@go-to-k/cdkd 0.285.3 → 0.285.5

package/dist/{deploy-engine-3lJaFGjA.js → deploy-engine-CSBoL-Az.js}

@@ -1,6 +1,6 @@
 import { d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, m as looksLikeCdkdGeneratedName, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, u as applyDefaultNameForFallback } from "./logger-Dz3Le2Pw.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-B4YqJKXh.js";
+import { t as getCdkdVersion } from "./version-neBHYAq9.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -11096,22 +11096,35 @@ function dynamicReferenceSpans(value) {
 * a MIXED leaf than to a whole token on the identical source, and that
 * inconsistency is what persisted a decrypted secret.
 *
-* ACCEPTED CONSEQUENCE, recorded rather than papered over: on the empty-map
-* paths a genuinely PUBLIC ssm mixed leaf is now OVER-redacted, so the baseline
-* no longer matches AWS and `cdkd drift` reports a phantom on it. That is
-* reachable only through the one documented hole in the premise above — `cdkd
-* import`'s warn path, which can leave a public expression in state. The trade
-* is deliberate and asymmetric: under-redaction persists a decrypted secret,
-* which is a disclosure and is what this lane exists to prevent, while
-* over-redaction is visible, recoverable and discloses nothing. Closing it
-* properly needs a real TYPE classification on these paths, which is issue
-* [#2012](https://github.com/go-to-k/cdkd/issues/2012)'s mechanism; the
-* over-redaction itself is tracked as issue
-* [#2036](https://github.com/go-to-k/cdkd/issues/2036).
-*
-* `tests/integration/secrets-dynamic-ref` is the end-to-end proof on BOTH
-* paths, and it is the only place the empty-map defect surfaced: Phase 1g
-* covers the populated-map deploy and Phase 1f the empty-map command.
+* NOT CLOSED here. Issue
+* [#2036](https://github.com/go-to-k/cdkd/issues/2036) tracks the price this
+* refusal pays: a genuinely PUBLIC ssm mixed leaf is OVER-redacted on the
+* empty-map paths, so the baseline no longer matches AWS. Giving the empty-map
+* path POSITIVE evidence (a store of PROVEN-public verdicts, which the
+* resolver's own `pinSecretVerdict` retraction already computes) was drafted in
+* PR #2415 and WITHDRAWN there: such a store is keyed on the bare expression
+* and lives for the whole process, so on a `cdkd deploy --all` spanning regions
+* a verdict recorded where the parameter is a plain `String` un-redacts a
+* SecureString of the same name in another region — measured, and the
+* un-redacting direction, which is worse than the over-redaction it fixes. Any
+* revival must key the verdict by SCOPE (region + account) at the READ side.
+*
+* The residual is therefore the whole population an empty map describes, which
+* is the state issue #2036 records. Refusing is still the right way to be wrong
+* here: under-redaction persists a decrypted secret, a disclosure and the thing
+* this lane exists to prevent, while over-redaction is visible, recoverable and
+* discloses nothing.
+*
+* `tests/integration/secrets-dynamic-ref` is the end-to-end proof, and it is
+* the only place the empty-map defect surfaced — every unit assertion passed.
+* Three of its phases pin a DIFFERENT map state for the same two leaves, which
+* is what makes the split observable rather than asserted: Phase 1 is the
+* populated-map deploy (the resource is being created), Phase 1g the EMPTY-map
+* deploy (the resource is UNCHANGED, so it has no per-resource map but the
+* resolver has still classified the parameter this run), and Phase 1f the
+* empty-map command, which classifies nothing and therefore still refuses. An
+* earlier revision of this sentence called Phase 1g the populated-map case,
+* which is the opposite of what that phase is built to reach.
 */
 function mixedLeafMayCarryPublicReference(source, secrets) {
 	if (secrets.size === 0) return false;
@@ -11267,7 +11280,9 @@ function anchorSignature(source) {
 *
 * Two conditions, both required:
 *
-* 1. the key sets (objects) or index counts (arrays) match, and
+* 1. every SOURCE key is present in the bag (objects) or the index counts match
+*    (arrays) — see the object arm for why containment rather than equality,
+*    and which of the two directions is the fabrication guard, and
 * 2. every position whose SOURCE carries no dynamic reference is deep-equal on
 *    both sides -- the *anchors*.
 *
@@ -11307,9 +11322,7 @@ function anchorsCorroboratePairing(bag, source, anchors) {
 	if (isDynamicReferenceString(source)) return typeof bag === "string";
 	if (isPlainObject$2(source)) {
 		if (!isPlainObject$2(bag)) return false;
-		const sourceKeys = Object.keys(source);
-		if (sourceKeys.length !== Object.keys(bag).length) return false;
-		return sourceKeys.every((k) => Object.hasOwn(bag, k) && anchorsCorroboratePairing(bag[k], source[k], anchors));
+		return Object.keys(source).every((k) => Object.hasOwn(bag, k) && anchorsCorroboratePairing(bag[k], source[k], anchors));
 	}
 	if (Array.isArray(source)) {
 		if (!Array.isArray(bag) || bag.length !== source.length) return false;
@@ -11398,6 +11411,394 @@ function unkeyedArrayPairsByAnchors(bag, source) {
 	return true;
 }
 /**
+* Marks a position one of the POSITION passes DECIDED, in the parallel tree
+* {@link refuseUncertifiedReadbackPositions} builds when asked to `mark`.
+*
+* A SENTINEL rather than a value comparison, and that distinction was a
+* security blocker on PR #2415. {@link preferPositionDecisions} first inferred
+* "not decided" from `refused === bag`, which cannot tell an UNDECIDED position
+* from one the pass decided IN FAVOUR of the value already there. Two shapes
+* hit it, both fabricating a baseline `cdkd drift --revert` then pushes:
+*
+* - the resolver's unsupported-service arm leaves an `{{resolve:ssm-secure:`
+*   token LITERAL, so AWS echoes it back and the source leaf EQUALS the bag
+*   leaf. The string arm returns `source` — a decision — and the equality made
+*   it look like no decision at all. (A BARE such token takes the whole-token
+*   arm and one embedded in text takes the mixed-leaf arm; both decide, and
+*   both were misread.)
+* - the empty-map arm that deliberately KEEPS a leaf returns `bag` by design.
+*
+* A symbol cannot be produced by any walk of JSON, so no readback value can
+* impersonate it.
+*/
+const POSITION_DECIDED = Symbol("position decided by a position pass");
+/**
+* Record one (plaintext -> expression) pair, or strike the plaintext out.
+*
+* Below {@link MIN_NEEDLE_LENGTH} nothing is recorded, and this floor DECIDES
+* rather than mirrors. {@link buildNeedleRegex} applies the same threshold, so
+* a short needle is dropped from the SUBSTRING arm either way — but the value
+* scan's other arm is a WHOLE-VALUE lookup (`secrets.get(leaf)`) that matches
+* at ANY length, so without this line a two-character derived plaintext would
+* still rewrite every leaf equal to it. That is the false redaction with a
+* blast radius {@link expressionMaySeedANeedle} exists to bound, arriving by
+* length instead of by provenance: a public config value of `us` or `dev` is
+* exactly the kind of short plaintext a readback carries in a dozen unrelated
+* fields.
+*/
+function learnNeedle(collector, plaintext, expression) {
+	if (plaintext.length < 4) return;
+	if (collector.poisoned.has(plaintext)) return;
+	if (expressionSecretIsInferred(expression)) collector.inferred.add(plaintext);
+	const already = collector.needles.get(plaintext);
+	if (already === void 0) {
+		collector.needles.set(plaintext, expression);
+		return;
+	}
+	if (already === expression) return;
+	collector.needles.delete(plaintext);
+	collector.poisoned.add(plaintext);
+}
+/**
+* The `{{resolve:<service>:` prefixes whose resolved value IS a secret,
+* whatever the parameter or secret is called.
+*
+* `ssm` is in the list and `ssm-secure` is spelled separately, because
+* `startsWith('{{resolve:ssm:')` is FALSE for `{{resolve:ssm-secure:` — the
+* next character is `-`. The two are disjoint tests, not one with a prefix
+* relationship, which is the trap `mixedLeafMayCarryPublicReference`'s own
+* comment already records from the other direction.
+*/
+const SECRET_BEARING_REFERENCE_PREFIXES = [
+	"{{resolve:secretsmanager:",
+	"{{resolve:ssm-secure:",
+	"{{resolve:ssm:"
+];
+/**
+* The prefixes whose SPELLING settles secret-ness, with no lookup and no
+* inference — the subset of {@link SECRET_BEARING_REFERENCE_PREFIXES} that
+* {@link expressionSecretIsInferred} treats as certain.
+*
+* An ALLOWLIST rather than "the admission list minus `{{resolve:ssm:`", and the
+* difference is what happens to the NEXT entry someone adds. Subtracting makes a
+* new prefix default to CERTAIN, i.e. to the WIDER blast radius, which is the
+* wrong direction to fail in; listing makes it default to inferred until someone
+* deliberately promotes it.
+*/
+const SPELLED_SECRET_REFERENCE_PREFIXES = ["{{resolve:secretsmanager:", "{{resolve:ssm-secure:"];
+/**
+* Is this expression's secret-ness INFERRED rather than spelled?
+*
+* SPELLING, and ONLY spelling. `secretsmanager:` and `ssm-secure:` say what they
+* are, in a way that is true in every region and every account. A bare
+* `{{resolve:ssm:` token is not: it is accepted as secret-bearing on the #1901
+* premise (a public `String` is persisted RESOLVED, so a token SURVIVING in a
+* state bag is a `SecureString`), which is sound for the leaf itself and NOT
+* sound as a licence to rewrite every other leaf that merely CONTAINS the value.
+*
+* A RECORDED verdict deliberately does NOT promote one, even though it is a real
+* `GetParameter` answer. {@link recordedSecretExpressions} is keyed on the bare
+* expression and lives for the whole process, so on a `cdkd deploy --all` a
+* verdict pinned where the parameter is a `SecureString` is inherited where it
+* is a plain `String` — and the `skipDynamicReferences` diff path skips the
+* lookup on a `true` verdict, so the second region never retracts it. That is
+* the SAME region blindness this PR withdrew issue #2036's public store for; a
+* secret-direction verdict is safe to inherit for ADMISSION (it can only
+* over-redact a leaf) and is not safe for BLAST RADIUS. The cost of ignoring it
+* here is the substring arm for a verdict-backed, same-region ssm
+* `SecureString` on the empty-map path — a strict subset of the population the
+* no-verdict case already concedes, and in the same direction.
+*
+* The difference is a `--revert` WRITE. Measured on this module: a bare `ssm`
+* token whose value is `production` turned `my-production-logs` into
+* `my-{{resolve:ssm:/app/env}}-logs`, exactly the failure
+* {@link expressionMaySeedANeedle}'s own doc names — and if that parameter is in
+* fact public, the baseline now holds a value AWS never reported, which `cdkd
+* drift --revert` re-resolves and pushes, renaming the live bucket the day the
+* parameter changes.
+*
+* So evidence strength decides BLAST RADIUS, not admission: an inferred needle
+* still closes issue #2012's two rows, because both are WHOLE-VALUE positions
+* (an unpaired element and an observed key both hold the plaintext and nothing
+* else). Only the substring arm is withheld. Issue #2036's withdrawn verdict
+* store is what would promote these to certain; until it returns, scoped by
+* region and account, this is the honest bound.
+*/
+function expressionSecretIsInferred(expression) {
+	return !SPELLED_SECRET_REFERENCE_PREFIXES.some((prefix) => expression.startsWith(prefix));
+}
+/**
+* May this expression's resolved value be used as a REDACTION NEEDLE?
+*
+* A stricter question than "may this expression be persisted at this position",
+* which is what `trustAnyExpression` answers, and the difference is the whole
+* reason this predicate exists. Persisting a source leaf VERBATIM is bounded to
+* that one position; promoting the value it replaced to a needle rewrites EVERY
+* leaf in the record that equals it, so a wrong answer here is a false
+* redaction with a blast radius rather than a mislabelled leaf.
+*
+* Two classes, and each was measured rather than reasoned about:
+*
+* - a NON-SECRET SERVICE. `isSingleDynamicReferenceToken` accepts any
+*   `{{resolve:<anything>}}` spelling, and the resolver's unsupported-service
+*   arm WARNS and returns the literal — so AWS holds the token text itself and
+*   the leaf beside it is ordinary data. `cdkd drift`'s own
+*   `--revert does not register a live value for a look-alike spelling` case
+*   pins exactly this for its sibling registration path
+*   (`{{resolve:notaservice:/x}}`), and this predicate is what keeps the two
+*   commands answering it the same way.
+* - a plain `ssm` reference is ACCEPTED, on the same
+*   #1901 premise the whole-token arm one level up already acts on: a public
+*   `String` / `StringList` parameter is persisted RESOLVED, so a
+*   `{{resolve:ssm:` token SURVIVING in a persisted state bag is a
+*   `SecureString` by construction. Requiring a recorded verdict instead would
+*   make the needle unavailable on `cdkd state refresh-observed`, whose process
+*   resolves nothing and therefore records nothing — i.e. it would fail exactly
+*   where issue #2012 is reported. A PROVEN-public verdict would refine this,
+*   and issue #2036's store was to supply one; PR #2415 withdrew it as a
+*   cross-region disclosure, so a genuinely public parameter's resolved value
+*   CAN still seed a needle here. Bounded by the per-record scope and by
+*   {@link MIN_NEEDLE_LENGTH}, and visible as over-redaction rather than as a
+*   leak.
+*/
+function expressionMaySeedANeedle(expression) {
+	return isRecordedSecretExpression(expression) || SECRET_BEARING_REFERENCE_PREFIXES.some((prefix) => expression.startsWith(prefix));
+}
+/**
+* Learn from a position whose SOURCE is a WHOLE `{{resolve:...}}` token.
+*
+* This is the strongest needle available on a readback path, and it asserts
+* nothing the walk was not already asserting: the caller is about to persist
+* `expression` OVER `bag` at this very position, which is the claim that `bag`
+* is that expression's resolved value. Reading the same claim back out as a
+* needle is free.
+*
+* TWO refusals, both narrow and both necessary:
+*
+* - a bag leaf that is ITSELF a complete token is not a plaintext at all. It is
+*   a record that was already redacted (a re-scrub, a second
+*   `refresh-observed`), and pairing it with itself would put a `{{resolve:...}}`
+*   string in the needle set, where the value scan's own token guard would then
+*   have to keep stepping over it.
+* - a token that does not name a SECRET-BEARING reference at all — see
+*   {@link expressionMaySeedANeedle}.
+*/
+function learnWholeTokenNeedle(collector, bag, source) {
+	if (isSingleDynamicReferenceToken(bag)) return;
+	if (!expressionMaySeedANeedle(source)) return;
+	learnNeedle(collector, bag, source);
+}
+/**
+* Learn from a MIXED leaf — a reference embedded in surrounding text, which
+* this module calls the DOMINANT CDK shape (an `Fn::Join` around
+* `secret.secretValueFromJson(...)`).
+*
+* The caller is about to persist `source` over `bag`, i.e. it has already
+* decided the two are the same leaf one resolution apart. Extracting the
+* plaintext is then arithmetic rather than inference, PROVIDED the extraction
+* is unambiguous, which is what the guards below establish:
+*
+* - EXACTLY ONE span. With two references the text between them cannot be
+*   split between the two resolved values without guessing. This one is
+*   CONSERVATIVE rather than a correctness guard, and saying so is what stops
+*   the next reader treating it as load-bearing: with two RESOLVED references
+*   the frame check below refuses independently, because the computed SUFFIX
+*   would then contain a whole `{{resolve:...}}` token and a resolved readback
+*   cannot end with one. The shape it genuinely decides is a second reference
+*   that survives LITERALLY in the readback — the resolver's
+*   unsupported-service arm (`ssm-secure:`) produces exactly that — where the
+*   extraction would in fact be right and is declined anyway. Measured: a
+*   both-resolved fixture leaves this line unfenced.
+* - the source's literal PREFIX and SUFFIX must both be present at the ends of
+*   the bag. That is what proves the leaf really is this source resolved; AWS
+*   normalising any of the surrounding text refuses instead of yielding a
+*   needle sliced at the wrong offsets.
+* - the two must not overlap, and something must remain between them.
+*
+* Anchoring at the ENDS rather than searching is deliberate: a secret whose own
+* text repeats the suffix (`abc@h` inside `postgres://u:abc@h@h`) still slices
+* correctly, while an `indexOf` scan would cut it short.
+*/
+function learnMixedLeafNeedle(collector, bag, source) {
+	const spans = dynamicReferenceSpans(source);
+	if (spans.length !== 1) return;
+	const [span] = spans;
+	const token = source.slice(span.start, span.end);
+	if (!expressionMaySeedANeedle(token)) return;
+	const prefix = source.slice(0, span.start);
+	const suffix = source.slice(span.end);
+	if (bag.length <= prefix.length + suffix.length) return;
+	if (!bag.startsWith(prefix) || !bag.endsWith(suffix)) return;
+	const plaintext = bag.slice(prefix.length, bag.length - suffix.length);
+	if (isSingleDynamicReferenceToken(plaintext)) return;
+	learnNeedle(collector, plaintext, token);
+}
+/**
+* Read the mark tree one level down. It has the SAME shape as `refused` by
+* construction (one function, one set of inputs), but this stays defensive: a
+* missing level yields `undefined`, which reads as "not decided" and therefore
+* lets the scan act. That is the same answer the pre-mark code gave, so a shape
+* surprise cannot silently start SUPPRESSING redaction — but it fails toward
+* SCANNING, which is the fabrication direction the mark tree exists to stop.
+* Both are stated because neither default is free; the shapes are identical by
+* construction (one function, one set of inputs), so this arm is a backstop
+* rather than a policy.
+*/
+function asChild(marks, key) {
+	return isPlainObject$2(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
+}
+/** The array-arm twin of {@link asChild}; same fail-open, same reason. */
+function asIndex(marks, index) {
+	return Array.isArray(marks) ? marks[index] : void 0;
+}
+/**
+* Merge the DERIVED-needle value scan back over the two POSITION passes, so the
+* scan can only ever ADD a rewrite and never EDIT one.
+*
+* WHY THIS EXISTS AT ALL. Issue #2012's fix has been through both orderings and
+* each has its own way of turning a redaction fix into a fabricated baseline —
+* the two are mirror images, which is why the answer is a merge rather than a
+* third choice of order:
+*
+* - SCAN FIRST (the first revision): a needle rewrites a frame LITERAL that
+*   happens to embed a learned plaintext, {@link unkeyedArrayPairsByAnchors} is
+*   then re-run against the SCANNED bag, the anchor no longer deep-equals its
+*   source, the whole array refuses, and a sibling MIXED leaf that position
+*   ALREADY redacted persists in plaintext. Under-redaction.
+* - SCAN LAST, unrestricted (the second): the scan now runs over leaves whose
+*   content came from the SOURCE. A needle occurring in the literal FRAME of a
+*   source-taken mixed leaf is replaced, so
+*   `postgres://appuser:{{resolve:secretsmanager:...}}@h/db` becomes
+*   `postgres://{{resolve:ssm:/app/db-user}}:{{resolve:...}}@h/db` when
+*   `appuser` is also some whole-token position's resolved value — a reference
+*   the template never had at that offset. `cdkd drift --revert` re-resolves the
+*   baseline before pushing it, so once that parameter's value changes the
+*   revert writes a DIFFERENT user to the live resource. Fabricated baseline,
+*   which is the bar {@link refuseUncertifiedReadbackPositions} refuses to break
+*   at its own bottom.
+*
+* THE RULE. A position the passes DECIDED is theirs; a position they left alone
+* belongs to the scan. Expressed as a walk over their OUTPUT rather than as a
+* second copy of their pairing logic, because a mirror of `identityKeyFor` /
+* `unkeyedArrayPairsByAnchors` would drift from the original and a needle
+* applied at a MIS-paired position is a false redaction everywhere it matches.
+* The shapes line up position-for-position for free: neither pass adds a key,
+* an element, or a scalar-over-container, so `refused` is `bag`'s own shape with
+* some leaves replaced.
+*
+* `typeof bag === 'string'` at the leaf: a derived needle can only ever rewrite
+* a STRING, so for every other leaf the two answers agree and taking `refused`
+* is free.
+*
+* KEEPING A NON-PLAIN LEAF INTACT takes the prototype guard on the object arm,
+* NOT that leaf rule, and an earlier revision of this comment claimed the
+* opposite — measured wrong. The scan's own walk rebuilds objects and turns a
+* `Date` the provider readback carries (`LastModified`) into `{}`; that
+* flattening predates this module's derived needles on the POPULATED-map path
+* (issue #2427). The object arm runs FIRST here and `isPlainObject` admits a
+* `Date`, so without `hasPlainPrototype` this walk did the flattening ITSELF —
+* newly extending #2427 to the EMPTY-map path, where the unchanged-resource
+* `drainObservedCaptures` baseline lives and where `cdkd drift --revert` pushes
+* the result to the live resource. With the guard a non-plain leaf falls
+* through to `refused`. That is the position passes' own answer — usually the
+* bag by identity, though NOT universally: their object arm has no prototype
+* guard of its own, so a non-plain leaf whose source subtree carries a
+* reference is already flattened one function earlier. Same defect as issue
+* #2427, one layer up, and out of this lane's scope.
+*
+* The net effect is byte-identical to the FIRST ordering on every input where
+* the un-certification did not fire — which is the whole point: it keeps that
+* ordering's intent and drops only its defect.
+*/
+function preferPositionDecisions(scanned, refused, bag, marks, inferred) {
+	if (isPlainObject$2(bag) && hasPlainPrototype(bag) && isPlainObject$2(refused) && isPlainObject$2(scanned)) {
+		const out = Object.create(null);
+		for (const [k, v] of Object.entries(refused)) out[k] = preferPositionDecisions(scanned[k], v, bag[k], asChild(marks, k), inferred);
+		return out;
+	}
+	if (Array.isArray(bag) && Array.isArray(refused) && Array.isArray(scanned) && refused.length === bag.length && scanned.length === bag.length) return refused.map((item, i) => preferPositionDecisions(scanned[i], item, bag[i], asIndex(marks, i), inferred));
+	if (typeof bag !== "string" || marks === POSITION_DECIDED) return refused;
+	return scanned === bag ? inferred.get(bag) ?? scanned : scanned;
+}
+/**
+* DERIVED NEEDLES (issue [#2012](https://github.com/go-to-k/cdkd/issues/2012)):
+* the secrets map an empty-map readback path can build from its OWN two bags,
+* with no resolution, no AWS call and no new permission.
+*
+* THE PROBLEM THIS ANSWERS. On the readback paths the secrets map is empty by
+* construction (nothing was resolved), so the value scan has no needles and
+* POSITION is the only mechanism. Two shapes have no position to argue from and
+* kept their plaintext: an UNPAIRED array element beside a paired one, and an
+* observed KEY the source does not carry. Both are places {@link redactByPath}
+* ALREADY delegates to the value scan — it is the scan that had nothing to say.
+*
+* WHAT MAKES A NEEDLE AVAILABLE WITHOUT FETCHING. The same record almost always
+* carries the same secret at a position the pass DOES certify: the paired
+* sibling, the key the source does carry. Certifying such a position IS the
+* assertion that AWS's value there is that expression's resolved form — the
+* pass acts on it by persisting the expression over it. Reading that assertion
+* back out gives a plaintext, and a plaintext is exactly what the value scan
+* was missing. Issue #2012's own direction was to RESOLVE the record's
+* expressions to get one, which would have made `cdkd state refresh-observed`
+* and every deploy's observed capture FETCH secrets: a new IAM requirement, a
+* new failure mode and a new place plaintext lives. None of that is needed —
+* AWS already handed us the plaintext, in the very bag being redacted.
+*
+* `redactByPath`'s own comment argued the opposite direction and was right
+* about it: seeding the scan from the SOURCE's expressions cannot work, because
+* a scan needs PLAINTEXT needles. This seeds it from the BAG's values, which is
+* the half that exists.
+*
+* SCOPE, and why each bound is where it is:
+*
+* - ONLY the readback-projected rules. Every other caller either has a real map
+*   or has a source of a different generation, where a value learned from one
+*   generation must not rewrite the other.
+* - ONLY when the map is EMPTY, and this bound is load-bearing for a reason
+*   that is not obvious: {@link crossStackAssociations} and
+*   {@link nestedStackParameterExpressions} are `WeakMap`s keyed by the
+*   RecordedSecretValues INSTANCE, so handing the pipeline a different Map
+*   object would silently lose every association that pass recorded. With an
+*   empty map there are none to lose (an association is only ever recorded for
+*   a plaintext that map holds).
+* - the pairs are scoped to ONE record, exactly as `perResourceSecrets` is on
+*   the deploy path, so one resource's secret can never rewrite another's
+*   coinciding literal.
+*
+* WHERE THE RESULT IS APPLIED, and this is a SEQUENCING claim rather than a
+* scoping one: the returned map is handed to a plain VALUE pass over the RAW
+* bag, whose result is then MERGED over the output of both position passes by
+* {@link preferPositionDecisions}. It reaches neither position pass. Both naive
+* orderings are wrong and that function's doc has the measurements: scanning
+* FIRST lets a needle rewrite a frame LITERAL and un-certify an anchor pairing
+* (under-redaction), scanning LAST over their output lets one rewrite a literal
+* inside a leaf they took from SOURCE (a fabricated baseline). The merge is what
+* makes "a derived needle can only ADD rewrites" literally true.
+*
+* Returns `undefined` when nothing is learned, so the no-secret path skips the
+* scan and the merge entirely and stays byte-identical to the position passes'
+* own output.
+*/
+function deriveReadbackNeedles(bag, source, secrets, rules) {
+	if (!isReadbackProjectedFromState(rules)) return void 0;
+	if (secrets.size > 0) return void 0;
+	if (!subtreeHasDynamicReference(source)) return void 0;
+	const collector = {
+		needles: /* @__PURE__ */ new Map(),
+		poisoned: /* @__PURE__ */ new Set(),
+		inferred: /* @__PURE__ */ new Set()
+	};
+	refuseUncertifiedReadbackPositions(bag, source, secrets, collector);
+	if (collector.needles.size === 0) return void 0;
+	const certain = /* @__PURE__ */ new Map();
+	const inferred = /* @__PURE__ */ new Map();
+	for (const [plaintext, expression] of collector.needles) (collector.inferred.has(plaintext) ? inferred : certain).set(plaintext, expression);
+	return {
+		certain,
+		inferred
+	};
+}
+/**
 * Refuse to persist a readback leaf the path pass could not CERTIFY, at any
 * position the STATE source proves is secret-bearing (issue #1926 review).
 *
@@ -11482,39 +11883,59 @@ function unkeyedArrayPairsByAnchors(bag, source) {
 * --revert` pushes the BASELINE to AWS, so a masked baseline would write the
 * literal `***` onto the live resource (the issue #1498 / #1501 class).
 *
-* KNOWN RESIDUAL, the last row: an observed KEY the source object does not
-* carry has no source leaf to take and no needle to match. It is NOT refused
-* the way an unpaired array ELEMENT is, and the asymmetry is deliberate rather
-* than an oversight — an extra array element is a PEER of the secret-bearing
-* ones (another `Environment` entry), so suspicion is warranted and extras are
-* rare, while an extra object KEY is a different FIELD entirely (`Runtime`,
-* `FunctionArn`, `LastModified`) and is the NORM in an AWS readback. Refusing
-* those would empty the drift baseline of every secret-bearing resource.
-* Tracked as issue [#2012](https://github.com/go-to-k/cdkd/issues/2012).
-*/
-function refuseUncertifiedReadbackPositions(bag, source, secrets) {
+* The last two rows were the RESIDUAL and are closed by DERIVED NEEDLES (issue
+* #2012) — see {@link deriveReadbackNeedles}. Neither has a position to argue
+* from: an unpaired array element and an observed KEY the source does not carry
+* are both positions with no source leaf to take. What they never lacked was a
+* VALUE — the same plaintext usually sits at a position this pass DOES certify,
+* and certifying it is already an assertion that the value is that expression's
+* resolved form. Reading that assertion back out as a needle turns the value
+* scan on for the rest of the record without resolving anything.
+*
+* The extra-KEY asymmetry stays as it was and is worth restating, because the
+* needle does not replace it: an extra array element is a PEER of the
+* secret-bearing ones (another `Environment` entry), while an extra object KEY
+* is a different FIELD entirely (`Runtime`, `FunctionArn`, `LastModified`) and
+* is the NORM in an AWS readback. Refusing those wholesale would empty the
+* drift baseline of every secret-bearing resource, which is why they are
+* value-scanned rather than refused.
+*
+* `learn` is the LEARN PASS's collector and is `undefined` on the substituting
+* pass. It changes NO verdict — every branch below decides exactly what it
+* decided before — it only records the (plaintext, expression) pairs the
+* certified positions establish. Deriving them through this function rather
+* than a second walk is deliberate: the pairing rules (identity keys, anchor
+* corroboration, the refusals) are subtle enough that a mirror of them would
+* drift, and a needle learned from a MIS-paired position is a false redaction
+* everywhere it then matches.
+*/
+function refuseUncertifiedReadbackPositions(bag, source, secrets, learn, mark) {
 	if (isDynamicReferenceString(source) && typeof bag === "string") {
-		if (isSingleDynamicReferenceToken(source)) return source;
-		if (mixedLeafMayCarryPublicReference(source, secrets)) return bag;
-		return source;
+		if (isSingleDynamicReferenceToken(source)) {
+			if (learn) learnWholeTokenNeedle(learn, bag, source);
+			return mark ? POSITION_DECIDED : source;
+		}
+		if (mixedLeafMayCarryPublicReference(source, secrets)) return mark ? POSITION_DECIDED : bag;
+		if (learn) learnMixedLeafNeedle(learn, bag, source);
+		return mark ? POSITION_DECIDED : source;
 	}
 	if (!subtreeHasDynamicReference(source)) return bag;
 	if (isPlainObject$2(bag) && isPlainObject$2(source)) {
 		const out = Object.create(null);
-		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets) : v;
+		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, learn, mark) : v;
 		return out;
 	}
 	if (Array.isArray(bag) && Array.isArray(source)) {
 		const key = identityKeyFor(bag, source);
 		if (key === void 0) {
 			if (!unkeyedArrayPairsByAnchors(bag, source)) return bag;
-			return bag.map((item, i) => refuseUncertifiedReadbackPositions(item, source[i], secrets));
+			return bag.map((item, i) => refuseUncertifiedReadbackPositions(item, source[i], secrets, learn, mark));
 		}
 		const sourceByIdentity = /* @__PURE__ */ new Map();
 		for (const item of source) sourceByIdentity.set(item[key], item);
 		return bag.map((item) => {
 			const partner = sourceByIdentity.get(item[key]);
-			return partner === void 0 ? item : refuseUncertifiedReadbackPositions(item, partner, secrets);
+			return partner === void 0 ? item : refuseUncertifiedReadbackPositions(item, partner, secrets, learn, mark);
 		});
 	}
 	return bag;
@@ -11532,7 +11953,12 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 	if (secrets.size === 0 && source === void 0) return bag;
 	if (source !== void 0) {
 		const positioned = redactByPath(bag, source, secrets, rules, new Set(secrets.values()));
-		return isReadbackProjectedFromState(rules) ? refuseUncertifiedReadbackPositions(positioned, source, secrets) : positioned;
+		if (!isReadbackProjectedFromState(rules)) return positioned;
+		const refused = refuseUncertifiedReadbackPositions(positioned, source, secrets);
+		const derived = deriveReadbackNeedles(bag, source, secrets, rules);
+		if (derived === void 0) return refused;
+		const marks = refuseUncertifiedReadbackPositions(positioned, source, secrets, void 0, true);
+		return preferPositionDecisions(redactSecretsForState(bag, derived.certain), refused, bag, marks, derived.inferred);
 	}
 	const regex = buildNeedleRegex(secrets.keys());
 	const wholeValueExpr = (s) => s === "" ? void 0 : secrets.get(s);
@@ -19792,6 +20218,151 @@ function isTerminationProtectionPropagationError(message) {
 	return /may not be terminated|disableApiTermination/i.test(message);
 }
 
+//#endregion
+//#region src/deployment/delete-outcome.ts
+/**
+* Shared helpers over {@link ResourceDeleteResult} — originally the deploy-side
+* consumption of it (issue
+* [#1762](https://github.com/go-to-k/cdkd/issues/1762)), the twin of what
+* `src/cli/commands/destroy-runner.ts` does for `cdkd destroy`, and since issue
+* [#2301](https://github.com/go-to-k/cdkd/issues/2301) also the PRODUCER-side
+* `indeterminateGuards` constructor. Write and read live in one file on
+* purpose: the field's whole job is to survive a hop from a provider to a
+* recorder, and a sanitizer that does not sit beside its constructor is how
+* the two drift.
+*
+* Issue [#1752](https://github.com/go-to-k/cdkd/issues/1752) gave
+* `ResourceProvider.delete` an optional return value whose `'skipped'` arm
+* means **the resource this result names was NOT destroyed and may still be
+* ALIVE**, and taught the destroy runner to report it. Every OTHER
+* `provider.delete(...)` call site — the deploy engine's template-DELETE
+* branch, its four replacement / recreate delete sites, and the five
+* `rollback-executor.ts` delete arms — discarded the value, so the same skip
+* printed as `deleted`, counted as `deleted`, and dropped the state record.
+*
+* **The module must stay a LEAF — no imports beyond the type, ever.** Same
+* reason as `src/provisioning/nested-stack-messages.ts`: both the deploy
+* engine and the rollback executor consume it, and those two already sit on a
+* dense import ring (engine -> executor -> provider registry -> every
+* provider). A helper that pulled anything else in would close it.
+*/
+/**
+* The `reason` of a `'skipped'` delete outcome, or `undefined` when the
+* provider reported a delete (`{ outcome: 'deleted' }` or the back-compat
+* `void` return ~80 providers still use).
+*
+* A function rather than an inline `result?.outcome === 'skipped'` test at
+* ten call sites so the back-compat `void` reading lives in ONE place: the
+* signature is `Promise<void | ResourceDeleteResult>`, so a caller that awaits
+* it holds `void | ResourceDeleteResult`, which TypeScript will happily let
+* you compare against nothing useful.
+*/
+function deleteSkipReason(result) {
+	if (!result || result.outcome !== "skipped") return void 0;
+	if (typeof result.reason !== "string") return UNSPECIFIED_SKIP_REASON;
+	const trimmed = result.reason.trim();
+	return trimmed === "" ? UNSPECIFIED_SKIP_REASON : trimmed;
+}
+/**
+* Stand-in for a `'skipped'` outcome whose producer supplied no `reason`.
+*
+* Deliberately says the cause is unknown rather than inventing one: the line
+* it renders on is the user's only signal that the resource survived, and a
+* fabricated cause would send them looking in the wrong place.
+*/
+const UNSPECIFIED_SKIP_REASON = "no reason reported by the provider";
+/**
+* The sentence every deploy-side skip renders, in the log line AND in the
+* `Error` the sites that must FAIL the resource throw.
+*
+* Wording rules, both load-bearing:
+*
+* 1. It says the resource was NOT deleted and MAY STILL EXIST. A skip issued
+*    no AWS call at every producer but `NestedStackProvider.delete`, so the
+*    old resource is presumed alive — which is the whole reason a replacement
+*    site cannot proceed to create its replacement beside it.
+* 2. It must NOT contain any phrase the callers' already-deleted classifiers
+*    substring-match (`does not exist` / `was not found` / `not found` /
+*    `No policy found` / `NoSuchEntity` / `NotFoundException` /
+*    `ResourceNotFoundException`). Reading a skip as "already gone" is exactly
+*    the mis-accounting this change exists to remove, and the deploy engine's
+*    DELETE branch and its update-not-supported fallback each carry such a
+*    classifier. The call sites additionally handle the skip OUTSIDE their
+*    `catch`, so a future `reason` carrying one of those phrases still cannot
+*    reach a classifier — belt and braces, because `reason` is provider text.
+*/
+function deleteSkippedMessage(logicalId, physicalId, reason, duringClause) {
+	return `cdkd could not address ${logicalId} (${physicalId}) ${duringClause}, so it was NOT deleted and may still exist: ${reason}`;
+}
+/**
+* Attach an {@link IndeterminateGuard} to whatever a delete arm was about to
+* return (issue [#2301](https://github.com/go-to-k/cdkd/issues/2301)).
+*
+* `undefined` in, `undefined` out when there is no guard to carry — so a
+* provider whose guard reached a verdict keeps returning the back-compat
+* `void` the ~80 providers that return it use, and nothing about the
+* existing shape changes on the hot path.
+*
+* A `'skipped'` result keeps its outcome and its `reason`: a guard that could
+* not answer and a delete that could not be addressed are independent facts,
+* and collapsing either into the other loses one of them.
+*/
+function withIndeterminateGuard(result, guard) {
+	if (!guard) return result;
+	const indeterminateGuards = [...Array.isArray(result?.indeterminateGuards) ? result.indeterminateGuards : [], guard];
+	if (result && result.outcome === "skipped") return {
+		...result,
+		indeterminateGuards
+	};
+	return {
+		...result ?? {},
+		outcome: "deleted",
+		indeterminateGuards
+	};
+}
+/**
+* The guards a delete result reports as INDETERMINATE — those that ran, could
+* not reach a verdict, and were therefore not enforced while cdkd proceeded
+* (issue [#2301](https://github.com/go-to-k/cdkd/issues/2301)). Empty for the
+* overwhelmingly common case, including the back-compat `void` return.
+*
+* Defensive in the same shape and for the same reason as
+* {@link deleteSkipReason}: the value crosses into a DURABLE record
+* (`deployments/*.jsonl`), providers are the least type-checked layer in the
+* repo (a hand-built test double, a future arm, a JS provider), and a
+* malformed entry must degrade to "not reported" rather than crash the delete
+* path or persist `guard: undefined`. `typeof` rather than `?.trim()` for the
+* same reason `deleteSkipReason` uses it — a non-string makes `.trim` itself
+* `undefined`, i.e. a TypeError thrown out of the very path this hardens.
+*
+* Entries whose `guard` or `reason` is missing / non-string / blank are
+* DROPPED rather than defaulted, which is the opposite of `deleteSkipReason`'s
+* choice and deliberately so: there a default is the user's only signal that a
+* live resource survived, so inventing `UNSPECIFIED_SKIP_REASON` beats
+* silence. Here a guard row with no guard id and no cause says only "something
+* somewhere was not checked", which cannot be acted on — and it would count
+* toward the destroy summary's tally, turning an unactionable row into a
+* number the operator has to chase.
+*/
+function deleteIndeterminateGuards(result) {
+	const raw = result?.indeterminateGuards;
+	if (!Array.isArray(raw)) return [];
+	const out = [];
+	for (const entry of raw) {
+		if (!entry || typeof entry !== "object") continue;
+		const { guard, reason } = entry;
+		if (typeof guard !== "string" || typeof reason !== "string") continue;
+		const trimmedGuard = guard.trim();
+		const trimmedReason = reason.trim();
+		if (trimmedGuard === "" || trimmedReason === "") continue;
+		out.push({
+			guard: trimmedGuard,
+			reason: trimmedReason
+		});
+	}
+	return out;
+}
+
 //#endregion
 //#region src/provisioning/json-patch-generator.ts
 /**
@@ -20515,6 +21086,19 @@ function requiresCcDeleteIdentityCheck(resourceType) {
 	return CC_DELETE_IDENTITY_CHECKED_TYPES.has(resourceType);
 }
 /**
+* `IndeterminateGuard.guard` for the pre-flight identity confirmation above
+* (issue [#2301](https://github.com/go-to-k/cdkd/issues/2301)).
+*
+* Named for the GUARD, not for the type or the API it happens to probe today:
+* the value is persisted into `deployments/*.jsonl` and is therefore a user
+* contract, and the set it fires for is
+* {@link CC_DELETE_IDENTITY_CHECKED_TYPES} — a set that is expected to grow to
+* any type whose physical id is globally unique while its resource is
+* regional. `s3` / `get-bucket-location` in the id would go stale on the first
+* such addition, and a stale id cannot be corrected without breaking readers.
+*/
+const CC_DELETE_REGION_IDENTITY_GUARD = "cc-delete-region-identity";
+/**
 * The region a `GetBucketLocation` answer denotes, canonicalized.
 *
 * Two legacy wire shapes, both still returned, which is why this is a function
@@ -20726,11 +21310,11 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		await this.assertRecordedRegionAgainstClient("pre-delete", context?.expectedRegion, resourceType, logicalId, physicalId);
-		await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
+		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-D3bSjRiw.js").then((n) => n.n);
-			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
+			const { ASGProvider } = await import("./asg-provider-BBSPZtne.js").then((n) => n.n);
+			return withIndeterminateGuard(await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
 		if (isProtectedEc2Instance) await disableInstanceApiTermination(getAwsClients().ec2, physicalId, this.logger);
@@ -20748,13 +21332,13 @@ var CloudControlProvider = class {
 			this.logger.debug(`Delete request submitted for ${logicalId}, token: ${deleteResponse.ProgressEvent.RequestToken}`);
 			await this.waitForOperation(deleteResponse.ProgressEvent.RequestToken, logicalId, "DELETE", resourceType);
 			this.logger.debug(`Deleted resource ${logicalId}`);
-			return;
+			return withIndeterminateGuard(void 0, indeterminateGuard);
 		} catch (error) {
 			const err = error;
 			if (error instanceof CloudControlOperationFailedError && error.ccOperation === "DELETE" && error.ccErrorCode === "NotFound" || err.name === "ResourceNotFoundException" || err.message?.includes("does not exist") || err.message?.includes("not found") || err.message?.includes("NotFound")) {
 				await this.assertRecordedRegionAgainstClient("not-found", context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Resource ${logicalId} already deleted (not found), treating as success`);
-				return;
+				return withIndeterminateGuard(void 0, indeterminateGuard);
 			}
 			if (isProtectedEc2Instance && isTerminationProtectionPropagationError(err.message ?? "") && attempt < maxAttempts) {
 				this.logger.debug(`Cloud Control delete of ${logicalId} raced the DisableApiTermination flip-off (attempt ${attempt}/${maxAttempts}); re-flipping and retrying`);
@@ -20890,21 +21474,43 @@ var CloudControlProvider = class {
 	* indeterminate arm, which PROCEEDS. `src/utils/aws-region-resolver.ts`
 	* records the same finding, and the SDK-side guard re-learned it the
 	* expensive way.
+	*
+	* RETURN VALUE (issue #2301 item 3). `undefined` means the guard reached a
+	* verdict — it confirmed the region, or the type is unguarded, or the bucket
+	* is absent (a fourth outcome, not an indeterminate one, per the paragraph
+	* above). An {@link IndeterminateGuard} means it could NOT, and the caller
+	* must carry it out through `ResourceDeleteResult` so the destroy runner can
+	* persist a `RESOURCE_GUARD_INDETERMINATE` event. A MISMATCH still throws.
+	*
+	* The two indeterminate arms below produce THREE distinct `reason` texts,
+	* not two, and that is deliberate: the region-resolution arm falls THROUGH
+	* into the no-region warn, so before this change a client whose SDK region
+	* chain REJECTED was reported identically to one that was never asked. The
+	* remedies differ (fix the credential chain / pass `--region` vs. repair the
+	* state record), so the durable record — and the warn beside it — names
+	* which happened.
 	*/
 	async confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context) {
-		if (!requiresCcDeleteIdentityCheck(resourceType)) return;
+		if (!requiresCcDeleteIdentityCheck(resourceType)) return void 0;
 		const recordedRegion = context?.expectedRegion?.trim();
 		let expectedRegion = recordedRegion === void 0 || recordedRegion === "" ? void 0 : recordedRegion;
+		let clientRegionError;
 		if (expectedRegion === void 0) try {
 			const clientRegion = (await this.cloudControlClient.config.region())?.trim();
 			expectedRegion = clientRegion === void 0 || clientRegion === "" ? void 0 : clientRegion;
 		} catch (error) {
-			this.logger.debug(`Could not resolve the Cloud Control client region while confirming ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+			const clientRegionFailure = describeAwsFailure(error);
+			clientRegionError = clientRegionFailure.summary;
+			this.logger.debug(`Could not resolve the Cloud Control client region while confirming ${physicalId}: ${clientRegionFailure.detail}`);
 			expectedRegion = void 0;
 		}
 		if (expectedRegion === void 0) {
-			this.logger.warn(`Could not confirm that ${resourceType} ${physicalId} (${logicalId}) is the resource this destroy targets: neither the stack state nor the AWS client reports a region. Proceeding with the delete.`);
-			return;
+			const reason = clientRegionError === void 0 ? `neither the stack state nor the AWS client reports a region` : `the stack state records no region and the AWS client's region could not be resolved: ${clientRegionError}`;
+			this.logger.warn(`Could not confirm that ${resourceType} ${physicalId} (${logicalId}) is the resource this destroy targets: ${reason.replace(/[.\s]+$/, "")}. Proceeding with the delete.`);
+			return {
+				guard: CC_DELETE_REGION_IDENTITY_GUARD,
+				reason
+			};
 		}
 		const wantRegion = canonicalizeRegion(expectedRegion);
 		let actualRegion;
@@ -20915,9 +21521,14 @@ var CloudControlProvider = class {
 				this.logger.debug(`Bucket ${physicalId} (${logicalId}) is already absent; leaving the delete to the Cloud Control idempotency path`);
 				return;
 			}
-			const reason = error instanceof Error ? error.message : String(error);
-			this.logger.warn(`Could not confirm which region S3 bucket ${physicalId} (${logicalId}) lives in before deleting it: ${reason}. S3 bucket names are globally unique, so cdkd cannot rule out that this name denotes a bucket in another region. Grant s3:GetBucketLocation on the bucket to enable the check. Proceeding with the delete.`);
-			return;
+			const failure = describeAwsFailure(error);
+			this.logger.debug(`s3:GetBucketLocation on ${physicalId} (${logicalId}) failed: ${failure.detail}`);
+			const summarySentence = failure.summary.replace(/[.\s]+$/, "");
+			this.logger.warn(`Could not confirm which region S3 bucket ${physicalId} (${logicalId}) lives in before deleting it: ${summarySentence}. S3 bucket names are globally unique, so cdkd cannot rule out that this name denotes a bucket in another region. Grant s3:GetBucketLocation on the bucket to enable the check. Proceeding with the delete.`);
+			return {
+				guard: CC_DELETE_REGION_IDENTITY_GUARD,
+				reason: `s3:GetBucketLocation on ${physicalId} could not be answered: ${failure.summary}`
+			};
 		}
 		if (actualRegion === wantRegion) {
 			this.logger.debug(`Confirmed S3 bucket ${physicalId} (${logicalId}) lives in ${wantRegion} before deleting it`);
@@ -28593,77 +29204,6 @@ async function withResourceDeadline(operation, opts) {
 	});
 }
 
-//#endregion
-//#region src/deployment/delete-outcome.ts
-/**
-* Deploy-side consumption of {@link ResourceDeleteResult} (issue
-* [#1762](https://github.com/go-to-k/cdkd/issues/1762)) — the twin of what
-* `src/cli/commands/destroy-runner.ts` does for `cdkd destroy`.
-*
-* Issue [#1752](https://github.com/go-to-k/cdkd/issues/1752) gave
-* `ResourceProvider.delete` an optional return value whose `'skipped'` arm
-* means **the resource this result names was NOT destroyed and may still be
-* ALIVE**, and taught the destroy runner to report it. Every OTHER
-* `provider.delete(...)` call site — the deploy engine's template-DELETE
-* branch, its four replacement / recreate delete sites, and the five
-* `rollback-executor.ts` delete arms — discarded the value, so the same skip
-* printed as `deleted`, counted as `deleted`, and dropped the state record.
-*
-* **The module must stay a LEAF — no imports beyond the type, ever.** Same
-* reason as `src/provisioning/nested-stack-messages.ts`: both the deploy
-* engine and the rollback executor consume it, and those two already sit on a
-* dense import ring (engine -> executor -> provider registry -> every
-* provider). A helper that pulled anything else in would close it.
-*/
-/**
-* The `reason` of a `'skipped'` delete outcome, or `undefined` when the
-* provider reported a delete (`{ outcome: 'deleted' }` or the back-compat
-* `void` return ~80 providers still use).
-*
-* A function rather than an inline `result?.outcome === 'skipped'` test at
-* ten call sites so the back-compat `void` reading lives in ONE place: the
-* signature is `Promise<void | ResourceDeleteResult>`, so a caller that awaits
-* it holds `void | ResourceDeleteResult`, which TypeScript will happily let
-* you compare against nothing useful.
-*/
-function deleteSkipReason(result) {
-	if (!result || result.outcome !== "skipped") return void 0;
-	if (typeof result.reason !== "string") return UNSPECIFIED_SKIP_REASON;
-	const trimmed = result.reason.trim();
-	return trimmed === "" ? UNSPECIFIED_SKIP_REASON : trimmed;
-}
-/**
-* Stand-in for a `'skipped'` outcome whose producer supplied no `reason`.
-*
-* Deliberately says the cause is unknown rather than inventing one: the line
-* it renders on is the user's only signal that the resource survived, and a
-* fabricated cause would send them looking in the wrong place.
-*/
-const UNSPECIFIED_SKIP_REASON = "no reason reported by the provider";
-/**
-* The sentence every deploy-side skip renders, in the log line AND in the
-* `Error` the sites that must FAIL the resource throw.
-*
-* Wording rules, both load-bearing:
-*
-* 1. It says the resource was NOT deleted and MAY STILL EXIST. A skip issued
-*    no AWS call at every producer but `NestedStackProvider.delete`, so the
-*    old resource is presumed alive — which is the whole reason a replacement
-*    site cannot proceed to create its replacement beside it.
-* 2. It must NOT contain any phrase the callers' already-deleted classifiers
-*    substring-match (`does not exist` / `was not found` / `not found` /
-*    `No policy found` / `NoSuchEntity` / `NotFoundException` /
-*    `ResourceNotFoundException`). Reading a skip as "already gone" is exactly
-*    the mis-accounting this change exists to remove, and the deploy engine's
-*    DELETE branch and its update-not-supported fallback each carry such a
-*    classifier. The call sites additionally handle the skip OUTSIDE their
-*    `catch`, so a future `reason` carrying one of those phrases still cannot
-*    reach a classifier — belt and braces, because `reason` is provider text.
-*/
-function deleteSkippedMessage(logicalId, physicalId, reason, duringClause) {
-	return `cdkd could not address ${logicalId} (${physicalId}) ${duringClause}, so it was NOT deleted and may still exist: ${reason}`;
-}
-
 //#endregion
 //#region src/deployment/update-outcome.ts
 /**
@@ -32717,5 +33257,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { maskerOrIdentity as $, CFN_TEMPLATE_BODY_LIMIT as $n, maskSecretsInText as $t, renderStatefulReason as A, describeAwsFailure as An, PartialFailureError as Ar, requireConfigString as At, exportAliasCollisionScrubWarning as B, Synthesizer as Bn, normalizeAwsError as Br, INTRINSIC_KEYS as Bt, isFinalSnapshotError as C, getBootstrapMarkerKey as Cn, DynamicReferenceRegionAmbiguousError as Cr, coerceCfnBoolean as Ct, extractDeploymentEventError as D, validateAssetBucketName as Dn, LockError as Dr, replayWarn as Dt, makeCanonicalizePropertiesFn as E, readBootstrapMarkerBody as En, LocalStartServiceError as Er, readConfigString as Et, green as F, partitionSensitiveEnv as Fn, StackTerminationProtectionError as Fr, s3BucketDualStackDomainName as Ft, IAMRoleProvider as G, resolveAutoAssetStorage as Gn, isTransientServerError as Gr, STATE_SOURCED_CROSS_GENERATION_RULES as Gt, secretBearingStateKeyWarning as H, getDefaultStateBucketName as Hn, isMarkedNonRetryable as Hr, withRetry as Ht, red as I, runDockerForeground as In, StateError as Ir, s3BucketRegionalDomainName as It, ProviderRegistry as J, resolveStateBucketWithDefault as Jn, retryClassificationText as Jr, createSecretMasker as Jt, collectInlinePolicyNamesManagedBySiblings as K, resolveCaptureObservedState as Kn, markNonRetryable as Kr, STATE_SOURCED_READBACK_RULES as Kt, yellow as L, runDockerStreaming as Ln, SynthesisError as Lr, s3BucketWebsiteUrl as Lt, bold as M, dockerSpawnEnvWithSensitive as Mn, ResourceTimeoutError as Mr, producerRegionsFromState as Mt, cyan as N, formatDockerLoginError as Nn, ResourceUpdateNotSupportedError as Nr, s3BucketArn as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, validateContainerRepoName as On, MissingCdkCliError as Or, requireConfigArray as Ot, gray as P, getDockerCmd as Pn, StackHasActiveImportsError as Pr, s3BucketDomainName as Pt, maskDeep as Q, warnDeprecatedNoPrefixCliFlag as Qn, maskSecretsInError as Qt, collectDeclaredOutputNames as R, AssetManifestLoader as Rn, formatError as Rr, applyRoleArnIfSet as Rt, createPreDeleteFinalSnapshot as S, ensureAssetStorage as Sn, DeployCancelledError as Sr, assertRegionMatch as St, unsupportedFinalSnapshotError as T, parseBootstrapMarker as Tn, LocalMigrateError as Tr, configStringRefusal as Tt, stateKeySecretExposure as U, getLegacyStateBucketName as Un, isRetryableTransientError as Ur, DagBuilder as Ut, isExportAliasCollision as V, synthesisStatusMessage as Vn, withErrorHandling as Vr, describeTypeWithThrottleRetry as Vt, getCurrentResourceSecrets as W, resolveApp as Wn, isThrottlingError as Wr, TemplateParser as Wt, findSilentDropProperties as X, resolveUseCdkBootstrapAssets as Xn, errorCauseChain as Xt, findActionableSilentDrops as Y, resolveStateBucketWithDefaultAndSource as Yn, __exportAll as Yr, dynamicReferenceTokens as Yt, createMaskedRetryLogger as Z, stateBucketExistenceConfirmed as Zn, isSingleDynamicReferenceToken as Zt, computeImplicitDeleteEdges as _, escapeRegExp$1 as _n, AssetError as _r, parameterTypeMayLoseSecretIdentity as _t, DeploymentEventsStore as a, rebuildClientForBucketRegion as an, expectedOwnerParam as ar, isInterruptedWaitError as at, buildFinalSnapshotIdentifier as b, BOOTSTRAP_MARKER_PREFIX as bn, CrossAccountSecretRefusalError as br, normalizeAwsTagsToCfn as bt, replayFailedOperations as c, importableOutputs as cn, derivePartitionAndUrlSuffix as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, stringifyValue as dn, clearBucketRegionCache as dr, IntrinsicFunctionResolver as dt, redactSecretsForState as en, CFN_TEMPLATE_URL_LIMIT as er, CUSTOM_RESOURCE_RESPONSE_PREFIX as et, UNSPECIFIED_SKIP_REASON as f, WorkGraph as fn, resolveBucketRegion as fr, carriesDynamicReference as ft, IMPLICIT_DELETE_DEPENDENCIES as g, rewriteTemplateAssetReferences as gn, setAwsClients as gr, isUnboundTemplateParameter as gt, maskingRetryLogger as h, loadPublishableAssetManifest as hn, resetAwsClients as hr, getAccountInfo as ht, DeploymentEventsReader as i, S3StateBackend as in, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ir, interruptWatchListenerCount as it, formatResourceLine as j, buildDockerImage as jn, ProvisioningError as jr, classifyReplaySecretRegion as jt, isStatefulRecreateTargetSync as k, buildDenyExternalAccessPolicy as kn, NestedStackChildDirectDestroyError as kr, requireConfigObject as kt, replayRollback as l, shouldRetainResource as ln, AssemblyReader as lr, disableInstanceApiTermination as lt, withResourceDeadline as m, createAssetRedirectResolver as mn, getAwsClients as mr, coerceParameterTypedValue as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, LockManager as nn, findLargeInlineResources as nr, beginCommandInterruptScope as nt, planFailedOps as o, exportNamesCarriedFrom as on, PARTITION_TABLE as or, startInterruptWatch as ot, deleteSkipReason as p, buildAssetRedirectMap as pn, AwsClients as pr, cfnRefValueFromPhysicalId as pt, clearOnUpdateRemoval as q, resolveSkipPrefix as qn, markRedactedCause as qr, TEMPLATE_SOURCED_RULES as qt, DeployEngine as r, displaySafe as rn, uploadCfnTemplate as rr, endCommandInterruptScope as rt, planRollback as s, importableOutputKeys as sn, canonicalizeRegion as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, scrubResourceRecord as tn, MIGRATE_TMP_PREFIX as tr, DEFAULT_STATE_PREFIX as tt, updatePartialMessage as u, AssetPublisher as un, processStackMessages as ur, isTerminationProtectionPropagationError as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, stripControlChars as vn, CdkdError as vr, refStateLookupFromResource as vt, refusesFinalSnapshot as w, isCrossRegionRedirect as wn, LocalInvokeBuildError as wr, configBooleanRefusal as wt, ccRoutedFinalSnapshotError as x, assertAssetBucketRegion as xn, DependencyError as xr, resolveExplicitPhysicalId as xt, PRE_DELETE_SNAPSHOT_TYPES as y, AssetModeResolver as yn, ConfigError as yr, WAFv2WebACLProvider as yt, collectPublishedOutputNames as z, getDockerImageBySourceHash as zn, isCdkdError as zr, DiffCalculator as zt };
-//# sourceMappingURL=deploy-engine-3lJaFGjA.js.map
+export { DEFAULT_STATE_PREFIX as $, warnDeprecatedNoPrefixCliFlag as $n, maskSecretsInError as $t, bold as A, buildDenyExternalAccessPolicy as An, NestedStackChildDirectDestroyError as Ar, requireConfigObject as At, secretBearingStateKeyWarning as B, getDockerImageBySourceHash as Bn, isCdkdError as Br, DiffCalculator as Bt, unsupportedFinalSnapshotError as C, ensureAssetStorage as Cn, DeployCancelledError as Cr, assertRegionMatch as Ct, isStatefulRecreateTargetSync as D, readBootstrapMarkerBody as Dn, LocalStartServiceError as Dr, readConfigString as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, parseBootstrapMarker as En, LocalMigrateError as Er, configStringRefusal as Et, yellow as F, getDockerCmd as Fn, StackHasActiveImportsError as Fr, s3BucketDomainName as Ft, clearOnUpdateRemoval as G, resolveApp as Gn, isThrottlingError as Gr, TemplateParser as Gt, getCurrentResourceSecrets as H, synthesisStatusMessage as Hn, withErrorHandling as Hr, describeTypeWithThrottleRetry as Ht, collectDeclaredOutputNames as I, partitionSensitiveEnv as In, StackTerminationProtectionError as Ir, s3BucketDualStackDomainName as It, findSilentDropProperties as J, resolveSkipPrefix as Jn, markRedactedCause as Jr, TEMPLATE_SOURCED_RULES as Jt, ProviderRegistry as K, resolveAutoAssetStorage as Kn, isTransientServerError as Kr, STATE_SOURCED_CROSS_GENERATION_RULES as Kt, collectPublishedOutputNames as L, runDockerForeground as Ln, StateError as Lr, s3BucketRegionalDomainName as Lt, gray as M, buildDockerImage as Mn, ProvisioningError as Mr, classifyReplaySecretRegion as Mt, green as N, dockerSpawnEnvWithSensitive as Nn, ResourceTimeoutError as Nr, producerRegionsFromState as Nt, renderStatefulReason as O, validateAssetBucketName as On, LockError as Or, replayWarn as Ot, red as P, formatDockerLoginError as Pn, ResourceUpdateNotSupportedError as Pr, s3BucketArn as Pt, CUSTOM_RESOURCE_RESPONSE_PREFIX as Q, stateBucketExistenceConfirmed as Qn, isSingleDynamicReferenceToken as Qt, exportAliasCollisionScrubWarning as R, runDockerStreaming as Rn, SynthesisError as Rr, s3BucketWebsiteUrl as Rt, refusesFinalSnapshot as S, assertAssetBucketRegion as Sn, DependencyError as Sr, resolveExplicitPhysicalId as St, extractDeploymentEventError as T, isCrossRegionRedirect as Tn, LocalInvokeBuildError as Tr, configBooleanRefusal as Tt, IAMRoleProvider as U, getDefaultStateBucketName as Un, isMarkedNonRetryable as Ur, withRetry as Ut, stateKeySecretExposure as V, Synthesizer as Vn, normalizeAwsError as Vr, INTRINSIC_KEYS as Vt, collectInlinePolicyNamesManagedBySiblings as W, getLegacyStateBucketName as Wn, isRetryableTransientError as Wr, DagBuilder as Wt, maskDeep as X, resolveStateBucketWithDefaultAndSource as Xn, __exportAll as Xr, dynamicReferenceTokens as Xt, createMaskedRetryLogger as Y, resolveStateBucketWithDefault as Yn, retryClassificationText as Yr, createSecretMasker as Yt, maskerOrIdentity as Z, resolveUseCdkBootstrapAssets as Zn, errorCauseChain as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, rewriteTemplateAssetReferences as _n, setAwsClients as _r, isUnboundTemplateParameter as _t, DeploymentEventsStore as a, S3StateBackend as an, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ar, CloudControlProvider as at, createPreDeleteFinalSnapshot as b, AssetModeResolver as bn, ConfigError as br, WAFv2WebACLProvider as bt, replayFailedOperations as c, importableOutputKeys as cn, canonicalizeRegion as cr, deleteIndeterminateGuards as ct, updatePartialReason as d, AssetPublisher as dn, processStackMessages as dr, isTerminationProtectionPropagationError as dt, maskSecretsInText as en, CFN_TEMPLATE_BODY_LIMIT as er, beginCommandInterruptScope as et, withResourceDeadline as f, stringifyValue as fn, clearBucketRegionCache as fr, IntrinsicFunctionResolver as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, loadPublishableAssetManifest as gn, resetAwsClients as gr, getAccountInfo as gt, computeImplicitDeleteEdges as h, createAssetRedirectResolver as hn, getAwsClients as hr, coerceParameterTypedValue as ht, DeploymentEventsReader as i, displaySafe as in, uploadCfnTemplate as ir, startInterruptWatch as it, cyan as j, describeAwsFailure as jn, PartialFailureError as jr, requireConfigString as jt, formatResourceLine as k, validateContainerRepoName as kn, MissingCdkCliError as kr, requireConfigArray as kt, replayRollback as l, importableOutputs as ln, derivePartitionAndUrlSuffix as lr, deleteSkipReason as lt, IMPLICIT_DELETE_DEPENDENCIES as m, buildAssetRedirectMap as mn, AwsClients as mr, cfnRefValueFromPhysicalId as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, scrubResourceRecord as nn, MIGRATE_TMP_PREFIX as nr, interruptWatchListenerCount as nt, planFailedOps as o, rebuildClientForBucketRegion as on, expectedOwnerParam as or, slowCcOperationTimeoutMs as ot, maskingRetryLogger as p, WorkGraph as pn, resolveBucketRegion as pr, carriesDynamicReference as pt, findActionableSilentDrops as q, resolveCaptureObservedState as qn, markNonRetryable as qr, STATE_SOURCED_READBACK_RULES as qt, DeployEngine as r, LockManager as rn, findLargeInlineResources as rr, isInterruptedWaitError as rt, planRollback as s, exportNamesCarriedFrom as sn, PARTITION_TABLE as sr, UNSPECIFIED_SKIP_REASON as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, redactSecretsForState as tn, CFN_TEMPLATE_URL_LIMIT as tr, endCommandInterruptScope as tt, updatePartialMessage as u, shouldRetainResource as un, AssemblyReader as ur, disableInstanceApiTermination as ut, buildFinalSnapshotIdentifier as v, escapeRegExp$1 as vn, AssetError as vr, parameterTypeMayLoseSecretIdentity as vt, makeCanonicalizePropertiesFn as w, getBootstrapMarkerKey as wn, DynamicReferenceRegionAmbiguousError as wr, coerceCfnBoolean as wt, isFinalSnapshotError as x, BOOTSTRAP_MARKER_PREFIX as xn, CrossAccountSecretRefusalError as xr, normalizeAwsTagsToCfn as xt, ccRoutedFinalSnapshotError as y, stripControlChars as yn, CdkdError as yr, refStateLookupFromResource as yt, isExportAliasCollision as z, AssetManifestLoader as zn, formatError as zr, applyRoleArnIfSet as zt };
+//# sourceMappingURL=deploy-engine-CSBoL-Az.js.map