@go-to-k/cdkd 0.297.0 → 0.298.0

package/dist/{deploy-engine-dvf1UDuo.js → deploy-engine-CJTG3tft.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js";
-import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
-import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-Cz2tPxXk.js";
+import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, H as truncateCodePoints, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as terminalSafe, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
+import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-CwKiK9nS.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-DE-djeB0.js";
+import { t as getCdkdVersion } from "./version-D96I6uiO.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -637,6 +637,7 @@ var AssemblyReader = class {
 			if (!resolvedNested.contained) throw new SynthesisError(`Stack ${displayStackName(stackName)} nested-stack ${displayIdent(logicalId)} has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which ${renderAssemblyPathEscape(resolvedNested, assemblyDir)}`);
 			nestedTemplates[logicalId] = resolvedNested.path;
 		}
+		const lookupRoleArn = props?.lookupRole?.arn;
 		return {
 			stackName,
 			displayName: artifact.displayName ?? stackName,
@@ -649,6 +650,7 @@ var AssemblyReader = class {
 			account: env?.account !== "unknown-account" ? env?.account : void 0,
 			...props?.terminationProtection !== void 0 && { terminationProtection: props.terminationProtection },
 			...Object.keys(nestedTemplates).length > 0 && { nestedTemplates },
+			...typeof lookupRoleArn === "string" && { lookupRoleArn },
 			messages: collectStackMessages(assemblyDir, artifact)
 		};
 	}
@@ -8405,6 +8407,23 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 	};
 }
 
+//#endregion
+//#region src/deployment/secret-redaction/physical-name-copies.ts
+const physicalNameCopiesOf = /* @__PURE__ */ new WeakMap();
+function recordPhysicalNameCopy(secrets, physicalId) {
+	if (physicalId === "") return;
+	sideSetOf(physicalNameCopiesOf, secrets).add(physicalId);
+}
+function physicalNameSpans(names, value) {
+	const spans = [];
+	if (names === void 0) return spans;
+	for (const name of names) for (let at = value.indexOf(name); at !== -1; at = value.indexOf(name, at + 1)) spans.push({
+		start: at,
+		end: at + name.length
+	});
+	return spans;
+}
+
 //#endregion
 //#region src/deployment/secret-redaction/redact-state.ts
 function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RULES) {
@@ -8424,17 +8443,22 @@ function redactSecretsForStatePasses(bag, secrets, source, rules) {
 	}
 	const regex = buildNeedleRegex(substringNeedlesOf(secrets));
 	const wholeValueExpr = (s) => s === "" ? void 0 : secrets.get(s);
+	const physicalNames = physicalNameCopiesOf.get(secrets);
 	let vouched;
 	const vouchedExpressions = () => vouched ??= new Set(secrets.values());
 	const scanLeaf = (value, needles) => {
 		const spans = isDynamicReferenceString(value) ? resolvableReferenceSpans(value, vouchedExpressions()) : [];
+		const names = physicalNameSpans(physicalNames, value);
 		return value.replace(needles, (match, offset) => {
 			if (isStrictlyInsideASpan(spans, offset, offset + match.length)) return match;
+			const end = offset + match.length;
+			if (names.some((n) => n.start <= offset && end <= n.end)) return match;
 			return secrets.get(match) ?? "***";
 		});
 	};
 	const walk = (value) => {
 		if (typeof value === "string") {
+			if (physicalNames?.has(value) === true) return value;
 			const whole = wholeValueExpr(value);
 			if (whole !== void 0) return whole;
 			if (isSingleDynamicReferenceToken(value) && spanNamesResolvableService(value)) return value;
@@ -8467,6 +8491,133 @@ function scrubResourceRecord(record, secrets, sourceProperties, observedRules) {
 	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets, sourceProperties ?? next.properties, observedRules ?? (sourceProperties !== void 0 ? TEMPLATE_SOURCED_RULES : secrets.size === 0 && isSameGenerationBag(record.observedProperties) ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES));
 	return next;
 }
+function withoutPhysicalNameCopies(secrets, run) {
+	const names = physicalNameCopiesOf.get(secrets);
+	if (names === void 0) return run();
+	physicalNameCopiesOf.delete(secrets);
+	try {
+		return run();
+	} finally {
+		physicalNameCopiesOf.set(secrets, names);
+	}
+}
+function withPhysicalNameCopies(secrets, ids, run) {
+	const previous = physicalNameCopiesOf.get(secrets);
+	const names = new Set(previous);
+	for (const id of ids) if (id !== "") names.add(id);
+	physicalNameCopiesOf.set(secrets, names);
+	try {
+		return run();
+	} finally {
+		if (previous === void 0) physicalNameCopiesOf.delete(secrets);
+		else physicalNameCopiesOf.set(secrets, previous);
+	}
+}
+function repairPhysicalNameCopyLeaves(stored, legacy, current) {
+	if (typeof stored === "string") return typeof legacy === "string" && typeof current === "string" && stored === legacy && current !== legacy ? current : stored;
+	if (Array.isArray(stored)) {
+		if (!Array.isArray(legacy) || !Array.isArray(current)) return stored;
+		if (legacy.length !== stored.length || current.length !== stored.length) return stored;
+		let changed = false;
+		const out = stored.map((item, i) => {
+			const next = repairPhysicalNameCopyLeaves(item, legacy[i], current[i]);
+			if (next !== item) changed = true;
+			return next;
+		});
+		return changed ? out : stored;
+	}
+	if (stored !== null && typeof stored === "object") {
+		if (legacy === null || typeof legacy !== "object" || Array.isArray(legacy)) return stored;
+		if (current === null || typeof current !== "object" || Array.isArray(current)) return stored;
+		const l = legacy;
+		const c = current;
+		let out;
+		for (const [key, value] of Object.entries(stored)) {
+			if (!Object.hasOwn(l, key) || !Object.hasOwn(c, key)) continue;
+			const next = repairPhysicalNameCopyLeaves(value, l[key], c[key]);
+			if (next !== value) {
+				out ??= { ...stored };
+				out[key] = next;
+			}
+		}
+		return out ?? stored;
+	}
+	return stored;
+}
+function embeddedPhysicalNameRewrites(secrets, legacySecrets = secrets) {
+	const names = physicalNameCopiesOf.get(secrets);
+	if (names === void 0) return [];
+	const pairs = [];
+	withoutPhysicalNameCopies(legacySecrets, () => {
+		for (const name of names) {
+			const legacy = redactSecretsForState(name, legacySecrets);
+			if (typeof legacy === "string" && legacy !== name && legacy.includes("{{resolve:") && !isSingleDynamicReferenceToken(legacy) && !legacy.includes("***")) pairs.push([legacy, name]);
+		}
+	});
+	return pairs;
+}
+function replaceEmbeddedPhysicalNameRewrites(value, pairs) {
+	if (pairs.length === 0) return value;
+	if (typeof value === "string") {
+		let next = value;
+		for (const [legacy, name] of pairs) next = next.split(legacy).join(name);
+		return next;
+	}
+	if (Array.isArray(value)) {
+		let changed = false;
+		const out = value.map((item) => {
+			const next = replaceEmbeddedPhysicalNameRewrites(item, pairs);
+			if (next !== item) changed = true;
+			return next;
+		});
+		return changed ? out : value;
+	}
+	if (value !== null && typeof value === "object") {
+		let out;
+		for (const [key, item] of Object.entries(value)) {
+			const next = replaceEmbeddedPhysicalNameRewrites(item, pairs);
+			if (next !== item) {
+				out ??= { ...value };
+				out[key] = next;
+			}
+		}
+		return out ?? value;
+	}
+	return value;
+}
+function repairEmbeddedPhysicalNamesTowards(stored, target, pairs) {
+	if (pairs.length === 0) return stored;
+	if (typeof stored === "string") {
+		if (typeof target !== "string" || stored === target) return stored;
+		const repaired = replaceEmbeddedPhysicalNameRewrites(stored, pairs);
+		return repaired === target ? repaired : stored;
+	}
+	if (Array.isArray(stored)) {
+		if (!Array.isArray(target) || target.length !== stored.length) return stored;
+		let changed = false;
+		const out = stored.map((item, i) => {
+			const next = repairEmbeddedPhysicalNamesTowards(item, target[i], pairs);
+			if (next !== item) changed = true;
+			return next;
+		});
+		return changed ? out : stored;
+	}
+	if (stored !== null && typeof stored === "object") {
+		if (target === null || typeof target !== "object" || Array.isArray(target)) return stored;
+		const t = target;
+		let out;
+		for (const [key, value] of Object.entries(stored)) {
+			if (!Object.hasOwn(t, key)) continue;
+			const next = repairEmbeddedPhysicalNamesTowards(value, t[key], pairs);
+			if (next !== value) {
+				out ??= { ...stored };
+				out[key] = next;
+			}
+		}
+		return out ?? stored;
+	}
+	return stored;
+}
 
 //#endregion
 //#region src/deployment/secret-redaction/positions.ts
@@ -17450,6 +17601,15 @@ function conditionsAssumedFalse(conditions) {
 	return assumedConditionNames.get(conditions) ?? /* @__PURE__ */ new Set();
 }
 
+//#endregion
+//#region src/deployment/noecho-declared.ts
+function isNoEchoDeclared(noEcho) {
+	return noEcho === true || noEcho === "true";
+}
+function declaresNoEcho(definition) {
+	return definition !== null && typeof definition === "object" && isNoEchoDeclared(definition.NoEcho);
+}
+
 //#endregion
 //#region src/deployment/masked-property-fingerprints.ts
 const FINGERPRINT_LAYOUT$1 = 1;
@@ -17526,7 +17686,7 @@ function parameterInputsFor(args) {
 			continue;
 		}
 		const value = values[name];
-		let secret = isPlainObject$2(definition) && (definition["NoEcho"] === true || definition["NoEcho"] === "true") || carriesSecretValue(value, []);
+		let secret = isPlainObject$2(definition) && declaresNoEcho(definition) || carriesSecretValue(value, []);
 		if (!secret && args.nestedChild === true && args.supplied !== void 0) {
 			if (Object.hasOwn(args.supplied, name)) {
 				const passed = args.passedClasses?.get(name);
@@ -17951,7 +18111,7 @@ function childParameterInputs(template, passed) {
 	const inputs = /* @__PURE__ */ new Map();
 	for (const name of Object.keys(declared)) {
 		const definition = declared[name];
-		if (isPlainObject$2(definition) && (definition["NoEcho"] === true || definition["NoEcho"] === "true")) inputs.set(name, { kind: "secret" });
+		if (isPlainObject$2(definition) && declaresNoEcho(definition)) inputs.set(name, { kind: "secret" });
 		else if (passed.has(name)) {
 			const passedClass = passed.get(name);
 			inputs.set(name, passedClass === "clean" ? {
@@ -18960,7 +19120,7 @@ function inheritedSecretsCarriedBy(value, inherited) {
 	return carried;
 }
 function stringifyParameterForLog(paramDef, value) {
-	if (paramDef?.NoEcho === true) return "<redacted>";
+	if (declaresNoEcho(paramDef)) return "<redacted>";
 	return stringifyValue(value);
 }
 function boundAltered(original, shown, maxCodePoints) {
@@ -19581,7 +19741,7 @@ async function resolveGetAtt(getAtt, context) {
 				redacted: isSensitiveAttributeName(attributeName)
 			})}`);
 			if (reresolvesNestedReference) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${this.displayLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
-			return notedFlatValue;
+			return await this.reresolveRecordedReferences(notedFlatValue, logicalId, context, `${logicalId}.${this.displayLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 		}
 		if (attributeName.includes(".")) {
 			const parts = attributeName.split(".");
@@ -19597,7 +19757,7 @@ async function resolveGetAtt(getAtt, context) {
 					structured: isStructured(cursor),
 					redacted: isSensitiveAttributeName(attributeName)
 				})}`);
-				return notedCursor;
+				return await this.reresolveRecordedReferences(notedCursor, logicalId, context, `${logicalId}.${this.displayLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 			}
 		}
 	}
@@ -19669,6 +19829,70 @@ function recordSecretNamedRead(logicalId, value, context) {
 		break;
 	}
 }
+async function reresolveRecordedReferences(value, logicalId, context, origin, sourceKey) {
+	if (!carriesDynamicReference(value) || carriesSecretMask(value)) return value;
+	if (context.recordedSecretValues === void 0) return value;
+	if (!referencesProvenLocal(value, logicalId, context)) {
+		this.logger.debug(safeMsg`Not re-resolving the reference(s) in ${this.displayMasked(origin, context)}: the template of ${this.displayMasked(logicalId, context)} does not spell them, so the region that resolved them is unknown`);
+		return value;
+	}
+	if (!await this.referencesMatchPhysicalId(value, logicalId, context)) {
+		this.logger.warn(safeMsg`Serving ${this.displayMasked(origin, context)} as recorded, with its {{resolve:...}} reference(s) unresolved: cdkd cannot confirm the secret still holds the value ${this.displayMasked(logicalId, context)} was deployed with, because its physical id does not contain it. Either the secret changed since then (update ${this.displayMasked(logicalId, context)} so cdkd deploys it with the new value), or the value is not part of its name (a custom resource's Data, a name shorter than four characters), and cdkd sends the recorded reference as before.`);
+		return value;
+	}
+	return await this.reresolveCrossStackValue(value, void 0, context, origin, sourceKey);
+}
+async function referencesMatchPhysicalId(value, logicalId, context) {
+	const record = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
+	const physicalId = typeof record?.physicalId === "string" ? record.physicalId.toLowerCase() : "";
+	for (const leaf of wholeStringLeavesOf(value)) for (const token of dynamicReferenceTokens(leaf)) {
+		const plaintext = await this.resolveDynamicReferences(token, context);
+		if (plaintext.includes("{{resolve:")) continue;
+		if (plaintext.length < 4) return false;
+		if (!physicalId.includes(plaintext.toLowerCase())) return false;
+	}
+	return true;
+}
+function readsAnotherStack(node) {
+	if (Object.hasOwn(node, "Fn::ImportValue") || Object.hasOwn(node, "Fn::GetStackOutput")) return true;
+	if (!Object.hasOwn(node, "Fn::GetAtt")) return false;
+	const getAtt = node["Fn::GetAtt"];
+	const attributeName = typeof getAtt === "string" ? splitGetAttStringForm(getAtt)?.attributeName : Array.isArray(getAtt) ? getAtt[1] : void 0;
+	return typeof attributeName !== "string" || attributeName.startsWith("Outputs.");
+}
+function takenIfBranch(node, context) {
+	if (Array.isArray(node) || !Object.hasOwn(node, "Fn::If")) return void 0;
+	const args = node["Fn::If"];
+	if (!Array.isArray(args) || args.length !== 3 || typeof args[0] !== "string") return void 0;
+	const conditions = context.conditions;
+	if (conditions === void 0 || !Object.hasOwn(conditions, args[0])) return void 0;
+	const verdict = conditions[args[0]];
+	if (typeof verdict !== "boolean") return void 0;
+	return { branch: verdict ? args[1] : args[2] };
+}
+function referencesProvenLocal(value, logicalId, context) {
+	const resources = context.template.Resources ?? {};
+	if (!Object.hasOwn(resources, logicalId)) return false;
+	const literals = [];
+	let crossStack = false;
+	const walk = (node) => {
+		if (typeof node === "string") {
+			if (node.includes("{{resolve:")) literals.push(node);
+			return;
+		}
+		if (node === null || typeof node !== "object") return;
+		if (!Array.isArray(node) && readsAnotherStack(node)) crossStack = true;
+		const taken = takenIfBranch(node, context);
+		if (taken !== void 0) {
+			walk(taken.branch);
+			return;
+		}
+		for (const child of Object.values(node)) walk(child);
+	};
+	walk(resources[logicalId]?.Properties);
+	if (crossStack) return false;
+	return [...wholeStringLeavesOf(value)].every((leaf) => dynamicReferenceTokens(leaf).every((token) => literals.some((l) => l.includes(token))));
+}
 function rejectPlaceholderArnAttribute(resource, attributeName, value, logicalId, context, healOutcome) {
 	if (!isStalePlaceholderArnAttribute(resource.resourceType, attributeName, value)) return;
 	throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: the recorded value ${quotedRender(stringifyValue(this.maskValueLeaves(value, context)), "\"")} is a placeholder written by an older cdkd version — its region and account fields are literal wildcards, so it is not a usable ARN. ` + this.staleRecordRemedy(healOutcome, context)));
@@ -20071,6 +20295,345 @@ function getCfnClient(rawRegion) {
 	return client;
 }
 
+//#endregion
+//#region src/utils/caller-credentials.ts
+const AWS_CREDENTIAL_ENV_KEYS = [
+	"AWS_ACCESS_KEY_ID",
+	"AWS_SECRET_ACCESS_KEY",
+	"AWS_SESSION_TOKEN"
+];
+function readEnvCredentials(source = process.env) {
+	const accessKeyId = source["AWS_ACCESS_KEY_ID"];
+	const secretAccessKey = source["AWS_SECRET_ACCESS_KEY"];
+	if (!accessKeyId || !secretAccessKey) return void 0;
+	const sessionToken = source["AWS_SESSION_TOKEN"];
+	return {
+		accessKeyId,
+		secretAccessKey,
+		...sessionToken ? { sessionToken } : {}
+	};
+}
+function callerEnvCredentials() {
+	if (getAssumedRoleCredentials() === void 0) return readEnvCredentials();
+	return getPreAssumeEnvCredentials();
+}
+function envCredentialsAreAssumedRole() {
+	return getAssumedRoleCredentials() !== void 0;
+}
+function applyCallerIdentityCredentials(env) {
+	if (getAssumedRoleCredentials() === void 0) return;
+	const caller = getPreAssumeEnvCredentials();
+	if (!caller) {
+		for (const key of AWS_CREDENTIAL_ENV_KEYS) delete env[key];
+		return;
+	}
+	env["AWS_ACCESS_KEY_ID"] = caller.accessKeyId;
+	env["AWS_SECRET_ACCESS_KEY"] = caller.secretAccessKey;
+	if (caller.sessionToken) env["AWS_SESSION_TOKEN"] = caller.sessionToken;
+	else delete env["AWS_SESSION_TOKEN"];
+}
+
+//#endregion
+//#region src/utils/role-arn.ts
+const crossAccountCredentialsCache = /* @__PURE__ */ new Map();
+const CRED_EXPIRY_SAFETY_MS = 6e4;
+const IAM_ROLE_ARN_RE = /^arn:(aws[a-z0-9-]*):iam::(\d{12}):role\/[\w+=,.@-]+(?:\/[\w+=,.@-]+)*$/;
+const IAM_ROLE_ARN_MAX_LENGTH = 2048;
+const IAM_ROLE_ARN_SHAPE_RE = /^arn:[A-Za-z0-9-]+:iam::[0-9]+:role\/[!-~]+$/;
+function isIamRoleArn(value) {
+	if (typeof value !== "string") return false;
+	if (value.length > 2048) return false;
+	return IAM_ROLE_ARN_SHAPE_RE.test(value);
+}
+function refusedRoleArnMessage(value) {
+	return `AssumeRole refused: the role ARN is not a well-formed IAM role ARN (expected arn:<partition>:iam::<account>:role/<name>, at most ${IAM_ROLE_ARN_MAX_LENGTH} characters): ${shownRefusedValue(value)}. Nothing was sent to STS.`;
+}
+function shownRefusedValue(value) {
+	if (value === "") return "(empty)";
+	return displayIdent(value, { maxCodePoints: 613 });
+}
+function assertSendableRoleArn(roleArn, makeError = (message) => new Error(message)) {
+	if (typeof roleArn !== "string" || !isIamRoleArn(roleArn)) throw makeError(refusedRoleArnMessage(roleArn));
+}
+function sendableAssumeRoleCommand(input, makeError) {
+	assertSendableRoleArn(input.RoleArn, makeError);
+	return new AssumeRoleCommand(input);
+}
+function explicitRoleArnOrThrow(flag, raw, makeError = (message) => new Error(message)) {
+	const trimmed = raw.trim();
+	if (!isIamRoleArn(trimmed)) throw makeError(`Invalid ${flag} value: ${refusedRoleArnMessage(raw)}`);
+	return trimmed;
+}
+function assertFlagRoleArn(flag, value, makeError = (message) => new Error(message)) {
+	assertSendableRoleArn(value, (message) => makeError(`Invalid ${flag} value: ${message}`));
+}
+function parseIamRoleArn(roleArn) {
+	if (roleArn.length > 2048) return null;
+	const match = IAM_ROLE_ARN_RE.exec(roleArn);
+	if (!match || !match[1] || !match[2]) return null;
+	return {
+		partition: match[1],
+		accountId: match[2]
+	};
+}
+async function assumeRoleForCrossAccountStateRead(roleArn) {
+	const sourceConfig = ambientCredentialConfig();
+	const cacheKey = JSON.stringify([credentialFingerprint(sourceConfig), roleArn]);
+	const cached = crossAccountCredentialsCache.get(cacheKey);
+	if (cached) {
+		const cachedCreds = await cached;
+		if (!cachedCreds.expiration || Date.now() < cachedCreds.expiration.getTime() - CRED_EXPIRY_SAFETY_MS) return cachedCreds;
+		crossAccountCredentialsCache.delete(cacheKey);
+	}
+	const promise = (async () => {
+		const logger = getLogger().child("role-arn");
+		const displayRoleArn = displayIdent(roleArn, { maxCodePoints: 613 });
+		logger.debug(`Assuming role for cross-account state read: ${displayRoleArn}`);
+		assertSendableRoleArn(roleArn);
+		const sts = new STSClient({ ...clientDefaultsFor(sourceConfig) });
+		try {
+			let response;
+			try {
+				response = await sts.send(sendableAssumeRoleCommand({
+					RoleArn: roleArn,
+					RoleSessionName: `cdkd-xacc-${Date.now()}`,
+					DurationSeconds: 3600
+				}));
+			} catch (err) {
+				const message = displayAwsMessage(err instanceof Error ? err.message : String(err));
+				throw new Error(`AssumeRole into ${displayRoleArn} failed: ${message}. If this is a trust-policy issue, the producer's role must allow sts:AssumeRole from the consumer's principal. See https://cdkd.dev/cross-stack-internals/#iam-permissions for the trust-policy setup.`, { cause: err instanceof Error ? err : void 0 });
+			}
+			if (!response.Credentials) throw new Error(`AssumeRole for cross-account Fn::GetStackOutput returned no credentials (RoleArn=${displayRoleArn})`);
+			const { AccessKeyId, SecretAccessKey, SessionToken, Expiration } = response.Credentials;
+			if (!AccessKeyId || !SecretAccessKey || !SessionToken) throw new Error(`AssumeRole response missing required credentials fields for cross-account state read (RoleArn=${displayRoleArn})`);
+			logger.info(`Assumed role for cross-account state read: ${displayRoleArn} (session expires ${Expiration?.toISOString() ?? "unknown"})`);
+			return {
+				accessKeyId: AccessKeyId,
+				secretAccessKey: SecretAccessKey,
+				sessionToken: SessionToken,
+				...Expiration && { expiration: Expiration }
+			};
+		} finally {
+			sts.destroy();
+		}
+	})().catch((err) => {
+		if (crossAccountCredentialsCache.get(cacheKey) === promise) crossAccountCredentialsCache.delete(cacheKey);
+		throw err;
+	});
+	crossAccountCredentialsCache.set(cacheKey, promise);
+	return promise;
+}
+async function applyRoleArnIfSet(opts) {
+	const roleArn = opts.roleArn !== void 0 ? opts.roleArn : process.env["CDKD_ROLE_ARN"] || void 0;
+	if (roleArn === void 0) return;
+	if (getAssumedRoleCredentials() !== void 0) throw new Error(SECOND_ROLE_PUBLISH_REFUSAL);
+	const logger = getLogger().child("role-arn");
+	const displayRoleArn = displayIdent(roleArn, { maxCodePoints: 613 });
+	logger.debug(`Assuming role ${displayRoleArn}...`);
+	assertSendableRoleArn(roleArn);
+	const sts = new STSClient({
+		...awsClientDefaults({ ignoreAssumedRole: true }),
+		...opts.region && { region: opts.region }
+	});
+	try {
+		let response;
+		try {
+			response = await sts.send(sendableAssumeRoleCommand({
+				RoleArn: roleArn,
+				RoleSessionName: `cdkd-${Date.now()}`,
+				DurationSeconds: 3600
+			}));
+		} catch (err) {
+			throw new Error(`AssumeRole for ${displayRoleArn} failed: ${displayAwsMessage(err instanceof Error ? err.message : String(err))}`, { cause: err instanceof Error ? err : void 0 });
+		}
+		if (!response.Credentials) throw new Error(`AssumeRole returned no credentials for role ${displayRoleArn}`);
+		const { AccessKeyId, SecretAccessKey, SessionToken, Expiration } = response.Credentials;
+		if (!AccessKeyId || !SecretAccessKey || !SessionToken) throw new Error(`AssumeRole response missing credentials fields for role ${displayRoleArn}`);
+		setPreAssumeEnvCredentials(readEnvCredentials());
+		process.env["AWS_ACCESS_KEY_ID"] = AccessKeyId;
+		process.env["AWS_SECRET_ACCESS_KEY"] = SecretAccessKey;
+		process.env["AWS_SESSION_TOKEN"] = SessionToken;
+		setAssumedRoleCredentials({
+			accessKeyId: AccessKeyId,
+			secretAccessKey: SecretAccessKey,
+			sessionToken: SessionToken,
+			...Expiration && { expiration: Expiration }
+		});
+		logger.info(`Assumed role ${displayRoleArn} (session expires ${Expiration?.toISOString() ?? "unknown"})`);
+		const selectedProfile = process.env["AWS_PROFILE"];
+		if (selectedProfile !== void 0 && selectedProfile !== "") logger.warn("AWS_PROFILE is set and a role has been assumed. The AWS calls cdkd makes to deploy and read state run as the role. The profile still decides the region, it is what your CDK app resolves during synthesis, and — when you passed `--profile` rather than exporting it — it is the identity a `cdkd local` emulated function or task is given. See https://cdkd.dev/cli-reference/#profile-vs-role-arn");
+	} finally {
+		sts.destroy();
+	}
+}
+
+//#endregion
+//#region src/deployment/intrinsic-resolver/cdk-cross-account-ref.ts
+function producerLookupOver(stacks) {
+	return (stackName, account, region) => stacks.find((s) => s.stackName === stackName && s.account === account && sameRegion(s.region, region));
+}
+const ROLE_NAME = "[\\w+=,.@-]{1,64}";
+const LITERAL_ROLE_ARN_RE = new RegExp(`^arn:aws[a-z0-9-]*:iam::(\\d{12}):role/(${ROLE_NAME})$`);
+const JOIN_TAIL_RE = new RegExp(`^:iam::(\\d{12}):role/(${ROLE_NAME})$`);
+function isExactlyKeyed(value, key) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const keys = Object.keys(value);
+	return keys.length === 1 && keys[0] === key;
+}
+function roleArnShape(raw) {
+	if (typeof raw === "string") {
+		const match = LITERAL_ROLE_ARN_RE.exec(raw);
+		if (!match || !match[1] || !match[2] || !parseIamRoleArn(raw)) return void 0;
+		return {
+			form: "literal",
+			accountId: match[1],
+			roleName: match[2]
+		};
+	}
+	if (!isExactlyKeyed(raw, "Fn::Join")) return void 0;
+	const join = raw["Fn::Join"];
+	if (!Array.isArray(join) || join.length !== 2 || join[0] !== "") return void 0;
+	const parts = join[1];
+	if (!Array.isArray(parts) || parts.length !== 3 || parts[0] !== "arn:") return void 0;
+	const ref = parts[1];
+	if (!isExactlyKeyed(ref, "Ref") || ref["Ref"] !== "AWS::Partition") return void 0;
+	const tail = parts[2];
+	if (typeof tail !== "string") return void 0;
+	const match = JOIN_TAIL_RE.exec(tail);
+	if (!match || !match[1] || !match[2]) return void 0;
+	return {
+		form: "join",
+		accountId: match[1],
+		roleName: match[2]
+	};
+}
+function roleArnOf(shape, region) {
+	const { partition } = derivePartitionAndUrlSuffix(region);
+	return `arn:${partition}:iam::${shape.accountId}:role/${shape.roleName}`;
+}
+const CFN_EXEC_ROLE_PRINCIPAL_RE = /^arn:(?:\$\{AWS::Partition\}|aws[a-z0-9-]*):iam::\d{12}:role\/[^/]*cfn-exec-role[^/]*$/;
+function isCfnExecRolePrincipal(principal) {
+	return isExactlyKeyed(principal, "Fn::Sub") && typeof principal["Fn::Sub"] === "string" && CFN_EXEC_ROLE_PRINCIPAL_RE.test(principal["Fn::Sub"]);
+}
+function trustsOnlyCfnExecRoles(document) {
+	if (document === null || typeof document !== "object" || Array.isArray(document)) return false;
+	const statements = document["Statement"];
+	if (!Array.isArray(statements) || statements.length === 0) return false;
+	for (const statement of statements) {
+		if (statement === null || typeof statement !== "object" || Array.isArray(statement)) return false;
+		const principal = statement["Principal"];
+		if (!isExactlyKeyed(principal, "AWS")) return false;
+		const aws = principal["AWS"];
+		const list = Array.isArray(aws) ? aws : [aws];
+		if (list.length === 0 || !list.every(isCfnExecRolePrincipal)) return false;
+	}
+	return true;
+}
+function isGeneratedReaderRole(template, roleName) {
+	const resources = template.Resources;
+	if (!resources || typeof resources !== "object") return false;
+	for (const resource of Object.values(resources)) {
+		if (resource === null || typeof resource !== "object") continue;
+		const { Type: type, Properties: properties } = resource;
+		if (type !== "AWS::IAM::Role") continue;
+		if (properties === null || typeof properties !== "object") continue;
+		const props = properties;
+		if (props["RoleName"] !== roleName) continue;
+		if (trustsOnlyCfnExecRoles(props["AssumeRolePolicyDocument"])) return true;
+	}
+	return false;
+}
+function producerLookupRoleArn(lookupRoleArn, producerRegion, producerAccount) {
+	if (typeof lookupRoleArn !== "string" || lookupRoleArn === "") return void 0;
+	const { partition } = derivePartitionAndUrlSuffix(producerRegion);
+	const arn = lookupRoleArn.split("${AWS::Partition}").join(partition);
+	const parsed = parseIamRoleArn(arn);
+	if (!parsed || parsed.accountId !== producerAccount) return void 0;
+	return arn;
+}
+function classifyCdkCrossAccountRef(shape, producerStackName, producerRegion, lookup) {
+	if (lookup === void 0) return { kind: "not-generated" };
+	const producer = lookup(producerStackName, shape.accountId, producerRegion);
+	if (!producer) return shape.form === "join" ? {
+		kind: "producer-absent",
+		shape
+	} : { kind: "not-generated" };
+	if (!isGeneratedReaderRole(producer.template, shape.roleName)) return { kind: "not-generated" };
+	return {
+		kind: "generated",
+		shape,
+		lookupRoleArn: producerLookupRoleArn(producer.lookupRoleArn, producerRegion, shape.accountId)
+	};
+}
+function quotedArg(rendered) {
+	return rendered.startsWith("\"") ? rendered : `'${rendered}'`;
+}
+function cdkCrossAccountRefRefusal(parts) {
+	const consumerAccount = parts.consumerAccount !== void 0 && /^\d{12}$/.test(parts.consumerAccount) ? parts.consumerAccount : "<consumer-account>";
+	const reason = parts.reason.replace(/[\s.]+$/, "");
+	const trust = `'cdk bootstrap --trust-for-lookup ${consumerAccount}' (or '--trust ${consumerAccount}')`;
+	const remedyOne = parts.noLookupRole ? `(1) synthesize stack ${parts.producer} with a stack synthesizer that names a lookup role (the default DefaultStackSynthesizer), and in account ${parts.producerAccount} run ${trust} so the identity running cdkd can assume it; or ` : `(1) in account ${parts.producerAccount}, run ${trust} so the identity running cdkd can assume the lookup role; or `;
+	return `Fn::GetStackOutput: cannot read output ${parts.output} of stack ${parts.producer} (region ${parts.region}, account ${parts.producerAccount})${parts.consumer ? ` for stack ${parts.consumer}` : ""}. Its RoleArn names ${parts.roleName}, a role the AWS CDK generates for a cross-account reference that trusts only the consumer account's CloudFormation execution role, which cdkd does not use; cdkd reads the producer's cdkd state through the producer account's CDK lookup role instead, but ${reason}. Fix it one of two ways: ` + remedyOne + `(2) write the reference as cdk.Fn.getStackOutput(${quotedArg(parts.producer)}, ${quotedArg(parts.output)}, ${quotedArg(parts.region)}, '<roleArn>') with a role in account ${parts.producerAccount} that trusts the identity running cdkd and allows s3:GetBucketLocation and s3:GetObject on cdkd-state-${parts.producerAccount}. See https://cdkd.dev/cross-stack-references/#reading-from-another-account`;
+}
+function producerAbsentReason(producerAccount) {
+	return `this producer stack (account ${producerAccount}) is not in this app's cloud assembly, so cdkd can neither confirm the role is the generated one nor find the lookup role`;
+}
+function noLookupRoleReason(producerAccount) {
+	return `the producer stack's artifact names no CDK lookup role in account ${producerAccount} (its stack synthesizer does not use the bootstrap lookup role)`;
+}
+function isLookupRoleDenial(error) {
+	let current = error;
+	for (let depth = 0; depth < 6 && current !== null && typeof current === "object"; depth++) {
+		const name = current.name;
+		if (name === "AccessDenied" || name === "AccessDeniedException" || name === "NoSuchEntity" || name === "NoSuchEntityException") return true;
+		if (current.$metadata?.httpStatusCode === 403) return true;
+		current = current.cause;
+	}
+	return false;
+}
+function describeInnermostAwsError(error) {
+	let innermost = error;
+	for (let depth = 0; depth < 6; depth++) {
+		const cause = innermost !== null && typeof innermost === "object" ? innermost.cause : void 0;
+		if (cause === null || typeof cause !== "object") break;
+		innermost = cause;
+	}
+	if (!(innermost instanceof Error)) return displayAwsMessage(String(innermost));
+	const code = innermost.Code;
+	const name = typeof code === "string" && code !== "" ? code : innermost.name;
+	const message = displayAwsMessage(innermost.message);
+	return name && name !== "Error" ? `${displayIdent(name)}: ${message}` : message;
+}
+function refuseUnreadableCdkCrossAccountRefs(refs, deployed, consumerOf, lookup) {
+	for (const { consumer, args } of refs) {
+		if (!deployed.has(consumer)) continue;
+		const shape = roleArnShape(args["RoleArn"]);
+		if (shape === void 0) continue;
+		const stackName = args["StackName"];
+		const outputName = args["OutputName"];
+		const consumerStack = consumerOf(consumer);
+		const region = args["Region"] ?? consumerStack.region;
+		if (typeof stackName !== "string" || typeof outputName !== "string") continue;
+		if (typeof region !== "string" || region === "") continue;
+		const verdict = classifyCdkCrossAccountRef(shape, stackName, region, lookup);
+		let reason;
+		if (verdict.kind === "producer-absent") reason = producerAbsentReason(shape.accountId);
+		else if (verdict.kind === "generated" && verdict.lookupRoleArn === void 0) reason = noLookupRoleReason(shape.accountId);
+		if (reason === void 0) continue;
+		throw markNonRetryable(new Error(cdkCrossAccountRefRefusal({
+			consumer: displayStackName(consumer),
+			output: displayIdent(outputName),
+			producer: displayStackName(stackName),
+			region: displayIdent(region),
+			producerAccount: shape.accountId,
+			roleName: displayIdent(shape.roleName),
+			consumerAccount: consumerStack.account,
+			reason,
+			noLookupRole: verdict.kind === "generated"
+		})));
+	}
+}
+
 //#endregion
 //#region src/deployment/intrinsic-resolver/stack-output.ts
 async function resolveGetStackOutput(arg, context) {
@@ -20094,10 +20657,29 @@ async function resolveGetStackOutput(arg, context) {
 		loggedRegionText = this.regionLogText(resolvedRegion, context);
 	}
 	let roleArn;
+	let cdkRef;
 	if ("RoleArn" in args && args["RoleArn"] !== void 0 && args["RoleArn"] !== null) {
 		const raw = args["RoleArn"];
-		if (typeof raw !== "string" || raw === "") throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: RoleArn must be a literal string in the template (no Ref / Fn::GetAtt / Fn::Sub allowed for cross-account references). Got ${raw === null ? "null" : Array.isArray(raw) ? "array" : typeof raw}${typeof raw === "object" ? ` (intrinsic shape: ${this.displayMasked(JSON.stringify(raw).slice(0, 80), context)})` : ""}.`));
-		roleArn = raw;
+		const refuseNonLiteral = () => markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: RoleArn must be a literal string in the template (no Ref / Fn::GetAtt / Fn::Sub allowed for cross-account references). Got ${raw === null ? "null" : Array.isArray(raw) ? "array" : typeof raw}${typeof raw === "object" ? ` (intrinsic shape: ${this.displayMasked(JSON.stringify(raw).slice(0, 80), context)})` : ""}.`));
+		const shape = roleArnShape(raw);
+		if ((typeof raw !== "string" || raw === "") && shape === void 0) throw refuseNonLiteral();
+		if (shape !== void 0) {
+			const key = JSON.stringify([
+				shape.form,
+				stackName,
+				shape.accountId,
+				canonicalizeRegion(region),
+				shape.roleName
+			]);
+			let verdict = this.cdkCrossAccountRefVerdicts.get(key);
+			if (verdict === void 0) {
+				verdict = classifyCdkCrossAccountRef(shape, stackName, region, this.producerLookup);
+				this.cdkCrossAccountRefVerdicts.set(key, verdict);
+			}
+			if (verdict.kind === "not-generated" && typeof raw !== "string") throw refuseNonLiteral();
+			if (verdict.kind !== "not-generated") cdkRef = verdict;
+		}
+		roleArn = typeof raw === "string" ? raw : shape && roleArnOf(shape, region);
 	}
 	if (!roleArn && context.stackName && context.stackName === stackName && sameRegion(region, this.resolverRegion)) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: cannot reference own stack ${this.displayMaskedIdent(stackName, context, STACK_REF_MAX_CODE_POINTS)} in the same region ${this.displayMaskedIdent(loggedRegionText, context)}`));
 	const loggedStackName = this.displayMaskedIdent(stackName, context, STACK_REF_MAX_CODE_POINTS);
@@ -20105,11 +20687,35 @@ async function resolveGetStackOutput(arg, context) {
 	const loggedRegion = this.displayMasked(loggedRegionText, context);
 	const shownRoleArn = roleArn ? displayIdent(roleArn, { maxCodePoints: 613 }) : "";
 	this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${shownRoleArn}` : ""}`);
+	let readRoleArn = roleArn;
+	let refuseCdkRead;
+	if (cdkRef !== void 0) {
+		const ref = cdkRef;
+		const producerAccount = ref.shape.accountId;
+		const refuseCdkRef = (reason, cause, noLookupRole = false) => markNonRetryable(new Error(cdkCrossAccountRefRefusal({
+			consumer: context.stackName ? this.displayMaskedIdent(context.stackName, context, STACK_REF_MAX_CODE_POINTS) : void 0,
+			output: loggedOutputName,
+			producer: loggedStackName,
+			region: displayIdent(loggedRegion),
+			producerAccount,
+			roleName: displayIdent(ref.shape.roleName),
+			consumerAccount: this.consumerAccount,
+			reason,
+			noLookupRole
+		}), cause === void 0 ? void 0 : { cause }));
+		if (ref.kind === "producer-absent") throw refuseCdkRef(producerAbsentReason(producerAccount));
+		if (ref.lookupRoleArn === void 0) throw refuseCdkRef(noLookupRoleReason(producerAccount), void 0, true);
+		readRoleArn = ref.lookupRoleArn;
+		const shownLookupRoleArn = displayIdent(readRoleArn, { maxCodePoints: 613 });
+		refuseCdkRead = (error) => refuseCdkRef(`assuming the lookup role ${shownLookupRoleArn} or reading cdkd-state-${producerAccount} with it was denied: ${describeInnermostAwsError(error)}`, error);
+		this.logger.debug(safeMsg`Fn::GetStackOutput: ${shownRoleArn} is the AWS CDK-generated cross-account reader role; reading through the producer account's lookup role ${shownLookupRoleArn}`);
+	}
+	const shownReadRoleArn = readRoleArn === roleArn ? shownRoleArn : displayIdent(readRoleArn, { maxCodePoints: 613 });
 	let stateData;
 	try {
-		stateData = roleArn ? await this.getCrossAccountStackState(roleArn, stackName, region, context) : await this.getSameAccountStackState(stackName, region, context);
+		stateData = readRoleArn ? await this.getCrossAccountStackState(readRoleArn, stackName, region, context) : await this.getSameAccountStackState(stackName, region, context);
 	} catch (error) {
-		this.maskStateReadError(error, [[stackName, this.displayMasked(stackName, context)], [region, loggedRegion]], context);
+		this.maskStateReadError(refuseCdkRead && isLookupRoleDenial(error) ? refuseCdkRead(error) : error, [[stackName, this.displayMasked(stackName, context)], [region, loggedRegion]], context);
 	}
 	if (!stateData) {
 		if (!roleArn && this.cfnFallback) {
@@ -20124,7 +20730,7 @@ async function resolveGetStackOutput(arg, context) {
 				return value;
 			}
 		}
-		throw new Error(`Fn::GetStackOutput: stack ${loggedStackName} not found in region ${displayIdent(loggedRegion)}${roleArn ? ` (cross-account via ${shownRoleArn})` : ""}. ${!roleArn && this.cfnFallback ? "Searched cdkd state and CloudFormation stacks. Make sure the producer stack has been deployed (via cdkd or CloudFormation)." : `Make sure the producer stack has been deployed via cdkd.`}`);
+		throw new Error(`Fn::GetStackOutput: stack ${loggedStackName} not found in region ${displayIdent(loggedRegion)}${roleArn ? ` (cross-account via ${shownReadRoleArn})` : ""}. ${!roleArn && this.cfnFallback ? "Searched cdkd state and CloudFormation stacks. Make sure the producer stack has been deployed (via cdkd or CloudFormation)." : `Make sure the producer stack has been deployed via cdkd.`}`);
 	}
 	if (!hasReadableOutputs(stateData.state)) throw markNonRetryable(new MalformedProducerRecordRefusalError(`Fn::GetStackOutput: the state record of producer stack ${loggedStackName} (${displayIdent(loggedRegion)}) has no readable 'outputs' map — the record is malformed or truncated. cdkd refuses to resolve from it rather than reading it as a map: 'Object.hasOwn' answers TRUE for '0' on a string and for an index on a list, so continuing would resolve ONE CHARACTER or element of the record as this reference's value and this deploy would send it to AWS. Inspect the producer's record with 'cdkd state show' --json, repair or remove it, then re-run.`));
 	const outputs = stateData.state.outputs ?? {};
@@ -20135,7 +20741,7 @@ async function resolveGetStackOutput(arg, context) {
 	const value = outputs[outputName];
 	this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${shownRoleArn}` : ""} (${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
 	if (!roleArn) this.recordOutputRead(context, stackName, region, outputName);
-	if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new CrossAccountSecretRefusalError(`Fn::GetStackOutput: output ${loggedOutputName} of stack ${loggedStackName} (${displayIdent(loggedRegion)}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${shownRoleArn}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
+	if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new CrossAccountSecretRefusalError(`Fn::GetStackOutput: output ${loggedOutputName} of stack ${loggedStackName} (${displayIdent(loggedRegion)}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${shownRoleArn}${readRoleArn !== roleArn ? `, read through the producer account's CDK lookup role ${shownReadRoleArn}` : ""}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
 	return await this.reresolveCrossStackValue(value, region, context, `Fn::GetStackOutput ${quotedRender(this.displayLeaf(outputName, context), "'")} (producer ${this.displayLeaf(stackName, context)} / ${this.displayLeaf(loggedRegionText, context)})`, sourceKey, {
 		stackName,
 		region,
@@ -20208,178 +20814,6 @@ function namedRequestMasks(pairs, context) {
 	};
 }
 
-//#endregion
-//#region src/utils/caller-credentials.ts
-const AWS_CREDENTIAL_ENV_KEYS = [
-	"AWS_ACCESS_KEY_ID",
-	"AWS_SECRET_ACCESS_KEY",
-	"AWS_SESSION_TOKEN"
-];
-function readEnvCredentials(source = process.env) {
-	const accessKeyId = source["AWS_ACCESS_KEY_ID"];
-	const secretAccessKey = source["AWS_SECRET_ACCESS_KEY"];
-	if (!accessKeyId || !secretAccessKey) return void 0;
-	const sessionToken = source["AWS_SESSION_TOKEN"];
-	return {
-		accessKeyId,
-		secretAccessKey,
-		...sessionToken ? { sessionToken } : {}
-	};
-}
-function callerEnvCredentials() {
-	if (getAssumedRoleCredentials() === void 0) return readEnvCredentials();
-	return getPreAssumeEnvCredentials();
-}
-function envCredentialsAreAssumedRole() {
-	return getAssumedRoleCredentials() !== void 0;
-}
-function applyCallerIdentityCredentials(env) {
-	if (getAssumedRoleCredentials() === void 0) return;
-	const caller = getPreAssumeEnvCredentials();
-	if (!caller) {
-		for (const key of AWS_CREDENTIAL_ENV_KEYS) delete env[key];
-		return;
-	}
-	env["AWS_ACCESS_KEY_ID"] = caller.accessKeyId;
-	env["AWS_SECRET_ACCESS_KEY"] = caller.secretAccessKey;
-	if (caller.sessionToken) env["AWS_SESSION_TOKEN"] = caller.sessionToken;
-	else delete env["AWS_SESSION_TOKEN"];
-}
-
-//#endregion
-//#region src/utils/role-arn.ts
-const crossAccountCredentialsCache = /* @__PURE__ */ new Map();
-const CRED_EXPIRY_SAFETY_MS = 6e4;
-const IAM_ROLE_ARN_RE = /^arn:(aws[a-z0-9-]*):iam::(\d{12}):role\/[\w+=,.@-]+(?:\/[\w+=,.@-]+)*$/;
-const IAM_ROLE_ARN_MAX_LENGTH = 2048;
-const IAM_ROLE_ARN_SHAPE_RE = /^arn:[A-Za-z0-9-]+:iam::[0-9]+:role\/[!-~]+$/;
-function isIamRoleArn(value) {
-	if (typeof value !== "string") return false;
-	if (value.length > 2048) return false;
-	return IAM_ROLE_ARN_SHAPE_RE.test(value);
-}
-function refusedRoleArnMessage(value) {
-	return `AssumeRole refused: the role ARN is not a well-formed IAM role ARN (expected arn:<partition>:iam::<account>:role/<name>, at most ${IAM_ROLE_ARN_MAX_LENGTH} characters): ${shownRefusedValue(value)}. Nothing was sent to STS.`;
-}
-function shownRefusedValue(value) {
-	if (value === "") return "(empty)";
-	return displayIdent(value, { maxCodePoints: 613 });
-}
-function assertSendableRoleArn(roleArn, makeError = (message) => new Error(message)) {
-	if (typeof roleArn !== "string" || !isIamRoleArn(roleArn)) throw makeError(refusedRoleArnMessage(roleArn));
-}
-function sendableAssumeRoleCommand(input, makeError) {
-	assertSendableRoleArn(input.RoleArn, makeError);
-	return new AssumeRoleCommand(input);
-}
-function explicitRoleArnOrThrow(flag, raw, makeError = (message) => new Error(message)) {
-	const trimmed = raw.trim();
-	if (!isIamRoleArn(trimmed)) throw makeError(`Invalid ${flag} value: ${refusedRoleArnMessage(raw)}`);
-	return trimmed;
-}
-function assertFlagRoleArn(flag, value, makeError = (message) => new Error(message)) {
-	assertSendableRoleArn(value, (message) => makeError(`Invalid ${flag} value: ${message}`));
-}
-function parseIamRoleArn(roleArn) {
-	if (roleArn.length > 2048) return null;
-	const match = IAM_ROLE_ARN_RE.exec(roleArn);
-	if (!match || !match[1] || !match[2]) return null;
-	return {
-		partition: match[1],
-		accountId: match[2]
-	};
-}
-async function assumeRoleForCrossAccountStateRead(roleArn) {
-	const sourceConfig = ambientCredentialConfig();
-	const cacheKey = JSON.stringify([credentialFingerprint(sourceConfig), roleArn]);
-	const cached = crossAccountCredentialsCache.get(cacheKey);
-	if (cached) {
-		const cachedCreds = await cached;
-		if (!cachedCreds.expiration || Date.now() < cachedCreds.expiration.getTime() - CRED_EXPIRY_SAFETY_MS) return cachedCreds;
-		crossAccountCredentialsCache.delete(cacheKey);
-	}
-	const promise = (async () => {
-		const logger = getLogger().child("role-arn");
-		const displayRoleArn = displayIdent(roleArn, { maxCodePoints: 613 });
-		logger.debug(`Assuming role for cross-account state read: ${displayRoleArn}`);
-		assertSendableRoleArn(roleArn);
-		const sts = new STSClient({ ...clientDefaultsFor(sourceConfig) });
-		try {
-			let response;
-			try {
-				response = await sts.send(sendableAssumeRoleCommand({
-					RoleArn: roleArn,
-					RoleSessionName: `cdkd-xacc-${Date.now()}`,
-					DurationSeconds: 3600
-				}));
-			} catch (err) {
-				const message = displayAwsMessage(err instanceof Error ? err.message : String(err));
-				throw new Error(`AssumeRole into ${displayRoleArn} failed: ${message}. If this is a trust-policy issue, the producer's role must allow sts:AssumeRole from the consumer's principal. See https://cdkd.dev/cross-stack-internals/#iam-permissions for the trust-policy setup.`, { cause: err instanceof Error ? err : void 0 });
-			}
-			if (!response.Credentials) throw new Error(`AssumeRole for cross-account Fn::GetStackOutput returned no credentials (RoleArn=${displayRoleArn})`);
-			const { AccessKeyId, SecretAccessKey, SessionToken, Expiration } = response.Credentials;
-			if (!AccessKeyId || !SecretAccessKey || !SessionToken) throw new Error(`AssumeRole response missing required credentials fields for cross-account state read (RoleArn=${displayRoleArn})`);
-			logger.info(`Assumed role for cross-account state read: ${displayRoleArn} (session expires ${Expiration?.toISOString() ?? "unknown"})`);
-			return {
-				accessKeyId: AccessKeyId,
-				secretAccessKey: SecretAccessKey,
-				sessionToken: SessionToken,
-				...Expiration && { expiration: Expiration }
-			};
-		} finally {
-			sts.destroy();
-		}
-	})().catch((err) => {
-		if (crossAccountCredentialsCache.get(cacheKey) === promise) crossAccountCredentialsCache.delete(cacheKey);
-		throw err;
-	});
-	crossAccountCredentialsCache.set(cacheKey, promise);
-	return promise;
-}
-async function applyRoleArnIfSet(opts) {
-	const roleArn = opts.roleArn !== void 0 ? opts.roleArn : process.env["CDKD_ROLE_ARN"] || void 0;
-	if (roleArn === void 0) return;
-	if (getAssumedRoleCredentials() !== void 0) throw new Error(SECOND_ROLE_PUBLISH_REFUSAL);
-	const logger = getLogger().child("role-arn");
-	const displayRoleArn = displayIdent(roleArn, { maxCodePoints: 613 });
-	logger.debug(`Assuming role ${displayRoleArn}...`);
-	assertSendableRoleArn(roleArn);
-	const sts = new STSClient({
-		...awsClientDefaults({ ignoreAssumedRole: true }),
-		...opts.region && { region: opts.region }
-	});
-	try {
-		let response;
-		try {
-			response = await sts.send(sendableAssumeRoleCommand({
-				RoleArn: roleArn,
-				RoleSessionName: `cdkd-${Date.now()}`,
-				DurationSeconds: 3600
-			}));
-		} catch (err) {
-			throw new Error(`AssumeRole for ${displayRoleArn} failed: ${displayAwsMessage(err instanceof Error ? err.message : String(err))}`, { cause: err instanceof Error ? err : void 0 });
-		}
-		if (!response.Credentials) throw new Error(`AssumeRole returned no credentials for role ${displayRoleArn}`);
-		const { AccessKeyId, SecretAccessKey, SessionToken, Expiration } = response.Credentials;
-		if (!AccessKeyId || !SecretAccessKey || !SessionToken) throw new Error(`AssumeRole response missing credentials fields for role ${displayRoleArn}`);
-		setPreAssumeEnvCredentials(readEnvCredentials());
-		process.env["AWS_ACCESS_KEY_ID"] = AccessKeyId;
-		process.env["AWS_SECRET_ACCESS_KEY"] = SecretAccessKey;
-		process.env["AWS_SESSION_TOKEN"] = SessionToken;
-		setAssumedRoleCredentials({
-			accessKeyId: AccessKeyId,
-			secretAccessKey: SecretAccessKey,
-			sessionToken: SessionToken,
-			...Expiration && { expiration: Expiration }
-		});
-		logger.info(`Assumed role ${displayRoleArn} (session expires ${Expiration?.toISOString() ?? "unknown"})`);
-		const selectedProfile = process.env["AWS_PROFILE"];
-		if (selectedProfile !== void 0 && selectedProfile !== "") logger.warn("AWS_PROFILE is set and a role has been assumed. The AWS calls cdkd makes to deploy and read state run as the role. The profile still decides the region, it is what your CDK app resolves during synthesis, and — when you passed `--profile` rather than exporting it — it is the identity a `cdkd local` emulated function or task is given. See https://cdkd.dev/cli-reference/#profile-vs-role-arn");
-	} finally {
-		sts.destroy();
-	}
-}
-
 //#endregion
 //#region src/deployment/intrinsic-resolver/stack-state.ts
 async function getSameAccountStackState(stackName, region, context) {
@@ -21857,8 +22291,9 @@ function recordInheritedNoEchoListElements(resolver, inherited, recorded, value,
 }
 function recordNoEchoParameterValue(paramDef, value, context) {
 	const bag = context.recordedSecretValues;
-	if (paramDef?.NoEcho !== true || bag === void 0) return;
+	if (!declaresNoEcho(paramDef) || bag === void 0) return;
 	recordLogOnlyParameterValue(bag, value);
+	if (paramDef?.NoEcho !== true) return;
 	recordNoEchoParameterFreshValue(value, bag, this.publicNoEchoTokens(context));
 }
 function refuseCoercedInheritedSecret(name, paramDef, userValue, inherited) {
@@ -21896,6 +22331,7 @@ function lookupResourceRecord(logicalId, via, context) {
 		const loggedId = this.displayMasked(logicalId, context);
 		throw markNonRetryable(new IntrinsicResolutionRefusalError(`${via} ${loggedId}: ${isObject ? `the state record's physical id is ${physicalId === null ? "null" : typeof physicalId}, not a string` : `the state record is ${Array.isArray(resource) ? "an array" : typeof resource}, not an object`}. cdkd always records an object with a string id, so this record was edited by hand or written by another tool. ${isObject ? `Set the resource's "physicalId" in the stack's state.json back to the id AWS knows the resource by.` : `Restore the resource's record in the stack's state.json, or remove it and re-import the resource.`}`, void 0, "STATE_PHYSICAL_ID_NOT_STRING"));
 	}
+	if (context.recordedSecretValues !== void 0) recordPhysicalNameCopy(context.recordedSecretValues, physicalId);
 	return resource;
 }
 async function resolveRef(logicalId, context, onParameter) {
@@ -21904,7 +22340,7 @@ async function resolveRef(logicalId, context, onParameter) {
 		const refValue = this.resolveRefValue(logicalId, resource, context);
 		recordSecretNamedRead(logicalId, refValue, context);
 		this.logger.debug(`Resolved Ref to resource: ${this.logRender(logicalId, context)} resolved to ${this.logRender(String(refValue), context)}`);
-		return refValue;
+		return await this.reresolveRecordedReferences(refValue, logicalId, context, `Ref ${logicalId}`, void 0);
 	}
 	if (context.parameters && Object.hasOwn(context.parameters, logicalId)) {
 		const value = context.parameters[logicalId];
@@ -21914,7 +22350,7 @@ async function resolveRef(logicalId, context, onParameter) {
 		this.recordInheritedParameterSecrets(logicalId, value, context);
 		this.logger.debug(`Resolved Ref to parameter: ${this.logRender(logicalId, context)} resolved to ${this.logRender(stringifyParameterForLog(paramDef, this.maskValueLeaves(value, context)), context, {
 			structured: isStructured(value),
-			redacted: paramDef?.NoEcho === true
+			redacted: declaresNoEcho(paramDef)
 		})}`);
 		onParameter?.();
 		return value;
@@ -21996,6 +22432,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	explicitRegionLogText;
 	strictGetAtt;
 	cfnFallback;
+	producerLookup;
+	consumerAccount;
+	cdkCrossAccountRefVerdicts = /* @__PURE__ */ new Map();
 	cfnClients = /* @__PURE__ */ new Map();
 	cfnExportsPromises = /* @__PURE__ */ new Map();
 	cfnStackOutputsCache = /* @__PURE__ */ new Map();
@@ -22007,6 +22446,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		this.explicitRegion = region || void 0;
 		this.strictGetAtt = options?.strictGetAtt ?? false;
 		this.cfnFallback = options?.cfnFallback ?? true;
+		this.producerLookup = options?.producerLookup;
+		this.consumerAccount = options?.consumerAccount;
 	}
 	getPhysicalIdFallbackCount() {
 		return this.physicalIdFallbackCount;
@@ -22201,6 +22642,8 @@ IntrinsicFunctionResolver.prototype.pushRedactedAttributeRead = pushRedactedAttr
 IntrinsicFunctionResolver.prototype.resolveGetAtt = resolveGetAtt;
 IntrinsicFunctionResolver.prototype.publicNoEchoTokens = publicNoEchoTokens;
 IntrinsicFunctionResolver.prototype.noteAttributeSecrecy = noteAttributeSecrecy;
+IntrinsicFunctionResolver.prototype.reresolveRecordedReferences = reresolveRecordedReferences;
+IntrinsicFunctionResolver.prototype.referencesMatchPhysicalId = referencesMatchPhysicalId;
 IntrinsicFunctionResolver.prototype.rejectPlaceholderArnAttribute = rejectPlaceholderArnAttribute;
 IntrinsicFunctionResolver.prototype.staleRecordRemedy = staleRecordRemedy;
 IntrinsicFunctionResolver.prototype.unenrichedRemedy = unenrichedRemedy;
@@ -23028,6 +23471,511 @@ function deleteIndeterminateGuards(result) {
 	return out;
 }
 
+//#endregion
+//#region src/deployment/inline-policy-claims.ts
+function isInlinePolicyClaimedByCompletedWriter(args, kind, principal, policyName) {
+	const { selfLogicalId, writers, changes, stateResources } = args;
+	for (const [lid, write] of writers) {
+		if (lid === selfLogicalId || !Object.hasOwn(stateResources, lid)) continue;
+		const record = stateResources[lid];
+		const standalone = standaloneInlinePolicyOf(record.resourceType, record.properties);
+		if (standalone !== void 0) {
+			if (standalone.kind === kind && sameIamName(standalone.principal, principal) && sameIamName(standalone.policyName, policyName)) return true;
+			continue;
+		}
+		if (record.provisionedBy === "cc-api") continue;
+		const props = record.properties ?? {};
+		if (record.resourceType === "AWS::IAM::Policy") {
+			if (!sameIamName(record.physicalId, policyName)) continue;
+			const listed = props[POLICY_LIST_FIELDS[kind]];
+			if (Array.isArray(listed) && listed.some((p) => sameIamName(p, principal))) return true;
+			continue;
+		}
+		if (!Object.hasOwn(PRINCIPAL_KINDS, record.resourceType)) continue;
+		if (PRINCIPAL_KINDS[record.resourceType] !== kind) continue;
+		if (!sameIamName(record.physicalId, principal)) continue;
+		if (write !== "create" && !ownPoliciesChange(changes.get(lid))) continue;
+		const policies = props["Policies"];
+		if (!Array.isArray(policies)) continue;
+		if (policies.some((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) && sameIamName(entry["PolicyName"], policyName))) return true;
+	}
+	return false;
+}
+var RollbackInlinePolicyWriters = class {
+	entries = /* @__PURE__ */ new Map();
+	removals = /* @__PURE__ */ new Map();
+	unsettled = /* @__PURE__ */ new Map();
+	notePending(ops) {
+		for (const op of ops) if (!this.unsettled.has(op)) this.unsettled.set(op, {
+			logicalId: op.logicalId,
+			state: "pending"
+		});
+	}
+	noteOutcome(op, completed) {
+		if (!completed) {
+			this.unsettled.set(op, {
+				logicalId: op.logicalId,
+				state: "failed"
+			});
+			return;
+		}
+		for (const [key, entry] of this.unsettled) if (key === op || entry.logicalId === op.logicalId) this.unsettled.delete(key);
+	}
+	record(logicalId, write, record, policiesChanged, via) {
+		if (via === "cc-api" && !isStandaloneInlinePolicyType(record.resourceType)) {
+			this.entries.delete(logicalId);
+			return;
+		}
+		this.entries.set(logicalId, {
+			write,
+			record,
+			policiesChanged
+		});
+	}
+	claimedFor(resourceType, logicalId, stateResources) {
+		if (resourceType !== "AWS::IAM::Policy" && !Object.hasOwn(PRINCIPAL_KINDS, resourceType) && !isStandaloneInlinePolicyType(resourceType)) return;
+		return (kind, principal, policyName) => {
+			const writers = /* @__PURE__ */ new Map();
+			const changes = /* @__PURE__ */ new Map();
+			for (const [lid, entry] of this.entries) {
+				if (!Object.hasOwn(stateResources, lid) || stateResources[lid] !== entry.record) continue;
+				writers.set(lid, entry.write);
+				if (entry.policiesChanged) changes.set(lid, {
+					logicalId: lid,
+					changeType: "UPDATE",
+					resourceType: entry.record.resourceType,
+					propertyChanges: [{
+						path: "Policies",
+						oldValue: void 0,
+						newValue: void 0,
+						requiresReplacement: false
+					}]
+				});
+			}
+			const claimed = isInlinePolicyClaimedByCompletedWriter({
+				selfLogicalId: logicalId,
+				writers,
+				changes,
+				stateResources
+			}, kind, principal, policyName);
+			if (!claimed) {
+				const key = removalKey(kind, principal, policyName);
+				const noted = this.removals.get(key) ?? {
+					kind,
+					principal,
+					policyName,
+					removers: /* @__PURE__ */ new Map()
+				};
+				noted.removers.set(logicalId, stateResources[logicalId]);
+				this.removals.set(key, noted);
+			}
+			return claimed;
+		};
+	}
+	takeHeldRemovals(stateResources) {
+		const held = [];
+		for (const [key, { kind, principal, policyName, removers }] of this.removals) {
+			const { holders, unreadable } = inlinePolicyHolders(stateResources, kind, principal, policyName);
+			const others = holders.filter((h) => !removers.has(h.logicalId) || stateResources[h.logicalId] !== removers.get(h.logicalId));
+			if (others.length === 0) continue;
+			this.removals.delete(key);
+			const open = new Set([...this.unsettled.values()].map((u) => u.logicalId));
+			const unsettled = [...new Set(others.map((h) => h.logicalId))].filter((id) => open.has(id));
+			held.push({
+				kind,
+				holders: others,
+				unreadable,
+				unsettled
+			});
+		}
+		return held;
+	}
+};
+function inlinePolicyHolders(stateResources, kind, principal, policyName) {
+	const holders = [];
+	const unreadable = [];
+	const unnamed = (v) => typeof v !== "string" || !IAM_NAME.test(v);
+	for (const [logicalId, record] of Object.entries(stateResources)) {
+		if (record === null || typeof record !== "object") continue;
+		const props = record.properties ?? {};
+		const standalone = standaloneInlinePolicyOf(record.resourceType, props);
+		if (standalone !== void 0) {
+			if (standalone.kind !== kind) continue;
+			const principalMatches = sameIamName(standalone.principal, principal);
+			const nameMatches = sameIamName(standalone.policyName, policyName);
+			if (principalMatches && nameMatches) holders.push({
+				logicalId,
+				principal: standalone.principal,
+				policyName: standalone.policyName,
+				document: props["PolicyDocument"]
+			});
+			else if ((principalMatches || unnamed(standalone.principal)) && (nameMatches || unnamed(standalone.policyName))) unreadable.push(logicalId);
+			continue;
+		}
+		if (record.resourceType === "AWS::IAM::Policy") {
+			const nameMatches = sameIamName(record.physicalId, policyName);
+			if (!nameMatches && !unnamed(record.physicalId)) continue;
+			const listed = props[POLICY_LIST_FIELDS[kind]];
+			const entries = Array.isArray(listed) ? listed : [];
+			const named = entries.find((p) => sameIamName(p, principal));
+			if (nameMatches && typeof named === "string") holders.push({
+				logicalId,
+				principal: named,
+				policyName: record.physicalId,
+				document: props["PolicyDocument"]
+			});
+			else if (named !== void 0 || entries.some(unnamed)) unreadable.push(logicalId);
+			continue;
+		}
+		if (!Object.hasOwn(PRINCIPAL_KINDS, record.resourceType)) continue;
+		if (PRINCIPAL_KINDS[record.resourceType] !== kind) continue;
+		const principalMatches = sameIamName(record.physicalId, principal);
+		if (!principalMatches && !unnamed(record.physicalId)) continue;
+		const policies = props["Policies"];
+		if (!Array.isArray(policies)) continue;
+		for (const entry of policies) {
+			if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+			const name = entry["PolicyName"];
+			if (principalMatches && sameIamName(name, policyName)) holders.push({
+				logicalId,
+				principal: record.physicalId,
+				policyName: name,
+				document: entry["PolicyDocument"]
+			});
+			else if (unnamed(name) || sameIamName(name, policyName)) unreadable.push(logicalId);
+		}
+	}
+	return {
+		holders,
+		unreadable: [...new Set(unreadable)]
+	};
+}
+function sameIamName(a, b) {
+	return typeof a === "string" && IAM_NAME.test(a) && a.toLowerCase() === b.toLowerCase();
+}
+function removalKey(kind, principal, policyName) {
+	return JSON.stringify([
+		kind,
+		principal.toLowerCase(),
+		policyName.toLowerCase()
+	]);
+}
+const IAM_NAME = /^[\w+=,.@-]+$/;
+const POLICY_LIST_FIELDS = {
+	role: "Roles",
+	group: "Groups",
+	user: "Users"
+};
+const PRINCIPAL_KINDS = {
+	"AWS::IAM::Role": "role",
+	"AWS::IAM::Group": "group",
+	"AWS::IAM::User": "user"
+};
+const STANDALONE_POLICY_KINDS = {
+	"AWS::IAM::RolePolicy": "role",
+	"AWS::IAM::GroupPolicy": "group",
+	"AWS::IAM::UserPolicy": "user"
+};
+function isStandaloneInlinePolicyType(resourceType) {
+	return Object.hasOwn(STANDALONE_POLICY_KINDS, resourceType);
+}
+function standaloneInlinePolicyOf(resourceType, properties) {
+	if (!isStandaloneInlinePolicyType(resourceType)) return void 0;
+	const kind = STANDALONE_POLICY_KINDS[resourceType];
+	const props = properties ?? {};
+	return {
+		kind,
+		principal: props[PRINCIPAL_NAME_FIELDS[kind]],
+		policyName: props["PolicyName"]
+	};
+}
+function standaloneInlinePolicyHandedOff(resourceType, properties, claimed, physicalId) {
+	if (claimed === void 0) return false;
+	const target = standaloneInlinePolicyOf(resourceType, properties);
+	if (target === void 0) return false;
+	const { kind, principal, policyName } = target;
+	if (typeof principal !== "string" || !IAM_NAME.test(principal)) return false;
+	if (typeof policyName !== "string" || !IAM_NAME.test(policyName)) return false;
+	if (physicalId !== void 0 && physicalId.toLowerCase() !== `${policyName}|${principal}`.toLowerCase()) return false;
+	return claimed(kind, principal, policyName) === true;
+}
+function isInlinePolicyPrincipalType(resourceType) {
+	return Object.hasOwn(PRINCIPAL_KINDS, resourceType);
+}
+function principalKindOf(resourceType) {
+	return Object.hasOwn(PRINCIPAL_KINDS, resourceType) ? PRINCIPAL_KINDS[resourceType] : void 0;
+}
+const ANY = "*";
+const PRINCIPAL_NAME_FIELDS = {
+	role: "RoleName",
+	group: "GroupName",
+	user: "UserName"
+};
+function nameKey(value) {
+	return typeof value === "string" && IAM_NAME.test(value) ? value.toLowerCase() : ANY;
+}
+function templatePrincipalKeys(entry, kind, templateResources, stateResources) {
+	if (typeof entry === "string") return [nameKey(entry)];
+	const ref = typeof entry === "object" && entry !== null && !Array.isArray(entry) ? entry["Ref"] : void 0;
+	if (typeof ref !== "string" || !Object.hasOwn(templateResources, ref)) return [ANY];
+	const target = templateResources[ref];
+	if (principalKindOf(target.Type) !== kind) return [ANY];
+	return principalSelfKeys(ref, kind, target, stateResources);
+}
+function principalSelfKeys(logicalId, kind, template, stateResources) {
+	const keys = [`ref:${logicalId}`];
+	const declared = template?.Properties?.[PRINCIPAL_NAME_FIELDS[kind]];
+	const declaredKey = nameKey(declared);
+	if (declaredKey !== ANY) keys.push(declaredKey);
+	const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+	if (record !== void 0 && principalKindOf(record.resourceType) === kind) {
+		const recordedKey = nameKey(record.physicalId);
+		if (recordedKey !== ANY) keys.push(recordedKey);
+	}
+	return keys;
+}
+function policiesNames(policies) {
+	if (policies === void 0 || policies === null) return [];
+	if (!Array.isArray(policies)) return [ANY];
+	return policies.map((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) ? nameKey(entry["PolicyName"]) : ANY);
+}
+function standaloneClaimSides(logicalId, change, templateResources, stateResources) {
+	const template = Object.hasOwn(templateResources, logicalId) ? templateResources[logicalId] : void 0;
+	const desired = standaloneInlinePolicyOf(change.resourceType, template?.Properties ?? {});
+	if (desired === void 0) return void 0;
+	const { kind } = desired;
+	const name = nameKey(desired.policyName);
+	const sides = {
+		desired: templatePrincipalKeys(desired.principal, kind, templateResources, stateResources).map((principal) => ({
+			kind,
+			principal,
+			name
+		})),
+		old: []
+	};
+	const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+	if (record?.resourceType === change.resourceType) {
+		const old = standaloneInlinePolicyOf(change.resourceType, record.properties);
+		sides.old.push({
+			kind,
+			principal: nameKey(old.principal),
+			name: nameKey(old.policyName)
+		});
+	}
+	return sides;
+}
+function inlinePolicyClaimsOf(logicalId, change, templateResources, stateResources) {
+	const template = Object.hasOwn(templateResources, logicalId) ? templateResources[logicalId] : void 0;
+	const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+	const recorded = record?.resourceType === change.resourceType ? record : void 0;
+	const claims = [];
+	const cross = (kind, principals, names) => {
+		for (const principal of new Set(principals)) for (const name of new Set(names)) claims.push({
+			kind,
+			principal,
+			name
+		});
+	};
+	const standalone = standaloneClaimSides(logicalId, change, templateResources, stateResources);
+	if (standalone !== void 0) return [...standalone.desired, ...standalone.old];
+	if (change.resourceType === "AWS::IAM::Policy") {
+		const desired = template?.Properties ?? {};
+		const old = recorded?.properties ?? {};
+		const names = [];
+		if (desired["PolicyName"] !== void 0) names.push(nameKey(desired["PolicyName"]));
+		if (old["PolicyName"] !== void 0) names.push(nameKey(old["PolicyName"]));
+		if (recorded !== void 0) names.push(nameKey(typeof recorded.physicalId === "string" ? recorded.physicalId.split(":")[0] : recorded.physicalId));
+		if (names.length === 0) return claims;
+		for (const kind of [
+			"role",
+			"group",
+			"user"
+		]) {
+			const field = POLICY_LIST_FIELDS[kind];
+			const principals = [];
+			const listed = desired[field];
+			if (Array.isArray(listed)) for (const entry of listed) principals.push(...templatePrincipalKeys(entry, kind, templateResources, stateResources));
+			else if (listed !== void 0) principals.push(ANY);
+			const held = old[field];
+			if (Array.isArray(held)) principals.push(...held.map(nameKey));
+			else if (held !== void 0 && held !== null) principals.push(ANY);
+			cross(kind, principals, names);
+		}
+		return claims;
+	}
+	const kind = principalKindOf(change.resourceType);
+	if (kind === void 0) return claims;
+	if (!(change.changeType === "CREATE" || (change.propertyChanges ?? []).some((c) => c.requiresReplacement) || ownPoliciesChange(change))) return claims;
+	cross(kind, principalSelfKeys(logicalId, kind, template, stateResources), [...policiesNames(template?.Properties?.["Policies"]), ...policiesNames(recorded?.properties?.["Policies"])]);
+	return claims;
+}
+function orderInlinePolicyWriters(args) {
+	const { writes, changes, templateResources, stateResources, dependencies, rank } = args;
+	const writers = writes.filter((id) => {
+		const type = changes.get(id)?.resourceType;
+		return type === "AWS::IAM::Policy" || type !== void 0 && (isInlinePolicyPrincipalType(type) || isStandaloneInlinePolicyType(type));
+	});
+	if (writers.length < 2) return [];
+	const exact = /* @__PURE__ */ new Map();
+	const loose = [];
+	const all = [];
+	for (const id of writers) for (const claim of inlinePolicyClaimsOf(id, changes.get(id), templateResources, stateResources)) {
+		all.push({
+			id,
+			claim
+		});
+		if (claim.principal === ANY || claim.name === ANY) {
+			loose.push({
+				id,
+				claim
+			});
+			continue;
+		}
+		const key = JSON.stringify([
+			claim.kind,
+			claim.principal,
+			claim.name
+		]);
+		const ids = exact.get(key) ?? /* @__PURE__ */ new Set();
+		ids.add(id);
+		exact.set(key, ids);
+	}
+	const principalRows = new Set(writers.filter((id) => isInlinePolicyPrincipalType(changes.get(id).resourceType)));
+	const standaloneRows = new Set(writers.filter((id) => isStandaloneInlinePolicyType(changes.get(id).resourceType)));
+	const sides = new Map([...standaloneRows].map((id) => [id, standaloneClaimSides(id, changes.get(id), templateResources, stateResources)]));
+	const sameClaim = (p, q) => p.kind === q.kind && (p.principal === ANY || q.principal === ANY || p.principal === q.principal) && (p.name === ANY || q.name === ANY || p.name === q.name);
+	const releasesFor = (a, b) => sides.get(a).old.some((o) => sides.get(b).desired.some((d) => sameClaim(o, d)));
+	const pairs = /* @__PURE__ */ new Map();
+	const pair = (a, b) => {
+		if (a === b || principalRows.has(a) && principalRows.has(b)) return;
+		const sa = standaloneRows.has(a);
+		const sb = standaloneRows.has(b);
+		let first;
+		if (sa !== sb) first = sa ? b : a;
+		else if (sa && sb) {
+			const aReleases = releasesFor(a, b);
+			if (aReleases !== releasesFor(b, a)) first = aReleases ? a : b;
+		}
+		first ??= rank(a) < rank(b) || rank(a) === rank(b) && a < b ? a : b;
+		const [x, y] = first === a ? [a, b] : [b, a];
+		pairs.set(JSON.stringify([x, y]), [x, y]);
+	};
+	for (const ids of exact.values()) {
+		const list = [...ids];
+		for (let i = 0; i < list.length; i++) for (let j = i + 1; j < list.length; j++) pair(list[i], list[j]);
+	}
+	const meets = (a, b) => a === ANY || b === ANY || a === b;
+	for (const { id, claim } of loose) for (const other of all) {
+		if (other.claim.kind !== claim.kind) continue;
+		if (meets(claim.principal, other.claim.principal) && meets(claim.name, other.claim.name)) pair(id, other.id);
+	}
+	if (pairs.size === 0) return [];
+	const reaches = (from, to) => {
+		const seen = /* @__PURE__ */ new Set();
+		const stack = [from];
+		while (stack.length > 0) {
+			const id = stack.pop();
+			if (id === to) return true;
+			if (seen.has(id)) continue;
+			seen.add(id);
+			for (const dep of dependencies.get(id) ?? []) stack.push(dep);
+		}
+		return false;
+	};
+	const added = [];
+	for (const [before, after] of pairs.values()) {
+		if (reaches(after, before) || reaches(before, after)) continue;
+		const deps = dependencies.get(after) ?? /* @__PURE__ */ new Set();
+		deps.add(before);
+		dependencies.set(after, deps);
+		added.push({
+			before,
+			after
+		});
+	}
+	return added;
+}
+function recordInlinePolicyKeys(record) {
+	if (record === void 0 || record === null || typeof record !== "object") return [];
+	const props = record.properties ?? {};
+	const keys = [];
+	const add = (kind, principal, name) => {
+		keys.push(JSON.stringify([
+			kind,
+			nameKey(principal),
+			nameKey(name)
+		]));
+	};
+	const standalone = standaloneInlinePolicyOf(record.resourceType, props);
+	if (standalone !== void 0) {
+		add(standalone.kind, standalone.principal, standalone.policyName);
+		return keys;
+	}
+	if (record.resourceType === "AWS::IAM::Policy") {
+		const names = [props["PolicyName"], typeof record.physicalId === "string" ? record.physicalId.split(":")[0] : record.physicalId];
+		for (const kind of [
+			"role",
+			"group",
+			"user"
+		]) {
+			const listed = props[POLICY_LIST_FIELDS[kind]];
+			if (listed === void 0 || listed === null) continue;
+			const principals = Array.isArray(listed) ? listed : [void 0];
+			for (const p of principals) for (const n of names) add(kind, p, n);
+		}
+		return keys;
+	}
+	const kind = principalKindOf(record.resourceType);
+	if (kind === void 0) return keys;
+	for (const name of policiesNames(props["Policies"])) add(kind, record.physicalId, name);
+	return keys;
+}
+function orderInlinePolicyReversals(replay, stateResources) {
+	const current = (op) => Object.hasOwn(stateResources, op.logicalId) ? stateResources[op.logicalId] : void 0;
+	const isStandalone = (op) => [current(op), op.previousState].some((r) => r !== void 0 && r !== null && isStandaloneInlinePolicyType(r.resourceType));
+	if (!replay.some(isStandalone)) return [...replay];
+	const keysOf = /* @__PURE__ */ new Map();
+	for (const op of replay) {
+		const keys = [...recordInlinePolicyKeys(current(op)), ...recordInlinePolicyKeys(op.previousState)];
+		if (keys.length > 0) keysOf.set(op, new Set(keys));
+	}
+	if (keysOf.size < 2) return [...replay];
+	const meets = (a, b) => a === ANY || b === ANY || a === b;
+	const collide = (a, b) => {
+		for (const ka of a) {
+			const [kindA, pA, nA] = JSON.parse(ka);
+			for (const kb of b) {
+				const [kindB, pB, nB] = JSON.parse(kb);
+				if (kindA === kindB && meets(pA, pB) && meets(nA, nB)) return true;
+			}
+		}
+		return false;
+	};
+	const dependsOn = (a, b) => [current(a), a.previousState].some((r) => Array.isArray(r?.dependencies) && r.dependencies.includes(b.logicalId));
+	const order = [...replay];
+	for (const op of [...replay].reverse()) {
+		if (!isStandalone(op)) continue;
+		const mine = keysOf.get(op);
+		if (mine === void 0) continue;
+		const at = order.indexOf(op);
+		let last = -1;
+		for (let j = at + 1; j < order.length; j++) {
+			const other = order[j];
+			const theirs = keysOf.get(other);
+			if (dependsOn(op, other) || dependsOn(other, op)) break;
+			if (theirs === void 0 || isStandalone(other)) continue;
+			if (collide(mine, theirs)) last = j;
+		}
+		if (last < 0) continue;
+		order.splice(at, 1);
+		order.splice(last, 0, op);
+	}
+	return order;
+}
+function ownPoliciesChange(change) {
+	return (change?.propertyChanges ?? []).some((c) => c.path === "Policies" && c.inPlacePropagated !== true && c.replacementPropagated !== true);
+}
+
 //#endregion
 //#region src/provisioning/json-patch-generator.ts
 var JsonPatchGenerator = class {
@@ -23290,9 +24238,24 @@ const WRITABLE_GETATT_ATTRIBUTES = {
 	"AWS::StepFunctions::Activity": ["Name"],
 	"AWS::Transfer::User": ["ServerId", "UserName"]
 };
+const SHAPE_MISMATCHED_GETATT_ATTRIBUTES = {
+	"AWS::DocDB::DBCluster": ["Port"],
+	"AWS::Events::EventBus": ["Policy"],
+	"AWS::MediaLive::Input": ["Destinations", "Sources"]
+};
 
 //#endregion
 //#region src/provisioning/read-only-properties.ts
+function isDefinitiveRefusal(error) {
+	if (isThrottlingError(error)) return false;
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		const status = current.$metadata?.httpStatusCode;
+		if (status !== void 0) return status >= 400 && status < 500;
+		current = current.cause;
+	}
+	return false;
+}
 const readOnlyPropertiesCache = /* @__PURE__ */ new Map();
 const attributeNamesCache = /* @__PURE__ */ new Map();
 async function getTopLevelAttributeNames(resourceType) {
@@ -23306,12 +24269,24 @@ async function getTopLevelAttributeNames(resourceType) {
 	attributeNamesCache.set(resourceType, names);
 	return names;
 }
+const deployAttributeNamesCache = /* @__PURE__ */ new Map();
+async function getTopLevelDeployAttributeNames(resourceType) {
+	const certified = await getTopLevelAttributeNames(resourceType);
+	if (certified === void 0) return void 0;
+	const mismatched = Object.hasOwn(SHAPE_MISMATCHED_GETATT_ATTRIBUTES, resourceType) ? SHAPE_MISMATCHED_GETATT_ATTRIBUTES[resourceType] : void 0;
+	if (!mismatched || mismatched.length === 0) return certified;
+	const cached = deployAttributeNamesCache.get(resourceType);
+	if (cached) return cached;
+	const names = /* @__PURE__ */ new Set([...certified, ...mismatched]);
+	deployAttributeNamesCache.set(resourceType, names);
+	return names;
+}
 function getTopLevelReadOnlyProperties(resourceType) {
 	if (hasNoRegistrySchema(resourceType)) return Promise.resolve(void 0);
 	const cached = readOnlyPropertiesCache.get(resourceType);
 	if (cached) return cached;
 	const entry = fetchTopLevelReadOnlyProperties(resourceType).catch((error) => {
-		readOnlyPropertiesCache.delete(resourceType);
+		if (!isDefinitiveRefusal(error)) readOnlyPropertiesCache.delete(resourceType);
 		const message = describeAwsFailure(error).detail;
 		getLogger().child("ReadOnlyProperties").debug(`Failed to resolve read-only properties for ${displaySafe(resourceType, { asciiOnly: true })} via cloudformation:DescribeType (${message}).`);
 	});
@@ -23728,10 +24703,11 @@ var CloudControlProvider = class {
 	async create(logicalId, resourceType, properties, context) {
 		const mask = maskerOrIdentity(context?.maskSecrets);
 		const idLog = new IdScrubLog(this.logger, mask, holdsSecretDerivedLeaf(properties, mask));
-		return inIdLogScope(idLog, () => this.createInIdLogScope(logicalId, resourceType, properties, idLog));
+		return inIdLogScope(idLog, () => this.createInIdLogScope(logicalId, resourceType, properties, idLog, mask));
 	}
-	async createInIdLogScope(logicalId, resourceType, properties, idLog) {
+	async createInIdLogScope(logicalId, resourceType, properties, idLog, mask) {
 		this.logger.debug(`Creating resource ${logicalId} (${resourceType})`);
+		const attributeNamesLookup = getTopLevelDeployAttributeNames(resourceType);
 		try {
 			const ccProperties = stringifyJsonProperties(resourceType, stripNullValues(properties));
 			const desiredState = JSON.stringify(ccProperties);
@@ -23749,7 +24725,9 @@ var CloudControlProvider = class {
 			const result = { physicalId: progressEvent.Identifier };
 			if (progressEvent.ResourceModel) result.attributes = this.parseResourceModel(progressEvent.ResourceModel);
 			result.attributes = await this.mergeSparseModelReadback(resourceType, progressEvent.Identifier, result.attributes || {});
+			const modelKeys = Object.keys(result.attributes);
 			result.attributes = await this.enrichResourceAttributes(resourceType, progressEvent.Identifier, result.attributes);
+			result.attributes = await this.maskDeployedNonAttributeKeys(result.attributes, modelKeys, resourceType, progressEvent.Identifier, attributeNamesLookup, properties, mask);
 			return result;
 		} catch (error) {
 			idLog.addId(identifierCarriedBy(error));
@@ -23820,6 +24798,7 @@ var CloudControlProvider = class {
 					sentNothing: true
 				};
 			}
+			const attributeNamesLookup = getTopLevelDeployAttributeNames(resourceType);
 			const writeOnlyProperties = await getTopLevelWriteOnlyProperties(resourceType);
 			if (writeOnlyProperties.size > 0) {
 				const keptOnPreviousSide = getTopLevelKeysHoldingUnreadableCreateOnly(resourceType, cleanProperties);
@@ -23860,7 +24839,9 @@ var CloudControlProvider = class {
 			};
 			if (progressEvent.ResourceModel) result.attributes = this.parseResourceModel(progressEvent.ResourceModel, idLog);
 			result.attributes = await this.mergeSparseModelReadback(resourceType, physicalId, result.attributes || {}, idLog);
+			const modelKeys = Object.keys(result.attributes);
 			result.attributes = await this.enrichResourceAttributes(resourceType, physicalId, result.attributes, idLog);
+			result.attributes = await this.maskDeployedNonAttributeKeys(result.attributes, modelKeys, resourceType, physicalId, attributeNamesLookup, properties, maskerOrIdentity(context?.maskSecrets), idLog);
 			return result;
 		} catch (error) {
 			this.handleError(error, "UPDATE", resourceType, logicalId, physicalId);
@@ -23885,10 +24866,14 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		await this.assertRecordedRegionAgainstClient("pre-delete", context?.expectedRegion, resourceType, logicalId, physicalId);
+		if (standaloneInlinePolicyHandedOff(resourceType, properties, context?.inlinePolicyClaimed, physicalId)) {
+			this.logger.info(`  ${logicalId}: not deleting its inline policy, which another resource of this deploy now holds under the same name`);
+			return;
+		}
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-D9Po293s.js");
+			const { ASGProvider } = await import("./asg-provider-B1xRE8do.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -23994,7 +24979,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-CU0LZr05.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-xROL9y31.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-J40R0ysf.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CU_1O2FR.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -24639,6 +25624,25 @@ var CloudControlProvider = class {
 			throw error;
 		}
 	}
+	async maskDeployedNonAttributeKeys(attributes, modelKeys, resourceType, physicalId, attributeNamesLookup, desired, mask, log = this.logger) {
+		const safeType = displaySafe(resourceType, { asciiOnly: true });
+		const attributeNames = await attributeNamesLookup;
+		if (attributeNames === void 0) {
+			log.debug(`Could not resolve the CloudFormation schema for ${safeType}; recording its Cloud Control model unnarrowed for ${displaySafe(physicalId, { asciiOnly: true })}.`);
+			return attributes;
+		}
+		const narrowed = new Set(modelKeys.filter((key) => !attributeNames.has(key) && !isLiteralDeployOnlyKey(resourceType, key, desired, mask)));
+		if (narrowed.size === 0) return attributes;
+		const out = Object.create(null);
+		for (const [key, value] of Object.entries(attributes)) Object.defineProperty(out, key, {
+			value: narrowed.has(key) ? maskLeavesDeep(value) : value,
+			enumerable: true,
+			writable: true,
+			configurable: true
+		});
+		log.debug(`Masked ${narrowed.size} non-attribute key(s) of the ${safeType} Cloud Control model for ${displaySafe(physicalId, { asciiOnly: true })}: they are not Fn::GetAtt attributes of the type.`);
+		return out;
+	}
 	async import(input) {
 		if (!input.knownPhysicalId) return null;
 		const identifier = toCloudControlIdentifier({
@@ -24794,6 +25798,11 @@ function holdsSecretDerivedLeaf(value, mask, depth = 0) {
 	return Object.entries(value).some(([key, entry]) => isSecretDerivedValue(key, mask) || holdsSecretDerivedLeaf(entry, mask, depth + 1));
 }
 const IMPORT_YIELDED_NO_ATTRIBUTES_CONSEQUENCE = "Attributes the stack's state already records for this physical id are kept; without them, an Fn::GetAtt against this resource falls back to a value constructed from its physical id.";
+function isLiteralDeployOnlyKey(resourceType, key, desired, mask) {
+	if (resourceType !== "AWS::SSM::Parameter" || key !== "Value") return false;
+	const declared = desired["Value"];
+	return typeof declared === "string" && !isSecretDerivedValue(declared, mask);
+}
 function maskLeavesDeep(value) {
 	if (Array.isArray(value)) return value.map((element) => maskLeavesDeep(element));
 	if (value !== null && typeof value === "object") {
@@ -25152,6 +26161,7 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 	logger = getLogger().child("NoEchoDeleteReresolution");
 	resolver;
 	parametersPromise;
+	printingNoEchoPromise;
 	noEchoParameters;
 	options;
 	constructor(options) {
@@ -25161,7 +26171,7 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 		const section = options.template.Parameters;
 		if (section !== null && typeof section === "object") for (const [name, definition] of Object.entries(section)) {
 			const noEcho = definition?.NoEcho;
-			if (noEcho === true || noEcho === "true") declared.add(name);
+			if (isNoEchoDeclared(noEcho)) declared.add(name);
 		}
 		for (const name of options.inheritedNoEchoParameters ?? []) declared.add(name);
 		this.noEchoParameters = declared;
@@ -25213,6 +26223,33 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 		for (const name of this.noEchoParameters) if (parameters !== void 0 && Object.hasOwn(parameters, name)) recordLogOnlyParameterValue(bag, parameters[name]);
 		return bag;
 	}
+	printingNoEchoValues() {
+		this.printingNoEchoPromise ??= this.printingNeedles().then((bag) => hasMaskableValues(bag) ? bag : void 0);
+		return this.printingNoEchoPromise;
+	}
+	async printingNeedles() {
+		const bag = this.newBag();
+		if (this.options.printingSeed !== void 0) carryLogOnlyValues(this.options.printingSeed, bag);
+		if (this.noEchoParameters.size === 0) return bag;
+		const parameters = await this.boundParameters();
+		const section = this.options.template.Parameters ?? {};
+		const supplied = this.options.parameters;
+		for (const name of this.noEchoParameters) {
+			if (parameters !== void 0) {
+				if (Object.hasOwn(parameters, name)) recordLogOnlyParameterValue(bag, parameters[name]);
+				continue;
+			}
+			if (supplied !== void 0 && Object.hasOwn(supplied, name)) {
+				const value = supplied[name];
+				if (!this.options.maskedParameters?.has(name)) recordLogOnlyParameterValue(bag, value);
+				continue;
+			}
+			const definition = Object.hasOwn(section, name) ? section[name] : void 0;
+			if (typeof definition?.Type === "string" && definition.Type.startsWith("AWS::SSM::")) continue;
+			if (definition?.Default !== void 0) recordLogOnlyParameterValue(bag, definition.Default);
+		}
+		return bag;
+	}
 	async valuesFor(logicalId, record) {
 		const masked = maskedNoEchoCoordinates(record.properties, noEchoLeavesOf(record));
 		if (masked.length === 0) return void 0;
@@ -25287,8 +26324,10 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 			const parameters0 = await this.boundParameters();
 			const rowTemplate = this.options.template.Resources?.[logicalId];
 			const passedClasses = parameters0 === void 0 ? void 0 : await classifyPassedParameters(rowTemplate?.Properties?.Parameters, this.inputSources(parameters0)).catch(() => void 0);
+			const printingSeed = await this.printingNoEchoValues().catch(() => void 0);
 			return new TemplateNoEchoReresolver({
 				...passedClasses !== void 0 && { passedClasses },
+				...printingSeed !== void 0 && { printingSeed },
 				template: child.template,
 				stackName: childStackName,
 				region: this.options.region,
@@ -28731,347 +29770,6 @@ async function reserveStackCreateToken(options) {
 	};
 }
 
-//#endregion
-//#region src/deployment/inline-policy-claims.ts
-function isInlinePolicyClaimedByCompletedWriter(args, kind, principal, policyName) {
-	const { selfLogicalId, writers, changes, stateResources } = args;
-	for (const [lid, write] of writers) {
-		if (lid === selfLogicalId || !Object.hasOwn(stateResources, lid)) continue;
-		const record = stateResources[lid];
-		if (record.provisionedBy === "cc-api") continue;
-		const props = record.properties ?? {};
-		if (record.resourceType === "AWS::IAM::Policy") {
-			if (!sameIamName(record.physicalId, policyName)) continue;
-			const listed = props[POLICY_LIST_FIELDS[kind]];
-			if (Array.isArray(listed) && listed.some((p) => sameIamName(p, principal))) return true;
-			continue;
-		}
-		if (!Object.hasOwn(PRINCIPAL_KINDS, record.resourceType)) continue;
-		if (PRINCIPAL_KINDS[record.resourceType] !== kind) continue;
-		if (!sameIamName(record.physicalId, principal)) continue;
-		if (write !== "create" && !ownPoliciesChange(changes.get(lid))) continue;
-		const policies = props["Policies"];
-		if (!Array.isArray(policies)) continue;
-		if (policies.some((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) && sameIamName(entry["PolicyName"], policyName))) return true;
-	}
-	return false;
-}
-var RollbackInlinePolicyWriters = class {
-	entries = /* @__PURE__ */ new Map();
-	removals = /* @__PURE__ */ new Map();
-	unsettled = /* @__PURE__ */ new Map();
-	notePending(ops) {
-		for (const op of ops) if (!this.unsettled.has(op)) this.unsettled.set(op, {
-			logicalId: op.logicalId,
-			state: "pending"
-		});
-	}
-	noteOutcome(op, completed) {
-		if (!completed) {
-			this.unsettled.set(op, {
-				logicalId: op.logicalId,
-				state: "failed"
-			});
-			return;
-		}
-		for (const [key, entry] of this.unsettled) if (key === op || entry.logicalId === op.logicalId) this.unsettled.delete(key);
-	}
-	record(logicalId, write, record, policiesChanged, via) {
-		if (via === "cc-api") {
-			this.entries.delete(logicalId);
-			return;
-		}
-		this.entries.set(logicalId, {
-			write,
-			record,
-			policiesChanged
-		});
-	}
-	claimedFor(resourceType, logicalId, stateResources) {
-		if (resourceType !== "AWS::IAM::Policy" && !Object.hasOwn(PRINCIPAL_KINDS, resourceType)) return;
-		return (kind, principal, policyName) => {
-			const writers = /* @__PURE__ */ new Map();
-			const changes = /* @__PURE__ */ new Map();
-			for (const [lid, entry] of this.entries) {
-				if (!Object.hasOwn(stateResources, lid) || stateResources[lid] !== entry.record) continue;
-				writers.set(lid, entry.write);
-				if (entry.policiesChanged) changes.set(lid, {
-					logicalId: lid,
-					changeType: "UPDATE",
-					resourceType: entry.record.resourceType,
-					propertyChanges: [{
-						path: "Policies",
-						oldValue: void 0,
-						newValue: void 0,
-						requiresReplacement: false
-					}]
-				});
-			}
-			const claimed = isInlinePolicyClaimedByCompletedWriter({
-				selfLogicalId: logicalId,
-				writers,
-				changes,
-				stateResources
-			}, kind, principal, policyName);
-			if (!claimed) {
-				const key = removalKey(kind, principal, policyName);
-				const noted = this.removals.get(key) ?? {
-					kind,
-					principal,
-					policyName,
-					removers: /* @__PURE__ */ new Map()
-				};
-				noted.removers.set(logicalId, stateResources[logicalId]);
-				this.removals.set(key, noted);
-			}
-			return claimed;
-		};
-	}
-	takeHeldRemovals(stateResources) {
-		const held = [];
-		for (const [key, { kind, principal, policyName, removers }] of this.removals) {
-			const { holders, unreadable } = inlinePolicyHolders(stateResources, kind, principal, policyName);
-			const others = holders.filter((h) => !removers.has(h.logicalId) || stateResources[h.logicalId] !== removers.get(h.logicalId));
-			if (others.length === 0) continue;
-			this.removals.delete(key);
-			const open = new Set([...this.unsettled.values()].map((u) => u.logicalId));
-			const unsettled = [...new Set(others.map((h) => h.logicalId))].filter((id) => open.has(id));
-			held.push({
-				kind,
-				holders: others,
-				unreadable,
-				unsettled
-			});
-		}
-		return held;
-	}
-};
-function inlinePolicyHolders(stateResources, kind, principal, policyName) {
-	const holders = [];
-	const unreadable = [];
-	const unnamed = (v) => typeof v !== "string" || !IAM_NAME.test(v);
-	for (const [logicalId, record] of Object.entries(stateResources)) {
-		if (record === null || typeof record !== "object") continue;
-		const props = record.properties ?? {};
-		if (record.resourceType === "AWS::IAM::Policy") {
-			const nameMatches = sameIamName(record.physicalId, policyName);
-			if (!nameMatches && !unnamed(record.physicalId)) continue;
-			const listed = props[POLICY_LIST_FIELDS[kind]];
-			const entries = Array.isArray(listed) ? listed : [];
-			const named = entries.find((p) => sameIamName(p, principal));
-			if (nameMatches && typeof named === "string") holders.push({
-				logicalId,
-				principal: named,
-				policyName: record.physicalId,
-				document: props["PolicyDocument"]
-			});
-			else if (named !== void 0 || entries.some(unnamed)) unreadable.push(logicalId);
-			continue;
-		}
-		if (!Object.hasOwn(PRINCIPAL_KINDS, record.resourceType)) continue;
-		if (PRINCIPAL_KINDS[record.resourceType] !== kind) continue;
-		const principalMatches = sameIamName(record.physicalId, principal);
-		if (!principalMatches && !unnamed(record.physicalId)) continue;
-		const policies = props["Policies"];
-		if (!Array.isArray(policies)) continue;
-		for (const entry of policies) {
-			if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
-			const name = entry["PolicyName"];
-			if (principalMatches && sameIamName(name, policyName)) holders.push({
-				logicalId,
-				principal: record.physicalId,
-				policyName: name,
-				document: entry["PolicyDocument"]
-			});
-			else if (unnamed(name) || sameIamName(name, policyName)) unreadable.push(logicalId);
-		}
-	}
-	return {
-		holders,
-		unreadable: [...new Set(unreadable)]
-	};
-}
-function sameIamName(a, b) {
-	return typeof a === "string" && IAM_NAME.test(a) && a.toLowerCase() === b.toLowerCase();
-}
-function removalKey(kind, principal, policyName) {
-	return JSON.stringify([
-		kind,
-		principal.toLowerCase(),
-		policyName.toLowerCase()
-	]);
-}
-const IAM_NAME = /^[\w+=,.@-]+$/;
-const POLICY_LIST_FIELDS = {
-	role: "Roles",
-	group: "Groups",
-	user: "Users"
-};
-const PRINCIPAL_KINDS = {
-	"AWS::IAM::Role": "role",
-	"AWS::IAM::Group": "group",
-	"AWS::IAM::User": "user"
-};
-function isInlinePolicyPrincipalType(resourceType) {
-	return Object.hasOwn(PRINCIPAL_KINDS, resourceType);
-}
-function principalKindOf(resourceType) {
-	return Object.hasOwn(PRINCIPAL_KINDS, resourceType) ? PRINCIPAL_KINDS[resourceType] : void 0;
-}
-const ANY = "*";
-const PRINCIPAL_NAME_FIELDS = {
-	role: "RoleName",
-	group: "GroupName",
-	user: "UserName"
-};
-function nameKey(value) {
-	return typeof value === "string" && IAM_NAME.test(value) ? value.toLowerCase() : ANY;
-}
-function templatePrincipalKeys(entry, kind, templateResources, stateResources) {
-	if (typeof entry === "string") return [nameKey(entry)];
-	const ref = typeof entry === "object" && entry !== null && !Array.isArray(entry) ? entry["Ref"] : void 0;
-	if (typeof ref !== "string" || !Object.hasOwn(templateResources, ref)) return [ANY];
-	const target = templateResources[ref];
-	if (principalKindOf(target.Type) !== kind) return [ANY];
-	return principalSelfKeys(ref, kind, target, stateResources);
-}
-function principalSelfKeys(logicalId, kind, template, stateResources) {
-	const keys = [`ref:${logicalId}`];
-	const declared = template?.Properties?.[PRINCIPAL_NAME_FIELDS[kind]];
-	const declaredKey = nameKey(declared);
-	if (declaredKey !== ANY) keys.push(declaredKey);
-	const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
-	if (record !== void 0 && principalKindOf(record.resourceType) === kind) {
-		const recordedKey = nameKey(record.physicalId);
-		if (recordedKey !== ANY) keys.push(recordedKey);
-	}
-	return keys;
-}
-function policiesNames(policies) {
-	if (policies === void 0 || policies === null) return [];
-	if (!Array.isArray(policies)) return [ANY];
-	return policies.map((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) ? nameKey(entry["PolicyName"]) : ANY);
-}
-function inlinePolicyClaimsOf(logicalId, change, templateResources, stateResources) {
-	const template = Object.hasOwn(templateResources, logicalId) ? templateResources[logicalId] : void 0;
-	const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
-	const recorded = record?.resourceType === change.resourceType ? record : void 0;
-	const claims = [];
-	const cross = (kind, principals, names) => {
-		for (const principal of new Set(principals)) for (const name of new Set(names)) claims.push({
-			kind,
-			principal,
-			name
-		});
-	};
-	if (change.resourceType === "AWS::IAM::Policy") {
-		const desired = template?.Properties ?? {};
-		const old = recorded?.properties ?? {};
-		const names = [];
-		if (desired["PolicyName"] !== void 0) names.push(nameKey(desired["PolicyName"]));
-		if (old["PolicyName"] !== void 0) names.push(nameKey(old["PolicyName"]));
-		if (recorded !== void 0) names.push(nameKey(typeof recorded.physicalId === "string" ? recorded.physicalId.split(":")[0] : recorded.physicalId));
-		if (names.length === 0) return claims;
-		for (const kind of [
-			"role",
-			"group",
-			"user"
-		]) {
-			const field = POLICY_LIST_FIELDS[kind];
-			const principals = [];
-			const listed = desired[field];
-			if (Array.isArray(listed)) for (const entry of listed) principals.push(...templatePrincipalKeys(entry, kind, templateResources, stateResources));
-			else if (listed !== void 0) principals.push(ANY);
-			const held = old[field];
-			if (Array.isArray(held)) principals.push(...held.map(nameKey));
-			else if (held !== void 0 && held !== null) principals.push(ANY);
-			cross(kind, principals, names);
-		}
-		return claims;
-	}
-	const kind = principalKindOf(change.resourceType);
-	if (kind === void 0) return claims;
-	if (!(change.changeType === "CREATE" || (change.propertyChanges ?? []).some((c) => c.requiresReplacement) || ownPoliciesChange(change))) return claims;
-	cross(kind, principalSelfKeys(logicalId, kind, template, stateResources), [...policiesNames(template?.Properties?.["Policies"]), ...policiesNames(recorded?.properties?.["Policies"])]);
-	return claims;
-}
-function orderInlinePolicyWriters(args) {
-	const { writes, changes, templateResources, stateResources, dependencies, rank } = args;
-	const writers = writes.filter((id) => {
-		const type = changes.get(id)?.resourceType;
-		return type === "AWS::IAM::Policy" || type !== void 0 && isInlinePolicyPrincipalType(type);
-	});
-	if (writers.length < 2) return [];
-	const exact = /* @__PURE__ */ new Map();
-	const loose = [];
-	const all = [];
-	for (const id of writers) for (const claim of inlinePolicyClaimsOf(id, changes.get(id), templateResources, stateResources)) {
-		all.push({
-			id,
-			claim
-		});
-		if (claim.principal === ANY || claim.name === ANY) {
-			loose.push({
-				id,
-				claim
-			});
-			continue;
-		}
-		const key = JSON.stringify([
-			claim.kind,
-			claim.principal,
-			claim.name
-		]);
-		const ids = exact.get(key) ?? /* @__PURE__ */ new Set();
-		ids.add(id);
-		exact.set(key, ids);
-	}
-	const principalRows = new Set(writers.filter((id) => isInlinePolicyPrincipalType(changes.get(id).resourceType)));
-	const pairs = /* @__PURE__ */ new Map();
-	const pair = (a, b) => {
-		if (a === b || principalRows.has(a) && principalRows.has(b)) return;
-		const [x, y] = rank(a) < rank(b) || rank(a) === rank(b) && a < b ? [a, b] : [b, a];
-		pairs.set(JSON.stringify([x, y]), [x, y]);
-	};
-	for (const ids of exact.values()) {
-		const list = [...ids];
-		for (let i = 0; i < list.length; i++) for (let j = i + 1; j < list.length; j++) pair(list[i], list[j]);
-	}
-	const meets = (a, b) => a === ANY || b === ANY || a === b;
-	for (const { id, claim } of loose) for (const other of all) {
-		if (other.claim.kind !== claim.kind) continue;
-		if (meets(claim.principal, other.claim.principal) && meets(claim.name, other.claim.name)) pair(id, other.id);
-	}
-	if (pairs.size === 0) return [];
-	const reaches = (from, to) => {
-		const seen = /* @__PURE__ */ new Set();
-		const stack = [from];
-		while (stack.length > 0) {
-			const id = stack.pop();
-			if (id === to) return true;
-			if (seen.has(id)) continue;
-			seen.add(id);
-			for (const dep of dependencies.get(id) ?? []) stack.push(dep);
-		}
-		return false;
-	};
-	const added = [];
-	for (const [before, after] of pairs.values()) {
-		if (reaches(after, before) || reaches(before, after)) continue;
-		const deps = dependencies.get(after) ?? /* @__PURE__ */ new Set();
-		deps.add(before);
-		dependencies.set(after, deps);
-		added.push({
-			before,
-			after
-		});
-	}
-	return added;
-}
-function ownPoliciesChange(change) {
-	return (change?.propertyChanges ?? []).some((c) => c.path === "Policies" && c.inPlacePropagated !== true && c.replacementPropagated !== true);
-}
-
 //#endregion
 //#region src/analyzer/destructive-changes.ts
 const IGNORED_RESOURCE_TYPES = /* @__PURE__ */ new Set(["AWS::CDK::Metadata"]);
@@ -29993,14 +30691,43 @@ function secretNamedRecordNeedles(resources, secrets, bag = /* @__PURE__ */ new
 	return bag;
 }
 function secretNamePrintingBag(logicalId, resources) {
-	const bag = /* @__PURE__ */ new Map();
-	const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
-	for (const needle of secretNameNeedlesOf(logicalId, record, void 0) ?? []) recordLogOnlyValue(bag, needle);
-	for (const needle of secretNamesReadBy(logicalId, record, resources)) recordLogOnlyValue(bag, needle);
-	return bag;
+	return secretNamePrintingBags(resources, void 0)(logicalId);
+}
+function secretNamePrintingBags(resources, noEchoValues) {
+	const secrets = noEchoValues !== void 0 && hasMaskableValues(noEchoValues) ? noEchoValues : void 0;
+	const judged = /* @__PURE__ */ new Map();
+	const needlesOf = (logicalId, record) => {
+		const hit = judged.get(logicalId);
+		if (hit !== void 0 && hit.record === record) return hit.needles;
+		const needles = secretNameNeedlesOf(logicalId, record, secrets, { embedded: void 0 });
+		judged.set(logicalId, {
+			record,
+			needles
+		});
+		return needles;
+	};
+	return (logicalId) => {
+		const bag = /* @__PURE__ */ new Map();
+		if (secrets !== void 0) carryLogOnlyValues(secrets, bag);
+		const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+		for (const needle of needlesOf(logicalId, record) ?? []) recordLogOnlyValue(bag, needle);
+		const leaves = [...wholeStringLeavesOf(record?.properties)].filter((leaf) => leaf !== "");
+		if (leaves.length === 0) return bag;
+		for (const [otherId, other] of Object.entries(resources)) {
+			if (otherId === logicalId) continue;
+			for (const needle of needlesOf(otherId, other) ?? []) if (leavesHoldNeedle(leaves, needle)) recordLogOnlyValue(bag, needle);
+		}
+		return bag;
+	};
 }
-function journaledOrphanPrintingBag(ops, stateResources) {
+function journaledOrphanPrintingBag(ops, stateResources, noEchoValues) {
 	const bag = /* @__PURE__ */ new Map();
+	const secrets = noEchoValues !== void 0 && hasMaskableValues(noEchoValues) ? noEchoValues : void 0;
+	if (secrets !== void 0) carryLogOnlyValues(secrets, bag);
+	const judge = {
+		secrets,
+		embedded: void 0
+	};
 	for (const op of ops) {
 		const record = {
 			resourceType: op.resourceType,
@@ -30009,9 +30736,9 @@ function journaledOrphanPrintingBag(ops, stateResources) {
 		};
 		const replaced = Object.hasOwn(stateResources, op.logicalId) ? stateResources[op.logicalId] : void 0;
 		for (const needle of [
-			...secretNameNeedlesOf(op.logicalId, record, void 0) ?? [],
-			...secretNameNeedlesOf(op.logicalId, replaced, void 0) ?? [],
-			...secretNamesReadBy(op.logicalId, record, stateResources)
+			...secretNameNeedlesOf(op.logicalId, record, secrets, judge) ?? [],
+			...secretNameNeedlesOf(op.logicalId, replaced, secrets, judge) ?? [],
+			...secretNamesReadBy(op.logicalId, record, stateResources, () => judge)
 		]) recordLogOnlyValue(bag, needle);
 	}
 	return bag;
@@ -30031,13 +30758,15 @@ function completedReplayEntries(ops) {
 		attemptedProperties: op.previousState.properties
 	}]]);
 }
-function orphanRecordsPrintingBag(records) {
+function orphanRecordsPrintingBag(records, noEchoValues) {
 	const bag = /* @__PURE__ */ new Map();
+	const secrets = noEchoValues !== void 0 && hasMaskableValues(noEchoValues) ? noEchoValues : void 0;
+	if (secrets !== void 0) carryLogOnlyValues(secrets, bag);
 	for (const entry of records) {
 		if (entry === null || typeof entry !== "object") continue;
 		const { logicalId, state } = entry;
 		if (typeof logicalId !== "string" || state === null || typeof state !== "object") continue;
-		for (const needle of secretNameNeedlesOf(logicalId, state, void 0) ?? []) recordLogOnlyValue(bag, needle);
+		for (const needle of secretNameNeedlesOf(logicalId, state, secrets, { embedded: void 0 }) ?? []) recordLogOnlyValue(bag, needle);
 	}
 	return bag;
 }
@@ -30147,7 +30876,7 @@ function withNoEchoDefaultsMasked(parameters) {
 	const masked = Object.create(null);
 	for (const [name, decl] of Object.entries(parameters)) {
 		const body = decl;
-		masked[name] = typeof body === "object" && body !== null && body["NoEcho"] === true && "Default" in body ? {
+		masked[name] = typeof body === "object" && body !== null && declaresNoEcho(body) && "Default" in body ? {
 			...body,
 			Default: NO_ECHO_DEFAULT_MASK
 		} : decl;
@@ -30359,7 +31088,7 @@ function noEchoParameterValueSeed(parameters, values, inherited, userParameters)
 	if (values === void 0) return seed;
 	for (const [name, value] of Object.entries(values)) {
 		if (isWholeDynamicReferenceValue(value)) continue;
-		if (parameters?.[name]?.NoEcho === true) {
+		if (parameters !== void 0 && declaresNoEcho(parameters[name])) {
 			const type = parameters[name]?.Type;
 			const ssmTyped = typeof type === "string" && type.startsWith("AWS::SSM::Parameter::Value<");
 			const spelled = Object.prototype.hasOwnProperty.call(userParameters ?? {}, name) ? userParameters?.[name] : parameters[name]?.Default;
@@ -31147,13 +31876,52 @@ async function resolveLeafByRegion(leaf, propertyPath, logicalId, execCtx, resol
 	}
 	return out + leaf.slice(cursor);
 }
-function redactRollbackRecord(record, secrets, journaledProps) {
+function redactRollbackRecord(record, secrets, journaledProps, journaledAttributes) {
 	if (secrets.size === 0) return record;
 	const positioned = journaledProps === void 0 ? record : {
 		...record,
 		properties: redactSecretsForState(record.properties, secrets, journaledProps, STATE_DERIVED_RULES)
 	};
-	return scrubResourceRecord(positioned, secrets);
+	return keepPersistedPlainRecordLeaves(scrubResourceRecord(positioned, secrets), record, {
+		properties: journaledProps,
+		attributes: journaledAttributes
+	});
+}
+function keepPersistedPlainRecordLeaves(scrubbed, raw, persisted) {
+	const properties = keepPersistedPlainLeaves(scrubbed.properties, raw.properties, persisted.properties);
+	const attributes = scrubbed.attributes === void 0 ? void 0 : keepPersistedPlainLeaves(scrubbed.attributes, raw.attributes, persisted.attributes);
+	if (properties === scrubbed.properties && attributes === scrubbed.attributes) return scrubbed;
+	return {
+		...scrubbed,
+		properties,
+		...attributes !== void 0 && { attributes }
+	};
+}
+function keepPersistedPlainLeaves(redacted, raw, persisted) {
+	if (typeof raw === "string") return typeof persisted === "string" && raw === persisted && redacted !== "***" && dynamicReferenceTokens(persisted).length === 0 ? persisted : redacted;
+	if (Array.isArray(raw)) {
+		if (!Array.isArray(persisted) || !Array.isArray(redacted)) return redacted;
+		if (redacted.length !== raw.length) return redacted;
+		let out;
+		for (let i = 0; i < redacted.length; i++) {
+			const kept = keepPersistedPlainLeaves(redacted[i], raw[i], persisted[i]);
+			if (kept !== redacted[i]) (out ??= [...redacted])[i] = kept;
+		}
+		return out ?? redacted;
+	}
+	if (!isPlainRecord$1(raw) || !isPlainRecord$1(persisted) || !isPlainRecord$1(redacted)) return redacted;
+	let out;
+	for (const key of Object.keys(redacted)) {
+		if (!hasOwnKey(raw, key) || !hasOwnKey(persisted, key)) continue;
+		const kept = keepPersistedPlainLeaves(redacted[key], raw[key], persisted[key]);
+		if (kept === redacted[key]) continue;
+		out ??= { ...redacted };
+		out[key] = kept;
+	}
+	return out ?? redacted;
+}
+function isPlainRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && hasPlainPrototype$1(value);
 }
 
 //#endregion
@@ -32207,7 +32975,7 @@ async function replayRevert(s) {
 		}
 	], op.logicalId, logger, isInterrupted, secrets, mask));
 	if (revertResult) recordNoEchoAttributeValues(revertResult, secrets, desiredProps);
-	stateResources[op.logicalId] = maskRestoredNoEchoRecord(redactRollbackRecord(recordAfterRollbackUpdate(previousState, revertResult), secrets, previousState.properties), previousState, noEcho.substituted);
+	stateResources[op.logicalId] = maskRestoredNoEchoRecord(redactRollbackRecord(recordAfterRollbackUpdate(previousState, revertResult), secrets, previousState.properties, previousState.attributes), previousState, noEcho.substituted);
 	if (updatePartialReason(revertResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$1(previousState.properties?.["Policies"], current.properties?.["Policies"]), revertVia);
 	const rollbackPartial = updatePartialReason(revertResult);
 	if (rollbackPartial !== void 0) logger.warn(mask(`  Rollback: ${safe(op.logicalId)} restored, ${updatePartialMessage(rollbackPartial)}`));
@@ -32406,7 +33174,7 @@ async function replayReverseReplacement(s) {
 		physicalId: createResult.physicalId,
 		attributes: createResult.attributes ?? {},
 		properties: recordedPropertiesAfterReplayCreate(prevRecord, createResult)
-	}, secrets, prevRecord.properties);
+	}, secrets, prevRecord.properties, prevRecord.attributes);
 	if (!adoptedLiveNewResource) inlinePolicyWriters.record(op.logicalId, "create", stateResources[op.logicalId], false, createProvisionedBy);
 	await afterOp?.(op.logicalId);
 	let survivorReason;
@@ -32577,12 +33345,12 @@ async function replayRollbackUnbound(operations, stateResources, stackName, ctx,
 	inlinePolicyWriters.notePending(operations);
 	markDeleteFirstBlocked(operations, options.failedOperations);
 	const { createOps, otherOps } = partitionOps(operations);
-	for (let i = otherOps.length - 1; i >= 0; i--) {
+	for (const op of orderInlinePolicyReversals([...otherOps].reverse(), stateResources)) {
 		if (options.isInterrupted?.()) {
 			result.interrupted = true;
 			break;
 		}
-		await replaySingle(otherOps[i], stateResources, stackName, ctx, resolver, orphanLogicalIds, result, options.onOrphan, inlinePolicyWriters, options.afterOp, options.isInterrupted);
+		await replaySingle(op, stateResources, stackName, ctx, resolver, orphanLogicalIds, result, options.onOrphan, inlinePolicyWriters, options.afterOp, options.isInterrupted);
 	}
 	if (!result.interrupted && createOps.length > 0) {
 		const sorted = sortRollbackCreates(createOps, stateResources);
@@ -32966,7 +33734,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						}
 					], op.logicalId, logger, options.isInterrupted, secrets, mask));
 					if (revertFailedResult) recordNoEchoAttributeValues(revertFailedResult, secrets, desiredProps);
-					stateResources[op.logicalId] = maskRestoredNoEchoRecord(redactRollbackRecord(recordAfterRollbackUpdate(prev, revertFailedResult), secrets, prev.properties), prev, noEcho.substituted);
+					stateResources[op.logicalId] = maskRestoredNoEchoRecord(redactRollbackRecord(recordAfterRollbackUpdate(prev, revertFailedResult), secrets, prev.properties, prev.attributes), prev, noEcho.substituted);
 					if (updatePartialReason(revertFailedResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$1(prev.properties?.["Policies"], (op.attemptedProperties ?? current.properties)?.["Policies"]), revertVia);
 					const revertFailedPartial = updatePartialReason(revertFailedResult);
 					if (revertFailedPartial !== void 0) logger.warn(mask(`  Rollback: ${safe(op.logicalId)} reverted, ${updatePartialMessage(revertFailedPartial)}`));
@@ -33124,7 +33892,7 @@ async function deleteJournaledOrphans(orphans, stateResources, stackName, ctx, o
 	const inlinePolicyWriters = new RollbackInlinePolicyWriters();
 	const failedIds = total.failedLogicalIds;
 	const record = ctx.recordEvent;
-	const printing = journaledOrphanPrintingBag(orphans.segments.flatMap(({ ops, companions }) => [...companions ?? [], ...ops]), stateResources);
+	const printing = journaledOrphanPrintingBag(orphans.segments.flatMap(({ ops, companions }) => [...companions ?? [], ...ops]), stateResources, options.noEchoValues);
 	const maskedCtx = record === void 0 ? ctx : {
 		...ctx,
 		recordEvent: (event) => record(maskEventTextWithBoundBags(event))
@@ -33936,11 +34704,14 @@ function redactOperationsForJournal(operations) {
 		if (next.attemptedProperties) next.attemptedProperties = byPosition(redactSecretsForState(markSameGenerationBag({ ...next.attemptedProperties }), ownSecrets, templateProps));
 		if (next.previousState) {
 			const previous = next.previousState;
-			next.previousState = this.applyNoEchoPersist(op.logicalId, previous, scrubResourceRecord(previous, ownSecrets, void 0, STATE_SOURCED_READBACK_RULES), void 0, {}, void 0, true);
+			const adopted = adoptedOrphanRecords.get(this);
+			const loaded = adopted?.has(op.logicalId) ? adopted.get(op.logicalId) : previous;
+			next.previousState = this.applyNoEchoPersist(op.logicalId, previous, keepPersistedPlainRecordLeaves(scrubResourceRecord(previous, ownSecrets, void 0, STATE_SOURCED_READBACK_RULES), previous, loaded ?? {}), void 0, {}, void 0, true);
 		}
 		return next;
 	});
 }
+const adoptedOrphanRecords = /* @__PURE__ */ new WeakMap();
 async function adoptRollbackOrphans(currentState, effectiveTemplate) {
 	const records = currentState.orphans ?? [];
 	const named = orphanRecordsPrintingBag(records);
@@ -33967,8 +34738,11 @@ async function adoptRollbackOrphans(currentState, effectiveTemplate) {
 		logger: { debug: (m) => this.logger.debug(m) }
 	}));
 	for (const notice of plan.notices) this.logger.info(maskSecretsInText(notice, named));
+	const adoptedFrom = /* @__PURE__ */ new Map();
+	adoptedOrphanRecords.set(this, adoptedFrom);
 	if (plan.refusals.length > 0) throw new Error(`Deploy refused — cdkd left ${plan.refusals.length} resource(s) in AWS that it cannot safely re-adopt:\n  ${plan.refusals.map((r) => maskSecretsInText(r, named)).join("\n  ")}`);
 	for (const [logicalId, record] of Object.entries(plan.adopted)) {
+		adoptedFrom.set(logicalId, records.findLast((r) => r.logicalId === logicalId)?.state);
 		currentState.resources[logicalId] = record;
 		this.logger.info(`Adopting ${displayIdent(logicalId)} (${displayIdent(record.resourceType)}) left in AWS by an earlier rollback as ${displaySafe(maskSecretsInText(record.physicalId, named))}`);
 	}
@@ -34582,6 +35356,20 @@ async function drainObservedCaptures(stateResources) {
 	}
 	return installed;
 }
+const STANDALONE_SIBLING = {
+	Roles: {
+		type: "AWS::IAM::RolePolicy",
+		field: "RoleName"
+	},
+	Users: {
+		type: "AWS::IAM::UserPolicy",
+		field: "UserName"
+	},
+	Groups: {
+		type: "AWS::IAM::GroupPolicy",
+		field: "GroupName"
+	}
+};
 async function buildObservedCaptureSiblings(resourceType, capturedLogicalId, capturedPhysicalId, template, stateResources, stackName, parameterValues, conditions) {
 	if (this.options.captureObservedState !== true) return void 0;
 	const attachmentField = resourceType === "AWS::IAM::Role" ? "Roles" : resourceType === "AWS::IAM::User" ? "Users" : resourceType === "AWS::IAM::Group" ? "Groups" : void 0;
@@ -34591,11 +35379,12 @@ async function buildObservedCaptureSiblings(resourceType, capturedLogicalId, cap
 	let resolverContext;
 	const isRefTo = (value, logicalId) => typeof value === "object" && value !== null && !Array.isArray(value) && value["Ref"] === logicalId;
 	const siblings = {};
+	const standaloneType = STANDALONE_SIBLING[attachmentField];
 	for (const [lid, res] of Object.entries(resources)) {
 		if (lid === capturedLogicalId) continue;
-		if (res.Type !== "AWS::IAM::Policy") continue;
+		if (res.Type !== "AWS::IAM::Policy" && res.Type !== standaloneType.type) continue;
 		const props = res.Properties ?? {};
-		const attachments = props[attachmentField];
+		const attachments = res.Type === "AWS::IAM::Policy" ? props[attachmentField] : [props[standaloneType.field]];
 		if (!Array.isArray(attachments)) continue;
 		if (!attachments.some((a) => isRefTo(a, capturedLogicalId) || a === capturedPhysicalId)) continue;
 		let policyName = props["PolicyName"];
@@ -34808,9 +35597,9 @@ function deepEqualValue(a, b) {
 function diffLogMasker(diffSecrets, template, parameterValues, resources) {
 	const inherited = this.options.inheritedSecrets;
 	const noEchoValues = /* @__PURE__ */ new Map();
-	const noEchoNames = new Set(Object.entries(template.Parameters ?? {}).filter(([, definition]) => definition?.NoEcho === true).map(([name]) => name));
+	const noEchoNames = new Set(Object.entries(template.Parameters ?? {}).filter(([, definition]) => declaresNoEcho(definition)).map(([name]) => name));
 	const splitDelimiters = literalSplitDelimitersOf(template, noEchoNames);
-	for (const [name, definition] of Object.entries(template.Parameters ?? {})) if (definition?.NoEcho === true && Object.hasOwn(parameterValues, name)) recordLogOnlyParameterValue(noEchoValues, parameterValues[name], splitDelimiters);
+	for (const [name, definition] of Object.entries(template.Parameters ?? {})) if (declaresNoEcho(definition) && Object.hasOwn(parameterValues, name)) recordLogOnlyParameterValue(noEchoValues, parameterValues[name], splitDelimiters);
 	const stateNames = /* @__PURE__ */ new Map();
 	const union = createUnionSecretMasker([
 		diffSecrets,
@@ -34907,7 +35696,7 @@ function refuseRedactedAttributeReads(logicalId, resourceType, context) {
 		const producers = [...new Set(reads.map((read) => read.logicalId).filter((id) => !!id))];
 		throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: ${producers.map((id) => displayIdent(id)).join(", ")} declared ${reads.length === 1 ? "that attribute" : "those attributes"} NoEcho, so cdkd's recorded state holds only the redaction mask for ${reads.length === 1 ? "it" : "them"}, and cdkd does not re-run a producer to recover a value. Remedy: deploy a change to the producer in the SAME run as ${logicalId} (for a custom resource, change one of its properties, e.g. a nonce / version property, so its handler runs again and supplies the value), or stop declaring the value NoEcho.`, resourceType, logicalId);
 	}
-	throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the redaction mask there, and the value is not recoverable from state. There are three ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all, or cdkd deploy '**' when either is inside a CDK Stage) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The value holds the Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records — so a deploy that leaves the resource or output holding it unchanged reads the mask again, and a re-import does not recover it. Remedy: have this resource build the value itself from the SECRET's own reference (the {{resolve:secretsmanager:...}} or {{resolve:ssm-secure:...}} reference, or a {{resolve:ssm:...}} of a SecureString parameter, that the encoding was made from) under its own Fn::Base64, instead of reading it from another resource's attribute or another stack's output — not by a {{resolve:ssm:...}} read of a String parameter holding the encoding, which cdkd treats as public and would record in state in the clear. (3) The resource was adopted by 'cdkd import' through the Cloud Control fallback, which records only the type's Fn::GetAtt attributes (its read-only properties plus the writable ones CloudFormation also accepts in Fn::GetAtt) and masks the rest. Either the attribute named above is not one of them — CloudFormation would reject an Fn::GetAtt naming it too, so stop reading it — or cdkd could not read that schema and masked the whole model, which the import warned about when it happened. If that warning named a missing cloudformation:DescribeType permission, grant it first. See https://github.com/go-to-k/cdkd/issues/2449. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources, true)}`, resourceType, logicalId);
+	throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the redaction mask there, and the value is not recoverable from state. There are three ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all, or cdkd deploy '**' when either is inside a CDK Stage) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The value holds the Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records — so a deploy that leaves the resource or output holding it unchanged reads the mask again, and a re-import does not recover it. Remedy: have this resource build the value itself from the SECRET's own reference (the {{resolve:secretsmanager:...}} or {{resolve:ssm-secure:...}} reference, or a {{resolve:ssm:...}} of a SecureString parameter, that the encoding was made from) under its own Fn::Base64, instead of reading it from another resource's attribute or another stack's output — not by a {{resolve:ssm:...}} read of a String parameter holding the encoding, which cdkd treats as public and would record in state in the clear. (3) The resource is recorded through the Cloud Control fallback (by a deploy or by 'cdkd import'), which keeps in the clear only the Fn::GetAtt attributes it can vouch for and masks the rest. If the name above is not an Fn::GetAtt attribute CloudFormation accepts for that resource type, no record will ever hold it: stop reading it. If it is one, 'cdkd import' masked it because it could not vouch for the value, or could not read the schema and warned about it when it happened (if that warning named a missing cloudformation:DescribeType permission, grant it first); a deploy that creates or updates the resource records it, unless its value came from a secret. See https://github.com/go-to-k/cdkd/issues/2449. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources, true)}`, resourceType, logicalId);
 }
 function allRecordedSecrets() {
 	const all = /* @__PURE__ */ new Map();
@@ -35216,6 +36005,7 @@ async function createFirstThenDeleteOld(input) {
 async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, deleteProvider, deleteProperties, finalSnapshotIdentifier, updateReplacePolicy, secrets, deleteProvisionedBy, noEchoDeleteValues) {
 	let deleteResult = void 0;
 	let deleteFailed = false;
+	const inlinePolicyClaimed = isStandaloneInlinePolicyType(oldResourceType) ? this.inlinePolicyClaimedFor(oldResourceType, logicalId, this.deployStateResources) : void 0;
 	try {
 		deleteResult = await deleteProvider.delete(logicalId, currentResource.physicalId, oldResourceType, deleteProperties, {
 			expectedRegion: this.stackRegion,
@@ -35224,7 +36014,8 @@ async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentReso
 			...this.replacementDeleteContext(updateReplacePolicy),
 			recordedAttributes: currentResource.attributes,
 			recordedNoEchoLeaves: currentResource.noEchoLeaves,
-			...noEchoDeleteValues !== void 0 && { noEchoDeleteValues }
+			...noEchoDeleteValues !== void 0 && { noEchoDeleteValues },
+			...inlinePolicyClaimed && { inlinePolicyClaimed }
 		});
 	} catch (deleteError) {
 		const deleteMsg = maskSecretsInText(deleteError instanceof Error ? deleteError.message : String(deleteError), secrets);
@@ -38606,10 +39397,7 @@ function noEchoParameterNamesOf(template) {
 	const names = /* @__PURE__ */ new Set();
 	const declared = template?.Parameters;
 	if (declared === null || typeof declared !== "object") return names;
-	for (const [name, definition] of Object.entries(declared)) {
-		const noEcho = definition?.NoEcho;
-		if (noEcho === true || noEcho === "true") names.add(name);
-	}
+	for (const [name, definition] of Object.entries(declared)) if (declaresNoEcho(definition)) names.add(name);
 	return names;
 }
 function noEchoAttributeNamesOf(record) {
@@ -38846,6 +39634,185 @@ function noEchoComparisonForTemplate(template, knownConditions, values, resource
 	return (input) => compare(input);
 }
 
+//#endregion
+//#region src/analyzer/security-diff.ts
+function isSyntheticChange(pc) {
+	return pc.replacementPropagated === true || pc.inPlacePropagated === true || pc.noEchoPromoted === true;
+}
+function withChanges(base, changes, side) {
+	const props = { ...base ?? {} };
+	for (const pc of changes) {
+		const value = pc[side];
+		if (value === void 0) delete props[pc.path];
+		else props[pc.path] = value;
+	}
+	return props;
+}
+function securityDiffTemplates(changes, records) {
+	const oldResources = {};
+	const newResources = {};
+	const maskedChanges = [];
+	for (const change of changes) {
+		const id = change.logicalId;
+		const record = Object.hasOwn(records, id) ? records[id] : void 0;
+		switch (change.changeType) {
+			case "CREATE":
+				newResources[id] = {
+					Type: change.resourceType,
+					Properties: { ...change.desiredProperties ?? {} }
+				};
+				break;
+			case "DELETE":
+				oldResources[id] = {
+					Type: record?.resourceType ?? change.resourceType,
+					Properties: { ...change.currentProperties ?? record?.properties ?? {} }
+				};
+				break;
+			case "UPDATE": {
+				const pcs = change.propertyChanges ?? [];
+				const typeChange = pcs.find((pc) => pc.path === "Type");
+				const oldType = record?.resourceType ?? change.resourceType;
+				if (typeChange !== void 0 || oldType !== change.resourceType) {
+					oldResources[id] = {
+						Type: typeof typeChange?.oldValue === "string" ? typeChange.oldValue : oldType,
+						Properties: { ...change.currentProperties ?? record?.properties ?? {} }
+					};
+					newResources[id] = {
+						Type: change.resourceType,
+						Properties: { ...change.desiredProperties ?? {} }
+					};
+					break;
+				}
+				for (const pc of pcs) if (pc.maskedExpressionChanged === true && !isSyntheticChange(pc)) maskedChanges.push({
+					logicalId: id,
+					resourceType: change.resourceType,
+					path: pc.path
+				});
+				const real = pcs.filter((pc) => !isSyntheticChange(pc) && pc.maskedExpressionChanged !== true);
+				if (real.length === 0) break;
+				const base = change.currentProperties ?? record?.properties;
+				oldResources[id] = {
+					Type: oldType,
+					Properties: withChanges(base, real, "oldValue")
+				};
+				newResources[id] = {
+					Type: change.resourceType,
+					Properties: withChanges(base, real, "newValue")
+				};
+				break;
+			}
+		}
+	}
+	return {
+		oldTemplate: { Resources: oldResources },
+		newTemplate: { Resources: newResources },
+		maskedChanges
+	};
+}
+let cfnDiffModule;
+function loadCfnDiff() {
+	cfnDiffModule ??= import("@aws-cdk/cloudformation-diff").then((mod) => mod.default ?? mod);
+	return cfnDiffModule;
+}
+let cfnDiffUtilModule;
+function loadCfnDiffUtil() {
+	cfnDiffUtilModule ??= import("@aws-cdk/cloudformation-diff/lib/diff/util.js").then((mod) => mod.default ?? mod);
+	return cfnDiffUtilModule;
+}
+function isScrutinized(util, change) {
+	const model = util.loadResourceModel(change.resourceType);
+	const scrutinized = (value) => value !== void 0 && value !== "None";
+	return scrutinized(model?.scrutinizable) || scrutinized(model?.properties?.[change.path]?.scrutinizable);
+}
+async function diffSecurity(args) {
+	const templates = securityDiffTemplates(args.changes, args.records);
+	const { oldTemplate, newTemplate } = templates;
+	if (Object.keys(oldTemplate.Resources).length === 0 && Object.keys(newTemplate.Resources).length === 0 && templates.maskedChanges.length === 0) return {
+		broadening: false,
+		rendered: ""
+	};
+	try {
+		const cfnDiff = await loadCfnDiff();
+		const unjudged = templates.maskedChanges.length === 0 ? [] : await loadCfnDiffUtil().then((util) => templates.maskedChanges.filter((c) => isScrutinized(util, c)));
+		const diff = cfnDiff.fullDiff(structuredClone(oldTemplate), structuredClone(newTemplate));
+		const broadening = diff.permissionsBroadened || unjudged.length > 0;
+		const unjudgedNote = unjudged.length === 0 ? "" : "These changed values are masked, so whether they broaden permissions could not be evaluated:\n" + unjudged.map((c) => `  ${c.logicalId} (${c.resourceType}): ${c.path}\n`).join("");
+		if (!diff.permissionsBroadened && !diff.permissionsAnyChanges) return {
+			broadening,
+			rendered: terminalSafe(unjudgedNote)
+		};
+		let table;
+		try {
+			const shown = args.secretMask === void 0 ? void 0 : withholdSecrets(templates, args.secretMask());
+			const shownDiff = shown === void 0 || shown.masked === 0 ? diff : cfnDiff.fullDiff(shown.templates.oldTemplate, shown.templates.newTemplate);
+			table = "";
+			cfnDiff.formatSecurityChanges({ write(chunk) {
+				table += String(chunk);
+				return true;
+			} }, shownDiff, logicalIdToPath(args.records, args.template));
+			if (shown !== void 0 && shown.masked > 0) table += "(Values that hold a secret are shown as ***.)\n";
+		} catch {
+			table = "The security changes are not shown: they could not be checked for secrets.\n";
+		}
+		return {
+			broadening,
+			rendered: terminalSafe(table + unjudgedNote)
+		};
+	} catch (error) {
+		throw new CdkdError(safeMsg`Could not compute the security diff of stack ${args.stackName}, so whether its changes broaden permissions is unknown: ${error instanceof Error ? error.message : String(error)}`, "SECURITY_DIFF_FAILED");
+	}
+}
+function holdsSecret(value, mask) {
+	if (typeof value === "string") return mask(value) !== value;
+	if (typeof value === "number" || typeof value === "boolean") return mask(String(value)) !== String(value);
+	if (Array.isArray(value)) return value.some((v) => holdsSecret(v, mask));
+	if (value !== null && typeof value === "object") return Object.entries(value).some(([k, v]) => mask(k) !== k || holdsSecret(v, mask));
+	return false;
+}
+function maskLeaves(value, mask, keys = true) {
+	if (Array.isArray(value)) return value.map((v) => maskLeaves(v, mask, keys));
+	if (value !== null && typeof value === "object") {
+		const entries = Object.entries(value).map(([k, v]) => [keys && mask(k) !== k ? "***" : k, maskLeaves(v, mask, keys)]);
+		if (new Set(entries.map(([k]) => k)).size < entries.length) return "***";
+		return Object.fromEntries(entries);
+	}
+	return holdsSecret(value, mask) ? "***" : value;
+}
+function withholdSecrets(templates, mask) {
+	const copy = structuredClone(templates);
+	let masked = 0;
+	const ids = /* @__PURE__ */ new Set([...Object.keys(copy.oldTemplate.Resources), ...Object.keys(copy.newTemplate.Resources)]);
+	for (const id of ids) {
+		const oldProps = copy.oldTemplate.Resources[id]?.Properties;
+		const newProps = copy.newTemplate.Resources[id]?.Properties;
+		const keys = /* @__PURE__ */ new Set([...Object.keys(oldProps ?? {}), ...Object.keys(newProps ?? {})]);
+		for (const key of keys) {
+			const oldValue = oldProps?.[key];
+			const newValue = newProps?.[key];
+			const newHolds = holdsSecret(newValue, mask);
+			if (!newHolds && !holdsSecret(oldValue, mask)) continue;
+			masked++;
+			if (newProps !== void 0 && newValue !== void 0) newProps[key] = maskLeaves(newValue, mask);
+			if (oldProps === void 0 || oldValue === void 0) continue;
+			if (newHolds && JSON.stringify(oldValue) !== JSON.stringify(newValue)) oldProps[key] = maskLeaves(oldValue, () => "***", false);
+			else oldProps[key] = maskLeaves(oldValue, mask);
+		}
+	}
+	return {
+		templates: copy,
+		masked
+	};
+}
+function logicalIdToPath(records, template) {
+	const map = {};
+	for (const [id, record] of Object.entries(records)) if (typeof record?.constructPath === "string") map[id] = record.constructPath;
+	for (const [id, resource] of Object.entries(template?.Resources ?? {})) {
+		const path = (resource?.Metadata)?.["aws:cdk:path"];
+		if (typeof path === "string") map[id] = path;
+	}
+	return map;
+}
+
 //#endregion
 //#region src/deployment/resource-deadline.ts
 var InvalidResourceDeadlineError = class extends Error {
@@ -38953,7 +39920,16 @@ async function requireDeploymentApproval(args) {
 	const changes = [...args.changes].filter((c) => c.changeType !== "NO_CHANGE" && !isNoEchoPromotionOnly(c));
 	const destructiveChanges = findDestructiveChanges(args.stackName, changes, args.records, args.template, new Set(args.recreateTargetIds ?? []));
 	const onlyNestedUpdates = changes.every((c) => c.changeType === "UPDATE" && c.resourceType === NESTED_STACK_TYPE$1);
-	if (!(level === "destructive" ? destructiveChanges.length > 0 : changes.length > 0 && !onlyNestedUpdates)) return false;
+	const security = level === "broadening" ? await diffSecurity({
+		stackName: args.stackName,
+		changes,
+		records: args.records,
+		template: args.template,
+		secretMask: args.secretMask
+	}).catch((error) => {
+		throw error instanceof Error ? markNonRetryable(error) : error;
+	}) : void 0;
+	if (!(level === "destructive" ? destructiveChanges.length > 0 : level === "broadening" ? security?.broadening === true : changes.length > 0 && !onlyNestedUpdates)) return false;
 	const count = (type) => changes.filter((c) => c.changeType === type).length;
 	if (enclosingDeadlineExpired()) throw approvalAfterTimeout(args.stackName);
 	let approved;
@@ -38966,7 +39942,8 @@ async function requireDeploymentApproval(args) {
 				update: count("UPDATE"),
 				delete: count("DELETE")
 			},
-			destructiveChanges
+			destructiveChanges,
+			...security !== void 0 && { securityChanges: security.rendered }
 		}));
 	} catch (error) {
 		throw error instanceof Error ? markNonRetryable(error) : error;
@@ -38986,7 +39963,7 @@ async function checkDestructivePlan(args) {
 async function approveLateReplacement(args) {
 	const level = args.options.requireApproval ?? "never";
 	const approve = args.options.approveDeployment;
-	if (level === "never" || approve === void 0) return true;
+	if (level === "never" || level === "broadening" || approve === void 0) return true;
 	if (enclosingDeadlineExpired()) return false;
 	try {
 		const approved = await whileEnclosingDeadlinesPaused(() => approve({
@@ -39245,6 +40222,24 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	if (resourceType === "AWS::CloudFormation::Stack") recordPassedNoEchoParameters(updateSecrets, desiredProps["Parameters"], this.noEchoPositionSources(stateResources));
 	if (fingerprintSources !== void 0 && resourceType === "AWS::CloudFormation::Stack") recordPassedParameterClasses(updateSecrets, await classifyPassedParameters(desiredProps["Parameters"], fingerprintSources));
 	const desiredForSkipCheck = maskAtCoordinates(redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps), comparisonCoordinates);
+	const legacyDesired = withoutPhysicalNameCopies(updateSecrets, () => maskAtCoordinates(redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps), comparisonCoordinates));
+	const copies = physicalNameCopiesOf.get(updateSecrets);
+	const regionEvidence = getCurrentProducerRegions()?.();
+	const recordOwnSecrets = copies !== void 0 && copies.size > 0 && regionEvidence?.complete === true && recordHoldsEmbeddedReference(currentResource) ? await resolveRecordSecrets({
+		properties: currentResource.properties,
+		attributes: currentResource.attributes
+	}, (token, own) => this.resolver.resolveDynamicReferences(token, persistedTokenResolverContext(own, regionEvidence.regions))) : void 0;
+	const embeddedRewrites = [...embeddedPhysicalNameRewrites(updateSecrets), ...recordOwnSecrets === void 0 || recordOwnSecrets.size === 0 ? [] : embeddedPhysicalNameRewrites(updateSecrets, recordOwnSecrets)];
+	const repairable = [currentProps, currentResource.properties].filter((bag) => bag !== null && typeof bag === "object");
+	for (const bag of new Set(repairable)) for (const key of Object.keys(bag)) {
+		const repaired = repairEmbeddedPhysicalNamesTowards(repairPhysicalNameCopyLeaves(bag[key], legacyDesired[key], desiredForSkipCheck[key]), desiredForSkipCheck[key], embeddedRewrites);
+		if (repaired !== bag[key]) bag[key] = repaired;
+	}
+	const attributes = currentResource.attributes;
+	if (attributes !== void 0 && attributes !== null && embeddedRewrites.length > 0) for (const key of Object.keys(attributes)) {
+		const repaired = replaceEmbeddedPhysicalNameRewrites(attributes[key], embeddedRewrites);
+		if (repaired !== attributes[key]) attributes[key] = repaired;
+	}
 	const allowedSilentDrops = this.providerRegistry.getAllowedUnsupportedProperties?.();
 	const desiredForSkipCheckAsWritten = currentResource.provisionedBy !== "cc-api" && allowedSilentDrops ? withoutAcceptedSilentDropProperties(resourceType, desiredForSkipCheck, allowedSilentDrops, currentResource.properties) : desiredForSkipCheck;
 	const allowedForRecord = allowedSilentDrops ?? /* @__PURE__ */ new Set();
@@ -39666,6 +40661,14 @@ function recordPreviousNoEchoLeaves(registry, stored, desiredLeaves, resolution,
 		if (partlyMasked !== leaf && partlyMasked !== "***") recordLogOnlyValue(registry, partlyMasked);
 	}
 }
+function recordHoldsEmbeddedReference(record) {
+	const walk = (node) => {
+		if (typeof node === "string") return node.includes("{{resolve:") && !isSingleDynamicReferenceToken(node);
+		if (node === null || typeof node !== "object") return false;
+		return Object.values(node).some(walk);
+	};
+	return walk(record.properties) || walk(record.attributes);
+}
 
 //#endregion
 //#region src/deployment/deploy-engine/update-replace.ts
@@ -40699,6 +41702,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 	const concurrency = this.options.concurrency;
 	this.deployChanges = changes;
 	const newResources = { ...currentState.resources };
+	this.deployStateResources = newResources;
 	const actualCounts = {
 		created: 0,
 		updated: 0,
@@ -42077,7 +43081,7 @@ function conditionFingerprint(template, name, inputOf) {
 			inputs[parameter] = { token: input.expression };
 			hasToken = true;
 		} else {
-			if (isPlainObject(definition) && definition["NoEcho"] === true) return void 0;
+			if (declaresNoEcho(definition)) return void 0;
 			if (typeof input.value !== "string") return void 0;
 			if (carriesDynamicReference(input.value)) return void 0;
 			if (coerceParameterTypedValue(input.value, type) !== input.value) return void 0;
@@ -42760,7 +43764,8 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			changes: changes.values(),
 			records: currentState.resources,
 			template: effectiveTemplate,
-			recreateTargetIds: recreateTargetIdsFor(this.options.recreateTargets, stackName)
+			recreateTargetIds: recreateTargetIdsFor(this.options.recreateTargets, stackName),
+			secretMask: () => this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues, currentState.resources)
 		})) this.generatedNameGuard?.noteApprovalPrompted();
 		this.generatedNameGuard?.recordPlannedIntents();
 		this.resolver.resetPhysicalIdFallbackCount();
@@ -43094,6 +44099,7 @@ var DeployEngine = class {
 	oldDeletedBeforeCreate = /* @__PURE__ */ new Set();
 	healBaseline = {};
 	deployChanges = /* @__PURE__ */ new Map();
+	deployStateResources = {};
 	stackRecordsView = void 0;
 	inlinePolicyWriters = /* @__PURE__ */ new Map();
 	attributeHeals = /* @__PURE__ */ new Map();
@@ -43110,7 +44116,9 @@ var DeployEngine = class {
 		this.exportIndexStore = exportIndexStore;
 		this.resolver = new IntrinsicFunctionResolver(stackRegion, {
 			strictGetAtt: options.strictGetAtt ?? false,
-			cfnFallback: options.cfnFallback ?? true
+			cfnFallback: options.cfnFallback ?? true,
+			...options.producerLookup && { producerLookup: options.producerLookup },
+			...options.consumerAccount && { consumerAccount: options.consumerAccount }
 		});
 		this.options.concurrency = options.concurrency ?? 10;
 		this.options.dryRun = options.dryRun ?? false;
@@ -43158,6 +44166,7 @@ var DeployEngine = class {
 		this.oldDeletedBeforeCreate = /* @__PURE__ */ new Set();
 		this.healBaseline = {};
 		this.deployChanges = /* @__PURE__ */ new Map();
+		this.deployStateResources = {};
 		this.inlinePolicyWriters = /* @__PURE__ */ new Map();
 		this.attributeHeals = /* @__PURE__ */ new Map();
 		this.healedAttributes = /* @__PURE__ */ new Map();
@@ -43227,7 +44236,7 @@ var DeployEngine = class {
 		};
 	}
 	inlinePolicyClaimedFor(resourceType, logicalId, stateResources) {
-		if (resourceType !== "AWS::IAM::Policy" && !isInlinePolicyPrincipalType(resourceType)) return;
+		if (resourceType !== "AWS::IAM::Policy" && !isInlinePolicyPrincipalType(resourceType) && !isStandaloneInlinePolicyType(resourceType)) return;
 		const args = {
 			selfLogicalId: logicalId,
 			writers: this.inlinePolicyWriters,
@@ -43374,5 +44383,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { getPriorAttempts as $, isWarmThroughputDecrease as $a, derivePartitionAndUrlSuffix as $c, malformedResourceEntriesWarning as $i, reserveStackCreateToken as $n, isUncertifiedBaselineMaskPosition as $o, AWS_CREDENTIAL_ENV_KEYS as $r, ensureAssetStorage as $s, orphanDeleteNeedsIdentity as $t, noEchoExactEchoLeavesOf as A, repairMalformedOrphansForReadOnly as Aa, getDefaultStateBucketName as Ac, UNREADABLE_RESOURCES_MAP_ROW as Ai, maskEventTextWithBoundBags as An, passedNoEchoParametersOf as Ao, deleteSkipReason as Ar, acceptedCreateOnlyDropsOf as As, isHandledOrphan as At, beginDeleteWait as B, findSilentDropProperties as Ba, stateBucketExistenceConfirmed as Bc, malformedExportNamesWarning as Bi, ccRoutedFinalSnapshotError as Bn, printingCorpusOf as Bo, DiffCalculator as Br, orphansCarriedFrom as Bs, withStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedResourcePropertiesForExport as Ca, warnFinchArgvExposure as Cc, withSharedDrainBudget as Ci, collectPublishedOutputNames as Cn, maskAtCoordinates as Co, customResourceResponseExpirationWarning as Cr, CrossPrefixReadError as Cs, revertedNestedRowIds as Ct, withResourceDeadline as D, refuseMalformedResourcesForExport as Da, getDockerImageBySourceHash as Dc, STATE_REGION_DIVERGED as Di, DEFAULT_RESOURCE_WARN_AFTER_MS as Dn, noEchoCoordinatesOf as Do, UNSPECIFIED_SKIP_REASON as Dr, isAccessDenied$1 as Ds, withNestedStackContext as Dt, serviceTokenBlockingReason as E, refuseMalformedResourcesForDestroy as Ea, AssetManifestLoader as Ec, JSON_LISTING_HOLE_VALUE as Ei, DEFAULT_RESOURCE_TIMEOUT_MS as En, maskedLeafCoordinatesOf as Eo, unchangedBehindSecretReference as Er, crossPrefixDeniedWarning as Es, getCurrentNestedStackContext as Et, isProtectionValueActive as F, unpreviewableOrphanRecords as Fa, resolveCaptureObservedState as Fc, hasReadableOutputs as Fi, storedSecretNameNeedles as Fn, carryLogOnlyValues as Fo, ec2InstanceProtectionSite as Fr, hasUnverifiableParameterRefusal as Fs, replayFailedOperations as Ft, DELETE_INDEX_WAIT_PROCEED_NOTE as G, findReplacedReadersOfRecreateTargets as Ga, MIGRATE_TMP_PREFIX as Gc, malformedOrphanRecordsRefusalMessage as Gi, unsupportedFinalSnapshotError as Gn, errorCauseChain as Go, producerRegionsFromState as Gr, WorkGraph as Gs, isReplacementOrphan as Gt, deleteBudgetKey as H, withoutSilentDropProperties as Ha, ssmResolvedValueType as Hc, malformedLocalOutputsWarning as Hi, effectiveDeletionPolicy as Hn, recordLogOnlyValue as Ho, IntrinsicFunctionResolver as Hr, AssetPublisher as Hs, recordAfterRollbackUpdate as Ht, perType as I, unreadableOrphanRecords as Ia, resolveSkipPrefix as Ic, hasReadableResources as Ii, extractDeploymentEventError as In, createUnionSecretMasker as Io, isTerminationProtectionPropagationError as Ir, importableOutputKeys as Is, replayRollback as It, waitForIndexesSettled as J, isStatefulRecreateTargetForReplace as Ja, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Jc, malformedOrphansRefusalMessage as Ji, findDestructiveChanges as Jn, markSameGenerationBag as Jo, assertFlagRoleArn as Jr, loadPublishableAssetManifest as Js, recheckFailedPlan as Jt, INDEX_SETTLE_POLL_INTERVAL_MS as K, shownType as Ka, findLargeInlineResources as Kc, malformedOrphanRecordsWarning as Ki, maskingRetryLogger as Kn, maskSecretsInError as Ko, regionLessSecretName as Kr, buildAssetRedirectMap as Ks, planFailedOps as Kt, readProtection as L, unreadableResourceEntries as La, resolveStateBucketWithDefault as Lc, isReadableOrphanRecord as Li, ATOMIC_FINAL_SNAPSHOT_TYPES as Ln, hasMaskableValues as Lo, observeThenDisableInstanceApiTermination as Lr, importableOutputs as Ls, awaitInFlightSibling as Lt, recordedProtectionEvidence as M, repairMalformedResourceEntriesForReadOnly as Ma, loadCdkJson as Mc, deployRefusesOrphanRowsReason as Mi, secretNamePrintingBag as Mn, readsNoEchoSource as Mo, isWaitAbandonedError as Mr, exportNamesCarriedFrom as Ms, loadJournaledOrphans as Mt, recordedProtectionNote as N, repairMalformedResourcePropertiesForReadOnly as Na, resolveApp as Nc, displayLogicalId as Ni, secretNamedRecordNeedles as Nn, valueAtCoordinate as No, markWaitAbandoned as Nr, hasReadableExportSet as Ns, makeForeignHolderScan as Nt, noEchoAttributeNamesOf as O, refuseMalformedState as Oa, Synthesizer as Oc, STATE_RESOURCES_MALFORMED as Oi, completedReplayEntries as On, noEchoLeavesOf as Oo, deleteIndeterminateGuards as Or, isNotImplemented as Os, deleteJournaledOrphans as Ot, PROTECTION_PROPERTY_BY_TYPE as P, repairMalformedResourcesForReadOnly as Pa, resolveAutoAssetStorage as Pc, hasReadableOrphans as Pi, stateSecretNameNeedles as Pn, liveMatchesUnresolvedTokenFrame as Po, disableInstanceApiTermination as Pr, hasReasonlessBaselineRefusal as Ps, sameJournaledOrphans as Pt, isTruthyCfnBoolean as Q, coerceWarmThroughput as Qa, canonicalizeRegion as Qc, malformedRenderedContainersWarning as Qi, ledgerForStack as Qn, dynamicReferenceTokens as Qo, sendableAssumeRoleCommand as Qr, assertAssetBucketRegion as Qs, seedsDeleteFirstGuard as Qt, DynamoDBGlobalTableProvider as R, withheldAccountClause as Ra, resolveStateBucketWithDefaultAndSource as Rc, isReadableResourceEntry as Ri, PRE_DELETE_SNAPSHOT_TYPES as Rn, literalSplitDelimitersOf as Ro, reDisableInstanceApiTermination as Rr, isReadableBag as Rs, destroyStackRecordsView as Rt, keptForReadoption as S, refuseMalformedResourcePropertiesForDrift as Sa, runDockerStreaming as Sc, parseWebACLArn as Si, collectDeclaredOutputNames as Sn, isMarkedCoordinate as So, applyCustomResourceResponseExpiration as Sr, rebuildClientForBucketRegion as Ss, revertNestedChildFromJournal as St, findServiceTokenRefusals as T, refuseMalformedResourcesForDeploy as Ta, stripControlChars as Tc, passedParameterClassesOf as Ti, bindingSkippedOutputs as Tn, maskWholeValue as To, slowCcOperationTimeoutMs as Tr, applyCrossPrefixScan as Ts, collectNestedChildUnaddressed as Tt, resolveDynamoDbDeleteBudgetClock as U, NO_CC_HANDLERS_REASON as Ua, CFN_TEMPLATE_BODY_LIMIT as Uc, malformedLocalResourceEntriesWarning as Ui, isFinalSnapshotError as Un, shareLogOnlyValues as Uo, poisonRenderedSpellingsCollidingIn as Ur, isSensitiveAttributeName as Us, demoteSupersededOrphans as Ut, compensateRemovedDeletionProtection as V, unwrittenCreateOnlyReplacement as Va, warnDeprecatedNoPrefixCliFlag as Vc, malformedExportSourceWarning as Vi, createPreDeleteFinalSnapshot as Vn, recordLogOnlyParameterValue as Vo, INTRINSIC_KEYS as Vr, shouldRetainResource as Vs, removeProtectionTypeList as Vt, resolveDynamoDbDeleteBudgetMs as W, hasNoCloudControlHandlers as Wa, CFN_TEMPLATE_URL_LIMIT as Wc, malformedLocalResourcesWarning as Wi, refusesFinalSnapshot as Wn, createSecretMasker as Wo, classifyReplaySecretRegion as Wr, stringifyValue as Ws, isJournaledOrphan as Wt, S3_AUTO_DELETE_OBJECTS_TAG as X, renderStatefulReason as Xa, expectedOwnerParam as Xc, malformedOutputsRefusalMessage as Xi, RollbackInlinePolicyWriters as Xn, scrubResourceRecord as Xo, explicitRoleArnOrThrow as Xr, AssetModeResolver as Xs, replacementNeverSwapped as Xt, ECR_AUTO_DELETE_IMAGES_TAG as Y, isStatefulRecreateTargetSync as Ya, decodeListingKey as Yc, malformedOrphansWarning as Yi, formatDestructiveChange as Yn, redactSecretsForState as Yo, assertSendableRoleArn as Yr, rewriteTemplateAssetReferences as Ys, recordUnderIdIsNotOwn as Yt, hasCdkAutoDeleteTag as Z, WARM_THROUGHPUT_MEMBERS as Za, PARTITION_TABLE as Zc, malformedOutputsWarning as Zi, earliestDefined as Zn, DYNAMIC_REFERENCE_TOKEN_SCAN as Zo, isIamRoleArn as Zr, BOOTSTRAP_MARKER_PREFIX as Zs, resolveReplacementOldType as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedResourceEntriesForDestroy as _a, isMalformedEnvKey as _c, keepsSecretReferenceToken as _i, carriedExportAliasExposure as _n, lambdaFunctionNameForMask as _o, readsNoEchoDeleteValues as _r, WHOLE_DYNAMIC_REFERENCE_PATTERN as _s, displacedPhysicalIdShown as _t, findNestedTemplateTreeDefect as a, refuseDivergentRecordRegionForDestroy as aa, validateContainerRepoName as ac, s3BucketDomainName as ai, hasPlainPrototype$1 as al, redactedDeleteAddressFields as an, configIntegerRefusal as ao, readTagList as ar, carriesSecretMask as as, gray as at, lookupEachName as b, refuseMalformedResourceEntriesForOrphan as ba, redactedDockerCause as bc, isStalePlaceholderArnAttribute as bi, isWholeDynamicReferenceValue as bn, TemplateParser as bo, withPrintingSecrets as br, isLockInfoExpired as bs, nestedChildStackName as bt, renderNestedTemplateTreeDefect as c, refuseMalformedOrphanRecordsForDestroy as ca, resolveDockerContextDirectory as cc, s3BucketWebsiteUrl as ci, absoluteAssemblyPathEscape as cl, updatePartialReason as cn, replayWarn as co, tagPlanWarning as cr, recordMaskOnlyValuesIn as cs, yellow as ct, conditionInputsFrom as d, refuseMalformedOrphansForOrphan as da, describeDockerFailure as dc, parameterTypeMayLoseSecretIdentity as di, renderAssemblyPathEscape as dl, WITHHELD_NAME_DISPLAY as dn, requireConfigString as do, CC_BROKEN_REASON as dr, recordProvenPublicExpression as ds, reachableDivergentParameters as dt, malformedResourcePropertiesWarning as ea, getBootstrapMarkerKey as ec, applyCallerIdentityCredentials as ei, AssemblyReader as el, findNestedStackTypeChanges as en, toCfnInteger as eo, withCreateTokenLedger as er, pathCrossesDottedKey as es, markRefusedBeforeApplying as et, parentSuppliedValues as f, refuseMalformedOutputs as fa, dockerSpawnEnvWithSensitive as fc, getAccountInfo as fi, resolveAssemblyPath as fl, displayTextOrWithheld as fn, prefetchCreateOnlyPropertyPaths as fo, ProviderRegistry as fr, wholeStringLeavesOf as fs, resourcesNamingDeclaredParameter as ft, mergeNoChangeOutputs as g, refuseMalformedResourceEntriesForDeploy as ga, isDockerClientEnvKey as gc, isNamelessDynamicReferenceError as gi, secretSafeKeyDisplay as gn, canonicalLambdaFunctionName as go, TemplateNoEchoReresolver as gr, TEMPLATE_SOURCED_RULES as gs, displacedOpClause as gt, keptWholeReasonText as h, refuseMalformedResourceEntries as ha, getDockerCmd as hc, carriesFetchableDynamicReference as hi, secretBearingStateKeyWarning as hn, withRetry as ho, wouldReturnToSdkProvider as hr, STATE_SOURCED_READBACK_RULES as hs, NESTED_PENDING_PARENT_REASON as ht, childTemplateLoader as i, previewableOrphanRecords as ia, validateAssetBucketName as ic, s3BucketArn as ii, hasOwnKey as il, isRedactedRecordedValue as in, configBooleanRefusal as io, planTagDiff as ir, recoverMaskedOutput as is, cyan as it, noEchoParameterNamesOf as j, repairMalformedOutputsForReadOnly as ja, getLegacyStateBucketName as jc, accountArgs as ji, orphanRecordsPrintingBag as jn, readbackPathFor as jo, withIndeterminateGuard as jr, describeRegionValueKind as js, journaledOrphanLines as jt, noEchoComparisonForTemplate as k, repairMalformedOrphanRecordsForReadOnly as ka, synthesisStatusMessage as kc, UNREADABLE_ORPHANS_CONTAINER_ROW as ki, journaledOrphanPrintingBag as kn, noEchoOutputsComparison as ko, deleteLeftInPlace as kr, splitImportedOps as ks, dropFailedHint as kt, templateIdentity as l, refuseMalformedOrphans as la, describeDockerCapturedOutput as lc, coerceParameterTypedValue as li, describeFileReadFailure as ll, DeploymentEventsReader as ln, requireConfigArray as lo, definedAttributes as lr, recordNoEchoAttributeValues as ls, computeParameterTaint as lt, isSecretBearingReferenceString as m, refuseMalformedResourceAttributesForOrphan as ma, formatDockerLoginError as mc, carriesDynamicReference as mi, resolveBucketRegion as ml, secretBearing as mn, describeTypeWithThrottleRetry as mo, isCustomResource as mr, STATE_SOURCED_CROSS_GENERATION_RULES as ms, planOrphanAdoption as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedScrubResourceEntriesRefusalMessage as na, parseBootstrapMarker as nc, envCredentialsAreAssumedRole as ni, processStackMessages as nl, inheritProducerRegions as nn, coerceCfnBoolean as no, DBPROXY_TAGS_WHAT as nr, inheritNestedStackParameterAssociations as ns, createReadOnlyAttributeHealerFactory as nt, isAbsoluteAssetPath as o, refuseMalformedNestedChildOutputs as oa, buildDenyExternalAccessPolicy as oc, s3BucketDualStackDomainName as oi, nullPrototypeRecord as ol, redactedDeleteAddressSkip as on, configStringRefusal as oo, refuseMalformedDesiredTags as or, provenPublicValue as os, green as ot, readRecordedConditionVerdicts as p, refuseMalformedOutputsForDestroy as pa, finchSecretArgvRefusal as pc, isImpossibleEmptyStoredAttribute as pi, clearBucketRegionCache as pl, exportAliasCollisionScrubWarning as pn, templateResourceTypes as po, ccBrokenReason as pr, STATE_SOURCED_BASELINE_RULES as ps, makeSiblingClaimReader as pt, deleteTableWithIndexBusyRetry as q, MULTI_REGION_RECREATE_BLOCKED_TYPES as qa, uploadCfnTemplate as qc, malformedOrphanRowsKeptWarning as qi, constructPathOf as qn, maskSecretsInText as qo, applyRoleArnIfSet as qr, createAssetRedirectResolver as qs, planRollback as qt, computeImplicitDeleteEdges as r, malformedStateRefusalMessage as ra, readBootstrapMarkerBody as rc, isSettledInstanceState as ri, defineOwnKey as rl, REDACTED_DELETE_ADDRESS_SKIP_REASON as rn, coerceCfnInteger as ro, DBPROXY_TAG_OPTIONS as rr, recordNestedStackParameterExpressions as rs, bold as rt, listNestedTemplateRows as s, refuseMalformedOrphanRecords as sa, buildDockerImage as sc, s3BucketRegionalDomainName as si, ownValue as sl, updatePartialMessage as sn, readConfigString as so, tagMapAsList as sr, recordMaskOnlyValue as ss, red as st, DeployEngine as t, malformedResourcesWarning as ta, isCrossRegionRedirect as tc, callerEnvCredentials as ti, StageLoadError as tl, getCurrentProducerRegions as tn, toFiniteNumber as to, acquireIdempotencyToken as tr, identityKeyFor as ts, formatResourceLine as tt, conditionFingerprint as u, refuseMalformedOrphansForDestroy as ua, describeDockerExecFailure as uc, isUnboundTemplateParameter as ui, displayAssemblyPath as ul, DeploymentEventsStore as un, requireConfigObject as uo, stringifyIfAssigned as ur, recordNoEchoParameterFreshValue as us, namesAnyDeclaredParameter as ut, chunks as v, refuseMalformedResourceEntriesForImport as va, partitionSensitiveEnv as vc, AWS_NO_VALUE as vi, exportNameNoEchoParameters as vn, sameLambdaFunctionAddress as vo, isCustomResourceType as vr, isSingleDynamicReferenceToken as vs, dropSettledNestedJournals as vt, deferredServiceTokenWarning as w, refuseMalformedResourcePropertiesForOrphan as wa, escapeRegExp$3 as wc, parameterInputsFor as wi, isExportAliasCollision as wn, maskReadbackAtCoordinates as wo, CloudControlProvider as wr, CrossPrefixScanCache as ws, withNestedRevertRun as wt, withApiLimit as x, refuseMalformedResourcePropertiesForDestroy as xa, runDockerForeground as xc, refStateLookupFromResource as xi, noEchoParameterValueSeed as xn, canonicalCoordinates as xo, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as xr, S3StateBackend as xs, recordDisplacedSkips as xt, isAccessDeniedError as y, refuseMalformedResourceEntriesForImportSave as ya, redactDockerArgvValues as yc, cfnRefValueFromPhysicalId as yi, exportNameSecretExposure as yn, DagBuilder as yo, getCurrentResourceSecrets as yr, LockManager as ys, getNestedRevertRun as yt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as z, findActionableSilentDrops as za, resolveUseCdkBootstrapAssets as zc, malformedDriftResourcePropertiesWarning as zi, buildFinalSnapshotIdentifier as zn, logOnlyValueCount as zo, reEnableInstanceApiTermination as zr, orphansAfterRollback as zs, getStackRecords as zt };
-//# sourceMappingURL=deploy-engine-dvf1UDuo.js.map
+export { isTruthyCfnBoolean as $, isStatefulRecreateTargetForReplace as $a, CFN_TEMPLATE_URL_LIMIT as $c, malformedOrphansRefusalMessage as $i, ledgerForStack as $n, markSameGenerationBag as $o, assertSendableRoleArn as $r, stringifyValue as $s, seedsDeleteFirstGuard as $t, noEchoComparisonForTemplate as A, refuseMalformedResourcesForDeploy as Aa, runDockerForeground as Ac, declaresNoEcho as Ai, journaledOrphanPrintingBag as An, maskWholeValue as Ao, deleteIndeterminateGuards as Ar, S3StateBackend as As, dropFailedHint as At, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as B, unpreviewableOrphanRecords as Ba, getLegacyStateBucketName as Bc, hasReadableOutputs as Bi, PRE_DELETE_SNAPSHOT_TYPES as Bn, carryLogOnlyValues as Bo, reDisableInstanceApiTermination as Br, describeRegionValueKind as Bs, getStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedResourceEntriesForImport as Ca, formatDockerLoginError as Cc, cfnRefValueFromPhysicalId as Ci, resolveBucketRegion as Cl, collectDeclaredOutputNames as Cn, sameLambdaFunctionAddress as Co, applyCustomResourceResponseExpiration as Cr, STATE_SOURCED_CROSS_GENERATION_RULES as Cs, revertNestedChildFromJournal as Ct, withResourceDeadline as D, refuseMalformedResourcePropertiesForDrift as Da, partitionSensitiveEnv as Dc, withSharedDrainBudget as Di, DEFAULT_RESOURCE_TIMEOUT_MS as Dn, isMarkedCoordinate as Do, unchangedBehindSecretReference as Dr, isSingleDynamicReferenceToken as Ds, getCurrentNestedStackContext as Dt, serviceTokenBlockingReason as E, refuseMalformedResourcePropertiesForDestroy as Ea, isMalformedEnvKey as Ec, parseWebACLArn as Ei, bindingSkippedOutputs as En, canonicalCoordinates as Eo, slowCcOperationTimeoutMs as Er, WHOLE_DYNAMIC_REFERENCE_PATTERN as Es, collectNestedChildUnaddressed as Et, PROTECTION_PROPERTY_BY_TYPE as F, repairMalformedOrphansForReadOnly as Fa, AssetManifestLoader as Fc, UNREADABLE_RESOURCES_MAP_ROW as Fi, secretNamedRecordNeedles as Fn, passedNoEchoParametersOf as Fo, markWaitAbandoned as Fr, crossPrefixDeniedWarning as Fs, sameJournaledOrphans as Ft, resolveDynamoDbDeleteBudgetMs as G, findSilentDropProperties as Ga, resolveSkipPrefix as Gc, malformedExportNamesWarning as Gi, isFinalSnapshotError as Gn, printingCorpusOf as Go, poisonRenderedSpellingsCollidingIn as Gr, importableOutputKeys as Gs, isJournaledOrphan as Gt, compensateRemovedDeletionProtection as H, unreadableResourceEntries as Ha, resolveApp as Hc, isReadableOrphanRecord as Hi, ccRoutedFinalSnapshotError as Hn, hasMaskableValues as Ho, DiffCalculator as Hr, hasReadableExportSet as Hs, removeProtectionTypeList as Ht, isProtectionValueActive as I, repairMalformedOutputsForReadOnly as Ia, getDockerImageBySourceHash as Ic, accountArgs as Ii, stateSecretNameNeedles as In, readbackPathFor as Io, disableInstanceApiTermination as Ir, isAccessDenied$1 as Is, replayFailedOperations as It, deleteTableWithIndexBusyRetry as J, NO_CC_HANDLERS_REASON as Ja, resolveUseCdkBootstrapAssets as Jc, malformedLocalResourceEntriesWarning as Ji, maskingRetryLogger as Jn, shareLogOnlyValues as Jo, regionLessSecretName as Jr, orphansAfterRollback as Js, planRollback as Jt, DELETE_INDEX_WAIT_PROCEED_NOTE as K, unwrittenCreateOnlyReplacement as Ka, resolveStateBucketWithDefault as Kc, malformedExportSourceWarning as Ki, refusesFinalSnapshot as Kn, recordLogOnlyParameterValue as Ko, classifyReplaySecretRegion as Kr, importableOutputs as Ks, isReplacementOrphan as Kt, perType as L, repairMalformedResourceEntriesForReadOnly as La, Synthesizer as Lc, deployRefusesOrphanRowsReason as Li, storedSecretNameNeedles as Ln, readsNoEchoSource as Lo, ec2InstanceProtectionSite as Lr, isNotImplemented as Ls, replayRollback as Lt, noEchoParameterNamesOf as M, refuseMalformedResourcesForExport as Ma, warnFinchArgvExposure as Mc, STATE_REGION_DIVERGED as Mi, orphanRecordsPrintingBag as Mn, noEchoCoordinatesOf as Mo, deleteSkipReason as Mr, CrossPrefixReadError as Ms, journaledOrphanLines as Mt, recordedProtectionEvidence as N, refuseMalformedState as Na, escapeRegExp$3 as Nc, STATE_RESOURCES_MALFORMED as Ni, secretNamePrintingBag as Nn, noEchoLeavesOf as No, withIndeterminateGuard as Nr, CrossPrefixScanCache as Ns, loadJournaledOrphans as Nt, diffSecurity as O, refuseMalformedResourcePropertiesForExport as Oa, redactDockerArgvValues as Oc, parameterInputsFor as Oi, DEFAULT_RESOURCE_WARN_AFTER_MS as On, maskAtCoordinates as Oo, RollbackInlinePolicyWriters as Or, LockManager as Os, withNestedStackContext as Ot, recordedProtectionNote as P, repairMalformedOrphanRecordsForReadOnly as Pa, stripControlChars as Pc, UNREADABLE_ORPHANS_CONTAINER_ROW as Pi, secretNamePrintingBags as Pn, noEchoOutputsComparison as Po, isWaitAbandonedError as Pr, applyCrossPrefixScan as Ps, makeForeignHolderScan as Pt, hasCdkAutoDeleteTag as Q, MULTI_REGION_RECREATE_BLOCKED_TYPES as Qa, CFN_TEMPLATE_BODY_LIMIT as Qc, malformedOrphanRowsKeptWarning as Qi, earliestDefined as Qn, maskSecretsInText as Qo, assertFlagRoleArn as Qr, isSensitiveAttributeName as Qs, resolveReplacementOldType as Qt, readProtection as R, repairMalformedResourcePropertiesForReadOnly as Ra, synthesisStatusMessage as Rc, displayLogicalId as Ri, extractDeploymentEventError as Rn, valueAtCoordinate as Ro, isTerminationProtectionPropagationError as Rr, splitImportedOps as Rs, awaitInFlightSibling as Rt, keptForReadoption as S, refuseMalformedResourceEntriesForDestroy as Sa, finchSecretArgvRefusal as Sc, AWS_NO_VALUE as Si, clearBucketRegionCache as Sl, noEchoParameterValueSeed as Sn, lambdaFunctionNameForMask as So, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Sr, STATE_SOURCED_BASELINE_RULES as Ss, recordDisplacedSkips as St, findServiceTokenRefusals as T, refuseMalformedResourceEntriesForOrphan as Ta, isDockerClientEnvKey as Tc, refStateLookupFromResource as Ti, isExportAliasCollision as Tn, TemplateParser as To, CloudControlProvider as Tr, TEMPLATE_SOURCED_RULES as Ts, withNestedRevertRun as Tt, deleteBudgetKey as U, withheldAccountClause as Ua, resolveAutoAssetStorage as Uc, isReadableResourceEntry as Ui, createPreDeleteFinalSnapshot as Un, literalSplitDelimitersOf as Uo, INTRINSIC_KEYS as Ur, hasReasonlessBaselineRefusal as Us, recordAfterRollbackUpdate as Ut, beginDeleteWait as V, unreadableOrphanRecords as Va, loadCdkJson as Vc, hasReadableResources as Vi, buildFinalSnapshotIdentifier as Vn, createUnionSecretMasker as Vo, reEnableInstanceApiTermination as Vr, exportNamesCarriedFrom as Vs, withStackRecords as Vt, resolveDynamoDbDeleteBudgetClock as W, findActionableSilentDrops as Wa, resolveCaptureObservedState as Wc, malformedDriftResourcePropertiesWarning as Wi, effectiveDeletionPolicy as Wn, logOnlyValueCount as Wo, IntrinsicFunctionResolver as Wr, hasUnverifiableParameterRefusal as Ws, demoteSupersededOrphans as Wt, ECR_AUTO_DELETE_IMAGES_TAG as X, findReplacedReadersOfRecreateTargets as Xa, warnDeprecatedNoPrefixCliFlag as Xc, malformedOrphanRecordsRefusalMessage as Xi, findDestructiveChanges as Xn, errorCauseChain as Xo, refuseUnreadableCdkCrossAccountRefs as Xr, shouldRetainResource as Xs, recordUnderIdIsNotOwn as Xt, waitForIndexesSettled as Y, hasNoCloudControlHandlers as Ya, stateBucketExistenceConfirmed as Yc, malformedLocalResourcesWarning as Yi, constructPathOf as Yn, createSecretMasker as Yo, producerLookupOver as Yr, orphansCarriedFrom as Ys, recheckFailedPlan as Yt, S3_AUTO_DELETE_OBJECTS_TAG as Z, shownType as Za, ssmResolvedValueType as Zc, malformedOrphanRecordsWarning as Zi, formatDestructiveChange as Zn, maskSecretsInError as Zo, applyRoleArnIfSet as Zr, AssetPublisher as Zs, replacementNeverSwapped as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedOutputs as _a, resolveDockerContextDirectory as _c, isImpossibleEmptyStoredAttribute as _i, absoluteAssemblyPathEscape as _l, secretSafeKeyDisplay as _n, prefetchCreateOnlyPropertyPaths as _o, TemplateNoEchoReresolver as _r, recordMaskOnlyValuesIn as _s, displacedOpClause as _t, findNestedTemplateTreeDefect as a, malformedResourcePropertiesWarning as aa, AssetModeResolver as ac, callerEnvCredentials as ai, expectedOwnerParam as al, isRedactedRecordedValue as an, toCfnInteger as ao, planTagDiff as ar, DYNAMIC_REFERENCE_TOKEN_SCAN as as, cyan as at, lookupEachName as b, refuseMalformedResourceEntries as ba, describeDockerFailure as bc, isNamelessDynamicReferenceError as bi, renderAssemblyPathEscape as bl, exportNameSecretExposure as bn, withRetry as bo, getCurrentResourceSecrets as br, recordProvenPublicExpression as bs, getNestedRevertRun as bt, renderNestedTemplateTreeDefect as c, malformedStateRefusalMessage as ca, ensureAssetStorage as cc, s3BucketArn as ci, derivePartitionAndUrlSuffix as cl, updatePartialMessage as cn, coerceCfnInteger as co, tagMapAsList as cr, pathCrossesDottedKey as cs, red as ct, conditionInputsFrom as d, refuseMalformedNestedChildOutputs as da, parseBootstrapMarker as dc, s3BucketRegionalDomainName as di, processStackMessages as dl, DeploymentEventsStore as dn, configStringRefusal as do, stringifyIfAssigned as dr, recordNestedStackParameterExpressions as ds, namesAnyDeclaredParameter as dt, malformedOrphansWarning as ea, WorkGraph as ec, explicitRoleArnOrThrow as ei, MIGRATE_TMP_PREFIX as el, orphanDeleteNeedsIdentity as en, isStatefulRecreateTargetSync as eo, reserveStackCreateToken as er, redactSecretsForState as es, getPriorAttempts as et, parentSuppliedValues as f, refuseMalformedOrphanRecords as fa, readBootstrapMarkerBody as fc, s3BucketWebsiteUrl as fi, defineOwnKey as fl, WITHHELD_NAME_DISPLAY as fn, readConfigString as fo, CC_BROKEN_REASON as fr, recoverMaskedOutput as fs, reachableDivergentParameters as ft, mergeNoChangeOutputs as g, refuseMalformedOrphansForOrphan as ga, buildDockerImage as gc, getAccountInfo as gi, ownValue as gl, secretBearingStateKeyWarning as gn, requireConfigString as go, wouldReturnToSdkProvider as gr, recordMaskOnlyValue as gs, NESTED_PENDING_PARENT_REASON as gt, keptWholeReasonText as h, refuseMalformedOrphansForDestroy as ha, buildDenyExternalAccessPolicy as hc, parameterTypeMayLoseSecretIdentity as hi, nullPrototypeRecord as hl, secretBearing as hn, requireConfigObject as ho, isCustomResource as hr, provenPublicValue as hs, planOrphanAdoption as ht, childTemplateLoader as i, malformedResourceEntriesWarning as ia, rewriteTemplateAssetReferences as ic, applyCallerIdentityCredentials as ii, decodeListingKey as il, REDACTED_DELETE_ADDRESS_SKIP_REASON as in, isWarmThroughputDecrease as io, DBPROXY_TAG_OPTIONS as ir, recordPhysicalNameCopy as is, bold as it, noEchoExactEchoLeavesOf as j, refuseMalformedResourcesForDestroy as ja, runDockerStreaming as jc, JSON_LISTING_HOLE_VALUE as ji, maskEventTextWithBoundBags as jn, maskedLeafCoordinatesOf as jo, deleteLeftInPlace as jr, rebuildClientForBucketRegion as js, isHandledOrphan as jt, noEchoAttributeNamesOf as k, refuseMalformedResourcePropertiesForOrphan as ka, redactedDockerCause as kc, passedParameterClassesOf as ki, completedReplayEntries as kn, maskReadbackAtCoordinates as ko, UNSPECIFIED_SKIP_REASON as kr, isLockInfoExpired as ks, deleteJournaledOrphans as kt, templateIdentity as l, previewableOrphanRecords as la, getBootstrapMarkerKey as lc, s3BucketDomainName as li, AssemblyReader as ll, updatePartialReason as ln, configBooleanRefusal as lo, tagPlanWarning as lr, identityKeyFor as ls, yellow as lt, isSecretBearingReferenceString as m, refuseMalformedOrphans as ma, validateContainerRepoName as mc, isUnboundTemplateParameter as mi, hasPlainPrototype$1 as ml, exportAliasCollisionScrubWarning as mn, requireConfigArray as mo, ccBrokenReason as mr, carriesSecretMask as ms, makeSiblingClaimReader as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedOutputsWarning as na, createAssetRedirectResolver as nc, sendableAssumeRoleCommand as ni, uploadCfnTemplate as nl, getCurrentProducerRegions as nn, WARM_THROUGHPUT_MEMBERS as no, acquireIdempotencyToken as nr, withPhysicalNameCopies as ns, formatResourceLine as nt, isAbsoluteAssetPath as o, malformedResourcesWarning as oa, BOOTSTRAP_MARKER_PREFIX as oc, envCredentialsAreAssumedRole as oi, PARTITION_TABLE as ol, redactedDeleteAddressFields as on, toFiniteNumber as oo, readTagList as or, dynamicReferenceTokens as os, gray as ot, readRecordedConditionVerdicts as p, refuseMalformedOrphanRecordsForDestroy as pa, validateAssetBucketName as pc, coerceParameterTypedValue as pi, hasOwnKey as pl, displayTextOrWithheld as pn, replayWarn as po, ProviderRegistry as pr, splitGetAttStringForm as ps, resourcesNamingDeclaredParameter as pt, INDEX_SETTLE_POLL_INTERVAL_MS as q, withoutSilentDropProperties as qa, resolveStateBucketWithDefaultAndSource as qc, malformedLocalOutputsWarning as qi, unsupportedFinalSnapshotError as qn, recordLogOnlyValue as qo, producerRegionsFromState as qr, isReadableBag as qs, planFailedOps as qt, computeImplicitDeleteEdges as r, malformedRenderedContainersWarning as ra, loadPublishableAssetManifest as rc, AWS_CREDENTIAL_ENV_KEYS as ri, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as rl, inheritProducerRegions as rn, coerceWarmThroughput as ro, DBPROXY_TAGS_WHAT as rr, withoutPhysicalNameCopies as rs, createReadOnlyAttributeHealerFactory as rt, listNestedTemplateRows as s, malformedScrubResourceEntriesRefusalMessage as sa, assertAssetBucketRegion as sc, isSettledInstanceState as si, canonicalizeRegion as sl, redactedDeleteAddressSkip as sn, coerceCfnBoolean as so, refuseMalformedDesiredTags as sr, isUncertifiedBaselineMaskPosition as ss, green as st, DeployEngine as t, malformedOutputsRefusalMessage as ta, buildAssetRedirectMap as tc, isIamRoleArn as ti, findLargeInlineResources as tl, findNestedStackTypeChanges as tn, renderStatefulReason as to, withCreateTokenLedger as tr, scrubResourceRecord as ts, markRefusedBeforeApplying as tt, conditionFingerprint as u, refuseDivergentRecordRegionForDestroy as ua, isCrossRegionRedirect as uc, s3BucketDualStackDomainName as ui, StageLoadError as ul, DeploymentEventsReader as un, configIntegerRefusal as uo, definedAttributes as ur, inheritNestedStackParameterAssociations as us, computeParameterTaint as ut, chunks as v, refuseMalformedOutputsForDestroy as va, describeDockerCapturedOutput as vc, carriesDynamicReference as vi, describeFileReadFailure as vl, carriedExportAliasExposure as vn, templateResourceTypes as vo, readsNoEchoDeleteValues as vr, recordNoEchoAttributeValues as vs, displacedPhysicalIdShown as vt, deferredServiceTokenWarning as w, refuseMalformedResourceEntriesForImportSave as wa, getDockerCmd as wc, isStalePlaceholderArnAttribute as wi, collectPublishedOutputNames as wn, DagBuilder as wo, customResourceResponseExpirationWarning as wr, STATE_SOURCED_READBACK_RULES as ws, revertedNestedRowIds as wt, withApiLimit as x, refuseMalformedResourceEntriesForDeploy as xa, dockerSpawnEnvWithSensitive as xc, keepsSecretReferenceToken as xi, resolveAssemblyPath as xl, isWholeDynamicReferenceValue as xn, canonicalLambdaFunctionName as xo, withPrintingSecrets as xr, wholeStringLeavesOf as xs, nestedChildStackName as xt, isAccessDeniedError as y, refuseMalformedResourceAttributesForOrphan as ya, describeDockerExecFailure as yc, carriesFetchableDynamicReference as yi, displayAssemblyPath as yl, exportNameNoEchoParameters as yn, describeTypeWithThrottleRetry as yo, isCustomResourceType as yr, recordNoEchoParameterFreshValue as ys, dropSettledNestedJournals as yt, DynamoDBGlobalTableProvider as z, repairMalformedResourcesForReadOnly as za, getDefaultStateBucketName as zc, hasReadableOrphans as zi, ATOMIC_FINAL_SNAPSHOT_TYPES as zn, liveMatchesUnresolvedTokenFrame as zo, observeThenDisableInstanceApiTermination as zr, acceptedCreateOnlyDropsOf as zs, destroyStackRecordsView as zt };
+//# sourceMappingURL=deploy-engine-CJTG3tft.js.map