@go-to-k/cdkd 0.254.1 → 0.256.0

package/dist/{deploy-engine-d-cwg8zS.js → deploy-engine-vUgwldVH.js}

@@ -8917,8 +8917,37 @@ function collectReferencedParameterNames(template) {
 var IntrinsicFunctionResolver = class {
 	logger = getLogger().child("IntrinsicFunctionResolver");
 	resolverRegion;
-	constructor(region) {
+	strictGetAtt;
+	/**
+	* Number of unknown-attribute resolutions that fell back to the physical
+	* ID (the warn path) since construction / the last
+	* {@link resetPhysicalIdFallbackCount}. Counting semantics (issue #1111
+	* item 3): the deploy engine resets this at the start of each `deploy()`
+	* run AND again right before provisioning on the change path — the diff
+	* phase resolves through this same counted resolver, so without the
+	* second reset a fallback site on a to-be-updated resource would count
+	* once during diff and again during provisioning (~2x distinct sites in
+	* the summary). Each distinct fallback site therefore counts once per
+	* run: the surfaced summary covers provisioning + output resolution on
+	* the change path, diff + output resolution on the no-change path, and
+	* diff only under --dry-run. Instance-scoped, so parallel stacks (each
+	* with their own engine + resolver) never share a counter; for the same
+	* reason a nested-stack CHILD engine's fallbacks are counted by the
+	* child's own resolver and are NOT aggregated into the parent stack's
+	* deploy summary.
+	*/
+	physicalIdFallbackCount = 0;
+	constructor(region, options) {
 		this.resolverRegion = region || process.env["AWS_REGION"] || "us-east-1";
+		this.strictGetAtt = options?.strictGetAtt ?? false;
+	}
+	/** Unknown-attribute physicalId fallbacks recorded since the last reset. */
+	getPhysicalIdFallbackCount() {
+		return this.physicalIdFallbackCount;
+	}
+	/** Reset the per-run fallback counter (called at the start of each deploy). */
+	resetPhysicalIdFallbackCount() {
+		this.physicalIdFallbackCount = 0;
 	}
 	/**
 	* Resolve parameter values from template Parameters section
@@ -9210,19 +9239,19 @@ var IntrinsicFunctionResolver = class {
 		if (resourceType === "AWS::DynamoDB::Table" || resourceType === "AWS::DynamoDB::GlobalTable") switch (attributeName) {
 			case "Arn": return `arn:${partition}:dynamodb:${region}:${accountId}:table/${physicalId}`;
 			case "StreamArn": return;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::S3::Bucket") switch (attributeName) {
 			case "Arn": return `arn:${partition}:s3:::${physicalId}`;
 			case "DomainName": return `${physicalId}.s3.amazonaws.com`;
 			case "RegionalDomainName": return `${physicalId}.s3.${region}.amazonaws.com`;
 			case "WebsiteURL": return `http://${physicalId}.s3-website-${region}.amazonaws.com`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::IAM::Role") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:role/${physicalId}`;
 			case "RoleId": return;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::EC2::VPC") switch (attributeName) {
 			case "VpcId": return physicalId;
@@ -9252,37 +9281,38 @@ var IntrinsicFunctionResolver = class {
 				return [];
 			}
 			case "DefaultSecurityGroup": return resource.attributes?.["DefaultSecurityGroup"] || physicalId;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::IAM::Policy") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:policy/${physicalId}`;
 			case "PolicyId": return;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::IAM::User") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:user/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::IAM::Group") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:group/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::IAM::InstanceProfile") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:instance-profile/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::KMS::Key") switch (attributeName) {
 			case "Arn": return `arn:${partition}:kms:${region}:${accountId}:key/${physicalId}`;
 			case "KeyId": return physicalId;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::Cognito::UserPool") switch (attributeName) {
 			case "Arn": return `arn:${partition}:cognito-idp:${region}:${accountId}:userpool/${physicalId}`;
-			default: return physicalId;
+			case "UserPoolId": return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::Kinesis::Stream") switch (attributeName) {
 			case "Arn": return `arn:${partition}:kinesis:${region}:${accountId}:stream/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::Events::Rule") switch (attributeName) {
 			case "Arn": {
@@ -9292,36 +9322,36 @@ var IntrinsicFunctionResolver = class {
 				const busName = bus.startsWith("arn:") ? bus.split("/").pop() || "" : bus;
 				return busName ? `arn:${partition}:events:${region}:${accountId}:rule/${busName}/${physicalId}` : `arn:${partition}:events:${region}:${accountId}:rule/${physicalId}`;
 			}
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::Events::EventBus") switch (attributeName) {
 			case "Arn": return `arn:${partition}:events:${region}:${accountId}:event-bus/${physicalId}`;
 			case "Name": return physicalId;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::EFS::FileSystem") switch (attributeName) {
 			case "Arn": return `arn:${partition}:elasticfilesystem:${region}:${accountId}:file-system/${physicalId}`;
 			case "FileSystemId": return physicalId;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::KinesisFirehose::DeliveryStream") switch (attributeName) {
 			case "Arn": return `arn:${partition}:firehose:${region}:${accountId}:deliverystream/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::CodeBuild::Project") switch (attributeName) {
 			case "Arn": return `arn:${partition}:codebuild:${region}:${accountId}:project/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::CloudTrail::Trail") switch (attributeName) {
 			case "Arn":
 				if (physicalId.startsWith("arn:")) return physicalId;
 				return `arn:${partition}:cloudtrail:${region}:${accountId}:trail/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::AppSync::GraphQLApi") switch (attributeName) {
 			case "Arn": return `arn:${partition}:appsync:${region}:${accountId}:apis/${physicalId}`;
 			case "ApiId": return physicalId;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::ServiceDiscovery::PrivateDnsNamespace" || resourceType === "AWS::ServiceDiscovery::HttpNamespace" || resourceType === "AWS::ServiceDiscovery::PublicDnsNamespace") switch (attributeName) {
 			case "Arn": return `arn:${partition}:servicediscovery:${region}:${accountId}:namespace/${physicalId}`;
@@ -9333,38 +9363,38 @@ var IntrinsicFunctionResolver = class {
 				this.logger.warn(`Failed to fetch HostedZoneId for namespace ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
 				return;
 			}
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::ServiceDiscovery::Service") switch (attributeName) {
 			case "Arn": return `arn:${partition}:servicediscovery:${region}:${accountId}:service/${physicalId}`;
 			case "Id": return physicalId;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::CloudWatch::Alarm") switch (attributeName) {
 			case "Arn": return `arn:${partition}:cloudwatch:${region}:${accountId}:alarm:${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::CloudWatch::CompositeAlarm") switch (attributeName) {
 			case "Arn": return `arn:${partition}:cloudwatch:${region}:${accountId}:alarm:${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::RDS::DBInstance" || resourceType === "AWS::DocDB::DBInstance" || resourceType === "AWS::Neptune::DBInstance") switch (attributeName) {
 			case "DBInstanceArn":
 			case "Arn": return `arn:${partition}:rds:${region}:${accountId}:db:${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::RDS::DBCluster" || resourceType === "AWS::DocDB::DBCluster" || resourceType === "AWS::Neptune::DBCluster") switch (attributeName) {
 			case "DBClusterArn":
 			case "Arn": return `arn:${partition}:rds:${region}:${accountId}:cluster:${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::S3Express::DirectoryBucket") switch (attributeName) {
 			case "Arn": return `arn:${partition}:s3express:${region}:${accountId}:bucket/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::Lambda::Function") switch (attributeName) {
 			case "Arn": return `arn:${partition}:lambda:${region}:${accountId}:function:${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::SQS::Queue") {
 			let queueName = physicalId;
@@ -9376,25 +9406,26 @@ var IntrinsicFunctionResolver = class {
 				case "Arn": return `arn:${partition}:sqs:${region}:${accountId}:${queueName}`;
 				case "QueueUrl": return physicalId;
 				case "QueueName": return queueName;
-				default: return physicalId;
+				default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 			}
 		}
 		if (resourceType === "AWS::SNS::Topic") switch (attributeName) {
 			case "TopicArn": return `arn:${partition}:sns:${region}:${accountId}:${physicalId}`;
-			default: return physicalId;
+			case "TopicName": return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::Logs::LogGroup") switch (attributeName) {
 			case "Arn": return `arn:${partition}:logs:${region}:${accountId}:log-group:${physicalId}:*`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::ECR::Repository") switch (attributeName) {
 			case "Arn": return `arn:${partition}:ecr:${region}:${accountId}:repository/${physicalId}`;
 			case "RepositoryUri": return `${accountId}.dkr.ecr.${region}.amazonaws.com/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::ECS::Cluster") switch (attributeName) {
 			case "Arn": return `arn:${partition}:ecs:${region}:${accountId}:cluster/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::ECS::Service") switch (attributeName) {
 			case "Name": {
@@ -9407,18 +9438,30 @@ var IntrinsicFunctionResolver = class {
 				if (pipeIdx >= 0) return physicalId.substring(pipeIdx + 1);
 				return physicalId;
 			}
-			default: return physicalId;
+			case "ServiceArn": {
+				const pipeIdx = physicalId.indexOf("|");
+				if (pipeIdx < 0) return physicalId;
+				const left = physicalId.substring(0, pipeIdx);
+				if (left.includes(":service/")) return left;
+				const clusterIdx = left.indexOf(":cluster/");
+				if (clusterIdx < 0) return physicalId;
+				const clusterName = left.substring(clusterIdx + 9);
+				const serviceName = physicalId.substring(pipeIdx + 1);
+				return `${left.substring(0, clusterIdx)}:service/${clusterName}/${serviceName}`;
+			}
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::EC2::SecurityGroup") switch (attributeName) {
 			case "GroupId": return physicalId;
 			case "VpcId": return;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::EC2::Subnet") switch (attributeName) {
 			case "SubnetId": return physicalId;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::EC2::Instance") switch (attributeName) {
+			case "InstanceId": return physicalId;
 			case "PrivateIp":
 			case "PublicIp":
 			case "PrivateDnsName":
@@ -9457,7 +9500,7 @@ var IntrinsicFunctionResolver = class {
 				}
 				return physicalId;
 			}
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::EC2::LaunchTemplate") {
 			if (attributeName === "LatestVersionNumber" || attributeName === "DefaultVersionNumber") {
@@ -9470,11 +9513,44 @@ var IntrinsicFunctionResolver = class {
 				}
 				return attributeName === "LatestVersionNumber" ? "$Latest" : "$Default";
 			}
-			return physicalId;
+			if (attributeName === "LaunchTemplateId") return physicalId;
+			return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
+		return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+	}
+	/**
+	* Shared unknown-attribute physicalId fallback (issues #1106 / #1111).
+	*
+	* Applied by BOTH the final unknown-type fallback of
+	* {@link constructAttribute} and every per-type handler's
+	* `default:`-for-an-unknown-attribute branch:
+	*
+	* - An attribute name ending in `Arn` whose fallback value is not
+	*   ARN-shaped (or ending in `Url` whose fallback is not an http(s) URL)
+	*   cannot be what CloudFormation would return — hard-fail. The #1103
+	*   incident shipped four resource NAMES into stack Outputs where ARNs
+	*   were requested, with a green deploy. A physicalId that already IS an
+	*   ARN / URL passes the shape check and remains a valid fallback.
+	* - Under `--strict-getatt`, EVERY unknown-attribute fallback (any
+	*   suffix) is a hard error.
+	* - Otherwise: `Alias` / `Endpoint` and every other suffix keep the
+	*   warn-and-return behavior (an alias or endpoint is
+	*   shape-indistinguishable from a plain name, so a hard-fail there
+	*   would risk failing correct deploys — false positives are
+	*   unacceptable). Each warn-and-return increments the per-run fallback
+	*   counter surfaced in the deploy summary.
+	*
+	* A `return physicalId` that is the CORRECT value for a KNOWN attribute
+	* (e.g. `AWS::KMS::Key.KeyId`, `AWS::SNS::Topic.TopicName`) must NOT
+	* route through this helper — those are explicit `case`s in the
+	* per-type handlers.
+	*/
+	guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId) {
 		const expectsArnShape = attributeName.endsWith("Arn") && !physicalId.startsWith("arn:");
 		const expectsUrlShape = attributeName.endsWith("Url") && !/^https?:\/\//.test(physicalId);
 		if (expectsArnShape || expectsUrlShape) throw new Error(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resourceType}: attributes are not enriched for this resource type, and the physical ID fallback "${physicalId}" is not ${expectsArnShape ? "an ARN (arn:...)" : "a URL (http(s)://...)"}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${attributeName}.`);
+		if (this.strictGetAtt) throw new Error(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resourceType}: attributes are not enriched for this resource type, and --strict-getatt rejects the physical ID fallback "${physicalId}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning, avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${attributeName}.`);
+		this.physicalIdFallbackCount++;
 		this.logger.warn(`Unknown attribute ${attributeName} for resource type ${resourceType}, returning physical ID`);
 		return physicalId;
 	}
@@ -10878,7 +10954,7 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BgcH5ymP.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DbIC4hWG.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -14677,6 +14753,319 @@ function isCustomResource(resourceType) {
 	return resourceType.startsWith("Custom::") || resourceType === "AWS::CloudFormation::CustomResource";
 }
 
+//#endregion
+//#region src/deployment/retryable-errors.ts
+/**
+* Patterns that mark an AWS error as a transient/retryable failure.
+* Each entry is a substring match against the error message; all of these
+* are situations where the same call typically succeeds after a short delay
+* because of eventual consistency or just-created-dependency propagation.
+*/
+const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
+	"cannot be assumed",
+	"Firehose is unable to assume role",
+	"is unable to assume provided role",
+	"role defined for the function",
+	"not authorized to perform",
+	"execution role",
+	"trust policy",
+	"Role validation failed",
+	"does not have required permissions",
+	"Trusted Entity",
+	"currently in the following state: Pending",
+	"has dependencies and cannot be deleted",
+	"can't be deleted since it has",
+	"DependencyViolation",
+	"does not exist",
+	"Schema is currently being altered",
+	"Invalid principal in policy",
+	"Policy Error: PrincipalNotFound",
+	"Invalid value for the parameter Policy",
+	"required permissions for: ENHANCED_MONITORING",
+	"Caught ServiceAccessDeniedException",
+	"permissions required to assume the role",
+	"authorized to assume the provided role",
+	"conflicting conditional operation",
+	"scheduled for deletion",
+	"Cannot access stream",
+	"Please ensure the role can perform",
+	"KMS key is invalid for CreateGrant",
+	"Policy contains a statement with one or more invalid principals",
+	"Invalid IAM Instance Profile",
+	"Invalid InstanceProfile",
+	"Failed to authorize instance profile",
+	"Could not deliver test message",
+	"wait 60 seconds",
+	"concurrent update operation",
+	"because it is in use",
+	"Rate exceeded"
+];
+/**
+* HTTP status codes that always indicate a transient failure worth retrying.
+* 429 = Too Many Requests (throttle), 503 = Service Unavailable.
+*/
+const RETRYABLE_HTTP_STATUS_CODES = /* @__PURE__ */ new Set([429, 503]);
+/**
+* AWS SDK v3 canonical throttling error names. Mirrors
+* `@aws-sdk/service-error-classification`'s `THROTTLING_ERROR_CODES` — any
+* error (or wrapped cause) whose `name` is one of these is a transient rate-
+* limit rejection worth retrying with backoff. Detecting by NAME is more
+* robust than by HTTP status because most AWS throttles surface as HTTP 400
+* (not 429) with the throttling signal carried only in the error code / name
+* (e.g. SSM `ThrottlingException` for the `Rate exceeded` message).
+*/
+const THROTTLING_ERROR_NAMES = /* @__PURE__ */ new Set([
+	"BandwidthLimitExceeded",
+	"EC2ThrottledException",
+	"LimitExceededException",
+	"PriorRequestNotComplete",
+	"ProvisionedThroughputExceededException",
+	"RequestLimitExceeded",
+	"RequestThrottled",
+	"RequestThrottledException",
+	"SlowDown",
+	"ThrottledException",
+	"Throttling",
+	"ThrottlingException",
+	"TooManyRequestsException",
+	"TransactionInProgressException"
+]);
+/**
+* Walk the error + its `.cause` chain (bounded) looking for a rate-limit
+* signal — either an AWS SDK v3 throttling error `name`
+* ({@link THROTTLING_ERROR_NAMES}) or a retryable HTTP status
+* ({@link RETRYABLE_HTTP_STATUS_CODES}) on `$metadata`.
+*
+* cdkd wraps the original AWS error in a `ProvisioningError`, so the signal is
+* typically one cause-link deep; the bounded walk also tolerates SDK errors
+* that nest a `$response`/cause without exploding on a cyclic chain.
+*
+* BOTH signals are checked at EVERY depth. An earlier version checked the name
+* to depth 5 but the HTTP status only at depths 0 and 1, so a 429 nested two
+* links deep was missed. This is the single shared cause-walk: the read-only
+* import tag walk (`src/provisioning/import-tag-walk.ts`) composes its own
+* classifier on top of this function rather than re-implementing the traversal,
+* so the two cannot drift apart again.
+*/
+function isThrottlingError(error) {
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		const name = current.name;
+		if (typeof name === "string" && THROTTLING_ERROR_NAMES.has(name)) return true;
+		const status = current.$metadata?.httpStatusCode;
+		if (status !== void 0 && RETRYABLE_HTTP_STATUS_CODES.has(status)) return true;
+		current = current.cause;
+	}
+	return false;
+}
+/**
+* Determine whether an AWS error should be retried.
+*
+* Checks (in order):
+*   1. Rate-limit signal on the error or any wrapped cause — throttling error
+*      `name` or retryable HTTP status (most AWS throttles are HTTP 400, not
+*      429, so the name check carries most of the weight). See
+*      {@link isThrottlingError}.
+*   2. Substring match against {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}
+*/
+function isRetryableTransientError(error, message) {
+	if (isThrottlingError(error)) return true;
+	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
+}
+
+//#endregion
+//#region src/deployment/retry.ts
+/**
+* Retry helper for resource provisioning operations that hit transient
+* AWS eventual-consistency errors (IAM propagation, Lambda Pending state,
+* dependency violations, etc.).
+*
+* Extracted from DeployEngine so the backoff schedule can be unit-tested
+* in isolation. The retryable-error classifier itself lives in
+* `./retryable-errors.ts`.
+*/
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+* Run `operation`, retrying transient failures with exponential backoff
+* capped at `maxDelayMs`.
+*
+* Backoff at the defaults (initialDelayMs=1_000, maxDelayMs=8_000, maxRetries=8):
+*   1s -> 2s -> 4s -> 8s -> 8s -> 8s -> 8s -> 8s   (cumulative 47s)
+*
+* Non-retryable errors are rethrown immediately. The transient-error
+* classifier is `isRetryableTransientError` from ./retryable-errors.ts.
+*/
+async function withRetry(operation, logicalId, opts = {}) {
+	const maxRetries = opts.maxRetries ?? 8;
+	const initialDelayMs = opts.initialDelayMs ?? 1e3;
+	const maxDelayMs = opts.maxDelayMs ?? 8e3;
+	const sleep = opts.sleep ?? defaultSleep;
+	let lastError;
+	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
+		return await operation();
+	} catch (error) {
+		lastError = error;
+		const message = error instanceof Error ? error.message : String(error);
+		if (!(opts.isRetryable ? opts.isRetryable(message, error) : isRetryableTransientError(error, message)) || attempt >= maxRetries) throw error;
+		const delay = Math.min(initialDelayMs * Math.pow(2, attempt), maxDelayMs);
+		opts.logger?.debug(`  ⏳ Retrying ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/${maxRetries}) - ${message}`);
+		for (let waited = 0; waited < delay; waited += 1e3) {
+			if (opts.isInterrupted?.()) throw opts.onInterrupted ? opts.onInterrupted() : /* @__PURE__ */ new Error("Interrupted");
+			await sleep(Math.min(1e3, delay - waited));
+		}
+	}
+	throw lastError;
+}
+
+//#endregion
+//#region src/provisioning/import-tag-walk.ts
+/**
+* Shared, throttle-tolerant `aws:cdk:path` tag walk for `ResourceProvider.import`.
+*
+* Providers that adopt a resource without an explicit name property fall back
+* to step 3 of the lookup order documented in `./import-helpers.ts`: enumerate
+* the service's `List*`/`Describe*` pages, then issue ONE per-candidate read
+* (`DescribeX` / `ListTagsForResource`) to obtain the tag set — the list
+* summaries usually do not carry tags. That is an inherent **N+1** read
+* pattern: an account with many resources of the type produces one API call
+* per candidate in a tight loop, which is exactly the shape AWS rate-limits.
+*
+* Every provider previously hand-rolled this loop with NO backoff, so a single
+* throttled `Describe*` aborted the whole `cdkd import` run. This helper
+* centralises the loop and wraps BOTH the list page fetch and the per-candidate
+* describe in the deploy engine's `withRetry` with exponential backoff.
+*
+* ## Why a narrower classifier than `isRetryableTransientError`
+*
+* The deploy engine's classifier is tuned for the WRITE path: it also treats
+* eventual-consistency phrasings like `does not exist` / `not authorized to
+* perform` as transient, because a just-created dependency legitimately needs a
+* moment to propagate. On a read-only import walk those messages mean the
+* opposite — the candidate really is gone, or the caller's credentials really
+* lack the permission — and retrying them burns the full backoff budget per
+* candidate before surfacing the true error.
+*
+* So the walk retries throttling ONLY, reusing the deploy engine's throttle
+* tables verbatim ({@link THROTTLING_ERROR_NAMES} /
+* {@link RETRYABLE_HTTP_STATUS_CODES}) rather than maintaining a second copy.
+*
+* ## Batching
+*
+* Batched tag reads are deliberately NOT modelled here: the services this
+* helper currently serves (EMR `DescribeCluster`, DocDB
+* `ListTagsForResource`) expose only single-resource reads. A service that
+* genuinely offers a batch API (e.g. CodeCommit `BatchGetRepositories`) can
+* satisfy several candidates from one call inside its own `describe` callback,
+* or bypass the helper entirely.
+*/
+/** Max number of retries after the first attempt, per API call in the walk. */
+const DEFAULT_MAX_RETRIES = 5;
+/** Initial backoff; each retry doubles it up to {@link DEFAULT_MAX_DELAY_MS}. */
+const DEFAULT_INITIAL_DELAY_MS = 500;
+/** Cap for the per-retry delay (0.5s -> 1s -> 2s -> 4s -> 5s, ~12.5s total). */
+const DEFAULT_MAX_DELAY_MS = 5e3;
+/**
+* Wall-clock ceiling for the WHOLE walk (all pages + all candidates), not just
+* one call. Backoff is per-call, so without this a sustained throttle against a
+* large account degrades into `(pages + candidates) x ~12.5s` of near-silent
+* retrying — ~42 minutes for 200 candidates, with no way to tell a slow walk
+* from a hung one. 10 minutes is generous for a healthy walk (a 200-candidate
+* DocDB account completes in seconds when AWS is not throttling) and bounds the
+* pathological case to something a user will wait through.
+*/
+const DEFAULT_MAX_WALK_MS = 10 * 6e4;
+/**
+* Ceiling on pages fetched. A service that returns a non-advancing pagination
+* token (a bug, or a marker cdkd echoes back wrongly) would otherwise spin
+* forever. This is now the shared path every migrated provider runs on, so the
+* guard belongs here rather than in each caller.
+*/
+const DEFAULT_MAX_PAGES = 1e3;
+/**
+* Whether an error hit during the read-only tag walk is a rate-limit rejection
+* worth backing off on.
+*
+* Delegates the error + `.cause` chain traversal to the deploy engine's
+* {@link isThrottlingError} (throttling error names + retryable HTTP statuses,
+* at every cause depth) and adds the canonical `Rate exceeded` message, which
+* several services return with an HTTP 400 and a service-specific error name.
+*
+* This is deliberately NARROWER than `isRetryableTransientError`: that
+* classifier also treats write-path eventual-consistency phrasings (`does not
+* exist`, `not authorized to perform`) as transient, because a just-created
+* dependency legitimately needs a moment to propagate. On a read-only walk
+* those mean the candidate really is gone or the credentials really lack the
+* permission, and retrying them burns the full backoff budget per candidate
+* before surfacing the true error.
+*
+* Exported for direct unit testing and for providers whose tag walk cannot use
+* {@link importTagWalk} verbatim.
+*/
+function isThrottlingLikeError(error, message) {
+	return isThrottlingError(error) || message.includes("Rate exceeded");
+}
+/** Thrown when the walk exceeds its wall-clock budget or page ceiling. */
+var ImportTagWalkLimitError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ImportTagWalkLimitError";
+	}
+};
+/**
+* Paginate `listPage`, `describe` each candidate, and return the first one
+* whose tags carry the requested `aws:cdk:path`. Returns `null` when no
+* candidate matches (or when `cdkPath` is empty).
+*
+* Both callbacks are individually retried with exponential backoff on
+* throttling errors, so one rate-limited call mid-walk no longer aborts the
+* whole import.
+*/
+async function importTagWalk(options) {
+	const { cdkPath, listPage, describe, tagsOf } = options;
+	if (!cdkPath) return null;
+	const logicalId = options.logicalId ?? "import";
+	const logger = options.retry?.logger ?? getLogger();
+	const maxWalkMs = options.retry?.maxWalkMs ?? DEFAULT_MAX_WALK_MS;
+	const maxPages = options.retry?.maxPages ?? DEFAULT_MAX_PAGES;
+	const retryOpts = {
+		maxRetries: options.retry?.maxRetries ?? DEFAULT_MAX_RETRIES,
+		initialDelayMs: options.retry?.initialDelayMs ?? DEFAULT_INITIAL_DELAY_MS,
+		maxDelayMs: options.retry?.maxDelayMs ?? DEFAULT_MAX_DELAY_MS,
+		isRetryable: (message, error) => isThrottlingLikeError(error, message),
+		logger,
+		...options.retry?.isInterrupted && { isInterrupted: options.retry.isInterrupted },
+		...options.retry?.onInterrupted && { onInterrupted: options.retry.onInterrupted },
+		...options.retry?.sleep && { sleep: options.retry.sleep }
+	};
+	const startedAt = Date.now();
+	const assertWithinBudget = (stage) => {
+		const elapsed = Date.now() - startedAt;
+		if (elapsed >= maxWalkMs) throw new ImportTagWalkLimitError(`Timed out looking up ${logicalId} by its aws:cdk:path tag after ${Math.round(elapsed / 1e3)}s (limit ${Math.round(maxWalkMs / 1e3)}s, while ${stage}). AWS is likely throttling the lookup; retry, or pass an explicit physical id with --resource ${logicalId}=<physicalId>.`);
+	};
+	let marker;
+	let pages = 0;
+	do {
+		assertWithinBudget("listing candidates");
+		if (++pages > maxPages) throw new ImportTagWalkLimitError(`Gave up looking up ${logicalId} by its aws:cdk:path tag after ${maxPages} pages (the service may be returning a non-advancing pagination token). Pass an explicit physical id with --resource ${logicalId}=<physicalId>.`);
+		const currentMarker = marker;
+		const page = await withRetry(() => listPage(currentMarker), logicalId, retryOpts);
+		for (const summary of page.items ?? []) {
+			assertWithinBudget("reading candidate tags");
+			const detail = await withRetry(() => describe(summary), logicalId, retryOpts);
+			if (detail === void 0) {
+				logger.debug(`  ↷ Skipped an ${logicalId} import candidate: its detail lookup returned no result`);
+				continue;
+			}
+			if (matchesCdkPath(tagsOf(detail, summary), cdkPath)) return {
+				summary,
+				detail
+			};
+		}
+		marker = page.nextMarker;
+	} while (marker);
+	return null;
+}
+
 //#endregion
 //#region src/provisioning/providers/iam-role-provider.ts
 /**
@@ -15226,25 +15615,32 @@ var IAMRoleProvider = class {
 			if (err instanceof NoSuchEntityException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.iamClient.send(new ListRolesCommand({ ...marker && { Marker: marker } }));
-			for (const role of list.Roles ?? []) {
-				if (!role.RoleName) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.iamClient.send(new ListRolesCommand({ ...marker && { Marker: marker } }));
+				return {
+					items: list.Roles,
+					nextMarker: list.IsTruncated ? list.Marker : void 0
+				};
+			},
+			describe: async (role) => {
+				if (!role.RoleName) return void 0;
 				try {
-					if (matchesCdkPath((await this.iamClient.send(new ListRoleTagsCommand({ RoleName: role.RoleName }))).Tags, input.cdkPath)) return {
-						physicalId: role.RoleName,
-						attributes: {}
-					};
+					return await this.iamClient.send(new ListRoleTagsCommand({ RoleName: role.RoleName }));
 				} catch (err) {
-					if (err instanceof NoSuchEntityException) continue;
+					if (err instanceof NoSuchEntityException) return void 0;
 					throw err;
 				}
-			}
-			marker = list.IsTruncated ? list.Marker : void 0;
-		} while (marker);
-		return null;
+			},
+			tagsOf: (tags) => tags.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.RoleName,
+			attributes: {}
+		};
 	}
 };
 /**
@@ -15740,170 +16136,6 @@ function computeImplicitDeleteEdges(resources) {
 	return edges;
 }
 
-//#endregion
-//#region src/deployment/retryable-errors.ts
-/**
-* Patterns that mark an AWS error as a transient/retryable failure.
-* Each entry is a substring match against the error message; all of these
-* are situations where the same call typically succeeds after a short delay
-* because of eventual consistency or just-created-dependency propagation.
-*/
-const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
-	"cannot be assumed",
-	"Firehose is unable to assume role",
-	"is unable to assume provided role",
-	"role defined for the function",
-	"not authorized to perform",
-	"execution role",
-	"trust policy",
-	"Role validation failed",
-	"does not have required permissions",
-	"Trusted Entity",
-	"currently in the following state: Pending",
-	"has dependencies and cannot be deleted",
-	"can't be deleted since it has",
-	"DependencyViolation",
-	"does not exist",
-	"Schema is currently being altered",
-	"Invalid principal in policy",
-	"Policy Error: PrincipalNotFound",
-	"Invalid value for the parameter Policy",
-	"required permissions for: ENHANCED_MONITORING",
-	"Caught ServiceAccessDeniedException",
-	"permissions required to assume the role",
-	"authorized to assume the provided role",
-	"conflicting conditional operation",
-	"scheduled for deletion",
-	"Cannot access stream",
-	"Please ensure the role can perform",
-	"KMS key is invalid for CreateGrant",
-	"Policy contains a statement with one or more invalid principals",
-	"Invalid IAM Instance Profile",
-	"Invalid InstanceProfile",
-	"Failed to authorize instance profile",
-	"Could not deliver test message",
-	"wait 60 seconds",
-	"concurrent update operation",
-	"because it is in use",
-	"Rate exceeded"
-];
-/**
-* HTTP status codes that always indicate a transient failure worth retrying.
-* 429 = Too Many Requests (throttle), 503 = Service Unavailable.
-*/
-const RETRYABLE_HTTP_STATUS_CODES = /* @__PURE__ */ new Set([429, 503]);
-/**
-* AWS SDK v3 canonical throttling error names. Mirrors
-* `@aws-sdk/service-error-classification`'s `THROTTLING_ERROR_CODES` — any
-* error (or wrapped cause) whose `name` is one of these is a transient rate-
-* limit rejection worth retrying with backoff. Detecting by NAME is more
-* robust than by HTTP status because most AWS throttles surface as HTTP 400
-* (not 429) with the throttling signal carried only in the error code / name
-* (e.g. SSM `ThrottlingException` for the `Rate exceeded` message).
-*/
-const THROTTLING_ERROR_NAMES = /* @__PURE__ */ new Set([
-	"BandwidthLimitExceeded",
-	"EC2ThrottledException",
-	"LimitExceededException",
-	"PriorRequestNotComplete",
-	"ProvisionedThroughputExceededException",
-	"RequestLimitExceeded",
-	"RequestThrottled",
-	"RequestThrottledException",
-	"SlowDown",
-	"ThrottledException",
-	"Throttling",
-	"ThrottlingException",
-	"TooManyRequestsException",
-	"TransactionInProgressException"
-]);
-/**
-* Walk the error + its `.cause` chain (bounded) looking for a rate-limit
-* signal — either an AWS SDK v3 throttling error `name`
-* ({@link THROTTLING_ERROR_NAMES}) or a retryable HTTP status
-* ({@link RETRYABLE_HTTP_STATUS_CODES}) on `$metadata`.
-*
-* cdkd wraps the original AWS error in a `ProvisioningError`, so the signal is
-* typically one cause-link deep; the bounded walk also tolerates SDK errors
-* that nest a `$response`/cause without exploding on a cyclic chain.
-*
-* BOTH signals are checked at EVERY depth. An earlier version checked the name
-* to depth 5 but the HTTP status only at depths 0 and 1, so a 429 nested two
-* links deep was missed. This is the single shared cause-walk: the read-only
-* import tag walk (`src/provisioning/import-tag-walk.ts`) composes its own
-* classifier on top of this function rather than re-implementing the traversal,
-* so the two cannot drift apart again.
-*/
-function isThrottlingError(error) {
-	let current = error;
-	for (let depth = 0; depth < 5 && current != null; depth++) {
-		const name = current.name;
-		if (typeof name === "string" && THROTTLING_ERROR_NAMES.has(name)) return true;
-		const status = current.$metadata?.httpStatusCode;
-		if (status !== void 0 && RETRYABLE_HTTP_STATUS_CODES.has(status)) return true;
-		current = current.cause;
-	}
-	return false;
-}
-/**
-* Determine whether an AWS error should be retried.
-*
-* Checks (in order):
-*   1. Rate-limit signal on the error or any wrapped cause — throttling error
-*      `name` or retryable HTTP status (most AWS throttles are HTTP 400, not
-*      429, so the name check carries most of the weight). See
-*      {@link isThrottlingError}.
-*   2. Substring match against {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}
-*/
-function isRetryableTransientError(error, message) {
-	if (isThrottlingError(error)) return true;
-	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
-}
-
-//#endregion
-//#region src/deployment/retry.ts
-/**
-* Retry helper for resource provisioning operations that hit transient
-* AWS eventual-consistency errors (IAM propagation, Lambda Pending state,
-* dependency violations, etc.).
-*
-* Extracted from DeployEngine so the backoff schedule can be unit-tested
-* in isolation. The retryable-error classifier itself lives in
-* `./retryable-errors.ts`.
-*/
-const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-/**
-* Run `operation`, retrying transient failures with exponential backoff
-* capped at `maxDelayMs`.
-*
-* Backoff at the defaults (initialDelayMs=1_000, maxDelayMs=8_000, maxRetries=8):
-*   1s -> 2s -> 4s -> 8s -> 8s -> 8s -> 8s -> 8s   (cumulative 47s)
-*
-* Non-retryable errors are rethrown immediately. The transient-error
-* classifier is `isRetryableTransientError` from ./retryable-errors.ts.
-*/
-async function withRetry(operation, logicalId, opts = {}) {
-	const maxRetries = opts.maxRetries ?? 8;
-	const initialDelayMs = opts.initialDelayMs ?? 1e3;
-	const maxDelayMs = opts.maxDelayMs ?? 8e3;
-	const sleep = opts.sleep ?? defaultSleep;
-	let lastError;
-	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
-		return await operation();
-	} catch (error) {
-		lastError = error;
-		const message = error instanceof Error ? error.message : String(error);
-		if (!(opts.isRetryable ? opts.isRetryable(message, error) : isRetryableTransientError(error, message)) || attempt >= maxRetries) throw error;
-		const delay = Math.min(initialDelayMs * Math.pow(2, attempt), maxDelayMs);
-		opts.logger?.debug(`  ⏳ Retrying ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/${maxRetries}) - ${message}`);
-		for (let waited = 0; waited < delay; waited += 1e3) {
-			if (opts.isInterrupted?.()) throw opts.onInterrupted ? opts.onInterrupted() : /* @__PURE__ */ new Error("Interrupted");
-			await sleep(Math.min(1e3, delay - waited));
-		}
-	}
-	throw lastError;
-}
-
 //#endregion
 //#region src/deployment/resource-deadline.ts
 /**
@@ -16124,7 +16356,7 @@ var DeployEngine = class {
 		this.options = options;
 		this.stackRegion = stackRegion;
 		this.exportIndexStore = exportIndexStore;
-		this.resolver = new IntrinsicFunctionResolver(stackRegion);
+		this.resolver = new IntrinsicFunctionResolver(stackRegion, { strictGetAtt: options.strictGetAtt ?? false });
 		this.options.concurrency = options.concurrency ?? 10;
 		this.options.dryRun = options.dryRun ?? false;
 		this.options.lockTimeout = options.lockTimeout ?? 300 * 1e3;
@@ -16139,6 +16371,7 @@ var DeployEngine = class {
 	async deploy(stackName, template) {
 		this.recordedImports = [];
 		this.recordedOutputReads = [];
+		this.resolver.resetPhysicalIdFallbackCount();
 		return withStackName(stackName, () => this.doDeploy(stackName, template));
 	}
 	/**
@@ -16455,7 +16688,8 @@ var DeployEngine = class {
 					deleted: 0,
 					unchanged: Object.keys(currentState.resources).length,
 					durationMs: Date.now() - startTime,
-					outputs: this.buildDisplayOutputs(template, persistedOutputs)
+					outputs: this.buildDisplayOutputs(template, persistedOutputs),
+					attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
 				};
 			}
 			const createChanges = this.diffCalculator.filterByType(changes, "CREATE");
@@ -16470,9 +16704,11 @@ var DeployEngine = class {
 					updated: updateChanges.length,
 					deleted: deleteChanges.length,
 					unchanged: this.diffCalculator.filterByType(changes, "NO_CHANGE").length,
-					durationMs: Date.now() - startTime
+					durationMs: Date.now() - startTime,
+					attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
 				};
 			}
+			this.resolver.resetPhysicalIdFallbackCount();
 			const progress = {
 				current: 0,
 				total: createChanges.length + updateChanges.length + deleteChanges.length
@@ -16491,7 +16727,8 @@ var DeployEngine = class {
 				deleted: actualCounts.deleted,
 				unchanged: unchangedCount,
 				durationMs,
-				outputs: this.buildDisplayOutputs(template, newState.outputs ?? {})
+				outputs: this.buildDisplayOutputs(template, newState.outputs ?? {}),
+				attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
 			};
 		} finally {
 			renderer.stop();
@@ -16705,7 +16942,13 @@ var DeployEngine = class {
 			}
 			throw error;
 		}
-		const outputs = await this.resolveOutputs(template, newResources, stackName, parameterValues, conditions);
+		let outputs;
+		try {
+			outputs = await this.resolveOutputs(template, newResources, stackName, parameterValues, conditions);
+		} catch (outputError) {
+			await this.persistStateAfterOutputFailure(stackName, currentState, newResources, currentEtag, pendingMigration);
+			throw outputError;
+		}
 		return {
 			state: {
 				version: 8,
@@ -16721,6 +16964,58 @@ var DeployEngine = class {
 		};
 	}
 	/**
+	* Persist state after provisioning fully succeeded but output resolution
+	* threw (only reachable under `--strict-getatt`, whose promotion fires
+	* AFTER the rollback catch block). The persisted shape mirrors the
+	* success-path state EXCEPT for outputs:
+	*
+	* - `resources`: this run's provisioning result (`newResources`) — every
+	*   create/update/delete landed in AWS, so state must record it.
+	* - `imports` / `outputReads`: this run's `recordedImports` /
+	*   `recordedOutputReads` (the provisioning that produced them succeeded;
+	*   dropping them would desync the strong-reference records from AWS —
+	*   matters on the update-deploy path where the pre-deploy snapshot may
+	*   be stale).
+	* - `outputs`: the PREVIOUSLY persisted map — resolveOutputs threw before
+	*   producing a new one, mirroring what a resource-failure persist keeps.
+	*   The exports index is deliberately NOT updated (it stays consistent
+	*   with the old outputs that remain in state).
+	*
+	* ETag handling mirrors the post-rollback save: expected-ETag first (or
+	* unconditional when `pendingMigration` — same as the per-resource save),
+	* then a fresh-ETag retry, then warn. Best-effort: the deploy error being
+	* rethrown is the primary signal; a failed save only warns.
+	*/
+	async persistStateAfterOutputFailure(stackName, currentState, newResources, currentEtag, pendingMigration) {
+		const buildState = () => ({
+			version: 8,
+			region: this.stackRegion,
+			stackName: currentState.stackName,
+			resources: newResources,
+			outputs: currentState.outputs,
+			...this.recordedImports.length > 0 && { imports: [...this.recordedImports] },
+			...this.recordedOutputReads.length > 0 && { outputReads: [...this.recordedOutputReads] },
+			lastModified: Date.now()
+		});
+		try {
+			const expectedEtag = pendingMigration ? void 0 : currentEtag;
+			await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(buildState()), {
+				...expectedEtag !== void 0 && { expectedEtag },
+				migrateLegacy: pendingMigration
+			});
+			this.logger.debug("State saved after output resolution failure");
+		} catch (saveError) {
+			this.logger.debug(`Retrying state save after output resolution failure (ETag mismatch): ${saveError instanceof Error ? saveError.message : String(saveError)}`);
+			try {
+				const freshEtag = (await this.stateBackend.getState(stackName, this.stackRegion))?.etag;
+				await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(buildState()), { ...freshEtag !== void 0 && { expectedEtag: freshEtag } });
+				this.logger.debug("State saved after output resolution failure (retry succeeded)");
+			} catch (retryError) {
+				this.logger.warn(`Failed to save state after output resolution failure: ${retryError instanceof Error ? retryError.message : String(retryError)} — resources were provisioned but not recorded; run deploy again to reconcile.`);
+			}
+		}
+	}
+	/**
 	* Perform best-effort rollback of completed operations respecting dependencies
 	*
 	* - CREATE → delete the newly created resource (in reverse dependency order)
@@ -17468,6 +17763,7 @@ var DeployEngine = class {
 					if (typeof exportName === "string") outputs[exportName] = value;
 				}
 			} catch (error) {
+				if (this.options.strictGetAtt) throw new Error(`Failed to resolve output ${outputKey}: ${error instanceof Error ? error.message : String(error)} (--strict-getatt promotes output resolution failures to deploy errors; drop the flag to warn and skip the output instead)`);
 				this.logger.warn(`Failed to resolve output ${outputKey}: ${String(error)}`);
 				outputs[outputKey] = void 0;
 			}
@@ -17486,5 +17782,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { BOOTSTRAP_MARKER_PREFIX as $, StateError as $t, refStateLookupFromResource as A, AssemblyReader as At, TemplateParser as B, DependencyError as Bt, ProviderRegistry as C, warnDeprecatedNoPrefixCliFlag as Ct, isTerminationProtectionPropagationError as D, findLargeInlineResources as Dt, disableInstanceApiTermination as E, MIGRATE_TMP_PREFIX as Et, resolveExplicitPhysicalId as F, resetAwsClients as Ft, AssetPublisher as G, MissingCdkCliError as Gt, S3StateBackend as H, LocalMigrateError as Ht, assertRegionMatch as I, setAwsClients as It, buildAssetRedirectMap as J, ProvisioningError as Jt, stringifyValue as K, NestedStackChildDirectDestroyError as Kt, applyRoleArnIfSet as L, AssetError as Lt, CDK_PATH_TAG as M, resolveBucketRegion as Mt, matchesCdkPath as N, AwsClients as Nt, IntrinsicFunctionResolver as O, uploadCfnTemplate as Ot, normalizeAwsTagsToCfn as P, getAwsClients as Pt, AssetModeResolver as Q, StackTerminationProtectionError as Qt, DiffCalculator as R, CdkdError as Rt, collectInlinePolicyNamesManagedBySiblings as S, resolveUseCdkBootstrapAssets as St, CloudControlProvider as T, CFN_TEMPLATE_URL_LIMIT as Tt, rebuildClientForBucketRegion as U, LocalStartServiceError as Ut, LockManager as V, LocalInvokeBuildError as Vt, shouldRetainResource as W, LockError as Wt, loadPublishableAssetManifest as X, ResourceUpdateNotSupportedError as Xt, createAssetRedirectResolver as Y, ResourceTimeoutError as Yt, rewriteTemplateAssetReferences as Z, StackHasActiveImportsError as Zt, gray as _, resolveAutoAssetStorage as _t, withRetry as a, __exportAll as an, buildDockerImage as at, yellow as b, resolveStateBucketWithDefault as bt, IMPLICIT_DELETE_DEPENDENCIES as c, runDockerForeground as ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as d, getDockerImageBySourceHash as dt, SynthesisError as en, ensureAssetStorage as et, isStatefulRecreateTargetSync as f, Synthesizer as ft, cyan as g, resolveApp as gt, bold as h, getLegacyStateBucketName as ht, withResourceDeadline as i, withErrorHandling as in, validateContainerRepoName as it, WAFv2WebACLProvider as j, clearBucketRegionCache as jt, cfnRefValueFromPhysicalId as k, expectedOwnerParam as kt, computeImplicitDeleteEdges as l, runDockerStreaming as lt, formatResourceLine as m, getDefaultStateBucketName as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isCdkdError as nn, parseBootstrapMarker as nt, isRetryableTransientError as o, formatDockerLoginError as ot, renderStatefulReason as p, synthesisStatusMessage as pt, WorkGraph as q, PartialFailureError as qt, DeployEngine as r, normalizeAwsError as rn, validateAssetBucketName as rt, isThrottlingError as s, getDockerCmd as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, formatError as tn, getBootstrapMarkerKey as tt, extractDeploymentEventError as u, AssetManifestLoader as ut, green as v, resolveCaptureObservedState as vt, findActionableSilentDrops as w, CFN_TEMPLATE_BODY_LIMIT as wt, IAMRoleProvider as x, resolveStateBucketWithDefaultAndSource as xt, red as y, resolveSkipPrefix as yt, DagBuilder as z, ConfigError as zt };
-//# sourceMappingURL=deploy-engine-d-cwg8zS.js.map
+export { BOOTSTRAP_MARKER_PREFIX as $, StateError as $t, refStateLookupFromResource as A, AssemblyReader as At, TemplateParser as B, DependencyError as Bt, ProviderRegistry as C, warnDeprecatedNoPrefixCliFlag as Ct, isTerminationProtectionPropagationError as D, findLargeInlineResources as Dt, disableInstanceApiTermination as E, MIGRATE_TMP_PREFIX as Et, resolveExplicitPhysicalId as F, resetAwsClients as Ft, AssetPublisher as G, MissingCdkCliError as Gt, S3StateBackend as H, LocalMigrateError as Ht, assertRegionMatch as I, setAwsClients as It, buildAssetRedirectMap as J, ProvisioningError as Jt, stringifyValue as K, NestedStackChildDirectDestroyError as Kt, applyRoleArnIfSet as L, AssetError as Lt, CDK_PATH_TAG as M, resolveBucketRegion as Mt, matchesCdkPath as N, AwsClients as Nt, IntrinsicFunctionResolver as O, uploadCfnTemplate as Ot, normalizeAwsTagsToCfn as P, getAwsClients as Pt, AssetModeResolver as Q, StackTerminationProtectionError as Qt, DiffCalculator as R, CdkdError as Rt, isRetryableTransientError as S, resolveUseCdkBootstrapAssets as St, CloudControlProvider as T, CFN_TEMPLATE_URL_LIMIT as Tt, rebuildClientForBucketRegion as U, LocalStartServiceError as Ut, LockManager as V, LocalInvokeBuildError as Vt, shouldRetainResource as W, LockError as Wt, loadPublishableAssetManifest as X, ResourceUpdateNotSupportedError as Xt, createAssetRedirectResolver as Y, ResourceTimeoutError as Yt, rewriteTemplateAssetReferences as Z, StackHasActiveImportsError as Zt, yellow as _, resolveAutoAssetStorage as _t, IMPLICIT_DELETE_DEPENDENCIES as a, __exportAll as an, buildDockerImage as at, importTagWalk as b, resolveStateBucketWithDefault as bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as c, runDockerForeground as ct, formatResourceLine as d, getDockerImageBySourceHash as dt, SynthesisError as en, ensureAssetStorage as et, bold as f, Synthesizer as ft, red as g, resolveApp as gt, green as h, getLegacyStateBucketName as ht, withResourceDeadline as i, withErrorHandling as in, validateContainerRepoName as it, WAFv2WebACLProvider as j, clearBucketRegionCache as jt, cfnRefValueFromPhysicalId as k, expectedOwnerParam as kt, isStatefulRecreateTargetSync as l, runDockerStreaming as lt, gray as m, getDefaultStateBucketName as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isCdkdError as nn, parseBootstrapMarker as nt, computeImplicitDeleteEdges as o, formatDockerLoginError as ot, cyan as p, synthesisStatusMessage as pt, WorkGraph as q, PartialFailureError as qt, DeployEngine as r, normalizeAwsError as rn, validateAssetBucketName as rt, extractDeploymentEventError as s, getDockerCmd as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, formatError as tn, getBootstrapMarkerKey as tt, renderStatefulReason as u, AssetManifestLoader as ut, IAMRoleProvider as v, resolveCaptureObservedState as vt, findActionableSilentDrops as w, CFN_TEMPLATE_BODY_LIMIT as wt, withRetry as x, resolveStateBucketWithDefaultAndSource as xt, collectInlinePolicyNamesManagedBySiblings as y, resolveSkipPrefix as yt, DagBuilder as z, ConfigError as zt };
+//# sourceMappingURL=deploy-engine-vUgwldVH.js.map