@go-to-k/cdkd 0.296.31 → 0.297.0

package/dist/{deploy-engine-5FFXg6ih.js → deploy-engine-dvf1UDuo.js}

@@ -2,10 +2,10 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js"
 import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
 import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-Cz2tPxXk.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-D0cK9V1A.js";
+import { t as getCdkdVersion } from "./version-DE-djeB0.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
+import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { CloudControlClient, CreateResourceCommand, DeleteResourceCommand, GetResourceCommand, GetResourceRequestStatusCommand, ListResourcesCommand, UpdateResourceCommand } from "@aws-sdk/client-cloudcontrol";
 import { PublishCommand, SNSClient } from "@aws-sdk/client-sns";
 import { GetFunctionCommand, GetFunctionUrlConfigCommand, InvokeCommand, LambdaClient, UpdateFunctionConfigurationCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
@@ -204,17 +204,37 @@ var AppExecutor = class {
 
 //#endregion
 //#region src/types/assembly.ts
-function parseEnvironment(env) {
-	const match = env.match(/^aws:\/\/([^/]+)\/(.+)$/);
+const ASSEMBLY_REGION_PREFIX = /^[a-z0-9-]+/;
+const CDK_ENVIRONMENT_PATTERN = /aws:\/\/([a-zA-Z0-9@._-]+)\/([a-z0-9-]+)/;
+const CANONICAL_ASSEMBLY_REGION = /^[a-z0-9-]+$/;
+function parseEnvironment(env, stackName) {
+	const match = env.match(/^aws:\/\/([^/]+)\/([\s\S]+)$/);
 	if (!match) return {
 		account: "unknown-account",
 		region: "unknown-region"
 	};
-	return {
+	const raw = match[2];
+	const region = ASSEMBLY_REGION_PREFIX.exec(raw)?.[0];
+	if (region !== void 0) return {
 		account: match[1] === "unknown-account" ? "unknown-account" : match[1],
-		region: match[2] === "unknown-region" ? "unknown-region" : match[2]
+		region
+	};
+	const cdk = CDK_ENVIRONMENT_PATTERN.exec(env);
+	if (cdk === null) throw new SynthesisError(unparsableRegionMessage(raw, stackName));
+	return {
+		account: cdk[1],
+		region: cdk[2]
 	};
 }
+function unparsableRegionMessage(region, stackName) {
+	const subject = stackName === void 0 ? "The cloud assembly" : `Stack ${displayStackName(stackName)} in the cloud assembly`;
+	const lower = region.toLowerCase();
+	const caseOnly = CANONICAL_ASSEMBLY_REGION.test(lower);
+	const fix = caseOnly ? `Re-synthesize with the region spelled ${displayIdent(lower)}.` : "Re-synthesize with a canonical region, e.g. env: { region: 'us-east-1' }.";
+	const head = `${subject} declares region ${displayIdent(region)}, which is not a canonical AWS region spelling (lowercase letters, digits and '-'). The AWS CDK CLI refuses this assembly too ("Unable to parse environment specification"). ${fix}`;
+	if (!caseOnly) return head;
+	return `${head}\nIf an earlier cdkd version deployed this stack from such an assembly, it recorded the stack's state under that raw region spelling, and a deploy using the canonical spelling will not find that state: it starts the stack from no state at all. 'cdkd state show' and 'cdkd state orphan' still reach that record when '--stack-region' is given the exact raw spelling; 'state orphan' removes the record and leaves its AWS resources in place, unmanaged by cdkd.`;
+}
 
 //#endregion
 //#region src/utils/assembly-path.ts
@@ -606,7 +626,7 @@ var AssemblyReader = class {
 		}
 		if (dependencyNames.length > 0) this.logger.debug(`Stack ${displayStackName(stackName)} depends on: [${dependencyNames.map((n) => displaySafe(n)).join(", ")}]`);
 		let env;
-		if (artifact.environment) env = parseEnvironment(artifact.environment);
+		if (artifact.environment) env = parseEnvironment(artifact.environment, stackName);
 		const nestedTemplates = nullPrototypeRecord();
 		for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
 			if (resource?.Type !== "AWS::CloudFormation::Stack") continue;
@@ -5000,7 +5020,7 @@ function isNotImplemented(error) {
 	const status = error?.$metadata?.httpStatusCode;
 	return name === "NotImplemented" || status === 501;
 }
-function isAccessDenied(error) {
+function isAccessDenied$1(error) {
 	let current = error;
 	for (let depth = 0; depth < 5 && current !== null && typeof current === "object"; depth++) {
 		const name = current.name;
@@ -5028,7 +5048,7 @@ async function scanOtherPrefixesForStack(target, stackName, region) {
 	try {
 		segments = await target.listTopLevelPrefixes();
 	} catch (error) {
-		return isAccessDenied(error) ? {
+		return isAccessDenied$1(error) ? {
 			kind: "denied",
 			error,
 			stage: "list"
@@ -5051,7 +5071,7 @@ async function scanOtherPrefixesForStack(target, stackName, region) {
 					if (held === "holder") found.push(prefix);
 					else if (held === "empty") stale.push(prefix);
 				} catch (error) {
-					if (isAccessDenied(error)) denied ??= error;
+					if (isAccessDenied$1(error)) denied ??= error;
 					else failed ??= error;
 				}
 			}
@@ -5491,7 +5511,7 @@ var S3StateBackend = class S3StateBackend {
 	async verifyBucketExists(options = {}) {
 		await this.ensureClientForBucket();
 		if (options.existenceAlreadyProbed) {
-			this.logger.debug(`Skipping the redundant HeadBucket on '${this.config.bucket}' — the default-name resolution already confirmed it exists with these credentials (issue #1283).`);
+			this.logger.debug(`Skipping the redundant HeadBucket on '${this.config.bucket}' — the default-name resolution already confirmed it exists with these credentials.`);
 			return;
 		}
 		try {
@@ -13794,7 +13814,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["Description", "CFn-only informational — no semantic effect on the recursive deploy"],
 			["DisableRollback", "CFn-only — cdkd controls rollback via the top-level deploy-engine --no-rollback flag, not per nested stack"],
 			["EnableTerminationProtection", "CFn-only per-nested-stack flag — cdkd records stack-level terminationProtection at CDK synth time (parent only) and `cdkd destroy` consults that for refusal"],
-			["NotificationARNs", "CFn-only SNS-on-stack-event surface — cdkd has no equivalent (issue #459 design §9)"],
+			["NotificationARNs", "CFn-only SNS-on-stack-event surface — cdkd has no equivalent"],
 			["RoleARN", "CFn-only role-assumption — cdkd uses the caller credentials directly, no per-resource role assumption"],
 			["StackName", "cdkd derives the child stack name as `<parent>~<logicalId>` per design §3 (state-key uniqueness); a user-provided StackName has no effect"],
 			["StackPolicyBody", "CFn-only stack-update policy — cdkd has no equivalent (per-resource diff replaces stack-level policy)"],
@@ -13802,7 +13822,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["StackStatusReason", "CFn-only read-only output — never a real input property"],
 			["Tags", "CFn-only — cdkd does not tag the synthesized \"stack\" (the parent's synthesized ARN is a cdkd-local placeholder, not a real AWS resource)"],
 			["TemplateBody", "CFn-only inline template — cdkd reads the child template from the synth output via Metadata['aws:asset:path'] instead of accepting it inline"],
-			["TimeoutInMinutes", "CFn-only stack-create deadline — cdkd uses per-resource --resource-timeout instead (issue #459 design §9)"]
+			["TimeoutInMinutes", "CFn-only stack-create deadline — cdkd uses per-resource --resource-timeout instead"]
 		]),
 		createOnlyDrops: /* @__PURE__ */ new Set(["StackName"]),
 		readOnly: /* @__PURE__ */ new Set([
@@ -14578,7 +14598,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"PosixUser",
 			"RootDirectory"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["ClientToken", "cdkd supplies its own retry-stable ClientToken on CreateAccessPoint (issues #2039 and #2080), so a template-supplied value would be overwritten. The SDK does not own this field either: measured against @aws-sdk/client-efs 3.1018.0, an omitted ClientToken is auto-filled with a FRESH uuid per attempt, which leaves a retried 500 free to mint a second access point, while a caller-supplied value goes on the wire verbatim."]]),
+		silentDrop: /* @__PURE__ */ new Map([["ClientToken", "cdkd supplies its own retry-stable ClientToken on CreateAccessPoint, so a template-supplied value would be overwritten. The SDK does not own this field either: an omitted ClientToken is auto-filled with a FRESH uuid per attempt, which leaves a retried 500 free to mint a second access point, while a caller-supplied value goes on the wire verbatim."]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(["ClientToken"]),
 		readOnly: /* @__PURE__ */ new Set(["AccessPointId", "Arn"]),
 		ccRouteUnavailable: false
@@ -14598,7 +14618,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"ProvisionedThroughputInMibps",
 			"ThroughputMode"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["ReplicationConfiguration", "Cross-region EFS replication (CreateReplicationConfiguration) provisions a separate destination file system in another region with its own lifecycle, KMS key, and availability-zone placement; replicating + then tearing down the destination on destroy is a multi-resource, cross-region orchestration that is out of scope for the single-resource SDK provider. Tracked as a follow-up to issue #609."]]),
+		silentDrop: /* @__PURE__ */ new Map([["ReplicationConfiguration", "Cross-region EFS replication (CreateReplicationConfiguration) provisions a separate destination file system in another region with its own lifecycle, KMS key, and availability-zone placement; replicating + then tearing down the destination on destroy is a multi-resource, cross-region orchestration that is out of scope for the single-resource SDK provider."]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Arn", "FileSystemId"]),
 		ccRouteUnavailable: false
@@ -15528,7 +15548,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["DBClusterParameterGroupName", "not yet implemented by cdkd"],
 			["DBInstanceParameterGroupName", "not yet implemented by cdkd"],
 			["DBSystemId", "not yet implemented by cdkd"],
-			["DeleteAutomatedBackups", "delete-time flag, sent on the delete when the record carries it (issue #3993); kept unhandled so a template declaring it keeps its Cloud Control route. Final snapshots are governed by DeletionPolicy: Snapshot (issue #1352), which this flag does not control"],
+			["DeleteAutomatedBackups", "delete-time flag, sent on the delete when the record carries it; kept unhandled so a template declaring it keeps its Cloud Control route. Final snapshots are governed by DeletionPolicy: Snapshot, which this flag does not control"],
 			["Domain", "not yet implemented by cdkd"],
 			["DomainIAMRoleName", "not yet implemented by cdkd"],
 			["EnableCloudwatchLogsExports", "not yet implemented by cdkd"],
@@ -15628,7 +15648,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["DBSnapshotIdentifier", "not yet implemented by cdkd"],
 			["DBSystemId", "not yet implemented by cdkd"],
 			["DedicatedLogVolume", "not yet implemented by cdkd"],
-			["DeleteAutomatedBackups", "delete-time flag, sent on the delete when the record carries it (issue #3993); kept unhandled so a template declaring it keeps its Cloud Control route. Final snapshots are governed by DeletionPolicy: Snapshot (issue #1352), which this flag does not control"],
+			["DeleteAutomatedBackups", "delete-time flag, sent on the delete when the record carries it; kept unhandled so a template declaring it keeps its Cloud Control route. Final snapshots are governed by DeletionPolicy: Snapshot, which this flag does not control"],
 			["Domain", "not yet implemented by cdkd"],
 			["DomainAuthSecretArn", "not yet implemented by cdkd"],
 			["DomainDnsIps", "not yet implemented by cdkd"],
@@ -19651,7 +19671,7 @@ function recordSecretNamedRead(logicalId, value, context) {
 }
 function rejectPlaceholderArnAttribute(resource, attributeName, value, logicalId, context, healOutcome) {
 	if (!isStalePlaceholderArnAttribute(resource.resourceType, attributeName, value)) return;
-	throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: the recorded value ${quotedRender(stringifyValue(this.maskValueLeaves(value, context)), "\"")} is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. ` + this.staleRecordRemedy(healOutcome, context)));
+	throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: the recorded value ${quotedRender(stringifyValue(this.maskValueLeaves(value, context)), "\"")} is a placeholder written by an older cdkd version — its region and account fields are literal wildcards, so it is not a usable ARN. ` + this.staleRecordRemedy(healOutcome, context)));
 }
 async function constructAttribute(resource, attributeName, context, logicalId, accountInfo) {
 	const { resourceType, physicalId } = resource;
@@ -20922,7 +20942,7 @@ async function resolveSplit(splitArgs, context) {
 		const source = this.describeSplitValueSource(value);
 		const sourceClause = source ? ` (from ${this.displayMasked(source.label, context)})` : "";
 		if (Array.isArray(resolvedValue)) {
-			const remedy = source?.kind === "ref" ? "A list-typed parameter — any List<...> type (List<AWS::EC2::Subnet::Id>, List<Number>, …) or CommaDelimitedList — is already a list." : source?.kind === "getatt" ? "A list-valued Fn::GetAtt (for example AWS::Route53::HostedZone.NameServers or AWS::EC2::VPC.Ipv6CidrBlocks) already returns a list. If you wrote the Fn::Split as a workaround for cdkd resolving that attribute to a comma-delimited string, that bug is fixed (PR #1868) and the workaround is no longer needed." : "Several intrinsics already return a list — among them a list-valued Fn::GetAtt, a Ref to a list-typed parameter (any List<...> type or CommaDelimitedList), Fn::GetAZs, Fn::Cidr, and Fn::Split itself.";
+			const remedy = source?.kind === "ref" ? "A list-typed parameter — any List<...> type (List<AWS::EC2::Subnet::Id>, List<Number>, …) or CommaDelimitedList — is already a list." : source?.kind === "getatt" ? "A list-valued Fn::GetAtt (for example AWS::Route53::HostedZone.NameServers or AWS::EC2::VPC.Ipv6CidrBlocks) already returns a list. If you wrote the Fn::Split as a workaround for cdkd resolving that attribute to a comma-delimited string, that bug is fixed and the workaround is no longer needed." : "Several intrinsics already return a list — among them a list-valued Fn::GetAtt, a Ref to a list-typed parameter (any List<...> type or CommaDelimitedList), Fn::GetAZs, Fn::Cidr, and Fn::Split itself.";
 			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Split: the value to split${sourceClause} is ALREADY a list (an array of ${resolvedValue.length} item${resolvedValue.length === 1 ? "" : "s"}), not a string. CloudFormation rejects Fn::Split over a list too, so this template is not valid CloudFormation either. Remove the Fn::Split and use the value directly. ${remedy}`));
 		}
 		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Split: the value to split${sourceClause} must be a string, got ${resolvedValue === null ? "null" : typeof resolvedValue}. Fn::Split accepts only a string; check the value or the intrinsic that produced it.`));
@@ -22347,7 +22367,7 @@ var DiffCalculator = class DiffCalculator {
 						requiresReplacement: await this.maskedEditRequiresReplacement(desiredResource.Type, key, oldValue, newValue),
 						maskedExpressionChanged: true
 					});
-					this.logger.debug(safeMsg`${logicalId}: ${key} is recorded masked and its template expression or a resolved input changed (go-to-k/cdkd#4451, go-to-k/cdkd#4543)`);
+					this.logger.debug(safeMsg`${logicalId}: ${key} is recorded masked and its template expression or a resolved input changed`);
 				}
 				const attributeChanges = this.compareAttributes(currentResource, desiredResource);
 				if (propertyChanges.length > 0 || attributeChanges.length > 0) {
@@ -23125,9 +23145,167 @@ function escapeRegExp$1(text) {
 	return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+//#endregion
+//#region src/provisioning/getatt-attributes.generated.ts
+const WRITABLE_GETATT_ATTRIBUTES = {
+	"AWS::Amplify::Branch": ["BranchName"],
+	"AWS::Amplify::Domain": [
+		"AutoSubDomainCreationPatterns",
+		"AutoSubDomainIAMRole",
+		"DomainName",
+		"EnableAutoSubDomain"
+	],
+	"AWS::AppMesh::GatewayRoute": [
+		"GatewayRouteName",
+		"MeshName",
+		"MeshOwner",
+		"VirtualGatewayName"
+	],
+	"AWS::AppMesh::Mesh": ["MeshName"],
+	"AWS::AppMesh::Route": [
+		"MeshName",
+		"MeshOwner",
+		"RouteName",
+		"VirtualRouterName"
+	],
+	"AWS::AppMesh::VirtualGateway": [
+		"MeshName",
+		"MeshOwner",
+		"VirtualGatewayName"
+	],
+	"AWS::AppMesh::VirtualNode": [
+		"MeshName",
+		"MeshOwner",
+		"VirtualNodeName"
+	],
+	"AWS::AppMesh::VirtualRouter": [
+		"MeshName",
+		"MeshOwner",
+		"VirtualRouterName"
+	],
+	"AWS::AppMesh::VirtualService": [
+		"MeshName",
+		"MeshOwner",
+		"VirtualServiceName"
+	],
+	"AWS::AppSync::DataSource": ["Name"],
+	"AWS::AppSync::DomainName": ["DomainName"],
+	"AWS::AppSync::FunctionConfiguration": ["DataSourceName", "Name"],
+	"AWS::AppSync::Resolver": ["FieldName", "TypeName"],
+	"AWS::Backup::BackupSelection": ["BackupPlanId"],
+	"AWS::Backup::BackupVault": ["BackupVaultName"],
+	"AWS::CleanRooms::AnalysisTemplate": ["Schema"],
+	"AWS::Cloud9::EnvironmentEC2": ["Name"],
+	"AWS::CloudWatch::InsightRule": ["RuleName"],
+	"AWS::CodeArtifact::Domain": ["EncryptionKey"],
+	"AWS::CodeArtifact::Repository": ["DomainName", "DomainOwner"],
+	"AWS::EC2::CapacityReservation": [
+		"AvailabilityZone",
+		"InstanceType",
+		"Tenancy"
+	],
+	"AWS::EC2::Instance": ["AvailabilityZone"],
+	"AWS::EC2::SecurityGroup": ["VpcId"],
+	"AWS::EC2::Subnet": [
+		"AvailabilityZone",
+		"AvailabilityZoneId",
+		"CidrBlock",
+		"OutpostArn",
+		"VpcId"
+	],
+	"AWS::EC2::VPC": ["CidrBlock"],
+	"AWS::EFS::MountTarget": ["IpAddress"],
+	"AWS::EKS::Nodegroup": ["ClusterName", "NodegroupName"],
+	"AWS::ElasticLoadBalancingV2::LoadBalancer": ["SecurityGroups"],
+	"AWS::EventSchemas::Discoverer": ["CrossAccount"],
+	"AWS::EventSchemas::Registry": ["RegistryName"],
+	"AWS::EventSchemas::Schema": ["SchemaName"],
+	"AWS::Events::EventBus": ["Name"],
+	"AWS::GameLift::GameSessionQueue": ["Name"],
+	"AWS::GameLift::MatchmakingConfiguration": ["Name"],
+	"AWS::GameLift::MatchmakingRuleSet": ["Name"],
+	"AWS::Grafana::Workspace": ["GrafanaVersion"],
+	"AWS::Greengrass::ConnectorDefinition": ["Name"],
+	"AWS::Greengrass::CoreDefinition": ["Name"],
+	"AWS::Greengrass::DeviceDefinition": ["Name"],
+	"AWS::Greengrass::FunctionDefinition": ["Name"],
+	"AWS::Greengrass::Group": ["Name", "RoleArn"],
+	"AWS::Greengrass::LoggerDefinition": ["Name"],
+	"AWS::Greengrass::ResourceDefinition": ["Name"],
+	"AWS::Greengrass::SubscriptionDefinition": ["Name"],
+	"AWS::ImageBuilder::Component": ["Name"],
+	"AWS::ImageBuilder::ContainerRecipe": ["Name"],
+	"AWS::ImageBuilder::DistributionConfiguration": ["Name"],
+	"AWS::ImageBuilder::ImagePipeline": ["Name"],
+	"AWS::ImageBuilder::ImageRecipe": ["Name"],
+	"AWS::ImageBuilder::InfrastructureConfiguration": ["Name"],
+	"AWS::Kinesis::StreamConsumer": ["ConsumerName", "StreamARN"],
+	"AWS::MSK::Cluster": ["CurrentVersion"],
+	"AWS::ManagedBlockchain::Member": ["NetworkId"],
+	"AWS::ManagedBlockchain::Node": ["MemberId", "NetworkId"],
+	"AWS::MediaConvert::JobTemplate": ["Name"],
+	"AWS::MediaConvert::Preset": ["Name"],
+	"AWS::MediaConvert::Queue": ["Name"],
+	"AWS::OpsWorks::Instance": ["AvailabilityZone"],
+	"AWS::OpsWorks::UserProfile": ["SshUsername"],
+	"AWS::QuickSight::Analysis": ["Errors", "Sheets"],
+	"AWS::RDS::DBInstance": ["DBSystemId"],
+	"AWS::RDS::DBParameterGroup": ["DBParameterGroupName"],
+	"AWS::RedshiftServerless::Workgroup": ["Workgroup"],
+	"AWS::RoboMaker::RobotApplication": ["CurrentRevisionId"],
+	"AWS::RoboMaker::SimulationApplication": ["CurrentRevisionId"],
+	"AWS::Route53Resolver::ResolverEndpoint": [
+		"Direction",
+		"Name",
+		"OutpostArn",
+		"PreferredInstanceType",
+		"ResolverEndpointType"
+	],
+	"AWS::Route53Resolver::ResolverRule": [
+		"DomainName",
+		"Name",
+		"ResolverEndpointId",
+		"TargetIps"
+	],
+	"AWS::Route53Resolver::ResolverRuleAssociation": [
+		"Name",
+		"ResolverRuleId",
+		"VPCId"
+	],
+	"AWS::S3::AccessPoint": ["Name"],
+	"AWS::SNS::Topic": ["TopicName"],
+	"AWS::SQS::Queue": ["QueueName"],
+	"AWS::SSM::Parameter": ["Type"],
+	"AWS::SSM::ResourceDataSync": ["SyncName"],
+	"AWS::SageMaker::CodeRepository": ["CodeRepositoryName"],
+	"AWS::SageMaker::Endpoint": ["EndpointName"],
+	"AWS::SageMaker::EndpointConfig": ["EndpointConfigName"],
+	"AWS::SageMaker::Model": ["ModelName"],
+	"AWS::SageMaker::ModelPackage": ["LastModifiedTime"],
+	"AWS::SageMaker::NotebookInstance": ["NotebookInstanceName"],
+	"AWS::SageMaker::NotebookInstanceLifecycleConfig": ["NotebookInstanceLifecycleConfigName"],
+	"AWS::SageMaker::Workteam": ["WorkteamName"],
+	"AWS::ServiceDiscovery::Service": ["Name"],
+	"AWS::Signer::SigningProfile": ["ProfileName"],
+	"AWS::StepFunctions::Activity": ["Name"],
+	"AWS::Transfer::User": ["ServerId", "UserName"]
+};
+
 //#endregion
 //#region src/provisioning/read-only-properties.ts
 const readOnlyPropertiesCache = /* @__PURE__ */ new Map();
+const attributeNamesCache = /* @__PURE__ */ new Map();
+async function getTopLevelAttributeNames(resourceType) {
+	const readOnly = await getTopLevelReadOnlyProperties(resourceType);
+	if (readOnly === void 0) return void 0;
+	const writable = Object.hasOwn(WRITABLE_GETATT_ATTRIBUTES, resourceType) ? WRITABLE_GETATT_ATTRIBUTES[resourceType] : void 0;
+	if (!writable || writable.length === 0) return readOnly;
+	const cached = attributeNamesCache.get(resourceType);
+	if (cached) return cached;
+	const names = /* @__PURE__ */ new Set([...readOnly, ...writable]);
+	attributeNamesCache.set(resourceType, names);
+	return names;
+}
 function getTopLevelReadOnlyProperties(resourceType) {
 	if (hasNoRegistrySchema(resourceType)) return Promise.resolve(void 0);
 	const cached = readOnlyPropertiesCache.get(resourceType);
@@ -23710,7 +23888,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Ca7cV9tM.js");
+			const { ASGProvider } = await import("./asg-provider-D9Po293s.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -23816,7 +23994,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-B4sFJ8YW.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-B1D2CFBs.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-CU0LZr05.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-xROL9y31.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -24501,7 +24679,7 @@ var CloudControlProvider = class {
 	async maskUncertifiedModelValues(model, resourceType, physicalId) {
 		const safeType = displaySafe(resourceType, { asciiOnly: true });
 		const safeId = displaySafe(physicalId, { asciiOnly: true });
-		const attributeNames = await getTopLevelReadOnlyProperties(resourceType);
+		const attributeNames = await getTopLevelAttributeNames(resourceType);
 		if (attributeNames === void 0) {
 			if (!this.warnedUnresolvableSchemaTypes.has(resourceType)) {
 				this.warnedUnresolvableSchemaTypes.add(resourceType);
@@ -24515,7 +24693,7 @@ var CloudControlProvider = class {
 			masked[key] = maskLeavesDeep(value);
 			maskedCount++;
 		}
-		if (maskedCount > 0 && attributeNames !== void 0) this.logger.debug(`Masked ${maskedCount} non-attribute key(s) out of the ${safeType} Cloud Control model for ${safeId}: they are not in the type's readOnlyProperties, so CloudFormation would reject an Fn::GetAtt naming them and cdkd has no evidence they are safe to persist.`);
+		if (maskedCount > 0 && attributeNames !== void 0) this.logger.debug(`Masked ${maskedCount} non-attribute key(s) out of the ${safeType} Cloud Control model for ${safeId}: they are not Fn::GetAtt attributes of the type, so CloudFormation would reject an Fn::GetAtt naming them and cdkd has no evidence they are safe to persist.`);
 		return masked;
 	}
 };
@@ -24626,6 +24804,124 @@ function maskLeavesDeep(value) {
 	return "***";
 }
 
+//#endregion
+//#region src/state/state-bucket-lifecycle.ts
+const CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID = "cdkd-custom-resource-responses-expiration";
+const CUSTOM_RESOURCE_RESPONSE_EXPIRATION_DAYS = 1;
+const CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_PREFIX = `${CUSTOM_RESOURCE_RESPONSE_PREFIX}/cdkd-1`;
+function buildCustomResourceResponseLifecycleRule(legacyPrefix) {
+	const prefix = CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_PREFIX;
+	return {
+		ID: CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID,
+		Status: "Enabled",
+		...legacyPrefix ? { Prefix: prefix } : { Filter: { Prefix: prefix } },
+		Expiration: { Days: 1 },
+		NoncurrentVersionExpiration: { NoncurrentDays: 1 }
+	};
+}
+async function applyCustomResourceResponseExpiration(s3, bucket, opts = {}) {
+	const owner = opts.expectedBucketOwner ? { ExpectedBucketOwner: opts.expectedBucketOwner } : {};
+	const first = await readLifecycle(s3, bucket, owner);
+	if ("failed" in first) return first.failed;
+	if (first.rules.some((rule) => rule.ID === "cdkd-custom-resource-responses-expiration")) return { status: "present" };
+	let collision;
+	try {
+		collision = await findStateUnderResponsePrefix(s3, bucket, owner);
+	} catch (error) {
+		return failedOutcome("ListObjectsV2", error);
+	}
+	if (collision !== void 0) return {
+		status: "refused",
+		reason: `${CUSTOM_RESOURCE_RESPONSE_PREFIX}/${displaySafe(collision) || "<unrenderable>"} holds objects other than custom-resource responses (a stack deployed with --state-prefix ${CUSTOM_RESOURCE_RESPONSE_PREFIX}), and the rule would expire them`
+	};
+	const latest = await readLifecycle(s3, bucket, owner);
+	if ("failed" in latest) return latest.failed;
+	if (latest.rules.some((rule) => rule.ID === "cdkd-custom-resource-responses-expiration")) return { status: "present" };
+	const existing = latest.rules;
+	const minimumObjectSize = latest.minimumObjectSize;
+	const legacyPrefix = existing.some((rule) => rule.Prefix !== void 0);
+	try {
+		await s3.send(new PutBucketLifecycleConfigurationCommand({
+			Bucket: bucket,
+			...owner,
+			LifecycleConfiguration: { Rules: [...existing, buildCustomResourceResponseLifecycleRule(legacyPrefix)] },
+			...minimumObjectSize !== void 0 && { TransitionDefaultMinimumObjectSize: minimumObjectSize }
+		}));
+	} catch (error) {
+		return failedOutcome("PutBucketLifecycleConfiguration", error);
+	}
+	return { status: "added" };
+}
+async function readLifecycle(s3, bucket, owner) {
+	try {
+		const current = await s3.send(new GetBucketLifecycleConfigurationCommand({
+			Bucket: bucket,
+			...owner
+		}));
+		return {
+			rules: current.Rules ?? [],
+			minimumObjectSize: current.TransitionDefaultMinimumObjectSize
+		};
+	} catch (error) {
+		if (error?.name === "NoSuchLifecycleConfiguration") return {
+			rules: [],
+			minimumObjectSize: void 0
+		};
+		return { failed: failedOutcome("GetBucketLifecycleConfiguration", error) };
+	}
+}
+function isAccessDenied(error) {
+	const e = error;
+	return e?.name === "AccessDenied" || e?.$metadata?.httpStatusCode === 403;
+}
+function failedOutcome(operation, error) {
+	return {
+		status: "failed",
+		reason: failureReason(operation, error),
+		accessDenied: isAccessDenied(error)
+	};
+}
+async function findStateUnderResponsePrefix(s3, bucket, owner) {
+	let token;
+	do {
+		const page = await s3.send(new ListObjectsV2Command({
+			Bucket: bucket,
+			...owner,
+			Prefix: CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_PREFIX,
+			Delimiter: "/",
+			EncodingType: "url",
+			...token !== void 0 && { ContinuationToken: token }
+		}));
+		const first = decodeListingKey(page.CommonPrefixes?.find((p) => p.Prefix)?.Prefix);
+		if (first !== void 0) return first.slice(CUSTOM_RESOURCE_RESPONSE_PREFIX.length + 1);
+		token = page.IsTruncated ? page.NextContinuationToken : void 0;
+	} while (token !== void 0);
+}
+function failureReason(operation, error) {
+	return `${operation} failed: ${displaySafe(describeAwsFailure(error).detail) || "<unrenderable>"}`;
+}
+function customResourceResponseExpirationWarning(bucket, outcome) {
+	const remedy = outcome.status === "refused" ? `To add the rule, move that stack to a different --state-prefix.` : outcome.accessDenied ? "To add the rule, grant s3:GetLifecycleConfiguration, s3:PutLifecycleConfiguration and s3:ListBucket on the bucket, and check that this account owns it." : `To add the rule, review the bucket's lifecycle configuration against the reason above.`;
+	return `Could not add the ${1}-day expiration lifecycle rule for ${CUSTOM_RESOURCE_RESPONSE_PREFIX}/ to state bucket ${displaySafe(bucket, { asciiOnly: true }) || "<unrenderable>"} (${outcome.reason}). The bucket's lifecycle configuration was left unchanged. Custom-resource response objects left by an interrupted run stay until 'cdkd gc' removes them. ${remedy}`;
+}
+const ensured = /* @__PURE__ */ new Map();
+function ensureCustomResourceResponseExpirationOnce(s3, bucket, log) {
+	const memo = ensured.get(bucket);
+	if (memo) return memo;
+	const run = (async () => {
+		try {
+			const owner = await expectedOwnerParam(s3);
+			const outcome = await applyCustomResourceResponseExpiration(s3, bucket, { ...owner.ExpectedBucketOwner && { expectedBucketOwner: owner.ExpectedBucketOwner } });
+			if (outcome.status === "failed" || outcome.status === "refused") log.warn(customResourceResponseExpirationWarning(bucket, outcome));
+			else if (outcome.status === "added") log.debug(`Added the ${1}-day expiration lifecycle rule for ${CUSTOM_RESOURCE_RESPONSE_PREFIX}/ to the state bucket.`);
+		} catch (error) {
+			log.warn(customResourceResponseExpirationWarning(bucket, failedOutcome("lifecycle check", error)));
+		}
+	})();
+	ensured.set(bucket, run);
+	return run;
+}
+
 //#endregion
 //#region src/deployment/resource-secrets-scope.ts
 const currentResourceSecretsStore = new AsyncLocalStorage();
@@ -25779,6 +26075,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 		if (!this.responseBucket) return "https://localhost/cfn-response-not-configured";
 		await this.ensureResponseClient();
 		const bucket = this.responseBucket;
+		if (this.responsePrefix === "custom-resource-responses") ensureCustomResourceResponseExpirationOnce(this.s3Client, bucket, this.logger);
 		try {
 			await withRetry(() => this.s3Client.send(new PutObjectCommand({
 				Bucket: bucket,
@@ -28615,6 +28912,162 @@ const PRINCIPAL_KINDS = {
 	"AWS::IAM::Group": "group",
 	"AWS::IAM::User": "user"
 };
+function isInlinePolicyPrincipalType(resourceType) {
+	return Object.hasOwn(PRINCIPAL_KINDS, resourceType);
+}
+function principalKindOf(resourceType) {
+	return Object.hasOwn(PRINCIPAL_KINDS, resourceType) ? PRINCIPAL_KINDS[resourceType] : void 0;
+}
+const ANY = "*";
+const PRINCIPAL_NAME_FIELDS = {
+	role: "RoleName",
+	group: "GroupName",
+	user: "UserName"
+};
+function nameKey(value) {
+	return typeof value === "string" && IAM_NAME.test(value) ? value.toLowerCase() : ANY;
+}
+function templatePrincipalKeys(entry, kind, templateResources, stateResources) {
+	if (typeof entry === "string") return [nameKey(entry)];
+	const ref = typeof entry === "object" && entry !== null && !Array.isArray(entry) ? entry["Ref"] : void 0;
+	if (typeof ref !== "string" || !Object.hasOwn(templateResources, ref)) return [ANY];
+	const target = templateResources[ref];
+	if (principalKindOf(target.Type) !== kind) return [ANY];
+	return principalSelfKeys(ref, kind, target, stateResources);
+}
+function principalSelfKeys(logicalId, kind, template, stateResources) {
+	const keys = [`ref:${logicalId}`];
+	const declared = template?.Properties?.[PRINCIPAL_NAME_FIELDS[kind]];
+	const declaredKey = nameKey(declared);
+	if (declaredKey !== ANY) keys.push(declaredKey);
+	const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+	if (record !== void 0 && principalKindOf(record.resourceType) === kind) {
+		const recordedKey = nameKey(record.physicalId);
+		if (recordedKey !== ANY) keys.push(recordedKey);
+	}
+	return keys;
+}
+function policiesNames(policies) {
+	if (policies === void 0 || policies === null) return [];
+	if (!Array.isArray(policies)) return [ANY];
+	return policies.map((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) ? nameKey(entry["PolicyName"]) : ANY);
+}
+function inlinePolicyClaimsOf(logicalId, change, templateResources, stateResources) {
+	const template = Object.hasOwn(templateResources, logicalId) ? templateResources[logicalId] : void 0;
+	const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+	const recorded = record?.resourceType === change.resourceType ? record : void 0;
+	const claims = [];
+	const cross = (kind, principals, names) => {
+		for (const principal of new Set(principals)) for (const name of new Set(names)) claims.push({
+			kind,
+			principal,
+			name
+		});
+	};
+	if (change.resourceType === "AWS::IAM::Policy") {
+		const desired = template?.Properties ?? {};
+		const old = recorded?.properties ?? {};
+		const names = [];
+		if (desired["PolicyName"] !== void 0) names.push(nameKey(desired["PolicyName"]));
+		if (old["PolicyName"] !== void 0) names.push(nameKey(old["PolicyName"]));
+		if (recorded !== void 0) names.push(nameKey(typeof recorded.physicalId === "string" ? recorded.physicalId.split(":")[0] : recorded.physicalId));
+		if (names.length === 0) return claims;
+		for (const kind of [
+			"role",
+			"group",
+			"user"
+		]) {
+			const field = POLICY_LIST_FIELDS[kind];
+			const principals = [];
+			const listed = desired[field];
+			if (Array.isArray(listed)) for (const entry of listed) principals.push(...templatePrincipalKeys(entry, kind, templateResources, stateResources));
+			else if (listed !== void 0) principals.push(ANY);
+			const held = old[field];
+			if (Array.isArray(held)) principals.push(...held.map(nameKey));
+			else if (held !== void 0 && held !== null) principals.push(ANY);
+			cross(kind, principals, names);
+		}
+		return claims;
+	}
+	const kind = principalKindOf(change.resourceType);
+	if (kind === void 0) return claims;
+	if (!(change.changeType === "CREATE" || (change.propertyChanges ?? []).some((c) => c.requiresReplacement) || ownPoliciesChange(change))) return claims;
+	cross(kind, principalSelfKeys(logicalId, kind, template, stateResources), [...policiesNames(template?.Properties?.["Policies"]), ...policiesNames(recorded?.properties?.["Policies"])]);
+	return claims;
+}
+function orderInlinePolicyWriters(args) {
+	const { writes, changes, templateResources, stateResources, dependencies, rank } = args;
+	const writers = writes.filter((id) => {
+		const type = changes.get(id)?.resourceType;
+		return type === "AWS::IAM::Policy" || type !== void 0 && isInlinePolicyPrincipalType(type);
+	});
+	if (writers.length < 2) return [];
+	const exact = /* @__PURE__ */ new Map();
+	const loose = [];
+	const all = [];
+	for (const id of writers) for (const claim of inlinePolicyClaimsOf(id, changes.get(id), templateResources, stateResources)) {
+		all.push({
+			id,
+			claim
+		});
+		if (claim.principal === ANY || claim.name === ANY) {
+			loose.push({
+				id,
+				claim
+			});
+			continue;
+		}
+		const key = JSON.stringify([
+			claim.kind,
+			claim.principal,
+			claim.name
+		]);
+		const ids = exact.get(key) ?? /* @__PURE__ */ new Set();
+		ids.add(id);
+		exact.set(key, ids);
+	}
+	const principalRows = new Set(writers.filter((id) => isInlinePolicyPrincipalType(changes.get(id).resourceType)));
+	const pairs = /* @__PURE__ */ new Map();
+	const pair = (a, b) => {
+		if (a === b || principalRows.has(a) && principalRows.has(b)) return;
+		const [x, y] = rank(a) < rank(b) || rank(a) === rank(b) && a < b ? [a, b] : [b, a];
+		pairs.set(JSON.stringify([x, y]), [x, y]);
+	};
+	for (const ids of exact.values()) {
+		const list = [...ids];
+		for (let i = 0; i < list.length; i++) for (let j = i + 1; j < list.length; j++) pair(list[i], list[j]);
+	}
+	const meets = (a, b) => a === ANY || b === ANY || a === b;
+	for (const { id, claim } of loose) for (const other of all) {
+		if (other.claim.kind !== claim.kind) continue;
+		if (meets(claim.principal, other.claim.principal) && meets(claim.name, other.claim.name)) pair(id, other.id);
+	}
+	if (pairs.size === 0) return [];
+	const reaches = (from, to) => {
+		const seen = /* @__PURE__ */ new Set();
+		const stack = [from];
+		while (stack.length > 0) {
+			const id = stack.pop();
+			if (id === to) return true;
+			if (seen.has(id)) continue;
+			seen.add(id);
+			for (const dep of dependencies.get(id) ?? []) stack.push(dep);
+		}
+		return false;
+	};
+	const added = [];
+	for (const [before, after] of pairs.values()) {
+		if (reaches(after, before) || reaches(before, after)) continue;
+		const deps = dependencies.get(after) ?? /* @__PURE__ */ new Set();
+		deps.add(before);
+		dependencies.set(after, deps);
+		added.push({
+			before,
+			after
+		});
+	}
+	return added;
+}
 function ownPoliciesChange(change) {
 	return (change?.propertyChanges ?? []).some((c) => c.path === "Policies" && c.inPlacePropagated !== true && c.replacementPropagated !== true);
 }
@@ -30749,7 +31202,7 @@ function renderNestedStackTypeChangeRefusal(typeChanges, stackName) {
 	const rows = typeChanges.map((tc) => {
 		return `${`  - ${tc.logicalId}: Type changes from ${tc.currentType} to ${tc.desiredType} (the existing ${tc.currentType} is ${tc.physicalId}).`}\n${tc.direction === "into-nested-stack" ? `    Replacing a single resource BY a nested stack is not supported: the create half of the replacement would deploy a whole child stack "${stackName}~${tc.logicalId}" as one row, while ${tc.physicalId} is still recorded under this logical id.` : `    Replacing a nested stack BY a single resource is not supported: a replacement deletes its old half as a best-effort cleanup step whose failure is only a warning, so the child stack "${stackName}~${tc.logicalId}" and every resource it owns could be left behind, untracked, under a deploy that reports success.`}`;
 	});
-	return `Refusing to deploy ${stackName}: ` + (typeChanges.length === 1 ? `a resource changes its Type ` : `${typeChanges.length} resources change their Type `) + `into or out of ${NESTED_STACK_RESOURCE_TYPE}, which cdkd does not replace in place (issue #2668).\n${rows.join("\n")}\n  Deploy this as two changes instead: give the new resource a DIFFERENT logical id (in CDK, rename the construct) so the existing row is deleted through its own type's provider and the new one is created under its own — or remove the resource in one deploy and add its replacement in the next. There is no flag that overrides this refusal.`;
+	return `Refusing to deploy ${stackName}: ` + (typeChanges.length === 1 ? `a resource changes its Type ` : `${typeChanges.length} resources change their Type `) + `into or out of ${NESTED_STACK_RESOURCE_TYPE}, which cdkd does not replace in place.\n${rows.join("\n")}\n  Deploy this as two changes instead: give the new resource a DIFFERENT logical id (in CDK, rename the construct) so the existing row is deleted through its own type's provider and the new one is created under its own — or remove the resource in one deploy and add its replacement in the next. There is no flag that overrides this refusal.`;
 }
 
 //#endregion
@@ -34211,7 +34664,7 @@ function kickOffAutoRefreshObservedProperties(stateResources, crossStackReads) {
 			resource
 		});
 	}
-	if (refused > 0) this.logger.debug(`observed-properties auto-refresh SKIPPED for ${refused} resource(s) whose baseline a 'cdkd import' run refused (issue #2944): their recorded properties cannot position the redaction, so capturing an AWS readback against them could persist a resolved secret in plaintext. A deploy that actually CHANGES one of them restores its baseline, unless the refusal is an unverifiable-parameter one (only a replacement or a proving re-import discharges that); a NO_CHANGE deploy never does.`);
+	if (refused > 0) this.logger.debug(`observed-properties auto-refresh SKIPPED for ${refused} resource(s) whose baseline a 'cdkd import' run refused: their recorded properties cannot position the redaction, so capturing an AWS readback against them could persist a resolved secret in plaintext. A deploy that actually CHANGES one of them restores its baseline, unless the refusal is an unverifiable-parameter one (only a replacement or a proving re-import discharges that); a NO_CHANGE deploy never does.`);
 	if (candidates.length === 0 && masked.length === 0) return;
 	const allSiblings = {};
 	for (const [lid, res] of Object.entries(stateResources)) allSiblings[lid] = {
@@ -34244,7 +34697,7 @@ function kickOffAutoRefreshObservedProperties(stateResources, crossStackReads) {
 	if (masked.length > 0) try {
 		producerRegions = producerRegionsFromState(crossStackReads);
 	} catch {
-		this.logger.debug(safeMsg`Masked observed baseline re-capture skipped for ${masked.length} resource(s): the record's cross-stack reads could not be read (issue #3595).`);
+		this.logger.debug(safeMsg`Masked observed baseline re-capture skipped for ${masked.length} resource(s): the record's cross-stack reads could not be read.`);
 		masked.length = 0;
 	}
 	for (const { logicalId, resource } of masked) {
@@ -34271,7 +34724,7 @@ function kickOffMaskedBaselineRecapture(provider, logicalId, resource, producerR
 	const task = (async () => {
 		const secrets = await resolveRecordSecrets(properties, (token, own) => this.resolver.resolveDynamicReferences(token, persistedTokenResolverContext(own, producerRegions)));
 		if (secrets === void 0 || secrets.size === 0) {
-			this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: its recorded references did not all resolve to distinct values (issue #3595).`);
+			this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: its recorded references did not all resolve to distinct values.`);
 			return;
 		}
 		const readback = await withCurrentResourceSecrets(secrets, () => readCurrentState(resource.physicalId, logicalId, resource.resourceType, properties, context));
@@ -34283,14 +34736,14 @@ function kickOffMaskedBaselineRecapture(provider, logicalId, resource, producerR
 			secrets
 		});
 		if (recaptured === void 0) {
-			this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: no masked position could be certified, or the resource no longer reads back as its baseline records (issue #3595).`);
+			this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: no masked position could be certified, or the resource no longer reads back as its baseline records.`);
 			return;
 		}
 		this.recapturedBaselines.set(recaptured, previous);
-		this.logger.debug(safeMsg`Re-captured the masked observed baseline of ${logicalId} (issue #3595).`);
+		this.logger.debug(safeMsg`Re-captured the masked observed baseline of ${logicalId}.`);
 		return recaptured;
 	})().catch(() => {
-		this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: the re-capture failed (issue #3595).`);
+		this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: the re-capture failed.`);
 	});
 	this.observedCaptureTasks.set(logicalId, task);
 }
@@ -34454,7 +34907,7 @@ function refuseRedactedAttributeReads(logicalId, resourceType, context) {
 		const producers = [...new Set(reads.map((read) => read.logicalId).filter((id) => !!id))];
 		throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: ${producers.map((id) => displayIdent(id)).join(", ")} declared ${reads.length === 1 ? "that attribute" : "those attributes"} NoEcho, so cdkd's recorded state holds only the redaction mask for ${reads.length === 1 ? "it" : "them"}, and cdkd does not re-run a producer to recover a value. Remedy: deploy a change to the producer in the SAME run as ${logicalId} (for a custom resource, change one of its properties, e.g. a nonce / version property, so its handler runs again and supplies the value), or stop declaring the value NoEcho.`, resourceType, logicalId);
 	}
-	throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the redaction mask there, and the value is not recoverable from state. There are three ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all, or cdkd deploy '**' when either is inside a CDK Stage) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The value holds the Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records — so a deploy that leaves the resource or output holding it unchanged reads the mask again, and a re-import does not recover it. Remedy: have this resource build the value itself from the SECRET's own reference (the {{resolve:secretsmanager:...}} or {{resolve:ssm-secure:...}} reference, or a {{resolve:ssm:...}} of a SecureString parameter, that the encoding was made from) under its own Fn::Base64, instead of reading it from another resource's attribute or another stack's output — not by a {{resolve:ssm:...}} read of a String parameter holding the encoding, which cdkd treats as public and would record in state in the clear. (3) The resource was adopted by 'cdkd import' through the Cloud Control fallback, which records only the attributes the type's CloudFormation schema declares read-only and masks the rest. Either the attribute named above is not one of them — CloudFormation would reject an Fn::GetAtt naming it too, so stop reading it — or cdkd could not read that schema and masked the whole model, which the import warned about when it happened. If that warning named a missing cloudformation:DescribeType permission, grant it first. See https://github.com/go-to-k/cdkd/issues/2449. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources, true)}`, resourceType, logicalId);
+	throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the redaction mask there, and the value is not recoverable from state. There are three ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all, or cdkd deploy '**' when either is inside a CDK Stage) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The value holds the Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records — so a deploy that leaves the resource or output holding it unchanged reads the mask again, and a re-import does not recover it. Remedy: have this resource build the value itself from the SECRET's own reference (the {{resolve:secretsmanager:...}} or {{resolve:ssm-secure:...}} reference, or a {{resolve:ssm:...}} of a SecureString parameter, that the encoding was made from) under its own Fn::Base64, instead of reading it from another resource's attribute or another stack's output — not by a {{resolve:ssm:...}} read of a String parameter holding the encoding, which cdkd treats as public and would record in state in the clear. (3) The resource was adopted by 'cdkd import' through the Cloud Control fallback, which records only the type's Fn::GetAtt attributes (its read-only properties plus the writable ones CloudFormation also accepts in Fn::GetAtt) and masks the rest. Either the attribute named above is not one of them — CloudFormation would reject an Fn::GetAtt naming it too, so stop reading it — or cdkd could not read that schema and masked the whole model, which the import warned about when it happened. If that warning named a missing cloudformation:DescribeType permission, grant it first. See https://github.com/go-to-k/cdkd/issues/2449. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources, true)}`, resourceType, logicalId);
 }
 function allRecordedSecrets() {
 	const all = /* @__PURE__ */ new Map();
@@ -34839,7 +35292,7 @@ function createReadOnlyAttributeHealerFactory(options) {
 			region
 		})))().then((outcome) => {
 			if (outcome.kind === "read") try {
-				logger.debug(safeMsg`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS for this preview — its state record lacked one a Fn::GetAtt asked for (#1852); nothing is written: ${Object.keys(outcome.attributes).length} attribute(s) read`);
+				logger.debug(safeMsg`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS for this preview — its state record lacked one a Fn::GetAtt asked for; nothing is written: ${Object.keys(outcome.attributes).length} attribute(s) read`);
 			} catch {}
 			return outcome;
 		}).catch((error) => ({
@@ -34891,7 +35344,7 @@ async function readStaleAttributes(logicalId, resource, stackName) {
 		resourceType: resource.resourceType,
 		attributes
 	});
-	this.logger.debug(`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS — its state record lacked one a Fn::GetAtt asked for (#1852): ${Object.keys(attributes).length} attribute(s) read`);
+	this.logger.debug(`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS — its state record lacked one a Fn::GetAtt asked for: ${Object.keys(attributes).length} attribute(s) read`);
 	return outcome;
 }
 function withHealedAttributes(logicalId, record) {
@@ -35240,9 +35693,9 @@ async function refuseUnlicensedGeneratedName(input) {
 			}], recoveryCommandFlags(this.options.refusalRecovery).flags).command}\``;
 			if (verdict.ownIntent !== void 0) {
 				const why = verdict.ownIntent === "abandoned" ? "a deploy of this stack that was killed or force-unlocked" : "a create of this stack that came back failed (a timeout or a server error)";
-				return refuse(`${subject} would be created with ${named}, which an existing resource (${displaySafe(verdict.holder)}) already holds. This stack's create-token ledger records that ${why} sent this name, but this type reports no creation time, so cdkd cannot tell that resource is the one it made rather than another deployment's created since. Since ${adoptsText}, creating it would take that resource over. ${displaySafe(logicalId)} was not created. The likely cause: the resource is this stack's own, from that deploy. If it is, ${importLine} and re-run; if it is not, this stack is also deployed under another state backend (go-to-k/cdkd#4705).`);
+				return refuse(`${subject} would be created with ${named}, which an existing resource (${displaySafe(verdict.holder)}) already holds. This stack's create-token ledger records that ${why} sent this name, but this type reports no creation time, so cdkd cannot tell that resource is the one it made rather than another deployment's created since. Since ${adoptsText}, creating it would take that resource over. ${displaySafe(logicalId)} was not created. The likely cause: the resource is this stack's own, from that deploy. If it is, ${importLine} and re-run; if it is not, this stack is also deployed under another state backend.`);
 			}
-			return refuse(`${subject} would be created with ${named}, which an existing resource (${displaySafe(verdict.holder)}) already holds, and nothing this stack records names that resource: not its state, its rollback journal or create-token ledger, nor what a destroy of it under this state prefix kept. Since ${adoptsText}, creating it would take that resource over, as CloudFormation refuses with "already exists". ${displaySafe(logicalId)} was not created. The likely cause: this stack is also deployed under another state backend (another --state-prefix, --state-bucket or account), where cdkd generates the same names. One stack name per account and region is supported (go-to-k/cdkd#4705): deploy it under one backend only, or give this stack another name. If the resource is this stack's own, ${importLine} and re-run.`);
+			return refuse(`${subject} would be created with ${named}, which an existing resource (${displaySafe(verdict.holder)}) already holds, and nothing this stack records names that resource: not its state, its rollback journal or create-token ledger, nor what a destroy of it under this state prefix kept. Since ${adoptsText}, creating it would take that resource over, as CloudFormation refuses with "already exists". ${displaySafe(logicalId)} was not created. The likely cause: this stack is also deployed under another state backend (another --state-prefix, --state-bucket or account), where cdkd generates the same names. One stack name per account and region is supported: deploy it under one backend only, or give this stack another name. If the resource is this stack's own, ${importLine} and re-run.`);
 		}
 	}
 }
@@ -36246,7 +36699,7 @@ var DynamoDBGlobalTableProvider = class {
 					const droppedOverrides = [];
 					if (oldReplicaOverrides.OnDemandThroughputOverride && !replicaOverrides.OnDemandThroughputOverride) droppedOverrides.push("ReadOnDemandThroughputSettings");
 					if (oldReplicaOverrides.ProvisionedThroughputOverride && !replicaOverrides.ProvisionedThroughputOverride) droppedOverrides.push("ReadProvisionedThroughputSettings");
-					if (droppedOverrides.length > 0) warn(`Cross-region replica ${region} of ${physicalId}: the template no longer declares ${droppedOverrides.map((o) => maskSecrets(o)).join(" / ")}, but DynamoDB offers no way to CLEAR a replica-level throughput override — a -1 sentinel is stored literally, and an empty override block wedges the table in UPDATING (both live-probed, issue #1436). The previous override is STILL IN EFFECT on AWS. Set an explicit value, or remove and re-add the replica, to change it.`);
+					if (droppedOverrides.length > 0) warn(`Cross-region replica ${region} of ${physicalId}: the template no longer declares ${droppedOverrides.map((o) => maskSecrets(o)).join(" / ")}, but DynamoDB offers no way to CLEAR a replica-level throughput override — a -1 sentinel is stored literally, and an empty override block wedges the table in UPDATING. The previous override is STILL IN EFFECT on AWS. Set an explicit value, or remove and re-add the replica, to change it.`);
 				}
 				if (replica["TableClassOverride"]) updateAction.TableClassOverride = replica["TableClassOverride"];
 				if (!(updateAction.KMSMasterKeyId !== void 0 || updateAction.GlobalSecondaryIndexes !== void 0 || updateAction.TableClassOverride !== void 0 || updateAction.ProvisionedThroughputOverride !== void 0 || updateAction.OnDemandThroughputOverride !== void 0)) {
@@ -36749,7 +37202,7 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		try {
 			if (hasTransitionalIndex(preDeleteIndexes)) {
-				this.logger.debug(`Waiting for indexes on ${physicalId} to settle before DeleteTable (issue #1521)`);
+				this.logger.debug(`Waiting for indexes on ${physicalId} to settle before DeleteTable`);
 				await this.waitForIndexesActive(physicalId, logicalId, {
 					proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE,
 					budget
@@ -38680,14 +39133,14 @@ const REMEDY = "To move a custom resource to a different handler, give it a new
 const UNJUDGEABLE_REMEDY = `Where the recorded ServiceToken is unreadable and the handler did not change, put the ARN of the handler that created this resource (the one it was last deployed with, not the one the template names now) back as ServiceToken in state.json (a ServiceToken fed by a NoEcho parameter is recorded only as '${"***"}': feed it from a plain value) and re-deploy.`;
 function renderServiceTokenRefusal(refusals, stackName, mask = (text) => text) {
 	const rows = refusals.map((refusal) => `  - ${rowText(refusal, mask)}`);
-	return `Refusing to deploy ${stackName}: ` + (refusals.length === 1 ? `a custom resource's ServiceToken changes` : `${refusals.length} custom resources' ServiceTokens change`) + `, which CloudFormation does not allow ("Modifying service token is not allowed") (issue #4749). Nothing was sent to either handler.
+	return `Refusing to deploy ${stackName}: ` + (refusals.length === 1 ? `a custom resource's ServiceToken changes` : `${refusals.length} custom resources' ServiceTokens change`) + `, which CloudFormation does not allow ("Modifying service token is not allowed"). Nothing was sent to either handler.
 ${rows.join("\n")}\n  ${REMEDY}` + (refusals.some((refusal) => refusal.kind === "unjudgeable") ? `\n  ${UNJUDGEABLE_REMEDY}` : "");
 }
 function serviceTokenBlockingReason(refusal, mask) {
-	return `${rowText(refusal, mask)} cdkd deploy refuses a changed custom-resource ServiceToken, as CloudFormation does (issue #4749); give the custom resource a new logical id to move it to another handler.`;
+	return `${rowText(refusal, mask)} cdkd deploy refuses a changed custom-resource ServiceToken, as CloudFormation does; give the custom resource a new logical id to move it to another handler.`;
 }
 function deferredServiceTokenWarning(row) {
-	return `${displayIdent(row.logicalId)}: its ServiceToken reads a resource this deploy replaces, creates or updates, or a value this preview cannot resolve. If it resolves to a different ARN than the one recorded, cdkd deploy refuses the update before invoking any handler and rolls back (issue #4749). A replaced backing function is already deleted by then and the rollback re-creates it; if that fails, the record names a function that no longer exists.`;
+	return `${displayIdent(row.logicalId)}: its ServiceToken reads a resource this deploy replaces, creates or updates, or a value this preview cannot resolve. If it resolves to a different ARN than the one recorded, cdkd deploy refuses the update before invoking any handler and rolls back. A replaced backing function is already deleted by then and the rollback re-creates it; if that fails, the record names a function that no longer exists.`;
 }
 
 //#endregion
@@ -40304,16 +40757,29 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			this.logger.info(`${cyan("Deploying")} ${cyan(createUpdateIds.length)} resource(s) (DAG: ${executionLevels.length} levels, max parallel: ${concurrency})`);
 			const createUpdateExecutor = new DagExecutor();
 			const provisionable = new Set(createUpdateIds);
+			const createUpdateDeps = /* @__PURE__ */ new Map();
 			for (const id of createUpdateIds) {
 				const allDeps = this.dagBuilder.getDirectDependencies(dag, id);
-				const deps = new Set(allDeps.filter((d) => provisionable.has(d)));
-				createUpdateExecutor.add({
-					id,
-					dependencies: deps,
-					state: "pending",
-					data: changes.get(id)
-				});
+				createUpdateDeps.set(id, new Set(allDeps.filter((d) => provisionable.has(d))));
 			}
+			const levelOf = /* @__PURE__ */ new Map();
+			executionLevels.forEach((level, at) => {
+				for (const id of level) levelOf.set(id, at);
+			});
+			for (const { before, after } of orderInlinePolicyWriters({
+				writes: createUpdateIds,
+				changes,
+				templateResources: template.Resources ?? {},
+				stateResources: currentState.resources,
+				dependencies: createUpdateDeps,
+				rank: (id) => levelOf.get(id) ?? Number.MAX_SAFE_INTEGER
+			})) this.logger.debug(safeMsg`${after} waits for ${before}: both write an inline policy name on the same IAM principal`);
+			for (const id of createUpdateIds) createUpdateExecutor.add({
+				id,
+				dependencies: createUpdateDeps.get(id),
+				state: "pending",
+				data: changes.get(id)
+			});
 			const enqueueLostChildren = (executor) => {
 				const lostIds = noChangeChildrenOfRecreatedParents({
 					changes,
@@ -42177,7 +42643,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 				const persistExportSet = new Set(exportNamesToPersist ?? []);
 				const exportSetChanged = exportNamesToPersist !== void 0 && (currentEffectiveExports.size !== persistExportSet.size || [...persistExportSet].some((k) => !currentEffectiveExports.has(k)));
 				if (merge?.kind === "kept" && !outputMapsEqual(persistedOutputs, resolvedOutputs)) this.logger.warn(`Outputs changed but one or more could not be resolved; keeping the previously persisted outputs. ${keptWholeReasonText(merge.reason)} A downstream Fn::ImportValue may fail until the next deploy.`);
-				else if (merge?.kind === "merged" && merge.carriedKeys.length > 0) this.logger.debug(`Kept the previously persisted value of ${merge.carriedKeys.length} output key(s), carried export aliases included, that could not be resolved (no-change path, #2771)`);
+				else if (merge?.kind === "merged" && merge.carriedKeys.length > 0) this.logger.debug(`Kept the previously persisted value of ${merge.carriedKeys.length} output key(s), carried export aliases included, that could not be resolved (no-change path)`);
 				const skippedOutputsChanged = !skippedOutputsEqual(currentState.skippedOutputs, this.skippedOutputs);
 				const healedAttributesPending = this.hasUnpersistedHeals(currentState.resources);
 				const conditionVerdictsChanged = !conditionVerdictRecordsEqual(readRecordedConditionVerdicts(currentState), conditionVerdicts);
@@ -42206,14 +42672,14 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 					if (outputsChanged || exportSetChanged) {
 						persistedOutputs = refreshedState.outputs;
 						if (outputsChanged) this.logger.info("Persisted Outputs-only change (no resource diff).");
-						else this.logger.debug("Persisted export-set change (no outputs-value diff, no-change path, #2193)");
+						else this.logger.debug("Persisted export-set change (no outputs-value diff, no-change path)");
 						if (this.exportIndexStore) await this.exportIndexStore.updateForStack(stackName, this.stackRegion, importableOutputs({
 							...refreshedState,
 							outputs: this.redactOutputs(refreshedState.outputs)
 						}));
 					} else if (observedRefresh) this.logger.debug("Persisted refreshed observedProperties (no-change path)");
-					else if (healedAttributesPending) this.logger.debug("Persisted attributes re-read from AWS for a stale record (no-change path, #1852)");
-					else this.logger.debug("Persisted skipped-outputs record (no outputs-value diff, no-change path, #2740)");
+					else if (healedAttributesPending) this.logger.debug("Persisted attributes re-read from AWS for a stale record (no-change path)");
+					else this.logger.debug("Persisted skipped-outputs record (no outputs-value diff, no-change path)");
 				} catch (saveError) {
 					this.logger.warn(`Failed to persist no-change state update: ${saveError instanceof Error ? saveError.message : String(saveError)} — drift baseline / outputs will be re-resolved on next deploy.`);
 				}
@@ -42761,7 +43227,7 @@ var DeployEngine = class {
 		};
 	}
 	inlinePolicyClaimedFor(resourceType, logicalId, stateResources) {
-		if (resourceType !== "AWS::IAM::Policy") return void 0;
+		if (resourceType !== "AWS::IAM::Policy" && !isInlinePolicyPrincipalType(resourceType)) return;
 		const args = {
 			selfLogicalId: logicalId,
 			writers: this.inlinePolicyWriters,
@@ -42908,5 +43374,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { getPriorAttempts as $, coerceCfnBoolean as $a, processStackMessages as $c, malformedScrubResourceEntriesRefusalMessage as $i, reserveStackCreateToken as $n, inheritNestedStackParameterAssociations as $o, envCredentialsAreAssumedRole as $r, parseBootstrapMarker as $s, orphanDeleteNeedsIdentity as $t, noEchoExactEchoLeavesOf as A, repairMalformedResourcePropertiesForReadOnly as Aa, resolveApp as Ac, displayLogicalId as Ai, maskEventTextWithBoundBags as An, valueAtCoordinate as Ao, markWaitAbandoned as Ar, hasReadableExportSet as As, isHandledOrphan as At, beginDeleteWait as B, NO_CC_HANDLERS_REASON as Ba, CFN_TEMPLATE_BODY_LIMIT as Bc, malformedLocalResourceEntriesWarning as Bi, ccRoutedFinalSnapshotError as Bn, shareLogOnlyValues as Bo, poisonRenderedSpellingsCollidingIn as Br, isSensitiveAttributeName as Bs, withStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedResourcesForDestroy as Ca, AssetManifestLoader as Cc, JSON_LISTING_HOLE_VALUE as Ci, collectPublishedOutputNames as Cn, maskedLeafCoordinatesOf as Co, unchangedBehindSecretReference as Cr, crossPrefixDeniedWarning as Cs, revertedNestedRowIds as Ct, withResourceDeadline as D, repairMalformedOrphansForReadOnly as Da, getDefaultStateBucketName as Dc, UNREADABLE_RESOURCES_MAP_ROW as Di, DEFAULT_RESOURCE_WARN_AFTER_MS as Dn, passedNoEchoParametersOf as Do, deleteSkipReason as Dr, acceptedCreateOnlyDropsOf as Ds, withNestedStackContext as Dt, serviceTokenBlockingReason as E, repairMalformedOrphanRecordsForReadOnly as Ea, synthesisStatusMessage as Ec, UNREADABLE_ORPHANS_CONTAINER_ROW as Ei, DEFAULT_RESOURCE_TIMEOUT_MS as En, noEchoOutputsComparison as Eo, deleteLeftInPlace as Er, splitImportedOps as Es, getCurrentNestedStackContext as Et, isProtectionValueActive as F, withheldAccountClause as Fa, resolveStateBucketWithDefaultAndSource as Fc, isReadableResourceEntry as Fi, storedSecretNameNeedles as Fn, literalSplitDelimitersOf as Fo, reDisableInstanceApiTermination as Fr, isReadableBag as Fs, replayFailedOperations as Ft, DELETE_INDEX_WAIT_PROCEED_NOTE as G, isStatefulRecreateTargetForReplace as Ga, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Gc, malformedOrphansRefusalMessage as Gi, unsupportedFinalSnapshotError as Gn, markSameGenerationBag as Go, assertFlagRoleArn as Gr, loadPublishableAssetManifest as Gs, isReplacementOrphan as Gt, deleteBudgetKey as H, findReplacedReadersOfRecreateTargets as Ha, MIGRATE_TMP_PREFIX as Hc, malformedOrphanRecordsRefusalMessage as Hi, effectiveDeletionPolicy as Hn, errorCauseChain as Ho, producerRegionsFromState as Hr, WorkGraph as Hs, recordAfterRollbackUpdate as Ht, perType as I, findActionableSilentDrops as Ia, resolveUseCdkBootstrapAssets as Ic, malformedDriftResourcePropertiesWarning as Ii, extractDeploymentEventError as In, logOnlyValueCount as Io, reEnableInstanceApiTermination as Ir, orphansAfterRollback as Is, replayRollback as It, waitForIndexesSettled as J, WARM_THROUGHPUT_MEMBERS as Ja, PARTITION_TABLE as Jc, malformedOutputsWarning as Ji, findDestructiveChanges as Jn, DYNAMIC_REFERENCE_TOKEN_SCAN as Jo, isIamRoleArn as Jr, BOOTSTRAP_MARKER_PREFIX as Js, recheckFailedPlan as Jt, INDEX_SETTLE_POLL_INTERVAL_MS as K, isStatefulRecreateTargetSync as Ka, decodeListingKey as Kc, malformedOrphansWarning as Ki, maskingRetryLogger as Kn, redactSecretsForState as Ko, assertSendableRoleArn as Kr, rewriteTemplateAssetReferences as Ks, planFailedOps as Kt, readProtection as L, findSilentDropProperties as La, stateBucketExistenceConfirmed as Lc, malformedExportNamesWarning as Li, ATOMIC_FINAL_SNAPSHOT_TYPES as Ln, printingCorpusOf as Lo, DiffCalculator as Lr, orphansCarriedFrom as Ls, awaitInFlightSibling as Lt, recordedProtectionEvidence as M, unpreviewableOrphanRecords as Ma, resolveCaptureObservedState as Mc, hasReadableOutputs as Mi, secretNamePrintingBag as Mn, carryLogOnlyValues as Mo, ec2InstanceProtectionSite as Mr, hasUnverifiableParameterRefusal as Ms, loadJournaledOrphans as Mt, recordedProtectionNote as N, unreadableOrphanRecords as Na, resolveSkipPrefix as Nc, hasReadableResources as Ni, secretNamedRecordNeedles as Nn, createUnionSecretMasker as No, isTerminationProtectionPropagationError as Nr, importableOutputKeys as Ns, makeForeignHolderScan as Nt, noEchoAttributeNamesOf as O, repairMalformedOutputsForReadOnly as Oa, getLegacyStateBucketName as Oc, accountArgs as Oi, completedReplayEntries as On, readbackPathFor as Oo, withIndeterminateGuard as Or, describeRegionValueKind as Os, deleteJournaledOrphans as Ot, PROTECTION_PROPERTY_BY_TYPE as P, unreadableResourceEntries as Pa, resolveStateBucketWithDefault as Pc, isReadableOrphanRecord as Pi, stateSecretNameNeedles as Pn, hasMaskableValues as Po, observeThenDisableInstanceApiTermination as Pr, importableOutputs as Ps, sameJournaledOrphans as Pt, isTruthyCfnBoolean as Q, toFiniteNumber as Qa, StageLoadError as Qc, malformedResourcesWarning as Qi, ledgerForStack as Qn, identityKeyFor as Qo, callerEnvCredentials as Qr, isCrossRegionRedirect as Qs, seedsDeleteFirstGuard as Qt, DynamoDBGlobalTableProvider as R, unwrittenCreateOnlyReplacement as Ra, warnDeprecatedNoPrefixCliFlag as Rc, malformedExportSourceWarning as Ri, PRE_DELETE_SNAPSHOT_TYPES as Rn, recordLogOnlyParameterValue as Ro, INTRINSIC_KEYS as Rr, shouldRetainResource as Rs, destroyStackRecordsView as Rt, keptForReadoption as S, refuseMalformedResourcesForDeploy as Sa, stripControlChars as Sc, passedParameterClassesOf as Si, collectDeclaredOutputNames as Sn, maskWholeValue as So, slowCcOperationTimeoutMs as Sr, applyCrossPrefixScan as Ss, revertNestedChildFromJournal as St, findServiceTokenRefusals as T, refuseMalformedState as Ta, Synthesizer as Tc, STATE_RESOURCES_MALFORMED as Ti, bindingSkippedOutputs as Tn, noEchoLeavesOf as To, deleteIndeterminateGuards as Tr, isNotImplemented as Ts, collectNestedChildUnaddressed as Tt, resolveDynamoDbDeleteBudgetClock as U, shownType as Ua, findLargeInlineResources as Uc, malformedOrphanRecordsWarning as Ui, isFinalSnapshotError as Un, maskSecretsInError as Uo, regionLessSecretName as Ur, buildAssetRedirectMap as Us, demoteSupersededOrphans as Ut, compensateRemovedDeletionProtection as V, hasNoCloudControlHandlers as Va, CFN_TEMPLATE_URL_LIMIT as Vc, malformedLocalResourcesWarning as Vi, createPreDeleteFinalSnapshot as Vn, createSecretMasker as Vo, classifyReplaySecretRegion as Vr, stringifyValue as Vs, removeProtectionTypeList as Vt, resolveDynamoDbDeleteBudgetMs as W, MULTI_REGION_RECREATE_BLOCKED_TYPES as Wa, uploadCfnTemplate as Wc, malformedOrphanRowsKeptWarning as Wi, refusesFinalSnapshot as Wn, maskSecretsInText as Wo, applyRoleArnIfSet as Wr, createAssetRedirectResolver as Ws, isJournaledOrphan as Wt, S3_AUTO_DELETE_OBJECTS_TAG as X, isWarmThroughputDecrease as Xa, derivePartitionAndUrlSuffix as Xc, malformedResourceEntriesWarning as Xi, RollbackInlinePolicyWriters as Xn, isUncertifiedBaselineMaskPosition as Xo, AWS_CREDENTIAL_ENV_KEYS as Xr, ensureAssetStorage as Xs, replacementNeverSwapped as Xt, ECR_AUTO_DELETE_IMAGES_TAG as Y, coerceWarmThroughput as Ya, canonicalizeRegion as Yc, malformedRenderedContainersWarning as Yi, formatDestructiveChange as Yn, dynamicReferenceTokens as Yo, sendableAssumeRoleCommand as Yr, assertAssetBucketRegion as Ys, recordUnderIdIsNotOwn as Yt, hasCdkAutoDeleteTag as Z, toCfnInteger as Za, AssemblyReader as Zc, malformedResourcePropertiesWarning as Zi, earliestDefined as Zn, pathCrossesDottedKey as Zo, applyCallerIdentityCredentials as Zr, getBootstrapMarkerKey as Zs, resolveReplacementOldType as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedResourceEntriesForOrphan as _a, redactedDockerCause as _c, isStalePlaceholderArnAttribute as _i, carriedExportAliasExposure as _n, TemplateParser as _o, readsNoEchoDeleteValues as _r, isLockInfoExpired as _s, displacedPhysicalIdShown as _t, findNestedTemplateTreeDefect as a, refuseMalformedOrphanRecordsForDestroy as aa, resolveDockerContextDirectory as ac, s3BucketWebsiteUrl as ai, absoluteAssemblyPathEscape as al, redactedDeleteAddressFields as an, replayWarn as ao, readTagList as ar, recordMaskOnlyValuesIn as as, gray as at, lookupEachName as b, refuseMalformedResourcePropertiesForExport as ba, warnFinchArgvExposure as bc, withSharedDrainBudget as bi, isWholeDynamicReferenceValue as bn, maskAtCoordinates as bo, withPrintingSecrets as br, CrossPrefixReadError as bs, nestedChildStackName as bt, renderNestedTemplateTreeDefect as c, refuseMalformedOrphansForOrphan as ca, describeDockerFailure as cc, parameterTypeMayLoseSecretIdentity as ci, renderAssemblyPathEscape as cl, updatePartialReason as cn, requireConfigString as co, tagPlanWarning as cr, recordProvenPublicExpression as cs, yellow as ct, conditionInputsFrom as d, refuseMalformedResourceAttributesForOrphan as da, formatDockerLoginError as dc, carriesDynamicReference as di, resolveBucketRegion as dl, WITHHELD_NAME_DISPLAY as dn, describeTypeWithThrottleRetry as do, CC_BROKEN_REASON as dr, STATE_SOURCED_CROSS_GENERATION_RULES as ds, reachableDivergentParameters as dt, malformedStateRefusalMessage as ea, readBootstrapMarkerBody as ec, isSettledInstanceState as ei, defineOwnKey as el, findNestedStackTypeChanges as en, coerceCfnInteger as eo, withCreateTokenLedger as er, recordNestedStackParameterExpressions as es, markRefusedBeforeApplying as et, parentSuppliedValues as f, refuseMalformedResourceEntries as fa, getDockerCmd as fc, carriesFetchableDynamicReference as fi, displayTextOrWithheld as fn, withRetry as fo, ProviderRegistry as fr, STATE_SOURCED_READBACK_RULES as fs, resourcesNamingDeclaredParameter as ft, mergeNoChangeOutputs as g, refuseMalformedResourceEntriesForImportSave as ga, redactDockerArgvValues as gc, cfnRefValueFromPhysicalId as gi, secretSafeKeyDisplay as gn, DagBuilder as go, TemplateNoEchoReresolver as gr, LockManager as gs, displacedOpClause as gt, keptWholeReasonText as h, refuseMalformedResourceEntriesForImport as ha, partitionSensitiveEnv as hc, AWS_NO_VALUE as hi, secretBearingStateKeyWarning as hn, sameLambdaFunctionAddress as ho, wouldReturnToSdkProvider as hr, isSingleDynamicReferenceToken as hs, NESTED_PENDING_PARENT_REASON as ht, childTemplateLoader as i, refuseMalformedOrphanRecords as ia, buildDockerImage as ic, s3BucketRegionalDomainName as ii, ownValue as il, isRedactedRecordedValue as in, readConfigString as io, planTagDiff as ir, recordMaskOnlyValue as is, cyan as it, noEchoParameterNamesOf as j, repairMalformedResourcesForReadOnly as ja, resolveAutoAssetStorage as jc, hasReadableOrphans as ji, orphanRecordsPrintingBag as jn, liveMatchesUnresolvedTokenFrame as jo, disableInstanceApiTermination as jr, hasReasonlessBaselineRefusal as js, journaledOrphanLines as jt, noEchoComparisonForTemplate as k, repairMalformedResourceEntriesForReadOnly as ka, loadCdkJson as kc, deployRefusesOrphanRowsReason as ki, journaledOrphanPrintingBag as kn, readsNoEchoSource as ko, isWaitAbandonedError as kr, exportNamesCarriedFrom as ks, dropFailedHint as kt, templateIdentity as l, refuseMalformedOutputs as la, dockerSpawnEnvWithSensitive as lc, getAccountInfo as li, resolveAssemblyPath as ll, DeploymentEventsReader as ln, prefetchCreateOnlyPropertyPaths as lo, definedAttributes as lr, wholeStringLeavesOf as ls, computeParameterTaint as lt, isSecretBearingReferenceString as m, refuseMalformedResourceEntriesForDestroy as ma, isMalformedEnvKey as mc, keepsSecretReferenceToken as mi, secretBearing as mn, lambdaFunctionNameForMask as mo, isCustomResource as mr, WHOLE_DYNAMIC_REFERENCE_PATTERN as ms, planOrphanAdoption as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseDivergentRecordRegionForDestroy as na, validateContainerRepoName as nc, s3BucketDomainName as ni, hasPlainPrototype$1 as nl, inheritProducerRegions as nn, configIntegerRefusal as no, DBPROXY_TAGS_WHAT as nr, carriesSecretMask as ns, createReadOnlyAttributeHealerFactory as nt, isAbsoluteAssetPath as o, refuseMalformedOrphans as oa, describeDockerCapturedOutput as oc, coerceParameterTypedValue as oi, describeFileReadFailure as ol, redactedDeleteAddressSkip as on, requireConfigArray as oo, refuseMalformedDesiredTags as or, recordNoEchoAttributeValues as os, green as ot, readRecordedConditionVerdicts as p, refuseMalformedResourceEntriesForDeploy as pa, isDockerClientEnvKey as pc, isNamelessDynamicReferenceError as pi, exportAliasCollisionScrubWarning as pn, canonicalLambdaFunctionName as po, ccBrokenReason as pr, TEMPLATE_SOURCED_RULES as ps, makeSiblingClaimReader as pt, deleteTableWithIndexBusyRetry as q, renderStatefulReason as qa, expectedOwnerParam as qc, malformedOutputsRefusalMessage as qi, constructPathOf as qn, scrubResourceRecord as qo, explicitRoleArnOrThrow as qr, AssetModeResolver as qs, planRollback as qt, computeImplicitDeleteEdges as r, refuseMalformedNestedChildOutputs as ra, buildDenyExternalAccessPolicy as rc, s3BucketDualStackDomainName as ri, nullPrototypeRecord as rl, REDACTED_DELETE_ADDRESS_SKIP_REASON as rn, configStringRefusal as ro, DBPROXY_TAG_OPTIONS as rr, provenPublicValue as rs, bold as rt, listNestedTemplateRows as s, refuseMalformedOrphansForDestroy as sa, describeDockerExecFailure as sc, isUnboundTemplateParameter as si, displayAssemblyPath as sl, updatePartialMessage as sn, requireConfigObject as so, tagMapAsList as sr, recordNoEchoParameterFreshValue as ss, red as st, DeployEngine as t, previewableOrphanRecords as ta, validateAssetBucketName as tc, s3BucketArn as ti, hasOwnKey as tl, getCurrentProducerRegions as tn, configBooleanRefusal as to, acquireIdempotencyToken as tr, recoverMaskedOutput as ts, formatResourceLine as tt, conditionFingerprint as u, refuseMalformedOutputsForDestroy as ua, finchSecretArgvRefusal as uc, isImpossibleEmptyStoredAttribute as ui, clearBucketRegionCache as ul, DeploymentEventsStore as un, templateResourceTypes as uo, stringifyIfAssigned as ur, STATE_SOURCED_BASELINE_RULES as us, namesAnyDeclaredParameter as ut, chunks as v, refuseMalformedResourcePropertiesForDestroy as va, runDockerForeground as vc, refStateLookupFromResource as vi, exportNameNoEchoParameters as vn, canonicalCoordinates as vo, isCustomResourceType as vr, S3StateBackend as vs, dropSettledNestedJournals as vt, deferredServiceTokenWarning as w, refuseMalformedResourcesForExport as wa, getDockerImageBySourceHash as wc, STATE_REGION_DIVERGED as wi, isExportAliasCollision as wn, noEchoCoordinatesOf as wo, UNSPECIFIED_SKIP_REASON as wr, isAccessDenied as ws, withNestedRevertRun as wt, withApiLimit as x, refuseMalformedResourcePropertiesForOrphan as xa, escapeRegExp$3 as xc, parameterInputsFor as xi, noEchoParameterValueSeed as xn, maskReadbackAtCoordinates as xo, CloudControlProvider as xr, CrossPrefixScanCache as xs, recordDisplacedSkips as xt, isAccessDeniedError as y, refuseMalformedResourcePropertiesForDrift as ya, runDockerStreaming as yc, parseWebACLArn as yi, exportNameSecretExposure as yn, isMarkedCoordinate as yo, getCurrentResourceSecrets as yr, rebuildClientForBucketRegion as ys, getNestedRevertRun as yt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as z, withoutSilentDropProperties as za, ssmResolvedValueType as zc, malformedLocalOutputsWarning as zi, buildFinalSnapshotIdentifier as zn, recordLogOnlyValue as zo, IntrinsicFunctionResolver as zr, AssetPublisher as zs, getStackRecords as zt };
-//# sourceMappingURL=deploy-engine-5FFXg6ih.js.map
+export { getPriorAttempts as $, isWarmThroughputDecrease as $a, derivePartitionAndUrlSuffix as $c, malformedResourceEntriesWarning as $i, reserveStackCreateToken as $n, isUncertifiedBaselineMaskPosition as $o, AWS_CREDENTIAL_ENV_KEYS as $r, ensureAssetStorage as $s, orphanDeleteNeedsIdentity as $t, noEchoExactEchoLeavesOf as A, repairMalformedOrphansForReadOnly as Aa, getDefaultStateBucketName as Ac, UNREADABLE_RESOURCES_MAP_ROW as Ai, maskEventTextWithBoundBags as An, passedNoEchoParametersOf as Ao, deleteSkipReason as Ar, acceptedCreateOnlyDropsOf as As, isHandledOrphan as At, beginDeleteWait as B, findSilentDropProperties as Ba, stateBucketExistenceConfirmed as Bc, malformedExportNamesWarning as Bi, ccRoutedFinalSnapshotError as Bn, printingCorpusOf as Bo, DiffCalculator as Br, orphansCarriedFrom as Bs, withStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedResourcePropertiesForExport as Ca, warnFinchArgvExposure as Cc, withSharedDrainBudget as Ci, collectPublishedOutputNames as Cn, maskAtCoordinates as Co, customResourceResponseExpirationWarning as Cr, CrossPrefixReadError as Cs, revertedNestedRowIds as Ct, withResourceDeadline as D, refuseMalformedResourcesForExport as Da, getDockerImageBySourceHash as Dc, STATE_REGION_DIVERGED as Di, DEFAULT_RESOURCE_WARN_AFTER_MS as Dn, noEchoCoordinatesOf as Do, UNSPECIFIED_SKIP_REASON as Dr, isAccessDenied$1 as Ds, withNestedStackContext as Dt, serviceTokenBlockingReason as E, refuseMalformedResourcesForDestroy as Ea, AssetManifestLoader as Ec, JSON_LISTING_HOLE_VALUE as Ei, DEFAULT_RESOURCE_TIMEOUT_MS as En, maskedLeafCoordinatesOf as Eo, unchangedBehindSecretReference as Er, crossPrefixDeniedWarning as Es, getCurrentNestedStackContext as Et, isProtectionValueActive as F, unpreviewableOrphanRecords as Fa, resolveCaptureObservedState as Fc, hasReadableOutputs as Fi, storedSecretNameNeedles as Fn, carryLogOnlyValues as Fo, ec2InstanceProtectionSite as Fr, hasUnverifiableParameterRefusal as Fs, replayFailedOperations as Ft, DELETE_INDEX_WAIT_PROCEED_NOTE as G, findReplacedReadersOfRecreateTargets as Ga, MIGRATE_TMP_PREFIX as Gc, malformedOrphanRecordsRefusalMessage as Gi, unsupportedFinalSnapshotError as Gn, errorCauseChain as Go, producerRegionsFromState as Gr, WorkGraph as Gs, isReplacementOrphan as Gt, deleteBudgetKey as H, withoutSilentDropProperties as Ha, ssmResolvedValueType as Hc, malformedLocalOutputsWarning as Hi, effectiveDeletionPolicy as Hn, recordLogOnlyValue as Ho, IntrinsicFunctionResolver as Hr, AssetPublisher as Hs, recordAfterRollbackUpdate as Ht, perType as I, unreadableOrphanRecords as Ia, resolveSkipPrefix as Ic, hasReadableResources as Ii, extractDeploymentEventError as In, createUnionSecretMasker as Io, isTerminationProtectionPropagationError as Ir, importableOutputKeys as Is, replayRollback as It, waitForIndexesSettled as J, isStatefulRecreateTargetForReplace as Ja, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Jc, malformedOrphansRefusalMessage as Ji, findDestructiveChanges as Jn, markSameGenerationBag as Jo, assertFlagRoleArn as Jr, loadPublishableAssetManifest as Js, recheckFailedPlan as Jt, INDEX_SETTLE_POLL_INTERVAL_MS as K, shownType as Ka, findLargeInlineResources as Kc, malformedOrphanRecordsWarning as Ki, maskingRetryLogger as Kn, maskSecretsInError as Ko, regionLessSecretName as Kr, buildAssetRedirectMap as Ks, planFailedOps as Kt, readProtection as L, unreadableResourceEntries as La, resolveStateBucketWithDefault as Lc, isReadableOrphanRecord as Li, ATOMIC_FINAL_SNAPSHOT_TYPES as Ln, hasMaskableValues as Lo, observeThenDisableInstanceApiTermination as Lr, importableOutputs as Ls, awaitInFlightSibling as Lt, recordedProtectionEvidence as M, repairMalformedResourceEntriesForReadOnly as Ma, loadCdkJson as Mc, deployRefusesOrphanRowsReason as Mi, secretNamePrintingBag as Mn, readsNoEchoSource as Mo, isWaitAbandonedError as Mr, exportNamesCarriedFrom as Ms, loadJournaledOrphans as Mt, recordedProtectionNote as N, repairMalformedResourcePropertiesForReadOnly as Na, resolveApp as Nc, displayLogicalId as Ni, secretNamedRecordNeedles as Nn, valueAtCoordinate as No, markWaitAbandoned as Nr, hasReadableExportSet as Ns, makeForeignHolderScan as Nt, noEchoAttributeNamesOf as O, refuseMalformedState as Oa, Synthesizer as Oc, STATE_RESOURCES_MALFORMED as Oi, completedReplayEntries as On, noEchoLeavesOf as Oo, deleteIndeterminateGuards as Or, isNotImplemented as Os, deleteJournaledOrphans as Ot, PROTECTION_PROPERTY_BY_TYPE as P, repairMalformedResourcesForReadOnly as Pa, resolveAutoAssetStorage as Pc, hasReadableOrphans as Pi, stateSecretNameNeedles as Pn, liveMatchesUnresolvedTokenFrame as Po, disableInstanceApiTermination as Pr, hasReasonlessBaselineRefusal as Ps, sameJournaledOrphans as Pt, isTruthyCfnBoolean as Q, coerceWarmThroughput as Qa, canonicalizeRegion as Qc, malformedRenderedContainersWarning as Qi, ledgerForStack as Qn, dynamicReferenceTokens as Qo, sendableAssumeRoleCommand as Qr, assertAssetBucketRegion as Qs, seedsDeleteFirstGuard as Qt, DynamoDBGlobalTableProvider as R, withheldAccountClause as Ra, resolveStateBucketWithDefaultAndSource as Rc, isReadableResourceEntry as Ri, PRE_DELETE_SNAPSHOT_TYPES as Rn, literalSplitDelimitersOf as Ro, reDisableInstanceApiTermination as Rr, isReadableBag as Rs, destroyStackRecordsView as Rt, keptForReadoption as S, refuseMalformedResourcePropertiesForDrift as Sa, runDockerStreaming as Sc, parseWebACLArn as Si, collectDeclaredOutputNames as Sn, isMarkedCoordinate as So, applyCustomResourceResponseExpiration as Sr, rebuildClientForBucketRegion as Ss, revertNestedChildFromJournal as St, findServiceTokenRefusals as T, refuseMalformedResourcesForDeploy as Ta, stripControlChars as Tc, passedParameterClassesOf as Ti, bindingSkippedOutputs as Tn, maskWholeValue as To, slowCcOperationTimeoutMs as Tr, applyCrossPrefixScan as Ts, collectNestedChildUnaddressed as Tt, resolveDynamoDbDeleteBudgetClock as U, NO_CC_HANDLERS_REASON as Ua, CFN_TEMPLATE_BODY_LIMIT as Uc, malformedLocalResourceEntriesWarning as Ui, isFinalSnapshotError as Un, shareLogOnlyValues as Uo, poisonRenderedSpellingsCollidingIn as Ur, isSensitiveAttributeName as Us, demoteSupersededOrphans as Ut, compensateRemovedDeletionProtection as V, unwrittenCreateOnlyReplacement as Va, warnDeprecatedNoPrefixCliFlag as Vc, malformedExportSourceWarning as Vi, createPreDeleteFinalSnapshot as Vn, recordLogOnlyParameterValue as Vo, INTRINSIC_KEYS as Vr, shouldRetainResource as Vs, removeProtectionTypeList as Vt, resolveDynamoDbDeleteBudgetMs as W, hasNoCloudControlHandlers as Wa, CFN_TEMPLATE_URL_LIMIT as Wc, malformedLocalResourcesWarning as Wi, refusesFinalSnapshot as Wn, createSecretMasker as Wo, classifyReplaySecretRegion as Wr, stringifyValue as Ws, isJournaledOrphan as Wt, S3_AUTO_DELETE_OBJECTS_TAG as X, renderStatefulReason as Xa, expectedOwnerParam as Xc, malformedOutputsRefusalMessage as Xi, RollbackInlinePolicyWriters as Xn, scrubResourceRecord as Xo, explicitRoleArnOrThrow as Xr, AssetModeResolver as Xs, replacementNeverSwapped as Xt, ECR_AUTO_DELETE_IMAGES_TAG as Y, isStatefulRecreateTargetSync as Ya, decodeListingKey as Yc, malformedOrphansWarning as Yi, formatDestructiveChange as Yn, redactSecretsForState as Yo, assertSendableRoleArn as Yr, rewriteTemplateAssetReferences as Ys, recordUnderIdIsNotOwn as Yt, hasCdkAutoDeleteTag as Z, WARM_THROUGHPUT_MEMBERS as Za, PARTITION_TABLE as Zc, malformedOutputsWarning as Zi, earliestDefined as Zn, DYNAMIC_REFERENCE_TOKEN_SCAN as Zo, isIamRoleArn as Zr, BOOTSTRAP_MARKER_PREFIX as Zs, resolveReplacementOldType as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedResourceEntriesForDestroy as _a, isMalformedEnvKey as _c, keepsSecretReferenceToken as _i, carriedExportAliasExposure as _n, lambdaFunctionNameForMask as _o, readsNoEchoDeleteValues as _r, WHOLE_DYNAMIC_REFERENCE_PATTERN as _s, displacedPhysicalIdShown as _t, findNestedTemplateTreeDefect as a, refuseDivergentRecordRegionForDestroy as aa, validateContainerRepoName as ac, s3BucketDomainName as ai, hasPlainPrototype$1 as al, redactedDeleteAddressFields as an, configIntegerRefusal as ao, readTagList as ar, carriesSecretMask as as, gray as at, lookupEachName as b, refuseMalformedResourceEntriesForOrphan as ba, redactedDockerCause as bc, isStalePlaceholderArnAttribute as bi, isWholeDynamicReferenceValue as bn, TemplateParser as bo, withPrintingSecrets as br, isLockInfoExpired as bs, nestedChildStackName as bt, renderNestedTemplateTreeDefect as c, refuseMalformedOrphanRecordsForDestroy as ca, resolveDockerContextDirectory as cc, s3BucketWebsiteUrl as ci, absoluteAssemblyPathEscape as cl, updatePartialReason as cn, replayWarn as co, tagPlanWarning as cr, recordMaskOnlyValuesIn as cs, yellow as ct, conditionInputsFrom as d, refuseMalformedOrphansForOrphan as da, describeDockerFailure as dc, parameterTypeMayLoseSecretIdentity as di, renderAssemblyPathEscape as dl, WITHHELD_NAME_DISPLAY as dn, requireConfigString as do, CC_BROKEN_REASON as dr, recordProvenPublicExpression as ds, reachableDivergentParameters as dt, malformedResourcePropertiesWarning as ea, getBootstrapMarkerKey as ec, applyCallerIdentityCredentials as ei, AssemblyReader as el, findNestedStackTypeChanges as en, toCfnInteger as eo, withCreateTokenLedger as er, pathCrossesDottedKey as es, markRefusedBeforeApplying as et, parentSuppliedValues as f, refuseMalformedOutputs as fa, dockerSpawnEnvWithSensitive as fc, getAccountInfo as fi, resolveAssemblyPath as fl, displayTextOrWithheld as fn, prefetchCreateOnlyPropertyPaths as fo, ProviderRegistry as fr, wholeStringLeavesOf as fs, resourcesNamingDeclaredParameter as ft, mergeNoChangeOutputs as g, refuseMalformedResourceEntriesForDeploy as ga, isDockerClientEnvKey as gc, isNamelessDynamicReferenceError as gi, secretSafeKeyDisplay as gn, canonicalLambdaFunctionName as go, TemplateNoEchoReresolver as gr, TEMPLATE_SOURCED_RULES as gs, displacedOpClause as gt, keptWholeReasonText as h, refuseMalformedResourceEntries as ha, getDockerCmd as hc, carriesFetchableDynamicReference as hi, secretBearingStateKeyWarning as hn, withRetry as ho, wouldReturnToSdkProvider as hr, STATE_SOURCED_READBACK_RULES as hs, NESTED_PENDING_PARENT_REASON as ht, childTemplateLoader as i, previewableOrphanRecords as ia, validateAssetBucketName as ic, s3BucketArn as ii, hasOwnKey as il, isRedactedRecordedValue as in, configBooleanRefusal as io, planTagDiff as ir, recoverMaskedOutput as is, cyan as it, noEchoParameterNamesOf as j, repairMalformedOutputsForReadOnly as ja, getLegacyStateBucketName as jc, accountArgs as ji, orphanRecordsPrintingBag as jn, readbackPathFor as jo, withIndeterminateGuard as jr, describeRegionValueKind as js, journaledOrphanLines as jt, noEchoComparisonForTemplate as k, repairMalformedOrphanRecordsForReadOnly as ka, synthesisStatusMessage as kc, UNREADABLE_ORPHANS_CONTAINER_ROW as ki, journaledOrphanPrintingBag as kn, noEchoOutputsComparison as ko, deleteLeftInPlace as kr, splitImportedOps as ks, dropFailedHint as kt, templateIdentity as l, refuseMalformedOrphans as la, describeDockerCapturedOutput as lc, coerceParameterTypedValue as li, describeFileReadFailure as ll, DeploymentEventsReader as ln, requireConfigArray as lo, definedAttributes as lr, recordNoEchoAttributeValues as ls, computeParameterTaint as lt, isSecretBearingReferenceString as m, refuseMalformedResourceAttributesForOrphan as ma, formatDockerLoginError as mc, carriesDynamicReference as mi, resolveBucketRegion as ml, secretBearing as mn, describeTypeWithThrottleRetry as mo, isCustomResource as mr, STATE_SOURCED_CROSS_GENERATION_RULES as ms, planOrphanAdoption as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedScrubResourceEntriesRefusalMessage as na, parseBootstrapMarker as nc, envCredentialsAreAssumedRole as ni, processStackMessages as nl, inheritProducerRegions as nn, coerceCfnBoolean as no, DBPROXY_TAGS_WHAT as nr, inheritNestedStackParameterAssociations as ns, createReadOnlyAttributeHealerFactory as nt, isAbsoluteAssetPath as o, refuseMalformedNestedChildOutputs as oa, buildDenyExternalAccessPolicy as oc, s3BucketDualStackDomainName as oi, nullPrototypeRecord as ol, redactedDeleteAddressSkip as on, configStringRefusal as oo, refuseMalformedDesiredTags as or, provenPublicValue as os, green as ot, readRecordedConditionVerdicts as p, refuseMalformedOutputsForDestroy as pa, finchSecretArgvRefusal as pc, isImpossibleEmptyStoredAttribute as pi, clearBucketRegionCache as pl, exportAliasCollisionScrubWarning as pn, templateResourceTypes as po, ccBrokenReason as pr, STATE_SOURCED_BASELINE_RULES as ps, makeSiblingClaimReader as pt, deleteTableWithIndexBusyRetry as q, MULTI_REGION_RECREATE_BLOCKED_TYPES as qa, uploadCfnTemplate as qc, malformedOrphanRowsKeptWarning as qi, constructPathOf as qn, maskSecretsInText as qo, applyRoleArnIfSet as qr, createAssetRedirectResolver as qs, planRollback as qt, computeImplicitDeleteEdges as r, malformedStateRefusalMessage as ra, readBootstrapMarkerBody as rc, isSettledInstanceState as ri, defineOwnKey as rl, REDACTED_DELETE_ADDRESS_SKIP_REASON as rn, coerceCfnInteger as ro, DBPROXY_TAG_OPTIONS as rr, recordNestedStackParameterExpressions as rs, bold as rt, listNestedTemplateRows as s, refuseMalformedOrphanRecords as sa, buildDockerImage as sc, s3BucketRegionalDomainName as si, ownValue as sl, updatePartialMessage as sn, readConfigString as so, tagMapAsList as sr, recordMaskOnlyValue as ss, red as st, DeployEngine as t, malformedResourcesWarning as ta, isCrossRegionRedirect as tc, callerEnvCredentials as ti, StageLoadError as tl, getCurrentProducerRegions as tn, toFiniteNumber as to, acquireIdempotencyToken as tr, identityKeyFor as ts, formatResourceLine as tt, conditionFingerprint as u, refuseMalformedOrphansForDestroy as ua, describeDockerExecFailure as uc, isUnboundTemplateParameter as ui, displayAssemblyPath as ul, DeploymentEventsStore as un, requireConfigObject as uo, stringifyIfAssigned as ur, recordNoEchoParameterFreshValue as us, namesAnyDeclaredParameter as ut, chunks as v, refuseMalformedResourceEntriesForImport as va, partitionSensitiveEnv as vc, AWS_NO_VALUE as vi, exportNameNoEchoParameters as vn, sameLambdaFunctionAddress as vo, isCustomResourceType as vr, isSingleDynamicReferenceToken as vs, dropSettledNestedJournals as vt, deferredServiceTokenWarning as w, refuseMalformedResourcePropertiesForOrphan as wa, escapeRegExp$3 as wc, parameterInputsFor as wi, isExportAliasCollision as wn, maskReadbackAtCoordinates as wo, CloudControlProvider as wr, CrossPrefixScanCache as ws, withNestedRevertRun as wt, withApiLimit as x, refuseMalformedResourcePropertiesForDestroy as xa, runDockerForeground as xc, refStateLookupFromResource as xi, noEchoParameterValueSeed as xn, canonicalCoordinates as xo, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as xr, S3StateBackend as xs, recordDisplacedSkips as xt, isAccessDeniedError as y, refuseMalformedResourceEntriesForImportSave as ya, redactDockerArgvValues as yc, cfnRefValueFromPhysicalId as yi, exportNameSecretExposure as yn, DagBuilder as yo, getCurrentResourceSecrets as yr, LockManager as ys, getNestedRevertRun as yt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as z, findActionableSilentDrops as za, resolveUseCdkBootstrapAssets as zc, malformedDriftResourcePropertiesWarning as zi, buildFinalSnapshotIdentifier as zn, logOnlyValueCount as zo, reEnableInstanceApiTermination as zr, orphansAfterRollback as zs, getStackRecords as zt };
+//# sourceMappingURL=deploy-engine-dvf1UDuo.js.map