@go-to-k/cdkd 0.283.35 → 0.284.0

package/dist/{deploy-engine-fBYrdrmB.js → deploy-engine-C7JEL0Mg.js}

@@ -9887,20 +9887,32 @@ const SECRET_MASK = "***";
 * homing it here means no call site has to thread it: the four sibling writers
 * #1910 fixes pass a position SOURCE and nothing else.
 *
-* Its lifetime matches the resolver's `cachedDynamicReferences` — the resolver
-* clears both together, and that shared lifetime is the point: this set IS the
-* resolver's own SecureString verdict store, which already had exactly this
-* scope, so nothing is widened by homing it here.
-*
-* Process-wide is therefore INHERITED, not claimed to be ideal. It is not
-* strictly sound across regions or accounts in one run — the same expression
-* can name a `SecureString` in one region and a plain `String` in another — but
-* `cachedDynamicReferences` caches the resolved VALUE under the same
-* assumption, so a per-region store here would fix nothing on its own. Note
-* which way the imprecision points: an entry only ever GRANTS "persist the
-* source leaf verbatim", and the leaf is the resource's own template
-* expression, so the failure mode is a public reference stored as an expression
-* (a spurious UPDATE, issue #1901's class), never a secret stored as plaintext.
+* Its lifetime NO LONGER matches the resolver's `cachedDynamicReferences`, and
+* that divergence is now deliberate (issue
+* [#1933](https://github.com/go-to-k/cdkd/issues/1933)). The resolved VALUES
+* moved onto the RESOLVER INSTANCE — one per stack, each carrying its own
+* region — because a value is only true for the region that read it. A VERDICT
+* is a statement about a reference's TYPE and has to be readable with no
+* resolver in hand: {@link isKnownSecretExpression} is consulted from the
+* redaction path, whose callers thread a position SOURCE and nothing else. So
+* this set stays process-wide while the values do not, and
+* `resetAccountInfoCache` now clears only this one.
+*
+* Process-wide is therefore CHOSEN here rather than inherited, and the choice
+* is what makes a stale verdict correctable: a resolver whose fresh
+* `GetParameter` reports a public `Type` RETRACTS the entry
+* ({@link forgetSecretExpression}) for every later reader, which a per-region
+* store would scope away. It is still not strictly sound across regions or
+* accounts in one run — the same expression can name a `SecureString` in one
+* region and a plain `String` in another — but note which way the imprecision
+* points in EACH direction now that the two stores can disagree. An entry only
+* ever GRANTS "persist the source leaf verbatim", so a verdict inherited from
+* another region can at worst store a public reference as an expression (a
+* spurious UPDATE, issue #1901's class), never a secret as plaintext. And the
+* opposite move — another region RETRACTING a verdict this stack still needs —
+* cannot un-redact anything either, because each of the resolver's own cache
+* entries carries the verdict that produced it and re-records on a hit without
+* consulting this set.
 */
 const recordedSecretExpressions$1 = /* @__PURE__ */ new Set();
 /** Remember that `expression` resolves to a secret. Called by the resolver. */
@@ -12152,15 +12164,19 @@ let cachedAccountIdentity = null;
 */
 const cachedAvailabilityZones = {};
 /**
-* Cache for resolved dynamic references (secretsmanager, ssm)
-*/
-const cachedDynamicReferences = {};
-/**
 * The `{{resolve:...}}` expressions this process has PROVEN resolve to a
 * SECRET, reached through `secret-redaction.ts`'s `recordedSecretExpressions`
-* store. Lifetime is {@link cachedDynamicReferences}'s — `resetAccountInfoCache`
-* clears both, so a stale verdict can never decide secret-ness for a reference
-* whose resolved value that call just asked to forget.
+* store. Process-global, and cleared by `resetAccountInfoCache` so a test (or a
+* later phase) cannot inherit a verdict it just asked to forget.
+*
+* NOTE this store is deliberately WIDER-lived than the resolved VALUES it was
+* once paired with: those moved onto the resolver instance (issue #1933), while
+* a verdict is a statement about a reference's TYPE, which the redaction path
+* must be able to read with no resolver in hand. The asymmetry is safe in the
+* one direction that matters — a verdict inherited across regions can only make
+* a reference be treated AS a secret (persisted as its expression, never as
+* plaintext), and the reverse case re-asks AWS because the fresh response is
+* authoritative and the value cache no longer answers for another region.
 *
 * `ssm` is the kind that NEEDS the memory (issue #1901). A plain `ssm`
 * reference is not a secret by SPELLING the way `secretsmanager` is — whether
@@ -12249,6 +12265,24 @@ function accountInfoFor(identity, overrideRegion) {
 * the same deploy heal.
 */
 const FABRICATED_ACCOUNT_INFO_TTL_MS = 1e4;
+/**
+* Retries after the first attempt for a dynamic-reference lookup, THROTTLE-shaped
+* failures only (issue #1933 review). Everything else — a missing parameter, a
+* denied secret — is a real answer and is thrown to the caller unchanged.
+*
+* It matters more since the cache became per-resolver AND stopped memoizing a
+* value whose ssm `Type` was unclassifiable: both raise the call COUNT for the
+* same template (one lookup per resolver rather than per process; one per
+* occurrence for the anomalous type), and a bare `send` turned the resulting
+* throttle into an aborted deploy. At the default backoff (1s -> 2s -> 4s -> 8s)
+* this adds at most ~15s of sleep, against re-running the whole deploy.
+*/
+const MAX_DYNAMIC_REFERENCE_THROTTLE_RETRIES = 4;
+/**
+* Test seam: overriding `sleep` lets unit tests drive the backoff schedule
+* without real waits (mirrors `describeTypeRetryDelays`).
+*/
+const dynamicReferenceRetryDelays = {};
 /** Test seam for {@link FABRICATED_ACCOUNT_INFO_TTL_MS} expiry. */
 const accountInfoClock = { now: () => Date.now() };
 let fabricatedAccountIdentity = null;
@@ -12435,6 +12469,89 @@ var IntrinsicFunctionResolver = class {
 	* deploy summary.
 	*/
 	physicalIdFallbackCount = 0;
+	/**
+	* Resolved `{{resolve:secretsmanager:...}}` / `{{resolve:ssm:...}}` values,
+	* keyed by the full expression — INSTANCE-scoped, which closes the CACHE half
+	* of issue [#1933](https://github.com/go-to-k/cdkd/issues/1933). The issue is
+	* only PARTIALLY addressed by this field: see "what this does NOT settle"
+	* below.
+	*
+	* It used to be a module-global map keyed by the expression ALONE, and both
+	* halves of that were wrong for the same reason: the key and the lifetime
+	* were narrower than the value they stood for.
+	*
+	* - REGION. Secrets Manager secrets and SSM parameters are regional and
+	*   independent — the same NAME in `us-east-1` and `ap-northeast-1` is two
+	*   different values, routinely two different credentials — so the first
+	*   region to resolve an expression won it for the whole process, and every
+	*   later stack in every other region silently reused that value.
+	* - STACK. Nothing reset the map between stacks, so a second stack's
+	*   resolution cache-HIT and skipped the lookup that re-records the value as
+	*   a secret. `cdkd scrub --all` then found an empty secrets map for that
+	*   stack and reported it clean.
+	*
+	* Instance scope settles both at once because a region boundary and a stack
+	* boundary are BOTH resolver boundaries in cdkd: {@link resolverRegion} is
+	* fixed at construction, and every caller builds one resolver per stack
+	* (`DeployEngine` per deploy, `scrub` / `import` / `diff-recursive` /
+	* `rollback-executor` per stack). Re-keying by region alone would have left
+	* the stack half open, which is why the lifetime — not the key — is what
+	* moved.
+	*
+	* ONE caller is a known EXCEPTION to that invariant, and it is written down
+	* here because an invariant recorded without its exception is how the next
+	* change breaks it: `cdkd export` builds a single `paramResolver`
+	* (`src/cli/commands/export.ts`, the `buildResolvedParametersPerStack`
+	* pre-pass) and shares it across every node of a nested-stack tree, while the
+	* nodes carry a per-node `region`. It is safe TODAY for two independent
+	* reasons — the resolver is constructed with the tree's single `rootRegion`
+	* and nested children do not yet diverge from it, and that pre-pass passes no
+	* `recordedSecretValues` bag, so neither the region nor the secrets-recording
+	* dimension has anything to cross. Both stop holding the moment cross-region
+	* nested stacks ship or that pass starts recording secrets; a resolver per
+	* node is the fix then, not a wider key here.
+	*
+	* What this does NOT settle — issue
+	* [#1957](https://github.com/go-to-k/cdkd/issues/1957) owns it: the lookups
+	* themselves still go through the process-ambient `getAwsClients()` singleton
+	* (see `resolveSecretsManagerReference` / `resolveSSMReference`), whose region
+	* is whichever the process installed last. So a resolver constructed for
+	* region B while the ambient clients point at region A still reads A on its
+	* FIRST resolution — no cache involved, so nothing here can prevent it.
+	* `cdkd deploy` re-pins the singleton per stack, which makes a SERIAL
+	* multi-region deploy correct end to end, but the default
+	* `--stack-concurrency 4` races for it (a hazard `deploy.ts` already
+	* documents) and `cdkd scrub` installs its clients once while resolving
+	* stacks in several regions. The split of ownership is therefore: THIS field
+	* closes the cache as a cross-region / cross-stack carrier, while #1957 owns
+	* the wrong-region READ — which is the outcome #1933's title names, so #1933
+	* is not fully resolved until #1957 lands. Pinning the lookup to
+	* {@link resolverRegion} means constructing region-scoped clients, which is a
+	* credentials decision (a bare `new SSMClient({ region })` drops the ambient
+	* profile / assume-role config) and belongs to #1957 rather than here.
+	*/
+	cachedDynamicReferences = /* @__PURE__ */ new Map();
+	/**
+	* `<parameter name>\u0000<reported Type>` pairs this resolver has already
+	* warned about (issue #1933 review).
+	*
+	* Keyed on the PAIR rather than the name alone: two different anomalous types
+	* for one parameter are two different facts — the line REPORTS the type, so
+	* suppressing the second would hide a `Type` nobody has seen yet behind one
+	* that was already explained. The volume problem this set exists for is N
+	* IDENTICAL lines for N occurrences of one reference, which the pair still
+	* bounds, because the type is a property of the parameter rather than of the
+	* occurrence.
+	*
+	* The warning is per LOOKUP, and a parameter with an anomalous `Type` is
+	* deliberately never cached (see `cacheable` in `resolveDynamicReferences`),
+	* so it is re-looked-up for every occurrence of the reference in the stack —
+	* which without this set means one identical warn line per occurrence per
+	* pass, on the exact template that most needs the line to be READ. Scoped to
+	* the resolver, like the value cache: a different stack genuinely deserves
+	* its own warning, since the parameter it names may be a different region's.
+	*/
+	warnedUnrecognizedSsmTypes = /* @__PURE__ */ new Set();
 	constructor(region, options) {
 		this.resolverRegion = region || process.env["AWS_REGION"] || "us-east-1";
 		this.strictGetAtt = options?.strictGetAtt ?? false;
@@ -14014,21 +14131,35 @@ var IntrinsicFunctionResolver = class {
 			const service = inner.split(":")[0];
 			const isKnownSecret = service === "secretsmanager" || recordedSecretExpressions.has(fullMatch);
 			if (isKnownSecret && context?.skipDynamicReferences) continue;
-			if (fullMatch in cachedDynamicReferences) {
-				const cached = cachedDynamicReferences[fullMatch];
-				if (isKnownSecret && cached) context?.recordedSecretValues?.set(cached, fullMatch);
-				result = result.replace(fullMatch, () => cached);
+			const cached = this.cachedDynamicReferences.get(fullMatch);
+			if (cached) {
+				if (cached.secret && cached.value) context?.recordedSecretValues?.set(cached.value, fullMatch);
+				result = result.replace(fullMatch, () => cached.value);
 				continue;
 			}
 			const parts = inner.split(":");
 			let resolved;
 			let isSecret = isKnownSecret;
+			/**
+			* May the resolved value be REMEMBERED, or must the next pass re-ask?
+			*
+			* Cleared for exactly the answers the verdict store refuses to pin — an
+			* ssm parameter judged secret from a `Type` that is not a definitive
+			* `SecureString` (issue #1901's fail-closed arm). Caching one would pin
+			* the transient answer for the whole resolver anyway, which is what the
+			* refusal to memoize exists to prevent: before the value cache became
+			* instance-scoped this was already true process-wide, and the
+			* "next pass re-asks" property only ever held on the comparison path,
+			* which caches nothing (issue #1933).
+			*/
+			let cacheable = true;
 			if (service === "secretsmanager") resolved = await this.resolveSecretsManagerReference(inner);
 			else if (service === "ssm") {
 				const decrypt = context?.skipDynamicReferences !== true;
 				const param = await this.resolveSSMReference(parts, decrypt);
 				if (param.type === "SecureString") recordedSecretExpressions.add(fullMatch);
 				else if (!param.secure) recordedSecretExpressions.delete(fullMatch);
+				else cacheable = false;
 				isSecret = param.secure;
 				if (param.secure) {
 					if (!decrypt) continue;
@@ -14038,7 +14169,10 @@ var IntrinsicFunctionResolver = class {
 				this.logger.warn(`Unsupported dynamic reference service: ${service}`);
 				continue;
 			}
-			cachedDynamicReferences[fullMatch] = resolved;
+			if (cacheable) this.cachedDynamicReferences.set(fullMatch, {
+				value: resolved,
+				secret: isSecret
+			});
 			if (isSecret && resolved) {
 				context?.recordedSecretValues?.set(resolved, fullMatch);
 				if (service === "secretsmanager") recordedSecretExpressions.add(fullMatch);
@@ -14098,7 +14232,7 @@ var IntrinsicFunctionResolver = class {
 			...versionStage && versionStage !== "" && { VersionStage: versionStage },
 			...versionId && versionId !== "" && { VersionId: versionId }
 		});
-		const secretString = (await client.send(command)).SecretString;
+		const secretString = (await this.sendWithThrottleRetry(() => client.send(command), `secretsmanager:${secretId}`)).SecretString;
 		if (!secretString) throw new Error(`Dynamic reference: secret '${secretId}' does not contain a SecretString value`);
 		if (jsonKey) try {
 			const keyValue = JSON.parse(secretString)[jsonKey];
@@ -14197,6 +14331,43 @@ var IntrinsicFunctionResolver = class {
 		return parts.join(":");
 	}
 	/**
+	* Run one dynamic-reference lookup, retrying THROTTLE-shaped failures only
+	* (issue #1933 review).
+	*
+	* Both lookups behind `{{resolve:...}}` were bare `send` calls, so a single
+	* `Rate exceeded` aborted the deploy. That was already the wrong trade for a
+	* read, and this PR raises the call count on both paths: the resolved-value
+	* cache is per-resolver now (one lookup per stack rather than one per
+	* process), and a value whose ssm `Type` came back unclassifiable is
+	* deliberately not cached at all (one lookup per OCCURRENCE, so it re-asks
+	* AWS rather than inheriting a transient verdict). Retrying only the throttle
+	* shape keeps every real answer — `ParameterNotFound`, `AccessDenied`, a
+	* malformed reference — failing fast and unchanged.
+	*
+	* Two bounds, both NAMED rather than fixed here:
+	*
+	* - No `isInterrupted` is threaded, so a Ctrl-C landing inside the backoff is
+	*   only noticed when that sleep ends — worst case ~8s, ~15s across the whole
+	*   schedule. `withRetry` supports the hook, but the only interrupt state in
+	*   the tree is `DeployEngine.interrupted`, which reaches nothing here;
+	*   wiring it means a resolver option threaded from that engine.
+	* - It says NOTHING about concurrency. The client is captured before the
+	*   first attempt, so a sibling stack's teardown (`stackAwsClients.destroy()`
+	*   in `deploy.ts`) during a backoff surfaces as a raw, non-throttle-shaped
+	*   failure on the next attempt. That is a property of the ambient-singleton
+	*   design this PR deliberately does not touch (issue
+	*   [#1957](https://github.com/go-to-k/cdkd/issues/1957)), not something the
+	*   retry makes safe.
+	*/
+	sendWithThrottleRetry(operation, label) {
+		return withRetry(operation, label, {
+			maxRetries: MAX_DYNAMIC_REFERENCE_THROTTLE_RETRIES,
+			isRetryable: (_message, error) => isThrottlingError(error),
+			logger: this.logger,
+			...dynamicReferenceRetryDelays.sleep ? { sleep: dynamicReferenceRetryDelays.sleep } : {}
+		});
+	}
+	/**
 	* Resolve an `{{resolve:ssm:...}}` dynamic reference, reporting whether the
 	* parameter is a `SecureString` (issue #1901).
 	*
@@ -14220,12 +14391,13 @@ var IntrinsicFunctionResolver = class {
 			Name: parameterName,
 			WithDecryption: decrypt
 		});
-		const response = await client.send(command);
+		const response = await this.sendWithThrottleRetry(() => client.send(command), `ssm:${parameterName}`);
 		const paramValue = response.Parameter?.Value;
 		if (paramValue === void 0 || paramValue === null) throw new Error(`Dynamic reference: SSM parameter '${parameterName}' not found or has no value`);
 		const paramType = response.Parameter?.Type;
 		const secure = paramType !== "String" && paramType !== "StringList";
-		if (secure && paramType !== "SecureString") {
+		if (secure && paramType !== "SecureString" && !this.warnedUnrecognizedSsmTypes.has(`${parameterName}\u0000${String(paramType)}`)) {
+			this.warnedUnrecognizedSsmTypes.add(`${parameterName}\u0000${String(paramType)}`);
 			const reported = paramType === void 0 ? "(absent)" : `'${String(paramType)}'`;
 			this.logger.warn(`SSM parameter '${parameterName}' reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:ssm:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`);
 		}
@@ -15097,7 +15269,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-xC0UiCjt.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CMvwsTc7.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -19667,18 +19839,27 @@ var IAMRoleProvider = class {
 			const reason = newRoleName !== physicalId ? "RoleName" : "Path";
 			this.logger.debug(`${reason} changed, replacing role: ${physicalId} (${reason}: ${reason === "RoleName" ? `${physicalId} -> ${newRoleName}` : `${oldPath} -> ${newPath}`})`);
 			const createResult = await this.create(logicalId, resourceType, properties);
+			let orphanReason;
 			try {
 				const deleteResult = await this.delete(logicalId, physicalId, resourceType);
-				if (deleteResult?.outcome === "skipped") this.logger.warn(`Skipped deleting old role ${physicalId} during replacement: ${deleteResult.reason}. The old role may be orphaned and require manual cleanup.`);
+				if (deleteResult?.outcome === "skipped") {
+					orphanReason = `old role ${physicalId} was not deleted: ${deleteResult.reason}`;
+					this.logger.warn(`Skipped deleting old role ${physicalId} during replacement: ${deleteResult.reason}. The old role may be orphaned and require manual cleanup.`);
+				}
 			} catch (error) {
+				orphanReason = `old role ${physicalId} could not be deleted: ${String(error)}`;
 				this.logger.warn(`Failed to delete old role ${physicalId} during replacement: ${String(error)}. The old role may be orphaned and require manual cleanup.`);
 			}
-			const result = {
+			const base = {
 				physicalId: createResult.physicalId,
-				wasReplaced: true
+				wasReplaced: true,
+				...createResult.attributes ? { attributes: createResult.attributes } : {}
 			};
-			if (createResult.attributes) result.attributes = createResult.attributes;
-			return result;
+			return orphanReason !== void 0 ? {
+				...base,
+				outcome: "partial",
+				reason: orphanReason
+			} : base;
 		}
 		try {
 			const updateParams = { RoleName: physicalId };
@@ -21603,6 +21784,62 @@ function deleteSkippedMessage(logicalId, physicalId, reason, duringClause) {
 	return `cdkd could not address ${logicalId} (${physicalId}) ${duringClause}, so it was NOT deleted and may still exist: ${reason}`;
 }
 
+//#endregion
+//#region src/deployment/update-outcome.ts
+/**
+* Consumption of {@link ResourceUpdateResult}'s `'partial'` arm (issue
+* [#1819](https://github.com/go-to-k/cdkd/issues/1819)) — the twin of
+* {@link ./delete-outcome.ts} for the UPDATE verb.
+*
+* `ResourceProvider.update` gained an outcome channel whose `'partial'` arm
+* means **the resource was updated, and something the update was responsible
+* for retiring survives and is no longer tracked by cdkd**. The four providers
+* that implement a REPLACEMENT inside `update()` by pairing create and delete
+* are the producers; before the channel existed they emitted a `logger.warn`
+* and the deploy exited 0 with the old resource alive and out of state.
+*
+* **The module must stay a LEAF — no imports beyond the type, ever.** Same
+* reason as `delete-outcome.ts`: the deploy engine, the drift-revert command
+* and the rollback executor all consume it, and those already sit on a dense
+* import ring. A helper that pulled anything else in would close it.
+*/
+/**
+* The `reason` of a `'partial'` update outcome, or `undefined` when the
+* provider reported a clean update (`{ outcome: 'updated' }` or the
+* back-compat omission ~80 providers still use).
+*
+* A function rather than an inline `result.outcome === 'partial'` test at
+* three call sites, so the back-compat reading lives in ONE place — the same
+* call {@link ./delete-outcome.ts} made, and for the same reason: the arm is
+* optional, so a caller comparing by hand can silently test nothing.
+*/
+function updatePartialReason(result) {
+	if (!result || result.outcome !== "partial") return void 0;
+	if (typeof result.reason !== "string") return UNSPECIFIED_PARTIAL_REASON;
+	const trimmed = result.reason.trim();
+	return trimmed === "" ? UNSPECIFIED_PARTIAL_REASON : trimmed;
+}
+/**
+* The one-line status suffix for a partial update, matching the destroy path's
+* `skipped (<reason>)` shape so the two verbs read the same way.
+*
+* Deliberately NOT the word `skipped`: the row's own resource WAS updated, and
+* `RESOURCE_SKIPPED`'s documented invariant is "the resource this row names was
+* not destroyed". Calling the row skipped would be false and would put the
+* event store at odds with its own contract.
+*/
+/**
+* Stand-in for a `'partial'` outcome whose producer supplied no usable reason.
+*
+* Says the cause is unknown rather than inventing one: the row still has to
+* announce that something survived, and a confident-sounding wrong cause is
+* worse than an admitted gap.
+*/
+const UNSPECIFIED_PARTIAL_REASON = "provider reported a partial update without a reason";
+function updatePartialMessage(reason) {
+	return `partial (${reason})`;
+}
+
 //#endregion
 //#region src/deployment/rollback-executor.ts
 /**
@@ -21869,13 +22106,14 @@ async function replayRollback(operations, stateResources, stackName, ctx, option
 		eventType: "ROLLBACK_STARTED",
 		stackName
 	});
+	const resolver = new IntrinsicFunctionResolver(ctx.region);
 	const { createOps, otherOps } = partitionOps(operations);
 	for (let i = otherOps.length - 1; i >= 0; i--) {
 		if (options.isInterrupted?.()) {
 			result.interrupted = true;
 			break;
 		}
-		await replaySingle(otherOps[i], stateResources, stackName, ctx, orphanLogicalIds, result, options.afterOp, options.isInterrupted);
+		await replaySingle(otherOps[i], stateResources, stackName, ctx, resolver, orphanLogicalIds, result, options.afterOp, options.isInterrupted);
 	}
 	if (!result.interrupted && createOps.length > 0) {
 		const sorted = sortRollbackCreates(createOps, stateResources);
@@ -21884,7 +22122,7 @@ async function replayRollback(operations, stateResources, stackName, ctx, option
 				result.interrupted = true;
 				break;
 			}
-			await replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds, result, options.afterOp, options.isInterrupted);
+			await replaySingle(op, stateResources, stackName, ctx, resolver, orphanLogicalIds, result, options.afterOp, options.isInterrupted);
 		}
 	}
 	ctx.logger.info("Rollback completed. Some resources may remain if deletion failed.");
@@ -22064,10 +22302,9 @@ function recordAfterRollbackUpdate(restored, result) {
 function recordedPropertiesAfterReplayCreate(restored, result) {
 	return result.effectiveProperties === void 0 ? restored.properties : { ...result.effectiveProperties };
 }
-async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds, result, afterOp, isInterrupted) {
+async function replaySingle(op, stateResources, stackName, ctx, resolver, orphanLogicalIds, result, afterOp, isInterrupted) {
 	const action = classifyRollbackOp(op, stateResources, orphanLogicalIds);
 	const { logger } = ctx;
-	const resolver = new IntrinsicFunctionResolver(ctx.region);
 	/**
 	* The route a CREATE-rollback arm resolved for this op (issue #1366) —
 	* hoisted so the shared catch's ROLLBACK_RESOURCE_FAILED reports the route
@@ -22306,7 +22543,9 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 					currentProps ?? {}
 				], op.logicalId, logger, isInterrupted);
 				stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(previousState, revertResult), secrets, previousState.properties);
-				logger.info(`  Rollback: ${op.logicalId} restored successfully`);
+				const rollbackPartial = updatePartialReason(revertResult);
+				if (rollbackPartial !== void 0) logger.warn(`  Rollback: ${op.logicalId} restored, ${updatePartialMessage(rollbackPartial)}`);
+				else logger.info(`  Rollback: ${op.logicalId} restored successfully`);
 				await afterOp?.(op.logicalId);
 				ctx.recordEvent?.({
 					eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
@@ -22314,7 +22553,8 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 					operation: "UPDATE",
 					logicalId: op.logicalId,
 					resourceType: op.resourceType,
-					...op.provisionedBy && { provisionedBy: op.provisionedBy }
+					...op.provisionedBy && { provisionedBy: op.provisionedBy },
+					...rollbackPartial !== void 0 && { reason: rollbackPartial }
 				});
 				return;
 			}
@@ -22446,7 +22686,9 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 						attemptedProps ?? {}
 					], op.logicalId, logger, options.isInterrupted);
 					stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(prev, revertFailedResult), secrets, prev.properties);
-					logger.info(`  Rollback: ${op.logicalId} reverted successfully`);
+					const revertFailedPartial = updatePartialReason(revertFailedResult);
+					if (revertFailedPartial !== void 0) logger.warn(`  Rollback: ${op.logicalId} reverted, ${updatePartialMessage(revertFailedPartial)}`);
+					else logger.info(`  Rollback: ${op.logicalId} reverted successfully`);
 					await options.afterOp?.(op.logicalId);
 					ctx.recordEvent?.({
 						eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
@@ -22454,7 +22696,8 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 						operation: "UPDATE",
 						logicalId: op.logicalId,
 						resourceType: op.resourceType,
-						...op.provisionedBy && { provisionedBy: op.provisionedBy }
+						...op.provisionedBy && { provisionedBy: op.provisionedBy },
+						...revertFailedPartial !== void 0 && { reason: revertFailedPartial }
 					});
 					break;
 				}
@@ -22571,7 +22814,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.283.35";
+	return "0.284.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -23682,6 +23925,7 @@ var DeployEngine = class {
 					updated: 0,
 					deleted: 0,
 					deleteSkipped: 0,
+					updatePartial: 0,
 					unchanged: Object.keys(currentState.resources).length,
 					durationMs: Date.now() - startTime,
 					outputs: this.buildDisplayOutputs(template, persistedOutputs),
@@ -23700,6 +23944,7 @@ var DeployEngine = class {
 					updated: updateChanges.length,
 					deleted: deleteChanges.length,
 					deleteSkipped: 0,
+					updatePartial: 0,
 					unchanged: this.diffCalculator.filterByType(changes, "NO_CHANGE").length,
 					durationMs: Date.now() - startTime,
 					attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
@@ -23723,6 +23968,7 @@ var DeployEngine = class {
 				updated: actualCounts.updated,
 				deleted: actualCounts.deleted,
 				deleteSkipped: actualCounts.deleteSkipped,
+				updatePartial: actualCounts.updatePartial,
 				unchanged: unchangedCount,
 				durationMs,
 				outputs: this.buildDisplayOutputs(template, newState.outputs ?? {}),
@@ -23757,7 +24003,8 @@ var DeployEngine = class {
 			updated: 0,
 			deleted: 0,
 			skipped: 0,
-			deleteSkipped: 0
+			deleteSkipped: 0,
+			updatePartial: 0
 		};
 		const completedOperations = [];
 		const failedOperations = [];
@@ -24176,9 +24423,14 @@ var DeployEngine = class {
 			...labelRouting && { provisionedBy: labelRouting }
 		});
 		let deleteSkipped;
+		let updatePartial;
+		const physicalIdBeforeUpdate = stateResources[logicalId]?.physicalId;
+		const provisionedByBeforeUpdate = stateResources[logicalId]?.provisionedBy;
 		try {
 			await withResourceDeadline(async () => {
-				deleteSkipped = (await this.provisionResourceBody(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress))?.deleteSkipped;
+				const bodyResult = await this.provisionResourceBody(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress);
+				deleteSkipped = bodyResult?.deleteSkipped;
+				updatePartial = bodyResult?.updatePartial;
 			}, {
 				warnAfterMs,
 				timeoutMs,
@@ -24206,6 +24458,17 @@ var DeployEngine = class {
 				});
 				return { deleteSkipped };
 			}
+			if (updatePartial !== void 0) this.recordEvent({
+				eventType: "RESOURCE_SKIPPED",
+				stackName,
+				operation: eventOp,
+				logicalId,
+				resourceType,
+				...provisionedByBeforeUpdate ? { provisionedBy: provisionedByBeforeUpdate } : labelRouting && { provisionedBy: labelRouting },
+				...physicalIdBeforeUpdate && { physicalId: physicalIdBeforeUpdate },
+				reason: updatePartial,
+				durationMs: Date.now() - resourceStartedAt
+			});
 			this.recordEvent({
 				eventType: "RESOURCE_SUCCEEDED",
 				stackName,
@@ -24637,10 +24900,16 @@ var DeployEngine = class {
 					};
 					const updateCaptureSiblings = await this.buildObservedCaptureSiblings(resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
 					this.kickOffObservedCapture(updateProvider, logicalId, result.physicalId, resourceType, resolvedProps, updateCaptureSiblings);
-					if (counts) counts.updated++;
+					const updatePartial = updatePartialReason(result);
+					if (counts) if (updatePartial !== void 0) counts.updatePartial++;
+					else counts.updated++;
 					if (progress) progress.current++;
 					const updatePrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
 					renderer.removeTask(logicalId);
+					if (updatePartial !== void 0) {
+						this.logger.warn(`${updatePrefix}${formatResourceLine("updated", logicalId, resourceType)} ` + updatePartialMessage(updatePartial));
+						return { updatePartial };
+					}
 					this.logger.info(`${updatePrefix}${formatResourceLine("updated", logicalId, resourceType)}`);
 				}
 				break;
@@ -25012,5 +25281,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { getAccountInfo as $, SynthesisError as $n, formatDockerLoginError as $t, cyan as A, resolveBucketRegion as An, TemplateParser as At, stateKeySecretExposure as B, LocalInvokeBuildError as Bn, loadPublishableAssetManifest as Bt, makeCanonicalizePropertiesFn as C, expectedOwnerParam as Cn, s3BucketWebsiteUrl as Ct, renderStatefulReason as D, AssemblyReader as Dn, describeTypeWithThrottleRetry as Dt, isStatefulRecreateTargetSync as E, derivePartitionAndUrlSuffix as En, INTRINSIC_KEYS as Et, collectDeclaredOutputNames as F, AssetError as Fn, AssetPublisher as Ft, findActionableSilentDrops as G, NestedStackChildDirectDestroyError as Gn, BOOTSTRAP_MARKER_PREFIX as Gt, collectInlinePolicyNamesManagedBySiblings as H, LocalStartServiceError as Hn, escapeRegExp$1 as Ht, collectPublishedOutputNames as I, CdkdError as In, stringifyValue as It, slowCcOperationTimeoutMs as J, ResourceTimeoutError as Jn, parseBootstrapMarker as Jt, findSilentDropProperties as K, PartialFailureError as Kn, ensureAssetStorage as Kt, exportAliasCollisionScrubWarning as L, ConfigError as Ln, WorkGraph as Lt, green as M, getAwsClients as Mn, S3StateBackend as Mt, red as N, resetAwsClients as Nn, rebuildClientForBucketRegion as Nt, formatResourceLine as O, processStackMessages as On, withRetry as Ot, yellow as P, setAwsClients as Pn, shouldRetainResource as Pt, cfnRefValueFromPhysicalId as Q, StateError as Qn, buildDockerImage as Qt, isExportAliasCollision as R, DependencyError as Rn, buildAssetRedirectMap as Rt, unsupportedFinalSnapshotError as S, uploadCfnTemplate as Sn, s3BucketRegionalDomainName as St, MULTI_REGION_RECREATE_BLOCKED_TYPES as T, canonicalizeRegion as Tn, DiffCalculator as Tt, clearOnUpdateRemoval as U, LockError as Un, stripControlChars as Ut, IAMRoleProvider as V, LocalMigrateError as Vn, rewriteTemplateAssetReferences as Vt, ProviderRegistry as W, MissingCdkCliError as Wn, AssetModeResolver as Wt, isTerminationProtectionPropagationError as X, StackHasActiveImportsError as Xn, validateContainerRepoName as Xt, disableInstanceApiTermination as Y, ResourceUpdateNotSupportedError as Yn, validateAssetBucketName as Yt, IntrinsicFunctionResolver as Z, StackTerminationProtectionError as Zn, buildDenyExternalAccessPolicy as Zt, buildFinalSnapshotIdentifier as _, warnDeprecatedNoPrefixCliFlag as _n, redactSecretsForState as _t, DeploymentEventsStore as a, Synthesizer as an, isRetryableTransientError as ar, coerceCfnBoolean as at, isFinalSnapshotError as b, MIGRATE_TMP_PREFIX as bn, s3BucketDomainName as bt, replayFailedOperations as c, getLegacyStateBucketName as cn, __exportAll as cr, readConfigString as ct, deleteSkipReason as d, resolveCaptureObservedState as dn, requireConfigObject as dt, getDockerCmd as en, formatError as er, refStateLookupFromResource as et, withResourceDeadline as f, resolveSkipPrefix as fn, requireConfigString as ft, PRE_DELETE_SNAPSHOT_TYPES as g, stateBucketExistenceConfirmed as gn, maskSecretsInText as gt, ATOMIC_FINAL_SNAPSHOT_TYPES as h, resolveUseCdkBootstrapAssets as hn, TEMPLATE_SOURCED_RULES as ht, DeploymentEventsReader as i, getDockerImageBySourceHash as in, isMarkedNonRetryable as ir, assertRegionMatch as it, gray as j, AwsClients as jn, LockManager as jt, bold as k, clearBucketRegionCache as kn, DagBuilder as kt, replayRollback as l, resolveApp as ln, replayWarn as lt, computeImplicitDeleteEdges as m, resolveStateBucketWithDefaultAndSource as mn, STATE_SOURCED_READBACK_RULES as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, runDockerStreaming as nn, normalizeAwsError as nr, normalizeAwsTagsToCfn as nt, planFailedOps as o, synthesisStatusMessage as on, isThrottlingError as or, configBooleanRefusal as ot, IMPLICIT_DELETE_DEPENDENCIES as p, resolveStateBucketWithDefault as pn, STATE_SOURCED_CROSS_GENERATION_RULES as pt, CloudControlProvider as q, ProvisioningError as qn, getBootstrapMarkerKey as qt, DeployEngine as r, AssetManifestLoader as rn, withErrorHandling as rr, resolveExplicitPhysicalId as rt, planRollback as s, getDefaultStateBucketName as sn, markNonRetryable as sr, configStringRefusal as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, runDockerForeground as tn, isCdkdError as tr, WAFv2WebACLProvider as tt, UNSPECIFIED_SKIP_REASON as u, resolveAutoAssetStorage as un, requireConfigArray as ut, ccRoutedFinalSnapshotError as v, CFN_TEMPLATE_BODY_LIMIT as vn, scrubResourceRecord as vt, extractDeploymentEventError as w, PARTITION_TABLE as wn, applyRoleArnIfSet as wt, refusesFinalSnapshot as x, findLargeInlineResources as xn, s3BucketDualStackDomainName as xt, createPreDeleteFinalSnapshot as y, CFN_TEMPLATE_URL_LIMIT as yn, s3BucketArn as yt, secretBearingStateKeyWarning as z, DeployCancelledError as zn, createAssetRedirectResolver as zt };
-//# sourceMappingURL=deploy-engine-fBYrdrmB.js.map
+export { IntrinsicFunctionResolver as $, StackTerminationProtectionError as $n, buildDenyExternalAccessPolicy as $t, formatResourceLine as A, processStackMessages as An, withRetry as At, isExportAliasCollision as B, DependencyError as Bn, buildAssetRedirectMap as Bt, refusesFinalSnapshot as C, findLargeInlineResources as Cn, s3BucketDualStackDomainName as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, canonicalizeRegion as Dn, DiffCalculator as Dt, extractDeploymentEventError as E, PARTITION_TABLE as En, applyRoleArnIfSet as Et, red as F, resetAwsClients as Fn, rebuildClientForBucketRegion as Ft, clearOnUpdateRemoval as G, LockError as Gn, stripControlChars as Gt, stateKeySecretExposure as H, LocalInvokeBuildError as Hn, loadPublishableAssetManifest as Ht, yellow as I, setAwsClients as In, shouldRetainResource as It, findSilentDropProperties as J, PartialFailureError as Jn, ensureAssetStorage as Jt, ProviderRegistry as K, MissingCdkCliError as Kn, AssetModeResolver as Kt, collectDeclaredOutputNames as L, AssetError as Ln, AssetPublisher as Lt, cyan as M, resolveBucketRegion as Mn, TemplateParser as Mt, gray as N, AwsClients as Nn, LockManager as Nt, isStatefulRecreateTargetSync as O, derivePartitionAndUrlSuffix as On, INTRINSIC_KEYS as Ot, green as P, getAwsClients as Pn, S3StateBackend as Pt, isTerminationProtectionPropagationError as Q, StackHasActiveImportsError as Qn, validateContainerRepoName as Qt, collectPublishedOutputNames as R, CdkdError as Rn, stringifyValue as Rt, isFinalSnapshotError as S, MIGRATE_TMP_PREFIX as Sn, s3BucketDomainName as St, makeCanonicalizePropertiesFn as T, expectedOwnerParam as Tn, s3BucketWebsiteUrl as Tt, IAMRoleProvider as U, LocalMigrateError as Un, rewriteTemplateAssetReferences as Ut, secretBearingStateKeyWarning as V, DeployCancelledError as Vn, createAssetRedirectResolver as Vt, collectInlinePolicyNamesManagedBySiblings as W, LocalStartServiceError as Wn, escapeRegExp$1 as Wt, slowCcOperationTimeoutMs as X, ResourceTimeoutError as Xn, parseBootstrapMarker as Xt, CloudControlProvider as Y, ProvisioningError as Yn, getBootstrapMarkerKey as Yt, disableInstanceApiTermination as Z, ResourceUpdateNotSupportedError as Zn, validateAssetBucketName as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, resolveUseCdkBootstrapAssets as _n, TEMPLATE_SOURCED_RULES as _t, DeploymentEventsStore as a, AssetManifestLoader as an, withErrorHandling as ar, resolveExplicitPhysicalId as at, ccRoutedFinalSnapshotError as b, CFN_TEMPLATE_BODY_LIMIT as bn, scrubResourceRecord as bt, replayFailedOperations as c, synthesisStatusMessage as cn, isThrottlingError as cr, configBooleanRefusal as ct, updatePartialReason as d, resolveApp as dn, replayWarn as dt, buildDockerImage as en, StateError as er, cfnRefValueFromPhysicalId as et, UNSPECIFIED_SKIP_REASON as f, resolveAutoAssetStorage as fn, requireConfigArray as ft, computeImplicitDeleteEdges as g, resolveStateBucketWithDefaultAndSource as gn, STATE_SOURCED_READBACK_RULES as gt, IMPLICIT_DELETE_DEPENDENCIES as h, resolveStateBucketWithDefault as hn, STATE_SOURCED_CROSS_GENERATION_RULES as ht, DeploymentEventsReader as i, runDockerStreaming as in, normalizeAwsError as ir, normalizeAwsTagsToCfn as it, bold as j, clearBucketRegionCache as jn, DagBuilder as jt, renderStatefulReason as k, AssemblyReader as kn, describeTypeWithThrottleRetry as kt, replayRollback as l, getDefaultStateBucketName as ln, markNonRetryable as lr, configStringRefusal as lt, withResourceDeadline as m, resolveSkipPrefix as mn, requireConfigString as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, getDockerCmd as nn, formatError as nr, refStateLookupFromResource as nt, planFailedOps as o, getDockerImageBySourceHash as on, isMarkedNonRetryable as or, assertRegionMatch as ot, deleteSkipReason as p, resolveCaptureObservedState as pn, requireConfigObject as pt, findActionableSilentDrops as q, NestedStackChildDirectDestroyError as qn, BOOTSTRAP_MARKER_PREFIX as qt, DeployEngine as r, runDockerForeground as rn, isCdkdError as rr, WAFv2WebACLProvider as rt, planRollback as s, Synthesizer as sn, isRetryableTransientError as sr, coerceCfnBoolean as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, formatDockerLoginError as tn, SynthesisError as tr, getAccountInfo as tt, updatePartialMessage as u, getLegacyStateBucketName as un, __exportAll as ur, readConfigString as ut, PRE_DELETE_SNAPSHOT_TYPES as v, stateBucketExistenceConfirmed as vn, maskSecretsInText as vt, unsupportedFinalSnapshotError as w, uploadCfnTemplate as wn, s3BucketRegionalDomainName as wt, createPreDeleteFinalSnapshot as x, CFN_TEMPLATE_URL_LIMIT as xn, s3BucketArn as xt, buildFinalSnapshotIdentifier as y, warnDeprecatedNoPrefixCliFlag as yn, redactSecretsForState as yt, exportAliasCollisionScrubWarning as z, ConfigError as zn, WorkGraph as zt };
+//# sourceMappingURL=deploy-engine-C7JEL0Mg.js.map