@go-to-k/cdkd 0.294.11 → 0.294.13

package/dist/{deploy-engine-CMRU0DTu.js → deploy-engine-BiA8Ud6-.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js"
 import { A as displaySafe, E as UNRENDERABLE, F as safeMsg, L as truncateCodePoints, M as isPasteableIdent, O as displayAwsMessage, P as plainIdentOr, S as withoutGeneratedFallbackName, T as STACK_REF_MAX_CODE_POINTS, _ as getCurrentSkipPrefix, b as withSkipPrefix, c as getLiveRenderer, f as applyDefaultNameForFallback, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, m as explicitNamePropertyFor, n as getLogger, r as isStdoutReservedForPayload, s as installLogLineMaskerSource, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS, x as withStackName, y as looksLikeCdkdGeneratedName } from "./logger-B46YMG0h.js";
 import { $t as StateError, A as isTerminalDeleteFailure, An as isAmbiguousCcHandlerErrorCode, At as clientDefaultsFor, Bn as isMarkedNonRetryable, Bt as IntrinsicResolutionRefusalError, C as refusalTypeShown, Cn as isNameCollisionErrorFrom, D as ProtectionFlipRegistry, Dt as withPasteableAwsProfile, En as isReplayedNameCollisionFrom, Fn as retryClassificationText, Gt as MalformedProducerRecordRefusalError, H as pasteableAwsCommand, Hn as markNonRetryable, In as describeAwsFailure, It as CrossAccountSecretRefusalError, J as isInterruptedWaitError, Jt as ProvisioningError, Lt as DependencyError, M as observeThenDisableProtection, Mn as isIamPropagationError, Mt as AccountIdUnavailableError, N as protectionFlipKey, Nn as isRetryableTransientError, Nt as AssetError, O as compensateProtectionFlip, On as markReplayMayCollide, Ot as ambientClientDefaults, Pn as isTransientServerError, Pt as CdkdError, Q as canonicalizeRoute53QueryName, R as DELETION_PROTECTION_DOC_POINTER, Rn as safeStringify$1, S as quotedRemedyLogicalId, Sn as hasReplayMayCollide, St as injectiveKey, T as resolveExplicitPhysicalId, Tn as isRecreateRetryableError, Tt as producerRecordKey, U as protectedReplacementAdvice, Un as markRedactedCause, Ut as LockError, Vn as isThrottlingError, Wn as wrapMaskedAwsError, Wt as MacroExpansionError, X as ElapsedBudgetRegistry, Xt as ResourceUpdateNotSupportedError, Y as startInterruptWatch, Yt as ResourceTimeoutError, Z as monotonicNowMs, _n as shellQuote, _t as formatLockOperation, at as segmentAfterAnchor, b as isQuotableImportValue, bt as CUSTOM_RESOURCE_RESPONSE_PREFIX, cn as UNSHOWABLE_VALUE, ct as isSecretDerivedValue, d as prepareRemovalForUpdate, dn as isInertUnquoted, dt as withDerivedNameMasks, en as SynthesisError, et as compositeIdSeparatorRefusal, f as removalWarning, fn as pasteableCommand, ft as UNREPRODUCIBLE_LOCK_CLAUSE, g as assertRegionMatch, gn as shellBoundedDisplay, gt as formatLockExpiry, h as RESOURCE_NOT_FOUND, hn as quotedOrDescribed, i as holdsSecretDerivedEntry, it as resourceTypeShown, jn as isAmbiguousOutcomeError, jt as credentialFingerprint, k as deleteWithProtectionCompensation, kn as formatRetryClassificationSignals, kt as ambientCredentialConfig, l as withUnchangedSecretPrincipalLists, ln as commandHole, lt as maskDeep, m as withoutInjectedRemovals, mn as plainOrDescribed, nt as logicalIdShown, on as SHELL_ACTIVE, ot as createMaskedLogSinks, pn as physicalIdShownBesideCommand, pt as buildForceUnlockCommand, rn as normalizeAwsError, sn as SHELL_ACTIVE_WHY, st as createMaskedRetryLogger, ut as maskerOrIdentity, vn as withheldTargetClause, vt as formatLockOwner, wn as isNameCooldownError, x as normalizeAwsTagsToCfn, xn as isUpdateUnsupportedError, xt as DEFAULT_STATE_PREFIX, yt as sanitizeRecoveryValue, zt as DynamicReferenceRegionAmbiguousError } from "./iam-policy-targets-CMSQGQnm.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-DIQcU8CA.js";
+import { t as getCdkdVersion } from "./version-CKLiAWMw.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1675,21 +1675,56 @@ function recordFailure(failed, key, reason) {
 	else failed.set(key, [reason]);
 }
 const describe$1 = (error) => error instanceof Error ? error.message : String(error);
+const PREFIX_HANDLE_SUFFIX = "* (every key under this prefix)";
+async function purgeNoncurrentVersionsUnderPrefix(s3Client, bucket, prefix, options = {}) {
+	const logger = options.logger ?? getLogger().child("s3-version-purge");
+	if (!prefix.endsWith("/") || prefix.replace(/\/+/g, "") === "") {
+		logger.warn(safeMsg`Refused to purge noncurrent versions under ${JSON.stringify(prefix)}: ` + `a prefix-wide purge needs a non-empty prefix ending in '/'. Nothing was purged.`);
+		return {
+			deletedBodies: 0,
+			complete: false
+		};
+	}
+	const handle = `${prefix}${PREFIX_HANDLE_SUFFIX}`;
+	return purgeWalk(s3Client, bucket, [prefix], {
+		scope: {
+			covers: (key) => key.startsWith(prefix),
+			unsettledUnder: () => [handle],
+			ownsEveryListedKey: true
+		},
+		listingFailureHandles: () => [handle],
+		options: {
+			...options,
+			logger
+		}
+	});
+}
 async function purgeNoncurrentKeyVersions(s3Client, bucket, keys, options = {}) {
 	if (keys.length === 0) return;
+	const wanted = new Set(keys);
+	await purgeWalk(s3Client, bucket, options.listPrefix !== void 0 ? [options.listPrefix] : keys, {
+		scope: {
+			covers: (key) => wanted.has(key),
+			unsettledUnder: (prefix) => [...wanted].filter((key) => key.startsWith(prefix)),
+			ownsEveryListedKey: false
+		},
+		listingFailureHandles: (prefix) => options.listPrefix !== void 0 ? [...keys] : [prefix],
+		options
+	});
+}
+async function purgeWalk(s3Client, bucket, prefixes, params) {
+	const { scope, listingFailureHandles, options } = params;
 	const logger = options.logger ?? getLogger().child("s3-version-purge");
 	const requestFields = options.requestFields ?? {};
-	const wanted = new Set(keys);
-	const prefixes = options.listPrefix !== void 0 ? [options.listPrefix] : keys;
 	const failed = /* @__PURE__ */ new Map();
 	const unknown = { n: 0 };
 	const purged = /* @__PURE__ */ new Set();
 	const unsettledBodies = /* @__PURE__ */ new Set();
+	const removed = { n: 0 };
 	for (const prefix of prefixes) try {
-		await purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields, failed, unknown, purged, unsettledBodies);
+		await purgeUnderPrefix(s3Client, bucket, prefix, scope, requestFields, failed, unknown, purged, unsettledBodies, removed);
 	} catch (error) {
-		const affected = options.listPrefix !== void 0 ? keys : [prefix];
-		for (const key of affected) {
+		for (const key of listingFailureHandles(prefix)) {
 			recordFailure(failed, key, describe$1(error));
 			unsettledBodies.add(key);
 		}
@@ -1697,7 +1732,10 @@ async function purgeNoncurrentKeyVersions(s3Client, bucket, keys, options = {})
 	if (failed.size > 0) {
 		const named = [...failed.entries()].slice(0, MAX_NAMED_FAILURES).map(([key, reasons]) => displaySafe(`${key} (${reasons.join("; ")})`));
 		const elided = failed.size - named.length;
-		logger.warn(`Could not purge noncurrent versions of ${failed.size} key(s) in s3://${displaySafe(bucket, { asciiOnly: true })}. Their previous versions survive and remain readable via GetObject with a VersionId (${options.objectDescription ?? "the body of an object cdkd has just reported as removed"}). Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key(s) by hand. Failures: ${named.join(", ")}` + (elided > 0 ? ` (and ${elided} more)` : ""));
+		const prefixCount = [...failed.keys()].filter((k) => k.endsWith(PREFIX_HANDLE_SUFFIX)).length;
+		const keyCount = failed.size - prefixCount;
+		const subject = [keyCount > 0 ? `${keyCount} key(s)` : "", prefixCount > 0 ? `every key under ${prefixCount} prefix(es)` : ""].filter((part) => part !== "").join(" and ");
+		logger.warn(`Could not purge noncurrent versions of ${subject} in s3://${displaySafe(bucket, { asciiOnly: true })}. Their previous versions survive and remain readable via GetObject with a VersionId (${options.objectDescription ?? "the body of an object cdkd has just reported as removed"}). Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key(s) by hand. Failures: ${named.join(", ")}` + (elided > 0 ? ` (and ${elided} more)` : ""));
 	}
 	const replicationKeys = [.../* @__PURE__ */ new Set([...purged, ...unsettledBodies])];
 	await warnIfPurgeIsReplicated(s3Client, bucket, replicationKeys, {
@@ -1705,8 +1743,12 @@ async function purgeNoncurrentKeyVersions(s3Client, bucket, keys, options = {})
 		logger,
 		...options.objectDescription !== void 0 && { objectDescription: options.objectDescription }
 	});
+	return {
+		deletedBodies: removed.n,
+		complete: failed.size === 0
+	};
 }
-async function purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields, failed, unknown, purged, unsettledBodies) {
+async function purgeUnderPrefix(s3Client, bucket, prefix, scope, requestFields, failed, unknown, purged, unsettledBodies, removed) {
 	let keyMarker;
 	let versionIdMarker;
 	do {
@@ -1719,6 +1761,8 @@ async function purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields,
 			...versionIdMarker !== void 0 && { VersionIdMarker: versionIdMarker }
 		}));
 		const stale = [];
+		const staleBodies = /* @__PURE__ */ new Map();
+		const isStaleBody = (key, versionId) => key !== void 0 && versionId !== void 0 && staleBodies.get(key)?.has(versionId) === true;
 		const entries = [...(resp.Versions ?? []).map((entry) => ({
 			entry,
 			hasBody: true
@@ -1732,9 +1776,10 @@ async function purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields,
 				decodedKey = decodeListingKey(entry.Key);
 			} catch {
 				if (hasBody && entry.Key !== void 0) unsettledBodies.add(`${entry.Key} [key not decodable; shown as S3 returned it]`);
+				if (scope.ownsEveryListedKey && entry.Key !== void 0 && entry.IsLatest !== true) recordFailure(failed, `${entry.Key} [key not decodable; shown as S3 returned it]`, `version ${entry.VersionId ?? "<unknown>"}: listing key could not be decoded, so the entry was left alone`);
 				continue;
 			}
-			if (decodedKey === void 0 || !wanted.has(decodedKey)) continue;
+			if (decodedKey === void 0 || !scope.covers(decodedKey)) continue;
 			if (entry.IsLatest === void 0) {
 				recordFailure(failed, decodedKey, `version ${entry.VersionId ?? "<unknown>"}: listing omitted IsLatest, so the entry was left alone rather than risk deleting a current version`);
 				if (hasBody) unsettledBodies.add(decodedKey);
@@ -1749,6 +1794,11 @@ async function purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields,
 				Key: decodedKey,
 				VersionId: entry.VersionId
 			});
+			if (hasBody) {
+				const ids = staleBodies.get(decodedKey) ?? /* @__PURE__ */ new Set();
+				ids.add(entry.VersionId);
+				staleBodies.set(decodedKey, ids);
+			}
 			if (hasBody) purged.add(decodedKey);
 		}
 		for (let i = 0; i < stale.length; i += DELETE_BATCH_SIZE) {
@@ -1762,6 +1812,9 @@ async function purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields,
 						Quiet: true
 					}
 				}));
+				let bodiesRemoved = batch.filter((o) => isStaleBody(o.Key, o.VersionId)).length;
+				for (const err of deleted.Errors ?? []) if (err.Key === void 0 || err.VersionId === void 0 || isStaleBody(err.Key, err.VersionId)) bodiesRemoved -= 1;
+				removed.n += Math.max(0, bodiesRemoved);
 				for (const err of deleted.Errors ?? []) {
 					if (err.Code === "NoSuchVersion") continue;
 					const reason = `version ${err.VersionId ?? "<unknown>"}: ${err.Code ?? "Error"}` + (err.Message ? ` - ${err.Message}` : "");
@@ -1775,11 +1828,9 @@ async function purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields,
 				for (const object of batch) recordFailure(failed, object.Key, describe$1(error));
 			}
 		}
-		if (resp.IsTruncated === true && resp.NextKeyMarker === void 0) {
-			for (const key of wanted) if (key.startsWith(prefix)) {
-				recordFailure(failed, key, TRUNCATED_NO_MARKER);
-				unsettledBodies.add(key);
-			}
+		if (resp.IsTruncated === true && resp.NextKeyMarker === void 0) for (const key of scope.unsettledUnder(prefix)) {
+			recordFailure(failed, key, TRUNCATED_NO_MARKER);
+			unsettledBodies.add(key);
 		}
 		keyMarker = resp.IsTruncated === true ? decodeListingKey(resp.NextKeyMarker) : void 0;
 		versionIdMarker = keyMarker !== void 0 ? resp.NextVersionIdMarker : void 0;
@@ -5322,6 +5373,24 @@ var S3StateBackend = class {
 			this.logger.warn(`Could not purge noncurrent versions of ${keys.length} key(s) in bucket '${this.config.bucket}': the purge could not be started. Their previous versions survive and remain readable via GetObject with a VersionId${describing}. Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key(s) by hand. Underlying error: ${errorDetail$1(error)}`);
 		}
 	}
+	async purgeNoncurrentVersionsUnderPrefix(keyPrefix, options = {}) {
+		try {
+			await this.ensureClientForBucket();
+			return await purgeNoncurrentVersionsUnderPrefix(this.s3Client, this.config.bucket, keyPrefix, {
+				...options,
+				requestFields: await this.ownerParam(),
+				logger: this.logger
+			});
+		} catch (error) {
+			const prefixShown = displayIdent(keyPrefix, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
+			const describing = options.objectDescription ? ` (${options.objectDescription})` : "";
+			this.logger.warn(safeMsg`Could not purge noncurrent versions under the prefix ${prefixShown} in bucket ${this.config.bucket}: the purge could not be started. Their previous versions survive and remain readable via GetObject with a VersionId${describing}. Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the prefix by hand. Underlying error: ${errorDetail$1(error)}`);
+			return {
+				deletedBodies: 0,
+				complete: false
+			};
+		}
+	}
 	async loadCreateTokenLedger(stackName, region) {
 		const body = await this.getRawObject(this.getCreateTokenLedgerKey(stackName, region));
 		if (body === null) return null;
@@ -21828,7 +21897,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CbHiTBaE.js");
+			const { ASGProvider } = await import("./asg-provider-DYk4gHU2.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -21934,7 +22003,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-l9F4Y8YY.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CS-r4Ufj.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-BeG3nAP_.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-BtKWZD6O.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -26713,16 +26782,19 @@ function deploymentsDirPrefix(prefix, stackName, region) {
 	return `${prefix}/${stackName}/${region}/deployments/`;
 }
 const DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION = "deployment-event streams and their index, whose recorded error messages can quote values the secret mask does not catch";
-async function deleteAndPurgeEventObjects(backend, keys, dirPrefix) {
-	if (keys.length === 0) return;
+async function deleteAndPurgeEventObjects(backend, keys, dirPrefix, scope = "deleted-keys") {
+	if (keys.length === 0) return void 0;
+	let swept;
 	try {
 		await backend.deleteRawObjects(keys);
 	} finally {
-		await backend.purgeNoncurrentVersions(keys, {
+		if (scope === "whole-dir") swept = await backend.purgeNoncurrentVersionsUnderPrefix(dirPrefix, { objectDescription: DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION });
+		else await backend.purgeNoncurrentVersions(keys, {
 			...keys.length > 1 && { listPrefix: dirPrefix },
 			objectDescription: DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION
 		});
 	}
+	return swept;
 }
 function runIdTimestampMs(runId) {
 	const m = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})(\d{3})Z/.exec(runId);
@@ -26960,11 +27032,12 @@ var DeploymentEventsReader = class {
 		const indexExisted = keys.includes(indexKey);
 		if (opts.all === true) {
 			const toDelete = runIdsDesc.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
-			await deleteAndPurgeEventObjects(this.backend, [...toDelete, indexKey], dirPrefix);
+			const earlierVersions = await deleteAndPurgeEventObjects(this.backend, [...toDelete, indexKey], dirPrefix, "whole-dir");
 			return {
 				deletedRunIds: runIdsDesc,
 				remainingRunIds: [],
-				indexDeleted: indexExisted
+				indexDeleted: indexExisted,
+				...earlierVersions !== void 0 && { earlierVersions }
 			};
 		}
 		const noGuards = opts.keep === void 0 && opts.olderThanMs === void 0;
@@ -27397,11 +27470,25 @@ const nonEmptyString = (v) => typeof v === "string" && v.length > 0;
 
 //#endregion
 //#region src/deployment/rollback-executor/messages.ts
-function throwIfDeleteSkipped(result, logicalId, physicalId, duringClause) {
+function throwIfDeleteSkipped(result, logicalId, physicalId, duringClause, guardScope) {
+	recordRollbackDeleteGuards(result, logicalId, physicalId, guardScope);
 	const reason = deleteSkipReason(result);
 	if (reason === void 0) return;
 	throw new Error(deleteSkippedMessage(logicalId, physicalId, reason, duringClause));
 }
+function recordRollbackDeleteGuards(result, logicalId, physicalId, scope) {
+	for (const guard of deleteIndeterminateGuards(result)) scope.ctx.recordEvent?.({
+		eventType: "RESOURCE_GUARD_INDETERMINATE",
+		stackName: scope.stackName,
+		operation: "DELETE",
+		logicalId,
+		resourceType: scope.resourceType,
+		...scope.provisionedBy && { provisionedBy: scope.provisionedBy },
+		...physicalId && { physicalId: scope.mask(physicalId) },
+		guard: guard.guard,
+		reason: scope.mask(guard.reason)
+	});
+}
 const SKIP_FINAL_SNAPSHOT_FLAG = "--skip-final-snapshot";
 const REPLAYING_STATE_CREATE_CONTEXT = { replayingState: true };
 function replayingStateCreateContext(secrets) {
@@ -28286,7 +28373,7 @@ async function replayDelete(s) {
 	let finalSnapshotIdentifier;
 	if (takeFinalSnapshot) finalSnapshotIdentifier = await prepareCreateRollbackFinalSnapshot(op, deleteProvisionedBy, ctx, mask);
 	logger.info(`  Rollback: Deleting created resource ${safe(op.logicalId)} (${safe(op.resourceType)})` + (takeFinalSnapshot ? " — DeletionPolicy: Snapshot" : "") + (snapshotPolicy && !takeFinalSnapshot ? " — DeletionPolicy: Snapshot NOT taken (--skip-final-snapshot)" : ""));
-	const { provider } = ctx.providerRegistry.getProviderFor({
+	const { provider, provisionedBy: deleteRoutedVia } = ctx.providerRegistry.getProviderFor({
 		resourceType: op.resourceType,
 		provisionedBy: deleteProvisionedBy
 	});
@@ -28299,7 +28386,13 @@ async function replayDelete(s) {
 		deletionPolicy: snapshotPolicy ? "Snapshot" : "Delete",
 		recordedAttributes: stateResources[op.logicalId]?.attributes
 	});
-	throwIfDeleteSkipped(createRollbackDelete, op.logicalId, op.physicalId, "while rolling back its CREATE");
+	throwIfDeleteSkipped(createRollbackDelete, op.logicalId, op.physicalId, "while rolling back its CREATE", {
+		ctx,
+		stackName,
+		resourceType: op.resourceType,
+		provisionedBy: deleteRoutedVia,
+		mask
+	});
 	delete stateResources[op.logicalId];
 	logger.info(`  Rollback: ${safe(op.logicalId)} deleted successfully`);
 	await afterOp?.(op.logicalId);
@@ -28327,7 +28420,7 @@ async function replayReadopt(s) {
 		survivorReason = survivorMessages.reason;
 		result.warnings++;
 	} else {
-		const { provider: newDeleteProvider } = ctx.providerRegistry.getProviderFor({
+		const { provider: newDeleteProvider, provisionedBy: newDeleteVia } = ctx.providerRegistry.getProviderFor({
 			resourceType: op.resourceType,
 			provisionedBy: current.provisionedBy ?? op.provisionedBy
 		});
@@ -28340,7 +28433,13 @@ async function replayReadopt(s) {
 			deletionPolicy: replacementDeletePolicy(current.updateReplacePolicy),
 			recordedAttributes: current.attributes
 		});
-		throwIfDeleteSkipped(readoptDelete, op.logicalId, current.physicalId, "while reversing its replacement (re-adopting the retained old resource)");
+		throwIfDeleteSkipped(readoptDelete, op.logicalId, current.physicalId, "while reversing its replacement (re-adopting the retained old resource)", {
+			ctx,
+			stackName,
+			resourceType: op.resourceType,
+			provisionedBy: newDeleteVia,
+			mask
+		});
 	}
 	stateResources[op.logicalId] = prev;
 	logger.info(`  Rollback: ${safe(op.logicalId)} restored to the retained old resource`);
@@ -28485,10 +28584,17 @@ async function replayReverseReplacement(s) {
 		physicalId: prev.physicalId,
 		via: createProvisionedBy
 	}, logger, mask, true);
-	const resolveNewDeleteProvider = () => ctx.providerRegistry.getProviderFor({
+	const resolveNewDeleteRoute = () => ctx.providerRegistry.getProviderFor({
 		resourceType: op.resourceType,
 		provisionedBy: current.provisionedBy ?? op.provisionedBy
-	}).provider;
+	});
+	const newDeleteGuardScope = (provisionedBy) => ({
+		ctx,
+		stackName,
+		resourceType: op.resourceType,
+		provisionedBy,
+		mask
+	});
 	const newCopyClaimed = inlinePolicyWriters.claimedFor(op.resourceType, op.logicalId, stateResources);
 	let deletedNewFirst = false;
 	let createResult;
@@ -28526,13 +28632,14 @@ async function replayReverseReplacement(s) {
 		logger.info(`  Rollback: re-create collided with the new resource's name — deleting the new resource (${displaySafe(mask(current.physicalId))}) first...` + (typeChanged ? ` (this op changed the resource's Type, ${safe(op.resourceType)} -> ${safe(oldType)}, which share a name space)` : ""));
 		{
 			const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
-			const deleteNewFirst = await resolveNewDeleteProvider().delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+			const deleteNewFirstRoute = resolveNewDeleteRoute();
+			const deleteNewFirst = await deleteNewFirstRoute.provider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
 				expectedRegion: ctx.region,
 				...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
 				deletionPolicy: replacementDeletePolicy(current.updateReplacePolicy),
 				recordedAttributes: current.attributes
 			});
-			throwIfDeleteSkipped(deleteNewFirst, op.logicalId, current.physicalId, "while clearing the new resource so the old one could be re-created");
+			throwIfDeleteSkipped(deleteNewFirst, op.logicalId, current.physicalId, "while clearing the new resource so the old one could be re-created", newDeleteGuardScope(deleteNewFirstRoute.provisionedBy));
 		}
 		deletedNewFirst = true;
 		delete stateResources[op.logicalId];
@@ -28591,14 +28698,15 @@ async function replayReverseReplacement(s) {
 		await noteRetainedResource(op.resourceType, op.logicalId);
 	} else if (!deletedNewFirst && !adoptedLiveNewResource) try {
 		const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
-		const deleteNewAfterRecreate = await resolveNewDeleteProvider().delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+		const deleteNewAfterRecreateRoute = resolveNewDeleteRoute();
+		const deleteNewAfterRecreate = await deleteNewAfterRecreateRoute.provider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
 			expectedRegion: ctx.region,
 			...newCopyClaimed && { inlinePolicyClaimed: newCopyClaimed },
 			...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
 			deletionPolicy: replacementDeletePolicy(current.updateReplacePolicy),
 			recordedAttributes: current.attributes
 		});
-		throwIfDeleteSkipped(deleteNewAfterRecreate, op.logicalId, current.physicalId, "while deleting the new resource after re-creating the old one");
+		throwIfDeleteSkipped(deleteNewAfterRecreate, op.logicalId, current.physicalId, "while deleting the new resource after re-creating the old one", newDeleteGuardScope(deleteNewAfterRecreateRoute.provisionedBy));
 	} catch (deleteError) {
 		logger.warn(mask(`  Rollback: old ${safe(op.logicalId)} re-created, but deleting the new resource (${displaySafe(mask(current.physicalId))}) failed: ${displaySafe(deleteError instanceof Error ? deleteError.message : String(deleteError))}. Delete it manually — it is no longer tracked in state.`));
 		survivorReason = `The replacement's new ${op.resourceType} (${current.physicalId}) could not be deleted after the old resource was re-created: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}. It is live, still billing, and no longer tracked by cdkd — delete it yourself.`;
@@ -28891,7 +28999,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 					let finalSnapshotIdentifier;
 					if (takeFinalSnapshot) finalSnapshotIdentifier = await prepareCreateRollbackFinalSnapshot(op, deleteProvisionedBy, ctx, mask);
 					logger.info(`  Rollback: deleting partially-created ${safe(op.logicalId)} (${safe(op.resourceType)}) (--revert-failed)` + (takeFinalSnapshot ? " — DeletionPolicy: Snapshot" : "") + (snapshotPolicy && !takeFinalSnapshot ? " — DeletionPolicy: Snapshot NOT taken (--skip-final-snapshot)" : ""));
-					const { provider } = ctx.providerRegistry.getProviderFor({
+					const { provider, provisionedBy: deleteRoutedVia } = ctx.providerRegistry.getProviderFor({
 						resourceType: op.resourceType,
 						provisionedBy: deleteProvisionedBy
 					});
@@ -28904,7 +29012,13 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						deletionPolicy: snapshotPolicy ? "Snapshot" : "Delete",
 						recordedAttributes: stateResources[op.logicalId]?.attributes
 					});
-					throwIfDeleteSkipped(failedCreateDelete, op.logicalId, op.physicalId, "while deleting the partially-created resource (--revert-failed)");
+					throwIfDeleteSkipped(failedCreateDelete, op.logicalId, op.physicalId, "while deleting the partially-created resource (--revert-failed)", {
+						ctx,
+						stackName,
+						resourceType: op.resourceType,
+						provisionedBy: deleteRoutedVia,
+						mask
+					});
 					delete stateResources[op.logicalId];
 					await options.afterOp?.(op.logicalId);
 					ctx.recordEvent?.({
@@ -29024,22 +29138,22 @@ async function replayFailedOperations(...args) {
 
 //#endregion
 //#region src/provisioning/nested-stack-context.ts
-const storage = new AsyncLocalStorage();
+const storage$1 = new AsyncLocalStorage();
 function withNestedStackContext(ctx, fn) {
-	return storage.run(ctx, fn);
+	return storage$1.run(ctx, fn);
 }
 function getCurrentNestedStackContext() {
-	return storage.getStore();
+	return storage$1.getStore();
 }
 async function collectNestedChildUnaddressed(fn) {
-	const ctx = storage.getStore();
+	const ctx = storage$1.getStore();
 	if (!ctx) return {
 		value: await fn(),
 		unaddressed: void 0
 	};
 	const slot = {};
 	return {
-		value: await storage.run({
+		value: await storage$1.run({
 			...ctx,
 			childUnaddressed: slot
 		}, fn),
@@ -30292,6 +30406,24 @@ const cyan = (s) => `${codes.cyan}${s}${codes.reset}`;
 const gray = (s) => `${codes.gray}${s}${codes.reset}`;
 const bold = (s) => `${codes.bright}${s}${codes.reset}`;
 
+//#endregion
+//#region src/deployment/delete-guard-scope.ts
+const storage = new AsyncLocalStorage();
+function collectDeleteGuards(sink, fn) {
+	return storage.run(sink, fn);
+}
+function reportDeleteGuards(result, target) {
+	const sink = storage.getStore();
+	if (!sink) return;
+	for (const guard of deleteIndeterminateGuards(result)) sink.push({
+		guard: guard.guard,
+		reason: guard.reason,
+		physicalId: target.physicalId,
+		resourceType: target.resourceType,
+		...target.provisionedBy && { provisionedBy: target.provisionedBy }
+	});
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/replacement.ts
 function replacementDeleteContext(updateReplacePolicy) {
@@ -30310,7 +30442,7 @@ async function prepareFinalSnapshotForDelete(logicalId, resourceType, currentRes
 	}
 	throw unsupportedFinalSnapshotError(logicalId, resourceType, "--skip-final-snapshot");
 }
-async function replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, secrets, updateReplacePolicy) {
+async function replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, secrets, updateReplacePolicy, oldDeleteProvisionedBy) {
 	const createContext = { maskSecrets: createSecretMasker(secrets) };
 	const finalSnapshotIdentifier = await this.prepareFinalSnapshotForDelete(logicalId, oldResourceType, currentResource, updateReplacePolicy);
 	let deleteResult;
@@ -30325,6 +30457,11 @@ async function replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourc
 	} catch (deleteError) {
 		throw new Error(maskSecretsInText(`Failed to delete old resource ${logicalId} (${currentResource.physicalId}) during the --replace delete-first fallback: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`, secrets));
 	}
+	reportDeleteGuards(deleteResult, {
+		physicalId: currentResource.physicalId,
+		resourceType: oldResourceType,
+		provisionedBy: oldDeleteProvisionedBy
+	});
 	const replaceSkipReason = deleteSkipReason(deleteResult);
 	if (replaceSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, replaceSkipReason, "during the --replace delete-first fallback"));
 	this.logger.info(`  ${green("✓")} Old resource deleted`);
@@ -30429,10 +30566,10 @@ async function createFirstThenDeleteOld(input) {
 	if (input.equalIdIsSameResource && createResult.physicalId === currentResource.physicalId) throw markNonRetryable(new CdkdError(maskName(`${displaySafe(logicalId)} (${displaySafe(resourceType)}) requires replacement (${input.trigger}) under a new name, but the create returned the resource being replaced (${displaySafe(currentResource.physicalId)}) instead of a new one, so cdkd cannot tell which name it holds. Nothing was deleted. Delete that resource by hand if it is yours, then re-run the deploy.`), "NAMED_REPLACEMENT_IDEMPOTENT_CREATE"));
 	if (retainOld) return createResult;
 	this.logger.info(safeMsg`  Deleting old ${logicalId} (${currentResource.physicalId})...`);
-	await this.deleteReplacedAfterCreate(logicalId, input.oldResourceType, currentResource, input.deleteProvider, input.deleteProperties, finalSnapshotIdentifier, input.deletePolicy, secrets);
+	await this.deleteReplacedAfterCreate(logicalId, input.oldResourceType, currentResource, input.deleteProvider, input.deleteProperties, finalSnapshotIdentifier, input.deletePolicy, secrets, input.deleteProvisionedBy);
 	return createResult;
 }
-async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, deleteProvider, deleteProperties, finalSnapshotIdentifier, updateReplacePolicy, secrets) {
+async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, deleteProvider, deleteProperties, finalSnapshotIdentifier, updateReplacePolicy, secrets, deleteProvisionedBy) {
 	let deleteResult = void 0;
 	let deleteFailed = false;
 	try {
@@ -30448,6 +30585,11 @@ async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentReso
 		deleteFailed = true;
 		this.logger.warn(safeMsg`  ⚠ Failed to delete old resource ${logicalId} (${currentResource.physicalId}): ${deleteMsg}`);
 	}
+	reportDeleteGuards(deleteResult, {
+		physicalId: currentResource.physicalId,
+		resourceType: oldResourceType,
+		provisionedBy: deleteProvisionedBy
+	});
 	const skipReason = deleteSkipReason(deleteResult);
 	if (skipReason !== void 0) this.logger.warn(`  ⚠ ${deleteSkippedMessage(logicalId, currentResource.physicalId, skipReason, "while cleaning up the replaced resource", { commandFreeLine: true })}. Delete it manually — it is no longer tracked in state.`);
 	else if (!deleteFailed) this.logger.info(`  ${green("✓")} Old resource deleted`);
@@ -33842,10 +33984,11 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 	});
 	const replaceProvider = replaceDecision.provider;
 	const replaceProps = replaceDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
-	const oldDeleteProvider = this.providerRegistry.getProviderFor({
+	const oldDeleteRoute = this.providerRegistry.getProviderFor({
 		resourceType: oldResourceType,
 		provisionedBy: currentResource.provisionedBy
-	}).provider;
+	});
+	const oldDeleteProvider = oldDeleteRoute.provider;
 	const equalIdIsSameResource = equalIdNamesSameResource({
 		oldType: oldResourceType,
 		newType: resourceType,
@@ -33884,6 +34027,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			createProvider: replaceProvider,
 			createProps: replaceProps,
 			deleteProvider: oldDeleteProvider,
+			deleteProvisionedBy: oldDeleteRoute.provisionedBy,
 			deleteProperties: currentResource.properties,
 			secrets: updateSecrets,
 			change: nameChange,
@@ -33913,6 +34057,11 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			} catch (deleteError) {
 				throw new Error(`Failed to destroy old resource ${logicalId} (${currentResource.physicalId}) during ${recreateFlagName}: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`);
 			}
+			reportDeleteGuards(recreateDeleteResult, {
+				physicalId: currentResource.physicalId,
+				resourceType: oldResourceType,
+				provisionedBy: oldDeleteRoute.provisionedBy
+			});
 			const recreateSkipReason = deleteSkipReason(recreateDeleteResult);
 			if (recreateSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, recreateSkipReason, `during ${recreateFlagName}`));
 			this.logger.info(`  ${green("✓")} Old resource deleted`);
@@ -33968,7 +34117,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but the create-first attempt collided with the existing resource: ${createMsg}. ${nameOrigin.descriptor}, so the CloudFormation-style safe replacement order (create the new resource before deleting the old) cannot reuse the occupied name — CloudFormation refuses this shape with "cannot update a stack when a custom-named resource requires replacing". ${nameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated).`, "NAMED_REPLACEMENT_COLLISION");
 			this.logger.info(`  Create-first collided with the existing resource's name and --replace is set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
 			deletedOldFirst = true;
-			createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy);
+			createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy, oldDeleteRoute.provisionedBy);
 		}
 		if (equalIdIsSameResource && !deletedOldFirst && createResult.physicalId === currentResource.physicalId) {
 			const idempotentNameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
@@ -33976,7 +34125,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its Create API is name-idempotent: the create-first attempt returned the EXISTING resource (${currentResource.physicalId}) instead of creating a new one, so deleting the "old" resource would silently destroy the resource the deploy just reported as created. ${idempotentNameOrigin.descriptor}; ${idempotentNameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated). Note: this branch is also reached when the old resource was deleted out-of-band and the physical id is name-derived — there the create was a genuine fresh create; \`--replace\` converges that case too.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
 			this.logger.info(`  Create-first returned the existing resource (name-idempotent Create API) and --replace is set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
 			deletedOldFirst = true;
-			createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy);
+			createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy, oldDeleteRoute.provisionedBy);
 		}
 		if (deletedOldFirst) {} else if (updateReplacePolicy === "Retain") {
 			this.retainedOldOnReplacement.add(logicalId);
@@ -33993,7 +34142,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 				snapshotBlockedDelete = true;
 				this.logger.warn(`  ⚠ Final snapshot for old ${logicalId} (${currentResource.physicalId}) failed: ${snapshotError instanceof Error ? snapshotError.message : String(snapshotError)}. The old resource was NOT deleted (UpdateReplacePolicy: Snapshot) — delete it manually once you have a snapshot; it is no longer tracked in state.`);
 			}
-			if (!snapshotBlockedDelete) await this.deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, oldDeleteProvider, currentResource.properties, cleanupFinalSnapshotId, updateReplacePolicy, updateSecrets);
+			if (!snapshotBlockedDelete) await this.deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, oldDeleteProvider, currentResource.properties, cleanupFinalSnapshotId, updateReplacePolicy, updateSecrets, oldDeleteRoute.provisionedBy);
 		}
 	}
 	this.registerNoEchoAttributes(logicalId, createResult, updateSecrets, resolvedProps);
@@ -34129,6 +34278,11 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 					if (!isWaitAbandonedError(deleteError) && !isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound"))) this.logger.debug(`Old resource ${logicalId} already gone, proceeding with CREATE`);
 					else throw deleteError;
 				}
+				reportDeleteGuards(fallbackDeleteResult, {
+					physicalId: currentResource.physicalId,
+					resourceType,
+					provisionedBy: updateDecision.provisionedBy
+				});
 				const fallbackSkipReason = deleteSkipReason(fallbackDeleteResult);
 				if (fallbackSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, fallbackSkipReason, "during the UPDATE-not-supported replacement"));
 			}
@@ -34143,6 +34297,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 					createProvider: replProvider,
 					createProps: replProps,
 					deleteProvider: updateProvider,
+					deleteProvisionedBy: updateDecision.provisionedBy,
 					deleteProperties: currentProps,
 					secrets: updateSecrets,
 					change: fallbackNameChange,
@@ -34272,10 +34427,11 @@ async function provisionDelete(logicalId, change, stateResources, stackName, tem
 	}
 	const governingPolicy = effectiveDeletionPolicy(resourceType, deletionPolicy, currentResource.properties);
 	const finalSnapshotIdentifier = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, governingPolicy);
-	const deleteProvider = this.providerRegistry.getProviderFor({
+	const deleteRoute = this.providerRegistry.getProviderFor({
 		resourceType,
 		provisionedBy: currentResource.provisionedBy
-	}).provider;
+	});
+	const deleteProvider = deleteRoute.provider;
 	this.logger.debug(`Deleting ${logicalId} (${resourceType})`);
 	let deleteResult = void 0;
 	const inlinePolicyClaimed = this.inlinePolicyClaimedFor(resourceType, logicalId, stateResources);
@@ -34293,6 +34449,11 @@ async function provisionDelete(logicalId, change, stateResources, stackName, tem
 		if (!isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && !isWaitAbandonedError(deleteError) && (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException"))) this.logger.debug(`Resource ${logicalId} already deleted (${msg}), removing from state`);
 		else throw deleteError;
 	}
+	reportDeleteGuards(deleteResult, {
+		physicalId: currentResource.physicalId,
+		resourceType,
+		provisionedBy: deleteRoute.provisionedBy
+	});
 	const deleteSkipped = deleteSkipReason(deleteResult);
 	if (deleteSkipped !== void 0) {
 		if (progress) progress.current++;
@@ -34415,12 +34576,27 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 	const physicalIdBeforeUpdate = stateResources[logicalId]?.physicalId;
 	const provisionedByBeforeUpdate = stateResources[logicalId]?.provisionedBy;
 	let nestedChildUnaddressed;
+	const deleteGuards = [];
 	try {
 		await withResourceDeadline(async () => {
-			const { value: bodyResult, unaddressed } = await collectNestedChildUnaddressed(() => this.provisionResourceBody(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress));
-			deleteSkipped = bodyResult?.deleteSkipped;
-			updatePartial = bodyResult?.updatePartial;
-			nestedChildUnaddressed = unaddressed;
+			try {
+				const { value: bodyResult, unaddressed } = await collectDeleteGuards(deleteGuards, () => collectNestedChildUnaddressed(() => this.provisionResourceBody(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress)));
+				deleteSkipped = bodyResult?.deleteSkipped;
+				updatePartial = bodyResult?.updatePartial;
+				nestedChildUnaddressed = unaddressed;
+			} finally {
+				for (const guard of deleteGuards.splice(0)) this.recordEvent({
+					eventType: "RESOURCE_GUARD_INDETERMINATE",
+					stackName,
+					operation: "DELETE",
+					logicalId,
+					resourceType: guard.resourceType,
+					...guard.provisionedBy && { provisionedBy: guard.provisionedBy },
+					...guard.physicalId && { physicalId: this.maskForResource(logicalId, guard.physicalId) },
+					guard: guard.guard,
+					reason: guard.reason
+				});
+			}
 		}, {
 			warnAfterMs,
 			timeoutMs,
@@ -36433,4 +36609,4 @@ DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice
 
 //#endregion
 export { resourcesNamingDeclaredParameter as $, STATE_SOURCED_READBACK_RULES as $a, isWarmThroughputDecrease as $i, explicitRoleArnOrThrow as $n, runDockerForeground as $o, malformedOutputsWarning as $r, noEchoParameterValueSeed as $t, resolveDynamoDbDeleteBudgetClock as A, printingCorpusOf as Aa, repairMalformedOrphanRecordsForReadOnly as Ai, ccProtectionRegistryTypes as An, assertAssetBucketRegion as Ao, STATE_REGION_DIVERGED as Ar, derivePartitionAndUrlSuffix as As, ccRoutedFinalSnapshotError as At, getPriorAttempts as B, scrubResourceRecord as Ba, findSilentDropProperties as Bi, isTerminationProtectionPropagationError as Bn, resolveDockerContextDirectory as Bo, isReadableResourceEntry as Br, describeFileReadFailure as Bs, updatePartialMessage as Bt, perType as C, inheritNestedStackParameterAssociations as Ca, refuseMalformedResourcePropertiesForDrift as Ci, ProviderRegistry as Cn, WorkGraph as Co, isStalePlaceholderArnAttribute as Cr, findLargeInlineResources as Cs, resolveReplacementOldType as Ct, beginDeleteWait as D, hasMaskableValues as Da, refuseMalformedResourcesForDestroy as Di, getCurrentResourceSecrets as Dn, rewriteTemplateAssetReferences as Do, parameterInputsFor as Dr, expectedOwnerParam as Ds, ATOMIC_FINAL_SNAPSHOT_TYPES as Dt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as E, createUnionSecretMasker as Ea, refuseMalformedResourcesForDeploy as Ei, isCustomResourceType as En, loadPublishableAssetManifest as Eo, withSharedDrainBudget as Er, decodeListingKey as Es, inheritProducerRegions as Et, waitForIndexesSettled as F, errorCauseChain as Fa, repairMalformedResourcesForReadOnly as Fi, withIndeterminateGuard as Fn, readBootstrapMarkerBody as Fo, displayLogicalId as Fr, hasOwnKey as Fs, unsupportedFinalSnapshotError as Ft, cyan as G, pathCrossesDottedKey as Ga, findReplacedReadersOfRecreateTargets as Gi, INTRINSIC_KEYS as Gn, finchSecretArgvRefusal as Go, malformedLocalResourceEntriesWarning as Gr, resolveBucketRegion as Gs, WITHHELD_NAME_DISPLAY as Gt, formatResourceLine as H, DYNAMIC_REFERENCE_TOKEN_SCAN as Ha, withoutSilentDropProperties as Hi, reDisableInstanceApiTermination as Hn, describeDockerExecFailure as Ho, malformedExportNamesWarning as Hr, renderAssemblyPathEscape as Hs, DeploymentEventsReader as Ht, ECR_AUTO_DELETE_IMAGES_TAG as I, maskSecretsInError as Ia, unpreviewableOrphanRecords as Ii, isWaitAbandonedError as In, validateAssetBucketName as Io, hasReadableOrphans as Ir, hasPlainPrototype$1 as Is, REDACTED_DELETE_ADDRESS_SKIP_REASON as It, red as J, recordMaskOnlyValue as Ja, isStatefulRecreateTargetForReplace as Ji, producerRegionsFromState as Jn, isDockerClientEnvKey as Jo, malformedOrphanRecordsWarning as Jr, secretBearing as Jt, gray as K, identityKeyFor as Ka, shownType as Ki, IntrinsicFunctionResolver as Kn, formatDockerLoginError as Ko, malformedLocalResourcesWarning as Kr, displayTextOrWithheld as Kt, S3_AUTO_DELETE_OBJECTS_TAG as L, maskSecretsInText as La, unreadableOrphanRecords as Li, markWaitAbandoned as Ln, validateContainerRepoName as Lo, hasReadableOutputs as Lr, nullPrototypeRecord as Ls, isRedactedRecordedValue as Lt, DELETE_INDEX_WAIT_PROCEED_NOTE as M, recordLogOnlyValue as Ma, repairMalformedOutputsForReadOnly as Mi, UNSPECIFIED_SKIP_REASON as Mn, getBootstrapMarkerKey as Mo, UNREADABLE_ORPHANS_CONTAINER_ROW as Mr, StageLoadError as Ms, effectiveDeletionPolicy as Mt, INDEX_SETTLE_POLL_INTERVAL_MS as N, shareLogOnlyValues as Na, repairMalformedResourceEntriesForReadOnly as Ni, deleteIndeterminateGuards as Nn, isCrossRegionRedirect as No, UNREADABLE_RESOURCES_MAP_ROW as Nr, processStackMessages as Ns, isFinalSnapshotError as Nt, compensateRemovedDeletionProtection as O, literalSplitDelimitersOf as Oa, refuseMalformedResourcesForExport as Oi, CloudControlProvider as On, AssetModeResolver as Oo, passedParameterClassesOf as Or, PARTITION_TABLE as Os, PRE_DELETE_SNAPSHOT_TYPES as Ot, deleteTableWithIndexBusyRetry as P, createSecretMasker as Pa, repairMalformedResourcePropertiesForReadOnly as Pi, deleteSkipReason as Pn, parseBootstrapMarker as Po, deployRefusesOrphanRowsReason as Pr, defineOwnKey as Ps, refusesFinalSnapshot as Pt, reachableDivergentParameters as Q, STATE_SOURCED_CROSS_GENERATION_RULES as Qa, coerceWarmThroughput as Qi, assertSendableRoleArn as Qn, redactedDockerCause as Qo, malformedOutputsRefusalMessage as Qr, isWholeDynamicReferenceValue as Qt, hasCdkAutoDeleteTag as R, markSameGenerationBag as Ra, unreadableResourceEntries as Ri, disableInstanceApiTermination as Rn, buildDenyExternalAccessPolicy as Ro, hasReadableResources as Rr, ownValue as Rs, redactedDeleteAddressFields as Rt, isProtectionValueActive as S, liveMatchesUnresolvedTokenFrame as Sa, refuseMalformedResourceEntriesForOrphan as Si, CC_BROKEN_REASON as Sn, stringifyValue as So, cfnRefValueFromPhysicalId as Sr, MIGRATE_TMP_PREFIX as Ss, planRollback as St, DynamoDBGlobalTableProvider as T, carryLogOnlyValues as Ta, refuseMalformedResourcePropertiesForOrphan as Ti, wouldReturnToSdkProvider as Tn, createAssetRedirectResolver as To, parseWebACLArn as Tr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ts, getCurrentProducerRegions as Tt, createReadOnlyAttributeHealerFactory as U, dynamicReferenceTokens as Ua, NO_CC_HANDLERS_REASON as Ui, reEnableInstanceApiTermination as Un, describeDockerFailure as Uo, malformedExportSourceWarning as Ur, resolveAssemblyPath as Us, DeploymentEventsStore as Ut, markRefusedBeforeApplying as V, recoverMaskedOutput as Va, unwrittenCreateOnlyReplacement as Vi, observeThenDisableInstanceApiTermination as Vn, describeDockerCapturedOutput as Vo, malformedDriftResourcePropertiesWarning as Vr, displayAssemblyPath as Vs, updatePartialReason as Vt, bold as W, isUncertifiedBaselineMaskPosition as Wa, hasNoCloudControlHandlers as Wi, DiffCalculator as Wn, dockerSpawnEnvWithSensitive as Wo, malformedLocalOutputsWarning as Wr, clearBucketRegionCache as Ws, extractDeploymentEventError as Wt, computeParameterTaint as X, recordNoEchoAttributeValues as Xa, renderStatefulReason as Xi, applyRoleArnIfSet as Xn, partitionSensitiveEnv as Xo, malformedOrphansRefusalMessage as Xr, secretSafeKeyDisplay as Xt, yellow as Y, recordMaskOnlyValuesIn as Ya, isStatefulRecreateTargetSync as Yi, regionLessSecretName as Yn, isMalformedEnvKey as Yo, malformedOrphanRowsKeptWarning as Yr, secretBearingStateKeyWarning as Yt, namesAnyDeclaredParameter as Z, STATE_SOURCED_BASELINE_RULES as Za, WARM_THROUGHPUT_MEMBERS as Zi, assertFlagRoleArn as Zn, redactDockerArgvValues as Zo, malformedOrphansWarning as Zr, exportNameSecretExposure as Zt, makeCanonicalizePropertiesFn as _, canonicalLambdaFunctionName as _a, refuseMalformedResourceEntries as _i, refuseMalformedDesiredTags as _n, orphansAfterRollback as _o, carriesDynamicReference as _r, stateBucketExistenceConfirmed as _s, destroyStackRecordsView as _t, findNestedTemplateTreeDefect as a, configIntegerRefusal as aa, malformedStateRefusalMessage as ai, DEFAULT_RESOURCE_WARN_AFTER_MS as an, S3StateBackend as ao, envCredentialsAreAssumedRole as ar, getDockerImageBySourceHash as as, dropSettledNestedJournals as at, recordedProtectionNote as b, DagBuilder as ba, refuseMalformedResourceEntriesForImport as bi, definedAttributes as bn, AssetPublisher as bo, keepsSecretReferenceToken as br, CFN_TEMPLATE_BODY_LIMIT as bs, recordAfterRollbackUpdate as bt, renderNestedTemplateTreeDefect as c, replayWarn as ca, refuseMalformedNestedChildOutputs as ci, earliestDefined as cn, acceptedCreateOnlyDropsOf as co, s3BucketDomainName as cr, getDefaultStateBucketName as cs, recordDisplacedSkips as ct, conditionInputsFrom as d, requireConfigString as da, refuseMalformedOrphans as di, withCreateTokenLedger as dn, hasReadableExportSet as do, s3BucketWebsiteUrl as dr, resolveAutoAssetStorage as ds, withNestedRevertRun as dt, toCfnInteger as ea, malformedRenderedContainersWarning as ei, collectDeclaredOutputNames as en, TEMPLATE_SOURCED_RULES as eo, isIamRoleArn as er, runDockerStreaming as es, makeSiblingClaimReader as et, parentSuppliedValues as f, prefetchCreateOnlyPropertyPaths as fa, refuseMalformedOrphansForDestroy as fi, acquireIdempotencyToken as fn, hasReasonlessBaselineRefusal as fo, coerceParameterTypedValue as fr, resolveCaptureObservedState as fs, getCurrentNestedStackContext as ft, mergeNoChangeOutputs as g, markAuxiliaryFailure as ga, refuseMalformedResourceAttributesForOrphan as gi, readTagList as gn, isReadableBag as go, isImpossibleEmptyStoredAttribute as gr, resolveUseCdkBootstrapAssets as gs, awaitInFlightSibling as gt, keptWholeReasonText as h, withRetry as ha, refuseMalformedOutputsForDestroy as hi, planTagDiff as hn, importableOutputs as ho, getAccountInfo as hr, resolveStateBucketWithDefaultAndSource as hs, replayRollback as ht, childTemplateLoader as i, configBooleanRefusal as ia, malformedScrubResourceEntriesRefusalMessage as ii, DEFAULT_RESOURCE_TIMEOUT_MS as in, isLockInfoExpired as io, callerEnvCredentials as ir, AssetManifestLoader as is, displacedPhysicalIdShown as it, resolveDynamoDbDeleteBudgetMs as j, recordLogOnlyParameterValue as ja, repairMalformedOrphansForReadOnly as ji, unchangedBehindSecretReference as jn, ensureAssetStorage as jo, STATE_RESOURCES_MALFORMED as jr, AssemblyReader as js, createPreDeleteFinalSnapshot as jt, deleteBudgetKey as k, logOnlyValueCount as ka, refuseMalformedState as ki, slowCcOperationTimeoutMs as kn, BOOTSTRAP_MARKER_PREFIX as ko, JSON_LISTING_HOLE_VALUE as kr, canonicalizeRegion as ks, buildFinalSnapshotIdentifier as kt, templateIdentity as l, requireConfigArray as la, refuseMalformedOrphanRecords as li, ledgerForStack as ln, describeRegionValueKind as lo, s3BucketDualStackDomainName as lr, getLegacyStateBucketName as ls, revertNestedChildFromJournal as lt, isSecretBearingReferenceString as m, describeTypeWithThrottleRetry as ma, refuseMalformedOutputs as mi, DBPROXY_TAG_OPTIONS as mn, importableOutputKeys as mo, parameterTypeMayLoseSecretIdentity as mr, resolveStateBucketWithDefault as ms, replayFailedOperations as mt, IMPLICIT_DELETE_DEPENDENCIES as n, coerceCfnBoolean as na, malformedResourcePropertiesWarning as ni, isExportAliasCollision as nn, isSingleDynamicReferenceToken as no, AWS_CREDENTIAL_ENV_KEYS as nr, escapeRegExp$2 as ns, NESTED_PENDING_PARENT_REASON as nt, isAbsoluteAssetPath as o, configStringRefusal as oa, previewableOrphanRecords as oi, maskingRetryLogger as on, rebuildClientForBucketRegion as oo, isSettledInstanceState as or, Synthesizer as os, getNestedRevertRun as ot, readRecordedConditionVerdicts as p, templateResourceTypes as pa, refuseMalformedOrphansForOrphan as pi, DBPROXY_TAGS_WHAT as pn, hasUnverifiableParameterRefusal as po, isUnboundTemplateParameter as pr, resolveSkipPrefix as ps, withNestedStackContext as pt, green as q, carriesSecretMask as qa, MULTI_REGION_RECREATE_BLOCKED_TYPES as qi, classifyReplaySecretRegion as qn, getDockerCmd as qo, malformedOrphanRecordsRefusalMessage as qr, exportAliasCollisionScrubWarning as qt, computeImplicitDeleteEdges as r, coerceCfnInteger as ra, malformedResourcesWarning as ri, bindingSkippedOutputs as rn, LockManager as ro, applyCallerIdentityCredentials as rr, stripControlChars as rs, displacedOpClause as rt, listNestedTemplateRows as s, readConfigString as sa, refuseDivergentRecordRegionForDestroy as si, RollbackInlinePolicyWriters as sn, splitImportedOps as so, s3BucketArn as sr, synthesisStatusMessage as ss, nestedChildStackName as st, DeployEngine as t, toFiniteNumber as ta, malformedResourceEntriesWarning as ti, collectPublishedOutputNames as tn, WHOLE_DYNAMIC_REFERENCE_PATTERN as to, sendableAssumeRoleCommand as tr, warnFinchArgvExposure as ts, planOrphanAdoption as tt, conditionFingerprint as u, requireConfigObject as ua, refuseMalformedOrphanRecordsForDestroy as ui, reserveStackCreateToken as un, exportNamesCarriedFrom as uo, s3BucketRegionalDomainName as ur, resolveApp as us, revertedNestedRowIds as ut, withResourceDeadline as v, lambdaFunctionNameForMask as va, refuseMalformedResourceEntriesForDeploy as vi, tagMapAsList as vn, orphansCarriedFrom as vo, carriesFetchableDynamicReference as vr, warnDeprecatedNoPrefixCliFlag as vs, getStackRecords as vt, readProtection as w, recordNestedStackParameterExpressions as wa, refuseMalformedResourcePropertiesForExport as wi, ccBrokenReason as wn, buildAssetRedirectMap as wo, refStateLookupFromResource as wr, uploadCfnTemplate as ws, findNestedStackTypeChanges as wt, PROTECTION_PROPERTY_BY_TYPE as x, TemplateParser as xa, refuseMalformedResourceEntriesForImportSave as xi, stringifyIfAssigned as xn, isSensitiveAttributeName as xo, AWS_NO_VALUE as xr, CFN_TEMPLATE_URL_LIMIT as xs, planFailedOps as xt, recordedProtectionEvidence as y, sameLambdaFunctionAddress as ya, refuseMalformedResourceEntriesForDestroy as yi, tagPlanWarning as yn, shouldRetainResource as yo, isNamelessDynamicReferenceError as yr, ssmResolvedValueType as ys, withStackRecords as yt, isTruthyCfnBoolean as z, redactSecretsForState as za, findActionableSilentDrops as zi, ec2InstanceProtectionSite as zn, buildDockerImage as zo, isReadableOrphanRecord as zr, absoluteAssemblyPathEscape as zs, redactedDeleteAddressSkip as zt };
-//# sourceMappingURL=deploy-engine-CMRU0DTu.js.map
+//# sourceMappingURL=deploy-engine-BiA8Ud6-.js.map