@go-to-k/cdkd 0.296.31 → 0.298.0

package/dist/{deploy-engine-5FFXg6ih.js → deploy-engine-CJTG3tft.js}

@@ -1,11 +1,11 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js";
-import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
-import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-Cz2tPxXk.js";
+import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, H as truncateCodePoints, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as terminalSafe, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
+import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-CwKiK9nS.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-D0cK9V1A.js";
+import { t as getCdkdVersion } from "./version-D96I6uiO.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
+import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { CloudControlClient, CreateResourceCommand, DeleteResourceCommand, GetResourceCommand, GetResourceRequestStatusCommand, ListResourcesCommand, UpdateResourceCommand } from "@aws-sdk/client-cloudcontrol";
 import { PublishCommand, SNSClient } from "@aws-sdk/client-sns";
 import { GetFunctionCommand, GetFunctionUrlConfigCommand, InvokeCommand, LambdaClient, UpdateFunctionConfigurationCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
@@ -204,16 +204,36 @@ var AppExecutor = class {
 
 //#endregion
 //#region src/types/assembly.ts
-function parseEnvironment(env) {
-	const match = env.match(/^aws:\/\/([^/]+)\/(.+)$/);
+const ASSEMBLY_REGION_PREFIX = /^[a-z0-9-]+/;
+const CDK_ENVIRONMENT_PATTERN = /aws:\/\/([a-zA-Z0-9@._-]+)\/([a-z0-9-]+)/;
+const CANONICAL_ASSEMBLY_REGION = /^[a-z0-9-]+$/;
+function parseEnvironment(env, stackName) {
+	const match = env.match(/^aws:\/\/([^/]+)\/([\s\S]+)$/);
 	if (!match) return {
 		account: "unknown-account",
 		region: "unknown-region"
 	};
-	return {
+	const raw = match[2];
+	const region = ASSEMBLY_REGION_PREFIX.exec(raw)?.[0];
+	if (region !== void 0) return {
 		account: match[1] === "unknown-account" ? "unknown-account" : match[1],
-		region: match[2] === "unknown-region" ? "unknown-region" : match[2]
+		region
 	};
+	const cdk = CDK_ENVIRONMENT_PATTERN.exec(env);
+	if (cdk === null) throw new SynthesisError(unparsableRegionMessage(raw, stackName));
+	return {
+		account: cdk[1],
+		region: cdk[2]
+	};
+}
+function unparsableRegionMessage(region, stackName) {
+	const subject = stackName === void 0 ? "The cloud assembly" : `Stack ${displayStackName(stackName)} in the cloud assembly`;
+	const lower = region.toLowerCase();
+	const caseOnly = CANONICAL_ASSEMBLY_REGION.test(lower);
+	const fix = caseOnly ? `Re-synthesize with the region spelled ${displayIdent(lower)}.` : "Re-synthesize with a canonical region, e.g. env: { region: 'us-east-1' }.";
+	const head = `${subject} declares region ${displayIdent(region)}, which is not a canonical AWS region spelling (lowercase letters, digits and '-'). The AWS CDK CLI refuses this assembly too ("Unable to parse environment specification"). ${fix}`;
+	if (!caseOnly) return head;
+	return `${head}\nIf an earlier cdkd version deployed this stack from such an assembly, it recorded the stack's state under that raw region spelling, and a deploy using the canonical spelling will not find that state: it starts the stack from no state at all. 'cdkd state show' and 'cdkd state orphan' still reach that record when '--stack-region' is given the exact raw spelling; 'state orphan' removes the record and leaves its AWS resources in place, unmanaged by cdkd.`;
 }
 
 //#endregion
@@ -606,7 +626,7 @@ var AssemblyReader = class {
 		}
 		if (dependencyNames.length > 0) this.logger.debug(`Stack ${displayStackName(stackName)} depends on: [${dependencyNames.map((n) => displaySafe(n)).join(", ")}]`);
 		let env;
-		if (artifact.environment) env = parseEnvironment(artifact.environment);
+		if (artifact.environment) env = parseEnvironment(artifact.environment, stackName);
 		const nestedTemplates = nullPrototypeRecord();
 		for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
 			if (resource?.Type !== "AWS::CloudFormation::Stack") continue;
@@ -617,6 +637,7 @@ var AssemblyReader = class {
 			if (!resolvedNested.contained) throw new SynthesisError(`Stack ${displayStackName(stackName)} nested-stack ${displayIdent(logicalId)} has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which ${renderAssemblyPathEscape(resolvedNested, assemblyDir)}`);
 			nestedTemplates[logicalId] = resolvedNested.path;
 		}
+		const lookupRoleArn = props?.lookupRole?.arn;
 		return {
 			stackName,
 			displayName: artifact.displayName ?? stackName,
@@ -629,6 +650,7 @@ var AssemblyReader = class {
 			account: env?.account !== "unknown-account" ? env?.account : void 0,
 			...props?.terminationProtection !== void 0 && { terminationProtection: props.terminationProtection },
 			...Object.keys(nestedTemplates).length > 0 && { nestedTemplates },
+			...typeof lookupRoleArn === "string" && { lookupRoleArn },
 			messages: collectStackMessages(assemblyDir, artifact)
 		};
 	}
@@ -5000,7 +5022,7 @@ function isNotImplemented(error) {
 	const status = error?.$metadata?.httpStatusCode;
 	return name === "NotImplemented" || status === 501;
 }
-function isAccessDenied(error) {
+function isAccessDenied$1(error) {
 	let current = error;
 	for (let depth = 0; depth < 5 && current !== null && typeof current === "object"; depth++) {
 		const name = current.name;
@@ -5028,7 +5050,7 @@ async function scanOtherPrefixesForStack(target, stackName, region) {
 	try {
 		segments = await target.listTopLevelPrefixes();
 	} catch (error) {
-		return isAccessDenied(error) ? {
+		return isAccessDenied$1(error) ? {
 			kind: "denied",
 			error,
 			stage: "list"
@@ -5051,7 +5073,7 @@ async function scanOtherPrefixesForStack(target, stackName, region) {
 					if (held === "holder") found.push(prefix);
 					else if (held === "empty") stale.push(prefix);
 				} catch (error) {
-					if (isAccessDenied(error)) denied ??= error;
+					if (isAccessDenied$1(error)) denied ??= error;
 					else failed ??= error;
 				}
 			}
@@ -5491,7 +5513,7 @@ var S3StateBackend = class S3StateBackend {
 	async verifyBucketExists(options = {}) {
 		await this.ensureClientForBucket();
 		if (options.existenceAlreadyProbed) {
-			this.logger.debug(`Skipping the redundant HeadBucket on '${this.config.bucket}' — the default-name resolution already confirmed it exists with these credentials (issue #1283).`);
+			this.logger.debug(`Skipping the redundant HeadBucket on '${this.config.bucket}' — the default-name resolution already confirmed it exists with these credentials.`);
 			return;
 		}
 		try {
@@ -8385,6 +8407,23 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 	};
 }
 
+//#endregion
+//#region src/deployment/secret-redaction/physical-name-copies.ts
+const physicalNameCopiesOf = /* @__PURE__ */ new WeakMap();
+function recordPhysicalNameCopy(secrets, physicalId) {
+	if (physicalId === "") return;
+	sideSetOf(physicalNameCopiesOf, secrets).add(physicalId);
+}
+function physicalNameSpans(names, value) {
+	const spans = [];
+	if (names === void 0) return spans;
+	for (const name of names) for (let at = value.indexOf(name); at !== -1; at = value.indexOf(name, at + 1)) spans.push({
+		start: at,
+		end: at + name.length
+	});
+	return spans;
+}
+
 //#endregion
 //#region src/deployment/secret-redaction/redact-state.ts
 function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RULES) {
@@ -8404,17 +8443,22 @@ function redactSecretsForStatePasses(bag, secrets, source, rules) {
 	}
 	const regex = buildNeedleRegex(substringNeedlesOf(secrets));
 	const wholeValueExpr = (s) => s === "" ? void 0 : secrets.get(s);
+	const physicalNames = physicalNameCopiesOf.get(secrets);
 	let vouched;
 	const vouchedExpressions = () => vouched ??= new Set(secrets.values());
 	const scanLeaf = (value, needles) => {
 		const spans = isDynamicReferenceString(value) ? resolvableReferenceSpans(value, vouchedExpressions()) : [];
+		const names = physicalNameSpans(physicalNames, value);
 		return value.replace(needles, (match, offset) => {
 			if (isStrictlyInsideASpan(spans, offset, offset + match.length)) return match;
+			const end = offset + match.length;
+			if (names.some((n) => n.start <= offset && end <= n.end)) return match;
 			return secrets.get(match) ?? "***";
 		});
 	};
 	const walk = (value) => {
 		if (typeof value === "string") {
+			if (physicalNames?.has(value) === true) return value;
 			const whole = wholeValueExpr(value);
 			if (whole !== void 0) return whole;
 			if (isSingleDynamicReferenceToken(value) && spanNamesResolvableService(value)) return value;
@@ -8447,6 +8491,133 @@ function scrubResourceRecord(record, secrets, sourceProperties, observedRules) {
 	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets, sourceProperties ?? next.properties, observedRules ?? (sourceProperties !== void 0 ? TEMPLATE_SOURCED_RULES : secrets.size === 0 && isSameGenerationBag(record.observedProperties) ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES));
 	return next;
 }
+function withoutPhysicalNameCopies(secrets, run) {
+	const names = physicalNameCopiesOf.get(secrets);
+	if (names === void 0) return run();
+	physicalNameCopiesOf.delete(secrets);
+	try {
+		return run();
+	} finally {
+		physicalNameCopiesOf.set(secrets, names);
+	}
+}
+function withPhysicalNameCopies(secrets, ids, run) {
+	const previous = physicalNameCopiesOf.get(secrets);
+	const names = new Set(previous);
+	for (const id of ids) if (id !== "") names.add(id);
+	physicalNameCopiesOf.set(secrets, names);
+	try {
+		return run();
+	} finally {
+		if (previous === void 0) physicalNameCopiesOf.delete(secrets);
+		else physicalNameCopiesOf.set(secrets, previous);
+	}
+}
+function repairPhysicalNameCopyLeaves(stored, legacy, current) {
+	if (typeof stored === "string") return typeof legacy === "string" && typeof current === "string" && stored === legacy && current !== legacy ? current : stored;
+	if (Array.isArray(stored)) {
+		if (!Array.isArray(legacy) || !Array.isArray(current)) return stored;
+		if (legacy.length !== stored.length || current.length !== stored.length) return stored;
+		let changed = false;
+		const out = stored.map((item, i) => {
+			const next = repairPhysicalNameCopyLeaves(item, legacy[i], current[i]);
+			if (next !== item) changed = true;
+			return next;
+		});
+		return changed ? out : stored;
+	}
+	if (stored !== null && typeof stored === "object") {
+		if (legacy === null || typeof legacy !== "object" || Array.isArray(legacy)) return stored;
+		if (current === null || typeof current !== "object" || Array.isArray(current)) return stored;
+		const l = legacy;
+		const c = current;
+		let out;
+		for (const [key, value] of Object.entries(stored)) {
+			if (!Object.hasOwn(l, key) || !Object.hasOwn(c, key)) continue;
+			const next = repairPhysicalNameCopyLeaves(value, l[key], c[key]);
+			if (next !== value) {
+				out ??= { ...stored };
+				out[key] = next;
+			}
+		}
+		return out ?? stored;
+	}
+	return stored;
+}
+function embeddedPhysicalNameRewrites(secrets, legacySecrets = secrets) {
+	const names = physicalNameCopiesOf.get(secrets);
+	if (names === void 0) return [];
+	const pairs = [];
+	withoutPhysicalNameCopies(legacySecrets, () => {
+		for (const name of names) {
+			const legacy = redactSecretsForState(name, legacySecrets);
+			if (typeof legacy === "string" && legacy !== name && legacy.includes("{{resolve:") && !isSingleDynamicReferenceToken(legacy) && !legacy.includes("***")) pairs.push([legacy, name]);
+		}
+	});
+	return pairs;
+}
+function replaceEmbeddedPhysicalNameRewrites(value, pairs) {
+	if (pairs.length === 0) return value;
+	if (typeof value === "string") {
+		let next = value;
+		for (const [legacy, name] of pairs) next = next.split(legacy).join(name);
+		return next;
+	}
+	if (Array.isArray(value)) {
+		let changed = false;
+		const out = value.map((item) => {
+			const next = replaceEmbeddedPhysicalNameRewrites(item, pairs);
+			if (next !== item) changed = true;
+			return next;
+		});
+		return changed ? out : value;
+	}
+	if (value !== null && typeof value === "object") {
+		let out;
+		for (const [key, item] of Object.entries(value)) {
+			const next = replaceEmbeddedPhysicalNameRewrites(item, pairs);
+			if (next !== item) {
+				out ??= { ...value };
+				out[key] = next;
+			}
+		}
+		return out ?? value;
+	}
+	return value;
+}
+function repairEmbeddedPhysicalNamesTowards(stored, target, pairs) {
+	if (pairs.length === 0) return stored;
+	if (typeof stored === "string") {
+		if (typeof target !== "string" || stored === target) return stored;
+		const repaired = replaceEmbeddedPhysicalNameRewrites(stored, pairs);
+		return repaired === target ? repaired : stored;
+	}
+	if (Array.isArray(stored)) {
+		if (!Array.isArray(target) || target.length !== stored.length) return stored;
+		let changed = false;
+		const out = stored.map((item, i) => {
+			const next = repairEmbeddedPhysicalNamesTowards(item, target[i], pairs);
+			if (next !== item) changed = true;
+			return next;
+		});
+		return changed ? out : stored;
+	}
+	if (stored !== null && typeof stored === "object") {
+		if (target === null || typeof target !== "object" || Array.isArray(target)) return stored;
+		const t = target;
+		let out;
+		for (const [key, value] of Object.entries(stored)) {
+			if (!Object.hasOwn(t, key)) continue;
+			const next = repairEmbeddedPhysicalNamesTowards(value, t[key], pairs);
+			if (next !== value) {
+				out ??= { ...stored };
+				out[key] = next;
+			}
+		}
+		return out ?? stored;
+	}
+	return stored;
+}
 
 //#endregion
 //#region src/deployment/secret-redaction/positions.ts
@@ -13794,7 +13965,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["Description", "CFn-only informational — no semantic effect on the recursive deploy"],
 			["DisableRollback", "CFn-only — cdkd controls rollback via the top-level deploy-engine --no-rollback flag, not per nested stack"],
 			["EnableTerminationProtection", "CFn-only per-nested-stack flag — cdkd records stack-level terminationProtection at CDK synth time (parent only) and `cdkd destroy` consults that for refusal"],
-			["NotificationARNs", "CFn-only SNS-on-stack-event surface — cdkd has no equivalent (issue #459 design §9)"],
+			["NotificationARNs", "CFn-only SNS-on-stack-event surface — cdkd has no equivalent"],
 			["RoleARN", "CFn-only role-assumption — cdkd uses the caller credentials directly, no per-resource role assumption"],
 			["StackName", "cdkd derives the child stack name as `<parent>~<logicalId>` per design §3 (state-key uniqueness); a user-provided StackName has no effect"],
 			["StackPolicyBody", "CFn-only stack-update policy — cdkd has no equivalent (per-resource diff replaces stack-level policy)"],
@@ -13802,7 +13973,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["StackStatusReason", "CFn-only read-only output — never a real input property"],
 			["Tags", "CFn-only — cdkd does not tag the synthesized \"stack\" (the parent's synthesized ARN is a cdkd-local placeholder, not a real AWS resource)"],
 			["TemplateBody", "CFn-only inline template — cdkd reads the child template from the synth output via Metadata['aws:asset:path'] instead of accepting it inline"],
-			["TimeoutInMinutes", "CFn-only stack-create deadline — cdkd uses per-resource --resource-timeout instead (issue #459 design §9)"]
+			["TimeoutInMinutes", "CFn-only stack-create deadline — cdkd uses per-resource --resource-timeout instead"]
 		]),
 		createOnlyDrops: /* @__PURE__ */ new Set(["StackName"]),
 		readOnly: /* @__PURE__ */ new Set([
@@ -14578,7 +14749,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"PosixUser",
 			"RootDirectory"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["ClientToken", "cdkd supplies its own retry-stable ClientToken on CreateAccessPoint (issues #2039 and #2080), so a template-supplied value would be overwritten. The SDK does not own this field either: measured against @aws-sdk/client-efs 3.1018.0, an omitted ClientToken is auto-filled with a FRESH uuid per attempt, which leaves a retried 500 free to mint a second access point, while a caller-supplied value goes on the wire verbatim."]]),
+		silentDrop: /* @__PURE__ */ new Map([["ClientToken", "cdkd supplies its own retry-stable ClientToken on CreateAccessPoint, so a template-supplied value would be overwritten. The SDK does not own this field either: an omitted ClientToken is auto-filled with a FRESH uuid per attempt, which leaves a retried 500 free to mint a second access point, while a caller-supplied value goes on the wire verbatim."]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(["ClientToken"]),
 		readOnly: /* @__PURE__ */ new Set(["AccessPointId", "Arn"]),
 		ccRouteUnavailable: false
@@ -14598,7 +14769,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"ProvisionedThroughputInMibps",
 			"ThroughputMode"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["ReplicationConfiguration", "Cross-region EFS replication (CreateReplicationConfiguration) provisions a separate destination file system in another region with its own lifecycle, KMS key, and availability-zone placement; replicating + then tearing down the destination on destroy is a multi-resource, cross-region orchestration that is out of scope for the single-resource SDK provider. Tracked as a follow-up to issue #609."]]),
+		silentDrop: /* @__PURE__ */ new Map([["ReplicationConfiguration", "Cross-region EFS replication (CreateReplicationConfiguration) provisions a separate destination file system in another region with its own lifecycle, KMS key, and availability-zone placement; replicating + then tearing down the destination on destroy is a multi-resource, cross-region orchestration that is out of scope for the single-resource SDK provider."]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Arn", "FileSystemId"]),
 		ccRouteUnavailable: false
@@ -15528,7 +15699,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["DBClusterParameterGroupName", "not yet implemented by cdkd"],
 			["DBInstanceParameterGroupName", "not yet implemented by cdkd"],
 			["DBSystemId", "not yet implemented by cdkd"],
-			["DeleteAutomatedBackups", "delete-time flag, sent on the delete when the record carries it (issue #3993); kept unhandled so a template declaring it keeps its Cloud Control route. Final snapshots are governed by DeletionPolicy: Snapshot (issue #1352), which this flag does not control"],
+			["DeleteAutomatedBackups", "delete-time flag, sent on the delete when the record carries it; kept unhandled so a template declaring it keeps its Cloud Control route. Final snapshots are governed by DeletionPolicy: Snapshot, which this flag does not control"],
 			["Domain", "not yet implemented by cdkd"],
 			["DomainIAMRoleName", "not yet implemented by cdkd"],
 			["EnableCloudwatchLogsExports", "not yet implemented by cdkd"],
@@ -15628,7 +15799,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["DBSnapshotIdentifier", "not yet implemented by cdkd"],
 			["DBSystemId", "not yet implemented by cdkd"],
 			["DedicatedLogVolume", "not yet implemented by cdkd"],
-			["DeleteAutomatedBackups", "delete-time flag, sent on the delete when the record carries it (issue #3993); kept unhandled so a template declaring it keeps its Cloud Control route. Final snapshots are governed by DeletionPolicy: Snapshot (issue #1352), which this flag does not control"],
+			["DeleteAutomatedBackups", "delete-time flag, sent on the delete when the record carries it; kept unhandled so a template declaring it keeps its Cloud Control route. Final snapshots are governed by DeletionPolicy: Snapshot, which this flag does not control"],
 			["Domain", "not yet implemented by cdkd"],
 			["DomainAuthSecretArn", "not yet implemented by cdkd"],
 			["DomainDnsIps", "not yet implemented by cdkd"],
@@ -17430,6 +17601,15 @@ function conditionsAssumedFalse(conditions) {
 	return assumedConditionNames.get(conditions) ?? /* @__PURE__ */ new Set();
 }
 
+//#endregion
+//#region src/deployment/noecho-declared.ts
+function isNoEchoDeclared(noEcho) {
+	return noEcho === true || noEcho === "true";
+}
+function declaresNoEcho(definition) {
+	return definition !== null && typeof definition === "object" && isNoEchoDeclared(definition.NoEcho);
+}
+
 //#endregion
 //#region src/deployment/masked-property-fingerprints.ts
 const FINGERPRINT_LAYOUT$1 = 1;
@@ -17506,7 +17686,7 @@ function parameterInputsFor(args) {
 			continue;
 		}
 		const value = values[name];
-		let secret = isPlainObject$2(definition) && (definition["NoEcho"] === true || definition["NoEcho"] === "true") || carriesSecretValue(value, []);
+		let secret = isPlainObject$2(definition) && declaresNoEcho(definition) || carriesSecretValue(value, []);
 		if (!secret && args.nestedChild === true && args.supplied !== void 0) {
 			if (Object.hasOwn(args.supplied, name)) {
 				const passed = args.passedClasses?.get(name);
@@ -17931,7 +18111,7 @@ function childParameterInputs(template, passed) {
 	const inputs = /* @__PURE__ */ new Map();
 	for (const name of Object.keys(declared)) {
 		const definition = declared[name];
-		if (isPlainObject$2(definition) && (definition["NoEcho"] === true || definition["NoEcho"] === "true")) inputs.set(name, { kind: "secret" });
+		if (isPlainObject$2(definition) && declaresNoEcho(definition)) inputs.set(name, { kind: "secret" });
 		else if (passed.has(name)) {
 			const passedClass = passed.get(name);
 			inputs.set(name, passedClass === "clean" ? {
@@ -18940,7 +19120,7 @@ function inheritedSecretsCarriedBy(value, inherited) {
 	return carried;
 }
 function stringifyParameterForLog(paramDef, value) {
-	if (paramDef?.NoEcho === true) return "<redacted>";
+	if (declaresNoEcho(paramDef)) return "<redacted>";
 	return stringifyValue(value);
 }
 function boundAltered(original, shown, maxCodePoints) {
@@ -19561,7 +19741,7 @@ async function resolveGetAtt(getAtt, context) {
 				redacted: isSensitiveAttributeName(attributeName)
 			})}`);
 			if (reresolvesNestedReference) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${this.displayLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
-			return notedFlatValue;
+			return await this.reresolveRecordedReferences(notedFlatValue, logicalId, context, `${logicalId}.${this.displayLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 		}
 		if (attributeName.includes(".")) {
 			const parts = attributeName.split(".");
@@ -19577,7 +19757,7 @@ async function resolveGetAtt(getAtt, context) {
 					structured: isStructured(cursor),
 					redacted: isSensitiveAttributeName(attributeName)
 				})}`);
-				return notedCursor;
+				return await this.reresolveRecordedReferences(notedCursor, logicalId, context, `${logicalId}.${this.displayLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 			}
 		}
 	}
@@ -19649,9 +19829,73 @@ function recordSecretNamedRead(logicalId, value, context) {
 		break;
 	}
 }
+async function reresolveRecordedReferences(value, logicalId, context, origin, sourceKey) {
+	if (!carriesDynamicReference(value) || carriesSecretMask(value)) return value;
+	if (context.recordedSecretValues === void 0) return value;
+	if (!referencesProvenLocal(value, logicalId, context)) {
+		this.logger.debug(safeMsg`Not re-resolving the reference(s) in ${this.displayMasked(origin, context)}: the template of ${this.displayMasked(logicalId, context)} does not spell them, so the region that resolved them is unknown`);
+		return value;
+	}
+	if (!await this.referencesMatchPhysicalId(value, logicalId, context)) {
+		this.logger.warn(safeMsg`Serving ${this.displayMasked(origin, context)} as recorded, with its {{resolve:...}} reference(s) unresolved: cdkd cannot confirm the secret still holds the value ${this.displayMasked(logicalId, context)} was deployed with, because its physical id does not contain it. Either the secret changed since then (update ${this.displayMasked(logicalId, context)} so cdkd deploys it with the new value), or the value is not part of its name (a custom resource's Data, a name shorter than four characters), and cdkd sends the recorded reference as before.`);
+		return value;
+	}
+	return await this.reresolveCrossStackValue(value, void 0, context, origin, sourceKey);
+}
+async function referencesMatchPhysicalId(value, logicalId, context) {
+	const record = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
+	const physicalId = typeof record?.physicalId === "string" ? record.physicalId.toLowerCase() : "";
+	for (const leaf of wholeStringLeavesOf(value)) for (const token of dynamicReferenceTokens(leaf)) {
+		const plaintext = await this.resolveDynamicReferences(token, context);
+		if (plaintext.includes("{{resolve:")) continue;
+		if (plaintext.length < 4) return false;
+		if (!physicalId.includes(plaintext.toLowerCase())) return false;
+	}
+	return true;
+}
+function readsAnotherStack(node) {
+	if (Object.hasOwn(node, "Fn::ImportValue") || Object.hasOwn(node, "Fn::GetStackOutput")) return true;
+	if (!Object.hasOwn(node, "Fn::GetAtt")) return false;
+	const getAtt = node["Fn::GetAtt"];
+	const attributeName = typeof getAtt === "string" ? splitGetAttStringForm(getAtt)?.attributeName : Array.isArray(getAtt) ? getAtt[1] : void 0;
+	return typeof attributeName !== "string" || attributeName.startsWith("Outputs.");
+}
+function takenIfBranch(node, context) {
+	if (Array.isArray(node) || !Object.hasOwn(node, "Fn::If")) return void 0;
+	const args = node["Fn::If"];
+	if (!Array.isArray(args) || args.length !== 3 || typeof args[0] !== "string") return void 0;
+	const conditions = context.conditions;
+	if (conditions === void 0 || !Object.hasOwn(conditions, args[0])) return void 0;
+	const verdict = conditions[args[0]];
+	if (typeof verdict !== "boolean") return void 0;
+	return { branch: verdict ? args[1] : args[2] };
+}
+function referencesProvenLocal(value, logicalId, context) {
+	const resources = context.template.Resources ?? {};
+	if (!Object.hasOwn(resources, logicalId)) return false;
+	const literals = [];
+	let crossStack = false;
+	const walk = (node) => {
+		if (typeof node === "string") {
+			if (node.includes("{{resolve:")) literals.push(node);
+			return;
+		}
+		if (node === null || typeof node !== "object") return;
+		if (!Array.isArray(node) && readsAnotherStack(node)) crossStack = true;
+		const taken = takenIfBranch(node, context);
+		if (taken !== void 0) {
+			walk(taken.branch);
+			return;
+		}
+		for (const child of Object.values(node)) walk(child);
+	};
+	walk(resources[logicalId]?.Properties);
+	if (crossStack) return false;
+	return [...wholeStringLeavesOf(value)].every((leaf) => dynamicReferenceTokens(leaf).every((token) => literals.some((l) => l.includes(token))));
+}
 function rejectPlaceholderArnAttribute(resource, attributeName, value, logicalId, context, healOutcome) {
 	if (!isStalePlaceholderArnAttribute(resource.resourceType, attributeName, value)) return;
-	throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: the recorded value ${quotedRender(stringifyValue(this.maskValueLeaves(value, context)), "\"")} is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. ` + this.staleRecordRemedy(healOutcome, context)));
+	throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: the recorded value ${quotedRender(stringifyValue(this.maskValueLeaves(value, context)), "\"")} is a placeholder written by an older cdkd version — its region and account fields are literal wildcards, so it is not a usable ARN. ` + this.staleRecordRemedy(healOutcome, context)));
 }
 async function constructAttribute(resource, attributeName, context, logicalId, accountInfo) {
 	const { resourceType, physicalId } = resource;
@@ -20051,6 +20295,345 @@ function getCfnClient(rawRegion) {
 	return client;
 }
 
+//#endregion
+//#region src/utils/caller-credentials.ts
+const AWS_CREDENTIAL_ENV_KEYS = [
+	"AWS_ACCESS_KEY_ID",
+	"AWS_SECRET_ACCESS_KEY",
+	"AWS_SESSION_TOKEN"
+];
+function readEnvCredentials(source = process.env) {
+	const accessKeyId = source["AWS_ACCESS_KEY_ID"];
+	const secretAccessKey = source["AWS_SECRET_ACCESS_KEY"];
+	if (!accessKeyId || !secretAccessKey) return void 0;
+	const sessionToken = source["AWS_SESSION_TOKEN"];
+	return {
+		accessKeyId,
+		secretAccessKey,
+		...sessionToken ? { sessionToken } : {}
+	};
+}
+function callerEnvCredentials() {
+	if (getAssumedRoleCredentials() === void 0) return readEnvCredentials();
+	return getPreAssumeEnvCredentials();
+}
+function envCredentialsAreAssumedRole() {
+	return getAssumedRoleCredentials() !== void 0;
+}
+function applyCallerIdentityCredentials(env) {
+	if (getAssumedRoleCredentials() === void 0) return;
+	const caller = getPreAssumeEnvCredentials();
+	if (!caller) {
+		for (const key of AWS_CREDENTIAL_ENV_KEYS) delete env[key];
+		return;
+	}
+	env["AWS_ACCESS_KEY_ID"] = caller.accessKeyId;
+	env["AWS_SECRET_ACCESS_KEY"] = caller.secretAccessKey;
+	if (caller.sessionToken) env["AWS_SESSION_TOKEN"] = caller.sessionToken;
+	else delete env["AWS_SESSION_TOKEN"];
+}
+
+//#endregion
+//#region src/utils/role-arn.ts
+const crossAccountCredentialsCache = /* @__PURE__ */ new Map();
+const CRED_EXPIRY_SAFETY_MS = 6e4;
+const IAM_ROLE_ARN_RE = /^arn:(aws[a-z0-9-]*):iam::(\d{12}):role\/[\w+=,.@-]+(?:\/[\w+=,.@-]+)*$/;
+const IAM_ROLE_ARN_MAX_LENGTH = 2048;
+const IAM_ROLE_ARN_SHAPE_RE = /^arn:[A-Za-z0-9-]+:iam::[0-9]+:role\/[!-~]+$/;
+function isIamRoleArn(value) {
+	if (typeof value !== "string") return false;
+	if (value.length > 2048) return false;
+	return IAM_ROLE_ARN_SHAPE_RE.test(value);
+}
+function refusedRoleArnMessage(value) {
+	return `AssumeRole refused: the role ARN is not a well-formed IAM role ARN (expected arn:<partition>:iam::<account>:role/<name>, at most ${IAM_ROLE_ARN_MAX_LENGTH} characters): ${shownRefusedValue(value)}. Nothing was sent to STS.`;
+}
+function shownRefusedValue(value) {
+	if (value === "") return "(empty)";
+	return displayIdent(value, { maxCodePoints: 613 });
+}
+function assertSendableRoleArn(roleArn, makeError = (message) => new Error(message)) {
+	if (typeof roleArn !== "string" || !isIamRoleArn(roleArn)) throw makeError(refusedRoleArnMessage(roleArn));
+}
+function sendableAssumeRoleCommand(input, makeError) {
+	assertSendableRoleArn(input.RoleArn, makeError);
+	return new AssumeRoleCommand(input);
+}
+function explicitRoleArnOrThrow(flag, raw, makeError = (message) => new Error(message)) {
+	const trimmed = raw.trim();
+	if (!isIamRoleArn(trimmed)) throw makeError(`Invalid ${flag} value: ${refusedRoleArnMessage(raw)}`);
+	return trimmed;
+}
+function assertFlagRoleArn(flag, value, makeError = (message) => new Error(message)) {
+	assertSendableRoleArn(value, (message) => makeError(`Invalid ${flag} value: ${message}`));
+}
+function parseIamRoleArn(roleArn) {
+	if (roleArn.length > 2048) return null;
+	const match = IAM_ROLE_ARN_RE.exec(roleArn);
+	if (!match || !match[1] || !match[2]) return null;
+	return {
+		partition: match[1],
+		accountId: match[2]
+	};
+}
+async function assumeRoleForCrossAccountStateRead(roleArn) {
+	const sourceConfig = ambientCredentialConfig();
+	const cacheKey = JSON.stringify([credentialFingerprint(sourceConfig), roleArn]);
+	const cached = crossAccountCredentialsCache.get(cacheKey);
+	if (cached) {
+		const cachedCreds = await cached;
+		if (!cachedCreds.expiration || Date.now() < cachedCreds.expiration.getTime() - CRED_EXPIRY_SAFETY_MS) return cachedCreds;
+		crossAccountCredentialsCache.delete(cacheKey);
+	}
+	const promise = (async () => {
+		const logger = getLogger().child("role-arn");
+		const displayRoleArn = displayIdent(roleArn, { maxCodePoints: 613 });
+		logger.debug(`Assuming role for cross-account state read: ${displayRoleArn}`);
+		assertSendableRoleArn(roleArn);
+		const sts = new STSClient({ ...clientDefaultsFor(sourceConfig) });
+		try {
+			let response;
+			try {
+				response = await sts.send(sendableAssumeRoleCommand({
+					RoleArn: roleArn,
+					RoleSessionName: `cdkd-xacc-${Date.now()}`,
+					DurationSeconds: 3600
+				}));
+			} catch (err) {
+				const message = displayAwsMessage(err instanceof Error ? err.message : String(err));
+				throw new Error(`AssumeRole into ${displayRoleArn} failed: ${message}. If this is a trust-policy issue, the producer's role must allow sts:AssumeRole from the consumer's principal. See https://cdkd.dev/cross-stack-internals/#iam-permissions for the trust-policy setup.`, { cause: err instanceof Error ? err : void 0 });
+			}
+			if (!response.Credentials) throw new Error(`AssumeRole for cross-account Fn::GetStackOutput returned no credentials (RoleArn=${displayRoleArn})`);
+			const { AccessKeyId, SecretAccessKey, SessionToken, Expiration } = response.Credentials;
+			if (!AccessKeyId || !SecretAccessKey || !SessionToken) throw new Error(`AssumeRole response missing required credentials fields for cross-account state read (RoleArn=${displayRoleArn})`);
+			logger.info(`Assumed role for cross-account state read: ${displayRoleArn} (session expires ${Expiration?.toISOString() ?? "unknown"})`);
+			return {
+				accessKeyId: AccessKeyId,
+				secretAccessKey: SecretAccessKey,
+				sessionToken: SessionToken,
+				...Expiration && { expiration: Expiration }
+			};
+		} finally {
+			sts.destroy();
+		}
+	})().catch((err) => {
+		if (crossAccountCredentialsCache.get(cacheKey) === promise) crossAccountCredentialsCache.delete(cacheKey);
+		throw err;
+	});
+	crossAccountCredentialsCache.set(cacheKey, promise);
+	return promise;
+}
+async function applyRoleArnIfSet(opts) {
+	const roleArn = opts.roleArn !== void 0 ? opts.roleArn : process.env["CDKD_ROLE_ARN"] || void 0;
+	if (roleArn === void 0) return;
+	if (getAssumedRoleCredentials() !== void 0) throw new Error(SECOND_ROLE_PUBLISH_REFUSAL);
+	const logger = getLogger().child("role-arn");
+	const displayRoleArn = displayIdent(roleArn, { maxCodePoints: 613 });
+	logger.debug(`Assuming role ${displayRoleArn}...`);
+	assertSendableRoleArn(roleArn);
+	const sts = new STSClient({
+		...awsClientDefaults({ ignoreAssumedRole: true }),
+		...opts.region && { region: opts.region }
+	});
+	try {
+		let response;
+		try {
+			response = await sts.send(sendableAssumeRoleCommand({
+				RoleArn: roleArn,
+				RoleSessionName: `cdkd-${Date.now()}`,
+				DurationSeconds: 3600
+			}));
+		} catch (err) {
+			throw new Error(`AssumeRole for ${displayRoleArn} failed: ${displayAwsMessage(err instanceof Error ? err.message : String(err))}`, { cause: err instanceof Error ? err : void 0 });
+		}
+		if (!response.Credentials) throw new Error(`AssumeRole returned no credentials for role ${displayRoleArn}`);
+		const { AccessKeyId, SecretAccessKey, SessionToken, Expiration } = response.Credentials;
+		if (!AccessKeyId || !SecretAccessKey || !SessionToken) throw new Error(`AssumeRole response missing credentials fields for role ${displayRoleArn}`);
+		setPreAssumeEnvCredentials(readEnvCredentials());
+		process.env["AWS_ACCESS_KEY_ID"] = AccessKeyId;
+		process.env["AWS_SECRET_ACCESS_KEY"] = SecretAccessKey;
+		process.env["AWS_SESSION_TOKEN"] = SessionToken;
+		setAssumedRoleCredentials({
+			accessKeyId: AccessKeyId,
+			secretAccessKey: SecretAccessKey,
+			sessionToken: SessionToken,
+			...Expiration && { expiration: Expiration }
+		});
+		logger.info(`Assumed role ${displayRoleArn} (session expires ${Expiration?.toISOString() ?? "unknown"})`);
+		const selectedProfile = process.env["AWS_PROFILE"];
+		if (selectedProfile !== void 0 && selectedProfile !== "") logger.warn("AWS_PROFILE is set and a role has been assumed. The AWS calls cdkd makes to deploy and read state run as the role. The profile still decides the region, it is what your CDK app resolves during synthesis, and — when you passed `--profile` rather than exporting it — it is the identity a `cdkd local` emulated function or task is given. See https://cdkd.dev/cli-reference/#profile-vs-role-arn");
+	} finally {
+		sts.destroy();
+	}
+}
+
+//#endregion
+//#region src/deployment/intrinsic-resolver/cdk-cross-account-ref.ts
+function producerLookupOver(stacks) {
+	return (stackName, account, region) => stacks.find((s) => s.stackName === stackName && s.account === account && sameRegion(s.region, region));
+}
+const ROLE_NAME = "[\\w+=,.@-]{1,64}";
+const LITERAL_ROLE_ARN_RE = new RegExp(`^arn:aws[a-z0-9-]*:iam::(\\d{12}):role/(${ROLE_NAME})$`);
+const JOIN_TAIL_RE = new RegExp(`^:iam::(\\d{12}):role/(${ROLE_NAME})$`);
+function isExactlyKeyed(value, key) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const keys = Object.keys(value);
+	return keys.length === 1 && keys[0] === key;
+}
+function roleArnShape(raw) {
+	if (typeof raw === "string") {
+		const match = LITERAL_ROLE_ARN_RE.exec(raw);
+		if (!match || !match[1] || !match[2] || !parseIamRoleArn(raw)) return void 0;
+		return {
+			form: "literal",
+			accountId: match[1],
+			roleName: match[2]
+		};
+	}
+	if (!isExactlyKeyed(raw, "Fn::Join")) return void 0;
+	const join = raw["Fn::Join"];
+	if (!Array.isArray(join) || join.length !== 2 || join[0] !== "") return void 0;
+	const parts = join[1];
+	if (!Array.isArray(parts) || parts.length !== 3 || parts[0] !== "arn:") return void 0;
+	const ref = parts[1];
+	if (!isExactlyKeyed(ref, "Ref") || ref["Ref"] !== "AWS::Partition") return void 0;
+	const tail = parts[2];
+	if (typeof tail !== "string") return void 0;
+	const match = JOIN_TAIL_RE.exec(tail);
+	if (!match || !match[1] || !match[2]) return void 0;
+	return {
+		form: "join",
+		accountId: match[1],
+		roleName: match[2]
+	};
+}
+function roleArnOf(shape, region) {
+	const { partition } = derivePartitionAndUrlSuffix(region);
+	return `arn:${partition}:iam::${shape.accountId}:role/${shape.roleName}`;
+}
+const CFN_EXEC_ROLE_PRINCIPAL_RE = /^arn:(?:\$\{AWS::Partition\}|aws[a-z0-9-]*):iam::\d{12}:role\/[^/]*cfn-exec-role[^/]*$/;
+function isCfnExecRolePrincipal(principal) {
+	return isExactlyKeyed(principal, "Fn::Sub") && typeof principal["Fn::Sub"] === "string" && CFN_EXEC_ROLE_PRINCIPAL_RE.test(principal["Fn::Sub"]);
+}
+function trustsOnlyCfnExecRoles(document) {
+	if (document === null || typeof document !== "object" || Array.isArray(document)) return false;
+	const statements = document["Statement"];
+	if (!Array.isArray(statements) || statements.length === 0) return false;
+	for (const statement of statements) {
+		if (statement === null || typeof statement !== "object" || Array.isArray(statement)) return false;
+		const principal = statement["Principal"];
+		if (!isExactlyKeyed(principal, "AWS")) return false;
+		const aws = principal["AWS"];
+		const list = Array.isArray(aws) ? aws : [aws];
+		if (list.length === 0 || !list.every(isCfnExecRolePrincipal)) return false;
+	}
+	return true;
+}
+function isGeneratedReaderRole(template, roleName) {
+	const resources = template.Resources;
+	if (!resources || typeof resources !== "object") return false;
+	for (const resource of Object.values(resources)) {
+		if (resource === null || typeof resource !== "object") continue;
+		const { Type: type, Properties: properties } = resource;
+		if (type !== "AWS::IAM::Role") continue;
+		if (properties === null || typeof properties !== "object") continue;
+		const props = properties;
+		if (props["RoleName"] !== roleName) continue;
+		if (trustsOnlyCfnExecRoles(props["AssumeRolePolicyDocument"])) return true;
+	}
+	return false;
+}
+function producerLookupRoleArn(lookupRoleArn, producerRegion, producerAccount) {
+	if (typeof lookupRoleArn !== "string" || lookupRoleArn === "") return void 0;
+	const { partition } = derivePartitionAndUrlSuffix(producerRegion);
+	const arn = lookupRoleArn.split("${AWS::Partition}").join(partition);
+	const parsed = parseIamRoleArn(arn);
+	if (!parsed || parsed.accountId !== producerAccount) return void 0;
+	return arn;
+}
+function classifyCdkCrossAccountRef(shape, producerStackName, producerRegion, lookup) {
+	if (lookup === void 0) return { kind: "not-generated" };
+	const producer = lookup(producerStackName, shape.accountId, producerRegion);
+	if (!producer) return shape.form === "join" ? {
+		kind: "producer-absent",
+		shape
+	} : { kind: "not-generated" };
+	if (!isGeneratedReaderRole(producer.template, shape.roleName)) return { kind: "not-generated" };
+	return {
+		kind: "generated",
+		shape,
+		lookupRoleArn: producerLookupRoleArn(producer.lookupRoleArn, producerRegion, shape.accountId)
+	};
+}
+function quotedArg(rendered) {
+	return rendered.startsWith("\"") ? rendered : `'${rendered}'`;
+}
+function cdkCrossAccountRefRefusal(parts) {
+	const consumerAccount = parts.consumerAccount !== void 0 && /^\d{12}$/.test(parts.consumerAccount) ? parts.consumerAccount : "<consumer-account>";
+	const reason = parts.reason.replace(/[\s.]+$/, "");
+	const trust = `'cdk bootstrap --trust-for-lookup ${consumerAccount}' (or '--trust ${consumerAccount}')`;
+	const remedyOne = parts.noLookupRole ? `(1) synthesize stack ${parts.producer} with a stack synthesizer that names a lookup role (the default DefaultStackSynthesizer), and in account ${parts.producerAccount} run ${trust} so the identity running cdkd can assume it; or ` : `(1) in account ${parts.producerAccount}, run ${trust} so the identity running cdkd can assume the lookup role; or `;
+	return `Fn::GetStackOutput: cannot read output ${parts.output} of stack ${parts.producer} (region ${parts.region}, account ${parts.producerAccount})${parts.consumer ? ` for stack ${parts.consumer}` : ""}. Its RoleArn names ${parts.roleName}, a role the AWS CDK generates for a cross-account reference that trusts only the consumer account's CloudFormation execution role, which cdkd does not use; cdkd reads the producer's cdkd state through the producer account's CDK lookup role instead, but ${reason}. Fix it one of two ways: ` + remedyOne + `(2) write the reference as cdk.Fn.getStackOutput(${quotedArg(parts.producer)}, ${quotedArg(parts.output)}, ${quotedArg(parts.region)}, '<roleArn>') with a role in account ${parts.producerAccount} that trusts the identity running cdkd and allows s3:GetBucketLocation and s3:GetObject on cdkd-state-${parts.producerAccount}. See https://cdkd.dev/cross-stack-references/#reading-from-another-account`;
+}
+function producerAbsentReason(producerAccount) {
+	return `this producer stack (account ${producerAccount}) is not in this app's cloud assembly, so cdkd can neither confirm the role is the generated one nor find the lookup role`;
+}
+function noLookupRoleReason(producerAccount) {
+	return `the producer stack's artifact names no CDK lookup role in account ${producerAccount} (its stack synthesizer does not use the bootstrap lookup role)`;
+}
+function isLookupRoleDenial(error) {
+	let current = error;
+	for (let depth = 0; depth < 6 && current !== null && typeof current === "object"; depth++) {
+		const name = current.name;
+		if (name === "AccessDenied" || name === "AccessDeniedException" || name === "NoSuchEntity" || name === "NoSuchEntityException") return true;
+		if (current.$metadata?.httpStatusCode === 403) return true;
+		current = current.cause;
+	}
+	return false;
+}
+function describeInnermostAwsError(error) {
+	let innermost = error;
+	for (let depth = 0; depth < 6; depth++) {
+		const cause = innermost !== null && typeof innermost === "object" ? innermost.cause : void 0;
+		if (cause === null || typeof cause !== "object") break;
+		innermost = cause;
+	}
+	if (!(innermost instanceof Error)) return displayAwsMessage(String(innermost));
+	const code = innermost.Code;
+	const name = typeof code === "string" && code !== "" ? code : innermost.name;
+	const message = displayAwsMessage(innermost.message);
+	return name && name !== "Error" ? `${displayIdent(name)}: ${message}` : message;
+}
+function refuseUnreadableCdkCrossAccountRefs(refs, deployed, consumerOf, lookup) {
+	for (const { consumer, args } of refs) {
+		if (!deployed.has(consumer)) continue;
+		const shape = roleArnShape(args["RoleArn"]);
+		if (shape === void 0) continue;
+		const stackName = args["StackName"];
+		const outputName = args["OutputName"];
+		const consumerStack = consumerOf(consumer);
+		const region = args["Region"] ?? consumerStack.region;
+		if (typeof stackName !== "string" || typeof outputName !== "string") continue;
+		if (typeof region !== "string" || region === "") continue;
+		const verdict = classifyCdkCrossAccountRef(shape, stackName, region, lookup);
+		let reason;
+		if (verdict.kind === "producer-absent") reason = producerAbsentReason(shape.accountId);
+		else if (verdict.kind === "generated" && verdict.lookupRoleArn === void 0) reason = noLookupRoleReason(shape.accountId);
+		if (reason === void 0) continue;
+		throw markNonRetryable(new Error(cdkCrossAccountRefRefusal({
+			consumer: displayStackName(consumer),
+			output: displayIdent(outputName),
+			producer: displayStackName(stackName),
+			region: displayIdent(region),
+			producerAccount: shape.accountId,
+			roleName: displayIdent(shape.roleName),
+			consumerAccount: consumerStack.account,
+			reason,
+			noLookupRole: verdict.kind === "generated"
+		})));
+	}
+}
+
 //#endregion
 //#region src/deployment/intrinsic-resolver/stack-output.ts
 async function resolveGetStackOutput(arg, context) {
@@ -20074,10 +20657,29 @@ async function resolveGetStackOutput(arg, context) {
 		loggedRegionText = this.regionLogText(resolvedRegion, context);
 	}
 	let roleArn;
+	let cdkRef;
 	if ("RoleArn" in args && args["RoleArn"] !== void 0 && args["RoleArn"] !== null) {
 		const raw = args["RoleArn"];
-		if (typeof raw !== "string" || raw === "") throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: RoleArn must be a literal string in the template (no Ref / Fn::GetAtt / Fn::Sub allowed for cross-account references). Got ${raw === null ? "null" : Array.isArray(raw) ? "array" : typeof raw}${typeof raw === "object" ? ` (intrinsic shape: ${this.displayMasked(JSON.stringify(raw).slice(0, 80), context)})` : ""}.`));
-		roleArn = raw;
+		const refuseNonLiteral = () => markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: RoleArn must be a literal string in the template (no Ref / Fn::GetAtt / Fn::Sub allowed for cross-account references). Got ${raw === null ? "null" : Array.isArray(raw) ? "array" : typeof raw}${typeof raw === "object" ? ` (intrinsic shape: ${this.displayMasked(JSON.stringify(raw).slice(0, 80), context)})` : ""}.`));
+		const shape = roleArnShape(raw);
+		if ((typeof raw !== "string" || raw === "") && shape === void 0) throw refuseNonLiteral();
+		if (shape !== void 0) {
+			const key = JSON.stringify([
+				shape.form,
+				stackName,
+				shape.accountId,
+				canonicalizeRegion(region),
+				shape.roleName
+			]);
+			let verdict = this.cdkCrossAccountRefVerdicts.get(key);
+			if (verdict === void 0) {
+				verdict = classifyCdkCrossAccountRef(shape, stackName, region, this.producerLookup);
+				this.cdkCrossAccountRefVerdicts.set(key, verdict);
+			}
+			if (verdict.kind === "not-generated" && typeof raw !== "string") throw refuseNonLiteral();
+			if (verdict.kind !== "not-generated") cdkRef = verdict;
+		}
+		roleArn = typeof raw === "string" ? raw : shape && roleArnOf(shape, region);
 	}
 	if (!roleArn && context.stackName && context.stackName === stackName && sameRegion(region, this.resolverRegion)) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: cannot reference own stack ${this.displayMaskedIdent(stackName, context, STACK_REF_MAX_CODE_POINTS)} in the same region ${this.displayMaskedIdent(loggedRegionText, context)}`));
 	const loggedStackName = this.displayMaskedIdent(stackName, context, STACK_REF_MAX_CODE_POINTS);
@@ -20085,11 +20687,35 @@ async function resolveGetStackOutput(arg, context) {
 	const loggedRegion = this.displayMasked(loggedRegionText, context);
 	const shownRoleArn = roleArn ? displayIdent(roleArn, { maxCodePoints: 613 }) : "";
 	this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${shownRoleArn}` : ""}`);
+	let readRoleArn = roleArn;
+	let refuseCdkRead;
+	if (cdkRef !== void 0) {
+		const ref = cdkRef;
+		const producerAccount = ref.shape.accountId;
+		const refuseCdkRef = (reason, cause, noLookupRole = false) => markNonRetryable(new Error(cdkCrossAccountRefRefusal({
+			consumer: context.stackName ? this.displayMaskedIdent(context.stackName, context, STACK_REF_MAX_CODE_POINTS) : void 0,
+			output: loggedOutputName,
+			producer: loggedStackName,
+			region: displayIdent(loggedRegion),
+			producerAccount,
+			roleName: displayIdent(ref.shape.roleName),
+			consumerAccount: this.consumerAccount,
+			reason,
+			noLookupRole
+		}), cause === void 0 ? void 0 : { cause }));
+		if (ref.kind === "producer-absent") throw refuseCdkRef(producerAbsentReason(producerAccount));
+		if (ref.lookupRoleArn === void 0) throw refuseCdkRef(noLookupRoleReason(producerAccount), void 0, true);
+		readRoleArn = ref.lookupRoleArn;
+		const shownLookupRoleArn = displayIdent(readRoleArn, { maxCodePoints: 613 });
+		refuseCdkRead = (error) => refuseCdkRef(`assuming the lookup role ${shownLookupRoleArn} or reading cdkd-state-${producerAccount} with it was denied: ${describeInnermostAwsError(error)}`, error);
+		this.logger.debug(safeMsg`Fn::GetStackOutput: ${shownRoleArn} is the AWS CDK-generated cross-account reader role; reading through the producer account's lookup role ${shownLookupRoleArn}`);
+	}
+	const shownReadRoleArn = readRoleArn === roleArn ? shownRoleArn : displayIdent(readRoleArn, { maxCodePoints: 613 });
 	let stateData;
 	try {
-		stateData = roleArn ? await this.getCrossAccountStackState(roleArn, stackName, region, context) : await this.getSameAccountStackState(stackName, region, context);
+		stateData = readRoleArn ? await this.getCrossAccountStackState(readRoleArn, stackName, region, context) : await this.getSameAccountStackState(stackName, region, context);
 	} catch (error) {
-		this.maskStateReadError(error, [[stackName, this.displayMasked(stackName, context)], [region, loggedRegion]], context);
+		this.maskStateReadError(refuseCdkRead && isLookupRoleDenial(error) ? refuseCdkRead(error) : error, [[stackName, this.displayMasked(stackName, context)], [region, loggedRegion]], context);
 	}
 	if (!stateData) {
 		if (!roleArn && this.cfnFallback) {
@@ -20104,7 +20730,7 @@ async function resolveGetStackOutput(arg, context) {
 				return value;
 			}
 		}
-		throw new Error(`Fn::GetStackOutput: stack ${loggedStackName} not found in region ${displayIdent(loggedRegion)}${roleArn ? ` (cross-account via ${shownRoleArn})` : ""}. ${!roleArn && this.cfnFallback ? "Searched cdkd state and CloudFormation stacks. Make sure the producer stack has been deployed (via cdkd or CloudFormation)." : `Make sure the producer stack has been deployed via cdkd.`}`);
+		throw new Error(`Fn::GetStackOutput: stack ${loggedStackName} not found in region ${displayIdent(loggedRegion)}${roleArn ? ` (cross-account via ${shownReadRoleArn})` : ""}. ${!roleArn && this.cfnFallback ? "Searched cdkd state and CloudFormation stacks. Make sure the producer stack has been deployed (via cdkd or CloudFormation)." : `Make sure the producer stack has been deployed via cdkd.`}`);
 	}
 	if (!hasReadableOutputs(stateData.state)) throw markNonRetryable(new MalformedProducerRecordRefusalError(`Fn::GetStackOutput: the state record of producer stack ${loggedStackName} (${displayIdent(loggedRegion)}) has no readable 'outputs' map — the record is malformed or truncated. cdkd refuses to resolve from it rather than reading it as a map: 'Object.hasOwn' answers TRUE for '0' on a string and for an index on a list, so continuing would resolve ONE CHARACTER or element of the record as this reference's value and this deploy would send it to AWS. Inspect the producer's record with 'cdkd state show' --json, repair or remove it, then re-run.`));
 	const outputs = stateData.state.outputs ?? {};
@@ -20115,7 +20741,7 @@ async function resolveGetStackOutput(arg, context) {
 	const value = outputs[outputName];
 	this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${shownRoleArn}` : ""} (${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
 	if (!roleArn) this.recordOutputRead(context, stackName, region, outputName);
-	if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new CrossAccountSecretRefusalError(`Fn::GetStackOutput: output ${loggedOutputName} of stack ${loggedStackName} (${displayIdent(loggedRegion)}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${shownRoleArn}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
+	if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new CrossAccountSecretRefusalError(`Fn::GetStackOutput: output ${loggedOutputName} of stack ${loggedStackName} (${displayIdent(loggedRegion)}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${shownRoleArn}${readRoleArn !== roleArn ? `, read through the producer account's CDK lookup role ${shownReadRoleArn}` : ""}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
 	return await this.reresolveCrossStackValue(value, region, context, `Fn::GetStackOutput ${quotedRender(this.displayLeaf(outputName, context), "'")} (producer ${this.displayLeaf(stackName, context)} / ${this.displayLeaf(loggedRegionText, context)})`, sourceKey, {
 		stackName,
 		region,
@@ -20188,178 +20814,6 @@ function namedRequestMasks(pairs, context) {
 	};
 }
 
-//#endregion
-//#region src/utils/caller-credentials.ts
-const AWS_CREDENTIAL_ENV_KEYS = [
-	"AWS_ACCESS_KEY_ID",
-	"AWS_SECRET_ACCESS_KEY",
-	"AWS_SESSION_TOKEN"
-];
-function readEnvCredentials(source = process.env) {
-	const accessKeyId = source["AWS_ACCESS_KEY_ID"];
-	const secretAccessKey = source["AWS_SECRET_ACCESS_KEY"];
-	if (!accessKeyId || !secretAccessKey) return void 0;
-	const sessionToken = source["AWS_SESSION_TOKEN"];
-	return {
-		accessKeyId,
-		secretAccessKey,
-		...sessionToken ? { sessionToken } : {}
-	};
-}
-function callerEnvCredentials() {
-	if (getAssumedRoleCredentials() === void 0) return readEnvCredentials();
-	return getPreAssumeEnvCredentials();
-}
-function envCredentialsAreAssumedRole() {
-	return getAssumedRoleCredentials() !== void 0;
-}
-function applyCallerIdentityCredentials(env) {
-	if (getAssumedRoleCredentials() === void 0) return;
-	const caller = getPreAssumeEnvCredentials();
-	if (!caller) {
-		for (const key of AWS_CREDENTIAL_ENV_KEYS) delete env[key];
-		return;
-	}
-	env["AWS_ACCESS_KEY_ID"] = caller.accessKeyId;
-	env["AWS_SECRET_ACCESS_KEY"] = caller.secretAccessKey;
-	if (caller.sessionToken) env["AWS_SESSION_TOKEN"] = caller.sessionToken;
-	else delete env["AWS_SESSION_TOKEN"];
-}
-
-//#endregion
-//#region src/utils/role-arn.ts
-const crossAccountCredentialsCache = /* @__PURE__ */ new Map();
-const CRED_EXPIRY_SAFETY_MS = 6e4;
-const IAM_ROLE_ARN_RE = /^arn:(aws[a-z0-9-]*):iam::(\d{12}):role\/[\w+=,.@-]+(?:\/[\w+=,.@-]+)*$/;
-const IAM_ROLE_ARN_MAX_LENGTH = 2048;
-const IAM_ROLE_ARN_SHAPE_RE = /^arn:[A-Za-z0-9-]+:iam::[0-9]+:role\/[!-~]+$/;
-function isIamRoleArn(value) {
-	if (typeof value !== "string") return false;
-	if (value.length > 2048) return false;
-	return IAM_ROLE_ARN_SHAPE_RE.test(value);
-}
-function refusedRoleArnMessage(value) {
-	return `AssumeRole refused: the role ARN is not a well-formed IAM role ARN (expected arn:<partition>:iam::<account>:role/<name>, at most ${IAM_ROLE_ARN_MAX_LENGTH} characters): ${shownRefusedValue(value)}. Nothing was sent to STS.`;
-}
-function shownRefusedValue(value) {
-	if (value === "") return "(empty)";
-	return displayIdent(value, { maxCodePoints: 613 });
-}
-function assertSendableRoleArn(roleArn, makeError = (message) => new Error(message)) {
-	if (typeof roleArn !== "string" || !isIamRoleArn(roleArn)) throw makeError(refusedRoleArnMessage(roleArn));
-}
-function sendableAssumeRoleCommand(input, makeError) {
-	assertSendableRoleArn(input.RoleArn, makeError);
-	return new AssumeRoleCommand(input);
-}
-function explicitRoleArnOrThrow(flag, raw, makeError = (message) => new Error(message)) {
-	const trimmed = raw.trim();
-	if (!isIamRoleArn(trimmed)) throw makeError(`Invalid ${flag} value: ${refusedRoleArnMessage(raw)}`);
-	return trimmed;
-}
-function assertFlagRoleArn(flag, value, makeError = (message) => new Error(message)) {
-	assertSendableRoleArn(value, (message) => makeError(`Invalid ${flag} value: ${message}`));
-}
-function parseIamRoleArn(roleArn) {
-	if (roleArn.length > 2048) return null;
-	const match = IAM_ROLE_ARN_RE.exec(roleArn);
-	if (!match || !match[1] || !match[2]) return null;
-	return {
-		partition: match[1],
-		accountId: match[2]
-	};
-}
-async function assumeRoleForCrossAccountStateRead(roleArn) {
-	const sourceConfig = ambientCredentialConfig();
-	const cacheKey = JSON.stringify([credentialFingerprint(sourceConfig), roleArn]);
-	const cached = crossAccountCredentialsCache.get(cacheKey);
-	if (cached) {
-		const cachedCreds = await cached;
-		if (!cachedCreds.expiration || Date.now() < cachedCreds.expiration.getTime() - CRED_EXPIRY_SAFETY_MS) return cachedCreds;
-		crossAccountCredentialsCache.delete(cacheKey);
-	}
-	const promise = (async () => {
-		const logger = getLogger().child("role-arn");
-		const displayRoleArn = displayIdent(roleArn, { maxCodePoints: 613 });
-		logger.debug(`Assuming role for cross-account state read: ${displayRoleArn}`);
-		assertSendableRoleArn(roleArn);
-		const sts = new STSClient({ ...clientDefaultsFor(sourceConfig) });
-		try {
-			let response;
-			try {
-				response = await sts.send(sendableAssumeRoleCommand({
-					RoleArn: roleArn,
-					RoleSessionName: `cdkd-xacc-${Date.now()}`,
-					DurationSeconds: 3600
-				}));
-			} catch (err) {
-				const message = displayAwsMessage(err instanceof Error ? err.message : String(err));
-				throw new Error(`AssumeRole into ${displayRoleArn} failed: ${message}. If this is a trust-policy issue, the producer's role must allow sts:AssumeRole from the consumer's principal. See https://cdkd.dev/cross-stack-internals/#iam-permissions for the trust-policy setup.`, { cause: err instanceof Error ? err : void 0 });
-			}
-			if (!response.Credentials) throw new Error(`AssumeRole for cross-account Fn::GetStackOutput returned no credentials (RoleArn=${displayRoleArn})`);
-			const { AccessKeyId, SecretAccessKey, SessionToken, Expiration } = response.Credentials;
-			if (!AccessKeyId || !SecretAccessKey || !SessionToken) throw new Error(`AssumeRole response missing required credentials fields for cross-account state read (RoleArn=${displayRoleArn})`);
-			logger.info(`Assumed role for cross-account state read: ${displayRoleArn} (session expires ${Expiration?.toISOString() ?? "unknown"})`);
-			return {
-				accessKeyId: AccessKeyId,
-				secretAccessKey: SecretAccessKey,
-				sessionToken: SessionToken,
-				...Expiration && { expiration: Expiration }
-			};
-		} finally {
-			sts.destroy();
-		}
-	})().catch((err) => {
-		if (crossAccountCredentialsCache.get(cacheKey) === promise) crossAccountCredentialsCache.delete(cacheKey);
-		throw err;
-	});
-	crossAccountCredentialsCache.set(cacheKey, promise);
-	return promise;
-}
-async function applyRoleArnIfSet(opts) {
-	const roleArn = opts.roleArn !== void 0 ? opts.roleArn : process.env["CDKD_ROLE_ARN"] || void 0;
-	if (roleArn === void 0) return;
-	if (getAssumedRoleCredentials() !== void 0) throw new Error(SECOND_ROLE_PUBLISH_REFUSAL);
-	const logger = getLogger().child("role-arn");
-	const displayRoleArn = displayIdent(roleArn, { maxCodePoints: 613 });
-	logger.debug(`Assuming role ${displayRoleArn}...`);
-	assertSendableRoleArn(roleArn);
-	const sts = new STSClient({
-		...awsClientDefaults({ ignoreAssumedRole: true }),
-		...opts.region && { region: opts.region }
-	});
-	try {
-		let response;
-		try {
-			response = await sts.send(sendableAssumeRoleCommand({
-				RoleArn: roleArn,
-				RoleSessionName: `cdkd-${Date.now()}`,
-				DurationSeconds: 3600
-			}));
-		} catch (err) {
-			throw new Error(`AssumeRole for ${displayRoleArn} failed: ${displayAwsMessage(err instanceof Error ? err.message : String(err))}`, { cause: err instanceof Error ? err : void 0 });
-		}
-		if (!response.Credentials) throw new Error(`AssumeRole returned no credentials for role ${displayRoleArn}`);
-		const { AccessKeyId, SecretAccessKey, SessionToken, Expiration } = response.Credentials;
-		if (!AccessKeyId || !SecretAccessKey || !SessionToken) throw new Error(`AssumeRole response missing credentials fields for role ${displayRoleArn}`);
-		setPreAssumeEnvCredentials(readEnvCredentials());
-		process.env["AWS_ACCESS_KEY_ID"] = AccessKeyId;
-		process.env["AWS_SECRET_ACCESS_KEY"] = SecretAccessKey;
-		process.env["AWS_SESSION_TOKEN"] = SessionToken;
-		setAssumedRoleCredentials({
-			accessKeyId: AccessKeyId,
-			secretAccessKey: SecretAccessKey,
-			sessionToken: SessionToken,
-			...Expiration && { expiration: Expiration }
-		});
-		logger.info(`Assumed role ${displayRoleArn} (session expires ${Expiration?.toISOString() ?? "unknown"})`);
-		const selectedProfile = process.env["AWS_PROFILE"];
-		if (selectedProfile !== void 0 && selectedProfile !== "") logger.warn("AWS_PROFILE is set and a role has been assumed. The AWS calls cdkd makes to deploy and read state run as the role. The profile still decides the region, it is what your CDK app resolves during synthesis, and — when you passed `--profile` rather than exporting it — it is the identity a `cdkd local` emulated function or task is given. See https://cdkd.dev/cli-reference/#profile-vs-role-arn");
-	} finally {
-		sts.destroy();
-	}
-}
-
 //#endregion
 //#region src/deployment/intrinsic-resolver/stack-state.ts
 async function getSameAccountStackState(stackName, region, context) {
@@ -20922,7 +21376,7 @@ async function resolveSplit(splitArgs, context) {
 		const source = this.describeSplitValueSource(value);
 		const sourceClause = source ? ` (from ${this.displayMasked(source.label, context)})` : "";
 		if (Array.isArray(resolvedValue)) {
-			const remedy = source?.kind === "ref" ? "A list-typed parameter — any List<...> type (List<AWS::EC2::Subnet::Id>, List<Number>, …) or CommaDelimitedList — is already a list." : source?.kind === "getatt" ? "A list-valued Fn::GetAtt (for example AWS::Route53::HostedZone.NameServers or AWS::EC2::VPC.Ipv6CidrBlocks) already returns a list. If you wrote the Fn::Split as a workaround for cdkd resolving that attribute to a comma-delimited string, that bug is fixed (PR #1868) and the workaround is no longer needed." : "Several intrinsics already return a list — among them a list-valued Fn::GetAtt, a Ref to a list-typed parameter (any List<...> type or CommaDelimitedList), Fn::GetAZs, Fn::Cidr, and Fn::Split itself.";
+			const remedy = source?.kind === "ref" ? "A list-typed parameter — any List<...> type (List<AWS::EC2::Subnet::Id>, List<Number>, …) or CommaDelimitedList — is already a list." : source?.kind === "getatt" ? "A list-valued Fn::GetAtt (for example AWS::Route53::HostedZone.NameServers or AWS::EC2::VPC.Ipv6CidrBlocks) already returns a list. If you wrote the Fn::Split as a workaround for cdkd resolving that attribute to a comma-delimited string, that bug is fixed and the workaround is no longer needed." : "Several intrinsics already return a list — among them a list-valued Fn::GetAtt, a Ref to a list-typed parameter (any List<...> type or CommaDelimitedList), Fn::GetAZs, Fn::Cidr, and Fn::Split itself.";
 			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Split: the value to split${sourceClause} is ALREADY a list (an array of ${resolvedValue.length} item${resolvedValue.length === 1 ? "" : "s"}), not a string. CloudFormation rejects Fn::Split over a list too, so this template is not valid CloudFormation either. Remove the Fn::Split and use the value directly. ${remedy}`));
 		}
 		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Split: the value to split${sourceClause} must be a string, got ${resolvedValue === null ? "null" : typeof resolvedValue}. Fn::Split accepts only a string; check the value or the intrinsic that produced it.`));
@@ -21837,8 +22291,9 @@ function recordInheritedNoEchoListElements(resolver, inherited, recorded, value,
 }
 function recordNoEchoParameterValue(paramDef, value, context) {
 	const bag = context.recordedSecretValues;
-	if (paramDef?.NoEcho !== true || bag === void 0) return;
+	if (!declaresNoEcho(paramDef) || bag === void 0) return;
 	recordLogOnlyParameterValue(bag, value);
+	if (paramDef?.NoEcho !== true) return;
 	recordNoEchoParameterFreshValue(value, bag, this.publicNoEchoTokens(context));
 }
 function refuseCoercedInheritedSecret(name, paramDef, userValue, inherited) {
@@ -21876,6 +22331,7 @@ function lookupResourceRecord(logicalId, via, context) {
 		const loggedId = this.displayMasked(logicalId, context);
 		throw markNonRetryable(new IntrinsicResolutionRefusalError(`${via} ${loggedId}: ${isObject ? `the state record's physical id is ${physicalId === null ? "null" : typeof physicalId}, not a string` : `the state record is ${Array.isArray(resource) ? "an array" : typeof resource}, not an object`}. cdkd always records an object with a string id, so this record was edited by hand or written by another tool. ${isObject ? `Set the resource's "physicalId" in the stack's state.json back to the id AWS knows the resource by.` : `Restore the resource's record in the stack's state.json, or remove it and re-import the resource.`}`, void 0, "STATE_PHYSICAL_ID_NOT_STRING"));
 	}
+	if (context.recordedSecretValues !== void 0) recordPhysicalNameCopy(context.recordedSecretValues, physicalId);
 	return resource;
 }
 async function resolveRef(logicalId, context, onParameter) {
@@ -21884,7 +22340,7 @@ async function resolveRef(logicalId, context, onParameter) {
 		const refValue = this.resolveRefValue(logicalId, resource, context);
 		recordSecretNamedRead(logicalId, refValue, context);
 		this.logger.debug(`Resolved Ref to resource: ${this.logRender(logicalId, context)} resolved to ${this.logRender(String(refValue), context)}`);
-		return refValue;
+		return await this.reresolveRecordedReferences(refValue, logicalId, context, `Ref ${logicalId}`, void 0);
 	}
 	if (context.parameters && Object.hasOwn(context.parameters, logicalId)) {
 		const value = context.parameters[logicalId];
@@ -21894,7 +22350,7 @@ async function resolveRef(logicalId, context, onParameter) {
 		this.recordInheritedParameterSecrets(logicalId, value, context);
 		this.logger.debug(`Resolved Ref to parameter: ${this.logRender(logicalId, context)} resolved to ${this.logRender(stringifyParameterForLog(paramDef, this.maskValueLeaves(value, context)), context, {
 			structured: isStructured(value),
-			redacted: paramDef?.NoEcho === true
+			redacted: declaresNoEcho(paramDef)
 		})}`);
 		onParameter?.();
 		return value;
@@ -21976,6 +22432,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	explicitRegionLogText;
 	strictGetAtt;
 	cfnFallback;
+	producerLookup;
+	consumerAccount;
+	cdkCrossAccountRefVerdicts = /* @__PURE__ */ new Map();
 	cfnClients = /* @__PURE__ */ new Map();
 	cfnExportsPromises = /* @__PURE__ */ new Map();
 	cfnStackOutputsCache = /* @__PURE__ */ new Map();
@@ -21987,6 +22446,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		this.explicitRegion = region || void 0;
 		this.strictGetAtt = options?.strictGetAtt ?? false;
 		this.cfnFallback = options?.cfnFallback ?? true;
+		this.producerLookup = options?.producerLookup;
+		this.consumerAccount = options?.consumerAccount;
 	}
 	getPhysicalIdFallbackCount() {
 		return this.physicalIdFallbackCount;
@@ -22181,6 +22642,8 @@ IntrinsicFunctionResolver.prototype.pushRedactedAttributeRead = pushRedactedAttr
 IntrinsicFunctionResolver.prototype.resolveGetAtt = resolveGetAtt;
 IntrinsicFunctionResolver.prototype.publicNoEchoTokens = publicNoEchoTokens;
 IntrinsicFunctionResolver.prototype.noteAttributeSecrecy = noteAttributeSecrecy;
+IntrinsicFunctionResolver.prototype.reresolveRecordedReferences = reresolveRecordedReferences;
+IntrinsicFunctionResolver.prototype.referencesMatchPhysicalId = referencesMatchPhysicalId;
 IntrinsicFunctionResolver.prototype.rejectPlaceholderArnAttribute = rejectPlaceholderArnAttribute;
 IntrinsicFunctionResolver.prototype.staleRecordRemedy = staleRecordRemedy;
 IntrinsicFunctionResolver.prototype.unenrichedRemedy = unenrichedRemedy;
@@ -22347,7 +22810,7 @@ var DiffCalculator = class DiffCalculator {
 						requiresReplacement: await this.maskedEditRequiresReplacement(desiredResource.Type, key, oldValue, newValue),
 						maskedExpressionChanged: true
 					});
-					this.logger.debug(safeMsg`${logicalId}: ${key} is recorded masked and its template expression or a resolved input changed (go-to-k/cdkd#4451, go-to-k/cdkd#4543)`);
+					this.logger.debug(safeMsg`${logicalId}: ${key} is recorded masked and its template expression or a resolved input changed`);
 				}
 				const attributeChanges = this.compareAttributes(currentResource, desiredResource);
 				if (propertyChanges.length > 0 || attributeChanges.length > 0) {
@@ -23008,6 +23471,511 @@ function deleteIndeterminateGuards(result) {
 	return out;
 }
 
+//#endregion
+//#region src/deployment/inline-policy-claims.ts
+function isInlinePolicyClaimedByCompletedWriter(args, kind, principal, policyName) {
+	const { selfLogicalId, writers, changes, stateResources } = args;
+	for (const [lid, write] of writers) {
+		if (lid === selfLogicalId || !Object.hasOwn(stateResources, lid)) continue;
+		const record = stateResources[lid];
+		const standalone = standaloneInlinePolicyOf(record.resourceType, record.properties);
+		if (standalone !== void 0) {
+			if (standalone.kind === kind && sameIamName(standalone.principal, principal) && sameIamName(standalone.policyName, policyName)) return true;
+			continue;
+		}
+		if (record.provisionedBy === "cc-api") continue;
+		const props = record.properties ?? {};
+		if (record.resourceType === "AWS::IAM::Policy") {
+			if (!sameIamName(record.physicalId, policyName)) continue;
+			const listed = props[POLICY_LIST_FIELDS[kind]];
+			if (Array.isArray(listed) && listed.some((p) => sameIamName(p, principal))) return true;
+			continue;
+		}
+		if (!Object.hasOwn(PRINCIPAL_KINDS, record.resourceType)) continue;
+		if (PRINCIPAL_KINDS[record.resourceType] !== kind) continue;
+		if (!sameIamName(record.physicalId, principal)) continue;
+		if (write !== "create" && !ownPoliciesChange(changes.get(lid))) continue;
+		const policies = props["Policies"];
+		if (!Array.isArray(policies)) continue;
+		if (policies.some((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) && sameIamName(entry["PolicyName"], policyName))) return true;
+	}
+	return false;
+}
+var RollbackInlinePolicyWriters = class {
+	entries = /* @__PURE__ */ new Map();
+	removals = /* @__PURE__ */ new Map();
+	unsettled = /* @__PURE__ */ new Map();
+	notePending(ops) {
+		for (const op of ops) if (!this.unsettled.has(op)) this.unsettled.set(op, {
+			logicalId: op.logicalId,
+			state: "pending"
+		});
+	}
+	noteOutcome(op, completed) {
+		if (!completed) {
+			this.unsettled.set(op, {
+				logicalId: op.logicalId,
+				state: "failed"
+			});
+			return;
+		}
+		for (const [key, entry] of this.unsettled) if (key === op || entry.logicalId === op.logicalId) this.unsettled.delete(key);
+	}
+	record(logicalId, write, record, policiesChanged, via) {
+		if (via === "cc-api" && !isStandaloneInlinePolicyType(record.resourceType)) {
+			this.entries.delete(logicalId);
+			return;
+		}
+		this.entries.set(logicalId, {
+			write,
+			record,
+			policiesChanged
+		});
+	}
+	claimedFor(resourceType, logicalId, stateResources) {
+		if (resourceType !== "AWS::IAM::Policy" && !Object.hasOwn(PRINCIPAL_KINDS, resourceType) && !isStandaloneInlinePolicyType(resourceType)) return;
+		return (kind, principal, policyName) => {
+			const writers = /* @__PURE__ */ new Map();
+			const changes = /* @__PURE__ */ new Map();
+			for (const [lid, entry] of this.entries) {
+				if (!Object.hasOwn(stateResources, lid) || stateResources[lid] !== entry.record) continue;
+				writers.set(lid, entry.write);
+				if (entry.policiesChanged) changes.set(lid, {
+					logicalId: lid,
+					changeType: "UPDATE",
+					resourceType: entry.record.resourceType,
+					propertyChanges: [{
+						path: "Policies",
+						oldValue: void 0,
+						newValue: void 0,
+						requiresReplacement: false
+					}]
+				});
+			}
+			const claimed = isInlinePolicyClaimedByCompletedWriter({
+				selfLogicalId: logicalId,
+				writers,
+				changes,
+				stateResources
+			}, kind, principal, policyName);
+			if (!claimed) {
+				const key = removalKey(kind, principal, policyName);
+				const noted = this.removals.get(key) ?? {
+					kind,
+					principal,
+					policyName,
+					removers: /* @__PURE__ */ new Map()
+				};
+				noted.removers.set(logicalId, stateResources[logicalId]);
+				this.removals.set(key, noted);
+			}
+			return claimed;
+		};
+	}
+	takeHeldRemovals(stateResources) {
+		const held = [];
+		for (const [key, { kind, principal, policyName, removers }] of this.removals) {
+			const { holders, unreadable } = inlinePolicyHolders(stateResources, kind, principal, policyName);
+			const others = holders.filter((h) => !removers.has(h.logicalId) || stateResources[h.logicalId] !== removers.get(h.logicalId));
+			if (others.length === 0) continue;
+			this.removals.delete(key);
+			const open = new Set([...this.unsettled.values()].map((u) => u.logicalId));
+			const unsettled = [...new Set(others.map((h) => h.logicalId))].filter((id) => open.has(id));
+			held.push({
+				kind,
+				holders: others,
+				unreadable,
+				unsettled
+			});
+		}
+		return held;
+	}
+};
+function inlinePolicyHolders(stateResources, kind, principal, policyName) {
+	const holders = [];
+	const unreadable = [];
+	const unnamed = (v) => typeof v !== "string" || !IAM_NAME.test(v);
+	for (const [logicalId, record] of Object.entries(stateResources)) {
+		if (record === null || typeof record !== "object") continue;
+		const props = record.properties ?? {};
+		const standalone = standaloneInlinePolicyOf(record.resourceType, props);
+		if (standalone !== void 0) {
+			if (standalone.kind !== kind) continue;
+			const principalMatches = sameIamName(standalone.principal, principal);
+			const nameMatches = sameIamName(standalone.policyName, policyName);
+			if (principalMatches && nameMatches) holders.push({
+				logicalId,
+				principal: standalone.principal,
+				policyName: standalone.policyName,
+				document: props["PolicyDocument"]
+			});
+			else if ((principalMatches || unnamed(standalone.principal)) && (nameMatches || unnamed(standalone.policyName))) unreadable.push(logicalId);
+			continue;
+		}
+		if (record.resourceType === "AWS::IAM::Policy") {
+			const nameMatches = sameIamName(record.physicalId, policyName);
+			if (!nameMatches && !unnamed(record.physicalId)) continue;
+			const listed = props[POLICY_LIST_FIELDS[kind]];
+			const entries = Array.isArray(listed) ? listed : [];
+			const named = entries.find((p) => sameIamName(p, principal));
+			if (nameMatches && typeof named === "string") holders.push({
+				logicalId,
+				principal: named,
+				policyName: record.physicalId,
+				document: props["PolicyDocument"]
+			});
+			else if (named !== void 0 || entries.some(unnamed)) unreadable.push(logicalId);
+			continue;
+		}
+		if (!Object.hasOwn(PRINCIPAL_KINDS, record.resourceType)) continue;
+		if (PRINCIPAL_KINDS[record.resourceType] !== kind) continue;
+		const principalMatches = sameIamName(record.physicalId, principal);
+		if (!principalMatches && !unnamed(record.physicalId)) continue;
+		const policies = props["Policies"];
+		if (!Array.isArray(policies)) continue;
+		for (const entry of policies) {
+			if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+			const name = entry["PolicyName"];
+			if (principalMatches && sameIamName(name, policyName)) holders.push({
+				logicalId,
+				principal: record.physicalId,
+				policyName: name,
+				document: entry["PolicyDocument"]
+			});
+			else if (unnamed(name) || sameIamName(name, policyName)) unreadable.push(logicalId);
+		}
+	}
+	return {
+		holders,
+		unreadable: [...new Set(unreadable)]
+	};
+}
+function sameIamName(a, b) {
+	return typeof a === "string" && IAM_NAME.test(a) && a.toLowerCase() === b.toLowerCase();
+}
+function removalKey(kind, principal, policyName) {
+	return JSON.stringify([
+		kind,
+		principal.toLowerCase(),
+		policyName.toLowerCase()
+	]);
+}
+const IAM_NAME = /^[\w+=,.@-]+$/;
+const POLICY_LIST_FIELDS = {
+	role: "Roles",
+	group: "Groups",
+	user: "Users"
+};
+const PRINCIPAL_KINDS = {
+	"AWS::IAM::Role": "role",
+	"AWS::IAM::Group": "group",
+	"AWS::IAM::User": "user"
+};
+const STANDALONE_POLICY_KINDS = {
+	"AWS::IAM::RolePolicy": "role",
+	"AWS::IAM::GroupPolicy": "group",
+	"AWS::IAM::UserPolicy": "user"
+};
+function isStandaloneInlinePolicyType(resourceType) {
+	return Object.hasOwn(STANDALONE_POLICY_KINDS, resourceType);
+}
+function standaloneInlinePolicyOf(resourceType, properties) {
+	if (!isStandaloneInlinePolicyType(resourceType)) return void 0;
+	const kind = STANDALONE_POLICY_KINDS[resourceType];
+	const props = properties ?? {};
+	return {
+		kind,
+		principal: props[PRINCIPAL_NAME_FIELDS[kind]],
+		policyName: props["PolicyName"]
+	};
+}
+function standaloneInlinePolicyHandedOff(resourceType, properties, claimed, physicalId) {
+	if (claimed === void 0) return false;
+	const target = standaloneInlinePolicyOf(resourceType, properties);
+	if (target === void 0) return false;
+	const { kind, principal, policyName } = target;
+	if (typeof principal !== "string" || !IAM_NAME.test(principal)) return false;
+	if (typeof policyName !== "string" || !IAM_NAME.test(policyName)) return false;
+	if (physicalId !== void 0 && physicalId.toLowerCase() !== `${policyName}|${principal}`.toLowerCase()) return false;
+	return claimed(kind, principal, policyName) === true;
+}
+function isInlinePolicyPrincipalType(resourceType) {
+	return Object.hasOwn(PRINCIPAL_KINDS, resourceType);
+}
+function principalKindOf(resourceType) {
+	return Object.hasOwn(PRINCIPAL_KINDS, resourceType) ? PRINCIPAL_KINDS[resourceType] : void 0;
+}
+const ANY = "*";
+const PRINCIPAL_NAME_FIELDS = {
+	role: "RoleName",
+	group: "GroupName",
+	user: "UserName"
+};
+function nameKey(value) {
+	return typeof value === "string" && IAM_NAME.test(value) ? value.toLowerCase() : ANY;
+}
+function templatePrincipalKeys(entry, kind, templateResources, stateResources) {
+	if (typeof entry === "string") return [nameKey(entry)];
+	const ref = typeof entry === "object" && entry !== null && !Array.isArray(entry) ? entry["Ref"] : void 0;
+	if (typeof ref !== "string" || !Object.hasOwn(templateResources, ref)) return [ANY];
+	const target = templateResources[ref];
+	if (principalKindOf(target.Type) !== kind) return [ANY];
+	return principalSelfKeys(ref, kind, target, stateResources);
+}
+function principalSelfKeys(logicalId, kind, template, stateResources) {
+	const keys = [`ref:${logicalId}`];
+	const declared = template?.Properties?.[PRINCIPAL_NAME_FIELDS[kind]];
+	const declaredKey = nameKey(declared);
+	if (declaredKey !== ANY) keys.push(declaredKey);
+	const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+	if (record !== void 0 && principalKindOf(record.resourceType) === kind) {
+		const recordedKey = nameKey(record.physicalId);
+		if (recordedKey !== ANY) keys.push(recordedKey);
+	}
+	return keys;
+}
+function policiesNames(policies) {
+	if (policies === void 0 || policies === null) return [];
+	if (!Array.isArray(policies)) return [ANY];
+	return policies.map((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) ? nameKey(entry["PolicyName"]) : ANY);
+}
+function standaloneClaimSides(logicalId, change, templateResources, stateResources) {
+	const template = Object.hasOwn(templateResources, logicalId) ? templateResources[logicalId] : void 0;
+	const desired = standaloneInlinePolicyOf(change.resourceType, template?.Properties ?? {});
+	if (desired === void 0) return void 0;
+	const { kind } = desired;
+	const name = nameKey(desired.policyName);
+	const sides = {
+		desired: templatePrincipalKeys(desired.principal, kind, templateResources, stateResources).map((principal) => ({
+			kind,
+			principal,
+			name
+		})),
+		old: []
+	};
+	const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+	if (record?.resourceType === change.resourceType) {
+		const old = standaloneInlinePolicyOf(change.resourceType, record.properties);
+		sides.old.push({
+			kind,
+			principal: nameKey(old.principal),
+			name: nameKey(old.policyName)
+		});
+	}
+	return sides;
+}
+function inlinePolicyClaimsOf(logicalId, change, templateResources, stateResources) {
+	const template = Object.hasOwn(templateResources, logicalId) ? templateResources[logicalId] : void 0;
+	const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+	const recorded = record?.resourceType === change.resourceType ? record : void 0;
+	const claims = [];
+	const cross = (kind, principals, names) => {
+		for (const principal of new Set(principals)) for (const name of new Set(names)) claims.push({
+			kind,
+			principal,
+			name
+		});
+	};
+	const standalone = standaloneClaimSides(logicalId, change, templateResources, stateResources);
+	if (standalone !== void 0) return [...standalone.desired, ...standalone.old];
+	if (change.resourceType === "AWS::IAM::Policy") {
+		const desired = template?.Properties ?? {};
+		const old = recorded?.properties ?? {};
+		const names = [];
+		if (desired["PolicyName"] !== void 0) names.push(nameKey(desired["PolicyName"]));
+		if (old["PolicyName"] !== void 0) names.push(nameKey(old["PolicyName"]));
+		if (recorded !== void 0) names.push(nameKey(typeof recorded.physicalId === "string" ? recorded.physicalId.split(":")[0] : recorded.physicalId));
+		if (names.length === 0) return claims;
+		for (const kind of [
+			"role",
+			"group",
+			"user"
+		]) {
+			const field = POLICY_LIST_FIELDS[kind];
+			const principals = [];
+			const listed = desired[field];
+			if (Array.isArray(listed)) for (const entry of listed) principals.push(...templatePrincipalKeys(entry, kind, templateResources, stateResources));
+			else if (listed !== void 0) principals.push(ANY);
+			const held = old[field];
+			if (Array.isArray(held)) principals.push(...held.map(nameKey));
+			else if (held !== void 0 && held !== null) principals.push(ANY);
+			cross(kind, principals, names);
+		}
+		return claims;
+	}
+	const kind = principalKindOf(change.resourceType);
+	if (kind === void 0) return claims;
+	if (!(change.changeType === "CREATE" || (change.propertyChanges ?? []).some((c) => c.requiresReplacement) || ownPoliciesChange(change))) return claims;
+	cross(kind, principalSelfKeys(logicalId, kind, template, stateResources), [...policiesNames(template?.Properties?.["Policies"]), ...policiesNames(recorded?.properties?.["Policies"])]);
+	return claims;
+}
+function orderInlinePolicyWriters(args) {
+	const { writes, changes, templateResources, stateResources, dependencies, rank } = args;
+	const writers = writes.filter((id) => {
+		const type = changes.get(id)?.resourceType;
+		return type === "AWS::IAM::Policy" || type !== void 0 && (isInlinePolicyPrincipalType(type) || isStandaloneInlinePolicyType(type));
+	});
+	if (writers.length < 2) return [];
+	const exact = /* @__PURE__ */ new Map();
+	const loose = [];
+	const all = [];
+	for (const id of writers) for (const claim of inlinePolicyClaimsOf(id, changes.get(id), templateResources, stateResources)) {
+		all.push({
+			id,
+			claim
+		});
+		if (claim.principal === ANY || claim.name === ANY) {
+			loose.push({
+				id,
+				claim
+			});
+			continue;
+		}
+		const key = JSON.stringify([
+			claim.kind,
+			claim.principal,
+			claim.name
+		]);
+		const ids = exact.get(key) ?? /* @__PURE__ */ new Set();
+		ids.add(id);
+		exact.set(key, ids);
+	}
+	const principalRows = new Set(writers.filter((id) => isInlinePolicyPrincipalType(changes.get(id).resourceType)));
+	const standaloneRows = new Set(writers.filter((id) => isStandaloneInlinePolicyType(changes.get(id).resourceType)));
+	const sides = new Map([...standaloneRows].map((id) => [id, standaloneClaimSides(id, changes.get(id), templateResources, stateResources)]));
+	const sameClaim = (p, q) => p.kind === q.kind && (p.principal === ANY || q.principal === ANY || p.principal === q.principal) && (p.name === ANY || q.name === ANY || p.name === q.name);
+	const releasesFor = (a, b) => sides.get(a).old.some((o) => sides.get(b).desired.some((d) => sameClaim(o, d)));
+	const pairs = /* @__PURE__ */ new Map();
+	const pair = (a, b) => {
+		if (a === b || principalRows.has(a) && principalRows.has(b)) return;
+		const sa = standaloneRows.has(a);
+		const sb = standaloneRows.has(b);
+		let first;
+		if (sa !== sb) first = sa ? b : a;
+		else if (sa && sb) {
+			const aReleases = releasesFor(a, b);
+			if (aReleases !== releasesFor(b, a)) first = aReleases ? a : b;
+		}
+		first ??= rank(a) < rank(b) || rank(a) === rank(b) && a < b ? a : b;
+		const [x, y] = first === a ? [a, b] : [b, a];
+		pairs.set(JSON.stringify([x, y]), [x, y]);
+	};
+	for (const ids of exact.values()) {
+		const list = [...ids];
+		for (let i = 0; i < list.length; i++) for (let j = i + 1; j < list.length; j++) pair(list[i], list[j]);
+	}
+	const meets = (a, b) => a === ANY || b === ANY || a === b;
+	for (const { id, claim } of loose) for (const other of all) {
+		if (other.claim.kind !== claim.kind) continue;
+		if (meets(claim.principal, other.claim.principal) && meets(claim.name, other.claim.name)) pair(id, other.id);
+	}
+	if (pairs.size === 0) return [];
+	const reaches = (from, to) => {
+		const seen = /* @__PURE__ */ new Set();
+		const stack = [from];
+		while (stack.length > 0) {
+			const id = stack.pop();
+			if (id === to) return true;
+			if (seen.has(id)) continue;
+			seen.add(id);
+			for (const dep of dependencies.get(id) ?? []) stack.push(dep);
+		}
+		return false;
+	};
+	const added = [];
+	for (const [before, after] of pairs.values()) {
+		if (reaches(after, before) || reaches(before, after)) continue;
+		const deps = dependencies.get(after) ?? /* @__PURE__ */ new Set();
+		deps.add(before);
+		dependencies.set(after, deps);
+		added.push({
+			before,
+			after
+		});
+	}
+	return added;
+}
+function recordInlinePolicyKeys(record) {
+	if (record === void 0 || record === null || typeof record !== "object") return [];
+	const props = record.properties ?? {};
+	const keys = [];
+	const add = (kind, principal, name) => {
+		keys.push(JSON.stringify([
+			kind,
+			nameKey(principal),
+			nameKey(name)
+		]));
+	};
+	const standalone = standaloneInlinePolicyOf(record.resourceType, props);
+	if (standalone !== void 0) {
+		add(standalone.kind, standalone.principal, standalone.policyName);
+		return keys;
+	}
+	if (record.resourceType === "AWS::IAM::Policy") {
+		const names = [props["PolicyName"], typeof record.physicalId === "string" ? record.physicalId.split(":")[0] : record.physicalId];
+		for (const kind of [
+			"role",
+			"group",
+			"user"
+		]) {
+			const listed = props[POLICY_LIST_FIELDS[kind]];
+			if (listed === void 0 || listed === null) continue;
+			const principals = Array.isArray(listed) ? listed : [void 0];
+			for (const p of principals) for (const n of names) add(kind, p, n);
+		}
+		return keys;
+	}
+	const kind = principalKindOf(record.resourceType);
+	if (kind === void 0) return keys;
+	for (const name of policiesNames(props["Policies"])) add(kind, record.physicalId, name);
+	return keys;
+}
+function orderInlinePolicyReversals(replay, stateResources) {
+	const current = (op) => Object.hasOwn(stateResources, op.logicalId) ? stateResources[op.logicalId] : void 0;
+	const isStandalone = (op) => [current(op), op.previousState].some((r) => r !== void 0 && r !== null && isStandaloneInlinePolicyType(r.resourceType));
+	if (!replay.some(isStandalone)) return [...replay];
+	const keysOf = /* @__PURE__ */ new Map();
+	for (const op of replay) {
+		const keys = [...recordInlinePolicyKeys(current(op)), ...recordInlinePolicyKeys(op.previousState)];
+		if (keys.length > 0) keysOf.set(op, new Set(keys));
+	}
+	if (keysOf.size < 2) return [...replay];
+	const meets = (a, b) => a === ANY || b === ANY || a === b;
+	const collide = (a, b) => {
+		for (const ka of a) {
+			const [kindA, pA, nA] = JSON.parse(ka);
+			for (const kb of b) {
+				const [kindB, pB, nB] = JSON.parse(kb);
+				if (kindA === kindB && meets(pA, pB) && meets(nA, nB)) return true;
+			}
+		}
+		return false;
+	};
+	const dependsOn = (a, b) => [current(a), a.previousState].some((r) => Array.isArray(r?.dependencies) && r.dependencies.includes(b.logicalId));
+	const order = [...replay];
+	for (const op of [...replay].reverse()) {
+		if (!isStandalone(op)) continue;
+		const mine = keysOf.get(op);
+		if (mine === void 0) continue;
+		const at = order.indexOf(op);
+		let last = -1;
+		for (let j = at + 1; j < order.length; j++) {
+			const other = order[j];
+			const theirs = keysOf.get(other);
+			if (dependsOn(op, other) || dependsOn(other, op)) break;
+			if (theirs === void 0 || isStandalone(other)) continue;
+			if (collide(mine, theirs)) last = j;
+		}
+		if (last < 0) continue;
+		order.splice(at, 1);
+		order.splice(last, 0, op);
+	}
+	return order;
+}
+function ownPoliciesChange(change) {
+	return (change?.propertyChanges ?? []).some((c) => c.path === "Policies" && c.inPlacePropagated !== true && c.replacementPropagated !== true);
+}
+
 //#endregion
 //#region src/provisioning/json-patch-generator.ts
 var JsonPatchGenerator = class {
@@ -23125,15 +24093,200 @@ function escapeRegExp$1(text) {
 	return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+//#endregion
+//#region src/provisioning/getatt-attributes.generated.ts
+const WRITABLE_GETATT_ATTRIBUTES = {
+	"AWS::Amplify::Branch": ["BranchName"],
+	"AWS::Amplify::Domain": [
+		"AutoSubDomainCreationPatterns",
+		"AutoSubDomainIAMRole",
+		"DomainName",
+		"EnableAutoSubDomain"
+	],
+	"AWS::AppMesh::GatewayRoute": [
+		"GatewayRouteName",
+		"MeshName",
+		"MeshOwner",
+		"VirtualGatewayName"
+	],
+	"AWS::AppMesh::Mesh": ["MeshName"],
+	"AWS::AppMesh::Route": [
+		"MeshName",
+		"MeshOwner",
+		"RouteName",
+		"VirtualRouterName"
+	],
+	"AWS::AppMesh::VirtualGateway": [
+		"MeshName",
+		"MeshOwner",
+		"VirtualGatewayName"
+	],
+	"AWS::AppMesh::VirtualNode": [
+		"MeshName",
+		"MeshOwner",
+		"VirtualNodeName"
+	],
+	"AWS::AppMesh::VirtualRouter": [
+		"MeshName",
+		"MeshOwner",
+		"VirtualRouterName"
+	],
+	"AWS::AppMesh::VirtualService": [
+		"MeshName",
+		"MeshOwner",
+		"VirtualServiceName"
+	],
+	"AWS::AppSync::DataSource": ["Name"],
+	"AWS::AppSync::DomainName": ["DomainName"],
+	"AWS::AppSync::FunctionConfiguration": ["DataSourceName", "Name"],
+	"AWS::AppSync::Resolver": ["FieldName", "TypeName"],
+	"AWS::Backup::BackupSelection": ["BackupPlanId"],
+	"AWS::Backup::BackupVault": ["BackupVaultName"],
+	"AWS::CleanRooms::AnalysisTemplate": ["Schema"],
+	"AWS::Cloud9::EnvironmentEC2": ["Name"],
+	"AWS::CloudWatch::InsightRule": ["RuleName"],
+	"AWS::CodeArtifact::Domain": ["EncryptionKey"],
+	"AWS::CodeArtifact::Repository": ["DomainName", "DomainOwner"],
+	"AWS::EC2::CapacityReservation": [
+		"AvailabilityZone",
+		"InstanceType",
+		"Tenancy"
+	],
+	"AWS::EC2::Instance": ["AvailabilityZone"],
+	"AWS::EC2::SecurityGroup": ["VpcId"],
+	"AWS::EC2::Subnet": [
+		"AvailabilityZone",
+		"AvailabilityZoneId",
+		"CidrBlock",
+		"OutpostArn",
+		"VpcId"
+	],
+	"AWS::EC2::VPC": ["CidrBlock"],
+	"AWS::EFS::MountTarget": ["IpAddress"],
+	"AWS::EKS::Nodegroup": ["ClusterName", "NodegroupName"],
+	"AWS::ElasticLoadBalancingV2::LoadBalancer": ["SecurityGroups"],
+	"AWS::EventSchemas::Discoverer": ["CrossAccount"],
+	"AWS::EventSchemas::Registry": ["RegistryName"],
+	"AWS::EventSchemas::Schema": ["SchemaName"],
+	"AWS::Events::EventBus": ["Name"],
+	"AWS::GameLift::GameSessionQueue": ["Name"],
+	"AWS::GameLift::MatchmakingConfiguration": ["Name"],
+	"AWS::GameLift::MatchmakingRuleSet": ["Name"],
+	"AWS::Grafana::Workspace": ["GrafanaVersion"],
+	"AWS::Greengrass::ConnectorDefinition": ["Name"],
+	"AWS::Greengrass::CoreDefinition": ["Name"],
+	"AWS::Greengrass::DeviceDefinition": ["Name"],
+	"AWS::Greengrass::FunctionDefinition": ["Name"],
+	"AWS::Greengrass::Group": ["Name", "RoleArn"],
+	"AWS::Greengrass::LoggerDefinition": ["Name"],
+	"AWS::Greengrass::ResourceDefinition": ["Name"],
+	"AWS::Greengrass::SubscriptionDefinition": ["Name"],
+	"AWS::ImageBuilder::Component": ["Name"],
+	"AWS::ImageBuilder::ContainerRecipe": ["Name"],
+	"AWS::ImageBuilder::DistributionConfiguration": ["Name"],
+	"AWS::ImageBuilder::ImagePipeline": ["Name"],
+	"AWS::ImageBuilder::ImageRecipe": ["Name"],
+	"AWS::ImageBuilder::InfrastructureConfiguration": ["Name"],
+	"AWS::Kinesis::StreamConsumer": ["ConsumerName", "StreamARN"],
+	"AWS::MSK::Cluster": ["CurrentVersion"],
+	"AWS::ManagedBlockchain::Member": ["NetworkId"],
+	"AWS::ManagedBlockchain::Node": ["MemberId", "NetworkId"],
+	"AWS::MediaConvert::JobTemplate": ["Name"],
+	"AWS::MediaConvert::Preset": ["Name"],
+	"AWS::MediaConvert::Queue": ["Name"],
+	"AWS::OpsWorks::Instance": ["AvailabilityZone"],
+	"AWS::OpsWorks::UserProfile": ["SshUsername"],
+	"AWS::QuickSight::Analysis": ["Errors", "Sheets"],
+	"AWS::RDS::DBInstance": ["DBSystemId"],
+	"AWS::RDS::DBParameterGroup": ["DBParameterGroupName"],
+	"AWS::RedshiftServerless::Workgroup": ["Workgroup"],
+	"AWS::RoboMaker::RobotApplication": ["CurrentRevisionId"],
+	"AWS::RoboMaker::SimulationApplication": ["CurrentRevisionId"],
+	"AWS::Route53Resolver::ResolverEndpoint": [
+		"Direction",
+		"Name",
+		"OutpostArn",
+		"PreferredInstanceType",
+		"ResolverEndpointType"
+	],
+	"AWS::Route53Resolver::ResolverRule": [
+		"DomainName",
+		"Name",
+		"ResolverEndpointId",
+		"TargetIps"
+	],
+	"AWS::Route53Resolver::ResolverRuleAssociation": [
+		"Name",
+		"ResolverRuleId",
+		"VPCId"
+	],
+	"AWS::S3::AccessPoint": ["Name"],
+	"AWS::SNS::Topic": ["TopicName"],
+	"AWS::SQS::Queue": ["QueueName"],
+	"AWS::SSM::Parameter": ["Type"],
+	"AWS::SSM::ResourceDataSync": ["SyncName"],
+	"AWS::SageMaker::CodeRepository": ["CodeRepositoryName"],
+	"AWS::SageMaker::Endpoint": ["EndpointName"],
+	"AWS::SageMaker::EndpointConfig": ["EndpointConfigName"],
+	"AWS::SageMaker::Model": ["ModelName"],
+	"AWS::SageMaker::ModelPackage": ["LastModifiedTime"],
+	"AWS::SageMaker::NotebookInstance": ["NotebookInstanceName"],
+	"AWS::SageMaker::NotebookInstanceLifecycleConfig": ["NotebookInstanceLifecycleConfigName"],
+	"AWS::SageMaker::Workteam": ["WorkteamName"],
+	"AWS::ServiceDiscovery::Service": ["Name"],
+	"AWS::Signer::SigningProfile": ["ProfileName"],
+	"AWS::StepFunctions::Activity": ["Name"],
+	"AWS::Transfer::User": ["ServerId", "UserName"]
+};
+const SHAPE_MISMATCHED_GETATT_ATTRIBUTES = {
+	"AWS::DocDB::DBCluster": ["Port"],
+	"AWS::Events::EventBus": ["Policy"],
+	"AWS::MediaLive::Input": ["Destinations", "Sources"]
+};
+
 //#endregion
 //#region src/provisioning/read-only-properties.ts
+function isDefinitiveRefusal(error) {
+	if (isThrottlingError(error)) return false;
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		const status = current.$metadata?.httpStatusCode;
+		if (status !== void 0) return status >= 400 && status < 500;
+		current = current.cause;
+	}
+	return false;
+}
 const readOnlyPropertiesCache = /* @__PURE__ */ new Map();
+const attributeNamesCache = /* @__PURE__ */ new Map();
+async function getTopLevelAttributeNames(resourceType) {
+	const readOnly = await getTopLevelReadOnlyProperties(resourceType);
+	if (readOnly === void 0) return void 0;
+	const writable = Object.hasOwn(WRITABLE_GETATT_ATTRIBUTES, resourceType) ? WRITABLE_GETATT_ATTRIBUTES[resourceType] : void 0;
+	if (!writable || writable.length === 0) return readOnly;
+	const cached = attributeNamesCache.get(resourceType);
+	if (cached) return cached;
+	const names = /* @__PURE__ */ new Set([...readOnly, ...writable]);
+	attributeNamesCache.set(resourceType, names);
+	return names;
+}
+const deployAttributeNamesCache = /* @__PURE__ */ new Map();
+async function getTopLevelDeployAttributeNames(resourceType) {
+	const certified = await getTopLevelAttributeNames(resourceType);
+	if (certified === void 0) return void 0;
+	const mismatched = Object.hasOwn(SHAPE_MISMATCHED_GETATT_ATTRIBUTES, resourceType) ? SHAPE_MISMATCHED_GETATT_ATTRIBUTES[resourceType] : void 0;
+	if (!mismatched || mismatched.length === 0) return certified;
+	const cached = deployAttributeNamesCache.get(resourceType);
+	if (cached) return cached;
+	const names = /* @__PURE__ */ new Set([...certified, ...mismatched]);
+	deployAttributeNamesCache.set(resourceType, names);
+	return names;
+}
 function getTopLevelReadOnlyProperties(resourceType) {
 	if (hasNoRegistrySchema(resourceType)) return Promise.resolve(void 0);
 	const cached = readOnlyPropertiesCache.get(resourceType);
 	if (cached) return cached;
 	const entry = fetchTopLevelReadOnlyProperties(resourceType).catch((error) => {
-		readOnlyPropertiesCache.delete(resourceType);
+		if (!isDefinitiveRefusal(error)) readOnlyPropertiesCache.delete(resourceType);
 		const message = describeAwsFailure(error).detail;
 		getLogger().child("ReadOnlyProperties").debug(`Failed to resolve read-only properties for ${displaySafe(resourceType, { asciiOnly: true })} via cloudformation:DescribeType (${message}).`);
 	});
@@ -23550,10 +24703,11 @@ var CloudControlProvider = class {
 	async create(logicalId, resourceType, properties, context) {
 		const mask = maskerOrIdentity(context?.maskSecrets);
 		const idLog = new IdScrubLog(this.logger, mask, holdsSecretDerivedLeaf(properties, mask));
-		return inIdLogScope(idLog, () => this.createInIdLogScope(logicalId, resourceType, properties, idLog));
+		return inIdLogScope(idLog, () => this.createInIdLogScope(logicalId, resourceType, properties, idLog, mask));
 	}
-	async createInIdLogScope(logicalId, resourceType, properties, idLog) {
+	async createInIdLogScope(logicalId, resourceType, properties, idLog, mask) {
 		this.logger.debug(`Creating resource ${logicalId} (${resourceType})`);
+		const attributeNamesLookup = getTopLevelDeployAttributeNames(resourceType);
 		try {
 			const ccProperties = stringifyJsonProperties(resourceType, stripNullValues(properties));
 			const desiredState = JSON.stringify(ccProperties);
@@ -23571,7 +24725,9 @@ var CloudControlProvider = class {
 			const result = { physicalId: progressEvent.Identifier };
 			if (progressEvent.ResourceModel) result.attributes = this.parseResourceModel(progressEvent.ResourceModel);
 			result.attributes = await this.mergeSparseModelReadback(resourceType, progressEvent.Identifier, result.attributes || {});
+			const modelKeys = Object.keys(result.attributes);
 			result.attributes = await this.enrichResourceAttributes(resourceType, progressEvent.Identifier, result.attributes);
+			result.attributes = await this.maskDeployedNonAttributeKeys(result.attributes, modelKeys, resourceType, progressEvent.Identifier, attributeNamesLookup, properties, mask);
 			return result;
 		} catch (error) {
 			idLog.addId(identifierCarriedBy(error));
@@ -23642,6 +24798,7 @@ var CloudControlProvider = class {
 					sentNothing: true
 				};
 			}
+			const attributeNamesLookup = getTopLevelDeployAttributeNames(resourceType);
 			const writeOnlyProperties = await getTopLevelWriteOnlyProperties(resourceType);
 			if (writeOnlyProperties.size > 0) {
 				const keptOnPreviousSide = getTopLevelKeysHoldingUnreadableCreateOnly(resourceType, cleanProperties);
@@ -23682,7 +24839,9 @@ var CloudControlProvider = class {
 			};
 			if (progressEvent.ResourceModel) result.attributes = this.parseResourceModel(progressEvent.ResourceModel, idLog);
 			result.attributes = await this.mergeSparseModelReadback(resourceType, physicalId, result.attributes || {}, idLog);
+			const modelKeys = Object.keys(result.attributes);
 			result.attributes = await this.enrichResourceAttributes(resourceType, physicalId, result.attributes, idLog);
+			result.attributes = await this.maskDeployedNonAttributeKeys(result.attributes, modelKeys, resourceType, physicalId, attributeNamesLookup, properties, maskerOrIdentity(context?.maskSecrets), idLog);
 			return result;
 		} catch (error) {
 			this.handleError(error, "UPDATE", resourceType, logicalId, physicalId);
@@ -23707,10 +24866,14 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		await this.assertRecordedRegionAgainstClient("pre-delete", context?.expectedRegion, resourceType, logicalId, physicalId);
+		if (standaloneInlinePolicyHandedOff(resourceType, properties, context?.inlinePolicyClaimed, physicalId)) {
+			this.logger.info(`  ${logicalId}: not deleting its inline policy, which another resource of this deploy now holds under the same name`);
+			return;
+		}
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Ca7cV9tM.js");
+			const { ASGProvider } = await import("./asg-provider-B1xRE8do.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -23816,7 +24979,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-B4sFJ8YW.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-B1D2CFBs.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-J40R0ysf.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CU_1O2FR.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -24461,6 +25624,25 @@ var CloudControlProvider = class {
 			throw error;
 		}
 	}
+	async maskDeployedNonAttributeKeys(attributes, modelKeys, resourceType, physicalId, attributeNamesLookup, desired, mask, log = this.logger) {
+		const safeType = displaySafe(resourceType, { asciiOnly: true });
+		const attributeNames = await attributeNamesLookup;
+		if (attributeNames === void 0) {
+			log.debug(`Could not resolve the CloudFormation schema for ${safeType}; recording its Cloud Control model unnarrowed for ${displaySafe(physicalId, { asciiOnly: true })}.`);
+			return attributes;
+		}
+		const narrowed = new Set(modelKeys.filter((key) => !attributeNames.has(key) && !isLiteralDeployOnlyKey(resourceType, key, desired, mask)));
+		if (narrowed.size === 0) return attributes;
+		const out = Object.create(null);
+		for (const [key, value] of Object.entries(attributes)) Object.defineProperty(out, key, {
+			value: narrowed.has(key) ? maskLeavesDeep(value) : value,
+			enumerable: true,
+			writable: true,
+			configurable: true
+		});
+		log.debug(`Masked ${narrowed.size} non-attribute key(s) of the ${safeType} Cloud Control model for ${displaySafe(physicalId, { asciiOnly: true })}: they are not Fn::GetAtt attributes of the type.`);
+		return out;
+	}
 	async import(input) {
 		if (!input.knownPhysicalId) return null;
 		const identifier = toCloudControlIdentifier({
@@ -24501,7 +25683,7 @@ var CloudControlProvider = class {
 	async maskUncertifiedModelValues(model, resourceType, physicalId) {
 		const safeType = displaySafe(resourceType, { asciiOnly: true });
 		const safeId = displaySafe(physicalId, { asciiOnly: true });
-		const attributeNames = await getTopLevelReadOnlyProperties(resourceType);
+		const attributeNames = await getTopLevelAttributeNames(resourceType);
 		if (attributeNames === void 0) {
 			if (!this.warnedUnresolvableSchemaTypes.has(resourceType)) {
 				this.warnedUnresolvableSchemaTypes.add(resourceType);
@@ -24515,7 +25697,7 @@ var CloudControlProvider = class {
 			masked[key] = maskLeavesDeep(value);
 			maskedCount++;
 		}
-		if (maskedCount > 0 && attributeNames !== void 0) this.logger.debug(`Masked ${maskedCount} non-attribute key(s) out of the ${safeType} Cloud Control model for ${safeId}: they are not in the type's readOnlyProperties, so CloudFormation would reject an Fn::GetAtt naming them and cdkd has no evidence they are safe to persist.`);
+		if (maskedCount > 0 && attributeNames !== void 0) this.logger.debug(`Masked ${maskedCount} non-attribute key(s) out of the ${safeType} Cloud Control model for ${safeId}: they are not Fn::GetAtt attributes of the type, so CloudFormation would reject an Fn::GetAtt naming them and cdkd has no evidence they are safe to persist.`);
 		return masked;
 	}
 };
@@ -24616,6 +25798,11 @@ function holdsSecretDerivedLeaf(value, mask, depth = 0) {
 	return Object.entries(value).some(([key, entry]) => isSecretDerivedValue(key, mask) || holdsSecretDerivedLeaf(entry, mask, depth + 1));
 }
 const IMPORT_YIELDED_NO_ATTRIBUTES_CONSEQUENCE = "Attributes the stack's state already records for this physical id are kept; without them, an Fn::GetAtt against this resource falls back to a value constructed from its physical id.";
+function isLiteralDeployOnlyKey(resourceType, key, desired, mask) {
+	if (resourceType !== "AWS::SSM::Parameter" || key !== "Value") return false;
+	const declared = desired["Value"];
+	return typeof declared === "string" && !isSecretDerivedValue(declared, mask);
+}
 function maskLeavesDeep(value) {
 	if (Array.isArray(value)) return value.map((element) => maskLeavesDeep(element));
 	if (value !== null && typeof value === "object") {
@@ -24626,6 +25813,124 @@ function maskLeavesDeep(value) {
 	return "***";
 }
 
+//#endregion
+//#region src/state/state-bucket-lifecycle.ts
+const CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID = "cdkd-custom-resource-responses-expiration";
+const CUSTOM_RESOURCE_RESPONSE_EXPIRATION_DAYS = 1;
+const CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_PREFIX = `${CUSTOM_RESOURCE_RESPONSE_PREFIX}/cdkd-1`;
+function buildCustomResourceResponseLifecycleRule(legacyPrefix) {
+	const prefix = CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_PREFIX;
+	return {
+		ID: CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID,
+		Status: "Enabled",
+		...legacyPrefix ? { Prefix: prefix } : { Filter: { Prefix: prefix } },
+		Expiration: { Days: 1 },
+		NoncurrentVersionExpiration: { NoncurrentDays: 1 }
+	};
+}
+async function applyCustomResourceResponseExpiration(s3, bucket, opts = {}) {
+	const owner = opts.expectedBucketOwner ? { ExpectedBucketOwner: opts.expectedBucketOwner } : {};
+	const first = await readLifecycle(s3, bucket, owner);
+	if ("failed" in first) return first.failed;
+	if (first.rules.some((rule) => rule.ID === "cdkd-custom-resource-responses-expiration")) return { status: "present" };
+	let collision;
+	try {
+		collision = await findStateUnderResponsePrefix(s3, bucket, owner);
+	} catch (error) {
+		return failedOutcome("ListObjectsV2", error);
+	}
+	if (collision !== void 0) return {
+		status: "refused",
+		reason: `${CUSTOM_RESOURCE_RESPONSE_PREFIX}/${displaySafe(collision) || "<unrenderable>"} holds objects other than custom-resource responses (a stack deployed with --state-prefix ${CUSTOM_RESOURCE_RESPONSE_PREFIX}), and the rule would expire them`
+	};
+	const latest = await readLifecycle(s3, bucket, owner);
+	if ("failed" in latest) return latest.failed;
+	if (latest.rules.some((rule) => rule.ID === "cdkd-custom-resource-responses-expiration")) return { status: "present" };
+	const existing = latest.rules;
+	const minimumObjectSize = latest.minimumObjectSize;
+	const legacyPrefix = existing.some((rule) => rule.Prefix !== void 0);
+	try {
+		await s3.send(new PutBucketLifecycleConfigurationCommand({
+			Bucket: bucket,
+			...owner,
+			LifecycleConfiguration: { Rules: [...existing, buildCustomResourceResponseLifecycleRule(legacyPrefix)] },
+			...minimumObjectSize !== void 0 && { TransitionDefaultMinimumObjectSize: minimumObjectSize }
+		}));
+	} catch (error) {
+		return failedOutcome("PutBucketLifecycleConfiguration", error);
+	}
+	return { status: "added" };
+}
+async function readLifecycle(s3, bucket, owner) {
+	try {
+		const current = await s3.send(new GetBucketLifecycleConfigurationCommand({
+			Bucket: bucket,
+			...owner
+		}));
+		return {
+			rules: current.Rules ?? [],
+			minimumObjectSize: current.TransitionDefaultMinimumObjectSize
+		};
+	} catch (error) {
+		if (error?.name === "NoSuchLifecycleConfiguration") return {
+			rules: [],
+			minimumObjectSize: void 0
+		};
+		return { failed: failedOutcome("GetBucketLifecycleConfiguration", error) };
+	}
+}
+function isAccessDenied(error) {
+	const e = error;
+	return e?.name === "AccessDenied" || e?.$metadata?.httpStatusCode === 403;
+}
+function failedOutcome(operation, error) {
+	return {
+		status: "failed",
+		reason: failureReason(operation, error),
+		accessDenied: isAccessDenied(error)
+	};
+}
+async function findStateUnderResponsePrefix(s3, bucket, owner) {
+	let token;
+	do {
+		const page = await s3.send(new ListObjectsV2Command({
+			Bucket: bucket,
+			...owner,
+			Prefix: CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_PREFIX,
+			Delimiter: "/",
+			EncodingType: "url",
+			...token !== void 0 && { ContinuationToken: token }
+		}));
+		const first = decodeListingKey(page.CommonPrefixes?.find((p) => p.Prefix)?.Prefix);
+		if (first !== void 0) return first.slice(CUSTOM_RESOURCE_RESPONSE_PREFIX.length + 1);
+		token = page.IsTruncated ? page.NextContinuationToken : void 0;
+	} while (token !== void 0);
+}
+function failureReason(operation, error) {
+	return `${operation} failed: ${displaySafe(describeAwsFailure(error).detail) || "<unrenderable>"}`;
+}
+function customResourceResponseExpirationWarning(bucket, outcome) {
+	const remedy = outcome.status === "refused" ? `To add the rule, move that stack to a different --state-prefix.` : outcome.accessDenied ? "To add the rule, grant s3:GetLifecycleConfiguration, s3:PutLifecycleConfiguration and s3:ListBucket on the bucket, and check that this account owns it." : `To add the rule, review the bucket's lifecycle configuration against the reason above.`;
+	return `Could not add the ${1}-day expiration lifecycle rule for ${CUSTOM_RESOURCE_RESPONSE_PREFIX}/ to state bucket ${displaySafe(bucket, { asciiOnly: true }) || "<unrenderable>"} (${outcome.reason}). The bucket's lifecycle configuration was left unchanged. Custom-resource response objects left by an interrupted run stay until 'cdkd gc' removes them. ${remedy}`;
+}
+const ensured = /* @__PURE__ */ new Map();
+function ensureCustomResourceResponseExpirationOnce(s3, bucket, log) {
+	const memo = ensured.get(bucket);
+	if (memo) return memo;
+	const run = (async () => {
+		try {
+			const owner = await expectedOwnerParam(s3);
+			const outcome = await applyCustomResourceResponseExpiration(s3, bucket, { ...owner.ExpectedBucketOwner && { expectedBucketOwner: owner.ExpectedBucketOwner } });
+			if (outcome.status === "failed" || outcome.status === "refused") log.warn(customResourceResponseExpirationWarning(bucket, outcome));
+			else if (outcome.status === "added") log.debug(`Added the ${1}-day expiration lifecycle rule for ${CUSTOM_RESOURCE_RESPONSE_PREFIX}/ to the state bucket.`);
+		} catch (error) {
+			log.warn(customResourceResponseExpirationWarning(bucket, failedOutcome("lifecycle check", error)));
+		}
+	})();
+	ensured.set(bucket, run);
+	return run;
+}
+
 //#endregion
 //#region src/deployment/resource-secrets-scope.ts
 const currentResourceSecretsStore = new AsyncLocalStorage();
@@ -24856,6 +26161,7 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 	logger = getLogger().child("NoEchoDeleteReresolution");
 	resolver;
 	parametersPromise;
+	printingNoEchoPromise;
 	noEchoParameters;
 	options;
 	constructor(options) {
@@ -24865,7 +26171,7 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 		const section = options.template.Parameters;
 		if (section !== null && typeof section === "object") for (const [name, definition] of Object.entries(section)) {
 			const noEcho = definition?.NoEcho;
-			if (noEcho === true || noEcho === "true") declared.add(name);
+			if (isNoEchoDeclared(noEcho)) declared.add(name);
 		}
 		for (const name of options.inheritedNoEchoParameters ?? []) declared.add(name);
 		this.noEchoParameters = declared;
@@ -24917,6 +26223,33 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 		for (const name of this.noEchoParameters) if (parameters !== void 0 && Object.hasOwn(parameters, name)) recordLogOnlyParameterValue(bag, parameters[name]);
 		return bag;
 	}
+	printingNoEchoValues() {
+		this.printingNoEchoPromise ??= this.printingNeedles().then((bag) => hasMaskableValues(bag) ? bag : void 0);
+		return this.printingNoEchoPromise;
+	}
+	async printingNeedles() {
+		const bag = this.newBag();
+		if (this.options.printingSeed !== void 0) carryLogOnlyValues(this.options.printingSeed, bag);
+		if (this.noEchoParameters.size === 0) return bag;
+		const parameters = await this.boundParameters();
+		const section = this.options.template.Parameters ?? {};
+		const supplied = this.options.parameters;
+		for (const name of this.noEchoParameters) {
+			if (parameters !== void 0) {
+				if (Object.hasOwn(parameters, name)) recordLogOnlyParameterValue(bag, parameters[name]);
+				continue;
+			}
+			if (supplied !== void 0 && Object.hasOwn(supplied, name)) {
+				const value = supplied[name];
+				if (!this.options.maskedParameters?.has(name)) recordLogOnlyParameterValue(bag, value);
+				continue;
+			}
+			const definition = Object.hasOwn(section, name) ? section[name] : void 0;
+			if (typeof definition?.Type === "string" && definition.Type.startsWith("AWS::SSM::")) continue;
+			if (definition?.Default !== void 0) recordLogOnlyParameterValue(bag, definition.Default);
+		}
+		return bag;
+	}
 	async valuesFor(logicalId, record) {
 		const masked = maskedNoEchoCoordinates(record.properties, noEchoLeavesOf(record));
 		if (masked.length === 0) return void 0;
@@ -24991,8 +26324,10 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 			const parameters0 = await this.boundParameters();
 			const rowTemplate = this.options.template.Resources?.[logicalId];
 			const passedClasses = parameters0 === void 0 ? void 0 : await classifyPassedParameters(rowTemplate?.Properties?.Parameters, this.inputSources(parameters0)).catch(() => void 0);
+			const printingSeed = await this.printingNoEchoValues().catch(() => void 0);
 			return new TemplateNoEchoReresolver({
 				...passedClasses !== void 0 && { passedClasses },
+				...printingSeed !== void 0 && { printingSeed },
 				template: child.template,
 				stackName: childStackName,
 				region: this.options.region,
@@ -25779,6 +27114,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 		if (!this.responseBucket) return "https://localhost/cfn-response-not-configured";
 		await this.ensureResponseClient();
 		const bucket = this.responseBucket;
+		if (this.responsePrefix === "custom-resource-responses") ensureCustomResourceResponseExpirationOnce(this.s3Client, bucket, this.logger);
 		try {
 			await withRetry(() => this.s3Client.send(new PutObjectCommand({
 				Bucket: bucket,
@@ -28434,191 +29770,6 @@ async function reserveStackCreateToken(options) {
 	};
 }
 
-//#endregion
-//#region src/deployment/inline-policy-claims.ts
-function isInlinePolicyClaimedByCompletedWriter(args, kind, principal, policyName) {
-	const { selfLogicalId, writers, changes, stateResources } = args;
-	for (const [lid, write] of writers) {
-		if (lid === selfLogicalId || !Object.hasOwn(stateResources, lid)) continue;
-		const record = stateResources[lid];
-		if (record.provisionedBy === "cc-api") continue;
-		const props = record.properties ?? {};
-		if (record.resourceType === "AWS::IAM::Policy") {
-			if (!sameIamName(record.physicalId, policyName)) continue;
-			const listed = props[POLICY_LIST_FIELDS[kind]];
-			if (Array.isArray(listed) && listed.some((p) => sameIamName(p, principal))) return true;
-			continue;
-		}
-		if (!Object.hasOwn(PRINCIPAL_KINDS, record.resourceType)) continue;
-		if (PRINCIPAL_KINDS[record.resourceType] !== kind) continue;
-		if (!sameIamName(record.physicalId, principal)) continue;
-		if (write !== "create" && !ownPoliciesChange(changes.get(lid))) continue;
-		const policies = props["Policies"];
-		if (!Array.isArray(policies)) continue;
-		if (policies.some((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) && sameIamName(entry["PolicyName"], policyName))) return true;
-	}
-	return false;
-}
-var RollbackInlinePolicyWriters = class {
-	entries = /* @__PURE__ */ new Map();
-	removals = /* @__PURE__ */ new Map();
-	unsettled = /* @__PURE__ */ new Map();
-	notePending(ops) {
-		for (const op of ops) if (!this.unsettled.has(op)) this.unsettled.set(op, {
-			logicalId: op.logicalId,
-			state: "pending"
-		});
-	}
-	noteOutcome(op, completed) {
-		if (!completed) {
-			this.unsettled.set(op, {
-				logicalId: op.logicalId,
-				state: "failed"
-			});
-			return;
-		}
-		for (const [key, entry] of this.unsettled) if (key === op || entry.logicalId === op.logicalId) this.unsettled.delete(key);
-	}
-	record(logicalId, write, record, policiesChanged, via) {
-		if (via === "cc-api") {
-			this.entries.delete(logicalId);
-			return;
-		}
-		this.entries.set(logicalId, {
-			write,
-			record,
-			policiesChanged
-		});
-	}
-	claimedFor(resourceType, logicalId, stateResources) {
-		if (resourceType !== "AWS::IAM::Policy" && !Object.hasOwn(PRINCIPAL_KINDS, resourceType)) return;
-		return (kind, principal, policyName) => {
-			const writers = /* @__PURE__ */ new Map();
-			const changes = /* @__PURE__ */ new Map();
-			for (const [lid, entry] of this.entries) {
-				if (!Object.hasOwn(stateResources, lid) || stateResources[lid] !== entry.record) continue;
-				writers.set(lid, entry.write);
-				if (entry.policiesChanged) changes.set(lid, {
-					logicalId: lid,
-					changeType: "UPDATE",
-					resourceType: entry.record.resourceType,
-					propertyChanges: [{
-						path: "Policies",
-						oldValue: void 0,
-						newValue: void 0,
-						requiresReplacement: false
-					}]
-				});
-			}
-			const claimed = isInlinePolicyClaimedByCompletedWriter({
-				selfLogicalId: logicalId,
-				writers,
-				changes,
-				stateResources
-			}, kind, principal, policyName);
-			if (!claimed) {
-				const key = removalKey(kind, principal, policyName);
-				const noted = this.removals.get(key) ?? {
-					kind,
-					principal,
-					policyName,
-					removers: /* @__PURE__ */ new Map()
-				};
-				noted.removers.set(logicalId, stateResources[logicalId]);
-				this.removals.set(key, noted);
-			}
-			return claimed;
-		};
-	}
-	takeHeldRemovals(stateResources) {
-		const held = [];
-		for (const [key, { kind, principal, policyName, removers }] of this.removals) {
-			const { holders, unreadable } = inlinePolicyHolders(stateResources, kind, principal, policyName);
-			const others = holders.filter((h) => !removers.has(h.logicalId) || stateResources[h.logicalId] !== removers.get(h.logicalId));
-			if (others.length === 0) continue;
-			this.removals.delete(key);
-			const open = new Set([...this.unsettled.values()].map((u) => u.logicalId));
-			const unsettled = [...new Set(others.map((h) => h.logicalId))].filter((id) => open.has(id));
-			held.push({
-				kind,
-				holders: others,
-				unreadable,
-				unsettled
-			});
-		}
-		return held;
-	}
-};
-function inlinePolicyHolders(stateResources, kind, principal, policyName) {
-	const holders = [];
-	const unreadable = [];
-	const unnamed = (v) => typeof v !== "string" || !IAM_NAME.test(v);
-	for (const [logicalId, record] of Object.entries(stateResources)) {
-		if (record === null || typeof record !== "object") continue;
-		const props = record.properties ?? {};
-		if (record.resourceType === "AWS::IAM::Policy") {
-			const nameMatches = sameIamName(record.physicalId, policyName);
-			if (!nameMatches && !unnamed(record.physicalId)) continue;
-			const listed = props[POLICY_LIST_FIELDS[kind]];
-			const entries = Array.isArray(listed) ? listed : [];
-			const named = entries.find((p) => sameIamName(p, principal));
-			if (nameMatches && typeof named === "string") holders.push({
-				logicalId,
-				principal: named,
-				policyName: record.physicalId,
-				document: props["PolicyDocument"]
-			});
-			else if (named !== void 0 || entries.some(unnamed)) unreadable.push(logicalId);
-			continue;
-		}
-		if (!Object.hasOwn(PRINCIPAL_KINDS, record.resourceType)) continue;
-		if (PRINCIPAL_KINDS[record.resourceType] !== kind) continue;
-		const principalMatches = sameIamName(record.physicalId, principal);
-		if (!principalMatches && !unnamed(record.physicalId)) continue;
-		const policies = props["Policies"];
-		if (!Array.isArray(policies)) continue;
-		for (const entry of policies) {
-			if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
-			const name = entry["PolicyName"];
-			if (principalMatches && sameIamName(name, policyName)) holders.push({
-				logicalId,
-				principal: record.physicalId,
-				policyName: name,
-				document: entry["PolicyDocument"]
-			});
-			else if (unnamed(name) || sameIamName(name, policyName)) unreadable.push(logicalId);
-		}
-	}
-	return {
-		holders,
-		unreadable: [...new Set(unreadable)]
-	};
-}
-function sameIamName(a, b) {
-	return typeof a === "string" && IAM_NAME.test(a) && a.toLowerCase() === b.toLowerCase();
-}
-function removalKey(kind, principal, policyName) {
-	return JSON.stringify([
-		kind,
-		principal.toLowerCase(),
-		policyName.toLowerCase()
-	]);
-}
-const IAM_NAME = /^[\w+=,.@-]+$/;
-const POLICY_LIST_FIELDS = {
-	role: "Roles",
-	group: "Groups",
-	user: "Users"
-};
-const PRINCIPAL_KINDS = {
-	"AWS::IAM::Role": "role",
-	"AWS::IAM::Group": "group",
-	"AWS::IAM::User": "user"
-};
-function ownPoliciesChange(change) {
-	return (change?.propertyChanges ?? []).some((c) => c.path === "Policies" && c.inPlacePropagated !== true && c.replacementPropagated !== true);
-}
-
 //#endregion
 //#region src/analyzer/destructive-changes.ts
 const IGNORED_RESOURCE_TYPES = /* @__PURE__ */ new Set(["AWS::CDK::Metadata"]);
@@ -29540,14 +30691,43 @@ function secretNamedRecordNeedles(resources, secrets, bag = /* @__PURE__ */ new
 	return bag;
 }
 function secretNamePrintingBag(logicalId, resources) {
-	const bag = /* @__PURE__ */ new Map();
-	const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
-	for (const needle of secretNameNeedlesOf(logicalId, record, void 0) ?? []) recordLogOnlyValue(bag, needle);
-	for (const needle of secretNamesReadBy(logicalId, record, resources)) recordLogOnlyValue(bag, needle);
-	return bag;
+	return secretNamePrintingBags(resources, void 0)(logicalId);
+}
+function secretNamePrintingBags(resources, noEchoValues) {
+	const secrets = noEchoValues !== void 0 && hasMaskableValues(noEchoValues) ? noEchoValues : void 0;
+	const judged = /* @__PURE__ */ new Map();
+	const needlesOf = (logicalId, record) => {
+		const hit = judged.get(logicalId);
+		if (hit !== void 0 && hit.record === record) return hit.needles;
+		const needles = secretNameNeedlesOf(logicalId, record, secrets, { embedded: void 0 });
+		judged.set(logicalId, {
+			record,
+			needles
+		});
+		return needles;
+	};
+	return (logicalId) => {
+		const bag = /* @__PURE__ */ new Map();
+		if (secrets !== void 0) carryLogOnlyValues(secrets, bag);
+		const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+		for (const needle of needlesOf(logicalId, record) ?? []) recordLogOnlyValue(bag, needle);
+		const leaves = [...wholeStringLeavesOf(record?.properties)].filter((leaf) => leaf !== "");
+		if (leaves.length === 0) return bag;
+		for (const [otherId, other] of Object.entries(resources)) {
+			if (otherId === logicalId) continue;
+			for (const needle of needlesOf(otherId, other) ?? []) if (leavesHoldNeedle(leaves, needle)) recordLogOnlyValue(bag, needle);
+		}
+		return bag;
+	};
 }
-function journaledOrphanPrintingBag(ops, stateResources) {
+function journaledOrphanPrintingBag(ops, stateResources, noEchoValues) {
 	const bag = /* @__PURE__ */ new Map();
+	const secrets = noEchoValues !== void 0 && hasMaskableValues(noEchoValues) ? noEchoValues : void 0;
+	if (secrets !== void 0) carryLogOnlyValues(secrets, bag);
+	const judge = {
+		secrets,
+		embedded: void 0
+	};
 	for (const op of ops) {
 		const record = {
 			resourceType: op.resourceType,
@@ -29556,9 +30736,9 @@ function journaledOrphanPrintingBag(ops, stateResources) {
 		};
 		const replaced = Object.hasOwn(stateResources, op.logicalId) ? stateResources[op.logicalId] : void 0;
 		for (const needle of [
-			...secretNameNeedlesOf(op.logicalId, record, void 0) ?? [],
-			...secretNameNeedlesOf(op.logicalId, replaced, void 0) ?? [],
-			...secretNamesReadBy(op.logicalId, record, stateResources)
+			...secretNameNeedlesOf(op.logicalId, record, secrets, judge) ?? [],
+			...secretNameNeedlesOf(op.logicalId, replaced, secrets, judge) ?? [],
+			...secretNamesReadBy(op.logicalId, record, stateResources, () => judge)
 		]) recordLogOnlyValue(bag, needle);
 	}
 	return bag;
@@ -29578,13 +30758,15 @@ function completedReplayEntries(ops) {
 		attemptedProperties: op.previousState.properties
 	}]]);
 }
-function orphanRecordsPrintingBag(records) {
+function orphanRecordsPrintingBag(records, noEchoValues) {
 	const bag = /* @__PURE__ */ new Map();
+	const secrets = noEchoValues !== void 0 && hasMaskableValues(noEchoValues) ? noEchoValues : void 0;
+	if (secrets !== void 0) carryLogOnlyValues(secrets, bag);
 	for (const entry of records) {
 		if (entry === null || typeof entry !== "object") continue;
 		const { logicalId, state } = entry;
 		if (typeof logicalId !== "string" || state === null || typeof state !== "object") continue;
-		for (const needle of secretNameNeedlesOf(logicalId, state, void 0) ?? []) recordLogOnlyValue(bag, needle);
+		for (const needle of secretNameNeedlesOf(logicalId, state, secrets, { embedded: void 0 }) ?? []) recordLogOnlyValue(bag, needle);
 	}
 	return bag;
 }
@@ -29694,7 +30876,7 @@ function withNoEchoDefaultsMasked(parameters) {
 	const masked = Object.create(null);
 	for (const [name, decl] of Object.entries(parameters)) {
 		const body = decl;
-		masked[name] = typeof body === "object" && body !== null && body["NoEcho"] === true && "Default" in body ? {
+		masked[name] = typeof body === "object" && body !== null && declaresNoEcho(body) && "Default" in body ? {
 			...body,
 			Default: NO_ECHO_DEFAULT_MASK
 		} : decl;
@@ -29906,7 +31088,7 @@ function noEchoParameterValueSeed(parameters, values, inherited, userParameters)
 	if (values === void 0) return seed;
 	for (const [name, value] of Object.entries(values)) {
 		if (isWholeDynamicReferenceValue(value)) continue;
-		if (parameters?.[name]?.NoEcho === true) {
+		if (parameters !== void 0 && declaresNoEcho(parameters[name])) {
 			const type = parameters[name]?.Type;
 			const ssmTyped = typeof type === "string" && type.startsWith("AWS::SSM::Parameter::Value<");
 			const spelled = Object.prototype.hasOwnProperty.call(userParameters ?? {}, name) ? userParameters?.[name] : parameters[name]?.Default;
@@ -30694,13 +31876,52 @@ async function resolveLeafByRegion(leaf, propertyPath, logicalId, execCtx, resol
 	}
 	return out + leaf.slice(cursor);
 }
-function redactRollbackRecord(record, secrets, journaledProps) {
+function redactRollbackRecord(record, secrets, journaledProps, journaledAttributes) {
 	if (secrets.size === 0) return record;
 	const positioned = journaledProps === void 0 ? record : {
 		...record,
 		properties: redactSecretsForState(record.properties, secrets, journaledProps, STATE_DERIVED_RULES)
 	};
-	return scrubResourceRecord(positioned, secrets);
+	return keepPersistedPlainRecordLeaves(scrubResourceRecord(positioned, secrets), record, {
+		properties: journaledProps,
+		attributes: journaledAttributes
+	});
+}
+function keepPersistedPlainRecordLeaves(scrubbed, raw, persisted) {
+	const properties = keepPersistedPlainLeaves(scrubbed.properties, raw.properties, persisted.properties);
+	const attributes = scrubbed.attributes === void 0 ? void 0 : keepPersistedPlainLeaves(scrubbed.attributes, raw.attributes, persisted.attributes);
+	if (properties === scrubbed.properties && attributes === scrubbed.attributes) return scrubbed;
+	return {
+		...scrubbed,
+		properties,
+		...attributes !== void 0 && { attributes }
+	};
+}
+function keepPersistedPlainLeaves(redacted, raw, persisted) {
+	if (typeof raw === "string") return typeof persisted === "string" && raw === persisted && redacted !== "***" && dynamicReferenceTokens(persisted).length === 0 ? persisted : redacted;
+	if (Array.isArray(raw)) {
+		if (!Array.isArray(persisted) || !Array.isArray(redacted)) return redacted;
+		if (redacted.length !== raw.length) return redacted;
+		let out;
+		for (let i = 0; i < redacted.length; i++) {
+			const kept = keepPersistedPlainLeaves(redacted[i], raw[i], persisted[i]);
+			if (kept !== redacted[i]) (out ??= [...redacted])[i] = kept;
+		}
+		return out ?? redacted;
+	}
+	if (!isPlainRecord$1(raw) || !isPlainRecord$1(persisted) || !isPlainRecord$1(redacted)) return redacted;
+	let out;
+	for (const key of Object.keys(redacted)) {
+		if (!hasOwnKey(raw, key) || !hasOwnKey(persisted, key)) continue;
+		const kept = keepPersistedPlainLeaves(redacted[key], raw[key], persisted[key]);
+		if (kept === redacted[key]) continue;
+		out ??= { ...redacted };
+		out[key] = kept;
+	}
+	return out ?? redacted;
+}
+function isPlainRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && hasPlainPrototype$1(value);
 }
 
 //#endregion
@@ -30749,7 +31970,7 @@ function renderNestedStackTypeChangeRefusal(typeChanges, stackName) {
 	const rows = typeChanges.map((tc) => {
 		return `${`  - ${tc.logicalId}: Type changes from ${tc.currentType} to ${tc.desiredType} (the existing ${tc.currentType} is ${tc.physicalId}).`}\n${tc.direction === "into-nested-stack" ? `    Replacing a single resource BY a nested stack is not supported: the create half of the replacement would deploy a whole child stack "${stackName}~${tc.logicalId}" as one row, while ${tc.physicalId} is still recorded under this logical id.` : `    Replacing a nested stack BY a single resource is not supported: a replacement deletes its old half as a best-effort cleanup step whose failure is only a warning, so the child stack "${stackName}~${tc.logicalId}" and every resource it owns could be left behind, untracked, under a deploy that reports success.`}`;
 	});
-	return `Refusing to deploy ${stackName}: ` + (typeChanges.length === 1 ? `a resource changes its Type ` : `${typeChanges.length} resources change their Type `) + `into or out of ${NESTED_STACK_RESOURCE_TYPE}, which cdkd does not replace in place (issue #2668).\n${rows.join("\n")}\n  Deploy this as two changes instead: give the new resource a DIFFERENT logical id (in CDK, rename the construct) so the existing row is deleted through its own type's provider and the new one is created under its own — or remove the resource in one deploy and add its replacement in the next. There is no flag that overrides this refusal.`;
+	return `Refusing to deploy ${stackName}: ` + (typeChanges.length === 1 ? `a resource changes its Type ` : `${typeChanges.length} resources change their Type `) + `into or out of ${NESTED_STACK_RESOURCE_TYPE}, which cdkd does not replace in place.\n${rows.join("\n")}\n  Deploy this as two changes instead: give the new resource a DIFFERENT logical id (in CDK, rename the construct) so the existing row is deleted through its own type's provider and the new one is created under its own — or remove the resource in one deploy and add its replacement in the next. There is no flag that overrides this refusal.`;
 }
 
 //#endregion
@@ -31754,7 +32975,7 @@ async function replayRevert(s) {
 		}
 	], op.logicalId, logger, isInterrupted, secrets, mask));
 	if (revertResult) recordNoEchoAttributeValues(revertResult, secrets, desiredProps);
-	stateResources[op.logicalId] = maskRestoredNoEchoRecord(redactRollbackRecord(recordAfterRollbackUpdate(previousState, revertResult), secrets, previousState.properties), previousState, noEcho.substituted);
+	stateResources[op.logicalId] = maskRestoredNoEchoRecord(redactRollbackRecord(recordAfterRollbackUpdate(previousState, revertResult), secrets, previousState.properties, previousState.attributes), previousState, noEcho.substituted);
 	if (updatePartialReason(revertResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$1(previousState.properties?.["Policies"], current.properties?.["Policies"]), revertVia);
 	const rollbackPartial = updatePartialReason(revertResult);
 	if (rollbackPartial !== void 0) logger.warn(mask(`  Rollback: ${safe(op.logicalId)} restored, ${updatePartialMessage(rollbackPartial)}`));
@@ -31953,7 +33174,7 @@ async function replayReverseReplacement(s) {
 		physicalId: createResult.physicalId,
 		attributes: createResult.attributes ?? {},
 		properties: recordedPropertiesAfterReplayCreate(prevRecord, createResult)
-	}, secrets, prevRecord.properties);
+	}, secrets, prevRecord.properties, prevRecord.attributes);
 	if (!adoptedLiveNewResource) inlinePolicyWriters.record(op.logicalId, "create", stateResources[op.logicalId], false, createProvisionedBy);
 	await afterOp?.(op.logicalId);
 	let survivorReason;
@@ -32124,12 +33345,12 @@ async function replayRollbackUnbound(operations, stateResources, stackName, ctx,
 	inlinePolicyWriters.notePending(operations);
 	markDeleteFirstBlocked(operations, options.failedOperations);
 	const { createOps, otherOps } = partitionOps(operations);
-	for (let i = otherOps.length - 1; i >= 0; i--) {
+	for (const op of orderInlinePolicyReversals([...otherOps].reverse(), stateResources)) {
 		if (options.isInterrupted?.()) {
 			result.interrupted = true;
 			break;
 		}
-		await replaySingle(otherOps[i], stateResources, stackName, ctx, resolver, orphanLogicalIds, result, options.onOrphan, inlinePolicyWriters, options.afterOp, options.isInterrupted);
+		await replaySingle(op, stateResources, stackName, ctx, resolver, orphanLogicalIds, result, options.onOrphan, inlinePolicyWriters, options.afterOp, options.isInterrupted);
 	}
 	if (!result.interrupted && createOps.length > 0) {
 		const sorted = sortRollbackCreates(createOps, stateResources);
@@ -32513,7 +33734,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						}
 					], op.logicalId, logger, options.isInterrupted, secrets, mask));
 					if (revertFailedResult) recordNoEchoAttributeValues(revertFailedResult, secrets, desiredProps);
-					stateResources[op.logicalId] = maskRestoredNoEchoRecord(redactRollbackRecord(recordAfterRollbackUpdate(prev, revertFailedResult), secrets, prev.properties), prev, noEcho.substituted);
+					stateResources[op.logicalId] = maskRestoredNoEchoRecord(redactRollbackRecord(recordAfterRollbackUpdate(prev, revertFailedResult), secrets, prev.properties, prev.attributes), prev, noEcho.substituted);
 					if (updatePartialReason(revertFailedResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$1(prev.properties?.["Policies"], (op.attemptedProperties ?? current.properties)?.["Policies"]), revertVia);
 					const revertFailedPartial = updatePartialReason(revertFailedResult);
 					if (revertFailedPartial !== void 0) logger.warn(mask(`  Rollback: ${safe(op.logicalId)} reverted, ${updatePartialMessage(revertFailedPartial)}`));
@@ -32671,7 +33892,7 @@ async function deleteJournaledOrphans(orphans, stateResources, stackName, ctx, o
 	const inlinePolicyWriters = new RollbackInlinePolicyWriters();
 	const failedIds = total.failedLogicalIds;
 	const record = ctx.recordEvent;
-	const printing = journaledOrphanPrintingBag(orphans.segments.flatMap(({ ops, companions }) => [...companions ?? [], ...ops]), stateResources);
+	const printing = journaledOrphanPrintingBag(orphans.segments.flatMap(({ ops, companions }) => [...companions ?? [], ...ops]), stateResources, options.noEchoValues);
 	const maskedCtx = record === void 0 ? ctx : {
 		...ctx,
 		recordEvent: (event) => record(maskEventTextWithBoundBags(event))
@@ -33483,11 +34704,14 @@ function redactOperationsForJournal(operations) {
 		if (next.attemptedProperties) next.attemptedProperties = byPosition(redactSecretsForState(markSameGenerationBag({ ...next.attemptedProperties }), ownSecrets, templateProps));
 		if (next.previousState) {
 			const previous = next.previousState;
-			next.previousState = this.applyNoEchoPersist(op.logicalId, previous, scrubResourceRecord(previous, ownSecrets, void 0, STATE_SOURCED_READBACK_RULES), void 0, {}, void 0, true);
+			const adopted = adoptedOrphanRecords.get(this);
+			const loaded = adopted?.has(op.logicalId) ? adopted.get(op.logicalId) : previous;
+			next.previousState = this.applyNoEchoPersist(op.logicalId, previous, keepPersistedPlainRecordLeaves(scrubResourceRecord(previous, ownSecrets, void 0, STATE_SOURCED_READBACK_RULES), previous, loaded ?? {}), void 0, {}, void 0, true);
 		}
 		return next;
 	});
 }
+const adoptedOrphanRecords = /* @__PURE__ */ new WeakMap();
 async function adoptRollbackOrphans(currentState, effectiveTemplate) {
 	const records = currentState.orphans ?? [];
 	const named = orphanRecordsPrintingBag(records);
@@ -33514,8 +34738,11 @@ async function adoptRollbackOrphans(currentState, effectiveTemplate) {
 		logger: { debug: (m) => this.logger.debug(m) }
 	}));
 	for (const notice of plan.notices) this.logger.info(maskSecretsInText(notice, named));
+	const adoptedFrom = /* @__PURE__ */ new Map();
+	adoptedOrphanRecords.set(this, adoptedFrom);
 	if (plan.refusals.length > 0) throw new Error(`Deploy refused — cdkd left ${plan.refusals.length} resource(s) in AWS that it cannot safely re-adopt:\n  ${plan.refusals.map((r) => maskSecretsInText(r, named)).join("\n  ")}`);
 	for (const [logicalId, record] of Object.entries(plan.adopted)) {
+		adoptedFrom.set(logicalId, records.findLast((r) => r.logicalId === logicalId)?.state);
 		currentState.resources[logicalId] = record;
 		this.logger.info(`Adopting ${displayIdent(logicalId)} (${displayIdent(record.resourceType)}) left in AWS by an earlier rollback as ${displaySafe(maskSecretsInText(record.physicalId, named))}`);
 	}
@@ -34129,6 +35356,20 @@ async function drainObservedCaptures(stateResources) {
 	}
 	return installed;
 }
+const STANDALONE_SIBLING = {
+	Roles: {
+		type: "AWS::IAM::RolePolicy",
+		field: "RoleName"
+	},
+	Users: {
+		type: "AWS::IAM::UserPolicy",
+		field: "UserName"
+	},
+	Groups: {
+		type: "AWS::IAM::GroupPolicy",
+		field: "GroupName"
+	}
+};
 async function buildObservedCaptureSiblings(resourceType, capturedLogicalId, capturedPhysicalId, template, stateResources, stackName, parameterValues, conditions) {
 	if (this.options.captureObservedState !== true) return void 0;
 	const attachmentField = resourceType === "AWS::IAM::Role" ? "Roles" : resourceType === "AWS::IAM::User" ? "Users" : resourceType === "AWS::IAM::Group" ? "Groups" : void 0;
@@ -34138,11 +35379,12 @@ async function buildObservedCaptureSiblings(resourceType, capturedLogicalId, cap
 	let resolverContext;
 	const isRefTo = (value, logicalId) => typeof value === "object" && value !== null && !Array.isArray(value) && value["Ref"] === logicalId;
 	const siblings = {};
+	const standaloneType = STANDALONE_SIBLING[attachmentField];
 	for (const [lid, res] of Object.entries(resources)) {
 		if (lid === capturedLogicalId) continue;
-		if (res.Type !== "AWS::IAM::Policy") continue;
+		if (res.Type !== "AWS::IAM::Policy" && res.Type !== standaloneType.type) continue;
 		const props = res.Properties ?? {};
-		const attachments = props[attachmentField];
+		const attachments = res.Type === "AWS::IAM::Policy" ? props[attachmentField] : [props[standaloneType.field]];
 		if (!Array.isArray(attachments)) continue;
 		if (!attachments.some((a) => isRefTo(a, capturedLogicalId) || a === capturedPhysicalId)) continue;
 		let policyName = props["PolicyName"];
@@ -34211,7 +35453,7 @@ function kickOffAutoRefreshObservedProperties(stateResources, crossStackReads) {
 			resource
 		});
 	}
-	if (refused > 0) this.logger.debug(`observed-properties auto-refresh SKIPPED for ${refused} resource(s) whose baseline a 'cdkd import' run refused (issue #2944): their recorded properties cannot position the redaction, so capturing an AWS readback against them could persist a resolved secret in plaintext. A deploy that actually CHANGES one of them restores its baseline, unless the refusal is an unverifiable-parameter one (only a replacement or a proving re-import discharges that); a NO_CHANGE deploy never does.`);
+	if (refused > 0) this.logger.debug(`observed-properties auto-refresh SKIPPED for ${refused} resource(s) whose baseline a 'cdkd import' run refused: their recorded properties cannot position the redaction, so capturing an AWS readback against them could persist a resolved secret in plaintext. A deploy that actually CHANGES one of them restores its baseline, unless the refusal is an unverifiable-parameter one (only a replacement or a proving re-import discharges that); a NO_CHANGE deploy never does.`);
 	if (candidates.length === 0 && masked.length === 0) return;
 	const allSiblings = {};
 	for (const [lid, res] of Object.entries(stateResources)) allSiblings[lid] = {
@@ -34244,7 +35486,7 @@ function kickOffAutoRefreshObservedProperties(stateResources, crossStackReads) {
 	if (masked.length > 0) try {
 		producerRegions = producerRegionsFromState(crossStackReads);
 	} catch {
-		this.logger.debug(safeMsg`Masked observed baseline re-capture skipped for ${masked.length} resource(s): the record's cross-stack reads could not be read (issue #3595).`);
+		this.logger.debug(safeMsg`Masked observed baseline re-capture skipped for ${masked.length} resource(s): the record's cross-stack reads could not be read.`);
 		masked.length = 0;
 	}
 	for (const { logicalId, resource } of masked) {
@@ -34271,7 +35513,7 @@ function kickOffMaskedBaselineRecapture(provider, logicalId, resource, producerR
 	const task = (async () => {
 		const secrets = await resolveRecordSecrets(properties, (token, own) => this.resolver.resolveDynamicReferences(token, persistedTokenResolverContext(own, producerRegions)));
 		if (secrets === void 0 || secrets.size === 0) {
-			this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: its recorded references did not all resolve to distinct values (issue #3595).`);
+			this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: its recorded references did not all resolve to distinct values.`);
 			return;
 		}
 		const readback = await withCurrentResourceSecrets(secrets, () => readCurrentState(resource.physicalId, logicalId, resource.resourceType, properties, context));
@@ -34283,14 +35525,14 @@ function kickOffMaskedBaselineRecapture(provider, logicalId, resource, producerR
 			secrets
 		});
 		if (recaptured === void 0) {
-			this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: no masked position could be certified, or the resource no longer reads back as its baseline records (issue #3595).`);
+			this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: no masked position could be certified, or the resource no longer reads back as its baseline records.`);
 			return;
 		}
 		this.recapturedBaselines.set(recaptured, previous);
-		this.logger.debug(safeMsg`Re-captured the masked observed baseline of ${logicalId} (issue #3595).`);
+		this.logger.debug(safeMsg`Re-captured the masked observed baseline of ${logicalId}.`);
 		return recaptured;
 	})().catch(() => {
-		this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: the re-capture failed (issue #3595).`);
+		this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: the re-capture failed.`);
 	});
 	this.observedCaptureTasks.set(logicalId, task);
 }
@@ -34355,9 +35597,9 @@ function deepEqualValue(a, b) {
 function diffLogMasker(diffSecrets, template, parameterValues, resources) {
 	const inherited = this.options.inheritedSecrets;
 	const noEchoValues = /* @__PURE__ */ new Map();
-	const noEchoNames = new Set(Object.entries(template.Parameters ?? {}).filter(([, definition]) => definition?.NoEcho === true).map(([name]) => name));
+	const noEchoNames = new Set(Object.entries(template.Parameters ?? {}).filter(([, definition]) => declaresNoEcho(definition)).map(([name]) => name));
 	const splitDelimiters = literalSplitDelimitersOf(template, noEchoNames);
-	for (const [name, definition] of Object.entries(template.Parameters ?? {})) if (definition?.NoEcho === true && Object.hasOwn(parameterValues, name)) recordLogOnlyParameterValue(noEchoValues, parameterValues[name], splitDelimiters);
+	for (const [name, definition] of Object.entries(template.Parameters ?? {})) if (declaresNoEcho(definition) && Object.hasOwn(parameterValues, name)) recordLogOnlyParameterValue(noEchoValues, parameterValues[name], splitDelimiters);
 	const stateNames = /* @__PURE__ */ new Map();
 	const union = createUnionSecretMasker([
 		diffSecrets,
@@ -34454,7 +35696,7 @@ function refuseRedactedAttributeReads(logicalId, resourceType, context) {
 		const producers = [...new Set(reads.map((read) => read.logicalId).filter((id) => !!id))];
 		throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: ${producers.map((id) => displayIdent(id)).join(", ")} declared ${reads.length === 1 ? "that attribute" : "those attributes"} NoEcho, so cdkd's recorded state holds only the redaction mask for ${reads.length === 1 ? "it" : "them"}, and cdkd does not re-run a producer to recover a value. Remedy: deploy a change to the producer in the SAME run as ${logicalId} (for a custom resource, change one of its properties, e.g. a nonce / version property, so its handler runs again and supplies the value), or stop declaring the value NoEcho.`, resourceType, logicalId);
 	}
-	throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the redaction mask there, and the value is not recoverable from state. There are three ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all, or cdkd deploy '**' when either is inside a CDK Stage) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The value holds the Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records — so a deploy that leaves the resource or output holding it unchanged reads the mask again, and a re-import does not recover it. Remedy: have this resource build the value itself from the SECRET's own reference (the {{resolve:secretsmanager:...}} or {{resolve:ssm-secure:...}} reference, or a {{resolve:ssm:...}} of a SecureString parameter, that the encoding was made from) under its own Fn::Base64, instead of reading it from another resource's attribute or another stack's output — not by a {{resolve:ssm:...}} read of a String parameter holding the encoding, which cdkd treats as public and would record in state in the clear. (3) The resource was adopted by 'cdkd import' through the Cloud Control fallback, which records only the attributes the type's CloudFormation schema declares read-only and masks the rest. Either the attribute named above is not one of them — CloudFormation would reject an Fn::GetAtt naming it too, so stop reading it — or cdkd could not read that schema and masked the whole model, which the import warned about when it happened. If that warning named a missing cloudformation:DescribeType permission, grant it first. See https://github.com/go-to-k/cdkd/issues/2449. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources, true)}`, resourceType, logicalId);
+	throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the redaction mask there, and the value is not recoverable from state. There are three ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all, or cdkd deploy '**' when either is inside a CDK Stage) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The value holds the Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records — so a deploy that leaves the resource or output holding it unchanged reads the mask again, and a re-import does not recover it. Remedy: have this resource build the value itself from the SECRET's own reference (the {{resolve:secretsmanager:...}} or {{resolve:ssm-secure:...}} reference, or a {{resolve:ssm:...}} of a SecureString parameter, that the encoding was made from) under its own Fn::Base64, instead of reading it from another resource's attribute or another stack's output — not by a {{resolve:ssm:...}} read of a String parameter holding the encoding, which cdkd treats as public and would record in state in the clear. (3) The resource is recorded through the Cloud Control fallback (by a deploy or by 'cdkd import'), which keeps in the clear only the Fn::GetAtt attributes it can vouch for and masks the rest. If the name above is not an Fn::GetAtt attribute CloudFormation accepts for that resource type, no record will ever hold it: stop reading it. If it is one, 'cdkd import' masked it because it could not vouch for the value, or could not read the schema and warned about it when it happened (if that warning named a missing cloudformation:DescribeType permission, grant it first); a deploy that creates or updates the resource records it, unless its value came from a secret. See https://github.com/go-to-k/cdkd/issues/2449. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources, true)}`, resourceType, logicalId);
 }
 function allRecordedSecrets() {
 	const all = /* @__PURE__ */ new Map();
@@ -34763,6 +36005,7 @@ async function createFirstThenDeleteOld(input) {
 async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, deleteProvider, deleteProperties, finalSnapshotIdentifier, updateReplacePolicy, secrets, deleteProvisionedBy, noEchoDeleteValues) {
 	let deleteResult = void 0;
 	let deleteFailed = false;
+	const inlinePolicyClaimed = isStandaloneInlinePolicyType(oldResourceType) ? this.inlinePolicyClaimedFor(oldResourceType, logicalId, this.deployStateResources) : void 0;
 	try {
 		deleteResult = await deleteProvider.delete(logicalId, currentResource.physicalId, oldResourceType, deleteProperties, {
 			expectedRegion: this.stackRegion,
@@ -34771,7 +36014,8 @@ async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentReso
 			...this.replacementDeleteContext(updateReplacePolicy),
 			recordedAttributes: currentResource.attributes,
 			recordedNoEchoLeaves: currentResource.noEchoLeaves,
-			...noEchoDeleteValues !== void 0 && { noEchoDeleteValues }
+			...noEchoDeleteValues !== void 0 && { noEchoDeleteValues },
+			...inlinePolicyClaimed && { inlinePolicyClaimed }
 		});
 	} catch (deleteError) {
 		const deleteMsg = maskSecretsInText(deleteError instanceof Error ? deleteError.message : String(deleteError), secrets);
@@ -34839,7 +36083,7 @@ function createReadOnlyAttributeHealerFactory(options) {
 			region
 		})))().then((outcome) => {
 			if (outcome.kind === "read") try {
-				logger.debug(safeMsg`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS for this preview — its state record lacked one a Fn::GetAtt asked for (#1852); nothing is written: ${Object.keys(outcome.attributes).length} attribute(s) read`);
+				logger.debug(safeMsg`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS for this preview — its state record lacked one a Fn::GetAtt asked for; nothing is written: ${Object.keys(outcome.attributes).length} attribute(s) read`);
 			} catch {}
 			return outcome;
 		}).catch((error) => ({
@@ -34891,7 +36135,7 @@ async function readStaleAttributes(logicalId, resource, stackName) {
 		resourceType: resource.resourceType,
 		attributes
 	});
-	this.logger.debug(`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS — its state record lacked one a Fn::GetAtt asked for (#1852): ${Object.keys(attributes).length} attribute(s) read`);
+	this.logger.debug(`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS — its state record lacked one a Fn::GetAtt asked for: ${Object.keys(attributes).length} attribute(s) read`);
 	return outcome;
 }
 function withHealedAttributes(logicalId, record) {
@@ -35240,9 +36484,9 @@ async function refuseUnlicensedGeneratedName(input) {
 			}], recoveryCommandFlags(this.options.refusalRecovery).flags).command}\``;
 			if (verdict.ownIntent !== void 0) {
 				const why = verdict.ownIntent === "abandoned" ? "a deploy of this stack that was killed or force-unlocked" : "a create of this stack that came back failed (a timeout or a server error)";
-				return refuse(`${subject} would be created with ${named}, which an existing resource (${displaySafe(verdict.holder)}) already holds. This stack's create-token ledger records that ${why} sent this name, but this type reports no creation time, so cdkd cannot tell that resource is the one it made rather than another deployment's created since. Since ${adoptsText}, creating it would take that resource over. ${displaySafe(logicalId)} was not created. The likely cause: the resource is this stack's own, from that deploy. If it is, ${importLine} and re-run; if it is not, this stack is also deployed under another state backend (go-to-k/cdkd#4705).`);
+				return refuse(`${subject} would be created with ${named}, which an existing resource (${displaySafe(verdict.holder)}) already holds. This stack's create-token ledger records that ${why} sent this name, but this type reports no creation time, so cdkd cannot tell that resource is the one it made rather than another deployment's created since. Since ${adoptsText}, creating it would take that resource over. ${displaySafe(logicalId)} was not created. The likely cause: the resource is this stack's own, from that deploy. If it is, ${importLine} and re-run; if it is not, this stack is also deployed under another state backend.`);
 			}
-			return refuse(`${subject} would be created with ${named}, which an existing resource (${displaySafe(verdict.holder)}) already holds, and nothing this stack records names that resource: not its state, its rollback journal or create-token ledger, nor what a destroy of it under this state prefix kept. Since ${adoptsText}, creating it would take that resource over, as CloudFormation refuses with "already exists". ${displaySafe(logicalId)} was not created. The likely cause: this stack is also deployed under another state backend (another --state-prefix, --state-bucket or account), where cdkd generates the same names. One stack name per account and region is supported (go-to-k/cdkd#4705): deploy it under one backend only, or give this stack another name. If the resource is this stack's own, ${importLine} and re-run.`);
+			return refuse(`${subject} would be created with ${named}, which an existing resource (${displaySafe(verdict.holder)}) already holds, and nothing this stack records names that resource: not its state, its rollback journal or create-token ledger, nor what a destroy of it under this state prefix kept. Since ${adoptsText}, creating it would take that resource over, as CloudFormation refuses with "already exists". ${displaySafe(logicalId)} was not created. The likely cause: this stack is also deployed under another state backend (another --state-prefix, --state-bucket or account), where cdkd generates the same names. One stack name per account and region is supported: deploy it under one backend only, or give this stack another name. If the resource is this stack's own, ${importLine} and re-run.`);
 		}
 	}
 }
@@ -36246,7 +37490,7 @@ var DynamoDBGlobalTableProvider = class {
 					const droppedOverrides = [];
 					if (oldReplicaOverrides.OnDemandThroughputOverride && !replicaOverrides.OnDemandThroughputOverride) droppedOverrides.push("ReadOnDemandThroughputSettings");
 					if (oldReplicaOverrides.ProvisionedThroughputOverride && !replicaOverrides.ProvisionedThroughputOverride) droppedOverrides.push("ReadProvisionedThroughputSettings");
-					if (droppedOverrides.length > 0) warn(`Cross-region replica ${region} of ${physicalId}: the template no longer declares ${droppedOverrides.map((o) => maskSecrets(o)).join(" / ")}, but DynamoDB offers no way to CLEAR a replica-level throughput override — a -1 sentinel is stored literally, and an empty override block wedges the table in UPDATING (both live-probed, issue #1436). The previous override is STILL IN EFFECT on AWS. Set an explicit value, or remove and re-add the replica, to change it.`);
+					if (droppedOverrides.length > 0) warn(`Cross-region replica ${region} of ${physicalId}: the template no longer declares ${droppedOverrides.map((o) => maskSecrets(o)).join(" / ")}, but DynamoDB offers no way to CLEAR a replica-level throughput override — a -1 sentinel is stored literally, and an empty override block wedges the table in UPDATING. The previous override is STILL IN EFFECT on AWS. Set an explicit value, or remove and re-add the replica, to change it.`);
 				}
 				if (replica["TableClassOverride"]) updateAction.TableClassOverride = replica["TableClassOverride"];
 				if (!(updateAction.KMSMasterKeyId !== void 0 || updateAction.GlobalSecondaryIndexes !== void 0 || updateAction.TableClassOverride !== void 0 || updateAction.ProvisionedThroughputOverride !== void 0 || updateAction.OnDemandThroughputOverride !== void 0)) {
@@ -36749,7 +37993,7 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		try {
 			if (hasTransitionalIndex(preDeleteIndexes)) {
-				this.logger.debug(`Waiting for indexes on ${physicalId} to settle before DeleteTable (issue #1521)`);
+				this.logger.debug(`Waiting for indexes on ${physicalId} to settle before DeleteTable`);
 				await this.waitForIndexesActive(physicalId, logicalId, {
 					proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE,
 					budget
@@ -38153,10 +39397,7 @@ function noEchoParameterNamesOf(template) {
 	const names = /* @__PURE__ */ new Set();
 	const declared = template?.Parameters;
 	if (declared === null || typeof declared !== "object") return names;
-	for (const [name, definition] of Object.entries(declared)) {
-		const noEcho = definition?.NoEcho;
-		if (noEcho === true || noEcho === "true") names.add(name);
-	}
+	for (const [name, definition] of Object.entries(declared)) if (declaresNoEcho(definition)) names.add(name);
 	return names;
 }
 function noEchoAttributeNamesOf(record) {
@@ -38393,6 +39634,185 @@ function noEchoComparisonForTemplate(template, knownConditions, values, resource
 	return (input) => compare(input);
 }
 
+//#endregion
+//#region src/analyzer/security-diff.ts
+function isSyntheticChange(pc) {
+	return pc.replacementPropagated === true || pc.inPlacePropagated === true || pc.noEchoPromoted === true;
+}
+function withChanges(base, changes, side) {
+	const props = { ...base ?? {} };
+	for (const pc of changes) {
+		const value = pc[side];
+		if (value === void 0) delete props[pc.path];
+		else props[pc.path] = value;
+	}
+	return props;
+}
+function securityDiffTemplates(changes, records) {
+	const oldResources = {};
+	const newResources = {};
+	const maskedChanges = [];
+	for (const change of changes) {
+		const id = change.logicalId;
+		const record = Object.hasOwn(records, id) ? records[id] : void 0;
+		switch (change.changeType) {
+			case "CREATE":
+				newResources[id] = {
+					Type: change.resourceType,
+					Properties: { ...change.desiredProperties ?? {} }
+				};
+				break;
+			case "DELETE":
+				oldResources[id] = {
+					Type: record?.resourceType ?? change.resourceType,
+					Properties: { ...change.currentProperties ?? record?.properties ?? {} }
+				};
+				break;
+			case "UPDATE": {
+				const pcs = change.propertyChanges ?? [];
+				const typeChange = pcs.find((pc) => pc.path === "Type");
+				const oldType = record?.resourceType ?? change.resourceType;
+				if (typeChange !== void 0 || oldType !== change.resourceType) {
+					oldResources[id] = {
+						Type: typeof typeChange?.oldValue === "string" ? typeChange.oldValue : oldType,
+						Properties: { ...change.currentProperties ?? record?.properties ?? {} }
+					};
+					newResources[id] = {
+						Type: change.resourceType,
+						Properties: { ...change.desiredProperties ?? {} }
+					};
+					break;
+				}
+				for (const pc of pcs) if (pc.maskedExpressionChanged === true && !isSyntheticChange(pc)) maskedChanges.push({
+					logicalId: id,
+					resourceType: change.resourceType,
+					path: pc.path
+				});
+				const real = pcs.filter((pc) => !isSyntheticChange(pc) && pc.maskedExpressionChanged !== true);
+				if (real.length === 0) break;
+				const base = change.currentProperties ?? record?.properties;
+				oldResources[id] = {
+					Type: oldType,
+					Properties: withChanges(base, real, "oldValue")
+				};
+				newResources[id] = {
+					Type: change.resourceType,
+					Properties: withChanges(base, real, "newValue")
+				};
+				break;
+			}
+		}
+	}
+	return {
+		oldTemplate: { Resources: oldResources },
+		newTemplate: { Resources: newResources },
+		maskedChanges
+	};
+}
+let cfnDiffModule;
+function loadCfnDiff() {
+	cfnDiffModule ??= import("@aws-cdk/cloudformation-diff").then((mod) => mod.default ?? mod);
+	return cfnDiffModule;
+}
+let cfnDiffUtilModule;
+function loadCfnDiffUtil() {
+	cfnDiffUtilModule ??= import("@aws-cdk/cloudformation-diff/lib/diff/util.js").then((mod) => mod.default ?? mod);
+	return cfnDiffUtilModule;
+}
+function isScrutinized(util, change) {
+	const model = util.loadResourceModel(change.resourceType);
+	const scrutinized = (value) => value !== void 0 && value !== "None";
+	return scrutinized(model?.scrutinizable) || scrutinized(model?.properties?.[change.path]?.scrutinizable);
+}
+async function diffSecurity(args) {
+	const templates = securityDiffTemplates(args.changes, args.records);
+	const { oldTemplate, newTemplate } = templates;
+	if (Object.keys(oldTemplate.Resources).length === 0 && Object.keys(newTemplate.Resources).length === 0 && templates.maskedChanges.length === 0) return {
+		broadening: false,
+		rendered: ""
+	};
+	try {
+		const cfnDiff = await loadCfnDiff();
+		const unjudged = templates.maskedChanges.length === 0 ? [] : await loadCfnDiffUtil().then((util) => templates.maskedChanges.filter((c) => isScrutinized(util, c)));
+		const diff = cfnDiff.fullDiff(structuredClone(oldTemplate), structuredClone(newTemplate));
+		const broadening = diff.permissionsBroadened || unjudged.length > 0;
+		const unjudgedNote = unjudged.length === 0 ? "" : "These changed values are masked, so whether they broaden permissions could not be evaluated:\n" + unjudged.map((c) => `  ${c.logicalId} (${c.resourceType}): ${c.path}\n`).join("");
+		if (!diff.permissionsBroadened && !diff.permissionsAnyChanges) return {
+			broadening,
+			rendered: terminalSafe(unjudgedNote)
+		};
+		let table;
+		try {
+			const shown = args.secretMask === void 0 ? void 0 : withholdSecrets(templates, args.secretMask());
+			const shownDiff = shown === void 0 || shown.masked === 0 ? diff : cfnDiff.fullDiff(shown.templates.oldTemplate, shown.templates.newTemplate);
+			table = "";
+			cfnDiff.formatSecurityChanges({ write(chunk) {
+				table += String(chunk);
+				return true;
+			} }, shownDiff, logicalIdToPath(args.records, args.template));
+			if (shown !== void 0 && shown.masked > 0) table += "(Values that hold a secret are shown as ***.)\n";
+		} catch {
+			table = "The security changes are not shown: they could not be checked for secrets.\n";
+		}
+		return {
+			broadening,
+			rendered: terminalSafe(table + unjudgedNote)
+		};
+	} catch (error) {
+		throw new CdkdError(safeMsg`Could not compute the security diff of stack ${args.stackName}, so whether its changes broaden permissions is unknown: ${error instanceof Error ? error.message : String(error)}`, "SECURITY_DIFF_FAILED");
+	}
+}
+function holdsSecret(value, mask) {
+	if (typeof value === "string") return mask(value) !== value;
+	if (typeof value === "number" || typeof value === "boolean") return mask(String(value)) !== String(value);
+	if (Array.isArray(value)) return value.some((v) => holdsSecret(v, mask));
+	if (value !== null && typeof value === "object") return Object.entries(value).some(([k, v]) => mask(k) !== k || holdsSecret(v, mask));
+	return false;
+}
+function maskLeaves(value, mask, keys = true) {
+	if (Array.isArray(value)) return value.map((v) => maskLeaves(v, mask, keys));
+	if (value !== null && typeof value === "object") {
+		const entries = Object.entries(value).map(([k, v]) => [keys && mask(k) !== k ? "***" : k, maskLeaves(v, mask, keys)]);
+		if (new Set(entries.map(([k]) => k)).size < entries.length) return "***";
+		return Object.fromEntries(entries);
+	}
+	return holdsSecret(value, mask) ? "***" : value;
+}
+function withholdSecrets(templates, mask) {
+	const copy = structuredClone(templates);
+	let masked = 0;
+	const ids = /* @__PURE__ */ new Set([...Object.keys(copy.oldTemplate.Resources), ...Object.keys(copy.newTemplate.Resources)]);
+	for (const id of ids) {
+		const oldProps = copy.oldTemplate.Resources[id]?.Properties;
+		const newProps = copy.newTemplate.Resources[id]?.Properties;
+		const keys = /* @__PURE__ */ new Set([...Object.keys(oldProps ?? {}), ...Object.keys(newProps ?? {})]);
+		for (const key of keys) {
+			const oldValue = oldProps?.[key];
+			const newValue = newProps?.[key];
+			const newHolds = holdsSecret(newValue, mask);
+			if (!newHolds && !holdsSecret(oldValue, mask)) continue;
+			masked++;
+			if (newProps !== void 0 && newValue !== void 0) newProps[key] = maskLeaves(newValue, mask);
+			if (oldProps === void 0 || oldValue === void 0) continue;
+			if (newHolds && JSON.stringify(oldValue) !== JSON.stringify(newValue)) oldProps[key] = maskLeaves(oldValue, () => "***", false);
+			else oldProps[key] = maskLeaves(oldValue, mask);
+		}
+	}
+	return {
+		templates: copy,
+		masked
+	};
+}
+function logicalIdToPath(records, template) {
+	const map = {};
+	for (const [id, record] of Object.entries(records)) if (typeof record?.constructPath === "string") map[id] = record.constructPath;
+	for (const [id, resource] of Object.entries(template?.Resources ?? {})) {
+		const path = (resource?.Metadata)?.["aws:cdk:path"];
+		if (typeof path === "string") map[id] = path;
+	}
+	return map;
+}
+
 //#endregion
 //#region src/deployment/resource-deadline.ts
 var InvalidResourceDeadlineError = class extends Error {
@@ -38500,7 +39920,16 @@ async function requireDeploymentApproval(args) {
 	const changes = [...args.changes].filter((c) => c.changeType !== "NO_CHANGE" && !isNoEchoPromotionOnly(c));
 	const destructiveChanges = findDestructiveChanges(args.stackName, changes, args.records, args.template, new Set(args.recreateTargetIds ?? []));
 	const onlyNestedUpdates = changes.every((c) => c.changeType === "UPDATE" && c.resourceType === NESTED_STACK_TYPE$1);
-	if (!(level === "destructive" ? destructiveChanges.length > 0 : changes.length > 0 && !onlyNestedUpdates)) return false;
+	const security = level === "broadening" ? await diffSecurity({
+		stackName: args.stackName,
+		changes,
+		records: args.records,
+		template: args.template,
+		secretMask: args.secretMask
+	}).catch((error) => {
+		throw error instanceof Error ? markNonRetryable(error) : error;
+	}) : void 0;
+	if (!(level === "destructive" ? destructiveChanges.length > 0 : level === "broadening" ? security?.broadening === true : changes.length > 0 && !onlyNestedUpdates)) return false;
 	const count = (type) => changes.filter((c) => c.changeType === type).length;
 	if (enclosingDeadlineExpired()) throw approvalAfterTimeout(args.stackName);
 	let approved;
@@ -38513,7 +39942,8 @@ async function requireDeploymentApproval(args) {
 				update: count("UPDATE"),
 				delete: count("DELETE")
 			},
-			destructiveChanges
+			destructiveChanges,
+			...security !== void 0 && { securityChanges: security.rendered }
 		}));
 	} catch (error) {
 		throw error instanceof Error ? markNonRetryable(error) : error;
@@ -38533,7 +39963,7 @@ async function checkDestructivePlan(args) {
 async function approveLateReplacement(args) {
 	const level = args.options.requireApproval ?? "never";
 	const approve = args.options.approveDeployment;
-	if (level === "never" || approve === void 0) return true;
+	if (level === "never" || level === "broadening" || approve === void 0) return true;
 	if (enclosingDeadlineExpired()) return false;
 	try {
 		const approved = await whileEnclosingDeadlinesPaused(() => approve({
@@ -38680,14 +40110,14 @@ const REMEDY = "To move a custom resource to a different handler, give it a new
 const UNJUDGEABLE_REMEDY = `Where the recorded ServiceToken is unreadable and the handler did not change, put the ARN of the handler that created this resource (the one it was last deployed with, not the one the template names now) back as ServiceToken in state.json (a ServiceToken fed by a NoEcho parameter is recorded only as '${"***"}': feed it from a plain value) and re-deploy.`;
 function renderServiceTokenRefusal(refusals, stackName, mask = (text) => text) {
 	const rows = refusals.map((refusal) => `  - ${rowText(refusal, mask)}`);
-	return `Refusing to deploy ${stackName}: ` + (refusals.length === 1 ? `a custom resource's ServiceToken changes` : `${refusals.length} custom resources' ServiceTokens change`) + `, which CloudFormation does not allow ("Modifying service token is not allowed") (issue #4749). Nothing was sent to either handler.
+	return `Refusing to deploy ${stackName}: ` + (refusals.length === 1 ? `a custom resource's ServiceToken changes` : `${refusals.length} custom resources' ServiceTokens change`) + `, which CloudFormation does not allow ("Modifying service token is not allowed"). Nothing was sent to either handler.
 ${rows.join("\n")}\n  ${REMEDY}` + (refusals.some((refusal) => refusal.kind === "unjudgeable") ? `\n  ${UNJUDGEABLE_REMEDY}` : "");
 }
 function serviceTokenBlockingReason(refusal, mask) {
-	return `${rowText(refusal, mask)} cdkd deploy refuses a changed custom-resource ServiceToken, as CloudFormation does (issue #4749); give the custom resource a new logical id to move it to another handler.`;
+	return `${rowText(refusal, mask)} cdkd deploy refuses a changed custom-resource ServiceToken, as CloudFormation does; give the custom resource a new logical id to move it to another handler.`;
 }
 function deferredServiceTokenWarning(row) {
-	return `${displayIdent(row.logicalId)}: its ServiceToken reads a resource this deploy replaces, creates or updates, or a value this preview cannot resolve. If it resolves to a different ARN than the one recorded, cdkd deploy refuses the update before invoking any handler and rolls back (issue #4749). A replaced backing function is already deleted by then and the rollback re-creates it; if that fails, the record names a function that no longer exists.`;
+	return `${displayIdent(row.logicalId)}: its ServiceToken reads a resource this deploy replaces, creates or updates, or a value this preview cannot resolve. If it resolves to a different ARN than the one recorded, cdkd deploy refuses the update before invoking any handler and rolls back. A replaced backing function is already deleted by then and the rollback re-creates it; if that fails, the record names a function that no longer exists.`;
 }
 
 //#endregion
@@ -38792,6 +40222,24 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	if (resourceType === "AWS::CloudFormation::Stack") recordPassedNoEchoParameters(updateSecrets, desiredProps["Parameters"], this.noEchoPositionSources(stateResources));
 	if (fingerprintSources !== void 0 && resourceType === "AWS::CloudFormation::Stack") recordPassedParameterClasses(updateSecrets, await classifyPassedParameters(desiredProps["Parameters"], fingerprintSources));
 	const desiredForSkipCheck = maskAtCoordinates(redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps), comparisonCoordinates);
+	const legacyDesired = withoutPhysicalNameCopies(updateSecrets, () => maskAtCoordinates(redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps), comparisonCoordinates));
+	const copies = physicalNameCopiesOf.get(updateSecrets);
+	const regionEvidence = getCurrentProducerRegions()?.();
+	const recordOwnSecrets = copies !== void 0 && copies.size > 0 && regionEvidence?.complete === true && recordHoldsEmbeddedReference(currentResource) ? await resolveRecordSecrets({
+		properties: currentResource.properties,
+		attributes: currentResource.attributes
+	}, (token, own) => this.resolver.resolveDynamicReferences(token, persistedTokenResolverContext(own, regionEvidence.regions))) : void 0;
+	const embeddedRewrites = [...embeddedPhysicalNameRewrites(updateSecrets), ...recordOwnSecrets === void 0 || recordOwnSecrets.size === 0 ? [] : embeddedPhysicalNameRewrites(updateSecrets, recordOwnSecrets)];
+	const repairable = [currentProps, currentResource.properties].filter((bag) => bag !== null && typeof bag === "object");
+	for (const bag of new Set(repairable)) for (const key of Object.keys(bag)) {
+		const repaired = repairEmbeddedPhysicalNamesTowards(repairPhysicalNameCopyLeaves(bag[key], legacyDesired[key], desiredForSkipCheck[key]), desiredForSkipCheck[key], embeddedRewrites);
+		if (repaired !== bag[key]) bag[key] = repaired;
+	}
+	const attributes = currentResource.attributes;
+	if (attributes !== void 0 && attributes !== null && embeddedRewrites.length > 0) for (const key of Object.keys(attributes)) {
+		const repaired = replaceEmbeddedPhysicalNameRewrites(attributes[key], embeddedRewrites);
+		if (repaired !== attributes[key]) attributes[key] = repaired;
+	}
 	const allowedSilentDrops = this.providerRegistry.getAllowedUnsupportedProperties?.();
 	const desiredForSkipCheckAsWritten = currentResource.provisionedBy !== "cc-api" && allowedSilentDrops ? withoutAcceptedSilentDropProperties(resourceType, desiredForSkipCheck, allowedSilentDrops, currentResource.properties) : desiredForSkipCheck;
 	const allowedForRecord = allowedSilentDrops ?? /* @__PURE__ */ new Set();
@@ -39213,6 +40661,14 @@ function recordPreviousNoEchoLeaves(registry, stored, desiredLeaves, resolution,
 		if (partlyMasked !== leaf && partlyMasked !== "***") recordLogOnlyValue(registry, partlyMasked);
 	}
 }
+function recordHoldsEmbeddedReference(record) {
+	const walk = (node) => {
+		if (typeof node === "string") return node.includes("{{resolve:") && !isSingleDynamicReferenceToken(node);
+		if (node === null || typeof node !== "object") return false;
+		return Object.values(node).some(walk);
+	};
+	return walk(record.properties) || walk(record.attributes);
+}
 
 //#endregion
 //#region src/deployment/deploy-engine/update-replace.ts
@@ -40246,6 +41702,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 	const concurrency = this.options.concurrency;
 	this.deployChanges = changes;
 	const newResources = { ...currentState.resources };
+	this.deployStateResources = newResources;
 	const actualCounts = {
 		created: 0,
 		updated: 0,
@@ -40304,16 +41761,29 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			this.logger.info(`${cyan("Deploying")} ${cyan(createUpdateIds.length)} resource(s) (DAG: ${executionLevels.length} levels, max parallel: ${concurrency})`);
 			const createUpdateExecutor = new DagExecutor();
 			const provisionable = new Set(createUpdateIds);
+			const createUpdateDeps = /* @__PURE__ */ new Map();
 			for (const id of createUpdateIds) {
 				const allDeps = this.dagBuilder.getDirectDependencies(dag, id);
-				const deps = new Set(allDeps.filter((d) => provisionable.has(d)));
-				createUpdateExecutor.add({
-					id,
-					dependencies: deps,
-					state: "pending",
-					data: changes.get(id)
-				});
+				createUpdateDeps.set(id, new Set(allDeps.filter((d) => provisionable.has(d))));
 			}
+			const levelOf = /* @__PURE__ */ new Map();
+			executionLevels.forEach((level, at) => {
+				for (const id of level) levelOf.set(id, at);
+			});
+			for (const { before, after } of orderInlinePolicyWriters({
+				writes: createUpdateIds,
+				changes,
+				templateResources: template.Resources ?? {},
+				stateResources: currentState.resources,
+				dependencies: createUpdateDeps,
+				rank: (id) => levelOf.get(id) ?? Number.MAX_SAFE_INTEGER
+			})) this.logger.debug(safeMsg`${after} waits for ${before}: both write an inline policy name on the same IAM principal`);
+			for (const id of createUpdateIds) createUpdateExecutor.add({
+				id,
+				dependencies: createUpdateDeps.get(id),
+				state: "pending",
+				data: changes.get(id)
+			});
 			const enqueueLostChildren = (executor) => {
 				const lostIds = noChangeChildrenOfRecreatedParents({
 					changes,
@@ -41611,7 +43081,7 @@ function conditionFingerprint(template, name, inputOf) {
 			inputs[parameter] = { token: input.expression };
 			hasToken = true;
 		} else {
-			if (isPlainObject(definition) && definition["NoEcho"] === true) return void 0;
+			if (declaresNoEcho(definition)) return void 0;
 			if (typeof input.value !== "string") return void 0;
 			if (carriesDynamicReference(input.value)) return void 0;
 			if (coerceParameterTypedValue(input.value, type) !== input.value) return void 0;
@@ -42177,7 +43647,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 				const persistExportSet = new Set(exportNamesToPersist ?? []);
 				const exportSetChanged = exportNamesToPersist !== void 0 && (currentEffectiveExports.size !== persistExportSet.size || [...persistExportSet].some((k) => !currentEffectiveExports.has(k)));
 				if (merge?.kind === "kept" && !outputMapsEqual(persistedOutputs, resolvedOutputs)) this.logger.warn(`Outputs changed but one or more could not be resolved; keeping the previously persisted outputs. ${keptWholeReasonText(merge.reason)} A downstream Fn::ImportValue may fail until the next deploy.`);
-				else if (merge?.kind === "merged" && merge.carriedKeys.length > 0) this.logger.debug(`Kept the previously persisted value of ${merge.carriedKeys.length} output key(s), carried export aliases included, that could not be resolved (no-change path, #2771)`);
+				else if (merge?.kind === "merged" && merge.carriedKeys.length > 0) this.logger.debug(`Kept the previously persisted value of ${merge.carriedKeys.length} output key(s), carried export aliases included, that could not be resolved (no-change path)`);
 				const skippedOutputsChanged = !skippedOutputsEqual(currentState.skippedOutputs, this.skippedOutputs);
 				const healedAttributesPending = this.hasUnpersistedHeals(currentState.resources);
 				const conditionVerdictsChanged = !conditionVerdictRecordsEqual(readRecordedConditionVerdicts(currentState), conditionVerdicts);
@@ -42206,14 +43676,14 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 					if (outputsChanged || exportSetChanged) {
 						persistedOutputs = refreshedState.outputs;
 						if (outputsChanged) this.logger.info("Persisted Outputs-only change (no resource diff).");
-						else this.logger.debug("Persisted export-set change (no outputs-value diff, no-change path, #2193)");
+						else this.logger.debug("Persisted export-set change (no outputs-value diff, no-change path)");
 						if (this.exportIndexStore) await this.exportIndexStore.updateForStack(stackName, this.stackRegion, importableOutputs({
 							...refreshedState,
 							outputs: this.redactOutputs(refreshedState.outputs)
 						}));
 					} else if (observedRefresh) this.logger.debug("Persisted refreshed observedProperties (no-change path)");
-					else if (healedAttributesPending) this.logger.debug("Persisted attributes re-read from AWS for a stale record (no-change path, #1852)");
-					else this.logger.debug("Persisted skipped-outputs record (no outputs-value diff, no-change path, #2740)");
+					else if (healedAttributesPending) this.logger.debug("Persisted attributes re-read from AWS for a stale record (no-change path)");
+					else this.logger.debug("Persisted skipped-outputs record (no outputs-value diff, no-change path)");
 				} catch (saveError) {
 					this.logger.warn(`Failed to persist no-change state update: ${saveError instanceof Error ? saveError.message : String(saveError)} — drift baseline / outputs will be re-resolved on next deploy.`);
 				}
@@ -42294,7 +43764,8 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			changes: changes.values(),
 			records: currentState.resources,
 			template: effectiveTemplate,
-			recreateTargetIds: recreateTargetIdsFor(this.options.recreateTargets, stackName)
+			recreateTargetIds: recreateTargetIdsFor(this.options.recreateTargets, stackName),
+			secretMask: () => this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues, currentState.resources)
 		})) this.generatedNameGuard?.noteApprovalPrompted();
 		this.generatedNameGuard?.recordPlannedIntents();
 		this.resolver.resetPhysicalIdFallbackCount();
@@ -42628,6 +44099,7 @@ var DeployEngine = class {
 	oldDeletedBeforeCreate = /* @__PURE__ */ new Set();
 	healBaseline = {};
 	deployChanges = /* @__PURE__ */ new Map();
+	deployStateResources = {};
 	stackRecordsView = void 0;
 	inlinePolicyWriters = /* @__PURE__ */ new Map();
 	attributeHeals = /* @__PURE__ */ new Map();
@@ -42644,7 +44116,9 @@ var DeployEngine = class {
 		this.exportIndexStore = exportIndexStore;
 		this.resolver = new IntrinsicFunctionResolver(stackRegion, {
 			strictGetAtt: options.strictGetAtt ?? false,
-			cfnFallback: options.cfnFallback ?? true
+			cfnFallback: options.cfnFallback ?? true,
+			...options.producerLookup && { producerLookup: options.producerLookup },
+			...options.consumerAccount && { consumerAccount: options.consumerAccount }
 		});
 		this.options.concurrency = options.concurrency ?? 10;
 		this.options.dryRun = options.dryRun ?? false;
@@ -42692,6 +44166,7 @@ var DeployEngine = class {
 		this.oldDeletedBeforeCreate = /* @__PURE__ */ new Set();
 		this.healBaseline = {};
 		this.deployChanges = /* @__PURE__ */ new Map();
+		this.deployStateResources = {};
 		this.inlinePolicyWriters = /* @__PURE__ */ new Map();
 		this.attributeHeals = /* @__PURE__ */ new Map();
 		this.healedAttributes = /* @__PURE__ */ new Map();
@@ -42761,7 +44236,7 @@ var DeployEngine = class {
 		};
 	}
 	inlinePolicyClaimedFor(resourceType, logicalId, stateResources) {
-		if (resourceType !== "AWS::IAM::Policy") return void 0;
+		if (resourceType !== "AWS::IAM::Policy" && !isInlinePolicyPrincipalType(resourceType) && !isStandaloneInlinePolicyType(resourceType)) return;
 		const args = {
 			selfLogicalId: logicalId,
 			writers: this.inlinePolicyWriters,
@@ -42908,5 +44383,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { getPriorAttempts as $, coerceCfnBoolean as $a, processStackMessages as $c, malformedScrubResourceEntriesRefusalMessage as $i, reserveStackCreateToken as $n, inheritNestedStackParameterAssociations as $o, envCredentialsAreAssumedRole as $r, parseBootstrapMarker as $s, orphanDeleteNeedsIdentity as $t, noEchoExactEchoLeavesOf as A, repairMalformedResourcePropertiesForReadOnly as Aa, resolveApp as Ac, displayLogicalId as Ai, maskEventTextWithBoundBags as An, valueAtCoordinate as Ao, markWaitAbandoned as Ar, hasReadableExportSet as As, isHandledOrphan as At, beginDeleteWait as B, NO_CC_HANDLERS_REASON as Ba, CFN_TEMPLATE_BODY_LIMIT as Bc, malformedLocalResourceEntriesWarning as Bi, ccRoutedFinalSnapshotError as Bn, shareLogOnlyValues as Bo, poisonRenderedSpellingsCollidingIn as Br, isSensitiveAttributeName as Bs, withStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedResourcesForDestroy as Ca, AssetManifestLoader as Cc, JSON_LISTING_HOLE_VALUE as Ci, collectPublishedOutputNames as Cn, maskedLeafCoordinatesOf as Co, unchangedBehindSecretReference as Cr, crossPrefixDeniedWarning as Cs, revertedNestedRowIds as Ct, withResourceDeadline as D, repairMalformedOrphansForReadOnly as Da, getDefaultStateBucketName as Dc, UNREADABLE_RESOURCES_MAP_ROW as Di, DEFAULT_RESOURCE_WARN_AFTER_MS as Dn, passedNoEchoParametersOf as Do, deleteSkipReason as Dr, acceptedCreateOnlyDropsOf as Ds, withNestedStackContext as Dt, serviceTokenBlockingReason as E, repairMalformedOrphanRecordsForReadOnly as Ea, synthesisStatusMessage as Ec, UNREADABLE_ORPHANS_CONTAINER_ROW as Ei, DEFAULT_RESOURCE_TIMEOUT_MS as En, noEchoOutputsComparison as Eo, deleteLeftInPlace as Er, splitImportedOps as Es, getCurrentNestedStackContext as Et, isProtectionValueActive as F, withheldAccountClause as Fa, resolveStateBucketWithDefaultAndSource as Fc, isReadableResourceEntry as Fi, storedSecretNameNeedles as Fn, literalSplitDelimitersOf as Fo, reDisableInstanceApiTermination as Fr, isReadableBag as Fs, replayFailedOperations as Ft, DELETE_INDEX_WAIT_PROCEED_NOTE as G, isStatefulRecreateTargetForReplace as Ga, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Gc, malformedOrphansRefusalMessage as Gi, unsupportedFinalSnapshotError as Gn, markSameGenerationBag as Go, assertFlagRoleArn as Gr, loadPublishableAssetManifest as Gs, isReplacementOrphan as Gt, deleteBudgetKey as H, findReplacedReadersOfRecreateTargets as Ha, MIGRATE_TMP_PREFIX as Hc, malformedOrphanRecordsRefusalMessage as Hi, effectiveDeletionPolicy as Hn, errorCauseChain as Ho, producerRegionsFromState as Hr, WorkGraph as Hs, recordAfterRollbackUpdate as Ht, perType as I, findActionableSilentDrops as Ia, resolveUseCdkBootstrapAssets as Ic, malformedDriftResourcePropertiesWarning as Ii, extractDeploymentEventError as In, logOnlyValueCount as Io, reEnableInstanceApiTermination as Ir, orphansAfterRollback as Is, replayRollback as It, waitForIndexesSettled as J, WARM_THROUGHPUT_MEMBERS as Ja, PARTITION_TABLE as Jc, malformedOutputsWarning as Ji, findDestructiveChanges as Jn, DYNAMIC_REFERENCE_TOKEN_SCAN as Jo, isIamRoleArn as Jr, BOOTSTRAP_MARKER_PREFIX as Js, recheckFailedPlan as Jt, INDEX_SETTLE_POLL_INTERVAL_MS as K, isStatefulRecreateTargetSync as Ka, decodeListingKey as Kc, malformedOrphansWarning as Ki, maskingRetryLogger as Kn, redactSecretsForState as Ko, assertSendableRoleArn as Kr, rewriteTemplateAssetReferences as Ks, planFailedOps as Kt, readProtection as L, findSilentDropProperties as La, stateBucketExistenceConfirmed as Lc, malformedExportNamesWarning as Li, ATOMIC_FINAL_SNAPSHOT_TYPES as Ln, printingCorpusOf as Lo, DiffCalculator as Lr, orphansCarriedFrom as Ls, awaitInFlightSibling as Lt, recordedProtectionEvidence as M, unpreviewableOrphanRecords as Ma, resolveCaptureObservedState as Mc, hasReadableOutputs as Mi, secretNamePrintingBag as Mn, carryLogOnlyValues as Mo, ec2InstanceProtectionSite as Mr, hasUnverifiableParameterRefusal as Ms, loadJournaledOrphans as Mt, recordedProtectionNote as N, unreadableOrphanRecords as Na, resolveSkipPrefix as Nc, hasReadableResources as Ni, secretNamedRecordNeedles as Nn, createUnionSecretMasker as No, isTerminationProtectionPropagationError as Nr, importableOutputKeys as Ns, makeForeignHolderScan as Nt, noEchoAttributeNamesOf as O, repairMalformedOutputsForReadOnly as Oa, getLegacyStateBucketName as Oc, accountArgs as Oi, completedReplayEntries as On, readbackPathFor as Oo, withIndeterminateGuard as Or, describeRegionValueKind as Os, deleteJournaledOrphans as Ot, PROTECTION_PROPERTY_BY_TYPE as P, unreadableResourceEntries as Pa, resolveStateBucketWithDefault as Pc, isReadableOrphanRecord as Pi, stateSecretNameNeedles as Pn, hasMaskableValues as Po, observeThenDisableInstanceApiTermination as Pr, importableOutputs as Ps, sameJournaledOrphans as Pt, isTruthyCfnBoolean as Q, toFiniteNumber as Qa, StageLoadError as Qc, malformedResourcesWarning as Qi, ledgerForStack as Qn, identityKeyFor as Qo, callerEnvCredentials as Qr, isCrossRegionRedirect as Qs, seedsDeleteFirstGuard as Qt, DynamoDBGlobalTableProvider as R, unwrittenCreateOnlyReplacement as Ra, warnDeprecatedNoPrefixCliFlag as Rc, malformedExportSourceWarning as Ri, PRE_DELETE_SNAPSHOT_TYPES as Rn, recordLogOnlyParameterValue as Ro, INTRINSIC_KEYS as Rr, shouldRetainResource as Rs, destroyStackRecordsView as Rt, keptForReadoption as S, refuseMalformedResourcesForDeploy as Sa, stripControlChars as Sc, passedParameterClassesOf as Si, collectDeclaredOutputNames as Sn, maskWholeValue as So, slowCcOperationTimeoutMs as Sr, applyCrossPrefixScan as Ss, revertNestedChildFromJournal as St, findServiceTokenRefusals as T, refuseMalformedState as Ta, Synthesizer as Tc, STATE_RESOURCES_MALFORMED as Ti, bindingSkippedOutputs as Tn, noEchoLeavesOf as To, deleteIndeterminateGuards as Tr, isNotImplemented as Ts, collectNestedChildUnaddressed as Tt, resolveDynamoDbDeleteBudgetClock as U, shownType as Ua, findLargeInlineResources as Uc, malformedOrphanRecordsWarning as Ui, isFinalSnapshotError as Un, maskSecretsInError as Uo, regionLessSecretName as Ur, buildAssetRedirectMap as Us, demoteSupersededOrphans as Ut, compensateRemovedDeletionProtection as V, hasNoCloudControlHandlers as Va, CFN_TEMPLATE_URL_LIMIT as Vc, malformedLocalResourcesWarning as Vi, createPreDeleteFinalSnapshot as Vn, createSecretMasker as Vo, classifyReplaySecretRegion as Vr, stringifyValue as Vs, removeProtectionTypeList as Vt, resolveDynamoDbDeleteBudgetMs as W, MULTI_REGION_RECREATE_BLOCKED_TYPES as Wa, uploadCfnTemplate as Wc, malformedOrphanRowsKeptWarning as Wi, refusesFinalSnapshot as Wn, maskSecretsInText as Wo, applyRoleArnIfSet as Wr, createAssetRedirectResolver as Ws, isJournaledOrphan as Wt, S3_AUTO_DELETE_OBJECTS_TAG as X, isWarmThroughputDecrease as Xa, derivePartitionAndUrlSuffix as Xc, malformedResourceEntriesWarning as Xi, RollbackInlinePolicyWriters as Xn, isUncertifiedBaselineMaskPosition as Xo, AWS_CREDENTIAL_ENV_KEYS as Xr, ensureAssetStorage as Xs, replacementNeverSwapped as Xt, ECR_AUTO_DELETE_IMAGES_TAG as Y, coerceWarmThroughput as Ya, canonicalizeRegion as Yc, malformedRenderedContainersWarning as Yi, formatDestructiveChange as Yn, dynamicReferenceTokens as Yo, sendableAssumeRoleCommand as Yr, assertAssetBucketRegion as Ys, recordUnderIdIsNotOwn as Yt, hasCdkAutoDeleteTag as Z, toCfnInteger as Za, AssemblyReader as Zc, malformedResourcePropertiesWarning as Zi, earliestDefined as Zn, pathCrossesDottedKey as Zo, applyCallerIdentityCredentials as Zr, getBootstrapMarkerKey as Zs, resolveReplacementOldType as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedResourceEntriesForOrphan as _a, redactedDockerCause as _c, isStalePlaceholderArnAttribute as _i, carriedExportAliasExposure as _n, TemplateParser as _o, readsNoEchoDeleteValues as _r, isLockInfoExpired as _s, displacedPhysicalIdShown as _t, findNestedTemplateTreeDefect as a, refuseMalformedOrphanRecordsForDestroy as aa, resolveDockerContextDirectory as ac, s3BucketWebsiteUrl as ai, absoluteAssemblyPathEscape as al, redactedDeleteAddressFields as an, replayWarn as ao, readTagList as ar, recordMaskOnlyValuesIn as as, gray as at, lookupEachName as b, refuseMalformedResourcePropertiesForExport as ba, warnFinchArgvExposure as bc, withSharedDrainBudget as bi, isWholeDynamicReferenceValue as bn, maskAtCoordinates as bo, withPrintingSecrets as br, CrossPrefixReadError as bs, nestedChildStackName as bt, renderNestedTemplateTreeDefect as c, refuseMalformedOrphansForOrphan as ca, describeDockerFailure as cc, parameterTypeMayLoseSecretIdentity as ci, renderAssemblyPathEscape as cl, updatePartialReason as cn, requireConfigString as co, tagPlanWarning as cr, recordProvenPublicExpression as cs, yellow as ct, conditionInputsFrom as d, refuseMalformedResourceAttributesForOrphan as da, formatDockerLoginError as dc, carriesDynamicReference as di, resolveBucketRegion as dl, WITHHELD_NAME_DISPLAY as dn, describeTypeWithThrottleRetry as do, CC_BROKEN_REASON as dr, STATE_SOURCED_CROSS_GENERATION_RULES as ds, reachableDivergentParameters as dt, malformedStateRefusalMessage as ea, readBootstrapMarkerBody as ec, isSettledInstanceState as ei, defineOwnKey as el, findNestedStackTypeChanges as en, coerceCfnInteger as eo, withCreateTokenLedger as er, recordNestedStackParameterExpressions as es, markRefusedBeforeApplying as et, parentSuppliedValues as f, refuseMalformedResourceEntries as fa, getDockerCmd as fc, carriesFetchableDynamicReference as fi, displayTextOrWithheld as fn, withRetry as fo, ProviderRegistry as fr, STATE_SOURCED_READBACK_RULES as fs, resourcesNamingDeclaredParameter as ft, mergeNoChangeOutputs as g, refuseMalformedResourceEntriesForImportSave as ga, redactDockerArgvValues as gc, cfnRefValueFromPhysicalId as gi, secretSafeKeyDisplay as gn, DagBuilder as go, TemplateNoEchoReresolver as gr, LockManager as gs, displacedOpClause as gt, keptWholeReasonText as h, refuseMalformedResourceEntriesForImport as ha, partitionSensitiveEnv as hc, AWS_NO_VALUE as hi, secretBearingStateKeyWarning as hn, sameLambdaFunctionAddress as ho, wouldReturnToSdkProvider as hr, isSingleDynamicReferenceToken as hs, NESTED_PENDING_PARENT_REASON as ht, childTemplateLoader as i, refuseMalformedOrphanRecords as ia, buildDockerImage as ic, s3BucketRegionalDomainName as ii, ownValue as il, isRedactedRecordedValue as in, readConfigString as io, planTagDiff as ir, recordMaskOnlyValue as is, cyan as it, noEchoParameterNamesOf as j, repairMalformedResourcesForReadOnly as ja, resolveAutoAssetStorage as jc, hasReadableOrphans as ji, orphanRecordsPrintingBag as jn, liveMatchesUnresolvedTokenFrame as jo, disableInstanceApiTermination as jr, hasReasonlessBaselineRefusal as js, journaledOrphanLines as jt, noEchoComparisonForTemplate as k, repairMalformedResourceEntriesForReadOnly as ka, loadCdkJson as kc, deployRefusesOrphanRowsReason as ki, journaledOrphanPrintingBag as kn, readsNoEchoSource as ko, isWaitAbandonedError as kr, exportNamesCarriedFrom as ks, dropFailedHint as kt, templateIdentity as l, refuseMalformedOutputs as la, dockerSpawnEnvWithSensitive as lc, getAccountInfo as li, resolveAssemblyPath as ll, DeploymentEventsReader as ln, prefetchCreateOnlyPropertyPaths as lo, definedAttributes as lr, wholeStringLeavesOf as ls, computeParameterTaint as lt, isSecretBearingReferenceString as m, refuseMalformedResourceEntriesForDestroy as ma, isMalformedEnvKey as mc, keepsSecretReferenceToken as mi, secretBearing as mn, lambdaFunctionNameForMask as mo, isCustomResource as mr, WHOLE_DYNAMIC_REFERENCE_PATTERN as ms, planOrphanAdoption as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseDivergentRecordRegionForDestroy as na, validateContainerRepoName as nc, s3BucketDomainName as ni, hasPlainPrototype$1 as nl, inheritProducerRegions as nn, configIntegerRefusal as no, DBPROXY_TAGS_WHAT as nr, carriesSecretMask as ns, createReadOnlyAttributeHealerFactory as nt, isAbsoluteAssetPath as o, refuseMalformedOrphans as oa, describeDockerCapturedOutput as oc, coerceParameterTypedValue as oi, describeFileReadFailure as ol, redactedDeleteAddressSkip as on, requireConfigArray as oo, refuseMalformedDesiredTags as or, recordNoEchoAttributeValues as os, green as ot, readRecordedConditionVerdicts as p, refuseMalformedResourceEntriesForDeploy as pa, isDockerClientEnvKey as pc, isNamelessDynamicReferenceError as pi, exportAliasCollisionScrubWarning as pn, canonicalLambdaFunctionName as po, ccBrokenReason as pr, TEMPLATE_SOURCED_RULES as ps, makeSiblingClaimReader as pt, deleteTableWithIndexBusyRetry as q, renderStatefulReason as qa, expectedOwnerParam as qc, malformedOutputsRefusalMessage as qi, constructPathOf as qn, scrubResourceRecord as qo, explicitRoleArnOrThrow as qr, AssetModeResolver as qs, planRollback as qt, computeImplicitDeleteEdges as r, refuseMalformedNestedChildOutputs as ra, buildDenyExternalAccessPolicy as rc, s3BucketDualStackDomainName as ri, nullPrototypeRecord as rl, REDACTED_DELETE_ADDRESS_SKIP_REASON as rn, configStringRefusal as ro, DBPROXY_TAG_OPTIONS as rr, provenPublicValue as rs, bold as rt, listNestedTemplateRows as s, refuseMalformedOrphansForDestroy as sa, describeDockerExecFailure as sc, isUnboundTemplateParameter as si, displayAssemblyPath as sl, updatePartialMessage as sn, requireConfigObject as so, tagMapAsList as sr, recordNoEchoParameterFreshValue as ss, red as st, DeployEngine as t, previewableOrphanRecords as ta, validateAssetBucketName as tc, s3BucketArn as ti, hasOwnKey as tl, getCurrentProducerRegions as tn, configBooleanRefusal as to, acquireIdempotencyToken as tr, recoverMaskedOutput as ts, formatResourceLine as tt, conditionFingerprint as u, refuseMalformedOutputsForDestroy as ua, finchSecretArgvRefusal as uc, isImpossibleEmptyStoredAttribute as ui, clearBucketRegionCache as ul, DeploymentEventsStore as un, templateResourceTypes as uo, stringifyIfAssigned as ur, STATE_SOURCED_BASELINE_RULES as us, namesAnyDeclaredParameter as ut, chunks as v, refuseMalformedResourcePropertiesForDestroy as va, runDockerForeground as vc, refStateLookupFromResource as vi, exportNameNoEchoParameters as vn, canonicalCoordinates as vo, isCustomResourceType as vr, S3StateBackend as vs, dropSettledNestedJournals as vt, deferredServiceTokenWarning as w, refuseMalformedResourcesForExport as wa, getDockerImageBySourceHash as wc, STATE_REGION_DIVERGED as wi, isExportAliasCollision as wn, noEchoCoordinatesOf as wo, UNSPECIFIED_SKIP_REASON as wr, isAccessDenied as ws, withNestedRevertRun as wt, withApiLimit as x, refuseMalformedResourcePropertiesForOrphan as xa, escapeRegExp$3 as xc, parameterInputsFor as xi, noEchoParameterValueSeed as xn, maskReadbackAtCoordinates as xo, CloudControlProvider as xr, CrossPrefixScanCache as xs, recordDisplacedSkips as xt, isAccessDeniedError as y, refuseMalformedResourcePropertiesForDrift as ya, runDockerStreaming as yc, parseWebACLArn as yi, exportNameSecretExposure as yn, isMarkedCoordinate as yo, getCurrentResourceSecrets as yr, rebuildClientForBucketRegion as ys, getNestedRevertRun as yt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as z, withoutSilentDropProperties as za, ssmResolvedValueType as zc, malformedLocalOutputsWarning as zi, buildFinalSnapshotIdentifier as zn, recordLogOnlyValue as zo, IntrinsicFunctionResolver as zr, AssetPublisher as zs, getStackRecords as zt };
-//# sourceMappingURL=deploy-engine-5FFXg6ih.js.map
+export { isTruthyCfnBoolean as $, isStatefulRecreateTargetForReplace as $a, CFN_TEMPLATE_URL_LIMIT as $c, malformedOrphansRefusalMessage as $i, ledgerForStack as $n, markSameGenerationBag as $o, assertSendableRoleArn as $r, stringifyValue as $s, seedsDeleteFirstGuard as $t, noEchoComparisonForTemplate as A, refuseMalformedResourcesForDeploy as Aa, runDockerForeground as Ac, declaresNoEcho as Ai, journaledOrphanPrintingBag as An, maskWholeValue as Ao, deleteIndeterminateGuards as Ar, S3StateBackend as As, dropFailedHint as At, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as B, unpreviewableOrphanRecords as Ba, getLegacyStateBucketName as Bc, hasReadableOutputs as Bi, PRE_DELETE_SNAPSHOT_TYPES as Bn, carryLogOnlyValues as Bo, reDisableInstanceApiTermination as Br, describeRegionValueKind as Bs, getStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedResourceEntriesForImport as Ca, formatDockerLoginError as Cc, cfnRefValueFromPhysicalId as Ci, resolveBucketRegion as Cl, collectDeclaredOutputNames as Cn, sameLambdaFunctionAddress as Co, applyCustomResourceResponseExpiration as Cr, STATE_SOURCED_CROSS_GENERATION_RULES as Cs, revertNestedChildFromJournal as Ct, withResourceDeadline as D, refuseMalformedResourcePropertiesForDrift as Da, partitionSensitiveEnv as Dc, withSharedDrainBudget as Di, DEFAULT_RESOURCE_TIMEOUT_MS as Dn, isMarkedCoordinate as Do, unchangedBehindSecretReference as Dr, isSingleDynamicReferenceToken as Ds, getCurrentNestedStackContext as Dt, serviceTokenBlockingReason as E, refuseMalformedResourcePropertiesForDestroy as Ea, isMalformedEnvKey as Ec, parseWebACLArn as Ei, bindingSkippedOutputs as En, canonicalCoordinates as Eo, slowCcOperationTimeoutMs as Er, WHOLE_DYNAMIC_REFERENCE_PATTERN as Es, collectNestedChildUnaddressed as Et, PROTECTION_PROPERTY_BY_TYPE as F, repairMalformedOrphansForReadOnly as Fa, AssetManifestLoader as Fc, UNREADABLE_RESOURCES_MAP_ROW as Fi, secretNamedRecordNeedles as Fn, passedNoEchoParametersOf as Fo, markWaitAbandoned as Fr, crossPrefixDeniedWarning as Fs, sameJournaledOrphans as Ft, resolveDynamoDbDeleteBudgetMs as G, findSilentDropProperties as Ga, resolveSkipPrefix as Gc, malformedExportNamesWarning as Gi, isFinalSnapshotError as Gn, printingCorpusOf as Go, poisonRenderedSpellingsCollidingIn as Gr, importableOutputKeys as Gs, isJournaledOrphan as Gt, compensateRemovedDeletionProtection as H, unreadableResourceEntries as Ha, resolveApp as Hc, isReadableOrphanRecord as Hi, ccRoutedFinalSnapshotError as Hn, hasMaskableValues as Ho, DiffCalculator as Hr, hasReadableExportSet as Hs, removeProtectionTypeList as Ht, isProtectionValueActive as I, repairMalformedOutputsForReadOnly as Ia, getDockerImageBySourceHash as Ic, accountArgs as Ii, stateSecretNameNeedles as In, readbackPathFor as Io, disableInstanceApiTermination as Ir, isAccessDenied$1 as Is, replayFailedOperations as It, deleteTableWithIndexBusyRetry as J, NO_CC_HANDLERS_REASON as Ja, resolveUseCdkBootstrapAssets as Jc, malformedLocalResourceEntriesWarning as Ji, maskingRetryLogger as Jn, shareLogOnlyValues as Jo, regionLessSecretName as Jr, orphansAfterRollback as Js, planRollback as Jt, DELETE_INDEX_WAIT_PROCEED_NOTE as K, unwrittenCreateOnlyReplacement as Ka, resolveStateBucketWithDefault as Kc, malformedExportSourceWarning as Ki, refusesFinalSnapshot as Kn, recordLogOnlyParameterValue as Ko, classifyReplaySecretRegion as Kr, importableOutputs as Ks, isReplacementOrphan as Kt, perType as L, repairMalformedResourceEntriesForReadOnly as La, Synthesizer as Lc, deployRefusesOrphanRowsReason as Li, storedSecretNameNeedles as Ln, readsNoEchoSource as Lo, ec2InstanceProtectionSite as Lr, isNotImplemented as Ls, replayRollback as Lt, noEchoParameterNamesOf as M, refuseMalformedResourcesForExport as Ma, warnFinchArgvExposure as Mc, STATE_REGION_DIVERGED as Mi, orphanRecordsPrintingBag as Mn, noEchoCoordinatesOf as Mo, deleteSkipReason as Mr, CrossPrefixReadError as Ms, journaledOrphanLines as Mt, recordedProtectionEvidence as N, refuseMalformedState as Na, escapeRegExp$3 as Nc, STATE_RESOURCES_MALFORMED as Ni, secretNamePrintingBag as Nn, noEchoLeavesOf as No, withIndeterminateGuard as Nr, CrossPrefixScanCache as Ns, loadJournaledOrphans as Nt, diffSecurity as O, refuseMalformedResourcePropertiesForExport as Oa, redactDockerArgvValues as Oc, parameterInputsFor as Oi, DEFAULT_RESOURCE_WARN_AFTER_MS as On, maskAtCoordinates as Oo, RollbackInlinePolicyWriters as Or, LockManager as Os, withNestedStackContext as Ot, recordedProtectionNote as P, repairMalformedOrphanRecordsForReadOnly as Pa, stripControlChars as Pc, UNREADABLE_ORPHANS_CONTAINER_ROW as Pi, secretNamePrintingBags as Pn, noEchoOutputsComparison as Po, isWaitAbandonedError as Pr, applyCrossPrefixScan as Ps, makeForeignHolderScan as Pt, hasCdkAutoDeleteTag as Q, MULTI_REGION_RECREATE_BLOCKED_TYPES as Qa, CFN_TEMPLATE_BODY_LIMIT as Qc, malformedOrphanRowsKeptWarning as Qi, earliestDefined as Qn, maskSecretsInText as Qo, assertFlagRoleArn as Qr, isSensitiveAttributeName as Qs, resolveReplacementOldType as Qt, readProtection as R, repairMalformedResourcePropertiesForReadOnly as Ra, synthesisStatusMessage as Rc, displayLogicalId as Ri, extractDeploymentEventError as Rn, valueAtCoordinate as Ro, isTerminationProtectionPropagationError as Rr, splitImportedOps as Rs, awaitInFlightSibling as Rt, keptForReadoption as S, refuseMalformedResourceEntriesForDestroy as Sa, finchSecretArgvRefusal as Sc, AWS_NO_VALUE as Si, clearBucketRegionCache as Sl, noEchoParameterValueSeed as Sn, lambdaFunctionNameForMask as So, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Sr, STATE_SOURCED_BASELINE_RULES as Ss, recordDisplacedSkips as St, findServiceTokenRefusals as T, refuseMalformedResourceEntriesForOrphan as Ta, isDockerClientEnvKey as Tc, refStateLookupFromResource as Ti, isExportAliasCollision as Tn, TemplateParser as To, CloudControlProvider as Tr, TEMPLATE_SOURCED_RULES as Ts, withNestedRevertRun as Tt, deleteBudgetKey as U, withheldAccountClause as Ua, resolveAutoAssetStorage as Uc, isReadableResourceEntry as Ui, createPreDeleteFinalSnapshot as Un, literalSplitDelimitersOf as Uo, INTRINSIC_KEYS as Ur, hasReasonlessBaselineRefusal as Us, recordAfterRollbackUpdate as Ut, beginDeleteWait as V, unreadableOrphanRecords as Va, loadCdkJson as Vc, hasReadableResources as Vi, buildFinalSnapshotIdentifier as Vn, createUnionSecretMasker as Vo, reEnableInstanceApiTermination as Vr, exportNamesCarriedFrom as Vs, withStackRecords as Vt, resolveDynamoDbDeleteBudgetClock as W, findActionableSilentDrops as Wa, resolveCaptureObservedState as Wc, malformedDriftResourcePropertiesWarning as Wi, effectiveDeletionPolicy as Wn, logOnlyValueCount as Wo, IntrinsicFunctionResolver as Wr, hasUnverifiableParameterRefusal as Ws, demoteSupersededOrphans as Wt, ECR_AUTO_DELETE_IMAGES_TAG as X, findReplacedReadersOfRecreateTargets as Xa, warnDeprecatedNoPrefixCliFlag as Xc, malformedOrphanRecordsRefusalMessage as Xi, findDestructiveChanges as Xn, errorCauseChain as Xo, refuseUnreadableCdkCrossAccountRefs as Xr, shouldRetainResource as Xs, recordUnderIdIsNotOwn as Xt, waitForIndexesSettled as Y, hasNoCloudControlHandlers as Ya, stateBucketExistenceConfirmed as Yc, malformedLocalResourcesWarning as Yi, constructPathOf as Yn, createSecretMasker as Yo, producerLookupOver as Yr, orphansCarriedFrom as Ys, recheckFailedPlan as Yt, S3_AUTO_DELETE_OBJECTS_TAG as Z, shownType as Za, ssmResolvedValueType as Zc, malformedOrphanRecordsWarning as Zi, formatDestructiveChange as Zn, maskSecretsInError as Zo, applyRoleArnIfSet as Zr, AssetPublisher as Zs, replacementNeverSwapped as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedOutputs as _a, resolveDockerContextDirectory as _c, isImpossibleEmptyStoredAttribute as _i, absoluteAssemblyPathEscape as _l, secretSafeKeyDisplay as _n, prefetchCreateOnlyPropertyPaths as _o, TemplateNoEchoReresolver as _r, recordMaskOnlyValuesIn as _s, displacedOpClause as _t, findNestedTemplateTreeDefect as a, malformedResourcePropertiesWarning as aa, AssetModeResolver as ac, callerEnvCredentials as ai, expectedOwnerParam as al, isRedactedRecordedValue as an, toCfnInteger as ao, planTagDiff as ar, DYNAMIC_REFERENCE_TOKEN_SCAN as as, cyan as at, lookupEachName as b, refuseMalformedResourceEntries as ba, describeDockerFailure as bc, isNamelessDynamicReferenceError as bi, renderAssemblyPathEscape as bl, exportNameSecretExposure as bn, withRetry as bo, getCurrentResourceSecrets as br, recordProvenPublicExpression as bs, getNestedRevertRun as bt, renderNestedTemplateTreeDefect as c, malformedStateRefusalMessage as ca, ensureAssetStorage as cc, s3BucketArn as ci, derivePartitionAndUrlSuffix as cl, updatePartialMessage as cn, coerceCfnInteger as co, tagMapAsList as cr, pathCrossesDottedKey as cs, red as ct, conditionInputsFrom as d, refuseMalformedNestedChildOutputs as da, parseBootstrapMarker as dc, s3BucketRegionalDomainName as di, processStackMessages as dl, DeploymentEventsStore as dn, configStringRefusal as do, stringifyIfAssigned as dr, recordNestedStackParameterExpressions as ds, namesAnyDeclaredParameter as dt, malformedOrphansWarning as ea, WorkGraph as ec, explicitRoleArnOrThrow as ei, MIGRATE_TMP_PREFIX as el, orphanDeleteNeedsIdentity as en, isStatefulRecreateTargetSync as eo, reserveStackCreateToken as er, redactSecretsForState as es, getPriorAttempts as et, parentSuppliedValues as f, refuseMalformedOrphanRecords as fa, readBootstrapMarkerBody as fc, s3BucketWebsiteUrl as fi, defineOwnKey as fl, WITHHELD_NAME_DISPLAY as fn, readConfigString as fo, CC_BROKEN_REASON as fr, recoverMaskedOutput as fs, reachableDivergentParameters as ft, mergeNoChangeOutputs as g, refuseMalformedOrphansForOrphan as ga, buildDockerImage as gc, getAccountInfo as gi, ownValue as gl, secretBearingStateKeyWarning as gn, requireConfigString as go, wouldReturnToSdkProvider as gr, recordMaskOnlyValue as gs, NESTED_PENDING_PARENT_REASON as gt, keptWholeReasonText as h, refuseMalformedOrphansForDestroy as ha, buildDenyExternalAccessPolicy as hc, parameterTypeMayLoseSecretIdentity as hi, nullPrototypeRecord as hl, secretBearing as hn, requireConfigObject as ho, isCustomResource as hr, provenPublicValue as hs, planOrphanAdoption as ht, childTemplateLoader as i, malformedResourceEntriesWarning as ia, rewriteTemplateAssetReferences as ic, applyCallerIdentityCredentials as ii, decodeListingKey as il, REDACTED_DELETE_ADDRESS_SKIP_REASON as in, isWarmThroughputDecrease as io, DBPROXY_TAG_OPTIONS as ir, recordPhysicalNameCopy as is, bold as it, noEchoExactEchoLeavesOf as j, refuseMalformedResourcesForDestroy as ja, runDockerStreaming as jc, JSON_LISTING_HOLE_VALUE as ji, maskEventTextWithBoundBags as jn, maskedLeafCoordinatesOf as jo, deleteLeftInPlace as jr, rebuildClientForBucketRegion as js, isHandledOrphan as jt, noEchoAttributeNamesOf as k, refuseMalformedResourcePropertiesForOrphan as ka, redactedDockerCause as kc, passedParameterClassesOf as ki, completedReplayEntries as kn, maskReadbackAtCoordinates as ko, UNSPECIFIED_SKIP_REASON as kr, isLockInfoExpired as ks, deleteJournaledOrphans as kt, templateIdentity as l, previewableOrphanRecords as la, getBootstrapMarkerKey as lc, s3BucketDomainName as li, AssemblyReader as ll, updatePartialReason as ln, configBooleanRefusal as lo, tagPlanWarning as lr, identityKeyFor as ls, yellow as lt, isSecretBearingReferenceString as m, refuseMalformedOrphans as ma, validateContainerRepoName as mc, isUnboundTemplateParameter as mi, hasPlainPrototype$1 as ml, exportAliasCollisionScrubWarning as mn, requireConfigArray as mo, ccBrokenReason as mr, carriesSecretMask as ms, makeSiblingClaimReader as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedOutputsWarning as na, createAssetRedirectResolver as nc, sendableAssumeRoleCommand as ni, uploadCfnTemplate as nl, getCurrentProducerRegions as nn, WARM_THROUGHPUT_MEMBERS as no, acquireIdempotencyToken as nr, withPhysicalNameCopies as ns, formatResourceLine as nt, isAbsoluteAssetPath as o, malformedResourcesWarning as oa, BOOTSTRAP_MARKER_PREFIX as oc, envCredentialsAreAssumedRole as oi, PARTITION_TABLE as ol, redactedDeleteAddressFields as on, toFiniteNumber as oo, readTagList as or, dynamicReferenceTokens as os, gray as ot, readRecordedConditionVerdicts as p, refuseMalformedOrphanRecordsForDestroy as pa, validateAssetBucketName as pc, coerceParameterTypedValue as pi, hasOwnKey as pl, displayTextOrWithheld as pn, replayWarn as po, ProviderRegistry as pr, splitGetAttStringForm as ps, resourcesNamingDeclaredParameter as pt, INDEX_SETTLE_POLL_INTERVAL_MS as q, withoutSilentDropProperties as qa, resolveStateBucketWithDefaultAndSource as qc, malformedLocalOutputsWarning as qi, unsupportedFinalSnapshotError as qn, recordLogOnlyValue as qo, producerRegionsFromState as qr, isReadableBag as qs, planFailedOps as qt, computeImplicitDeleteEdges as r, malformedRenderedContainersWarning as ra, loadPublishableAssetManifest as rc, AWS_CREDENTIAL_ENV_KEYS as ri, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as rl, inheritProducerRegions as rn, coerceWarmThroughput as ro, DBPROXY_TAGS_WHAT as rr, withoutPhysicalNameCopies as rs, createReadOnlyAttributeHealerFactory as rt, listNestedTemplateRows as s, malformedScrubResourceEntriesRefusalMessage as sa, assertAssetBucketRegion as sc, isSettledInstanceState as si, canonicalizeRegion as sl, redactedDeleteAddressSkip as sn, coerceCfnBoolean as so, refuseMalformedDesiredTags as sr, isUncertifiedBaselineMaskPosition as ss, green as st, DeployEngine as t, malformedOutputsRefusalMessage as ta, buildAssetRedirectMap as tc, isIamRoleArn as ti, findLargeInlineResources as tl, findNestedStackTypeChanges as tn, renderStatefulReason as to, withCreateTokenLedger as tr, scrubResourceRecord as ts, markRefusedBeforeApplying as tt, conditionFingerprint as u, refuseDivergentRecordRegionForDestroy as ua, isCrossRegionRedirect as uc, s3BucketDualStackDomainName as ui, StageLoadError as ul, DeploymentEventsReader as un, configIntegerRefusal as uo, definedAttributes as ur, inheritNestedStackParameterAssociations as us, computeParameterTaint as ut, chunks as v, refuseMalformedOutputsForDestroy as va, describeDockerCapturedOutput as vc, carriesDynamicReference as vi, describeFileReadFailure as vl, carriedExportAliasExposure as vn, templateResourceTypes as vo, readsNoEchoDeleteValues as vr, recordNoEchoAttributeValues as vs, displacedPhysicalIdShown as vt, deferredServiceTokenWarning as w, refuseMalformedResourceEntriesForImportSave as wa, getDockerCmd as wc, isStalePlaceholderArnAttribute as wi, collectPublishedOutputNames as wn, DagBuilder as wo, customResourceResponseExpirationWarning as wr, STATE_SOURCED_READBACK_RULES as ws, revertedNestedRowIds as wt, withApiLimit as x, refuseMalformedResourceEntriesForDeploy as xa, dockerSpawnEnvWithSensitive as xc, keepsSecretReferenceToken as xi, resolveAssemblyPath as xl, isWholeDynamicReferenceValue as xn, canonicalLambdaFunctionName as xo, withPrintingSecrets as xr, wholeStringLeavesOf as xs, nestedChildStackName as xt, isAccessDeniedError as y, refuseMalformedResourceAttributesForOrphan as ya, describeDockerExecFailure as yc, carriesFetchableDynamicReference as yi, displayAssemblyPath as yl, exportNameNoEchoParameters as yn, describeTypeWithThrottleRetry as yo, isCustomResourceType as yr, recordNoEchoParameterFreshValue as ys, dropSettledNestedJournals as yt, DynamoDBGlobalTableProvider as z, repairMalformedResourcesForReadOnly as za, getDefaultStateBucketName as zc, hasReadableOrphans as zi, ATOMIC_FINAL_SNAPSHOT_TYPES as zn, liveMatchesUnresolvedTokenFrame as zo, observeThenDisableInstanceApiTermination as zr, acceptedCreateOnlyDropsOf as zs, destroyStackRecordsView as zt };
+//# sourceMappingURL=deploy-engine-CJTG3tft.js.map