@go-to-k/cdkd 0.294.14 → 0.295.1

package/dist/{deploy-engine--YvYB0qw.js → deploy-engine-DG-oC9YK.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js"
 import { A as displaySafe, E as UNRENDERABLE, F as safeMsg, L as truncateCodePoints, M as isPasteableIdent, O as displayAwsMessage, P as plainIdentOr, S as withoutGeneratedFallbackName, T as STACK_REF_MAX_CODE_POINTS, _ as getCurrentSkipPrefix, b as withSkipPrefix, c as getLiveRenderer, f as applyDefaultNameForFallback, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, m as explicitNamePropertyFor, n as getLogger, r as isStdoutReservedForPayload, s as installLogLineMaskerSource, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS, x as withStackName, y as looksLikeCdkdGeneratedName } from "./logger-B46YMG0h.js";
 import { $t as StateError, A as isTerminalDeleteFailure, An as isAmbiguousCcHandlerErrorCode, At as clientDefaultsFor, Bn as isMarkedNonRetryable, Bt as IntrinsicResolutionRefusalError, C as refusalTypeShown, Cn as isNameCollisionErrorFrom, D as ProtectionFlipRegistry, Dt as withPasteableAwsProfile, En as isReplayedNameCollisionFrom, Fn as retryClassificationText, Gt as MalformedProducerRecordRefusalError, H as pasteableAwsCommand, Hn as markNonRetryable, In as describeAwsFailure, It as CrossAccountSecretRefusalError, J as isInterruptedWaitError, Jt as ProvisioningError, Lt as DependencyError, M as observeThenDisableProtection, Mn as isIamPropagationError, Mt as AccountIdUnavailableError, N as protectionFlipKey, Nn as isRetryableTransientError, Nt as AssetError, O as compensateProtectionFlip, On as markReplayMayCollide, Ot as ambientClientDefaults, Pn as isTransientServerError, Pt as CdkdError, Q as canonicalizeRoute53QueryName, R as DELETION_PROTECTION_DOC_POINTER, Rn as safeStringify$1, S as quotedRemedyLogicalId, Sn as hasReplayMayCollide, St as injectiveKey, T as resolveExplicitPhysicalId, Tn as isRecreateRetryableError, Tt as producerRecordKey, U as protectedReplacementAdvice, Un as markRedactedCause, Ut as LockError, Vn as isThrottlingError, Wn as wrapMaskedAwsError, Wt as MacroExpansionError, X as ElapsedBudgetRegistry, Xt as ResourceUpdateNotSupportedError, Y as startInterruptWatch, Yt as ResourceTimeoutError, Z as monotonicNowMs, _n as shellQuote, _t as formatLockOperation, at as segmentAfterAnchor, b as isQuotableImportValue, bt as CUSTOM_RESOURCE_RESPONSE_PREFIX, cn as UNSHOWABLE_VALUE, ct as isSecretDerivedValue, d as prepareRemovalForUpdate, dn as isInertUnquoted, dt as withDerivedNameMasks, en as SynthesisError, et as compositeIdSeparatorRefusal, f as removalWarning, fn as pasteableCommand, ft as UNREPRODUCIBLE_LOCK_CLAUSE, g as assertRegionMatch, gn as shellBoundedDisplay, gt as formatLockExpiry, h as RESOURCE_NOT_FOUND, hn as quotedOrDescribed, i as holdsSecretDerivedEntry, it as resourceTypeShown, jn as isAmbiguousOutcomeError, jt as credentialFingerprint, k as deleteWithProtectionCompensation, kn as formatRetryClassificationSignals, kt as ambientCredentialConfig, l as withUnchangedSecretPrincipalLists, ln as commandHole, lt as maskDeep, m as withoutInjectedRemovals, mn as plainOrDescribed, nt as logicalIdShown, on as SHELL_ACTIVE, ot as createMaskedLogSinks, pn as physicalIdShownBesideCommand, pt as buildForceUnlockCommand, rn as normalizeAwsError, sn as SHELL_ACTIVE_WHY, st as createMaskedRetryLogger, ut as maskerOrIdentity, vn as withheldTargetClause, vt as formatLockOwner, wn as isNameCooldownError, x as normalizeAwsTagsToCfn, xn as isUpdateUnsupportedError, xt as DEFAULT_STATE_PREFIX, yt as sanitizeRecoveryValue, zt as DynamicReferenceRegionAmbiguousError } from "./iam-policy-targets-CMSQGQnm.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-CLicSzp8.js";
+import { t as getCdkdVersion } from "./version-Bqzsng8Y.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2705,7 +2705,7 @@ var FileAssetPublisher = class {
 
 //#endregion
 //#region src/utils/regexp.ts
-function escapeRegExp$2(value) {
+function escapeRegExp$3(value) {
 	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function stripControlChars(value) {
@@ -3123,7 +3123,7 @@ function trailingShortFlagOfCluster(arg) {
 	for (const flag of ARGV_VALUE_BEARING_FLAGS) if (flag.length === 2 && flag.startsWith("-") && flag[1] !== "-" && flag[1] === last) return flag;
 }
 const ARGV_VALUE_TOKEN_RE = (() => {
-	const alternation = [...ARGV_VALUE_BEARING_FLAGS].sort((a, b) => b.length - a.length || a.localeCompare(b)).map(escapeRegExp$2).join("|");
+	const alternation = [...ARGV_VALUE_BEARING_FLAGS].sort((a, b) => b.length - a.length || a.localeCompare(b)).map(escapeRegExp$3).join("|");
 	if (alternation.length === 0 || [...ARGV_VALUE_BEARING_FLAGS].some((f) => f.trim() === "")) throw new Error("ARGV_VALUE_BEARING_FLAGS is empty or holds an empty flag: the token scan would match every k=v");
 	return new RegExp(`(^|\\s)(${alternation})(\\s+|=)([^\\s=]*)=\\S*`, "g");
 })();
@@ -4133,10 +4133,10 @@ function flattenAssetPlaceholders(value, accountId, region, partition = "aws") {
 	return value.replace(/\$\{AWS::AccountId\}/g, accountId).replace(/\$\{AWS::Region\}/g, region).replace(/\$\{AWS::Partition\}/g, partition);
 }
 function isDefaultBootstrapBucketName(name, accountId, region) {
-	return new RegExp(`^cdk-[a-z0-9]+-assets-${accountId}-${escapeRegExp$2(region)}$`).test(name);
+	return new RegExp(`^cdk-[a-z0-9]+-assets-${accountId}-${escapeRegExp$3(region)}$`).test(name);
 }
 function isDefaultBootstrapRepoName(name, accountId, region) {
-	return new RegExp(`^cdk-[a-z0-9]+-container-assets-${accountId}-${escapeRegExp$2(region)}$`).test(name);
+	return new RegExp(`^cdk-[a-z0-9]+-container-assets-${accountId}-${escapeRegExp$3(region)}$`).test(name);
 }
 function buildAssetRedirectMap(manifest, marker, accountId, region, partition = "aws") {
 	const buckets = /* @__PURE__ */ new Map();
@@ -4145,7 +4145,7 @@ function buildAssetRedirectMap(manifest, marker, accountId, region, partition =
 	const addForms = (rawName, flattened, target) => {
 		sources.set(flattened, target);
 		if (rawName !== flattened) sources.set(rawName, target);
-		const suffixRe = new RegExp(`-${accountId}-${escapeRegExp$2(region)}$`);
+		const suffixRe = new RegExp(`-${accountId}-${escapeRegExp$3(region)}$`);
 		for (const suffix of [
 			"-${AWS::AccountId}-${AWS::Region}",
 			`-\${AWS::AccountId}-${region}`,
@@ -4186,7 +4186,7 @@ function buildAssetRedirectMap(manifest, marker, accountId, region, partition =
 	};
 }
 function buildBoundaryRegex(source) {
-	return new RegExp(`(?<![A-Za-z0-9_.-])${escapeRegExp$2(source)}(?![A-Za-z0-9_-])`, "g");
+	return new RegExp(`(?<![A-Za-z0-9_.-])${escapeRegExp$3(source)}(?![A-Za-z0-9_-])`, "g");
 }
 function rewriteString(value, map, counter) {
 	let result = value;
@@ -4803,6 +4803,14 @@ function refuseMalformedOperation(shownStack, where, op) {
 	const attempted = o["attemptedProperties"];
 	if (attempted !== void 0 && (typeof attempted !== "object" || attempted === null || Array.isArray(attempted))) fail("attemptedProperties", attempted, "an object when present");
 	if (o["oldResourceRetained"] !== void 0 && typeof o["oldResourceRetained"] !== "boolean") fail("oldResourceRetained", o["oldResourceRetained"], "a boolean when present");
+	if (o["physicalIdRecoveredFromError"] !== void 0 && typeof o["physicalIdRecoveredFromError"] !== "boolean") fail("physicalIdRecoveredFromError", o["physicalIdRecoveredFromError"], "a boolean when present");
+	if (o["physicalIdRecoveredFromError"] !== void 0 && o["changeType"] !== "CREATE") refuseMalformed(shownStack, `${where}.physicalIdRecoveredFromError is only valid on a CREATE (got changeType ${kind(o["changeType"])}).`);
+	if (o["deletionPolicy"] !== void 0 && ![
+		"Delete",
+		"Retain",
+		"Snapshot",
+		"RetainExceptOnCreate"
+	].includes(o["deletionPolicy"])) fail("deletionPolicy", o["deletionPolicy"], "one of Delete, Retain, Snapshot, RetainExceptOnCreate when present");
 	if (o["previousResourceType"] !== void 0 && typeof o["previousResourceType"] !== "string") fail("previousResourceType", o["previousResourceType"], "a string when present");
 }
 function kind(v) {
@@ -6151,13 +6159,13 @@ function nanIfUncoercible(value) {
 //#endregion
 //#region src/deployment/secret-redaction/rules.ts
 const MIN_NEEDLE_LENGTH = 4;
-function escapeRegExp$1(value) {
+function escapeRegExp$2(value) {
 	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function buildNeedleRegex(values) {
 	const needles = Array.from(new Set(values)).filter((v) => v.length >= 4).sort((a, b) => b.length - a.length);
 	if (needles.length === 0) return void 0;
-	return new RegExp(needles.map(escapeRegExp$1).join("|"), "g");
+	return new RegExp(needles.map(escapeRegExp$2).join("|"), "g");
 }
 const TEMPLATE_DERIVED_RULES = {
 	descendArrays: true,
@@ -7323,7 +7331,7 @@ function intrinsicSkeletonPattern(source) {
 	return anchoredSkeletonPattern(segments);
 }
 function anchoredSkeletonPattern(segments) {
-	const body = joinSkeletonSegments(segments.map((segment) => segment === UNKNOWN_PART ? SKELETON_WILDCARD : escapeRegExp$1(segment)));
+	const body = joinSkeletonSegments(segments.map((segment) => segment === UNKNOWN_PART ? SKELETON_WILDCARD : escapeRegExp$2(segment)));
 	return body === void 0 ? void 0 : new RegExp(`^${body}$`);
 }
 const UNKNOWN_PART = Symbol("unknown intrinsic part");
@@ -9129,6 +9137,77 @@ function isAuxiliaryFailure(error) {
 	} catch {}
 	return false;
 }
+const CREATED_BEFORE_FAILURE = Symbol.for("cdkd.createdBeforeFailure");
+function markCreatedBeforeFailure(error, ownerLogicalId, resourceType, physicalId) {
+	try {
+		if (typeof error !== "object" || error === null || !Object.isExtensible(error)) return error;
+		if (physicalId === "") return error;
+		Object.defineProperty(error, CREATED_BEFORE_FAILURE, {
+			value: Object.freeze({
+				logicalId: ownerLogicalId,
+				resourceType,
+				physicalId
+			}),
+			enumerable: false,
+			writable: false,
+			configurable: true
+		});
+	} catch {}
+	return error;
+}
+function createdMarkOn(link) {
+	const value = link[CREATED_BEFORE_FAILURE];
+	if (typeof value !== "object" || value === null) return void 0;
+	const { logicalId, resourceType, physicalId } = value;
+	if (typeof logicalId !== "string" || typeof resourceType !== "string" || typeof physicalId !== "string" || physicalId === "") return;
+	return {
+		logicalId,
+		resourceType,
+		physicalId
+	};
+}
+function createdBeforeFailure(error, logicalId, resourceType) {
+	try {
+		let current = error;
+		for (let depth = 0; depth < 10 && typeof current === "object" && current !== null; depth++) {
+			const mark = createdMarkOn(current);
+			if (mark) return mark.logicalId === logicalId && mark.resourceType === resourceType ? mark.physicalId : void 0;
+			const own = Object.getOwnPropertyDescriptor(current, "logicalId");
+			if (typeof own?.value === "string" && own.value !== logicalId && !isAuxiliaryMarkOf(current, logicalId)) return;
+			current = current.cause;
+		}
+	} catch {}
+}
+function hasCreatedBeforeFailure(error) {
+	try {
+		let current = error;
+		for (let depth = 0; depth < 10 && typeof current === "object" && current !== null; depth++) {
+			if (createdMarkOn(current)) return true;
+			current = current.cause;
+		}
+	} catch {}
+	return false;
+}
+function carryCreatedBeforeFailure(from, to) {
+	try {
+		if (typeof to !== "object" || to === null) return to;
+		let current = from;
+		let mark;
+		for (let depth = 0; depth < 10 && typeof current === "object" && current !== null && !mark; depth++) {
+			mark = createdMarkOn(current);
+			current = current.cause;
+		}
+		if (!mark) return to;
+		let probe = to;
+		for (let depth = 0; depth < 10 && typeof probe === "object" && probe !== null; depth++) {
+			if (createdMarkOn(probe)) return to;
+			probe = probe.cause;
+		}
+		return markCreatedBeforeFailure(to, mark.logicalId, mark.resourceType, mark.physicalId);
+	} catch {
+		return to;
+	}
+}
 function markAuxiliaryFailure(error, ownerLogicalId) {
 	try {
 		let current = error;
@@ -9175,11 +9254,14 @@ async function withRetry(operation, logicalId, opts = {}) {
 	let nameCooldownSleptMs = 0;
 	let serverErrorRetries = 0;
 	let replayMayCollide = false;
+	let previousError;
 	const settle = (error) => replayMayCollide ? markReplayMayCollide(markAuxiliaryFailure(error, RETRY_AUXILIARY_OWNER)) : error;
 	for (let attempt = 0; attempt <= attemptCeiling; attempt++) try {
 		return await operation();
 	} catch (error) {
 		lastError = error;
+		const carried = carryCreatedBeforeFailure(previousError, error);
+		if (hasCreatedBeforeFailure(carried) || !hasCreatedBeforeFailure(previousError)) previousError = carried;
 		if (isAuxiliaryFailure(error) || hasReplayMayCollide(error) || isAmbiguousOutcomeError(error)) replayMayCollide = true;
 		const message = describeAwsFailure(error).detail;
 		const classifyText = retryClassificationText(error);
@@ -15663,6 +15745,16 @@ function malformedDestroyResourceEntriesRefusalMessage(rawStackName, rawRegion,
 	const region = absentIfEmpty(rawRegion);
 	return `${namedEntriesClause(stackName, region, logicalIds)} 'cdkd destroy' DELETES what this map names, so it refuses rather than continuing: a null row stops the run on a bare TypeError in the listing above the prompt; a false, 0 or empty-string row is SKIPPED as 'not found in state' and the record removed with its resource still live in AWS; and any other row it cannot read, unless its own deletion policy retains it, is routed to a provider on whatever its type field holds — nothing, or a non-string — with a physical id nothing checked, so its delete either fails on a type-lookup error that names the row but not what is wrong with its record, after every readable row not retained was deleted, or is counted done, the record removed and success reported with its resource still live. Nothing was deleted or written FOR THIS STACK. Repair the row first; 'cdkd state orphan' drops the whole record with every resource left standing, which is more than this row asks for. ${inspectClause(stackName, region, recovery)}Inspect the record with: ` + inspectCommand(stackName, region, recovery);
 }
+function refuseMalformedResourcePropertiesForDestroy(state, stackName, region, recovery) {
+	const unreadable = unreadableResourcePropertyBags(state);
+	if (unreadable.length === 0) return;
+	throw markNonRetryable(new CdkdError(malformedDestroyResourcePropertiesRefusalMessage(stackName, region, unreadable, recovery), STATE_RESOURCES_MALFORMED));
+}
+function malformedDestroyResourcePropertiesRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return `${namedPropertyBagsDiagnosis(stackName, region, logicalIds)} 'cdkd destroy' hands that map to the resource's delete, which reads keys off it — whether an RDS DB instance takes a final snapshot, whether an ECR repository is emptied first — so it refuses rather than continuing: the provider would get the torn value as it stands, and reading the map as EMPTY answers each of those keys as absent, a delete that fails or takes the wrong branch after every resource ordered before it was deleted. Nothing was deleted or written FOR THIS STACK. Repair the map first; 'cdkd state orphan' drops the whole record with every resource left standing, which is more than this asks for. ${inspectClause(stackName, region, recovery)}Inspect the record with: ` + inspectCommand(stackName, region, recovery);
+}
 function refuseMalformedResourceEntriesForImport(state, reimportedLogicalIds, stackName, region, recovery) {
 	const reimported = new Set(reimportedLogicalIds);
 	const unreadable = unreadableResourceEntries(state).filter((id) => !reimported.has(id));
@@ -21381,13 +21473,13 @@ function resolvesReference(desired, previous, mask) {
 		rest = rest.slice(at + token.length);
 	}
 	literals.push(rest);
-	const pattern = literals.map(escapeRegExp).join("[\\s\\S]*");
+	const pattern = literals.map(escapeRegExp$1).join("[\\s\\S]*");
 	return new RegExp(`^${pattern}$`).test(desired);
 }
 function isPlainObject$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function escapeRegExp(text) {
+function escapeRegExp$1(text) {
 	return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
@@ -21795,7 +21887,10 @@ function isCcConflict(error) {
 }
 var CloudControlProvider = class {
 	cloudControlClient;
-	logger = getLogger().child("CloudControlProvider");
+	baseLogger = getLogger().child("CloudControlProvider");
+	get logger() {
+		return idLogScope.getStore() ?? this.baseLogger;
+	}
 	patchGenerator = new JsonPatchGenerator();
 	warnedUnresolvableSchemaTypes = /* @__PURE__ */ new Set();
 	protectionFlips = new ProtectionFlipRegistry();
@@ -21810,7 +21905,12 @@ var CloudControlProvider = class {
 		const awsClients = getAwsClients();
 		this.cloudControlClient = awsClients.cloudControl;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
+		const mask = maskerOrIdentity(context?.maskSecrets);
+		const idLog = new IdScrubLog(this.logger, mask, holdsSecretDerivedLeaf(properties, mask));
+		return inIdLogScope(idLog, () => this.createInIdLogScope(logicalId, resourceType, properties, idLog));
+	}
+	async createInIdLogScope(logicalId, resourceType, properties, idLog) {
 		this.logger.debug(`Creating resource ${logicalId} (${resourceType})`);
 		try {
 			const ccProperties = stringifyJsonProperties(resourceType, stripNullValues(properties));
@@ -21824,6 +21924,7 @@ var CloudControlProvider = class {
 			this.logger.debug(`Create request submitted for ${logicalId}, token: ${createResponse.ProgressEvent.RequestToken}`);
 			const progressEvent = await this.waitForOperation(createResponse.ProgressEvent.RequestToken, logicalId, "CREATE", resourceType);
 			if (!progressEvent.Identifier) throw new ProvisioningError(`Failed to create resource ${logicalId}: No physical ID returned`, resourceType, logicalId);
+			idLog.addId(progressEvent.Identifier);
 			this.logger.debug(`Created resource ${logicalId}, physical ID: ${progressEvent.Identifier}`);
 			const result = { physicalId: progressEvent.Identifier };
 			if (progressEvent.ResourceModel) result.attributes = this.parseResourceModel(progressEvent.ResourceModel);
@@ -21831,6 +21932,7 @@ var CloudControlProvider = class {
 			result.attributes = await this.enrichResourceAttributes(resourceType, progressEvent.Identifier, result.attributes);
 			return result;
 		} catch (error) {
+			idLog.addId(identifierCarriedBy(error));
 			await this.cleanupFailedCreateRemnant(error, resourceType, logicalId);
 			this.handleError(error, "CREATE", resourceType, logicalId);
 		}
@@ -21851,7 +21953,10 @@ var CloudControlProvider = class {
 		} catch (cleanupError) {
 			const message = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
 			if (isWaitAbandonedError(cleanupError)) {
-				this.logger.warn(`Could not confirm whether the remnant ${error.physicalId} left by the failed CREATE of ${logicalId} was removed (a retry may fail with AlreadyExists until it is removed manually): ${displaySafe(message)}`);
+				const line = `Could not confirm whether the remnant ${error.physicalId} left by the failed CREATE of ${logicalId} was removed (a retry may fail with AlreadyExists until it is removed manually): ${displaySafe(message)}`;
+				const log = this.logger;
+				if (log instanceof IdScrubLog) log.warnKeepingResume(line, abandonedRequestTokens(cleanupError));
+				else log.warn(line);
 				return;
 			}
 			if (isNotFoundMessage(message)) {
@@ -21862,7 +21967,12 @@ var CloudControlProvider = class {
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
-		const idLog = updateIdLogSink(this.logger, physicalId, properties, previousProperties, context?.maskSecrets);
+		const mask = maskerOrIdentity(context?.maskSecrets);
+		const idLog = new IdScrubLog(this.logger, mask, holdsSecretDerivedLeaf(properties, mask) || holdsSecretDerivedLeaf(previousProperties, mask));
+		idLog.addId(physicalId);
+		return inIdLogScope(idLog, () => this.updateInIdLogScope(logicalId, physicalId, resourceType, properties, previousProperties, context, idLog));
+	}
+	async updateInIdLogScope(logicalId, physicalId, resourceType, properties, previousProperties, context, idLog) {
 		idLog.debug(`Updating resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		await this.assertRecordedRegionAgainstClient("pre-update", context?.expectedRegion, resourceType, logicalId, physicalId);
 		try {
@@ -21936,26 +22046,41 @@ var CloudControlProvider = class {
 			this.handleError(error, "UPDATE", resourceType, logicalId, physicalId);
 		}
 	}
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
+	async delete(logicalId, physicalId, resourceType, properties, context) {
+		const mask = maskerOrIdentity(void 0);
+		const idLog = new IdScrubLog(this.logger, mask, holdsSecretDerivedLeaf(properties, mask));
+		idLog.addId(physicalId);
+		const result = await inIdLogScope(idLog, () => this.deleteInIdLogScope(logicalId, physicalId, resourceType, properties, context));
+		if (!idLog.withheld || !result) return result;
+		return {
+			...result,
+			...result.outcome === "skipped" && { reason: idLog.scrub(result.reason) },
+			...Array.isArray(result.indeterminateGuards) && { indeterminateGuards: result.indeterminateGuards.map((guard) => ({
+				...guard,
+				reason: idLog.scrub(guard.reason)
+			})) }
+		};
+	}
+	async deleteInIdLogScope(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		await this.assertRecordedRegionAgainstClient("pre-delete", context?.expectedRegion, resourceType, logicalId, physicalId);
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DQkUXvQl.js");
+			const { ASGProvider } = await import("./asg-provider-CbwOK2TQ.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
 				asgProvider = new ASGProvider();
 				this.asgDeleteDelegates.set(delegateRegion, asgProvider);
 			}
-			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
+			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, properties, context), indeterminateGuard);
 		}
 		if ((context?.deletionPolicy === "Delete" || context?.skipFinalSnapshot === true) && SDK_DELETE_FAMILIES.has(resourceType)) {
-			if (deletesThroughSdkProvider(resourceType, _properties)) {
+			if (deletesThroughSdkProvider(resourceType, properties)) {
 				const delegate = await this.sdkDeleteDelegateInCcRegion(resourceType, logicalId, physicalId);
-				return withIndeterminateGuard(await delegate.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
+				return withIndeterminateGuard(await delegate.delete(logicalId, physicalId, resourceType, properties, context), indeterminateGuard);
 			}
 			this.logger.warn(safeMsg`${logicalId} (${resourceType}) records a GlobalClusterIdentifier cdkd cannot detach it from, so it is deleted through ` + `Cloud Control, which handles the global-cluster membership. Its handler ` + safeMsg`can take a manual final snapshot of ${physicalId}, which cdkd does not record; ` + `delete it yourself if you do not want it.`);
 		}
@@ -22049,7 +22174,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-xB2NA923.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-B51VlQxH.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-COCDd7bS.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-TnGNCeLX.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -22752,20 +22877,94 @@ var CloudControlProvider = class {
 		return masked;
 	}
 };
-function updateIdLogSink(logger, physicalId, properties, previousProperties, maskSecrets) {
-	const mask = maskerOrIdentity(maskSecrets);
-	const raw = updateIdWithheld(properties, previousProperties, mask) ? [physicalId, ...physicalId.split("|")].filter((needle) => needle !== "") : [];
-	const masked = raw.map((needle) => mask(needle));
-	const needles = [.../* @__PURE__ */ new Set([...raw, ...masked.filter((m, i) => m !== "" && m !== raw[i] && m !== "***")])].sort((a, b) => b.length - a.length);
-	const scrub = (message) => needles.reduce((text, needle) => text.split(needle).join("***"), mask(message));
-	return {
-		debug: (message) => logger.debug(scrub(message)),
-		warn: (message) => logger.warn(scrub(message)),
-		withheld: needles.length > 0
-	};
+var IdScrubLog = class {
+	needles = [];
+	base;
+	mask;
+	evidence;
+	constructor(base, mask, evidence) {
+		this.base = base;
+		this.mask = mask;
+		this.evidence = evidence;
+	}
+	get withheld() {
+		return this.needles.length > 0;
+	}
+	addId(id) {
+		if (!this.evidence || id === void 0 || id === "") return;
+		const parts = [id, ...id.split("|")].filter((needle) => needle !== "");
+		const raw = [...new Set(parts.flatMap((part) => [
+			part,
+			displaySafe(part),
+			displaySafe(part, { asciiOnly: true })
+		]))].filter((needle) => needle !== "" && needle !== "***");
+		const masked = raw.map((needle) => this.mask(needle));
+		this.needles = [.../* @__PURE__ */ new Set([
+			...this.needles,
+			...raw,
+			...masked.filter((m, i) => m !== "" && m !== raw[i] && m !== "***")
+		])].sort((a, b) => b.length - a.length);
+	}
+	scrub = (text) => this.needles.reduce((out, needle) => out.split(needle).join("***"), this.mask(text));
+	scrubKeepingResume(text, requestTokens) {
+		const tokens = requestTokens.filter((token) => token !== "");
+		if (tokens.length === 0) return this.scrub(text);
+		const keep = new RegExp(`(${[RESUME_COMMAND.source, ...tokens.map(escapeRegExp)].join("|")})`);
+		return text.split(keep).map((segment, i) => i % 2 === 1 ? this.mask(segment) : this.scrub(segment)).join("");
+	}
+	scrubError(error) {
+		if (this.needles.length === 0 || !(error instanceof Error)) return error;
+		const original = errorCauseChain(error);
+		const tokens = abandonedRequestTokens(error);
+		const scrubbed = maskSecretsInError(error, /* @__PURE__ */ new Map(), (text) => this.scrubKeepingResume(text, tokens));
+		const clones = errorCauseChain(scrubbed);
+		original.forEach((link, i) => {
+			const clone = clones[i];
+			if (clone === void 0 || clone === link) return;
+			for (const key of VERBATIM_ERROR_FIELDS) {
+				const descriptor = Object.getOwnPropertyDescriptor(link, key);
+				if (descriptor === void 0 || typeof descriptor.value !== "string") continue;
+				try {
+					Object.defineProperty(clone, key, descriptor);
+				} catch {}
+			}
+		});
+		return scrubbed;
+	}
+	warnKeepingResume(message, requestTokens) {
+		this.base.warn(this.scrubKeepingResume(message, requestTokens));
+	}
+	debug(message) {
+		this.base.debug(this.scrub(message));
+	}
+	info(message) {
+		this.base.info(this.scrub(message));
+	}
+	warn(message) {
+		this.base.warn(this.scrub(message));
+	}
+	error(message) {
+		this.base.error(this.scrub(message));
+	}
+};
+const VERBATIM_ERROR_FIELDS = ["logicalId", "resourceType"];
+function escapeRegExp(text) {
+	return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+const RESUME_COMMAND = /aws(?: --profile (?:'(?:[^'\n]|'\\'')*'|\S+))? cloudcontrol get-resource-request-status --request-token \S+(?: --region \S+)?/;
+function abandonedRequestTokens(error) {
+	return error instanceof Error ? errorCauseChain(error).flatMap((link) => link instanceof CloudControlWaitAbandonedError ? [link.requestToken] : []) : [];
 }
-function updateIdWithheld(properties, previousProperties, mask) {
-	return holdsSecretDerivedLeaf(properties, mask) || holdsSecretDerivedLeaf(previousProperties, mask);
+const idLogScope = new AsyncLocalStorage();
+async function inIdLogScope(idLog, fn) {
+	try {
+		return await idLogScope.run(idLog, fn);
+	} catch (error) {
+		throw idLog.scrubError(error);
+	}
+}
+function identifierCarriedBy(error) {
+	return error instanceof ProvisioningError ? error.physicalId : void 0;
 }
 function holdsSecretDerivedLeaf(value, mask, depth = 0) {
 	if (typeof value === "string") return isSecretDerivedValue(value, mask);
@@ -28154,6 +28353,15 @@ function classifyFailedOp(op, stateResources) {
 	const current = stateResources[op.logicalId];
 	if (op.changeType === "CREATE") {
 		if (!op.physicalId) return "skip-failed-unknown";
+		if (op.physicalIdRecoveredFromError === false) return "skip-failed-superseded";
+		if (op.physicalIdRecoveredFromError === true) {
+			if (current) return current.physicalId === op.physicalId ? "skip-failed-noop" : "skip-failed-mismatch";
+			if (stateHoldsPhysicalId(stateResources, op.resourceType, op.physicalId)) return "skip-failed-noop";
+			const orphanPolicy = effectiveDeletionPolicy(op.resourceType, op.deletionPolicy, op.attemptedProperties);
+			if (orphanPolicy === "Retain") return "orphan-failed-create-retain";
+			if (orphanPolicy === "Snapshot") return "delete-failed-create-with-final-snapshot";
+			return "delete-failed-create";
+		}
 		if (!current) return "skip-failed-noop";
 		if (current.physicalId !== op.physicalId) return "skip-failed-mismatch";
 		const policy = effectiveDeletionPolicy(current.resourceType, current.deletionPolicy, current.properties);
@@ -28165,6 +28373,28 @@ function classifyFailedOp(op, stateResources) {
 	if (isTypeChangeOp(op)) return "skip-failed-type-change";
 	return "revert-failed-update";
 }
+function stateHoldsPhysicalId(stateResources, resourceType, physicalId) {
+	return Object.values(stateResources).some((r) => r?.resourceType === resourceType && r.physicalId === physicalId);
+}
+function demoteSupersededOrphans(segments, orphans = []) {
+	let demoted = 0;
+	segments.forEach((segment, s) => {
+		for (const op of segment.failedOperations ?? []) {
+			if (op.changeType !== "CREATE" || op.physicalIdRecoveredFromError !== true) continue;
+			if (segments.slice(s + 1).some((t) => (t.operations ?? []).some((o) => mayOwn(o, op, true)) || (t.failedOperations ?? []).some((o) => mayOwn(o, op, false))) || segments.slice(s).some((t) => t.supersededLogicalIds?.includes(op.logicalId) === true) || orphans.some((o) => o?.logicalId === op.logicalId || o?.state?.resourceType === op.resourceType && o.state?.physicalId === op.physicalId)) {
+				op.physicalIdRecoveredFromError = false;
+				demoted++;
+			}
+		}
+	});
+	return demoted;
+}
+function mayOwn(o, orphan, completed) {
+	if (o?.resourceType !== orphan.resourceType) return false;
+	if (completed && o.changeType === "CREATE") return true;
+	if (o.physicalId === orphan.physicalId) return true;
+	return o.previousState?.physicalId === orphan.physicalId;
+}
 function planFailedOps(failedOps, stateResources) {
 	return failedOps.map((op) => ({
 		op,
@@ -28997,6 +29227,10 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 					logger.warn(safeMsg`  Rollback: Skipping failed CREATE of ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}) — it recorded ${mask(String(op.physicalId))}, which is not the resource state tracks under this id; manual attention may be required`);
 					recordRollbackSkip(skipScope, op, "The failed CREATE recorded a physical id other than the one state now tracks under this logical id, so the rollback left it as it is; manual attention may be required.");
 					break;
+				case "skip-failed-superseded":
+					logger.warn(safeMsg`  Rollback: Skipping failed CREATE of ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}) — it created ${mask(String(op.physicalId))} before failing, and a later deploy or rollback may own a resource under that id now; if it is not in use, delete it manually`);
+					recordRollbackSkip(skipScope, op, "The failed CREATE created its resource before failing, but a later deploy or rollback may own a resource under that id now, so the rollback left it as it is; manual attention may be required.");
+					break;
 				case "skip-failed-unknown":
 					logger.warn(`  Rollback: failed CREATE of ${safe(op.logicalId)} (${safe(op.resourceType)}) recorded no physical id — if it was partially created in AWS, delete it manually`);
 					recordRollbackSkip(skipScope, op, "The failed CREATE recorded no physical id, so the rollback cannot address it; if it was partially created in AWS, delete it manually.");
@@ -29024,7 +29258,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 					}
 					delete stateResources[op.logicalId];
 					await noteRetainedResource(op.resourceType, op.logicalId);
-					logger.info(`  Rollback: leaving partially-created ${safe(op.logicalId)} (${safe(op.resourceType)}) in AWS (DeletionPolicy: Retain) — removed from state`);
+					logger.info(`  Rollback: leaving partially-created ${safe(op.logicalId)} (${safe(op.resourceType)}) in AWS (DeletionPolicy: Retain)` + (failedCreateRecord ? " — removed from state" : " — it was never in state"));
 					await options.afterOp?.(op.logicalId);
 					ctx.recordEvent?.({
 						eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
@@ -29165,7 +29399,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 				error: maskedRollbackEventError(revertError, mask)
 			});
 		}
-		inlinePolicyWriters.noteOutcome(op, action === "skip-failed-noop" || action === "skip-failed-mismatch" || ownRecord(stateResources, op.logicalId) !== recordBefore);
+		inlinePolicyWriters.noteOutcome(op, action === "skip-failed-noop" || action === "skip-failed-mismatch" || action === "skip-failed-superseded" || ownRecord(stateResources, op.logicalId) !== recordBefore);
 	}
 	if (result.interrupted) await restoreHeldInlinePolicies(inlinePolicyWriters, stateResources, stackName, ctx, result, { refuseAll: true });
 	if (emitEnvelope) ctx.recordEvent?.({
@@ -30850,6 +31084,7 @@ function priorAttemptsInJournal(journal, logicalId, resourceType) {
 }
 function recordedAsNewResource(op) {
 	if (typeof op.physicalId !== "string" || op.physicalId === "") return false;
+	if (op.physicalIdRecoveredFromError === true) return false;
 	if (op.changeType === "CREATE") return true;
 	const previous = op.previousState?.physicalId;
 	return typeof previous === "string" && previous !== op.physicalId;
@@ -34979,15 +35214,20 @@ async function executeDeployment(template, currentState, changes, dag, execution
 					this.interrupted = true;
 					this.interruptCause ??= "sibling-failure";
 					const refused = isRefusedBeforeApplying(provisionError, logicalId);
-					const physicalId = newResources[logicalId]?.physicalId ?? previousState?.physicalId;
-					if (refused && change.changeType === "CREATE" && physicalId === void 0) throw provisionError;
+					const statePhysicalId = newResources[logicalId]?.physicalId ?? previousState?.physicalId;
+					if (refused && change.changeType === "CREATE" && statePhysicalId === void 0) throw provisionError;
+					const createdId = change.changeType === "CREATE" && statePhysicalId === void 0 ? createdBeforeFailure(provisionError, logicalId, change.resourceType) : void 0;
 					failedOperations.push({
 						logicalId,
 						changeType: change.changeType,
 						resourceType: change.resourceType,
-						provisionedBy: newResources[logicalId]?.provisionedBy ?? previousState?.provisionedBy,
+						provisionedBy: createdId !== void 0 ? "sdk" : newResources[logicalId]?.provisionedBy ?? previousState?.provisionedBy,
 						...previousState && { previousState },
-						physicalId,
+						physicalId: createdId ?? statePhysicalId,
+						...createdId !== void 0 && {
+							physicalIdRecoveredFromError: true,
+							deletionPolicy: journaledOrphanPolicy(this.extractTemplateAttributes(template, logicalId).deletionPolicy)
+						},
 						...!refused && { attemptedProperties: this.attemptedResolvedProps.get(logicalId) }
 					});
 					throw provisionError;
@@ -35265,6 +35505,10 @@ async function persistStateAfterOutputFailure(stackName, currentState, newResour
 		}
 	}
 }
+function journaledOrphanPolicy(policy) {
+	if (policy === void 0) return void 0;
+	return policy === "Delete" || policy === "Retain" || policy === "Snapshot" || policy === "RetainExceptOnCreate" ? policy : "Retain";
+}
 
 //#endregion
 //#region src/provisioning/canonicalize-properties.ts
@@ -36654,5 +36898,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { resourcesNamingDeclaredParameter as $, wholeStringLeavesOf as $a, isWarmThroughputDecrease as $i, explicitRoleArnOrThrow as $n, partitionSensitiveEnv as $o, malformedOutputsWarning as $r, noEchoParameterValueSeed as $t, resolveDynamoDbDeleteBudgetClock as A, printingCorpusOf as Aa, repairMalformedOrphanRecordsForReadOnly as Ai, ccProtectionRegistryTypes as An, rewriteTemplateAssetReferences as Ao, STATE_REGION_DIVERGED as Ar, expectedOwnerParam as As, ccRoutedFinalSnapshotError as At, getPriorAttempts as B, scrubResourceRecord as Ba, findSilentDropProperties as Bi, isTerminationProtectionPropagationError as Bn, validateContainerRepoName as Bo, isReadableResourceEntry as Br, nullPrototypeRecord as Bs, updatePartialMessage as Bt, perType as C, inheritNestedStackParameterAssociations as Ca, refuseMalformedResourcePropertiesForDrift as Ci, ProviderRegistry as Cn, AssetPublisher as Co, isStalePlaceholderArnAttribute as Cr, CFN_TEMPLATE_BODY_LIMIT as Cs, resolveReplacementOldType as Ct, beginDeleteWait as D, hasMaskableValues as Da, refuseMalformedResourcesForDestroy as Di, getCurrentResourceSecrets as Dn, buildAssetRedirectMap as Do, parameterInputsFor as Dr, uploadCfnTemplate as Ds, ATOMIC_FINAL_SNAPSHOT_TYPES as Dt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as E, createUnionSecretMasker as Ea, refuseMalformedResourcesForDeploy as Ei, isCustomResourceType as En, WorkGraph as Eo, withSharedDrainBudget as Er, findLargeInlineResources as Es, inheritProducerRegions as Et, waitForIndexesSettled as F, errorCauseChain as Fa, repairMalformedResourcesForReadOnly as Fi, withIndeterminateGuard as Fn, getBootstrapMarkerKey as Fo, displayLogicalId as Fr, StageLoadError as Fs, unsupportedFinalSnapshotError as Ft, cyan as G, pathCrossesDottedKey as Ga, findReplacedReadersOfRecreateTargets as Gi, INTRINSIC_KEYS as Gn, describeDockerExecFailure as Go, malformedLocalResourceEntriesWarning as Gr, renderAssemblyPathEscape as Gs, WITHHELD_NAME_DISPLAY as Gt, formatResourceLine as H, DYNAMIC_REFERENCE_TOKEN_SCAN as Ha, withoutSilentDropProperties as Hi, reDisableInstanceApiTermination as Hn, buildDockerImage as Ho, malformedExportNamesWarning as Hr, absoluteAssemblyPathEscape as Hs, DeploymentEventsReader as Ht, ECR_AUTO_DELETE_IMAGES_TAG as I, maskSecretsInError as Ia, unpreviewableOrphanRecords as Ii, isWaitAbandonedError as In, isCrossRegionRedirect as Io, hasReadableOrphans as Ir, processStackMessages as Is, REDACTED_DELETE_ADDRESS_SKIP_REASON as It, red as J, provenPublicValue as Ja, isStatefulRecreateTargetForReplace as Ji, producerRegionsFromState as Jn, finchSecretArgvRefusal as Jo, malformedOrphanRecordsWarning as Jr, resolveBucketRegion as Js, secretBearing as Jt, gray as K, identityKeyFor as Ka, shownType as Ki, IntrinsicFunctionResolver as Kn, describeDockerFailure as Ko, malformedLocalResourcesWarning as Kr, resolveAssemblyPath as Ks, displayTextOrWithheld as Kt, S3_AUTO_DELETE_OBJECTS_TAG as L, maskSecretsInText as La, unreadableOrphanRecords as Li, markWaitAbandoned as Ln, parseBootstrapMarker as Lo, hasReadableOutputs as Lr, defineOwnKey as Ls, isRedactedRecordedValue as Lt, DELETE_INDEX_WAIT_PROCEED_NOTE as M, recordLogOnlyValue as Ma, repairMalformedOutputsForReadOnly as Mi, UNSPECIFIED_SKIP_REASON as Mn, BOOTSTRAP_MARKER_PREFIX as Mo, UNREADABLE_ORPHANS_CONTAINER_ROW as Mr, canonicalizeRegion as Ms, effectiveDeletionPolicy as Mt, INDEX_SETTLE_POLL_INTERVAL_MS as N, shareLogOnlyValues as Na, repairMalformedResourceEntriesForReadOnly as Ni, deleteIndeterminateGuards as Nn, assertAssetBucketRegion as No, UNREADABLE_RESOURCES_MAP_ROW as Nr, derivePartitionAndUrlSuffix as Ns, isFinalSnapshotError as Nt, compensateRemovedDeletionProtection as O, literalSplitDelimitersOf as Oa, refuseMalformedResourcesForExport as Oi, CloudControlProvider as On, createAssetRedirectResolver as Oo, passedParameterClassesOf as Or, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Os, PRE_DELETE_SNAPSHOT_TYPES as Ot, deleteTableWithIndexBusyRetry as P, createSecretMasker as Pa, repairMalformedResourcePropertiesForReadOnly as Pi, deleteSkipReason as Pn, ensureAssetStorage as Po, deployRefusesOrphanRowsReason as Pr, AssemblyReader as Ps, refusesFinalSnapshot as Pt, reachableDivergentParameters as Q, recordProvenPublicExpression as Qa, coerceWarmThroughput as Qi, assertSendableRoleArn as Qn, isMalformedEnvKey as Qo, malformedOutputsRefusalMessage as Qr, isWholeDynamicReferenceValue as Qt, hasCdkAutoDeleteTag as R, markSameGenerationBag as Ra, unreadableResourceEntries as Ri, disableInstanceApiTermination as Rn, readBootstrapMarkerBody as Ro, hasReadableResources as Rr, hasOwnKey as Rs, redactedDeleteAddressFields as Rt, isProtectionValueActive as S, liveMatchesUnresolvedTokenFrame as Sa, refuseMalformedResourceEntriesForOrphan as Si, CC_BROKEN_REASON as Sn, shouldRetainResource as So, cfnRefValueFromPhysicalId as Sr, ssmResolvedValueType as Ss, planRollback as St, DynamoDBGlobalTableProvider as T, carryLogOnlyValues as Ta, refuseMalformedResourcePropertiesForOrphan as Ti, wouldReturnToSdkProvider as Tn, stringifyValue as To, parseWebACLArn as Tr, MIGRATE_TMP_PREFIX as Ts, getCurrentProducerRegions as Tt, createReadOnlyAttributeHealerFactory as U, dynamicReferenceTokens as Ua, NO_CC_HANDLERS_REASON as Ui, reEnableInstanceApiTermination as Un, resolveDockerContextDirectory as Uo, malformedExportSourceWarning as Ur, describeFileReadFailure as Us, DeploymentEventsStore as Ut, markRefusedBeforeApplying as V, recoverMaskedOutput as Va, unwrittenCreateOnlyReplacement as Vi, observeThenDisableInstanceApiTermination as Vn, buildDenyExternalAccessPolicy as Vo, malformedDriftResourcePropertiesWarning as Vr, ownValue as Vs, updatePartialReason as Vt, bold as W, isUncertifiedBaselineMaskPosition as Wa, hasNoCloudControlHandlers as Wi, DiffCalculator as Wn, describeDockerCapturedOutput as Wo, malformedLocalOutputsWarning as Wr, displayAssemblyPath as Ws, extractDeploymentEventError as Wt, computeParameterTaint as X, recordMaskOnlyValuesIn as Xa, renderStatefulReason as Xi, applyRoleArnIfSet as Xn, getDockerCmd as Xo, malformedOrphansRefusalMessage as Xr, secretSafeKeyDisplay as Xt, yellow as Y, recordMaskOnlyValue as Ya, isStatefulRecreateTargetSync as Yi, regionLessSecretName as Yn, formatDockerLoginError as Yo, malformedOrphanRowsKeptWarning as Yr, secretBearingStateKeyWarning as Yt, namesAnyDeclaredParameter as Z, recordNoEchoAttributeValues as Za, WARM_THROUGHPUT_MEMBERS as Zi, assertFlagRoleArn as Zn, isDockerClientEnvKey as Zo, malformedOrphansWarning as Zr, exportNameSecretExposure as Zt, makeCanonicalizePropertiesFn as _, canonicalLambdaFunctionName as _a, refuseMalformedResourceEntries as _i, refuseMalformedDesiredTags as _n, importableOutputKeys as _o, carriesDynamicReference as _r, resolveStateBucketWithDefault as _s, destroyStackRecordsView as _t, findNestedTemplateTreeDefect as a, configIntegerRefusal as aa, malformedStateRefusalMessage as ai, DEFAULT_RESOURCE_WARN_AFTER_MS as an, isSingleDynamicReferenceToken as ao, envCredentialsAreAssumedRole as ar, escapeRegExp$2 as as, dropSettledNestedJournals as at, recordedProtectionNote as b, DagBuilder as ba, refuseMalformedResourceEntriesForImport as bi, definedAttributes as bn, orphansAfterRollback as bo, keepsSecretReferenceToken as br, stateBucketExistenceConfirmed as bs, recordAfterRollbackUpdate as bt, renderNestedTemplateTreeDefect as c, replayWarn as ca, refuseMalformedNestedChildOutputs as ci, earliestDefined as cn, S3StateBackend as co, s3BucketDomainName as cr, getDockerImageBySourceHash as cs, recordDisplacedSkips as ct, conditionInputsFrom as d, requireConfigString as da, refuseMalformedOrphans as di, withCreateTokenLedger as dn, acceptedCreateOnlyDropsOf as do, s3BucketWebsiteUrl as dr, getDefaultStateBucketName as ds, withNestedRevertRun as dt, toCfnInteger as ea, malformedRenderedContainersWarning as ei, collectDeclaredOutputNames as en, STATE_SOURCED_BASELINE_RULES as eo, isIamRoleArn as er, redactDockerArgvValues as es, makeSiblingClaimReader as et, parentSuppliedValues as f, prefetchCreateOnlyPropertyPaths as fa, refuseMalformedOrphansForDestroy as fi, acquireIdempotencyToken as fn, describeRegionValueKind as fo, coerceParameterTypedValue as fr, getLegacyStateBucketName as fs, getCurrentNestedStackContext as ft, mergeNoChangeOutputs as g, markAuxiliaryFailure as ga, refuseMalformedResourceAttributesForOrphan as gi, readTagList as gn, hasUnverifiableParameterRefusal as go, isImpossibleEmptyStoredAttribute as gr, resolveSkipPrefix as gs, awaitInFlightSibling as gt, keptWholeReasonText as h, withRetry as ha, refuseMalformedOutputsForDestroy as hi, planTagDiff as hn, hasReasonlessBaselineRefusal as ho, getAccountInfo as hr, resolveCaptureObservedState as hs, replayRollback as ht, childTemplateLoader as i, configBooleanRefusal as ia, malformedScrubResourceEntriesRefusalMessage as ii, DEFAULT_RESOURCE_TIMEOUT_MS as in, WHOLE_DYNAMIC_REFERENCE_PATTERN as io, callerEnvCredentials as ir, warnFinchArgvExposure as is, displacedPhysicalIdShown as it, resolveDynamoDbDeleteBudgetMs as j, recordLogOnlyParameterValue as ja, repairMalformedOrphansForReadOnly as ji, unchangedBehindSecretReference as jn, AssetModeResolver as jo, STATE_RESOURCES_MALFORMED as jr, PARTITION_TABLE as js, createPreDeleteFinalSnapshot as jt, deleteBudgetKey as k, logOnlyValueCount as ka, refuseMalformedState as ki, slowCcOperationTimeoutMs as kn, loadPublishableAssetManifest as ko, JSON_LISTING_HOLE_VALUE as kr, decodeListingKey as ks, buildFinalSnapshotIdentifier as kt, templateIdentity as l, requireConfigArray as la, refuseMalformedOrphanRecords as li, ledgerForStack as ln, rebuildClientForBucketRegion as lo, s3BucketDualStackDomainName as lr, Synthesizer as ls, revertNestedChildFromJournal as lt, isSecretBearingReferenceString as m, describeTypeWithThrottleRetry as ma, refuseMalformedOutputs as mi, DBPROXY_TAG_OPTIONS as mn, hasReadableExportSet as mo, parameterTypeMayLoseSecretIdentity as mr, resolveAutoAssetStorage as ms, replayFailedOperations as mt, IMPLICIT_DELETE_DEPENDENCIES as n, coerceCfnBoolean as na, malformedResourcePropertiesWarning as ni, isExportAliasCollision as nn, STATE_SOURCED_READBACK_RULES as no, AWS_CREDENTIAL_ENV_KEYS as nr, runDockerForeground as ns, NESTED_PENDING_PARENT_REASON as nt, isAbsoluteAssetPath as o, configStringRefusal as oa, previewableOrphanRecords as oi, maskingRetryLogger as on, LockManager as oo, isSettledInstanceState as or, stripControlChars as os, getNestedRevertRun as ot, readRecordedConditionVerdicts as p, templateResourceTypes as pa, refuseMalformedOrphansForOrphan as pi, DBPROXY_TAGS_WHAT as pn, exportNamesCarriedFrom as po, isUnboundTemplateParameter as pr, resolveApp as ps, withNestedStackContext as pt, green as q, carriesSecretMask as qa, MULTI_REGION_RECREATE_BLOCKED_TYPES as qi, classifyReplaySecretRegion as qn, dockerSpawnEnvWithSensitive as qo, malformedOrphanRecordsRefusalMessage as qr, clearBucketRegionCache as qs, exportAliasCollisionScrubWarning as qt, computeImplicitDeleteEdges as r, coerceCfnInteger as ra, malformedResourcesWarning as ri, bindingSkippedOutputs as rn, TEMPLATE_SOURCED_RULES as ro, applyCallerIdentityCredentials as rr, runDockerStreaming as rs, displacedOpClause as rt, listNestedTemplateRows as s, readConfigString as sa, refuseDivergentRecordRegionForDestroy as si, RollbackInlinePolicyWriters as sn, isLockInfoExpired as so, s3BucketArn as sr, AssetManifestLoader as ss, nestedChildStackName as st, DeployEngine as t, toFiniteNumber as ta, malformedResourceEntriesWarning as ti, collectPublishedOutputNames as tn, STATE_SOURCED_CROSS_GENERATION_RULES as to, sendableAssumeRoleCommand as tr, redactedDockerCause as ts, planOrphanAdoption as tt, conditionFingerprint as u, requireConfigObject as ua, refuseMalformedOrphanRecordsForDestroy as ui, reserveStackCreateToken as un, splitImportedOps as uo, s3BucketRegionalDomainName as ur, synthesisStatusMessage as us, revertedNestedRowIds as ut, withResourceDeadline as v, lambdaFunctionNameForMask as va, refuseMalformedResourceEntriesForDeploy as vi, tagMapAsList as vn, importableOutputs as vo, carriesFetchableDynamicReference as vr, resolveStateBucketWithDefaultAndSource as vs, getStackRecords as vt, readProtection as w, recordNestedStackParameterExpressions as wa, refuseMalformedResourcePropertiesForExport as wi, ccBrokenReason as wn, isSensitiveAttributeName as wo, refStateLookupFromResource as wr, CFN_TEMPLATE_URL_LIMIT as ws, findNestedStackTypeChanges as wt, PROTECTION_PROPERTY_BY_TYPE as x, TemplateParser as xa, refuseMalformedResourceEntriesForImportSave as xi, stringifyIfAssigned as xn, orphansCarriedFrom as xo, AWS_NO_VALUE as xr, warnDeprecatedNoPrefixCliFlag as xs, planFailedOps as xt, recordedProtectionEvidence as y, sameLambdaFunctionAddress as ya, refuseMalformedResourceEntriesForDestroy as yi, tagPlanWarning as yn, isReadableBag as yo, isNamelessDynamicReferenceError as yr, resolveUseCdkBootstrapAssets as ys, withStackRecords as yt, isTruthyCfnBoolean as z, redactSecretsForState as za, findActionableSilentDrops as zi, ec2InstanceProtectionSite as zn, validateAssetBucketName as zo, isReadableOrphanRecord as zr, hasPlainPrototype$1 as zs, redactedDeleteAddressSkip as zt };
-//# sourceMappingURL=deploy-engine--YvYB0qw.js.map
+export { resourcesNamingDeclaredParameter as $, recordMaskOnlyValuesIn as $a, WARM_THROUGHPUT_MEMBERS as $i, assertSendableRoleArn as $n, getDockerCmd as $o, malformedOutputsRefusalMessage as $r, isWholeDynamicReferenceValue as $t, resolveDynamoDbDeleteBudgetClock as A, hasMaskableValues as Aa, refuseMalformedResourcesForExport as Ai, slowCcOperationTimeoutMs as An, buildAssetRedirectMap as Ao, JSON_LISTING_HOLE_VALUE as Ar, uploadCfnTemplate as As, buildFinalSnapshotIdentifier as At, getPriorAttempts as B, maskSecretsInText as Ba, unreadableResourceEntries as Bi, ec2InstanceProtectionSite as Bn, parseBootstrapMarker as Bo, isReadableOrphanRecord as Br, defineOwnKey as Bs, redactedDeleteAddressSkip as Bt, perType as C, DagBuilder as Ca, refuseMalformedResourceEntriesForOrphan as Ci, CC_BROKEN_REASON as Cn, orphansAfterRollback as Co, cfnRefValueFromPhysicalId as Cr, stateBucketExistenceConfirmed as Cs, planRollback as Ct, beginDeleteWait as D, recordNestedStackParameterExpressions as Da, refuseMalformedResourcePropertiesForOrphan as Di, isCustomResourceType as Dn, isSensitiveAttributeName as Do, withSharedDrainBudget as Dr, CFN_TEMPLATE_URL_LIMIT as Ds, inheritProducerRegions as Dt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as E, inheritNestedStackParameterAssociations as Ea, refuseMalformedResourcePropertiesForExport as Ei, wouldReturnToSdkProvider as En, AssetPublisher as Eo, parseWebACLArn as Er, CFN_TEMPLATE_BODY_LIMIT as Es, getCurrentProducerRegions as Et, waitForIndexesSettled as F, recordLogOnlyValue as Fa, repairMalformedResourceEntriesForReadOnly as Fi, deleteSkipReason as Fn, BOOTSTRAP_MARKER_PREFIX as Fo, deployRefusesOrphanRowsReason as Fr, canonicalizeRegion as Fs, refusesFinalSnapshot as Ft, cyan as G, DYNAMIC_REFERENCE_TOKEN_SCAN as Ga, NO_CC_HANDLERS_REASON as Gi, DiffCalculator as Gn, buildDockerImage as Go, malformedLocalOutputsWarning as Gr, absoluteAssemblyPathEscape as Gs, extractDeploymentEventError as Gt, formatResourceLine as H, redactSecretsForState as Ha, findSilentDropProperties as Hi, observeThenDisableInstanceApiTermination as Hn, validateAssetBucketName as Ho, malformedDriftResourcePropertiesWarning as Hr, hasPlainPrototype$1 as Hs, updatePartialReason as Ht, ECR_AUTO_DELETE_IMAGES_TAG as I, shareLogOnlyValues as Ia, repairMalformedResourcePropertiesForReadOnly as Ii, withIndeterminateGuard as In, assertAssetBucketRegion as Io, displayLogicalId as Ir, derivePartitionAndUrlSuffix as Is, unsupportedFinalSnapshotError as It, red as J, pathCrossesDottedKey as Ja, shownType as Ji, classifyReplaySecretRegion as Jn, describeDockerExecFailure as Jo, malformedOrphanRecordsRefusalMessage as Jr, renderAssemblyPathEscape as Js, exportAliasCollisionScrubWarning as Jt, gray as K, dynamicReferenceTokens as Ka, hasNoCloudControlHandlers as Ki, INTRINSIC_KEYS as Kn, resolveDockerContextDirectory as Ko, malformedLocalResourceEntriesWarning as Kr, describeFileReadFailure as Ks, WITHHELD_NAME_DISPLAY as Kt, S3_AUTO_DELETE_OBJECTS_TAG as L, createSecretMasker as La, repairMalformedResourcesForReadOnly as Li, isWaitAbandonedError as Ln, ensureAssetStorage as Lo, hasReadableOrphans as Lr, AssemblyReader as Ls, REDACTED_DELETE_ADDRESS_SKIP_REASON as Lt, DELETE_INDEX_WAIT_PROCEED_NOTE as M, logOnlyValueCount as Ma, repairMalformedOrphanRecordsForReadOnly as Mi, unchangedBehindSecretReference as Mn, loadPublishableAssetManifest as Mo, STATE_RESOURCES_MALFORMED as Mr, decodeListingKey as Ms, createPreDeleteFinalSnapshot as Mt, INDEX_SETTLE_POLL_INTERVAL_MS as N, printingCorpusOf as Na, repairMalformedOrphansForReadOnly as Ni, UNSPECIFIED_SKIP_REASON as Nn, rewriteTemplateAssetReferences as No, UNREADABLE_ORPHANS_CONTAINER_ROW as Nr, expectedOwnerParam as Ns, effectiveDeletionPolicy as Nt, compensateRemovedDeletionProtection as O, carryLogOnlyValues as Oa, refuseMalformedResourcesForDeploy as Oi, getCurrentResourceSecrets as On, stringifyValue as Oo, parameterInputsFor as Or, MIGRATE_TMP_PREFIX as Os, ATOMIC_FINAL_SNAPSHOT_TYPES as Ot, deleteTableWithIndexBusyRetry as P, recordLogOnlyParameterValue as Pa, repairMalformedOutputsForReadOnly as Pi, deleteIndeterminateGuards as Pn, AssetModeResolver as Po, UNREADABLE_RESOURCES_MAP_ROW as Pr, PARTITION_TABLE as Ps, isFinalSnapshotError as Pt, reachableDivergentParameters as Q, recordMaskOnlyValue as Qa, renderStatefulReason as Qi, assertFlagRoleArn as Qn, formatDockerLoginError as Qo, malformedOrphansWarning as Qr, exportNameSecretExposure as Qt, hasCdkAutoDeleteTag as R, errorCauseChain as Ra, unpreviewableOrphanRecords as Ri, markWaitAbandoned as Rn, getBootstrapMarkerKey as Ro, hasReadableOutputs as Rr, StageLoadError as Rs, isRedactedRecordedValue as Rt, isProtectionValueActive as S, sameLambdaFunctionAddress as Sa, refuseMalformedResourceEntriesForImportSave as Si, stringifyIfAssigned as Sn, isReadableBag as So, AWS_NO_VALUE as Sr, resolveUseCdkBootstrapAssets as Ss, planFailedOps as St, DynamoDBGlobalTableProvider as T, liveMatchesUnresolvedTokenFrame as Ta, refuseMalformedResourcePropertiesForDrift as Ti, ccBrokenReason as Tn, shouldRetainResource as To, refStateLookupFromResource as Tr, ssmResolvedValueType as Ts, findNestedStackTypeChanges as Tt, createReadOnlyAttributeHealerFactory as U, scrubResourceRecord as Ua, unwrittenCreateOnlyReplacement as Ui, reDisableInstanceApiTermination as Un, validateContainerRepoName as Uo, malformedExportNamesWarning as Ur, nullPrototypeRecord as Us, DeploymentEventsReader as Ut, markRefusedBeforeApplying as V, markSameGenerationBag as Va, findActionableSilentDrops as Vi, isTerminationProtectionPropagationError as Vn, readBootstrapMarkerBody as Vo, isReadableResourceEntry as Vr, hasOwnKey as Vs, updatePartialMessage as Vt, bold as W, recoverMaskedOutput as Wa, withoutSilentDropProperties as Wi, reEnableInstanceApiTermination as Wn, buildDenyExternalAccessPolicy as Wo, malformedExportSourceWarning as Wr, ownValue as Ws, DeploymentEventsStore as Wt, computeParameterTaint as X, carriesSecretMask as Xa, isStatefulRecreateTargetForReplace as Xi, regionLessSecretName as Xn, dockerSpawnEnvWithSensitive as Xo, malformedOrphanRowsKeptWarning as Xr, clearBucketRegionCache as Xs, secretBearingStateKeyWarning as Xt, yellow as Y, identityKeyFor as Ya, MULTI_REGION_RECREATE_BLOCKED_TYPES as Yi, producerRegionsFromState as Yn, describeDockerFailure as Yo, malformedOrphanRecordsWarning as Yr, resolveAssemblyPath as Ys, secretBearing as Yt, namesAnyDeclaredParameter as Z, provenPublicValue as Za, isStatefulRecreateTargetSync as Zi, applyRoleArnIfSet as Zn, finchSecretArgvRefusal as Zo, malformedOrphansRefusalMessage as Zr, resolveBucketRegion as Zs, secretSafeKeyDisplay as Zt, makeCanonicalizePropertiesFn as _, withRetry as _a, refuseMalformedResourceAttributesForOrphan as _i, readTagList as _n, hasReadableExportSet as _o, isImpossibleEmptyStoredAttribute as _r, resolveAutoAssetStorage as _s, destroyStackRecordsView as _t, findNestedTemplateTreeDefect as a, coerceCfnInteger as aa, malformedScrubResourceEntriesRefusalMessage as ai, DEFAULT_RESOURCE_TIMEOUT_MS as an, STATE_SOURCED_READBACK_RULES as ao, callerEnvCredentials as ar, runDockerForeground as as, dropSettledNestedJournals as at, recordedProtectionNote as b, canonicalLambdaFunctionName as ba, refuseMalformedResourceEntriesForDestroy as bi, tagPlanWarning as bn, importableOutputKeys as bo, isNamelessDynamicReferenceError as br, resolveStateBucketWithDefault as bs, recordAfterRollbackUpdate as bt, renderNestedTemplateTreeDefect as c, configStringRefusal as ca, refuseDivergentRecordRegionForDestroy as ci, RollbackInlinePolicyWriters as cn, isSingleDynamicReferenceToken as co, s3BucketArn as cr, escapeRegExp$3 as cs, recordDisplacedSkips as ct, conditionInputsFrom as d, requireConfigArray as da, refuseMalformedOrphanRecordsForDestroy as di, reserveStackCreateToken as dn, S3StateBackend as do, s3BucketRegionalDomainName as dr, getDockerImageBySourceHash as ds, withNestedRevertRun as dt, coerceWarmThroughput as ea, malformedOutputsWarning as ei, noEchoParameterValueSeed as en, recordNoEchoAttributeValues as eo, explicitRoleArnOrThrow as er, isDockerClientEnvKey as es, makeSiblingClaimReader as et, parentSuppliedValues as f, requireConfigObject as fa, refuseMalformedOrphans as fi, withCreateTokenLedger as fn, rebuildClientForBucketRegion as fo, s3BucketWebsiteUrl as fr, Synthesizer as fs, getCurrentNestedStackContext as ft, mergeNoChangeOutputs as g, describeTypeWithThrottleRetry as ga, refuseMalformedOutputsForDestroy as gi, planTagDiff as gn, exportNamesCarriedFrom as go, getAccountInfo as gr, resolveApp as gs, awaitInFlightSibling as gt, keptWholeReasonText as h, templateResourceTypes as ha, refuseMalformedOutputs as hi, DBPROXY_TAG_OPTIONS as hn, describeRegionValueKind as ho, parameterTypeMayLoseSecretIdentity as hr, getLegacyStateBucketName as hs, replayRollback as ht, childTemplateLoader as i, coerceCfnBoolean as ia, malformedResourcesWarning as ii, bindingSkippedOutputs as in, STATE_SOURCED_CROSS_GENERATION_RULES as io, applyCallerIdentityCredentials as ir, redactedDockerCause as is, displacedPhysicalIdShown as it, resolveDynamoDbDeleteBudgetMs as j, literalSplitDelimitersOf as ja, refuseMalformedState as ji, ccProtectionRegistryTypes as jn, createAssetRedirectResolver as jo, STATE_REGION_DIVERGED as jr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as js, ccRoutedFinalSnapshotError as jt, deleteBudgetKey as k, createUnionSecretMasker as ka, refuseMalformedResourcesForDestroy as ki, CloudControlProvider as kn, WorkGraph as ko, passedParameterClassesOf as kr, findLargeInlineResources as ks, PRE_DELETE_SNAPSHOT_TYPES as kt, templateIdentity as l, readConfigString as la, refuseMalformedNestedChildOutputs as li, earliestDefined as ln, LockManager as lo, s3BucketDomainName as lr, stripControlChars as ls, revertNestedChildFromJournal as lt, isSecretBearingReferenceString as m, prefetchCreateOnlyPropertyPaths as ma, refuseMalformedOrphansForOrphan as mi, DBPROXY_TAGS_WHAT as mn, acceptedCreateOnlyDropsOf as mo, isUnboundTemplateParameter as mr, getDefaultStateBucketName as ms, replayFailedOperations as mt, IMPLICIT_DELETE_DEPENDENCIES as n, toCfnInteger as na, malformedResourceEntriesWarning as ni, collectPublishedOutputNames as nn, wholeStringLeavesOf as no, sendableAssumeRoleCommand as nr, partitionSensitiveEnv as ns, NESTED_PENDING_PARENT_REASON as nt, isAbsoluteAssetPath as o, configBooleanRefusal as oa, malformedStateRefusalMessage as oi, DEFAULT_RESOURCE_WARN_AFTER_MS as on, TEMPLATE_SOURCED_RULES as oo, envCredentialsAreAssumedRole as or, runDockerStreaming as os, getNestedRevertRun as ot, readRecordedConditionVerdicts as p, requireConfigString as pa, refuseMalformedOrphansForDestroy as pi, acquireIdempotencyToken as pn, splitImportedOps as po, coerceParameterTypedValue as pr, synthesisStatusMessage as ps, withNestedStackContext as pt, green as q, isUncertifiedBaselineMaskPosition as qa, findReplacedReadersOfRecreateTargets as qi, IntrinsicFunctionResolver as qn, describeDockerCapturedOutput as qo, malformedLocalResourcesWarning as qr, displayAssemblyPath as qs, displayTextOrWithheld as qt, computeImplicitDeleteEdges as r, toFiniteNumber as ra, malformedResourcePropertiesWarning as ri, isExportAliasCollision as rn, STATE_SOURCED_BASELINE_RULES as ro, AWS_CREDENTIAL_ENV_KEYS as rr, redactDockerArgvValues as rs, displacedOpClause as rt, listNestedTemplateRows as s, configIntegerRefusal as sa, previewableOrphanRecords as si, maskingRetryLogger as sn, WHOLE_DYNAMIC_REFERENCE_PATTERN as so, isSettledInstanceState as sr, warnFinchArgvExposure as ss, nestedChildStackName as st, DeployEngine as t, isWarmThroughputDecrease as ta, malformedRenderedContainersWarning as ti, collectDeclaredOutputNames as tn, recordProvenPublicExpression as to, isIamRoleArn as tr, isMalformedEnvKey as ts, planOrphanAdoption as tt, conditionFingerprint as u, replayWarn as ua, refuseMalformedOrphanRecords as ui, ledgerForStack as un, isLockInfoExpired as uo, s3BucketDualStackDomainName as ur, AssetManifestLoader as us, revertedNestedRowIds as ut, withResourceDeadline as v, markAuxiliaryFailure as va, refuseMalformedResourceEntries as vi, refuseMalformedDesiredTags as vn, hasReasonlessBaselineRefusal as vo, carriesDynamicReference as vr, resolveCaptureObservedState as vs, getStackRecords as vt, readProtection as w, TemplateParser as wa, refuseMalformedResourcePropertiesForDestroy as wi, ProviderRegistry as wn, orphansCarriedFrom as wo, isStalePlaceholderArnAttribute as wr, warnDeprecatedNoPrefixCliFlag as ws, resolveReplacementOldType as wt, PROTECTION_PROPERTY_BY_TYPE as x, lambdaFunctionNameForMask as xa, refuseMalformedResourceEntriesForImport as xi, definedAttributes as xn, importableOutputs as xo, keepsSecretReferenceToken as xr, resolveStateBucketWithDefaultAndSource as xs, demoteSupersededOrphans as xt, recordedProtectionEvidence as y, markCreatedBeforeFailure as ya, refuseMalformedResourceEntriesForDeploy as yi, tagMapAsList as yn, hasUnverifiableParameterRefusal as yo, carriesFetchableDynamicReference as yr, resolveSkipPrefix as ys, withStackRecords as yt, isTruthyCfnBoolean as z, maskSecretsInError as za, unreadableOrphanRecords as zi, disableInstanceApiTermination as zn, isCrossRegionRedirect as zo, hasReadableResources as zr, processStackMessages as zs, redactedDeleteAddressFields as zt };
+//# sourceMappingURL=deploy-engine-DG-oC9YK.js.map