@go-to-k/cdkd 0.263.2 → 0.264.1

package/dist/{deploy-engine-j-e2Q0XH.js → deploy-engine-DNLQYYBx.js}

@@ -5821,6 +5821,26 @@ var S3StateBackend = class {
 		await this.putRawObject(this.getRollbackJournalKey(stackName, region), JSON.stringify(journal, null, 2));
 	}
 	/**
+	* Replace the `failedOperations` list on the NEWEST journal segment
+	* (issue #1198) with the ops STILL pending after a `--revert-failed`
+	* replay — an empty list removes the field. Called right after the
+	* failed-op replay, BEFORE the segment's completed ops replay, so a later
+	* completed-op failure that keeps the segment for a re-run does not
+	* re-issue the already-applied failed-op reverts (the journal's
+	* `attemptedProperties` would generate a patch undoing changes that are no
+	* longer present, which can fail on patch-based providers). Per-op — a
+	* partially-successful replay strips only the handled ops. No-op when the
+	* journal / segment / field is absent.
+	*/
+	async setRollbackJournalFailedOperations(stackName, region, remaining) {
+		const journal = await this.loadRollbackJournal(stackName, region);
+		const newest = journal?.segments[journal.segments.length - 1];
+		if (!journal || !newest || !newest.failedOperations) return;
+		if (remaining.length === 0) delete newest.failedOperations;
+		else newest.failedOperations = remaining;
+		await this.putRawObject(this.getRollbackJournalKey(stackName, region), JSON.stringify(journal, null, 2));
+	}
+	/**
 	* Pop the newest segment off the stack's rollback journal after it has
 	* been fully replayed. When the last segment is removed, the journal
 	* object is deleted entirely. Returns the number of segments remaining.
@@ -11240,7 +11260,7 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CkNAViXd.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-ByH521ze.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -11914,10 +11934,10 @@ var CustomResourceProvider = class CustomResourceProvider {
 	responseClientResolveInFlight = null;
 	responseClientGeneration = 0;
 	/**
-	* Whether `this.s3Client` is a provider-OWNED client (built from the
-	* `setResponseBucket` region hint or by a region-correction rebuild)
-	* vs the shared `AwsClients.s3` instance from the constructor. Owned
-	* clients are `destroy()`ed when replaced; the shared one never is.
+	* Whether `this.s3Client` is a provider-OWNED client (built by a
+	* region-correction rebuild) vs the shared `AwsClients.s3` instance
+	* from the constructor. Owned clients are `destroy()`ed when replaced;
+	* the shared one never is.
 	*/
 	ownsS3Client = false;
 	/**
@@ -11995,12 +12015,20 @@ var CustomResourceProvider = class CustomResourceProvider {
 		return this.asyncResponseTimeoutMs;
 	}
 	/**
-	* Set the S3 bucket for custom resource responses
-	* Called by ProviderRegistry when state bucket is configured
-	*/
-	setResponseBucket(bucket, bucketRegion) {
+	* Set the S3 bucket for custom resource responses.
+	* Called by ProviderRegistry when the state bucket is configured.
+	*
+	* There is deliberately NO region parameter (issue #1202): the bucket's
+	* ACTUAL region is resolved lazily via `ensureResponseClient()` before
+	* the first S3 operation (issue #1195), starting from the shared
+	* `AwsClients.s3` client so `--profile` / static credentials carry into
+	* both the `GetBucketLocation` probe and the rebuilt client. The former
+	* deploy-region hint parameter built a default-credential-chain client
+	* (dropping `--profile`) and added nothing — the probe resolves the
+	* bucket's real region regardless of the starting client's region.
+	*/
+	setResponseBucket(bucket) {
 		this.responseBucket = bucket;
-		if (bucketRegion) this.replaceS3Client(new S3Client({ region: bucketRegion }));
 		this.responseClientGeneration++;
 		this.responseClientResolved = false;
 		this.responseClientResolveInFlight = null;
@@ -14873,8 +14901,8 @@ var ProviderRegistry = class {
 	* Configure the response bucket for custom resources
 	* This allows Lambda handlers using cfn-response to send responses via S3
 	*/
-	setCustomResourceResponseBucket(bucket, bucketRegion) {
-		this.customResourceProvider.setResponseBucket(bucket, bucketRegion);
+	setCustomResourceResponseBucket(bucket) {
+		this.customResourceProvider.setResponseBucket(bucket);
 		this.logger.debug(`Custom resource response bucket set to: ${bucket}`);
 	}
 	/**
@@ -16532,12 +16560,42 @@ function classifyRollbackOp(op, stateResources, orphanLogicalIds) {
 	}
 	const current = stateResources[op.logicalId];
 	if (!current) return "skip-absent";
-	if (op.previousState && deepEqual(current.properties, op.previousState.properties)) {
-		if (!replacement) return "skip-already-done";
+	if (replacement) {
+		if (current.physicalId === op.previousState.physicalId) return "skip-already-done";
+		if (op.physicalId !== void 0 && current.physicalId !== op.physicalId) {
+			if (deepEqual(current.properties, op.previousState.properties)) return "skip-already-done";
+			return "skip-mismatch";
+		}
+		return op.previousState.updateReplacePolicy === "Retain" ? "reverse-replacement-readopt" : "reverse-replacement";
 	}
+	if (op.previousState && deepEqual(current.properties, op.previousState.properties)) return "skip-already-done";
 	return "revert";
 }
 /**
+* Classify what reverting a FAILED in-flight op (issue #1198) will do
+* against the current state, without touching AWS. Pure — used by both the
+* command's `--revert-failed` plan preview and {@link replayFailedOperations}.
+*/
+function classifyFailedOp(op, stateResources) {
+	if (op.changeType === "DELETE") return "skip-failed-noop";
+	const current = stateResources[op.logicalId];
+	if (op.changeType === "CREATE") {
+		if (op.physicalId === void 0) return "skip-failed-unknown";
+		if (!current) return "skip-failed-noop";
+		if (current.physicalId !== op.physicalId) return "skip-failed-noop";
+		return "delete-failed-create";
+	}
+	if (!current || !op.previousState) return "skip-failed-absent";
+	return "revert-failed-update";
+}
+/** Build the plan items for a segment's failed ops (issue #1198). */
+function planFailedOps(failedOps, stateResources) {
+	return failedOps.map((op) => ({
+		op,
+		action: classifyFailedOp(op, stateResources)
+	}));
+}
+/**
 * Build the full ordered plan for a list of ops (one segment). Mirrors the
 * replay order: UPDATE/DELETE first (reverse completion order), then CREATE
 * deletions in dependency-aware order.
@@ -16595,7 +16653,7 @@ async function replayRollback(operations, stateResources, stackName, ctx, option
 			result.interrupted = true;
 			break;
 		}
-		await replaySingle(otherOps[i], stateResources, stackName, ctx, orphanLogicalIds, result, options.afterOp);
+		await replaySingle(otherOps[i], stateResources, stackName, ctx, orphanLogicalIds, result, options.afterOp, options.isInterrupted);
 	}
 	if (!result.interrupted && createOps.length > 0) {
 		const sorted = sortRollbackCreates(createOps, stateResources);
@@ -16604,7 +16662,7 @@ async function replayRollback(operations, stateResources, stackName, ctx, option
 				result.interrupted = true;
 				break;
 			}
-			await replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds, result, options.afterOp);
+			await replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds, result, options.afterOp, options.isInterrupted);
 		}
 	}
 	ctx.logger.info("Rollback completed. Some resources may remain if deletion failed.");
@@ -16614,7 +16672,7 @@ async function replayRollback(operations, stateResources, stackName, ctx, option
 	});
 	return result;
 }
-async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds, result, afterOp) {
+async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds, result, afterOp, isInterrupted) {
 	const action = classifyRollbackOp(op, stateResources, orphanLogicalIds);
 	const { logger } = ctx;
 	try {
@@ -16687,6 +16745,93 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 				});
 				return;
 			}
+			case "reverse-replacement-readopt": {
+				const current = stateResources[op.logicalId];
+				const prev = op.previousState;
+				logger.info(`  Rollback: Reversing replacement of ${op.logicalId} (${op.resourceType}) — deleting the new resource and re-adopting the retained old one (${prev.physicalId})`);
+				const { provider: newDeleteProvider } = ctx.providerRegistry.getProviderFor({
+					resourceType: op.resourceType,
+					provisionedBy: current.provisionedBy ?? op.provisionedBy
+				});
+				await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, { expectedRegion: ctx.region });
+				stateResources[op.logicalId] = prev;
+				logger.info(`  Rollback: ${op.logicalId} restored to the retained old resource`);
+				await afterOp?.(op.logicalId);
+				ctx.recordEvent?.({
+					eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
+					stackName,
+					operation: "UPDATE",
+					logicalId: op.logicalId,
+					resourceType: op.resourceType,
+					...op.provisionedBy && { provisionedBy: op.provisionedBy }
+				});
+				return;
+			}
+			case "reverse-replacement": {
+				const current = stateResources[op.logicalId];
+				const prev = op.previousState;
+				logger.info(`  Rollback: Reversing replacement of ${op.logicalId} (${op.resourceType}) — re-creating the old resource and deleting the new one`);
+				if (STATEFUL_TYPES.has(op.resourceType)) logger.warn(`  ⚠ ${op.logicalId} (${op.resourceType}) is a stateful type — the old physical resource's data was destroyed by the replacement and CANNOT be recovered; the re-created resource starts empty.`);
+				const { provider: createProvider } = ctx.providerRegistry.getProviderFor({
+					resourceType: op.resourceType,
+					provisionedBy: prev.provisionedBy
+				});
+				const { provider: newDeleteProvider } = ctx.providerRegistry.getProviderFor({
+					resourceType: op.resourceType,
+					provisionedBy: current.provisionedBy ?? op.provisionedBy
+				});
+				let deletedNewFirst = false;
+				let createResult;
+				try {
+					createResult = await createProvider.create(op.logicalId, op.resourceType, { ...prev.properties });
+				} catch (createError) {
+					const msg = createError instanceof Error ? createError.message : String(createError);
+					if (!(/already exists/i.test(msg) || msg.includes("AlreadyExists"))) throw createError;
+					logger.info(`  Rollback: re-create collided with the new resource's name — deleting the new resource (${current.physicalId}) first...`);
+					await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, { expectedRegion: ctx.region });
+					deletedNewFirst = true;
+					delete stateResources[op.logicalId];
+					await afterOp?.(op.logicalId);
+					try {
+						createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...prev.properties }), op.logicalId, {
+							maxRetries: 5,
+							initialDelayMs: 2e3,
+							maxDelayMs: 1e4,
+							logger,
+							...isInterrupted && {
+								isInterrupted,
+								onInterrupted: () => /* @__PURE__ */ new Error("Rollback interrupted while waiting for the old name to release")
+							},
+							isRetryable: (message) => /already exists/i.test(message) || message.includes("AlreadyExists")
+						});
+					} catch (recreateError) {
+						throw new Error(`Failed to re-create the old ${op.logicalId} after the new resource (${current.physicalId}) was already deleted: ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. The resource is now absent — fix forward with 'cdkd deploy'.`);
+					}
+				}
+				const { observedProperties: _staleObserved, ...prevRecord } = prev;
+				stateResources[op.logicalId] = {
+					...prevRecord,
+					physicalId: createResult.physicalId,
+					attributes: createResult.attributes ?? {}
+				};
+				await afterOp?.(op.logicalId);
+				if (!deletedNewFirst) try {
+					await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, { expectedRegion: ctx.region });
+				} catch (deleteError) {
+					logger.warn(`  Rollback: old ${op.logicalId} re-created, but deleting the new resource (${current.physicalId}) failed: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}. Delete it manually — it is no longer tracked in state.`);
+					result.warnings++;
+				}
+				logger.info(`  Rollback: ${op.logicalId} replacement reversed (old resource re-created as ${createResult.physicalId})`);
+				ctx.recordEvent?.({
+					eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
+					stackName,
+					operation: "UPDATE",
+					logicalId: op.logicalId,
+					resourceType: op.resourceType,
+					...op.provisionedBy && { provisionedBy: op.provisionedBy }
+				});
+				return;
+			}
 			case "revert": {
 				if (!op.previousState) {
 					logger.warn(`  Rollback: Cannot restore ${op.logicalId} — no previous state available`);
@@ -16734,6 +16879,115 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 		});
 	}
 }
+/**
+* Revert a segment's FAILED in-flight operations (issue #1198). Opt-in via
+* `cdkd rollback --revert-failed` — the failed resource's remote state is
+* unknown (the op died partway), so force-applying `previousState` is a
+* deliberate user decision, never the default. Runs BEFORE the segment's
+* completed ops (the failed op is the newest work of the failed deploy).
+*
+* Best-effort like {@link replayRollback}: per-op failures are caught,
+* warned, and counted.
+*/
+async function replayFailedOperations(failedOps, stateResources, stackName, ctx, options = {}) {
+	const result = {
+		failures: 0,
+		warnings: 0,
+		interrupted: false,
+		remainingFailedOps: []
+	};
+	const { logger } = ctx;
+	const emitEnvelope = options.emitEnvelope === true && failedOps.length > 0;
+	if (emitEnvelope) ctx.recordEvent?.({
+		eventType: "ROLLBACK_STARTED",
+		stackName
+	});
+	const pending = /* @__PURE__ */ new Set();
+	for (let i = failedOps.length - 1; i >= 0; i--) {
+		if (options.isInterrupted?.()) {
+			result.interrupted = true;
+			for (let j = i; j >= 0; j--) pending.add(failedOps[j]);
+			break;
+		}
+		const op = failedOps[i];
+		const action = classifyFailedOp(op, stateResources);
+		try {
+			switch (action) {
+				case "skip-failed-noop":
+					logger.info(`  Rollback: failed ${op.changeType} of ${op.logicalId} (${op.resourceType}) left nothing to revert, skipping`);
+					break;
+				case "skip-failed-unknown":
+					logger.warn(`  Rollback: failed CREATE of ${op.logicalId} (${op.resourceType}) recorded no physical id — if it was partially created in AWS, delete it manually`);
+					result.warnings++;
+					break;
+				case "skip-failed-absent":
+					logger.warn(`  Rollback: cannot revert failed UPDATE of ${op.logicalId} — no previous state available, skipping`);
+					result.warnings++;
+					break;
+				case "delete-failed-create": {
+					logger.info(`  Rollback: deleting partially-created ${op.logicalId} (${op.resourceType}) (--revert-failed)`);
+					const { provider } = ctx.providerRegistry.getProviderFor({
+						resourceType: op.resourceType,
+						provisionedBy: op.provisionedBy
+					});
+					await provider.delete(op.logicalId, op.physicalId, op.resourceType, void 0, { expectedRegion: ctx.region });
+					delete stateResources[op.logicalId];
+					await options.afterOp?.(op.logicalId);
+					ctx.recordEvent?.({
+						eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
+						stackName,
+						operation: "CREATE",
+						logicalId: op.logicalId,
+						resourceType: op.resourceType,
+						...op.provisionedBy && { provisionedBy: op.provisionedBy }
+					});
+					break;
+				}
+				case "revert-failed-update": {
+					const current = stateResources[op.logicalId];
+					const prev = op.previousState;
+					logger.info(`  Rollback: force-reverting failed UPDATE of ${op.logicalId} (${op.resourceType}) to its pre-deploy properties (--revert-failed; remote state is unknown)`);
+					const { provider } = ctx.providerRegistry.getProviderFor({
+						resourceType: op.resourceType,
+						provisionedBy: op.provisionedBy ?? current.provisionedBy
+					});
+					await provider.update(op.logicalId, current.physicalId, op.resourceType, prev.properties, op.attemptedProperties ?? current.properties);
+					stateResources[op.logicalId] = prev;
+					logger.info(`  Rollback: ${op.logicalId} reverted successfully`);
+					await options.afterOp?.(op.logicalId);
+					ctx.recordEvent?.({
+						eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
+						stackName,
+						operation: "UPDATE",
+						logicalId: op.logicalId,
+						resourceType: op.resourceType,
+						...op.provisionedBy && { provisionedBy: op.provisionedBy }
+					});
+					break;
+				}
+			}
+		} catch (revertError) {
+			logger.warn(`  Rollback failed for failed-op ${op.logicalId} (${op.changeType}): ${revertError instanceof Error ? revertError.message : String(revertError)}`);
+			result.failures++;
+			pending.add(op);
+			ctx.recordEvent?.({
+				eventType: "ROLLBACK_RESOURCE_FAILED",
+				stackName,
+				operation: op.changeType,
+				logicalId: op.logicalId,
+				resourceType: op.resourceType,
+				...op.provisionedBy && { provisionedBy: op.provisionedBy },
+				error: extractDeploymentEventError(revertError)
+			});
+		}
+	}
+	if (emitEnvelope) ctx.recordEvent?.({
+		eventType: "ROLLBACK_FINISHED",
+		stackName
+	});
+	result.remainingFailedOps = failedOps.filter((op) => pending.has(op));
+	return result;
+}
 function stateResourcesPolicyLabel(op, stateResources) {
 	return stateResources[op.logicalId]?.deletionPolicy ?? "Retain";
 }
@@ -16826,7 +17080,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.263.2";
+	return "0.264.1";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -17383,6 +17637,14 @@ var DeployEngine = class {
 	*/
 	recordedOutputReads = [];
 	/**
+	* Per-logical-id snapshot of the intrinsic-RESOLVED desired properties
+	* each CREATE / UPDATE attempted (issue #1198). Written just before the
+	* provider call; read only when the op FAILS, to journal the failed op's
+	* `attemptedProperties` so `cdkd rollback --revert-failed` can generate a
+	* patch that undoes a half-applied update.
+	*/
+	attemptedResolvedProps = /* @__PURE__ */ new Map();
+	/**
 	* Target region for this stack. Required — load-bearing for the
 	* region-prefixed S3 state key and recorded in state.json for
 	* cross-region destroy.
@@ -17808,6 +18070,7 @@ var DeployEngine = class {
 			skipped: 0
 		};
 		const completedOperations = [];
+		const failedOperations = [];
 		let pendingMigration = migrationPending;
 		let saveChain = Promise.resolve();
 		const saveStateAfterResource = (logicalId) => {
@@ -17869,6 +18132,15 @@ var DeployEngine = class {
 						} catch (provisionError) {
 							this.interrupted = true;
 							this.interruptCause ??= "sibling-failure";
+							failedOperations.push({
+								logicalId,
+								changeType: change.changeType,
+								resourceType: change.resourceType,
+								provisionedBy: newResources[logicalId]?.provisionedBy ?? previousState?.provisionedBy,
+								...previousState && { previousState },
+								physicalId: newResources[logicalId]?.physicalId ?? previousState?.physicalId,
+								attemptedProperties: this.attemptedResolvedProps.get(logicalId)
+							});
 							throw provisionError;
 						}
 						completedOperations.push({
@@ -17907,6 +18179,14 @@ var DeployEngine = class {
 						} catch (provisionError) {
 							this.interrupted = true;
 							this.interruptCause ??= "sibling-failure";
+							failedOperations.push({
+								logicalId,
+								changeType: "DELETE",
+								resourceType: change.resourceType,
+								provisionedBy: previousState?.provisionedBy,
+								...previousState && { previousState },
+								physicalId: previousState?.physicalId
+							});
 							throw provisionError;
 						}
 						completedOperations.push({
@@ -17949,16 +18229,16 @@ var DeployEngine = class {
 			}
 			let autoRollbackClean = false;
 			if (error instanceof InterruptedError) {
-				await this.writeRollbackJournalSegment(stackName, completedOperations, "interrupted", initialDeploy);
+				await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "interrupted", initialDeploy);
 				this.logger.info(`Partial state saved (${Object.keys(newResources).length} resources). Run deploy again to resume, 'cdkd rollback' to revert, or destroy to clean up.`);
 				throw error;
 			}
 			if (this.options.noRollback) {
-				await this.writeRollbackJournalSegment(stackName, completedOperations, "no-rollback-failure", initialDeploy);
+				await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "no-rollback-failure", initialDeploy);
 				this.logger.warn("Deployment failed. --no-rollback is set, skipping rollback.");
 				this.logger.warn("Partial state has been saved. Run 'cdkd deploy' to resume, 'cdkd rollback' to revert, or destroy to clean up.");
 			} else {
-				await this.writeRollbackJournalSegment(stackName, completedOperations, "auto-rollback-started", initialDeploy);
+				await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "auto-rollback-started", initialDeploy);
 				autoRollbackClean = (await this.performRollback(completedOperations, newResources, stackName)).failures === 0;
 			}
 			try {
@@ -18003,7 +18283,7 @@ var DeployEngine = class {
 			outputs = await this.resolveOutputs(template, newResources, stackName, parameterValues, conditions);
 		} catch (outputError) {
 			await this.persistStateAfterOutputFailure(stackName, currentState, newResources, currentEtag, pendingMigration);
-			await this.writeRollbackJournalSegment(stackName, completedOperations, "no-rollback-failure", currentEtag === void 0);
+			await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "no-rollback-failure", currentEtag === void 0);
 			throw outputError;
 		}
 		return {
@@ -18113,8 +18393,8 @@ var DeployEngine = class {
 	* `cdkd rollback`. Best-effort like the partial-state save, but warns
 	* LOUDLY on failure — the user just lost the ability to `cdkd rollback`.
 	*/
-	async writeRollbackJournalSegment(stackName, completedOperations, reason, initialDeploy) {
-		if (completedOperations.length === 0) return;
+	async writeRollbackJournalSegment(stackName, completedOperations, failedOperations, reason, initialDeploy) {
+		if (completedOperations.length === 0 && failedOperations.length === 0) return;
 		try {
 			const segment = {
 				...this.options.eventRecorder?.runId !== void 0 && { runId: this.options.eventRecorder.runId },
@@ -18123,7 +18403,8 @@ var DeployEngine = class {
 				initialDeploy,
 				...this.options.roleArn && { roleArn: this.options.roleArn },
 				cdkdVersion: getCdkdVersion(),
-				operations: completedOperations
+				operations: completedOperations,
+				...failedOperations.length > 0 && { failedOperations }
 			};
 			await this.stateBackend.appendRollbackJournalSegment(stackName, this.stackRegion, segment);
 			this.logger.debug(`Rollback journal segment written (${reason})`);
@@ -18255,6 +18536,7 @@ var DeployEngine = class {
 				}, stackName);
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
+				this.attemptedResolvedProps.set(logicalId, resolvedProps);
 				const createDecision = this.providerRegistry.getProviderFor({
 					resourceType,
 					properties: resolvedProps
@@ -18295,6 +18577,7 @@ var DeployEngine = class {
 				}, stackName);
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
+				this.attemptedResolvedProps.set(logicalId, resolvedProps);
 				if (JSON.stringify(resolvedProps) === JSON.stringify(currentProps)) {
 					if (change.attributeChanges && change.attributeChanges.length > 0) {
 						const attrSummary = change.attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
@@ -18733,5 +19016,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { rewriteTemplateAssetReferences as $, StackHasActiveImportsError as $t, disableInstanceApiTermination as A, uploadCfnTemplate as At, DiffCalculator as B, CdkdError as Bt, yellow as C, resolveStateBucketWithDefaultAndSource as Ct, findActionableSilentDrops as D, CFN_TEMPLATE_URL_LIMIT as Dt, ProviderRegistry as E, CFN_TEMPLATE_BODY_LIMIT as Et, WAFv2WebACLProvider as F, AwsClients as Ft, rebuildClientForBucketRegion as G, LocalStartServiceError as Gt, TemplateParser as H, DependencyError as Ht, normalizeAwsTagsToCfn as I, getAwsClients as It, stringifyValue as J, NestedStackChildDirectDestroyError as Jt, shouldRetainResource as K, LockError as Kt, resolveExplicitPhysicalId as L, resetAwsClients as Lt, IntrinsicFunctionResolver as M, AssemblyReader as Mt, cfnRefValueFromPhysicalId as N, clearBucketRegionCache as Nt, CloudControlProvider as O, MIGRATE_TMP_PREFIX as Ot, refStateLookupFromResource as P, resolveBucketRegion as Pt, loadPublishableAssetManifest as Q, ResourceUpdateNotSupportedError as Qt, assertRegionMatch as R, setAwsClients as Rt, red as S, resolveStateBucketWithDefault as St, collectInlinePolicyNamesManagedBySiblings as T, warnDeprecatedNoPrefixCliFlag as Tt, LockManager as U, LocalInvokeBuildError as Ut, DagBuilder as V, ConfigError as Vt, S3StateBackend as W, LocalMigrateError as Wt, buildAssetRedirectMap as X, ProvisioningError as Xt, WorkGraph as Y, PartialFailureError as Yt, createAssetRedirectResolver as Z, ResourceTimeoutError as Zt, formatResourceLine as _, getLegacyStateBucketName as _t, DeploymentEventsStore as a, normalizeAwsError as an, validateAssetBucketName as at, gray as b, resolveCaptureObservedState as bt, withResourceDeadline as c, formatDockerLoginError as ct, IMPLICIT_DELETE_DEPENDENCIES as d, runDockerStreaming as dt, StackTerminationProtectionError as en, AssetModeResolver as et, computeImplicitDeleteEdges as f, AssetManifestLoader as ft, renderStatefulReason as g, getDefaultStateBucketName as gt, isStatefulRecreateTargetSync as h, synthesisStatusMessage as ht, DeploymentEventsReader as i, isCdkdError as in, parseBootstrapMarker as it, isTerminationProtectionPropagationError as j, expectedOwnerParam as jt, slowCcOperationTimeoutMs as k, findLargeInlineResources as kt, withRetry as l, getDockerCmd as lt, MULTI_REGION_RECREATE_BLOCKED_TYPES as m, Synthesizer as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, SynthesisError as nn, ensureAssetStorage as nt, planRollback as o, withErrorHandling as on, validateContainerRepoName as ot, extractDeploymentEventError as p, getDockerImageBySourceHash as pt, AssetPublisher as q, MissingCdkCliError as qt, DeployEngine as r, formatError as rn, getBootstrapMarkerKey as rt, replayRollback as s, __exportAll as sn, buildDockerImage as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, StateError as tn, BOOTSTRAP_MARKER_PREFIX as tt, isRetryableTransientError as u, runDockerForeground as ut, bold as v, resolveApp as vt, IAMRoleProvider as w, resolveUseCdkBootstrapAssets as wt, green as x, resolveSkipPrefix as xt, cyan as y, resolveAutoAssetStorage as yt, applyRoleArnIfSet as z, AssetError as zt };
-//# sourceMappingURL=deploy-engine-j-e2Q0XH.js.map
+export { createAssetRedirectResolver as $, ResourceTimeoutError as $t, CloudControlProvider as A, MIGRATE_TMP_PREFIX as At, assertRegionMatch as B, setAwsClients as Bt, green as C, resolveSkipPrefix as Ct, collectInlinePolicyNamesManagedBySiblings as D, warnDeprecatedNoPrefixCliFlag as Dt, IAMRoleProvider as E, resolveUseCdkBootstrapAssets as Et, cfnRefValueFromPhysicalId as F, clearBucketRegionCache as Ft, LockManager as G, LocalInvokeBuildError as Gt, DiffCalculator as H, CdkdError as Ht, refStateLookupFromResource as I, resolveBucketRegion as It, shouldRetainResource as J, LockError as Jt, S3StateBackend as K, LocalMigrateError as Kt, WAFv2WebACLProvider as L, AwsClients as Lt, disableInstanceApiTermination as M, uploadCfnTemplate as Mt, isTerminationProtectionPropagationError as N, expectedOwnerParam as Nt, ProviderRegistry as O, CFN_TEMPLATE_BODY_LIMIT as Ot, IntrinsicFunctionResolver as P, AssemblyReader as Pt, buildAssetRedirectMap as Q, ProvisioningError as Qt, normalizeAwsTagsToCfn as R, getAwsClients as Rt, gray as S, resolveCaptureObservedState as St, yellow as T, resolveStateBucketWithDefaultAndSource as Tt, DagBuilder as U, ConfigError as Ut, applyRoleArnIfSet as V, AssetError as Vt, TemplateParser as W, DependencyError as Wt, stringifyValue as X, NestedStackChildDirectDestroyError as Xt, AssetPublisher as Y, MissingCdkCliError as Yt, WorkGraph as Z, PartialFailureError as Zt, isStatefulRecreateTargetSync as _, synthesisStatusMessage as _t, DeploymentEventsStore as a, formatError as an, getBootstrapMarkerKey as at, bold as b, resolveApp as bt, replayFailedOperations as c, withErrorHandling as cn, validateContainerRepoName as ct, withRetry as d, getDockerCmd as dt, ResourceUpdateNotSupportedError as en, loadPublishableAssetManifest as et, isRetryableTransientError as f, runDockerForeground as ft, MULTI_REGION_RECREATE_BLOCKED_TYPES as g, Synthesizer as gt, extractDeploymentEventError as h, getDockerImageBySourceHash as ht, DeploymentEventsReader as i, SynthesisError as in, ensureAssetStorage as it, slowCcOperationTimeoutMs as j, findLargeInlineResources as jt, findActionableSilentDrops as k, CFN_TEMPLATE_URL_LIMIT as kt, replayRollback as l, __exportAll as ln, buildDockerImage as lt, computeImplicitDeleteEdges as m, AssetManifestLoader as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, StackTerminationProtectionError as nn, AssetModeResolver as nt, planFailedOps as o, isCdkdError as on, parseBootstrapMarker as ot, IMPLICIT_DELETE_DEPENDENCIES as p, runDockerStreaming as pt, rebuildClientForBucketRegion as q, LocalStartServiceError as qt, DeployEngine as r, StateError as rn, BOOTSTRAP_MARKER_PREFIX as rt, planRollback as s, normalizeAwsError as sn, validateAssetBucketName as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, StackHasActiveImportsError as tn, rewriteTemplateAssetReferences as tt, withResourceDeadline as u, formatDockerLoginError as ut, renderStatefulReason as v, getDefaultStateBucketName as vt, red as w, resolveStateBucketWithDefault as wt, cyan as x, resolveAutoAssetStorage as xt, formatResourceLine as y, getLegacyStateBucketName as yt, resolveExplicitPhysicalId as z, resetAwsClients as zt };
+//# sourceMappingURL=deploy-engine-DNLQYYBx.js.map