@go-to-k/cdkd 0.298.0 → 0.298.2

package/dist/{deploy-engine-CJTG3tft.js → deploy-engine-BgWY0v3K.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js"
 import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, H as truncateCodePoints, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as terminalSafe, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
 import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-CwKiK9nS.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-D96I6uiO.js";
+import { t as getCdkdVersion } from "./version-CUIlKSi1.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -5442,6 +5442,7 @@ function legacyProbeBelongsTo(probe, region) {
 	}
 }
 const KEPT_AT_CLOCK_TOLERANCE_MS = 2e3;
+const ROLLBACK_JOURNAL_OBJECT_DESCRIPTION = "the rollback journal, whose `failedOperations[].attemptedProperties` records the properties of the failed write verbatim";
 var S3StateBackend = class S3StateBackend {
 	logger = getLogger().child("S3StateBackend");
 	s3Client;
@@ -5450,6 +5451,8 @@ var S3StateBackend = class S3StateBackend {
 	clientResolved = false;
 	scanClient;
 	resolveInFlight = null;
+	journalsReadAbsent = /* @__PURE__ */ new Set();
+	journalTouches = /* @__PURE__ */ new Map();
 	constructor(s3Client, config, clientOpts = {}) {
 		this.s3Client = s3Client;
 		this.config = config;
@@ -5481,8 +5484,32 @@ var S3StateBackend = class S3StateBackend {
 		return `${this.config.prefix}/${stackName}/state.json`;
 	}
 	getRollbackJournalKey(stackName, region) {
+		const key = this.rollbackJournalKey(stackName, region);
+		this.journalsReadAbsent.delete(key);
+		this.journalTouches.set(key, (this.journalTouches.get(key) ?? 0) + 1);
+		return key;
+	}
+	rollbackJournalKey(stackName, region) {
 		return `${this.config.prefix}/${stackName}/${region}/rollback-journal.json`;
 	}
+	rollbackJournalReadAbsent(stackName, region) {
+		return this.journalsReadAbsent.has(this.rollbackJournalKey(stackName, region));
+	}
+	async warmConnections(stackName, region, count) {
+		try {
+			await this.ensureClientForBucket();
+			const owner = await this.ownerParam();
+			const key = this.getStateKey(stackName, region);
+			await Promise.allSettled(Array.from({ length: count }, () => this.s3Client.send(new HeadObjectCommand({
+				Bucket: this.config.bucket,
+				...owner,
+				Key: key
+			}))));
+		} catch {}
+	}
+	async purgeRollbackJournalVersions(stackName, region) {
+		await this.purgeNoncurrentVersions([this.rollbackJournalKey(stackName, region)], { objectDescription: ROLLBACK_JOURNAL_OBJECT_DESCRIPTION });
+	}
 	getCreateTokenLedgerKey(stackName, region) {
 		return `${this.config.prefix}/${stackName}/${region}/create-tokens.json`;
 	}
@@ -6157,8 +6184,14 @@ var S3StateBackend = class S3StateBackend {
 		}
 	}
 	async loadRollbackJournal(stackName, region) {
-		const body = await this.getRawObject(this.getRollbackJournalKey(stackName, region));
-		if (body === null) return null;
+		const key = this.rollbackJournalKey(stackName, region);
+		const touches = this.journalTouches.get(key) ?? 0;
+		this.journalsReadAbsent.delete(key);
+		const body = await this.getRawObject(key);
+		if (body === null) {
+			if ((this.journalTouches.get(key) ?? 0) === touches) this.journalsReadAbsent.add(key);
+			return null;
+		}
 		return parseRollbackJournal(body, stackName);
 	}
 	async appendRollbackJournalSegment(stackName, region, segment) {
@@ -6302,7 +6335,7 @@ var S3StateBackend = class S3StateBackend {
 				this.logger.warn(`Failed to delete rollback journal for ${this.stackRef(stackName, region)}: ${errorDetail$2(error)}`);
 			}
 		}
-		await this.purgeNoncurrentVersions([key], { objectDescription: "the rollback journal, whose `failedOperations[].attemptedProperties` records the properties of the failed write verbatim" });
+		await this.purgeNoncurrentVersions([key], { objectDescription: ROLLBACK_JOURNAL_OBJECT_DESCRIPTION });
 		return gone;
 	}
 	async headObject(key) {
@@ -6543,6 +6576,8 @@ var LockManager = class {
 	abandonedLocks = /* @__PURE__ */ new Map();
 	clientResolved = false;
 	resolveInFlight = null;
+	deferReleasePurge;
+	deferredPurges = /* @__PURE__ */ new Set();
 	constructor(s3Client, config, options) {
 		this.s3Client = s3Client;
 		this.config = config;
@@ -6551,6 +6586,10 @@ var LockManager = class {
 		this.ttlMs = ttlMinutes * 60 * 1e3;
 		this.renewalDisabled = options?.disableRenewal === true;
 		this.renewalIntervalMs = renewalIntervalFor(this.ttlMs);
+		this.deferReleasePurge = options?.deferReleasePurge === true;
+	}
+	async settleDeferredPurges() {
+		await Promise.all(this.deferredPurges);
 	}
 	async ownerParam() {
 		return expectedOwnerParam(this.s3Client);
@@ -6779,7 +6818,11 @@ var LockManager = class {
 			}
 			throw new LockError(`Failed to release lock for stack ${stackRef(stackName, region)}: ${errorDetail$1(error)}`, error instanceof Error ? error : void 0);
 		} finally {
-			await this.purgeLockVersions(this.getLockKey(stackName, region), "release");
+			const purge = this.purgeLockVersions(this.getLockKey(stackName, region), "release");
+			if (this.deferReleasePurge) {
+				this.deferredPurges.add(purge);
+				purge.finally(() => this.deferredPurges.delete(purge));
+			} else await purge;
 		}
 	}
 	async stillOursByBody(held) {
@@ -7439,6 +7482,23 @@ function positionByCrossStackSource(bag, source, secrets) {
 	return certifiedExpressionForLeaf(secrets, association, bag);
 }
 
+//#endregion
+//#region src/deployment/secret-redaction/physical-name-copies.ts
+const physicalNameCopiesOf = /* @__PURE__ */ new WeakMap();
+function recordPhysicalNameCopy(secrets, physicalId) {
+	if (physicalId === "") return;
+	sideSetOf(physicalNameCopiesOf, secrets).add(physicalId);
+}
+function physicalNameSpans(names, value) {
+	const spans = [];
+	if (names === void 0) return spans;
+	for (const name of names) for (let at = value.indexOf(name); at !== -1; at = value.indexOf(name, at + 1)) spans.push({
+		start: at,
+		end: at + name.length
+	});
+	return spans;
+}
+
 //#endregion
 //#region src/deployment/secret-redaction/fresh-noecho.ts
 function embedsFreshNoEchoValue(text, secrets, freshClass) {
@@ -7507,9 +7567,14 @@ function isStrictlyInsideASpan(spans, start, end) {
 }
 function embedsNeedleOutsideReferences(leaf, needles, secrets) {
 	let spans;
+	let names;
 	for (const needle of needles) for (let at = leaf.indexOf(needle); at >= 0; at = leaf.indexOf(needle, at + 1)) {
 		spans ??= isDynamicReferenceString(leaf) ? resolvableReferenceSpans(leaf, new Set(secrets.values())) : [];
-		if (!isStrictlyInsideASpan(spans, at, at + needle.length)) return true;
+		if (isStrictlyInsideASpan(spans, at, at + needle.length)) continue;
+		names ??= physicalNameSpans(physicalNameCopiesOf.get(secrets), leaf);
+		const end = at + needle.length;
+		if (names.some((n) => n.start <= at && end <= n.end)) continue;
+		return true;
 	}
 	return false;
 }
@@ -8407,23 +8472,6 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 	};
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/physical-name-copies.ts
-const physicalNameCopiesOf = /* @__PURE__ */ new WeakMap();
-function recordPhysicalNameCopy(secrets, physicalId) {
-	if (physicalId === "") return;
-	sideSetOf(physicalNameCopiesOf, secrets).add(physicalId);
-}
-function physicalNameSpans(names, value) {
-	const spans = [];
-	if (names === void 0) return spans;
-	for (const name of names) for (let at = value.indexOf(name); at !== -1; at = value.indexOf(name, at + 1)) spans.push({
-		start: at,
-		end: at + name.length
-	});
-	return spans;
-}
-
 //#endregion
 //#region src/deployment/secret-redaction/redact-state.ts
 function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RULES) {
@@ -9738,7 +9786,7 @@ function noEchoParametersReadBy(node, sources) {
 }
 function noEchoComparison(options) {
 	const { sources, values, minNeedleLength, publicTokens } = options;
-	return ({ templateProperties, desired, current, record }) => {
+	return ({ templateProperties, desired, current }) => {
 		const coordinates = noEchoCoordinatesOf(templateProperties, desired, sources);
 		const needles = [];
 		for (const name of noEchoParametersReadBy(templateProperties, sources)) {
@@ -9774,10 +9822,6 @@ function noEchoComparison(options) {
 			};
 			masked = walk(masked);
 		}
-		if (noEchoLeavesOf(record) !== void 0) return {
-			desired: masked,
-			current
-		};
 		const witnessed = witnessNormalize(current, desired, masked);
 		const shown = maskAtCoordinatesWith(witnessed.current, witnessed.differing, PREVIOUS_NOECHO_VALUE);
 		return {
@@ -19154,6 +19198,80 @@ function quotedRender(rendered, quote, described = "(not shown: it is not a plai
 	return QUOTABLE_RENDER.test(rendered) ? `${quote}${rendered}${quote}` : described;
 }
 
+//#endregion
+//#region src/deployment/secret-region-classification.ts
+const REPLAY_SECRET_SERVICES = /* @__PURE__ */ new Set([
+	"secretsmanager",
+	"ssm",
+	"ssm-secure"
+]);
+function secretsManagerSecretId(inner) {
+	const afterService = inner.substring(15);
+	let stringIdx = afterService.indexOf(":SecretString:");
+	let binaryIdx = afterService.indexOf(":SecretBinary:");
+	if (stringIdx < 0 && afterService.endsWith(":SecretString")) stringIdx = afterService.length - 13;
+	if (binaryIdx < 0 && afterService.endsWith(":SecretBinary")) binaryIdx = afterService.length - 13;
+	const delimiterIdx = stringIdx >= 0 && binaryIdx >= 0 ? Math.min(stringIdx, binaryIdx) : stringIdx >= 0 ? stringIdx : binaryIdx;
+	return delimiterIdx >= 0 ? afterService.substring(0, delimiterIdx) : afterService;
+}
+function ssmParameterName(inner) {
+	const serviceEnd = inner.indexOf(":");
+	return serviceEnd < 0 ? "" : inner.substring(serviceEnd + 1);
+}
+function arnRegion(secretId) {
+	if (!secretId.startsWith("arn:")) return void 0;
+	const region = secretId.split(":")[3];
+	return region ? region : void 0;
+}
+function producerRegionsFromState(state) {
+	const seen = /* @__PURE__ */ new Set();
+	const regions = [];
+	for (const entry of [...state.imports ?? [], ...state.outputReads ?? []]) {
+		const canonical = canonicalizeRegion(entry.sourceRegion);
+		if (!canonical || seen.has(canonical)) continue;
+		seen.add(canonical);
+		regions.push(entry.sourceRegion);
+	}
+	return regions;
+}
+function secretReferenceName(expression) {
+	const inner = expression.startsWith("{{resolve:") ? expression.slice(10, -2) : void 0;
+	if (inner === void 0) return void 0;
+	const service = inner.split(":")[0];
+	if (service === void 0 || !REPLAY_SECRET_SERVICES.has(service)) return void 0;
+	const secretName = service === "secretsmanager" ? secretsManagerSecretId(inner) : ssmParameterName(inner);
+	return secretName ? secretName : void 0;
+}
+function regionLessSecretName(expression) {
+	const secretName = secretReferenceName(expression);
+	return secretName !== void 0 && arnRegion(secretName) === void 0 ? secretName : void 0;
+}
+function classifyReplaySecretRegion(expression, consumerRegion, importedProducerRegions) {
+	const secretName = secretReferenceName(expression);
+	if (!secretName) return { kind: "local" };
+	const named = arnRegion(secretName);
+	if (named !== void 0) return canonicalizeRegion(named) === canonicalizeRegion(consumerRegion) ? { kind: "local" } : {
+		kind: "named-region",
+		secretName,
+		region: named
+	};
+	const seen = /* @__PURE__ */ new Set();
+	const foreignProducerRegions = [];
+	for (const candidate of importedProducerRegions ?? []) {
+		const canonical = canonicalizeRegion(candidate);
+		if (!canonical || canonical === canonicalizeRegion(consumerRegion)) continue;
+		if (seen.has(canonical)) continue;
+		seen.add(canonical);
+		foreignProducerRegions.push(candidate);
+	}
+	if (foreignProducerRegions.length === 0) return { kind: "local" };
+	return {
+		kind: "ambiguous",
+		secretName,
+		foreignProducerRegions
+	};
+}
+
 //#endregion
 //#region src/utils/s3-endpoints.ts
 const S3_WEBSITE_ENDPOINT_LEGACY_DASH_REGIONS = /* @__PURE__ */ new Set([
@@ -19802,6 +19920,7 @@ function noteAttributeSecrecy(logicalId, attributeName, value, context) {
 	const served = override !== void 0 && Object.hasOwn(override, attributeName);
 	if (served) value = override[attributeName];
 	recordSecretNamedRead(logicalId, value, context);
+	recordProducerSecretPairs(logicalId, value, context);
 	const declared = context.noEchoAttributeResources?.get(logicalId);
 	if ((served || declared === true || declared !== void 0 && declared.has(attributeName)) && context.recordedSecretValues) recordFreshNoEchoValuesIn(value, context.recordedSecretValues, void 0, this.publicNoEchoTokens(context, logicalId));
 	if (context.redactedAttributeReads !== void 0 && carriesSecretMask(value)) {
@@ -19818,6 +19937,24 @@ function noteAttributeSecrecy(logicalId, attributeName, value, context) {
 	}
 	return value;
 }
+function recordProducerSecretPairs(logicalId, value, context) {
+	const bag = context.recordedSecretValues;
+	if (bag === void 0 || context.producerSecrets === void 0) return;
+	const producer = context.producerSecrets(logicalId);
+	if (producer === void 0 || producer === bag || producer.size === 0) return;
+	const preRun = context.producerPreRunPhysicalId?.(logicalId);
+	const record = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
+	if (typeof preRun !== "string" || record?.physicalId !== preRun) return;
+	const physicalId = preRun.toLowerCase();
+	const leaves = [...wholeStringLeavesOf(value)];
+	if (leaves.length === 0) return;
+	for (const [plaintext, expression] of producer) {
+		if (plaintext.length < 4 || bag.has(plaintext)) continue;
+		if (typeof expression !== "string" || !expression.startsWith("{{resolve:")) continue;
+		if (!physicalId.includes(plaintext.toLowerCase())) continue;
+		if (leaves.some((leaf) => leaf.includes(plaintext))) bag.set(plaintext, expression);
+	}
+}
 function recordSecretNamedRead(logicalId, value, context) {
 	const bag = context.secretNameSink ?? context.printingSecrets ?? context.recordedSecretValues;
 	if (bag === void 0 || context.secretNameNeedles === void 0) return;
@@ -19832,8 +19969,8 @@ function recordSecretNamedRead(logicalId, value, context) {
 async function reresolveRecordedReferences(value, logicalId, context, origin, sourceKey) {
 	if (!carriesDynamicReference(value) || carriesSecretMask(value)) return value;
 	if (context.recordedSecretValues === void 0) return value;
-	if (!referencesProvenLocal(value, logicalId, context)) {
-		this.logger.debug(safeMsg`Not re-resolving the reference(s) in ${this.displayMasked(origin, context)}: the template of ${this.displayMasked(logicalId, context)} does not spell them, so the region that resolved them is unknown`);
+	if (!referencesProvenLocal(value, logicalId, context) && !referencesRegionProven(value, context, this.resolverRegion)) {
+		this.logger.debug(safeMsg`Not re-resolving the reference(s) in ${this.displayMasked(origin, context)}: the template of ${this.displayMasked(logicalId, context)} does not spell them, and this stack may read a stack in another region, so the region that resolved them is unknown`);
 		return value;
 	}
 	if (!await this.referencesMatchPhysicalId(value, logicalId, context)) {
@@ -19853,6 +19990,11 @@ async function referencesMatchPhysicalId(value, logicalId, context) {
 	}
 	return true;
 }
+function referencesRegionProven(value, context, region) {
+	const evidence = context.secretRegionEvidence?.();
+	if (evidence?.complete !== true) return false;
+	return [...wholeStringLeavesOf(value)].every((leaf) => dynamicReferenceTokens(leaf).every((token) => classifyReplaySecretRegion(token, region, evidence.regions).kind !== "ambiguous"));
+}
 function readsAnotherStack(node) {
 	if (Object.hasOwn(node, "Fn::ImportValue") || Object.hasOwn(node, "Fn::GetStackOutput")) return true;
 	if (!Object.hasOwn(node, "Fn::GetAtt")) return false;
@@ -20087,6 +20229,13 @@ async function reresolveCrossStackValue(value, producerRegion, context, origin,
 			});
 		}
 	}
+	if (context.recordedSecretValues !== void 0 && producerOutput !== void 0 && producerOutput.crossAccount !== true && context.stateBackend !== void 0 && context.skipDynamicReferences !== true) {
+		const plain = [...wholeStringLeavesOf(value)].filter((leaf) => !leaf.includes("{{resolve:") && !carriesSecretMask(leaf));
+		if (plain.length > 0) {
+			const ids = await producerPhysicalIds(context.recordedImports ?? context.recordedSecretValues, context.stateBackend, producerOutput.stackName, producerOutput.region || this.resolverRegion, () => this.logger.debug(safeMsg`Could not read the state of producer ${this.displayMasked(producerOutput.stackName, context)} for its physical ids; no cross-stack copy of one is kept (go-to-k/cdkd#4819)`));
+			for (const leaf of plain) if (ids.has(leaf)) recordPhysicalNameCopy(context.recordedSecretValues, leaf);
+		}
+	}
 	if (!carriesDynamicReference(value)) return value;
 	const resolver = this.resolverForProducerRegion(producerRegion, context, producerRegionLogText);
 	const pinnedContext = producerRegion ? withoutProducerRegions(context) : context;
@@ -20205,6 +20354,33 @@ function recordImport(context, exportName, producerStack, producerRegion) {
 		sourceRegion: producerRegion
 	});
 }
+const producerPhysicalIdReads = /* @__PURE__ */ new WeakMap();
+function producerPhysicalIds(scope, stateBackend, stackName, region, onFailure) {
+	let reads = producerPhysicalIdReads.get(scope);
+	if (reads === void 0) {
+		reads = /* @__PURE__ */ new Map();
+		producerPhysicalIdReads.set(scope, reads);
+	}
+	const key = JSON.stringify([stackName, region]);
+	let read = reads.get(key);
+	if (read === void 0) {
+		read = (async () => {
+			const ids = /* @__PURE__ */ new Set();
+			try {
+				const data = await stateBackend.getState(stackName, region);
+				for (const record of Object.values(data?.state.resources ?? {})) {
+					const id = record?.physicalId;
+					if (typeof id === "string" && id !== "") ids.add(id);
+				}
+			} catch {
+				onFailure();
+			}
+			return ids;
+		})();
+		reads.set(key, read);
+	}
+	return read;
+}
 
 //#endregion
 //#region src/deployment/intrinsic-resolver/cfn-fallback.ts
@@ -20859,80 +21035,6 @@ async function getCrossAccountStackState(roleArn, stackName, region, context) {
 	}).getState(stackName, region);
 }
 
-//#endregion
-//#region src/deployment/secret-region-classification.ts
-const REPLAY_SECRET_SERVICES = /* @__PURE__ */ new Set([
-	"secretsmanager",
-	"ssm",
-	"ssm-secure"
-]);
-function secretsManagerSecretId(inner) {
-	const afterService = inner.substring(15);
-	let stringIdx = afterService.indexOf(":SecretString:");
-	let binaryIdx = afterService.indexOf(":SecretBinary:");
-	if (stringIdx < 0 && afterService.endsWith(":SecretString")) stringIdx = afterService.length - 13;
-	if (binaryIdx < 0 && afterService.endsWith(":SecretBinary")) binaryIdx = afterService.length - 13;
-	const delimiterIdx = stringIdx >= 0 && binaryIdx >= 0 ? Math.min(stringIdx, binaryIdx) : stringIdx >= 0 ? stringIdx : binaryIdx;
-	return delimiterIdx >= 0 ? afterService.substring(0, delimiterIdx) : afterService;
-}
-function ssmParameterName(inner) {
-	const serviceEnd = inner.indexOf(":");
-	return serviceEnd < 0 ? "" : inner.substring(serviceEnd + 1);
-}
-function arnRegion(secretId) {
-	if (!secretId.startsWith("arn:")) return void 0;
-	const region = secretId.split(":")[3];
-	return region ? region : void 0;
-}
-function producerRegionsFromState(state) {
-	const seen = /* @__PURE__ */ new Set();
-	const regions = [];
-	for (const entry of [...state.imports ?? [], ...state.outputReads ?? []]) {
-		const canonical = canonicalizeRegion(entry.sourceRegion);
-		if (!canonical || seen.has(canonical)) continue;
-		seen.add(canonical);
-		regions.push(entry.sourceRegion);
-	}
-	return regions;
-}
-function secretReferenceName(expression) {
-	const inner = expression.startsWith("{{resolve:") ? expression.slice(10, -2) : void 0;
-	if (inner === void 0) return void 0;
-	const service = inner.split(":")[0];
-	if (service === void 0 || !REPLAY_SECRET_SERVICES.has(service)) return void 0;
-	const secretName = service === "secretsmanager" ? secretsManagerSecretId(inner) : ssmParameterName(inner);
-	return secretName ? secretName : void 0;
-}
-function regionLessSecretName(expression) {
-	const secretName = secretReferenceName(expression);
-	return secretName !== void 0 && arnRegion(secretName) === void 0 ? secretName : void 0;
-}
-function classifyReplaySecretRegion(expression, consumerRegion, importedProducerRegions) {
-	const secretName = secretReferenceName(expression);
-	if (!secretName) return { kind: "local" };
-	const named = arnRegion(secretName);
-	if (named !== void 0) return canonicalizeRegion(named) === canonicalizeRegion(consumerRegion) ? { kind: "local" } : {
-		kind: "named-region",
-		secretName,
-		region: named
-	};
-	const seen = /* @__PURE__ */ new Set();
-	const foreignProducerRegions = [];
-	for (const candidate of importedProducerRegions ?? []) {
-		const canonical = canonicalizeRegion(candidate);
-		if (!canonical || canonical === canonicalizeRegion(consumerRegion)) continue;
-		if (seen.has(canonical)) continue;
-		seen.add(canonical);
-		foreignProducerRegions.push(candidate);
-	}
-	if (foreignProducerRegions.length === 0) return { kind: "local" };
-	return {
-		kind: "ambiguous",
-		secretName,
-		foreignProducerRegions
-	};
-}
-
 //#endregion
 //#region src/deployment/intrinsic-resolver/dynamic-refs.ts
 function secretVerdictScope(resolver) {
@@ -22188,6 +22290,7 @@ function recordInheritedParameterSecrets(parameterName, value, context) {
 	const inherited = context.inheritedSecrets;
 	const recorded = context.recordedSecretValues;
 	if (inherited && recorded) carryLogOnlyValuesCarriedBy(inherited, recorded, value);
+	if (recorded) carryPhysicalNameCopiesCarriedBy(context, recorded, value);
 	if (inherited && recorded) recordInheritedNoEchoListElements(this, inherited, recorded, value, context);
 	if (!inherited || inherited.size === 0 || !recorded) return;
 	for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) {
@@ -22196,6 +22299,12 @@ function recordInheritedParameterSecrets(parameterName, value, context) {
 		carryFreshNoEchoMark(inherited, recorded, plaintext);
 	}
 }
+function carryPhysicalNameCopiesCarriedBy(context, recorded, value) {
+	const names = context.inheritedPhysicalNameCopies ?? (context.inheritedSecrets && physicalNameCopiesOf.get(context.inheritedSecrets));
+	if (names === void 0 || names.size === 0) return;
+	const leaves = [...wholeStringLeavesOf(value)];
+	for (const name of names) if (leaves.some((leaf) => leaf.includes(name))) recordPhysicalNameCopy(recorded, name);
+}
 function carriedExpressionFor(inherited, parameterName, value, plaintext, survivor) {
 	const own = inheritedParameterExpression(inherited, parameterName, plaintext);
 	if (typeof own === "string") return own;
@@ -22787,8 +22896,7 @@ var DiffCalculator = class DiffCalculator {
 					resourceType: desiredResource.Type,
 					templateProperties: rawDesiredProps,
 					desired: desiredPropsForCompare,
-					current: currentPropsForCompare,
-					record: currentResource
+					current: currentPropsForCompare
 				});
 				const desiredCompared = noEchoCompared?.desired ?? desiredPropsForCompare;
 				const currentCompared = noEchoCompared?.current ?? currentPropsForCompare;
@@ -24194,6 +24302,10 @@ const WRITABLE_GETATT_ATTRIBUTES = {
 	"AWS::MediaConvert::JobTemplate": ["Name"],
 	"AWS::MediaConvert::Preset": ["Name"],
 	"AWS::MediaConvert::Queue": ["Name"],
+	"AWS::NetworkManager::ConnectAttachment": ["ProposedSegmentChange"],
+	"AWS::NetworkManager::SiteToSiteVpnAttachment": ["ProposedSegmentChange"],
+	"AWS::NetworkManager::TransitGatewayRouteTableAttachment": ["ProposedSegmentChange"],
+	"AWS::NetworkManager::VpcAttachment": ["ProposedSegmentChange"],
 	"AWS::OpsWorks::Instance": ["AvailabilityZone"],
 	"AWS::OpsWorks::UserProfile": ["SshUsername"],
 	"AWS::QuickSight::Analysis": ["Errors", "Sheets"],
@@ -24873,7 +24985,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-B1xRE8do.js");
+			const { ASGProvider } = await import("./asg-provider-Ds5ElkGf.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -24979,7 +25091,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-J40R0ysf.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CU_1O2FR.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-D4kq6O-L.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-BGAmbyRB.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -29651,6 +29763,15 @@ var CreateTokenLedger = class {
 			}
 		});
 	}
+	prefetch() {
+		return this.serialized(async () => {
+			try {
+				await this.current();
+			} catch {
+				this.stale = true;
+			}
+		});
+	}
 	forget(logicalIds) {
 		return this.serialized(async () => {
 			try {
@@ -29739,6 +29860,9 @@ function earliestDefined(...times) {
 	const defined = times.filter((t) => t !== void 0);
 	return defined.length === 0 ? void 0 : Math.min(...defined);
 }
+async function prefetchCreateTokenLedger() {
+	await ledgerStore.getStore()?.prefetch();
+}
 async function forgetRecordedCreateTokens(logicalIds) {
 	await ledgerStore.getStore()?.forget(logicalIds);
 }
@@ -34854,6 +34978,10 @@ async function settleJournalAfterSuccess(stackName, completedOperations, previou
 	const deployRunId = this.options.eventRecorder?.runId;
 	const stripOnFailure = /* @__PURE__ */ new Map();
 	const [ownLeft] = await Promise.all([(async () => {
+		if (this.absentJournalVersionPurge !== void 0 && this.stateBackend.rollbackJournalReadAbsent(stackName, this.stackRegion)) {
+			await this.absentJournalVersionPurge;
+			return 0;
+		}
 		const own = await settleJournaledOrphansOnSuccess({
 			stateBackend: this.stateBackend,
 			stackName,
@@ -36295,9 +36423,13 @@ function buildResolverContext(base, stackName) {
 		recordedOutputReads: this.recordedOutputReads,
 		attributeHealer: (logicalId, resource) => this.healStaleAttributes(logicalId, resource, stackName),
 		...this.options.inheritedSecrets && hasMaskableValues(this.options.inheritedSecrets) && { inheritedSecrets: this.options.inheritedSecrets },
+		...this.options.inheritedPhysicalNameCopies && { inheritedPhysicalNameCopies: this.options.inheritedPhysicalNameCopies },
 		recordedSecretValues,
 		noEchoAttributeResources: this.noEchoAttributeResources,
 		secretNameNeedles: (logicalId) => this.noteSecretNamedRecord(logicalId, Object.hasOwn(base.resources, logicalId) ? base.resources[logicalId] : void 0),
+		producerSecrets: (logicalId) => this.perResourceSecrets.get(logicalId),
+		secretRegionEvidence: () => this.runProducerRegionEvidence?.(),
+		producerPreRunPhysicalId: (logicalId) => Object.hasOwn(this.healBaseline, logicalId) ? this.healBaseline[logicalId]?.physicalId : void 0,
 		...base.redactedAttributeReads && { redactedAttributeReads: base.redactedAttributeReads }
 	};
 }
@@ -39422,7 +39554,10 @@ function noEchoPositionSources(resources = {}, template = this.constructPathTemp
 function noEchoLeavesFor(logicalId, record, templateProps, sources) {
 	if (templateProps !== void 0 && isWrittenFromDeployedTemplate(record.properties)) return canonicalCoordinates(noEchoCoordinatesOf(templateProps, record.properties, sources));
 	const existing = noEchoLeavesOf(record);
-	if (existing !== void 0) return canonicalCoordinates(existing);
+	if (existing !== void 0) {
+		const confirmed = this.witnessConfirmedLeaves.get(logicalId) ?? [];
+		return canonicalCoordinates([...existing, ...confirmed]);
+	}
 	const resolvedAsSame = this.perResourceResolvedType.get(logicalId) === record.resourceType;
 	const source = (templateProps !== void 0 && resolvedAsSame ? templateProps : void 0) ?? templatePropertiesFor(this, logicalId, record.resourceType);
 	if (source === void 0) return void 0;
@@ -39634,6 +39769,981 @@ function noEchoComparisonForTemplate(template, knownConditions, values, resource
 	return (input) => compare(input);
 }
 
+//#endregion
+//#region src/analyzer/security-changes.ts
+const RESOURCE_SCRUTINY = {
+	"AWS::Bedrock::KnowledgeBasePolicy": "ResourcePolicyResource",
+	"AWS::Bedrock::ResourcePolicy": "ResourcePolicyResource",
+	"AWS::CloudTrail::ResourcePolicy": "ResourcePolicyResource",
+	"AWS::EC2::SecurityGroupEgress": "EgressRuleResource",
+	"AWS::EC2::SecurityGroupIngress": "IngressRuleResource",
+	"AWS::ECR::RegistryPolicy": "ResourcePolicyResource",
+	"AWS::EventSchemas::RegistryPolicy": "ResourcePolicyResource",
+	"AWS::EventsV2::ResourcePolicy": "ResourcePolicyResource",
+	"AWS::IAM::GroupPolicy": "IdentityPolicyResource",
+	"AWS::IAM::ManagedPolicy": "IdentityPolicyResource",
+	"AWS::IAM::Policy": "IdentityPolicyResource",
+	"AWS::IAM::RolePolicy": "IdentityPolicyResource",
+	"AWS::IAM::UserPolicy": "IdentityPolicyResource",
+	"AWS::IoT::Policy": "ResourcePolicyResource",
+	"AWS::Kinesis::ResourcePolicy": "ResourcePolicyResource",
+	"AWS::Lambda::Permission": "LambdaPermission",
+	"AWS::Lambda::ResourcePolicy": "ResourcePolicyResource",
+	"AWS::Lex::ResourcePolicy": "ResourcePolicyResource",
+	"AWS::Logs::ResourcePolicy": "ResourcePolicyResource",
+	"AWS::MSK::ClusterPolicy": "ResourcePolicyResource",
+	"AWS::MediaPackageV2::ChannelPolicy": "ResourcePolicyResource",
+	"AWS::MediaPackageV2::OriginEndpointPolicy": "ResourcePolicyResource",
+	"AWS::MediaTailor::ChannelPolicy": "ResourcePolicyResource",
+	"AWS::S3::BucketPolicy": "ResourcePolicyResource",
+	"AWS::S3::MultiRegionAccessPointPolicy": "ResourcePolicyResource",
+	"AWS::S3Express::BucketPolicy": "ResourcePolicyResource",
+	"AWS::S3Files::FileSystemPolicy": "ResourcePolicyResource",
+	"AWS::S3ObjectLambda::AccessPointPolicy": "ResourcePolicyResource",
+	"AWS::S3Outposts::BucketPolicy": "ResourcePolicyResource",
+	"AWS::S3Tables::TableBucketPolicy": "ResourcePolicyResource",
+	"AWS::S3Tables::TablePolicy": "ResourcePolicyResource",
+	"AWS::S3Vectors::VectorBucketPolicy": "ResourcePolicyResource",
+	"AWS::SMSVOICE::ResourcePolicy": "ResourcePolicyResource",
+	"AWS::SNS::TopicInlinePolicy": "ResourcePolicyResource",
+	"AWS::SNS::TopicPolicy": "ResourcePolicyResource",
+	"AWS::SQS::QueueInlinePolicy": "ResourcePolicyResource",
+	"AWS::SQS::QueuePolicy": "ResourcePolicyResource",
+	"AWS::SSM::ResourcePolicy": "ResourcePolicyResource",
+	"AWS::SSO::Assignment": "SsoAssignmentResource",
+	"AWS::SSO::InstanceAccessControlAttributeConfiguration": "SsoInstanceACAConfigResource",
+	"AWS::SSO::PermissionSet": "SsoPermissionSet",
+	"AWS::SecretsManager::ResourcePolicy": "ResourcePolicyResource",
+	"AWS::VpcLattice::AuthPolicy": "ResourcePolicyResource",
+	"AWS::VpcLattice::ResourcePolicy": "ResourcePolicyResource"
+};
+const PROPERTY_SCRUTINY = {
+	"AWS::ApiGateway::DomainNameV2": { Policy: "InlineResourcePolicy" },
+	"AWS::ApiGateway::RestApi": { Policy: "InlineResourcePolicy" },
+	"AWS::Backup::BackupVault": { AccessPolicy: "InlineResourcePolicy" },
+	"AWS::Backup::LogicallyAirGappedBackupVault": { AccessPolicy: "InlineResourcePolicy" },
+	"AWS::CodeArtifact::Domain": { PermissionsPolicyDocument: "InlineResourcePolicy" },
+	"AWS::CodeArtifact::Repository": { PermissionsPolicyDocument: "InlineResourcePolicy" },
+	"AWS::EC2::SecurityGroup": {
+		SecurityGroupEgress: "EgressRules",
+		SecurityGroupIngress: "IngressRules"
+	},
+	"AWS::EC2::VPCEndpoint": { PolicyDocument: "InlineResourcePolicy" },
+	"AWS::ECR::PublicRepository": { RepositoryPolicyText: "InlineResourcePolicy" },
+	"AWS::ECR::Repository": { RepositoryPolicyText: "InlineResourcePolicy" },
+	"AWS::EFS::FileSystem": { FileSystemPolicy: "InlineResourcePolicy" },
+	"AWS::Events::EventBus": { Policy: "InlineResourcePolicy" },
+	"AWS::IAM::Group": {
+		ManagedPolicyArns: "ManagedPolicies",
+		Policies: "InlineIdentityPolicies"
+	},
+	"AWS::IAM::Role": {
+		AssumeRolePolicyDocument: "InlineResourcePolicy",
+		ManagedPolicyArns: "ManagedPolicies",
+		Policies: "InlineIdentityPolicies"
+	},
+	"AWS::IAM::User": {
+		ManagedPolicyArns: "ManagedPolicies",
+		Policies: "InlineIdentityPolicies"
+	},
+	"AWS::KMS::Key": { KeyPolicy: "InlineResourcePolicy" },
+	"AWS::KMS::ReplicaKey": { KeyPolicy: "InlineResourcePolicy" },
+	"AWS::Logs::LogGroup": {
+		DataProtectionPolicy: "InlineResourcePolicy",
+		ResourcePolicyDocument: "InlineResourcePolicy"
+	},
+	"AWS::MPA::ApprovalTeam": { Policies: "InlineIdentityPolicies" },
+	"AWS::NetworkManager::CoreNetwork": { PolicyDocument: "InlineResourcePolicy" },
+	"AWS::Oam::Sink": { Policy: "InlineResourcePolicy" },
+	"AWS::Omics::SequenceStore": { S3AccessPolicy: "InlineResourcePolicy" },
+	"AWS::RAM::Permission": { PolicyTemplate: "InlineResourcePolicy" },
+	"AWS::Redshift::Cluster": { NamespaceResourcePolicy: "InlineResourcePolicy" },
+	"AWS::RedshiftServerless::Namespace": { NamespaceResourcePolicy: "InlineResourcePolicy" },
+	"AWS::RolesAnywhere::Profile": { ManagedPolicyArns: "ManagedPolicies" },
+	"AWS::S3::AccessPoint": { Policy: "InlineResourcePolicy" },
+	"AWS::S3Express::AccessPoint": { Policy: "InlineResourcePolicy" },
+	"AWS::S3Outposts::AccessPoint": { Policy: "InlineResourcePolicy" },
+	"AWS::SNS::Subscription": {
+		RedrivePolicy: "InlineResourcePolicy",
+		ReplayPolicy: "InlineResourcePolicy"
+	},
+	"AWS::SNS::Topic": {
+		DataProtectionPolicy: "InlineResourcePolicy",
+		ArchivePolicy: "InlineResourcePolicy"
+	},
+	"AWS::SQS::Queue": { RedriveAllowPolicy: "InlineResourcePolicy" },
+	"AWS::SSO::PermissionSet": {
+		InlinePolicy: "InlineResourcePolicy",
+		ManagedPolicies: "ManagedPolicies"
+	},
+	"AWS::SageMaker::ModelPackageGroup": { ModelPackageGroupPolicy: "InlineResourcePolicy" },
+	"AWS::Serverless::Function": { AssumeRolePolicyDocument: "InlineResourcePolicy" }
+};
+function resourceScrutiny(type) {
+	return Object.hasOwn(RESOURCE_SCRUTINY, type) ? RESOURCE_SCRUTINY[type] : void 0;
+}
+function propertyScrutinies(type) {
+	return Object.hasOwn(PROPERTY_SCRUTINY, type) ? PROPERTY_SCRUTINY[type] ?? {} : {};
+}
+function isScrutinizedProperty(type, path) {
+	return resourceScrutiny(type) !== void 0 || Object.hasOwn(propertyScrutinies(type), path);
+}
+function strictEqual(a, b) {
+	if (a === b) return true;
+	if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) return a !== a && b !== b;
+	if (Array.isArray(a) !== Array.isArray(b)) return false;
+	if (Array.isArray(a)) {
+		const bArr = b;
+		return a.length === bArr.length && a.every((v, i) => strictEqual(v, bArr[i]));
+	}
+	const aKeys = Object.keys(a);
+	if (aKeys.length !== Object.keys(b).length) return false;
+	return aKeys.every((k) => Object.hasOwn(b, k) && strictEqual(a[k], b[k]));
+}
+function cfnEqual(lvalue, rvalue) {
+	if (lvalue === rvalue) return true;
+	if ((typeof lvalue === "string" && typeof rvalue === "boolean" || typeof lvalue === "boolean" && typeof rvalue === "string") && lvalue.toString() === rvalue.toString()) return true;
+	if ((typeof lvalue === "string" || typeof rvalue === "string") && Number(lvalue) === Number(rvalue)) return true;
+	if (typeof lvalue !== typeof rvalue) return false;
+	if (Array.isArray(lvalue) !== Array.isArray(rvalue)) return false;
+	if (Array.isArray(lvalue)) {
+		if (lvalue.length !== rvalue.length) return false;
+		for (let i = 0; i < lvalue.length; i++) if (!cfnEqual(lvalue[i], rvalue[i])) return false;
+		return true;
+	}
+	if (typeof lvalue === "object") {
+		if (lvalue === null || rvalue === null) return false;
+		const keys = Object.keys(lvalue);
+		if (keys.length !== Object.keys(rvalue).length) return false;
+		for (const key of keys) {
+			if (!Object.hasOwn(rvalue, key)) return false;
+			if (key === "DependsOn") {
+				if (!dependsOnEqual(lvalue[key], rvalue[key])) return false;
+				continue;
+			}
+			if (!cfnEqual(lvalue[key], rvalue[key])) return false;
+		}
+		return true;
+	}
+	return false;
+}
+function dependsOnEqual(lvalue, rvalue) {
+	if (Array.isArray(lvalue) !== Array.isArray(rvalue)) {
+		const array = Array.isArray(lvalue) ? lvalue : rvalue;
+		const nonArray = Array.isArray(lvalue) ? rvalue : lvalue;
+		return array.length === 1 && cfnEqual(array[0], nonArray);
+	}
+	if (Array.isArray(lvalue) && Array.isArray(rvalue)) {
+		if (lvalue.length !== rvalue.length) return false;
+		for (let i = 0; i < lvalue.length; i++) if (!cfnEqual(lvalue[i], rvalue[0]) && lvalue.length === 1) return false;
+		return true;
+	}
+	return false;
+}
+function normalize(template) {
+	if (typeof template !== "object" || template === null) return;
+	for (const key of Object.keys(template)) {
+		if (key === "Fn::GetAtt" && typeof template[key] === "string") {
+			template[key] = template[key].split(".");
+			continue;
+		} else if (key === "DependsOn") {
+			if (typeof template[key] === "string") template[key] = [template[key]];
+			else if (Array.isArray(template[key])) template[key] = template[key].sort((x, y) => String(x) < String(y) ? -1 : String(x) > String(y) ? 1 : 0);
+			continue;
+		}
+		if (Array.isArray(template[key])) for (const element of template[key]) normalize(element);
+		else normalize(template[key]);
+	}
+}
+function getIntrinsic(x) {
+	if (x === void 0 || x === null || Array.isArray(x) || typeof x !== "object") return void 0;
+	const keys = Object.keys(x);
+	return keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::")) ? {
+		fn: keys[0],
+		args: x[keys[0]]
+	} : void 0;
+}
+function isNoValue(x) {
+	const intrinsic = getIntrinsic(x);
+	return intrinsic !== void 0 && intrinsic.fn === "Ref" && intrinsic.args === "AWS::NoValue";
+}
+function renderIntrinsics(x) {
+	if (Array.isArray(x)) return x.filter((el) => !isNoValue(el)).map(renderIntrinsics);
+	if (isNoValue(x)) return void 0;
+	const intrinsic = getIntrinsic(x);
+	if (intrinsic !== void 0) {
+		if (intrinsic.fn === "Ref") return "${" + intrinsic.args + "}";
+		if (intrinsic.fn === "Fn::GetAtt") return "${" + intrinsic.args[0] + "." + intrinsic.args[1] + "}";
+		if (intrinsic.fn === "Fn::Join") {
+			const [separator, args] = intrinsic.args;
+			if (Array.isArray(args)) return args.filter((el) => !isNoValue(el)).map(renderIntrinsics).join(separator);
+			return JSON.stringify({ "Fn::Join": renderIntrinsics([separator, args]) });
+		}
+		return JSON.stringify({ [intrinsic.fn]: renderIntrinsics(intrinsic.args) });
+	}
+	if (typeof x === "object" && x !== null) {
+		const ret = {};
+		for (const [key, value] of Object.entries(x)) if (!isNoValue(value)) ret[key] = renderIntrinsics(value);
+		return ret;
+	}
+	return x;
+}
+var Targets = class {
+	values;
+	not;
+	constructor(statement, positiveKey, negativeKey) {
+		if (negativeKey in statement) {
+			this.values = forceListOfStrings(statement[negativeKey]);
+			this.not = true;
+		} else {
+			this.values = forceListOfStrings(statement[positiveKey]);
+			this.not = false;
+		}
+		this.values.sort();
+	}
+	get empty() {
+		return this.values.length === 0;
+	}
+	equal(other) {
+		return this.not === other.not && strictEqual(this.values.sort(), other.values.sort());
+	}
+	replaceEmpty(replacement) {
+		if (this.empty) this.values.push(replacement);
+	}
+	replaceStar(replacement) {
+		for (let i = 0; i < this.values.length; i++) if (this.values[i] === "*") this.values[i] = replacement;
+		this.values.sort();
+	}
+	render() {
+		return this.not ? this.values.map((s) => `NOT ${s}`).join("\n") : this.values.join("\n");
+	}
+};
+function forceListOfStrings(x) {
+	if (typeof x === "string") return [x];
+	if (x === void 0 || x === null) return [];
+	if (Array.isArray(x)) return x.map((e) => forceListOfStrings(e).join(","));
+	if (typeof x === "object") {
+		const ret = [];
+		for (const [key, value] of Object.entries(x)) ret.push(...forceListOfStrings(value).map((s) => `${key}:${s}`));
+		return ret;
+	}
+	return [`${x}`];
+}
+var Statement = class {
+	sid;
+	effect;
+	resources;
+	actions;
+	principals;
+	condition;
+	serializedIntrinsic;
+	constructor(statement) {
+		if (typeof statement === "string") {
+			this.sid = void 0;
+			this.effect = "Unknown";
+			this.resources = new Targets({}, "", "");
+			this.actions = new Targets({}, "", "");
+			this.principals = new Targets({}, "", "");
+			this.condition = void 0;
+			this.serializedIntrinsic = statement;
+		} else {
+			if (typeof statement !== "object" || statement === null) throw new Error("An IAM policy statement is neither an object nor a string");
+			this.sid = typeof statement.Sid === "string" ? statement.Sid : void 0;
+			this.effect = statement.Effect === "Allow" || statement.Effect === "Deny" ? statement.Effect : "Unknown";
+			this.resources = new Targets(statement, "Resource", "NotResource");
+			this.actions = new Targets(statement, "Action", "NotAction");
+			this.principals = new Targets(statement, "Principal", "NotPrincipal");
+			this.condition = statement.Condition;
+			this.serializedIntrinsic = void 0;
+		}
+	}
+	equal(other) {
+		return this.sid === other.sid && this.effect === other.effect && this.serializedIntrinsic === other.serializedIntrinsic && this.resources.equal(other.resources) && this.actions.equal(other.actions) && this.principals.equal(other.principals) && strictEqual(this.condition, other.condition);
+	}
+	get isNegativeStatement() {
+		const notTarget = this.actions.not || this.principals.not || this.resources.not;
+		return this.effect === "Allow" ? notTarget : !notTarget;
+	}
+	render() {
+		return this.serializedIntrinsic ? [
+			this.serializedIntrinsic,
+			"",
+			"",
+			this.principals.render(),
+			""
+		] : [
+			this.resources.render(),
+			this.effect,
+			this.actions.render(),
+			this.principals.render(),
+			renderCondition(this.condition)
+		];
+	}
+};
+function parseStatements(x) {
+	if (x === void 0) x = [];
+	if (!Array.isArray(x)) x = [x];
+	return x.map((s) => new Statement(s));
+}
+function parseLambdaPermission(x) {
+	const statement = {
+		Effect: "Allow",
+		Action: x.Action,
+		Resource: x.FunctionName
+	};
+	if (x.Principal !== void 0) {
+		if (x.Principal === "*") statement.Principal = "*";
+		else if (/^\d{12}$/.test(x.Principal)) statement.Principal = { AWS: `arn:aws:iam::${x.Principal}:root` };
+		else statement.Principal = { Service: x.Principal };
+	}
+	if (x.SourceArn !== void 0) {
+		statement.Condition ??= {};
+		statement.Condition.ArnLike = { "AWS:SourceArn": x.SourceArn };
+	}
+	if (x.SourceAccount !== void 0) {
+		statement.Condition ??= {};
+		statement.Condition.StringEquals = { "AWS:SourceAccount": x.SourceAccount };
+	}
+	if (x.EventSourceToken !== void 0) {
+		statement.Condition ??= {};
+		statement.Condition.StringEquals = { "lambda:EventSourceToken": x.EventSourceToken };
+	}
+	return new Statement(statement);
+}
+function renderCondition(condition) {
+	if (!condition || Object.keys(condition).length === 0) return "";
+	const lines = JSON.stringify(condition, void 0, 2).split("\n");
+	return lines.slice(1, lines.length - 1).map((s) => s.slice(2)).join("\n");
+}
+function defaultPrincipal(principal, statements) {
+	statements.forEach((s) => s.principals.replaceEmpty(principal));
+	statements.forEach((s) => s.principals.replaceStar(principal));
+	return statements;
+}
+function defaultResource(resource, statements) {
+	statements.forEach((s) => s.resources.replaceEmpty(resource));
+	statements.forEach((s) => s.resources.replaceStar(resource));
+	return statements;
+}
+var ManagedPolicyAttachment = class {
+	identityArn;
+	managedPolicyArn;
+	constructor(identityArn, managedPolicyArn) {
+		this.identityArn = identityArn;
+		this.managedPolicyArn = managedPolicyArn;
+	}
+	equal(other) {
+		return this.identityArn === other.identityArn && this.managedPolicyArn === other.managedPolicyArn;
+	}
+};
+var SsoElement = class {
+	fields;
+	constructor(fields) {
+		this.fields = fields;
+	}
+	equal(other) {
+		return strictEqual(this.fields, other.fields);
+	}
+};
+var SecurityGroupRule = class {
+	ipProtocol;
+	fromPort;
+	toPort;
+	groupId;
+	peer;
+	constructor(rule, groupRef) {
+		this.ipProtocol = rule.IpProtocol?.toString() || "*unknown*";
+		this.fromPort = rule.FromPort;
+		this.toPort = rule.ToPort;
+		this.groupId = rule.GroupId || groupRef || "*unknown*";
+		this.peer = findFirst(rule, ["CidrIp", "CidrIpv6"], (ip) => ({
+			kind: "cidr-ip",
+			ip
+		})) || findFirst(rule, ["DestinationSecurityGroupId", "SourceSecurityGroupId"], (id) => ({
+			kind: "security-group",
+			securityGroupId: id
+		})) || findFirst(rule, ["DestinationPrefixListId", "SourcePrefixListId"], (id) => ({
+			kind: "prefix-list",
+			prefixListId: id
+		}));
+	}
+	equal(other) {
+		return this.ipProtocol === other.ipProtocol && this.fromPort === other.fromPort && this.toPort === other.toPort && peerEqual(this.peer, other.peer);
+	}
+	describeProtocol() {
+		if (this.ipProtocol === "-1") return "Everything";
+		const ipProtocol = this.ipProtocol.toUpperCase();
+		if (this.fromPort === -1) return `All ${ipProtocol}`;
+		if (this.fromPort === this.toPort) return `${ipProtocol} ${this.fromPort}`;
+		return `${ipProtocol} ${this.fromPort}-${this.toPort}`;
+	}
+	describePeer() {
+		switch (this.peer?.kind) {
+			case "cidr-ip":
+				if (this.peer.ip === "0.0.0.0/0") return "Everyone (IPv4)";
+				if (this.peer.ip === "::/0") return "Everyone (IPv6)";
+				return `${this.peer.ip}`;
+			case "prefix-list": return `${this.peer.prefixListId}`;
+			case "security-group": return `${this.peer.securityGroupId}`;
+			default: return "?";
+		}
+	}
+};
+function peerEqual(a, b) {
+	if (a === void 0 || b === void 0) return a === b;
+	if (a.kind === "cidr-ip" && b.kind === "cidr-ip") return a.ip === b.ip;
+	if (a.kind === "security-group" && b.kind === "security-group") return a.securityGroupId === b.securityGroupId;
+	if (a.kind === "prefix-list" && b.kind === "prefix-list") return a.prefixListId === b.prefixListId;
+	return false;
+}
+function findFirst(obj, keys, fn) {
+	for (const key of keys) try {
+		if (key in obj) return fn(obj[key]);
+	} catch {}
+}
+var DiffableCollection = class {
+	additions = [];
+	removals = [];
+	oldElements = [];
+	newElements = [];
+	addOld(...elements) {
+		this.oldElements.push(...elements);
+	}
+	addNew(...elements) {
+		this.newElements.push(...elements);
+	}
+	calculateDiff() {
+		const contains = (x, xs) => xs.some((y) => y.equal(x));
+		this.additions.push(...this.newElements.filter((x) => !contains(x, this.oldElements)));
+		this.removals.push(...this.oldElements.filter((x) => !contains(x, this.newElements)));
+	}
+	get hasChanges() {
+		return this.additions.length + this.removals.length > 0;
+	}
+	get hasAdditions() {
+		return this.additions.length > 0;
+	}
+};
+function resourceDiffers(oldValue, newValue) {
+	if (oldValue === void 0 || newValue === void 0) return true;
+	if (oldValue.Type !== newValue.Type) return true;
+	const keyDiffers = (a, b, skip) => [.../* @__PURE__ */ new Set([...Object.keys(a ?? {}), ...Object.keys(b ?? {})])].some((key) => {
+		if (key === skip) return false;
+		const x = a?.[key];
+		const y = b?.[key];
+		return !(x === void 0 && y === void 0) && !cfnEqual(x, y);
+	});
+	return keyDiffers(oldValue.Properties, newValue.Properties) || keyDiffers(oldValue, newValue, "Properties");
+}
+var SecurityChanges = class {
+	statements = new DiffableCollection();
+	managedPolicies = new DiffableCollection();
+	ssoPermissionSets = new DiffableCollection();
+	ssoAssignments = new DiffableCollection();
+	ssoInstanceACAConfigs = new DiffableCollection();
+	ingress = new DiffableCollection();
+	egress = new DiffableCollection();
+	constructor(oldTemplate, newTemplate) {
+		normalize(oldTemplate);
+		normalize(newTemplate);
+		const oldResources = oldTemplate.Resources ?? {};
+		const newResources = newTemplate.Resources ?? {};
+		const changed = [];
+		for (const id of /* @__PURE__ */ new Set([...Object.keys(oldResources), ...Object.keys(newResources)])) {
+			const oldValue = Object.hasOwn(oldResources, id) ? oldResources[id] : void 0;
+			const newValue = Object.hasOwn(newResources, id) ? newResources[id] : void 0;
+			if (oldValue === void 0 && newValue === void 0) continue;
+			if (resourceDiffers(oldValue, newValue)) changed.push([id, {
+				oldValue,
+				newValue
+			}]);
+		}
+		for (const change of this.propertyChanges(changed)) this.readPropertyChange(change);
+		for (const change of this.resourceChanges(changed)) this.readResourceChange(change);
+		for (const collection of this.collections()) collection.calculateDiff();
+	}
+	collections() {
+		return [
+			this.statements,
+			this.managedPolicies,
+			this.ssoPermissionSets,
+			this.ssoAssignments,
+			this.ssoInstanceACAConfigs,
+			this.ingress,
+			this.egress
+		];
+	}
+	propertyChanges(changed) {
+		const ret = [];
+		for (const [logicalId, { oldValue, newValue }] of changed) {
+			const oldType = oldValue?.Type;
+			const newType = newValue?.Type;
+			if (oldType !== void 0 && newType !== void 0 && oldType !== newType) continue;
+			const resourceType = oldType ?? newType;
+			if (!resourceType) continue;
+			for (const [propertyName, scrutiny] of Object.entries(propertyScrutinies(resourceType))) ret.push({
+				logicalId,
+				resourceType,
+				scrutiny,
+				oldValue: oldValue?.Properties?.[propertyName],
+				newValue: newValue?.Properties?.[propertyName]
+			});
+		}
+		return ret;
+	}
+	resourceChanges(changed) {
+		const ret = [];
+		for (const [logicalId, { oldValue, newValue }] of changed) {
+			const oldType = oldValue?.Type;
+			const newType = newValue?.Type;
+			const common = {
+				logicalId,
+				oldProperties: oldValue?.Properties,
+				newProperties: newValue?.Properties
+			};
+			if (oldType !== void 0 && newType !== void 0 && oldType !== newType) {
+				const oldScrutiny = resourceScrutiny(oldType);
+				if (oldScrutiny) ret.push({
+					...common,
+					newProperties: void 0,
+					scrutiny: oldScrutiny
+				});
+				const newScrutiny = resourceScrutiny(newType);
+				if (newScrutiny) ret.push({
+					...common,
+					oldProperties: void 0,
+					scrutiny: newScrutiny
+				});
+				continue;
+			}
+			const type = oldType ?? newType;
+			const scrutiny = type ? resourceScrutiny(type) : void 0;
+			if (scrutiny) ret.push({
+				...common,
+				scrutiny
+			});
+		}
+		return ret;
+	}
+	get permissionsBroadened() {
+		return this.statements.additions.some((s) => !s.isNegativeStatement) || this.statements.removals.some((s) => s.isNegativeStatement) || this.managedPolicies.hasAdditions || this.ssoPermissionSets.hasAdditions || this.ssoAssignments.hasAdditions || this.ssoInstanceACAConfigs.hasAdditions || this.ingress.hasAdditions || this.egress.hasAdditions;
+	}
+	get iamHasChanges() {
+		return this.statements.hasChanges || this.managedPolicies.hasChanges || this.ssoPermissionSets.hasChanges || this.ssoAssignments.hasChanges || this.ssoInstanceACAConfigs.hasChanges;
+	}
+	get securityGroupsHaveChanges() {
+		return this.ingress.hasChanges || this.egress.hasChanges;
+	}
+	get permissionsAnyChanges() {
+		return this.iamHasChanges || this.securityGroupsHaveChanges;
+	}
+	readPropertyChange(change) {
+		switch (change.scrutiny) {
+			case "InlineIdentityPolicies":
+				this.statements.addOld(...readIdentityPolicies(change.oldValue, change.logicalId));
+				this.statements.addNew(...readIdentityPolicies(change.newValue, change.logicalId));
+				break;
+			case "InlineResourcePolicy":
+				if (change.resourceType === "AWS::SSO::PermissionSet") {
+					this.statements.addOld(...readPermissionSetInlinePolicy(change.oldValue, change.logicalId));
+					this.statements.addNew(...readPermissionSetInlinePolicy(change.newValue, change.logicalId));
+				} else {
+					this.statements.addOld(...readResourceStatements(change.oldValue, change.logicalId));
+					this.statements.addNew(...readResourceStatements(change.newValue, change.logicalId));
+				}
+				break;
+			case "ManagedPolicies":
+				this.managedPolicies.addOld(...readManagedPolicies(change.oldValue, change.logicalId));
+				this.managedPolicies.addNew(...readManagedPolicies(change.newValue, change.logicalId));
+				break;
+			case "IngressRules":
+				this.ingress.addOld(...readInlineRules(change.oldValue, change.logicalId));
+				this.ingress.addNew(...readInlineRules(change.newValue, change.logicalId));
+				break;
+			case "EgressRules":
+				this.egress.addOld(...readInlineRules(change.oldValue, change.logicalId));
+				this.egress.addNew(...readInlineRules(change.newValue, change.logicalId));
+		}
+	}
+	readResourceChange(change) {
+		const id = change.logicalId;
+		switch (change.scrutiny) {
+			case "IdentityPolicyResource":
+				this.statements.addOld(...readIdentityPolicyResource(change.oldProperties));
+				this.statements.addNew(...readIdentityPolicyResource(change.newProperties));
+				break;
+			case "ResourcePolicyResource":
+				this.statements.addOld(...readResourcePolicyResource(change.oldProperties));
+				this.statements.addNew(...readResourcePolicyResource(change.newProperties));
+				break;
+			case "LambdaPermission":
+				this.statements.addOld(...readLambdaStatements(change.oldProperties));
+				this.statements.addNew(...readLambdaStatements(change.newProperties));
+				break;
+			case "SsoPermissionSet":
+				this.ssoPermissionSets.addOld(...readSso(change.oldProperties, id, permissionSetFields));
+				this.ssoPermissionSets.addNew(...readSso(change.newProperties, id, permissionSetFields));
+				break;
+			case "SsoAssignmentResource":
+				this.ssoAssignments.addOld(...readSso(change.oldProperties, id, assignmentFields));
+				this.ssoAssignments.addNew(...readSso(change.newProperties, id, assignmentFields));
+				break;
+			case "SsoInstanceACAConfigResource":
+				this.ssoInstanceACAConfigs.addOld(...readSso(change.oldProperties, id, acaConfigFields));
+				this.ssoInstanceACAConfigs.addNew(...readSso(change.newProperties, id, acaConfigFields));
+				break;
+			case "IngressRuleResource":
+				this.ingress.addOld(...readRuleResource(change.oldProperties));
+				this.ingress.addNew(...readRuleResource(change.newProperties));
+				break;
+			case "EgressRuleResource":
+				this.egress.addOld(...readRuleResource(change.oldProperties));
+				this.egress.addNew(...readRuleResource(change.newProperties));
+		}
+	}
+};
+function readIdentityPolicies(policies, logicalId) {
+	if (policies === void 0 || !Array.isArray(policies)) return [];
+	const appliesToPrincipal = "AWS:${" + logicalId + "}";
+	return policies.flatMap((policy) => {
+		const unparsed = policy.PolicyDocument?.Statement ? policy.PolicyDocument.Statement : policy;
+		return defaultPrincipal(appliesToPrincipal, parseStatements(renderIntrinsics(unparsed)));
+	});
+}
+function readIdentityPolicyResource(properties) {
+	if (properties === void 0) return [];
+	properties = renderIntrinsics(properties);
+	return (properties.Groups || []).concat(properties.Users || []).concat(properties.Roles || []).flatMap((principal) => defaultPrincipal("AWS:" + principal, parseStatements(properties.PolicyDocument.Statement)));
+}
+function readPermissionSetInlinePolicy(policy, logicalId) {
+	if (policy === void 0) return [];
+	const statements = parseStatements(renderIntrinsics(policy.Statement));
+	defaultResource("${" + logicalId + ".Arn}", statements);
+	defaultPrincipal("AWS:${" + logicalId + "}", statements);
+	return statements;
+}
+function readResourceStatements(policy, logicalId) {
+	if (policy === void 0) return [];
+	return defaultResource("${" + logicalId + ".Arn}", parseStatements(renderIntrinsics(policy.Statement)));
+}
+function readResourcePolicyResource(properties) {
+	if (properties === void 0) return [];
+	properties = renderIntrinsics(properties);
+	const policyKeys = Object.keys(properties).filter((key) => key.indexOf("Policy") > -1);
+	const resourceKeys = Object.keys(properties).filter((key) => !policyKeys.includes(key) && !key.endsWith("Name"));
+	let resources = resourceKeys.length === 1 ? properties[resourceKeys[0]] : ["???"];
+	if (!Array.isArray(resources)) resources = [resources];
+	return resources.flatMap((resource) => defaultResource(resource, parseStatements(properties[policyKeys[0]].Statement)));
+}
+function readManagedPolicies(policyArns, logicalId) {
+	if (!policyArns) return [];
+	const identity = "${" + logicalId + "}";
+	const arns = renderIntrinsics(policyArns);
+	return typeof arns === "string" ? [new ManagedPolicyAttachment(identity, arns)] : arns.map((arn) => new ManagedPolicyAttachment(identity, arn));
+}
+function readLambdaStatements(properties) {
+	if (!properties) return [];
+	return [parseLambdaPermission(renderIntrinsics(properties))];
+}
+function readInlineRules(rules, logicalId) {
+	if (!rules || !Array.isArray(rules)) return [];
+	const ref = "${" + logicalId + ".GroupId}";
+	return rules.flatMap((rule) => {
+		const rendered = renderIntrinsics(rule);
+		return typeof rendered === "object" ? [new SecurityGroupRule(rendered, ref)] : [];
+	});
+}
+function readRuleResource(resource) {
+	if (!resource) return [];
+	return [new SecurityGroupRule(renderIntrinsics(resource))];
+}
+const permissionSetFields = (p) => ({
+	name: p.Name,
+	ssoInstanceArn: p.InstanceArn,
+	ssoCustomerManagedPolicyReferences: p.CustomerManagedPolicyReferences,
+	ssoPermissionsBoundary: p.PermissionsBoundary
+});
+const assignmentFields = (p) => ({
+	ssoInstanceArn: p.InstanceArn,
+	permissionSetArn: p.PermissionSetArn,
+	principalId: p.PrincipalId,
+	principalType: p.PrincipalType,
+	targetId: p.TargetId,
+	targetType: p.TargetType
+});
+const acaConfigFields = (p) => ({
+	ssoInstanceArn: p.InstanceArn,
+	accessControlAttributes: p.AccessControlAttributes
+});
+function readSso(properties, logicalId, fields) {
+	if (properties === void 0) return [];
+	const values = Object.fromEntries(Object.entries({
+		cfnLogicalId: "${" + logicalId + "}",
+		...fields(renderIntrinsics(properties))
+	}).filter(([, v]) => v !== void 0));
+	return [new SsoElement(values)];
+}
+function withHeader(color, header, rows, then = () => 0) {
+	rows.sort((a, b) => {
+		const keyA = sortKey(a, color);
+		const keyB = sortKey(b, color);
+		if (keyA < keyB) return -1;
+		if (keyB < keyA) return 1;
+		return then(a) - then(b);
+	});
+	return [header, ...rows];
+}
+function sortKey(row, color) {
+	const open = !color ? "" : row[0] === "-" ? "\x1B[31m" : row[0] === "+" ? "\x1B[32m" : "";
+	if (open === "" || row[1] === "") return row[1];
+	const close = "\x1B[39m";
+	return open + row[1].replace(/\r?\n/g, (m) => close + m + open) + close;
+}
+function summarizeStatements(changes, color) {
+	return withHeader(color, [
+		"",
+		"Resource",
+		"Effect",
+		"Action",
+		"Principal",
+		"Condition"
+	], [...changes.statements.additions.map((s) => ["+", ...s.render()]), ...changes.statements.removals.map((s) => ["-", ...s.render()])]);
+}
+function summarizeManagedPolicies(changes, color) {
+	return withHeader(color, [
+		"",
+		"Resource",
+		"Managed Policy ARN"
+	], [...changes.managedPolicies.additions.map((a) => [
+		"+",
+		a.identityArn,
+		a.managedPolicyArn
+	]), ...changes.managedPolicies.removals.map((a) => [
+		"-",
+		a.identityArn,
+		a.managedPolicyArn
+	])]);
+}
+function ssoRows(collection, cells) {
+	return [...collection.additions.map((e) => ["+", ...cells(e.fields)]), ...collection.removals.map((e) => ["-", ...cells(e.fields)])];
+}
+function formatManagedPolicyRef(s) {
+	return `Name: ${s?.Name || ""}, Path: ${s?.Path || ""}`;
+}
+function summarizeSsoPermissionSets(changes, color) {
+	const boundary = (pb) => {
+		if (pb?.ManagedPolicyArn !== void 0) return `ManagedPolicyArn: ${pb?.ManagedPolicyArn || ""}`;
+		if (pb?.CustomerManagedPolicyReference !== void 0) return `CustomerManagedPolicyReference: {\n  ${formatManagedPolicyRef(pb?.CustomerManagedPolicyReference)}\n}`;
+		return "";
+	};
+	return withHeader(color, [
+		"",
+		"Resource",
+		"InstanceArn",
+		"PermissionSet name",
+		"PermissionsBoundary",
+		"CustomerManagedPolicyReferences"
+	], ssoRows(changes.ssoPermissionSets, (f) => [
+		f.cfnLogicalId || "",
+		f.ssoInstanceArn || "",
+		f.name || "",
+		boundary(f.ssoPermissionsBoundary),
+		f.ssoCustomerManagedPolicyReferences?.map(formatManagedPolicyRef).join("\n") || ""
+	]));
+}
+function summarizeSsoInstanceACAConfigs(changes, color) {
+	const attribute = (aca) => `Key: ${aca?.Key}, Values: [${aca?.Value?.Source.join(", ")}]`;
+	return withHeader(color, [
+		"",
+		"Resource",
+		"InstanceArn",
+		"AccessControlAttributes"
+	], ssoRows(changes.ssoInstanceACAConfigs, (f) => [
+		f.cfnLogicalId || "",
+		f.ssoInstanceArn || "",
+		f.accessControlAttributes?.map(attribute).join("\n") || ""
+	]));
+}
+function summarizeSsoAssignments(changes, color) {
+	return withHeader(color, [
+		"",
+		"Resource",
+		"InstanceArn",
+		"PermissionSetArn",
+		"PrincipalId",
+		"PrincipalType",
+		"TargetId",
+		"TargetType"
+	], ssoRows(changes.ssoAssignments, (f) => [
+		f.cfnLogicalId || "",
+		f.ssoInstanceArn || "",
+		f.permissionSetArn || "",
+		f.principalId || "",
+		f.principalType || "",
+		f.targetId || "",
+		f.targetType || ""
+	]));
+}
+function summarizeSecurityGroups(changes, color) {
+	const render = (sign, dir) => (rule) => [
+		sign,
+		`${rule.groupId}`,
+		dir,
+		rule.describeProtocol(),
+		rule.describePeer()
+	];
+	return withHeader(color, [
+		"",
+		"Group",
+		"Dir",
+		"Protocol",
+		"Peer"
+	], [
+		...changes.ingress.additions.map(render("+", "In")),
+		...changes.egress.additions.map(render("+", "Out")),
+		...changes.ingress.removals.map(render("-", "In")),
+		...changes.egress.removals.map(render("-", "Out"))
+	], (row) => row[2].indexOf("In") > -1 ? 0 : 1);
+}
+function displayWidth(text) {
+	let width = 0;
+	for (const ch of text.replace(/(?:\p{Regional_Indicator}{2}|\p{Emoji_Presentation}|\p{Extended_Pictographic}\uFE0F)\p{Emoji_Modifier}?(?:\u200D(?:\p{Emoji_Presentation}|\p{Extended_Pictographic}\uFE0F?)\p{Emoji_Modifier}?)*/gu, "  ")) {
+		const code = ch.codePointAt(0);
+		if (code <= 31 || code >= 127 && code <= 159) continue;
+		if (code >= 768 && code <= 879) continue;
+		width += isFullwidth(code) ? 2 : 1;
+	}
+	return width;
+}
+function isFullwidth(c) {
+	return c >= 4352 && (c <= 4447 || c === 9001 || c === 9002 || c >= 11904 && c <= 12871 && c !== 12351 || c >= 12880 && c <= 19903 || c >= 19968 && c <= 42182 || c >= 43360 && c <= 43388 || c >= 44032 && c <= 55203 || c >= 63744 && c <= 64255 || c >= 65040 && c <= 65049 || c >= 65072 && c <= 65131 || c >= 65281 && c <= 65376 || c >= 65504 && c <= 65510 || c >= 110592 && c <= 110593 || c >= 127488 && c <= 127569 || c >= 131072 && c <= 262141);
+}
+function formatTable(cells, color) {
+	const paint = (fn) => color ? fn : (text) => text;
+	const lines = cells.map((row) => row.map((cell) => String(cell).split("\n")));
+	const widths = cells[0].map((_, i) => Math.max(...lines.map((row) => Math.max(...row[i].map(displayWidth)))));
+	const rule = (left, join, right) => paint(gray)(left + widths.map((w) => "─".repeat(w + 2)).join(join) + right);
+	const bar = paint(gray)("│");
+	const out = [rule("┌", "┬", "┐")];
+	lines.forEach((row, r) => {
+		if (r > 0 && (r === 1 || sortKey(cells[r - 1], color) !== sortKey(cells[r], color))) out.push(rule("├", "┼", "┤"));
+		const sign = r === 0 ? "" : cells[r][0];
+		const tint = paint(sign === "+" ? green : sign === "-" ? red : (text) => text);
+		const height = Math.max(...row.map((cell) => cell.length));
+		for (let l = 0; l < height; l++) {
+			const cellsOut = row.map((cell, i) => {
+				const text = cell[l] ?? "";
+				return " " + (text === "" ? "" : tint(text)) + " ".repeat(widths[i] - displayWidth(text)) + " ";
+			});
+			out.push(bar + cellsOut.join(bar) + bar);
+		}
+	});
+	out.push(rule("└", "┴", "┘"));
+	return out.join("\n");
+}
+function formatSecurityChanges(changes, logicalToPath = {}, color = stdoutSupportsColor()) {
+	if (!changes.permissionsAnyChanges) return "";
+	const paint = (fn) => color ? fn : (text) => text;
+	const substitute = (source) => source.replace(/\$\{([^.}]+)(.[^}]+)?\}/gi, (_m, logId, suffix) => {
+		const path = Object.hasOwn(logicalToPath, logId) ? logicalToPath[logId] : void 0;
+		return "${" + (path && normalizePath(path) || logId) + (suffix || "") + "}";
+	});
+	let out = "";
+	const section = (title) => {
+		out += `${paint(bold)(title)}\n`;
+	};
+	const table = (rows) => {
+		out += formatTable(rows.map((row) => row.map(substitute)), color) + "\n";
+	};
+	if (changes.statements.hasChanges) {
+		section("IAM Statement Changes");
+		table(summarizeStatements(changes, color));
+	}
+	if (changes.managedPolicies.hasChanges) {
+		section("IAM Policy Changes");
+		table(summarizeManagedPolicies(changes, color));
+	}
+	if (changes.ssoPermissionSets.hasChanges || changes.ssoInstanceACAConfigs.hasChanges || changes.ssoAssignments.hasChanges) {
+		section("IAM Identity Center Changes");
+		if (changes.ssoPermissionSets.hasChanges) table(summarizeSsoPermissionSets(changes, color));
+		if (changes.ssoInstanceACAConfigs.hasChanges) table(summarizeSsoInstanceACAConfigs(changes, color));
+		if (changes.ssoAssignments.hasChanges) table(summarizeSsoAssignments(changes, color));
+	}
+	if (changes.securityGroupsHaveChanges) {
+		section("Security Group Changes");
+		table(summarizeSecurityGroups(changes, color));
+	}
+	out += `${paint(yellow)("(NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299)")}\n`;
+	out += "\n";
+	return out;
+}
+function normalizePath(p) {
+	if (p.startsWith("/")) p = p.slice(1);
+	let parts = p.split("/");
+	if (parts.length > 1) {
+		parts = parts.slice(1);
+		if (parts.length > 1) {
+			const last = parts[parts.length - 1];
+			if (last === "Resource" || last === "Default") parts = parts.slice(0, parts.length - 1);
+		}
+		p = parts.join("/");
+	}
+	return p;
+}
+function stdoutSupportsColor(env = process.env, argv = process.argv, isTTY = process.stdout.isTTY === true, platform = process.platform) {
+	const terminator = argv.indexOf("--");
+	const hasFlag = (flag) => {
+		const position = argv.indexOf(`--${flag}`);
+		return position !== -1 && (terminator === -1 || position < terminator);
+	};
+	let force;
+	if ([
+		"no-color",
+		"no-colors",
+		"color=false",
+		"color=never"
+	].some(hasFlag)) force = 0;
+	else if ([
+		"color",
+		"colors",
+		"color=true",
+		"color=always"
+	].some(hasFlag)) force = 1;
+	const forceEnv = env["FORCE_COLOR"];
+	if (forceEnv !== void 0) {
+		if (forceEnv === "true") force = 1;
+		else if (forceEnv === "false") force = 0;
+		else force = forceEnv.length === 0 ? 1 : Math.min(parseInt(forceEnv, 10), 3);
+	}
+	if (force === 0) return false;
+	if ([
+		"color=16m",
+		"color=full",
+		"color=truecolor",
+		"color=256"
+	].some(hasFlag)) return true;
+	if (!isTTY && force === void 0) return false;
+	const min = force || 0;
+	if (env["TERM"] === "dumb") return min > 0;
+	if (platform === "win32") return true;
+	if ("CI" in env) return [
+		"TRAVIS",
+		"CIRCLECI",
+		"APPVEYOR",
+		"GITLAB_CI",
+		"GITHUB_ACTIONS",
+		"BUILDKITE"
+	].some((sign) => sign in env) || env["CI_NAME"] === "codeship" || min > 0;
+	if ("TEAMCITY_VERSION" in env) return /^(9\.(0*[1-9]\d*)\.|\d{2,}\.)/.test(env["TEAMCITY_VERSION"] ?? "");
+	if (env["COLORTERM"] === "truecolor") return true;
+	if (env["TERM_PROGRAM"] === "iTerm.app" || env["TERM_PROGRAM"] === "Apple_Terminal") return true;
+	const term = env["TERM"] ?? "";
+	if (/-256(color)?$/i.test(term)) return true;
+	if (/^screen|^xterm|^vt100|^vt220|^rxvt|color|ansi|cygwin|linux/i.test(term)) return true;
+	if ("COLORTERM" in env) return true;
+	return min > 0;
+}
+
 //#endregion
 //#region src/analyzer/security-diff.ts
 function isSyntheticChange(pc) {
@@ -39709,21 +40819,6 @@ function securityDiffTemplates(changes, records) {
 		maskedChanges
 	};
 }
-let cfnDiffModule;
-function loadCfnDiff() {
-	cfnDiffModule ??= import("@aws-cdk/cloudformation-diff").then((mod) => mod.default ?? mod);
-	return cfnDiffModule;
-}
-let cfnDiffUtilModule;
-function loadCfnDiffUtil() {
-	cfnDiffUtilModule ??= import("@aws-cdk/cloudformation-diff/lib/diff/util.js").then((mod) => mod.default ?? mod);
-	return cfnDiffUtilModule;
-}
-function isScrutinized(util, change) {
-	const model = util.loadResourceModel(change.resourceType);
-	const scrutinized = (value) => value !== void 0 && value !== "None";
-	return scrutinized(model?.scrutinizable) || scrutinized(model?.properties?.[change.path]?.scrutinizable);
-}
 async function diffSecurity(args) {
 	const templates = securityDiffTemplates(args.changes, args.records);
 	const { oldTemplate, newTemplate } = templates;
@@ -39732,9 +40827,8 @@ async function diffSecurity(args) {
 		rendered: ""
 	};
 	try {
-		const cfnDiff = await loadCfnDiff();
-		const unjudged = templates.maskedChanges.length === 0 ? [] : await loadCfnDiffUtil().then((util) => templates.maskedChanges.filter((c) => isScrutinized(util, c)));
-		const diff = cfnDiff.fullDiff(structuredClone(oldTemplate), structuredClone(newTemplate));
+		const unjudged = templates.maskedChanges.filter((c) => isScrutinizedProperty(c.resourceType, c.path));
+		const diff = new SecurityChanges(structuredClone(oldTemplate), structuredClone(newTemplate));
 		const broadening = diff.permissionsBroadened || unjudged.length > 0;
 		const unjudgedNote = unjudged.length === 0 ? "" : "These changed values are masked, so whether they broaden permissions could not be evaluated:\n" + unjudged.map((c) => `  ${c.logicalId} (${c.resourceType}): ${c.path}\n`).join("");
 		if (!diff.permissionsBroadened && !diff.permissionsAnyChanges) return {
@@ -39744,12 +40838,8 @@ async function diffSecurity(args) {
 		let table;
 		try {
 			const shown = args.secretMask === void 0 ? void 0 : withholdSecrets(templates, args.secretMask());
-			const shownDiff = shown === void 0 || shown.masked === 0 ? diff : cfnDiff.fullDiff(shown.templates.oldTemplate, shown.templates.newTemplate);
-			table = "";
-			cfnDiff.formatSecurityChanges({ write(chunk) {
-				table += String(chunk);
-				return true;
-			} }, shownDiff, logicalIdToPath(args.records, args.template));
+			const shownDiff = shown === void 0 || shown.masked === 0 ? diff : new SecurityChanges(shown.templates.oldTemplate, shown.templates.newTemplate);
+			table = formatSecurityChanges(shownDiff, logicalIdToPath(args.records, args.template));
 			if (shown !== void 0 && shown.masked > 0) table += "(Values that hold a secret are shown as ***.)\n";
 		} catch {
 			table = "The security changes are not shown: they could not be checked for secrets.\n";
@@ -40246,9 +41336,11 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	const createOnlyEvidence = acceptedCreateOnlyDropsOf(currentResource);
 	const recordedAsWritten = currentResource.provisionedBy === "cc-api" ? currentProps : withoutUnwrittenSilentDropProperties(resourceType, currentProps, desiredForSkipCheck, allowedForRecord, createOnlyEvidence);
 	const unmarkedRecord = noEchoLeavesOf(currentResource) === void 0;
-	const todayAsWritten = unmarkedRecord ? redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), withoutNoEchoParameterEntries(updateSecrets), desiredProps) : void 0;
+	const todayAsWritten = unmarkedRecord || witnessNormalize(recordedAsWritten, void 0, desiredForSkipCheckAsWritten).differing.length > 0 ? redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), withoutNoEchoParameterEntries(updateSecrets), desiredProps) : void 0;
 	const witness = todayAsWritten === void 0 ? void 0 : witnessNormalize(recordedAsWritten, todayAsWritten, desiredForSkipCheckAsWritten);
 	const currentPropsAsWritten = witness === void 0 ? recordedAsWritten : witness.current;
+	const witnessMigrates = unmarkedRecord || (witness?.confirmed.length ?? 0) > 0;
+	if (!unmarkedRecord && witness !== void 0 && witness.confirmed.length > 0) this.witnessConfirmedLeaves.set(logicalId, witness.confirmed.map((coordinate) => [...coordinate]));
 	for (const coordinate of witness?.differing ?? []) {
 		const desiredAt = valueAtCoordinate(desiredForSkipCheckAsWritten, coordinate);
 		recordPreviousNoEchoLeaves(this.secretNameBagFor(logicalId), valueAtCoordinate(recordedAsWritten, coordinate), scalarLeavesOf(desiredAt), updateSecrets, desiredAt !== "***");
@@ -40305,7 +41397,8 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		this.logger.warn(cause === "parameter" ? safeMsg`${logicalId}.${key} is a create-only property, and a NoEcho parameter's value changed since the last deploy: ${logicalId} is replaced.` : safeMsg`${logicalId}.${key} is a create-only property, and the value at its NoEcho position changed since the last deploy: ${logicalId} is replaced.`);
 	};
 	const suppliesFreshMaskOnlyValue = pendingParameterLeaves.size > 0 || Object.keys(resolvedProps).some((key) => otherFreshAt(key).length > 0);
-	const recordMatchesDesired = movedMasked.size === 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten);
+	const rewrittenPaths = readsProducerReplacedThisRun.call(this, template, logicalId, stateResources) ? redactionRewrittenPaths(resolvedProps, desiredForSkipCheck, comparisonCoordinates) : /* @__PURE__ */ new Set();
+	const recordMatchesDesired = movedMasked.size === 0 && rewrittenPaths.size === 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten);
 	const applyAttributeOnlyUpdate = (attributeChanges) => {
 		const attrSummary = attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
 		this.logger.info(safeMsg`  ↻ ${logicalId} (${resourceType}) attribute update: ${attrSummary}`);
@@ -40321,7 +41414,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	};
 	const schemaCreateOnly = pendingParameterLeaves.size === 0 && parameterCoordinates.length === 0 ? [] : await getCreateOnlyPropertyPaths(resourceType).catch(() => []);
 	const echoCandidates = echoFidelityCandidates(parameterCoordinates, resolvedProps, schemaCreateOnly);
-	const readbackRecord = unmarkedRecord && parameterCoordinates.length > 0 ? {
+	const readbackRecord = witnessMigrates && parameterCoordinates.length > 0 ? {
 		...currentResource,
 		properties: maskAtCoordinates(currentResource.properties, parameterCoordinates)
 	} : currentResource;
@@ -40378,7 +41471,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	};
 	const lateReplacementDeclined = /* @__PURE__ */ new Set();
 	const differsWhy = (key) => !lateReplacementDeclined.has(key) ? "differs; the provider is not known to report this property exactly, so the difference may be its normalization" : lateCrossPrefixRefused ? "differs; the replacement was refused: see the state-prefix warning above" : `differs; the replacement was not approved (--require-approval=${this.options.requireApproval ?? "never"})`;
-	if (unmarkedRecord && !typeChanged && echoCandidates.length > 0 && hasAddressablePhysicalId(currentResource)) await readOnce();
+	if (witnessMigrates && !typeChanged && echoCandidates.length > 0 && hasAddressablePhysicalId(currentResource)) await readOnce();
 	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && recordMatchesDesired) {
 		if (change.attributeChanges && change.attributeChanges.length > 0) {
 			applyAttributeOnlyUpdate(change.attributeChanges);
@@ -40409,7 +41502,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 				lowered.push(pc);
 				continue;
 			}
-			const moved = movedMasked.has(pc.path) || keyOrderFreeJson(desiredForSkipCheckAsWritten[pc.path]) !== keyOrderFreeJson(currentPropsAsWritten[pc.path]);
+			const moved = movedMasked.has(pc.path) || rewrittenPaths.has(pc.path) || keyOrderFreeJson(desiredForSkipCheckAsWritten[pc.path]) !== keyOrderFreeJson(currentPropsAsWritten[pc.path]);
 			const conditionalVerdict = moved && !typeChanged && isReplacementCeiling(pc) ? this.diffCalculator.conditionalReplacementVerdict?.(resourceType, pc.path, currentPropsAsWritten[pc.path], desiredForSkipCheckAsWritten[pc.path]) : void 0;
 			if (moved && conditionalVerdict !== false) {
 				warnWitnessReplacement(pc.path);
@@ -40463,7 +41556,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 			return liveHoldsFreshLeaves(read.live[key], pendingParameterLeaves.get(key) ?? []) ? "held" : "differs";
 		};
 		const lowered = [];
-		const movedAt = (path) => movedMasked.has(path) || keyOrderFreeJson(desiredForSkipCheckAsWritten[path]) !== keyOrderFreeJson(currentPropsAsWritten[path]);
+		const movedAt = (path) => movedMasked.has(path) || rewrittenPaths.has(path) || keyOrderFreeJson(desiredForSkipCheckAsWritten[path]) !== keyOrderFreeJson(currentPropsAsWritten[path]);
 		replacedAnyway = this.recreateDirectionFor(stackName, logicalId) !== void 0 || lostWithParent !== void 0 || (change.propertyChanges ?? []).some((other) => other.requiresReplacement && (!parameterCreateOnlyPaths.has(other.path) || movedAt(other.path)));
 		for (const pc of change.propertyChanges ?? []) {
 			if (!parameterCreateOnlyPaths.has(pc.path)) {
@@ -40613,11 +41706,16 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		diffSawTokenChange: diffMovedServiceToken(change)
 	});
 	if (serviceTokenRefusal !== void 0) throw markRefusedBeforeApplying(markNonRetryable(new CdkdError(renderServiceTokenRefusal([serviceTokenRefusal], stackName, createSecretMasker(updateSecrets)), SERVICE_TOKEN_CHANGE_REFUSED)));
+	let previousForProvider = currentPropsAsWritten;
+	for (const coordinate of witness?.confirmed ?? []) {
+		const value = valueAtCoordinate(resolvedProps, coordinate);
+		if (value !== void 0) previousForProvider = setAtCoordinate(previousForProvider, coordinate, value);
+	}
 	return markRestored(await this.updateInPlace({
 		conditions,
 		counts,
 		currentProps,
-		currentPropsAsWritten,
+		currentPropsAsWritten: previousForProvider,
 		currentResource,
 		dependencies,
 		desiredForSkipCheckAsWritten,
@@ -40669,6 +41767,18 @@ function recordHoldsEmbeddedReference(record) {
 	};
 	return walk(record.properties) || walk(record.attributes);
 }
+function redactionRewrittenPaths(resolvedProps, desiredForSkipCheck, comparisonCoordinates) {
+	const masked = maskAtCoordinates({ ...resolvedProps }, comparisonCoordinates);
+	return new Set(Object.keys(masked).filter((key) => keyOrderFreeJson(masked[key]) !== keyOrderFreeJson(desiredForSkipCheck[key])));
+}
+function readsProducerReplacedThisRun(template, logicalId, stateResources) {
+	return (this.extractAllDependencies(template, logicalId) ?? []).some((id) => {
+		const loaded = Object.hasOwn(this.healBaseline, id) ? this.healBaseline[id] : void 0;
+		if (loaded === void 0) return false;
+		const now = Object.hasOwn(stateResources, id) ? stateResources[id] : void 0;
+		return now !== void 0 && now.physicalId !== loaded.physicalId;
+	});
+}
 
 //#endregion
 //#region src/deployment/deploy-engine/update-replace.ts
@@ -43426,6 +44536,7 @@ function promoteRecreateTargets(changes, recreateTargets, stackName) {
 
 //#endregion
 //#region src/deployment/deploy-engine/deploy-flow.ts
+const TAIL_WARM_CONNECTIONS = 3;
 async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 	const startTime = Date.now();
 	this.logger.debug(`Starting deployment for stack: ${stackName}`);
@@ -43447,6 +44558,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		throw error;
 	}
 	let firstDeployStateGate;
+	let exportsPrefetch;
 	let firstDeploy = false;
 	let failed = false;
 	try {
@@ -43464,6 +44576,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		};
 		const currentEtag = currentStateData?.etag;
 		this.healBaseline = currentState.resources ?? {};
+		this.runProducerRegionEvidence = () => this.producerRegionEvidence(currentState);
 		refuseMalformedOutputs(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
 		refuseMalformedResourcesForDeploy(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
 		refuseMalformedResourceEntriesForDeploy(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
@@ -43480,8 +44593,17 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 				gate.catch(() => void 0);
 			} else await gate;
 		}
+		const gate = firstDeployStateGate;
+		const afterGate = (start) => (gate === void 0 ? Promise.resolve() : gate).then(start, () => void 0).catch(() => void 0);
+		if (!this.options.dryRun) {
+			prefetchCreateTokenLedger();
+			const exportIndexStore = this.exportIndexStore;
+			if (exportIndexStore && importableOutputKeys(currentState).length === 0) exportsPrefetch = afterGate(() => exportIndexStore.prefetch());
+		}
+		this.absentJournalVersionPurge = void 0;
 		try {
 			const loaded = await this.stateBackend.loadRollbackJournal(stackName, this.stackRegion);
+			if (loaded === null && !this.options.parentStackInfo && !this.options.dryRun) this.absentJournalVersionPurge = afterGate(() => this.stateBackend.purgeRollbackJournalVersions(stackName, this.stackRegion));
 			const journal = loaded && {
 				...loaded,
 				segments: loaded.segments.filter((s) => s.reason !== "nested-pending-parent")
@@ -43774,6 +44896,9 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			total: createChanges.length + updateChanges.length + deleteChanges.length
 		};
 		const { state: newState, actualCounts, completedOperations } = await withProducerRegions(() => this.producerRegionEvidence(currentState), () => this.executeDeployment(effectiveTemplate, currentState, changes, dag, executionLevels, stackName, outputsDigestSource, parameterValues, conditions, currentEtag, progress, migrationPending));
+		try {
+			this.stateBackend.warmConnections(stackName, this.stackRegion, TAIL_WARM_CONNECTIONS);
+		} catch {}
 		await this.drainObservedCaptures(newState.resources);
 		const [newEtag] = await Promise.all([this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(conditionVerdicts ? {
 			...newState,
@@ -43828,6 +44953,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			await flushKeptForReadoption(this);
 			await this.generatedNameGuard?.settle();
 		} catch {}
+		await Promise.all([this.absentJournalVersionPurge, exportsPrefetch]);
 		if (firstDeploy && failed && this.options.onFirstDeployLeftNoRecord && !this.options.dryRun) try {
 			const left = await this.stateBackend.getState(stackName, this.stackRegion);
 			const journal = left === null ? await this.stateBackend.loadRollbackJournal(stackName, this.stackRegion) : void 0;
@@ -44050,6 +45176,7 @@ var DeployEngine = class {
 	interrupted = false;
 	interruptCause = null;
 	observedCaptureTasks = /* @__PURE__ */ new Map();
+	absentJournalVersionPurge;
 	noEchoCeilingReadbackTimeoutMs = 3e4;
 	recapturedBaselines = /* @__PURE__ */ new WeakMap();
 	stateBackend;
@@ -44075,6 +45202,7 @@ var DeployEngine = class {
 	secretNameNeedles = /* @__PURE__ */ new Map();
 	perResourceTemplateProps = /* @__PURE__ */ new Map();
 	perResourceResolvedType = /* @__PURE__ */ new Map();
+	witnessConfirmedLeaves = /* @__PURE__ */ new Map();
 	fingerprintNoEchoValues = void 0;
 	preDeploySecretNamedRecords = void 0;
 	fingerprintParameters = void 0;
@@ -44098,6 +45226,7 @@ var DeployEngine = class {
 	updateWasReplaced = /* @__PURE__ */ new Map();
 	oldDeletedBeforeCreate = /* @__PURE__ */ new Set();
 	healBaseline = {};
+	runProducerRegionEvidence = void 0;
 	deployChanges = /* @__PURE__ */ new Map();
 	deployStateResources = {};
 	stackRecordsView = void 0;
@@ -44145,6 +45274,7 @@ var DeployEngine = class {
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
 		this.constructPathTemplate = void 0;
 		this.perResourceResolvedType = /* @__PURE__ */ new Map();
+		this.witnessConfirmedLeaves = /* @__PURE__ */ new Map();
 		this.fingerprintNoEchoValues = void 0;
 		this.preDeploySecretNamedRecords = void 0;
 		this.fingerprintParameters = void 0;
@@ -44165,6 +45295,7 @@ var DeployEngine = class {
 		this.updateWasReplaced = /* @__PURE__ */ new Map();
 		this.oldDeletedBeforeCreate = /* @__PURE__ */ new Set();
 		this.healBaseline = {};
+		this.runProducerRegionEvidence = void 0;
 		this.deployChanges = /* @__PURE__ */ new Map();
 		this.deployStateResources = {};
 		this.inlinePolicyWriters = /* @__PURE__ */ new Map();
@@ -44383,5 +45514,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { isTruthyCfnBoolean as $, isStatefulRecreateTargetForReplace as $a, CFN_TEMPLATE_URL_LIMIT as $c, malformedOrphansRefusalMessage as $i, ledgerForStack as $n, markSameGenerationBag as $o, assertSendableRoleArn as $r, stringifyValue as $s, seedsDeleteFirstGuard as $t, noEchoComparisonForTemplate as A, refuseMalformedResourcesForDeploy as Aa, runDockerForeground as Ac, declaresNoEcho as Ai, journaledOrphanPrintingBag as An, maskWholeValue as Ao, deleteIndeterminateGuards as Ar, S3StateBackend as As, dropFailedHint as At, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as B, unpreviewableOrphanRecords as Ba, getLegacyStateBucketName as Bc, hasReadableOutputs as Bi, PRE_DELETE_SNAPSHOT_TYPES as Bn, carryLogOnlyValues as Bo, reDisableInstanceApiTermination as Br, describeRegionValueKind as Bs, getStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedResourceEntriesForImport as Ca, formatDockerLoginError as Cc, cfnRefValueFromPhysicalId as Ci, resolveBucketRegion as Cl, collectDeclaredOutputNames as Cn, sameLambdaFunctionAddress as Co, applyCustomResourceResponseExpiration as Cr, STATE_SOURCED_CROSS_GENERATION_RULES as Cs, revertNestedChildFromJournal as Ct, withResourceDeadline as D, refuseMalformedResourcePropertiesForDrift as Da, partitionSensitiveEnv as Dc, withSharedDrainBudget as Di, DEFAULT_RESOURCE_TIMEOUT_MS as Dn, isMarkedCoordinate as Do, unchangedBehindSecretReference as Dr, isSingleDynamicReferenceToken as Ds, getCurrentNestedStackContext as Dt, serviceTokenBlockingReason as E, refuseMalformedResourcePropertiesForDestroy as Ea, isMalformedEnvKey as Ec, parseWebACLArn as Ei, bindingSkippedOutputs as En, canonicalCoordinates as Eo, slowCcOperationTimeoutMs as Er, WHOLE_DYNAMIC_REFERENCE_PATTERN as Es, collectNestedChildUnaddressed as Et, PROTECTION_PROPERTY_BY_TYPE as F, repairMalformedOrphansForReadOnly as Fa, AssetManifestLoader as Fc, UNREADABLE_RESOURCES_MAP_ROW as Fi, secretNamedRecordNeedles as Fn, passedNoEchoParametersOf as Fo, markWaitAbandoned as Fr, crossPrefixDeniedWarning as Fs, sameJournaledOrphans as Ft, resolveDynamoDbDeleteBudgetMs as G, findSilentDropProperties as Ga, resolveSkipPrefix as Gc, malformedExportNamesWarning as Gi, isFinalSnapshotError as Gn, printingCorpusOf as Go, poisonRenderedSpellingsCollidingIn as Gr, importableOutputKeys as Gs, isJournaledOrphan as Gt, compensateRemovedDeletionProtection as H, unreadableResourceEntries as Ha, resolveApp as Hc, isReadableOrphanRecord as Hi, ccRoutedFinalSnapshotError as Hn, hasMaskableValues as Ho, DiffCalculator as Hr, hasReadableExportSet as Hs, removeProtectionTypeList as Ht, isProtectionValueActive as I, repairMalformedOutputsForReadOnly as Ia, getDockerImageBySourceHash as Ic, accountArgs as Ii, stateSecretNameNeedles as In, readbackPathFor as Io, disableInstanceApiTermination as Ir, isAccessDenied$1 as Is, replayFailedOperations as It, deleteTableWithIndexBusyRetry as J, NO_CC_HANDLERS_REASON as Ja, resolveUseCdkBootstrapAssets as Jc, malformedLocalResourceEntriesWarning as Ji, maskingRetryLogger as Jn, shareLogOnlyValues as Jo, regionLessSecretName as Jr, orphansAfterRollback as Js, planRollback as Jt, DELETE_INDEX_WAIT_PROCEED_NOTE as K, unwrittenCreateOnlyReplacement as Ka, resolveStateBucketWithDefault as Kc, malformedExportSourceWarning as Ki, refusesFinalSnapshot as Kn, recordLogOnlyParameterValue as Ko, classifyReplaySecretRegion as Kr, importableOutputs as Ks, isReplacementOrphan as Kt, perType as L, repairMalformedResourceEntriesForReadOnly as La, Synthesizer as Lc, deployRefusesOrphanRowsReason as Li, storedSecretNameNeedles as Ln, readsNoEchoSource as Lo, ec2InstanceProtectionSite as Lr, isNotImplemented as Ls, replayRollback as Lt, noEchoParameterNamesOf as M, refuseMalformedResourcesForExport as Ma, warnFinchArgvExposure as Mc, STATE_REGION_DIVERGED as Mi, orphanRecordsPrintingBag as Mn, noEchoCoordinatesOf as Mo, deleteSkipReason as Mr, CrossPrefixReadError as Ms, journaledOrphanLines as Mt, recordedProtectionEvidence as N, refuseMalformedState as Na, escapeRegExp$3 as Nc, STATE_RESOURCES_MALFORMED as Ni, secretNamePrintingBag as Nn, noEchoLeavesOf as No, withIndeterminateGuard as Nr, CrossPrefixScanCache as Ns, loadJournaledOrphans as Nt, diffSecurity as O, refuseMalformedResourcePropertiesForExport as Oa, redactDockerArgvValues as Oc, parameterInputsFor as Oi, DEFAULT_RESOURCE_WARN_AFTER_MS as On, maskAtCoordinates as Oo, RollbackInlinePolicyWriters as Or, LockManager as Os, withNestedStackContext as Ot, recordedProtectionNote as P, repairMalformedOrphanRecordsForReadOnly as Pa, stripControlChars as Pc, UNREADABLE_ORPHANS_CONTAINER_ROW as Pi, secretNamePrintingBags as Pn, noEchoOutputsComparison as Po, isWaitAbandonedError as Pr, applyCrossPrefixScan as Ps, makeForeignHolderScan as Pt, hasCdkAutoDeleteTag as Q, MULTI_REGION_RECREATE_BLOCKED_TYPES as Qa, CFN_TEMPLATE_BODY_LIMIT as Qc, malformedOrphanRowsKeptWarning as Qi, earliestDefined as Qn, maskSecretsInText as Qo, assertFlagRoleArn as Qr, isSensitiveAttributeName as Qs, resolveReplacementOldType as Qt, readProtection as R, repairMalformedResourcePropertiesForReadOnly as Ra, synthesisStatusMessage as Rc, displayLogicalId as Ri, extractDeploymentEventError as Rn, valueAtCoordinate as Ro, isTerminationProtectionPropagationError as Rr, splitImportedOps as Rs, awaitInFlightSibling as Rt, keptForReadoption as S, refuseMalformedResourceEntriesForDestroy as Sa, finchSecretArgvRefusal as Sc, AWS_NO_VALUE as Si, clearBucketRegionCache as Sl, noEchoParameterValueSeed as Sn, lambdaFunctionNameForMask as So, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Sr, STATE_SOURCED_BASELINE_RULES as Ss, recordDisplacedSkips as St, findServiceTokenRefusals as T, refuseMalformedResourceEntriesForOrphan as Ta, isDockerClientEnvKey as Tc, refStateLookupFromResource as Ti, isExportAliasCollision as Tn, TemplateParser as To, CloudControlProvider as Tr, TEMPLATE_SOURCED_RULES as Ts, withNestedRevertRun as Tt, deleteBudgetKey as U, withheldAccountClause as Ua, resolveAutoAssetStorage as Uc, isReadableResourceEntry as Ui, createPreDeleteFinalSnapshot as Un, literalSplitDelimitersOf as Uo, INTRINSIC_KEYS as Ur, hasReasonlessBaselineRefusal as Us, recordAfterRollbackUpdate as Ut, beginDeleteWait as V, unreadableOrphanRecords as Va, loadCdkJson as Vc, hasReadableResources as Vi, buildFinalSnapshotIdentifier as Vn, createUnionSecretMasker as Vo, reEnableInstanceApiTermination as Vr, exportNamesCarriedFrom as Vs, withStackRecords as Vt, resolveDynamoDbDeleteBudgetClock as W, findActionableSilentDrops as Wa, resolveCaptureObservedState as Wc, malformedDriftResourcePropertiesWarning as Wi, effectiveDeletionPolicy as Wn, logOnlyValueCount as Wo, IntrinsicFunctionResolver as Wr, hasUnverifiableParameterRefusal as Ws, demoteSupersededOrphans as Wt, ECR_AUTO_DELETE_IMAGES_TAG as X, findReplacedReadersOfRecreateTargets as Xa, warnDeprecatedNoPrefixCliFlag as Xc, malformedOrphanRecordsRefusalMessage as Xi, findDestructiveChanges as Xn, errorCauseChain as Xo, refuseUnreadableCdkCrossAccountRefs as Xr, shouldRetainResource as Xs, recordUnderIdIsNotOwn as Xt, waitForIndexesSettled as Y, hasNoCloudControlHandlers as Ya, stateBucketExistenceConfirmed as Yc, malformedLocalResourcesWarning as Yi, constructPathOf as Yn, createSecretMasker as Yo, producerLookupOver as Yr, orphansCarriedFrom as Ys, recheckFailedPlan as Yt, S3_AUTO_DELETE_OBJECTS_TAG as Z, shownType as Za, ssmResolvedValueType as Zc, malformedOrphanRecordsWarning as Zi, formatDestructiveChange as Zn, maskSecretsInError as Zo, applyRoleArnIfSet as Zr, AssetPublisher as Zs, replacementNeverSwapped as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedOutputs as _a, resolveDockerContextDirectory as _c, isImpossibleEmptyStoredAttribute as _i, absoluteAssemblyPathEscape as _l, secretSafeKeyDisplay as _n, prefetchCreateOnlyPropertyPaths as _o, TemplateNoEchoReresolver as _r, recordMaskOnlyValuesIn as _s, displacedOpClause as _t, findNestedTemplateTreeDefect as a, malformedResourcePropertiesWarning as aa, AssetModeResolver as ac, callerEnvCredentials as ai, expectedOwnerParam as al, isRedactedRecordedValue as an, toCfnInteger as ao, planTagDiff as ar, DYNAMIC_REFERENCE_TOKEN_SCAN as as, cyan as at, lookupEachName as b, refuseMalformedResourceEntries as ba, describeDockerFailure as bc, isNamelessDynamicReferenceError as bi, renderAssemblyPathEscape as bl, exportNameSecretExposure as bn, withRetry as bo, getCurrentResourceSecrets as br, recordProvenPublicExpression as bs, getNestedRevertRun as bt, renderNestedTemplateTreeDefect as c, malformedStateRefusalMessage as ca, ensureAssetStorage as cc, s3BucketArn as ci, derivePartitionAndUrlSuffix as cl, updatePartialMessage as cn, coerceCfnInteger as co, tagMapAsList as cr, pathCrossesDottedKey as cs, red as ct, conditionInputsFrom as d, refuseMalformedNestedChildOutputs as da, parseBootstrapMarker as dc, s3BucketRegionalDomainName as di, processStackMessages as dl, DeploymentEventsStore as dn, configStringRefusal as do, stringifyIfAssigned as dr, recordNestedStackParameterExpressions as ds, namesAnyDeclaredParameter as dt, malformedOrphansWarning as ea, WorkGraph as ec, explicitRoleArnOrThrow as ei, MIGRATE_TMP_PREFIX as el, orphanDeleteNeedsIdentity as en, isStatefulRecreateTargetSync as eo, reserveStackCreateToken as er, redactSecretsForState as es, getPriorAttempts as et, parentSuppliedValues as f, refuseMalformedOrphanRecords as fa, readBootstrapMarkerBody as fc, s3BucketWebsiteUrl as fi, defineOwnKey as fl, WITHHELD_NAME_DISPLAY as fn, readConfigString as fo, CC_BROKEN_REASON as fr, recoverMaskedOutput as fs, reachableDivergentParameters as ft, mergeNoChangeOutputs as g, refuseMalformedOrphansForOrphan as ga, buildDockerImage as gc, getAccountInfo as gi, ownValue as gl, secretBearingStateKeyWarning as gn, requireConfigString as go, wouldReturnToSdkProvider as gr, recordMaskOnlyValue as gs, NESTED_PENDING_PARENT_REASON as gt, keptWholeReasonText as h, refuseMalformedOrphansForDestroy as ha, buildDenyExternalAccessPolicy as hc, parameterTypeMayLoseSecretIdentity as hi, nullPrototypeRecord as hl, secretBearing as hn, requireConfigObject as ho, isCustomResource as hr, provenPublicValue as hs, planOrphanAdoption as ht, childTemplateLoader as i, malformedResourceEntriesWarning as ia, rewriteTemplateAssetReferences as ic, applyCallerIdentityCredentials as ii, decodeListingKey as il, REDACTED_DELETE_ADDRESS_SKIP_REASON as in, isWarmThroughputDecrease as io, DBPROXY_TAG_OPTIONS as ir, recordPhysicalNameCopy as is, bold as it, noEchoExactEchoLeavesOf as j, refuseMalformedResourcesForDestroy as ja, runDockerStreaming as jc, JSON_LISTING_HOLE_VALUE as ji, maskEventTextWithBoundBags as jn, maskedLeafCoordinatesOf as jo, deleteLeftInPlace as jr, rebuildClientForBucketRegion as js, isHandledOrphan as jt, noEchoAttributeNamesOf as k, refuseMalformedResourcePropertiesForOrphan as ka, redactedDockerCause as kc, passedParameterClassesOf as ki, completedReplayEntries as kn, maskReadbackAtCoordinates as ko, UNSPECIFIED_SKIP_REASON as kr, isLockInfoExpired as ks, deleteJournaledOrphans as kt, templateIdentity as l, previewableOrphanRecords as la, getBootstrapMarkerKey as lc, s3BucketDomainName as li, AssemblyReader as ll, updatePartialReason as ln, configBooleanRefusal as lo, tagPlanWarning as lr, identityKeyFor as ls, yellow as lt, isSecretBearingReferenceString as m, refuseMalformedOrphans as ma, validateContainerRepoName as mc, isUnboundTemplateParameter as mi, hasPlainPrototype$1 as ml, exportAliasCollisionScrubWarning as mn, requireConfigArray as mo, ccBrokenReason as mr, carriesSecretMask as ms, makeSiblingClaimReader as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedOutputsWarning as na, createAssetRedirectResolver as nc, sendableAssumeRoleCommand as ni, uploadCfnTemplate as nl, getCurrentProducerRegions as nn, WARM_THROUGHPUT_MEMBERS as no, acquireIdempotencyToken as nr, withPhysicalNameCopies as ns, formatResourceLine as nt, isAbsoluteAssetPath as o, malformedResourcesWarning as oa, BOOTSTRAP_MARKER_PREFIX as oc, envCredentialsAreAssumedRole as oi, PARTITION_TABLE as ol, redactedDeleteAddressFields as on, toFiniteNumber as oo, readTagList as or, dynamicReferenceTokens as os, gray as ot, readRecordedConditionVerdicts as p, refuseMalformedOrphanRecordsForDestroy as pa, validateAssetBucketName as pc, coerceParameterTypedValue as pi, hasOwnKey as pl, displayTextOrWithheld as pn, replayWarn as po, ProviderRegistry as pr, splitGetAttStringForm as ps, resourcesNamingDeclaredParameter as pt, INDEX_SETTLE_POLL_INTERVAL_MS as q, withoutSilentDropProperties as qa, resolveStateBucketWithDefaultAndSource as qc, malformedLocalOutputsWarning as qi, unsupportedFinalSnapshotError as qn, recordLogOnlyValue as qo, producerRegionsFromState as qr, isReadableBag as qs, planFailedOps as qt, computeImplicitDeleteEdges as r, malformedRenderedContainersWarning as ra, loadPublishableAssetManifest as rc, AWS_CREDENTIAL_ENV_KEYS as ri, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as rl, inheritProducerRegions as rn, coerceWarmThroughput as ro, DBPROXY_TAGS_WHAT as rr, withoutPhysicalNameCopies as rs, createReadOnlyAttributeHealerFactory as rt, listNestedTemplateRows as s, malformedScrubResourceEntriesRefusalMessage as sa, assertAssetBucketRegion as sc, isSettledInstanceState as si, canonicalizeRegion as sl, redactedDeleteAddressSkip as sn, coerceCfnBoolean as so, refuseMalformedDesiredTags as sr, isUncertifiedBaselineMaskPosition as ss, green as st, DeployEngine as t, malformedOutputsRefusalMessage as ta, buildAssetRedirectMap as tc, isIamRoleArn as ti, findLargeInlineResources as tl, findNestedStackTypeChanges as tn, renderStatefulReason as to, withCreateTokenLedger as tr, scrubResourceRecord as ts, markRefusedBeforeApplying as tt, conditionFingerprint as u, refuseDivergentRecordRegionForDestroy as ua, isCrossRegionRedirect as uc, s3BucketDualStackDomainName as ui, StageLoadError as ul, DeploymentEventsReader as un, configIntegerRefusal as uo, definedAttributes as ur, inheritNestedStackParameterAssociations as us, computeParameterTaint as ut, chunks as v, refuseMalformedOutputsForDestroy as va, describeDockerCapturedOutput as vc, carriesDynamicReference as vi, describeFileReadFailure as vl, carriedExportAliasExposure as vn, templateResourceTypes as vo, readsNoEchoDeleteValues as vr, recordNoEchoAttributeValues as vs, displacedPhysicalIdShown as vt, deferredServiceTokenWarning as w, refuseMalformedResourceEntriesForImportSave as wa, getDockerCmd as wc, isStalePlaceholderArnAttribute as wi, collectPublishedOutputNames as wn, DagBuilder as wo, customResourceResponseExpirationWarning as wr, STATE_SOURCED_READBACK_RULES as ws, revertedNestedRowIds as wt, withApiLimit as x, refuseMalformedResourceEntriesForDeploy as xa, dockerSpawnEnvWithSensitive as xc, keepsSecretReferenceToken as xi, resolveAssemblyPath as xl, isWholeDynamicReferenceValue as xn, canonicalLambdaFunctionName as xo, withPrintingSecrets as xr, wholeStringLeavesOf as xs, nestedChildStackName as xt, isAccessDeniedError as y, refuseMalformedResourceAttributesForOrphan as ya, describeDockerExecFailure as yc, carriesFetchableDynamicReference as yi, displayAssemblyPath as yl, exportNameNoEchoParameters as yn, describeTypeWithThrottleRetry as yo, isCustomResourceType as yr, recordNoEchoParameterFreshValue as ys, dropSettledNestedJournals as yt, DynamoDBGlobalTableProvider as z, repairMalformedResourcesForReadOnly as za, getDefaultStateBucketName as zc, hasReadableOrphans as zi, ATOMIC_FINAL_SNAPSHOT_TYPES as zn, liveMatchesUnresolvedTokenFrame as zo, observeThenDisableInstanceApiTermination as zr, acceptedCreateOnlyDropsOf as zs, destroyStackRecordsView as zt };
-//# sourceMappingURL=deploy-engine-CJTG3tft.js.map
+export { isTruthyCfnBoolean as $, isStatefulRecreateTargetForReplace as $a, CFN_TEMPLATE_BODY_LIMIT as $c, malformedOrphansRefusalMessage as $i, ledgerForStack as $n, markSameGenerationBag as $o, sendableAssumeRoleCommand as $r, isSensitiveAttributeName as $s, seedsDeleteFirstGuard as $t, noEchoComparisonForTemplate as A, refuseMalformedResourcesForDeploy as Aa, redactedDockerCause as Ac, declaresNoEcho as Ai, journaledOrphanPrintingBag as An, maskWholeValue as Ao, deleteIndeterminateGuards as Ar, isLockInfoExpired as As, dropFailedHint as At, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as B, unpreviewableOrphanRecords as Ba, getDefaultStateBucketName as Bc, hasReadableOutputs as Bi, PRE_DELETE_SNAPSHOT_TYPES as Bn, carryLogOnlyValues as Bo, reDisableInstanceApiTermination as Br, acceptedCreateOnlyDropsOf as Bs, getStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedResourceEntriesForImport as Ca, finchSecretArgvRefusal as Cc, cfnRefValueFromPhysicalId as Ci, clearBucketRegionCache as Cl, collectDeclaredOutputNames as Cn, sameLambdaFunctionAddress as Co, applyCustomResourceResponseExpiration as Cr, STATE_SOURCED_BASELINE_RULES as Cs, revertNestedChildFromJournal as Ct, withResourceDeadline as D, refuseMalformedResourcePropertiesForDrift as Da, isMalformedEnvKey as Dc, withSharedDrainBudget as Di, DEFAULT_RESOURCE_TIMEOUT_MS as Dn, isMarkedCoordinate as Do, unchangedBehindSecretReference as Dr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ds, getCurrentNestedStackContext as Dt, serviceTokenBlockingReason as E, refuseMalformedResourcePropertiesForDestroy as Ea, isDockerClientEnvKey as Ec, parseWebACLArn as Ei, bindingSkippedOutputs as En, canonicalCoordinates as Eo, slowCcOperationTimeoutMs as Er, TEMPLATE_SOURCED_RULES as Es, collectNestedChildUnaddressed as Et, PROTECTION_PROPERTY_BY_TYPE as F, repairMalformedOrphansForReadOnly as Fa, stripControlChars as Fc, UNREADABLE_RESOURCES_MAP_ROW as Fi, secretNamedRecordNeedles as Fn, passedNoEchoParametersOf as Fo, markWaitAbandoned as Fr, applyCrossPrefixScan as Fs, sameJournaledOrphans as Ft, resolveDynamoDbDeleteBudgetMs as G, findSilentDropProperties as Ga, resolveCaptureObservedState as Gc, malformedExportNamesWarning as Gi, isFinalSnapshotError as Gn, printingCorpusOf as Go, poisonRenderedSpellingsCollidingIn as Gr, hasUnverifiableParameterRefusal as Gs, isJournaledOrphan as Gt, compensateRemovedDeletionProtection as H, unreadableResourceEntries as Ha, loadCdkJson as Hc, isReadableOrphanRecord as Hi, ccRoutedFinalSnapshotError as Hn, hasMaskableValues as Ho, DiffCalculator as Hr, exportNamesCarriedFrom as Hs, removeProtectionTypeList as Ht, isProtectionValueActive as I, repairMalformedOutputsForReadOnly as Ia, AssetManifestLoader as Ic, accountArgs as Ii, stateSecretNameNeedles as In, readbackPathFor as Io, disableInstanceApiTermination as Ir, crossPrefixDeniedWarning as Is, replayFailedOperations as It, deleteTableWithIndexBusyRetry as J, NO_CC_HANDLERS_REASON as Ja, resolveStateBucketWithDefaultAndSource as Jc, malformedLocalResourceEntriesWarning as Ji, maskingRetryLogger as Jn, shareLogOnlyValues as Jo, applyRoleArnIfSet as Jr, isReadableBag as Js, planRollback as Jt, DELETE_INDEX_WAIT_PROCEED_NOTE as K, unwrittenCreateOnlyReplacement as Ka, resolveSkipPrefix as Kc, malformedExportSourceWarning as Ki, refusesFinalSnapshot as Kn, recordLogOnlyParameterValue as Ko, producerLookupOver as Kr, importableOutputKeys as Ks, isReplacementOrphan as Kt, perType as L, repairMalformedResourceEntriesForReadOnly as La, getDockerImageBySourceHash as Lc, deployRefusesOrphanRowsReason as Li, storedSecretNameNeedles as Ln, readsNoEchoSource as Lo, ec2InstanceProtectionSite as Lr, isAccessDenied$1 as Ls, replayRollback as Lt, noEchoParameterNamesOf as M, refuseMalformedResourcesForExport as Ma, runDockerStreaming as Mc, STATE_REGION_DIVERGED as Mi, orphanRecordsPrintingBag as Mn, noEchoCoordinatesOf as Mo, deleteSkipReason as Mr, rebuildClientForBucketRegion as Ms, journaledOrphanLines as Mt, recordedProtectionEvidence as N, refuseMalformedState as Na, warnFinchArgvExposure as Nc, STATE_RESOURCES_MALFORMED as Ni, secretNamePrintingBag as Nn, noEchoLeavesOf as No, withIndeterminateGuard as Nr, CrossPrefixReadError as Ns, loadJournaledOrphans as Nt, diffSecurity as O, refuseMalformedResourcePropertiesForExport as Oa, partitionSensitiveEnv as Oc, parameterInputsFor as Oi, DEFAULT_RESOURCE_WARN_AFTER_MS as On, maskAtCoordinates as Oo, RollbackInlinePolicyWriters as Or, isSingleDynamicReferenceToken as Os, withNestedStackContext as Ot, recordedProtectionNote as P, repairMalformedOrphanRecordsForReadOnly as Pa, escapeRegExp$3 as Pc, UNREADABLE_ORPHANS_CONTAINER_ROW as Pi, secretNamePrintingBags as Pn, noEchoOutputsComparison as Po, isWaitAbandonedError as Pr, CrossPrefixScanCache as Ps, makeForeignHolderScan as Pt, hasCdkAutoDeleteTag as Q, MULTI_REGION_RECREATE_BLOCKED_TYPES as Qa, ssmResolvedValueType as Qc, malformedOrphanRowsKeptWarning as Qi, earliestDefined as Qn, maskSecretsInText as Qo, isIamRoleArn as Qr, AssetPublisher as Qs, resolveReplacementOldType as Qt, readProtection as R, repairMalformedResourcePropertiesForReadOnly as Ra, Synthesizer as Rc, displayLogicalId as Ri, extractDeploymentEventError as Rn, valueAtCoordinate as Ro, isTerminationProtectionPropagationError as Rr, isNotImplemented as Rs, awaitInFlightSibling as Rt, keptForReadoption as S, refuseMalformedResourceEntriesForDestroy as Sa, dockerSpawnEnvWithSensitive as Sc, AWS_NO_VALUE as Si, resolveAssemblyPath as Sl, noEchoParameterValueSeed as Sn, lambdaFunctionNameForMask as So, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Sr, wholeStringLeavesOf as Ss, recordDisplacedSkips as St, findServiceTokenRefusals as T, refuseMalformedResourceEntriesForOrphan as Ta, getDockerCmd as Tc, refStateLookupFromResource as Ti, isExportAliasCollision as Tn, TemplateParser as To, CloudControlProvider as Tr, STATE_SOURCED_READBACK_RULES as Ts, withNestedRevertRun as Tt, deleteBudgetKey as U, withheldAccountClause as Ua, resolveApp as Uc, isReadableResourceEntry as Ui, createPreDeleteFinalSnapshot as Un, literalSplitDelimitersOf as Uo, INTRINSIC_KEYS as Ur, hasReadableExportSet as Us, recordAfterRollbackUpdate as Ut, beginDeleteWait as V, unreadableOrphanRecords as Va, getLegacyStateBucketName as Vc, hasReadableResources as Vi, buildFinalSnapshotIdentifier as Vn, createUnionSecretMasker as Vo, reEnableInstanceApiTermination as Vr, describeRegionValueKind as Vs, withStackRecords as Vt, resolveDynamoDbDeleteBudgetClock as W, findActionableSilentDrops as Wa, resolveAutoAssetStorage as Wc, malformedDriftResourcePropertiesWarning as Wi, effectiveDeletionPolicy as Wn, logOnlyValueCount as Wo, IntrinsicFunctionResolver as Wr, hasReasonlessBaselineRefusal as Ws, demoteSupersededOrphans as Wt, ECR_AUTO_DELETE_IMAGES_TAG as X, findReplacedReadersOfRecreateTargets as Xa, stateBucketExistenceConfirmed as Xc, malformedOrphanRecordsRefusalMessage as Xi, findDestructiveChanges as Xn, errorCauseChain as Xo, assertSendableRoleArn as Xr, orphansCarriedFrom as Xs, recordUnderIdIsNotOwn as Xt, waitForIndexesSettled as Y, hasNoCloudControlHandlers as Ya, resolveUseCdkBootstrapAssets as Yc, malformedLocalResourcesWarning as Yi, constructPathOf as Yn, createSecretMasker as Yo, assertFlagRoleArn as Yr, orphansAfterRollback as Ys, recheckFailedPlan as Yt, S3_AUTO_DELETE_OBJECTS_TAG as Z, shownType as Za, warnDeprecatedNoPrefixCliFlag as Zc, malformedOrphanRecordsWarning as Zi, formatDestructiveChange as Zn, maskSecretsInError as Zo, explicitRoleArnOrThrow as Zr, shouldRetainResource as Zs, replacementNeverSwapped as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedOutputs as _a, buildDockerImage as _c, isImpossibleEmptyStoredAttribute as _i, ownValue as _l, secretSafeKeyDisplay as _n, prefetchCreateOnlyPropertyPaths as _o, TemplateNoEchoReresolver as _r, recordMaskOnlyValue as _s, displacedOpClause as _t, findNestedTemplateTreeDefect as a, malformedResourcePropertiesWarning as aa, rewriteTemplateAssetReferences as ac, s3BucketArn as ai, decodeListingKey as al, isRedactedRecordedValue as an, toCfnInteger as ao, planTagDiff as ar, dynamicReferenceTokens as as, cyan as at, lookupEachName as b, refuseMalformedResourceEntries as ba, describeDockerExecFailure as bc, isNamelessDynamicReferenceError as bi, displayAssemblyPath as bl, exportNameSecretExposure as bn, withRetry as bo, getCurrentResourceSecrets as br, recordNoEchoParameterFreshValue as bs, getNestedRevertRun as bt, renderNestedTemplateTreeDefect as c, malformedStateRefusalMessage as ca, assertAssetBucketRegion as cc, s3BucketRegionalDomainName as ci, canonicalizeRegion as cl, updatePartialMessage as cn, coerceCfnInteger as co, tagMapAsList as cr, identityKeyFor as cs, red as ct, conditionInputsFrom as d, refuseMalformedNestedChildOutputs as da, isCrossRegionRedirect as dc, producerRegionsFromState as di, StageLoadError as dl, DeploymentEventsStore as dn, configStringRefusal as do, stringifyIfAssigned as dr, recoverMaskedOutput as ds, namesAnyDeclaredParameter as dt, malformedOrphansWarning as ea, stringifyValue as ec, AWS_CREDENTIAL_ENV_KEYS as ei, CFN_TEMPLATE_URL_LIMIT as el, orphanDeleteNeedsIdentity as en, isStatefulRecreateTargetSync as eo, reserveStackCreateToken as er, redactSecretsForState as es, getPriorAttempts as et, parentSuppliedValues as f, refuseMalformedOrphanRecords as fa, parseBootstrapMarker as fc, regionLessSecretName as fi, processStackMessages as fl, WITHHELD_NAME_DISPLAY as fn, readConfigString as fo, CC_BROKEN_REASON as fr, physicalNameCopiesOf as fs, reachableDivergentParameters as ft, mergeNoChangeOutputs as g, refuseMalformedOrphansForOrphan as ga, buildDenyExternalAccessPolicy as gc, getAccountInfo as gi, nullPrototypeRecord as gl, secretBearingStateKeyWarning as gn, requireConfigString as go, wouldReturnToSdkProvider as gr, provenPublicValue as gs, NESTED_PENDING_PARENT_REASON as gt, keptWholeReasonText as h, refuseMalformedOrphansForDestroy as ha, validateContainerRepoName as hc, parameterTypeMayLoseSecretIdentity as hi, hasPlainPrototype$1 as hl, secretBearing as hn, requireConfigObject as ho, isCustomResource as hr, carriesSecretMask as hs, planOrphanAdoption as ht, childTemplateLoader as i, malformedResourceEntriesWarning as ia, loadPublishableAssetManifest as ic, isSettledInstanceState as ii, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as il, REDACTED_DELETE_ADDRESS_SKIP_REASON as in, isWarmThroughputDecrease as io, DBPROXY_TAG_OPTIONS as ir, DYNAMIC_REFERENCE_TOKEN_SCAN as is, bold as it, noEchoExactEchoLeavesOf as j, refuseMalformedResourcesForDestroy as ja, runDockerForeground as jc, JSON_LISTING_HOLE_VALUE as ji, maskEventTextWithBoundBags as jn, maskedLeafCoordinatesOf as jo, deleteLeftInPlace as jr, S3StateBackend as js, isHandledOrphan as jt, noEchoAttributeNamesOf as k, refuseMalformedResourcePropertiesForOrphan as ka, redactDockerArgvValues as kc, passedParameterClassesOf as ki, completedReplayEntries as kn, maskReadbackAtCoordinates as ko, UNSPECIFIED_SKIP_REASON as kr, LockManager as ks, deleteJournaledOrphans as kt, templateIdentity as l, previewableOrphanRecords as la, ensureAssetStorage as lc, s3BucketWebsiteUrl as li, derivePartitionAndUrlSuffix as ll, updatePartialReason as ln, configBooleanRefusal as lo, tagPlanWarning as lr, inheritNestedStackParameterAssociations as ls, yellow as lt, isSecretBearingReferenceString as m, refuseMalformedOrphans as ma, validateAssetBucketName as mc, isUnboundTemplateParameter as mi, hasOwnKey as ml, exportAliasCollisionScrubWarning as mn, requireConfigArray as mo, ccBrokenReason as mr, splitGetAttStringForm as ms, makeSiblingClaimReader as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedOutputsWarning as na, buildAssetRedirectMap as nc, callerEnvCredentials as ni, findLargeInlineResources as nl, getCurrentProducerRegions as nn, WARM_THROUGHPUT_MEMBERS as no, acquireIdempotencyToken as nr, withPhysicalNameCopies as ns, formatResourceLine as nt, isAbsoluteAssetPath as o, malformedResourcesWarning as oa, AssetModeResolver as oc, s3BucketDomainName as oi, expectedOwnerParam as ol, redactedDeleteAddressFields as on, toFiniteNumber as oo, readTagList as or, isUncertifiedBaselineMaskPosition as os, gray as ot, readRecordedConditionVerdicts as p, refuseMalformedOrphanRecordsForDestroy as pa, readBootstrapMarkerBody as pc, coerceParameterTypedValue as pi, defineOwnKey as pl, displayTextOrWithheld as pn, replayWarn as po, ProviderRegistry as pr, recordPhysicalNameCopy as ps, resourcesNamingDeclaredParameter as pt, INDEX_SETTLE_POLL_INTERVAL_MS as q, withoutSilentDropProperties as qa, resolveStateBucketWithDefault as qc, malformedLocalOutputsWarning as qi, unsupportedFinalSnapshotError as qn, recordLogOnlyValue as qo, refuseUnreadableCdkCrossAccountRefs as qr, importableOutputs as qs, planFailedOps as qt, computeImplicitDeleteEdges as r, malformedRenderedContainersWarning as ra, createAssetRedirectResolver as rc, envCredentialsAreAssumedRole as ri, uploadCfnTemplate as rl, inheritProducerRegions as rn, coerceWarmThroughput as ro, DBPROXY_TAGS_WHAT as rr, withoutPhysicalNameCopies as rs, createReadOnlyAttributeHealerFactory as rt, listNestedTemplateRows as s, malformedScrubResourceEntriesRefusalMessage as sa, BOOTSTRAP_MARKER_PREFIX as sc, s3BucketDualStackDomainName as si, PARTITION_TABLE as sl, redactedDeleteAddressSkip as sn, coerceCfnBoolean as so, refuseMalformedDesiredTags as sr, pathCrossesDottedKey as ss, green as st, DeployEngine as t, malformedOutputsRefusalMessage as ta, WorkGraph as tc, applyCallerIdentityCredentials as ti, MIGRATE_TMP_PREFIX as tl, findNestedStackTypeChanges as tn, renderStatefulReason as to, withCreateTokenLedger as tr, scrubResourceRecord as ts, markRefusedBeforeApplying as tt, conditionFingerprint as u, refuseDivergentRecordRegionForDestroy as ua, getBootstrapMarkerKey as uc, classifyReplaySecretRegion as ui, AssemblyReader as ul, DeploymentEventsReader as un, configIntegerRefusal as uo, definedAttributes as ur, recordNestedStackParameterExpressions as us, computeParameterTaint as ut, chunks as v, refuseMalformedOutputsForDestroy as va, resolveDockerContextDirectory as vc, carriesDynamicReference as vi, absoluteAssemblyPathEscape as vl, carriedExportAliasExposure as vn, templateResourceTypes as vo, readsNoEchoDeleteValues as vr, recordMaskOnlyValuesIn as vs, displacedPhysicalIdShown as vt, deferredServiceTokenWarning as w, refuseMalformedResourceEntriesForImportSave as wa, formatDockerLoginError as wc, isStalePlaceholderArnAttribute as wi, resolveBucketRegion as wl, collectPublishedOutputNames as wn, DagBuilder as wo, customResourceResponseExpirationWarning as wr, STATE_SOURCED_CROSS_GENERATION_RULES as ws, revertedNestedRowIds as wt, withApiLimit as x, refuseMalformedResourceEntriesForDeploy as xa, describeDockerFailure as xc, keepsSecretReferenceToken as xi, renderAssemblyPathEscape as xl, isWholeDynamicReferenceValue as xn, canonicalLambdaFunctionName as xo, withPrintingSecrets as xr, recordProvenPublicExpression as xs, nestedChildStackName as xt, isAccessDeniedError as y, refuseMalformedResourceAttributesForOrphan as ya, describeDockerCapturedOutput as yc, carriesFetchableDynamicReference as yi, describeFileReadFailure as yl, exportNameNoEchoParameters as yn, describeTypeWithThrottleRetry as yo, isCustomResourceType as yr, recordNoEchoAttributeValues as ys, dropSettledNestedJournals as yt, DynamoDBGlobalTableProvider as z, repairMalformedResourcesForReadOnly as za, synthesisStatusMessage as zc, hasReadableOrphans as zi, ATOMIC_FINAL_SNAPSHOT_TYPES as zn, liveMatchesUnresolvedTokenFrame as zo, observeThenDisableInstanceApiTermination as zr, splitImportedOps as zs, destroyStackRecordsView as zt };
+//# sourceMappingURL=deploy-engine-BgWY0v3K.js.map