@go-to-k/cdkd 0.291.3 → 0.291.4

package/dist/{deploy-engine-5fdODHji.js → deploy-engine-CpMT9Bmm.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-GASr9bAF.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-BKm47b9j.js";
+import { t as getCdkdVersion } from "./version-ChuDKy_E.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -3330,6 +3330,53 @@ function processStackMessages(stacks, logger, options = {}) {
 	if (hasWarnings && failAt === "warn") throw new SynthesisError("Found warnings (--strict mode)");
 }
 
+//#endregion
+//#region src/utils/glob-match.ts
+/**
+* Whether `subject` matches the glob `pattern`, where `*` matches any run of
+* characters (the empty run included) and EVERY other character is literal.
+*
+* The one answer to "what does a stack-selection pattern mean", shared by
+* `stackMatchesPattern` (`src/cli/stack-matcher.ts`) and the failed-Stage
+* attribution in `src/synthesis/failed-stages.ts`, so the two cannot disagree
+* ([#3508](https://github.com/go-to-k/cdkd/issues/3508)). An import-free LEAF,
+* so both layers may import it.
+*
+* **Never a RegExp.** Both sites used to expand `*` into `.*` and compile the
+* result, which had two defects: a pattern with several `*` separated by
+* literals backtracked EXPONENTIALLY in the length of the subject (a stack
+* name or Stage path from the Cloud Assembly), and the other characters were
+* live regex syntax only when the pattern held a `*` — `My.Stage*` matched
+* `MyXStage1` while `My.Stage` matched only itself, and `My(Stage*` threw a
+* `SyntaxError`.
+*
+* The walk anchors the text before the first `*` at the start and the text
+* after the last `*` at the end, then places each middle segment at its
+* LEFTMOST occurrence after the previous one. Leftmost placement is optimal
+* when `*` is the only wildcard — any later placement leaves strictly less room
+* for the segments after it — so no backtracking is needed. The cost is one
+* `indexOf` per segment, O(|subject| x |pattern|) in the worst case:
+* polynomial, where the RegExp was exponential.
+*/
+function globMatches(pattern, subject) {
+	const segments = pattern.split("*");
+	if (segments.length === 1) return pattern === subject;
+	const head = segments[0];
+	const tail = segments[segments.length - 1];
+	if (subject.length < head.length + tail.length) return false;
+	if (!subject.startsWith(head) || !subject.endsWith(tail)) return false;
+	const end = subject.length - tail.length;
+	let cursor = head.length;
+	for (let i = 1; i < segments.length - 1; i++) {
+		const segment = segments[i];
+		if (segment === "") continue;
+		const at = subject.indexOf(segment, cursor);
+		if (at === -1 || at + segment.length > end) return false;
+		cursor = at + segment.length;
+	}
+	return true;
+}
+
 //#endregion
 //#region src/synthesis/failed-stages.ts
 /**
@@ -3431,29 +3478,7 @@ function patternTargetsStage(pattern, stagePath) {
 	const patternSegments = pattern.split("/");
 	const stageSegments = stagePath.split("/");
 	if (patternSegments.length < stageSegments.length) return false;
-	return stageSegments.every((segment, i) => segmentMatches(patternSegments[i], segment));
-}
-/**
-* Wildcard-aware comparison of ONE path segment, matching how
-* `stackMatchesPattern` expands `*` in `src/cli/stack-matcher.ts`. The pattern
-* is the USER's own input, not an assembly-supplied value, so it is expanded
-* there the same way — metacharacters and all, so the two cannot disagree
-* about what a pattern means.
-*
-* The construction is guarded because SPLITTING on `/` can make an invalid
-* segment out of a valid pattern (`'(*x/y*)'` splits into `'(*x'`), and this
-* helper runs when the stack list is EMPTY, which is exactly when
-* `stackMatchesPattern` never evaluates and therefore never raises first. An
-* unusable pattern is simply not attributed: the note still prints, hedged,
-* instead of a `SyntaxError` replacing the message the user needed.
-*/
-function segmentMatches(patternSegment, segment) {
-	if (!patternSegment.includes("*")) return patternSegment === segment;
-	try {
-		return new RegExp("^" + patternSegment.replace(/\*/g, ".*") + "$").test(segment);
-	} catch {
-		return false;
-	}
+	return stageSegments.every((segment, i) => globMatches(patternSegments[i], segment));
 }
 
 //#endregion
@@ -3750,7 +3775,7 @@ var ContextStore = class {
 				this.logger.debug(`Skipping transient context value for key: ${key}`);
 				continue;
 			}
-			existing[key] = value;
+			defineOwnKey(existing, key, value);
 		}
 		writeFileSync(filePath, JSON.stringify(existing, null, 2) + "\n", "utf-8");
 		this.logger.debug(`Saved ${Object.keys(updates).length} context value(s) to cdk.context.json`);
@@ -4450,7 +4475,7 @@ var ContextProviderRegistry = class {
 	* @returns Map of context key → resolved value
 	*/
 	async resolve(missing) {
-		const results = {};
+		const results = nullPrototypeRecord();
 		for (const entry of missing) {
 			const provider = this.providers.get(entry.provider);
 			const shownProvider = displaySafe(entry.provider);
@@ -18325,12 +18350,12 @@ var TemplateParser = class {
 		const resources = t["Resources"];
 		for (const [logicalId, resource] of Object.entries(resources)) {
 			if (typeof resource !== "object" || resource === null) {
-				this.logger.error(`Resource ${logicalId} is not an object`);
+				this.logger.error(`Resource ${displaySafe(logicalId)} is not an object`);
 				return false;
 			}
 			const r = resource;
 			if (!("Type" in r) || typeof r["Type"] !== "string") {
-				this.logger.error(`Resource ${logicalId} missing Type or Type is not a string`);
+				this.logger.error(`Resource ${displaySafe(logicalId)} missing Type or Type is not a string`);
 				return false;
 			}
 		}
@@ -18387,7 +18412,7 @@ var TemplateParser = class {
 		for (const [logicalId, resource] of Object.entries(template.Resources)) {
 			const conditionName = resource.Condition;
 			if (conditionName !== void 0 && Object.hasOwn(conditions, conditionName) && conditions[conditionName] === false) {
-				this.logger.debug(`Excluding resource ${logicalId} — condition ${conditionName} is false`);
+				this.logger.debug(`Excluding resource ${displaySafe(logicalId)} — condition ${displaySafe(conditionName)} is false`);
 				continue;
 			}
 			if (logicalId === "__proto__") Object.defineProperty(filteredResources, logicalId, {
@@ -20383,14 +20408,11 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"UserPoolTags",
 			"UserPoolTier",
 			"VerificationMessageTemplate",
+			"WebAuthnFactorConfiguration",
 			"WebAuthnRelyingPartyID",
 			"WebAuthnUserVerification"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["IssuerConfiguration", "not yet implemented by cdkd"],
-			["KeyConfiguration", "not yet implemented by cdkd"],
-			["WebAuthnFactorConfiguration", "No wire path in the PINNED SDK (@aws-sdk/client-cognito-identity-provider 3.1018.0): WebAuthnConfigurationType is {RelyingPartyId?, UserVerification?} and no CreateUserPool/UpdateUserPool field accepts SINGLE_FACTOR | MULTI_FACTOR_WITH_USER_VERIFICATION. This is an SDK-VERSION limit, NOT an API one -- the live API does honour FactorConfiguration (measured us-east-1 2026-08-20: SetUserPoolMfaConfig(ON) on a pool allowing WEB_AUTHN as a first auth factor is rejected with \"Cannot set WebAuthn factor configuration to SINGLE_FACTOR if MFA is required and WebAuthn is an allowed first auth factor\", i.e. the service reads a field the SDK cannot send). RE-EVALUATE THIS ENTRY ON AN SDK BUMP: if WebAuthnConfigurationType gains FactorConfiguration, the property becomes handleable and this entry must go"]
-		]),
+		silentDrop: /* @__PURE__ */ new Map([["IssuerConfiguration", "not yet implemented by cdkd"], ["KeyConfiguration", "not yet implemented by cdkd"]]),
 		createOnlyDrops: /* @__PURE__ */ new Set()
 	}],
 	["AWS::DLM::LifecyclePolicy", {
@@ -22698,10 +22720,31 @@ function repairMalformedResourcesForReadOnly(state) {
 * documents `2` as "PARTIAL — journal kept, idempotent re-run", so a `2` here
 * would tell an operator to re-run a command that attempted nothing.
 */
-function malformedStateRefusalMessage(rawStackName, rawRegion) {
+function malformedStateRefusalMessage(rawStackName, rawRegion, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${malformedStateDiagnosis(stackName, region)} This command can WRITE state, so it refuses rather than continuing: saving over a record whose resource map could not be read would replace the evidence with a well-formed empty one and lose it permanently. Repair or remove the record first. Inspect it with: ${inspectCommand(stackName, region)}`;
+	return inspectTail(`${malformedStateDiagnosis(stackName, region)} This command can WRITE state, so it refuses rather than continuing: saving over a record whose resource map could not be read would replace the evidence with a well-formed empty one and lose it permanently. Repair or remove the record first.`, stackName, region, recovery);
+}
+/**
+* How a READ-ONLY remedy ends a single-command message: on
+* `Inspect it with: <inspectCommand>` — unless the record is a region-less
+* LEGACY one, which that command cannot read (go-to-k/cdkd#3388).
+*
+* A KNOWN stack with NO region is what `cdkd orphan` hands for a legacy
+* `<prefix>/<stack>/state.json` listed with no region, and `cdkd state show`
+* refuses such a record with or without `--stack-region`, so ending on it hands
+* the operator a dead end. That arm names the S3 object instead, through
+* {@link orphanInspectClause}, which already owns the shape (the object path
+* gated on the name rendering exactly, the real prefix and bucket when
+* `recovery` carries them, one location per trailing line).
+*
+* Every other identity keeps the command, so a region-keyed record's text is
+* byte-identical to what it was.
+*/
+function inspectTail(prose, stackName, region, recovery) {
+	if (stackName === void 0 || region !== void 0) return `${prose} Inspect it with: ${inspectCommand(stackName, region)}`;
+	const legacy = orphanInspectClause(stackName, void 0, recovery);
+	return [`${prose} ${legacy.sentence ?? ""}`.trimEnd(), ...legacy.locations ?? []].join("\n");
 }
 /**
 * The destructive template, in the three messages that offer one.
@@ -22746,7 +22789,7 @@ const DROP_RECORD_LINE = `Drop the record: ${DROP_RECORD_TEMPLATE}`;
 * identity here.
 */
 function mayNameTargetWithDestructiveRemedy(stackName, region) {
-	return safeStackName(stackName) === stackName && safeRegion(region) === region && isPasteableIdent(stackName) && isPasteableIdent(region);
+	return rendersExactly(stackName) && rendersExactly(region, SHORT_NAME_MAX_CODE_POINTS) && isPasteableIdent(stackName) && isPasteableIdent(region);
 }
 /**
 * The DESTROY refusal text for the `resources` bag (issue
@@ -22955,7 +22998,7 @@ const STATE_REGION_DIVERGED = "STATE_REGION_DIVERGED";
 */
 function divergentRecordRegionRefusalMessage(stackName, keyRegion, divergentBodyRegion, resourceCount) {
 	const cap = STACK_REF_MAX_CODE_POINTS;
-	const exact = safeIdentifier(stackName, cap) === stackName && safeIdentifier(keyRegion, cap) === keyRegion && isPasteableIdent(stackName) && isPasteableIdent(keyRegion);
+	const exact = rendersExactly(stackName, cap) && rendersExactly(keyRegion, cap) && isPasteableIdent(stackName) && isPasteableIdent(keyRegion);
 	const lists = resourceCount === void 0 ? "its resources map cannot be read" : `it still lists ${resourceCount} resource${resourceCount === 1 ? "" : "s"}`;
 	const kind = describeRegionValueKind(divergentBodyRegion);
 	const opening = exact ? `cdkd will not destroy stack ${shellQuote(safeIdentifier(stackName, cap))} (${shellQuote(safeIdentifier(keyRegion, cap))}): the state record read from that region's key carries a 'region' of its own (${kind}) that is not the key's, and ${lists}` : `cdkd will not destroy the state record this command loaded: it carries a 'region' of its own (${kind}) that is not the region of the key it was read from, and ${lists}`;
@@ -23252,9 +23295,9 @@ function malformedOutputsWarning(rawStackName, rawRegion) {
 * this names the stack, the region, the defect and the remedy, and exits on a
 * code rather than on a stack trace.
 */
-function refuseMalformedState(state, stackName, region) {
+function refuseMalformedState(state, stackName, region, recovery) {
 	if (hasReadableResources(state)) return;
-	throw new CdkdError(malformedStateRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED);
+	throw new CdkdError(malformedStateRefusalMessage(stackName, region, recovery), STATE_RESOURCES_MALFORMED);
 }
 /**
 * The `outputs` half of {@link malformedStateRefusalMessage}, for the same
@@ -23273,10 +23316,10 @@ function refuseMalformedState(state, stackName, region) {
 * Identifiers are sanitized and THEN shell-quoted and the command is emitted
 * LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
 */
-function malformedOutputsRefusalMessage(rawStackName, rawRegion) {
+function malformedOutputsRefusalMessage(rawStackName, rawRegion, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${stackClause(stackName, region)} has no readable 'outputs' map — the record is malformed or truncated. This command can WRITE state, so it refuses rather than continuing: it REBUILDS the bag before saving, and 'Object.entries' walks a string or a list as readily as a map, so a six-character value would be saved back as a well-formed six-key map (a null one as an empty map). That replaces the only signal anything is wrong with a legitimate-looking record, permanently — and the next deploy republishes it into the shared exports index every other stack's Fn::ImportValue resolves against. Repair or remove the record first. Inspect it with: ` + inspectCommand(stackName, region);
+	return inspectTail(`${stackClause(stackName, region)} has no readable 'outputs' map — the record is malformed or truncated. This command can WRITE state, so it refuses rather than continuing: it REBUILDS the bag before saving, and 'Object.entries' walks a string or a list as readily as a map, so a six-character value would be saved back as a well-formed six-key map (a null one as an empty map). That replaces the only signal anything is wrong with a legitimate-looking record, permanently — and the next deploy republishes it into the shared exports index every other stack's Fn::ImportValue resolves against. Repair or remove the record first.`, stackName, region, recovery);
 }
 /**
 * The line `ExportIndexStore`'s rebuild emits for a producer record whose
@@ -23360,9 +23403,9 @@ function malformedExportNamesWarning(rawStackName, rawRegion) {
 * records: a guard written at the rebuild leaves every earlier dereference in
 * front of it.
 */
-function refuseMalformedOutputs(state, stackName, region) {
+function refuseMalformedOutputs(state, stackName, region, recovery) {
 	if (hasReadableOutputs(state)) return;
-	throw markNonRetryable(new CdkdError(malformedOutputsRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED));
+	throw markNonRetryable(new CdkdError(malformedOutputsRefusalMessage(stackName, region, recovery), STATE_RESOURCES_MALFORMED));
 }
 /**
 * The stand-in row a read-only view lists in its `unreadable` set for an
@@ -23393,9 +23436,9 @@ const UNREADABLE_ORPHANS_CONTAINER_ROW = "(orphans container)";
 * ones it cannot see.
 *
 * The ENTRIES are a separate question with a separate answer —
-* `orphans[<i>].properties` is go-to-k/cdkd#3344, and
-* {@link refuseMalformedResourcePropertiesForOrphan} is the guard there. This
-* one says only that the container is a list.
+* {@link unreadableOrphanRecords}, which `cdkd orphan` refuses on through
+* {@link refuseMalformedOrphansForOrphan} (go-to-k/cdkd#3344). This one says
+* only that the container is a list.
 */
 function hasReadableOrphans(state) {
 	return state.orphans === void 0 || Array.isArray(state.orphans);
@@ -23766,15 +23809,26 @@ function dropRecordCommand(stackName, region, recovery) {
 * drop command from a legacy record whose name merely needs quoting — the very
 * path go-to-k/cdkd#3359 built, where `cdkd state show` refuses outright and
 * this command is the way out. Measured: `It's Legacy` loses it.
+*
+* **The ONE spelling of the exactness test in this module** (go-to-k/cdkd#3388).
+* The two DESTROY gates measure through it too, each at the cap its own clause
+* renders at: {@link mayNameTargetWithDestructiveRemedy} passes a region's
+* `SHORT_NAME_MAX_CODE_POINTS`, and `divergentRecordRegionRefusalMessage`
+* this default for both identities. `safeStackName(x) === x` and
+* `safeRegion(x) === x` are this predicate at those two caps, so a site
+* wanting either says so here instead of re-spelling the comparison —
+* `tests/unit/state/malformed-resources-bag.test.ts` refuses a second inline
+* spelling.
 */
-function rendersExactly(value) {
-	return safeIdentifier(value, STACK_REF_MAX_CODE_POINTS) === value;
+function rendersExactly(value, maxCodePoints = STACK_REF_MAX_CODE_POINTS) {
+	return safeIdentifier(value, maxCodePoints) === value;
 }
 /**
 * The remedy command a message ends ON — unless the message also offers the
 * destructive template, in which case it ends the READ's own LINE and
-* {@link DROP_RECORD_LINE} is last (go-to-k/cdkd#3516). Two of the eight call
-* sites are that shape; the rest close their string with it.
+* {@link DROP_RECORD_LINE} is last (go-to-k/cdkd#3516) — the two DESTROY
+* refusals; the rest close their string with it, directly or through
+* {@link inspectTail}.
 */
 function inspectCommand(stackName, region) {
 	if (stackName === void 0) return `cdkd state show ${commandHole("stack")} --stack-region ${commandHole("region")} --json`;
@@ -24094,6 +24148,32 @@ function malformedResourcePropertiesRefusalMessage(rawStackName, rawRegion, logi
 function malformedOrphanResourcePropertiesRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
+	return orphanRefusal(stackName, region, recovery, `${namedPropertyBagsClause(stackName, region, logicalIds)} 'cdkd orphan' REWRITES and SAVES every record it keeps, so it refuses rather than continuing — under '--dry-run' too, because the rewrite audit table a dry run prints is the wrong one. It is not that the save would fabricate a map: an unreadable bag is carried through VERBATIM. It is that this command exists to leave the record deployable by rewriting every reference to an orphaned resource, and a map it cannot read hides whichever references it holds — a string or a number presents none to find, and a list is walked, so its rewrites are recorded into a container that is still not a map. Continuing would rewrite, save, and report success over a record 'cdkd deploy' then REFUSES.`, SURVIVOR_THIRD_WAY_OUT);
+}
+/**
+* The third way out every `cdkd orphan` refusal over a `resources` ENTRY
+* offers, conditioned as {@link malformedOrphanResourcePropertiesRefusalMessage}'s
+* note requires. One spelling for the three refusals scoped to the survivors
+* (the entry, its `properties` and its `attributes`), which make the same
+* promise for the same reason: each subtracts the orphan set.
+*/
+const SURVIVOR_THIRD_WAY_OUT = "A third works only while the CDK app STILL DECLARES the named resource — this refusal covers just the records that would SURVIVE the save, so 'cdkd orphan <its construct path>' removes it and repairs the rest; construct paths come from the synthesized template, so a resource the app no longer declares has none and must take one of the first two.";
+/**
+* What every `cdkd orphan` refusal shares after its own diagnosis: the two
+* template-free ways out, the caller's third, and the pasteable lines.
+*
+* `lead` is the diagnosis AND the harm, which is what differs per container —
+* the rule this module follows for every text. The remedy half does not
+* differ, and a second copy of it is what would drift: it carries the
+* substitution gate, the withheld-identity clause and the per-line commands
+* go-to-k/cdkd#3363 settled. `thirdWayOut` is a full sentence; the ones naming
+* a record outside `resources` cannot offer `cdkd orphan <construct path>` and
+* say so instead.
+*
+* Takes identities ALREADY normalised by the exported builder's
+* {@link absentIfEmpty}, which is where that floor lives.
+*/
+function orphanRefusal(stackName, region, recovery, lead, thirdWayOut, dropCaveat = "") {
 	const inspect = orphanInspectClause(stackName, region, recovery);
 	const listCommand = withheldIdentityListCommand(stackName, region, recovery);
 	const commands = [
@@ -24102,7 +24182,7 @@ function malformedOrphanResourcePropertiesRefusalMessage(rawStackName, rawRegion
 		...inspect.command === void 0 ? [] : [`Inspect the record: ${inspect.command}`]
 	];
 	return [
-		`${namedPropertyBagsClause(stackName, region, logicalIds)} 'cdkd orphan' REWRITES and SAVES every record it keeps, so it refuses rather than continuing — under '--dry-run' too, because the rewrite audit table a dry run prints is the wrong one. It is not that the save would fabricate a map: an unreadable bag is carried through VERBATIM. It is that this command exists to leave the record deployable by rewriting every reference to an orphaned resource, and a map it cannot read hides whichever references it holds — a string or a number presents none to find, and a list is walked, so its rewrites are recorded into a container that is still not a map. Continuing would rewrite, save, and report success over a record 'cdkd deploy' then REFUSES. No state was written. Two ways out need no CDK app: repair the record by hand, or drop it whole with the 'Drop the record' command below, which leaves the live AWS resources standing${withheldIdentityClause(stackName, region)}${withheldRecoveryClause(recovery)}. A third works only while the CDK app STILL DECLARES the named resource — this refusal covers just the records that would SURVIVE the save, so 'cdkd orphan <its construct path>' removes it and repairs the rest; construct paths come from the synthesized template, so a resource the app no longer declares has none and must take one of the first two.` + (inspect.sentence === void 0 ? "" : ` ${inspect.sentence}`),
+		`${lead} No state was written. Two ways out need no CDK app: repair the record by hand, or drop it whole with the 'Drop the record' command below, which leaves the live AWS resources standing${dropCaveat}${withheldIdentityClause(stackName, region)}${withheldRecoveryClause(recovery)}. ` + thirdWayOut + (inspect.sentence === void 0 ? "" : ` ${inspect.sentence}`),
 		...commands,
 		...inspect.locations ?? []
 	].join("\n");
@@ -24210,6 +24290,9 @@ function orphanInspectCommand(stackName, region, recovery) {
 * With `recovery` the path carries the REAL prefix and names the bucket, the
 * way the drop remedy above it is qualified; without it the prefix is a
 * placeholder and the sentence says how to fill it.
+*
+* Its region-less arm is also {@link inspectTail}'s, for the state and outputs
+* refusals `cdkd orphan` raises over the same legacy record (go-to-k/cdkd#3388).
 */
 function orphanInspectClause(stackName, region, recovery) {
 	if (stackName === void 0 || stackName === "") return { command: [`cdkd state show ${commandHole("stack")} --stack-region ${commandHole("region")} --json`, ...recoveryCommandFlags(recovery).flags].join(" ") };
@@ -24247,34 +24330,18 @@ function orphanInspectClause(stackName, region, recovery) {
 * cannot persist a record it is deleting, and because refusing on one would
 * break the recovery path the refusal is otherwise meant to preserve.
 *
-* **It covers `state.resources` ONLY, and the save keeps more than that.**
-* `rewriteResourceReferences` spreads `carriedState`, so `state.orphans[]` —
-* rollback-orphaned records each holding a whole `ResourceState`
-* (go-to-k/cdkd#2934) — rides through untouched, and
-* {@link unreadableResourcePropertyBags} never walks it. A torn bag parked
-* there is therefore still saved, and `computeStackDiff` splices those records
-* into `state.resources` on the next preview. Stated rather than implied,
-* because "the records the save would KEEP" reads wider than what this scans:
-* the gap is go-to-k/cdkd#3344, filed rather than folded in because the remedy
-* differs — an entry in that container has no construct path, so the message's
-* third way out is meaningless for it.
-*
-* **A surviving ENTRY that is not a map is the other gap, and it DOES launder.**
-* This scan asks whether a resource's `properties` is readable; it never asks
-* whether the resource RECORD is. `isReadableBag('abcdef')` is false, so a
-* string entry is skipped here, and then `rewriteResourceReferences`'s
-* `{ ...resource }` spreads it into per-character keys — the record is SAVED as
-* `{"0":"a",…,"dependencies":[]}` and the run reports success. A number entry
-* saves as `{"dependencies":[]}`, a record with no `physicalId`. So the
-* refusal's own text, which says a torn `properties` map is persisted verbatim
-* rather than reshaped, is true of the container it scans and NOT of the one
-* above it.
-*
-* That gap is NOT go-to-k/cdkd#3202's as filed — that issue records only the
-* `null`-entry `TypeError` — and NOT open PR go-to-k/cdkd#3226's, whose file
-* list carries neither `orphan.ts` nor `orphan-rewriter.ts`. A lane closing
-* either one leaves this open, which is why it is named here rather than
-* deferred to them by reference. Filed as go-to-k/cdkd#3350.
+* **It covers the `properties` map of a `state.resources` entry ONLY, and the
+* save keeps more than that.** Three siblings answer for the rest, each its
+* own call because each is its own container with its own consequence:
+* {@link refuseMalformedResourceEntriesForOrphan} for an entry that is not a
+* record at all — the one shape the save RESHAPES rather than carries
+* (go-to-k/cdkd#3350) — {@link refuseMalformedResourceAttributesForOrphan} for
+* the entry's `attributes` map (go-to-k/cdkd#3345), and
+* {@link refuseMalformedOrphansForOrphan} for `state.orphans[]`, which the
+* rewrite spreads through `carriedState` without reading (go-to-k/cdkd#3344).
+* This scan skips an entry that is not an object, which is why the first of
+* them has to exist: its "carried through VERBATIM" sentence is true of the
+* container it scans and false of the one above it.
 *
 * CALL IT AT THE LOAD, beside {@link refuseMalformedState} and
 * {@link refuseMalformedOutputs}, above `rewriteResourceReferences` — the
@@ -24362,8 +24429,9 @@ function isReadableResourceEntry(entry) {
 * and refusing would stop the command documented as the way to UNWIND a stack
 * whose state is already suspect. The other callers (`cdkd import`,
 * `cdkd orphan`, `cdkd scrub`) each owe their own classification; `cdkd orphan`
-* does still throw on an unreadable sibling, which is why that one is tracked on
-* go-to-k/cdkd#3202 rather than answered here by a shared refusal.
+* answers through its own entry point on this class,
+* {@link refuseMalformedResourceEntriesForOrphan}, scoped to the records its
+* save keeps (go-to-k/cdkd#3350).
 *
 * So the entry rule is OPT-IN, taken by a flow that dereferences EVERY entry and
 * writes the record back.
@@ -24503,6 +24571,171 @@ function malformedResourceEntriesRefusalMessage(rawStackName, rawRegion, logical
 	const region = absentIfEmpty(rawRegion);
 	return `${namedEntriesClause(stackName, region, logicalIds)} This command can WRITE state, so it refuses rather than skipping them: saving over the record would report a clean run for entries nothing could read, and would leave the next command to fail on them with no more to go on. Nothing was locked, read from AWS or written FOR THIS STACK. Inspect it with: ` + inspectCommand(stackName, region);
 }
+/**
+* For `cdkd orphan`: refuse a record whose SURVIVING `resources` entries are
+* not readable resource records (go-to-k/cdkd#3350).
+*
+* The ENTRY class's predicate ({@link unreadableResourceEntries}), scoped to
+* the survivors exactly as the `properties` refusal is: an entry this run
+* DROPS is never saved, and `cdkd orphan` over the damaged record is the way
+* out of it, so the orphan set is subtracted. The drop is safe because the
+* rewriter will not RESOLVE a reference through an unreadable orphaned record —
+* it reports the site as unresolvable instead (`src/analyzer/orphan-rewriter.ts`).
+*
+* A second entry point on the class rather than a widening of
+* {@link refuseMalformedResourceEntries}, whose text says nothing was LOCKED —
+* false here, where the lock is taken before the load — and names no way out.
+*/
+function refuseMalformedResourceEntriesForOrphan(state, removedLogicalIds, stackName, region, recovery) {
+	const removed = new Set(removedLogicalIds);
+	const unreadable = unreadableResourceEntries(state).filter((id) => !removed.has(id));
+	if (unreadable.length === 0) return;
+	throw new CdkdError(malformedOrphanResourceEntriesRefusalMessage(stackName, region, unreadable, recovery), STATE_RESOURCES_MALFORMED);
+}
+/**
+* The text {@link refuseMalformedResourceEntriesForOrphan} raises.
+*
+* **This is the one container the save RESHAPES**, so the `properties`
+* refusal's "carried through VERBATIM" must not be borrowed. Measured through
+* the real rewrite, which rebuilds each kept record as
+* `{ ...resource, properties, dependencies }`: `"abcdef"` saved as
+* `{"0":"a",…,"5":"f","dependencies":[]}`, `5` and `true` as
+* `{"dependencies":[]}` (no `physicalId` at all), `[{"Ref":"O"}]` as
+* `{"0":{"Ref":"O"},"dependencies":[]}` with the reference to the orphan left
+* UNREWRITTEN — the failure this command exists to prevent — and `null` threw
+* `Cannot read properties of null`. An object with no `resourceType` is the
+* one shape carried as it stands.
+*/
+function malformedOrphanResourceEntriesRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return orphanRefusal(stackName, region, recovery, `${namedEntriesClause(stackName, region, logicalIds)} 'cdkd orphan' REWRITES and SAVES every record it keeps, so it refuses rather than continuing — under '--dry-run' too, so a dry run never prints a plan the real run refuses. The rewrite rebuilds each kept record by copying its fields, and a value that is not an object does not survive the copy: a string or a list is saved as one key per character or element — a list's references to an orphaned resource left UNREWRITTEN — a number or a boolean as a record with no physical id, and null stops the run on a bare TypeError. An object with no resource type is saved as it stands. Continuing would save a record no cdkd command wrote and report success.`, SURVIVOR_THIRD_WAY_OUT);
+}
+/**
+* Whether an ENTRY's `attributes` map — the `Fn::GetAtt` cache — can be read.
+*
+* ABSENT IS READABLE: the field is optional on `ResourceState` and plenty of
+* records carry none. `null` is NOT, the split {@link hasReadableOutputs}
+* draws for its own container: the resolver's cached-attribute read gates on
+* `!== undefined` and then indexes the map, so a `null` passes the gate and a
+* string or a list answers for keys it does not hold.
+*/
+function hasReadableAttributes(entry) {
+	const attributes = entry.attributes;
+	return attributes === void 0 || isReadableBag(attributes);
+}
+/**
+* The logical ids whose `resources` entry carries an `attributes` map that
+* cannot be read (go-to-k/cdkd#3345). Like {@link unreadableResourcePropertyBags}
+* it skips an entry that is not an object — that is the ENTRY class's to name —
+* and returns `[]` for an unreadable bag.
+*/
+function unreadableResourceAttributeBags(state) {
+	if (!hasReadableResources(state)) return [];
+	return Object.entries(state.resources).filter(([, entry]) => isReadableBag(entry) && !hasReadableAttributes(entry)).map(([logicalId]) => logicalId);
+}
+/**
+* For `cdkd orphan`: refuse a record whose SURVIVING entries carry an
+* unreadable `attributes` map (go-to-k/cdkd#3345). Scoped to the survivors for
+* the reason {@link refuseMalformedResourceEntriesForOrphan} is; an ORPHANED
+* entry's map is the `--force` cache, and the rewriter reads that one as
+* holding nothing instead of indexing it.
+*/
+function refuseMalformedResourceAttributesForOrphan(state, removedLogicalIds, stackName, region, recovery) {
+	const removed = new Set(removedLogicalIds);
+	const unreadable = unreadableResourceAttributeBags(state).filter((id) => !removed.has(id));
+	if (unreadable.length === 0) return;
+	throw new CdkdError(malformedOrphanResourceAttributesRefusalMessage(stackName, region, unreadable, recovery), STATE_RESOURCES_MALFORMED);
+}
+/**
+* The text {@link refuseMalformedResourceAttributesForOrphan} raises.
+*
+* Measured through the real rewrite: `"abcdef"`, `5`, `0`, `""`, `false` and
+* `null` are carried into the save byte for byte (the falsy ones skip
+* `rewriteValue` and survive through the spread), and `[{"Ref":"O"}]` is
+* WALKED, coming back `["<physical id>"]` — a rewrite recorded into a container
+* that is still not a map, the `properties` refusal's list case one field over.
+*/
+function malformedOrphanResourceAttributesRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	const named = logicalIds.slice(0, NAMED_UNREADABLE_ENTRIES).map((id) => displayLogicalId(id)).join(", ");
+	const rest = logicalIds.length - NAMED_UNREADABLE_ENTRIES;
+	const more = rest > 0 ? ` and ${rest} more` : "";
+	return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} holds ${logicalIds.length} resource record(s) whose 'attributes' map cannot be read — ${named}${more} — because it is null or not an object. The record is malformed or truncated. 'cdkd orphan' REWRITES and SAVES every record it keeps, so it refuses rather than continuing — under '--dry-run' too, so a dry run never prints a plan the real run refuses. The map is carried into the save VERBATIM, and a list is walked, so its rewrites are recorded into a container that is still not a map. It is the cache a later 'cdkd deploy' reads another resource's 'Fn::GetAtt' of this one from, so continuing would report success over the one map that read depends on.`, SURVIVOR_THIRD_WAY_OUT);
+}
+/**
+* The `orphans[]` records a reader cannot use: a record that is not an object
+* or has no string `logicalId`, whose `state` is not a readable resource entry,
+* or whose `state` carries an unreadable `properties` or `attributes` map
+* (go-to-k/cdkd#3344). The `logicalId` half is go-to-k/cdkd#3500's row
+* predicate: rows with none all key one map entry, and `orphansAfterRollback`
+* collapses them into one.
+*
+* Every `ResourceState` question the `resources` side answers in separate
+* predicates, asked in ONE here: a rollback-orphan record is reached only as a
+* whole — `computeStackDiff` and the deploy's adoption pass splice the record
+* into `resources` — so which part of it is torn does not change what a caller
+* can do with it. Returns `[]` for a container that is not a list, which is
+* {@link hasReadableOrphans}'s to report. Each record is named by its
+* `logicalId`, or `''` (rendered as the `UNRENDERABLE` stand-in) when it has
+* no string one — the convention {@link malformedOrphanRecordsWarning} takes.
+*/
+function unreadableOrphanRecords(state) {
+	if (!Array.isArray(state.orphans)) return [];
+	return state.orphans.filter((record) => {
+		if (!isReadableBag(record)) return true;
+		if (typeof record.logicalId !== "string") return true;
+		const entry = record.state;
+		return !isReadableResourceEntry(entry) || !isReadableBag(entry.properties) || !hasReadableAttributes(entry);
+	}).map((record) => {
+		const id = isReadableBag(record) ? record.logicalId : void 0;
+		return typeof id === "string" ? id : "";
+	});
+}
+/**
+* For `cdkd orphan`: refuse a record whose `orphans` list, or any record in
+* it, cannot be read (go-to-k/cdkd#3344).
+*
+* A THIRD entry point on the `orphans` container, beside
+* {@link refuseMalformedOrphans} and its destroy twin, because neither text is
+* true here. The rewrite neither walks nor rebuilds this container — it
+* spreads it through `carriedState` VERBATIM (measured: `"abc"` comes back
+* `"abc"`, a record whose `state.properties` is `"abcdef"` comes back byte for
+* byte) — so the rollback text's "written back as a list of character-shaped
+* orphan records" would be false. What this command does is SAVE it, report
+* success, and leave the damage for the next deploy or diff to meet.
+*
+* NOT scoped by the orphan set: these records are not in `resources`, so
+* `cdkd orphan` cannot name one, and its save keeps every one of them.
+*/
+function refuseMalformedOrphansForOrphan(state, stackName, region, recovery) {
+	if (!hasReadableOrphans(state)) throw new CdkdError(malformedOrphansForOrphanRefusalMessage(stackName, region, void 0, recovery), STATE_RESOURCES_MALFORMED);
+	const unreadable = unreadableOrphanRecords(state);
+	if (unreadable.length === 0) return;
+	throw new CdkdError(malformedOrphansForOrphanRefusalMessage(stackName, region, unreadable, recovery), STATE_RESOURCES_MALFORMED);
+}
+/** See {@link orphanRefusal}'s `dropCaveat`. */
+const ORPHANS_DROP_CAVEAT = "; it also discards the 'orphans' list, the only record of resources an earlier failed deploy left live in AWS";
+/**
+* The text {@link refuseMalformedOrphansForOrphan} raises: the CONTAINER arm
+* when `logicalIds` is `undefined`, the RECORDS arm otherwise.
+*
+* Its third way out is not {@link SURVIVOR_THIRD_WAY_OUT}: a record in
+* `orphans` has no construct path, so `cdkd orphan` cannot remove it, and the
+* hand repair that remains must not be a deletion — the record is the only
+* evidence that an earlier failed deploy left its resource live in AWS.
+*/
+function malformedOrphansForOrphanRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	const verbatim = "'cdkd orphan' carries it into the record it saves VERBATIM, without reading it, so it refuses rather than continuing — under '--dry-run' too, so a dry run never prints a plan the real run refuses.";
+	if (logicalIds === void 0) return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} has no readable 'orphans' list — the record is malformed or truncated. ${verbatim} The next 'cdkd deploy' refuses the same record, so continuing would only report success over it and leave that refusal one command later.`, "'cdkd orphan' cannot address this list at all, and rewriting it to [] by hand discards the only record of resources an earlier failed deploy left live in AWS.", ORPHANS_DROP_CAVEAT);
+	const named = logicalIds.slice(0, NAMED_UNREADABLE_ENTRIES).map((id) => displayLogicalId(id)).join(", ");
+	const rest = logicalIds.length - NAMED_UNREADABLE_ENTRIES;
+	const more = rest > 0 ? ` and ${rest} more` : "";
+	return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read — ${named}${more} — because the record has no string 'logicalId', its 'state' is not an object or names no resource type, or that state's 'properties' or 'attributes' map is not one. The record is malformed or truncated. ${verbatim} Those records are not inert: they are what the next 'cdkd deploy' may re-adopt into 'resources' and what 'cdkd diff' previews for adoption, so continuing would report success over damage the next command meets.`, "'cdkd orphan' cannot remove such a record itself: it is not in 'resources', so it has no construct path. Repair the record by hand rather than deleting it — it is the only record that an earlier failed deploy left its resource live in AWS.", ORPHANS_DROP_CAVEAT);
+}
 
 //#endregion
 //#region src/analyzer/diff-calculator.ts
@@ -29973,7 +30206,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (carriedBefore === 0) return;
 		if (inheritedSecretsCarriedBy(this.coerceParameterValue(userValue, paramDef.Type), inherited).length >= carriedBefore) return;
 		const loggedName = this.displayMasked(name);
-		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Nested-stack parameter '${loggedName}' is declared 'Type: ${paramDef.Type}', but the parent stack resolved a SECRET dynamic reference into it. cdkd keeps a resolved secret out of persisted state by rewriting STRING leaves back to their {{resolve:...}} expression; coercing this value to '${paramDef.Type}' destroys the plaintext cdkd would have matched on, so the DECRYPTED secret would be left in the child stack's state.json with nothing to redact it back to. Declare '${loggedName}' as 'Type: String' in the nested stack's template (CDK does this by default for cross-stack references), or stop passing a secret reference into it.`, void 0, "NESTED_STACK_SECRET_PARAMETER_TYPE"));
+		const loggedType = this.displayMasked(paramDef.Type);
+		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Nested-stack parameter '${loggedName}' is declared 'Type: ${loggedType}', but the parent stack resolved a SECRET dynamic reference into it. cdkd keeps a resolved secret out of persisted state by rewriting STRING leaves back to their {{resolve:...}} expression; coercing this value to '${loggedType}' destroys the plaintext cdkd would have matched on, so the DECRYPTED secret would be left in the child stack's state.json with nothing to redact it back to. Declare '${loggedName}' as 'Type: String' in the nested stack's template (CDK does this by default for cross-stack references), or stop passing a secret reference into it.`, void 0, "NESTED_STACK_SECRET_PARAMETER_TYPE"));
 	}
 	/**
 	* Resolve Ref intrinsic function
@@ -29987,7 +30221,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const resource = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
 		if (resource) {
 			const refValue = this.resolveRefValue(logicalId, resource, context);
-			this.logger.debug(`Resolved Ref to resource: ${this.displayMasked(logicalId, context)} -> ${refValue}`);
+			this.logger.debug(`Resolved Ref to resource: ${this.displayMasked(logicalId, context)} -> ${this.displayMasked(String(refValue), context)}`);
 			return refValue;
 		}
 		if (context.parameters && Object.hasOwn(context.parameters, logicalId)) {
@@ -30001,7 +30235,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const pseudoValue = await this.resolvePseudoParameter(logicalId, context);
 		if (pseudoValue !== void 0) {
 			const valueStr = typeof pseudoValue === "symbol" ? pseudoValue.toString() : String(pseudoValue);
-			this.logger.debug(`Resolved Ref to pseudo parameter: ${logicalId} -> ${valueStr}`);
+			this.logger.debug(`Resolved Ref to pseudo parameter: ${logicalId} -> ${this.displayMasked(valueStr, context)}`);
 			return pseudoValue;
 		}
 		const loggedLogicalId = this.displayMasked(logicalId, context);
@@ -30174,7 +30408,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			attributeName = resolvedAttributeName;
 		} else {
 			const split = splitGetAttStringForm(getAtt);
-			if (split === void 0) throw markNonRetryable(/* @__PURE__ */ new Error(`Invalid Fn::GetAtt format: ${getAtt}`));
+			if (split === void 0) throw markNonRetryable(/* @__PURE__ */ new Error(`Invalid Fn::GetAtt format: ${this.displayMasked(getAtt, context)}`));
 			logicalId = split.logicalId;
 			attributeName = split.attributeName;
 		}
@@ -30259,8 +30493,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* which reads the SAME persisted `attributes` bag and shipped without the
 	* note (it takes it now). The rule the note actually needs is about the
 	* SOURCE of the value — every branch serving one out of a PERSISTED
-	* `attributes` bag must call this — and that is not a shape a compiler can
-	* enforce. `constructGuardedAttribute`'s return is deliberately outside it:
+	* `attributes` bag must call this, and so must one serving (or embedding) a
+	* persisted `properties` leaf, which a mask-only needle masks whole
+	* (go-to-k/cdkd#2936: the VPC `CidrBlock` and Events rule `Arn` arms) — and
+	* that is not a shape a compiler can enforce. `constructGuardedAttribute`'s return is deliberately outside it:
 	* that value is fetched from AWS in this run, not read back from state, so
 	* it can be neither a stale mask nor a value a provider declared `NoEcho`.
 	*
@@ -30348,7 +30584,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* predate the enrichment and `cdkd deploy` is what heals it.
 	*/
 	unenrichedRemedy(resourceType, attributeName, outcome, context) {
-		const fileIssue = `Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.displayMasked(attributeName, context)}.`;
+		const fileIssue = `Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${this.displayMasked(resourceType, context)}.${this.displayMasked(attributeName, context)}.`;
 		if (outcome === void 0) return `If this record was written by an older cdkd that did not record the attribute yet, 'cdkd deploy' re-reads it from AWS and heals the record. ${fileIssue}`;
 		if (outcome.kind === "read") {
 			if (this.healWithheld(outcome, attributeName)) return this.withheldRemedy();
@@ -30491,7 +30727,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async constructGuardedAttribute(resource, attributeName, context, logicalId) {
 		const accountInfo = await getAccountInfo(this.resolverRegion);
 		const value = await this.constructAttribute(resource, attributeName, context, logicalId, accountInfo);
-		if (accountInfo.fabricated && embedsAccountId(value, accountInfo.accountId)) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: STS did not report this deploy's account id, so cdkd would build the value from the placeholder account ${accountInfo.accountId} — structurally valid, naming a different account, and indistinguishable downstream from a real one. Fix the AWS credentials (or set AWS_ACCOUNT_ID to this deploy's account) and deploy again.`);
+		if (accountInfo.fabricated && embedsAccountId(value, accountInfo.accountId)) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${this.displayMasked(resource.resourceType, context)}: STS did not report this deploy's account id, so cdkd would build the value from the placeholder account ${accountInfo.accountId} — structurally valid, naming a different account, and indistinguishable downstream from a real one. Fix the AWS credentials (or set AWS_ACCOUNT_ID to this deploy's account) and deploy again.`);
 		return value;
 	}
 	/**
@@ -30528,28 +30764,29 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		}
 		if (resourceType === "AWS::EC2::VPC") switch (attributeName) {
 			case "VpcId": return physicalId;
-			case "CidrBlock": return resource.attributes?.["CidrBlock"] || resource.properties?.["CidrBlock"];
+			case "CidrBlock": return this.noteAttributeSecrecy(logicalId, attributeName, resource.attributes?.["CidrBlock"] || resource.properties?.["CidrBlock"], context);
 			case "Ipv6CidrBlocks": try {
 				const ec2 = this.clientsForRegion(this.explicitRegion).ec2;
 				const maxAttempts = 15;
+				const loggedId = this.displayMasked(String(physicalId), context);
 				for (let attempt = 1; attempt <= maxAttempts; attempt++) {
 					const associations = (await ec2.send(new DescribeVpcsCommand({ VpcIds: [physicalId] }))).Vpcs?.[0]?.Ipv6CidrBlockAssociationSet || [];
 					const blocks = associations.filter((a) => a.Ipv6CidrBlockState?.State === "associated").map((a) => a.Ipv6CidrBlock);
 					if (blocks.length > 0) {
-						this.logger.debug(`Resolved VPC Ipv6CidrBlocks for ${physicalId}: ${this.displayMasked(JSON.stringify(this.maskValueLeaves(blocks, context)), context)}`);
+						this.logger.debug(`Resolved VPC Ipv6CidrBlocks for ${loggedId}: ${this.displayMasked(JSON.stringify(this.maskValueLeaves(blocks, context)), context)}`);
 						return blocks;
 					}
 					if (associations.filter((a) => a.Ipv6CidrBlockState?.State === "associating").length === 0) {
-						this.logger.debug(`No IPv6 CIDR associations found for VPC ${physicalId}`);
+						this.logger.debug(`No IPv6 CIDR associations found for VPC ${loggedId}`);
 						return [];
 					}
-					this.logger.debug(`VPC ${physicalId} IPv6 CIDR still associating (attempt ${attempt}/${maxAttempts}), waiting...`);
+					this.logger.debug(`VPC ${loggedId} IPv6 CIDR still associating (attempt ${attempt}/${maxAttempts}), waiting...`);
 					await new Promise((resolve) => setTimeout(resolve, 2e3));
 				}
-				this.logger.warn(`VPC ${physicalId} IPv6 CIDR did not reach 'associated' state after ${maxAttempts} attempts`);
+				this.logger.warn(`VPC ${loggedId} IPv6 CIDR did not reach 'associated' state after ${maxAttempts} attempts`);
 				return [];
 			} catch (error) {
-				this.logger.warn(`Failed to fetch VPC Ipv6CidrBlocks for ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+				this.logger.warn(`Failed to fetch VPC Ipv6CidrBlocks for ${this.displayMasked(String(physicalId), context)}: ${this.displayMasked(error instanceof Error ? error.message : String(error), context)}`);
 				return [];
 			}
 			case "DefaultSecurityGroup": {
@@ -30626,7 +30863,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (resourceType === "AWS::Events::Rule") switch (attributeName) {
 			case "Arn": {
 				if (physicalId.startsWith("arn:")) return physicalId;
-				const busRaw = resource.properties?.["EventBusName"];
+				const busRaw = this.noteAttributeSecrecy(logicalId, attributeName, resource.properties?.["EventBusName"], context);
 				const bus = typeof busRaw === "string" && busRaw && busRaw !== "default" ? busRaw : "";
 				const busName = bus.startsWith("arn:") ? bus.split("/").pop() || "" : bus;
 				return busName ? `arn:${partition}:events:${region}:${accountId}:rule/${busName}/${physicalId}` : `arn:${partition}:events:${region}:${accountId}:rule/${physicalId}`;
@@ -30674,7 +30911,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				const { GetNamespaceCommand } = await import("@aws-sdk/client-servicediscovery");
 				return (await (await this.serviceDiscoveryClient()).send(new GetNamespaceCommand({ Id: physicalId }))).Namespace?.Properties?.DnsProperties?.HostedZoneId;
 			} catch (error) {
-				this.logger.warn(`Failed to fetch HostedZoneId for namespace ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+				this.logger.warn(`Failed to fetch HostedZoneId for namespace ${this.displayMasked(String(physicalId), context)}: ${this.displayMasked(error instanceof Error ? error.message : String(error), context)}`);
 				return;
 			}
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
@@ -30875,7 +31112,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					const value = attributeName === "LatestVersionNumber" ? lt?.LatestVersionNumber : lt?.DefaultVersionNumber;
 					if (value !== void 0 && value !== null) return String(value);
 				} catch (err) {
-					this.logger.warn(`DescribeLaunchTemplates(${physicalId}) failed for ${this.displayMasked(attributeName, context)}: ${this.displayMasked(err instanceof Error ? err.message : String(err), context)}`);
+					this.logger.warn(`DescribeLaunchTemplates(${this.displayMasked(String(physicalId), context)}) failed for ${this.displayMasked(attributeName, context)}: ${this.displayMasked(err instanceof Error ? err.message : String(err), context)}`);
 				}
 				return attributeName === "LatestVersionNumber" ? "$Latest" : "$Default";
 			}
@@ -30982,7 +31219,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*/
 	refuseUnservedAttribute(site) {
 		const { logicalId, attributeName, resourceType, physicalId, context, observed, remedy } = site;
-		throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: ${observed}. The physical id "${this.displayMasked(physicalId, context)}" is not a usable ${this.displayMasked(attributeName, context)}, so cdkd refuses to substitute it. ${remedy}`);
+		throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${this.displayMasked(resourceType, context)}: ${observed}. The physical id "${this.displayMasked(physicalId, context)}" is not a usable ${this.displayMasked(attributeName, context)}, so cdkd refuses to substitute it. ${remedy}`);
 	}
 	/**
 	* The `observed` clause of {@link refuseUnservedAttribute} for a live read
@@ -31028,20 +31265,21 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (context?.staleAttributeHeal?.phase === "probe") throw new StaleAttributeMissSignal();
 		const healOutcome = context?.staleAttributeHeal?.phase === "settled" ? context.staleAttributeHeal.outcome : void 0;
 		const recordMayBeStale = healOutcome?.kind === "failed" || healOutcome?.kind === "not-found";
+		const loggedType = this.displayMasked(resourceType, context);
 		const expectsArnShape = attributeName.endsWith("Arn") && !physicalId.startsWith("arn:");
 		const expectsUrlShape = attributeName.endsWith("Url") && !/^https?:\/\//.test(physicalId);
 		if (expectsArnShape || expectsUrlShape) {
 			const expectedShape = expectsArnShape ? "an ARN (arn:...)" : "a URL (http(s)://...)";
-			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: ` + (recordMayBeStale ? `the state record holds no value for it, and the physical ID ` : `attributes are not enriched for this resource type, and the physical ID `) + `fallback "${this.displayMasked(physicalId, context)}" is not ${expectedShape}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). ` + (recordMayBeStale ? this.staleRecordRemedy(healOutcome, context) : this.unenrichedRemedy(resourceType, attributeName, healOutcome, context))));
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${loggedType}: ` + (recordMayBeStale ? `the state record holds no value for it, and the physical ID ` : `attributes are not enriched for this resource type, and the physical ID `) + `fallback "${this.displayMasked(physicalId, context)}" is not ${expectedShape}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). ` + (recordMayBeStale ? this.staleRecordRemedy(healOutcome, context) : this.unenrichedRemedy(resourceType, attributeName, healOutcome, context))));
 		}
-		if (this.strictGetAtt) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: ` + (recordMayBeStale ? `the state record holds no value for it, and --strict-getatt ` : `attributes are not enriched for this resource type, and --strict-getatt `) + `rejects the physical ID fallback "${this.displayMasked(physicalId, context)}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning. ` + (recordMayBeStale ? this.staleRecordRemedy(healOutcome, context) : this.unenrichedRemedy(resourceType, attributeName, healOutcome, context))));
+		if (this.strictGetAtt) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${loggedType}: ` + (recordMayBeStale ? `the state record holds no value for it, and --strict-getatt ` : `attributes are not enriched for this resource type, and --strict-getatt `) + `rejects the physical ID fallback "${this.displayMasked(physicalId, context)}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning. ` + (recordMayBeStale ? this.staleRecordRemedy(healOutcome, context) : this.unenrichedRemedy(resourceType, attributeName, healOutcome, context))));
 		this.physicalIdFallbackCount++;
 		if (recordMayBeStale) {
-			this.logger.warn(`The state record for ${this.displayMasked(logicalId, context)} (${resourceType}) holds no ${this.displayMasked(attributeName, context)}, returning physical ID. ` + this.staleRecordRemedy(healOutcome, context));
+			this.logger.warn(`The state record for ${this.displayMasked(logicalId, context)} (${loggedType}) holds no ${this.displayMasked(attributeName, context)}, returning physical ID. ` + this.staleRecordRemedy(healOutcome, context));
 			return physicalId;
 		}
 		const withheld = healOutcome?.kind === "read" && this.healWithheld(healOutcome, attributeName) ? `. ${this.withheldRemedy()}` : "";
-		this.logger.warn(`Unknown attribute ${this.displayMasked(attributeName, context)} for resource type ${resourceType}, returning physical ID${withheld}`);
+		this.logger.warn(`Unknown attribute ${this.displayMasked(attributeName, context)} for resource type ${loggedType}, returning physical ID${withheld}`);
 		return physicalId;
 	}
 	/**
@@ -31375,11 +31613,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const resolvedList = await this.resolveValue(list, context);
 		if (!Array.isArray(resolvedList)) throw new Error(`Fn::Select: list must be an array, got ${typeof resolvedList}`);
 		if (index < 0 || index >= resolvedList.length) {
-			this.logger.warn(`Fn::Select: index ${index} out of bounds (array length: ${resolvedList.length})`);
+			this.logger.warn(`Fn::Select: index ${this.displayMasked(String(index), context)} out of bounds (array length: ${resolvedList.length})`);
 			return `{{Fn::Select:${index}:OutOfBounds}}`;
 		}
 		const result = resolvedList[index];
-		this.logger.debug(`Resolved Fn::Select: index ${index} -> ${JSON.stringify(this.maskValueLeaves(result, context))}`);
+		this.logger.debug(`Resolved Fn::Select: index ${this.displayMasked(String(index), context)} -> ${JSON.stringify(this.maskValueLeaves(result, context))}`);
 		return result;
 	}
 	/**
@@ -31524,7 +31762,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		}
 		const result = resolvedValue.split(delimiter);
 		const pieceTwins = this.splitLogTwins(resolvedValue, delimiter, result, context);
-		this.logger.debug(`Resolved Fn::Split: split by "${delimiter}" -> ${JSON.stringify(this.maskValueLeaves(pieceTwins, context))}`);
+		this.logger.debug(`Resolved Fn::Split: split by "${this.displayMasked(String(delimiter), context)}" -> ${JSON.stringify(this.maskValueLeaves(pieceTwins, context))}`);
 		return result;
 	}
 	/**
@@ -32121,7 +32359,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		let roleArn;
 		if ("RoleArn" in args && args["RoleArn"] !== void 0 && args["RoleArn"] !== null) {
 			const raw = args["RoleArn"];
-			if (typeof raw !== "string" || raw === "") throw new Error(`Fn::GetStackOutput: RoleArn must be a literal string in the template (no Ref / Fn::GetAtt / Fn::Sub allowed for cross-account references). Got ${raw === null ? "null" : Array.isArray(raw) ? "array" : typeof raw}${typeof raw === "object" ? ` (intrinsic shape: ${JSON.stringify(raw).slice(0, 80)})` : ""}.`);
+			if (typeof raw !== "string" || raw === "") throw new Error(`Fn::GetStackOutput: RoleArn must be a literal string in the template (no Ref / Fn::GetAtt / Fn::Sub allowed for cross-account references). Got ${raw === null ? "null" : Array.isArray(raw) ? "array" : typeof raw}${typeof raw === "object" ? ` (intrinsic shape: ${this.displayMasked(JSON.stringify(raw).slice(0, 80), context)})` : ""}.`);
 			roleArn = raw;
 		}
 		if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw new Error(`Fn::GetStackOutput: cannot reference own stack '${this.displayMasked(stackName, context)}' in the same region '${this.displayMasked(loggedRegionText, context)}'`);
@@ -32265,7 +32503,15 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* {@link positionalNameMask} turns them into the transform and owns why.
 	*/
 	maskStateReadError(error, pairs, context) {
-		const extraMask = this.positionalNameMask(pairs);
+		throw this.maskNamedError(error, this.positionalNameMask(pairs), context);
+	}
+	/**
+	* {@link maskStateReadError}'s body, RETURNING the masked clone rather than
+	* throwing it, so {@link namedRequestMasks} can hand the same answer to an
+	* SDK call site (go-to-k/cdkd#3171). `extraMask` is a
+	* {@link positionalNameMask} transform, or `undefined` for none.
+	*/
+	maskNamedError(error, extraMask, context) {
 		let masked = error;
 		let positional = extraMask;
 		for (const bag of [context?.inheritedSecrets, context?.recordedSecretValues]) {
@@ -32274,7 +32520,57 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			positional = void 0;
 		}
 		if (positional) masked = maskSecretsInError(masked, /* @__PURE__ */ new Map(), positional);
-		throw masked;
+		return masked;
+	}
+	/**
+	* The three masks an AWS SDK call site owes the text the SDK produces about a
+	* request that carried template-derived NAMES (go-to-k/cdkd#3171).
+	*
+	* The resolver masks every name it prints ITSELF through the name's log text
+	* (go-to-k/cdkd#3150), but an SDK rejection QUOTES the name it refused back —
+	* `ParameterNotFound: <name>`, a region in a describe failure — and that
+	* text reached only the needle mask, whose substring arm has the
+	* {@link MIN_NEEDLE_LENGTH} floor. A name an `Fn::Sub` assembled around a
+	* 1-3 character secret printed masked in the resolver's own words and in the
+	* clear a few characters later, in the SDK's.
+	*
+	* `pairs` are (raw name as SENT, that name's log text), the same shape
+	* {@link positionalNameMask} takes and for the same reason; an unmasked pair
+	* is dropped there. ONE helper returning all three, so a call site cannot
+	* adopt one and miss the others:
+	*
+	* - `error` — a masked CLONE of the whole cause chain
+	*   ({@link maskNamedError}), which keeps the class and every own descriptor,
+	*   so `isThrottlingError` / `isMarkedNonRetryable` still classify it;
+	* - `text` — a caught message about to be interpolated into a line or a
+	*   throw, positional pass first, then {@link displayMasked};
+	* - `retryLogger` — for `withRetry`, whose per-attempt `debug` line and
+	*   give-up `warn` interpolate the SDK message verbatim.
+	*
+	* THE WHOLE NAME is the key, never its secret span alone: the substitution
+	* rewrites every occurrence of the raw name wherever the SDK put it (inside
+	* an ARN, after a colon). That is what reaches a sub-floor secret — the
+	* whole name is longer than the secret — and it is also the bound: a name
+	* the SDK re-encodes or truncates before quoting it is not matched, and a
+	* masked name of 1-3 characters is matched only where the SDK quotes it
+	* exactly, which may over-mask unrelated text (the SAFE direction
+	* {@link positionalNameMask} documents).
+	*/
+	namedRequestMasks(pairs, context) {
+		const positional = this.positionalNameMask(this.explicitRegion !== void 0 && this.explicitRegionLogText !== void 0 ? [...pairs, [this.explicitRegion, this.explicitRegionLogText]] : pairs);
+		const text = (message) => this.displayMasked(positional ? positional(message) : message, context);
+		const line = (message) => {
+			const indent = /^ */.exec(message)?.[0] ?? "";
+			return indent + text(message.slice(indent.length));
+		};
+		return {
+			error: (error) => this.maskNamedError(error, positional, context),
+			text,
+			retryLogger: {
+				debug: (message) => this.logger.debug(line(message)),
+				warn: (message) => this.logger.warn(line(message))
+			}
+		};
 	}
 	/**
 	* Read the producer's state from the SAME AWS account (no RoleArn).
@@ -32453,7 +32749,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				Values: ["available"]
 			}] }))).AvailabilityZones || []).map((az) => az.ZoneName).filter((name) => name !== void 0).sort();
 		} catch (error) {
-			throw new Error(`Fn::GetAZs: failed to describe availability zones for region '${this.displayMasked(loggedRegionText ?? region, context)}': ${this.displayMasked(error instanceof Error ? error.message : String(error), context)}`);
+			const loggedRegion = this.displayMasked(loggedRegionText ?? region, context);
+			const masks = this.namedRequestMasks([[region, loggedRegion]], context);
+			throw new Error(`Fn::GetAZs: failed to describe availability zones for region '${loggedRegion}': ${masks.text(error instanceof Error ? error.message : String(error))}`);
 		}
 		if (azNames.length === 0) throw new Error(`Fn::GetAZs: no availability zones returned for region '${this.displayMasked(loggedRegionText ?? region, context)}'. Either the region is not enabled on this account (opt-in regions must be enabled before use), or the request was answered by a different region's endpoint.`);
 		cachedAvailabilityZones[region] = azNames;
@@ -32562,9 +32860,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* One constructor for both walks so neither can grow a second masking rule:
 	* `subject` and `message` are the only fields a consumer may render, and each
 	* carries its own route to a plaintext — an assembled reference puts one in
-	* the raw token (issue #2827), and an SDK rejection arrives RAW through
-	* `sendWithThrottleRetry` echoing the `Name` it was handed. `error` is kept
-	* unmasked on purpose and is documented as classification-only.
+	* the raw token (issue #2827), and an SDK rejection echoes the `Name` it was
+	* handed — which `sendWithThrottleRetry` now masks by position before it
+	* rethrows (go-to-k/cdkd#3171), so this is the second layer on that route.
+	* `error` is not re-masked here and is documented as classification-only.
 	*/
 	abandonedUnit(unit, subject, error, context, rawInput, preRedact) {
 		const raw = error instanceof Error ? error.message : String(error);
@@ -33320,7 +33619,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			...versionStage && versionStage !== "" && { VersionStage: versionStage },
 			...versionId && versionId !== "" && { VersionId: versionId }
 		});
-		const secretString = (await this.sendWithThrottleRetry(() => client.send(command), `secretsmanager:${loggedSecretId}`)).SecretString;
+		const secretString = (await this.sendWithThrottleRetry(() => client.send(command), `secretsmanager:${loggedSecretId}`, this.namedRequestMasks([
+			[secretId, loggedSecretId],
+			[versionStage, this.displayMasked(nameLogText(versionStage), context)],
+			[versionId, this.displayMasked(nameLogText(versionId), context)]
+		], context))).SecretString;
 		if (!secretString) throw new Error(`Dynamic reference: secret '${loggedSecretId}' does not contain a SecretString value`);
 		if (jsonKey) try {
 			const parsed = JSON.parse(secretString);
@@ -33355,7 +33658,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const count = Number(await this.resolveValue(rawCount, context));
 		const cidrBits = Number(await this.resolveValue(rawCidrBits, context));
 		if (!ipBlock || typeof ipBlock !== "string") throw new Error(`Fn::Cidr: ipBlock must be a string, got ${typeof ipBlock}: ${JSON.stringify(this.maskValueLeaves(ipBlock, context))}`);
-		this.logger.debug(`Resolving Fn::Cidr: ipBlock=${this.displayMasked(JSON.stringify(this.maskValueLeaves(ipBlock, context)), context)}, count=${count}, cidrBits=${cidrBits}`);
+		this.logger.debug(`Resolving Fn::Cidr: ipBlock=${this.displayMasked(JSON.stringify(this.maskValueLeaves(ipBlock, context)), context)}, count=${this.displayMasked(String(count), context)}, cidrBits=${this.displayMasked(String(cidrBits), context)}`);
 		const isIpv6 = ipBlock.includes(":");
 		const results = [];
 		if (isIpv6) {
@@ -33451,13 +33754,17 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*   sibling in the SAME region still shares the ambient instance, so the
 	*   window survives exactly where the two stacks agree on the region.
 	*/
-	sendWithThrottleRetry(operation, label) {
-		return withRetry(operation, label, {
-			maxRetries: MAX_DYNAMIC_REFERENCE_THROTTLE_RETRIES,
-			isRetryable: (_message, error) => isThrottlingError(error),
-			logger: this.logger,
-			...dynamicReferenceRetryDelays.sleep ? { sleep: dynamicReferenceRetryDelays.sleep } : {}
-		});
+	async sendWithThrottleRetry(operation, label, masks) {
+		try {
+			return await withRetry(operation, label, {
+				maxRetries: MAX_DYNAMIC_REFERENCE_THROTTLE_RETRIES,
+				isRetryable: (_message, error) => isThrottlingError(error),
+				logger: masks.retryLogger,
+				...dynamicReferenceRetryDelays.sleep ? { sleep: dynamicReferenceRetryDelays.sleep } : {}
+			});
+		} catch (error) {
+			throw masks.error(error);
+		}
 	}
 	/**
 	* Resolve an `{{resolve:ssm:...}}` dynamic reference, reporting whether the
@@ -33484,14 +33791,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			Name: parameterName,
 			WithDecryption: decrypt
 		});
-		const response = await this.sendWithThrottleRetry(() => client.send(command), `${service}:${loggedParameterName}`);
+		const response = await this.sendWithThrottleRetry(() => client.send(command), `${service}:${loggedParameterName}`, this.namedRequestMasks([[parameterName, loggedParameterName]], context));
 		const paramValue = response.Parameter?.Value;
 		if (paramValue === void 0 || paramValue === null) throw new Error(`Dynamic reference: SSM parameter '${loggedParameterName}' not found or has no value`);
 		const paramType = response.Parameter?.Type;
 		const secure = paramType !== "String" && paramType !== "StringList";
 		if (secure && paramType !== "SecureString" && !this.warnedUnrecognizedSsmTypes.has(injectiveKey(parameterName, String(paramType)))) {
 			this.warnedUnrecognizedSsmTypes.add(injectiveKey(parameterName, String(paramType)));
-			const reported = paramType === void 0 ? "(absent)" : `'${String(paramType)}'`;
+			const reported = paramType === void 0 ? "(absent)" : `'${this.displayMasked(String(paramType), context)}'`;
 			this.logger.warn(`SSM parameter '${loggedParameterName}' reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:${service}:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`);
 		}
 		return {
@@ -35175,7 +35482,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CLqajoRp.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-_vdcb9QG.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -38598,7 +38905,7 @@ const MUTUALLY_EXCLUSIVE_PROPERTIES = /* @__PURE__ */ new Map([["AWS::EC2::Route
 * different questions about the shape and should not drift into one another's
 * behavior by accident.
 */
-function isUnresolvedIntrinsic(value) {
+function isUnresolvedIntrinsic$1(value) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
 	const keys = Object.keys(value);
 	return keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"));
@@ -38615,7 +38922,7 @@ function isUnresolvedIntrinsic(value) {
 * NOT yet known, so it is excluded ahead of the truthiness test.
 */
 function isDeclared(value) {
-	if (isUnresolvedIntrinsic(value)) return false;
+	if (isUnresolvedIntrinsic$1(value)) return false;
 	return Boolean(value);
 }
 /**
@@ -38643,7 +38950,7 @@ function findViolationsForRules(resourceType, rules, templateProperties) {
 	for (const rule of rules) {
 		const declared = rule.properties.filter((property) => isDeclared(templateProperties[property]));
 		if (declared.length <= 1) continue;
-		const winnerCertain = !rule.properties.slice(0, rule.properties.indexOf(declared[0])).some((property) => isUnresolvedIntrinsic(templateProperties[property]));
+		const winnerCertain = !rule.properties.slice(0, rule.properties.indexOf(declared[0])).some((property) => isUnresolvedIntrinsic$1(templateProperties[property]));
 		violations.push({
 			resourceType,
 			rule,
@@ -38677,6 +38984,1526 @@ function buildMutuallyExclusiveMessage(logicalId, violation) {
 	return `  - ${logicalId} (${resourceType}) declares ${declared.join(" and ")}\n      ${rule.rationale}${winnerNote}\n      Declare at most one of: ${rule.properties.join(" / ")}`;
 }
 
+//#endregion
+//#region src/provisioning/nested-required.generated.ts
+/**
+* AUTO-GENERATED by scripts/gen-nested-required.ts — DO NOT EDIT BY HAND.
+* Source: the `nestedRequired` section of tests/fixtures/cfn-schemas/*.json.
+* Regenerate: `vp run gen:nested-required`.
+*
+* Per resource type, each nested property PATH (dotted, arrays transparent)
+* mapped to the members its schema definition lists as `required`. What the
+* SCHEMA says, not what CloudFormation enforces: the pre-flight refusal in
+* `nested-required.ts` reads it only for types measured to be enforced.
+*/
+const NESTED_REQUIRED = /* @__PURE__ */ new Map([
+	["AWS::ApiGateway::Deployment", /* @__PURE__ */ new Map([["StageDescription.Tags", ["Key", "Value"]]])],
+	["AWS::ApiGateway::Method", /* @__PURE__ */ new Map([
+		["Integration", ["Type"]],
+		["Integration.IntegrationResponses", ["StatusCode"]],
+		["MethodResponses", ["StatusCode"]]
+	])],
+	["AWS::ApiGateway::Stage", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::ApiGatewayV2::Route", /* @__PURE__ */ new Map([["RequestParameters", ["Required"]]])],
+	["AWS::AppSync::DataSource", /* @__PURE__ */ new Map([
+		["DynamoDBConfig", ["AwsRegion", "TableName"]],
+		["DynamoDBConfig.DeltaSyncConfig", [
+			"BaseTableTTL",
+			"DeltaSyncTableName",
+			"DeltaSyncTableTTL"
+		]],
+		["ElasticsearchConfig", ["AwsRegion", "Endpoint"]],
+		["EventBridgeConfig", ["EventBusArn"]],
+		["HttpConfig", ["Endpoint"]],
+		["HttpConfig.AuthorizationConfig", ["AuthorizationType"]],
+		["LambdaConfig", ["LambdaFunctionArn"]],
+		["OpenSearchServiceConfig", ["AwsRegion", "Endpoint"]],
+		["RelationalDatabaseConfig", ["RelationalDatabaseSourceType"]],
+		["RelationalDatabaseConfig.RdsHttpEndpointConfig", [
+			"AwsRegion",
+			"AwsSecretStoreArn",
+			"DbClusterIdentifier"
+		]]
+	])],
+	["AWS::AppSync::GraphQLApi", /* @__PURE__ */ new Map([
+		["AdditionalAuthenticationProviders", ["AuthenticationType"]],
+		["EnhancedMetricsConfig", [
+			"DataSourceLevelMetricsBehavior",
+			"OperationLevelMetricsConfig",
+			"ResolverLevelMetricsBehavior"
+		]],
+		["LogConfig", ["CloudWatchLogsRoleArn", "FieldLogLevel"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::AppSync::Resolver", /* @__PURE__ */ new Map([
+		["CachingConfig", ["Ttl"]],
+		["Runtime", ["Name", "RuntimeVersion"]],
+		["SyncConfig", ["ConflictDetection"]]
+	])],
+	["AWS::AutoScaling::AutoScalingGroup", /* @__PURE__ */ new Map([
+		["AvailabilityZoneImpairmentPolicy", ["ImpairedZoneHealthCheckBehavior", "ZonalShiftEnabled"]],
+		["CapacityReservationSpecification", ["CapacityReservationPreference"]],
+		["LaunchTemplate", ["Version"]],
+		["LifecycleHookSpecificationList", ["LifecycleHookName", "LifecycleTransition"]],
+		["MetricsCollection", ["Granularity"]],
+		["MixedInstancesPolicy", ["LaunchTemplate"]],
+		["MixedInstancesPolicy.InstancesDistribution.DistributionSegments", ["TargetCapacityTypes"]],
+		["MixedInstancesPolicy.LaunchTemplate", ["LaunchTemplateSpecification"]],
+		["MixedInstancesPolicy.LaunchTemplate.LaunchTemplateSpecification", ["Version"]],
+		["MixedInstancesPolicy.LaunchTemplate.Overrides.InstanceRequirements", ["MemoryMiB", "VCpuCount"]],
+		["MixedInstancesPolicy.LaunchTemplate.Overrides.LaunchTemplateSpecification", ["Version"]],
+		["NotificationConfiguration", ["TopicARN"]],
+		["NotificationConfigurations", ["TopicARN"]],
+		["Tags", [
+			"Key",
+			"PropagateAtLaunch",
+			"Value"
+		]],
+		["TrafficSources", ["Identifier", "Type"]]
+	])],
+	["AWS::BedrockAgentCore::Evaluator", /* @__PURE__ */ new Map([
+		["EvaluatorConfig.CodeBased", ["LambdaConfig"]],
+		["EvaluatorConfig.CodeBased.LambdaConfig", ["LambdaArn"]],
+		["EvaluatorConfig.LlmAsAJudge", [
+			"Instructions",
+			"ModelConfig",
+			"RatingScale"
+		]],
+		["EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig", ["ModelId"]],
+		["EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig", ["ModelId"]],
+		["EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical", ["Definition", "Label"]],
+		["EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical", [
+			"Definition",
+			"Label",
+			"Value"
+		]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::BedrockAgentCore::Runtime", /* @__PURE__ */ new Map([
+		["AgentRuntimeArtifact.CodeConfiguration", [
+			"Code",
+			"EntryPoint",
+			"Runtime"
+		]],
+		["AgentRuntimeArtifact.CodeConfiguration.Code.S3", ["Bucket", "Prefix"]],
+		["AgentRuntimeArtifact.ContainerConfiguration", ["ContainerUri"]],
+		["AuthorizerConfiguration.CustomJWTAuthorizer", ["DiscoveryUrl"]],
+		["AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.HostingEnvironments", ["Arn"]],
+		["AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims", [
+			"AuthorizingClaimMatchValue",
+			"InboundTokenClaimName",
+			"InboundTokenClaimValueType"
+		]],
+		["AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims.AuthorizingClaimMatchValue", ["ClaimMatchOperator", "ClaimMatchValue"]],
+		["AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides", ["Domain", "PrivateEndpoint"]],
+		["CapacityProviderConfiguration", ["CapacityProviderArn"]],
+		["FilesystemConfigurations.CapacityProviderVolume", ["MountPath", "VolumeName"]],
+		["FilesystemConfigurations.EfsAccessPoint", ["AccessPointArn", "MountPath"]],
+		["FilesystemConfigurations.S3FilesAccessPoint", ["AccessPointArn", "MountPath"]],
+		["FilesystemConfigurations.SessionStorage", ["MountPath"]],
+		["NetworkConfiguration", ["NetworkMode"]],
+		["NetworkConfiguration.NetworkModeConfig", ["SecurityGroups", "Subnets"]],
+		["WorkloadIdentityDetails", ["WorkloadIdentityArn"]]
+	])],
+	["AWS::Budgets::Budget", /* @__PURE__ */ new Map([
+		["Budget", ["BudgetType", "TimeUnit"]],
+		["Budget.AutoAdjustData", ["AutoAdjustType"]],
+		["Budget.AutoAdjustData.HistoricalOptions", ["BudgetAdjustmentPeriod"]],
+		["Budget.BudgetLimit", ["Amount", "Unit"]],
+		["NotificationsWithSubscribers", ["Notification", "Subscribers"]],
+		["NotificationsWithSubscribers.Notification", [
+			"ComparisonOperator",
+			"NotificationType",
+			"Threshold"
+		]],
+		["NotificationsWithSubscribers.Subscribers", ["Address", "SubscriptionType"]],
+		["ResourceTags", ["Key"]]
+	])],
+	["AWS::CertificateManager::Certificate", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::CloudFormation::Stack", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::CloudFront::CloudFrontOriginAccessIdentity", /* @__PURE__ */ new Map([["CloudFrontOriginAccessIdentityConfig", ["Comment"]]])],
+	["AWS::CloudFront::Distribution", /* @__PURE__ */ new Map([
+		["DistributionConfig", ["DefaultCacheBehavior", "Enabled"]],
+		["DistributionConfig.CacheBehaviors", [
+			"PathPattern",
+			"TargetOriginId",
+			"ViewerProtocolPolicy"
+		]],
+		["DistributionConfig.CacheBehaviors.ForwardedValues", ["QueryString"]],
+		["DistributionConfig.CacheBehaviors.ForwardedValues.Cookies", ["Forward"]],
+		["DistributionConfig.CacheBehaviors.GrpcConfig", ["Enabled"]],
+		["DistributionConfig.CacheTagConfig", ["HeaderName"]],
+		["DistributionConfig.ConnectionFunctionAssociation", ["Id"]],
+		["DistributionConfig.CustomErrorResponses", ["ErrorCode"]],
+		["DistributionConfig.CustomOrigin", [
+			"DNSName",
+			"OriginProtocolPolicy",
+			"OriginSSLProtocols"
+		]],
+		["DistributionConfig.DefaultCacheBehavior", ["TargetOriginId", "ViewerProtocolPolicy"]],
+		["DistributionConfig.DefaultCacheBehavior.ForwardedValues", ["QueryString"]],
+		["DistributionConfig.DefaultCacheBehavior.ForwardedValues.Cookies", ["Forward"]],
+		["DistributionConfig.DefaultCacheBehavior.GrpcConfig", ["Enabled"]],
+		["DistributionConfig.OriginGroups", ["Quantity"]],
+		["DistributionConfig.OriginGroups.Items", [
+			"FailoverCriteria",
+			"Id",
+			"Members"
+		]],
+		["DistributionConfig.OriginGroups.Items.FailoverCriteria", ["StatusCodes"]],
+		["DistributionConfig.OriginGroups.Items.FailoverCriteria.StatusCodes", ["Items", "Quantity"]],
+		["DistributionConfig.OriginGroups.Items.Members", ["Items", "Quantity"]],
+		["DistributionConfig.OriginGroups.Items.Members.Items", ["OriginId"]],
+		["DistributionConfig.Origins", ["DomainName", "Id"]],
+		["DistributionConfig.Origins.CustomOriginConfig", ["OriginProtocolPolicy"]],
+		["DistributionConfig.Origins.CustomOriginConfig.OriginMtlsConfig", ["ClientCertificateArn"]],
+		["DistributionConfig.Origins.OriginCustomHeaders", ["HeaderName", "HeaderValue"]],
+		["DistributionConfig.Origins.VpcOriginConfig", ["VpcOriginId"]],
+		["DistributionConfig.Restrictions", ["GeoRestriction"]],
+		["DistributionConfig.Restrictions.GeoRestriction", ["RestrictionType"]],
+		["DistributionConfig.S3Origin", ["DNSName"]],
+		["DistributionConfig.TenantConfig.ParameterDefinitions", ["Definition", "Name"]],
+		["DistributionConfig.TenantConfig.ParameterDefinitions.Definition.StringSchema", ["Required"]],
+		["DistributionConfig.ViewerMtlsConfig.TrustStoreConfig", ["TrustStoreId"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::CloudFront::OriginAccessControl", /* @__PURE__ */ new Map([["OriginAccessControlConfig", [
+		"Name",
+		"OriginAccessControlOriginType",
+		"SigningBehavior",
+		"SigningProtocol"
+	]]])],
+	["AWS::CloudTrail::Trail", /* @__PURE__ */ new Map([
+		["AdvancedEventSelectors", ["FieldSelectors"]],
+		["AdvancedEventSelectors.FieldSelectors", ["Field"]],
+		["AggregationConfigurations", ["EventCategory", "Templates"]],
+		["EventSelectors.DataResources", ["Type"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::CloudWatch::Alarm", /* @__PURE__ */ new Map([
+		["Dimensions", ["Name", "Value"]],
+		["Metrics", ["Id"]],
+		["Metrics.MetricStat", [
+			"Metric",
+			"Period",
+			"Stat"
+		]],
+		["Metrics.MetricStat.Metric.Dimensions", ["Name", "Value"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::CloudWatch::AnomalyDetector", /* @__PURE__ */ new Map([
+		["Configuration.ExcludedTimeRanges", ["EndTime", "StartTime"]],
+		["Dimensions", ["Name", "Value"]],
+		["MetricMathAnomalyDetector.MetricDataQueries", ["Id"]],
+		["MetricMathAnomalyDetector.MetricDataQueries.MetricStat", [
+			"Metric",
+			"Period",
+			"Stat"
+		]],
+		["MetricMathAnomalyDetector.MetricDataQueries.MetricStat.Metric", ["MetricName", "Namespace"]],
+		["MetricMathAnomalyDetector.MetricDataQueries.MetricStat.Metric.Dimensions", ["Name", "Value"]],
+		["SingleMetricAnomalyDetector.Dimensions", ["Name", "Value"]]
+	])],
+	["AWS::CodeBuild::Project", /* @__PURE__ */ new Map([
+		["Artifacts", ["Type"]],
+		["Cache", ["Type"]],
+		["Environment", [
+			"ComputeType",
+			"Image",
+			"Type"
+		]],
+		["Environment.DockerServer", ["ComputeType"]],
+		["Environment.EnvironmentVariables", ["Name", "Value"]],
+		["Environment.RegistryCredential", ["Credential", "CredentialProvider"]],
+		["FileSystemLocations", [
+			"Identifier",
+			"Location",
+			"MountPoint",
+			"Type"
+		]],
+		["LogsConfig.CloudWatchLogs", ["Status"]],
+		["LogsConfig.S3Logs", ["Status"]],
+		["SecondaryArtifacts", ["Type"]],
+		["SecondarySourceVersions", ["SourceIdentifier"]],
+		["SecondarySources", ["Type"]],
+		["SecondarySources.Auth", ["Type"]],
+		["SecondarySources.GitSubmodulesConfig", ["FetchSubmodules"]],
+		["Source", ["Type"]],
+		["Source.Auth", ["Type"]],
+		["Source.GitSubmodulesConfig", ["FetchSubmodules"]],
+		["Tags", ["Key", "Value"]],
+		["Triggers.PullRequestBuildPolicy", ["RequiresCommentApproval"]],
+		["Triggers.ScopeConfiguration", ["Name"]]
+	])],
+	["AWS::CodeCommit::Repository", /* @__PURE__ */ new Map([
+		["Code", ["S3"]],
+		["Code.S3", ["Bucket", "Key"]],
+		["Tags", ["Key", "Value"]],
+		["Triggers", [
+			"DestinationArn",
+			"Events",
+			"Name"
+		]]
+	])],
+	["AWS::Cognito::UserPool", /* @__PURE__ */ new Map([["SmsConfiguration.EumsSms", ["CallerArn"]], ["UserAttributeUpdateSettings", ["AttributesRequireVerificationBeforeUpdate"]]])],
+	["AWS::DLM::LifecyclePolicy", /* @__PURE__ */ new Map([
+		["Exclusions.ExcludeTags", ["Key", "Value"]],
+		["PolicyDetails.Actions", ["CrossRegionCopy", "Name"]],
+		["PolicyDetails.Actions.CrossRegionCopy", ["EncryptionConfiguration", "Target"]],
+		["PolicyDetails.Actions.CrossRegionCopy.EncryptionConfiguration", ["Encrypted"]],
+		["PolicyDetails.Actions.CrossRegionCopy.RetainRule", ["Interval", "IntervalUnit"]],
+		["PolicyDetails.EventSource", ["Type"]],
+		["PolicyDetails.EventSource.Parameters", ["EventType", "SnapshotOwner"]],
+		["PolicyDetails.Exclusions.ExcludeTags", ["Key", "Value"]],
+		["PolicyDetails.Parameters.ExcludeDataVolumeTags", ["Key", "Value"]],
+		["PolicyDetails.Schedules.ArchiveRule", ["RetainRule"]],
+		["PolicyDetails.Schedules.ArchiveRule.RetainRule", ["RetentionArchiveTier"]],
+		["PolicyDetails.Schedules.CrossRegionCopyRules", ["Encrypted"]],
+		["PolicyDetails.Schedules.CrossRegionCopyRules.DeprecateRule", ["Interval", "IntervalUnit"]],
+		["PolicyDetails.Schedules.CrossRegionCopyRules.RetainRule", ["Interval", "IntervalUnit"]],
+		["PolicyDetails.Schedules.TagsToAdd", ["Key", "Value"]],
+		["PolicyDetails.Schedules.VariableTags", ["Key", "Value"]],
+		["PolicyDetails.TargetTags", ["Key", "Value"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::DocDB::DBCluster", /* @__PURE__ */ new Map([["ServerlessV2ScalingConfiguration", ["MaxCapacity", "MinCapacity"]], ["Tags", ["Key", "Value"]]])],
+	["AWS::DocDB::DBInstance", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::DocDB::DBSubnetGroup", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::DynamoDB::GlobalTable", /* @__PURE__ */ new Map([
+		["AttributeDefinitions", ["AttributeName", "AttributeType"]],
+		["GlobalSecondaryIndexes", [
+			"IndexName",
+			"KeySchema",
+			"Projection"
+		]],
+		["GlobalSecondaryIndexes.KeySchema", ["AttributeName", "KeyType"]],
+		["GlobalSecondaryIndexes.WriteProvisionedThroughputSettings.WriteCapacityAutoScalingSettings", [
+			"MaxCapacity",
+			"MinCapacity",
+			"TargetTrackingScalingPolicyConfiguration"
+		]],
+		["GlobalSecondaryIndexes.WriteProvisionedThroughputSettings.WriteCapacityAutoScalingSettings.TargetTrackingScalingPolicyConfiguration", ["TargetValue"]],
+		["KeySchema", ["AttributeName", "KeyType"]],
+		["LocalSecondaryIndexes", [
+			"IndexName",
+			"KeySchema",
+			"Projection"
+		]],
+		["LocalSecondaryIndexes.KeySchema", ["AttributeName", "KeyType"]],
+		["Replicas", ["Region"]],
+		["Replicas.ContributorInsightsSpecification", ["Enabled"]],
+		["Replicas.GlobalSecondaryIndexes", ["IndexName"]],
+		["Replicas.GlobalSecondaryIndexes.ContributorInsightsSpecification", ["Enabled"]],
+		["Replicas.GlobalSecondaryIndexes.ReadProvisionedThroughputSettings.ReadCapacityAutoScalingSettings", [
+			"MaxCapacity",
+			"MinCapacity",
+			"TargetTrackingScalingPolicyConfiguration"
+		]],
+		["Replicas.GlobalSecondaryIndexes.ReadProvisionedThroughputSettings.ReadCapacityAutoScalingSettings.TargetTrackingScalingPolicyConfiguration", ["TargetValue"]],
+		["Replicas.KinesisStreamSpecification", ["StreamArn"]],
+		["Replicas.ReadProvisionedThroughputSettings.ReadCapacityAutoScalingSettings", [
+			"MaxCapacity",
+			"MinCapacity",
+			"TargetTrackingScalingPolicyConfiguration"
+		]],
+		["Replicas.ReadProvisionedThroughputSettings.ReadCapacityAutoScalingSettings.TargetTrackingScalingPolicyConfiguration", ["TargetValue"]],
+		["Replicas.ReplicaStreamSpecification.ResourcePolicy", ["PolicyDocument"]],
+		["Replicas.ReplicaStreamSpecification.Tags", ["Key", "Value"]],
+		["Replicas.ResourcePolicy", ["PolicyDocument"]],
+		["Replicas.SSESpecification", ["KMSMasterKeyId"]],
+		["Replicas.Tags", ["Key", "Value"]],
+		["SSESpecification", ["SSEEnabled"]],
+		["StreamSpecification", ["StreamViewType"]],
+		["TimeToLiveSpecification", ["Enabled"]],
+		["VectorIndexes", [
+			"Dimensions",
+			"DistanceFunction",
+			"IndexName",
+			"Projection",
+			"VectorAttribute"
+		]],
+		["VectorIndexes.SearchSchema", ["AttributeName", "SearchSchemaElementType"]],
+		["VectorIndexes.VectorAttribute", ["AttributeName"]],
+		["WriteProvisionedThroughputSettings.WriteCapacityAutoScalingSettings", [
+			"MaxCapacity",
+			"MinCapacity",
+			"TargetTrackingScalingPolicyConfiguration"
+		]],
+		["WriteProvisionedThroughputSettings.WriteCapacityAutoScalingSettings.TargetTrackingScalingPolicyConfiguration", ["TargetValue"]]
+	])],
+	["AWS::DynamoDB::Table", /* @__PURE__ */ new Map([
+		["AttributeDefinitions", ["AttributeName", "AttributeType"]],
+		["ContributorInsightsSpecification", ["Enabled"]],
+		["GlobalSecondaryIndexes", [
+			"IndexName",
+			"KeySchema",
+			"Projection"
+		]],
+		["GlobalSecondaryIndexes.ContributorInsightsSpecification", ["Enabled"]],
+		["GlobalSecondaryIndexes.KeySchema", ["AttributeName", "KeyType"]],
+		["GlobalSecondaryIndexes.ProvisionedThroughput", ["ReadCapacityUnits", "WriteCapacityUnits"]],
+		["ImportSourceSpecification", ["InputFormat", "S3BucketSource"]],
+		["ImportSourceSpecification.S3BucketSource", ["S3Bucket"]],
+		["KinesisStreamSpecification", ["StreamArn"]],
+		["LocalSecondaryIndexes", [
+			"IndexName",
+			"KeySchema",
+			"Projection"
+		]],
+		["LocalSecondaryIndexes.KeySchema", ["AttributeName", "KeyType"]],
+		["ProvisionedThroughput", ["ReadCapacityUnits", "WriteCapacityUnits"]],
+		["ResourcePolicy", ["PolicyDocument"]],
+		["SSESpecification", ["SSEEnabled"]],
+		["StreamSpecification", ["StreamViewType"]],
+		["StreamSpecification.ResourcePolicy", ["PolicyDocument"]],
+		["StreamSpecification.Tags", ["Key", "Value"]],
+		["Tags", ["Key", "Value"]],
+		["TimeToLiveSpecification", ["Enabled"]],
+		["VectorIndexes", [
+			"Dimensions",
+			"DistanceFunction",
+			"IndexName",
+			"Projection",
+			"VectorAttribute"
+		]],
+		["VectorIndexes.SearchSchema", ["AttributeName", "SearchSchemaElementType"]],
+		["VectorIndexes.VectorAttribute", ["AttributeName"]]
+	])],
+	["AWS::EC2::EIP", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::EC2::Instance", /* @__PURE__ */ new Map([
+		["BlockDeviceMappings", ["DeviceName"]],
+		["ElasticGpuSpecifications", ["Type"]],
+		["ElasticInferenceAccelerators", ["Type"]],
+		["Ipv6Addresses", ["Ipv6Address"]],
+		["LicenseSpecifications", ["LicenseConfigurationArn"]],
+		["NetworkInterfaces", ["DeviceIndex"]],
+		["NetworkInterfaces.Ipv6Addresses", ["Ipv6Address"]],
+		["NetworkInterfaces.PrivateIpAddresses", ["Primary", "PrivateIpAddress"]],
+		["SsmAssociations", ["DocumentName"]],
+		["SsmAssociations.AssociationParameters", ["Key", "Value"]],
+		["Tags", ["Key", "Value"]],
+		["Volumes", ["Device", "VolumeId"]]
+	])],
+	["AWS::EC2::InternetGateway", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::EC2::NatGateway", /* @__PURE__ */ new Map([["AvailabilityZoneAddresses", ["AllocationIds"]], ["Tags", ["Key", "Value"]]])],
+	["AWS::EC2::NetworkAcl", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::EC2::RouteTable", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::EC2::SecurityGroup", /* @__PURE__ */ new Map([
+		["SecurityGroupEgress", ["IpProtocol"]],
+		["SecurityGroupIngress", ["IpProtocol"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::EC2::Subnet", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::EC2::VPC", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::ECR::Repository", /* @__PURE__ */ new Map([
+		["EncryptionConfiguration", ["EncryptionType"]],
+		["ImageTagMutabilityExclusionFilters", ["ImageTagMutabilityExclusionFilterType", "ImageTagMutabilityExclusionFilterValue"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::ECS::Service", /* @__PURE__ */ new Map([
+		["DeploymentConfiguration.Alarms", [
+			"AlarmNames",
+			"Enable",
+			"Rollback"
+		]],
+		["DeploymentConfiguration.DeploymentCircuitBreaker", ["Enable", "Rollback"]],
+		["DeploymentConfiguration.DeploymentCircuitBreaker.ThresholdConfiguration", ["Type", "Value"]],
+		["DeploymentConfiguration.LifecycleHooks", ["LifecycleStages"]],
+		["ForceNewDeployment", ["EnableForceNewDeployment"]],
+		["LoadBalancers.AdvancedConfiguration", ["AlternateTargetGroupArn"]],
+		["Monitoring", ["MetricConfigurations"]],
+		["Monitoring.MetricConfigurations", ["MetricNames", "ResolutionSeconds"]],
+		["PlacementConstraints", ["Type"]],
+		["PlacementStrategies", ["Type"]],
+		["ServiceConnectConfiguration", ["Enabled"]],
+		["ServiceConnectConfiguration.AccessLogConfiguration", ["Format"]],
+		["ServiceConnectConfiguration.LogConfiguration.SecretOptions", ["Name", "ValueFrom"]],
+		["ServiceConnectConfiguration.Services", ["PortName"]],
+		["ServiceConnectConfiguration.Services.ClientAliases", ["Port"]],
+		["ServiceConnectConfiguration.Services.ClientAliases.TestTrafficRules", ["Header"]],
+		["ServiceConnectConfiguration.Services.ClientAliases.TestTrafficRules.Header", ["Name"]],
+		["ServiceConnectConfiguration.Services.ClientAliases.TestTrafficRules.Header.Value", ["Exact"]],
+		["ServiceConnectConfiguration.Services.Tls", ["IssuerCertificateAuthority"]],
+		["VolumeConfigurations", ["Name"]],
+		["VolumeConfigurations.ManagedEBSVolume", ["RoleArn"]],
+		["VolumeConfigurations.ManagedEBSVolume.TagSpecifications", ["ResourceType"]],
+		["VpcLatticeConfigurations", [
+			"PortName",
+			"RoleArn",
+			"TargetGroupArn"
+		]]
+	])],
+	["AWS::ECS::TaskDefinition", /* @__PURE__ */ new Map([
+		["ContainerDefinitions", ["Image", "Name"]],
+		["ContainerDefinitions.LinuxParameters.Tmpfs", ["Size"]],
+		["ContainerDefinitions.LogConfiguration", ["LogDriver"]],
+		["ContainerDefinitions.LogConfiguration.SecretOptions", ["Name", "ValueFrom"]],
+		["ContainerDefinitions.ResourceRequirements", ["Type", "Value"]],
+		["ContainerDefinitions.Secrets", ["Name", "ValueFrom"]],
+		["ContainerDefinitions.Ulimits", [
+			"HardLimit",
+			"Name",
+			"SoftLimit"
+		]],
+		["PlacementConstraints", ["Type"]],
+		["ProxyConfiguration", ["ContainerName"]],
+		["Volumes.EFSVolumeConfiguration", ["FilesystemId"]],
+		["Volumes.FSxWindowsFileServerVolumeConfiguration", ["FileSystemId", "RootDirectory"]],
+		["Volumes.FSxWindowsFileServerVolumeConfiguration.AuthorizationConfig", ["CredentialsParameter", "Domain"]],
+		["Volumes.S3FilesVolumeConfiguration", ["FileSystemArn"]]
+	])],
+	["AWS::EFS::AccessPoint", /* @__PURE__ */ new Map([["PosixUser", ["Gid", "Uid"]], ["RootDirectory.CreationInfo", [
+		"OwnerGid",
+		"OwnerUid",
+		"Permissions"
+	]]])],
+	["AWS::EFS::FileSystem", /* @__PURE__ */ new Map([["BackupPolicy", ["Status"]], ["FileSystemTags", ["Key", "Value"]]])],
+	["AWS::ElastiCache::CacheCluster", /* @__PURE__ */ new Map([
+		["LogDeliveryConfigurations", [
+			"DestinationDetails",
+			"DestinationType",
+			"LogFormat",
+			"LogType"
+		]],
+		["LogDeliveryConfigurations.DestinationDetails.CloudWatchLogsDetails", ["LogGroup"]],
+		["LogDeliveryConfigurations.DestinationDetails.KinesisFirehoseDetails", ["DeliveryStream"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::ElastiCache::SubnetGroup", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::ElasticLoadBalancingV2::Listener", /* @__PURE__ */ new Map([
+		["DefaultActions", ["Type"]],
+		["DefaultActions.AuthenticateCognitoConfig", [
+			"UserPoolArn",
+			"UserPoolClientId",
+			"UserPoolDomain"
+		]],
+		["DefaultActions.AuthenticateOidcConfig", [
+			"AuthorizationEndpoint",
+			"ClientId",
+			"Issuer",
+			"TokenEndpoint",
+			"UserInfoEndpoint"
+		]],
+		["DefaultActions.FixedResponseConfig", ["StatusCode"]],
+		["DefaultActions.JwtValidationConfig", ["Issuer", "JwksEndpoint"]],
+		["DefaultActions.JwtValidationConfig.AdditionalClaims", [
+			"Format",
+			"Name",
+			"Values"
+		]],
+		["DefaultActions.RedirectConfig", ["StatusCode"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::ElasticLoadBalancingV2::LoadBalancer", /* @__PURE__ */ new Map([
+		["MinimumLoadBalancerCapacity", ["CapacityUnits"]],
+		["SubnetMappings", ["SubnetId"]],
+		["Tags", ["Key"]]
+	])],
+	["AWS::ElasticLoadBalancingV2::TargetGroup", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]], ["Targets", ["Id"]]])],
+	["AWS::EMR::Cluster", /* @__PURE__ */ new Map([
+		["BootstrapActions", ["Name", "ScriptBootstrapAction"]],
+		["BootstrapActions.ScriptBootstrapAction", ["Path"]],
+		["Instances.CoreInstanceFleet.InstanceTypeConfigs", ["InstanceType"]],
+		["Instances.CoreInstanceFleet.InstanceTypeConfigs.EbsConfiguration.EbsBlockDeviceConfigs", ["VolumeSpecification"]],
+		["Instances.CoreInstanceFleet.InstanceTypeConfigs.EbsConfiguration.EbsBlockDeviceConfigs.VolumeSpecification", ["SizeInGB", "VolumeType"]],
+		["Instances.CoreInstanceFleet.LaunchSpecifications.OnDemandSpecification", ["AllocationStrategy"]],
+		["Instances.CoreInstanceFleet.LaunchSpecifications.SpotSpecification", ["TimeoutAction", "TimeoutDurationMinutes"]],
+		["Instances.CoreInstanceGroup", ["InstanceCount", "InstanceType"]],
+		["Instances.CoreInstanceGroup.AutoScalingPolicy", ["Constraints", "Rules"]],
+		["Instances.CoreInstanceGroup.AutoScalingPolicy.Constraints", ["MaxCapacity", "MinCapacity"]],
+		["Instances.CoreInstanceGroup.AutoScalingPolicy.Rules", [
+			"Action",
+			"Name",
+			"Trigger"
+		]],
+		["Instances.CoreInstanceGroup.AutoScalingPolicy.Rules.Action", ["SimpleScalingPolicyConfiguration"]],
+		["Instances.CoreInstanceGroup.AutoScalingPolicy.Rules.Action.SimpleScalingPolicyConfiguration", ["ScalingAdjustment"]],
+		["Instances.CoreInstanceGroup.AutoScalingPolicy.Rules.Trigger", ["CloudWatchAlarmDefinition"]],
+		["Instances.CoreInstanceGroup.AutoScalingPolicy.Rules.Trigger.CloudWatchAlarmDefinition", [
+			"ComparisonOperator",
+			"MetricName",
+			"Period",
+			"Threshold"
+		]],
+		["Instances.CoreInstanceGroup.AutoScalingPolicy.Rules.Trigger.CloudWatchAlarmDefinition.Dimensions", ["Key", "Value"]],
+		["Instances.CoreInstanceGroup.EbsConfiguration.EbsBlockDeviceConfigs", ["VolumeSpecification"]],
+		["Instances.CoreInstanceGroup.EbsConfiguration.EbsBlockDeviceConfigs.VolumeSpecification", ["SizeInGB", "VolumeType"]],
+		["Instances.MasterInstanceFleet.InstanceTypeConfigs", ["InstanceType"]],
+		["Instances.MasterInstanceFleet.InstanceTypeConfigs.EbsConfiguration.EbsBlockDeviceConfigs", ["VolumeSpecification"]],
+		["Instances.MasterInstanceFleet.InstanceTypeConfigs.EbsConfiguration.EbsBlockDeviceConfigs.VolumeSpecification", ["SizeInGB", "VolumeType"]],
+		["Instances.MasterInstanceFleet.LaunchSpecifications.OnDemandSpecification", ["AllocationStrategy"]],
+		["Instances.MasterInstanceFleet.LaunchSpecifications.SpotSpecification", ["TimeoutAction", "TimeoutDurationMinutes"]],
+		["Instances.MasterInstanceGroup", ["InstanceCount", "InstanceType"]],
+		["Instances.MasterInstanceGroup.AutoScalingPolicy", ["Constraints", "Rules"]],
+		["Instances.MasterInstanceGroup.AutoScalingPolicy.Constraints", ["MaxCapacity", "MinCapacity"]],
+		["Instances.MasterInstanceGroup.AutoScalingPolicy.Rules", [
+			"Action",
+			"Name",
+			"Trigger"
+		]],
+		["Instances.MasterInstanceGroup.AutoScalingPolicy.Rules.Action", ["SimpleScalingPolicyConfiguration"]],
+		["Instances.MasterInstanceGroup.AutoScalingPolicy.Rules.Action.SimpleScalingPolicyConfiguration", ["ScalingAdjustment"]],
+		["Instances.MasterInstanceGroup.AutoScalingPolicy.Rules.Trigger", ["CloudWatchAlarmDefinition"]],
+		["Instances.MasterInstanceGroup.AutoScalingPolicy.Rules.Trigger.CloudWatchAlarmDefinition", [
+			"ComparisonOperator",
+			"MetricName",
+			"Period",
+			"Threshold"
+		]],
+		["Instances.MasterInstanceGroup.AutoScalingPolicy.Rules.Trigger.CloudWatchAlarmDefinition.Dimensions", ["Key", "Value"]],
+		["Instances.MasterInstanceGroup.EbsConfiguration.EbsBlockDeviceConfigs", ["VolumeSpecification"]],
+		["Instances.MasterInstanceGroup.EbsConfiguration.EbsBlockDeviceConfigs.VolumeSpecification", ["SizeInGB", "VolumeType"]],
+		["Instances.Placement", ["AvailabilityZone"]],
+		["Instances.TaskInstanceFleets.InstanceTypeConfigs", ["InstanceType"]],
+		["Instances.TaskInstanceFleets.InstanceTypeConfigs.EbsConfiguration.EbsBlockDeviceConfigs", ["VolumeSpecification"]],
+		["Instances.TaskInstanceFleets.InstanceTypeConfigs.EbsConfiguration.EbsBlockDeviceConfigs.VolumeSpecification", ["SizeInGB", "VolumeType"]],
+		["Instances.TaskInstanceFleets.LaunchSpecifications.OnDemandSpecification", ["AllocationStrategy"]],
+		["Instances.TaskInstanceFleets.LaunchSpecifications.SpotSpecification", ["TimeoutAction", "TimeoutDurationMinutes"]],
+		["Instances.TaskInstanceGroups", ["InstanceCount", "InstanceType"]],
+		["Instances.TaskInstanceGroups.AutoScalingPolicy", ["Constraints", "Rules"]],
+		["Instances.TaskInstanceGroups.AutoScalingPolicy.Constraints", ["MaxCapacity", "MinCapacity"]],
+		["Instances.TaskInstanceGroups.AutoScalingPolicy.Rules", [
+			"Action",
+			"Name",
+			"Trigger"
+		]],
+		["Instances.TaskInstanceGroups.AutoScalingPolicy.Rules.Action", ["SimpleScalingPolicyConfiguration"]],
+		["Instances.TaskInstanceGroups.AutoScalingPolicy.Rules.Action.SimpleScalingPolicyConfiguration", ["ScalingAdjustment"]],
+		["Instances.TaskInstanceGroups.AutoScalingPolicy.Rules.Trigger", ["CloudWatchAlarmDefinition"]],
+		["Instances.TaskInstanceGroups.AutoScalingPolicy.Rules.Trigger.CloudWatchAlarmDefinition", [
+			"ComparisonOperator",
+			"MetricName",
+			"Period",
+			"Threshold"
+		]],
+		["Instances.TaskInstanceGroups.AutoScalingPolicy.Rules.Trigger.CloudWatchAlarmDefinition.Dimensions", ["Key", "Value"]],
+		["Instances.TaskInstanceGroups.EbsConfiguration.EbsBlockDeviceConfigs", ["VolumeSpecification"]],
+		["Instances.TaskInstanceGroups.EbsConfiguration.EbsBlockDeviceConfigs.VolumeSpecification", ["SizeInGB", "VolumeType"]],
+		["KerberosAttributes", ["KdcAdminPassword", "Realm"]],
+		["ManagedScalingPolicy.ComputeLimits", [
+			"MaximumCapacityUnits",
+			"MinimumCapacityUnits",
+			"UnitType"
+		]],
+		["PlacementGroupConfigs", ["InstanceRole"]],
+		["Steps", ["HadoopJarStep", "Name"]],
+		["Steps.HadoopJarStep", ["Jar"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::EMR::InstanceFleetConfig", /* @__PURE__ */ new Map([
+		["InstanceTypeConfigs", ["InstanceType"]],
+		["InstanceTypeConfigs.EbsConfiguration.EbsBlockDeviceConfigs", ["VolumeSpecification"]],
+		["InstanceTypeConfigs.EbsConfiguration.EbsBlockDeviceConfigs.VolumeSpecification", ["SizeInGB", "VolumeType"]],
+		["LaunchSpecifications.OnDemandSpecification", ["AllocationStrategy"]],
+		["LaunchSpecifications.SpotSpecification", ["TimeoutAction", "TimeoutDurationMinutes"]]
+	])],
+	["AWS::EMR::InstanceGroupConfig", /* @__PURE__ */ new Map([
+		["AutoScalingPolicy", ["Constraints", "Rules"]],
+		["AutoScalingPolicy.Constraints", ["MaxCapacity", "MinCapacity"]],
+		["AutoScalingPolicy.Rules", [
+			"Action",
+			"Name",
+			"Trigger"
+		]],
+		["AutoScalingPolicy.Rules.Action", ["SimpleScalingPolicyConfiguration"]],
+		["AutoScalingPolicy.Rules.Action.SimpleScalingPolicyConfiguration", ["ScalingAdjustment"]],
+		["AutoScalingPolicy.Rules.Trigger", ["CloudWatchAlarmDefinition"]],
+		["AutoScalingPolicy.Rules.Trigger.CloudWatchAlarmDefinition", [
+			"ComparisonOperator",
+			"MetricName",
+			"Period",
+			"Threshold"
+		]],
+		["AutoScalingPolicy.Rules.Trigger.CloudWatchAlarmDefinition.Dimensions", ["Key", "Value"]],
+		["EbsConfiguration.EbsBlockDeviceConfigs", ["VolumeSpecification"]],
+		["EbsConfiguration.EbsBlockDeviceConfigs.VolumeSpecification", ["SizeInGB", "VolumeType"]]
+	])],
+	["AWS::Events::EventBus", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::Events::Rule", /* @__PURE__ */ new Map([
+		["Targets", ["Arn", "Id"]],
+		["Targets.AppSyncParameters", ["GraphQLOperation"]],
+		["Targets.BatchParameters", ["JobDefinition", "JobName"]],
+		["Targets.EcsParameters", ["TaskDefinitionArn"]],
+		["Targets.EcsParameters.CapacityProviderStrategy", ["CapacityProvider"]],
+		["Targets.EcsParameters.NetworkConfiguration.AwsVpcConfiguration", ["Subnets"]],
+		["Targets.InputTransformer", ["InputTemplate"]],
+		["Targets.KinesisParameters", ["PartitionKeyPath"]],
+		["Targets.RedshiftDataParameters", ["Database"]],
+		["Targets.RunCommandParameters", ["RunCommandTargets"]],
+		["Targets.RunCommandParameters.RunCommandTargets", ["Key", "Values"]],
+		["Targets.SageMakerPipelineParameters.PipelineParameterList", ["Name", "Value"]],
+		["Targets.SqsParameters", ["MessageGroupId"]]
+	])],
+	["AWS::FSx::FileSystem", /* @__PURE__ */ new Map([
+		["LustreConfiguration.LogConfiguration", ["Level"]],
+		["OntapConfiguration", ["DeploymentType"]],
+		["OpenZFSConfiguration", ["DeploymentType"]],
+		["Tags", ["Key", "Value"]],
+		["WindowsConfiguration", ["ThroughputCapacity"]],
+		["WindowsConfiguration.AuditLogConfiguration", ["FileAccessAuditLogLevel", "FileShareAccessAuditLogLevel"]],
+		["WindowsConfiguration.FsrmConfiguration", ["FsrmServiceEnabled"]]
+	])],
+	["AWS::Glue::Connection", /* @__PURE__ */ new Map([["ConnectionInput", ["ConnectionType"]], ["ConnectionInput.AuthenticationConfiguration", ["AuthenticationType"]]])],
+	["AWS::Glue::Table", /* @__PURE__ */ new Map([
+		["OpenTableFormatInput.IcebergInput.IcebergTableInput", ["Location", "Schema"]],
+		["OpenTableFormatInput.IcebergInput.IcebergTableInput.PartitionSpec", ["Fields"]],
+		["OpenTableFormatInput.IcebergInput.IcebergTableInput.PartitionSpec.Fields", [
+			"Name",
+			"SourceId",
+			"Transform"
+		]],
+		["OpenTableFormatInput.IcebergInput.IcebergTableInput.Schema", ["Fields"]],
+		["OpenTableFormatInput.IcebergInput.IcebergTableInput.Schema.Fields", [
+			"Id",
+			"Name",
+			"Required",
+			"Type"
+		]],
+		["OpenTableFormatInput.IcebergInput.IcebergTableInput.WriteOrder", ["Fields", "OrderId"]],
+		["OpenTableFormatInput.IcebergInput.IcebergTableInput.WriteOrder.Fields", [
+			"Direction",
+			"NullOrder",
+			"SourceId",
+			"Transform"
+		]],
+		["TableInput.PartitionKeys", ["Name"]],
+		["TableInput.StorageDescriptor.Columns", ["Name"]],
+		["TableInput.StorageDescriptor.SortColumns", ["Column", "SortOrder"]]
+	])],
+	["AWS::Glue::Trigger", /* @__PURE__ */ new Map([["EventBatchingCondition", ["BatchSize"]]])],
+	["AWS::IAM::Group", /* @__PURE__ */ new Map([["Policies", ["PolicyDocument", "PolicyName"]]])],
+	["AWS::IAM::Role", /* @__PURE__ */ new Map([["Policies", ["PolicyDocument", "PolicyName"]], ["Tags", ["Key", "Value"]]])],
+	["AWS::IAM::User", /* @__PURE__ */ new Map([
+		["LoginProfile", ["Password"]],
+		["Policies", ["PolicyDocument", "PolicyName"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::Kinesis::Stream", /* @__PURE__ */ new Map([
+		["StreamEncryption", ["EncryptionType", "KeyId"]],
+		["StreamModeDetails", ["StreamMode"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::Kinesis::StreamConsumer", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::KinesisFirehose::DeliveryStream", /* @__PURE__ */ new Map([
+		["AmazonOpenSearchServerlessDestinationConfiguration", [
+			"IndexName",
+			"RoleARN",
+			"S3Configuration"
+		]],
+		["AmazonOpenSearchServerlessDestinationConfiguration.ProcessingConfiguration.Processors", ["Type"]],
+		["AmazonOpenSearchServerlessDestinationConfiguration.ProcessingConfiguration.Processors.Parameters", ["ParameterName", "ParameterValue"]],
+		["AmazonOpenSearchServerlessDestinationConfiguration.S3Configuration", ["BucketARN", "RoleARN"]],
+		["AmazonOpenSearchServerlessDestinationConfiguration.S3Configuration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["AmazonOpenSearchServerlessDestinationConfiguration.VpcConfiguration", [
+			"RoleARN",
+			"SecurityGroupIds",
+			"SubnetIds"
+		]],
+		["AmazonopensearchserviceDestinationConfiguration", [
+			"IndexName",
+			"RoleARN",
+			"S3Configuration"
+		]],
+		["AmazonopensearchserviceDestinationConfiguration.DocumentIdOptions", ["DefaultDocumentIdFormat"]],
+		["AmazonopensearchserviceDestinationConfiguration.ProcessingConfiguration.Processors", ["Type"]],
+		["AmazonopensearchserviceDestinationConfiguration.ProcessingConfiguration.Processors.Parameters", ["ParameterName", "ParameterValue"]],
+		["AmazonopensearchserviceDestinationConfiguration.S3Configuration", ["BucketARN", "RoleARN"]],
+		["AmazonopensearchserviceDestinationConfiguration.S3Configuration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["AmazonopensearchserviceDestinationConfiguration.VpcConfiguration", [
+			"RoleARN",
+			"SecurityGroupIds",
+			"SubnetIds"
+		]],
+		["DatabaseSourceConfiguration", [
+			"DatabaseSourceAuthenticationConfiguration",
+			"DatabaseSourceVPCConfiguration",
+			"Databases",
+			"Endpoint",
+			"Port",
+			"SnapshotWatermarkTable",
+			"Tables",
+			"Type"
+		]],
+		["DatabaseSourceConfiguration.DatabaseSourceAuthenticationConfiguration", ["SecretsManagerConfiguration"]],
+		["DatabaseSourceConfiguration.DatabaseSourceAuthenticationConfiguration.SecretsManagerConfiguration", ["Enabled"]],
+		["DatabaseSourceConfiguration.DatabaseSourceVPCConfiguration", ["VpcEndpointServiceName"]],
+		["DeliveryStreamEncryptionConfigurationInput", ["KeyType"]],
+		["ElasticsearchDestinationConfiguration", [
+			"IndexName",
+			"RoleARN",
+			"S3Configuration"
+		]],
+		["ElasticsearchDestinationConfiguration.DocumentIdOptions", ["DefaultDocumentIdFormat"]],
+		["ElasticsearchDestinationConfiguration.ProcessingConfiguration.Processors", ["Type"]],
+		["ElasticsearchDestinationConfiguration.ProcessingConfiguration.Processors.Parameters", ["ParameterName", "ParameterValue"]],
+		["ElasticsearchDestinationConfiguration.S3Configuration", ["BucketARN", "RoleARN"]],
+		["ElasticsearchDestinationConfiguration.S3Configuration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["ElasticsearchDestinationConfiguration.VpcConfiguration", [
+			"RoleARN",
+			"SecurityGroupIds",
+			"SubnetIds"
+		]],
+		["ExtendedS3DestinationConfiguration", ["BucketARN", "RoleARN"]],
+		["ExtendedS3DestinationConfiguration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["ExtendedS3DestinationConfiguration.ProcessingConfiguration.Processors", ["Type"]],
+		["ExtendedS3DestinationConfiguration.ProcessingConfiguration.Processors.Parameters", ["ParameterName", "ParameterValue"]],
+		["ExtendedS3DestinationConfiguration.S3BackupConfiguration", ["BucketARN", "RoleARN"]],
+		["ExtendedS3DestinationConfiguration.S3BackupConfiguration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["HttpEndpointDestinationConfiguration", ["EndpointConfiguration", "S3Configuration"]],
+		["HttpEndpointDestinationConfiguration.EndpointConfiguration", ["Url"]],
+		["HttpEndpointDestinationConfiguration.ProcessingConfiguration.Processors", ["Type"]],
+		["HttpEndpointDestinationConfiguration.ProcessingConfiguration.Processors.Parameters", ["ParameterName", "ParameterValue"]],
+		["HttpEndpointDestinationConfiguration.RequestConfiguration.CommonAttributes", ["AttributeName", "AttributeValue"]],
+		["HttpEndpointDestinationConfiguration.S3Configuration", ["BucketARN", "RoleARN"]],
+		["HttpEndpointDestinationConfiguration.S3Configuration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["HttpEndpointDestinationConfiguration.SecretsManagerConfiguration", ["Enabled"]],
+		["IcebergDestinationConfiguration", [
+			"CatalogConfiguration",
+			"RoleARN",
+			"S3Configuration"
+		]],
+		["IcebergDestinationConfiguration.DestinationTableConfigurationList", ["DestinationDatabaseName", "DestinationTableName"]],
+		["IcebergDestinationConfiguration.DestinationTableConfigurationList.PartitionSpec.Identity", ["SourceName"]],
+		["IcebergDestinationConfiguration.ProcessingConfiguration.Processors", ["Type"]],
+		["IcebergDestinationConfiguration.ProcessingConfiguration.Processors.Parameters", ["ParameterName", "ParameterValue"]],
+		["IcebergDestinationConfiguration.S3Configuration", ["BucketARN", "RoleARN"]],
+		["IcebergDestinationConfiguration.S3Configuration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["KinesisStreamSourceConfiguration", ["KinesisStreamARN", "RoleARN"]],
+		["MSKSourceConfiguration", [
+			"AuthenticationConfiguration",
+			"MSKClusterARN",
+			"TopicName"
+		]],
+		["MSKSourceConfiguration.AuthenticationConfiguration", ["Connectivity", "RoleARN"]],
+		["RedshiftDestinationConfiguration", [
+			"ClusterJDBCURL",
+			"CopyCommand",
+			"RoleARN",
+			"S3Configuration"
+		]],
+		["RedshiftDestinationConfiguration.CopyCommand", ["DataTableName"]],
+		["RedshiftDestinationConfiguration.ProcessingConfiguration.Processors", ["Type"]],
+		["RedshiftDestinationConfiguration.ProcessingConfiguration.Processors.Parameters", ["ParameterName", "ParameterValue"]],
+		["RedshiftDestinationConfiguration.S3BackupConfiguration", ["BucketARN", "RoleARN"]],
+		["RedshiftDestinationConfiguration.S3BackupConfiguration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["RedshiftDestinationConfiguration.S3Configuration", ["BucketARN", "RoleARN"]],
+		["RedshiftDestinationConfiguration.S3Configuration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["RedshiftDestinationConfiguration.SecretsManagerConfiguration", ["Enabled"]],
+		["S3DestinationConfiguration", ["BucketARN", "RoleARN"]],
+		["S3DestinationConfiguration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["SnowflakeDestinationConfiguration", [
+			"AccountUrl",
+			"Database",
+			"RoleARN",
+			"S3Configuration",
+			"Schema",
+			"Table"
+		]],
+		["SnowflakeDestinationConfiguration.ProcessingConfiguration.Processors", ["Type"]],
+		["SnowflakeDestinationConfiguration.ProcessingConfiguration.Processors.Parameters", ["ParameterName", "ParameterValue"]],
+		["SnowflakeDestinationConfiguration.S3Configuration", ["BucketARN", "RoleARN"]],
+		["SnowflakeDestinationConfiguration.S3Configuration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["SnowflakeDestinationConfiguration.SecretsManagerConfiguration", ["Enabled"]],
+		["SnowflakeDestinationConfiguration.SnowflakeVpcConfiguration", ["PrivateLinkVpceId"]],
+		["SplunkDestinationConfiguration", [
+			"HECEndpoint",
+			"HECEndpointType",
+			"S3Configuration"
+		]],
+		["SplunkDestinationConfiguration.ProcessingConfiguration.Processors", ["Type"]],
+		["SplunkDestinationConfiguration.ProcessingConfiguration.Processors.Parameters", ["ParameterName", "ParameterValue"]],
+		["SplunkDestinationConfiguration.S3Configuration", ["BucketARN", "RoleARN"]],
+		["SplunkDestinationConfiguration.S3Configuration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["SplunkDestinationConfiguration.SecretsManagerConfiguration", ["Enabled"]],
+		["Tags", ["Key"]]
+	])],
+	["AWS::KMS::Key", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::Lambda::EventInvokeConfig", /* @__PURE__ */ new Map([["DestinationConfig.OnFailure", ["Destination"]], ["DestinationConfig.OnSuccess", ["Destination"]]])],
+	["AWS::Lambda::EventSourceMapping", /* @__PURE__ */ new Map([["Tags", ["Key"]]])],
+	["AWS::Lambda::Function", /* @__PURE__ */ new Map([
+		["CapacityProviderConfig", ["LambdaManagedInstancesCapacityProviderConfig"]],
+		["CapacityProviderConfig.LambdaManagedInstancesCapacityProviderConfig", ["CapacityProviderArn"]],
+		["DurableConfig", ["ExecutionTimeout"]],
+		["EphemeralStorage", ["Size"]],
+		["FileSystemConfigs", ["Arn", "LocalMountPath"]],
+		["RuntimeManagementConfig", ["UpdateRuntimeOn"]],
+		["SnapStart", ["ApplyOn"]],
+		["Tags", ["Key"]],
+		["TenancyConfig", ["TenantIsolationMode"]]
+	])],
+	["AWS::Lambda::LayerVersion", /* @__PURE__ */ new Map([["Content", ["S3Bucket", "S3Key"]]])],
+	["AWS::Lambda::MicrovmImage", /* @__PURE__ */ new Map([
+		["CodeArtifact", ["Uri"]],
+		["CpuConfigurations", ["Architecture"]],
+		["EnvironmentVariables", ["Key", "Value"]],
+		["Resources", ["MinimumMemoryInMiB"]],
+		["Tags", ["Key"]]
+	])],
+	["AWS::Logs::LogGroup", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::Neptune::DBCluster", /* @__PURE__ */ new Map([
+		["AssociatedRoles", ["RoleArn"]],
+		["ServerlessScalingConfiguration", ["MaxCapacity", "MinCapacity"]],
+		["Tags", ["Key"]]
+	])],
+	["AWS::Neptune::DBInstance", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::Neptune::DBSubnetGroup", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::RDS::DBCluster", /* @__PURE__ */ new Map([["AssociatedRoles", ["RoleArn"]], ["Tags", ["Key"]]])],
+	["AWS::RDS::DBInstance", /* @__PURE__ */ new Map([["AssociatedRoles", ["FeatureName", "RoleArn"]], ["Tags", ["Key"]]])],
+	["AWS::RDS::DBSubnetGroup", /* @__PURE__ */ new Map([["Tags", ["Key"]]])],
+	["AWS::Route53::HostedZone", /* @__PURE__ */ new Map([
+		["HostedZoneTags", ["Key", "Value"]],
+		["QueryLoggingConfig", ["CloudWatchLogsLogGroupArn"]],
+		["VPCs", ["VPCId", "VPCRegion"]]
+	])],
+	["AWS::Route53::RecordSet", /* @__PURE__ */ new Map([["AliasTarget", ["DNSName", "HostedZoneId"]], ["CidrRoutingConfig", ["CollectionId", "LocationName"]]])],
+	["AWS::S3::Bucket", /* @__PURE__ */ new Map([
+		["AccelerateConfiguration", ["AccelerationStatus"]],
+		["AnalyticsConfigurations", ["Id", "StorageClassAnalysis"]],
+		["AnalyticsConfigurations.StorageClassAnalysis.DataExport", ["Destination", "OutputSchemaVersion"]],
+		["AnalyticsConfigurations.StorageClassAnalysis.DataExport.Destination", ["BucketArn", "Format"]],
+		["AnalyticsConfigurations.TagFilters", ["Key", "Value"]],
+		["BucketEncryption", ["ServerSideEncryptionConfiguration"]],
+		["BucketEncryption.ServerSideEncryptionConfiguration.ServerSideEncryptionByDefault", ["SSEAlgorithm"]],
+		["CorsConfiguration", ["CorsRules"]],
+		["CorsConfiguration.CorsRules", ["AllowedMethods", "AllowedOrigins"]],
+		["IntelligentTieringConfigurations", [
+			"Id",
+			"Status",
+			"Tierings"
+		]],
+		["IntelligentTieringConfigurations.TagFilters", ["Key", "Value"]],
+		["IntelligentTieringConfigurations.Tierings", ["AccessTier", "Days"]],
+		["InventoryConfigurations", [
+			"Destination",
+			"Enabled",
+			"Id",
+			"IncludedObjectVersions",
+			"ScheduleFrequency"
+		]],
+		["InventoryConfigurations.Destination", ["BucketArn", "Format"]],
+		["LifecycleConfiguration", ["Rules"]],
+		["LifecycleConfiguration.Rules", ["Status"]],
+		["LifecycleConfiguration.Rules.AbortIncompleteMultipartUpload", ["DaysAfterInitiation"]],
+		["LifecycleConfiguration.Rules.NoncurrentVersionExpiration", ["NoncurrentDays"]],
+		["LifecycleConfiguration.Rules.NoncurrentVersionTransition", ["StorageClass", "TransitionInDays"]],
+		["LifecycleConfiguration.Rules.NoncurrentVersionTransitions", ["StorageClass", "TransitionInDays"]],
+		["LifecycleConfiguration.Rules.TagFilters", ["Key", "Value"]],
+		["LifecycleConfiguration.Rules.Transition", ["StorageClass"]],
+		["LifecycleConfiguration.Rules.Transitions", ["StorageClass"]],
+		["MetadataConfiguration", ["JournalTableConfiguration"]],
+		["MetadataConfiguration.AnnotationTableConfiguration", ["ConfigurationState"]],
+		["MetadataConfiguration.AnnotationTableConfiguration.EncryptionConfiguration", ["SseAlgorithm"]],
+		["MetadataConfiguration.Destination", ["TableBucketType"]],
+		["MetadataConfiguration.InventoryTableConfiguration", ["ConfigurationState"]],
+		["MetadataConfiguration.InventoryTableConfiguration.EncryptionConfiguration", ["SseAlgorithm"]],
+		["MetadataConfiguration.JournalTableConfiguration", ["RecordExpiration"]],
+		["MetadataConfiguration.JournalTableConfiguration.EncryptionConfiguration", ["SseAlgorithm"]],
+		["MetadataConfiguration.JournalTableConfiguration.RecordExpiration", ["Expiration"]],
+		["MetadataTableConfiguration", ["S3TablesDestination"]],
+		["MetadataTableConfiguration.S3TablesDestination", ["TableBucketArn", "TableName"]],
+		["MetricsConfigurations", ["Id"]],
+		["MetricsConfigurations.TagFilters", ["Key", "Value"]],
+		["NotificationConfiguration.EventBridgeConfiguration", ["EventBridgeEnabled"]],
+		["NotificationConfiguration.LambdaConfigurations", ["Event", "Function"]],
+		["NotificationConfiguration.LambdaConfigurations.Filter", ["S3Key"]],
+		["NotificationConfiguration.LambdaConfigurations.Filter.S3Key", ["Rules"]],
+		["NotificationConfiguration.LambdaConfigurations.Filter.S3Key.Rules", ["Name", "Value"]],
+		["NotificationConfiguration.QueueConfigurations", ["Event", "Queue"]],
+		["NotificationConfiguration.QueueConfigurations.Filter", ["S3Key"]],
+		["NotificationConfiguration.QueueConfigurations.Filter.S3Key", ["Rules"]],
+		["NotificationConfiguration.QueueConfigurations.Filter.S3Key.Rules", ["Name", "Value"]],
+		["NotificationConfiguration.TopicConfigurations", ["Event", "Topic"]],
+		["NotificationConfiguration.TopicConfigurations.Filter", ["S3Key"]],
+		["NotificationConfiguration.TopicConfigurations.Filter.S3Key", ["Rules"]],
+		["NotificationConfiguration.TopicConfigurations.Filter.S3Key.Rules", ["Name", "Value"]],
+		["OwnershipControls", ["Rules"]],
+		["ReplicationConfiguration", ["Role", "Rules"]],
+		["ReplicationConfiguration.Rules", ["Destination", "Status"]],
+		["ReplicationConfiguration.Rules.Destination", ["Bucket"]],
+		["ReplicationConfiguration.Rules.Destination.AccessControlTranslation", ["Owner"]],
+		["ReplicationConfiguration.Rules.Destination.EncryptionConfiguration", ["ReplicaKmsKeyID"]],
+		["ReplicationConfiguration.Rules.Destination.Metrics", ["Status"]],
+		["ReplicationConfiguration.Rules.Destination.Metrics.EventThreshold", ["Minutes"]],
+		["ReplicationConfiguration.Rules.Destination.ReplicationTime", ["Status", "Time"]],
+		["ReplicationConfiguration.Rules.Destination.ReplicationTime.Time", ["Minutes"]],
+		["ReplicationConfiguration.Rules.Filter.And.TagFilters", ["Key", "Value"]],
+		["ReplicationConfiguration.Rules.Filter.TagFilter", ["Key", "Value"]],
+		["ReplicationConfiguration.Rules.SourceSelectionCriteria.ReplicaModifications", ["Status"]],
+		["ReplicationConfiguration.Rules.SourceSelectionCriteria.SseKmsEncryptedObjects", ["Status"]],
+		["Tags", ["Key", "Value"]],
+		["VersioningConfiguration", ["Status"]],
+		["WebsiteConfiguration.RedirectAllRequestsTo", ["HostName"]],
+		["WebsiteConfiguration.RoutingRules", ["RedirectRule"]]
+	])],
+	["AWS::S3Express::DirectoryBucket", /* @__PURE__ */ new Map([
+		["BucketEncryption", ["ServerSideEncryptionConfiguration"]],
+		["BucketEncryption.ServerSideEncryptionConfiguration.ServerSideEncryptionByDefault", ["SSEAlgorithm"]],
+		["InventoryConfigurations", [
+			"Destination",
+			"Enabled",
+			"Id",
+			"IncludedObjectVersions",
+			"ScheduleFrequency"
+		]],
+		["InventoryConfigurations.Destination", ["BucketArn", "Format"]],
+		["LifecycleConfiguration", ["Rules"]],
+		["LifecycleConfiguration.Rules", ["Status"]],
+		["LifecycleConfiguration.Rules.AbortIncompleteMultipartUpload", ["DaysAfterInitiation"]],
+		["MetricsConfigurations", ["Id"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::S3Tables::Table", /* @__PURE__ */ new Map([
+		["IcebergMetadata.IcebergPartitionSpec", ["Fields"]],
+		["IcebergMetadata.IcebergPartitionSpec.Fields", [
+			"Name",
+			"SourceId",
+			"Transform"
+		]],
+		["IcebergMetadata.IcebergSchema", ["SchemaFieldList"]],
+		["IcebergMetadata.IcebergSchema.SchemaFieldList", ["Name", "Type"]],
+		["IcebergMetadata.IcebergSchemaV2", ["SchemaV2FieldList", "SchemaV2FieldType"]],
+		["IcebergMetadata.IcebergSchemaV2.SchemaV2FieldList", [
+			"Id",
+			"Name",
+			"Required",
+			"Type"
+		]],
+		["IcebergMetadata.IcebergSortOrder", ["Fields"]],
+		["IcebergMetadata.IcebergSortOrder.Fields", [
+			"Direction",
+			"NullOrder",
+			"SourceId",
+			"Transform"
+		]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::S3Tables::TableBucket", /* @__PURE__ */ new Map([
+		["ReplicationConfiguration", ["Role", "Rules"]],
+		["ReplicationConfiguration.Rules", ["Destinations"]],
+		["ReplicationConfiguration.Rules.Destinations", ["DestinationTableBucketARN"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::S3Vectors::VectorBucket", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::Scheduler::Schedule", /* @__PURE__ */ new Map([
+		["FlexibleTimeWindow", ["Mode"]],
+		["Target", ["Arn", "RoleArn"]],
+		["Target.EcsParameters", ["TaskDefinitionArn"]],
+		["Target.EcsParameters.CapacityProviderStrategy", ["CapacityProvider"]],
+		["Target.EcsParameters.NetworkConfiguration.AwsvpcConfiguration", ["Subnets"]],
+		["Target.EventBridgeParameters", ["DetailType", "Source"]],
+		["Target.KinesisParameters", ["PartitionKey"]],
+		["Target.SageMakerPipelineParameters.PipelineParameterList", ["Name", "Value"]]
+	])],
+	["AWS::SecretsManager::Secret", /* @__PURE__ */ new Map([["ReplicaRegions", ["Region"]], ["Tags", ["Key", "Value"]]])],
+	["AWS::ServiceDiscovery::HttpNamespace", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::ServiceDiscovery::PrivateDnsNamespace", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::ServiceDiscovery::PublicDnsNamespace", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::ServiceDiscovery::Service", /* @__PURE__ */ new Map([
+		["DnsConfig", ["DnsRecords"]],
+		["DnsConfig.DnsRecords", ["TTL", "Type"]],
+		["HealthCheckConfig", ["Type"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::SNS::Topic", /* @__PURE__ */ new Map([
+		["DeliveryStatusLogging", ["Protocol"]],
+		["Subscription", ["Endpoint", "Protocol"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::SQS::Queue", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::StepFunctions::StateMachine", /* @__PURE__ */ new Map([
+		["DefinitionS3Location", ["Bucket", "Key"]],
+		["EncryptionConfiguration", ["Type"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::WAFv2::WebACL", /* @__PURE__ */ new Map([
+		["ApplicationConfig", ["Attributes"]],
+		["ApplicationConfig.Attributes", ["Name", "Values"]],
+		["CaptchaConfig.ImmunityTimeProperty", ["ImmunityTime"]],
+		["ChallengeConfig.ImmunityTimeProperty", ["ImmunityTime"]],
+		["DataProtectionConfig", ["DataProtections"]],
+		["DataProtectionConfig.DataProtections", ["Action", "Field"]],
+		["DataProtectionConfig.DataProtections.Field", ["FieldType"]],
+		["DefaultAction.Allow.CustomRequestHandling", ["InsertHeaders"]],
+		["DefaultAction.Allow.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["DefaultAction.Block.CustomResponse", ["ResponseCode"]],
+		["DefaultAction.Block.CustomResponse.ResponseHeaders", ["Name", "Value"]],
+		["MonetizationConfig.CryptoConfig", ["PaymentNetworks"]],
+		["MonetizationConfig.CryptoConfig.PaymentNetworks", [
+			"Chain",
+			"Prices",
+			"WalletAddress"
+		]],
+		["MonetizationConfig.CryptoConfig.PaymentNetworks.Prices", ["Amount", "Currency"]],
+		["OnSourceDDoSProtectionConfig", ["ALBLowReputationMode"]],
+		["Rules", [
+			"Name",
+			"Priority",
+			"Statement",
+			"VisibilityConfig"
+		]],
+		["Rules.Action.Allow.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Action.Allow.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.Action.Block.CustomResponse", ["ResponseCode"]],
+		["Rules.Action.Block.CustomResponse.ResponseHeaders", ["Name", "Value"]],
+		["Rules.Action.Captcha.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Action.Captcha.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.Action.Challenge.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Action.Challenge.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.Action.Count.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Action.Count.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.CaptchaConfig.ImmunityTimeProperty", ["ImmunityTime"]],
+		["Rules.ChallengeConfig.ImmunityTimeProperty", ["ImmunityTime"]],
+		["Rules.RuleLabels", ["Name"]],
+		["Rules.Statement.AndStatement", ["Statements"]],
+		["Rules.Statement.AsnMatchStatement.ForwardedIPConfig", ["FallbackBehavior", "HeaderName"]],
+		["Rules.Statement.ByteMatchStatement", [
+			"FieldToMatch",
+			"PositionalConstraint",
+			"TextTransformations"
+		]],
+		["Rules.Statement.ByteMatchStatement.FieldToMatch.Cookies", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.ByteMatchStatement.FieldToMatch.HeaderOrder", ["OversizeHandling"]],
+		["Rules.Statement.ByteMatchStatement.FieldToMatch.Headers", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.ByteMatchStatement.FieldToMatch.JA3Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.ByteMatchStatement.FieldToMatch.JA4Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.ByteMatchStatement.FieldToMatch.JsonBody", ["MatchPattern", "MatchScope"]],
+		["Rules.Statement.ByteMatchStatement.FieldToMatch.SingleHeader", ["Name"]],
+		["Rules.Statement.ByteMatchStatement.FieldToMatch.SingleQueryArgument", ["Name"]],
+		["Rules.Statement.ByteMatchStatement.PreParseTextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.ByteMatchStatement.TextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.GeoMatchStatement.ForwardedIPConfig", ["FallbackBehavior", "HeaderName"]],
+		["Rules.Statement.IPSetReferenceStatement", ["Arn"]],
+		["Rules.Statement.IPSetReferenceStatement.IPSetForwardedIPConfig", [
+			"FallbackBehavior",
+			"HeaderName",
+			"Position"
+		]],
+		["Rules.Statement.LabelMatchStatement", ["Key", "Scope"]],
+		["Rules.Statement.ManagedRuleGroupStatement", ["Name", "VendorName"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ExcludedRules", ["Name"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesACFPRuleSet", [
+			"CreationPath",
+			"RegistrationPagePath",
+			"RequestInspection"
+		]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesACFPRuleSet.RequestInspection", ["PayloadType"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesACFPRuleSet.RequestInspection.AddressFields", ["Identifier"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesACFPRuleSet.RequestInspection.EmailField", ["Identifier"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesACFPRuleSet.RequestInspection.PasswordField", ["Identifier"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesACFPRuleSet.RequestInspection.PhoneNumberFields", ["Identifier"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesACFPRuleSet.RequestInspection.UsernameField", ["Identifier"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesACFPRuleSet.ResponseInspection.BodyContains", ["FailureStrings", "SuccessStrings"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesACFPRuleSet.ResponseInspection.Header", [
+			"FailureValues",
+			"Name",
+			"SuccessValues"
+		]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesACFPRuleSet.ResponseInspection.Json", [
+			"FailureValues",
+			"Identifier",
+			"SuccessValues"
+		]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesACFPRuleSet.ResponseInspection.StatusCode", ["FailureCodes", "SuccessCodes"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesATPRuleSet", ["LoginPath"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesATPRuleSet.RequestInspection", [
+			"PasswordField",
+			"PayloadType",
+			"UsernameField"
+		]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesATPRuleSet.RequestInspection.PasswordField", ["Identifier"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesATPRuleSet.RequestInspection.UsernameField", ["Identifier"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesATPRuleSet.ResponseInspection.BodyContains", ["FailureStrings", "SuccessStrings"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesATPRuleSet.ResponseInspection.Header", [
+			"FailureValues",
+			"Name",
+			"SuccessValues"
+		]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesATPRuleSet.ResponseInspection.Json", [
+			"FailureValues",
+			"Identifier",
+			"SuccessValues"
+		]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesATPRuleSet.ResponseInspection.StatusCode", ["FailureCodes", "SuccessCodes"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesAntiDDoSRuleSet", ["ClientSideActionConfig"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesAntiDDoSRuleSet.ClientSideActionConfig", ["Challenge"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesAntiDDoSRuleSet.ClientSideActionConfig.Challenge", ["UsageOfAction"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesBotControlRuleSet", ["InspectionLevel"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.PasswordField", ["Identifier"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.UsernameField", ["Identifier"]],
+		["Rules.Statement.ManagedRuleGroupStatement.RuleActionOverrides", ["ActionToUse", "Name"]],
+		["Rules.Statement.ManagedRuleGroupStatement.RuleActionOverrides.ActionToUse.Allow.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Statement.ManagedRuleGroupStatement.RuleActionOverrides.ActionToUse.Allow.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.Statement.ManagedRuleGroupStatement.RuleActionOverrides.ActionToUse.Block.CustomResponse", ["ResponseCode"]],
+		["Rules.Statement.ManagedRuleGroupStatement.RuleActionOverrides.ActionToUse.Block.CustomResponse.ResponseHeaders", ["Name", "Value"]],
+		["Rules.Statement.ManagedRuleGroupStatement.RuleActionOverrides.ActionToUse.Captcha.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Statement.ManagedRuleGroupStatement.RuleActionOverrides.ActionToUse.Captcha.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.Statement.ManagedRuleGroupStatement.RuleActionOverrides.ActionToUse.Challenge.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Statement.ManagedRuleGroupStatement.RuleActionOverrides.ActionToUse.Challenge.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.Statement.ManagedRuleGroupStatement.RuleActionOverrides.ActionToUse.Count.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Statement.ManagedRuleGroupStatement.RuleActionOverrides.ActionToUse.Count.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.Statement.NotStatement", ["Statement"]],
+		["Rules.Statement.OrStatement", ["Statements"]],
+		["Rules.Statement.RateBasedStatement", ["AggregateKeyType", "Limit"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.Cookie", ["Name", "TextTransformations"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.Cookie.TextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.Header", ["Name", "TextTransformations"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.Header.TextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.JA3Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.JA4Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.LabelNamespace", ["Namespace"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.QueryArgument", ["Name", "TextTransformations"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.QueryArgument.TextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.QueryString", ["TextTransformations"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.QueryString.TextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.UriPath", ["TextTransformations"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.UriPath.TextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.RateBasedStatement.ForwardedIPConfig", ["FallbackBehavior", "HeaderName"]],
+		["Rules.Statement.RegexMatchStatement", [
+			"FieldToMatch",
+			"RegexString",
+			"TextTransformations"
+		]],
+		["Rules.Statement.RegexMatchStatement.FieldToMatch.Cookies", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.RegexMatchStatement.FieldToMatch.HeaderOrder", ["OversizeHandling"]],
+		["Rules.Statement.RegexMatchStatement.FieldToMatch.Headers", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.RegexMatchStatement.FieldToMatch.JA3Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.RegexMatchStatement.FieldToMatch.JA4Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.RegexMatchStatement.FieldToMatch.JsonBody", ["MatchPattern", "MatchScope"]],
+		["Rules.Statement.RegexMatchStatement.FieldToMatch.SingleHeader", ["Name"]],
+		["Rules.Statement.RegexMatchStatement.FieldToMatch.SingleQueryArgument", ["Name"]],
+		["Rules.Statement.RegexMatchStatement.PreParseTextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.RegexMatchStatement.TextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.RegexPatternSetReferenceStatement", [
+			"Arn",
+			"FieldToMatch",
+			"TextTransformations"
+		]],
+		["Rules.Statement.RegexPatternSetReferenceStatement.FieldToMatch.Cookies", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.RegexPatternSetReferenceStatement.FieldToMatch.HeaderOrder", ["OversizeHandling"]],
+		["Rules.Statement.RegexPatternSetReferenceStatement.FieldToMatch.Headers", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.RegexPatternSetReferenceStatement.FieldToMatch.JA3Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.RegexPatternSetReferenceStatement.FieldToMatch.JA4Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.RegexPatternSetReferenceStatement.FieldToMatch.JsonBody", ["MatchPattern", "MatchScope"]],
+		["Rules.Statement.RegexPatternSetReferenceStatement.FieldToMatch.SingleHeader", ["Name"]],
+		["Rules.Statement.RegexPatternSetReferenceStatement.FieldToMatch.SingleQueryArgument", ["Name"]],
+		["Rules.Statement.RegexPatternSetReferenceStatement.PreParseTextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.RegexPatternSetReferenceStatement.TextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.RuleGroupReferenceStatement", ["Arn"]],
+		["Rules.Statement.RuleGroupReferenceStatement.ExcludedRules", ["Name"]],
+		["Rules.Statement.RuleGroupReferenceStatement.RuleActionOverrides", ["ActionToUse", "Name"]],
+		["Rules.Statement.RuleGroupReferenceStatement.RuleActionOverrides.ActionToUse.Allow.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Statement.RuleGroupReferenceStatement.RuleActionOverrides.ActionToUse.Allow.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.Statement.RuleGroupReferenceStatement.RuleActionOverrides.ActionToUse.Block.CustomResponse", ["ResponseCode"]],
+		["Rules.Statement.RuleGroupReferenceStatement.RuleActionOverrides.ActionToUse.Block.CustomResponse.ResponseHeaders", ["Name", "Value"]],
+		["Rules.Statement.RuleGroupReferenceStatement.RuleActionOverrides.ActionToUse.Captcha.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Statement.RuleGroupReferenceStatement.RuleActionOverrides.ActionToUse.Captcha.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.Statement.RuleGroupReferenceStatement.RuleActionOverrides.ActionToUse.Challenge.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Statement.RuleGroupReferenceStatement.RuleActionOverrides.ActionToUse.Challenge.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.Statement.RuleGroupReferenceStatement.RuleActionOverrides.ActionToUse.Count.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Statement.RuleGroupReferenceStatement.RuleActionOverrides.ActionToUse.Count.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.Statement.SizeConstraintStatement", [
+			"ComparisonOperator",
+			"FieldToMatch",
+			"Size",
+			"TextTransformations"
+		]],
+		["Rules.Statement.SizeConstraintStatement.FieldToMatch.Cookies", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.SizeConstraintStatement.FieldToMatch.HeaderOrder", ["OversizeHandling"]],
+		["Rules.Statement.SizeConstraintStatement.FieldToMatch.Headers", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.SizeConstraintStatement.FieldToMatch.JA3Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.SizeConstraintStatement.FieldToMatch.JA4Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.SizeConstraintStatement.FieldToMatch.JsonBody", ["MatchPattern", "MatchScope"]],
+		["Rules.Statement.SizeConstraintStatement.FieldToMatch.SingleHeader", ["Name"]],
+		["Rules.Statement.SizeConstraintStatement.FieldToMatch.SingleQueryArgument", ["Name"]],
+		["Rules.Statement.SizeConstraintStatement.PreParseTextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.SizeConstraintStatement.TextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.SqliMatchStatement", ["FieldToMatch", "TextTransformations"]],
+		["Rules.Statement.SqliMatchStatement.FieldToMatch.Cookies", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.SqliMatchStatement.FieldToMatch.HeaderOrder", ["OversizeHandling"]],
+		["Rules.Statement.SqliMatchStatement.FieldToMatch.Headers", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.SqliMatchStatement.FieldToMatch.JA3Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.SqliMatchStatement.FieldToMatch.JA4Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.SqliMatchStatement.FieldToMatch.JsonBody", ["MatchPattern", "MatchScope"]],
+		["Rules.Statement.SqliMatchStatement.FieldToMatch.SingleHeader", ["Name"]],
+		["Rules.Statement.SqliMatchStatement.FieldToMatch.SingleQueryArgument", ["Name"]],
+		["Rules.Statement.SqliMatchStatement.PreParseTextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.SqliMatchStatement.TextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.XssMatchStatement", ["FieldToMatch", "TextTransformations"]],
+		["Rules.Statement.XssMatchStatement.FieldToMatch.Cookies", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.XssMatchStatement.FieldToMatch.HeaderOrder", ["OversizeHandling"]],
+		["Rules.Statement.XssMatchStatement.FieldToMatch.Headers", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.XssMatchStatement.FieldToMatch.JA3Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.XssMatchStatement.FieldToMatch.JA4Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.XssMatchStatement.FieldToMatch.JsonBody", ["MatchPattern", "MatchScope"]],
+		["Rules.Statement.XssMatchStatement.FieldToMatch.SingleHeader", ["Name"]],
+		["Rules.Statement.XssMatchStatement.FieldToMatch.SingleQueryArgument", ["Name"]],
+		["Rules.Statement.XssMatchStatement.PreParseTextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.XssMatchStatement.TextTransformations", ["Priority", "Type"]],
+		["Rules.VisibilityConfig", [
+			"CloudWatchMetricsEnabled",
+			"MetricName",
+			"SampledRequestsEnabled"
+		]],
+		["VisibilityConfig", [
+			"CloudWatchMetricsEnabled",
+			"MetricName",
+			"SampledRequestsEnabled"
+		]]
+	])]
+]);
+
+//#endregion
+//#region src/provisioning/nested-required.ts
+/**
+* Pre-flight rule: a PRESENT nested property block must carry every member its
+* schema definition lists as `required` (issue
+* [#1802](https://github.com/go-to-k/cdkd/issues/1802)).
+*
+* CloudFormation refuses such a block before it touches AWS. cdkd forwarded
+* it, and where the service API replaces the nested struct wholesale the
+* result was a silent change to a live setting: a kept
+* `AWS::ECS::Service.DeploymentConfiguration.DeploymentCircuitBreaker` without
+* `Rollback` flipped the live `rollback` from true to false. Cloud Control
+* validates against the same schema server-side, so the gap is SDK-provider
+* scoped; running the check for every resource is correct-but-redundant on the
+* Cloud Control route. Same layer and same reasons as
+* {@link ./mutually-exclusive-properties}: pre-flight runs on every deploy, not
+* only when the provider is called.
+*
+* ## Refuse only what CloudFormation refuses
+*
+* - An ABSENT block is never a violation — only a present one missing a member.
+* - Pre-flight runs BEFORE intrinsic resolution, so any value along the path
+*   that is an unresolved intrinsic (`Fn::If`, `Ref`, ...) is UNKNOWN and its
+*   subtree is skipped. A member is present when its KEY is, whatever the value
+*   (`false`, `0`, `null`, or an intrinsic that may resolve to
+*   `AWS::NoValue`). Every doubt passes through: a false refusal blocks a valid
+*   deploy with no escape hatch, a missed one reaches AWS as it did before.
+* - {@link CFN_ENFORCED_TYPES} gates the whole check. A schema's `required`
+*   list is NOT evidence that CloudFormation enforces it: measured, CFn accepted
+*   an `AWS::Logs::LogGroup` tag with neither `Key` nor `Value`, and sent an
+*   `AWS::EC2::SecurityGroup` ingress rule without `IpProtocol` to the EC2 API.
+*
+* ## No override flag, by design
+*
+* The violation is in the TEMPLATE, CloudFormation rejects it too, and the
+* remedy (declare the missing member) is always available.
+*/
+/**
+* Types whose nested `required` lists CloudFormation was MEASURED to enforce.
+* One template per type declared
+* every nested block of `NESTED_REQUIRED` empty; a type is listed only when
+* CloudFormation refused EVERY missing member the table predicts:
+*
+* - 64 types by early validation of a CREATE change set (nothing provisioned):
+*   `PROPERTY_VALIDATION` / "Required property [X] not found".
+* - 7 types early validation passed, refused at execution before any API call:
+*   `Model validation failed` / `Properties validation failed` /
+*   `Property validation failure` (ECS Service + TaskDefinition, EFS
+*   AccessPoint, Lambda EventSourceMapping, Step Functions StateMachine,
+*   API Gateway Method, AppSync GraphQLApi).
+* - 7 types with no registry handler, refused at execution by CloudFormation's
+*   own `Property validation failure` list (Budgets Budget, CloudWatch
+*   AnomalyDetector, CodeBuild Project, DocDB DBCluster + DBInstance, FSx
+*   FileSystem, Glue Table).
+*
+* Measured NOT enforced by a schema check (a handler or service error instead,
+* or an accepted create): ApiGatewayV2 Route, CloudFormation Stack, EC2
+* SecurityGroup, ECR Repository, EFS FileSystem, ELBv2 Listener, KMS Key,
+* KinesisFirehose DeliveryStream, Logs LogGroup, Route53 HostedZone, WAFv2
+* WebACL. Left out because CloudFormation reports only the FIRST missing member
+* (`Property X cannot be empty.`), so the rest of the table was not confirmed:
+* EMR Cluster, InstanceFleetConfig, InstanceGroupConfig. A type in none of
+* these lists (added later) is not checked until it is measured.
+*/
+const CFN_ENFORCED_TYPES = /* @__PURE__ */ new Set([
+	"AWS::ApiGateway::Deployment",
+	"AWS::ApiGateway::Method",
+	"AWS::ApiGateway::Stage",
+	"AWS::AppSync::DataSource",
+	"AWS::AppSync::GraphQLApi",
+	"AWS::AppSync::Resolver",
+	"AWS::AutoScaling::AutoScalingGroup",
+	"AWS::BedrockAgentCore::Evaluator",
+	"AWS::BedrockAgentCore::Runtime",
+	"AWS::Budgets::Budget",
+	"AWS::CertificateManager::Certificate",
+	"AWS::CloudFront::CloudFrontOriginAccessIdentity",
+	"AWS::CloudFront::Distribution",
+	"AWS::CloudFront::OriginAccessControl",
+	"AWS::CloudTrail::Trail",
+	"AWS::CloudWatch::Alarm",
+	"AWS::CloudWatch::AnomalyDetector",
+	"AWS::CodeBuild::Project",
+	"AWS::CodeCommit::Repository",
+	"AWS::Cognito::UserPool",
+	"AWS::DLM::LifecyclePolicy",
+	"AWS::DocDB::DBCluster",
+	"AWS::DocDB::DBInstance",
+	"AWS::DocDB::DBSubnetGroup",
+	"AWS::DynamoDB::GlobalTable",
+	"AWS::DynamoDB::Table",
+	"AWS::EC2::EIP",
+	"AWS::EC2::Instance",
+	"AWS::EC2::InternetGateway",
+	"AWS::EC2::NatGateway",
+	"AWS::EC2::NetworkAcl",
+	"AWS::EC2::RouteTable",
+	"AWS::EC2::Subnet",
+	"AWS::EC2::VPC",
+	"AWS::ECS::Service",
+	"AWS::ECS::TaskDefinition",
+	"AWS::EFS::AccessPoint",
+	"AWS::ElastiCache::CacheCluster",
+	"AWS::ElastiCache::SubnetGroup",
+	"AWS::ElasticLoadBalancingV2::LoadBalancer",
+	"AWS::ElasticLoadBalancingV2::TargetGroup",
+	"AWS::Events::EventBus",
+	"AWS::Events::Rule",
+	"AWS::FSx::FileSystem",
+	"AWS::Glue::Connection",
+	"AWS::Glue::Table",
+	"AWS::Glue::Trigger",
+	"AWS::IAM::Group",
+	"AWS::IAM::Role",
+	"AWS::IAM::User",
+	"AWS::Kinesis::Stream",
+	"AWS::Kinesis::StreamConsumer",
+	"AWS::Lambda::EventInvokeConfig",
+	"AWS::Lambda::EventSourceMapping",
+	"AWS::Lambda::Function",
+	"AWS::Lambda::LayerVersion",
+	"AWS::Lambda::MicrovmImage",
+	"AWS::Neptune::DBCluster",
+	"AWS::Neptune::DBInstance",
+	"AWS::Neptune::DBSubnetGroup",
+	"AWS::RDS::DBCluster",
+	"AWS::RDS::DBInstance",
+	"AWS::RDS::DBSubnetGroup",
+	"AWS::Route53::RecordSet",
+	"AWS::S3::Bucket",
+	"AWS::S3Express::DirectoryBucket",
+	"AWS::S3Tables::Table",
+	"AWS::S3Tables::TableBucket",
+	"AWS::S3Vectors::VectorBucket",
+	"AWS::SNS::Topic",
+	"AWS::SQS::Queue",
+	"AWS::Scheduler::Schedule",
+	"AWS::SecretsManager::Secret",
+	"AWS::ServiceDiscovery::HttpNamespace",
+	"AWS::ServiceDiscovery::PrivateDnsNamespace",
+	"AWS::ServiceDiscovery::PublicDnsNamespace",
+	"AWS::ServiceDiscovery::Service",
+	"AWS::StepFunctions::StateMachine"
+]);
+/**
+* True for a single-key object whose key is `Ref` or `Fn::*`. The same
+* predicate as `mutually-exclusive-properties.ts` keeps local, for the same
+* reason: the modules answer different questions about the shape.
+*/
+function isUnresolvedIntrinsic(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const keys = Object.keys(value);
+	return keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"));
+}
+/** A plain object whose members can be checked: not an array, not an intrinsic. */
+function isConcreteObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && !isUnresolvedIntrinsic(value);
+}
+/**
+* Find every present nested block of this resource that lacks a required
+* member. `table` defaults to the generated one gated by
+* {@link CFN_ENFORCED_TYPES}; tests pass their own to reach every shape.
+*/
+function findNestedRequiredViolations(resourceType, templateProperties, table = CFN_ENFORCED_TYPES.has(resourceType) ? NESTED_REQUIRED.get(resourceType) : void 0) {
+	if (!table || !isConcreteObject(templateProperties)) return [];
+	const violations = [];
+	for (const [path, required] of table) {
+		const segments = path.split(".");
+		const check = (value, display) => {
+			if (Array.isArray(value)) {
+				value.forEach((element, i) => check(element, `${display}[${i}]`));
+				return;
+			}
+			if (!isConcreteObject(value)) return;
+			const missing = required.filter((member) => !hasOwnKey(value, member));
+			if (missing.length > 0) violations.push({
+				resourceType,
+				path: display,
+				missing
+			});
+		};
+		const visit = (value, depth, display) => {
+			if (depth === segments.length) {
+				check(value, display);
+				return;
+			}
+			if (Array.isArray(value)) {
+				value.forEach((element, i) => visit(element, depth, `${display}[${i}]`));
+				return;
+			}
+			if (!isConcreteObject(value)) return;
+			const segment = segments[depth];
+			if (!hasOwnKey(value, segment)) return;
+			visit(value[segment], depth + 1, display ? `${display}.${segment}` : segment);
+		};
+		visit(templateProperties, 0, "");
+	}
+	return violations;
+}
+/** Render one violation as a per-resource error line. */
+function buildNestedRequiredMessage(logicalId, violation) {
+	return `  - ${logicalId} (${violation.resourceType}): ${violation.path} is missing required ${violation.missing.length === 1 ? "member" : "members"} ${violation.missing.join(", ")}`;
+}
+
 //#endregion
 //#region src/provisioning/provider-registry.ts
 /**
@@ -39003,7 +40830,10 @@ var ProviderRegistry = class {
 	* ALSO runs the mutually-exclusive-property check
 	* ({@link validateMutuallyExclusiveProperties}), which throws BEFORE any
 	* routing decision is logged — a template CloudFormation itself rejects
-	* should not first produce a page of routing chatter.
+	* should not first produce a page of routing chatter. Issue
+	* [#1802](https://github.com/go-to-k/cdkd/issues/1802) adds the nested
+	* `required` check ({@link validateNestedRequiredProperties}) at the same
+	* point, for the same reason.
 	*
 	* @see findAutoRouteHits for the pure-functional pre-deploy plan-builder
 	*      that returns the same information without logging.
@@ -39011,6 +40841,7 @@ var ProviderRegistry = class {
 	validateResourceProperties(resources) {
 		const materialized = [...resources];
 		this.validateMutuallyExclusiveProperties(materialized);
+		this.validateNestedRequiredProperties(materialized);
 		this.reportSilentDropDecisions(materialized);
 	}
 	/**
@@ -39036,6 +40867,23 @@ var ProviderRegistry = class {
 		throw new Error(`The following resources declare mutually exclusive properties:\n` + lines.join("\n") + "\n\nCloudFormation rejects these combinations too — edit the template to declare only one of each set.");
 	}
 	/**
+	* Reject a template whose PRESENT nested property block lacks a member the
+	* type's schema requires there, for the types CloudFormation was measured to
+	* enforce that on (issue [#1802](https://github.com/go-to-k/cdkd/issues/1802);
+	* the rule, its fail-safe bias and the measurement live in
+	* `nested-required.ts`).
+	*
+	* Aggregated into ONE error, like {@link validateMutuallyExclusiveProperties},
+	* and with no `--allow-*` escape hatch for the same reason: CloudFormation
+	* rejects the template too, and declaring the member is always possible.
+	*/
+	validateNestedRequiredProperties(resources) {
+		const lines = [];
+		for (const { logicalId, resourceType, properties } of resources) for (const violation of findNestedRequiredViolations(resourceType, properties)) lines.push(buildNestedRequiredMessage(logicalId, violation));
+		if (lines.length === 0) return;
+		throw new Error(`The following resources declare a nested property block without a member it requires:\n` + lines.join("\n") + "\n\nCloudFormation rejects these blocks too. Declare the missing members; leaving a whole block out is not a violation.");
+	}
+	/**
 	* Info-log every silent-drop routing decision (auto-route via CC API) and
 	* warn-log every silent drop the user explicitly opted into via
 	* `--allow-unsupported-properties` (forced SDK path, the property will
@@ -48884,5 +50732,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, derivePartitionAndUrlSuffix as $i, safeStackName as $n, assertAssetBucketRegion as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, PartialFailureError as Aa, resolveAutoAssetStorage as Ai, malformedOutputsRefusalMessage as An, formatLockExpiry as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, normalizeAwsError as Ba, CFN_TEMPLATE_URL_LIMIT as Bi, refuseMalformedOrphansForDestroy as Bn, isReadableBag as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, DynamicReferenceRegionAmbiguousError as Ca, AssetManifestLoader as Ci, isReadableResourceEntry as Cn, LockManager as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, LockError as Da, getDefaultStateBucketName as Di, malformedOrphanRecordsWarning as Dn, buildForceUnlockCommand as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, LocalStartServiceError as Ea, synthesisStatusMessage as Ei, malformedLocalOutputsWarning as En, UNREPRODUCIBLE_LOCK_CLAUSE as Er, deleteSkipReason as Et, extractDeploymentEventError as F, StackTerminationProtectionError as Fa, resolveUseCdkBootstrapAssets as Fi, malformedResourcesWarning as Fn, hasReadableExportSet as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, isTransientServerError as Ga, injectiveKey as Gi, refuseMalformedResourcesForDestroy as Gn, stringifyValue as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, isMarkedNonRetryable as Ha, findLargeInlineResources as Hi, refuseMalformedOutputsForDestroy as Hn, orphansCarriedFrom as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, StateError as Ia, stateBucketExistenceConfirmed as Ii, malformedStateRefusalMessage as In, hasReasonlessBaselineRefusal as Ir, isNamelessDynamicReferenceError as It, bold as J, retryClassificationText as Ja, producerRecordKey as Ji, repairMalformedOutputsForReadOnly as Jn, createAssetRedirectResolver as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, markNonRetryable as Ka, injectiveKeyPrefix as Ki, refuseMalformedState as Kn, WorkGraph as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, SynthesisError as La, warnDeprecatedNoPrefixCliFlag as Li, refuseDivergentRecordRegionForDestroy as Ln, hasUnverifiableParameterRefusal as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, ResourceTimeoutError as Ma, resolveSkipPrefix as Mi, malformedRenderedContainersWarning as Mn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, ResourceUpdateNotSupportedError as Na, resolveStateBucketWithDefault as Ni, malformedResourceEntriesWarning as Nn, DEFAULT_STATE_PREFIX as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, MalformedProducerRecordRefusalError as Oa, getLegacyStateBucketName as Oi, malformedOrphansRefusalMessage as On, buildLockContentionMessage as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, StackHasActiveImportsError as Pa, resolveStateBucketWithDefaultAndSource as Pi, malformedResourcePropertiesWarning as Pn, exportNamesCarriedFrom as Pr, getAccountInfo as Pt, red as Q, canonicalizeRegion as Qi, safeRegion as Qn, BOOTSTRAP_MARKER_PREFIX as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, formatError as Ra, ssmResolvedValueType as Ri, refuseMalformedNestedChildOutputs as Rn, importableOutputKeys as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, DeployCancelledError as Sa, stripControlChars as Si, hasReadableResources as Sn, scrubResourceRecord as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, LocalInvokeBuildError as Ta, Synthesizer as Ti, malformedExportSourceWarning as Tn, rebuildClientForBucketRegion as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, isRetryableTransientError as Ua, uploadCfnTemplate as Ui, refuseMalformedResourceEntries as Un, shouldRetainResource as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, withErrorHandling as Va, MIGRATE_TMP_PREFIX as Vi, refuseMalformedOutputs as Vn, orphansAfterRollback as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, isThrottlingError as Wa, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Wi, refuseMalformedResourcePropertiesForOrphan as Wn, AssetPublisher as Wr, assertRegionMatch as Wt, gray as X, safeStringify$1 as Xa, expectedOwnerParam as Xi, repairMalformedResourcePropertiesForReadOnly as Xn, rewriteTemplateAssetReferences as Xr, readConfigString as Xt, cyan as Y, describeAwsFailure as Ya, decodeListingKey as Yi, repairMalformedResourceEntriesForReadOnly as Yn, loadPublishableAssetManifest as Yr, configStringRefusal as Yt, green as Z, __exportAll as Za, PARTITION_TABLE as Zi, repairMalformedResourcesForReadOnly as Zn, AssetModeResolver as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, AssetError as _a, partitionSensitiveEnv as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, maskSecretsInError as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, hasPlainPrototype$1 as aa, validateAssetBucketName as ai, s3BucketDomainName as an, TemplateParser as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, CrossAccountSecretRefusalError as ba, runDockerStreaming as bi, hasReadableOrphans as bn, recoverMaskedOutput as br, startInterruptWatch as bt, replayFailedOperations as c, absoluteAssemblyPathEscape as ca, buildDockerImage as ci, s3BucketWebsiteUrl as cn, STATE_SOURCED_READBACK_RULES as cr, IAMRoleProvider as ct, updatePartialMessage as d, clearBucketRegionCache as da, describeDockerCapturedOutput as di, applyCallerIdentityCredentials as dn, createSecretMasker as dr, ProviderRegistry as dt, AssemblyReader as ea, ensureAssetStorage as ei, requireConfigString as en, findActionableSilentDrops as er, collectDeclaredOutputNames as et, updatePartialReason as f, resolveBucketRegion as fa, describeDockerExecFailure as fi, callerEnvCredentials as fn, dynamicReferenceTokens as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, setAwsClients as ga, getDockerCmd as gi, STATE_RESOURCES_MALFORMED as gn, markSameGenerationBag as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, resetAwsClients as ha, formatDockerLoginError as hi, INTRINSIC_KEYS as hn, isSingleDynamicReferenceToken as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, hasOwnKey as ia, readBootstrapMarkerBody as ii, s3BucketArn as in, DagBuilder as ir, secretBearing as it, isFinalSnapshotError as j, ProvisioningError as ja, resolveCaptureObservedState as ji, malformedOutputsWarning as jn, shellQuote as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, NestedStackChildDirectDestroyError as ka, resolveApp as ki, malformedOrphansWarning as kn, forceQuitRecoveryClause as kr, IntrinsicFunctionResolver as kt, replayRollback as l, renderAssemblyPathEscape as la, resolveDockerContextDirectory as li, applyRoleArnIfSet as ln, TEMPLATE_SOURCED_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, getAwsClients as ma, dockerSpawnEnvWithSensitive as mi, DiffCalculator as mn, identityKeyFor as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, processStackMessages as na, isCrossRegionRedirect as ni, producerRegionsFromState as nn, describeTypeWithThrottleRetry as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, nullPrototypeRecord as oa, validateContainerRepoName as oi, s3BucketDualStackDomainName as on, STATE_SOURCED_BASELINE_RULES as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, AwsClients as pa, describeDockerFailure as pi, envCredentialsAreAssumedRole as pn, errorCauseChain as pr, createMaskedRetryLogger as pt, formatResourceLine as q, markRedactedCause as qa, producerCoordinateKey as qi, repairMalformedOrphansForReadOnly as qn, buildAssetRedirectMap as qr, configBooleanRefusal as qt, DeployEngine as r, defineOwnKey as ra, parseBootstrapMarker as ri, withSharedDrainBudget as rn, withRetry as rr, isExportAliasCollision as rt, planRollback as s, ownValue as sa, buildDenyExternalAccessPolicy as si, s3BucketRegionalDomainName as sn, STATE_SOURCED_CROSS_GENERATION_RULES as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, failedStageNote as ta, getBootstrapMarkerKey as ti, classifyReplaySecretRegion as tn, findSilentDropProperties as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, resolveAssemblyPath as ua, warnManifestExecutable as ui, AWS_CREDENTIAL_ENV_KEYS as un, carriesSecretMask as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, CdkdError as va, redactDockerArgvValues as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, maskSecretsInText as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, IntrinsicResolutionRefusalError as wa, getDockerImageBySourceHash as wi, malformedExportNamesWarning as wn, S3StateBackend as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, DependencyError as xa, escapeRegExp$1 as xi, hasReadableOutputs as xn, redactSecretsForState as xr, CloudControlProvider as xt, keptWholeReasonText as y, ConfigError as ya, runDockerForeground as yi, displayLogicalId as yn, recordMaskOnlyValue as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, isCdkdError as za, CFN_TEMPLATE_BODY_LIMIT as zi, refuseMalformedOrphans as zn, importableOutputs as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-5fdODHji.js.map
+export { yellow as $, describeAwsFailure as $a, expectedOwnerParam as $i, repairMalformedResourcePropertiesForReadOnly as $n, rewriteTemplateAssetReferences as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, LocalStartServiceError as Aa, getDefaultStateBucketName as Ai, malformedOutputsRefusalMessage as An, buildForceUnlockCommand as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, StateError as Ba, warnDeprecatedNoPrefixCliFlag as Bi, refuseMalformedOrphansForDestroy as Bn, hasUnverifiableParameterRefusal as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, ConfigError as Ca, runDockerStreaming as Ci, isReadableResourceEntry as Cn, recoverMaskedOutput as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, DynamicReferenceRegionAmbiguousError as Da, getDockerImageBySourceHash as Di, malformedOrphanRecordsWarning as Dn, S3StateBackend as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, DeployCancelledError as Ea, AssetManifestLoader as Ei, malformedLocalOutputsWarning as En, LockManager as Er, deleteSkipReason as Et, extractDeploymentEventError as F, ProvisioningError as Fa, resolveSkipPrefix as Fi, malformedResourcesWarning as Fn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, withErrorHandling as Ga, findLargeInlineResources as Gi, refuseMalformedResourceEntries as Gn, orphansCarriedFrom as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, formatError as Ha, CFN_TEMPLATE_BODY_LIMIT as Hi, refuseMalformedOutputs as Hn, importableOutputs as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, ResourceTimeoutError as Ia, resolveStateBucketWithDefault as Ii, malformedStateRefusalMessage as In, DEFAULT_STATE_PREFIX as Ir, isNamelessDynamicReferenceError as It, bold as J, isThrottlingError as Ja, injectiveKey as Ji, refuseMalformedResourcesForDestroy as Jn, stringifyValue as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, isMarkedNonRetryable as Ka, uploadCfnTemplate as Ki, refuseMalformedResourceEntriesForOrphan as Kn, shouldRetainResource as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, ResourceUpdateNotSupportedError as La, resolveStateBucketWithDefaultAndSource as Li, refuseDivergentRecordRegionForDestroy as Ln, exportNamesCarriedFrom as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, MalformedProducerRecordRefusalError as Ma, resolveApp as Mi, malformedRenderedContainersWarning as Mn, forceQuitRecoveryClause as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, NestedStackChildDirectDestroyError as Na, resolveAutoAssetStorage as Ni, malformedResourceEntriesWarning as Nn, formatLockExpiry as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, IntrinsicResolutionRefusalError as Oa, Synthesizer as Oi, malformedOrphansRefusalMessage as On, rebuildClientForBucketRegion as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, PartialFailureError as Pa, resolveCaptureObservedState as Pi, malformedResourcePropertiesWarning as Pn, shellQuote as Pr, getAccountInfo as Pt, red as Q, retryClassificationText as Qa, decodeListingKey as Qi, repairMalformedResourceEntriesForReadOnly as Qn, loadPublishableAssetManifest as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, StackHasActiveImportsError as Ra, resolveUseCdkBootstrapAssets as Ri, refuseMalformedNestedChildOutputs as Rn, hasReadableExportSet as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, CdkdError as Sa, runDockerForeground as Si, hasReadableResources as Sn, recordMaskOnlyValue as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, DependencyError as Ta, stripControlChars as Ti, malformedExportSourceWarning as Tn, scrubResourceRecord as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, isCdkdError as Ua, CFN_TEMPLATE_URL_LIMIT as Ui, refuseMalformedOutputsForDestroy as Un, isReadableBag as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, SynthesisError as Va, ssmResolvedValueType as Vi, refuseMalformedOrphansForOrphan as Vn, importableOutputKeys as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, normalizeAwsError as Wa, MIGRATE_TMP_PREFIX as Wi, refuseMalformedResourceAttributesForOrphan as Wn, orphansAfterRollback as Wr, assertRegionMatch as Wt, gray as X, markNonRetryable as Xa, producerCoordinateKey as Xi, repairMalformedOrphansForReadOnly as Xn, buildAssetRedirectMap as Xr, readConfigString as Xt, cyan as Y, isTransientServerError as Ya, injectiveKeyPrefix as Yi, refuseMalformedState as Yn, WorkGraph as Yr, configStringRefusal as Yt, green as Z, markRedactedCause as Za, producerRecordKey as Zi, repairMalformedOutputsForReadOnly as Zn, createAssetRedirectResolver as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, AwsClients as _a, dockerSpawnEnvWithSensitive as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, identityKeyFor as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, globMatches as aa, isCrossRegionRedirect as ai, s3BucketDomainName as an, describeTypeWithThrottleRetry as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, setAwsClients as ba, partitionSensitiveEnv as bi, hasReadableOrphans as bn, maskSecretsInError as br, startInterruptWatch as bt, replayFailedOperations as c, hasOwnKey as ca, validateAssetBucketName as ci, s3BucketWebsiteUrl as cn, TemplateParser as cr, IAMRoleProvider as ct, updatePartialMessage as d, ownValue as da, buildDockerImage as di, applyCallerIdentityCredentials as dn, STATE_SOURCED_READBACK_RULES as dr, ProviderRegistry as dt, PARTITION_TABLE as ea, AssetModeResolver as ei, requireConfigString as en, safeStringify$1 as eo, repairMalformedResourcesForReadOnly as er, collectDeclaredOutputNames as et, updatePartialReason as f, absoluteAssemblyPathEscape as fa, resolveDockerContextDirectory as fi, callerEnvCredentials as fn, TEMPLATE_SOURCED_RULES as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, resolveBucketRegion as ga, describeDockerFailure as gi, STATE_RESOURCES_MALFORMED as gn, errorCauseChain as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, clearBucketRegionCache as ha, describeDockerExecFailure as hi, INTRINSIC_KEYS as hn, dynamicReferenceTokens as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, failedStageNote as ia, getBootstrapMarkerKey as ii, s3BucketArn as in, findSilentDropProperties as ir, secretBearing as it, isFinalSnapshotError as j, LockError as ja, getLegacyStateBucketName as ji, malformedOutputsWarning as jn, buildLockContentionMessage as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, LocalInvokeBuildError as ka, synthesisStatusMessage as ki, malformedOrphansWarning as kn, UNREPRODUCIBLE_LOCK_CLAUSE as kr, IntrinsicFunctionResolver as kt, replayRollback as l, hasPlainPrototype$1 as la, validateContainerRepoName as li, applyRoleArnIfSet as ln, STATE_SOURCED_BASELINE_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, resolveAssemblyPath as ma, describeDockerCapturedOutput as mi, DiffCalculator as mn, createSecretMasker as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, derivePartitionAndUrlSuffix as na, assertAssetBucketRegion as ni, producerRegionsFromState as nn, safeStackName as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, processStackMessages as oa, parseBootstrapMarker as oi, s3BucketDualStackDomainName as on, withRetry as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, renderAssemblyPathEscape as pa, warnManifestExecutable as pi, envCredentialsAreAssumedRole as pn, carriesSecretMask as pr, createMaskedRetryLogger as pt, formatResourceLine as q, isRetryableTransientError as qa, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as qi, refuseMalformedResourcePropertiesForOrphan as qn, AssetPublisher as qr, configBooleanRefusal as qt, DeployEngine as r, AssemblyReader as ra, ensureAssetStorage as ri, withSharedDrainBudget as rn, findActionableSilentDrops as rr, isExportAliasCollision as rt, planRollback as s, defineOwnKey as sa, readBootstrapMarkerBody as si, s3BucketRegionalDomainName as sn, DagBuilder as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, canonicalizeRegion as ta, BOOTSTRAP_MARKER_PREFIX as ti, classifyReplaySecretRegion as tn, __exportAll as to, safeRegion as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, nullPrototypeRecord as ua, buildDenyExternalAccessPolicy as ui, AWS_CREDENTIAL_ENV_KEYS as un, STATE_SOURCED_CROSS_GENERATION_RULES as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, getAwsClients as va, formatDockerLoginError as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, isSingleDynamicReferenceToken as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, CrossAccountSecretRefusalError as wa, escapeRegExp$1 as wi, malformedExportNamesWarning as wn, redactSecretsForState as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, AssetError as xa, redactDockerArgvValues as xi, hasReadableOutputs as xn, maskSecretsInText as xr, CloudControlProvider as xt, keptWholeReasonText as y, resetAwsClients as ya, getDockerCmd as yi, displayLogicalId as yn, markSameGenerationBag as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, StackTerminationProtectionError as za, stateBucketExistenceConfirmed as zi, refuseMalformedOrphans as zn, hasReasonlessBaselineRefusal as zr, refStateLookupFromResource as zt };
+//# sourceMappingURL=deploy-engine-CpMT9Bmm.js.map