@go-to-k/cdkd 0.291.25 → 0.291.26

package/dist/{deploy-engine-JdJuqXID.js → deploy-engine-BZps_IKn.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as isPasteableIdent, E as displayStackName, O as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-Bt0RGDfb.js";
 import { a as setAssumedRoleCredentials, c as currentStackAwsScope, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-BuS5njuZ.js";
+import { t as getCdkdVersion } from "./version-BkoR4hMq.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -37,7 +37,7 @@ import { KMSClient, ListAliasesCommand } from "@aws-sdk/client-kms";
 import { readFile } from "fs/promises";
 import { isAbsolute as isAbsolute$1, resolve as resolve$1 } from "path";
 import { CreateRepositoryCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, PutImageTagMutabilityCommand } from "@aws-sdk/client-ecr";
-import { inspect } from "node:util";
+import { inspect, isDeepStrictEqual } from "node:util";
 import { hostname } from "os";
 import graphlib from "graphlib";
 import { DescribeDBClustersCommand, DescribeDBInstancesCommand, RDSClient } from "@aws-sdk/client-rds";
@@ -3451,6 +3451,24 @@ function displayAssemblyPath(value) {
 	return `"${body}"`;
 }
 /**
+* A file read-or-parse failure's CAUSE, for a message whose subject already
+* renders the path through {@link displayAssemblyPath} (go-to-k/cdkd#3617).
+*
+* - Node's own errno text repeats the path inside Node's quotes
+*   (`ENOENT: no such file or directory, open '<path>'`), so printing
+*   `err.message` whole re-opens the clause-injection the subject closed, one
+*   colon later. Every occurrence of the path is replaced with `<path>` -- the
+*   subject names it, bounded -- and what is left is sanitized.
+* - A `JSON.parse` failure is reduced to `invalid JSON`: V8 echoes a window of
+*   the file's own bytes verbatim, `'` included, and the file is assembly-chosen
+*   too -- the rule `AssemblyReader`'s `manifestReadFailureText` already states.
+*/
+function describeFileReadFailure(err, filePath) {
+	if (err instanceof SyntaxError) return "invalid JSON";
+	const message = err instanceof Error ? err.message : String(err);
+	return displaySafe(filePath === "" ? message : message.split(filePath).join("<path>"));
+}
+/**
 * The shared tail of every containment refusal: what the value resolved to,
 * what it escaped, and why that means the assembly is not CDK-generated. Each
 * call site supplies its own subject ("Stack 'X' has templateFile='...' which
@@ -3603,11 +3621,11 @@ function collectStackMessages(assemblyDir, artifact) {
 			sideFile = JSON.parse(readFileSync(metadataPath, "utf-8"));
 			if (sideFile === null || typeof sideFile !== "object" || Array.isArray(sideFile)) throw new Error("expected a JSON object mapping construct paths to metadata entry arrays");
 			for (const [path, entries] of Object.entries(sideFile)) {
-				if (!Array.isArray(entries)) throw new Error(`entry for path '${path}' is not an array`);
+				if (!Array.isArray(entries)) throw new Error(`entry for path ${displayStackName(path)} is not an array`);
 				merged[path] = [...merged[path] ?? [], ...entries];
 			}
 		} catch (error) {
-			throw new SynthesisError(`Failed to read stack metadata file ${displayAssemblyPath(metadataPath)}: ${displaySafe(error instanceof Error ? error.message : String(error))}`, error instanceof Error ? error : void 0);
+			throw new SynthesisError(`Failed to read stack metadata file ${displayAssemblyPath(metadataPath)}: ${describeFileReadFailure(error, metadataPath)}`);
 		}
 	}
 	const messages = [];
@@ -3999,7 +4017,7 @@ var AssemblyReader = class {
 			const content = readFileSync(templatePath, "utf-8");
 			template = JSON.parse(content);
 		} catch (error) {
-			throw new SynthesisError(`Failed to read template for stack ${displayStackName(stackName)}: ${displaySafe(error instanceof Error ? error.message : String(error))}`, error instanceof Error ? error : void 0);
+			throw new SynthesisError(`Failed to read template ${displayAssemblyPath(templatePath)} for stack ${displayStackName(stackName)}: ${describeFileReadFailure(error, templatePath)}`);
 		}
 		this.logger.debug(`Stack: ${displaySafe(stackName)}, Resources: ${Object.keys(template.Resources ?? {}).length}`);
 		let assetManifestPath;
@@ -6888,7 +6906,7 @@ function stringifyParamDefault(value, type, paramKey, logger) {
 			if (inner !== void 0 && isListParameterType(inner)) return "placeholder,placeholder";
 			return "placeholder";
 		}
-		logger.warn(`Parameter '${displaySafe(paramKey)}' has unrecognized CFn Type '${displaySafe(type)}'; using a generic string placeholder for the transient macro-expansion changeset. If CFn rejects the changeset with a type error, file an issue with the offending Type.`);
+		logger.warn(`Parameter ${displayIdent(paramKey)} has unrecognized CFn Type ${displayIdent(type)}; using a generic string placeholder for the transient macro-expansion changeset. If CFn rejects the changeset with a type error, file an issue with the offending Type.`);
 		return PARAMETER_PLACEHOLDER;
 	}
 	return PARAMETER_PLACEHOLDER;
@@ -9560,7 +9578,7 @@ function warnEscapingBuildKitPaths(source, base, bound) {
 		const escape = assemblyPathEscape(base, bound, ref.path);
 		if (escape === void 0) continue;
 		const verb = ref.write ? "WRITE to" : "read";
-		logger.warn(`Docker asset ${ref.field}` + (ref.where === ref.field ? "" : `['${displaySafe(ref.where)}']`) + ` names a host path outside the assembly, which ${renderAssemblyPathEscape(escape, bound, "load", `cdkd will ${verb} it during the image build, matching the CDK CLI — a pre-synthesized assembly is trusted input. If you did not produce this assembly, that is a host path it chose and the CloudFormation template does not show.`)}`);
+		logger.warn(`Docker asset ${ref.field}` + (ref.where === ref.field ? "" : `[${displayIdent(ref.where)}]`) + ` names a host path outside the assembly, which ${renderAssemblyPathEscape(escape, bound, "load", `cdkd will ${verb} it during the image build, matching the CDK CLI — a pre-synthesized assembly is trusted input. If you did not produce this assembly, that is a host path it chose and the CloudFormation template does not show.`)}`);
 	}
 }
 /**
@@ -9578,7 +9596,7 @@ function warnManifestExecutable(executable) {
 	const [cmd, ...rest] = executable;
 	const logger = getLogger().child("assets");
 	logger.debug(`source.executable argv: ${redactDockerArgvValues([...executable]).join(" ")}`);
-	logger.warn(`Docker asset source.executable runs a command this asset manifest chose, on this machine: '${displaySafe(cmd ?? "")}'` + (rest.length > 0 ? ` (with ${rest.length} argument(s); --verbose shows them)` : "") + ". cdkd runs it, matching the CDK CLI — a pre-synthesized assembly is trusted input. Note that this means deploying from a pre-synthesized assembly DOES execute code from it, which the CloudFormation template does not show.");
+	logger.warn(`Docker asset source.executable runs a command this asset manifest chose, on this machine: ${displayAssemblyPath(cmd ?? "")}` + (rest.length > 0 ? ` (with ${rest.length} argument(s); --verbose shows them)` : "") + ". cdkd runs it, matching the CDK CLI — a pre-synthesized assembly is trusted input. Note that this means deploying from a pre-synthesized assembly DOES execute code from it, which the CloudFormation template does not show.");
 }
 /**
 * One set per KIND rather than one set of composite keys. A `${kind}` + NUL +
@@ -9619,7 +9637,7 @@ function warnUnrecognizedAssetDestination(opts) {
 	const seen = warnedDestinations[opts.kind];
 	if (seen.has(opts.name)) return;
 	seen.add(opts.name);
-	getLogger().child("assets").warn(`Asset destination ${opts.kind} '${displaySafe(opts.name)}' is not a CDK-bootstrap or cdkd-managed name, so cdkd uploads there exactly as this asset manifest wrote it, with your credentials. That is what a custom bootstrap looks like and is expected for one; if you did not configure it, the manifest chose where your assets go.`);
+	getLogger().child("assets").warn(`Asset destination ${opts.kind} ${displayIdent(opts.name)} is not a CDK-bootstrap or cdkd-managed name, so cdkd uploads there exactly as this asset manifest wrote it, with your credentials. That is what a custom bootstrap looks like and is expected for one; if you did not configure it, the manifest chose where your assets go.`);
 }
 
 //#endregion
@@ -12428,7 +12446,7 @@ var S3StateBackend = class {
 		await this.ensureClientForBucket();
 		const newKey = this.getStateKey(stackName, region);
 		const shownStackName = this.displayName(stackName);
-		const shownRegionName = displaySafe(region, { asciiOnly: true }) || "<unrenderable>";
+		const shownRegionName = displayIdent(region);
 		try {
 			this.logger.debug(`Getting state for stack: ${shownStackName} (${shownRegionName})`);
 			const response = await this.s3Client.send(new GetObjectCommand({
@@ -12436,8 +12454,8 @@ var S3StateBackend = class {
 				...await this.ownerParam(),
 				Key: newKey
 			}));
-			if (!response.Body) throw new StateError(`State file for stack '${shownStackName}' (${shownRegionName}) has no body`);
-			if (!response.ETag) throw new StateError(`State file for stack '${shownStackName}' (${shownRegionName}) has no ETag`);
+			if (!response.Body) throw new StateError(`State file for stack ${shownStackName} (${shownRegionName}) has no body`);
+			if (!response.ETag) throw new StateError(`State file for stack ${shownStackName} (${shownRegionName}) has no ETag`);
 			const bodyString = await response.Body.transformToString();
 			const parsed = this.parseStateBody(bodyString, stackName);
 			const { state, divergentBodyRegion } = this.adoptKeyRegion(parsed, region, shownStackName, shownRegionName);
@@ -12451,14 +12469,14 @@ var S3StateBackend = class {
 			if (!isNoSuchKey(error)) {
 				if (error instanceof StateError) throw error;
 				const detail = displaySafe(error instanceof Error ? error.message : String(error), { asciiOnly: true }) || "<unrenderable>";
-				throw new StateError(`Failed to get state for stack '${shownStackName}' (${shownRegionName}): ${detail}`, error instanceof Error ? error : void 0);
+				throw new StateError(`Failed to get state for stack ${shownStackName} (${shownRegionName}): ${detail}`, error instanceof Error ? error : void 0);
 			}
 			this.logger.debug(`No state at new key for stack: ${shownStackName} (${shownRegionName})`);
 		}
 		const legacy = await this.tryGetLegacy(stackName, region);
 		if (legacy) {
-			const shownKey = displaySafe(this.getLegacyStateKey(stackName), { asciiOnly: true }) || "<unrenderable>";
-			this.logger.warn(`Loaded legacy state for stack '${shownStackName}' from '${shownKey}'. It will be migrated to the region-scoped layout on next save.`);
+			const shownKey = displayIdent(this.getLegacyStateKey(stackName), { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
+			this.logger.warn(`Loaded legacy state for stack ${shownStackName} from ${shownKey}. It will be migrated to the region-scoped layout on next save.`);
 			return {
 				...legacy,
 				migrationPending: true
@@ -12548,7 +12566,7 @@ var S3StateBackend = class {
 			const legacyProbe = await this.probeLegacyState(stackName);
 			if (legacyProbe.kind === "unreadable") {
 				const safeName = this.displayName(stackName);
-				this.logger.warn(`Could not read the legacy state record for '${safeName}' while cleaning up (${legacyProbe.reason}). If one exists it was left in place. Re-run with --verbose for the details.`);
+				this.logger.warn(`Could not read the legacy state record for ${safeName} while cleaning up (${legacyProbe.reason}). If one exists it was left in place. Re-run with --verbose for the details.`);
 			}
 			if (legacyProbeBelongsTo(legacyProbe, region)) {
 				await this.s3Client.send(new DeleteObjectCommand({
@@ -12595,8 +12613,8 @@ var S3StateBackend = class {
 		await this.ensureClientForBucket();
 		const key = this.getLegacyStateKey(stackName);
 		try {
-			const safeStack = displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>";
-			this.logger.debug(`Deleting legacy state: ${safeStack} (${displaySafe(key, { asciiOnly: true }) || "<unrenderable>"})`);
+			const safeStack = displayStackName(stackName);
+			this.logger.debug(`Deleting legacy state: ${safeStack} (${displayIdent(key, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })})`);
 			await this.s3Client.send(new DeleteObjectCommand({
 				Bucket: this.config.bucket,
 				...await this.ownerParam(),
@@ -12608,7 +12626,7 @@ var S3StateBackend = class {
 				bucket: this.config.bucket,
 				operation: "DeleteObject"
 			});
-			throw new StateError(`Failed to delete legacy state for stack '${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}': ${normalized.message}`, normalized);
+			throw new StateError(`Failed to delete legacy state for stack ${displayStackName(stackName)}: ${normalized.message}`, normalized);
 		}
 	}
 	/**
@@ -13005,7 +13023,7 @@ var S3StateBackend = class {
 	* message that renders one goes through here (issue #2170's class).
 	*/
 	displayName(stackName) {
-		return displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>";
+		return displayStackName(stackName);
 	}
 	/**
 	* Make the S3 KEY's region the region of the record read from it, and report
@@ -13073,9 +13091,8 @@ var S3StateBackend = class {
 			region
 		} };
 		const kind = describeRegionValueKind(raw);
-		this.logger.warn(`State record for stack '${shownStackName}' carries a 'region' of its own (${kind}) that is not the region of the S3 key it was read from ('${shownRegionName}'). cdkd stamps the key's region into every record it writes, so this record was not written by cdkd. Continuing against '${shownRegionName}' — the key is authoritative. Re-run with --verbose to see the recorded value, where it has one to show.`);
-		const shownBodyRegion = truncateCodePoints(displaySafe(raw, { asciiOnly: true }), 255);
-		this.logger.debug(`State record for stack '${shownStackName}' carries body region ` + (shownBodyRegion.text === "" ? `${kind}, which renders as nothing — its kind above is the whole of it.` : `'${shownBodyRegion.text}'${shownBodyRegion.truncated ? " [cut]" : ""}.`));
+		this.logger.warn(`State record for stack ${shownStackName} carries a 'region' of its own (${kind}) that is not the region of the S3 key it was read from (${shownRegionName}). cdkd stamps the key's region into every record it writes, so this record was not written by cdkd. Continuing against ${shownRegionName} — the key is authoritative. Re-run with --verbose to see the recorded value, where it has one to show.`);
+		this.logger.debug(`State record for stack ${shownStackName} carries body region ` + (displaySafe(raw, { asciiOnly: true }) === "" ? `${kind}, which renders as nothing — its kind above is the whole of it.` : `${displayIdent(raw)}.`));
 		return {
 			state: {
 				...state,
@@ -13092,7 +13109,7 @@ var S3StateBackend = class {
 				Key: this.getLegacyStateKey(stackName)
 			}));
 			if (!response.Body) {
-				this.logger.debug(`Legacy state probe for '${this.displayName(stackName)}': response carried no body`);
+				this.logger.debug(`Legacy state probe for ${this.displayName(stackName)}: response carried no body`);
 				return {
 					kind: "unreadable",
 					reason: "the response carried no body"
@@ -13102,7 +13119,7 @@ var S3StateBackend = class {
 			const raw = JSON.parse(bodyString).region;
 			if (!raw) return { kind: "no-region" };
 			if (typeof raw !== "string") {
-				this.logger.debug(`Legacy state probe for '${this.displayName(stackName)}': 'region' is ${typeof raw}, not a string`);
+				this.logger.debug(`Legacy state probe for ${this.displayName(stackName)}: 'region' is ${typeof raw}, not a string`);
 				return {
 					kind: "unreadable",
 					reason: `its 'region' field is ${typeof raw}, not a string`
@@ -13115,7 +13132,7 @@ var S3StateBackend = class {
 		} catch (error) {
 			if (isNoSuchKey(error)) return { kind: "absent" };
 			const { detail } = describeAwsFailure(error);
-			this.logger.debug(`Could not read legacy state region for '${this.displayName(stackName)}': ${displaySafe(detail, { asciiOnly: true }) || "<unrenderable>"}`);
+			this.logger.debug(`Could not read legacy state region for ${this.displayName(stackName)}: ${displaySafe(detail, { asciiOnly: true }) || "<unrenderable>"}`);
 			const cls = error instanceof Error && error.name ? error.name : "an unknown error";
 			return {
 				kind: "unreadable",
@@ -13169,12 +13186,12 @@ var S3StateBackend = class {
 			const bodyString = await response.Body.transformToString();
 			const state = this.parseStateBody(bodyString, stackName);
 			if (state.region && state.region !== region) {
-				this.logger.debug(`Legacy state for stack '${this.displayName(stackName)}' has region '${displaySafe(state.region, { asciiOnly: true }) || "<unrenderable>"}', not '${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}' — skipping legacy fallback.`);
+				this.logger.debug(`Legacy state for stack ${this.displayName(stackName)} has region ${displayIdent(state.region)}, not ${displayIdent(region)} — skipping legacy fallback.`);
 				return null;
 			}
 			const legacyRegion = state.region;
 			if (legacyRegion !== void 0 && (typeof legacyRegion !== "string" || legacyRegion === "")) {
-				this.logger.debug(`Legacy state for stack '${this.displayName(stackName)}' names no usable region (${describeRegionValueKind(legacyRegion)}); reading it as region-less.`);
+				this.logger.debug(`Legacy state for stack ${this.displayName(stackName)} names no usable region (${describeRegionValueKind(legacyRegion)}); reading it as region-less.`);
 				const { region: _dropped, ...withoutRegion } = state;
 				return {
 					state: withoutRegion,
@@ -13188,7 +13205,7 @@ var S3StateBackend = class {
 		} catch (error) {
 			if (isNoSuchKey(error)) return null;
 			const detail = displaySafe(error instanceof Error ? error.message : String(error), { asciiOnly: true }) || "<unrenderable>";
-			throw new StateError(`Failed to get legacy state for stack '${this.displayName(stackName)}': ${detail}`, error instanceof Error ? error : void 0);
+			throw new StateError(`Failed to get legacy state for stack ${this.displayName(stackName)}: ${detail}`, error instanceof Error ? error : void 0);
 		}
 	}
 	/**
@@ -13204,18 +13221,18 @@ var S3StateBackend = class {
 		} catch (error) {
 			const raw = error instanceof Error ? error.message : String(error);
 			const detail = displaySafe(raw, { asciiOnly: true }) || "<unrenderable>";
-			throw new StateError(`State file for stack '${this.displayName(stackName)}' is not valid JSON: ${detail}`, error instanceof Error ? error : void 0);
+			throw new StateError(`State file for stack ${this.displayName(stackName)} is not valid JSON: ${detail}`, error instanceof Error ? error : void 0);
 		}
 		if (root === null || typeof root !== "object" || Array.isArray(root)) {
 			const got = root === null ? "null" : Array.isArray(root) ? "an array" : `a ${typeof root}`;
-			throw new StateError(`State file for stack '${this.displayName(stackName)}' is not a JSON object (it parses to ${got}), so cdkd cannot read it as a state record.`);
+			throw new StateError(`State file for stack ${this.displayName(stackName)} is not a JSON object (it parses to ${got}), so cdkd cannot read it as a state record.`);
 		}
 		const parsed = root;
 		const v = parsed.version;
 		if (v !== void 0 && !STATE_SCHEMA_VERSIONS_READABLE.includes(v)) {
 			const vShown = v;
 			const shown = displaySafe(vShown === null ? "null" : vShown, { asciiOnly: true }) || "<unrenderable>";
-			throw new StateError(`Unsupported state schema version ${shown} for stack '${this.displayName(stackName)}'. This cdkd binary supports versions ${STATE_SCHEMA_VERSIONS_READABLE.join(", ")}. Upgrade cdkd to a version that supports schema ${shown}.`);
+			throw new StateError(`Unsupported state schema version ${shown} for stack ${this.displayName(stackName)}. This cdkd binary supports versions ${STATE_SCHEMA_VERSIONS_READABLE.join(", ")}. Upgrade cdkd to a version that supports schema ${shown}.`);
 		}
 		return parsed;
 	}
@@ -13273,7 +13290,7 @@ const LOCK_OBJECT_DESCRIPTION = "a stack lock heartbeat, which records the lock
 * `grep safeSegment` answers it exactly.
 */
 function safeSegment(value) {
-	return displaySafe(value, { asciiOnly: true }) || "<unrenderable>";
+	return displayIdent(value, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
 }
 /**
 * S3-based lock manager using conditional writes (If-None-Match)
@@ -13481,7 +13498,7 @@ var LockManager = class {
 				}
 				return false;
 			}
-			throw new LockError(`Failed to acquire lock for stack '${safeSegment(stackName)}' (${safeSegment(region)}): ${displaySafe(error instanceof Error ? error.message : String(error), { asciiOnly: true }) || "<unrenderable>"}`, error instanceof Error ? error : void 0);
+			throw new LockError(`Failed to acquire lock for stack ${safeSegment(stackName)} (${safeSegment(region)}): ${displaySafe(error instanceof Error ? error.message : String(error), { asciiOnly: true }) || "<unrenderable>"}`, error instanceof Error ? error : void 0);
 		}
 	}
 	/**
@@ -13532,7 +13549,7 @@ var LockManager = class {
 				...await this.ownerParam(),
 				Key: key
 			}));
-			if (!response.Body) throw new LockError(`Lock file for stack '${shownStack}' has no body`);
+			if (!response.Body) throw new LockError(`Lock file for stack ${shownStack} has no body`);
 			const bodyString = await response.Body.transformToString();
 			const raw = JSON.parse(bodyString);
 			if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
@@ -13558,7 +13575,7 @@ var LockManager = class {
 			}
 			if (error instanceof LockError) throw error;
 			const detail = displaySafe(error instanceof Error ? error.message : String(error), { asciiOnly: true }) || "<unrenderable>";
-			throw new LockError(`Failed to get lock info for stack '${shownStack}': ${detail}`, error instanceof Error ? error : void 0);
+			throw new LockError(`Failed to get lock info for stack ${shownStack}: ${detail}`, error instanceof Error ? error : void 0);
 		}
 	}
 	/**
@@ -13852,7 +13869,7 @@ var LockManager = class {
 				objectDescription: LOCK_OBJECT_DESCRIPTION
 			});
 		} catch (error) {
-			report(`Could not purge noncurrent versions of the lock key '${displaySafe(key)}' in bucket '${this.config.bucket}': the purge could not be started. Their previous versions survive and remain readable via GetObject with a VersionId (${LOCK_OBJECT_DESCRIPTION}). Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key by hand. Underlying error: ${error instanceof Error ? error.message : String(error)}`);
+			report(`Could not purge noncurrent versions of the lock key ${displayIdent(key, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })} in bucket '${this.config.bucket}': the purge could not be started. Their previous versions survive and remain readable via GetObject with a VersionId (${LOCK_OBJECT_DESCRIPTION}). Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key by hand. Underlying error: ${error instanceof Error ? error.message : String(error)}`);
 		}
 	}
 	/**
@@ -14054,7 +14071,7 @@ var LockManager = class {
 			const lockInfo = await this.getLockInfo(stackName, region);
 			if (lockInfo) {
 				if (attempt < maxRetries) {
-					this.logger.info(`Stack '${safeSegment(stackName)}' (${safeSegment(region)}) is locked by ${lockInfo.owner}${lockInfo.operation ? ` (operation: ${lockInfo.operation})` : ""}. Lock ${formatLockExpiry(lockInfo.expiresAt)}. Retrying in ${this.formatDuration(retryDelay)}... (attempt ${attempt + 1}/${maxRetries})`);
+					this.logger.info(`Stack ${safeSegment(stackName)} (${safeSegment(region)}) is locked by ${lockInfo.owner}${lockInfo.operation ? ` (operation: ${lockInfo.operation})` : ""}. Lock ${formatLockExpiry(lockInfo.expiresAt)}. Retrying in ${this.formatDuration(retryDelay)}... (attempt ${attempt + 1}/${maxRetries})`);
 					await new Promise((resolve) => setTimeout(resolve, retryDelay));
 					continue;
 				}
@@ -14066,7 +14083,7 @@ var LockManager = class {
 		const recovery = forceUnlockCommand ? `If you are certain no other process is active, run: ${forceUnlockCommand}` : `If you are certain no other process is active, ${UNREPRODUCIBLE_LOCK_CLAUSE.charAt(0).toLowerCase()}${UNREPRODUCIBLE_LOCK_CLAUSE.slice(1)}`;
 		const safeStack = safeSegment(stackName);
 		const safeRegion = safeSegment(region);
-		throw new LockError(`Failed to acquire lock for stack '${safeStack}' (${safeRegion}) after ${maxRetries + 1} attempts. ` + (lockInfo ? `Locked by: ${lockInfo.owner}${lockInfo.operation ? `, operation: ${lockInfo.operation}` : ""}, ${expiry}. ` + recovery : `Lock exists but could not read lock info. ${recovery}`));
+		throw new LockError(`Failed to acquire lock for stack ${safeStack} (${safeRegion}) after ${maxRetries + 1} attempts. ` + (lockInfo ? `Locked by: ${lockInfo.owner}${lockInfo.operation ? `, operation: ${lockInfo.operation}` : ""}, ${expiry}. ` + recovery : `Lock exists but could not read lock info. ${recovery}`));
 	}
 };
 /**
@@ -14701,6 +14718,117 @@ function carriesSecretMask(value) {
 	return walk(value);
 }
 /**
+* The mask-only plaintexts of a pass that are a `NoEcho` value SUPPLIED IN THIS
+* DEPLOY (go-to-k/cdkd#3662), keyed by the pass's map exactly like
+* {@link resolvedPairsOf}: a copy of the map is a different pass and starts
+* with none.
+*
+* WHY A SIDE SET, when the sentinel value is otherwise the whole marker: the
+* mask-only class has TWO populations and one question tells them apart. A
+* `NoEcho` value (a handler's `Data`, or a producer output recovered from this
+* process) is fresh evidence that can differ from what the record's `***`
+* stood for. A DERIVED needle (`Fn::Base64` over a `{{resolve:...}}` input,
+* issue #2759) is the encoding of a secret whose reference the record already
+* positions, and treating it as fresh would update that resource on every
+* deploy — measured on the #3662 review round with a Base64 `UserData`. The
+* engine's no-change skip asks {@link carriesFreshNoEchoValue}, and only the
+* first population answers it.
+*/
+const freshNoEchoValuesOf = /* @__PURE__ */ new WeakMap();
+function freshNoEchoSet(secrets) {
+	let set = freshNoEchoValuesOf.get(secrets);
+	if (set === void 0) {
+		set = /* @__PURE__ */ new Set();
+		freshNoEchoValuesOf.set(secrets, set);
+	}
+	return set;
+}
+/**
+* {@link recordMaskOnlyValuesIn} for a `NoEcho` value supplied in THIS deploy,
+* which additionally marks each leaf it registered as FRESH (see
+* {@link freshNoEchoValuesOf}). The three writers are the ones that hold such a
+* value: the resolver's `Fn::GetAtt` note for a resource whose provider
+* declared `NoEcho` earlier in this run, the cross-stack recovery of an output
+* this process masked, and `Fn::Base64` over an input that embeds one.
+*/
+function recordFreshNoEchoValuesIn(value, secrets, excluded) {
+	recordMaskOnlyValuesIn(value, secrets, excluded);
+	const fresh = freshNoEchoSet(secrets);
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (node) => {
+		if (typeof node === "string") {
+			if (excluded?.has(node) !== true && isMaskOnlyPlaintext(secrets, node)) fresh.add(node);
+			return;
+		}
+		if (node === null || typeof node !== "object") return;
+		if (seen.has(node)) return;
+		seen.add(node);
+		if (Array.isArray(node)) {
+			for (const item of node) walk(item);
+			return;
+		}
+		for (const child of Object.values(node)) walk(child);
+	};
+	walk(value);
+}
+/**
+* Carry the FRESH mark of `plaintext` from `from` into `to`, when `from` marks
+* it and `to` holds it as mask-only (go-to-k/cdkd#3717). The one caller is the
+* resolver's inherited-parameter recording in a nested CHILD: the parent's
+* bag for the `AWS::CloudFormation::Stack` row is where a `NoEcho` value this
+* deploy supplied was marked, and the child resource reading the parameter
+* records the pair into its OWN bag, a different pass — which is exactly the
+* copy {@link freshNoEchoValuesOf} otherwise starts empty, so without this the
+* child's no-change skip read the new value's `***` as equal to its record.
+*/
+function carryFreshNoEchoMark(from, to, plaintext) {
+	if (freshNoEchoValuesOf.get(from)?.has(plaintext) !== true) return;
+	if (!isMaskOnlyPlaintext(to, plaintext)) return;
+	freshNoEchoSet(to).add(plaintext);
+}
+/**
+* Does `text` EMBED a fresh `NoEcho` value of this pass? Asked by
+* `Fn::Base64`, whose encoded result is a new plaintext that carries the
+* value's freshness along with its secrecy.
+*/
+function embedsFreshNoEchoValue(text, secrets) {
+	const fresh = freshNoEchoValuesOf.get(secrets);
+	if (fresh === void 0) return false;
+	for (const value of fresh) if (isMaskOnlyPlaintext(secrets, value) && text.includes(value)) return true;
+	return false;
+}
+/**
+* Does `value` hold a string leaf that {@link redactSecretsForState} will
+* replace with {@link SECRET_MASK} AND that is a `NoEcho` value supplied in
+* this deploy (go-to-k/cdkd#3662)?
+*
+* A mask-only needle reaches only the whole-value arm, so such a leaf is
+* masked exactly when the WHOLE leaf is the plaintext. What makes the question
+* worth asking: the mask identifies nothing. Two expression-redacted bags that
+* compare equal hold the same references, which is what a rotated secret
+* behind an unchanged `{{resolve:...}}` means. Two mask-redacted bags that
+* compare equal prove only that both hold SOME `NoEcho` value, so a caller
+* deciding "nothing changed" from such a comparison has to ask this first.
+*
+* A leaf that already IS the mask does not count: it was read back from state
+* (the resolver records that read as a redacted read), not supplied fresh in
+* this pass. Neither does a derived needle (see {@link freshNoEchoValuesOf}).
+*/
+function carriesFreshNoEchoValue(value, secrets) {
+	const fresh = freshNoEchoValuesOf.get(secrets);
+	if (fresh === void 0 || fresh.size === 0) return false;
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (node) => {
+		if (typeof node === "string") return fresh.has(node) && isMaskOnlyPlaintext(secrets, node);
+		if (node === null || typeof node !== "object") return false;
+		if (seen.has(node)) return false;
+		seen.add(node);
+		if (Array.isArray(node)) return node.some((item) => walk(item));
+		return Object.values(node).some((child) => walk(child));
+	};
+	return walk(value);
+}
+/**
 * The plaintexts the PERSIST path may scan for as SUBSTRINGS — every recorded
 * one except the mask-only class. See the mask-only channel note above for why the
 * mask class is whole-leaf only.
@@ -20557,7 +20685,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	["AWS::ApiGateway::Account", {
 		handled: /* @__PURE__ */ new Set(["CloudWatchRoleArn"]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ApiGateway::Authorizer", {
 		handled: /* @__PURE__ */ new Set([
@@ -20573,7 +20703,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Type"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["AuthorizerId"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ApiGateway::Deployment", {
 		handled: /* @__PURE__ */ new Set(["Description", "RestApiId"]),
@@ -20582,7 +20714,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["StageDescription", "CFn-only convenience for inline-creating a Stage; declare AWS::ApiGateway::Stage with the Description property instead"],
 			["StageName", "CFn-only convenience for inline-creating a Stage from a Deployment; declare AWS::ApiGateway::Stage explicitly to attach to this Deployment"]
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["DeploymentCanarySettings"])
+		createOnlyDrops: /* @__PURE__ */ new Set(["DeploymentCanarySettings"]),
+		readOnly: /* @__PURE__ */ new Set(["DeploymentId"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ApiGateway::Method", {
 		handled: /* @__PURE__ */ new Set([
@@ -20601,7 +20735,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"RestApiId"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ApiGateway::Resource", {
 		handled: /* @__PURE__ */ new Set([
@@ -20610,7 +20746,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"RestApiId"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["ResourceId"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ApiGateway::Stage", {
 		handled: /* @__PURE__ */ new Set([
@@ -20630,7 +20768,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Variables"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ApiGatewayV2::Api", {
 		handled: /* @__PURE__ */ new Set([
@@ -20655,7 +20795,13 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["RouteKey", "Quick-create shortcut: CreateApi inline-creates a default route+integration from RouteKey/Target/CredentialsArn. cdkd models routes/integrations as explicit AWS::ApiGatewayV2::Route/::Integration resources, so this convenience field is not wired."],
 			["Target", "Quick-create shortcut (paired with RouteKey/CredentialsArn); cdkd models the integration as an explicit AWS::ApiGatewayV2::Integration resource instead."]
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"ApiEndpoint",
+			"ApiId",
+			"ExecuteApiArn"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ApiGatewayV2::Authorizer", {
 		handled: /* @__PURE__ */ new Set([
@@ -20672,7 +20818,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Name"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["AuthorizerId"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ApiGatewayV2::Integration", {
 		handled: /* @__PURE__ */ new Set([
@@ -20696,7 +20844,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"TlsConfig"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["IntegrationId"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ApiGatewayV2::Route", {
 		handled: /* @__PURE__ */ new Set([
@@ -20714,7 +20864,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Target"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["RouteId"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ApiGatewayV2::Stage", {
 		handled: /* @__PURE__ */ new Set([
@@ -20731,7 +20883,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Tags"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(),
+		ccRouteUnavailable: false
 	}],
 	["AWS::AppSync::ApiKey", {
 		handled: /* @__PURE__ */ new Set([
@@ -20740,7 +20894,13 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Expires"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"ApiKey",
+			"ApiKeyId",
+			"Arn"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::AppSync::DataSource", {
 		handled: /* @__PURE__ */ new Set([
@@ -20759,7 +20919,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Type"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["DataSourceArn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::AppSync::GraphQLApi", {
 		handled: /* @__PURE__ */ new Set([
@@ -20783,7 +20945,17 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"XrayEnabled"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"ApiId",
+			"Arn",
+			"GraphQLDns",
+			"GraphQLEndpointArn",
+			"GraphQLUrl",
+			"RealtimeDns",
+			"RealtimeUrl"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::AppSync::GraphQLSchema", {
 		handled: /* @__PURE__ */ new Set([
@@ -20792,7 +20964,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"DefinitionS3Location"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::AppSync::Resolver", {
 		handled: /* @__PURE__ */ new Set([
@@ -20815,7 +20989,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"TypeName"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["ResolverArn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::AutoScaling::AutoScalingGroup", {
 		handled: /* @__PURE__ */ new Set([
@@ -20861,17 +21037,32 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["NotificationConfiguration", "Legacy singular form; use NotificationConfigurations (plural) which cdkd already wires"],
 			["PlacementGroup", "not yet implemented by cdkd"]
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["InstanceId"])
+		createOnlyDrops: /* @__PURE__ */ new Set(["InstanceId"]),
+		readOnly: /* @__PURE__ */ new Set(["AutoScalingGroupARN"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::BedrockAgentCore::Browser", {
 		handled: /* @__PURE__ */ new Set(),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"BrowserArn",
+			"BrowserId",
+			"Name",
+			"Status"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::BedrockAgentCore::CodeInterpreter", {
 		handled: /* @__PURE__ */ new Set(),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"CodeInterpreterArn",
+			"CodeInterpreterId",
+			"Status"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::BedrockAgentCore::Evaluator", {
 		handled: /* @__PURE__ */ new Set([
@@ -20883,7 +21074,15 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Tags"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"CreatedAt",
+			"EvaluatorArn",
+			"EvaluatorId",
+			"Status",
+			"UpdatedAt"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::BedrockAgentCore::Runtime", {
 		handled: /* @__PURE__ */ new Set([
@@ -20905,7 +21104,18 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["RequestHeaderConfiguration", "not yet implemented by cdkd"],
 			["Tags", "not yet implemented by cdkd"]
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"AgentRuntimeArn",
+			"AgentRuntimeId",
+			"AgentRuntimeVersion",
+			"CreatedAt",
+			"FailureReason",
+			"LastUpdatedAt",
+			"Status",
+			"WorkloadIdentityDetails"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Budgets::Budget", {
 		handled: /* @__PURE__ */ new Set([
@@ -20914,7 +21124,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"ResourceTags"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::CertificateManager::Certificate", {
 		handled: /* @__PURE__ */ new Set([
@@ -20929,7 +21141,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"ValidationMethod"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["CertificateArn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::CloudFormation::Stack", {
 		handled: /* @__PURE__ */ new Set(["Parameters", "TemplateURL"]),
@@ -20948,27 +21162,46 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["TemplateBody", "CFn-only inline template — cdkd reads the child template from the synth output via Metadata['aws:asset:path'] instead of accepting it inline"],
 			["TimeoutInMinutes", "CFn-only stack-create deadline — cdkd uses per-resource --resource-timeout instead (issue #459 design §9)"]
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["StackName"])
+		createOnlyDrops: /* @__PURE__ */ new Set(["StackName"]),
+		readOnly: /* @__PURE__ */ new Set([
+			"ChangeSetId",
+			"CreationTime",
+			"LastUpdateTime",
+			"Outputs",
+			"ParentId",
+			"RootId",
+			"StackId",
+			"StackStatus"
+		]),
+		ccRouteUnavailable: true
 	}],
 	["AWS::CloudFormation::WaitConditionHandle", {
 		handled: /* @__PURE__ */ new Set(),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::CloudFront::CloudFrontOriginAccessIdentity", {
 		handled: /* @__PURE__ */ new Set(["CloudFrontOriginAccessIdentityConfig"]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Id", "S3CanonicalUserId"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::CloudFront::Distribution", {
 		handled: /* @__PURE__ */ new Set(["DistributionConfig", "Tags"]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["DomainName", "Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::CloudFront::OriginAccessControl", {
 		handled: /* @__PURE__ */ new Set(["OriginAccessControlConfig"]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::CloudTrail::Trail", {
 		handled: /* @__PURE__ */ new Set([
@@ -20989,7 +21222,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"TrailName"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([["AdvancedEventSelectors", "not yet implemented by cdkd"], ["AggregationConfigurations", "not yet implemented by cdkd"]]),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn", "SnsTopicArn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::CloudWatch::Alarm", {
 		handled: /* @__PURE__ */ new Set([
@@ -21022,7 +21257,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["EvaluationWindow", "not yet implemented by cdkd"],
 			["WarmUpConfiguration", "not yet implemented by cdkd"]
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::CloudWatch::AnomalyDetector", {
 		handled: /* @__PURE__ */ new Set([
@@ -21036,7 +21273,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Stat"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		ccRouteUnavailable: true
 	}],
 	["AWS::CodeBuild::Project", {
 		handled: /* @__PURE__ */ new Set([
@@ -21068,7 +21307,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["Triggers", "not yet implemented by cdkd"],
 			["Visibility", "not yet implemented by cdkd"]
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn", "Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::CodeCommit::Repository", {
 		handled: /* @__PURE__ */ new Set([
@@ -21080,7 +21321,15 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Triggers"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"Arn",
+			"CloneUrlHttp",
+			"CloneUrlSsh",
+			"Name",
+			"RepositoryId"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Cognito::UserPool", {
 		handled: /* @__PURE__ */ new Set([
@@ -21116,7 +21365,14 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"WebAuthnUserVerification"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([["IssuerConfiguration", "not yet implemented by cdkd"], ["KeyConfiguration", "not yet implemented by cdkd"]]),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"Arn",
+			"ProviderName",
+			"ProviderURL",
+			"UserPoolId"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::DLM::LifecyclePolicy", {
 		handled: /* @__PURE__ */ new Set([
@@ -21134,7 +21390,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Tags"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn", "PolicyId"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::DocDB::DBCluster", {
 		handled: /* @__PURE__ */ new Set([
@@ -21175,7 +21433,14 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"AvailabilityZones",
 			"SnapshotIdentifier",
 			"SourceDBClusterIdentifier"
-		])
+		]),
+		readOnly: /* @__PURE__ */ new Set([
+			"ClusterResourceId",
+			"Endpoint",
+			"Id",
+			"ReadEndpoint"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::DocDB::DBInstance", {
 		handled: /* @__PURE__ */ new Set([
@@ -21192,7 +21457,13 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["CertificateRotationRestart", "not yet implemented by cdkd"],
 			["EnablePerformanceInsights", "not yet implemented by cdkd"]
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"Endpoint",
+			"Id",
+			"Port"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::DocDB::DBSubnetGroup", {
 		handled: /* @__PURE__ */ new Set([
@@ -21202,7 +21473,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Tags"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(),
+		ccRouteUnavailable: false
 	}],
 	["AWS::DynamoDB::GlobalTable", {
 		handled: /* @__PURE__ */ new Set([
@@ -21230,7 +21503,13 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["VectorIndexes", "not yet implemented by cdkd"],
 			["WarmThroughput", "not yet implemented by cdkd"]
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"Arn",
+			"StreamArn",
+			"TableId"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::DynamoDB::Table", {
 		handled: /* @__PURE__ */ new Set([
@@ -21255,7 +21534,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"WarmThroughput"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([["ImportSourceSpecification", "S3 import uses the separate ImportTable API (not CreateTable) and is create-only with no readback; deferred to a dedicated import-from-S3 PR"], ["VectorIndexes", "not yet implemented by cdkd"]]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["ImportSourceSpecification"])
+		createOnlyDrops: /* @__PURE__ */ new Set(["ImportSourceSpecification"]),
+		readOnly: /* @__PURE__ */ new Set(["Arn", "StreamArn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::EC2::EIP", {
 		handled: /* @__PURE__ */ new Set([
@@ -21274,7 +21555,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Address",
 			"IpamPoolId",
 			"TransferAddress"
-		])
+		]),
+		readOnly: /* @__PURE__ */ new Set(["AllocationId", "PublicIp"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::EC2::Instance", {
 		handled: /* @__PURE__ */ new Set([
@@ -21335,12 +21618,24 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"LicenseSpecifications",
 			"PlacementGroupName",
 			"PrivateIpAddress"
-		])
+		]),
+		readOnly: /* @__PURE__ */ new Set([
+			"InstanceId",
+			"PrivateDnsName",
+			"PrivateIp",
+			"PublicDnsName",
+			"PublicIp",
+			"State",
+			"VpcId"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::EC2::InternetGateway", {
 		handled: /* @__PURE__ */ new Set(["Tags"]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["InternetGatewayId"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::EC2::NatGateway", {
 		handled: /* @__PURE__ */ new Set([
@@ -21359,12 +21654,22 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["MaxDrainDurationSeconds", "write-only address-drain timeout with no CreateNatGateway member and no NAT gateway modify API; only ec2:DisassociateNatGatewayAddress / UnassignPrivateNatGatewayAddress accept it, and cdkd rejects NatGateway updates outright — routed via Cloud Control instead"],
 			["VpcId", "AWS derives the VPC from SubnetId; the ec2:CreateNatGateway API has no VpcId parameter"]
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["AvailabilityMode", "VpcId"])
+		createOnlyDrops: /* @__PURE__ */ new Set(["AvailabilityMode", "VpcId"]),
+		readOnly: /* @__PURE__ */ new Set([
+			"AutoProvisionZones",
+			"AutoScalingIps",
+			"EniId",
+			"NatGatewayId",
+			"RouteTableId"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::EC2::NetworkAcl", {
 		handled: /* @__PURE__ */ new Set(["Tags", "VpcId"]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::EC2::NetworkAclEntry", {
 		handled: /* @__PURE__ */ new Set([
@@ -21379,7 +21684,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"RuleNumber"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::EC2::Route", {
 		handled: /* @__PURE__ */ new Set([
@@ -21400,12 +21707,16 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"VpcPeeringConnectionId"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([["OdbNetworkArn", "not yet implemented by cdkd"]]),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["CidrBlock"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::EC2::RouteTable", {
 		handled: /* @__PURE__ */ new Set(["Tags", "VpcId"]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["RouteTableId"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::EC2::SecurityGroup", {
 		handled: /* @__PURE__ */ new Set([
@@ -21417,7 +21728,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"VpcId"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["GroupId", "Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::EC2::SecurityGroupIngress", {
 		handled: /* @__PURE__ */ new Set([
@@ -21433,7 +21746,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"ToPort"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([["GroupName", "EC2-Classic-only — use GroupId for VPC security groups (EC2-Classic retired 2022-08-15)"], ["SourceSecurityGroupName", "EC2-Classic-only — use SourceSecurityGroupId for VPC peer security groups (EC2-Classic retired 2022-08-15)"]]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["GroupName", "SourceSecurityGroupName"])
+		createOnlyDrops: /* @__PURE__ */ new Set(["GroupName", "SourceSecurityGroupName"]),
+		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::EC2::Subnet", {
 		handled: /* @__PURE__ */ new Set([
@@ -21465,17 +21780,28 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Ipv6Native",
 			"Ipv6NetmaskLength",
 			"OutpostArn"
-		])
+		]),
+		readOnly: /* @__PURE__ */ new Set([
+			"BlockPublicAccessStates",
+			"Ipv6CidrBlocks",
+			"NetworkAclAssociationId",
+			"SubnetId"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::EC2::SubnetNetworkAclAssociation", {
 		handled: /* @__PURE__ */ new Set(["NetworkAclId", "SubnetId"]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["AssociationId"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::EC2::SubnetRouteTableAssociation", {
 		handled: /* @__PURE__ */ new Set(["RouteTableId", "SubnetId"]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::EC2::VPC", {
 		handled: /* @__PURE__ */ new Set([
@@ -21494,12 +21820,22 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Ipv4IpamPoolId",
 			"Ipv4NetmaskLength",
 			"VpcEncryptionControl"
-		])
+		]),
+		readOnly: /* @__PURE__ */ new Set([
+			"CidrBlockAssociations",
+			"DefaultNetworkAcl",
+			"DefaultSecurityGroup",
+			"Ipv6CidrBlocks",
+			"VpcId"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::EC2::VPCGatewayAttachment", {
 		handled: /* @__PURE__ */ new Set(["InternetGatewayId", "VpcId"]),
 		silentDrop: /* @__PURE__ */ new Map([["VpnGatewayId", "not yet implemented by cdkd"]]),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["AttachmentType"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ECR::Repository", {
 		handled: /* @__PURE__ */ new Set([
@@ -21514,7 +21850,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Tags"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn", "RepositoryUri"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ECS::Cluster", {
 		handled: /* @__PURE__ */ new Set([
@@ -21527,7 +21865,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Tags"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ECS::Service", {
 		handled: /* @__PURE__ */ new Set([
@@ -21560,7 +21900,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"VpcLatticeConfigurations"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Name", "ServiceArn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ECS::TaskDefinition", {
 		handled: /* @__PURE__ */ new Set([
@@ -21583,7 +21925,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Volumes"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([["InferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["InferenceAccelerators"])
+		createOnlyDrops: /* @__PURE__ */ new Set(["InferenceAccelerators"]),
+		readOnly: /* @__PURE__ */ new Set(["TaskDefinitionArn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::EFS::AccessPoint", {
 		handled: /* @__PURE__ */ new Set([
@@ -21593,7 +21937,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"RootDirectory"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([["ClientToken", "cdkd supplies its own retry-stable ClientToken on CreateAccessPoint (issues #2039 and #2080), so a template-supplied value would be overwritten. The SDK does not own this field either: measured against @aws-sdk/client-efs 3.1018.0, an omitted ClientToken is auto-filled with a FRESH uuid per attempt, which leaves a retried 500 free to mint a second access point, while a caller-supplied value goes on the wire verbatim."]]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["ClientToken"])
+		createOnlyDrops: /* @__PURE__ */ new Set(["ClientToken"]),
+		readOnly: /* @__PURE__ */ new Set(["AccessPointId", "Arn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::EFS::FileSystem", {
 		handled: /* @__PURE__ */ new Set([
@@ -21611,7 +21957,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"ThroughputMode"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([["ReplicationConfiguration", "Cross-region EFS replication (CreateReplicationConfiguration) provisions a separate destination file system in another region with its own lifecycle, KMS key, and availability-zone placement; replicating + then tearing down the destination on destroy is a multi-resource, cross-region orchestration that is out of scope for the single-resource SDK provider. Tracked as a follow-up to issue #609."]]),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn", "FileSystemId"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::EFS::MountTarget", {
 		handled: /* @__PURE__ */ new Set([
@@ -21628,7 +21976,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"IpAddress",
 			"IpAddressType",
 			"Ipv6Address"
-		])
+		]),
+		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ElastiCache::CacheCluster", {
 		handled: /* @__PURE__ */ new Set([
@@ -21657,7 +22007,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"VpcSecurityGroupIds"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([["CacheSecurityGroupNames", "EC2-Classic-only — use VpcSecurityGroupIds for VPC-deployed clusters (EC2-Classic retired 2022-08-15)"], ["SnapshotArns", "not yet implemented by cdkd"]]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["SnapshotArns"])
+		createOnlyDrops: /* @__PURE__ */ new Set(["SnapshotArns"]),
+		readOnly: /* @__PURE__ */ new Set(["ConfigurationEndpoint", "RedisEndpoint"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ElastiCache::SubnetGroup", {
 		handled: /* @__PURE__ */ new Set([
@@ -21668,7 +22020,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Tags"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ElasticLoadBalancingV2::Listener", {
 		handled: /* @__PURE__ */ new Set([
@@ -21683,7 +22037,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"SslPolicy"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([["Tags", "not yet implemented by cdkd"]]),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["ListenerArn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ElasticLoadBalancingV2::LoadBalancer", {
 		handled: /* @__PURE__ */ new Set([
@@ -21703,7 +22059,15 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Type"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"CanonicalHostedZoneID",
+			"DNSName",
+			"LoadBalancerArn",
+			"LoadBalancerFullName",
+			"LoadBalancerName"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ElasticLoadBalancingV2::TargetGroup", {
 		handled: /* @__PURE__ */ new Set([
@@ -21729,7 +22093,14 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"VpcId"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"LoadBalancerArns",
+			"TargetGroupArn",
+			"TargetGroupFullName",
+			"TargetGroupName"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::EMR::Cluster", {
 		handled: /* @__PURE__ */ new Set([
@@ -21762,7 +22133,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"VisibleToAllUsers"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Id", "MasterPublicDNS"]),
+		ccRouteUnavailable: true
 	}],
 	["AWS::EMR::InstanceFleetConfig", {
 		handled: /* @__PURE__ */ new Set([
@@ -21776,7 +22149,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"TargetSpotCapacity"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		ccRouteUnavailable: true
 	}],
 	["AWS::EMR::InstanceGroupConfig", {
 		handled: /* @__PURE__ */ new Set([
@@ -21793,7 +22168,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Name"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["InstanceGroupId"]),
+		ccRouteUnavailable: true
 	}],
 	["AWS::Events::EventBus", {
 		handled: /* @__PURE__ */ new Set([
@@ -21807,7 +22184,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Tags"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Events::Rule", {
 		handled: /* @__PURE__ */ new Set([
@@ -21822,7 +22201,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Targets"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn", "RuleName"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::FSx::FileSystem", {
 		handled: /* @__PURE__ */ new Set([
@@ -21842,12 +22223,22 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"WindowsConfiguration"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"DNSName",
+			"Id",
+			"LustreMountName",
+			"ResourceARN",
+			"RootVolumeId"
+		]),
+		ccRouteUnavailable: true
 	}],
 	["AWS::Glue::Connection", {
 		handled: /* @__PURE__ */ new Set(["CatalogId", "ConnectionInput"]),
 		silentDrop: /* @__PURE__ */ new Map([["Tags", "not yet implemented by cdkd"]]),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Name"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Glue::Crawler", {
 		handled: /* @__PURE__ */ new Set([
@@ -21868,7 +22259,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Targets"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Glue::Database", {
 		handled: /* @__PURE__ */ new Set([
@@ -21877,7 +22270,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"DatabaseName"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Glue::Job", {
 		handled: /* @__PURE__ */ new Set([
@@ -21907,12 +22302,16 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"WorkerType"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Glue::SecurityConfiguration", {
 		handled: /* @__PURE__ */ new Set(["EncryptionConfiguration", "Name"]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Glue::Table", {
 		handled: /* @__PURE__ */ new Set([
@@ -21923,7 +22322,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"TableInput"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Glue::Trigger", {
 		handled: /* @__PURE__ */ new Set([
@@ -21939,7 +22340,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"WorkflowName"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Glue::Workflow", {
 		handled: /* @__PURE__ */ new Set([
@@ -21950,7 +22353,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Tags"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(),
+		ccRouteUnavailable: false
 	}],
 	["AWS::IAM::AccessKey", {
 		handled: /* @__PURE__ */ new Set([
@@ -21959,7 +22364,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"UserName"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Id", "SecretAccessKey"]),
+		ccRouteUnavailable: true
 	}],
 	["AWS::IAM::Group", {
 		handled: /* @__PURE__ */ new Set([
@@ -21969,7 +22376,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Policies"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::IAM::InstanceProfile", {
 		handled: /* @__PURE__ */ new Set([
@@ -21978,7 +22387,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Roles"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::IAM::ManagedPolicy", {
 		handled: /* @__PURE__ */ new Set([
@@ -21992,7 +22403,18 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Users"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"AttachmentCount",
+			"CreateDate",
+			"DefaultVersionId",
+			"IsAttachable",
+			"PermissionsBoundaryUsageCount",
+			"PolicyArn",
+			"PolicyId",
+			"UpdateDate"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::IAM::Policy", {
 		handled: /* @__PURE__ */ new Set([
@@ -22003,7 +22425,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Users"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::IAM::Role", {
 		handled: /* @__PURE__ */ new Set([
@@ -22018,7 +22442,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Tags"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn", "RoleId"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::IAM::User", {
 		handled: /* @__PURE__ */ new Set([
@@ -22032,12 +22458,16 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"UserName"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::IAM::UserToGroupAddition", {
 		handled: /* @__PURE__ */ new Set(["GroupName", "Users"]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Kinesis::Stream", {
 		handled: /* @__PURE__ */ new Set([
@@ -22051,7 +22481,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Tags"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([["WarmThroughputMiBps", "not yet implemented by cdkd"]]),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn", "WarmThroughputObject"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Kinesis::StreamConsumer", {
 		handled: /* @__PURE__ */ new Set([
@@ -22060,7 +22492,13 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Tags"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"ConsumerARN",
+			"ConsumerCreationTimestamp",
+			"ConsumerStatus"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::KinesisFirehose::DeliveryStream", {
 		handled: /* @__PURE__ */ new Set([
@@ -22089,12 +22527,16 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"DatabaseSourceConfiguration",
 			"DirectPutSourceConfiguration",
 			"MSKSourceConfiguration"
-		])
+		]),
+		readOnly: /* @__PURE__ */ new Set(["Arn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::KMS::Alias", {
 		handled: /* @__PURE__ */ new Set(["AliasName", "TargetKeyId"]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(),
+		ccRouteUnavailable: false
 	}],
 	["AWS::KMS::Key", {
 		handled: /* @__PURE__ */ new Set([
@@ -22112,7 +22554,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Tags"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn", "KeyId"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Lambda::EventInvokeConfig", {
 		handled: /* @__PURE__ */ new Set([
@@ -22123,7 +22567,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Qualifier"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Lambda::EventSourceMapping", {
 		handled: /* @__PURE__ */ new Set([
@@ -22157,7 +22603,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"TumblingWindowInSeconds"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["EventSourceMappingArn", "Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Lambda::Function", {
 		handled: /* @__PURE__ */ new Set([
@@ -22195,7 +22643,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["FunctionScalingConfig", "not yet implemented by cdkd"],
 			["PublishToLatestPublished", "CloudFormation-only version-publishing directive with no AWS SDK equivalent"]
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn", "SnapStartResponse"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Lambda::LayerVersion", {
 		handled: /* @__PURE__ */ new Set([
@@ -22207,7 +22657,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"LicenseInfo"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["LayerVersionArn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Lambda::MicrovmImage", {
 		handled: /* @__PURE__ */ new Set([
@@ -22227,7 +22679,16 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Tags"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"CreatedAt",
+			"ImageArn",
+			"LatestActiveImageVersion",
+			"LatestFailedImageVersion",
+			"State",
+			"UpdatedAt"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Lambda::Permission", {
 		handled: /* @__PURE__ */ new Set([
@@ -22242,7 +22703,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"SourceArn"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Lambda::Url", {
 		handled: /* @__PURE__ */ new Set([
@@ -22253,7 +22716,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"TargetFunctionArn"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["FunctionArn", "FunctionUrl"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Logs::LogGroup", {
 		handled: /* @__PURE__ */ new Set([
@@ -22268,7 +22733,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Tags"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([["ResourcePolicyDocument", "covered by the separate account-wide AWS::Logs::ResourcePolicy resource type; logs:PutResourcePolicy is account-scoped, not per-log-group, so it has no CreateLogGroup / PutRetentionPolicy counterpart — routed via Cloud Control instead"]]),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Neptune::DBCluster", {
 		handled: /* @__PURE__ */ new Set([
@@ -22311,7 +22778,14 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"SnapshotIdentifier",
 			"SourceDBClusterIdentifier",
 			"UseLatestRestorableTime"
-		])
+		]),
+		readOnly: /* @__PURE__ */ new Set([
+			"ClusterResourceId",
+			"Endpoint",
+			"Port",
+			"ReadEndpoint"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Neptune::DBInstance", {
 		handled: /* @__PURE__ */ new Set([
@@ -22331,7 +22805,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["DBSnapshotIdentifier", "not yet implemented by cdkd"],
 			["PubliclyAccessible", "not yet implemented by cdkd"]
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["DBSnapshotIdentifier"])
+		createOnlyDrops: /* @__PURE__ */ new Set(["DBSnapshotIdentifier"]),
+		readOnly: /* @__PURE__ */ new Set(["Endpoint", "Port"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Neptune::DBSubnetGroup", {
 		handled: /* @__PURE__ */ new Set([
@@ -22341,7 +22817,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Tags"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(),
+		ccRouteUnavailable: false
 	}],
 	["AWS::RDS::DBCluster", {
 		handled: /* @__PURE__ */ new Set([
@@ -22420,7 +22898,16 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"SourceDbClusterResourceId",
 			"SourceRegion",
 			"UseLatestRestorableTime"
-		])
+		]),
+		readOnly: /* @__PURE__ */ new Set([
+			"DBClusterArn",
+			"DBClusterResourceId",
+			"Endpoint",
+			"ReadEndpoint",
+			"StorageEncryptionType",
+			"StorageThroughput"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::RDS::DBInstance", {
 		handled: /* @__PURE__ */ new Set([
@@ -22519,7 +23006,28 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"NcharCharacterSetName",
 			"SourceRegion",
 			"Timezone"
-		])
+		]),
+		readOnly: /* @__PURE__ */ new Set([
+			"AutomaticRestartTime",
+			"CertificateDetails",
+			"DBInstanceArn",
+			"DBInstanceStatus",
+			"DbiResourceId",
+			"Endpoint",
+			"InstanceCreateTime",
+			"IsStorageConfigUpgradeAvailable",
+			"LatestRestorableTime",
+			"ListenerEndpoint",
+			"PercentProgress",
+			"ReadReplicaDBClusterIdentifiers",
+			"ReadReplicaDBInstanceIdentifiers",
+			"ResumeFullAutomationModeTime",
+			"SecondaryAvailabilityZone",
+			"StatusInfos",
+			"StorageOperationPercentProgress",
+			"StorageOperationStatus"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::RDS::DBProxy", {
 		handled: /* @__PURE__ */ new Set([
@@ -22539,7 +23047,13 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["EndpointNetworkType", "not yet implemented by cdkd"],
 			["TargetConnectionNetworkType", "not yet implemented by cdkd"]
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["EndpointNetworkType", "TargetConnectionNetworkType"])
+		createOnlyDrops: /* @__PURE__ */ new Set(["EndpointNetworkType", "TargetConnectionNetworkType"]),
+		readOnly: /* @__PURE__ */ new Set([
+			"DBProxyArn",
+			"Endpoint",
+			"VpcId"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::RDS::DBProxyEndpoint", {
 		handled: /* @__PURE__ */ new Set([
@@ -22551,7 +23065,14 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"VpcSubnetIds"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([["EndpointNetworkType", "not yet implemented by cdkd"]]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["EndpointNetworkType"])
+		createOnlyDrops: /* @__PURE__ */ new Set(["EndpointNetworkType"]),
+		readOnly: /* @__PURE__ */ new Set([
+			"DBProxyEndpointArn",
+			"Endpoint",
+			"IsDefault",
+			"VpcId"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::RDS::DBProxyTargetGroup", {
 		handled: /* @__PURE__ */ new Set([
@@ -22562,7 +23083,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"TargetGroupName"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["TargetGroupArn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::RDS::DBSubnetGroup", {
 		handled: /* @__PURE__ */ new Set([
@@ -22572,7 +23095,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Tags"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["DBSubnetGroupArn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Route53::HostedZone", {
 		handled: /* @__PURE__ */ new Set([
@@ -22584,7 +23109,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"VPCs"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Id", "NameServers"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Route53::RecordSet", {
 		handled: /* @__PURE__ */ new Set([
@@ -22607,7 +23134,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Weight"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(),
+		ccRouteUnavailable: false
 	}],
 	["AWS::S3::Bucket", {
 		handled: /* @__PURE__ */ new Set([
@@ -22639,12 +23168,22 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["MetadataConfiguration", "not yet implemented by cdkd"],
 			["MetadataTableConfiguration", "not yet implemented by cdkd"]
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set(["BucketNamePrefix", "BucketNamespace"])
+		createOnlyDrops: /* @__PURE__ */ new Set(["BucketNamePrefix", "BucketNamespace"]),
+		readOnly: /* @__PURE__ */ new Set([
+			"Arn",
+			"DomainName",
+			"DualStackDomainName",
+			"RegionalDomainName",
+			"WebsiteURL"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::S3::BucketPolicy", {
 		handled: /* @__PURE__ */ new Set(["Bucket", "PolicyDocument"]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(),
+		ccRouteUnavailable: false
 	}],
 	["AWS::S3Express::DirectoryBucket", {
 		handled: /* @__PURE__ */ new Set([
@@ -22659,12 +23198,16 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["LifecycleConfiguration", "not yet implemented by cdkd"],
 			["MetricsConfigurations", "not yet implemented by cdkd"]
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn", "AvailabilityZoneName"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::S3Tables::Namespace", {
 		handled: /* @__PURE__ */ new Set(["Namespace", "TableBucketARN"]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(),
+		ccRouteUnavailable: false
 	}],
 	["AWS::S3Tables::Table", {
 		handled: /* @__PURE__ */ new Set([
@@ -22687,7 +23230,13 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"IcebergMetadata",
 			"StorageClassConfiguration",
 			"WithoutMetadata"
-		])
+		]),
+		readOnly: /* @__PURE__ */ new Set([
+			"TableARN",
+			"VersionToken",
+			"WarehouseLocation"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::S3Tables::TableBucket", {
 		handled: /* @__PURE__ */ new Set(["TableBucketName", "Tags"]),
@@ -22698,7 +23247,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["StorageClassConfiguration", "not yet implemented by cdkd"],
 			["UnreferencedFileRemoval", "not yet implemented by cdkd"]
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["TableBucketARN"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::S3Vectors::VectorBucket", {
 		handled: /* @__PURE__ */ new Set([
@@ -22707,7 +23258,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"VectorBucketName"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["CreationTime", "VectorBucketArn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::Scheduler::Schedule", {
 		handled: /* @__PURE__ */ new Set([
@@ -22724,7 +23277,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Target"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn"]),
+		ccRouteUnavailable: true
 	}],
 	["AWS::SecretsManager::Secret", {
 		handled: /* @__PURE__ */ new Set([
@@ -22738,7 +23293,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Type"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ServiceDiscovery::HttpNamespace", {
 		handled: /* @__PURE__ */ new Set([
@@ -22747,7 +23304,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Tags"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn", "Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ServiceDiscovery::PrivateDnsNamespace", {
 		handled: /* @__PURE__ */ new Set([
@@ -22758,7 +23317,13 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Vpc"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"Arn",
+			"HostedZoneId",
+			"Id"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ServiceDiscovery::PublicDnsNamespace", {
 		handled: /* @__PURE__ */ new Set([
@@ -22768,7 +23333,13 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Tags"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"Arn",
+			"HostedZoneId",
+			"Id"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::ServiceDiscovery::Service", {
 		handled: /* @__PURE__ */ new Set([
@@ -22783,7 +23354,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Type"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn", "Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::SNS::Subscription", {
 		handled: /* @__PURE__ */ new Set([
@@ -22799,7 +23372,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"TopicArn"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([["Region", "CFn-only cross-region subscription hint; cdkd uses the SDK client region directly and has no per-resource region override"]]),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::SNS::Topic", {
 		handled: /* @__PURE__ */ new Set([
@@ -22819,12 +23394,16 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"TracingConfig"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["TopicArn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::SNS::TopicPolicy", {
 		handled: /* @__PURE__ */ new Set(["PolicyDocument", "Topics"]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::SQS::Queue", {
 		handled: /* @__PURE__ */ new Set([
@@ -22846,12 +23425,16 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"VisibilityTimeout"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn", "QueueUrl"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::SQS::QueuePolicy", {
 		handled: /* @__PURE__ */ new Set(["PolicyDocument", "Queues"]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::SSM::Parameter", {
 		handled: /* @__PURE__ */ new Set([
@@ -22866,7 +23449,9 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Value"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set(["Arn"]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::StepFunctions::StateMachine", {
 		handled: /* @__PURE__ */ new Set([
@@ -22883,7 +23468,13 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"TracingConfiguration"
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"Arn",
+			"Name",
+			"StateMachineRevisionId"
+		]),
+		ccRouteUnavailable: false
 	}],
 	["AWS::WAFv2::WebACL", {
 		handled: /* @__PURE__ */ new Set([
@@ -22906,10 +23497,329 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["MonetizationConfig", "not yet implemented by cdkd"],
 			["OnSourceDDoSProtectionConfig", "not yet implemented by cdkd"]
 		]),
-		createOnlyDrops: /* @__PURE__ */ new Set()
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"Arn",
+			"Capacity",
+			"Id",
+			"LabelNamespace"
+		]),
+		ccRouteUnavailable: false
 	}]
 ]);
 
+//#endregion
+//#region src/provisioning/unsupported-types.generated.ts
+/**
+* AUTO-GENERATED by scripts/gen-unsupported-types.ts — DO NOT EDIT BY HAND.
+* Source: docs/_generated/provider-coverage.json (tier3), minus
+* registry-routed special cases (see REGISTRY_ROUTED_EXCLUSIONS in the
+* generator).
+* Regenerate: `vp run gen:unsupported-types`.
+*
+* AWS CloudFormation resource types AWS reports as
+* `ProvisioningType: NON_PROVISIONABLE` (Cloud Control API cannot
+* create/update/delete them) and for which cdkd has no SDK provider. cdkd
+* pre-flight rejects these fast with an actionable message instead of letting
+* the optimistic Cloud Control fallthrough fail mid-deploy.
+*/
+const NON_PROVISIONABLE_TYPES = /* @__PURE__ */ new Set([
+	"Alexa::ASK::Skill",
+	"AWS::AmazonMQ::ConfigurationAssociation",
+	"AWS::Amplify::Jobs",
+	"AWS::AmplifyUIBuilder::CodegenJob",
+	"AWS::AppMesh::GatewayRoute",
+	"AWS::AppMesh::Mesh",
+	"AWS::AppMesh::Route",
+	"AWS::AppMesh::VirtualGateway",
+	"AWS::AppMesh::VirtualNode",
+	"AWS::AppMesh::VirtualRouter",
+	"AWS::AppMesh::VirtualService",
+	"AWS::AppStream::Fleet",
+	"AWS::AppStream::StackFleetAssociation",
+	"AWS::AppSync::ApiCache",
+	"AWS::Artifact::Report",
+	"AWS::Athena::Session",
+	"AWS::AutoScalingPlans::ScalingPlan",
+	"AWS::BackupSearch::SearchJob",
+	"AWS::BackupSearch::SearchResultExportJob",
+	"AWS::BCMDataExports::Table",
+	"AWS::Bedrock::AsyncInvoke",
+	"AWS::Bedrock::DefaultPromptRouter",
+	"AWS::Bedrock::FlowExecution",
+	"AWS::Bedrock::FoundationModel",
+	"AWS::Bedrock::ImportedModel",
+	"AWS::Bedrock::ModelImportJob",
+	"AWS::Bedrock::ModelInvocationJob",
+	"AWS::BedrockAgentCore::ConfigurationBundleVersion",
+	"AWS::BedrockAgentCore::HarnessVersion",
+	"AWS::BedrockAgentCore::PolicyGeneration",
+	"AWS::BedrockAgentCore::TokenVault",
+	"AWS::Braket::Job",
+	"AWS::Cassandra::Stream",
+	"AWS::Cloud9::EnvironmentEC2",
+	"AWS::CloudFormation::Macro",
+	"AWS::CloudFormation::ResourceScan",
+	"AWS::CloudFormation::WaitCondition",
+	"AWS::CloudFront::StreamingDistribution",
+	"AWS::CodeArtifact::Package",
+	"AWS::CodeBuild::Build",
+	"AWS::CodeBuild::BuildBatch",
+	"AWS::CodeBuild::Sandbox",
+	"AWS::CodeStar::GitHubRepository",
+	"AWS::CognitoSync::Dataset",
+	"AWS::Comprehend::DocumentClassificationJob",
+	"AWS::Comprehend::DominantLanguageDetectionJob",
+	"AWS::Comprehend::EntitiesDetectionJob",
+	"AWS::Comprehend::FlywheelDataset",
+	"AWS::Comprehend::SentimentDetectionJob",
+	"AWS::Comprehend::TargetedSentimentDetectionJob",
+	"AWS::Config::ConfigurationRecorder",
+	"AWS::Config::DeliveryChannel",
+	"AWS::Config::OrganizationConfigRule",
+	"AWS::ControlCatalog::CommonControl",
+	"AWS::ControlCatalog::Control",
+	"AWS::ControlCatalog::Objective",
+	"AWS::DataExchange::Assets",
+	"AWS::DataExchange::EntitledDataSets",
+	"AWS::DataExchange::Job",
+	"AWS::DataSync::TaskExecution",
+	"AWS::DAX::Cluster",
+	"AWS::DAX::SubnetGroup",
+	"AWS::Deadline::Job",
+	"AWS::DirectoryService::MicrosoftAD",
+	"AWS::DMS::ReplicationInstance",
+	"AWS::DRS::RecoveryInstance",
+	"AWS::DynamoDB::Export",
+	"AWS::DynamoDB::Stream",
+	"AWS::EC2::ClientVpnAuthorizationRule",
+	"AWS::EC2::ClientVpnEndpoint",
+	"AWS::EC2::ClientVpnRoute",
+	"AWS::EC2::ClientVpnTargetNetworkAssociation",
+	"AWS::EC2::ExportInstanceTask",
+	"AWS::EC2::NetworkInterfacePermission",
+	"AWS::EC2::ReplaceRootVolumeTask",
+	"AWS::EC2::VpnConnectionDeviceType",
+	"AWS::EC2::VPNGatewayRoutePropagation",
+	"AWS::ECRPublic::Registry",
+	"AWS::ECS::ContainerInstance",
+	"AWS::ECS::Task",
+	"AWS::ElastiCache::ReservedCacheNode",
+	"AWS::ElastiCache::SecurityGroup",
+	"AWS::ElastiCache::SecurityGroupIngress",
+	"AWS::ElasticLoadBalancingV2::ListenerCertificate",
+	"AWS::Elasticsearch::Domain",
+	"AWS::EMR::NotebookExecution",
+	"AWS::EMRContainers::JobRun",
+	"AWS::EMRServerless::JobRun",
+	"AWS::Events::Replay",
+	"AWS::FIS::Experiment",
+	"AWS::FIS::SafetyLever",
+	"AWS::FSx::Snapshot",
+	"AWS::FSx::StorageVirtualMachine",
+	"AWS::Glue::DevEndpoint",
+	"AWS::Glue::Partition",
+	"AWS::Glue::TableVersion",
+	"AWS::Greengrass::ConnectorDefinition",
+	"AWS::Greengrass::ConnectorDefinitionVersion",
+	"AWS::Greengrass::CoreDefinition",
+	"AWS::Greengrass::CoreDefinitionVersion",
+	"AWS::Greengrass::DeviceDefinition",
+	"AWS::Greengrass::DeviceDefinitionVersion",
+	"AWS::Greengrass::FunctionDefinition",
+	"AWS::Greengrass::FunctionDefinitionVersion",
+	"AWS::Greengrass::Group",
+	"AWS::Greengrass::GroupVersion",
+	"AWS::Greengrass::LoggerDefinition",
+	"AWS::Greengrass::LoggerDefinitionVersion",
+	"AWS::Greengrass::ResourceDefinition",
+	"AWS::Greengrass::ResourceDefinitionVersion",
+	"AWS::Greengrass::SubscriptionDefinition",
+	"AWS::Greengrass::SubscriptionDefinitionVersion",
+	"AWS::GreengrassV2::Component",
+	"AWS::GreengrassV2::CoreDevice",
+	"AWS::IdentityStore::AllGroupMemberships",
+	"AWS::ImageBuilder::AllImageBuildVersions",
+	"AWS::ImageBuilder::AllWorkflowBuildVersions",
+	"AWS::ImageBuilder::LifecycleExecution",
+	"AWS::ImageBuilder::WorkflowExecution",
+	"AWS::ImageBuilder::WorkflowStepExecution",
+	"AWS::InternetMonitor::InternetEvent",
+	"AWS::IoT::Index",
+	"AWS::IoT::PolicyPrincipalAttachment",
+	"AWS::IoT::ThingPrincipalAttachment",
+	"AWS::IoTDeviceAdvisor::SuiteRun",
+	"AWS::IoTThingsGraph::FlowTemplate",
+	"AWS::IoTTwinMaker::MetadataTransferJob",
+	"AWS::IVS::Composition",
+	"AWS::KafkaConnect::ConnectorOperation",
+	"AWS::KinesisAnalytics::Application",
+	"AWS::KinesisAnalytics::ApplicationOutput",
+	"AWS::KinesisAnalytics::ApplicationReferenceDataSource",
+	"AWS::KinesisAnalyticsV2::ApplicationCloudWatchLoggingOption",
+	"AWS::KinesisAnalyticsV2::ApplicationOutput",
+	"AWS::KinesisAnalyticsV2::ApplicationReferenceDataSource",
+	"AWS::LakeFormation::DataLakeSettings",
+	"AWS::LakeFormation::Permissions",
+	"AWS::LakeFormation::Resource",
+	"AWS::Lambda::DurableExecution",
+	"AWS::Lightsail::ExportSnapshotRecord",
+	"AWS::Location::Job",
+	"AWS::Macie2::ClassificationJob",
+	"AWS::ManagedBlockchain::Member",
+	"AWS::ManagedBlockchain::Node",
+	"AWS::MediaConnect::Offering",
+	"AWS::MediaConnect::Reservation",
+	"AWS::MediaConvert::JobTemplate",
+	"AWS::MediaConvert::Queue",
+	"AWS::MediaLive::Channel",
+	"AWS::MediaLive::Input",
+	"AWS::MediaLive::InputSecurityGroup",
+	"AWS::MediaLive::Offering",
+	"AWS::MediaPackage::HarvestJob",
+	"AWS::MediaPackageV2::HarvestJob",
+	"AWS::MediaStore::Container",
+	"AWS::MedicalImaging::ImageSet",
+	"AWS::MemoryDB::MultiRegionParameterGroup",
+	"AWS::MemoryDB::ReservedNode",
+	"AWS::NeptuneGraph::ExportTask",
+	"AWS::NovaAct::WorkflowRun",
+	"AWS::Omics::ReadSet",
+	"AWS::Omics::Reference",
+	"AWS::Omics::Run",
+	"AWS::Omics::Task",
+	"AWS::OpsWorks::App",
+	"AWS::OpsWorks::ElasticLoadBalancerAttachment",
+	"AWS::OpsWorks::Instance",
+	"AWS::OpsWorks::Layer",
+	"AWS::OpsWorks::Stack",
+	"AWS::OpsWorks::UserProfile",
+	"AWS::OpsWorks::Volume",
+	"AWS::Organizations::Root",
+	"AWS::OSIS::PipelineBlueprint",
+	"AWS::PartnerCentral::ConnectionPreferences",
+	"AWS::PartnerCentral::Partner",
+	"AWS::Personalize::BatchInferenceJob",
+	"AWS::Personalize::BatchSegmentJob",
+	"AWS::Personalize::DataDeletionJob",
+	"AWS::Personalize::DatasetExportJob",
+	"AWS::Personalize::Recipe",
+	"AWS::Pinpoint::ADMChannel",
+	"AWS::Pinpoint::APNSChannel",
+	"AWS::Pinpoint::APNSSandboxChannel",
+	"AWS::Pinpoint::APNSVoipChannel",
+	"AWS::Pinpoint::APNSVoipSandboxChannel",
+	"AWS::Pinpoint::App",
+	"AWS::Pinpoint::ApplicationSettings",
+	"AWS::Pinpoint::BaiduChannel",
+	"AWS::Pinpoint::Campaign",
+	"AWS::Pinpoint::EmailChannel",
+	"AWS::Pinpoint::EmailTemplate",
+	"AWS::Pinpoint::EventStream",
+	"AWS::Pinpoint::GCMChannel",
+	"AWS::Pinpoint::PushTemplate",
+	"AWS::Pinpoint::Segment",
+	"AWS::Pinpoint::SMSChannel",
+	"AWS::Pinpoint::SmsTemplate",
+	"AWS::Pinpoint::VoiceChannel",
+	"AWS::PinpointEmail::ConfigurationSet",
+	"AWS::PinpointEmail::ConfigurationSetEventDestination",
+	"AWS::PinpointEmail::DedicatedIpPool",
+	"AWS::PinpointEmail::Identity",
+	"AWS::QLDB::Ledger",
+	"AWS::QuickSight::AssetBundleExportJob",
+	"AWS::QuickSight::AssetBundleImportJob",
+	"AWS::RDS::DBSecurityGroup",
+	"AWS::RDS::DBSecurityGroupIngress",
+	"AWS::RDS::ReservedDBInstance",
+	"AWS::Redshift::ClusterSecurityGroup",
+	"AWS::Redshift::ClusterSecurityGroupIngress",
+	"AWS::Redshift::DataShare",
+	"AWS::RedshiftServerless::RecoveryPoint",
+	"AWS::ResilienceHub::RecommendationTemplate",
+	"AWS::Route53::RecordSetGroup",
+	"AWS::Route53Resolver::FirewallConfig",
+	"AWS::SageMaker::AutoMLJob",
+	"AWS::SageMaker::CodeRepository",
+	"AWS::SageMaker::ExperimentTrialComponent",
+	"AWS::SageMaker::HubContentVersion",
+	"AWS::SageMaker::HyperParameterTuningJob",
+	"AWS::SageMaker::ModelCardExportJob",
+	"AWS::SageMaker::MonitoringScheduleAlert",
+	"AWS::SageMaker::NotebookInstance",
+	"AWS::SageMaker::NotebookInstanceLifecycleConfig",
+	"AWS::SageMaker::OptimizationJob",
+	"AWS::SageMaker::PipelineExecution",
+	"AWS::SageMaker::TrainingJob",
+	"AWS::SageMaker::TransformJob",
+	"AWS::SageMaker::Workteam",
+	"AWS::SavingsPlans::SavingsPlan",
+	"AWS::SecurityAgent::PentestTask",
+	"AWS::ServiceDiscovery::Instance",
+	"AWS::ServiceQuotas::Quota",
+	"AWS::Signer::SigningJob",
+	"AWS::SSM::AutomationExecution",
+	"AWS::SSM::ManagedInstance",
+	"AWS::SSM::Session",
+	"AWS::SSO::ApplicationProvider",
+	"AWS::States::Execution",
+	"AWS::StepFunctions::MapRun",
+	"AWS::ThinClient::SoftwareSet",
+	"AWS::Transcribe::CallAnalyticsJob",
+	"AWS::Transcribe::MedicalScribeJob",
+	"AWS::Transcribe::MedicalTranscriptionJob",
+	"AWS::Transcribe::TranscriptionJob",
+	"AWS::UserNotifications::ManagedNotificationConfiguration",
+	"AWS::UserNotifications::NotificationEvent",
+	"AWS::WAF::ByteMatchSet",
+	"AWS::WAF::IPSet",
+	"AWS::WAF::Rule",
+	"AWS::WAF::SizeConstraintSet",
+	"AWS::WAF::SqlInjectionMatchSet",
+	"AWS::WAF::WebACL",
+	"AWS::WAF::XssMatchSet",
+	"AWS::WAFRegional::ByteMatchSet",
+	"AWS::WAFRegional::GeoMatchSet",
+	"AWS::WAFRegional::IPSet",
+	"AWS::WAFRegional::RateBasedRule",
+	"AWS::WAFRegional::RegexPatternSet",
+	"AWS::WAFRegional::Rule",
+	"AWS::WAFRegional::SizeConstraintSet",
+	"AWS::WAFRegional::SqlInjectionMatchSet",
+	"AWS::WAFRegional::WebACL",
+	"AWS::WAFRegional::WebACLAssociation",
+	"AWS::WAFRegional::XssMatchSet",
+	"AWS::Wisdom::Session",
+	"AWS::WorkSpaces::WorkSpaceApplication"
+]);
+
+//#endregion
+//#region src/provisioning/unsupported-types.ts
+/**
+* Helpers for cdkd's genuinely-unsupported resource types.
+*
+* The data ({@link NON_PROVISIONABLE_TYPES}) is generated from the
+* provider-coverage audit (`vp run gen:unsupported-types`); this module adds
+* the runtime predicates + the actionable issue link used by the pre-flight
+* check (see {@link ../provisioning/provider-registry.ProviderRegistry.validateResourceTypes}).
+*/
+/**
+* True if AWS reports the type as `ProvisioningType: NON_PROVISIONABLE`
+* (Cloud Control API cannot create/update/delete it) and cdkd has no SDK
+* provider for it.
+*/
+function isNonProvisionable(resourceType) {
+	return NON_PROVISIONABLE_TYPES.has(resourceType);
+}
+/**
+* A 1-click pre-filled GitHub issue link requesting cdkd support for a
+* resource type. Surfaced in the pre-flight error so a user hitting an
+* unsupported type lands directly in the "request support" flow.
+*/
+function unsupportedTypeIssueUrl(resourceType) {
+	return `https://github.com/go-to-k/cdkd/issues/new?title=${encodeURIComponent(`Support resource type ${resourceType}`)}&labels=resource-support`;
+}
+
 //#endregion
 //#region src/provisioning/property-coverage.ts
 /**
@@ -22947,9 +23857,11 @@ function getPropertyCoverage(resourceType) {
 * for a single resource. Returns an array of `{ property, rationale }` for
 * each unhandled top-level key in `templateProperties`, sorted alphabetically.
 *
-* Properties NOT in the CFn schema (likely a user typo or
-* `addPropertyOverride` escape hatch) are silently allowed: matching CFn's
-* own tolerance, and we cannot judge intent.
+* Only properties the committed CFn schema snapshot KNOWS. A key absent from
+* it is {@link findUnrecognizedProperties}' concern, and it drives routing
+* through {@link findRoutableUnrecognizedProperties} instead — kept apart
+* because the state and diff NARROWINGS below read this list and must stay
+* fixture-only (issue [#3713](https://github.com/go-to-k/cdkd/issues/3713)).
 */
 function findSilentDropProperties(resourceType, templateProperties) {
 	if (!templateProperties) return [];
@@ -22967,23 +23879,62 @@ function findSilentDropProperties(resourceType, templateProperties) {
 	}
 	return drops.sort((a, b) => a.property.localeCompare(b.property));
 }
+/** Rationale carried by a route-driving key absent from the schema snapshot. */
+const UNRECOGNIZED_PROPERTY_RATIONALE = "not in cdkd's CFn schema snapshot";
+/**
+* The properties that drive the Cloud Control auto-route (issue
+* [#614](https://github.com/go-to-k/cdkd/issues/614)): every silent drop whose
+* `<Type>:<Prop>` key is NOT in the `--prefer-sdk-route` allow set, plus every
+* {@link findRoutableUnrecognizedProperties} key. THE routing predicate —
+* `getProviderFor`, the sticky-escape, the plan and diff annotations and the
+* recreate validators all read it, so none can disagree with the route.
+*
+* `recordedProperties` is the resource's existing state-record bag, and it
+* matters only for the unrecognized half; see
+* {@link findRoutableUnrecognizedProperties}. Omitting it is PRESENCE
+* semantics, correct for a new physical resource.
+*
+* Sorted by property; `[]` for Tier 2 / Custom / unknown types, an absent bag,
+* or a bag whose every drop is allowed.
+*/
+function findActionableSilentDrops(resourceType, templateProperties, allowedKeys, recordedProperties, options) {
+	const drops = findSilentDropProperties(resourceType, templateProperties).filter(({ property }) => !allowedKeys.has(`${resourceType}:${property}`));
+	const unrecognized = findRoutableUnrecognizedProperties(resourceType, templateProperties, allowedKeys, recordedProperties, options);
+	if (unrecognized.length === 0) return drops;
+	return [...drops, ...unrecognized.map((property) => ({
+		property,
+		rationale: UNRECOGNIZED_PROPERTY_RATIONALE
+	}))].sort((a, b) => a.property.localeCompare(b.property));
+}
+function findRoutableUnrecognizedProperties(resourceType, templateProperties, allowedKeys, recordedProperties, options) {
+	const coverage = getPropertyCoverage(resourceType);
+	if (!templateProperties || !coverage) return [];
+	if (coverage.ccRouteUnavailable || isNonProvisionable(resourceType)) return [];
+	return findUnrecognizedProperties(resourceType, templateProperties).filter((property) => !coverage.readOnly.has(property) && !allowedKeys.has(`${resourceType}:${property}`) && !(recordedProperties != null && typeof recordedProperties === "object" && Object.hasOwn(recordedProperties, property) && sameJsonValue(recordedProperties[property], templateProperties[property], options?.unresolvedAs ?? "unchanged")));
+}
 /**
-* Same as {@link findSilentDropProperties} but filters out entries whose
-* `<Type>:<Prop>` key is in the supplied allow set (the
-* `--allow-unsupported-properties` user override). Returned drops are the
-* ones that should drive CC API auto-routing (issue
-* [#614](https://github.com/go-to-k/cdkd/issues/614)) — silent drops
-* the user has explicitly opted-into via the override are removed so the
-* resource stays on the SDK Provider path.
-*
-* Mirrors `findSilentDropProperties`'s sort + early-return behavior:
-* returns `[]` for Tier 2 / Custom / unknown types, undefined / empty
-* `templateProperties`, or when every drop is in `allowedKeys`.
+* Structural equality over the JSON form, for the baseline arm of
+* {@link findRoutableUnrecognizedProperties}. Not `isDeepStrictEqual` on the raw
+* values: the two bags are built by different code (the state record is parsed
+* JSON, the desired bag can be rebuilt with a null prototype by the secret
+* redaction), and a prototype difference must not read as a changed value —
+* that would route an unchanged key. Key order does not matter here either.
 */
-function findActionableSilentDrops(resourceType, templateProperties, allowedKeys) {
-	const drops = findSilentDropProperties(resourceType, templateProperties);
-	if (drops.length === 0) return drops;
-	return drops.filter(({ property }) => !allowedKeys.has(`${resourceType}:${property}`));
+function sameJsonValue(recorded, desired, unresolvedAs) {
+	const recordedJson = toJsonValue(recorded);
+	if (JSON.stringify(recordedJson)?.includes("{{resolve:") === true) return true;
+	const desiredJson = toJsonValue(desired);
+	if (containsIntrinsic(desiredJson)) return unresolvedAs === "unchanged";
+	return isDeepStrictEqual(recordedJson, desiredJson);
+}
+/** True when `value` holds a `Ref` / `Fn::*` object anywhere. */
+function containsIntrinsic(value) {
+	if (Array.isArray(value)) return value.some(containsIntrinsic);
+	if (value === null || typeof value !== "object") return false;
+	return Object.entries(value).some(([key, child]) => key === "Ref" || key.startsWith("Fn::") || containsIntrinsic(child));
+}
+function toJsonValue(value) {
+	return value === void 0 ? void 0 : JSON.parse(JSON.stringify(value));
 }
 /**
 * The silent-drop properties in `templateProperties` the user has opted back
@@ -23000,9 +23951,13 @@ function findActionableSilentDrops(resourceType, templateProperties, allowedKeys
 * per-property answer would be wrong for exactly the mixed bag.
 *
 * The complement of {@link findActionableSilentDrops}: one is empty whenever
-* the other is not, unless the bag has no drops at all (both empty).
+* the other is not, unless the bag has no drops at all (both empty). A
+* route-driving UNRECOGNIZED key empties this too, which is why it takes the
+* same `recordedProperties` — but the accepted list itself stays fixture-only,
+* since it feeds the narrowing.
 */
-function findAcceptedSilentDrops(resourceType, templateProperties, allowedKeys) {
+function findAcceptedSilentDrops(resourceType, templateProperties, allowedKeys, recordedProperties) {
+	if (findRoutableUnrecognizedProperties(resourceType, templateProperties, allowedKeys, recordedProperties).length > 0) return [];
 	const drops = findSilentDropProperties(resourceType, templateProperties);
 	const accepted = [];
 	for (const { property } of drops) {
@@ -23061,10 +24016,17 @@ function withoutSilentDropProperties(resourceType, properties) {
 * — {@link removableSilentDrops} carries the rationale, and both go through
 * {@link excludeCreateOnly} so they cannot decline on different rules.
 *
+* `recordedProperties` is the resource's state-record bag — the one
+* `getProviderFor` receives as `previousProperties` — so this narrows on the
+* route the deploy actually takes (issue
+* [#3713](https://github.com/go-to-k/cdkd/issues/3713)). Omitting it for an
+* existing resource treats an unchanged unrecognized key as route-driving and
+* declines to narrow.
+*
 * Returns the input UNCHANGED when nothing applies.
 */
-function withoutAcceptedSilentDropProperties(resourceType, properties, allowedKeys) {
-	const removable = excludeCreateOnly(resourceType, findAcceptedSilentDrops(resourceType, properties, allowedKeys));
+function withoutAcceptedSilentDropProperties(resourceType, properties, allowedKeys, recordedProperties) {
+	const removable = excludeCreateOnly(resourceType, findAcceptedSilentDrops(resourceType, properties, allowedKeys, recordedProperties));
 	if (removable.length === 0) return properties;
 	const written = { ...properties };
 	for (const property of removable) delete written[property];
@@ -23132,16 +24094,14 @@ function unsupportedPropertyIssueUrl(resourceType, property) {
 * `coverage.handled` nor `coverage.silentDrop` (issue
 * [#2718](https://github.com/go-to-k/cdkd/issues/2718)).
 *
-* The complement of {@link findSilentDropProperties}, which deliberately
-* PASSES these through: a property absent from the schema is indistinguishable
-* at deploy time from a user typo or an `addPropertyOverride` escape hatch, so
-* it cannot drive a routing decision. That tolerance is correct for routing
-* and wrong for silence — the routing table is built offline from
-* `tests/fixtures/cfn-schemas/*.json`, so every property AWS publishes AFTER
-* that snapshot lands here, and on the SDK route it reaches neither AWS nor an
-* error while the deploy reports success. That is the issue
-* [#614](https://github.com/go-to-k/cdkd/issues/614) failure class arriving
-* through the one input the #614 machinery cannot observe.
+* The complement of {@link findSilentDropProperties}. The routing table is
+* built offline from `tests/fixtures/cfn-schemas/*.json`, so every property
+* AWS publishes AFTER that snapshot lands here — as does a typo or an
+* `addPropertyOverride` key. The route-driving subset is
+* {@link findRoutableUnrecognizedProperties} (issue
+* [#3713](https://github.com/go-to-k/cdkd/issues/3713)); what stays on the SDK
+* route (read-only keys, allow-listed or unchanged ones, types Cloud Control
+* cannot take) is what the caller's warn reports.
 *
 * **Why a warn built on this has no false-positive mode.** An SDK provider
 * writes only what it declares in `handledProperties`, so a top-level property
@@ -25872,6 +26832,15 @@ const IN_PLACE_UPDATE_DERIVED_ATTRS = Object.freeze({ "AWS::EC2::LaunchTemplate"
 */
 const IN_PLACE_UPDATE_DERIVED_ATTR_PREFIXES = Object.freeze({ "AWS::CloudFormation::Stack": Object.freeze(["Outputs."]) });
 /**
+* The attribute name {@link DiffCalculator.extractGetAttRefs} records for a
+* `Ref` read (go-to-k/cdkd#3717 / #3722). Not a name any attribute can have, so
+* the property-name, derived-attribute and prefix arms of the in-place pass
+* never match it; only the custom-resource arm (whose physical id the handler
+* may change) and the fresh-parameter arm (a parameter carrying a `NoEcho`
+* value supplied in this deploy) read it.
+*/
+const REF_READ = "<Ref>";
+/**
 * Diff calculator for comparing desired state (template) with current state
 */
 var DiffCalculator = class DiffCalculator {
@@ -25905,7 +26874,7 @@ var DiffCalculator = class DiffCalculator {
 	*                  flag-less deploy.
 	* @returns Map of logical ID to resource change
 	*/
-	async calculateDiff(currentState, desiredTemplate, resolveFn, canonicalizeProperties, allowedUnsupportedProperties) {
+	async calculateDiff(currentState, desiredTemplate, resolveFn, canonicalizeProperties, allowedUnsupportedProperties, freshParameters) {
 		const changes = /* @__PURE__ */ new Map();
 		refuseMalformedResourceEntriesForDeploy(currentState, void 0, void 0);
 		refuseMalformedResourceProperties(currentState, void 0, void 0);
@@ -25961,7 +26930,7 @@ var DiffCalculator = class DiffCalculator {
 				const rawDesiredProps = desiredResource.Properties || {};
 				const resolvedDesiredProps = resolveFn ? await this.resolveBestEffort(rawDesiredProps, resolveFn) : rawDesiredProps;
 				const sdkRouted = currentResource.provisionedBy !== "cc-api";
-				const desiredAfterDrops = sdkRouted && allowedUnsupportedProperties ? withoutAcceptedSilentDropProperties(desiredResource.Type, resolvedDesiredProps, allowedUnsupportedProperties) : resolvedDesiredProps;
+				const desiredAfterDrops = sdkRouted && allowedUnsupportedProperties ? withoutAcceptedSilentDropProperties(desiredResource.Type, resolvedDesiredProps, allowedUnsupportedProperties, currentResource.properties) : resolvedDesiredProps;
 				const currentAfterDrops = sdkRouted ? withoutSilentDropProperties(desiredResource.Type, currentResource.properties) : currentResource.properties;
 				const desiredPropsForCompare = canonicalizeProperties ? canonicalizeProperties(desiredResource.Type, desiredAfterDrops) : desiredAfterDrops;
 				const currentPropsForCompare = canonicalizeProperties && sdkRouted ? canonicalizeProperties(desiredResource.Type, currentAfterDrops) : currentAfterDrops;
@@ -26002,11 +26971,9 @@ var DiffCalculator = class DiffCalculator {
 			});
 			this.logger.debug(`DELETE: ${logicalId} (${currentResource.resourceType})`);
 		}
-		let round = 0;
-		do {
-			round++;
+		do
 			this.promoteReplacementDependents(changes, desiredTemplate);
-		} while (this.promoteInPlaceAttributeDependents(changes, desiredTemplate, rawGetAttRefs, currentResources, round));
+		while (this.promoteInPlaceAttributeDependents(changes, desiredTemplate, rawGetAttRefs, freshParameters));
 		const summary = this.getSummary(changes);
 		this.logger.debug(`Diff calculated: ${summary.create} CREATE, ${summary.update} UPDATE, ${summary.delete} DELETE, ${summary.noChange} NO_CHANGE`);
 		return changes;
@@ -26122,34 +27089,44 @@ var DiffCalculator = class DiffCalculator {
 	*      or
 	*   3. `Attr` starts with a derived-attribute PREFIX of `Up`'s type — the
 	*      {@link IN_PLACE_UPDATE_DERIVED_ATTR_PREFIXES} table (issue #3631; a
-	*      nested stack's `Outputs.<Key>`).
-	* (`Ref` resolves to the physical id, which an in-place update never moves, so
-	* Ref-only dependents are left NO_CHANGE; likewise a GetAtt of a computed
-	* attribute NOT in the allow list, e.g. a Lambda `Arn` on a Description edit.)
+	*      nested stack's `Outputs.<Key>`); or
+	*   4. `Up` is a custom resource, whose attributes are all its handler's
+	*      response `Data` (go-to-k/cdkd#3662), and whose `Ref` — the physical
+	*      id — its handler may also change on an Update by returning a new
+	*      `PhysicalResourceId` (go-to-k/cdkd#3722); or
+	*   5. `Up` is a template PARAMETER in `freshParameters`, read by `Ref` or
+	*      `${Param}` (go-to-k/cdkd#3717).
+	* (Any other `Ref` resolves to a physical id an in-place update keeps, so
+	* Ref-only dependents of other types are left NO_CHANGE; likewise a GetAtt
+	* of a computed attribute NOT in the allow list, e.g. a Lambda `Arn` on a
+	* Description edit.)
 	*
 	* Promotion is safe even when speculative: the deploy engine re-resolves the
 	* promoted resource against the in-flight state and skips the provider call
-	* when nothing actually changed.
+	* when nothing actually changed. Each synthetic change is marked
+	* `inPlacePropagated`, and its `requiresReplacement` is a ceiling the engine
+	* lowers when the resolved value equals the record, so an unmoved value never
+	* replaces a reader that another edit sent to the provider.
 	*
 	* One pass is single-hop: `changedPropsByUpstream` is frozen at entry, so a
 	* chain `A(in-place) -> B(reads A's changed attr) -> C(reads B's now-changed
 	* attr)` promotes B but not C. `calculateDiff` re-runs it to a fixpoint, and
 	* the pass after B's promotion sees B as an in-place UPDATE.
 	*
-	* A SPECULATIVE promotion — arm 3 in any round, and every arm after the first
-	* round, whose upstreams exist only because an earlier promotion guessed —
-	* skips a dependent that reads a MASKED attribute anywhere
-	* ({@link readsMaskedAttribute}). The engine resolves the dependent's whole
-	* bag and refuses a read of `***` BEFORE its no-change skip, so such a guess
-	* would fail a deploy that left the dependent alone before this pass could
-	* reach it (go-to-k/cdkd#3662). The first round's arms 1 and 2 keep their
-	* behaviour: a property they match really changed.
+	* A dependent reading a MASKED attribute (a `NoEcho` custom resource's
+	* value, persisted `***`, issue #2274) is promoted like any other
+	* (go-to-k/cdkd#3662). The engine takes its no-change skip BEFORE refusing a
+	* redacted read, so a guess whose resolved bag equals the record, mask
+	* included, sends nothing; a fresh `NoEcho` value never takes that skip, so
+	* one the upstream re-minted in this run reaches AWS. What is left is the
+	* refusal's own case: a promoted dependent whose OTHER reads moved while the
+	* masked value was not re-minted fails loudly, as an update of it with a
+	* changed property already did, rather than keeping the stale values.
 	*
-	* @param round 1-based fixpoint round; see the speculative-promotion note.
 	* @returns whether any synthetic PropertyChange was added (the caller's
 	*          fixpoint signal).
 	*/
-	promoteInPlaceAttributeDependents(changes, desiredTemplate, rawGetAttRefs, currentResources, round) {
+	promoteInPlaceAttributeDependents(changes, desiredTemplate, rawGetAttRefs, freshParameters) {
 		const changedPropsByUpstream = /* @__PURE__ */ new Map();
 		const inPlaceUpdateTypeByUpstream = /* @__PURE__ */ new Map();
 		for (const [logicalId, change] of changes) {
@@ -26159,7 +27136,8 @@ var DiffCalculator = class DiffCalculator {
 			const props = propertyChanges.map((pc) => pc.path).filter((p) => typeof p === "string");
 			if (props.length > 0) changedPropsByUpstream.set(logicalId, new Set(props));
 		}
-		if (changedPropsByUpstream.size === 0 && inPlaceUpdateTypeByUpstream.size === 0) return false;
+		const anyFreshParameter = freshParameters !== void 0 && freshParameters.size > 0;
+		if (changedPropsByUpstream.size === 0 && inPlaceUpdateTypeByUpstream.size === 0 && !anyFreshParameter) return false;
 		let added = false;
 		for (const [dependentId, perProp] of rawGetAttRefs) {
 			const resource = desiredTemplate.Resources[dependentId];
@@ -26169,13 +27147,11 @@ var DiffCalculator = class DiffCalculator {
 			if (change.changeType !== "NO_CHANGE" && change.changeType !== "UPDATE") continue;
 			const existingPaths = new Set((change.propertyChanges ?? []).map((pc) => pc.path));
 			const syntheticChanges = [];
-			const speculationAllowed = !DiffCalculator.readsMaskedAttribute(perProp, currentResources);
 			for (const [propKey, getAttRefs] of perProp) {
 				if (existingPaths.has(propKey)) continue;
 				let matched = false;
 				for (const [upstreamId, attrs] of getAttRefs) {
 					if (upstreamId === dependentId) continue;
-					if (round > 1 && !speculationAllowed) break;
 					const changedProps = changedPropsByUpstream.get(upstreamId);
 					if (changedProps && [...attrs].some((attr) => changedProps.has(attr))) {
 						matched = true;
@@ -26188,7 +27164,15 @@ var DiffCalculator = class DiffCalculator {
 						break;
 					}
 					const derivedPrefixes = upstreamType !== void 0 && Object.hasOwn(IN_PLACE_UPDATE_DERIVED_ATTR_PREFIXES, upstreamType) ? IN_PLACE_UPDATE_DERIVED_ATTR_PREFIXES[upstreamType] : void 0;
-					if (speculationAllowed && derivedPrefixes && [...attrs].some((attr) => derivedPrefixes.some((prefix) => attr.startsWith(prefix)))) {
+					if (derivedPrefixes && [...attrs].some((attr) => derivedPrefixes.some((prefix) => attr.startsWith(prefix)))) {
+						matched = true;
+						break;
+					}
+					if (upstreamType !== void 0 && (upstreamType.startsWith("Custom::") || upstreamType === "AWS::CloudFormation::CustomResource")) {
+						matched = true;
+						break;
+					}
+					if (anyFreshParameter && freshParameters.has(upstreamId) && attrs.has(REF_READ) && !Object.hasOwn(desiredTemplate.Resources, upstreamId)) {
 						matched = true;
 						break;
 					}
@@ -26198,7 +27182,8 @@ var DiffCalculator = class DiffCalculator {
 					path: propKey,
 					oldValue: change.currentProperties?.[propKey],
 					newValue: change.desiredProperties?.[propKey],
-					requiresReplacement: this.replacementRules.requiresReplacement(change.resourceType, propKey, void 0, void 0)
+					requiresReplacement: this.replacementRules.requiresReplacement(change.resourceType, propKey, void 0, void 0),
+					inPlacePropagated: true
 				});
 			}
 			if (syntheticChanges.length === 0) continue;
@@ -26212,47 +27197,11 @@ var DiffCalculator = class DiffCalculator {
 		return added;
 	}
 	/**
-	* Whether any `Fn::GetAtt` / `Fn::Sub` read of a dependent (its
-	* {@link extractGetAttRefs} map, every property and every upstream) lands on
-	* a PERSISTED attribute carrying the redaction mask. The attribute is found
-	* the way the resolver finds it: the flat key, else the dot-separated path
-	* walked through nested objects (a Cloud Control record's
-	* `Endpoint.Address`).
-	*
-	* What it cannot see, and the engine still refuses on a speculative
-	* promotion: a masked cross-stack read (`Fn::ImportValue` /
-	* `Fn::GetStackOutput`), whose producer record is another stack's, and a
-	* `Ref` whose state-key lookup lands on a masked property, since `Ref`
-	* reads are not extracted.
-	*/
-	static readsMaskedAttribute(perProp, currentResources) {
-		for (const getAttRefs of perProp.values()) for (const [upstreamId, attrs] of getAttRefs) {
-			const attributes = Object.hasOwn(currentResources, upstreamId) ? currentResources[upstreamId]?.attributes : void 0;
-			if (!attributes) continue;
-			for (const attr of attrs) if (carriesSecretMask(DiffCalculator.persistedAttribute(attributes, attr))) return true;
-		}
-		return false;
-	}
-	/**
-	* A persisted attribute by the resolver's lookup rule: the own flat key, else
-	* the dot-separated path through own keys of nested objects; `undefined`
-	* when neither exists.
-	*/
-	static persistedAttribute(attributes, attr) {
-		if (Object.hasOwn(attributes, attr)) return attributes[attr];
-		if (!attr.includes(".")) return void 0;
-		let cursor = attributes;
-		for (const part of attr.split(".")) {
-			if (cursor === null || typeof cursor !== "object" || !Object.hasOwn(cursor, part)) return;
-			cursor = cursor[part];
-		}
-		return cursor;
-	}
-	/**
 	* Extract `Fn::GetAtt` / `Fn::Sub`-`${X.Attr}` references from a property value
 	* as a map of `referencedLogicalId -> set of referenced attribute names`.
-	* Plain `Ref` is intentionally NOT captured: it resolves to the physical id,
-	* which an in-place update never changes. Recurses into arrays / objects so
+	* A plain `Ref` (and a dot-less `${X}`) is recorded under the
+	* {@link REF_READ} name, which only the custom-resource and fresh-parameter
+	* arms of the in-place pass read (go-to-k/cdkd#3717 / #3722). Recurses into arrays / objects so
 	* intrinsics nested inside `Fn::Sub`'s variable map / `Fn::Join` etc. are seen.
 	*/
 	static extractGetAttRefs(value) {
@@ -26300,7 +27249,10 @@ var DiffCalculator = class DiffCalculator {
 					const placeholder = m[2];
 					if (!placeholder) continue;
 					const dot = placeholder.indexOf(".");
-					if (dot < 0) continue;
+					if (dot < 0) {
+						if (!mapKeys?.has(placeholder)) add(placeholder, REF_READ);
+						continue;
+					}
 					const id = placeholder.slice(0, dot);
 					const attr = placeholder.slice(dot + 1);
 					if (!id || mapKeys?.has(id)) continue;
@@ -26308,7 +27260,10 @@ var DiffCalculator = class DiffCalculator {
 				}
 				return;
 			}
-			if ("Ref" in obj && Object.keys(obj).length === 1) return;
+			if ("Ref" in obj && Object.keys(obj).length === 1) {
+				if (typeof obj["Ref"] === "string") add(obj["Ref"], REF_READ);
+				return;
+			}
 			Object.values(obj).forEach(walk);
 		};
 		walk(value);
@@ -30705,6 +31660,18 @@ function stringifyParameterForLog(paramDef, value) {
 	if (paramDef?.NoEcho === true) return "<redacted>";
 	return stringifyValue(value);
 }
+/**
+* `displayIdent` over text THIS file already sanitized, keeping its rule that
+* an ALTERED value takes a boundary (go-to-k/cdkd#3617). `displayIdent` tests
+* alteration against its own input, which here is already trimmed and blanked
+* -- so `ProdStack ` or `ProdStack<NBSP>` would print bare, byte-identical to
+* a genuine `ProdStack` (the #3164 spoof). Compared against the ORIGINAL, an
+* altered value is quoted even when what is left is plain.
+*/
+function boundAltered(original, shown, maxCodePoints) {
+	const bounded = displayIdent(shown, maxCodePoints === void 0 ? void 0 : { maxCodePoints });
+	return shown !== original && !bounded.startsWith("\"") && bounded !== "<unrenderable>" ? `${JSON.stringify(bounded.split(" [cut: ")[0])}${bounded.includes(" [cut: ") ? bounded.slice(bounded.indexOf(" [cut: ")) : ""}` : bounded;
+}
 var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	logger = getLogger().child("IntrinsicFunctionResolver");
 	resolverRegion;
@@ -31096,7 +32063,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (!targetRegion) return ambient;
 		const target = canonicalizeRegion(targetRegion);
 		const loggedTarget = targetLogText ?? (targetRegion === this.explicitRegion ? this.explicitRegionLogText : void 0) ?? target;
-		if (!isClientSafeRegion(target)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to build AWS clients for the region '${displaySafe(stripControlChars(loggedTarget)).slice(0, 64)}': it is not a valid AWS region name, and a region is substituted into the AWS service hostname.`));
+		if (!isClientSafeRegion(target)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to build AWS clients for the region ${boundAltered(targetRegion ?? loggedTarget, displaySafe(stripControlChars(loggedTarget)), 64)}: it is not a valid AWS region name, and a region is substituted into the AWS service hostname.`));
 		if (typeof ambient.withRegion !== "function") return ambient;
 		const cacheKey = clientCacheKey(target, ambient.credentialConfig ?? {});
 		const cached = this.regionScopedClients.get(cacheKey);
@@ -31501,6 +32468,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) {
 			const own = inheritedParameterExpression(inherited, parameterName, plaintext);
 			recorded.set(plaintext, typeof own === "string" ? own : expression);
+			carryFreshNoEchoMark(inherited, recorded, plaintext);
 		}
 	}
 	/**
@@ -31881,7 +32849,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*/
 	noteAttributeSecrecy(logicalId, attributeName, value, context) {
 		const declared = context.noEchoAttributeResources?.get(logicalId);
-		if ((declared === true || declared !== void 0 && declared.has(attributeName)) && context.recordedSecretValues) recordMaskOnlyValuesIn(value, context.recordedSecretValues);
+		if ((declared === true || declared !== void 0 && declared.has(attributeName)) && context.recordedSecretValues) recordFreshNoEchoValuesIn(value, context.recordedSecretValues);
 		if (context.redactedAttributeReads !== void 0 && carriesSecretMask(value)) {
 			const maskedAttributeName = this.displayMasked(attributeName, context);
 			this.pushRedactedAttributeRead(context, {
@@ -32027,7 +32995,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* 1. PROBE — construct under a derived context whose fallback raises
 	*    {@link StaleAttributeMissSignal} instead of deciding. Every per-type arm
 	*    that CAN answer (the ~40 constructed ARNs, the live-read arms) returns
-	*    here exactly as before.
+	*    here exactly as before — except the heal-first arms
+	*    ({@link healBeforeConstructing}, issue #3627), which raise the signal
+	*    too because their answer may be wrong for a record lacking the value.
 	* 2. HEAL — only on the signal: ask the context's healer, which re-reads the
 	*    record's attributes through its provider once per deploy. A value for
 	*    this attribute is served from that read.
@@ -32108,6 +33078,21 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		return value;
 	}
 	/**
+	* Route an arm that ANSWERS without the record through the #1852 heal first.
+	*
+	* The heal runs only when a construction raises
+	* {@link StaleAttributeMissSignal}, which only `guardedPhysicalIdFallback`
+	* did — so an arm that returned `undefined` (DynamoDB `StreamArn`, IAM
+	* `RoleId`) or built a path-less IAM ARN never healed a record that lacks
+	* the attribute, such as one `cdkd import` wrote before issue #3627's
+	* read-backs. Under the probe phase this raises the signal; in the settled
+	* phase (the read found nothing) or with no healer it returns, and the arm
+	* answers as it always did.
+	*/
+	healBeforeConstructing(context) {
+		if (context.staleAttributeHeal?.phase === "probe") throw new StaleAttributeMissSignal();
+	}
+	/**
 	* The per-resource-type attribute construction itself.
 	*
 	* Many CloudFormation attributes are not returned by Cloud Control API,
@@ -32123,7 +33108,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const region = canonicalizeRegion(accountInfo.region);
 		if (resourceType === "AWS::DynamoDB::Table" || resourceType === "AWS::DynamoDB::GlobalTable") switch (attributeName) {
 			case "Arn": return `arn:${partition}:dynamodb:${region}:${accountId}:table/${physicalId}`;
-			case "StreamArn": return;
+			case "StreamArn":
+				this.healBeforeConstructing(context);
+				return;
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::S3::Bucket") switch (attributeName) {
@@ -32135,8 +33122,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::IAM::Role") switch (attributeName) {
-			case "Arn": return `arn:${partition}:iam::${accountId}:role/${physicalId}`;
-			case "RoleId": return;
+			case "Arn":
+				this.healBeforeConstructing(context);
+				return `arn:${partition}:iam::${accountId}:role/${physicalId}`;
+			case "RoleId":
+				this.healBeforeConstructing(context);
+				return;
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::EC2::VPC") switch (attributeName) {
@@ -32212,15 +33203,21 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::IAM::User") switch (attributeName) {
-			case "Arn": return `arn:${partition}:iam::${accountId}:user/${physicalId}`;
+			case "Arn":
+				this.healBeforeConstructing(context);
+				return `arn:${partition}:iam::${accountId}:user/${physicalId}`;
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::IAM::Group") switch (attributeName) {
-			case "Arn": return `arn:${partition}:iam::${accountId}:group/${physicalId}`;
+			case "Arn":
+				this.healBeforeConstructing(context);
+				return `arn:${partition}:iam::${accountId}:group/${physicalId}`;
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::IAM::InstanceProfile") switch (attributeName) {
-			case "Arn": return `arn:${partition}:iam::${accountId}:instance-profile/${physicalId}`;
+			case "Arn":
+				this.healBeforeConstructing(context);
+				return `arn:${partition}:iam::${accountId}:instance-profile/${physicalId}`;
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::KMS::Key") switch (attributeName) {
@@ -33339,7 +34336,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (carriesSecretMask(value)) {
 			const recovered = producerOutput === void 0 || producerOutput.crossAccount === true ? void 0 : recoverMaskedOutput(producerOutput.stackName, producerOutput.region, producerOutput.outputKey);
 			if (recovered !== void 0) {
-				if (context.recordedSecretValues) recordMaskOnlyValuesIn(recovered, context.recordedSecretValues);
+				if (context.recordedSecretValues) recordFreshNoEchoValuesIn(recovered, context.recordedSecretValues);
 				return recovered;
 			}
 			if (context.redactedAttributeReads !== void 0) {
@@ -33645,7 +34642,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
 			const cfnNameMask = this.positionalNameMask([[stackName, this.displayMasked(stackName, context)], [region, this.displayMasked(loggedRegionText, context)]]);
-			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${this.displayMasked(stackName, context)}' (${this.displayMasked(loggedRegionText, context)}): ${displayAwsMessage(this.displayMasked(cfnNameMask ? cfnNameMask(message) : message, context))}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
+			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack ${this.displayMaskedIdent(stackName, context, STACK_REF_MAX_CODE_POINTS)} (${this.displayMaskedIdent(loggedRegionText, context)}): ${displayAwsMessage(this.displayMasked(cfnNameMask ? cfnNameMask(message) : message, context))}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
 			return;
 		}
 	}
@@ -33775,7 +34772,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const resolvedRegion = await this.resolveValue(args["Region"], context);
 			if (typeof resolvedRegion !== "string" || resolvedRegion === "") throw new Error(`Fn::GetStackOutput: Region must resolve to a non-empty string, got ${typeof resolvedRegion}`);
 			const requestedRegion = canonicalizeRegion(resolvedRegion);
-			if (!isClientSafeRegion(requestedRegion)) throw new Error(`Fn::GetStackOutput: '${this.displayMasked(this.logTextOfLeaf(resolvedRegion, context) !== resolvedRegion ? "***" : resolvedRegion, context).slice(0, 64)}' is not a valid AWS region name. The region selects both the AWS endpoint and the state-file key, so cdkd will not use it.`);
+			if (!isClientSafeRegion(requestedRegion)) throw new Error(`Fn::GetStackOutput: ${this.displayMaskedIdent(this.logTextOfLeaf(resolvedRegion, context) !== resolvedRegion ? "***" : resolvedRegion, context, 64)} is not a valid AWS region name. The region selects both the AWS endpoint and the state-file key, so cdkd will not use it.`);
 			region = requestedRegion;
 			loggedRegionText = this.regionLogText(resolvedRegion, context);
 		}
@@ -33785,9 +34782,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			if (typeof raw !== "string" || raw === "") throw new Error(`Fn::GetStackOutput: RoleArn must be a literal string in the template (no Ref / Fn::GetAtt / Fn::Sub allowed for cross-account references). Got ${raw === null ? "null" : Array.isArray(raw) ? "array" : typeof raw}${typeof raw === "object" ? ` (intrinsic shape: ${this.displayMasked(JSON.stringify(raw).slice(0, 80), context)})` : ""}.`);
 			roleArn = raw;
 		}
-		if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw new Error(`Fn::GetStackOutput: cannot reference own stack '${this.displayMasked(stackName, context)}' in the same region '${this.displayMasked(loggedRegionText, context)}'`);
-		const loggedStackName = this.displayMasked(stackName, context);
-		const loggedOutputName = this.displayMasked(outputName, context);
+		if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw new Error(`Fn::GetStackOutput: cannot reference own stack ${this.displayMaskedIdent(stackName, context, STACK_REF_MAX_CODE_POINTS)} in the same region ${this.displayMaskedIdent(loggedRegionText, context)}`);
+		const loggedStackName = this.displayMaskedIdent(stackName, context, STACK_REF_MAX_CODE_POINTS);
+		const loggedOutputName = this.displayMaskedIdent(outputName, context);
 		const loggedRegion = this.displayMasked(loggedRegionText, context);
 		const shownRoleArn = roleArn ? displayIdent(roleArn, { maxCodePoints: 613 }) : "";
 		this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${shownRoleArn}` : ""}`);
@@ -33795,7 +34792,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		try {
 			stateData = roleArn ? await this.getCrossAccountStackState(roleArn, stackName, region, context) : await this.getSameAccountStackState(stackName, region, context);
 		} catch (error) {
-			this.maskStateReadError(error, [[stackName, loggedStackName], [region, loggedRegion]], context);
+			this.maskStateReadError(error, [[stackName, this.displayMasked(stackName, context)], [region, loggedRegion]], context);
 		}
 		if (!stateData) {
 			if (!roleArn && this.cfnFallback) {
@@ -33803,25 +34800,25 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				if (cfnOutputs) {
 					if (!Object.hasOwn(cfnOutputs, outputName)) {
 						const available = this.describeAvailableOutputs(Object.keys(cfnOutputs), context);
-						throw new Error(`Fn::GetStackOutput: output '${loggedOutputName}' not found in CloudFormation stack '${loggedStackName}' (${loggedRegion}). Available outputs: ${available}`);
+						throw new Error(`Fn::GetStackOutput: output ${loggedOutputName} not found in CloudFormation stack ${loggedStackName} (${displayIdent(loggedRegion)}). Available outputs: ${available}`);
 					}
 					const value = cfnOutputs[outputName];
 					this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName} (from CloudFormation stack outputs; weak reference — producer is not cdkd-managed)`);
 					return value;
 				}
 			}
-			throw new Error(`Fn::GetStackOutput: stack '${loggedStackName}' not found in region '${loggedRegion}'${roleArn ? ` (cross-account via ${shownRoleArn})` : ""}. ${!roleArn && this.cfnFallback ? "Searched cdkd state and CloudFormation stacks. Make sure the producer stack has been deployed (via cdkd or CloudFormation)." : `Make sure the producer stack has been deployed via cdkd.`}`);
+			throw new Error(`Fn::GetStackOutput: stack ${loggedStackName} not found in region ${displayIdent(loggedRegion)}${roleArn ? ` (cross-account via ${shownRoleArn})` : ""}. ${!roleArn && this.cfnFallback ? "Searched cdkd state and CloudFormation stacks. Make sure the producer stack has been deployed (via cdkd or CloudFormation)." : `Make sure the producer stack has been deployed via cdkd.`}`);
 		}
-		if (!hasReadableOutputs(stateData.state)) throw markNonRetryable(new MalformedProducerRecordRefusalError(`Fn::GetStackOutput: the state record of producer stack '${loggedStackName}' (${loggedRegion}) has no readable 'outputs' map — the record is malformed or truncated. cdkd refuses to resolve from it rather than reading it as a map: 'Object.hasOwn' answers TRUE for '0' on a string and for an index on a list, so continuing would resolve ONE CHARACTER or element of the record as this reference's value and this deploy would send it to AWS. Inspect the producer's record with 'cdkd state show' --json, repair or remove it, then re-run.`));
+		if (!hasReadableOutputs(stateData.state)) throw markNonRetryable(new MalformedProducerRecordRefusalError(`Fn::GetStackOutput: the state record of producer stack ${loggedStackName} (${displayIdent(loggedRegion)}) has no readable 'outputs' map — the record is malformed or truncated. cdkd refuses to resolve from it rather than reading it as a map: 'Object.hasOwn' answers TRUE for '0' on a string and for an index on a list, so continuing would resolve ONE CHARACTER or element of the record as this reference's value and this deploy would send it to AWS. Inspect the producer's record with 'cdkd state show' --json, repair or remove it, then re-run.`));
 		const outputs = stateData.state.outputs ?? {};
 		if (!Object.hasOwn(outputs, outputName)) {
 			const available = this.describeAvailableOutputs(Object.keys(outputs), context);
-			throw new Error(`Fn::GetStackOutput: output '${loggedOutputName}' not found in stack '${loggedStackName}' (${loggedRegion}). Available outputs: ${available}`);
+			throw new Error(`Fn::GetStackOutput: output ${loggedOutputName} not found in stack ${loggedStackName} (${displayIdent(loggedRegion)}). Available outputs: ${available}`);
 		}
 		const value = outputs[outputName];
 		this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${shownRoleArn}` : ""} (${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
 		if (!roleArn) this.recordOutputRead(context, stackName, region, outputName);
-		if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new CrossAccountSecretRefusalError(`Fn::GetStackOutput: output '${loggedOutputName}' of stack '${loggedStackName}' (${loggedRegion}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${shownRoleArn}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
+		if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new CrossAccountSecretRefusalError(`Fn::GetStackOutput: output ${loggedOutputName} of stack ${loggedStackName} (${displayIdent(loggedRegion)}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${shownRoleArn}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
 		return await this.reresolveCrossStackValue(value, region, context, `Fn::GetStackOutput '${this.displayLeaf(outputName, context)}' (producer ${this.displayLeaf(stackName, context)} / ${this.displayLeaf(loggedRegionText, context)})`, sourceKey, {
 			stackName,
 			region,
@@ -33858,6 +34855,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*
 	* A pair that DOES carry a mask contributes its raw spelling AND the spelling
 	* the reader will actually see. `S3StateBackend` prints names through
+	* `displayStackName`, whose first step is
 	* `displaySafe(..., { asciiOnly: true })`, which REPLACES every non-printable
 	* character with a space and then trims, so a secret carrying one is a
 	* DIFFERENT string by the time it is quoted back and matching the raw form
@@ -33899,9 +34897,16 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	positionalNameMask(pairs) {
 		const substitutions = pairs.filter(([raw, masked]) => raw !== "" && raw !== masked).flatMap(([raw, masked]) => {
 			const shown = displaySafe(raw, { asciiOnly: true });
-			if (shown === raw) return [[raw, masked]];
+			const escaped = (text) => JSON.stringify(text).slice(1, -1);
+			const rendered = displayStackName(raw);
+			const escapedPair = [...shown !== "" && escaped(shown) !== shown ? [[escaped(shown), escaped(displaySafe(masked, { asciiOnly: true }))]] : [], ...rendered !== raw && rendered !== shown && rendered !== escaped(shown) ? [[rendered, displayStackName(displaySafe(masked, { asciiOnly: true }))]] : []];
+			if (shown === raw) return [[raw, masked], ...escapedPair];
 			const shownMask = displaySafe(masked, { asciiOnly: true });
-			return shown === "" || shownMask === "" ? [[raw, masked]] : [[raw, masked], [shown, shownMask]];
+			return shown === "" || shownMask === "" ? [[raw, masked]] : [
+				[raw, masked],
+				[shown, shownMask],
+				...escapedPair
+			];
 		}).sort(([a], [b]) => b.length - a.length);
 		if (substitutions.length === 0) return void 0;
 		return (text) => {
@@ -34115,7 +35120,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (typeof resolvedValue !== "string") throw new Error(`Fn::Base64: value must resolve to a string, got ${typeof resolvedValue}`);
 		const result = Buffer.from(resolvedValue).toString("base64");
 		const inputLogText = this.logTextOfLeaf(resolvedValue, context);
-		if (context.recordedSecretValues && (inputLogText !== resolvedValue || this.maskNeedlesForLog(resolvedValue, context) !== resolvedValue)) recordMaskOnlyValue(context.recordedSecretValues, result);
+		if (context.recordedSecretValues && (inputLogText !== resolvedValue || this.maskNeedlesForLog(resolvedValue, context) !== resolvedValue)) {
+			recordMaskOnlyValue(context.recordedSecretValues, result);
+			if (embedsFreshNoEchoValue(resolvedValue, context.recordedSecretValues)) recordFreshNoEchoValuesIn(result, context.recordedSecretValues);
+		}
 		this.logger.debug(`Resolved Fn::Base64: ${this.displayMasked(inputLogText, context)} -> ${this.displayMasked(inputLogText !== resolvedValue ? "***" : result, context)}`);
 		return result;
 	}
@@ -34781,6 +35789,16 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		return displaySafe(this.maskThenStripThenMask(value, context));
 	}
 	/**
+	* {@link displayMasked}, then bounded as an IDENTIFIER (go-to-k/cdkd#3617):
+	* bare when plain, otherwise one JSON string, so a template- or state-chosen
+	* name cannot close a quote of cdkd's own and write a clause into the
+	* message. Masked FIRST: `displayIdent` blanks non-ASCII and cuts, either of
+	* which would stop a recorded plaintext inside the name from matching.
+	*/
+	displayMaskedIdent(value, context, maxCodePoints) {
+		return boundAltered(value, this.displayMasked(displaySafe(this.displayMasked(value, context), { asciiOnly: true }), context), maxCodePoints);
+	}
+	/**
 	* The display form of a LOG-TWIN leaf — the second render route, named for
 	* the same reason as {@link displayMasked} and closed by the same scanner.
 	*
@@ -36068,24 +37086,22 @@ function maskDeep(value, mask, depth = 0) {
 * ## Why it has to be guarded
 *
 * The separator is NOT escaped, so a segment that itself contains a `|`
-* produces an id with the wrong arity. Every decode site splits the stored id
-* back apart and the extra segment shifts everything — for a Glue table named
-* `a|b` in database `mydb` the recorded id `mydb|a|b` decodes to database
-* `mydb`, table `a`. Both halves are non-empty, so every existing
-* "is this id well-formed?" guard passes and the deploy SUCCEEDS. What breaks
-* is everything afterwards: `cdkd destroy` deletes the WRONG resource if one
-* exists under the decoded pair (or warn-and-skips, reporting success while
-* the real resource stays alive and billing), and `cdkd drift` reads back
-* `undefined` forever.
-*
-* AWS itself accepts such a name — verified live us-east-1 2026-08-12,
-* `glue:CreateTable` with `TableInput.Name: 'a|b'` succeeds — and
-* CloudFormation manages the resource fine. The limitation is cdkd's own, so
-* the honest answer is to REFUSE at deploy time with a message that says so,
-* rather than to record an id that silently names something else. Escaping the
-* separator, or dropping the packing where the decode sites already receive
-* the properties bag, are the two real fixes and both remain open on #1672;
-* this guard is what closes the data-loss path in the meantime.
+* produces an id with the wrong arity. A decode site that splits the stored id
+* back apart shifts every later segment — for `<a>|<b|c>` a bare split yields
+* `(a, b)`. Both halves are non-empty, so every "is this id well-formed?" guard
+* passes and the deploy SUCCEEDS. What breaks is everything afterwards:
+* `cdkd destroy` deletes the WRONG resource if one exists under the decoded
+* pair (or warn-and-skips, reporting success while the real resource stays
+* alive and billing), and `cdkd drift` reads back `undefined` forever.
+*
+* AWS itself can accept such a segment — `glue:CreateTable` with
+* `TableInput.Name: 'a|b'` succeeds — and CloudFormation manages the resource
+* fine. The limitation is cdkd's own, so the honest answer is to REFUSE at
+* deploy time with a message that says so, rather than to record an id that
+* silently names something else. `AWS::Glue::Table`'s decode sites now anchor
+* on the recorded `DatabaseName` instead of splitting, but its `Ref`
+* extraction still takes the last segment, so the refusal stays for it too.
+* Escaping the separator is the general fix and remains open on #1672.
 *
 * ## Two entry points, mirroring `config-shape.ts`
 *
@@ -36431,318 +37447,6 @@ function ccProtectionRegistryTypes() {
 	return Object.keys(CC_PROTECTION_PROPERTIES);
 }
 
-//#endregion
-//#region src/provisioning/unsupported-types.generated.ts
-/**
-* AUTO-GENERATED by scripts/gen-unsupported-types.ts — DO NOT EDIT BY HAND.
-* Source: docs/_generated/provider-coverage.json (tier3), minus
-* registry-routed special cases (see REGISTRY_ROUTED_EXCLUSIONS in the
-* generator).
-* Regenerate: `vp run gen:unsupported-types`.
-*
-* AWS CloudFormation resource types AWS reports as
-* `ProvisioningType: NON_PROVISIONABLE` (Cloud Control API cannot
-* create/update/delete them) and for which cdkd has no SDK provider. cdkd
-* pre-flight rejects these fast with an actionable message instead of letting
-* the optimistic Cloud Control fallthrough fail mid-deploy.
-*/
-const NON_PROVISIONABLE_TYPES = /* @__PURE__ */ new Set([
-	"Alexa::ASK::Skill",
-	"AWS::AmazonMQ::ConfigurationAssociation",
-	"AWS::Amplify::Jobs",
-	"AWS::AmplifyUIBuilder::CodegenJob",
-	"AWS::AppMesh::GatewayRoute",
-	"AWS::AppMesh::Mesh",
-	"AWS::AppMesh::Route",
-	"AWS::AppMesh::VirtualGateway",
-	"AWS::AppMesh::VirtualNode",
-	"AWS::AppMesh::VirtualRouter",
-	"AWS::AppMesh::VirtualService",
-	"AWS::AppStream::Fleet",
-	"AWS::AppStream::StackFleetAssociation",
-	"AWS::AppSync::ApiCache",
-	"AWS::Artifact::Report",
-	"AWS::Athena::Session",
-	"AWS::AutoScalingPlans::ScalingPlan",
-	"AWS::BackupSearch::SearchJob",
-	"AWS::BackupSearch::SearchResultExportJob",
-	"AWS::BCMDataExports::Table",
-	"AWS::Bedrock::AsyncInvoke",
-	"AWS::Bedrock::DefaultPromptRouter",
-	"AWS::Bedrock::FlowExecution",
-	"AWS::Bedrock::FoundationModel",
-	"AWS::Bedrock::ImportedModel",
-	"AWS::Bedrock::ModelImportJob",
-	"AWS::Bedrock::ModelInvocationJob",
-	"AWS::BedrockAgentCore::ConfigurationBundleVersion",
-	"AWS::BedrockAgentCore::HarnessVersion",
-	"AWS::BedrockAgentCore::PolicyGeneration",
-	"AWS::BedrockAgentCore::TokenVault",
-	"AWS::Braket::Job",
-	"AWS::Cassandra::Stream",
-	"AWS::Cloud9::EnvironmentEC2",
-	"AWS::CloudFormation::Macro",
-	"AWS::CloudFormation::ResourceScan",
-	"AWS::CloudFormation::WaitCondition",
-	"AWS::CloudFront::StreamingDistribution",
-	"AWS::CodeArtifact::Package",
-	"AWS::CodeBuild::Build",
-	"AWS::CodeBuild::BuildBatch",
-	"AWS::CodeBuild::Sandbox",
-	"AWS::CodeStar::GitHubRepository",
-	"AWS::CognitoSync::Dataset",
-	"AWS::Comprehend::DocumentClassificationJob",
-	"AWS::Comprehend::DominantLanguageDetectionJob",
-	"AWS::Comprehend::EntitiesDetectionJob",
-	"AWS::Comprehend::FlywheelDataset",
-	"AWS::Comprehend::SentimentDetectionJob",
-	"AWS::Comprehend::TargetedSentimentDetectionJob",
-	"AWS::Config::ConfigurationRecorder",
-	"AWS::Config::DeliveryChannel",
-	"AWS::Config::OrganizationConfigRule",
-	"AWS::ControlCatalog::CommonControl",
-	"AWS::ControlCatalog::Control",
-	"AWS::ControlCatalog::Objective",
-	"AWS::DataExchange::Assets",
-	"AWS::DataExchange::EntitledDataSets",
-	"AWS::DataExchange::Job",
-	"AWS::DataSync::TaskExecution",
-	"AWS::DAX::Cluster",
-	"AWS::DAX::SubnetGroup",
-	"AWS::Deadline::Job",
-	"AWS::DirectoryService::MicrosoftAD",
-	"AWS::DMS::ReplicationInstance",
-	"AWS::DRS::RecoveryInstance",
-	"AWS::DynamoDB::Export",
-	"AWS::DynamoDB::Stream",
-	"AWS::EC2::ClientVpnAuthorizationRule",
-	"AWS::EC2::ClientVpnEndpoint",
-	"AWS::EC2::ClientVpnRoute",
-	"AWS::EC2::ClientVpnTargetNetworkAssociation",
-	"AWS::EC2::ExportInstanceTask",
-	"AWS::EC2::NetworkInterfacePermission",
-	"AWS::EC2::ReplaceRootVolumeTask",
-	"AWS::EC2::VpnConnectionDeviceType",
-	"AWS::EC2::VPNGatewayRoutePropagation",
-	"AWS::ECRPublic::Registry",
-	"AWS::ECS::ContainerInstance",
-	"AWS::ECS::Task",
-	"AWS::ElastiCache::ReservedCacheNode",
-	"AWS::ElastiCache::SecurityGroup",
-	"AWS::ElastiCache::SecurityGroupIngress",
-	"AWS::ElasticLoadBalancingV2::ListenerCertificate",
-	"AWS::Elasticsearch::Domain",
-	"AWS::EMR::NotebookExecution",
-	"AWS::EMRContainers::JobRun",
-	"AWS::EMRServerless::JobRun",
-	"AWS::Events::Replay",
-	"AWS::FIS::Experiment",
-	"AWS::FIS::SafetyLever",
-	"AWS::FSx::Snapshot",
-	"AWS::FSx::StorageVirtualMachine",
-	"AWS::Glue::DevEndpoint",
-	"AWS::Glue::Partition",
-	"AWS::Glue::TableVersion",
-	"AWS::Greengrass::ConnectorDefinition",
-	"AWS::Greengrass::ConnectorDefinitionVersion",
-	"AWS::Greengrass::CoreDefinition",
-	"AWS::Greengrass::CoreDefinitionVersion",
-	"AWS::Greengrass::DeviceDefinition",
-	"AWS::Greengrass::DeviceDefinitionVersion",
-	"AWS::Greengrass::FunctionDefinition",
-	"AWS::Greengrass::FunctionDefinitionVersion",
-	"AWS::Greengrass::Group",
-	"AWS::Greengrass::GroupVersion",
-	"AWS::Greengrass::LoggerDefinition",
-	"AWS::Greengrass::LoggerDefinitionVersion",
-	"AWS::Greengrass::ResourceDefinition",
-	"AWS::Greengrass::ResourceDefinitionVersion",
-	"AWS::Greengrass::SubscriptionDefinition",
-	"AWS::Greengrass::SubscriptionDefinitionVersion",
-	"AWS::GreengrassV2::Component",
-	"AWS::GreengrassV2::CoreDevice",
-	"AWS::IdentityStore::AllGroupMemberships",
-	"AWS::ImageBuilder::AllImageBuildVersions",
-	"AWS::ImageBuilder::AllWorkflowBuildVersions",
-	"AWS::ImageBuilder::LifecycleExecution",
-	"AWS::ImageBuilder::WorkflowExecution",
-	"AWS::ImageBuilder::WorkflowStepExecution",
-	"AWS::InternetMonitor::InternetEvent",
-	"AWS::IoT::Index",
-	"AWS::IoT::PolicyPrincipalAttachment",
-	"AWS::IoT::ThingPrincipalAttachment",
-	"AWS::IoTDeviceAdvisor::SuiteRun",
-	"AWS::IoTThingsGraph::FlowTemplate",
-	"AWS::IoTTwinMaker::MetadataTransferJob",
-	"AWS::IVS::Composition",
-	"AWS::KafkaConnect::ConnectorOperation",
-	"AWS::KinesisAnalytics::Application",
-	"AWS::KinesisAnalytics::ApplicationOutput",
-	"AWS::KinesisAnalytics::ApplicationReferenceDataSource",
-	"AWS::KinesisAnalyticsV2::ApplicationCloudWatchLoggingOption",
-	"AWS::KinesisAnalyticsV2::ApplicationOutput",
-	"AWS::KinesisAnalyticsV2::ApplicationReferenceDataSource",
-	"AWS::LakeFormation::DataLakeSettings",
-	"AWS::LakeFormation::Permissions",
-	"AWS::LakeFormation::Resource",
-	"AWS::Lambda::DurableExecution",
-	"AWS::Lightsail::ExportSnapshotRecord",
-	"AWS::Location::Job",
-	"AWS::Macie2::ClassificationJob",
-	"AWS::ManagedBlockchain::Member",
-	"AWS::ManagedBlockchain::Node",
-	"AWS::MediaConnect::Offering",
-	"AWS::MediaConnect::Reservation",
-	"AWS::MediaConvert::JobTemplate",
-	"AWS::MediaConvert::Queue",
-	"AWS::MediaLive::Channel",
-	"AWS::MediaLive::Input",
-	"AWS::MediaLive::InputSecurityGroup",
-	"AWS::MediaLive::Offering",
-	"AWS::MediaPackage::HarvestJob",
-	"AWS::MediaPackageV2::HarvestJob",
-	"AWS::MediaStore::Container",
-	"AWS::MedicalImaging::ImageSet",
-	"AWS::MemoryDB::MultiRegionParameterGroup",
-	"AWS::MemoryDB::ReservedNode",
-	"AWS::NeptuneGraph::ExportTask",
-	"AWS::NovaAct::WorkflowRun",
-	"AWS::Omics::ReadSet",
-	"AWS::Omics::Reference",
-	"AWS::Omics::Run",
-	"AWS::Omics::Task",
-	"AWS::OpsWorks::App",
-	"AWS::OpsWorks::ElasticLoadBalancerAttachment",
-	"AWS::OpsWorks::Instance",
-	"AWS::OpsWorks::Layer",
-	"AWS::OpsWorks::Stack",
-	"AWS::OpsWorks::UserProfile",
-	"AWS::OpsWorks::Volume",
-	"AWS::Organizations::Root",
-	"AWS::OSIS::PipelineBlueprint",
-	"AWS::PartnerCentral::ConnectionPreferences",
-	"AWS::PartnerCentral::Partner",
-	"AWS::Personalize::BatchInferenceJob",
-	"AWS::Personalize::BatchSegmentJob",
-	"AWS::Personalize::DataDeletionJob",
-	"AWS::Personalize::DatasetExportJob",
-	"AWS::Personalize::Recipe",
-	"AWS::Pinpoint::ADMChannel",
-	"AWS::Pinpoint::APNSChannel",
-	"AWS::Pinpoint::APNSSandboxChannel",
-	"AWS::Pinpoint::APNSVoipChannel",
-	"AWS::Pinpoint::APNSVoipSandboxChannel",
-	"AWS::Pinpoint::App",
-	"AWS::Pinpoint::ApplicationSettings",
-	"AWS::Pinpoint::BaiduChannel",
-	"AWS::Pinpoint::Campaign",
-	"AWS::Pinpoint::EmailChannel",
-	"AWS::Pinpoint::EmailTemplate",
-	"AWS::Pinpoint::EventStream",
-	"AWS::Pinpoint::GCMChannel",
-	"AWS::Pinpoint::PushTemplate",
-	"AWS::Pinpoint::Segment",
-	"AWS::Pinpoint::SMSChannel",
-	"AWS::Pinpoint::SmsTemplate",
-	"AWS::Pinpoint::VoiceChannel",
-	"AWS::PinpointEmail::ConfigurationSet",
-	"AWS::PinpointEmail::ConfigurationSetEventDestination",
-	"AWS::PinpointEmail::DedicatedIpPool",
-	"AWS::PinpointEmail::Identity",
-	"AWS::QLDB::Ledger",
-	"AWS::QuickSight::AssetBundleExportJob",
-	"AWS::QuickSight::AssetBundleImportJob",
-	"AWS::RDS::DBSecurityGroup",
-	"AWS::RDS::DBSecurityGroupIngress",
-	"AWS::RDS::ReservedDBInstance",
-	"AWS::Redshift::ClusterSecurityGroup",
-	"AWS::Redshift::ClusterSecurityGroupIngress",
-	"AWS::Redshift::DataShare",
-	"AWS::RedshiftServerless::RecoveryPoint",
-	"AWS::ResilienceHub::RecommendationTemplate",
-	"AWS::Route53::RecordSetGroup",
-	"AWS::Route53Resolver::FirewallConfig",
-	"AWS::SageMaker::AutoMLJob",
-	"AWS::SageMaker::CodeRepository",
-	"AWS::SageMaker::ExperimentTrialComponent",
-	"AWS::SageMaker::HubContentVersion",
-	"AWS::SageMaker::HyperParameterTuningJob",
-	"AWS::SageMaker::ModelCardExportJob",
-	"AWS::SageMaker::MonitoringScheduleAlert",
-	"AWS::SageMaker::NotebookInstance",
-	"AWS::SageMaker::NotebookInstanceLifecycleConfig",
-	"AWS::SageMaker::OptimizationJob",
-	"AWS::SageMaker::PipelineExecution",
-	"AWS::SageMaker::TrainingJob",
-	"AWS::SageMaker::TransformJob",
-	"AWS::SageMaker::Workteam",
-	"AWS::SavingsPlans::SavingsPlan",
-	"AWS::SecurityAgent::PentestTask",
-	"AWS::ServiceDiscovery::Instance",
-	"AWS::ServiceQuotas::Quota",
-	"AWS::Signer::SigningJob",
-	"AWS::SSM::AutomationExecution",
-	"AWS::SSM::ManagedInstance",
-	"AWS::SSM::Session",
-	"AWS::SSO::ApplicationProvider",
-	"AWS::States::Execution",
-	"AWS::StepFunctions::MapRun",
-	"AWS::ThinClient::SoftwareSet",
-	"AWS::Transcribe::CallAnalyticsJob",
-	"AWS::Transcribe::MedicalScribeJob",
-	"AWS::Transcribe::MedicalTranscriptionJob",
-	"AWS::Transcribe::TranscriptionJob",
-	"AWS::UserNotifications::ManagedNotificationConfiguration",
-	"AWS::UserNotifications::NotificationEvent",
-	"AWS::WAF::ByteMatchSet",
-	"AWS::WAF::IPSet",
-	"AWS::WAF::Rule",
-	"AWS::WAF::SizeConstraintSet",
-	"AWS::WAF::SqlInjectionMatchSet",
-	"AWS::WAF::WebACL",
-	"AWS::WAF::XssMatchSet",
-	"AWS::WAFRegional::ByteMatchSet",
-	"AWS::WAFRegional::GeoMatchSet",
-	"AWS::WAFRegional::IPSet",
-	"AWS::WAFRegional::RateBasedRule",
-	"AWS::WAFRegional::RegexPatternSet",
-	"AWS::WAFRegional::Rule",
-	"AWS::WAFRegional::SizeConstraintSet",
-	"AWS::WAFRegional::SqlInjectionMatchSet",
-	"AWS::WAFRegional::WebACL",
-	"AWS::WAFRegional::WebACLAssociation",
-	"AWS::WAFRegional::XssMatchSet",
-	"AWS::Wisdom::Session",
-	"AWS::WorkSpaces::WorkSpaceApplication"
-]);
-
-//#endregion
-//#region src/provisioning/unsupported-types.ts
-/**
-* Helpers for cdkd's genuinely-unsupported resource types.
-*
-* The data ({@link NON_PROVISIONABLE_TYPES}) is generated from the
-* provider-coverage audit (`vp run gen:unsupported-types`); this module adds
-* the runtime predicates + the actionable issue link used by the pre-flight
-* check (see {@link ../provisioning/provider-registry.ProviderRegistry.validateResourceTypes}).
-*/
-/**
-* True if AWS reports the type as `ProvisioningType: NON_PROVISIONABLE`
-* (Cloud Control API cannot create/update/delete it) and cdkd has no SDK
-* provider for it.
-*/
-function isNonProvisionable(resourceType) {
-	return NON_PROVISIONABLE_TYPES.has(resourceType);
-}
-/**
-* A 1-click pre-filled GitHub issue link requesting cdkd support for a
-* resource type. Surfaced in the pre-flight error so a user hitting an
-* unsupported type lands directly in the "request support" flow.
-*/
-function unsupportedTypeIssueUrl(resourceType) {
-	return `https://github.com/go-to-k/cdkd/issues/new?title=${encodeURIComponent(`Support resource type ${resourceType}`)}&labels=resource-support`;
-}
-
 //#endregion
 //#region src/provisioning/slow-cc-operation-timeouts.ts
 const MINUTE_MS = 6e4;
@@ -37486,7 +38190,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-B32vpt_E.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-Dbqbr89e.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -38032,7 +38736,11 @@ var CloudControlProvider = class {
 		const enriched = { ...attributes };
 		switch (resourceType) {
 			case "AWS::S3::Bucket":
-				if (!enriched["Arn"]) enriched["Arn"] = `arn:aws:s3:::${physicalId}`;
+				if (!enriched["Arn"]) try {
+					enriched["Arn"] = s3BucketArn(physicalId, await this.cloudControlClient.config.region());
+				} catch (error) {
+					this.logger.debug(`Failed to construct S3 Bucket Arn for ${physicalId}: ${describeAwsFailure(error).detail}`);
+				}
 				break;
 			case "AWS::RDS::DBCluster":
 				try {
@@ -39940,7 +40648,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 					reuseClientCredentials: true,
 					tolerateNonStandardClient: true,
 					onRebuild: ({ bucketRegion, currentRegion }) => {
-						this.logger.debug(`Custom resource response bucket '${displaySafe(bucket, { asciiOnly: true }) || "<unrenderable>"}' is in '${displaySafe(bucketRegion, { asciiOnly: true }) || "<unrenderable>"}' (client was '${displaySafe(currentRegion, { asciiOnly: true }) || "<unrenderable>"}'); building a region-corrected S3 client for response operations.`);
+						this.logger.debug(`Custom resource response bucket ${displayIdent(bucket)} is in ${displayIdent(bucketRegion)} (client was ${displayIdent(currentRegion)}); building a region-corrected S3 client for response operations.`);
 					}
 				});
 				if (generation !== this.responseClientGeneration) {
@@ -42611,7 +43319,7 @@ var ProviderRegistry = class {
 		}
 		const specificProvider = this.providers.get(resourceType);
 		if (specificProvider) {
-			const actionableDrops = findActionableSilentDrops(resourceType, properties, this.allowedUnsupportedProperties);
+			const actionableDrops = findActionableSilentDrops(resourceType, properties, this.allowedUnsupportedProperties, input.previousProperties);
 			if (actionableDrops.length === 0) {
 				this.logger.debug(`Using specific SDK provider for ${resourceType}`);
 				if (returningToSdk) {
@@ -42851,15 +43559,18 @@ var ProviderRegistry = class {
 	* surface every time.
 	*/
 	reportSilentDropDecisions(resources) {
-		for (const { logicalId, resourceType, properties, provisionedBy } of resources) {
+		for (const { logicalId, resourceType, properties, provisionedBy, previousProperties } of resources) {
 			const drops = findSilentDropProperties(resourceType, properties);
+			const unrecognizedRoute = findRoutableUnrecognizedProperties(resourceType, properties, this.allowedUnsupportedProperties, previousProperties);
 			const stickyCc = provisionedBy === "cc-api" && !STICKY_CC_MIGRATION_EXEMPT.has(resourceType);
-			const overridden = stickyCc ? [] : findAcceptedSilentDrops(resourceType, properties, this.allowedUnsupportedProperties);
-			const autoRouted = drops.map(({ property }) => property).filter((property) => !this.allowedUnsupportedProperties.has(`${resourceType}:${property}`));
+			const overridden = stickyCc ? [] : findAcceptedSilentDrops(resourceType, properties, this.allowedUnsupportedProperties, previousProperties);
+			const autoRouted = [...drops.map(({ property }) => property).filter((property) => !this.allowedUnsupportedProperties.has(`${resourceType}:${property}`)), ...unrecognizedRoute].sort((a, b) => a.localeCompare(b));
 			if (autoRouted.length > 0) {
 				const unroutable = this.ccRouteUnavailableReason(resourceType);
 				if (unroutable !== void 0) throw new Error(`${logicalId}: ${this.buildUnroutableSilentDropMessage(resourceType, drops.filter((d) => autoRouted.includes(d.property)), unroutable)}`);
-				const message = `${logicalId} (${resourceType}): routing via Cloud Control API (cdkd's SDK Provider does not yet wire ${autoRouted.join(", ")} — CC API will forward the full property map. Override via --prefer-sdk-route ${autoRouted.map((p) => `${resourceType}:${p}`).join(",")}.)`;
+				const propList = autoRouted.join(", ");
+				const overrideHint = autoRouted.map((p) => `${resourceType}:${p}`).join(",");
+				const message = `${logicalId} (${resourceType}): routing via Cloud Control API (cdkd's SDK Provider does not yet wire ${propList} — CC API will forward the full property map.${unrecognizedRoute.length === 0 ? "" : ` ${unrecognizedRoute.join(", ")} ${unrecognizedRoute.length === 1 ? "is" : "are"} not in cdkd's CFn schema snapshot: Cloud Control applies a property AWS published since, and rejects a misspelled one as CloudFormation does.`} Override via --prefer-sdk-route ${overrideHint}.)`;
 				if (provisionedBy === "cc-api") this.logger.debug(message);
 				else this.logger.info(message);
 			}
@@ -42886,67 +43597,70 @@ var ProviderRegistry = class {
 			}
 			this.reportUnrecognizedProperties(logicalId, resourceType, properties, {
 				provisionedBy,
-				autoRouted: autoRouted.length > 0
+				autoRouted: autoRouted.length > 0,
+				previousProperties
 			});
 		}
 	}
 	/**
 	* Warn about top-level template properties this type's committed CFn schema
 	* snapshot does not know about, on resources that resolve to the SDK route
-	* (issue [#2718](https://github.com/go-to-k/cdkd/issues/2718)).
-	*
-	* The gap this closes: {@link getProviderFor} decides SDK-vs-Cloud-Control
-	* from `property-coverage.generated.ts`, built offline from the schema
-	* fixtures, and there is no runtime `DescribeType` on that path. So a
-	* property AWS publishes AFTER the fixture snapshot produces no
-	* `silentDrop` entry, does not auto-route to Cloud Control, and is dropped
-	* with the deploy reporting success — the issue
-	* [#614](https://github.com/go-to-k/cdkd/issues/614) failure class reached
-	* through the one input the #614 machinery cannot observe. The scheduled
-	* fixture-refresh job is the FIX (the property enters the fixture and the
-	* existing auto-route handles it); this warn is what protects a user
-	* deploying BETWEEN refresh cycles.
-	*
-	* Fires only on the SDK route, which is where the drop actually happens.
-	* The two Cloud-Control routes both forward the full property map verbatim,
-	* so the property does reach AWS there and a warn would be false:
-	* - `provisionedBy: 'cc-api'` from existing state (sticky rule 2 of
-	*   {@link getProviderFor}), minus the `STICKY_CC_MIGRATION_EXEMPT` types
-	*   that deliberately re-route back to their SDK provider;
-	* - an actionable silent drop auto-routing this deploy (`autoRouted`).
-	*
-	* The route test MIRRORS `getProviderFor` rather than re-deriving it — the
-	* two answering differently is the only way this warn can be wrong about a
-	* resource, and it is not decidable from the message.
-	*
-	* **Known divergence, in the SAFE direction.** This runs on the template's
-	* RAW properties (`deploy-engine.ts` calls `validateResourceProperties`
-	* pre-flight) while `getProviderFor` runs on RESOLVED ones. So a silent-drop
-	* key present only behind an `Fn::If` that resolves to `AWS::NoValue` makes
-	* `autoRouted` true here and suppresses the warn, while the real route ends
-	* up on the SDK provider and does drop the unrecognized property. The result
-	* is a MISSING warn, never a false one — which is the right direction for an
-	* advisory line, and why this is documented rather than fixed by resolving
-	* twice. `getProviderFor` remains the authority on routing; nothing here
-	* changes a routing decision.
-	*
-	* Suppressed per `<Type>:<Prop>` by `--allow-unsupported-properties`, whose
-	* meaning ("accept the silent drop, stay on the SDK path") is exactly this
-	* case; deliberately no new flag. Warn rather than error because the drop
-	* may be intended, and deliberately NOT an auto-route: flipping to
-	* Cloud Control on an UNRECOGNIZED property would let a typo trigger the
-	* currently one-way `cc-api` state flip (issue
-	* [#2719](https://github.com/go-to-k/cdkd/issues/2719)), and CC would reject
-	* the unknown key anyway.
+	* (issues [#2718](https://github.com/go-to-k/cdkd/issues/2718),
+	* [#3713](https://github.com/go-to-k/cdkd/issues/3713)).
+	*
+	* Such a key normally ROUTES the resource through Cloud Control
+	* (`findRoutableUnrecognizedProperties`), and then no warn is due: Cloud
+	* Control applies it or rejects it as CloudFormation would. What stays on the
+	* SDK route — and is dropped there with the deploy reporting success — falls
+	* into three buckets, each named with its own reason, because a line naming
+	* the wrong one misdirects the reader into the wrong fix:
+	*
+	* - READ-ONLY: an attribute, which no engine sets. CloudFormation ignores it
+	*   too, which is why it does not route.
+	* - UNROUTABLE TYPE: Cloud Control cannot take the type over
+	*   (`disableCcApiFallback` / `NON_PROVISIONABLE`), so the value has no route.
+	* - UNCHANGED: the state record already holds the key with this value (or
+	*   a value that cannot be compared before resolution), so the resource
+	*   stays on the SDK route, which does not send it. Changing it routes the
+	*   resource. "Never reached AWS" would overclaim: a record `cdkd import`
+	*   wrote carries the template's bag, whose value the live resource may hold.
+	* - UNROUTABLE TYPE also covers a `'cc-broken'` sticky-CC exemption, whose
+	*   Cloud Control handler cannot manage the type at all.
+	*
+	* Fires only on the SDK route. `provisionedBy: 'cc-api'` from state (minus
+	* the `STICKY_CC_MIGRATION_EXEMPT` types that return to their SDK provider)
+	* and a resource auto-routing this deploy both forward the full map.
+	*
+	* **An intrinsic value is reported as undecided.** This runs on the
+	* template's RAW properties (`deploy-engine.ts` calls
+	* `validateResourceProperties` pre-flight) while `getProviderFor` runs on
+	* RESOLVED ones, so a recorded key whose raw value still holds an intrinsic
+	* cannot be compared here. It is not announced as routing, and its warn
+	* sentence says the route is decided once the value resolves — true on
+	* either outcome. `getProviderFor` remains the authority.
+	*
+	* Suppressed per `<Type>:<Prop>` by `--prefer-sdk-route`, whose meaning
+	* ("accept the silent drop, stay on the SDK path") is exactly this case.
 	*/
 	reportUnrecognizedProperties(logicalId, resourceType, properties, route) {
 		if (route.provisionedBy === "cc-api" && !STICKY_CC_MIGRATION_EXEMPT.has(resourceType) || route.autoRouted) return;
 		const unrecognized = findUnrecognizedProperties(resourceType, properties).filter((property) => !this.allowedUnsupportedProperties.has(`${resourceType}:${property}`));
 		if (unrecognized.length === 0) return;
-		const propList = unrecognized.join(", ");
+		const coverage = getPropertyCoverage(resourceType);
+		const unroutable = this.ccRouteUnavailableReason(resourceType) ?? (STICKY_CC_MIGRATION_EXEMPT.get(resourceType)?.mode === "cc-broken" ? "Cloud Control's handler cannot manage this type correctly" : coverage?.ccRouteUnavailable === true ? "the type's SDK provider opts out of the Cloud Control fallback (disableCcApiFallback)" : void 0);
+		const readOnly = unrecognized.filter((p) => coverage?.readOnly.has(p) === true);
+		const notReadOnly = unrecognized.filter((p) => coverage?.readOnly.has(p) !== true);
+		const undecided = unroutable === void 0 ? notReadOnly.filter((p) => containsIntrinsic(properties?.[p]) && route.previousProperties != null && typeof route.previousProperties === "object" && Object.hasOwn(route.previousProperties, p)) : [];
+		const rest = notReadOnly.filter((p) => !undecided.includes(p));
+		const sentences = [];
+		const isAre = (names) => names.length === 1 ? "is" : "are";
+		if (readOnly.length > 0) sentences.push(`${readOnly.join(", ")} ${isAre(readOnly)} read-only — an attribute AWS computes, which no engine sets (CloudFormation ignores it too); remove it.`);
+		if (rest.length > 0 && unroutable !== void 0) sentences.push(`${rest.join(", ")} ${isAre(rest)} not in cdkd's CFn schema snapshot, and this type cannot be routed via Cloud Control API (${unroutable}), so cdkd has no route that applies ${rest.length === 1 ? "it" : "them"}. If it is a property AWS published since the snapshot, please report it: ${unsupportedPropertyIssueUrl(resourceType, rest[0])}.`);
+		else if (rest.length > 0) sentences.push(`${rest.join(", ")} ${isAre(rest)} not in cdkd's CFn schema snapshot and unchanged since this resource was deployed on the SDK route, so it stays there and cdkd does not send ${rest.length === 1 ? "it" : "them"}. Changing ${rest.length === 1 ? "it" : "one"} routes the resource via Cloud Control API, which applies a property AWS published since the snapshot and rejects a misspelled one, as CloudFormation does.`);
+		if (undecided.length > 0) sentences.push(`${undecided.join(", ")} ${isAre(undecided)} not in cdkd's CFn schema snapshot and ${undecided.length === 1 ? "its value holds" : "their values hold"} an intrinsic, so the route is decided once it resolves: a value unchanged since the SDK-route deploy stays there and is not sent, and a changed one routes via Cloud Control API.`);
+		if (sentences.length === 0) return;
 		const overrideHint = unrecognized.map((p) => `${resourceType}:${p}`).join(",");
-		const one = unrecognized.length === 1;
-		this.logger.warn(`${logicalId} (${resourceType}): ${propList} ${one ? "is" : "are"} not in cdkd's CFn schema snapshot for this type, so ${one ? "it" : "they"} will NOT reach AWS — the deploy will still report success. Anything of these shapes looks the same here: a misspelled name (fix the spelling); a read-only attribute, which is not settable on any engine (remove it); or a property AWS published after cdkd's snapshot, which cdkd should be routing via Cloud Control — please report that one: ${unsupportedPropertyIssueUrl(resourceType, unrecognized[0])}${one ? "" : ` (link is for ${unrecognized[0]})`}. If the drop is intended — an addPropertyOverride escape hatch — silence this via --prefer-sdk-route ${overrideHint}.`);
+		this.logger.warn(`${logicalId} (${resourceType}): ${unrecognized.length === 1 ? "a property" : "properties"} ${readOnly.length + rest.length > 0 ? "will NOT" : "may not"} reach AWS — the deploy will still report success. ${sentences.join(" ")} If the drop is intended — an addPropertyOverride escape hatch — silence this via --prefer-sdk-route ${overrideHint}.`);
 	}
 	/**
 	* Pure-functional discovery of every resource whose template uses one or
@@ -42961,8 +43675,8 @@ var ProviderRegistry = class {
 	*/
 	findAutoRouteHits(resources) {
 		const hits = [];
-		for (const { logicalId, resourceType, properties } of resources) {
-			const actionable = findActionableSilentDrops(resourceType, properties, this.allowedUnsupportedProperties);
+		for (const { logicalId, resourceType, properties, previousProperties } of resources) {
+			const actionable = findActionableSilentDrops(resourceType, properties, this.allowedUnsupportedProperties, previousProperties);
 			if (actionable.length === 0) continue;
 			hits.push({
 				logicalId,
@@ -44148,7 +44862,7 @@ function maskEveryOccurrence(text, exposure) {
 function secretBearingExportNameWarning(outputKey, exportName, exposure, secrets) {
 	const corpus = secrets ?? exposure;
 	const name = secretSafeKeyDisplay(exportName, corpus, exposure);
-	const shown = name.kind === "masked" ? `(masked: "${name.text}") ` : "";
+	const shown = name.kind === "masked" ? `${maskedLabel(name.text)} ` : "";
 	const ownerForceMask = /* @__PURE__ */ new Map();
 	const ownerHaystacks = secretScanHaystacks(outputKey);
 	for (const [plaintext, expression] of exposure) {
@@ -44221,6 +44935,22 @@ function displayTextOrWithheld(display) {
 	return display.kind === "withheld" ? WITHHELD_NAME_DISPLAY : display.text;
 }
 /**
+* The `(masked: ...)` label for a secret-bearing key the verdict already
+* masked, BOUNDED (go-to-k/cdkd#3617): both names are template- or
+* state-chosen, and inside hand-written quotes a `"` in the key closed them and
+* wrote a clause of its own.
+*
+* WITHHELD rather than bounded when the masked text carries anything
+* non-ASCII. `displayIdent` blanks such a character to a space AFTER the
+* verdict's own re-test, so the printed text would no longer be the tested
+* text -- `correct<NBSP>horse` beside a recorded `correct horse` would print
+* the secret byte for byte. Withholding keeps one string tested and printed,
+* the rule #2874 set for this module.
+*/
+function maskedLabel(maskedText) {
+	return /[^ -~]/.test(maskedText) ? "(masked, name withheld: it carries characters this line cannot show as tested)" : `(masked: ${displayIdent(maskedText)})`;
+}
+/**
 * Warning for a state KEY that already holds secret plaintext — the residue an
 * EARLIER binary left when it published an export name that resolved to one.
 *
@@ -44232,8 +44962,8 @@ function displayTextOrWithheld(display) {
 * Reported so the `--dry-run --fail` CI gate stops calling such a state clean.
 */
 function secretBearingStateKeyWarning(stackName, display) {
-	const clause = display.kind === "masked" ? `(masked: "${display.text}") ` : `(the name is withheld: masking it would leave the secret readable) `;
-	return `State for ${canonicalForSecretScan(stackName)} holds an output KEY that renders a secret ${clause}— cdkd scrub cannot rewrite a key, only a value, because the key IS the export name consumers resolve by. Give that output a non-secret Export.Name and redeploy: the next deploy replaces state.outputs and the exports index entirely. ROTATE the exposed secret.`;
+	const clause = display.kind === "masked" ? `${maskedLabel(display.text)} ` : `(the name is withheld: masking it would leave the secret readable) `;
+	return `State for ${displayStackName(canonicalForSecretScan(stackName))} holds an output KEY that renders a secret ${clause}— cdkd scrub cannot rewrite a key, only a value, because the key IS the export name consumers resolve by. Give that output a non-secret Export.Name and redeploy: the next deploy replaces state.outputs and the exports index entirely. ROTATE the exposed secret.`;
 }
 /**
 * Warning for an `Export.Name` colliding with an output NAME it does not own.
@@ -44790,7 +45520,6 @@ const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 	"AWS::S3Express::DirectoryBucket",
 	"AWS::S3Tables::TableBucket",
 	"AWS::S3Tables::Table",
-	"AWS::S3Tables::Namespace",
 	"AWS::S3Vectors::VectorBucket",
 	"AWS::ECR::Repository",
 	"AWS::EC2::Volume",
@@ -49365,6 +50094,15 @@ function deriveLabelRouting(change, existingState, registry, forceCcApi = false)
 	}
 }
 /**
+* Whether a property change's `requiresReplacement` is only a CEILING the diff
+* set before the value could be known — a synthetic change from in-place
+* attribute propagation or replacement propagation (go-to-k/cdkd#3662). The
+* UPDATE arm lowers such a ceiling when the resolved value equals the record.
+*/
+function isReplacementCeiling(pc) {
+	return pc.requiresReplacement && (pc.inPlacePropagated === true || pc.replacementPropagated === true);
+}
+/**
 * Structural equality for resolved Outputs maps (issue #875).
 *
 * Output values are intrinsic-resolved primitives or nested objects/arrays
@@ -49676,6 +50414,15 @@ var DeployEngine = class DeployEngine {
 	*/
 	attemptedResolvedProps = /* @__PURE__ */ new Map();
 	/**
+	* The live-progress label `provisionResource` gave each resource, and whether
+	* its verb said `Replacing` (go-to-k/cdkd#3662). The label is chosen before
+	* resolution, so a resource whose only replacement is a CEILING (a synthetic
+	* change, see `isReplacementCeiling`) is labelled `Updating`; the UPDATE arm
+	* re-labels it here if the resolved value keeps the replacement, and the
+	* slow-resource warning reads the current label rather than the first one.
+	*/
+	liveTaskLabels = /* @__PURE__ */ new Map();
+	/**
 	* Logical ids whose replacement this deploy DELIBERATELY left the old
 	* physical resource alive for — `UpdateReplacePolicy: Retain` (issue
 	* [#2603](https://github.com/go-to-k/cdkd/issues/2603)).
@@ -49780,6 +50527,7 @@ var DeployEngine = class DeployEngine {
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
 		this.perResourceResolvedType = /* @__PURE__ */ new Map();
 		this.attemptedResolvedProps = /* @__PURE__ */ new Map();
+		this.liveTaskLabels = /* @__PURE__ */ new Map();
 		this.outputSecrets = /* @__PURE__ */ new Map();
 		this.outputsPassSecretMaps = [];
 		this.outputsTemplateSource = Object.create(null);
@@ -49819,6 +50567,24 @@ var DeployEngine = class DeployEngine {
 		};
 	}
 	/**
+	* The names of this child's parameters whose value carries a `NoEcho` value
+	* the parent supplied in THIS deploy (go-to-k/cdkd#3717), read off the
+	* inherited bag's fresh marks. `undefined` outside a nested child, or when
+	* none does.
+	*
+	* WHOLE values only. A mask-only needle replaces a leaf only whole, so a
+	* parameter that EMBEDS such a value (`prefix-<token>`) is not redacted for
+	* the diff at all: its readers already diff as UPDATE on the plaintext, and
+	* need no promotion from here.
+	*/
+	freshNoEchoParameters(parameterValues) {
+		const inherited = this.options.inheritedSecrets;
+		if (!inherited || inherited.size === 0) return void 0;
+		const fresh = /* @__PURE__ */ new Set();
+		for (const [name, value] of Object.entries(parameterValues)) if (carriesFreshNoEchoValue(value, inherited)) fresh.add(name);
+		return fresh.size > 0 ? fresh : void 0;
+	}
+	/**
 	* The parameter bag the DIFF resolver context binds, with any inherited
 	* secret plaintext rewritten back to its `{{resolve:...}}` expression (issue
 	* #1903).
@@ -50293,7 +51059,8 @@ var DeployEngine = class DeployEngine {
 		const { provider } = this.providerRegistry.getProviderFor({
 			resourceType: resource.resourceType,
 			properties: resource.properties,
-			provisionedBy: resource.provisionedBy
+			provisionedBy: resource.provisionedBy,
+			previousProperties: resource.properties
 		});
 		if (!provider.import) return { kind: "not-attempted" };
 		const found = await provider.import({
@@ -50794,7 +51561,8 @@ var DeployEngine = class DeployEngine {
 				logicalId,
 				resourceType: r.Type,
 				properties: r.Properties,
-				provisionedBy: currentState.resources[logicalId]?.provisionedBy
+				provisionedBy: currentState.resources[logicalId]?.provisionedBy,
+				previousProperties: currentState.resources[logicalId]?.properties
 			}));
 			this.providerRegistry.validateResourceProperties(resourcesForPropertyCheck);
 			this.logger.debug(`All resource properties validated`);
@@ -50810,7 +51578,7 @@ var DeployEngine = class DeployEngine {
 			diffResolverContext.bestEffort = true;
 			diffResolverContext.skipDynamicReferences = true;
 			const diffResolveFn = (value) => this.resolver.resolve(value, diffResolverContext);
-			const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry), this.providerRegistry.getAllowedUnsupportedProperties?.());
+			const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry), this.providerRegistry.getAllowedUnsupportedProperties?.(), this.freshNoEchoParameters(parameterValues));
 			const nestedStackTypeChanges = findNestedStackTypeChanges({
 				changes,
 				stateResources: currentState.resources
@@ -51444,11 +52212,15 @@ var DeployEngine = class DeployEngine {
 		const renderer = getLiveRenderer();
 		const labelRecreateDirection = this.recreateDirectionFor(stackName, logicalId);
 		const labelRecordedType = stateResources[logicalId]?.resourceType;
-		const needsReplacement = change.changeType === "UPDATE" && ((change.propertyChanges?.some((pc) => pc.requiresReplacement) ?? false) || labelRecordedType !== void 0 && labelRecordedType !== resourceType) || labelRecreateDirection !== void 0;
+		const needsReplacement = change.changeType === "UPDATE" && ((change.propertyChanges?.some((pc) => pc.requiresReplacement && !isReplacementCeiling(pc)) ?? false) || labelRecordedType !== void 0 && labelRecordedType !== resourceType) || labelRecreateDirection !== void 0;
 		const verb = change.changeType === "CREATE" ? "Creating" : change.changeType === "DELETE" ? "Deleting" : needsReplacement ? "Replacing" : "Updating";
 		const labelRouting = this.peekRoutingForLabel(change, stateResources[logicalId], stackName, logicalId, needsReplacement, labelRecreateDirection);
 		const baseLabel = `${verb} ${logicalId} (${resourceType})${labelRouting === "cc-api" ? " [CC API]" : ""}`;
 		renderer.addTask(logicalId, baseLabel);
+		this.liveTaskLabels.set(logicalId, {
+			label: baseLabel,
+			replacing: needsReplacement
+		});
 		const operationKind = change.changeType === "CREATE" ? "CREATE" : change.changeType === "DELETE" ? "DELETE" : "UPDATE";
 		const providerMinTimeoutMs = this.providerRegistry.getProvider(resourceType).getMinResourceTimeoutMs?.() ?? 0;
 		const warnAfterMs = this.options.resourceWarnAfterByType?.[resourceType] ?? this.options.resourceWarnAfterMs ?? 3e5;
@@ -51480,7 +52252,9 @@ var DeployEngine = class DeployEngine {
 				onWarn: (elapsedMs) => {
 					const minutes = Math.max(1, Math.round(elapsedMs / 6e4));
 					const warnSuffix = ` [taking longer than expected, ${minutes}m+]`;
-					renderer.updateTaskLabel(logicalId, `${baseLabel}${warnSuffix}`);
+					const current = this.liveTaskLabels.get(logicalId);
+					if (current !== void 0) current.warnSuffix = warnSuffix;
+					renderer.updateTaskLabel(logicalId, `${current?.label ?? baseLabel}${warnSuffix}`);
 					renderer.printAbove(() => {
 						this.logger.warn(`${logicalId} (${resourceType}) has been ${operationKind === "CREATE" ? "creating" : operationKind === "DELETE" ? "deleting" : "updating"} for ${minutes}m — still waiting`);
 					});
@@ -51586,7 +52360,10 @@ var DeployEngine = class DeployEngine {
 		if (targets.viaSdkProvider.has(logicalId)) return "sdk";
 	}
 	peekRoutingForLabel(change, existingState, stackName, logicalId, needsReplacement = false, recreateDirection) {
-		if (needsReplacement) return deriveLabelRouting(change, recreateDirection === void 0 ? void 0 : { provisionedBy: recreateDirection }, this.providerRegistry, recreateDirection === "cc-api");
+		if (needsReplacement) return deriveLabelRouting(change, {
+			...recreateDirection !== void 0 && { provisionedBy: recreateDirection },
+			...existingState?.properties !== void 0 && { properties: existingState.properties }
+		}, this.providerRegistry, recreateDirection === "cc-api");
 		return deriveLabelRouting(change, existingState, this.providerRegistry, this.isPinnedToCcApi(stackName, logicalId));
 	}
 	/**
@@ -51777,16 +52554,15 @@ var DeployEngine = class DeployEngine {
 				const updateSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
 				this.perResourceSecrets.set(logicalId, updateSecrets);
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
-				this.refuseRedactedAttributeReads(logicalId, resourceType, context);
 				this.perResourceTemplateProps.set(logicalId, desiredProps);
 				this.perResourceResolvedType.set(logicalId, resourceType);
 				recordNestedStackParameterExpressions(updateSecrets, resourceType, resolvedProps, desiredProps);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
-				this.attemptedResolvedProps.set(logicalId, resolvedProps);
+				const suppliesFreshMaskOnlyValue = carriesFreshNoEchoValue(resolvedProps, updateSecrets);
 				const desiredForSkipCheck = redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps);
 				const allowedSilentDrops = this.providerRegistry.getAllowedUnsupportedProperties?.();
-				const desiredForSkipCheckAsWritten = currentResource.provisionedBy !== "cc-api" && allowedSilentDrops ? withoutAcceptedSilentDropProperties(resourceType, desiredForSkipCheck, allowedSilentDrops) : desiredForSkipCheck;
-				if (!typeChanged && JSON.stringify(desiredForSkipCheckAsWritten) === JSON.stringify(currentPropsAsWritten)) {
+				const desiredForSkipCheckAsWritten = currentResource.provisionedBy !== "cc-api" && allowedSilentDrops ? withoutAcceptedSilentDropProperties(resourceType, desiredForSkipCheck, allowedSilentDrops, currentResource.properties) : desiredForSkipCheck;
+				if (!typeChanged && !suppliesFreshMaskOnlyValue && JSON.stringify(desiredForSkipCheckAsWritten) === JSON.stringify(currentPropsAsWritten)) {
 					if (change.attributeChanges && change.attributeChanges.length > 0) {
 						const attrSummary = change.attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
 						this.logger.info(`  ↻ ${logicalId} (${resourceType}) attribute update: ${attrSummary}`);
@@ -51805,12 +52581,32 @@ var DeployEngine = class DeployEngine {
 					if (counts) counts.skipped++;
 					break;
 				}
+				this.refuseRedactedAttributeReads(logicalId, resourceType, context);
+				this.attemptedResolvedProps.set(logicalId, resolvedProps);
+				if (change.propertyChanges?.some((pc) => isReplacementCeiling(pc)) === true) change.propertyChanges = change.propertyChanges.map((pc) => {
+					if (!isReplacementCeiling(pc)) return pc;
+					if (carriesFreshNoEchoValue(resolvedProps[pc.path], updateSecrets)) return pc;
+					return JSON.stringify(desiredForSkipCheckAsWritten[pc.path]) !== JSON.stringify(currentPropsAsWritten[pc.path]) ? pc : {
+						...pc,
+						requiresReplacement: false
+					};
+				});
 				const propertyDrivenReplacement = typeChanged || change.propertyChanges?.some((pc) => pc.requiresReplacement);
 				const recreateTargets = this.options.recreateTargets?.stackName === stackName ? this.options.recreateTargets : void 0;
 				const recreateViaCcApi = recreateTargets?.viaCcApi.has(logicalId) ?? false;
 				const recreateViaSdkProvider = recreateTargets?.viaSdkProvider.has(logicalId) ?? false;
 				const recreateFlagged = recreateViaCcApi || recreateViaSdkProvider;
 				const needsReplacement = propertyDrivenReplacement || recreateFlagged;
+				const liveLabel = this.liveTaskLabels.get(logicalId);
+				if (needsReplacement && liveLabel !== void 0 && !liveLabel.replacing) {
+					const label = `Replacing ${logicalId} (${resourceType})${this.peekRoutingForLabel(change, currentResource, stackName, logicalId, true, this.recreateDirectionFor(stackName, logicalId)) === "cc-api" ? " [CC API]" : ""}`;
+					this.liveTaskLabels.set(logicalId, {
+						label,
+						replacing: true,
+						...liveLabel.warnSuffix !== void 0 && { warnSuffix: liveLabel.warnSuffix }
+					});
+					renderer.updateTaskLabel(logicalId, `${label}${liveLabel.warnSuffix ?? ""}`);
+				}
 				const dependencies = this.extractAllDependencies(template, logicalId);
 				const updateReplacePolicy = template?.Resources?.[logicalId]?.UpdateReplacePolicy;
 				if (needsReplacement) {
@@ -51831,6 +52627,7 @@ var DeployEngine = class DeployEngine {
 						resourceType,
 						properties: resolvedProps,
 						...recreateDirectionHint && { provisionedBy: recreateDirectionHint },
+						previousProperties: currentResource.properties,
 						...recreateViaCcApi && { forceCcApi: true }
 					});
 					const replaceProvider = replaceDecision.provider;
@@ -52012,7 +52809,8 @@ var DeployEngine = class DeployEngine {
 							}
 							const replDecision = this.providerRegistry.getProviderFor({
 								resourceType,
-								properties: resolvedProps
+								properties: resolvedProps,
+								previousProperties: currentResource.properties
 							});
 							const replProvider = replDecision.provider;
 							const replProps = replDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
@@ -52796,5 +53594,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, ConfigError as $a, synthesisStatusMessage as $i, refuseMalformedOrphanRecordsForDestroy as $n, forceQuitRecoveryClause as $r, configIntegerRefusal as $t, createPreDeleteFinalSnapshot as A, credentialFingerprint as Aa, validateContainerRepoName as Ai, hasReadableOutputs as An, retryClassificationText as Ao, TEMPLATE_SOURCED_RULES as Ar, deleteSkipReason as At, isStatefulRecreateTargetSync as B, absoluteAssemblyPathEscape as Ba, getDockerCmd as Bi, malformedOrphansRefusalMessage as Bn, maskSecretsInText as Br, isImpossibleEmptyStoredAttribute as Bt, namesAnyDeclaredParameter as C, expectedOwnerParam as Ca, assertAssetBucketRegion as Ci, STATE_REGION_DIVERGED as Cn, shellQuote as Co, describeTypeWithThrottleRetry as Cr, compositeIdSkipResult as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, ambientClientDefaults as Da, parseBootstrapMarker as Di, deployRefusesOrphanRowsReason as Dn, isTransientServerError as Do, STATE_SOURCED_BASELINE_RULES as Dr, maskerOrIdentity as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, derivePartitionAndUrlSuffix as Ea, isCrossRegionRedirect as Ei, UNREADABLE_RESOURCES_MAP_ROW as En, isThrottlingError as Eo, TemplateParser as Er, maskDeep as Et, extractDeploymentEventError as F, defineOwnKey as Fa, describeDockerExecFailure as Fi, malformedExportSourceWarning as Fn, identityKeyFor as Fr, carriesDynamicReference as Ft, toCfnInteger as G, resolveBucketRegion as Ga, runDockerForeground as Gi, malformedResourceEntriesWarning as Gn, redactSecretsForState as Gr, isSettledInstanceState as Gt, WARM_THROUGHPUT_MEMBERS as H, renderAssemblyPathEscape as Ha, isMalformedEnvKey as Hi, malformedOutputsRefusalMessage as Hn, recordMaskOnlyValue as Hr, isUnboundTemplateParameter as Ht, makeSiblingClaimReader as I, hasOwnKey as Ia, describeDockerFailure as Ii, malformedLocalOutputsWarning as In, isSingleDynamicReferenceToken as Ir, carriesFetchableDynamicReference as It, bold as J, resetAwsClients as Ja, escapeRegExp$1 as Ji, malformedStateRefusalMessage as Jn, S3StateBackend as Jr, resolveExplicitPhysicalId as Jt, toFiniteNumber as K, AwsClients as Ka, runDockerStreaming as Ki, malformedResourcePropertiesWarning as Kn, scrubResourceRecord as Kr, WAFv2WebACLProvider as Kt, planOrphanAdoption as L, hasPlainPrototype$1 as La, dockerSpawnEnvWithSensitive as Li, malformedOrphanRecordsRefusalMessage as Ln, isUncertifiedBaselineMaskPosition as Lr, cfnRefValueFromPhysicalId as Lt, refusesFinalSnapshot as M, failedStageNote as Ma, buildDockerImage as Mi, isReadableOrphanRecord as Mn, safeStringify$1 as Mo, createSecretMasker as Mr, disableInstanceApiTermination as Mt, unsupportedFinalSnapshotError as N, globMatches as Na, resolveDockerContextDirectory as Ni, isReadableResourceEntry as Nn, __exportAll as No, dynamicReferenceTokens as Nr, isTerminationProtectionPropagationError as Nt, buildFinalSnapshotIdentifier as O, ambientCredentialConfig as Oa, readBootstrapMarkerBody as Oi, displayLogicalId as On, markNonRetryable as Oo, STATE_SOURCED_CROSS_GENERATION_RULES as Or, UNSPECIFIED_SKIP_REASON as Ot, makeCanonicalizePropertiesFn as P, processStackMessages as Pa, describeDockerCapturedOutput as Pi, malformedExportNamesWarning as Pn, errorCauseChain as Pr, IntrinsicFunctionResolver as Pt, red as Q, CdkdError as Qa, Synthesizer as Qi, refuseMalformedOrphanRecords as Qn, buildLockContentionMessage as Qr, configBooleanRefusal as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, nullPrototypeRecord as Ra, finchSecretArgvRefusal as Ri, malformedOrphanRecordsWarning as Rn, markSameGenerationBag as Rr, coerceParameterTypedValue as Rt, computeParameterTaint as S, decodeListingKey as Sa, BOOTSTRAP_MARKER_PREFIX as Si, INTRINSIC_KEYS as Sn, pasteableCommand as So, findSilentDropProperties as Sr, compositeIdSeparatorRefusal as St, resourcesNamingDeclaredParameter as T, canonicalizeRegion as Ta, getBootstrapMarkerKey as Ti, UNREADABLE_ORPHANS_CONTAINER_ROW as Tn, isRetryableTransientError as To, DagBuilder as Tr, createMaskedRetryLogger as Tt, coerceWarmThroughput as U, resolveAssemblyPath as Ua, partitionSensitiveEnv as Ui, malformedOutputsWarning as Un, recordMaskOnlyValuesIn as Ur, parameterTypeMayLoseSecretIdentity as Ut, renderStatefulReason as V, displayAssemblyPath as Va, isDockerClientEnvKey as Vi, malformedOrphansWarning as Vn, pathCrossesDottedKey as Vr, isNamelessDynamicReferenceError as Vt, isWarmThroughputDecrease as W, clearBucketRegionCache as Wa, redactDockerArgvValues as Wi, malformedRenderedContainersWarning as Wn, recoverMaskedOutput as Wr, refStateLookupFromResource as Wt, gray as X, setAwsClients as Xa, AssetManifestLoader as Xi, refuseDivergentRecordRegionForDestroy as Xn, UNREPRODUCIBLE_LOCK_CLAUSE as Xr, coerceCfnBoolean as Xt, cyan as Y, runWithStackAwsClients as Ya, stripControlChars as Yi, previewableOrphanRecords as Yn, rebuildClientForBucketRegion as Yr, assertRegionMatch as Yt, green as Z, AssetError as Za, getDockerImageBySourceHash as Zi, refuseMalformedNestedChildOutputs as Zn, buildForceUnlockCommand as Zr, coerceCfnInteger as Zt, bagHoldsSecretExpression as _, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as _a, buildAssetRedirectMap as _i, AWS_CREDENTIAL_ENV_KEYS as _n, SynthesisError as _o, safeRegion as _r, startInterruptWatch as _t, DeploymentEventsStore as a, resolveSkipPrefix as aa, hasReadableExportSet as ai, requireConfigString as an, LocalInvokeBuildError as ao, refuseMalformedResourceAttributesForOrphan as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, producerCoordinateKey as ba, rewriteTemplateAssetReferences as bi, envCredentialsAreAssumedRole as bn, normalizeAwsError as bo, unreadableOrphanRecords as br, ccProtectionRegistryTypes as bt, replayFailedOperations as c, resolveUseCdkBootstrapAssets as ca, importableOutputKeys as ci, classifyReplaySecretRegion as cn, MalformedProducerRecordRefusalError as co, refuseMalformedResourcePropertiesForOrphan as cr, IAMRoleProvider as ct, updatePartialMessage as d, ssmResolvedValueType as da, orphansAfterRollback as di, s3BucketArn as dn, ProvisioningError as do, repairMalformedOrphanRecordsForReadOnly as dr, ProviderRegistry as dt, getDefaultStateBucketName as ea, formatLockExpiry as ei, configStringRefusal as en, CrossAccountSecretRefusalError as eo, refuseMalformedOrphans as er, collectDeclaredOutputNames as et, updatePartialReason as f, CFN_TEMPLATE_BODY_LIMIT as fa, orphansCarriedFrom as fi, s3BucketDomainName as fn, ResourceTimeoutError as fo, repairMalformedOrphansForReadOnly as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, uploadCfnTemplate as ga, WorkGraph as gi, applyRoleArnIfSet as gn, StateError as go, repairMalformedResourcesForReadOnly as gr, isInterruptedWaitError as gt, IMPLICIT_DELETE_DEPENDENCIES as h, findLargeInlineResources as ha, stringifyValue as hi, s3BucketWebsiteUrl as hn, StackTerminationProtectionError as ho, repairMalformedResourcePropertiesForReadOnly as hr, interruptWatchListenerCount as ht, DeploymentEventsReader as i, resolveCaptureObservedState as ia, exportNamesCarriedFrom as ii, requireConfigObject as in, IntrinsicResolutionRefusalError as io, refuseMalformedOutputsForDestroy as ir, secretBearing as it, isFinalSnapshotError as j, AssemblyReader as ja, buildDenyExternalAccessPolicy as ji, hasReadableResources as jn, describeAwsFailure as jo, carriesSecretMask as jr, isWaitAbandonedError as jt, ccRoutedFinalSnapshotError as k, clientDefaultsFor as ka, validateAssetBucketName as ki, hasReadableOrphans as kn, markRedactedCause as ko, STATE_SOURCED_READBACK_RULES as kr, deleteIndeterminateGuards as kt, replayRollback as l, stateBucketExistenceConfirmed as la, importableOutputs as li, producerRegionsFromState as ln, NestedStackChildDirectDestroyError as lo, refuseMalformedResourcesForDestroy as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, MIGRATE_TMP_PREFIX as ma, AssetPublisher as mi, s3BucketRegionalDomainName as mn, StackHasActiveImportsError as mo, repairMalformedResourceEntriesForReadOnly as mr, endCommandInterruptScope as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveApp as na, DEFAULT_STATE_PREFIX as ni, replayWarn as nn, DeployCancelledError as no, refuseMalformedOrphansForOrphan as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, resolveStateBucketWithDefault as oa, hasReasonlessBaselineRefusal as oi, definedAttributes as on, LocalStartServiceError as oo, refuseMalformedResourceEntries as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, CFN_TEMPLATE_URL_LIMIT as pa, shouldRetainResource as pi, s3BucketDualStackDomainName as pn, ResourceUpdateNotSupportedError as po, repairMalformedOutputsForReadOnly as pr, beginCommandInterruptScope as pt, formatResourceLine as q, getAwsClients as qa, warnFinchArgvExposure as qi, malformedResourcesWarning as qn, LockManager as qr, normalizeAwsTagsToCfn as qt, DeployEngine as r, resolveAutoAssetStorage as ra, describeRegionValueKind as ri, requireConfigArray as rn, DynamicReferenceRegionAmbiguousError as ro, refuseMalformedOutputs as rr, isExportAliasCollision as rt, planRollback as s, resolveStateBucketWithDefaultAndSource as sa, hasUnverifiableParameterRefusal as si, stringifyIfAssigned as sn, LockError as so, refuseMalformedResourceEntriesForOrphan as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, getLegacyStateBucketName as ta, CUSTOM_RESOURCE_RESPONSE_PREFIX as ti, readConfigString as tn, DependencyError as to, refuseMalformedOrphansForDestroy as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, warnDeprecatedNoPrefixCliFlag as ua, isReadableBag as ui, withSharedDrainBudget as un, PartialFailureError as uo, refuseMalformedState as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, injectiveKey as va, createAssetRedirectResolver as vi, applyCallerIdentityCredentials as vn, formatError as vo, safeStackName as vr, CloudControlProvider as vt, reachableDivergentParameters as w, PARTITION_TABLE as wa, ensureAssetStorage as wi, STATE_RESOURCES_MALFORMED as wn, isMarkedNonRetryable as wo, withRetry as wr, packCompositeId as wt, bindingSkippedOutputs as x, producerRecordKey as xa, AssetModeResolver as xi, DiffCalculator as xn, withErrorHandling as xo, findActionableSilentDrops as xr, compositeIdFormatMessage as xt, keptWholeReasonText as y, injectiveKeyPrefix as ya, loadPublishableAssetManifest as yi, callerEnvCredentials as yn, isCdkdError as yo, unpreviewableOrphanRecords as yr, slowCcOperationTimeoutMs as yt, isStatefulRecreateTargetForReplace as z, ownValue as za, formatDockerLoginError as zi, malformedOrphanRowsKeptWarning as zn, maskSecretsInError as zr, getAccountInfo as zt };
-//# sourceMappingURL=deploy-engine-JdJuqXID.js.map
+export { yellow as $, CdkdError as $a, synthesisStatusMessage as $i, refuseMalformedOrphanRecordsForDestroy as $n, forceQuitRecoveryClause as $r, configIntegerRefusal as $t, createPreDeleteFinalSnapshot as A, credentialFingerprint as Aa, validateContainerRepoName as Ai, hasReadableOutputs as An, markRedactedCause as Ao, TEMPLATE_SOURCED_RULES as Ar, deleteSkipReason as At, isStatefulRecreateTargetSync as B, absoluteAssemblyPathEscape as Ba, getDockerCmd as Bi, malformedOrphansRefusalMessage as Bn, maskSecretsInText as Br, isImpossibleEmptyStoredAttribute as Bt, namesAnyDeclaredParameter as C, expectedOwnerParam as Ca, assertAssetBucketRegion as Ci, STATE_REGION_DIVERGED as Cn, pasteableCommand as Co, describeTypeWithThrottleRetry as Cr, compositeIdSkipResult as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, ambientClientDefaults as Da, parseBootstrapMarker as Di, deployRefusesOrphanRowsReason as Dn, isThrottlingError as Do, STATE_SOURCED_BASELINE_RULES as Dr, maskerOrIdentity as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, derivePartitionAndUrlSuffix as Ea, isCrossRegionRedirect as Ei, UNREADABLE_RESOURCES_MAP_ROW as En, isRetryableTransientError as Eo, TemplateParser as Er, maskDeep as Et, extractDeploymentEventError as F, defineOwnKey as Fa, describeDockerExecFailure as Fi, malformedExportSourceWarning as Fn, identityKeyFor as Fr, carriesDynamicReference as Ft, toCfnInteger as G, clearBucketRegionCache as Ga, runDockerForeground as Gi, malformedResourceEntriesWarning as Gn, redactSecretsForState as Gr, isSettledInstanceState as Gt, WARM_THROUGHPUT_MEMBERS as H, displayAssemblyPath as Ha, isMalformedEnvKey as Hi, malformedOutputsRefusalMessage as Hn, recordMaskOnlyValue as Hr, isUnboundTemplateParameter as Ht, makeSiblingClaimReader as I, hasOwnKey as Ia, describeDockerFailure as Ii, malformedLocalOutputsWarning as In, isSingleDynamicReferenceToken as Ir, carriesFetchableDynamicReference as It, bold as J, getAwsClients as Ja, escapeRegExp$1 as Ji, malformedStateRefusalMessage as Jn, S3StateBackend as Jr, resolveExplicitPhysicalId as Jt, toFiniteNumber as K, resolveBucketRegion as Ka, runDockerStreaming as Ki, malformedResourcePropertiesWarning as Kn, scrubResourceRecord as Kr, WAFv2WebACLProvider as Kt, planOrphanAdoption as L, hasPlainPrototype$1 as La, dockerSpawnEnvWithSensitive as Li, malformedOrphanRecordsRefusalMessage as Ln, isUncertifiedBaselineMaskPosition as Lr, cfnRefValueFromPhysicalId as Lt, refusesFinalSnapshot as M, failedStageNote as Ma, buildDockerImage as Mi, isReadableOrphanRecord as Mn, describeAwsFailure as Mo, createSecretMasker as Mr, disableInstanceApiTermination as Mt, unsupportedFinalSnapshotError as N, globMatches as Na, resolveDockerContextDirectory as Ni, isReadableResourceEntry as Nn, safeStringify$1 as No, dynamicReferenceTokens as Nr, isTerminationProtectionPropagationError as Nt, buildFinalSnapshotIdentifier as O, ambientCredentialConfig as Oa, readBootstrapMarkerBody as Oi, displayLogicalId as On, isTransientServerError as Oo, STATE_SOURCED_CROSS_GENERATION_RULES as Or, UNSPECIFIED_SKIP_REASON as Ot, makeCanonicalizePropertiesFn as P, processStackMessages as Pa, describeDockerCapturedOutput as Pi, malformedExportNamesWarning as Pn, __exportAll as Po, errorCauseChain as Pr, IntrinsicFunctionResolver as Pt, red as Q, AssetError as Qa, Synthesizer as Qi, refuseMalformedOrphanRecords as Qn, buildLockContentionMessage as Qr, configBooleanRefusal as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, nullPrototypeRecord as Ra, finchSecretArgvRefusal as Ri, malformedOrphanRecordsWarning as Rn, markSameGenerationBag as Rr, coerceParameterTypedValue as Rt, computeParameterTaint as S, decodeListingKey as Sa, BOOTSTRAP_MARKER_PREFIX as Si, INTRINSIC_KEYS as Sn, withErrorHandling as So, findSilentDropProperties as Sr, compositeIdSeparatorRefusal as St, resourcesNamingDeclaredParameter as T, canonicalizeRegion as Ta, getBootstrapMarkerKey as Ti, UNREADABLE_ORPHANS_CONTAINER_ROW as Tn, isMarkedNonRetryable as To, DagBuilder as Tr, createMaskedRetryLogger as Tt, coerceWarmThroughput as U, renderAssemblyPathEscape as Ua, partitionSensitiveEnv as Ui, malformedOutputsWarning as Un, recordMaskOnlyValuesIn as Ur, parameterTypeMayLoseSecretIdentity as Ut, renderStatefulReason as V, describeFileReadFailure as Va, isDockerClientEnvKey as Vi, malformedOrphansWarning as Vn, pathCrossesDottedKey as Vr, isNamelessDynamicReferenceError as Vt, isWarmThroughputDecrease as W, resolveAssemblyPath as Wa, redactDockerArgvValues as Wi, malformedRenderedContainersWarning as Wn, recoverMaskedOutput as Wr, refStateLookupFromResource as Wt, gray as X, runWithStackAwsClients as Xa, AssetManifestLoader as Xi, refuseDivergentRecordRegionForDestroy as Xn, UNREPRODUCIBLE_LOCK_CLAUSE as Xr, coerceCfnBoolean as Xt, cyan as Y, resetAwsClients as Ya, stripControlChars as Yi, previewableOrphanRecords as Yn, rebuildClientForBucketRegion as Yr, assertRegionMatch as Yt, green as Z, setAwsClients as Za, getDockerImageBySourceHash as Zi, refuseMalformedNestedChildOutputs as Zn, buildForceUnlockCommand as Zr, coerceCfnInteger as Zt, bagHoldsSecretExpression as _, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as _a, buildAssetRedirectMap as _i, AWS_CREDENTIAL_ENV_KEYS as _n, StateError as _o, safeRegion as _r, startInterruptWatch as _t, DeploymentEventsStore as a, resolveSkipPrefix as aa, hasReadableExportSet as ai, requireConfigString as an, IntrinsicResolutionRefusalError as ao, refuseMalformedResourceAttributesForOrphan as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, producerCoordinateKey as ba, rewriteTemplateAssetReferences as bi, envCredentialsAreAssumedRole as bn, isCdkdError as bo, unreadableOrphanRecords as br, ccProtectionRegistryTypes as bt, replayFailedOperations as c, resolveUseCdkBootstrapAssets as ca, importableOutputKeys as ci, classifyReplaySecretRegion as cn, LockError as co, refuseMalformedResourcePropertiesForOrphan as cr, IAMRoleProvider as ct, updatePartialMessage as d, ssmResolvedValueType as da, orphansAfterRollback as di, s3BucketArn as dn, PartialFailureError as do, repairMalformedOrphanRecordsForReadOnly as dr, ProviderRegistry as dt, getDefaultStateBucketName as ea, formatLockExpiry as ei, configStringRefusal as en, ConfigError as eo, refuseMalformedOrphans as er, collectDeclaredOutputNames as et, updatePartialReason as f, CFN_TEMPLATE_BODY_LIMIT as fa, orphansCarriedFrom as fi, s3BucketDomainName as fn, ProvisioningError as fo, repairMalformedOrphansForReadOnly as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, uploadCfnTemplate as ga, WorkGraph as gi, applyRoleArnIfSet as gn, StackTerminationProtectionError as go, repairMalformedResourcesForReadOnly as gr, isInterruptedWaitError as gt, IMPLICIT_DELETE_DEPENDENCIES as h, findLargeInlineResources as ha, stringifyValue as hi, s3BucketWebsiteUrl as hn, StackHasActiveImportsError as ho, repairMalformedResourcePropertiesForReadOnly as hr, interruptWatchListenerCount as ht, DeploymentEventsReader as i, resolveCaptureObservedState as ia, exportNamesCarriedFrom as ii, requireConfigObject as in, DynamicReferenceRegionAmbiguousError as io, refuseMalformedOutputsForDestroy as ir, secretBearing as it, isFinalSnapshotError as j, AssemblyReader as ja, buildDenyExternalAccessPolicy as ji, hasReadableResources as jn, retryClassificationText as jo, carriesSecretMask as jr, isWaitAbandonedError as jt, ccRoutedFinalSnapshotError as k, clientDefaultsFor as ka, validateAssetBucketName as ki, hasReadableOrphans as kn, markNonRetryable as ko, STATE_SOURCED_READBACK_RULES as kr, deleteIndeterminateGuards as kt, replayRollback as l, stateBucketExistenceConfirmed as la, importableOutputs as li, producerRegionsFromState as ln, MalformedProducerRecordRefusalError as lo, refuseMalformedResourcesForDestroy as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, MIGRATE_TMP_PREFIX as ma, AssetPublisher as mi, s3BucketRegionalDomainName as mn, ResourceUpdateNotSupportedError as mo, repairMalformedResourceEntriesForReadOnly as mr, endCommandInterruptScope as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveApp as na, DEFAULT_STATE_PREFIX as ni, replayWarn as nn, DependencyError as no, refuseMalformedOrphansForOrphan as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, resolveStateBucketWithDefault as oa, hasReasonlessBaselineRefusal as oi, definedAttributes as on, LocalInvokeBuildError as oo, refuseMalformedResourceEntries as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, CFN_TEMPLATE_URL_LIMIT as pa, shouldRetainResource as pi, s3BucketDualStackDomainName as pn, ResourceTimeoutError as po, repairMalformedOutputsForReadOnly as pr, beginCommandInterruptScope as pt, formatResourceLine as q, AwsClients as qa, warnFinchArgvExposure as qi, malformedResourcesWarning as qn, LockManager as qr, normalizeAwsTagsToCfn as qt, DeployEngine as r, resolveAutoAssetStorage as ra, describeRegionValueKind as ri, requireConfigArray as rn, DeployCancelledError as ro, refuseMalformedOutputs as rr, isExportAliasCollision as rt, planRollback as s, resolveStateBucketWithDefaultAndSource as sa, hasUnverifiableParameterRefusal as si, stringifyIfAssigned as sn, LocalStartServiceError as so, refuseMalformedResourceEntriesForOrphan as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, getLegacyStateBucketName as ta, CUSTOM_RESOURCE_RESPONSE_PREFIX as ti, readConfigString as tn, CrossAccountSecretRefusalError as to, refuseMalformedOrphansForDestroy as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, warnDeprecatedNoPrefixCliFlag as ua, isReadableBag as ui, withSharedDrainBudget as un, NestedStackChildDirectDestroyError as uo, refuseMalformedState as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, injectiveKey as va, createAssetRedirectResolver as vi, applyCallerIdentityCredentials as vn, SynthesisError as vo, safeStackName as vr, CloudControlProvider as vt, reachableDivergentParameters as w, PARTITION_TABLE as wa, ensureAssetStorage as wi, STATE_RESOURCES_MALFORMED as wn, shellQuote as wo, withRetry as wr, packCompositeId as wt, bindingSkippedOutputs as x, producerRecordKey as xa, AssetModeResolver as xi, DiffCalculator as xn, normalizeAwsError as xo, findActionableSilentDrops as xr, compositeIdFormatMessage as xt, keptWholeReasonText as y, injectiveKeyPrefix as ya, loadPublishableAssetManifest as yi, callerEnvCredentials as yn, formatError as yo, unpreviewableOrphanRecords as yr, slowCcOperationTimeoutMs as yt, isStatefulRecreateTargetForReplace as z, ownValue as za, formatDockerLoginError as zi, malformedOrphanRowsKeptWarning as zn, maskSecretsInError as zr, getAccountInfo as zt };
+//# sourceMappingURL=deploy-engine-BZps_IKn.js.map