@go-to-k/cdkd 0.294.10 → 0.294.12

package/dist/{deploy-engine-RCOtmm4V.js → deploy-engine-C35Ctso3.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js"
 import { A as displaySafe, E as UNRENDERABLE, F as safeMsg, L as truncateCodePoints, M as isPasteableIdent, O as displayAwsMessage, P as plainIdentOr, S as withoutGeneratedFallbackName, T as STACK_REF_MAX_CODE_POINTS, _ as getCurrentSkipPrefix, b as withSkipPrefix, c as getLiveRenderer, f as applyDefaultNameForFallback, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, m as explicitNamePropertyFor, n as getLogger, r as isStdoutReservedForPayload, s as installLogLineMaskerSource, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS, x as withStackName, y as looksLikeCdkdGeneratedName } from "./logger-B46YMG0h.js";
 import { $t as StateError, A as isTerminalDeleteFailure, An as isAmbiguousCcHandlerErrorCode, At as clientDefaultsFor, Bn as isMarkedNonRetryable, Bt as IntrinsicResolutionRefusalError, C as refusalTypeShown, Cn as isNameCollisionErrorFrom, D as ProtectionFlipRegistry, Dt as withPasteableAwsProfile, En as isReplayedNameCollisionFrom, Fn as retryClassificationText, Gt as MalformedProducerRecordRefusalError, H as pasteableAwsCommand, Hn as markNonRetryable, In as describeAwsFailure, It as CrossAccountSecretRefusalError, J as isInterruptedWaitError, Jt as ProvisioningError, Lt as DependencyError, M as observeThenDisableProtection, Mn as isIamPropagationError, Mt as AccountIdUnavailableError, N as protectionFlipKey, Nn as isRetryableTransientError, Nt as AssetError, O as compensateProtectionFlip, On as markReplayMayCollide, Ot as ambientClientDefaults, Pn as isTransientServerError, Pt as CdkdError, Q as canonicalizeRoute53QueryName, R as DELETION_PROTECTION_DOC_POINTER, Rn as safeStringify$1, S as quotedRemedyLogicalId, Sn as hasReplayMayCollide, St as injectiveKey, T as resolveExplicitPhysicalId, Tn as isRecreateRetryableError, Tt as producerRecordKey, U as protectedReplacementAdvice, Un as markRedactedCause, Ut as LockError, Vn as isThrottlingError, Wn as wrapMaskedAwsError, Wt as MacroExpansionError, X as ElapsedBudgetRegistry, Xt as ResourceUpdateNotSupportedError, Y as startInterruptWatch, Yt as ResourceTimeoutError, Z as monotonicNowMs, _n as shellQuote, _t as formatLockOperation, at as segmentAfterAnchor, b as isQuotableImportValue, bt as CUSTOM_RESOURCE_RESPONSE_PREFIX, cn as UNSHOWABLE_VALUE, ct as isSecretDerivedValue, d as prepareRemovalForUpdate, dn as isInertUnquoted, dt as withDerivedNameMasks, en as SynthesisError, et as compositeIdSeparatorRefusal, f as removalWarning, fn as pasteableCommand, ft as UNREPRODUCIBLE_LOCK_CLAUSE, g as assertRegionMatch, gn as shellBoundedDisplay, gt as formatLockExpiry, h as RESOURCE_NOT_FOUND, hn as quotedOrDescribed, i as holdsSecretDerivedEntry, it as resourceTypeShown, jn as isAmbiguousOutcomeError, jt as credentialFingerprint, k as deleteWithProtectionCompensation, kn as formatRetryClassificationSignals, kt as ambientCredentialConfig, l as withUnchangedSecretPrincipalLists, ln as commandHole, lt as maskDeep, m as withoutInjectedRemovals, mn as plainOrDescribed, nt as logicalIdShown, on as SHELL_ACTIVE, ot as createMaskedLogSinks, pn as physicalIdShownBesideCommand, pt as buildForceUnlockCommand, rn as normalizeAwsError, sn as SHELL_ACTIVE_WHY, st as createMaskedRetryLogger, ut as maskerOrIdentity, vn as withheldTargetClause, vt as formatLockOwner, wn as isNameCooldownError, x as normalizeAwsTagsToCfn, xn as isUpdateUnsupportedError, xt as DEFAULT_STATE_PREFIX, yt as sanitizeRecoveryValue, zt as DynamicReferenceRegionAmbiguousError } from "./iam-policy-targets-CMSQGQnm.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-BNo3JdVW.js";
+import { t as getCdkdVersion } from "./version-D_N3IrrJ.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4683,6 +4683,41 @@ function orphansAfterRollback(previous, newlyOrphaned) {
 //#endregion
 //#region src/types/rollback-journal.ts
 const ROLLBACK_JOURNAL_VERSION = 1;
+function splitImportedOps(ops, segment, except = /* @__PURE__ */ new Set()) {
+	const marks = segment.importedResources ?? [];
+	const replay = [];
+	const imported = [];
+	const displaced = [];
+	for (const op of ops) {
+		const ofId = except.has(op.logicalId) ? [] : marks.filter((m) => m.logicalId === op.logicalId);
+		if (ofId.length === 0) replay.push(op);
+		else if (ofId.some((m) => isMarkFor(m, op)) && retainedOldPhysicalId(op) === void 0) imported.push(op);
+		else displaced.push(op);
+	}
+	return {
+		replay,
+		imported,
+		displaced
+	};
+}
+function journalOpPhysicalId(op) {
+	if (op.physicalId !== void 0) return op.physicalId;
+	const prev = op.previousState?.physicalId;
+	return op.changeType === "DELETE" && typeof prev === "string" && prev !== "" ? prev : void 0;
+}
+function retainedOldPhysicalId(op) {
+	if (op.changeType !== "UPDATE") return void 0;
+	const prev = op.previousState?.physicalId;
+	if (typeof prev !== "string" || prev === "") return void 0;
+	const prevType = op.previousState?.resourceType;
+	const oldType = op.previousResourceType ?? (typeof prevType === "string" && prevType !== "" ? prevType : void 0);
+	if (!(prev !== journalOpPhysicalId(op) || oldType !== void 0 && oldType !== op.resourceType)) return void 0;
+	return op.oldResourceRetained !== false ? prev : void 0;
+}
+function isMarkFor(mark, op) {
+	const own = journalOpPhysicalId(op);
+	return own !== void 0 && mark.logicalId === op.logicalId && mark.physicalId === own && mark.resourceType === op.resourceType;
+}
 var UnknownRollbackJournalVersionError = class extends Error {
 	foundVersion;
 	stackName;
@@ -4753,6 +4788,7 @@ function parseRollbackJournal(bodyString, stackName) {
 			seg["failedOperations"].forEach((op, i) => refuseMalformedOperation(shownStack, `segments[${s}].failedOperations[${i}]`, op));
 		}
 		if (seg["supersededLogicalIds"] !== void 0 && (!Array.isArray(seg["supersededLogicalIds"]) || !seg["supersededLogicalIds"].every((id) => typeof id === "string"))) refuseMalformed(shownStack, `segments[${s}].supersededLogicalIds must be an array of strings when present.`);
+		if (seg["importedResources"] !== void 0 && (!Array.isArray(seg["importedResources"]) || !seg["importedResources"].every((m) => typeof m === "object" && m !== null && typeof m["logicalId"] === "string" && typeof m["physicalId"] === "string" && typeof m["resourceType"] === "string"))) refuseMalformed(shownStack, `segments[${s}].importedResources must be an array of { logicalId, physicalId, resourceType } strings when present.`);
 		if (seg["runId"] !== void 0 && typeof seg["runId"] !== "string") refuseMalformed(shownStack, `segments[${s}].runId must be a string when present (got ${kind(seg["runId"])}).`);
 		if (seg["skipPrefix"] !== void 0 && typeof seg["skipPrefix"] !== "boolean") refuseMalformed(shownStack, `segments[${s}].skipPrefix must be a boolean when present (got ${kind(seg["skipPrefix"])}).`);
 		const reads = seg["previousCrossStackReads"];
@@ -5370,6 +5406,23 @@ var S3StateBackend = class {
 		addSupersededIds(newest, logicalIds);
 		await this.putRawObject(this.getRollbackJournalKey(stackName, region), JSON.stringify(journal, null, 2));
 	}
+	async markRollbackJournalImported(stackName, region, marks) {
+		if (marks.length === 0) return [];
+		const journal = await this.loadRollbackJournal(stackName, region);
+		if (!journal) return [];
+		const marked = /* @__PURE__ */ new Set();
+		for (const segment of journal.segments) {
+			const named = new Set([...segment.operations, ...segment.failedOperations ?? []].map((op) => op.logicalId));
+			const hits = marks.filter((m) => named.has(m.logicalId));
+			if (hits.length === 0) continue;
+			segment.importedResources = [...(segment.importedResources ?? []).filter((k) => !hits.some((m) => m.logicalId === k.logicalId)), ...hits.map((m) => ({ ...m }))];
+			for (const m of hits) marked.add(m.logicalId);
+		}
+		if (marked.size === 0) return [];
+		addSupersededIds(journal.segments[journal.segments.length - 1], [...marked]);
+		await this.putRawObject(this.getRollbackJournalKey(stackName, region), JSON.stringify(journal, null, 2));
+		return [...marked];
+	}
 	async dropRollbackJournalSegments(stackName, region, drop) {
 		const journal = await this.loadRollbackJournal(stackName, region);
 		if (!journal) return 0;
@@ -6077,7 +6130,7 @@ const WHOLE_DYNAMIC_REFERENCE_PATTERN = new RegExp(`^\\{\\{resolve:${DYNAMIC_REF
 function isSingleDynamicReferenceToken(value) {
 	return WHOLE_DYNAMIC_REFERENCE_PATTERN.test(value);
 }
-function isPlainObject$3(value) {
+function isPlainObject$4(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
@@ -6262,7 +6315,7 @@ function crossStackSourceKey(source) {
 	}
 	if (key === "Fn::GetStackOutput") {
 		const args = source[key];
-		if (!isPlainObject$3(args)) return void 0;
+		if (!isPlainObject$4(args)) return void 0;
 		const stackName = Object.hasOwn(args, "StackName") ? literalStringOrUndefined(args["StackName"]) : void 0;
 		const outputName = Object.hasOwn(args, "OutputName") ? literalStringOrUndefined(args["OutputName"]) : void 0;
 		if (stackName === void 0 || outputName === void 0) return void 0;
@@ -6308,7 +6361,7 @@ function crossStackSourceKey(source) {
 		let template;
 		let variables;
 		if (typeof raw === "string") template = raw;
-		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$3(raw[1])) {
+		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$4(raw[1])) {
 			if (typeof raw[0] !== "string") return void 0;
 			template = raw[0];
 			variables = raw[1];
@@ -6408,7 +6461,7 @@ function appendValuePlaceholderParts(value, out, budget, depth) {
 	if (budget.exhausted) return;
 	const literal = joinPartLiteralText(value);
 	if (literal !== void 0) return pushPlaceholderPart(out, literal, budget);
-	if (isPlainObject$3(value) && Object.keys(value).length === 1) {
+	if (isPlainObject$4(value) && Object.keys(value).length === 1) {
 		const ref = value["Ref"];
 		if (typeof ref === "string" && ref !== "") return pushPlaceholderPart(out, keyedPart({ Ref: ref }), budget);
 		if (depth >= MAX_PLACEHOLDER_DEPTH) {
@@ -6440,7 +6493,7 @@ function appendParameterPlaceholderParts(source, out, budget, depth) {
 		let template;
 		let variables = {};
 		if (typeof args === "string") template = args;
-		else if (Array.isArray(args) && args.length === 2 && isPlainObject$3(args[1])) {
+		else if (Array.isArray(args) && args.length === 2 && isPlainObject$4(args[1])) {
 			template = args[0];
 			variables = args[1];
 		} else return false;
@@ -6583,7 +6636,7 @@ function isUniquelyKeyedBy(items, key) {
 	if (items.length === 0) return false;
 	const seen = /* @__PURE__ */ new Set();
 	for (const item of items) {
-		if (!isPlainObject$3(item) || !Object.hasOwn(item, key)) return false;
+		if (!isPlainObject$4(item) || !Object.hasOwn(item, key)) return false;
 		const id = item[key];
 		if (typeof id !== "string" || id === "") return false;
 		if (seen.has(id)) return false;
@@ -6613,7 +6666,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		return positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration);
 	}
-	if (typeof bag === "string" && isPlainObject$3(source)) {
+	if (typeof bag === "string" && isPlainObject$4(source)) {
 		const certified = positionByCrossStackSource(bag, source, secrets);
 		if (certified !== void 0) return certified;
 		const placeheld = positionByParameterPlaceholders(bag, source, secrets);
@@ -6623,7 +6676,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		const framed = positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIsSameGeneration);
 		if (framed !== void 0) return framed;
 	}
-	if (Array.isArray(bag) && isPlainObject$3(source)) {
+	if (Array.isArray(bag) && isPlainObject$4(source)) {
 		const positionedList = positionListByCrossStackSource(bag, source, secrets);
 		if (positionedList !== void 0) return positionedList;
 	}
@@ -6651,7 +6704,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration));
 	}
-	if (isPlainObject$3(bag) && hasPlainPrototype(bag) && isPlainObject$3(source)) {
+	if (isPlainObject$4(bag) && hasPlainPrototype(bag) && isPlainObject$4(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactSecretsForState(v, secrets);
 		return out;
@@ -6664,7 +6717,7 @@ function isReadbackProjectedFromState(rules) {
 function subtreeHasDynamicReference(value) {
 	if (isDynamicReferenceString(value)) return true;
 	if (Array.isArray(value)) return value.some(subtreeHasDynamicReference);
-	if (isPlainObject$3(value)) return Object.values(value).some(subtreeHasDynamicReference);
+	if (isPlainObject$4(value)) return Object.values(value).some(subtreeHasDynamicReference);
 	return false;
 }
 function pathCrossesDottedKey(bag, path) {
@@ -6726,8 +6779,8 @@ function deepEqualJsonValue(a, b) {
 		if (!Array.isArray(b) || a.length !== b.length) return false;
 		return a.every((item, i) => deepEqualJsonValue(item, b[i]));
 	}
-	if (isPlainObject$3(a)) {
-		if (!isPlainObject$3(b)) return false;
+	if (isPlainObject$4(a)) {
+		if (!isPlainObject$4(b)) return false;
 		if (!hasPlainPrototype(a) || !hasPlainPrototype(b)) return false;
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
@@ -6753,7 +6806,7 @@ function refuseUncertifiedSubtree(value, sourceLiterals, mark, seen = /* @__PURE
 		for (const item of value) out.push(refuseUncertifiedSubtree(item, sourceLiterals, mark, seen));
 		return out;
 	}
-	if (isPlainObject$3(value) && hasPlainPrototype(value)) {
+	if (isPlainObject$4(value) && hasPlainPrototype(value)) {
 		const out = Object.create(null);
 		seen.set(value, out);
 		for (const [k, v] of Object.entries(value)) out[k] = refuseUncertifiedSubtree(v, sourceLiterals, mark, seen);
@@ -6781,7 +6834,7 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 		return mark ? POSITION_DECIDED : source;
 	}
 	if (!subtreeHasDynamicReference(source)) return bag;
-	if (isPlainObject$3(bag) && hasPlainPrototype(bag) && isPlainObject$3(source)) {
+	if (isPlainObject$4(bag) && hasPlainPrototype(bag) && isPlainObject$4(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, failClosed, learn, mark) : v;
 		return out;
@@ -6808,14 +6861,14 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 function isDistinguishingAnchor(value) {
 	if (typeof value === "string") return value !== "";
 	if (Array.isArray(value)) return value.some(isDistinguishingAnchor);
-	if (isPlainObject$3(value)) return Object.values(value).some(isDistinguishingAnchor);
+	if (isPlainObject$4(value)) return Object.values(value).some(isDistinguishingAnchor);
 	return false;
 }
 const ANCHOR_REFERENCE_MASK = "<ref>";
 function anchorSignature(source) {
 	if (isDynamicReferenceString(source)) return ANCHOR_REFERENCE_MASK;
 	if (Array.isArray(source)) return `[${source.map(anchorSignature).sort().join(",")}]`;
-	if (isPlainObject$3(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
+	if (isPlainObject$4(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
 	return JSON.stringify(source) ?? "undefined";
 }
 function anchorsCorroboratePairing(bag, source, anchors) {
@@ -6825,8 +6878,8 @@ function anchorsCorroboratePairing(bag, source, anchors) {
 		return true;
 	}
 	if (isDynamicReferenceString(source)) return typeof bag === "string";
-	if (isPlainObject$3(source)) {
-		if (!isPlainObject$3(bag)) return false;
+	if (isPlainObject$4(source)) {
+		if (!isPlainObject$4(bag)) return false;
 		return Object.keys(source).every((k) => Object.hasOwn(bag, k) && anchorsCorroboratePairing(bag[k], source[k], anchors));
 	}
 	if (Array.isArray(source)) {
@@ -6917,13 +6970,13 @@ function learnMixedLeafNeedle(collector, bag, source) {
 	learnNeedle(collector, plaintext, token);
 }
 function asChild(marks, key) {
-	return isPlainObject$3(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
+	return isPlainObject$4(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
 }
 function asIndex(marks, index) {
 	return Array.isArray(marks) ? marks[index] : void 0;
 }
 function preferPositionDecisions(scanned, refused, bag, marks, inferred) {
-	if (isPlainObject$3(bag) && hasPlainPrototype(bag) && isPlainObject$3(refused) && isPlainObject$3(scanned)) {
+	if (isPlainObject$4(bag) && hasPlainPrototype(bag) && isPlainObject$4(refused) && isPlainObject$4(scanned)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(refused)) out[k] = preferPositionDecisions(scanned[k], v, bag[k], asChild(marks, k), inferred);
 		return out;
@@ -7792,12 +7845,12 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, rules = TEMPLATE_DERIVED_RULES) {
 	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$4) return;
 	if (secrets.size === 0) return;
-	if (!isPlainObject$3(resolvedProperties) || !isPlainObject$3(sourceProperties)) return;
+	if (!isPlainObject$4(resolvedProperties) || !isPlainObject$4(sourceProperties)) return;
 	if (!Object.hasOwn(resolvedProperties, "Parameters")) return;
 	if (!Object.hasOwn(sourceProperties, "Parameters")) return;
 	const resolvedParameters = resolvedProperties["Parameters"];
 	const sourceParameters = sourceProperties["Parameters"];
-	if (!isPlainObject$3(resolvedParameters) || !isPlainObject$3(sourceParameters)) return;
+	if (!isPlainObject$4(resolvedParameters) || !isPlainObject$4(sourceParameters)) return;
 	const positioned = redactSecretsForState(markSameGenerationBag({ ...resolvedParameters }), secrets, sourceParameters, rules);
 	let table = nestedStackParameterExpressions.get(secrets);
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
@@ -7829,7 +7882,7 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 		if (typeof resolvedValue !== "string") return void 0;
 		const sourceLeaf = sourceParameters[name];
 		if (typeof sourceLeaf === "string") return sourceLeaf;
-		if (!isPlainObject$3(sourceLeaf)) return void 0;
+		if (!isPlainObject$4(sourceLeaf)) return void 0;
 		const written = positioned[name];
 		if (typeof written !== "string") return void 0;
 		const rendered = intrinsicSkeletonSegments(sourceLeaf)?.map((s) => s === UNKNOWN_PART ? "\0" : s).join("");
@@ -10787,7 +10840,7 @@ function probeFoundSameId(resourceType, a, b) {
 //#region src/provisioning/config-shape.ts
 function readConfigString(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return fallback;
-	if (!isPlainObject$2(container) || isUnresolvedIntrinsicContainer(container)) {
+	if (!isPlainObject$3(container) || isUnresolvedIntrinsicContainer(container)) {
 		const detail = malformedShapeDetail(container);
 		if (options?.onUnusable) {
 			const named = fallback === "" ? "" : ` (${fallback})`;
@@ -10827,7 +10880,7 @@ function requireConfigArray(value, path, options) {
 	return value;
 }
 function requireConfigObject(value, path, options) {
-	if (!isPlainObject$2(value) || isUnresolvedIntrinsicContainer(value)) {
+	if (!isPlainObject$3(value) || isUnresolvedIntrinsicContainer(value)) {
 		const detail = malformedShapeDetail(value);
 		if (options?.onUnusable) {
 			options.onUnusable(`${path} must be an object ${detail}. Leaving this configuration unapplied here; the same value is REFUSED on a template-path create.`);
@@ -10839,7 +10892,7 @@ function requireConfigObject(value, path, options) {
 }
 function configStringRefusal(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$2(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$3(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	return configValueRefusal(container[key], fallback, `${containerPath}.${key}`, options);
 }
 function coerceCfnBoolean(value) {
@@ -10852,7 +10905,7 @@ function coerceCfnBoolean(value) {
 }
 function configBooleanRefusal(container, key, containerPath) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$2(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$3(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	if (coerceCfnBoolean(value) !== void 0) return void 0;
@@ -10866,7 +10919,7 @@ function coerceCfnInteger(value) {
 }
 function configIntegerRefusal(container, key, containerPath, min, max) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$2(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$3(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	const n = coerceCfnInteger(value);
@@ -10880,10 +10933,10 @@ function configValueRefusal(value, fallback, path, options) {
 	if (typeof value !== "string" || value.trim() === "") return `${path} must be a non-empty string ${malformedShapeDetail(value)}`;
 }
 function malformedShapeDetail(value) {
-	if (isPlainObject$2(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
+	if (isPlainObject$3(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
 	return `(got ${describe(value)}) — check for an unresolved intrinsic or a mis-nested template value`;
 }
-function isPlainObject$2(value) {
+function isPlainObject$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 const NAMEABLE_INTRINSIC_KEYS = /* @__PURE__ */ new Set([
@@ -10910,7 +10963,7 @@ function describe(value) {
 	if (value === null) return "null";
 	if (Array.isArray(value)) return "an array";
 	if (typeof value === "string") return value.trim() === "" ? "a blank string" : "a string";
-	if (isPlainObject$2(value) && isUnresolvedIntrinsicContainer(value)) {
+	if (isPlainObject$3(value) && isUnresolvedIntrinsicContainer(value)) {
 		const key = Object.keys(value)[0];
 		return NAMEABLE_INTRINSIC_KEYS.has(key) ? `an unresolved ${key} intrinsic` : "an unresolved intrinsic";
 	}
@@ -15683,9 +15736,20 @@ function malformedOrphansForOrphanRefusalMessage(rawStackName, rawRegion, logica
 	return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read — ${namedOrphanRows(logicalIds)} — because the record has no string 'logicalId' or shares it with another row, or its 'state' is not an object, names no resource type, has no non-empty string 'physicalId', or holds a 'properties' or 'attributes' map that is not an object. The record is malformed or truncated. ${verbatim} Those records are not inert: they are what the next 'cdkd deploy' may re-adopt into 'resources' and what 'cdkd diff' previews for adoption, so continuing would report success over damage the next command meets.`, "'cdkd orphan' cannot remove such a record itself: it is not in 'resources', so it has no construct path. Repair the record by hand rather than deleting it — it is the only record that an earlier failed deploy left its resource live in AWS.", ORPHANS_DROP_CAVEAT);
 }
 
+//#endregion
+//#region src/deployment/assumed-conditions.ts
+const assumedConditionNames = /* @__PURE__ */ new WeakMap();
+function recordAssumedConditions(conditions, assumed) {
+	assumedConditionNames.set(conditions, assumed);
+}
+function conditionsAssumedFalse(conditions) {
+	return assumedConditionNames.get(conditions) ?? /* @__PURE__ */ new Set();
+}
+
 //#endregion
 //#region src/deployment/masked-property-fingerprints.ts
 const FINGERPRINT_LAYOUT$1 = 1;
+const INPUT_FINGERPRINT_LAYOUT = 2;
 function canonicalJson$2(value) {
 	if (value === void 0) return "null";
 	if (Array.isArray(value)) return `[${value.map(canonicalJson$2).join(",")}]`;
@@ -15697,6 +15761,20 @@ function canonicalJson$2(value) {
 }
 const REFUSED_FINGERPRINT = "refused:secret-in-template";
 const FINGERPRINT_PREFIX = "sha256:";
+const INPUT_FINGERPRINT_PREFIX = "inputs-sha256:";
+const TEXT_HALF_SEPARATOR = "+";
+function splitInputFingerprint(entry) {
+	const at = entry.indexOf(TEXT_HALF_SEPARATOR);
+	if (at < 0) return {
+		input: entry,
+		text: void 0
+	};
+	const text = entry.slice(at + 1);
+	return {
+		input: entry.slice(0, at),
+		text: text.startsWith(FINGERPRINT_PREFIX) ? text : void 0
+	};
+}
 function templateCarriesNeedle(templateValue, secrets) {
 	const text = canonicalJson$2(templateValue);
 	for (const needle of printingCorpusOf(secrets).keys()) {
@@ -15712,6 +15790,725 @@ function maskedPropertyFingerprint(templateValue) {
 	})).digest("hex");
 	return `${FINGERPRINT_PREFIX}${digest}`;
 }
+var UnknownInput = class extends Error {};
+function isPlainObject$2(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+const DYNAMIC_REFERENCE_OPEN = "{{resolve:";
+const NESTED_STACK_TYPE$2 = "AWS::CloudFormation::Stack";
+const NESTED_OUTPUT_PREFIX = "Outputs.";
+function carriesSecretValue(value, corpora) {
+	if (carriesSecretMask(value)) return true;
+	const text = canonicalJson$2(value);
+	if (text.includes(DYNAMIC_REFERENCE_OPEN)) return true;
+	for (const corpus of corpora) {
+		if (corpus === void 0) continue;
+		for (const needle of printingCorpusOf(corpus).keys()) {
+			if (needle.length === 0) continue;
+			if (text.includes(needle) || text.includes(JSON.stringify(needle).slice(1, -1))) return true;
+		}
+	}
+	return false;
+}
+function parameterInputsFor(args) {
+	const declared = isPlainObject$2(args.template.Parameters) ? args.template.Parameters : {};
+	const values = args.values ?? {};
+	const inputs = /* @__PURE__ */ new Map();
+	const bound = {};
+	for (const name of Object.keys(declared)) {
+		const definition = declared[name];
+		if (args.unbound?.has(name) || !Object.hasOwn(values, name)) {
+			inputs.set(name, { kind: "unknown" });
+			continue;
+		}
+		const value = values[name];
+		let secret = isPlainObject$2(definition) && (definition["NoEcho"] === true || definition["NoEcho"] === "true") || carriesSecretValue(value, []);
+		if (!secret && args.nestedChild === true && args.supplied !== void 0) {
+			if (Object.hasOwn(args.supplied, name)) {
+				const passed = args.passedClasses?.get(name);
+				if (passed === "unknown") {
+					inputs.set(name, { kind: "unknown" });
+					continue;
+				}
+				if (passed !== "clean") secret = true;
+			}
+		}
+		if (secret) inputs.set(name, { kind: "secret" });
+		else {
+			inputs.set(name, {
+				kind: "value",
+				value
+			});
+			bound[name] = value;
+		}
+	}
+	return {
+		parameterInput: (name) => inputs.get(name) ?? { kind: "unknown" },
+		bound
+	};
+}
+function newShared() {
+	return {
+		steps: 0,
+		passed: /* @__PURE__ */ new Map(),
+		outputs: /* @__PURE__ */ new Map(),
+		rowsPassed: /* @__PURE__ */ new Map()
+	};
+}
+function subPlaceholders(text) {
+	const names = [];
+	for (const match of text.matchAll(/\$\{([^}]*)\}/g)) {
+		const body = match[1] ?? "";
+		if (body.startsWith("!") || body.length === 0) continue;
+		if (!names.includes(body)) names.push(body);
+	}
+	return names;
+}
+function intrinsicKey(value) {
+	const keys = Object.keys(value);
+	if (keys.length !== 1) return void 0;
+	const key = keys[0];
+	return key === "Ref" || key.startsWith("Fn::") ? key : void 0;
+}
+const OPAQUE_ATTRIBUTE_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::CustomResource", NESTED_STACK_TYPE$2]);
+function hasOpaqueAttributes(logicalId, walk) {
+	const definition = walk.resources[logicalId];
+	const type = isPlainObject$2(definition) ? definition["Type"] : void 0;
+	return typeof type === "string" && (type.startsWith("Custom::") || OPAQUE_ATTRIBUTE_TYPES.has(type));
+}
+function getAttTarget(operand) {
+	if (Array.isArray(operand) && typeof operand[0] === "string") return operand[0];
+	if (typeof operand === "string" && operand.includes(".")) return operand.split(".")[0];
+}
+function taintOf(logicalId, walk) {
+	const cached = walk.taint.get(logicalId);
+	if (cached !== void 0) return cached;
+	if (walk.inProgress.has(logicalId)) return "tainted";
+	walk.inProgress.add(logicalId);
+	let unknown = false;
+	const nameTaint = (name) => {
+		if (name.startsWith("AWS::")) return "clean";
+		if (Object.hasOwn(walk.resources, name)) return taintOf(name, walk);
+		if (Object.hasOwn(walk.parameters, name)) {
+			const input = walk.sources.parameterInput(name);
+			return input.kind === "value" ? "clean" : input.kind === "secret" ? "tainted" : "unknown";
+		}
+		return "tainted";
+	};
+	const visit = (value) => {
+		if (typeof value === "string") return value.includes(DYNAMIC_REFERENCE_OPEN);
+		if (Array.isArray(value)) return value.some(visit);
+		if (!isPlainObject$2(value)) return false;
+		const key = intrinsicKey(value);
+		const operand = key === void 0 ? void 0 : value[key];
+		let verdict = "clean";
+		if (key === "Ref" && typeof operand === "string") verdict = nameTaint(operand);
+		else if (key === "Fn::GetAtt") {
+			const target = getAttTarget(operand);
+			verdict = target === void 0 || Object.hasOwn(walk.resources, target) && hasOpaqueAttributes(target, walk) ? "tainted" : nameTaint(target);
+		} else if (key === "Fn::ImportValue" || key === "Fn::GetStackOutput") verdict = "tainted";
+		else if (key === "Fn::FindInMap" && mapReadClass(operand, walk.sources.template) !== "clean") verdict = "tainted";
+		else if (key === "Fn::Sub") {
+			const text = Array.isArray(operand) ? operand[0] : operand;
+			const vars = Array.isArray(operand) && isPlainObject$2(operand[1]) ? operand[1] : {};
+			if (typeof text === "string") for (const name of subPlaceholders(text)) {
+				if (Object.hasOwn(vars, name)) continue;
+				const owner = name.includes(".") ? name.split(".")[0] : name;
+				const t = name.includes(".") && Object.hasOwn(walk.resources, owner) && hasOpaqueAttributes(owner, walk) ? "tainted" : nameTaint(owner);
+				if (t === "tainted") return true;
+				if (t === "unknown") unknown = true;
+			}
+		}
+		if (verdict === "tainted") return true;
+		if (verdict === "unknown") unknown = true;
+		return Object.values(value).some(visit);
+	};
+	const definition = walk.resources[logicalId];
+	const result = visit(isPlainObject$2(definition) ? definition["Properties"] : void 0) ? "tainted" : unknown ? "unknown" : "clean";
+	walk.inProgress.delete(logicalId);
+	walk.taint.set(logicalId, result);
+	return result;
+}
+function conditionInput(name, walk) {
+	const closure = conditionClosure(name, walk);
+	if (closure.unknown || closure.unread) return "unknown";
+	if (closure.secret) return "secret";
+	const conditions = walk.sources.conditions;
+	if (conditions === void 0 || !Object.hasOwn(conditions, name)) return "unknown";
+	if (conditionsAssumedFalse(conditions).has(name)) return "unknown";
+	const verdict = conditions[name];
+	return typeof verdict === "boolean" ? verdict : "unknown";
+}
+function conditionClosure(name, walk) {
+	const definitions = isPlainObject$2(walk.sources.template.Conditions) ? walk.sources.template.Conditions : {};
+	let secret = false;
+	let unknown = false;
+	let unread = false;
+	const seen = /* @__PURE__ */ new Set();
+	const pending = [name];
+	const visit = (value) => {
+		if (typeof value === "string") {
+			if (value.includes(DYNAMIC_REFERENCE_OPEN)) secret = true;
+			return;
+		}
+		if (Array.isArray(value)) {
+			value.forEach(visit);
+			return;
+		}
+		if (!isPlainObject$2(value)) return;
+		const keys = Object.keys(value);
+		if (keys.length === 1 && keys[0] === "Condition" && typeof value["Condition"] === "string") {
+			pending.push(value["Condition"]);
+			return;
+		}
+		const classifyName = (ref) => {
+			if (ref.startsWith("AWS::")) return;
+			if (!Object.hasOwn(walk.parameters, ref)) {
+				unknown = true;
+				return;
+			}
+			const input = walk.sources.parameterInput(ref);
+			if (input.kind === "secret") secret = true;
+			if (input.kind === "unknown") unread = true;
+		};
+		if (keys.length === 1 && keys[0] === "Ref" && typeof value["Ref"] === "string") {
+			classifyName(value["Ref"]);
+			return;
+		}
+		const key = keys.length === 1 ? keys[0] : void 0;
+		if (key === "Fn::FindInMap") {
+			const read = mapReadClass(value["Fn::FindInMap"], walk.sources.template);
+			if (read === "secret") secret = true;
+			if (read === "unknown") unknown = true;
+		}
+		if (key === "Fn::ImportValue" || key === "Fn::GetStackOutput" || key === "Fn::GetAtt") {
+			secret = true;
+			return;
+		}
+		if (key === "Fn::Sub") {
+			const operand = value["Fn::Sub"];
+			const text = Array.isArray(operand) ? operand[0] : operand;
+			const vars = Array.isArray(operand) && isPlainObject$2(operand[1]) ? operand[1] : {};
+			if (typeof text === "string") for (const name of subPlaceholders(text)) {
+				if (Object.hasOwn(vars, name)) continue;
+				if (name.includes(".") && !name.startsWith("AWS::")) secret = true;
+				else classifyName(name);
+			}
+		}
+		Object.values(value).forEach(visit);
+	};
+	while (pending.length > 0) {
+		const current = pending.pop();
+		if (seen.has(current)) continue;
+		seen.add(current);
+		if (!Object.hasOwn(definitions, current)) {
+			unknown = true;
+			continue;
+		}
+		visit(definitions[current]);
+	}
+	return {
+		secret,
+		unknown,
+		unread
+	};
+}
+function mapReadClass(operand, template) {
+	const mapName = Array.isArray(operand) ? operand[0] : void 0;
+	if (typeof mapName !== "string") return "unknown";
+	const mappings = template.Mappings;
+	const map = isPlainObject$2(mappings) && Object.hasOwn(mappings, mapName) ? mappings[mapName] : void 0;
+	if (!isPlainObject$2(map)) return "unknown";
+	return carriesSecretValue(map, []) ? "secret" : "clean";
+}
+async function resolvedInput(node, walk) {
+	let resolved;
+	try {
+		resolved = await walk.sources.resolve(node);
+	} catch {
+		throw new UnknownInput();
+	}
+	if (resolved.keepAsWritten === true || carriesSecretValue(resolved.value, [resolved.secrets])) return {
+		form: node,
+		concrete: false
+	};
+	return {
+		form: resolved.value,
+		concrete: true
+	};
+}
+async function nameInput(name, node, walk) {
+	if (name === "AWS::NoValue") return {
+		form: node,
+		concrete: false
+	};
+	if (name.startsWith("AWS::")) return resolvedInput(node, walk);
+	if (Object.hasOwn(walk.resources, name)) {
+		const taint = taintOf(name, walk);
+		if (taint === "unknown") throw new UnknownInput();
+		if (taint === "tainted") return {
+			form: node,
+			concrete: false
+		};
+		return resolvedInput(node, walk);
+	}
+	if (Object.hasOwn(walk.parameters, name)) {
+		const input = walk.sources.parameterInput(name);
+		if (input.kind === "unknown") throw new UnknownInput();
+		if (input.kind === "secret") return {
+			form: node,
+			concrete: false
+		};
+		return {
+			form: input.value,
+			concrete: true
+		};
+	}
+	return {
+		form: node,
+		concrete: false
+	};
+}
+async function inputForms(values, walk) {
+	const parts = [];
+	for (const element of values) parts.push(await inputForm(element, walk));
+	return parts;
+}
+async function inputForm(value, walk) {
+	if (typeof value === "string") return {
+		form: value,
+		concrete: !value.includes(DYNAMIC_REFERENCE_OPEN)
+	};
+	if (Array.isArray(value)) {
+		const parts = await inputForms(value, walk);
+		return {
+			form: parts.map((p) => p.form),
+			concrete: parts.every((p) => p.concrete)
+		};
+	}
+	if (!isPlainObject$2(value)) return {
+		form: value,
+		concrete: true
+	};
+	const key = intrinsicKey(value);
+	if (key === void 0) {
+		const entries = Object.keys(value);
+		const parts = await inputForms(entries.map((k) => value[k]), walk);
+		return {
+			form: Object.fromEntries(entries.map((k, i) => [k, parts[i].form])),
+			concrete: parts.every((p) => p.concrete)
+		};
+	}
+	const operand = value[key];
+	switch (key) {
+		case "Ref": return typeof operand === "string" ? nameInput(operand, value, walk) : {
+			form: value,
+			concrete: false
+		};
+		case "Fn::GetAtt": {
+			const target = getAttTarget(operand);
+			if (target !== void 0 && isNestedStackRow(target, walk)) return nestedOutputInput(target, getAttAttribute(operand, target), value, walk);
+			if (target === void 0 || !Object.hasOwn(walk.resources, target) || hasOpaqueAttributes(target, walk)) return {
+				form: value,
+				concrete: false
+			};
+			if (Array.isArray(operand) && operand.length > 1 && typeof operand[1] !== "string") {
+				const attribute = await inputForm(operand[1], walk);
+				if (!attribute.concrete) return {
+					form: { [key]: [operand[0], attribute.form] },
+					concrete: false
+				};
+			}
+			return nameInput(target, value, walk);
+		}
+		case "Fn::If": {
+			if (!Array.isArray(operand) || typeof operand[0] !== "string") {
+				const args = await inputForm(operand, walk);
+				return {
+					form: { [key]: args.form },
+					concrete: false
+				};
+			}
+			const verdict = conditionInput(operand[0], walk);
+			if (verdict === "unknown") throw new UnknownInput();
+			if (verdict === "secret") {
+				const args = await inputForm(operand.slice(1), walk);
+				return {
+					form: { [key]: [operand[0], ...args.form] },
+					concrete: false
+				};
+			}
+			return inputForm(verdict ? operand[1] : operand[2], walk);
+		}
+		case "Fn::Sub": {
+			const text = Array.isArray(operand) ? operand[0] : operand;
+			if (typeof text !== "string") {
+				const args = await inputForm(operand, walk);
+				return {
+					form: { [key]: args.form },
+					concrete: false
+				};
+			}
+			const explicit = Array.isArray(operand) && isPlainObject$2(operand[1]) ? operand[1] : {};
+			const vars = await inputForm(explicit, walk);
+			const placeholders = [];
+			let concrete = vars.concrete && !text.includes(DYNAMIC_REFERENCE_OPEN);
+			for (const name of subPlaceholders(text)) {
+				if (Object.hasOwn(explicit, name)) continue;
+				const dot = name.indexOf(".");
+				const part = dot > 0 && !name.startsWith("AWS::") && isNestedStackRow(name.slice(0, dot), walk) ? await nestedOutputInput(name.slice(0, dot), name.slice(dot + 1), { "Fn::GetAtt": [name.slice(0, dot), name.slice(dot + 1)] }, walk) : dot > 0 && !name.startsWith("AWS::") ? Object.hasOwn(walk.resources, name.slice(0, dot)) && !hasOpaqueAttributes(name.slice(0, dot), walk) ? await nameInput(name.slice(0, dot), { "Fn::GetAtt": [name.slice(0, dot), name.slice(dot + 1)] }, walk) : {
+					form: { "Fn::GetAtt": [name.slice(0, dot), name.slice(dot + 1)] },
+					concrete: false
+				} : await nameInput(name, { Ref: name }, walk);
+				placeholders.push([name, part.form]);
+				concrete &&= part.concrete;
+			}
+			return {
+				form: { [key]: [
+					text,
+					vars.form,
+					Object.fromEntries(placeholders)
+				] },
+				concrete
+			};
+		}
+		case "Fn::ImportValue":
+		case "Fn::GetStackOutput":
+		case "Fn::FindInMap":
+		case "Fn::GetAZs": {
+			const args = await inputForm(operand, walk);
+			if (!args.concrete) return {
+				form: { [key]: args.form },
+				concrete: false
+			};
+			const resolved = await resolvedInput(value, walk);
+			return resolved.concrete ? resolved : {
+				form: { [key]: args.form },
+				concrete: false
+			};
+		}
+		default: {
+			const args = await inputForm(operand, walk);
+			return {
+				form: { [key]: args.form },
+				concrete: args.concrete
+			};
+		}
+	}
+}
+function newWalk(sources, nested = {
+	stackChain: /* @__PURE__ */ new Set(),
+	shared: newShared()
+}) {
+	return {
+		sources,
+		resources: isPlainObject$2(sources.template.Resources) ? sources.template.Resources : {},
+		parameters: isPlainObject$2(sources.template.Parameters) ? sources.template.Parameters : {},
+		taint: /* @__PURE__ */ new Map(),
+		inProgress: /* @__PURE__ */ new Set(),
+		stackChain: nested.stackChain,
+		shared: nested.shared
+	};
+}
+const NESTED_OUTPUT_ORDER = {
+	clean: 0,
+	unread: 1,
+	unknown: 2,
+	secret: 3
+};
+function worseOf(a, b) {
+	return NESTED_OUTPUT_ORDER[a] >= NESTED_OUTPUT_ORDER[b] ? a : b;
+}
+const MAX_NESTED_OUTPUT_DEPTH = 32;
+const MAX_NESTED_OUTPUT_STEPS = 1e4;
+function passedKey(passed) {
+	return JSON.stringify([...passed.entries()]);
+}
+function isNestedStackRow(logicalId, walk) {
+	if (!Object.hasOwn(walk.resources, logicalId)) return false;
+	const definition = walk.resources[logicalId];
+	return isPlainObject$2(definition) && definition["Type"] === NESTED_STACK_TYPE$2;
+}
+function getAttAttribute(operand, target) {
+	if (Array.isArray(operand)) return operand.length === 2 && typeof operand[1] === "string" ? operand[1] : void 0;
+	return typeof operand === "string" ? operand.slice(target.length + 1) : void 0;
+}
+function rowParameters(definition) {
+	const properties = isPlainObject$2(definition) ? definition["Properties"] : void 0;
+	if (properties === void 0) return {};
+	if (!isPlainObject$2(properties)) return "unknown";
+	const parameters = properties["Parameters"];
+	if (parameters === void 0) return {};
+	if (!isPlainObject$2(parameters) || intrinsicKey(parameters) !== void 0) return "unknown";
+	return parameters;
+}
+function childParameterInputs(template, passed) {
+	const declared = isPlainObject$2(template.Parameters) ? template.Parameters : {};
+	const inputs = /* @__PURE__ */ new Map();
+	for (const name of Object.keys(declared)) {
+		const definition = declared[name];
+		if (isPlainObject$2(definition) && (definition["NoEcho"] === true || definition["NoEcho"] === "true")) inputs.set(name, { kind: "secret" });
+		else if (passed.has(name)) {
+			const passedClass = passed.get(name);
+			inputs.set(name, passedClass === "clean" ? {
+				kind: "value",
+				value: void 0
+			} : passedClass === "unknown" ? { kind: "unknown" } : { kind: "secret" });
+		} else if (isPlainObject$2(definition) && Object.hasOwn(definition, "Default") && !carriesSecretValue(definition["Default"], [])) inputs.set(name, {
+			kind: "value",
+			value: definition["Default"]
+		});
+		else inputs.set(name, { kind: "secret" });
+	}
+	return (name) => inputs.get(name) ?? { kind: "secret" };
+}
+function taintClass(taint) {
+	return taint === "clean" ? "clean" : taint === "tainted" ? "secret" : "unread";
+}
+function closureClass(closure) {
+	if (closure.secret) return "secret";
+	if (closure.unknown) return "unknown";
+	return closure.unread ? "unread" : "clean";
+}
+async function childOutputClass(loaded, outputName, passed, chain, shared) {
+	if (loaded === void 0 || !isPlainObject$2(loaded.template)) return "unknown";
+	const scopeKey = JSON.stringify([loaded.identity, passedKey(passed)]);
+	const memoKey = JSON.stringify([scopeKey, outputName]);
+	const memo = shared.outputs.get(memoKey);
+	if (memo !== void 0) return memo;
+	const outputClass = await classifyChildOutput(loaded, outputName, passed, chain, shared, scopeKey);
+	shared.outputs.set(memoKey, outputClass);
+	return outputClass;
+}
+async function classifyChildOutput(loaded, outputName, passed, chain, shared, scopeKey) {
+	if (++shared.steps > MAX_NESTED_OUTPUT_STEPS) return "unknown";
+	if (chain.includes(loaded.identity) || chain.length >= MAX_NESTED_OUTPUT_DEPTH) return "unknown";
+	const template = loaded.template;
+	const output = (isPlainObject$2(template.Outputs) ? template.Outputs : {})[outputName];
+	if (!isPlainObject$2(output) || !Object.hasOwn(output, "Value")) return "unknown";
+	const scope = {
+		walk: newWalk({
+			template,
+			parameterInput: childParameterInputs(template, passed),
+			resolve: () => Promise.reject(/* @__PURE__ */ new Error("a nested output is classified, never resolved"))
+		}),
+		childTemplate: loaded.childTemplate,
+		chain: [...chain, loaded.identity],
+		rows: /* @__PURE__ */ new Set(),
+		key: scopeKey,
+		shared
+	};
+	let outputClass = "clean";
+	if (Object.hasOwn(output, "Condition")) {
+		const condition = output["Condition"];
+		outputClass = typeof condition === "string" ? closureClass(conditionClosure(condition, scope.walk)) : "unknown";
+	}
+	return worseOf(outputClass, await expressionClass(output["Value"], scope));
+}
+function nameClass(name, scope) {
+	if (name.startsWith("AWS::")) return "clean";
+	const walk = scope.walk;
+	if (Object.hasOwn(walk.resources, name)) return taintClass(taintOf(name, walk));
+	if (Object.hasOwn(walk.parameters, name)) {
+		const input = walk.sources.parameterInput(name);
+		return input.kind === "value" ? "clean" : input.kind === "secret" ? "secret" : "unread";
+	}
+	return "secret";
+}
+async function attributeClass(target, attribute, scope) {
+	const walk = scope.walk;
+	if (!Object.hasOwn(walk.resources, target)) return "secret";
+	if (isNestedStackRow(target, walk)) {
+		if (attribute === void 0 || !attribute.startsWith(NESTED_OUTPUT_PREFIX)) return "unknown";
+		if (scope.rows.has(target)) return "unknown";
+		const parameters = rowParameters(walk.resources[target]);
+		if (parameters === "unknown") return "unknown";
+		const rowKey = JSON.stringify([scope.key, target]);
+		let passed = scope.shared.rowsPassed.get(rowKey);
+		if (passed === void 0) {
+			const inner = {
+				...scope,
+				rows: /* @__PURE__ */ new Set([...scope.rows, target])
+			};
+			const classes = /* @__PURE__ */ new Map();
+			for (const [name, expression] of Object.entries(parameters)) {
+				const passedClass = await expressionClass(expression, inner);
+				classes.set(name, passedClass === "clean" ? "clean" : passedClass === "unread" ? "unknown" : "secret");
+			}
+			scope.shared.rowsPassed.set(rowKey, classes);
+			passed = classes;
+		}
+		let loaded;
+		try {
+			loaded = scope.childTemplate(target);
+		} catch {
+			loaded = void 0;
+		}
+		return childOutputClass(loaded, attribute.slice(8), passed, scope.chain, scope.shared);
+	}
+	if (hasOpaqueAttributes(target, walk)) return "unknown";
+	return taintClass(taintOf(target, walk));
+}
+async function expressionClass(value, scope) {
+	if (typeof value === "string") return value.includes(DYNAMIC_REFERENCE_OPEN) ? "secret" : "clean";
+	const all = async (values) => {
+		let result = "clean";
+		for (const element of values) result = worseOf(result, await expressionClass(element, scope));
+		return result;
+	};
+	if (Array.isArray(value)) return all(value);
+	if (!isPlainObject$2(value)) return "clean";
+	const key = intrinsicKey(value);
+	if (key === void 0) return all(Object.values(value));
+	const operand = value[key];
+	switch (key) {
+		case "Ref": return typeof operand === "string" ? nameClass(operand, scope) : "unknown";
+		case "Fn::GetAtt": {
+			const target = getAttTarget(operand);
+			if (target === void 0) return "secret";
+			const attribute = getAttAttribute(operand, target);
+			return worseOf(attribute === void 0 && Array.isArray(operand) ? await all(operand.slice(1)) : "clean", await attributeClass(target, attribute, scope));
+		}
+		case "Fn::Sub": {
+			const text = Array.isArray(operand) ? operand[0] : operand;
+			if (typeof text !== "string") return worseOf("unknown", await expressionClass(operand, scope));
+			const vars = Array.isArray(operand) && isPlainObject$2(operand[1]) ? operand[1] : {};
+			let result = text.includes(DYNAMIC_REFERENCE_OPEN) ? "secret" : "clean";
+			result = worseOf(result, await all(Object.values(vars)));
+			for (const name of subPlaceholders(text)) {
+				if (Object.hasOwn(vars, name)) continue;
+				const dot = name.indexOf(".");
+				result = worseOf(result, dot > 0 && !name.startsWith("AWS::") ? await attributeClass(name.slice(0, dot), name.slice(dot + 1), scope) : nameClass(name, scope));
+			}
+			return result;
+		}
+		case "Fn::If":
+			if (!Array.isArray(operand) || operand.length !== 3 || typeof operand[0] !== "string") return worseOf("unknown", await expressionClass(operand, scope));
+			return worseOf(closureClass(conditionClosure(operand[0], scope.walk)), await all(operand.slice(1)));
+		case "Fn::ImportValue":
+		case "Fn::GetStackOutput": return "secret";
+		case "Fn::FindInMap": {
+			const read = mapReadClass(operand, scope.walk.sources.template);
+			if (read === "unknown") return worseOf("unknown", await all([operand]));
+			return worseOf(read, await all(operand.slice(1)));
+		}
+		default: return expressionClass(operand, scope);
+	}
+}
+async function stackOutputClass(stackLogicalId, attribute, walk) {
+	const loader = walk.sources.childTemplate;
+	if (loader === void 0 || !isNestedStackRow(stackLogicalId, walk)) return "unknown";
+	if (attribute === void 0 || !attribute.startsWith(NESTED_OUTPUT_PREFIX)) return "unknown";
+	if (walk.stackChain.has(stackLogicalId)) return "unknown";
+	const parameters = rowParameters(walk.resources[stackLogicalId]);
+	if (parameters === "unknown") return "unknown";
+	let passed = walk.shared.passed.get(stackLogicalId);
+	if (passed === void 0) {
+		if (++walk.shared.steps > MAX_NESTED_OUTPUT_STEPS) return "unknown";
+		passed = await classifyPassed(parameters, walk.sources, {
+			stackChain: /* @__PURE__ */ new Set([...walk.stackChain, stackLogicalId]),
+			shared: walk.shared
+		});
+		walk.shared.passed.set(stackLogicalId, passed);
+	}
+	let loaded;
+	try {
+		loaded = loader(stackLogicalId);
+	} catch {
+		loaded = void 0;
+	}
+	return childOutputClass(loaded, attribute.slice(8), passed, [], walk.shared);
+}
+async function nestedOutputInput(stackLogicalId, attribute, node, walk) {
+	const outputClass = await stackOutputClass(stackLogicalId, attribute, walk);
+	if (outputClass === "unread") throw new UnknownInput();
+	if (outputClass !== "clean") return {
+		form: node,
+		concrete: false
+	};
+	return resolvedInput(node, walk);
+}
+async function maskedInputFingerprint(templateValue, sources) {
+	let form;
+	try {
+		form = (await inputForm(templateValue, newWalk(sources))).form;
+	} catch (error) {
+		if (error instanceof UnknownInput) return void 0;
+		throw error;
+	}
+	const digest = createHash("sha256").update(canonicalJson$2({
+		layout: INPUT_FINGERPRINT_LAYOUT,
+		value: form
+	})).digest("hex");
+	return `${INPUT_FINGERPRINT_PREFIX}${digest}${TEXT_HALF_SEPARATOR}${maskedPropertyFingerprint(templateValue)}`;
+}
+async function classifyPassedParameters(parameters, sources) {
+	return classifyPassed(parameters, sources, {
+		stackChain: /* @__PURE__ */ new Set(),
+		shared: newShared()
+	});
+}
+async function classifyPassed(parameters, sources, nested) {
+	const classes = /* @__PURE__ */ new Map();
+	if (!isPlainObject$2(parameters)) return classes;
+	for (const [name, expression] of Object.entries(parameters)) {
+		let passedClass;
+		try {
+			passedClass = (await inputForm(expression, newWalk(sources, nested))).concrete ? "clean" : "secret";
+		} catch {
+			passedClass = "unknown";
+		}
+		classes.set(name, passedClass);
+	}
+	return classes;
+}
+const passedParameterClasses = /* @__PURE__ */ new WeakMap();
+function recordPassedParameterClasses(bag, classes) {
+	passedParameterClasses.set(bag, classes);
+}
+function passedParameterClassesOf(bag) {
+	return bag === void 0 ? void 0 : passedParameterClasses.get(bag);
+}
+function inputFingerprinter(templateProps, sources) {
+	const memo = /* @__PURE__ */ new Map();
+	return (key) => {
+		let pending = memo.get(key);
+		if (pending === void 0) {
+			pending = Object.hasOwn(templateProps, key) ? maskedInputFingerprint(templateProps[key], sources).catch(() => void 0) : Promise.resolve(void 0);
+			memo.set(key, pending);
+		}
+		return pending;
+	};
+}
+function possiblyMaskedKeys(resolvedProps, corpora) {
+	const needles = /* @__PURE__ */ new Set();
+	for (const corpus of corpora) {
+		if (corpus === void 0) continue;
+		for (const needle of printingCorpusOf(corpus).keys()) if (needle.length > 0) needles.add(needle);
+	}
+	const short = [...needles].filter((needle) => needle.length < 4);
+	const long = [...needles].filter((needle) => needle.length >= 4);
+	const wholeShortLeaf = (value) => {
+		if (typeof value === "string") return short.includes(value);
+		if (Array.isArray(value)) return value.some(wholeShortLeaf);
+		if (isPlainObject$2(value)) return Object.values(value).some(wholeShortLeaf);
+		return false;
+	};
+	return Object.keys(resolvedProps).filter((key) => {
+		const value = resolvedProps[key];
+		if (carriesSecretMask(value) || wholeShortLeaf(value)) return true;
+		const text = canonicalJson$2(value);
+		return long.some((needle) => text.includes(needle) || text.includes(JSON.stringify(needle).slice(1, -1)));
+	});
+}
+async function maskedInputFingerprintsFor(keys, fingerprinter) {
+	const entries = [];
+	for (const key of keys) {
+		const fingerprint = await fingerprinter(key);
+		if (fingerprint !== void 0) entries.push([key, fingerprint]);
+	}
+	return Object.fromEntries(entries);
+}
 function maskedPropertyFingerprintsFor(recordedProperties, templateProps) {
 	const entries = [];
 	for (const key of Object.keys(recordedProperties)) {
@@ -15725,48 +16522,111 @@ function maskedPropertyFingerprintsOf(record) {
 	const read = /* @__PURE__ */ new Map();
 	if (record === null || typeof record !== "object") return read;
 	const field = record.maskedPropertyFingerprints;
-	if (field === null || typeof field !== "object" || Array.isArray(field)) return read;
+	if (!isPlainObject$2(field)) return read;
 	for (const [key, value] of Object.entries(field)) if (typeof value === "string" && value.startsWith(FINGERPRINT_PREFIX)) read.set(key, value);
 	return read;
 }
-function movedMaskedProperties(record, templateProps) {
+function maskedPropertyInputFingerprintsOf(record) {
+	const read = /* @__PURE__ */ new Map();
+	if (record === null || typeof record !== "object") return read;
+	const field = record.maskedPropertyInputFingerprints;
+	if (!isPlainObject$2(field)) return read;
+	const text = maskedPropertyFingerprintsOf(record);
+	for (const [key, value] of Object.entries(field)) {
+		if (typeof value !== "string" || !value.startsWith(INPUT_FINGERPRINT_PREFIX)) continue;
+		const half = splitInputFingerprint(value).text;
+		if (half !== void 0 && text.get(key) === half) read.set(key, value);
+	}
+	return read;
+}
+function boundInputFingerprints(textFingerprints, inputFingerprints) {
+	if (textFingerprints === void 0 || inputFingerprints === void 0) return void 0;
+	const entries = [];
+	for (const [key, text] of Object.entries(textFingerprints)) {
+		if (!text.startsWith(FINGERPRINT_PREFIX) || !Object.hasOwn(inputFingerprints, key)) continue;
+		const input = inputFingerprints[key];
+		if (splitInputFingerprint(input).text === text) entries.push([key, input]);
+	}
+	return entries.length > 0 ? Object.fromEntries(entries) : void 0;
+}
+async function movedMaskedProperties(record, templateProps, fingerprinter, onRebaseline) {
 	const recorded = maskedPropertyFingerprintsOf(record);
 	if (recorded.size === 0) return [];
 	const properties = record.properties;
 	if (properties === null || typeof properties !== "object") return [];
+	const inputs = maskedPropertyInputFingerprintsOf(record);
 	const moved = [];
 	for (const [key, fingerprint] of recorded) {
 		if (!Object.hasOwn(templateProps, key) || !Object.hasOwn(properties, key)) continue;
 		if (!carriesSecretMask(properties[key])) continue;
-		if (maskedPropertyFingerprint(templateProps[key]) !== fingerprint) moved.push(key);
+		if (maskedPropertyFingerprint(templateProps[key]) !== fingerprint) {
+			moved.push(key);
+			continue;
+		}
+		if (fingerprinter === void 0) continue;
+		const bound = inputs.get(key);
+		if (bound === void 0 && onRebaseline === void 0) continue;
+		const now = await fingerprinter(key);
+		if (now === void 0) continue;
+		if (bound !== void 0) {
+			if (splitInputFingerprint(now).input !== splitInputFingerprint(bound).input) moved.push(key);
+		} else onRebaseline(key, now);
 	}
 	return moved;
 }
+function withRebaselinedFingerprints(record, fingerprints) {
+	const text = maskedPropertyFingerprintsOf(record);
+	const field = record.maskedPropertyInputFingerprints;
+	const next = isPlainObject$2(field) ? Object.entries(field) : [];
+	let changed = false;
+	for (const [key, value] of Object.entries(fingerprints)) {
+		if (text.get(key) !== splitInputFingerprint(value).text) continue;
+		const at = next.findIndex(([k]) => k === key);
+		if (at >= 0) next[at] = [key, value];
+		else next.push([key, value]);
+		changed = true;
+	}
+	return changed ? {
+		...record,
+		maskedPropertyInputFingerprints: Object.fromEntries(next)
+	} : record;
+}
 const writtenFromDeployedTemplate = /* @__PURE__ */ new WeakSet();
 function markWrittenFromDeployedTemplate(bag) {
 	writtenFromDeployedTemplate.add(bag);
 	return bag;
 }
-function withMaskedPropertyFingerprints(scrubbed, writtenBag, templateProps, secrets, noEchoParameterValues) {
+function withMaskedPropertyFingerprints(scrubbed, writtenBag, templateProps, secrets, noEchoParameterValues, inputFingerprints) {
 	if (templateProps === void 0) return scrubbed;
 	const corpora = [secrets, noEchoParameterValues].filter((corpus) => corpus !== void 0);
 	const written = writtenBag !== null && typeof writtenBag === "object" && writtenFromDeployedTemplate.has(writtenBag);
-	const { maskedPropertyFingerprints: previous, ...rest } = scrubbed;
+	const { maskedPropertyFingerprints: previous, maskedPropertyInputFingerprints: previousInputs, ...rest } = scrubbed;
 	let fingerprints;
-	if (written) fingerprints = maskedPropertyFingerprintsFor(scrubbed.properties, templateProps);
-	else {
-		if (previous === void 0 || previous === null || typeof previous !== "object") return scrubbed;
+	let inputs;
+	if (written) {
+		fingerprints = maskedPropertyFingerprintsFor(scrubbed.properties, templateProps);
+		inputs = boundInputFingerprints(fingerprints, inputFingerprints);
+	} else {
+		if (!isPlainObject$2(previous)) return scrubbed;
 		if (corpora.length === 0) return scrubbed;
 		fingerprints = { ...previous };
+		inputs = isPlainObject$2(previousInputs) ? { ...previousInputs } : void 0;
 	}
 	if (fingerprints !== void 0 && corpora.length > 0) {
 		const refused = Object.keys(fingerprints).filter((key) => Object.hasOwn(templateProps, key) && corpora.some((corpus) => templateCarriesNeedle(templateProps[key], corpus)));
-		if (refused.length > 0) fingerprints = Object.fromEntries(Object.entries(fingerprints).map(([key, value]) => [key, refused.includes(key) ? REFUSED_FINGERPRINT : value]));
+		if (refused.length > 0) {
+			fingerprints = Object.fromEntries(Object.entries(fingerprints).map(([key, value]) => [key, refused.includes(key) ? REFUSED_FINGERPRINT : value]));
+			if (inputs !== void 0) {
+				const kept = Object.entries(inputs).filter(([key]) => !refused.includes(key));
+				inputs = kept.length > 0 ? Object.fromEntries(kept) : void 0;
+			}
+		}
 	}
-	if (!written && JSON.stringify(fingerprints) === JSON.stringify(previous)) return scrubbed;
-	return fingerprints === void 0 ? rest : {
+	if (!written && JSON.stringify(fingerprints) === JSON.stringify(previous) && JSON.stringify(inputs) === JSON.stringify(previousInputs)) return scrubbed;
+	return {
 		...rest,
-		maskedPropertyFingerprints: fingerprints
+		...fingerprints !== void 0 && { maskedPropertyFingerprints: fingerprints },
+		...inputs !== void 0 && { maskedPropertyInputFingerprints: inputs }
 	};
 }
 function backfillMaskedPropertyFingerprints(resources, template, noEchoParameterValues) {
@@ -16094,6 +16954,49 @@ const DEPLOY_RESOLVED_REFERENCE_SERVICES = /* @__PURE__ */ new Set([
 	"ssm",
 	"ssm-secure"
 ]);
+function sitsInsideResolvableReference(text, start, end) {
+	const OPENING = "{{resolve:";
+	const opening = text.lastIndexOf(OPENING, start);
+	if (opening < 0) return false;
+	const head = text.slice(opening + 10, start);
+	if (head.includes("}}")) return false;
+	const colon = head.indexOf(":");
+	if (colon >= 0 && !DEPLOY_RESOLVED_REFERENCE_SERVICES.has(head.slice(0, colon))) return false;
+	const close = text.indexOf("}}", end);
+	if (close < 0) return false;
+	const nextOpening = text.indexOf(OPENING, end);
+	if (nextOpening >= 0 && nextOpening < close) return false;
+	return !/["\r\n]/.test(text.slice(opening, close));
+}
+const KEPT_PLACEHOLDERS = /* @__PURE__ */ new WeakMap();
+function recordKeptPlaceholder(bag, placeholder, because) {
+	let kept = KEPT_PLACEHOLDERS.get(bag);
+	if (kept === void 0) {
+		kept = /* @__PURE__ */ new Map();
+		KEPT_PLACEHOLDERS.set(bag, kept);
+	}
+	if (!kept.has(placeholder)) kept.set(placeholder, {
+		because,
+		reported: false
+	});
+}
+function takeKeptPlaceholdersInsideReferences(bag, text) {
+	const kept = KEPT_PLACEHOLDERS.get(bag);
+	if (kept === void 0) return [];
+	const found = [];
+	for (const [placeholder, entry] of kept) {
+		if (entry.reported) continue;
+		for (let at = text.indexOf(placeholder); at >= 0; at = text.indexOf(placeholder, at + 1)) if (sitsInsideResolvableReference(text, at, at + placeholder.length)) {
+			entry.reported = true;
+			found.push({
+				placeholder,
+				because: entry.because
+			});
+			break;
+		}
+	}
+	return found;
+}
 function keepsSecretReferenceToken(resolvedName) {
 	return dynamicReferenceTokens(resolvedName).some((token) => DEPLOY_RESOLVED_REFERENCE_SERVICES.has(token.slice(10, -2).split(":")[0] ?? ""));
 }
@@ -17880,6 +18783,13 @@ async function resolveTemplateLeafReferences(value, context) {
 	return (await this.resolveDynamicReferencesWithLogTwin(value, value, context)).result;
 }
 async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inherited, persistedText = false) {
+	if (context?.abandonedResolutions !== void 0) {
+		const bag = context.abandonedResolutions;
+		for (const { placeholder, because } of takeKeptPlaceholdersInsideReferences(bag, value)) {
+			const reason = because instanceof Error ? because.message : String(because);
+			bag.push(this.abandonedUnit("placeholder", placeholder, new Error(`Fn::Sub kept the placeholder ${placeholder} (${reason}) inside a {{resolve:...}} reference, so that reference was never resolved`, { cause: because }), context, value));
+		}
+	}
 	const pattern = /\{\{resolve:([^}]+)\}\}/g;
 	let result = value;
 	let twin = logTwin;
@@ -18342,6 +19252,15 @@ function rethrowStructuralSubFailure(varName, error, context) {
 	if (!this.subPlaceholderNamesADeclaredTemplateEntity(varName, context)) return;
 	throw error;
 }
+function noteKeptSubPlaceholder(varName, placeholder, because, context) {
+	if (context.abandonedResolutions === void 0) return;
+	const firstDot = varName.indexOf(".");
+	const head = firstDot >= 0 ? varName.slice(0, firstDot) : varName;
+	for (const declared of [context.template?.Resources, context.template?.Parameters]) if (declared !== void 0 && declared !== null && typeof declared === "object") {
+		if (Object.hasOwn(declared, head)) return;
+	}
+	recordKeptPlaceholder(context.abandonedResolutions, placeholder, because);
+}
 function subListRefusal(subject, value, context) {
 	if (!Array.isArray(value)) return void 0;
 	const count = `${value.length} item${value.length === 1 ? "" : "s"}`;
@@ -18451,11 +19370,13 @@ async function resolveSub(subArgs, context, source) {
 					this.rethrowStructuralSubFailure(varNameStr, getAttError, context);
 					this.logger.warn(this.displayMasked(this.subPlaceholderWarning(varNameStr, getAttError), context));
 					replacement = match[0];
+					noteKeptSubPlaceholder(varNameStr, match[0], getAttError, context);
 				}
 				else {
 					this.rethrowStructuralSubFailure(varNameStr, refError, context);
 					this.logger.warn(this.displayMasked(this.subPlaceholderWarning(varNameStr, refError), context));
 					replacement = match[0];
+					noteKeptSubPlaceholder(varNameStr, match[0], refError, context);
 				}
 			}
 		}
@@ -18972,16 +19893,6 @@ function displayLeaf(value, context) {
 	return this.displayMasked(this.logTextOfLeaf(value, context), context);
 }
 
-//#endregion
-//#region src/deployment/assumed-conditions.ts
-const assumedConditionNames = /* @__PURE__ */ new WeakMap();
-function recordAssumedConditions(conditions, assumed) {
-	assumedConditionNames.set(conditions, assumed);
-}
-function conditionsAssumedFalse(conditions) {
-	return assumedConditionNames.get(conditions) ?? /* @__PURE__ */ new Set();
-}
-
 //#endregion
 //#region src/deployment/intrinsic-resolver/params-conditions.ts
 async function resolveParameters(template, userParameters, options) {
@@ -19523,7 +20434,7 @@ var DiffCalculator = class DiffCalculator {
 	conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue) {
 		return this.replacementRules.conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue);
 	}
-	async calculateDiff(currentState, desiredTemplate, resolveFn, canonicalizeProperties, allowedUnsupportedProperties, freshParameters, maskForLog, recreateTargets) {
+	async calculateDiff(currentState, desiredTemplate, resolveFn, canonicalizeProperties, allowedUnsupportedProperties, freshParameters, maskForLog, recreateTargets, maskedInputs) {
 		const changes = /* @__PURE__ */ new Map();
 		refuseMalformedResourceEntriesForDeploy(currentState, void 0, void 0);
 		refuseMalformedResourceProperties(currentState, void 0, void 0);
@@ -19588,7 +20499,10 @@ var DiffCalculator = class DiffCalculator {
 				else if (canonicalizeProperties && !this.valuesEqual(desiredPropsForCompare, desiredAfterDrops)) this.logger.debug(`${logicalId} (${desiredResource.Type}): the provider normalizes part of the declared properties before sending them; the comparison uses the normalized form. Nothing is dropped.`);
 				const propertyChanges = await this.compareProperties(desiredResource.Type, currentPropsForCompare, desiredPropsForCompare, maskForLog);
 				const reported = new Set(propertyChanges.map((pc) => pc.path));
-				for (const key of movedMaskedProperties(currentResource, rawDesiredProps)) {
+				const rebaselined = [];
+				const moved = await movedMaskedProperties(currentResource, rawDesiredProps, maskedInputs && inputFingerprinter(rawDesiredProps, maskedInputs.sources), maskedInputs?.rebaselined && ((key, fingerprint) => rebaselined.push([key, fingerprint])));
+				if (rebaselined.length > 0) maskedInputs.rebaselined.set(logicalId, Object.fromEntries(rebaselined));
+				for (const key of moved) {
 					if (reported.has(key)) continue;
 					if (!Object.hasOwn(currentPropsForCompare, key)) continue;
 					if (!Object.hasOwn(desiredPropsForCompare, key)) continue;
@@ -19601,7 +20515,7 @@ var DiffCalculator = class DiffCalculator {
 						requiresReplacement: await this.maskedEditRequiresReplacement(desiredResource.Type, key, oldValue, newValue),
 						maskedExpressionChanged: true
 					});
-					this.logger.debug(safeMsg`${logicalId}: ${key} is recorded masked and its template expression changed (go-to-k/cdkd#4451)`);
+					this.logger.debug(safeMsg`${logicalId}: ${key} is recorded masked and its template expression or a resolved input changed (go-to-k/cdkd#4451, go-to-k/cdkd#4543)`);
 				}
 				const attributeChanges = this.compareAttributes(currentResource, desiredResource);
 				if (propertyChanges.length > 0 || attributeChanges.length > 0) {
@@ -20914,7 +21828,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BFlmarbF.js");
+			const { ASGProvider } = await import("./asg-provider-m6f7Veu0.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -21020,7 +21934,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-DqHELwjV.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CHnIs1hG.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-DAe7XFvF.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-B_OxkCXj.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -25798,6 +26712,18 @@ function deploymentEventsIndexKey(prefix, stackName, region) {
 function deploymentsDirPrefix(prefix, stackName, region) {
 	return `${prefix}/${stackName}/${region}/deployments/`;
 }
+const DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION = "deployment-event streams and their index, whose recorded error messages can quote values the secret mask does not catch";
+async function deleteAndPurgeEventObjects(backend, keys, dirPrefix) {
+	if (keys.length === 0) return;
+	try {
+		await backend.deleteRawObjects(keys);
+	} finally {
+		await backend.purgeNoncurrentVersions(keys, {
+			...keys.length > 1 && { listPrefix: dirPrefix },
+			objectDescription: DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION
+		});
+	}
+}
 function runIdTimestampMs(runId) {
 	const m = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})(\d{3})Z/.exec(runId);
 	if (!m) return null;
@@ -25942,7 +26868,7 @@ var DeploymentEventsStore = class {
 			return runId !== null && runId < cutoff;
 		});
 		if (stale.length === 0) return;
-		await this.backend.deleteRawObjects(stale);
+		await deleteAndPurgeEventObjects(this.backend, stale, dirPrefix);
 		this.logger.debug(`Pruned ${stale.length} superseded deployment-event stream(s) for ${this.stackName} (${this.region})`);
 	}
 	warnOnce(message) {
@@ -26034,7 +26960,7 @@ var DeploymentEventsReader = class {
 		const indexExisted = keys.includes(indexKey);
 		if (opts.all === true) {
 			const toDelete = runIdsDesc.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
-			await this.backend.deleteRawObjects([...toDelete, indexKey]);
+			await deleteAndPurgeEventObjects(this.backend, [...toDelete, indexKey], dirPrefix);
 			return {
 				deletedRunIds: runIdsDesc,
 				remainingRunIds: [],
@@ -26060,35 +26986,39 @@ var DeploymentEventsReader = class {
 		const deletedSet = new Set(candidates);
 		const deleteKeys = candidates.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
 		const remainingRunIds = runIdsDesc.filter((id) => !deletedSet.has(id));
-		const indexDeleted = await this.rewriteIndexAfterPrune(indexKey, stackName, region, deletedSet, remainingRunIds.length === 0, indexExisted);
-		await this.backend.deleteRawObjects(deleteKeys);
+		if (remainingRunIds.length === 0) {
+			await deleteAndPurgeEventObjects(this.backend, [...deleteKeys, indexKey], dirPrefix);
+			return {
+				deletedRunIds: candidates,
+				remainingRunIds,
+				indexDeleted: indexExisted
+			};
+		}
+		await this.rewriteIndexAfterPrune(indexKey, stackName, region, deletedSet);
+		await deleteAndPurgeEventObjects(this.backend, deleteKeys, dirPrefix);
 		return {
 			deletedRunIds: candidates,
 			remainingRunIds,
-			indexDeleted
+			indexDeleted: false
 		};
 	}
-	async rewriteIndexAfterPrune(indexKey, stackName, region, deletedRunIds, noRunsRemain, indexExisted) {
-		if (noRunsRemain) {
-			await this.backend.deleteRawObjects([indexKey]);
-			return indexExisted;
-		}
+	async rewriteIndexAfterPrune(indexKey, stackName, region, deletedRunIds) {
 		let raw;
 		try {
 			raw = await this.backend.getRawObject(indexKey);
 		} catch {
-			return false;
+			return;
 		}
-		if (raw === null) return false;
+		if (raw === null) return;
 		let parsed;
 		try {
 			parsed = JSON.parse(raw);
 		} catch {
-			return false;
+			return;
 		}
-		if (!Array.isArray(parsed.runs)) return false;
+		if (!Array.isArray(parsed.runs)) return;
 		const remaining = parsed.runs.filter((r) => !deletedRunIds.has(r.runId));
-		if (remaining.length === parsed.runs.length) return false;
+		if (remaining.length === parsed.runs.length) return;
 		const file = {
 			indexVersion: 1,
 			stackName,
@@ -26097,7 +27027,6 @@ var DeploymentEventsReader = class {
 			lastModified: Date.now()
 		};
 		await this.backend.putRawObject(indexKey, JSON.stringify(file, null, 2));
-		return false;
 	}
 };
 
@@ -26468,11 +27397,25 @@ const nonEmptyString = (v) => typeof v === "string" && v.length > 0;
 
 //#endregion
 //#region src/deployment/rollback-executor/messages.ts
-function throwIfDeleteSkipped(result, logicalId, physicalId, duringClause) {
+function throwIfDeleteSkipped(result, logicalId, physicalId, duringClause, guardScope) {
+	recordRollbackDeleteGuards(result, logicalId, physicalId, guardScope);
 	const reason = deleteSkipReason(result);
 	if (reason === void 0) return;
 	throw new Error(deleteSkippedMessage(logicalId, physicalId, reason, duringClause));
 }
+function recordRollbackDeleteGuards(result, logicalId, physicalId, scope) {
+	for (const guard of deleteIndeterminateGuards(result)) scope.ctx.recordEvent?.({
+		eventType: "RESOURCE_GUARD_INDETERMINATE",
+		stackName: scope.stackName,
+		operation: "DELETE",
+		logicalId,
+		resourceType: scope.resourceType,
+		...scope.provisionedBy && { provisionedBy: scope.provisionedBy },
+		...physicalId && { physicalId: scope.mask(physicalId) },
+		guard: guard.guard,
+		reason: scope.mask(guard.reason)
+	});
+}
 const SKIP_FINAL_SNAPSHOT_FLAG = "--skip-final-snapshot";
 const REPLAYING_STATE_CREATE_CONTEXT = { replayingState: true };
 function replayingStateCreateContext(secrets) {
@@ -27093,7 +28036,7 @@ function classifyFailedOp(op, stateResources) {
 	if (op.changeType === "CREATE") {
 		if (!op.physicalId) return "skip-failed-unknown";
 		if (!current) return "skip-failed-noop";
-		if (current.physicalId !== op.physicalId) return "skip-failed-noop";
+		if (current.physicalId !== op.physicalId) return "skip-failed-mismatch";
 		const policy = effectiveDeletionPolicy(current.resourceType, current.deletionPolicy, current.properties);
 		if (policy === "Retain") return "orphan-failed-create-retain";
 		if (policy === "Snapshot") return "delete-failed-create-with-final-snapshot";
@@ -27357,7 +28300,7 @@ async function replayDelete(s) {
 	let finalSnapshotIdentifier;
 	if (takeFinalSnapshot) finalSnapshotIdentifier = await prepareCreateRollbackFinalSnapshot(op, deleteProvisionedBy, ctx, mask);
 	logger.info(`  Rollback: Deleting created resource ${safe(op.logicalId)} (${safe(op.resourceType)})` + (takeFinalSnapshot ? " — DeletionPolicy: Snapshot" : "") + (snapshotPolicy && !takeFinalSnapshot ? " — DeletionPolicy: Snapshot NOT taken (--skip-final-snapshot)" : ""));
-	const { provider } = ctx.providerRegistry.getProviderFor({
+	const { provider, provisionedBy: deleteRoutedVia } = ctx.providerRegistry.getProviderFor({
 		resourceType: op.resourceType,
 		provisionedBy: deleteProvisionedBy
 	});
@@ -27370,7 +28313,13 @@ async function replayDelete(s) {
 		deletionPolicy: snapshotPolicy ? "Snapshot" : "Delete",
 		recordedAttributes: stateResources[op.logicalId]?.attributes
 	});
-	throwIfDeleteSkipped(createRollbackDelete, op.logicalId, op.physicalId, "while rolling back its CREATE");
+	throwIfDeleteSkipped(createRollbackDelete, op.logicalId, op.physicalId, "while rolling back its CREATE", {
+		ctx,
+		stackName,
+		resourceType: op.resourceType,
+		provisionedBy: deleteRoutedVia,
+		mask
+	});
 	delete stateResources[op.logicalId];
 	logger.info(`  Rollback: ${safe(op.logicalId)} deleted successfully`);
 	await afterOp?.(op.logicalId);
@@ -27398,7 +28347,7 @@ async function replayReadopt(s) {
 		survivorReason = survivorMessages.reason;
 		result.warnings++;
 	} else {
-		const { provider: newDeleteProvider } = ctx.providerRegistry.getProviderFor({
+		const { provider: newDeleteProvider, provisionedBy: newDeleteVia } = ctx.providerRegistry.getProviderFor({
 			resourceType: op.resourceType,
 			provisionedBy: current.provisionedBy ?? op.provisionedBy
 		});
@@ -27411,7 +28360,13 @@ async function replayReadopt(s) {
 			deletionPolicy: replacementDeletePolicy(current.updateReplacePolicy),
 			recordedAttributes: current.attributes
 		});
-		throwIfDeleteSkipped(readoptDelete, op.logicalId, current.physicalId, "while reversing its replacement (re-adopting the retained old resource)");
+		throwIfDeleteSkipped(readoptDelete, op.logicalId, current.physicalId, "while reversing its replacement (re-adopting the retained old resource)", {
+			ctx,
+			stackName,
+			resourceType: op.resourceType,
+			provisionedBy: newDeleteVia,
+			mask
+		});
 	}
 	stateResources[op.logicalId] = prev;
 	logger.info(`  Rollback: ${safe(op.logicalId)} restored to the retained old resource`);
@@ -27556,10 +28511,17 @@ async function replayReverseReplacement(s) {
 		physicalId: prev.physicalId,
 		via: createProvisionedBy
 	}, logger, mask, true);
-	const resolveNewDeleteProvider = () => ctx.providerRegistry.getProviderFor({
+	const resolveNewDeleteRoute = () => ctx.providerRegistry.getProviderFor({
 		resourceType: op.resourceType,
 		provisionedBy: current.provisionedBy ?? op.provisionedBy
-	}).provider;
+	});
+	const newDeleteGuardScope = (provisionedBy) => ({
+		ctx,
+		stackName,
+		resourceType: op.resourceType,
+		provisionedBy,
+		mask
+	});
 	const newCopyClaimed = inlinePolicyWriters.claimedFor(op.resourceType, op.logicalId, stateResources);
 	let deletedNewFirst = false;
 	let createResult;
@@ -27597,13 +28559,14 @@ async function replayReverseReplacement(s) {
 		logger.info(`  Rollback: re-create collided with the new resource's name — deleting the new resource (${displaySafe(mask(current.physicalId))}) first...` + (typeChanged ? ` (this op changed the resource's Type, ${safe(op.resourceType)} -> ${safe(oldType)}, which share a name space)` : ""));
 		{
 			const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
-			const deleteNewFirst = await resolveNewDeleteProvider().delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+			const deleteNewFirstRoute = resolveNewDeleteRoute();
+			const deleteNewFirst = await deleteNewFirstRoute.provider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
 				expectedRegion: ctx.region,
 				...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
 				deletionPolicy: replacementDeletePolicy(current.updateReplacePolicy),
 				recordedAttributes: current.attributes
 			});
-			throwIfDeleteSkipped(deleteNewFirst, op.logicalId, current.physicalId, "while clearing the new resource so the old one could be re-created");
+			throwIfDeleteSkipped(deleteNewFirst, op.logicalId, current.physicalId, "while clearing the new resource so the old one could be re-created", newDeleteGuardScope(deleteNewFirstRoute.provisionedBy));
 		}
 		deletedNewFirst = true;
 		delete stateResources[op.logicalId];
@@ -27662,14 +28625,15 @@ async function replayReverseReplacement(s) {
 		await noteRetainedResource(op.resourceType, op.logicalId);
 	} else if (!deletedNewFirst && !adoptedLiveNewResource) try {
 		const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
-		const deleteNewAfterRecreate = await resolveNewDeleteProvider().delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+		const deleteNewAfterRecreateRoute = resolveNewDeleteRoute();
+		const deleteNewAfterRecreate = await deleteNewAfterRecreateRoute.provider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
 			expectedRegion: ctx.region,
 			...newCopyClaimed && { inlinePolicyClaimed: newCopyClaimed },
 			...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
 			deletionPolicy: replacementDeletePolicy(current.updateReplacePolicy),
 			recordedAttributes: current.attributes
 		});
-		throwIfDeleteSkipped(deleteNewAfterRecreate, op.logicalId, current.physicalId, "while deleting the new resource after re-creating the old one");
+		throwIfDeleteSkipped(deleteNewAfterRecreate, op.logicalId, current.physicalId, "while deleting the new resource after re-creating the old one", newDeleteGuardScope(deleteNewAfterRecreateRoute.provisionedBy));
 	} catch (deleteError) {
 		logger.warn(mask(`  Rollback: old ${safe(op.logicalId)} re-created, but deleting the new resource (${displaySafe(mask(current.physicalId))}) failed: ${displaySafe(deleteError instanceof Error ? deleteError.message : String(deleteError))}. Delete it manually — it is no longer tracked in state.`));
 		survivorReason = `The replacement's new ${op.resourceType} (${current.physicalId}) could not be deleted after the old resource was re-created: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}. It is live, still billing, and no longer tracked by cdkd — delete it yourself.`;
@@ -27910,6 +28874,10 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 				case "skip-failed-noop":
 					logger.info(`  Rollback: failed ${safe(op.changeType)} of ${safe(op.logicalId)} (${safe(op.resourceType)}) left nothing to revert, skipping`);
 					break;
+				case "skip-failed-mismatch":
+					logger.warn(safeMsg`  Rollback: Skipping failed CREATE of ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}) — it recorded ${mask(String(op.physicalId))}, which is not the resource state tracks under this id; manual attention may be required`);
+					recordRollbackSkip(skipScope, op, "The failed CREATE recorded a physical id other than the one state now tracks under this logical id, so the rollback left it as it is; manual attention may be required.");
+					break;
 				case "skip-failed-unknown":
 					logger.warn(`  Rollback: failed CREATE of ${safe(op.logicalId)} (${safe(op.resourceType)}) recorded no physical id — if it was partially created in AWS, delete it manually`);
 					recordRollbackSkip(skipScope, op, "The failed CREATE recorded no physical id, so the rollback cannot address it; if it was partially created in AWS, delete it manually.");
@@ -27958,7 +28926,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 					let finalSnapshotIdentifier;
 					if (takeFinalSnapshot) finalSnapshotIdentifier = await prepareCreateRollbackFinalSnapshot(op, deleteProvisionedBy, ctx, mask);
 					logger.info(`  Rollback: deleting partially-created ${safe(op.logicalId)} (${safe(op.resourceType)}) (--revert-failed)` + (takeFinalSnapshot ? " — DeletionPolicy: Snapshot" : "") + (snapshotPolicy && !takeFinalSnapshot ? " — DeletionPolicy: Snapshot NOT taken (--skip-final-snapshot)" : ""));
-					const { provider } = ctx.providerRegistry.getProviderFor({
+					const { provider, provisionedBy: deleteRoutedVia } = ctx.providerRegistry.getProviderFor({
 						resourceType: op.resourceType,
 						provisionedBy: deleteProvisionedBy
 					});
@@ -27971,7 +28939,13 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						deletionPolicy: snapshotPolicy ? "Snapshot" : "Delete",
 						recordedAttributes: stateResources[op.logicalId]?.attributes
 					});
-					throwIfDeleteSkipped(failedCreateDelete, op.logicalId, op.physicalId, "while deleting the partially-created resource (--revert-failed)");
+					throwIfDeleteSkipped(failedCreateDelete, op.logicalId, op.physicalId, "while deleting the partially-created resource (--revert-failed)", {
+						ctx,
+						stackName,
+						resourceType: op.resourceType,
+						provisionedBy: deleteRoutedVia,
+						mask
+					});
 					delete stateResources[op.logicalId];
 					await options.afterOp?.(op.logicalId);
 					ctx.recordEvent?.({
@@ -28072,7 +29046,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 				error: maskedRollbackEventError(revertError, mask)
 			});
 		}
-		inlinePolicyWriters.noteOutcome(op, action === "skip-failed-noop" || ownRecord(stateResources, op.logicalId) !== recordBefore);
+		inlinePolicyWriters.noteOutcome(op, action === "skip-failed-noop" || action === "skip-failed-mismatch" || ownRecord(stateResources, op.logicalId) !== recordBefore);
 	}
 	if (result.interrupted) await restoreHeldInlinePolicies(inlinePolicyWriters, stateResources, stackName, ctx, result, { refuseAll: true });
 	if (emitEnvelope) ctx.recordEvent?.({
@@ -28091,22 +29065,22 @@ async function replayFailedOperations(...args) {
 
 //#endregion
 //#region src/provisioning/nested-stack-context.ts
-const storage = new AsyncLocalStorage();
+const storage$1 = new AsyncLocalStorage();
 function withNestedStackContext(ctx, fn) {
-	return storage.run(ctx, fn);
+	return storage$1.run(ctx, fn);
 }
 function getCurrentNestedStackContext() {
-	return storage.getStore();
+	return storage$1.getStore();
 }
 async function collectNestedChildUnaddressed(fn) {
-	const ctx = storage.getStore();
+	const ctx = storage$1.getStore();
 	if (!ctx) return {
 		value: await fn(),
 		unaddressed: void 0
 	};
 	const slot = {};
 	return {
-		value: await storage.run({
+		value: await storage$1.run({
 			...ctx,
 			childUnaddressed: slot
 		}, fn),
@@ -28117,7 +29091,7 @@ async function collectNestedChildUnaddressed(fn) {
 //#endregion
 //#region src/deployment/nested-child-journal.ts
 const NESTED_PENDING_PARENT_REASON = "nested-pending-parent";
-const NESTED_STACK_TYPE = "AWS::CloudFormation::Stack";
+const NESTED_STACK_TYPE$1 = "AWS::CloudFormation::Stack";
 const MAX_NESTED_WALK_DEPTH = 32;
 function nestedChildStackName(parentStackName, logicalId) {
 	return `${parentStackName}~${logicalId}`;
@@ -28134,8 +29108,46 @@ function nestedPendingSnapshot(state) {
 		}
 	};
 }
+function displacedPhysicalIdShown(op, logger, physicalId = journalOpPhysicalId(op)) {
+	if (physicalId === void 0) return void 0;
+	const masker = createOpMasker(logger, /* @__PURE__ */ new Map());
+	for (const properties of [
+		op.properties,
+		op.attemptedProperties,
+		op.previousState?.properties
+	]) {
+		if (properties === void 0) continue;
+		masker.addNamed({
+			resourceType: op.resourceType,
+			properties,
+			logicalId: op.logicalId,
+			physicalIds: [physicalId]
+		});
+	}
+	return displaySafe(String(masker.mask(physicalId)));
+}
+function displacedOpClause(op, marks, logger) {
+	const retainedOld = retainedOldPhysicalId(op);
+	if (retainedOld !== void 0 && marks.some((m) => isMarkFor(m, op))) {
+		const shownOld = displacedPhysicalIdShown(op, logger, retainedOld);
+		return `replaced ${shownOld} ${op.oldResourceRetained === true ? "but kept it (UpdateReplacePolicy: Retain)" : "and may have kept it (the journal records no verdict)"}; cdkd import adopted the replacement, so ${shownOld} is left untracked`;
+	}
+	const shownId = displacedPhysicalIdShown(op, logger);
+	return shownId !== void 0 ? `recorded ${shownId}, which cdkd import has since replaced under this id` : "recorded no physical id, and cdkd import has since put another resource under this id";
+}
+function recordDisplacedSkips(recordEvent, stackName, ops) {
+	for (const op of ops) recordEvent?.({
+		eventType: "ROLLBACK_RESOURCE_SKIPPED",
+		stackName,
+		operation: op.changeType,
+		logicalId: op.logicalId,
+		resourceType: op.resourceType,
+		...op.provisionedBy && { provisionedBy: op.provisionedBy },
+		reason: "cdkd import has since put another resource under this logical id, so the op was not reverted; check the resource it recorded by hand"
+	});
+}
 function revertedNestedRowIds(ops) {
-	return ops.filter((op) => op.resourceType === NESTED_STACK_TYPE && op.changeType === "UPDATE").map((op) => op.logicalId);
+	return ops.filter((op) => op.resourceType === NESTED_STACK_TYPE$1 && op.changeType === "UPDATE").map((op) => op.logicalId);
 }
 const revertRunStorage = new AsyncLocalStorage();
 function withNestedRevertRun(runId, fn) {
@@ -28161,7 +29173,7 @@ async function dropNestedChildJournals(args) {
 	if (!isPlainRecord(resources)) return;
 	if (depthExceeded(depth, parentStackName, logger)) return;
 	for (const [logicalId, record] of Object.entries(resources)) {
-		if (!isPlainRecord(record) || record["resourceType"] !== NESTED_STACK_TYPE) continue;
+		if (!isPlainRecord(record) || record["resourceType"] !== NESTED_STACK_TYPE$1) continue;
 		const child = nestedChildStackName(parentStackName, logicalId);
 		try {
 			const data = await stateBackend.getState(child, region);
@@ -28319,8 +29331,9 @@ async function revertNestedChildFromJournal(args) {
 		for (let s = segments.length - 1; s >= 0; s--) {
 			const segment = segments[s];
 			const skipPrefix = segment.skipPrefix ?? getCurrentSkipPrefix();
+			const split = splitImportedOps(segment.operations, segment);
 			const result = await withNestedStackContext(childCtx, () => withSkipPrefix(skipPrefix, () => withStackName(childStackName, () => withCreateTokenLedger(ledgerForStack(ctx.stateBackend, childStackName, region), () => withNestedRevertRun(runId, async (inner) => {
-				const replayed = await replayRollback(segment.operations, stateResources, childStackName, execCtx, {
+				const replayed = await replayRollback(split.replay, stateResources, childStackName, execCtx, {
 					afterOp: save,
 					onOrphan: (record) => mintedOrphans.push(record),
 					inlinePolicyWriters
@@ -28332,7 +29345,9 @@ async function revertNestedChildFromJournal(args) {
 				};
 			})))));
 			failures += result.failures;
-			warnings += result.warnings;
+			warnings += result.warnings + split.displaced.length;
+			recordDisplacedSkips(execCtx.recordEvent, childStackName, split.displaced);
+			for (const op of split.displaced) logger.warn(safeMsg`Nested stack ${childStackName}: ${op.logicalId} ` + safeMsg`${displacedOpClause(op, segment.importedResources ?? [], logger)}; ` + "not reverted, check that resource by hand");
 		}
 		restoring = failures === 0;
 		await save();
@@ -29318,6 +30333,24 @@ const cyan = (s) => `${codes.cyan}${s}${codes.reset}`;
 const gray = (s) => `${codes.gray}${s}${codes.reset}`;
 const bold = (s) => `${codes.bright}${s}${codes.reset}`;
 
+//#endregion
+//#region src/deployment/delete-guard-scope.ts
+const storage = new AsyncLocalStorage();
+function collectDeleteGuards(sink, fn) {
+	return storage.run(sink, fn);
+}
+function reportDeleteGuards(result, target) {
+	const sink = storage.getStore();
+	if (!sink) return;
+	for (const guard of deleteIndeterminateGuards(result)) sink.push({
+		guard: guard.guard,
+		reason: guard.reason,
+		physicalId: target.physicalId,
+		resourceType: target.resourceType,
+		...target.provisionedBy && { provisionedBy: target.provisionedBy }
+	});
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/replacement.ts
 function replacementDeleteContext(updateReplacePolicy) {
@@ -29336,7 +30369,7 @@ async function prepareFinalSnapshotForDelete(logicalId, resourceType, currentRes
 	}
 	throw unsupportedFinalSnapshotError(logicalId, resourceType, "--skip-final-snapshot");
 }
-async function replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, secrets, updateReplacePolicy) {
+async function replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, secrets, updateReplacePolicy, oldDeleteProvisionedBy) {
 	const createContext = { maskSecrets: createSecretMasker(secrets) };
 	const finalSnapshotIdentifier = await this.prepareFinalSnapshotForDelete(logicalId, oldResourceType, currentResource, updateReplacePolicy);
 	let deleteResult;
@@ -29351,6 +30384,11 @@ async function replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourc
 	} catch (deleteError) {
 		throw new Error(maskSecretsInText(`Failed to delete old resource ${logicalId} (${currentResource.physicalId}) during the --replace delete-first fallback: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`, secrets));
 	}
+	reportDeleteGuards(deleteResult, {
+		physicalId: currentResource.physicalId,
+		resourceType: oldResourceType,
+		provisionedBy: oldDeleteProvisionedBy
+	});
 	const replaceSkipReason = deleteSkipReason(deleteResult);
 	if (replaceSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, replaceSkipReason, "during the --replace delete-first fallback"));
 	this.logger.info(`  ${green("✓")} Old resource deleted`);
@@ -29455,10 +30493,10 @@ async function createFirstThenDeleteOld(input) {
 	if (input.equalIdIsSameResource && createResult.physicalId === currentResource.physicalId) throw markNonRetryable(new CdkdError(maskName(`${displaySafe(logicalId)} (${displaySafe(resourceType)}) requires replacement (${input.trigger}) under a new name, but the create returned the resource being replaced (${displaySafe(currentResource.physicalId)}) instead of a new one, so cdkd cannot tell which name it holds. Nothing was deleted. Delete that resource by hand if it is yours, then re-run the deploy.`), "NAMED_REPLACEMENT_IDEMPOTENT_CREATE"));
 	if (retainOld) return createResult;
 	this.logger.info(safeMsg`  Deleting old ${logicalId} (${currentResource.physicalId})...`);
-	await this.deleteReplacedAfterCreate(logicalId, input.oldResourceType, currentResource, input.deleteProvider, input.deleteProperties, finalSnapshotIdentifier, input.deletePolicy, secrets);
+	await this.deleteReplacedAfterCreate(logicalId, input.oldResourceType, currentResource, input.deleteProvider, input.deleteProperties, finalSnapshotIdentifier, input.deletePolicy, secrets, input.deleteProvisionedBy);
 	return createResult;
 }
-async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, deleteProvider, deleteProperties, finalSnapshotIdentifier, updateReplacePolicy, secrets) {
+async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, deleteProvider, deleteProperties, finalSnapshotIdentifier, updateReplacePolicy, secrets, deleteProvisionedBy) {
 	let deleteResult = void 0;
 	let deleteFailed = false;
 	try {
@@ -29474,6 +30512,11 @@ async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentReso
 		deleteFailed = true;
 		this.logger.warn(safeMsg`  ⚠ Failed to delete old resource ${logicalId} (${currentResource.physicalId}): ${deleteMsg}`);
 	}
+	reportDeleteGuards(deleteResult, {
+		physicalId: currentResource.physicalId,
+		resourceType: oldResourceType,
+		provisionedBy: deleteProvisionedBy
+	});
 	const skipReason = deleteSkipReason(deleteResult);
 	if (skipReason !== void 0) this.logger.warn(`  ⚠ ${deleteSkippedMessage(logicalId, currentResource.physicalId, skipReason, "while cleaning up the replaced resource", { commandFreeLine: true })}. Delete it manually — it is no longer tracked in state.`);
 	else if (!deleteFailed) this.logger.info(`  ${green("✓")} Old resource deleted`);
@@ -29737,8 +30780,15 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 	const resolvedProps = await this.resolver.resolve(desiredProps, context);
 	this.refuseRedactedAttributeReads(logicalId, resourceType, context);
 	this.perResourceTemplateProps.set(logicalId, desiredProps);
+	const fingerprintSources = template && this.maskedInputSources(template, stateResources, conditions, stackName);
+	if (fingerprintSources !== void 0) this.perResourceInputFingerprints.set(logicalId, await maskedInputFingerprintsFor(possiblyMaskedKeys(resolvedProps, [
+		context.recordedSecretValues,
+		this.fingerprintNoEchoValues,
+		this.options.inheritedSecrets
+	]), inputFingerprinter(desiredProps, fingerprintSources)));
 	this.perResourceResolvedType.set(logicalId, resourceType);
 	const createSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
+	if (fingerprintSources !== void 0 && resourceType === "AWS::CloudFormation::Stack") recordPassedParameterClasses(createSecrets, await classifyPassedParameters(desiredProps["Parameters"], fingerprintSources));
 	recordNestedStackParameterExpressions(createSecrets, resourceType, resolvedProps, desiredProps);
 	this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 	this.attemptedResolvedProps.set(logicalId, resolvedProps);
@@ -32630,7 +33680,15 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	const lostChild = lostCandidate?.mode === "reattach" || lostCandidate !== void 0 && Object.hasOwn(resolvedProps, lostCandidate.property) && Object.hasOwn(currentProps, lostCandidate.property) && keyOrderFreeJson(resolvedProps[lostCandidate.property]) === keyOrderFreeJson(currentProps[lostCandidate.property]) ? lostCandidate : void 0;
 	const lostWithParent = lostChild?.mode === "recreate" ? lostChild.parent : void 0;
 	const suppliesFreshMaskOnlyValue = carriesFreshNoEchoValue(resolvedProps, updateSecrets);
-	const movedMasked = new Set(movedMaskedProperties(currentResource, desiredProps));
+	const fingerprintSources = template && this.maskedInputSources(template, stateResources, conditions, stackName);
+	const fingerprints = fingerprintSources && inputFingerprinter(desiredProps, fingerprintSources);
+	const movedMasked = new Set(await movedMaskedProperties(currentResource, desiredProps, fingerprints));
+	if (fingerprints !== void 0) this.perResourceInputFingerprints.set(logicalId, await maskedInputFingerprintsFor(possiblyMaskedKeys(resolvedProps, [
+		updateSecrets,
+		this.fingerprintNoEchoValues,
+		this.options.inheritedSecrets
+	]), fingerprints));
+	if (fingerprintSources !== void 0 && resourceType === "AWS::CloudFormation::Stack") recordPassedParameterClasses(updateSecrets, await classifyPassedParameters(desiredProps["Parameters"], fingerprintSources));
 	const desiredForSkipCheck = redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps);
 	const allowedSilentDrops = this.providerRegistry.getAllowedUnsupportedProperties?.();
 	const desiredForSkipCheckAsWritten = currentResource.provisionedBy !== "cc-api" && allowedSilentDrops ? withoutAcceptedSilentDropProperties(resourceType, desiredForSkipCheck, allowedSilentDrops, currentResource.properties) : desiredForSkipCheck;
@@ -32853,10 +33911,11 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 	});
 	const replaceProvider = replaceDecision.provider;
 	const replaceProps = replaceDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
-	const oldDeleteProvider = this.providerRegistry.getProviderFor({
+	const oldDeleteRoute = this.providerRegistry.getProviderFor({
 		resourceType: oldResourceType,
 		provisionedBy: currentResource.provisionedBy
-	}).provider;
+	});
+	const oldDeleteProvider = oldDeleteRoute.provider;
 	const equalIdIsSameResource = equalIdNamesSameResource({
 		oldType: oldResourceType,
 		newType: resourceType,
@@ -32895,6 +33954,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			createProvider: replaceProvider,
 			createProps: replaceProps,
 			deleteProvider: oldDeleteProvider,
+			deleteProvisionedBy: oldDeleteRoute.provisionedBy,
 			deleteProperties: currentResource.properties,
 			secrets: updateSecrets,
 			change: nameChange,
@@ -32924,6 +33984,11 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			} catch (deleteError) {
 				throw new Error(`Failed to destroy old resource ${logicalId} (${currentResource.physicalId}) during ${recreateFlagName}: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`);
 			}
+			reportDeleteGuards(recreateDeleteResult, {
+				physicalId: currentResource.physicalId,
+				resourceType: oldResourceType,
+				provisionedBy: oldDeleteRoute.provisionedBy
+			});
 			const recreateSkipReason = deleteSkipReason(recreateDeleteResult);
 			if (recreateSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, recreateSkipReason, `during ${recreateFlagName}`));
 			this.logger.info(`  ${green("✓")} Old resource deleted`);
@@ -32979,7 +34044,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but the create-first attempt collided with the existing resource: ${createMsg}. ${nameOrigin.descriptor}, so the CloudFormation-style safe replacement order (create the new resource before deleting the old) cannot reuse the occupied name — CloudFormation refuses this shape with "cannot update a stack when a custom-named resource requires replacing". ${nameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated).`, "NAMED_REPLACEMENT_COLLISION");
 			this.logger.info(`  Create-first collided with the existing resource's name and --replace is set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
 			deletedOldFirst = true;
-			createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy);
+			createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy, oldDeleteRoute.provisionedBy);
 		}
 		if (equalIdIsSameResource && !deletedOldFirst && createResult.physicalId === currentResource.physicalId) {
 			const idempotentNameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
@@ -32987,7 +34052,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its Create API is name-idempotent: the create-first attempt returned the EXISTING resource (${currentResource.physicalId}) instead of creating a new one, so deleting the "old" resource would silently destroy the resource the deploy just reported as created. ${idempotentNameOrigin.descriptor}; ${idempotentNameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated). Note: this branch is also reached when the old resource was deleted out-of-band and the physical id is name-derived — there the create was a genuine fresh create; \`--replace\` converges that case too.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
 			this.logger.info(`  Create-first returned the existing resource (name-idempotent Create API) and --replace is set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
 			deletedOldFirst = true;
-			createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy);
+			createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy, oldDeleteRoute.provisionedBy);
 		}
 		if (deletedOldFirst) {} else if (updateReplacePolicy === "Retain") {
 			this.retainedOldOnReplacement.add(logicalId);
@@ -33004,7 +34069,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 				snapshotBlockedDelete = true;
 				this.logger.warn(`  ⚠ Final snapshot for old ${logicalId} (${currentResource.physicalId}) failed: ${snapshotError instanceof Error ? snapshotError.message : String(snapshotError)}. The old resource was NOT deleted (UpdateReplacePolicy: Snapshot) — delete it manually once you have a snapshot; it is no longer tracked in state.`);
 			}
-			if (!snapshotBlockedDelete) await this.deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, oldDeleteProvider, currentResource.properties, cleanupFinalSnapshotId, updateReplacePolicy, updateSecrets);
+			if (!snapshotBlockedDelete) await this.deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, oldDeleteProvider, currentResource.properties, cleanupFinalSnapshotId, updateReplacePolicy, updateSecrets, oldDeleteRoute.provisionedBy);
 		}
 	}
 	this.registerNoEchoAttributes(logicalId, createResult, updateSecrets, resolvedProps);
@@ -33140,6 +34205,11 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 					if (!isWaitAbandonedError(deleteError) && !isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound"))) this.logger.debug(`Old resource ${logicalId} already gone, proceeding with CREATE`);
 					else throw deleteError;
 				}
+				reportDeleteGuards(fallbackDeleteResult, {
+					physicalId: currentResource.physicalId,
+					resourceType,
+					provisionedBy: updateDecision.provisionedBy
+				});
 				const fallbackSkipReason = deleteSkipReason(fallbackDeleteResult);
 				if (fallbackSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, fallbackSkipReason, "during the UPDATE-not-supported replacement"));
 			}
@@ -33154,6 +34224,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 					createProvider: replProvider,
 					createProps: replProps,
 					deleteProvider: updateProvider,
+					deleteProvisionedBy: updateDecision.provisionedBy,
 					deleteProperties: currentProps,
 					secrets: updateSecrets,
 					change: fallbackNameChange,
@@ -33283,10 +34354,11 @@ async function provisionDelete(logicalId, change, stateResources, stackName, tem
 	}
 	const governingPolicy = effectiveDeletionPolicy(resourceType, deletionPolicy, currentResource.properties);
 	const finalSnapshotIdentifier = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, governingPolicy);
-	const deleteProvider = this.providerRegistry.getProviderFor({
+	const deleteRoute = this.providerRegistry.getProviderFor({
 		resourceType,
 		provisionedBy: currentResource.provisionedBy
-	}).provider;
+	});
+	const deleteProvider = deleteRoute.provider;
 	this.logger.debug(`Deleting ${logicalId} (${resourceType})`);
 	let deleteResult = void 0;
 	const inlinePolicyClaimed = this.inlinePolicyClaimedFor(resourceType, logicalId, stateResources);
@@ -33304,6 +34376,11 @@ async function provisionDelete(logicalId, change, stateResources, stackName, tem
 		if (!isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && !isWaitAbandonedError(deleteError) && (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException"))) this.logger.debug(`Resource ${logicalId} already deleted (${msg}), removing from state`);
 		else throw deleteError;
 	}
+	reportDeleteGuards(deleteResult, {
+		physicalId: currentResource.physicalId,
+		resourceType,
+		provisionedBy: deleteRoute.provisionedBy
+	});
 	const deleteSkipped = deleteSkipReason(deleteResult);
 	if (deleteSkipped !== void 0) {
 		if (progress) progress.current++;
@@ -33426,12 +34503,27 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 	const physicalIdBeforeUpdate = stateResources[logicalId]?.physicalId;
 	const provisionedByBeforeUpdate = stateResources[logicalId]?.provisionedBy;
 	let nestedChildUnaddressed;
+	const deleteGuards = [];
 	try {
 		await withResourceDeadline(async () => {
-			const { value: bodyResult, unaddressed } = await collectNestedChildUnaddressed(() => this.provisionResourceBody(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress));
-			deleteSkipped = bodyResult?.deleteSkipped;
-			updatePartial = bodyResult?.updatePartial;
-			nestedChildUnaddressed = unaddressed;
+			try {
+				const { value: bodyResult, unaddressed } = await collectDeleteGuards(deleteGuards, () => collectNestedChildUnaddressed(() => this.provisionResourceBody(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress)));
+				deleteSkipped = bodyResult?.deleteSkipped;
+				updatePartial = bodyResult?.updatePartial;
+				nestedChildUnaddressed = unaddressed;
+			} finally {
+				for (const guard of deleteGuards.splice(0)) this.recordEvent({
+					eventType: "RESOURCE_GUARD_INDETERMINATE",
+					stackName,
+					operation: "DELETE",
+					logicalId,
+					resourceType: guard.resourceType,
+					...guard.provisionedBy && { provisionedBy: guard.provisionedBy },
+					...guard.physicalId && { physicalId: this.maskForResource(logicalId, guard.physicalId) },
+					guard: guard.guard,
+					reason: guard.reason
+				});
+			}
 		}, {
 			warnAfterMs,
 			timeoutMs,
@@ -34370,6 +35462,184 @@ function conditionVerdictRecordsEqual(a, b) {
 	return names.every((name) => Object.hasOwn(right, name) && left[name].verdict === right[name].verdict && left[name].fingerprint === right[name].fingerprint);
 }
 
+//#endregion
+//#region src/utils/nested-template-cycle.ts
+const NESTED_STACK_TYPE = "AWS::CloudFormation::Stack";
+function isAbsoluteAssetPath(p) {
+	return path.isAbsolute(p) || p.startsWith("/");
+}
+function templateIdentity(templatePath) {
+	const dir = path.dirname(templatePath);
+	let realDir;
+	try {
+		realDir = fs.realpathSync.native(dir);
+	} catch {
+		realDir = path.resolve(dir);
+	}
+	return path.join(realDir, path.basename(templatePath));
+}
+function listNestedTemplateRows(template) {
+	if (template === null || typeof template !== "object") return [];
+	const resources = template.Resources;
+	if (resources === null || resources === void 0) return [];
+	const rows = [];
+	for (const [logicalId, resource] of Object.entries(resources)) {
+		const row = resource;
+		if (row?.Type !== NESTED_STACK_TYPE) continue;
+		const assetPath = row.Metadata?.["aws:asset:path"];
+		if (typeof assetPath !== "string" || assetPath.length === 0) continue;
+		rows.push({
+			logicalId,
+			assetPath
+		});
+	}
+	return rows;
+}
+function readNestedRows(templatePath) {
+	let parsed;
+	try {
+		parsed = JSON.parse(fs.readFileSync(templatePath, "utf-8"));
+	} catch {
+		return;
+	}
+	return listNestedTemplateRows(parsed);
+}
+const MAX_NESTING_DEPTH = 512;
+const MAX_ROWS_FOLLOWED = 1e4;
+function findNestedTemplateTreeDefect(nestedTemplates, ancestorTemplatePaths = []) {
+	const onChain = /* @__PURE__ */ new Set();
+	for (const p of ancestorTemplatePaths) onChain.add(templateIdentity(p));
+	const clean = /* @__PURE__ */ new Set();
+	const chain = [];
+	let rowsFollowed = 0;
+	const visit = (logicalId, templatePath) => {
+		if (typeof templatePath !== "string") return void 0;
+		const identity = templateIdentity(templatePath);
+		const lexical = path.resolve(templatePath);
+		chain.push({
+			logicalId,
+			templatePath: identity
+		});
+		try {
+			if (onChain.has(identity)) return {
+				kind: "cycle",
+				chain: [...chain]
+			};
+			if (chain.length > 512) return {
+				kind: "too-deep",
+				chain: [...chain]
+			};
+			if (++rowsFollowed > 1e4) return {
+				kind: "too-large",
+				chain: [...chain]
+			};
+			if (clean.has(lexical)) return void 0;
+			const rows = readNestedRows(templatePath);
+			if (rows === void 0) return void 0;
+			onChain.add(identity);
+			try {
+				const dir = path.dirname(templatePath);
+				for (const row of rows) {
+					if (isAbsoluteAssetPath(row.assetPath)) return {
+						kind: "absolute-path",
+						chain: [...chain],
+						logicalId: row.logicalId,
+						assetPath: row.assetPath
+					};
+					const resolved = resolveAssemblyPath(dir, row.assetPath);
+					if (!resolved.contained) return {
+						kind: "escaping-path",
+						chain: [...chain],
+						logicalId: row.logicalId,
+						assetPath: row.assetPath,
+						escape: resolved,
+						dir
+					};
+					const defect = visit(row.logicalId, resolved.path);
+					if (defect) return defect;
+				}
+			} finally {
+				onChain.delete(identity);
+			}
+			clean.add(lexical);
+			return;
+		} finally {
+			chain.pop();
+		}
+	};
+	for (const [logicalId, templatePath] of Object.entries(nestedTemplates)) {
+		const defect = visit(logicalId, templatePath);
+		if (defect) return defect;
+	}
+}
+const MAX_RENDERED_HOPS = 8;
+function renderChain(chain) {
+	const hop = (h) => `${displayIdent(h.logicalId)} (${displayAssemblyPath(h.templatePath)})`;
+	if (chain.length <= MAX_RENDERED_HOPS) return chain.map(hop).join(" then ");
+	const keep = MAX_RENDERED_HOPS / 2;
+	return [
+		...chain.slice(0, keep).map(hop),
+		`... ${chain.length - 8} more ...`,
+		...chain.slice(-4).map(hop)
+	].join(" then ");
+}
+function renderNestedTemplateTreeDefect(defect, stackName, action) {
+	const provenance = `CDK emits an acyclic nested template tree with relative asset paths, so this indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to ${action}.`;
+	const owner = (chain) => {
+		const ids = chain.slice(0, -1).map((h) => h.logicalId);
+		const keep = MAX_RENDERED_HOPS / 2;
+		if (ids.length <= MAX_RENDERED_HOPS) return displayStackName([stackName, ...ids].join("~"));
+		const head = displayStackName([stackName, ...ids.slice(0, keep)].join("~"));
+		const tail = displayStackName(ids.slice(-4).join("~"));
+		return `${head}~...${ids.length - 8} more...~${tail}`;
+	};
+	if (defect.kind === "cycle") {
+		const closing = defect.chain[defect.chain.length - 1];
+		return `The nested template tree under stack ${displayStackName(stackName)} contains a cycle: ${renderChain(defect.chain)}. Nested stack ${displayIdent(closing.logicalId)} (declared in stack ${owner(defect.chain)}) resolves to a template that is already on that nesting chain, so its Metadata['aws:asset:path'] closes a cycle. ${provenance}`;
+	}
+	if (defect.kind === "too-large") return `The nested template tree under stack ${displayStackName(stackName)} has more than ${MAX_ROWS_FOLLOWED} nested-stack rows to follow (the walk stopped at ${renderChain(defect.chain)}). That is far beyond any CDK-generated assembly. Symlinked directories can give one template file many paths, which multiplies the tree without ever repeating on one chain. Refusing to ${action}.`;
+	if (defect.kind === "too-deep") return `The nested template tree under stack ${displayStackName(stackName)} nests more than ${512} levels deep: ${renderChain(defect.chain)}. No tree that deep can deploy, because each level lengthens the child's state key and S3 caps a key at 1024 bytes. ${provenance}`;
+	if (defect.kind === "escaping-path") return `The nested template tree under stack ${displayStackName(stackName)} has nested stack ${displayIdent(defect.logicalId)} (reached through ${renderChain(defect.chain)}) with Metadata['aws:asset:path']=${displayAssemblyPath(defect.assetPath)} which ${renderAssemblyPathEscape(defect.escape, defect.dir, action)}`;
+	return `The nested template tree under stack ${displayStackName(stackName)} has nested stack ${displayIdent(defect.logicalId)} (reached through ${renderChain(defect.chain)}) with Metadata['aws:asset:path']=${displayAssemblyPath(defect.assetPath)} which is absolute. ${provenance}`;
+}
+
+//#endregion
+//#region src/deployment/nested-output-templates.ts
+function childTemplateLoader(nestedTemplates) {
+	if (nestedTemplates === void 0) return void 0;
+	const read = /* @__PURE__ */ new Map();
+	const loaderOver = (index) => (logicalId) => {
+		const templatePath = index[logicalId];
+		if (typeof templatePath !== "string") return void 0;
+		const key = path.resolve(templatePath);
+		if (read.has(key)) return read.get(key);
+		let entry;
+		try {
+			const parsed = JSON.parse(fs.readFileSync(templatePath, "utf-8"));
+			if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) entry = {
+				template: parsed,
+				identity: templateIdentity(templatePath),
+				childTemplate: loaderOver(childIndex(parsed, templatePath))
+			};
+		} catch {
+			entry = void 0;
+		}
+		read.set(key, entry);
+		return entry;
+	};
+	return loaderOver(nestedTemplates);
+}
+function childIndex(template, templatePath) {
+	const dir = path.dirname(templatePath);
+	const index = Object.create(null);
+	for (const { logicalId, assetPath } of listNestedTemplateRows(template)) {
+		if (isAbsoluteAssetPath(assetPath)) continue;
+		const resolved = resolveAssemblyPath(dir, assetPath);
+		if (resolved.contained) index[logicalId] = resolved.path;
+	}
+	return index;
+}
+
 //#endregion
 //#region src/deployment/recreate-target-promotion.ts
 function recreateTargetIdsFor(recreateTargets, stackName) {
@@ -34476,6 +35746,14 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		this.logger.debug(`Resolved ${Object.keys(parameterValues).length} parameters: ${Object.keys(parameterValues).join(", ")}`);
 		const backfillNoEchoValues = noEchoParameterValueSeed(template.Parameters, parameterValues, this.options.inheritedSecrets, this.options.parameters);
 		this.fingerprintNoEchoValues = backfillNoEchoValues;
+		this.fingerprintParameters = parameterInputsFor({
+			template,
+			values: parameterValues,
+			nestedChild: this.options.parentStackInfo !== void 0,
+			supplied: this.options.parameters,
+			passedClasses: this.options.passedParameterClasses
+		});
+		this.fingerprintChildTemplates = childTemplateLoader(getCurrentNestedStackContext()?.nestedTemplates);
 		let maskedFingerprintsBackfilled = backfillMaskedPropertyFingerprints(currentState.resources, template, backfillNoEchoValues) > 0;
 		const context = this.buildResolverContext({
 			template,
@@ -34527,8 +35805,19 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		diffResolverContext.bestEffort = true;
 		diffResolverContext.skipDynamicReferences = true;
 		const diffResolveFn = (value) => this.resolver.resolve(value, diffResolverContext);
-		const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry), this.providerRegistry.getAllowedUnsupportedProperties?.(), this.freshNoEchoParameters(parameterValues), this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues), recreateTargetIdsFor(this.options.recreateTargets, stackName));
+		const maskedInputSourcesForDiff = this.maskedInputSources(effectiveTemplate, currentState.resources, conditions, stackName);
+		const maskedInputs = maskedInputSourcesForDiff && {
+			sources: maskedInputSourcesForDiff,
+			rebaselined: /* @__PURE__ */ new Map()
+		};
+		const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry), this.providerRegistry.getAllowedUnsupportedProperties?.(), this.freshNoEchoParameters(parameterValues), this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues), recreateTargetIdsFor(this.options.recreateTargets, stackName), maskedInputs);
 		createOnlyPrefetch.cancel();
+		for (const [logicalId, fingerprints] of maskedInputs?.rebaselined ?? []) {
+			const record = currentState.resources[logicalId];
+			if (record === void 0) continue;
+			currentState.resources[logicalId] = withRebaselinedFingerprints(record, fingerprints);
+			maskedFingerprintsBackfilled = true;
+		}
 		const nestedStackTypeChanges = findNestedStackTypeChanges({
 			changes,
 			stateResources: currentState.resources
@@ -34712,6 +36001,54 @@ function buildResolverContext(base, stackName) {
 		...base.redactedAttributeReads && { redactedAttributeReads: base.redactedAttributeReads }
 	};
 }
+function getAttTargetOf(node) {
+	if (node === null || typeof node !== "object" || Array.isArray(node)) return void 0;
+	const getAtt = node["Fn::GetAtt"];
+	if (Array.isArray(getAtt) && typeof getAtt[0] === "string") return getAtt[0];
+	if (typeof getAtt === "string") return getAtt.split(".")[0];
+}
+function maskedInputSources(template, resources, conditions, stackName) {
+	const parameters = this.fingerprintParameters;
+	if (parameters === void 0) return void 0;
+	return {
+		template,
+		parameterInput: parameters.parameterInput,
+		conditions,
+		childTemplate: this.fingerprintChildTemplates,
+		resolve: async (node) => {
+			const { attributeHealer: _healer, ...base } = this.buildResolverContext({
+				template,
+				resources,
+				parameters: parameters.bound,
+				...conditions && { conditions }
+			}, stackName);
+			const context = {
+				...base,
+				recordedImports: [],
+				recordedOutputReads: [],
+				bestEffort: true,
+				skipDynamicReferences: true,
+				staleAttributeHeal: { phase: "probe" }
+			};
+			const value = await this.resolver.resolve(structuredClone(node), context);
+			const secrets = context.recordedSecretValues;
+			const target = getAttTargetOf(node);
+			const targetSecrets = target === void 0 ? void 0 : this.perResourceSecrets.get(target);
+			if (targetSecrets !== void 0 && hasMaskableValues(targetSecrets)) {
+				const probe = { value };
+				const redacted = redactSecretsForState(probe, targetSecrets);
+				if (JSON.stringify(redacted) !== JSON.stringify(probe)) return {
+					value,
+					keepAsWritten: true
+				};
+			}
+			return {
+				value,
+				...secrets && { secrets }
+			};
+		}
+	};
+}
 
 //#endregion
 //#region src/deployment/label-routing.ts
@@ -34936,6 +36273,9 @@ var DeployEngine = class {
 	perResourceTemplateProps = /* @__PURE__ */ new Map();
 	perResourceResolvedType = /* @__PURE__ */ new Map();
 	fingerprintNoEchoValues = void 0;
+	fingerprintParameters = void 0;
+	fingerprintChildTemplates = void 0;
+	perResourceInputFingerprints = /* @__PURE__ */ new Map();
 	outputSecrets = /* @__PURE__ */ new Map();
 	outputsPassSecretMaps = [];
 	outputsTemplateSource = Object.create(null);
@@ -34984,6 +36324,9 @@ var DeployEngine = class {
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
 		this.perResourceResolvedType = /* @__PURE__ */ new Map();
 		this.fingerprintNoEchoValues = void 0;
+		this.fingerprintParameters = void 0;
+		this.fingerprintChildTemplates = void 0;
+		this.perResourceInputFingerprints = /* @__PURE__ */ new Map();
 		this.attemptedResolvedProps = /* @__PURE__ */ new Map();
 		this.liveTaskLabels = /* @__PURE__ */ new Map();
 		this.outputSecrets = /* @__PURE__ */ new Map();
@@ -35011,14 +36354,14 @@ var DeployEngine = class {
 			const secrets = this.perResourceSecrets.get(logicalId);
 			const templateProps = this.perResourceTemplateProps.get(logicalId);
 			const scrubbed = scrubResourceRecord(this.withHealedAttributes(logicalId, record), secrets ?? /* @__PURE__ */ new Map(), templateProps);
-			resources[logicalId] = withMaskedPropertyFingerprints(scrubbed, record.properties, templateProps, secrets, this.fingerprintNoEchoValues);
+			resources[logicalId] = withMaskedPropertyFingerprints(scrubbed, record.properties, templateProps, secrets, this.fingerprintNoEchoValues, this.perResourceInputFingerprints.get(logicalId));
 		}
 		const orphans = state.orphans?.map((entry) => {
 			const sameResource = this.perResourceResolvedType.get(entry.logicalId) === entry.state.resourceType;
 			const orphanTemplateProps = sameResource ? this.perResourceTemplateProps.get(entry.logicalId) : void 0;
 			return {
 				...entry,
-				state: withMaskedPropertyFingerprints(scrubResourceRecord(entry.state, (sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), orphanTemplateProps), entry.state.properties, orphanTemplateProps, sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0, sameResource ? this.fingerprintNoEchoValues : void 0)
+				state: withMaskedPropertyFingerprints(scrubResourceRecord(entry.state, (sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), orphanTemplateProps), entry.state.properties, orphanTemplateProps, sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0, sameResource ? this.fingerprintNoEchoValues : void 0, sameResource ? this.perResourceInputFingerprints.get(entry.logicalId) : void 0)
 			};
 		});
 		const outputs = this.redactOutputs(state.outputs);
@@ -35134,6 +36477,7 @@ DeployEngine.prototype.recreateDirectionFor = recreateDirectionFor;
 DeployEngine.prototype.peekRoutingForLabel = peekRoutingForLabel;
 DeployEngine.prototype.preparePropertiesForCcApi = preparePropertiesForCcApi;
 DeployEngine.prototype.buildResolverContext = buildResolverContext;
+DeployEngine.prototype.maskedInputSources = maskedInputSources;
 DeployEngine.prototype.doDeployWithPrefetch = doDeployWithPrefetch;
 DeployEngine.prototype.executeDeployment = executeDeployment;
 DeployEngine.prototype.persistStateAfterOutputFailure = persistStateAfterOutputFailure;
@@ -35191,5 +36535,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { nestedChildStackName as $, hasReadableExportSet as $a, requireConfigObject as $i, s3BucketDomainName as $n, resolveAutoAssetStorage as $o, refuseMalformedOrphanRecordsForDestroy as $r, earliestDefined as $t, ECR_AUTO_DELETE_IMAGES_TAG as A, recoverMaskedOutput as Aa, unwrittenCreateOnlyReplacement as Ai, ec2InstanceProtectionSite as An, describeDockerExecFailure as Ao, malformedDriftResourcePropertiesWarning as Ar, renderAssemblyPathEscape as As, redactedDeleteAddressSkip as At, gray as B, STATE_SOURCED_BASELINE_RULES as Ba, WARM_THROUGHPUT_MEMBERS as Bi, regionLessSecretName as Bn, redactedDockerCause as Bo, malformedOrphansWarning as Br, secretBearingStateKeyWarning as Bt, deleteBudgetKey as C, createSecretMasker as Ca, repairMalformedResourcePropertiesForReadOnly as Ci, UNSPECIFIED_SKIP_REASON as Cn, readBootstrapMarkerBody as Co, deployRefusesOrphanRowsReason as Cr, hasOwnKey as Cs, effectiveDeletionPolicy as Ct, INDEX_SETTLE_POLL_INTERVAL_MS as D, markSameGenerationBag as Da, unreadableResourceEntries as Di, isWaitAbandonedError as Dn, buildDockerImage as Do, hasReadableResources as Dr, absoluteAssemblyPathEscape as Ds, REDACTED_DELETE_ADDRESS_SKIP_REASON as Dt, DELETE_INDEX_WAIT_PROCEED_NOTE as E, maskSecretsInText as Ea, unreadableOrphanRecords as Ei, withIndeterminateGuard as En, buildDenyExternalAccessPolicy as Eo, hasReadableOutputs as Er, ownValue as Es, unsupportedFinalSnapshotError as Et, markRefusedBeforeApplying as F, identityKeyFor as Fa, shownType as Fi, DiffCalculator as Fn, getDockerCmd as Fo, malformedLocalResourcesWarning as Fr, extractDeploymentEventError as Ft, namesAnyDeclaredParameter as G, isSingleDynamicReferenceToken as Ga, coerceCfnBoolean as Gi, isIamRoleArn as Gn, stripControlChars as Go, malformedResourcePropertiesWarning as Gr, collectDeclaredOutputNames as Gt, red as H, STATE_SOURCED_READBACK_RULES as Ha, isWarmThroughputDecrease as Hi, assertFlagRoleArn as Hn, runDockerStreaming as Ho, malformedOutputsWarning as Hr, exportNameSecretExposure as Ht, formatResourceLine as I, carriesSecretMask as Ia, MULTI_REGION_RECREATE_BLOCKED_TYPES as Ii, INTRINSIC_KEYS as In, isDockerClientEnvKey as Io, malformedOrphanRecordsRefusalMessage as Ir, WITHHELD_NAME_DISPLAY as It, makeSiblingClaimReader as J, S3StateBackend as Ja, configIntegerRefusal as Ji, applyCallerIdentityCredentials as Jn, Synthesizer as Jo, malformedStateRefusalMessage as Jr, bindingSkippedOutputs as Jt, reachableDivergentParameters as K, LockManager as Ka, coerceCfnInteger as Ki, sendableAssumeRoleCommand as Kn, AssetManifestLoader as Ko, malformedResourcesWarning as Kr, collectPublishedOutputNames as Kt, createReadOnlyAttributeHealerFactory as L, recordMaskOnlyValue as La, isStatefulRecreateTargetForReplace as Li, IntrinsicFunctionResolver as Ln, isMalformedEnvKey as Lo, malformedOrphanRecordsWarning as Lr, displayTextOrWithheld as Lt, hasCdkAutoDeleteTag as M, dynamicReferenceTokens as Ma, NO_CC_HANDLERS_REASON as Mi, observeThenDisableInstanceApiTermination as Mn, dockerSpawnEnvWithSensitive as Mo, malformedExportSourceWarning as Mr, clearBucketRegionCache as Ms, updatePartialReason as Mt, isTruthyCfnBoolean as N, isUncertifiedBaselineMaskPosition as Na, hasNoCloudControlHandlers as Ni, reDisableInstanceApiTermination as Nn, finchSecretArgvRefusal as No, malformedLocalOutputsWarning as Nr, resolveBucketRegion as Ns, DeploymentEventsReader as Nt, deleteTableWithIndexBusyRetry as O, redactSecretsForState as Oa, findActionableSilentDrops as Oi, markWaitAbandoned as On, resolveDockerContextDirectory as Oo, isReadableOrphanRecord as Or, describeFileReadFailure as Os, isRedactedRecordedValue as Ot, getPriorAttempts as P, pathCrossesDottedKey as Pa, findReplacedReadersOfRecreateTargets as Pi, reEnableInstanceApiTermination as Pn, formatDockerLoginError as Po, malformedLocalResourceEntriesWarning as Pr, DeploymentEventsStore as Pt, getNestedRevertRun as Q, exportNamesCarriedFrom as Qa, requireConfigArray as Qi, s3BucketArn as Qn, resolveApp as Qo, refuseMalformedOrphanRecords as Qr, RollbackInlinePolicyWriters as Qt, bold as R, recordMaskOnlyValuesIn as Ra, isStatefulRecreateTargetSync as Ri, classifyReplaySecretRegion as Rn, partitionSensitiveEnv as Ro, malformedOrphanRowsKeptWarning as Rr, exportAliasCollisionScrubWarning as Rt, compensateRemovedDeletionProtection as S, shareLogOnlyValues as Sa, repairMalformedResourceEntriesForReadOnly as Si, unchangedBehindSecretReference as Sn, parseBootstrapMarker as So, UNREADABLE_RESOURCES_MAP_ROW as Sr, defineOwnKey as Ss, createPreDeleteFinalSnapshot as St, resolveDynamoDbDeleteBudgetMs as T, maskSecretsInError as Ta, unpreviewableOrphanRecords as Ti, deleteSkipReason as Tn, validateContainerRepoName as To, hasReadableOrphans as Tr, nullPrototypeRecord as Ts, refusesFinalSnapshot as Tt, yellow as U, TEMPLATE_SOURCED_RULES as Ua, toCfnInteger as Ui, assertSendableRoleArn as Un, warnFinchArgvExposure as Uo, malformedRenderedContainersWarning as Ur, isWholeDynamicReferenceValue as Ut, green as V, STATE_SOURCED_CROSS_GENERATION_RULES as Va, coerceWarmThroughput as Vi, applyRoleArnIfSet as Vn, runDockerForeground as Vo, malformedOutputsRefusalMessage as Vr, secretSafeKeyDisplay as Vt, computeParameterTaint as W, WHOLE_DYNAMIC_REFERENCE_PATTERN as Wa, toFiniteNumber as Wi, explicitRoleArnOrThrow as Wn, escapeRegExp$2 as Wo, malformedResourceEntriesWarning as Wr, noEchoParameterValueSeed as Wt, NESTED_PENDING_PARENT_REASON as X, acceptedCreateOnlyDropsOf as Xa, readConfigString as Xi, envCredentialsAreAssumedRole as Xn, getDefaultStateBucketName as Xo, refuseDivergentRecordRegionForDestroy as Xr, DEFAULT_RESOURCE_WARN_AFTER_MS as Xt, planOrphanAdoption as Y, rebuildClientForBucketRegion as Ya, configStringRefusal as Yi, callerEnvCredentials as Yn, synthesisStatusMessage as Yo, previewableOrphanRecords as Yr, DEFAULT_RESOURCE_TIMEOUT_MS as Yt, dropSettledNestedJournals as Z, describeRegionValueKind as Za, replayWarn as Zi, isSettledInstanceState as Zn, getLegacyStateBucketName as Zo, refuseMalformedNestedChildOutputs as Zr, maskingRetryLogger as Zt, perType as _, literalSplitDelimitersOf as _a, refuseMalformedResourcesForExport as _i, isCustomResourceType as _n, BOOTSTRAP_MARKER_PREFIX as _o, withSharedDrainBudget as _r, canonicalizeRegion as _s, inheritProducerRegions as _t, conditionInputsFrom as a, markAuxiliaryFailure as aa, refuseMalformedResourceAttributesForOrphan as ai, DBPROXY_TAG_OPTIONS as an, orphansAfterRollback as ao, parameterTypeMayLoseSecretIdentity as ar, stateBucketExistenceConfirmed as as, replayFailedOperations as at, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as b, recordLogOnlyParameterValue as ba, repairMalformedOrphansForReadOnly as bi, slowCcOperationTimeoutMs as bn, getBootstrapMarkerKey as bo, STATE_RESOURCES_MALFORMED as br, StageLoadError as bs, buildFinalSnapshotIdentifier as bt, isSecretBearingReferenceString as c, sameLambdaFunctionAddress as ca, refuseMalformedResourceEntriesForDestroy as ci, refuseMalformedDesiredTags as cn, AssetPublisher as co, carriesDynamicReference as cr, CFN_TEMPLATE_BODY_LIMIT as cs, destroyStackRecordsView as ct, makeCanonicalizePropertiesFn as d, liveMatchesUnresolvedTokenFrame as da, refuseMalformedResourceEntriesForOrphan as di, definedAttributes as dn, WorkGraph as do, keepsSecretReferenceToken as dr, findLargeInlineResources as ds, recordAfterRollbackUpdate as dt, requireConfigString as ea, refuseMalformedOrphans as ei, ledgerForStack as en, hasReasonlessBaselineRefusal as eo, s3BucketDualStackDomainName as er, resolveCaptureObservedState as es, revertNestedChildFromJournal as et, withResourceDeadline as f, inheritNestedStackParameterAssociations as fa, refuseMalformedResourcePropertiesForDrift as fi, stringifyIfAssigned as fn, buildAssetRedirectMap as fo, AWS_NO_VALUE as fr, uploadCfnTemplate as fs, planFailedOps as ft, isProtectionValueActive as g, hasMaskableValues as ga, refuseMalformedResourcesForDestroy as gi, wouldReturnToSdkProvider as gn, AssetModeResolver as go, parseWebACLArn as gr, PARTITION_TABLE as gs, getCurrentProducerRegions as gt, PROTECTION_PROPERTY_BY_TYPE as h, createUnionSecretMasker as ha, refuseMalformedResourcesForDeploy as hi, ccBrokenReason as hn, rewriteTemplateAssetReferences as ho, refStateLookupFromResource as hr, expectedOwnerParam as hs, findNestedStackTypeChanges as ht, conditionFingerprint as i, withRetry as ia, refuseMalformedOutputsForDestroy as ii, DBPROXY_TAGS_WHAT as in, isReadableBag as io, isUnboundTemplateParameter as ir, resolveUseCdkBootstrapAssets as is, withNestedStackContext as it, S3_AUTO_DELETE_OBJECTS_TAG as j, DYNAMIC_REFERENCE_TOKEN_SCAN as ja, withoutSilentDropProperties as ji, isTerminationProtectionPropagationError as jn, describeDockerFailure as jo, malformedExportNamesWarning as jr, resolveAssemblyPath as js, updatePartialMessage as jt, waitForIndexesSettled as k, scrubResourceRecord as ka, findSilentDropProperties as ki, disableInstanceApiTermination as kn, describeDockerCapturedOutput as ko, isReadableResourceEntry as kr, displayAssemblyPath as ks, redactedDeleteAddressFields as kt, keptWholeReasonText as l, DagBuilder as la, refuseMalformedResourceEntriesForImport as li, tagMapAsList as ln, isSensitiveAttributeName as lo, carriesFetchableDynamicReference as lr, CFN_TEMPLATE_URL_LIMIT as ls, getStackRecords as lt, recordedProtectionNote as m, carryLogOnlyValues as ma, refuseMalformedResourcePropertiesForOrphan as mi, ProviderRegistry as mn, loadPublishableAssetManifest as mo, isStalePlaceholderArnAttribute as mr, decodeListingKey as ms, resolveReplacementOldType as mt, IMPLICIT_DELETE_DEPENDENCIES as n, templateResourceTypes as na, refuseMalformedOrphansForOrphan as ni, withCreateTokenLedger as nn, importableOutputKeys as no, s3BucketWebsiteUrl as nr, resolveStateBucketWithDefault as ns, withNestedRevertRun as nt, parentSuppliedValues as o, canonicalLambdaFunctionName as oa, refuseMalformedResourceEntries as oi, planTagDiff as on, orphansCarriedFrom as oo, getAccountInfo as or, warnDeprecatedNoPrefixCliFlag as os, replayRollback as ot, recordedProtectionEvidence as p, recordNestedStackParameterExpressions as pa, refuseMalformedResourcePropertiesForExport as pi, CC_BROKEN_REASON as pn, createAssetRedirectResolver as po, cfnRefValueFromPhysicalId as pr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ps, planRollback as pt, resourcesNamingDeclaredParameter as q, isLockInfoExpired as qa, configBooleanRefusal as qi, AWS_CREDENTIAL_ENV_KEYS as qn, getDockerImageBySourceHash as qo, malformedScrubResourceEntriesRefusalMessage as qr, isExportAliasCollision as qt, computeImplicitDeleteEdges as r, describeTypeWithThrottleRetry as ra, refuseMalformedOutputs as ri, acquireIdempotencyToken as rn, importableOutputs as ro, coerceParameterTypedValue as rr, resolveStateBucketWithDefaultAndSource as rs, getCurrentNestedStackContext as rt, readRecordedConditionVerdicts as s, lambdaFunctionNameForMask as sa, refuseMalformedResourceEntriesForDeploy as si, readTagList as sn, shouldRetainResource as so, isImpossibleEmptyStoredAttribute as sr, ssmResolvedValueType as ss, awaitInFlightSibling as st, DeployEngine as t, prefetchCreateOnlyPropertyPaths as ta, refuseMalformedOrphansForDestroy as ti, reserveStackCreateToken as tn, hasUnverifiableParameterRefusal as to, s3BucketRegionalDomainName as tr, resolveSkipPrefix as ts, revertedNestedRowIds as tt, mergeNoChangeOutputs as u, TemplateParser as ua, refuseMalformedResourceEntriesForImportSave as ui, tagPlanWarning as un, stringifyValue as uo, isNamelessDynamicReferenceError as ur, MIGRATE_TMP_PREFIX as us, withStackRecords as ut, readProtection as v, logOnlyValueCount as va, refuseMalformedState as vi, getCurrentResourceSecrets as vn, assertAssetBucketRegion as vo, JSON_LISTING_HOLE_VALUE as vr, derivePartitionAndUrlSuffix as vs, ATOMIC_FINAL_SNAPSHOT_TYPES as vt, resolveDynamoDbDeleteBudgetClock as w, errorCauseChain as wa, repairMalformedResourcesForReadOnly as wi, deleteIndeterminateGuards as wn, validateAssetBucketName as wo, displayLogicalId as wr, hasPlainPrototype$1 as ws, isFinalSnapshotError as wt, beginDeleteWait as x, recordLogOnlyValue as xa, repairMalformedOutputsForReadOnly as xi, ccProtectionRegistryTypes as xn, isCrossRegionRedirect as xo, UNREADABLE_ORPHANS_CONTAINER_ROW as xr, processStackMessages as xs, ccRoutedFinalSnapshotError as xt, DynamoDBGlobalTableProvider as y, printingCorpusOf as ya, repairMalformedOrphanRecordsForReadOnly as yi, CloudControlProvider as yn, ensureAssetStorage as yo, STATE_REGION_DIVERGED as yr, AssemblyReader as ys, PRE_DELETE_SNAPSHOT_TYPES as yt, cyan as z, recordNoEchoAttributeValues as za, renderStatefulReason as zi, producerRegionsFromState as zn, redactDockerArgvValues as zo, malformedOrphansRefusalMessage as zr, secretBearing as zt };
-//# sourceMappingURL=deploy-engine-RCOtmm4V.js.map
+export { resourcesNamingDeclaredParameter as $, STATE_SOURCED_READBACK_RULES as $a, isWarmThroughputDecrease as $i, explicitRoleArnOrThrow as $n, runDockerForeground as $o, malformedOutputsWarning as $r, noEchoParameterValueSeed as $t, resolveDynamoDbDeleteBudgetClock as A, printingCorpusOf as Aa, repairMalformedOrphanRecordsForReadOnly as Ai, ccProtectionRegistryTypes as An, assertAssetBucketRegion as Ao, STATE_REGION_DIVERGED as Ar, derivePartitionAndUrlSuffix as As, ccRoutedFinalSnapshotError as At, getPriorAttempts as B, scrubResourceRecord as Ba, findSilentDropProperties as Bi, isTerminationProtectionPropagationError as Bn, resolveDockerContextDirectory as Bo, isReadableResourceEntry as Br, describeFileReadFailure as Bs, updatePartialMessage as Bt, perType as C, inheritNestedStackParameterAssociations as Ca, refuseMalformedResourcePropertiesForDrift as Ci, ProviderRegistry as Cn, WorkGraph as Co, isStalePlaceholderArnAttribute as Cr, findLargeInlineResources as Cs, resolveReplacementOldType as Ct, beginDeleteWait as D, hasMaskableValues as Da, refuseMalformedResourcesForDestroy as Di, getCurrentResourceSecrets as Dn, rewriteTemplateAssetReferences as Do, parameterInputsFor as Dr, expectedOwnerParam as Ds, ATOMIC_FINAL_SNAPSHOT_TYPES as Dt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as E, createUnionSecretMasker as Ea, refuseMalformedResourcesForDeploy as Ei, isCustomResourceType as En, loadPublishableAssetManifest as Eo, withSharedDrainBudget as Er, decodeListingKey as Es, inheritProducerRegions as Et, waitForIndexesSettled as F, errorCauseChain as Fa, repairMalformedResourcesForReadOnly as Fi, withIndeterminateGuard as Fn, readBootstrapMarkerBody as Fo, displayLogicalId as Fr, hasOwnKey as Fs, unsupportedFinalSnapshotError as Ft, cyan as G, pathCrossesDottedKey as Ga, findReplacedReadersOfRecreateTargets as Gi, INTRINSIC_KEYS as Gn, finchSecretArgvRefusal as Go, malformedLocalResourceEntriesWarning as Gr, resolveBucketRegion as Gs, WITHHELD_NAME_DISPLAY as Gt, formatResourceLine as H, DYNAMIC_REFERENCE_TOKEN_SCAN as Ha, withoutSilentDropProperties as Hi, reDisableInstanceApiTermination as Hn, describeDockerExecFailure as Ho, malformedExportNamesWarning as Hr, renderAssemblyPathEscape as Hs, DeploymentEventsReader as Ht, ECR_AUTO_DELETE_IMAGES_TAG as I, maskSecretsInError as Ia, unpreviewableOrphanRecords as Ii, isWaitAbandonedError as In, validateAssetBucketName as Io, hasReadableOrphans as Ir, hasPlainPrototype$1 as Is, REDACTED_DELETE_ADDRESS_SKIP_REASON as It, red as J, recordMaskOnlyValue as Ja, isStatefulRecreateTargetForReplace as Ji, producerRegionsFromState as Jn, isDockerClientEnvKey as Jo, malformedOrphanRecordsWarning as Jr, secretBearing as Jt, gray as K, identityKeyFor as Ka, shownType as Ki, IntrinsicFunctionResolver as Kn, formatDockerLoginError as Ko, malformedLocalResourcesWarning as Kr, displayTextOrWithheld as Kt, S3_AUTO_DELETE_OBJECTS_TAG as L, maskSecretsInText as La, unreadableOrphanRecords as Li, markWaitAbandoned as Ln, validateContainerRepoName as Lo, hasReadableOutputs as Lr, nullPrototypeRecord as Ls, isRedactedRecordedValue as Lt, DELETE_INDEX_WAIT_PROCEED_NOTE as M, recordLogOnlyValue as Ma, repairMalformedOutputsForReadOnly as Mi, UNSPECIFIED_SKIP_REASON as Mn, getBootstrapMarkerKey as Mo, UNREADABLE_ORPHANS_CONTAINER_ROW as Mr, StageLoadError as Ms, effectiveDeletionPolicy as Mt, INDEX_SETTLE_POLL_INTERVAL_MS as N, shareLogOnlyValues as Na, repairMalformedResourceEntriesForReadOnly as Ni, deleteIndeterminateGuards as Nn, isCrossRegionRedirect as No, UNREADABLE_RESOURCES_MAP_ROW as Nr, processStackMessages as Ns, isFinalSnapshotError as Nt, compensateRemovedDeletionProtection as O, literalSplitDelimitersOf as Oa, refuseMalformedResourcesForExport as Oi, CloudControlProvider as On, AssetModeResolver as Oo, passedParameterClassesOf as Or, PARTITION_TABLE as Os, PRE_DELETE_SNAPSHOT_TYPES as Ot, deleteTableWithIndexBusyRetry as P, createSecretMasker as Pa, repairMalformedResourcePropertiesForReadOnly as Pi, deleteSkipReason as Pn, parseBootstrapMarker as Po, deployRefusesOrphanRowsReason as Pr, defineOwnKey as Ps, refusesFinalSnapshot as Pt, reachableDivergentParameters as Q, STATE_SOURCED_CROSS_GENERATION_RULES as Qa, coerceWarmThroughput as Qi, assertSendableRoleArn as Qn, redactedDockerCause as Qo, malformedOutputsRefusalMessage as Qr, isWholeDynamicReferenceValue as Qt, hasCdkAutoDeleteTag as R, markSameGenerationBag as Ra, unreadableResourceEntries as Ri, disableInstanceApiTermination as Rn, buildDenyExternalAccessPolicy as Ro, hasReadableResources as Rr, ownValue as Rs, redactedDeleteAddressFields as Rt, isProtectionValueActive as S, liveMatchesUnresolvedTokenFrame as Sa, refuseMalformedResourceEntriesForOrphan as Si, CC_BROKEN_REASON as Sn, stringifyValue as So, cfnRefValueFromPhysicalId as Sr, MIGRATE_TMP_PREFIX as Ss, planRollback as St, DynamoDBGlobalTableProvider as T, carryLogOnlyValues as Ta, refuseMalformedResourcePropertiesForOrphan as Ti, wouldReturnToSdkProvider as Tn, createAssetRedirectResolver as To, parseWebACLArn as Tr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ts, getCurrentProducerRegions as Tt, createReadOnlyAttributeHealerFactory as U, dynamicReferenceTokens as Ua, NO_CC_HANDLERS_REASON as Ui, reEnableInstanceApiTermination as Un, describeDockerFailure as Uo, malformedExportSourceWarning as Ur, resolveAssemblyPath as Us, DeploymentEventsStore as Ut, markRefusedBeforeApplying as V, recoverMaskedOutput as Va, unwrittenCreateOnlyReplacement as Vi, observeThenDisableInstanceApiTermination as Vn, describeDockerCapturedOutput as Vo, malformedDriftResourcePropertiesWarning as Vr, displayAssemblyPath as Vs, updatePartialReason as Vt, bold as W, isUncertifiedBaselineMaskPosition as Wa, hasNoCloudControlHandlers as Wi, DiffCalculator as Wn, dockerSpawnEnvWithSensitive as Wo, malformedLocalOutputsWarning as Wr, clearBucketRegionCache as Ws, extractDeploymentEventError as Wt, computeParameterTaint as X, recordNoEchoAttributeValues as Xa, renderStatefulReason as Xi, applyRoleArnIfSet as Xn, partitionSensitiveEnv as Xo, malformedOrphansRefusalMessage as Xr, secretSafeKeyDisplay as Xt, yellow as Y, recordMaskOnlyValuesIn as Ya, isStatefulRecreateTargetSync as Yi, regionLessSecretName as Yn, isMalformedEnvKey as Yo, malformedOrphanRowsKeptWarning as Yr, secretBearingStateKeyWarning as Yt, namesAnyDeclaredParameter as Z, STATE_SOURCED_BASELINE_RULES as Za, WARM_THROUGHPUT_MEMBERS as Zi, assertFlagRoleArn as Zn, redactDockerArgvValues as Zo, malformedOrphansWarning as Zr, exportNameSecretExposure as Zt, makeCanonicalizePropertiesFn as _, canonicalLambdaFunctionName as _a, refuseMalformedResourceEntries as _i, refuseMalformedDesiredTags as _n, orphansAfterRollback as _o, carriesDynamicReference as _r, stateBucketExistenceConfirmed as _s, destroyStackRecordsView as _t, findNestedTemplateTreeDefect as a, configIntegerRefusal as aa, malformedStateRefusalMessage as ai, DEFAULT_RESOURCE_WARN_AFTER_MS as an, S3StateBackend as ao, envCredentialsAreAssumedRole as ar, getDockerImageBySourceHash as as, dropSettledNestedJournals as at, recordedProtectionNote as b, DagBuilder as ba, refuseMalformedResourceEntriesForImport as bi, definedAttributes as bn, AssetPublisher as bo, keepsSecretReferenceToken as br, CFN_TEMPLATE_BODY_LIMIT as bs, recordAfterRollbackUpdate as bt, renderNestedTemplateTreeDefect as c, replayWarn as ca, refuseMalformedNestedChildOutputs as ci, earliestDefined as cn, acceptedCreateOnlyDropsOf as co, s3BucketDomainName as cr, getDefaultStateBucketName as cs, recordDisplacedSkips as ct, conditionInputsFrom as d, requireConfigString as da, refuseMalformedOrphans as di, withCreateTokenLedger as dn, hasReadableExportSet as do, s3BucketWebsiteUrl as dr, resolveAutoAssetStorage as ds, withNestedRevertRun as dt, toCfnInteger as ea, malformedRenderedContainersWarning as ei, collectDeclaredOutputNames as en, TEMPLATE_SOURCED_RULES as eo, isIamRoleArn as er, runDockerStreaming as es, makeSiblingClaimReader as et, parentSuppliedValues as f, prefetchCreateOnlyPropertyPaths as fa, refuseMalformedOrphansForDestroy as fi, acquireIdempotencyToken as fn, hasReasonlessBaselineRefusal as fo, coerceParameterTypedValue as fr, resolveCaptureObservedState as fs, getCurrentNestedStackContext as ft, mergeNoChangeOutputs as g, markAuxiliaryFailure as ga, refuseMalformedResourceAttributesForOrphan as gi, readTagList as gn, isReadableBag as go, isImpossibleEmptyStoredAttribute as gr, resolveUseCdkBootstrapAssets as gs, awaitInFlightSibling as gt, keptWholeReasonText as h, withRetry as ha, refuseMalformedOutputsForDestroy as hi, planTagDiff as hn, importableOutputs as ho, getAccountInfo as hr, resolveStateBucketWithDefaultAndSource as hs, replayRollback as ht, childTemplateLoader as i, configBooleanRefusal as ia, malformedScrubResourceEntriesRefusalMessage as ii, DEFAULT_RESOURCE_TIMEOUT_MS as in, isLockInfoExpired as io, callerEnvCredentials as ir, AssetManifestLoader as is, displacedPhysicalIdShown as it, resolveDynamoDbDeleteBudgetMs as j, recordLogOnlyParameterValue as ja, repairMalformedOrphansForReadOnly as ji, unchangedBehindSecretReference as jn, ensureAssetStorage as jo, STATE_RESOURCES_MALFORMED as jr, AssemblyReader as js, createPreDeleteFinalSnapshot as jt, deleteBudgetKey as k, logOnlyValueCount as ka, refuseMalformedState as ki, slowCcOperationTimeoutMs as kn, BOOTSTRAP_MARKER_PREFIX as ko, JSON_LISTING_HOLE_VALUE as kr, canonicalizeRegion as ks, buildFinalSnapshotIdentifier as kt, templateIdentity as l, requireConfigArray as la, refuseMalformedOrphanRecords as li, ledgerForStack as ln, describeRegionValueKind as lo, s3BucketDualStackDomainName as lr, getLegacyStateBucketName as ls, revertNestedChildFromJournal as lt, isSecretBearingReferenceString as m, describeTypeWithThrottleRetry as ma, refuseMalformedOutputs as mi, DBPROXY_TAG_OPTIONS as mn, importableOutputKeys as mo, parameterTypeMayLoseSecretIdentity as mr, resolveStateBucketWithDefault as ms, replayFailedOperations as mt, IMPLICIT_DELETE_DEPENDENCIES as n, coerceCfnBoolean as na, malformedResourcePropertiesWarning as ni, isExportAliasCollision as nn, isSingleDynamicReferenceToken as no, AWS_CREDENTIAL_ENV_KEYS as nr, escapeRegExp$2 as ns, NESTED_PENDING_PARENT_REASON as nt, isAbsoluteAssetPath as o, configStringRefusal as oa, previewableOrphanRecords as oi, maskingRetryLogger as on, rebuildClientForBucketRegion as oo, isSettledInstanceState as or, Synthesizer as os, getNestedRevertRun as ot, readRecordedConditionVerdicts as p, templateResourceTypes as pa, refuseMalformedOrphansForOrphan as pi, DBPROXY_TAGS_WHAT as pn, hasUnverifiableParameterRefusal as po, isUnboundTemplateParameter as pr, resolveSkipPrefix as ps, withNestedStackContext as pt, green as q, carriesSecretMask as qa, MULTI_REGION_RECREATE_BLOCKED_TYPES as qi, classifyReplaySecretRegion as qn, getDockerCmd as qo, malformedOrphanRecordsRefusalMessage as qr, exportAliasCollisionScrubWarning as qt, computeImplicitDeleteEdges as r, coerceCfnInteger as ra, malformedResourcesWarning as ri, bindingSkippedOutputs as rn, LockManager as ro, applyCallerIdentityCredentials as rr, stripControlChars as rs, displacedOpClause as rt, listNestedTemplateRows as s, readConfigString as sa, refuseDivergentRecordRegionForDestroy as si, RollbackInlinePolicyWriters as sn, splitImportedOps as so, s3BucketArn as sr, synthesisStatusMessage as ss, nestedChildStackName as st, DeployEngine as t, toFiniteNumber as ta, malformedResourceEntriesWarning as ti, collectPublishedOutputNames as tn, WHOLE_DYNAMIC_REFERENCE_PATTERN as to, sendableAssumeRoleCommand as tr, warnFinchArgvExposure as ts, planOrphanAdoption as tt, conditionFingerprint as u, requireConfigObject as ua, refuseMalformedOrphanRecordsForDestroy as ui, reserveStackCreateToken as un, exportNamesCarriedFrom as uo, s3BucketRegionalDomainName as ur, resolveApp as us, revertedNestedRowIds as ut, withResourceDeadline as v, lambdaFunctionNameForMask as va, refuseMalformedResourceEntriesForDeploy as vi, tagMapAsList as vn, orphansCarriedFrom as vo, carriesFetchableDynamicReference as vr, warnDeprecatedNoPrefixCliFlag as vs, getStackRecords as vt, readProtection as w, recordNestedStackParameterExpressions as wa, refuseMalformedResourcePropertiesForExport as wi, ccBrokenReason as wn, buildAssetRedirectMap as wo, refStateLookupFromResource as wr, uploadCfnTemplate as ws, findNestedStackTypeChanges as wt, PROTECTION_PROPERTY_BY_TYPE as x, TemplateParser as xa, refuseMalformedResourceEntriesForImportSave as xi, stringifyIfAssigned as xn, isSensitiveAttributeName as xo, AWS_NO_VALUE as xr, CFN_TEMPLATE_URL_LIMIT as xs, planFailedOps as xt, recordedProtectionEvidence as y, sameLambdaFunctionAddress as ya, refuseMalformedResourceEntriesForDestroy as yi, tagPlanWarning as yn, shouldRetainResource as yo, isNamelessDynamicReferenceError as yr, ssmResolvedValueType as ys, withStackRecords as yt, isTruthyCfnBoolean as z, redactSecretsForState as za, findActionableSilentDrops as zi, ec2InstanceProtectionSite as zn, buildDockerImage as zo, isReadableOrphanRecord as zr, absoluteAssemblyPathEscape as zs, redactedDeleteAddressSkip as zt };
+//# sourceMappingURL=deploy-engine-C35Ctso3.js.map