@go-to-k/cdkd 0.320.0 → 0.322.0

package/dist/{provider-classes-BTOXS3cs.js → provider-classes-HcyJmeJE.js}

@@ -2,13 +2,13 @@ import { r as getAwsClients, s as withApiGatewayPacing } from "./aws-clients-DWp
 import { $ as safeMsg, A as isBeforeStateRead, E as generatedNameFor, J as displaySafe, N as recordedGeneratedNameKept, O as getCurrentStackInstanceId, Q as plainIdentOr, T as generateResourceNameWithFallback, V as SECRET_REF_MAX_CODE_POINTS, X as isPasteableIdent, Y as displayStackName, a as safeStringify, i as isAwsAuthoredFailure, n as describeAwsFailure, q as displayIdent, r as describeAwsStatusReason, s as getLogger, t as VERBOSE_POINTER, w as generateResourceName } from "./aws-failure-text-DiHodi76.js";
 import { $ as isTerminalDeleteFailure, A as setBounded, Ar as isThrottlingError, At as stateOrphanRecordRemedy, B as normalizeAwsTagsToCfn, C as AmbiguousCreateLatch, Cr as isExplicitDenyError, Ct as compositeIdFormatMessage, D as isInsideWindow, Dt as packCompositeId, E as createAttemptKey, Er as isTransientServerError, Et as logicalIdShown, F as assertRegionMatch, Fn as ResourceUpdateNotSupportedError, Ft as maskerOrIdentity, Gt as markAuxiliaryFailure, H as refusalTypeShown, I as VALUE_NOT_SHOWN, It as withDerivedNameMasks, J as deleteAfterProtectionFlipWithFinalSnapshot, K as ProtectionFlipRegistry, Kt as markCreatedBeforeFailure, L as isPlainImportJson, M as RESOURCE_NOT_FOUND, Mr as markRedactedCause, Mt as createMaskedRetryLogger, Nn as ProvisioningError, Nr as wrapMaskedAwsError, Nt as isSecretDerivedValue, O as replayFollowedAmbiguousAttempt, Or as THROTTLING_ERROR_NAMES, P as markNotGone, Pt as maskDeep, Q as isTerminalDbWaitStatus, Qn as pasteableCommand, R as isPlainImportValue, S as AMBIGUOUS_LATCH_TTL_MS, Sr as isAmbiguousOutcomeError, St as canonicalizeRoute53QueryName, T as ambiguousAttemptLead, Tr as isRetryableTransientError, Tt as compositeIdSkipResult, U as remedyLogicalId, Ut as isAuxiliaryFailure, V as quotedRemedyLogicalId, W as resolveExplicitPhysicalId, Xn as hasClauseBreak, Y as deleteWithProtectionCompensation, Yn as commandHole, Z as isProceedDbStatus, Zn as isInertUnquoted, b as withRemovalDefaults, bt as isInterruptedWaitError, ct as UNNAMEABLE_ID_CLAUSE, d as onlySecretDerived, dn as withPasteableAwsProfile, dt as pasteableAwsCommand, er as plainOrDescribed, et as logGroupProtectionSite, f as readPrincipalLists, fn as ambientClientDefaults, ft as protectedReplacementAdvice, g as clearOnUpdateRemoval, gn as AccountIdUnavailableError, hn as credentialFingerprint, hr as relayedNameCollision, ht as ElapsedBudgetRegistry, i as reportCreatedResource, ir as withheldTargetClause, j as withoutServerErrorRetries, jr as markNonRetryable, jt as createMaskedLogSinks, k as replayedSendWindow, kr as isMarkedNonRetryable, kt as segmentAfterAnchor, l as SECRET_DERIVED_READ_LIVE, lt as WITHHELD_AWS_COMMAND, m as recordedPrincipalsRepair, mn as clientDefaultsFor, mr as markReplayMayCollide, mt as ElapsedBudget, nt as protectionFlipKey, o as retractCreatedResource, on as injectiveKey, ot as userPoolProtectionSite, pn as ambientCredentialConfig, pr as markNameCollision, pt as renderDisableCommand, qt as markSupersedesEarlierCreate, rr as shellQuote, rt as rdsFamilyProtectionSite, sn as injectiveKeyPrefix, tt as observeThenDisableProtection, u as holdsSecretDerivedEntry, ut as isAwsCliLiteral, vn as CdkdError, w as RecentIdSet, wt as compositeIdSeparatorRefusal, xt as startInterruptWatch, y as removedTemplateKeys, yr as explicitDenyPolicyKind, z as isQuotableImportValue, zt as clearCreatedBeforeFailure } from "./created-resource-sink-CmrPwGge.js";
 import { c as ambientRegion } from "./aws-client-defaults-BLXFsfMa.js";
-import { $ as sendTtlWaitingOutRateLimit, A as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, B as deleteTableWithIndexBusyRetry, Ba as s3BucketArn, Bc as passedNoEchoParametersOf, Bi as isRefusedByName, C as planContributorInsightsOp, Cl as recordAttributeIdCopy, Ct as enclosingDeadlineExpired, D as reverseMapTableContributorInsights, Da as reDisableInstanceApiTermination, Dc as lambdaFunctionNameForMask, E as reverseMapIndexContributorInsights, Ea as observeThenDisableInstanceApiTermination, Ec as canonicalLambdaFunctionName, El as carriesSecretMask, Eo as parseWebACLArn, F as resolveDynamoDbDeleteBudgetClock, Fd as displayAssemblyPath, G as readbackVectorIndexes, Gi as readTagList, Gn as isRedactedRecordedValue, H as relayedIndexBusyDelete, Ha as s3BucketDualStackDomainName, Hi as DBPROXY_TAGS_WHAT, Hn as getCurrentProducerRegions, I as resolveDynamoDbDeleteBudgetMs, Id as renderAssemblyPathEscape, Ii as acquireIdempotencyToken, Io as accountArgs, J as vectorIndexesShapeDetail, Jc as recordReferenceProvenanceEntry, Ji as tagPlanWarning, Js as withoutSilentDropProperties, Jt as getCurrentNestedStackContext, K as vectorIndexesForCreate, Kc as markSameGenerationBag, Ki as refuseMalformedDesiredTags, Kn as redactedDeleteAddressFields, Ks as findSilentDropProperties, L as DELETE_INDEX_WAIT_PROCEED_NOTE, Ld as resolveAssemblyPath, M as beginDeleteWait, Mi as earliestDefined, N as compensateRemovedDeletionProtection, O as stripIndexContributorInsights, Oa as reEnableInstanceApiTermination, Oc as sameLambdaFunctionAddress, P as deleteBudgetKey, Pd as describeFileReadFailure, Pi as reserveStackCreateToken, Q as readTtlSpec, Qc as hasMaskableValues, R as INDEX_SETTLE_POLL_INTERVAL_MS, S as indexDeclaresContributorInsights, Sa as markWaitAbandoned, Sc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, Sl as physicalNameCopiesOf, T as readContributorInsightsSpec, Ta as isTerminationProtectionPropagationError, Tc as emrClusterInstancesReplaced, U as waitForIndexesSettled, Ua as s3BucketRegionalDomainName, Ui as DBPROXY_TAG_OPTIONS, Ur as replacedDeleteFailureVerdict, Us as withheldAccountClause, V as maskedLogger, Va as s3BucketDomainName, Vi as markDeleteStarted, Vr as getStackRecords, Vt as getNestedRevertRun, W as planVectorIndexUpdates, Wa as s3BucketWebsiteUrl, Wi as planTagDiff, Wn as REDACTED_DELETE_ADDRESS_SKIP_REASON, Wt as revertNestedChildFromJournal, X as isTtlRateLimited, Xi as stringifyIfAssigned, Y as isTtlAlreadyDisabled, Ya as outputReferenceProvenanceOf, Yc as snapshotPassProvenance, Yi as definedAttributes, Yt as withNestedStackContext, Z as planTimeToLive, _ as streamMemberRefusals, _c as requireConfigString, _d as decodeListingKey, _t as renderNestedTemplateTreeDefect, ac as isWarmThroughputDecrease, an as chunks, at as markRefusedBeforeApplying, b as CONTRIBUTOR_INSIGHTS_KEY, ba as withIndeterminateGuard, bd as canonicalizeRegion, c as DynamoDBGlobalTableProvider, cc as coerceCfnBoolean, cn as withApiLimit, d as declaredStreamPolicyMember, dc as configIntegerRefusal, ds as refuseMalformedNestedChildOutputs, et as ECR_AUTO_DELETE_IMAGES_TAG, f as declaredStreamTagsMember, fa as slowCcOperationTimeoutMs, fc as configStringRefusal, fl as withoutPhysicalNameCopies, g as streamDeclaresTags, gc as requireConfigObject, gt as listNestedTemplateRows, h as streamDeclaresPolicy, hc as requireConfigArray, ho as getAccountInfo, ht as isAbsoluteAssetPath, ic as coerceWarmThroughput$1, it as getPriorAttempts, j as DYNAMODB_DELETE_POLL_COST_MS, ja as isUsableAttemptedName, js as refuseMalformedResourcesForDestroy, k as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, ko as passedParameterClassesOf, l as STREAM_POLICY_KEY, lc as coerceCfnInteger, m as reverseMapStreamPolicy, ma as unchangedBehindSecretReference, mc as replayWarn, ml as dynamicReferenceTokens, mt as findNestedTemplateTreeDefect, na as waitForLambdaFunctionActive, nt as hasCdkAutoDeleteTag, oa as getCurrentResourceSecrets, oc as toCfnInteger, on as isAccessDeniedError, p as planStreamMemberOps, pa as onlySecretReferencesDiffer, pc as readConfigString, pu as stringifyValue, q as vectorIndexesSettled, qc as redactForState, qi as tagMapAsList, qn as redactedDeleteAddressSkip, rc as WARM_THROUGHPUT_MEMBERS, rt as isTruthyCfnBoolean, sc as toFiniteNumber, sn as lookupEachName, t as DeployEngine, tt as S3_AUTO_DELETE_OBJECTS_TAG, u as STREAM_TAGS_KEY, uc as configBooleanRefusal, uu as timePhase, v as streamPolicyMatchesDeclared, vu as rewriteTemplateAssetReferences, w as planIndexContributorInsightsOps, wa as ec2InstanceProtectionSite, wc as ecsServiceLaunchTypeSetOrChanged, wt as enclosingDeadlineRemainingMs, x as contributorInsightsRefusals, xa as isWaitAbandonedError, xc as withRetry, xd as derivePartitionAndUrlSuffix, xl as recoverMaskedOutput, y as streamTagsMatchDeclared, ya as deleteSkipReason, yi as secretNamedAttributeNamesOf, z as TABLE_INDEX_NOUN, za as isSettledInstanceState, zr as awaitInFlightSibling } from "./deploy-engine-BiJyU4j1.js";
-import { a as IamCreateClientCache, i as isEntityAlreadyExists, n as collectInlinePolicyNamesManagedBySiblings, r as iamEntityLeftByThisCreate, t as IAMRoleProvider } from "./iam-role-provider-FsEgUieT.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-Dm0hn2Sn.js";
+import { $ as isTtlRateLimited, $i as stringifyIfAssigned, A as resolvedResourceTimeoutMs, Aa as reEnableInstanceApiTermination, Ac as sameLambdaFunctionAddress, B as DELETE_INDEX_WAIT_PROCEED_NOTE, C as planContributorInsightsOp, Ca as withIndeterminateGuard, Cc as withRetry, Cd as derivePartitionAndUrlSuffix, Cl as recoverMaskedOutput, D as reverseMapTableContributorInsights, Da as isTerminationProtectionPropagationError, Dc as emrClusterInstancesReplaced, Dt as enclosingDeadlineRemainingMs, E as reverseMapIndexContributorInsights, Ea as ec2InstanceProtectionSite, Ec as ecsServiceLaunchTypeSetOrChanged, Et as enclosingDeadlineExpired, F as beginDeleteWait, Fi as earliestDefined, G as relayedIndexBusyDelete, Ga as s3BucketRegionalDomainName, Gi as DBPROXY_TAGS_WHAT, Gn as getCurrentProducerRegions, Gs as withheldAccountClause, H as TABLE_INDEX_NOUN, Ha as s3BucketArn, Hc as passedNoEchoParametersOf, Hr as awaitInFlightSibling, I as compensateRemovedDeletionProtection, Id as describeFileReadFailure, J as readbackVectorIndexes, Jc as markSameGenerationBag, Ji as readTagList, Jn as isRedactedRecordedValue, Js as findSilentDropProperties, K as waitForIndexesSettled, Ka as s3BucketWebsiteUrl, Ki as DBPROXY_TAG_OPTIONS, Kr as replacedDeleteFailureVerdict, L as deleteBudgetKey, Ld as displayAssemblyPath, Li as reserveStackCreateToken, M as DYNAMODB_DELETE_DEADLINE_MARGIN_MS, N as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Na as isUsableAttemptedName, Ns as refuseMalformedResourcesForDestroy, O as stripIndexContributorInsights, Oa as observeThenDisableInstanceApiTermination, Oc as canonicalLambdaFunctionName, Ol as carriesSecretMask, Oo as parseWebACLArn, P as DYNAMODB_DELETE_POLL_COST_MS, Q as isTtlAlreadyDisabled, Qi as definedAttributes, Qt as withNestedStackContext, R as resolveDynamoDbDeleteBudgetClock, Rd as renderAssemblyPathEscape, Ro as accountArgs, S as indexDeclaresContributorInsights, Sa as deleteSkipReason, Sd as canonicalizeRegion, Si as secretNamedAttributeNamesOf, T as readContributorInsightsSpec, Tl as recordAttributeIdCopy, U as deleteTableWithIndexBusyRetry, Ua as s3BucketDomainName, Ui as isRefusedByName, V as INDEX_SETTLE_POLL_INTERVAL_MS, Va as isSettledInstanceState, Vr as refuseRestoreFromItself, W as maskedLogger, Wa as s3BucketDualStackDomainName, Wi as markDeleteStarted, Wr as getStackRecords, Wt as getNestedRevertRun, X as vectorIndexesSettled, Xc as recordReferenceProvenanceEntry, Xi as tagMapAsList, Xn as redactedDeleteAddressSkip, Xs as withoutSilentDropProperties, Y as vectorIndexesForCreate, Yc as redactForState, Yi as refuseMalformedDesiredTags, Yn as redactedDeleteAddressFields, Z as vectorIndexesShapeDetail, Za as outputReferenceProvenanceOf, Zc as snapshotPassProvenance, Zi as tagPlanWarning, Zt as getCurrentNestedStackContext, _ as streamMemberRefusals, _a as unchangedBehindSecretReference, _c as requireConfigArray, _o as getAccountInfo, _t as findNestedTemplateTreeDefect, aa as waitForLambdaFunctionActive, ac as WARM_THROUGHPUT_MEMBERS, at as hasCdkAutoDeleteTag, b as CONTRIBUTOR_INSIGHTS_KEY, bt as renderNestedTemplateTreeDefect, bu as rewriteTemplateAssetReferences, c as DynamoDBGlobalTableProvider, cc as toCfnInteger, cn as chunks, ct as markRefusedBeforeApplying, d as declaredStreamPolicyMember, dc as coerceCfnInteger, dn as withApiLimit, el as hasMaskableValues, et as planTimeToLive, f as declaredStreamTagsMember, fc as configBooleanRefusal, fu as timePhase, g as streamDeclaresTags, ga as onlySecretReferencesDiffer, gc as replayWarn, gl as dynamicReferenceTokens, h as streamDeclaresPolicy, ha as slowCcOperationTimeoutMs, hc as readConfigString, hu as stringifyValue, it as S3_AUTO_DELETE_OBJECTS_TAG, jo as passedParameterClassesOf, k as waitForGoneAfterDelete, ka as reDisableInstanceApiTermination, kc as lambdaFunctionNameForMask, l as STREAM_POLICY_KEY, la as getCurrentResourceSecrets, lc as toFiniteNumber, ln as isAccessDeniedError, m as reverseMapStreamPolicy, mc as configStringRefusal, ml as withoutPhysicalNameCopies, nt as sendTtlWaitingOutRateLimit, oc as coerceWarmThroughput$1, ot as isTruthyCfnBoolean, p as planStreamMemberOps, pc as configIntegerRefusal, ps as refuseMalformedNestedChildOutputs, q as planVectorIndexUpdates, qi as planTagDiff, qn as REDACTED_DELETE_ADDRESS_SKIP_REASON, qt as revertNestedChildFromJournal, rt as ECR_AUTO_DELETE_IMAGES_TAG, sc as isWarmThroughputDecrease, st as getPriorAttempts, t as DeployEngine, tt as readTtlSpec, u as STREAM_TAGS_KEY, uc as coerceCfnBoolean, un as lookupEachName, v as streamPolicyMatchesDeclared, vc as requireConfigObject, vt as isAbsoluteAssetPath, w as planIndexContributorInsightsOps, wc as blockDeviceMappingsDifferOnlyInDeleteOnTermination, wl as physicalNameCopiesOf, x as contributorInsightsRefusals, y as streamTagsMatchDeclared, yc as requireConfigString, yd as decodeListingKey, yt as listNestedTemplateRows, z as resolveDynamoDbDeleteBudgetMs, zd as resolveAssemblyPath, zi as acquireIdempotencyToken } from "./deploy-engine-BC5pwkqY.js";
+import { a as IamCreateClientCache, i as isEntityAlreadyExists, n as collectInlinePolicyNamesManagedBySiblings, r as iamEntityLeftByThisCreate, t as IAMRoleProvider } from "./iam-role-provider-CHwvGLRj.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, t as canonicalizeIpv4Cidr } from "./program-DdncAAar.js";
 import { n as modifyDbInstanceWhenAvailable } from "./db-instance-modify-retry-DCLA_p9I.js";
-import { RDSProvider } from "./rds-provider-C_r5q9NM.js";
-import { NeptuneProvider } from "./neptune-provider-DjjNodrS.js";
-import { ASGProvider } from "./asg-provider-B4XVfH0S.js";
+import { RDSProvider } from "./rds-provider-CFm779-M.js";
+import { NeptuneProvider } from "./neptune-provider-BQ92M2BH.js";
+import { ASGProvider } from "./asg-provider-BymHNHgo.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, CreateBucketMetadataConfigurationCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetadataConfigurationCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAbacCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketMetadataConfigurationCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAbacCommand, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, UpdateBucketMetadataAnnotationTableConfigurationCommand, UpdateBucketMetadataInventoryTableConfigurationCommand, UpdateBucketMetadataJournalTableConfigurationCommand } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateGroupCommand, UpdateLoginProfileCommand, UpdateUserCommand } from "@aws-sdk/client-iam";
@@ -44,7 +44,7 @@ import * as zlib from "node:zlib";
 import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteAccessLogSettingsCommand, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteCorsConfigurationCommand, DeleteIntegrationCommand as DeleteIntegrationCommand$1, DeleteRouteCommand as DeleteRouteCommand$1, DeleteRouteRequestParameterCommand, DeleteRouteSettingsCommand, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetApisCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetAuthorizersCommand as GetAuthorizersCommand$1, GetIntegrationCommand, GetIntegrationsCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
 import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$12, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
 import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, ListTaskDefinitionsCommand, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateClusterCommand, UpdateServiceCommand, waitUntilServicesStable } from "@aws-sdk/client-ecs";
-import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DescribeGlobalClustersCommand as DescribeGlobalClustersCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveFromGlobalClusterCommand as RemoveFromGlobalClusterCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
+import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClusterSnapshotsCommand, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DescribeGlobalClustersCommand as DescribeGlobalClustersCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveFromGlobalClusterCommand as RemoveFromGlobalClusterCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3, RestoreDBClusterFromSnapshotCommand, RestoreDBClusterToPointInTimeCommand } from "@aws-sdk/client-docdb";
 import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
 import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$11, SetUserPoolMfaConfigCommand, UntagResourceCommand as UntagResourceCommand$18, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
 import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$15, NamespaceNotFound, ResourceInUse, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$19, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
@@ -12497,57 +12497,6 @@ function versionOfArn(arn) {
 	return match ? Number(match[1]) : void 0;
 }
 
-// src/provisioning/delete-gone-wait.ts
-async function waitForGoneAfterDelete(opts) {
-	const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-	const now = opts.now ?? Date.now;
-	const userTimeoutMs = resolvedResourceTimeoutMs(opts.resourceType);
-	const maxWaitMs = userTimeoutMs === void 0 ? opts.maxWaitMs : Math.min(opts.maxWaitMs, userTimeoutMs / 2);
-	const startedAt = now();
-	const stopped = `${opts.what}: the delete was ACCEPTED by AWS, but cdkd stopped waiting for it to disappear`;
-	const consequence = "AWS finishes the delete on its side; until it does, a create of the same name is refused with \"already exists\".";
-	const watch = startInterruptWatch(`${opts.what} deletion wait`);
-	try {
-		let lastStatus;
-		let sawNonFailedStatus = false;
-		for (;;) {
-			if (watch.isInterrupted()) {
-				opts.logger.warn(safeMsg`${stopped} (interrupted). ${consequence}`);
-				return;
-			}
-			try {
-				const status = await opts.describe();
-				if (status === void 0) {
-					opts.logger.debug(safeMsg`${opts.what} is gone`);
-					return;
-				}
-				const failure = opts.failedStatus?.(status);
-				if (failure !== void 0) {
-					if (sawNonFailedStatus || now() - startedAt >= opts.pollIntervalMs) throw markWaitAbandoned(failure);
-				} else sawNonFailedStatus = true;
-				lastStatus = status;
-				opts.logger.debug(safeMsg`${opts.what} status: ${status}, waiting for it to disappear`);
-			} catch (error) {
-				if (isWaitAbandonedError(error)) throw error;
-				if (!isThrottlingError(error) && !isTransientServerError(error)) {
-					opts.logger.debug(safeMsg`${opts.what}: status read failed: ${describeAwsFailure(error).detail}`);
-					opts.logger.warn(safeMsg`${stopped}: its status could not be read (${describeAwsFailure(error).summary}). ${consequence}`);
-					return;
-				}
-				opts.logger.debug(safeMsg`${opts.what}: status read throttled or failed transiently, re-polling`);
-			}
-			const remainingMs = maxWaitMs - (now() - startedAt);
-			if (remainingMs <= 0) {
-				opts.logger.warn(safeMsg`${stopped} after ${Math.round(maxWaitMs / 1e3)}s` + safeMsg`${lastStatus !== void 0 ? ` (last status: ${lastStatus})` : ""}. ${consequence}`);
-				return;
-			}
-			await sleep(Math.min(opts.pollIntervalMs, remainingMs));
-		}
-	} finally {
-		watch.dispose();
-	}
-}
-
 // src/provisioning/providers/dynamodb-table-provider.ts
 function isTableName(id) {
 	return /^[A-Za-z0-9_.-]{3,255}$/.test(id);
@@ -31761,6 +31710,82 @@ function instanceAttributes(instance) {
 function isDbIdentifier(id) {
 	return id.length <= 63 && /^[A-Za-z](?:-?[A-Za-z0-9])*$/.test(id);
 }
+const ZONED_TIMESTAMP = /^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:z|[+-]\d{2}:?\d{2})$/i;
+function readDocDBClusterRestore(properties, resourceType, logicalId) {
+	const refuse = (reason) => {
+		throw markNonRetryable(new ProvisioningError(safeMsg`DocDB DBCluster ${logicalId}: ${reason}, as CloudFormation requires; nothing was changed.`, resourceType, logicalId));
+	};
+	const identifier = (key) => {
+		const value = properties[key];
+		if (value == null) return void 0;
+		return typeof value === "string" ? value || void 0 : refuse(`${key} must be a string`);
+	};
+	const snapshotIdentifier = identifier("SnapshotIdentifier");
+	const sourceDBClusterIdentifier = identifier("SourceDBClusterIdentifier");
+	if (snapshotIdentifier !== void 0 && sourceDBClusterIdentifier !== void 0) return refuse("SnapshotIdentifier and SourceDBClusterIdentifier cannot both be set");
+	if (sourceDBClusterIdentifier === void 0) return snapshotIdentifier === void 0 ? void 0 : {
+		kind: "snapshot",
+		snapshotIdentifier
+	};
+	const declaredTime = properties["RestoreToTime"];
+	let restoreToTime;
+	if (declaredTime != null && declaredTime !== "") {
+		restoreToTime = typeof declaredTime === "string" && ZONED_TIMESTAMP.test(declaredTime) ? new Date(declaredTime) : void 0;
+		if (restoreToTime === void 0 || Number.isNaN(restoreToTime.getTime())) return refuse("RestoreToTime must be a timestamp with a time zone, such as 2026-01-01T00:00:00Z");
+	}
+	const declaredLatest = properties["UseLatestRestorableTime"];
+	const latest = declaredLatest == null ? false : coerceCfnBoolean(declaredLatest);
+	if (latest === void 0) return refuse("UseLatestRestorableTime must be a boolean");
+	if (restoreToTime !== void 0 && latest) return refuse("RestoreToTime and UseLatestRestorableTime: true cannot both be set");
+	if (restoreToTime === void 0 && !latest) return refuse("a SourceDBClusterIdentifier restore needs RestoreToTime or UseLatestRestorableTime: true");
+	const restoreType = properties["RestoreType"];
+	if (restoreType != null && typeof restoreType !== "string") return refuse("RestoreType must be a string");
+	return {
+		kind: "point-in-time",
+		sourceDBClusterIdentifier,
+		restoreToTime
+	};
+}
+function unusedRestoreKeys(properties, restore) {
+	return (restore?.kind === "point-in-time" ? ["GlobalClusterIdentifier", "AvailabilityZones"] : [
+		"RestoreType",
+		"RestoreToTime",
+		"UseLatestRestorableTime",
+		...restore === void 0 ? [] : ["GlobalClusterIdentifier"]
+	]).filter((key) => properties[key] != null && properties[key] !== "" && properties[key] !== false);
+}
+const CLUSTER_AVAILABLE_MAX_WAIT_MS = 18e5;
+function restoreWaitMs() {
+	const remaining = enclosingDeadlineRemainingMs() - DEADLINE_MARGIN_MS;
+	return Number.isFinite(remaining) ? Math.max(CLUSTER_AVAILABLE_MAX_WAIT_MS, remaining) : CLUSTER_AVAILABLE_MAX_WAIT_MS;
+}
+const RESTORE_VALUE_REFUSALS = /* @__PURE__ */ new Set(["InvalidParameterValue", "InvalidParameterCombination"]);
+function docdbRestoreFollowUp(properties, restore, password, managedPassword) {
+	const nonEmpty = (members) => Object.values(members).some((value) => value !== void 0) ? members : void 0;
+	const retention = numberOrUndefined(properties["BackupRetentionPeriod"]);
+	const windows = {
+		PreferredBackupWindow: properties["PreferredBackupWindow"],
+		PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"]
+	};
+	const snapshot = restore.kind === "snapshot";
+	return {
+		parity: nonEmpty({
+			DBClusterParameterGroupName: properties["DBClusterParameterGroupName"],
+			...snapshot && {
+				BackupRetentionPeriod: retention,
+				...windows
+			}
+		}),
+		declared: [
+			...snapshot ? [] : [nonEmpty({ BackupRetentionPeriod: retention }), nonEmpty(windows)],
+			nonEmpty({ MasterUserPassword: password }),
+			nonEmpty({
+				ManageMasterUserPassword: managedPassword === true ? true : void 0,
+				MasterUserSecretKmsKeyId: managedPassword === true ? properties["MasterUserSecretKmsKeyId"] : void 0
+			})
+		].filter((group) => group !== void 0)
+	};
+}
 var DocDBProvider = class {
 	docdbClient;
 	createClient;
@@ -31780,6 +31805,11 @@ var DocDBProvider = class {
 		"MasterUserPassword",
 		"RotateMasterUserPassword",
 		"GlobalClusterIdentifier",
+		"SnapshotIdentifier",
+		"SourceDBClusterIdentifier",
+		"RestoreToTime",
+		"RestoreType",
+		"UseLatestRestorableTime",
 		...DOCDB_CLUSTER_KEPT_ON_REMOVAL,
 		...DOCDB_CLUSTER_UNMEASURED_ON_REMOVAL
 	])], ["AWS::DocDB::DBInstance", /* @__PURE__ */ new Set([
@@ -31817,7 +31847,12 @@ var DocDBProvider = class {
 		"NetworkType",
 		"RotateMasterUserPassword",
 		"ServerlessV2ScalingConfiguration",
-		"StorageType"
+		"StorageType",
+		"RestoreToTime",
+		"RestoreType",
+		"SnapshotIdentifier",
+		"SourceDBClusterIdentifier",
+		"UseLatestRestorableTime"
 	])], ["AWS::DocDB::DBInstance", /* @__PURE__ */ new Set([
 		"DBInstanceIdentifier",
 		"DBInstanceClass",
@@ -31888,43 +31923,75 @@ var DocDBProvider = class {
 			this.logger.warn(safeMsg`${logicalId} (${resourceType}): the recorded GlobalClusterIdentifier is unusable, so it is not sent.`);
 		}
 		const globalClusterId = docdbGlobalClusterId(properties["GlobalClusterIdentifier"]);
+		const restore = readDocDBClusterRestore(properties, resourceType, logicalId);
+		const unused = unusedRestoreKeys(properties, restore);
+		if (unused.length > 0) {
+			const call = restore === void 0 ? "create" : restore.kind === "snapshot" ? "snapshot restore" : "point-in-time restore";
+			this.logger.warn(safeMsg`${logicalId} (${resourceType}): this ${call} does not use ${unused.join(", ")}, as in CloudFormation.`);
+		}
 		const dbClusterIdentifier = properties["DBClusterIdentifier"] || generatedNameFor("AWS::DocDB::DBCluster", logicalId);
+		if (!String(properties["SourceDBClusterIdentifier"]).startsWith("arn:")) refuseRestoreFromItself(resourceType, properties, dbClusterIdentifier, logicalId, { region: this.providerRegion });
+		const port = properties["Port"] != null ? Number(properties["Port"]) : void 0;
+		const kmsKeyId = properties["KmsKeyId"];
+		const sharedInput = {
+			DBClusterIdentifier: dbClusterIdentifier,
+			VpcSecurityGroupIds: properties["VpcSecurityGroupIds"],
+			DBSubnetGroupName: properties["DBSubnetGroupName"],
+			KmsKeyId: kmsKeyId,
+			DeletionProtection: properties["DeletionProtection"],
+			CopyTagsToSnapshot: properties["CopyTagsToSnapshot"],
+			NetworkType: properties["NetworkType"],
+			StorageType: properties["StorageType"],
+			...logTypes !== void 0 && logTypes.length > 0 && { EnableCloudwatchLogsExports: logTypes },
+			...scaling != null && { ServerlessV2ScalingConfiguration: scaling },
+			...tags.length > 0 && { Tags: tags }
+		};
+		const restorePort = port ?? DOCDB_DEFAULT_PORT;
+		if (restore !== void 0) await this.refuseUnencryptedRestoreSource(properties, restore, resourceType, logicalId, mask);
 		let clusterCreated = false;
 		let createdResourceId;
 		try {
-			const response = await this.getCreateClient().send(new CreateDBClusterCommand$1({
-				DBClusterIdentifier: dbClusterIdentifier,
+			const response = await (restore === void 0 ? this.getCreateClient().send(new CreateDBClusterCommand$1({
+				...sharedInput,
 				Engine: "docdb",
 				EngineVersion: properties["EngineVersion"],
 				MasterUsername: properties["MasterUsername"],
 				MasterUserPassword: password,
-				Port: properties["Port"] != null ? Number(properties["Port"]) : void 0,
-				VpcSecurityGroupIds: properties["VpcSecurityGroupIds"],
-				DBSubnetGroupName: properties["DBSubnetGroupName"],
+				Port: port,
 				StorageEncrypted: properties["StorageEncrypted"],
-				KmsKeyId: properties["KmsKeyId"],
-				BackupRetentionPeriod: properties["BackupRetentionPeriod"] != null ? Number(properties["BackupRetentionPeriod"]) : void 0,
+				BackupRetentionPeriod: numberOrUndefined(properties["BackupRetentionPeriod"]),
 				PreferredBackupWindow: properties["PreferredBackupWindow"],
 				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
 				DBClusterParameterGroupName: properties["DBClusterParameterGroupName"],
-				DeletionProtection: properties["DeletionProtection"],
 				AvailabilityZones: properties["AvailabilityZones"],
-				CopyTagsToSnapshot: properties["CopyTagsToSnapshot"],
 				ManageMasterUserPassword: managedPassword,
 				MasterUserSecretKmsKeyId: properties["MasterUserSecretKmsKeyId"],
-				NetworkType: properties["NetworkType"],
-				StorageType: properties["StorageType"],
-				...globalClusterId !== void 0 && { GlobalClusterIdentifier: globalClusterId },
-				...logTypes !== void 0 && logTypes.length > 0 && { EnableCloudwatchLogsExports: logTypes },
-				...scaling != null && { ServerlessV2ScalingConfiguration: scaling },
-				...tags.length > 0 && { Tags: tags }
-			}));
+				...globalClusterId !== void 0 && { GlobalClusterIdentifier: globalClusterId }
+			})) : restore.kind === "snapshot" ? this.getCreateClient().send(new RestoreDBClusterFromSnapshotCommand({
+				...sharedInput,
+				SnapshotIdentifier: restore.snapshotIdentifier,
+				Engine: "docdb",
+				EngineVersion: properties["EngineVersion"],
+				Port: restorePort,
+				AvailabilityZones: properties["AvailabilityZones"]
+			})) : this.getCreateClient().send(new RestoreDBClusterToPointInTimeCommand({
+				...sharedInput,
+				SourceDBClusterIdentifier: restore.sourceDBClusterIdentifier,
+				RestoreType: properties["RestoreType"],
+				...restore.restoreToTime !== void 0 ? { RestoreToTime: restore.restoreToTime } : { UseLatestRestorableTime: true },
+				Port: restorePort
+			})));
 			clusterCreated = true;
 			createdResourceId = response.DBCluster?.DbClusterResourceId;
 			reportCreatedResource(logicalId, resourceType, dbClusterIdentifier, createdResourceId);
-			if (!response.DBCluster) throw new Error("CreateDBCluster did not return DBCluster");
+			const cluster = response.DBCluster;
+			if (!cluster) throw new Error("The create call did not return DBCluster");
 			this.logger.debug(`Successfully created DocDB DBCluster ${logicalId}: ${dbClusterIdentifier}`);
-			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterAvailable(logicalId, dbClusterIdentifier);
+			const followUp = restore === void 0 ? void 0 : docdbRestoreFollowUp(properties, restore, password, managedPassword);
+			const followingUp = followUp !== void 0 && (followUp.parity !== void 0 || followUp.declared.length > 0);
+			if (followingUp || process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterAvailable(logicalId, dbClusterIdentifier, restore === void 0 ? void 0 : restoreWaitMs());
+			if (followUp !== void 0 && followingUp) await this.sendRestoreFollowUp(logicalId, resourceType, dbClusterIdentifier, followUp, mask);
+			if (restore !== void 0) this.warnRestoredDifferences(logicalId, resourceType, properties, restore, cluster);
 			return {
 				physicalId: dbClusterIdentifier,
 				attributes: clusterAttributes(await this.describeDBCluster(dbClusterIdentifier))
@@ -31935,6 +32002,74 @@ var DocDBProvider = class {
 			throw thrown;
 		}
 	}
+	async refuseUnencryptedRestoreSource(properties, restore, resourceType, logicalId, mask) {
+		if (coerceCfnBoolean(properties["StorageEncrypted"]) !== true) return;
+		if (properties["KmsKeyId"] != null && properties["KmsKeyId"] !== "") return;
+		let encrypted;
+		try {
+			if (restore.kind === "snapshot") {
+				const snapshot = (await this.getClient().send(new DescribeDBClusterSnapshotsCommand({
+					DBClusterSnapshotIdentifier: restore.snapshotIdentifier,
+					IncludeShared: true,
+					IncludePublic: true
+				}))).DBClusterSnapshots?.[0];
+				if (snapshot === void 0) return;
+				encrypted = snapshot.StorageEncrypted;
+			} else {
+				const source = await this.describeDBCluster(restore.sourceDBClusterIdentifier);
+				if (source === void 0) return;
+				encrypted = source.StorageEncrypted;
+			}
+		} catch (error) {
+			const fault = restore.kind === "snapshot" ? "DBClusterSnapshotNotFoundFault" : "DBClusterNotFoundFault";
+			if (isDocDBNotFoundError(error, fault)) return;
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to create DocDB DBCluster ${logicalId}: reading whether the restore source is encrypted failed, so nothing was changed: ${text}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0));
+		}
+		if (encrypted === true) return;
+		throw markNonRetryable(new ProvisioningError(safeMsg`DocDB DBCluster ${logicalId}: StorageEncrypted is true, but the restore source does not read as encrypted and no KmsKeyId is set. Set KmsKeyId (alias/aws/rds is the default key), as CloudFormation requires; nothing was changed.`, resourceType, logicalId));
+	}
+	async sendRestoreFollowUp(logicalId, resourceType, physicalId, followUp, mask) {
+		const send = (members) => modifyDbInstanceWhenAvailable({
+			send: () => this.getClient().send(new ModifyDBClusterCommand$1({
+				DBClusterIdentifier: physicalId,
+				...members,
+				ApplyImmediately: true
+			})),
+			readStatus: async () => (await this.describeDBCluster(physicalId))?.Status,
+			sleep: (ms) => this.sleep(ms),
+			logger: this.logger,
+			label: "DocDB DBCluster",
+			subject: "cluster",
+			logicalId,
+			remainingMs: enclosingDeadlineRemainingMs()
+		});
+		if (followUp.parity !== void 0) await send(followUp.parity);
+		const refused = async (members) => {
+			try {
+				await send(members);
+				return false;
+			} catch (error) {
+				if (error instanceof Error && RESTORE_VALUE_REFUSALS.has(error.name)) {
+					this.logger.debug(safeMsg`${error.name} after restoring ${logicalId}: ${maskerOrIdentity(mask)(error.message)}`);
+					return true;
+				}
+				throw error;
+			}
+		};
+		const { declared } = followUp;
+		if (declared.length > 0 && await refused(Object.assign({}, ...declared))) {
+			const keys = [];
+			for (const group of declared) if (declared.length === 1 || await refused(group)) keys.push(...Object.keys(group).filter((key) => group[key] !== void 0));
+			if (keys.length > 0) this.logger.warn(safeMsg`${logicalId} (${resourceType}): AWS refused ${keys.join(", ")} after the restore, so the cluster keeps its restored values. The record holds the declared ones, so drift does not report the difference. An update sends a declared BackupRetentionPeriod or window again; the password settings only once the template changes them.`);
+		}
+		if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterAvailable(logicalId, physicalId, restoreWaitMs());
+	}
+	warnRestoredDifferences(logicalId, resourceType, properties, restore, cluster) {
+		const differs = (key, live) => properties[key] != null && live !== void 0 && String(properties[key]) !== live;
+		const keys = [...differs("MasterUsername", cluster.MasterUsername) ? ["MasterUsername"] : [], ...restore.kind === "point-in-time" && differs("EngineVersion", cluster.EngineVersion) ? ["EngineVersion"] : []];
+		if (keys.length === 0) return;
+		this.logger.warn(safeMsg`${logicalId} (${resourceType}): the restored cluster keeps its source's ${keys.join(", ")}, not the template's, as in CloudFormation: a restore does not set ${keys.length === 1 ? "it" : "them"}. cdkd drift does not report the difference: its baseline is the readback taken at deploy.`);
+	}
 	async updateDBCluster(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating DocDB DBCluster ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
@@ -32592,7 +32727,7 @@ var DocDBProvider = class {
 			remainingMs: enclosingDeadlineRemainingMs()
 		});
 	}
-	async waitForClusterAvailable(logicalId, dbClusterIdentifier, maxWaitMs = 18e5) {
+	async waitForClusterAvailable(logicalId, dbClusterIdentifier, maxWaitMs = CLUSTER_AVAILABLE_MAX_WAIT_MS) {
 		const startTime = Date.now();
 		let delay = 5e3;
 		while (Date.now() - startTime < maxWaitMs) {
@@ -32662,7 +32797,12 @@ var DocDBProvider = class {
 			"AvailabilityZones",
 			"GlobalClusterIdentifier",
 			"MasterUserSecretKmsKeyId",
-			"RotateMasterUserPassword"
+			"RestoreToTime",
+			"RestoreType",
+			"RotateMasterUserPassword",
+			"SnapshotIdentifier",
+			"SourceDBClusterIdentifier",
+			"UseLatestRestorableTime"
 		];
 		if (resourceType === "AWS::DocDB::DBInstance") return ["CertificateRotationRestart"];
 		return [];
@@ -48638,6 +48778,7 @@ var FirehoseProvider = class {
 		"IcebergDestinationConfiguration",
 		"MSKSourceConfiguration"
 	])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::KinesisFirehose::DeliveryStream", /* @__PURE__ */ new Map([["DatabaseSourceConfiguration", "Database as a source was a public preview AWS removed on 2025-09-24 (Firehose document history); CreateDeliveryStream refused DeliveryStreamType DatabaseAsSource in every region probed, so an SDK path could not be verified. Stays on Cloud Control"], ["SnowflakeDestinationConfiguration", "Proving the wire shape live needs a real Snowflake account, and the block carries key material (PrivateKey, KeyPassphrase). Stays on Cloud Control"]])]]);
 	getClient() {
 		if (!this.client) {
 			this.client = new FirehoseClient({
@@ -55158,4 +55299,4 @@ var ACMCertificateProvider = class {
 };
 
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-BTOXS3cs.js.map
+//# sourceMappingURL=provider-classes-HcyJmeJE.js.map