@go-to-k/cdkd 0.308.1 → 0.310.0

package/dist/{program-Ymf7svYk.js → program-CS420Kx9.js}

@@ -2,8 +2,8 @@ import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients,
 import { $ as stringifyJsonPayload, A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, Q as safeMsg, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, W as cutMarker, Y as isPasteableIdent, Z as plainIdentOr, _ as PATTERN_B_RESOURCE_TYPES, a as safeStringify, b as derivesPatternBName, c as isStdoutReservedForPayload, d as runStackBuffered, et as terminalSafe, g as PATTERN_B_NAME_PROPERTIES, h as PATTERN_B_NAME_OPTIONS, l as reserveStdoutForPayload, m as getLiveRenderer, n as describeAwsFailure, q as displaySafe, s as getLogger, tt as truncateCodePoints, x as explicitNamePropertyFor, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-NSBdKPYK.js";
 import { An as StateError, Cn as NestedStackChildDirectDestroyError, Cr as markNonRetryable, Dn as ResourceUpdateNotSupportedError, E as isMarkedNotGone, En as ResourceTimeoutError, Fn as normalizeAwsError, Gt as formatLockExpiry, Ht as buildForceUnlockCommand, I as remedyLogicalId, In as withErrorHandling, Jn as shellBoundedDisplay, Kn as plainOrDescribed, Kt as formatLockOperation, Ln as TIMEOUT_FLAG_RESOURCE_TYPE, Mn as formatError, O as assertRegionMatch, On as StackHasActiveImportsError, Qn as setPasteableVerbFlags, Qt as injectiveKey, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Un as isInertUnquoted, Ut as buildLockContentionMessage, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Wt as forceQuitRecoveryClause, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Yn as shellQuote, Z as runDeleteAttempt, Zn as setPasteableRunFlags, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp, dt as interruptWatchListenerCount, en as producerCoordinateKey, fn as CrossAccountSecretRefusalError, ft as isInterruptedWaitError, gn as DynamicReferenceRegionAmbiguousError, in as ambientClientDefaults, jn as SynthesisError, k as VALUE_NOT_SHOWN, kn as StackTerminationProtectionError, lr as stripControlChars, lt as beginCommandInterruptScope, mn as DeployCancelledError, mr as isAmbiguousOutcomeError, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as setPasteableAwsProfile, on as clientDefaultsFor, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rt as isAwsCliLiteral, s as readRecordedPrincipals, sn as credentialFingerprint, t as IAM_PRINCIPAL_NAME, tn as producerRecordKey, un as CdkdError, ur as stripForDisplay, ut as endCommandInterruptScope, vn as LocalInvokeBuildError$1, vr as isTransientServerError, vt as logicalIdShown, wn as PartialFailureError, xr as isMarkedNonRetryable, yn as LocalStartServiceError, yr as retryClassificationText, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-D94wh05t.js";
 import { a as setAssumedRoleCredentials, d as formatAuthority, i as getPreAssumeEnvCredentials, n as awsClientDefaults, r as getAssumedRoleCredentials, u as runInStackAwsScope } from "./aws-client-defaults-BX9Y_fKp.js";
-import { $ as computeImplicitDeleteEdges, $a as AWS_NO_VALUE, $i as RollbackInlinePolicyWriters, $l as getBootstrapMarkerKey, $n as carriedExportAliasExposure, $o as refuseMalformedResourceEntriesForDeploy, $r as namingSecretsWithRecordedNoEcho, $u as StageLoadError, Aa as applyRoleArnIfSet, Ac as logOnlyValueCount, Al as hasUnverifiableParameterRefusal, Ao as malformedOrphanRowsKeptWarning, Ar as cyan, As as MULTI_REGION_RECREATE_BLOCKED_TYPES, At as displacedOpClause, Au as loadCdkJson, Ba as classifyRecordedSecretRegion, Bc as scrubResourceRecord, Bl as timePhase, Bn as retiredNameGenerationsAfter, Bo as malformedStateRefusalMessage, Br as supersededAfterRollback, Bt as getCurrentNestedStackContext, Bu as ssmResolvedValueType, Ca as resolveDynamicReferences, Cc as redactForState, Ci as extractDeploymentEventError, Cl as withStackInstanceIdWithheld, Cn as replacementNeverSwapped, Co as malformedExportNamesWarning, Cr as proposeRenames, Ct as makeSiblingClaimReader, Cu as warnFinchArgvExposure, Dc as createUnionSecretMasker, Dl as exportNamesCarriedFrom, Dn as findNestedStackTypeChanges, Do as malformedLocalResourcesWarning, Dr as withStackRecords, Ds as hasNoCloudControlHandlers, Dt as keptForRetainedRecord, Du as synthesisStatusMessage, Ea as keepHeldTokenProvenance, Ec as carryLogOnlyValues, El as describeRegionValueKind, En as orphanNeedsIdentity, Eo as malformedLocalResourceEntriesWarning, Es as NO_CC_HANDLERS_REASON, Et as resolvePendingCloudControlRequests, Eu as Synthesizer, Fa as sendableAssumeRoleCommand, Fc as unionOfSecretBags, Fi as CC_BROKEN_REASON, Fl as orphansCarriedFrom, Fn as updatePartialReason, Fo as malformedRenderedContainersWarning, Fr as addSuperseded, Ft as recordDisplacedSkips, Fu as resolveStateBucketWithDefault, Ga as isUnboundTemplateParameter, Gc as isUncertifiedBaselineMaskPosition, Gi as withPrintingSecrets, Gl as buildAssetRedirectMap, Gn as reachableDivergentParameters, Go as refuseMalformedOrphanRecordsForDestroy, Gr as noEchoAttributeNamesOf, Gt as isHandledOrphan, Gu as uploadCfnTemplate, Ha as producerRegionsFromState, Hi as readsNoEchoDeleteValues, Hl as isSensitiveAttributeName, Hn as withNameGenerationReached, Ho as refuseDivergentRecordRegionForDestroy, Hr as supersededHolderOf, Ht as deleteJournaledOrphans, Hu as CFN_TEMPLATE_URL_LIMIT, Ia as AWS_CREDENTIAL_ENV_KEYS, Ic as createSecretMasker, Ii as ProviderRegistry, Il as shouldRetainResource, In as nameGenerationCarriedFrom, Io as malformedResourceEntriesWarning, Ir as deleteSupersededEntry, Iu as resolveStateBucketWithDefaultAndSource, Ja as isImpossibleEmptyStoredAttribute, Jc as identityKeyFor, Ji as customResourceResponseExpirationWarning, Jl as rewriteTemplateAssetReferences, Jn as displayTextOrWithheld, Jo as refuseMalformedOrphansForOrphan, Jr as noEchoParameterNamesOf, Jt as makeForeignHolderScan, Ju as expectedOwnerParam, Ka as parameterTypeMayLoseSecretIdentity, Kc as pathCrossesDottedKey, Ki as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Kl as createAssetRedirectResolver, Kn as resourcesNamingDeclaredParameter, Ko as refuseMalformedOrphans, Kr as noEchoComparisonForTemplate, Kt as journaledOrphanLines, Ku as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, La as applyCallerIdentityCredentials, Lc as errorCauseChain, Li as ccBrokenReason, Ll as stackInstanceIdCarriedFrom, Ln as nameGenerationHighWaterOf, Lo as malformedResourcePropertiesWarning, Lr as holdsSupersededResources, Lt as revertedNestedRowIds, Lu as resolveUseCdkBootstrapAssets, Ma as assertSendableRoleArn, Mc as recordLogOnlyParameterValue, Ml as importableOutputs, Mo as malformedOrphansWarning, Mr as green, Ms as isStatefulRecreateTargetSync, Mt as dropSettledNestedJournals, Mu as resolveAutoAssetStorage, Na as explicitRoleArnOrThrow, Nc as recordLogOnlyValue, Nl as isReadableBag, No as malformedOutputsRefusalMessage, Nr as red, Ns as renderStatefulReason, Nu as resolveCaptureObservedState, Oa as recordedOutputReferenceRegions, Oc as hasMaskableValues, Ol as hasReadableExportSet, Oo as malformedOrphanRecordsRefusalMessage, Os as findReplacedReadersOfRecreateTargets, Ot as recordRetainedForReadoption, Ou as getDefaultStateBucketName, Pa as isIamRoleArn, Pc as shareLogOnlyValues, Pl as orphansAfterRollback, Pn as updatePartialMessage, Po as malformedOutputsWarning, Pr as yellow, Pt as nestedChildStackName$1, Pu as resolveSkipPrefix, Q as IMPLICIT_DELETE_DEPENDENCIES, Qa as keepsSecretReferenceToken, Qc as physicalNameCopiesOf, Ql as ensureAssetStorage, Qn as secretSafeKeyDisplay, Qo as refuseMalformedResourceEntries, Qr as maskEventTextWithBoundBags, Qs as withRetry, Qu as AssemblyReader, Ra as callerEnvCredentials, Rc as maskSecretsInError, Ri as isCustomResource, Rl as PhaseClock, Rn as nameScopeOf, Ro as malformedResourcesWarning, Rr as isSupersededResourceRecord, Rt as withNestedRevertRun, Ru as stateBucketExistenceConfirmed, Si as DeploymentEventsStore, Sl as stackInstanceIdOf, Sn as recordUnderIdIsNotOwn, So as malformedDriftResourcePropertiesWarning, Sr as parseMappingFile, Ss as findActionableSilentDrops, St as makeCanonicalizePropertiesFn, Su as runDockerStreaming, Ta as refuseUnreadableCdkCrossAccountRefs, Tl as acceptedCreateOnlyDropsOf, Tn as seedsDeleteFirstGuard, To as malformedLocalOutputsWarning, Tr as destroyStackRecordsView, Tt as pendingRequestCount, Tu as getDockerImageBySourceHash, Ua as regionLessSecretName, Uc as DYNAMIC_REFERENCE_TOKEN_SCAN, Ui as isCustomResourceType$1, Ul as stringifyValue, Un as computeParameterTaint, Ur as supersededResourcesOf, Ut as dropFailedCommands, Uu as MIGRATE_TMP_PREFIX, Va as classifyReplaySecretRegion, Vc as withPhysicalNameCopies, Vi as TemplateNoEchoReresolver, Vl as AssetPublisher, Vn as retiredNameGenerationsLeaving, Vo as previewableOrphanRecords, Vr as supersededHeldByOtherTypeWarning, Vt as withNestedStackContext, Vu as CFN_TEMPLATE_BODY_LIMIT, Wa as coerceParameterTypedValue, Wc as dynamicReferenceTokens, Wl as WorkGraph, Wn as namesAnyDeclaredParameter, Wo as refuseMalformedOrphanRecords, Wr as withoutSuperseded, Wt as dropFailedHint, Wu as findLargeInlineResources, Xa as carriesFetchableDynamicReference, Xc as recordNestedStackParameterExpressions, Xi as slowCcOperationTimeoutMs, Xl as BOOTSTRAP_MARKER_PREFIX, Xn as secretBearing, Xo as refuseMalformedOutputsForDestroy, Xr as completedReplayEntries, Xs as templateResourceTypes, Xt as formatResourceLine, Xu as canonicalizeRegion, Ya as carriesDynamicReference, Yc as inheritNestedStackParameterAssociations, Yi as CloudControlProvider, Yl as AssetModeResolver, Yn as exportAliasCollisionScrubWarning, Yo as refuseMalformedOutputs, Yr as createReadOnlyAttributeHealerFactory, Ys as prefetchCreateOnlyPropertyPaths, Yt as sameJournaledOrphans, Yu as PARTITION_TABLE, Za as isNamelessDynamicReferenceError, Zl as assertAssetBucketRegion, Zn as secretBearingStateKeyWarning, Zo as refuseMalformedResourceAttributesForOrphan, Zr as journaledOrphanPrintingBag, Zs as describeTypeWithThrottleRetry, Zu as derivePartitionAndUrlSuffix, _c as readbackPathFor, _d as resolveBucketRegion, _i as ledgerForStack, _l as CrossPrefixScanCache, _n as isJournaledOrphan, _o as hasReadableOrphans, _r as rollbackOrphanIds, _s as repairMalformedResourcesForReadOnly, _t as withResourceDeadline, _u as partitionSensitiveEnv, a as isProtectionValueActive, aa as isWaitAbandonedError, ac as DagBuilder, ad as hasOwnKey, ai as stateSecretNameNeedles, al as recordMaskOnlyValuesIn, an as refuseRefactorMarker, ao as withSharedDrainBudget, ar as collectPublishedOutputNames, as as refuseMalformedResourcePropertiesForDrift, at as childTemplateLoader, au as buildDenyExternalAccessPolicy, bc as valueAtCoordinate, bl as isAccessDenied, bn as planRollback, bo as isReadableOrphanRecord, br as looselyEqual, bs as unreadableResourceEntries, bt as keptWholeReasonText, bu as redactedDockerCause, cc as isMarkedCoordinate, cd as ownValue, ci as PRE_DELETE_SNAPSHOT_TYPES, cl as recordProvenPublicExpression, cn as hasPendingMovesOut, co as declaresNoEcho, cr as DEFAULT_RESOURCE_TIMEOUT_MS, cs as refuseMalformedResourcesForDeploy, ct as listNestedTemplateRows, cu as describeDockerCapturedOutput, dc as maskWholeValue, dd as displayAssemblyPath, di as createPreDeleteFinalSnapshot, dl as isSingleDynamicReferenceToken, dn as refusePendingMovesOut, do as STATE_RESOURCES_MALFORMED, dr as constructPathOf$1, ds as refuseMalformedState, dt as conditionFingerprint, du as dockerSpawnEnvWithSensitive, ea as UNSPECIFIED_SKIP_REASON, ed as processStackMessages, ei as orphanRecordsPrintingBag, el as recordPhysicalNameCopy, eo as cfnRefValueFromPhysicalId, er as exportNameNoEchoParameters, es as refuseMalformedResourceEntriesForDestroy, et as crossStackOutputProvenanceSource, eu as isCrossRegionRedirect, fc as maskedLeafCoordinatesOf, fd as renderAssemblyPathEscape, fi as effectiveDeletionPolicy, fl as LockManager, fn as replayFailedOperations, fo as UNREADABLE_ORPHANS_CONTAINER_ROW, fr as findDestructiveChanges, fs as repairMalformedOrphanRecordsForReadOnly, ft as conditionInputsFrom, fu as finchSecretArgvRefusal, ga as poisonRenderedSpellingsCollidingIn, gl as CrossPrefixReadError, gn as demoteSupersededOrphans, go as displayLogicalId, gr as movedToHint, gs as repairMalformedResourcePropertiesForReadOnly, gu as isMalformedEnvKey, ha as IntrinsicFunctionResolver, hc as noEchoOutputsComparison, hd as injectedAwsRegionValue, hi as unsupportedFinalSnapshotError, hl as rebuildClientForBucketRegion, hn as recordAfterRollbackUpdate, ho as deployRefusesOrphanRowsReason, hr as hintSidesOf, hs as repairMalformedResourceEntriesForReadOnly, hu as isDockerClientEnvKey, i as PROTECTION_PROPERTY_BY_TYPE, id as defineOwnKey, ii as secretNamedRecordNeedles, il as recordMaskOnlyValue, in as refactorMarkerRefusalMessage, ir as collectDeclaredOutputNames, is as refuseMalformedResourcePropertiesForDestroy, it as serviceTokenBlockingReason, iu as validateContainerRepoName, ja as assertFlagRoleArn, jc as printingCorpusOf, jl as importableOutputKeys, jo as malformedOrphansRefusalMessage, jr as gray, js as isStatefulRecreateTargetForReplace, jt as displacedPhysicalIdShown, ju as resolveApp, ka as recordedReferenceRegions, kc as literalSplitDelimitersOf, kl as hasReasonlessBaselineRefusal, kn as inheritProducerRegions, ko as malformedOrphanRecordsWarning, kr as bold, ks as shownType, kt as NESTED_PENDING_PARENT_REASON, ku as getLegacyStateBucketName, lc as maskAtCoordinates, ld as absoluteAssemblyPathEscape, li as buildFinalSnapshotIdentifier, ll as wholeStringLeavesOf, ln as pendingMovesOutOf, lo as JSON_LISTING_HOLE_VALUE, lr as DEFAULT_RESOURCE_WARN_AFTER_MS, ls as refuseMalformedResourcesForDestroy, lt as renderNestedTemplateTreeDefect, lu as describeDockerExecFailure, ma as INTRINSIC_KEYS, mc as noEchoLeavesOf, md as injectAwsRegion, mi as refusesFinalSnapshot, ml as S3StateBackend, mn as removeProtectionTypeList, mo as accountArgs, mr as findRefactorHints, ms as repairMalformedOutputsForReadOnly, mt as readRecordedConditionVerdicts, mu as getDockerCmd, n as recordedProtectionEvidence, na as deleteLeftInPlace, nd as parseFailureDebugDetail, ni as secretNamePrintingBags, nl as carriesSecretMask, nn as readRefactorMarkerOnce, no as lacksRecordedTableArn, nr as isWholeDynamicReferenceValue, ns as refuseMalformedResourceEntriesForImportSave, nt as deferredServiceTokenWarning, nu as readBootstrapMarkerBody, o as perType, oc as TemplateParser, od as hasPlainPrototype, oi as storedSecretNameNeedles, ol as recordNoEchoAttributeValues, on as sameMove, oo as parameterInputsFor, or as isExportAliasCollision, os as refuseMalformedResourcePropertiesForExport, ot as findNestedTemplateTreeDefect, ou as buildDockerImage, pa as DiffCalculator, pc as noEchoCoordinatesOf, pd as resolveAssemblyPath, pi as isFinalSnapshotError, pl as isLockInfoExpired, pn as replayRollback, po as UNREADABLE_RESOURCES_MAP_ROW, pr as formatDestructiveChange, ps as repairMalformedOrphansForReadOnly, pt as parentSuppliedValues, pu as formatDockerLoginError, qa as getAccountInfo, qc as spelledKeysOf, qi as applyCustomResourceResponseExpiration, ql as loadPublishableAssetManifest, qn as WITHHELD_NAME_DISPLAY, qo as refuseMalformedOrphansForDestroy, qr as noEchoExactEchoLeavesOf, qt as loadJournaledOrphans, qu as decodeListingKey, r as recordedProtectionNote, ra as deleteSkipReason, rd as utf8ByteLength, rl as provenPublicValue, rn as refactorMarkerMovesOf, ro as refStateLookupFromResource, rr as noEchoParameterValueSeed, rs as refuseMalformedResourceEntriesForOrphan, rt as findServiceTokenRefusals, ru as validateAssetBucketName, s as readProtection, sc as canonicalCoordinates, sd as nullPrototypeRecord, si as ATOMIC_FINAL_SNAPSHOT_TYPES, sl as recordNoEchoParameterFreshValue, sn as updateRefactorMarker, sr as bindingSkippedOutputs, ss as refuseMalformedResourcePropertiesForOrphan, st as isAbsoluteAssetPath, su as resolveDockerContextDirectory, t as DeployEngine, ta as deleteIndeterminateGuards, td as describeJsonParseFailure, ti as secretNamePrintingBag, tl as splitGetAttStringForm, tn as readRefactorMarker, to as isStalePlaceholderArnAttribute, tr as exportNameSecretExposure, ts as refuseMalformedResourceEntriesForImport, tt as inheritedProvenanceForChildDiff, tu as parseBootstrapMarker, uc as maskReadbackAtCoordinates, ud as describeFileReadFailure, ui as ccRoutedFinalSnapshotError, ul as WHOLE_DYNAMIC_REFERENCE_PATTERN, un as pendingMovesRefusalMessage, uo as STATE_REGION_DIVERGED, ur as maskingRetryLogger, us as refuseMalformedResourcesForExport, ut as templateIdentity, uu as describeDockerFailure, vc as readsNoEchoSource, vl as applyCrossPrefixScan, vn as isReplacementOrphan, vo as hasReadableOutputs, vr as withMovedTo, vs as unpreviewableOrphanRecords, vt as diffSecurity, vu as redactDockerArgvValues, wa as producerLookupOver, wl as splitImportedOps, wn as resolveReplacementOldType, wo as malformedExportSourceWarning, ws as unwrittenCreateOnlyReplacement, wt as planOrphanAdoption, wu as AssetManifestLoader, xc as liveMatchesUnresolvedTokenFrame, xi as DeploymentEventsReader, xl as isNotImplemented, xn as recheckFailedPlan, xo as isReadableResourceEntry, xr as mappingPairs, xs as withheldAccountClause, xt as mergeNoChangeOutputs, xu as runDockerForeground, yc as recordedNoEchoValuesOf, yi as withCreateTokenLedger, yl as crossPrefixDeniedWarning, yn as planFailedOps, yo as hasReadableResources, yr as isPairableType, ys as unreadableOrphanRecords, yt as isSecretBearingReferenceString, yu as redactedCause, za as envCredentialsAreAssumedRole, zc as maskSecretsInText, zi as wouldReturnToSdkProvider, zl as renderPhaseTimings, zn as retiredAfterRollback, zo as malformedScrubResourceEntriesRefusalMessage, zr as removeSuperseded, zt as collectNestedChildUnaddressed, zu as warnDeprecatedNoPrefixCliFlag } from "./deploy-engine-CDjAtIrn.js";
-import { t as getCdkdVersion } from "./version-BWqrjGBS.js";
+import { $ as computeImplicitDeleteEdges, $a as coerceParameterTypedValue, $c as DYNAMIC_REFERENCE_TOKEN_SCAN, $i as applyCustomResourceResponseExpiration, $l as stringifyValue, $n as WITHHELD_NAME_DISPLAY, $o as refuseMalformedOrphanRecords, $r as noEchoExactEchoLeavesOf, $u as MIGRATE_TMP_PREFIX, Ac as valueAtCoordinate, Al as isAccessDenied, An as resolveReplacementOldType, Ao as isReadableResourceEntry, As as withheldAccountClause, At as displacedOpClause, Au as redactedDockerCause, Ba as assertFlagRoleArn, Bc as logOnlyValueCount, Bl as hasUnverifiableParameterRefusal, Bn as updatePartialMessage, Bo as malformedOrphansRefusalMessage, Br as yellow, Bs as isStatefulRecreateTargetForReplace, Bt as getCurrentNestedStackContext, Bu as loadCdkJson, Ca as withoutUnsettledProperties, Cc as noEchoCoordinatesOf, Cd as resolveAssemblyPath, Ci as ledgerForStack, Cl as isLockInfoExpired, Cn as isJournaledOrphan, Co as accountArgs, Cr as rollbackOrphanIds, Cs as repairMalformedOutputsForReadOnly, Ct as makeSiblingClaimReader, Cu as formatDockerLoginError, Dc as readbackPathFor, Dd as resolveBucketRegion, Di as DeploymentEventsReader, Dl as CrossPrefixScanCache, Dn as recheckFailedPlan, Do as hasReadableOutputs, Dr as mappingPairs, Ds as unpreviewableOrphanRecords, Dt as keptForRetainedRecord, Du as partitionSensitiveEnv, El as CrossPrefixReadError, En as planRollback, Eo as hasReadableOrphans, Er as looselyEqual, Es as repairMalformedResourcesForReadOnly, Et as resolvePendingCloudControlRequests, Eu as isMalformedEnvKey, Fa as keepHeldTokenProvenance, Fl as acceptedCreateOnlyDropsOf, Fn as inheritProducerRegions, Fo as malformedLocalResourceEntriesWarning, Fr as bold, Fs as NO_CC_HANDLERS_REASON, Ft as recordDisplacedSkips, Fu as getDockerImageBySourceHash, Ga as AWS_CREDENTIAL_ENV_KEYS, Gc as unionOfSecretBags, Gi as wouldReturnToSdkProvider, Gl as orphansCarriedFrom, Gn as retiredAfterRollback, Go as malformedResourceEntriesWarning, Gr as removeSuperseded, Gt as isHandledOrphan, Gu as resolveStateBucketWithDefault, Ha as explicitRoleArnOrThrow, Hc as recordLogOnlyParameterValue, Hi as ProviderRegistry, Hl as importableOutputs, Hn as nameGenerationCarriedFrom, Ho as malformedOutputsRefusalMessage, Hr as deleteSupersededEntry, Hs as renderStatefulReason, Ht as deleteJournaledOrphans, Hu as resolveAutoAssetStorage, Ic as carryLogOnlyValues, Il as describeRegionValueKind, Io as malformedLocalResourcesWarning, Ir as cyan, Is as hasNoCloudControlHandlers, Iu as Synthesizer, Ja as envCredentialsAreAssumedRole, Jc as maskSecretsInError, Ji as readsNoEchoDeleteValues, Jl as PhaseClock, Jn as withNameGenerationReached, Jo as malformedScrubResourceEntriesRefusalMessage, Jr as supersededHolderOf, Jt as makeForeignHolderScan, Ju as stateBucketExistenceConfirmed, Ka as applyCallerIdentityCredentials, Kc as createSecretMasker, Kl as shouldRetainResource, Kn as retiredNameGenerationsAfter, Ko as malformedResourcePropertiesWarning, Kr as supersededAfterRollback, Kt as journaledOrphanLines, Ku as resolveStateBucketWithDefaultAndSource, La as recordedOutputReferenceRegions, Lc as createUnionSecretMasker, Ll as exportNamesCarriedFrom, Lo as malformedOrphanRecordsRefusalMessage, Lr as gray, Ls as findReplacedReadersOfRecreateTargets, Lt as revertedNestedRowIds, Lu as synthesisStatusMessage, Ma as resolveDynamicReferences, Ml as stackInstanceIdOf, Mn as orphanNeedsIdentity, Mo as malformedExportNamesWarning, Mt as dropSettledNestedJournals, Mu as runDockerStreaming, Na as producerLookupOver, Nc as redactForState, Nl as withStackInstanceIdWithheld, Nn as findNestedStackTypeChanges, No as malformedExportSourceWarning, Nr as withStackRecords, Ns as unwrittenCreateOnlyReplacement, Nu as warnFinchArgvExposure, Oc as readsNoEchoSource, Oi as DeploymentEventsStore, Ol as applyCrossPrefixScan, On as recordUnderIdIsNotOwn, Oo as hasReadableResources, Or as parseMappingFile, Os as unreadableOrphanRecords, Ot as recordRetainedForReadoption, Ou as redactDockerArgvValues, Pa as refuseUnreadableCdkCrossAccountRefs, Pl as splitImportedOps, Po as malformedLocalOutputsWarning, Pt as nestedChildStackName$1, Pu as AssetManifestLoader, Q as IMPLICIT_DELETE_DEPENDENCIES, Qa as regionLessSecretName, Qi as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ql as isSensitiveAttributeName, Qn as resourcesNamingDeclaredParameter, Qr as noEchoComparisonForTemplate, Qu as CFN_TEMPLATE_URL_LIMIT, Ra as recordedReferenceRegions, Rc as hasMaskableValues, Rl as hasReadableExportSet, Ro as malformedOrphanRecordsWarning, Rr as green, Rs as shownType, Rt as withNestedRevertRun, Ru as getDefaultStateBucketName, Sa as withUnsettledProperties, Sc as maskedLeafCoordinatesOf, Sd as renderAssemblyPathEscape, Sl as LockManager, Sn as demoteSupersededOrphans, So as UNREADABLE_RESOURCES_MAP_ROW, Sr as movedToHint, Ss as repairMalformedOrphansForReadOnly, St as makeCanonicalizePropertiesFn, Su as finchSecretArgvRefusal, Ta as poisonRenderedSpellingsCollidingIn, Tc as noEchoOutputsComparison, Td as injectedAwsRegionValue, Ti as withCreateTokenLedger, Tl as rebuildClientForBucketRegion, Tn as planFailedOps, To as displayLogicalId, Tr as isPairableType, Ts as repairMalformedResourcePropertiesForReadOnly, Tt as pendingRequestCount, Tu as isDockerClientEnvKey, Ua as isIamRoleArn, Uc as recordLogOnlyValue, Ui as ccBrokenReason, Ul as isReadableBag, Un as nameGenerationHighWaterOf, Uo as malformedOutputsWarning, Ur as holdsSupersededResources, Ut as dropFailedCommands, Uu as resolveCaptureObservedState, Va as assertSendableRoleArn, Vc as printingCorpusOf, Vi as CC_BROKEN_REASON, Vl as importableOutputKeys, Vn as updatePartialReason, Vo as malformedOrphansWarning, Vr as addSuperseded, Vs as isStatefulRecreateTargetSync, Vt as withNestedStackContext, Vu as resolveApp, Wa as sendableAssumeRoleCommand, Wc as shareLogOnlyValues, Wi as isCustomResource, Wl as orphansAfterRollback, Wn as nameScopeOf, Wo as malformedRenderedContainersWarning, Wr as isSupersededResourceRecord, Wt as dropFailedHint, Wu as resolveSkipPrefix, Xa as classifyReplaySecretRegion, Xc as scrubResourceRecord, Xl as timePhase, Xn as namesAnyDeclaredParameter, Xo as previewableOrphanRecords, Xr as withoutSuperseded, Xt as formatResourceLine, Xu as ssmResolvedValueType, Ya as classifyRecordedSecretRegion, Yc as maskSecretsInText, Yi as isCustomResourceType$1, Yl as renderPhaseTimings, Yn as computeParameterTaint, Yo as malformedStateRefusalMessage, Yr as supersededResourcesOf, Yt as sameJournaledOrphans, Yu as warnDeprecatedNoPrefixCliFlag, Za as producerRegionsFromState, Zc as withPhysicalNameCopies, Zi as withPrintingSecrets, Zl as AssetPublisher, Zn as reachableDivergentParameters, Zo as refuseDivergentRecordRegionForDestroy, Zr as noEchoAttributeNamesOf, Zu as CFN_TEMPLATE_BODY_LIMIT, _c as canonicalCoordinates, _d as nullPrototypeRecord, _i as createPreDeleteFinalSnapshot, _l as recordNoEchoParameterFreshValue, _n as withUnprovenUnsettled, _o as declaresNoEcho, _r as constructPathOf$1, _s as refuseMalformedResourcesForDeploy, _t as withResourceDeadline, _u as resolveDockerContextDirectory, a as isProtectionValueActive, aa as RollbackInlinePolicyWriters, ac as templateResourceTypes, ad as PARTITION_TABLE, ai as namingSecretsWithRecordedNoEcho, al as inheritNestedStackParameterAssociations, an as refuseRefactorMarker, ao as carriesFetchableDynamicReference, ar as carriedExportAliasExposure, as as refuseMalformedOutputsForDestroy, at as childTemplateLoader, au as AssetModeResolver, ba as INTRINSIC_KEYS, bc as maskReadbackAtCoordinates, bd as describeFileReadFailure, bi as refusesFinalSnapshot, bl as WHOLE_DYNAMIC_REFERENCE_PATTERN, bn as equalModuloMask, bo as STATE_RESOURCES_MALFORMED, br as findRefactorHints, bs as refuseMalformedState, bt as keptWholeReasonText, bu as describeDockerFailure, ca as deleteLeftInPlace, cd as AssemblyReader, ci as secretNamePrintingBags, cl as physicalNameCopiesOf, cn as hasPendingMovesOut, co as AWS_NO_VALUE, cr as isWholeDynamicReferenceValue, cs as refuseMalformedResourceEntriesForDeploy, ct as listNestedTemplateRows, cu as ensureAssetStorage, da as isWaitAbandonedError, dd as describeJsonParseFailure, di as stateSecretNameNeedles, dl as splitGetAttStringForm, dn as refusePendingMovesOut, do as lacksRecordedTableArn, dr as collectPublishedOutputNames, ds as refuseMalformedResourceEntriesForImportSave, dt as conditionFingerprint, du as parseBootstrapMarker, ea as customResourceResponseExpirationWarning, ed as findLargeInlineResources, ei as noEchoParameterNamesOf, el as dynamicReferenceTokens, eo as isUnboundTemplateParameter, er as displayTextOrWithheld, es as refuseMalformedOrphanRecordsForDestroy, et as crossStackOutputProvenanceSource, eu as WorkGraph, fd as parseFailureDebugDetail, fi as storedSecretNameNeedles, fl as carriesSecretMask, fn as replayFailedOperations, fo as refStateLookupFromResource, fr as isExportAliasCollision, fs as refuseMalformedResourceEntriesForOrphan, ft as conditionInputsFrom, fu as readBootstrapMarkerBody, gc as TemplateParser, gd as hasPlainPrototype, gi as ccRoutedFinalSnapshotError, gl as recordNoEchoAttributeValues, gn as settleUnsettledPrevious, gr as maskingRetryLogger, gs as refuseMalformedResourcePropertiesForOrphan, gu as buildDockerImage, hc as DagBuilder, hd as hasOwnKey, hi as buildFinalSnapshotIdentifier, hl as recordMaskOnlyValuesIn, hn as recordAfterRollbackUpdate, ho as parameterInputsFor, hr as DEFAULT_RESOURCE_WARN_AFTER_MS, hs as refuseMalformedResourcePropertiesForExport, hu as buildDenyExternalAccessPolicy, i as PROTECTION_PROPERTY_BY_TYPE, ic as prefetchCreateOnlyPropertyPaths, id as expectedOwnerParam, ii as maskEventTextWithBoundBags, il as identityKeyFor, in as refactorMarkerRefusalMessage, io as carriesDynamicReference, ir as secretSafeKeyDisplay, is as refuseMalformedOutputs, it as serviceTokenBlockingReason, iu as rewriteTemplateAssetReferences, jc as liveMatchesUnresolvedTokenFrame, jl as isNotImplemented, jn as seedsDeleteFirstGuard, jo as malformedDriftResourcePropertiesWarning, jr as destroyStackRecordsView, js as findActionableSilentDrops, jt as displacedPhysicalIdShown, ju as runDockerForeground, kc as recordedNoEchoValuesOf, ki as extractDeploymentEventError, kl as crossPrefixDeniedWarning, kn as replacementNeverSwapped, ko as isReadableOrphanRecord, kr as proposeRenames, ks as unreadableResourceEntries, kt as NESTED_PENDING_PARENT_REASON, ku as redactedCause, la as deleteSkipReason, ld as StageLoadError, ln as pendingMovesOutOf, lo as cfnRefValueFromPhysicalId, lr as noEchoParameterValueSeed, ls as refuseMalformedResourceEntriesForDestroy, lt as renderNestedTemplateTreeDefect, lu as getBootstrapMarkerKey, md as defineOwnKey, mi as PRE_DELETE_SNAPSHOT_TYPES, ml as recordMaskOnlyValue, mn as removeProtectionTypeList, mo as withSharedDrainBudget, mr as DEFAULT_RESOURCE_TIMEOUT_MS, ms as refuseMalformedResourcePropertiesForDrift, mt as readRecordedConditionVerdicts, mu as validateContainerRepoName, n as recordedProtectionEvidence, na as slowCcOperationTimeoutMs, nd as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, ni as completedReplayEntries, nl as pathCrossesDottedKey, nn as readRefactorMarkerOnce, no as getAccountInfo, nr as secretBearing, ns as refuseMalformedOrphansForDestroy, nt as deferredServiceTokenWarning, nu as createAssetRedirectResolver, o as perType, oa as UNSPECIFIED_SKIP_REASON, oc as describeTypeWithThrottleRetry, od as canonicalizeRegion, oi as orphanRecordsPrintingBag, ol as recordNestedStackParameterExpressions, on as sameMove, oo as isNamelessDynamicReferenceError, or as exportNameNoEchoParameters, os as refuseMalformedResourceAttributesForOrphan, ot as findNestedTemplateTreeDefect, ou as BOOTSTRAP_MARKER_PREFIX, pd as utf8ByteLength, pi as ATOMIC_FINAL_SNAPSHOT_TYPES, pl as provenPublicValue, pn as replayRollback, pr as bindingSkippedOutputs, ps as refuseMalformedResourcePropertiesForDestroy, pt as parentSuppliedValues, pu as validateAssetBucketName, qa as callerEnvCredentials, qc as errorCauseChain, qi as TemplateNoEchoReresolver, ql as stackInstanceIdCarriedFrom, qn as retiredNameGenerationsLeaving, qo as malformedResourcesWarning, qr as supersededHeldByOtherTypeWarning, qt as loadJournaledOrphans, qu as resolveUseCdkBootstrapAssets, r as recordedProtectionNote, rd as decodeListingKey, ri as journaledOrphanPrintingBag, rl as spelledKeysOf, rn as refactorMarkerMovesOf, ro as isImpossibleEmptyStoredAttribute, rr as secretBearingStateKeyWarning, rs as refuseMalformedOrphansForOrphan, rt as findServiceTokenRefusals, ru as loadPublishableAssetManifest, s as readProtection, sa as deleteIndeterminateGuards, sc as withRetry, sd as derivePartitionAndUrlSuffix, si as secretNamePrintingBag, sn as updateRefactorMarker, so as keepsSecretReferenceToken, sr as exportNameSecretExposure, ss as refuseMalformedResourceEntries, st as isAbsoluteAssetPath, su as assertAssetBucketRegion, t as DeployEngine, ta as CloudControlProvider, td as uploadCfnTemplate, ti as createReadOnlyAttributeHealerFactory, tl as isUncertifiedBaselineMaskPosition, tn as readRefactorMarker, to as parameterTypeMayLoseSecretIdentity, tr as exportAliasCollisionScrubWarning, ts as refuseMalformedOrphans, tt as inheritedProvenanceForChildDiff, tu as buildAssetRedirectMap, ud as processStackMessages, ui as secretNamedRecordNeedles, ul as recordPhysicalNameCopy, un as pendingMovesRefusalMessage, uo as isStalePlaceholderArnAttribute, ur as collectDeclaredOutputNames, us as refuseMalformedResourceEntriesForImport, ut as templateIdentity, uu as isCrossRegionRedirect, vc as isMarkedCoordinate, vd as ownValue, vi as effectiveDeletionPolicy, vl as recordProvenPublicExpression, vn as calculateResourceDrift, vo as JSON_LISTING_HOLE_VALUE, vr as findDestructiveChanges, vs as refuseMalformedResourcesForDestroy, vt as diffSecurity, vu as describeDockerCapturedOutput, wa as IntrinsicFunctionResolver, wc as noEchoLeavesOf, wd as injectAwsRegion, wl as S3StateBackend, wn as isReplacementOrphan, wo as deployRefusesOrphanRowsReason, wr as withMovedTo, ws as repairMalformedResourceEntriesForReadOnly, wt as planOrphanAdoption, wu as getDockerCmd, xa as unsettledPropertiesOf, xc as maskWholeValue, xd as displayAssemblyPath, xi as unsupportedFinalSnapshotError, xl as isSingleDynamicReferenceToken, xn as undeclaredEmptyObservedKeys, xo as UNREADABLE_ORPHANS_CONTAINER_ROW, xr as hintSidesOf, xs as repairMalformedOrphanRecordsForReadOnly, xt as mergeNoChangeOutputs, xu as dockerSpawnEnvWithSensitive, ya as DiffCalculator, yc as maskAtCoordinates, yd as absoluteAssemblyPathEscape, yi as isFinalSnapshotError, yl as wholeStringLeavesOf, yn as equalModuloMarkedMask, yo as STATE_REGION_DIVERGED, yr as formatDestructiveChange, ys as refuseMalformedResourcesForExport, yt as isSecretBearingReferenceString, yu as describeDockerExecFailure, za as applyRoleArnIfSet, zc as literalSplitDelimitersOf, zl as hasReasonlessBaselineRefusal, zo as malformedOrphanRowsKeptWarning, zr as red, zs as MULTI_REGION_RECREATE_BLOCKED_TYPES, zt as collectNestedChildUnaddressed, zu as getLegacyStateBucketName } from "./deploy-engine-DZO2SOQJ.js";
+import { t as getCdkdVersion } from "./version-QOtLxcEo.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -2710,7 +2710,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-BxfIHcea.js");
+	providerClasses ??= import("./provider-classes-KsrvwO_r.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -3557,7 +3557,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 					const syncValidation = validateRecreateTargets({
 						template: stackInfo.template,
 						state: stateForRecreateCheck?.state ?? {
-							version: 13,
+							version: 14,
 							stackName: stackInfo.stackName,
 							region: stackRegion,
 							resources: {},
@@ -3592,7 +3592,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 						const replacedReaders = await findReplacedReadersOfRecreateTargets({
 							template: stackInfo.template,
 							state: stateForRecreateCheck?.state ?? {
-								version: 13,
+								version: 14,
 								stackName: stackInfo.stackName,
 								region: stackRegion,
 								resources: {},
@@ -5001,7 +5001,7 @@ async function loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery
 			region,
 			resources: {},
 			outputs: {},
-			version: 13,
+			version: 14,
 			lastModified: Date.now()
 		},
 		unreadable: [],
@@ -6146,7 +6146,7 @@ function renderChangeLines(changes, logFn, ccApiRoutes, adoptedOrphans, refactor
 			logFn(`  [~] ${logicalId} (${change.resourceType})${annotateAdoption(logicalId)}${annotateRouting(logicalId)}`);
 			if (change.propertyChanges && change.propertyChanges.length > 0) for (const propChange of change.propertyChanges) {
 				const requiresReplace = propChange.requiresReplacement && (propChange.inPlacePropagated === true || propChange.replacementPropagated === true) ? " [may require replacement]" : propChange.requiresReplacement ? " [requires replacement]" : "";
-				const propagated = propChange.replacementPropagated ? " [replacement propagated]" : propChange.readProvenancePromoted === true ? " [read value moved upstream]" : propChange.inPlacePropagated ? " [attribute propagated]" : propChange.maskedExpressionChanged === true ? " [masked input or expression changed]" : "";
+				const propagated = propChange.replacementPropagated ? " [replacement propagated]" : propChange.readProvenancePromoted === true ? " [read value moved upstream]" : propChange.inPlacePropagated ? " [attribute propagated]" : propChange.maskedExpressionChanged === true ? " [masked input or expression changed]" : propChange.unsettled === true ? " [unsettled after a failed update; sent again]" : "";
 				const indent = "              ";
 				const [oldFiltered, newFiltered] = stripUnchangedValuePair(propChange.oldValue, propChange.newValue);
 				const oldStr = renderDiffValue(propChange.oldValue, oldFiltered, indent, false);
@@ -9071,244 +9071,6 @@ function copiesOfParentRow(bag) {
 	return copies === void 0 || copies.size === 0 ? {} : { inheritedPhysicalNameCopies: copies };
 }
 
-//#endregion
-//#region src/analyzer/drift-normalize.ts
-function canonicalizeTagListsDeep(v) {
-	if (Array.isArray(v)) {
-		const mapped = v.map(canonicalizeTagListsDeep);
-		if (mapped.length > 0 && mapped.every((t) => t && typeof t === "object" && typeof t.Key === "string")) return [...mapped].sort((a, b) => {
-			const ka = a.Key;
-			const kb = b.Key;
-			if (ka !== kb) return ka < kb ? -1 : 1;
-			return JSON.stringify(a) < JSON.stringify(b) ? -1 : 1;
-		});
-		return mapped;
-	}
-	if (v && typeof v === "object") {
-		if (!hasPlainPrototype(v)) return v;
-		const out = nullPrototypeRecord();
-		for (const [k, val] of Object.entries(v)) out[k] = canonicalizeTagListsDeep(val);
-		return out;
-	}
-	return v;
-}
-const ID_RE = /^[a-z][a-z0-9]*-[0-9a-f]{6,}$/;
-const isIdLike = (s) => typeof s === "string" && (s.startsWith("arn:") || ID_RE.test(s));
-function canonicalizeIdArraysDeep(v) {
-	if (Array.isArray(v)) {
-		const mapped = v.map(canonicalizeIdArraysDeep);
-		if (mapped.length > 1 && mapped.every(isIdLike)) return [...mapped].sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
-		return mapped;
-	}
-	if (v && typeof v === "object") {
-		if (!hasPlainPrototype(v)) return v;
-		const out = nullPrototypeRecord();
-		for (const [k, val] of Object.entries(v)) out[k] = canonicalizeIdArraysDeep(val);
-		return out;
-	}
-	return v;
-}
-const LEAF_ONLY_PATH_SUFFIX = "[]";
-function matchesPathPrefix(path, entries) {
-	for (const entry of entries) {
-		if (entry.endsWith("[]")) {
-			const leaf = entry.slice(0, -2);
-			if (leaf !== "" && path === leaf) return true;
-			continue;
-		}
-		if (path === entry) return true;
-		if (path.startsWith(`${entry}.`)) return true;
-	}
-	return false;
-}
-function canonicalizeUnorderedArraysAtPaths(v, paths) {
-	if (paths.length === 0) return v;
-	return walkUnordered(v, "", paths);
-}
-function canonicalJson(v) {
-	if (Array.isArray(v)) return `[${v.map(canonicalJson).join(",")}]`;
-	if (v && typeof v === "object") {
-		const bag = v;
-		return `{${Object.keys(bag).filter((k) => bag[k] !== void 0).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson(bag[k])}`).join(",")}}`;
-	}
-	return JSON.stringify(v) ?? "null";
-}
-const isPlainObjectElement = (el) => el !== null && typeof el === "object" && !Array.isArray(el);
-function walkUnordered(v, path, paths) {
-	if (Array.isArray(v)) {
-		const mapped = v.map((el) => Array.isArray(el) ? el : walkUnordered(el, path, paths));
-		if (mapped.length > 1 && matchesPathPrefix(path, paths)) {
-			if (mapped.every((el) => typeof el === "string")) return [...mapped].sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
-			if (mapped.every(isPlainObjectElement)) {
-				const keyed = mapped.map((el) => ({
-					el,
-					key: canonicalJson(el)
-				}));
-				keyed.sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0);
-				return keyed.map((k) => k.el);
-			}
-		}
-		return mapped;
-	}
-	if (v && typeof v === "object") {
-		if (!hasPlainPrototype(v)) return v;
-		const out = nullPrototypeRecord();
-		for (const [k, val] of Object.entries(v)) out[k] = walkUnordered(val, path === "" ? k : `${path}.${k}`, paths);
-		return out;
-	}
-	return v;
-}
-
-//#endregion
-//#region src/analyzer/drift-calculator.ts
-function calculateResourceDrift(stateProperties, awsProperties, options) {
-	const drifts = [];
-	const ignore = options?.ignorePaths ?? [];
-	const union = options?.unionWalkObjects ?? false;
-	const unordered = options?.unorderedPaths ?? [];
-	stateProperties = canonicalizeUnorderedArraysAtPaths(canonicalizeIdArraysDeep(canonicalizeTagListsDeep(stateProperties)), unordered);
-	awsProperties = canonicalizeUnorderedArraysAtPaths(canonicalizeIdArraysDeep(canonicalizeTagListsDeep(awsProperties)), unordered);
-	for (const key of Object.keys(stateProperties)) {
-		if (isIgnoredPath(key, ignore)) continue;
-		diffAt(key, stateProperties[key], awsProperties[key], drifts, ignore, union);
-	}
-	return drifts;
-}
-function undeclaredEmptyObservedKeys(observed, declared) {
-	const keys = [];
-	for (const key of Object.keys(observed)) {
-		if (Object.hasOwn(declared, key)) continue;
-		const value = observed[key];
-		if (value === null || value === void 0 || Array.isArray(value) && value.length === 0 || isPlainObject(value) && Object.keys(value).length === 0) keys.push(key);
-	}
-	return keys;
-}
-function isIgnoredPath(path, ignorePaths) {
-	return matchesPathPrefix(path, ignorePaths);
-}
-function diffAt(path, stateValue, awsValue, out, ignorePaths, unionWalkObjects) {
-	const stateForm = jsonForm(stateValue);
-	const awsForm = jsonForm(awsValue);
-	if (deepEqual(stateForm, awsForm)) return;
-	if (typeof stateValue === "string" && stateValue.includes("{{resolve:")) return;
-	if (isPlainObject(stateForm) && isPlainObject(awsForm) && !Array.isArray(stateForm) && !Array.isArray(awsForm)) {
-		const keys = unionWalkObjects ? /* @__PURE__ */ new Set([...Object.keys(stateForm), ...Object.keys(awsForm)]) : Object.keys(stateForm);
-		for (const key of keys) {
-			const childPath = `${path}.${key}`;
-			if (isIgnoredPath(childPath, ignorePaths)) continue;
-			diffAt(childPath, stateForm[key], awsForm[key], out, ignorePaths, unionWalkObjects);
-		}
-		return;
-	}
-	out.push({
-		path,
-		stateValue,
-		awsValue
-	});
-}
-function jsonForm(value) {
-	if (value === null || typeof value !== "object" || hasPlainPrototype(value)) return value;
-	const toJSON = value.toJSON;
-	return typeof toJSON === "function" ? toJSON.call(value) : value;
-}
-function deepEqual(a, b) {
-	a = jsonForm(a);
-	b = jsonForm(b);
-	if (a === b) return true;
-	if (a === null || b === null || a === void 0 || b === void 0) return a === b;
-	if (typeof a !== typeof b) return false;
-	if (typeof a !== "object") return false;
-	if (Array.isArray(a) || Array.isArray(b)) {
-		if (!Array.isArray(a) || !Array.isArray(b)) return false;
-		if (a.length !== b.length) return false;
-		return a.every((v, i) => deepEqual(v, b[i]));
-	}
-	const aObj = a;
-	const bObj = b;
-	const aKeys = Object.keys(aObj);
-	const bKeys = Object.keys(bObj);
-	if (aKeys.length !== bKeys.length) return false;
-	for (const key of aKeys) {
-		if (!Object.prototype.hasOwnProperty.call(bObj, key)) return false;
-		if (!deepEqual(aObj[key], bObj[key])) return false;
-	}
-	return true;
-}
-function equalModuloMask(state, aws, mask) {
-	const a = jsonForm(state);
-	const b = jsonForm(aws);
-	if (a === mask && b !== null && b !== void 0) return true;
-	if (a === b) return true;
-	if (a === null || b === null || a === void 0 || b === void 0) return a === b;
-	if (typeof a !== typeof b || typeof a !== "object") return false;
-	if (Array.isArray(a) || Array.isArray(b)) {
-		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-		return a.every((v, i) => equalModuloMask(v, b[i], mask));
-	}
-	const aObj = a;
-	const bObj = b;
-	const aKeys = Object.keys(aObj);
-	if (aKeys.length !== Object.keys(bObj).length) return false;
-	return aKeys.every((key) => Object.prototype.hasOwnProperty.call(bObj, key) && equalModuloMask(aObj[key], bObj[key], mask));
-}
-function equalModuloMarkedMask(state, aws, mask, coordinate, isMarked, isWithinMarked = isMarked) {
-	const a = jsonForm(state);
-	const b = jsonForm(aws);
-	if (isMarked(coordinate) && b !== void 0 && b !== null) {
-		if (a === mask) return true;
-		if (isWithinMarked(coordinate) ? isWhollyMask(a, mask) : sameJson(a, wholeMaskOf(b, mask))) return holdsMask(a, mask);
-	}
-	if (a === mask && (typeof b === "string" || typeof b === "number" || typeof b === "boolean")) return true;
-	if (a === b) return true;
-	if (a === null || b === null || a === void 0 || b === void 0) return a === b;
-	if (typeof a !== typeof b || typeof a !== "object") return false;
-	if (Array.isArray(a) || Array.isArray(b)) {
-		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-		return a.every((v, i) => equalModuloMarkedMask(v, b[i], mask, [...coordinate, i], isMarked, isWithinMarked));
-	}
-	const aObj = a;
-	const bObj = b;
-	const aKeys = Object.keys(aObj);
-	if (aKeys.length !== Object.keys(bObj).length) return false;
-	return aKeys.every((key) => Object.prototype.hasOwnProperty.call(bObj, key) && equalModuloMarkedMask(aObj[key], bObj[key], mask, [...coordinate, key], isMarked, isWithinMarked));
-}
-function wholeMaskOf(value, mask) {
-	if (value === null || value === void 0) return value;
-	if (Array.isArray(value)) return value.map((v) => wholeMaskOf(v, mask));
-	if (isPlainObject(value)) return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, wholeMaskOf(v, mask)]));
-	return mask;
-}
-function isWhollyMask(value, mask) {
-	const walk = (node) => {
-		if (node === mask || node === null) return true;
-		if (Array.isArray(node)) return node.every(walk);
-		if (isPlainObject(node)) return Object.values(node).every(walk);
-		return false;
-	};
-	return walk(value) && holdsMask(value, mask);
-}
-function holdsMask(value, mask) {
-	if (value === mask) return true;
-	if (Array.isArray(value)) return value.some((v) => holdsMask(v, mask));
-	if (isPlainObject(value)) return Object.values(value).some((v) => holdsMask(v, mask));
-	return false;
-}
-function sameJson(a, b) {
-	if (a === b) return true;
-	if (a === null || b === null || typeof a !== "object" || typeof b !== "object") return false;
-	if (Array.isArray(a) || Array.isArray(b)) {
-		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-		return a.every((v, i) => sameJson(v, b[i]));
-	}
-	const aObj = a;
-	const bObj = b;
-	const keys = Object.keys(aObj);
-	return keys.length === Object.keys(bObj).length && keys.every((k) => Object.prototype.hasOwnProperty.call(bObj, k) && sameJson(aObj[k], bObj[k]));
-}
-function isPlainObject(value) {
-	return typeof value === "object" && value !== null;
-}
-
 //#endregion
 //#region src/analyzer/drift-principal-normalize.ts
 const PRINCIPAL_UNIQUE_ID_RE = /^A(?:ROA|IDA)[A-Z0-9]{6,}$/;
@@ -9832,7 +9594,7 @@ async function driftCommand(stacks, options) {
 			return;
 		}
 		let outcome;
-		if (options.accept) outcome = await runAccept(reports, stateBackend, stateConfig, awsClients, options);
+		if (options.accept) outcome = await runAccept(reports, stackRegionScope, stateBackend, stateConfig, awsClients, options);
 		else try {
 			outcome = await runRevert(reports, stackRegionScope, stateBackend, stateConfig, awsClients, options);
 		} catch (err) {
@@ -10685,7 +10447,7 @@ function setAtPath(target, path, value) {
 	}
 	defineOwnKey(cursor, segments[segments.length - 1], value);
 }
-async function runAccept(reports, stateBackend, stateConfig, awsClients, options) {
+async function runAccept(reports, regionScope, stateBackend, stateConfig, awsClients, options) {
 	const logger = getLogger();
 	const out = humanTextSink(options.json);
 	const lockRecovery = {
@@ -10761,11 +10523,15 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 				}
 				if (recordedChanges > 0) acceptedResourceCount++;
 				const written = maskMarkedNoEchoBaselineWithLeaves(redactedBaseline, existing, hasObserved);
+				const settled = await settleUnsettled(existing, outcome.logicalId, () => regionScope(report.region).registry.getProviderFor({
+					resourceType: outcome.resourceType,
+					provisionedBy: existing.provisionedBy
+				}).provider);
 				resources[outcome.logicalId] = hasObserved ? {
-					...existing,
+					...settled,
 					observedProperties: written.baseline
 				} : {
-					...existing,
+					...settled,
 					properties: written.baseline,
 					...written.noEchoLeaves !== void 0 && { noEchoLeaves: written.noEchoLeaves }
 				};
@@ -11263,6 +11029,7 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 			}));
 			const narrowedByLogicalId = /* @__PURE__ */ new Map();
 			const reRecordedByLogicalId = /* @__PURE__ */ new Map();
+			const settledByRevert = /* @__PURE__ */ new Map();
 			try {
 				const revertSecretResolvers = new DriftSecretResolvers(report.region);
 				const revertProducerRegions = report.producerRegions;
@@ -11352,7 +11119,17 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 						return;
 					}
 					try {
-						const updateResult = await withRetry(() => provider.update(outcome.logicalId, stateResource.physicalId, outcome.resourceType, newProperties, outcome.awsProperties, {
+						const revertPrevious = await settleUnsettledPrevious({
+							provider,
+							logicalId: outcome.logicalId,
+							physicalId: stateResource.physicalId,
+							resourceType: outcome.resourceType,
+							recordedProperties: stateResource.properties ?? {},
+							names: unsettledPropertiesOf(stateResource),
+							previous: outcome.awsProperties,
+							desired: newProperties
+						});
+						const updateResult = await withRetry(() => provider.update(outcome.logicalId, stateResource.physicalId, outcome.resourceType, newProperties, revertPrevious, {
 							desiredFromAwsReadback: true,
 							declaredEmptyProperties: declaredEmptyProperties(stateResource.properties),
 							maskSecrets: createSecretMasker(secrets),
@@ -11361,6 +11138,19 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 							removedProperties: /* @__PURE__ */ new Set()
 						}), outcome.logicalId, { logger: maskingRetryLogger(logger, secrets) });
 						totalSucceeded++;
+						const unsettledNames = unsettledPropertiesOf(stateResource);
+						if (unsettledNames.size > 0) {
+							const settled = await withUnprovenUnsettled(withoutUnsettledProperties(stateResource), {
+								provider,
+								logicalId: outcome.logicalId,
+								physicalId: stateResource.physicalId,
+								resourceType: outcome.resourceType,
+								recordedProperties: stateResource.properties ?? {},
+								names: unsettledNames,
+								desired: newProperties
+							}, (message) => logger.warn(maskSecretsInText(message, secrets)));
+							if (unsettledPropertiesOf(settled).size < unsettledNames.size) settledByRevert.set(outcome.logicalId, settled);
+						}
 						const revertPartial = updatePartialReason(updateResult);
 						if (revertPartial !== void 0) logger.warn(`  ✓ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, ${maskSecretsInText(updatePartialMessage(revertPartial), secrets)}`);
 						else logger.info(`  ✓ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted.`);
@@ -11405,8 +11195,15 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 						logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): AWS update failed — ${msg}`);
 					}
 				})), concurrency);
-				if (narrowedByLogicalId.size > 0 || reRecordedByLogicalId.size > 0) {
+				if (narrowedByLogicalId.size > 0 || reRecordedByLogicalId.size > 0 || settledByRevert.size > 0) {
 					const resources = { ...report.state.resources };
+					let settledCount = 0;
+					for (const [logicalId, settled] of settledByRevert) {
+						const existing = resources[logicalId];
+						if (!existing) continue;
+						resources[logicalId] = withUnsettledProperties(withoutUnsettledProperties(existing), unsettledPropertiesOf(settled));
+						settledCount++;
+					}
 					let recordedCount = 0;
 					for (const [logicalId, delta] of narrowedByLogicalId) {
 						const existing = resources[logicalId];
@@ -11449,10 +11246,11 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 							...identity.attributes !== void 0 && { attributes: identity.attributes }
 						};
 					}
-					if (recordedCount === 0 && reRecordedCount === 0) return;
+					if (recordedCount === 0 && reRecordedCount === 0 && settledCount === 0) return;
 					const recordedParts = [];
 					if (recordedCount > 0) recordedParts.push(`the value the provider actually applied on ${recordedCount} resource(s)`);
 					if (reRecordedCount > 0) recordedParts.push(`the identity the revert returned on ${reRecordedCount} resource(s)`);
+					if (settledCount > 0) recordedParts.push(`that a failed deploy's unsettled properties are settled on ${settledCount} resource(s)`);
 					const recordedWhat = recordedParts.join(" and ");
 					const { skippedOutputs: _droppedByRevert, ...carriedState } = report.state;
 					const newState = {
@@ -11468,7 +11266,11 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 						logger.info(`✓ State updated for ${report.stackName} (${report.region}): recorded ${recordedWhat}.`);
 					} catch (err) {
 						const revertAgain = revertCommandLine(report.stackName, report.region);
-						const unrecorded = [...recordedCount > 0 ? ["the value the provider actually applied"] : [], ...reRecordedCount > 0 ? ["the identity the revert returned"] : []].join(" and ");
+						const unrecorded = [
+							...recordedCount > 0 ? ["the value the provider actually applied"] : [],
+							...reRecordedCount > 0 ? ["the identity the revert returned"] : [],
+							...settledCount > 0 ? ["that a failed deploy's unsettled properties are settled"] : []
+						].join(" and ");
 						logger.warn(`Reverted ${report.stackName} (${report.region}), but could not record ${unrecorded}: ${describeAwsFailure(err).detail}.` + (reRecordedCount > 0 ? " The state record still holds the physical id and attributes from before the revert, which a later 'Fn::GetAtt' and 'cdkd export' read. Re-running the revert does not repair it, since the revert landed; a later deploy that updates this resource records the identity its update returns." : "") + (recordedCount > 0 ? ` The next 'cdkd drift' will report the same difference — ` + (revertAgain === void 0 ? `re-run 'cdkd drift --revert' for this stack once the state write can succeed.` : `re-run the command below once the state write can succeed.\nRevert with: ${revertAgain}`) : ""));
 					}
 				}
@@ -11624,8 +11426,38 @@ async function confirmPrompt$5(prompt, out) {
 		refusal: "The cdkd drift confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes to confirm, or run the command from a real terminal."
 	});
 }
+async function settleUnsettled(record, logicalId, providerOf) {
+	const names = unsettledPropertiesOf(record);
+	if (names.size === 0) return record;
+	let kept = /* @__PURE__ */ new Set();
+	try {
+		const provider = providerOf();
+		if (provider?.unsettledInTransition !== void 0) kept = await provider.unsettledInTransition(record.physicalId, logicalId, record.resourceType, names, record.properties);
+	} catch {
+		kept = names;
+	}
+	const keep = [...names].filter((name) => kept.has(name));
+	if (keep.length === names.size) return record;
+	return withUnsettledProperties(withoutUnsettledProperties(record), keep);
+}
+function unsettledRowsOf(report) {
+	const rows = [];
+	const resources = report.state.resources ?? {};
+	for (const logicalId of Object.keys(resources).sort()) {
+		const record = resources[logicalId];
+		const names = unsettledPropertiesOf(record);
+		if (names.size === 0) continue;
+		rows.push({
+			logicalId,
+			type: typeof record?.resourceType === "string" ? record.resourceType : "unknown",
+			properties: [...names].sort()
+		});
+	}
+	return rows;
+}
 function writeJsonReport(reports) {
 	const payload = reports.map((r) => {
+		const unsettled = unsettledRowsOf(r);
 		const drifted = [];
 		const clean = [];
 		const deleted = [];
@@ -11683,6 +11515,7 @@ function writeJsonReport(reports) {
 			stack: r.stackName,
 			region: r.region,
 			...r.warnings.length > 0 && { warnings: r.warnings },
+			...unsettled.length > 0 && { unsettled },
 			drifted,
 			deleted,
 			clean,
@@ -11809,6 +11642,17 @@ function writeHumanReport(reports) {
 				process.stdout.write("\n");
 			}
 		}
+		const unsettledRows = unsettledRowsOf(report);
+		if (unsettledRows.length > 0) {
+			process.stdout.write(`\n! ${reportHeading(report)}: a failed deploy left properties unsettled on ${unsettledRows.length} resource${unsettledRows.length === 1 ? "" : "s"} (AWS may hold the recorded value or the attempted one). The next 'cdkd deploy' sends them again; a successful --accept or --revert of the resource clears them.\n`);
+			for (const row of unsettledRows) {
+				const names = row.properties.map((name) => safeMsg`${reportIdent(name, 255)}`).join(", ");
+				process.stdout.write(`    ! ${reportResource({
+					logicalId: row.logicalId,
+					resourceType: row.type
+				})}: ${names}\n`);
+			}
+		}
 		if (notCompared.length > 0) {
 			const notComparedAtAll = notCompared.filter((n) => !ANY_OF_IT_COMPARED[n.cause]).length;
 			const referenceCaused = notCompared.length - notComparedAtAll;
@@ -20167,7 +20011,7 @@ async function rollbackCommand(stackArg, options) {
 						...carriedState,
 						...stackInstanceIdCarriedFrom(baseState),
 						...supersededAfterRollback(baseState, supersededHost),
-						version: 13,
+						version: 14,
 						region,
 						resources: { ...stateResources },
 						...orphansAfterRollback(baseState, mintedOrphans),
@@ -23735,7 +23579,7 @@ function buildStackState(stackName, region, rows, templateParser, template, exis
 	}
 	if (namesParameter?.failedClosed !== void 0) getLogger().debug(`The template's parameter dependence could not be judged (${namesParameter.failedClosed}): every prior observed-baseline refusal recorded without a reason is carried as an unverifiable-parameter refusal.`);
 	return {
-		version: 13,
+		version: 14,
 		stackName,
 		region,
 		resources,
@@ -30954,7 +30798,7 @@ function createLocalStartCloudFrontCommand$1() {
 		extraStateProviders: cdkdExtraStateProviders,
 		synthesizer: cdkdHostSynthesizer(() => cmd.opts())
 	});
-	cmd.addOption(new Option("--from-state", "Read cdkd's S3 state for the target stack: resolve a deployed S3 origin's bucket and the KeyValueStores cf.kvs() reads, and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue / Fn::GetStackOutput intrinsics in the Function URL origin and Lambda@Edge environment variables. Mutually exclusive with --from-cfn-stack.").default(false));
+	cmd.addOption(new Option("--from-state", "Read cdkd's S3 state for the target stack: resolve a deployed S3 origin's bucket and the KeyValueStores cf.kvs() reads, and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue / Fn::GetStackOutput intrinsics in the Function URL origin, Web Function endpoint origin and Lambda@Edge environment variables. Mutually exclusive with --from-cfn-stack.").default(false));
 	cmd.addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket. Also receives the transient upload of a CloudFormation-macro template too large to expand inline."));
 	cmd.addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd"));
 	cmd.addOption(new Option("--no-assume-role", "Explicitly opt out of assuming the deployed execution role: forward your ambient AWS credentials (or the --profile overlay) unchanged, and suppress the \"re-run with --assume-role\" hint that omitting the flag prints when deployed state is loaded."));
@@ -31741,4 +31585,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { resolveSecretDerivedPrincipals as a, buildProgram, isResolvableSecretPrincipalList as i, runDestroyForStack as n, canonicalizeIpProtocolValue as o, holdsUnprovenSecretPrincipalToken as r, resolvedResourceTimeoutMs as s, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-Ymf7svYk.js.map
+//# sourceMappingURL=program-CS420Kx9.js.map