@go-to-k/cdkd 0.297.0 → 0.298.1

package/dist/{deploy-engine-dvf1UDuo.js → deploy-engine-A-Ys_mhE.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js";
-import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
-import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-Cz2tPxXk.js";
+import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, H as truncateCodePoints, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as terminalSafe, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
+import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-CwKiK9nS.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-DE-djeB0.js";
+import { t as getCdkdVersion } from "./version-CItAaDXu.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -637,6 +637,7 @@ var AssemblyReader = class {
 			if (!resolvedNested.contained) throw new SynthesisError(`Stack ${displayStackName(stackName)} nested-stack ${displayIdent(logicalId)} has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which ${renderAssemblyPathEscape(resolvedNested, assemblyDir)}`);
 			nestedTemplates[logicalId] = resolvedNested.path;
 		}
+		const lookupRoleArn = props?.lookupRole?.arn;
 		return {
 			stackName,
 			displayName: artifact.displayName ?? stackName,
@@ -649,6 +650,7 @@ var AssemblyReader = class {
 			account: env?.account !== "unknown-account" ? env?.account : void 0,
 			...props?.terminationProtection !== void 0 && { terminationProtection: props.terminationProtection },
 			...Object.keys(nestedTemplates).length > 0 && { nestedTemplates },
+			...typeof lookupRoleArn === "string" && { lookupRoleArn },
 			messages: collectStackMessages(assemblyDir, artifact)
 		};
 	}
@@ -7437,6 +7439,23 @@ function positionByCrossStackSource(bag, source, secrets) {
 	return certifiedExpressionForLeaf(secrets, association, bag);
 }
 
+//#endregion
+//#region src/deployment/secret-redaction/physical-name-copies.ts
+const physicalNameCopiesOf = /* @__PURE__ */ new WeakMap();
+function recordPhysicalNameCopy(secrets, physicalId) {
+	if (physicalId === "") return;
+	sideSetOf(physicalNameCopiesOf, secrets).add(physicalId);
+}
+function physicalNameSpans(names, value) {
+	const spans = [];
+	if (names === void 0) return spans;
+	for (const name of names) for (let at = value.indexOf(name); at !== -1; at = value.indexOf(name, at + 1)) spans.push({
+		start: at,
+		end: at + name.length
+	});
+	return spans;
+}
+
 //#endregion
 //#region src/deployment/secret-redaction/fresh-noecho.ts
 function embedsFreshNoEchoValue(text, secrets, freshClass) {
@@ -7505,9 +7524,14 @@ function isStrictlyInsideASpan(spans, start, end) {
 }
 function embedsNeedleOutsideReferences(leaf, needles, secrets) {
 	let spans;
+	let names;
 	for (const needle of needles) for (let at = leaf.indexOf(needle); at >= 0; at = leaf.indexOf(needle, at + 1)) {
 		spans ??= isDynamicReferenceString(leaf) ? resolvableReferenceSpans(leaf, new Set(secrets.values())) : [];
-		if (!isStrictlyInsideASpan(spans, at, at + needle.length)) return true;
+		if (isStrictlyInsideASpan(spans, at, at + needle.length)) continue;
+		names ??= physicalNameSpans(physicalNameCopiesOf.get(secrets), leaf);
+		const end = at + needle.length;
+		if (names.some((n) => n.start <= at && end <= n.end)) continue;
+		return true;
 	}
 	return false;
 }
@@ -8424,17 +8448,22 @@ function redactSecretsForStatePasses(bag, secrets, source, rules) {
 	}
 	const regex = buildNeedleRegex(substringNeedlesOf(secrets));
 	const wholeValueExpr = (s) => s === "" ? void 0 : secrets.get(s);
+	const physicalNames = physicalNameCopiesOf.get(secrets);
 	let vouched;
 	const vouchedExpressions = () => vouched ??= new Set(secrets.values());
 	const scanLeaf = (value, needles) => {
 		const spans = isDynamicReferenceString(value) ? resolvableReferenceSpans(value, vouchedExpressions()) : [];
+		const names = physicalNameSpans(physicalNames, value);
 		return value.replace(needles, (match, offset) => {
 			if (isStrictlyInsideASpan(spans, offset, offset + match.length)) return match;
+			const end = offset + match.length;
+			if (names.some((n) => n.start <= offset && end <= n.end)) return match;
 			return secrets.get(match) ?? "***";
 		});
 	};
 	const walk = (value) => {
 		if (typeof value === "string") {
+			if (physicalNames?.has(value) === true) return value;
 			const whole = wholeValueExpr(value);
 			if (whole !== void 0) return whole;
 			if (isSingleDynamicReferenceToken(value) && spanNamesResolvableService(value)) return value;
@@ -8467,6 +8496,133 @@ function scrubResourceRecord(record, secrets, sourceProperties, observedRules) {
 	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets, sourceProperties ?? next.properties, observedRules ?? (sourceProperties !== void 0 ? TEMPLATE_SOURCED_RULES : secrets.size === 0 && isSameGenerationBag(record.observedProperties) ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES));
 	return next;
 }
+function withoutPhysicalNameCopies(secrets, run) {
+	const names = physicalNameCopiesOf.get(secrets);
+	if (names === void 0) return run();
+	physicalNameCopiesOf.delete(secrets);
+	try {
+		return run();
+	} finally {
+		physicalNameCopiesOf.set(secrets, names);
+	}
+}
+function withPhysicalNameCopies(secrets, ids, run) {
+	const previous = physicalNameCopiesOf.get(secrets);
+	const names = new Set(previous);
+	for (const id of ids) if (id !== "") names.add(id);
+	physicalNameCopiesOf.set(secrets, names);
+	try {
+		return run();
+	} finally {
+		if (previous === void 0) physicalNameCopiesOf.delete(secrets);
+		else physicalNameCopiesOf.set(secrets, previous);
+	}
+}
+function repairPhysicalNameCopyLeaves(stored, legacy, current) {
+	if (typeof stored === "string") return typeof legacy === "string" && typeof current === "string" && stored === legacy && current !== legacy ? current : stored;
+	if (Array.isArray(stored)) {
+		if (!Array.isArray(legacy) || !Array.isArray(current)) return stored;
+		if (legacy.length !== stored.length || current.length !== stored.length) return stored;
+		let changed = false;
+		const out = stored.map((item, i) => {
+			const next = repairPhysicalNameCopyLeaves(item, legacy[i], current[i]);
+			if (next !== item) changed = true;
+			return next;
+		});
+		return changed ? out : stored;
+	}
+	if (stored !== null && typeof stored === "object") {
+		if (legacy === null || typeof legacy !== "object" || Array.isArray(legacy)) return stored;
+		if (current === null || typeof current !== "object" || Array.isArray(current)) return stored;
+		const l = legacy;
+		const c = current;
+		let out;
+		for (const [key, value] of Object.entries(stored)) {
+			if (!Object.hasOwn(l, key) || !Object.hasOwn(c, key)) continue;
+			const next = repairPhysicalNameCopyLeaves(value, l[key], c[key]);
+			if (next !== value) {
+				out ??= { ...stored };
+				out[key] = next;
+			}
+		}
+		return out ?? stored;
+	}
+	return stored;
+}
+function embeddedPhysicalNameRewrites(secrets, legacySecrets = secrets) {
+	const names = physicalNameCopiesOf.get(secrets);
+	if (names === void 0) return [];
+	const pairs = [];
+	withoutPhysicalNameCopies(legacySecrets, () => {
+		for (const name of names) {
+			const legacy = redactSecretsForState(name, legacySecrets);
+			if (typeof legacy === "string" && legacy !== name && legacy.includes("{{resolve:") && !isSingleDynamicReferenceToken(legacy) && !legacy.includes("***")) pairs.push([legacy, name]);
+		}
+	});
+	return pairs;
+}
+function replaceEmbeddedPhysicalNameRewrites(value, pairs) {
+	if (pairs.length === 0) return value;
+	if (typeof value === "string") {
+		let next = value;
+		for (const [legacy, name] of pairs) next = next.split(legacy).join(name);
+		return next;
+	}
+	if (Array.isArray(value)) {
+		let changed = false;
+		const out = value.map((item) => {
+			const next = replaceEmbeddedPhysicalNameRewrites(item, pairs);
+			if (next !== item) changed = true;
+			return next;
+		});
+		return changed ? out : value;
+	}
+	if (value !== null && typeof value === "object") {
+		let out;
+		for (const [key, item] of Object.entries(value)) {
+			const next = replaceEmbeddedPhysicalNameRewrites(item, pairs);
+			if (next !== item) {
+				out ??= { ...value };
+				out[key] = next;
+			}
+		}
+		return out ?? value;
+	}
+	return value;
+}
+function repairEmbeddedPhysicalNamesTowards(stored, target, pairs) {
+	if (pairs.length === 0) return stored;
+	if (typeof stored === "string") {
+		if (typeof target !== "string" || stored === target) return stored;
+		const repaired = replaceEmbeddedPhysicalNameRewrites(stored, pairs);
+		return repaired === target ? repaired : stored;
+	}
+	if (Array.isArray(stored)) {
+		if (!Array.isArray(target) || target.length !== stored.length) return stored;
+		let changed = false;
+		const out = stored.map((item, i) => {
+			const next = repairEmbeddedPhysicalNamesTowards(item, target[i], pairs);
+			if (next !== item) changed = true;
+			return next;
+		});
+		return changed ? out : stored;
+	}
+	if (stored !== null && typeof stored === "object") {
+		if (target === null || typeof target !== "object" || Array.isArray(target)) return stored;
+		const t = target;
+		let out;
+		for (const [key, value] of Object.entries(stored)) {
+			if (!Object.hasOwn(t, key)) continue;
+			const next = repairEmbeddedPhysicalNamesTowards(value, t[key], pairs);
+			if (next !== value) {
+				out ??= { ...stored };
+				out[key] = next;
+			}
+		}
+		return out ?? stored;
+	}
+	return stored;
+}
 
 //#endregion
 //#region src/deployment/secret-redaction/positions.ts
@@ -9587,7 +9743,7 @@ function noEchoParametersReadBy(node, sources) {
 }
 function noEchoComparison(options) {
 	const { sources, values, minNeedleLength, publicTokens } = options;
-	return ({ templateProperties, desired, current, record }) => {
+	return ({ templateProperties, desired, current }) => {
 		const coordinates = noEchoCoordinatesOf(templateProperties, desired, sources);
 		const needles = [];
 		for (const name of noEchoParametersReadBy(templateProperties, sources)) {
@@ -9623,10 +9779,6 @@ function noEchoComparison(options) {
 			};
 			masked = walk(masked);
 		}
-		if (noEchoLeavesOf(record) !== void 0) return {
-			desired: masked,
-			current
-		};
 		const witnessed = witnessNormalize(current, desired, masked);
 		const shown = maskAtCoordinatesWith(witnessed.current, witnessed.differing, PREVIOUS_NOECHO_VALUE);
 		return {
@@ -17450,6 +17602,15 @@ function conditionsAssumedFalse(conditions) {
 	return assumedConditionNames.get(conditions) ?? /* @__PURE__ */ new Set();
 }
 
+//#endregion
+//#region src/deployment/noecho-declared.ts
+function isNoEchoDeclared(noEcho) {
+	return noEcho === true || noEcho === "true";
+}
+function declaresNoEcho(definition) {
+	return definition !== null && typeof definition === "object" && isNoEchoDeclared(definition.NoEcho);
+}
+
 //#endregion
 //#region src/deployment/masked-property-fingerprints.ts
 const FINGERPRINT_LAYOUT$1 = 1;
@@ -17526,7 +17687,7 @@ function parameterInputsFor(args) {
 			continue;
 		}
 		const value = values[name];
-		let secret = isPlainObject$2(definition) && (definition["NoEcho"] === true || definition["NoEcho"] === "true") || carriesSecretValue(value, []);
+		let secret = isPlainObject$2(definition) && declaresNoEcho(definition) || carriesSecretValue(value, []);
 		if (!secret && args.nestedChild === true && args.supplied !== void 0) {
 			if (Object.hasOwn(args.supplied, name)) {
 				const passed = args.passedClasses?.get(name);
@@ -17951,7 +18112,7 @@ function childParameterInputs(template, passed) {
 	const inputs = /* @__PURE__ */ new Map();
 	for (const name of Object.keys(declared)) {
 		const definition = declared[name];
-		if (isPlainObject$2(definition) && (definition["NoEcho"] === true || definition["NoEcho"] === "true")) inputs.set(name, { kind: "secret" });
+		if (isPlainObject$2(definition) && declaresNoEcho(definition)) inputs.set(name, { kind: "secret" });
 		else if (passed.has(name)) {
 			const passedClass = passed.get(name);
 			inputs.set(name, passedClass === "clean" ? {
@@ -18960,7 +19121,7 @@ function inheritedSecretsCarriedBy(value, inherited) {
 	return carried;
 }
 function stringifyParameterForLog(paramDef, value) {
-	if (paramDef?.NoEcho === true) return "<redacted>";
+	if (declaresNoEcho(paramDef)) return "<redacted>";
 	return stringifyValue(value);
 }
 function boundAltered(original, shown, maxCodePoints) {
@@ -18994,6 +19155,80 @@ function quotedRender(rendered, quote, described = "(not shown: it is not a plai
 	return QUOTABLE_RENDER.test(rendered) ? `${quote}${rendered}${quote}` : described;
 }
 
+//#endregion
+//#region src/deployment/secret-region-classification.ts
+const REPLAY_SECRET_SERVICES = /* @__PURE__ */ new Set([
+	"secretsmanager",
+	"ssm",
+	"ssm-secure"
+]);
+function secretsManagerSecretId(inner) {
+	const afterService = inner.substring(15);
+	let stringIdx = afterService.indexOf(":SecretString:");
+	let binaryIdx = afterService.indexOf(":SecretBinary:");
+	if (stringIdx < 0 && afterService.endsWith(":SecretString")) stringIdx = afterService.length - 13;
+	if (binaryIdx < 0 && afterService.endsWith(":SecretBinary")) binaryIdx = afterService.length - 13;
+	const delimiterIdx = stringIdx >= 0 && binaryIdx >= 0 ? Math.min(stringIdx, binaryIdx) : stringIdx >= 0 ? stringIdx : binaryIdx;
+	return delimiterIdx >= 0 ? afterService.substring(0, delimiterIdx) : afterService;
+}
+function ssmParameterName(inner) {
+	const serviceEnd = inner.indexOf(":");
+	return serviceEnd < 0 ? "" : inner.substring(serviceEnd + 1);
+}
+function arnRegion(secretId) {
+	if (!secretId.startsWith("arn:")) return void 0;
+	const region = secretId.split(":")[3];
+	return region ? region : void 0;
+}
+function producerRegionsFromState(state) {
+	const seen = /* @__PURE__ */ new Set();
+	const regions = [];
+	for (const entry of [...state.imports ?? [], ...state.outputReads ?? []]) {
+		const canonical = canonicalizeRegion(entry.sourceRegion);
+		if (!canonical || seen.has(canonical)) continue;
+		seen.add(canonical);
+		regions.push(entry.sourceRegion);
+	}
+	return regions;
+}
+function secretReferenceName(expression) {
+	const inner = expression.startsWith("{{resolve:") ? expression.slice(10, -2) : void 0;
+	if (inner === void 0) return void 0;
+	const service = inner.split(":")[0];
+	if (service === void 0 || !REPLAY_SECRET_SERVICES.has(service)) return void 0;
+	const secretName = service === "secretsmanager" ? secretsManagerSecretId(inner) : ssmParameterName(inner);
+	return secretName ? secretName : void 0;
+}
+function regionLessSecretName(expression) {
+	const secretName = secretReferenceName(expression);
+	return secretName !== void 0 && arnRegion(secretName) === void 0 ? secretName : void 0;
+}
+function classifyReplaySecretRegion(expression, consumerRegion, importedProducerRegions) {
+	const secretName = secretReferenceName(expression);
+	if (!secretName) return { kind: "local" };
+	const named = arnRegion(secretName);
+	if (named !== void 0) return canonicalizeRegion(named) === canonicalizeRegion(consumerRegion) ? { kind: "local" } : {
+		kind: "named-region",
+		secretName,
+		region: named
+	};
+	const seen = /* @__PURE__ */ new Set();
+	const foreignProducerRegions = [];
+	for (const candidate of importedProducerRegions ?? []) {
+		const canonical = canonicalizeRegion(candidate);
+		if (!canonical || canonical === canonicalizeRegion(consumerRegion)) continue;
+		if (seen.has(canonical)) continue;
+		seen.add(canonical);
+		foreignProducerRegions.push(candidate);
+	}
+	if (foreignProducerRegions.length === 0) return { kind: "local" };
+	return {
+		kind: "ambiguous",
+		secretName,
+		foreignProducerRegions
+	};
+}
+
 //#endregion
 //#region src/utils/s3-endpoints.ts
 const S3_WEBSITE_ENDPOINT_LEGACY_DASH_REGIONS = /* @__PURE__ */ new Set([
@@ -19581,7 +19816,7 @@ async function resolveGetAtt(getAtt, context) {
 				redacted: isSensitiveAttributeName(attributeName)
 			})}`);
 			if (reresolvesNestedReference) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${this.displayLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
-			return notedFlatValue;
+			return await this.reresolveRecordedReferences(notedFlatValue, logicalId, context, `${logicalId}.${this.displayLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 		}
 		if (attributeName.includes(".")) {
 			const parts = attributeName.split(".");
@@ -19597,7 +19832,7 @@ async function resolveGetAtt(getAtt, context) {
 					structured: isStructured(cursor),
 					redacted: isSensitiveAttributeName(attributeName)
 				})}`);
-				return notedCursor;
+				return await this.reresolveRecordedReferences(notedCursor, logicalId, context, `${logicalId}.${this.displayLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 			}
 		}
 	}
@@ -19642,6 +19877,7 @@ function noteAttributeSecrecy(logicalId, attributeName, value, context) {
 	const served = override !== void 0 && Object.hasOwn(override, attributeName);
 	if (served) value = override[attributeName];
 	recordSecretNamedRead(logicalId, value, context);
+	recordProducerSecretPairs(logicalId, value, context);
 	const declared = context.noEchoAttributeResources?.get(logicalId);
 	if ((served || declared === true || declared !== void 0 && declared.has(attributeName)) && context.recordedSecretValues) recordFreshNoEchoValuesIn(value, context.recordedSecretValues, void 0, this.publicNoEchoTokens(context, logicalId));
 	if (context.redactedAttributeReads !== void 0 && carriesSecretMask(value)) {
@@ -19658,6 +19894,24 @@ function noteAttributeSecrecy(logicalId, attributeName, value, context) {
 	}
 	return value;
 }
+function recordProducerSecretPairs(logicalId, value, context) {
+	const bag = context.recordedSecretValues;
+	if (bag === void 0 || context.producerSecrets === void 0) return;
+	const producer = context.producerSecrets(logicalId);
+	if (producer === void 0 || producer === bag || producer.size === 0) return;
+	const preRun = context.producerPreRunPhysicalId?.(logicalId);
+	const record = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
+	if (typeof preRun !== "string" || record?.physicalId !== preRun) return;
+	const physicalId = preRun.toLowerCase();
+	const leaves = [...wholeStringLeavesOf(value)];
+	if (leaves.length === 0) return;
+	for (const [plaintext, expression] of producer) {
+		if (plaintext.length < 4 || bag.has(plaintext)) continue;
+		if (typeof expression !== "string" || !expression.startsWith("{{resolve:")) continue;
+		if (!physicalId.includes(plaintext.toLowerCase())) continue;
+		if (leaves.some((leaf) => leaf.includes(plaintext))) bag.set(plaintext, expression);
+	}
+}
 function recordSecretNamedRead(logicalId, value, context) {
 	const bag = context.secretNameSink ?? context.printingSecrets ?? context.recordedSecretValues;
 	if (bag === void 0 || context.secretNameNeedles === void 0) return;
@@ -19669,6 +19923,75 @@ function recordSecretNamedRead(logicalId, value, context) {
 		break;
 	}
 }
+async function reresolveRecordedReferences(value, logicalId, context, origin, sourceKey) {
+	if (!carriesDynamicReference(value) || carriesSecretMask(value)) return value;
+	if (context.recordedSecretValues === void 0) return value;
+	if (!referencesProvenLocal(value, logicalId, context) && !referencesRegionProven(value, context, this.resolverRegion)) {
+		this.logger.debug(safeMsg`Not re-resolving the reference(s) in ${this.displayMasked(origin, context)}: the template of ${this.displayMasked(logicalId, context)} does not spell them, and this stack may read a stack in another region, so the region that resolved them is unknown`);
+		return value;
+	}
+	if (!await this.referencesMatchPhysicalId(value, logicalId, context)) {
+		this.logger.warn(safeMsg`Serving ${this.displayMasked(origin, context)} as recorded, with its {{resolve:...}} reference(s) unresolved: cdkd cannot confirm the secret still holds the value ${this.displayMasked(logicalId, context)} was deployed with, because its physical id does not contain it. Either the secret changed since then (update ${this.displayMasked(logicalId, context)} so cdkd deploys it with the new value), or the value is not part of its name (a custom resource's Data, a name shorter than four characters), and cdkd sends the recorded reference as before.`);
+		return value;
+	}
+	return await this.reresolveCrossStackValue(value, void 0, context, origin, sourceKey);
+}
+async function referencesMatchPhysicalId(value, logicalId, context) {
+	const record = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
+	const physicalId = typeof record?.physicalId === "string" ? record.physicalId.toLowerCase() : "";
+	for (const leaf of wholeStringLeavesOf(value)) for (const token of dynamicReferenceTokens(leaf)) {
+		const plaintext = await this.resolveDynamicReferences(token, context);
+		if (plaintext.includes("{{resolve:")) continue;
+		if (plaintext.length < 4) return false;
+		if (!physicalId.includes(plaintext.toLowerCase())) return false;
+	}
+	return true;
+}
+function referencesRegionProven(value, context, region) {
+	const evidence = context.secretRegionEvidence?.();
+	if (evidence?.complete !== true) return false;
+	return [...wholeStringLeavesOf(value)].every((leaf) => dynamicReferenceTokens(leaf).every((token) => classifyReplaySecretRegion(token, region, evidence.regions).kind !== "ambiguous"));
+}
+function readsAnotherStack(node) {
+	if (Object.hasOwn(node, "Fn::ImportValue") || Object.hasOwn(node, "Fn::GetStackOutput")) return true;
+	if (!Object.hasOwn(node, "Fn::GetAtt")) return false;
+	const getAtt = node["Fn::GetAtt"];
+	const attributeName = typeof getAtt === "string" ? splitGetAttStringForm(getAtt)?.attributeName : Array.isArray(getAtt) ? getAtt[1] : void 0;
+	return typeof attributeName !== "string" || attributeName.startsWith("Outputs.");
+}
+function takenIfBranch(node, context) {
+	if (Array.isArray(node) || !Object.hasOwn(node, "Fn::If")) return void 0;
+	const args = node["Fn::If"];
+	if (!Array.isArray(args) || args.length !== 3 || typeof args[0] !== "string") return void 0;
+	const conditions = context.conditions;
+	if (conditions === void 0 || !Object.hasOwn(conditions, args[0])) return void 0;
+	const verdict = conditions[args[0]];
+	if (typeof verdict !== "boolean") return void 0;
+	return { branch: verdict ? args[1] : args[2] };
+}
+function referencesProvenLocal(value, logicalId, context) {
+	const resources = context.template.Resources ?? {};
+	if (!Object.hasOwn(resources, logicalId)) return false;
+	const literals = [];
+	let crossStack = false;
+	const walk = (node) => {
+		if (typeof node === "string") {
+			if (node.includes("{{resolve:")) literals.push(node);
+			return;
+		}
+		if (node === null || typeof node !== "object") return;
+		if (!Array.isArray(node) && readsAnotherStack(node)) crossStack = true;
+		const taken = takenIfBranch(node, context);
+		if (taken !== void 0) {
+			walk(taken.branch);
+			return;
+		}
+		for (const child of Object.values(node)) walk(child);
+	};
+	walk(resources[logicalId]?.Properties);
+	if (crossStack) return false;
+	return [...wholeStringLeavesOf(value)].every((leaf) => dynamicReferenceTokens(leaf).every((token) => literals.some((l) => l.includes(token))));
+}
 function rejectPlaceholderArnAttribute(resource, attributeName, value, logicalId, context, healOutcome) {
 	if (!isStalePlaceholderArnAttribute(resource.resourceType, attributeName, value)) return;
 	throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: the recorded value ${quotedRender(stringifyValue(this.maskValueLeaves(value, context)), "\"")} is a placeholder written by an older cdkd version — its region and account fields are literal wildcards, so it is not a usable ARN. ` + this.staleRecordRemedy(healOutcome, context)));
@@ -19863,6 +20186,13 @@ async function reresolveCrossStackValue(value, producerRegion, context, origin,
 			});
 		}
 	}
+	if (context.recordedSecretValues !== void 0 && producerOutput !== void 0 && producerOutput.crossAccount !== true && context.stateBackend !== void 0 && context.skipDynamicReferences !== true) {
+		const plain = [...wholeStringLeavesOf(value)].filter((leaf) => !leaf.includes("{{resolve:") && !carriesSecretMask(leaf));
+		if (plain.length > 0) {
+			const ids = await producerPhysicalIds(context.recordedImports ?? context.recordedSecretValues, context.stateBackend, producerOutput.stackName, producerOutput.region || this.resolverRegion, () => this.logger.debug(safeMsg`Could not read the state of producer ${this.displayMasked(producerOutput.stackName, context)} for its physical ids; no cross-stack copy of one is kept (go-to-k/cdkd#4819)`));
+			for (const leaf of plain) if (ids.has(leaf)) recordPhysicalNameCopy(context.recordedSecretValues, leaf);
+		}
+	}
 	if (!carriesDynamicReference(value)) return value;
 	const resolver = this.resolverForProducerRegion(producerRegion, context, producerRegionLogText);
 	const pinnedContext = producerRegion ? withoutProducerRegions(context) : context;
@@ -19981,6 +20311,33 @@ function recordImport(context, exportName, producerStack, producerRegion) {
 		sourceRegion: producerRegion
 	});
 }
+const producerPhysicalIdReads = /* @__PURE__ */ new WeakMap();
+function producerPhysicalIds(scope, stateBackend, stackName, region, onFailure) {
+	let reads = producerPhysicalIdReads.get(scope);
+	if (reads === void 0) {
+		reads = /* @__PURE__ */ new Map();
+		producerPhysicalIdReads.set(scope, reads);
+	}
+	const key = JSON.stringify([stackName, region]);
+	let read = reads.get(key);
+	if (read === void 0) {
+		read = (async () => {
+			const ids = /* @__PURE__ */ new Set();
+			try {
+				const data = await stateBackend.getState(stackName, region);
+				for (const record of Object.values(data?.state.resources ?? {})) {
+					const id = record?.physicalId;
+					if (typeof id === "string" && id !== "") ids.add(id);
+				}
+			} catch {
+				onFailure();
+			}
+			return ids;
+		})();
+		reads.set(key, read);
+	}
+	return read;
+}
 
 //#endregion
 //#region src/deployment/intrinsic-resolver/cfn-fallback.ts
@@ -20071,143 +20428,6 @@ function getCfnClient(rawRegion) {
 	return client;
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/stack-output.ts
-async function resolveGetStackOutput(arg, context) {
-	if (!arg || typeof arg !== "object" || Array.isArray(arg)) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: argument must be an object with StackName/OutputName/Region/RoleArn, got ${arg === null ? "null" : Array.isArray(arg) ? "array" : typeof arg}`));
-	const args = arg;
-	if (!("StackName" in args)) throw markNonRetryable(/* @__PURE__ */ new Error("Fn::GetStackOutput: StackName is required"));
-	if (!("OutputName" in args)) throw markNonRetryable(/* @__PURE__ */ new Error("Fn::GetStackOutput: OutputName is required"));
-	const sourceKey = crossStackSourceKey({ "Fn::GetStackOutput": args });
-	const stackName = await this.resolveValue(args["StackName"], context);
-	if (typeof stackName !== "string" || stackName === "") throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: StackName must resolve to a non-empty string, got ${typeof stackName}`));
-	const outputName = await this.resolveValue(args["OutputName"], context);
-	if (typeof outputName !== "string" || outputName === "") throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: OutputName must resolve to a non-empty string, got ${typeof outputName}`));
-	let region = this.resolverRegion;
-	let loggedRegionText = this.logTextOfLeaf(region, context);
-	if ("Region" in args && args["Region"] !== void 0 && args["Region"] !== null) {
-		const resolvedRegion = await this.resolveValue(args["Region"], context);
-		if (typeof resolvedRegion !== "string" || resolvedRegion === "") throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: Region must resolve to a non-empty string, got ${typeof resolvedRegion}`));
-		const requestedRegion = canonicalizeRegion(resolvedRegion);
-		if (!isClientSafeRegion(requestedRegion)) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: ${this.displayMaskedIdent(this.logTextOfLeaf(resolvedRegion, context) !== resolvedRegion ? "***" : resolvedRegion, context, 64)} is not a valid AWS region name. The region selects both the AWS endpoint and the state-file key, so cdkd will not use it.`));
-		region = requestedRegion;
-		loggedRegionText = this.regionLogText(resolvedRegion, context);
-	}
-	let roleArn;
-	if ("RoleArn" in args && args["RoleArn"] !== void 0 && args["RoleArn"] !== null) {
-		const raw = args["RoleArn"];
-		if (typeof raw !== "string" || raw === "") throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: RoleArn must be a literal string in the template (no Ref / Fn::GetAtt / Fn::Sub allowed for cross-account references). Got ${raw === null ? "null" : Array.isArray(raw) ? "array" : typeof raw}${typeof raw === "object" ? ` (intrinsic shape: ${this.displayMasked(JSON.stringify(raw).slice(0, 80), context)})` : ""}.`));
-		roleArn = raw;
-	}
-	if (!roleArn && context.stackName && context.stackName === stackName && sameRegion(region, this.resolverRegion)) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: cannot reference own stack ${this.displayMaskedIdent(stackName, context, STACK_REF_MAX_CODE_POINTS)} in the same region ${this.displayMaskedIdent(loggedRegionText, context)}`));
-	const loggedStackName = this.displayMaskedIdent(stackName, context, STACK_REF_MAX_CODE_POINTS);
-	const loggedOutputName = this.displayMaskedIdent(outputName, context);
-	const loggedRegion = this.displayMasked(loggedRegionText, context);
-	const shownRoleArn = roleArn ? displayIdent(roleArn, { maxCodePoints: 613 }) : "";
-	this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${shownRoleArn}` : ""}`);
-	let stateData;
-	try {
-		stateData = roleArn ? await this.getCrossAccountStackState(roleArn, stackName, region, context) : await this.getSameAccountStackState(stackName, region, context);
-	} catch (error) {
-		this.maskStateReadError(error, [[stackName, this.displayMasked(stackName, context)], [region, loggedRegion]], context);
-	}
-	if (!stateData) {
-		if (!roleArn && this.cfnFallback) {
-			const cfnOutputs = await this.lookupCfnStackOutputs(stackName, region, context, loggedRegionText);
-			if (cfnOutputs) {
-				if (!Object.hasOwn(cfnOutputs, outputName)) {
-					const available = this.describeAvailableOutputs(Object.keys(cfnOutputs), context);
-					throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: output ${loggedOutputName} not found in CloudFormation stack ${loggedStackName} (${displayIdent(loggedRegion)}). Available outputs: ${available}`));
-				}
-				const value = cfnOutputs[outputName];
-				this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName} (from CloudFormation stack outputs; weak reference — producer is not cdkd-managed)`);
-				return value;
-			}
-		}
-		throw new Error(`Fn::GetStackOutput: stack ${loggedStackName} not found in region ${displayIdent(loggedRegion)}${roleArn ? ` (cross-account via ${shownRoleArn})` : ""}. ${!roleArn && this.cfnFallback ? "Searched cdkd state and CloudFormation stacks. Make sure the producer stack has been deployed (via cdkd or CloudFormation)." : `Make sure the producer stack has been deployed via cdkd.`}`);
-	}
-	if (!hasReadableOutputs(stateData.state)) throw markNonRetryable(new MalformedProducerRecordRefusalError(`Fn::GetStackOutput: the state record of producer stack ${loggedStackName} (${displayIdent(loggedRegion)}) has no readable 'outputs' map — the record is malformed or truncated. cdkd refuses to resolve from it rather than reading it as a map: 'Object.hasOwn' answers TRUE for '0' on a string and for an index on a list, so continuing would resolve ONE CHARACTER or element of the record as this reference's value and this deploy would send it to AWS. Inspect the producer's record with 'cdkd state show' --json, repair or remove it, then re-run.`));
-	const outputs = stateData.state.outputs ?? {};
-	if (!Object.hasOwn(outputs, outputName)) {
-		const available = this.describeAvailableOutputs(Object.keys(outputs), context);
-		throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: output ${loggedOutputName} not found in stack ${loggedStackName} (${displayIdent(loggedRegion)}). Available outputs: ${available}`));
-	}
-	const value = outputs[outputName];
-	this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${shownRoleArn}` : ""} (${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
-	if (!roleArn) this.recordOutputRead(context, stackName, region, outputName);
-	if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new CrossAccountSecretRefusalError(`Fn::GetStackOutput: output ${loggedOutputName} of stack ${loggedStackName} (${displayIdent(loggedRegion)}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${shownRoleArn}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
-	return await this.reresolveCrossStackValue(value, region, context, `Fn::GetStackOutput ${quotedRender(this.displayLeaf(outputName, context), "'")} (producer ${this.displayLeaf(stackName, context)} / ${this.displayLeaf(loggedRegionText, context)})`, sourceKey, {
-		stackName,
-		region,
-		outputKey: outputName,
-		...roleArn ? { crossAccount: true } : {}
-	}, loggedRegionText);
-}
-function recordOutputRead(context, producerStack, producerRegion, outputName) {
-	if (!context.recordedOutputReads) return;
-	if (context.recordedOutputReads.some((e) => e.sourceStack === producerStack && sameRegion(e.sourceRegion, producerRegion) && e.outputName === outputName)) return;
-	context.recordedOutputReads.push({
-		sourceStack: producerStack,
-		sourceRegion: producerRegion,
-		outputName
-	});
-}
-function positionalNameMask(pairs) {
-	const substitutions = pairs.filter(([raw, masked]) => raw !== "" && raw !== masked).flatMap(([raw, masked]) => {
-		const shown = displaySafe(raw, { asciiOnly: true });
-		const escaped = (text) => JSON.stringify(text).slice(1, -1);
-		const rendered = displayStackName(raw);
-		const escapedPair = [...shown !== "" && escaped(shown) !== shown ? [[escaped(shown), escaped(displaySafe(masked, { asciiOnly: true }))]] : [], ...rendered !== raw && rendered !== shown && rendered !== escaped(shown) ? [[rendered, displayStackName(displaySafe(masked, { asciiOnly: true }))]] : []];
-		if (shown === raw) return [[raw, masked], ...escapedPair];
-		const shownMask = displaySafe(masked, { asciiOnly: true });
-		return shown === "" || shownMask === "" ? [[raw, masked]] : [
-			[raw, masked],
-			[shown, shownMask],
-			...escapedPair
-		];
-	}).sort(([a], [b]) => b.length - a.length);
-	if (substitutions.length === 0) return void 0;
-	return (text) => {
-		let out = text;
-		for (const [raw, masked] of substitutions) out = out.split(raw).join(masked);
-		return out;
-	};
-}
-function maskStateReadError(error, pairs, context) {
-	throw this.maskNamedError(error, this.positionalNameMask(pairs), context);
-}
-function maskNamedError(error, extraMask, context) {
-	let masked = error;
-	let positional = extraMask;
-	const union = unionOfSecretBags([
-		context?.inheritedSecrets,
-		context?.recordedSecretValues,
-		context?.printingSecrets
-	]);
-	if (hasMaskableValues(union)) {
-		masked = maskSecretsInError(masked, union, positional);
-		positional = void 0;
-	}
-	if (positional) masked = maskSecretsInError(masked, /* @__PURE__ */ new Map(), positional);
-	return masked;
-}
-function namedRequestMasks(pairs, context) {
-	const positional = this.positionalNameMask(this.explicitRegion !== void 0 && this.explicitRegionLogText !== void 0 ? [...pairs, [this.explicitRegion, this.explicitRegionLogText]] : pairs);
-	const text = (message) => this.displayMasked(positional ? positional(message) : message, context);
-	const line = (message) => {
-		const indent = /^ */.exec(message)?.[0] ?? "";
-		return indent + text(message.slice(indent.length));
-	};
-	return {
-		error: (error) => this.maskNamedError(error, positional, context),
-		text,
-		retryLogger: {
-			debug: (message) => this.logger.debug(line(message)),
-			warn: (message) => this.logger.warn(line(message))
-		}
-	};
-}
-
 //#endregion
 //#region src/utils/caller-credentials.ts
 const AWS_CREDENTIAL_ENV_KEYS = [
@@ -20380,6 +20600,353 @@ async function applyRoleArnIfSet(opts) {
 	}
 }
 
+//#endregion
+//#region src/deployment/intrinsic-resolver/cdk-cross-account-ref.ts
+function producerLookupOver(stacks) {
+	return (stackName, account, region) => stacks.find((s) => s.stackName === stackName && s.account === account && sameRegion(s.region, region));
+}
+const ROLE_NAME = "[\\w+=,.@-]{1,64}";
+const LITERAL_ROLE_ARN_RE = new RegExp(`^arn:aws[a-z0-9-]*:iam::(\\d{12}):role/(${ROLE_NAME})$`);
+const JOIN_TAIL_RE = new RegExp(`^:iam::(\\d{12}):role/(${ROLE_NAME})$`);
+function isExactlyKeyed(value, key) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const keys = Object.keys(value);
+	return keys.length === 1 && keys[0] === key;
+}
+function roleArnShape(raw) {
+	if (typeof raw === "string") {
+		const match = LITERAL_ROLE_ARN_RE.exec(raw);
+		if (!match || !match[1] || !match[2] || !parseIamRoleArn(raw)) return void 0;
+		return {
+			form: "literal",
+			accountId: match[1],
+			roleName: match[2]
+		};
+	}
+	if (!isExactlyKeyed(raw, "Fn::Join")) return void 0;
+	const join = raw["Fn::Join"];
+	if (!Array.isArray(join) || join.length !== 2 || join[0] !== "") return void 0;
+	const parts = join[1];
+	if (!Array.isArray(parts) || parts.length !== 3 || parts[0] !== "arn:") return void 0;
+	const ref = parts[1];
+	if (!isExactlyKeyed(ref, "Ref") || ref["Ref"] !== "AWS::Partition") return void 0;
+	const tail = parts[2];
+	if (typeof tail !== "string") return void 0;
+	const match = JOIN_TAIL_RE.exec(tail);
+	if (!match || !match[1] || !match[2]) return void 0;
+	return {
+		form: "join",
+		accountId: match[1],
+		roleName: match[2]
+	};
+}
+function roleArnOf(shape, region) {
+	const { partition } = derivePartitionAndUrlSuffix(region);
+	return `arn:${partition}:iam::${shape.accountId}:role/${shape.roleName}`;
+}
+const CFN_EXEC_ROLE_PRINCIPAL_RE = /^arn:(?:\$\{AWS::Partition\}|aws[a-z0-9-]*):iam::\d{12}:role\/[^/]*cfn-exec-role[^/]*$/;
+function isCfnExecRolePrincipal(principal) {
+	return isExactlyKeyed(principal, "Fn::Sub") && typeof principal["Fn::Sub"] === "string" && CFN_EXEC_ROLE_PRINCIPAL_RE.test(principal["Fn::Sub"]);
+}
+function trustsOnlyCfnExecRoles(document) {
+	if (document === null || typeof document !== "object" || Array.isArray(document)) return false;
+	const statements = document["Statement"];
+	if (!Array.isArray(statements) || statements.length === 0) return false;
+	for (const statement of statements) {
+		if (statement === null || typeof statement !== "object" || Array.isArray(statement)) return false;
+		const principal = statement["Principal"];
+		if (!isExactlyKeyed(principal, "AWS")) return false;
+		const aws = principal["AWS"];
+		const list = Array.isArray(aws) ? aws : [aws];
+		if (list.length === 0 || !list.every(isCfnExecRolePrincipal)) return false;
+	}
+	return true;
+}
+function isGeneratedReaderRole(template, roleName) {
+	const resources = template.Resources;
+	if (!resources || typeof resources !== "object") return false;
+	for (const resource of Object.values(resources)) {
+		if (resource === null || typeof resource !== "object") continue;
+		const { Type: type, Properties: properties } = resource;
+		if (type !== "AWS::IAM::Role") continue;
+		if (properties === null || typeof properties !== "object") continue;
+		const props = properties;
+		if (props["RoleName"] !== roleName) continue;
+		if (trustsOnlyCfnExecRoles(props["AssumeRolePolicyDocument"])) return true;
+	}
+	return false;
+}
+function producerLookupRoleArn(lookupRoleArn, producerRegion, producerAccount) {
+	if (typeof lookupRoleArn !== "string" || lookupRoleArn === "") return void 0;
+	const { partition } = derivePartitionAndUrlSuffix(producerRegion);
+	const arn = lookupRoleArn.split("${AWS::Partition}").join(partition);
+	const parsed = parseIamRoleArn(arn);
+	if (!parsed || parsed.accountId !== producerAccount) return void 0;
+	return arn;
+}
+function classifyCdkCrossAccountRef(shape, producerStackName, producerRegion, lookup) {
+	if (lookup === void 0) return { kind: "not-generated" };
+	const producer = lookup(producerStackName, shape.accountId, producerRegion);
+	if (!producer) return shape.form === "join" ? {
+		kind: "producer-absent",
+		shape
+	} : { kind: "not-generated" };
+	if (!isGeneratedReaderRole(producer.template, shape.roleName)) return { kind: "not-generated" };
+	return {
+		kind: "generated",
+		shape,
+		lookupRoleArn: producerLookupRoleArn(producer.lookupRoleArn, producerRegion, shape.accountId)
+	};
+}
+function quotedArg(rendered) {
+	return rendered.startsWith("\"") ? rendered : `'${rendered}'`;
+}
+function cdkCrossAccountRefRefusal(parts) {
+	const consumerAccount = parts.consumerAccount !== void 0 && /^\d{12}$/.test(parts.consumerAccount) ? parts.consumerAccount : "<consumer-account>";
+	const reason = parts.reason.replace(/[\s.]+$/, "");
+	const trust = `'cdk bootstrap --trust-for-lookup ${consumerAccount}' (or '--trust ${consumerAccount}')`;
+	const remedyOne = parts.noLookupRole ? `(1) synthesize stack ${parts.producer} with a stack synthesizer that names a lookup role (the default DefaultStackSynthesizer), and in account ${parts.producerAccount} run ${trust} so the identity running cdkd can assume it; or ` : `(1) in account ${parts.producerAccount}, run ${trust} so the identity running cdkd can assume the lookup role; or `;
+	return `Fn::GetStackOutput: cannot read output ${parts.output} of stack ${parts.producer} (region ${parts.region}, account ${parts.producerAccount})${parts.consumer ? ` for stack ${parts.consumer}` : ""}. Its RoleArn names ${parts.roleName}, a role the AWS CDK generates for a cross-account reference that trusts only the consumer account's CloudFormation execution role, which cdkd does not use; cdkd reads the producer's cdkd state through the producer account's CDK lookup role instead, but ${reason}. Fix it one of two ways: ` + remedyOne + `(2) write the reference as cdk.Fn.getStackOutput(${quotedArg(parts.producer)}, ${quotedArg(parts.output)}, ${quotedArg(parts.region)}, '<roleArn>') with a role in account ${parts.producerAccount} that trusts the identity running cdkd and allows s3:GetBucketLocation and s3:GetObject on cdkd-state-${parts.producerAccount}. See https://cdkd.dev/cross-stack-references/#reading-from-another-account`;
+}
+function producerAbsentReason(producerAccount) {
+	return `this producer stack (account ${producerAccount}) is not in this app's cloud assembly, so cdkd can neither confirm the role is the generated one nor find the lookup role`;
+}
+function noLookupRoleReason(producerAccount) {
+	return `the producer stack's artifact names no CDK lookup role in account ${producerAccount} (its stack synthesizer does not use the bootstrap lookup role)`;
+}
+function isLookupRoleDenial(error) {
+	let current = error;
+	for (let depth = 0; depth < 6 && current !== null && typeof current === "object"; depth++) {
+		const name = current.name;
+		if (name === "AccessDenied" || name === "AccessDeniedException" || name === "NoSuchEntity" || name === "NoSuchEntityException") return true;
+		if (current.$metadata?.httpStatusCode === 403) return true;
+		current = current.cause;
+	}
+	return false;
+}
+function describeInnermostAwsError(error) {
+	let innermost = error;
+	for (let depth = 0; depth < 6; depth++) {
+		const cause = innermost !== null && typeof innermost === "object" ? innermost.cause : void 0;
+		if (cause === null || typeof cause !== "object") break;
+		innermost = cause;
+	}
+	if (!(innermost instanceof Error)) return displayAwsMessage(String(innermost));
+	const code = innermost.Code;
+	const name = typeof code === "string" && code !== "" ? code : innermost.name;
+	const message = displayAwsMessage(innermost.message);
+	return name && name !== "Error" ? `${displayIdent(name)}: ${message}` : message;
+}
+function refuseUnreadableCdkCrossAccountRefs(refs, deployed, consumerOf, lookup) {
+	for (const { consumer, args } of refs) {
+		if (!deployed.has(consumer)) continue;
+		const shape = roleArnShape(args["RoleArn"]);
+		if (shape === void 0) continue;
+		const stackName = args["StackName"];
+		const outputName = args["OutputName"];
+		const consumerStack = consumerOf(consumer);
+		const region = args["Region"] ?? consumerStack.region;
+		if (typeof stackName !== "string" || typeof outputName !== "string") continue;
+		if (typeof region !== "string" || region === "") continue;
+		const verdict = classifyCdkCrossAccountRef(shape, stackName, region, lookup);
+		let reason;
+		if (verdict.kind === "producer-absent") reason = producerAbsentReason(shape.accountId);
+		else if (verdict.kind === "generated" && verdict.lookupRoleArn === void 0) reason = noLookupRoleReason(shape.accountId);
+		if (reason === void 0) continue;
+		throw markNonRetryable(new Error(cdkCrossAccountRefRefusal({
+			consumer: displayStackName(consumer),
+			output: displayIdent(outputName),
+			producer: displayStackName(stackName),
+			region: displayIdent(region),
+			producerAccount: shape.accountId,
+			roleName: displayIdent(shape.roleName),
+			consumerAccount: consumerStack.account,
+			reason,
+			noLookupRole: verdict.kind === "generated"
+		})));
+	}
+}
+
+//#endregion
+//#region src/deployment/intrinsic-resolver/stack-output.ts
+async function resolveGetStackOutput(arg, context) {
+	if (!arg || typeof arg !== "object" || Array.isArray(arg)) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: argument must be an object with StackName/OutputName/Region/RoleArn, got ${arg === null ? "null" : Array.isArray(arg) ? "array" : typeof arg}`));
+	const args = arg;
+	if (!("StackName" in args)) throw markNonRetryable(/* @__PURE__ */ new Error("Fn::GetStackOutput: StackName is required"));
+	if (!("OutputName" in args)) throw markNonRetryable(/* @__PURE__ */ new Error("Fn::GetStackOutput: OutputName is required"));
+	const sourceKey = crossStackSourceKey({ "Fn::GetStackOutput": args });
+	const stackName = await this.resolveValue(args["StackName"], context);
+	if (typeof stackName !== "string" || stackName === "") throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: StackName must resolve to a non-empty string, got ${typeof stackName}`));
+	const outputName = await this.resolveValue(args["OutputName"], context);
+	if (typeof outputName !== "string" || outputName === "") throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: OutputName must resolve to a non-empty string, got ${typeof outputName}`));
+	let region = this.resolverRegion;
+	let loggedRegionText = this.logTextOfLeaf(region, context);
+	if ("Region" in args && args["Region"] !== void 0 && args["Region"] !== null) {
+		const resolvedRegion = await this.resolveValue(args["Region"], context);
+		if (typeof resolvedRegion !== "string" || resolvedRegion === "") throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: Region must resolve to a non-empty string, got ${typeof resolvedRegion}`));
+		const requestedRegion = canonicalizeRegion(resolvedRegion);
+		if (!isClientSafeRegion(requestedRegion)) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: ${this.displayMaskedIdent(this.logTextOfLeaf(resolvedRegion, context) !== resolvedRegion ? "***" : resolvedRegion, context, 64)} is not a valid AWS region name. The region selects both the AWS endpoint and the state-file key, so cdkd will not use it.`));
+		region = requestedRegion;
+		loggedRegionText = this.regionLogText(resolvedRegion, context);
+	}
+	let roleArn;
+	let cdkRef;
+	if ("RoleArn" in args && args["RoleArn"] !== void 0 && args["RoleArn"] !== null) {
+		const raw = args["RoleArn"];
+		const refuseNonLiteral = () => markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: RoleArn must be a literal string in the template (no Ref / Fn::GetAtt / Fn::Sub allowed for cross-account references). Got ${raw === null ? "null" : Array.isArray(raw) ? "array" : typeof raw}${typeof raw === "object" ? ` (intrinsic shape: ${this.displayMasked(JSON.stringify(raw).slice(0, 80), context)})` : ""}.`));
+		const shape = roleArnShape(raw);
+		if ((typeof raw !== "string" || raw === "") && shape === void 0) throw refuseNonLiteral();
+		if (shape !== void 0) {
+			const key = JSON.stringify([
+				shape.form,
+				stackName,
+				shape.accountId,
+				canonicalizeRegion(region),
+				shape.roleName
+			]);
+			let verdict = this.cdkCrossAccountRefVerdicts.get(key);
+			if (verdict === void 0) {
+				verdict = classifyCdkCrossAccountRef(shape, stackName, region, this.producerLookup);
+				this.cdkCrossAccountRefVerdicts.set(key, verdict);
+			}
+			if (verdict.kind === "not-generated" && typeof raw !== "string") throw refuseNonLiteral();
+			if (verdict.kind !== "not-generated") cdkRef = verdict;
+		}
+		roleArn = typeof raw === "string" ? raw : shape && roleArnOf(shape, region);
+	}
+	if (!roleArn && context.stackName && context.stackName === stackName && sameRegion(region, this.resolverRegion)) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: cannot reference own stack ${this.displayMaskedIdent(stackName, context, STACK_REF_MAX_CODE_POINTS)} in the same region ${this.displayMaskedIdent(loggedRegionText, context)}`));
+	const loggedStackName = this.displayMaskedIdent(stackName, context, STACK_REF_MAX_CODE_POINTS);
+	const loggedOutputName = this.displayMaskedIdent(outputName, context);
+	const loggedRegion = this.displayMasked(loggedRegionText, context);
+	const shownRoleArn = roleArn ? displayIdent(roleArn, { maxCodePoints: 613 }) : "";
+	this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${shownRoleArn}` : ""}`);
+	let readRoleArn = roleArn;
+	let refuseCdkRead;
+	if (cdkRef !== void 0) {
+		const ref = cdkRef;
+		const producerAccount = ref.shape.accountId;
+		const refuseCdkRef = (reason, cause, noLookupRole = false) => markNonRetryable(new Error(cdkCrossAccountRefRefusal({
+			consumer: context.stackName ? this.displayMaskedIdent(context.stackName, context, STACK_REF_MAX_CODE_POINTS) : void 0,
+			output: loggedOutputName,
+			producer: loggedStackName,
+			region: displayIdent(loggedRegion),
+			producerAccount,
+			roleName: displayIdent(ref.shape.roleName),
+			consumerAccount: this.consumerAccount,
+			reason,
+			noLookupRole
+		}), cause === void 0 ? void 0 : { cause }));
+		if (ref.kind === "producer-absent") throw refuseCdkRef(producerAbsentReason(producerAccount));
+		if (ref.lookupRoleArn === void 0) throw refuseCdkRef(noLookupRoleReason(producerAccount), void 0, true);
+		readRoleArn = ref.lookupRoleArn;
+		const shownLookupRoleArn = displayIdent(readRoleArn, { maxCodePoints: 613 });
+		refuseCdkRead = (error) => refuseCdkRef(`assuming the lookup role ${shownLookupRoleArn} or reading cdkd-state-${producerAccount} with it was denied: ${describeInnermostAwsError(error)}`, error);
+		this.logger.debug(safeMsg`Fn::GetStackOutput: ${shownRoleArn} is the AWS CDK-generated cross-account reader role; reading through the producer account's lookup role ${shownLookupRoleArn}`);
+	}
+	const shownReadRoleArn = readRoleArn === roleArn ? shownRoleArn : displayIdent(readRoleArn, { maxCodePoints: 613 });
+	let stateData;
+	try {
+		stateData = readRoleArn ? await this.getCrossAccountStackState(readRoleArn, stackName, region, context) : await this.getSameAccountStackState(stackName, region, context);
+	} catch (error) {
+		this.maskStateReadError(refuseCdkRead && isLookupRoleDenial(error) ? refuseCdkRead(error) : error, [[stackName, this.displayMasked(stackName, context)], [region, loggedRegion]], context);
+	}
+	if (!stateData) {
+		if (!roleArn && this.cfnFallback) {
+			const cfnOutputs = await this.lookupCfnStackOutputs(stackName, region, context, loggedRegionText);
+			if (cfnOutputs) {
+				if (!Object.hasOwn(cfnOutputs, outputName)) {
+					const available = this.describeAvailableOutputs(Object.keys(cfnOutputs), context);
+					throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: output ${loggedOutputName} not found in CloudFormation stack ${loggedStackName} (${displayIdent(loggedRegion)}). Available outputs: ${available}`));
+				}
+				const value = cfnOutputs[outputName];
+				this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName} (from CloudFormation stack outputs; weak reference — producer is not cdkd-managed)`);
+				return value;
+			}
+		}
+		throw new Error(`Fn::GetStackOutput: stack ${loggedStackName} not found in region ${displayIdent(loggedRegion)}${roleArn ? ` (cross-account via ${shownReadRoleArn})` : ""}. ${!roleArn && this.cfnFallback ? "Searched cdkd state and CloudFormation stacks. Make sure the producer stack has been deployed (via cdkd or CloudFormation)." : `Make sure the producer stack has been deployed via cdkd.`}`);
+	}
+	if (!hasReadableOutputs(stateData.state)) throw markNonRetryable(new MalformedProducerRecordRefusalError(`Fn::GetStackOutput: the state record of producer stack ${loggedStackName} (${displayIdent(loggedRegion)}) has no readable 'outputs' map — the record is malformed or truncated. cdkd refuses to resolve from it rather than reading it as a map: 'Object.hasOwn' answers TRUE for '0' on a string and for an index on a list, so continuing would resolve ONE CHARACTER or element of the record as this reference's value and this deploy would send it to AWS. Inspect the producer's record with 'cdkd state show' --json, repair or remove it, then re-run.`));
+	const outputs = stateData.state.outputs ?? {};
+	if (!Object.hasOwn(outputs, outputName)) {
+		const available = this.describeAvailableOutputs(Object.keys(outputs), context);
+		throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: output ${loggedOutputName} not found in stack ${loggedStackName} (${displayIdent(loggedRegion)}). Available outputs: ${available}`));
+	}
+	const value = outputs[outputName];
+	this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${shownRoleArn}` : ""} (${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
+	if (!roleArn) this.recordOutputRead(context, stackName, region, outputName);
+	if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new CrossAccountSecretRefusalError(`Fn::GetStackOutput: output ${loggedOutputName} of stack ${loggedStackName} (${displayIdent(loggedRegion)}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${shownRoleArn}${readRoleArn !== roleArn ? `, read through the producer account's CDK lookup role ${shownReadRoleArn}` : ""}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
+	return await this.reresolveCrossStackValue(value, region, context, `Fn::GetStackOutput ${quotedRender(this.displayLeaf(outputName, context), "'")} (producer ${this.displayLeaf(stackName, context)} / ${this.displayLeaf(loggedRegionText, context)})`, sourceKey, {
+		stackName,
+		region,
+		outputKey: outputName,
+		...roleArn ? { crossAccount: true } : {}
+	}, loggedRegionText);
+}
+function recordOutputRead(context, producerStack, producerRegion, outputName) {
+	if (!context.recordedOutputReads) return;
+	if (context.recordedOutputReads.some((e) => e.sourceStack === producerStack && sameRegion(e.sourceRegion, producerRegion) && e.outputName === outputName)) return;
+	context.recordedOutputReads.push({
+		sourceStack: producerStack,
+		sourceRegion: producerRegion,
+		outputName
+	});
+}
+function positionalNameMask(pairs) {
+	const substitutions = pairs.filter(([raw, masked]) => raw !== "" && raw !== masked).flatMap(([raw, masked]) => {
+		const shown = displaySafe(raw, { asciiOnly: true });
+		const escaped = (text) => JSON.stringify(text).slice(1, -1);
+		const rendered = displayStackName(raw);
+		const escapedPair = [...shown !== "" && escaped(shown) !== shown ? [[escaped(shown), escaped(displaySafe(masked, { asciiOnly: true }))]] : [], ...rendered !== raw && rendered !== shown && rendered !== escaped(shown) ? [[rendered, displayStackName(displaySafe(masked, { asciiOnly: true }))]] : []];
+		if (shown === raw) return [[raw, masked], ...escapedPair];
+		const shownMask = displaySafe(masked, { asciiOnly: true });
+		return shown === "" || shownMask === "" ? [[raw, masked]] : [
+			[raw, masked],
+			[shown, shownMask],
+			...escapedPair
+		];
+	}).sort(([a], [b]) => b.length - a.length);
+	if (substitutions.length === 0) return void 0;
+	return (text) => {
+		let out = text;
+		for (const [raw, masked] of substitutions) out = out.split(raw).join(masked);
+		return out;
+	};
+}
+function maskStateReadError(error, pairs, context) {
+	throw this.maskNamedError(error, this.positionalNameMask(pairs), context);
+}
+function maskNamedError(error, extraMask, context) {
+	let masked = error;
+	let positional = extraMask;
+	const union = unionOfSecretBags([
+		context?.inheritedSecrets,
+		context?.recordedSecretValues,
+		context?.printingSecrets
+	]);
+	if (hasMaskableValues(union)) {
+		masked = maskSecretsInError(masked, union, positional);
+		positional = void 0;
+	}
+	if (positional) masked = maskSecretsInError(masked, /* @__PURE__ */ new Map(), positional);
+	return masked;
+}
+function namedRequestMasks(pairs, context) {
+	const positional = this.positionalNameMask(this.explicitRegion !== void 0 && this.explicitRegionLogText !== void 0 ? [...pairs, [this.explicitRegion, this.explicitRegionLogText]] : pairs);
+	const text = (message) => this.displayMasked(positional ? positional(message) : message, context);
+	const line = (message) => {
+		const indent = /^ */.exec(message)?.[0] ?? "";
+		return indent + text(message.slice(indent.length));
+	};
+	return {
+		error: (error) => this.maskNamedError(error, positional, context),
+		text,
+		retryLogger: {
+			debug: (message) => this.logger.debug(line(message)),
+			warn: (message) => this.logger.warn(line(message))
+		}
+	};
+}
+
 //#endregion
 //#region src/deployment/intrinsic-resolver/stack-state.ts
 async function getSameAccountStackState(stackName, region, context) {
@@ -20425,80 +20992,6 @@ async function getCrossAccountStackState(roleArn, stackName, region, context) {
 	}).getState(stackName, region);
 }
 
-//#endregion
-//#region src/deployment/secret-region-classification.ts
-const REPLAY_SECRET_SERVICES = /* @__PURE__ */ new Set([
-	"secretsmanager",
-	"ssm",
-	"ssm-secure"
-]);
-function secretsManagerSecretId(inner) {
-	const afterService = inner.substring(15);
-	let stringIdx = afterService.indexOf(":SecretString:");
-	let binaryIdx = afterService.indexOf(":SecretBinary:");
-	if (stringIdx < 0 && afterService.endsWith(":SecretString")) stringIdx = afterService.length - 13;
-	if (binaryIdx < 0 && afterService.endsWith(":SecretBinary")) binaryIdx = afterService.length - 13;
-	const delimiterIdx = stringIdx >= 0 && binaryIdx >= 0 ? Math.min(stringIdx, binaryIdx) : stringIdx >= 0 ? stringIdx : binaryIdx;
-	return delimiterIdx >= 0 ? afterService.substring(0, delimiterIdx) : afterService;
-}
-function ssmParameterName(inner) {
-	const serviceEnd = inner.indexOf(":");
-	return serviceEnd < 0 ? "" : inner.substring(serviceEnd + 1);
-}
-function arnRegion(secretId) {
-	if (!secretId.startsWith("arn:")) return void 0;
-	const region = secretId.split(":")[3];
-	return region ? region : void 0;
-}
-function producerRegionsFromState(state) {
-	const seen = /* @__PURE__ */ new Set();
-	const regions = [];
-	for (const entry of [...state.imports ?? [], ...state.outputReads ?? []]) {
-		const canonical = canonicalizeRegion(entry.sourceRegion);
-		if (!canonical || seen.has(canonical)) continue;
-		seen.add(canonical);
-		regions.push(entry.sourceRegion);
-	}
-	return regions;
-}
-function secretReferenceName(expression) {
-	const inner = expression.startsWith("{{resolve:") ? expression.slice(10, -2) : void 0;
-	if (inner === void 0) return void 0;
-	const service = inner.split(":")[0];
-	if (service === void 0 || !REPLAY_SECRET_SERVICES.has(service)) return void 0;
-	const secretName = service === "secretsmanager" ? secretsManagerSecretId(inner) : ssmParameterName(inner);
-	return secretName ? secretName : void 0;
-}
-function regionLessSecretName(expression) {
-	const secretName = secretReferenceName(expression);
-	return secretName !== void 0 && arnRegion(secretName) === void 0 ? secretName : void 0;
-}
-function classifyReplaySecretRegion(expression, consumerRegion, importedProducerRegions) {
-	const secretName = secretReferenceName(expression);
-	if (!secretName) return { kind: "local" };
-	const named = arnRegion(secretName);
-	if (named !== void 0) return canonicalizeRegion(named) === canonicalizeRegion(consumerRegion) ? { kind: "local" } : {
-		kind: "named-region",
-		secretName,
-		region: named
-	};
-	const seen = /* @__PURE__ */ new Set();
-	const foreignProducerRegions = [];
-	for (const candidate of importedProducerRegions ?? []) {
-		const canonical = canonicalizeRegion(candidate);
-		if (!canonical || canonical === canonicalizeRegion(consumerRegion)) continue;
-		if (seen.has(canonical)) continue;
-		seen.add(canonical);
-		foreignProducerRegions.push(candidate);
-	}
-	if (foreignProducerRegions.length === 0) return { kind: "local" };
-	return {
-		kind: "ambiguous",
-		secretName,
-		foreignProducerRegions
-	};
-}
-
 //#endregion
 //#region src/deployment/intrinsic-resolver/dynamic-refs.ts
 function secretVerdictScope(resolver) {
@@ -21754,6 +22247,7 @@ function recordInheritedParameterSecrets(parameterName, value, context) {
 	const inherited = context.inheritedSecrets;
 	const recorded = context.recordedSecretValues;
 	if (inherited && recorded) carryLogOnlyValuesCarriedBy(inherited, recorded, value);
+	if (recorded) carryPhysicalNameCopiesCarriedBy(context, recorded, value);
 	if (inherited && recorded) recordInheritedNoEchoListElements(this, inherited, recorded, value, context);
 	if (!inherited || inherited.size === 0 || !recorded) return;
 	for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) {
@@ -21762,6 +22256,12 @@ function recordInheritedParameterSecrets(parameterName, value, context) {
 		carryFreshNoEchoMark(inherited, recorded, plaintext);
 	}
 }
+function carryPhysicalNameCopiesCarriedBy(context, recorded, value) {
+	const names = context.inheritedPhysicalNameCopies ?? (context.inheritedSecrets && physicalNameCopiesOf.get(context.inheritedSecrets));
+	if (names === void 0 || names.size === 0) return;
+	const leaves = [...wholeStringLeavesOf(value)];
+	for (const name of names) if (leaves.some((leaf) => leaf.includes(name))) recordPhysicalNameCopy(recorded, name);
+}
 function carriedExpressionFor(inherited, parameterName, value, plaintext, survivor) {
 	const own = inheritedParameterExpression(inherited, parameterName, plaintext);
 	if (typeof own === "string") return own;
@@ -21857,8 +22357,9 @@ function recordInheritedNoEchoListElements(resolver, inherited, recorded, value,
 }
 function recordNoEchoParameterValue(paramDef, value, context) {
 	const bag = context.recordedSecretValues;
-	if (paramDef?.NoEcho !== true || bag === void 0) return;
+	if (!declaresNoEcho(paramDef) || bag === void 0) return;
 	recordLogOnlyParameterValue(bag, value);
+	if (paramDef?.NoEcho !== true) return;
 	recordNoEchoParameterFreshValue(value, bag, this.publicNoEchoTokens(context));
 }
 function refuseCoercedInheritedSecret(name, paramDef, userValue, inherited) {
@@ -21896,6 +22397,7 @@ function lookupResourceRecord(logicalId, via, context) {
 		const loggedId = this.displayMasked(logicalId, context);
 		throw markNonRetryable(new IntrinsicResolutionRefusalError(`${via} ${loggedId}: ${isObject ? `the state record's physical id is ${physicalId === null ? "null" : typeof physicalId}, not a string` : `the state record is ${Array.isArray(resource) ? "an array" : typeof resource}, not an object`}. cdkd always records an object with a string id, so this record was edited by hand or written by another tool. ${isObject ? `Set the resource's "physicalId" in the stack's state.json back to the id AWS knows the resource by.` : `Restore the resource's record in the stack's state.json, or remove it and re-import the resource.`}`, void 0, "STATE_PHYSICAL_ID_NOT_STRING"));
 	}
+	if (context.recordedSecretValues !== void 0) recordPhysicalNameCopy(context.recordedSecretValues, physicalId);
 	return resource;
 }
 async function resolveRef(logicalId, context, onParameter) {
@@ -21904,7 +22406,7 @@ async function resolveRef(logicalId, context, onParameter) {
 		const refValue = this.resolveRefValue(logicalId, resource, context);
 		recordSecretNamedRead(logicalId, refValue, context);
 		this.logger.debug(`Resolved Ref to resource: ${this.logRender(logicalId, context)} resolved to ${this.logRender(String(refValue), context)}`);
-		return refValue;
+		return await this.reresolveRecordedReferences(refValue, logicalId, context, `Ref ${logicalId}`, void 0);
 	}
 	if (context.parameters && Object.hasOwn(context.parameters, logicalId)) {
 		const value = context.parameters[logicalId];
@@ -21914,7 +22416,7 @@ async function resolveRef(logicalId, context, onParameter) {
 		this.recordInheritedParameterSecrets(logicalId, value, context);
 		this.logger.debug(`Resolved Ref to parameter: ${this.logRender(logicalId, context)} resolved to ${this.logRender(stringifyParameterForLog(paramDef, this.maskValueLeaves(value, context)), context, {
 			structured: isStructured(value),
-			redacted: paramDef?.NoEcho === true
+			redacted: declaresNoEcho(paramDef)
 		})}`);
 		onParameter?.();
 		return value;
@@ -21996,6 +22498,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	explicitRegionLogText;
 	strictGetAtt;
 	cfnFallback;
+	producerLookup;
+	consumerAccount;
+	cdkCrossAccountRefVerdicts = /* @__PURE__ */ new Map();
 	cfnClients = /* @__PURE__ */ new Map();
 	cfnExportsPromises = /* @__PURE__ */ new Map();
 	cfnStackOutputsCache = /* @__PURE__ */ new Map();
@@ -22007,6 +22512,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		this.explicitRegion = region || void 0;
 		this.strictGetAtt = options?.strictGetAtt ?? false;
 		this.cfnFallback = options?.cfnFallback ?? true;
+		this.producerLookup = options?.producerLookup;
+		this.consumerAccount = options?.consumerAccount;
 	}
 	getPhysicalIdFallbackCount() {
 		return this.physicalIdFallbackCount;
@@ -22201,6 +22708,8 @@ IntrinsicFunctionResolver.prototype.pushRedactedAttributeRead = pushRedactedAttr
 IntrinsicFunctionResolver.prototype.resolveGetAtt = resolveGetAtt;
 IntrinsicFunctionResolver.prototype.publicNoEchoTokens = publicNoEchoTokens;
 IntrinsicFunctionResolver.prototype.noteAttributeSecrecy = noteAttributeSecrecy;
+IntrinsicFunctionResolver.prototype.reresolveRecordedReferences = reresolveRecordedReferences;
+IntrinsicFunctionResolver.prototype.referencesMatchPhysicalId = referencesMatchPhysicalId;
 IntrinsicFunctionResolver.prototype.rejectPlaceholderArnAttribute = rejectPlaceholderArnAttribute;
 IntrinsicFunctionResolver.prototype.staleRecordRemedy = staleRecordRemedy;
 IntrinsicFunctionResolver.prototype.unenrichedRemedy = unenrichedRemedy;
@@ -22344,8 +22853,7 @@ var DiffCalculator = class DiffCalculator {
 					resourceType: desiredResource.Type,
 					templateProperties: rawDesiredProps,
 					desired: desiredPropsForCompare,
-					current: currentPropsForCompare,
-					record: currentResource
+					current: currentPropsForCompare
 				});
 				const desiredCompared = noEchoCompared?.desired ?? desiredPropsForCompare;
 				const currentCompared = noEchoCompared?.current ?? currentPropsForCompare;
@@ -23028,6 +23536,511 @@ function deleteIndeterminateGuards(result) {
 	return out;
 }
 
+//#endregion
+//#region src/deployment/inline-policy-claims.ts
+function isInlinePolicyClaimedByCompletedWriter(args, kind, principal, policyName) {
+	const { selfLogicalId, writers, changes, stateResources } = args;
+	for (const [lid, write] of writers) {
+		if (lid === selfLogicalId || !Object.hasOwn(stateResources, lid)) continue;
+		const record = stateResources[lid];
+		const standalone = standaloneInlinePolicyOf(record.resourceType, record.properties);
+		if (standalone !== void 0) {
+			if (standalone.kind === kind && sameIamName(standalone.principal, principal) && sameIamName(standalone.policyName, policyName)) return true;
+			continue;
+		}
+		if (record.provisionedBy === "cc-api") continue;
+		const props = record.properties ?? {};
+		if (record.resourceType === "AWS::IAM::Policy") {
+			if (!sameIamName(record.physicalId, policyName)) continue;
+			const listed = props[POLICY_LIST_FIELDS[kind]];
+			if (Array.isArray(listed) && listed.some((p) => sameIamName(p, principal))) return true;
+			continue;
+		}
+		if (!Object.hasOwn(PRINCIPAL_KINDS, record.resourceType)) continue;
+		if (PRINCIPAL_KINDS[record.resourceType] !== kind) continue;
+		if (!sameIamName(record.physicalId, principal)) continue;
+		if (write !== "create" && !ownPoliciesChange(changes.get(lid))) continue;
+		const policies = props["Policies"];
+		if (!Array.isArray(policies)) continue;
+		if (policies.some((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) && sameIamName(entry["PolicyName"], policyName))) return true;
+	}
+	return false;
+}
+var RollbackInlinePolicyWriters = class {
+	entries = /* @__PURE__ */ new Map();
+	removals = /* @__PURE__ */ new Map();
+	unsettled = /* @__PURE__ */ new Map();
+	notePending(ops) {
+		for (const op of ops) if (!this.unsettled.has(op)) this.unsettled.set(op, {
+			logicalId: op.logicalId,
+			state: "pending"
+		});
+	}
+	noteOutcome(op, completed) {
+		if (!completed) {
+			this.unsettled.set(op, {
+				logicalId: op.logicalId,
+				state: "failed"
+			});
+			return;
+		}
+		for (const [key, entry] of this.unsettled) if (key === op || entry.logicalId === op.logicalId) this.unsettled.delete(key);
+	}
+	record(logicalId, write, record, policiesChanged, via) {
+		if (via === "cc-api" && !isStandaloneInlinePolicyType(record.resourceType)) {
+			this.entries.delete(logicalId);
+			return;
+		}
+		this.entries.set(logicalId, {
+			write,
+			record,
+			policiesChanged
+		});
+	}
+	claimedFor(resourceType, logicalId, stateResources) {
+		if (resourceType !== "AWS::IAM::Policy" && !Object.hasOwn(PRINCIPAL_KINDS, resourceType) && !isStandaloneInlinePolicyType(resourceType)) return;
+		return (kind, principal, policyName) => {
+			const writers = /* @__PURE__ */ new Map();
+			const changes = /* @__PURE__ */ new Map();
+			for (const [lid, entry] of this.entries) {
+				if (!Object.hasOwn(stateResources, lid) || stateResources[lid] !== entry.record) continue;
+				writers.set(lid, entry.write);
+				if (entry.policiesChanged) changes.set(lid, {
+					logicalId: lid,
+					changeType: "UPDATE",
+					resourceType: entry.record.resourceType,
+					propertyChanges: [{
+						path: "Policies",
+						oldValue: void 0,
+						newValue: void 0,
+						requiresReplacement: false
+					}]
+				});
+			}
+			const claimed = isInlinePolicyClaimedByCompletedWriter({
+				selfLogicalId: logicalId,
+				writers,
+				changes,
+				stateResources
+			}, kind, principal, policyName);
+			if (!claimed) {
+				const key = removalKey(kind, principal, policyName);
+				const noted = this.removals.get(key) ?? {
+					kind,
+					principal,
+					policyName,
+					removers: /* @__PURE__ */ new Map()
+				};
+				noted.removers.set(logicalId, stateResources[logicalId]);
+				this.removals.set(key, noted);
+			}
+			return claimed;
+		};
+	}
+	takeHeldRemovals(stateResources) {
+		const held = [];
+		for (const [key, { kind, principal, policyName, removers }] of this.removals) {
+			const { holders, unreadable } = inlinePolicyHolders(stateResources, kind, principal, policyName);
+			const others = holders.filter((h) => !removers.has(h.logicalId) || stateResources[h.logicalId] !== removers.get(h.logicalId));
+			if (others.length === 0) continue;
+			this.removals.delete(key);
+			const open = new Set([...this.unsettled.values()].map((u) => u.logicalId));
+			const unsettled = [...new Set(others.map((h) => h.logicalId))].filter((id) => open.has(id));
+			held.push({
+				kind,
+				holders: others,
+				unreadable,
+				unsettled
+			});
+		}
+		return held;
+	}
+};
+function inlinePolicyHolders(stateResources, kind, principal, policyName) {
+	const holders = [];
+	const unreadable = [];
+	const unnamed = (v) => typeof v !== "string" || !IAM_NAME.test(v);
+	for (const [logicalId, record] of Object.entries(stateResources)) {
+		if (record === null || typeof record !== "object") continue;
+		const props = record.properties ?? {};
+		const standalone = standaloneInlinePolicyOf(record.resourceType, props);
+		if (standalone !== void 0) {
+			if (standalone.kind !== kind) continue;
+			const principalMatches = sameIamName(standalone.principal, principal);
+			const nameMatches = sameIamName(standalone.policyName, policyName);
+			if (principalMatches && nameMatches) holders.push({
+				logicalId,
+				principal: standalone.principal,
+				policyName: standalone.policyName,
+				document: props["PolicyDocument"]
+			});
+			else if ((principalMatches || unnamed(standalone.principal)) && (nameMatches || unnamed(standalone.policyName))) unreadable.push(logicalId);
+			continue;
+		}
+		if (record.resourceType === "AWS::IAM::Policy") {
+			const nameMatches = sameIamName(record.physicalId, policyName);
+			if (!nameMatches && !unnamed(record.physicalId)) continue;
+			const listed = props[POLICY_LIST_FIELDS[kind]];
+			const entries = Array.isArray(listed) ? listed : [];
+			const named = entries.find((p) => sameIamName(p, principal));
+			if (nameMatches && typeof named === "string") holders.push({
+				logicalId,
+				principal: named,
+				policyName: record.physicalId,
+				document: props["PolicyDocument"]
+			});
+			else if (named !== void 0 || entries.some(unnamed)) unreadable.push(logicalId);
+			continue;
+		}
+		if (!Object.hasOwn(PRINCIPAL_KINDS, record.resourceType)) continue;
+		if (PRINCIPAL_KINDS[record.resourceType] !== kind) continue;
+		const principalMatches = sameIamName(record.physicalId, principal);
+		if (!principalMatches && !unnamed(record.physicalId)) continue;
+		const policies = props["Policies"];
+		if (!Array.isArray(policies)) continue;
+		for (const entry of policies) {
+			if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+			const name = entry["PolicyName"];
+			if (principalMatches && sameIamName(name, policyName)) holders.push({
+				logicalId,
+				principal: record.physicalId,
+				policyName: name,
+				document: entry["PolicyDocument"]
+			});
+			else if (unnamed(name) || sameIamName(name, policyName)) unreadable.push(logicalId);
+		}
+	}
+	return {
+		holders,
+		unreadable: [...new Set(unreadable)]
+	};
+}
+function sameIamName(a, b) {
+	return typeof a === "string" && IAM_NAME.test(a) && a.toLowerCase() === b.toLowerCase();
+}
+function removalKey(kind, principal, policyName) {
+	return JSON.stringify([
+		kind,
+		principal.toLowerCase(),
+		policyName.toLowerCase()
+	]);
+}
+const IAM_NAME = /^[\w+=,.@-]+$/;
+const POLICY_LIST_FIELDS = {
+	role: "Roles",
+	group: "Groups",
+	user: "Users"
+};
+const PRINCIPAL_KINDS = {
+	"AWS::IAM::Role": "role",
+	"AWS::IAM::Group": "group",
+	"AWS::IAM::User": "user"
+};
+const STANDALONE_POLICY_KINDS = {
+	"AWS::IAM::RolePolicy": "role",
+	"AWS::IAM::GroupPolicy": "group",
+	"AWS::IAM::UserPolicy": "user"
+};
+function isStandaloneInlinePolicyType(resourceType) {
+	return Object.hasOwn(STANDALONE_POLICY_KINDS, resourceType);
+}
+function standaloneInlinePolicyOf(resourceType, properties) {
+	if (!isStandaloneInlinePolicyType(resourceType)) return void 0;
+	const kind = STANDALONE_POLICY_KINDS[resourceType];
+	const props = properties ?? {};
+	return {
+		kind,
+		principal: props[PRINCIPAL_NAME_FIELDS[kind]],
+		policyName: props["PolicyName"]
+	};
+}
+function standaloneInlinePolicyHandedOff(resourceType, properties, claimed, physicalId) {
+	if (claimed === void 0) return false;
+	const target = standaloneInlinePolicyOf(resourceType, properties);
+	if (target === void 0) return false;
+	const { kind, principal, policyName } = target;
+	if (typeof principal !== "string" || !IAM_NAME.test(principal)) return false;
+	if (typeof policyName !== "string" || !IAM_NAME.test(policyName)) return false;
+	if (physicalId !== void 0 && physicalId.toLowerCase() !== `${policyName}|${principal}`.toLowerCase()) return false;
+	return claimed(kind, principal, policyName) === true;
+}
+function isInlinePolicyPrincipalType(resourceType) {
+	return Object.hasOwn(PRINCIPAL_KINDS, resourceType);
+}
+function principalKindOf(resourceType) {
+	return Object.hasOwn(PRINCIPAL_KINDS, resourceType) ? PRINCIPAL_KINDS[resourceType] : void 0;
+}
+const ANY = "*";
+const PRINCIPAL_NAME_FIELDS = {
+	role: "RoleName",
+	group: "GroupName",
+	user: "UserName"
+};
+function nameKey(value) {
+	return typeof value === "string" && IAM_NAME.test(value) ? value.toLowerCase() : ANY;
+}
+function templatePrincipalKeys(entry, kind, templateResources, stateResources) {
+	if (typeof entry === "string") return [nameKey(entry)];
+	const ref = typeof entry === "object" && entry !== null && !Array.isArray(entry) ? entry["Ref"] : void 0;
+	if (typeof ref !== "string" || !Object.hasOwn(templateResources, ref)) return [ANY];
+	const target = templateResources[ref];
+	if (principalKindOf(target.Type) !== kind) return [ANY];
+	return principalSelfKeys(ref, kind, target, stateResources);
+}
+function principalSelfKeys(logicalId, kind, template, stateResources) {
+	const keys = [`ref:${logicalId}`];
+	const declared = template?.Properties?.[PRINCIPAL_NAME_FIELDS[kind]];
+	const declaredKey = nameKey(declared);
+	if (declaredKey !== ANY) keys.push(declaredKey);
+	const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+	if (record !== void 0 && principalKindOf(record.resourceType) === kind) {
+		const recordedKey = nameKey(record.physicalId);
+		if (recordedKey !== ANY) keys.push(recordedKey);
+	}
+	return keys;
+}
+function policiesNames(policies) {
+	if (policies === void 0 || policies === null) return [];
+	if (!Array.isArray(policies)) return [ANY];
+	return policies.map((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) ? nameKey(entry["PolicyName"]) : ANY);
+}
+function standaloneClaimSides(logicalId, change, templateResources, stateResources) {
+	const template = Object.hasOwn(templateResources, logicalId) ? templateResources[logicalId] : void 0;
+	const desired = standaloneInlinePolicyOf(change.resourceType, template?.Properties ?? {});
+	if (desired === void 0) return void 0;
+	const { kind } = desired;
+	const name = nameKey(desired.policyName);
+	const sides = {
+		desired: templatePrincipalKeys(desired.principal, kind, templateResources, stateResources).map((principal) => ({
+			kind,
+			principal,
+			name
+		})),
+		old: []
+	};
+	const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+	if (record?.resourceType === change.resourceType) {
+		const old = standaloneInlinePolicyOf(change.resourceType, record.properties);
+		sides.old.push({
+			kind,
+			principal: nameKey(old.principal),
+			name: nameKey(old.policyName)
+		});
+	}
+	return sides;
+}
+function inlinePolicyClaimsOf(logicalId, change, templateResources, stateResources) {
+	const template = Object.hasOwn(templateResources, logicalId) ? templateResources[logicalId] : void 0;
+	const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+	const recorded = record?.resourceType === change.resourceType ? record : void 0;
+	const claims = [];
+	const cross = (kind, principals, names) => {
+		for (const principal of new Set(principals)) for (const name of new Set(names)) claims.push({
+			kind,
+			principal,
+			name
+		});
+	};
+	const standalone = standaloneClaimSides(logicalId, change, templateResources, stateResources);
+	if (standalone !== void 0) return [...standalone.desired, ...standalone.old];
+	if (change.resourceType === "AWS::IAM::Policy") {
+		const desired = template?.Properties ?? {};
+		const old = recorded?.properties ?? {};
+		const names = [];
+		if (desired["PolicyName"] !== void 0) names.push(nameKey(desired["PolicyName"]));
+		if (old["PolicyName"] !== void 0) names.push(nameKey(old["PolicyName"]));
+		if (recorded !== void 0) names.push(nameKey(typeof recorded.physicalId === "string" ? recorded.physicalId.split(":")[0] : recorded.physicalId));
+		if (names.length === 0) return claims;
+		for (const kind of [
+			"role",
+			"group",
+			"user"
+		]) {
+			const field = POLICY_LIST_FIELDS[kind];
+			const principals = [];
+			const listed = desired[field];
+			if (Array.isArray(listed)) for (const entry of listed) principals.push(...templatePrincipalKeys(entry, kind, templateResources, stateResources));
+			else if (listed !== void 0) principals.push(ANY);
+			const held = old[field];
+			if (Array.isArray(held)) principals.push(...held.map(nameKey));
+			else if (held !== void 0 && held !== null) principals.push(ANY);
+			cross(kind, principals, names);
+		}
+		return claims;
+	}
+	const kind = principalKindOf(change.resourceType);
+	if (kind === void 0) return claims;
+	if (!(change.changeType === "CREATE" || (change.propertyChanges ?? []).some((c) => c.requiresReplacement) || ownPoliciesChange(change))) return claims;
+	cross(kind, principalSelfKeys(logicalId, kind, template, stateResources), [...policiesNames(template?.Properties?.["Policies"]), ...policiesNames(recorded?.properties?.["Policies"])]);
+	return claims;
+}
+function orderInlinePolicyWriters(args) {
+	const { writes, changes, templateResources, stateResources, dependencies, rank } = args;
+	const writers = writes.filter((id) => {
+		const type = changes.get(id)?.resourceType;
+		return type === "AWS::IAM::Policy" || type !== void 0 && (isInlinePolicyPrincipalType(type) || isStandaloneInlinePolicyType(type));
+	});
+	if (writers.length < 2) return [];
+	const exact = /* @__PURE__ */ new Map();
+	const loose = [];
+	const all = [];
+	for (const id of writers) for (const claim of inlinePolicyClaimsOf(id, changes.get(id), templateResources, stateResources)) {
+		all.push({
+			id,
+			claim
+		});
+		if (claim.principal === ANY || claim.name === ANY) {
+			loose.push({
+				id,
+				claim
+			});
+			continue;
+		}
+		const key = JSON.stringify([
+			claim.kind,
+			claim.principal,
+			claim.name
+		]);
+		const ids = exact.get(key) ?? /* @__PURE__ */ new Set();
+		ids.add(id);
+		exact.set(key, ids);
+	}
+	const principalRows = new Set(writers.filter((id) => isInlinePolicyPrincipalType(changes.get(id).resourceType)));
+	const standaloneRows = new Set(writers.filter((id) => isStandaloneInlinePolicyType(changes.get(id).resourceType)));
+	const sides = new Map([...standaloneRows].map((id) => [id, standaloneClaimSides(id, changes.get(id), templateResources, stateResources)]));
+	const sameClaim = (p, q) => p.kind === q.kind && (p.principal === ANY || q.principal === ANY || p.principal === q.principal) && (p.name === ANY || q.name === ANY || p.name === q.name);
+	const releasesFor = (a, b) => sides.get(a).old.some((o) => sides.get(b).desired.some((d) => sameClaim(o, d)));
+	const pairs = /* @__PURE__ */ new Map();
+	const pair = (a, b) => {
+		if (a === b || principalRows.has(a) && principalRows.has(b)) return;
+		const sa = standaloneRows.has(a);
+		const sb = standaloneRows.has(b);
+		let first;
+		if (sa !== sb) first = sa ? b : a;
+		else if (sa && sb) {
+			const aReleases = releasesFor(a, b);
+			if (aReleases !== releasesFor(b, a)) first = aReleases ? a : b;
+		}
+		first ??= rank(a) < rank(b) || rank(a) === rank(b) && a < b ? a : b;
+		const [x, y] = first === a ? [a, b] : [b, a];
+		pairs.set(JSON.stringify([x, y]), [x, y]);
+	};
+	for (const ids of exact.values()) {
+		const list = [...ids];
+		for (let i = 0; i < list.length; i++) for (let j = i + 1; j < list.length; j++) pair(list[i], list[j]);
+	}
+	const meets = (a, b) => a === ANY || b === ANY || a === b;
+	for (const { id, claim } of loose) for (const other of all) {
+		if (other.claim.kind !== claim.kind) continue;
+		if (meets(claim.principal, other.claim.principal) && meets(claim.name, other.claim.name)) pair(id, other.id);
+	}
+	if (pairs.size === 0) return [];
+	const reaches = (from, to) => {
+		const seen = /* @__PURE__ */ new Set();
+		const stack = [from];
+		while (stack.length > 0) {
+			const id = stack.pop();
+			if (id === to) return true;
+			if (seen.has(id)) continue;
+			seen.add(id);
+			for (const dep of dependencies.get(id) ?? []) stack.push(dep);
+		}
+		return false;
+	};
+	const added = [];
+	for (const [before, after] of pairs.values()) {
+		if (reaches(after, before) || reaches(before, after)) continue;
+		const deps = dependencies.get(after) ?? /* @__PURE__ */ new Set();
+		deps.add(before);
+		dependencies.set(after, deps);
+		added.push({
+			before,
+			after
+		});
+	}
+	return added;
+}
+function recordInlinePolicyKeys(record) {
+	if (record === void 0 || record === null || typeof record !== "object") return [];
+	const props = record.properties ?? {};
+	const keys = [];
+	const add = (kind, principal, name) => {
+		keys.push(JSON.stringify([
+			kind,
+			nameKey(principal),
+			nameKey(name)
+		]));
+	};
+	const standalone = standaloneInlinePolicyOf(record.resourceType, props);
+	if (standalone !== void 0) {
+		add(standalone.kind, standalone.principal, standalone.policyName);
+		return keys;
+	}
+	if (record.resourceType === "AWS::IAM::Policy") {
+		const names = [props["PolicyName"], typeof record.physicalId === "string" ? record.physicalId.split(":")[0] : record.physicalId];
+		for (const kind of [
+			"role",
+			"group",
+			"user"
+		]) {
+			const listed = props[POLICY_LIST_FIELDS[kind]];
+			if (listed === void 0 || listed === null) continue;
+			const principals = Array.isArray(listed) ? listed : [void 0];
+			for (const p of principals) for (const n of names) add(kind, p, n);
+		}
+		return keys;
+	}
+	const kind = principalKindOf(record.resourceType);
+	if (kind === void 0) return keys;
+	for (const name of policiesNames(props["Policies"])) add(kind, record.physicalId, name);
+	return keys;
+}
+function orderInlinePolicyReversals(replay, stateResources) {
+	const current = (op) => Object.hasOwn(stateResources, op.logicalId) ? stateResources[op.logicalId] : void 0;
+	const isStandalone = (op) => [current(op), op.previousState].some((r) => r !== void 0 && r !== null && isStandaloneInlinePolicyType(r.resourceType));
+	if (!replay.some(isStandalone)) return [...replay];
+	const keysOf = /* @__PURE__ */ new Map();
+	for (const op of replay) {
+		const keys = [...recordInlinePolicyKeys(current(op)), ...recordInlinePolicyKeys(op.previousState)];
+		if (keys.length > 0) keysOf.set(op, new Set(keys));
+	}
+	if (keysOf.size < 2) return [...replay];
+	const meets = (a, b) => a === ANY || b === ANY || a === b;
+	const collide = (a, b) => {
+		for (const ka of a) {
+			const [kindA, pA, nA] = JSON.parse(ka);
+			for (const kb of b) {
+				const [kindB, pB, nB] = JSON.parse(kb);
+				if (kindA === kindB && meets(pA, pB) && meets(nA, nB)) return true;
+			}
+		}
+		return false;
+	};
+	const dependsOn = (a, b) => [current(a), a.previousState].some((r) => Array.isArray(r?.dependencies) && r.dependencies.includes(b.logicalId));
+	const order = [...replay];
+	for (const op of [...replay].reverse()) {
+		if (!isStandalone(op)) continue;
+		const mine = keysOf.get(op);
+		if (mine === void 0) continue;
+		const at = order.indexOf(op);
+		let last = -1;
+		for (let j = at + 1; j < order.length; j++) {
+			const other = order[j];
+			const theirs = keysOf.get(other);
+			if (dependsOn(op, other) || dependsOn(other, op)) break;
+			if (theirs === void 0 || isStandalone(other)) continue;
+			if (collide(mine, theirs)) last = j;
+		}
+		if (last < 0) continue;
+		order.splice(at, 1);
+		order.splice(last, 0, op);
+	}
+	return order;
+}
+function ownPoliciesChange(change) {
+	return (change?.propertyChanges ?? []).some((c) => c.path === "Policies" && c.inPlacePropagated !== true && c.replacementPropagated !== true);
+}
+
 //#endregion
 //#region src/provisioning/json-patch-generator.ts
 var JsonPatchGenerator = class {
@@ -23246,6 +24259,10 @@ const WRITABLE_GETATT_ATTRIBUTES = {
 	"AWS::MediaConvert::JobTemplate": ["Name"],
 	"AWS::MediaConvert::Preset": ["Name"],
 	"AWS::MediaConvert::Queue": ["Name"],
+	"AWS::NetworkManager::ConnectAttachment": ["ProposedSegmentChange"],
+	"AWS::NetworkManager::SiteToSiteVpnAttachment": ["ProposedSegmentChange"],
+	"AWS::NetworkManager::TransitGatewayRouteTableAttachment": ["ProposedSegmentChange"],
+	"AWS::NetworkManager::VpcAttachment": ["ProposedSegmentChange"],
 	"AWS::OpsWorks::Instance": ["AvailabilityZone"],
 	"AWS::OpsWorks::UserProfile": ["SshUsername"],
 	"AWS::QuickSight::Analysis": ["Errors", "Sheets"],
@@ -23290,9 +24307,24 @@ const WRITABLE_GETATT_ATTRIBUTES = {
 	"AWS::StepFunctions::Activity": ["Name"],
 	"AWS::Transfer::User": ["ServerId", "UserName"]
 };
+const SHAPE_MISMATCHED_GETATT_ATTRIBUTES = {
+	"AWS::DocDB::DBCluster": ["Port"],
+	"AWS::Events::EventBus": ["Policy"],
+	"AWS::MediaLive::Input": ["Destinations", "Sources"]
+};
 
 //#endregion
 //#region src/provisioning/read-only-properties.ts
+function isDefinitiveRefusal(error) {
+	if (isThrottlingError(error)) return false;
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		const status = current.$metadata?.httpStatusCode;
+		if (status !== void 0) return status >= 400 && status < 500;
+		current = current.cause;
+	}
+	return false;
+}
 const readOnlyPropertiesCache = /* @__PURE__ */ new Map();
 const attributeNamesCache = /* @__PURE__ */ new Map();
 async function getTopLevelAttributeNames(resourceType) {
@@ -23306,12 +24338,24 @@ async function getTopLevelAttributeNames(resourceType) {
 	attributeNamesCache.set(resourceType, names);
 	return names;
 }
+const deployAttributeNamesCache = /* @__PURE__ */ new Map();
+async function getTopLevelDeployAttributeNames(resourceType) {
+	const certified = await getTopLevelAttributeNames(resourceType);
+	if (certified === void 0) return void 0;
+	const mismatched = Object.hasOwn(SHAPE_MISMATCHED_GETATT_ATTRIBUTES, resourceType) ? SHAPE_MISMATCHED_GETATT_ATTRIBUTES[resourceType] : void 0;
+	if (!mismatched || mismatched.length === 0) return certified;
+	const cached = deployAttributeNamesCache.get(resourceType);
+	if (cached) return cached;
+	const names = /* @__PURE__ */ new Set([...certified, ...mismatched]);
+	deployAttributeNamesCache.set(resourceType, names);
+	return names;
+}
 function getTopLevelReadOnlyProperties(resourceType) {
 	if (hasNoRegistrySchema(resourceType)) return Promise.resolve(void 0);
 	const cached = readOnlyPropertiesCache.get(resourceType);
 	if (cached) return cached;
 	const entry = fetchTopLevelReadOnlyProperties(resourceType).catch((error) => {
-		readOnlyPropertiesCache.delete(resourceType);
+		if (!isDefinitiveRefusal(error)) readOnlyPropertiesCache.delete(resourceType);
 		const message = describeAwsFailure(error).detail;
 		getLogger().child("ReadOnlyProperties").debug(`Failed to resolve read-only properties for ${displaySafe(resourceType, { asciiOnly: true })} via cloudformation:DescribeType (${message}).`);
 	});
@@ -23728,10 +24772,11 @@ var CloudControlProvider = class {
 	async create(logicalId, resourceType, properties, context) {
 		const mask = maskerOrIdentity(context?.maskSecrets);
 		const idLog = new IdScrubLog(this.logger, mask, holdsSecretDerivedLeaf(properties, mask));
-		return inIdLogScope(idLog, () => this.createInIdLogScope(logicalId, resourceType, properties, idLog));
+		return inIdLogScope(idLog, () => this.createInIdLogScope(logicalId, resourceType, properties, idLog, mask));
 	}
-	async createInIdLogScope(logicalId, resourceType, properties, idLog) {
+	async createInIdLogScope(logicalId, resourceType, properties, idLog, mask) {
 		this.logger.debug(`Creating resource ${logicalId} (${resourceType})`);
+		const attributeNamesLookup = getTopLevelDeployAttributeNames(resourceType);
 		try {
 			const ccProperties = stringifyJsonProperties(resourceType, stripNullValues(properties));
 			const desiredState = JSON.stringify(ccProperties);
@@ -23749,7 +24794,9 @@ var CloudControlProvider = class {
 			const result = { physicalId: progressEvent.Identifier };
 			if (progressEvent.ResourceModel) result.attributes = this.parseResourceModel(progressEvent.ResourceModel);
 			result.attributes = await this.mergeSparseModelReadback(resourceType, progressEvent.Identifier, result.attributes || {});
+			const modelKeys = Object.keys(result.attributes);
 			result.attributes = await this.enrichResourceAttributes(resourceType, progressEvent.Identifier, result.attributes);
+			result.attributes = await this.maskDeployedNonAttributeKeys(result.attributes, modelKeys, resourceType, progressEvent.Identifier, attributeNamesLookup, properties, mask);
 			return result;
 		} catch (error) {
 			idLog.addId(identifierCarriedBy(error));
@@ -23820,6 +24867,7 @@ var CloudControlProvider = class {
 					sentNothing: true
 				};
 			}
+			const attributeNamesLookup = getTopLevelDeployAttributeNames(resourceType);
 			const writeOnlyProperties = await getTopLevelWriteOnlyProperties(resourceType);
 			if (writeOnlyProperties.size > 0) {
 				const keptOnPreviousSide = getTopLevelKeysHoldingUnreadableCreateOnly(resourceType, cleanProperties);
@@ -23860,7 +24908,9 @@ var CloudControlProvider = class {
 			};
 			if (progressEvent.ResourceModel) result.attributes = this.parseResourceModel(progressEvent.ResourceModel, idLog);
 			result.attributes = await this.mergeSparseModelReadback(resourceType, physicalId, result.attributes || {}, idLog);
+			const modelKeys = Object.keys(result.attributes);
 			result.attributes = await this.enrichResourceAttributes(resourceType, physicalId, result.attributes, idLog);
+			result.attributes = await this.maskDeployedNonAttributeKeys(result.attributes, modelKeys, resourceType, physicalId, attributeNamesLookup, properties, maskerOrIdentity(context?.maskSecrets), idLog);
 			return result;
 		} catch (error) {
 			this.handleError(error, "UPDATE", resourceType, logicalId, physicalId);
@@ -23885,10 +24935,14 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		await this.assertRecordedRegionAgainstClient("pre-delete", context?.expectedRegion, resourceType, logicalId, physicalId);
+		if (standaloneInlinePolicyHandedOff(resourceType, properties, context?.inlinePolicyClaimed, physicalId)) {
+			this.logger.info(`  ${logicalId}: not deleting its inline policy, which another resource of this deploy now holds under the same name`);
+			return;
+		}
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-D9Po293s.js");
+			const { ASGProvider } = await import("./asg-provider-semUK44T.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -23994,7 +25048,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-CU0LZr05.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-xROL9y31.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-X4mc-nGw.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-C4A86Y7P.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -24639,6 +25693,25 @@ var CloudControlProvider = class {
 			throw error;
 		}
 	}
+	async maskDeployedNonAttributeKeys(attributes, modelKeys, resourceType, physicalId, attributeNamesLookup, desired, mask, log = this.logger) {
+		const safeType = displaySafe(resourceType, { asciiOnly: true });
+		const attributeNames = await attributeNamesLookup;
+		if (attributeNames === void 0) {
+			log.debug(`Could not resolve the CloudFormation schema for ${safeType}; recording its Cloud Control model unnarrowed for ${displaySafe(physicalId, { asciiOnly: true })}.`);
+			return attributes;
+		}
+		const narrowed = new Set(modelKeys.filter((key) => !attributeNames.has(key) && !isLiteralDeployOnlyKey(resourceType, key, desired, mask)));
+		if (narrowed.size === 0) return attributes;
+		const out = Object.create(null);
+		for (const [key, value] of Object.entries(attributes)) Object.defineProperty(out, key, {
+			value: narrowed.has(key) ? maskLeavesDeep(value) : value,
+			enumerable: true,
+			writable: true,
+			configurable: true
+		});
+		log.debug(`Masked ${narrowed.size} non-attribute key(s) of the ${safeType} Cloud Control model for ${displaySafe(physicalId, { asciiOnly: true })}: they are not Fn::GetAtt attributes of the type.`);
+		return out;
+	}
 	async import(input) {
 		if (!input.knownPhysicalId) return null;
 		const identifier = toCloudControlIdentifier({
@@ -24794,6 +25867,11 @@ function holdsSecretDerivedLeaf(value, mask, depth = 0) {
 	return Object.entries(value).some(([key, entry]) => isSecretDerivedValue(key, mask) || holdsSecretDerivedLeaf(entry, mask, depth + 1));
 }
 const IMPORT_YIELDED_NO_ATTRIBUTES_CONSEQUENCE = "Attributes the stack's state already records for this physical id are kept; without them, an Fn::GetAtt against this resource falls back to a value constructed from its physical id.";
+function isLiteralDeployOnlyKey(resourceType, key, desired, mask) {
+	if (resourceType !== "AWS::SSM::Parameter" || key !== "Value") return false;
+	const declared = desired["Value"];
+	return typeof declared === "string" && !isSecretDerivedValue(declared, mask);
+}
 function maskLeavesDeep(value) {
 	if (Array.isArray(value)) return value.map((element) => maskLeavesDeep(element));
 	if (value !== null && typeof value === "object") {
@@ -25152,6 +26230,7 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 	logger = getLogger().child("NoEchoDeleteReresolution");
 	resolver;
 	parametersPromise;
+	printingNoEchoPromise;
 	noEchoParameters;
 	options;
 	constructor(options) {
@@ -25161,7 +26240,7 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 		const section = options.template.Parameters;
 		if (section !== null && typeof section === "object") for (const [name, definition] of Object.entries(section)) {
 			const noEcho = definition?.NoEcho;
-			if (noEcho === true || noEcho === "true") declared.add(name);
+			if (isNoEchoDeclared(noEcho)) declared.add(name);
 		}
 		for (const name of options.inheritedNoEchoParameters ?? []) declared.add(name);
 		this.noEchoParameters = declared;
@@ -25213,6 +26292,33 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 		for (const name of this.noEchoParameters) if (parameters !== void 0 && Object.hasOwn(parameters, name)) recordLogOnlyParameterValue(bag, parameters[name]);
 		return bag;
 	}
+	printingNoEchoValues() {
+		this.printingNoEchoPromise ??= this.printingNeedles().then((bag) => hasMaskableValues(bag) ? bag : void 0);
+		return this.printingNoEchoPromise;
+	}
+	async printingNeedles() {
+		const bag = this.newBag();
+		if (this.options.printingSeed !== void 0) carryLogOnlyValues(this.options.printingSeed, bag);
+		if (this.noEchoParameters.size === 0) return bag;
+		const parameters = await this.boundParameters();
+		const section = this.options.template.Parameters ?? {};
+		const supplied = this.options.parameters;
+		for (const name of this.noEchoParameters) {
+			if (parameters !== void 0) {
+				if (Object.hasOwn(parameters, name)) recordLogOnlyParameterValue(bag, parameters[name]);
+				continue;
+			}
+			if (supplied !== void 0 && Object.hasOwn(supplied, name)) {
+				const value = supplied[name];
+				if (!this.options.maskedParameters?.has(name)) recordLogOnlyParameterValue(bag, value);
+				continue;
+			}
+			const definition = Object.hasOwn(section, name) ? section[name] : void 0;
+			if (typeof definition?.Type === "string" && definition.Type.startsWith("AWS::SSM::")) continue;
+			if (definition?.Default !== void 0) recordLogOnlyParameterValue(bag, definition.Default);
+		}
+		return bag;
+	}
 	async valuesFor(logicalId, record) {
 		const masked = maskedNoEchoCoordinates(record.properties, noEchoLeavesOf(record));
 		if (masked.length === 0) return void 0;
@@ -25287,8 +26393,10 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 			const parameters0 = await this.boundParameters();
 			const rowTemplate = this.options.template.Resources?.[logicalId];
 			const passedClasses = parameters0 === void 0 ? void 0 : await classifyPassedParameters(rowTemplate?.Properties?.Parameters, this.inputSources(parameters0)).catch(() => void 0);
+			const printingSeed = await this.printingNoEchoValues().catch(() => void 0);
 			return new TemplateNoEchoReresolver({
 				...passedClasses !== void 0 && { passedClasses },
+				...printingSeed !== void 0 && { printingSeed },
 				template: child.template,
 				stackName: childStackName,
 				region: this.options.region,
@@ -28627,449 +29735,108 @@ var CreateTokenLedger = class {
 			}
 		});
 	}
-	noteStateSaved(stackName, region) {
-		if (this.stack === void 0 || this.stack.stackName !== stackName || this.stack.region !== region) return Promise.resolve();
-		this.stateRecorded = true;
-		if (this.stateRecordedPersisted) return Promise.resolve();
-		return this.serialized(async () => {
-			if (this.stateRecordedPersisted) return;
-			try {
-				const doc = await this.current();
-				if (doc === null || doc.stateRecorded === true) {
-					this.stateRecordedPersisted = true;
-					return;
-				}
-				await this.persist(doc);
-			} catch (error) {
-				this.stale = true;
-				this.logger.warn(safeMsg`Could not mark this stack's create-token ledger as recorded (${describeAwsFailure(error).summary}); the next state save tries again.`);
-			}
-		});
-	}
-};
-function ledgerForStack(backend, stackName, region) {
-	return new CreateTokenLedger({
-		load: () => backend.loadCreateTokenLedger(stackName, region),
-		save: (doc) => backend.saveCreateTokenLedger(stackName, region, doc)
-	}, {
-		stackName,
-		region
-	});
-}
-const ledgerStore = new AsyncLocalStorage();
-const ADOPTING_CREATE_BASE = "adopt-by-name:";
-async function recordedAdoptingCreates() {
-	const ledger = ledgerStore.getStore();
-	if (ledger === void 0) return void 0;
-	const out = /* @__PURE__ */ new Map();
-	for (const [logicalId, entry] of Object.entries(await ledger.sentEntries())) if (entry.base.startsWith("adopt-by-name:")) out.set(logicalId, {
-		resourceType: entry.base.slice(14),
-		name: entry.token,
-		firstSentAt: entry.firstSentAt,
-		...entry.failedAt !== void 0 && { failedAt: entry.failedAt }
-	});
-	return out;
-}
-async function recordAdoptingCreates(creates) {
-	const ledger = ledgerStore.getStore();
-	if (ledger === void 0 || creates.length === 0) return;
-	await ledger.recordSent(creates.map((c) => ({
-		logicalId: c.logicalId,
-		base: `${ADOPTING_CREATE_BASE}${c.resourceType}`,
-		token: c.name
-	})), Date.now());
-}
-async function noteAbandonedRun(at) {
-	const ledger = ledgerStore.getStore();
-	if (ledger === void 0) return true;
-	return ledger.noteAbandoned(at).then(() => true, () => false);
-}
-async function ledgerAbandonedAt() {
-	return ledgerStore.getStore()?.abandonedAt();
-}
-async function settleAdoptingCreates(drop, failedAt = /* @__PURE__ */ new Map()) {
-	await ledgerStore.getStore()?.settleAdoptingCreates(drop, failedAt);
-}
-function withCreateTokenLedger(ledger, fn) {
-	return ledgerStore.run(ledger, () => withStateSavedObserver((stackName, region) => ledger.noteStateSaved(stackName, region), fn));
-}
-function noteDeployStateRecord(exists) {
-	ledgerStore.getStore()?.beginDeploy(exists);
-}
-function earliestDefined(...times) {
-	const defined = times.filter((t) => t !== void 0);
-	return defined.length === 0 ? void 0 : Math.min(...defined);
-}
-async function forgetRecordedCreateTokens(logicalIds) {
-	await ledgerStore.getStore()?.forget(logicalIds);
-}
-const LEDGER_TOKEN_RESOURCE_TYPES = /* @__PURE__ */ new Set([
-	"AWS::EFS::FileSystem",
-	"AWS::FSx::FileSystem",
-	"AWS::CloudFront::CloudFrontOriginAccessIdentity"
-]);
-async function noteRetainedResource(resourceType, logicalId) {
-	if (!LEDGER_TOKEN_RESOURCE_TYPES.has(resourceType)) return;
-	await ledgerStore.getStore()?.rotate(logicalId);
-}
-async function reserveStackCreateToken(options) {
-	const base = stackScopedCreateToken(options);
-	const ledger = ledgerStore.getStore();
-	if (ledger === void 0) return {
-		value: base,
-		base,
-		earlierFirstSentAt: void 0,
-		ledgerStartedThisDeploy: false
-	};
-	const derive = (nonce) => stackScopedCreateToken({
-		...options,
-		immutableInputs: [...options.immutableInputs, { createTokenNonce: nonce }]
-	});
-	return {
-		...await ledger.reserve(options.logicalId, base, derive, Date.now()),
-		base
-	};
-}
-
-//#endregion
-//#region src/deployment/inline-policy-claims.ts
-function isInlinePolicyClaimedByCompletedWriter(args, kind, principal, policyName) {
-	const { selfLogicalId, writers, changes, stateResources } = args;
-	for (const [lid, write] of writers) {
-		if (lid === selfLogicalId || !Object.hasOwn(stateResources, lid)) continue;
-		const record = stateResources[lid];
-		if (record.provisionedBy === "cc-api") continue;
-		const props = record.properties ?? {};
-		if (record.resourceType === "AWS::IAM::Policy") {
-			if (!sameIamName(record.physicalId, policyName)) continue;
-			const listed = props[POLICY_LIST_FIELDS[kind]];
-			if (Array.isArray(listed) && listed.some((p) => sameIamName(p, principal))) return true;
-			continue;
-		}
-		if (!Object.hasOwn(PRINCIPAL_KINDS, record.resourceType)) continue;
-		if (PRINCIPAL_KINDS[record.resourceType] !== kind) continue;
-		if (!sameIamName(record.physicalId, principal)) continue;
-		if (write !== "create" && !ownPoliciesChange(changes.get(lid))) continue;
-		const policies = props["Policies"];
-		if (!Array.isArray(policies)) continue;
-		if (policies.some((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) && sameIamName(entry["PolicyName"], policyName))) return true;
-	}
-	return false;
-}
-var RollbackInlinePolicyWriters = class {
-	entries = /* @__PURE__ */ new Map();
-	removals = /* @__PURE__ */ new Map();
-	unsettled = /* @__PURE__ */ new Map();
-	notePending(ops) {
-		for (const op of ops) if (!this.unsettled.has(op)) this.unsettled.set(op, {
-			logicalId: op.logicalId,
-			state: "pending"
-		});
-	}
-	noteOutcome(op, completed) {
-		if (!completed) {
-			this.unsettled.set(op, {
-				logicalId: op.logicalId,
-				state: "failed"
-			});
-			return;
-		}
-		for (const [key, entry] of this.unsettled) if (key === op || entry.logicalId === op.logicalId) this.unsettled.delete(key);
-	}
-	record(logicalId, write, record, policiesChanged, via) {
-		if (via === "cc-api") {
-			this.entries.delete(logicalId);
-			return;
-		}
-		this.entries.set(logicalId, {
-			write,
-			record,
-			policiesChanged
-		});
-	}
-	claimedFor(resourceType, logicalId, stateResources) {
-		if (resourceType !== "AWS::IAM::Policy" && !Object.hasOwn(PRINCIPAL_KINDS, resourceType)) return;
-		return (kind, principal, policyName) => {
-			const writers = /* @__PURE__ */ new Map();
-			const changes = /* @__PURE__ */ new Map();
-			for (const [lid, entry] of this.entries) {
-				if (!Object.hasOwn(stateResources, lid) || stateResources[lid] !== entry.record) continue;
-				writers.set(lid, entry.write);
-				if (entry.policiesChanged) changes.set(lid, {
-					logicalId: lid,
-					changeType: "UPDATE",
-					resourceType: entry.record.resourceType,
-					propertyChanges: [{
-						path: "Policies",
-						oldValue: void 0,
-						newValue: void 0,
-						requiresReplacement: false
-					}]
-				});
-			}
-			const claimed = isInlinePolicyClaimedByCompletedWriter({
-				selfLogicalId: logicalId,
-				writers,
-				changes,
-				stateResources
-			}, kind, principal, policyName);
-			if (!claimed) {
-				const key = removalKey(kind, principal, policyName);
-				const noted = this.removals.get(key) ?? {
-					kind,
-					principal,
-					policyName,
-					removers: /* @__PURE__ */ new Map()
-				};
-				noted.removers.set(logicalId, stateResources[logicalId]);
-				this.removals.set(key, noted);
-			}
-			return claimed;
-		};
-	}
-	takeHeldRemovals(stateResources) {
-		const held = [];
-		for (const [key, { kind, principal, policyName, removers }] of this.removals) {
-			const { holders, unreadable } = inlinePolicyHolders(stateResources, kind, principal, policyName);
-			const others = holders.filter((h) => !removers.has(h.logicalId) || stateResources[h.logicalId] !== removers.get(h.logicalId));
-			if (others.length === 0) continue;
-			this.removals.delete(key);
-			const open = new Set([...this.unsettled.values()].map((u) => u.logicalId));
-			const unsettled = [...new Set(others.map((h) => h.logicalId))].filter((id) => open.has(id));
-			held.push({
-				kind,
-				holders: others,
-				unreadable,
-				unsettled
-			});
-		}
-		return held;
-	}
-};
-function inlinePolicyHolders(stateResources, kind, principal, policyName) {
-	const holders = [];
-	const unreadable = [];
-	const unnamed = (v) => typeof v !== "string" || !IAM_NAME.test(v);
-	for (const [logicalId, record] of Object.entries(stateResources)) {
-		if (record === null || typeof record !== "object") continue;
-		const props = record.properties ?? {};
-		if (record.resourceType === "AWS::IAM::Policy") {
-			const nameMatches = sameIamName(record.physicalId, policyName);
-			if (!nameMatches && !unnamed(record.physicalId)) continue;
-			const listed = props[POLICY_LIST_FIELDS[kind]];
-			const entries = Array.isArray(listed) ? listed : [];
-			const named = entries.find((p) => sameIamName(p, principal));
-			if (nameMatches && typeof named === "string") holders.push({
-				logicalId,
-				principal: named,
-				policyName: record.physicalId,
-				document: props["PolicyDocument"]
-			});
-			else if (named !== void 0 || entries.some(unnamed)) unreadable.push(logicalId);
-			continue;
-		}
-		if (!Object.hasOwn(PRINCIPAL_KINDS, record.resourceType)) continue;
-		if (PRINCIPAL_KINDS[record.resourceType] !== kind) continue;
-		const principalMatches = sameIamName(record.physicalId, principal);
-		if (!principalMatches && !unnamed(record.physicalId)) continue;
-		const policies = props["Policies"];
-		if (!Array.isArray(policies)) continue;
-		for (const entry of policies) {
-			if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
-			const name = entry["PolicyName"];
-			if (principalMatches && sameIamName(name, policyName)) holders.push({
-				logicalId,
-				principal: record.physicalId,
-				policyName: name,
-				document: entry["PolicyDocument"]
-			});
-			else if (unnamed(name) || sameIamName(name, policyName)) unreadable.push(logicalId);
-		}
-	}
-	return {
-		holders,
-		unreadable: [...new Set(unreadable)]
-	};
+	noteStateSaved(stackName, region) {
+		if (this.stack === void 0 || this.stack.stackName !== stackName || this.stack.region !== region) return Promise.resolve();
+		this.stateRecorded = true;
+		if (this.stateRecordedPersisted) return Promise.resolve();
+		return this.serialized(async () => {
+			if (this.stateRecordedPersisted) return;
+			try {
+				const doc = await this.current();
+				if (doc === null || doc.stateRecorded === true) {
+					this.stateRecordedPersisted = true;
+					return;
+				}
+				await this.persist(doc);
+			} catch (error) {
+				this.stale = true;
+				this.logger.warn(safeMsg`Could not mark this stack's create-token ledger as recorded (${describeAwsFailure(error).summary}); the next state save tries again.`);
+			}
+		});
+	}
+};
+function ledgerForStack(backend, stackName, region) {
+	return new CreateTokenLedger({
+		load: () => backend.loadCreateTokenLedger(stackName, region),
+		save: (doc) => backend.saveCreateTokenLedger(stackName, region, doc)
+	}, {
+		stackName,
+		region
+	});
 }
-function sameIamName(a, b) {
-	return typeof a === "string" && IAM_NAME.test(a) && a.toLowerCase() === b.toLowerCase();
+const ledgerStore = new AsyncLocalStorage();
+const ADOPTING_CREATE_BASE = "adopt-by-name:";
+async function recordedAdoptingCreates() {
+	const ledger = ledgerStore.getStore();
+	if (ledger === void 0) return void 0;
+	const out = /* @__PURE__ */ new Map();
+	for (const [logicalId, entry] of Object.entries(await ledger.sentEntries())) if (entry.base.startsWith("adopt-by-name:")) out.set(logicalId, {
+		resourceType: entry.base.slice(14),
+		name: entry.token,
+		firstSentAt: entry.firstSentAt,
+		...entry.failedAt !== void 0 && { failedAt: entry.failedAt }
+	});
+	return out;
 }
-function removalKey(kind, principal, policyName) {
-	return JSON.stringify([
-		kind,
-		principal.toLowerCase(),
-		policyName.toLowerCase()
-	]);
+async function recordAdoptingCreates(creates) {
+	const ledger = ledgerStore.getStore();
+	if (ledger === void 0 || creates.length === 0) return;
+	await ledger.recordSent(creates.map((c) => ({
+		logicalId: c.logicalId,
+		base: `${ADOPTING_CREATE_BASE}${c.resourceType}`,
+		token: c.name
+	})), Date.now());
 }
-const IAM_NAME = /^[\w+=,.@-]+$/;
-const POLICY_LIST_FIELDS = {
-	role: "Roles",
-	group: "Groups",
-	user: "Users"
-};
-const PRINCIPAL_KINDS = {
-	"AWS::IAM::Role": "role",
-	"AWS::IAM::Group": "group",
-	"AWS::IAM::User": "user"
-};
-function isInlinePolicyPrincipalType(resourceType) {
-	return Object.hasOwn(PRINCIPAL_KINDS, resourceType);
+async function noteAbandonedRun(at) {
+	const ledger = ledgerStore.getStore();
+	if (ledger === void 0) return true;
+	return ledger.noteAbandoned(at).then(() => true, () => false);
 }
-function principalKindOf(resourceType) {
-	return Object.hasOwn(PRINCIPAL_KINDS, resourceType) ? PRINCIPAL_KINDS[resourceType] : void 0;
+async function ledgerAbandonedAt() {
+	return ledgerStore.getStore()?.abandonedAt();
 }
-const ANY = "*";
-const PRINCIPAL_NAME_FIELDS = {
-	role: "RoleName",
-	group: "GroupName",
-	user: "UserName"
-};
-function nameKey(value) {
-	return typeof value === "string" && IAM_NAME.test(value) ? value.toLowerCase() : ANY;
+async function settleAdoptingCreates(drop, failedAt = /* @__PURE__ */ new Map()) {
+	await ledgerStore.getStore()?.settleAdoptingCreates(drop, failedAt);
 }
-function templatePrincipalKeys(entry, kind, templateResources, stateResources) {
-	if (typeof entry === "string") return [nameKey(entry)];
-	const ref = typeof entry === "object" && entry !== null && !Array.isArray(entry) ? entry["Ref"] : void 0;
-	if (typeof ref !== "string" || !Object.hasOwn(templateResources, ref)) return [ANY];
-	const target = templateResources[ref];
-	if (principalKindOf(target.Type) !== kind) return [ANY];
-	return principalSelfKeys(ref, kind, target, stateResources);
+function withCreateTokenLedger(ledger, fn) {
+	return ledgerStore.run(ledger, () => withStateSavedObserver((stackName, region) => ledger.noteStateSaved(stackName, region), fn));
 }
-function principalSelfKeys(logicalId, kind, template, stateResources) {
-	const keys = [`ref:${logicalId}`];
-	const declared = template?.Properties?.[PRINCIPAL_NAME_FIELDS[kind]];
-	const declaredKey = nameKey(declared);
-	if (declaredKey !== ANY) keys.push(declaredKey);
-	const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
-	if (record !== void 0 && principalKindOf(record.resourceType) === kind) {
-		const recordedKey = nameKey(record.physicalId);
-		if (recordedKey !== ANY) keys.push(recordedKey);
-	}
-	return keys;
+function noteDeployStateRecord(exists) {
+	ledgerStore.getStore()?.beginDeploy(exists);
 }
-function policiesNames(policies) {
-	if (policies === void 0 || policies === null) return [];
-	if (!Array.isArray(policies)) return [ANY];
-	return policies.map((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) ? nameKey(entry["PolicyName"]) : ANY);
+function earliestDefined(...times) {
+	const defined = times.filter((t) => t !== void 0);
+	return defined.length === 0 ? void 0 : Math.min(...defined);
 }
-function inlinePolicyClaimsOf(logicalId, change, templateResources, stateResources) {
-	const template = Object.hasOwn(templateResources, logicalId) ? templateResources[logicalId] : void 0;
-	const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
-	const recorded = record?.resourceType === change.resourceType ? record : void 0;
-	const claims = [];
-	const cross = (kind, principals, names) => {
-		for (const principal of new Set(principals)) for (const name of new Set(names)) claims.push({
-			kind,
-			principal,
-			name
-		});
-	};
-	if (change.resourceType === "AWS::IAM::Policy") {
-		const desired = template?.Properties ?? {};
-		const old = recorded?.properties ?? {};
-		const names = [];
-		if (desired["PolicyName"] !== void 0) names.push(nameKey(desired["PolicyName"]));
-		if (old["PolicyName"] !== void 0) names.push(nameKey(old["PolicyName"]));
-		if (recorded !== void 0) names.push(nameKey(typeof recorded.physicalId === "string" ? recorded.physicalId.split(":")[0] : recorded.physicalId));
-		if (names.length === 0) return claims;
-		for (const kind of [
-			"role",
-			"group",
-			"user"
-		]) {
-			const field = POLICY_LIST_FIELDS[kind];
-			const principals = [];
-			const listed = desired[field];
-			if (Array.isArray(listed)) for (const entry of listed) principals.push(...templatePrincipalKeys(entry, kind, templateResources, stateResources));
-			else if (listed !== void 0) principals.push(ANY);
-			const held = old[field];
-			if (Array.isArray(held)) principals.push(...held.map(nameKey));
-			else if (held !== void 0 && held !== null) principals.push(ANY);
-			cross(kind, principals, names);
-		}
-		return claims;
-	}
-	const kind = principalKindOf(change.resourceType);
-	if (kind === void 0) return claims;
-	if (!(change.changeType === "CREATE" || (change.propertyChanges ?? []).some((c) => c.requiresReplacement) || ownPoliciesChange(change))) return claims;
-	cross(kind, principalSelfKeys(logicalId, kind, template, stateResources), [...policiesNames(template?.Properties?.["Policies"]), ...policiesNames(recorded?.properties?.["Policies"])]);
-	return claims;
+async function forgetRecordedCreateTokens(logicalIds) {
+	await ledgerStore.getStore()?.forget(logicalIds);
 }
-function orderInlinePolicyWriters(args) {
-	const { writes, changes, templateResources, stateResources, dependencies, rank } = args;
-	const writers = writes.filter((id) => {
-		const type = changes.get(id)?.resourceType;
-		return type === "AWS::IAM::Policy" || type !== void 0 && isInlinePolicyPrincipalType(type);
-	});
-	if (writers.length < 2) return [];
-	const exact = /* @__PURE__ */ new Map();
-	const loose = [];
-	const all = [];
-	for (const id of writers) for (const claim of inlinePolicyClaimsOf(id, changes.get(id), templateResources, stateResources)) {
-		all.push({
-			id,
-			claim
-		});
-		if (claim.principal === ANY || claim.name === ANY) {
-			loose.push({
-				id,
-				claim
-			});
-			continue;
-		}
-		const key = JSON.stringify([
-			claim.kind,
-			claim.principal,
-			claim.name
-		]);
-		const ids = exact.get(key) ?? /* @__PURE__ */ new Set();
-		ids.add(id);
-		exact.set(key, ids);
-	}
-	const principalRows = new Set(writers.filter((id) => isInlinePolicyPrincipalType(changes.get(id).resourceType)));
-	const pairs = /* @__PURE__ */ new Map();
-	const pair = (a, b) => {
-		if (a === b || principalRows.has(a) && principalRows.has(b)) return;
-		const [x, y] = rank(a) < rank(b) || rank(a) === rank(b) && a < b ? [a, b] : [b, a];
-		pairs.set(JSON.stringify([x, y]), [x, y]);
+const LEDGER_TOKEN_RESOURCE_TYPES = /* @__PURE__ */ new Set([
+	"AWS::EFS::FileSystem",
+	"AWS::FSx::FileSystem",
+	"AWS::CloudFront::CloudFrontOriginAccessIdentity"
+]);
+async function noteRetainedResource(resourceType, logicalId) {
+	if (!LEDGER_TOKEN_RESOURCE_TYPES.has(resourceType)) return;
+	await ledgerStore.getStore()?.rotate(logicalId);
+}
+async function reserveStackCreateToken(options) {
+	const base = stackScopedCreateToken(options);
+	const ledger = ledgerStore.getStore();
+	if (ledger === void 0) return {
+		value: base,
+		base,
+		earlierFirstSentAt: void 0,
+		ledgerStartedThisDeploy: false
 	};
-	for (const ids of exact.values()) {
-		const list = [...ids];
-		for (let i = 0; i < list.length; i++) for (let j = i + 1; j < list.length; j++) pair(list[i], list[j]);
-	}
-	const meets = (a, b) => a === ANY || b === ANY || a === b;
-	for (const { id, claim } of loose) for (const other of all) {
-		if (other.claim.kind !== claim.kind) continue;
-		if (meets(claim.principal, other.claim.principal) && meets(claim.name, other.claim.name)) pair(id, other.id);
-	}
-	if (pairs.size === 0) return [];
-	const reaches = (from, to) => {
-		const seen = /* @__PURE__ */ new Set();
-		const stack = [from];
-		while (stack.length > 0) {
-			const id = stack.pop();
-			if (id === to) return true;
-			if (seen.has(id)) continue;
-			seen.add(id);
-			for (const dep of dependencies.get(id) ?? []) stack.push(dep);
-		}
-		return false;
+	const derive = (nonce) => stackScopedCreateToken({
+		...options,
+		immutableInputs: [...options.immutableInputs, { createTokenNonce: nonce }]
+	});
+	return {
+		...await ledger.reserve(options.logicalId, base, derive, Date.now()),
+		base
 	};
-	const added = [];
-	for (const [before, after] of pairs.values()) {
-		if (reaches(after, before) || reaches(before, after)) continue;
-		const deps = dependencies.get(after) ?? /* @__PURE__ */ new Set();
-		deps.add(before);
-		dependencies.set(after, deps);
-		added.push({
-			before,
-			after
-		});
-	}
-	return added;
-}
-function ownPoliciesChange(change) {
-	return (change?.propertyChanges ?? []).some((c) => c.path === "Policies" && c.inPlacePropagated !== true && c.replacementPropagated !== true);
 }
 
 //#endregion
@@ -29993,14 +30760,43 @@ function secretNamedRecordNeedles(resources, secrets, bag = /* @__PURE__ */ new
 	return bag;
 }
 function secretNamePrintingBag(logicalId, resources) {
-	const bag = /* @__PURE__ */ new Map();
-	const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
-	for (const needle of secretNameNeedlesOf(logicalId, record, void 0) ?? []) recordLogOnlyValue(bag, needle);
-	for (const needle of secretNamesReadBy(logicalId, record, resources)) recordLogOnlyValue(bag, needle);
-	return bag;
+	return secretNamePrintingBags(resources, void 0)(logicalId);
+}
+function secretNamePrintingBags(resources, noEchoValues) {
+	const secrets = noEchoValues !== void 0 && hasMaskableValues(noEchoValues) ? noEchoValues : void 0;
+	const judged = /* @__PURE__ */ new Map();
+	const needlesOf = (logicalId, record) => {
+		const hit = judged.get(logicalId);
+		if (hit !== void 0 && hit.record === record) return hit.needles;
+		const needles = secretNameNeedlesOf(logicalId, record, secrets, { embedded: void 0 });
+		judged.set(logicalId, {
+			record,
+			needles
+		});
+		return needles;
+	};
+	return (logicalId) => {
+		const bag = /* @__PURE__ */ new Map();
+		if (secrets !== void 0) carryLogOnlyValues(secrets, bag);
+		const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+		for (const needle of needlesOf(logicalId, record) ?? []) recordLogOnlyValue(bag, needle);
+		const leaves = [...wholeStringLeavesOf(record?.properties)].filter((leaf) => leaf !== "");
+		if (leaves.length === 0) return bag;
+		for (const [otherId, other] of Object.entries(resources)) {
+			if (otherId === logicalId) continue;
+			for (const needle of needlesOf(otherId, other) ?? []) if (leavesHoldNeedle(leaves, needle)) recordLogOnlyValue(bag, needle);
+		}
+		return bag;
+	};
 }
-function journaledOrphanPrintingBag(ops, stateResources) {
+function journaledOrphanPrintingBag(ops, stateResources, noEchoValues) {
 	const bag = /* @__PURE__ */ new Map();
+	const secrets = noEchoValues !== void 0 && hasMaskableValues(noEchoValues) ? noEchoValues : void 0;
+	if (secrets !== void 0) carryLogOnlyValues(secrets, bag);
+	const judge = {
+		secrets,
+		embedded: void 0
+	};
 	for (const op of ops) {
 		const record = {
 			resourceType: op.resourceType,
@@ -30009,9 +30805,9 @@ function journaledOrphanPrintingBag(ops, stateResources) {
 		};
 		const replaced = Object.hasOwn(stateResources, op.logicalId) ? stateResources[op.logicalId] : void 0;
 		for (const needle of [
-			...secretNameNeedlesOf(op.logicalId, record, void 0) ?? [],
-			...secretNameNeedlesOf(op.logicalId, replaced, void 0) ?? [],
-			...secretNamesReadBy(op.logicalId, record, stateResources)
+			...secretNameNeedlesOf(op.logicalId, record, secrets, judge) ?? [],
+			...secretNameNeedlesOf(op.logicalId, replaced, secrets, judge) ?? [],
+			...secretNamesReadBy(op.logicalId, record, stateResources, () => judge)
 		]) recordLogOnlyValue(bag, needle);
 	}
 	return bag;
@@ -30031,13 +30827,15 @@ function completedReplayEntries(ops) {
 		attemptedProperties: op.previousState.properties
 	}]]);
 }
-function orphanRecordsPrintingBag(records) {
+function orphanRecordsPrintingBag(records, noEchoValues) {
 	const bag = /* @__PURE__ */ new Map();
+	const secrets = noEchoValues !== void 0 && hasMaskableValues(noEchoValues) ? noEchoValues : void 0;
+	if (secrets !== void 0) carryLogOnlyValues(secrets, bag);
 	for (const entry of records) {
 		if (entry === null || typeof entry !== "object") continue;
 		const { logicalId, state } = entry;
 		if (typeof logicalId !== "string" || state === null || typeof state !== "object") continue;
-		for (const needle of secretNameNeedlesOf(logicalId, state, void 0) ?? []) recordLogOnlyValue(bag, needle);
+		for (const needle of secretNameNeedlesOf(logicalId, state, secrets, { embedded: void 0 }) ?? []) recordLogOnlyValue(bag, needle);
 	}
 	return bag;
 }
@@ -30147,7 +30945,7 @@ function withNoEchoDefaultsMasked(parameters) {
 	const masked = Object.create(null);
 	for (const [name, decl] of Object.entries(parameters)) {
 		const body = decl;
-		masked[name] = typeof body === "object" && body !== null && body["NoEcho"] === true && "Default" in body ? {
+		masked[name] = typeof body === "object" && body !== null && declaresNoEcho(body) && "Default" in body ? {
 			...body,
 			Default: NO_ECHO_DEFAULT_MASK
 		} : decl;
@@ -30359,7 +31157,7 @@ function noEchoParameterValueSeed(parameters, values, inherited, userParameters)
 	if (values === void 0) return seed;
 	for (const [name, value] of Object.entries(values)) {
 		if (isWholeDynamicReferenceValue(value)) continue;
-		if (parameters?.[name]?.NoEcho === true) {
+		if (parameters !== void 0 && declaresNoEcho(parameters[name])) {
 			const type = parameters[name]?.Type;
 			const ssmTyped = typeof type === "string" && type.startsWith("AWS::SSM::Parameter::Value<");
 			const spelled = Object.prototype.hasOwnProperty.call(userParameters ?? {}, name) ? userParameters?.[name] : parameters[name]?.Default;
@@ -31147,13 +31945,52 @@ async function resolveLeafByRegion(leaf, propertyPath, logicalId, execCtx, resol
 	}
 	return out + leaf.slice(cursor);
 }
-function redactRollbackRecord(record, secrets, journaledProps) {
+function redactRollbackRecord(record, secrets, journaledProps, journaledAttributes) {
 	if (secrets.size === 0) return record;
 	const positioned = journaledProps === void 0 ? record : {
 		...record,
 		properties: redactSecretsForState(record.properties, secrets, journaledProps, STATE_DERIVED_RULES)
 	};
-	return scrubResourceRecord(positioned, secrets);
+	return keepPersistedPlainRecordLeaves(scrubResourceRecord(positioned, secrets), record, {
+		properties: journaledProps,
+		attributes: journaledAttributes
+	});
+}
+function keepPersistedPlainRecordLeaves(scrubbed, raw, persisted) {
+	const properties = keepPersistedPlainLeaves(scrubbed.properties, raw.properties, persisted.properties);
+	const attributes = scrubbed.attributes === void 0 ? void 0 : keepPersistedPlainLeaves(scrubbed.attributes, raw.attributes, persisted.attributes);
+	if (properties === scrubbed.properties && attributes === scrubbed.attributes) return scrubbed;
+	return {
+		...scrubbed,
+		properties,
+		...attributes !== void 0 && { attributes }
+	};
+}
+function keepPersistedPlainLeaves(redacted, raw, persisted) {
+	if (typeof raw === "string") return typeof persisted === "string" && raw === persisted && redacted !== "***" && dynamicReferenceTokens(persisted).length === 0 ? persisted : redacted;
+	if (Array.isArray(raw)) {
+		if (!Array.isArray(persisted) || !Array.isArray(redacted)) return redacted;
+		if (redacted.length !== raw.length) return redacted;
+		let out;
+		for (let i = 0; i < redacted.length; i++) {
+			const kept = keepPersistedPlainLeaves(redacted[i], raw[i], persisted[i]);
+			if (kept !== redacted[i]) (out ??= [...redacted])[i] = kept;
+		}
+		return out ?? redacted;
+	}
+	if (!isPlainRecord$1(raw) || !isPlainRecord$1(persisted) || !isPlainRecord$1(redacted)) return redacted;
+	let out;
+	for (const key of Object.keys(redacted)) {
+		if (!hasOwnKey(raw, key) || !hasOwnKey(persisted, key)) continue;
+		const kept = keepPersistedPlainLeaves(redacted[key], raw[key], persisted[key]);
+		if (kept === redacted[key]) continue;
+		out ??= { ...redacted };
+		out[key] = kept;
+	}
+	return out ?? redacted;
+}
+function isPlainRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && hasPlainPrototype$1(value);
 }
 
 //#endregion
@@ -32207,7 +33044,7 @@ async function replayRevert(s) {
 		}
 	], op.logicalId, logger, isInterrupted, secrets, mask));
 	if (revertResult) recordNoEchoAttributeValues(revertResult, secrets, desiredProps);
-	stateResources[op.logicalId] = maskRestoredNoEchoRecord(redactRollbackRecord(recordAfterRollbackUpdate(previousState, revertResult), secrets, previousState.properties), previousState, noEcho.substituted);
+	stateResources[op.logicalId] = maskRestoredNoEchoRecord(redactRollbackRecord(recordAfterRollbackUpdate(previousState, revertResult), secrets, previousState.properties, previousState.attributes), previousState, noEcho.substituted);
 	if (updatePartialReason(revertResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$1(previousState.properties?.["Policies"], current.properties?.["Policies"]), revertVia);
 	const rollbackPartial = updatePartialReason(revertResult);
 	if (rollbackPartial !== void 0) logger.warn(mask(`  Rollback: ${safe(op.logicalId)} restored, ${updatePartialMessage(rollbackPartial)}`));
@@ -32406,7 +33243,7 @@ async function replayReverseReplacement(s) {
 		physicalId: createResult.physicalId,
 		attributes: createResult.attributes ?? {},
 		properties: recordedPropertiesAfterReplayCreate(prevRecord, createResult)
-	}, secrets, prevRecord.properties);
+	}, secrets, prevRecord.properties, prevRecord.attributes);
 	if (!adoptedLiveNewResource) inlinePolicyWriters.record(op.logicalId, "create", stateResources[op.logicalId], false, createProvisionedBy);
 	await afterOp?.(op.logicalId);
 	let survivorReason;
@@ -32577,12 +33414,12 @@ async function replayRollbackUnbound(operations, stateResources, stackName, ctx,
 	inlinePolicyWriters.notePending(operations);
 	markDeleteFirstBlocked(operations, options.failedOperations);
 	const { createOps, otherOps } = partitionOps(operations);
-	for (let i = otherOps.length - 1; i >= 0; i--) {
+	for (const op of orderInlinePolicyReversals([...otherOps].reverse(), stateResources)) {
 		if (options.isInterrupted?.()) {
 			result.interrupted = true;
 			break;
 		}
-		await replaySingle(otherOps[i], stateResources, stackName, ctx, resolver, orphanLogicalIds, result, options.onOrphan, inlinePolicyWriters, options.afterOp, options.isInterrupted);
+		await replaySingle(op, stateResources, stackName, ctx, resolver, orphanLogicalIds, result, options.onOrphan, inlinePolicyWriters, options.afterOp, options.isInterrupted);
 	}
 	if (!result.interrupted && createOps.length > 0) {
 		const sorted = sortRollbackCreates(createOps, stateResources);
@@ -32966,7 +33803,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						}
 					], op.logicalId, logger, options.isInterrupted, secrets, mask));
 					if (revertFailedResult) recordNoEchoAttributeValues(revertFailedResult, secrets, desiredProps);
-					stateResources[op.logicalId] = maskRestoredNoEchoRecord(redactRollbackRecord(recordAfterRollbackUpdate(prev, revertFailedResult), secrets, prev.properties), prev, noEcho.substituted);
+					stateResources[op.logicalId] = maskRestoredNoEchoRecord(redactRollbackRecord(recordAfterRollbackUpdate(prev, revertFailedResult), secrets, prev.properties, prev.attributes), prev, noEcho.substituted);
 					if (updatePartialReason(revertFailedResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$1(prev.properties?.["Policies"], (op.attemptedProperties ?? current.properties)?.["Policies"]), revertVia);
 					const revertFailedPartial = updatePartialReason(revertFailedResult);
 					if (revertFailedPartial !== void 0) logger.warn(mask(`  Rollback: ${safe(op.logicalId)} reverted, ${updatePartialMessage(revertFailedPartial)}`));
@@ -33124,7 +33961,7 @@ async function deleteJournaledOrphans(orphans, stateResources, stackName, ctx, o
 	const inlinePolicyWriters = new RollbackInlinePolicyWriters();
 	const failedIds = total.failedLogicalIds;
 	const record = ctx.recordEvent;
-	const printing = journaledOrphanPrintingBag(orphans.segments.flatMap(({ ops, companions }) => [...companions ?? [], ...ops]), stateResources);
+	const printing = journaledOrphanPrintingBag(orphans.segments.flatMap(({ ops, companions }) => [...companions ?? [], ...ops]), stateResources, options.noEchoValues);
 	const maskedCtx = record === void 0 ? ctx : {
 		...ctx,
 		recordEvent: (event) => record(maskEventTextWithBoundBags(event))
@@ -33936,11 +34773,14 @@ function redactOperationsForJournal(operations) {
 		if (next.attemptedProperties) next.attemptedProperties = byPosition(redactSecretsForState(markSameGenerationBag({ ...next.attemptedProperties }), ownSecrets, templateProps));
 		if (next.previousState) {
 			const previous = next.previousState;
-			next.previousState = this.applyNoEchoPersist(op.logicalId, previous, scrubResourceRecord(previous, ownSecrets, void 0, STATE_SOURCED_READBACK_RULES), void 0, {}, void 0, true);
+			const adopted = adoptedOrphanRecords.get(this);
+			const loaded = adopted?.has(op.logicalId) ? adopted.get(op.logicalId) : previous;
+			next.previousState = this.applyNoEchoPersist(op.logicalId, previous, keepPersistedPlainRecordLeaves(scrubResourceRecord(previous, ownSecrets, void 0, STATE_SOURCED_READBACK_RULES), previous, loaded ?? {}), void 0, {}, void 0, true);
 		}
 		return next;
 	});
 }
+const adoptedOrphanRecords = /* @__PURE__ */ new WeakMap();
 async function adoptRollbackOrphans(currentState, effectiveTemplate) {
 	const records = currentState.orphans ?? [];
 	const named = orphanRecordsPrintingBag(records);
@@ -33967,8 +34807,11 @@ async function adoptRollbackOrphans(currentState, effectiveTemplate) {
 		logger: { debug: (m) => this.logger.debug(m) }
 	}));
 	for (const notice of plan.notices) this.logger.info(maskSecretsInText(notice, named));
+	const adoptedFrom = /* @__PURE__ */ new Map();
+	adoptedOrphanRecords.set(this, adoptedFrom);
 	if (plan.refusals.length > 0) throw new Error(`Deploy refused — cdkd left ${plan.refusals.length} resource(s) in AWS that it cannot safely re-adopt:\n  ${plan.refusals.map((r) => maskSecretsInText(r, named)).join("\n  ")}`);
 	for (const [logicalId, record] of Object.entries(plan.adopted)) {
+		adoptedFrom.set(logicalId, records.findLast((r) => r.logicalId === logicalId)?.state);
 		currentState.resources[logicalId] = record;
 		this.logger.info(`Adopting ${displayIdent(logicalId)} (${displayIdent(record.resourceType)}) left in AWS by an earlier rollback as ${displaySafe(maskSecretsInText(record.physicalId, named))}`);
 	}
@@ -34582,6 +35425,20 @@ async function drainObservedCaptures(stateResources) {
 	}
 	return installed;
 }
+const STANDALONE_SIBLING = {
+	Roles: {
+		type: "AWS::IAM::RolePolicy",
+		field: "RoleName"
+	},
+	Users: {
+		type: "AWS::IAM::UserPolicy",
+		field: "UserName"
+	},
+	Groups: {
+		type: "AWS::IAM::GroupPolicy",
+		field: "GroupName"
+	}
+};
 async function buildObservedCaptureSiblings(resourceType, capturedLogicalId, capturedPhysicalId, template, stateResources, stackName, parameterValues, conditions) {
 	if (this.options.captureObservedState !== true) return void 0;
 	const attachmentField = resourceType === "AWS::IAM::Role" ? "Roles" : resourceType === "AWS::IAM::User" ? "Users" : resourceType === "AWS::IAM::Group" ? "Groups" : void 0;
@@ -34591,11 +35448,12 @@ async function buildObservedCaptureSiblings(resourceType, capturedLogicalId, cap
 	let resolverContext;
 	const isRefTo = (value, logicalId) => typeof value === "object" && value !== null && !Array.isArray(value) && value["Ref"] === logicalId;
 	const siblings = {};
+	const standaloneType = STANDALONE_SIBLING[attachmentField];
 	for (const [lid, res] of Object.entries(resources)) {
 		if (lid === capturedLogicalId) continue;
-		if (res.Type !== "AWS::IAM::Policy") continue;
+		if (res.Type !== "AWS::IAM::Policy" && res.Type !== standaloneType.type) continue;
 		const props = res.Properties ?? {};
-		const attachments = props[attachmentField];
+		const attachments = res.Type === "AWS::IAM::Policy" ? props[attachmentField] : [props[standaloneType.field]];
 		if (!Array.isArray(attachments)) continue;
 		if (!attachments.some((a) => isRefTo(a, capturedLogicalId) || a === capturedPhysicalId)) continue;
 		let policyName = props["PolicyName"];
@@ -34808,9 +35666,9 @@ function deepEqualValue(a, b) {
 function diffLogMasker(diffSecrets, template, parameterValues, resources) {
 	const inherited = this.options.inheritedSecrets;
 	const noEchoValues = /* @__PURE__ */ new Map();
-	const noEchoNames = new Set(Object.entries(template.Parameters ?? {}).filter(([, definition]) => definition?.NoEcho === true).map(([name]) => name));
+	const noEchoNames = new Set(Object.entries(template.Parameters ?? {}).filter(([, definition]) => declaresNoEcho(definition)).map(([name]) => name));
 	const splitDelimiters = literalSplitDelimitersOf(template, noEchoNames);
-	for (const [name, definition] of Object.entries(template.Parameters ?? {})) if (definition?.NoEcho === true && Object.hasOwn(parameterValues, name)) recordLogOnlyParameterValue(noEchoValues, parameterValues[name], splitDelimiters);
+	for (const [name, definition] of Object.entries(template.Parameters ?? {})) if (declaresNoEcho(definition) && Object.hasOwn(parameterValues, name)) recordLogOnlyParameterValue(noEchoValues, parameterValues[name], splitDelimiters);
 	const stateNames = /* @__PURE__ */ new Map();
 	const union = createUnionSecretMasker([
 		diffSecrets,
@@ -34907,7 +35765,7 @@ function refuseRedactedAttributeReads(logicalId, resourceType, context) {
 		const producers = [...new Set(reads.map((read) => read.logicalId).filter((id) => !!id))];
 		throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: ${producers.map((id) => displayIdent(id)).join(", ")} declared ${reads.length === 1 ? "that attribute" : "those attributes"} NoEcho, so cdkd's recorded state holds only the redaction mask for ${reads.length === 1 ? "it" : "them"}, and cdkd does not re-run a producer to recover a value. Remedy: deploy a change to the producer in the SAME run as ${logicalId} (for a custom resource, change one of its properties, e.g. a nonce / version property, so its handler runs again and supplies the value), or stop declaring the value NoEcho.`, resourceType, logicalId);
 	}
-	throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the redaction mask there, and the value is not recoverable from state. There are three ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all, or cdkd deploy '**' when either is inside a CDK Stage) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The value holds the Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records — so a deploy that leaves the resource or output holding it unchanged reads the mask again, and a re-import does not recover it. Remedy: have this resource build the value itself from the SECRET's own reference (the {{resolve:secretsmanager:...}} or {{resolve:ssm-secure:...}} reference, or a {{resolve:ssm:...}} of a SecureString parameter, that the encoding was made from) under its own Fn::Base64, instead of reading it from another resource's attribute or another stack's output — not by a {{resolve:ssm:...}} read of a String parameter holding the encoding, which cdkd treats as public and would record in state in the clear. (3) The resource was adopted by 'cdkd import' through the Cloud Control fallback, which records only the type's Fn::GetAtt attributes (its read-only properties plus the writable ones CloudFormation also accepts in Fn::GetAtt) and masks the rest. Either the attribute named above is not one of them — CloudFormation would reject an Fn::GetAtt naming it too, so stop reading it — or cdkd could not read that schema and masked the whole model, which the import warned about when it happened. If that warning named a missing cloudformation:DescribeType permission, grant it first. See https://github.com/go-to-k/cdkd/issues/2449. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources, true)}`, resourceType, logicalId);
+	throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the redaction mask there, and the value is not recoverable from state. There are three ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all, or cdkd deploy '**' when either is inside a CDK Stage) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The value holds the Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records — so a deploy that leaves the resource or output holding it unchanged reads the mask again, and a re-import does not recover it. Remedy: have this resource build the value itself from the SECRET's own reference (the {{resolve:secretsmanager:...}} or {{resolve:ssm-secure:...}} reference, or a {{resolve:ssm:...}} of a SecureString parameter, that the encoding was made from) under its own Fn::Base64, instead of reading it from another resource's attribute or another stack's output — not by a {{resolve:ssm:...}} read of a String parameter holding the encoding, which cdkd treats as public and would record in state in the clear. (3) The resource is recorded through the Cloud Control fallback (by a deploy or by 'cdkd import'), which keeps in the clear only the Fn::GetAtt attributes it can vouch for and masks the rest. If the name above is not an Fn::GetAtt attribute CloudFormation accepts for that resource type, no record will ever hold it: stop reading it. If it is one, 'cdkd import' masked it because it could not vouch for the value, or could not read the schema and warned about it when it happened (if that warning named a missing cloudformation:DescribeType permission, grant it first); a deploy that creates or updates the resource records it, unless its value came from a secret. See https://github.com/go-to-k/cdkd/issues/2449. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources, true)}`, resourceType, logicalId);
 }
 function allRecordedSecrets() {
 	const all = /* @__PURE__ */ new Map();
@@ -35216,6 +36074,7 @@ async function createFirstThenDeleteOld(input) {
 async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, deleteProvider, deleteProperties, finalSnapshotIdentifier, updateReplacePolicy, secrets, deleteProvisionedBy, noEchoDeleteValues) {
 	let deleteResult = void 0;
 	let deleteFailed = false;
+	const inlinePolicyClaimed = isStandaloneInlinePolicyType(oldResourceType) ? this.inlinePolicyClaimedFor(oldResourceType, logicalId, this.deployStateResources) : void 0;
 	try {
 		deleteResult = await deleteProvider.delete(logicalId, currentResource.physicalId, oldResourceType, deleteProperties, {
 			expectedRegion: this.stackRegion,
@@ -35224,7 +36083,8 @@ async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentReso
 			...this.replacementDeleteContext(updateReplacePolicy),
 			recordedAttributes: currentResource.attributes,
 			recordedNoEchoLeaves: currentResource.noEchoLeaves,
-			...noEchoDeleteValues !== void 0 && { noEchoDeleteValues }
+			...noEchoDeleteValues !== void 0 && { noEchoDeleteValues },
+			...inlinePolicyClaimed && { inlinePolicyClaimed }
 		});
 	} catch (deleteError) {
 		const deleteMsg = maskSecretsInText(deleteError instanceof Error ? deleteError.message : String(deleteError), secrets);
@@ -35504,9 +36364,13 @@ function buildResolverContext(base, stackName) {
 		recordedOutputReads: this.recordedOutputReads,
 		attributeHealer: (logicalId, resource) => this.healStaleAttributes(logicalId, resource, stackName),
 		...this.options.inheritedSecrets && hasMaskableValues(this.options.inheritedSecrets) && { inheritedSecrets: this.options.inheritedSecrets },
+		...this.options.inheritedPhysicalNameCopies && { inheritedPhysicalNameCopies: this.options.inheritedPhysicalNameCopies },
 		recordedSecretValues,
 		noEchoAttributeResources: this.noEchoAttributeResources,
 		secretNameNeedles: (logicalId) => this.noteSecretNamedRecord(logicalId, Object.hasOwn(base.resources, logicalId) ? base.resources[logicalId] : void 0),
+		producerSecrets: (logicalId) => this.perResourceSecrets.get(logicalId),
+		secretRegionEvidence: () => this.runProducerRegionEvidence?.(),
+		producerPreRunPhysicalId: (logicalId) => Object.hasOwn(this.healBaseline, logicalId) ? this.healBaseline[logicalId]?.physicalId : void 0,
 		...base.redactedAttributeReads && { redactedAttributeReads: base.redactedAttributeReads }
 	};
 }
@@ -38606,10 +39470,7 @@ function noEchoParameterNamesOf(template) {
 	const names = /* @__PURE__ */ new Set();
 	const declared = template?.Parameters;
 	if (declared === null || typeof declared !== "object") return names;
-	for (const [name, definition] of Object.entries(declared)) {
-		const noEcho = definition?.NoEcho;
-		if (noEcho === true || noEcho === "true") names.add(name);
-	}
+	for (const [name, definition] of Object.entries(declared)) if (declaresNoEcho(definition)) names.add(name);
 	return names;
 }
 function noEchoAttributeNamesOf(record) {
@@ -38634,7 +39495,10 @@ function noEchoPositionSources(resources = {}, template = this.constructPathTemp
 function noEchoLeavesFor(logicalId, record, templateProps, sources) {
 	if (templateProps !== void 0 && isWrittenFromDeployedTemplate(record.properties)) return canonicalCoordinates(noEchoCoordinatesOf(templateProps, record.properties, sources));
 	const existing = noEchoLeavesOf(record);
-	if (existing !== void 0) return canonicalCoordinates(existing);
+	if (existing !== void 0) {
+		const confirmed = this.witnessConfirmedLeaves.get(logicalId) ?? [];
+		return canonicalCoordinates([...existing, ...confirmed]);
+	}
 	const resolvedAsSame = this.perResourceResolvedType.get(logicalId) === record.resourceType;
 	const source = (templateProps !== void 0 && resolvedAsSame ? templateProps : void 0) ?? templatePropertiesFor(this, logicalId, record.resourceType);
 	if (source === void 0) return void 0;
@@ -38846,6 +39710,1140 @@ function noEchoComparisonForTemplate(template, knownConditions, values, resource
 	return (input) => compare(input);
 }
 
+//#endregion
+//#region src/analyzer/security-changes.ts
+const RESOURCE_SCRUTINY = {
+	"AWS::Bedrock::KnowledgeBasePolicy": "ResourcePolicyResource",
+	"AWS::Bedrock::ResourcePolicy": "ResourcePolicyResource",
+	"AWS::CloudTrail::ResourcePolicy": "ResourcePolicyResource",
+	"AWS::EC2::SecurityGroupEgress": "EgressRuleResource",
+	"AWS::EC2::SecurityGroupIngress": "IngressRuleResource",
+	"AWS::ECR::RegistryPolicy": "ResourcePolicyResource",
+	"AWS::EventSchemas::RegistryPolicy": "ResourcePolicyResource",
+	"AWS::EventsV2::ResourcePolicy": "ResourcePolicyResource",
+	"AWS::IAM::GroupPolicy": "IdentityPolicyResource",
+	"AWS::IAM::ManagedPolicy": "IdentityPolicyResource",
+	"AWS::IAM::Policy": "IdentityPolicyResource",
+	"AWS::IAM::RolePolicy": "IdentityPolicyResource",
+	"AWS::IAM::UserPolicy": "IdentityPolicyResource",
+	"AWS::IoT::Policy": "ResourcePolicyResource",
+	"AWS::Kinesis::ResourcePolicy": "ResourcePolicyResource",
+	"AWS::Lambda::Permission": "LambdaPermission",
+	"AWS::Lambda::ResourcePolicy": "ResourcePolicyResource",
+	"AWS::Lex::ResourcePolicy": "ResourcePolicyResource",
+	"AWS::Logs::ResourcePolicy": "ResourcePolicyResource",
+	"AWS::MSK::ClusterPolicy": "ResourcePolicyResource",
+	"AWS::MediaPackageV2::ChannelPolicy": "ResourcePolicyResource",
+	"AWS::MediaPackageV2::OriginEndpointPolicy": "ResourcePolicyResource",
+	"AWS::MediaTailor::ChannelPolicy": "ResourcePolicyResource",
+	"AWS::S3::BucketPolicy": "ResourcePolicyResource",
+	"AWS::S3::MultiRegionAccessPointPolicy": "ResourcePolicyResource",
+	"AWS::S3Express::BucketPolicy": "ResourcePolicyResource",
+	"AWS::S3Files::FileSystemPolicy": "ResourcePolicyResource",
+	"AWS::S3ObjectLambda::AccessPointPolicy": "ResourcePolicyResource",
+	"AWS::S3Outposts::BucketPolicy": "ResourcePolicyResource",
+	"AWS::S3Tables::TableBucketPolicy": "ResourcePolicyResource",
+	"AWS::S3Tables::TablePolicy": "ResourcePolicyResource",
+	"AWS::S3Vectors::VectorBucketPolicy": "ResourcePolicyResource",
+	"AWS::SMSVOICE::ResourcePolicy": "ResourcePolicyResource",
+	"AWS::SNS::TopicInlinePolicy": "ResourcePolicyResource",
+	"AWS::SNS::TopicPolicy": "ResourcePolicyResource",
+	"AWS::SQS::QueueInlinePolicy": "ResourcePolicyResource",
+	"AWS::SQS::QueuePolicy": "ResourcePolicyResource",
+	"AWS::SSM::ResourcePolicy": "ResourcePolicyResource",
+	"AWS::SSO::Assignment": "SsoAssignmentResource",
+	"AWS::SSO::InstanceAccessControlAttributeConfiguration": "SsoInstanceACAConfigResource",
+	"AWS::SSO::PermissionSet": "SsoPermissionSet",
+	"AWS::SecretsManager::ResourcePolicy": "ResourcePolicyResource",
+	"AWS::VpcLattice::AuthPolicy": "ResourcePolicyResource",
+	"AWS::VpcLattice::ResourcePolicy": "ResourcePolicyResource"
+};
+const PROPERTY_SCRUTINY = {
+	"AWS::ApiGateway::DomainNameV2": { Policy: "InlineResourcePolicy" },
+	"AWS::ApiGateway::RestApi": { Policy: "InlineResourcePolicy" },
+	"AWS::Backup::BackupVault": { AccessPolicy: "InlineResourcePolicy" },
+	"AWS::Backup::LogicallyAirGappedBackupVault": { AccessPolicy: "InlineResourcePolicy" },
+	"AWS::CodeArtifact::Domain": { PermissionsPolicyDocument: "InlineResourcePolicy" },
+	"AWS::CodeArtifact::Repository": { PermissionsPolicyDocument: "InlineResourcePolicy" },
+	"AWS::EC2::SecurityGroup": {
+		SecurityGroupEgress: "EgressRules",
+		SecurityGroupIngress: "IngressRules"
+	},
+	"AWS::EC2::VPCEndpoint": { PolicyDocument: "InlineResourcePolicy" },
+	"AWS::ECR::PublicRepository": { RepositoryPolicyText: "InlineResourcePolicy" },
+	"AWS::ECR::Repository": { RepositoryPolicyText: "InlineResourcePolicy" },
+	"AWS::EFS::FileSystem": { FileSystemPolicy: "InlineResourcePolicy" },
+	"AWS::Events::EventBus": { Policy: "InlineResourcePolicy" },
+	"AWS::IAM::Group": {
+		ManagedPolicyArns: "ManagedPolicies",
+		Policies: "InlineIdentityPolicies"
+	},
+	"AWS::IAM::Role": {
+		AssumeRolePolicyDocument: "InlineResourcePolicy",
+		ManagedPolicyArns: "ManagedPolicies",
+		Policies: "InlineIdentityPolicies"
+	},
+	"AWS::IAM::User": {
+		ManagedPolicyArns: "ManagedPolicies",
+		Policies: "InlineIdentityPolicies"
+	},
+	"AWS::KMS::Key": { KeyPolicy: "InlineResourcePolicy" },
+	"AWS::KMS::ReplicaKey": { KeyPolicy: "InlineResourcePolicy" },
+	"AWS::Logs::LogGroup": {
+		DataProtectionPolicy: "InlineResourcePolicy",
+		ResourcePolicyDocument: "InlineResourcePolicy"
+	},
+	"AWS::MPA::ApprovalTeam": { Policies: "InlineIdentityPolicies" },
+	"AWS::NetworkManager::CoreNetwork": { PolicyDocument: "InlineResourcePolicy" },
+	"AWS::Oam::Sink": { Policy: "InlineResourcePolicy" },
+	"AWS::Omics::SequenceStore": { S3AccessPolicy: "InlineResourcePolicy" },
+	"AWS::RAM::Permission": { PolicyTemplate: "InlineResourcePolicy" },
+	"AWS::Redshift::Cluster": { NamespaceResourcePolicy: "InlineResourcePolicy" },
+	"AWS::RedshiftServerless::Namespace": { NamespaceResourcePolicy: "InlineResourcePolicy" },
+	"AWS::RolesAnywhere::Profile": { ManagedPolicyArns: "ManagedPolicies" },
+	"AWS::S3::AccessPoint": { Policy: "InlineResourcePolicy" },
+	"AWS::S3Express::AccessPoint": { Policy: "InlineResourcePolicy" },
+	"AWS::S3Outposts::AccessPoint": { Policy: "InlineResourcePolicy" },
+	"AWS::SNS::Subscription": {
+		RedrivePolicy: "InlineResourcePolicy",
+		ReplayPolicy: "InlineResourcePolicy"
+	},
+	"AWS::SNS::Topic": {
+		DataProtectionPolicy: "InlineResourcePolicy",
+		ArchivePolicy: "InlineResourcePolicy"
+	},
+	"AWS::SQS::Queue": { RedriveAllowPolicy: "InlineResourcePolicy" },
+	"AWS::SSO::PermissionSet": {
+		InlinePolicy: "InlineResourcePolicy",
+		ManagedPolicies: "ManagedPolicies"
+	},
+	"AWS::SageMaker::ModelPackageGroup": { ModelPackageGroupPolicy: "InlineResourcePolicy" },
+	"AWS::Serverless::Function": { AssumeRolePolicyDocument: "InlineResourcePolicy" }
+};
+function resourceScrutiny(type) {
+	return Object.hasOwn(RESOURCE_SCRUTINY, type) ? RESOURCE_SCRUTINY[type] : void 0;
+}
+function propertyScrutinies(type) {
+	return Object.hasOwn(PROPERTY_SCRUTINY, type) ? PROPERTY_SCRUTINY[type] ?? {} : {};
+}
+function isScrutinizedProperty(type, path) {
+	return resourceScrutiny(type) !== void 0 || Object.hasOwn(propertyScrutinies(type), path);
+}
+function strictEqual(a, b) {
+	if (a === b) return true;
+	if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) return a !== a && b !== b;
+	if (Array.isArray(a) !== Array.isArray(b)) return false;
+	if (Array.isArray(a)) {
+		const bArr = b;
+		return a.length === bArr.length && a.every((v, i) => strictEqual(v, bArr[i]));
+	}
+	const aKeys = Object.keys(a);
+	if (aKeys.length !== Object.keys(b).length) return false;
+	return aKeys.every((k) => Object.hasOwn(b, k) && strictEqual(a[k], b[k]));
+}
+function cfnEqual(lvalue, rvalue) {
+	if (lvalue === rvalue) return true;
+	if ((typeof lvalue === "string" && typeof rvalue === "boolean" || typeof lvalue === "boolean" && typeof rvalue === "string") && lvalue.toString() === rvalue.toString()) return true;
+	if ((typeof lvalue === "string" || typeof rvalue === "string") && Number(lvalue) === Number(rvalue)) return true;
+	if (typeof lvalue !== typeof rvalue) return false;
+	if (Array.isArray(lvalue) !== Array.isArray(rvalue)) return false;
+	if (Array.isArray(lvalue)) {
+		if (lvalue.length !== rvalue.length) return false;
+		for (let i = 0; i < lvalue.length; i++) if (!cfnEqual(lvalue[i], rvalue[i])) return false;
+		return true;
+	}
+	if (typeof lvalue === "object") {
+		if (lvalue === null || rvalue === null) return false;
+		const keys = Object.keys(lvalue);
+		if (keys.length !== Object.keys(rvalue).length) return false;
+		for (const key of keys) {
+			if (!Object.hasOwn(rvalue, key)) return false;
+			if (key === "DependsOn") {
+				if (!dependsOnEqual(lvalue[key], rvalue[key])) return false;
+				continue;
+			}
+			if (!cfnEqual(lvalue[key], rvalue[key])) return false;
+		}
+		return true;
+	}
+	return false;
+}
+function dependsOnEqual(lvalue, rvalue) {
+	if (Array.isArray(lvalue) !== Array.isArray(rvalue)) {
+		const array = Array.isArray(lvalue) ? lvalue : rvalue;
+		const nonArray = Array.isArray(lvalue) ? rvalue : lvalue;
+		return array.length === 1 && cfnEqual(array[0], nonArray);
+	}
+	if (Array.isArray(lvalue) && Array.isArray(rvalue)) {
+		if (lvalue.length !== rvalue.length) return false;
+		for (let i = 0; i < lvalue.length; i++) if (!cfnEqual(lvalue[i], rvalue[0]) && lvalue.length === 1) return false;
+		return true;
+	}
+	return false;
+}
+function normalize(template) {
+	if (typeof template !== "object" || template === null) return;
+	for (const key of Object.keys(template)) {
+		if (key === "Fn::GetAtt" && typeof template[key] === "string") {
+			template[key] = template[key].split(".");
+			continue;
+		} else if (key === "DependsOn") {
+			if (typeof template[key] === "string") template[key] = [template[key]];
+			else if (Array.isArray(template[key])) template[key] = template[key].sort((x, y) => String(x) < String(y) ? -1 : String(x) > String(y) ? 1 : 0);
+			continue;
+		}
+		if (Array.isArray(template[key])) for (const element of template[key]) normalize(element);
+		else normalize(template[key]);
+	}
+}
+function getIntrinsic(x) {
+	if (x === void 0 || x === null || Array.isArray(x) || typeof x !== "object") return void 0;
+	const keys = Object.keys(x);
+	return keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::")) ? {
+		fn: keys[0],
+		args: x[keys[0]]
+	} : void 0;
+}
+function isNoValue(x) {
+	const intrinsic = getIntrinsic(x);
+	return intrinsic !== void 0 && intrinsic.fn === "Ref" && intrinsic.args === "AWS::NoValue";
+}
+function renderIntrinsics(x) {
+	if (Array.isArray(x)) return x.filter((el) => !isNoValue(el)).map(renderIntrinsics);
+	if (isNoValue(x)) return void 0;
+	const intrinsic = getIntrinsic(x);
+	if (intrinsic !== void 0) {
+		if (intrinsic.fn === "Ref") return "${" + intrinsic.args + "}";
+		if (intrinsic.fn === "Fn::GetAtt") return "${" + intrinsic.args[0] + "." + intrinsic.args[1] + "}";
+		if (intrinsic.fn === "Fn::Join") {
+			const [separator, args] = intrinsic.args;
+			if (Array.isArray(args)) return args.filter((el) => !isNoValue(el)).map(renderIntrinsics).join(separator);
+			return JSON.stringify({ "Fn::Join": renderIntrinsics([separator, args]) });
+		}
+		return JSON.stringify({ [intrinsic.fn]: renderIntrinsics(intrinsic.args) });
+	}
+	if (typeof x === "object" && x !== null) {
+		const ret = {};
+		for (const [key, value] of Object.entries(x)) if (!isNoValue(value)) ret[key] = renderIntrinsics(value);
+		return ret;
+	}
+	return x;
+}
+var Targets = class {
+	values;
+	not;
+	constructor(statement, positiveKey, negativeKey) {
+		if (negativeKey in statement) {
+			this.values = forceListOfStrings(statement[negativeKey]);
+			this.not = true;
+		} else {
+			this.values = forceListOfStrings(statement[positiveKey]);
+			this.not = false;
+		}
+		this.values.sort();
+	}
+	get empty() {
+		return this.values.length === 0;
+	}
+	equal(other) {
+		return this.not === other.not && strictEqual(this.values.sort(), other.values.sort());
+	}
+	replaceEmpty(replacement) {
+		if (this.empty) this.values.push(replacement);
+	}
+	replaceStar(replacement) {
+		for (let i = 0; i < this.values.length; i++) if (this.values[i] === "*") this.values[i] = replacement;
+		this.values.sort();
+	}
+	render() {
+		return this.not ? this.values.map((s) => `NOT ${s}`).join("\n") : this.values.join("\n");
+	}
+};
+function forceListOfStrings(x) {
+	if (typeof x === "string") return [x];
+	if (x === void 0 || x === null) return [];
+	if (Array.isArray(x)) return x.map((e) => forceListOfStrings(e).join(","));
+	if (typeof x === "object") {
+		const ret = [];
+		for (const [key, value] of Object.entries(x)) ret.push(...forceListOfStrings(value).map((s) => `${key}:${s}`));
+		return ret;
+	}
+	return [`${x}`];
+}
+var Statement = class {
+	sid;
+	effect;
+	resources;
+	actions;
+	principals;
+	condition;
+	serializedIntrinsic;
+	constructor(statement) {
+		if (typeof statement === "string") {
+			this.sid = void 0;
+			this.effect = "Unknown";
+			this.resources = new Targets({}, "", "");
+			this.actions = new Targets({}, "", "");
+			this.principals = new Targets({}, "", "");
+			this.condition = void 0;
+			this.serializedIntrinsic = statement;
+		} else {
+			if (typeof statement !== "object" || statement === null) throw new Error("An IAM policy statement is neither an object nor a string");
+			this.sid = typeof statement.Sid === "string" ? statement.Sid : void 0;
+			this.effect = statement.Effect === "Allow" || statement.Effect === "Deny" ? statement.Effect : "Unknown";
+			this.resources = new Targets(statement, "Resource", "NotResource");
+			this.actions = new Targets(statement, "Action", "NotAction");
+			this.principals = new Targets(statement, "Principal", "NotPrincipal");
+			this.condition = statement.Condition;
+			this.serializedIntrinsic = void 0;
+		}
+	}
+	equal(other) {
+		return this.sid === other.sid && this.effect === other.effect && this.serializedIntrinsic === other.serializedIntrinsic && this.resources.equal(other.resources) && this.actions.equal(other.actions) && this.principals.equal(other.principals) && strictEqual(this.condition, other.condition);
+	}
+	get isNegativeStatement() {
+		const notTarget = this.actions.not || this.principals.not || this.resources.not;
+		return this.effect === "Allow" ? notTarget : !notTarget;
+	}
+	render() {
+		return this.serializedIntrinsic ? [
+			this.serializedIntrinsic,
+			"",
+			"",
+			this.principals.render(),
+			""
+		] : [
+			this.resources.render(),
+			this.effect,
+			this.actions.render(),
+			this.principals.render(),
+			renderCondition(this.condition)
+		];
+	}
+};
+function parseStatements(x) {
+	if (x === void 0) x = [];
+	if (!Array.isArray(x)) x = [x];
+	return x.map((s) => new Statement(s));
+}
+function parseLambdaPermission(x) {
+	const statement = {
+		Effect: "Allow",
+		Action: x.Action,
+		Resource: x.FunctionName
+	};
+	if (x.Principal !== void 0) {
+		if (x.Principal === "*") statement.Principal = "*";
+		else if (/^\d{12}$/.test(x.Principal)) statement.Principal = { AWS: `arn:aws:iam::${x.Principal}:root` };
+		else statement.Principal = { Service: x.Principal };
+	}
+	if (x.SourceArn !== void 0) {
+		statement.Condition ??= {};
+		statement.Condition.ArnLike = { "AWS:SourceArn": x.SourceArn };
+	}
+	if (x.SourceAccount !== void 0) {
+		statement.Condition ??= {};
+		statement.Condition.StringEquals = { "AWS:SourceAccount": x.SourceAccount };
+	}
+	if (x.EventSourceToken !== void 0) {
+		statement.Condition ??= {};
+		statement.Condition.StringEquals = { "lambda:EventSourceToken": x.EventSourceToken };
+	}
+	return new Statement(statement);
+}
+function renderCondition(condition) {
+	if (!condition || Object.keys(condition).length === 0) return "";
+	const lines = JSON.stringify(condition, void 0, 2).split("\n");
+	return lines.slice(1, lines.length - 1).map((s) => s.slice(2)).join("\n");
+}
+function defaultPrincipal(principal, statements) {
+	statements.forEach((s) => s.principals.replaceEmpty(principal));
+	statements.forEach((s) => s.principals.replaceStar(principal));
+	return statements;
+}
+function defaultResource(resource, statements) {
+	statements.forEach((s) => s.resources.replaceEmpty(resource));
+	statements.forEach((s) => s.resources.replaceStar(resource));
+	return statements;
+}
+var ManagedPolicyAttachment = class {
+	identityArn;
+	managedPolicyArn;
+	constructor(identityArn, managedPolicyArn) {
+		this.identityArn = identityArn;
+		this.managedPolicyArn = managedPolicyArn;
+	}
+	equal(other) {
+		return this.identityArn === other.identityArn && this.managedPolicyArn === other.managedPolicyArn;
+	}
+};
+var SsoElement = class {
+	fields;
+	constructor(fields) {
+		this.fields = fields;
+	}
+	equal(other) {
+		return strictEqual(this.fields, other.fields);
+	}
+};
+var SecurityGroupRule = class {
+	ipProtocol;
+	fromPort;
+	toPort;
+	groupId;
+	peer;
+	constructor(rule, groupRef) {
+		this.ipProtocol = rule.IpProtocol?.toString() || "*unknown*";
+		this.fromPort = rule.FromPort;
+		this.toPort = rule.ToPort;
+		this.groupId = rule.GroupId || groupRef || "*unknown*";
+		this.peer = findFirst(rule, ["CidrIp", "CidrIpv6"], (ip) => ({
+			kind: "cidr-ip",
+			ip
+		})) || findFirst(rule, ["DestinationSecurityGroupId", "SourceSecurityGroupId"], (id) => ({
+			kind: "security-group",
+			securityGroupId: id
+		})) || findFirst(rule, ["DestinationPrefixListId", "SourcePrefixListId"], (id) => ({
+			kind: "prefix-list",
+			prefixListId: id
+		}));
+	}
+	equal(other) {
+		return this.ipProtocol === other.ipProtocol && this.fromPort === other.fromPort && this.toPort === other.toPort && peerEqual(this.peer, other.peer);
+	}
+	describeProtocol() {
+		if (this.ipProtocol === "-1") return "Everything";
+		const ipProtocol = this.ipProtocol.toUpperCase();
+		if (this.fromPort === -1) return `All ${ipProtocol}`;
+		if (this.fromPort === this.toPort) return `${ipProtocol} ${this.fromPort}`;
+		return `${ipProtocol} ${this.fromPort}-${this.toPort}`;
+	}
+	describePeer() {
+		switch (this.peer?.kind) {
+			case "cidr-ip":
+				if (this.peer.ip === "0.0.0.0/0") return "Everyone (IPv4)";
+				if (this.peer.ip === "::/0") return "Everyone (IPv6)";
+				return `${this.peer.ip}`;
+			case "prefix-list": return `${this.peer.prefixListId}`;
+			case "security-group": return `${this.peer.securityGroupId}`;
+			default: return "?";
+		}
+	}
+};
+function peerEqual(a, b) {
+	if (a === void 0 || b === void 0) return a === b;
+	if (a.kind === "cidr-ip" && b.kind === "cidr-ip") return a.ip === b.ip;
+	if (a.kind === "security-group" && b.kind === "security-group") return a.securityGroupId === b.securityGroupId;
+	if (a.kind === "prefix-list" && b.kind === "prefix-list") return a.prefixListId === b.prefixListId;
+	return false;
+}
+function findFirst(obj, keys, fn) {
+	for (const key of keys) try {
+		if (key in obj) return fn(obj[key]);
+	} catch {}
+}
+var DiffableCollection = class {
+	additions = [];
+	removals = [];
+	oldElements = [];
+	newElements = [];
+	addOld(...elements) {
+		this.oldElements.push(...elements);
+	}
+	addNew(...elements) {
+		this.newElements.push(...elements);
+	}
+	calculateDiff() {
+		const contains = (x, xs) => xs.some((y) => y.equal(x));
+		this.additions.push(...this.newElements.filter((x) => !contains(x, this.oldElements)));
+		this.removals.push(...this.oldElements.filter((x) => !contains(x, this.newElements)));
+	}
+	get hasChanges() {
+		return this.additions.length + this.removals.length > 0;
+	}
+	get hasAdditions() {
+		return this.additions.length > 0;
+	}
+};
+function resourceDiffers(oldValue, newValue) {
+	if (oldValue === void 0 || newValue === void 0) return true;
+	if (oldValue.Type !== newValue.Type) return true;
+	const keyDiffers = (a, b, skip) => [.../* @__PURE__ */ new Set([...Object.keys(a ?? {}), ...Object.keys(b ?? {})])].some((key) => {
+		if (key === skip) return false;
+		const x = a?.[key];
+		const y = b?.[key];
+		return !(x === void 0 && y === void 0) && !cfnEqual(x, y);
+	});
+	return keyDiffers(oldValue.Properties, newValue.Properties) || keyDiffers(oldValue, newValue, "Properties");
+}
+var SecurityChanges = class {
+	statements = new DiffableCollection();
+	managedPolicies = new DiffableCollection();
+	ssoPermissionSets = new DiffableCollection();
+	ssoAssignments = new DiffableCollection();
+	ssoInstanceACAConfigs = new DiffableCollection();
+	ingress = new DiffableCollection();
+	egress = new DiffableCollection();
+	constructor(oldTemplate, newTemplate) {
+		normalize(oldTemplate);
+		normalize(newTemplate);
+		const oldResources = oldTemplate.Resources ?? {};
+		const newResources = newTemplate.Resources ?? {};
+		const changed = [];
+		for (const id of /* @__PURE__ */ new Set([...Object.keys(oldResources), ...Object.keys(newResources)])) {
+			const oldValue = Object.hasOwn(oldResources, id) ? oldResources[id] : void 0;
+			const newValue = Object.hasOwn(newResources, id) ? newResources[id] : void 0;
+			if (oldValue === void 0 && newValue === void 0) continue;
+			if (resourceDiffers(oldValue, newValue)) changed.push([id, {
+				oldValue,
+				newValue
+			}]);
+		}
+		for (const change of this.propertyChanges(changed)) this.readPropertyChange(change);
+		for (const change of this.resourceChanges(changed)) this.readResourceChange(change);
+		for (const collection of this.collections()) collection.calculateDiff();
+	}
+	collections() {
+		return [
+			this.statements,
+			this.managedPolicies,
+			this.ssoPermissionSets,
+			this.ssoAssignments,
+			this.ssoInstanceACAConfigs,
+			this.ingress,
+			this.egress
+		];
+	}
+	propertyChanges(changed) {
+		const ret = [];
+		for (const [logicalId, { oldValue, newValue }] of changed) {
+			const oldType = oldValue?.Type;
+			const newType = newValue?.Type;
+			if (oldType !== void 0 && newType !== void 0 && oldType !== newType) continue;
+			const resourceType = oldType ?? newType;
+			if (!resourceType) continue;
+			for (const [propertyName, scrutiny] of Object.entries(propertyScrutinies(resourceType))) ret.push({
+				logicalId,
+				resourceType,
+				scrutiny,
+				oldValue: oldValue?.Properties?.[propertyName],
+				newValue: newValue?.Properties?.[propertyName]
+			});
+		}
+		return ret;
+	}
+	resourceChanges(changed) {
+		const ret = [];
+		for (const [logicalId, { oldValue, newValue }] of changed) {
+			const oldType = oldValue?.Type;
+			const newType = newValue?.Type;
+			const common = {
+				logicalId,
+				oldProperties: oldValue?.Properties,
+				newProperties: newValue?.Properties
+			};
+			if (oldType !== void 0 && newType !== void 0 && oldType !== newType) {
+				const oldScrutiny = resourceScrutiny(oldType);
+				if (oldScrutiny) ret.push({
+					...common,
+					newProperties: void 0,
+					scrutiny: oldScrutiny
+				});
+				const newScrutiny = resourceScrutiny(newType);
+				if (newScrutiny) ret.push({
+					...common,
+					oldProperties: void 0,
+					scrutiny: newScrutiny
+				});
+				continue;
+			}
+			const type = oldType ?? newType;
+			const scrutiny = type ? resourceScrutiny(type) : void 0;
+			if (scrutiny) ret.push({
+				...common,
+				scrutiny
+			});
+		}
+		return ret;
+	}
+	get permissionsBroadened() {
+		return this.statements.additions.some((s) => !s.isNegativeStatement) || this.statements.removals.some((s) => s.isNegativeStatement) || this.managedPolicies.hasAdditions || this.ssoPermissionSets.hasAdditions || this.ssoAssignments.hasAdditions || this.ssoInstanceACAConfigs.hasAdditions || this.ingress.hasAdditions || this.egress.hasAdditions;
+	}
+	get iamHasChanges() {
+		return this.statements.hasChanges || this.managedPolicies.hasChanges || this.ssoPermissionSets.hasChanges || this.ssoAssignments.hasChanges || this.ssoInstanceACAConfigs.hasChanges;
+	}
+	get securityGroupsHaveChanges() {
+		return this.ingress.hasChanges || this.egress.hasChanges;
+	}
+	get permissionsAnyChanges() {
+		return this.iamHasChanges || this.securityGroupsHaveChanges;
+	}
+	readPropertyChange(change) {
+		switch (change.scrutiny) {
+			case "InlineIdentityPolicies":
+				this.statements.addOld(...readIdentityPolicies(change.oldValue, change.logicalId));
+				this.statements.addNew(...readIdentityPolicies(change.newValue, change.logicalId));
+				break;
+			case "InlineResourcePolicy":
+				if (change.resourceType === "AWS::SSO::PermissionSet") {
+					this.statements.addOld(...readPermissionSetInlinePolicy(change.oldValue, change.logicalId));
+					this.statements.addNew(...readPermissionSetInlinePolicy(change.newValue, change.logicalId));
+				} else {
+					this.statements.addOld(...readResourceStatements(change.oldValue, change.logicalId));
+					this.statements.addNew(...readResourceStatements(change.newValue, change.logicalId));
+				}
+				break;
+			case "ManagedPolicies":
+				this.managedPolicies.addOld(...readManagedPolicies(change.oldValue, change.logicalId));
+				this.managedPolicies.addNew(...readManagedPolicies(change.newValue, change.logicalId));
+				break;
+			case "IngressRules":
+				this.ingress.addOld(...readInlineRules(change.oldValue, change.logicalId));
+				this.ingress.addNew(...readInlineRules(change.newValue, change.logicalId));
+				break;
+			case "EgressRules":
+				this.egress.addOld(...readInlineRules(change.oldValue, change.logicalId));
+				this.egress.addNew(...readInlineRules(change.newValue, change.logicalId));
+		}
+	}
+	readResourceChange(change) {
+		const id = change.logicalId;
+		switch (change.scrutiny) {
+			case "IdentityPolicyResource":
+				this.statements.addOld(...readIdentityPolicyResource(change.oldProperties));
+				this.statements.addNew(...readIdentityPolicyResource(change.newProperties));
+				break;
+			case "ResourcePolicyResource":
+				this.statements.addOld(...readResourcePolicyResource(change.oldProperties));
+				this.statements.addNew(...readResourcePolicyResource(change.newProperties));
+				break;
+			case "LambdaPermission":
+				this.statements.addOld(...readLambdaStatements(change.oldProperties));
+				this.statements.addNew(...readLambdaStatements(change.newProperties));
+				break;
+			case "SsoPermissionSet":
+				this.ssoPermissionSets.addOld(...readSso(change.oldProperties, id, permissionSetFields));
+				this.ssoPermissionSets.addNew(...readSso(change.newProperties, id, permissionSetFields));
+				break;
+			case "SsoAssignmentResource":
+				this.ssoAssignments.addOld(...readSso(change.oldProperties, id, assignmentFields));
+				this.ssoAssignments.addNew(...readSso(change.newProperties, id, assignmentFields));
+				break;
+			case "SsoInstanceACAConfigResource":
+				this.ssoInstanceACAConfigs.addOld(...readSso(change.oldProperties, id, acaConfigFields));
+				this.ssoInstanceACAConfigs.addNew(...readSso(change.newProperties, id, acaConfigFields));
+				break;
+			case "IngressRuleResource":
+				this.ingress.addOld(...readRuleResource(change.oldProperties));
+				this.ingress.addNew(...readRuleResource(change.newProperties));
+				break;
+			case "EgressRuleResource":
+				this.egress.addOld(...readRuleResource(change.oldProperties));
+				this.egress.addNew(...readRuleResource(change.newProperties));
+		}
+	}
+};
+function readIdentityPolicies(policies, logicalId) {
+	if (policies === void 0 || !Array.isArray(policies)) return [];
+	const appliesToPrincipal = "AWS:${" + logicalId + "}";
+	return policies.flatMap((policy) => {
+		const unparsed = policy.PolicyDocument?.Statement ? policy.PolicyDocument.Statement : policy;
+		return defaultPrincipal(appliesToPrincipal, parseStatements(renderIntrinsics(unparsed)));
+	});
+}
+function readIdentityPolicyResource(properties) {
+	if (properties === void 0) return [];
+	properties = renderIntrinsics(properties);
+	return (properties.Groups || []).concat(properties.Users || []).concat(properties.Roles || []).flatMap((principal) => defaultPrincipal("AWS:" + principal, parseStatements(properties.PolicyDocument.Statement)));
+}
+function readPermissionSetInlinePolicy(policy, logicalId) {
+	if (policy === void 0) return [];
+	const statements = parseStatements(renderIntrinsics(policy.Statement));
+	defaultResource("${" + logicalId + ".Arn}", statements);
+	defaultPrincipal("AWS:${" + logicalId + "}", statements);
+	return statements;
+}
+function readResourceStatements(policy, logicalId) {
+	if (policy === void 0) return [];
+	return defaultResource("${" + logicalId + ".Arn}", parseStatements(renderIntrinsics(policy.Statement)));
+}
+function readResourcePolicyResource(properties) {
+	if (properties === void 0) return [];
+	properties = renderIntrinsics(properties);
+	const policyKeys = Object.keys(properties).filter((key) => key.indexOf("Policy") > -1);
+	const resourceKeys = Object.keys(properties).filter((key) => !policyKeys.includes(key) && !key.endsWith("Name"));
+	let resources = resourceKeys.length === 1 ? properties[resourceKeys[0]] : ["???"];
+	if (!Array.isArray(resources)) resources = [resources];
+	return resources.flatMap((resource) => defaultResource(resource, parseStatements(properties[policyKeys[0]].Statement)));
+}
+function readManagedPolicies(policyArns, logicalId) {
+	if (!policyArns) return [];
+	const identity = "${" + logicalId + "}";
+	const arns = renderIntrinsics(policyArns);
+	return typeof arns === "string" ? [new ManagedPolicyAttachment(identity, arns)] : arns.map((arn) => new ManagedPolicyAttachment(identity, arn));
+}
+function readLambdaStatements(properties) {
+	if (!properties) return [];
+	return [parseLambdaPermission(renderIntrinsics(properties))];
+}
+function readInlineRules(rules, logicalId) {
+	if (!rules || !Array.isArray(rules)) return [];
+	const ref = "${" + logicalId + ".GroupId}";
+	return rules.flatMap((rule) => {
+		const rendered = renderIntrinsics(rule);
+		return typeof rendered === "object" ? [new SecurityGroupRule(rendered, ref)] : [];
+	});
+}
+function readRuleResource(resource) {
+	if (!resource) return [];
+	return [new SecurityGroupRule(renderIntrinsics(resource))];
+}
+const permissionSetFields = (p) => ({
+	name: p.Name,
+	ssoInstanceArn: p.InstanceArn,
+	ssoCustomerManagedPolicyReferences: p.CustomerManagedPolicyReferences,
+	ssoPermissionsBoundary: p.PermissionsBoundary
+});
+const assignmentFields = (p) => ({
+	ssoInstanceArn: p.InstanceArn,
+	permissionSetArn: p.PermissionSetArn,
+	principalId: p.PrincipalId,
+	principalType: p.PrincipalType,
+	targetId: p.TargetId,
+	targetType: p.TargetType
+});
+const acaConfigFields = (p) => ({
+	ssoInstanceArn: p.InstanceArn,
+	accessControlAttributes: p.AccessControlAttributes
+});
+function readSso(properties, logicalId, fields) {
+	if (properties === void 0) return [];
+	const values = Object.fromEntries(Object.entries({
+		cfnLogicalId: "${" + logicalId + "}",
+		...fields(renderIntrinsics(properties))
+	}).filter(([, v]) => v !== void 0));
+	return [new SsoElement(values)];
+}
+function withHeader(color, header, rows, then = () => 0) {
+	rows.sort((a, b) => {
+		const keyA = sortKey(a, color);
+		const keyB = sortKey(b, color);
+		if (keyA < keyB) return -1;
+		if (keyB < keyA) return 1;
+		return then(a) - then(b);
+	});
+	return [header, ...rows];
+}
+function sortKey(row, color) {
+	const open = !color ? "" : row[0] === "-" ? "\x1B[31m" : row[0] === "+" ? "\x1B[32m" : "";
+	if (open === "" || row[1] === "") return row[1];
+	const close = "\x1B[39m";
+	return open + row[1].replace(/\r?\n/g, (m) => close + m + open) + close;
+}
+function summarizeStatements(changes, color) {
+	return withHeader(color, [
+		"",
+		"Resource",
+		"Effect",
+		"Action",
+		"Principal",
+		"Condition"
+	], [...changes.statements.additions.map((s) => ["+", ...s.render()]), ...changes.statements.removals.map((s) => ["-", ...s.render()])]);
+}
+function summarizeManagedPolicies(changes, color) {
+	return withHeader(color, [
+		"",
+		"Resource",
+		"Managed Policy ARN"
+	], [...changes.managedPolicies.additions.map((a) => [
+		"+",
+		a.identityArn,
+		a.managedPolicyArn
+	]), ...changes.managedPolicies.removals.map((a) => [
+		"-",
+		a.identityArn,
+		a.managedPolicyArn
+	])]);
+}
+function ssoRows(collection, cells) {
+	return [...collection.additions.map((e) => ["+", ...cells(e.fields)]), ...collection.removals.map((e) => ["-", ...cells(e.fields)])];
+}
+function formatManagedPolicyRef(s) {
+	return `Name: ${s?.Name || ""}, Path: ${s?.Path || ""}`;
+}
+function summarizeSsoPermissionSets(changes, color) {
+	const boundary = (pb) => {
+		if (pb?.ManagedPolicyArn !== void 0) return `ManagedPolicyArn: ${pb?.ManagedPolicyArn || ""}`;
+		if (pb?.CustomerManagedPolicyReference !== void 0) return `CustomerManagedPolicyReference: {\n  ${formatManagedPolicyRef(pb?.CustomerManagedPolicyReference)}\n}`;
+		return "";
+	};
+	return withHeader(color, [
+		"",
+		"Resource",
+		"InstanceArn",
+		"PermissionSet name",
+		"PermissionsBoundary",
+		"CustomerManagedPolicyReferences"
+	], ssoRows(changes.ssoPermissionSets, (f) => [
+		f.cfnLogicalId || "",
+		f.ssoInstanceArn || "",
+		f.name || "",
+		boundary(f.ssoPermissionsBoundary),
+		f.ssoCustomerManagedPolicyReferences?.map(formatManagedPolicyRef).join("\n") || ""
+	]));
+}
+function summarizeSsoInstanceACAConfigs(changes, color) {
+	const attribute = (aca) => `Key: ${aca?.Key}, Values: [${aca?.Value?.Source.join(", ")}]`;
+	return withHeader(color, [
+		"",
+		"Resource",
+		"InstanceArn",
+		"AccessControlAttributes"
+	], ssoRows(changes.ssoInstanceACAConfigs, (f) => [
+		f.cfnLogicalId || "",
+		f.ssoInstanceArn || "",
+		f.accessControlAttributes?.map(attribute).join("\n") || ""
+	]));
+}
+function summarizeSsoAssignments(changes, color) {
+	return withHeader(color, [
+		"",
+		"Resource",
+		"InstanceArn",
+		"PermissionSetArn",
+		"PrincipalId",
+		"PrincipalType",
+		"TargetId",
+		"TargetType"
+	], ssoRows(changes.ssoAssignments, (f) => [
+		f.cfnLogicalId || "",
+		f.ssoInstanceArn || "",
+		f.permissionSetArn || "",
+		f.principalId || "",
+		f.principalType || "",
+		f.targetId || "",
+		f.targetType || ""
+	]));
+}
+function summarizeSecurityGroups(changes, color) {
+	const render = (sign, dir) => (rule) => [
+		sign,
+		`${rule.groupId}`,
+		dir,
+		rule.describeProtocol(),
+		rule.describePeer()
+	];
+	return withHeader(color, [
+		"",
+		"Group",
+		"Dir",
+		"Protocol",
+		"Peer"
+	], [
+		...changes.ingress.additions.map(render("+", "In")),
+		...changes.egress.additions.map(render("+", "Out")),
+		...changes.ingress.removals.map(render("-", "In")),
+		...changes.egress.removals.map(render("-", "Out"))
+	], (row) => row[2].indexOf("In") > -1 ? 0 : 1);
+}
+function displayWidth(text) {
+	let width = 0;
+	for (const ch of text.replace(/(?:\p{Regional_Indicator}{2}|\p{Emoji_Presentation}|\p{Extended_Pictographic}\uFE0F)\p{Emoji_Modifier}?(?:\u200D(?:\p{Emoji_Presentation}|\p{Extended_Pictographic}\uFE0F?)\p{Emoji_Modifier}?)*/gu, "  ")) {
+		const code = ch.codePointAt(0);
+		if (code <= 31 || code >= 127 && code <= 159) continue;
+		if (code >= 768 && code <= 879) continue;
+		width += isFullwidth(code) ? 2 : 1;
+	}
+	return width;
+}
+function isFullwidth(c) {
+	return c >= 4352 && (c <= 4447 || c === 9001 || c === 9002 || c >= 11904 && c <= 12871 && c !== 12351 || c >= 12880 && c <= 19903 || c >= 19968 && c <= 42182 || c >= 43360 && c <= 43388 || c >= 44032 && c <= 55203 || c >= 63744 && c <= 64255 || c >= 65040 && c <= 65049 || c >= 65072 && c <= 65131 || c >= 65281 && c <= 65376 || c >= 65504 && c <= 65510 || c >= 110592 && c <= 110593 || c >= 127488 && c <= 127569 || c >= 131072 && c <= 262141);
+}
+function formatTable(cells, color) {
+	const paint = (fn) => color ? fn : (text) => text;
+	const lines = cells.map((row) => row.map((cell) => String(cell).split("\n")));
+	const widths = cells[0].map((_, i) => Math.max(...lines.map((row) => Math.max(...row[i].map(displayWidth)))));
+	const rule = (left, join, right) => paint(gray)(left + widths.map((w) => "─".repeat(w + 2)).join(join) + right);
+	const bar = paint(gray)("│");
+	const out = [rule("┌", "┬", "┐")];
+	lines.forEach((row, r) => {
+		if (r > 0 && (r === 1 || sortKey(cells[r - 1], color) !== sortKey(cells[r], color))) out.push(rule("├", "┼", "┤"));
+		const sign = r === 0 ? "" : cells[r][0];
+		const tint = paint(sign === "+" ? green : sign === "-" ? red : (text) => text);
+		const height = Math.max(...row.map((cell) => cell.length));
+		for (let l = 0; l < height; l++) {
+			const cellsOut = row.map((cell, i) => {
+				const text = cell[l] ?? "";
+				return " " + (text === "" ? "" : tint(text)) + " ".repeat(widths[i] - displayWidth(text)) + " ";
+			});
+			out.push(bar + cellsOut.join(bar) + bar);
+		}
+	});
+	out.push(rule("└", "┴", "┘"));
+	return out.join("\n");
+}
+function formatSecurityChanges(changes, logicalToPath = {}, color = stdoutSupportsColor()) {
+	if (!changes.permissionsAnyChanges) return "";
+	const paint = (fn) => color ? fn : (text) => text;
+	const substitute = (source) => source.replace(/\$\{([^.}]+)(.[^}]+)?\}/gi, (_m, logId, suffix) => {
+		const path = Object.hasOwn(logicalToPath, logId) ? logicalToPath[logId] : void 0;
+		return "${" + (path && normalizePath(path) || logId) + (suffix || "") + "}";
+	});
+	let out = "";
+	const section = (title) => {
+		out += `${paint(bold)(title)}\n`;
+	};
+	const table = (rows) => {
+		out += formatTable(rows.map((row) => row.map(substitute)), color) + "\n";
+	};
+	if (changes.statements.hasChanges) {
+		section("IAM Statement Changes");
+		table(summarizeStatements(changes, color));
+	}
+	if (changes.managedPolicies.hasChanges) {
+		section("IAM Policy Changes");
+		table(summarizeManagedPolicies(changes, color));
+	}
+	if (changes.ssoPermissionSets.hasChanges || changes.ssoInstanceACAConfigs.hasChanges || changes.ssoAssignments.hasChanges) {
+		section("IAM Identity Center Changes");
+		if (changes.ssoPermissionSets.hasChanges) table(summarizeSsoPermissionSets(changes, color));
+		if (changes.ssoInstanceACAConfigs.hasChanges) table(summarizeSsoInstanceACAConfigs(changes, color));
+		if (changes.ssoAssignments.hasChanges) table(summarizeSsoAssignments(changes, color));
+	}
+	if (changes.securityGroupsHaveChanges) {
+		section("Security Group Changes");
+		table(summarizeSecurityGroups(changes, color));
+	}
+	out += `${paint(yellow)("(NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299)")}\n`;
+	out += "\n";
+	return out;
+}
+function normalizePath(p) {
+	if (p.startsWith("/")) p = p.slice(1);
+	let parts = p.split("/");
+	if (parts.length > 1) {
+		parts = parts.slice(1);
+		if (parts.length > 1) {
+			const last = parts[parts.length - 1];
+			if (last === "Resource" || last === "Default") parts = parts.slice(0, parts.length - 1);
+		}
+		p = parts.join("/");
+	}
+	return p;
+}
+function stdoutSupportsColor(env = process.env, argv = process.argv, isTTY = process.stdout.isTTY === true, platform = process.platform) {
+	const terminator = argv.indexOf("--");
+	const hasFlag = (flag) => {
+		const position = argv.indexOf(`--${flag}`);
+		return position !== -1 && (terminator === -1 || position < terminator);
+	};
+	let force;
+	if ([
+		"no-color",
+		"no-colors",
+		"color=false",
+		"color=never"
+	].some(hasFlag)) force = 0;
+	else if ([
+		"color",
+		"colors",
+		"color=true",
+		"color=always"
+	].some(hasFlag)) force = 1;
+	const forceEnv = env["FORCE_COLOR"];
+	if (forceEnv !== void 0) {
+		if (forceEnv === "true") force = 1;
+		else if (forceEnv === "false") force = 0;
+		else force = forceEnv.length === 0 ? 1 : Math.min(parseInt(forceEnv, 10), 3);
+	}
+	if (force === 0) return false;
+	if ([
+		"color=16m",
+		"color=full",
+		"color=truecolor",
+		"color=256"
+	].some(hasFlag)) return true;
+	if (!isTTY && force === void 0) return false;
+	const min = force || 0;
+	if (env["TERM"] === "dumb") return min > 0;
+	if (platform === "win32") return true;
+	if ("CI" in env) return [
+		"TRAVIS",
+		"CIRCLECI",
+		"APPVEYOR",
+		"GITLAB_CI",
+		"GITHUB_ACTIONS",
+		"BUILDKITE"
+	].some((sign) => sign in env) || env["CI_NAME"] === "codeship" || min > 0;
+	if ("TEAMCITY_VERSION" in env) return /^(9\.(0*[1-9]\d*)\.|\d{2,}\.)/.test(env["TEAMCITY_VERSION"] ?? "");
+	if (env["COLORTERM"] === "truecolor") return true;
+	if (env["TERM_PROGRAM"] === "iTerm.app" || env["TERM_PROGRAM"] === "Apple_Terminal") return true;
+	const term = env["TERM"] ?? "";
+	if (/-256(color)?$/i.test(term)) return true;
+	if (/^screen|^xterm|^vt100|^vt220|^rxvt|color|ansi|cygwin|linux/i.test(term)) return true;
+	if ("COLORTERM" in env) return true;
+	return min > 0;
+}
+
+//#endregion
+//#region src/analyzer/security-diff.ts
+function isSyntheticChange(pc) {
+	return pc.replacementPropagated === true || pc.inPlacePropagated === true || pc.noEchoPromoted === true;
+}
+function withChanges(base, changes, side) {
+	const props = { ...base ?? {} };
+	for (const pc of changes) {
+		const value = pc[side];
+		if (value === void 0) delete props[pc.path];
+		else props[pc.path] = value;
+	}
+	return props;
+}
+function securityDiffTemplates(changes, records) {
+	const oldResources = {};
+	const newResources = {};
+	const maskedChanges = [];
+	for (const change of changes) {
+		const id = change.logicalId;
+		const record = Object.hasOwn(records, id) ? records[id] : void 0;
+		switch (change.changeType) {
+			case "CREATE":
+				newResources[id] = {
+					Type: change.resourceType,
+					Properties: { ...change.desiredProperties ?? {} }
+				};
+				break;
+			case "DELETE":
+				oldResources[id] = {
+					Type: record?.resourceType ?? change.resourceType,
+					Properties: { ...change.currentProperties ?? record?.properties ?? {} }
+				};
+				break;
+			case "UPDATE": {
+				const pcs = change.propertyChanges ?? [];
+				const typeChange = pcs.find((pc) => pc.path === "Type");
+				const oldType = record?.resourceType ?? change.resourceType;
+				if (typeChange !== void 0 || oldType !== change.resourceType) {
+					oldResources[id] = {
+						Type: typeof typeChange?.oldValue === "string" ? typeChange.oldValue : oldType,
+						Properties: { ...change.currentProperties ?? record?.properties ?? {} }
+					};
+					newResources[id] = {
+						Type: change.resourceType,
+						Properties: { ...change.desiredProperties ?? {} }
+					};
+					break;
+				}
+				for (const pc of pcs) if (pc.maskedExpressionChanged === true && !isSyntheticChange(pc)) maskedChanges.push({
+					logicalId: id,
+					resourceType: change.resourceType,
+					path: pc.path
+				});
+				const real = pcs.filter((pc) => !isSyntheticChange(pc) && pc.maskedExpressionChanged !== true);
+				if (real.length === 0) break;
+				const base = change.currentProperties ?? record?.properties;
+				oldResources[id] = {
+					Type: oldType,
+					Properties: withChanges(base, real, "oldValue")
+				};
+				newResources[id] = {
+					Type: change.resourceType,
+					Properties: withChanges(base, real, "newValue")
+				};
+				break;
+			}
+		}
+	}
+	return {
+		oldTemplate: { Resources: oldResources },
+		newTemplate: { Resources: newResources },
+		maskedChanges
+	};
+}
+async function diffSecurity(args) {
+	const templates = securityDiffTemplates(args.changes, args.records);
+	const { oldTemplate, newTemplate } = templates;
+	if (Object.keys(oldTemplate.Resources).length === 0 && Object.keys(newTemplate.Resources).length === 0 && templates.maskedChanges.length === 0) return {
+		broadening: false,
+		rendered: ""
+	};
+	try {
+		const unjudged = templates.maskedChanges.filter((c) => isScrutinizedProperty(c.resourceType, c.path));
+		const diff = new SecurityChanges(structuredClone(oldTemplate), structuredClone(newTemplate));
+		const broadening = diff.permissionsBroadened || unjudged.length > 0;
+		const unjudgedNote = unjudged.length === 0 ? "" : "These changed values are masked, so whether they broaden permissions could not be evaluated:\n" + unjudged.map((c) => `  ${c.logicalId} (${c.resourceType}): ${c.path}\n`).join("");
+		if (!diff.permissionsBroadened && !diff.permissionsAnyChanges) return {
+			broadening,
+			rendered: terminalSafe(unjudgedNote)
+		};
+		let table;
+		try {
+			const shown = args.secretMask === void 0 ? void 0 : withholdSecrets(templates, args.secretMask());
+			const shownDiff = shown === void 0 || shown.masked === 0 ? diff : new SecurityChanges(shown.templates.oldTemplate, shown.templates.newTemplate);
+			table = formatSecurityChanges(shownDiff, logicalIdToPath(args.records, args.template));
+			if (shown !== void 0 && shown.masked > 0) table += "(Values that hold a secret are shown as ***.)\n";
+		} catch {
+			table = "The security changes are not shown: they could not be checked for secrets.\n";
+		}
+		return {
+			broadening,
+			rendered: terminalSafe(table + unjudgedNote)
+		};
+	} catch (error) {
+		throw new CdkdError(safeMsg`Could not compute the security diff of stack ${args.stackName}, so whether its changes broaden permissions is unknown: ${error instanceof Error ? error.message : String(error)}`, "SECURITY_DIFF_FAILED");
+	}
+}
+function holdsSecret(value, mask) {
+	if (typeof value === "string") return mask(value) !== value;
+	if (typeof value === "number" || typeof value === "boolean") return mask(String(value)) !== String(value);
+	if (Array.isArray(value)) return value.some((v) => holdsSecret(v, mask));
+	if (value !== null && typeof value === "object") return Object.entries(value).some(([k, v]) => mask(k) !== k || holdsSecret(v, mask));
+	return false;
+}
+function maskLeaves(value, mask, keys = true) {
+	if (Array.isArray(value)) return value.map((v) => maskLeaves(v, mask, keys));
+	if (value !== null && typeof value === "object") {
+		const entries = Object.entries(value).map(([k, v]) => [keys && mask(k) !== k ? "***" : k, maskLeaves(v, mask, keys)]);
+		if (new Set(entries.map(([k]) => k)).size < entries.length) return "***";
+		return Object.fromEntries(entries);
+	}
+	return holdsSecret(value, mask) ? "***" : value;
+}
+function withholdSecrets(templates, mask) {
+	const copy = structuredClone(templates);
+	let masked = 0;
+	const ids = /* @__PURE__ */ new Set([...Object.keys(copy.oldTemplate.Resources), ...Object.keys(copy.newTemplate.Resources)]);
+	for (const id of ids) {
+		const oldProps = copy.oldTemplate.Resources[id]?.Properties;
+		const newProps = copy.newTemplate.Resources[id]?.Properties;
+		const keys = /* @__PURE__ */ new Set([...Object.keys(oldProps ?? {}), ...Object.keys(newProps ?? {})]);
+		for (const key of keys) {
+			const oldValue = oldProps?.[key];
+			const newValue = newProps?.[key];
+			const newHolds = holdsSecret(newValue, mask);
+			if (!newHolds && !holdsSecret(oldValue, mask)) continue;
+			masked++;
+			if (newProps !== void 0 && newValue !== void 0) newProps[key] = maskLeaves(newValue, mask);
+			if (oldProps === void 0 || oldValue === void 0) continue;
+			if (newHolds && JSON.stringify(oldValue) !== JSON.stringify(newValue)) oldProps[key] = maskLeaves(oldValue, () => "***", false);
+			else oldProps[key] = maskLeaves(oldValue, mask);
+		}
+	}
+	return {
+		templates: copy,
+		masked
+	};
+}
+function logicalIdToPath(records, template) {
+	const map = {};
+	for (const [id, record] of Object.entries(records)) if (typeof record?.constructPath === "string") map[id] = record.constructPath;
+	for (const [id, resource] of Object.entries(template?.Resources ?? {})) {
+		const path = (resource?.Metadata)?.["aws:cdk:path"];
+		if (typeof path === "string") map[id] = path;
+	}
+	return map;
+}
+
 //#endregion
 //#region src/deployment/resource-deadline.ts
 var InvalidResourceDeadlineError = class extends Error {
@@ -38953,7 +40951,16 @@ async function requireDeploymentApproval(args) {
 	const changes = [...args.changes].filter((c) => c.changeType !== "NO_CHANGE" && !isNoEchoPromotionOnly(c));
 	const destructiveChanges = findDestructiveChanges(args.stackName, changes, args.records, args.template, new Set(args.recreateTargetIds ?? []));
 	const onlyNestedUpdates = changes.every((c) => c.changeType === "UPDATE" && c.resourceType === NESTED_STACK_TYPE$1);
-	if (!(level === "destructive" ? destructiveChanges.length > 0 : changes.length > 0 && !onlyNestedUpdates)) return false;
+	const security = level === "broadening" ? await diffSecurity({
+		stackName: args.stackName,
+		changes,
+		records: args.records,
+		template: args.template,
+		secretMask: args.secretMask
+	}).catch((error) => {
+		throw error instanceof Error ? markNonRetryable(error) : error;
+	}) : void 0;
+	if (!(level === "destructive" ? destructiveChanges.length > 0 : level === "broadening" ? security?.broadening === true : changes.length > 0 && !onlyNestedUpdates)) return false;
 	const count = (type) => changes.filter((c) => c.changeType === type).length;
 	if (enclosingDeadlineExpired()) throw approvalAfterTimeout(args.stackName);
 	let approved;
@@ -38966,7 +40973,8 @@ async function requireDeploymentApproval(args) {
 				update: count("UPDATE"),
 				delete: count("DELETE")
 			},
-			destructiveChanges
+			destructiveChanges,
+			...security !== void 0 && { securityChanges: security.rendered }
 		}));
 	} catch (error) {
 		throw error instanceof Error ? markNonRetryable(error) : error;
@@ -38986,7 +40994,7 @@ async function checkDestructivePlan(args) {
 async function approveLateReplacement(args) {
 	const level = args.options.requireApproval ?? "never";
 	const approve = args.options.approveDeployment;
-	if (level === "never" || approve === void 0) return true;
+	if (level === "never" || level === "broadening" || approve === void 0) return true;
 	if (enclosingDeadlineExpired()) return false;
 	try {
 		const approved = await whileEnclosingDeadlinesPaused(() => approve({
@@ -39245,15 +41253,35 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	if (resourceType === "AWS::CloudFormation::Stack") recordPassedNoEchoParameters(updateSecrets, desiredProps["Parameters"], this.noEchoPositionSources(stateResources));
 	if (fingerprintSources !== void 0 && resourceType === "AWS::CloudFormation::Stack") recordPassedParameterClasses(updateSecrets, await classifyPassedParameters(desiredProps["Parameters"], fingerprintSources));
 	const desiredForSkipCheck = maskAtCoordinates(redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps), comparisonCoordinates);
+	const legacyDesired = withoutPhysicalNameCopies(updateSecrets, () => maskAtCoordinates(redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps), comparisonCoordinates));
+	const copies = physicalNameCopiesOf.get(updateSecrets);
+	const regionEvidence = getCurrentProducerRegions()?.();
+	const recordOwnSecrets = copies !== void 0 && copies.size > 0 && regionEvidence?.complete === true && recordHoldsEmbeddedReference(currentResource) ? await resolveRecordSecrets({
+		properties: currentResource.properties,
+		attributes: currentResource.attributes
+	}, (token, own) => this.resolver.resolveDynamicReferences(token, persistedTokenResolverContext(own, regionEvidence.regions))) : void 0;
+	const embeddedRewrites = [...embeddedPhysicalNameRewrites(updateSecrets), ...recordOwnSecrets === void 0 || recordOwnSecrets.size === 0 ? [] : embeddedPhysicalNameRewrites(updateSecrets, recordOwnSecrets)];
+	const repairable = [currentProps, currentResource.properties].filter((bag) => bag !== null && typeof bag === "object");
+	for (const bag of new Set(repairable)) for (const key of Object.keys(bag)) {
+		const repaired = repairEmbeddedPhysicalNamesTowards(repairPhysicalNameCopyLeaves(bag[key], legacyDesired[key], desiredForSkipCheck[key]), desiredForSkipCheck[key], embeddedRewrites);
+		if (repaired !== bag[key]) bag[key] = repaired;
+	}
+	const attributes = currentResource.attributes;
+	if (attributes !== void 0 && attributes !== null && embeddedRewrites.length > 0) for (const key of Object.keys(attributes)) {
+		const repaired = replaceEmbeddedPhysicalNameRewrites(attributes[key], embeddedRewrites);
+		if (repaired !== attributes[key]) attributes[key] = repaired;
+	}
 	const allowedSilentDrops = this.providerRegistry.getAllowedUnsupportedProperties?.();
 	const desiredForSkipCheckAsWritten = currentResource.provisionedBy !== "cc-api" && allowedSilentDrops ? withoutAcceptedSilentDropProperties(resourceType, desiredForSkipCheck, allowedSilentDrops, currentResource.properties) : desiredForSkipCheck;
 	const allowedForRecord = allowedSilentDrops ?? /* @__PURE__ */ new Set();
 	const createOnlyEvidence = acceptedCreateOnlyDropsOf(currentResource);
 	const recordedAsWritten = currentResource.provisionedBy === "cc-api" ? currentProps : withoutUnwrittenSilentDropProperties(resourceType, currentProps, desiredForSkipCheck, allowedForRecord, createOnlyEvidence);
 	const unmarkedRecord = noEchoLeavesOf(currentResource) === void 0;
-	const todayAsWritten = unmarkedRecord ? redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), withoutNoEchoParameterEntries(updateSecrets), desiredProps) : void 0;
+	const todayAsWritten = unmarkedRecord || witnessNormalize(recordedAsWritten, void 0, desiredForSkipCheckAsWritten).differing.length > 0 ? redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), withoutNoEchoParameterEntries(updateSecrets), desiredProps) : void 0;
 	const witness = todayAsWritten === void 0 ? void 0 : witnessNormalize(recordedAsWritten, todayAsWritten, desiredForSkipCheckAsWritten);
 	const currentPropsAsWritten = witness === void 0 ? recordedAsWritten : witness.current;
+	const witnessMigrates = unmarkedRecord || (witness?.confirmed.length ?? 0) > 0;
+	if (!unmarkedRecord && witness !== void 0 && witness.confirmed.length > 0) this.witnessConfirmedLeaves.set(logicalId, witness.confirmed.map((coordinate) => [...coordinate]));
 	for (const coordinate of witness?.differing ?? []) {
 		const desiredAt = valueAtCoordinate(desiredForSkipCheckAsWritten, coordinate);
 		recordPreviousNoEchoLeaves(this.secretNameBagFor(logicalId), valueAtCoordinate(recordedAsWritten, coordinate), scalarLeavesOf(desiredAt), updateSecrets, desiredAt !== "***");
@@ -39310,7 +41338,8 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		this.logger.warn(cause === "parameter" ? safeMsg`${logicalId}.${key} is a create-only property, and a NoEcho parameter's value changed since the last deploy: ${logicalId} is replaced.` : safeMsg`${logicalId}.${key} is a create-only property, and the value at its NoEcho position changed since the last deploy: ${logicalId} is replaced.`);
 	};
 	const suppliesFreshMaskOnlyValue = pendingParameterLeaves.size > 0 || Object.keys(resolvedProps).some((key) => otherFreshAt(key).length > 0);
-	const recordMatchesDesired = movedMasked.size === 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten);
+	const rewrittenPaths = readsProducerReplacedThisRun.call(this, template, logicalId, stateResources) ? redactionRewrittenPaths(resolvedProps, desiredForSkipCheck, comparisonCoordinates) : /* @__PURE__ */ new Set();
+	const recordMatchesDesired = movedMasked.size === 0 && rewrittenPaths.size === 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten);
 	const applyAttributeOnlyUpdate = (attributeChanges) => {
 		const attrSummary = attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
 		this.logger.info(safeMsg`  ↻ ${logicalId} (${resourceType}) attribute update: ${attrSummary}`);
@@ -39326,7 +41355,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	};
 	const schemaCreateOnly = pendingParameterLeaves.size === 0 && parameterCoordinates.length === 0 ? [] : await getCreateOnlyPropertyPaths(resourceType).catch(() => []);
 	const echoCandidates = echoFidelityCandidates(parameterCoordinates, resolvedProps, schemaCreateOnly);
-	const readbackRecord = unmarkedRecord && parameterCoordinates.length > 0 ? {
+	const readbackRecord = witnessMigrates && parameterCoordinates.length > 0 ? {
 		...currentResource,
 		properties: maskAtCoordinates(currentResource.properties, parameterCoordinates)
 	} : currentResource;
@@ -39383,7 +41412,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	};
 	const lateReplacementDeclined = /* @__PURE__ */ new Set();
 	const differsWhy = (key) => !lateReplacementDeclined.has(key) ? "differs; the provider is not known to report this property exactly, so the difference may be its normalization" : lateCrossPrefixRefused ? "differs; the replacement was refused: see the state-prefix warning above" : `differs; the replacement was not approved (--require-approval=${this.options.requireApproval ?? "never"})`;
-	if (unmarkedRecord && !typeChanged && echoCandidates.length > 0 && hasAddressablePhysicalId(currentResource)) await readOnce();
+	if (witnessMigrates && !typeChanged && echoCandidates.length > 0 && hasAddressablePhysicalId(currentResource)) await readOnce();
 	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && recordMatchesDesired) {
 		if (change.attributeChanges && change.attributeChanges.length > 0) {
 			applyAttributeOnlyUpdate(change.attributeChanges);
@@ -39414,7 +41443,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 				lowered.push(pc);
 				continue;
 			}
-			const moved = movedMasked.has(pc.path) || keyOrderFreeJson(desiredForSkipCheckAsWritten[pc.path]) !== keyOrderFreeJson(currentPropsAsWritten[pc.path]);
+			const moved = movedMasked.has(pc.path) || rewrittenPaths.has(pc.path) || keyOrderFreeJson(desiredForSkipCheckAsWritten[pc.path]) !== keyOrderFreeJson(currentPropsAsWritten[pc.path]);
 			const conditionalVerdict = moved && !typeChanged && isReplacementCeiling(pc) ? this.diffCalculator.conditionalReplacementVerdict?.(resourceType, pc.path, currentPropsAsWritten[pc.path], desiredForSkipCheckAsWritten[pc.path]) : void 0;
 			if (moved && conditionalVerdict !== false) {
 				warnWitnessReplacement(pc.path);
@@ -39468,7 +41497,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 			return liveHoldsFreshLeaves(read.live[key], pendingParameterLeaves.get(key) ?? []) ? "held" : "differs";
 		};
 		const lowered = [];
-		const movedAt = (path) => movedMasked.has(path) || keyOrderFreeJson(desiredForSkipCheckAsWritten[path]) !== keyOrderFreeJson(currentPropsAsWritten[path]);
+		const movedAt = (path) => movedMasked.has(path) || rewrittenPaths.has(path) || keyOrderFreeJson(desiredForSkipCheckAsWritten[path]) !== keyOrderFreeJson(currentPropsAsWritten[path]);
 		replacedAnyway = this.recreateDirectionFor(stackName, logicalId) !== void 0 || lostWithParent !== void 0 || (change.propertyChanges ?? []).some((other) => other.requiresReplacement && (!parameterCreateOnlyPaths.has(other.path) || movedAt(other.path)));
 		for (const pc of change.propertyChanges ?? []) {
 			if (!parameterCreateOnlyPaths.has(pc.path)) {
@@ -39618,11 +41647,16 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		diffSawTokenChange: diffMovedServiceToken(change)
 	});
 	if (serviceTokenRefusal !== void 0) throw markRefusedBeforeApplying(markNonRetryable(new CdkdError(renderServiceTokenRefusal([serviceTokenRefusal], stackName, createSecretMasker(updateSecrets)), SERVICE_TOKEN_CHANGE_REFUSED)));
+	let previousForProvider = currentPropsAsWritten;
+	for (const coordinate of witness?.confirmed ?? []) {
+		const value = valueAtCoordinate(resolvedProps, coordinate);
+		if (value !== void 0) previousForProvider = setAtCoordinate(previousForProvider, coordinate, value);
+	}
 	return markRestored(await this.updateInPlace({
 		conditions,
 		counts,
 		currentProps,
-		currentPropsAsWritten,
+		currentPropsAsWritten: previousForProvider,
 		currentResource,
 		dependencies,
 		desiredForSkipCheckAsWritten,
@@ -39666,6 +41700,26 @@ function recordPreviousNoEchoLeaves(registry, stored, desiredLeaves, resolution,
 		if (partlyMasked !== leaf && partlyMasked !== "***") recordLogOnlyValue(registry, partlyMasked);
 	}
 }
+function recordHoldsEmbeddedReference(record) {
+	const walk = (node) => {
+		if (typeof node === "string") return node.includes("{{resolve:") && !isSingleDynamicReferenceToken(node);
+		if (node === null || typeof node !== "object") return false;
+		return Object.values(node).some(walk);
+	};
+	return walk(record.properties) || walk(record.attributes);
+}
+function redactionRewrittenPaths(resolvedProps, desiredForSkipCheck, comparisonCoordinates) {
+	const masked = maskAtCoordinates({ ...resolvedProps }, comparisonCoordinates);
+	return new Set(Object.keys(masked).filter((key) => keyOrderFreeJson(masked[key]) !== keyOrderFreeJson(desiredForSkipCheck[key])));
+}
+function readsProducerReplacedThisRun(template, logicalId, stateResources) {
+	return (this.extractAllDependencies(template, logicalId) ?? []).some((id) => {
+		const loaded = Object.hasOwn(this.healBaseline, id) ? this.healBaseline[id] : void 0;
+		if (loaded === void 0) return false;
+		const now = Object.hasOwn(stateResources, id) ? stateResources[id] : void 0;
+		return now !== void 0 && now.physicalId !== loaded.physicalId;
+	});
+}
 
 //#endregion
 //#region src/deployment/deploy-engine/update-replace.ts
@@ -40699,6 +42753,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 	const concurrency = this.options.concurrency;
 	this.deployChanges = changes;
 	const newResources = { ...currentState.resources };
+	this.deployStateResources = newResources;
 	const actualCounts = {
 		created: 0,
 		updated: 0,
@@ -42077,7 +44132,7 @@ function conditionFingerprint(template, name, inputOf) {
 			inputs[parameter] = { token: input.expression };
 			hasToken = true;
 		} else {
-			if (isPlainObject(definition) && definition["NoEcho"] === true) return void 0;
+			if (declaresNoEcho(definition)) return void 0;
 			if (typeof input.value !== "string") return void 0;
 			if (carriesDynamicReference(input.value)) return void 0;
 			if (coerceParameterTypedValue(input.value, type) !== input.value) return void 0;
@@ -42460,6 +44515,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		};
 		const currentEtag = currentStateData?.etag;
 		this.healBaseline = currentState.resources ?? {};
+		this.runProducerRegionEvidence = () => this.producerRegionEvidence(currentState);
 		refuseMalformedOutputs(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
 		refuseMalformedResourcesForDeploy(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
 		refuseMalformedResourceEntriesForDeploy(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
@@ -42760,7 +44816,8 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			changes: changes.values(),
 			records: currentState.resources,
 			template: effectiveTemplate,
-			recreateTargetIds: recreateTargetIdsFor(this.options.recreateTargets, stackName)
+			recreateTargetIds: recreateTargetIdsFor(this.options.recreateTargets, stackName),
+			secretMask: () => this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues, currentState.resources)
 		})) this.generatedNameGuard?.noteApprovalPrompted();
 		this.generatedNameGuard?.recordPlannedIntents();
 		this.resolver.resetPhysicalIdFallbackCount();
@@ -43070,6 +45127,7 @@ var DeployEngine = class {
 	secretNameNeedles = /* @__PURE__ */ new Map();
 	perResourceTemplateProps = /* @__PURE__ */ new Map();
 	perResourceResolvedType = /* @__PURE__ */ new Map();
+	witnessConfirmedLeaves = /* @__PURE__ */ new Map();
 	fingerprintNoEchoValues = void 0;
 	preDeploySecretNamedRecords = void 0;
 	fingerprintParameters = void 0;
@@ -43093,7 +45151,9 @@ var DeployEngine = class {
 	updateWasReplaced = /* @__PURE__ */ new Map();
 	oldDeletedBeforeCreate = /* @__PURE__ */ new Set();
 	healBaseline = {};
+	runProducerRegionEvidence = void 0;
 	deployChanges = /* @__PURE__ */ new Map();
+	deployStateResources = {};
 	stackRecordsView = void 0;
 	inlinePolicyWriters = /* @__PURE__ */ new Map();
 	attributeHeals = /* @__PURE__ */ new Map();
@@ -43110,7 +45170,9 @@ var DeployEngine = class {
 		this.exportIndexStore = exportIndexStore;
 		this.resolver = new IntrinsicFunctionResolver(stackRegion, {
 			strictGetAtt: options.strictGetAtt ?? false,
-			cfnFallback: options.cfnFallback ?? true
+			cfnFallback: options.cfnFallback ?? true,
+			...options.producerLookup && { producerLookup: options.producerLookup },
+			...options.consumerAccount && { consumerAccount: options.consumerAccount }
 		});
 		this.options.concurrency = options.concurrency ?? 10;
 		this.options.dryRun = options.dryRun ?? false;
@@ -43137,6 +45199,7 @@ var DeployEngine = class {
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
 		this.constructPathTemplate = void 0;
 		this.perResourceResolvedType = /* @__PURE__ */ new Map();
+		this.witnessConfirmedLeaves = /* @__PURE__ */ new Map();
 		this.fingerprintNoEchoValues = void 0;
 		this.preDeploySecretNamedRecords = void 0;
 		this.fingerprintParameters = void 0;
@@ -43157,7 +45220,9 @@ var DeployEngine = class {
 		this.updateWasReplaced = /* @__PURE__ */ new Map();
 		this.oldDeletedBeforeCreate = /* @__PURE__ */ new Set();
 		this.healBaseline = {};
+		this.runProducerRegionEvidence = void 0;
 		this.deployChanges = /* @__PURE__ */ new Map();
+		this.deployStateResources = {};
 		this.inlinePolicyWriters = /* @__PURE__ */ new Map();
 		this.attributeHeals = /* @__PURE__ */ new Map();
 		this.healedAttributes = /* @__PURE__ */ new Map();
@@ -43227,7 +45292,7 @@ var DeployEngine = class {
 		};
 	}
 	inlinePolicyClaimedFor(resourceType, logicalId, stateResources) {
-		if (resourceType !== "AWS::IAM::Policy" && !isInlinePolicyPrincipalType(resourceType)) return;
+		if (resourceType !== "AWS::IAM::Policy" && !isInlinePolicyPrincipalType(resourceType) && !isStandaloneInlinePolicyType(resourceType)) return;
 		const args = {
 			selfLogicalId: logicalId,
 			writers: this.inlinePolicyWriters,
@@ -43374,5 +45439,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { getPriorAttempts as $, isWarmThroughputDecrease as $a, derivePartitionAndUrlSuffix as $c, malformedResourceEntriesWarning as $i, reserveStackCreateToken as $n, isUncertifiedBaselineMaskPosition as $o, AWS_CREDENTIAL_ENV_KEYS as $r, ensureAssetStorage as $s, orphanDeleteNeedsIdentity as $t, noEchoExactEchoLeavesOf as A, repairMalformedOrphansForReadOnly as Aa, getDefaultStateBucketName as Ac, UNREADABLE_RESOURCES_MAP_ROW as Ai, maskEventTextWithBoundBags as An, passedNoEchoParametersOf as Ao, deleteSkipReason as Ar, acceptedCreateOnlyDropsOf as As, isHandledOrphan as At, beginDeleteWait as B, findSilentDropProperties as Ba, stateBucketExistenceConfirmed as Bc, malformedExportNamesWarning as Bi, ccRoutedFinalSnapshotError as Bn, printingCorpusOf as Bo, DiffCalculator as Br, orphansCarriedFrom as Bs, withStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedResourcePropertiesForExport as Ca, warnFinchArgvExposure as Cc, withSharedDrainBudget as Ci, collectPublishedOutputNames as Cn, maskAtCoordinates as Co, customResourceResponseExpirationWarning as Cr, CrossPrefixReadError as Cs, revertedNestedRowIds as Ct, withResourceDeadline as D, refuseMalformedResourcesForExport as Da, getDockerImageBySourceHash as Dc, STATE_REGION_DIVERGED as Di, DEFAULT_RESOURCE_WARN_AFTER_MS as Dn, noEchoCoordinatesOf as Do, UNSPECIFIED_SKIP_REASON as Dr, isAccessDenied$1 as Ds, withNestedStackContext as Dt, serviceTokenBlockingReason as E, refuseMalformedResourcesForDestroy as Ea, AssetManifestLoader as Ec, JSON_LISTING_HOLE_VALUE as Ei, DEFAULT_RESOURCE_TIMEOUT_MS as En, maskedLeafCoordinatesOf as Eo, unchangedBehindSecretReference as Er, crossPrefixDeniedWarning as Es, getCurrentNestedStackContext as Et, isProtectionValueActive as F, unpreviewableOrphanRecords as Fa, resolveCaptureObservedState as Fc, hasReadableOutputs as Fi, storedSecretNameNeedles as Fn, carryLogOnlyValues as Fo, ec2InstanceProtectionSite as Fr, hasUnverifiableParameterRefusal as Fs, replayFailedOperations as Ft, DELETE_INDEX_WAIT_PROCEED_NOTE as G, findReplacedReadersOfRecreateTargets as Ga, MIGRATE_TMP_PREFIX as Gc, malformedOrphanRecordsRefusalMessage as Gi, unsupportedFinalSnapshotError as Gn, errorCauseChain as Go, producerRegionsFromState as Gr, WorkGraph as Gs, isReplacementOrphan as Gt, deleteBudgetKey as H, withoutSilentDropProperties as Ha, ssmResolvedValueType as Hc, malformedLocalOutputsWarning as Hi, effectiveDeletionPolicy as Hn, recordLogOnlyValue as Ho, IntrinsicFunctionResolver as Hr, AssetPublisher as Hs, recordAfterRollbackUpdate as Ht, perType as I, unreadableOrphanRecords as Ia, resolveSkipPrefix as Ic, hasReadableResources as Ii, extractDeploymentEventError as In, createUnionSecretMasker as Io, isTerminationProtectionPropagationError as Ir, importableOutputKeys as Is, replayRollback as It, waitForIndexesSettled as J, isStatefulRecreateTargetForReplace as Ja, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Jc, malformedOrphansRefusalMessage as Ji, findDestructiveChanges as Jn, markSameGenerationBag as Jo, assertFlagRoleArn as Jr, loadPublishableAssetManifest as Js, recheckFailedPlan as Jt, INDEX_SETTLE_POLL_INTERVAL_MS as K, shownType as Ka, findLargeInlineResources as Kc, malformedOrphanRecordsWarning as Ki, maskingRetryLogger as Kn, maskSecretsInError as Ko, regionLessSecretName as Kr, buildAssetRedirectMap as Ks, planFailedOps as Kt, readProtection as L, unreadableResourceEntries as La, resolveStateBucketWithDefault as Lc, isReadableOrphanRecord as Li, ATOMIC_FINAL_SNAPSHOT_TYPES as Ln, hasMaskableValues as Lo, observeThenDisableInstanceApiTermination as Lr, importableOutputs as Ls, awaitInFlightSibling as Lt, recordedProtectionEvidence as M, repairMalformedResourceEntriesForReadOnly as Ma, loadCdkJson as Mc, deployRefusesOrphanRowsReason as Mi, secretNamePrintingBag as Mn, readsNoEchoSource as Mo, isWaitAbandonedError as Mr, exportNamesCarriedFrom as Ms, loadJournaledOrphans as Mt, recordedProtectionNote as N, repairMalformedResourcePropertiesForReadOnly as Na, resolveApp as Nc, displayLogicalId as Ni, secretNamedRecordNeedles as Nn, valueAtCoordinate as No, markWaitAbandoned as Nr, hasReadableExportSet as Ns, makeForeignHolderScan as Nt, noEchoAttributeNamesOf as O, refuseMalformedState as Oa, Synthesizer as Oc, STATE_RESOURCES_MALFORMED as Oi, completedReplayEntries as On, noEchoLeavesOf as Oo, deleteIndeterminateGuards as Or, isNotImplemented as Os, deleteJournaledOrphans as Ot, PROTECTION_PROPERTY_BY_TYPE as P, repairMalformedResourcesForReadOnly as Pa, resolveAutoAssetStorage as Pc, hasReadableOrphans as Pi, stateSecretNameNeedles as Pn, liveMatchesUnresolvedTokenFrame as Po, disableInstanceApiTermination as Pr, hasReasonlessBaselineRefusal as Ps, sameJournaledOrphans as Pt, isTruthyCfnBoolean as Q, coerceWarmThroughput as Qa, canonicalizeRegion as Qc, malformedRenderedContainersWarning as Qi, ledgerForStack as Qn, dynamicReferenceTokens as Qo, sendableAssumeRoleCommand as Qr, assertAssetBucketRegion as Qs, seedsDeleteFirstGuard as Qt, DynamoDBGlobalTableProvider as R, withheldAccountClause as Ra, resolveStateBucketWithDefaultAndSource as Rc, isReadableResourceEntry as Ri, PRE_DELETE_SNAPSHOT_TYPES as Rn, literalSplitDelimitersOf as Ro, reDisableInstanceApiTermination as Rr, isReadableBag as Rs, destroyStackRecordsView as Rt, keptForReadoption as S, refuseMalformedResourcePropertiesForDrift as Sa, runDockerStreaming as Sc, parseWebACLArn as Si, collectDeclaredOutputNames as Sn, isMarkedCoordinate as So, applyCustomResourceResponseExpiration as Sr, rebuildClientForBucketRegion as Ss, revertNestedChildFromJournal as St, findServiceTokenRefusals as T, refuseMalformedResourcesForDeploy as Ta, stripControlChars as Tc, passedParameterClassesOf as Ti, bindingSkippedOutputs as Tn, maskWholeValue as To, slowCcOperationTimeoutMs as Tr, applyCrossPrefixScan as Ts, collectNestedChildUnaddressed as Tt, resolveDynamoDbDeleteBudgetClock as U, NO_CC_HANDLERS_REASON as Ua, CFN_TEMPLATE_BODY_LIMIT as Uc, malformedLocalResourceEntriesWarning as Ui, isFinalSnapshotError as Un, shareLogOnlyValues as Uo, poisonRenderedSpellingsCollidingIn as Ur, isSensitiveAttributeName as Us, demoteSupersededOrphans as Ut, compensateRemovedDeletionProtection as V, unwrittenCreateOnlyReplacement as Va, warnDeprecatedNoPrefixCliFlag as Vc, malformedExportSourceWarning as Vi, createPreDeleteFinalSnapshot as Vn, recordLogOnlyParameterValue as Vo, INTRINSIC_KEYS as Vr, shouldRetainResource as Vs, removeProtectionTypeList as Vt, resolveDynamoDbDeleteBudgetMs as W, hasNoCloudControlHandlers as Wa, CFN_TEMPLATE_URL_LIMIT as Wc, malformedLocalResourcesWarning as Wi, refusesFinalSnapshot as Wn, createSecretMasker as Wo, classifyReplaySecretRegion as Wr, stringifyValue as Ws, isJournaledOrphan as Wt, S3_AUTO_DELETE_OBJECTS_TAG as X, renderStatefulReason as Xa, expectedOwnerParam as Xc, malformedOutputsRefusalMessage as Xi, RollbackInlinePolicyWriters as Xn, scrubResourceRecord as Xo, explicitRoleArnOrThrow as Xr, AssetModeResolver as Xs, replacementNeverSwapped as Xt, ECR_AUTO_DELETE_IMAGES_TAG as Y, isStatefulRecreateTargetSync as Ya, decodeListingKey as Yc, malformedOrphansWarning as Yi, formatDestructiveChange as Yn, redactSecretsForState as Yo, assertSendableRoleArn as Yr, rewriteTemplateAssetReferences as Ys, recordUnderIdIsNotOwn as Yt, hasCdkAutoDeleteTag as Z, WARM_THROUGHPUT_MEMBERS as Za, PARTITION_TABLE as Zc, malformedOutputsWarning as Zi, earliestDefined as Zn, DYNAMIC_REFERENCE_TOKEN_SCAN as Zo, isIamRoleArn as Zr, BOOTSTRAP_MARKER_PREFIX as Zs, resolveReplacementOldType as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedResourceEntriesForDestroy as _a, isMalformedEnvKey as _c, keepsSecretReferenceToken as _i, carriedExportAliasExposure as _n, lambdaFunctionNameForMask as _o, readsNoEchoDeleteValues as _r, WHOLE_DYNAMIC_REFERENCE_PATTERN as _s, displacedPhysicalIdShown as _t, findNestedTemplateTreeDefect as a, refuseDivergentRecordRegionForDestroy as aa, validateContainerRepoName as ac, s3BucketDomainName as ai, hasPlainPrototype$1 as al, redactedDeleteAddressFields as an, configIntegerRefusal as ao, readTagList as ar, carriesSecretMask as as, gray as at, lookupEachName as b, refuseMalformedResourceEntriesForOrphan as ba, redactedDockerCause as bc, isStalePlaceholderArnAttribute as bi, isWholeDynamicReferenceValue as bn, TemplateParser as bo, withPrintingSecrets as br, isLockInfoExpired as bs, nestedChildStackName as bt, renderNestedTemplateTreeDefect as c, refuseMalformedOrphanRecordsForDestroy as ca, resolveDockerContextDirectory as cc, s3BucketWebsiteUrl as ci, absoluteAssemblyPathEscape as cl, updatePartialReason as cn, replayWarn as co, tagPlanWarning as cr, recordMaskOnlyValuesIn as cs, yellow as ct, conditionInputsFrom as d, refuseMalformedOrphansForOrphan as da, describeDockerFailure as dc, parameterTypeMayLoseSecretIdentity as di, renderAssemblyPathEscape as dl, WITHHELD_NAME_DISPLAY as dn, requireConfigString as do, CC_BROKEN_REASON as dr, recordProvenPublicExpression as ds, reachableDivergentParameters as dt, malformedResourcePropertiesWarning as ea, getBootstrapMarkerKey as ec, applyCallerIdentityCredentials as ei, AssemblyReader as el, findNestedStackTypeChanges as en, toCfnInteger as eo, withCreateTokenLedger as er, pathCrossesDottedKey as es, markRefusedBeforeApplying as et, parentSuppliedValues as f, refuseMalformedOutputs as fa, dockerSpawnEnvWithSensitive as fc, getAccountInfo as fi, resolveAssemblyPath as fl, displayTextOrWithheld as fn, prefetchCreateOnlyPropertyPaths as fo, ProviderRegistry as fr, wholeStringLeavesOf as fs, resourcesNamingDeclaredParameter as ft, mergeNoChangeOutputs as g, refuseMalformedResourceEntriesForDeploy as ga, isDockerClientEnvKey as gc, isNamelessDynamicReferenceError as gi, secretSafeKeyDisplay as gn, canonicalLambdaFunctionName as go, TemplateNoEchoReresolver as gr, TEMPLATE_SOURCED_RULES as gs, displacedOpClause as gt, keptWholeReasonText as h, refuseMalformedResourceEntries as ha, getDockerCmd as hc, carriesFetchableDynamicReference as hi, secretBearingStateKeyWarning as hn, withRetry as ho, wouldReturnToSdkProvider as hr, STATE_SOURCED_READBACK_RULES as hs, NESTED_PENDING_PARENT_REASON as ht, childTemplateLoader as i, previewableOrphanRecords as ia, validateAssetBucketName as ic, s3BucketArn as ii, hasOwnKey as il, isRedactedRecordedValue as in, configBooleanRefusal as io, planTagDiff as ir, recoverMaskedOutput as is, cyan as it, noEchoParameterNamesOf as j, repairMalformedOutputsForReadOnly as ja, getLegacyStateBucketName as jc, accountArgs as ji, orphanRecordsPrintingBag as jn, readbackPathFor as jo, withIndeterminateGuard as jr, describeRegionValueKind as js, journaledOrphanLines as jt, noEchoComparisonForTemplate as k, repairMalformedOrphanRecordsForReadOnly as ka, synthesisStatusMessage as kc, UNREADABLE_ORPHANS_CONTAINER_ROW as ki, journaledOrphanPrintingBag as kn, noEchoOutputsComparison as ko, deleteLeftInPlace as kr, splitImportedOps as ks, dropFailedHint as kt, templateIdentity as l, refuseMalformedOrphans as la, describeDockerCapturedOutput as lc, coerceParameterTypedValue as li, describeFileReadFailure as ll, DeploymentEventsReader as ln, requireConfigArray as lo, definedAttributes as lr, recordNoEchoAttributeValues as ls, computeParameterTaint as lt, isSecretBearingReferenceString as m, refuseMalformedResourceAttributesForOrphan as ma, formatDockerLoginError as mc, carriesDynamicReference as mi, resolveBucketRegion as ml, secretBearing as mn, describeTypeWithThrottleRetry as mo, isCustomResource as mr, STATE_SOURCED_CROSS_GENERATION_RULES as ms, planOrphanAdoption as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedScrubResourceEntriesRefusalMessage as na, parseBootstrapMarker as nc, envCredentialsAreAssumedRole as ni, processStackMessages as nl, inheritProducerRegions as nn, coerceCfnBoolean as no, DBPROXY_TAGS_WHAT as nr, inheritNestedStackParameterAssociations as ns, createReadOnlyAttributeHealerFactory as nt, isAbsoluteAssetPath as o, refuseMalformedNestedChildOutputs as oa, buildDenyExternalAccessPolicy as oc, s3BucketDualStackDomainName as oi, nullPrototypeRecord as ol, redactedDeleteAddressSkip as on, configStringRefusal as oo, refuseMalformedDesiredTags as or, provenPublicValue as os, green as ot, readRecordedConditionVerdicts as p, refuseMalformedOutputsForDestroy as pa, finchSecretArgvRefusal as pc, isImpossibleEmptyStoredAttribute as pi, clearBucketRegionCache as pl, exportAliasCollisionScrubWarning as pn, templateResourceTypes as po, ccBrokenReason as pr, STATE_SOURCED_BASELINE_RULES as ps, makeSiblingClaimReader as pt, deleteTableWithIndexBusyRetry as q, MULTI_REGION_RECREATE_BLOCKED_TYPES as qa, uploadCfnTemplate as qc, malformedOrphanRowsKeptWarning as qi, constructPathOf as qn, maskSecretsInText as qo, applyRoleArnIfSet as qr, createAssetRedirectResolver as qs, planRollback as qt, computeImplicitDeleteEdges as r, malformedStateRefusalMessage as ra, readBootstrapMarkerBody as rc, isSettledInstanceState as ri, defineOwnKey as rl, REDACTED_DELETE_ADDRESS_SKIP_REASON as rn, coerceCfnInteger as ro, DBPROXY_TAG_OPTIONS as rr, recordNestedStackParameterExpressions as rs, bold as rt, listNestedTemplateRows as s, refuseMalformedOrphanRecords as sa, buildDockerImage as sc, s3BucketRegionalDomainName as si, ownValue as sl, updatePartialMessage as sn, readConfigString as so, tagMapAsList as sr, recordMaskOnlyValue as ss, red as st, DeployEngine as t, malformedResourcesWarning as ta, isCrossRegionRedirect as tc, callerEnvCredentials as ti, StageLoadError as tl, getCurrentProducerRegions as tn, toFiniteNumber as to, acquireIdempotencyToken as tr, identityKeyFor as ts, formatResourceLine as tt, conditionFingerprint as u, refuseMalformedOrphansForDestroy as ua, describeDockerExecFailure as uc, isUnboundTemplateParameter as ui, displayAssemblyPath as ul, DeploymentEventsStore as un, requireConfigObject as uo, stringifyIfAssigned as ur, recordNoEchoParameterFreshValue as us, namesAnyDeclaredParameter as ut, chunks as v, refuseMalformedResourceEntriesForImport as va, partitionSensitiveEnv as vc, AWS_NO_VALUE as vi, exportNameNoEchoParameters as vn, sameLambdaFunctionAddress as vo, isCustomResourceType as vr, isSingleDynamicReferenceToken as vs, dropSettledNestedJournals as vt, deferredServiceTokenWarning as w, refuseMalformedResourcePropertiesForOrphan as wa, escapeRegExp$3 as wc, parameterInputsFor as wi, isExportAliasCollision as wn, maskReadbackAtCoordinates as wo, CloudControlProvider as wr, CrossPrefixScanCache as ws, withNestedRevertRun as wt, withApiLimit as x, refuseMalformedResourcePropertiesForDestroy as xa, runDockerForeground as xc, refStateLookupFromResource as xi, noEchoParameterValueSeed as xn, canonicalCoordinates as xo, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as xr, S3StateBackend as xs, recordDisplacedSkips as xt, isAccessDeniedError as y, refuseMalformedResourceEntriesForImportSave as ya, redactDockerArgvValues as yc, cfnRefValueFromPhysicalId as yi, exportNameSecretExposure as yn, DagBuilder as yo, getCurrentResourceSecrets as yr, LockManager as ys, getNestedRevertRun as yt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as z, findActionableSilentDrops as za, resolveUseCdkBootstrapAssets as zc, malformedDriftResourcePropertiesWarning as zi, buildFinalSnapshotIdentifier as zn, logOnlyValueCount as zo, reEnableInstanceApiTermination as zr, orphansAfterRollback as zs, getStackRecords as zt };
-//# sourceMappingURL=deploy-engine-dvf1UDuo.js.map
+export { isTruthyCfnBoolean as $, isStatefulRecreateTargetForReplace as $a, CFN_TEMPLATE_BODY_LIMIT as $c, malformedOrphansRefusalMessage as $i, ledgerForStack as $n, markSameGenerationBag as $o, sendableAssumeRoleCommand as $r, isSensitiveAttributeName as $s, seedsDeleteFirstGuard as $t, noEchoComparisonForTemplate as A, refuseMalformedResourcesForDeploy as Aa, redactedDockerCause as Ac, declaresNoEcho as Ai, journaledOrphanPrintingBag as An, maskWholeValue as Ao, deleteIndeterminateGuards as Ar, isLockInfoExpired as As, dropFailedHint as At, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as B, unpreviewableOrphanRecords as Ba, getDefaultStateBucketName as Bc, hasReadableOutputs as Bi, PRE_DELETE_SNAPSHOT_TYPES as Bn, carryLogOnlyValues as Bo, reDisableInstanceApiTermination as Br, acceptedCreateOnlyDropsOf as Bs, getStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedResourceEntriesForImport as Ca, finchSecretArgvRefusal as Cc, cfnRefValueFromPhysicalId as Ci, clearBucketRegionCache as Cl, collectDeclaredOutputNames as Cn, sameLambdaFunctionAddress as Co, applyCustomResourceResponseExpiration as Cr, STATE_SOURCED_BASELINE_RULES as Cs, revertNestedChildFromJournal as Ct, withResourceDeadline as D, refuseMalformedResourcePropertiesForDrift as Da, isMalformedEnvKey as Dc, withSharedDrainBudget as Di, DEFAULT_RESOURCE_TIMEOUT_MS as Dn, isMarkedCoordinate as Do, unchangedBehindSecretReference as Dr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ds, getCurrentNestedStackContext as Dt, serviceTokenBlockingReason as E, refuseMalformedResourcePropertiesForDestroy as Ea, isDockerClientEnvKey as Ec, parseWebACLArn as Ei, bindingSkippedOutputs as En, canonicalCoordinates as Eo, slowCcOperationTimeoutMs as Er, TEMPLATE_SOURCED_RULES as Es, collectNestedChildUnaddressed as Et, PROTECTION_PROPERTY_BY_TYPE as F, repairMalformedOrphansForReadOnly as Fa, stripControlChars as Fc, UNREADABLE_RESOURCES_MAP_ROW as Fi, secretNamedRecordNeedles as Fn, passedNoEchoParametersOf as Fo, markWaitAbandoned as Fr, applyCrossPrefixScan as Fs, sameJournaledOrphans as Ft, resolveDynamoDbDeleteBudgetMs as G, findSilentDropProperties as Ga, resolveCaptureObservedState as Gc, malformedExportNamesWarning as Gi, isFinalSnapshotError as Gn, printingCorpusOf as Go, poisonRenderedSpellingsCollidingIn as Gr, hasUnverifiableParameterRefusal as Gs, isJournaledOrphan as Gt, compensateRemovedDeletionProtection as H, unreadableResourceEntries as Ha, loadCdkJson as Hc, isReadableOrphanRecord as Hi, ccRoutedFinalSnapshotError as Hn, hasMaskableValues as Ho, DiffCalculator as Hr, exportNamesCarriedFrom as Hs, removeProtectionTypeList as Ht, isProtectionValueActive as I, repairMalformedOutputsForReadOnly as Ia, AssetManifestLoader as Ic, accountArgs as Ii, stateSecretNameNeedles as In, readbackPathFor as Io, disableInstanceApiTermination as Ir, crossPrefixDeniedWarning as Is, replayFailedOperations as It, deleteTableWithIndexBusyRetry as J, NO_CC_HANDLERS_REASON as Ja, resolveStateBucketWithDefaultAndSource as Jc, malformedLocalResourceEntriesWarning as Ji, maskingRetryLogger as Jn, shareLogOnlyValues as Jo, applyRoleArnIfSet as Jr, isReadableBag as Js, planRollback as Jt, DELETE_INDEX_WAIT_PROCEED_NOTE as K, unwrittenCreateOnlyReplacement as Ka, resolveSkipPrefix as Kc, malformedExportSourceWarning as Ki, refusesFinalSnapshot as Kn, recordLogOnlyParameterValue as Ko, producerLookupOver as Kr, importableOutputKeys as Ks, isReplacementOrphan as Kt, perType as L, repairMalformedResourceEntriesForReadOnly as La, getDockerImageBySourceHash as Lc, deployRefusesOrphanRowsReason as Li, storedSecretNameNeedles as Ln, readsNoEchoSource as Lo, ec2InstanceProtectionSite as Lr, isAccessDenied$1 as Ls, replayRollback as Lt, noEchoParameterNamesOf as M, refuseMalformedResourcesForExport as Ma, runDockerStreaming as Mc, STATE_REGION_DIVERGED as Mi, orphanRecordsPrintingBag as Mn, noEchoCoordinatesOf as Mo, deleteSkipReason as Mr, rebuildClientForBucketRegion as Ms, journaledOrphanLines as Mt, recordedProtectionEvidence as N, refuseMalformedState as Na, warnFinchArgvExposure as Nc, STATE_RESOURCES_MALFORMED as Ni, secretNamePrintingBag as Nn, noEchoLeavesOf as No, withIndeterminateGuard as Nr, CrossPrefixReadError as Ns, loadJournaledOrphans as Nt, diffSecurity as O, refuseMalformedResourcePropertiesForExport as Oa, partitionSensitiveEnv as Oc, parameterInputsFor as Oi, DEFAULT_RESOURCE_WARN_AFTER_MS as On, maskAtCoordinates as Oo, RollbackInlinePolicyWriters as Or, isSingleDynamicReferenceToken as Os, withNestedStackContext as Ot, recordedProtectionNote as P, repairMalformedOrphanRecordsForReadOnly as Pa, escapeRegExp$3 as Pc, UNREADABLE_ORPHANS_CONTAINER_ROW as Pi, secretNamePrintingBags as Pn, noEchoOutputsComparison as Po, isWaitAbandonedError as Pr, CrossPrefixScanCache as Ps, makeForeignHolderScan as Pt, hasCdkAutoDeleteTag as Q, MULTI_REGION_RECREATE_BLOCKED_TYPES as Qa, ssmResolvedValueType as Qc, malformedOrphanRowsKeptWarning as Qi, earliestDefined as Qn, maskSecretsInText as Qo, isIamRoleArn as Qr, AssetPublisher as Qs, resolveReplacementOldType as Qt, readProtection as R, repairMalformedResourcePropertiesForReadOnly as Ra, Synthesizer as Rc, displayLogicalId as Ri, extractDeploymentEventError as Rn, valueAtCoordinate as Ro, isTerminationProtectionPropagationError as Rr, isNotImplemented as Rs, awaitInFlightSibling as Rt, keptForReadoption as S, refuseMalformedResourceEntriesForDestroy as Sa, dockerSpawnEnvWithSensitive as Sc, AWS_NO_VALUE as Si, resolveAssemblyPath as Sl, noEchoParameterValueSeed as Sn, lambdaFunctionNameForMask as So, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Sr, wholeStringLeavesOf as Ss, recordDisplacedSkips as St, findServiceTokenRefusals as T, refuseMalformedResourceEntriesForOrphan as Ta, getDockerCmd as Tc, refStateLookupFromResource as Ti, isExportAliasCollision as Tn, TemplateParser as To, CloudControlProvider as Tr, STATE_SOURCED_READBACK_RULES as Ts, withNestedRevertRun as Tt, deleteBudgetKey as U, withheldAccountClause as Ua, resolveApp as Uc, isReadableResourceEntry as Ui, createPreDeleteFinalSnapshot as Un, literalSplitDelimitersOf as Uo, INTRINSIC_KEYS as Ur, hasReadableExportSet as Us, recordAfterRollbackUpdate as Ut, beginDeleteWait as V, unreadableOrphanRecords as Va, getLegacyStateBucketName as Vc, hasReadableResources as Vi, buildFinalSnapshotIdentifier as Vn, createUnionSecretMasker as Vo, reEnableInstanceApiTermination as Vr, describeRegionValueKind as Vs, withStackRecords as Vt, resolveDynamoDbDeleteBudgetClock as W, findActionableSilentDrops as Wa, resolveAutoAssetStorage as Wc, malformedDriftResourcePropertiesWarning as Wi, effectiveDeletionPolicy as Wn, logOnlyValueCount as Wo, IntrinsicFunctionResolver as Wr, hasReasonlessBaselineRefusal as Ws, demoteSupersededOrphans as Wt, ECR_AUTO_DELETE_IMAGES_TAG as X, findReplacedReadersOfRecreateTargets as Xa, stateBucketExistenceConfirmed as Xc, malformedOrphanRecordsRefusalMessage as Xi, findDestructiveChanges as Xn, errorCauseChain as Xo, assertSendableRoleArn as Xr, orphansCarriedFrom as Xs, recordUnderIdIsNotOwn as Xt, waitForIndexesSettled as Y, hasNoCloudControlHandlers as Ya, resolveUseCdkBootstrapAssets as Yc, malformedLocalResourcesWarning as Yi, constructPathOf as Yn, createSecretMasker as Yo, assertFlagRoleArn as Yr, orphansAfterRollback as Ys, recheckFailedPlan as Yt, S3_AUTO_DELETE_OBJECTS_TAG as Z, shownType as Za, warnDeprecatedNoPrefixCliFlag as Zc, malformedOrphanRecordsWarning as Zi, formatDestructiveChange as Zn, maskSecretsInError as Zo, explicitRoleArnOrThrow as Zr, shouldRetainResource as Zs, replacementNeverSwapped as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedOutputs as _a, buildDockerImage as _c, isImpossibleEmptyStoredAttribute as _i, ownValue as _l, secretSafeKeyDisplay as _n, prefetchCreateOnlyPropertyPaths as _o, TemplateNoEchoReresolver as _r, recordMaskOnlyValue as _s, displacedOpClause as _t, findNestedTemplateTreeDefect as a, malformedResourcePropertiesWarning as aa, rewriteTemplateAssetReferences as ac, s3BucketArn as ai, decodeListingKey as al, isRedactedRecordedValue as an, toCfnInteger as ao, planTagDiff as ar, dynamicReferenceTokens as as, cyan as at, lookupEachName as b, refuseMalformedResourceEntries as ba, describeDockerExecFailure as bc, isNamelessDynamicReferenceError as bi, displayAssemblyPath as bl, exportNameSecretExposure as bn, withRetry as bo, getCurrentResourceSecrets as br, recordNoEchoParameterFreshValue as bs, getNestedRevertRun as bt, renderNestedTemplateTreeDefect as c, malformedStateRefusalMessage as ca, assertAssetBucketRegion as cc, s3BucketRegionalDomainName as ci, canonicalizeRegion as cl, updatePartialMessage as cn, coerceCfnInteger as co, tagMapAsList as cr, identityKeyFor as cs, red as ct, conditionInputsFrom as d, refuseMalformedNestedChildOutputs as da, isCrossRegionRedirect as dc, producerRegionsFromState as di, StageLoadError as dl, DeploymentEventsStore as dn, configStringRefusal as do, stringifyIfAssigned as dr, recoverMaskedOutput as ds, namesAnyDeclaredParameter as dt, malformedOrphansWarning as ea, stringifyValue as ec, AWS_CREDENTIAL_ENV_KEYS as ei, CFN_TEMPLATE_URL_LIMIT as el, orphanDeleteNeedsIdentity as en, isStatefulRecreateTargetSync as eo, reserveStackCreateToken as er, redactSecretsForState as es, getPriorAttempts as et, parentSuppliedValues as f, refuseMalformedOrphanRecords as fa, parseBootstrapMarker as fc, regionLessSecretName as fi, processStackMessages as fl, WITHHELD_NAME_DISPLAY as fn, readConfigString as fo, CC_BROKEN_REASON as fr, physicalNameCopiesOf as fs, reachableDivergentParameters as ft, mergeNoChangeOutputs as g, refuseMalformedOrphansForOrphan as ga, buildDenyExternalAccessPolicy as gc, getAccountInfo as gi, nullPrototypeRecord as gl, secretBearingStateKeyWarning as gn, requireConfigString as go, wouldReturnToSdkProvider as gr, provenPublicValue as gs, NESTED_PENDING_PARENT_REASON as gt, keptWholeReasonText as h, refuseMalformedOrphansForDestroy as ha, validateContainerRepoName as hc, parameterTypeMayLoseSecretIdentity as hi, hasPlainPrototype$1 as hl, secretBearing as hn, requireConfigObject as ho, isCustomResource as hr, carriesSecretMask as hs, planOrphanAdoption as ht, childTemplateLoader as i, malformedResourceEntriesWarning as ia, loadPublishableAssetManifest as ic, isSettledInstanceState as ii, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as il, REDACTED_DELETE_ADDRESS_SKIP_REASON as in, isWarmThroughputDecrease as io, DBPROXY_TAG_OPTIONS as ir, DYNAMIC_REFERENCE_TOKEN_SCAN as is, bold as it, noEchoExactEchoLeavesOf as j, refuseMalformedResourcesForDestroy as ja, runDockerForeground as jc, JSON_LISTING_HOLE_VALUE as ji, maskEventTextWithBoundBags as jn, maskedLeafCoordinatesOf as jo, deleteLeftInPlace as jr, S3StateBackend as js, isHandledOrphan as jt, noEchoAttributeNamesOf as k, refuseMalformedResourcePropertiesForOrphan as ka, redactDockerArgvValues as kc, passedParameterClassesOf as ki, completedReplayEntries as kn, maskReadbackAtCoordinates as ko, UNSPECIFIED_SKIP_REASON as kr, LockManager as ks, deleteJournaledOrphans as kt, templateIdentity as l, previewableOrphanRecords as la, ensureAssetStorage as lc, s3BucketWebsiteUrl as li, derivePartitionAndUrlSuffix as ll, updatePartialReason as ln, configBooleanRefusal as lo, tagPlanWarning as lr, inheritNestedStackParameterAssociations as ls, yellow as lt, isSecretBearingReferenceString as m, refuseMalformedOrphans as ma, validateAssetBucketName as mc, isUnboundTemplateParameter as mi, hasOwnKey as ml, exportAliasCollisionScrubWarning as mn, requireConfigArray as mo, ccBrokenReason as mr, splitGetAttStringForm as ms, makeSiblingClaimReader as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedOutputsWarning as na, buildAssetRedirectMap as nc, callerEnvCredentials as ni, findLargeInlineResources as nl, getCurrentProducerRegions as nn, WARM_THROUGHPUT_MEMBERS as no, acquireIdempotencyToken as nr, withPhysicalNameCopies as ns, formatResourceLine as nt, isAbsoluteAssetPath as o, malformedResourcesWarning as oa, AssetModeResolver as oc, s3BucketDomainName as oi, expectedOwnerParam as ol, redactedDeleteAddressFields as on, toFiniteNumber as oo, readTagList as or, isUncertifiedBaselineMaskPosition as os, gray as ot, readRecordedConditionVerdicts as p, refuseMalformedOrphanRecordsForDestroy as pa, readBootstrapMarkerBody as pc, coerceParameterTypedValue as pi, defineOwnKey as pl, displayTextOrWithheld as pn, replayWarn as po, ProviderRegistry as pr, recordPhysicalNameCopy as ps, resourcesNamingDeclaredParameter as pt, INDEX_SETTLE_POLL_INTERVAL_MS as q, withoutSilentDropProperties as qa, resolveStateBucketWithDefault as qc, malformedLocalOutputsWarning as qi, unsupportedFinalSnapshotError as qn, recordLogOnlyValue as qo, refuseUnreadableCdkCrossAccountRefs as qr, importableOutputs as qs, planFailedOps as qt, computeImplicitDeleteEdges as r, malformedRenderedContainersWarning as ra, createAssetRedirectResolver as rc, envCredentialsAreAssumedRole as ri, uploadCfnTemplate as rl, inheritProducerRegions as rn, coerceWarmThroughput as ro, DBPROXY_TAGS_WHAT as rr, withoutPhysicalNameCopies as rs, createReadOnlyAttributeHealerFactory as rt, listNestedTemplateRows as s, malformedScrubResourceEntriesRefusalMessage as sa, BOOTSTRAP_MARKER_PREFIX as sc, s3BucketDualStackDomainName as si, PARTITION_TABLE as sl, redactedDeleteAddressSkip as sn, coerceCfnBoolean as so, refuseMalformedDesiredTags as sr, pathCrossesDottedKey as ss, green as st, DeployEngine as t, malformedOutputsRefusalMessage as ta, WorkGraph as tc, applyCallerIdentityCredentials as ti, MIGRATE_TMP_PREFIX as tl, findNestedStackTypeChanges as tn, renderStatefulReason as to, withCreateTokenLedger as tr, scrubResourceRecord as ts, markRefusedBeforeApplying as tt, conditionFingerprint as u, refuseDivergentRecordRegionForDestroy as ua, getBootstrapMarkerKey as uc, classifyReplaySecretRegion as ui, AssemblyReader as ul, DeploymentEventsReader as un, configIntegerRefusal as uo, definedAttributes as ur, recordNestedStackParameterExpressions as us, computeParameterTaint as ut, chunks as v, refuseMalformedOutputsForDestroy as va, resolveDockerContextDirectory as vc, carriesDynamicReference as vi, absoluteAssemblyPathEscape as vl, carriedExportAliasExposure as vn, templateResourceTypes as vo, readsNoEchoDeleteValues as vr, recordMaskOnlyValuesIn as vs, displacedPhysicalIdShown as vt, deferredServiceTokenWarning as w, refuseMalformedResourceEntriesForImportSave as wa, formatDockerLoginError as wc, isStalePlaceholderArnAttribute as wi, resolveBucketRegion as wl, collectPublishedOutputNames as wn, DagBuilder as wo, customResourceResponseExpirationWarning as wr, STATE_SOURCED_CROSS_GENERATION_RULES as ws, revertedNestedRowIds as wt, withApiLimit as x, refuseMalformedResourceEntriesForDeploy as xa, describeDockerFailure as xc, keepsSecretReferenceToken as xi, renderAssemblyPathEscape as xl, isWholeDynamicReferenceValue as xn, canonicalLambdaFunctionName as xo, withPrintingSecrets as xr, recordProvenPublicExpression as xs, nestedChildStackName as xt, isAccessDeniedError as y, refuseMalformedResourceAttributesForOrphan as ya, describeDockerCapturedOutput as yc, carriesFetchableDynamicReference as yi, describeFileReadFailure as yl, exportNameNoEchoParameters as yn, describeTypeWithThrottleRetry as yo, isCustomResourceType as yr, recordNoEchoAttributeValues as ys, dropSettledNestedJournals as yt, DynamoDBGlobalTableProvider as z, repairMalformedResourcesForReadOnly as za, synthesisStatusMessage as zc, hasReadableOrphans as zi, ATOMIC_FINAL_SNAPSHOT_TYPES as zn, liveMatchesUnresolvedTokenFrame as zo, observeThenDisableInstanceApiTermination as zr, splitImportedOps as zs, destroyStackRecordsView as zt };
+//# sourceMappingURL=deploy-engine-A-Ys_mhE.js.map