@go-to-k/cdkd 0.296.30 → 0.297.0

package/dist/{deploy-engine-BuPc2Dfc.js → deploy-engine-dvf1UDuo.js}

@@ -2,10 +2,10 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js"
 import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
 import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-Cz2tPxXk.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-B__YmKBy.js";
+import { t as getCdkdVersion } from "./version-DE-djeB0.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
+import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { CloudControlClient, CreateResourceCommand, DeleteResourceCommand, GetResourceCommand, GetResourceRequestStatusCommand, ListResourcesCommand, UpdateResourceCommand } from "@aws-sdk/client-cloudcontrol";
 import { PublishCommand, SNSClient } from "@aws-sdk/client-sns";
 import { GetFunctionCommand, GetFunctionUrlConfigCommand, InvokeCommand, LambdaClient, UpdateFunctionConfigurationCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
@@ -204,17 +204,37 @@ var AppExecutor = class {
 
 //#endregion
 //#region src/types/assembly.ts
-function parseEnvironment(env) {
-	const match = env.match(/^aws:\/\/([^/]+)\/(.+)$/);
+const ASSEMBLY_REGION_PREFIX = /^[a-z0-9-]+/;
+const CDK_ENVIRONMENT_PATTERN = /aws:\/\/([a-zA-Z0-9@._-]+)\/([a-z0-9-]+)/;
+const CANONICAL_ASSEMBLY_REGION = /^[a-z0-9-]+$/;
+function parseEnvironment(env, stackName) {
+	const match = env.match(/^aws:\/\/([^/]+)\/([\s\S]+)$/);
 	if (!match) return {
 		account: "unknown-account",
 		region: "unknown-region"
 	};
-	return {
+	const raw = match[2];
+	const region = ASSEMBLY_REGION_PREFIX.exec(raw)?.[0];
+	if (region !== void 0) return {
 		account: match[1] === "unknown-account" ? "unknown-account" : match[1],
-		region: match[2] === "unknown-region" ? "unknown-region" : match[2]
+		region
+	};
+	const cdk = CDK_ENVIRONMENT_PATTERN.exec(env);
+	if (cdk === null) throw new SynthesisError(unparsableRegionMessage(raw, stackName));
+	return {
+		account: cdk[1],
+		region: cdk[2]
 	};
 }
+function unparsableRegionMessage(region, stackName) {
+	const subject = stackName === void 0 ? "The cloud assembly" : `Stack ${displayStackName(stackName)} in the cloud assembly`;
+	const lower = region.toLowerCase();
+	const caseOnly = CANONICAL_ASSEMBLY_REGION.test(lower);
+	const fix = caseOnly ? `Re-synthesize with the region spelled ${displayIdent(lower)}.` : "Re-synthesize with a canonical region, e.g. env: { region: 'us-east-1' }.";
+	const head = `${subject} declares region ${displayIdent(region)}, which is not a canonical AWS region spelling (lowercase letters, digits and '-'). The AWS CDK CLI refuses this assembly too ("Unable to parse environment specification"). ${fix}`;
+	if (!caseOnly) return head;
+	return `${head}\nIf an earlier cdkd version deployed this stack from such an assembly, it recorded the stack's state under that raw region spelling, and a deploy using the canonical spelling will not find that state: it starts the stack from no state at all. 'cdkd state show' and 'cdkd state orphan' still reach that record when '--stack-region' is given the exact raw spelling; 'state orphan' removes the record and leaves its AWS resources in place, unmanaged by cdkd.`;
+}
 
 //#endregion
 //#region src/utils/assembly-path.ts
@@ -606,7 +626,7 @@ var AssemblyReader = class {
 		}
 		if (dependencyNames.length > 0) this.logger.debug(`Stack ${displayStackName(stackName)} depends on: [${dependencyNames.map((n) => displaySafe(n)).join(", ")}]`);
 		let env;
-		if (artifact.environment) env = parseEnvironment(artifact.environment);
+		if (artifact.environment) env = parseEnvironment(artifact.environment, stackName);
 		const nestedTemplates = nullPrototypeRecord();
 		for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
 			if (resource?.Type !== "AWS::CloudFormation::Stack") continue;
@@ -5000,7 +5020,7 @@ function isNotImplemented(error) {
 	const status = error?.$metadata?.httpStatusCode;
 	return name === "NotImplemented" || status === 501;
 }
-function isAccessDenied(error) {
+function isAccessDenied$1(error) {
 	let current = error;
 	for (let depth = 0; depth < 5 && current !== null && typeof current === "object"; depth++) {
 		const name = current.name;
@@ -5028,7 +5048,7 @@ async function scanOtherPrefixesForStack(target, stackName, region) {
 	try {
 		segments = await target.listTopLevelPrefixes();
 	} catch (error) {
-		return isAccessDenied(error) ? {
+		return isAccessDenied$1(error) ? {
 			kind: "denied",
 			error,
 			stage: "list"
@@ -5051,7 +5071,7 @@ async function scanOtherPrefixesForStack(target, stackName, region) {
 					if (held === "holder") found.push(prefix);
 					else if (held === "empty") stale.push(prefix);
 				} catch (error) {
-					if (isAccessDenied(error)) denied ??= error;
+					if (isAccessDenied$1(error)) denied ??= error;
 					else failed ??= error;
 				}
 			}
@@ -5491,7 +5511,7 @@ var S3StateBackend = class S3StateBackend {
 	async verifyBucketExists(options = {}) {
 		await this.ensureClientForBucket();
 		if (options.existenceAlreadyProbed) {
-			this.logger.debug(`Skipping the redundant HeadBucket on '${this.config.bucket}' — the default-name resolution already confirmed it exists with these credentials (issue #1283).`);
+			this.logger.debug(`Skipping the redundant HeadBucket on '${this.config.bucket}' — the default-name resolution already confirmed it exists with these credentials.`);
 			return;
 		}
 		try {
@@ -13794,7 +13814,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["Description", "CFn-only informational — no semantic effect on the recursive deploy"],
 			["DisableRollback", "CFn-only — cdkd controls rollback via the top-level deploy-engine --no-rollback flag, not per nested stack"],
 			["EnableTerminationProtection", "CFn-only per-nested-stack flag — cdkd records stack-level terminationProtection at CDK synth time (parent only) and `cdkd destroy` consults that for refusal"],
-			["NotificationARNs", "CFn-only SNS-on-stack-event surface — cdkd has no equivalent (issue #459 design §9)"],
+			["NotificationARNs", "CFn-only SNS-on-stack-event surface — cdkd has no equivalent"],
 			["RoleARN", "CFn-only role-assumption — cdkd uses the caller credentials directly, no per-resource role assumption"],
 			["StackName", "cdkd derives the child stack name as `<parent>~<logicalId>` per design §3 (state-key uniqueness); a user-provided StackName has no effect"],
 			["StackPolicyBody", "CFn-only stack-update policy — cdkd has no equivalent (per-resource diff replaces stack-level policy)"],
@@ -13802,7 +13822,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["StackStatusReason", "CFn-only read-only output — never a real input property"],
 			["Tags", "CFn-only — cdkd does not tag the synthesized \"stack\" (the parent's synthesized ARN is a cdkd-local placeholder, not a real AWS resource)"],
 			["TemplateBody", "CFn-only inline template — cdkd reads the child template from the synth output via Metadata['aws:asset:path'] instead of accepting it inline"],
-			["TimeoutInMinutes", "CFn-only stack-create deadline — cdkd uses per-resource --resource-timeout instead (issue #459 design §9)"]
+			["TimeoutInMinutes", "CFn-only stack-create deadline — cdkd uses per-resource --resource-timeout instead"]
 		]),
 		createOnlyDrops: /* @__PURE__ */ new Set(["StackName"]),
 		readOnly: /* @__PURE__ */ new Set([
@@ -14578,7 +14598,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"PosixUser",
 			"RootDirectory"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["ClientToken", "cdkd supplies its own retry-stable ClientToken on CreateAccessPoint (issues #2039 and #2080), so a template-supplied value would be overwritten. The SDK does not own this field either: measured against @aws-sdk/client-efs 3.1018.0, an omitted ClientToken is auto-filled with a FRESH uuid per attempt, which leaves a retried 500 free to mint a second access point, while a caller-supplied value goes on the wire verbatim."]]),
+		silentDrop: /* @__PURE__ */ new Map([["ClientToken", "cdkd supplies its own retry-stable ClientToken on CreateAccessPoint, so a template-supplied value would be overwritten. The SDK does not own this field either: an omitted ClientToken is auto-filled with a FRESH uuid per attempt, which leaves a retried 500 free to mint a second access point, while a caller-supplied value goes on the wire verbatim."]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(["ClientToken"]),
 		readOnly: /* @__PURE__ */ new Set(["AccessPointId", "Arn"]),
 		ccRouteUnavailable: false
@@ -14598,7 +14618,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"ProvisionedThroughputInMibps",
 			"ThroughputMode"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["ReplicationConfiguration", "Cross-region EFS replication (CreateReplicationConfiguration) provisions a separate destination file system in another region with its own lifecycle, KMS key, and availability-zone placement; replicating + then tearing down the destination on destroy is a multi-resource, cross-region orchestration that is out of scope for the single-resource SDK provider. Tracked as a follow-up to issue #609."]]),
+		silentDrop: /* @__PURE__ */ new Map([["ReplicationConfiguration", "Cross-region EFS replication (CreateReplicationConfiguration) provisions a separate destination file system in another region with its own lifecycle, KMS key, and availability-zone placement; replicating + then tearing down the destination on destroy is a multi-resource, cross-region orchestration that is out of scope for the single-resource SDK provider."]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Arn", "FileSystemId"]),
 		ccRouteUnavailable: false
@@ -15528,7 +15548,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["DBClusterParameterGroupName", "not yet implemented by cdkd"],
 			["DBInstanceParameterGroupName", "not yet implemented by cdkd"],
 			["DBSystemId", "not yet implemented by cdkd"],
-			["DeleteAutomatedBackups", "delete-time flag, sent on the delete when the record carries it (issue #3993); kept unhandled so a template declaring it keeps its Cloud Control route. Final snapshots are governed by DeletionPolicy: Snapshot (issue #1352), which this flag does not control"],
+			["DeleteAutomatedBackups", "delete-time flag, sent on the delete when the record carries it; kept unhandled so a template declaring it keeps its Cloud Control route. Final snapshots are governed by DeletionPolicy: Snapshot, which this flag does not control"],
 			["Domain", "not yet implemented by cdkd"],
 			["DomainIAMRoleName", "not yet implemented by cdkd"],
 			["EnableCloudwatchLogsExports", "not yet implemented by cdkd"],
@@ -15628,7 +15648,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["DBSnapshotIdentifier", "not yet implemented by cdkd"],
 			["DBSystemId", "not yet implemented by cdkd"],
 			["DedicatedLogVolume", "not yet implemented by cdkd"],
-			["DeleteAutomatedBackups", "delete-time flag, sent on the delete when the record carries it (issue #3993); kept unhandled so a template declaring it keeps its Cloud Control route. Final snapshots are governed by DeletionPolicy: Snapshot (issue #1352), which this flag does not control"],
+			["DeleteAutomatedBackups", "delete-time flag, sent on the delete when the record carries it; kept unhandled so a template declaring it keeps its Cloud Control route. Final snapshots are governed by DeletionPolicy: Snapshot, which this flag does not control"],
 			["Domain", "not yet implemented by cdkd"],
 			["DomainAuthSecretArn", "not yet implemented by cdkd"],
 			["DomainDnsIps", "not yet implemented by cdkd"],
@@ -19651,7 +19671,7 @@ function recordSecretNamedRead(logicalId, value, context) {
 }
 function rejectPlaceholderArnAttribute(resource, attributeName, value, logicalId, context, healOutcome) {
 	if (!isStalePlaceholderArnAttribute(resource.resourceType, attributeName, value)) return;
-	throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: the recorded value ${quotedRender(stringifyValue(this.maskValueLeaves(value, context)), "\"")} is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. ` + this.staleRecordRemedy(healOutcome, context)));
+	throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: the recorded value ${quotedRender(stringifyValue(this.maskValueLeaves(value, context)), "\"")} is a placeholder written by an older cdkd version — its region and account fields are literal wildcards, so it is not a usable ARN. ` + this.staleRecordRemedy(healOutcome, context)));
 }
 async function constructAttribute(resource, attributeName, context, logicalId, accountInfo) {
 	const { resourceType, physicalId } = resource;
@@ -20922,7 +20942,7 @@ async function resolveSplit(splitArgs, context) {
 		const source = this.describeSplitValueSource(value);
 		const sourceClause = source ? ` (from ${this.displayMasked(source.label, context)})` : "";
 		if (Array.isArray(resolvedValue)) {
-			const remedy = source?.kind === "ref" ? "A list-typed parameter — any List<...> type (List<AWS::EC2::Subnet::Id>, List<Number>, …) or CommaDelimitedList — is already a list." : source?.kind === "getatt" ? "A list-valued Fn::GetAtt (for example AWS::Route53::HostedZone.NameServers or AWS::EC2::VPC.Ipv6CidrBlocks) already returns a list. If you wrote the Fn::Split as a workaround for cdkd resolving that attribute to a comma-delimited string, that bug is fixed (PR #1868) and the workaround is no longer needed." : "Several intrinsics already return a list — among them a list-valued Fn::GetAtt, a Ref to a list-typed parameter (any List<...> type or CommaDelimitedList), Fn::GetAZs, Fn::Cidr, and Fn::Split itself.";
+			const remedy = source?.kind === "ref" ? "A list-typed parameter — any List<...> type (List<AWS::EC2::Subnet::Id>, List<Number>, …) or CommaDelimitedList — is already a list." : source?.kind === "getatt" ? "A list-valued Fn::GetAtt (for example AWS::Route53::HostedZone.NameServers or AWS::EC2::VPC.Ipv6CidrBlocks) already returns a list. If you wrote the Fn::Split as a workaround for cdkd resolving that attribute to a comma-delimited string, that bug is fixed and the workaround is no longer needed." : "Several intrinsics already return a list — among them a list-valued Fn::GetAtt, a Ref to a list-typed parameter (any List<...> type or CommaDelimitedList), Fn::GetAZs, Fn::Cidr, and Fn::Split itself.";
 			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Split: the value to split${sourceClause} is ALREADY a list (an array of ${resolvedValue.length} item${resolvedValue.length === 1 ? "" : "s"}), not a string. CloudFormation rejects Fn::Split over a list too, so this template is not valid CloudFormation either. Remove the Fn::Split and use the value directly. ${remedy}`));
 		}
 		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Split: the value to split${sourceClause} must be a string, got ${resolvedValue === null ? "null" : typeof resolvedValue}. Fn::Split accepts only a string; check the value or the intrinsic that produced it.`));
@@ -22347,7 +22367,7 @@ var DiffCalculator = class DiffCalculator {
 						requiresReplacement: await this.maskedEditRequiresReplacement(desiredResource.Type, key, oldValue, newValue),
 						maskedExpressionChanged: true
 					});
-					this.logger.debug(safeMsg`${logicalId}: ${key} is recorded masked and its template expression or a resolved input changed (go-to-k/cdkd#4451, go-to-k/cdkd#4543)`);
+					this.logger.debug(safeMsg`${logicalId}: ${key} is recorded masked and its template expression or a resolved input changed`);
 				}
 				const attributeChanges = this.compareAttributes(currentResource, desiredResource);
 				if (propertyChanges.length > 0 || attributeChanges.length > 0) {
@@ -23125,9 +23145,167 @@ function escapeRegExp$1(text) {
 	return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+//#endregion
+//#region src/provisioning/getatt-attributes.generated.ts
+const WRITABLE_GETATT_ATTRIBUTES = {
+	"AWS::Amplify::Branch": ["BranchName"],
+	"AWS::Amplify::Domain": [
+		"AutoSubDomainCreationPatterns",
+		"AutoSubDomainIAMRole",
+		"DomainName",
+		"EnableAutoSubDomain"
+	],
+	"AWS::AppMesh::GatewayRoute": [
+		"GatewayRouteName",
+		"MeshName",
+		"MeshOwner",
+		"VirtualGatewayName"
+	],
+	"AWS::AppMesh::Mesh": ["MeshName"],
+	"AWS::AppMesh::Route": [
+		"MeshName",
+		"MeshOwner",
+		"RouteName",
+		"VirtualRouterName"
+	],
+	"AWS::AppMesh::VirtualGateway": [
+		"MeshName",
+		"MeshOwner",
+		"VirtualGatewayName"
+	],
+	"AWS::AppMesh::VirtualNode": [
+		"MeshName",
+		"MeshOwner",
+		"VirtualNodeName"
+	],
+	"AWS::AppMesh::VirtualRouter": [
+		"MeshName",
+		"MeshOwner",
+		"VirtualRouterName"
+	],
+	"AWS::AppMesh::VirtualService": [
+		"MeshName",
+		"MeshOwner",
+		"VirtualServiceName"
+	],
+	"AWS::AppSync::DataSource": ["Name"],
+	"AWS::AppSync::DomainName": ["DomainName"],
+	"AWS::AppSync::FunctionConfiguration": ["DataSourceName", "Name"],
+	"AWS::AppSync::Resolver": ["FieldName", "TypeName"],
+	"AWS::Backup::BackupSelection": ["BackupPlanId"],
+	"AWS::Backup::BackupVault": ["BackupVaultName"],
+	"AWS::CleanRooms::AnalysisTemplate": ["Schema"],
+	"AWS::Cloud9::EnvironmentEC2": ["Name"],
+	"AWS::CloudWatch::InsightRule": ["RuleName"],
+	"AWS::CodeArtifact::Domain": ["EncryptionKey"],
+	"AWS::CodeArtifact::Repository": ["DomainName", "DomainOwner"],
+	"AWS::EC2::CapacityReservation": [
+		"AvailabilityZone",
+		"InstanceType",
+		"Tenancy"
+	],
+	"AWS::EC2::Instance": ["AvailabilityZone"],
+	"AWS::EC2::SecurityGroup": ["VpcId"],
+	"AWS::EC2::Subnet": [
+		"AvailabilityZone",
+		"AvailabilityZoneId",
+		"CidrBlock",
+		"OutpostArn",
+		"VpcId"
+	],
+	"AWS::EC2::VPC": ["CidrBlock"],
+	"AWS::EFS::MountTarget": ["IpAddress"],
+	"AWS::EKS::Nodegroup": ["ClusterName", "NodegroupName"],
+	"AWS::ElasticLoadBalancingV2::LoadBalancer": ["SecurityGroups"],
+	"AWS::EventSchemas::Discoverer": ["CrossAccount"],
+	"AWS::EventSchemas::Registry": ["RegistryName"],
+	"AWS::EventSchemas::Schema": ["SchemaName"],
+	"AWS::Events::EventBus": ["Name"],
+	"AWS::GameLift::GameSessionQueue": ["Name"],
+	"AWS::GameLift::MatchmakingConfiguration": ["Name"],
+	"AWS::GameLift::MatchmakingRuleSet": ["Name"],
+	"AWS::Grafana::Workspace": ["GrafanaVersion"],
+	"AWS::Greengrass::ConnectorDefinition": ["Name"],
+	"AWS::Greengrass::CoreDefinition": ["Name"],
+	"AWS::Greengrass::DeviceDefinition": ["Name"],
+	"AWS::Greengrass::FunctionDefinition": ["Name"],
+	"AWS::Greengrass::Group": ["Name", "RoleArn"],
+	"AWS::Greengrass::LoggerDefinition": ["Name"],
+	"AWS::Greengrass::ResourceDefinition": ["Name"],
+	"AWS::Greengrass::SubscriptionDefinition": ["Name"],
+	"AWS::ImageBuilder::Component": ["Name"],
+	"AWS::ImageBuilder::ContainerRecipe": ["Name"],
+	"AWS::ImageBuilder::DistributionConfiguration": ["Name"],
+	"AWS::ImageBuilder::ImagePipeline": ["Name"],
+	"AWS::ImageBuilder::ImageRecipe": ["Name"],
+	"AWS::ImageBuilder::InfrastructureConfiguration": ["Name"],
+	"AWS::Kinesis::StreamConsumer": ["ConsumerName", "StreamARN"],
+	"AWS::MSK::Cluster": ["CurrentVersion"],
+	"AWS::ManagedBlockchain::Member": ["NetworkId"],
+	"AWS::ManagedBlockchain::Node": ["MemberId", "NetworkId"],
+	"AWS::MediaConvert::JobTemplate": ["Name"],
+	"AWS::MediaConvert::Preset": ["Name"],
+	"AWS::MediaConvert::Queue": ["Name"],
+	"AWS::OpsWorks::Instance": ["AvailabilityZone"],
+	"AWS::OpsWorks::UserProfile": ["SshUsername"],
+	"AWS::QuickSight::Analysis": ["Errors", "Sheets"],
+	"AWS::RDS::DBInstance": ["DBSystemId"],
+	"AWS::RDS::DBParameterGroup": ["DBParameterGroupName"],
+	"AWS::RedshiftServerless::Workgroup": ["Workgroup"],
+	"AWS::RoboMaker::RobotApplication": ["CurrentRevisionId"],
+	"AWS::RoboMaker::SimulationApplication": ["CurrentRevisionId"],
+	"AWS::Route53Resolver::ResolverEndpoint": [
+		"Direction",
+		"Name",
+		"OutpostArn",
+		"PreferredInstanceType",
+		"ResolverEndpointType"
+	],
+	"AWS::Route53Resolver::ResolverRule": [
+		"DomainName",
+		"Name",
+		"ResolverEndpointId",
+		"TargetIps"
+	],
+	"AWS::Route53Resolver::ResolverRuleAssociation": [
+		"Name",
+		"ResolverRuleId",
+		"VPCId"
+	],
+	"AWS::S3::AccessPoint": ["Name"],
+	"AWS::SNS::Topic": ["TopicName"],
+	"AWS::SQS::Queue": ["QueueName"],
+	"AWS::SSM::Parameter": ["Type"],
+	"AWS::SSM::ResourceDataSync": ["SyncName"],
+	"AWS::SageMaker::CodeRepository": ["CodeRepositoryName"],
+	"AWS::SageMaker::Endpoint": ["EndpointName"],
+	"AWS::SageMaker::EndpointConfig": ["EndpointConfigName"],
+	"AWS::SageMaker::Model": ["ModelName"],
+	"AWS::SageMaker::ModelPackage": ["LastModifiedTime"],
+	"AWS::SageMaker::NotebookInstance": ["NotebookInstanceName"],
+	"AWS::SageMaker::NotebookInstanceLifecycleConfig": ["NotebookInstanceLifecycleConfigName"],
+	"AWS::SageMaker::Workteam": ["WorkteamName"],
+	"AWS::ServiceDiscovery::Service": ["Name"],
+	"AWS::Signer::SigningProfile": ["ProfileName"],
+	"AWS::StepFunctions::Activity": ["Name"],
+	"AWS::Transfer::User": ["ServerId", "UserName"]
+};
+
 //#endregion
 //#region src/provisioning/read-only-properties.ts
 const readOnlyPropertiesCache = /* @__PURE__ */ new Map();
+const attributeNamesCache = /* @__PURE__ */ new Map();
+async function getTopLevelAttributeNames(resourceType) {
+	const readOnly = await getTopLevelReadOnlyProperties(resourceType);
+	if (readOnly === void 0) return void 0;
+	const writable = Object.hasOwn(WRITABLE_GETATT_ATTRIBUTES, resourceType) ? WRITABLE_GETATT_ATTRIBUTES[resourceType] : void 0;
+	if (!writable || writable.length === 0) return readOnly;
+	const cached = attributeNamesCache.get(resourceType);
+	if (cached) return cached;
+	const names = /* @__PURE__ */ new Set([...readOnly, ...writable]);
+	attributeNamesCache.set(resourceType, names);
+	return names;
+}
 function getTopLevelReadOnlyProperties(resourceType) {
 	if (hasNoRegistrySchema(resourceType)) return Promise.resolve(void 0);
 	const cached = readOnlyPropertiesCache.get(resourceType);
@@ -23710,7 +23888,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BaabA371.js");
+			const { ASGProvider } = await import("./asg-provider-D9Po293s.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -23816,7 +23994,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-IBY6fDvN.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-5yc_bOJ-.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-CU0LZr05.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-xROL9y31.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -24501,7 +24679,7 @@ var CloudControlProvider = class {
 	async maskUncertifiedModelValues(model, resourceType, physicalId) {
 		const safeType = displaySafe(resourceType, { asciiOnly: true });
 		const safeId = displaySafe(physicalId, { asciiOnly: true });
-		const attributeNames = await getTopLevelReadOnlyProperties(resourceType);
+		const attributeNames = await getTopLevelAttributeNames(resourceType);
 		if (attributeNames === void 0) {
 			if (!this.warnedUnresolvableSchemaTypes.has(resourceType)) {
 				this.warnedUnresolvableSchemaTypes.add(resourceType);
@@ -24515,7 +24693,7 @@ var CloudControlProvider = class {
 			masked[key] = maskLeavesDeep(value);
 			maskedCount++;
 		}
-		if (maskedCount > 0 && attributeNames !== void 0) this.logger.debug(`Masked ${maskedCount} non-attribute key(s) out of the ${safeType} Cloud Control model for ${safeId}: they are not in the type's readOnlyProperties, so CloudFormation would reject an Fn::GetAtt naming them and cdkd has no evidence they are safe to persist.`);
+		if (maskedCount > 0 && attributeNames !== void 0) this.logger.debug(`Masked ${maskedCount} non-attribute key(s) out of the ${safeType} Cloud Control model for ${safeId}: they are not Fn::GetAtt attributes of the type, so CloudFormation would reject an Fn::GetAtt naming them and cdkd has no evidence they are safe to persist.`);
 		return masked;
 	}
 };
@@ -24626,6 +24804,124 @@ function maskLeavesDeep(value) {
 	return "***";
 }
 
+//#endregion
+//#region src/state/state-bucket-lifecycle.ts
+const CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID = "cdkd-custom-resource-responses-expiration";
+const CUSTOM_RESOURCE_RESPONSE_EXPIRATION_DAYS = 1;
+const CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_PREFIX = `${CUSTOM_RESOURCE_RESPONSE_PREFIX}/cdkd-1`;
+function buildCustomResourceResponseLifecycleRule(legacyPrefix) {
+	const prefix = CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_PREFIX;
+	return {
+		ID: CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID,
+		Status: "Enabled",
+		...legacyPrefix ? { Prefix: prefix } : { Filter: { Prefix: prefix } },
+		Expiration: { Days: 1 },
+		NoncurrentVersionExpiration: { NoncurrentDays: 1 }
+	};
+}
+async function applyCustomResourceResponseExpiration(s3, bucket, opts = {}) {
+	const owner = opts.expectedBucketOwner ? { ExpectedBucketOwner: opts.expectedBucketOwner } : {};
+	const first = await readLifecycle(s3, bucket, owner);
+	if ("failed" in first) return first.failed;
+	if (first.rules.some((rule) => rule.ID === "cdkd-custom-resource-responses-expiration")) return { status: "present" };
+	let collision;
+	try {
+		collision = await findStateUnderResponsePrefix(s3, bucket, owner);
+	} catch (error) {
+		return failedOutcome("ListObjectsV2", error);
+	}
+	if (collision !== void 0) return {
+		status: "refused",
+		reason: `${CUSTOM_RESOURCE_RESPONSE_PREFIX}/${displaySafe(collision) || "<unrenderable>"} holds objects other than custom-resource responses (a stack deployed with --state-prefix ${CUSTOM_RESOURCE_RESPONSE_PREFIX}), and the rule would expire them`
+	};
+	const latest = await readLifecycle(s3, bucket, owner);
+	if ("failed" in latest) return latest.failed;
+	if (latest.rules.some((rule) => rule.ID === "cdkd-custom-resource-responses-expiration")) return { status: "present" };
+	const existing = latest.rules;
+	const minimumObjectSize = latest.minimumObjectSize;
+	const legacyPrefix = existing.some((rule) => rule.Prefix !== void 0);
+	try {
+		await s3.send(new PutBucketLifecycleConfigurationCommand({
+			Bucket: bucket,
+			...owner,
+			LifecycleConfiguration: { Rules: [...existing, buildCustomResourceResponseLifecycleRule(legacyPrefix)] },
+			...minimumObjectSize !== void 0 && { TransitionDefaultMinimumObjectSize: minimumObjectSize }
+		}));
+	} catch (error) {
+		return failedOutcome("PutBucketLifecycleConfiguration", error);
+	}
+	return { status: "added" };
+}
+async function readLifecycle(s3, bucket, owner) {
+	try {
+		const current = await s3.send(new GetBucketLifecycleConfigurationCommand({
+			Bucket: bucket,
+			...owner
+		}));
+		return {
+			rules: current.Rules ?? [],
+			minimumObjectSize: current.TransitionDefaultMinimumObjectSize
+		};
+	} catch (error) {
+		if (error?.name === "NoSuchLifecycleConfiguration") return {
+			rules: [],
+			minimumObjectSize: void 0
+		};
+		return { failed: failedOutcome("GetBucketLifecycleConfiguration", error) };
+	}
+}
+function isAccessDenied(error) {
+	const e = error;
+	return e?.name === "AccessDenied" || e?.$metadata?.httpStatusCode === 403;
+}
+function failedOutcome(operation, error) {
+	return {
+		status: "failed",
+		reason: failureReason(operation, error),
+		accessDenied: isAccessDenied(error)
+	};
+}
+async function findStateUnderResponsePrefix(s3, bucket, owner) {
+	let token;
+	do {
+		const page = await s3.send(new ListObjectsV2Command({
+			Bucket: bucket,
+			...owner,
+			Prefix: CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_PREFIX,
+			Delimiter: "/",
+			EncodingType: "url",
+			...token !== void 0 && { ContinuationToken: token }
+		}));
+		const first = decodeListingKey(page.CommonPrefixes?.find((p) => p.Prefix)?.Prefix);
+		if (first !== void 0) return first.slice(CUSTOM_RESOURCE_RESPONSE_PREFIX.length + 1);
+		token = page.IsTruncated ? page.NextContinuationToken : void 0;
+	} while (token !== void 0);
+}
+function failureReason(operation, error) {
+	return `${operation} failed: ${displaySafe(describeAwsFailure(error).detail) || "<unrenderable>"}`;
+}
+function customResourceResponseExpirationWarning(bucket, outcome) {
+	const remedy = outcome.status === "refused" ? `To add the rule, move that stack to a different --state-prefix.` : outcome.accessDenied ? "To add the rule, grant s3:GetLifecycleConfiguration, s3:PutLifecycleConfiguration and s3:ListBucket on the bucket, and check that this account owns it." : `To add the rule, review the bucket's lifecycle configuration against the reason above.`;
+	return `Could not add the ${1}-day expiration lifecycle rule for ${CUSTOM_RESOURCE_RESPONSE_PREFIX}/ to state bucket ${displaySafe(bucket, { asciiOnly: true }) || "<unrenderable>"} (${outcome.reason}). The bucket's lifecycle configuration was left unchanged. Custom-resource response objects left by an interrupted run stay until 'cdkd gc' removes them. ${remedy}`;
+}
+const ensured = /* @__PURE__ */ new Map();
+function ensureCustomResourceResponseExpirationOnce(s3, bucket, log) {
+	const memo = ensured.get(bucket);
+	if (memo) return memo;
+	const run = (async () => {
+		try {
+			const owner = await expectedOwnerParam(s3);
+			const outcome = await applyCustomResourceResponseExpiration(s3, bucket, { ...owner.ExpectedBucketOwner && { expectedBucketOwner: owner.ExpectedBucketOwner } });
+			if (outcome.status === "failed" || outcome.status === "refused") log.warn(customResourceResponseExpirationWarning(bucket, outcome));
+			else if (outcome.status === "added") log.debug(`Added the ${1}-day expiration lifecycle rule for ${CUSTOM_RESOURCE_RESPONSE_PREFIX}/ to the state bucket.`);
+		} catch (error) {
+			log.warn(customResourceResponseExpirationWarning(bucket, failedOutcome("lifecycle check", error)));
+		}
+	})();
+	ensured.set(bucket, run);
+	return run;
+}
+
 //#endregion
 //#region src/deployment/resource-secrets-scope.ts
 const currentResourceSecretsStore = new AsyncLocalStorage();
@@ -25779,6 +26075,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 		if (!this.responseBucket) return "https://localhost/cfn-response-not-configured";
 		await this.ensureResponseClient();
 		const bucket = this.responseBucket;
+		if (this.responsePrefix === "custom-resource-responses") ensureCustomResourceResponseExpirationOnce(this.s3Client, bucket, this.logger);
 		try {
 			await withRetry(() => this.s3Client.send(new PutObjectCommand({
 				Bucket: bucket,
@@ -28615,6 +28912,162 @@ const PRINCIPAL_KINDS = {
 	"AWS::IAM::Group": "group",
 	"AWS::IAM::User": "user"
 };
+function isInlinePolicyPrincipalType(resourceType) {
+	return Object.hasOwn(PRINCIPAL_KINDS, resourceType);
+}
+function principalKindOf(resourceType) {
+	return Object.hasOwn(PRINCIPAL_KINDS, resourceType) ? PRINCIPAL_KINDS[resourceType] : void 0;
+}
+const ANY = "*";
+const PRINCIPAL_NAME_FIELDS = {
+	role: "RoleName",
+	group: "GroupName",
+	user: "UserName"
+};
+function nameKey(value) {
+	return typeof value === "string" && IAM_NAME.test(value) ? value.toLowerCase() : ANY;
+}
+function templatePrincipalKeys(entry, kind, templateResources, stateResources) {
+	if (typeof entry === "string") return [nameKey(entry)];
+	const ref = typeof entry === "object" && entry !== null && !Array.isArray(entry) ? entry["Ref"] : void 0;
+	if (typeof ref !== "string" || !Object.hasOwn(templateResources, ref)) return [ANY];
+	const target = templateResources[ref];
+	if (principalKindOf(target.Type) !== kind) return [ANY];
+	return principalSelfKeys(ref, kind, target, stateResources);
+}
+function principalSelfKeys(logicalId, kind, template, stateResources) {
+	const keys = [`ref:${logicalId}`];
+	const declared = template?.Properties?.[PRINCIPAL_NAME_FIELDS[kind]];
+	const declaredKey = nameKey(declared);
+	if (declaredKey !== ANY) keys.push(declaredKey);
+	const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+	if (record !== void 0 && principalKindOf(record.resourceType) === kind) {
+		const recordedKey = nameKey(record.physicalId);
+		if (recordedKey !== ANY) keys.push(recordedKey);
+	}
+	return keys;
+}
+function policiesNames(policies) {
+	if (policies === void 0 || policies === null) return [];
+	if (!Array.isArray(policies)) return [ANY];
+	return policies.map((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) ? nameKey(entry["PolicyName"]) : ANY);
+}
+function inlinePolicyClaimsOf(logicalId, change, templateResources, stateResources) {
+	const template = Object.hasOwn(templateResources, logicalId) ? templateResources[logicalId] : void 0;
+	const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+	const recorded = record?.resourceType === change.resourceType ? record : void 0;
+	const claims = [];
+	const cross = (kind, principals, names) => {
+		for (const principal of new Set(principals)) for (const name of new Set(names)) claims.push({
+			kind,
+			principal,
+			name
+		});
+	};
+	if (change.resourceType === "AWS::IAM::Policy") {
+		const desired = template?.Properties ?? {};
+		const old = recorded?.properties ?? {};
+		const names = [];
+		if (desired["PolicyName"] !== void 0) names.push(nameKey(desired["PolicyName"]));
+		if (old["PolicyName"] !== void 0) names.push(nameKey(old["PolicyName"]));
+		if (recorded !== void 0) names.push(nameKey(typeof recorded.physicalId === "string" ? recorded.physicalId.split(":")[0] : recorded.physicalId));
+		if (names.length === 0) return claims;
+		for (const kind of [
+			"role",
+			"group",
+			"user"
+		]) {
+			const field = POLICY_LIST_FIELDS[kind];
+			const principals = [];
+			const listed = desired[field];
+			if (Array.isArray(listed)) for (const entry of listed) principals.push(...templatePrincipalKeys(entry, kind, templateResources, stateResources));
+			else if (listed !== void 0) principals.push(ANY);
+			const held = old[field];
+			if (Array.isArray(held)) principals.push(...held.map(nameKey));
+			else if (held !== void 0 && held !== null) principals.push(ANY);
+			cross(kind, principals, names);
+		}
+		return claims;
+	}
+	const kind = principalKindOf(change.resourceType);
+	if (kind === void 0) return claims;
+	if (!(change.changeType === "CREATE" || (change.propertyChanges ?? []).some((c) => c.requiresReplacement) || ownPoliciesChange(change))) return claims;
+	cross(kind, principalSelfKeys(logicalId, kind, template, stateResources), [...policiesNames(template?.Properties?.["Policies"]), ...policiesNames(recorded?.properties?.["Policies"])]);
+	return claims;
+}
+function orderInlinePolicyWriters(args) {
+	const { writes, changes, templateResources, stateResources, dependencies, rank } = args;
+	const writers = writes.filter((id) => {
+		const type = changes.get(id)?.resourceType;
+		return type === "AWS::IAM::Policy" || type !== void 0 && isInlinePolicyPrincipalType(type);
+	});
+	if (writers.length < 2) return [];
+	const exact = /* @__PURE__ */ new Map();
+	const loose = [];
+	const all = [];
+	for (const id of writers) for (const claim of inlinePolicyClaimsOf(id, changes.get(id), templateResources, stateResources)) {
+		all.push({
+			id,
+			claim
+		});
+		if (claim.principal === ANY || claim.name === ANY) {
+			loose.push({
+				id,
+				claim
+			});
+			continue;
+		}
+		const key = JSON.stringify([
+			claim.kind,
+			claim.principal,
+			claim.name
+		]);
+		const ids = exact.get(key) ?? /* @__PURE__ */ new Set();
+		ids.add(id);
+		exact.set(key, ids);
+	}
+	const principalRows = new Set(writers.filter((id) => isInlinePolicyPrincipalType(changes.get(id).resourceType)));
+	const pairs = /* @__PURE__ */ new Map();
+	const pair = (a, b) => {
+		if (a === b || principalRows.has(a) && principalRows.has(b)) return;
+		const [x, y] = rank(a) < rank(b) || rank(a) === rank(b) && a < b ? [a, b] : [b, a];
+		pairs.set(JSON.stringify([x, y]), [x, y]);
+	};
+	for (const ids of exact.values()) {
+		const list = [...ids];
+		for (let i = 0; i < list.length; i++) for (let j = i + 1; j < list.length; j++) pair(list[i], list[j]);
+	}
+	const meets = (a, b) => a === ANY || b === ANY || a === b;
+	for (const { id, claim } of loose) for (const other of all) {
+		if (other.claim.kind !== claim.kind) continue;
+		if (meets(claim.principal, other.claim.principal) && meets(claim.name, other.claim.name)) pair(id, other.id);
+	}
+	if (pairs.size === 0) return [];
+	const reaches = (from, to) => {
+		const seen = /* @__PURE__ */ new Set();
+		const stack = [from];
+		while (stack.length > 0) {
+			const id = stack.pop();
+			if (id === to) return true;
+			if (seen.has(id)) continue;
+			seen.add(id);
+			for (const dep of dependencies.get(id) ?? []) stack.push(dep);
+		}
+		return false;
+	};
+	const added = [];
+	for (const [before, after] of pairs.values()) {
+		if (reaches(after, before) || reaches(before, after)) continue;
+		const deps = dependencies.get(after) ?? /* @__PURE__ */ new Set();
+		deps.add(before);
+		dependencies.set(after, deps);
+		added.push({
+			before,
+			after
+		});
+	}
+	return added;
+}
 function ownPoliciesChange(change) {
 	return (change?.propertyChanges ?? []).some((c) => c.path === "Policies" && c.inPlacePropagated !== true && c.replacementPropagated !== true);
 }
@@ -29490,13 +29943,55 @@ function secretNamesReadBy(logicalId, record, resources, judge = () => ({
 		const bags = judge(otherId);
 		const needles = secretNameNeedlesOf(otherId, other, bags.secrets, { embedded: bags.embedded });
 		if (needles === void 0) continue;
-		for (const needle of needles) if (leaves.some((leaf) => leaf === needle || needle.length >= 4 && leaf.includes(needle))) read.add(needle);
+		for (const needle of needles) if (leavesHoldNeedle(leaves, needle)) read.add(needle);
 	}
 	return read;
 }
+function leavesHoldNeedle(leaves, needle) {
+	return leaves.some((leaf) => leaf === needle || needle.length >= 4 && leaf.includes(needle));
+}
 function stateSecretNameNeedles(resources, secrets) {
 	return (logicalId) => secretNameNeedlesOf(logicalId, Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0, secrets, { embedded: void 0 });
 }
+function storedRecordNameNeedles(logicalId, record, secrets) {
+	const needles = secretNameNeedlesOf(logicalId, record, secrets, { embedded: void 0 });
+	if (needles === void 0) return void 0;
+	const bag = secrets !== void 0 && hasMaskableValues(secrets) ? secrets : void 0;
+	const mask = (text) => bag === void 0 ? text : maskSecretsInText(text, bag);
+	const folded = /* @__PURE__ */ new Map();
+	if (bag !== void 0) for (const needle of printingCorpusOf(bag).keys()) recordLogOnlyValue(folded, needle.toLowerCase());
+	const maskFolded = (text) => hasMaskableValues(folded) ? maskSecretsInText(text.toLowerCase(), folded) : text.toLowerCase();
+	const publicLeaves = [...wholeStringLeavesOf(record?.properties)].filter((leaf) => leaf !== "" && !leaf.includes("{{resolve:") && leaf !== "***" && !isSecretDerivedValue(leaf.toLowerCase(), maskFolded) && !isSecretDerivedValue(leaf, mask));
+	for (const needle of [...needles]) if (leavesHoldNeedle(publicLeaves, needle)) needles.delete(needle);
+	return needles.size > 0 ? needles : void 0;
+}
+function storedSecretNameNeedles(resources, secrets, bag = /* @__PURE__ */ new Map(), outputs) {
+	const named = [];
+	for (const [logicalId, record] of Object.entries(resources)) {
+		const needles = storedRecordNameNeedles(logicalId, record, secrets);
+		if (needles !== void 0) named.push([logicalId, needles]);
+	}
+	if (named.length === 0) return bag;
+	const readers = Object.entries(resources).map(([readerId, record]) => [readerId, [...wholeStringLeavesOf(record?.properties)].filter((leaf) => leaf !== "")]);
+	readers.push([void 0, [...wholeStringLeavesOf(outputs)].filter((leaf) => leaf !== "")]);
+	for (const [readerId, leaves] of readers) {
+		if (leaves.length === 0) continue;
+		for (const [namedId, needles] of named) {
+			if (namedId === readerId) continue;
+			for (const needle of needles) if (leavesHoldNeedle(leaves, needle)) recordLogOnlyValue(bag, needle);
+		}
+	}
+	return bag;
+}
+function secretNamesStoredIn(record, needles) {
+	const leaves = [...wholeStringLeavesOf(record?.properties)].filter((leaf) => leaf !== "");
+	if (leaves.length === 0) return [];
+	return [...needles].filter((needle) => leavesHoldNeedle(leaves, needle));
+}
+function secretNamedRecordNeedles(resources, secrets, bag = /* @__PURE__ */ new Map()) {
+	for (const [logicalId, record] of Object.entries(resources)) for (const needle of storedRecordNameNeedles(logicalId, record, secrets) ?? []) recordLogOnlyValue(bag, needle);
+	return bag;
+}
 function secretNamePrintingBag(logicalId, resources) {
 	const bag = /* @__PURE__ */ new Map();
 	const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
@@ -30707,7 +31202,7 @@ function renderNestedStackTypeChangeRefusal(typeChanges, stackName) {
 	const rows = typeChanges.map((tc) => {
 		return `${`  - ${tc.logicalId}: Type changes from ${tc.currentType} to ${tc.desiredType} (the existing ${tc.currentType} is ${tc.physicalId}).`}\n${tc.direction === "into-nested-stack" ? `    Replacing a single resource BY a nested stack is not supported: the create half of the replacement would deploy a whole child stack "${stackName}~${tc.logicalId}" as one row, while ${tc.physicalId} is still recorded under this logical id.` : `    Replacing a nested stack BY a single resource is not supported: a replacement deletes its old half as a best-effort cleanup step whose failure is only a warning, so the child stack "${stackName}~${tc.logicalId}" and every resource it owns could be left behind, untracked, under a deploy that reports success.`}`;
 	});
-	return `Refusing to deploy ${stackName}: ` + (typeChanges.length === 1 ? `a resource changes its Type ` : `${typeChanges.length} resources change their Type `) + `into or out of ${NESTED_STACK_RESOURCE_TYPE}, which cdkd does not replace in place (issue #2668).\n${rows.join("\n")}\n  Deploy this as two changes instead: give the new resource a DIFFERENT logical id (in CDK, rename the construct) so the existing row is deleted through its own type's provider and the new one is created under its own — or remove the resource in one deploy and add its replacement in the next. There is no flag that overrides this refusal.`;
+	return `Refusing to deploy ${stackName}: ` + (typeChanges.length === 1 ? `a resource changes its Type ` : `${typeChanges.length} resources change their Type `) + `into or out of ${NESTED_STACK_RESOURCE_TYPE}, which cdkd does not replace in place.\n${rows.join("\n")}\n  Deploy this as two changes instead: give the new resource a DIFFERENT logical id (in CDK, rename the construct) so the existing row is deleted through its own type's provider and the new one is created under its own — or remove the resource in one deploy and add its replacement in the next. There is no flag that overrides this refusal.`;
 }
 
 //#endregion
@@ -34169,7 +34664,7 @@ function kickOffAutoRefreshObservedProperties(stateResources, crossStackReads) {
 			resource
 		});
 	}
-	if (refused > 0) this.logger.debug(`observed-properties auto-refresh SKIPPED for ${refused} resource(s) whose baseline a 'cdkd import' run refused (issue #2944): their recorded properties cannot position the redaction, so capturing an AWS readback against them could persist a resolved secret in plaintext. A deploy that actually CHANGES one of them restores its baseline, unless the refusal is an unverifiable-parameter one (only a replacement or a proving re-import discharges that); a NO_CHANGE deploy never does.`);
+	if (refused > 0) this.logger.debug(`observed-properties auto-refresh SKIPPED for ${refused} resource(s) whose baseline a 'cdkd import' run refused: their recorded properties cannot position the redaction, so capturing an AWS readback against them could persist a resolved secret in plaintext. A deploy that actually CHANGES one of them restores its baseline, unless the refusal is an unverifiable-parameter one (only a replacement or a proving re-import discharges that); a NO_CHANGE deploy never does.`);
 	if (candidates.length === 0 && masked.length === 0) return;
 	const allSiblings = {};
 	for (const [lid, res] of Object.entries(stateResources)) allSiblings[lid] = {
@@ -34202,7 +34697,7 @@ function kickOffAutoRefreshObservedProperties(stateResources, crossStackReads) {
 	if (masked.length > 0) try {
 		producerRegions = producerRegionsFromState(crossStackReads);
 	} catch {
-		this.logger.debug(safeMsg`Masked observed baseline re-capture skipped for ${masked.length} resource(s): the record's cross-stack reads could not be read (issue #3595).`);
+		this.logger.debug(safeMsg`Masked observed baseline re-capture skipped for ${masked.length} resource(s): the record's cross-stack reads could not be read.`);
 		masked.length = 0;
 	}
 	for (const { logicalId, resource } of masked) {
@@ -34229,7 +34724,7 @@ function kickOffMaskedBaselineRecapture(provider, logicalId, resource, producerR
 	const task = (async () => {
 		const secrets = await resolveRecordSecrets(properties, (token, own) => this.resolver.resolveDynamicReferences(token, persistedTokenResolverContext(own, producerRegions)));
 		if (secrets === void 0 || secrets.size === 0) {
-			this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: its recorded references did not all resolve to distinct values (issue #3595).`);
+			this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: its recorded references did not all resolve to distinct values.`);
 			return;
 		}
 		const readback = await withCurrentResourceSecrets(secrets, () => readCurrentState(resource.physicalId, logicalId, resource.resourceType, properties, context));
@@ -34241,14 +34736,14 @@ function kickOffMaskedBaselineRecapture(provider, logicalId, resource, producerR
 			secrets
 		});
 		if (recaptured === void 0) {
-			this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: no masked position could be certified, or the resource no longer reads back as its baseline records (issue #3595).`);
+			this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: no masked position could be certified, or the resource no longer reads back as its baseline records.`);
 			return;
 		}
 		this.recapturedBaselines.set(recaptured, previous);
-		this.logger.debug(safeMsg`Re-captured the masked observed baseline of ${logicalId} (issue #3595).`);
+		this.logger.debug(safeMsg`Re-captured the masked observed baseline of ${logicalId}.`);
 		return recaptured;
 	})().catch(() => {
-		this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: the re-capture failed (issue #3595).`);
+		this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: the re-capture failed.`);
 	});
 	this.observedCaptureTasks.set(logicalId, task);
 }
@@ -34310,17 +34805,27 @@ function deepEqualValue(a, b) {
 
 //#endregion
 //#region src/deployment/deploy-engine/masking.ts
-function diffLogMasker(diffSecrets, template, parameterValues) {
+function diffLogMasker(diffSecrets, template, parameterValues, resources) {
 	const inherited = this.options.inheritedSecrets;
 	const noEchoValues = /* @__PURE__ */ new Map();
 	const noEchoNames = new Set(Object.entries(template.Parameters ?? {}).filter(([, definition]) => definition?.NoEcho === true).map(([name]) => name));
 	const splitDelimiters = literalSplitDelimitersOf(template, noEchoNames);
 	for (const [name, definition] of Object.entries(template.Parameters ?? {})) if (definition?.NoEcho === true && Object.hasOwn(parameterValues, name)) recordLogOnlyParameterValue(noEchoValues, parameterValues[name], splitDelimiters);
-	return createUnionSecretMasker([
+	const stateNames = /* @__PURE__ */ new Map();
+	const union = createUnionSecretMasker([
 		diffSecrets,
 		noEchoValues,
+		stateNames,
 		inherited
 	]);
+	let judged = false;
+	return (text) => {
+		if (!judged) {
+			judged = true;
+			storedSecretNameNeedles(resources, this.fingerprintNoEchoValues, stateNames);
+		}
+		return union(text);
+	};
 }
 function freshNoEchoParameters(parameterValues) {
 	const inherited = this.options.inheritedSecrets;
@@ -34402,7 +34907,7 @@ function refuseRedactedAttributeReads(logicalId, resourceType, context) {
 		const producers = [...new Set(reads.map((read) => read.logicalId).filter((id) => !!id))];
 		throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: ${producers.map((id) => displayIdent(id)).join(", ")} declared ${reads.length === 1 ? "that attribute" : "those attributes"} NoEcho, so cdkd's recorded state holds only the redaction mask for ${reads.length === 1 ? "it" : "them"}, and cdkd does not re-run a producer to recover a value. Remedy: deploy a change to the producer in the SAME run as ${logicalId} (for a custom resource, change one of its properties, e.g. a nonce / version property, so its handler runs again and supplies the value), or stop declaring the value NoEcho.`, resourceType, logicalId);
 	}
-	throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the redaction mask there, and the value is not recoverable from state. There are three ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all, or cdkd deploy '**' when either is inside a CDK Stage) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The value holds the Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records — so a deploy that leaves the resource or output holding it unchanged reads the mask again, and a re-import does not recover it. Remedy: have this resource build the value itself from the SECRET's own reference (the {{resolve:secretsmanager:...}} or {{resolve:ssm-secure:...}} reference, or a {{resolve:ssm:...}} of a SecureString parameter, that the encoding was made from) under its own Fn::Base64, instead of reading it from another resource's attribute or another stack's output — not by a {{resolve:ssm:...}} read of a String parameter holding the encoding, which cdkd treats as public and would record in state in the clear. (3) The resource was adopted by 'cdkd import' through the Cloud Control fallback, which records only the attributes the type's CloudFormation schema declares read-only and masks the rest. Either the attribute named above is not one of them — CloudFormation would reject an Fn::GetAtt naming it too, so stop reading it — or cdkd could not read that schema and masked the whole model, which the import warned about when it happened. If that warning named a missing cloudformation:DescribeType permission, grant it first. See https://github.com/go-to-k/cdkd/issues/2449. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources, true)}`, resourceType, logicalId);
+	throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the redaction mask there, and the value is not recoverable from state. There are three ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all, or cdkd deploy '**' when either is inside a CDK Stage) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The value holds the Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records — so a deploy that leaves the resource or output holding it unchanged reads the mask again, and a re-import does not recover it. Remedy: have this resource build the value itself from the SECRET's own reference (the {{resolve:secretsmanager:...}} or {{resolve:ssm-secure:...}} reference, or a {{resolve:ssm:...}} of a SecureString parameter, that the encoding was made from) under its own Fn::Base64, instead of reading it from another resource's attribute or another stack's output — not by a {{resolve:ssm:...}} read of a String parameter holding the encoding, which cdkd treats as public and would record in state in the clear. (3) The resource was adopted by 'cdkd import' through the Cloud Control fallback, which records only the type's Fn::GetAtt attributes (its read-only properties plus the writable ones CloudFormation also accepts in Fn::GetAtt) and masks the rest. Either the attribute named above is not one of them — CloudFormation would reject an Fn::GetAtt naming it too, so stop reading it — or cdkd could not read that schema and masked the whole model, which the import warned about when it happened. If that warning named a missing cloudformation:DescribeType permission, grant it first. See https://github.com/go-to-k/cdkd/issues/2449. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources, true)}`, resourceType, logicalId);
 }
 function allRecordedSecrets() {
 	const all = /* @__PURE__ */ new Map();
@@ -34787,7 +35292,7 @@ function createReadOnlyAttributeHealerFactory(options) {
 			region
 		})))().then((outcome) => {
 			if (outcome.kind === "read") try {
-				logger.debug(safeMsg`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS for this preview — its state record lacked one a Fn::GetAtt asked for (#1852); nothing is written: ${Object.keys(outcome.attributes).length} attribute(s) read`);
+				logger.debug(safeMsg`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS for this preview — its state record lacked one a Fn::GetAtt asked for; nothing is written: ${Object.keys(outcome.attributes).length} attribute(s) read`);
 			} catch {}
 			return outcome;
 		}).catch((error) => ({
@@ -34839,7 +35344,7 @@ async function readStaleAttributes(logicalId, resource, stackName) {
 		resourceType: resource.resourceType,
 		attributes
 	});
-	this.logger.debug(`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS — its state record lacked one a Fn::GetAtt asked for (#1852): ${Object.keys(attributes).length} attribute(s) read`);
+	this.logger.debug(`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS — its state record lacked one a Fn::GetAtt asked for: ${Object.keys(attributes).length} attribute(s) read`);
 	return outcome;
 }
 function withHealedAttributes(logicalId, record) {
@@ -35188,9 +35693,9 @@ async function refuseUnlicensedGeneratedName(input) {
 			}], recoveryCommandFlags(this.options.refusalRecovery).flags).command}\``;
 			if (verdict.ownIntent !== void 0) {
 				const why = verdict.ownIntent === "abandoned" ? "a deploy of this stack that was killed or force-unlocked" : "a create of this stack that came back failed (a timeout or a server error)";
-				return refuse(`${subject} would be created with ${named}, which an existing resource (${displaySafe(verdict.holder)}) already holds. This stack's create-token ledger records that ${why} sent this name, but this type reports no creation time, so cdkd cannot tell that resource is the one it made rather than another deployment's created since. Since ${adoptsText}, creating it would take that resource over. ${displaySafe(logicalId)} was not created. The likely cause: the resource is this stack's own, from that deploy. If it is, ${importLine} and re-run; if it is not, this stack is also deployed under another state backend (go-to-k/cdkd#4705).`);
+				return refuse(`${subject} would be created with ${named}, which an existing resource (${displaySafe(verdict.holder)}) already holds. This stack's create-token ledger records that ${why} sent this name, but this type reports no creation time, so cdkd cannot tell that resource is the one it made rather than another deployment's created since. Since ${adoptsText}, creating it would take that resource over. ${displaySafe(logicalId)} was not created. The likely cause: the resource is this stack's own, from that deploy. If it is, ${importLine} and re-run; if it is not, this stack is also deployed under another state backend.`);
 			}
-			return refuse(`${subject} would be created with ${named}, which an existing resource (${displaySafe(verdict.holder)}) already holds, and nothing this stack records names that resource: not its state, its rollback journal or create-token ledger, nor what a destroy of it under this state prefix kept. Since ${adoptsText}, creating it would take that resource over, as CloudFormation refuses with "already exists". ${displaySafe(logicalId)} was not created. The likely cause: this stack is also deployed under another state backend (another --state-prefix, --state-bucket or account), where cdkd generates the same names. One stack name per account and region is supported (go-to-k/cdkd#4705): deploy it under one backend only, or give this stack another name. If the resource is this stack's own, ${importLine} and re-run.`);
+			return refuse(`${subject} would be created with ${named}, which an existing resource (${displaySafe(verdict.holder)}) already holds, and nothing this stack records names that resource: not its state, its rollback journal or create-token ledger, nor what a destroy of it under this state prefix kept. Since ${adoptsText}, creating it would take that resource over, as CloudFormation refuses with "already exists". ${displaySafe(logicalId)} was not created. The likely cause: this stack is also deployed under another state backend (another --state-prefix, --state-bucket or account), where cdkd generates the same names. One stack name per account and region is supported: deploy it under one backend only, or give this stack another name. If the resource is this stack's own, ${importLine} and re-run.`);
 		}
 	}
 }
@@ -36194,7 +36699,7 @@ var DynamoDBGlobalTableProvider = class {
 					const droppedOverrides = [];
 					if (oldReplicaOverrides.OnDemandThroughputOverride && !replicaOverrides.OnDemandThroughputOverride) droppedOverrides.push("ReadOnDemandThroughputSettings");
 					if (oldReplicaOverrides.ProvisionedThroughputOverride && !replicaOverrides.ProvisionedThroughputOverride) droppedOverrides.push("ReadProvisionedThroughputSettings");
-					if (droppedOverrides.length > 0) warn(`Cross-region replica ${region} of ${physicalId}: the template no longer declares ${droppedOverrides.map((o) => maskSecrets(o)).join(" / ")}, but DynamoDB offers no way to CLEAR a replica-level throughput override — a -1 sentinel is stored literally, and an empty override block wedges the table in UPDATING (both live-probed, issue #1436). The previous override is STILL IN EFFECT on AWS. Set an explicit value, or remove and re-add the replica, to change it.`);
+					if (droppedOverrides.length > 0) warn(`Cross-region replica ${region} of ${physicalId}: the template no longer declares ${droppedOverrides.map((o) => maskSecrets(o)).join(" / ")}, but DynamoDB offers no way to CLEAR a replica-level throughput override — a -1 sentinel is stored literally, and an empty override block wedges the table in UPDATING. The previous override is STILL IN EFFECT on AWS. Set an explicit value, or remove and re-add the replica, to change it.`);
 				}
 				if (replica["TableClassOverride"]) updateAction.TableClassOverride = replica["TableClassOverride"];
 				if (!(updateAction.KMSMasterKeyId !== void 0 || updateAction.GlobalSecondaryIndexes !== void 0 || updateAction.TableClassOverride !== void 0 || updateAction.ProvisionedThroughputOverride !== void 0 || updateAction.OnDemandThroughputOverride !== void 0)) {
@@ -36697,7 +37202,7 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		try {
 			if (hasTransitionalIndex(preDeleteIndexes)) {
-				this.logger.debug(`Waiting for indexes on ${physicalId} to settle before DeleteTable (issue #1521)`);
+				this.logger.debug(`Waiting for indexes on ${physicalId} to settle before DeleteTable`);
 				await this.waitForIndexesActive(physicalId, logicalId, {
 					proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE,
 					budget
@@ -38628,14 +39133,14 @@ const REMEDY = "To move a custom resource to a different handler, give it a new
 const UNJUDGEABLE_REMEDY = `Where the recorded ServiceToken is unreadable and the handler did not change, put the ARN of the handler that created this resource (the one it was last deployed with, not the one the template names now) back as ServiceToken in state.json (a ServiceToken fed by a NoEcho parameter is recorded only as '${"***"}': feed it from a plain value) and re-deploy.`;
 function renderServiceTokenRefusal(refusals, stackName, mask = (text) => text) {
 	const rows = refusals.map((refusal) => `  - ${rowText(refusal, mask)}`);
-	return `Refusing to deploy ${stackName}: ` + (refusals.length === 1 ? `a custom resource's ServiceToken changes` : `${refusals.length} custom resources' ServiceTokens change`) + `, which CloudFormation does not allow ("Modifying service token is not allowed") (issue #4749). Nothing was sent to either handler.
+	return `Refusing to deploy ${stackName}: ` + (refusals.length === 1 ? `a custom resource's ServiceToken changes` : `${refusals.length} custom resources' ServiceTokens change`) + `, which CloudFormation does not allow ("Modifying service token is not allowed"). Nothing was sent to either handler.
 ${rows.join("\n")}\n  ${REMEDY}` + (refusals.some((refusal) => refusal.kind === "unjudgeable") ? `\n  ${UNJUDGEABLE_REMEDY}` : "");
 }
 function serviceTokenBlockingReason(refusal, mask) {
-	return `${rowText(refusal, mask)} cdkd deploy refuses a changed custom-resource ServiceToken, as CloudFormation does (issue #4749); give the custom resource a new logical id to move it to another handler.`;
+	return `${rowText(refusal, mask)} cdkd deploy refuses a changed custom-resource ServiceToken, as CloudFormation does; give the custom resource a new logical id to move it to another handler.`;
 }
 function deferredServiceTokenWarning(row) {
-	return `${displayIdent(row.logicalId)}: its ServiceToken reads a resource this deploy replaces, creates or updates, or a value this preview cannot resolve. If it resolves to a different ARN than the one recorded, cdkd deploy refuses the update before invoking any handler and rolls back (issue #4749). A replaced backing function is already deleted by then and the rollback re-creates it; if that fails, the record names a function that no longer exists.`;
+	return `${displayIdent(row.logicalId)}: its ServiceToken reads a resource this deploy replaces, creates or updates, or a value this preview cannot resolve. If it resolves to a different ARN than the one recorded, cdkd deploy refuses the update before invoking any handler and rolls back. A replaced backing function is already deleted by then and the rollback re-creates it; if that fails, the record names a function that no longer exists.`;
 }
 
 //#endregion
@@ -39903,6 +40408,7 @@ Drop the record with: ${dropCommand}`);
 
 //#endregion
 //#region src/deployment/deploy-engine/provision.ts
+const NESTED_STACK_ROW_TYPE = "AWS::CloudFormation::Stack";
 async function provisionResource(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
 	const resourceType = change.resourceType;
 	const renderer = getLiveRenderer();
@@ -39938,7 +40444,13 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 	const physicalIdBeforeUpdate = stateResources[logicalId]?.physicalId;
 	const provisionedByBeforeUpdate = stateResources[logicalId]?.provisionedBy;
 	this.noteSecretNamedRecord(logicalId, stateResources[logicalId]);
+	const readsRegistry = this.secretNameBagFor(logicalId);
+	for (const needle of secretNamesStoredIn(stateResources[logicalId], printingCorpusOf(this.preDeploySecretNamedRecords ?? /* @__PURE__ */ new Map()).keys())) recordLogOnlyValue(readsRegistry, needle);
 	if (change.changeType === "DELETE") this.noteSecretNamedReads(logicalId, stateResources[logicalId], stateResources);
+	if (resourceType === NESTED_STACK_ROW_TYPE) {
+		const registry = this.secretNameBagFor(logicalId);
+		for (const needle of printingCorpusOf(this.preDeploySecretNamedRecords ?? /* @__PURE__ */ new Map()).keys()) recordLogOnlyValue(registry, needle);
+	}
 	const printingRegistry = this.secretNameBagFor(logicalId);
 	let nestedChildUnaddressed;
 	const deleteGuards = [];
@@ -40245,16 +40757,29 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			this.logger.info(`${cyan("Deploying")} ${cyan(createUpdateIds.length)} resource(s) (DAG: ${executionLevels.length} levels, max parallel: ${concurrency})`);
 			const createUpdateExecutor = new DagExecutor();
 			const provisionable = new Set(createUpdateIds);
+			const createUpdateDeps = /* @__PURE__ */ new Map();
 			for (const id of createUpdateIds) {
 				const allDeps = this.dagBuilder.getDirectDependencies(dag, id);
-				const deps = new Set(allDeps.filter((d) => provisionable.has(d)));
-				createUpdateExecutor.add({
-					id,
-					dependencies: deps,
-					state: "pending",
-					data: changes.get(id)
-				});
+				createUpdateDeps.set(id, new Set(allDeps.filter((d) => provisionable.has(d))));
 			}
+			const levelOf = /* @__PURE__ */ new Map();
+			executionLevels.forEach((level, at) => {
+				for (const id of level) levelOf.set(id, at);
+			});
+			for (const { before, after } of orderInlinePolicyWriters({
+				writes: createUpdateIds,
+				changes,
+				templateResources: template.Resources ?? {},
+				stateResources: currentState.resources,
+				dependencies: createUpdateDeps,
+				rank: (id) => levelOf.get(id) ?? Number.MAX_SAFE_INTEGER
+			})) this.logger.debug(safeMsg`${after} waits for ${before}: both write an inline policy name on the same IAM principal`);
+			for (const id of createUpdateIds) createUpdateExecutor.add({
+				id,
+				dependencies: createUpdateDeps.get(id),
+				state: "pending",
+				data: changes.get(id)
+			});
 			const enqueueLostChildren = (executor) => {
 				const lostIds = noChangeChildrenOfRecreatedParents({
 					changes,
@@ -42014,6 +42539,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		this.seedPersistedNoEchoAttributes(currentState.resources);
 		const orphanCountBeforeAdoption = (currentState.orphans ?? []).length;
 		const orphanPlan = await this.adoptRollbackOrphans(currentState, effectiveTemplate);
+		this.preDeploySecretNamedRecords = secretNamedRecordNeedles(currentState.resources, this.fingerprintNoEchoValues);
 		if (Object.keys(orphanPlan.adopted).length > 0) {
 			this.stampReasonlessParameterRefusals(currentState.resources, template);
 			if (backfillMaskedPropertyFingerprints(currentState.resources, template, backfillNoEchoValues) > 0) maskedFingerprintsBackfilled = true;
@@ -42048,7 +42574,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			sources: maskedInputSourcesForDiff,
 			rebaselined: /* @__PURE__ */ new Map()
 		};
-		const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry), this.providerRegistry.getAllowedUnsupportedProperties?.(), freshNoEchoParametersWithDeclared(this.inheritedNoEchoParameters, effectiveTemplate), this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues), recreateTargetIdsFor(this.options.recreateTargets, stackName), maskedInputs, this.options.refusalRecovery, this.noEchoDiffComparison(currentState.resources, effectiveTemplate, conditions, parameterValues, stackName));
+		const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry), this.providerRegistry.getAllowedUnsupportedProperties?.(), freshNoEchoParametersWithDeclared(this.inheritedNoEchoParameters, effectiveTemplate), this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues, currentState.resources), recreateTargetIdsFor(this.options.recreateTargets, stackName), maskedInputs, this.options.refusalRecovery, this.noEchoDiffComparison(currentState.resources, effectiveTemplate, conditions, parameterValues, stackName));
 		createOnlyPrefetch.cancel();
 		for (const [logicalId, fingerprints] of maskedInputs?.rebaselined ?? []) {
 			const record = currentState.resources[logicalId];
@@ -42067,7 +42593,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			recreateTargetIds: recreateTargetIdsFor(this.options.recreateTargets, stackName)
 		}).refused;
 		if (serviceTokenRefusals.length > 0) {
-			const mask = this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues);
+			const mask = this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues, currentState.resources);
 			throw markNonRetryable(new CdkdError(renderServiceTokenRefusal(serviceTokenRefusals, stackName, mask), SERVICE_TOKEN_CHANGE_REFUSED));
 		}
 		const recreatePromotion = promoteRecreateTargets(changes, this.options.recreateTargets, stackName);
@@ -42117,7 +42643,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 				const persistExportSet = new Set(exportNamesToPersist ?? []);
 				const exportSetChanged = exportNamesToPersist !== void 0 && (currentEffectiveExports.size !== persistExportSet.size || [...persistExportSet].some((k) => !currentEffectiveExports.has(k)));
 				if (merge?.kind === "kept" && !outputMapsEqual(persistedOutputs, resolvedOutputs)) this.logger.warn(`Outputs changed but one or more could not be resolved; keeping the previously persisted outputs. ${keptWholeReasonText(merge.reason)} A downstream Fn::ImportValue may fail until the next deploy.`);
-				else if (merge?.kind === "merged" && merge.carriedKeys.length > 0) this.logger.debug(`Kept the previously persisted value of ${merge.carriedKeys.length} output key(s), carried export aliases included, that could not be resolved (no-change path, #2771)`);
+				else if (merge?.kind === "merged" && merge.carriedKeys.length > 0) this.logger.debug(`Kept the previously persisted value of ${merge.carriedKeys.length} output key(s), carried export aliases included, that could not be resolved (no-change path)`);
 				const skippedOutputsChanged = !skippedOutputsEqual(currentState.skippedOutputs, this.skippedOutputs);
 				const healedAttributesPending = this.hasUnpersistedHeals(currentState.resources);
 				const conditionVerdictsChanged = !conditionVerdictRecordsEqual(readRecordedConditionVerdicts(currentState), conditionVerdicts);
@@ -42146,14 +42672,14 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 					if (outputsChanged || exportSetChanged) {
 						persistedOutputs = refreshedState.outputs;
 						if (outputsChanged) this.logger.info("Persisted Outputs-only change (no resource diff).");
-						else this.logger.debug("Persisted export-set change (no outputs-value diff, no-change path, #2193)");
+						else this.logger.debug("Persisted export-set change (no outputs-value diff, no-change path)");
 						if (this.exportIndexStore) await this.exportIndexStore.updateForStack(stackName, this.stackRegion, importableOutputs({
 							...refreshedState,
 							outputs: this.redactOutputs(refreshedState.outputs)
 						}));
 					} else if (observedRefresh) this.logger.debug("Persisted refreshed observedProperties (no-change path)");
-					else if (healedAttributesPending) this.logger.debug("Persisted attributes re-read from AWS for a stale record (no-change path, #1852)");
-					else this.logger.debug("Persisted skipped-outputs record (no outputs-value diff, no-change path, #2740)");
+					else if (healedAttributesPending) this.logger.debug("Persisted attributes re-read from AWS for a stale record (no-change path)");
+					else this.logger.debug("Persisted skipped-outputs record (no outputs-value diff, no-change path)");
 				} catch (saveError) {
 					this.logger.warn(`Failed to persist no-change state update: ${saveError instanceof Error ? saveError.message : String(saveError)} — drift baseline / outputs will be re-resolved on next deploy.`);
 				}
@@ -42545,6 +43071,7 @@ var DeployEngine = class {
 	perResourceTemplateProps = /* @__PURE__ */ new Map();
 	perResourceResolvedType = /* @__PURE__ */ new Map();
 	fingerprintNoEchoValues = void 0;
+	preDeploySecretNamedRecords = void 0;
 	fingerprintParameters = void 0;
 	fingerprintChildTemplates = void 0;
 	perResourceInputFingerprints = /* @__PURE__ */ new Map();
@@ -42611,6 +43138,7 @@ var DeployEngine = class {
 		this.constructPathTemplate = void 0;
 		this.perResourceResolvedType = /* @__PURE__ */ new Map();
 		this.fingerprintNoEchoValues = void 0;
+		this.preDeploySecretNamedRecords = void 0;
 		this.fingerprintParameters = void 0;
 		this.fingerprintChildTemplates = void 0;
 		this.perResourceInputFingerprints = /* @__PURE__ */ new Map();
@@ -42699,7 +43227,7 @@ var DeployEngine = class {
 		};
 	}
 	inlinePolicyClaimedFor(resourceType, logicalId, stateResources) {
-		if (resourceType !== "AWS::IAM::Policy") return void 0;
+		if (resourceType !== "AWS::IAM::Policy" && !isInlinePolicyPrincipalType(resourceType)) return;
 		const args = {
 			selfLogicalId: logicalId,
 			writers: this.inlinePolicyWriters,
@@ -42846,5 +43374,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { getPriorAttempts as $, configBooleanRefusal as $a, hasOwnKey as $c, previewableOrphanRecords as $i, acquireIdempotencyToken as $n, recoverMaskedOutput as $o, s3BucketArn as $r, validateAssetBucketName as $s, orphanDeleteNeedsIdentity as $t, noEchoExactEchoLeavesOf as A, unpreviewableOrphanRecords as Aa, resolveCaptureObservedState as Ac, hasReadableOutputs as Ai, maskEventTextWithBoundBags as An, carryLogOnlyValues as Ao, ec2InstanceProtectionSite as Ar, hasUnverifiableParameterRefusal as As, isHandledOrphan as At, beginDeleteWait as B, findReplacedReadersOfRecreateTargets as Ba, MIGRATE_TMP_PREFIX as Bc, malformedOrphanRecordsRefusalMessage as Bi, effectiveDeletionPolicy as Bn, errorCauseChain as Bo, producerRegionsFromState as Br, WorkGraph as Bs, withStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedState as Ca, Synthesizer as Cc, STATE_RESOURCES_MALFORMED as Ci, collectPublishedOutputNames as Cn, noEchoLeavesOf as Co, deleteIndeterminateGuards as Cr, isNotImplemented as Cs, revertedNestedRowIds as Ct, withResourceDeadline as D, repairMalformedResourceEntriesForReadOnly as Da, loadCdkJson as Dc, deployRefusesOrphanRowsReason as Di, DEFAULT_RESOURCE_WARN_AFTER_MS as Dn, readsNoEchoSource as Do, isWaitAbandonedError as Dr, exportNamesCarriedFrom as Ds, withNestedStackContext as Dt, serviceTokenBlockingReason as E, repairMalformedOutputsForReadOnly as Ea, getLegacyStateBucketName as Ec, accountArgs as Ei, DEFAULT_RESOURCE_TIMEOUT_MS as En, readbackPathFor as Eo, withIndeterminateGuard as Er, describeRegionValueKind as Es, getCurrentNestedStackContext as Et, isProtectionValueActive as F, findSilentDropProperties as Fa, stateBucketExistenceConfirmed as Fc, malformedExportNamesWarning as Fi, ATOMIC_FINAL_SNAPSHOT_TYPES as Fn, printingCorpusOf as Fo, DiffCalculator as Fr, orphansCarriedFrom as Fs, replayFailedOperations as Ft, DELETE_INDEX_WAIT_PROCEED_NOTE as G, renderStatefulReason as Ga, expectedOwnerParam as Gc, malformedOutputsRefusalMessage as Gi, constructPathOf as Gn, scrubResourceRecord as Go, explicitRoleArnOrThrow as Gr, AssetModeResolver as Gs, isReplacementOrphan as Gt, deleteBudgetKey as H, MULTI_REGION_RECREATE_BLOCKED_TYPES as Ha, uploadCfnTemplate as Hc, malformedOrphanRowsKeptWarning as Hi, refusesFinalSnapshot as Hn, maskSecretsInText as Ho, applyRoleArnIfSet as Hr, createAssetRedirectResolver as Hs, recordAfterRollbackUpdate as Ht, perType as I, unwrittenCreateOnlyReplacement as Ia, warnDeprecatedNoPrefixCliFlag as Ic, malformedExportSourceWarning as Ii, PRE_DELETE_SNAPSHOT_TYPES as In, recordLogOnlyParameterValue as Io, INTRINSIC_KEYS as Ir, shouldRetainResource as Is, replayRollback as It, waitForIndexesSettled as J, isWarmThroughputDecrease as Ja, derivePartitionAndUrlSuffix as Jc, malformedResourceEntriesWarning as Ji, RollbackInlinePolicyWriters as Jn, isUncertifiedBaselineMaskPosition as Jo, AWS_CREDENTIAL_ENV_KEYS as Jr, ensureAssetStorage as Js, recheckFailedPlan as Jt, INDEX_SETTLE_POLL_INTERVAL_MS as K, WARM_THROUGHPUT_MEMBERS as Ka, PARTITION_TABLE as Kc, malformedOutputsWarning as Ki, findDestructiveChanges as Kn, DYNAMIC_REFERENCE_TOKEN_SCAN as Ko, isIamRoleArn as Kr, BOOTSTRAP_MARKER_PREFIX as Ks, planFailedOps as Kt, readProtection as L, withoutSilentDropProperties as La, ssmResolvedValueType as Lc, malformedLocalOutputsWarning as Li, buildFinalSnapshotIdentifier as Ln, recordLogOnlyValue as Lo, IntrinsicFunctionResolver as Lr, AssetPublisher as Ls, awaitInFlightSibling as Lt, recordedProtectionEvidence as M, unreadableResourceEntries as Ma, resolveStateBucketWithDefault as Mc, isReadableOrphanRecord as Mi, secretNamePrintingBag as Mn, hasMaskableValues as Mo, observeThenDisableInstanceApiTermination as Mr, importableOutputs as Ms, loadJournaledOrphans as Mt, recordedProtectionNote as N, withheldAccountClause as Na, resolveStateBucketWithDefaultAndSource as Nc, isReadableResourceEntry as Ni, stateSecretNameNeedles as Nn, literalSplitDelimitersOf as No, reDisableInstanceApiTermination as Nr, isReadableBag as Ns, makeForeignHolderScan as Nt, noEchoAttributeNamesOf as O, repairMalformedResourcePropertiesForReadOnly as Oa, resolveApp as Oc, displayLogicalId as Oi, completedReplayEntries as On, valueAtCoordinate as Oo, markWaitAbandoned as Or, hasReadableExportSet as Os, deleteJournaledOrphans as Ot, PROTECTION_PROPERTY_BY_TYPE as P, findActionableSilentDrops as Pa, resolveUseCdkBootstrapAssets as Pc, malformedDriftResourcePropertiesWarning as Pi, extractDeploymentEventError as Pn, logOnlyValueCount as Po, reEnableInstanceApiTermination as Pr, orphansAfterRollback as Ps, sameJournaledOrphans as Pt, isTruthyCfnBoolean as Q, coerceCfnInteger as Qa, defineOwnKey as Qc, malformedStateRefusalMessage as Qi, withCreateTokenLedger as Qn, recordNestedStackParameterExpressions as Qo, isSettledInstanceState as Qr, readBootstrapMarkerBody as Qs, seedsDeleteFirstGuard as Qt, DynamoDBGlobalTableProvider as R, NO_CC_HANDLERS_REASON as Ra, CFN_TEMPLATE_BODY_LIMIT as Rc, malformedLocalResourceEntriesWarning as Ri, ccRoutedFinalSnapshotError as Rn, shareLogOnlyValues as Ro, poisonRenderedSpellingsCollidingIn as Rr, isSensitiveAttributeName as Rs, destroyStackRecordsView as Rt, keptForReadoption as S, refuseMalformedResourcesForExport as Sa, getDockerImageBySourceHash as Sc, STATE_REGION_DIVERGED as Si, collectDeclaredOutputNames as Sn, noEchoCoordinatesOf as So, UNSPECIFIED_SKIP_REASON as Sr, isAccessDenied as Ss, revertNestedChildFromJournal as St, findServiceTokenRefusals as T, repairMalformedOrphansForReadOnly as Ta, getDefaultStateBucketName as Tc, UNREADABLE_RESOURCES_MAP_ROW as Ti, bindingSkippedOutputs as Tn, passedNoEchoParametersOf as To, deleteSkipReason as Tr, acceptedCreateOnlyDropsOf as Ts, collectNestedChildUnaddressed as Tt, resolveDynamoDbDeleteBudgetClock as U, isStatefulRecreateTargetForReplace as Ua, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Uc, malformedOrphansRefusalMessage as Ui, unsupportedFinalSnapshotError as Un, markSameGenerationBag as Uo, assertFlagRoleArn as Ur, loadPublishableAssetManifest as Us, demoteSupersededOrphans as Ut, compensateRemovedDeletionProtection as V, shownType as Va, findLargeInlineResources as Vc, malformedOrphanRecordsWarning as Vi, isFinalSnapshotError as Vn, maskSecretsInError as Vo, regionLessSecretName as Vr, buildAssetRedirectMap as Vs, removeProtectionTypeList as Vt, resolveDynamoDbDeleteBudgetMs as W, isStatefulRecreateTargetSync as Wa, decodeListingKey as Wc, malformedOrphansWarning as Wi, maskingRetryLogger as Wn, redactSecretsForState as Wo, assertSendableRoleArn as Wr, rewriteTemplateAssetReferences as Ws, isJournaledOrphan as Wt, S3_AUTO_DELETE_OBJECTS_TAG as X, toFiniteNumber as Xa, StageLoadError as Xc, malformedResourcesWarning as Xi, ledgerForStack as Xn, identityKeyFor as Xo, callerEnvCredentials as Xr, isCrossRegionRedirect as Xs, replacementNeverSwapped as Xt, ECR_AUTO_DELETE_IMAGES_TAG as Y, toCfnInteger as Ya, AssemblyReader as Yc, malformedResourcePropertiesWarning as Yi, earliestDefined as Yn, pathCrossesDottedKey as Yo, applyCallerIdentityCredentials as Yr, getBootstrapMarkerKey as Ys, recordUnderIdIsNotOwn as Yt, hasCdkAutoDeleteTag as Z, coerceCfnBoolean as Za, processStackMessages as Zc, malformedScrubResourceEntriesRefusalMessage as Zi, reserveStackCreateToken as Zn, inheritNestedStackParameterAssociations as Zo, envCredentialsAreAssumedRole as Zr, parseBootstrapMarker as Zs, resolveReplacementOldType as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedResourcePropertiesForDrift as _a, runDockerStreaming as _c, parseWebACLArn as _i, carriedExportAliasExposure as _n, isMarkedCoordinate as _o, getCurrentResourceSecrets as _r, rebuildClientForBucketRegion as _s, displacedPhysicalIdShown as _t, findNestedTemplateTreeDefect as a, refuseMalformedOrphansForDestroy as aa, describeDockerExecFailure as ac, isUnboundTemplateParameter as ai, displayAssemblyPath as al, redactedDeleteAddressFields as an, requireConfigObject as ao, tagMapAsList as ar, recordNoEchoParameterFreshValue as as, gray as at, lookupEachName as b, refuseMalformedResourcesForDeploy as ba, stripControlChars as bc, passedParameterClassesOf as bi, isWholeDynamicReferenceValue as bn, maskWholeValue as bo, slowCcOperationTimeoutMs as br, applyCrossPrefixScan as bs, nestedChildStackName as bt, renderNestedTemplateTreeDefect as c, refuseMalformedOutputsForDestroy as ca, finchSecretArgvRefusal as cc, isImpossibleEmptyStoredAttribute as ci, clearBucketRegionCache as cl, updatePartialReason as cn, templateResourceTypes as co, stringifyIfAssigned as cr, STATE_SOURCED_BASELINE_RULES as cs, yellow as ct, conditionInputsFrom as d, refuseMalformedResourceEntriesForDeploy as da, isDockerClientEnvKey as dc, isNamelessDynamicReferenceError as di, WITHHELD_NAME_DISPLAY as dn, canonicalLambdaFunctionName as do, ccBrokenReason as dr, TEMPLATE_SOURCED_RULES as ds, reachableDivergentParameters as dt, refuseDivergentRecordRegionForDestroy as ea, validateContainerRepoName as ec, s3BucketDomainName as ei, hasPlainPrototype$1 as el, findNestedStackTypeChanges as en, configIntegerRefusal as eo, DBPROXY_TAGS_WHAT as er, carriesSecretMask as es, markRefusedBeforeApplying as et, parentSuppliedValues as f, refuseMalformedResourceEntriesForDestroy as fa, isMalformedEnvKey as fc, keepsSecretReferenceToken as fi, displayTextOrWithheld as fn, lambdaFunctionNameForMask as fo, isCustomResource as fr, WHOLE_DYNAMIC_REFERENCE_PATTERN as fs, resourcesNamingDeclaredParameter as ft, mergeNoChangeOutputs as g, refuseMalformedResourcePropertiesForDestroy as ga, runDockerForeground as gc, refStateLookupFromResource as gi, secretSafeKeyDisplay as gn, canonicalCoordinates as go, isCustomResourceType as gr, S3StateBackend as gs, displacedOpClause as gt, keptWholeReasonText as h, refuseMalformedResourceEntriesForOrphan as ha, redactedDockerCause as hc, isStalePlaceholderArnAttribute as hi, secretBearingStateKeyWarning as hn, TemplateParser as ho, readsNoEchoDeleteValues as hr, isLockInfoExpired as hs, NESTED_PENDING_PARENT_REASON as ht, childTemplateLoader as i, refuseMalformedOrphans as ia, describeDockerCapturedOutput as ic, coerceParameterTypedValue as ii, describeFileReadFailure as il, isRedactedRecordedValue as in, requireConfigArray as io, refuseMalformedDesiredTags as ir, recordNoEchoAttributeValues as is, cyan as it, noEchoParameterNamesOf as j, unreadableOrphanRecords as ja, resolveSkipPrefix as jc, hasReadableResources as ji, orphanRecordsPrintingBag as jn, createUnionSecretMasker as jo, isTerminationProtectionPropagationError as jr, importableOutputKeys as js, journaledOrphanLines as jt, noEchoComparisonForTemplate as k, repairMalformedResourcesForReadOnly as ka, resolveAutoAssetStorage as kc, hasReadableOrphans as ki, journaledOrphanPrintingBag as kn, liveMatchesUnresolvedTokenFrame as ko, disableInstanceApiTermination as kr, hasReasonlessBaselineRefusal as ks, dropFailedHint as kt, templateIdentity as l, refuseMalformedResourceAttributesForOrphan as la, formatDockerLoginError as lc, carriesDynamicReference as li, resolveBucketRegion as ll, DeploymentEventsReader as ln, describeTypeWithThrottleRetry as lo, CC_BROKEN_REASON as lr, STATE_SOURCED_CROSS_GENERATION_RULES as ls, computeParameterTaint as lt, isSecretBearingReferenceString as m, refuseMalformedResourceEntriesForImportSave as ma, redactDockerArgvValues as mc, cfnRefValueFromPhysicalId as mi, secretBearing as mn, DagBuilder as mo, TemplateNoEchoReresolver as mr, LockManager as ms, planOrphanAdoption as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedOrphanRecords as na, buildDockerImage as nc, s3BucketRegionalDomainName as ni, ownValue as nl, inheritProducerRegions as nn, readConfigString as no, planTagDiff as nr, recordMaskOnlyValue as ns, createReadOnlyAttributeHealerFactory as nt, isAbsoluteAssetPath as o, refuseMalformedOrphansForOrphan as oa, describeDockerFailure as oc, parameterTypeMayLoseSecretIdentity as oi, renderAssemblyPathEscape as ol, redactedDeleteAddressSkip as on, requireConfigString as oo, tagPlanWarning as or, recordProvenPublicExpression as os, green as ot, readRecordedConditionVerdicts as p, refuseMalformedResourceEntriesForImport as pa, partitionSensitiveEnv as pc, AWS_NO_VALUE as pi, exportAliasCollisionScrubWarning as pn, sameLambdaFunctionAddress as po, wouldReturnToSdkProvider as pr, isSingleDynamicReferenceToken as ps, makeSiblingClaimReader as pt, deleteTableWithIndexBusyRetry as q, coerceWarmThroughput as qa, canonicalizeRegion as qc, malformedRenderedContainersWarning as qi, formatDestructiveChange as qn, dynamicReferenceTokens as qo, sendableAssumeRoleCommand as qr, assertAssetBucketRegion as qs, planRollback as qt, computeImplicitDeleteEdges as r, refuseMalformedOrphanRecordsForDestroy as ra, resolveDockerContextDirectory as rc, s3BucketWebsiteUrl as ri, absoluteAssemblyPathEscape as rl, REDACTED_DELETE_ADDRESS_SKIP_REASON as rn, replayWarn as ro, readTagList as rr, recordMaskOnlyValuesIn as rs, bold as rt, listNestedTemplateRows as s, refuseMalformedOutputs as sa, dockerSpawnEnvWithSensitive as sc, getAccountInfo as si, resolveAssemblyPath as sl, updatePartialMessage as sn, prefetchCreateOnlyPropertyPaths as so, definedAttributes as sr, wholeStringLeavesOf as ss, red as st, DeployEngine as t, refuseMalformedNestedChildOutputs as ta, buildDenyExternalAccessPolicy as tc, s3BucketDualStackDomainName as ti, nullPrototypeRecord as tl, getCurrentProducerRegions as tn, configStringRefusal as to, DBPROXY_TAG_OPTIONS as tr, provenPublicValue as ts, formatResourceLine as tt, conditionFingerprint as u, refuseMalformedResourceEntries as ua, getDockerCmd as uc, carriesFetchableDynamicReference as ui, DeploymentEventsStore as un, withRetry as uo, ProviderRegistry as ur, STATE_SOURCED_READBACK_RULES as us, namesAnyDeclaredParameter as ut, chunks as v, refuseMalformedResourcePropertiesForExport as va, warnFinchArgvExposure as vc, withSharedDrainBudget as vi, exportNameNoEchoParameters as vn, maskAtCoordinates as vo, withPrintingSecrets as vr, CrossPrefixReadError as vs, dropSettledNestedJournals as vt, deferredServiceTokenWarning as w, repairMalformedOrphanRecordsForReadOnly as wa, synthesisStatusMessage as wc, UNREADABLE_ORPHANS_CONTAINER_ROW as wi, isExportAliasCollision as wn, noEchoOutputsComparison as wo, deleteLeftInPlace as wr, splitImportedOps as ws, withNestedRevertRun as wt, withApiLimit as x, refuseMalformedResourcesForDestroy as xa, AssetManifestLoader as xc, JSON_LISTING_HOLE_VALUE as xi, noEchoParameterValueSeed as xn, maskedLeafCoordinatesOf as xo, unchangedBehindSecretReference as xr, crossPrefixDeniedWarning as xs, recordDisplacedSkips as xt, isAccessDeniedError as y, refuseMalformedResourcePropertiesForOrphan as ya, escapeRegExp$3 as yc, parameterInputsFor as yi, exportNameSecretExposure as yn, maskReadbackAtCoordinates as yo, CloudControlProvider as yr, CrossPrefixScanCache as ys, getNestedRevertRun as yt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as z, hasNoCloudControlHandlers as za, CFN_TEMPLATE_URL_LIMIT as zc, malformedLocalResourcesWarning as zi, createPreDeleteFinalSnapshot as zn, createSecretMasker as zo, classifyReplaySecretRegion as zr, stringifyValue as zs, getStackRecords as zt };
-//# sourceMappingURL=deploy-engine-BuPc2Dfc.js.map
+export { getPriorAttempts as $, isWarmThroughputDecrease as $a, derivePartitionAndUrlSuffix as $c, malformedResourceEntriesWarning as $i, reserveStackCreateToken as $n, isUncertifiedBaselineMaskPosition as $o, AWS_CREDENTIAL_ENV_KEYS as $r, ensureAssetStorage as $s, orphanDeleteNeedsIdentity as $t, noEchoExactEchoLeavesOf as A, repairMalformedOrphansForReadOnly as Aa, getDefaultStateBucketName as Ac, UNREADABLE_RESOURCES_MAP_ROW as Ai, maskEventTextWithBoundBags as An, passedNoEchoParametersOf as Ao, deleteSkipReason as Ar, acceptedCreateOnlyDropsOf as As, isHandledOrphan as At, beginDeleteWait as B, findSilentDropProperties as Ba, stateBucketExistenceConfirmed as Bc, malformedExportNamesWarning as Bi, ccRoutedFinalSnapshotError as Bn, printingCorpusOf as Bo, DiffCalculator as Br, orphansCarriedFrom as Bs, withStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedResourcePropertiesForExport as Ca, warnFinchArgvExposure as Cc, withSharedDrainBudget as Ci, collectPublishedOutputNames as Cn, maskAtCoordinates as Co, customResourceResponseExpirationWarning as Cr, CrossPrefixReadError as Cs, revertedNestedRowIds as Ct, withResourceDeadline as D, refuseMalformedResourcesForExport as Da, getDockerImageBySourceHash as Dc, STATE_REGION_DIVERGED as Di, DEFAULT_RESOURCE_WARN_AFTER_MS as Dn, noEchoCoordinatesOf as Do, UNSPECIFIED_SKIP_REASON as Dr, isAccessDenied$1 as Ds, withNestedStackContext as Dt, serviceTokenBlockingReason as E, refuseMalformedResourcesForDestroy as Ea, AssetManifestLoader as Ec, JSON_LISTING_HOLE_VALUE as Ei, DEFAULT_RESOURCE_TIMEOUT_MS as En, maskedLeafCoordinatesOf as Eo, unchangedBehindSecretReference as Er, crossPrefixDeniedWarning as Es, getCurrentNestedStackContext as Et, isProtectionValueActive as F, unpreviewableOrphanRecords as Fa, resolveCaptureObservedState as Fc, hasReadableOutputs as Fi, storedSecretNameNeedles as Fn, carryLogOnlyValues as Fo, ec2InstanceProtectionSite as Fr, hasUnverifiableParameterRefusal as Fs, replayFailedOperations as Ft, DELETE_INDEX_WAIT_PROCEED_NOTE as G, findReplacedReadersOfRecreateTargets as Ga, MIGRATE_TMP_PREFIX as Gc, malformedOrphanRecordsRefusalMessage as Gi, unsupportedFinalSnapshotError as Gn, errorCauseChain as Go, producerRegionsFromState as Gr, WorkGraph as Gs, isReplacementOrphan as Gt, deleteBudgetKey as H, withoutSilentDropProperties as Ha, ssmResolvedValueType as Hc, malformedLocalOutputsWarning as Hi, effectiveDeletionPolicy as Hn, recordLogOnlyValue as Ho, IntrinsicFunctionResolver as Hr, AssetPublisher as Hs, recordAfterRollbackUpdate as Ht, perType as I, unreadableOrphanRecords as Ia, resolveSkipPrefix as Ic, hasReadableResources as Ii, extractDeploymentEventError as In, createUnionSecretMasker as Io, isTerminationProtectionPropagationError as Ir, importableOutputKeys as Is, replayRollback as It, waitForIndexesSettled as J, isStatefulRecreateTargetForReplace as Ja, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Jc, malformedOrphansRefusalMessage as Ji, findDestructiveChanges as Jn, markSameGenerationBag as Jo, assertFlagRoleArn as Jr, loadPublishableAssetManifest as Js, recheckFailedPlan as Jt, INDEX_SETTLE_POLL_INTERVAL_MS as K, shownType as Ka, findLargeInlineResources as Kc, malformedOrphanRecordsWarning as Ki, maskingRetryLogger as Kn, maskSecretsInError as Ko, regionLessSecretName as Kr, buildAssetRedirectMap as Ks, planFailedOps as Kt, readProtection as L, unreadableResourceEntries as La, resolveStateBucketWithDefault as Lc, isReadableOrphanRecord as Li, ATOMIC_FINAL_SNAPSHOT_TYPES as Ln, hasMaskableValues as Lo, observeThenDisableInstanceApiTermination as Lr, importableOutputs as Ls, awaitInFlightSibling as Lt, recordedProtectionEvidence as M, repairMalformedResourceEntriesForReadOnly as Ma, loadCdkJson as Mc, deployRefusesOrphanRowsReason as Mi, secretNamePrintingBag as Mn, readsNoEchoSource as Mo, isWaitAbandonedError as Mr, exportNamesCarriedFrom as Ms, loadJournaledOrphans as Mt, recordedProtectionNote as N, repairMalformedResourcePropertiesForReadOnly as Na, resolveApp as Nc, displayLogicalId as Ni, secretNamedRecordNeedles as Nn, valueAtCoordinate as No, markWaitAbandoned as Nr, hasReadableExportSet as Ns, makeForeignHolderScan as Nt, noEchoAttributeNamesOf as O, refuseMalformedState as Oa, Synthesizer as Oc, STATE_RESOURCES_MALFORMED as Oi, completedReplayEntries as On, noEchoLeavesOf as Oo, deleteIndeterminateGuards as Or, isNotImplemented as Os, deleteJournaledOrphans as Ot, PROTECTION_PROPERTY_BY_TYPE as P, repairMalformedResourcesForReadOnly as Pa, resolveAutoAssetStorage as Pc, hasReadableOrphans as Pi, stateSecretNameNeedles as Pn, liveMatchesUnresolvedTokenFrame as Po, disableInstanceApiTermination as Pr, hasReasonlessBaselineRefusal as Ps, sameJournaledOrphans as Pt, isTruthyCfnBoolean as Q, coerceWarmThroughput as Qa, canonicalizeRegion as Qc, malformedRenderedContainersWarning as Qi, ledgerForStack as Qn, dynamicReferenceTokens as Qo, sendableAssumeRoleCommand as Qr, assertAssetBucketRegion as Qs, seedsDeleteFirstGuard as Qt, DynamoDBGlobalTableProvider as R, withheldAccountClause as Ra, resolveStateBucketWithDefaultAndSource as Rc, isReadableResourceEntry as Ri, PRE_DELETE_SNAPSHOT_TYPES as Rn, literalSplitDelimitersOf as Ro, reDisableInstanceApiTermination as Rr, isReadableBag as Rs, destroyStackRecordsView as Rt, keptForReadoption as S, refuseMalformedResourcePropertiesForDrift as Sa, runDockerStreaming as Sc, parseWebACLArn as Si, collectDeclaredOutputNames as Sn, isMarkedCoordinate as So, applyCustomResourceResponseExpiration as Sr, rebuildClientForBucketRegion as Ss, revertNestedChildFromJournal as St, findServiceTokenRefusals as T, refuseMalformedResourcesForDeploy as Ta, stripControlChars as Tc, passedParameterClassesOf as Ti, bindingSkippedOutputs as Tn, maskWholeValue as To, slowCcOperationTimeoutMs as Tr, applyCrossPrefixScan as Ts, collectNestedChildUnaddressed as Tt, resolveDynamoDbDeleteBudgetClock as U, NO_CC_HANDLERS_REASON as Ua, CFN_TEMPLATE_BODY_LIMIT as Uc, malformedLocalResourceEntriesWarning as Ui, isFinalSnapshotError as Un, shareLogOnlyValues as Uo, poisonRenderedSpellingsCollidingIn as Ur, isSensitiveAttributeName as Us, demoteSupersededOrphans as Ut, compensateRemovedDeletionProtection as V, unwrittenCreateOnlyReplacement as Va, warnDeprecatedNoPrefixCliFlag as Vc, malformedExportSourceWarning as Vi, createPreDeleteFinalSnapshot as Vn, recordLogOnlyParameterValue as Vo, INTRINSIC_KEYS as Vr, shouldRetainResource as Vs, removeProtectionTypeList as Vt, resolveDynamoDbDeleteBudgetMs as W, hasNoCloudControlHandlers as Wa, CFN_TEMPLATE_URL_LIMIT as Wc, malformedLocalResourcesWarning as Wi, refusesFinalSnapshot as Wn, createSecretMasker as Wo, classifyReplaySecretRegion as Wr, stringifyValue as Ws, isJournaledOrphan as Wt, S3_AUTO_DELETE_OBJECTS_TAG as X, renderStatefulReason as Xa, expectedOwnerParam as Xc, malformedOutputsRefusalMessage as Xi, RollbackInlinePolicyWriters as Xn, scrubResourceRecord as Xo, explicitRoleArnOrThrow as Xr, AssetModeResolver as Xs, replacementNeverSwapped as Xt, ECR_AUTO_DELETE_IMAGES_TAG as Y, isStatefulRecreateTargetSync as Ya, decodeListingKey as Yc, malformedOrphansWarning as Yi, formatDestructiveChange as Yn, redactSecretsForState as Yo, assertSendableRoleArn as Yr, rewriteTemplateAssetReferences as Ys, recordUnderIdIsNotOwn as Yt, hasCdkAutoDeleteTag as Z, WARM_THROUGHPUT_MEMBERS as Za, PARTITION_TABLE as Zc, malformedOutputsWarning as Zi, earliestDefined as Zn, DYNAMIC_REFERENCE_TOKEN_SCAN as Zo, isIamRoleArn as Zr, BOOTSTRAP_MARKER_PREFIX as Zs, resolveReplacementOldType as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedResourceEntriesForDestroy as _a, isMalformedEnvKey as _c, keepsSecretReferenceToken as _i, carriedExportAliasExposure as _n, lambdaFunctionNameForMask as _o, readsNoEchoDeleteValues as _r, WHOLE_DYNAMIC_REFERENCE_PATTERN as _s, displacedPhysicalIdShown as _t, findNestedTemplateTreeDefect as a, refuseDivergentRecordRegionForDestroy as aa, validateContainerRepoName as ac, s3BucketDomainName as ai, hasPlainPrototype$1 as al, redactedDeleteAddressFields as an, configIntegerRefusal as ao, readTagList as ar, carriesSecretMask as as, gray as at, lookupEachName as b, refuseMalformedResourceEntriesForOrphan as ba, redactedDockerCause as bc, isStalePlaceholderArnAttribute as bi, isWholeDynamicReferenceValue as bn, TemplateParser as bo, withPrintingSecrets as br, isLockInfoExpired as bs, nestedChildStackName as bt, renderNestedTemplateTreeDefect as c, refuseMalformedOrphanRecordsForDestroy as ca, resolveDockerContextDirectory as cc, s3BucketWebsiteUrl as ci, absoluteAssemblyPathEscape as cl, updatePartialReason as cn, replayWarn as co, tagPlanWarning as cr, recordMaskOnlyValuesIn as cs, yellow as ct, conditionInputsFrom as d, refuseMalformedOrphansForOrphan as da, describeDockerFailure as dc, parameterTypeMayLoseSecretIdentity as di, renderAssemblyPathEscape as dl, WITHHELD_NAME_DISPLAY as dn, requireConfigString as do, CC_BROKEN_REASON as dr, recordProvenPublicExpression as ds, reachableDivergentParameters as dt, malformedResourcePropertiesWarning as ea, getBootstrapMarkerKey as ec, applyCallerIdentityCredentials as ei, AssemblyReader as el, findNestedStackTypeChanges as en, toCfnInteger as eo, withCreateTokenLedger as er, pathCrossesDottedKey as es, markRefusedBeforeApplying as et, parentSuppliedValues as f, refuseMalformedOutputs as fa, dockerSpawnEnvWithSensitive as fc, getAccountInfo as fi, resolveAssemblyPath as fl, displayTextOrWithheld as fn, prefetchCreateOnlyPropertyPaths as fo, ProviderRegistry as fr, wholeStringLeavesOf as fs, resourcesNamingDeclaredParameter as ft, mergeNoChangeOutputs as g, refuseMalformedResourceEntriesForDeploy as ga, isDockerClientEnvKey as gc, isNamelessDynamicReferenceError as gi, secretSafeKeyDisplay as gn, canonicalLambdaFunctionName as go, TemplateNoEchoReresolver as gr, TEMPLATE_SOURCED_RULES as gs, displacedOpClause as gt, keptWholeReasonText as h, refuseMalformedResourceEntries as ha, getDockerCmd as hc, carriesFetchableDynamicReference as hi, secretBearingStateKeyWarning as hn, withRetry as ho, wouldReturnToSdkProvider as hr, STATE_SOURCED_READBACK_RULES as hs, NESTED_PENDING_PARENT_REASON as ht, childTemplateLoader as i, previewableOrphanRecords as ia, validateAssetBucketName as ic, s3BucketArn as ii, hasOwnKey as il, isRedactedRecordedValue as in, configBooleanRefusal as io, planTagDiff as ir, recoverMaskedOutput as is, cyan as it, noEchoParameterNamesOf as j, repairMalformedOutputsForReadOnly as ja, getLegacyStateBucketName as jc, accountArgs as ji, orphanRecordsPrintingBag as jn, readbackPathFor as jo, withIndeterminateGuard as jr, describeRegionValueKind as js, journaledOrphanLines as jt, noEchoComparisonForTemplate as k, repairMalformedOrphanRecordsForReadOnly as ka, synthesisStatusMessage as kc, UNREADABLE_ORPHANS_CONTAINER_ROW as ki, journaledOrphanPrintingBag as kn, noEchoOutputsComparison as ko, deleteLeftInPlace as kr, splitImportedOps as ks, dropFailedHint as kt, templateIdentity as l, refuseMalformedOrphans as la, describeDockerCapturedOutput as lc, coerceParameterTypedValue as li, describeFileReadFailure as ll, DeploymentEventsReader as ln, requireConfigArray as lo, definedAttributes as lr, recordNoEchoAttributeValues as ls, computeParameterTaint as lt, isSecretBearingReferenceString as m, refuseMalformedResourceAttributesForOrphan as ma, formatDockerLoginError as mc, carriesDynamicReference as mi, resolveBucketRegion as ml, secretBearing as mn, describeTypeWithThrottleRetry as mo, isCustomResource as mr, STATE_SOURCED_CROSS_GENERATION_RULES as ms, planOrphanAdoption as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedScrubResourceEntriesRefusalMessage as na, parseBootstrapMarker as nc, envCredentialsAreAssumedRole as ni, processStackMessages as nl, inheritProducerRegions as nn, coerceCfnBoolean as no, DBPROXY_TAGS_WHAT as nr, inheritNestedStackParameterAssociations as ns, createReadOnlyAttributeHealerFactory as nt, isAbsoluteAssetPath as o, refuseMalformedNestedChildOutputs as oa, buildDenyExternalAccessPolicy as oc, s3BucketDualStackDomainName as oi, nullPrototypeRecord as ol, redactedDeleteAddressSkip as on, configStringRefusal as oo, refuseMalformedDesiredTags as or, provenPublicValue as os, green as ot, readRecordedConditionVerdicts as p, refuseMalformedOutputsForDestroy as pa, finchSecretArgvRefusal as pc, isImpossibleEmptyStoredAttribute as pi, clearBucketRegionCache as pl, exportAliasCollisionScrubWarning as pn, templateResourceTypes as po, ccBrokenReason as pr, STATE_SOURCED_BASELINE_RULES as ps, makeSiblingClaimReader as pt, deleteTableWithIndexBusyRetry as q, MULTI_REGION_RECREATE_BLOCKED_TYPES as qa, uploadCfnTemplate as qc, malformedOrphanRowsKeptWarning as qi, constructPathOf as qn, maskSecretsInText as qo, applyRoleArnIfSet as qr, createAssetRedirectResolver as qs, planRollback as qt, computeImplicitDeleteEdges as r, malformedStateRefusalMessage as ra, readBootstrapMarkerBody as rc, isSettledInstanceState as ri, defineOwnKey as rl, REDACTED_DELETE_ADDRESS_SKIP_REASON as rn, coerceCfnInteger as ro, DBPROXY_TAG_OPTIONS as rr, recordNestedStackParameterExpressions as rs, bold as rt, listNestedTemplateRows as s, refuseMalformedOrphanRecords as sa, buildDockerImage as sc, s3BucketRegionalDomainName as si, ownValue as sl, updatePartialMessage as sn, readConfigString as so, tagMapAsList as sr, recordMaskOnlyValue as ss, red as st, DeployEngine as t, malformedResourcesWarning as ta, isCrossRegionRedirect as tc, callerEnvCredentials as ti, StageLoadError as tl, getCurrentProducerRegions as tn, toFiniteNumber as to, acquireIdempotencyToken as tr, identityKeyFor as ts, formatResourceLine as tt, conditionFingerprint as u, refuseMalformedOrphansForDestroy as ua, describeDockerExecFailure as uc, isUnboundTemplateParameter as ui, displayAssemblyPath as ul, DeploymentEventsStore as un, requireConfigObject as uo, stringifyIfAssigned as ur, recordNoEchoParameterFreshValue as us, namesAnyDeclaredParameter as ut, chunks as v, refuseMalformedResourceEntriesForImport as va, partitionSensitiveEnv as vc, AWS_NO_VALUE as vi, exportNameNoEchoParameters as vn, sameLambdaFunctionAddress as vo, isCustomResourceType as vr, isSingleDynamicReferenceToken as vs, dropSettledNestedJournals as vt, deferredServiceTokenWarning as w, refuseMalformedResourcePropertiesForOrphan as wa, escapeRegExp$3 as wc, parameterInputsFor as wi, isExportAliasCollision as wn, maskReadbackAtCoordinates as wo, CloudControlProvider as wr, CrossPrefixScanCache as ws, withNestedRevertRun as wt, withApiLimit as x, refuseMalformedResourcePropertiesForDestroy as xa, runDockerForeground as xc, refStateLookupFromResource as xi, noEchoParameterValueSeed as xn, canonicalCoordinates as xo, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as xr, S3StateBackend as xs, recordDisplacedSkips as xt, isAccessDeniedError as y, refuseMalformedResourceEntriesForImportSave as ya, redactDockerArgvValues as yc, cfnRefValueFromPhysicalId as yi, exportNameSecretExposure as yn, DagBuilder as yo, getCurrentResourceSecrets as yr, LockManager as ys, getNestedRevertRun as yt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as z, findActionableSilentDrops as za, resolveUseCdkBootstrapAssets as zc, malformedDriftResourcePropertiesWarning as zi, buildFinalSnapshotIdentifier as zn, logOnlyValueCount as zo, reEnableInstanceApiTermination as zr, orphansAfterRollback as zs, getStackRecords as zt };
+//# sourceMappingURL=deploy-engine-dvf1UDuo.js.map