@go-to-k/cdkd 0.288.6 → 0.289.0

package/dist/{deploy-engine-umIP3xus.js → deploy-engine-B6pEfNd9.js}

@@ -1,6 +1,6 @@
-import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-Dw-3y48G.js";
+import { d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName } from "./logger-D2Md1kTq.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-4xTzOaA1.js";
+import { t as getCdkdVersion } from "./version-CCKo6fK2.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -9054,7 +9054,8 @@ const STATE_SCHEMA_VERSIONS_READABLE = [
 	6,
 	7,
 	8,
-	9
+	9,
+	10
 ];
 /**
 * Returns true when a recorded `DeletionPolicy` should prevent cdkd from
@@ -9126,6 +9127,46 @@ function exportNamesCarriedFrom(previous) {
 function skippedOutputsCarriedFrom(previous) {
 	return previous.skippedOutputs === void 0 ? {} : { skippedOutputs: previous.skippedOutputs };
 }
+/**
+* Carry {@link StackState.orphans} across a rebuild that does not re-decide it
+* (issue #2934): absent stays absent, present stays as it was.
+*
+* **Every** field-enumerating `StackState` literal must spread this. The field
+* is the only record that a `Retain`-orphaned resource exists at all, so a save
+* that omits it does not merely lose a hint — it makes a live, billing AWS
+* resource untrackable and re-opens the deploy loop the record closes. That is
+* a stronger duty than {@link skippedOutputsCarriedFrom}'s, whose loss costs a
+* diff preview.
+*
+* Writers that re-DECIDE the set do not call this: the rollback arms append,
+* and the deploy drops an entry once it has been adopted or found absent from
+* AWS. Spread-form writers (`{ ...previous, ... }`) carry the field already and
+* need nothing.
+*/
+function orphansCarriedFrom(previous) {
+	return previous.orphans === void 0 ? {} : { orphans: previous.orphans };
+}
+/**
+* The `orphans` set a post-rollback save should persist (issue #2934): what the
+* record already carried, plus what THIS rollback just left in AWS.
+*
+* A merge rather than a carry, because a rollback both inherits and produces.
+* Keyed by `logicalId`, newest wins: a resource orphaned twice (deploy fails,
+* user retries, it fails again) has one live AWS resource, and the later record
+* describes the deploy that actually left it there. Keeping both would make the
+* next adoption pick arbitrarily between two states of the same resource.
+*
+* Returns `{}` when there is nothing on either side, so a stack that has never
+* orphaned anything keeps a byte-identical `state.json` and an old binary sees
+* exactly what it saw before.
+*/
+function orphansAfterRollback(previous, newlyOrphaned) {
+	if (previous.orphans === void 0 && newlyOrphaned.length === 0) return {};
+	const byLogicalId = /* @__PURE__ */ new Map();
+	for (const entry of previous.orphans ?? []) byLogicalId.set(entry.logicalId, entry);
+	for (const entry of newlyOrphaned) byLogicalId.set(entry.logicalId, entry);
+	return { orphans: [...byLogicalId.values()] };
+}
 
 //#endregion
 //#region src/types/rollback-journal.ts
@@ -9673,7 +9714,7 @@ var S3StateBackend = class {
 		const { expectedEtag, migrateLegacy } = options;
 		const body = {
 			...state,
-			version: 9,
+			version: 10,
 			stackName,
 			region
 		};
@@ -14726,13 +14767,22 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 * GENERATION as the observed bag beside them (issue #1917 review). Left
 * unspecified, the derivation below is right for every other caller, whose
 * `properties` reach this function untouched.
+*
+* That derivation's fail-closed arm asks TWO questions, not one — the secrets
+* map must be EMPTY and the observed bag must be one THIS RUN produced (issue
+* [#2906](https://github.com/go-to-k/cdkd/issues/2906)). A caller re-writing a
+* PRIOR generation's `observedProperties` unchanged therefore keeps it intact
+* rather than masking positions it cannot pair. A caller whose bag IS fresh but
+* which does not route it through {@link markSameGenerationBag} should pass
+* {@link STATE_SOURCED_BASELINE_RULES} through `observedRules` rather than lean
+* on the derivation.
 */
 function scrubResourceRecord(record, secrets, sourceProperties, observedRules) {
 	if (secrets.size === 0 && sourceProperties === void 0 && !record.observedProperties) return record;
 	const next = { ...record };
 	next.properties = redactSecretsForState(record.properties, secrets, sourceProperties);
 	if (record.attributes) next.attributes = redactSecretsForState(record.attributes, secrets);
-	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets, sourceProperties ?? next.properties, observedRules ?? (sourceProperties !== void 0 ? TEMPLATE_SOURCED_RULES : secrets.size === 0 ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES));
+	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets, sourceProperties ?? next.properties, observedRules ?? (sourceProperties !== void 0 ? TEMPLATE_SOURCED_RULES : secrets.size === 0 && isSameGenerationBag(record.observedProperties) ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES));
 	return next;
 }
 /**
@@ -27587,7 +27637,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CC6BMuNK.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-1XVtAjhm.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -31138,7 +31188,7 @@ var ProviderRegistry = class {
 	buildUnroutableSilentDropMessage(resourceType, drops) {
 		const details = drops.map((d) => `  - ${d.property}: ${d.rationale}`).join("\n");
 		const overrideHint = drops.map((d) => `${resourceType}:${d.property}`).join(",");
-		return `${resourceType} uses properties cdkd's SDK Provider does not handle, and this type cannot fall back to Cloud Control API (${isNonProvisionable(resourceType) ? "ProvisioningType: NON_PROVISIONABLE — Cloud Control has no handlers for it" : "the type's SDK provider opts out of the Cloud Control fallback (disableCcApiFallback)"}):\n${details}\nRemove the properties, or force the SDK provider path and accept the drop via --allow-unsupported-properties ${overrideHint} (the provider may still reject the resource if the property is required).`;
+		return `${resourceType} uses properties cdkd's SDK Provider does not handle, and this type cannot fall back to Cloud Control API (${isNonProvisionable(resourceType) ? "ProvisioningType: NON_PROVISIONABLE — Cloud Control has no handlers for it" : "the type's SDK provider opts out of the Cloud Control fallback (disableCcApiFallback)"}):\n${details}\nRemove the properties, or force the SDK provider path and accept the drop via --prefer-sdk-route ${overrideHint} (the provider may still reject the resource if the property is required).`;
 	}
 	/**
 	* Legacy entry point that returns just the provider. Delegates to
@@ -31295,15 +31345,23 @@ var ProviderRegistry = class {
 	reportSilentDropDecisions(resources) {
 		for (const { logicalId, resourceType, properties, provisionedBy } of resources) {
 			const drops = findSilentDropProperties(resourceType, properties);
-			const overridden = provisionedBy === "cc-api" && !STICKY_CC_MIGRATION_EXEMPT.has(resourceType) ? [] : findAcceptedSilentDrops(resourceType, properties, this.allowedUnsupportedProperties);
+			const stickyCc = provisionedBy === "cc-api" && !STICKY_CC_MIGRATION_EXEMPT.has(resourceType);
+			const overridden = stickyCc ? [] : findAcceptedSilentDrops(resourceType, properties, this.allowedUnsupportedProperties);
 			const autoRouted = drops.map(({ property }) => property).filter((property) => !this.allowedUnsupportedProperties.has(`${resourceType}:${property}`));
 			if (autoRouted.length > 0) {
 				const provider = this.providers.get(resourceType);
 				if (isNonProvisionable(resourceType) || provider?.disableCcApiFallback === true) throw new Error(`${logicalId}: ${this.buildUnroutableSilentDropMessage(resourceType, drops.filter((d) => autoRouted.includes(d.property)))}`);
-				const message = `${logicalId} (${resourceType}): routing via Cloud Control API (cdkd's SDK Provider does not yet wire ${autoRouted.join(", ")} — CC API will forward the full property map. Override via --allow-unsupported-properties ${autoRouted.map((p) => `${resourceType}:${p}`).join(",")}.)`;
+				const message = `${logicalId} (${resourceType}): routing via Cloud Control API (cdkd's SDK Provider does not yet wire ${autoRouted.join(", ")} — CC API will forward the full property map. Override via --prefer-sdk-route ${autoRouted.map((p) => `${resourceType}:${p}`).join(",")}.)`;
 				if (provisionedBy === "cc-api") this.logger.debug(message);
 				else this.logger.info(message);
 			}
+			const named = drops.map(({ property }) => property).filter((property) => this.allowedUnsupportedProperties.has(`${resourceType}:${property}`));
+			if (named.length > 0 && (stickyCc || autoRouted.length > 0)) {
+				const list = named.join(", ");
+				const isAre = named.length === 1 ? "is" : "are";
+				const [cause, remedy] = stickyCc ? ["this resource's state record already routes it to Cloud Control (provisionedBy: cc-api), which is decided before any property is consulted", "Returning this resource to the SDK provider is a destroy-and-recreate, not a flag change — see docs/cli-deploy-safety.md. Widening --prefer-sdk-route alone cannot do it."] : [`${autoRouted.join(", ")} ${autoRouted.length === 1 ? "is" : "are"} not covered by it, and one uncovered property routes the whole RESOURCE to Cloud Control`, `To keep the resource on its SDK provider, add ${autoRouted.map((p) => `${resourceType}:${p}`).join(",")} to --prefer-sdk-route as well.`];
+				this.logger.warn(`${logicalId} (${resourceType}): --prefer-sdk-route had no effect for ${list} — ${cause}. Cloud Control forwards the full property map, so ${list} ${isAre} written to AWS after all. ${remedy}`);
+			}
 			if (overridden.length > 0) {
 				const createOnly = getPropertyCoverage(resourceType)?.createOnlyDrops;
 				const reroutable = overridden.filter((p) => createOnly?.has(p) !== true);
@@ -31314,7 +31372,7 @@ var ProviderRegistry = class {
 					const one = needsRecreate.length === 1;
 					remedies.push(`${needsRecreate.join(", ")} ${one ? "is" : "are"} create-only, so removing the override does not apply ${one ? "it" : "them"} either -- a create-only property can only be applied by recreating the resource.`);
 				}
-				this.logger.warn(`${logicalId} (${resourceType}): ${overridden.join(", ")} will be silently dropped (--allow-unsupported-properties override accepted). ${remedies.join(" ")}`);
+				this.logger.warn(`${logicalId} (${resourceType}): ${overridden.join(", ")} will be silently dropped (--prefer-sdk-route override accepted). ${remedies.join(" ")}`);
 			}
 			this.reportUnrecognizedProperties(logicalId, resourceType, properties, {
 				provisionedBy,
@@ -31378,7 +31436,7 @@ var ProviderRegistry = class {
 		const propList = unrecognized.join(", ");
 		const overrideHint = unrecognized.map((p) => `${resourceType}:${p}`).join(",");
 		const one = unrecognized.length === 1;
-		this.logger.warn(`${logicalId} (${resourceType}): ${propList} ${one ? "is" : "are"} not in cdkd's CFn schema snapshot for this type, so ${one ? "it" : "they"} will NOT reach AWS — the deploy will still report success. Anything of these shapes looks the same here: a misspelled name (fix the spelling); a read-only attribute, which is not settable on any engine (remove it); or a property AWS published after cdkd's snapshot, which cdkd should be routing via Cloud Control — please report that one: ${unsupportedPropertyIssueUrl(resourceType, unrecognized[0])}${one ? "" : ` (link is for ${unrecognized[0]})`}. If the drop is intended — an addPropertyOverride escape hatch — silence this via --allow-unsupported-properties ${overrideHint}.`);
+		this.logger.warn(`${logicalId} (${resourceType}): ${propList} ${one ? "is" : "are"} not in cdkd's CFn schema snapshot for this type, so ${one ? "it" : "they"} will NOT reach AWS — the deploy will still report success. Anything of these shapes looks the same here: a misspelled name (fix the spelling); a read-only attribute, which is not settable on any engine (remove it); or a property AWS published after cdkd's snapshot, which cdkd should be routing via Cloud Control — please report that one: ${unsupportedPropertyIssueUrl(resourceType, unrecognized[0])}${one ? "" : ` (link is for ${unrecognized[0]})`}. If the drop is intended — an addPropertyOverride escape hatch — silence this via --prefer-sdk-route ${overrideHint}.`);
 	}
 	/**
 	* Pure-functional discovery of every resource whose template uses one or
@@ -33459,6 +33517,209 @@ var DagExecutor = class {
 	}
 };
 
+//#endregion
+//#region src/deployment/orphan-adoption.ts
+/**
+* True when the template still declares `logicalId` with `resourceType` and
+* supplies no explicit physical name for it.
+*
+* In that shape the name this deploy would generate equals the recorded
+* `physicalId` BY CONSTRUCTION — `generateResourceName` is deterministic over
+* exactly (stack name, logical id), truncation included, with no random
+* component. That matters because the engine cannot DERIVE the name to compare:
+* the per-type `ResourceNameOptions` live in the providers, and
+* `looksLikeCdkdGeneratedName`'s own doc records that the engine does not know
+* which type maps to which.
+*
+* An explicitly named resource is never adopted here. Two different reasons
+* converge on that: a template-supplied name may belong to someone else
+* entirely, and if the user CHANGED the name there is no collision to solve —
+* the ordinary CREATE succeeds and the orphan simply stays behind.
+*/
+function templateStillDeclares(template, record, nameProperties) {
+	const declared = template.Resources?.[record.logicalId];
+	if (!declared) return false;
+	if (declared.Type !== record.state.resourceType) return false;
+	const properties = declared.Properties ?? {};
+	return !nameProperties.some((p) => properties[p] !== void 0 && properties[p] !== null);
+}
+/**
+* Types the allow-list admits but adoption must still refuse (issue #2934).
+*
+* The primary gate asks "does cdkd derive a name for this type", which is the
+* by-construction premise restated. `AWS::Lambda::LayerVersion` passes it —
+* `FALLBACK_NAME_RULES` carries `LayerName` — while its provider records the
+* `LayerVersionArn` as the physical id (`lambda-layer-provider.ts:143`), so the
+* premise is false for it anyway. `AWS::ECS::TaskDefinition` is here as a BELT:
+* it is absent from both name tables today, so the primary gate already refuses
+* it, and an entry added there later (its `Family` is a plausible one) would
+* silently re-admit a type round 5 proved harmful.
+*
+* **Membership is decided by the three CONSEQUENCES, never by the id's SHAPE.**
+* An earlier revision of this doc said "the provider records an AWS-minted
+* identifier while `explicitNamePropertyFor` answers" — and at least six
+* admitted types satisfy that: `AWS::SNS::Topic` (ARN), `AWS::Cognito::UserPool`
+* (`userPoolId`), both ELBv2 types, `AWS::StepFunctions::StateMachine`,
+* `AWS::ECS::Service`. A maintainer applying it would add SNS Topic — the
+* module header's own motivating type — and gut the feature. The tests are:
+*
+*   1. the create API mints a NEW resource instead of colliding on the name, so
+*      there is no loop to break;
+*   2. `update()` refuses outright, so an adopted resource's next change is a
+*      REPLACEMENT;
+*   3. that replacement's delete destroys the very copy `DeletionPolicy: Retain`
+*      preserved.
+*
+* All three, together. SNS Topic fails (1): `CreateTopic` returns the EXISTING
+* topic rather than minting a new one, which is exactly the shape adoption is
+* for — and is why the module header calls it the type that "raises nothing at
+* all".
+*/
+const ADOPTION_REFUSED_TYPES = /* @__PURE__ */ new Set(["AWS::Lambda::LayerVersion", "AWS::ECS::TaskDefinition"]);
+/**
+* Decide what to do with each orphan record, before the diff runs.
+*
+* Ordering is load-bearing: the AWS existence check runs for EVERY record,
+* INDEPENDENTLY of whether the template still declares it. The reverse order
+* left a record whose logical id had left the template never checked, so it
+* never dropped — present, blocking nothing, surfacing nowhere, and with no
+* per-record command to clear it.
+*/
+async function planOrphanAdoption(params) {
+	const outcome = {
+		adopted: {},
+		remaining: [],
+		refusals: [],
+		notices: []
+	};
+	if (params.records.length === 0) return outcome;
+	let siblingClaims;
+	const claims = async () => siblingClaims ??= await params.readSiblingClaims();
+	for (const record of params.records) {
+		const { logicalId, state } = record;
+		if (params.managedLogicalIds.has(logicalId)) {
+			params.logger.debug(`orphan ${logicalId}: already present in state.resources — dropping the stale record`);
+			continue;
+		}
+		let provider;
+		try {
+			provider = params.getProvider(state.resourceType, state.provisionedBy);
+		} catch (error) {
+			outcome.remaining.push(record);
+			outcome.notices.push(`${logicalId} (${state.resourceType}) is still in AWS as ${state.physicalId} from an earlier rollback, but this build cannot route that type (${error instanceof Error ? error.message : String(error)}) — cdkd is not adopting it.`);
+			continue;
+		}
+		if (!provider.import) {
+			outcome.remaining.push(record);
+			outcome.notices.push(`${logicalId} (${state.resourceType}) was left in AWS by an earlier rollback as ${state.physicalId}, but its provider cannot verify it — cdkd is not adopting it.`);
+			continue;
+		}
+		let found;
+		try {
+			found = await provider.import({
+				logicalId,
+				resourceType: state.resourceType,
+				stackName: params.stackName,
+				region: params.region,
+				properties: state.properties,
+				knownPhysicalId: state.physicalId
+			});
+		} catch (error) {
+			outcome.notices.push(`${logicalId} (${state.resourceType}) is recorded as left in AWS as ${state.physicalId}, but cdkd could not confirm it exists (${error instanceof Error ? error.message : String(error)}) — keeping the record and not adopting it this run.`);
+			outcome.remaining.push(record);
+			continue;
+		}
+		if (found !== null && found.physicalId !== state.physicalId) {
+			outcome.remaining.push(record);
+			outcome.notices.push(`${logicalId} (${state.resourceType}): cdkd asked about ${state.physicalId} and its provider answered for ${found.physicalId} — not adopting.`);
+			continue;
+		}
+		if (found === null) {
+			params.logger.debug(`orphan ${logicalId}: ${state.physicalId} no longer exists in AWS — dropping the record`);
+			continue;
+		}
+		if (params.nameProperties(state.resourceType).length === 0 || ADOPTION_REFUSED_TYPES.has(state.resourceType)) {
+			outcome.remaining.push(record);
+			const why = ADOPTION_REFUSED_TYPES.has(state.resourceType) ? "a new deploy of it mints a new resource rather than colliding, and cdkd cannot update one in place — so adopting it would end in a replacement that destroys what DeletionPolicy: Retain preserved" : "cdkd does not derive that resource's physical name, so a new deploy mints a new resource instead of colliding";
+			outcome.notices.push(`${logicalId} (${state.resourceType}) is still in AWS as ${state.physicalId} from an earlier rollback. cdkd does not re-adopt this type: ${why}. Delete it yourself when you no longer need it.`);
+			continue;
+		}
+		if (!templateStillDeclares(params.template, record, params.nameProperties(state.resourceType))) {
+			outcome.remaining.push(record);
+			outcome.notices.push(`${logicalId} (${state.resourceType}) is still in AWS as ${state.physicalId} from an earlier rollback. This deploy does not create it under that name, so cdkd is leaving it alone.`);
+			continue;
+		}
+		if ((await claims()).has(state.physicalId)) {
+			outcome.refusals.push(`${logicalId}: ${state.physicalId} is already recorded by another cdkd stack. cdkd will not adopt a resource another stack manages.`);
+			outcome.remaining.push(record);
+			continue;
+		}
+		const refreshed = Object.create(null);
+		for (const [key, value] of Object.entries(found.attributes ?? {})) {
+			if (carriesSecretMask(value)) continue;
+			refreshed[key] = value;
+		}
+		const mergedAttributes = Object.create(null);
+		for (const [key, value] of Object.entries(refreshed)) mergedAttributes[key] = value;
+		for (const [key, value] of Object.entries(state.attributes ?? {})) mergedAttributes[key] = value;
+		outcome.adopted[logicalId] = {
+			...state,
+			...Object.keys(mergedAttributes).length > 0 || state.attributes ? { attributes: mergedAttributes } : {}
+		};
+	}
+	return outcome;
+}
+/**
+* Every physical id recorded by a cdkd stack OTHER than `selfStackName` in
+* `selfRegion` (issue #2934).
+*
+* The orphan record proves cdkd created something under a name; it cannot
+* prove no one has since taken that resource over. A `cdkd import` into a
+* different stack during the rollback-to-redeploy window would leave one
+* physical id in two state files, and either stack's `cdkd destroy` would
+* then delete the other's live resource. This is the check that refuses it.
+*
+* Best-effort per sibling: a state file that fails to load is SKIPPED rather
+* than failing the caller, because the alternative is that one unreadable
+* record in an unrelated stack blocks every adoption in the account. That
+* makes the result a lower bound on what is claimed — stated here because it
+* is the direction that can let a wrong adoption through, and the reason this
+* check is one of several rather than the only one.
+*
+* Reachability is bounded by what this backend can see: another ACCOUNT's
+* bucket, and a stack deployed against a different `--state-bucket`, are
+* invisible here by construction.
+*
+* SHARED by `cdkd deploy` and `cdkd diff` (issue go-to-k/cdkd#2943) rather
+* than copied: the two must agree on which records they refuse, or the
+* preview stops predicting the deploy — which is the defect that issue is
+* about. A second implementation is the way they would drift apart.
+*/
+function makeSiblingClaimReader(params) {
+	const { stateBackend, selfStackName, selfRegion, logger } = params;
+	return async () => {
+		const claimed = /* @__PURE__ */ new Set();
+		let refs;
+		try {
+			refs = await stateBackend.listStacks();
+		} catch (error) {
+			logger.debug(`orphan adoption: could not list sibling stacks — ${error instanceof Error ? error.message : String(error)}`);
+			return claimed;
+		}
+		for (const ref of refs) {
+			if (ref.stackName === selfStackName && ref.region === selfRegion) continue;
+			if (ref.region === void 0) continue;
+			try {
+				const sibling = await stateBackend.getState(ref.stackName, ref.region);
+				for (const record of Object.values(sibling?.state.resources ?? {})) claimed.add(record.physicalId);
+			} catch (error) {
+				logger.debug(`orphan adoption: skipping unreadable state for ${ref.stackName} — ${error instanceof Error ? error.message : String(error)}`);
+			}
+		}
+		return claimed;
+	};
+}
+
 //#endregion
 //#region src/types/deployment-events.ts
 /**
@@ -35085,7 +35346,8 @@ async function replayRollback(operations, stateResources, stackName, ctx, option
 	const result = {
 		failures: 0,
 		warnings: 0,
-		interrupted: false
+		interrupted: false,
+		orphaned: []
 	};
 	if (operations.length === 0) {
 		ctx.logger.info("No completed operations to roll back.");
@@ -35103,7 +35365,7 @@ async function replayRollback(operations, stateResources, stackName, ctx, option
 			result.interrupted = true;
 			break;
 		}
-		await replaySingle(otherOps[i], stateResources, stackName, ctx, resolver, orphanLogicalIds, result, options.afterOp, options.isInterrupted);
+		await replaySingle(otherOps[i], stateResources, stackName, ctx, resolver, orphanLogicalIds, result, options.onOrphan, options.afterOp, options.isInterrupted);
 	}
 	if (!result.interrupted && createOps.length > 0) {
 		const sorted = sortRollbackCreates(createOps, stateResources);
@@ -35112,7 +35374,7 @@ async function replayRollback(operations, stateResources, stackName, ctx, option
 				result.interrupted = true;
 				break;
 			}
-			await replaySingle(op, stateResources, stackName, ctx, resolver, orphanLogicalIds, result, options.afterOp, options.isInterrupted);
+			await replaySingle(op, stateResources, stackName, ctx, resolver, orphanLogicalIds, result, options.onOrphan, options.afterOp, options.isInterrupted);
 		}
 	}
 	ctx.logger.info("Rollback completed. Some resources may remain if deletion failed.");
@@ -35605,7 +35867,7 @@ function recordAfterRollbackUpdate(restored, result) {
 function recordedPropertiesAfterReplayCreate(restored, result) {
 	return result.effectiveProperties === void 0 ? restored.properties : { ...result.effectiveProperties };
 }
-async function replaySingle(op, stateResources, stackName, ctx, resolver, orphanLogicalIds, result, afterOp, isInterrupted) {
+async function replaySingle(op, stateResources, stackName, ctx, resolver, orphanLogicalIds, result, onOrphan, afterOp, isInterrupted) {
 	const action = classifyRollbackOp(op, stateResources, orphanLogicalIds);
 	const { logger } = ctx;
 	/**
@@ -35674,6 +35936,15 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				const record = stateResources[op.logicalId];
 				const orphanProvisionedBy = effectiveProvisionedBy(record, op.provisionedBy);
 				createRollbackRoute = orphanProvisionedBy;
+				if (record) {
+					const orphaned = {
+						logicalId: op.logicalId,
+						orphanedAt: Date.now(),
+						state: record
+					};
+					result.orphaned.push(orphaned);
+					onOrphan?.(orphaned);
+				}
 				delete stateResources[op.logicalId];
 				logger.info(`  Rollback: Leaving ${op.logicalId} (${op.resourceType}) in AWS (DeletionPolicy: Retain) — removed from state`);
 				await afterOp?.(op.logicalId);
@@ -35956,7 +36227,8 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 		failures: 0,
 		warnings: 0,
 		interrupted: false,
-		remainingFailedOps: []
+		remainingFailedOps: [],
+		orphaned: []
 	};
 	const { logger } = ctx;
 	const resolver = new ReplayResolvers(ctx.region);
@@ -35998,8 +36270,18 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 					result.warnings++;
 					break;
 				case "orphan-failed-create-retain": {
-					const orphanProvisionedBy = effectiveProvisionedBy(stateResources[op.logicalId], op.provisionedBy);
+					const failedCreateRecord = stateResources[op.logicalId];
+					const orphanProvisionedBy = effectiveProvisionedBy(failedCreateRecord, op.provisionedBy);
 					createRollbackRoute = orphanProvisionedBy;
+					if (failedCreateRecord) {
+						const orphaned = {
+							logicalId: op.logicalId,
+							orphanedAt: Date.now(),
+							state: failedCreateRecord
+						};
+						result.orphaned.push(orphaned);
+						options.onOrphan?.(orphaned);
+					}
 					delete stateResources[op.logicalId];
 					logger.info(`  Rollback: leaving partially-created ${op.logicalId} (${op.resourceType}) in AWS (DeletionPolicy: Retain) — removed from state`);
 					await options.afterOp?.(op.logicalId);
@@ -36919,6 +37201,20 @@ var DeployEngine = class DeployEngine {
 	*/
 	perResourceTemplateProps = /* @__PURE__ */ new Map();
 	/**
+	* The resource TYPE each logical id was resolved as during THIS deploy
+	* (issue #2934), the sibling of {@link perResourceSecrets} and
+	* {@link perResourceTemplateProps}.
+	*
+	* Exists only so the orphan-record redaction can tell "these needles belong
+	* to this record" from "a CDK refactor reused this logical id for a different
+	* resource". Keying that on `state.resources` instead was tried and is WRONG
+	* in the direction that matters: an orphan is by definition NOT in
+	* `resources`, so the gate read false for the record being minted, the
+	* needles went empty, and the plaintext survived into `state.json`. The
+	* real-AWS secret fixture caught it.
+	*/
+	perResourceResolvedType = /* @__PURE__ */ new Map();
+	/**
 	* Resolved secrets recorded while resolving the stack OUTPUTS (a `CfnOutput`
 	* whose Value resolves a `{{resolve:...}}` reference). Separate from the
 	* per-resource maps for the same anti-cross-contamination reason. Reset per
@@ -37051,6 +37347,7 @@ var DeployEngine = class DeployEngine {
 		this.perResourceSecrets = /* @__PURE__ */ new Map();
 		this.noEchoAttributeResources = /* @__PURE__ */ new Map();
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
+		this.perResourceResolvedType = /* @__PURE__ */ new Map();
 		this.attemptedResolvedProps = /* @__PURE__ */ new Map();
 		this.outputSecrets = /* @__PURE__ */ new Map();
 		this.outputsTemplateSource = Object.create(null);
@@ -37439,10 +37736,18 @@ var DeployEngine = class DeployEngine {
 			const templateProps = this.perResourceTemplateProps.get(logicalId);
 			resources[logicalId] = scrubResourceRecord(record, secrets ?? /* @__PURE__ */ new Map(), templateProps);
 		}
+		const orphans = state.orphans?.map((entry) => {
+			const sameResource = this.perResourceResolvedType.get(entry.logicalId) === entry.state.resourceType;
+			return {
+				...entry,
+				state: scrubResourceRecord(entry.state, (sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), sameResource ? this.perResourceTemplateProps.get(entry.logicalId) : void 0)
+			};
+		});
 		return {
 			...state,
 			resources,
-			outputs: this.redactOutputs(state.outputs)
+			outputs: this.redactOutputs(state.outputs),
+			...orphans === void 0 ? {} : { orphans }
 		};
 	}
 	/**
@@ -37615,14 +37920,20 @@ var DeployEngine = class DeployEngine {
 		if (this.options.captureObservedState !== true) return;
 		if (this.options.dryRun === true) return;
 		let toRefresh = 0;
+		let refused = 0;
 		const candidates = [];
 		for (const [logicalId, resource] of Object.entries(stateResources)) {
 			if (resource.observedProperties !== void 0) continue;
+			if (resource.observedBaselineRefused === true) {
+				refused++;
+				continue;
+			}
 			candidates.push({
 				logicalId,
 				resource
 			});
 		}
+		if (refused > 0) this.logger.debug(`observed-properties auto-refresh SKIPPED for ${refused} resource(s) whose baseline a 'cdkd import' run refused (issue #2944): their recorded properties cannot position the redaction, so capturing an AWS readback against them could persist a resolved secret in plaintext. A deploy that actually CHANGES one of them restores its baseline; a NO_CHANGE deploy does not.`);
 		if (candidates.length === 0) return;
 		const allSiblings = {};
 		for (const [lid, res] of Object.entries(stateResources)) allSiblings[lid] = {
@@ -37672,7 +37983,7 @@ var DeployEngine = class DeployEngine {
 			renderer.start();
 			const currentStateData = await this.stateBackend.getState(stackName, this.stackRegion);
 			const currentState = currentStateData?.state ?? {
-				version: 9,
+				version: 10,
 				region: this.stackRegion,
 				stackName,
 				resources: {},
@@ -37707,6 +38018,9 @@ var DeployEngine = class DeployEngine {
 			const conditions = await this.resolver.evaluateConditions(context);
 			this.logger.debug(`Evaluated ${Object.keys(conditions).length} conditions: ${Object.keys(conditions).join(", ")}`);
 			const effectiveTemplate = this.templateParser.filterResourcesByCondition(template, conditions);
+			const orphanCountBeforeAdoption = (currentState.orphans ?? []).length;
+			const orphanPlan = await this.adoptRollbackOrphans(currentState, effectiveTemplate);
+			const orphansChanged = Object.keys(orphanPlan.adopted).length > 0 || (currentState.orphans ?? []).length !== orphanCountBeforeAdoption;
 			const resourceTypes = new Set(Object.values(effectiveTemplate.Resources || {}).map((r) => r.Type).filter((type) => type !== "AWS::CDK::Metadata"));
 			this.providerRegistry.validateResourceTypes(resourceTypes);
 			this.logger.debug(`All resource types validated`);
@@ -37750,12 +38064,13 @@ var DeployEngine = class DeployEngine {
 					const observedRefresh = this.observedCaptureTasks.size > 0;
 					if (observedRefresh) await this.drainObservedCaptures(currentState.resources);
 					const skippedOutputsChanged = !skippedOutputsEqual(currentState.skippedOutputs, this.skippedOutputs);
-					if (observedRefresh || outputsChanged || exportSetChanged || skippedOutputsChanged) try {
+					if (observedRefresh || outputsChanged || exportSetChanged || skippedOutputsChanged || orphansChanged) try {
 						const refreshedState = {
-							version: 9,
+							version: 10,
 							region: this.stackRegion,
 							stackName: currentState.stackName,
 							resources: currentState.resources,
+							...orphansCarriedFrom(currentState),
 							outputs: outputsChanged ? resolvedOutputs : persistedOutputs,
 							...resolutionFailed ? exportNamesCarriedFrom(currentState) : { exportNames: [...this.resolvedExportNames] },
 							...this.skippedOutputs && { skippedOutputs: { ...this.skippedOutputs } },
@@ -37876,13 +38191,14 @@ var DeployEngine = class DeployEngine {
 			saveChain = saveChain.then(async () => {
 				try {
 					const partialState = {
-						version: 9,
+						version: 10,
 						region: this.stackRegion,
 						stackName: currentState.stackName,
 						resources: newResources,
 						outputs: currentState.outputs,
 						...exportNamesCarriedFrom(currentState),
 						...skippedOutputsCarriedFrom(currentState),
+						...orphansCarriedFrom(currentState),
 						...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 						lastModified: Date.now()
 					};
@@ -38009,13 +38325,14 @@ var DeployEngine = class DeployEngine {
 			const initialDeploy = currentEtag === void 0;
 			try {
 				const preRollbackState = {
-					version: 9,
+					version: 10,
 					region: this.stackRegion,
 					stackName: currentState.stackName,
 					resources: newResources,
 					outputs: currentState.outputs,
 					...exportNamesCarriedFrom(currentState),
 					...skippedOutputsCarriedFrom(currentState),
+					...orphansCarriedFrom(currentState),
 					...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 					lastModified: Date.now()
 				};
@@ -38031,6 +38348,7 @@ var DeployEngine = class DeployEngine {
 				this.logger.warn(`Failed to save partial state before rollback: ${saveError instanceof Error ? saveError.message : String(saveError)}`);
 			}
 			let autoRollbackClean = false;
+			let rollbackOrphans = [];
 			if (error instanceof InterruptedError || isInterruptedWaitError(error)) {
 				await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "interrupted", initialDeploy);
 				this.logger.info(`Partial state saved (${Object.keys(newResources).length} resources). Run deploy again to resume, 'cdkd rollback' to revert, or destroy to clean up.`);
@@ -38042,17 +38360,20 @@ var DeployEngine = class DeployEngine {
 				this.logger.warn("Partial state has been saved. Run 'cdkd deploy' to resume, 'cdkd rollback' to revert, or destroy to clean up.");
 			} else {
 				await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "auto-rollback-started", initialDeploy);
-				autoRollbackClean = (await this.performRollback(completedOperations, newResources, stackName, currentState)).failures === 0;
+				const rollbackResult = await this.performRollback(completedOperations, newResources, stackName, currentState);
+				autoRollbackClean = rollbackResult.failures === 0;
+				rollbackOrphans = rollbackResult.orphaned;
 			}
 			try {
 				const postRollbackState = {
-					version: 9,
+					version: 10,
 					region: this.stackRegion,
 					stackName: currentState.stackName,
 					resources: newResources,
 					outputs: currentState.outputs,
 					...exportNamesCarriedFrom(currentState),
 					...skippedOutputsCarriedFrom(currentState),
+					...orphansAfterRollback(currentState, rollbackOrphans),
 					...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 					lastModified: Date.now()
 				};
@@ -38064,13 +38385,14 @@ var DeployEngine = class DeployEngine {
 				try {
 					const freshEtag = (await this.stateBackend.getState(stackName, this.stackRegion))?.etag;
 					const postRollbackState = {
-						version: 9,
+						version: 10,
 						region: this.stackRegion,
 						stackName: currentState.stackName,
 						resources: newResources,
 						outputs: currentState.outputs,
 						...exportNamesCarriedFrom(currentState),
 						...skippedOutputsCarriedFrom(currentState),
+						...orphansAfterRollback(currentState, rollbackOrphans),
 						...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 						lastModified: Date.now()
 					};
@@ -38096,10 +38418,11 @@ var DeployEngine = class DeployEngine {
 		}
 		return {
 			state: {
-				version: 9,
+				version: 10,
 				region: this.stackRegion,
 				stackName: currentState.stackName,
 				resources: newResources,
+				...orphansCarriedFrom(currentState),
 				outputs,
 				exportNames: [...this.resolvedExportNames],
 				...this.skippedOutputs && { skippedOutputs: { ...this.skippedOutputs } },
@@ -38135,13 +38458,14 @@ var DeployEngine = class DeployEngine {
 	*/
 	async persistStateAfterOutputFailure(stackName, currentState, newResources, currentEtag, pendingMigration) {
 		const buildState = () => ({
-			version: 9,
+			version: 10,
 			region: this.stackRegion,
 			stackName: currentState.stackName,
 			resources: newResources,
 			outputs: currentState.outputs,
 			...exportNamesCarriedFrom(currentState),
 			...skippedOutputsCarriedFrom(currentState),
+			...orphansCarriedFrom(currentState),
 			...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 			lastModified: Date.now()
 		});
@@ -38169,11 +38493,60 @@ var DeployEngine = class DeployEngine {
 	* command drives identical semantics). Thin wrapper that builds the
 	* executor context from the engine's collaborators and delegates.
 	*/
+	/**
+	* Re-adopt what a previous rollback left in AWS, before the diff runs
+	* (issue #2934).
+	*
+	* MUTATES `currentState`: adopted records go into `resources` so the diff
+	* sees them, and `orphans` is replaced by the surviving set so every save
+	* on every path below persists the same object. Mutation rather than a
+	* returned copy because `currentState` is read by ~a dozen later sites and
+	* threading a second binding through all of them is how one gets missed.
+	*
+	* Refusals THROW. A record whose name this deploy is about to request, that
+	* cdkd cannot vouch for, is exactly the go-to-k/cdkd#2916 situation: letting
+	* the deploy run would collide and roll back anyway, adding another orphan
+	* on the way.
+	*/
+	async adoptRollbackOrphans(currentState, effectiveTemplate) {
+		const records = currentState.orphans ?? [];
+		const plan = await planOrphanAdoption({
+			records,
+			managedLogicalIds: new Set(Object.keys(currentState.resources)),
+			template: effectiveTemplate,
+			stackName: currentState.stackName,
+			region: this.stackRegion,
+			getProvider: (type, provisionedBy) => this.providerRegistry.getProviderFor({
+				resourceType: type,
+				...provisionedBy !== void 0 && { provisionedBy }
+			}).provider,
+			nameProperties: (type) => {
+				const property = explicitNamePropertyFor(type);
+				return property === void 0 ? [] : [property];
+			},
+			readSiblingClaims: makeSiblingClaimReader({
+				stateBackend: this.stateBackend,
+				selfStackName: currentState.stackName,
+				selfRegion: this.stackRegion,
+				logger: this.logger
+			}),
+			logger: { debug: (m) => this.logger.debug(m) }
+		});
+		for (const notice of plan.notices) this.logger.info(notice);
+		if (plan.refusals.length > 0) throw new Error(`Deploy refused — cdkd left ${plan.refusals.length} resource(s) in AWS that it cannot safely re-adopt:\n  ${plan.refusals.join("\n  ")}`);
+		for (const [logicalId, record] of Object.entries(plan.adopted)) {
+			currentState.resources[logicalId] = record;
+			this.logger.info(`Adopting ${logicalId} (${record.resourceType}) left in AWS by an earlier rollback as ${record.physicalId}`);
+		}
+		if (records.length > 0) currentState.orphans = plan.remaining;
+		return plan;
+	}
 	async performRollback(completedOperations, stateResources, stackName, previousState) {
 		const result = await replayRollback(completedOperations, stateResources, stackName, this.rollbackExecutorContext(previousState));
 		return {
 			failures: result.failures,
-			warnings: result.warnings
+			warnings: result.warnings,
+			orphaned: result.orphaned
 		};
 	}
 	/**
@@ -38556,6 +38929,7 @@ var DeployEngine = class DeployEngine {
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
 				this.refuseRedactedAttributeReads(logicalId, resourceType, context);
 				this.perResourceTemplateProps.set(logicalId, desiredProps);
+				this.perResourceResolvedType.set(logicalId, resourceType);
 				const createSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
 				recordNestedStackParameterExpressions(createSecrets, resourceType, resolvedProps, desiredProps);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
@@ -38606,6 +38980,7 @@ var DeployEngine = class DeployEngine {
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
 				this.refuseRedactedAttributeReads(logicalId, resourceType, context);
 				this.perResourceTemplateProps.set(logicalId, desiredProps);
+				this.perResourceResolvedType.set(logicalId, resourceType);
 				recordNestedStackParameterExpressions(updateSecrets, resourceType, resolvedProps, desiredProps);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 				this.attemptedResolvedProps.set(logicalId, resolvedProps);
@@ -39595,5 +39970,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { ProviderRegistry as $, formatDockerLoginError as $n, PartialFailureError as $r, STATE_SOURCED_BASELINE_RULES as $t, renderStatefulReason as A, stringifyValue as An, PARTITION_TABLE as Ar, configStringRefusal as At, red as B, getBootstrapMarkerKey as Bn, setAwsClients as Br, s3BucketDomainName as Bt, refusesFinalSnapshot as C, CUSTOM_RESOURCE_RESPONSE_PREFIX as Cn, CFN_TEMPLATE_URL_LIMIT as Cr, refStateLookupFromResource as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, importableOutputs as Dn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Dr, assertRegionMatch as Dt, extractDeploymentEventError as E, importableOutputKeys as En, uploadCfnTemplate as Er, resolveExplicitPhysicalId as Et, formatResourceLine as F, rewriteTemplateAssetReferences as Fn, clearBucketRegionCache as Fr, requireConfigString as Ft, isExportAliasCollision as G, validateContainerRepoName as Gn, DependencyError as Gr, DiffCalculator as Gt, collectDeclaredOutputNames as H, parseBootstrapMarker as Hn, CdkdError as Hr, s3BucketRegionalDomainName as Ht, bold as I, AssetModeResolver as In, resolveBucketRegion as Ir, classifyReplaySecretRegion as It, secretSafeKeyDisplay as J, buildDockerImage as Jn, IntrinsicResolutionRefusalError as Jr, findSilentDropProperties as Jt, secretBearing as K, buildDenyExternalAccessPolicy as Kn, DeployCancelledError as Kr, INTRINSIC_KEYS as Kt, cyan as L, BOOTSTRAP_MARKER_PREFIX as Ln, AwsClients as Lr, producerRegionsFromState as Lt, coerceWarmThroughput as M, buildAssetRedirectMap as Mn, derivePartitionAndUrlSuffix as Mr, replayWarn as Mt, isWarmThroughputDecrease as N, createAssetRedirectResolver as Nn, AssemblyReader as Nr, requireConfigArray as Nt, isStatefulRecreateTargetForReplace as O, shouldRetainResource as On, displaySafe as Or, coerceCfnBoolean as Ot, toFiniteNumber as P, loadPublishableAssetManifest as Pn, processStackMessages as Pr, requireConfigObject as Pt, clearOnUpdateRemoval as Q, dockerSpawnEnvWithSensitive as Qn, NestedStackChildDirectDestroyError as Qr, TemplateParser as Qt, gray as R, assertAssetBucketRegion as Rn, getAwsClients as Rr, withSharedDrainBudget as Rt, isFinalSnapshotError as S, shellQuote as Sn, CFN_TEMPLATE_BODY_LIMIT as Sr, parameterTypeMayLoseSecretIdentity as St, makeCanonicalizePropertiesFn as T, exportNamesCarriedFrom as Tn, findLargeInlineResources as Tr, normalizeAwsTagsToCfn as Tt, collectPublishedOutputNames as U, readBootstrapMarkerBody as Un, ConfigError as Ur, s3BucketWebsiteUrl as Ut, yellow as V, isCrossRegionRedirect as Vn, AssetError as Vr, s3BucketDualStackDomainName as Vt, exportAliasCollisionScrubWarning as W, validateAssetBucketName as Wn, CrossAccountSecretRefusalError as Wr, applyRoleArnIfSet as Wt, IAMRoleProvider as X, describeDockerExecFailure as Xn, LocalStartServiceError as Xr, withRetry as Xt, getCurrentResourceSecrets as Y, describeDockerCapturedOutput as Yn, LocalInvokeBuildError as Yr, describeTypeWithThrottleRetry as Yt, collectInlinePolicyNamesManagedBySiblings as Z, describeDockerFailure as Zn, LockError as Zr, DagBuilder as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, retryClassificationText as _i, rebuildClientForBucketRegion as _n, resolveStateBucketWithDefault as _r, carriesDynamicReference as _t, DeploymentEventsStore as a, StateError as ai, dynamicReferenceTokens as an, escapeRegExp$1 as ar, endCommandInterruptScope as at, ccRoutedFinalSnapshotError as b, buildLockContentionMessage as bn, stateBucketExistenceConfirmed as br, getAccountInfo as bt, replayFailedOperations as c, isCdkdError as ci, isSingleDynamicReferenceToken as cn, getDockerImageBySourceHash as cr, startInterruptWatch as ct, updatePartialReason as d, isMarkedNonRetryable as di, recordMaskOnlyValue as dn, getDefaultStateBucketName as dr, UNSPECIFIED_SKIP_REASON as dt, ProvisioningError as ei, STATE_SOURCED_CROSS_GENERATION_RULES as en, getDockerCmd as er, wouldReturnToSdkProvider as et, withResourceDeadline as f, isRetryableTransientError as fi, recoverMaskedOutput as fn, getLegacyStateBucketName as fr, deleteIndeterminateGuards as ft, bindingSkippedOutputs as g, markRedactedCause as gi, S3StateBackend as gn, resolveSkipPrefix as gr, IntrinsicFunctionResolver as gt, computeImplicitDeleteEdges as h, markNonRetryable as hi, LockManager as hn, resolveCaptureObservedState as hr, isTerminationProtectionPropagationError as ht, DeploymentEventsReader as i, StackTerminationProtectionError as ii, createSecretMasker as in, runDockerStreaming as ir, beginCommandInterruptScope as it, WARM_THROUGHPUT_MEMBERS as j, WorkGraph as jn, canonicalizeRegion as jr, readConfigString as jt, isStatefulRecreateTargetSync as k, AssetPublisher as kn, expectedOwnerParam as kr, configBooleanRefusal as kt, replayRollback as l, normalizeAwsError as li, maskSecretsInError as ln, Synthesizer as lr, CloudControlProvider as lt, IMPLICIT_DELETE_DEPENDENCIES as m, isTransientServerError as mi, scrubResourceRecord as mn, resolveAutoAssetStorage as mr, disableInstanceApiTermination as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, ResourceUpdateNotSupportedError as ni, TEMPLATE_SOURCED_RULES as nn, redactDockerArgvValues as nr, maskDeep as nt, planFailedOps as o, SynthesisError as oi, errorCauseChain as on, stripControlChars as or, interruptWatchListenerCount as ot, maskingRetryLogger as p, isThrottlingError as pi, redactSecretsForState as pn, resolveApp as pr, deleteSkipReason as pt, secretBearingStateKeyWarning as q, describeAwsFailure as qn, DynamicReferenceRegionAmbiguousError as qr, findActionableSilentDrops as qt, DeployEngine as r, StackHasActiveImportsError as ri, carriesSecretMask as rn, runDockerForeground as rr, maskerOrIdentity as rt, planRollback as s, formatError as si, identityKeyFor as sn, AssetManifestLoader as sr, isInterruptedWaitError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, ResourceTimeoutError as ti, STATE_SOURCED_READBACK_RULES as tn, partitionSensitiveEnv as tr, createMaskedRetryLogger as tt, updatePartialMessage as u, withErrorHandling as ui, maskSecretsInText as un, synthesisStatusMessage as ur, slowCcOperationTimeoutMs as ut, PRE_DELETE_SNAPSHOT_TYPES as v, __exportAll as vi, UNRENDERABLE as vn, resolveStateBucketWithDefaultAndSource as vr, cfnRefValueFromPhysicalId as vt, unsupportedFinalSnapshotError as w, DEFAULT_STATE_PREFIX as wn, MIGRATE_TMP_PREFIX as wr, WAFv2WebACLProvider as wt, createPreDeleteFinalSnapshot as x, forceQuitRecoveryClause as xn, warnDeprecatedNoPrefixCliFlag as xr, isUnboundTemplateParameter as xt, buildFinalSnapshotIdentifier as y, buildForceUnlockCommand as yn, resolveUseCdkBootstrapAssets as yr, coerceParameterTypedValue as yt, green as z, ensureAssetStorage as zn, resetAwsClients as zr, s3BucketArn as zt };
-//# sourceMappingURL=deploy-engine-umIP3xus.js.map
+export { collectInlinePolicyNamesManagedBySiblings as $, describeDockerCapturedOutput as $n, LocalInvokeBuildError as $r, DagBuilder as $t, isStatefulRecreateTargetForReplace as A, orphansAfterRollback as An, uploadCfnTemplate as Ar, coerceCfnBoolean as At, gray as B, AssetModeResolver as Bn, resolveBucketRegion as Br, withSharedDrainBudget as Bt, refusesFinalSnapshot as C, forceQuitRecoveryClause as Cn, resolveUseCdkBootstrapAssets as Cr, isUnboundTemplateParameter as Ct, makeSiblingClaimReader as D, exportNamesCarriedFrom as Dn, CFN_TEMPLATE_URL_LIMIT as Dr, normalizeAwsTagsToCfn as Dt, extractDeploymentEventError as E, DEFAULT_STATE_PREFIX as En, CFN_TEMPLATE_BODY_LIMIT as Er, WAFv2WebACLProvider as Et, isWarmThroughputDecrease as F, WorkGraph as Fn, canonicalizeRegion as Fr, requireConfigArray as Ft, collectPublishedOutputNames as G, isCrossRegionRedirect as Gn, AssetError as Gr, s3BucketWebsiteUrl as Gt, red as H, assertAssetBucketRegion as Hn, getAwsClients as Hr, s3BucketDomainName as Ht, toFiniteNumber as I, buildAssetRedirectMap as In, derivePartitionAndUrlSuffix as Ir, requireConfigObject as It, secretBearing as J, validateAssetBucketName as Jn, CrossAccountSecretRefusalError as Jr, INTRINSIC_KEYS as Jt, exportAliasCollisionScrubWarning as K, parseBootstrapMarker as Kn, CdkdError as Kr, applyRoleArnIfSet as Kt, formatResourceLine as L, createAssetRedirectResolver as Ln, AssemblyReader as Lr, requireConfigString as Lt, renderStatefulReason as M, shouldRetainResource as Mn, displaySafe as Mr, configStringRefusal as Mt, WARM_THROUGHPUT_MEMBERS as N, AssetPublisher as Nn, expectedOwnerParam as Nr, readConfigString as Nt, planOrphanAdoption as O, importableOutputKeys as On, MIGRATE_TMP_PREFIX as Or, resolveExplicitPhysicalId as Ot, coerceWarmThroughput as P, stringifyValue as Pn, PARTITION_TABLE as Pr, replayWarn as Pt, IAMRoleProvider as Q, buildDockerImage as Qn, IntrinsicResolutionRefusalError as Qr, withRetry as Qt, bold as R, loadPublishableAssetManifest as Rn, processStackMessages as Rr, classifyReplaySecretRegion as Rt, isFinalSnapshotError as S, __exportAll as Si, buildLockContentionMessage as Sn, resolveStateBucketWithDefaultAndSource as Sr, getAccountInfo as St, makeCanonicalizePropertiesFn as T, CUSTOM_RESOURCE_RESPONSE_PREFIX as Tn, warnDeprecatedNoPrefixCliFlag as Tr, refStateLookupFromResource as Tt, yellow as U, ensureAssetStorage as Un, resetAwsClients as Ur, s3BucketDualStackDomainName as Ut, green as V, BOOTSTRAP_MARKER_PREFIX as Vn, AwsClients as Vr, s3BucketArn as Vt, collectDeclaredOutputNames as W, getBootstrapMarkerKey as Wn, setAwsClients as Wr, s3BucketRegionalDomainName as Wt, secretSafeKeyDisplay as X, buildDenyExternalAccessPolicy as Xn, DeployCancelledError as Xr, findSilentDropProperties as Xt, secretBearingStateKeyWarning as Y, validateContainerRepoName as Yn, DependencyError as Yr, findActionableSilentDrops as Yt, getCurrentResourceSecrets as Z, describeAwsFailure as Zn, DynamicReferenceRegionAmbiguousError as Zr, describeTypeWithThrottleRetry as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, isThrottlingError as _i, LockManager as _n, resolveApp as _r, isTerminationProtectionPropagationError as _t, DeploymentEventsStore as a, ResourceTimeoutError as ai, carriesSecretMask as an, partitionSensitiveEnv as ar, maskerOrIdentity as at, ccRoutedFinalSnapshotError as b, markRedactedCause as bi, UNRENDERABLE as bn, resolveSkipPrefix as br, cfnRefValueFromPhysicalId as bt, replayFailedOperations as c, StackTerminationProtectionError as ci, errorCauseChain as cn, runDockerStreaming as cr, interruptWatchListenerCount as ct, updatePartialReason as d, formatError as di, maskSecretsInError as dn, AssetManifestLoader as dr, CloudControlProvider as dt, LocalStartServiceError as ei, TemplateParser as en, describeDockerExecFailure as er, clearOnUpdateRemoval as et, withResourceDeadline as f, isCdkdError as fi, maskSecretsInText as fn, getDockerImageBySourceHash as fr, slowCcOperationTimeoutMs as ft, bindingSkippedOutputs as g, isRetryableTransientError as gi, scrubResourceRecord as gn, getLegacyStateBucketName as gr, disableInstanceApiTermination as gt, computeImplicitDeleteEdges as h, isMarkedNonRetryable as hi, redactSecretsForState as hn, getDefaultStateBucketName as hr, deleteSkipReason as ht, DeploymentEventsReader as i, ProvisioningError as ii, TEMPLATE_SOURCED_RULES as in, getDockerCmd as ir, maskDeep as it, isStatefulRecreateTargetSync as j, orphansCarriedFrom as jn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as jr, configBooleanRefusal as jt, MULTI_REGION_RECREATE_BLOCKED_TYPES as k, importableOutputs as kn, findLargeInlineResources as kr, assertRegionMatch as kt, replayRollback as l, StateError as li, identityKeyFor as ln, escapeRegExp$1 as lr, isInterruptedWaitError as lt, IMPLICIT_DELETE_DEPENDENCIES as m, withErrorHandling as mi, recoverMaskedOutput as mn, synthesisStatusMessage as mr, deleteIndeterminateGuards as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, NestedStackChildDirectDestroyError as ni, STATE_SOURCED_CROSS_GENERATION_RULES as nn, dockerSpawnEnvWithSensitive as nr, wouldReturnToSdkProvider as nt, planFailedOps as o, ResourceUpdateNotSupportedError as oi, createSecretMasker as on, redactDockerArgvValues as or, beginCommandInterruptScope as ot, maskingRetryLogger as p, normalizeAwsError as pi, recordMaskOnlyValue as pn, Synthesizer as pr, UNSPECIFIED_SKIP_REASON as pt, isExportAliasCollision as q, readBootstrapMarkerBody as qn, ConfigError as qr, DiffCalculator as qt, DeployEngine as r, PartialFailureError as ri, STATE_SOURCED_READBACK_RULES as rn, formatDockerLoginError as rr, createMaskedRetryLogger as rt, planRollback as s, StackHasActiveImportsError as si, dynamicReferenceTokens as sn, runDockerForeground as sr, endCommandInterruptScope as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, LockError as ti, STATE_SOURCED_BASELINE_RULES as tn, describeDockerFailure as tr, ProviderRegistry as tt, updatePartialMessage as u, SynthesisError as ui, isSingleDynamicReferenceToken as un, stripControlChars as ur, startInterruptWatch as ut, PRE_DELETE_SNAPSHOT_TYPES as v, isTransientServerError as vi, S3StateBackend as vn, resolveAutoAssetStorage as vr, IntrinsicFunctionResolver as vt, unsupportedFinalSnapshotError as w, shellQuote as wn, stateBucketExistenceConfirmed as wr, parameterTypeMayLoseSecretIdentity as wt, createPreDeleteFinalSnapshot as x, retryClassificationText as xi, buildForceUnlockCommand as xn, resolveStateBucketWithDefault as xr, coerceParameterTypedValue as xt, buildFinalSnapshotIdentifier as y, markNonRetryable as yi, rebuildClientForBucketRegion as yn, resolveCaptureObservedState as yr, carriesDynamicReference as yt, cyan as z, rewriteTemplateAssetReferences as zn, clearBucketRegionCache as zr, producerRegionsFromState as zt };
+//# sourceMappingURL=deploy-engine-B6pEfNd9.js.map