@go-to-k/cdkd 0.291.3 → 0.291.5

package/dist/{deploy-engine-5fdODHji.js → deploy-engine-BtJocpRR.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-GASr9bAF.js";
-import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-BKm47b9j.js";
+import { a as setAssumedRoleCredentials, c as currentStackAwsScope, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-jISU4PHo.js";
+import { t as getCdkdVersion } from "./version-DVA14XyG.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1436,14 +1436,20 @@ function formatDuration$1(ms) {
 *    the attribute and the live read finds nothing or fails), plus the
 *    read-less `AWS::RDS::DBProxy` / `DBProxyEndpoint` `VpcId` refusal beside
 *    them — each replacing a physical id the attribute's value type can never
-*    accept.
+*    accept; and `lookupResourceRecord`'s refusal of a state record whose
+*    `physicalId` is not a string
+*    ([#3576](https://github.com/go-to-k/cdkd/issues/3576)), which both `Ref`
+*    and `Fn::GetAtt` reach, and so both `${...}` forms.
 * 2. NOT reachable from it, and thrown as this class only so that "deliberate
 *    refusal" is a property of the THROW rather than of the one catch that
 *    inspects it: `resolveSplit`'s two refusals of a non-string value (#1874),
+*    `resolveSelect`'s refusal of an index that does not resolve to a
+*    non-negative integer ([#3574](https://github.com/go-to-k/cdkd/issues/3574)),
 *    and `refuseCoercedInheritedSecret`, which refuses an already-resolved
 *    value whose type cannot be coerced. Their non-reachability has two
-*    DIFFERENT reasons, so do not collapse them: `Fn::Sub` cannot syntactically
-*    contain an `Fn::Split`, while `refuseCoercedInheritedSecret` runs in the
+*    DIFFERENT reasons, so do not collapse them: a `${...}` placeholder cannot
+*    syntactically contain an `Fn::Split` or `Fn::Select`, while
+*    `refuseCoercedInheritedSecret` runs in the
 *    nested-stack PARAMETER pre-pass, before any `Fn::Sub` is resolved. Neither
 *    changes behavior by being this class.
 * 3. PERMANENT — the one site where no user action and no re-run can make the
@@ -1453,7 +1459,8 @@ function formatDuration$1(ms) {
 *    {@link CrossAccountSecretRefusalError} rather than this class, because
 *    every site in groups 1 and 2 is USER-FIXABLE (correct the stale
 *    placeholder ARN, deploy the producer so STS resolves, enrich the
-*    `Fn::GetAtt`, drop `--strict-getatt`, fix the malformed `Fn::Split`,
+*    `Fn::GetAtt`, drop `--strict-getatt`, fix the malformed `Fn::Split` or
+*    `Fn::Select` index, repair the record's `physicalId`,
 *    correct the nested stack's output name, declare the nested-stack parameter
 *    `Type: String`) and a
 *    consumer that treats "permanent" as a property of the CLASS silently
@@ -1983,6 +1990,7 @@ var aws_clients_exports = /* @__PURE__ */ __exportAll({
 	AwsClients: () => AwsClients,
 	getAwsClients: () => getAwsClients,
 	resetAwsClients: () => resetAwsClients,
+	runWithStackAwsClients: () => runWithStackAwsClients,
 	setAwsClients: () => setAwsClients
 });
 /**
@@ -2063,18 +2071,21 @@ var AwsClients = class AwsClients {
 	* incomplete, it is UNSTABLE in the one direction that is dangerous: the SDK
 	* memoizes a region-less client's region at its first resolution
 	* (`@smithy/node-config-provider`'s `loadConfig` wraps the provider chain in
-	* `memoize`), while `deploy.ts`'s `switchRegion` keeps mutating
-	* `process.env.AWS_REGION` per stack and restores it in each stack's
-	* `finally`. So an env-derived answer can report region X for a client that
-	* long ago pinned itself to region P — letting a caller conclude "these
+	* `memoize`), while a per-stack region switch (`destroy-runner.ts` today;
+	* `deploy.ts` until issue #1981 moved it into a stack scope) mutates
+	* `process.env.AWS_REGION` and restores it in each stack's `finally`. So
+	* an env-derived answer can report region X for a client that long ago
+	* pinned itself to region P — letting a caller conclude "these
 	* clients already point at my region" and use the WRONG ones, which is worse
 	* than not knowing.
 	*
 	* When this returns `undefined` the region is not merely unknown to us, it is
-	* NOT YET DECIDED — and that is the important part. {@link clientOptions}
-	* omits `region` entirely in that case, so each service client resolves and
+	* NOT YET DECIDED — and that is the important part. Outside a stack scope
+	* (`runWithStackAwsClients`, which makes `awsClientDefaults()` supply the
+	* scope's region), {@link clientOptions} omits `region` entirely in that
+	* case, so each service client resolves and
 	* MEMOIZES its own region independently, at its own first construction, from
-	* an environment `deploy.ts`'s `switchRegion` is actively mutating. The
+	* an environment a per-stack region switch may be actively mutating. The
 	* members of one region-less bag can therefore disagree with each other:
 	* `ssm` can pin `us-west-2` and `secretsManager` pin `us-east-1` a moment
 	* later, because the getters are lazy and each samples a different instant.
@@ -2491,14 +2502,44 @@ var AwsClients = class AwsClients {
 */
 let globalClients = null;
 /**
-* Get or create global AWS clients
+* The AWS clients for the code running now: the active per-stack scope's
+* clients when one is entered ({@link runWithStackAwsClients}), else the
+* process-global instance, created on first use.
+*
+* The scope comes FIRST so that a stack deploying concurrently with a stack in
+* another region can never read the other stack's clients (issue
+* go-to-k/cdkd#1981). `config` only matters when the global is created.
 */
 function getAwsClients(config) {
+	const scoped = currentStackAwsScope();
+	if (scoped) return scoped.clients;
 	if (!globalClients) globalClients = new AwsClients(config);
 	return globalClients;
 }
 /**
-* Set global AWS clients instance
+* Run `fn` with `clients` as the AWS clients, and their configured region as
+* the ambient region, of everything it calls — across `await`s, and without
+* touching the process-global instance or `process.env.AWS_REGION`, which
+* concurrently running stacks would otherwise overwrite for each other
+* (issue go-to-k/cdkd#1981). See `stack-aws-scope.ts`.
+*
+* `clients` must be configured with a region: the scope's whole job is to name
+* one, and a region-less bag resolves its region from the very environment
+* this replaces.
+*/
+function runWithStackAwsClients(clients, fn) {
+	const region = clients.configuredRegion;
+	if (region === void 0) throw new Error("runWithStackAwsClients requires AwsClients configured with a region");
+	return runInStackAwsScope({
+		region,
+		clients
+	}, fn);
+}
+/**
+* Set global AWS clients instance.
+*
+* Inside a {@link runWithStackAwsClients} scope, `getAwsClients()` keeps
+* returning the scope's clients: the global this sets is only seen outside it.
 */
 function setAwsClients(clients) {
 	globalClients = clients;
@@ -3330,6 +3371,53 @@ function processStackMessages(stacks, logger, options = {}) {
 	if (hasWarnings && failAt === "warn") throw new SynthesisError("Found warnings (--strict mode)");
 }
 
+//#endregion
+//#region src/utils/glob-match.ts
+/**
+* Whether `subject` matches the glob `pattern`, where `*` matches any run of
+* characters (the empty run included) and EVERY other character is literal.
+*
+* The one answer to "what does a stack-selection pattern mean", shared by
+* `stackMatchesPattern` (`src/cli/stack-matcher.ts`) and the failed-Stage
+* attribution in `src/synthesis/failed-stages.ts`, so the two cannot disagree
+* ([#3508](https://github.com/go-to-k/cdkd/issues/3508)). An import-free LEAF,
+* so both layers may import it.
+*
+* **Never a RegExp.** Both sites used to expand `*` into `.*` and compile the
+* result, which had two defects: a pattern with several `*` separated by
+* literals backtracked EXPONENTIALLY in the length of the subject (a stack
+* name or Stage path from the Cloud Assembly), and the other characters were
+* live regex syntax only when the pattern held a `*` — `My.Stage*` matched
+* `MyXStage1` while `My.Stage` matched only itself, and `My(Stage*` threw a
+* `SyntaxError`.
+*
+* The walk anchors the text before the first `*` at the start and the text
+* after the last `*` at the end, then places each middle segment at its
+* LEFTMOST occurrence after the previous one. Leftmost placement is optimal
+* when `*` is the only wildcard — any later placement leaves strictly less room
+* for the segments after it — so no backtracking is needed. The cost is one
+* `indexOf` per segment, O(|subject| x |pattern|) in the worst case:
+* polynomial, where the RegExp was exponential.
+*/
+function globMatches(pattern, subject) {
+	const segments = pattern.split("*");
+	if (segments.length === 1) return pattern === subject;
+	const head = segments[0];
+	const tail = segments[segments.length - 1];
+	if (subject.length < head.length + tail.length) return false;
+	if (!subject.startsWith(head) || !subject.endsWith(tail)) return false;
+	const end = subject.length - tail.length;
+	let cursor = head.length;
+	for (let i = 1; i < segments.length - 1; i++) {
+		const segment = segments[i];
+		if (segment === "") continue;
+		const at = subject.indexOf(segment, cursor);
+		if (at === -1 || at + segment.length > end) return false;
+		cursor = at + segment.length;
+	}
+	return true;
+}
+
 //#endregion
 //#region src/synthesis/failed-stages.ts
 /**
@@ -3431,29 +3519,7 @@ function patternTargetsStage(pattern, stagePath) {
 	const patternSegments = pattern.split("/");
 	const stageSegments = stagePath.split("/");
 	if (patternSegments.length < stageSegments.length) return false;
-	return stageSegments.every((segment, i) => segmentMatches(patternSegments[i], segment));
-}
-/**
-* Wildcard-aware comparison of ONE path segment, matching how
-* `stackMatchesPattern` expands `*` in `src/cli/stack-matcher.ts`. The pattern
-* is the USER's own input, not an assembly-supplied value, so it is expanded
-* there the same way — metacharacters and all, so the two cannot disagree
-* about what a pattern means.
-*
-* The construction is guarded because SPLITTING on `/` can make an invalid
-* segment out of a valid pattern (`'(*x/y*)'` splits into `'(*x'`), and this
-* helper runs when the stack list is EMPTY, which is exactly when
-* `stackMatchesPattern` never evaluates and therefore never raises first. An
-* unusable pattern is simply not attributed: the note still prints, hedged,
-* instead of a `SyntaxError` replacing the message the user needed.
-*/
-function segmentMatches(patternSegment, segment) {
-	if (!patternSegment.includes("*")) return patternSegment === segment;
-	try {
-		return new RegExp("^" + patternSegment.replace(/\*/g, ".*") + "$").test(segment);
-	} catch {
-		return false;
-	}
+	return stageSegments.every((segment, i) => globMatches(patternSegments[i], segment));
 }
 
 //#endregion
@@ -3750,7 +3816,7 @@ var ContextStore = class {
 				this.logger.debug(`Skipping transient context value for key: ${key}`);
 				continue;
 			}
-			existing[key] = value;
+			defineOwnKey(existing, key, value);
 		}
 		writeFileSync(filePath, JSON.stringify(existing, null, 2) + "\n", "utf-8");
 		this.logger.debug(`Saved ${Object.keys(updates).length} context value(s) to cdk.context.json`);
@@ -4450,7 +4516,7 @@ var ContextProviderRegistry = class {
 	* @returns Map of context key → resolved value
 	*/
 	async resolve(missing) {
-		const results = {};
+		const results = nullPrototypeRecord();
 		for (const entry of missing) {
 			const provider = this.providers.get(entry.provider);
 			const shownProvider = displaySafe(entry.provider);
@@ -18325,12 +18391,12 @@ var TemplateParser = class {
 		const resources = t["Resources"];
 		for (const [logicalId, resource] of Object.entries(resources)) {
 			if (typeof resource !== "object" || resource === null) {
-				this.logger.error(`Resource ${logicalId} is not an object`);
+				this.logger.error(`Resource ${displaySafe(logicalId)} is not an object`);
 				return false;
 			}
 			const r = resource;
 			if (!("Type" in r) || typeof r["Type"] !== "string") {
-				this.logger.error(`Resource ${logicalId} missing Type or Type is not a string`);
+				this.logger.error(`Resource ${displaySafe(logicalId)} missing Type or Type is not a string`);
 				return false;
 			}
 		}
@@ -18387,7 +18453,7 @@ var TemplateParser = class {
 		for (const [logicalId, resource] of Object.entries(template.Resources)) {
 			const conditionName = resource.Condition;
 			if (conditionName !== void 0 && Object.hasOwn(conditions, conditionName) && conditions[conditionName] === false) {
-				this.logger.debug(`Excluding resource ${logicalId} — condition ${conditionName} is false`);
+				this.logger.debug(`Excluding resource ${displaySafe(logicalId)} — condition ${displaySafe(conditionName)} is false`);
 				continue;
 			}
 			if (logicalId === "__proto__") Object.defineProperty(filteredResources, logicalId, {
@@ -20383,14 +20449,11 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"UserPoolTags",
 			"UserPoolTier",
 			"VerificationMessageTemplate",
+			"WebAuthnFactorConfiguration",
 			"WebAuthnRelyingPartyID",
 			"WebAuthnUserVerification"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["IssuerConfiguration", "not yet implemented by cdkd"],
-			["KeyConfiguration", "not yet implemented by cdkd"],
-			["WebAuthnFactorConfiguration", "No wire path in the PINNED SDK (@aws-sdk/client-cognito-identity-provider 3.1018.0): WebAuthnConfigurationType is {RelyingPartyId?, UserVerification?} and no CreateUserPool/UpdateUserPool field accepts SINGLE_FACTOR | MULTI_FACTOR_WITH_USER_VERIFICATION. This is an SDK-VERSION limit, NOT an API one -- the live API does honour FactorConfiguration (measured us-east-1 2026-08-20: SetUserPoolMfaConfig(ON) on a pool allowing WEB_AUTHN as a first auth factor is rejected with \"Cannot set WebAuthn factor configuration to SINGLE_FACTOR if MFA is required and WebAuthn is an allowed first auth factor\", i.e. the service reads a field the SDK cannot send). RE-EVALUATE THIS ENTRY ON AN SDK BUMP: if WebAuthnConfigurationType gains FactorConfiguration, the property becomes handleable and this entry must go"]
-		]),
+		silentDrop: /* @__PURE__ */ new Map([["IssuerConfiguration", "not yet implemented by cdkd"], ["KeyConfiguration", "not yet implemented by cdkd"]]),
 		createOnlyDrops: /* @__PURE__ */ new Set()
 	}],
 	["AWS::DLM::LifecyclePolicy", {
@@ -22698,10 +22761,31 @@ function repairMalformedResourcesForReadOnly(state) {
 * documents `2` as "PARTIAL — journal kept, idempotent re-run", so a `2` here
 * would tell an operator to re-run a command that attempted nothing.
 */
-function malformedStateRefusalMessage(rawStackName, rawRegion) {
+function malformedStateRefusalMessage(rawStackName, rawRegion, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${malformedStateDiagnosis(stackName, region)} This command can WRITE state, so it refuses rather than continuing: saving over a record whose resource map could not be read would replace the evidence with a well-formed empty one and lose it permanently. Repair or remove the record first. Inspect it with: ${inspectCommand(stackName, region)}`;
+	return inspectTail(`${malformedStateDiagnosis(stackName, region)} This command can WRITE state, so it refuses rather than continuing: saving over a record whose resource map could not be read would replace the evidence with a well-formed empty one and lose it permanently. Repair or remove the record first.`, stackName, region, recovery);
+}
+/**
+* How a READ-ONLY remedy ends a single-command message: on
+* `Inspect it with: <inspectCommand>` — unless the record is a region-less
+* LEGACY one, which that command cannot read (go-to-k/cdkd#3388).
+*
+* A KNOWN stack with NO region is what `cdkd orphan` hands for a legacy
+* `<prefix>/<stack>/state.json` listed with no region, and `cdkd state show`
+* refuses such a record with or without `--stack-region`, so ending on it hands
+* the operator a dead end. That arm names the S3 object instead, through
+* {@link orphanInspectClause}, which already owns the shape (the object path
+* gated on the name rendering exactly, the real prefix and bucket when
+* `recovery` carries them, one location per trailing line).
+*
+* Every other identity keeps the command, so a region-keyed record's text is
+* byte-identical to what it was.
+*/
+function inspectTail(prose, stackName, region, recovery) {
+	if (stackName === void 0 || region !== void 0) return `${prose} Inspect it with: ${inspectCommand(stackName, region)}`;
+	const legacy = orphanInspectClause(stackName, void 0, recovery);
+	return [`${prose} ${legacy.sentence ?? ""}`.trimEnd(), ...legacy.locations ?? []].join("\n");
 }
 /**
 * The destructive template, in the three messages that offer one.
@@ -22746,7 +22830,7 @@ const DROP_RECORD_LINE = `Drop the record: ${DROP_RECORD_TEMPLATE}`;
 * identity here.
 */
 function mayNameTargetWithDestructiveRemedy(stackName, region) {
-	return safeStackName(stackName) === stackName && safeRegion(region) === region && isPasteableIdent(stackName) && isPasteableIdent(region);
+	return rendersExactly(stackName) && rendersExactly(region, SHORT_NAME_MAX_CODE_POINTS) && isPasteableIdent(stackName) && isPasteableIdent(region);
 }
 /**
 * The DESTROY refusal text for the `resources` bag (issue
@@ -22955,7 +23039,7 @@ const STATE_REGION_DIVERGED = "STATE_REGION_DIVERGED";
 */
 function divergentRecordRegionRefusalMessage(stackName, keyRegion, divergentBodyRegion, resourceCount) {
 	const cap = STACK_REF_MAX_CODE_POINTS;
-	const exact = safeIdentifier(stackName, cap) === stackName && safeIdentifier(keyRegion, cap) === keyRegion && isPasteableIdent(stackName) && isPasteableIdent(keyRegion);
+	const exact = rendersExactly(stackName, cap) && rendersExactly(keyRegion, cap) && isPasteableIdent(stackName) && isPasteableIdent(keyRegion);
 	const lists = resourceCount === void 0 ? "its resources map cannot be read" : `it still lists ${resourceCount} resource${resourceCount === 1 ? "" : "s"}`;
 	const kind = describeRegionValueKind(divergentBodyRegion);
 	const opening = exact ? `cdkd will not destroy stack ${shellQuote(safeIdentifier(stackName, cap))} (${shellQuote(safeIdentifier(keyRegion, cap))}): the state record read from that region's key carries a 'region' of its own (${kind}) that is not the key's, and ${lists}` : `cdkd will not destroy the state record this command loaded: it carries a 'region' of its own (${kind}) that is not the region of the key it was read from, and ${lists}`;
@@ -23252,9 +23336,9 @@ function malformedOutputsWarning(rawStackName, rawRegion) {
 * this names the stack, the region, the defect and the remedy, and exits on a
 * code rather than on a stack trace.
 */
-function refuseMalformedState(state, stackName, region) {
+function refuseMalformedState(state, stackName, region, recovery) {
 	if (hasReadableResources(state)) return;
-	throw new CdkdError(malformedStateRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED);
+	throw new CdkdError(malformedStateRefusalMessage(stackName, region, recovery), STATE_RESOURCES_MALFORMED);
 }
 /**
 * The `outputs` half of {@link malformedStateRefusalMessage}, for the same
@@ -23273,10 +23357,10 @@ function refuseMalformedState(state, stackName, region) {
 * Identifiers are sanitized and THEN shell-quoted and the command is emitted
 * LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
 */
-function malformedOutputsRefusalMessage(rawStackName, rawRegion) {
+function malformedOutputsRefusalMessage(rawStackName, rawRegion, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${stackClause(stackName, region)} has no readable 'outputs' map — the record is malformed or truncated. This command can WRITE state, so it refuses rather than continuing: it REBUILDS the bag before saving, and 'Object.entries' walks a string or a list as readily as a map, so a six-character value would be saved back as a well-formed six-key map (a null one as an empty map). That replaces the only signal anything is wrong with a legitimate-looking record, permanently — and the next deploy republishes it into the shared exports index every other stack's Fn::ImportValue resolves against. Repair or remove the record first. Inspect it with: ` + inspectCommand(stackName, region);
+	return inspectTail(`${stackClause(stackName, region)} has no readable 'outputs' map — the record is malformed or truncated. This command can WRITE state, so it refuses rather than continuing: it REBUILDS the bag before saving, and 'Object.entries' walks a string or a list as readily as a map, so a six-character value would be saved back as a well-formed six-key map (a null one as an empty map). That replaces the only signal anything is wrong with a legitimate-looking record, permanently — and the next deploy republishes it into the shared exports index every other stack's Fn::ImportValue resolves against. Repair or remove the record first.`, stackName, region, recovery);
 }
 /**
 * The line `ExportIndexStore`'s rebuild emits for a producer record whose
@@ -23360,9 +23444,9 @@ function malformedExportNamesWarning(rawStackName, rawRegion) {
 * records: a guard written at the rebuild leaves every earlier dereference in
 * front of it.
 */
-function refuseMalformedOutputs(state, stackName, region) {
+function refuseMalformedOutputs(state, stackName, region, recovery) {
 	if (hasReadableOutputs(state)) return;
-	throw markNonRetryable(new CdkdError(malformedOutputsRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED));
+	throw markNonRetryable(new CdkdError(malformedOutputsRefusalMessage(stackName, region, recovery), STATE_RESOURCES_MALFORMED));
 }
 /**
 * The stand-in row a read-only view lists in its `unreadable` set for an
@@ -23393,9 +23477,9 @@ const UNREADABLE_ORPHANS_CONTAINER_ROW = "(orphans container)";
 * ones it cannot see.
 *
 * The ENTRIES are a separate question with a separate answer —
-* `orphans[<i>].properties` is go-to-k/cdkd#3344, and
-* {@link refuseMalformedResourcePropertiesForOrphan} is the guard there. This
-* one says only that the container is a list.
+* {@link unreadableOrphanRecords}, which `cdkd orphan` refuses on through
+* {@link refuseMalformedOrphansForOrphan} (go-to-k/cdkd#3344). This one says
+* only that the container is a list.
 */
 function hasReadableOrphans(state) {
 	return state.orphans === void 0 || Array.isArray(state.orphans);
@@ -23766,15 +23850,26 @@ function dropRecordCommand(stackName, region, recovery) {
 * drop command from a legacy record whose name merely needs quoting — the very
 * path go-to-k/cdkd#3359 built, where `cdkd state show` refuses outright and
 * this command is the way out. Measured: `It's Legacy` loses it.
+*
+* **The ONE spelling of the exactness test in this module** (go-to-k/cdkd#3388).
+* The two DESTROY gates measure through it too, each at the cap its own clause
+* renders at: {@link mayNameTargetWithDestructiveRemedy} passes a region's
+* `SHORT_NAME_MAX_CODE_POINTS`, and `divergentRecordRegionRefusalMessage`
+* this default for both identities. `safeStackName(x) === x` and
+* `safeRegion(x) === x` are this predicate at those two caps, so a site
+* wanting either says so here instead of re-spelling the comparison —
+* `tests/unit/state/malformed-resources-bag.test.ts` refuses a second inline
+* spelling.
 */
-function rendersExactly(value) {
-	return safeIdentifier(value, STACK_REF_MAX_CODE_POINTS) === value;
+function rendersExactly(value, maxCodePoints = STACK_REF_MAX_CODE_POINTS) {
+	return safeIdentifier(value, maxCodePoints) === value;
 }
 /**
 * The remedy command a message ends ON — unless the message also offers the
 * destructive template, in which case it ends the READ's own LINE and
-* {@link DROP_RECORD_LINE} is last (go-to-k/cdkd#3516). Two of the eight call
-* sites are that shape; the rest close their string with it.
+* {@link DROP_RECORD_LINE} is last (go-to-k/cdkd#3516) — the two DESTROY
+* refusals; the rest close their string with it, directly or through
+* {@link inspectTail}.
 */
 function inspectCommand(stackName, region) {
 	if (stackName === void 0) return `cdkd state show ${commandHole("stack")} --stack-region ${commandHole("region")} --json`;
@@ -24094,6 +24189,32 @@ function malformedResourcePropertiesRefusalMessage(rawStackName, rawRegion, logi
 function malformedOrphanResourcePropertiesRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
+	return orphanRefusal(stackName, region, recovery, `${namedPropertyBagsClause(stackName, region, logicalIds)} 'cdkd orphan' REWRITES and SAVES every record it keeps, so it refuses rather than continuing — under '--dry-run' too, because the rewrite audit table a dry run prints is the wrong one. It is not that the save would fabricate a map: an unreadable bag is carried through VERBATIM. It is that this command exists to leave the record deployable by rewriting every reference to an orphaned resource, and a map it cannot read hides whichever references it holds — a string or a number presents none to find, and a list is walked, so its rewrites are recorded into a container that is still not a map. Continuing would rewrite, save, and report success over a record 'cdkd deploy' then REFUSES.`, SURVIVOR_THIRD_WAY_OUT);
+}
+/**
+* The third way out every `cdkd orphan` refusal over a `resources` ENTRY
+* offers, conditioned as {@link malformedOrphanResourcePropertiesRefusalMessage}'s
+* note requires. One spelling for the three refusals scoped to the survivors
+* (the entry, its `properties` and its `attributes`), which make the same
+* promise for the same reason: each subtracts the orphan set.
+*/
+const SURVIVOR_THIRD_WAY_OUT = "A third works only while the CDK app STILL DECLARES the named resource — this refusal covers just the records that would SURVIVE the save, so 'cdkd orphan <its construct path>' removes it and repairs the rest; construct paths come from the synthesized template, so a resource the app no longer declares has none and must take one of the first two.";
+/**
+* What every `cdkd orphan` refusal shares after its own diagnosis: the two
+* template-free ways out, the caller's third, and the pasteable lines.
+*
+* `lead` is the diagnosis AND the harm, which is what differs per container —
+* the rule this module follows for every text. The remedy half does not
+* differ, and a second copy of it is what would drift: it carries the
+* substitution gate, the withheld-identity clause and the per-line commands
+* go-to-k/cdkd#3363 settled. `thirdWayOut` is a full sentence; the ones naming
+* a record outside `resources` cannot offer `cdkd orphan <construct path>` and
+* say so instead.
+*
+* Takes identities ALREADY normalised by the exported builder's
+* {@link absentIfEmpty}, which is where that floor lives.
+*/
+function orphanRefusal(stackName, region, recovery, lead, thirdWayOut, dropCaveat = "") {
 	const inspect = orphanInspectClause(stackName, region, recovery);
 	const listCommand = withheldIdentityListCommand(stackName, region, recovery);
 	const commands = [
@@ -24102,7 +24223,7 @@ function malformedOrphanResourcePropertiesRefusalMessage(rawStackName, rawRegion
 		...inspect.command === void 0 ? [] : [`Inspect the record: ${inspect.command}`]
 	];
 	return [
-		`${namedPropertyBagsClause(stackName, region, logicalIds)} 'cdkd orphan' REWRITES and SAVES every record it keeps, so it refuses rather than continuing — under '--dry-run' too, because the rewrite audit table a dry run prints is the wrong one. It is not that the save would fabricate a map: an unreadable bag is carried through VERBATIM. It is that this command exists to leave the record deployable by rewriting every reference to an orphaned resource, and a map it cannot read hides whichever references it holds — a string or a number presents none to find, and a list is walked, so its rewrites are recorded into a container that is still not a map. Continuing would rewrite, save, and report success over a record 'cdkd deploy' then REFUSES. No state was written. Two ways out need no CDK app: repair the record by hand, or drop it whole with the 'Drop the record' command below, which leaves the live AWS resources standing${withheldIdentityClause(stackName, region)}${withheldRecoveryClause(recovery)}. A third works only while the CDK app STILL DECLARES the named resource — this refusal covers just the records that would SURVIVE the save, so 'cdkd orphan <its construct path>' removes it and repairs the rest; construct paths come from the synthesized template, so a resource the app no longer declares has none and must take one of the first two.` + (inspect.sentence === void 0 ? "" : ` ${inspect.sentence}`),
+		`${lead} No state was written. Two ways out need no CDK app: repair the record by hand, or drop it whole with the 'Drop the record' command below, which leaves the live AWS resources standing${dropCaveat}${withheldIdentityClause(stackName, region)}${withheldRecoveryClause(recovery)}. ` + thirdWayOut + (inspect.sentence === void 0 ? "" : ` ${inspect.sentence}`),
 		...commands,
 		...inspect.locations ?? []
 	].join("\n");
@@ -24210,6 +24331,9 @@ function orphanInspectCommand(stackName, region, recovery) {
 * With `recovery` the path carries the REAL prefix and names the bucket, the
 * way the drop remedy above it is qualified; without it the prefix is a
 * placeholder and the sentence says how to fill it.
+*
+* Its region-less arm is also {@link inspectTail}'s, for the state and outputs
+* refusals `cdkd orphan` raises over the same legacy record (go-to-k/cdkd#3388).
 */
 function orphanInspectClause(stackName, region, recovery) {
 	if (stackName === void 0 || stackName === "") return { command: [`cdkd state show ${commandHole("stack")} --stack-region ${commandHole("region")} --json`, ...recoveryCommandFlags(recovery).flags].join(" ") };
@@ -24247,34 +24371,18 @@ function orphanInspectClause(stackName, region, recovery) {
 * cannot persist a record it is deleting, and because refusing on one would
 * break the recovery path the refusal is otherwise meant to preserve.
 *
-* **It covers `state.resources` ONLY, and the save keeps more than that.**
-* `rewriteResourceReferences` spreads `carriedState`, so `state.orphans[]` —
-* rollback-orphaned records each holding a whole `ResourceState`
-* (go-to-k/cdkd#2934) — rides through untouched, and
-* {@link unreadableResourcePropertyBags} never walks it. A torn bag parked
-* there is therefore still saved, and `computeStackDiff` splices those records
-* into `state.resources` on the next preview. Stated rather than implied,
-* because "the records the save would KEEP" reads wider than what this scans:
-* the gap is go-to-k/cdkd#3344, filed rather than folded in because the remedy
-* differs — an entry in that container has no construct path, so the message's
-* third way out is meaningless for it.
-*
-* **A surviving ENTRY that is not a map is the other gap, and it DOES launder.**
-* This scan asks whether a resource's `properties` is readable; it never asks
-* whether the resource RECORD is. `isReadableBag('abcdef')` is false, so a
-* string entry is skipped here, and then `rewriteResourceReferences`'s
-* `{ ...resource }` spreads it into per-character keys — the record is SAVED as
-* `{"0":"a",…,"dependencies":[]}` and the run reports success. A number entry
-* saves as `{"dependencies":[]}`, a record with no `physicalId`. So the
-* refusal's own text, which says a torn `properties` map is persisted verbatim
-* rather than reshaped, is true of the container it scans and NOT of the one
-* above it.
-*
-* That gap is NOT go-to-k/cdkd#3202's as filed — that issue records only the
-* `null`-entry `TypeError` — and NOT open PR go-to-k/cdkd#3226's, whose file
-* list carries neither `orphan.ts` nor `orphan-rewriter.ts`. A lane closing
-* either one leaves this open, which is why it is named here rather than
-* deferred to them by reference. Filed as go-to-k/cdkd#3350.
+* **It covers the `properties` map of a `state.resources` entry ONLY, and the
+* save keeps more than that.** Three siblings answer for the rest, each its
+* own call because each is its own container with its own consequence:
+* {@link refuseMalformedResourceEntriesForOrphan} for an entry that is not a
+* record at all — the one shape the save RESHAPES rather than carries
+* (go-to-k/cdkd#3350) — {@link refuseMalformedResourceAttributesForOrphan} for
+* the entry's `attributes` map (go-to-k/cdkd#3345), and
+* {@link refuseMalformedOrphansForOrphan} for `state.orphans[]`, which the
+* rewrite spreads through `carriedState` without reading (go-to-k/cdkd#3344).
+* This scan skips an entry that is not an object, which is why the first of
+* them has to exist: its "carried through VERBATIM" sentence is true of the
+* container it scans and false of the one above it.
 *
 * CALL IT AT THE LOAD, beside {@link refuseMalformedState} and
 * {@link refuseMalformedOutputs}, above `rewriteResourceReferences` — the
@@ -24362,8 +24470,9 @@ function isReadableResourceEntry(entry) {
 * and refusing would stop the command documented as the way to UNWIND a stack
 * whose state is already suspect. The other callers (`cdkd import`,
 * `cdkd orphan`, `cdkd scrub`) each owe their own classification; `cdkd orphan`
-* does still throw on an unreadable sibling, which is why that one is tracked on
-* go-to-k/cdkd#3202 rather than answered here by a shared refusal.
+* answers through its own entry point on this class,
+* {@link refuseMalformedResourceEntriesForOrphan}, scoped to the records its
+* save keeps (go-to-k/cdkd#3350).
 *
 * So the entry rule is OPT-IN, taken by a flow that dereferences EVERY entry and
 * writes the record back.
@@ -24503,6 +24612,171 @@ function malformedResourceEntriesRefusalMessage(rawStackName, rawRegion, logical
 	const region = absentIfEmpty(rawRegion);
 	return `${namedEntriesClause(stackName, region, logicalIds)} This command can WRITE state, so it refuses rather than skipping them: saving over the record would report a clean run for entries nothing could read, and would leave the next command to fail on them with no more to go on. Nothing was locked, read from AWS or written FOR THIS STACK. Inspect it with: ` + inspectCommand(stackName, region);
 }
+/**
+* For `cdkd orphan`: refuse a record whose SURVIVING `resources` entries are
+* not readable resource records (go-to-k/cdkd#3350).
+*
+* The ENTRY class's predicate ({@link unreadableResourceEntries}), scoped to
+* the survivors exactly as the `properties` refusal is: an entry this run
+* DROPS is never saved, and `cdkd orphan` over the damaged record is the way
+* out of it, so the orphan set is subtracted. The drop is safe because the
+* rewriter will not RESOLVE a reference through an unreadable orphaned record —
+* it reports the site as unresolvable instead (`src/analyzer/orphan-rewriter.ts`).
+*
+* A second entry point on the class rather than a widening of
+* {@link refuseMalformedResourceEntries}, whose text says nothing was LOCKED —
+* false here, where the lock is taken before the load — and names no way out.
+*/
+function refuseMalformedResourceEntriesForOrphan(state, removedLogicalIds, stackName, region, recovery) {
+	const removed = new Set(removedLogicalIds);
+	const unreadable = unreadableResourceEntries(state).filter((id) => !removed.has(id));
+	if (unreadable.length === 0) return;
+	throw new CdkdError(malformedOrphanResourceEntriesRefusalMessage(stackName, region, unreadable, recovery), STATE_RESOURCES_MALFORMED);
+}
+/**
+* The text {@link refuseMalformedResourceEntriesForOrphan} raises.
+*
+* **This is the one container the save RESHAPES**, so the `properties`
+* refusal's "carried through VERBATIM" must not be borrowed. Measured through
+* the real rewrite, which rebuilds each kept record as
+* `{ ...resource, properties, dependencies }`: `"abcdef"` saved as
+* `{"0":"a",…,"5":"f","dependencies":[]}`, `5` and `true` as
+* `{"dependencies":[]}` (no `physicalId` at all), `[{"Ref":"O"}]` as
+* `{"0":{"Ref":"O"},"dependencies":[]}` with the reference to the orphan left
+* UNREWRITTEN — the failure this command exists to prevent — and `null` threw
+* `Cannot read properties of null`. An object with no `resourceType` is the
+* one shape carried as it stands.
+*/
+function malformedOrphanResourceEntriesRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return orphanRefusal(stackName, region, recovery, `${namedEntriesClause(stackName, region, logicalIds)} 'cdkd orphan' REWRITES and SAVES every record it keeps, so it refuses rather than continuing — under '--dry-run' too, so a dry run never prints a plan the real run refuses. The rewrite rebuilds each kept record by copying its fields, and a value that is not an object does not survive the copy: a string or a list is saved as one key per character or element — a list's references to an orphaned resource left UNREWRITTEN — a number or a boolean as a record with no physical id, and null stops the run on a bare TypeError. An object with no resource type is saved as it stands. Continuing would save a record no cdkd command wrote and report success.`, SURVIVOR_THIRD_WAY_OUT);
+}
+/**
+* Whether an ENTRY's `attributes` map — the `Fn::GetAtt` cache — can be read.
+*
+* ABSENT IS READABLE: the field is optional on `ResourceState` and plenty of
+* records carry none. `null` is NOT, the split {@link hasReadableOutputs}
+* draws for its own container: the resolver's cached-attribute read gates on
+* `!== undefined` and then indexes the map, so a `null` passes the gate and a
+* string or a list answers for keys it does not hold.
+*/
+function hasReadableAttributes(entry) {
+	const attributes = entry.attributes;
+	return attributes === void 0 || isReadableBag(attributes);
+}
+/**
+* The logical ids whose `resources` entry carries an `attributes` map that
+* cannot be read (go-to-k/cdkd#3345). Like {@link unreadableResourcePropertyBags}
+* it skips an entry that is not an object — that is the ENTRY class's to name —
+* and returns `[]` for an unreadable bag.
+*/
+function unreadableResourceAttributeBags(state) {
+	if (!hasReadableResources(state)) return [];
+	return Object.entries(state.resources).filter(([, entry]) => isReadableBag(entry) && !hasReadableAttributes(entry)).map(([logicalId]) => logicalId);
+}
+/**
+* For `cdkd orphan`: refuse a record whose SURVIVING entries carry an
+* unreadable `attributes` map (go-to-k/cdkd#3345). Scoped to the survivors for
+* the reason {@link refuseMalformedResourceEntriesForOrphan} is; an ORPHANED
+* entry's map is the `--force` cache, and the rewriter reads that one as
+* holding nothing instead of indexing it.
+*/
+function refuseMalformedResourceAttributesForOrphan(state, removedLogicalIds, stackName, region, recovery) {
+	const removed = new Set(removedLogicalIds);
+	const unreadable = unreadableResourceAttributeBags(state).filter((id) => !removed.has(id));
+	if (unreadable.length === 0) return;
+	throw new CdkdError(malformedOrphanResourceAttributesRefusalMessage(stackName, region, unreadable, recovery), STATE_RESOURCES_MALFORMED);
+}
+/**
+* The text {@link refuseMalformedResourceAttributesForOrphan} raises.
+*
+* Measured through the real rewrite: `"abcdef"`, `5`, `0`, `""`, `false` and
+* `null` are carried into the save byte for byte (the falsy ones skip
+* `rewriteValue` and survive through the spread), and `[{"Ref":"O"}]` is
+* WALKED, coming back `["<physical id>"]` — a rewrite recorded into a container
+* that is still not a map, the `properties` refusal's list case one field over.
+*/
+function malformedOrphanResourceAttributesRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	const named = logicalIds.slice(0, NAMED_UNREADABLE_ENTRIES).map((id) => displayLogicalId(id)).join(", ");
+	const rest = logicalIds.length - NAMED_UNREADABLE_ENTRIES;
+	const more = rest > 0 ? ` and ${rest} more` : "";
+	return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} holds ${logicalIds.length} resource record(s) whose 'attributes' map cannot be read — ${named}${more} — because it is null or not an object. The record is malformed or truncated. 'cdkd orphan' REWRITES and SAVES every record it keeps, so it refuses rather than continuing — under '--dry-run' too, so a dry run never prints a plan the real run refuses. The map is carried into the save VERBATIM, and a list is walked, so its rewrites are recorded into a container that is still not a map. It is the cache a later 'cdkd deploy' reads another resource's 'Fn::GetAtt' of this one from, so continuing would report success over the one map that read depends on.`, SURVIVOR_THIRD_WAY_OUT);
+}
+/**
+* The `orphans[]` records a reader cannot use: a record that is not an object
+* or has no string `logicalId`, whose `state` is not a readable resource entry,
+* or whose `state` carries an unreadable `properties` or `attributes` map
+* (go-to-k/cdkd#3344). The `logicalId` half is go-to-k/cdkd#3500's row
+* predicate: rows with none all key one map entry, and `orphansAfterRollback`
+* collapses them into one.
+*
+* Every `ResourceState` question the `resources` side answers in separate
+* predicates, asked in ONE here: a rollback-orphan record is reached only as a
+* whole — `computeStackDiff` and the deploy's adoption pass splice the record
+* into `resources` — so which part of it is torn does not change what a caller
+* can do with it. Returns `[]` for a container that is not a list, which is
+* {@link hasReadableOrphans}'s to report. Each record is named by its
+* `logicalId`, or `''` (rendered as the `UNRENDERABLE` stand-in) when it has
+* no string one — the convention {@link malformedOrphanRecordsWarning} takes.
+*/
+function unreadableOrphanRecords(state) {
+	if (!Array.isArray(state.orphans)) return [];
+	return state.orphans.filter((record) => {
+		if (!isReadableBag(record)) return true;
+		if (typeof record.logicalId !== "string") return true;
+		const entry = record.state;
+		return !isReadableResourceEntry(entry) || !isReadableBag(entry.properties) || !hasReadableAttributes(entry);
+	}).map((record) => {
+		const id = isReadableBag(record) ? record.logicalId : void 0;
+		return typeof id === "string" ? id : "";
+	});
+}
+/**
+* For `cdkd orphan`: refuse a record whose `orphans` list, or any record in
+* it, cannot be read (go-to-k/cdkd#3344).
+*
+* A THIRD entry point on the `orphans` container, beside
+* {@link refuseMalformedOrphans} and its destroy twin, because neither text is
+* true here. The rewrite neither walks nor rebuilds this container — it
+* spreads it through `carriedState` VERBATIM (measured: `"abc"` comes back
+* `"abc"`, a record whose `state.properties` is `"abcdef"` comes back byte for
+* byte) — so the rollback text's "written back as a list of character-shaped
+* orphan records" would be false. What this command does is SAVE it, report
+* success, and leave the damage for the next deploy or diff to meet.
+*
+* NOT scoped by the orphan set: these records are not in `resources`, so
+* `cdkd orphan` cannot name one, and its save keeps every one of them.
+*/
+function refuseMalformedOrphansForOrphan(state, stackName, region, recovery) {
+	if (!hasReadableOrphans(state)) throw new CdkdError(malformedOrphansForOrphanRefusalMessage(stackName, region, void 0, recovery), STATE_RESOURCES_MALFORMED);
+	const unreadable = unreadableOrphanRecords(state);
+	if (unreadable.length === 0) return;
+	throw new CdkdError(malformedOrphansForOrphanRefusalMessage(stackName, region, unreadable, recovery), STATE_RESOURCES_MALFORMED);
+}
+/** See {@link orphanRefusal}'s `dropCaveat`. */
+const ORPHANS_DROP_CAVEAT = "; it also discards the 'orphans' list, the only record of resources an earlier failed deploy left live in AWS";
+/**
+* The text {@link refuseMalformedOrphansForOrphan} raises: the CONTAINER arm
+* when `logicalIds` is `undefined`, the RECORDS arm otherwise.
+*
+* Its third way out is not {@link SURVIVOR_THIRD_WAY_OUT}: a record in
+* `orphans` has no construct path, so `cdkd orphan` cannot remove it, and the
+* hand repair that remains must not be a deletion — the record is the only
+* evidence that an earlier failed deploy left its resource live in AWS.
+*/
+function malformedOrphansForOrphanRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	const verbatim = "'cdkd orphan' carries it into the record it saves VERBATIM, without reading it, so it refuses rather than continuing — under '--dry-run' too, so a dry run never prints a plan the real run refuses.";
+	if (logicalIds === void 0) return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} has no readable 'orphans' list — the record is malformed or truncated. ${verbatim} The next 'cdkd deploy' refuses the same record, so continuing would only report success over it and leave that refusal one command later.`, "'cdkd orphan' cannot address this list at all, and rewriting it to [] by hand discards the only record of resources an earlier failed deploy left live in AWS.", ORPHANS_DROP_CAVEAT);
+	const named = logicalIds.slice(0, NAMED_UNREADABLE_ENTRIES).map((id) => displayLogicalId(id)).join(", ");
+	const rest = logicalIds.length - NAMED_UNREADABLE_ENTRIES;
+	const more = rest > 0 ? ` and ${rest} more` : "";
+	return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read — ${named}${more} — because the record has no string 'logicalId', its 'state' is not an object or names no resource type, or that state's 'properties' or 'attributes' map is not one. The record is malformed or truncated. ${verbatim} Those records are not inert: they are what the next 'cdkd deploy' may re-adopt into 'resources' and what 'cdkd diff' previews for adoption, so continuing would report success over damage the next command meets.`, "'cdkd orphan' cannot remove such a record itself: it is not in 'resources', so it has no construct path. Repair the record by hand rather than deleting it — it is the only record that an earlier failed deploy left its resource live in AWS.", ORPHANS_DROP_CAVEAT);
+}
 
 //#endregion
 //#region src/analyzer/diff-calculator.ts
@@ -27288,7 +27562,7 @@ function parseWebACLArn(arn) {
 */
 var WAFv2WebACLProvider = class {
 	wafv2Client;
-	providerRegion = process.env["AWS_REGION"];
+	providerRegion = ambientRegion();
 	logger = getLogger().child("WAFv2WebACLProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::WAFv2::WebACL", /* @__PURE__ */ new Set([
 		"Name",
@@ -28218,6 +28492,19 @@ function nestedStackChildRegionFromLocalArn(physicalId) {
 	return NESTED_STACK_LOCAL_ARN.exec(physicalId)?.[1];
 }
 /**
+* The array position a RESOLVED `Fn::Select` index names, or `undefined` when
+* it names none (issue #3574): a non-negative safe integer, or its canonical
+* decimal string (CloudFormation accepts `"1"`, and a `Ref` to a parameter the
+* resolver did not coerce is still a string). No `Number()` on anything else:
+* it trims whitespace and maps `""` / `null` / `[]` to `0`. No leading zero
+* either, so `String(position)` IS the resolved text and masks like it — the
+* same shape `import.ts`'s `isStaticSelectIndex` vouches for.
+*/
+function selectIndexPosition(value) {
+	const n = typeof value === "number" ? value : typeof value === "string" && /^(0|[1-9][0-9]*)$/.test(value) ? Number(value) : void 0;
+	return n !== void 0 && Number.isSafeInteger(n) && n >= 0 ? n : void 0;
+}
+/**
 * The prefix every dynamic-reference diagnostic this resolver spells carries.
 *
 * Exported because `cdkd scrub` applies the SAME partition on its side and must
@@ -29973,7 +30260,35 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (carriedBefore === 0) return;
 		if (inheritedSecretsCarriedBy(this.coerceParameterValue(userValue, paramDef.Type), inherited).length >= carriedBefore) return;
 		const loggedName = this.displayMasked(name);
-		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Nested-stack parameter '${loggedName}' is declared 'Type: ${paramDef.Type}', but the parent stack resolved a SECRET dynamic reference into it. cdkd keeps a resolved secret out of persisted state by rewriting STRING leaves back to their {{resolve:...}} expression; coercing this value to '${paramDef.Type}' destroys the plaintext cdkd would have matched on, so the DECRYPTED secret would be left in the child stack's state.json with nothing to redact it back to. Declare '${loggedName}' as 'Type: String' in the nested stack's template (CDK does this by default for cross-stack references), or stop passing a secret reference into it.`, void 0, "NESTED_STACK_SECRET_PARAMETER_TYPE"));
+		const loggedType = this.displayMasked(paramDef.Type);
+		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Nested-stack parameter '${loggedName}' is declared 'Type: ${loggedType}', but the parent stack resolved a SECRET dynamic reference into it. cdkd keeps a resolved secret out of persisted state by rewriting STRING leaves back to their {{resolve:...}} expression; coercing this value to '${loggedType}' destroys the plaintext cdkd would have matched on, so the DECRYPTED secret would be left in the child stack's state.json with nothing to redact it back to. Declare '${loggedName}' as 'Type: String' in the nested stack's template (CDK does this by default for cross-stack references), or stop passing a secret reference into it.`, void 0, "NESTED_STACK_SECRET_PARAMETER_TYPE"));
+	}
+	/**
+	* The ONE read of a state record by logical id, shared by `Ref` and
+	* `Fn::GetAtt` (the only two arms that take a record out of
+	* `context.resources`; every other method receives it from them).
+	*
+	* - `Object.hasOwn`, never a bare read (issue #2767): the logical id is
+	*   template text, and a plain-object read walks the prototype chain.
+	* - A record whose `physicalId` is not a string, or that is not an object at
+	*   all, is REFUSED here, above every reader (issue #3576). Nothing in
+	*   `src/state/` checks the type, so a hand edit or a foreign writer can
+	*   leave a number, and the arms below call `.startsWith` / `.replace` on
+	*   it (a bare `TypeError`) or build an ARN from it. cdkd never writes such
+	*   a record, so no answer derived from it is honest. `markNonRetryable`:
+	*   the verdict is a function of the persisted record, and the message
+	*   carries a template-controlled id. A NULL record keeps missing as before.
+	*/
+	lookupResourceRecord(logicalId, via, context) {
+		const resource = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
+		if (!resource) return void 0;
+		const isObject = typeof resource === "object" && !Array.isArray(resource);
+		const physicalId = isObject ? resource.physicalId : void 0;
+		if (typeof physicalId !== "string") {
+			const loggedId = this.displayMasked(logicalId, context);
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`${via} ${loggedId}: ${isObject ? `the state record's physical id is ${physicalId === null ? "null" : typeof physicalId}, not a string` : `the state record is ${Array.isArray(resource) ? "an array" : typeof resource}, not an object`}. cdkd always records an object with a string id, so this record was edited by hand or written by another tool. ${isObject ? `Set the resource's "physicalId" in the stack's state.json back to the id AWS knows the resource by.` : `Restore the resource's record in the stack's state.json, or remove it and re-import the resource.`}`, void 0, "STATE_PHYSICAL_ID_NOT_STRING"));
+		}
+		return resource;
 	}
 	/**
 	* Resolve Ref intrinsic function
@@ -29984,10 +30299,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* 3. Pseudo parameters (AWS::Region, AWS::AccountId, etc.)
 	*/
 	async resolveRef(logicalId, context) {
-		const resource = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
+		const resource = this.lookupResourceRecord(logicalId, "Ref", context);
 		if (resource) {
 			const refValue = this.resolveRefValue(logicalId, resource, context);
-			this.logger.debug(`Resolved Ref to resource: ${this.displayMasked(logicalId, context)} -> ${refValue}`);
+			this.logger.debug(`Resolved Ref to resource: ${this.displayMasked(logicalId, context)} -> ${this.displayMasked(String(refValue), context)}`);
 			return refValue;
 		}
 		if (context.parameters && Object.hasOwn(context.parameters, logicalId)) {
@@ -30001,7 +30316,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const pseudoValue = await this.resolvePseudoParameter(logicalId, context);
 		if (pseudoValue !== void 0) {
 			const valueStr = typeof pseudoValue === "symbol" ? pseudoValue.toString() : String(pseudoValue);
-			this.logger.debug(`Resolved Ref to pseudo parameter: ${logicalId} -> ${valueStr}`);
+			this.logger.debug(`Resolved Ref to pseudo parameter: ${logicalId} -> ${this.displayMasked(valueStr, context)}`);
 			return pseudoValue;
 		}
 		const loggedLogicalId = this.displayMasked(logicalId, context);
@@ -30174,11 +30489,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			attributeName = resolvedAttributeName;
 		} else {
 			const split = splitGetAttStringForm(getAtt);
-			if (split === void 0) throw markNonRetryable(/* @__PURE__ */ new Error(`Invalid Fn::GetAtt format: ${getAtt}`));
+			if (split === void 0) throw markNonRetryable(/* @__PURE__ */ new Error(`Invalid Fn::GetAtt format: ${this.displayMasked(getAtt, context)}`));
 			logicalId = split.logicalId;
 			attributeName = split.attributeName;
 		}
-		const resource = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
+		const resource = this.lookupResourceRecord(logicalId, "Fn::GetAtt", context);
 		if (!resource) throw markNonRetryable(/* @__PURE__ */ new Error(`Resource ${this.displayMasked(logicalId, context)} not found for Fn::GetAtt`));
 		if (!(resource.resourceType === "AWS::EC2::VPC" && attributeName === "Ipv6CidrBlocks") && resource.attributes !== void 0) {
 			const storedValue = Object.hasOwn(resource.attributes, attributeName) ? resource.attributes[attributeName] : void 0;
@@ -30259,8 +30574,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* which reads the SAME persisted `attributes` bag and shipped without the
 	* note (it takes it now). The rule the note actually needs is about the
 	* SOURCE of the value — every branch serving one out of a PERSISTED
-	* `attributes` bag must call this — and that is not a shape a compiler can
-	* enforce. `constructGuardedAttribute`'s return is deliberately outside it:
+	* `attributes` bag must call this, and so must one serving (or embedding) a
+	* persisted `properties` leaf, which a mask-only needle masks whole
+	* (go-to-k/cdkd#2936: the VPC `CidrBlock` and Events rule `Arn` arms) — and
+	* that is not a shape a compiler can enforce. `constructGuardedAttribute`'s return is deliberately outside it:
 	* that value is fetched from AWS in this run, not read back from state, so
 	* it can be neither a stale mask nor a value a provider declared `NoEcho`.
 	*
@@ -30348,7 +30665,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* predate the enrichment and `cdkd deploy` is what heals it.
 	*/
 	unenrichedRemedy(resourceType, attributeName, outcome, context) {
-		const fileIssue = `Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.displayMasked(attributeName, context)}.`;
+		const fileIssue = `Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${this.displayMasked(resourceType, context)}.${this.displayMasked(attributeName, context)}.`;
 		if (outcome === void 0) return `If this record was written by an older cdkd that did not record the attribute yet, 'cdkd deploy' re-reads it from AWS and heals the record. ${fileIssue}`;
 		if (outcome.kind === "read") {
 			if (this.healWithheld(outcome, attributeName)) return this.withheldRemedy();
@@ -30491,7 +30808,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async constructGuardedAttribute(resource, attributeName, context, logicalId) {
 		const accountInfo = await getAccountInfo(this.resolverRegion);
 		const value = await this.constructAttribute(resource, attributeName, context, logicalId, accountInfo);
-		if (accountInfo.fabricated && embedsAccountId(value, accountInfo.accountId)) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: STS did not report this deploy's account id, so cdkd would build the value from the placeholder account ${accountInfo.accountId} — structurally valid, naming a different account, and indistinguishable downstream from a real one. Fix the AWS credentials (or set AWS_ACCOUNT_ID to this deploy's account) and deploy again.`);
+		if (accountInfo.fabricated && embedsAccountId(value, accountInfo.accountId)) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${this.displayMasked(resource.resourceType, context)}: STS did not report this deploy's account id, so cdkd would build the value from the placeholder account ${accountInfo.accountId} — structurally valid, naming a different account, and indistinguishable downstream from a real one. Fix the AWS credentials (or set AWS_ACCOUNT_ID to this deploy's account) and deploy again.`);
 		return value;
 	}
 	/**
@@ -30528,28 +30845,29 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		}
 		if (resourceType === "AWS::EC2::VPC") switch (attributeName) {
 			case "VpcId": return physicalId;
-			case "CidrBlock": return resource.attributes?.["CidrBlock"] || resource.properties?.["CidrBlock"];
+			case "CidrBlock": return this.noteAttributeSecrecy(logicalId, attributeName, resource.attributes?.["CidrBlock"] || resource.properties?.["CidrBlock"], context);
 			case "Ipv6CidrBlocks": try {
 				const ec2 = this.clientsForRegion(this.explicitRegion).ec2;
 				const maxAttempts = 15;
+				const loggedId = this.displayMasked(physicalId, context);
 				for (let attempt = 1; attempt <= maxAttempts; attempt++) {
 					const associations = (await ec2.send(new DescribeVpcsCommand({ VpcIds: [physicalId] }))).Vpcs?.[0]?.Ipv6CidrBlockAssociationSet || [];
 					const blocks = associations.filter((a) => a.Ipv6CidrBlockState?.State === "associated").map((a) => a.Ipv6CidrBlock);
 					if (blocks.length > 0) {
-						this.logger.debug(`Resolved VPC Ipv6CidrBlocks for ${physicalId}: ${this.displayMasked(JSON.stringify(this.maskValueLeaves(blocks, context)), context)}`);
+						this.logger.debug(`Resolved VPC Ipv6CidrBlocks for ${loggedId}: ${this.displayMasked(JSON.stringify(this.maskValueLeaves(blocks, context)), context)}`);
 						return blocks;
 					}
 					if (associations.filter((a) => a.Ipv6CidrBlockState?.State === "associating").length === 0) {
-						this.logger.debug(`No IPv6 CIDR associations found for VPC ${physicalId}`);
+						this.logger.debug(`No IPv6 CIDR associations found for VPC ${loggedId}`);
 						return [];
 					}
-					this.logger.debug(`VPC ${physicalId} IPv6 CIDR still associating (attempt ${attempt}/${maxAttempts}), waiting...`);
+					this.logger.debug(`VPC ${loggedId} IPv6 CIDR still associating (attempt ${attempt}/${maxAttempts}), waiting...`);
 					await new Promise((resolve) => setTimeout(resolve, 2e3));
 				}
-				this.logger.warn(`VPC ${physicalId} IPv6 CIDR did not reach 'associated' state after ${maxAttempts} attempts`);
+				this.logger.warn(`VPC ${loggedId} IPv6 CIDR did not reach 'associated' state after ${maxAttempts} attempts`);
 				return [];
 			} catch (error) {
-				this.logger.warn(`Failed to fetch VPC Ipv6CidrBlocks for ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+				this.logger.warn(`Failed to fetch VPC Ipv6CidrBlocks for ${this.displayMasked(physicalId, context)}: ${this.displayMasked(error instanceof Error ? error.message : String(error), context)}`);
 				return [];
 			}
 			case "DefaultSecurityGroup": {
@@ -30626,7 +30944,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (resourceType === "AWS::Events::Rule") switch (attributeName) {
 			case "Arn": {
 				if (physicalId.startsWith("arn:")) return physicalId;
-				const busRaw = resource.properties?.["EventBusName"];
+				const busRaw = this.noteAttributeSecrecy(logicalId, attributeName, resource.properties?.["EventBusName"], context);
 				const bus = typeof busRaw === "string" && busRaw && busRaw !== "default" ? busRaw : "";
 				const busName = bus.startsWith("arn:") ? bus.split("/").pop() || "" : bus;
 				return busName ? `arn:${partition}:events:${region}:${accountId}:rule/${busName}/${physicalId}` : `arn:${partition}:events:${region}:${accountId}:rule/${physicalId}`;
@@ -30674,7 +30992,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				const { GetNamespaceCommand } = await import("@aws-sdk/client-servicediscovery");
 				return (await (await this.serviceDiscoveryClient()).send(new GetNamespaceCommand({ Id: physicalId }))).Namespace?.Properties?.DnsProperties?.HostedZoneId;
 			} catch (error) {
-				this.logger.warn(`Failed to fetch HostedZoneId for namespace ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+				this.logger.warn(`Failed to fetch HostedZoneId for namespace ${this.displayMasked(physicalId, context)}: ${this.displayMasked(error instanceof Error ? error.message : String(error), context)}`);
 				return;
 			}
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
@@ -30875,7 +31193,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					const value = attributeName === "LatestVersionNumber" ? lt?.LatestVersionNumber : lt?.DefaultVersionNumber;
 					if (value !== void 0 && value !== null) return String(value);
 				} catch (err) {
-					this.logger.warn(`DescribeLaunchTemplates(${physicalId}) failed for ${this.displayMasked(attributeName, context)}: ${this.displayMasked(err instanceof Error ? err.message : String(err), context)}`);
+					this.logger.warn(`DescribeLaunchTemplates(${this.displayMasked(physicalId, context)}) failed for ${this.displayMasked(attributeName, context)}: ${this.displayMasked(err instanceof Error ? err.message : String(err), context)}`);
 				}
 				return attributeName === "LatestVersionNumber" ? "$Latest" : "$Default";
 			}
@@ -30982,7 +31300,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*/
 	refuseUnservedAttribute(site) {
 		const { logicalId, attributeName, resourceType, physicalId, context, observed, remedy } = site;
-		throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: ${observed}. The physical id "${this.displayMasked(physicalId, context)}" is not a usable ${this.displayMasked(attributeName, context)}, so cdkd refuses to substitute it. ${remedy}`);
+		throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${this.displayMasked(resourceType, context)}: ${observed}. The physical id "${this.displayMasked(physicalId, context)}" is not a usable ${this.displayMasked(attributeName, context)}, so cdkd refuses to substitute it. ${remedy}`);
 	}
 	/**
 	* The `observed` clause of {@link refuseUnservedAttribute} for a live read
@@ -31028,20 +31346,21 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (context?.staleAttributeHeal?.phase === "probe") throw new StaleAttributeMissSignal();
 		const healOutcome = context?.staleAttributeHeal?.phase === "settled" ? context.staleAttributeHeal.outcome : void 0;
 		const recordMayBeStale = healOutcome?.kind === "failed" || healOutcome?.kind === "not-found";
+		const loggedType = this.displayMasked(resourceType, context);
 		const expectsArnShape = attributeName.endsWith("Arn") && !physicalId.startsWith("arn:");
 		const expectsUrlShape = attributeName.endsWith("Url") && !/^https?:\/\//.test(physicalId);
 		if (expectsArnShape || expectsUrlShape) {
 			const expectedShape = expectsArnShape ? "an ARN (arn:...)" : "a URL (http(s)://...)";
-			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: ` + (recordMayBeStale ? `the state record holds no value for it, and the physical ID ` : `attributes are not enriched for this resource type, and the physical ID `) + `fallback "${this.displayMasked(physicalId, context)}" is not ${expectedShape}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). ` + (recordMayBeStale ? this.staleRecordRemedy(healOutcome, context) : this.unenrichedRemedy(resourceType, attributeName, healOutcome, context))));
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${loggedType}: ` + (recordMayBeStale ? `the state record holds no value for it, and the physical ID ` : `attributes are not enriched for this resource type, and the physical ID `) + `fallback "${this.displayMasked(physicalId, context)}" is not ${expectedShape}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). ` + (recordMayBeStale ? this.staleRecordRemedy(healOutcome, context) : this.unenrichedRemedy(resourceType, attributeName, healOutcome, context))));
 		}
-		if (this.strictGetAtt) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: ` + (recordMayBeStale ? `the state record holds no value for it, and --strict-getatt ` : `attributes are not enriched for this resource type, and --strict-getatt `) + `rejects the physical ID fallback "${this.displayMasked(physicalId, context)}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning. ` + (recordMayBeStale ? this.staleRecordRemedy(healOutcome, context) : this.unenrichedRemedy(resourceType, attributeName, healOutcome, context))));
+		if (this.strictGetAtt) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${loggedType}: ` + (recordMayBeStale ? `the state record holds no value for it, and --strict-getatt ` : `attributes are not enriched for this resource type, and --strict-getatt `) + `rejects the physical ID fallback "${this.displayMasked(physicalId, context)}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning. ` + (recordMayBeStale ? this.staleRecordRemedy(healOutcome, context) : this.unenrichedRemedy(resourceType, attributeName, healOutcome, context))));
 		this.physicalIdFallbackCount++;
 		if (recordMayBeStale) {
-			this.logger.warn(`The state record for ${this.displayMasked(logicalId, context)} (${resourceType}) holds no ${this.displayMasked(attributeName, context)}, returning physical ID. ` + this.staleRecordRemedy(healOutcome, context));
+			this.logger.warn(`The state record for ${this.displayMasked(logicalId, context)} (${loggedType}) holds no ${this.displayMasked(attributeName, context)}, returning physical ID. ` + this.staleRecordRemedy(healOutcome, context));
 			return physicalId;
 		}
 		const withheld = healOutcome?.kind === "read" && this.healWithheld(healOutcome, attributeName) ? `. ${this.withheldRemedy()}` : "";
-		this.logger.warn(`Unknown attribute ${this.displayMasked(attributeName, context)} for resource type ${resourceType}, returning physical ID${withheld}`);
+		this.logger.warn(`Unknown attribute ${this.displayMasked(attributeName, context)} for resource type ${loggedType}, returning physical ID${withheld}`);
 		return physicalId;
 	}
 	/**
@@ -31368,18 +31687,29 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* Resolve Fn::Select intrinsic function
 	*
 	* Fn::Select: [index, [value1, value2, ...]]
-	* Returns the value at the specified index in the list
+	* Returns the value at the specified index in the list. The index may be an
+	* intrinsic; it is resolved, then must name a position (issue #3574).
 	*/
 	async resolveSelect(selectArgs, context) {
+		if (!Array.isArray(selectArgs) || selectArgs.length !== 2) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Select takes a two-element list [index, list], got ${this.describeOperandShape(selectArgs, context)}`));
 		const [index, list] = selectArgs;
+		const resolvedIndex = await this.resolveValue(index, context);
+		const position = selectIndexPosition(resolvedIndex);
+		if (position === void 0) {
+			const source = this.describeSplitValueSource(index);
+			const sourceClause = source ? ` (from ${this.displayMasked(source.label, context)})` : "";
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Select: the index${sourceClause} must resolve to a non-negative integer (a number, or its decimal string with no leading zero), got ${this.describeOperandShape(resolvedIndex, context)}. Use a literal, a Ref to a parameter or an Fn::FindInMap that yields one.`));
+		}
 		const resolvedList = await this.resolveValue(list, context);
 		if (!Array.isArray(resolvedList)) throw new Error(`Fn::Select: list must be an array, got ${typeof resolvedList}`);
-		if (index < 0 || index >= resolvedList.length) {
-			this.logger.warn(`Fn::Select: index ${index} out of bounds (array length: ${resolvedList.length})`);
-			return `{{Fn::Select:${index}:OutOfBounds}}`;
-		}
-		const result = resolvedList[index];
-		this.logger.debug(`Resolved Fn::Select: index ${index} -> ${JSON.stringify(this.maskValueLeaves(result, context))}`);
+		const loggedPosition = this.displayMasked(String(position), context);
+		if (position >= resolvedList.length) {
+			if (loggedPosition !== String(position)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Select: the index ${loggedPosition} is out of bounds (array length: ${resolvedList.length}), and it resolves from a secret value, so cdkd will not write it into the OutOfBounds placeholder.`));
+			this.logger.warn(`Fn::Select: index ${position} out of bounds (array length: ${resolvedList.length})`);
+			return `{{Fn::Select:${position}:OutOfBounds}}`;
+		}
+		const result = resolvedList[position];
+		this.logger.debug(`Resolved Fn::Select: index ${loggedPosition} -> ${JSON.stringify(this.maskValueLeaves(result, context))}`);
 		return result;
 	}
 	/**
@@ -31398,6 +31728,18 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		return "<intrinsic>";
 	}
 	/**
+	* Name a malformed operand's type, and its value when that is a scalar, for
+	* a refusal message. The value is template text or a resolution product, so
+	* it goes through the builder (issue #3479).
+	*/
+	describeOperandShape(value, context) {
+		if (value === null) return "null";
+		if (Array.isArray(value)) return `an array of ${value.length}`;
+		if (typeof value === "string") return `string "${this.displayMasked(value, context)}"`;
+		if (typeof value === "number" || typeof value === "boolean") return `${typeof value} ${this.displayMasked(String(value), context)}`;
+		return typeof value;
+	}
+	/**
 	* Name the UNRESOLVED value argument of an `Fn::Split` for its refusal
 	* message (issue [#1874](https://github.com/go-to-k/cdkd/issues/1874)).
 	*
@@ -31415,7 +31757,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*   naming the parameter.
 	*
 	* Anything else degrades to its bare intrinsic key, or to `undefined` for a
-	* literal (which the message then simply omits).
+	* literal (which the message then simply omits). `resolveSelect` borrows the
+	* label for its index refusal (issue #3574); only `kind` is Split-specific.
 	*
 	* `kind` is not decoration: the caller uses it to pick the remedy, since the
 	* `Fn::GetAtt` remedy (drop the `Fn::Split`, and the #1868 note for the
@@ -31524,7 +31867,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		}
 		const result = resolvedValue.split(delimiter);
 		const pieceTwins = this.splitLogTwins(resolvedValue, delimiter, result, context);
-		this.logger.debug(`Resolved Fn::Split: split by "${delimiter}" -> ${JSON.stringify(this.maskValueLeaves(pieceTwins, context))}`);
+		this.logger.debug(`Resolved Fn::Split: split by "${this.displayMasked(String(delimiter), context)}" -> ${JSON.stringify(this.maskValueLeaves(pieceTwins, context))}`);
 		return result;
 	}
 	/**
@@ -32121,7 +32464,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		let roleArn;
 		if ("RoleArn" in args && args["RoleArn"] !== void 0 && args["RoleArn"] !== null) {
 			const raw = args["RoleArn"];
-			if (typeof raw !== "string" || raw === "") throw new Error(`Fn::GetStackOutput: RoleArn must be a literal string in the template (no Ref / Fn::GetAtt / Fn::Sub allowed for cross-account references). Got ${raw === null ? "null" : Array.isArray(raw) ? "array" : typeof raw}${typeof raw === "object" ? ` (intrinsic shape: ${JSON.stringify(raw).slice(0, 80)})` : ""}.`);
+			if (typeof raw !== "string" || raw === "") throw new Error(`Fn::GetStackOutput: RoleArn must be a literal string in the template (no Ref / Fn::GetAtt / Fn::Sub allowed for cross-account references). Got ${raw === null ? "null" : Array.isArray(raw) ? "array" : typeof raw}${typeof raw === "object" ? ` (intrinsic shape: ${this.displayMasked(JSON.stringify(raw).slice(0, 80), context)})` : ""}.`);
 			roleArn = raw;
 		}
 		if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw new Error(`Fn::GetStackOutput: cannot reference own stack '${this.displayMasked(stackName, context)}' in the same region '${this.displayMasked(loggedRegionText, context)}'`);
@@ -32265,7 +32608,15 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* {@link positionalNameMask} turns them into the transform and owns why.
 	*/
 	maskStateReadError(error, pairs, context) {
-		const extraMask = this.positionalNameMask(pairs);
+		throw this.maskNamedError(error, this.positionalNameMask(pairs), context);
+	}
+	/**
+	* {@link maskStateReadError}'s body, RETURNING the masked clone rather than
+	* throwing it, so {@link namedRequestMasks} can hand the same answer to an
+	* SDK call site (go-to-k/cdkd#3171). `extraMask` is a
+	* {@link positionalNameMask} transform, or `undefined` for none.
+	*/
+	maskNamedError(error, extraMask, context) {
 		let masked = error;
 		let positional = extraMask;
 		for (const bag of [context?.inheritedSecrets, context?.recordedSecretValues]) {
@@ -32274,7 +32625,57 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			positional = void 0;
 		}
 		if (positional) masked = maskSecretsInError(masked, /* @__PURE__ */ new Map(), positional);
-		throw masked;
+		return masked;
+	}
+	/**
+	* The three masks an AWS SDK call site owes the text the SDK produces about a
+	* request that carried template-derived NAMES (go-to-k/cdkd#3171).
+	*
+	* The resolver masks every name it prints ITSELF through the name's log text
+	* (go-to-k/cdkd#3150), but an SDK rejection QUOTES the name it refused back —
+	* `ParameterNotFound: <name>`, a region in a describe failure — and that
+	* text reached only the needle mask, whose substring arm has the
+	* {@link MIN_NEEDLE_LENGTH} floor. A name an `Fn::Sub` assembled around a
+	* 1-3 character secret printed masked in the resolver's own words and in the
+	* clear a few characters later, in the SDK's.
+	*
+	* `pairs` are (raw name as SENT, that name's log text), the same shape
+	* {@link positionalNameMask} takes and for the same reason; an unmasked pair
+	* is dropped there. ONE helper returning all three, so a call site cannot
+	* adopt one and miss the others:
+	*
+	* - `error` — a masked CLONE of the whole cause chain
+	*   ({@link maskNamedError}), which keeps the class and every own descriptor,
+	*   so `isThrottlingError` / `isMarkedNonRetryable` still classify it;
+	* - `text` — a caught message about to be interpolated into a line or a
+	*   throw, positional pass first, then {@link displayMasked};
+	* - `retryLogger` — for `withRetry`, whose per-attempt `debug` line and
+	*   give-up `warn` interpolate the SDK message verbatim.
+	*
+	* THE WHOLE NAME is the key, never its secret span alone: the substitution
+	* rewrites every occurrence of the raw name wherever the SDK put it (inside
+	* an ARN, after a colon). That is what reaches a sub-floor secret — the
+	* whole name is longer than the secret — and it is also the bound: a name
+	* the SDK re-encodes or truncates before quoting it is not matched, and a
+	* masked name of 1-3 characters is matched only where the SDK quotes it
+	* exactly, which may over-mask unrelated text (the SAFE direction
+	* {@link positionalNameMask} documents).
+	*/
+	namedRequestMasks(pairs, context) {
+		const positional = this.positionalNameMask(this.explicitRegion !== void 0 && this.explicitRegionLogText !== void 0 ? [...pairs, [this.explicitRegion, this.explicitRegionLogText]] : pairs);
+		const text = (message) => this.displayMasked(positional ? positional(message) : message, context);
+		const line = (message) => {
+			const indent = /^ */.exec(message)?.[0] ?? "";
+			return indent + text(message.slice(indent.length));
+		};
+		return {
+			error: (error) => this.maskNamedError(error, positional, context),
+			text,
+			retryLogger: {
+				debug: (message) => this.logger.debug(line(message)),
+				warn: (message) => this.logger.warn(line(message))
+			}
+		};
 	}
 	/**
 	* Read the producer's state from the SAME AWS account (no RoleArn).
@@ -32453,7 +32854,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				Values: ["available"]
 			}] }))).AvailabilityZones || []).map((az) => az.ZoneName).filter((name) => name !== void 0).sort();
 		} catch (error) {
-			throw new Error(`Fn::GetAZs: failed to describe availability zones for region '${this.displayMasked(loggedRegionText ?? region, context)}': ${this.displayMasked(error instanceof Error ? error.message : String(error), context)}`);
+			const loggedRegion = this.displayMasked(loggedRegionText ?? region, context);
+			const masks = this.namedRequestMasks([[region, loggedRegion]], context);
+			throw new Error(`Fn::GetAZs: failed to describe availability zones for region '${loggedRegion}': ${masks.text(error instanceof Error ? error.message : String(error))}`);
 		}
 		if (azNames.length === 0) throw new Error(`Fn::GetAZs: no availability zones returned for region '${this.displayMasked(loggedRegionText ?? region, context)}'. Either the region is not enabled on this account (opt-in regions must be enabled before use), or the request was answered by a different region's endpoint.`);
 		cachedAvailabilityZones[region] = azNames;
@@ -32562,9 +32965,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* One constructor for both walks so neither can grow a second masking rule:
 	* `subject` and `message` are the only fields a consumer may render, and each
 	* carries its own route to a plaintext — an assembled reference puts one in
-	* the raw token (issue #2827), and an SDK rejection arrives RAW through
-	* `sendWithThrottleRetry` echoing the `Name` it was handed. `error` is kept
-	* unmasked on purpose and is documented as classification-only.
+	* the raw token (issue #2827), and an SDK rejection echoes the `Name` it was
+	* handed — which `sendWithThrottleRetry` now masks by position before it
+	* rethrows (go-to-k/cdkd#3171), so this is the second layer on that route.
+	* `error` is not re-masked here and is documented as classification-only.
 	*/
 	abandonedUnit(unit, subject, error, context, rawInput, preRedact) {
 		const raw = error instanceof Error ? error.message : String(error);
@@ -33320,7 +33724,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			...versionStage && versionStage !== "" && { VersionStage: versionStage },
 			...versionId && versionId !== "" && { VersionId: versionId }
 		});
-		const secretString = (await this.sendWithThrottleRetry(() => client.send(command), `secretsmanager:${loggedSecretId}`)).SecretString;
+		const secretString = (await this.sendWithThrottleRetry(() => client.send(command), `secretsmanager:${loggedSecretId}`, this.namedRequestMasks([
+			[secretId, loggedSecretId],
+			[versionStage, this.displayMasked(nameLogText(versionStage), context)],
+			[versionId, this.displayMasked(nameLogText(versionId), context)]
+		], context))).SecretString;
 		if (!secretString) throw new Error(`Dynamic reference: secret '${loggedSecretId}' does not contain a SecretString value`);
 		if (jsonKey) try {
 			const parsed = JSON.parse(secretString);
@@ -33355,7 +33763,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const count = Number(await this.resolveValue(rawCount, context));
 		const cidrBits = Number(await this.resolveValue(rawCidrBits, context));
 		if (!ipBlock || typeof ipBlock !== "string") throw new Error(`Fn::Cidr: ipBlock must be a string, got ${typeof ipBlock}: ${JSON.stringify(this.maskValueLeaves(ipBlock, context))}`);
-		this.logger.debug(`Resolving Fn::Cidr: ipBlock=${this.displayMasked(JSON.stringify(this.maskValueLeaves(ipBlock, context)), context)}, count=${count}, cidrBits=${cidrBits}`);
+		this.logger.debug(`Resolving Fn::Cidr: ipBlock=${this.displayMasked(JSON.stringify(this.maskValueLeaves(ipBlock, context)), context)}, count=${this.displayMasked(String(count), context)}, cidrBits=${this.displayMasked(String(cidrBits), context)}`);
 		const isIpv6 = ipBlock.includes(":");
 		const results = [];
 		if (isIpv6) {
@@ -33451,13 +33859,17 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*   sibling in the SAME region still shares the ambient instance, so the
 	*   window survives exactly where the two stacks agree on the region.
 	*/
-	sendWithThrottleRetry(operation, label) {
-		return withRetry(operation, label, {
-			maxRetries: MAX_DYNAMIC_REFERENCE_THROTTLE_RETRIES,
-			isRetryable: (_message, error) => isThrottlingError(error),
-			logger: this.logger,
-			...dynamicReferenceRetryDelays.sleep ? { sleep: dynamicReferenceRetryDelays.sleep } : {}
-		});
+	async sendWithThrottleRetry(operation, label, masks) {
+		try {
+			return await withRetry(operation, label, {
+				maxRetries: MAX_DYNAMIC_REFERENCE_THROTTLE_RETRIES,
+				isRetryable: (_message, error) => isThrottlingError(error),
+				logger: masks.retryLogger,
+				...dynamicReferenceRetryDelays.sleep ? { sleep: dynamicReferenceRetryDelays.sleep } : {}
+			});
+		} catch (error) {
+			throw masks.error(error);
+		}
 	}
 	/**
 	* Resolve an `{{resolve:ssm:...}}` dynamic reference, reporting whether the
@@ -33484,14 +33896,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			Name: parameterName,
 			WithDecryption: decrypt
 		});
-		const response = await this.sendWithThrottleRetry(() => client.send(command), `${service}:${loggedParameterName}`);
+		const response = await this.sendWithThrottleRetry(() => client.send(command), `${service}:${loggedParameterName}`, this.namedRequestMasks([[parameterName, loggedParameterName]], context));
 		const paramValue = response.Parameter?.Value;
 		if (paramValue === void 0 || paramValue === null) throw new Error(`Dynamic reference: SSM parameter '${loggedParameterName}' not found or has no value`);
 		const paramType = response.Parameter?.Type;
 		const secure = paramType !== "String" && paramType !== "StringList";
 		if (secure && paramType !== "SecureString" && !this.warnedUnrecognizedSsmTypes.has(injectiveKey(parameterName, String(paramType)))) {
 			this.warnedUnrecognizedSsmTypes.add(injectiveKey(parameterName, String(paramType)));
-			const reported = paramType === void 0 ? "(absent)" : `'${String(paramType)}'`;
+			const reported = paramType === void 0 ? "(absent)" : `'${this.displayMasked(String(paramType), context)}'`;
 			this.logger.warn(`SSM parameter '${loggedParameterName}' reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:${service}:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`);
 		}
 		return {
@@ -35175,7 +35587,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CLqajoRp.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CZTUKQnY.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -38598,7 +39010,7 @@ const MUTUALLY_EXCLUSIVE_PROPERTIES = /* @__PURE__ */ new Map([["AWS::EC2::Route
 * different questions about the shape and should not drift into one another's
 * behavior by accident.
 */
-function isUnresolvedIntrinsic(value) {
+function isUnresolvedIntrinsic$1(value) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
 	const keys = Object.keys(value);
 	return keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"));
@@ -38615,7 +39027,7 @@ function isUnresolvedIntrinsic(value) {
 * NOT yet known, so it is excluded ahead of the truthiness test.
 */
 function isDeclared(value) {
-	if (isUnresolvedIntrinsic(value)) return false;
+	if (isUnresolvedIntrinsic$1(value)) return false;
 	return Boolean(value);
 }
 /**
@@ -38643,7 +39055,7 @@ function findViolationsForRules(resourceType, rules, templateProperties) {
 	for (const rule of rules) {
 		const declared = rule.properties.filter((property) => isDeclared(templateProperties[property]));
 		if (declared.length <= 1) continue;
-		const winnerCertain = !rule.properties.slice(0, rule.properties.indexOf(declared[0])).some((property) => isUnresolvedIntrinsic(templateProperties[property]));
+		const winnerCertain = !rule.properties.slice(0, rule.properties.indexOf(declared[0])).some((property) => isUnresolvedIntrinsic$1(templateProperties[property]));
 		violations.push({
 			resourceType,
 			rule,
@@ -38677,6 +39089,1526 @@ function buildMutuallyExclusiveMessage(logicalId, violation) {
 	return `  - ${logicalId} (${resourceType}) declares ${declared.join(" and ")}\n      ${rule.rationale}${winnerNote}\n      Declare at most one of: ${rule.properties.join(" / ")}`;
 }
 
+//#endregion
+//#region src/provisioning/nested-required.generated.ts
+/**
+* AUTO-GENERATED by scripts/gen-nested-required.ts — DO NOT EDIT BY HAND.
+* Source: the `nestedRequired` section of tests/fixtures/cfn-schemas/*.json.
+* Regenerate: `vp run gen:nested-required`.
+*
+* Per resource type, each nested property PATH (dotted, arrays transparent)
+* mapped to the members its schema definition lists as `required`. What the
+* SCHEMA says, not what CloudFormation enforces: the pre-flight refusal in
+* `nested-required.ts` reads it only for types measured to be enforced.
+*/
+const NESTED_REQUIRED = /* @__PURE__ */ new Map([
+	["AWS::ApiGateway::Deployment", /* @__PURE__ */ new Map([["StageDescription.Tags", ["Key", "Value"]]])],
+	["AWS::ApiGateway::Method", /* @__PURE__ */ new Map([
+		["Integration", ["Type"]],
+		["Integration.IntegrationResponses", ["StatusCode"]],
+		["MethodResponses", ["StatusCode"]]
+	])],
+	["AWS::ApiGateway::Stage", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::ApiGatewayV2::Route", /* @__PURE__ */ new Map([["RequestParameters", ["Required"]]])],
+	["AWS::AppSync::DataSource", /* @__PURE__ */ new Map([
+		["DynamoDBConfig", ["AwsRegion", "TableName"]],
+		["DynamoDBConfig.DeltaSyncConfig", [
+			"BaseTableTTL",
+			"DeltaSyncTableName",
+			"DeltaSyncTableTTL"
+		]],
+		["ElasticsearchConfig", ["AwsRegion", "Endpoint"]],
+		["EventBridgeConfig", ["EventBusArn"]],
+		["HttpConfig", ["Endpoint"]],
+		["HttpConfig.AuthorizationConfig", ["AuthorizationType"]],
+		["LambdaConfig", ["LambdaFunctionArn"]],
+		["OpenSearchServiceConfig", ["AwsRegion", "Endpoint"]],
+		["RelationalDatabaseConfig", ["RelationalDatabaseSourceType"]],
+		["RelationalDatabaseConfig.RdsHttpEndpointConfig", [
+			"AwsRegion",
+			"AwsSecretStoreArn",
+			"DbClusterIdentifier"
+		]]
+	])],
+	["AWS::AppSync::GraphQLApi", /* @__PURE__ */ new Map([
+		["AdditionalAuthenticationProviders", ["AuthenticationType"]],
+		["EnhancedMetricsConfig", [
+			"DataSourceLevelMetricsBehavior",
+			"OperationLevelMetricsConfig",
+			"ResolverLevelMetricsBehavior"
+		]],
+		["LogConfig", ["CloudWatchLogsRoleArn", "FieldLogLevel"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::AppSync::Resolver", /* @__PURE__ */ new Map([
+		["CachingConfig", ["Ttl"]],
+		["Runtime", ["Name", "RuntimeVersion"]],
+		["SyncConfig", ["ConflictDetection"]]
+	])],
+	["AWS::AutoScaling::AutoScalingGroup", /* @__PURE__ */ new Map([
+		["AvailabilityZoneImpairmentPolicy", ["ImpairedZoneHealthCheckBehavior", "ZonalShiftEnabled"]],
+		["CapacityReservationSpecification", ["CapacityReservationPreference"]],
+		["LaunchTemplate", ["Version"]],
+		["LifecycleHookSpecificationList", ["LifecycleHookName", "LifecycleTransition"]],
+		["MetricsCollection", ["Granularity"]],
+		["MixedInstancesPolicy", ["LaunchTemplate"]],
+		["MixedInstancesPolicy.InstancesDistribution.DistributionSegments", ["TargetCapacityTypes"]],
+		["MixedInstancesPolicy.LaunchTemplate", ["LaunchTemplateSpecification"]],
+		["MixedInstancesPolicy.LaunchTemplate.LaunchTemplateSpecification", ["Version"]],
+		["MixedInstancesPolicy.LaunchTemplate.Overrides.InstanceRequirements", ["MemoryMiB", "VCpuCount"]],
+		["MixedInstancesPolicy.LaunchTemplate.Overrides.LaunchTemplateSpecification", ["Version"]],
+		["NotificationConfiguration", ["TopicARN"]],
+		["NotificationConfigurations", ["TopicARN"]],
+		["Tags", [
+			"Key",
+			"PropagateAtLaunch",
+			"Value"
+		]],
+		["TrafficSources", ["Identifier", "Type"]]
+	])],
+	["AWS::BedrockAgentCore::Evaluator", /* @__PURE__ */ new Map([
+		["EvaluatorConfig.CodeBased", ["LambdaConfig"]],
+		["EvaluatorConfig.CodeBased.LambdaConfig", ["LambdaArn"]],
+		["EvaluatorConfig.LlmAsAJudge", [
+			"Instructions",
+			"ModelConfig",
+			"RatingScale"
+		]],
+		["EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig", ["ModelId"]],
+		["EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig", ["ModelId"]],
+		["EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical", ["Definition", "Label"]],
+		["EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical", [
+			"Definition",
+			"Label",
+			"Value"
+		]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::BedrockAgentCore::Runtime", /* @__PURE__ */ new Map([
+		["AgentRuntimeArtifact.CodeConfiguration", [
+			"Code",
+			"EntryPoint",
+			"Runtime"
+		]],
+		["AgentRuntimeArtifact.CodeConfiguration.Code.S3", ["Bucket", "Prefix"]],
+		["AgentRuntimeArtifact.ContainerConfiguration", ["ContainerUri"]],
+		["AuthorizerConfiguration.CustomJWTAuthorizer", ["DiscoveryUrl"]],
+		["AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.HostingEnvironments", ["Arn"]],
+		["AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims", [
+			"AuthorizingClaimMatchValue",
+			"InboundTokenClaimName",
+			"InboundTokenClaimValueType"
+		]],
+		["AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims.AuthorizingClaimMatchValue", ["ClaimMatchOperator", "ClaimMatchValue"]],
+		["AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides", ["Domain", "PrivateEndpoint"]],
+		["CapacityProviderConfiguration", ["CapacityProviderArn"]],
+		["FilesystemConfigurations.CapacityProviderVolume", ["MountPath", "VolumeName"]],
+		["FilesystemConfigurations.EfsAccessPoint", ["AccessPointArn", "MountPath"]],
+		["FilesystemConfigurations.S3FilesAccessPoint", ["AccessPointArn", "MountPath"]],
+		["FilesystemConfigurations.SessionStorage", ["MountPath"]],
+		["NetworkConfiguration", ["NetworkMode"]],
+		["NetworkConfiguration.NetworkModeConfig", ["SecurityGroups", "Subnets"]],
+		["WorkloadIdentityDetails", ["WorkloadIdentityArn"]]
+	])],
+	["AWS::Budgets::Budget", /* @__PURE__ */ new Map([
+		["Budget", ["BudgetType", "TimeUnit"]],
+		["Budget.AutoAdjustData", ["AutoAdjustType"]],
+		["Budget.AutoAdjustData.HistoricalOptions", ["BudgetAdjustmentPeriod"]],
+		["Budget.BudgetLimit", ["Amount", "Unit"]],
+		["NotificationsWithSubscribers", ["Notification", "Subscribers"]],
+		["NotificationsWithSubscribers.Notification", [
+			"ComparisonOperator",
+			"NotificationType",
+			"Threshold"
+		]],
+		["NotificationsWithSubscribers.Subscribers", ["Address", "SubscriptionType"]],
+		["ResourceTags", ["Key"]]
+	])],
+	["AWS::CertificateManager::Certificate", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::CloudFormation::Stack", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::CloudFront::CloudFrontOriginAccessIdentity", /* @__PURE__ */ new Map([["CloudFrontOriginAccessIdentityConfig", ["Comment"]]])],
+	["AWS::CloudFront::Distribution", /* @__PURE__ */ new Map([
+		["DistributionConfig", ["DefaultCacheBehavior", "Enabled"]],
+		["DistributionConfig.CacheBehaviors", [
+			"PathPattern",
+			"TargetOriginId",
+			"ViewerProtocolPolicy"
+		]],
+		["DistributionConfig.CacheBehaviors.ForwardedValues", ["QueryString"]],
+		["DistributionConfig.CacheBehaviors.ForwardedValues.Cookies", ["Forward"]],
+		["DistributionConfig.CacheBehaviors.GrpcConfig", ["Enabled"]],
+		["DistributionConfig.CacheTagConfig", ["HeaderName"]],
+		["DistributionConfig.ConnectionFunctionAssociation", ["Id"]],
+		["DistributionConfig.CustomErrorResponses", ["ErrorCode"]],
+		["DistributionConfig.CustomOrigin", [
+			"DNSName",
+			"OriginProtocolPolicy",
+			"OriginSSLProtocols"
+		]],
+		["DistributionConfig.DefaultCacheBehavior", ["TargetOriginId", "ViewerProtocolPolicy"]],
+		["DistributionConfig.DefaultCacheBehavior.ForwardedValues", ["QueryString"]],
+		["DistributionConfig.DefaultCacheBehavior.ForwardedValues.Cookies", ["Forward"]],
+		["DistributionConfig.DefaultCacheBehavior.GrpcConfig", ["Enabled"]],
+		["DistributionConfig.OriginGroups", ["Quantity"]],
+		["DistributionConfig.OriginGroups.Items", [
+			"FailoverCriteria",
+			"Id",
+			"Members"
+		]],
+		["DistributionConfig.OriginGroups.Items.FailoverCriteria", ["StatusCodes"]],
+		["DistributionConfig.OriginGroups.Items.FailoverCriteria.StatusCodes", ["Items", "Quantity"]],
+		["DistributionConfig.OriginGroups.Items.Members", ["Items", "Quantity"]],
+		["DistributionConfig.OriginGroups.Items.Members.Items", ["OriginId"]],
+		["DistributionConfig.Origins", ["DomainName", "Id"]],
+		["DistributionConfig.Origins.CustomOriginConfig", ["OriginProtocolPolicy"]],
+		["DistributionConfig.Origins.CustomOriginConfig.OriginMtlsConfig", ["ClientCertificateArn"]],
+		["DistributionConfig.Origins.OriginCustomHeaders", ["HeaderName", "HeaderValue"]],
+		["DistributionConfig.Origins.VpcOriginConfig", ["VpcOriginId"]],
+		["DistributionConfig.Restrictions", ["GeoRestriction"]],
+		["DistributionConfig.Restrictions.GeoRestriction", ["RestrictionType"]],
+		["DistributionConfig.S3Origin", ["DNSName"]],
+		["DistributionConfig.TenantConfig.ParameterDefinitions", ["Definition", "Name"]],
+		["DistributionConfig.TenantConfig.ParameterDefinitions.Definition.StringSchema", ["Required"]],
+		["DistributionConfig.ViewerMtlsConfig.TrustStoreConfig", ["TrustStoreId"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::CloudFront::OriginAccessControl", /* @__PURE__ */ new Map([["OriginAccessControlConfig", [
+		"Name",
+		"OriginAccessControlOriginType",
+		"SigningBehavior",
+		"SigningProtocol"
+	]]])],
+	["AWS::CloudTrail::Trail", /* @__PURE__ */ new Map([
+		["AdvancedEventSelectors", ["FieldSelectors"]],
+		["AdvancedEventSelectors.FieldSelectors", ["Field"]],
+		["AggregationConfigurations", ["EventCategory", "Templates"]],
+		["EventSelectors.DataResources", ["Type"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::CloudWatch::Alarm", /* @__PURE__ */ new Map([
+		["Dimensions", ["Name", "Value"]],
+		["Metrics", ["Id"]],
+		["Metrics.MetricStat", [
+			"Metric",
+			"Period",
+			"Stat"
+		]],
+		["Metrics.MetricStat.Metric.Dimensions", ["Name", "Value"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::CloudWatch::AnomalyDetector", /* @__PURE__ */ new Map([
+		["Configuration.ExcludedTimeRanges", ["EndTime", "StartTime"]],
+		["Dimensions", ["Name", "Value"]],
+		["MetricMathAnomalyDetector.MetricDataQueries", ["Id"]],
+		["MetricMathAnomalyDetector.MetricDataQueries.MetricStat", [
+			"Metric",
+			"Period",
+			"Stat"
+		]],
+		["MetricMathAnomalyDetector.MetricDataQueries.MetricStat.Metric", ["MetricName", "Namespace"]],
+		["MetricMathAnomalyDetector.MetricDataQueries.MetricStat.Metric.Dimensions", ["Name", "Value"]],
+		["SingleMetricAnomalyDetector.Dimensions", ["Name", "Value"]]
+	])],
+	["AWS::CodeBuild::Project", /* @__PURE__ */ new Map([
+		["Artifacts", ["Type"]],
+		["Cache", ["Type"]],
+		["Environment", [
+			"ComputeType",
+			"Image",
+			"Type"
+		]],
+		["Environment.DockerServer", ["ComputeType"]],
+		["Environment.EnvironmentVariables", ["Name", "Value"]],
+		["Environment.RegistryCredential", ["Credential", "CredentialProvider"]],
+		["FileSystemLocations", [
+			"Identifier",
+			"Location",
+			"MountPoint",
+			"Type"
+		]],
+		["LogsConfig.CloudWatchLogs", ["Status"]],
+		["LogsConfig.S3Logs", ["Status"]],
+		["SecondaryArtifacts", ["Type"]],
+		["SecondarySourceVersions", ["SourceIdentifier"]],
+		["SecondarySources", ["Type"]],
+		["SecondarySources.Auth", ["Type"]],
+		["SecondarySources.GitSubmodulesConfig", ["FetchSubmodules"]],
+		["Source", ["Type"]],
+		["Source.Auth", ["Type"]],
+		["Source.GitSubmodulesConfig", ["FetchSubmodules"]],
+		["Tags", ["Key", "Value"]],
+		["Triggers.PullRequestBuildPolicy", ["RequiresCommentApproval"]],
+		["Triggers.ScopeConfiguration", ["Name"]]
+	])],
+	["AWS::CodeCommit::Repository", /* @__PURE__ */ new Map([
+		["Code", ["S3"]],
+		["Code.S3", ["Bucket", "Key"]],
+		["Tags", ["Key", "Value"]],
+		["Triggers", [
+			"DestinationArn",
+			"Events",
+			"Name"
+		]]
+	])],
+	["AWS::Cognito::UserPool", /* @__PURE__ */ new Map([["SmsConfiguration.EumsSms", ["CallerArn"]], ["UserAttributeUpdateSettings", ["AttributesRequireVerificationBeforeUpdate"]]])],
+	["AWS::DLM::LifecyclePolicy", /* @__PURE__ */ new Map([
+		["Exclusions.ExcludeTags", ["Key", "Value"]],
+		["PolicyDetails.Actions", ["CrossRegionCopy", "Name"]],
+		["PolicyDetails.Actions.CrossRegionCopy", ["EncryptionConfiguration", "Target"]],
+		["PolicyDetails.Actions.CrossRegionCopy.EncryptionConfiguration", ["Encrypted"]],
+		["PolicyDetails.Actions.CrossRegionCopy.RetainRule", ["Interval", "IntervalUnit"]],
+		["PolicyDetails.EventSource", ["Type"]],
+		["PolicyDetails.EventSource.Parameters", ["EventType", "SnapshotOwner"]],
+		["PolicyDetails.Exclusions.ExcludeTags", ["Key", "Value"]],
+		["PolicyDetails.Parameters.ExcludeDataVolumeTags", ["Key", "Value"]],
+		["PolicyDetails.Schedules.ArchiveRule", ["RetainRule"]],
+		["PolicyDetails.Schedules.ArchiveRule.RetainRule", ["RetentionArchiveTier"]],
+		["PolicyDetails.Schedules.CrossRegionCopyRules", ["Encrypted"]],
+		["PolicyDetails.Schedules.CrossRegionCopyRules.DeprecateRule", ["Interval", "IntervalUnit"]],
+		["PolicyDetails.Schedules.CrossRegionCopyRules.RetainRule", ["Interval", "IntervalUnit"]],
+		["PolicyDetails.Schedules.TagsToAdd", ["Key", "Value"]],
+		["PolicyDetails.Schedules.VariableTags", ["Key", "Value"]],
+		["PolicyDetails.TargetTags", ["Key", "Value"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::DocDB::DBCluster", /* @__PURE__ */ new Map([["ServerlessV2ScalingConfiguration", ["MaxCapacity", "MinCapacity"]], ["Tags", ["Key", "Value"]]])],
+	["AWS::DocDB::DBInstance", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::DocDB::DBSubnetGroup", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::DynamoDB::GlobalTable", /* @__PURE__ */ new Map([
+		["AttributeDefinitions", ["AttributeName", "AttributeType"]],
+		["GlobalSecondaryIndexes", [
+			"IndexName",
+			"KeySchema",
+			"Projection"
+		]],
+		["GlobalSecondaryIndexes.KeySchema", ["AttributeName", "KeyType"]],
+		["GlobalSecondaryIndexes.WriteProvisionedThroughputSettings.WriteCapacityAutoScalingSettings", [
+			"MaxCapacity",
+			"MinCapacity",
+			"TargetTrackingScalingPolicyConfiguration"
+		]],
+		["GlobalSecondaryIndexes.WriteProvisionedThroughputSettings.WriteCapacityAutoScalingSettings.TargetTrackingScalingPolicyConfiguration", ["TargetValue"]],
+		["KeySchema", ["AttributeName", "KeyType"]],
+		["LocalSecondaryIndexes", [
+			"IndexName",
+			"KeySchema",
+			"Projection"
+		]],
+		["LocalSecondaryIndexes.KeySchema", ["AttributeName", "KeyType"]],
+		["Replicas", ["Region"]],
+		["Replicas.ContributorInsightsSpecification", ["Enabled"]],
+		["Replicas.GlobalSecondaryIndexes", ["IndexName"]],
+		["Replicas.GlobalSecondaryIndexes.ContributorInsightsSpecification", ["Enabled"]],
+		["Replicas.GlobalSecondaryIndexes.ReadProvisionedThroughputSettings.ReadCapacityAutoScalingSettings", [
+			"MaxCapacity",
+			"MinCapacity",
+			"TargetTrackingScalingPolicyConfiguration"
+		]],
+		["Replicas.GlobalSecondaryIndexes.ReadProvisionedThroughputSettings.ReadCapacityAutoScalingSettings.TargetTrackingScalingPolicyConfiguration", ["TargetValue"]],
+		["Replicas.KinesisStreamSpecification", ["StreamArn"]],
+		["Replicas.ReadProvisionedThroughputSettings.ReadCapacityAutoScalingSettings", [
+			"MaxCapacity",
+			"MinCapacity",
+			"TargetTrackingScalingPolicyConfiguration"
+		]],
+		["Replicas.ReadProvisionedThroughputSettings.ReadCapacityAutoScalingSettings.TargetTrackingScalingPolicyConfiguration", ["TargetValue"]],
+		["Replicas.ReplicaStreamSpecification.ResourcePolicy", ["PolicyDocument"]],
+		["Replicas.ReplicaStreamSpecification.Tags", ["Key", "Value"]],
+		["Replicas.ResourcePolicy", ["PolicyDocument"]],
+		["Replicas.SSESpecification", ["KMSMasterKeyId"]],
+		["Replicas.Tags", ["Key", "Value"]],
+		["SSESpecification", ["SSEEnabled"]],
+		["StreamSpecification", ["StreamViewType"]],
+		["TimeToLiveSpecification", ["Enabled"]],
+		["VectorIndexes", [
+			"Dimensions",
+			"DistanceFunction",
+			"IndexName",
+			"Projection",
+			"VectorAttribute"
+		]],
+		["VectorIndexes.SearchSchema", ["AttributeName", "SearchSchemaElementType"]],
+		["VectorIndexes.VectorAttribute", ["AttributeName"]],
+		["WriteProvisionedThroughputSettings.WriteCapacityAutoScalingSettings", [
+			"MaxCapacity",
+			"MinCapacity",
+			"TargetTrackingScalingPolicyConfiguration"
+		]],
+		["WriteProvisionedThroughputSettings.WriteCapacityAutoScalingSettings.TargetTrackingScalingPolicyConfiguration", ["TargetValue"]]
+	])],
+	["AWS::DynamoDB::Table", /* @__PURE__ */ new Map([
+		["AttributeDefinitions", ["AttributeName", "AttributeType"]],
+		["ContributorInsightsSpecification", ["Enabled"]],
+		["GlobalSecondaryIndexes", [
+			"IndexName",
+			"KeySchema",
+			"Projection"
+		]],
+		["GlobalSecondaryIndexes.ContributorInsightsSpecification", ["Enabled"]],
+		["GlobalSecondaryIndexes.KeySchema", ["AttributeName", "KeyType"]],
+		["GlobalSecondaryIndexes.ProvisionedThroughput", ["ReadCapacityUnits", "WriteCapacityUnits"]],
+		["ImportSourceSpecification", ["InputFormat", "S3BucketSource"]],
+		["ImportSourceSpecification.S3BucketSource", ["S3Bucket"]],
+		["KinesisStreamSpecification", ["StreamArn"]],
+		["LocalSecondaryIndexes", [
+			"IndexName",
+			"KeySchema",
+			"Projection"
+		]],
+		["LocalSecondaryIndexes.KeySchema", ["AttributeName", "KeyType"]],
+		["ProvisionedThroughput", ["ReadCapacityUnits", "WriteCapacityUnits"]],
+		["ResourcePolicy", ["PolicyDocument"]],
+		["SSESpecification", ["SSEEnabled"]],
+		["StreamSpecification", ["StreamViewType"]],
+		["StreamSpecification.ResourcePolicy", ["PolicyDocument"]],
+		["StreamSpecification.Tags", ["Key", "Value"]],
+		["Tags", ["Key", "Value"]],
+		["TimeToLiveSpecification", ["Enabled"]],
+		["VectorIndexes", [
+			"Dimensions",
+			"DistanceFunction",
+			"IndexName",
+			"Projection",
+			"VectorAttribute"
+		]],
+		["VectorIndexes.SearchSchema", ["AttributeName", "SearchSchemaElementType"]],
+		["VectorIndexes.VectorAttribute", ["AttributeName"]]
+	])],
+	["AWS::EC2::EIP", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::EC2::Instance", /* @__PURE__ */ new Map([
+		["BlockDeviceMappings", ["DeviceName"]],
+		["ElasticGpuSpecifications", ["Type"]],
+		["ElasticInferenceAccelerators", ["Type"]],
+		["Ipv6Addresses", ["Ipv6Address"]],
+		["LicenseSpecifications", ["LicenseConfigurationArn"]],
+		["NetworkInterfaces", ["DeviceIndex"]],
+		["NetworkInterfaces.Ipv6Addresses", ["Ipv6Address"]],
+		["NetworkInterfaces.PrivateIpAddresses", ["Primary", "PrivateIpAddress"]],
+		["SsmAssociations", ["DocumentName"]],
+		["SsmAssociations.AssociationParameters", ["Key", "Value"]],
+		["Tags", ["Key", "Value"]],
+		["Volumes", ["Device", "VolumeId"]]
+	])],
+	["AWS::EC2::InternetGateway", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::EC2::NatGateway", /* @__PURE__ */ new Map([["AvailabilityZoneAddresses", ["AllocationIds"]], ["Tags", ["Key", "Value"]]])],
+	["AWS::EC2::NetworkAcl", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::EC2::RouteTable", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::EC2::SecurityGroup", /* @__PURE__ */ new Map([
+		["SecurityGroupEgress", ["IpProtocol"]],
+		["SecurityGroupIngress", ["IpProtocol"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::EC2::Subnet", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::EC2::VPC", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::ECR::Repository", /* @__PURE__ */ new Map([
+		["EncryptionConfiguration", ["EncryptionType"]],
+		["ImageTagMutabilityExclusionFilters", ["ImageTagMutabilityExclusionFilterType", "ImageTagMutabilityExclusionFilterValue"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::ECS::Service", /* @__PURE__ */ new Map([
+		["DeploymentConfiguration.Alarms", [
+			"AlarmNames",
+			"Enable",
+			"Rollback"
+		]],
+		["DeploymentConfiguration.DeploymentCircuitBreaker", ["Enable", "Rollback"]],
+		["DeploymentConfiguration.DeploymentCircuitBreaker.ThresholdConfiguration", ["Type", "Value"]],
+		["DeploymentConfiguration.LifecycleHooks", ["LifecycleStages"]],
+		["ForceNewDeployment", ["EnableForceNewDeployment"]],
+		["LoadBalancers.AdvancedConfiguration", ["AlternateTargetGroupArn"]],
+		["Monitoring", ["MetricConfigurations"]],
+		["Monitoring.MetricConfigurations", ["MetricNames", "ResolutionSeconds"]],
+		["PlacementConstraints", ["Type"]],
+		["PlacementStrategies", ["Type"]],
+		["ServiceConnectConfiguration", ["Enabled"]],
+		["ServiceConnectConfiguration.AccessLogConfiguration", ["Format"]],
+		["ServiceConnectConfiguration.LogConfiguration.SecretOptions", ["Name", "ValueFrom"]],
+		["ServiceConnectConfiguration.Services", ["PortName"]],
+		["ServiceConnectConfiguration.Services.ClientAliases", ["Port"]],
+		["ServiceConnectConfiguration.Services.ClientAliases.TestTrafficRules", ["Header"]],
+		["ServiceConnectConfiguration.Services.ClientAliases.TestTrafficRules.Header", ["Name"]],
+		["ServiceConnectConfiguration.Services.ClientAliases.TestTrafficRules.Header.Value", ["Exact"]],
+		["ServiceConnectConfiguration.Services.Tls", ["IssuerCertificateAuthority"]],
+		["VolumeConfigurations", ["Name"]],
+		["VolumeConfigurations.ManagedEBSVolume", ["RoleArn"]],
+		["VolumeConfigurations.ManagedEBSVolume.TagSpecifications", ["ResourceType"]],
+		["VpcLatticeConfigurations", [
+			"PortName",
+			"RoleArn",
+			"TargetGroupArn"
+		]]
+	])],
+	["AWS::ECS::TaskDefinition", /* @__PURE__ */ new Map([
+		["ContainerDefinitions", ["Image", "Name"]],
+		["ContainerDefinitions.LinuxParameters.Tmpfs", ["Size"]],
+		["ContainerDefinitions.LogConfiguration", ["LogDriver"]],
+		["ContainerDefinitions.LogConfiguration.SecretOptions", ["Name", "ValueFrom"]],
+		["ContainerDefinitions.ResourceRequirements", ["Type", "Value"]],
+		["ContainerDefinitions.Secrets", ["Name", "ValueFrom"]],
+		["ContainerDefinitions.Ulimits", [
+			"HardLimit",
+			"Name",
+			"SoftLimit"
+		]],
+		["PlacementConstraints", ["Type"]],
+		["ProxyConfiguration", ["ContainerName"]],
+		["Volumes.EFSVolumeConfiguration", ["FilesystemId"]],
+		["Volumes.FSxWindowsFileServerVolumeConfiguration", ["FileSystemId", "RootDirectory"]],
+		["Volumes.FSxWindowsFileServerVolumeConfiguration.AuthorizationConfig", ["CredentialsParameter", "Domain"]],
+		["Volumes.S3FilesVolumeConfiguration", ["FileSystemArn"]]
+	])],
+	["AWS::EFS::AccessPoint", /* @__PURE__ */ new Map([["PosixUser", ["Gid", "Uid"]], ["RootDirectory.CreationInfo", [
+		"OwnerGid",
+		"OwnerUid",
+		"Permissions"
+	]]])],
+	["AWS::EFS::FileSystem", /* @__PURE__ */ new Map([["BackupPolicy", ["Status"]], ["FileSystemTags", ["Key", "Value"]]])],
+	["AWS::ElastiCache::CacheCluster", /* @__PURE__ */ new Map([
+		["LogDeliveryConfigurations", [
+			"DestinationDetails",
+			"DestinationType",
+			"LogFormat",
+			"LogType"
+		]],
+		["LogDeliveryConfigurations.DestinationDetails.CloudWatchLogsDetails", ["LogGroup"]],
+		["LogDeliveryConfigurations.DestinationDetails.KinesisFirehoseDetails", ["DeliveryStream"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::ElastiCache::SubnetGroup", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::ElasticLoadBalancingV2::Listener", /* @__PURE__ */ new Map([
+		["DefaultActions", ["Type"]],
+		["DefaultActions.AuthenticateCognitoConfig", [
+			"UserPoolArn",
+			"UserPoolClientId",
+			"UserPoolDomain"
+		]],
+		["DefaultActions.AuthenticateOidcConfig", [
+			"AuthorizationEndpoint",
+			"ClientId",
+			"Issuer",
+			"TokenEndpoint",
+			"UserInfoEndpoint"
+		]],
+		["DefaultActions.FixedResponseConfig", ["StatusCode"]],
+		["DefaultActions.JwtValidationConfig", ["Issuer", "JwksEndpoint"]],
+		["DefaultActions.JwtValidationConfig.AdditionalClaims", [
+			"Format",
+			"Name",
+			"Values"
+		]],
+		["DefaultActions.RedirectConfig", ["StatusCode"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::ElasticLoadBalancingV2::LoadBalancer", /* @__PURE__ */ new Map([
+		["MinimumLoadBalancerCapacity", ["CapacityUnits"]],
+		["SubnetMappings", ["SubnetId"]],
+		["Tags", ["Key"]]
+	])],
+	["AWS::ElasticLoadBalancingV2::TargetGroup", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]], ["Targets", ["Id"]]])],
+	["AWS::EMR::Cluster", /* @__PURE__ */ new Map([
+		["BootstrapActions", ["Name", "ScriptBootstrapAction"]],
+		["BootstrapActions.ScriptBootstrapAction", ["Path"]],
+		["Instances.CoreInstanceFleet.InstanceTypeConfigs", ["InstanceType"]],
+		["Instances.CoreInstanceFleet.InstanceTypeConfigs.EbsConfiguration.EbsBlockDeviceConfigs", ["VolumeSpecification"]],
+		["Instances.CoreInstanceFleet.InstanceTypeConfigs.EbsConfiguration.EbsBlockDeviceConfigs.VolumeSpecification", ["SizeInGB", "VolumeType"]],
+		["Instances.CoreInstanceFleet.LaunchSpecifications.OnDemandSpecification", ["AllocationStrategy"]],
+		["Instances.CoreInstanceFleet.LaunchSpecifications.SpotSpecification", ["TimeoutAction", "TimeoutDurationMinutes"]],
+		["Instances.CoreInstanceGroup", ["InstanceCount", "InstanceType"]],
+		["Instances.CoreInstanceGroup.AutoScalingPolicy", ["Constraints", "Rules"]],
+		["Instances.CoreInstanceGroup.AutoScalingPolicy.Constraints", ["MaxCapacity", "MinCapacity"]],
+		["Instances.CoreInstanceGroup.AutoScalingPolicy.Rules", [
+			"Action",
+			"Name",
+			"Trigger"
+		]],
+		["Instances.CoreInstanceGroup.AutoScalingPolicy.Rules.Action", ["SimpleScalingPolicyConfiguration"]],
+		["Instances.CoreInstanceGroup.AutoScalingPolicy.Rules.Action.SimpleScalingPolicyConfiguration", ["ScalingAdjustment"]],
+		["Instances.CoreInstanceGroup.AutoScalingPolicy.Rules.Trigger", ["CloudWatchAlarmDefinition"]],
+		["Instances.CoreInstanceGroup.AutoScalingPolicy.Rules.Trigger.CloudWatchAlarmDefinition", [
+			"ComparisonOperator",
+			"MetricName",
+			"Period",
+			"Threshold"
+		]],
+		["Instances.CoreInstanceGroup.AutoScalingPolicy.Rules.Trigger.CloudWatchAlarmDefinition.Dimensions", ["Key", "Value"]],
+		["Instances.CoreInstanceGroup.EbsConfiguration.EbsBlockDeviceConfigs", ["VolumeSpecification"]],
+		["Instances.CoreInstanceGroup.EbsConfiguration.EbsBlockDeviceConfigs.VolumeSpecification", ["SizeInGB", "VolumeType"]],
+		["Instances.MasterInstanceFleet.InstanceTypeConfigs", ["InstanceType"]],
+		["Instances.MasterInstanceFleet.InstanceTypeConfigs.EbsConfiguration.EbsBlockDeviceConfigs", ["VolumeSpecification"]],
+		["Instances.MasterInstanceFleet.InstanceTypeConfigs.EbsConfiguration.EbsBlockDeviceConfigs.VolumeSpecification", ["SizeInGB", "VolumeType"]],
+		["Instances.MasterInstanceFleet.LaunchSpecifications.OnDemandSpecification", ["AllocationStrategy"]],
+		["Instances.MasterInstanceFleet.LaunchSpecifications.SpotSpecification", ["TimeoutAction", "TimeoutDurationMinutes"]],
+		["Instances.MasterInstanceGroup", ["InstanceCount", "InstanceType"]],
+		["Instances.MasterInstanceGroup.AutoScalingPolicy", ["Constraints", "Rules"]],
+		["Instances.MasterInstanceGroup.AutoScalingPolicy.Constraints", ["MaxCapacity", "MinCapacity"]],
+		["Instances.MasterInstanceGroup.AutoScalingPolicy.Rules", [
+			"Action",
+			"Name",
+			"Trigger"
+		]],
+		["Instances.MasterInstanceGroup.AutoScalingPolicy.Rules.Action", ["SimpleScalingPolicyConfiguration"]],
+		["Instances.MasterInstanceGroup.AutoScalingPolicy.Rules.Action.SimpleScalingPolicyConfiguration", ["ScalingAdjustment"]],
+		["Instances.MasterInstanceGroup.AutoScalingPolicy.Rules.Trigger", ["CloudWatchAlarmDefinition"]],
+		["Instances.MasterInstanceGroup.AutoScalingPolicy.Rules.Trigger.CloudWatchAlarmDefinition", [
+			"ComparisonOperator",
+			"MetricName",
+			"Period",
+			"Threshold"
+		]],
+		["Instances.MasterInstanceGroup.AutoScalingPolicy.Rules.Trigger.CloudWatchAlarmDefinition.Dimensions", ["Key", "Value"]],
+		["Instances.MasterInstanceGroup.EbsConfiguration.EbsBlockDeviceConfigs", ["VolumeSpecification"]],
+		["Instances.MasterInstanceGroup.EbsConfiguration.EbsBlockDeviceConfigs.VolumeSpecification", ["SizeInGB", "VolumeType"]],
+		["Instances.Placement", ["AvailabilityZone"]],
+		["Instances.TaskInstanceFleets.InstanceTypeConfigs", ["InstanceType"]],
+		["Instances.TaskInstanceFleets.InstanceTypeConfigs.EbsConfiguration.EbsBlockDeviceConfigs", ["VolumeSpecification"]],
+		["Instances.TaskInstanceFleets.InstanceTypeConfigs.EbsConfiguration.EbsBlockDeviceConfigs.VolumeSpecification", ["SizeInGB", "VolumeType"]],
+		["Instances.TaskInstanceFleets.LaunchSpecifications.OnDemandSpecification", ["AllocationStrategy"]],
+		["Instances.TaskInstanceFleets.LaunchSpecifications.SpotSpecification", ["TimeoutAction", "TimeoutDurationMinutes"]],
+		["Instances.TaskInstanceGroups", ["InstanceCount", "InstanceType"]],
+		["Instances.TaskInstanceGroups.AutoScalingPolicy", ["Constraints", "Rules"]],
+		["Instances.TaskInstanceGroups.AutoScalingPolicy.Constraints", ["MaxCapacity", "MinCapacity"]],
+		["Instances.TaskInstanceGroups.AutoScalingPolicy.Rules", [
+			"Action",
+			"Name",
+			"Trigger"
+		]],
+		["Instances.TaskInstanceGroups.AutoScalingPolicy.Rules.Action", ["SimpleScalingPolicyConfiguration"]],
+		["Instances.TaskInstanceGroups.AutoScalingPolicy.Rules.Action.SimpleScalingPolicyConfiguration", ["ScalingAdjustment"]],
+		["Instances.TaskInstanceGroups.AutoScalingPolicy.Rules.Trigger", ["CloudWatchAlarmDefinition"]],
+		["Instances.TaskInstanceGroups.AutoScalingPolicy.Rules.Trigger.CloudWatchAlarmDefinition", [
+			"ComparisonOperator",
+			"MetricName",
+			"Period",
+			"Threshold"
+		]],
+		["Instances.TaskInstanceGroups.AutoScalingPolicy.Rules.Trigger.CloudWatchAlarmDefinition.Dimensions", ["Key", "Value"]],
+		["Instances.TaskInstanceGroups.EbsConfiguration.EbsBlockDeviceConfigs", ["VolumeSpecification"]],
+		["Instances.TaskInstanceGroups.EbsConfiguration.EbsBlockDeviceConfigs.VolumeSpecification", ["SizeInGB", "VolumeType"]],
+		["KerberosAttributes", ["KdcAdminPassword", "Realm"]],
+		["ManagedScalingPolicy.ComputeLimits", [
+			"MaximumCapacityUnits",
+			"MinimumCapacityUnits",
+			"UnitType"
+		]],
+		["PlacementGroupConfigs", ["InstanceRole"]],
+		["Steps", ["HadoopJarStep", "Name"]],
+		["Steps.HadoopJarStep", ["Jar"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::EMR::InstanceFleetConfig", /* @__PURE__ */ new Map([
+		["InstanceTypeConfigs", ["InstanceType"]],
+		["InstanceTypeConfigs.EbsConfiguration.EbsBlockDeviceConfigs", ["VolumeSpecification"]],
+		["InstanceTypeConfigs.EbsConfiguration.EbsBlockDeviceConfigs.VolumeSpecification", ["SizeInGB", "VolumeType"]],
+		["LaunchSpecifications.OnDemandSpecification", ["AllocationStrategy"]],
+		["LaunchSpecifications.SpotSpecification", ["TimeoutAction", "TimeoutDurationMinutes"]]
+	])],
+	["AWS::EMR::InstanceGroupConfig", /* @__PURE__ */ new Map([
+		["AutoScalingPolicy", ["Constraints", "Rules"]],
+		["AutoScalingPolicy.Constraints", ["MaxCapacity", "MinCapacity"]],
+		["AutoScalingPolicy.Rules", [
+			"Action",
+			"Name",
+			"Trigger"
+		]],
+		["AutoScalingPolicy.Rules.Action", ["SimpleScalingPolicyConfiguration"]],
+		["AutoScalingPolicy.Rules.Action.SimpleScalingPolicyConfiguration", ["ScalingAdjustment"]],
+		["AutoScalingPolicy.Rules.Trigger", ["CloudWatchAlarmDefinition"]],
+		["AutoScalingPolicy.Rules.Trigger.CloudWatchAlarmDefinition", [
+			"ComparisonOperator",
+			"MetricName",
+			"Period",
+			"Threshold"
+		]],
+		["AutoScalingPolicy.Rules.Trigger.CloudWatchAlarmDefinition.Dimensions", ["Key", "Value"]],
+		["EbsConfiguration.EbsBlockDeviceConfigs", ["VolumeSpecification"]],
+		["EbsConfiguration.EbsBlockDeviceConfigs.VolumeSpecification", ["SizeInGB", "VolumeType"]]
+	])],
+	["AWS::Events::EventBus", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::Events::Rule", /* @__PURE__ */ new Map([
+		["Targets", ["Arn", "Id"]],
+		["Targets.AppSyncParameters", ["GraphQLOperation"]],
+		["Targets.BatchParameters", ["JobDefinition", "JobName"]],
+		["Targets.EcsParameters", ["TaskDefinitionArn"]],
+		["Targets.EcsParameters.CapacityProviderStrategy", ["CapacityProvider"]],
+		["Targets.EcsParameters.NetworkConfiguration.AwsVpcConfiguration", ["Subnets"]],
+		["Targets.InputTransformer", ["InputTemplate"]],
+		["Targets.KinesisParameters", ["PartitionKeyPath"]],
+		["Targets.RedshiftDataParameters", ["Database"]],
+		["Targets.RunCommandParameters", ["RunCommandTargets"]],
+		["Targets.RunCommandParameters.RunCommandTargets", ["Key", "Values"]],
+		["Targets.SageMakerPipelineParameters.PipelineParameterList", ["Name", "Value"]],
+		["Targets.SqsParameters", ["MessageGroupId"]]
+	])],
+	["AWS::FSx::FileSystem", /* @__PURE__ */ new Map([
+		["LustreConfiguration.LogConfiguration", ["Level"]],
+		["OntapConfiguration", ["DeploymentType"]],
+		["OpenZFSConfiguration", ["DeploymentType"]],
+		["Tags", ["Key", "Value"]],
+		["WindowsConfiguration", ["ThroughputCapacity"]],
+		["WindowsConfiguration.AuditLogConfiguration", ["FileAccessAuditLogLevel", "FileShareAccessAuditLogLevel"]],
+		["WindowsConfiguration.FsrmConfiguration", ["FsrmServiceEnabled"]]
+	])],
+	["AWS::Glue::Connection", /* @__PURE__ */ new Map([["ConnectionInput", ["ConnectionType"]], ["ConnectionInput.AuthenticationConfiguration", ["AuthenticationType"]]])],
+	["AWS::Glue::Table", /* @__PURE__ */ new Map([
+		["OpenTableFormatInput.IcebergInput.IcebergTableInput", ["Location", "Schema"]],
+		["OpenTableFormatInput.IcebergInput.IcebergTableInput.PartitionSpec", ["Fields"]],
+		["OpenTableFormatInput.IcebergInput.IcebergTableInput.PartitionSpec.Fields", [
+			"Name",
+			"SourceId",
+			"Transform"
+		]],
+		["OpenTableFormatInput.IcebergInput.IcebergTableInput.Schema", ["Fields"]],
+		["OpenTableFormatInput.IcebergInput.IcebergTableInput.Schema.Fields", [
+			"Id",
+			"Name",
+			"Required",
+			"Type"
+		]],
+		["OpenTableFormatInput.IcebergInput.IcebergTableInput.WriteOrder", ["Fields", "OrderId"]],
+		["OpenTableFormatInput.IcebergInput.IcebergTableInput.WriteOrder.Fields", [
+			"Direction",
+			"NullOrder",
+			"SourceId",
+			"Transform"
+		]],
+		["TableInput.PartitionKeys", ["Name"]],
+		["TableInput.StorageDescriptor.Columns", ["Name"]],
+		["TableInput.StorageDescriptor.SortColumns", ["Column", "SortOrder"]]
+	])],
+	["AWS::Glue::Trigger", /* @__PURE__ */ new Map([["EventBatchingCondition", ["BatchSize"]]])],
+	["AWS::IAM::Group", /* @__PURE__ */ new Map([["Policies", ["PolicyDocument", "PolicyName"]]])],
+	["AWS::IAM::Role", /* @__PURE__ */ new Map([["Policies", ["PolicyDocument", "PolicyName"]], ["Tags", ["Key", "Value"]]])],
+	["AWS::IAM::User", /* @__PURE__ */ new Map([
+		["LoginProfile", ["Password"]],
+		["Policies", ["PolicyDocument", "PolicyName"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::Kinesis::Stream", /* @__PURE__ */ new Map([
+		["StreamEncryption", ["EncryptionType", "KeyId"]],
+		["StreamModeDetails", ["StreamMode"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::Kinesis::StreamConsumer", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::KinesisFirehose::DeliveryStream", /* @__PURE__ */ new Map([
+		["AmazonOpenSearchServerlessDestinationConfiguration", [
+			"IndexName",
+			"RoleARN",
+			"S3Configuration"
+		]],
+		["AmazonOpenSearchServerlessDestinationConfiguration.ProcessingConfiguration.Processors", ["Type"]],
+		["AmazonOpenSearchServerlessDestinationConfiguration.ProcessingConfiguration.Processors.Parameters", ["ParameterName", "ParameterValue"]],
+		["AmazonOpenSearchServerlessDestinationConfiguration.S3Configuration", ["BucketARN", "RoleARN"]],
+		["AmazonOpenSearchServerlessDestinationConfiguration.S3Configuration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["AmazonOpenSearchServerlessDestinationConfiguration.VpcConfiguration", [
+			"RoleARN",
+			"SecurityGroupIds",
+			"SubnetIds"
+		]],
+		["AmazonopensearchserviceDestinationConfiguration", [
+			"IndexName",
+			"RoleARN",
+			"S3Configuration"
+		]],
+		["AmazonopensearchserviceDestinationConfiguration.DocumentIdOptions", ["DefaultDocumentIdFormat"]],
+		["AmazonopensearchserviceDestinationConfiguration.ProcessingConfiguration.Processors", ["Type"]],
+		["AmazonopensearchserviceDestinationConfiguration.ProcessingConfiguration.Processors.Parameters", ["ParameterName", "ParameterValue"]],
+		["AmazonopensearchserviceDestinationConfiguration.S3Configuration", ["BucketARN", "RoleARN"]],
+		["AmazonopensearchserviceDestinationConfiguration.S3Configuration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["AmazonopensearchserviceDestinationConfiguration.VpcConfiguration", [
+			"RoleARN",
+			"SecurityGroupIds",
+			"SubnetIds"
+		]],
+		["DatabaseSourceConfiguration", [
+			"DatabaseSourceAuthenticationConfiguration",
+			"DatabaseSourceVPCConfiguration",
+			"Databases",
+			"Endpoint",
+			"Port",
+			"SnapshotWatermarkTable",
+			"Tables",
+			"Type"
+		]],
+		["DatabaseSourceConfiguration.DatabaseSourceAuthenticationConfiguration", ["SecretsManagerConfiguration"]],
+		["DatabaseSourceConfiguration.DatabaseSourceAuthenticationConfiguration.SecretsManagerConfiguration", ["Enabled"]],
+		["DatabaseSourceConfiguration.DatabaseSourceVPCConfiguration", ["VpcEndpointServiceName"]],
+		["DeliveryStreamEncryptionConfigurationInput", ["KeyType"]],
+		["ElasticsearchDestinationConfiguration", [
+			"IndexName",
+			"RoleARN",
+			"S3Configuration"
+		]],
+		["ElasticsearchDestinationConfiguration.DocumentIdOptions", ["DefaultDocumentIdFormat"]],
+		["ElasticsearchDestinationConfiguration.ProcessingConfiguration.Processors", ["Type"]],
+		["ElasticsearchDestinationConfiguration.ProcessingConfiguration.Processors.Parameters", ["ParameterName", "ParameterValue"]],
+		["ElasticsearchDestinationConfiguration.S3Configuration", ["BucketARN", "RoleARN"]],
+		["ElasticsearchDestinationConfiguration.S3Configuration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["ElasticsearchDestinationConfiguration.VpcConfiguration", [
+			"RoleARN",
+			"SecurityGroupIds",
+			"SubnetIds"
+		]],
+		["ExtendedS3DestinationConfiguration", ["BucketARN", "RoleARN"]],
+		["ExtendedS3DestinationConfiguration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["ExtendedS3DestinationConfiguration.ProcessingConfiguration.Processors", ["Type"]],
+		["ExtendedS3DestinationConfiguration.ProcessingConfiguration.Processors.Parameters", ["ParameterName", "ParameterValue"]],
+		["ExtendedS3DestinationConfiguration.S3BackupConfiguration", ["BucketARN", "RoleARN"]],
+		["ExtendedS3DestinationConfiguration.S3BackupConfiguration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["HttpEndpointDestinationConfiguration", ["EndpointConfiguration", "S3Configuration"]],
+		["HttpEndpointDestinationConfiguration.EndpointConfiguration", ["Url"]],
+		["HttpEndpointDestinationConfiguration.ProcessingConfiguration.Processors", ["Type"]],
+		["HttpEndpointDestinationConfiguration.ProcessingConfiguration.Processors.Parameters", ["ParameterName", "ParameterValue"]],
+		["HttpEndpointDestinationConfiguration.RequestConfiguration.CommonAttributes", ["AttributeName", "AttributeValue"]],
+		["HttpEndpointDestinationConfiguration.S3Configuration", ["BucketARN", "RoleARN"]],
+		["HttpEndpointDestinationConfiguration.S3Configuration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["HttpEndpointDestinationConfiguration.SecretsManagerConfiguration", ["Enabled"]],
+		["IcebergDestinationConfiguration", [
+			"CatalogConfiguration",
+			"RoleARN",
+			"S3Configuration"
+		]],
+		["IcebergDestinationConfiguration.DestinationTableConfigurationList", ["DestinationDatabaseName", "DestinationTableName"]],
+		["IcebergDestinationConfiguration.DestinationTableConfigurationList.PartitionSpec.Identity", ["SourceName"]],
+		["IcebergDestinationConfiguration.ProcessingConfiguration.Processors", ["Type"]],
+		["IcebergDestinationConfiguration.ProcessingConfiguration.Processors.Parameters", ["ParameterName", "ParameterValue"]],
+		["IcebergDestinationConfiguration.S3Configuration", ["BucketARN", "RoleARN"]],
+		["IcebergDestinationConfiguration.S3Configuration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["KinesisStreamSourceConfiguration", ["KinesisStreamARN", "RoleARN"]],
+		["MSKSourceConfiguration", [
+			"AuthenticationConfiguration",
+			"MSKClusterARN",
+			"TopicName"
+		]],
+		["MSKSourceConfiguration.AuthenticationConfiguration", ["Connectivity", "RoleARN"]],
+		["RedshiftDestinationConfiguration", [
+			"ClusterJDBCURL",
+			"CopyCommand",
+			"RoleARN",
+			"S3Configuration"
+		]],
+		["RedshiftDestinationConfiguration.CopyCommand", ["DataTableName"]],
+		["RedshiftDestinationConfiguration.ProcessingConfiguration.Processors", ["Type"]],
+		["RedshiftDestinationConfiguration.ProcessingConfiguration.Processors.Parameters", ["ParameterName", "ParameterValue"]],
+		["RedshiftDestinationConfiguration.S3BackupConfiguration", ["BucketARN", "RoleARN"]],
+		["RedshiftDestinationConfiguration.S3BackupConfiguration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["RedshiftDestinationConfiguration.S3Configuration", ["BucketARN", "RoleARN"]],
+		["RedshiftDestinationConfiguration.S3Configuration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["RedshiftDestinationConfiguration.SecretsManagerConfiguration", ["Enabled"]],
+		["S3DestinationConfiguration", ["BucketARN", "RoleARN"]],
+		["S3DestinationConfiguration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["SnowflakeDestinationConfiguration", [
+			"AccountUrl",
+			"Database",
+			"RoleARN",
+			"S3Configuration",
+			"Schema",
+			"Table"
+		]],
+		["SnowflakeDestinationConfiguration.ProcessingConfiguration.Processors", ["Type"]],
+		["SnowflakeDestinationConfiguration.ProcessingConfiguration.Processors.Parameters", ["ParameterName", "ParameterValue"]],
+		["SnowflakeDestinationConfiguration.S3Configuration", ["BucketARN", "RoleARN"]],
+		["SnowflakeDestinationConfiguration.S3Configuration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["SnowflakeDestinationConfiguration.SecretsManagerConfiguration", ["Enabled"]],
+		["SnowflakeDestinationConfiguration.SnowflakeVpcConfiguration", ["PrivateLinkVpceId"]],
+		["SplunkDestinationConfiguration", [
+			"HECEndpoint",
+			"HECEndpointType",
+			"S3Configuration"
+		]],
+		["SplunkDestinationConfiguration.ProcessingConfiguration.Processors", ["Type"]],
+		["SplunkDestinationConfiguration.ProcessingConfiguration.Processors.Parameters", ["ParameterName", "ParameterValue"]],
+		["SplunkDestinationConfiguration.S3Configuration", ["BucketARN", "RoleARN"]],
+		["SplunkDestinationConfiguration.S3Configuration.EncryptionConfiguration.KMSEncryptionConfig", ["AWSKMSKeyARN"]],
+		["SplunkDestinationConfiguration.SecretsManagerConfiguration", ["Enabled"]],
+		["Tags", ["Key"]]
+	])],
+	["AWS::KMS::Key", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::Lambda::EventInvokeConfig", /* @__PURE__ */ new Map([["DestinationConfig.OnFailure", ["Destination"]], ["DestinationConfig.OnSuccess", ["Destination"]]])],
+	["AWS::Lambda::EventSourceMapping", /* @__PURE__ */ new Map([["Tags", ["Key"]]])],
+	["AWS::Lambda::Function", /* @__PURE__ */ new Map([
+		["CapacityProviderConfig", ["LambdaManagedInstancesCapacityProviderConfig"]],
+		["CapacityProviderConfig.LambdaManagedInstancesCapacityProviderConfig", ["CapacityProviderArn"]],
+		["DurableConfig", ["ExecutionTimeout"]],
+		["EphemeralStorage", ["Size"]],
+		["FileSystemConfigs", ["Arn", "LocalMountPath"]],
+		["RuntimeManagementConfig", ["UpdateRuntimeOn"]],
+		["SnapStart", ["ApplyOn"]],
+		["Tags", ["Key"]],
+		["TenancyConfig", ["TenantIsolationMode"]]
+	])],
+	["AWS::Lambda::LayerVersion", /* @__PURE__ */ new Map([["Content", ["S3Bucket", "S3Key"]]])],
+	["AWS::Lambda::MicrovmImage", /* @__PURE__ */ new Map([
+		["CodeArtifact", ["Uri"]],
+		["CpuConfigurations", ["Architecture"]],
+		["EnvironmentVariables", ["Key", "Value"]],
+		["Resources", ["MinimumMemoryInMiB"]],
+		["Tags", ["Key"]]
+	])],
+	["AWS::Logs::LogGroup", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::Neptune::DBCluster", /* @__PURE__ */ new Map([
+		["AssociatedRoles", ["RoleArn"]],
+		["ServerlessScalingConfiguration", ["MaxCapacity", "MinCapacity"]],
+		["Tags", ["Key"]]
+	])],
+	["AWS::Neptune::DBInstance", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::Neptune::DBSubnetGroup", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::RDS::DBCluster", /* @__PURE__ */ new Map([["AssociatedRoles", ["RoleArn"]], ["Tags", ["Key"]]])],
+	["AWS::RDS::DBInstance", /* @__PURE__ */ new Map([["AssociatedRoles", ["FeatureName", "RoleArn"]], ["Tags", ["Key"]]])],
+	["AWS::RDS::DBSubnetGroup", /* @__PURE__ */ new Map([["Tags", ["Key"]]])],
+	["AWS::Route53::HostedZone", /* @__PURE__ */ new Map([
+		["HostedZoneTags", ["Key", "Value"]],
+		["QueryLoggingConfig", ["CloudWatchLogsLogGroupArn"]],
+		["VPCs", ["VPCId", "VPCRegion"]]
+	])],
+	["AWS::Route53::RecordSet", /* @__PURE__ */ new Map([["AliasTarget", ["DNSName", "HostedZoneId"]], ["CidrRoutingConfig", ["CollectionId", "LocationName"]]])],
+	["AWS::S3::Bucket", /* @__PURE__ */ new Map([
+		["AccelerateConfiguration", ["AccelerationStatus"]],
+		["AnalyticsConfigurations", ["Id", "StorageClassAnalysis"]],
+		["AnalyticsConfigurations.StorageClassAnalysis.DataExport", ["Destination", "OutputSchemaVersion"]],
+		["AnalyticsConfigurations.StorageClassAnalysis.DataExport.Destination", ["BucketArn", "Format"]],
+		["AnalyticsConfigurations.TagFilters", ["Key", "Value"]],
+		["BucketEncryption", ["ServerSideEncryptionConfiguration"]],
+		["BucketEncryption.ServerSideEncryptionConfiguration.ServerSideEncryptionByDefault", ["SSEAlgorithm"]],
+		["CorsConfiguration", ["CorsRules"]],
+		["CorsConfiguration.CorsRules", ["AllowedMethods", "AllowedOrigins"]],
+		["IntelligentTieringConfigurations", [
+			"Id",
+			"Status",
+			"Tierings"
+		]],
+		["IntelligentTieringConfigurations.TagFilters", ["Key", "Value"]],
+		["IntelligentTieringConfigurations.Tierings", ["AccessTier", "Days"]],
+		["InventoryConfigurations", [
+			"Destination",
+			"Enabled",
+			"Id",
+			"IncludedObjectVersions",
+			"ScheduleFrequency"
+		]],
+		["InventoryConfigurations.Destination", ["BucketArn", "Format"]],
+		["LifecycleConfiguration", ["Rules"]],
+		["LifecycleConfiguration.Rules", ["Status"]],
+		["LifecycleConfiguration.Rules.AbortIncompleteMultipartUpload", ["DaysAfterInitiation"]],
+		["LifecycleConfiguration.Rules.NoncurrentVersionExpiration", ["NoncurrentDays"]],
+		["LifecycleConfiguration.Rules.NoncurrentVersionTransition", ["StorageClass", "TransitionInDays"]],
+		["LifecycleConfiguration.Rules.NoncurrentVersionTransitions", ["StorageClass", "TransitionInDays"]],
+		["LifecycleConfiguration.Rules.TagFilters", ["Key", "Value"]],
+		["LifecycleConfiguration.Rules.Transition", ["StorageClass"]],
+		["LifecycleConfiguration.Rules.Transitions", ["StorageClass"]],
+		["MetadataConfiguration", ["JournalTableConfiguration"]],
+		["MetadataConfiguration.AnnotationTableConfiguration", ["ConfigurationState"]],
+		["MetadataConfiguration.AnnotationTableConfiguration.EncryptionConfiguration", ["SseAlgorithm"]],
+		["MetadataConfiguration.Destination", ["TableBucketType"]],
+		["MetadataConfiguration.InventoryTableConfiguration", ["ConfigurationState"]],
+		["MetadataConfiguration.InventoryTableConfiguration.EncryptionConfiguration", ["SseAlgorithm"]],
+		["MetadataConfiguration.JournalTableConfiguration", ["RecordExpiration"]],
+		["MetadataConfiguration.JournalTableConfiguration.EncryptionConfiguration", ["SseAlgorithm"]],
+		["MetadataConfiguration.JournalTableConfiguration.RecordExpiration", ["Expiration"]],
+		["MetadataTableConfiguration", ["S3TablesDestination"]],
+		["MetadataTableConfiguration.S3TablesDestination", ["TableBucketArn", "TableName"]],
+		["MetricsConfigurations", ["Id"]],
+		["MetricsConfigurations.TagFilters", ["Key", "Value"]],
+		["NotificationConfiguration.EventBridgeConfiguration", ["EventBridgeEnabled"]],
+		["NotificationConfiguration.LambdaConfigurations", ["Event", "Function"]],
+		["NotificationConfiguration.LambdaConfigurations.Filter", ["S3Key"]],
+		["NotificationConfiguration.LambdaConfigurations.Filter.S3Key", ["Rules"]],
+		["NotificationConfiguration.LambdaConfigurations.Filter.S3Key.Rules", ["Name", "Value"]],
+		["NotificationConfiguration.QueueConfigurations", ["Event", "Queue"]],
+		["NotificationConfiguration.QueueConfigurations.Filter", ["S3Key"]],
+		["NotificationConfiguration.QueueConfigurations.Filter.S3Key", ["Rules"]],
+		["NotificationConfiguration.QueueConfigurations.Filter.S3Key.Rules", ["Name", "Value"]],
+		["NotificationConfiguration.TopicConfigurations", ["Event", "Topic"]],
+		["NotificationConfiguration.TopicConfigurations.Filter", ["S3Key"]],
+		["NotificationConfiguration.TopicConfigurations.Filter.S3Key", ["Rules"]],
+		["NotificationConfiguration.TopicConfigurations.Filter.S3Key.Rules", ["Name", "Value"]],
+		["OwnershipControls", ["Rules"]],
+		["ReplicationConfiguration", ["Role", "Rules"]],
+		["ReplicationConfiguration.Rules", ["Destination", "Status"]],
+		["ReplicationConfiguration.Rules.Destination", ["Bucket"]],
+		["ReplicationConfiguration.Rules.Destination.AccessControlTranslation", ["Owner"]],
+		["ReplicationConfiguration.Rules.Destination.EncryptionConfiguration", ["ReplicaKmsKeyID"]],
+		["ReplicationConfiguration.Rules.Destination.Metrics", ["Status"]],
+		["ReplicationConfiguration.Rules.Destination.Metrics.EventThreshold", ["Minutes"]],
+		["ReplicationConfiguration.Rules.Destination.ReplicationTime", ["Status", "Time"]],
+		["ReplicationConfiguration.Rules.Destination.ReplicationTime.Time", ["Minutes"]],
+		["ReplicationConfiguration.Rules.Filter.And.TagFilters", ["Key", "Value"]],
+		["ReplicationConfiguration.Rules.Filter.TagFilter", ["Key", "Value"]],
+		["ReplicationConfiguration.Rules.SourceSelectionCriteria.ReplicaModifications", ["Status"]],
+		["ReplicationConfiguration.Rules.SourceSelectionCriteria.SseKmsEncryptedObjects", ["Status"]],
+		["Tags", ["Key", "Value"]],
+		["VersioningConfiguration", ["Status"]],
+		["WebsiteConfiguration.RedirectAllRequestsTo", ["HostName"]],
+		["WebsiteConfiguration.RoutingRules", ["RedirectRule"]]
+	])],
+	["AWS::S3Express::DirectoryBucket", /* @__PURE__ */ new Map([
+		["BucketEncryption", ["ServerSideEncryptionConfiguration"]],
+		["BucketEncryption.ServerSideEncryptionConfiguration.ServerSideEncryptionByDefault", ["SSEAlgorithm"]],
+		["InventoryConfigurations", [
+			"Destination",
+			"Enabled",
+			"Id",
+			"IncludedObjectVersions",
+			"ScheduleFrequency"
+		]],
+		["InventoryConfigurations.Destination", ["BucketArn", "Format"]],
+		["LifecycleConfiguration", ["Rules"]],
+		["LifecycleConfiguration.Rules", ["Status"]],
+		["LifecycleConfiguration.Rules.AbortIncompleteMultipartUpload", ["DaysAfterInitiation"]],
+		["MetricsConfigurations", ["Id"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::S3Tables::Table", /* @__PURE__ */ new Map([
+		["IcebergMetadata.IcebergPartitionSpec", ["Fields"]],
+		["IcebergMetadata.IcebergPartitionSpec.Fields", [
+			"Name",
+			"SourceId",
+			"Transform"
+		]],
+		["IcebergMetadata.IcebergSchema", ["SchemaFieldList"]],
+		["IcebergMetadata.IcebergSchema.SchemaFieldList", ["Name", "Type"]],
+		["IcebergMetadata.IcebergSchemaV2", ["SchemaV2FieldList", "SchemaV2FieldType"]],
+		["IcebergMetadata.IcebergSchemaV2.SchemaV2FieldList", [
+			"Id",
+			"Name",
+			"Required",
+			"Type"
+		]],
+		["IcebergMetadata.IcebergSortOrder", ["Fields"]],
+		["IcebergMetadata.IcebergSortOrder.Fields", [
+			"Direction",
+			"NullOrder",
+			"SourceId",
+			"Transform"
+		]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::S3Tables::TableBucket", /* @__PURE__ */ new Map([
+		["ReplicationConfiguration", ["Role", "Rules"]],
+		["ReplicationConfiguration.Rules", ["Destinations"]],
+		["ReplicationConfiguration.Rules.Destinations", ["DestinationTableBucketARN"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::S3Vectors::VectorBucket", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::Scheduler::Schedule", /* @__PURE__ */ new Map([
+		["FlexibleTimeWindow", ["Mode"]],
+		["Target", ["Arn", "RoleArn"]],
+		["Target.EcsParameters", ["TaskDefinitionArn"]],
+		["Target.EcsParameters.CapacityProviderStrategy", ["CapacityProvider"]],
+		["Target.EcsParameters.NetworkConfiguration.AwsvpcConfiguration", ["Subnets"]],
+		["Target.EventBridgeParameters", ["DetailType", "Source"]],
+		["Target.KinesisParameters", ["PartitionKey"]],
+		["Target.SageMakerPipelineParameters.PipelineParameterList", ["Name", "Value"]]
+	])],
+	["AWS::SecretsManager::Secret", /* @__PURE__ */ new Map([["ReplicaRegions", ["Region"]], ["Tags", ["Key", "Value"]]])],
+	["AWS::ServiceDiscovery::HttpNamespace", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::ServiceDiscovery::PrivateDnsNamespace", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::ServiceDiscovery::PublicDnsNamespace", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::ServiceDiscovery::Service", /* @__PURE__ */ new Map([
+		["DnsConfig", ["DnsRecords"]],
+		["DnsConfig.DnsRecords", ["TTL", "Type"]],
+		["HealthCheckConfig", ["Type"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::SNS::Topic", /* @__PURE__ */ new Map([
+		["DeliveryStatusLogging", ["Protocol"]],
+		["Subscription", ["Endpoint", "Protocol"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::SQS::Queue", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
+	["AWS::StepFunctions::StateMachine", /* @__PURE__ */ new Map([
+		["DefinitionS3Location", ["Bucket", "Key"]],
+		["EncryptionConfiguration", ["Type"]],
+		["Tags", ["Key", "Value"]]
+	])],
+	["AWS::WAFv2::WebACL", /* @__PURE__ */ new Map([
+		["ApplicationConfig", ["Attributes"]],
+		["ApplicationConfig.Attributes", ["Name", "Values"]],
+		["CaptchaConfig.ImmunityTimeProperty", ["ImmunityTime"]],
+		["ChallengeConfig.ImmunityTimeProperty", ["ImmunityTime"]],
+		["DataProtectionConfig", ["DataProtections"]],
+		["DataProtectionConfig.DataProtections", ["Action", "Field"]],
+		["DataProtectionConfig.DataProtections.Field", ["FieldType"]],
+		["DefaultAction.Allow.CustomRequestHandling", ["InsertHeaders"]],
+		["DefaultAction.Allow.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["DefaultAction.Block.CustomResponse", ["ResponseCode"]],
+		["DefaultAction.Block.CustomResponse.ResponseHeaders", ["Name", "Value"]],
+		["MonetizationConfig.CryptoConfig", ["PaymentNetworks"]],
+		["MonetizationConfig.CryptoConfig.PaymentNetworks", [
+			"Chain",
+			"Prices",
+			"WalletAddress"
+		]],
+		["MonetizationConfig.CryptoConfig.PaymentNetworks.Prices", ["Amount", "Currency"]],
+		["OnSourceDDoSProtectionConfig", ["ALBLowReputationMode"]],
+		["Rules", [
+			"Name",
+			"Priority",
+			"Statement",
+			"VisibilityConfig"
+		]],
+		["Rules.Action.Allow.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Action.Allow.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.Action.Block.CustomResponse", ["ResponseCode"]],
+		["Rules.Action.Block.CustomResponse.ResponseHeaders", ["Name", "Value"]],
+		["Rules.Action.Captcha.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Action.Captcha.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.Action.Challenge.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Action.Challenge.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.Action.Count.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Action.Count.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.CaptchaConfig.ImmunityTimeProperty", ["ImmunityTime"]],
+		["Rules.ChallengeConfig.ImmunityTimeProperty", ["ImmunityTime"]],
+		["Rules.RuleLabels", ["Name"]],
+		["Rules.Statement.AndStatement", ["Statements"]],
+		["Rules.Statement.AsnMatchStatement.ForwardedIPConfig", ["FallbackBehavior", "HeaderName"]],
+		["Rules.Statement.ByteMatchStatement", [
+			"FieldToMatch",
+			"PositionalConstraint",
+			"TextTransformations"
+		]],
+		["Rules.Statement.ByteMatchStatement.FieldToMatch.Cookies", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.ByteMatchStatement.FieldToMatch.HeaderOrder", ["OversizeHandling"]],
+		["Rules.Statement.ByteMatchStatement.FieldToMatch.Headers", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.ByteMatchStatement.FieldToMatch.JA3Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.ByteMatchStatement.FieldToMatch.JA4Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.ByteMatchStatement.FieldToMatch.JsonBody", ["MatchPattern", "MatchScope"]],
+		["Rules.Statement.ByteMatchStatement.FieldToMatch.SingleHeader", ["Name"]],
+		["Rules.Statement.ByteMatchStatement.FieldToMatch.SingleQueryArgument", ["Name"]],
+		["Rules.Statement.ByteMatchStatement.PreParseTextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.ByteMatchStatement.TextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.GeoMatchStatement.ForwardedIPConfig", ["FallbackBehavior", "HeaderName"]],
+		["Rules.Statement.IPSetReferenceStatement", ["Arn"]],
+		["Rules.Statement.IPSetReferenceStatement.IPSetForwardedIPConfig", [
+			"FallbackBehavior",
+			"HeaderName",
+			"Position"
+		]],
+		["Rules.Statement.LabelMatchStatement", ["Key", "Scope"]],
+		["Rules.Statement.ManagedRuleGroupStatement", ["Name", "VendorName"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ExcludedRules", ["Name"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesACFPRuleSet", [
+			"CreationPath",
+			"RegistrationPagePath",
+			"RequestInspection"
+		]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesACFPRuleSet.RequestInspection", ["PayloadType"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesACFPRuleSet.RequestInspection.AddressFields", ["Identifier"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesACFPRuleSet.RequestInspection.EmailField", ["Identifier"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesACFPRuleSet.RequestInspection.PasswordField", ["Identifier"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesACFPRuleSet.RequestInspection.PhoneNumberFields", ["Identifier"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesACFPRuleSet.RequestInspection.UsernameField", ["Identifier"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesACFPRuleSet.ResponseInspection.BodyContains", ["FailureStrings", "SuccessStrings"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesACFPRuleSet.ResponseInspection.Header", [
+			"FailureValues",
+			"Name",
+			"SuccessValues"
+		]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesACFPRuleSet.ResponseInspection.Json", [
+			"FailureValues",
+			"Identifier",
+			"SuccessValues"
+		]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesACFPRuleSet.ResponseInspection.StatusCode", ["FailureCodes", "SuccessCodes"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesATPRuleSet", ["LoginPath"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesATPRuleSet.RequestInspection", [
+			"PasswordField",
+			"PayloadType",
+			"UsernameField"
+		]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesATPRuleSet.RequestInspection.PasswordField", ["Identifier"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesATPRuleSet.RequestInspection.UsernameField", ["Identifier"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesATPRuleSet.ResponseInspection.BodyContains", ["FailureStrings", "SuccessStrings"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesATPRuleSet.ResponseInspection.Header", [
+			"FailureValues",
+			"Name",
+			"SuccessValues"
+		]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesATPRuleSet.ResponseInspection.Json", [
+			"FailureValues",
+			"Identifier",
+			"SuccessValues"
+		]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesATPRuleSet.ResponseInspection.StatusCode", ["FailureCodes", "SuccessCodes"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesAntiDDoSRuleSet", ["ClientSideActionConfig"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesAntiDDoSRuleSet.ClientSideActionConfig", ["Challenge"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesAntiDDoSRuleSet.ClientSideActionConfig.Challenge", ["UsageOfAction"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.AWSManagedRulesBotControlRuleSet", ["InspectionLevel"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.PasswordField", ["Identifier"]],
+		["Rules.Statement.ManagedRuleGroupStatement.ManagedRuleGroupConfigs.UsernameField", ["Identifier"]],
+		["Rules.Statement.ManagedRuleGroupStatement.RuleActionOverrides", ["ActionToUse", "Name"]],
+		["Rules.Statement.ManagedRuleGroupStatement.RuleActionOverrides.ActionToUse.Allow.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Statement.ManagedRuleGroupStatement.RuleActionOverrides.ActionToUse.Allow.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.Statement.ManagedRuleGroupStatement.RuleActionOverrides.ActionToUse.Block.CustomResponse", ["ResponseCode"]],
+		["Rules.Statement.ManagedRuleGroupStatement.RuleActionOverrides.ActionToUse.Block.CustomResponse.ResponseHeaders", ["Name", "Value"]],
+		["Rules.Statement.ManagedRuleGroupStatement.RuleActionOverrides.ActionToUse.Captcha.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Statement.ManagedRuleGroupStatement.RuleActionOverrides.ActionToUse.Captcha.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.Statement.ManagedRuleGroupStatement.RuleActionOverrides.ActionToUse.Challenge.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Statement.ManagedRuleGroupStatement.RuleActionOverrides.ActionToUse.Challenge.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.Statement.ManagedRuleGroupStatement.RuleActionOverrides.ActionToUse.Count.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Statement.ManagedRuleGroupStatement.RuleActionOverrides.ActionToUse.Count.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.Statement.NotStatement", ["Statement"]],
+		["Rules.Statement.OrStatement", ["Statements"]],
+		["Rules.Statement.RateBasedStatement", ["AggregateKeyType", "Limit"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.Cookie", ["Name", "TextTransformations"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.Cookie.TextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.Header", ["Name", "TextTransformations"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.Header.TextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.JA3Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.JA4Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.LabelNamespace", ["Namespace"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.QueryArgument", ["Name", "TextTransformations"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.QueryArgument.TextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.QueryString", ["TextTransformations"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.QueryString.TextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.UriPath", ["TextTransformations"]],
+		["Rules.Statement.RateBasedStatement.CustomKeys.UriPath.TextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.RateBasedStatement.ForwardedIPConfig", ["FallbackBehavior", "HeaderName"]],
+		["Rules.Statement.RegexMatchStatement", [
+			"FieldToMatch",
+			"RegexString",
+			"TextTransformations"
+		]],
+		["Rules.Statement.RegexMatchStatement.FieldToMatch.Cookies", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.RegexMatchStatement.FieldToMatch.HeaderOrder", ["OversizeHandling"]],
+		["Rules.Statement.RegexMatchStatement.FieldToMatch.Headers", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.RegexMatchStatement.FieldToMatch.JA3Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.RegexMatchStatement.FieldToMatch.JA4Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.RegexMatchStatement.FieldToMatch.JsonBody", ["MatchPattern", "MatchScope"]],
+		["Rules.Statement.RegexMatchStatement.FieldToMatch.SingleHeader", ["Name"]],
+		["Rules.Statement.RegexMatchStatement.FieldToMatch.SingleQueryArgument", ["Name"]],
+		["Rules.Statement.RegexMatchStatement.PreParseTextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.RegexMatchStatement.TextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.RegexPatternSetReferenceStatement", [
+			"Arn",
+			"FieldToMatch",
+			"TextTransformations"
+		]],
+		["Rules.Statement.RegexPatternSetReferenceStatement.FieldToMatch.Cookies", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.RegexPatternSetReferenceStatement.FieldToMatch.HeaderOrder", ["OversizeHandling"]],
+		["Rules.Statement.RegexPatternSetReferenceStatement.FieldToMatch.Headers", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.RegexPatternSetReferenceStatement.FieldToMatch.JA3Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.RegexPatternSetReferenceStatement.FieldToMatch.JA4Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.RegexPatternSetReferenceStatement.FieldToMatch.JsonBody", ["MatchPattern", "MatchScope"]],
+		["Rules.Statement.RegexPatternSetReferenceStatement.FieldToMatch.SingleHeader", ["Name"]],
+		["Rules.Statement.RegexPatternSetReferenceStatement.FieldToMatch.SingleQueryArgument", ["Name"]],
+		["Rules.Statement.RegexPatternSetReferenceStatement.PreParseTextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.RegexPatternSetReferenceStatement.TextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.RuleGroupReferenceStatement", ["Arn"]],
+		["Rules.Statement.RuleGroupReferenceStatement.ExcludedRules", ["Name"]],
+		["Rules.Statement.RuleGroupReferenceStatement.RuleActionOverrides", ["ActionToUse", "Name"]],
+		["Rules.Statement.RuleGroupReferenceStatement.RuleActionOverrides.ActionToUse.Allow.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Statement.RuleGroupReferenceStatement.RuleActionOverrides.ActionToUse.Allow.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.Statement.RuleGroupReferenceStatement.RuleActionOverrides.ActionToUse.Block.CustomResponse", ["ResponseCode"]],
+		["Rules.Statement.RuleGroupReferenceStatement.RuleActionOverrides.ActionToUse.Block.CustomResponse.ResponseHeaders", ["Name", "Value"]],
+		["Rules.Statement.RuleGroupReferenceStatement.RuleActionOverrides.ActionToUse.Captcha.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Statement.RuleGroupReferenceStatement.RuleActionOverrides.ActionToUse.Captcha.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.Statement.RuleGroupReferenceStatement.RuleActionOverrides.ActionToUse.Challenge.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Statement.RuleGroupReferenceStatement.RuleActionOverrides.ActionToUse.Challenge.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.Statement.RuleGroupReferenceStatement.RuleActionOverrides.ActionToUse.Count.CustomRequestHandling", ["InsertHeaders"]],
+		["Rules.Statement.RuleGroupReferenceStatement.RuleActionOverrides.ActionToUse.Count.CustomRequestHandling.InsertHeaders", ["Name", "Value"]],
+		["Rules.Statement.SizeConstraintStatement", [
+			"ComparisonOperator",
+			"FieldToMatch",
+			"Size",
+			"TextTransformations"
+		]],
+		["Rules.Statement.SizeConstraintStatement.FieldToMatch.Cookies", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.SizeConstraintStatement.FieldToMatch.HeaderOrder", ["OversizeHandling"]],
+		["Rules.Statement.SizeConstraintStatement.FieldToMatch.Headers", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.SizeConstraintStatement.FieldToMatch.JA3Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.SizeConstraintStatement.FieldToMatch.JA4Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.SizeConstraintStatement.FieldToMatch.JsonBody", ["MatchPattern", "MatchScope"]],
+		["Rules.Statement.SizeConstraintStatement.FieldToMatch.SingleHeader", ["Name"]],
+		["Rules.Statement.SizeConstraintStatement.FieldToMatch.SingleQueryArgument", ["Name"]],
+		["Rules.Statement.SizeConstraintStatement.PreParseTextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.SizeConstraintStatement.TextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.SqliMatchStatement", ["FieldToMatch", "TextTransformations"]],
+		["Rules.Statement.SqliMatchStatement.FieldToMatch.Cookies", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.SqliMatchStatement.FieldToMatch.HeaderOrder", ["OversizeHandling"]],
+		["Rules.Statement.SqliMatchStatement.FieldToMatch.Headers", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.SqliMatchStatement.FieldToMatch.JA3Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.SqliMatchStatement.FieldToMatch.JA4Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.SqliMatchStatement.FieldToMatch.JsonBody", ["MatchPattern", "MatchScope"]],
+		["Rules.Statement.SqliMatchStatement.FieldToMatch.SingleHeader", ["Name"]],
+		["Rules.Statement.SqliMatchStatement.FieldToMatch.SingleQueryArgument", ["Name"]],
+		["Rules.Statement.SqliMatchStatement.PreParseTextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.SqliMatchStatement.TextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.XssMatchStatement", ["FieldToMatch", "TextTransformations"]],
+		["Rules.Statement.XssMatchStatement.FieldToMatch.Cookies", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.XssMatchStatement.FieldToMatch.HeaderOrder", ["OversizeHandling"]],
+		["Rules.Statement.XssMatchStatement.FieldToMatch.Headers", [
+			"MatchPattern",
+			"MatchScope",
+			"OversizeHandling"
+		]],
+		["Rules.Statement.XssMatchStatement.FieldToMatch.JA3Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.XssMatchStatement.FieldToMatch.JA4Fingerprint", ["FallbackBehavior"]],
+		["Rules.Statement.XssMatchStatement.FieldToMatch.JsonBody", ["MatchPattern", "MatchScope"]],
+		["Rules.Statement.XssMatchStatement.FieldToMatch.SingleHeader", ["Name"]],
+		["Rules.Statement.XssMatchStatement.FieldToMatch.SingleQueryArgument", ["Name"]],
+		["Rules.Statement.XssMatchStatement.PreParseTextTransformations", ["Priority", "Type"]],
+		["Rules.Statement.XssMatchStatement.TextTransformations", ["Priority", "Type"]],
+		["Rules.VisibilityConfig", [
+			"CloudWatchMetricsEnabled",
+			"MetricName",
+			"SampledRequestsEnabled"
+		]],
+		["VisibilityConfig", [
+			"CloudWatchMetricsEnabled",
+			"MetricName",
+			"SampledRequestsEnabled"
+		]]
+	])]
+]);
+
+//#endregion
+//#region src/provisioning/nested-required.ts
+/**
+* Pre-flight rule: a PRESENT nested property block must carry every member its
+* schema definition lists as `required` (issue
+* [#1802](https://github.com/go-to-k/cdkd/issues/1802)).
+*
+* CloudFormation refuses such a block before it touches AWS. cdkd forwarded
+* it, and where the service API replaces the nested struct wholesale the
+* result was a silent change to a live setting: a kept
+* `AWS::ECS::Service.DeploymentConfiguration.DeploymentCircuitBreaker` without
+* `Rollback` flipped the live `rollback` from true to false. Cloud Control
+* validates against the same schema server-side, so the gap is SDK-provider
+* scoped; running the check for every resource is correct-but-redundant on the
+* Cloud Control route. Same layer and same reasons as
+* {@link ./mutually-exclusive-properties}: pre-flight runs on every deploy, not
+* only when the provider is called.
+*
+* ## Refuse only what CloudFormation refuses
+*
+* - An ABSENT block is never a violation — only a present one missing a member.
+* - Pre-flight runs BEFORE intrinsic resolution, so any value along the path
+*   that is an unresolved intrinsic (`Fn::If`, `Ref`, ...) is UNKNOWN and its
+*   subtree is skipped. A member is present when its KEY is, whatever the value
+*   (`false`, `0`, `null`, or an intrinsic that may resolve to
+*   `AWS::NoValue`). Every doubt passes through: a false refusal blocks a valid
+*   deploy with no escape hatch, a missed one reaches AWS as it did before.
+* - {@link CFN_ENFORCED_TYPES} gates the whole check. A schema's `required`
+*   list is NOT evidence that CloudFormation enforces it: measured, CFn accepted
+*   an `AWS::Logs::LogGroup` tag with neither `Key` nor `Value`, and sent an
+*   `AWS::EC2::SecurityGroup` ingress rule without `IpProtocol` to the EC2 API.
+*
+* ## No override flag, by design
+*
+* The violation is in the TEMPLATE, CloudFormation rejects it too, and the
+* remedy (declare the missing member) is always available.
+*/
+/**
+* Types whose nested `required` lists CloudFormation was MEASURED to enforce.
+* One template per type declared
+* every nested block of `NESTED_REQUIRED` empty; a type is listed only when
+* CloudFormation refused EVERY missing member the table predicts:
+*
+* - 64 types by early validation of a CREATE change set (nothing provisioned):
+*   `PROPERTY_VALIDATION` / "Required property [X] not found".
+* - 7 types early validation passed, refused at execution before any API call:
+*   `Model validation failed` / `Properties validation failed` /
+*   `Property validation failure` (ECS Service + TaskDefinition, EFS
+*   AccessPoint, Lambda EventSourceMapping, Step Functions StateMachine,
+*   API Gateway Method, AppSync GraphQLApi).
+* - 7 types with no registry handler, refused at execution by CloudFormation's
+*   own `Property validation failure` list (Budgets Budget, CloudWatch
+*   AnomalyDetector, CodeBuild Project, DocDB DBCluster + DBInstance, FSx
+*   FileSystem, Glue Table).
+*
+* Measured NOT enforced by a schema check (a handler or service error instead,
+* or an accepted create): ApiGatewayV2 Route, CloudFormation Stack, EC2
+* SecurityGroup, ECR Repository, EFS FileSystem, ELBv2 Listener, KMS Key,
+* KinesisFirehose DeliveryStream, Logs LogGroup, Route53 HostedZone, WAFv2
+* WebACL. Left out because CloudFormation reports only the FIRST missing member
+* (`Property X cannot be empty.`), so the rest of the table was not confirmed:
+* EMR Cluster, InstanceFleetConfig, InstanceGroupConfig. A type in none of
+* these lists (added later) is not checked until it is measured.
+*/
+const CFN_ENFORCED_TYPES = /* @__PURE__ */ new Set([
+	"AWS::ApiGateway::Deployment",
+	"AWS::ApiGateway::Method",
+	"AWS::ApiGateway::Stage",
+	"AWS::AppSync::DataSource",
+	"AWS::AppSync::GraphQLApi",
+	"AWS::AppSync::Resolver",
+	"AWS::AutoScaling::AutoScalingGroup",
+	"AWS::BedrockAgentCore::Evaluator",
+	"AWS::BedrockAgentCore::Runtime",
+	"AWS::Budgets::Budget",
+	"AWS::CertificateManager::Certificate",
+	"AWS::CloudFront::CloudFrontOriginAccessIdentity",
+	"AWS::CloudFront::Distribution",
+	"AWS::CloudFront::OriginAccessControl",
+	"AWS::CloudTrail::Trail",
+	"AWS::CloudWatch::Alarm",
+	"AWS::CloudWatch::AnomalyDetector",
+	"AWS::CodeBuild::Project",
+	"AWS::CodeCommit::Repository",
+	"AWS::Cognito::UserPool",
+	"AWS::DLM::LifecyclePolicy",
+	"AWS::DocDB::DBCluster",
+	"AWS::DocDB::DBInstance",
+	"AWS::DocDB::DBSubnetGroup",
+	"AWS::DynamoDB::GlobalTable",
+	"AWS::DynamoDB::Table",
+	"AWS::EC2::EIP",
+	"AWS::EC2::Instance",
+	"AWS::EC2::InternetGateway",
+	"AWS::EC2::NatGateway",
+	"AWS::EC2::NetworkAcl",
+	"AWS::EC2::RouteTable",
+	"AWS::EC2::Subnet",
+	"AWS::EC2::VPC",
+	"AWS::ECS::Service",
+	"AWS::ECS::TaskDefinition",
+	"AWS::EFS::AccessPoint",
+	"AWS::ElastiCache::CacheCluster",
+	"AWS::ElastiCache::SubnetGroup",
+	"AWS::ElasticLoadBalancingV2::LoadBalancer",
+	"AWS::ElasticLoadBalancingV2::TargetGroup",
+	"AWS::Events::EventBus",
+	"AWS::Events::Rule",
+	"AWS::FSx::FileSystem",
+	"AWS::Glue::Connection",
+	"AWS::Glue::Table",
+	"AWS::Glue::Trigger",
+	"AWS::IAM::Group",
+	"AWS::IAM::Role",
+	"AWS::IAM::User",
+	"AWS::Kinesis::Stream",
+	"AWS::Kinesis::StreamConsumer",
+	"AWS::Lambda::EventInvokeConfig",
+	"AWS::Lambda::EventSourceMapping",
+	"AWS::Lambda::Function",
+	"AWS::Lambda::LayerVersion",
+	"AWS::Lambda::MicrovmImage",
+	"AWS::Neptune::DBCluster",
+	"AWS::Neptune::DBInstance",
+	"AWS::Neptune::DBSubnetGroup",
+	"AWS::RDS::DBCluster",
+	"AWS::RDS::DBInstance",
+	"AWS::RDS::DBSubnetGroup",
+	"AWS::Route53::RecordSet",
+	"AWS::S3::Bucket",
+	"AWS::S3Express::DirectoryBucket",
+	"AWS::S3Tables::Table",
+	"AWS::S3Tables::TableBucket",
+	"AWS::S3Vectors::VectorBucket",
+	"AWS::SNS::Topic",
+	"AWS::SQS::Queue",
+	"AWS::Scheduler::Schedule",
+	"AWS::SecretsManager::Secret",
+	"AWS::ServiceDiscovery::HttpNamespace",
+	"AWS::ServiceDiscovery::PrivateDnsNamespace",
+	"AWS::ServiceDiscovery::PublicDnsNamespace",
+	"AWS::ServiceDiscovery::Service",
+	"AWS::StepFunctions::StateMachine"
+]);
+/**
+* True for a single-key object whose key is `Ref` or `Fn::*`. The same
+* predicate as `mutually-exclusive-properties.ts` keeps local, for the same
+* reason: the modules answer different questions about the shape.
+*/
+function isUnresolvedIntrinsic(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const keys = Object.keys(value);
+	return keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"));
+}
+/** A plain object whose members can be checked: not an array, not an intrinsic. */
+function isConcreteObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && !isUnresolvedIntrinsic(value);
+}
+/**
+* Find every present nested block of this resource that lacks a required
+* member. `table` defaults to the generated one gated by
+* {@link CFN_ENFORCED_TYPES}; tests pass their own to reach every shape.
+*/
+function findNestedRequiredViolations(resourceType, templateProperties, table = CFN_ENFORCED_TYPES.has(resourceType) ? NESTED_REQUIRED.get(resourceType) : void 0) {
+	if (!table || !isConcreteObject(templateProperties)) return [];
+	const violations = [];
+	for (const [path, required] of table) {
+		const segments = path.split(".");
+		const check = (value, display) => {
+			if (Array.isArray(value)) {
+				value.forEach((element, i) => check(element, `${display}[${i}]`));
+				return;
+			}
+			if (!isConcreteObject(value)) return;
+			const missing = required.filter((member) => !hasOwnKey(value, member));
+			if (missing.length > 0) violations.push({
+				resourceType,
+				path: display,
+				missing
+			});
+		};
+		const visit = (value, depth, display) => {
+			if (depth === segments.length) {
+				check(value, display);
+				return;
+			}
+			if (Array.isArray(value)) {
+				value.forEach((element, i) => visit(element, depth, `${display}[${i}]`));
+				return;
+			}
+			if (!isConcreteObject(value)) return;
+			const segment = segments[depth];
+			if (!hasOwnKey(value, segment)) return;
+			visit(value[segment], depth + 1, display ? `${display}.${segment}` : segment);
+		};
+		visit(templateProperties, 0, "");
+	}
+	return violations;
+}
+/** Render one violation as a per-resource error line. */
+function buildNestedRequiredMessage(logicalId, violation) {
+	return `  - ${logicalId} (${violation.resourceType}): ${violation.path} is missing required ${violation.missing.length === 1 ? "member" : "members"} ${violation.missing.join(", ")}`;
+}
+
 //#endregion
 //#region src/provisioning/provider-registry.ts
 /**
@@ -39003,7 +40935,10 @@ var ProviderRegistry = class {
 	* ALSO runs the mutually-exclusive-property check
 	* ({@link validateMutuallyExclusiveProperties}), which throws BEFORE any
 	* routing decision is logged — a template CloudFormation itself rejects
-	* should not first produce a page of routing chatter.
+	* should not first produce a page of routing chatter. Issue
+	* [#1802](https://github.com/go-to-k/cdkd/issues/1802) adds the nested
+	* `required` check ({@link validateNestedRequiredProperties}) at the same
+	* point, for the same reason.
 	*
 	* @see findAutoRouteHits for the pure-functional pre-deploy plan-builder
 	*      that returns the same information without logging.
@@ -39011,6 +40946,7 @@ var ProviderRegistry = class {
 	validateResourceProperties(resources) {
 		const materialized = [...resources];
 		this.validateMutuallyExclusiveProperties(materialized);
+		this.validateNestedRequiredProperties(materialized);
 		this.reportSilentDropDecisions(materialized);
 	}
 	/**
@@ -39036,6 +40972,23 @@ var ProviderRegistry = class {
 		throw new Error(`The following resources declare mutually exclusive properties:\n` + lines.join("\n") + "\n\nCloudFormation rejects these combinations too — edit the template to declare only one of each set.");
 	}
 	/**
+	* Reject a template whose PRESENT nested property block lacks a member the
+	* type's schema requires there, for the types CloudFormation was measured to
+	* enforce that on (issue [#1802](https://github.com/go-to-k/cdkd/issues/1802);
+	* the rule, its fail-safe bias and the measurement live in
+	* `nested-required.ts`).
+	*
+	* Aggregated into ONE error, like {@link validateMutuallyExclusiveProperties},
+	* and with no `--allow-*` escape hatch for the same reason: CloudFormation
+	* rejects the template too, and declaring the member is always possible.
+	*/
+	validateNestedRequiredProperties(resources) {
+		const lines = [];
+		for (const { logicalId, resourceType, properties } of resources) for (const violation of findNestedRequiredViolations(resourceType, properties)) lines.push(buildNestedRequiredMessage(logicalId, violation));
+		if (lines.length === 0) return;
+		throw new Error(`The following resources declare a nested property block without a member it requires:\n` + lines.join("\n") + "\n\nCloudFormation rejects these blocks too. Declare the missing members; leaving a whole block out is not a violation.");
+	}
+	/**
 	* Info-log every silent-drop routing decision (auto-route via CC API) and
 	* warn-log every silent drop the user explicitly opted into via
 	* `--allow-unsupported-properties` (forced SDK path, the property will
@@ -48884,5 +50837,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, derivePartitionAndUrlSuffix as $i, safeStackName as $n, assertAssetBucketRegion as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, PartialFailureError as Aa, resolveAutoAssetStorage as Ai, malformedOutputsRefusalMessage as An, formatLockExpiry as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, normalizeAwsError as Ba, CFN_TEMPLATE_URL_LIMIT as Bi, refuseMalformedOrphansForDestroy as Bn, isReadableBag as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, DynamicReferenceRegionAmbiguousError as Ca, AssetManifestLoader as Ci, isReadableResourceEntry as Cn, LockManager as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, LockError as Da, getDefaultStateBucketName as Di, malformedOrphanRecordsWarning as Dn, buildForceUnlockCommand as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, LocalStartServiceError as Ea, synthesisStatusMessage as Ei, malformedLocalOutputsWarning as En, UNREPRODUCIBLE_LOCK_CLAUSE as Er, deleteSkipReason as Et, extractDeploymentEventError as F, StackTerminationProtectionError as Fa, resolveUseCdkBootstrapAssets as Fi, malformedResourcesWarning as Fn, hasReadableExportSet as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, isTransientServerError as Ga, injectiveKey as Gi, refuseMalformedResourcesForDestroy as Gn, stringifyValue as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, isMarkedNonRetryable as Ha, findLargeInlineResources as Hi, refuseMalformedOutputsForDestroy as Hn, orphansCarriedFrom as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, StateError as Ia, stateBucketExistenceConfirmed as Ii, malformedStateRefusalMessage as In, hasReasonlessBaselineRefusal as Ir, isNamelessDynamicReferenceError as It, bold as J, retryClassificationText as Ja, producerRecordKey as Ji, repairMalformedOutputsForReadOnly as Jn, createAssetRedirectResolver as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, markNonRetryable as Ka, injectiveKeyPrefix as Ki, refuseMalformedState as Kn, WorkGraph as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, SynthesisError as La, warnDeprecatedNoPrefixCliFlag as Li, refuseDivergentRecordRegionForDestroy as Ln, hasUnverifiableParameterRefusal as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, ResourceTimeoutError as Ma, resolveSkipPrefix as Mi, malformedRenderedContainersWarning as Mn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, ResourceUpdateNotSupportedError as Na, resolveStateBucketWithDefault as Ni, malformedResourceEntriesWarning as Nn, DEFAULT_STATE_PREFIX as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, MalformedProducerRecordRefusalError as Oa, getLegacyStateBucketName as Oi, malformedOrphansRefusalMessage as On, buildLockContentionMessage as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, StackHasActiveImportsError as Pa, resolveStateBucketWithDefaultAndSource as Pi, malformedResourcePropertiesWarning as Pn, exportNamesCarriedFrom as Pr, getAccountInfo as Pt, red as Q, canonicalizeRegion as Qi, safeRegion as Qn, BOOTSTRAP_MARKER_PREFIX as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, formatError as Ra, ssmResolvedValueType as Ri, refuseMalformedNestedChildOutputs as Rn, importableOutputKeys as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, DeployCancelledError as Sa, stripControlChars as Si, hasReadableResources as Sn, scrubResourceRecord as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, LocalInvokeBuildError as Ta, Synthesizer as Ti, malformedExportSourceWarning as Tn, rebuildClientForBucketRegion as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, isRetryableTransientError as Ua, uploadCfnTemplate as Ui, refuseMalformedResourceEntries as Un, shouldRetainResource as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, withErrorHandling as Va, MIGRATE_TMP_PREFIX as Vi, refuseMalformedOutputs as Vn, orphansAfterRollback as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, isThrottlingError as Wa, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Wi, refuseMalformedResourcePropertiesForOrphan as Wn, AssetPublisher as Wr, assertRegionMatch as Wt, gray as X, safeStringify$1 as Xa, expectedOwnerParam as Xi, repairMalformedResourcePropertiesForReadOnly as Xn, rewriteTemplateAssetReferences as Xr, readConfigString as Xt, cyan as Y, describeAwsFailure as Ya, decodeListingKey as Yi, repairMalformedResourceEntriesForReadOnly as Yn, loadPublishableAssetManifest as Yr, configStringRefusal as Yt, green as Z, __exportAll as Za, PARTITION_TABLE as Zi, repairMalformedResourcesForReadOnly as Zn, AssetModeResolver as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, AssetError as _a, partitionSensitiveEnv as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, maskSecretsInError as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, hasPlainPrototype$1 as aa, validateAssetBucketName as ai, s3BucketDomainName as an, TemplateParser as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, CrossAccountSecretRefusalError as ba, runDockerStreaming as bi, hasReadableOrphans as bn, recoverMaskedOutput as br, startInterruptWatch as bt, replayFailedOperations as c, absoluteAssemblyPathEscape as ca, buildDockerImage as ci, s3BucketWebsiteUrl as cn, STATE_SOURCED_READBACK_RULES as cr, IAMRoleProvider as ct, updatePartialMessage as d, clearBucketRegionCache as da, describeDockerCapturedOutput as di, applyCallerIdentityCredentials as dn, createSecretMasker as dr, ProviderRegistry as dt, AssemblyReader as ea, ensureAssetStorage as ei, requireConfigString as en, findActionableSilentDrops as er, collectDeclaredOutputNames as et, updatePartialReason as f, resolveBucketRegion as fa, describeDockerExecFailure as fi, callerEnvCredentials as fn, dynamicReferenceTokens as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, setAwsClients as ga, getDockerCmd as gi, STATE_RESOURCES_MALFORMED as gn, markSameGenerationBag as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, resetAwsClients as ha, formatDockerLoginError as hi, INTRINSIC_KEYS as hn, isSingleDynamicReferenceToken as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, hasOwnKey as ia, readBootstrapMarkerBody as ii, s3BucketArn as in, DagBuilder as ir, secretBearing as it, isFinalSnapshotError as j, ProvisioningError as ja, resolveCaptureObservedState as ji, malformedOutputsWarning as jn, shellQuote as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, NestedStackChildDirectDestroyError as ka, resolveApp as ki, malformedOrphansWarning as kn, forceQuitRecoveryClause as kr, IntrinsicFunctionResolver as kt, replayRollback as l, renderAssemblyPathEscape as la, resolveDockerContextDirectory as li, applyRoleArnIfSet as ln, TEMPLATE_SOURCED_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, getAwsClients as ma, dockerSpawnEnvWithSensitive as mi, DiffCalculator as mn, identityKeyFor as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, processStackMessages as na, isCrossRegionRedirect as ni, producerRegionsFromState as nn, describeTypeWithThrottleRetry as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, nullPrototypeRecord as oa, validateContainerRepoName as oi, s3BucketDualStackDomainName as on, STATE_SOURCED_BASELINE_RULES as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, AwsClients as pa, describeDockerFailure as pi, envCredentialsAreAssumedRole as pn, errorCauseChain as pr, createMaskedRetryLogger as pt, formatResourceLine as q, markRedactedCause as qa, producerCoordinateKey as qi, repairMalformedOrphansForReadOnly as qn, buildAssetRedirectMap as qr, configBooleanRefusal as qt, DeployEngine as r, defineOwnKey as ra, parseBootstrapMarker as ri, withSharedDrainBudget as rn, withRetry as rr, isExportAliasCollision as rt, planRollback as s, ownValue as sa, buildDenyExternalAccessPolicy as si, s3BucketRegionalDomainName as sn, STATE_SOURCED_CROSS_GENERATION_RULES as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, failedStageNote as ta, getBootstrapMarkerKey as ti, classifyReplaySecretRegion as tn, findSilentDropProperties as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, resolveAssemblyPath as ua, warnManifestExecutable as ui, AWS_CREDENTIAL_ENV_KEYS as un, carriesSecretMask as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, CdkdError as va, redactDockerArgvValues as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, maskSecretsInText as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, IntrinsicResolutionRefusalError as wa, getDockerImageBySourceHash as wi, malformedExportNamesWarning as wn, S3StateBackend as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, DependencyError as xa, escapeRegExp$1 as xi, hasReadableOutputs as xn, redactSecretsForState as xr, CloudControlProvider as xt, keptWholeReasonText as y, ConfigError as ya, runDockerForeground as yi, displayLogicalId as yn, recordMaskOnlyValue as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, isCdkdError as za, CFN_TEMPLATE_BODY_LIMIT as zi, refuseMalformedOrphans as zn, importableOutputs as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-5fdODHji.js.map
+export { yellow as $, retryClassificationText as $a, expectedOwnerParam as $i, repairMalformedResourcePropertiesForReadOnly as $n, rewriteTemplateAssetReferences as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, LocalInvokeBuildError as Aa, getDefaultStateBucketName as Ai, malformedOutputsRefusalMessage as An, buildForceUnlockCommand as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, StackTerminationProtectionError as Ba, warnDeprecatedNoPrefixCliFlag as Bi, refuseMalformedOrphansForDestroy as Bn, hasUnverifiableParameterRefusal as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, CdkdError as Ca, runDockerStreaming as Ci, isReadableResourceEntry as Cn, recoverMaskedOutput as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, DeployCancelledError as Da, getDockerImageBySourceHash as Di, malformedOrphanRecordsWarning as Dn, S3StateBackend as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, DependencyError as Ea, AssetManifestLoader as Ei, malformedLocalOutputsWarning as En, LockManager as Er, deleteSkipReason as Et, extractDeploymentEventError as F, PartialFailureError as Fa, resolveSkipPrefix as Fi, malformedResourcesWarning as Fn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, normalizeAwsError as Ga, findLargeInlineResources as Gi, refuseMalformedResourceEntries as Gn, orphansCarriedFrom as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, SynthesisError as Ha, CFN_TEMPLATE_BODY_LIMIT as Hi, refuseMalformedOutputs as Hn, importableOutputs as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, ProvisioningError as Ia, resolveStateBucketWithDefault as Ii, malformedStateRefusalMessage as In, DEFAULT_STATE_PREFIX as Ir, isNamelessDynamicReferenceError as It, bold as J, isRetryableTransientError as Ja, injectiveKey as Ji, refuseMalformedResourcesForDestroy as Jn, stringifyValue as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, withErrorHandling as Ka, uploadCfnTemplate as Ki, refuseMalformedResourceEntriesForOrphan as Kn, shouldRetainResource as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, ResourceTimeoutError as La, resolveStateBucketWithDefaultAndSource as Li, refuseDivergentRecordRegionForDestroy as Ln, exportNamesCarriedFrom as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, LockError as Ma, resolveApp as Mi, malformedRenderedContainersWarning as Mn, forceQuitRecoveryClause as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, MalformedProducerRecordRefusalError as Na, resolveAutoAssetStorage as Ni, malformedResourceEntriesWarning as Nn, formatLockExpiry as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, DynamicReferenceRegionAmbiguousError as Oa, Synthesizer as Oi, malformedOrphansRefusalMessage as On, rebuildClientForBucketRegion as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, NestedStackChildDirectDestroyError as Pa, resolveCaptureObservedState as Pi, malformedResourcePropertiesWarning as Pn, shellQuote as Pr, getAccountInfo as Pt, red as Q, markRedactedCause as Qa, decodeListingKey as Qi, repairMalformedResourceEntriesForReadOnly as Qn, loadPublishableAssetManifest as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, ResourceUpdateNotSupportedError as Ra, resolveUseCdkBootstrapAssets as Ri, refuseMalformedNestedChildOutputs as Rn, hasReadableExportSet as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, AssetError as Sa, runDockerForeground as Si, hasReadableResources as Sn, recordMaskOnlyValue as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, CrossAccountSecretRefusalError as Ta, stripControlChars as Ti, malformedExportSourceWarning as Tn, scrubResourceRecord as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, formatError as Ua, CFN_TEMPLATE_URL_LIMIT as Ui, refuseMalformedOutputsForDestroy as Un, isReadableBag as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, StateError as Va, ssmResolvedValueType as Vi, refuseMalformedOrphansForOrphan as Vn, importableOutputKeys as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, isCdkdError as Wa, MIGRATE_TMP_PREFIX as Wi, refuseMalformedResourceAttributesForOrphan as Wn, orphansAfterRollback as Wr, assertRegionMatch as Wt, gray as X, isTransientServerError as Xa, producerCoordinateKey as Xi, repairMalformedOrphansForReadOnly as Xn, buildAssetRedirectMap as Xr, readConfigString as Xt, cyan as Y, isThrottlingError as Ya, injectiveKeyPrefix as Yi, refuseMalformedState as Yn, WorkGraph as Yr, configStringRefusal as Yt, green as Z, markNonRetryable as Za, producerRecordKey as Zi, repairMalformedOutputsForReadOnly as Zn, createAssetRedirectResolver as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, AwsClients as _a, dockerSpawnEnvWithSensitive as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, identityKeyFor as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, globMatches as aa, isCrossRegionRedirect as ai, s3BucketDomainName as an, describeTypeWithThrottleRetry as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, runWithStackAwsClients as ba, partitionSensitiveEnv as bi, hasReadableOrphans as bn, maskSecretsInError as br, startInterruptWatch as bt, replayFailedOperations as c, hasOwnKey as ca, validateAssetBucketName as ci, s3BucketWebsiteUrl as cn, TemplateParser as cr, IAMRoleProvider as ct, updatePartialMessage as d, ownValue as da, buildDockerImage as di, applyCallerIdentityCredentials as dn, STATE_SOURCED_READBACK_RULES as dr, ProviderRegistry as dt, PARTITION_TABLE as ea, AssetModeResolver as ei, requireConfigString as en, describeAwsFailure as eo, repairMalformedResourcesForReadOnly as er, collectDeclaredOutputNames as et, updatePartialReason as f, absoluteAssemblyPathEscape as fa, resolveDockerContextDirectory as fi, callerEnvCredentials as fn, TEMPLATE_SOURCED_RULES as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, resolveBucketRegion as ga, describeDockerFailure as gi, STATE_RESOURCES_MALFORMED as gn, errorCauseChain as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, clearBucketRegionCache as ha, describeDockerExecFailure as hi, INTRINSIC_KEYS as hn, dynamicReferenceTokens as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, failedStageNote as ia, getBootstrapMarkerKey as ii, s3BucketArn as in, findSilentDropProperties as ir, secretBearing as it, isFinalSnapshotError as j, LocalStartServiceError as ja, getLegacyStateBucketName as ji, malformedOutputsWarning as jn, buildLockContentionMessage as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, IntrinsicResolutionRefusalError as ka, synthesisStatusMessage as ki, malformedOrphansWarning as kn, UNREPRODUCIBLE_LOCK_CLAUSE as kr, IntrinsicFunctionResolver as kt, replayRollback as l, hasPlainPrototype$1 as la, validateContainerRepoName as li, applyRoleArnIfSet as ln, STATE_SOURCED_BASELINE_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, resolveAssemblyPath as ma, describeDockerCapturedOutput as mi, DiffCalculator as mn, createSecretMasker as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, derivePartitionAndUrlSuffix as na, assertAssetBucketRegion as ni, producerRegionsFromState as nn, __exportAll as no, safeStackName as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, processStackMessages as oa, parseBootstrapMarker as oi, s3BucketDualStackDomainName as on, withRetry as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, renderAssemblyPathEscape as pa, warnManifestExecutable as pi, envCredentialsAreAssumedRole as pn, carriesSecretMask as pr, createMaskedRetryLogger as pt, formatResourceLine as q, isMarkedNonRetryable as qa, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as qi, refuseMalformedResourcePropertiesForOrphan as qn, AssetPublisher as qr, configBooleanRefusal as qt, DeployEngine as r, AssemblyReader as ra, ensureAssetStorage as ri, withSharedDrainBudget as rn, findActionableSilentDrops as rr, isExportAliasCollision as rt, planRollback as s, defineOwnKey as sa, readBootstrapMarkerBody as si, s3BucketRegionalDomainName as sn, DagBuilder as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, canonicalizeRegion as ta, BOOTSTRAP_MARKER_PREFIX as ti, classifyReplaySecretRegion as tn, safeStringify$1 as to, safeRegion as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, nullPrototypeRecord as ua, buildDenyExternalAccessPolicy as ui, AWS_CREDENTIAL_ENV_KEYS as un, STATE_SOURCED_CROSS_GENERATION_RULES as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, getAwsClients as va, formatDockerLoginError as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, isSingleDynamicReferenceToken as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, ConfigError as wa, escapeRegExp$1 as wi, malformedExportNamesWarning as wn, redactSecretsForState as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, setAwsClients as xa, redactDockerArgvValues as xi, hasReadableOutputs as xn, maskSecretsInText as xr, CloudControlProvider as xt, keptWholeReasonText as y, resetAwsClients as ya, getDockerCmd as yi, displayLogicalId as yn, markSameGenerationBag as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, StackHasActiveImportsError as za, stateBucketExistenceConfirmed as zi, refuseMalformedOrphans as zn, hasReasonlessBaselineRefusal as zr, refStateLookupFromResource as zt };
+//# sourceMappingURL=deploy-engine-BtJocpRR.js.map