@go-to-k/cdkd 0.294.8 → 0.294.10

package/dist/{deploy-engine-C5kAhscq.js → deploy-engine-RCOtmm4V.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js"
 import { A as displaySafe, E as UNRENDERABLE, F as safeMsg, L as truncateCodePoints, M as isPasteableIdent, O as displayAwsMessage, P as plainIdentOr, S as withoutGeneratedFallbackName, T as STACK_REF_MAX_CODE_POINTS, _ as getCurrentSkipPrefix, b as withSkipPrefix, c as getLiveRenderer, f as applyDefaultNameForFallback, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, m as explicitNamePropertyFor, n as getLogger, r as isStdoutReservedForPayload, s as installLogLineMaskerSource, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS, x as withStackName, y as looksLikeCdkdGeneratedName } from "./logger-B46YMG0h.js";
 import { $t as StateError, A as isTerminalDeleteFailure, An as isAmbiguousCcHandlerErrorCode, At as clientDefaultsFor, Bn as isMarkedNonRetryable, Bt as IntrinsicResolutionRefusalError, C as refusalTypeShown, Cn as isNameCollisionErrorFrom, D as ProtectionFlipRegistry, Dt as withPasteableAwsProfile, En as isReplayedNameCollisionFrom, Fn as retryClassificationText, Gt as MalformedProducerRecordRefusalError, H as pasteableAwsCommand, Hn as markNonRetryable, In as describeAwsFailure, It as CrossAccountSecretRefusalError, J as isInterruptedWaitError, Jt as ProvisioningError, Lt as DependencyError, M as observeThenDisableProtection, Mn as isIamPropagationError, Mt as AccountIdUnavailableError, N as protectionFlipKey, Nn as isRetryableTransientError, Nt as AssetError, O as compensateProtectionFlip, On as markReplayMayCollide, Ot as ambientClientDefaults, Pn as isTransientServerError, Pt as CdkdError, Q as canonicalizeRoute53QueryName, R as DELETION_PROTECTION_DOC_POINTER, Rn as safeStringify$1, S as quotedRemedyLogicalId, Sn as hasReplayMayCollide, St as injectiveKey, T as resolveExplicitPhysicalId, Tn as isRecreateRetryableError, Tt as producerRecordKey, U as protectedReplacementAdvice, Un as markRedactedCause, Ut as LockError, Vn as isThrottlingError, Wn as wrapMaskedAwsError, Wt as MacroExpansionError, X as ElapsedBudgetRegistry, Xt as ResourceUpdateNotSupportedError, Y as startInterruptWatch, Yt as ResourceTimeoutError, Z as monotonicNowMs, _n as shellQuote, _t as formatLockOperation, at as segmentAfterAnchor, b as isQuotableImportValue, bt as CUSTOM_RESOURCE_RESPONSE_PREFIX, cn as UNSHOWABLE_VALUE, ct as isSecretDerivedValue, d as prepareRemovalForUpdate, dn as isInertUnquoted, dt as withDerivedNameMasks, en as SynthesisError, et as compositeIdSeparatorRefusal, f as removalWarning, fn as pasteableCommand, ft as UNREPRODUCIBLE_LOCK_CLAUSE, g as assertRegionMatch, gn as shellBoundedDisplay, gt as formatLockExpiry, h as RESOURCE_NOT_FOUND, hn as quotedOrDescribed, i as holdsSecretDerivedEntry, it as resourceTypeShown, jn as isAmbiguousOutcomeError, jt as credentialFingerprint, k as deleteWithProtectionCompensation, kn as formatRetryClassificationSignals, kt as ambientCredentialConfig, l as withUnchangedSecretPrincipalLists, ln as commandHole, lt as maskDeep, m as withoutInjectedRemovals, mn as plainOrDescribed, nt as logicalIdShown, on as SHELL_ACTIVE, ot as createMaskedLogSinks, pn as physicalIdShownBesideCommand, pt as buildForceUnlockCommand, rn as normalizeAwsError, sn as SHELL_ACTIVE_WHY, st as createMaskedRetryLogger, ut as maskerOrIdentity, vn as withheldTargetClause, vt as formatLockOwner, wn as isNameCooldownError, x as normalizeAwsTagsToCfn, xn as isUpdateUnsupportedError, xt as DEFAULT_STATE_PREFIX, yt as sanitizeRecoveryValue, zt as DynamicReferenceRegionAmbiguousError } from "./iam-policy-targets-CMSQGQnm.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-DGxZ-zFN.js";
+import { t as getCdkdVersion } from "./version-BNo3JdVW.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4645,6 +4645,12 @@ function importableOutputKeys(state) {
 	if (state.exportNames === void 0) return Object.keys(outputs);
 	return state.exportNames.filter((name) => typeof name === "string" && Object.hasOwn(outputs, name));
 }
+function acceptedCreateOnlyDropsOf(record) {
+	if (record === null || typeof record !== "object") return /* @__PURE__ */ new Set();
+	const value = record.acceptedCreateOnlyDrops;
+	if (!Array.isArray(value)) return /* @__PURE__ */ new Set();
+	return new Set(value.filter((entry) => typeof entry === "string"));
+}
 function hasReadableExportSet(state) {
 	if (!isReadableBag(state.outputs)) return false;
 	if (state.exportNames === void 0) return true;
@@ -6077,18 +6083,24 @@ function isPlainObject$3(value) {
 
 //#endregion
 //#region src/deployment/secret-redaction/mask-only.ts
-const recordedSecretExpressions$1 = /* @__PURE__ */ new Set();
-function recordSecretExpression(expression) {
-	recordedSecretExpressions$1.add(expression);
+const recordedSecretExpressions = /* @__PURE__ */ new Set();
+const secretVerdictScopes = /* @__PURE__ */ new Map();
+function pinScopedSecretVerdict(scope, expression, secret) {
+	const scopes = secretVerdictScopes.get(expression);
+	if (secret) {
+		if (scopes) scopes.add(scope);
+		else secretVerdictScopes.set(expression, /* @__PURE__ */ new Set([scope]));
+		recordedSecretExpressions.add(expression);
+		return;
+	}
+	if (scopes?.delete(scope) && scopes.size === 0) secretVerdictScopes.delete(expression);
+	recordedSecretExpressions.delete(expression);
 }
-function forgetSecretExpression(expression) {
-	recordedSecretExpressions$1.delete(expression);
+function isScopedSecretVerdict(scope, expression) {
+	return secretVerdictScopes.get(expression)?.has(scope) === true;
 }
 function isRecordedSecretExpression(expression) {
-	return recordedSecretExpressions$1.has(expression);
-}
-function clearRecordedSecretExpressions() {
-	recordedSecretExpressions$1.clear();
+	return recordedSecretExpressions.has(expression);
 }
 function recordMaskOnlyValue(secrets, plaintext) {
 	if (plaintext.length < 4) return;
@@ -6542,12 +6554,11 @@ function positionByRecordedParameterSpans(bag, source, secrets, associations) {
 	let persisted = "";
 	const gaps = [];
 	const certified = [];
-	for (const { start, length, parameter } of recorded) {
+	for (const { start, length, key } of recorded) {
 		if (!(start >= previousEnd && length > 0 && start + length <= bag.length)) return void 0;
 		previousEnd = start + length;
 		const text = bag.slice(start, start + length);
-		const key = crossStackSourceKey({ Ref: parameter });
-		const association = key === void 0 ? void 0 : associations.get(key);
+		const association = associations.get(key);
 		if (association === void 0 || typeof association === "symbol") continue;
 		const expression = certifiedExpressionForLeaf(secrets, association, text);
 		if (expression === void 0) continue;
@@ -7201,7 +7212,7 @@ function positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions) {
 	if (!pattern) return void 0;
 	const plaintextOf = plaintextIndexOf(secrets);
 	let matched;
-	for (const candidate of /* @__PURE__ */ new Set([...secretExpressions, ...recordedSecretExpressions$1])) {
+	for (const candidate of /* @__PURE__ */ new Set([...secretExpressions, ...recordedSecretExpressions])) {
 		if (candidate.length > MAX_SKELETON_CANDIDATE_LENGTH) return void 0;
 		if (!pattern.test(candidate)) continue;
 		const recordedPlaintext = plaintextOf.get(candidate);
@@ -7259,7 +7270,7 @@ function positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIs
 	let matched;
 	for (const candidate of /* @__PURE__ */ new Set([
 		...secretExpressions,
-		...recordedSecretExpressions$1,
+		...recordedSecretExpressions,
 		...resolvedExpressionsOf(secrets)
 	])) {
 		if (candidate.length > MAX_SKELETON_CANDIDATE_LENGTH) return void 0;
@@ -7327,10 +7338,10 @@ function recordIntrinsicLeafResolution(secrets, source, resolution) {
 			secret
 		})),
 		complete: resolution.complete,
-		...resolution.parameterSpans === void 0 ? {} : { parameterSpans: resolution.parameterSpans.map(({ start, length, parameter }) => ({
+		...resolution.parameterSpans === void 0 ? {} : { parameterSpans: resolution.parameterSpans.map(({ start, length, key }) => ({
 			start,
 			length,
-			parameter
+			key
 		})) }
 	};
 	const previous = leaves.get(source);
@@ -7359,7 +7370,7 @@ function sameLeafResolution(a, b) {
 }
 function sameParameterSpans(a, b) {
 	if (a === void 0 || b === void 0) return a === b;
-	return a.length === b.length && a.every((s, i) => s.start === b[i].start && s.length === b[i].length && s.parameter === b[i].parameter);
+	return a.length === b.length && a.every((s, i) => s.start === b[i].start && s.length === b[i].length && s.key === b[i].key);
 }
 function substitutedSpellingOf(secrets, source, resolvedValue) {
 	const resolution = intrinsicLeafResolutionsOf.get(secrets)?.get(source);
@@ -10063,8 +10074,8 @@ const REVERSE_REPLACEMENT_NAME_KEYS = {
 	"AWS::Glue::Job": flat("Name"),
 	"AWS::Glue::SecurityConfiguration": flat("Name"),
 	"AWS::Glue::Table": {
-		name: [["TableInput", "Name"]],
-		scope: [["DatabaseName"]]
+		name: [["TableInput", "Name"], ["Name"]],
+		scope: [["DatabaseName"], ["CatalogId"]]
 	},
 	"AWS::Glue::Trigger": flat("Name"),
 	"AWS::Glue::Workflow": flat("Name"),
@@ -10137,6 +10148,8 @@ const CASE_INSENSITIVE_NAME_TYPES = /* @__PURE__ */ new Set([
 	"AWS::RDS::DBInstance",
 	"AWS::RDS::DBSubnetGroup"
 ]);
+const ASCII_CASE_INSENSITIVE_NAME_TYPES = /* @__PURE__ */ new Set(["AWS::Glue::Table"]);
+const NO_PHYSICAL_ID_NAME_PROOF = /* @__PURE__ */ new Set(["AWS::Glue::Table"]);
 const GENERATED_NAME_VERBATIM = /* @__PURE__ */ new Set([
 	"AWS::CloudWatch::Alarm",
 	"AWS::DocDB::DBCluster",
@@ -10566,16 +10579,18 @@ function holderVerdict(input, v) {
 	}
 	if (namePath === void 0 || wantName === void 0) return unproven(`${v.create} named no ${labels} (its provider picks one), so cdkd cannot show that ${newResource} holds it`);
 	const wanted = generatedName ? `${v.create} named no ${labels}, and the cdkd naming rule generates ${r.shown(namePath.join("."))} ${r.quoted(wantName)} for it` : `${v.create} asked for ${r.shown(namePath.join("."))} ${r.quoted(wantName)}`;
-	const same = CASE_INSENSITIVE_NAME_TYPES.has(oldResourceType) ? (a, b) => a.toLowerCase() === b.toLowerCase() : (a, b) => a === b;
-	const inCase = CASE_INSENSITIVE_NAME_TYPES.has(oldResourceType) ? (value) => value.toLowerCase() : (value) => value;
-	const drifted = newKey.name.find((path) => {
-		const recordedName = valueAt(recorded, path);
-		const observedName = valueAt(observed, path);
-		return recordedName !== void 0 && observedName !== void 0 && !same(recordedName, observedName);
+	const asciiFold = ASCII_CASE_INSENSITIVE_NAME_TYPES.has(oldResourceType);
+	const inCase = CASE_INSENSITIVE_NAME_TYPES.has(oldResourceType) ? (value) => value.toLowerCase() : asciiFold ? (value) => value.replace(/[A-Z]/g, (c) => c.toLowerCase()) : (value) => value;
+	const same = (a, b) => inCase(a) === inCase(b);
+	const namePathHeld = newKey.name.find((path) => {
+		const h = heldAt(recorded, observed, path);
+		return h.value !== void 0 || h.unreadable;
 	});
-	if (drifted !== void 0) return unproven(`${wanted}, and the records of ${newResource} disagree on its ${r.shown(drifted.join("."))} (recorded ${r.quoted(valueAt(recorded, drifted) ?? "")}, read back ${r.quoted(valueAt(observed, drifted) ?? "")}), so cdkd cannot show which name it holds`);
-	const haveName = newKey.name.map((path) => heldAt(recorded, observed, path)).find((h) => h.value !== void 0)?.value;
-	if (!(haveName !== void 0 && same(haveName, wantName) || physicalId !== "" && holderIdNames(inCase(physicalId), inCase(wantName)))) return haveName !== void 0 && !generatedName ? elsewhere(`${wanted}, while ${newResource} holds ${r.quoted(haveName)}`) : unproven(`${wanted}, and cdkd cannot show that ${newResource} holds that name`);
+	const recordedName = namePathHeld && valueAt(recorded, namePathHeld);
+	const observedName = namePathHeld && valueAt(observed, namePathHeld);
+	if (namePathHeld !== void 0 && recordedName !== void 0 && observedName !== void 0 && !same(recordedName, observedName)) return unproven(`${wanted}, and the records of ${newResource} disagree on its ${r.shown(namePathHeld.join("."))} (recorded ${r.quoted(recordedName)}, read back ${r.quoted(observedName)}), so cdkd cannot show which name it holds`);
+	const haveName = namePathHeld === void 0 ? void 0 : heldAt(recorded, observed, namePathHeld).value;
+	if (!(haveName !== void 0 && same(haveName, wantName) || physicalId !== "" && !NO_PHYSICAL_ID_NAME_PROOF.has(newResourceType) && holderIdNames(inCase(physicalId), inCase(wantName)))) return haveName !== void 0 && !generatedName ? elsewhere(`${wanted}, while ${newResource} holds ${r.quoted(haveName)}`) : unproven(`${wanted}, and cdkd cannot show that ${newResource} holds that name`);
 	for (const [i, path] of (oldKey.scope ?? []).entries()) {
 		const label = r.shown(path.join("."));
 		const wantRaw = valueAt(requested, path);
@@ -14841,6 +14856,29 @@ function excludeCreateOnly(resourceType, names) {
 	if (createOnly === void 0 || createOnly.size === 0) return names;
 	return names.filter((property) => !createOnly.has(property));
 }
+function withoutUnwrittenSilentDropProperties(resourceType, recordedProperties, desiredProperties, allowedKeys, evidence) {
+	const drops = findSilentDropProperties(resourceType, recordedProperties);
+	if (drops.length === 0) return recordedProperties;
+	const createOnly = getPropertyCoverage(resourceType)?.createOnlyDrops;
+	const accepted = new Set(findAcceptedSilentDrops(resourceType, desiredProperties, allowedKeys, recordedProperties));
+	const removable = drops.map(({ property }) => property).filter((property) => createOnly?.has(property) !== true || evidence.has(property) && !accepted.has(property));
+	if (removable.length === 0) return recordedProperties;
+	const narrowed = { ...recordedProperties };
+	for (const property of removable) delete narrowed[property];
+	return narrowed;
+}
+function findUnwrittenCreateOnlyDrops(resourceType, recordedProperties, desiredProperties, allowedKeys, evidence) {
+	const createOnly = getPropertyCoverage(resourceType)?.createOnlyDrops;
+	if (createOnly === void 0 || createOnly.size === 0 || evidence.size === 0) return [];
+	const accepted = new Set(findAcceptedSilentDrops(resourceType, desiredProperties, allowedKeys, recordedProperties));
+	return findSilentDropProperties(resourceType, recordedProperties).map(({ property }) => property).filter((property) => createOnly.has(property) && evidence.has(property) && !accepted.has(property) && Object.hasOwn(desiredProperties, property) && sameJsonValue(recordedProperties[property], desiredProperties[property], "unchanged"));
+}
+function unwrittenCreateOnlyReplacement(resourceType, recordedProperties, desiredProperties, allowedKeys, evidence, replacingPaths) {
+	if (replacingPaths.length === 0) return [];
+	const unwritten = findUnwrittenCreateOnlyDrops(resourceType, recordedProperties, desiredProperties, allowedKeys, evidence);
+	if (unwritten.length === 0) return [];
+	return replacingPaths.every((path) => unwritten.includes(path)) ? unwritten : [];
+}
 function unsupportedPropertyIssueUrl(resourceType, property) {
 	return `https://github.com/go-to-k/cdkd/issues/new?title=${encodeURIComponent(`Support property ${resourceType}.${property}`)}&labels=resource-support`;
 }
@@ -15645,6 +15683,120 @@ function malformedOrphansForOrphanRefusalMessage(rawStackName, rawRegion, logica
 	return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read — ${namedOrphanRows(logicalIds)} — because the record has no string 'logicalId' or shares it with another row, or its 'state' is not an object, names no resource type, has no non-empty string 'physicalId', or holds a 'properties' or 'attributes' map that is not an object. The record is malformed or truncated. ${verbatim} Those records are not inert: they are what the next 'cdkd deploy' may re-adopt into 'resources' and what 'cdkd diff' previews for adoption, so continuing would report success over damage the next command meets.`, "'cdkd orphan' cannot remove such a record itself: it is not in 'resources', so it has no construct path. Repair the record by hand rather than deleting it — it is the only record that an earlier failed deploy left its resource live in AWS.", ORPHANS_DROP_CAVEAT);
 }
 
+//#endregion
+//#region src/deployment/masked-property-fingerprints.ts
+const FINGERPRINT_LAYOUT$1 = 1;
+function canonicalJson$2(value) {
+	if (value === void 0) return "null";
+	if (Array.isArray(value)) return `[${value.map(canonicalJson$2).join(",")}]`;
+	if (value !== null && typeof value === "object") {
+		const record = value;
+		return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson$2(record[key])}`).join(",")}}`;
+	}
+	return JSON.stringify(value) ?? "null";
+}
+const REFUSED_FINGERPRINT = "refused:secret-in-template";
+const FINGERPRINT_PREFIX = "sha256:";
+function templateCarriesNeedle(templateValue, secrets) {
+	const text = canonicalJson$2(templateValue);
+	for (const needle of printingCorpusOf(secrets).keys()) {
+		if (needle.length < 4) continue;
+		if (text.includes(needle) || text.includes(JSON.stringify(needle).slice(1, -1))) return true;
+	}
+	return false;
+}
+function maskedPropertyFingerprint(templateValue) {
+	const digest = createHash("sha256").update(canonicalJson$2({
+		layout: FINGERPRINT_LAYOUT$1,
+		value: templateValue
+	})).digest("hex");
+	return `${FINGERPRINT_PREFIX}${digest}`;
+}
+function maskedPropertyFingerprintsFor(recordedProperties, templateProps) {
+	const entries = [];
+	for (const key of Object.keys(recordedProperties)) {
+		if (!Object.hasOwn(templateProps, key)) continue;
+		if (!carriesSecretMask(recordedProperties[key])) continue;
+		entries.push([key, maskedPropertyFingerprint(templateProps[key])]);
+	}
+	return entries.length > 0 ? Object.fromEntries(entries) : void 0;
+}
+function maskedPropertyFingerprintsOf(record) {
+	const read = /* @__PURE__ */ new Map();
+	if (record === null || typeof record !== "object") return read;
+	const field = record.maskedPropertyFingerprints;
+	if (field === null || typeof field !== "object" || Array.isArray(field)) return read;
+	for (const [key, value] of Object.entries(field)) if (typeof value === "string" && value.startsWith(FINGERPRINT_PREFIX)) read.set(key, value);
+	return read;
+}
+function movedMaskedProperties(record, templateProps) {
+	const recorded = maskedPropertyFingerprintsOf(record);
+	if (recorded.size === 0) return [];
+	const properties = record.properties;
+	if (properties === null || typeof properties !== "object") return [];
+	const moved = [];
+	for (const [key, fingerprint] of recorded) {
+		if (!Object.hasOwn(templateProps, key) || !Object.hasOwn(properties, key)) continue;
+		if (!carriesSecretMask(properties[key])) continue;
+		if (maskedPropertyFingerprint(templateProps[key]) !== fingerprint) moved.push(key);
+	}
+	return moved;
+}
+const writtenFromDeployedTemplate = /* @__PURE__ */ new WeakSet();
+function markWrittenFromDeployedTemplate(bag) {
+	writtenFromDeployedTemplate.add(bag);
+	return bag;
+}
+function withMaskedPropertyFingerprints(scrubbed, writtenBag, templateProps, secrets, noEchoParameterValues) {
+	if (templateProps === void 0) return scrubbed;
+	const corpora = [secrets, noEchoParameterValues].filter((corpus) => corpus !== void 0);
+	const written = writtenBag !== null && typeof writtenBag === "object" && writtenFromDeployedTemplate.has(writtenBag);
+	const { maskedPropertyFingerprints: previous, ...rest } = scrubbed;
+	let fingerprints;
+	if (written) fingerprints = maskedPropertyFingerprintsFor(scrubbed.properties, templateProps);
+	else {
+		if (previous === void 0 || previous === null || typeof previous !== "object") return scrubbed;
+		if (corpora.length === 0) return scrubbed;
+		fingerprints = { ...previous };
+	}
+	if (fingerprints !== void 0 && corpora.length > 0) {
+		const refused = Object.keys(fingerprints).filter((key) => Object.hasOwn(templateProps, key) && corpora.some((corpus) => templateCarriesNeedle(templateProps[key], corpus)));
+		if (refused.length > 0) fingerprints = Object.fromEntries(Object.entries(fingerprints).map(([key, value]) => [key, refused.includes(key) ? REFUSED_FINGERPRINT : value]));
+	}
+	if (!written && JSON.stringify(fingerprints) === JSON.stringify(previous)) return scrubbed;
+	return fingerprints === void 0 ? rest : {
+		...rest,
+		maskedPropertyFingerprints: fingerprints
+	};
+}
+function backfillMaskedPropertyFingerprints(resources, template, noEchoParameterValues) {
+	const declared = template?.Resources;
+	if (declared === void 0 || declared === null) return 0;
+	let stamped = 0;
+	for (const [logicalId, record] of Object.entries(resources)) {
+		if (record === null || typeof record !== "object") continue;
+		const field = record.maskedPropertyFingerprints;
+		if (field !== void 0 && (field === null || typeof field !== "object" || Array.isArray(field))) continue;
+		const existing = field ?? {};
+		if (!Object.hasOwn(declared, logicalId)) continue;
+		const definition = declared[logicalId];
+		if (definition === void 0 || definition.Type !== record.resourceType) continue;
+		const properties = record.properties;
+		if (properties === null || typeof properties !== "object" || Array.isArray(properties)) continue;
+		const fingerprints = maskedPropertyFingerprintsFor(properties, definition.Properties ?? {});
+		if (fingerprints === void 0) continue;
+		const templateProps = definition.Properties ?? {};
+		const added = Object.entries(fingerprints).filter(([key]) => !Object.hasOwn(existing, key)).map(([key, value]) => noEchoParameterValues !== void 0 && templateCarriesNeedle(templateProps[key], noEchoParameterValues) ? [key, REFUSED_FINGERPRINT] : [key, value]);
+		if (added.length === 0) continue;
+		resources[logicalId] = {
+			...record,
+			maskedPropertyFingerprints: Object.fromEntries([...Object.entries(existing), ...added])
+		};
+		stamped++;
+	}
+	return stamped;
+}
+
 //#endregion
 //#region src/deployment/drain-budget.ts
 const drainDeadlines = new AsyncLocalStorage();
@@ -15975,12 +16127,6 @@ function isDeliberateResolutionRefusal(err) {
 }
 const cachedAccountIdentities = /* @__PURE__ */ new Map();
 const cachedAvailabilityZones = /* @__PURE__ */ new Map();
-const recordedSecretExpressions = {
-	has: (expression) => isRecordedSecretExpression(expression),
-	add: (expression) => recordSecretExpression(expression),
-	delete: (expression) => forgetSecretExpression(expression),
-	clear: () => clearRecordedSecretExpressions()
-};
 const cachedEc2InstanceAttributes = Object.create(null);
 const cachedVpcDefaultSecurityGroups = Object.create(null);
 const cachedCloudFrontDomainNames = Object.create(null);
@@ -17109,10 +17255,9 @@ async function reresolveCrossStackValue(value, producerRegion, context, origin,
 	if (sourceKey !== void 0 && typeof value === "string" && isSingleDynamicReferenceToken(value) && typeof reresolved === "string" && context.recordedSecretValues?.has(reresolved) === true && isSecretExpressionByVerdictOrSpelling(value)) recordCrossStackExpression(context.recordedSecretValues, sourceKey, value, reresolved);
 	return reresolved;
 }
-function pinSecretVerdict(expression, secret) {
+function pinSecretVerdict(expression, secret, scope) {
 	if (this.producerRegionGuest) return;
-	if (secret) recordedSecretExpressions.add(expression);
-	else recordedSecretExpressions.delete(expression);
+	pinScopedSecretVerdict(scope, expression, secret);
 }
 async function resolveImportValue(importValueArg, context) {
 	const sourceKey = crossStackSourceKey({ "Fn::ImportValue": importValueArg });
@@ -17725,6 +17870,9 @@ function classifyReplaySecretRegion(expression, consumerRegion, importedProducer
 
 //#endregion
 //#region src/deployment/intrinsic-resolver/dynamic-refs.ts
+function secretVerdictScope(resolver) {
+	return injectiveKey(credentialFingerprint(ambientCredentialConfig()), canonicalizeRegion(resolver.explicitRegion) ?? "");
+}
 async function resolveDynamicReferences(value, context) {
 	return (await this.resolveDynamicReferencesWithLogTwin(value, value, context, void 0, true)).result;
 }
@@ -17751,7 +17899,8 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 		const tokenLogText = inherited?.tokenLogText ?? (pairedTwin === void 0 ? "***" : this.straddleSafeTwin(fullMatch, pairedTwin, context));
 		const nameLogText = inherited?.nameLogText ?? (pairedTwin === void 0 ? () => "***" : this.dynamicReferenceNameLogText(inner, pairedTwin, context));
 		try {
-			const isKnownSecret = service === "secretsmanager" || service === "ssm-secure" || recordedSecretExpressions.has(fullMatch);
+			const verdictScope = secretVerdictScope(this);
+			const isKnownSecret = service === "secretsmanager" || service === "ssm-secure" || isScopedSecretVerdict(verdictScope, fullMatch);
 			if (isKnownSecret && context?.skipDynamicReferences) {
 				complete = false;
 				continue;
@@ -17804,8 +17953,8 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 				const param = await this.resolveSSMReference(parts, decrypt, "ssm", context, nameLogText);
 				if (param.type === "SecureString") {
 					if (decrypt) pinSecureVerdict = true;
-					else if (persistedText || !this.tokenAssembledForRecording(fullMatch, tokenLogText, context)) this.pinSecretVerdict(fullMatch, true);
-				} else if (!param.secure) this.pinSecretVerdict(fullMatch, false);
+					else if (persistedText || !this.tokenAssembledForRecording(fullMatch, tokenLogText, context)) this.pinSecretVerdict(fullMatch, true, verdictScope);
+				} else if (!param.secure) this.pinSecretVerdict(fullMatch, false, verdictScope);
 				else cacheable = false;
 				isSecret = param.secure;
 				if (param.secure) {
@@ -17827,7 +17976,7 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 				continue;
 			}
 			if (isSecret && resolved && !persistedText) this.refuseSecretAssembledReference(fullMatch, tokenLogText, context);
-			if (pinSecureVerdict) this.pinSecretVerdict(fullMatch, true);
+			if (pinSecureVerdict) this.pinSecretVerdict(fullMatch, true, verdictScope);
 			if (cacheable) this.cachedDynamicReferences.set(dynamicReferenceCacheKey, {
 				value: resolved,
 				secret: isSecret
@@ -17838,7 +17987,7 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 					recorded.set(resolved, fullMatch);
 					recordResolvedPair(recorded, fullMatch, resolved);
 				}
-				if (service === "secretsmanager" || service === "ssm-secure") this.pinSecretVerdict(fullMatch, true);
+				if (service === "secretsmanager" || service === "ssm-secure") this.pinSecretVerdict(fullMatch, true, verdictScope);
 			}
 			result = result.replace(fullMatch, () => resolved);
 			twin = twin.replace(fullMatch, () => isSecret && resolved ? "***" : resolved);
@@ -17977,11 +18126,20 @@ function partParameterSpans(context, part, resolved) {
 	if (own === void 0 || own.output !== resolved) return [];
 	return own.parameterSpans ?? [];
 }
+function wholeReferenceSpans(source, value) {
+	if (typeof value !== "string" || value === "") return [];
+	const key = crossStackSourceKey(source);
+	return key === void 0 ? [] : [{
+		start: 0,
+		length: value.length,
+		key
+	}];
+}
 function appendShiftedSpans(out, spans, by) {
 	for (const span of spans) out.push({
 		start: span.start + by,
 		length: span.length,
-		parameter: span.parameter
+		key: span.key
 	});
 }
 async function resolveJoin(joinArgs, context, source) {
@@ -18276,11 +18434,7 @@ async function resolveSub(subArgs, context, source) {
 				listRefusal ??= refusal;
 				replacement = refusal ? match[0] : String(value);
 				if (!refusal) twinReplacement = this.productLogTwin(value, context);
-				if (!refusal && fromParameter && typeof value === "string" && value !== "") parameterSpans = [{
-					start: 0,
-					length: value.length,
-					parameter: varNameStr
-				}];
+				if (!refusal && fromParameter) parameterSpans = wholeReferenceSpans({ Ref: varNameStr }, value);
 			} catch (refError) {
 				if (refError instanceof IntrinsicResolutionRefusalError) throw refError;
 				if (varNameStr.includes(".")) try {
@@ -18288,7 +18442,10 @@ async function resolveSub(subArgs, context, source) {
 					const refusal = this.subListRefusal(`the variable \${${varNameStr}}`, value, context);
 					listRefusal ??= refusal;
 					replacement = refusal ? match[0] : String(value);
-					if (!refusal) twinReplacement = this.productLogTwin(value, context);
+					if (!refusal) {
+						twinReplacement = this.productLogTwin(value, context);
+						parameterSpans = wholeReferenceSpans({ "Fn::GetAtt": varNameStr }, value);
+					}
 				} catch (getAttError) {
 					if (getAttError instanceof IntrinsicResolutionRefusalError) throw getAttError;
 					this.rethrowStructuralSubFailure(varNameStr, getAttError, context);
@@ -19118,6 +19275,16 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const parts = pending === 1 ? "1 concurrent part was" : `${pending} concurrent parts were`;
 		this.logger.warn(`A resolution failed while ${parts} still running, and cdkd stopped waiting because the wait after a failure (capped at ${capSeconds}s) was used up. A secret such a part resolves from now on is still recorded, but only what runs after it arrives can mask it: output already printed or saved is not revisited.`);
 	}
+	recordCrossStackReadSpan(context, source, value) {
+		if (typeof value === "string") this.recordLeafResolution(context, source, {
+			input: value,
+			output: value,
+			substitutions: [],
+			complete: true,
+			parameterSpans: wholeReferenceSpans(source, value)
+		});
+		return value;
+	}
 	async resolveValue(value, context) {
 		if (typeof value !== "object" || value === null) {
 			if (typeof value === "string" && value.includes("{{resolve:")) return await this.resolveTemplateLeafReferences(value, context);
@@ -19136,15 +19303,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				output: value,
 				substitutions: [],
 				complete: true,
-				parameterSpans: value === "" ? [] : [{
-					start: 0,
-					length: value.length,
-					parameter: logicalId
-				}]
+				parameterSpans: wholeReferenceSpans({ Ref: logicalId }, value)
 			});
 			return value;
 		}
-		if ("Fn::GetAtt" in obj) return await this.resolveGetAtt(obj["Fn::GetAtt"], context);
+		if ("Fn::GetAtt" in obj) return this.recordCrossStackReadSpan(context, obj, await this.resolveGetAtt(obj["Fn::GetAtt"], context));
 		if ("Fn::Join" in obj) return await this.resolveJoin(obj["Fn::Join"], context, obj);
 		if ("Fn::Sub" in obj) return await this.resolveSub(obj["Fn::Sub"], context, obj);
 		if ("Fn::Select" in obj) return await this.resolveSelect(obj["Fn::Select"], context);
@@ -19155,8 +19318,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if ("Fn::And" in obj) return await this.resolveAnd(obj["Fn::And"], context);
 		if ("Fn::Or" in obj) return await this.resolveOr(obj["Fn::Or"], context);
 		if ("Fn::Not" in obj) return await this.resolveNot(obj["Fn::Not"], context);
-		if ("Fn::ImportValue" in obj) return await this.resolveImportValue(obj["Fn::ImportValue"], context);
-		if ("Fn::GetStackOutput" in obj) return await this.resolveGetStackOutput(obj["Fn::GetStackOutput"], context);
+		if ("Fn::ImportValue" in obj) return this.recordCrossStackReadSpan(context, obj, await this.resolveImportValue(obj["Fn::ImportValue"], context));
+		if ("Fn::GetStackOutput" in obj) return this.recordCrossStackReadSpan(context, obj, await this.resolveGetStackOutput(obj["Fn::GetStackOutput"], context));
 		if ("Fn::FindInMap" in obj) return await this.resolveFindInMap(obj["Fn::FindInMap"], context);
 		if ("Fn::Base64" in obj) return await this.resolveBase64(obj["Fn::Base64"], context);
 		if ("Fn::GetAZs" in obj) return await this.resolveGetAZs(obj["Fn::GetAZs"], context);
@@ -19417,13 +19580,29 @@ var DiffCalculator = class DiffCalculator {
 				const resolvedDesiredProps = resolveFn ? await this.resolveBestEffort(rawDesiredProps, resolveFn) : rawDesiredProps;
 				const sdkRouted = currentResource.provisionedBy !== "cc-api";
 				const desiredAfterDrops = sdkRouted && allowedUnsupportedProperties ? withoutAcceptedSilentDropProperties(desiredResource.Type, resolvedDesiredProps, allowedUnsupportedProperties, currentResource.properties) : resolvedDesiredProps;
-				const currentAfterDrops = sdkRouted ? withoutSilentDropProperties(desiredResource.Type, currentResource.properties) : currentResource.properties;
+				const currentAfterDrops = sdkRouted ? withoutUnwrittenSilentDropProperties(desiredResource.Type, currentResource.properties, resolvedDesiredProps, allowedUnsupportedProperties ?? /* @__PURE__ */ new Set(), acceptedCreateOnlyDropsOf(currentResource)) : currentResource.properties;
 				const desiredPropsForCompare = canonicalizeProperties ? canonicalizeProperties(desiredResource.Type, desiredAfterDrops) : desiredAfterDrops;
 				const currentPropsForCompare = canonicalizeProperties && sdkRouted ? canonicalizeProperties(desiredResource.Type, currentAfterDrops) : currentAfterDrops;
 				const droppedKeys = canonicalizeProperties ? Object.keys(desiredAfterDrops).filter((key) => !Object.hasOwn(desiredPropsForCompare, key)) : [];
 				if (droppedKeys.length > 0) this.logger.warn(`${logicalId} (${desiredResource.Type}): part of the declared properties cannot be sent as declared and is ignored when comparing against deployed state — the provider narrows them (${droppedKeys.join(", ")}). Fix the template to declare only what the resource supports; until then changes to the ignored keys have no effect.`);
 				else if (canonicalizeProperties && !this.valuesEqual(desiredPropsForCompare, desiredAfterDrops)) this.logger.debug(`${logicalId} (${desiredResource.Type}): the provider normalizes part of the declared properties before sending them; the comparison uses the normalized form. Nothing is dropped.`);
 				const propertyChanges = await this.compareProperties(desiredResource.Type, currentPropsForCompare, desiredPropsForCompare, maskForLog);
+				const reported = new Set(propertyChanges.map((pc) => pc.path));
+				for (const key of movedMaskedProperties(currentResource, rawDesiredProps)) {
+					if (reported.has(key)) continue;
+					if (!Object.hasOwn(currentPropsForCompare, key)) continue;
+					if (!Object.hasOwn(desiredPropsForCompare, key)) continue;
+					const oldValue = currentPropsForCompare[key];
+					const newValue = desiredPropsForCompare[key];
+					propertyChanges.push({
+						path: key,
+						oldValue,
+						newValue,
+						requiresReplacement: await this.maskedEditRequiresReplacement(desiredResource.Type, key, oldValue, newValue),
+						maskedExpressionChanged: true
+					});
+					this.logger.debug(safeMsg`${logicalId}: ${key} is recorded masked and its template expression changed (go-to-k/cdkd#4451)`);
+				}
 				const attributeChanges = this.compareAttributes(currentResource, desiredResource);
 				if (propertyChanges.length > 0 || attributeChanges.length > 0) {
 					changes.set(logicalId, {
@@ -19790,6 +19969,11 @@ var DiffCalculator = class DiffCalculator {
 		}
 		return changes;
 	}
+	async maskedEditRequiresReplacement(resourceType, key, oldValue, newValue) {
+		if (this.replacementRules.requiresReplacement(resourceType, key, oldValue, newValue)) return true;
+		if (this.replacementRules.isClassified(resourceType, key)) return false;
+		return (await getCreateOnlyPropertyPaths(resourceType)).some((path) => path.length === 1 && path[0] === key);
+	}
 	static INTRINSIC_KEYS = INTRINSIC_KEYS;
 	static isIntrinsic(value) {
 		if (value === null || value === void 0 || typeof value !== "object" || Array.isArray(value)) return false;
@@ -20649,7 +20833,8 @@ var CloudControlProvider = class {
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
-		this.logger.debug(`Updating resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
+		const idLog = updateIdLogSink(this.logger, physicalId, properties, previousProperties, context?.maskSecrets);
+		idLog.debug(`Updating resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		await this.assertRecordedRegionAgainstClient("pre-update", context?.expectedRegion, resourceType, logicalId, physicalId);
 		try {
 			const cleanPreviousProperties = stringifyJsonProperties(resourceType, stripNullValues(previousProperties));
@@ -20714,9 +20899,9 @@ var CloudControlProvider = class {
 				physicalId,
 				wasReplaced: false
 			};
-			if (progressEvent.ResourceModel) result.attributes = this.parseResourceModel(progressEvent.ResourceModel);
-			result.attributes = await this.mergeSparseModelReadback(resourceType, physicalId, result.attributes || {});
-			result.attributes = await this.enrichResourceAttributes(resourceType, physicalId, result.attributes);
+			if (progressEvent.ResourceModel) result.attributes = this.parseResourceModel(progressEvent.ResourceModel, idLog);
+			result.attributes = await this.mergeSparseModelReadback(resourceType, physicalId, result.attributes || {}, idLog);
+			result.attributes = await this.enrichResourceAttributes(resourceType, physicalId, result.attributes, idLog);
 			return result;
 		} catch (error) {
 			this.handleError(error, "UPDATE", resourceType, logicalId, physicalId);
@@ -20729,7 +20914,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CsajFK4_.js");
+			const { ASGProvider } = await import("./asg-provider-BFlmarbF.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -20835,7 +21020,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-a-vZsR9L.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DlFQdgwe.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-DqHELwjV.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CHnIs1hG.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -21080,34 +21265,34 @@ var CloudControlProvider = class {
 		const regionFlag = safeRegion === void 0 ? "" : ` --region ${shellQuote(safeRegion)}`;
 		return `${withPasteableAwsProfile("aws cloudcontrol get-resource-request-status")} --request-token ${shellQuote(safeToken)}${regionFlag}`;
 	}
-	parseResourceModel(resourceModel) {
+	parseResourceModel(resourceModel, log = this.logger) {
 		try {
 			return JSON.parse(resourceModel);
 		} catch (error) {
 			const described = describeAwsFailure(error);
-			this.logger.warn(`Failed to parse resource model: ${described.redacted ? described.summary : error instanceof Error ? error.name : "Error"}\nModel shape: ${resourceModel.length} chars, ${describeJsonKeys(resourceModel)}`);
-			this.logger.debug(`Resource model parse failure detail: ${displaySafe(described.detail)}`);
+			log.warn(`Failed to parse resource model: ${described.redacted ? described.summary : error instanceof Error ? error.name : "Error"}\nModel shape: ${resourceModel.length} chars, ${describeJsonKeys(resourceModel)}`);
+			if (log.withheld !== true) log.debug(`Resource model parse failure detail: ${displaySafe(described.detail)}`);
 			return {};
 		}
 	}
-	async accountInfoForSynthesizedArn(resourceType, attributeName, physicalId) {
+	async accountInfoForSynthesizedArn(resourceType, attributeName, physicalId, log = this.logger) {
 		const region = await this.cloudControlClient.config.region();
 		try {
 			return await getAccountInfo(region);
 		} catch (error) {
 			if (!(error instanceof AccountIdUnavailableError)) throw error;
-			this.logger.warn(`Not enriching ${resourceType} ${attributeName} for ${physicalId}: ${error.message} The resource itself is unaffected; the record heals on its next update.`);
+			log.warn(`Not enriching ${resourceType} ${attributeName} for ${physicalId}: ${error.message} The resource itself is unaffected; the record heals on its next update.`);
 			return;
 		}
 	}
-	async enrichResourceAttributes(resourceType, physicalId, attributes) {
+	async enrichResourceAttributes(resourceType, physicalId, attributes, log = this.logger) {
 		const enriched = { ...attributes };
 		switch (resourceType) {
 			case "AWS::S3::Bucket":
 				if (!enriched["Arn"]) try {
 					enriched["Arn"] = s3BucketArn(physicalId, await this.cloudControlClient.config.region());
 				} catch (error) {
-					this.logger.debug(`Failed to construct S3 Bucket Arn for ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to construct S3 Bucket Arn for ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::RDS::DBCluster":
@@ -21119,10 +21304,10 @@ var CloudControlProvider = class {
 						if (cluster.ReaderEndpoint) enriched["ReadEndpoint.Address"] = cluster.ReaderEndpoint;
 						if (cluster.DBClusterArn) enriched["Arn"] = cluster.DBClusterArn;
 						if (cluster.DbClusterResourceId) enriched["DBClusterResourceId"] = cluster.DbClusterResourceId;
-						this.logger.debug(`Enriched RDS DBCluster ${physicalId} with Endpoint/Port/Arn from DescribeDBClusters`);
+						log.debug(`Enriched RDS DBCluster ${physicalId} with Endpoint/Port/Arn from DescribeDBClusters`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to enrich RDS DBCluster ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to enrich RDS DBCluster ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::RDS::DBInstance":
@@ -21133,10 +21318,10 @@ var CloudControlProvider = class {
 						if (inst.Endpoint?.Port !== void 0) enriched["Endpoint.Port"] = String(inst.Endpoint.Port);
 						if (inst.Endpoint?.HostedZoneId) enriched["Endpoint.HostedZoneId"] = inst.Endpoint.HostedZoneId;
 						if (inst.DBInstanceArn) enriched["Arn"] = inst.DBInstanceArn;
-						this.logger.debug(`Enriched RDS DBInstance ${physicalId} with Endpoint/Port/Arn from DescribeDBInstances`);
+						log.debug(`Enriched RDS DBInstance ${physicalId} with Endpoint/Port/Arn from DescribeDBInstances`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to enrich RDS DBInstance ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to enrich RDS DBInstance ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::DynamoDB::Table":
@@ -21144,10 +21329,10 @@ var CloudControlProvider = class {
 					const latestStreamArn = (await getAwsClients().dynamoDB.send(new DescribeTableCommand({ TableName: physicalId }))).Table?.LatestStreamArn;
 					if (latestStreamArn) {
 						enriched["StreamArn"] = latestStreamArn;
-						this.logger.debug(`Enriched DynamoDB StreamArn for ${physicalId}: ${latestStreamArn}`);
+						log.debug(`Enriched DynamoDB StreamArn for ${physicalId}: ${latestStreamArn}`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to get DynamoDB StreamArn for ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to get DynamoDB StreamArn for ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::ApiGateway::RestApi":
@@ -21155,10 +21340,10 @@ var CloudControlProvider = class {
 					const getRestApiResponse = await getAwsClients().apiGateway.send(new GetRestApiCommand({ restApiId: physicalId }));
 					if (getRestApiResponse.rootResourceId) {
 						enriched["RootResourceId"] = getRestApiResponse.rootResourceId;
-						this.logger.debug(`Enriched RestApi RootResourceId for ${physicalId}: ${getRestApiResponse.rootResourceId}`);
+						log.debug(`Enriched RestApi RootResourceId for ${physicalId}: ${getRestApiResponse.rootResourceId}`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to get RestApi RootResourceId for ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to get RestApi RootResourceId for ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				if (!enriched["RestApiId"]) enriched["RestApiId"] = physicalId;
 				break;
@@ -21167,21 +21352,21 @@ var CloudControlProvider = class {
 					const s3CanonicalUserId = (await getAwsClients().cloudFront.send(new GetCloudFrontOriginAccessIdentityCommand({ Id: physicalId }))).CloudFrontOriginAccessIdentity?.S3CanonicalUserId;
 					if (s3CanonicalUserId) {
 						enriched["S3CanonicalUserId"] = s3CanonicalUserId;
-						this.logger.debug(`Enriched CloudFront OAI S3CanonicalUserId for ${physicalId}: ${s3CanonicalUserId}`);
+						log.debug(`Enriched CloudFront OAI S3CanonicalUserId for ${physicalId}: ${s3CanonicalUserId}`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to get CloudFront OAI S3CanonicalUserId for ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to get CloudFront OAI S3CanonicalUserId for ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::KMS::Key":
 				if (!enriched["Arn"]) try {
-					const kmsAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "Arn", physicalId);
+					const kmsAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "Arn", physicalId, log);
 					if (kmsAccountInfo) {
 						enriched["Arn"] = `arn:${kmsAccountInfo.partition}:kms:${canonicalizeRegion(kmsAccountInfo.region)}:${kmsAccountInfo.accountId}:key/${physicalId}`;
-						this.logger.debug(`Enriched KMS Key Arn for ${physicalId}: ${String(enriched["Arn"])}`);
+						log.debug(`Enriched KMS Key Arn for ${physicalId}: ${String(enriched["Arn"])}`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to construct KMS Key Arn for ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to construct KMS Key Arn for ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				if (!enriched["KeyId"]) enriched["KeyId"] = physicalId;
 				break;
@@ -21193,16 +21378,16 @@ var CloudControlProvider = class {
 				break;
 			case "AWS::ECR::Repository":
 				if (!enriched["Arn"]) try {
-					const ecrAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "Arn", physicalId);
+					const ecrAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "Arn", physicalId, log);
 					if (ecrAccountInfo) {
 						enriched["Arn"] = `arn:${ecrAccountInfo.partition}:ecr:${canonicalizeRegion(ecrAccountInfo.region)}:${ecrAccountInfo.accountId}:repository/${physicalId}`;
-						this.logger.debug(`Enriched ECR Repository Arn for ${physicalId}: ${String(enriched["Arn"])}`);
+						log.debug(`Enriched ECR Repository Arn for ${physicalId}: ${String(enriched["Arn"])}`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to construct ECR Repository Arn: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to construct ECR Repository Arn: ${describeAwsFailure(error).detail}`);
 				}
 				if (!enriched["RepositoryUri"]) try {
-					const ecrAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "RepositoryUri", physicalId);
+					const ecrAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "RepositoryUri", physicalId, log);
 					if (ecrAccountInfo) {
 						const { urlSuffix } = derivePartitionAndUrlSuffix(ecrAccountInfo.region);
 						enriched["RepositoryUri"] = `${ecrAccountInfo.accountId}.dkr.ecr.${canonicalizeRegion(ecrAccountInfo.region)}.${urlSuffix}/${physicalId}`;
@@ -21214,7 +21399,7 @@ var CloudControlProvider = class {
 					const [publicIp, allocationId] = physicalId.split("|");
 					if (!enriched["AllocationId"]) enriched["AllocationId"] = allocationId;
 					if (!enriched["PublicIp"]) enriched["PublicIp"] = publicIp;
-					this.logger.debug(`Enriched EIP attributes: AllocationId=${allocationId}, PublicIp=${publicIp}`);
+					log.debug(`Enriched EIP attributes: AllocationId=${allocationId}, PublicIp=${publicIp}`);
 				}
 				break;
 			case "AWS::Lambda::Version":
@@ -21222,18 +21407,18 @@ var CloudControlProvider = class {
 					const versionSegments = physicalId.split(":");
 					const versionNumber = versionSegments[versionSegments.length - 1];
 					enriched["Version"] = versionNumber;
-					this.logger.debug(`Enriched Lambda Version for ${physicalId}: ${versionNumber}`);
+					log.debug(`Enriched Lambda Version for ${physicalId}: ${versionNumber}`);
 				}
 				break;
 			case "AWS::Kinesis::Stream":
 				if (!enriched["Arn"]) try {
-					const kinesisAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "Arn", physicalId);
+					const kinesisAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "Arn", physicalId, log);
 					if (kinesisAccountInfo) {
 						enriched["Arn"] = `arn:${kinesisAccountInfo.partition}:kinesis:${canonicalizeRegion(kinesisAccountInfo.region)}:${kinesisAccountInfo.accountId}:stream/${physicalId}`;
-						this.logger.debug(`Enriched Kinesis Stream Arn for ${physicalId}: ${String(enriched["Arn"])}`);
+						log.debug(`Enriched Kinesis Stream Arn for ${physicalId}: ${String(enriched["Arn"])}`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to construct Kinesis Stream Arn for ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to construct Kinesis Stream Arn for ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::Lambda::Url":
@@ -21241,11 +21426,11 @@ var CloudControlProvider = class {
 					const urlConfig = await getAwsClients().lambda.send(new GetFunctionUrlConfigCommand({ FunctionName: physicalId }));
 					if (urlConfig.FunctionUrl) {
 						enriched["FunctionUrl"] = urlConfig.FunctionUrl;
-						this.logger.debug(`Enriched Lambda URL FunctionUrl for ${physicalId}: ${urlConfig.FunctionUrl}`);
+						log.debug(`Enriched Lambda URL FunctionUrl for ${physicalId}: ${urlConfig.FunctionUrl}`);
 					}
 					if (urlConfig.FunctionArn) enriched["FunctionArn"] = urlConfig.FunctionArn;
 				} catch (error) {
-					this.logger.debug(`Failed to get Lambda URL config for ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to get Lambda URL config for ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::Events::Connection":
@@ -21259,9 +21444,9 @@ var CloudControlProvider = class {
 						}
 					}
 					if (conn.SecretArn && !enriched["SecretArn"]) enriched["SecretArn"] = conn.SecretArn;
-					this.logger.debug(`Enriched Events Connection ${physicalId} with Arn/SecretArn/ArnForPolicy from DescribeConnection`);
+					log.debug(`Enriched Events Connection ${physicalId} with Arn/SecretArn/ArnForPolicy from DescribeConnection`);
 				} catch (error) {
-					this.logger.debug(`Failed to enrich Events Connection ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to enrich Events Connection ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::Events::ApiDestination":
@@ -21274,9 +21459,9 @@ var CloudControlProvider = class {
 							if (lastSlash > 0) enriched["ArnForPolicy"] = dest.ApiDestinationArn.slice(0, lastSlash);
 						}
 					}
-					this.logger.debug(`Enriched Events ApiDestination ${physicalId} with Arn/ArnForPolicy from DescribeApiDestination`);
+					log.debug(`Enriched Events ApiDestination ${physicalId} with Arn/ArnForPolicy from DescribeApiDestination`);
 				} catch (error) {
-					this.logger.debug(`Failed to enrich Events ApiDestination ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to enrich Events ApiDestination ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::ElastiCache::ReplicationGroup":
@@ -21295,10 +21480,10 @@ var CloudControlProvider = class {
 						const readPorts = readEndpoints.map((ep) => ep?.Port).filter((p) => p !== void 0);
 						if (readAddrs.length > 0) enriched["ReadEndPoint.Addresses"] = readAddrs.join(",");
 						if (readPorts.length > 0) enriched["ReadEndPoint.Ports"] = readPorts.map(String).join(",");
-						this.logger.debug(`Enriched ElastiCache ReplicationGroup ${physicalId} with endpoint attributes from DescribeReplicationGroups`);
+						log.debug(`Enriched ElastiCache ReplicationGroup ${physicalId} with endpoint attributes from DescribeReplicationGroups`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to enrich ElastiCache ReplicationGroup ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to enrich ElastiCache ReplicationGroup ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::Redshift::Cluster":
@@ -21307,10 +21492,10 @@ var CloudControlProvider = class {
 					if (cluster?.Endpoint) {
 						if (cluster.Endpoint.Address) enriched["Endpoint.Address"] = cluster.Endpoint.Address;
 						if (cluster.Endpoint.Port !== void 0) enriched["Endpoint.Port"] = String(cluster.Endpoint.Port);
-						this.logger.debug(`Enriched Redshift Cluster ${physicalId} with Endpoint.Address/Port from DescribeClusters`);
+						log.debug(`Enriched Redshift Cluster ${physicalId} with Endpoint.Address/Port from DescribeClusters`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to enrich Redshift Cluster ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to enrich Redshift Cluster ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::OpenSearchService::Domain":
@@ -21324,31 +21509,31 @@ var CloudControlProvider = class {
 							enriched["DomainArn"] = domain.ARN;
 						}
 						if (domain.DomainId) enriched["Id"] = domain.DomainId;
-						this.logger.debug(`Enriched OpenSearch Domain ${physicalId} with DomainEndpoint/Arn from DescribeDomain`);
+						log.debug(`Enriched OpenSearch Domain ${physicalId} with DomainEndpoint/Arn from DescribeDomain`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to enrich OpenSearch Domain ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to enrich OpenSearch Domain ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::Backup::BackupVault":
 				if (!enriched["BackupVaultArn"]) {
-					const model = await this.readCcResourceModel(resourceType, physicalId);
+					const model = await this.readCcResourceModel(resourceType, physicalId, log);
 					if (model) {
 						if (typeof model["BackupVaultArn"] === "string") enriched["BackupVaultArn"] = model["BackupVaultArn"];
 						if (!enriched["BackupVaultName"] && typeof model["BackupVaultName"] === "string") enriched["BackupVaultName"] = model["BackupVaultName"];
-						this.logger.debug(`Enriched Backup BackupVault ${physicalId} with BackupVaultArn from CC GetResource`);
+						log.debug(`Enriched Backup BackupVault ${physicalId} with BackupVaultArn from CC GetResource`);
 					}
 				}
 				if (!enriched["BackupVaultName"]) enriched["BackupVaultName"] = physicalId;
 				break;
 			case "AWS::Backup::BackupPlan":
 				if (!enriched["BackupPlanArn"] || !enriched["VersionId"]) {
-					const model = await this.readCcResourceModel(resourceType, physicalId);
+					const model = await this.readCcResourceModel(resourceType, physicalId, log);
 					if (model) {
 						if (!enriched["BackupPlanArn"] && typeof model["BackupPlanArn"] === "string") enriched["BackupPlanArn"] = model["BackupPlanArn"];
 						if (!enriched["VersionId"] && typeof model["VersionId"] === "string") enriched["VersionId"] = model["VersionId"];
 						if (!enriched["BackupPlanId"] && typeof model["BackupPlanId"] === "string") enriched["BackupPlanId"] = model["BackupPlanId"];
-						this.logger.debug(`Enriched Backup BackupPlan ${physicalId} with BackupPlanArn/VersionId from CC GetResource`);
+						log.debug(`Enriched Backup BackupPlan ${physicalId} with BackupPlanArn/VersionId from CC GetResource`);
 					}
 				}
 				if (!enriched["BackupPlanId"]) enriched["BackupPlanId"] = physicalId;
@@ -21360,53 +21545,53 @@ var CloudControlProvider = class {
 						if (!enriched["SelectionId"]) enriched["SelectionId"] = physicalId.substring(0, firstUnderscore);
 						if (!enriched["BackupPlanId"]) enriched["BackupPlanId"] = physicalId.substring(firstUnderscore + 1);
 					}
-					const model = await this.readCcResourceModel(resourceType, physicalId);
+					const model = await this.readCcResourceModel(resourceType, physicalId, log);
 					if (model) {
 						if (typeof model["SelectionId"] === "string") enriched["SelectionId"] = model["SelectionId"];
 						if (typeof model["BackupPlanId"] === "string") enriched["BackupPlanId"] = model["BackupPlanId"];
-						this.logger.debug(`Enriched Backup BackupSelection ${physicalId} with SelectionId from CC GetResource`);
+						log.debug(`Enriched Backup BackupSelection ${physicalId} with SelectionId from CC GetResource`);
 					}
 				}
 				break;
 			case "AWS::Pipes::Pipe":
 				if (!enriched["Arn"]) {
-					const model = await this.readCcResourceModel(resourceType, physicalId);
+					const model = await this.readCcResourceModel(resourceType, physicalId, log);
 					if (model) {
 						if (typeof model["Arn"] === "string") enriched["Arn"] = model["Arn"];
 						if (!enriched["CurrentState"] && typeof model["CurrentState"] === "string") enriched["CurrentState"] = model["CurrentState"];
 						if (!enriched["StateReason"] && typeof model["StateReason"] === "string") enriched["StateReason"] = model["StateReason"];
 						if (!enriched["CreationTime"] && typeof model["CreationTime"] === "string") enriched["CreationTime"] = model["CreationTime"];
 						if (!enriched["LastModifiedTime"] && typeof model["LastModifiedTime"] === "string") enriched["LastModifiedTime"] = model["LastModifiedTime"];
-						this.logger.debug(`Enriched Pipes Pipe ${physicalId} with Arn from CC GetResource`);
+						log.debug(`Enriched Pipes Pipe ${physicalId} with Arn from CC GetResource`);
 					}
 				}
 				break;
 			case "AWS::S3::AccessPoint":
 				if (!enriched["Arn"] || !enriched["Alias"]) {
-					const model = await this.readCcResourceModel(resourceType, physicalId);
+					const model = await this.readCcResourceModel(resourceType, physicalId, log);
 					if (model) {
 						if (!enriched["Arn"] && typeof model["Arn"] === "string") enriched["Arn"] = model["Arn"];
 						if (!enriched["Alias"] && typeof model["Alias"] === "string") enriched["Alias"] = model["Alias"];
 						if (!enriched["NetworkOrigin"] && typeof model["NetworkOrigin"] === "string") enriched["NetworkOrigin"] = model["NetworkOrigin"];
-						this.logger.debug(`Enriched S3 AccessPoint ${physicalId} with Arn/Alias from CC GetResource`);
+						log.debug(`Enriched S3 AccessPoint ${physicalId} with Arn/Alias from CC GetResource`);
 					}
 				}
 				break;
 			case "AWS::ResourceGroups::Group": if (!enriched["Arn"]) {
-				const model = await this.readCcResourceModel(resourceType, physicalId);
+				const model = await this.readCcResourceModel(resourceType, physicalId, log);
 				if (model) {
 					if (typeof model["Arn"] === "string") enriched["Arn"] = model["Arn"];
-					this.logger.debug(`Enriched ResourceGroups Group ${physicalId} with Arn from CC GetResource`);
+					log.debug(`Enriched ResourceGroups Group ${physicalId} with Arn from CC GetResource`);
 				}
 			}
 		}
 		return enriched;
 	}
-	async mergeSparseModelReadback(resourceType, physicalId, attributes) {
+	async mergeSparseModelReadback(resourceType, physicalId, attributes, log = this.logger) {
 		if (!this.isSparseAttributeMap(attributes, physicalId)) return attributes;
-		const model = await this.readCcResourceModel(resourceType, physicalId);
+		const model = await this.readCcResourceModel(resourceType, physicalId, log);
 		if (!model) return attributes;
-		this.logger.debug(`Merged CC GetResource read-back over sparse ${resourceType} attributes for ${physicalId}`);
+		log.debug(`Merged CC GetResource read-back over sparse ${resourceType} attributes for ${physicalId}`);
 		return {
 			...attributes,
 			...model
@@ -21419,7 +21604,7 @@ var CloudControlProvider = class {
 		identifierEchoes.add(physicalId);
 		return values.every((value) => typeof value === "string" && identifierEchoes.has(value));
 	}
-	async readCcResourceModel(resourceType, physicalId) {
+	async readCcResourceModel(resourceType, physicalId, log = this.logger) {
 		try {
 			const raw = (await this.cloudControlClient.send(new GetResourceCommand({
 				TypeName: resourceType,
@@ -21430,7 +21615,7 @@ var CloudControlProvider = class {
 			if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return;
 			return parsed;
 		} catch (error) {
-			this.logger.debug(`Failed to read CC model for ${resourceType} ${physicalId}: ${describeAwsFailure(error).detail}`);
+			log.debug(`Failed to read CC model for ${resourceType} ${physicalId}: ${describeAwsFailure(error).detail}`);
 			return;
 		}
 	}
@@ -21538,6 +21723,28 @@ var CloudControlProvider = class {
 		return masked;
 	}
 };
+function updateIdLogSink(logger, physicalId, properties, previousProperties, maskSecrets) {
+	const mask = maskerOrIdentity(maskSecrets);
+	const raw = updateIdWithheld(properties, previousProperties, mask) ? [physicalId, ...physicalId.split("|")].filter((needle) => needle !== "") : [];
+	const masked = raw.map((needle) => mask(needle));
+	const needles = [.../* @__PURE__ */ new Set([...raw, ...masked.filter((m, i) => m !== "" && m !== raw[i] && m !== "***")])].sort((a, b) => b.length - a.length);
+	const scrub = (message) => needles.reduce((text, needle) => text.split(needle).join("***"), mask(message));
+	return {
+		debug: (message) => logger.debug(scrub(message)),
+		warn: (message) => logger.warn(scrub(message)),
+		withheld: needles.length > 0
+	};
+}
+function updateIdWithheld(properties, previousProperties, mask) {
+	return holdsSecretDerivedLeaf(properties, mask) || holdsSecretDerivedLeaf(previousProperties, mask);
+}
+function holdsSecretDerivedLeaf(value, mask, depth = 0) {
+	if (typeof value === "string") return isSecretDerivedValue(value, mask);
+	if (value === null || typeof value !== "object") return false;
+	if (depth > 64) return true;
+	if (Array.isArray(value)) return value.some((entry) => holdsSecretDerivedLeaf(entry, mask, depth + 1));
+	return Object.entries(value).some(([key, entry]) => isSecretDerivedValue(key, mask) || holdsSecretDerivedLeaf(entry, mask, depth + 1));
+}
 const IMPORT_YIELDED_NO_ATTRIBUTES_CONSEQUENCE = "Attributes the stack's state already records for this physical id are kept; without them, an Fn::GetAtt against this resource falls back to a value constructed from its physical id.";
 function maskLeavesDeep(value) {
 	if (Array.isArray(value)) return value.map((element) => maskLeavesDeep(element));
@@ -24458,7 +24665,7 @@ var ProviderRegistry = class {
 				if (reroutable.length > 0) remedies.push(`Remove the override for ${reroutable.join(", ")} to route this resource via Cloud Control API instead.`);
 				if (needsRecreate.length > 0) {
 					const one = needsRecreate.length === 1;
-					remedies.push(`${needsRecreate.join(", ")} ${one ? "is" : "are"} create-only, so removing the override does not apply ${one ? "it" : "them"} either -- a create-only property can only be applied by recreating the resource.`);
+					remedies.push(`${needsRecreate.join(", ")} ${one ? "is" : "are"} create-only, so removing the override does not apply ${one ? "it" : "them"} in place -- a create-only property can only be applied by recreating the resource. Where cdkd created the resource without ${one ? "it" : "them"}, a deploy without the override refuses unless something else already forces a replacement or the recreate is opted into.`);
 				}
 				this.logger.warn(`${logicalId} (${resourceType}): ${overridden.join(", ")} will be silently dropped (--prefer-sdk-route override accepted). ${remedies.join(" ")}`);
 			}
@@ -24866,30 +25073,47 @@ async function reserveStackCreateToken(options) {
 //#region src/deployment/inline-policy-claims.ts
 function isInlinePolicyClaimedByCompletedWriter(args, kind, principal, policyName) {
 	const { selfLogicalId, writers, changes, stateResources } = args;
-	const same = (a, b) => typeof a === "string" && IAM_NAME.test(a) && a.toLowerCase() === b.toLowerCase();
 	for (const [lid, write] of writers) {
 		if (lid === selfLogicalId || !Object.hasOwn(stateResources, lid)) continue;
 		const record = stateResources[lid];
 		if (record.provisionedBy === "cc-api") continue;
 		const props = record.properties ?? {};
 		if (record.resourceType === "AWS::IAM::Policy") {
-			if (!same(record.physicalId, policyName)) continue;
+			if (!sameIamName(record.physicalId, policyName)) continue;
 			const listed = props[POLICY_LIST_FIELDS[kind]];
-			if (Array.isArray(listed) && listed.some((p) => same(p, principal))) return true;
+			if (Array.isArray(listed) && listed.some((p) => sameIamName(p, principal))) return true;
 			continue;
 		}
 		if (!Object.hasOwn(PRINCIPAL_KINDS, record.resourceType)) continue;
 		if (PRINCIPAL_KINDS[record.resourceType] !== kind) continue;
-		if (!same(record.physicalId, principal)) continue;
+		if (!sameIamName(record.physicalId, principal)) continue;
 		if (write !== "create" && !ownPoliciesChange(changes.get(lid))) continue;
 		const policies = props["Policies"];
 		if (!Array.isArray(policies)) continue;
-		if (policies.some((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) && same(entry["PolicyName"], policyName))) return true;
+		if (policies.some((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) && sameIamName(entry["PolicyName"], policyName))) return true;
 	}
 	return false;
 }
 var RollbackInlinePolicyWriters = class {
 	entries = /* @__PURE__ */ new Map();
+	removals = /* @__PURE__ */ new Map();
+	unsettled = /* @__PURE__ */ new Map();
+	notePending(ops) {
+		for (const op of ops) if (!this.unsettled.has(op)) this.unsettled.set(op, {
+			logicalId: op.logicalId,
+			state: "pending"
+		});
+	}
+	noteOutcome(op, completed) {
+		if (!completed) {
+			this.unsettled.set(op, {
+				logicalId: op.logicalId,
+				state: "failed"
+			});
+			return;
+		}
+		for (const [key, entry] of this.unsettled) if (key === op || entry.logicalId === op.logicalId) this.unsettled.delete(key);
+	}
 	record(logicalId, write, record, policiesChanged, via) {
 		if (via === "cc-api") {
 			this.entries.delete(logicalId);
@@ -24921,15 +25145,100 @@ var RollbackInlinePolicyWriters = class {
 					}]
 				});
 			}
-			return isInlinePolicyClaimedByCompletedWriter({
+			const claimed = isInlinePolicyClaimedByCompletedWriter({
 				selfLogicalId: logicalId,
 				writers,
 				changes,
 				stateResources
 			}, kind, principal, policyName);
+			if (!claimed) {
+				const key = removalKey(kind, principal, policyName);
+				const noted = this.removals.get(key) ?? {
+					kind,
+					principal,
+					policyName,
+					removers: /* @__PURE__ */ new Map()
+				};
+				noted.removers.set(logicalId, stateResources[logicalId]);
+				this.removals.set(key, noted);
+			}
+			return claimed;
 		};
 	}
+	takeHeldRemovals(stateResources) {
+		const held = [];
+		for (const [key, { kind, principal, policyName, removers }] of this.removals) {
+			const { holders, unreadable } = inlinePolicyHolders(stateResources, kind, principal, policyName);
+			const others = holders.filter((h) => !removers.has(h.logicalId) || stateResources[h.logicalId] !== removers.get(h.logicalId));
+			if (others.length === 0) continue;
+			this.removals.delete(key);
+			const open = new Set([...this.unsettled.values()].map((u) => u.logicalId));
+			const unsettled = [...new Set(others.map((h) => h.logicalId))].filter((id) => open.has(id));
+			held.push({
+				kind,
+				holders: others,
+				unreadable,
+				unsettled
+			});
+		}
+		return held;
+	}
 };
+function inlinePolicyHolders(stateResources, kind, principal, policyName) {
+	const holders = [];
+	const unreadable = [];
+	const unnamed = (v) => typeof v !== "string" || !IAM_NAME.test(v);
+	for (const [logicalId, record] of Object.entries(stateResources)) {
+		if (record === null || typeof record !== "object") continue;
+		const props = record.properties ?? {};
+		if (record.resourceType === "AWS::IAM::Policy") {
+			const nameMatches = sameIamName(record.physicalId, policyName);
+			if (!nameMatches && !unnamed(record.physicalId)) continue;
+			const listed = props[POLICY_LIST_FIELDS[kind]];
+			const entries = Array.isArray(listed) ? listed : [];
+			const named = entries.find((p) => sameIamName(p, principal));
+			if (nameMatches && typeof named === "string") holders.push({
+				logicalId,
+				principal: named,
+				policyName: record.physicalId,
+				document: props["PolicyDocument"]
+			});
+			else if (named !== void 0 || entries.some(unnamed)) unreadable.push(logicalId);
+			continue;
+		}
+		if (!Object.hasOwn(PRINCIPAL_KINDS, record.resourceType)) continue;
+		if (PRINCIPAL_KINDS[record.resourceType] !== kind) continue;
+		const principalMatches = sameIamName(record.physicalId, principal);
+		if (!principalMatches && !unnamed(record.physicalId)) continue;
+		const policies = props["Policies"];
+		if (!Array.isArray(policies)) continue;
+		for (const entry of policies) {
+			if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+			const name = entry["PolicyName"];
+			if (principalMatches && sameIamName(name, policyName)) holders.push({
+				logicalId,
+				principal: record.physicalId,
+				policyName: name,
+				document: entry["PolicyDocument"]
+			});
+			else if (unnamed(name) || sameIamName(name, policyName)) unreadable.push(logicalId);
+		}
+	}
+	return {
+		holders,
+		unreadable: [...new Set(unreadable)]
+	};
+}
+function sameIamName(a, b) {
+	return typeof a === "string" && IAM_NAME.test(a) && a.toLowerCase() === b.toLowerCase();
+}
+function removalKey(kind, principal, policyName) {
+	return JSON.stringify([
+		kind,
+		principal.toLowerCase(),
+		policyName.toLowerCase()
+	]);
+}
 const IAM_NAME = /^[\w+=,.@-]+$/;
 const POLICY_LIST_FIELDS = {
 	role: "Roles",
@@ -25805,6 +26114,31 @@ function updatePartialMessage(reason) {
 	return `partial (${reason})`;
 }
 
+//#endregion
+//#region src/provisioning/redacted-delete-address.ts
+function isRedactedRecordedValue(value) {
+	if (carriesSecretMask(value)) return true;
+	let text;
+	try {
+		text = typeof value === "string" ? value : JSON.stringify(value);
+	} catch {
+		return false;
+	}
+	return text !== void 0 && dynamicReferenceTokens(text).length > 0;
+}
+const REDACTED_DELETE_ADDRESS_SKIP_REASON = "redacted address property in state — no delete issued";
+function redactedDeleteAddressFields(fields) {
+	return Object.keys(fields).filter((key) => isRedactedRecordedValue(fields[key]));
+}
+function redactedDeleteAddressSkip(logger, logicalId, what, redactedFields) {
+	if (redactedFields.length === 0) return void 0;
+	logger.warn(safeMsg`${what} ${logicalId} is recorded in state with ${redactedFields.join(", ")} ` + "redacted (the '***' mask of a NoEcho value it read, or a secret '{{resolve:...}}' reference), which names nothing in AWS; skipping deletion — no AWS call is issued, so the resource is LEFT IN PLACE unless a parent resource this run also deletes removes it (then only the record is stale). Re-deploying records the same redaction again. The state record is KEPT and the run reports the skip: on 'cdkd destroy' / 'cdkd state destroy' (which exits non-zero) and, since issue 1762, on the plain DELETE of a resource removed from the template during cdkd deploy. Remove the resource by hand, then clear the stack's records with 'cdkd state orphan <stack>' — that command drops EVERY record for the stack, not just this one. NOTE a deploy-side REPLACEMENT or rollback delete instead FAILS the resource (https://github.com/go-to-k/cdkd/issues/1762) — the old resource is left untracked there, so remove it by hand.");
+	return {
+		outcome: "skipped",
+		reason: REDACTED_DELETE_ADDRESS_SKIP_REASON
+	};
+}
+
 //#endregion
 //#region src/provisioning/final-snapshot.ts
 const ATOMIC_FINAL_SNAPSHOT_TYPES = /* @__PURE__ */ new Set([
@@ -26132,30 +26466,6 @@ async function createReplicationGroupFinalSnapshot(client, replicationGroupId, l
 const NESTED_STACK_RESOURCE_TYPE$1 = "AWS::CloudFormation::Stack";
 const nonEmptyString = (v) => typeof v === "string" && v.length > 0;
 
-//#endregion
-//#region src/deployment/producer-regions-scope.ts
-const producerRegionsStore = new AsyncLocalStorage();
-function withProducerRegions(evidence, fn) {
-	return producerRegionsStore.run(evidence, fn);
-}
-function getCurrentProducerRegions() {
-	return producerRegionsStore.getStore();
-}
-function inheritProducerRegions(own, inherited) {
-	const seen = /* @__PURE__ */ new Set();
-	const regions = [];
-	for (const region of [...own, ...inherited?.regions ?? []]) {
-		const canonical = canonicalizeRegion(region);
-		if (!canonical || seen.has(canonical)) continue;
-		seen.add(canonical);
-		regions.push(region);
-	}
-	return {
-		regions,
-		complete: inherited?.complete === true
-	};
-}
-
 //#endregion
 //#region src/deployment/rollback-executor/messages.ts
 function throwIfDeleteSkipped(result, logicalId, physicalId, duringClause) {
@@ -26183,6 +26493,19 @@ function maskedRollbackEventError(error, mask) {
 		message
 	};
 }
+function recordRollbackSkip(scope, op, reason) {
+	scope.result.warnings++;
+	scope.result.skipped++;
+	scope.ctx.recordEvent?.({
+		eventType: "ROLLBACK_RESOURCE_SKIPPED",
+		stackName: scope.stackName,
+		operation: op.changeType,
+		logicalId: op.logicalId,
+		resourceType: op.resourceType,
+		...op.provisionedBy && { provisionedBy: op.provisionedBy },
+		reason: scope.mask(reason)
+	});
+}
 function effectiveProvisionedBy(record, fallbackProvisionedBy) {
 	return record?.provisionedBy ?? fallbackProvisionedBy;
 }
@@ -26286,6 +26609,271 @@ function retainedSurvivorMessages(logicalId, resourceType, survivorPhysicalId, s
 	};
 }
 
+//#endregion
+//#region src/deployment/rollback-executor/names.ts
+function replayPrefixScope(input, logger, mask, restoring) {
+	const choice = replayPrefixChoice(input);
+	if (choice.kind === "not-applicable") return (fn) => fn();
+	const setting = (skip) => skip ? "SKIPPED" : "KEPT";
+	const subject = `${safe(input.logicalId)} (${safe(input.resourceType)})`;
+	const declared = choice.declared;
+	const secretDerived = declared !== void 0 && mask(declared) !== declared;
+	const withheld = secretDerived || choice.kind === "unreproduced" && declared === void 0;
+	const shown = (value) => displayIdent(mask(String(value)));
+	const quoted = (value) => {
+		const masked = mask(value);
+		const rendered = displayIdent(masked);
+		return rendered === masked ? `"${masked}"` : rendered;
+	};
+	if (choice.kind === "reproduced" && choice.skipPrefix !== choice.recorded) logger.info(mask(`  Rollback: ${restoring ? "re-creating" : "reverting"} ${subject} under the user-supplied-name prefix setting that created ` + (withheld ? `it (its physical id is withheld, as its name is secret-derived): ` : `${shown(input.physicalId)} (`) + `stack-name prefix ${setting(choice.skipPrefix)}; the failed deploy ran with it ${setting(choice.recorded)}${withheld ? "" : ")"}`));
+	else if (choice.kind === "unreproduced" && restoring) {
+		const idUnreadable = typeof input.physicalId !== "string" || input.physicalId === "";
+		const prop = safe(choice.property);
+		const unreadable = declared === void 0 ? idUnreadable ? `its ${prop} or its physical id` : `its ${prop}` : idUnreadable ? `its physical id` : void 0;
+		logger.warn(mask(`  ⚠ ${subject}: cdkd cannot tell which user-supplied-name prefix setting created the old resource (` + (withheld ? `its physical id is withheld, as its name is secret-derived or unreadable` : shown(input.physicalId)) + `) — ` + (choice.names === void 0 ? unreadable !== void 0 ? `cdkd cannot read ${unreadable} to compare` : `cdkd cannot derive the names its ${prop} takes to compare` : secretDerived ? `its ${prop} is secret-derived, and neither name it derives matches` : `its ${prop} derives to ${quoted(choice.names.skipped)} (prefix skipped) or ${quoted(choice.names.kept)} (prefix kept), and it is neither`) + `; re-creating it with the stack-name prefix ${setting(choice.skipPrefix)}, as the failed deploy ran, so it may come back under a different physical name.`));
+	}
+	const skip = choice.skipPrefix;
+	return (fn) => withSkipPrefix(skip, fn);
+}
+function createOpMasker(logger, secrets) {
+	const base = createMaskedLogSinks(logger, (text) => maskSecretsInText(text, secrets));
+	const pairs = [];
+	let sinks = base;
+	return {
+		mask: (text) => typeof text === "string" ? sinks.mask(text) : text,
+		addNamed: (record) => {
+			pairs.push(...secretDerivedNamePairs(record));
+			sinks = withDerivedNameMasks(logger, base, pairs);
+		}
+	};
+}
+const OTHER_SPELLED_NAME_KEYS = {
+	"AWS::Cognito::UserPoolDomain": ["Domain"],
+	"AWS::Cognito::UserPoolUser": ["Username"],
+	"AWS::ECS::TaskDefinition": ["Family"],
+	"AWS::ElastiCache::ReplicationGroup": ["ReplicationGroupId"],
+	"AWS::ElastiCache::User": ["UserId"],
+	"AWS::ElastiCache::UserGroup": ["UserGroupId"],
+	"AWS::SES::EmailIdentity": ["EmailIdentity"]
+};
+const COMPOSITE_SCOPE_LAST = /^(?:REGIONAL|CLOUDFRONT|GLOBAL)$/;
+const COMPOSITE_POOL_FIRST = /^[a-z]{2}(?:-gov)?-[a-z]+-\d+_[A-Za-z0-9]+$/;
+function idNameSegments(id) {
+	const segments = /* @__PURE__ */ new Set();
+	const arn = /^arn:[^:]*:([^:]*):[^:]*:[^:]*:(.+)$/.exec(id);
+	if (arn !== null) {
+		const service = arn[1];
+		const resource = arn[2];
+		const lambda = service === "lambda" ? /^(?:function|layer):([^:]+)(?::([^:]+))?/.exec(resource) : null;
+		if (lambda !== null) {
+			segments.add(lambda[1]);
+			const qualifier = lambda[2];
+			if (qualifier !== void 0 && !/^\d+$/.test(qualifier)) segments.add(qualifier);
+		} else {
+			const parts = resource.split(/[/:]/).filter((part) => part !== "");
+			let body = parts.length > 1 ? parts.slice(1) : parts;
+			if (body.length > 1 && /^\d+$/.test(body[body.length - 1])) body = body.slice(0, -1);
+			for (const part of body) {
+				segments.add(part);
+				if (service === "secretsmanager") segments.add(part.replace(/-[A-Za-z0-9]{6}$/, ""));
+			}
+		}
+	}
+	if (id.includes("/")) {
+		const afterSlash = id.slice(id.lastIndexOf("/") + 1);
+		segments.add(afterSlash);
+		segments.add(afterSlash.replace(/:\d+$/, ""));
+	}
+	if (id.includes("|")) {
+		const parts = id.split("|");
+		parts.forEach((part, index) => {
+			if (part === "") return;
+			if (index === parts.length - 1 && parts.length > 1 && COMPOSITE_SCOPE_LAST.test(part)) return;
+			if (index === 0 && parts.length > 1 && COMPOSITE_POOL_FIRST.test(part)) return;
+			segments.add(part);
+		});
+	}
+	return [...segments].filter((segment) => segment.length >= 4 && segment !== id);
+}
+function ownEntry(table, key) {
+	return Object.hasOwn(table, key) ? table[key] : void 0;
+}
+function secretDerivedNamePairs(record) {
+	const { resourceType, properties, logicalId } = record;
+	if (typeof resourceType !== "string" || !isRestorableBag(properties)) return [];
+	const rewritten = reverseReplacementRewrittenNameTypes();
+	const named = /* @__PURE__ */ new Set();
+	const primary = Object.hasOwn(rewritten, resourceType) ? rewritten[resourceType].property : explicitNamePropertyFor(resourceType);
+	if (typeof primary === "string") named.add(primary);
+	for (const key of Object.keys(properties)) if (/(?:Name|Identifier)$/.test(key)) named.add(key);
+	for (const key of ownEntry(OTHER_SPELLED_NAME_KEYS, resourceType) ?? []) named.add(key);
+	const idSpellings = record.physicalIds.filter((id) => typeof id === "string" && id !== "").flatMap((id) => [
+		id,
+		...id.toLowerCase() === id || id.length < 4 ? [] : [id.toLowerCase()],
+		finalSnapshotNamePrefix(id, resourceType),
+		...idNameSegments(id)
+	]);
+	const pairs = [];
+	for (const key of named) {
+		if (!Object.hasOwn(properties, key)) continue;
+		const value = properties[key];
+		if (typeof value !== "string" || value === "") continue;
+		const derived = key === primary && !value.includes("{{resolve:") && value !== "***" ? rewrittenNameSpellings(resourceType, value, logicalId) : [];
+		for (const spelling of [...idSpellings, ...derived]) pairs.push([value, spelling]);
+	}
+	return pairs;
+}
+function addRecordNames(opMasker, op, current) {
+	const { logicalId } = op;
+	for (const properties of [op.properties, op.attemptedProperties]) opMasker.addNamed({
+		resourceType: op.resourceType,
+		properties,
+		logicalId,
+		physicalIds: [op.physicalId]
+	});
+	for (const record of [op.previousState, current]) {
+		if (record === null || typeof record !== "object") continue;
+		opMasker.addNamed({
+			resourceType: record.resourceType ?? op.resourceType,
+			properties: record.properties,
+			logicalId,
+			physicalIds: [record.physicalId]
+		});
+	}
+}
+const ABSENT_BASELINE_SKIP_CAUSE = "Its recorded previous state has no `properties` bag, so there is nothing to restore it to; the rollback left the resource exactly as it is.";
+function requireRestorableBaseline(bag, logger, { logicalId, consequence, remedy, retry }) {
+	if (isRestorableBag(bag)) return true;
+	if (bag === void 0) {
+		logger.warn(`  Rollback: Cannot restore ${shownLogicalId(logicalId)} \u2014 its recorded previous state has no \`properties\` bag, so there is nothing to restore it to. An empty desired state would ${consequence}. The resource is therefore left exactly as it is. ${remedy}`);
+		return false;
+	}
+	const shape = bag === null ? "null" : Array.isArray(bag) ? "an array" : `a ${typeof bag}`;
+	throw new CdkdError(`Cannot roll ${shownLogicalId(logicalId)} back: its recorded previous state has a \`properties\` field that is not a property bag (${shape}), so cdkd cannot tell what to restore it to. Replaying it would do one of two things, and cdkd does neither: send the malformed value to the provider as-is, or send an empty desired state (which would ${consequence}). The rollback JOURNAL record is kept: once that record holds a property bag again, ${retry}. Otherwise fix forward with \`cdkd deploy\`, or remove the stack with \`cdkd destroy\`.`, "ROLLBACK_UNUSABLE_BASELINE");
+}
+function isRestorableBag(bag) {
+	return typeof bag === "object" && bag !== null && !Array.isArray(bag);
+}
+async function prepareCreateRollbackFinalSnapshot(op, provisionedBy, ctx, mask) {
+	const { logicalId, resourceType } = op;
+	const physicalId = op.physicalId;
+	switch (finalSnapshotMechanism(resourceType, provisionedBy)) {
+		case "atomic-delete-parameter": return buildFinalSnapshotIdentifier(physicalId, resourceType);
+		case "pre-delete-snapshot":
+			await createPreDeleteFinalSnapshot(resourceType, physicalId, logicalId, ctx.finalSnapshotClients ?? getAwsClients(), {
+				info: (message) => ctx.logger.info(mask(message)),
+				debug: (message) => ctx.logger.debug(mask(message))
+			});
+			return;
+		case "refuse-cc-routed": throw ccRoutedFinalSnapshotError(logicalId, resourceType, SKIP_FINAL_SNAPSHOT_FLAG);
+		case "refuse-unsupported-type": throw unsupportedFinalSnapshotError(logicalId, resourceType, SKIP_FINAL_SNAPSHOT_FLAG);
+	}
+}
+
+//#endregion
+//#region src/deployment/rollback-executor/replay-inline-policy-restore.ts
+async function restoreHeldInlinePolicies(writers, stateResources, stackName, ctx, result, options = {}) {
+	for (const removal of writers.takeHeldRemovals(stateResources)) await restoreOne(removal, stateResources, stackName, ctx, result, options.refuseAll === true);
+}
+async function restoreOne({ kind, holders, unreadable, unsettled }, stateResources, stackName, ctx, result, refuseAll) {
+	const { logger } = ctx;
+	const ids = [...new Set(holders.map((h) => h.logicalId))].map((id) => safe(id)).join(", ");
+	const lost = safeMsg`the ${kind} it is on lacks that inline policy until the resource is next updated, or ` + `'cdkd drift <stack> --revert' restores it`;
+	if (refuseAll || unsettled.length > 0) {
+		const pending = refuseAll ? ids : unsettled.map((id) => safe(id)).join(", ");
+		logger.warn(safeMsg`  Rollback: an inline policy this rollback removed is recorded by ${ids}, but the ` + safeMsg`rollback of ${pending} has not completed, so that record may be the failed ` + safeMsg`deploy's and cdkd did not put it back; ${lost}.`);
+		result.warnings++;
+		return;
+	}
+	if (unreadable.length > 0) {
+		logger.warn(safeMsg`  Rollback: an inline policy this rollback removed is recorded by ${ids}, and ` + safeMsg`${unreadable.map((id) => safe(id)).join(", ")} may record it too under a redacted ` + safeMsg`name, so cdkd did not put it back; ${lost}.`);
+		result.warnings++;
+		return;
+	}
+	const documents = holders.map((h) => serializedDocument(h.document));
+	if (documents.some((d) => d === void 0)) {
+		logger.warn(safeMsg`  Rollback: an inline policy this rollback removed is still recorded by ${ids}, but its ` + safeMsg`recorded document is absent or redacted, so cdkd did not put it back; ${lost}.`);
+		result.warnings++;
+		return;
+	}
+	if (new Set(documents).size > 1) {
+		logger.warn(safeMsg`  Rollback: an inline policy this rollback removed is recorded by ${ids} with different ` + safeMsg`documents under one name on one ${kind}, so cdkd put neither back; ${lost}.`);
+		result.warnings++;
+		return;
+	}
+	const holder = holders[0];
+	const secrets = /* @__PURE__ */ new Map();
+	for (const h of holders) {
+		const bag = ctx.logOnlyNeedlesFor?.(h.logicalId);
+		if (bag) carryLogOnlyValues(bag, secrets);
+	}
+	const masker = createOpMasker(logger, secrets);
+	for (const h of holders) {
+		const record = stateResources[h.logicalId];
+		addRecordNames(masker, {
+			logicalId: h.logicalId,
+			resourceType: record?.resourceType,
+			physicalId: record?.physicalId
+		}, record);
+	}
+	try {
+		const { provider, provisionedBy } = ctx.providerRegistry.getProviderFor({
+			resourceType: "AWS::IAM::Policy",
+			provisionedBy: "sdk"
+		});
+		if (provisionedBy !== "sdk") throw new Error("AWS::IAM::Policy is not routed to its SDK provider");
+		await provider.create(holder.logicalId, "AWS::IAM::Policy", {
+			PolicyName: holder.policyName,
+			PolicyDocument: holder.document,
+			[POLICY_LIST_FIELDS[kind]]: [holder.principal]
+		}, { maskSecrets: masker.mask });
+	} catch (error) {
+		logger.warn(maskedFailureText(safeMsg`  Rollback: could not put back the inline policy ${ids} records on its ${kind} ` + safeMsg`(${lost}): `, error, masker.mask));
+		result.warnings++;
+		return;
+	}
+	logger.info(safeMsg`  Rollback: put back the inline policy ${ids} records on its ${kind}`);
+	const holderType = stateResources[holder.logicalId]?.resourceType;
+	ctx.recordEvent?.({
+		eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
+		stackName,
+		operation: "UPDATE",
+		logicalId: holder.logicalId,
+		...typeof holderType === "string" && { resourceType: holderType },
+		provisionedBy: "sdk",
+		reason: `Put back the inline policy this resource records on its ${kind}, which the rollback had removed from it.`
+	});
+}
+function serializedDocument(document) {
+	if (typeof document === "string") return document.length > 0 && !isRedactedRecordedValue(document) ? document : void 0;
+	if (document === null || typeof document !== "object" || Array.isArray(document)) return;
+	return isRedactedRecordedValue(document) ? void 0 : JSON.stringify(document);
+}
+
+//#endregion
+//#region src/deployment/producer-regions-scope.ts
+const producerRegionsStore = new AsyncLocalStorage();
+function withProducerRegions(evidence, fn) {
+	return producerRegionsStore.run(evidence, fn);
+}
+function getCurrentProducerRegions() {
+	return producerRegionsStore.getStore();
+}
+function inheritProducerRegions(own, inherited) {
+	const seen = /* @__PURE__ */ new Set();
+	const regions = [];
+	for (const region of [...own, ...inherited?.regions ?? []]) {
+		const canonical = canonicalizeRegion(region);
+		if (!canonical || seen.has(canonical)) continue;
+		seen.add(canonical);
+		regions.push(region);
+	}
+	return {
+		regions,
+		complete: inherited?.complete === true
+	};
+}
+
 //#endregion
 //#region src/deployment/rollback-executor/replay-secrets.ts
 function replayProducerRegionEvidence(ctx) {
@@ -26589,166 +27177,6 @@ function sortRollbackCreates(createOps, stateResources, logger) {
 	return sorted;
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/names.ts
-function replayPrefixScope(input, logger, mask, restoring) {
-	const choice = replayPrefixChoice(input);
-	if (choice.kind === "not-applicable") return (fn) => fn();
-	const setting = (skip) => skip ? "SKIPPED" : "KEPT";
-	const subject = `${safe(input.logicalId)} (${safe(input.resourceType)})`;
-	const declared = choice.declared;
-	const secretDerived = declared !== void 0 && mask(declared) !== declared;
-	const withheld = secretDerived || choice.kind === "unreproduced" && declared === void 0;
-	const shown = (value) => displayIdent(mask(String(value)));
-	const quoted = (value) => {
-		const masked = mask(value);
-		const rendered = displayIdent(masked);
-		return rendered === masked ? `"${masked}"` : rendered;
-	};
-	if (choice.kind === "reproduced" && choice.skipPrefix !== choice.recorded) logger.info(mask(`  Rollback: ${restoring ? "re-creating" : "reverting"} ${subject} under the user-supplied-name prefix setting that created ` + (withheld ? `it (its physical id is withheld, as its name is secret-derived): ` : `${shown(input.physicalId)} (`) + `stack-name prefix ${setting(choice.skipPrefix)}; the failed deploy ran with it ${setting(choice.recorded)}${withheld ? "" : ")"}`));
-	else if (choice.kind === "unreproduced" && restoring) {
-		const idUnreadable = typeof input.physicalId !== "string" || input.physicalId === "";
-		const prop = safe(choice.property);
-		const unreadable = declared === void 0 ? idUnreadable ? `its ${prop} or its physical id` : `its ${prop}` : idUnreadable ? `its physical id` : void 0;
-		logger.warn(mask(`  ⚠ ${subject}: cdkd cannot tell which user-supplied-name prefix setting created the old resource (` + (withheld ? `its physical id is withheld, as its name is secret-derived or unreadable` : shown(input.physicalId)) + `) — ` + (choice.names === void 0 ? unreadable !== void 0 ? `cdkd cannot read ${unreadable} to compare` : `cdkd cannot derive the names its ${prop} takes to compare` : secretDerived ? `its ${prop} is secret-derived, and neither name it derives matches` : `its ${prop} derives to ${quoted(choice.names.skipped)} (prefix skipped) or ${quoted(choice.names.kept)} (prefix kept), and it is neither`) + `; re-creating it with the stack-name prefix ${setting(choice.skipPrefix)}, as the failed deploy ran, so it may come back under a different physical name.`));
-	}
-	const skip = choice.skipPrefix;
-	return (fn) => withSkipPrefix(skip, fn);
-}
-function createOpMasker(logger, secrets) {
-	const base = createMaskedLogSinks(logger, (text) => maskSecretsInText(text, secrets));
-	const pairs = [];
-	let sinks = base;
-	return {
-		mask: (text) => typeof text === "string" ? sinks.mask(text) : text,
-		addNamed: (record) => {
-			pairs.push(...secretDerivedNamePairs(record));
-			sinks = withDerivedNameMasks(logger, base, pairs);
-		}
-	};
-}
-const OTHER_SPELLED_NAME_KEYS = {
-	"AWS::Cognito::UserPoolDomain": ["Domain"],
-	"AWS::Cognito::UserPoolUser": ["Username"],
-	"AWS::ECS::TaskDefinition": ["Family"],
-	"AWS::ElastiCache::ReplicationGroup": ["ReplicationGroupId"],
-	"AWS::ElastiCache::User": ["UserId"],
-	"AWS::ElastiCache::UserGroup": ["UserGroupId"],
-	"AWS::SES::EmailIdentity": ["EmailIdentity"]
-};
-const COMPOSITE_SCOPE_LAST = /^(?:REGIONAL|CLOUDFRONT|GLOBAL)$/;
-const COMPOSITE_POOL_FIRST = /^[a-z]{2}(?:-gov)?-[a-z]+-\d+_[A-Za-z0-9]+$/;
-function idNameSegments(id) {
-	const segments = /* @__PURE__ */ new Set();
-	const arn = /^arn:[^:]*:([^:]*):[^:]*:[^:]*:(.+)$/.exec(id);
-	if (arn !== null) {
-		const service = arn[1];
-		const resource = arn[2];
-		const lambda = service === "lambda" ? /^(?:function|layer):([^:]+)(?::([^:]+))?/.exec(resource) : null;
-		if (lambda !== null) {
-			segments.add(lambda[1]);
-			const qualifier = lambda[2];
-			if (qualifier !== void 0 && !/^\d+$/.test(qualifier)) segments.add(qualifier);
-		} else {
-			const parts = resource.split(/[/:]/).filter((part) => part !== "");
-			let body = parts.length > 1 ? parts.slice(1) : parts;
-			if (body.length > 1 && /^\d+$/.test(body[body.length - 1])) body = body.slice(0, -1);
-			for (const part of body) {
-				segments.add(part);
-				if (service === "secretsmanager") segments.add(part.replace(/-[A-Za-z0-9]{6}$/, ""));
-			}
-		}
-	}
-	if (id.includes("/")) {
-		const afterSlash = id.slice(id.lastIndexOf("/") + 1);
-		segments.add(afterSlash);
-		segments.add(afterSlash.replace(/:\d+$/, ""));
-	}
-	if (id.includes("|")) {
-		const parts = id.split("|");
-		parts.forEach((part, index) => {
-			if (part === "") return;
-			if (index === parts.length - 1 && parts.length > 1 && COMPOSITE_SCOPE_LAST.test(part)) return;
-			if (index === 0 && parts.length > 1 && COMPOSITE_POOL_FIRST.test(part)) return;
-			segments.add(part);
-		});
-	}
-	return [...segments].filter((segment) => segment.length >= 4 && segment !== id);
-}
-function ownEntry(table, key) {
-	return Object.hasOwn(table, key) ? table[key] : void 0;
-}
-function secretDerivedNamePairs(record) {
-	const { resourceType, properties, logicalId } = record;
-	if (typeof resourceType !== "string" || !isRestorableBag(properties)) return [];
-	const rewritten = reverseReplacementRewrittenNameTypes();
-	const named = /* @__PURE__ */ new Set();
-	const primary = Object.hasOwn(rewritten, resourceType) ? rewritten[resourceType].property : explicitNamePropertyFor(resourceType);
-	if (typeof primary === "string") named.add(primary);
-	for (const key of Object.keys(properties)) if (/(?:Name|Identifier)$/.test(key)) named.add(key);
-	for (const key of ownEntry(OTHER_SPELLED_NAME_KEYS, resourceType) ?? []) named.add(key);
-	const idSpellings = record.physicalIds.filter((id) => typeof id === "string" && id !== "").flatMap((id) => [
-		id,
-		...id.toLowerCase() === id || id.length < 4 ? [] : [id.toLowerCase()],
-		finalSnapshotNamePrefix(id, resourceType),
-		...idNameSegments(id)
-	]);
-	const pairs = [];
-	for (const key of named) {
-		if (!Object.hasOwn(properties, key)) continue;
-		const value = properties[key];
-		if (typeof value !== "string" || value === "") continue;
-		const derived = key === primary && !value.includes("{{resolve:") && value !== "***" ? rewrittenNameSpellings(resourceType, value, logicalId) : [];
-		for (const spelling of [...idSpellings, ...derived]) pairs.push([value, spelling]);
-	}
-	return pairs;
-}
-function addRecordNames(opMasker, op, current) {
-	const { logicalId } = op;
-	for (const properties of [op.properties, op.attemptedProperties]) opMasker.addNamed({
-		resourceType: op.resourceType,
-		properties,
-		logicalId,
-		physicalIds: [op.physicalId]
-	});
-	for (const record of [op.previousState, current]) {
-		if (record === null || typeof record !== "object") continue;
-		opMasker.addNamed({
-			resourceType: record.resourceType ?? op.resourceType,
-			properties: record.properties,
-			logicalId,
-			physicalIds: [record.physicalId]
-		});
-	}
-}
-function requireRestorableBaseline(bag, logger, { logicalId, consequence, remedy, retry }) {
-	if (isRestorableBag(bag)) return true;
-	if (bag === void 0) {
-		logger.warn(`  Rollback: Cannot restore ${shownLogicalId(logicalId)} \u2014 its recorded previous state has no \`properties\` bag, so there is nothing to restore it to. An empty desired state would ${consequence}. The resource is therefore left exactly as it is. ${remedy}`);
-		return false;
-	}
-	const shape = bag === null ? "null" : Array.isArray(bag) ? "an array" : `a ${typeof bag}`;
-	throw new CdkdError(`Cannot roll ${shownLogicalId(logicalId)} back: its recorded previous state has a \`properties\` field that is not a property bag (${shape}), so cdkd cannot tell what to restore it to. Replaying it would do one of two things, and cdkd does neither: send the malformed value to the provider as-is, or send an empty desired state (which would ${consequence}). The rollback JOURNAL record is kept: once that record holds a property bag again, ${retry}. Otherwise fix forward with \`cdkd deploy\`, or remove the stack with \`cdkd destroy\`.`, "ROLLBACK_UNUSABLE_BASELINE");
-}
-function isRestorableBag(bag) {
-	return typeof bag === "object" && bag !== null && !Array.isArray(bag);
-}
-async function prepareCreateRollbackFinalSnapshot(op, provisionedBy, ctx, mask) {
-	const { logicalId, resourceType } = op;
-	const physicalId = op.physicalId;
-	switch (finalSnapshotMechanism(resourceType, provisionedBy)) {
-		case "atomic-delete-parameter": return buildFinalSnapshotIdentifier(physicalId, resourceType);
-		case "pre-delete-snapshot":
-			await createPreDeleteFinalSnapshot(resourceType, physicalId, logicalId, ctx.finalSnapshotClients ?? getAwsClients(), {
-				info: (message) => ctx.logger.info(mask(message)),
-				debug: (message) => ctx.logger.debug(mask(message))
-			});
-			return;
-		case "refuse-cc-routed": throw ccRoutedFinalSnapshotError(logicalId, resourceType, SKIP_FINAL_SNAPSHOT_FLAG);
-		case "refuse-unsupported-type": throw unsupportedFinalSnapshotError(logicalId, resourceType, SKIP_FINAL_SNAPSHOT_FLAG);
-	}
-}
-
 //#endregion
 //#region src/deployment/rollback-executor/replay-props.ts
 async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId) {
@@ -26916,10 +27344,10 @@ async function replayOrphanRetain(s) {
 	});
 }
 async function replayDelete(s) {
-	const { op, stateResources, stackName, ctx, result, inlinePolicyWriters, afterOp, action, logger, mask } = s;
+	const { op, stateResources, stackName, ctx, inlinePolicyWriters, afterOp, action, logger, mask } = s;
 	if (!op.physicalId) {
 		logger.warn(`  Rollback: Cannot delete ${safe(op.logicalId)} — no physical ID recorded`);
-		result.warnings++;
+		recordRollbackSkip(s, op, "No physical id is recorded for the rolled-back CREATE, so the rollback cannot address it to delete it.");
 		return;
 	}
 	const deleteProvisionedBy = effectiveProvisionedBy(stateResources[op.logicalId], op.provisionedBy);
@@ -27004,17 +27432,17 @@ async function replayReadopt(s) {
 	});
 }
 async function replayRevert(s) {
-	const { op, stateResources, stackName, ctx, resolver, result, inlinePolicyWriters, afterOp, isInterrupted, logger, secrets, opMasker, mask } = s;
+	const { op, stateResources, stackName, ctx, resolver, inlinePolicyWriters, afterOp, isInterrupted, logger, secrets, opMasker, mask } = s;
 	if (!op.previousState) {
 		logger.warn(`  Rollback: Cannot restore ${safe(op.logicalId)} — no previous state available`);
-		result.warnings++;
+		recordRollbackSkip(s, op, "No previous state is recorded for it, so there is nothing to restore it to.");
 		return;
 	}
 	const previousState = op.previousState;
 	const current = stateResources[op.logicalId];
 	if (!current) {
 		logger.warn(`  Rollback: Cannot restore ${safe(op.logicalId)} — resource not found in current state`);
-		result.warnings++;
+		recordRollbackSkip(s, op, "The resource is not in the current state, so the rollback had nothing to restore.");
 		return;
 	}
 	if (!requireRestorableBaseline(previousState.properties, logger, {
@@ -27023,7 +27451,7 @@ async function replayRevert(s) {
 		remedy: "Re-run `cdkd deploy` to re-converge it.",
 		retry: `re-running ${rerunRollbackPhrase(ctx, "`cdkd rollback`")} retries this op`
 	})) {
-		result.warnings++;
+		recordRollbackSkip(s, op, ABSENT_BASELINE_SKIP_CAUSE);
 		return;
 	}
 	logger.info(`  Rollback: Restoring ${safe(op.logicalId)} (${safe(op.resourceType)}) to previous state`);
@@ -27102,7 +27530,7 @@ async function replayReverseReplacement(s) {
 		remedy: "Re-run `cdkd deploy` to re-converge it.",
 		retry: `re-running ${rerunRollbackPhrase(ctx, "`cdkd rollback`")} retries this op`
 	})) {
-		result.warnings++;
+		recordRollbackSkip(s, op, ABSENT_BASELINE_SKIP_CAUSE);
 		return;
 	}
 	const resolvedPrevProps = await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId) ?? {};
@@ -27261,7 +27689,8 @@ async function replayReverseReplacement(s) {
 			physicalId: current.physicalId,
 			reason: mask(survivorReason),
 			...survivorProvisionedBy && { provisionedBy: survivorProvisionedBy }
-		}
+		},
+		...adoptedLiveNewResource && { reason: mask("The re-create returned the live new resource instead of re-creating the old one (its Create API is name-idempotent), so the replacement was NOT fully reversed: the old resource's original properties may not have been re-applied. Inspect it with `cdkd drift` and run `cdkd deploy` to reconcile.") }
 	});
 }
 
@@ -27317,11 +27746,13 @@ async function replayRollbackUnbound(operations, stateResources, stackName, ctx,
 	const result = {
 		failures: 0,
 		warnings: 0,
+		skipped: 0,
 		interrupted: false,
 		orphaned: []
 	};
 	if (operations.length === 0) {
 		ctx.logger.info("No completed operations to roll back.");
+		await restoreHeldInlinePolicies(inlinePolicyWriters, stateResources, stackName, ctx, result);
 		return result;
 	}
 	ctx.logger.info(`Rolling back ${operations.length} completed operation(s)...`);
@@ -27330,6 +27761,7 @@ async function replayRollbackUnbound(operations, stateResources, stackName, ctx,
 		stackName
 	});
 	const resolver = new ReplayResolvers(ctx.region);
+	inlinePolicyWriters.notePending(operations);
 	const { createOps, otherOps } = partitionOps(operations);
 	for (let i = otherOps.length - 1; i >= 0; i--) {
 		if (options.isInterrupted?.()) {
@@ -27348,6 +27780,7 @@ async function replayRollbackUnbound(operations, stateResources, stackName, ctx,
 			await replaySingle(op, stateResources, stackName, ctx, resolver, orphanLogicalIds, result, options.onOrphan, inlinePolicyWriters, options.afterOp, options.isInterrupted);
 		}
 	}
+	await restoreHeldInlinePolicies(inlinePolicyWriters, stateResources, stackName, ctx, result);
 	ctx.logger.info("Rollback completed. Some resources may remain if deletion failed.");
 	ctx.recordEvent?.({
 		eventType: "ROLLBACK_FINISHED",
@@ -27382,23 +27815,24 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 		mask,
 		createRollbackRoute: void 0
 	};
+	const recordBefore = ownRecord(stateResources, op.logicalId);
 	try {
 		addRecordNames(opMasker, op, stateResources[op.logicalId]);
 		switch (action) {
 			case "unrecoverable-delete":
 				logger.warn(`  Rollback: Cannot restore deleted resource ${safe(op.logicalId)} (${safe(op.resourceType)}) — resource has already been deleted`);
-				result.warnings++;
+				recordRollbackSkip(scope, op, "The failed deploy deleted this resource, and a rollback cannot re-create a deleted resource.");
 				return;
 			case "skip-already-done":
 				logger.debug(`  Rollback: ${safe(op.logicalId)} already reverted, skipping`);
 				return;
 			case "skip-mismatch":
 				logger.warn(`  Rollback: Skipping ${safe(op.logicalId)} — its physical id changed since the failed deploy (replaced by a later attempt); manual attention may be required`);
-				result.warnings++;
+				recordRollbackSkip(scope, op, "Its physical id changed since the failed deploy (replaced by a later attempt), so the rollback left it as it is; manual attention may be required.");
 				return;
 			case "skip-absent":
 				logger.warn(`  Rollback: Cannot restore ${safe(op.logicalId)} — resource no longer in state, skipping`);
-				result.warnings++;
+				recordRollbackSkip(scope, op, "The resource is no longer in state, so the rollback had nothing to restore.");
 				return;
 			case "refuse-replacement-routing": {
 				const routing = resolveReplacementOldType(op);
@@ -27426,13 +27860,19 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 			...failedRoute && { provisionedBy: failedRoute },
 			error: maskedRollbackEventError(rollbackError, mask)
 		});
+	} finally {
+		inlinePolicyWriters.noteOutcome(op, action === "skip-already-done" || ownRecord(stateResources, op.logicalId) !== recordBefore);
 	}
 }
+function ownRecord(stateResources, logicalId) {
+	return Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+}
 async function replayFailedOperationsUnbound(failedOps, stateResources, stackName, ctx, options = {}) {
 	const inlinePolicyWriters = options.inlinePolicyWriters ?? new RollbackInlinePolicyWriters();
 	const result = {
 		failures: 0,
 		warnings: 0,
+		skipped: 0,
 		interrupted: false,
 		remainingFailedOps: [],
 		orphaned: []
@@ -27456,7 +27896,14 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 		const secrets = /* @__PURE__ */ new Map();
 		const opMasker = createOpMasker(logger, secrets);
 		const mask = opMasker.mask;
+		const skipScope = {
+			ctx,
+			stackName,
+			result,
+			mask
+		};
 		let createRollbackRoute;
+		const recordBefore = ownRecord(stateResources, op.logicalId);
 		try {
 			addRecordNames(opMasker, op, stateResources[op.logicalId]);
 			switch (action) {
@@ -27465,15 +27912,15 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 					break;
 				case "skip-failed-unknown":
 					logger.warn(`  Rollback: failed CREATE of ${safe(op.logicalId)} (${safe(op.resourceType)}) recorded no physical id — if it was partially created in AWS, delete it manually`);
-					result.warnings++;
+					recordRollbackSkip(skipScope, op, "The failed CREATE recorded no physical id, so the rollback cannot address it; if it was partially created in AWS, delete it manually.");
 					break;
 				case "skip-failed-absent":
 					logger.warn(`  Rollback: cannot revert failed UPDATE of ${safe(op.logicalId)} — no previous state available, skipping`);
-					result.warnings++;
+					recordRollbackSkip(skipScope, op, "No previous state is available for the failed UPDATE, so there is nothing to revert it to.");
 					break;
 				case "skip-failed-type-change":
 					logger.warn(`  Rollback: cannot revert failed UPDATE of ${shownLogicalId(op.logicalId)} in place — it was a Type change (${refusalResourceType(op.previousState?.resourceType)} -> ${refusalResourceType(op.resourceType)}), which is a replacement, and its remote state is unknown. Inspect it with \`cdkd drift\` and re-converge with \`cdkd deploy\`. Skipping.`);
-					result.warnings++;
+					recordRollbackSkip(skipScope, op, `The failed UPDATE was a Type change (${String(op.previousState?.resourceType)} -> ${String(op.resourceType)}), which is a replacement, and its remote state is unknown, so it cannot be reverted in place.`);
 					break;
 				case "orphan-failed-create-retain": {
 					const failedCreateRecord = stateResources[op.logicalId];
@@ -27546,7 +27993,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						remedy: "Inspect it with `cdkd drift` (this op died mid-flight, so its remote state is unknown) and re-converge with `cdkd drift --revert` or `cdkd deploy`.",
 						retry: "re-running `cdkd rollback --revert-failed` retries this op (a plain `cdkd rollback` replays only the COMPLETED ops and then pops the whole segment, discarding this record)"
 					})) {
-						result.warnings++;
+						recordRollbackSkip(skipScope, op, ABSENT_BASELINE_SKIP_CAUSE);
 						break;
 					}
 					logger.info(`  Rollback: force-reverting failed UPDATE of ${safe(op.logicalId)} (${safe(op.resourceType)}) to its pre-deploy properties (--revert-failed; remote state is unknown)`);
@@ -27625,7 +28072,9 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 				error: maskedRollbackEventError(revertError, mask)
 			});
 		}
+		inlinePolicyWriters.noteOutcome(op, action === "skip-failed-noop" || ownRecord(stateResources, op.logicalId) !== recordBefore);
 	}
+	if (result.interrupted) await restoreHeldInlinePolicies(inlinePolicyWriters, stateResources, stackName, ctx, result, { refuseAll: true });
 	if (emitEnvelope) ctx.recordEvent?.({
 		eventType: "ROLLBACK_FINISHED",
 		stackName
@@ -28096,6 +28545,7 @@ async function performRollback(completedOperations, stateResources, stackName, p
 	return {
 		failures: result.failures,
 		warnings: result.warnings + run.warnings,
+		skipped: result.skipped,
 		orphaned: result.orphaned,
 		settledNested: run.settled
 	};
@@ -28145,7 +28595,7 @@ async function settleJournalAfterCleanRollback(stackName, failedOperations, init
 		this.logger.warn(safeMsg`Failed to settle the rollback journal after the clean rollback: ${err instanceof Error ? err.message : String(err)}. ` + `The journal keeps the full segment; a later rollback replay is idempotent.`);
 		return false;
 	}
-	await this.writeRollbackJournalSegment(stackName, [], failedOperations, "auto-rollback-clean", initialDeploy);
+	if (!await this.writeRollbackJournalSegment(stackName, [], failedOperations, "auto-rollback-clean", initialDeploy)) return true;
 	this.logger.info(`The automatic rollback restored the pre-deploy state. The failed resource's pre-failure record was kept — if it was left partially applied, revert it.\nRevert it with: ${pasteableCommand("cdkd rollback", [{
 		value: stackName,
 		hole: "stack"
@@ -28193,7 +28643,7 @@ function producerRegionEvidence(previousState) {
 	return inheritProducerRegions(own, this.options.inheritedProducerRegions?.());
 }
 async function writeRollbackJournalSegment(stackName, completedOperations, failedOperations, reason, initialDeploy, nestedPending) {
-	if (!nestedPending && completedOperations.length === 0 && failedOperations.length === 0) return;
+	if (!nestedPending && completedOperations.length === 0 && failedOperations.length === 0) return false;
 	const redactedCompleted = this.redactOperationsForJournal(completedOperations);
 	const redactedFailed = this.redactOperationsForJournal(failedOperations);
 	try {
@@ -28212,8 +28662,10 @@ async function writeRollbackJournalSegment(stackName, completedOperations, faile
 		};
 		await this.stateBackend.appendRollbackJournalSegment(stackName, this.stackRegion, segment);
 		this.logger.debug(`Rollback journal segment written (${reason})`);
+		return true;
 	} catch (journalError) {
 		this.logger.warn(`Failed to write rollback journal: ${journalError instanceof Error ? journalError.message : String(journalError)}. 'cdkd rollback' will NOT be able to revert this deploy — use 'cdkd deploy' to resume or 'cdkd destroy' to clean up.`);
+		return false;
 	}
 }
 
@@ -29147,6 +29599,45 @@ function hasUnpersistedHeals(resources) {
 	return false;
 }
 
+//#endregion
+//#region src/deployment/deploy-engine/record-shape.ts
+function auditResolvedAssetReferences(logicalId, resourceType, resolvedProps) {
+	const redirect = this.options.assetRedirect;
+	if (!redirect) return;
+	const findings = findUnrewrittenAssetReferences(resolvedProps, redirect);
+	if (findings.length === 0) return;
+	const detail = findings.map((f) => `  - ${f.path}: still references '${f.source}'`).join("\n");
+	throw new ProvisioningError(`Unrewritten asset reference on '${logicalId}' (${resourceType}): this region uses cdkd-owned asset storage, but the following resolved properties still point at the CDK bootstrap storage that 'cdk gc' may garbage-collect:\n${detail}\nThis is a template shape cdkd's asset-reference rewrite did not cover — deploying it would split-brain the stack (assets in cdkd storage, properties reading the CDK bucket). Please report this at https://github.com/go-to-k/cdkd/issues with the property shape. Workaround: deploy with --use-cdk-bootstrap-assets to pin the legacy destinations for this app.`, resourceType, logicalId);
+}
+function extractAllDependencies(template, logicalId) {
+	const resource = template?.Resources?.[logicalId];
+	if (!resource) return void 0;
+	const parser = new TemplateParser();
+	const parameterNames = new Set(Object.keys(template?.Parameters ?? {}));
+	const deps = [...parser.extractDependencies(resource)].filter((dep) => !parameterNames.has(dep));
+	return deps.length > 0 ? deps : void 0;
+}
+function propertiesToRecord(desiredProperties, result, resourceType, provisionedBy) {
+	if (result.effectiveProperties) return markWrittenFromDeployedTemplate(provisionedBy === "sdk" ? withoutSilentDropProperties(resourceType, result.effectiveProperties) : result.effectiveProperties);
+	const written = provisionedBy === "sdk" ? withoutSilentDropProperties(resourceType, desiredProperties) : desiredProperties;
+	return markWrittenFromDeployedTemplate(markSameGenerationBag(written));
+}
+function extractTemplateAttributes(template, logicalId) {
+	const resource = template?.Resources?.[logicalId];
+	return {
+		deletionPolicy: resource?.DeletionPolicy,
+		updateReplacePolicy: resource?.UpdateReplacePolicy
+	};
+}
+function acceptedCreateOnlyDropsField(recordedProperties, resourceType, provisionedBy, mode, previous) {
+	if (provisionedBy !== "sdk") return { acceptedCreateOnlyDrops: void 0 };
+	const createOnly = getPropertyCoverage(resourceType)?.createOnlyDrops;
+	if (createOnly === void 0 || createOnly.size === 0) return { acceptedCreateOnlyDrops: void 0 };
+	const carried = mode === "in-place" ? acceptedCreateOnlyDropsOf(previous) : void 0;
+	const names = findSilentDropProperties(resourceType, recordedProperties).map(({ property }) => property).filter((property) => createOnly.has(property) && (carried === void 0 || carried.has(property)));
+	return { acceptedCreateOnlyDrops: names.length > 0 ? names : void 0 };
+}
+
 //#endregion
 //#region src/utils/resource-line.ts
 function formatResourceLine(op, logicalId, resourceType, verbOverride) {
@@ -29160,6 +29651,75 @@ function formatResourceLine(op, logicalId, resourceType, verbOverride) {
 	}
 }
 
+//#endregion
+//#region src/deployment/prior-attempt-scope.ts
+const priorAttemptStore = new AsyncLocalStorage();
+function withPriorAttempts(lookup, fn) {
+	return priorAttemptStore.run(lookup, fn);
+}
+function priorAttemptLookup(logicalId, attempts) {
+	let landed = false;
+	return {
+		logicalId,
+		attempts,
+		notePossiblyLanded: () => {
+			landed = true;
+		},
+		possiblyLanded: () => landed
+	};
+}
+function getPriorAttempts(logicalId) {
+	const bound = priorAttemptStore.getStore();
+	return bound?.logicalId === logicalId ? bound : void 0;
+}
+function priorAttemptsInJournal(journal, logicalId, resourceType) {
+	let bags = [];
+	for (const segment of journal?.segments ?? []) {
+		if (segment.operations.some((op) => op.logicalId === logicalId)) bags = [];
+		for (const op of segment.failedOperations ?? []) {
+			if (op.logicalId !== logicalId || op.resourceType !== resourceType) continue;
+			if (op.changeType === "DELETE" || !isBag(op.attemptedProperties)) continue;
+			if (recordedAsNewResource(op)) continue;
+			bags.push(op.attemptedProperties);
+		}
+		if (segment.supersededLogicalIds?.includes(logicalId)) bags = [];
+	}
+	return bags;
+}
+function recordedAsNewResource(op) {
+	if (typeof op.physicalId !== "string" || op.physicalId === "") return false;
+	if (op.changeType === "CREATE") return true;
+	const previous = op.previousState?.physicalId;
+	return typeof previous === "string" && previous !== op.physicalId;
+}
+function isBag(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+const REFUSED_BEFORE_APPLYING = Symbol.for("cdkd.refusedBeforeApplying");
+const MAX_CAUSE_DEPTH = 10;
+function markRefusedBeforeApplying(error) {
+	if (!Object.isExtensible(error)) return error;
+	Object.defineProperty(error, REFUSED_BEFORE_APPLYING, {
+		value: true,
+		enumerable: false,
+		configurable: true,
+		writable: false
+	});
+	return error;
+}
+function isRefusedBeforeApplying(error, logicalId) {
+	let current = error;
+	for (let depth = 0; depth < MAX_CAUSE_DEPTH && current != null; depth++) {
+		if (typeof current === "object" || typeof current === "function") {
+			const linkId = current.logicalId;
+			if (typeof linkId === "string" && linkId !== logicalId) return false;
+			if (current[REFUSED_BEFORE_APPLYING] === true) return true;
+		}
+		current = current.cause;
+	}
+	return false;
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/create.ts
 async function provisionCreate(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
@@ -29202,10 +29762,12 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 	this.registerNoEchoAttributes(logicalId, result, createSecrets, resolvedProps);
 	const dependencies = this.extractAllDependencies(template, logicalId);
 	const templateAttrs = this.extractTemplateAttributes(template, logicalId);
+	const recordedProperties = this.propertiesToRecord(resolvedProps, result, resourceType, createDecision.provisionedBy);
 	stateResources[logicalId] = {
 		physicalId: result.physicalId,
 		resourceType,
-		properties: this.propertiesToRecord(resolvedProps, result, resourceType, createDecision.provisionedBy),
+		properties: recordedProperties,
+		...acceptedCreateOnlyDropsField(recordedProperties, resourceType, createDecision.provisionedBy, "new-resource"),
 		...result.attributes && { attributes: result.attributes },
 		...dependencies && dependencies.length > 0 && { dependencies },
 		...templateAttrs,
@@ -29239,7 +29801,7 @@ async function refuseTakenCreateName(input) {
 	const named = `${question.property} ${shown(question.desiredName)}`;
 	const adoptsText = "its create API hands back or overwrites an existing resource of that name instead of refusing it";
 	const refuse = (message, cause) => {
-		throw markNonRetryable(new CdkdError(maskName(message), "NAMED_CREATE_COLLISION", cause instanceof Error ? cause : void 0));
+		throw markNonRetryable(markRefusedBeforeApplying(new CdkdError(maskName(message), "NAMED_CREATE_COLLISION", cause instanceof Error ? cause : void 0)));
 	};
 	let knownPhysicalId;
 	const byArn = ["AWS::SNS::Topic", "AWS::StepFunctions::StateMachine"].includes(resourceType) ? createLookupArn(resourceType, question.desiredName, await getAccountInfo(this.stackRegion)) : void 0;
@@ -29272,262 +29834,6 @@ async function refuseTakenCreateName(input) {
 	return refuse(`${subject} is created with ${named}, and an existing resource (${shown(holderId)}) already holds that name. Since ${adoptsText}, creating it would take that resource over and record it as this stack's, for a later \`cdkd destroy\` to delete. Nothing was created. Choose a name no other resource holds; ` + ownRemedy);
 }
 
-//#endregion
-//#region src/deployment/deploy-value-equality.ts
-function isReplacementCeiling(pc) {
-	return pc.requiresReplacement && (pc.inPlacePropagated === true || pc.replacementPropagated === true);
-}
-function keyOrderFreeJson(value) {
-	return JSON.stringify(value, (_key, node) => {
-		if (node === null || typeof node !== "object" || Array.isArray(node)) return node;
-		const sorted = Object.create(null);
-		for (const key of Object.keys(node).sort()) sorted[key] = node[key];
-		return sorted;
-	});
-}
-function liveHoldsFreshLeaves(live, leaves) {
-	for (const leaf of leaves) {
-		let node = live;
-		for (const segment of leaf.path) {
-			if (typeof segment === "number") {
-				if (!Array.isArray(node) || segment >= node.length) return false;
-				node = node[segment];
-				continue;
-			}
-			if (node === null || typeof node !== "object" || Array.isArray(node)) return false;
-			if (!Object.prototype.hasOwnProperty.call(node, segment)) return false;
-			node = node[segment];
-		}
-		if (typeof node !== "string" || node !== leaf.plaintext) return false;
-	}
-	return true;
-}
-function outputMapsEqual(a, b) {
-	return deepEqualValue(a, b);
-}
-function deepEqualValue(a, b) {
-	if (a === b) return true;
-	if (a == null || b == null) return a === b;
-	if (typeof a !== typeof b) return false;
-	if (typeof a !== "object") return false;
-	if (Array.isArray(a) || Array.isArray(b)) {
-		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-		return a.every((v, i) => deepEqualValue(v, b[i]));
-	}
-	const ao = a;
-	const bo = b;
-	const ak = Object.keys(ao);
-	if (ak.length !== Object.keys(bo).length) return false;
-	for (const k of ak) {
-		if (!Object.prototype.hasOwnProperty.call(bo, k)) return false;
-		if (!deepEqualValue(ao[k], bo[k])) return false;
-	}
-	return true;
-}
-
-//#endregion
-//#region src/deployment/deploy-engine/update.ts
-async function provisionUpdate(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
-	const resourceType = change.resourceType;
-	const existingState = stateResources[logicalId];
-	const renderer = getLiveRenderer();
-	const currentResource = existingState;
-	if (!currentResource) throw new Error(`Cannot update ${logicalId}: resource not found in state`);
-	const oldResourceType = currentResource.resourceType;
-	const typeChanged = oldResourceType !== resourceType;
-	const desiredProps = change.desiredProperties || {};
-	const currentProps = change.currentProperties || {};
-	const currentPropsAsWritten = currentResource.provisionedBy === "cc-api" ? currentProps : withoutSilentDropProperties(resourceType, currentProps);
-	const context = this.buildResolverContext({
-		template,
-		resources: stateResources,
-		...parameterValues && { parameters: parameterValues },
-		...conditions && { conditions },
-		redactedAttributeReads: []
-	}, stackName);
-	const updateSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
-	this.perResourceSecrets.set(logicalId, updateSecrets);
-	const resolvedProps = await this.resolver.resolve(desiredProps, context);
-	this.perResourceTemplateProps.set(logicalId, desiredProps);
-	this.perResourceResolvedType.set(logicalId, resourceType);
-	recordNestedStackParameterExpressions(updateSecrets, resourceType, resolvedProps, desiredProps);
-	this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
-	const lostCandidate = childLostWithRecreatedParent({
-		resourceType,
-		templateProperties: desiredProps,
-		recreatedUnderSameId: this.recreatedUnderSameId,
-		recordedTypeOf: (id) => Object.hasOwn(stateResources, id) ? stateResources[id]?.resourceType : void 0,
-		conditions
-	});
-	const lostChild = lostCandidate?.mode === "reattach" || lostCandidate !== void 0 && Object.hasOwn(resolvedProps, lostCandidate.property) && Object.hasOwn(currentProps, lostCandidate.property) && keyOrderFreeJson(resolvedProps[lostCandidate.property]) === keyOrderFreeJson(currentProps[lostCandidate.property]) ? lostCandidate : void 0;
-	const lostWithParent = lostChild?.mode === "recreate" ? lostChild.parent : void 0;
-	const suppliesFreshMaskOnlyValue = carriesFreshNoEchoValue(resolvedProps, updateSecrets);
-	const desiredForSkipCheck = redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps);
-	const allowedSilentDrops = this.providerRegistry.getAllowedUnsupportedProperties?.();
-	const desiredForSkipCheckAsWritten = currentResource.provisionedBy !== "cc-api" && allowedSilentDrops ? withoutAcceptedSilentDropProperties(resourceType, desiredForSkipCheck, allowedSilentDrops, currentResource.properties) : desiredForSkipCheck;
-	const applyAttributeOnlyUpdate = (attributeChanges) => {
-		const attrSummary = attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
-		this.logger.info(safeMsg`  ↻ ${logicalId} (${resourceType}) attribute update: ${attrSummary}`);
-		stateResources[logicalId] = {
-			...currentResource,
-			...this.extractTemplateAttributes(template, logicalId)
-		};
-		if (counts) counts.updated++;
-		if (progress) progress.current++;
-		const attrPrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
-		renderer.removeTask(logicalId);
-		this.logger.info(safeMsg`${attrPrefix}${formatResourceLine("updated", logicalId, resourceType, "updated (metadata)")}`);
-	};
-	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten)) {
-		if (change.attributeChanges && change.attributeChanges.length > 0) {
-			applyAttributeOnlyUpdate(change.attributeChanges);
-			return;
-		}
-		this.logger.debug(`Skipping ${logicalId}: no actual changes after intrinsic function resolution`);
-		if (counts) counts.skipped++;
-		return;
-	}
-	this.refuseRedactedAttributeReads(logicalId, resourceType, context);
-	this.attemptedResolvedProps.set(logicalId, resolvedProps);
-	const noEchoHeldPaths = /* @__PURE__ */ new Set();
-	if (change.propertyChanges?.some((pc) => pc.requiresReplacement) === true) {
-		let readback;
-		const lowered = [];
-		for (const pc of change.propertyChanges) {
-			if (!pc.requiresReplacement) {
-				lowered.push(pc);
-				continue;
-			}
-			const freshLeaves = freshNoEchoLeafPositions(resolvedProps[pc.path], updateSecrets);
-			if (!isReplacementCeiling(pc) && freshLeaves.length === 0) {
-				lowered.push(pc);
-				continue;
-			}
-			const moved = keyOrderFreeJson(desiredForSkipCheckAsWritten[pc.path]) !== keyOrderFreeJson(currentPropsAsWritten[pc.path]);
-			const conditionalVerdict = moved && !typeChanged && isReplacementCeiling(pc) ? this.diffCalculator.conditionalReplacementVerdict?.(resourceType, pc.path, currentPropsAsWritten[pc.path], desiredForSkipCheckAsWritten[pc.path]) : void 0;
-			if (moved && conditionalVerdict !== false) {
-				lowered.push(pc);
-				continue;
-			}
-			if (freshLeaves.length > 0) {
-				if (typeChanged) {
-					lowered.push(pc);
-					continue;
-				}
-				readback ??= this.readReaderForFreshNoEchoCeiling(logicalId, currentResource, updateSecrets);
-				const read = await readback;
-				let verdict;
-				if ("failure" in read) verdict = read.failure;
-				else if (!Object.prototype.hasOwnProperty.call(read.live, pc.path)) verdict = "not-readable";
-				else verdict = liveHoldsFreshLeaves(read.live[pc.path], freshLeaves) ? "held" : "differs";
-				if (verdict !== "held") {
-					this.logger.warn(safeMsg`${logicalId}.${pc.path} carries a NoEcho value that AWS could not confirm unchanged (${verdict}): replacement kept.`);
-					lowered.push(pc);
-					continue;
-				}
-				this.logger.debug(safeMsg`${logicalId}.${pc.path} carries a NoEcho value AWS already holds: not replaced.`);
-				noEchoHeldPaths.add(pc.path);
-			}
-			lowered.push({
-				...pc,
-				requiresReplacement: false
-			});
-		}
-		change.propertyChanges = lowered;
-	}
-	if (noEchoHeldPaths.size > 0 && !typeChanged && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten) && Object.entries(resolvedProps).every(([key, value]) => noEchoHeldPaths.has(key) || freshNoEchoLeafPositions(value, updateSecrets).length === 0)) {
-		this.logger.debug(safeMsg`Skipping ${logicalId}: AWS already holds every NoEcho value it carries, and nothing else changed`);
-		this.attemptedResolvedProps.delete(logicalId);
-		if (change.attributeChanges && change.attributeChanges.length > 0) {
-			applyAttributeOnlyUpdate(change.attributeChanges);
-			return;
-		}
-		if (counts) counts.skipped++;
-		return;
-	}
-	const propertyDrivenReplacement = typeChanged || change.propertyChanges?.some((pc) => pc.requiresReplacement);
-	const recreateTargets = this.options.recreateTargets?.stackName === stackName ? this.options.recreateTargets : void 0;
-	const recreateViaCcApi = recreateTargets?.viaCcApi.has(logicalId) ?? false;
-	const recreateViaSdkProvider = recreateTargets?.viaSdkProvider.has(logicalId) ?? false;
-	const recreateFlagged = recreateViaCcApi || recreateViaSdkProvider;
-	const needsReplacement = propertyDrivenReplacement || recreateFlagged || lostWithParent !== void 0;
-	const liveLabel = this.liveTaskLabels.get(logicalId);
-	if (needsReplacement && liveLabel !== void 0 && !liveLabel.replacing) {
-		const label = `Replacing ${logicalId} (${resourceType})${this.peekRoutingForLabel(change, currentResource, stackName, logicalId, true, this.recreateDirectionFor(stackName, logicalId)) === "cc-api" ? " [CC API]" : ""}`;
-		this.liveTaskLabels.set(logicalId, {
-			label,
-			replacing: true,
-			...liveLabel.warnSuffix !== void 0 && { warnSuffix: liveLabel.warnSuffix }
-		});
-		renderer.updateTaskLabel(logicalId, `${label}${liveLabel.warnSuffix ?? ""}`);
-	} else if (!needsReplacement && liveLabel !== void 0 && liveLabel.replacing) {
-		const label = `Updating ${logicalId} (${resourceType})${this.peekRoutingForLabel(change, currentResource, stackName, logicalId, false, this.recreateDirectionFor(stackName, logicalId)) === "cc-api" ? " [CC API]" : ""}`;
-		this.liveTaskLabels.set(logicalId, {
-			label,
-			replacing: false,
-			...liveLabel.warnSuffix !== void 0 && { warnSuffix: liveLabel.warnSuffix }
-		});
-		renderer.updateTaskLabel(logicalId, `${label}${liveLabel.warnSuffix ?? ""}`);
-	}
-	const dependencies = this.extractAllDependencies(template, logicalId);
-	const updateReplacePolicy = template?.Resources?.[logicalId]?.UpdateReplacePolicy;
-	const markRestored = (outcome) => {
-		if (lostChild === void 0) return outcome;
-		if (this.updatesThatSentNothing.has(logicalId)) {
-			this.logger.warn(survivesParent(resourceType) ? safeMsg`  ⚠ ${logicalId} lost its attachment to ${lostChild.parent}, which was re-created, but its update sent no change (it is recorded on Cloud Control, which patches record against template); it may no longer be attached to ${lostChild.parent}. Attach it there by hand.` : safeMsg`  ⚠ ${logicalId} went with ${lostChild.parent}, which was re-created, but its update sent no change (it is recorded on Cloud Control, which patches record against template); its policy may be missing from ${lostChild.parent}. Re-run with --recreate-via-sdk-provider ${logicalId} to write it again.`);
-			return outcome;
-		}
-		this.restoredLostChildren.add(logicalId);
-		return outcome;
-	};
-	if (needsReplacement) return markRestored(await this.updateByReplacement({
-		change,
-		counts,
-		currentProps,
-		currentResource,
-		dependencies,
-		logicalId,
-		oldResourceType,
-		progress,
-		propertyDrivenReplacement,
-		recreateFlagged,
-		recreateViaCcApi,
-		recreateViaSdkProvider,
-		renderer,
-		resolvedProps,
-		resourceType,
-		stackName,
-		stateResources,
-		template,
-		typeChanged,
-		updateReplacePolicy,
-		updateSecrets,
-		lostWithParent
-	}));
-	return markRestored(await this.updateInPlace({
-		conditions,
-		counts,
-		currentProps,
-		currentPropsAsWritten,
-		currentResource,
-		dependencies,
-		desiredForSkipCheckAsWritten,
-		logicalId,
-		noEchoHeldPaths,
-		parameterValues,
-		progress,
-		renderer,
-		resolvedProps,
-		resourceType,
-		stackName,
-		stateResources,
-		template,
-		updateReplacePolicy,
-		updateSecrets,
-		reattach: lostChild?.mode === "reattach"
-	}));
-}
-
 //#endregion
 //#region src/provisioning/data-delete-intent.ts
 const S3_AUTO_DELETE_OBJECTS_TAG = "aws-cdk:auto-delete-objects";
@@ -32235,6 +32541,286 @@ function recordedProtectionNote(evidence, flags) {
 	return `${evidence}. AWS refuses to delete the resource while that protection is on, and cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and cdkd state destroy act on one), so ${flags} alone does not remove the old resource: depending on the replacement order, the deploy either fails at that delete or completes leaving the old resource, and its data, in AWS and no longer tracked by cdkd. Read ${DELETION_PROTECTION_DOC_POINTER} before you disable anything, then turn the protection off out of band (the console, or the service's own API) and re-run with ${flags}.`;
 }
 
+//#endregion
+//#region src/deployment/deploy-value-equality.ts
+function isReplacementCeiling(pc) {
+	return pc.requiresReplacement && (pc.inPlacePropagated === true || pc.replacementPropagated === true);
+}
+function keyOrderFreeJson(value) {
+	return JSON.stringify(value, (_key, node) => {
+		if (node === null || typeof node !== "object" || Array.isArray(node)) return node;
+		const sorted = Object.create(null);
+		for (const key of Object.keys(node).sort()) sorted[key] = node[key];
+		return sorted;
+	});
+}
+function liveHoldsFreshLeaves(live, leaves) {
+	for (const leaf of leaves) {
+		let node = live;
+		for (const segment of leaf.path) {
+			if (typeof segment === "number") {
+				if (!Array.isArray(node) || segment >= node.length) return false;
+				node = node[segment];
+				continue;
+			}
+			if (node === null || typeof node !== "object" || Array.isArray(node)) return false;
+			if (!Object.prototype.hasOwnProperty.call(node, segment)) return false;
+			node = node[segment];
+		}
+		if (typeof node !== "string" || node !== leaf.plaintext) return false;
+	}
+	return true;
+}
+function outputMapsEqual(a, b) {
+	return deepEqualValue(a, b);
+}
+function deepEqualValue(a, b) {
+	if (a === b) return true;
+	if (a == null || b == null) return a === b;
+	if (typeof a !== typeof b) return false;
+	if (typeof a !== "object") return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((v, i) => deepEqualValue(v, b[i]));
+	}
+	const ao = a;
+	const bo = b;
+	const ak = Object.keys(ao);
+	if (ak.length !== Object.keys(bo).length) return false;
+	for (const k of ak) {
+		if (!Object.prototype.hasOwnProperty.call(bo, k)) return false;
+		if (!deepEqualValue(ao[k], bo[k])) return false;
+	}
+	return true;
+}
+
+//#endregion
+//#region src/deployment/deploy-engine/update.ts
+async function provisionUpdate(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
+	const resourceType = change.resourceType;
+	const existingState = stateResources[logicalId];
+	const renderer = getLiveRenderer();
+	const currentResource = existingState;
+	if (!currentResource) throw new Error(`Cannot update ${logicalId}: resource not found in state`);
+	const oldResourceType = currentResource.resourceType;
+	const typeChanged = oldResourceType !== resourceType;
+	const desiredProps = change.desiredProperties || {};
+	const currentProps = change.currentProperties || {};
+	const context = this.buildResolverContext({
+		template,
+		resources: stateResources,
+		...parameterValues && { parameters: parameterValues },
+		...conditions && { conditions },
+		redactedAttributeReads: []
+	}, stackName);
+	const updateSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
+	this.perResourceSecrets.set(logicalId, updateSecrets);
+	const resolvedProps = await this.resolver.resolve(desiredProps, context);
+	this.perResourceTemplateProps.set(logicalId, desiredProps);
+	this.perResourceResolvedType.set(logicalId, resourceType);
+	recordNestedStackParameterExpressions(updateSecrets, resourceType, resolvedProps, desiredProps);
+	this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
+	const lostCandidate = childLostWithRecreatedParent({
+		resourceType,
+		templateProperties: desiredProps,
+		recreatedUnderSameId: this.recreatedUnderSameId,
+		recordedTypeOf: (id) => Object.hasOwn(stateResources, id) ? stateResources[id]?.resourceType : void 0,
+		conditions
+	});
+	const lostChild = lostCandidate?.mode === "reattach" || lostCandidate !== void 0 && Object.hasOwn(resolvedProps, lostCandidate.property) && Object.hasOwn(currentProps, lostCandidate.property) && keyOrderFreeJson(resolvedProps[lostCandidate.property]) === keyOrderFreeJson(currentProps[lostCandidate.property]) ? lostCandidate : void 0;
+	const lostWithParent = lostChild?.mode === "recreate" ? lostChild.parent : void 0;
+	const suppliesFreshMaskOnlyValue = carriesFreshNoEchoValue(resolvedProps, updateSecrets);
+	const movedMasked = new Set(movedMaskedProperties(currentResource, desiredProps));
+	const desiredForSkipCheck = redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps);
+	const allowedSilentDrops = this.providerRegistry.getAllowedUnsupportedProperties?.();
+	const desiredForSkipCheckAsWritten = currentResource.provisionedBy !== "cc-api" && allowedSilentDrops ? withoutAcceptedSilentDropProperties(resourceType, desiredForSkipCheck, allowedSilentDrops, currentResource.properties) : desiredForSkipCheck;
+	const allowedForRecord = allowedSilentDrops ?? /* @__PURE__ */ new Set();
+	const createOnlyEvidence = acceptedCreateOnlyDropsOf(currentResource);
+	const currentPropsAsWritten = currentResource.provisionedBy === "cc-api" ? currentProps : withoutUnwrittenSilentDropProperties(resourceType, currentProps, desiredForSkipCheck, allowedForRecord, createOnlyEvidence);
+	const recordMatchesDesired = movedMasked.size === 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten);
+	const applyAttributeOnlyUpdate = (attributeChanges) => {
+		const attrSummary = attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
+		this.logger.info(safeMsg`  ↻ ${logicalId} (${resourceType}) attribute update: ${attrSummary}`);
+		stateResources[logicalId] = {
+			...currentResource,
+			...this.extractTemplateAttributes(template, logicalId)
+		};
+		if (counts) counts.updated++;
+		if (progress) progress.current++;
+		const attrPrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
+		renderer.removeTask(logicalId);
+		this.logger.info(safeMsg`${attrPrefix}${formatResourceLine("updated", logicalId, resourceType, "updated (metadata)")}`);
+	};
+	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && recordMatchesDesired) {
+		if (change.attributeChanges && change.attributeChanges.length > 0) {
+			applyAttributeOnlyUpdate(change.attributeChanges);
+			return;
+		}
+		this.logger.debug(`Skipping ${logicalId}: no actual changes after intrinsic function resolution`);
+		if (counts) counts.skipped++;
+		return;
+	}
+	this.refuseRedactedAttributeReads(logicalId, resourceType, context);
+	this.attemptedResolvedProps.set(logicalId, resolvedProps);
+	const noEchoHeldPaths = /* @__PURE__ */ new Set();
+	if (change.propertyChanges?.some((pc) => pc.requiresReplacement) === true) {
+		let readback;
+		const lowered = [];
+		for (const pc of change.propertyChanges) {
+			if (!pc.requiresReplacement) {
+				lowered.push(pc);
+				continue;
+			}
+			const freshLeaves = freshNoEchoLeafPositions(resolvedProps[pc.path], updateSecrets);
+			if (!isReplacementCeiling(pc) && freshLeaves.length === 0) {
+				lowered.push(pc);
+				continue;
+			}
+			const moved = movedMasked.has(pc.path) || keyOrderFreeJson(desiredForSkipCheckAsWritten[pc.path]) !== keyOrderFreeJson(currentPropsAsWritten[pc.path]);
+			const conditionalVerdict = moved && !typeChanged && isReplacementCeiling(pc) ? this.diffCalculator.conditionalReplacementVerdict?.(resourceType, pc.path, currentPropsAsWritten[pc.path], desiredForSkipCheckAsWritten[pc.path]) : void 0;
+			if (moved && conditionalVerdict !== false) {
+				lowered.push(pc);
+				continue;
+			}
+			if (freshLeaves.length > 0) {
+				if (typeChanged) {
+					lowered.push(pc);
+					continue;
+				}
+				readback ??= this.readReaderForFreshNoEchoCeiling(logicalId, currentResource, updateSecrets);
+				const read = await readback;
+				let verdict;
+				if ("failure" in read) verdict = read.failure;
+				else if (!Object.prototype.hasOwnProperty.call(read.live, pc.path)) verdict = "not-readable";
+				else verdict = liveHoldsFreshLeaves(read.live[pc.path], freshLeaves) ? "held" : "differs";
+				if (verdict !== "held") {
+					this.logger.warn(safeMsg`${logicalId}.${pc.path} carries a NoEcho value that AWS could not confirm unchanged (${verdict}): replacement kept.`);
+					lowered.push(pc);
+					continue;
+				}
+				this.logger.debug(safeMsg`${logicalId}.${pc.path} carries a NoEcho value AWS already holds: not replaced.`);
+				noEchoHeldPaths.add(pc.path);
+			}
+			lowered.push({
+				...pc,
+				requiresReplacement: false
+			});
+		}
+		change.propertyChanges = lowered;
+	}
+	if (noEchoHeldPaths.size > 0 && !typeChanged && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && recordMatchesDesired && Object.entries(resolvedProps).every(([key, value]) => noEchoHeldPaths.has(key) || freshNoEchoLeafPositions(value, updateSecrets).length === 0)) {
+		this.logger.debug(safeMsg`Skipping ${logicalId}: AWS already holds every NoEcho value it carries, and nothing else changed`);
+		this.attemptedResolvedProps.delete(logicalId);
+		if (change.attributeChanges && change.attributeChanges.length > 0) {
+			applyAttributeOnlyUpdate(change.attributeChanges);
+			return;
+		}
+		if (counts) counts.skipped++;
+		return;
+	}
+	const propertyDrivenReplacement = typeChanged || change.propertyChanges?.some((pc) => pc.requiresReplacement);
+	const recreateTargets = this.options.recreateTargets?.stackName === stackName ? this.options.recreateTargets : void 0;
+	const recreateViaCcApi = recreateTargets?.viaCcApi.has(logicalId) ?? false;
+	const recreateViaSdkProvider = recreateTargets?.viaSdkProvider.has(logicalId) ?? false;
+	const recreateFlagged = recreateViaCcApi || recreateViaSdkProvider;
+	const needsReplacement = propertyDrivenReplacement || recreateFlagged || lostWithParent !== void 0;
+	if (propertyDrivenReplacement && !typeChanged && !recreateFlagged && lostWithParent === void 0 && this.options.replace !== true && currentResource.provisionedBy !== "cc-api") {
+		const unwritten = unwrittenCreateOnlyReplacement(resourceType, currentProps, desiredForSkipCheck, allowedForRecord, createOnlyEvidence, (change.propertyChanges ?? []).filter((pc) => pc.requiresReplacement).map((pc) => pc.path));
+		if (unwritten.length > 0) throw markRefusedBeforeApplying(markNonRetryable(new CdkdError(unwrittenCreateOnlyRefusal({
+			logicalId,
+			resourceType,
+			unwritten,
+			routeDriving: findActionableSilentDrops(resourceType, desiredForSkipCheck, allowedForRecord, currentProps).map(({ property }) => property),
+			nested: this.options.parentStackInfo !== void 0,
+			protectionEvidence: recordedProtectionEvidence(resourceType, currentProps, currentResource.observedProperties, this.stackRegion)
+		}), "CREATE_ONLY_DROP_NEEDS_REPLACEMENT")));
+	}
+	const liveLabel = this.liveTaskLabels.get(logicalId);
+	if (needsReplacement && liveLabel !== void 0 && !liveLabel.replacing) {
+		const label = `Replacing ${logicalId} (${resourceType})${this.peekRoutingForLabel(change, currentResource, stackName, logicalId, true, this.recreateDirectionFor(stackName, logicalId)) === "cc-api" ? " [CC API]" : ""}`;
+		this.liveTaskLabels.set(logicalId, {
+			label,
+			replacing: true,
+			...liveLabel.warnSuffix !== void 0 && { warnSuffix: liveLabel.warnSuffix }
+		});
+		renderer.updateTaskLabel(logicalId, `${label}${liveLabel.warnSuffix ?? ""}`);
+	} else if (!needsReplacement && liveLabel !== void 0 && liveLabel.replacing) {
+		const label = `Updating ${logicalId} (${resourceType})${this.peekRoutingForLabel(change, currentResource, stackName, logicalId, false, this.recreateDirectionFor(stackName, logicalId)) === "cc-api" ? " [CC API]" : ""}`;
+		this.liveTaskLabels.set(logicalId, {
+			label,
+			replacing: false,
+			...liveLabel.warnSuffix !== void 0 && { warnSuffix: liveLabel.warnSuffix }
+		});
+		renderer.updateTaskLabel(logicalId, `${label}${liveLabel.warnSuffix ?? ""}`);
+	}
+	const dependencies = this.extractAllDependencies(template, logicalId);
+	const updateReplacePolicy = template?.Resources?.[logicalId]?.UpdateReplacePolicy;
+	const markRestored = (outcome) => {
+		if (lostChild === void 0) return outcome;
+		if (this.updatesThatSentNothing.has(logicalId)) {
+			this.logger.warn(survivesParent(resourceType) ? safeMsg`  ⚠ ${logicalId} lost its attachment to ${lostChild.parent}, which was re-created, but its update sent no change (it is recorded on Cloud Control, which patches record against template); it may no longer be attached to ${lostChild.parent}. Attach it there by hand.` : safeMsg`  ⚠ ${logicalId} went with ${lostChild.parent}, which was re-created, but its update sent no change (it is recorded on Cloud Control, which patches record against template); its policy may be missing from ${lostChild.parent}. Re-run with --recreate-via-sdk-provider ${logicalId} to write it again.`);
+			return outcome;
+		}
+		this.restoredLostChildren.add(logicalId);
+		return outcome;
+	};
+	if (needsReplacement) return markRestored(await this.updateByReplacement({
+		change,
+		counts,
+		currentProps,
+		currentResource,
+		dependencies,
+		logicalId,
+		oldResourceType,
+		progress,
+		propertyDrivenReplacement,
+		recreateFlagged,
+		recreateViaCcApi,
+		recreateViaSdkProvider,
+		renderer,
+		resolvedProps,
+		resourceType,
+		stackName,
+		stateResources,
+		template,
+		typeChanged,
+		updateReplacePolicy,
+		updateSecrets,
+		lostWithParent
+	}));
+	return markRestored(await this.updateInPlace({
+		conditions,
+		counts,
+		currentProps,
+		currentPropsAsWritten,
+		currentResource,
+		dependencies,
+		desiredForSkipCheckAsWritten,
+		logicalId,
+		noEchoHeldPaths,
+		parameterValues,
+		progress,
+		renderer,
+		resolvedProps,
+		resourceType,
+		stackName,
+		stateResources,
+		template,
+		updateReplacePolicy,
+		updateSecrets,
+		reattach: lostChild?.mode === "reattach"
+	}));
+}
+function unwrittenCreateOnlyRefusal(input) {
+	const { logicalId, resourceType, unwritten, routeDriving, nested, protectionEvidence } = input;
+	const one = unwritten.length === 1;
+	const list = unwritten.join(", ");
+	const keep = [.../* @__PURE__ */ new Set([...unwritten, ...routeDriving])].sort((a, b) => a.localeCompare(b)).map((property) => `${resourceType}:${property}`).join(",");
+	const replaceFlags = nested ? "--replace (which creates the new resource before deleting the old one, so a resource holding a unique value other than its name, such as a CIDR block, collides)" : `--recreate-via-cc-api ${logicalId}, which deletes the old resource first (--replace also works, but creates the new one first, so a resource holding a unique value other than its name, such as a CIDR block, collides)`;
+	const routed = [...routeDriving].sort((a, b) => a.localeCompare(b)).join(", ");
+	return `${logicalId} (${resourceType}): ${list} ${one ? "is" : "are"} create-only, and the state record holds ${one ? "it" : "them"} although this type's SDK provider never writes ${one ? "it" : "them"}, so AWS does not. This deploy routes the resource through Cloud Control (--prefer-sdk-route does not cover ${routed}), and applying a create-only property means replacing the resource, which cdkd does not do on its own. This resource was not changed. To replace it and apply ${list}, re-run with ${replaceFlags}; a stateful resource also needs --force-stateful-recreation.` + (protectionEvidence !== void 0 ? ` ${recordedProtectionNote(protectionEvidence, nested ? "--replace" : `--recreate-via-cc-api ${logicalId} or --replace`)}` : "") + ` To keep dropping ${one ? "it" : "them"}, re-run with --prefer-sdk-route ${keep}.`;
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/update-replace.ts
 async function updateByReplacement({ change, counts, currentProps, currentResource, dependencies, logicalId, oldResourceType, progress, propertyDrivenReplacement, recreateFlagged, recreateViaCcApi, recreateViaSdkProvider, renderer, resolvedProps, resourceType, stackName, stateResources, template, typeChanged, updateReplacePolicy, updateSecrets, lostWithParent }) {
@@ -32423,10 +33009,12 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 	}
 	this.registerNoEchoAttributes(logicalId, createResult, updateSecrets, resolvedProps);
 	if (equalIdIsSameResource && createResult.physicalId === currentResource.physicalId) this.recreatedUnderSameId.add(logicalId);
+	const recordedReplacementProperties = this.propertiesToRecord(resolvedProps, createResult, resourceType, replaceDecision.provisionedBy);
 	stateResources[logicalId] = {
 		physicalId: createResult.physicalId,
 		resourceType,
-		properties: this.propertiesToRecord(resolvedProps, createResult, resourceType, replaceDecision.provisionedBy),
+		properties: recordedReplacementProperties,
+		...acceptedCreateOnlyDropsField(recordedReplacementProperties, resourceType, replaceDecision.provisionedBy, "new-resource"),
 		...createResult.attributes && { attributes: createResult.attributes },
 		...dependencies && dependencies.length > 0 && { dependencies },
 		...this.extractTemplateAttributes(template, logicalId),
@@ -32633,17 +33221,20 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 		} else throw updateError;
 	}
 	if (result.wasReplaced) this.logger.info(`Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`);
-	const keepsParameterRefusal = !(result.wasReplaced === true && result.physicalId !== currentResource.physicalId) && hasUnverifiableParameterRefusal(currentResource);
+	const dischargedByReplacement = result.wasReplaced === true && result.physicalId !== currentResource.physicalId;
+	const keepsParameterRefusal = !dischargedByReplacement && hasUnverifiableParameterRefusal(currentResource);
 	const carriedAttributes = result.attributes ?? (result.wasReplaced ? void 0 : currentResource.attributes);
 	this.registerNoEchoAttributes(logicalId, {
 		...carriedAttributes && { attributes: carriedAttributes },
 		...result.noEchoAttributes === true && { noEchoAttributes: true },
 		...result.noEchoAttributeNames && { noEchoAttributeNames: result.noEchoAttributeNames }
 	}, updateSecrets, resolvedProps);
+	const recordedProperties = this.propertiesToRecord(resolvedProps, result, resourceType, resultProvisionedBy);
 	stateResources[logicalId] = {
 		physicalId: result.physicalId,
 		resourceType,
-		properties: this.propertiesToRecord(resolvedProps, result, resourceType, resultProvisionedBy),
+		properties: recordedProperties,
+		...acceptedCreateOnlyDropsField(recordedProperties, resourceType, resultProvisionedBy, dischargedByReplacement ? "new-resource" : "in-place", currentResource),
 		...carriedAttributes && { attributes: carriedAttributes },
 		...dependencies && dependencies.length > 0 && { dependencies },
 		...this.extractTemplateAttributes(template, logicalId),
@@ -32798,75 +33389,6 @@ async function withResourceDeadline(operation, opts) {
 	});
 }
 
-//#endregion
-//#region src/deployment/prior-attempt-scope.ts
-const priorAttemptStore = new AsyncLocalStorage();
-function withPriorAttempts(lookup, fn) {
-	return priorAttemptStore.run(lookup, fn);
-}
-function priorAttemptLookup(logicalId, attempts) {
-	let landed = false;
-	return {
-		logicalId,
-		attempts,
-		notePossiblyLanded: () => {
-			landed = true;
-		},
-		possiblyLanded: () => landed
-	};
-}
-function getPriorAttempts(logicalId) {
-	const bound = priorAttemptStore.getStore();
-	return bound?.logicalId === logicalId ? bound : void 0;
-}
-function priorAttemptsInJournal(journal, logicalId, resourceType) {
-	let bags = [];
-	for (const segment of journal?.segments ?? []) {
-		if (segment.operations.some((op) => op.logicalId === logicalId)) bags = [];
-		for (const op of segment.failedOperations ?? []) {
-			if (op.logicalId !== logicalId || op.resourceType !== resourceType) continue;
-			if (op.changeType === "DELETE" || !isBag(op.attemptedProperties)) continue;
-			if (recordedAsNewResource(op)) continue;
-			bags.push(op.attemptedProperties);
-		}
-		if (segment.supersededLogicalIds?.includes(logicalId)) bags = [];
-	}
-	return bags;
-}
-function recordedAsNewResource(op) {
-	if (typeof op.physicalId !== "string" || op.physicalId === "") return false;
-	if (op.changeType === "CREATE") return true;
-	const previous = op.previousState?.physicalId;
-	return typeof previous === "string" && previous !== op.physicalId;
-}
-function isBag(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-const REFUSED_BEFORE_APPLYING = Symbol.for("cdkd.refusedBeforeApplying");
-const MAX_CAUSE_DEPTH = 10;
-function markRefusedBeforeApplying(error) {
-	if (!Object.isExtensible(error)) return error;
-	Object.defineProperty(error, REFUSED_BEFORE_APPLYING, {
-		value: true,
-		enumerable: false,
-		configurable: true,
-		writable: false
-	});
-	return error;
-}
-function isRefusedBeforeApplying(error, logicalId) {
-	let current = error;
-	for (let depth = 0; depth < MAX_CAUSE_DEPTH && current != null; depth++) {
-		if (typeof current === "object" || typeof current === "function") {
-			const linkId = current.logicalId;
-			if (typeof linkId === "string" && linkId !== logicalId) return false;
-			if (current[REFUSED_BEFORE_APPLYING] === true) return true;
-		}
-		current = current.cause;
-	}
-	return false;
-}
-
 //#endregion
 //#region src/deployment/deploy-engine/provision.ts
 async function provisionResource(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
@@ -33245,14 +33767,17 @@ async function executeDeployment(template, currentState, changes, dag, execution
 				} catch (provisionError) {
 					this.interrupted = true;
 					this.interruptCause ??= "sibling-failure";
+					const refused = isRefusedBeforeApplying(provisionError, logicalId);
+					const physicalId = newResources[logicalId]?.physicalId ?? previousState?.physicalId;
+					if (refused && change.changeType === "CREATE" && physicalId === void 0) throw provisionError;
 					failedOperations.push({
 						logicalId,
 						changeType: change.changeType,
 						resourceType: change.resourceType,
 						provisionedBy: newResources[logicalId]?.provisionedBy ?? previousState?.provisionedBy,
 						...previousState && { previousState },
-						physicalId: newResources[logicalId]?.physicalId ?? previousState?.physicalId,
-						...!isRefusedBeforeApplying(provisionError, logicalId) && { attemptedProperties: this.attemptedResolvedProps.get(logicalId) }
+						physicalId,
+						...!refused && { attemptedProperties: this.attemptedResolvedProps.get(logicalId) }
 					});
 					throw provisionError;
 				}
@@ -33402,6 +33927,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			this.logger.warn(`Failed to save partial state before rollback: ${saveError instanceof Error ? saveError.message : String(saveError)}`);
 		}
 		let autoRollbackClean = false;
+		let autoRollbackJournaled = false;
 		let rollbackOrphans = [];
 		let rollbackSettledNested = /* @__PURE__ */ new Map();
 		if (error instanceof InterruptedError || isInterruptedWaitError(error) || this.interruptCause === "user") {
@@ -33414,9 +33940,16 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			this.logger.warn("Deployment failed. --no-rollback is set, skipping rollback.");
 			this.logger.warn(safeMsg`Partial state has been saved. ${this.recoveryHint("Run 'cdkd deploy' to resume, 'cdkd rollback' to revert, or destroy to clean up.")}`);
 		} else {
-			await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "auto-rollback-started", initialDeploy);
+			autoRollbackJournaled = await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "auto-rollback-started", initialDeploy);
 			const rollbackResult = await this.performRollback(completedOperations, newResources, stackName, currentState);
-			autoRollbackClean = rollbackResult.failures === 0;
+			autoRollbackClean = autoRollbackJournaled && rollbackResult.failures === 0 && rollbackResult.skipped === 0;
+			if (rollbackResult.failures === 0 && rollbackResult.skipped > 0) {
+				this.logger.warn(safeMsg`The automatic rollback could not revert ${rollbackResult.skipped} operation(s) ` + `(see the warnings above; each is recorded as a ROLLBACK_RESOURCE_SKIPPED event).` + (autoRollbackJournaled ? ` The rollback journal keeps them.` : ""));
+				if (autoRollbackJournaled && this.options.parentStackInfo === void 0 && failedOperations.some((op) => op.changeType !== "DELETE")) this.logger.warn(safeMsg`The record of the operation that failed is kept too. Revert it with: ${pasteableCommand("cdkd rollback", [{
+					value: stackName,
+					hole: "stack"
+				}, { literal: "--revert-failed" }]).command}`);
+			}
 			rollbackOrphans = rollbackResult.orphaned;
 			rollbackSettledNested = rollbackResult.settledNested;
 		}
@@ -33941,6 +34474,9 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		});
 		const parameterValues = await this.resolver.resolveParameters(template, this.options.parameters, { ...this.options.inheritedSecrets && hasMaskableValues(this.options.inheritedSecrets) && { inheritedSecrets: this.options.inheritedSecrets } });
 		this.logger.debug(`Resolved ${Object.keys(parameterValues).length} parameters: ${Object.keys(parameterValues).join(", ")}`);
+		const backfillNoEchoValues = noEchoParameterValueSeed(template.Parameters, parameterValues, this.options.inheritedSecrets, this.options.parameters);
+		this.fingerprintNoEchoValues = backfillNoEchoValues;
+		let maskedFingerprintsBackfilled = backfillMaskedPropertyFingerprints(currentState.resources, template, backfillNoEchoValues) > 0;
 		const context = this.buildResolverContext({
 			template,
 			resources: currentState.resources,
@@ -33962,7 +34498,10 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		const effectiveTemplate = this.templateParser.filterResourcesByCondition(template, conditions);
 		const orphanCountBeforeAdoption = (currentState.orphans ?? []).length;
 		const orphanPlan = await this.adoptRollbackOrphans(currentState, effectiveTemplate);
-		if (Object.keys(orphanPlan.adopted).length > 0) this.stampReasonlessParameterRefusals(currentState.resources, template);
+		if (Object.keys(orphanPlan.adopted).length > 0) {
+			this.stampReasonlessParameterRefusals(currentState.resources, template);
+			if (backfillMaskedPropertyFingerprints(currentState.resources, template, backfillNoEchoValues) > 0) maskedFingerprintsBackfilled = true;
+		}
 		const orphansChanged = Object.keys(orphanPlan.adopted).length > 0 || (currentState.orphans ?? []).length !== orphanCountBeforeAdoption;
 		const resourceTypes = new Set(Object.values(effectiveTemplate.Resources || {}).map((r) => r.Type).filter((type) => type !== "AWS::CDK::Metadata"));
 		this.providerRegistry.validateResourceTypes(resourceTypes);
@@ -34039,7 +34578,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 				const skippedOutputsChanged = !skippedOutputsEqual(currentState.skippedOutputs, this.skippedOutputs);
 				const healedAttributesPending = this.hasUnpersistedHeals(currentState.resources);
 				const conditionVerdictsChanged = !conditionVerdictRecordsEqual(readRecordedConditionVerdicts(currentState), conditionVerdicts);
-				if (observedRefresh || conditionVerdictsChanged || outputsChanged || exportSetChanged || skippedOutputsChanged || orphansChanged || healedAttributesPending) try {
+				if (observedRefresh || maskedFingerprintsBackfilled || conditionVerdictsChanged || outputsChanged || exportSetChanged || skippedOutputsChanged || orphansChanged || healedAttributesPending) try {
 					const refreshedState = {
 						version: 10,
 						region: this.stackRegion,
@@ -34218,37 +34757,6 @@ function preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) {
 	return applyDefaultNameForFallback(logicalId, resourceType, resolvedProps);
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/record-shape.ts
-function auditResolvedAssetReferences(logicalId, resourceType, resolvedProps) {
-	const redirect = this.options.assetRedirect;
-	if (!redirect) return;
-	const findings = findUnrewrittenAssetReferences(resolvedProps, redirect);
-	if (findings.length === 0) return;
-	const detail = findings.map((f) => `  - ${f.path}: still references '${f.source}'`).join("\n");
-	throw new ProvisioningError(`Unrewritten asset reference on '${logicalId}' (${resourceType}): this region uses cdkd-owned asset storage, but the following resolved properties still point at the CDK bootstrap storage that 'cdk gc' may garbage-collect:\n${detail}\nThis is a template shape cdkd's asset-reference rewrite did not cover — deploying it would split-brain the stack (assets in cdkd storage, properties reading the CDK bucket). Please report this at https://github.com/go-to-k/cdkd/issues with the property shape. Workaround: deploy with --use-cdk-bootstrap-assets to pin the legacy destinations for this app.`, resourceType, logicalId);
-}
-function extractAllDependencies(template, logicalId) {
-	const resource = template?.Resources?.[logicalId];
-	if (!resource) return void 0;
-	const parser = new TemplateParser();
-	const parameterNames = new Set(Object.keys(template?.Parameters ?? {}));
-	const deps = [...parser.extractDependencies(resource)].filter((dep) => !parameterNames.has(dep));
-	return deps.length > 0 ? deps : void 0;
-}
-function propertiesToRecord(desiredProperties, result, resourceType, provisionedBy) {
-	if (result.effectiveProperties) return provisionedBy === "sdk" ? withoutSilentDropProperties(resourceType, result.effectiveProperties) : result.effectiveProperties;
-	const written = provisionedBy === "sdk" ? withoutSilentDropProperties(resourceType, desiredProperties) : desiredProperties;
-	return markSameGenerationBag(written);
-}
-function extractTemplateAttributes(template, logicalId) {
-	const resource = template?.Resources?.[logicalId];
-	return {
-		deletionPolicy: resource?.DeletionPolicy,
-		updateReplacePolicy: resource?.UpdateReplacePolicy
-	};
-}
-
 //#endregion
 //#region src/analyzer/implicit-delete-deps.ts
 const IMPLICIT_DELETE_DEPENDENCIES = {
@@ -34427,6 +34935,7 @@ var DeployEngine = class {
 	noEchoAttributeResources = /* @__PURE__ */ new Map();
 	perResourceTemplateProps = /* @__PURE__ */ new Map();
 	perResourceResolvedType = /* @__PURE__ */ new Map();
+	fingerprintNoEchoValues = void 0;
 	outputSecrets = /* @__PURE__ */ new Map();
 	outputsPassSecretMaps = [];
 	outputsTemplateSource = Object.create(null);
@@ -34474,6 +34983,7 @@ var DeployEngine = class {
 		this.noEchoAttributeResources = /* @__PURE__ */ new Map();
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
 		this.perResourceResolvedType = /* @__PURE__ */ new Map();
+		this.fingerprintNoEchoValues = void 0;
 		this.attemptedResolvedProps = /* @__PURE__ */ new Map();
 		this.liveTaskLabels = /* @__PURE__ */ new Map();
 		this.outputSecrets = /* @__PURE__ */ new Map();
@@ -34500,13 +35010,15 @@ var DeployEngine = class {
 		for (const [logicalId, record] of Object.entries(state.resources)) {
 			const secrets = this.perResourceSecrets.get(logicalId);
 			const templateProps = this.perResourceTemplateProps.get(logicalId);
-			resources[logicalId] = scrubResourceRecord(this.withHealedAttributes(logicalId, record), secrets ?? /* @__PURE__ */ new Map(), templateProps);
+			const scrubbed = scrubResourceRecord(this.withHealedAttributes(logicalId, record), secrets ?? /* @__PURE__ */ new Map(), templateProps);
+			resources[logicalId] = withMaskedPropertyFingerprints(scrubbed, record.properties, templateProps, secrets, this.fingerprintNoEchoValues);
 		}
 		const orphans = state.orphans?.map((entry) => {
 			const sameResource = this.perResourceResolvedType.get(entry.logicalId) === entry.state.resourceType;
+			const orphanTemplateProps = sameResource ? this.perResourceTemplateProps.get(entry.logicalId) : void 0;
 			return {
 				...entry,
-				state: scrubResourceRecord(entry.state, (sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), sameResource ? this.perResourceTemplateProps.get(entry.logicalId) : void 0)
+				state: withMaskedPropertyFingerprints(scrubResourceRecord(entry.state, (sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), orphanTemplateProps), entry.state.properties, orphanTemplateProps, sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0, sameResource ? this.fingerprintNoEchoValues : void 0)
 			};
 		});
 		const outputs = this.redactOutputs(state.outputs);
@@ -34679,5 +35191,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { nestedChildStackName as $, shouldRetainResource as $a, markAuxiliaryFailure as $i, isUnboundTemplateParameter as $n, ssmResolvedValueType as $o, refuseMalformedOutputsForDestroy as $r, DBPROXY_TAGS_WHAT as $t, deleteTableWithIndexBusyRetry as A, carriesSecretMask as Aa, MULTI_REGION_RECREATE_BLOCKED_TYPES as Ai, DiffCalculator as An, partitionSensitiveEnv as Ao, malformedLocalResourcesWarning as Ar, extractDeploymentEventError as At, gray as B, isLockInfoExpired as Ba, coerceCfnInteger as Bi, isIamRoleArn as Bn, Synthesizer as Bo, malformedResourcePropertiesWarning as Br, collectDeclaredOutputNames as Bt, beginDeleteWait as C, scrubResourceRecord as Ca, findActionableSilentDrops as Ci, markWaitAbandoned as Cn, describeDockerFailure as Co, isReadableOrphanRecord as Cr, resolveAssemblyPath as Cs, isFinalSnapshotError as Ct, resolveDynamoDbDeleteBudgetMs as D, isUncertifiedBaselineMaskPosition as Da, hasNoCloudControlHandlers as Di, observeThenDisableInstanceApiTermination as Dn, getDockerCmd as Do, malformedExportSourceWarning as Dr, updatePartialReason as Dt, resolveDynamoDbDeleteBudgetClock as E, dynamicReferenceTokens as Ea, NO_CC_HANDLERS_REASON as Ei, isTerminationProtectionPropagationError as En, formatDockerLoginError as Eo, malformedExportNamesWarning as Er, updatePartialMessage as Et, isTruthyCfnBoolean as F, STATE_SOURCED_READBACK_RULES as Fa, coerceWarmThroughput as Fi, regionLessSecretName as Fn, warnFinchArgvExposure as Fo, malformedOrphansWarning as Fr, secretBearingStateKeyWarning as Ft, namesAnyDeclaredParameter as G, hasReadableExportSet as Ga, replayWarn as Gi, envCredentialsAreAssumedRole as Gn, resolveAutoAssetStorage as Go, refuseDivergentRecordRegionForDestroy as Gr, DEFAULT_RESOURCE_WARN_AFTER_MS as Gt, red as H, rebuildClientForBucketRegion as Ha, configIntegerRefusal as Hi, AWS_CREDENTIAL_ENV_KEYS as Hn, getDefaultStateBucketName as Ho, malformedScrubResourceEntriesRefusalMessage as Hr, isExportAliasCollision as Ht, formatResourceLine as I, TEMPLATE_SOURCED_RULES as Ia, isWarmThroughputDecrease as Ii, applyRoleArnIfSet as In, escapeRegExp$2 as Io, malformedOutputsRefusalMessage as Ir, secretSafeKeyDisplay as It, makeSiblingClaimReader as J, importableOutputKeys as Ja, requireConfigString as Ji, s3BucketDomainName as Jn, resolveStateBucketWithDefault as Jo, refuseMalformedOrphanRecordsForDestroy as Jr, earliestDefined as Jt, reachableDivergentParameters as K, hasReasonlessBaselineRefusal as Ka, requireConfigArray as Ki, isSettledInstanceState as Kn, resolveCaptureObservedState as Ko, refuseMalformedNestedChildOutputs as Kr, maskingRetryLogger as Kt, createReadOnlyAttributeHealerFactory as L, WHOLE_DYNAMIC_REFERENCE_PATTERN as La, toCfnInteger as Li, assertFlagRoleArn as Ln, stripControlChars as Lo, malformedOutputsWarning as Lr, exportNameSecretExposure as Lt, ECR_AUTO_DELETE_IMAGES_TAG as M, recordMaskOnlyValuesIn as Ma, isStatefulRecreateTargetSync as Mi, IntrinsicFunctionResolver as Mn, redactedDockerCause as Mo, malformedOrphanRecordsWarning as Mr, displayTextOrWithheld as Mt, S3_AUTO_DELETE_OBJECTS_TAG as N, STATE_SOURCED_BASELINE_RULES as Na, renderStatefulReason as Ni, classifyReplaySecretRegion as Nn, runDockerForeground as No, malformedOrphanRowsKeptWarning as Nr, exportAliasCollisionScrubWarning as Nt, DELETE_INDEX_WAIT_PROCEED_NOTE as O, pathCrossesDottedKey as Oa, findReplacedReadersOfRecreateTargets as Oi, reDisableInstanceApiTermination as On, isDockerClientEnvKey as Oo, malformedLocalOutputsWarning as Or, DeploymentEventsReader as Ot, hasCdkAutoDeleteTag as P, STATE_SOURCED_CROSS_GENERATION_RULES as Pa, WARM_THROUGHPUT_MEMBERS as Pi, producerRegionsFromState as Pn, runDockerStreaming as Po, malformedOrphansRefusalMessage as Pr, secretBearing as Pt, getNestedRevertRun as Q, orphansCarriedFrom as Qa, withRetry as Qi, coerceParameterTypedValue as Qn, warnDeprecatedNoPrefixCliFlag as Qo, refuseMalformedOutputs as Qr, acquireIdempotencyToken as Qt, bold as R, isSingleDynamicReferenceToken as Ra, toFiniteNumber as Ri, assertSendableRoleArn as Rn, AssetManifestLoader as Ro, malformedRenderedContainersWarning as Rr, isWholeDynamicReferenceValue as Rt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as S, redactSecretsForState as Sa, unreadableResourceEntries as Si, isWaitAbandonedError as Sn, describeDockerExecFailure as So, hasReadableResources as Sr, renderAssemblyPathEscape as Ss, effectiveDeletionPolicy as St, deleteBudgetKey as T, DYNAMIC_REFERENCE_TOKEN_SCAN as Ta, withoutSilentDropProperties as Ti, ec2InstanceProtectionSite as Tn, finchSecretArgvRefusal as To, malformedDriftResourcePropertiesWarning as Tr, resolveBucketRegion as Ts, unsupportedFinalSnapshotError as Tt, yellow as U, describeRegionValueKind as Ua, configStringRefusal as Ui, applyCallerIdentityCredentials as Un, getLegacyStateBucketName as Uo, malformedStateRefusalMessage as Ur, bindingSkippedOutputs as Ut, green as V, S3StateBackend as Va, configBooleanRefusal as Vi, sendableAssumeRoleCommand as Vn, synthesisStatusMessage as Vo, malformedResourcesWarning as Vr, collectPublishedOutputNames as Vt, computeParameterTaint as W, exportNamesCarriedFrom as Wa, readConfigString as Wi, callerEnvCredentials as Wn, resolveApp as Wo, previewableOrphanRecords as Wr, DEFAULT_RESOURCE_TIMEOUT_MS as Wt, NESTED_PENDING_PARENT_REASON as X, isReadableBag as Xa, templateResourceTypes as Xi, s3BucketRegionalDomainName as Xn, resolveUseCdkBootstrapAssets as Xo, refuseMalformedOrphansForDestroy as Xr, reserveStackCreateToken as Xt, planOrphanAdoption as Y, importableOutputs as Ya, prefetchCreateOnlyPropertyPaths as Yi, s3BucketDualStackDomainName as Yn, resolveStateBucketWithDefaultAndSource as Yo, refuseMalformedOrphans as Yr, ledgerForStack as Yt, dropSettledNestedJournals as Z, orphansAfterRollback as Za, describeTypeWithThrottleRetry as Zi, s3BucketWebsiteUrl as Zn, stateBucketExistenceConfirmed as Zo, refuseMalformedOrphansForOrphan as Zr, withCreateTokenLedger as Zt, PROTECTION_PROPERTY_BY_TYPE as _, createSecretMasker as _a, repairMalformedResourceEntriesForReadOnly as _i, unchangedBehindSecretReference as _n, validateContainerRepoName as _o, UNREADABLE_RESOURCES_MAP_ROW as _r, nullPrototypeRecord as _s, ATOMIC_FINAL_SNAPSHOT_TYPES as _t, conditionInputsFrom as a, liveMatchesUnresolvedTokenFrame as aa, refuseMalformedResourceEntriesForImportSave as ai, tagPlanWarning as an, createAssetRedirectResolver as ao, isNamelessDynamicReferenceError as ar, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as as, replayFailedOperations as at, readProtection as b, maskSecretsInText as ba, unpreviewableOrphanRecords as bi, deleteSkipReason as bn, resolveDockerContextDirectory as bo, hasReadableOrphans as br, describeFileReadFailure as bs, ccRoutedFinalSnapshotError as bt, isSecretBearingReferenceString as c, carryLogOnlyValues as ca, refuseMalformedResourcePropertiesForExport as ci, CC_BROKEN_REASON as cn, AssetModeResolver as co, cfnRefValueFromPhysicalId as cr, PARTITION_TABLE as cs, destroyStackRecordsView as ct, makeCanonicalizePropertiesFn as d, literalSplitDelimitersOf as da, refuseMalformedResourcesForDestroy as di, wouldReturnToSdkProvider as dn, ensureAssetStorage as do, parseWebACLArn as dr, AssemblyReader as ds, planFailedOps as dt, canonicalLambdaFunctionName as ea, refuseMalformedResourceAttributesForOrphan as ei, DBPROXY_TAG_OPTIONS as en, AssetPublisher as eo, parameterTypeMayLoseSecretIdentity as er, CFN_TEMPLATE_BODY_LIMIT as es, revertNestedChildFromJournal as et, getPriorAttempts as f, logOnlyValueCount as fa, refuseMalformedResourcesForExport as fi, isCustomResourceType as fn, getBootstrapMarkerKey as fo, withSharedDrainBudget as fr, StageLoadError as fs, planRollback as ft, recordedProtectionNote as g, shareLogOnlyValues as ga, repairMalformedOutputsForReadOnly as gi, ccProtectionRegistryTypes as gn, validateAssetBucketName as go, UNREADABLE_ORPHANS_CONTAINER_ROW as gr, hasPlainPrototype$1 as gs, inheritProducerRegions as gt, recordedProtectionEvidence as h, recordLogOnlyValue as ha, repairMalformedOrphansForReadOnly as hi, slowCcOperationTimeoutMs as hn, readBootstrapMarkerBody as ho, STATE_RESOURCES_MALFORMED as hr, hasOwnKey as hs, getCurrentProducerRegions as ht, conditionFingerprint as i, TemplateParser as ia, refuseMalformedResourceEntriesForImport as ii, tagMapAsList as in, buildAssetRedirectMap as io, carriesFetchableDynamicReference as ir, uploadCfnTemplate as is, withNestedStackContext as it, waitForIndexesSettled as j, recordMaskOnlyValue as ja, isStatefulRecreateTargetForReplace as ji, INTRINSIC_KEYS as jn, redactDockerArgvValues as jo, malformedOrphanRecordsRefusalMessage as jr, WITHHELD_NAME_DISPLAY as jt, INDEX_SETTLE_POLL_INTERVAL_MS as k, identityKeyFor as ka, shownType as ki, reEnableInstanceApiTermination as kn, isMalformedEnvKey as ko, malformedLocalResourceEntriesWarning as kr, DeploymentEventsStore as kt, keptWholeReasonText as l, createUnionSecretMasker as la, refuseMalformedResourcePropertiesForOrphan as li, ProviderRegistry as ln, BOOTSTRAP_MARKER_PREFIX as lo, isStalePlaceholderArnAttribute as lr, canonicalizeRegion as ls, getStackRecords as lt, withResourceDeadline as m, recordLogOnlyParameterValue as ma, repairMalformedOrphanRecordsForReadOnly as mi, CloudControlProvider as mn, parseBootstrapMarker as mo, STATE_REGION_DIVERGED as mr, defineOwnKey as ms, findNestedStackTypeChanges as mt, IMPLICIT_DELETE_DEPENDENCIES as n, sameLambdaFunctionAddress as na, refuseMalformedResourceEntriesForDeploy as ni, readTagList as nn, stringifyValue as no, isImpossibleEmptyStoredAttribute as nr, MIGRATE_TMP_PREFIX as ns, withNestedRevertRun as nt, parentSuppliedValues as o, inheritNestedStackParameterAssociations as oa, refuseMalformedResourceEntriesForOrphan as oi, definedAttributes as on, loadPublishableAssetManifest as oo, keepsSecretReferenceToken as or, decodeListingKey as os, replayRollback as ot, markRefusedBeforeApplying as p, printingCorpusOf as pa, refuseMalformedState as pi, getCurrentResourceSecrets as pn, isCrossRegionRedirect as po, JSON_LISTING_HOLE_VALUE as pr, processStackMessages as ps, resolveReplacementOldType as pt, resourcesNamingDeclaredParameter as q, hasUnverifiableParameterRefusal as qa, requireConfigObject as qi, s3BucketArn as qn, resolveSkipPrefix as qo, refuseMalformedOrphanRecords as qr, RollbackInlinePolicyWriters as qt, computeImplicitDeleteEdges as r, DagBuilder as ra, refuseMalformedResourceEntriesForDestroy as ri, refuseMalformedDesiredTags as rn, WorkGraph as ro, carriesDynamicReference as rr, findLargeInlineResources as rs, getCurrentNestedStackContext as rt, readRecordedConditionVerdicts as s, recordNestedStackParameterExpressions as sa, refuseMalformedResourcePropertiesForDrift as si, stringifyIfAssigned as sn, rewriteTemplateAssetReferences as so, AWS_NO_VALUE as sr, expectedOwnerParam as ss, awaitInFlightSibling as st, DeployEngine as t, lambdaFunctionNameForMask as ta, refuseMalformedResourceEntries as ti, planTagDiff as tn, isSensitiveAttributeName as to, getAccountInfo as tr, CFN_TEMPLATE_URL_LIMIT as ts, revertedNestedRowIds as tt, mergeNoChangeOutputs as u, hasMaskableValues as ua, refuseMalformedResourcesForDeploy as ui, ccBrokenReason as un, assertAssetBucketRegion as uo, refStateLookupFromResource as ur, derivePartitionAndUrlSuffix as us, withStackRecords as ut, isProtectionValueActive as v, errorCauseChain as va, repairMalformedResourcePropertiesForReadOnly as vi, UNSPECIFIED_SKIP_REASON as vn, buildDenyExternalAccessPolicy as vo, deployRefusesOrphanRowsReason as vr, ownValue as vs, PRE_DELETE_SNAPSHOT_TYPES as vt, compensateRemovedDeletionProtection as w, recoverMaskedOutput as wa, findSilentDropProperties as wi, disableInstanceApiTermination as wn, dockerSpawnEnvWithSensitive as wo, isReadableResourceEntry as wr, clearBucketRegionCache as ws, refusesFinalSnapshot as wt, DynamoDBGlobalTableProvider as x, markSameGenerationBag as xa, unreadableOrphanRecords as xi, withIndeterminateGuard as xn, describeDockerCapturedOutput as xo, hasReadableOutputs as xr, displayAssemblyPath as xs, createPreDeleteFinalSnapshot as xt, perType as y, maskSecretsInError as ya, repairMalformedResourcesForReadOnly as yi, deleteIndeterminateGuards as yn, buildDockerImage as yo, displayLogicalId as yr, absoluteAssemblyPathEscape as ys, buildFinalSnapshotIdentifier as yt, cyan as z, LockManager as za, coerceCfnBoolean as zi, explicitRoleArnOrThrow as zn, getDockerImageBySourceHash as zo, malformedResourceEntriesWarning as zr, noEchoParameterValueSeed as zt };
-//# sourceMappingURL=deploy-engine-C5kAhscq.js.map
+export { nestedChildStackName as $, hasReadableExportSet as $a, requireConfigObject as $i, s3BucketDomainName as $n, resolveAutoAssetStorage as $o, refuseMalformedOrphanRecordsForDestroy as $r, earliestDefined as $t, ECR_AUTO_DELETE_IMAGES_TAG as A, recoverMaskedOutput as Aa, unwrittenCreateOnlyReplacement as Ai, ec2InstanceProtectionSite as An, describeDockerExecFailure as Ao, malformedDriftResourcePropertiesWarning as Ar, renderAssemblyPathEscape as As, redactedDeleteAddressSkip as At, gray as B, STATE_SOURCED_BASELINE_RULES as Ba, WARM_THROUGHPUT_MEMBERS as Bi, regionLessSecretName as Bn, redactedDockerCause as Bo, malformedOrphansWarning as Br, secretBearingStateKeyWarning as Bt, deleteBudgetKey as C, createSecretMasker as Ca, repairMalformedResourcePropertiesForReadOnly as Ci, UNSPECIFIED_SKIP_REASON as Cn, readBootstrapMarkerBody as Co, deployRefusesOrphanRowsReason as Cr, hasOwnKey as Cs, effectiveDeletionPolicy as Ct, INDEX_SETTLE_POLL_INTERVAL_MS as D, markSameGenerationBag as Da, unreadableResourceEntries as Di, isWaitAbandonedError as Dn, buildDockerImage as Do, hasReadableResources as Dr, absoluteAssemblyPathEscape as Ds, REDACTED_DELETE_ADDRESS_SKIP_REASON as Dt, DELETE_INDEX_WAIT_PROCEED_NOTE as E, maskSecretsInText as Ea, unreadableOrphanRecords as Ei, withIndeterminateGuard as En, buildDenyExternalAccessPolicy as Eo, hasReadableOutputs as Er, ownValue as Es, unsupportedFinalSnapshotError as Et, markRefusedBeforeApplying as F, identityKeyFor as Fa, shownType as Fi, DiffCalculator as Fn, getDockerCmd as Fo, malformedLocalResourcesWarning as Fr, extractDeploymentEventError as Ft, namesAnyDeclaredParameter as G, isSingleDynamicReferenceToken as Ga, coerceCfnBoolean as Gi, isIamRoleArn as Gn, stripControlChars as Go, malformedResourcePropertiesWarning as Gr, collectDeclaredOutputNames as Gt, red as H, STATE_SOURCED_READBACK_RULES as Ha, isWarmThroughputDecrease as Hi, assertFlagRoleArn as Hn, runDockerStreaming as Ho, malformedOutputsWarning as Hr, exportNameSecretExposure as Ht, formatResourceLine as I, carriesSecretMask as Ia, MULTI_REGION_RECREATE_BLOCKED_TYPES as Ii, INTRINSIC_KEYS as In, isDockerClientEnvKey as Io, malformedOrphanRecordsRefusalMessage as Ir, WITHHELD_NAME_DISPLAY as It, makeSiblingClaimReader as J, S3StateBackend as Ja, configIntegerRefusal as Ji, applyCallerIdentityCredentials as Jn, Synthesizer as Jo, malformedStateRefusalMessage as Jr, bindingSkippedOutputs as Jt, reachableDivergentParameters as K, LockManager as Ka, coerceCfnInteger as Ki, sendableAssumeRoleCommand as Kn, AssetManifestLoader as Ko, malformedResourcesWarning as Kr, collectPublishedOutputNames as Kt, createReadOnlyAttributeHealerFactory as L, recordMaskOnlyValue as La, isStatefulRecreateTargetForReplace as Li, IntrinsicFunctionResolver as Ln, isMalformedEnvKey as Lo, malformedOrphanRecordsWarning as Lr, displayTextOrWithheld as Lt, hasCdkAutoDeleteTag as M, dynamicReferenceTokens as Ma, NO_CC_HANDLERS_REASON as Mi, observeThenDisableInstanceApiTermination as Mn, dockerSpawnEnvWithSensitive as Mo, malformedExportSourceWarning as Mr, clearBucketRegionCache as Ms, updatePartialReason as Mt, isTruthyCfnBoolean as N, isUncertifiedBaselineMaskPosition as Na, hasNoCloudControlHandlers as Ni, reDisableInstanceApiTermination as Nn, finchSecretArgvRefusal as No, malformedLocalOutputsWarning as Nr, resolveBucketRegion as Ns, DeploymentEventsReader as Nt, deleteTableWithIndexBusyRetry as O, redactSecretsForState as Oa, findActionableSilentDrops as Oi, markWaitAbandoned as On, resolveDockerContextDirectory as Oo, isReadableOrphanRecord as Or, describeFileReadFailure as Os, isRedactedRecordedValue as Ot, getPriorAttempts as P, pathCrossesDottedKey as Pa, findReplacedReadersOfRecreateTargets as Pi, reEnableInstanceApiTermination as Pn, formatDockerLoginError as Po, malformedLocalResourceEntriesWarning as Pr, DeploymentEventsStore as Pt, getNestedRevertRun as Q, exportNamesCarriedFrom as Qa, requireConfigArray as Qi, s3BucketArn as Qn, resolveApp as Qo, refuseMalformedOrphanRecords as Qr, RollbackInlinePolicyWriters as Qt, bold as R, recordMaskOnlyValuesIn as Ra, isStatefulRecreateTargetSync as Ri, classifyReplaySecretRegion as Rn, partitionSensitiveEnv as Ro, malformedOrphanRowsKeptWarning as Rr, exportAliasCollisionScrubWarning as Rt, compensateRemovedDeletionProtection as S, shareLogOnlyValues as Sa, repairMalformedResourceEntriesForReadOnly as Si, unchangedBehindSecretReference as Sn, parseBootstrapMarker as So, UNREADABLE_RESOURCES_MAP_ROW as Sr, defineOwnKey as Ss, createPreDeleteFinalSnapshot as St, resolveDynamoDbDeleteBudgetMs as T, maskSecretsInError as Ta, unpreviewableOrphanRecords as Ti, deleteSkipReason as Tn, validateContainerRepoName as To, hasReadableOrphans as Tr, nullPrototypeRecord as Ts, refusesFinalSnapshot as Tt, yellow as U, TEMPLATE_SOURCED_RULES as Ua, toCfnInteger as Ui, assertSendableRoleArn as Un, warnFinchArgvExposure as Uo, malformedRenderedContainersWarning as Ur, isWholeDynamicReferenceValue as Ut, green as V, STATE_SOURCED_CROSS_GENERATION_RULES as Va, coerceWarmThroughput as Vi, applyRoleArnIfSet as Vn, runDockerForeground as Vo, malformedOutputsRefusalMessage as Vr, secretSafeKeyDisplay as Vt, computeParameterTaint as W, WHOLE_DYNAMIC_REFERENCE_PATTERN as Wa, toFiniteNumber as Wi, explicitRoleArnOrThrow as Wn, escapeRegExp$2 as Wo, malformedResourceEntriesWarning as Wr, noEchoParameterValueSeed as Wt, NESTED_PENDING_PARENT_REASON as X, acceptedCreateOnlyDropsOf as Xa, readConfigString as Xi, envCredentialsAreAssumedRole as Xn, getDefaultStateBucketName as Xo, refuseDivergentRecordRegionForDestroy as Xr, DEFAULT_RESOURCE_WARN_AFTER_MS as Xt, planOrphanAdoption as Y, rebuildClientForBucketRegion as Ya, configStringRefusal as Yi, callerEnvCredentials as Yn, synthesisStatusMessage as Yo, previewableOrphanRecords as Yr, DEFAULT_RESOURCE_TIMEOUT_MS as Yt, dropSettledNestedJournals as Z, describeRegionValueKind as Za, replayWarn as Zi, isSettledInstanceState as Zn, getLegacyStateBucketName as Zo, refuseMalformedNestedChildOutputs as Zr, maskingRetryLogger as Zt, perType as _, literalSplitDelimitersOf as _a, refuseMalformedResourcesForExport as _i, isCustomResourceType as _n, BOOTSTRAP_MARKER_PREFIX as _o, withSharedDrainBudget as _r, canonicalizeRegion as _s, inheritProducerRegions as _t, conditionInputsFrom as a, markAuxiliaryFailure as aa, refuseMalformedResourceAttributesForOrphan as ai, DBPROXY_TAG_OPTIONS as an, orphansAfterRollback as ao, parameterTypeMayLoseSecretIdentity as ar, stateBucketExistenceConfirmed as as, replayFailedOperations as at, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as b, recordLogOnlyParameterValue as ba, repairMalformedOrphansForReadOnly as bi, slowCcOperationTimeoutMs as bn, getBootstrapMarkerKey as bo, STATE_RESOURCES_MALFORMED as br, StageLoadError as bs, buildFinalSnapshotIdentifier as bt, isSecretBearingReferenceString as c, sameLambdaFunctionAddress as ca, refuseMalformedResourceEntriesForDestroy as ci, refuseMalformedDesiredTags as cn, AssetPublisher as co, carriesDynamicReference as cr, CFN_TEMPLATE_BODY_LIMIT as cs, destroyStackRecordsView as ct, makeCanonicalizePropertiesFn as d, liveMatchesUnresolvedTokenFrame as da, refuseMalformedResourceEntriesForOrphan as di, definedAttributes as dn, WorkGraph as do, keepsSecretReferenceToken as dr, findLargeInlineResources as ds, recordAfterRollbackUpdate as dt, requireConfigString as ea, refuseMalformedOrphans as ei, ledgerForStack as en, hasReasonlessBaselineRefusal as eo, s3BucketDualStackDomainName as er, resolveCaptureObservedState as es, revertNestedChildFromJournal as et, withResourceDeadline as f, inheritNestedStackParameterAssociations as fa, refuseMalformedResourcePropertiesForDrift as fi, stringifyIfAssigned as fn, buildAssetRedirectMap as fo, AWS_NO_VALUE as fr, uploadCfnTemplate as fs, planFailedOps as ft, isProtectionValueActive as g, hasMaskableValues as ga, refuseMalformedResourcesForDestroy as gi, wouldReturnToSdkProvider as gn, AssetModeResolver as go, parseWebACLArn as gr, PARTITION_TABLE as gs, getCurrentProducerRegions as gt, PROTECTION_PROPERTY_BY_TYPE as h, createUnionSecretMasker as ha, refuseMalformedResourcesForDeploy as hi, ccBrokenReason as hn, rewriteTemplateAssetReferences as ho, refStateLookupFromResource as hr, expectedOwnerParam as hs, findNestedStackTypeChanges as ht, conditionFingerprint as i, withRetry as ia, refuseMalformedOutputsForDestroy as ii, DBPROXY_TAGS_WHAT as in, isReadableBag as io, isUnboundTemplateParameter as ir, resolveUseCdkBootstrapAssets as is, withNestedStackContext as it, S3_AUTO_DELETE_OBJECTS_TAG as j, DYNAMIC_REFERENCE_TOKEN_SCAN as ja, withoutSilentDropProperties as ji, isTerminationProtectionPropagationError as jn, describeDockerFailure as jo, malformedExportNamesWarning as jr, resolveAssemblyPath as js, updatePartialMessage as jt, waitForIndexesSettled as k, scrubResourceRecord as ka, findSilentDropProperties as ki, disableInstanceApiTermination as kn, describeDockerCapturedOutput as ko, isReadableResourceEntry as kr, displayAssemblyPath as ks, redactedDeleteAddressFields as kt, keptWholeReasonText as l, DagBuilder as la, refuseMalformedResourceEntriesForImport as li, tagMapAsList as ln, isSensitiveAttributeName as lo, carriesFetchableDynamicReference as lr, CFN_TEMPLATE_URL_LIMIT as ls, getStackRecords as lt, recordedProtectionNote as m, carryLogOnlyValues as ma, refuseMalformedResourcePropertiesForOrphan as mi, ProviderRegistry as mn, loadPublishableAssetManifest as mo, isStalePlaceholderArnAttribute as mr, decodeListingKey as ms, resolveReplacementOldType as mt, IMPLICIT_DELETE_DEPENDENCIES as n, templateResourceTypes as na, refuseMalformedOrphansForOrphan as ni, withCreateTokenLedger as nn, importableOutputKeys as no, s3BucketWebsiteUrl as nr, resolveStateBucketWithDefault as ns, withNestedRevertRun as nt, parentSuppliedValues as o, canonicalLambdaFunctionName as oa, refuseMalformedResourceEntries as oi, planTagDiff as on, orphansCarriedFrom as oo, getAccountInfo as or, warnDeprecatedNoPrefixCliFlag as os, replayRollback as ot, recordedProtectionEvidence as p, recordNestedStackParameterExpressions as pa, refuseMalformedResourcePropertiesForExport as pi, CC_BROKEN_REASON as pn, createAssetRedirectResolver as po, cfnRefValueFromPhysicalId as pr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ps, planRollback as pt, resourcesNamingDeclaredParameter as q, isLockInfoExpired as qa, configBooleanRefusal as qi, AWS_CREDENTIAL_ENV_KEYS as qn, getDockerImageBySourceHash as qo, malformedScrubResourceEntriesRefusalMessage as qr, isExportAliasCollision as qt, computeImplicitDeleteEdges as r, describeTypeWithThrottleRetry as ra, refuseMalformedOutputs as ri, acquireIdempotencyToken as rn, importableOutputs as ro, coerceParameterTypedValue as rr, resolveStateBucketWithDefaultAndSource as rs, getCurrentNestedStackContext as rt, readRecordedConditionVerdicts as s, lambdaFunctionNameForMask as sa, refuseMalformedResourceEntriesForDeploy as si, readTagList as sn, shouldRetainResource as so, isImpossibleEmptyStoredAttribute as sr, ssmResolvedValueType as ss, awaitInFlightSibling as st, DeployEngine as t, prefetchCreateOnlyPropertyPaths as ta, refuseMalformedOrphansForDestroy as ti, reserveStackCreateToken as tn, hasUnverifiableParameterRefusal as to, s3BucketRegionalDomainName as tr, resolveSkipPrefix as ts, revertedNestedRowIds as tt, mergeNoChangeOutputs as u, TemplateParser as ua, refuseMalformedResourceEntriesForImportSave as ui, tagPlanWarning as un, stringifyValue as uo, isNamelessDynamicReferenceError as ur, MIGRATE_TMP_PREFIX as us, withStackRecords as ut, readProtection as v, logOnlyValueCount as va, refuseMalformedState as vi, getCurrentResourceSecrets as vn, assertAssetBucketRegion as vo, JSON_LISTING_HOLE_VALUE as vr, derivePartitionAndUrlSuffix as vs, ATOMIC_FINAL_SNAPSHOT_TYPES as vt, resolveDynamoDbDeleteBudgetClock as w, errorCauseChain as wa, repairMalformedResourcesForReadOnly as wi, deleteIndeterminateGuards as wn, validateAssetBucketName as wo, displayLogicalId as wr, hasPlainPrototype$1 as ws, isFinalSnapshotError as wt, beginDeleteWait as x, recordLogOnlyValue as xa, repairMalformedOutputsForReadOnly as xi, ccProtectionRegistryTypes as xn, isCrossRegionRedirect as xo, UNREADABLE_ORPHANS_CONTAINER_ROW as xr, processStackMessages as xs, ccRoutedFinalSnapshotError as xt, DynamoDBGlobalTableProvider as y, printingCorpusOf as ya, repairMalformedOrphanRecordsForReadOnly as yi, CloudControlProvider as yn, ensureAssetStorage as yo, STATE_REGION_DIVERGED as yr, AssemblyReader as ys, PRE_DELETE_SNAPSHOT_TYPES as yt, cyan as z, recordNoEchoAttributeValues as za, renderStatefulReason as zi, producerRegionsFromState as zn, redactDockerArgvValues as zo, malformedOrphansRefusalMessage as zr, secretBearing as zt };
+//# sourceMappingURL=deploy-engine-RCOtmm4V.js.map