@go-to-k/cdkd 0.290.32 → 0.290.34

package/dist/{deploy-engine-CfOsVRQB.js → deploy-engine-efiVJ-rX.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-BX4pJk0T.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-F41ektvu.js";
+import { t as getCdkdVersion } from "./version-CpyoQ3PO.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -9802,6 +9802,7 @@ function refuseMalformedOperation(shownStack, where, op) {
 	const attempted = o["attemptedProperties"];
 	if (attempted !== void 0 && (typeof attempted !== "object" || attempted === null || Array.isArray(attempted))) fail("attemptedProperties", attempted, "an object when present");
 	if (o["oldResourceRetained"] !== void 0 && typeof o["oldResourceRetained"] !== "boolean") fail("oldResourceRetained", o["oldResourceRetained"], "a boolean when present");
+	if (o["previousResourceType"] !== void 0 && typeof o["previousResourceType"] !== "string") fail("previousResourceType", o["previousResourceType"], "a string when present");
 }
 /** The TYPE of a JSON-derived value, for a refusal that must not echo the value. */
 function kind(v) {
@@ -13071,7 +13072,7 @@ function storeAssociation(associations, key, expression, plaintext) {
 * matters: an AWS resource type string is fixed by AWS, and a typo in either
 * copy makes that copy's gate simply never fire (no-op), never fire wrongly.
 */
-const NESTED_STACK_RESOURCE_TYPE$2 = "AWS::CloudFormation::Stack";
+const NESTED_STACK_RESOURCE_TYPE$4 = "AWS::CloudFormation::Stack";
 /**
 * What a PARENT stack's resolution proved about each `Parameters` entry of an
 * `AWS::CloudFormation::Stack` row it is about to provision, keyed by the
@@ -13410,7 +13411,7 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 * it either -- it walks the child's stored bag with no inherited bag.
 */
 function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, rules = TEMPLATE_DERIVED_RULES) {
-	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$2) return;
+	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$4) return;
 	if (secrets.size === 0) return;
 	if (!isPlainObject$2(resolvedProperties) || !isPlainObject$2(sourceProperties)) return;
 	if (!Object.hasOwn(resolvedProperties, "Parameters")) return;
@@ -18705,6 +18706,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		silentDrop: /* @__PURE__ */ new Map([
 			["CapacityProviderConfiguration", "not yet implemented by cdkd"],
 			["FilesystemConfigurations", "not yet implemented by cdkd"],
+			["PlatformVersion", "not yet implemented by cdkd"],
 			["RequestHeaderConfiguration", "not yet implemented by cdkd"],
 			["Tags", "not yet implemented by cdkd"]
 		]),
@@ -24103,6 +24105,88 @@ function classifyReplaySecretRegion(expression, consumerRegion, importedProducer
 	};
 }
 
+//#endregion
+//#region src/deployment/stale-attribute-heal.ts
+/**
+* Control-flow signal from the physical-id fallback to `resolveGetAtt`'s heal
+* wrapper. It never escapes that wrapper: it is raised only under a `probe`
+* context, which only the wrapper builds, and the wrapper catches it on the
+* same `await`. An `Error` subclass so a lint rule or a stray `catch` that
+* assumes `Error` still behaves.
+*/
+var StaleAttributeMissSignal = class StaleAttributeMissSignal extends Error {
+	constructor() {
+		super("stale attribute miss (internal control flow — must not escape resolveGetAtt)");
+		this.name = "StaleAttributeMissSignal";
+		Object.setPrototypeOf(this, StaleAttributeMissSignal.prototype);
+	}
+};
+const NESTED_STACK_RESOURCE_TYPE$3 = "AWS::CloudFormation::Stack";
+/**
+* Types whose `attributes` are NOT an AWS read-back: a custom resource's are its
+* handler's response `Data` (possibly `NoEcho`, and re-invoking the handler is
+* not a read), a nested stack's are its child's outputs.
+*/
+function isHealExcludedType(resourceType) {
+	return resourceType === NESTED_STACK_RESOURCE_TYPE$3 || resourceType === "AWS::CloudFormation::CustomResource" || resourceType.startsWith("Custom::");
+}
+/**
+* Drop every member that is not a value: `undefined`, `null` and `''`.
+*
+* Empty-to-absent is the point for the `--no-wait` `DBInstance` row
+* (go-to-k/cdkd#3077): an instance still `creating` has no endpoint, and an
+* empty value persisted into the record would be SERVED by the resolver's
+* cached read forever, shadowing every later heal.
+*/
+function normalizeHealedAttributes(attributes) {
+	const out = {};
+	if (attributes === void 0 || attributes === null || typeof attributes !== "object") return out;
+	for (const [key, value] of Object.entries(attributes)) {
+		if (value === void 0 || value === null || value === "") continue;
+		if (key === "__proto__") continue;
+		out[key] = value;
+	}
+	return out;
+}
+/**
+* Read `attributeName` out of a healed map the way `resolveGetAtt` reads the
+* recorded one: flat key first (SDK providers record `Endpoint.Port` flat), then
+* a dot-path walk (Cloud Control records nested objects). `Object.hasOwn` at
+* every step — `attributeName` is template text (issue #2767).
+*/
+function readHealedAttribute(attributes, attributeName) {
+	if (Object.hasOwn(attributes, attributeName)) {
+		const flat = attributes[attributeName];
+		if (flat !== void 0 && flat !== null && flat !== "") return flat;
+	}
+	if (!attributeName.includes(".")) return void 0;
+	let cursor = attributes;
+	for (const part of attributeName.split(".")) if (cursor !== null && typeof cursor === "object" && Object.hasOwn(cursor, part)) cursor = cursor[part];
+	else return;
+	return cursor === null || cursor === "" ? void 0 : cursor;
+}
+/**
+* Merge a healed map INTO a record's attributes: a healed key is added only
+* where the record holds NO value for it (or holds one `isStaleValue` declares
+* unusable — the pre-#1681 placeholder ARN). A recorded value always wins
+* otherwise: create-time attributes the read does not report must survive, and
+* a read must never rewrite what a provider recorded.
+*
+* Returns the SAME `recorded` reference when nothing was added, so a caller can
+* tell "healed" from "nothing to do" by identity.
+*/
+function mergeHealedAttributes(recorded, healed, isStaleValue) {
+	let merged;
+	for (const [key, value] of Object.entries(healed)) {
+		if (value === void 0 || value === null || value === "") continue;
+		if (key === "__proto__") continue;
+		if (recorded !== void 0 && Object.hasOwn(recorded, key) && !isStaleValue(key, recorded[key])) continue;
+		merged ??= { ...recorded };
+		merged[key] = value;
+	}
+	return merged ?? recorded;
+}
+
 //#endregion
 //#region src/provisioning/config-shape.ts
 /**
@@ -25757,6 +25841,20 @@ const REF_RETURNS_ARN_FROM_STATE = /* @__PURE__ */ new Map([
 	["AWS::AppSync::Resolver", ["ResolverArn"]]
 ]);
 /**
+* Is `value`, recorded under `attributeName` of a `resourceType` record, a
+* pre-#1681 PLACEHOLDER ARN — a value that is present but knowably unusable?
+*
+* The one predicate behind `rejectPlaceholderArnAttribute`'s refusal and the
+* #1852 heal's "this recorded value may be overwritten" exception
+* (`mergeHealedAttributes`), so the two cannot disagree about which records are
+* stale. Scoped to the {@link REF_RETURNS_ARN_FROM_STATE} types AND their
+* declared ARN attribute names — see that refusal's note for why no wider.
+*/
+function isStalePlaceholderArnAttribute(resourceType, attributeName, value) {
+	if (!REF_RETURNS_ARN_FROM_STATE.get(resourceType)?.includes(attributeName)) return false;
+	return typeof value === "string" && isPlaceholderArn(value);
+}
+/**
 * Build a {@link RefStateLookup} from a resource's stored state maps, checking
 * `properties` first (the template value CFn `Ref` mirrors) then `attributes`.
 * Only non-empty string values qualify — an intrinsic-shaped or empty value is
@@ -26074,7 +26172,7 @@ function carriesDynamicReference(value) {
 	return false;
 }
 /** The nested-stack resource type, whose `Outputs.<Name>` attributes are re-resolved (issue #2055). */
-const NESTED_STACK_RESOURCE_TYPE$1 = "AWS::CloudFormation::Stack";
+const NESTED_STACK_RESOURCE_TYPE$2 = "AWS::CloudFormation::Stack";
 /** Prefix `NestedStackProvider` records a child stack output under. */
 const NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX = "Outputs.";
 /**
@@ -28070,14 +28168,19 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const storedValue = Object.hasOwn(resource.attributes, attributeName) ? resource.attributes[attributeName] : void 0;
 			const flatValue = isImpossibleEmptyStoredAttribute(resource.resourceType, attributeName, storedValue) ? void 0 : storedValue;
 			if (flatValue !== void 0) {
-				this.rejectPlaceholderArnAttribute(resource, attributeName, flatValue, logicalId, context);
+				if (isStalePlaceholderArnAttribute(resource.resourceType, attributeName, flatValue)) {
+					const outcome = await this.healStaleAttributes(logicalId, resource, context);
+					const healed = this.usableHealedAttribute(outcome, attributeName);
+					if (healed !== void 0 && !isStalePlaceholderArnAttribute(resource.resourceType, attributeName, healed)) return this.serveHealedAttribute(logicalId, attributeName, healed, context);
+					this.rejectPlaceholderArnAttribute(resource, attributeName, flatValue, logicalId, context, outcome);
+				}
 				if (resource.resourceType === "AWS::Route53::HostedZone" && attributeName === "NameServers" && typeof flatValue === "string") {
 					const nameServers = flatValue === "" ? [] : flatValue.split(",");
 					this.logger.debug(`Normalized legacy Fn::GetAtt attribute: ${this.displayMasked(logicalId, context)}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(nameServers, context)), context)}`);
 					return this.noteAttributeSecrecy(logicalId, attributeName, nameServers, context);
 				}
 				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${this.displayMasked(logicalId, context)}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(flatValue, context)), context)}`);
-				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${this.displayLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
+				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$2 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${this.displayLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 				return this.noteAttributeSecrecy(logicalId, attributeName, flatValue, context);
 			}
 			if (attributeName.includes(".")) {
@@ -28094,13 +28197,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				}
 			}
 		}
-		if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)) {
+		if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$2 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)) {
 			const declared = Object.keys(resource.attributes ?? {}).filter((k) => k.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)).sort().map((k) => this.displayMasked(this.outputNameLogText(k, context), context));
 			const declaredText = declared.length > 0 ? declared.join(", ") : "(none)";
 			const loggedLogicalId = this.displayMasked(logicalId, context);
 			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${loggedLogicalId}, ${this.displayMasked(attributeName, context)}]: the nested stack '${loggedLogicalId}' declares no output named '${this.displayMasked(this.outputNameLogText(attributeName, context), context)}'. Its outputs are ${this.displayMasked(declaredText, context)}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
 		}
-		const value = await this.constructGuardedAttribute(resource, attributeName, context, logicalId);
+		const value = await this.constructWithStaleRecordHeal(resource, attributeName, context, logicalId);
 		this.logger.debug(`Resolved Fn::GetAtt: ${this.displayMasked(logicalId, context)}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(value, context)), context)}`);
 		return value;
 	}
@@ -28191,10 +28294,143 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* honest answer is to say so and name the remedy: the record heals on the
 	* resource's next in-place update (#1727).
 	*/
-	rejectPlaceholderArnAttribute(resource, attributeName, value, logicalId, context) {
-		if (!REF_RETURNS_ARN_FROM_STATE.get(resource.resourceType)?.includes(attributeName)) return;
-		if (typeof value !== "string" || !isPlaceholderArn(value)) return;
-		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: the recorded value "${stringifyValue(this.maskValueLeaves(value, context))}" is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. Deploy the stack again so the resource's next update heals the record (cdkd now records the real ARN), or re-import the resource.`));
+	rejectPlaceholderArnAttribute(resource, attributeName, value, logicalId, context, healOutcome) {
+		if (!isStalePlaceholderArnAttribute(resource.resourceType, attributeName, value)) return;
+		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: the recorded value "${stringifyValue(this.maskValueLeaves(value, context))}" is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. ` + this.staleRecordRemedy(healOutcome, context)));
+	}
+	/**
+	* The remedy half of a STALE-RECORD refusal (issue
+	* [#1852](https://github.com/go-to-k/cdkd/issues/1852)), worded from what the
+	* heal observed so it is true on the path taken.
+	*
+	* The sentence it replaces — "deploy the stack again so the resource's next
+	* update heals the record" — was false for the commonest case: a deploy that
+	* changes none of the resource's own properties takes the no-change skip and
+	* never runs `update()`, so "again" healed nothing.
+	*
+	* Every clause is cdkd-authored; AWS's text stays behind `--verbose`
+	* ({@link describeFailureObserved}), because a denied read quotes the
+	* caller's account, role and session.
+	*/
+	staleRecordRemedy(outcome, context) {
+		const touch = "change any property of the resource so its next update re-records the attributes, or re-import it with 'cdkd import'";
+		if (outcome === void 0) return `Run 'cdkd deploy': it re-reads a stale record's attributes from AWS and heals the record. Otherwise ${touch}.`;
+		switch (outcome.kind) {
+			case "failed": return `cdkd tried to re-read the attributes from AWS to heal the record, but ${this.describeFailureObserved("the provider read", outcome.error, context)}. Fix that (a missing read permission is the usual cause) and deploy again — cdkd retries the read on every deploy until the record is healed — or ${touch}.`;
+			case "not-found": return "cdkd tried to re-read the attributes from AWS to heal the record, but AWS reports no resource behind the recorded physical id — it was probably deleted outside cdkd. Check it with 'cdkd drift', then re-create it (change the resource so it is replaced) or remove it from state.";
+			case "read":
+				if ((outcome.withheldKeys?.length ?? 0) > 0) return this.withheldRemedy();
+				return `cdkd re-read the resource from AWS and the read reports no usable value for this attribute either, so there is nothing to heal the record with; ${touch}.`;
+			case "not-attempted": return `cdkd did not re-read it from AWS (the record was written by this deploy, or this resource type has no read-only lookup); ${touch}.`;
+		}
+	}
+	/**
+	* The remedy half of the "not enriched" refusal. The pre-#1852 sentence,
+	* plus what the heal established: a completed re-read that reports no such
+	* attribute CONFIRMS the type does not supply it; a context with no healer
+	* (`cdkd diff`, `cdkd drift`, ...) re-read nothing, so the record may merely
+	* predate the enrichment and `cdkd deploy` is what heals it.
+	*/
+	unenrichedRemedy(resourceType, attributeName, outcome, context) {
+		const fileIssue = `Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.displayMasked(attributeName, context)}.`;
+		if (outcome === void 0) return `If this record was written by an older cdkd that did not record the attribute yet, 'cdkd deploy' re-reads it from AWS and heals the record. ${fileIssue}`;
+		if (outcome.kind === "read") {
+			if (this.healWithheld(outcome, attributeName)) return this.withheldRemedy();
+			return `cdkd re-read the resource's attributes from AWS and the read reports none by that name. ${fileIssue}`;
+		}
+		return fileIssue;
+	}
+	/** Did the heal's read report this attribute (by its top-level key) and cdkd withhold it as masked? */
+	healWithheld(outcome, attributeName) {
+		const head = attributeName.split(".")[0];
+		return outcome.withheldKeys?.some((key) => key === attributeName || key === head) ?? false;
+	}
+	/**
+	* The remedy when the re-read DID report a value and cdkd withheld it: Cloud
+	* Control's read-back is masked wherever cdkd cannot certify a key as a
+	* read-only attribute, which is every key when `DescribeType` is unavailable.
+	* "The read reports none ... file an issue" would be false here.
+	*/
+	withheldRemedy() {
+		return "cdkd re-read the resource through Cloud Control, but withheld the value: it could not confirm that this is a read-only attribute of the type, and an unconfirmed value is never used. Grant the deploy role cloudformation:DescribeType and deploy again; if the role already has it, the name is a writable property rather than an attribute — reference the value the template sets instead.";
+	}
+	/**
+	* Ask the context's healer (issue #1852) — `undefined` when it has none. The
+	* healer is contracted never to throw; the `catch` makes that a property of
+	* THIS call site rather than of every supplier, because a throw here would
+	* fail a deploy the pre-#1852 code passed (the warn-and-return fallback).
+	*/
+	async healStaleAttributes(logicalId, resource, context) {
+		if (context.attributeHealer === void 0) return void 0;
+		try {
+			return await context.attributeHealer(logicalId, resource);
+		} catch (error) {
+			return {
+				kind: "failed",
+				error
+			};
+		}
+	}
+	/**
+	* The attribute out of a heal's read-back, or `undefined` when the read does
+	* not supply a USABLE one. A value carrying `SECRET_MASK` is not usable:
+	* `CloudControlProvider.import` masks what it cannot certify, and serving
+	* that would send the literal mask to AWS.
+	*/
+	usableHealedAttribute(outcome, attributeName) {
+		if (outcome?.kind !== "read") return void 0;
+		const value = readHealedAttribute(outcome.attributes, attributeName);
+		return value === void 0 || carriesSecretMask(value) ? void 0 : value;
+	}
+	/** Serve a value the #1852 heal just read from AWS, logging it like a cached read. */
+	serveHealedAttribute(logicalId, attributeName, value, context) {
+		this.logger.debug(`Resolved Fn::GetAtt from a re-read of AWS (the state record lacked it): ${this.displayMasked(logicalId, context)}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(value, context)), context)}`);
+		return this.noteAttributeSecrecy(logicalId, attributeName, value, context);
+	}
+	/**
+	* {@link constructGuardedAttribute}, healing a STALE state record first when
+	* the construction is about to take {@link guardedPhysicalIdFallback} (issue
+	* [#1852](https://github.com/go-to-k/cdkd/issues/1852)).
+	*
+	* Three passes at most, and an AWS call on none of them unless the fallback
+	* is actually reached:
+	*
+	* 1. PROBE — construct under a derived context whose fallback raises
+	*    {@link StaleAttributeMissSignal} instead of deciding. Every per-type arm
+	*    that CAN answer (the ~40 constructed ARNs, the live-read arms) returns
+	*    here exactly as before.
+	* 2. HEAL — only on the signal: ask the context's healer, which re-reads the
+	*    record's attributes through its provider once per deploy. A value for
+	*    this attribute is served from that read.
+	* 3. SETTLE — otherwise construct again under a context carrying the heal's
+	*    outcome, so the fallback decides exactly as it always has (refuse an
+	*    `*Arn` / `*Url` shape, refuse under `--strict-getatt`, else warn and
+	*    return the physical id) and words a refusal from what was observed.
+	*
+	* The phase rides a DERIVED context, never a field of this resolver: one
+	* resolver instance serves every concurrently resolving resource of a stack.
+	* A context with no healer skips all of it.
+	*/
+	async constructWithStaleRecordHeal(resource, attributeName, context, logicalId) {
+		if (context.attributeHealer === void 0) return this.constructGuardedAttribute(resource, attributeName, context, logicalId);
+		try {
+			return await this.constructGuardedAttribute(resource, attributeName, {
+				...context,
+				staleAttributeHeal: { phase: "probe" }
+			}, logicalId);
+		} catch (error) {
+			if (!(error instanceof StaleAttributeMissSignal)) throw error;
+		}
+		const outcome = await this.healStaleAttributes(logicalId, resource, context) ?? { kind: "not-attempted" };
+		const healed = this.usableHealedAttribute(outcome, attributeName);
+		if (healed !== void 0) return this.serveHealedAttribute(logicalId, attributeName, healed, context);
+		return this.constructGuardedAttribute(resource, attributeName, {
+			...context,
+			staleAttributeHeal: {
+				phase: "settled",
+				outcome
+			}
+		}, logicalId);
 	}
 	/**
 	* Construct resource attribute value based on resource type, refusing to
@@ -28667,7 +28903,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::RDS::DBProxy" || resourceType === "AWS::RDS::DBProxyEndpoint") {
-			if (attributeName === "VpcId") throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: the state record holds no VpcId for it (the read-back that would have recorded it reported none), and the physical id "${this.displayMasked(physicalId, context)}" is a name, not a VPC id, so cdkd refuses to substitute it. Update the resource so its next deploy records the value, or reference the VPC directly.`));
+			if (attributeName === "VpcId") {
+				if (context.staleAttributeHeal?.phase === "probe") throw new StaleAttributeMissSignal();
+				const vpcIdHealOutcome = context.staleAttributeHeal?.phase === "settled" ? context.staleAttributeHeal.outcome : void 0;
+				throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: the state record holds no VpcId for it (the read-back that would have recorded it reported none), and the physical id "${this.displayMasked(physicalId, context)}" is a name, not a VPC id, so cdkd refuses to substitute it. ${this.staleRecordRemedy(vpcIdHealOutcome, context)} Referencing the VPC directly also works.`));
+			}
 			return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
@@ -28769,15 +29009,23 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* per-type handlers.
 	*/
 	guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context) {
+		if (context?.staleAttributeHeal?.phase === "probe") throw new StaleAttributeMissSignal();
+		const healOutcome = context?.staleAttributeHeal?.phase === "settled" ? context.staleAttributeHeal.outcome : void 0;
+		const recordMayBeStale = healOutcome?.kind === "failed" || healOutcome?.kind === "not-found";
 		const expectsArnShape = attributeName.endsWith("Arn") && !physicalId.startsWith("arn:");
 		const expectsUrlShape = attributeName.endsWith("Url") && !/^https?:\/\//.test(physicalId);
 		if (expectsArnShape || expectsUrlShape) {
 			const expectedShape = expectsArnShape ? "an ARN (arn:...)" : "a URL (http(s)://...)";
-			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and the physical ID fallback "${this.displayMasked(physicalId, context)}" is not ${expectedShape}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.displayMasked(attributeName, context)}.`));
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: ` + (recordMayBeStale ? `the state record holds no value for it, and the physical ID ` : `attributes are not enriched for this resource type, and the physical ID `) + `fallback "${this.displayMasked(physicalId, context)}" is not ${expectedShape}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). ` + (recordMayBeStale ? this.staleRecordRemedy(healOutcome, context) : this.unenrichedRemedy(resourceType, attributeName, healOutcome, context))));
 		}
-		if (this.strictGetAtt) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and --strict-getatt rejects the physical ID fallback "${this.displayMasked(physicalId, context)}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning, avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.displayMasked(attributeName, context)}.`));
+		if (this.strictGetAtt) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: ` + (recordMayBeStale ? `the state record holds no value for it, and --strict-getatt ` : `attributes are not enriched for this resource type, and --strict-getatt `) + `rejects the physical ID fallback "${this.displayMasked(physicalId, context)}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning. ` + (recordMayBeStale ? this.staleRecordRemedy(healOutcome, context) : this.unenrichedRemedy(resourceType, attributeName, healOutcome, context))));
 		this.physicalIdFallbackCount++;
-		this.logger.warn(`Unknown attribute ${this.displayMasked(attributeName, context)} for resource type ${resourceType}, returning physical ID`);
+		if (recordMayBeStale) {
+			this.logger.warn(`The state record for ${this.displayMasked(logicalId, context)} (${resourceType}) holds no ${this.displayMasked(attributeName, context)}, returning physical ID. ` + this.staleRecordRemedy(healOutcome, context));
+			return physicalId;
+		}
+		const withheld = healOutcome?.kind === "read" && this.healWithheld(healOutcome, attributeName) ? `. ${this.withheldRemedy()}` : "";
+		this.logger.warn(`Unknown attribute ${this.displayMasked(attributeName, context)} for resource type ${resourceType}, returning physical ID${withheld}`);
 		return physicalId;
 	}
 	/**
@@ -32887,7 +33135,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BuEvX2d9.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BTxYWlwu.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -36889,6 +37137,11 @@ var ProviderRegistry = class {
 		return hits;
 	}
 };
+/**
+* True for the types `CustomResourceProvider` serves. Exported for
+* `type-change-guard.ts`'s `equalIdNamesSameResource`: these types are the one
+* family whose physical ids share ONE namespace across types.
+*/
 function isCustomResource(resourceType) {
 	return resourceType.startsWith("Custom::") || resourceType === "AWS::CloudFormation::CustomResource";
 }
@@ -37590,6 +37843,35 @@ function getCurrentResourceSecrets() {
 //#endregion
 //#region src/deployment/type-change-guard.ts
 /**
+* Does an EQUAL physical id on the two halves of a replacement name the SAME
+* resource? (issue [#2668](https://github.com/go-to-k/cdkd/issues/2668))
+*
+* Within one type, always — which is what the engine's name-idempotent-create
+* guards and the rollback's "adopted the live new resource" shortcut assume.
+* Across a `Type` change an equal id is a coincidence of two namespaces (an SSM
+* parameter and a log group, an IAM user and an IAM group, can share a bare
+* name): the create was genuine, and the other half still has to be deleted
+* through its own type's provider.
+*
+* The ONE exception is the custom-resource family. Every `Custom::*` type and
+* `AWS::CloudFormation::CustomResource` are served by the user's handler, which
+* picks the id, so `Custom::Foo` -> `Custom::Bar` returning the same
+* `PhysicalResourceId` names the SAME resource — and "deleting the other half"
+* would send `Delete` for what the create just built. That holds only on the
+* SDK layer: Cloud Control addresses a resource by type AND identifier.
+*
+* Keyed on the TYPES, deliberately not on "both halves resolved to one provider
+* instance": `register-providers.ts` shares one instance across many types
+* whose namespaces are disjoint (`AWS::IAM::User` / `AWS::IAM::Group`, the EC2,
+* RDS, Glue, ECS families ...), and reading those as one namespace refuses a
+* genuine create on the deploy side and strands the new resource on the
+* rollback side.
+*/
+function equalIdNamesSameResource(input) {
+	if (input.oldType === input.newType) return true;
+	return isCustomResource(input.oldType) && isCustomResource(input.newType) && input.createLayer !== "cc-api";
+}
+/**
 * The CFn type of a nested stack's row in its PARENT's template.
 *
 * Spelled locally rather than imported, matching
@@ -37597,14 +37879,14 @@ function getCurrentResourceSecrets() {
 * `src/cli/commands/retire-cfn-stack.ts`, and importing a CLI command module
 * from the deployment layer would invert the dependency direction.
 */
-const NESTED_STACK_RESOURCE_TYPE = "AWS::CloudFormation::Stack";
+const NESTED_STACK_RESOURCE_TYPE$1 = "AWS::CloudFormation::Stack";
 /**
 * Find every planned change whose recorded type and template type differ with
 * `AWS::CloudFormation::Stack` on one side.
 *
-* Reads exactly the two values the defect is made of: `change.resourceType`
-* (what `provisionResource` binds and routes BOTH replacement halves on) and
-* the state record's `resourceType` (the resource that actually exists). That
+* Reads exactly the two values a replacement's halves route on:
+* `change.resourceType` (the create) and the state record's `resourceType`
+* (the resource that actually exists, and the delete). That
 * is deliberate — deriving the "desired" type from the template again would be
 * a second implementation of the diff's own Type-change rule (metadata skip,
 * condition pruning) which could drift away from the routing decision this
@@ -37624,8 +37906,8 @@ function findNestedStackTypeChanges(input) {
 		const currentType = currentResource.resourceType;
 		const desiredType = change.resourceType;
 		if (currentType === desiredType) continue;
-		const intoNested = desiredType === NESTED_STACK_RESOURCE_TYPE;
-		if (!intoNested && !(currentType === NESTED_STACK_RESOURCE_TYPE)) continue;
+		const intoNested = desiredType === NESTED_STACK_RESOURCE_TYPE$1;
+		if (!intoNested && !(currentType === NESTED_STACK_RESOURCE_TYPE$1)) continue;
 		found.push({
 			logicalId,
 			currentType,
@@ -37637,18 +37919,18 @@ function findNestedStackTypeChanges(input) {
 	return found;
 }
 /**
-* Render the refusal. Names the logical id, BOTH types, the resource the
-* mis-routed delete would be aimed at, and what to do instead.
+* Render the refusal. Names the logical id, BOTH types, the existing resource,
+* the child stack involved, and what to do instead.
 *
-* `stackName` is the stack being deployed, so the into-nested arm can print the
-* child stack name `NestedStackProvider.delete` would derive and destroy — the
-* one piece of the damage the user cannot read off their own template.
+* `stackName` is the stack being deployed, so each arm can print the child
+* stack name `<stackName>~<logicalId>` — the one piece the user cannot read off
+* their own template.
 */
 function renderNestedStackTypeChangeRefusal(typeChanges, stackName) {
 	const rows = typeChanges.map((tc) => {
-		return `${`  - ${tc.logicalId}: Type changes from ${tc.currentType} to ${tc.desiredType} (the existing ${tc.currentType} is ${tc.physicalId}).`}\n${tc.direction === "into-nested-stack" ? `    Both halves of the replacement would route on the TEMPLATE's type, so the existing resource's delete would be dispatched at the ${NESTED_STACK_RESOURCE_TYPE} provider — which ignores the physical id it is handed and instead destroys the nested child stack "${stackName}~${tc.logicalId}" and every resource that child owns. Where no such child exists the delete is a no-op and ${tc.physicalId} is silently leaked instead.` : `    Both halves of the replacement would route on the TEMPLATE's type, so the existing nested stack's delete would be dispatched at the ${tc.desiredType} provider, which cannot delete a nested stack — the child stack "${stackName}~${tc.logicalId}" and every resource it owns would be left behind, untracked.`}`;
+		return `${`  - ${tc.logicalId}: Type changes from ${tc.currentType} to ${tc.desiredType} (the existing ${tc.currentType} is ${tc.physicalId}).`}\n${tc.direction === "into-nested-stack" ? `    Replacing a single resource BY a nested stack is not supported: the create half of the replacement would deploy a whole child stack "${stackName}~${tc.logicalId}" as one row, while ${tc.physicalId} is still recorded under this logical id.` : `    Replacing a nested stack BY a single resource is not supported: a replacement deletes its old half as a best-effort cleanup step whose failure is only a warning, so the child stack "${stackName}~${tc.logicalId}" and every resource it owns could be left behind, untracked, under a deploy that reports success.`}`;
 	});
-	return `Refusing to deploy ${stackName}: ` + (typeChanges.length === 1 ? `a resource changes its Type ` : `${typeChanges.length} resources change their Type `) + `into or out of ${NESTED_STACK_RESOURCE_TYPE}, which cdkd cannot replace safely (issue #2668).\n${rows.join("\n")}\n  Deploy this as two changes instead: give the new resource a DIFFERENT logical id (in CDK, rename the construct) so the existing row is deleted through its own type's provider and the new one is created under its own — or remove the resource in one deploy and add its replacement in the next. There is no flag that overrides this refusal: the delete's TARGET would be wrong, not merely its consequences.`;
+	return `Refusing to deploy ${stackName}: ` + (typeChanges.length === 1 ? `a resource changes its Type ` : `${typeChanges.length} resources change their Type `) + `into or out of ${NESTED_STACK_RESOURCE_TYPE$1}, which cdkd does not replace in place (issue #2668).\n${rows.join("\n")}\n  Deploy this as two changes instead: give the new resource a DIFFERENT logical id (in CDK, rename the construct) so the existing row is deleted through its own type's provider and the new one is created under its own — or remove the resource in one deploy and add its replacement in the next. There is no flag that overrides this refusal.`;
 }
 
 //#endregion
@@ -40927,13 +41209,86 @@ const RECREATE_RETRY_SCHEDULE = {
 	initialDelayMs: 2e3,
 	maxDelayMs: 1e4
 };
+/** Spelled locally: importing the CLI's copy would invert the layer direction. */
+const NESTED_STACK_RESOURCE_TYPE = "AWS::CloudFormation::Stack";
+const nonEmptyString = (v) => typeof v === "string" && v.length > 0;
+/** The two places a journal can name the old resource's type, each `undefined` when unusable. */
+function journaledOldTypes(op) {
+	return {
+		stamped: nonEmptyString(op.previousResourceType) ? op.previousResourceType : void 0,
+		recorded: nonEmptyString(op.previousState?.resourceType) ? op.previousState.resourceType : void 0
+	};
+}
 /**
-* True when the op recorded a replacement (old physical id differs from the
-* new one). The old physical resource is already gone / orphaned, so an
-* in-place revert is best-effort — the plan labels these explicitly.
+* Which type the OLD half of a replacement op routes on, or why that cannot be
+* decided (issue [#2668](https://github.com/go-to-k/cdkd/issues/2668)).
+*
+* Two sources name it: {@link CompletedOperation.previousResourceType} (written
+* by a binary that knows about Type changes) and `previousState.resourceType`
+* (journaled by every binary, inside the previous record). A legacy journal has
+* only the second, which is enough. The verdict is REFUSED rather than guessed
+* in three shapes, because a wrong answer dispatches a create and a delete at
+* the wrong service:
+*
+*   - neither source names a type (a hand-edited or torn op) — falling back to
+*     `op.resourceType` is exactly the single-type assumption this replaces;
+*   - the two sources disagree — one of them was edited, and nothing says which;
+*   - the types differ with `AWS::CloudFormation::Stack` on either side. The
+*     deploy refuses that pair at plan time (`type-change-guard.ts`), so only a
+*     journal from a binary older than that guard carries one, and what that
+*     deploy left behind is not knowable from the journal: its mis-routed
+*     delete may have destroyed the child it had just created.
+*/
+function resolveReplacementOldType(op) {
+	const { stamped, recorded } = journaledOldTypes(op);
+	if (stamped !== void 0 && recorded !== void 0 && stamped !== recorded) return {
+		ok: false,
+		reason: `the journal names two different types for the old resource (previousResourceType ${safe(stamped)}, previousState.resourceType ${safe(recorded)})`
+	};
+	const oldType = stamped ?? recorded;
+	if (oldType === void 0) return {
+		ok: false,
+		reason: "the journal does not record the old resource's type"
+	};
+	if (oldType !== op.resourceType && (oldType === NESTED_STACK_RESOURCE_TYPE || op.resourceType === NESTED_STACK_RESOURCE_TYPE)) return {
+		ok: false,
+		reason: `it is a Type change between ${safe(oldType)} and ${safe(op.resourceType)}, and cdkd does not replace a nested stack with, or by, a single resource`
+	};
+	return {
+		ok: true,
+		oldType
+	};
+}
+/**
+* The one refusal both the `refuse-replacement-routing` arm and the
+* `reverse-replacement` arm's own guard raise. `markNonRetryable`: the verdict
+* is read off the journal alone, so no retry can change it.
+*/
+function unroutableReplacementError(op, reason) {
+	return markNonRetryable(new CdkdError(`Cannot reverse the replacement of ${safe(op.logicalId)} (${safe(op.resourceType)}): ${reason}, so cdkd will not guess which provider re-creates the old resource. Nothing was changed. The journal is kept: fix forward with \`cdkd deploy\`, or re-run with ` + (typeof op.logicalId === "string" && PASTEABLE_LOGICAL_ID.test(op.logicalId) ? `\`cdkd rollback --orphan ${op.logicalId}\`` : `\`cdkd rollback --orphan <id>\` (read the id from \`cdkd events\`)`) + ` to leave this resource as it is and let the rest of the rollback proceed.`, "ROLLBACK_REPLACEMENT_UNROUTABLE"));
+}
+/**
+* True when the op changed the resource's `Type`. `false` when the old type is
+* not recorded at all: that shape is refused by {@link resolveReplacementOldType}
+* where it matters, and must not by itself turn an in-place op into a
+* replacement.
+*/
+function isTypeChangeOp(op) {
+	const { stamped, recorded } = journaledOldTypes(op);
+	return stamped !== void 0 && stamped !== op.resourceType || recorded !== void 0 && recorded !== op.resourceType;
+}
+/**
+* True when the op recorded a replacement: the old physical id differs from the
+* new one, OR the resource's `Type` changed (issue #2668). The second arm is
+* not redundant — two types' physical-id namespaces can overlap (a log group
+* and a Lambda function are both addressed by a bare name), so a Type change
+* can keep the id, and classified as an in-place `revert` it would hand the
+* NEW resource's id to an `update()` of either type. The old physical resource
+* is already gone / orphaned, so an in-place revert is best-effort — the plan
+* labels these explicitly.
 */
 function isReplacementOp(op) {
-	return op.changeType === "UPDATE" && op.previousState?.physicalId !== void 0 && op.previousState.physicalId !== op.physicalId;
+	return op.changeType === "UPDATE" && op.previousState?.physicalId !== void 0 && (op.previousState.physicalId !== op.physicalId || isTypeChangeOp(op));
 }
 function deepEqual(a, b) {
 	if (a === b) return true;
@@ -40976,11 +41331,15 @@ function classifyRollbackOp(op, stateResources, orphanLogicalIds) {
 	const current = stateResources[op.logicalId];
 	if (!current) return "skip-absent";
 	if (replacement) {
-		if (current.physicalId === op.previousState.physicalId) return "skip-already-done";
+		const oldTypes = journaledOldTypes(op);
+		const oldTypeForCompare = isTypeChangeOp(op) ? oldTypes.stamped ?? oldTypes.recorded : void 0;
+		const sameTypeAsOld = oldTypeForCompare === void 0 || !nonEmptyString(current.resourceType) || current.resourceType === oldTypeForCompare;
+		if (current.physicalId === op.previousState.physicalId && sameTypeAsOld) return "skip-already-done";
 		if (op.physicalId !== void 0 && current.physicalId !== op.physicalId) {
-			if (deepEqual(current.properties, op.previousState.properties)) return "skip-already-done";
+			if (sameTypeAsOld && deepEqual(current.properties, op.previousState.properties)) return "skip-already-done";
 			return "skip-mismatch";
 		}
+		if (!resolveReplacementOldType(op).ok) return "refuse-replacement-routing";
 		return op.oldResourceRetained ?? op.previousState.updateReplacePolicy === "Retain" ? "reverse-replacement-readopt" : "reverse-replacement";
 	}
 	if (op.previousState && deepEqual(current.properties, op.previousState.properties)) return "skip-already-done";
@@ -41004,6 +41363,7 @@ function classifyFailedOp(op, stateResources) {
 		return "delete-failed-create";
 	}
 	if (!current || !op.previousState) return "skip-failed-absent";
+	if (isTypeChangeOp(op)) return "skip-failed-type-change";
 	return "revert-failed-update";
 }
 /** Build the plan items for a segment's failed ops (issue #1198). */
@@ -41625,6 +41985,10 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				logger.warn(`  Rollback: Cannot restore ${safe(op.logicalId)} — resource no longer in state, skipping`);
 				result.warnings++;
 				return;
+			case "refuse-replacement-routing": {
+				const routing = resolveReplacementOldType(op);
+				throw unroutableReplacementError(op, routing.ok ? "its old type could not be routed" : routing.reason);
+			}
 			case "orphan-flag":
 				if (op.changeType === "CREATE") {
 					const record = stateResources[op.logicalId];
@@ -41770,6 +42134,10 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 			case "reverse-replacement": {
 				const current = stateResources[op.logicalId];
 				const prev = op.previousState;
+				const oldTypeRouting = resolveReplacementOldType(op);
+				if (!oldTypeRouting.ok) throw unroutableReplacementError(op, oldTypeRouting.reason);
+				const oldType = oldTypeRouting.oldType;
+				const typeChanged = oldType !== op.resourceType;
 				if (!requireRestorableBaseline(prev.properties, logger, {
 					logicalId: op.logicalId,
 					consequence: "create a default-configured resource and then delete the live one",
@@ -41781,14 +42149,14 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				}
 				const resolvedPrevProps = await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId) ?? {};
 				refuseMaskedReplayBaseline(resolvedPrevProps, op.logicalId);
-				recordNestedStackParameterExpressions(secrets, op.resourceType, resolvedPrevProps, prev.properties, STATE_DERIVED_RULES);
-				logger.info(`  Rollback: Reversing replacement of ${safe(op.logicalId)} (${safe(op.resourceType)}) — re-creating the old resource and deleting the new one`);
-				if (STATEFUL_TYPES.has(op.resourceType)) logger.warn(`  ⚠ ${safe(op.logicalId)} (${safe(op.resourceType)}) is a stateful type — the old physical resource's data was destroyed by the replacement and is NOT recovered by this rollback; the re-created resource starts empty.`);
+				recordNestedStackParameterExpressions(secrets, oldType, resolvedPrevProps, prev.properties, STATE_DERIVED_RULES);
+				logger.info(`  Rollback: Reversing replacement of ${safe(op.logicalId)} (${typeChanged ? `${safe(op.resourceType)} -> ${safe(oldType)}` : safe(op.resourceType)}) — re-creating the old resource and deleting the new one`);
+				if (STATEFUL_TYPES.has(oldType)) logger.warn(`  ⚠ ${safe(op.logicalId)} (${safe(oldType)}) is a stateful type — the old physical resource's data was destroyed by the replacement and is NOT recovered by this rollback; the re-created resource starts empty.`);
 				const { provider: createProvider, provisionedBy: createProvisionedBy } = ctx.providerRegistry.getProviderFor({
-					resourceType: op.resourceType,
+					resourceType: oldType,
 					provisionedBy: prev.provisionedBy
 				});
-				const replayCreateProps = () => ({ ...createProvisionedBy === "cc-api" ? applyDefaultNameForFallback(op.logicalId, op.resourceType, resolvedPrevProps) : resolvedPrevProps });
+				const replayCreateProps = () => ({ ...createProvisionedBy === "cc-api" ? applyDefaultNameForFallback(op.logicalId, oldType, resolvedPrevProps) : resolvedPrevProps });
 				const resolveNewDeleteProvider = () => ctx.providerRegistry.getProviderFor({
 					resourceType: op.resourceType,
 					provisionedBy: current.provisionedBy ?? op.provisionedBy
@@ -41796,7 +42164,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				let deletedNewFirst = false;
 				let createResult;
 				try {
-					createResult = await createWithRollbackRetry(createProvider, () => withCurrentResourceSecrets(secrets, () => createProvider.create(op.logicalId, op.resourceType, replayCreateProps(), replayingStateCreateContext(secrets))), op.logicalId, logger, isInterrupted, secrets, {
+					createResult = await createWithRollbackRetry(createProvider, () => withCurrentResourceSecrets(secrets, () => createProvider.create(op.logicalId, oldType, replayCreateProps(), replayingStateCreateContext(secrets))), op.logicalId, logger, isInterrupted, secrets, {
 						isRetryable: isNameCooldownError,
 						interruptedMessage: "Rollback interrupted while waiting out the name cooldown"
 					});
@@ -41804,7 +42172,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					const msg = createError instanceof Error ? createError.message : String(createError);
 					if (!isNameCollisionErrorFrom(createError, op.logicalId)) throw createError;
 					if (rollbackRetainsNewResource(current)) throw markNonRetryable(new CdkdError(maskSecretsInText(`Cannot reverse the replacement of ${safe(op.logicalId)} (${safe(op.resourceType)}): the re-create of the old resource (${safe(prev.physicalId)}) collided with the name still held by the new one (${safe(current.physicalId)}), and UpdateReplacePolicy: Retain pins that new resource in place, so cdkd will not delete it to free the name. Delete the new resource yourself, or remove UpdateReplacePolicy: Retain, then re-run \`cdkd rollback\` — the journal is kept, so the revert resumes from here. To leave THIS resource alone and let the rest of the rollback proceed, re-run with ` + (typeof op.logicalId === "string" && PASTEABLE_LOGICAL_ID.test(op.logicalId) ? `\`cdkd rollback --orphan ${op.logicalId}\`: one op failure stops the ` : "`cdkd rollback --orphan <id>` (the id is withheld: it is not a plain CloudFormation logical id, so a pasted command could be reshaped by the shell or name a different resource -- read it from `cdkd events`): one op failure stops the ") + `segment loop, so a single pinned resource otherwise halts every OLDER segment too. Underlying collision: ${displaySafe(msg)}`, secrets), "NAMED_REPLACEMENT_COLLISION", maskSecretsInError(createError instanceof Error ? createError : void 0, secrets)));
-					logger.info(`  Rollback: re-create collided with the new resource's name — deleting the new resource (${displaySafe(current.physicalId)}) first...`);
+					logger.info(`  Rollback: re-create collided with the new resource's name — deleting the new resource (${displaySafe(current.physicalId)}) first...` + (typeChanged ? ` (this op changed the resource's Type, ${safe(op.resourceType)} -> ${safe(oldType)}: if those types do not share a name space the name is held by an unrelated resource and the re-create will collide again)` : ""));
 					{
 						const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
 						throwIfDeleteSkipped(await resolveNewDeleteProvider().delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
@@ -41816,7 +42184,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					delete stateResources[op.logicalId];
 					await afterOp?.(op.logicalId);
 					try {
-						createResult = await createWithRollbackRetry(createProvider, () => withCurrentResourceSecrets(secrets, () => createProvider.create(op.logicalId, op.resourceType, replayCreateProps(), replayingStateCreateContext(secrets))), op.logicalId, logger, isInterrupted, secrets, {
+						createResult = await createWithRollbackRetry(createProvider, () => withCurrentResourceSecrets(secrets, () => createProvider.create(op.logicalId, oldType, replayCreateProps(), replayingStateCreateContext(secrets))), op.logicalId, logger, isInterrupted, secrets, {
 							isRetryable: isRecreateRetryableError,
 							interruptedMessage: "Rollback interrupted while waiting for the old name to release"
 						});
@@ -41824,7 +42192,11 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 						throw new Error(maskSecretsInText(`Failed to re-create the old ${safe(op.logicalId)} after the new resource (${current.physicalId}) was already deleted: ${displaySafe(recreateError instanceof Error ? recreateError.message : String(recreateError))}. The resource is now absent — fix forward with 'cdkd deploy'.`, secrets), { cause: maskSecretsInError(recreateError instanceof Error ? recreateError : void 0, secrets) });
 					}
 				}
-				const adoptedLiveNewResource = !deletedNewFirst && createResult.physicalId === current.physicalId;
+				const adoptedLiveNewResource = equalIdNamesSameResource({
+					oldType,
+					newType: op.resourceType,
+					createLayer: createProvisionedBy
+				}) && !deletedNewFirst && createResult.physicalId === current.physicalId;
 				if (adoptedLiveNewResource) {
 					logger.warn(`  ⚠ ${safe(op.logicalId)} (${safe(op.resourceType)}): the re-create returned the LIVE new resource (${displaySafe(current.physicalId)}) instead of re-creating the old one — its Create API is name-idempotent and the new resource still holds the same user-supplied name. Skipping the delete-new step (it would delete that very resource). The old resource's ORIGINAL properties may NOT have been re-applied; state now records the pre-replacement properties, so run 'cdkd drift ${stackName}' to inspect and 'cdkd deploy' to reconcile, or rename the resource to make the replacement reversible.`);
 					result.warnings++;
@@ -42004,6 +42376,10 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 					logger.warn(`  Rollback: cannot revert failed UPDATE of ${safe(op.logicalId)} — no previous state available, skipping`);
 					result.warnings++;
 					break;
+				case "skip-failed-type-change":
+					logger.warn(`  Rollback: cannot revert failed UPDATE of ${safe(op.logicalId)} in place — it was a Type change (${safe(op.previousState?.resourceType)} -> ${safe(op.resourceType)}), which is a replacement, and its remote state is unknown. Inspect it with \`cdkd drift\` and re-converge with \`cdkd deploy\`. Skipping.`);
+					result.warnings++;
+					break;
 				case "orphan-failed-create-retain": {
 					const failedCreateRecord = stateResources[op.logicalId];
 					const orphanProvisionedBy = effectiveProvisionedBy(failedCreateRecord, op.provisionedBy);
@@ -43110,6 +43486,40 @@ var DeployEngine = class DeployEngine {
 	*/
 	retainedOldOnReplacement = /* @__PURE__ */ new Set();
 	/**
+	* The pre-deploy state records, as loaded — the #1852 heal's eligibility
+	* baseline. A record is healed only while it is still the one this deploy
+	* LOADED (same physical id, same `attributes` object): once a provider has
+	* (re)written it this run, a missing attribute is the provider's answer, not
+	* staleness, and re-reading would cost an AWS call to learn nothing.
+	*
+	* Compared by the `attributes` REFERENCE rather than the record's, because
+	* the metadata-only arm re-spreads a record (`{ ...currentResource }`) without
+	* a provider call — its attributes object survives the spread, a create /
+	* update result's does not.
+	*/
+	healBaseline = {};
+	/**
+	* Single-flight + per-deploy memo of the #1852 heal, keyed by logical id and
+	* physical id. ENGINE-instance state, never module-global: one engine deploys
+	* one stack, and `--stack-concurrency` runs several engines at once. Holding
+	* the PROMISE is what makes it single-flight — every concurrent resolution of
+	* the same record awaits the one read — and never deleting an entry is what
+	* bounds it: one read per record per deploy, success or failure, no retry.
+	*/
+	attributeHeals = /* @__PURE__ */ new Map();
+	/**
+	* What the heals of this deploy read, waiting for the next state save.
+	*
+	* Applied at {@link redactStateForPersist} — the choke point EVERY save
+	* passes through — rather than written into the in-memory record, so a heal
+	* survives every exit path that saves at all (success, a failed resource, a
+	* failed output, the no-change path), whichever copy-on-write record map the
+	* save happens to hold, and is scrubbed by the same redaction every other
+	* attribute goes through. A path that saves NOTHING (`--dry-run`) persists
+	* nothing and the next deploy re-heals.
+	*/
+	healedAttributes = /* @__PURE__ */ new Map();
+	/**
 	* Target region for this stack. Required — load-bearing for the
 	* region-prefixed S3 state key and recorded in state.json for
 	* cross-region destroy.
@@ -43153,6 +43563,9 @@ var DeployEngine = class DeployEngine {
 		this.outputsSourceUsable = true;
 		this.skippedOutputs = void 0;
 		this.retainedOldOnReplacement = /* @__PURE__ */ new Set();
+		this.healBaseline = {};
+		this.attributeHeals = /* @__PURE__ */ new Map();
+		this.healedAttributes = /* @__PURE__ */ new Map();
 		this.resolver.resetPhysicalIdFallbackCount();
 		return withStackName(stackName, () => this.doDeploy(stackName, template));
 	}
@@ -43175,6 +43588,7 @@ var DeployEngine = class DeployEngine {
 			...this.exportIndexStore && { exportIndex: this.exportIndexStore },
 			recordedImports: this.recordedImports,
 			recordedOutputReads: this.recordedOutputReads,
+			attributeHealer: (logicalId, resource) => this.healStaleAttributes(logicalId, resource, stackName),
 			...this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0 && { inheritedSecrets: this.options.inheritedSecrets },
 			recordedSecretValues,
 			noEchoAttributeResources: this.noEchoAttributeResources,
@@ -43618,12 +44032,111 @@ var DeployEngine = class DeployEngine {
 			return next;
 		});
 	}
+	/**
+	* Re-read a STALE record's attributes from AWS (issue
+	* [#1852](https://github.com/go-to-k/cdkd/issues/1852)) — the resolver calls
+	* this, through `ResolverContext.attributeHealer`, only when `Fn::GetAtt` is
+	* about to take the physical-id fallback.
+	*
+	* The read is the provider's `import()` with `knownPhysicalId` — the same
+	* primitive `orphan-adoption.ts` verifies a record with. It is READ-ONLY by
+	* contract ("verify the resource exists and fetch attributes, do NOT
+	* search"), it returns the map `create()` records (so a healed record looks
+	* like a fresh one), and it is routed by the record's own `resourceType` +
+	* `provisionedBy`, so a Cloud-Control-routed record is read through Cloud
+	* Control. `getAttribute()` was the alternative and is implemented by about
+	* half the providers — neither of the two types this issue names.
+	*
+	* NEVER throws and never retries: every failure is an outcome the resolver
+	* words its refusal from, and the memo makes one read per record per deploy
+	* the ceiling.
+	*/
+	healStaleAttributes(logicalId, resource, stackName) {
+		if (!this.isHealEligible(logicalId, resource)) return Promise.resolve({ kind: "not-attempted" });
+		const key = `${logicalId}\u0000${resource.physicalId}`;
+		const inFlight = this.attributeHeals.get(key);
+		if (inFlight) return inFlight;
+		const heal = this.readStaleAttributes(logicalId, resource, stackName).catch((error) => ({
+			kind: "failed",
+			error
+		}));
+		this.attributeHeals.set(key, heal);
+		return heal;
+	}
+	/**
+	* Is `resource` still the record this deploy LOADED — same physical id, same
+	* `attributes` object — and of a type whose attributes are an AWS read-back?
+	* See {@link healBaseline}. Asked by the read AND by the persist merge: a
+	* read taken before this deploy rewrote the record must reach neither a later
+	* resolution nor the rewritten record.
+	*/
+	isHealEligible(logicalId, resource) {
+		const loaded = Object.hasOwn(this.healBaseline, logicalId) ? this.healBaseline[logicalId] : void 0;
+		return loaded !== void 0 && loaded.physicalId === resource.physicalId && loaded.attributes === resource.attributes && !isHealExcludedType(resource.resourceType);
+	}
+	async readStaleAttributes(logicalId, resource, stackName) {
+		const { provider } = this.providerRegistry.getProviderFor({
+			resourceType: resource.resourceType,
+			properties: resource.properties,
+			provisionedBy: resource.provisionedBy
+		});
+		if (!provider.import) return { kind: "not-attempted" };
+		const found = await provider.import({
+			logicalId,
+			resourceType: resource.resourceType,
+			stackName,
+			region: this.stackRegion,
+			properties: resource.properties,
+			knownPhysicalId: resource.physicalId
+		});
+		if (found === null) return { kind: "not-found" };
+		if (found.physicalId !== resource.physicalId) throw new Error(`the provider answered for a different resource (${found.physicalId}) than the one asked about (${resource.physicalId})`);
+		const reported = Object.entries(normalizeHealedAttributes(found.attributes));
+		const attributes = Object.fromEntries(reported.filter(([, value]) => !carriesSecretMask(value)));
+		const withheldKeys = reported.filter(([, value]) => carriesSecretMask(value)).map(([key]) => key);
+		if (Object.keys(attributes).length > 0) this.healedAttributes.set(logicalId, {
+			physicalId: resource.physicalId,
+			resourceType: resource.resourceType,
+			attributes
+		});
+		this.logger.debug(`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS — its state record lacked one a Fn::GetAtt asked for (#1852): ${Object.keys(attributes).length} attribute(s) read`);
+		return {
+			kind: "read",
+			attributes,
+			...withheldKeys.length > 0 && { withheldKeys }
+		};
+	}
+	/**
+	* The record to persist for `logicalId`: `record` itself, or a copy whose
+	* `attributes` gained what this deploy's heal read. MERGED, never replaced —
+	* only `attributes` is touched, and within it only keys the record does not
+	* hold (or holds as a pre-#1681 placeholder ARN). Skipped when the record no
+	* longer describes the resource that was read: a replacement or a Type change
+	* this deploy made.
+	*/
+	withHealedAttributes(logicalId, record) {
+		const healed = this.healedAttributes.get(logicalId);
+		if (healed === void 0 || healed.physicalId !== record.physicalId || healed.resourceType !== record.resourceType || !this.isHealEligible(logicalId, record)) return record;
+		const merged = mergeHealedAttributes(record.attributes, healed.attributes, (key, value) => isStalePlaceholderArnAttribute(record.resourceType, key, value));
+		return merged === record.attributes || merged === void 0 ? record : {
+			...record,
+			attributes: merged
+		};
+	}
+	/** Would a save of `resources` persist something a heal read? The no-change path's trigger. */
+	hasUnpersistedHeals(resources) {
+		for (const logicalId of this.healedAttributes.keys()) {
+			const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+			if (record !== void 0 && this.withHealedAttributes(logicalId, record) !== record) return true;
+		}
+		return false;
+	}
 	redactStateForPersist(state) {
 		const resources = {};
 		for (const [logicalId, record] of Object.entries(state.resources)) {
 			const secrets = this.perResourceSecrets.get(logicalId);
 			const templateProps = this.perResourceTemplateProps.get(logicalId);
-			resources[logicalId] = scrubResourceRecord(record, secrets ?? /* @__PURE__ */ new Map(), templateProps);
+			resources[logicalId] = scrubResourceRecord(this.withHealedAttributes(logicalId, record), secrets ?? /* @__PURE__ */ new Map(), templateProps);
 		}
 		const orphans = state.orphans?.map((entry) => {
 			const sameResource = this.perResourceResolvedType.get(entry.logicalId) === entry.state.resourceType;
@@ -43975,6 +44488,7 @@ var DeployEngine = class DeployEngine {
 				lastModified: Date.now()
 			};
 			const currentEtag = currentStateData?.etag;
+			this.healBaseline = currentState.resources ?? {};
 			refuseMalformedOutputs(currentState, stackName, this.stackRegion);
 			refuseMalformedResourcesForDeploy(currentState, stackName, this.stackRegion);
 			const migrationPending = currentStateData?.migrationPending ?? false;
@@ -44067,7 +44581,8 @@ var DeployEngine = class DeployEngine {
 					if (merge?.kind === "kept" && !outputMapsEqual(persistedOutputs, resolvedOutputs)) this.logger.warn(`Outputs changed but one or more could not be resolved; keeping the previously persisted outputs. ${keptWholeReasonText(merge.reason)} A downstream Fn::ImportValue may fail until the next deploy.`);
 					else if (merge?.kind === "merged" && merge.carriedKeys.length > 0) this.logger.debug(`Kept the previously persisted value of ${merge.carriedKeys.length} output key(s), carried export aliases included, that could not be resolved (no-change path, #2771)`);
 					const skippedOutputsChanged = !skippedOutputsEqual(currentState.skippedOutputs, this.skippedOutputs);
-					if (observedRefresh || outputsChanged || exportSetChanged || skippedOutputsChanged || orphansChanged) try {
+					const healedAttributesPending = this.hasUnpersistedHeals(currentState.resources);
+					if (observedRefresh || outputsChanged || exportSetChanged || skippedOutputsChanged || orphansChanged || healedAttributesPending) try {
 						const refreshedState = {
 							version: 10,
 							region: this.stackRegion,
@@ -44093,6 +44608,7 @@ var DeployEngine = class DeployEngine {
 								outputs: this.redactOutputs(refreshedState.outputs)
 							}));
 						} else if (observedRefresh) this.logger.debug("Persisted refreshed observedProperties (no-change path)");
+						else if (healedAttributesPending) this.logger.debug("Persisted attributes re-read from AWS for a stale record (no-change path, #1852)");
 						else this.logger.debug("Persisted skipped-outputs record (no outputs-value diff, no-change path, #2740)");
 					} catch (saveError) {
 						this.logger.warn(`Failed to persist no-change state update: ${saveError instanceof Error ? saveError.message : String(saveError)} — drift baseline / outputs will be re-resolved on next deploy.`);
@@ -44275,7 +44791,8 @@ var DeployEngine = class DeployEngine {
 							previousState,
 							physicalId: newResources[logicalId]?.physicalId,
 							properties: newResources[logicalId]?.properties,
-							...change.changeType === "UPDATE" && { oldResourceRetained: this.retainedOldOnReplacement.has(logicalId) }
+							...change.changeType === "UPDATE" && { oldResourceRetained: this.retainedOldOnReplacement.has(logicalId) },
+							...change.changeType === "UPDATE" && previousState !== void 0 && { previousResourceType: previousState.resourceType }
 						});
 						saveStateAfterResource(logicalId);
 					}, () => this.interrupted);
@@ -44656,7 +45173,8 @@ var DeployEngine = class DeployEngine {
 		const resourceType = change.resourceType;
 		const renderer = getLiveRenderer();
 		const labelRecreateDirection = this.recreateDirectionFor(stackName, logicalId);
-		const needsReplacement = change.changeType === "UPDATE" && (change.propertyChanges?.some((pc) => pc.requiresReplacement) ?? false) || labelRecreateDirection !== void 0;
+		const labelRecordedType = stateResources[logicalId]?.resourceType;
+		const needsReplacement = change.changeType === "UPDATE" && ((change.propertyChanges?.some((pc) => pc.requiresReplacement) ?? false) || labelRecordedType !== void 0 && labelRecordedType !== resourceType) || labelRecreateDirection !== void 0;
 		const verb = change.changeType === "CREATE" ? "Creating" : change.changeType === "DELETE" ? "Deleting" : needsReplacement ? "Replacing" : "Updating";
 		const labelRouting = this.peekRoutingForLabel(change, stateResources[logicalId], stackName, logicalId, needsReplacement, labelRecreateDirection);
 		const baseLabel = `${verb} ${logicalId} (${resourceType})${labelRouting === "cc-api" ? " [CC API]" : ""}`;
@@ -44883,12 +45401,12 @@ var DeployEngine = class DeployEngine {
 	* #960 follow-up) and the name-idempotent same-id guard (issue #1238) so
 	* the two --replace escape hatches cannot drift apart.
 	*/
-	async replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, secrets, updateReplacePolicy) {
+	async replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, secrets, updateReplacePolicy) {
 		const createContext = { maskSecrets: createSecretMasker(secrets) };
-		const finalSnapshotIdentifier = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, updateReplacePolicy);
+		const finalSnapshotIdentifier = await this.prepareFinalSnapshotForDelete(logicalId, oldResourceType, currentResource, updateReplacePolicy);
 		let deleteResult;
 		try {
-			deleteResult = await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
+			deleteResult = await oldDeleteProvider.delete(logicalId, currentResource.physicalId, oldResourceType, currentResource.properties, {
 				expectedRegion: this.stackRegion,
 				forceDataDelete: this.options.forceStatefulRecreation === true,
 				...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
@@ -44974,6 +45492,8 @@ var DeployEngine = class DeployEngine {
 			case "UPDATE": {
 				const currentResource = existingState;
 				if (!currentResource) throw new Error(`Cannot update ${logicalId}: resource not found in state`);
+				const oldResourceType = currentResource.resourceType;
+				const typeChanged = oldResourceType !== resourceType;
 				const desiredProps = change.desiredProperties || {};
 				const currentProps = change.currentProperties || {};
 				const currentPropsAsWritten = currentResource.provisionedBy === "cc-api" ? currentProps : withoutSilentDropProperties(resourceType, currentProps);
@@ -44996,7 +45516,7 @@ var DeployEngine = class DeployEngine {
 				const desiredForSkipCheck = redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps);
 				const allowedSilentDrops = this.providerRegistry.getAllowedUnsupportedProperties?.();
 				const desiredForSkipCheckAsWritten = currentResource.provisionedBy !== "cc-api" && allowedSilentDrops ? withoutAcceptedSilentDropProperties(resourceType, desiredForSkipCheck, allowedSilentDrops) : desiredForSkipCheck;
-				if (JSON.stringify(desiredForSkipCheckAsWritten) === JSON.stringify(currentPropsAsWritten)) {
+				if (!typeChanged && JSON.stringify(desiredForSkipCheckAsWritten) === JSON.stringify(currentPropsAsWritten)) {
 					if (change.attributeChanges && change.attributeChanges.length > 0) {
 						const attrSummary = change.attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
 						this.logger.info(`  ↻ ${logicalId} (${resourceType}) attribute update: ${attrSummary}`);
@@ -45015,7 +45535,7 @@ var DeployEngine = class DeployEngine {
 					if (counts) counts.skipped++;
 					break;
 				}
-				const propertyDrivenReplacement = change.propertyChanges?.some((pc) => pc.requiresReplacement);
+				const propertyDrivenReplacement = typeChanged || change.propertyChanges?.some((pc) => pc.requiresReplacement);
 				const recreateTargets = this.options.recreateTargets?.stackName === stackName ? this.options.recreateTargets : void 0;
 				const recreateViaCcApi = recreateTargets?.viaCcApi.has(logicalId) ?? false;
 				const recreateViaSdkProvider = recreateTargets?.viaSdkProvider.has(logicalId) ?? false;
@@ -45025,17 +45545,17 @@ var DeployEngine = class DeployEngine {
 				const updateReplacePolicy = template?.Resources?.[logicalId]?.UpdateReplacePolicy;
 				if (needsReplacement) {
 					if (propertyDrivenReplacement && !recreateFlagged && updateReplacePolicy !== "Retain") {
-						const statefulReason = isStatefulRecreateTargetForReplace(resourceType, currentProps, currentResource.observedProperties);
+						const statefulReason = isStatefulRecreateTargetForReplace(oldResourceType, currentProps, currentResource.observedProperties);
 						if (statefulReason && this.options.forceStatefulRecreation !== true) {
-							const immutableProps = change.propertyChanges?.filter((pc) => pc.requiresReplacement).map((pc) => pc.path).join(", ");
-							throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement (immutable property changed: ${immutableProps}) but it is a stateful resource — ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.`, "STATEFUL_REPLACE_BLOCKED"));
+							const immutableProps = change.propertyChanges?.filter((pc) => pc.requiresReplacement).map((pc) => pc.path).join(", ") || "Type";
+							throw markNonRetryable(new CdkdError(`${logicalId} (${oldResourceType}) requires replacement (immutable property changed: ${immutableProps}${typeChanged ? `, to ${resourceType}` : ""}) but it is a stateful resource — ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.`, "STATEFUL_REPLACE_BLOCKED"));
 						}
 					}
 					let replacementReason;
 					if (recreateViaCcApi) replacementReason = "--recreate-via-cc-api flag (mid-life SDK→CC migration)";
 					else if (recreateViaSdkProvider) replacementReason = "--recreate-via-sdk-provider flag (mid-life CC→SDK migration)";
 					else replacementReason = `immutable properties changed: ${change.propertyChanges?.filter((pc) => pc.requiresReplacement).map((pc) => pc.path).join(", ")}`;
-					this.logger.info(`Replacing ${logicalId} (${resourceType}) - ${replacementReason}`);
+					this.logger.info(`Replacing ${logicalId} (${typeChanged ? `${oldResourceType} -> ${resourceType}` : resourceType}) - ${replacementReason}`);
 					const recreateDirectionHint = recreateViaCcApi ? "cc-api" : recreateViaSdkProvider ? "sdk" : void 0;
 					const replaceDecision = this.providerRegistry.getProviderFor({
 						resourceType,
@@ -45046,9 +45566,14 @@ var DeployEngine = class DeployEngine {
 					const replaceProvider = replaceDecision.provider;
 					const replaceProps = replaceDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
 					const oldDeleteProvider = this.providerRegistry.getProviderFor({
-						resourceType,
+						resourceType: oldResourceType,
 						provisionedBy: currentResource.provisionedBy
 					}).provider;
+					const equalIdIsSameResource = equalIdNamesSameResource({
+						oldType: oldResourceType,
+						newType: resourceType,
+						createLayer: replaceDecision.provisionedBy
+					});
 					let createResult;
 					if (recreateFlagged) {
 						const recreateFlagName = recreateViaCcApi ? "--recreate-via-cc-api" : "--recreate-via-sdk-provider";
@@ -45057,10 +45582,10 @@ var DeployEngine = class DeployEngine {
 							this.logger.warn(`  ⚠ ${logicalId} has UpdateReplacePolicy: Retain — ${recreateFlagName} will leak the old physical resource (${currentResource.physicalId}). The new resource shares the same name where applicable; if the type has user-supplied names (e.g. functionName, bucketName), the create will deterministically collide with the retained orphan.`);
 						} else {
 							this.logger.info(`  Destroying old ${logicalId} (${currentResource.physicalId}) before recreate...`);
-							const recreateFinalSnapshotId = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, updateReplacePolicy);
+							const recreateFinalSnapshotId = await this.prepareFinalSnapshotForDelete(logicalId, oldResourceType, currentResource, updateReplacePolicy);
 							let recreateDeleteResult;
 							try {
-								recreateDeleteResult = await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
+								recreateDeleteResult = await oldDeleteProvider.delete(logicalId, currentResource.physicalId, oldResourceType, currentResource.properties, {
 									expectedRegion: this.stackRegion,
 									forceDataDelete: this.options.forceStatefulRecreation === true,
 									...recreateFinalSnapshotId !== void 0 && { finalSnapshotIdentifier: recreateFinalSnapshotId }
@@ -45082,7 +45607,7 @@ var DeployEngine = class DeployEngine {
 							onInterrupted: () => new InterruptedError(this.interruptCause ?? "user"),
 							isRetryable: isRecreateRetryableError
 						});
-						if (updateReplacePolicy === "Retain" && createResult.physicalId === currentResource.physicalId) throw new CdkdError(`${logicalId} (${resourceType}) recreate returned the existing resource (${currentResource.physicalId}) instead of creating a new one — its Create API is name-idempotent — and UpdateReplacePolicy: Retain means the old resource was never destroyed, so the new properties were not applied. Rename the resource in your CDK code (or remove the explicit physical name) so the recreate can produce a genuinely new resource.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
+						if (equalIdIsSameResource && updateReplacePolicy === "Retain" && createResult.physicalId === currentResource.physicalId) throw new CdkdError(`${logicalId} (${resourceType}) recreate returned the existing resource (${currentResource.physicalId}) instead of creating a new one — its Create API is name-idempotent — and UpdateReplacePolicy: Retain means the old resource was never destroyed, so the new properties were not applied. Rename the resource in your CDK code (or remove the explicit physical name) so the recreate can produce a genuinely new resource.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
 					} else {
 						this.logger.info(`  Creating new ${logicalId}...`);
 						let deletedOldFirst = false;
@@ -45092,19 +45617,20 @@ var DeployEngine = class DeployEngine {
 							const createMsg = createError instanceof Error ? createError.message : String(createError);
 							if (!isNameCollisionErrorFrom(createError, logicalId)) throw createError;
 							const nameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
-							if (updateReplacePolicy === "Retain") throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. ${nameOrigin.descriptor}. ${nameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed.`, "NAMED_REPLACEMENT_COLLISION");
-							if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but the create-first attempt collided with the existing resource: ${createMsg}. ${nameOrigin.descriptor}, so the CloudFormation-style safe replacement order (create the new resource before deleting the old) cannot reuse the occupied name — CloudFormation refuses this shape with "cannot update a stack when a custom-named resource requires replacing". ${nameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated).`, "NAMED_REPLACEMENT_COLLISION");
+							const typeChangeCollisionNote = typeChanged ? ` Note: this replacement changes the resource's Type (${oldResourceType} -> ${resourceType}). Unless those two types share one name space, the name is held by an unrelated existing ${resourceType}, not by the ${oldResourceType} being replaced — then deleting the old resource first cannot free it, and the fix is a different name.` : "";
+							if (updateReplacePolicy === "Retain") throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. ${nameOrigin.descriptor}. ${nameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed.${typeChangeCollisionNote}`, "NAMED_REPLACEMENT_COLLISION");
+							if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but the create-first attempt collided with the existing resource: ${createMsg}. ${nameOrigin.descriptor}, so the CloudFormation-style safe replacement order (create the new resource before deleting the old) cannot reuse the occupied name — CloudFormation refuses this shape with "cannot update a stack when a custom-named resource requires replacing". ${nameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated).${typeChangeCollisionNote}`, "NAMED_REPLACEMENT_COLLISION");
 							this.logger.info(`  Create-first collided with the existing resource's name and --replace is set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
 							deletedOldFirst = true;
-							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy);
+							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy);
 						}
-						if (!deletedOldFirst && createResult.physicalId === currentResource.physicalId) {
+						if (equalIdIsSameResource && !deletedOldFirst && createResult.physicalId === currentResource.physicalId) {
 							const idempotentNameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
 							if (updateReplacePolicy === "Retain") throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its Create API is name-idempotent: the create-first attempt returned the existing resource (${currentResource.physicalId}) instead of creating a new one, and UpdateReplacePolicy: Retain pins that resource in place. ${idempotentNameOrigin.descriptor}. ${idempotentNameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
 							if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its Create API is name-idempotent: the create-first attempt returned the EXISTING resource (${currentResource.physicalId}) instead of creating a new one, so deleting the "old" resource would silently destroy the resource the deploy just reported as created. ${idempotentNameOrigin.descriptor}; ${idempotentNameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated). Note: this branch is also reached when the old resource was deleted out-of-band and the physical id is name-derived — there the create was a genuine fresh create; \`--replace\` converges that case too.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
 							this.logger.info(`  Create-first returned the existing resource (name-idempotent Create API) and --replace is set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
 							deletedOldFirst = true;
-							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy);
+							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy);
 						}
 						if (deletedOldFirst) {} else if (updateReplacePolicy === "Retain") {
 							this.retainedOldOnReplacement.add(logicalId);
@@ -45114,7 +45640,7 @@ var DeployEngine = class DeployEngine {
 							let cleanupFinalSnapshotId;
 							let snapshotBlockedDelete = false;
 							try {
-								cleanupFinalSnapshotId = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, updateReplacePolicy);
+								cleanupFinalSnapshotId = await this.prepareFinalSnapshotForDelete(logicalId, oldResourceType, currentResource, updateReplacePolicy);
 							} catch (snapshotError) {
 								if (snapshotError instanceof CdkdError && snapshotError.code === "FINAL_SNAPSHOT_UNSUPPORTED") throw snapshotError;
 								snapshotBlockedDelete = true;
@@ -45124,7 +45650,7 @@ var DeployEngine = class DeployEngine {
 								let cleanupDeleteResult = void 0;
 								let cleanupDeleteFailed = false;
 								try {
-									cleanupDeleteResult = await oldDeleteProvider.delete(logicalId, currentResource.physicalId, resourceType, currentResource.properties, {
+									cleanupDeleteResult = await oldDeleteProvider.delete(logicalId, currentResource.physicalId, oldResourceType, currentResource.properties, {
 										expectedRegion: this.stackRegion,
 										forceDataDelete: this.options.forceStatefulRecreation === true,
 										...cleanupFinalSnapshotId !== void 0 && { finalSnapshotIdentifier: cleanupFinalSnapshotId }
@@ -45980,5 +46506,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { secretBearing as $, SynthesisError as $i, recordMaskOnlyValue as $n, AssetManifestLoader as $r, s3BucketArn as $t, extractDeploymentEventError as A, getAwsClients as Ai, refuseMalformedState as An, BOOTSTRAP_MARKER_PREFIX as Ar, isImpossibleEmptyStoredAttribute as At, toCfnInteger as B, IntrinsicResolutionRefusalError as Bi, STATE_SOURCED_BASELINE_RULES as Bn, buildDockerImage as Br, coerceCfnBoolean as Bt, buildFinalSnapshotIdentifier as C, canonicalizeRegion as Ci, producerRecordKey as Cn, stringifyValue as Cr, isTerminationProtectionPropagationError as Ct, refusesFinalSnapshot as D, clearBucketRegionCache as Di, refuseMalformedOutputsForDestroy as Dn, loadPublishableAssetManifest as Dr, cfnRefValueFromPhysicalId as Dt, isFinalSnapshotError as E, processStackMessages as Ei, refuseMalformedOutputs as En, createAssetRedirectResolver as Er, carriesFetchableDynamicReference as Et, isStatefulRecreateTargetSync as F, ConfigError as Fi, findSilentDropProperties as Fn, parseBootstrapMarker as Fr, isSettledInstanceState as Ft, gray as G, NestedStackChildDirectDestroyError as Gi, createSecretMasker as Gn, formatDockerLoginError as Gr, readConfigString as Gt, formatResourceLine as H, LocalStartServiceError as Hi, STATE_SOURCED_READBACK_RULES as Hn, describeDockerExecFailure as Hr, configBooleanRefusal as Ht, renderStatefulReason as I, CrossAccountSecretRefusalError as Ii, describeTypeWithThrottleRetry as In, readBootstrapMarkerBody as Ir, WAFv2WebACLProvider as It, yellow as J, ResourceTimeoutError as Ji, identityKeyFor as Jn, redactDockerArgvValues as Jr, requireConfigObject as Jt, green as K, PartialFailureError as Ki, dynamicReferenceTokens as Kn, getDockerCmd as Kr, replayWarn as Kt, WARM_THROUGHPUT_MEMBERS as L, DependencyError as Li, withRetry as Ln, validateAssetBucketName as Lr, normalizeAwsTagsToCfn as Lt, planOrphanAdoption as M, setAwsClients as Mi, repairMalformedResourcePropertiesForReadOnly as Mn, ensureAssetStorage as Mr, isUnboundTemplateParameter as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, AssetError as Ni, repairMalformedResourcesForReadOnly as Nn, getBootstrapMarkerKey as Nr, parameterTypeMayLoseSecretIdentity as Nt, unsupportedFinalSnapshotError as O, resolveBucketRegion as Oi, refuseMalformedResourcePropertiesForOrphan as On, rewriteTemplateAssetReferences as Or, coerceParameterTypedValue as Ot, isStatefulRecreateTargetForReplace as P, CdkdError as Pi, findActionableSilentDrops as Pn, isCrossRegionRedirect as Pr, refStateLookupFromResource as Pt, isExportAliasCollision as Q, StateError as Qi, maskSecretsInText as Qn, stripControlChars as Qr, withSharedDrainBudget as Qt, coerceWarmThroughput as R, DeployCancelledError as Ri, DagBuilder as Rn, validateContainerRepoName as Rr, resolveExplicitPhysicalId as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, PARTITION_TABLE as Si, malformedStateRefusalMessage as Sn, AssetPublisher as Sr, disableInstanceApiTermination as St, createPreDeleteFinalSnapshot as T, AssemblyReader as Ti, refuseMalformedNestedChildOutputs as Tn, buildAssetRedirectMap as Tr, carriesDynamicReference as Tt, bold as U, LockError as Ui, TEMPLATE_SOURCED_RULES as Un, describeDockerFailure as Ur, configIntegerRefusal as Ut, toFiniteNumber as V, LocalInvokeBuildError as Vi, STATE_SOURCED_CROSS_GENERATION_RULES as Vn, describeDockerCapturedOutput as Vr, coerceCfnInteger as Vt, cyan as W, MalformedProducerRecordRefusalError as Wi, carriesSecretMask as Wn, dockerSpawnEnvWithSensitive as Wr, configStringRefusal as Wt, collectPublishedOutputNames as X, StackHasActiveImportsError as Xi, markSameGenerationBag as Xn, runDockerStreaming as Xr, classifyReplaySecretRegion as Xt, collectDeclaredOutputNames as Y, ResourceUpdateNotSupportedError as Yi, isSingleDynamicReferenceToken as Yn, runDockerForeground as Yr, requireConfigString as Yt, exportAliasCollisionScrubWarning as Z, StackTerminationProtectionError as Zi, maskSecretsInError as Zn, escapeRegExp$1 as Zr, producerRegionsFromState as Zt, isSecretBearingReferenceString as _, findLargeInlineResources as _i, malformedOutputsRefusalMessage as _n, importableOutputs as _r, isWaitAbandonedError as _t, DeploymentEventsStore as a, isRetryableTransientError as aa, resolveApp as ai, AWS_CREDENTIAL_ENV_KEYS as an, rebuildClientForBucketRegion as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, decodeListingKey as bi, malformedResourcePropertiesWarning as bn, orphansCarriedFrom as br, deleteIndeterminateGuards as bt, replayFailedOperations as c, markNonRetryable as ca, resolveSkipPrefix as ci, envCredentialsAreAssumedRole as cn, buildLockContentionMessage as cr, createMaskedRetryLogger as ct, updatePartialReason as d, describeAwsFailure as da, resolveUseCdkBootstrapAssets as di, STATE_RESOURCES_MALFORMED as dn, shellQuote as dr, beginCommandInterruptScope as dt, formatError as ea, getDockerImageBySourceHash as ei, s3BucketDomainName as en, recoverMaskedOutput as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, safeStringify$1 as fa, stateBucketExistenceConfirmed as fi, hasReadableOutputs as fn, CUSTOM_RESOURCE_RESPONSE_PREFIX as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, MIGRATE_TMP_PREFIX as gi, malformedLocalOutputsWarning as gn, importableOutputKeys as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, CFN_TEMPLATE_URL_LIMIT as hi, malformedExportSourceWarning as hn, hasReadableExportSet as hr, startInterruptWatch as ht, DeploymentEventsReader as i, isMarkedNonRetryable as ia, getLegacyStateBucketName as ii, applyRoleArnIfSet as in, S3StateBackend as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, resetAwsClients as ji, repairMalformedOutputsForReadOnly as jn, assertAssetBucketRegion as jr, isNamelessDynamicReferenceError as jt, makeCanonicalizePropertiesFn as k, AwsClients as ki, refuseMalformedResourcesForDestroy as kn, AssetModeResolver as kr, getAccountInfo as kt, replayRollback as l, markRedactedCause as la, resolveStateBucketWithDefault as li, DiffCalculator as ln, forceQuitRecoveryClause as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, CFN_TEMPLATE_BODY_LIMIT as mi, malformedExportNamesWarning as mn, exportNamesCarriedFrom as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, normalizeAwsError as na, synthesisStatusMessage as ni, s3BucketRegionalDomainName as nn, scrubResourceRecord as nr, getCurrentResourceSecrets as nt, planFailedOps as o, isThrottlingError as oa, resolveAutoAssetStorage as oi, applyCallerIdentityCredentials as on, UNREPRODUCIBLE_LOCK_CLAUSE as or, ProviderRegistry as ot, maskingRetryLogger as p, __exportAll as pa, warnDeprecatedNoPrefixCliFlag as pi, hasReadableResources as pn, DEFAULT_STATE_PREFIX as pr, interruptWatchListenerCount as pt, red as q, ProvisioningError as qi, errorCauseChain as qn, partitionSensitiveEnv as qr, requireConfigArray as qt, DeployEngine as r, withErrorHandling as ra, getDefaultStateBucketName as ri, s3BucketWebsiteUrl as rn, LockManager as rr, IAMRoleProvider as rt, planRollback as s, isTransientServerError as sa, resolveCaptureObservedState as si, callerEnvCredentials as sn, buildForceUnlockCommand as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, isCdkdError as ta, Synthesizer as ti, s3BucketDualStackDomainName as tn, redactSecretsForState as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, retryClassificationText as ua, resolveStateBucketWithDefaultAndSource as ui, INTRINSIC_KEYS as un, formatLockExpiry as ur, maskerOrIdentity as ut, keptWholeReasonText as v, uploadCfnTemplate as vi, malformedOutputsWarning as vn, isReadableBag as vr, slowCcOperationTimeoutMs as vt, ccRoutedFinalSnapshotError as w, derivePartitionAndUrlSuffix as wi, refuseDivergentRecordRegionForDestroy as wn, WorkGraph as wr, IntrinsicFunctionResolver as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, expectedOwnerParam as xi, malformedResourcesWarning as xn, shouldRetainResource as xr, deleteSkipReason as xt, mergeNoChangeOutputs as y, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as yi, malformedRenderedContainersWarning as yn, orphansAfterRollback as yr, UNSPECIFIED_SKIP_REASON as yt, isWarmThroughputDecrease as z, DynamicReferenceRegionAmbiguousError as zi, TemplateParser as zn, buildDenyExternalAccessPolicy as zr, assertRegionMatch as zt };
-//# sourceMappingURL=deploy-engine-CfOsVRQB.js.map
+export { isExportAliasCollision as $, StateError as $i, maskSecretsInText as $n, stripControlChars as $r, withSharedDrainBudget as $t, makeCanonicalizePropertiesFn as A, AwsClients as Ai, refuseMalformedResourcesForDestroy as An, AssetModeResolver as Ar, getAccountInfo as At, isWarmThroughputDecrease as B, DynamicReferenceRegionAmbiguousError as Bi, TemplateParser as Bn, buildDenyExternalAccessPolicy as Br, assertRegionMatch as Bt, PRE_DELETE_SNAPSHOT_TYPES as C, PARTITION_TABLE as Ci, malformedStateRefusalMessage as Cn, AssetPublisher as Cr, disableInstanceApiTermination as Ct, isFinalSnapshotError as D, processStackMessages as Di, refuseMalformedOutputs as Dn, createAssetRedirectResolver as Dr, carriesFetchableDynamicReference as Dt, createPreDeleteFinalSnapshot as E, AssemblyReader as Ei, refuseMalformedNestedChildOutputs as En, buildAssetRedirectMap as Er, carriesDynamicReference as Et, isStatefulRecreateTargetForReplace as F, CdkdError as Fi, findActionableSilentDrops as Fn, isCrossRegionRedirect as Fr, refStateLookupFromResource as Ft, cyan as G, MalformedProducerRecordRefusalError as Gi, carriesSecretMask as Gn, dockerSpawnEnvWithSensitive as Gr, configStringRefusal as Gt, toFiniteNumber as H, LocalInvokeBuildError as Hi, STATE_SOURCED_CROSS_GENERATION_RULES as Hn, describeDockerCapturedOutput as Hr, coerceCfnInteger as Ht, isStatefulRecreateTargetSync as I, ConfigError as Ii, findSilentDropProperties as In, parseBootstrapMarker as Ir, isSettledInstanceState as It, red as J, ProvisioningError as Ji, errorCauseChain as Jn, partitionSensitiveEnv as Jr, requireConfigArray as Jt, gray as K, NestedStackChildDirectDestroyError as Ki, createSecretMasker as Kn, formatDockerLoginError as Kr, readConfigString as Kt, renderStatefulReason as L, CrossAccountSecretRefusalError as Li, describeTypeWithThrottleRetry as Ln, readBootstrapMarkerBody as Lr, WAFv2WebACLProvider as Lt, makeSiblingClaimReader as M, resetAwsClients as Mi, repairMalformedOutputsForReadOnly as Mn, assertAssetBucketRegion as Mr, isNamelessDynamicReferenceError as Mt, planOrphanAdoption as N, setAwsClients as Ni, repairMalformedResourcePropertiesForReadOnly as Nn, ensureAssetStorage as Nr, isUnboundTemplateParameter as Nt, refusesFinalSnapshot as O, clearBucketRegionCache as Oi, refuseMalformedOutputsForDestroy as On, loadPublishableAssetManifest as Or, cfnRefValueFromPhysicalId as Ot, MULTI_REGION_RECREATE_BLOCKED_TYPES as P, AssetError as Pi, repairMalformedResourcesForReadOnly as Pn, getBootstrapMarkerKey as Pr, parameterTypeMayLoseSecretIdentity as Pt, exportAliasCollisionScrubWarning as Q, StackTerminationProtectionError as Qi, maskSecretsInError as Qn, escapeRegExp$1 as Qr, producerRegionsFromState as Qt, WARM_THROUGHPUT_MEMBERS as R, DependencyError as Ri, withRetry as Rn, validateAssetBucketName as Rr, normalizeAwsTagsToCfn as Rt, ATOMIC_FINAL_SNAPSHOT_TYPES as S, expectedOwnerParam as Si, malformedResourcesWarning as Sn, shouldRetainResource as Sr, deleteSkipReason as St, ccRoutedFinalSnapshotError as T, derivePartitionAndUrlSuffix as Ti, refuseDivergentRecordRegionForDestroy as Tn, WorkGraph as Tr, IntrinsicFunctionResolver as Tt, formatResourceLine as U, LocalStartServiceError as Ui, STATE_SOURCED_READBACK_RULES as Un, describeDockerExecFailure as Ur, configBooleanRefusal as Ut, toCfnInteger as V, IntrinsicResolutionRefusalError as Vi, STATE_SOURCED_BASELINE_RULES as Vn, buildDockerImage as Vr, coerceCfnBoolean as Vt, bold as W, LockError as Wi, TEMPLATE_SOURCED_RULES as Wn, describeDockerFailure as Wr, configIntegerRefusal as Wt, collectDeclaredOutputNames as X, ResourceUpdateNotSupportedError as Xi, isSingleDynamicReferenceToken as Xn, runDockerForeground as Xr, requireConfigString as Xt, yellow as Y, ResourceTimeoutError as Yi, identityKeyFor as Yn, redactDockerArgvValues as Yr, requireConfigObject as Yt, collectPublishedOutputNames as Z, StackHasActiveImportsError as Zi, markSameGenerationBag as Zn, runDockerStreaming as Zr, classifyReplaySecretRegion as Zt, bagHoldsSecretExpression as _, MIGRATE_TMP_PREFIX as _i, malformedLocalOutputsWarning as _n, importableOutputKeys as _r, CloudControlProvider as _t, DeploymentEventsStore as a, isMarkedNonRetryable as aa, getLegacyStateBucketName as ai, applyRoleArnIfSet as an, S3StateBackend as ar, collectInlinePolicyNamesManagedBySiblings as at, mergeNoChangeOutputs as b, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as bi, malformedRenderedContainersWarning as bn, orphansAfterRollback as br, UNSPECIFIED_SKIP_REASON as bt, replayFailedOperations as c, isTransientServerError as ca, resolveCaptureObservedState as ci, callerEnvCredentials as cn, buildForceUnlockCommand as cr, wouldReturnToSdkProvider as ct, updatePartialMessage as d, retryClassificationText as da, resolveStateBucketWithDefaultAndSource as di, INTRINSIC_KEYS as dn, formatLockExpiry as dr, maskerOrIdentity as dt, SynthesisError as ea, AssetManifestLoader as ei, s3BucketArn as en, recordMaskOnlyValue as er, secretBearing as et, updatePartialReason as f, describeAwsFailure as fa, resolveUseCdkBootstrapAssets as fi, STATE_RESOURCES_MALFORMED as fn, shellQuote as fr, beginCommandInterruptScope as ft, computeImplicitDeleteEdges as g, CFN_TEMPLATE_URL_LIMIT as gi, malformedExportSourceWarning as gn, hasReadableExportSet as gr, startInterruptWatch as gt, IMPLICIT_DELETE_DEPENDENCIES as h, CFN_TEMPLATE_BODY_LIMIT as hi, malformedExportNamesWarning as hn, exportNamesCarriedFrom as hr, isInterruptedWaitError as ht, DeploymentEventsReader as i, withErrorHandling as ia, getDefaultStateBucketName as ii, s3BucketWebsiteUrl as in, LockManager as ir, IAMRoleProvider as it, extractDeploymentEventError as j, getAwsClients as ji, refuseMalformedState as jn, BOOTSTRAP_MARKER_PREFIX as jr, isImpossibleEmptyStoredAttribute as jt, unsupportedFinalSnapshotError as k, resolveBucketRegion as ki, refuseMalformedResourcePropertiesForOrphan as kn, rewriteTemplateAssetReferences as kr, coerceParameterTypedValue as kt, replayRollback as l, markNonRetryable as la, resolveSkipPrefix as li, envCredentialsAreAssumedRole as ln, buildLockContentionMessage as lr, createMaskedRetryLogger as lt, maskingRetryLogger as m, __exportAll as ma, warnDeprecatedNoPrefixCliFlag as mi, hasReadableResources as mn, DEFAULT_STATE_PREFIX as mr, interruptWatchListenerCount as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isCdkdError as na, Synthesizer as ni, s3BucketDualStackDomainName as nn, redactSecretsForState as nr, secretSafeKeyDisplay as nt, planFailedOps as o, isRetryableTransientError as oa, resolveApp as oi, AWS_CREDENTIAL_ENV_KEYS as on, rebuildClientForBucketRegion as or, clearOnUpdateRemoval as ot, withResourceDeadline as p, safeStringify$1 as pa, stateBucketExistenceConfirmed as pi, hasReadableOutputs as pn, CUSTOM_RESOURCE_RESPONSE_PREFIX as pr, endCommandInterruptScope as pt, green as q, PartialFailureError as qi, dynamicReferenceTokens as qn, getDockerCmd as qr, replayWarn as qt, DeployEngine as r, normalizeAwsError as ra, synthesisStatusMessage as ri, s3BucketRegionalDomainName as rn, scrubResourceRecord as rr, getCurrentResourceSecrets as rt, planRollback as s, isThrottlingError as sa, resolveAutoAssetStorage as si, applyCallerIdentityCredentials as sn, UNREPRODUCIBLE_LOCK_CLAUSE as sr, ProviderRegistry as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, formatError as ta, getDockerImageBySourceHash as ti, s3BucketDomainName as tn, recoverMaskedOutput as tr, secretBearingStateKeyWarning as tt, resolveReplacementOldType as u, markRedactedCause as ua, resolveStateBucketWithDefault as ui, DiffCalculator as un, forceQuitRecoveryClause as ur, maskDeep as ut, isSecretBearingReferenceString as v, findLargeInlineResources as vi, malformedOutputsRefusalMessage as vn, importableOutputs as vr, isWaitAbandonedError as vt, buildFinalSnapshotIdentifier as w, canonicalizeRegion as wi, producerRecordKey as wn, stringifyValue as wr, isTerminationProtectionPropagationError as wt, bindingSkippedOutputs as x, decodeListingKey as xi, malformedResourcePropertiesWarning as xn, orphansCarriedFrom as xr, deleteIndeterminateGuards as xt, keptWholeReasonText as y, uploadCfnTemplate as yi, malformedOutputsWarning as yn, isReadableBag as yr, slowCcOperationTimeoutMs as yt, coerceWarmThroughput as z, DeployCancelledError as zi, DagBuilder as zn, validateContainerRepoName as zr, resolveExplicitPhysicalId as zt };
+//# sourceMappingURL=deploy-engine-efiVJ-rX.js.map