@go-to-k/cdkd 0.288.0 → 0.288.2

package/dist/{deploy-engine-DF3fAY6q.js → deploy-engine-Cxt3gn8N.js}

@@ -1,6 +1,6 @@
 import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BQMDIEQY.js";
+import { t as getCdkdVersion } from "./version-BRByznpy.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2337,7 +2337,7 @@ async function resolveCrossAccountStateBucket(accountId, credentials) {
 /** Cloud assembly schema version compatible with CDK v2 */
 const CDK_ASM_VERSION = "38.0.0";
 /** Maximum context size before overflow to temp file (32KB) */
-const CONTEXT_OVERFLOW_LIMIT = 32 * 1024;
+const CONTEXT_OVERFLOW_LIMIT = 32768;
 /**
 * Remove one matched pair of surrounding quotes from a shell token, so a quoted
 * entrypoint (`"bin/app.js"`) is recognized as a .js file and re-quoted cleanly.
@@ -2551,7 +2551,6 @@ function processStackMessages(stacks, logger, options = {}) {
 		case "error":
 			hasErrors = true;
 			logger.error(`[Error at ${msg.path}] ${msg.message}`);
-			break;
 	}
 	const failAt = options.strict ? "warn" : options.ignoreErrors ? "none" : "error";
 	if (hasErrors && failAt !== "none") throw new SynthesisError("Found errors");
@@ -3174,10 +3173,7 @@ var CcApiContextProvider = class {
 			case "at-least-one":
 				if (count < 1) throw new Error(`Expected at least one ${typeName}${context}, found none`);
 				break;
-			case "at-most-one":
-				if (count > 1) throw new Error(`Expected at most one ${typeName}${context}, found ${count}`);
-				break;
-			case "any": break;
+			case "at-most-one": if (count > 1) throw new Error(`Expected at most one ${typeName}${context}, found ${count}`);
 		}
 	}
 	/**
@@ -4514,7 +4510,8 @@ async function purgeNoncurrentKeyVersions(s3Client, bucket, keys, options = {})
 		const elided = failed.size - named.length;
 		logger.warn(`Could not purge noncurrent versions of ${failed.size} key(s) in s3://${displaySafe(bucket, { asciiOnly: true })}. Their previous versions survive and remain readable via GetObject with a VersionId (${options.objectDescription ?? "the body of an object cdkd has just reported as removed"}). Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key(s) by hand. Failures: ${named.join(", ")}` + (elided > 0 ? ` (and ${elided} more)` : ""));
 	}
-	await warnIfPurgeIsReplicated(s3Client, bucket, [.../* @__PURE__ */ new Set([...purged, ...unsettledBodies])], {
+	const replicationKeys = [.../* @__PURE__ */ new Set([...purged, ...unsettledBodies])];
+	await warnIfPurgeIsReplicated(s3Client, bucket, replicationKeys, {
 		requestFields,
 		logger,
 		...options.objectDescription !== void 0 && { objectDescription: options.objectDescription }
@@ -5114,7 +5111,8 @@ async function expandMacrosAttempt(template, opts, logger) {
 				ChangeSetName: changeSetName
 			})).catch(() => void 0);
 			const reason = desc?.StatusReason ?? "unknown (DescribeChangeSet failed)";
-			throw new MacroExpansionError(`CloudFormation macro expansion failed (status=${desc?.Status ?? "UNKNOWN"}): ${reason}`, waiterError instanceof Error ? waiterError : void 0);
+			const status = desc?.Status ?? "UNKNOWN";
+			throw new MacroExpansionError(`CloudFormation macro expansion failed (status=${status}): ${reason}`, waiterError instanceof Error ? waiterError : void 0);
 		}
 		const tpl = await cfn.send(new GetTemplateCommand({
 			StackName: transientStackName,
@@ -5123,7 +5121,10 @@ async function expandMacrosAttempt(template, opts, logger) {
 		}));
 		if (tpl.TemplateBody === void 0 || tpl.TemplateBody === null) throw new MacroExpansionError(`CloudFormation returned no Processed-stage template body for the macro-expansion changeset. This typically indicates a CFn-side regression — re-run, and if the failure persists open an issue with the transforms involved: [${macros.join(", ")}].`);
 		const expanded = parseTemplateBody(tpl.TemplateBody);
-		if (containsMacro(expanded)) throw new MacroExpansionError(`Macro expansion produced a template that still contains macros [${enumerateMacros(expanded).join(", ")}]. Multi-stage macros (a macro whose expansion emits another macro reference) are intentionally out of scope in cdkd v1 — see https://github.com/go-to-k/cdkd/issues/463. If you need this pattern, manually pre-expand the template and deploy the result.`);
+		if (containsMacro(expanded)) {
+			const inner = enumerateMacros(expanded);
+			throw new MacroExpansionError(`Macro expansion produced a template that still contains macros [${inner.join(", ")}]. Multi-stage macros (a macro whose expansion emits another macro reference) are intentionally out of scope in cdkd v1 — see https://github.com/go-to-k/cdkd/issues/463. If you need this pattern, manually pre-expand the template and deploy the result.`);
+		}
 		logger.debug(`Macro expansion: success — ${Object.keys(expanded.Resources ?? {}).length} resources after expansion.`);
 		return expanded;
 	} finally {
@@ -5245,7 +5246,8 @@ function loadJsonConfig(filePath) {
 * Load cdk.json from the current working directory
 */
 function loadCdkJson(cwd) {
-	return loadJsonConfig(resolve(cwd || process.cwd(), "cdk.json"));
+	const dir = cwd || process.cwd();
+	return loadJsonConfig(resolve(dir, "cdk.json"));
 }
 /**
 * Load user-level defaults from ~/.cdk.json
@@ -6200,8 +6202,10 @@ async function spawnStreaming(cmd, args, options = {}) {
 		const stderrChunks = [];
 		child.stdout.on("data", (chunk) => {
 			stdoutChunks.push(chunk);
-			if (streamLive) if (isStdoutReservedForPayload()) process.stderr.write(chunk);
-			else process.stdout.write(chunk);
+			if (streamLive) {
+				if (isStdoutReservedForPayload()) process.stderr.write(chunk);
+				else process.stdout.write(chunk);
+			}
 		});
 		child.stderr.on("data", (chunk) => {
 			stderrChunks.push(chunk);
@@ -7831,10 +7835,11 @@ async function assertAssetBucketRegion(s3Client, bucketName, expectedRegion, acc
 	const fromHeader = readBucketRegionHeader(cause);
 	if (fromHeader) actual = canonicalizeRegion(fromHeader);
 	else try {
-		actual = canonicalizeRegion(bucketLocationToRegion$1((await s3Client.send(new GetBucketLocationCommand({
+		const location = await s3Client.send(new GetBucketLocationCommand({
 			Bucket: bucketName,
 			ExpectedBucketOwner: accountId
-		}))).LocationConstraint));
+		}));
+		actual = canonicalizeRegion(bucketLocationToRegion$1(location.LocationConstraint));
 	} catch (probeError) {
 		const fromProbe = readBucketRegionHeader(probeError);
 		if (fromProbe) actual = canonicalizeRegion(fromProbe);
@@ -9000,7 +9005,8 @@ var AssetPublisher = class {
 			const err = error;
 			const message = stringifyValue(err["message"] || err["name"] || error);
 			const code = stringifyValue(err["Code"] || err["code"] || err["name"] || "");
-			throw new AssetError(`Asset publishing failed: ${code ? `${code}: ${message}` : message}`, error instanceof Error ? error : void 0);
+			const detail = code ? `${code}: ${message}` : message;
+			throw new AssetError(`Asset publishing failed: ${detail}`, error instanceof Error ? error : void 0);
 		}
 	}
 	/**
@@ -10184,9 +10190,10 @@ var S3StateBackend = class {
 			if (isNoSuchKey(error)) return { kind: "absent" };
 			const { detail } = describeAwsFailure(error);
 			this.logger.debug(`Could not read legacy state region for '${this.displayName(stackName)}': ${displaySafe(detail, { asciiOnly: true }) || "<unrenderable>"}`);
+			const cls = error instanceof Error && error.name ? error.name : "an unknown error";
 			return {
 				kind: "unreadable",
-				reason: displaySafe(error instanceof Error && error.name ? error.name : "an unknown error", { asciiOnly: true }) || "<unrenderable>"
+				reason: displaySafe(cls, { asciiOnly: true }) || "<unrenderable>"
 			};
 		}
 	}
@@ -10289,7 +10296,7 @@ function isNoSuchKey(error) {
 * tolerates FOURTEEN consecutive missed renewals before it lapses, and an
 * ordinary broad-set integ (~8 min) performs three.
 */
-const MAX_RENEWAL_INTERVAL_MS = 120 * 1e3;
+const MAX_RENEWAL_INTERVAL_MS = 12e4;
 /**
 * Renew after at most a quarter of the TTL, so a short TTL still gets three
 * chances to renew before it lapses. This is what binds the two numbers
@@ -11093,7 +11100,9 @@ var LockManager = class {
 		const expiresIn = lockInfo ? this.formatDuration(lockInfo.expiresAt - Date.now()) : "unknown";
 		const forceUnlockCommand = buildForceUnlockCommand(stackName, region);
 		const recovery = forceUnlockCommand ? `If you are certain no other process is active, run: ${forceUnlockCommand}` : `If you are certain no other process is active, ${UNREPRODUCIBLE_LOCK_CLAUSE.charAt(0).toLowerCase()}${UNREPRODUCIBLE_LOCK_CLAUSE.slice(1)}`;
-		throw new LockError(`Failed to acquire lock for stack '${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}' (${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}) after ${maxRetries + 1} attempts. ` + (lockInfo ? `Locked by: ${lockInfo.owner}${lockInfo.operation ? `, operation: ${lockInfo.operation}` : ""}, expires in: ${expiresIn}. ` + recovery : `Lock exists but could not read lock info. ${recovery}`));
+		const safeStack = displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>";
+		const safeRegion = displaySafe(region, { asciiOnly: true }) || "<unrenderable>";
+		throw new LockError(`Failed to acquire lock for stack '${safeStack}' (${safeRegion}) after ${maxRetries + 1} attempts. ` + (lockInfo ? `Locked by: ${lockInfo.owner}${lockInfo.operation ? `, operation: ${lockInfo.operation}` : ""}, expires in: ${expiresIn}. ` + recovery : `Lock exists but could not read lock info. ${recovery}`));
 	}
 };
 
@@ -11197,6 +11206,102 @@ function resolvedPlaintextOf(secrets, expression) {
 	return typeof recorded === "string" ? recorded : void 0;
 }
 /**
+* The bag OBJECTS a deploy pass produced ITSELF and installed on a success
+* path — the fact the resolved-pair evidence above cannot state (issue
+* [#2516](https://github.com/go-to-k/cdkd/issues/2516)).
+*
+* A pair proves that THIS pass resolved a token to a plaintext; it says nothing
+* about which bag is being walked. The deploy engine's persist choke point
+* walks EVERY record in the state map against today's template, and a record
+* that merely ENTERED the create/update arm is still the PREVIOUS generation
+* until its provider call succeeds (an intermediate save, a pre/post-rollback
+* save, Ctrl-C — the same population the `sourceIsSameGeneration` note on
+* {@link PathSourceRules} names). One record also carries two bags of
+* different provenance: `properties`, this pass's resolved bag once the
+* provider succeeded, and `observedProperties`, an AWS readback installed
+* separately. So the fact is BAG-specific, not caller- or record-level, and it
+* is carried on the object: {@link markSameGenerationBag} at the moment the
+* successful result is installed, consulted by {@link redactSecretsForState}
+* for the object it is handed. A copy of the bag, a derived needle map, a
+* previous generation's record, a scrub / import / drift walk and a bag the
+* engine did not mark all answer `false` and keep the fall-through.
+*
+* A `WeakSet` for the reason {@link resolvedPairsOf} is a `WeakMap`: the mark
+* dies with the object it is on, and nothing has to clear it.
+*/
+const sameGenerationBags = /* @__PURE__ */ new WeakSet();
+/**
+* Mark `bag` as an object THIS pass is entitled to speak for, and return it.
+* The one evidence {@link positionByEmbeddedSpan} needs beyond a resolved pair
+* to write a middle SHORTER than {@link MIN_NEEDLE_LENGTH} — see the arm.
+*
+* Deliberately NOT "produced by resolving today's template, read back from a
+* resource it just wrote, and about to be installed on a success path": each
+* of those three was in this sentence and each is false at one site (an
+* unchanged resource's auto-refresh resolves nothing; the no-change re-check
+* and the journal are never installed on the record). The conditions are per
+* site and are listed below.
+*
+* WHAT THE MARK CLAIMS, which is the only thing every site shares: the object
+* is one THIS PASS is entitled to speak for, so a sub-floor middle in it may
+* be written as the token this pass recorded. What never qualifies is a bag of
+* MIXED provenance: a provider's `effectiveProperties` replacement may carry
+* previous-state values IN, so an object-level mark on it would prove nothing
+* for those leaves — it stays unmarked and keeps the residual. Nor does the
+* object the resolver produced, marked at resolution time: it is not
+* necessarily the object state ends up holding.
+*
+* The CONDITIONS are per SITE, not global, and stating them globally is what
+* this paragraph kept getting wrong (PR 2753, rounds 3 and 4). "After the
+* provider call" is false for the no-change re-check, which marks BEFORE it
+* and may skip it entirely. "Every leaf this pass produced" is false for the
+* auto-refresh readback of an UNCHANGED resource, where nothing was resolved
+* at all — there the safety comes from the empty secrets map, not from the
+* mark. Read the per-site list below rather than a rule over all five.
+*
+* The five call sites, and which of them the record HOLDS, because the earlier
+* "two never-installed copies" reading of this paragraph was false once the
+* third copy arrived:
+* - `propertiesToRecord` — the record's `properties`, installed. The resolved
+*   bag itself when the route drops nothing, a narrowed copy of it when it
+*   does, and `withoutSilentDropProperties` returns its input by reference in
+*   the first case, which is why the mark must be taken AFTER the narrowing
+*   and not before.
+* - `drainObservedCaptures` — the `observedProperties` readback it installs,
+*   and a COPY: the object a provider returned is never the marked one, so a
+*   provider that hands back its own `properties` argument cannot get a
+*   previous generation marked. It marks EVERY capture it drains, which is
+*   wider than "a resource this pass wrote" — the schema-upgrade auto-refresh
+*   of an UNCHANGED resource is marked too. What keeps that safe is the map,
+*   not the mark: `perResourceSecrets` is populated only in the create /
+*   update arms, so an unchanged resource's walk carries an empty one and the
+*   span arm cannot fire whatever the object is marked.
+* - `resolveOutputs` — the `outputs` bag this pass resolved. What every site
+*   shares is that the marked object is the redaction INPUT; whether the
+*   record then holds that same object varies, and here it depends on whether
+*   this pass recorded any output secret: with one,
+*   `redactOutputs` returns a fresh redacted bag and that return value is
+*   installed; with none — the ordinary deploy — it returns its input
+*   unchanged and the marked object IS the one
+*   stored. On the no-change path the newly redacted bag is installed when
+*   the outputs CHANGED, and the previous `persistedOutputs` is kept
+*   otherwise; that previous bag is unmarked, which is the answer that arm
+*   wants.
+* - the update arm's no-change re-check — a marked `{ ...resolvedProps }`
+*   compared against the stored record so a stored token reads as a no-op.
+*   NOT installed; the object the provider is handed is the unmarked original.
+* - the rollback journal's FAILED-op `attemptedProperties` — a marked copy, so
+*   that persisted artifact does not carry the plaintext on exactly the
+*   failure path. NOT installed on the record.
+*/
+function markSameGenerationBag(bag) {
+	sameGenerationBags.add(bag);
+	return bag;
+}
+function isSameGenerationBag(bag) {
+	return sameGenerationBags.has(bag);
+}
+/**
 * Every `{{resolve:...}}` expression this process has PROVEN resolves to a
 * secret, as a SET — uncollapsed by resolved value (issue #1910).
 *
@@ -12847,15 +12952,78 @@ function singleSpanFrame(bag, source) {
 * not create is the whole-token arm's: a middle that is ALREADY an expression
 * (a persisted answer from another generation), which the token refusal below
 * keeps out — and, by the same argument, any leaf the value scan would NOT
-* rewrite to exactly `prefix + survivor + suffix`: a middle shorter than the
-* scan's needle floor (an embedded 1-3 character secret stays the scan's
-* documented residual — issue #2516 tracks closing it with a bound that
-* proves the bag's generation, which this evidence does not), a whole leaf
-* that is itself another recorded plaintext, a needle starting in the prefix
-* and overlapping the middle. The
-* arm checks that equivalence against the scan's own answer rather than
-* re-deriving the scan's rules. Pinned by the cross-generation cases in
-* `secret-redaction-embedded-span.test.ts`.
+* rewrite to exactly `prefix + survivor + suffix`: a whole leaf that is itself
+* another recorded plaintext, a needle starting in the prefix and overlapping
+* the middle, and — on a bag whose generation is NOT proven — a middle shorter
+* than the scan's needle floor. The arm checks that equivalence against the
+* scan's own answer rather than re-deriving the scan's rules. Pinned by the
+* cross-generation cases in `secret-redaction-embedded-span.test.ts`.
+*
+* BELOW THE NEEDLE FLOOR the scan makes no claim at all (issue
+* [#2516](https://github.com/go-to-k/cdkd/issues/2516)): {@link buildNeedleRegex}
+* drops every plaintext shorter than {@link MIN_NEEDLE_LENGTH} from its
+* alternation, so an embedded 1-3 character secret is left in plaintext by
+* the scan, with or without a same-plaintext sibling. Accepting the scan's
+* silence (`scanned === bag`) as equivalence would therefore be a NEW claim
+* rather than a choice within the scan's class, and on a previous
+* generation's bag it would fabricate: a 1-3 character readback or old
+* record that COINCIDES with today's plaintext (`port:0` where AWS returns a
+* default and today's secret resolved to `0`) would be persisted as today's
+* expression, which round-trips today and, after a rotation, reports a drift
+* that never happened. So that arm is admitted only for a bag whose
+* generation IS proven: `bagIsSameGeneration`, the object-level mark
+* {@link markSameGenerationBag} puts on the bags the deploy engine hands to
+* redaction on a success path (the record's `properties`, which are the
+* resolved bag or the subset of it the SDK route writes; EVERY
+* `observedProperties` readback `drainObservedCaptures` drains, an unchanged
+* resource's auto-refresh included, where the empty secrets map rather than
+* the mark is what keeps it safe; and the `outputs` bag this pass resolved,
+* whose redacted RETURN VALUE is usually what the record holds) and on two
+* copies of the resolver's own output that the record never holds. That
+* function's contract is the authority — the conditions differ per site and
+* do not survive being stated once. Threaded down from
+* {@link redactSecretsForState} for exactly the object it was handed. With
+* the mark AND the pair, `recorded === middle` says this pass resolved the
+* source token to the middle and the bag is this pass's own, so
+* `prefix + token + suffix` is what the template says at that leaf and what
+* the resource holds. Without the mark the sub-floor middle keeps today's
+* bound, which is the scan's answer: the plaintext, unchanged.
+*
+* What stays, stated here rather than papered over. A provider that
+* substituted `effectiveProperties` built a bag of MIXED provenance, so that
+* object is never marked and a sub-floor middle in it keeps the scan's
+* answer. A readback AWS rewrote at that offset to a value that coincides
+* with the 1-3 character secret is persisted as the expression: value-equal
+* until the secret rotates, and the same residual the value scan already has
+* for a 4+ character coincidence in a readback. Every refusal of this arm
+* returns the scan's answer, so a leaf refused for interference (a frame
+* that is itself a recorded plaintext, say) has its frame rewritten and its
+* sub-floor middle left in plaintext. And this arm positions a LITERAL
+* source leaf only: an `Fn::Join` / `Fn::Sub` source rendering the same
+* `port:` + token goes to {@link positionByIntrinsicSkeleton}, which refuses
+* unless the WHOLE bag is a recorded plaintext, so a sub-floor secret
+* embedded through an intrinsic — the dominant CDK shape — still falls to
+* the value scan and persists in plaintext. `cdkd scrub`, the documented
+* repair tool for a pre-GHSA record, cannot repair a sub-floor embedded leaf
+* either: it walks a STORED bag, which no deploy marked, so the arm is
+* unreachable from it by construction and the leaf keeps the scan's answer.
+* The MASKING channel keeps the residual whole: `maskSecretsInText`'s
+* substring arm carries the same four-character floor, so once this arm has
+* put `port:{{resolve:...}}` in state, a warn line quoting an AWS message can
+* still print `port:q7`. Pre-existing and not a regression -- the #2453 class,
+* and the reason the list would otherwise read as complete when it is not
+* (maintainer review of PR 2753, round 2).
+*
+* The next DEPLOY of that resource repairs the leaves this arm is eligible
+* for — a LITERAL source leaf on a bag the engine marks — because the
+* re-check compares unequal against a record holding the plaintext and the
+* resource is written again from a bag this pass produced. The residuals
+* named above (an `effectiveProperties` substitution, an intrinsic source
+* shape) are not repaired by that deploy either; they stay tracked by
+* #2745. Tracked, with the sub-floor
+* residuals of a nested-stack child's inherited parameter and of `cdkd
+* import`'s own resolution, by issue
+* [#2745](https://github.com/go-to-k/cdkd/issues/2745).
 *
 * One shape reaches this arm that a reader may not expect: a WHOLE-token
 * source that FAILED the whole-token arm's `isKnownSecretExpression` gate (an
@@ -12883,7 +13051,7 @@ function singleSpanFrame(bag, source) {
 * the scan as a parameter, which left the bound one wrong caller away from
 * comparing against a scan of some other bag with no type error.
 */
-function positionByEmbeddedSpan(bag, source, secrets) {
+function positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration) {
 	const scanned = redactSecretsForState(bag, secrets);
 	const frame = singleSpanFrame(bag, source);
 	if (frame === void 0) return scanned;
@@ -12892,8 +13060,9 @@ function positionByEmbeddedSpan(bag, source, secrets) {
 	if (recorded === void 0 || recorded !== middle) return scanned;
 	const survivor = secrets.get(middle);
 	if (survivor === void 0) return scanned;
-	if (scanned !== prefix + survivor + suffix) return scanned;
-	return prefix + token + suffix;
+	if (scanned === prefix + survivor + suffix) return prefix + token + suffix;
+	if (bagIsSameGeneration && scanned === bag) return prefix + token + suffix;
+	return scanned;
 }
 /**
 * Keys tried, in order, when pairing two arrays whose ORDER cannot be trusted
@@ -13089,13 +13258,13 @@ function positionListByCrossStackSource(bag, source, secrets) {
 * association where the position is a cross-stack read, skeleton where it is a
 * describable intrinsic, value where none is.
 */
-function redactByPath(bag, source, secrets, rules, secretExpressions) {
+function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameGeneration) {
 	if (isDynamicReferenceString(source) && typeof bag === "string") {
 		if (isSingleDynamicReferenceToken(source) && (rules.trustAnyExpression || isKnownSecretExpression(source, secretExpressions))) {
 			if (!rules.sourceIsSameGeneration && isSingleDynamicReferenceToken(bag)) return secrets.get(bag) ?? bag;
 			return source;
 		}
-		return positionByEmbeddedSpan(bag, source, secrets);
+		return positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration);
 	}
 	if (typeof bag === "string" && isPlainObject$2(source)) {
 		const certified = positionByCrossStackSource(bag, source, secrets);
@@ -13124,16 +13293,16 @@ function redactByPath(bag, source, secrets, rules, secretExpressions) {
 			const positionalIsExact = rules.descendArrays && bag.length === source.length && orderPreserved;
 			return bag.map((item, i) => {
 				const j = partnerIndex[i];
-				if (j >= 0) return redactByPath(item, source[j], secrets, rules, secretExpressions);
-				if (positionalIsExact) return redactByPath(item, source[i], secrets, rules, secretExpressions);
+				if (j >= 0) return redactByPath(item, source[j], secrets, rules, secretExpressions, bagIsSameGeneration);
+				if (positionalIsExact) return redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration);
 				return redactSecretsForState(item, secrets);
 			});
 		}
-		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions));
+		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration));
 	}
 	if (isPlainObject$2(bag) && isPlainObject$2(source)) {
 		const out = Object.create(null);
-		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions) : redactSecretsForState(v, secrets);
+		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactSecretsForState(v, secrets);
 		return out;
 	}
 	return redactSecretsForState(bag, secrets);
@@ -14151,7 +14320,7 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, learn, mark) {
 function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RULES) {
 	if (secrets.size === 0 && source === void 0) return bag;
 	if (source !== void 0) {
-		const positioned = redactByPath(bag, source, secrets, rules, recordedExpressionsOf(secrets));
+		const positioned = redactByPath(bag, source, secrets, rules, recordedExpressionsOf(secrets), isSameGenerationBag(bag));
 		if (!isReadbackProjectedFromState(rules)) return positioned;
 		const refused = refuseUncertifiedReadbackPositions(positioned, source, secrets);
 		const derived = deriveReadbackNeedles(bag, source, secrets, rules);
@@ -14991,7 +15160,10 @@ var DagBuilder = class {
 		this.logger.debug(`Dependency graph built: ${resourceIds.length} nodes, ${edgeCount} edges`);
 		edgeCount += this.addCustomResourcePolicyEdges(graph, template);
 		edgeCount += this.addLambdaVpcEdges(graph, template);
-		if (!alg.isAcyclic(graph)) throw new DependencyError(`Circular dependency detected in template. Cycles: ${this.findCycles(graph).map((c) => c.join(" -> ")).join("; ")}`);
+		if (!alg.isAcyclic(graph)) {
+			const cycles = this.findCycles(graph);
+			throw new DependencyError(`Circular dependency detected in template. Cycles: ${cycles.map((c) => c.join(" -> ")).join("; ")}`);
+		}
 		return graph;
 	}
 	/**
@@ -15020,7 +15192,10 @@ var DagBuilder = class {
 				const predecessors = graphCopy.predecessors(node);
 				return !predecessors || predecessors.length === 0;
 			});
-			if (readyNodes.length === 0) throw new DependencyError(`Circular dependency detected. Remaining nodes: ${graphCopy.nodes().join(", ")}`);
+			if (readyNodes.length === 0) {
+				const remaining = graphCopy.nodes();
+				throw new DependencyError(`Circular dependency detected. Remaining nodes: ${remaining.join(", ")}`);
+			}
 			this.logger.debug(`Level ${levelNum}: ${readyNodes.length} resources - ${readyNodes.join(", ")}`);
 			levels.push(readyNodes);
 			readyNodes.forEach((node) => {
@@ -15826,9 +16001,10 @@ const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 * 4s/8s steps overshoot it. The dense schedule applies ONLY when the caller
 * left the schedule at its defaults — a caller that passed its own
 * `maxRetries` / `initialDelayMs` / `maxDelayMs` / `isRetryable` picked that
-* schedule deliberately (e.g. the DELETE path's 3 x 5s, or the delete-then-
-* re-create sites' ~64s budget covering SQS's 60s name cooldown) and gets it
-* verbatim.
+* schedule deliberately (e.g. the DELETE path's 3 retries from 5s — 5s/8s/8s,
+* since it passes `initialDelayMs` but leaves `maxDelayMs` at the 8s default —
+* or the delete-then-re-create sites' ~64s budget covering SQS's 60s name
+* cooldown) and gets it verbatim.
 *
 * A THIRD class rides its own grid on the default schedule since issue
 * [#2116](https://github.com/go-to-k/cdkd/issues/2116): a NAME COOLDOWN (a
@@ -19370,9 +19546,7 @@ var DiffCalculator = class DiffCalculator {
 			case "DELETE":
 				summary.delete++;
 				break;
-			case "NO_CHANGE":
-				summary.noChange++;
-				break;
+			case "NO_CHANGE": summary.noChange++;
 		}
 		return summary;
 	}
@@ -21122,7 +21296,8 @@ var WAFv2WebACLProvider = class {
 			this.logger.debug(`Successfully deleted WAFv2 WebACL ${logicalId}`);
 		} catch (error) {
 			if (error instanceof WAFNonexistentItemException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`WAFv2 WebACL ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -21224,7 +21399,8 @@ var WAFv2WebACLProvider = class {
 		result["TokenDomains"] = webACL.TokenDomains ? [...webACL.TokenDomains] : [];
 		if (webACL.AssociationConfig) result["AssociationConfig"] = webACL.AssociationConfig;
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$11({ ResourceARN: physicalId }))).TagInfoForResource?.TagList);
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$11({ ResourceARN: physicalId }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagInfoForResource?.TagList);
 		} catch (err) {
 			this.logger.debug(`WAFv2 ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -22929,14 +23105,15 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const resolved = {};
 		for (const [key, val] of Object.entries(obj)) {
 			const resolvedVal = await this.resolveValue(val, context);
-			if (resolvedVal !== AWS_NO_VALUE) if (key === "__proto__") Object.defineProperty(resolved, key, {
-				value: resolvedVal,
-				enumerable: true,
-				writable: true,
-				configurable: true
-			});
-			else resolved[key] = resolvedVal;
-			else this.logger.debug(`Property ${key} resolved to AWS::NoValue, omitting from object`);
+			if (resolvedVal !== AWS_NO_VALUE) {
+				if (key === "__proto__") Object.defineProperty(resolved, key, {
+					value: resolvedVal,
+					enumerable: true,
+					writable: true,
+					configurable: true
+				});
+				else resolved[key] = resolvedVal;
+			} else this.logger.debug(`Property ${key} resolved to AWS::NoValue, omitting from object`);
 		}
 		return resolved;
 	}
@@ -23649,9 +23826,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 						case "PublicDnsName":
 							value = instance?.PublicDnsName;
 							break;
-						case "AvailabilityZone":
-							value = instance?.Placement?.AvailabilityZone;
-							break;
+						case "AvailabilityZone": value = instance?.Placement?.AvailabilityZone;
 					}
 					if (value !== void 0 && value !== null && value !== "") {
 						cachedEc2InstanceAttributes[cacheKey] = value;
@@ -24775,7 +24950,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const credentials = await assumeRoleForCrossAccountStateRead(roleArn);
 		const { bucket, region: bucketRegion } = await resolveCrossAccountStateBucket(parsed.accountId, credentials);
 		const prefix = context.stateBackend?.prefix ?? "cdkd";
-		return new S3StateBackend(new S3Client({
+		const s3 = new S3Client({
 			...awsClientDefaults(),
 			region: bucketRegion,
 			credentials: {
@@ -24789,7 +24964,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				warn: () => {},
 				error: () => {}
 			}
-		}), {
+		});
+		return new S3StateBackend(s3, {
 			bucket,
 			prefix
 		}, {
@@ -25984,7 +26160,7 @@ function unsupportedTypeIssueUrl(resourceType) {
 
 //#endregion
 //#region src/provisioning/slow-cc-operation-timeouts.ts
-const MINUTE_MS = 60 * 1e3;
+const MINUTE_MS = 6e4;
 /**
 * 60 min covers the worst-case observed for each type with headroom over the
 * 15-30 min typical range. Keyed by CloudFormation type name. RDS / ElastiCache
@@ -26307,7 +26483,7 @@ var CloudControlProvider = class {
 	cloudControlClient;
 	logger = getLogger().child("CloudControlProvider");
 	patchGenerator = new JsonPatchGenerator();
-	MAX_WAIT_TIME_MS = 900 * 1e3;
+	MAX_WAIT_TIME_MS = 9e5;
 	INITIAL_POLL_INTERVAL_MS = 1e3;
 	MAX_POLL_INTERVAL_MS = 1e4;
 	constructor() {
@@ -26466,8 +26642,9 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DQCVYO5-.js").then((n) => n.n);
-			return withIndeterminateGuard(await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
+			const { ASGProvider } = await import("./asg-provider-DUlRn84u.js").then((n) => n.n);
+			const asgProvider = new ASGProvider();
+			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
 		if (isProtectedEc2Instance) await disableInstanceApiTermination(getAwsClients().ec2, physicalId, this.logger);
@@ -27119,16 +27296,13 @@ var CloudControlProvider = class {
 					}
 				}
 				break;
-			case "AWS::ResourceGroups::Group":
-				if (!enriched["Arn"]) {
-					const model = await this.readCcResourceModel(resourceType, physicalId);
-					if (model) {
-						if (typeof model["Arn"] === "string") enriched["Arn"] = model["Arn"];
-						this.logger.debug(`Enriched ResourceGroups Group ${physicalId} with Arn from CC GetResource`);
-					}
+			case "AWS::ResourceGroups::Group": if (!enriched["Arn"]) {
+				const model = await this.readCcResourceModel(resourceType, physicalId);
+				if (model) {
+					if (typeof model["Arn"] === "string") enriched["Arn"] = model["Arn"];
+					this.logger.debug(`Enriched ResourceGroups Group ${physicalId} with Arn from CC GetResource`);
 				}
-				break;
-			default: break;
+			}
 		}
 		return enriched;
 	}
@@ -30321,7 +30495,8 @@ var IAMRoleProvider = class {
 				await this.iamClient.send(new GetRoleCommand({ RoleName: physicalId }));
 			} catch (error) {
 				if (error instanceof NoSuchEntityException) {
-					assertRegionMatch(await this.iamClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.iamClient.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`Role ${physicalId} does not exist, skipping deletion`);
 					return;
 				}
@@ -32121,9 +32296,9 @@ const EBS_FINAL_SNAPSHOT_TAG_KEY = "cdkd:final-snapshot-of";
 /** Test seam (matches the `describe-type.ts` / macro-expander pattern). */
 const finalSnapshotDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
 const PRE_DELETE_SNAPSHOT_POLL_INTERVAL_MS = 5e3;
-const PRE_DELETE_SNAPSHOT_TIMEOUT_MS = 3600 * 1e3;
+const PRE_DELETE_SNAPSHOT_TIMEOUT_MS = 36e5;
 /** Post-snapshot settle budget for a Redshift cluster before its delete. */
-const REDSHIFT_CLUSTER_SETTLE_TIMEOUT_MS = 1200 * 1e3;
+const REDSHIFT_CLUSTER_SETTLE_TIMEOUT_MS = 12e5;
 function errMsg(error) {
 	return error instanceof Error ? error.message : String(error);
 }
@@ -33432,7 +33607,8 @@ var ReplayResolvers = class {
 * `state.json` already stores in the clear.
 */
 function regionAmbiguousReplaySecretError(logicalId, propertyPath, secretName, foreignProducerRegions, consumerRegion) {
-	return new CdkdError(`Rollback of ${logicalId}${propertyPath === "" ? "" : ` property '${propertyPath}'`} cannot re-resolve the secret reference '${secretName}': the reference carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.join(", ")}), so it may have been resolved in one of those rather than in '${consumerRegion}'. A secret of the same name in two regions is two independent values, so replaying this would write the WRONG secret to a live resource. Refusing instead. Resolve the reference in its own region and set the property directly (or spell it as a full ARN, which names its region and is resolved there), then re-run 'cdkd rollback'.`, "ROLLBACK_SECRET_REGION_AMBIGUOUS");
+	const where = propertyPath === "" ? "" : ` property '${propertyPath}'`;
+	return new CdkdError(`Rollback of ${logicalId}${where} cannot re-resolve the secret reference '${secretName}': the reference carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.join(", ")}), so it may have been resolved in one of those rather than in '${consumerRegion}'. A secret of the same name in two regions is two independent values, so replaying this would write the WRONG secret to a live resource. Refusing instead. Resolve the reference in its own region and set the property directly (or spell it as a full ARN, which names its region and is resolved there), then re-run 'cdkd rollback'.`, "ROLLBACK_SECRET_REGION_AMBIGUOUS");
 }
 /**
 * Re-resolve one LEAF string, sending each `{{resolve:...}}` reference in it to
@@ -33535,10 +33711,11 @@ async function resolveLeafByRegion(leaf, propertyPath, logicalId, execCtx, resol
 */
 function redactRollbackRecord(record, secrets, journaledProps) {
 	if (secrets.size === 0) return record;
-	return scrubResourceRecord(journaledProps === void 0 ? record : {
+	const positioned = journaledProps === void 0 ? record : {
 		...record,
 		properties: redactSecretsForState(record.properties, secrets, journaledProps, STATE_DERIVED_RULES)
-	}, secrets);
+	};
+	return scrubResourceRecord(positioned, secrets);
 }
 async function updateWithRollbackRetry(provider, args, logicalId, logger, isInterrupted, secrets) {
 	if (provider.disableOuterRetry) return await withCurrentResourceSecrets(secrets, () => provider.update(...args));
@@ -34759,13 +34936,13 @@ const EMPTY_SECRETS = /* @__PURE__ */ new Map();
 * resource has been in flight for 5 minutes. Most CC API resources
 * complete in under a minute; 5m is the agreed elbow.
 */
-const DEFAULT_RESOURCE_WARN_AFTER_MS = 300 * 1e3;
+const DEFAULT_RESOURCE_WARN_AFTER_MS = 3e5;
 /**
 * Default per-resource hard timeout: abort after 30 minutes. Matches the
 * design doc — Custom-Resource-heavy stacks should pass `--resource-timeout 1h`
 * explicitly because the Custom Resource provider's polling cap is 1h.
 */
-const DEFAULT_RESOURCE_TIMEOUT_MS = 1800 * 1e3;
+const DEFAULT_RESOURCE_TIMEOUT_MS = 18e5;
 var InterruptedError = class extends Error {
 	constructor(reason = "user") {
 		super(reason === "user" ? "Deployment interrupted by user (Ctrl+C)" : "Deployment aborted after another resource failed");
@@ -35104,7 +35281,7 @@ var DeployEngine = class {
 		});
 		this.options.concurrency = options.concurrency ?? 10;
 		this.options.dryRun = options.dryRun ?? false;
-		this.options.lockTimeout = options.lockTimeout ?? 300 * 1e3;
+		this.options.lockTimeout = options.lockTimeout ?? 3e5;
 		this.options.noRollback = options.noRollback ?? false;
 		this.options.resourceWarnAfterMs = options.resourceWarnAfterMs ?? 3e5;
 		this.options.resourceTimeoutMs = options.resourceTimeoutMs ?? 18e5;
@@ -35119,6 +35296,7 @@ var DeployEngine = class {
 		this.perResourceSecrets = /* @__PURE__ */ new Map();
 		this.noEchoAttributeResources = /* @__PURE__ */ new Map();
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
+		this.attemptedResolvedProps = /* @__PURE__ */ new Map();
 		this.outputSecrets = /* @__PURE__ */ new Map();
 		this.outputsTemplateSource = {};
 		this.outputsSourceUsable = true;
@@ -35339,7 +35517,7 @@ var DeployEngine = class {
 			const ownSecrets = secrets ?? /* @__PURE__ */ new Map();
 			const next = { ...op };
 			if (next.properties) next.properties = redactSecretsForState(next.properties, ownSecrets, templateProps);
-			if (next.attemptedProperties) next.attemptedProperties = redactSecretsForState(next.attemptedProperties, ownSecrets, templateProps);
+			if (next.attemptedProperties) next.attemptedProperties = redactSecretsForState(markSameGenerationBag({ ...next.attemptedProperties }), ownSecrets, templateProps);
 			if (next.previousState) next.previousState = scrubResourceRecord(next.previousState, ownSecrets);
 			return next;
 		});
@@ -35427,7 +35605,7 @@ var DeployEngine = class {
 			const logicalId = entries[i][0];
 			const observed = resolved[i];
 			const target = stateResources[logicalId];
-			if (target && observed !== void 0) target.observedProperties = observed;
+			if (target && observed !== void 0) target.observedProperties = markSameGenerationBag({ ...observed });
 		}
 	}
 	/**
@@ -36361,7 +36539,8 @@ var DeployEngine = class {
 		if (!redirect) return;
 		const findings = findUnrewrittenAssetReferences(resolvedProps, redirect);
 		if (findings.length === 0) return;
-		throw new ProvisioningError(`Unrewritten asset reference on '${logicalId}' (${resourceType}): this region uses cdkd-owned asset storage, but the following resolved properties still point at the CDK bootstrap storage that 'cdk gc' may garbage-collect:\n${findings.map((f) => `  - ${f.path}: still references '${f.source}'`).join("\n")}\nThis is a template shape cdkd's asset-reference rewrite did not cover — deploying it would split-brain the stack (assets in cdkd storage, properties reading the CDK bucket). Please report this at https://github.com/go-to-k/cdkd/issues with the property shape. Workaround: deploy with --use-cdk-bootstrap-assets to pin the legacy destinations for this app.`, resourceType, logicalId);
+		const detail = findings.map((f) => `  - ${f.path}: still references '${f.source}'`).join("\n");
+		throw new ProvisioningError(`Unrewritten asset reference on '${logicalId}' (${resourceType}): this region uses cdkd-owned asset storage, but the following resolved properties still point at the CDK bootstrap storage that 'cdk gc' may garbage-collect:\n${detail}\nThis is a template shape cdkd's asset-reference rewrite did not cover — deploying it would split-brain the stack (assets in cdkd storage, properties reading the CDK bucket). Please report this at https://github.com/go-to-k/cdkd/issues with the property shape. Workaround: deploy with --use-cdk-bootstrap-assets to pin the legacy destinations for this app.`, resourceType, logicalId);
 	}
 	/**
 	* The `Snapshot`-policy gate every engine delete site runs BEFORE its
@@ -36503,7 +36682,7 @@ var DeployEngine = class {
 				recordNestedStackParameterExpressions(updateSecrets, resourceType, resolvedProps, desiredProps);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 				this.attemptedResolvedProps.set(logicalId, resolvedProps);
-				if (JSON.stringify(redactSecretsForState(resolvedProps, updateSecrets, desiredProps)) === JSON.stringify(currentPropsAsWritten)) {
+				if (JSON.stringify(redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps)) === JSON.stringify(currentPropsAsWritten)) {
 					if (change.attributeChanges && change.attributeChanges.length > 0) {
 						const attrSummary = change.attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
 						this.logger.info(`  ↻ ${logicalId} (${resourceType}) attribute update: ${attrSummary}`);
@@ -36733,7 +36912,8 @@ var DeployEngine = class {
 								createResult = await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replProvider.create(logicalId, resourceType, replProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replProvider);
 							} catch (createError) {
 								if (!retainOldOnReplace) throw new Error(maskSecretsInText(`Failed to create ${logicalId} after the UPDATE-not-supported replacement: the old resource (${currentResource.physicalId}) is now gone. Cause: ${createError instanceof Error ? createError.message : String(createError)}. Re-run the deploy to create it fresh.`, updateSecrets), { cause: createError instanceof Error ? createError : void 0 });
-								if (!isNameCollisionError(createError instanceof Error ? createError.message : String(createError))) throw createError;
+								const createMsg = createError instanceof Error ? createError.message : String(createError);
+								if (!isNameCollisionError(createMsg)) throw createError;
 								const nameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
 								throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement because the provisioning layer cannot update it in place — but its physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. ${nameOrigin.descriptor}. ${nameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed. Removing UpdateReplacePolicy: Retain lets cdkd delete the old resource first, which destroys it and any data it holds.`, "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
 							}
@@ -36782,8 +36962,10 @@ var DeployEngine = class {
 					const updateCaptureSiblings = await this.buildObservedCaptureSiblings(resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
 					this.kickOffObservedCapture(captureProvider, logicalId, result.physicalId, resourceType, resolvedProps, updateCaptureSiblings);
 					const updatePartial = updatePartialReason(result);
-					if (counts) if (updatePartial !== void 0) counts.updatePartial++;
-					else counts.updated++;
+					if (counts) {
+						if (updatePartial !== void 0) counts.updatePartial++;
+						else counts.updated++;
+					}
 					if (progress) progress.current++;
 					const updatePrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
 					renderer.removeTask(logicalId);
@@ -36903,9 +37085,9 @@ var DeployEngine = class {
 	* `cdkd export`, `cdkd state`.
 	*/
 	propertiesToRecord(desiredProperties, result, resourceType, provisionedBy) {
-		const effective = result.effectiveProperties ?? desiredProperties;
-		if (provisionedBy !== "sdk") return effective;
-		return withoutSilentDropProperties(resourceType, effective);
+		if (result.effectiveProperties) return provisionedBy === "sdk" ? withoutSilentDropProperties(resourceType, result.effectiveProperties) : result.effectiveProperties;
+		const written = provisionedBy === "sdk" ? withoutSilentDropProperties(resourceType, desiredProperties) : desiredProperties;
+		return markSameGenerationBag(written);
 	}
 	/**
 	* The name-origin half of the replacement-collision messages (issue #1636).
@@ -37285,7 +37467,7 @@ var DeployEngine = class {
 			if (!publishedOutputNames.has(outputKey)) continue;
 			this.outputsTemplateSource[outputKey] = output.Value;
 		}
-		return outputs;
+		return markSameGenerationBag(outputs);
 	}
 	buildDisplayOutputs(template, resolvedOutputs) {
 		const display = {};
@@ -37300,4 +37482,4 @@ var DeployEngine = class {
 
 //#endregion
 export { createMaskedRetryLogger as $, runDockerStreaming as $n, StackTerminationProtectionError as $r, carriesSecretMask as $t, WARM_THROUGHPUT_MEMBERS as A, rewriteTemplateAssetReferences as An, clearBucketRegionCache as Ar, replayWarn as At, yellow as B, validateContainerRepoName as Bn, DependencyError as Br, s3BucketWebsiteUrl as Bt, unsupportedFinalSnapshotError as C, shouldRetainResource as Cn, displaySafe as Cr, normalizeAwsTagsToCfn as Ct, isStatefulRecreateTargetForReplace as D, buildAssetRedirectMap as Dn, derivePartitionAndUrlSuffix as Dr, configBooleanRefusal as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, WorkGraph as En, canonicalizeRegion as Er, coerceCfnBoolean as Et, bold as F, getBootstrapMarkerKey as Fn, setAwsClients as Fr, producerRegionsFromState as Ft, secretBearingStateKeyWarning as G, describeDockerExecFailure as Gn, LocalStartServiceError as Gr, findSilentDropProperties as Gt, collectPublishedOutputNames as H, describeAwsFailure as Hn, DynamicReferenceRegionAmbiguousError as Hr, DiffCalculator as Ht, cyan as I, isCrossRegionRedirect as In, AssetError as Ir, s3BucketArn as It, IAMRoleProvider as J, formatDockerLoginError as Jn, PartialFailureError as Jr, DagBuilder as Jt, stateKeySecretExposure as K, describeDockerFailure as Kn, LockError as Kr, describeTypeWithThrottleRetry as Kt, gray as L, parseBootstrapMarker as Ln, CdkdError as Lr, s3BucketDomainName as Lt, isWarmThroughputDecrease as M, BOOTSTRAP_MARKER_PREFIX as Mn, AwsClients as Mr, requireConfigObject as Mt, toFiniteNumber as N, assertAssetBucketRegion as Nn, getAwsClients as Nr, requireConfigString as Nt, isStatefulRecreateTargetSync as O, createAssetRedirectResolver as On, AssemblyReader as Or, configStringRefusal as Ot, formatResourceLine as P, ensureAssetStorage as Pn, resetAwsClients as Pr, classifyReplaySecretRegion as Pt, wouldReturnToSdkProvider as Q, runDockerForeground as Qn, StackHasActiveImportsError as Qr, TEMPLATE_SOURCED_RULES as Qt, green as R, readBootstrapMarkerBody as Rn, ConfigError as Rr, s3BucketDualStackDomainName as Rt, refusesFinalSnapshot as S, importableOutputs as Sn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Sr, WAFv2WebACLProvider as St, extractDeploymentEventError as T, stringifyValue as Tn, PARTITION_TABLE as Tr, assertRegionMatch as Tt, exportAliasCollisionScrubWarning as U, buildDockerImage as Un, IntrinsicResolutionRefusalError as Ur, INTRINSIC_KEYS as Ut, collectDeclaredOutputNames as V, buildDenyExternalAccessPolicy as Vn, DeployCancelledError as Vr, applyRoleArnIfSet as Vt, isExportAliasCollision as W, describeDockerCapturedOutput as Wn, LocalInvokeBuildError as Wr, findActionableSilentDrops as Wt, clearOnUpdateRemoval as X, partitionSensitiveEnv as Xn, ResourceTimeoutError as Xr, STATE_SOURCED_CROSS_GENERATION_RULES as Xt, collectInlinePolicyNamesManagedBySiblings as Y, getDockerCmd as Yn, ProvisioningError as Yr, TemplateParser as Yt, ProviderRegistry as Z, redactDockerArgvValues as Zn, ResourceUpdateNotSupportedError as Zr, STATE_SOURCED_READBACK_RULES as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, shellQuote as _n, CFN_TEMPLATE_BODY_LIMIT as _r, coerceParameterTypedValue as _t, DeploymentEventsStore as a, withErrorHandling as ai, maskSecretsInText as an, synthesisStatusMessage as ar, isInterruptedWaitError as at, createPreDeleteFinalSnapshot as b, exportNamesCarriedFrom as bn, findLargeInlineResources as br, parameterTypeMayLoseSecretIdentity as bt, replayFailedOperations as c, isThrottlingError as ci, redactSecretsForState as cn, resolveApp as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, markRedactedCause as di, S3StateBackend as dn, resolveSkipPrefix as dr, deleteSkipReason as dt, StateError as ei, createSecretMasker as en, escapeRegExp$1 as er, maskDeep as et, withResourceDeadline as f, retryClassificationText as fi, rebuildClientForBucketRegion as fn, resolveStateBucketWithDefault as fr, disableInstanceApiTermination as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, forceQuitRecoveryClause as gn, warnDeprecatedNoPrefixCliFlag as gr, cfnRefValueFromPhysicalId as gt, computeImplicitDeleteEdges as h, buildLockContentionMessage as hn, stateBucketExistenceConfirmed as hr, carriesDynamicReference as ht, DeploymentEventsReader as i, normalizeAwsError as ii, maskSecretsInError as in, Synthesizer as ir, interruptWatchListenerCount as it, coerceWarmThroughput as j, AssetModeResolver as jn, resolveBucketRegion as jr, requireConfigArray as jt, renderStatefulReason as k, loadPublishableAssetManifest as kn, processStackMessages as kr, readConfigString as kt, replayRollback as l, isTransientServerError as li, scrubResourceRecord as ln, resolveAutoAssetStorage as lr, UNSPECIFIED_SKIP_REASON as lt, IMPLICIT_DELETE_DEPENDENCIES as m, buildForceUnlockCommand as mn, resolveUseCdkBootstrapAssets as mr, IntrinsicFunctionResolver as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, formatError as ni, errorCauseChain as nn, AssetManifestLoader as nr, beginCommandInterruptScope as nt, planFailedOps as o, isMarkedNonRetryable as oi, recordMaskOnlyValue as on, getDefaultStateBucketName as or, startInterruptWatch as ot, maskingRetryLogger as p, __exportAll as pi, UNRENDERABLE as pn, resolveStateBucketWithDefaultAndSource as pr, isTerminationProtectionPropagationError as pt, getCurrentResourceSecrets as q, dockerSpawnEnvWithSensitive as qn, NestedStackChildDirectDestroyError as qr, withRetry as qt, DeployEngine as r, isCdkdError as ri, isSingleDynamicReferenceToken as rn, getDockerImageBySourceHash as rr, endCommandInterruptScope as rt, planRollback as s, isRetryableTransientError as si, recoverMaskedOutput as sn, getLegacyStateBucketName as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, SynthesisError as ti, dynamicReferenceTokens as tn, stripControlChars as tr, maskerOrIdentity as tt, updatePartialMessage as u, markNonRetryable as ui, LockManager as un, resolveCaptureObservedState as ur, deleteIndeterminateGuards as ut, buildFinalSnapshotIdentifier as v, CUSTOM_RESOURCE_RESPONSE_PREFIX as vn, CFN_TEMPLATE_URL_LIMIT as vr, getAccountInfo as vt, makeCanonicalizePropertiesFn as w, AssetPublisher as wn, expectedOwnerParam as wr, resolveExplicitPhysicalId as wt, isFinalSnapshotError as x, importableOutputKeys as xn, uploadCfnTemplate as xr, refStateLookupFromResource as xt, ccRoutedFinalSnapshotError as y, DEFAULT_STATE_PREFIX as yn, MIGRATE_TMP_PREFIX as yr, isUnboundTemplateParameter as yt, red as z, validateAssetBucketName as zn, CrossAccountSecretRefusalError as zr, s3BucketRegionalDomainName as zt };
-//# sourceMappingURL=deploy-engine-DF3fAY6q.js.map
+//# sourceMappingURL=deploy-engine-Cxt3gn8N.js.map