@go-to-k/cdkd 0.285.13 → 0.285.15

package/dist/{deploy-engine-DhMm2M33.js → deploy-engine-DPh-XamZ.js}

@@ -1,6 +1,6 @@
 import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-FLW4rE5A.js";
+import { t as getCdkdVersion } from "./version-Dcdouqd3.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7927,6 +7927,140 @@ function parseRollbackJournal(bodyString, stackName) {
 	};
 }
 
+//#endregion
+//#region src/state/state-prefix.ts
+/**
+* The default S3 key prefix for cdkd state.
+*
+* Homed in the STATE layer rather than in `src/cli/commands/state-file-keys.ts`
+* (which re-exports it, so its four existing importers are unchanged) because
+* `src/state/lock-contention-message.ts` needs it to decide whether a recovery
+* hint should spell `--state-prefix` at all, and a `src/state/**` module
+* importing from `src/cli/commands/**` inverts the layering — the CLI sits
+* ABOVE the state layer in the 7-layer architecture, not below it.
+*
+* Note this is only the DEFAULT. Other commands accept `--state-prefix`, so
+* whole-bucket listings deliberately do not scope to it.
+*/
+const DEFAULT_STATE_PREFIX = "cdkd";
+/**
+* The state-bucket prefix `CustomResourceProvider` PUTs its response
+* placeholders under, one object per invocation
+* (`custom-resource-responses/{requestId}.json`).
+*
+* Homed here for the same layering reason as {@link DEFAULT_STATE_PREFIX}: the
+* PRODUCER is `src/provisioning/providers/custom-resource-provider.ts` and the
+* COLLECTOR is `src/cli/commands/gc.ts`, so a copy in either would be a copy
+* the other could drift from — and the two spellings would then disagree about
+* which objects exist, which is the only way a sweeper can miss the family it
+* was written for (issue #2052). `src/cli/commands/state-file-keys.ts`
+* re-exports it so gc reads it alongside the other state-key constants.
+*
+* Note this is only the DEFAULT: `ProviderRegistry` can be configured with a
+* different `responsePrefix`, so a sweep scoped to this value is a sweep of the
+* default layout. gc has no access to a non-default one — nothing persists it —
+* which is stated at the sweep's own call site rather than implied here.
+*/
+const CUSTOM_RESOURCE_RESPONSE_PREFIX = "custom-resource-responses";
+
+//#endregion
+//#region src/state/lock-contention-message.ts
+/**
+* The message every fail-fast lock-contention site raises.
+*
+* Issue #2161 made six commands throw on `acquireLock` returning `false`
+* instead of running under a foreign lock. Issue #2170 is the follow-up: the
+* message those sites raise asked the user to decide "is another process
+* active?" while printing none of the evidence that would answer it, and the
+* recovery command it suggested could resolve against the wrong AWS account.
+*
+* Both matter more than they look, because of WHICH locks reach this message.
+* `LockManager.acquireLock` reaps an EXPIRED foreign lock and retries, so a
+* `false` return means the lock is LIVE — in practice a running `cdkd deploy`.
+* The user who follows a bare `cdkd force-unlock <stack>` suggestion therefore
+* deletes a live owner's lock and reproduces issue #2161's harm by hand, which
+* is the outcome #2161 exists to prevent.
+*
+* Centralising the text here also settles the third finding: the nine sites
+* had drifted to three spellings (`for stack` / `for nested stack` /
+* `for nested-stack child`), so a user grepping CI logs for one of them found
+* two of three. `subject` now varies only the noun.
+*/
+/**
+* Stand-in for a value with nothing renderable left after sanitization. Named
+* rather than inlined so the message and the command-suppression branch cannot
+* disagree about what "unrenderable" looks like.
+*/
+const UNRENDERABLE = "<unrenderable>";
+/** Render `expiresIn` without implying more precision than a clock skew allows. */
+function formatRemaining(ms) {
+	if (!Number.isFinite(ms)) return "at an unknown time";
+	if (ms <= 0) return "already expired";
+	const minutes = Math.round(ms / 6e4);
+	if (minutes < 1) return "in under a minute";
+	return `in ~${minutes}m`;
+}
+function shellQuote(value) {
+	return /^[A-Za-z0-9._/@:+-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/**
+* The `cdkd force-unlock ...` line, carrying every flag that decides which
+* lock object it resolves to.
+*/
+function buildForceUnlockCommand(stackName, region, recovery) {
+	const safeStack = displaySafe(stackName, { asciiOnly: true });
+	const stackIsExact = safeStack === stackName;
+	const safeRegion = region === void 0 ? void 0 : displaySafe(region, { asciiOnly: true });
+	if (!safeStack || safeRegion === "" || !stackIsExact || !(region === void 0 || safeRegion === region)) return "";
+	const parts = [safeRegion === void 0 ? `cdkd force-unlock ${shellQuote(safeStack)}` : `cdkd force-unlock ${shellQuote(safeStack)} --stack-region ${shellQuote(safeRegion)}`];
+	if (recovery?.profile) parts.push(`--profile ${shellQuote(recovery.profile)}`);
+	if (recovery?.stateBucket) parts.push(`--state-bucket ${shellQuote(recovery.stateBucket)}`);
+	if (recovery?.statePrefix && recovery.statePrefix !== "cdkd") parts.push(`--state-prefix ${shellQuote(recovery.statePrefix)}`);
+	return parts.join(" ");
+}
+/**
+* The force-quit banner's recovery sentence.
+*
+* Exported so the two `destroy-runner.ts` banners do not each decide what to
+* say when {@link buildForceUnlockCommand} suppresses — a banner ending in a
+* bare `run: ` is the shape the review found, and two copies of the branch is
+* how the next one drifts. Returns a leading-space clause so the caller can
+* concatenate it unconditionally.
+*/
+function forceQuitRecoveryClause(stackName, region, recovery) {
+	const command = buildForceUnlockCommand(stackName, region, recovery);
+	return command ? ` If the next run reports a lock, run: ${command}` : " Inspect the lock object directly: the name or region recorded for this stack cannot be reproduced safely on a command line, so any command shown here would address a different lock.";
+}
+/**
+* Build the contention message, reading the holder's identity best-effort.
+*
+* The `getLockInfo` read is one GetObject and is deliberately NOT allowed to
+* fail the command: the caller is already on its way to throwing, and turning
+* a contention refusal into an S3 error would lose the reason. A failed or
+* absent read degrades to the evidence-free wording rather than to a crash.
+*/
+async function buildLockContentionMessage(args) {
+	const { lockManager, stackName, region, subject = "stack", recovery, heldClause, suffix } = args;
+	let held = heldClause ?? "another cdkd process holds it";
+	let sawHolder = false;
+	try {
+		const info = await lockManager.getLockInfo(stackName, region);
+		if (info) {
+			const operation = info.operation ? `, operation: ${displaySafe(info.operation)}` : "";
+			const expires = formatRemaining(info.expiresAt - Date.now());
+			const owner = displaySafe(info.owner);
+			const holder = owner ? `held by ${owner}${operation}` : `held by an unnamed holder`;
+			held = `${heldClause ? `${heldClause} — ` : ""}${holder}, expires ${expires}`;
+			if (owner) sawHolder = true;
+		}
+	} catch {}
+	const advice = sawHolder ? `That process is still running — wait for it to finish. Only if you are certain it is gone` : `Wait for it to finish, or if you are certain no other process is active`;
+	const recoveryCommand = buildForceUnlockCommand(stackName, region, recovery);
+	const head = `Could not acquire lock for ${subject} '${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}' (${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}) — ${held}.` + (suffix ? ` ${suffix}` : "");
+	if (!recoveryCommand) return `${head} ${advice}. No recovery command can be shown: the name or region recorded for this lock contains characters that cannot be reproduced safely on a command line, so any command shown here would address a different lock — inspect the lock object directly.`;
+	return `${head} ${advice}, run: ${recoveryCommand}`;
+}
+
 //#endregion
 //#region src/utils/bucket-region-client.ts
 /**
@@ -8013,6 +8147,23 @@ const LEGACY_KEY_DEPTH = 2;
 /** The `version: 2` region-prefixed key. */
 const NEW_KEY_DEPTH = 3;
 /**
+* Does a legacy record classified by {@link LegacyStateProbe} belong to an
+* operation targeting `region`?
+*
+* Free function, and shared by both consumers on purpose: the delete sweep
+* needs the probe's KIND as well as this verdict (to warn when a record may
+* have been left behind), and duplicating the mapping at that call site is
+* how the two would drift apart again.
+*/
+function legacyProbeBelongsTo(probe, region) {
+	switch (probe.kind) {
+		case "region": return probe.region === region;
+		case "no-region": return true;
+		case "absent":
+		case "unreadable": return false;
+	}
+}
+/**
 * S3-based state backend using conditional writes for optimistic locking.
 *
 * State keys are region-scoped (`{prefix}/{stackName}/{region}/state.json`)
@@ -8178,7 +8329,7 @@ var S3StateBackend = class {
 		await this.ensureClientForBucket();
 		const newKey = this.getStateKey(stackName, region);
 		if (await this.headObject(newKey)) return true;
-		return this.legacyMatchesRegion(stackName, region);
+		return this.legacyBelongsToRegion(stackName, region);
 	}
 	/**
 	* Get state for a stack, transparently falling back to the legacy key.
@@ -8310,7 +8461,12 @@ var S3StateBackend = class {
 				...await this.ownerParam(),
 				Key: this.getStateKey(stackName, region)
 			}));
-			if (await this.legacyMatchesRegion(stackName, region)) {
+			const legacyProbe = await this.probeLegacyState(stackName);
+			if (legacyProbe.kind === "unreadable") {
+				const safeName = this.displayName(stackName);
+				this.logger.warn(`Could not read the legacy state record for '${safeName}' while cleaning up (${legacyProbe.reason}). If one exists it was left in place. Re-run with --verbose for the details.`);
+			}
+			if (legacyProbeBelongsTo(legacyProbe, region)) {
 				await this.s3Client.send(new DeleteObjectCommand({
 					Bucket: this.config.bucket,
 					...await this.ownerParam(),
@@ -8330,6 +8486,48 @@ var S3StateBackend = class {
 		}
 	}
 	/**
+	* Delete a legacy state file that names no region (issue #2537).
+	*
+	* `deleteState` cannot serve this case: it takes a region, keys the primary
+	* delete off it, and sweeps the legacy key only when that key's own `region`
+	* field matches. A `version: 1` blob whose body carries no `region` at all
+	* has nothing to match, so it falls through every branch there — which is
+	* how `cdkd state orphan` came to report a removal it never performed.
+	*
+	* Unconditional, and deliberately so — but NOT because the caller's ref
+	* proves the body names no region. `listStacks` derives that ref from
+	* `readLegacyRegion`, which also returns undefined on a swallowed 403 / 503
+	* / unparseable body, so a record that DOES name a region can surface
+	* region-less. The delete is still right there: the caller
+	* (`cdkd state orphan` with no `--stack-region`) means "every record for
+	* this name", and this key is one of them. A caller that means something
+	* narrower must not use this method.
+	*
+	* No rollback-journal sweep: journal keys exist only in the region-scoped
+	* layout (see `getRollbackJournalKey`), so a region-less record can have
+	* none.
+	*/
+	async deleteLegacyState(stackName) {
+		await this.ensureClientForBucket();
+		const key = this.getLegacyStateKey(stackName);
+		try {
+			const safeStack = displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>";
+			this.logger.debug(`Deleting legacy state: ${safeStack} (${displaySafe(key, { asciiOnly: true }) || "<unrenderable>"})`);
+			await this.s3Client.send(new DeleteObjectCommand({
+				Bucket: this.config.bucket,
+				...await this.ownerParam(),
+				Key: key
+			}));
+			this.logger.debug(`Legacy state deleted: ${safeStack}`);
+		} catch (error) {
+			const normalized = normalizeAwsError(error, {
+				bucket: this.config.bucket,
+				operation: "DeleteObject"
+			});
+			throw new StateError(`Failed to delete legacy state for stack '${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}': ${normalized.message}`, normalized);
+		}
+	}
+	/**
 	* List all stacks with state in the bucket.
 	*
 	* Returns one `{stackName, region}` pair per state file. Both layouts
@@ -8708,29 +8906,85 @@ var S3StateBackend = class {
 		}
 	}
 	/**
-	* Read the legacy state's `region` field. Used for region matching during
-	* `stateExists` / `deleteState` and for assigning a region to legacy
-	* entries during `listStacks`.
+	* Read the legacy key and classify what is there — {@link LegacyStateProbe}
+	* says what each answer means and which consumer acts on it.
 	*/
-	async readLegacyRegion(stackName) {
+	/**
+	* A stack name safe to put in a log line. Names reach this class from S3
+	* key segments, which anyone able to write the bucket controls, so every
+	* message that renders one goes through here (issue #2170's class).
+	*/
+	displayName(stackName) {
+		return displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>";
+	}
+	async probeLegacyState(stackName) {
 		try {
 			const response = await this.s3Client.send(new GetObjectCommand({
 				Bucket: this.config.bucket,
 				...await this.ownerParam(),
 				Key: this.getLegacyStateKey(stackName)
 			}));
-			if (!response.Body) return void 0;
+			if (!response.Body) {
+				this.logger.debug(`Legacy state probe for '${this.displayName(stackName)}': response carried no body`);
+				return {
+					kind: "unreadable",
+					reason: "the response carried no body"
+				};
+			}
 			const bodyString = await response.Body.transformToString();
-			const state = JSON.parse(bodyString);
-			return typeof state.region === "string" ? state.region : void 0;
+			const raw = JSON.parse(bodyString).region;
+			if (!raw) return { kind: "no-region" };
+			if (typeof raw !== "string") {
+				this.logger.debug(`Legacy state probe for '${this.displayName(stackName)}': 'region' is ${typeof raw}, not a string`);
+				return {
+					kind: "unreadable",
+					reason: `its 'region' field is ${typeof raw}, not a string`
+				};
+			}
+			return {
+				kind: "region",
+				region: raw
+			};
 		} catch (error) {
-			if (isNoSuchKey(error)) return void 0;
-			this.logger.debug(`Could not read legacy state region for '${stackName}': ${error instanceof Error ? error.message : String(error)}`);
-			return;
+			if (isNoSuchKey(error)) return { kind: "absent" };
+			const { detail } = describeAwsFailure(error);
+			this.logger.debug(`Could not read legacy state region for '${this.displayName(stackName)}': ${displaySafe(detail, { asciiOnly: true }) || "<unrenderable>"}`);
+			return {
+				kind: "unreadable",
+				reason: displaySafe(error instanceof Error && error.name ? error.name : "an unknown error", { asciiOnly: true }) || "<unrenderable>"
+			};
 		}
 	}
-	async legacyMatchesRegion(stackName, region) {
-		return await this.readLegacyRegion(stackName) === region;
+	/**
+	* The region a legacy record should be listed under, or `undefined` when it
+	* names none / could not be read. Preserves `listStacks`'s behaviour across
+	* the {@link probeLegacyState} split.
+	*/
+	async readLegacyRegion(stackName) {
+		const probe = await this.probeLegacyState(stackName);
+		return probe.kind === "region" ? probe.region : void 0;
+	}
+	/**
+	* Whether an operation targeting `region` owns the legacy record — the
+	* DELETE-side counterpart of `tryGetLegacy`'s read gate, and issue #2550.
+	*
+	* The two must agree. `tryGetLegacy` accepts a body that names NO region
+	* from any region (`if (state.region && state.region !== region)` is false
+	* when the field is absent), so `cdkd destroy` reads such a record, deletes
+	* the AWS resources, and finishes. The old equality test here answered
+	* `undefined === 'us-east-1'` — false — so the record survived a successful
+	* destroy, kept appearing in `cdkd state list`, and the next deploy of that
+	* name planned updates against resources that were gone.
+	*
+	* `unreadable` is deliberately NOT treated as `no-region`: a 403, a 503 or a
+	* malformed body says nothing about who owns the record, and a read that
+	* failed must never authorise a delete. It collapsed into the same
+	* `undefined` as the other two before, which is why the one-line fix — make
+	* `undefined` match — was wrong: it would also have made `stateExists`
+	* report state for a stack that has none, since `absent` reads the same way.
+	*/
+	async legacyBelongsToRegion(stackName, region) {
+		return legacyProbeBelongsTo(await this.probeLegacyState(stackName), region);
 	}
 	/**
 	* Try to read the legacy `version: 1` state. Returns null when the legacy
@@ -9608,6 +9862,99 @@ var LockManager = class {
 /** Fixed marker substituted for a secret value in log / error output. */
 const SECRET_MASK = "***";
 /**
+* The UNCOLLAPSED companion of a {@link RecordedSecretValues} map: for each map
+* instance, every `expression -> plaintext` pair the resolver recorded INTO IT,
+* keyed by EXPRESSION (issue [#2485](https://github.com/go-to-k/cdkd/issues/2485)).
+*
+* WHY IT EXISTS. The map is keyed by PLAINTEXT, so two expressions resolving to
+* one value keep ONE entry — whichever the resolver recorded last. A WHOLE-token
+* leaf is immune (the position pass copies its own source), but a leaf that
+* EMBEDS a token in a literal string is redacted by the value scan, which can
+* only write the map's surviving expression: the versioned sibling's, for a
+* template that spells the un-versioned one, and the next deploy diffs that
+* leaf forever. Recovering the losing expression needs evidence the map has
+* discarded, and it has to be PASS-LOCAL: `recordedSecretExpressions` is
+* process-wide and says only that an expression IS secret, never what it
+* resolved to in THIS resource — so it cannot tell "the source token lost the
+* map slot to its sibling" from "the source token was never resolved here"
+* (a previous generation's bag, where writing today's expression over the
+* framed value would record something that was never deployed).
+*
+* Keyed by the map INSTANCE, so the evidence is exactly as pass-local as the
+* map itself: a map the resolver populated (the deploy's `perResourceSecrets`
+* entry, and equally the map drift / scrub / import hand their own resolution)
+* carries the pairs of THAT resolution, while a map the resolver did not
+* populate — a derived needle map, a nested-stack inheritance copy, a
+* `new Map(secrets)` copy — starts with no entries here and takes the
+* pre-#2485 fall-through, the safe direction. A copy loses the evidence
+* deliberately: a copy is not the pass that resolved anything.
+*
+* `CONFLICTING_PLAINTEXT` marks an expression this map saw resolve to TWO
+* values (a region-pinned re-resolution of one spelling, say); it then vouches
+* for nothing, which is the same "answer nothing you cannot prove" rule
+* {@link plaintextIndexOf} applies to the collapsed map's reverse index.
+*/
+const resolvedPairsOf = /* @__PURE__ */ new WeakMap();
+/**
+* Record that `expression` resolved to `plaintext` in the pass that owns
+* `secrets` — the resolver's recording seam calls this beside its
+* `secrets.set(plaintext, expression)`, so the two never disagree about which
+* pass the evidence belongs to. Mask-only map entries (value `SECRET_MASK`)
+* never pass through that seam — they came from no `{{resolve:...}}` token —
+* so nothing here special-cases the mask string: a secret whose plaintext
+* happens to BE `***` is a secret like any other.
+*/
+function recordResolvedPair(secrets, expression, plaintext) {
+	let pairs = resolvedPairsOf.get(secrets);
+	if (pairs === void 0) {
+		pairs = /* @__PURE__ */ new Map();
+		resolvedPairsOf.set(secrets, pairs);
+	}
+	const previous = pairs.get(expression);
+	if (previous === void 0) pairs.set(expression, plaintext);
+	else if (previous !== plaintext) pairs.set(expression, CONFLICTING_PLAINTEXT);
+}
+/**
+* Carry the resolved pairs of `from` into `to`, for the one copy of a
+* resolver-populated map that POSITIONS anything: the deploy engine accumulates
+* each stack's output resolution into its `outputSecrets` bag entry by entry,
+* and without this the copy would keep the collapsed entries while dropping the
+* evidence — so a literal `Output` embedding one of two same-plaintext
+* references would fall back to the value scan and persist the sibling's
+* expression. The engine's other entry-by-entry copy — an `Export.Name`'s
+* secrets into the pass map — deliberately does NOT call this: a name never
+* positions a leaf, a value re-using the same token records its own pair at
+* the seam, and the only thing the merge could add is a CONFLICT (a
+* non-cacheable `{{resolve:ssm:X}}` whose value moved between the value pass
+* and the name's resolution), which would destroy positioning the value pass
+* had earned. A pair that conflicts across the two maps is marked conflicting
+* in `to`, the same rule {@link recordResolvedPair} applies within one map.
+*
+* Deliberately NOT a general "copy the map" helper: every other new map is a
+* different PASS, and starting it without evidence is the safe direction.
+*/
+function mergeResolvedPairs(from, to) {
+	const pairs = resolvedPairsOf.get(from);
+	if (pairs === void 0) return;
+	for (const [expression, plaintext] of pairs) if (typeof plaintext === "string") recordResolvedPair(to, expression, plaintext);
+	else {
+		let target = resolvedPairsOf.get(to);
+		if (target === void 0) {
+			target = /* @__PURE__ */ new Map();
+			resolvedPairsOf.set(to, target);
+		}
+		target.set(expression, CONFLICTING_PLAINTEXT);
+	}
+}
+/**
+* The plaintext `expression` resolved to in the pass that owns `secrets`, or
+* `undefined` when that pass recorded nothing for it (or two different values).
+*/
+function resolvedPlaintextOf(secrets, expression) {
+	const recorded = resolvedPairsOf.get(secrets)?.get(expression);
+	return typeof recorded === "string" ? recorded : void 0;
+}
+/**
 * Every `{{resolve:...}}` expression this process has PROVEN resolves to a
 * secret, as a SET — uncollapsed by resolved value (issue #1910).
 *
@@ -10618,8 +10965,9 @@ function isKnownSecretExpression(expression, secretExpressions) {
 	return isSecretExpressionByVerdictOrSpelling(expression) || secretExpressions.has(expression);
 }
 /**
-* The two arms of {@link isKnownSecretExpression} that need NO pass-local set:
-* `secretsmanager` by SPELLING, and anything this process PROVED secret.
+* The arms of {@link isKnownSecretExpression} that need NO pass-local set:
+* `secretsmanager` / `ssm-secure` by SPELLING, and anything this process
+* PROVED secret.
 *
 * Split out so the resolver can ask the same question at the issue #2059
 * recording seam, where no `secretExpressions` set is in hand. It must not
@@ -10644,7 +10992,7 @@ function isKnownSecretExpression(expression, secretExpressions) {
 * change to a store this function only reads.
 */
 function isSecretExpressionByVerdictOrSpelling(expression) {
-	return expression.startsWith("{{resolve:secretsmanager:") || isRecordedSecretExpression(expression);
+	return expression.startsWith("{{resolve:secretsmanager:") || expression.startsWith("{{resolve:ssm-secure:") || isRecordedSecretExpression(expression);
 }
 /**
 * The character class a `{{resolve:...}}` reference's INNER text is built from,
@@ -11188,6 +11536,124 @@ function positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions) {
 	return matched;
 }
 /**
+* The ONE-span frame shared by {@link positionByEmbeddedSpan} and
+* {@link learnMixedLeafNeedle}: a source holding exactly one `{{resolve:...}}`
+* token, and a bag that starts with the source's prefix and ends with its
+* suffix with something non-empty between them that is NOT itself a complete
+* token (an already-redacted record is a persisted answer, not a plaintext).
+* `undefined` for any other shape. One helper rather than two copies so the
+* two refusals cannot drift apart.
+*/
+function singleSpanFrame(bag, source) {
+	const spans = dynamicReferenceSpans(source);
+	if (spans.length !== 1) return void 0;
+	const [span] = spans;
+	const token = source.slice(span.start, span.end);
+	const prefix = source.slice(0, span.start);
+	const suffix = source.slice(span.end);
+	if (bag.length <= prefix.length + suffix.length) return void 0;
+	if (!bag.startsWith(prefix) || !bag.endsWith(suffix)) return void 0;
+	const middle = bag.slice(prefix.length, bag.length - suffix.length);
+	if (isSingleDynamicReferenceToken(middle)) return void 0;
+	return {
+		token,
+		prefix,
+		suffix,
+		middle
+	};
+}
+/**
+* Position a literal source leaf that EMBEDS exactly one `{{resolve:...}}`
+* token — `postgres://app-svc:{{resolve:ssm-secure:NAME}}@db/app` — by the
+* span the source states, writing `prefix + token + suffix` (issue
+* [#2485](https://github.com/go-to-k/cdkd/issues/2485)).
+*
+* WHY THE VALUE SCAN IS NOT ENOUGH HERE. The scan writes the map's surviving
+* expression for a plaintext, and the map keeps one expression per plaintext:
+* a whole-value `NAME:1` sibling that resolved LAST leaves `NAME:1` as the only
+* expression for the value, so the embedded leaf persists the versioned
+* spelling for a template that spells `NAME`, and the deploy diff — expression
+* against expression — reports that leaf on every run. The whole-token arm of
+* {@link redactByPath} is immune because it copies its own source; this arm
+* gives the one-span literal leaf the same immunity.
+*
+* THE EVIDENCE, and why the shape of the frame is not enough on its own: the
+* frame check (`bag` starts with the source's prefix and ends with its suffix,
+* with something between) is what {@link learnMixedLeafNeedle} already uses to
+* LEARN a needle, and it proves only that the bag has the source's shape. The
+* bag can also be a PREVIOUS generation's (`cdkd scrub`, a state-sourced walk)
+* with an earlier plaintext framed exactly like this, and writing today's
+* token over it would record an expression that was never deployed at that
+* position — the hazard `sourceIsSameGeneration` exists for on the whole-token
+* arm. So the middle must EQUAL what THIS pass recorded the source token
+* resolving to ({@link recordResolvedPair}, per map instance): that is evidence
+* of this resolution, not of shape, and it is absent by construction for every
+* bag this pass did not produce. It is also what keeps a PUBLIC `ssm` token
+* resolved (issue #1901) — the resolver records only secret verdicts — and what
+* keeps a mask-only `NoEcho` value out (never recorded).
+*
+* WHAT THIS EVIDENCE DOES NOT CLAIM, stated because a reviewer asked: it does
+* not prove the bag was produced FROM this source. A previous generation's bag
+* whose framed middle happens to EQUAL a plaintext this pass resolved the
+* source token to (`cdkd scrub` walking an old record against today's template,
+* or a failed deploy persisting an old bag) takes this arm and persists TODAY's
+* expression at that position. That is not a new claim: the value scan the
+* arm replaces rewrites that same plaintext onto one of THIS pass's expressions
+* regardless of generation — the map holds no other — so the class of answer
+* is unchanged and only the choice within it improves (the source's own
+* token rather than the map's survivor). The generation hazard this arm must
+* not create is the whole-token arm's: a middle that is ALREADY an expression
+* (a persisted answer from another generation), which the token refusal below
+* keeps out — and, by the same argument, any leaf the value scan would NOT
+* rewrite to exactly `prefix + survivor + suffix`: a middle shorter than the
+* scan's needle floor (an embedded 1-3 character secret stays the scan's
+* documented residual — issue #2516 tracks closing it with a bound that
+* proves the bag's generation, which this evidence does not), a whole leaf
+* that is itself another recorded plaintext, a needle starting in the prefix
+* and overlapping the middle. The
+* arm checks that equivalence against the scan's own answer rather than
+* re-deriving the scan's rules. Pinned by the cross-generation cases in
+* `secret-redaction-embedded-span.test.ts`.
+*
+* One shape reaches this arm that a reader may not expect: a WHOLE-token
+* source that FAILED the whole-token arm's `isKnownSecretExpression` gate (an
+* `ssm` token whose type came back unclassifiable and which lost the map slot
+* to a sibling). Its "frame" is empty, and if this pass recorded it resolving
+* to the bag it is written back as itself — an expression, and the leaf's own,
+* where the scan wrote the survivor. Stated so it is not mistaken for a leak.
+*
+* Everything else keeps the pre-#2485 fall-through: two or more spans (which
+* span produced which value is genuinely ambiguous when they share one), an
+* `Fn::Sub` / `Fn::Join` source (an object, not this arm at all — issue #2320's
+* placeholder primitive), a frame mismatch, a middle that is itself a complete
+* token (an already-redacted record, per the same refusal
+* {@link learnMixedLeafNeedle} makes), and a middle this pass cannot vouch for.
+*
+* The frame is copied from the SOURCE, not scanned. A needle occurring in the
+* literal frame would be a reference the template never had at that offset —
+* the fabricated-baseline direction {@link preferPositionDecisions} refuses —
+* and the whole-token arm returns its source unscanned for the same reason.
+*
+* RETURNS THE VALUE SCAN'S ANSWER ON EVERY REFUSAL, not `undefined`: the scan
+* is computed once, here, for `(bag, secrets)` — the arm's bound below compares
+* against it, and every fall-through IS it — so the compared value provably
+* comes from the same bag and map the arm positions. An earlier revision took
+* the scan as a parameter, which left the bound one wrong caller away from
+* comparing against a scan of some other bag with no type error.
+*/
+function positionByEmbeddedSpan(bag, source, secrets) {
+	const scanned = redactSecretsForState(bag, secrets);
+	const frame = singleSpanFrame(bag, source);
+	if (frame === void 0) return scanned;
+	const { token, prefix, suffix, middle } = frame;
+	const recorded = resolvedPlaintextOf(secrets, token);
+	if (recorded === void 0 || recorded !== middle) return scanned;
+	const survivor = secrets.get(middle);
+	if (survivor === void 0) return scanned;
+	if (scanned !== prefix + survivor + suffix) return scanned;
+	return prefix + token + suffix;
+}
+/**
 * Keys tried, in order, when pairing two arrays whose ORDER cannot be trusted
 * (issue #1915).
 *
@@ -11387,7 +11853,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions) {
 			if (!rules.sourceIsSameGeneration && isSingleDynamicReferenceToken(bag)) return secrets.get(bag) ?? bag;
 			return source;
 		}
-		return redactSecretsForState(bag, secrets);
+		return positionByEmbeddedSpan(bag, source, secrets);
 	}
 	if (typeof bag === "string" && isPlainObject$2(source)) {
 		const certified = positionByCrossStackSource(bag, source, secrets);
@@ -11505,12 +11971,13 @@ function subtreeHasDynamicReference(value) {
 * Widening it changes one answer, in the SAFE direction for BOTH readers.
 *
 * `drift.ts`'s `survivingDynamicReferences` is the reader that is easy to
-* forget, because it lives in another file — it feeds `isSecretBySpelling`,
-* so seeing MORE tokens can only mask more, never less. Do not shorten this
-* to "the only reader": that sentence is what a later editor uses to bound
-* the blast radius of touching the class, and getting it wrong points them
-* away from the report / `--json` / `--accept` path where an unmasked
-* `ssm-secure` survivor would surface.
+* forget, because it lives in another file — it feeds the survivor REPORT
+* (`onUnresolved`, and through it the `unresolvedToken` cause), so seeing MORE
+* tokens can only report more, never less. Do not shorten this to "the only
+* reader": that sentence is what a later editor uses to bound the blast
+* radius of touching the class, and getting it wrong points them away from
+* the report / `--json` / `--accept` path where an unreported survivor would
+* surface.
 *
 * The other reader is the DECLARED direction for issue #1901:
 * {@link mixedLeafMayCarryPublicReference}, which asks whether a MIXED leaf
@@ -11916,9 +12383,9 @@ function unkeyedArrayPairsByAnchors(bag, source) {
 * from one the pass decided IN FAVOUR of the value already there. Two shapes
 * hit it, both fabricating a baseline `cdkd drift --revert` then pushes:
 *
-* - the resolver's unsupported-service arm leaves an `{{resolve:ssm-secure:`
-*   token LITERAL, so AWS echoes it back and the source leaf EQUALS the bag
-*   leaf. The string arm returns `source` — a decision — and the equality made
+* - the resolver's unsupported-service arm leaves a `{{resolve:...}}` token it
+*   has no arm for LITERAL (`ssm-secure:` was one until issue #2482), so AWS
+*   echoes it back and the source leaf EQUALS the bag leaf. The string arm returns `source` — a decision — and the equality made
 *   it look like no decision at all. (A BARE such token takes the whole-token
 *   arm and one embedded in text takes the mixed-leaf arm; both decide, and
 *   both were misread.)
@@ -12102,7 +12569,8 @@ function learnWholeTokenNeedle(collector, bag, source) {
 *   would then contain a whole `{{resolve:...}}` token and a resolved readback
 *   cannot end with one. The shape it genuinely decides is a second reference
 *   that survives LITERALLY in the readback — the resolver's
-*   unsupported-service arm (`ssm-secure:`) produces exactly that — where the
+*   unsupported-service arm produces exactly that (`ssm-secure:` did until
+*   issue #2482; a spelling with no arm still does) — where the
 *   extraction would in fact be right and is declined anyway. Measured: a
 *   both-resolved fixture leaves this line unfenced.
 * - the source's literal PREFIX and SUFFIX must both be present at the ends of
@@ -12116,17 +12584,10 @@ function learnWholeTokenNeedle(collector, bag, source) {
 * correctly, while an `indexOf` scan would cut it short.
 */
 function learnMixedLeafNeedle(collector, bag, source) {
-	const spans = dynamicReferenceSpans(source);
-	if (spans.length !== 1) return;
-	const [span] = spans;
-	const token = source.slice(span.start, span.end);
+	const frame = singleSpanFrame(bag, source);
+	if (frame === void 0) return;
+	const { token, middle: plaintext } = frame;
 	if (!expressionMaySeedANeedle(token)) return;
-	const prefix = source.slice(0, span.start);
-	const suffix = source.slice(span.end);
-	if (bag.length <= prefix.length + suffix.length) return;
-	if (!bag.startsWith(prefix) || !bag.endsWith(suffix)) return;
-	const plaintext = bag.slice(prefix.length, bag.length - suffix.length);
-	if (isSingleDynamicReferenceToken(plaintext)) return;
 	learnNeedle(collector, plaintext, token);
 }
 /**
@@ -15382,17 +15843,22 @@ function s3BucketWebsiteUrl(bucketName, region) {
 /**
 * The `{{resolve:<service>:...}}` families whose value can be a SECRET, and
 * therefore the only ones the region question below is asked about: every
-* `secretsmanager` reference by spelling, and every `ssm` one, which is secret
-* exactly when its parameter is a `SecureString` (issue #1901).
-*
-* Every OTHER service is `local` because cdkd cannot resolve it at all, NOT
-* because it is public. `ssm-secure` is the live example and is emphatically
-* not public: `resolveDynamicReferences` has no arm for it, so the literal
-* token is passed through to AWS and CloudFormation resolves it SERVER-side.
-* cdkd never holds its value, so there is no region for cdkd to get wrong —
-* which is the only reason it can be waved through here.
-*/
-const REPLAY_SECRET_SERVICES = /* @__PURE__ */ new Set(["secretsmanager", "ssm"]);
+* `secretsmanager` reference by spelling, every `ssm-secure` one by spelling
+* (issue #2482 — it is resolved through the same `GetParameter` as `ssm`, so
+* the wrong region answers it in exactly the same way), and every `ssm` one,
+* which is secret exactly when its parameter is a `SecureString` (issue #1901).
+*
+* Every OTHER service is `local` because cdkd cannot resolve it at all — the
+* resolver's unsupported-service arm leaves such a token in place, so there
+* is no lookup for a region to get wrong. None of CloudFormation's three
+* services is in that position any more; the arm exists for a spelling that
+* is not a dynamic reference at all, or one AWS adds later.
+*/
+const REPLAY_SECRET_SERVICES = /* @__PURE__ */ new Set([
+	"secretsmanager",
+	"ssm",
+	"ssm-secure"
+]);
 /**
 * Split a `{{resolve:secretsmanager:...}}` inner body into its SECRET_ID.
 *
@@ -15428,7 +15894,7 @@ function secretsManagerSecretId(inner) {
 *    a different thing in the refusal message than the one that would be read.
 */
 function ssmParameterName(inner) {
-	return inner.substring(4);
+	return inner.substring(inner.indexOf(":") + 1);
 }
 /**
 * The region an ARN names, or `undefined` for anything that is not an ARN with
@@ -16155,7 +16621,7 @@ function normalizeAwsTagsToCfn(tags) {
 * through `update()` and surface as a hard AWS rejection, so we sanitize
 * the wire-layer payload while keeping the read-side placeholder
 * intact. This is the Class 2 pattern from
-* `docs/provider-development.md § 3b`.
+* `docs/provider-rules.md#readcurrentstate-for-drift-detection`.
 */
 function sanitizeDescription(value) {
 	if (value === void 0 || value === null) return void 0;
@@ -20488,7 +20954,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		});
 		for (const { fullMatch, inner } of matches) {
 			const service = inner.split(":")[0];
-			const isKnownSecret = service === "secretsmanager" || recordedSecretExpressions.has(fullMatch);
+			const isKnownSecret = service === "secretsmanager" || service === "ssm-secure" || recordedSecretExpressions.has(fullMatch);
 			if (isKnownSecret && context?.skipDynamicReferences) continue;
 			const regionVerdict = classifyReplaySecretRegion(fullMatch, this.explicitRegion ?? this.resolverRegion, context?.producerRegions);
 			if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${fullMatch}: it names '${regionVerdict.secretName}' without a region, and this stack reads from ${regionVerdict.foreignProducerRegions.join(", ")} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
@@ -20499,7 +20965,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 			const cached = this.cachedDynamicReferences.get(fullMatch);
 			if (cached) {
-				if (cached.secret && cached.value) context?.recordedSecretValues?.set(cached.value, fullMatch);
+				if (cached.secret && cached.value) {
+					context?.recordedSecretValues?.set(cached.value, fullMatch);
+					if (context?.recordedSecretValues) recordResolvedPair(context.recordedSecretValues, fullMatch, cached.value);
+				}
 				result = result.replace(fullMatch, () => cached.value);
 				continue;
 			}
@@ -20531,6 +21000,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					if (!decrypt) continue;
 				}
 				resolved = param.value;
+			} else if (service === "ssm-secure") {
+				const param = await this.resolveSSMReference(parts, true, "ssm-secure");
+				if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${fullMatch}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
+				isSecret = true;
+				resolved = param.value;
 			} else {
 				this.logger.warn(`Unsupported dynamic reference service: ${service}`);
 				continue;
@@ -20541,7 +21015,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			});
 			if (isSecret && resolved) {
 				context?.recordedSecretValues?.set(resolved, fullMatch);
-				if (service === "secretsmanager") this.pinSecretVerdict(fullMatch, true);
+				if (context?.recordedSecretValues) recordResolvedPair(context.recordedSecretValues, fullMatch, resolved);
+				if (service === "secretsmanager" || service === "ssm-secure") this.pinSecretVerdict(fullMatch, true);
 			}
 			result = result.replace(fullMatch, () => resolved);
 		}
@@ -20751,16 +21226,16 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* discard the value when `secure` is set — it is ciphertext, not the resolved
 	* reference.
 	*/
-	async resolveSSMReference(parts, decrypt = true) {
+	async resolveSSMReference(parts, decrypt = true, service = "ssm") {
 		const parameterName = parts.slice(1).join(":");
-		if (!parameterName) throw new Error("Dynamic reference: ssm PARAMETER_NAME is required");
-		this.logger.debug(`Resolving dynamic reference: ssm:${parameterName}`);
+		if (!parameterName) throw new Error(`Dynamic reference: ${service} PARAMETER_NAME is required`);
+		this.logger.debug(`Resolving dynamic reference: ${service}:${parameterName}`);
 		const client = this.clientsForRegion(this.explicitRegion).ssm;
 		const command = new GetParameterCommand({
 			Name: parameterName,
 			WithDecryption: decrypt
 		});
-		const response = await this.sendWithThrottleRetry(() => client.send(command), `ssm:${parameterName}`);
+		const response = await this.sendWithThrottleRetry(() => client.send(command), `${service}:${parameterName}`);
 		const paramValue = response.Parameter?.Value;
 		if (paramValue === void 0 || paramValue === null) throw new Error(`Dynamic reference: SSM parameter '${parameterName}' not found or has no value`);
 		const paramType = response.Parameter?.Type;
@@ -20768,7 +21243,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (secure && paramType !== "SecureString" && !this.warnedUnrecognizedSsmTypes.has(`${parameterName}\u0000${String(paramType)}`)) {
 			this.warnedUnrecognizedSsmTypes.add(`${parameterName}\u0000${String(paramType)}`);
 			const reported = paramType === void 0 ? "(absent)" : `'${String(paramType)}'`;
-			this.logger.warn(`SSM parameter '${parameterName}' reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:ssm:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`);
+			this.logger.warn(`SSM parameter '${parameterName}' reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:${service}:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`);
 		}
 		return {
 			value: paramValue,
@@ -21903,7 +22378,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DcFgnQQO.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CKEf903K.js").then((n) => n.n);
 			return withIndeterminateGuard(await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -23088,42 +23563,6 @@ function interruptWatchListenerCount() {
 	return sharedSigintHandler === void 0 ? 0 : 1;
 }
 
-//#endregion
-//#region src/state/state-prefix.ts
-/**
-* The default S3 key prefix for cdkd state.
-*
-* Homed in the STATE layer rather than in `src/cli/commands/state-file-keys.ts`
-* (which re-exports it, so its four existing importers are unchanged) because
-* `src/state/lock-contention-message.ts` needs it to decide whether a recovery
-* hint should spell `--state-prefix` at all, and a `src/state/**` module
-* importing from `src/cli/commands/**` inverts the layering — the CLI sits
-* ABOVE the state layer in the 7-layer architecture, not below it.
-*
-* Note this is only the DEFAULT. Other commands accept `--state-prefix`, so
-* whole-bucket listings deliberately do not scope to it.
-*/
-const DEFAULT_STATE_PREFIX = "cdkd";
-/**
-* The state-bucket prefix `CustomResourceProvider` PUTs its response
-* placeholders under, one object per invocation
-* (`custom-resource-responses/{requestId}.json`).
-*
-* Homed here for the same layering reason as {@link DEFAULT_STATE_PREFIX}: the
-* PRODUCER is `src/provisioning/providers/custom-resource-provider.ts` and the
-* COLLECTOR is `src/cli/commands/gc.ts`, so a copy in either would be a copy
-* the other could drift from — and the two spellings would then disagree about
-* which objects exist, which is the only way a sweeper can miss the family it
-* was written for (issue #2052). `src/cli/commands/state-file-keys.ts`
-* re-exports it so gc reads it alongside the other state-key constants.
-*
-* Note this is only the DEFAULT: `ProviderRegistry` can be configured with a
-* different `responsePrefix`, so a sweep scoped to this value is a sweep of the
-* default layout. gc has no access to a non-default one — nothing persists it —
-* which is stated at the sweep's own call site rather than implied here.
-*/
-const CUSTOM_RESOURCE_RESPONSE_PREFIX = "custom-resource-responses";
-
 //#endregion
 //#region src/provisioning/masked-retry-logger.ts
 /**
@@ -27724,7 +28163,7 @@ function isCustomResource(resourceType) {
 * live value on removal. Route every optional mutable field of a
 * merge-semantics API through this helper, with `clearValue` set to the
 * property's CFn default or the SDK-documented clear sentinel — see
-* docs/provider-development.md §2a for the per-field checklist.
+* docs/provider-rules.md#update-removal-semantics-clear-on-removal for the per-field checklist.
 *
 * Returns `newValue` when present, the `clearValue` when the field was
 * present before and is now absent (removal), and `undefined` when it was
@@ -28741,9 +29180,16 @@ function formatResourceLine(op, logicalId, resourceType, verbOverride) {
 *
 * To avoid an accidental data-loss footgun, cdkd refuses to recreate
 * any resource whose type is in {@link STATEFUL_TYPES} unless the user
-* ALSO passes `--force-stateful-recreation`. The two-flag protection
-* mirrors `--remove-protection`'s pattern (see
-* `src/cli/commands/destroy-runner.ts`).
+* ALSO passes `--force-stateful-recreation`. On the `--recreate-via-*`
+* and `--replace` opt-ins that is a two-flag protection, mirroring
+* `--remove-protection`'s pattern (see
+* `src/cli/commands/destroy-runner.ts`). It is NOT only that shape any
+* more: the guard also runs on replacement paths a plain `cdkd deploy`
+* reaches with no flag at all (a property-driven replacement, and the
+* update-failure fallback's Cloud Control trigger — issue [#2514]),
+* where `--force-stateful-recreation` is the ONLY flag involved. See
+* {@link isStatefulRecreateTargetForReplace} for the mid-deploy variant
+* those paths use.
 *
 * The list is hand-curated and intentionally **conservative**: every
 * type here carries user data that the AWS service does NOT
@@ -28751,18 +29197,59 @@ function formatResourceLine(op, logicalId, resourceType, verbOverride) {
 * AWS service treats as ephemeral (e.g. Lambda Function, IAM Role)
 * are NOT in this list — recreate is cheap.
 *
-* Two entries are **conditionally stateful** — they only count when
-* the resource actually contains data:
+* Two entries carry a CONDITION instead of counting unconditionally.
+* The condition is what the guard evaluates; failing it is not a
+* finding that the resource holds no data (see the LogGroup note):
 *
 *   - `AWS::S3::Bucket`: empty buckets are safe to recreate. The
-*     deploy engine probes `s3:ListObjectsV2` at plan time and only
+*     deploy engine probes `s3:ListObjectVersions` at plan time and only
 *     refuses when the bucket has at least one object.
-*   - `AWS::Logs::LogGroup`: a log group with `RetentionInDays`
-*     undefined or zero is functionally ephemeral. The deploy engine
-*     refuses only when `RetentionInDays > 0`.
+*   - `AWS::Logs::LogGroup`: the deploy engine refuses only when
+*     `RetentionInDays > 0`. NOTE this is a KNOWN GAP, not a statement
+*     that the rest are empty: an unset or zero retention is CloudWatch
+*     Logs' "never expire", the most data-bearing setting there is, and
+*     `LogsLogGroupProvider` writes `0` for precisely that. Issue
+*     [#2558] tracks it; the predicate is left as-is here.
 *
 * Both conditional checks live in {@link isStatefulRecreateTarget};
 * the bare {@link STATEFUL_TYPES} set is the type-only first-cut.
+*
+* **Lower bound, enforced by a test** (issue [#2514]'s review round):
+* every type in `final-snapshot.ts`'s `ATOMIC_FINAL_SNAPSHOT_TYPES` ∪
+* `PRE_DELETE_SNAPSHOT_TYPES` must appear here. That union is the
+* CloudFormation-documented `DeletionPolicy: Snapshot`-capable list, and
+* CloudFormation permits the attribute exactly where deleting the resource
+* destroys data worth capturing first — so membership there is an
+* AWS-authored statement that the type is data-bearing. The types that were
+* in that union and NOT here (`AWS::Redshift::Cluster`,
+* `AWS::ElastiCache::ReplicationGroup`, `AWS::ElastiCache::CacheCluster`)
+* meant cdkd took a final snapshot before a `cdkd destroy` of them
+* while replacing them mid-deploy with no consent flag at all.
+* `tests/unit/provisioning/stateful-types.test.ts` pins the subset
+* relation so a future addition to either snapshot set cannot land without
+* the guard entry.
+*
+* The relation is deliberately ONE-directional: most data-bearing types
+* (S3, DynamoDB, LogGroup, ECR, …) have no snapshot API at all and
+* CloudFormation rejects `DeletionPolicy: Snapshot` on them, so this set is
+* a strict superset and the reverse containment would be wrong.
+*
+* **Second lower bound, also enforced by a test**: every resource type
+* registered to a provider whose `delete()` consults
+* `DeleteContext.forceDataDelete` must appear here. That field is set ONLY
+* by the replacement / recreate delete sites under
+* `--force-stateful-recreation`, so a provider reading it has already
+* declared its delete destroys user data — which makes the guard list's
+* agreement checkable rather than hand-curated.
+* `AWS::S3Express::DirectoryBucket` was the one type on the wrong side.
+*
+* Neither fence can see a provider whose delete destroys data with NO opt-in
+* at all — an unconditional empty (`S3TablesProvider.deleteTableBucket`,
+* `S3VectorsProvider.deleteVectorBucket`) or a plainly destructive API call
+* (`KMSProvider`'s `ScheduleKeyDeletion`,
+* `CodeCommitRepositoryProvider`'s `DeleteRepository`). Those types are
+* hand-added with the reason at the entry, and a provider added that way
+* should be reviewed for whether it wants a `forceDataDelete` gate too.
 */
 const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 	"AWS::RDS::DBInstance",
@@ -28773,17 +29260,29 @@ const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 	"AWS::Neptune::DBCluster",
 	"AWS::DynamoDB::Table",
 	"AWS::DynamoDB::GlobalTable",
+	"AWS::Redshift::Cluster",
+	"AWS::ElastiCache::CacheCluster",
+	"AWS::ElastiCache::ReplicationGroup",
 	"AWS::EFS::FileSystem",
 	"AWS::FSx::FileSystem",
 	"AWS::S3::Bucket",
+	"AWS::S3Express::DirectoryBucket",
+	"AWS::S3Tables::TableBucket",
+	"AWS::S3Tables::Table",
+	"AWS::S3Tables::Namespace",
+	"AWS::S3Vectors::VectorBucket",
 	"AWS::ECR::Repository",
 	"AWS::EC2::Volume",
+	"AWS::EMR::Cluster",
 	"AWS::Kinesis::Stream",
 	"AWS::Elasticsearch::Domain",
 	"AWS::OpenSearchService::Domain",
 	"AWS::Cognito::UserPool",
 	"AWS::SecretsManager::Secret",
 	"AWS::SSM::Parameter",
+	"AWS::KMS::Key",
+	"AWS::KMS::ReplicaKey",
+	"AWS::CodeCommit::Repository",
 	"AWS::Glue::Database",
 	"AWS::Glue::Table",
 	"AWS::Logs::LogGroup",
@@ -28804,7 +29303,7 @@ const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 const MULTI_REGION_RECREATE_BLOCKED_TYPES = /* @__PURE__ */ new Set(["AWS::DynamoDB::GlobalTable"]);
 /**
 * Cheap, synchronous read of the resource's recorded properties only.
-* For `AWS::S3::Bucket` this returns `null` — the live `ListObjectsV2`
+* For `AWS::S3::Bucket` this returns `null` — the live `ListObjectVersions`
 * probe to distinguish empty buckets (safe to recreate) from
 * non-empty (data loss) lives in
 * `src/deployment/recreate-targets.ts#probeStatefulRecreateTargetsAsync`
@@ -28827,17 +29326,26 @@ function isStatefulRecreateTargetSync(resourceType, recordedProperties) {
 	return "always";
 }
 /**
-* Conservative variant for the `cdkd deploy --replace` mid-deploy guard.
+* Conservative variant for the deploy engine's mid-deploy guard sites, which
+* between them serve the paths below — only one of which is reached by a flag:
 *
-* `--replace` catches a provider's immutable-update rejection while the deploy
-* is already in flight, so — unlike the `--recreate-via-*` pre-flight, which
+*   - property-driven replacement (an immutable / createOnly property changed
+*     in the template) — fires on a plain `cdkd deploy`, no flag;
+*   - the update-failure fallback's Cloud Control trigger (an
+*     `UnsupportedActionException` / "does not support UPDATE" rejection) —
+*     also no flag (issue [#2514]);
+*   - the same fallback's `--replace` trigger (an SDK provider's typed
+*     `ResourceUpdateNotSupportedError`).
+*
+* All of them catch the rejection or classify the diff while the deploy is
+* already in flight, so — unlike the `--recreate-via-*` pre-flight, which
 * runs {@link probeStatefulRecreateTargetsAsync} (`s3:ListObjectVersions`) —
 * there is no opportunity to probe an `AWS::S3::Bucket`'s object count. The
 * sync check returns `null` for S3 (it defers to that async probe), which would
 * let a NON-EMPTY bucket be DELETE + CREATEd (data loss) without
 * `--force-stateful-recreation`. To stay fail-safe, treat a deferred S3 bucket
 * as stateful here: the user must pass `--force-stateful-recreation` to replace
-* ANY S3 bucket via `--replace`, empty or not. Every other type matches
+* ANY S3 bucket on any of those paths, empty or not. Every other type matches
 * {@link isStatefulRecreateTargetSync} exactly (the LogGroup retention check is
 * fully resolvable from recorded properties, so no conservatism is needed there).
 */
@@ -30818,7 +31326,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				refuseMaskedReplayBaseline(resolvedPrevProps, op.logicalId);
 				recordNestedStackParameterExpressions(secrets, op.resourceType, resolvedPrevProps, prev.properties, STATE_DERIVED_RULES);
 				logger.info(`  Rollback: Reversing replacement of ${op.logicalId} (${op.resourceType}) — re-creating the old resource and deleting the new one`);
-				if (STATEFUL_TYPES.has(op.resourceType)) logger.warn(`  ⚠ ${op.logicalId} (${op.resourceType}) is a stateful type — the old physical resource's data was destroyed by the replacement and CANNOT be recovered; the re-created resource starts empty.`);
+				if (STATEFUL_TYPES.has(op.resourceType)) logger.warn(`  ⚠ ${op.logicalId} (${op.resourceType}) is a stateful type — the old physical resource's data was destroyed by the replacement and is NOT recovered by this rollback; the re-created resource starts empty.`);
 				const { provider: createProvider } = ctx.providerRegistry.getProviderFor({
 					resourceType: op.resourceType,
 					provisionedBy: prev.provisionedBy
@@ -33385,7 +33893,7 @@ var DeployEngine = class {
 						const statefulReason = isStatefulRecreateTargetForReplace(resourceType, currentProps);
 						if (statefulReason && this.options.forceStatefulRecreation !== true) {
 							const immutableProps = change.propertyChanges?.filter((pc) => pc.requiresReplacement).map((pc) => pc.path).join(", ");
-							throw new CdkdError(`${logicalId} (${resourceType}) requires replacement (immutable property changed: ${immutableProps}) but it is a stateful resource — ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.`, "STATEFUL_REPLACE_BLOCKED");
+							throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement (immutable property changed: ${immutableProps}) but it is a stateful resource — ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.`, "STATEFUL_REPLACE_BLOCKED"));
 						}
 					}
 					let replacementReason;
@@ -33528,9 +34036,10 @@ var DeployEngine = class {
 						const ccUnsupported = msg.includes("UnsupportedActionException") || msg.includes("does not support UPDATE");
 						const replaceOptIn = updateError instanceof ResourceUpdateNotSupportedError && this.options.replace === true;
 						if (ccUnsupported || replaceOptIn) {
-							if (replaceOptIn) {
-								const statefulReason = isStatefulRecreateTargetForReplace(resourceType, currentProps);
-								if (statefulReason && this.options.forceStatefulRecreation !== true) throw new CdkdError(`--replace would DELETE + CREATE the stateful resource ${logicalId} (${resourceType}) — ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.`, "STATEFUL_REPLACE_BLOCKED");
+							const statefulReason = isStatefulRecreateTargetForReplace(resourceType, currentProps);
+							if (statefulReason && this.options.forceStatefulRecreation !== true) {
+								const retainNote = updateReplacePolicy === "Retain" ? " Note: UpdateReplacePolicy: Retain does NOT protect this path — the replacement deletes the old resource regardless." : "";
+								throw markNonRetryable(new CdkdError((replaceOptIn ? `--replace would DELETE + CREATE the stateful resource ${logicalId} (${resourceType}) — ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.` : `${logicalId} (${resourceType}) cannot be updated in place by the provisioning layer it routes through, so applying this change would DELETE + CREATE it — but it is a stateful resource: ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the update.`) + retainNote, "STATEFUL_REPLACE_BLOCKED", updateError instanceof Error ? updateError : void 0));
 							}
 							this.logger.info(`UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE → CREATE)`);
 							const fallbackFinalSnapshotId = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, template?.Resources?.[logicalId]?.UpdateReplacePolicy ?? currentResource.updateReplacePolicy);
@@ -34007,7 +34516,10 @@ var DeployEngine = class {
 			}
 			outputsPassCompleted = true;
 		} finally {
-			if (context.recordedSecretValues) for (const [value, expr] of context.recordedSecretValues) this.outputSecrets.set(value, expr);
+			if (context.recordedSecretValues) {
+				for (const [value, expr] of context.recordedSecretValues) this.outputSecrets.set(value, expr);
+				mergeResolvedPairs(context.recordedSecretValues, this.outputSecrets);
+			}
 			if (!outputsPassCompleted) this.outputsSourceUsable = false;
 		}
 		for (const [outputKey, output] of Object.entries(template.Outputs)) {
@@ -34028,5 +34540,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { DEFAULT_STATE_PREFIX as $, resolveUseCdkBootstrapAssets as $n, __exportAll as $r, isSingleDynamicReferenceToken as $t, bold as A, validateAssetBucketName as An, LocalStartServiceError as Ar, requireConfigObject as At, secretBearingStateKeyWarning as B, runDockerStreaming as Bn, StateError as Br, DiffCalculator as Bt, unsupportedFinalSnapshotError as C, BOOTSTRAP_MARKER_PREFIX as Cn, ConfigError as Cr, assertRegionMatch as Ct, isStatefulRecreateTargetSync as D, isCrossRegionRedirect as Dn, DynamicReferenceRegionAmbiguousError as Dr, readConfigString as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, getBootstrapMarkerKey as En, DeployCancelledError as Er, configStringRefusal as Et, yellow as F, dockerSpawnEnvWithSensitive as Fn, ProvisioningError as Fr, s3BucketDomainName as Ft, clearOnUpdateRemoval as G, getDefaultStateBucketName as Gn, withErrorHandling as Gr, TemplateParser as Gt, getCurrentResourceSecrets as H, getDockerImageBySourceHash as Hn, formatError as Hr, describeTypeWithThrottleRetry as Ht, collectDeclaredOutputNames as I, formatDockerLoginError as In, ResourceTimeoutError as Ir, s3BucketDualStackDomainName as It, findSilentDropProperties as J, resolveAutoAssetStorage as Jn, isThrottlingError as Jr, TEMPLATE_SOURCED_RULES as Jt, ProviderRegistry as K, getLegacyStateBucketName as Kn, isMarkedNonRetryable as Kr, STATE_SOURCED_CROSS_GENERATION_RULES as Kt, collectPublishedOutputNames as L, getDockerCmd as Ln, ResourceUpdateNotSupportedError as Lr, s3BucketRegionalDomainName as Lt, gray as M, buildDenyExternalAccessPolicy as Mn, MissingCdkCliError as Mr, classifyReplaySecretRegion as Mt, green as N, describeAwsFailure as Nn, NestedStackChildDirectDestroyError as Nr, producerRegionsFromState as Nt, renderStatefulReason as O, parseBootstrapMarker as On, LocalInvokeBuildError as Or, replayWarn as Ot, red as P, buildDockerImage as Pn, PartialFailureError as Pr, s3BucketArn as Pt, CUSTOM_RESOURCE_RESPONSE_PREFIX as Q, resolveStateBucketWithDefaultAndSource as Qn, retryClassificationText as Qr, errorCauseChain as Qt, exportAliasCollisionScrubWarning as R, partitionSensitiveEnv as Rn, StackHasActiveImportsError as Rr, s3BucketWebsiteUrl as Rt, refusesFinalSnapshot as S, AssetModeResolver as Sn, CdkdError as Sr, resolveExplicitPhysicalId as St, extractDeploymentEventError as T, ensureAssetStorage as Tn, DependencyError as Tr, configBooleanRefusal as Tt, IAMRoleProvider as U, Synthesizer as Un, isCdkdError as Ur, withRetry as Ut, stateKeySecretExposure as V, AssetManifestLoader as Vn, SynthesisError as Vr, INTRINSIC_KEYS as Vt, collectInlinePolicyNamesManagedBySiblings as W, synthesisStatusMessage as Wn, normalizeAwsError as Wr, DagBuilder as Wt, maskDeep as X, resolveSkipPrefix as Xn, markNonRetryable as Xr, createSecretMasker as Xt, createMaskedRetryLogger as Y, resolveCaptureObservedState as Yn, isTransientServerError as Yr, carriesSecretMask as Yt, maskerOrIdentity as Z, resolveStateBucketWithDefault as Zn, markRedactedCause as Zr, dynamicReferenceTokens as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, createAssetRedirectResolver as _n, AwsClients as _r, isUnboundTemplateParameter as _t, DeploymentEventsStore as a, scrubResourceRecord as an, findLargeInlineResources as ar, CloudControlProvider as at, createPreDeleteFinalSnapshot as b, escapeRegExp$1 as bn, setAwsClients as br, WAFv2WebACLProvider as bt, replayFailedOperations as c, rebuildClientForBucketRegion as cn, displaySafe as cr, deleteIndeterminateGuards as ct, updatePartialReason as d, importableOutputs as dn, canonicalizeRegion as dr, isTerminationProtectionPropagationError as dt, maskSecretsInError as en, stateBucketExistenceConfirmed as er, beginCommandInterruptScope as et, withResourceDeadline as f, shouldRetainResource as fn, derivePartitionAndUrlSuffix as fr, IntrinsicFunctionResolver as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, buildAssetRedirectMap as gn, resolveBucketRegion as gr, getAccountInfo as gt, computeImplicitDeleteEdges as h, WorkGraph as hn, clearBucketRegionCache as hr, coerceParameterTypedValue as ht, DeploymentEventsReader as i, redactSecretsForState as in, MIGRATE_TMP_PREFIX as ir, startInterruptWatch as it, cyan as j, validateContainerRepoName as jn, LockError as jr, requireConfigString as jt, formatResourceLine as k, readBootstrapMarkerBody as kn, LocalMigrateError as kr, requireConfigArray as kt, replayRollback as l, exportNamesCarriedFrom as ln, expectedOwnerParam as lr, deleteSkipReason as lt, IMPLICIT_DELETE_DEPENDENCIES as m, stringifyValue as mn, processStackMessages as mr, cfnRefValueFromPhysicalId as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, recordMaskOnlyValue as nn, CFN_TEMPLATE_BODY_LIMIT as nr, interruptWatchListenerCount as nt, planFailedOps as o, LockManager as on, uploadCfnTemplate as or, slowCcOperationTimeoutMs as ot, maskingRetryLogger as p, AssetPublisher as pn, AssemblyReader as pr, carriesDynamicReference as pt, findActionableSilentDrops as q, resolveApp as qn, isRetryableTransientError as qr, STATE_SOURCED_READBACK_RULES as qt, DeployEngine as r, recoverMaskedOutput as rn, CFN_TEMPLATE_URL_LIMIT as rr, isInterruptedWaitError as rt, planRollback as s, S3StateBackend as sn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as sr, UNSPECIFIED_SKIP_REASON as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, maskSecretsInText as tn, warnDeprecatedNoPrefixCliFlag as tr, endCommandInterruptScope as tt, updatePartialMessage as u, importableOutputKeys as un, PARTITION_TABLE as ur, disableInstanceApiTermination as ut, buildFinalSnapshotIdentifier as v, loadPublishableAssetManifest as vn, getAwsClients as vr, parameterTypeMayLoseSecretIdentity as vt, makeCanonicalizePropertiesFn as w, assertAssetBucketRegion as wn, CrossAccountSecretRefusalError as wr, coerceCfnBoolean as wt, isFinalSnapshotError as x, stripControlChars as xn, AssetError as xr, normalizeAwsTagsToCfn as xt, ccRoutedFinalSnapshotError as y, rewriteTemplateAssetReferences as yn, resetAwsClients as yr, refStateLookupFromResource as yt, isExportAliasCollision as z, runDockerForeground as zn, StackTerminationProtectionError as zr, applyRoleArnIfSet as zt };
-//# sourceMappingURL=deploy-engine-DhMm2M33.js.map
+export { endCommandInterruptScope as $, resolveCaptureObservedState as $n, isThrottlingError as $r, maskSecretsInText as $t, bold as A, getBootstrapMarkerKey as An, DeployCancelledError as Ar, classifyReplaySecretRegion as At, secretBearingStateKeyWarning as B, formatDockerLoginError as Bn, ProvisioningError as Br, describeTypeWithThrottleRetry as Bt, unsupportedFinalSnapshotError as C, rewriteTemplateAssetReferences as Cn, resetAwsClients as Cr, configBooleanRefusal as Ct, isStatefulRecreateTargetSync as D, BOOTSTRAP_MARKER_PREFIX as Dn, ConfigError as Dr, requireConfigArray as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, AssetModeResolver as En, CdkdError as Er, replayWarn as Et, yellow as F, validateContainerRepoName as Fn, LocalStartServiceError as Fr, s3BucketRegionalDomainName as Ft, clearOnUpdateRemoval as G, AssetManifestLoader as Gn, StateError as Gr, STATE_SOURCED_READBACK_RULES as Gt, getCurrentResourceSecrets as H, partitionSensitiveEnv as Hn, ResourceUpdateNotSupportedError as Hr, DagBuilder as Ht, collectDeclaredOutputNames as I, buildDenyExternalAccessPolicy as In, LockError as Ir, s3BucketWebsiteUrl as It, findSilentDropProperties as J, synthesisStatusMessage as Jn, isCdkdError as Jr, createSecretMasker as Jt, ProviderRegistry as K, getDockerImageBySourceHash as Kn, SynthesisError as Kr, TEMPLATE_SOURCED_RULES as Kt, collectPublishedOutputNames as L, describeAwsFailure as Ln, MissingCdkCliError as Lr, applyRoleArnIfSet as Lt, gray as M, parseBootstrapMarker as Mn, IntrinsicResolutionRefusalError as Mr, s3BucketArn as Mt, green as N, readBootstrapMarkerBody as Nn, LocalInvokeBuildError as Nr, s3BucketDomainName as Nt, renderStatefulReason as O, assertAssetBucketRegion as On, CrossAccountSecretRefusalError as Or, requireConfigObject as Ot, red as P, validateAssetBucketName as Pn, LocalMigrateError as Pr, s3BucketDualStackDomainName as Pt, beginCommandInterruptScope as Q, resolveAutoAssetStorage as Qn, isRetryableTransientError as Qr, maskSecretsInError as Qt, exportAliasCollisionScrubWarning as R, buildDockerImage as Rn, NestedStackChildDirectDestroyError as Rr, DiffCalculator as Rt, refusesFinalSnapshot as S, loadPublishableAssetManifest as Sn, getAwsClients as Sr, coerceCfnBoolean as St, extractDeploymentEventError as T, stripControlChars as Tn, AssetError as Tr, readConfigString as Tt, IAMRoleProvider as U, runDockerForeground as Un, StackHasActiveImportsError as Ur, TemplateParser as Ut, stateKeySecretExposure as V, getDockerCmd as Vn, ResourceTimeoutError as Vr, withRetry as Vt, collectInlinePolicyNamesManagedBySiblings as W, runDockerStreaming as Wn, StackTerminationProtectionError as Wr, STATE_SOURCED_CROSS_GENERATION_RULES as Wt, maskDeep as X, getLegacyStateBucketName as Xn, withErrorHandling as Xr, errorCauseChain as Xt, createMaskedRetryLogger as Y, getDefaultStateBucketName as Yn, normalizeAwsError as Yr, dynamicReferenceTokens as Yt, maskerOrIdentity as Z, resolveApp as Zn, isMarkedNonRetryable as Zr, isSingleDynamicReferenceToken as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, AssetPublisher as _n, AssemblyReader as _r, refStateLookupFromResource as _t, DeploymentEventsStore as a, S3StateBackend as an, warnDeprecatedNoPrefixCliFlag as ar, UNSPECIFIED_SKIP_REASON as at, createPreDeleteFinalSnapshot as b, buildAssetRedirectMap as bn, resolveBucketRegion as br, resolveExplicitPhysicalId as bt, replayFailedOperations as c, buildForceUnlockCommand as cn, MIGRATE_TMP_PREFIX as cr, disableInstanceApiTermination as ct, updatePartialReason as d, CUSTOM_RESOURCE_RESPONSE_PREFIX as dn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as dr, carriesDynamicReference as dt, isTransientServerError as ei, recordMaskOnlyValue as en, resolveSkipPrefix as er, interruptWatchListenerCount as et, withResourceDeadline as f, DEFAULT_STATE_PREFIX as fn, displaySafe as fr, cfnRefValueFromPhysicalId as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, shouldRetainResource as gn, derivePartitionAndUrlSuffix as gr, parameterTypeMayLoseSecretIdentity as gt, computeImplicitDeleteEdges as h, importableOutputs as hn, canonicalizeRegion as hr, isUnboundTemplateParameter as ht, DeploymentEventsReader as i, __exportAll as ii, LockManager as in, stateBucketExistenceConfirmed as ir, slowCcOperationTimeoutMs as it, cyan as j, isCrossRegionRedirect as jn, DynamicReferenceRegionAmbiguousError as jr, producerRegionsFromState as jt, formatResourceLine as k, ensureAssetStorage as kn, DependencyError as kr, requireConfigString as kt, replayRollback as l, buildLockContentionMessage as ln, findLargeInlineResources as lr, isTerminationProtectionPropagationError as lt, IMPLICIT_DELETE_DEPENDENCIES as m, importableOutputKeys as mn, PARTITION_TABLE as mr, getAccountInfo as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, markRedactedCause as ni, redactSecretsForState as nn, resolveStateBucketWithDefaultAndSource as nr, startInterruptWatch as nt, planFailedOps as o, rebuildClientForBucketRegion as on, CFN_TEMPLATE_BODY_LIMIT as or, deleteIndeterminateGuards as ot, maskingRetryLogger as p, exportNamesCarriedFrom as pn, expectedOwnerParam as pr, coerceParameterTypedValue as pt, findActionableSilentDrops as q, Synthesizer as qn, formatError as qr, carriesSecretMask as qt, DeployEngine as r, retryClassificationText as ri, scrubResourceRecord as rn, resolveUseCdkBootstrapAssets as rr, CloudControlProvider as rt, planRollback as s, UNRENDERABLE as sn, CFN_TEMPLATE_URL_LIMIT as sr, deleteSkipReason as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, markNonRetryable as ti, recoverMaskedOutput as tn, resolveStateBucketWithDefault as tr, isInterruptedWaitError as tt, updatePartialMessage as u, forceQuitRecoveryClause as un, uploadCfnTemplate as ur, IntrinsicFunctionResolver as ut, buildFinalSnapshotIdentifier as v, stringifyValue as vn, processStackMessages as vr, WAFv2WebACLProvider as vt, makeCanonicalizePropertiesFn as w, escapeRegExp$1 as wn, setAwsClients as wr, configStringRefusal as wt, isFinalSnapshotError as x, createAssetRedirectResolver as xn, AwsClients as xr, assertRegionMatch as xt, ccRoutedFinalSnapshotError as y, WorkGraph as yn, clearBucketRegionCache as yr, normalizeAwsTagsToCfn as yt, isExportAliasCollision as z, dockerSpawnEnvWithSensitive as zn, PartialFailureError as zr, INTRINSIC_KEYS as zt };
+//# sourceMappingURL=deploy-engine-DPh-XamZ.js.map