@go-to-k/cdkd 0.291.27 → 0.291.28

package/dist/{deploy-engine-DIZztJy5.js → deploy-engine-CidtgaFr.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as isPasteableIdent, E as displayStackName, O as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-Bt0RGDfb.js";
 import { a as setAssumedRoleCredentials, c as currentStackAwsScope, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-qSDe1fA_.js";
-import { t as getCdkdVersion } from "./version-CuKFdkKV.js";
+import { t as getCdkdVersion } from "./version-CyFoAN6V.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1314,8 +1314,8 @@ function isUpdateUnsupportedError(error, logicalId) {
 * EXISTS — `scripts/check-pasteable-command-shapes.ts`, whose unit test is its
 * enforcement. A list of what is not yet covered goes stale the moment
 * something is, so derive it rather than reading it: the fence reports the
-* shapes, and its `EXEMPTIONS` name the sites deliberately left for a
-* follow-up PR.
+* shapes, and its `EXEMPTIONS` (empty today) name any site deliberately left
+* for a follow-up PR.
 */
 /**
 * Quote a value for a pasteable shell command.
@@ -1349,6 +1349,28 @@ function commandHole(name) {
 	return `'<${name}>'`;
 }
 /**
+* An identifier for the PROSE of a message that also carries a labelled
+* pasteable line: the value itself when `isPasteableIdent` admits it,
+* otherwise a description. A value with a newline, or with padding that wraps
+* on screen, could otherwise spell a counterfeit labelled row beside the real
+* one — the rule `.claude/rules/state-malformed-containers.md` states for
+* naming a target beside a labelled line (go-to-k/cdkd#3328,
+* go-to-k/cdkd#3759).
+*/
+function plainOrDescribed(value, what) {
+	return isPasteableIdent(value) ? value : `a ${what} that is not a plain identifier`;
+}
+/**
+* {@link plainOrDescribed} for a sentence that quotes the name: `'value'` when
+* `isPasteableIdent` admits it, otherwise the same description UNQUOTED, so the
+* prose never reads `'a stack name that is not a plain identifier'` as if that
+* were the name. A plain name's spelling is byte-identical to the literal
+* `'${value}'` it replaces, which `docs/design/459-nested-stacks.md` quotes.
+*/
+function quotedOrDescribed(value, what) {
+	return isPasteableIdent(value) ? `'${value}'` : plainOrDescribed(value, what);
+}
+/**
 * WHY a value must become a hole, or `undefined` when it may be NAMED.
 *
 * FIRST MATCH WINS, in the order written: `empty`, `altered`, `too-long`,
@@ -1466,7 +1488,7 @@ function pasteableCommand(verb, args = [], extraFlags = []) {
 * right thing, and substituting one arm's text for another's is exactly the
 * disagreement M11 closed.
 */
-function withheldTargetClause(built, hole, verb) {
+function withheldTargetClause(built, hole, verb, subject = "This record's name") {
 	const reason = built.withheld.find((w) => w.hole === hole)?.reason;
 	if (reason === void 0) return "";
 	let why;
@@ -1491,7 +1513,7 @@ function withheldTargetClause(built, hole, verb) {
 			break;
 		default: throw new Error(`withheldTargetClause: unhandled WithholdReason ${String(reason)}`);
 	}
-	return ` This record's name ${why} — so it is not named in the command below; list the records as stored with 'cdkd state list --long' and act on the one whose key matches.`;
+	return ` ${subject} ${why} — so it is not named in the command below; list the records as stored with 'cdkd state list --long' and act on the one whose key matches.`;
 }
 
 //#endregion
@@ -2007,11 +2029,15 @@ var ResourceUpdateNotSupportedError = class ResourceUpdateNotSupportedError exte
 var StackTerminationProtectionError = class StackTerminationProtectionError extends CdkdError {
 	stackName;
 	constructor(stackName, cause) {
-		super(`Stack '${stackName}' has terminationProtection: true and cannot be destroyed. Set terminationProtection: false in the CDK code, redeploy, then retry the destroy.\nRetry with: ${pasteableCommand("cdkd destroy", [{
+		const retry = pasteableCommand("cdkd destroy", [{
 			value: stackName,
 			hole: "stack",
-			opts: { patternMatched: true }
-		}]).command}`, "STACK_TERMINATION_PROTECTION", cause);
+			opts: {
+				patternMatched: true,
+				plainIdent: true
+			}
+		}]);
+		super(`Stack ${quotedOrDescribed(stackName, "stack name")} has terminationProtection: true and cannot be destroyed. Set terminationProtection: false in the CDK code, redeploy, then retry the destroy.` + withheldTargetClause(retry, "stack", "cdkd destroy", "This stack's name") + `\nRetry with: ${retry.command}`, "STACK_TERMINATION_PROTECTION", cause);
 		this.stackName = stackName;
 		this.name = "StackTerminationProtectionError";
 		Object.setPrototypeOf(this, StackTerminationProtectionError.prototype);
@@ -2056,17 +2082,24 @@ var NestedStackChildDirectDestroyError = class NestedStackChildDirectDestroyErro
 	parentStack;
 	parentLogicalId;
 	constructor(stackName, parentStack, parentLogicalId, cause) {
-		const logicalIdSuffix = parentLogicalId ? ` (parent's logical id: ${parentLogicalId})` : "";
-		const cascadeCommand = pasteableCommand("cdkd destroy", [{
+		const logicalIdSuffix = parentLogicalId ? ` (parent's logical id: ${plainOrDescribed(parentLogicalId, "logical id")})` : "";
+		const cascade = pasteableCommand("cdkd destroy", [{
 			value: parentStack,
 			hole: "parent",
-			opts: { patternMatched: true }
-		}]).command;
-		const childDestroyCommand = pasteableCommand("cdkd state destroy", [{
+			opts: {
+				patternMatched: true,
+				plainIdent: true
+			}
+		}]);
+		const childDestroy = pasteableCommand("cdkd state destroy", [{
 			value: stackName,
-			hole: "stack"
-		}]).command;
-		super(`Stack '${stackName}' is a nested child of '${parentStack}'${logicalIdSuffix}; directly destroying a nested stack is not supported. Either cascade-delete this child along with its parent, or destroy the child on its own — which deletes its AWS resources and its record, and leaves the parent's reference dangling (the synth-free escape hatch).\nCascade-delete with: ${cascadeCommand}\nDestroy the child alone with: ${childDestroyCommand}`, "NESTED_STACK_CHILD_DIRECT_DESTROY", cause);
+			hole: "stack",
+			opts: { plainIdent: true }
+		}]);
+		const withheld = withheldTargetClause(cascade, "parent", "cdkd destroy", "The parent stack's name") + withheldTargetClause(childDestroy, "stack", "cdkd state destroy", "The child stack's name");
+		const child = quotedOrDescribed(stackName, "stack name");
+		const parent = quotedOrDescribed(parentStack, "stack name");
+		super(`Stack ${child} is a nested child of ${parent}${logicalIdSuffix}; directly destroying a nested stack is not supported. Either cascade-delete this child along with its parent, or destroy the child on its own — which deletes its AWS resources and its record, and leaves the parent's reference dangling (the synth-free escape hatch).${withheld}\nCascade-delete with: ${cascade.command}\nDestroy the child alone with: ${childDestroy.command}`, "NESTED_STACK_CHILD_DIRECT_DESTROY", cause);
 		this.stackName = stackName;
 		this.parentStack = parentStack;
 		if (parentLogicalId !== void 0) this.parentLogicalId = parentLogicalId;
@@ -14978,7 +15011,13 @@ function recordedExpressionsOf(secrets) {
 * go-to-k/cdkd#3691: the writer's `credentialFingerprint`, which every reader
 * computes the same way from the clients it resolves with), written at the
 * moment the producer's outputs are redacted and read at the three cross-stack
-* sites above. It answers only for a producer
+* sites above. The fingerprint covers only an EXPLICIT `profile` /
+* `accessKeyId`: a library caller that switches accounts through the
+* process-wide environment or default credential chain (e.g. `AWS_PROFILE`,
+* `AWS_ACCESS_KEY_ID`, the shared config file, web identity) with clients
+* carrying neither shares one identity key across those accounts — the same
+* boundary as the resolver's value caches (go-to-k/cdkd#3692). It answers
+* only for a producer
 * THIS PROCESS deployed in THIS run, which is exactly the population that has a
 * plaintext to hand back: a separate `cdkd deploy` of the consumer has none, and
 * that case is refused rather than guessed at.
@@ -20522,6 +20561,98 @@ async function withRetry(operation, logicalId, opts = {}) {
 	throw lastError;
 }
 
+//#endregion
+//#region src/utils/concurrency-limiter.ts
+/** The rejection of a background task withdrawn by `cancel()`. */
+var BackgroundTaskCancelledError = class extends Error {
+	constructor() {
+		super("Background task cancelled");
+		this.name = "BackgroundTaskCancelledError";
+	}
+};
+function createConcurrencyLimiter(limit) {
+	if (!Number.isInteger(limit) || limit < 1) throw new Error(`Concurrency limit must be a positive integer, got ${String(limit)}`);
+	let active = 0;
+	const queue = [];
+	const insert = (entry) => {
+		if (!entry.urgent) {
+			queue.push(entry);
+			return;
+		}
+		const firstBackground = queue.findIndex((e) => !e.urgent);
+		if (firstBackground === -1) queue.push(entry);
+		else queue.splice(firstBackground, 0, entry);
+	};
+	const drain = () => {
+		while (active < limit && queue.length > 0) queue.shift().start();
+	};
+	return {
+		schedule(task, options) {
+			let resolveTask;
+			let rejectTask;
+			const promise = new Promise((resolve, reject) => {
+				resolveTask = resolve;
+				rejectTask = reject;
+			});
+			const controller = new AbortController();
+			let settled = false;
+			let released = false;
+			const release = () => {
+				if (released) return;
+				released = true;
+				active--;
+				drain();
+			};
+			const entry = {
+				urgent: options?.background !== true,
+				start: () => {
+					active++;
+					Promise.resolve().then(() => task(controller.signal)).then((value) => {
+						if (settled) return;
+						settled = true;
+						resolveTask(value);
+					}, (error) => {
+						if (settled) return;
+						settled = true;
+						rejectTask(error);
+					}).finally(release);
+				}
+			};
+			insert(entry);
+			drain();
+			return {
+				promise,
+				promote: () => {
+					if (entry.urgent) return;
+					entry.urgent = true;
+					const index = queue.indexOf(entry);
+					if (index === -1) return;
+					queue.splice(index, 1);
+					insert(entry);
+				},
+				cancel: () => {
+					if (entry.urgent || settled) return false;
+					settled = true;
+					const index = queue.indexOf(entry);
+					if (index !== -1) queue.splice(index, 1);
+					else {
+						controller.abort();
+						release();
+					}
+					rejectTask(new BackgroundTaskCancelledError());
+					return true;
+				}
+			};
+		},
+		get activeCount() {
+			return active;
+		},
+		get pendingCount() {
+			return queue.length;
+		}
+	};
+}
+
 //#endregion
 //#region src/provisioning/describe-type.ts
 /**
@@ -20558,6 +20689,33 @@ const describeTypeRetryDelays = {};
 */
 const MAX_THROTTLE_RETRIES = 4;
 /**
+* Most `DescribeType` calls in flight at once, process-wide (issue #3718).
+*
+* The quota behaves as a RATE limit, not a concurrency one: measured in
+* us-east-1, a 30-call burst after idle drew no throttle, but 134 calls drew
+* throttles at 134 in parallel (45-61 across runs), at 20 (95) and even one at
+* a time (73).
+* So no cap makes a 134-type prefetch throttle-free. What the cap buys is
+* ordering: with at most 20 in flight, an awaited lookup (URGENT) is sent
+* ahead of queued prefetches instead of joining the back of an unbounded
+* burst — at the cost of up to one round trip (~0.2 s) for an awaited lookup
+* that arrives while the first 20 background calls hold every slot. Measured
+* on the same 134 types, the 5 lookups a diff awaited 300 ms
+* after the prefetch started took 18 s before and 0.65-0.8 s with the cap, and
+* lookups that exhausted their retries fell from 86-94 to 9-23. The price is a
+* longer tail for the prefetch as a whole (35 s -> 53-63 s), which nothing
+* waits on and which its owner cancels once done. 20 keeps enough calls
+* overlapped to spend the burst quickly.
+*/
+const DESCRIBE_TYPE_MAX_IN_FLIGHT = 20;
+/**
+* ONE limiter for every DescribeType-backed resolver, since the throttle is
+* per account rather than per caller. A slot is held across the throttle
+* retries too: a throttled call backing off is exactly the moment to send
+* fewer, not more.
+*/
+const describeTypeLimiter = createConcurrencyLimiter(20);
+/**
 * Issue `DescribeType` for a resource type, retrying throttle-shaped failures
 * with exponential backoff. Any other failure (or a throttle persisting past
 * the retry budget) is thrown to the caller unchanged.
@@ -20565,16 +20723,70 @@ const MAX_THROTTLE_RETRIES = 4;
 * `client` defaults to the shared `AwsClients.cloudFormation`; callers that
 * carry their own injected client (`cdkd export`'s primary-identifier
 * resolution) pass it so test doubles keep intercepting.
+*
+* The call waits for a slot of the shared limiter
+* ({@link DESCRIBE_TYPE_MAX_IN_FLIGHT}) as an URGENT task, ahead of any queued
+* prefetch.
 */
 function describeTypeWithThrottleRetry(resourceType, client) {
-	return withRetry(() => (client ?? getAwsClients().cloudFormation).send(new DescribeTypeCommand({
-		Type: "RESOURCE",
-		TypeName: resourceType
-	})), resourceType, {
+	return scheduleDescribeType(resourceType, { ...client && { client } }).promise;
+}
+/**
+* {@link describeTypeWithThrottleRetry} with the scheduling handle exposed:
+* `background: true` queues the call behind every urgent one (a speculative
+* prefetch), `promote()` makes it urgent once a caller starts awaiting that
+* type, and `cancel()` withdraws it while it is still background.
+*
+* A BACKGROUND call must never hold the process open: its request carries the
+* task's `AbortSignal`, and its throttle backoff sleeps on an UNREF'd timer
+* that the same signal cuts short, so a cancelled prefetch settles at once and
+* an uncancelled one keeps a finished command alive no longer than one
+* in-flight round trip. An urgent call is sent exactly as before, its backoff
+* on a REF'd timer: the command is waiting on it.
+*/
+function scheduleDescribeType(resourceType, options = {}) {
+	const { client, background } = options;
+	let cfn;
+	let clientError;
+	try {
+		cfn = client ?? getAwsClients().cloudFormation;
+	} catch (error) {
+		clientError = error;
+	}
+	return describeTypeLimiter.schedule((signal) => withRetry(() => {
+		if (cfn === void 0) throw clientError;
+		const command = new DescribeTypeCommand({
+			Type: "RESOURCE",
+			TypeName: resourceType
+		});
+		return background ? cfn.send(command, { abortSignal: signal }) : cfn.send(command);
+	}, resourceType, {
 		maxRetries: MAX_THROTTLE_RETRIES,
-		isRetryable: (_message, error) => isThrottlingError(error),
+		isRetryable: (_message, error) => !signal.aborted && isThrottlingError(error),
 		logger: getLogger().child("DescribeType"),
-		...describeTypeRetryDelays.sleep ? { sleep: describeTypeRetryDelays.sleep } : {}
+		...describeTypeRetryDelays.sleep ? { sleep: describeTypeRetryDelays.sleep } : background ? { sleep: (ms) => backgroundSleep(ms, signal) } : {}
+	}), { background: background === true });
+}
+/**
+* The backoff sleep of a BACKGROUND call: an unref'd timer, so a pending
+* retry never keeps the event loop alive, rejected at once by `signal`.
+*/
+function backgroundSleep(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal.aborted) {
+			reject(/* @__PURE__ */ new Error("DescribeType prefetch cancelled"));
+			return;
+		}
+		const timer = setTimeout(() => {
+			signal.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		timer.unref?.();
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(/* @__PURE__ */ new Error("DescribeType prefetch cancelled"));
+		};
+		signal.addEventListener("abort", onAbort, { once: true });
 	});
 }
 /**
@@ -20603,39 +20815,565 @@ function hasNoRegistrySchema(resourceType) {
 }
 
 //#endregion
-//#region src/provisioning/create-only-properties.ts
+//#region src/provisioning/create-only-paths.ts
 /**
-* Create-only (immutable) property resolution for replacement detection.
-*
-* CloudFormation marks some properties "Update requires: Replacement" — the
-* resource type's registry schema lists them under `createOnlyProperties`.
-* Changing such a property cannot be an in-place UPDATE; CloudFormation
-* transparently DELETE+CREATEs the resource. cdkd's diff classifier
-* (`ReplacementRulesRegistry`) only knows the ~25 types with a hand-authored
-* rule, so for every other type an immutable-property change was previously
-* mis-classified as an in-place UPDATE (the provider's `update()` then either
-* rejected it with a typed error — at best — or silently dropped it).
-*
-* This module resolves each resource type's `createOnlyProperties` from the
-* CloudFormation registry schema via `cloudformation:DescribeType`, reduced to
-* the TOP-LEVEL containing property names (a nested path like
-* `/properties/Foo/Bar` strips to `Foo`) so the diff's top-level property keys
-* match. The diff calculator consults it as a fallback for any property the
-* registry does not explicitly classify, so a createOnly change on ANY type now
-* correctly drives a replacement.
-*
-* Caching / failure semantics are identical to {@link
-* ./write-only-properties.ts} (the sibling DescribeType-backed resolver): only
-* SUCCESSFUL lookups are cached per resource type for the process (deploy)
-* lifetime — `cloudformation:DescribeType` is throttled per-account and the
-* schema cannot change mid-deploy. A FAILED lookup (missing IAM permission,
-* transient throttle / 5xx) is logged as a warning and resolves to an empty set
-* WITHOUT poisoning the cache, so the caller gracefully falls back to the
-* registry-only classification for THIS resource while a later resource of the
-* same type retries. A caller permanently without `cloudformation:DescribeType`
-* simply keeps the pre-existing registry-only behavior — no regression.
+* The ONE parse of a registry schema's `createOnlyProperties` JSON pointers
+* into property paths (issue #3718).
+*
+* Shared by the live resolver (`create-only-properties.ts`, parsing a
+* `DescribeType` schema) and the fixture producer
+* (`scripts/refresh-cfn-schemas.mjs`, whose output is shipped as the offline
+* fallback). A second spelling would let the fallback disagree with the live
+* answer for the same schema. An import-free LEAF, so the `.mjs` producer can
+* load it under Node's type stripping.
 */
 /**
+* Parse `createOnlyProperties` into segment arrays after `/properties/` (e.g.
+* `['Name']`, `['SourceParameters', 'KinesisStreamParameters',
+* 'StartingPosition']`), in schema order.
+*
+* Full paths, not top-level reductions: the diff compares at the schema's own
+* granularity (issue #960). A non-array input or a non-string / non-
+* `/properties/` entry is skipped. Empty segments are dropped: a trailing slash
+* degrades to the (more conservative) whole-property path, and no real
+* registry schema names a property literally "" via an RFC 6901 empty segment.
+*/
+function parseCreateOnlyPropertyPointers(createOnly) {
+	const result = [];
+	if (!Array.isArray(createOnly)) return result;
+	for (const path of createOnly) {
+		if (typeof path !== "string") continue;
+		if (!path.startsWith("/properties/")) continue;
+		const segments = path.slice(12).split("/").map(unescapeJsonPointerSegment$2).filter((segment) => segment.length > 0);
+		if (segments.length > 0) result.push(segments);
+	}
+	return result;
+}
+/**
+* Unescape an RFC 6901 JSON Pointer segment (`~1` -> `/`, `~0` -> `~`).
+*/
+function unescapeJsonPointerSegment$2(segment) {
+	return segment.replace(/~1/g, "/").replace(/~0/g, "~");
+}
+
+//#endregion
+//#region src/provisioning/create-only-snapshot.generated.ts
+/**
+* AUTO-GENERATED by scripts/gen-property-coverage.ts — DO NOT EDIT BY HAND.
+* Source: the `createOnlyPropertyPaths` of tests/fixtures/cfn-schemas/*.json.
+* Regenerate: `vp run gen:property-coverage`.
+*
+* cdkd's committed snapshot of each type's create-only property PATHS
+* (segment arrays after `/properties/`). `getCreateOnlyPropertyPaths`
+* resolves it ONLY when the live `cloudformation:DescribeType` lookup fails
+* (issue #3718): the live schema always wins when it can be read.
+*/
+const CREATE_ONLY_PATHS_SNAPSHOT = /* @__PURE__ */ new Map([
+	["AWS::ApiGateway::Account", []],
+	["AWS::ApiGateway::Authorizer", [["RestApiId"]]],
+	["AWS::ApiGateway::Deployment", [["DeploymentCanarySettings"], ["RestApiId"]]],
+	["AWS::ApiGateway::Method", [
+		["HttpMethod"],
+		["ResourceId"],
+		["RestApiId"]
+	]],
+	["AWS::ApiGateway::Resource", [
+		["ParentId"],
+		["PathPart"],
+		["RestApiId"]
+	]],
+	["AWS::ApiGateway::Stage", [["RestApiId"], ["StageName"]]],
+	["AWS::ApiGatewayV2::Api", [["ProtocolType"]]],
+	["AWS::ApiGatewayV2::Authorizer", [["ApiId"]]],
+	["AWS::ApiGatewayV2::Integration", [["ApiId"]]],
+	["AWS::ApiGatewayV2::Route", [["ApiId"]]],
+	["AWS::ApiGatewayV2::Stage", [["ApiId"], ["StageName"]]],
+	["AWS::AppSync::ApiKey", [["ApiId"]]],
+	["AWS::AppSync::DataSource", [["ApiId"], ["Name"]]],
+	["AWS::AppSync::GraphQLApi", []],
+	["AWS::AppSync::GraphQLSchema", [["ApiId"]]],
+	["AWS::AppSync::Resolver", [
+		["ApiId"],
+		["FieldName"],
+		["TypeName"]
+	]],
+	["AWS::AutoScaling::AutoScalingGroup", [["AutoScalingGroupName"], ["InstanceId"]]],
+	["AWS::BedrockAgentCore::Browser", []],
+	["AWS::BedrockAgentCore::CodeInterpreter", []],
+	["AWS::BedrockAgentCore::Evaluator", [["EvaluatorName"]]],
+	["AWS::BedrockAgentCore::Runtime", [["AgentRuntimeName"]]],
+	["AWS::Budgets::Budget", [["NotificationsWithSubscribers"]]],
+	["AWS::CertificateManager::Certificate", [
+		["CertificateAuthorityArn"],
+		["CertificateExport"],
+		["DomainName"],
+		["DomainValidationOptions"],
+		["KeyAlgorithm"],
+		["SubjectAlternativeNames"]
+	]],
+	["AWS::CloudFormation::Stack", [["StackName"]]],
+	["AWS::CloudFormation::WaitConditionHandle", []],
+	["AWS::CloudFront::CloudFrontOriginAccessIdentity", []],
+	["AWS::CloudFront::Distribution", []],
+	["AWS::CloudFront::OriginAccessControl", []],
+	["AWS::CloudTrail::Trail", [["TrailName"]]],
+	["AWS::CloudWatch::Alarm", [["AlarmName"]]],
+	["AWS::CloudWatch::AnomalyDetector", [
+		["Dimensions"],
+		["MetricCharacteristics"],
+		["MetricMathAnomalyDetector"],
+		["MetricName"],
+		["Namespace"],
+		["SingleMetricAnomalyDetector"],
+		["Stat"]
+	]],
+	["AWS::CodeBuild::Project", [["Name"]]],
+	["AWS::CodeCommit::Repository", []],
+	["AWS::Cognito::UserPool", []],
+	["AWS::DLM::LifecyclePolicy", []],
+	["AWS::DocDB::DBCluster", [
+		["AvailabilityZones"],
+		["DBClusterIdentifier"],
+		["DBSubnetGroupName"],
+		["KmsKeyId"],
+		["MasterUsername"],
+		["SnapshotIdentifier"],
+		["SourceDBClusterIdentifier"],
+		["StorageEncrypted"]
+	]],
+	["AWS::DocDB::DBInstance", [
+		["AvailabilityZone"],
+		["DBClusterIdentifier"],
+		["DBInstanceIdentifier"]
+	]],
+	["AWS::DocDB::DBSubnetGroup", [["DBSubnetGroupName"]]],
+	["AWS::DynamoDB::GlobalTable", [["TableName"]]],
+	["AWS::DynamoDB::Table", [["ImportSourceSpecification"], ["TableName"]]],
+	["AWS::EC2::EIP", [
+		["Address"],
+		["IpamPoolId"],
+		["NetworkBorderGroup"],
+		["TransferAddress"]
+	]],
+	["AWS::EC2::Instance", [
+		["AvailabilityZone"],
+		["CpuOptions"],
+		["ElasticGpuSpecifications"],
+		["ElasticInferenceAccelerators"],
+		["EnclaveOptions"],
+		["HibernationOptions"],
+		["HostResourceGroupArn"],
+		["ImageId"],
+		["Ipv6AddressCount"],
+		["Ipv6Addresses"],
+		["KeyName"],
+		["LaunchTemplate"],
+		["LicenseSpecifications"],
+		["NetworkInterfaces"],
+		["PlacementGroupName"],
+		["PrivateIpAddress"],
+		["SecurityGroups"],
+		["SubnetId"]
+	]],
+	["AWS::EC2::InternetGateway", []],
+	["AWS::EC2::NatGateway", [
+		["AllocationId"],
+		["AvailabilityMode"],
+		["ConnectivityType"],
+		["PrivateIpAddress"],
+		["SubnetId"],
+		["VpcId"]
+	]],
+	["AWS::EC2::NetworkAcl", [["VpcId"]]],
+	["AWS::EC2::NetworkAclEntry", [
+		["Egress"],
+		["NetworkAclId"],
+		["RuleNumber"]
+	]],
+	["AWS::EC2::Route", [
+		["DestinationCidrBlock"],
+		["DestinationIpv6CidrBlock"],
+		["DestinationPrefixListId"],
+		["RouteTableId"]
+	]],
+	["AWS::EC2::RouteTable", [["VpcId"]]],
+	["AWS::EC2::SecurityGroup", [
+		["GroupDescription"],
+		["GroupName"],
+		["VpcId"]
+	]],
+	["AWS::EC2::SecurityGroupIngress", [
+		["CidrIp"],
+		["CidrIpv6"],
+		["FromPort"],
+		["GroupId"],
+		["GroupName"],
+		["IpProtocol"],
+		["SourcePrefixListId"],
+		["SourceSecurityGroupId"],
+		["SourceSecurityGroupName"],
+		["SourceSecurityGroupOwnerId"],
+		["ToPort"]
+	]],
+	["AWS::EC2::Subnet", [
+		["AvailabilityZone"],
+		["AvailabilityZoneId"],
+		["CidrBlock"],
+		["Ipv4IpamPoolId"],
+		["Ipv4NetmaskLength"],
+		["Ipv6IpamPoolId"],
+		["Ipv6Native"],
+		["Ipv6NetmaskLength"],
+		["OutpostArn"],
+		["VpcId"]
+	]],
+	["AWS::EC2::SubnetNetworkAclAssociation", [["NetworkAclId"], ["SubnetId"]]],
+	["AWS::EC2::SubnetRouteTableAssociation", [["RouteTableId"], ["SubnetId"]]],
+	["AWS::EC2::VPC", [
+		["CidrBlock"],
+		["Ipv4IpamPoolId"],
+		["Ipv4NetmaskLength"],
+		["VpcEncryptionControl"]
+	]],
+	["AWS::EC2::VPCGatewayAttachment", [["VpcId"]]],
+	["AWS::ECR::Repository", [
+		["EncryptionConfiguration"],
+		["EncryptionConfiguration", "EncryptionType"],
+		["EncryptionConfiguration", "KmsKey"],
+		["RepositoryName"]
+	]],
+	["AWS::ECS::Cluster", [["ClusterName"]]],
+	["AWS::ECS::Service", [
+		["Cluster"],
+		["Role"],
+		["SchedulingStrategy"],
+		["ServiceName"]
+	]],
+	["AWS::ECS::TaskDefinition", [
+		["ContainerDefinitions"],
+		["Cpu"],
+		["EnableFaultInjection"],
+		["EphemeralStorage"],
+		["ExecutionRoleArn"],
+		["Family"],
+		["InferenceAccelerators"],
+		["IpcMode"],
+		["Memory"],
+		["NetworkMode"],
+		["PidMode"],
+		["PlacementConstraints"],
+		["ProxyConfiguration"],
+		["RequiresCompatibilities"],
+		["RuntimePlatform"],
+		["TaskRoleArn"],
+		["Volumes"]
+	]],
+	["AWS::EFS::AccessPoint", [
+		["ClientToken"],
+		["CreationInfo"],
+		["CreationInfo", "OwnerGid"],
+		["CreationInfo", "OwnerUid"],
+		["CreationInfo", "Permissions"],
+		["FileSystemId"],
+		["PosixUser"],
+		["PosixUser", "Gid"],
+		["PosixUser", "SecondaryGids"],
+		["PosixUser", "Uid"],
+		["RootDirectory"],
+		["RootDirectory", "CreationInfo"],
+		["RootDirectory", "Path"]
+	]],
+	["AWS::EFS::FileSystem", [
+		["AvailabilityZoneName"],
+		["Encrypted"],
+		["KmsKeyId"],
+		["PerformanceMode"]
+	]],
+	["AWS::EFS::MountTarget", [
+		["FileSystemId"],
+		["IpAddress"],
+		["IpAddressType"],
+		["Ipv6Address"],
+		["SubnetId"]
+	]],
+	["AWS::ElastiCache::CacheCluster", [
+		["CacheSubnetGroupName"],
+		["ClusterName"],
+		["Engine"],
+		["NetworkType"],
+		["Port"],
+		["SnapshotArns"],
+		["SnapshotName"]
+	]],
+	["AWS::ElastiCache::SubnetGroup", [["CacheSubnetGroupName"]]],
+	["AWS::ElasticLoadBalancingV2::Listener", [["LoadBalancerArn"]]],
+	["AWS::ElasticLoadBalancingV2::LoadBalancer", [
+		["Name"],
+		["Scheme"],
+		["Type"]
+	]],
+	["AWS::ElasticLoadBalancingV2::TargetGroup", [
+		["IpAddressType"],
+		["Name"],
+		["Port"],
+		["Protocol"],
+		["ProtocolVersion"],
+		["TargetType"],
+		["VpcId"]
+	]],
+	["AWS::EMR::Cluster", [
+		["AdditionalInfo"],
+		["Applications"],
+		["AutoScalingRole"],
+		["BootstrapActions"],
+		["Configurations"],
+		["CustomAmiId"],
+		["EbsRootVolumeIops"],
+		["EbsRootVolumeSize"],
+		["EbsRootVolumeThroughput"],
+		["JobFlowRole"],
+		["KerberosAttributes"],
+		["LogEncryptionKmsKeyId"],
+		["LogUri"],
+		["Name"],
+		["OSReleaseLabel"],
+		["PlacementGroupConfigs"],
+		["ReleaseLabel"],
+		["ScaleDownBehavior"],
+		["SecurityConfiguration"],
+		["ServiceRole"],
+		["Steps"]
+	]],
+	["AWS::EMR::InstanceFleetConfig", [
+		["ClusterId"],
+		["InstanceFleetType"],
+		["LaunchSpecifications"],
+		["Name"]
+	]],
+	["AWS::EMR::InstanceGroupConfig", [
+		["BidPrice"],
+		["Configurations"],
+		["CustomAmiId"],
+		["EbsConfiguration"],
+		["InstanceRole"],
+		["InstanceType"],
+		["JobFlowId"],
+		["Market"],
+		["Name"]
+	]],
+	["AWS::Events::EventBus", [["Name"]]],
+	["AWS::Events::Rule", [["Name"]]],
+	["AWS::FSx::FileSystem", [
+		["BackupId"],
+		["FileSystemType"],
+		["KmsKeyId"],
+		["SecurityGroupIds"],
+		["SubnetIds"]
+	]],
+	["AWS::Glue::Connection", [["CatalogId"], ["ConnectionInput", "Name"]]],
+	["AWS::Glue::Crawler", [["Name"]]],
+	["AWS::Glue::Database", [["DatabaseName"]]],
+	["AWS::Glue::Job", [["Name"]]],
+	["AWS::Glue::SecurityConfiguration", [["Name"]]],
+	["AWS::Glue::Table", [
+		["CatalogId"],
+		["DatabaseName"],
+		["Name"]
+	]],
+	["AWS::Glue::Trigger", [
+		["Name"],
+		["Type"],
+		["WorkflowName"]
+	]],
+	["AWS::Glue::Workflow", [["Name"]]],
+	["AWS::IAM::AccessKey", [["Serial"], ["UserName"]]],
+	["AWS::IAM::Group", [["GroupName"]]],
+	["AWS::IAM::InstanceProfile", [["InstanceProfileName"], ["Path"]]],
+	["AWS::IAM::ManagedPolicy", [
+		["Description"],
+		["ManagedPolicyName"],
+		["Path"]
+	]],
+	["AWS::IAM::Policy", []],
+	["AWS::IAM::Role", [["Path"], ["RoleName"]]],
+	["AWS::IAM::User", [["UserName"]]],
+	["AWS::IAM::UserToGroupAddition", []],
+	["AWS::Kinesis::Stream", [["Name"]]],
+	["AWS::Kinesis::StreamConsumer", [
+		["ConsumerName"],
+		["StreamARN"],
+		["Tags"]
+	]],
+	["AWS::KinesisFirehose::DeliveryStream", [
+		["AmazonOpenSearchServerlessDestinationConfiguration", "VpcConfiguration"],
+		["AmazonopensearchserviceDestinationConfiguration", "VpcConfiguration"],
+		["DatabaseSourceConfiguration"],
+		["DeliveryStreamName"],
+		["DeliveryStreamType"],
+		["DirectPutSourceConfiguration"],
+		["ElasticsearchDestinationConfiguration", "VpcConfiguration"],
+		["IcebergDestinationConfiguration", "CatalogConfiguration"],
+		["KinesisStreamSourceConfiguration"],
+		["MSKSourceConfiguration"],
+		["SnowflakeDestinationConfiguration", "SnowflakeVpcConfiguration"]
+	]],
+	["AWS::KMS::Alias", [["AliasName"]]],
+	["AWS::KMS::Key", []],
+	["AWS::Lambda::EventInvokeConfig", [["FunctionName"], ["Qualifier"]]],
+	["AWS::Lambda::EventSourceMapping", [
+		["EventSourceArn"],
+		["SelfManagedEventSource"],
+		["StartingPosition"],
+		["StartingPositionTimestamp"]
+	]],
+	["AWS::Lambda::Function", [
+		["FunctionName"],
+		["PackageType"],
+		["TenancyConfig"]
+	]],
+	["AWS::Lambda::LayerVersion", [
+		["CompatibleArchitectures"],
+		["CompatibleRuntimes"],
+		["Content"],
+		["Description"],
+		["LayerName"],
+		["LicenseInfo"]
+	]],
+	["AWS::Lambda::MicrovmImage", [["Name"]]],
+	["AWS::Lambda::Permission", [
+		["Action"],
+		["EventSourceToken"],
+		["FunctionName"],
+		["FunctionUrlAuthType"],
+		["InvokedViaFunctionUrl"],
+		["Principal"],
+		["PrincipalOrgID"],
+		["SourceAccount"],
+		["SourceArn"]
+	]],
+	["AWS::Lambda::Url", [["Qualifier"], ["TargetFunctionArn"]]],
+	["AWS::Logs::LogGroup", [["LogGroupName"]]],
+	["AWS::Neptune::DBCluster", [
+		["AvailabilityZones"],
+		["DBClusterIdentifier"],
+		["DBSubnetGroupName"],
+		["GlobalClusterIdentifier"],
+		["KmsKeyId"],
+		["RestoreToTime"],
+		["RestoreType"],
+		["SnapshotIdentifier"],
+		["SourceDBClusterIdentifier"],
+		["StorageEncrypted"],
+		["UseLatestRestorableTime"]
+	]],
+	["AWS::Neptune::DBInstance", [
+		["AvailabilityZone"],
+		["DBClusterIdentifier"],
+		["DBInstanceIdentifier"],
+		["DBSnapshotIdentifier"],
+		["DBSubnetGroupName"]
+	]],
+	["AWS::Neptune::DBSubnetGroup", [["DBSubnetGroupName"]]],
+	["AWS::RDS::DBCluster", [
+		["ClusterScalabilityType"],
+		["DBClusterIdentifier"],
+		["DBSubnetGroupName"],
+		["DBSystemId"],
+		["DatabaseName"],
+		["EngineMode"],
+		["KmsKeyId"],
+		["PubliclyAccessible"],
+		["RestoreToTime"],
+		["RestoreType"],
+		["SnapshotIdentifier"],
+		["SourceDBClusterIdentifier"],
+		["SourceDbClusterResourceId"],
+		["SourceRegion"],
+		["StorageEncrypted"],
+		["UseLatestRestorableTime"]
+	]],
+	["AWS::RDS::DBInstance", [
+		["BackupTarget"],
+		["CharacterSetName"],
+		["CustomIAMInstanceProfile"],
+		["DBClusterIdentifier"],
+		["DBInstanceIdentifier"],
+		["DBName"],
+		["DBSubnetGroupName"],
+		["DBSystemId"],
+		["KmsKeyId"],
+		["MasterUsername"],
+		["NcharCharacterSetName"],
+		["SourceRegion"],
+		["StorageEncrypted"],
+		["Timezone"]
+	]],
+	["AWS::RDS::DBProxy", [
+		["DBProxyName"],
+		["EndpointNetworkType"],
+		["EngineFamily"],
+		["TargetConnectionNetworkType"],
+		["VpcSubnetIds"]
+	]],
+	["AWS::RDS::DBProxyEndpoint", [
+		["DBProxyEndpointName"],
+		["DBProxyName"],
+		["EndpointNetworkType"],
+		["VpcSubnetIds"]
+	]],
+	["AWS::RDS::DBProxyTargetGroup", [["DBProxyName"], ["TargetGroupName"]]],
+	["AWS::RDS::DBSubnetGroup", [["DBSubnetGroupName"]]],
+	["AWS::Route53::HostedZone", [["Name"]]],
+	["AWS::Route53::RecordSet", [["HostedZoneId"], ["HostedZoneName"]]],
+	["AWS::S3::Bucket", [
+		["BucketName"],
+		["BucketNamePrefix"],
+		["BucketNamespace"]
+	]],
+	["AWS::S3::BucketPolicy", [["Bucket"]]],
+	["AWS::S3Express::DirectoryBucket", [
+		["BucketName"],
+		["DataRedundancy"],
+		["LocationName"]
+	]],
+	["AWS::S3Tables::Namespace", [["Namespace"], ["TableBucketARN"]]],
+	["AWS::S3Tables::Table", [
+		["IcebergMetadata"],
+		["OpenTableFormat"],
+		["StorageClassConfiguration"],
+		["TableBucketARN"],
+		["WithoutMetadata"]
+	]],
+	["AWS::S3Tables::TableBucket", [["TableBucketName"]]],
+	["AWS::S3Vectors::VectorBucket", [["EncryptionConfiguration"], ["VectorBucketName"]]],
+	["AWS::Scheduler::Schedule", [["Name"]]],
+	["AWS::SecretsManager::Secret", [["Name"]]],
+	["AWS::ServiceDiscovery::HttpNamespace", [["Name"]]],
+	["AWS::ServiceDiscovery::PrivateDnsNamespace", [["Name"], ["Vpc"]]],
+	["AWS::ServiceDiscovery::PublicDnsNamespace", [["Name"]]],
+	["AWS::ServiceDiscovery::Service", [
+		["HealthCheckCustomConfig"],
+		["Name"],
+		["NamespaceId"],
+		["Type"]
+	]],
+	["AWS::SNS::Subscription", [
+		["Endpoint"],
+		["Protocol"],
+		["TopicArn"]
+	]],
+	["AWS::SNS::Topic", [["FifoTopic"], ["TopicName"]]],
+	["AWS::SNS::TopicPolicy", []],
+	["AWS::SQS::Queue", [["FifoQueue"], ["QueueName"]]],
+	["AWS::SQS::QueuePolicy", []],
+	["AWS::SSM::Parameter", [["Name"]]],
+	["AWS::StepFunctions::StateMachine", [["StateMachineName"], ["StateMachineType"]]],
+	["AWS::WAFv2::WebACL", [["Name"], ["Scope"]]]
+]);
+
+//#endregion
+//#region src/provisioning/create-only-properties.ts
+/**
 * Per-type cache of SUCCESSFUL lookups only. The value is the in-flight (or
 * settled) promise so concurrent diffs of the same resource type share a
 * single DescribeType call. A failed lookup removes its own entry so a later
@@ -20643,6 +21381,13 @@ function hasNoRegistrySchema(resourceType) {
 */
 const createOnlyPropertiesCache = /* @__PURE__ */ new Map();
 /**
+* The scheduling handle of each lookup still IN FLIGHT, so an awaited lookup
+* of a type a prefetch already queued promotes that one call instead of
+* issuing a second one, and a prefetch's `cancel()` can withdraw the calls it
+* started (issue #3718).
+*/
+const inFlightLookups = /* @__PURE__ */ new Map();
+/**
 * Resolve the create-only (immutable) property PATHS for a resource type,
 * each as the segment array after `/properties/` (e.g.
 * `['Name']`, `['SourceParameters', 'KinesisStreamParameters',
@@ -20657,25 +21402,103 @@ const createOnlyPropertiesCache = /* @__PURE__ */ new Map();
 * consults {@link createOnlyChangeRequiresReplacement} to compare at the
 * schema's actual path granularity.
 *
-* Never throws: a DescribeType failure logs a warning and resolves to an empty
-* list (graceful fallback to the registry-only classification). Only SUCCESSFUL
-* lookups are cached per resource type for the process lifetime; a failed
-* lookup is NOT cached, so a later call for the same type retries DescribeType
-* (a transient throttle must not poison the deploy's replacement detection).
+* Never throws: a DescribeType failure logs a warning and resolves to the
+* committed snapshot's paths for the type, or to an empty list for a type
+* with no snapshot (graceful fallback to the registry-only classification).
+* Only SUCCESSFUL lookups are cached per resource type for the process
+* lifetime; a failed lookup is NOT cached, so a later call for the same type
+* retries DescribeType (a transient throttle must not pin the deploy to the
+* snapshot).
+*
+* The call is an URGENT DescribeType: it waits only behind other urgent ones,
+* never behind a queued {@link prefetchCreateOnlyPropertyPaths}, and awaiting
+* a type a prefetch already queued promotes that queued call.
 */
 function getCreateOnlyPropertyPaths(resourceType) {
+	return lookupCreateOnlyPropertyPaths(resourceType, false);
+}
+/**
+* Warm the cache for each of `resourceTypes` without waiting (issue #1180),
+* as BACKGROUND DescribeType calls behind every awaited lookup (issue #3718).
+* Duplicates and schema-less types are skipped; it never throws and never
+* leaves an unhandled rejection.
+*
+* The prefetch is purely opportunistic, so its owner MUST `cancel()` it when
+* the work it was warming for is done: an unfinished background lookup (a
+* throttle backoff can run to ~15 s) must never delay a command's completion.
+* The handle is per call, so a nested-stack child engine cancelling its own
+* prefetch cannot withdraw its parent's.
+*/
+function prefetchCreateOnlyPropertyPaths(resourceTypes) {
+	const started = [];
+	for (const type of new Set(resourceTypes)) {
+		if (hasNoRegistrySchema(type) || createOnlyPropertiesCache.has(type)) continue;
+		lookupCreateOnlyPropertyPaths(type, true).catch(() => {});
+		const lookup = inFlightLookups.get(type);
+		if (lookup) started.push([type, lookup]);
+	}
+	return { cancel: () => {
+		for (const [type, lookup] of started.splice(0).reverse()) {
+			if (inFlightLookups.get(type) !== lookup || !lookup.scheduled.cancel()) continue;
+			inFlightLookups.delete(type);
+			createOnlyPropertiesCache.delete(type);
+		}
+	} };
+}
+/**
+* The distinct resource types of a template's `Resources`, for
+* {@link prefetchCreateOnlyPropertyPaths}. Tolerates a missing or malformed
+* section (the prefetch must never be the thing that throws).
+*/
+function templateResourceTypes(resources) {
+	if (resources === null || typeof resources !== "object") return [];
+	const types = /* @__PURE__ */ new Set();
+	for (const resource of Object.values(resources)) {
+		if (resource === null || typeof resource !== "object") continue;
+		const type = resource.Type;
+		if (typeof type === "string") types.add(type);
+	}
+	return [...types];
+}
+function lookupCreateOnlyPropertyPaths(resourceType, background) {
 	if (hasNoRegistrySchema(resourceType)) return Promise.resolve([]);
 	const cached = createOnlyPropertiesCache.get(resourceType);
-	if (cached) return cached;
-	const entry = fetchCreateOnlyPropertyPaths(resourceType).catch((error) => {
-		createOnlyPropertiesCache.delete(resourceType);
-		const message = describeAwsFailure(error).detail;
-		getLogger().child("CreateOnlyProperties").warn(`Failed to resolve create-only properties for ${resourceType} via cloudformation:DescribeType (${message}). Falling back to the registry-only replacement classification for this resource — an immutable-property change may be mis-classified as an in-place update. Grant cloudformation:DescribeType to enable schema-driven replacement detection.`);
-		return [];
+	if (cached) {
+		const inFlight = inFlightLookups.get(resourceType);
+		if (!background && inFlight) {
+			inFlight.awaited = true;
+			inFlight.scheduled.promote();
+		}
+		return cached;
+	}
+	const scheduled = scheduleDescribeType(resourceType, { background });
+	const lookup = {
+		scheduled,
+		awaited: !background
+	};
+	inFlightLookups.set(resourceType, lookup);
+	const entry = scheduled.promise.then((response) => parseCreateOnlyResponse(resourceType, response.Schema)).catch((error) => {
+		if (error instanceof BackgroundTaskCancelledError) return [];
+		if (createOnlyPropertiesCache.get(resourceType) === entry) createOnlyPropertiesCache.delete(resourceType);
+		return fallBackToSnapshot(resourceType, error, lookup.awaited);
+	}).finally(() => {
+		if (inFlightLookups.get(resourceType) === lookup) inFlightLookups.delete(resourceType);
 	});
 	createOnlyPropertiesCache.set(resourceType, entry);
 	return entry;
 }
+function fallBackToSnapshot(resourceType, error, awaited) {
+	const message = describeAwsFailure(error).detail;
+	const child = getLogger().child("CreateOnlyProperties");
+	const report = (line) => awaited ? child.warn(line) : child.debug(line);
+	const snapshot = CREATE_ONLY_PATHS_SNAPSHOT.get(resourceType);
+	if (snapshot) {
+		report(`Failed to resolve create-only properties for ${resourceType} via cloudformation:DescribeType (${message}). Falling back to cdkd's bundled schema snapshot for this resource — it can lag AWS's current schema, so a property AWS has since made updatable may be classified as a replacement. Grant cloudformation:DescribeType to use the live schema.`);
+		return snapshot;
+	}
+	report(`Failed to resolve create-only properties for ${resourceType} via cloudformation:DescribeType (${message}). Falling back to the registry-only replacement classification for this resource — an immutable-property change may be mis-classified as an in-place update. Grant cloudformation:DescribeType to enable schema-driven replacement detection.`);
+	return [];
+}
 /**
 * Decide whether a change to top-level property `topLevelKey` requires
 * replacement per the schema's createOnly paths.
@@ -20743,32 +21566,19 @@ function isIntrinsicShaped(value) {
 	return keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"));
 }
 /**
-* Fetch + parse the type's create-only property paths. THROWS on a
-* DescribeType failure — the caller ({@link getCreateOnlyPropertyPaths})
-* catches, warns, and declines to cache so the lookup can be retried later.
+* Parse a DescribeType response's schema into create-only paths.
+*
+* A response without a Schema (e.g. a still-registering / private type, or a
+* type with no CFn registry schema) carries no createOnlyProperties to
+* extract; treat it as "none" without a warning — it is a successful,
+* cacheable lookup, not a failure. A Schema that is not JSON THROWS, which the
+* caller handles as a failed lookup.
 */
-async function fetchCreateOnlyPropertyPaths(resourceType) {
-	const logger = getLogger().child("CreateOnlyProperties");
-	const response = await describeTypeWithThrottleRetry(resourceType);
-	const result = [];
-	if (response.Schema) {
-		const createOnly = JSON.parse(response.Schema).createOnlyProperties;
-		if (Array.isArray(createOnly)) for (const path of createOnly) {
-			if (typeof path !== "string") continue;
-			if (!path.startsWith("/properties/")) continue;
-			const segments = path.slice(12).split("/").map(unescapeJsonPointerSegment$2).filter((segment) => segment.length > 0);
-			if (segments.length > 0) result.push(segments);
-		}
-	}
-	logger.debug(`Resolved ${result.length} create-only property paths for ${resourceType}` + (result.length > 0 ? `: ${result.map((p) => p.join(".")).join(", ")}` : ""));
+function parseCreateOnlyResponse(resourceType, schema) {
+	const result = schema ? parseCreateOnlyPropertyPointers(JSON.parse(schema).createOnlyProperties) : [];
+	getLogger().child("CreateOnlyProperties").debug(`Resolved ${result.length} create-only property paths for ${resourceType}` + (result.length > 0 ? `: ${result.map((p) => p.join(".")).join(", ")}` : ""));
 	return result;
 }
-/**
-* Unescape an RFC 6901 JSON Pointer segment (`~1` -> `/`, `~0` -> `~`).
-*/
-function unescapeJsonPointerSegment$2(segment) {
-	return segment.replace(/~1/g, "/").replace(/~0/g, "~");
-}
 
 //#endregion
 //#region src/provisioning/property-coverage.generated.ts
@@ -33973,8 +34783,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const variables = Object.create(null);
 		const variableTwins = Object.create(null);
 		const variablePasses = Object.create(null);
+		const subTemplateKind = (value) => value === null ? "null" : Array.isArray(value) ? "array" : typeof value;
 		if (Array.isArray(subArgs)) {
 			const [templateString, variableMap] = subArgs;
+			if (typeof templateString !== "string") throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::Sub: the first element must be a string, got ${subTemplateKind(templateString)}`));
 			template = templateString;
 			if (typeof variableMap !== "object" || variableMap === null) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::Sub: the second element must be a variable map, got ${variableMap === null ? "null" : typeof variableMap}`));
 			for (const [key, val] of Object.entries(variableMap)) if (typeof val === "string") {
@@ -33988,7 +34800,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				variableTwins[key] = resolved.twin;
 				variablePasses[key] = resolved;
 			} else variables[key] = context.abandonedResolutions === void 0 ? await this.resolveValue(val, context) : await this.resolveKeyUnit(key, val, context, context.abandonedResolutions);
-		} else template = subArgs;
+		} else {
+			if (typeof subArgs !== "string") throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::Sub: the template must be a string, got ${subTemplateKind(subArgs)}`));
+			template = subArgs;
+		}
 		const replacements = [];
 		const matches = template.matchAll(/\$\{(!)?([^}]*)\}/g);
 		for (const match of matches) {
@@ -34014,10 +34829,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			let replacement;
 			let twinReplacement;
 			let pass;
-			if (varNameStr in variables) {
+			if (Object.hasOwn(variables, varNameStr)) {
 				replacement = String(variables[varNameStr]);
-				twinReplacement = varNameStr in variableTwins ? variableTwins[varNameStr] : this.productLogTwin(variables[varNameStr], context);
-				if (varNameStr in variablePasses) pass = variablePasses[varNameStr];
+				twinReplacement = Object.hasOwn(variableTwins, varNameStr) ? variableTwins[varNameStr] : this.productLogTwin(variables[varNameStr], context);
+				if (Object.hasOwn(variablePasses, varNameStr)) pass = variablePasses[varNameStr];
 			} else {
 				const pseudoValue = await this.resolvePseudoParameter(varNameStr, context);
 				if (pseudoValue !== void 0) replacement = String(pseudoValue);
@@ -38294,7 +39109,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CWCv370K.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DaYT8UPi.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -45642,6 +46457,7 @@ const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 	"AWS::Glue::Table",
 	"AWS::Logs::LogGroup",
 	"AWS::CloudFront::Distribution",
+	"AWS::CloudFormation::Stack",
 	"AWS::Cassandra::Table",
 	"AWS::DocDBElastic::Cluster",
 	"AWS::Lightsail::Database",
@@ -48617,7 +49433,7 @@ async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId)
 		}
 		if (v !== null && typeof v === "object") {
 			const out = {};
-			for (const [k, val] of Object.entries(v)) out[k] = await walk(val, path === "" ? k : `${path}.${k}`);
+			for (const [k, val] of Object.entries(v)) defineOwnKey(out, k, await walk(val, path === "" ? k : `${path}.${k}`));
 			return out;
 		}
 		return v;
@@ -51584,9 +52400,16 @@ var DeployEngine = class DeployEngine {
 		if (toRefresh > 0) this.logger.warn(`cdkd state schema upgrade detected — refreshing observed-properties baseline for ${toRefresh} resource(s) (one-time, runs in parallel with deploy)`);
 	}
 	async doDeploy(stackName, template) {
+		const createOnlyPrefetch = prefetchCreateOnlyPropertyPaths(templateResourceTypes(template.Resources).filter((type) => !hasNoRegistrySchema(type)));
+		try {
+			return await this.doDeployWithPrefetch(stackName, template, createOnlyPrefetch);
+		} finally {
+			createOnlyPrefetch.cancel();
+		}
+	}
+	async doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		const startTime = Date.now();
 		this.logger.debug(`Starting deployment for stack: ${stackName}`);
-		for (const type of new Set(Object.values(template.Resources).map((r) => r.Type).filter((type) => !hasNoRegistrySchema(type)))) getCreateOnlyPropertyPaths(type).catch(() => {});
 		const renderer = getLiveRenderer();
 		this.interrupted = false;
 		this.interruptCause = null;
@@ -51685,6 +52508,7 @@ var DeployEngine = class DeployEngine {
 			diffResolverContext.skipDynamicReferences = true;
 			const diffResolveFn = (value) => this.resolver.resolve(value, diffResolverContext);
 			const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry), this.providerRegistry.getAllowedUnsupportedProperties?.(), this.freshNoEchoParameters(parameterValues));
+			createOnlyPrefetch.cancel();
 			const nestedStackTypeChanges = findNestedStackTypeChanges({
 				changes,
 				stateResources: currentState.resources
@@ -53700,5 +54524,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, CdkdError as $a, synthesisStatusMessage as $i, refuseMalformedOrphanRecordsForDestroy as $n, forceQuitRecoveryClause as $r, configIntegerRefusal as $t, createPreDeleteFinalSnapshot as A, credentialFingerprint as Aa, validateContainerRepoName as Ai, hasReadableOutputs as An, isTransientServerError as Ao, TEMPLATE_SOURCED_RULES as Ar, deleteSkipReason as At, isStatefulRecreateTargetSync as B, absoluteAssemblyPathEscape as Ba, getDockerCmd as Bi, malformedOrphansRefusalMessage as Bn, maskSecretsInText as Br, isImpossibleEmptyStoredAttribute as Bt, namesAnyDeclaredParameter as C, expectedOwnerParam as Ca, assertAssetBucketRegion as Ci, STATE_REGION_DIVERGED as Cn, commandHole as Co, describeTypeWithThrottleRetry as Cr, compositeIdSkipResult as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, ambientClientDefaults as Da, parseBootstrapMarker as Di, deployRefusesOrphanRowsReason as Dn, isMarkedNonRetryable as Do, STATE_SOURCED_BASELINE_RULES as Dr, maskerOrIdentity as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, derivePartitionAndUrlSuffix as Ea, isCrossRegionRedirect as Ei, UNREADABLE_RESOURCES_MAP_ROW as En, withheldTargetClause as Eo, TemplateParser as Er, maskDeep as Et, extractDeploymentEventError as F, defineOwnKey as Fa, describeDockerExecFailure as Fi, malformedExportSourceWarning as Fn, safeStringify$1 as Fo, identityKeyFor as Fr, carriesDynamicReference as Ft, toCfnInteger as G, clearBucketRegionCache as Ga, runDockerForeground as Gi, malformedResourceEntriesWarning as Gn, redactSecretsForState as Gr, isSettledInstanceState as Gt, WARM_THROUGHPUT_MEMBERS as H, displayAssemblyPath as Ha, isMalformedEnvKey as Hi, malformedOutputsRefusalMessage as Hn, recordMaskOnlyValue as Hr, isUnboundTemplateParameter as Ht, makeSiblingClaimReader as I, hasOwnKey as Ia, describeDockerFailure as Ii, malformedLocalOutputsWarning as In, __exportAll as Io, isSingleDynamicReferenceToken as Ir, carriesFetchableDynamicReference as It, bold as J, getAwsClients as Ja, escapeRegExp$1 as Ji, malformedStateRefusalMessage as Jn, S3StateBackend as Jr, resolveExplicitPhysicalId as Jt, toFiniteNumber as K, resolveBucketRegion as Ka, runDockerStreaming as Ki, malformedResourcePropertiesWarning as Kn, scrubResourceRecord as Kr, WAFv2WebACLProvider as Kt, planOrphanAdoption as L, hasPlainPrototype$1 as La, dockerSpawnEnvWithSensitive as Li, malformedOrphanRecordsRefusalMessage as Ln, isUncertifiedBaselineMaskPosition as Lr, cfnRefValueFromPhysicalId as Lt, refusesFinalSnapshot as M, failedStageNote as Ma, buildDockerImage as Mi, isReadableOrphanRecord as Mn, markRedactedCause as Mo, createSecretMasker as Mr, disableInstanceApiTermination as Mt, unsupportedFinalSnapshotError as N, globMatches as Na, resolveDockerContextDirectory as Ni, isReadableResourceEntry as Nn, retryClassificationText as No, dynamicReferenceTokens as Nr, isTerminationProtectionPropagationError as Nt, buildFinalSnapshotIdentifier as O, ambientCredentialConfig as Oa, readBootstrapMarkerBody as Oi, displayLogicalId as On, isRetryableTransientError as Oo, STATE_SOURCED_CROSS_GENERATION_RULES as Or, UNSPECIFIED_SKIP_REASON as Ot, makeCanonicalizePropertiesFn as P, processStackMessages as Pa, describeDockerCapturedOutput as Pi, malformedExportNamesWarning as Pn, describeAwsFailure as Po, errorCauseChain as Pr, IntrinsicFunctionResolver as Pt, red as Q, AssetError as Qa, Synthesizer as Qi, refuseMalformedOrphanRecords as Qn, buildLockContentionMessage as Qr, configBooleanRefusal as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, nullPrototypeRecord as Ra, finchSecretArgvRefusal as Ri, malformedOrphanRecordsWarning as Rn, markSameGenerationBag as Rr, coerceParameterTypedValue as Rt, computeParameterTaint as S, decodeListingKey as Sa, BOOTSTRAP_MARKER_PREFIX as Si, INTRINSIC_KEYS as Sn, withErrorHandling as So, findSilentDropProperties as Sr, compositeIdSeparatorRefusal as St, resourcesNamingDeclaredParameter as T, canonicalizeRegion as Ta, getBootstrapMarkerKey as Ti, UNREADABLE_ORPHANS_CONTAINER_ROW as Tn, shellQuote as To, DagBuilder as Tr, createMaskedRetryLogger as Tt, coerceWarmThroughput as U, renderAssemblyPathEscape as Ua, partitionSensitiveEnv as Ui, malformedOutputsWarning as Un, recordMaskOnlyValuesIn as Ur, parameterTypeMayLoseSecretIdentity as Ut, renderStatefulReason as V, describeFileReadFailure as Va, isDockerClientEnvKey as Vi, malformedOrphansWarning as Vn, pathCrossesDottedKey as Vr, isNamelessDynamicReferenceError as Vt, isWarmThroughputDecrease as W, resolveAssemblyPath as Wa, redactDockerArgvValues as Wi, malformedRenderedContainersWarning as Wn, recoverMaskedOutput as Wr, refStateLookupFromResource as Wt, gray as X, runWithStackAwsClients as Xa, AssetManifestLoader as Xi, refuseDivergentRecordRegionForDestroy as Xn, UNREPRODUCIBLE_LOCK_CLAUSE as Xr, coerceCfnBoolean as Xt, cyan as Y, resetAwsClients as Ya, stripControlChars as Yi, previewableOrphanRecords as Yn, rebuildClientForBucketRegion as Yr, assertRegionMatch as Yt, green as Z, setAwsClients as Za, getDockerImageBySourceHash as Zi, refuseMalformedNestedChildOutputs as Zn, buildForceUnlockCommand as Zr, coerceCfnInteger as Zt, bagHoldsSecretExpression as _, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as _a, buildAssetRedirectMap as _i, AWS_CREDENTIAL_ENV_KEYS as _n, StateError as _o, safeRegion as _r, startInterruptWatch as _t, DeploymentEventsStore as a, resolveSkipPrefix as aa, hasReadableExportSet as ai, requireConfigString as an, IntrinsicResolutionRefusalError as ao, refuseMalformedResourceAttributesForOrphan as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, producerCoordinateKey as ba, rewriteTemplateAssetReferences as bi, envCredentialsAreAssumedRole as bn, isCdkdError as bo, unreadableOrphanRecords as br, ccProtectionRegistryTypes as bt, replayFailedOperations as c, resolveUseCdkBootstrapAssets as ca, importableOutputKeys as ci, classifyReplaySecretRegion as cn, LockError as co, refuseMalformedResourcePropertiesForOrphan as cr, IAMRoleProvider as ct, updatePartialMessage as d, ssmResolvedValueType as da, orphansAfterRollback as di, s3BucketArn as dn, PartialFailureError as do, repairMalformedOrphanRecordsForReadOnly as dr, ProviderRegistry as dt, getDefaultStateBucketName as ea, formatLockExpiry as ei, configStringRefusal as en, ConfigError as eo, refuseMalformedOrphans as er, collectDeclaredOutputNames as et, updatePartialReason as f, CFN_TEMPLATE_BODY_LIMIT as fa, orphansCarriedFrom as fi, s3BucketDomainName as fn, ProvisioningError as fo, repairMalformedOrphansForReadOnly as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, uploadCfnTemplate as ga, WorkGraph as gi, applyRoleArnIfSet as gn, StackTerminationProtectionError as go, repairMalformedResourcesForReadOnly as gr, isInterruptedWaitError as gt, IMPLICIT_DELETE_DEPENDENCIES as h, findLargeInlineResources as ha, stringifyValue as hi, s3BucketWebsiteUrl as hn, StackHasActiveImportsError as ho, repairMalformedResourcePropertiesForReadOnly as hr, interruptWatchListenerCount as ht, DeploymentEventsReader as i, resolveCaptureObservedState as ia, exportNamesCarriedFrom as ii, requireConfigObject as in, DynamicReferenceRegionAmbiguousError as io, refuseMalformedOutputsForDestroy as ir, secretBearing as it, isFinalSnapshotError as j, AssemblyReader as ja, buildDenyExternalAccessPolicy as ji, hasReadableResources as jn, markNonRetryable as jo, carriesSecretMask as jr, isWaitAbandonedError as jt, ccRoutedFinalSnapshotError as k, clientDefaultsFor as ka, validateAssetBucketName as ki, hasReadableOrphans as kn, isThrottlingError as ko, STATE_SOURCED_READBACK_RULES as kr, deleteIndeterminateGuards as kt, replayRollback as l, stateBucketExistenceConfirmed as la, importableOutputs as li, producerRegionsFromState as ln, MalformedProducerRecordRefusalError as lo, refuseMalformedResourcesForDestroy as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, MIGRATE_TMP_PREFIX as ma, AssetPublisher as mi, s3BucketRegionalDomainName as mn, ResourceUpdateNotSupportedError as mo, repairMalformedResourceEntriesForReadOnly as mr, endCommandInterruptScope as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveApp as na, DEFAULT_STATE_PREFIX as ni, replayWarn as nn, DependencyError as no, refuseMalformedOrphansForOrphan as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, resolveStateBucketWithDefault as oa, hasReasonlessBaselineRefusal as oi, definedAttributes as on, LocalInvokeBuildError as oo, refuseMalformedResourceEntries as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, CFN_TEMPLATE_URL_LIMIT as pa, shouldRetainResource as pi, s3BucketDualStackDomainName as pn, ResourceTimeoutError as po, repairMalformedOutputsForReadOnly as pr, beginCommandInterruptScope as pt, formatResourceLine as q, AwsClients as qa, warnFinchArgvExposure as qi, malformedResourcesWarning as qn, LockManager as qr, normalizeAwsTagsToCfn as qt, DeployEngine as r, resolveAutoAssetStorage as ra, describeRegionValueKind as ri, requireConfigArray as rn, DeployCancelledError as ro, refuseMalformedOutputs as rr, isExportAliasCollision as rt, planRollback as s, resolveStateBucketWithDefaultAndSource as sa, hasUnverifiableParameterRefusal as si, stringifyIfAssigned as sn, LocalStartServiceError as so, refuseMalformedResourceEntriesForOrphan as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, getLegacyStateBucketName as ta, CUSTOM_RESOURCE_RESPONSE_PREFIX as ti, readConfigString as tn, CrossAccountSecretRefusalError as to, refuseMalformedOrphansForDestroy as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, warnDeprecatedNoPrefixCliFlag as ua, isReadableBag as ui, withSharedDrainBudget as un, NestedStackChildDirectDestroyError as uo, refuseMalformedState as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, injectiveKey as va, createAssetRedirectResolver as vi, applyCallerIdentityCredentials as vn, SynthesisError as vo, safeStackName as vr, CloudControlProvider as vt, reachableDivergentParameters as w, PARTITION_TABLE as wa, ensureAssetStorage as wi, STATE_RESOURCES_MALFORMED as wn, pasteableCommand as wo, withRetry as wr, packCompositeId as wt, bindingSkippedOutputs as x, producerRecordKey as xa, AssetModeResolver as xi, DiffCalculator as xn, normalizeAwsError as xo, findActionableSilentDrops as xr, compositeIdFormatMessage as xt, keptWholeReasonText as y, injectiveKeyPrefix as ya, loadPublishableAssetManifest as yi, callerEnvCredentials as yn, formatError as yo, unpreviewableOrphanRecords as yr, slowCcOperationTimeoutMs as yt, isStatefulRecreateTargetForReplace as z, ownValue as za, formatDockerLoginError as zi, malformedOrphanRowsKeptWarning as zn, maskSecretsInError as zr, getAccountInfo as zt };
-//# sourceMappingURL=deploy-engine-DIZztJy5.js.map
+export { yellow as $, setAwsClients as $a, getDockerImageBySourceHash as $i, refuseMalformedOrphanRecordsForDestroy as $n, buildForceUnlockCommand as $r, configIntegerRefusal as $t, createPreDeleteFinalSnapshot as A, ambientCredentialConfig as Aa, readBootstrapMarkerBody as Ai, hasReadableOutputs as An, withheldTargetClause as Ao, STATE_SOURCED_CROSS_GENERATION_RULES as Ar, deleteSkipReason as At, isStatefulRecreateTargetSync as B, nullPrototypeRecord as Ba, finchSecretArgvRefusal as Bi, malformedOrphansRefusalMessage as Bn, __exportAll as Bo, markSameGenerationBag as Br, isImpossibleEmptyStoredAttribute as Bt, namesAnyDeclaredParameter as C, producerRecordKey as Ca, AssetModeResolver as Ci, STATE_REGION_DIVERGED as Cn, normalizeAwsError as Co, prefetchCreateOnlyPropertyPaths as Cr, compositeIdSkipResult as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, canonicalizeRegion as Da, getBootstrapMarkerKey as Di, deployRefusesOrphanRowsReason as Dn, plainOrDescribed as Do, DagBuilder as Dr, maskerOrIdentity as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, PARTITION_TABLE as Ea, ensureAssetStorage as Ei, UNREADABLE_RESOURCES_MAP_ROW as En, pasteableCommand as Eo, withRetry as Er, maskDeep as Et, extractDeploymentEventError as F, globMatches as Fa, resolveDockerContextDirectory as Fi, malformedExportSourceWarning as Fn, markNonRetryable as Fo, dynamicReferenceTokens as Fr, carriesDynamicReference as Ft, toCfnInteger as G, renderAssemblyPathEscape as Ga, partitionSensitiveEnv as Gi, malformedResourceEntriesWarning as Gn, recordMaskOnlyValuesIn as Gr, isSettledInstanceState as Gt, WARM_THROUGHPUT_MEMBERS as H, absoluteAssemblyPathEscape as Ha, getDockerCmd as Hi, malformedOutputsRefusalMessage as Hn, maskSecretsInText as Hr, isUnboundTemplateParameter as Ht, makeSiblingClaimReader as I, processStackMessages as Ia, describeDockerCapturedOutput as Ii, malformedLocalOutputsWarning as In, markRedactedCause as Io, errorCauseChain as Ir, carriesFetchableDynamicReference as It, bold as J, resolveBucketRegion as Ja, runDockerStreaming as Ji, malformedStateRefusalMessage as Jn, scrubResourceRecord as Jr, resolveExplicitPhysicalId as Jt, toFiniteNumber as K, resolveAssemblyPath as Ka, redactDockerArgvValues as Ki, malformedResourcePropertiesWarning as Kn, recoverMaskedOutput as Kr, WAFv2WebACLProvider as Kt, planOrphanAdoption as L, defineOwnKey as La, describeDockerExecFailure as Li, malformedOrphanRecordsRefusalMessage as Ln, retryClassificationText as Lo, identityKeyFor as Lr, cfnRefValueFromPhysicalId as Lt, refusesFinalSnapshot as M, credentialFingerprint as Ma, validateContainerRepoName as Mi, isReadableOrphanRecord as Mn, isRetryableTransientError as Mo, TEMPLATE_SOURCED_RULES as Mr, disableInstanceApiTermination as Mt, unsupportedFinalSnapshotError as N, AssemblyReader as Na, buildDenyExternalAccessPolicy as Ni, isReadableResourceEntry as Nn, isThrottlingError as No, carriesSecretMask as Nr, isTerminationProtectionPropagationError as Nt, buildFinalSnapshotIdentifier as O, derivePartitionAndUrlSuffix as Oa, isCrossRegionRedirect as Oi, displayLogicalId as On, quotedOrDescribed as Oo, TemplateParser as Or, UNSPECIFIED_SKIP_REASON as Ot, makeCanonicalizePropertiesFn as P, failedStageNote as Pa, buildDockerImage as Pi, malformedExportNamesWarning as Pn, isTransientServerError as Po, createSecretMasker as Pr, IntrinsicFunctionResolver as Pt, red as Q, runWithStackAwsClients as Qa, AssetManifestLoader as Qi, refuseMalformedOrphanRecords as Qn, UNREPRODUCIBLE_LOCK_CLAUSE as Qr, configBooleanRefusal as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, hasOwnKey as Ra, describeDockerFailure as Ri, malformedOrphanRecordsWarning as Rn, describeAwsFailure as Ro, isSingleDynamicReferenceToken as Rr, coerceParameterTypedValue as Rt, computeParameterTaint as S, producerCoordinateKey as Sa, rewriteTemplateAssetReferences as Si, INTRINSIC_KEYS as Sn, isCdkdError as So, findSilentDropProperties as Sr, compositeIdSeparatorRefusal as St, resourcesNamingDeclaredParameter as T, expectedOwnerParam as Ta, assertAssetBucketRegion as Ti, UNREADABLE_ORPHANS_CONTAINER_ROW as Tn, commandHole as To, describeTypeWithThrottleRetry as Tr, createMaskedRetryLogger as Tt, coerceWarmThroughput as U, describeFileReadFailure as Ua, isDockerClientEnvKey as Ui, malformedOutputsWarning as Un, pathCrossesDottedKey as Ur, parameterTypeMayLoseSecretIdentity as Ut, renderStatefulReason as V, ownValue as Va, formatDockerLoginError as Vi, malformedOrphansWarning as Vn, maskSecretsInError as Vr, isNamelessDynamicReferenceError as Vt, isWarmThroughputDecrease as W, displayAssemblyPath as Wa, isMalformedEnvKey as Wi, malformedRenderedContainersWarning as Wn, recordMaskOnlyValue as Wr, refStateLookupFromResource as Wt, gray as X, getAwsClients as Xa, escapeRegExp$1 as Xi, refuseDivergentRecordRegionForDestroy as Xn, S3StateBackend as Xr, coerceCfnBoolean as Xt, cyan as Y, AwsClients as Ya, warnFinchArgvExposure as Yi, previewableOrphanRecords as Yn, LockManager as Yr, assertRegionMatch as Yt, green as Z, resetAwsClients as Za, stripControlChars as Zi, refuseMalformedNestedChildOutputs as Zn, rebuildClientForBucketRegion as Zr, coerceCfnInteger as Zt, bagHoldsSecretExpression as _, findLargeInlineResources as _a, stringifyValue as _i, AWS_CREDENTIAL_ENV_KEYS as _n, StackHasActiveImportsError as _o, safeRegion as _r, startInterruptWatch as _t, DeploymentEventsStore as a, resolveAutoAssetStorage as aa, describeRegionValueKind as ai, requireConfigString as an, DeployCancelledError as ao, refuseMalformedResourceAttributesForOrphan as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, injectiveKey as ba, createAssetRedirectResolver as bi, envCredentialsAreAssumedRole as bn, SynthesisError as bo, unreadableOrphanRecords as br, ccProtectionRegistryTypes as bt, replayFailedOperations as c, resolveStateBucketWithDefault as ca, hasReasonlessBaselineRefusal as ci, classifyReplaySecretRegion as cn, LocalInvokeBuildError as co, refuseMalformedResourcePropertiesForOrphan as cr, IAMRoleProvider as ct, updatePartialMessage as d, stateBucketExistenceConfirmed as da, importableOutputs as di, s3BucketArn as dn, MalformedProducerRecordRefusalError as do, repairMalformedOrphanRecordsForReadOnly as dr, ProviderRegistry as dt, Synthesizer as ea, buildLockContentionMessage as ei, configStringRefusal as en, AssetError as eo, refuseMalformedOrphans as er, collectDeclaredOutputNames as et, updatePartialReason as f, warnDeprecatedNoPrefixCliFlag as fa, isReadableBag as fi, s3BucketDomainName as fn, NestedStackChildDirectDestroyError as fo, repairMalformedOrphansForReadOnly as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, MIGRATE_TMP_PREFIX as ga, AssetPublisher as gi, applyRoleArnIfSet as gn, ResourceUpdateNotSupportedError as go, repairMalformedResourcesForReadOnly as gr, isInterruptedWaitError as gt, IMPLICIT_DELETE_DEPENDENCIES as h, CFN_TEMPLATE_URL_LIMIT as ha, shouldRetainResource as hi, s3BucketWebsiteUrl as hn, ResourceTimeoutError as ho, repairMalformedResourcePropertiesForReadOnly as hr, interruptWatchListenerCount as ht, DeploymentEventsReader as i, resolveApp as ia, DEFAULT_STATE_PREFIX as ii, requireConfigObject as in, DependencyError as io, refuseMalformedOutputsForDestroy as ir, secretBearing as it, isFinalSnapshotError as j, clientDefaultsFor as ja, validateAssetBucketName as ji, hasReadableResources as jn, isMarkedNonRetryable as jo, STATE_SOURCED_READBACK_RULES as jr, isWaitAbandonedError as jt, ccRoutedFinalSnapshotError as k, ambientClientDefaults as ka, parseBootstrapMarker as ki, hasReadableOrphans as kn, shellQuote as ko, STATE_SOURCED_BASELINE_RULES as kr, deleteIndeterminateGuards as kt, replayRollback as l, resolveStateBucketWithDefaultAndSource as la, hasUnverifiableParameterRefusal as li, producerRegionsFromState as ln, LocalStartServiceError as lo, refuseMalformedResourcesForDestroy as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, CFN_TEMPLATE_BODY_LIMIT as ma, orphansCarriedFrom as mi, s3BucketRegionalDomainName as mn, ProvisioningError as mo, repairMalformedResourceEntriesForReadOnly as mr, endCommandInterruptScope as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, getDefaultStateBucketName as na, formatLockExpiry as ni, replayWarn as nn, ConfigError as no, refuseMalformedOrphansForOrphan as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, resolveCaptureObservedState as oa, exportNamesCarriedFrom as oi, definedAttributes as on, DynamicReferenceRegionAmbiguousError as oo, refuseMalformedResourceEntries as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, ssmResolvedValueType as pa, orphansAfterRollback as pi, s3BucketDualStackDomainName as pn, PartialFailureError as po, repairMalformedOutputsForReadOnly as pr, beginCommandInterruptScope as pt, formatResourceLine as q, clearBucketRegionCache as qa, runDockerForeground as qi, malformedResourcesWarning as qn, redactSecretsForState as qr, normalizeAwsTagsToCfn as qt, DeployEngine as r, getLegacyStateBucketName as ra, CUSTOM_RESOURCE_RESPONSE_PREFIX as ri, requireConfigArray as rn, CrossAccountSecretRefusalError as ro, refuseMalformedOutputs as rr, isExportAliasCollision as rt, planRollback as s, resolveSkipPrefix as sa, hasReadableExportSet as si, stringifyIfAssigned as sn, IntrinsicResolutionRefusalError as so, refuseMalformedResourceEntriesForOrphan as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, synthesisStatusMessage as ta, forceQuitRecoveryClause as ti, readConfigString as tn, CdkdError as to, refuseMalformedOrphansForDestroy as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, resolveUseCdkBootstrapAssets as ua, importableOutputKeys as ui, withSharedDrainBudget as un, LockError as uo, refuseMalformedState as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, uploadCfnTemplate as va, WorkGraph as vi, applyCallerIdentityCredentials as vn, StackTerminationProtectionError as vo, safeStackName as vr, CloudControlProvider as vt, reachableDivergentParameters as w, decodeListingKey as wa, BOOTSTRAP_MARKER_PREFIX as wi, STATE_RESOURCES_MALFORMED as wn, withErrorHandling as wo, templateResourceTypes as wr, packCompositeId as wt, bindingSkippedOutputs as x, injectiveKeyPrefix as xa, loadPublishableAssetManifest as xi, DiffCalculator as xn, formatError as xo, findActionableSilentDrops as xr, compositeIdFormatMessage as xt, keptWholeReasonText as y, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ya, buildAssetRedirectMap as yi, callerEnvCredentials as yn, StateError as yo, unpreviewableOrphanRecords as yr, slowCcOperationTimeoutMs as yt, isStatefulRecreateTargetForReplace as z, hasPlainPrototype$1 as za, dockerSpawnEnvWithSensitive as zi, malformedOrphanRowsKeptWarning as zn, safeStringify$1 as zo, isUncertifiedBaselineMaskPosition as zr, getAccountInfo as zt };
+//# sourceMappingURL=deploy-engine-CidtgaFr.js.map