@go-to-k/cdkd 0.308.0 → 0.309.0

package/dist/{program-DOPic-aS.js → program-Bnt3Yt0k.js}

@@ -1,9 +1,9 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-Bu9EMILF.js";
 import { $ as stringifyJsonPayload, A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, Q as safeMsg, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, W as cutMarker, Y as isPasteableIdent, Z as plainIdentOr, _ as PATTERN_B_RESOURCE_TYPES, a as safeStringify, b as derivesPatternBName, c as isStdoutReservedForPayload, d as runStackBuffered, et as terminalSafe, g as PATTERN_B_NAME_PROPERTIES, h as PATTERN_B_NAME_OPTIONS, l as reserveStdoutForPayload, m as getLiveRenderer, n as describeAwsFailure, q as displaySafe, s as getLogger, tt as truncateCodePoints, x as explicitNamePropertyFor, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-NSBdKPYK.js";
-import { An as StateError, Cn as NestedStackChildDirectDestroyError, Cr as markNonRetryable, Dn as ResourceUpdateNotSupportedError, E as isMarkedNotGone, En as ResourceTimeoutError, Fn as normalizeAwsError, Gt as formatLockExpiry, Ht as buildForceUnlockCommand, I as remedyLogicalId, In as withErrorHandling, Jn as shellBoundedDisplay, Kn as plainOrDescribed, Kt as formatLockOperation, Ln as TIMEOUT_FLAG_RESOURCE_TYPE, Mn as formatError, O as assertRegionMatch, On as StackHasActiveImportsError, Qn as setPasteableVerbFlags, Qt as injectiveKey, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Un as isInertUnquoted, Ut as buildLockContentionMessage, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Wt as forceQuitRecoveryClause, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Yn as shellQuote, Z as runDeleteAttempt, Zn as setPasteableRunFlags, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp, dt as interruptWatchListenerCount, en as producerCoordinateKey, fn as CrossAccountSecretRefusalError, ft as isInterruptedWaitError, gn as DynamicReferenceRegionAmbiguousError, in as ambientClientDefaults, jn as SynthesisError, k as VALUE_NOT_SHOWN, kn as StackTerminationProtectionError, lr as stripControlChars, lt as beginCommandInterruptScope, mn as DeployCancelledError, mr as isAmbiguousOutcomeError, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as setPasteableAwsProfile, on as clientDefaultsFor, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rt as isAwsCliLiteral, s as readRecordedPrincipals, sn as credentialFingerprint, t as IAM_PRINCIPAL_NAME, tn as producerRecordKey, un as CdkdError, ur as stripForDisplay, ut as endCommandInterruptScope, vn as LocalInvokeBuildError$1, vr as isTransientServerError, vt as logicalIdShown, wn as PartialFailureError, xr as isMarkedNonRetryable, yn as LocalStartServiceError, yr as retryClassificationText, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-TFGunWmV.js";
+import { An as StateError, Cn as NestedStackChildDirectDestroyError, Cr as markNonRetryable, Dn as ResourceUpdateNotSupportedError, E as isMarkedNotGone, En as ResourceTimeoutError, Fn as normalizeAwsError, Gt as formatLockExpiry, Ht as buildForceUnlockCommand, I as remedyLogicalId, In as withErrorHandling, Jn as shellBoundedDisplay, Kn as plainOrDescribed, Kt as formatLockOperation, Ln as TIMEOUT_FLAG_RESOURCE_TYPE, Mn as formatError, O as assertRegionMatch, On as StackHasActiveImportsError, Qn as setPasteableVerbFlags, Qt as injectiveKey, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Un as isInertUnquoted, Ut as buildLockContentionMessage, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Wt as forceQuitRecoveryClause, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Yn as shellQuote, Z as runDeleteAttempt, Zn as setPasteableRunFlags, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp, dt as interruptWatchListenerCount, en as producerCoordinateKey, fn as CrossAccountSecretRefusalError, ft as isInterruptedWaitError, gn as DynamicReferenceRegionAmbiguousError, in as ambientClientDefaults, jn as SynthesisError, k as VALUE_NOT_SHOWN, kn as StackTerminationProtectionError, lr as stripControlChars, lt as beginCommandInterruptScope, mn as DeployCancelledError, mr as isAmbiguousOutcomeError, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as setPasteableAwsProfile, on as clientDefaultsFor, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rt as isAwsCliLiteral, s as readRecordedPrincipals, sn as credentialFingerprint, t as IAM_PRINCIPAL_NAME, tn as producerRecordKey, un as CdkdError, ur as stripForDisplay, ut as endCommandInterruptScope, vn as LocalInvokeBuildError$1, vr as isTransientServerError, vt as logicalIdShown, wn as PartialFailureError, xr as isMarkedNonRetryable, yn as LocalStartServiceError, yr as retryClassificationText, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-D94wh05t.js";
 import { a as setAssumedRoleCredentials, d as formatAuthority, i as getPreAssumeEnvCredentials, n as awsClientDefaults, r as getAssumedRoleCredentials, u as runInStackAwsScope } from "./aws-client-defaults-BX9Y_fKp.js";
-import { $ as inheritedProvenanceForChildDiff, $a as isStalePlaceholderArnAttribute, $c as carriesSecretMask, $i as deleteIndeterminateGuards, $l as readBootstrapMarkerBody, $n as exportNameSecretExposure, $o as refuseMalformedResourceEntriesForImport, $r as secretNamePrintingBag, $t as readRefactorMarker, $u as parseFailureDebugDetail, Aa as assertSendableRoleArn, Ac as recordLogOnlyValue, Al as isReadableBag, Ao as malformedOrphansWarning, Ar as green, As as isStatefulRecreateTargetSync, At as dropSettledNestedJournals, Au as resolveCaptureObservedState, Ba as producerRegionsFromState, Bc as DYNAMIC_REFERENCE_TOKEN_SCAN, Bi as readsNoEchoDeleteValues, Bl as stringifyValue, Bn as withNameGenerationReached, Bo as refuseDivergentRecordRegionForDestroy, Br as supersededHolderOf, Bt as deleteJournaledOrphans, Bu as MIGRATE_TMP_PREFIX, Ca as refuseUnreadableCdkCrossAccountRefs, Cc as carryLogOnlyValues, Cl as describeRegionValueKind, Cn as seedsDeleteFirstGuard, Co as malformedLocalOutputsWarning, Cr as destroyStackRecordsView, Ct as pendingRequestCount, Cu as Synthesizer, Da as recordedReferenceRegions, Dc as logOnlyValueCount, Dl as hasUnverifiableParameterRefusal, Dn as inheritProducerRegions, Do as malformedOrphanRecordsWarning, Dr as bold, Ds as shownType, Dt as NESTED_PENDING_PARENT_REASON, Du as loadCdkJson, Ea as recordedOutputReferenceRegions, Ec as literalSplitDelimitersOf, El as hasReasonlessBaselineRefusal, Eo as malformedOrphanRecordsRefusalMessage, Es as findReplacedReadersOfRecreateTargets, Et as recordRetainedForReadoption, Eu as getLegacyStateBucketName, Fa as applyCallerIdentityCredentials, Fc as maskSecretsInError, Fi as ccBrokenReason, Fl as PhaseClock, Fn as nameGenerationHighWaterOf, Fo as malformedResourcePropertiesWarning, Fr as holdsSupersededResources, Ft as revertedNestedRowIds, Fu as stateBucketExistenceConfirmed, Ga as getAccountInfo, Gc as identityKeyFor, Gi as applyCustomResourceResponseExpiration, Gl as rewriteTemplateAssetReferences, Gn as WITHHELD_NAME_DISPLAY, Go as refuseMalformedOrphansForDestroy, Gr as noEchoExactEchoLeavesOf, Gt as loadJournaledOrphans, Gu as expectedOwnerParam, Ha as coerceParameterTypedValue, Hc as isUncertifiedBaselineMaskPosition, Hl as buildAssetRedirectMap, Hn as namesAnyDeclaredParameter, Ho as refuseMalformedOrphanRecords, Hr as withoutSuperseded, Ht as dropFailedHint, Hu as uploadCfnTemplate, Ia as callerEnvCredentials, Ic as maskSecretsInText, Ii as isCustomResource, Il as renderPhaseTimings, In as nameScopeOf, Io as malformedResourcesWarning, Ir as isSupersededResourceRecord, It as withNestedRevertRun, Iu as warnDeprecatedNoPrefixCliFlag, Ja as carriesFetchableDynamicReference, Ji as slowCcOperationTimeoutMs, Jl as assertAssetBucketRegion, Jn as secretBearing, Jo as refuseMalformedOutputsForDestroy, Jr as completedReplayEntries, Js as templateResourceTypes, Jt as formatResourceLine, Ju as derivePartitionAndUrlSuffix, Ka as isImpossibleEmptyStoredAttribute, Kc as inheritNestedStackParameterAssociations, Ki as customResourceResponseExpirationWarning, Kl as AssetModeResolver, Kn as displayTextOrWithheld, Ko as refuseMalformedOrphansForOrphan, Kr as noEchoParameterNamesOf, Kt as makeForeignHolderScan, Ku as PARTITION_TABLE, La as envCredentialsAreAssumedRole, Lc as scrubResourceRecord, Li as wouldReturnToSdkProvider, Ll as timePhase, Ln as retiredAfterRollback, Lo as malformedScrubResourceEntriesRefusalMessage, Lr as removeSuperseded, Lt as collectNestedChildUnaddressed, Lu as ssmResolvedValueType, Ma as isIamRoleArn, Mc as unionOfSecretBags, Ml as orphansCarriedFrom, Mn as updatePartialMessage, Mo as malformedOutputsWarning, Mr as yellow, Mt as nestedChildStackName$1, Mu as resolveStateBucketWithDefault, Na as sendableAssumeRoleCommand, Nc as createSecretMasker, Ni as CC_BROKEN_REASON, Nl as shouldRetainResource, Nn as updatePartialReason, No as malformedRenderedContainersWarning, Nr as addSuperseded, Nt as recordDisplacedSkips, Nu as resolveStateBucketWithDefaultAndSource, Oa as applyRoleArnIfSet, Oc as printingCorpusOf, Ol as importableOutputKeys, Oo as malformedOrphanRowsKeptWarning, Or as cyan, Os as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ot as displacedOpClause, Ou as resolveApp, Pa as AWS_CREDENTIAL_ENV_KEYS, Pc as errorCauseChain, Pi as ProviderRegistry, Pl as stackInstanceIdCarriedFrom, Pn as nameGenerationCarriedFrom, Po as malformedResourceEntriesWarning, Pr as deleteSupersededEntry, Pu as resolveUseCdkBootstrapAssets, Q as crossStackOutputProvenanceSource, Qa as cfnRefValueFromPhysicalId, Qc as splitGetAttStringForm, Qi as UNSPECIFIED_SKIP_REASON, Ql as parseBootstrapMarker, Qn as exportNameNoEchoParameters, Qo as refuseMalformedResourceEntriesForDestroy, Qr as orphanRecordsPrintingBag, Qu as describeJsonParseFailure, Ra as classifyRecordedSecretRegion, Rc as withPhysicalNameCopies, Rl as AssetPublisher, Rn as retiredNameGenerationsAfter, Ro as malformedStateRefusalMessage, Rr as supersededAfterRollback, Rt as getCurrentNestedStackContext, Ru as CFN_TEMPLATE_BODY_LIMIT, Sa as producerLookupOver, Sl as acceptedCreateOnlyDropsOf, Sn as resolveReplacementOldType, So as malformedExportSourceWarning, Ss as unwrittenCreateOnlyReplacement, St as planOrphanAdoption, Su as getDockerImageBySourceHash, Tc as hasMaskableValues, Tl as hasReadableExportSet, Tn as findNestedStackTypeChanges, To as malformedLocalResourcesWarning, Tr as withStackRecords, Ts as hasNoCloudControlHandlers, Tt as keptForRetainedRecord, Tu as getDefaultStateBucketName, Ua as isUnboundTemplateParameter, Uc as pathCrossesDottedKey, Ui as withPrintingSecrets, Ul as createAssetRedirectResolver, Un as reachableDivergentParameters, Uo as refuseMalformedOrphanRecordsForDestroy, Ur as noEchoAttributeNamesOf, Ut as isHandledOrphan, Uu as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Va as regionLessSecretName, Vc as dynamicReferenceTokens, Vi as isCustomResourceType$1, Vl as WorkGraph, Vn as computeParameterTaint, Vr as supersededResourcesOf, Vt as dropFailedCommands, Vu as findLargeInlineResources, Wa as parameterTypeMayLoseSecretIdentity, Wc as spelledKeysOf, Wi as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Wl as loadPublishableAssetManifest, Wn as resourcesNamingDeclaredParameter, Wo as refuseMalformedOrphans, Wr as noEchoComparisonForTemplate, Wt as journaledOrphanLines, Wu as decodeListingKey, X as IMPLICIT_DELETE_DEPENDENCIES, Xa as keepsSecretReferenceToken, Xl as getBootstrapMarkerKey, Xn as secretSafeKeyDisplay, Xo as refuseMalformedResourceEntries, Xr as maskEventTextWithBoundBags, Xs as withRetry, Xu as StageLoadError, Ya as isNamelessDynamicReferenceError, Yc as physicalNameCopiesOf, Yl as ensureAssetStorage, Yn as secretBearingStateKeyWarning, Yo as refuseMalformedResourceAttributesForOrphan, Yr as journaledOrphanPrintingBag, Ys as describeTypeWithThrottleRetry, Yu as AssemblyReader, Z as computeImplicitDeleteEdges, Za as AWS_NO_VALUE, Zc as recordPhysicalNameCopy, Zi as RollbackInlinePolicyWriters, Zl as isCrossRegionRedirect, Zn as carriedExportAliasExposure, Zo as refuseMalformedResourceEntriesForDeploy, Zr as namingSecretsWithRecordedNoEcho, Zu as processStackMessages, _c as valueAtCoordinate, _i as withCreateTokenLedger, _l as isAccessDenied, _n as planFailedOps, _o as hasReadableResources, _r as isPairableType, _s as unreadableOrphanRecords, _t as isSecretBearingReferenceString, _u as redactedDockerCause, a as isProtectionValueActive, ac as isMarkedCoordinate, ad as ownValue, ai as ATOMIC_FINAL_SNAPSHOT_TYPES, al as recordProvenPublicExpression, an as updateRefactorMarker, ar as bindingSkippedOutputs, as as refuseMalformedResourcePropertiesForOrphan, at as isAbsoluteAssetPath, au as describeDockerCapturedOutput, bc as redactForState, bi as DeploymentEventsStore, bl as withStackInstanceIdWithheld, bn as recordUnderIdIsNotOwn, bo as malformedDriftResourcePropertiesWarning, br as parseMappingFile, bs as findActionableSilentDrops, bt as makeCanonicalizePropertiesFn, bu as warnFinchArgvExposure, cc as maskWholeValue, cd as displayAssemblyPath, ci as ccRoutedFinalSnapshotError, cl as isSingleDynamicReferenceToken, cn as pendingMovesRefusalMessage, co as STATE_REGION_DIVERGED, cr as maskingRetryLogger, cs as refuseMalformedResourcesForExport, ct as templateIdentity, cu as dockerSpawnEnvWithSensitive, da as DiffCalculator, dc as noEchoLeavesOf, dd as injectAwsRegion, di as isFinalSnapshotError, dl as S3StateBackend, dn as replayRollback, do as UNREADABLE_RESOURCES_MAP_ROW, dr as formatDestructiveChange, ds as repairMalformedOrphansForReadOnly, dt as parentSuppliedValues, du as getDockerCmd, ea as deleteLeftInPlace, ed as utf8ByteLength, ei as secretNamePrintingBags, el as provenPublicValue, en as readRefactorMarkerOnce, eo as lacksRecordedTableArn, er as isWholeDynamicReferenceValue, es as refuseMalformedResourceEntriesForImportSave, et as deferredServiceTokenWarning, eu as validateAssetBucketName, fa as INTRINSIC_KEYS, fc as noEchoOutputsComparison, fd as injectedAwsRegionValue, fi as refusesFinalSnapshot, fl as rebuildClientForBucketRegion, fn as removeProtectionTypeList, fo as accountArgs, fr as findRefactorHints, fs as repairMalformedOutputsForReadOnly, ft as readRecordedConditionVerdicts, fu as isDockerClientEnvKey, gc as recordedNoEchoValuesOf, gl as crossPrefixDeniedWarning, gn as isReplacementOrphan, go as hasReadableOutputs, gr as withMovedTo, gs as unpreviewableOrphanRecords, gt as diffSecurity, gu as redactedCause, hc as readsNoEchoSource, hi as ledgerForStack, hl as applyCrossPrefixScan, hn as isJournaledOrphan, ho as hasReadableOrphans, hr as rollbackOrphanIds, hs as repairMalformedResourcesForReadOnly, ht as withResourceDeadline, hu as redactDockerArgvValues, i as PROTECTION_PROPERTY_BY_TYPE, ic as canonicalCoordinates, id as nullPrototypeRecord, ii as storedSecretNameNeedles, il as recordNoEchoParameterFreshValue, in as sameMove, io as parameterInputsFor, ir as isExportAliasCollision, is as refuseMalformedResourcePropertiesForExport, it as findNestedTemplateTreeDefect, iu as resolveDockerContextDirectory, ja as explicitRoleArnOrThrow, jc as shareLogOnlyValues, jl as orphansAfterRollback, jo as malformedOutputsRefusalMessage, jr as red, js as renderStatefulReason, ju as resolveSkipPrefix, ka as assertFlagRoleArn, kc as recordLogOnlyParameterValue, kl as importableOutputs, ko as malformedOrphansRefusalMessage, kr as gray, ks as isStatefulRecreateTargetForReplace, kt as displacedPhysicalIdShown, ku as resolveAutoAssetStorage, lc as maskedLeafCoordinatesOf, ld as renderAssemblyPathEscape, li as createPreDeleteFinalSnapshot, ll as LockManager, ln as refusePendingMovesOut, lo as STATE_RESOURCES_MALFORMED, lr as constructPathOf$1, ls as refuseMalformedState, lt as conditionFingerprint, lu as finchSecretArgvRefusal, ma as poisonRenderedSpellingsCollidingIn, mc as readbackPathFor, md as resolveBucketRegion, ml as CrossPrefixScanCache, mn as demoteSupersededOrphans, mo as displayLogicalId, mr as movedToHint, ms as repairMalformedResourcePropertiesForReadOnly, mu as partitionSensitiveEnv, n as recordedProtectionEvidence, nc as DagBuilder, nd as hasOwnKey, ni as secretNamedRecordNeedles, nl as recordMaskOnlyValuesIn, nn as refactorMarkerRefusalMessage, nr as collectDeclaredOutputNames, ns as refuseMalformedResourcePropertiesForDestroy, nt as serviceTokenBlockingReason, nu as buildDenyExternalAccessPolicy, o as perType, oc as maskAtCoordinates, od as absoluteAssemblyPathEscape, oi as PRE_DELETE_SNAPSHOT_TYPES, ol as wholeStringLeavesOf, on as hasPendingMovesOut, oo as declaresNoEcho, or as DEFAULT_RESOURCE_TIMEOUT_MS, os as refuseMalformedResourcesForDeploy, ot as listNestedTemplateRows, ou as describeDockerExecFailure, pa as IntrinsicFunctionResolver, pi as unsupportedFinalSnapshotError, pl as CrossPrefixReadError, pn as recordAfterRollbackUpdate, po as deployRefusesOrphanRowsReason, pr as hintSidesOf, ps as repairMalformedResourceEntriesForReadOnly, pu as isMalformedEnvKey, qa as carriesDynamicReference, qc as recordNestedStackParameterExpressions, qi as CloudControlProvider, ql as BOOTSTRAP_MARKER_PREFIX, qn as exportAliasCollisionScrubWarning, qo as refuseMalformedOutputs, qr as createReadOnlyAttributeHealerFactory, qs as prefetchCreateOnlyPropertyPaths, qt as sameJournaledOrphans, qu as canonicalizeRegion, r as recordedProtectionNote, ra as isWaitAbandonedError, rc as TemplateParser, rd as hasPlainPrototype, ri as stateSecretNameNeedles, rl as recordNoEchoAttributeValues, rn as refuseRefactorMarker, ro as withSharedDrainBudget, rr as collectPublishedOutputNames, rs as refuseMalformedResourcePropertiesForDrift, rt as childTemplateLoader, ru as buildDockerImage, s as readProtection, sc as maskReadbackAtCoordinates, sd as describeFileReadFailure, si as buildFinalSnapshotIdentifier, sl as WHOLE_DYNAMIC_REFERENCE_PATTERN, sn as pendingMovesOutOf, so as JSON_LISTING_HOLE_VALUE, sr as DEFAULT_RESOURCE_WARN_AFTER_MS, ss as refuseMalformedResourcesForDestroy, st as renderNestedTemplateTreeDefect, su as describeDockerFailure, t as DeployEngine, ta as deleteSkipReason, td as defineOwnKey, tl as recordMaskOnlyValue, tn as refactorMarkerMovesOf, to as refStateLookupFromResource, tr as noEchoParameterValueSeed, ts as refuseMalformedResourceEntriesForOrphan, tt as findServiceTokenRefusals, tu as validateContainerRepoName, uc as noEchoCoordinatesOf, ud as resolveAssemblyPath, ui as effectiveDeletionPolicy, ul as isLockInfoExpired, un as replayFailedOperations, uo as UNREADABLE_ORPHANS_CONTAINER_ROW, ur as findDestructiveChanges, us as repairMalformedOrphanRecordsForReadOnly, ut as conditionInputsFrom, uu as formatDockerLoginError, vc as liveMatchesUnresolvedTokenFrame, vl as isNotImplemented, vn as planRollback, vo as isReadableOrphanRecord, vr as looselyEqual, vs as unreadableResourceEntries, vt as keptWholeReasonText, vu as runDockerForeground, wa as keepHeldTokenProvenance, wc as createUnionSecretMasker, wl as exportNamesCarriedFrom, wn as orphanNeedsIdentity, wo as malformedLocalResourceEntriesWarning, ws as NO_CC_HANDLERS_REASON, wt as resolvePendingCloudControlRequests, wu as synthesisStatusMessage, xa as resolveDynamicReferences, xi as extractDeploymentEventError, xl as splitImportedOps, xn as replacementNeverSwapped, xo as malformedExportNamesWarning, xr as proposeRenames, xt as makeSiblingClaimReader, xu as AssetManifestLoader, yi as DeploymentEventsReader, yl as stackInstanceIdOf, yn as recheckFailedPlan, yo as isReadableResourceEntry, yr as mappingPairs, ys as withheldAccountClause, yt as mergeNoChangeOutputs, yu as runDockerStreaming, za as classifyReplaySecretRegion, zi as TemplateNoEchoReresolver, zl as isSensitiveAttributeName, zn as retiredNameGenerationsLeaving, zo as previewableOrphanRecords, zr as supersededHeldByOtherTypeWarning, zt as withNestedStackContext, zu as CFN_TEMPLATE_URL_LIMIT } from "./deploy-engine-DSpxEUjC.js";
-import { t as getCdkdVersion } from "./version-DzajQDkv.js";
+import { $ as computeImplicitDeleteEdges, $a as coerceParameterTypedValue, $c as DYNAMIC_REFERENCE_TOKEN_SCAN, $i as applyCustomResourceResponseExpiration, $l as stringifyValue, $n as WITHHELD_NAME_DISPLAY, $o as refuseMalformedOrphanRecords, $r as noEchoExactEchoLeavesOf, $u as MIGRATE_TMP_PREFIX, Ac as valueAtCoordinate, Al as isAccessDenied, An as resolveReplacementOldType, Ao as isReadableResourceEntry, As as withheldAccountClause, At as displacedOpClause, Au as redactedDockerCause, Ba as assertFlagRoleArn, Bc as logOnlyValueCount, Bl as hasUnverifiableParameterRefusal, Bn as updatePartialMessage, Bo as malformedOrphansRefusalMessage, Br as yellow, Bs as isStatefulRecreateTargetForReplace, Bt as getCurrentNestedStackContext, Bu as loadCdkJson, Ca as withoutUnsettledProperties, Cc as noEchoCoordinatesOf, Cd as resolveAssemblyPath, Ci as ledgerForStack, Cl as isLockInfoExpired, Cn as isJournaledOrphan, Co as accountArgs, Cr as rollbackOrphanIds, Cs as repairMalformedOutputsForReadOnly, Ct as makeSiblingClaimReader, Cu as formatDockerLoginError, Dc as readbackPathFor, Dd as resolveBucketRegion, Di as DeploymentEventsReader, Dl as CrossPrefixScanCache, Dn as recheckFailedPlan, Do as hasReadableOutputs, Dr as mappingPairs, Ds as unpreviewableOrphanRecords, Dt as keptForRetainedRecord, Du as partitionSensitiveEnv, El as CrossPrefixReadError, En as planRollback, Eo as hasReadableOrphans, Er as looselyEqual, Es as repairMalformedResourcesForReadOnly, Et as resolvePendingCloudControlRequests, Eu as isMalformedEnvKey, Fa as keepHeldTokenProvenance, Fl as acceptedCreateOnlyDropsOf, Fn as inheritProducerRegions, Fo as malformedLocalResourceEntriesWarning, Fr as bold, Fs as NO_CC_HANDLERS_REASON, Ft as recordDisplacedSkips, Fu as getDockerImageBySourceHash, Ga as AWS_CREDENTIAL_ENV_KEYS, Gc as unionOfSecretBags, Gi as wouldReturnToSdkProvider, Gl as orphansCarriedFrom, Gn as retiredAfterRollback, Go as malformedResourceEntriesWarning, Gr as removeSuperseded, Gt as isHandledOrphan, Gu as resolveStateBucketWithDefault, Ha as explicitRoleArnOrThrow, Hc as recordLogOnlyParameterValue, Hi as ProviderRegistry, Hl as importableOutputs, Hn as nameGenerationCarriedFrom, Ho as malformedOutputsRefusalMessage, Hr as deleteSupersededEntry, Hs as renderStatefulReason, Ht as deleteJournaledOrphans, Hu as resolveAutoAssetStorage, Ic as carryLogOnlyValues, Il as describeRegionValueKind, Io as malformedLocalResourcesWarning, Ir as cyan, Is as hasNoCloudControlHandlers, Iu as Synthesizer, Ja as envCredentialsAreAssumedRole, Jc as maskSecretsInError, Ji as readsNoEchoDeleteValues, Jl as PhaseClock, Jn as withNameGenerationReached, Jo as malformedScrubResourceEntriesRefusalMessage, Jr as supersededHolderOf, Jt as makeForeignHolderScan, Ju as stateBucketExistenceConfirmed, Ka as applyCallerIdentityCredentials, Kc as createSecretMasker, Kl as shouldRetainResource, Kn as retiredNameGenerationsAfter, Ko as malformedResourcePropertiesWarning, Kr as supersededAfterRollback, Kt as journaledOrphanLines, Ku as resolveStateBucketWithDefaultAndSource, La as recordedOutputReferenceRegions, Lc as createUnionSecretMasker, Ll as exportNamesCarriedFrom, Lo as malformedOrphanRecordsRefusalMessage, Lr as gray, Ls as findReplacedReadersOfRecreateTargets, Lt as revertedNestedRowIds, Lu as synthesisStatusMessage, Ma as resolveDynamicReferences, Ml as stackInstanceIdOf, Mn as orphanNeedsIdentity, Mo as malformedExportNamesWarning, Mt as dropSettledNestedJournals, Mu as runDockerStreaming, Na as producerLookupOver, Nc as redactForState, Nl as withStackInstanceIdWithheld, Nn as findNestedStackTypeChanges, No as malformedExportSourceWarning, Nr as withStackRecords, Ns as unwrittenCreateOnlyReplacement, Nu as warnFinchArgvExposure, Oc as readsNoEchoSource, Oi as DeploymentEventsStore, Ol as applyCrossPrefixScan, On as recordUnderIdIsNotOwn, Oo as hasReadableResources, Or as parseMappingFile, Os as unreadableOrphanRecords, Ot as recordRetainedForReadoption, Ou as redactDockerArgvValues, Pa as refuseUnreadableCdkCrossAccountRefs, Pl as splitImportedOps, Po as malformedLocalOutputsWarning, Pt as nestedChildStackName$1, Pu as AssetManifestLoader, Q as IMPLICIT_DELETE_DEPENDENCIES, Qa as regionLessSecretName, Qi as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ql as isSensitiveAttributeName, Qn as resourcesNamingDeclaredParameter, Qr as noEchoComparisonForTemplate, Qu as CFN_TEMPLATE_URL_LIMIT, Ra as recordedReferenceRegions, Rc as hasMaskableValues, Rl as hasReadableExportSet, Ro as malformedOrphanRecordsWarning, Rr as green, Rs as shownType, Rt as withNestedRevertRun, Ru as getDefaultStateBucketName, Sa as withUnsettledProperties, Sc as maskedLeafCoordinatesOf, Sd as renderAssemblyPathEscape, Sl as LockManager, Sn as demoteSupersededOrphans, So as UNREADABLE_RESOURCES_MAP_ROW, Sr as movedToHint, Ss as repairMalformedOrphansForReadOnly, St as makeCanonicalizePropertiesFn, Su as finchSecretArgvRefusal, Ta as poisonRenderedSpellingsCollidingIn, Tc as noEchoOutputsComparison, Td as injectedAwsRegionValue, Ti as withCreateTokenLedger, Tl as rebuildClientForBucketRegion, Tn as planFailedOps, To as displayLogicalId, Tr as isPairableType, Ts as repairMalformedResourcePropertiesForReadOnly, Tt as pendingRequestCount, Tu as isDockerClientEnvKey, Ua as isIamRoleArn, Uc as recordLogOnlyValue, Ui as ccBrokenReason, Ul as isReadableBag, Un as nameGenerationHighWaterOf, Uo as malformedOutputsWarning, Ur as holdsSupersededResources, Ut as dropFailedCommands, Uu as resolveCaptureObservedState, Va as assertSendableRoleArn, Vc as printingCorpusOf, Vi as CC_BROKEN_REASON, Vl as importableOutputKeys, Vn as updatePartialReason, Vo as malformedOrphansWarning, Vr as addSuperseded, Vs as isStatefulRecreateTargetSync, Vt as withNestedStackContext, Vu as resolveApp, Wa as sendableAssumeRoleCommand, Wc as shareLogOnlyValues, Wi as isCustomResource, Wl as orphansAfterRollback, Wn as nameScopeOf, Wo as malformedRenderedContainersWarning, Wr as isSupersededResourceRecord, Wt as dropFailedHint, Wu as resolveSkipPrefix, Xa as classifyReplaySecretRegion, Xc as scrubResourceRecord, Xl as timePhase, Xn as namesAnyDeclaredParameter, Xo as previewableOrphanRecords, Xr as withoutSuperseded, Xt as formatResourceLine, Xu as ssmResolvedValueType, Ya as classifyRecordedSecretRegion, Yc as maskSecretsInText, Yi as isCustomResourceType$1, Yl as renderPhaseTimings, Yn as computeParameterTaint, Yo as malformedStateRefusalMessage, Yr as supersededResourcesOf, Yt as sameJournaledOrphans, Yu as warnDeprecatedNoPrefixCliFlag, Za as producerRegionsFromState, Zc as withPhysicalNameCopies, Zi as withPrintingSecrets, Zl as AssetPublisher, Zn as reachableDivergentParameters, Zo as refuseDivergentRecordRegionForDestroy, Zr as noEchoAttributeNamesOf, Zu as CFN_TEMPLATE_BODY_LIMIT, _c as canonicalCoordinates, _d as nullPrototypeRecord, _i as createPreDeleteFinalSnapshot, _l as recordNoEchoParameterFreshValue, _n as withUnprovenUnsettled, _o as declaresNoEcho, _r as constructPathOf$1, _s as refuseMalformedResourcesForDeploy, _t as withResourceDeadline, _u as resolveDockerContextDirectory, a as isProtectionValueActive, aa as RollbackInlinePolicyWriters, ac as templateResourceTypes, ad as PARTITION_TABLE, ai as namingSecretsWithRecordedNoEcho, al as inheritNestedStackParameterAssociations, an as refuseRefactorMarker, ao as carriesFetchableDynamicReference, ar as carriedExportAliasExposure, as as refuseMalformedOutputsForDestroy, at as childTemplateLoader, au as AssetModeResolver, ba as INTRINSIC_KEYS, bc as maskReadbackAtCoordinates, bd as describeFileReadFailure, bi as refusesFinalSnapshot, bl as WHOLE_DYNAMIC_REFERENCE_PATTERN, bn as equalModuloMask, bo as STATE_RESOURCES_MALFORMED, br as findRefactorHints, bs as refuseMalformedState, bt as keptWholeReasonText, bu as describeDockerFailure, ca as deleteLeftInPlace, cd as AssemblyReader, ci as secretNamePrintingBags, cl as physicalNameCopiesOf, cn as hasPendingMovesOut, co as AWS_NO_VALUE, cr as isWholeDynamicReferenceValue, cs as refuseMalformedResourceEntriesForDeploy, ct as listNestedTemplateRows, cu as ensureAssetStorage, da as isWaitAbandonedError, dd as describeJsonParseFailure, di as stateSecretNameNeedles, dl as splitGetAttStringForm, dn as refusePendingMovesOut, do as lacksRecordedTableArn, dr as collectPublishedOutputNames, ds as refuseMalformedResourceEntriesForImportSave, dt as conditionFingerprint, du as parseBootstrapMarker, ea as customResourceResponseExpirationWarning, ed as findLargeInlineResources, ei as noEchoParameterNamesOf, el as dynamicReferenceTokens, eo as isUnboundTemplateParameter, er as displayTextOrWithheld, es as refuseMalformedOrphanRecordsForDestroy, et as crossStackOutputProvenanceSource, eu as WorkGraph, fd as parseFailureDebugDetail, fi as storedSecretNameNeedles, fl as carriesSecretMask, fn as replayFailedOperations, fo as refStateLookupFromResource, fr as isExportAliasCollision, fs as refuseMalformedResourceEntriesForOrphan, ft as conditionInputsFrom, fu as readBootstrapMarkerBody, gc as TemplateParser, gd as hasPlainPrototype, gi as ccRoutedFinalSnapshotError, gl as recordNoEchoAttributeValues, gn as settleUnsettledPrevious, gr as maskingRetryLogger, gs as refuseMalformedResourcePropertiesForOrphan, gu as buildDockerImage, hc as DagBuilder, hd as hasOwnKey, hi as buildFinalSnapshotIdentifier, hl as recordMaskOnlyValuesIn, hn as recordAfterRollbackUpdate, ho as parameterInputsFor, hr as DEFAULT_RESOURCE_WARN_AFTER_MS, hs as refuseMalformedResourcePropertiesForExport, hu as buildDenyExternalAccessPolicy, i as PROTECTION_PROPERTY_BY_TYPE, ic as prefetchCreateOnlyPropertyPaths, id as expectedOwnerParam, ii as maskEventTextWithBoundBags, il as identityKeyFor, in as refactorMarkerRefusalMessage, io as carriesDynamicReference, ir as secretSafeKeyDisplay, is as refuseMalformedOutputs, it as serviceTokenBlockingReason, iu as rewriteTemplateAssetReferences, jc as liveMatchesUnresolvedTokenFrame, jl as isNotImplemented, jn as seedsDeleteFirstGuard, jo as malformedDriftResourcePropertiesWarning, jr as destroyStackRecordsView, js as findActionableSilentDrops, jt as displacedPhysicalIdShown, ju as runDockerForeground, kc as recordedNoEchoValuesOf, ki as extractDeploymentEventError, kl as crossPrefixDeniedWarning, kn as replacementNeverSwapped, ko as isReadableOrphanRecord, kr as proposeRenames, ks as unreadableResourceEntries, kt as NESTED_PENDING_PARENT_REASON, ku as redactedCause, la as deleteSkipReason, ld as StageLoadError, ln as pendingMovesOutOf, lo as cfnRefValueFromPhysicalId, lr as noEchoParameterValueSeed, ls as refuseMalformedResourceEntriesForDestroy, lt as renderNestedTemplateTreeDefect, lu as getBootstrapMarkerKey, md as defineOwnKey, mi as PRE_DELETE_SNAPSHOT_TYPES, ml as recordMaskOnlyValue, mn as removeProtectionTypeList, mo as withSharedDrainBudget, mr as DEFAULT_RESOURCE_TIMEOUT_MS, ms as refuseMalformedResourcePropertiesForDrift, mt as readRecordedConditionVerdicts, mu as validateContainerRepoName, n as recordedProtectionEvidence, na as slowCcOperationTimeoutMs, nd as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, ni as completedReplayEntries, nl as pathCrossesDottedKey, nn as readRefactorMarkerOnce, no as getAccountInfo, nr as secretBearing, ns as refuseMalformedOrphansForDestroy, nt as deferredServiceTokenWarning, nu as createAssetRedirectResolver, o as perType, oa as UNSPECIFIED_SKIP_REASON, oc as describeTypeWithThrottleRetry, od as canonicalizeRegion, oi as orphanRecordsPrintingBag, ol as recordNestedStackParameterExpressions, on as sameMove, oo as isNamelessDynamicReferenceError, or as exportNameNoEchoParameters, os as refuseMalformedResourceAttributesForOrphan, ot as findNestedTemplateTreeDefect, ou as BOOTSTRAP_MARKER_PREFIX, pd as utf8ByteLength, pi as ATOMIC_FINAL_SNAPSHOT_TYPES, pl as provenPublicValue, pn as replayRollback, pr as bindingSkippedOutputs, ps as refuseMalformedResourcePropertiesForDestroy, pt as parentSuppliedValues, pu as validateAssetBucketName, qa as callerEnvCredentials, qc as errorCauseChain, qi as TemplateNoEchoReresolver, ql as stackInstanceIdCarriedFrom, qn as retiredNameGenerationsLeaving, qo as malformedResourcesWarning, qr as supersededHeldByOtherTypeWarning, qt as loadJournaledOrphans, qu as resolveUseCdkBootstrapAssets, r as recordedProtectionNote, rd as decodeListingKey, ri as journaledOrphanPrintingBag, rl as spelledKeysOf, rn as refactorMarkerMovesOf, ro as isImpossibleEmptyStoredAttribute, rr as secretBearingStateKeyWarning, rs as refuseMalformedOrphansForOrphan, rt as findServiceTokenRefusals, ru as loadPublishableAssetManifest, s as readProtection, sa as deleteIndeterminateGuards, sc as withRetry, sd as derivePartitionAndUrlSuffix, si as secretNamePrintingBag, sn as updateRefactorMarker, so as keepsSecretReferenceToken, sr as exportNameSecretExposure, ss as refuseMalformedResourceEntries, st as isAbsoluteAssetPath, su as assertAssetBucketRegion, t as DeployEngine, ta as CloudControlProvider, td as uploadCfnTemplate, ti as createReadOnlyAttributeHealerFactory, tl as isUncertifiedBaselineMaskPosition, tn as readRefactorMarker, to as parameterTypeMayLoseSecretIdentity, tr as exportAliasCollisionScrubWarning, ts as refuseMalformedOrphans, tt as inheritedProvenanceForChildDiff, tu as buildAssetRedirectMap, ud as processStackMessages, ui as secretNamedRecordNeedles, ul as recordPhysicalNameCopy, un as pendingMovesRefusalMessage, uo as isStalePlaceholderArnAttribute, ur as collectDeclaredOutputNames, us as refuseMalformedResourceEntriesForImport, ut as templateIdentity, uu as isCrossRegionRedirect, vc as isMarkedCoordinate, vd as ownValue, vi as effectiveDeletionPolicy, vl as recordProvenPublicExpression, vn as calculateResourceDrift, vo as JSON_LISTING_HOLE_VALUE, vr as findDestructiveChanges, vs as refuseMalformedResourcesForDestroy, vt as diffSecurity, vu as describeDockerCapturedOutput, wa as IntrinsicFunctionResolver, wc as noEchoLeavesOf, wd as injectAwsRegion, wl as S3StateBackend, wn as isReplacementOrphan, wo as deployRefusesOrphanRowsReason, wr as withMovedTo, ws as repairMalformedResourceEntriesForReadOnly, wt as planOrphanAdoption, wu as getDockerCmd, xa as unsettledPropertiesOf, xc as maskWholeValue, xd as displayAssemblyPath, xi as unsupportedFinalSnapshotError, xl as isSingleDynamicReferenceToken, xn as undeclaredEmptyObservedKeys, xo as UNREADABLE_ORPHANS_CONTAINER_ROW, xr as hintSidesOf, xs as repairMalformedOrphanRecordsForReadOnly, xt as mergeNoChangeOutputs, xu as dockerSpawnEnvWithSensitive, ya as DiffCalculator, yc as maskAtCoordinates, yd as absoluteAssemblyPathEscape, yi as isFinalSnapshotError, yl as wholeStringLeavesOf, yn as equalModuloMarkedMask, yo as STATE_REGION_DIVERGED, yr as formatDestructiveChange, ys as refuseMalformedResourcesForExport, yt as isSecretBearingReferenceString, yu as describeDockerExecFailure, za as applyRoleArnIfSet, zc as literalSplitDelimitersOf, zl as hasReasonlessBaselineRefusal, zo as malformedOrphanRowsKeptWarning, zr as red, zs as MULTI_REGION_RECREATE_BLOCKED_TYPES, zt as collectNestedChildUnaddressed, zu as getLegacyStateBucketName } from "./deploy-engine-tQ0aqZMo.js";
+import { t as getCdkdVersion } from "./version-9LVuCtBU.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -2710,7 +2710,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-d9K3vBVh.js");
+	providerClasses ??= import("./provider-classes-DYke4HKr.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -3557,7 +3557,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 					const syncValidation = validateRecreateTargets({
 						template: stackInfo.template,
 						state: stateForRecreateCheck?.state ?? {
-							version: 13,
+							version: 14,
 							stackName: stackInfo.stackName,
 							region: stackRegion,
 							resources: {},
@@ -3592,7 +3592,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 						const replacedReaders = await findReplacedReadersOfRecreateTargets({
 							template: stackInfo.template,
 							state: stateForRecreateCheck?.state ?? {
-								version: 13,
+								version: 14,
 								stackName: stackInfo.stackName,
 								region: stackRegion,
 								resources: {},
@@ -5001,7 +5001,7 @@ async function loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery
 			region,
 			resources: {},
 			outputs: {},
-			version: 13,
+			version: 14,
 			lastModified: Date.now()
 		},
 		unreadable: [],
@@ -6146,7 +6146,7 @@ function renderChangeLines(changes, logFn, ccApiRoutes, adoptedOrphans, refactor
 			logFn(`  [~] ${logicalId} (${change.resourceType})${annotateAdoption(logicalId)}${annotateRouting(logicalId)}`);
 			if (change.propertyChanges && change.propertyChanges.length > 0) for (const propChange of change.propertyChanges) {
 				const requiresReplace = propChange.requiresReplacement && (propChange.inPlacePropagated === true || propChange.replacementPropagated === true) ? " [may require replacement]" : propChange.requiresReplacement ? " [requires replacement]" : "";
-				const propagated = propChange.replacementPropagated ? " [replacement propagated]" : propChange.readProvenancePromoted === true ? " [read value moved upstream]" : propChange.inPlacePropagated ? " [attribute propagated]" : propChange.maskedExpressionChanged === true ? " [masked input or expression changed]" : "";
+				const propagated = propChange.replacementPropagated ? " [replacement propagated]" : propChange.readProvenancePromoted === true ? " [read value moved upstream]" : propChange.inPlacePropagated ? " [attribute propagated]" : propChange.maskedExpressionChanged === true ? " [masked input or expression changed]" : propChange.unsettled === true ? " [unsettled after a failed update; sent again]" : "";
 				const indent = "              ";
 				const [oldFiltered, newFiltered] = stripUnchangedValuePair(propChange.oldValue, propChange.newValue);
 				const oldStr = renderDiffValue(propChange.oldValue, oldFiltered, indent, false);
@@ -9071,244 +9071,6 @@ function copiesOfParentRow(bag) {
 	return copies === void 0 || copies.size === 0 ? {} : { inheritedPhysicalNameCopies: copies };
 }
 
-//#endregion
-//#region src/analyzer/drift-normalize.ts
-function canonicalizeTagListsDeep(v) {
-	if (Array.isArray(v)) {
-		const mapped = v.map(canonicalizeTagListsDeep);
-		if (mapped.length > 0 && mapped.every((t) => t && typeof t === "object" && typeof t.Key === "string")) return [...mapped].sort((a, b) => {
-			const ka = a.Key;
-			const kb = b.Key;
-			if (ka !== kb) return ka < kb ? -1 : 1;
-			return JSON.stringify(a) < JSON.stringify(b) ? -1 : 1;
-		});
-		return mapped;
-	}
-	if (v && typeof v === "object") {
-		if (!hasPlainPrototype(v)) return v;
-		const out = nullPrototypeRecord();
-		for (const [k, val] of Object.entries(v)) out[k] = canonicalizeTagListsDeep(val);
-		return out;
-	}
-	return v;
-}
-const ID_RE = /^[a-z][a-z0-9]*-[0-9a-f]{6,}$/;
-const isIdLike = (s) => typeof s === "string" && (s.startsWith("arn:") || ID_RE.test(s));
-function canonicalizeIdArraysDeep(v) {
-	if (Array.isArray(v)) {
-		const mapped = v.map(canonicalizeIdArraysDeep);
-		if (mapped.length > 1 && mapped.every(isIdLike)) return [...mapped].sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
-		return mapped;
-	}
-	if (v && typeof v === "object") {
-		if (!hasPlainPrototype(v)) return v;
-		const out = nullPrototypeRecord();
-		for (const [k, val] of Object.entries(v)) out[k] = canonicalizeIdArraysDeep(val);
-		return out;
-	}
-	return v;
-}
-const LEAF_ONLY_PATH_SUFFIX = "[]";
-function matchesPathPrefix(path, entries) {
-	for (const entry of entries) {
-		if (entry.endsWith("[]")) {
-			const leaf = entry.slice(0, -2);
-			if (leaf !== "" && path === leaf) return true;
-			continue;
-		}
-		if (path === entry) return true;
-		if (path.startsWith(`${entry}.`)) return true;
-	}
-	return false;
-}
-function canonicalizeUnorderedArraysAtPaths(v, paths) {
-	if (paths.length === 0) return v;
-	return walkUnordered(v, "", paths);
-}
-function canonicalJson(v) {
-	if (Array.isArray(v)) return `[${v.map(canonicalJson).join(",")}]`;
-	if (v && typeof v === "object") {
-		const bag = v;
-		return `{${Object.keys(bag).filter((k) => bag[k] !== void 0).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson(bag[k])}`).join(",")}}`;
-	}
-	return JSON.stringify(v) ?? "null";
-}
-const isPlainObjectElement = (el) => el !== null && typeof el === "object" && !Array.isArray(el);
-function walkUnordered(v, path, paths) {
-	if (Array.isArray(v)) {
-		const mapped = v.map((el) => Array.isArray(el) ? el : walkUnordered(el, path, paths));
-		if (mapped.length > 1 && matchesPathPrefix(path, paths)) {
-			if (mapped.every((el) => typeof el === "string")) return [...mapped].sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
-			if (mapped.every(isPlainObjectElement)) {
-				const keyed = mapped.map((el) => ({
-					el,
-					key: canonicalJson(el)
-				}));
-				keyed.sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0);
-				return keyed.map((k) => k.el);
-			}
-		}
-		return mapped;
-	}
-	if (v && typeof v === "object") {
-		if (!hasPlainPrototype(v)) return v;
-		const out = nullPrototypeRecord();
-		for (const [k, val] of Object.entries(v)) out[k] = walkUnordered(val, path === "" ? k : `${path}.${k}`, paths);
-		return out;
-	}
-	return v;
-}
-
-//#endregion
-//#region src/analyzer/drift-calculator.ts
-function calculateResourceDrift(stateProperties, awsProperties, options) {
-	const drifts = [];
-	const ignore = options?.ignorePaths ?? [];
-	const union = options?.unionWalkObjects ?? false;
-	const unordered = options?.unorderedPaths ?? [];
-	stateProperties = canonicalizeUnorderedArraysAtPaths(canonicalizeIdArraysDeep(canonicalizeTagListsDeep(stateProperties)), unordered);
-	awsProperties = canonicalizeUnorderedArraysAtPaths(canonicalizeIdArraysDeep(canonicalizeTagListsDeep(awsProperties)), unordered);
-	for (const key of Object.keys(stateProperties)) {
-		if (isIgnoredPath(key, ignore)) continue;
-		diffAt(key, stateProperties[key], awsProperties[key], drifts, ignore, union);
-	}
-	return drifts;
-}
-function undeclaredEmptyObservedKeys(observed, declared) {
-	const keys = [];
-	for (const key of Object.keys(observed)) {
-		if (Object.hasOwn(declared, key)) continue;
-		const value = observed[key];
-		if (value === null || value === void 0 || Array.isArray(value) && value.length === 0 || isPlainObject(value) && Object.keys(value).length === 0) keys.push(key);
-	}
-	return keys;
-}
-function isIgnoredPath(path, ignorePaths) {
-	return matchesPathPrefix(path, ignorePaths);
-}
-function diffAt(path, stateValue, awsValue, out, ignorePaths, unionWalkObjects) {
-	const stateForm = jsonForm(stateValue);
-	const awsForm = jsonForm(awsValue);
-	if (deepEqual(stateForm, awsForm)) return;
-	if (typeof stateValue === "string" && stateValue.includes("{{resolve:")) return;
-	if (isPlainObject(stateForm) && isPlainObject(awsForm) && !Array.isArray(stateForm) && !Array.isArray(awsForm)) {
-		const keys = unionWalkObjects ? /* @__PURE__ */ new Set([...Object.keys(stateForm), ...Object.keys(awsForm)]) : Object.keys(stateForm);
-		for (const key of keys) {
-			const childPath = `${path}.${key}`;
-			if (isIgnoredPath(childPath, ignorePaths)) continue;
-			diffAt(childPath, stateForm[key], awsForm[key], out, ignorePaths, unionWalkObjects);
-		}
-		return;
-	}
-	out.push({
-		path,
-		stateValue,
-		awsValue
-	});
-}
-function jsonForm(value) {
-	if (value === null || typeof value !== "object" || hasPlainPrototype(value)) return value;
-	const toJSON = value.toJSON;
-	return typeof toJSON === "function" ? toJSON.call(value) : value;
-}
-function deepEqual(a, b) {
-	a = jsonForm(a);
-	b = jsonForm(b);
-	if (a === b) return true;
-	if (a === null || b === null || a === void 0 || b === void 0) return a === b;
-	if (typeof a !== typeof b) return false;
-	if (typeof a !== "object") return false;
-	if (Array.isArray(a) || Array.isArray(b)) {
-		if (!Array.isArray(a) || !Array.isArray(b)) return false;
-		if (a.length !== b.length) return false;
-		return a.every((v, i) => deepEqual(v, b[i]));
-	}
-	const aObj = a;
-	const bObj = b;
-	const aKeys = Object.keys(aObj);
-	const bKeys = Object.keys(bObj);
-	if (aKeys.length !== bKeys.length) return false;
-	for (const key of aKeys) {
-		if (!Object.prototype.hasOwnProperty.call(bObj, key)) return false;
-		if (!deepEqual(aObj[key], bObj[key])) return false;
-	}
-	return true;
-}
-function equalModuloMask(state, aws, mask) {
-	const a = jsonForm(state);
-	const b = jsonForm(aws);
-	if (a === mask && b !== null && b !== void 0) return true;
-	if (a === b) return true;
-	if (a === null || b === null || a === void 0 || b === void 0) return a === b;
-	if (typeof a !== typeof b || typeof a !== "object") return false;
-	if (Array.isArray(a) || Array.isArray(b)) {
-		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-		return a.every((v, i) => equalModuloMask(v, b[i], mask));
-	}
-	const aObj = a;
-	const bObj = b;
-	const aKeys = Object.keys(aObj);
-	if (aKeys.length !== Object.keys(bObj).length) return false;
-	return aKeys.every((key) => Object.prototype.hasOwnProperty.call(bObj, key) && equalModuloMask(aObj[key], bObj[key], mask));
-}
-function equalModuloMarkedMask(state, aws, mask, coordinate, isMarked, isWithinMarked = isMarked) {
-	const a = jsonForm(state);
-	const b = jsonForm(aws);
-	if (isMarked(coordinate) && b !== void 0 && b !== null) {
-		if (a === mask) return true;
-		if (isWithinMarked(coordinate) ? isWhollyMask(a, mask) : sameJson(a, wholeMaskOf(b, mask))) return holdsMask(a, mask);
-	}
-	if (a === mask && (typeof b === "string" || typeof b === "number" || typeof b === "boolean")) return true;
-	if (a === b) return true;
-	if (a === null || b === null || a === void 0 || b === void 0) return a === b;
-	if (typeof a !== typeof b || typeof a !== "object") return false;
-	if (Array.isArray(a) || Array.isArray(b)) {
-		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-		return a.every((v, i) => equalModuloMarkedMask(v, b[i], mask, [...coordinate, i], isMarked, isWithinMarked));
-	}
-	const aObj = a;
-	const bObj = b;
-	const aKeys = Object.keys(aObj);
-	if (aKeys.length !== Object.keys(bObj).length) return false;
-	return aKeys.every((key) => Object.prototype.hasOwnProperty.call(bObj, key) && equalModuloMarkedMask(aObj[key], bObj[key], mask, [...coordinate, key], isMarked, isWithinMarked));
-}
-function wholeMaskOf(value, mask) {
-	if (value === null || value === void 0) return value;
-	if (Array.isArray(value)) return value.map((v) => wholeMaskOf(v, mask));
-	if (isPlainObject(value)) return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, wholeMaskOf(v, mask)]));
-	return mask;
-}
-function isWhollyMask(value, mask) {
-	const walk = (node) => {
-		if (node === mask || node === null) return true;
-		if (Array.isArray(node)) return node.every(walk);
-		if (isPlainObject(node)) return Object.values(node).every(walk);
-		return false;
-	};
-	return walk(value) && holdsMask(value, mask);
-}
-function holdsMask(value, mask) {
-	if (value === mask) return true;
-	if (Array.isArray(value)) return value.some((v) => holdsMask(v, mask));
-	if (isPlainObject(value)) return Object.values(value).some((v) => holdsMask(v, mask));
-	return false;
-}
-function sameJson(a, b) {
-	if (a === b) return true;
-	if (a === null || b === null || typeof a !== "object" || typeof b !== "object") return false;
-	if (Array.isArray(a) || Array.isArray(b)) {
-		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-		return a.every((v, i) => sameJson(v, b[i]));
-	}
-	const aObj = a;
-	const bObj = b;
-	const keys = Object.keys(aObj);
-	return keys.length === Object.keys(bObj).length && keys.every((k) => Object.prototype.hasOwnProperty.call(bObj, k) && sameJson(aObj[k], bObj[k]));
-}
-function isPlainObject(value) {
-	return typeof value === "object" && value !== null;
-}
-
 //#endregion
 //#region src/analyzer/drift-principal-normalize.ts
 const PRINCIPAL_UNIQUE_ID_RE = /^A(?:ROA|IDA)[A-Z0-9]{6,}$/;
@@ -9832,7 +9594,7 @@ async function driftCommand(stacks, options) {
 			return;
 		}
 		let outcome;
-		if (options.accept) outcome = await runAccept(reports, stateBackend, stateConfig, awsClients, options);
+		if (options.accept) outcome = await runAccept(reports, stackRegionScope, stateBackend, stateConfig, awsClients, options);
 		else try {
 			outcome = await runRevert(reports, stackRegionScope, stateBackend, stateConfig, awsClients, options);
 		} catch (err) {
@@ -10529,7 +10291,8 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 					} : protocolNormalized;
 					const paired = provider.canonicalizeDriftPair ? await provider.canonicalizeDriftPair(resource.resourceType, canonicalized.baseline, canonicalized.aws, resource.properties ?? {}) : canonicalized;
 					const nameBaseline = canonicalizeDerivedPatternBName(resource.resourceType, paired.baseline, paired.aws);
-					const noEchoPartitioned = partitionNoEchoParameterChanges(calculateResourceDrift(nameBaseline, paired.aws, {
+					const comparedBaseline = useObserved ? withAbsentDefaultKeys(nameBaseline, paired.aws, driftAbsentMeansDefaultKeys(provider, resource.resourceType, resource.properties)) : nameBaseline;
+					const noEchoPartitioned = partitionNoEchoParameterChanges(calculateResourceDrift(comparedBaseline, paired.aws, {
 						ignorePaths: observedIgnorePaths.length ? [...ignorePaths, ...observedIgnorePaths] : ignorePaths,
 						unionWalkObjects: useObserved,
 						unorderedPaths
@@ -10684,7 +10447,7 @@ function setAtPath(target, path, value) {
 	}
 	defineOwnKey(cursor, segments[segments.length - 1], value);
 }
-async function runAccept(reports, stateBackend, stateConfig, awsClients, options) {
+async function runAccept(reports, regionScope, stateBackend, stateConfig, awsClients, options) {
 	const logger = getLogger();
 	const out = humanTextSink(options.json);
 	const lockRecovery = {
@@ -10760,11 +10523,15 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 				}
 				if (recordedChanges > 0) acceptedResourceCount++;
 				const written = maskMarkedNoEchoBaselineWithLeaves(redactedBaseline, existing, hasObserved);
+				const settled = await settleUnsettled(existing, outcome.logicalId, () => regionScope(report.region).registry.getProviderFor({
+					resourceType: outcome.resourceType,
+					provisionedBy: existing.provisionedBy
+				}).provider);
 				resources[outcome.logicalId] = hasObserved ? {
-					...existing,
+					...settled,
 					observedProperties: written.baseline
 				} : {
-					...existing,
+					...settled,
 					properties: written.baseline,
 					...written.noEchoLeaves !== void 0 && { noEchoLeaves: written.noEchoLeaves }
 				};
@@ -11144,6 +10911,7 @@ function preserveLiveValuesAtMaskedLeaves(send, awsProperties, secrets, corrobor
 }
 function buildRevertNewProperties(drifts, desiredProperties, awsProperties, options = {}) {
 	const preserveUntemplated = options.preserveUntemplated === true;
+	const absentMeansDefault = options.absentMeansDefault ?? [];
 	const result = { ...awsProperties };
 	for (const d of drifts) {
 		const topLevelKey = d.path.split(".", 1)[0];
@@ -11156,10 +10924,25 @@ function buildRevertNewProperties(drifts, desiredProperties, awsProperties, opti
 				const baselineIsTagList = isCfnTagList(desiredValue) || Array.isArray(desiredValue) && desiredValue.length === 0;
 				defineOwnKey(result, topLevelKey, isTagListKey(topLevelKey) && baselineIsTagList && isCfnTagList(awsValue) ? mergeTagListForRevert(desiredValue, awsValue) : desiredValue);
 			}
-		}
+		} else if (absentMeansDefault.includes(topLevelKey)) delete result[topLevelKey];
 	}
 	return result;
 }
+function driftAbsentMeansDefaultKeys(provider, resourceType, properties) {
+	if (provider.getDriftAbsentMeansDefaultKeys === void 0 || !isPlainRecord(properties)) return [];
+	const keys = provider.getDriftAbsentMeansDefaultKeys(resourceType, properties);
+	const dotted = keys.filter((key) => key.includes("."));
+	if (dotted.length === 0) return keys;
+	getLogger().debug(safeMsg`${resourceType}: getDriftAbsentMeansDefaultKeys returned non-top-level name(s) ` + safeMsg`${dotted.join(", ")}; ignored (top-level property names only).`);
+	return keys.filter((key) => !key.includes("."));
+}
+function withAbsentDefaultKeys(baseline, aws, keys) {
+	const missing = keys.filter((key) => !hasOwnKey(baseline, key) && hasOwnKey(aws, key));
+	if (missing.length === 0) return baseline;
+	const out = { ...baseline };
+	for (const key of missing) defineOwnKey(out, key, void 0);
+	return out;
+}
 function collectNarrowedTopLevelKeys(sent, effective) {
 	const delta = Object.create(null);
 	for (const key of /* @__PURE__ */ new Set([...Object.keys(sent), ...Object.keys(effective)])) {
@@ -11246,6 +11029,7 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 			}));
 			const narrowedByLogicalId = /* @__PURE__ */ new Map();
 			const reRecordedByLogicalId = /* @__PURE__ */ new Map();
+			const settledByRevert = /* @__PURE__ */ new Map();
 			try {
 				const revertSecretResolvers = new DriftSecretResolvers(report.region);
 				const revertProducerRegions = report.producerRegions;
@@ -11312,7 +11096,7 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 					let newProperties;
 					try {
 						if (provider.canonicalizeDriftPair) desiredProperties = (await provider.canonicalizeDriftPair(outcome.resourceType, desiredProperties, outcome.awsProperties, stateResource.properties ?? {})).baseline;
-						const certifiedOverlay = overlayLiveAtUncertifiedPaths(buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties, { preserveUntemplated: stateResource.observedProperties === void 0 }), [...outcome.uncertifiedPaths, ...outcome.noEchoParameterPaths ?? []], outcome.awsProperties, desiredProperties, secrets, new Set(outcome.changes.map((change) => change.path.split(".", 1)[0] ?? "")), spelledKeysOf(stateResource.properties ?? {}));
+						const certifiedOverlay = overlayLiveAtUncertifiedPaths(buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties, stateResource.observedProperties === void 0 ? { preserveUntemplated: true } : { absentMeansDefault: driftAbsentMeansDefaultKeys(provider, outcome.resourceType, stateResource.properties) }), [...outcome.uncertifiedPaths, ...outcome.noEchoParameterPaths ?? []], outcome.awsProperties, desiredProperties, secrets, new Set(outcome.changes.map((change) => change.path.split(".", 1)[0] ?? "")), spelledKeysOf(stateResource.properties ?? {}));
 						const maskPreserved = preserveLiveValuesAtMaskedLeaves(unresolvedTokens.size > 0 ? preserveLiveValuesAtUnresolvedTokens(certifiedOverlay, outcome.awsProperties, unresolvedTokens, secrets) : certifiedOverlay, outcome.awsProperties, secrets, certifiedOverlay, spelledKeysOf(stateResource.properties ?? {}));
 						if (maskPreserved.unpreservablePaths.length > 0) {
 							totalUnresolvable++;
@@ -11335,7 +11119,17 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 						return;
 					}
 					try {
-						const updateResult = await withRetry(() => provider.update(outcome.logicalId, stateResource.physicalId, outcome.resourceType, newProperties, outcome.awsProperties, {
+						const revertPrevious = await settleUnsettledPrevious({
+							provider,
+							logicalId: outcome.logicalId,
+							physicalId: stateResource.physicalId,
+							resourceType: outcome.resourceType,
+							recordedProperties: stateResource.properties ?? {},
+							names: unsettledPropertiesOf(stateResource),
+							previous: outcome.awsProperties,
+							desired: newProperties
+						});
+						const updateResult = await withRetry(() => provider.update(outcome.logicalId, stateResource.physicalId, outcome.resourceType, newProperties, revertPrevious, {
 							desiredFromAwsReadback: true,
 							declaredEmptyProperties: declaredEmptyProperties(stateResource.properties),
 							maskSecrets: createSecretMasker(secrets),
@@ -11344,6 +11138,19 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 							removedProperties: /* @__PURE__ */ new Set()
 						}), outcome.logicalId, { logger: maskingRetryLogger(logger, secrets) });
 						totalSucceeded++;
+						const unsettledNames = unsettledPropertiesOf(stateResource);
+						if (unsettledNames.size > 0) {
+							const settled = await withUnprovenUnsettled(withoutUnsettledProperties(stateResource), {
+								provider,
+								logicalId: outcome.logicalId,
+								physicalId: stateResource.physicalId,
+								resourceType: outcome.resourceType,
+								recordedProperties: stateResource.properties ?? {},
+								names: unsettledNames,
+								desired: newProperties
+							}, (message) => logger.warn(maskSecretsInText(message, secrets)));
+							if (unsettledPropertiesOf(settled).size < unsettledNames.size) settledByRevert.set(outcome.logicalId, settled);
+						}
 						const revertPartial = updatePartialReason(updateResult);
 						if (revertPartial !== void 0) logger.warn(`  ✓ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, ${maskSecretsInText(updatePartialMessage(revertPartial), secrets)}`);
 						else logger.info(`  ✓ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted.`);
@@ -11388,8 +11195,15 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 						logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): AWS update failed — ${msg}`);
 					}
 				})), concurrency);
-				if (narrowedByLogicalId.size > 0 || reRecordedByLogicalId.size > 0) {
+				if (narrowedByLogicalId.size > 0 || reRecordedByLogicalId.size > 0 || settledByRevert.size > 0) {
 					const resources = { ...report.state.resources };
+					let settledCount = 0;
+					for (const [logicalId, settled] of settledByRevert) {
+						const existing = resources[logicalId];
+						if (!existing) continue;
+						resources[logicalId] = withUnsettledProperties(withoutUnsettledProperties(existing), unsettledPropertiesOf(settled));
+						settledCount++;
+					}
 					let recordedCount = 0;
 					for (const [logicalId, delta] of narrowedByLogicalId) {
 						const existing = resources[logicalId];
@@ -11432,10 +11246,11 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 							...identity.attributes !== void 0 && { attributes: identity.attributes }
 						};
 					}
-					if (recordedCount === 0 && reRecordedCount === 0) return;
+					if (recordedCount === 0 && reRecordedCount === 0 && settledCount === 0) return;
 					const recordedParts = [];
 					if (recordedCount > 0) recordedParts.push(`the value the provider actually applied on ${recordedCount} resource(s)`);
 					if (reRecordedCount > 0) recordedParts.push(`the identity the revert returned on ${reRecordedCount} resource(s)`);
+					if (settledCount > 0) recordedParts.push(`that a failed deploy's unsettled properties are settled on ${settledCount} resource(s)`);
 					const recordedWhat = recordedParts.join(" and ");
 					const { skippedOutputs: _droppedByRevert, ...carriedState } = report.state;
 					const newState = {
@@ -11451,7 +11266,11 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 						logger.info(`✓ State updated for ${report.stackName} (${report.region}): recorded ${recordedWhat}.`);
 					} catch (err) {
 						const revertAgain = revertCommandLine(report.stackName, report.region);
-						const unrecorded = [...recordedCount > 0 ? ["the value the provider actually applied"] : [], ...reRecordedCount > 0 ? ["the identity the revert returned"] : []].join(" and ");
+						const unrecorded = [
+							...recordedCount > 0 ? ["the value the provider actually applied"] : [],
+							...reRecordedCount > 0 ? ["the identity the revert returned"] : [],
+							...settledCount > 0 ? ["that a failed deploy's unsettled properties are settled"] : []
+						].join(" and ");
 						logger.warn(`Reverted ${report.stackName} (${report.region}), but could not record ${unrecorded}: ${describeAwsFailure(err).detail}.` + (reRecordedCount > 0 ? " The state record still holds the physical id and attributes from before the revert, which a later 'Fn::GetAtt' and 'cdkd export' read. Re-running the revert does not repair it, since the revert landed; a later deploy that updates this resource records the identity its update returns." : "") + (recordedCount > 0 ? ` The next 'cdkd drift' will report the same difference — ` + (revertAgain === void 0 ? `re-run 'cdkd drift --revert' for this stack once the state write can succeed.` : `re-run the command below once the state write can succeed.\nRevert with: ${revertAgain}`) : ""));
 					}
 				}
@@ -11607,8 +11426,38 @@ async function confirmPrompt$5(prompt, out) {
 		refusal: "The cdkd drift confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes to confirm, or run the command from a real terminal."
 	});
 }
+async function settleUnsettled(record, logicalId, providerOf) {
+	const names = unsettledPropertiesOf(record);
+	if (names.size === 0) return record;
+	let kept = /* @__PURE__ */ new Set();
+	try {
+		const provider = providerOf();
+		if (provider?.unsettledInTransition !== void 0) kept = await provider.unsettledInTransition(record.physicalId, logicalId, record.resourceType, names, record.properties);
+	} catch {
+		kept = names;
+	}
+	const keep = [...names].filter((name) => kept.has(name));
+	if (keep.length === names.size) return record;
+	return withUnsettledProperties(withoutUnsettledProperties(record), keep);
+}
+function unsettledRowsOf(report) {
+	const rows = [];
+	const resources = report.state.resources ?? {};
+	for (const logicalId of Object.keys(resources).sort()) {
+		const record = resources[logicalId];
+		const names = unsettledPropertiesOf(record);
+		if (names.size === 0) continue;
+		rows.push({
+			logicalId,
+			type: typeof record?.resourceType === "string" ? record.resourceType : "unknown",
+			properties: [...names].sort()
+		});
+	}
+	return rows;
+}
 function writeJsonReport(reports) {
 	const payload = reports.map((r) => {
+		const unsettled = unsettledRowsOf(r);
 		const drifted = [];
 		const clean = [];
 		const deleted = [];
@@ -11666,6 +11515,7 @@ function writeJsonReport(reports) {
 			stack: r.stackName,
 			region: r.region,
 			...r.warnings.length > 0 && { warnings: r.warnings },
+			...unsettled.length > 0 && { unsettled },
 			drifted,
 			deleted,
 			clean,
@@ -11792,6 +11642,17 @@ function writeHumanReport(reports) {
 				process.stdout.write("\n");
 			}
 		}
+		const unsettledRows = unsettledRowsOf(report);
+		if (unsettledRows.length > 0) {
+			process.stdout.write(`\n! ${reportHeading(report)}: a failed deploy left properties unsettled on ${unsettledRows.length} resource${unsettledRows.length === 1 ? "" : "s"} (AWS may hold the recorded value or the attempted one). The next 'cdkd deploy' sends them again; a successful --accept or --revert of the resource clears them.\n`);
+			for (const row of unsettledRows) {
+				const names = row.properties.map((name) => safeMsg`${reportIdent(name, 255)}`).join(", ");
+				process.stdout.write(`    ! ${reportResource({
+					logicalId: row.logicalId,
+					resourceType: row.type
+				})}: ${names}\n`);
+			}
+		}
 		if (notCompared.length > 0) {
 			const notComparedAtAll = notCompared.filter((n) => !ANY_OF_IT_COMPARED[n.cause]).length;
 			const referenceCaused = notCompared.length - notComparedAtAll;
@@ -20150,7 +20011,7 @@ async function rollbackCommand(stackArg, options) {
 						...carriedState,
 						...stackInstanceIdCarriedFrom(baseState),
 						...supersededAfterRollback(baseState, supersededHost),
-						version: 13,
+						version: 14,
 						region,
 						resources: { ...stateResources },
 						...orphansAfterRollback(baseState, mintedOrphans),
@@ -23718,7 +23579,7 @@ function buildStackState(stackName, region, rows, templateParser, template, exis
 	}
 	if (namesParameter?.failedClosed !== void 0) getLogger().debug(`The template's parameter dependence could not be judged (${namesParameter.failedClosed}): every prior observed-baseline refusal recorded without a reason is carried as an unverifiable-parameter refusal.`);
 	return {
-		version: 13,
+		version: 14,
 		stackName,
 		region,
 		resources,
@@ -31724,4 +31585,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { resolveSecretDerivedPrincipals as a, buildProgram, isResolvableSecretPrincipalList as i, runDestroyForStack as n, canonicalizeIpProtocolValue as o, holdsUnprovenSecretPrincipalToken as r, resolvedResourceTimeoutMs as s, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-DOPic-aS.js.map
+//# sourceMappingURL=program-Bnt3Yt0k.js.map