@go-to-k/cdkd 0.294.8 → 0.294.9

package/dist/{deploy-engine-C5kAhscq.js → deploy-engine-BTOCDCWf.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js"
 import { A as displaySafe, E as UNRENDERABLE, F as safeMsg, L as truncateCodePoints, M as isPasteableIdent, O as displayAwsMessage, P as plainIdentOr, S as withoutGeneratedFallbackName, T as STACK_REF_MAX_CODE_POINTS, _ as getCurrentSkipPrefix, b as withSkipPrefix, c as getLiveRenderer, f as applyDefaultNameForFallback, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, m as explicitNamePropertyFor, n as getLogger, r as isStdoutReservedForPayload, s as installLogLineMaskerSource, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS, x as withStackName, y as looksLikeCdkdGeneratedName } from "./logger-B46YMG0h.js";
 import { $t as StateError, A as isTerminalDeleteFailure, An as isAmbiguousCcHandlerErrorCode, At as clientDefaultsFor, Bn as isMarkedNonRetryable, Bt as IntrinsicResolutionRefusalError, C as refusalTypeShown, Cn as isNameCollisionErrorFrom, D as ProtectionFlipRegistry, Dt as withPasteableAwsProfile, En as isReplayedNameCollisionFrom, Fn as retryClassificationText, Gt as MalformedProducerRecordRefusalError, H as pasteableAwsCommand, Hn as markNonRetryable, In as describeAwsFailure, It as CrossAccountSecretRefusalError, J as isInterruptedWaitError, Jt as ProvisioningError, Lt as DependencyError, M as observeThenDisableProtection, Mn as isIamPropagationError, Mt as AccountIdUnavailableError, N as protectionFlipKey, Nn as isRetryableTransientError, Nt as AssetError, O as compensateProtectionFlip, On as markReplayMayCollide, Ot as ambientClientDefaults, Pn as isTransientServerError, Pt as CdkdError, Q as canonicalizeRoute53QueryName, R as DELETION_PROTECTION_DOC_POINTER, Rn as safeStringify$1, S as quotedRemedyLogicalId, Sn as hasReplayMayCollide, St as injectiveKey, T as resolveExplicitPhysicalId, Tn as isRecreateRetryableError, Tt as producerRecordKey, U as protectedReplacementAdvice, Un as markRedactedCause, Ut as LockError, Vn as isThrottlingError, Wn as wrapMaskedAwsError, Wt as MacroExpansionError, X as ElapsedBudgetRegistry, Xt as ResourceUpdateNotSupportedError, Y as startInterruptWatch, Yt as ResourceTimeoutError, Z as monotonicNowMs, _n as shellQuote, _t as formatLockOperation, at as segmentAfterAnchor, b as isQuotableImportValue, bt as CUSTOM_RESOURCE_RESPONSE_PREFIX, cn as UNSHOWABLE_VALUE, ct as isSecretDerivedValue, d as prepareRemovalForUpdate, dn as isInertUnquoted, dt as withDerivedNameMasks, en as SynthesisError, et as compositeIdSeparatorRefusal, f as removalWarning, fn as pasteableCommand, ft as UNREPRODUCIBLE_LOCK_CLAUSE, g as assertRegionMatch, gn as shellBoundedDisplay, gt as formatLockExpiry, h as RESOURCE_NOT_FOUND, hn as quotedOrDescribed, i as holdsSecretDerivedEntry, it as resourceTypeShown, jn as isAmbiguousOutcomeError, jt as credentialFingerprint, k as deleteWithProtectionCompensation, kn as formatRetryClassificationSignals, kt as ambientCredentialConfig, l as withUnchangedSecretPrincipalLists, ln as commandHole, lt as maskDeep, m as withoutInjectedRemovals, mn as plainOrDescribed, nt as logicalIdShown, on as SHELL_ACTIVE, ot as createMaskedLogSinks, pn as physicalIdShownBesideCommand, pt as buildForceUnlockCommand, rn as normalizeAwsError, sn as SHELL_ACTIVE_WHY, st as createMaskedRetryLogger, ut as maskerOrIdentity, vn as withheldTargetClause, vt as formatLockOwner, wn as isNameCooldownError, x as normalizeAwsTagsToCfn, xn as isUpdateUnsupportedError, xt as DEFAULT_STATE_PREFIX, yt as sanitizeRecoveryValue, zt as DynamicReferenceRegionAmbiguousError } from "./iam-policy-targets-CMSQGQnm.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-DGxZ-zFN.js";
+import { t as getCdkdVersion } from "./version-QrNvZCe0.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4645,6 +4645,12 @@ function importableOutputKeys(state) {
 	if (state.exportNames === void 0) return Object.keys(outputs);
 	return state.exportNames.filter((name) => typeof name === "string" && Object.hasOwn(outputs, name));
 }
+function acceptedCreateOnlyDropsOf(record) {
+	if (record === null || typeof record !== "object") return /* @__PURE__ */ new Set();
+	const value = record.acceptedCreateOnlyDrops;
+	if (!Array.isArray(value)) return /* @__PURE__ */ new Set();
+	return new Set(value.filter((entry) => typeof entry === "string"));
+}
 function hasReadableExportSet(state) {
 	if (!isReadableBag(state.outputs)) return false;
 	if (state.exportNames === void 0) return true;
@@ -6077,18 +6083,24 @@ function isPlainObject$3(value) {
 
 //#endregion
 //#region src/deployment/secret-redaction/mask-only.ts
-const recordedSecretExpressions$1 = /* @__PURE__ */ new Set();
-function recordSecretExpression(expression) {
-	recordedSecretExpressions$1.add(expression);
+const recordedSecretExpressions = /* @__PURE__ */ new Set();
+const secretVerdictScopes = /* @__PURE__ */ new Map();
+function pinScopedSecretVerdict(scope, expression, secret) {
+	const scopes = secretVerdictScopes.get(expression);
+	if (secret) {
+		if (scopes) scopes.add(scope);
+		else secretVerdictScopes.set(expression, /* @__PURE__ */ new Set([scope]));
+		recordedSecretExpressions.add(expression);
+		return;
+	}
+	if (scopes?.delete(scope) && scopes.size === 0) secretVerdictScopes.delete(expression);
+	recordedSecretExpressions.delete(expression);
 }
-function forgetSecretExpression(expression) {
-	recordedSecretExpressions$1.delete(expression);
+function isScopedSecretVerdict(scope, expression) {
+	return secretVerdictScopes.get(expression)?.has(scope) === true;
 }
 function isRecordedSecretExpression(expression) {
-	return recordedSecretExpressions$1.has(expression);
-}
-function clearRecordedSecretExpressions() {
-	recordedSecretExpressions$1.clear();
+	return recordedSecretExpressions.has(expression);
 }
 function recordMaskOnlyValue(secrets, plaintext) {
 	if (plaintext.length < 4) return;
@@ -6542,12 +6554,11 @@ function positionByRecordedParameterSpans(bag, source, secrets, associations) {
 	let persisted = "";
 	const gaps = [];
 	const certified = [];
-	for (const { start, length, parameter } of recorded) {
+	for (const { start, length, key } of recorded) {
 		if (!(start >= previousEnd && length > 0 && start + length <= bag.length)) return void 0;
 		previousEnd = start + length;
 		const text = bag.slice(start, start + length);
-		const key = crossStackSourceKey({ Ref: parameter });
-		const association = key === void 0 ? void 0 : associations.get(key);
+		const association = associations.get(key);
 		if (association === void 0 || typeof association === "symbol") continue;
 		const expression = certifiedExpressionForLeaf(secrets, association, text);
 		if (expression === void 0) continue;
@@ -7201,7 +7212,7 @@ function positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions) {
 	if (!pattern) return void 0;
 	const plaintextOf = plaintextIndexOf(secrets);
 	let matched;
-	for (const candidate of /* @__PURE__ */ new Set([...secretExpressions, ...recordedSecretExpressions$1])) {
+	for (const candidate of /* @__PURE__ */ new Set([...secretExpressions, ...recordedSecretExpressions])) {
 		if (candidate.length > MAX_SKELETON_CANDIDATE_LENGTH) return void 0;
 		if (!pattern.test(candidate)) continue;
 		const recordedPlaintext = plaintextOf.get(candidate);
@@ -7259,7 +7270,7 @@ function positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIs
 	let matched;
 	for (const candidate of /* @__PURE__ */ new Set([
 		...secretExpressions,
-		...recordedSecretExpressions$1,
+		...recordedSecretExpressions,
 		...resolvedExpressionsOf(secrets)
 	])) {
 		if (candidate.length > MAX_SKELETON_CANDIDATE_LENGTH) return void 0;
@@ -7327,10 +7338,10 @@ function recordIntrinsicLeafResolution(secrets, source, resolution) {
 			secret
 		})),
 		complete: resolution.complete,
-		...resolution.parameterSpans === void 0 ? {} : { parameterSpans: resolution.parameterSpans.map(({ start, length, parameter }) => ({
+		...resolution.parameterSpans === void 0 ? {} : { parameterSpans: resolution.parameterSpans.map(({ start, length, key }) => ({
 			start,
 			length,
-			parameter
+			key
 		})) }
 	};
 	const previous = leaves.get(source);
@@ -7359,7 +7370,7 @@ function sameLeafResolution(a, b) {
 }
 function sameParameterSpans(a, b) {
 	if (a === void 0 || b === void 0) return a === b;
-	return a.length === b.length && a.every((s, i) => s.start === b[i].start && s.length === b[i].length && s.parameter === b[i].parameter);
+	return a.length === b.length && a.every((s, i) => s.start === b[i].start && s.length === b[i].length && s.key === b[i].key);
 }
 function substitutedSpellingOf(secrets, source, resolvedValue) {
 	const resolution = intrinsicLeafResolutionsOf.get(secrets)?.get(source);
@@ -10063,8 +10074,8 @@ const REVERSE_REPLACEMENT_NAME_KEYS = {
 	"AWS::Glue::Job": flat("Name"),
 	"AWS::Glue::SecurityConfiguration": flat("Name"),
 	"AWS::Glue::Table": {
-		name: [["TableInput", "Name"]],
-		scope: [["DatabaseName"]]
+		name: [["TableInput", "Name"], ["Name"]],
+		scope: [["DatabaseName"], ["CatalogId"]]
 	},
 	"AWS::Glue::Trigger": flat("Name"),
 	"AWS::Glue::Workflow": flat("Name"),
@@ -10137,6 +10148,8 @@ const CASE_INSENSITIVE_NAME_TYPES = /* @__PURE__ */ new Set([
 	"AWS::RDS::DBInstance",
 	"AWS::RDS::DBSubnetGroup"
 ]);
+const ASCII_CASE_INSENSITIVE_NAME_TYPES = /* @__PURE__ */ new Set(["AWS::Glue::Table"]);
+const NO_PHYSICAL_ID_NAME_PROOF = /* @__PURE__ */ new Set(["AWS::Glue::Table"]);
 const GENERATED_NAME_VERBATIM = /* @__PURE__ */ new Set([
 	"AWS::CloudWatch::Alarm",
 	"AWS::DocDB::DBCluster",
@@ -10566,16 +10579,18 @@ function holderVerdict(input, v) {
 	}
 	if (namePath === void 0 || wantName === void 0) return unproven(`${v.create} named no ${labels} (its provider picks one), so cdkd cannot show that ${newResource} holds it`);
 	const wanted = generatedName ? `${v.create} named no ${labels}, and the cdkd naming rule generates ${r.shown(namePath.join("."))} ${r.quoted(wantName)} for it` : `${v.create} asked for ${r.shown(namePath.join("."))} ${r.quoted(wantName)}`;
-	const same = CASE_INSENSITIVE_NAME_TYPES.has(oldResourceType) ? (a, b) => a.toLowerCase() === b.toLowerCase() : (a, b) => a === b;
-	const inCase = CASE_INSENSITIVE_NAME_TYPES.has(oldResourceType) ? (value) => value.toLowerCase() : (value) => value;
-	const drifted = newKey.name.find((path) => {
-		const recordedName = valueAt(recorded, path);
-		const observedName = valueAt(observed, path);
-		return recordedName !== void 0 && observedName !== void 0 && !same(recordedName, observedName);
+	const asciiFold = ASCII_CASE_INSENSITIVE_NAME_TYPES.has(oldResourceType);
+	const inCase = CASE_INSENSITIVE_NAME_TYPES.has(oldResourceType) ? (value) => value.toLowerCase() : asciiFold ? (value) => value.replace(/[A-Z]/g, (c) => c.toLowerCase()) : (value) => value;
+	const same = (a, b) => inCase(a) === inCase(b);
+	const namePathHeld = newKey.name.find((path) => {
+		const h = heldAt(recorded, observed, path);
+		return h.value !== void 0 || h.unreadable;
 	});
-	if (drifted !== void 0) return unproven(`${wanted}, and the records of ${newResource} disagree on its ${r.shown(drifted.join("."))} (recorded ${r.quoted(valueAt(recorded, drifted) ?? "")}, read back ${r.quoted(valueAt(observed, drifted) ?? "")}), so cdkd cannot show which name it holds`);
-	const haveName = newKey.name.map((path) => heldAt(recorded, observed, path)).find((h) => h.value !== void 0)?.value;
-	if (!(haveName !== void 0 && same(haveName, wantName) || physicalId !== "" && holderIdNames(inCase(physicalId), inCase(wantName)))) return haveName !== void 0 && !generatedName ? elsewhere(`${wanted}, while ${newResource} holds ${r.quoted(haveName)}`) : unproven(`${wanted}, and cdkd cannot show that ${newResource} holds that name`);
+	const recordedName = namePathHeld && valueAt(recorded, namePathHeld);
+	const observedName = namePathHeld && valueAt(observed, namePathHeld);
+	if (namePathHeld !== void 0 && recordedName !== void 0 && observedName !== void 0 && !same(recordedName, observedName)) return unproven(`${wanted}, and the records of ${newResource} disagree on its ${r.shown(namePathHeld.join("."))} (recorded ${r.quoted(recordedName)}, read back ${r.quoted(observedName)}), so cdkd cannot show which name it holds`);
+	const haveName = namePathHeld === void 0 ? void 0 : heldAt(recorded, observed, namePathHeld).value;
+	if (!(haveName !== void 0 && same(haveName, wantName) || physicalId !== "" && !NO_PHYSICAL_ID_NAME_PROOF.has(newResourceType) && holderIdNames(inCase(physicalId), inCase(wantName)))) return haveName !== void 0 && !generatedName ? elsewhere(`${wanted}, while ${newResource} holds ${r.quoted(haveName)}`) : unproven(`${wanted}, and cdkd cannot show that ${newResource} holds that name`);
 	for (const [i, path] of (oldKey.scope ?? []).entries()) {
 		const label = r.shown(path.join("."));
 		const wantRaw = valueAt(requested, path);
@@ -14841,6 +14856,29 @@ function excludeCreateOnly(resourceType, names) {
 	if (createOnly === void 0 || createOnly.size === 0) return names;
 	return names.filter((property) => !createOnly.has(property));
 }
+function withoutUnwrittenSilentDropProperties(resourceType, recordedProperties, desiredProperties, allowedKeys, evidence) {
+	const drops = findSilentDropProperties(resourceType, recordedProperties);
+	if (drops.length === 0) return recordedProperties;
+	const createOnly = getPropertyCoverage(resourceType)?.createOnlyDrops;
+	const accepted = new Set(findAcceptedSilentDrops(resourceType, desiredProperties, allowedKeys, recordedProperties));
+	const removable = drops.map(({ property }) => property).filter((property) => createOnly?.has(property) !== true || evidence.has(property) && !accepted.has(property));
+	if (removable.length === 0) return recordedProperties;
+	const narrowed = { ...recordedProperties };
+	for (const property of removable) delete narrowed[property];
+	return narrowed;
+}
+function findUnwrittenCreateOnlyDrops(resourceType, recordedProperties, desiredProperties, allowedKeys, evidence) {
+	const createOnly = getPropertyCoverage(resourceType)?.createOnlyDrops;
+	if (createOnly === void 0 || createOnly.size === 0 || evidence.size === 0) return [];
+	const accepted = new Set(findAcceptedSilentDrops(resourceType, desiredProperties, allowedKeys, recordedProperties));
+	return findSilentDropProperties(resourceType, recordedProperties).map(({ property }) => property).filter((property) => createOnly.has(property) && evidence.has(property) && !accepted.has(property) && Object.hasOwn(desiredProperties, property) && sameJsonValue(recordedProperties[property], desiredProperties[property], "unchanged"));
+}
+function unwrittenCreateOnlyReplacement(resourceType, recordedProperties, desiredProperties, allowedKeys, evidence, replacingPaths) {
+	if (replacingPaths.length === 0) return [];
+	const unwritten = findUnwrittenCreateOnlyDrops(resourceType, recordedProperties, desiredProperties, allowedKeys, evidence);
+	if (unwritten.length === 0) return [];
+	return replacingPaths.every((path) => unwritten.includes(path)) ? unwritten : [];
+}
 function unsupportedPropertyIssueUrl(resourceType, property) {
 	return `https://github.com/go-to-k/cdkd/issues/new?title=${encodeURIComponent(`Support property ${resourceType}.${property}`)}&labels=resource-support`;
 }
@@ -15975,12 +16013,6 @@ function isDeliberateResolutionRefusal(err) {
 }
 const cachedAccountIdentities = /* @__PURE__ */ new Map();
 const cachedAvailabilityZones = /* @__PURE__ */ new Map();
-const recordedSecretExpressions = {
-	has: (expression) => isRecordedSecretExpression(expression),
-	add: (expression) => recordSecretExpression(expression),
-	delete: (expression) => forgetSecretExpression(expression),
-	clear: () => clearRecordedSecretExpressions()
-};
 const cachedEc2InstanceAttributes = Object.create(null);
 const cachedVpcDefaultSecurityGroups = Object.create(null);
 const cachedCloudFrontDomainNames = Object.create(null);
@@ -17109,10 +17141,9 @@ async function reresolveCrossStackValue(value, producerRegion, context, origin,
 	if (sourceKey !== void 0 && typeof value === "string" && isSingleDynamicReferenceToken(value) && typeof reresolved === "string" && context.recordedSecretValues?.has(reresolved) === true && isSecretExpressionByVerdictOrSpelling(value)) recordCrossStackExpression(context.recordedSecretValues, sourceKey, value, reresolved);
 	return reresolved;
 }
-function pinSecretVerdict(expression, secret) {
+function pinSecretVerdict(expression, secret, scope) {
 	if (this.producerRegionGuest) return;
-	if (secret) recordedSecretExpressions.add(expression);
-	else recordedSecretExpressions.delete(expression);
+	pinScopedSecretVerdict(scope, expression, secret);
 }
 async function resolveImportValue(importValueArg, context) {
 	const sourceKey = crossStackSourceKey({ "Fn::ImportValue": importValueArg });
@@ -17725,6 +17756,9 @@ function classifyReplaySecretRegion(expression, consumerRegion, importedProducer
 
 //#endregion
 //#region src/deployment/intrinsic-resolver/dynamic-refs.ts
+function secretVerdictScope(resolver) {
+	return injectiveKey(credentialFingerprint(ambientCredentialConfig()), canonicalizeRegion(resolver.explicitRegion) ?? "");
+}
 async function resolveDynamicReferences(value, context) {
 	return (await this.resolveDynamicReferencesWithLogTwin(value, value, context, void 0, true)).result;
 }
@@ -17751,7 +17785,8 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 		const tokenLogText = inherited?.tokenLogText ?? (pairedTwin === void 0 ? "***" : this.straddleSafeTwin(fullMatch, pairedTwin, context));
 		const nameLogText = inherited?.nameLogText ?? (pairedTwin === void 0 ? () => "***" : this.dynamicReferenceNameLogText(inner, pairedTwin, context));
 		try {
-			const isKnownSecret = service === "secretsmanager" || service === "ssm-secure" || recordedSecretExpressions.has(fullMatch);
+			const verdictScope = secretVerdictScope(this);
+			const isKnownSecret = service === "secretsmanager" || service === "ssm-secure" || isScopedSecretVerdict(verdictScope, fullMatch);
 			if (isKnownSecret && context?.skipDynamicReferences) {
 				complete = false;
 				continue;
@@ -17804,8 +17839,8 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 				const param = await this.resolveSSMReference(parts, decrypt, "ssm", context, nameLogText);
 				if (param.type === "SecureString") {
 					if (decrypt) pinSecureVerdict = true;
-					else if (persistedText || !this.tokenAssembledForRecording(fullMatch, tokenLogText, context)) this.pinSecretVerdict(fullMatch, true);
-				} else if (!param.secure) this.pinSecretVerdict(fullMatch, false);
+					else if (persistedText || !this.tokenAssembledForRecording(fullMatch, tokenLogText, context)) this.pinSecretVerdict(fullMatch, true, verdictScope);
+				} else if (!param.secure) this.pinSecretVerdict(fullMatch, false, verdictScope);
 				else cacheable = false;
 				isSecret = param.secure;
 				if (param.secure) {
@@ -17827,7 +17862,7 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 				continue;
 			}
 			if (isSecret && resolved && !persistedText) this.refuseSecretAssembledReference(fullMatch, tokenLogText, context);
-			if (pinSecureVerdict) this.pinSecretVerdict(fullMatch, true);
+			if (pinSecureVerdict) this.pinSecretVerdict(fullMatch, true, verdictScope);
 			if (cacheable) this.cachedDynamicReferences.set(dynamicReferenceCacheKey, {
 				value: resolved,
 				secret: isSecret
@@ -17838,7 +17873,7 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 					recorded.set(resolved, fullMatch);
 					recordResolvedPair(recorded, fullMatch, resolved);
 				}
-				if (service === "secretsmanager" || service === "ssm-secure") this.pinSecretVerdict(fullMatch, true);
+				if (service === "secretsmanager" || service === "ssm-secure") this.pinSecretVerdict(fullMatch, true, verdictScope);
 			}
 			result = result.replace(fullMatch, () => resolved);
 			twin = twin.replace(fullMatch, () => isSecret && resolved ? "***" : resolved);
@@ -17977,11 +18012,20 @@ function partParameterSpans(context, part, resolved) {
 	if (own === void 0 || own.output !== resolved) return [];
 	return own.parameterSpans ?? [];
 }
+function wholeReferenceSpans(source, value) {
+	if (typeof value !== "string" || value === "") return [];
+	const key = crossStackSourceKey(source);
+	return key === void 0 ? [] : [{
+		start: 0,
+		length: value.length,
+		key
+	}];
+}
 function appendShiftedSpans(out, spans, by) {
 	for (const span of spans) out.push({
 		start: span.start + by,
 		length: span.length,
-		parameter: span.parameter
+		key: span.key
 	});
 }
 async function resolveJoin(joinArgs, context, source) {
@@ -18276,11 +18320,7 @@ async function resolveSub(subArgs, context, source) {
 				listRefusal ??= refusal;
 				replacement = refusal ? match[0] : String(value);
 				if (!refusal) twinReplacement = this.productLogTwin(value, context);
-				if (!refusal && fromParameter && typeof value === "string" && value !== "") parameterSpans = [{
-					start: 0,
-					length: value.length,
-					parameter: varNameStr
-				}];
+				if (!refusal && fromParameter) parameterSpans = wholeReferenceSpans({ Ref: varNameStr }, value);
 			} catch (refError) {
 				if (refError instanceof IntrinsicResolutionRefusalError) throw refError;
 				if (varNameStr.includes(".")) try {
@@ -18288,7 +18328,10 @@ async function resolveSub(subArgs, context, source) {
 					const refusal = this.subListRefusal(`the variable \${${varNameStr}}`, value, context);
 					listRefusal ??= refusal;
 					replacement = refusal ? match[0] : String(value);
-					if (!refusal) twinReplacement = this.productLogTwin(value, context);
+					if (!refusal) {
+						twinReplacement = this.productLogTwin(value, context);
+						parameterSpans = wholeReferenceSpans({ "Fn::GetAtt": varNameStr }, value);
+					}
 				} catch (getAttError) {
 					if (getAttError instanceof IntrinsicResolutionRefusalError) throw getAttError;
 					this.rethrowStructuralSubFailure(varNameStr, getAttError, context);
@@ -19118,6 +19161,16 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const parts = pending === 1 ? "1 concurrent part was" : `${pending} concurrent parts were`;
 		this.logger.warn(`A resolution failed while ${parts} still running, and cdkd stopped waiting because the wait after a failure (capped at ${capSeconds}s) was used up. A secret such a part resolves from now on is still recorded, but only what runs after it arrives can mask it: output already printed or saved is not revisited.`);
 	}
+	recordCrossStackReadSpan(context, source, value) {
+		if (typeof value === "string") this.recordLeafResolution(context, source, {
+			input: value,
+			output: value,
+			substitutions: [],
+			complete: true,
+			parameterSpans: wholeReferenceSpans(source, value)
+		});
+		return value;
+	}
 	async resolveValue(value, context) {
 		if (typeof value !== "object" || value === null) {
 			if (typeof value === "string" && value.includes("{{resolve:")) return await this.resolveTemplateLeafReferences(value, context);
@@ -19136,15 +19189,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				output: value,
 				substitutions: [],
 				complete: true,
-				parameterSpans: value === "" ? [] : [{
-					start: 0,
-					length: value.length,
-					parameter: logicalId
-				}]
+				parameterSpans: wholeReferenceSpans({ Ref: logicalId }, value)
 			});
 			return value;
 		}
-		if ("Fn::GetAtt" in obj) return await this.resolveGetAtt(obj["Fn::GetAtt"], context);
+		if ("Fn::GetAtt" in obj) return this.recordCrossStackReadSpan(context, obj, await this.resolveGetAtt(obj["Fn::GetAtt"], context));
 		if ("Fn::Join" in obj) return await this.resolveJoin(obj["Fn::Join"], context, obj);
 		if ("Fn::Sub" in obj) return await this.resolveSub(obj["Fn::Sub"], context, obj);
 		if ("Fn::Select" in obj) return await this.resolveSelect(obj["Fn::Select"], context);
@@ -19155,8 +19204,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if ("Fn::And" in obj) return await this.resolveAnd(obj["Fn::And"], context);
 		if ("Fn::Or" in obj) return await this.resolveOr(obj["Fn::Or"], context);
 		if ("Fn::Not" in obj) return await this.resolveNot(obj["Fn::Not"], context);
-		if ("Fn::ImportValue" in obj) return await this.resolveImportValue(obj["Fn::ImportValue"], context);
-		if ("Fn::GetStackOutput" in obj) return await this.resolveGetStackOutput(obj["Fn::GetStackOutput"], context);
+		if ("Fn::ImportValue" in obj) return this.recordCrossStackReadSpan(context, obj, await this.resolveImportValue(obj["Fn::ImportValue"], context));
+		if ("Fn::GetStackOutput" in obj) return this.recordCrossStackReadSpan(context, obj, await this.resolveGetStackOutput(obj["Fn::GetStackOutput"], context));
 		if ("Fn::FindInMap" in obj) return await this.resolveFindInMap(obj["Fn::FindInMap"], context);
 		if ("Fn::Base64" in obj) return await this.resolveBase64(obj["Fn::Base64"], context);
 		if ("Fn::GetAZs" in obj) return await this.resolveGetAZs(obj["Fn::GetAZs"], context);
@@ -19417,7 +19466,7 @@ var DiffCalculator = class DiffCalculator {
 				const resolvedDesiredProps = resolveFn ? await this.resolveBestEffort(rawDesiredProps, resolveFn) : rawDesiredProps;
 				const sdkRouted = currentResource.provisionedBy !== "cc-api";
 				const desiredAfterDrops = sdkRouted && allowedUnsupportedProperties ? withoutAcceptedSilentDropProperties(desiredResource.Type, resolvedDesiredProps, allowedUnsupportedProperties, currentResource.properties) : resolvedDesiredProps;
-				const currentAfterDrops = sdkRouted ? withoutSilentDropProperties(desiredResource.Type, currentResource.properties) : currentResource.properties;
+				const currentAfterDrops = sdkRouted ? withoutUnwrittenSilentDropProperties(desiredResource.Type, currentResource.properties, resolvedDesiredProps, allowedUnsupportedProperties ?? /* @__PURE__ */ new Set(), acceptedCreateOnlyDropsOf(currentResource)) : currentResource.properties;
 				const desiredPropsForCompare = canonicalizeProperties ? canonicalizeProperties(desiredResource.Type, desiredAfterDrops) : desiredAfterDrops;
 				const currentPropsForCompare = canonicalizeProperties && sdkRouted ? canonicalizeProperties(desiredResource.Type, currentAfterDrops) : currentAfterDrops;
 				const droppedKeys = canonicalizeProperties ? Object.keys(desiredAfterDrops).filter((key) => !Object.hasOwn(desiredPropsForCompare, key)) : [];
@@ -20649,7 +20698,8 @@ var CloudControlProvider = class {
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
-		this.logger.debug(`Updating resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
+		const idLog = updateIdLogSink(this.logger, physicalId, properties, previousProperties, context?.maskSecrets);
+		idLog.debug(`Updating resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		await this.assertRecordedRegionAgainstClient("pre-update", context?.expectedRegion, resourceType, logicalId, physicalId);
 		try {
 			const cleanPreviousProperties = stringifyJsonProperties(resourceType, stripNullValues(previousProperties));
@@ -20714,9 +20764,9 @@ var CloudControlProvider = class {
 				physicalId,
 				wasReplaced: false
 			};
-			if (progressEvent.ResourceModel) result.attributes = this.parseResourceModel(progressEvent.ResourceModel);
-			result.attributes = await this.mergeSparseModelReadback(resourceType, physicalId, result.attributes || {});
-			result.attributes = await this.enrichResourceAttributes(resourceType, physicalId, result.attributes);
+			if (progressEvent.ResourceModel) result.attributes = this.parseResourceModel(progressEvent.ResourceModel, idLog);
+			result.attributes = await this.mergeSparseModelReadback(resourceType, physicalId, result.attributes || {}, idLog);
+			result.attributes = await this.enrichResourceAttributes(resourceType, physicalId, result.attributes, idLog);
 			return result;
 		} catch (error) {
 			this.handleError(error, "UPDATE", resourceType, logicalId, physicalId);
@@ -20729,7 +20779,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CsajFK4_.js");
+			const { ASGProvider } = await import("./asg-provider-3uLGAhIx.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -20835,7 +20885,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-a-vZsR9L.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DlFQdgwe.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-J6zl27x3.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-BQ-CGoYJ.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -21080,34 +21130,34 @@ var CloudControlProvider = class {
 		const regionFlag = safeRegion === void 0 ? "" : ` --region ${shellQuote(safeRegion)}`;
 		return `${withPasteableAwsProfile("aws cloudcontrol get-resource-request-status")} --request-token ${shellQuote(safeToken)}${regionFlag}`;
 	}
-	parseResourceModel(resourceModel) {
+	parseResourceModel(resourceModel, log = this.logger) {
 		try {
 			return JSON.parse(resourceModel);
 		} catch (error) {
 			const described = describeAwsFailure(error);
-			this.logger.warn(`Failed to parse resource model: ${described.redacted ? described.summary : error instanceof Error ? error.name : "Error"}\nModel shape: ${resourceModel.length} chars, ${describeJsonKeys(resourceModel)}`);
-			this.logger.debug(`Resource model parse failure detail: ${displaySafe(described.detail)}`);
+			log.warn(`Failed to parse resource model: ${described.redacted ? described.summary : error instanceof Error ? error.name : "Error"}\nModel shape: ${resourceModel.length} chars, ${describeJsonKeys(resourceModel)}`);
+			if (log.withheld !== true) log.debug(`Resource model parse failure detail: ${displaySafe(described.detail)}`);
 			return {};
 		}
 	}
-	async accountInfoForSynthesizedArn(resourceType, attributeName, physicalId) {
+	async accountInfoForSynthesizedArn(resourceType, attributeName, physicalId, log = this.logger) {
 		const region = await this.cloudControlClient.config.region();
 		try {
 			return await getAccountInfo(region);
 		} catch (error) {
 			if (!(error instanceof AccountIdUnavailableError)) throw error;
-			this.logger.warn(`Not enriching ${resourceType} ${attributeName} for ${physicalId}: ${error.message} The resource itself is unaffected; the record heals on its next update.`);
+			log.warn(`Not enriching ${resourceType} ${attributeName} for ${physicalId}: ${error.message} The resource itself is unaffected; the record heals on its next update.`);
 			return;
 		}
 	}
-	async enrichResourceAttributes(resourceType, physicalId, attributes) {
+	async enrichResourceAttributes(resourceType, physicalId, attributes, log = this.logger) {
 		const enriched = { ...attributes };
 		switch (resourceType) {
 			case "AWS::S3::Bucket":
 				if (!enriched["Arn"]) try {
 					enriched["Arn"] = s3BucketArn(physicalId, await this.cloudControlClient.config.region());
 				} catch (error) {
-					this.logger.debug(`Failed to construct S3 Bucket Arn for ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to construct S3 Bucket Arn for ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::RDS::DBCluster":
@@ -21119,10 +21169,10 @@ var CloudControlProvider = class {
 						if (cluster.ReaderEndpoint) enriched["ReadEndpoint.Address"] = cluster.ReaderEndpoint;
 						if (cluster.DBClusterArn) enriched["Arn"] = cluster.DBClusterArn;
 						if (cluster.DbClusterResourceId) enriched["DBClusterResourceId"] = cluster.DbClusterResourceId;
-						this.logger.debug(`Enriched RDS DBCluster ${physicalId} with Endpoint/Port/Arn from DescribeDBClusters`);
+						log.debug(`Enriched RDS DBCluster ${physicalId} with Endpoint/Port/Arn from DescribeDBClusters`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to enrich RDS DBCluster ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to enrich RDS DBCluster ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::RDS::DBInstance":
@@ -21133,10 +21183,10 @@ var CloudControlProvider = class {
 						if (inst.Endpoint?.Port !== void 0) enriched["Endpoint.Port"] = String(inst.Endpoint.Port);
 						if (inst.Endpoint?.HostedZoneId) enriched["Endpoint.HostedZoneId"] = inst.Endpoint.HostedZoneId;
 						if (inst.DBInstanceArn) enriched["Arn"] = inst.DBInstanceArn;
-						this.logger.debug(`Enriched RDS DBInstance ${physicalId} with Endpoint/Port/Arn from DescribeDBInstances`);
+						log.debug(`Enriched RDS DBInstance ${physicalId} with Endpoint/Port/Arn from DescribeDBInstances`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to enrich RDS DBInstance ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to enrich RDS DBInstance ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::DynamoDB::Table":
@@ -21144,10 +21194,10 @@ var CloudControlProvider = class {
 					const latestStreamArn = (await getAwsClients().dynamoDB.send(new DescribeTableCommand({ TableName: physicalId }))).Table?.LatestStreamArn;
 					if (latestStreamArn) {
 						enriched["StreamArn"] = latestStreamArn;
-						this.logger.debug(`Enriched DynamoDB StreamArn for ${physicalId}: ${latestStreamArn}`);
+						log.debug(`Enriched DynamoDB StreamArn for ${physicalId}: ${latestStreamArn}`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to get DynamoDB StreamArn for ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to get DynamoDB StreamArn for ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::ApiGateway::RestApi":
@@ -21155,10 +21205,10 @@ var CloudControlProvider = class {
 					const getRestApiResponse = await getAwsClients().apiGateway.send(new GetRestApiCommand({ restApiId: physicalId }));
 					if (getRestApiResponse.rootResourceId) {
 						enriched["RootResourceId"] = getRestApiResponse.rootResourceId;
-						this.logger.debug(`Enriched RestApi RootResourceId for ${physicalId}: ${getRestApiResponse.rootResourceId}`);
+						log.debug(`Enriched RestApi RootResourceId for ${physicalId}: ${getRestApiResponse.rootResourceId}`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to get RestApi RootResourceId for ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to get RestApi RootResourceId for ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				if (!enriched["RestApiId"]) enriched["RestApiId"] = physicalId;
 				break;
@@ -21167,21 +21217,21 @@ var CloudControlProvider = class {
 					const s3CanonicalUserId = (await getAwsClients().cloudFront.send(new GetCloudFrontOriginAccessIdentityCommand({ Id: physicalId }))).CloudFrontOriginAccessIdentity?.S3CanonicalUserId;
 					if (s3CanonicalUserId) {
 						enriched["S3CanonicalUserId"] = s3CanonicalUserId;
-						this.logger.debug(`Enriched CloudFront OAI S3CanonicalUserId for ${physicalId}: ${s3CanonicalUserId}`);
+						log.debug(`Enriched CloudFront OAI S3CanonicalUserId for ${physicalId}: ${s3CanonicalUserId}`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to get CloudFront OAI S3CanonicalUserId for ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to get CloudFront OAI S3CanonicalUserId for ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::KMS::Key":
 				if (!enriched["Arn"]) try {
-					const kmsAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "Arn", physicalId);
+					const kmsAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "Arn", physicalId, log);
 					if (kmsAccountInfo) {
 						enriched["Arn"] = `arn:${kmsAccountInfo.partition}:kms:${canonicalizeRegion(kmsAccountInfo.region)}:${kmsAccountInfo.accountId}:key/${physicalId}`;
-						this.logger.debug(`Enriched KMS Key Arn for ${physicalId}: ${String(enriched["Arn"])}`);
+						log.debug(`Enriched KMS Key Arn for ${physicalId}: ${String(enriched["Arn"])}`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to construct KMS Key Arn for ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to construct KMS Key Arn for ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				if (!enriched["KeyId"]) enriched["KeyId"] = physicalId;
 				break;
@@ -21193,16 +21243,16 @@ var CloudControlProvider = class {
 				break;
 			case "AWS::ECR::Repository":
 				if (!enriched["Arn"]) try {
-					const ecrAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "Arn", physicalId);
+					const ecrAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "Arn", physicalId, log);
 					if (ecrAccountInfo) {
 						enriched["Arn"] = `arn:${ecrAccountInfo.partition}:ecr:${canonicalizeRegion(ecrAccountInfo.region)}:${ecrAccountInfo.accountId}:repository/${physicalId}`;
-						this.logger.debug(`Enriched ECR Repository Arn for ${physicalId}: ${String(enriched["Arn"])}`);
+						log.debug(`Enriched ECR Repository Arn for ${physicalId}: ${String(enriched["Arn"])}`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to construct ECR Repository Arn: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to construct ECR Repository Arn: ${describeAwsFailure(error).detail}`);
 				}
 				if (!enriched["RepositoryUri"]) try {
-					const ecrAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "RepositoryUri", physicalId);
+					const ecrAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "RepositoryUri", physicalId, log);
 					if (ecrAccountInfo) {
 						const { urlSuffix } = derivePartitionAndUrlSuffix(ecrAccountInfo.region);
 						enriched["RepositoryUri"] = `${ecrAccountInfo.accountId}.dkr.ecr.${canonicalizeRegion(ecrAccountInfo.region)}.${urlSuffix}/${physicalId}`;
@@ -21214,7 +21264,7 @@ var CloudControlProvider = class {
 					const [publicIp, allocationId] = physicalId.split("|");
 					if (!enriched["AllocationId"]) enriched["AllocationId"] = allocationId;
 					if (!enriched["PublicIp"]) enriched["PublicIp"] = publicIp;
-					this.logger.debug(`Enriched EIP attributes: AllocationId=${allocationId}, PublicIp=${publicIp}`);
+					log.debug(`Enriched EIP attributes: AllocationId=${allocationId}, PublicIp=${publicIp}`);
 				}
 				break;
 			case "AWS::Lambda::Version":
@@ -21222,18 +21272,18 @@ var CloudControlProvider = class {
 					const versionSegments = physicalId.split(":");
 					const versionNumber = versionSegments[versionSegments.length - 1];
 					enriched["Version"] = versionNumber;
-					this.logger.debug(`Enriched Lambda Version for ${physicalId}: ${versionNumber}`);
+					log.debug(`Enriched Lambda Version for ${physicalId}: ${versionNumber}`);
 				}
 				break;
 			case "AWS::Kinesis::Stream":
 				if (!enriched["Arn"]) try {
-					const kinesisAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "Arn", physicalId);
+					const kinesisAccountInfo = await this.accountInfoForSynthesizedArn(resourceType, "Arn", physicalId, log);
 					if (kinesisAccountInfo) {
 						enriched["Arn"] = `arn:${kinesisAccountInfo.partition}:kinesis:${canonicalizeRegion(kinesisAccountInfo.region)}:${kinesisAccountInfo.accountId}:stream/${physicalId}`;
-						this.logger.debug(`Enriched Kinesis Stream Arn for ${physicalId}: ${String(enriched["Arn"])}`);
+						log.debug(`Enriched Kinesis Stream Arn for ${physicalId}: ${String(enriched["Arn"])}`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to construct Kinesis Stream Arn for ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to construct Kinesis Stream Arn for ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::Lambda::Url":
@@ -21241,11 +21291,11 @@ var CloudControlProvider = class {
 					const urlConfig = await getAwsClients().lambda.send(new GetFunctionUrlConfigCommand({ FunctionName: physicalId }));
 					if (urlConfig.FunctionUrl) {
 						enriched["FunctionUrl"] = urlConfig.FunctionUrl;
-						this.logger.debug(`Enriched Lambda URL FunctionUrl for ${physicalId}: ${urlConfig.FunctionUrl}`);
+						log.debug(`Enriched Lambda URL FunctionUrl for ${physicalId}: ${urlConfig.FunctionUrl}`);
 					}
 					if (urlConfig.FunctionArn) enriched["FunctionArn"] = urlConfig.FunctionArn;
 				} catch (error) {
-					this.logger.debug(`Failed to get Lambda URL config for ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to get Lambda URL config for ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::Events::Connection":
@@ -21259,9 +21309,9 @@ var CloudControlProvider = class {
 						}
 					}
 					if (conn.SecretArn && !enriched["SecretArn"]) enriched["SecretArn"] = conn.SecretArn;
-					this.logger.debug(`Enriched Events Connection ${physicalId} with Arn/SecretArn/ArnForPolicy from DescribeConnection`);
+					log.debug(`Enriched Events Connection ${physicalId} with Arn/SecretArn/ArnForPolicy from DescribeConnection`);
 				} catch (error) {
-					this.logger.debug(`Failed to enrich Events Connection ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to enrich Events Connection ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::Events::ApiDestination":
@@ -21274,9 +21324,9 @@ var CloudControlProvider = class {
 							if (lastSlash > 0) enriched["ArnForPolicy"] = dest.ApiDestinationArn.slice(0, lastSlash);
 						}
 					}
-					this.logger.debug(`Enriched Events ApiDestination ${physicalId} with Arn/ArnForPolicy from DescribeApiDestination`);
+					log.debug(`Enriched Events ApiDestination ${physicalId} with Arn/ArnForPolicy from DescribeApiDestination`);
 				} catch (error) {
-					this.logger.debug(`Failed to enrich Events ApiDestination ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to enrich Events ApiDestination ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::ElastiCache::ReplicationGroup":
@@ -21295,10 +21345,10 @@ var CloudControlProvider = class {
 						const readPorts = readEndpoints.map((ep) => ep?.Port).filter((p) => p !== void 0);
 						if (readAddrs.length > 0) enriched["ReadEndPoint.Addresses"] = readAddrs.join(",");
 						if (readPorts.length > 0) enriched["ReadEndPoint.Ports"] = readPorts.map(String).join(",");
-						this.logger.debug(`Enriched ElastiCache ReplicationGroup ${physicalId} with endpoint attributes from DescribeReplicationGroups`);
+						log.debug(`Enriched ElastiCache ReplicationGroup ${physicalId} with endpoint attributes from DescribeReplicationGroups`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to enrich ElastiCache ReplicationGroup ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to enrich ElastiCache ReplicationGroup ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::Redshift::Cluster":
@@ -21307,10 +21357,10 @@ var CloudControlProvider = class {
 					if (cluster?.Endpoint) {
 						if (cluster.Endpoint.Address) enriched["Endpoint.Address"] = cluster.Endpoint.Address;
 						if (cluster.Endpoint.Port !== void 0) enriched["Endpoint.Port"] = String(cluster.Endpoint.Port);
-						this.logger.debug(`Enriched Redshift Cluster ${physicalId} with Endpoint.Address/Port from DescribeClusters`);
+						log.debug(`Enriched Redshift Cluster ${physicalId} with Endpoint.Address/Port from DescribeClusters`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to enrich Redshift Cluster ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to enrich Redshift Cluster ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::OpenSearchService::Domain":
@@ -21324,31 +21374,31 @@ var CloudControlProvider = class {
 							enriched["DomainArn"] = domain.ARN;
 						}
 						if (domain.DomainId) enriched["Id"] = domain.DomainId;
-						this.logger.debug(`Enriched OpenSearch Domain ${physicalId} with DomainEndpoint/Arn from DescribeDomain`);
+						log.debug(`Enriched OpenSearch Domain ${physicalId} with DomainEndpoint/Arn from DescribeDomain`);
 					}
 				} catch (error) {
-					this.logger.debug(`Failed to enrich OpenSearch Domain ${physicalId}: ${describeAwsFailure(error).detail}`);
+					log.debug(`Failed to enrich OpenSearch Domain ${physicalId}: ${describeAwsFailure(error).detail}`);
 				}
 				break;
 			case "AWS::Backup::BackupVault":
 				if (!enriched["BackupVaultArn"]) {
-					const model = await this.readCcResourceModel(resourceType, physicalId);
+					const model = await this.readCcResourceModel(resourceType, physicalId, log);
 					if (model) {
 						if (typeof model["BackupVaultArn"] === "string") enriched["BackupVaultArn"] = model["BackupVaultArn"];
 						if (!enriched["BackupVaultName"] && typeof model["BackupVaultName"] === "string") enriched["BackupVaultName"] = model["BackupVaultName"];
-						this.logger.debug(`Enriched Backup BackupVault ${physicalId} with BackupVaultArn from CC GetResource`);
+						log.debug(`Enriched Backup BackupVault ${physicalId} with BackupVaultArn from CC GetResource`);
 					}
 				}
 				if (!enriched["BackupVaultName"]) enriched["BackupVaultName"] = physicalId;
 				break;
 			case "AWS::Backup::BackupPlan":
 				if (!enriched["BackupPlanArn"] || !enriched["VersionId"]) {
-					const model = await this.readCcResourceModel(resourceType, physicalId);
+					const model = await this.readCcResourceModel(resourceType, physicalId, log);
 					if (model) {
 						if (!enriched["BackupPlanArn"] && typeof model["BackupPlanArn"] === "string") enriched["BackupPlanArn"] = model["BackupPlanArn"];
 						if (!enriched["VersionId"] && typeof model["VersionId"] === "string") enriched["VersionId"] = model["VersionId"];
 						if (!enriched["BackupPlanId"] && typeof model["BackupPlanId"] === "string") enriched["BackupPlanId"] = model["BackupPlanId"];
-						this.logger.debug(`Enriched Backup BackupPlan ${physicalId} with BackupPlanArn/VersionId from CC GetResource`);
+						log.debug(`Enriched Backup BackupPlan ${physicalId} with BackupPlanArn/VersionId from CC GetResource`);
 					}
 				}
 				if (!enriched["BackupPlanId"]) enriched["BackupPlanId"] = physicalId;
@@ -21360,53 +21410,53 @@ var CloudControlProvider = class {
 						if (!enriched["SelectionId"]) enriched["SelectionId"] = physicalId.substring(0, firstUnderscore);
 						if (!enriched["BackupPlanId"]) enriched["BackupPlanId"] = physicalId.substring(firstUnderscore + 1);
 					}
-					const model = await this.readCcResourceModel(resourceType, physicalId);
+					const model = await this.readCcResourceModel(resourceType, physicalId, log);
 					if (model) {
 						if (typeof model["SelectionId"] === "string") enriched["SelectionId"] = model["SelectionId"];
 						if (typeof model["BackupPlanId"] === "string") enriched["BackupPlanId"] = model["BackupPlanId"];
-						this.logger.debug(`Enriched Backup BackupSelection ${physicalId} with SelectionId from CC GetResource`);
+						log.debug(`Enriched Backup BackupSelection ${physicalId} with SelectionId from CC GetResource`);
 					}
 				}
 				break;
 			case "AWS::Pipes::Pipe":
 				if (!enriched["Arn"]) {
-					const model = await this.readCcResourceModel(resourceType, physicalId);
+					const model = await this.readCcResourceModel(resourceType, physicalId, log);
 					if (model) {
 						if (typeof model["Arn"] === "string") enriched["Arn"] = model["Arn"];
 						if (!enriched["CurrentState"] && typeof model["CurrentState"] === "string") enriched["CurrentState"] = model["CurrentState"];
 						if (!enriched["StateReason"] && typeof model["StateReason"] === "string") enriched["StateReason"] = model["StateReason"];
 						if (!enriched["CreationTime"] && typeof model["CreationTime"] === "string") enriched["CreationTime"] = model["CreationTime"];
 						if (!enriched["LastModifiedTime"] && typeof model["LastModifiedTime"] === "string") enriched["LastModifiedTime"] = model["LastModifiedTime"];
-						this.logger.debug(`Enriched Pipes Pipe ${physicalId} with Arn from CC GetResource`);
+						log.debug(`Enriched Pipes Pipe ${physicalId} with Arn from CC GetResource`);
 					}
 				}
 				break;
 			case "AWS::S3::AccessPoint":
 				if (!enriched["Arn"] || !enriched["Alias"]) {
-					const model = await this.readCcResourceModel(resourceType, physicalId);
+					const model = await this.readCcResourceModel(resourceType, physicalId, log);
 					if (model) {
 						if (!enriched["Arn"] && typeof model["Arn"] === "string") enriched["Arn"] = model["Arn"];
 						if (!enriched["Alias"] && typeof model["Alias"] === "string") enriched["Alias"] = model["Alias"];
 						if (!enriched["NetworkOrigin"] && typeof model["NetworkOrigin"] === "string") enriched["NetworkOrigin"] = model["NetworkOrigin"];
-						this.logger.debug(`Enriched S3 AccessPoint ${physicalId} with Arn/Alias from CC GetResource`);
+						log.debug(`Enriched S3 AccessPoint ${physicalId} with Arn/Alias from CC GetResource`);
 					}
 				}
 				break;
 			case "AWS::ResourceGroups::Group": if (!enriched["Arn"]) {
-				const model = await this.readCcResourceModel(resourceType, physicalId);
+				const model = await this.readCcResourceModel(resourceType, physicalId, log);
 				if (model) {
 					if (typeof model["Arn"] === "string") enriched["Arn"] = model["Arn"];
-					this.logger.debug(`Enriched ResourceGroups Group ${physicalId} with Arn from CC GetResource`);
+					log.debug(`Enriched ResourceGroups Group ${physicalId} with Arn from CC GetResource`);
 				}
 			}
 		}
 		return enriched;
 	}
-	async mergeSparseModelReadback(resourceType, physicalId, attributes) {
+	async mergeSparseModelReadback(resourceType, physicalId, attributes, log = this.logger) {
 		if (!this.isSparseAttributeMap(attributes, physicalId)) return attributes;
-		const model = await this.readCcResourceModel(resourceType, physicalId);
+		const model = await this.readCcResourceModel(resourceType, physicalId, log);
 		if (!model) return attributes;
-		this.logger.debug(`Merged CC GetResource read-back over sparse ${resourceType} attributes for ${physicalId}`);
+		log.debug(`Merged CC GetResource read-back over sparse ${resourceType} attributes for ${physicalId}`);
 		return {
 			...attributes,
 			...model
@@ -21419,7 +21469,7 @@ var CloudControlProvider = class {
 		identifierEchoes.add(physicalId);
 		return values.every((value) => typeof value === "string" && identifierEchoes.has(value));
 	}
-	async readCcResourceModel(resourceType, physicalId) {
+	async readCcResourceModel(resourceType, physicalId, log = this.logger) {
 		try {
 			const raw = (await this.cloudControlClient.send(new GetResourceCommand({
 				TypeName: resourceType,
@@ -21430,7 +21480,7 @@ var CloudControlProvider = class {
 			if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return;
 			return parsed;
 		} catch (error) {
-			this.logger.debug(`Failed to read CC model for ${resourceType} ${physicalId}: ${describeAwsFailure(error).detail}`);
+			log.debug(`Failed to read CC model for ${resourceType} ${physicalId}: ${describeAwsFailure(error).detail}`);
 			return;
 		}
 	}
@@ -21538,6 +21588,28 @@ var CloudControlProvider = class {
 		return masked;
 	}
 };
+function updateIdLogSink(logger, physicalId, properties, previousProperties, maskSecrets) {
+	const mask = maskerOrIdentity(maskSecrets);
+	const raw = updateIdWithheld(properties, previousProperties, mask) ? [physicalId, ...physicalId.split("|")].filter((needle) => needle !== "") : [];
+	const masked = raw.map((needle) => mask(needle));
+	const needles = [.../* @__PURE__ */ new Set([...raw, ...masked.filter((m, i) => m !== "" && m !== raw[i] && m !== "***")])].sort((a, b) => b.length - a.length);
+	const scrub = (message) => needles.reduce((text, needle) => text.split(needle).join("***"), mask(message));
+	return {
+		debug: (message) => logger.debug(scrub(message)),
+		warn: (message) => logger.warn(scrub(message)),
+		withheld: needles.length > 0
+	};
+}
+function updateIdWithheld(properties, previousProperties, mask) {
+	return holdsSecretDerivedLeaf(properties, mask) || holdsSecretDerivedLeaf(previousProperties, mask);
+}
+function holdsSecretDerivedLeaf(value, mask, depth = 0) {
+	if (typeof value === "string") return isSecretDerivedValue(value, mask);
+	if (value === null || typeof value !== "object") return false;
+	if (depth > 64) return true;
+	if (Array.isArray(value)) return value.some((entry) => holdsSecretDerivedLeaf(entry, mask, depth + 1));
+	return Object.entries(value).some(([key, entry]) => isSecretDerivedValue(key, mask) || holdsSecretDerivedLeaf(entry, mask, depth + 1));
+}
 const IMPORT_YIELDED_NO_ATTRIBUTES_CONSEQUENCE = "Attributes the stack's state already records for this physical id are kept; without them, an Fn::GetAtt against this resource falls back to a value constructed from its physical id.";
 function maskLeavesDeep(value) {
 	if (Array.isArray(value)) return value.map((element) => maskLeavesDeep(element));
@@ -24458,7 +24530,7 @@ var ProviderRegistry = class {
 				if (reroutable.length > 0) remedies.push(`Remove the override for ${reroutable.join(", ")} to route this resource via Cloud Control API instead.`);
 				if (needsRecreate.length > 0) {
 					const one = needsRecreate.length === 1;
-					remedies.push(`${needsRecreate.join(", ")} ${one ? "is" : "are"} create-only, so removing the override does not apply ${one ? "it" : "them"} either -- a create-only property can only be applied by recreating the resource.`);
+					remedies.push(`${needsRecreate.join(", ")} ${one ? "is" : "are"} create-only, so removing the override does not apply ${one ? "it" : "them"} in place -- a create-only property can only be applied by recreating the resource. Where cdkd created the resource without ${one ? "it" : "them"}, a deploy without the override refuses unless something else already forces a replacement or the recreate is opted into.`);
 				}
 				this.logger.warn(`${logicalId} (${resourceType}): ${overridden.join(", ")} will be silently dropped (--prefer-sdk-route override accepted). ${remedies.join(" ")}`);
 			}
@@ -26183,6 +26255,19 @@ function maskedRollbackEventError(error, mask) {
 		message
 	};
 }
+function recordRollbackSkip(scope, op, reason) {
+	scope.result.warnings++;
+	scope.result.skipped++;
+	scope.ctx.recordEvent?.({
+		eventType: "ROLLBACK_RESOURCE_SKIPPED",
+		stackName: scope.stackName,
+		operation: op.changeType,
+		logicalId: op.logicalId,
+		resourceType: op.resourceType,
+		...op.provisionedBy && { provisionedBy: op.provisionedBy },
+		reason: scope.mask(reason)
+	});
+}
 function effectiveProvisionedBy(record, fallbackProvisionedBy) {
 	return record?.provisionedBy ?? fallbackProvisionedBy;
 }
@@ -26721,6 +26806,7 @@ function addRecordNames(opMasker, op, current) {
 		});
 	}
 }
+const ABSENT_BASELINE_SKIP_CAUSE = "Its recorded previous state has no `properties` bag, so there is nothing to restore it to; the rollback left the resource exactly as it is.";
 function requireRestorableBaseline(bag, logger, { logicalId, consequence, remedy, retry }) {
 	if (isRestorableBag(bag)) return true;
 	if (bag === void 0) {
@@ -26916,10 +27002,10 @@ async function replayOrphanRetain(s) {
 	});
 }
 async function replayDelete(s) {
-	const { op, stateResources, stackName, ctx, result, inlinePolicyWriters, afterOp, action, logger, mask } = s;
+	const { op, stateResources, stackName, ctx, inlinePolicyWriters, afterOp, action, logger, mask } = s;
 	if (!op.physicalId) {
 		logger.warn(`  Rollback: Cannot delete ${safe(op.logicalId)} — no physical ID recorded`);
-		result.warnings++;
+		recordRollbackSkip(s, op, "No physical id is recorded for the rolled-back CREATE, so the rollback cannot address it to delete it.");
 		return;
 	}
 	const deleteProvisionedBy = effectiveProvisionedBy(stateResources[op.logicalId], op.provisionedBy);
@@ -27004,17 +27090,17 @@ async function replayReadopt(s) {
 	});
 }
 async function replayRevert(s) {
-	const { op, stateResources, stackName, ctx, resolver, result, inlinePolicyWriters, afterOp, isInterrupted, logger, secrets, opMasker, mask } = s;
+	const { op, stateResources, stackName, ctx, resolver, inlinePolicyWriters, afterOp, isInterrupted, logger, secrets, opMasker, mask } = s;
 	if (!op.previousState) {
 		logger.warn(`  Rollback: Cannot restore ${safe(op.logicalId)} — no previous state available`);
-		result.warnings++;
+		recordRollbackSkip(s, op, "No previous state is recorded for it, so there is nothing to restore it to.");
 		return;
 	}
 	const previousState = op.previousState;
 	const current = stateResources[op.logicalId];
 	if (!current) {
 		logger.warn(`  Rollback: Cannot restore ${safe(op.logicalId)} — resource not found in current state`);
-		result.warnings++;
+		recordRollbackSkip(s, op, "The resource is not in the current state, so the rollback had nothing to restore.");
 		return;
 	}
 	if (!requireRestorableBaseline(previousState.properties, logger, {
@@ -27023,7 +27109,7 @@ async function replayRevert(s) {
 		remedy: "Re-run `cdkd deploy` to re-converge it.",
 		retry: `re-running ${rerunRollbackPhrase(ctx, "`cdkd rollback`")} retries this op`
 	})) {
-		result.warnings++;
+		recordRollbackSkip(s, op, ABSENT_BASELINE_SKIP_CAUSE);
 		return;
 	}
 	logger.info(`  Rollback: Restoring ${safe(op.logicalId)} (${safe(op.resourceType)}) to previous state`);
@@ -27102,7 +27188,7 @@ async function replayReverseReplacement(s) {
 		remedy: "Re-run `cdkd deploy` to re-converge it.",
 		retry: `re-running ${rerunRollbackPhrase(ctx, "`cdkd rollback`")} retries this op`
 	})) {
-		result.warnings++;
+		recordRollbackSkip(s, op, ABSENT_BASELINE_SKIP_CAUSE);
 		return;
 	}
 	const resolvedPrevProps = await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId) ?? {};
@@ -27261,7 +27347,8 @@ async function replayReverseReplacement(s) {
 			physicalId: current.physicalId,
 			reason: mask(survivorReason),
 			...survivorProvisionedBy && { provisionedBy: survivorProvisionedBy }
-		}
+		},
+		...adoptedLiveNewResource && { reason: mask("The re-create returned the live new resource instead of re-creating the old one (its Create API is name-idempotent), so the replacement was NOT fully reversed: the old resource's original properties may not have been re-applied. Inspect it with `cdkd drift` and run `cdkd deploy` to reconcile.") }
 	});
 }
 
@@ -27317,6 +27404,7 @@ async function replayRollbackUnbound(operations, stateResources, stackName, ctx,
 	const result = {
 		failures: 0,
 		warnings: 0,
+		skipped: 0,
 		interrupted: false,
 		orphaned: []
 	};
@@ -27387,18 +27475,18 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 		switch (action) {
 			case "unrecoverable-delete":
 				logger.warn(`  Rollback: Cannot restore deleted resource ${safe(op.logicalId)} (${safe(op.resourceType)}) — resource has already been deleted`);
-				result.warnings++;
+				recordRollbackSkip(scope, op, "The failed deploy deleted this resource, and a rollback cannot re-create a deleted resource.");
 				return;
 			case "skip-already-done":
 				logger.debug(`  Rollback: ${safe(op.logicalId)} already reverted, skipping`);
 				return;
 			case "skip-mismatch":
 				logger.warn(`  Rollback: Skipping ${safe(op.logicalId)} — its physical id changed since the failed deploy (replaced by a later attempt); manual attention may be required`);
-				result.warnings++;
+				recordRollbackSkip(scope, op, "Its physical id changed since the failed deploy (replaced by a later attempt), so the rollback left it as it is; manual attention may be required.");
 				return;
 			case "skip-absent":
 				logger.warn(`  Rollback: Cannot restore ${safe(op.logicalId)} — resource no longer in state, skipping`);
-				result.warnings++;
+				recordRollbackSkip(scope, op, "The resource is no longer in state, so the rollback had nothing to restore.");
 				return;
 			case "refuse-replacement-routing": {
 				const routing = resolveReplacementOldType(op);
@@ -27433,6 +27521,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 	const result = {
 		failures: 0,
 		warnings: 0,
+		skipped: 0,
 		interrupted: false,
 		remainingFailedOps: [],
 		orphaned: []
@@ -27456,6 +27545,12 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 		const secrets = /* @__PURE__ */ new Map();
 		const opMasker = createOpMasker(logger, secrets);
 		const mask = opMasker.mask;
+		const skipScope = {
+			ctx,
+			stackName,
+			result,
+			mask
+		};
 		let createRollbackRoute;
 		try {
 			addRecordNames(opMasker, op, stateResources[op.logicalId]);
@@ -27465,15 +27560,15 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 					break;
 				case "skip-failed-unknown":
 					logger.warn(`  Rollback: failed CREATE of ${safe(op.logicalId)} (${safe(op.resourceType)}) recorded no physical id — if it was partially created in AWS, delete it manually`);
-					result.warnings++;
+					recordRollbackSkip(skipScope, op, "The failed CREATE recorded no physical id, so the rollback cannot address it; if it was partially created in AWS, delete it manually.");
 					break;
 				case "skip-failed-absent":
 					logger.warn(`  Rollback: cannot revert failed UPDATE of ${safe(op.logicalId)} — no previous state available, skipping`);
-					result.warnings++;
+					recordRollbackSkip(skipScope, op, "No previous state is available for the failed UPDATE, so there is nothing to revert it to.");
 					break;
 				case "skip-failed-type-change":
 					logger.warn(`  Rollback: cannot revert failed UPDATE of ${shownLogicalId(op.logicalId)} in place — it was a Type change (${refusalResourceType(op.previousState?.resourceType)} -> ${refusalResourceType(op.resourceType)}), which is a replacement, and its remote state is unknown. Inspect it with \`cdkd drift\` and re-converge with \`cdkd deploy\`. Skipping.`);
-					result.warnings++;
+					recordRollbackSkip(skipScope, op, `The failed UPDATE was a Type change (${String(op.previousState?.resourceType)} -> ${String(op.resourceType)}), which is a replacement, and its remote state is unknown, so it cannot be reverted in place.`);
 					break;
 				case "orphan-failed-create-retain": {
 					const failedCreateRecord = stateResources[op.logicalId];
@@ -27546,7 +27641,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						remedy: "Inspect it with `cdkd drift` (this op died mid-flight, so its remote state is unknown) and re-converge with `cdkd drift --revert` or `cdkd deploy`.",
 						retry: "re-running `cdkd rollback --revert-failed` retries this op (a plain `cdkd rollback` replays only the COMPLETED ops and then pops the whole segment, discarding this record)"
 					})) {
-						result.warnings++;
+						recordRollbackSkip(skipScope, op, ABSENT_BASELINE_SKIP_CAUSE);
 						break;
 					}
 					logger.info(`  Rollback: force-reverting failed UPDATE of ${safe(op.logicalId)} (${safe(op.resourceType)}) to its pre-deploy properties (--revert-failed; remote state is unknown)`);
@@ -28096,6 +28191,7 @@ async function performRollback(completedOperations, stateResources, stackName, p
 	return {
 		failures: result.failures,
 		warnings: result.warnings + run.warnings,
+		skipped: result.skipped,
 		orphaned: result.orphaned,
 		settledNested: run.settled
 	};
@@ -28145,7 +28241,7 @@ async function settleJournalAfterCleanRollback(stackName, failedOperations, init
 		this.logger.warn(safeMsg`Failed to settle the rollback journal after the clean rollback: ${err instanceof Error ? err.message : String(err)}. ` + `The journal keeps the full segment; a later rollback replay is idempotent.`);
 		return false;
 	}
-	await this.writeRollbackJournalSegment(stackName, [], failedOperations, "auto-rollback-clean", initialDeploy);
+	if (!await this.writeRollbackJournalSegment(stackName, [], failedOperations, "auto-rollback-clean", initialDeploy)) return true;
 	this.logger.info(`The automatic rollback restored the pre-deploy state. The failed resource's pre-failure record was kept — if it was left partially applied, revert it.\nRevert it with: ${pasteableCommand("cdkd rollback", [{
 		value: stackName,
 		hole: "stack"
@@ -28193,7 +28289,7 @@ function producerRegionEvidence(previousState) {
 	return inheritProducerRegions(own, this.options.inheritedProducerRegions?.());
 }
 async function writeRollbackJournalSegment(stackName, completedOperations, failedOperations, reason, initialDeploy, nestedPending) {
-	if (!nestedPending && completedOperations.length === 0 && failedOperations.length === 0) return;
+	if (!nestedPending && completedOperations.length === 0 && failedOperations.length === 0) return false;
 	const redactedCompleted = this.redactOperationsForJournal(completedOperations);
 	const redactedFailed = this.redactOperationsForJournal(failedOperations);
 	try {
@@ -28212,8 +28308,10 @@ async function writeRollbackJournalSegment(stackName, completedOperations, faile
 		};
 		await this.stateBackend.appendRollbackJournalSegment(stackName, this.stackRegion, segment);
 		this.logger.debug(`Rollback journal segment written (${reason})`);
+		return true;
 	} catch (journalError) {
 		this.logger.warn(`Failed to write rollback journal: ${journalError instanceof Error ? journalError.message : String(journalError)}. 'cdkd rollback' will NOT be able to revert this deploy — use 'cdkd deploy' to resume or 'cdkd destroy' to clean up.`);
+		return false;
 	}
 }
 
@@ -29147,6 +29245,45 @@ function hasUnpersistedHeals(resources) {
 	return false;
 }
 
+//#endregion
+//#region src/deployment/deploy-engine/record-shape.ts
+function auditResolvedAssetReferences(logicalId, resourceType, resolvedProps) {
+	const redirect = this.options.assetRedirect;
+	if (!redirect) return;
+	const findings = findUnrewrittenAssetReferences(resolvedProps, redirect);
+	if (findings.length === 0) return;
+	const detail = findings.map((f) => `  - ${f.path}: still references '${f.source}'`).join("\n");
+	throw new ProvisioningError(`Unrewritten asset reference on '${logicalId}' (${resourceType}): this region uses cdkd-owned asset storage, but the following resolved properties still point at the CDK bootstrap storage that 'cdk gc' may garbage-collect:\n${detail}\nThis is a template shape cdkd's asset-reference rewrite did not cover — deploying it would split-brain the stack (assets in cdkd storage, properties reading the CDK bucket). Please report this at https://github.com/go-to-k/cdkd/issues with the property shape. Workaround: deploy with --use-cdk-bootstrap-assets to pin the legacy destinations for this app.`, resourceType, logicalId);
+}
+function extractAllDependencies(template, logicalId) {
+	const resource = template?.Resources?.[logicalId];
+	if (!resource) return void 0;
+	const parser = new TemplateParser();
+	const parameterNames = new Set(Object.keys(template?.Parameters ?? {}));
+	const deps = [...parser.extractDependencies(resource)].filter((dep) => !parameterNames.has(dep));
+	return deps.length > 0 ? deps : void 0;
+}
+function propertiesToRecord(desiredProperties, result, resourceType, provisionedBy) {
+	if (result.effectiveProperties) return provisionedBy === "sdk" ? withoutSilentDropProperties(resourceType, result.effectiveProperties) : result.effectiveProperties;
+	const written = provisionedBy === "sdk" ? withoutSilentDropProperties(resourceType, desiredProperties) : desiredProperties;
+	return markSameGenerationBag(written);
+}
+function extractTemplateAttributes(template, logicalId) {
+	const resource = template?.Resources?.[logicalId];
+	return {
+		deletionPolicy: resource?.DeletionPolicy,
+		updateReplacePolicy: resource?.UpdateReplacePolicy
+	};
+}
+function acceptedCreateOnlyDropsField(recordedProperties, resourceType, provisionedBy, mode, previous) {
+	if (provisionedBy !== "sdk") return { acceptedCreateOnlyDrops: void 0 };
+	const createOnly = getPropertyCoverage(resourceType)?.createOnlyDrops;
+	if (createOnly === void 0 || createOnly.size === 0) return { acceptedCreateOnlyDrops: void 0 };
+	const carried = mode === "in-place" ? acceptedCreateOnlyDropsOf(previous) : void 0;
+	const names = findSilentDropProperties(resourceType, recordedProperties).map(({ property }) => property).filter((property) => createOnly.has(property) && (carried === void 0 || carried.has(property)));
+	return { acceptedCreateOnlyDrops: names.length > 0 ? names : void 0 };
+}
+
 //#endregion
 //#region src/utils/resource-line.ts
 function formatResourceLine(op, logicalId, resourceType, verbOverride) {
@@ -29160,6 +29297,75 @@ function formatResourceLine(op, logicalId, resourceType, verbOverride) {
 	}
 }
 
+//#endregion
+//#region src/deployment/prior-attempt-scope.ts
+const priorAttemptStore = new AsyncLocalStorage();
+function withPriorAttempts(lookup, fn) {
+	return priorAttemptStore.run(lookup, fn);
+}
+function priorAttemptLookup(logicalId, attempts) {
+	let landed = false;
+	return {
+		logicalId,
+		attempts,
+		notePossiblyLanded: () => {
+			landed = true;
+		},
+		possiblyLanded: () => landed
+	};
+}
+function getPriorAttempts(logicalId) {
+	const bound = priorAttemptStore.getStore();
+	return bound?.logicalId === logicalId ? bound : void 0;
+}
+function priorAttemptsInJournal(journal, logicalId, resourceType) {
+	let bags = [];
+	for (const segment of journal?.segments ?? []) {
+		if (segment.operations.some((op) => op.logicalId === logicalId)) bags = [];
+		for (const op of segment.failedOperations ?? []) {
+			if (op.logicalId !== logicalId || op.resourceType !== resourceType) continue;
+			if (op.changeType === "DELETE" || !isBag(op.attemptedProperties)) continue;
+			if (recordedAsNewResource(op)) continue;
+			bags.push(op.attemptedProperties);
+		}
+		if (segment.supersededLogicalIds?.includes(logicalId)) bags = [];
+	}
+	return bags;
+}
+function recordedAsNewResource(op) {
+	if (typeof op.physicalId !== "string" || op.physicalId === "") return false;
+	if (op.changeType === "CREATE") return true;
+	const previous = op.previousState?.physicalId;
+	return typeof previous === "string" && previous !== op.physicalId;
+}
+function isBag(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+const REFUSED_BEFORE_APPLYING = Symbol.for("cdkd.refusedBeforeApplying");
+const MAX_CAUSE_DEPTH = 10;
+function markRefusedBeforeApplying(error) {
+	if (!Object.isExtensible(error)) return error;
+	Object.defineProperty(error, REFUSED_BEFORE_APPLYING, {
+		value: true,
+		enumerable: false,
+		configurable: true,
+		writable: false
+	});
+	return error;
+}
+function isRefusedBeforeApplying(error, logicalId) {
+	let current = error;
+	for (let depth = 0; depth < MAX_CAUSE_DEPTH && current != null; depth++) {
+		if (typeof current === "object" || typeof current === "function") {
+			const linkId = current.logicalId;
+			if (typeof linkId === "string" && linkId !== logicalId) return false;
+			if (current[REFUSED_BEFORE_APPLYING] === true) return true;
+		}
+		current = current.cause;
+	}
+	return false;
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/create.ts
 async function provisionCreate(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
@@ -29202,10 +29408,12 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 	this.registerNoEchoAttributes(logicalId, result, createSecrets, resolvedProps);
 	const dependencies = this.extractAllDependencies(template, logicalId);
 	const templateAttrs = this.extractTemplateAttributes(template, logicalId);
+	const recordedProperties = this.propertiesToRecord(resolvedProps, result, resourceType, createDecision.provisionedBy);
 	stateResources[logicalId] = {
 		physicalId: result.physicalId,
 		resourceType,
-		properties: this.propertiesToRecord(resolvedProps, result, resourceType, createDecision.provisionedBy),
+		properties: recordedProperties,
+		...acceptedCreateOnlyDropsField(recordedProperties, resourceType, createDecision.provisionedBy, "new-resource"),
 		...result.attributes && { attributes: result.attributes },
 		...dependencies && dependencies.length > 0 && { dependencies },
 		...templateAttrs,
@@ -29239,7 +29447,7 @@ async function refuseTakenCreateName(input) {
 	const named = `${question.property} ${shown(question.desiredName)}`;
 	const adoptsText = "its create API hands back or overwrites an existing resource of that name instead of refusing it";
 	const refuse = (message, cause) => {
-		throw markNonRetryable(new CdkdError(maskName(message), "NAMED_CREATE_COLLISION", cause instanceof Error ? cause : void 0));
+		throw markNonRetryable(markRefusedBeforeApplying(new CdkdError(maskName(message), "NAMED_CREATE_COLLISION", cause instanceof Error ? cause : void 0)));
 	};
 	let knownPhysicalId;
 	const byArn = ["AWS::SNS::Topic", "AWS::StepFunctions::StateMachine"].includes(resourceType) ? createLookupArn(resourceType, question.desiredName, await getAccountInfo(this.stackRegion)) : void 0;
@@ -29272,262 +29480,6 @@ async function refuseTakenCreateName(input) {
 	return refuse(`${subject} is created with ${named}, and an existing resource (${shown(holderId)}) already holds that name. Since ${adoptsText}, creating it would take that resource over and record it as this stack's, for a later \`cdkd destroy\` to delete. Nothing was created. Choose a name no other resource holds; ` + ownRemedy);
 }
 
-//#endregion
-//#region src/deployment/deploy-value-equality.ts
-function isReplacementCeiling(pc) {
-	return pc.requiresReplacement && (pc.inPlacePropagated === true || pc.replacementPropagated === true);
-}
-function keyOrderFreeJson(value) {
-	return JSON.stringify(value, (_key, node) => {
-		if (node === null || typeof node !== "object" || Array.isArray(node)) return node;
-		const sorted = Object.create(null);
-		for (const key of Object.keys(node).sort()) sorted[key] = node[key];
-		return sorted;
-	});
-}
-function liveHoldsFreshLeaves(live, leaves) {
-	for (const leaf of leaves) {
-		let node = live;
-		for (const segment of leaf.path) {
-			if (typeof segment === "number") {
-				if (!Array.isArray(node) || segment >= node.length) return false;
-				node = node[segment];
-				continue;
-			}
-			if (node === null || typeof node !== "object" || Array.isArray(node)) return false;
-			if (!Object.prototype.hasOwnProperty.call(node, segment)) return false;
-			node = node[segment];
-		}
-		if (typeof node !== "string" || node !== leaf.plaintext) return false;
-	}
-	return true;
-}
-function outputMapsEqual(a, b) {
-	return deepEqualValue(a, b);
-}
-function deepEqualValue(a, b) {
-	if (a === b) return true;
-	if (a == null || b == null) return a === b;
-	if (typeof a !== typeof b) return false;
-	if (typeof a !== "object") return false;
-	if (Array.isArray(a) || Array.isArray(b)) {
-		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-		return a.every((v, i) => deepEqualValue(v, b[i]));
-	}
-	const ao = a;
-	const bo = b;
-	const ak = Object.keys(ao);
-	if (ak.length !== Object.keys(bo).length) return false;
-	for (const k of ak) {
-		if (!Object.prototype.hasOwnProperty.call(bo, k)) return false;
-		if (!deepEqualValue(ao[k], bo[k])) return false;
-	}
-	return true;
-}
-
-//#endregion
-//#region src/deployment/deploy-engine/update.ts
-async function provisionUpdate(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
-	const resourceType = change.resourceType;
-	const existingState = stateResources[logicalId];
-	const renderer = getLiveRenderer();
-	const currentResource = existingState;
-	if (!currentResource) throw new Error(`Cannot update ${logicalId}: resource not found in state`);
-	const oldResourceType = currentResource.resourceType;
-	const typeChanged = oldResourceType !== resourceType;
-	const desiredProps = change.desiredProperties || {};
-	const currentProps = change.currentProperties || {};
-	const currentPropsAsWritten = currentResource.provisionedBy === "cc-api" ? currentProps : withoutSilentDropProperties(resourceType, currentProps);
-	const context = this.buildResolverContext({
-		template,
-		resources: stateResources,
-		...parameterValues && { parameters: parameterValues },
-		...conditions && { conditions },
-		redactedAttributeReads: []
-	}, stackName);
-	const updateSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
-	this.perResourceSecrets.set(logicalId, updateSecrets);
-	const resolvedProps = await this.resolver.resolve(desiredProps, context);
-	this.perResourceTemplateProps.set(logicalId, desiredProps);
-	this.perResourceResolvedType.set(logicalId, resourceType);
-	recordNestedStackParameterExpressions(updateSecrets, resourceType, resolvedProps, desiredProps);
-	this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
-	const lostCandidate = childLostWithRecreatedParent({
-		resourceType,
-		templateProperties: desiredProps,
-		recreatedUnderSameId: this.recreatedUnderSameId,
-		recordedTypeOf: (id) => Object.hasOwn(stateResources, id) ? stateResources[id]?.resourceType : void 0,
-		conditions
-	});
-	const lostChild = lostCandidate?.mode === "reattach" || lostCandidate !== void 0 && Object.hasOwn(resolvedProps, lostCandidate.property) && Object.hasOwn(currentProps, lostCandidate.property) && keyOrderFreeJson(resolvedProps[lostCandidate.property]) === keyOrderFreeJson(currentProps[lostCandidate.property]) ? lostCandidate : void 0;
-	const lostWithParent = lostChild?.mode === "recreate" ? lostChild.parent : void 0;
-	const suppliesFreshMaskOnlyValue = carriesFreshNoEchoValue(resolvedProps, updateSecrets);
-	const desiredForSkipCheck = redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps);
-	const allowedSilentDrops = this.providerRegistry.getAllowedUnsupportedProperties?.();
-	const desiredForSkipCheckAsWritten = currentResource.provisionedBy !== "cc-api" && allowedSilentDrops ? withoutAcceptedSilentDropProperties(resourceType, desiredForSkipCheck, allowedSilentDrops, currentResource.properties) : desiredForSkipCheck;
-	const applyAttributeOnlyUpdate = (attributeChanges) => {
-		const attrSummary = attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
-		this.logger.info(safeMsg`  ↻ ${logicalId} (${resourceType}) attribute update: ${attrSummary}`);
-		stateResources[logicalId] = {
-			...currentResource,
-			...this.extractTemplateAttributes(template, logicalId)
-		};
-		if (counts) counts.updated++;
-		if (progress) progress.current++;
-		const attrPrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
-		renderer.removeTask(logicalId);
-		this.logger.info(safeMsg`${attrPrefix}${formatResourceLine("updated", logicalId, resourceType, "updated (metadata)")}`);
-	};
-	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten)) {
-		if (change.attributeChanges && change.attributeChanges.length > 0) {
-			applyAttributeOnlyUpdate(change.attributeChanges);
-			return;
-		}
-		this.logger.debug(`Skipping ${logicalId}: no actual changes after intrinsic function resolution`);
-		if (counts) counts.skipped++;
-		return;
-	}
-	this.refuseRedactedAttributeReads(logicalId, resourceType, context);
-	this.attemptedResolvedProps.set(logicalId, resolvedProps);
-	const noEchoHeldPaths = /* @__PURE__ */ new Set();
-	if (change.propertyChanges?.some((pc) => pc.requiresReplacement) === true) {
-		let readback;
-		const lowered = [];
-		for (const pc of change.propertyChanges) {
-			if (!pc.requiresReplacement) {
-				lowered.push(pc);
-				continue;
-			}
-			const freshLeaves = freshNoEchoLeafPositions(resolvedProps[pc.path], updateSecrets);
-			if (!isReplacementCeiling(pc) && freshLeaves.length === 0) {
-				lowered.push(pc);
-				continue;
-			}
-			const moved = keyOrderFreeJson(desiredForSkipCheckAsWritten[pc.path]) !== keyOrderFreeJson(currentPropsAsWritten[pc.path]);
-			const conditionalVerdict = moved && !typeChanged && isReplacementCeiling(pc) ? this.diffCalculator.conditionalReplacementVerdict?.(resourceType, pc.path, currentPropsAsWritten[pc.path], desiredForSkipCheckAsWritten[pc.path]) : void 0;
-			if (moved && conditionalVerdict !== false) {
-				lowered.push(pc);
-				continue;
-			}
-			if (freshLeaves.length > 0) {
-				if (typeChanged) {
-					lowered.push(pc);
-					continue;
-				}
-				readback ??= this.readReaderForFreshNoEchoCeiling(logicalId, currentResource, updateSecrets);
-				const read = await readback;
-				let verdict;
-				if ("failure" in read) verdict = read.failure;
-				else if (!Object.prototype.hasOwnProperty.call(read.live, pc.path)) verdict = "not-readable";
-				else verdict = liveHoldsFreshLeaves(read.live[pc.path], freshLeaves) ? "held" : "differs";
-				if (verdict !== "held") {
-					this.logger.warn(safeMsg`${logicalId}.${pc.path} carries a NoEcho value that AWS could not confirm unchanged (${verdict}): replacement kept.`);
-					lowered.push(pc);
-					continue;
-				}
-				this.logger.debug(safeMsg`${logicalId}.${pc.path} carries a NoEcho value AWS already holds: not replaced.`);
-				noEchoHeldPaths.add(pc.path);
-			}
-			lowered.push({
-				...pc,
-				requiresReplacement: false
-			});
-		}
-		change.propertyChanges = lowered;
-	}
-	if (noEchoHeldPaths.size > 0 && !typeChanged && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten) && Object.entries(resolvedProps).every(([key, value]) => noEchoHeldPaths.has(key) || freshNoEchoLeafPositions(value, updateSecrets).length === 0)) {
-		this.logger.debug(safeMsg`Skipping ${logicalId}: AWS already holds every NoEcho value it carries, and nothing else changed`);
-		this.attemptedResolvedProps.delete(logicalId);
-		if (change.attributeChanges && change.attributeChanges.length > 0) {
-			applyAttributeOnlyUpdate(change.attributeChanges);
-			return;
-		}
-		if (counts) counts.skipped++;
-		return;
-	}
-	const propertyDrivenReplacement = typeChanged || change.propertyChanges?.some((pc) => pc.requiresReplacement);
-	const recreateTargets = this.options.recreateTargets?.stackName === stackName ? this.options.recreateTargets : void 0;
-	const recreateViaCcApi = recreateTargets?.viaCcApi.has(logicalId) ?? false;
-	const recreateViaSdkProvider = recreateTargets?.viaSdkProvider.has(logicalId) ?? false;
-	const recreateFlagged = recreateViaCcApi || recreateViaSdkProvider;
-	const needsReplacement = propertyDrivenReplacement || recreateFlagged || lostWithParent !== void 0;
-	const liveLabel = this.liveTaskLabels.get(logicalId);
-	if (needsReplacement && liveLabel !== void 0 && !liveLabel.replacing) {
-		const label = `Replacing ${logicalId} (${resourceType})${this.peekRoutingForLabel(change, currentResource, stackName, logicalId, true, this.recreateDirectionFor(stackName, logicalId)) === "cc-api" ? " [CC API]" : ""}`;
-		this.liveTaskLabels.set(logicalId, {
-			label,
-			replacing: true,
-			...liveLabel.warnSuffix !== void 0 && { warnSuffix: liveLabel.warnSuffix }
-		});
-		renderer.updateTaskLabel(logicalId, `${label}${liveLabel.warnSuffix ?? ""}`);
-	} else if (!needsReplacement && liveLabel !== void 0 && liveLabel.replacing) {
-		const label = `Updating ${logicalId} (${resourceType})${this.peekRoutingForLabel(change, currentResource, stackName, logicalId, false, this.recreateDirectionFor(stackName, logicalId)) === "cc-api" ? " [CC API]" : ""}`;
-		this.liveTaskLabels.set(logicalId, {
-			label,
-			replacing: false,
-			...liveLabel.warnSuffix !== void 0 && { warnSuffix: liveLabel.warnSuffix }
-		});
-		renderer.updateTaskLabel(logicalId, `${label}${liveLabel.warnSuffix ?? ""}`);
-	}
-	const dependencies = this.extractAllDependencies(template, logicalId);
-	const updateReplacePolicy = template?.Resources?.[logicalId]?.UpdateReplacePolicy;
-	const markRestored = (outcome) => {
-		if (lostChild === void 0) return outcome;
-		if (this.updatesThatSentNothing.has(logicalId)) {
-			this.logger.warn(survivesParent(resourceType) ? safeMsg`  ⚠ ${logicalId} lost its attachment to ${lostChild.parent}, which was re-created, but its update sent no change (it is recorded on Cloud Control, which patches record against template); it may no longer be attached to ${lostChild.parent}. Attach it there by hand.` : safeMsg`  ⚠ ${logicalId} went with ${lostChild.parent}, which was re-created, but its update sent no change (it is recorded on Cloud Control, which patches record against template); its policy may be missing from ${lostChild.parent}. Re-run with --recreate-via-sdk-provider ${logicalId} to write it again.`);
-			return outcome;
-		}
-		this.restoredLostChildren.add(logicalId);
-		return outcome;
-	};
-	if (needsReplacement) return markRestored(await this.updateByReplacement({
-		change,
-		counts,
-		currentProps,
-		currentResource,
-		dependencies,
-		logicalId,
-		oldResourceType,
-		progress,
-		propertyDrivenReplacement,
-		recreateFlagged,
-		recreateViaCcApi,
-		recreateViaSdkProvider,
-		renderer,
-		resolvedProps,
-		resourceType,
-		stackName,
-		stateResources,
-		template,
-		typeChanged,
-		updateReplacePolicy,
-		updateSecrets,
-		lostWithParent
-	}));
-	return markRestored(await this.updateInPlace({
-		conditions,
-		counts,
-		currentProps,
-		currentPropsAsWritten,
-		currentResource,
-		dependencies,
-		desiredForSkipCheckAsWritten,
-		logicalId,
-		noEchoHeldPaths,
-		parameterValues,
-		progress,
-		renderer,
-		resolvedProps,
-		resourceType,
-		stackName,
-		stateResources,
-		template,
-		updateReplacePolicy,
-		updateSecrets,
-		reattach: lostChild?.mode === "reattach"
-	}));
-}
-
 //#endregion
 //#region src/provisioning/data-delete-intent.ts
 const S3_AUTO_DELETE_OBJECTS_TAG = "aws-cdk:auto-delete-objects";
@@ -32235,6 +32187,284 @@ function recordedProtectionNote(evidence, flags) {
 	return `${evidence}. AWS refuses to delete the resource while that protection is on, and cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and cdkd state destroy act on one), so ${flags} alone does not remove the old resource: depending on the replacement order, the deploy either fails at that delete or completes leaving the old resource, and its data, in AWS and no longer tracked by cdkd. Read ${DELETION_PROTECTION_DOC_POINTER} before you disable anything, then turn the protection off out of band (the console, or the service's own API) and re-run with ${flags}.`;
 }
 
+//#endregion
+//#region src/deployment/deploy-value-equality.ts
+function isReplacementCeiling(pc) {
+	return pc.requiresReplacement && (pc.inPlacePropagated === true || pc.replacementPropagated === true);
+}
+function keyOrderFreeJson(value) {
+	return JSON.stringify(value, (_key, node) => {
+		if (node === null || typeof node !== "object" || Array.isArray(node)) return node;
+		const sorted = Object.create(null);
+		for (const key of Object.keys(node).sort()) sorted[key] = node[key];
+		return sorted;
+	});
+}
+function liveHoldsFreshLeaves(live, leaves) {
+	for (const leaf of leaves) {
+		let node = live;
+		for (const segment of leaf.path) {
+			if (typeof segment === "number") {
+				if (!Array.isArray(node) || segment >= node.length) return false;
+				node = node[segment];
+				continue;
+			}
+			if (node === null || typeof node !== "object" || Array.isArray(node)) return false;
+			if (!Object.prototype.hasOwnProperty.call(node, segment)) return false;
+			node = node[segment];
+		}
+		if (typeof node !== "string" || node !== leaf.plaintext) return false;
+	}
+	return true;
+}
+function outputMapsEqual(a, b) {
+	return deepEqualValue(a, b);
+}
+function deepEqualValue(a, b) {
+	if (a === b) return true;
+	if (a == null || b == null) return a === b;
+	if (typeof a !== typeof b) return false;
+	if (typeof a !== "object") return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((v, i) => deepEqualValue(v, b[i]));
+	}
+	const ao = a;
+	const bo = b;
+	const ak = Object.keys(ao);
+	if (ak.length !== Object.keys(bo).length) return false;
+	for (const k of ak) {
+		if (!Object.prototype.hasOwnProperty.call(bo, k)) return false;
+		if (!deepEqualValue(ao[k], bo[k])) return false;
+	}
+	return true;
+}
+
+//#endregion
+//#region src/deployment/deploy-engine/update.ts
+async function provisionUpdate(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
+	const resourceType = change.resourceType;
+	const existingState = stateResources[logicalId];
+	const renderer = getLiveRenderer();
+	const currentResource = existingState;
+	if (!currentResource) throw new Error(`Cannot update ${logicalId}: resource not found in state`);
+	const oldResourceType = currentResource.resourceType;
+	const typeChanged = oldResourceType !== resourceType;
+	const desiredProps = change.desiredProperties || {};
+	const currentProps = change.currentProperties || {};
+	const context = this.buildResolverContext({
+		template,
+		resources: stateResources,
+		...parameterValues && { parameters: parameterValues },
+		...conditions && { conditions },
+		redactedAttributeReads: []
+	}, stackName);
+	const updateSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
+	this.perResourceSecrets.set(logicalId, updateSecrets);
+	const resolvedProps = await this.resolver.resolve(desiredProps, context);
+	this.perResourceTemplateProps.set(logicalId, desiredProps);
+	this.perResourceResolvedType.set(logicalId, resourceType);
+	recordNestedStackParameterExpressions(updateSecrets, resourceType, resolvedProps, desiredProps);
+	this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
+	const lostCandidate = childLostWithRecreatedParent({
+		resourceType,
+		templateProperties: desiredProps,
+		recreatedUnderSameId: this.recreatedUnderSameId,
+		recordedTypeOf: (id) => Object.hasOwn(stateResources, id) ? stateResources[id]?.resourceType : void 0,
+		conditions
+	});
+	const lostChild = lostCandidate?.mode === "reattach" || lostCandidate !== void 0 && Object.hasOwn(resolvedProps, lostCandidate.property) && Object.hasOwn(currentProps, lostCandidate.property) && keyOrderFreeJson(resolvedProps[lostCandidate.property]) === keyOrderFreeJson(currentProps[lostCandidate.property]) ? lostCandidate : void 0;
+	const lostWithParent = lostChild?.mode === "recreate" ? lostChild.parent : void 0;
+	const suppliesFreshMaskOnlyValue = carriesFreshNoEchoValue(resolvedProps, updateSecrets);
+	const desiredForSkipCheck = redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps);
+	const allowedSilentDrops = this.providerRegistry.getAllowedUnsupportedProperties?.();
+	const desiredForSkipCheckAsWritten = currentResource.provisionedBy !== "cc-api" && allowedSilentDrops ? withoutAcceptedSilentDropProperties(resourceType, desiredForSkipCheck, allowedSilentDrops, currentResource.properties) : desiredForSkipCheck;
+	const allowedForRecord = allowedSilentDrops ?? /* @__PURE__ */ new Set();
+	const createOnlyEvidence = acceptedCreateOnlyDropsOf(currentResource);
+	const currentPropsAsWritten = currentResource.provisionedBy === "cc-api" ? currentProps : withoutUnwrittenSilentDropProperties(resourceType, currentProps, desiredForSkipCheck, allowedForRecord, createOnlyEvidence);
+	const applyAttributeOnlyUpdate = (attributeChanges) => {
+		const attrSummary = attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
+		this.logger.info(safeMsg`  ↻ ${logicalId} (${resourceType}) attribute update: ${attrSummary}`);
+		stateResources[logicalId] = {
+			...currentResource,
+			...this.extractTemplateAttributes(template, logicalId)
+		};
+		if (counts) counts.updated++;
+		if (progress) progress.current++;
+		const attrPrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
+		renderer.removeTask(logicalId);
+		this.logger.info(safeMsg`${attrPrefix}${formatResourceLine("updated", logicalId, resourceType, "updated (metadata)")}`);
+	};
+	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten)) {
+		if (change.attributeChanges && change.attributeChanges.length > 0) {
+			applyAttributeOnlyUpdate(change.attributeChanges);
+			return;
+		}
+		this.logger.debug(`Skipping ${logicalId}: no actual changes after intrinsic function resolution`);
+		if (counts) counts.skipped++;
+		return;
+	}
+	this.refuseRedactedAttributeReads(logicalId, resourceType, context);
+	this.attemptedResolvedProps.set(logicalId, resolvedProps);
+	const noEchoHeldPaths = /* @__PURE__ */ new Set();
+	if (change.propertyChanges?.some((pc) => pc.requiresReplacement) === true) {
+		let readback;
+		const lowered = [];
+		for (const pc of change.propertyChanges) {
+			if (!pc.requiresReplacement) {
+				lowered.push(pc);
+				continue;
+			}
+			const freshLeaves = freshNoEchoLeafPositions(resolvedProps[pc.path], updateSecrets);
+			if (!isReplacementCeiling(pc) && freshLeaves.length === 0) {
+				lowered.push(pc);
+				continue;
+			}
+			const moved = keyOrderFreeJson(desiredForSkipCheckAsWritten[pc.path]) !== keyOrderFreeJson(currentPropsAsWritten[pc.path]);
+			const conditionalVerdict = moved && !typeChanged && isReplacementCeiling(pc) ? this.diffCalculator.conditionalReplacementVerdict?.(resourceType, pc.path, currentPropsAsWritten[pc.path], desiredForSkipCheckAsWritten[pc.path]) : void 0;
+			if (moved && conditionalVerdict !== false) {
+				lowered.push(pc);
+				continue;
+			}
+			if (freshLeaves.length > 0) {
+				if (typeChanged) {
+					lowered.push(pc);
+					continue;
+				}
+				readback ??= this.readReaderForFreshNoEchoCeiling(logicalId, currentResource, updateSecrets);
+				const read = await readback;
+				let verdict;
+				if ("failure" in read) verdict = read.failure;
+				else if (!Object.prototype.hasOwnProperty.call(read.live, pc.path)) verdict = "not-readable";
+				else verdict = liveHoldsFreshLeaves(read.live[pc.path], freshLeaves) ? "held" : "differs";
+				if (verdict !== "held") {
+					this.logger.warn(safeMsg`${logicalId}.${pc.path} carries a NoEcho value that AWS could not confirm unchanged (${verdict}): replacement kept.`);
+					lowered.push(pc);
+					continue;
+				}
+				this.logger.debug(safeMsg`${logicalId}.${pc.path} carries a NoEcho value AWS already holds: not replaced.`);
+				noEchoHeldPaths.add(pc.path);
+			}
+			lowered.push({
+				...pc,
+				requiresReplacement: false
+			});
+		}
+		change.propertyChanges = lowered;
+	}
+	if (noEchoHeldPaths.size > 0 && !typeChanged && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten) && Object.entries(resolvedProps).every(([key, value]) => noEchoHeldPaths.has(key) || freshNoEchoLeafPositions(value, updateSecrets).length === 0)) {
+		this.logger.debug(safeMsg`Skipping ${logicalId}: AWS already holds every NoEcho value it carries, and nothing else changed`);
+		this.attemptedResolvedProps.delete(logicalId);
+		if (change.attributeChanges && change.attributeChanges.length > 0) {
+			applyAttributeOnlyUpdate(change.attributeChanges);
+			return;
+		}
+		if (counts) counts.skipped++;
+		return;
+	}
+	const propertyDrivenReplacement = typeChanged || change.propertyChanges?.some((pc) => pc.requiresReplacement);
+	const recreateTargets = this.options.recreateTargets?.stackName === stackName ? this.options.recreateTargets : void 0;
+	const recreateViaCcApi = recreateTargets?.viaCcApi.has(logicalId) ?? false;
+	const recreateViaSdkProvider = recreateTargets?.viaSdkProvider.has(logicalId) ?? false;
+	const recreateFlagged = recreateViaCcApi || recreateViaSdkProvider;
+	const needsReplacement = propertyDrivenReplacement || recreateFlagged || lostWithParent !== void 0;
+	if (propertyDrivenReplacement && !typeChanged && !recreateFlagged && lostWithParent === void 0 && this.options.replace !== true && currentResource.provisionedBy !== "cc-api") {
+		const unwritten = unwrittenCreateOnlyReplacement(resourceType, currentProps, desiredForSkipCheck, allowedForRecord, createOnlyEvidence, (change.propertyChanges ?? []).filter((pc) => pc.requiresReplacement).map((pc) => pc.path));
+		if (unwritten.length > 0) throw markRefusedBeforeApplying(markNonRetryable(new CdkdError(unwrittenCreateOnlyRefusal({
+			logicalId,
+			resourceType,
+			unwritten,
+			routeDriving: findActionableSilentDrops(resourceType, desiredForSkipCheck, allowedForRecord, currentProps).map(({ property }) => property),
+			nested: this.options.parentStackInfo !== void 0,
+			protectionEvidence: recordedProtectionEvidence(resourceType, currentProps, currentResource.observedProperties, this.stackRegion)
+		}), "CREATE_ONLY_DROP_NEEDS_REPLACEMENT")));
+	}
+	const liveLabel = this.liveTaskLabels.get(logicalId);
+	if (needsReplacement && liveLabel !== void 0 && !liveLabel.replacing) {
+		const label = `Replacing ${logicalId} (${resourceType})${this.peekRoutingForLabel(change, currentResource, stackName, logicalId, true, this.recreateDirectionFor(stackName, logicalId)) === "cc-api" ? " [CC API]" : ""}`;
+		this.liveTaskLabels.set(logicalId, {
+			label,
+			replacing: true,
+			...liveLabel.warnSuffix !== void 0 && { warnSuffix: liveLabel.warnSuffix }
+		});
+		renderer.updateTaskLabel(logicalId, `${label}${liveLabel.warnSuffix ?? ""}`);
+	} else if (!needsReplacement && liveLabel !== void 0 && liveLabel.replacing) {
+		const label = `Updating ${logicalId} (${resourceType})${this.peekRoutingForLabel(change, currentResource, stackName, logicalId, false, this.recreateDirectionFor(stackName, logicalId)) === "cc-api" ? " [CC API]" : ""}`;
+		this.liveTaskLabels.set(logicalId, {
+			label,
+			replacing: false,
+			...liveLabel.warnSuffix !== void 0 && { warnSuffix: liveLabel.warnSuffix }
+		});
+		renderer.updateTaskLabel(logicalId, `${label}${liveLabel.warnSuffix ?? ""}`);
+	}
+	const dependencies = this.extractAllDependencies(template, logicalId);
+	const updateReplacePolicy = template?.Resources?.[logicalId]?.UpdateReplacePolicy;
+	const markRestored = (outcome) => {
+		if (lostChild === void 0) return outcome;
+		if (this.updatesThatSentNothing.has(logicalId)) {
+			this.logger.warn(survivesParent(resourceType) ? safeMsg`  ⚠ ${logicalId} lost its attachment to ${lostChild.parent}, which was re-created, but its update sent no change (it is recorded on Cloud Control, which patches record against template); it may no longer be attached to ${lostChild.parent}. Attach it there by hand.` : safeMsg`  ⚠ ${logicalId} went with ${lostChild.parent}, which was re-created, but its update sent no change (it is recorded on Cloud Control, which patches record against template); its policy may be missing from ${lostChild.parent}. Re-run with --recreate-via-sdk-provider ${logicalId} to write it again.`);
+			return outcome;
+		}
+		this.restoredLostChildren.add(logicalId);
+		return outcome;
+	};
+	if (needsReplacement) return markRestored(await this.updateByReplacement({
+		change,
+		counts,
+		currentProps,
+		currentResource,
+		dependencies,
+		logicalId,
+		oldResourceType,
+		progress,
+		propertyDrivenReplacement,
+		recreateFlagged,
+		recreateViaCcApi,
+		recreateViaSdkProvider,
+		renderer,
+		resolvedProps,
+		resourceType,
+		stackName,
+		stateResources,
+		template,
+		typeChanged,
+		updateReplacePolicy,
+		updateSecrets,
+		lostWithParent
+	}));
+	return markRestored(await this.updateInPlace({
+		conditions,
+		counts,
+		currentProps,
+		currentPropsAsWritten,
+		currentResource,
+		dependencies,
+		desiredForSkipCheckAsWritten,
+		logicalId,
+		noEchoHeldPaths,
+		parameterValues,
+		progress,
+		renderer,
+		resolvedProps,
+		resourceType,
+		stackName,
+		stateResources,
+		template,
+		updateReplacePolicy,
+		updateSecrets,
+		reattach: lostChild?.mode === "reattach"
+	}));
+}
+function unwrittenCreateOnlyRefusal(input) {
+	const { logicalId, resourceType, unwritten, routeDriving, nested, protectionEvidence } = input;
+	const one = unwritten.length === 1;
+	const list = unwritten.join(", ");
+	const keep = [.../* @__PURE__ */ new Set([...unwritten, ...routeDriving])].sort((a, b) => a.localeCompare(b)).map((property) => `${resourceType}:${property}`).join(",");
+	const replaceFlags = nested ? "--replace (which creates the new resource before deleting the old one, so a resource holding a unique value other than its name, such as a CIDR block, collides)" : `--recreate-via-cc-api ${logicalId}, which deletes the old resource first (--replace also works, but creates the new one first, so a resource holding a unique value other than its name, such as a CIDR block, collides)`;
+	const routed = [...routeDriving].sort((a, b) => a.localeCompare(b)).join(", ");
+	return `${logicalId} (${resourceType}): ${list} ${one ? "is" : "are"} create-only, and the state record holds ${one ? "it" : "them"} although this type's SDK provider never writes ${one ? "it" : "them"}, so AWS does not. This deploy routes the resource through Cloud Control (--prefer-sdk-route does not cover ${routed}), and applying a create-only property means replacing the resource, which cdkd does not do on its own. This resource was not changed. To replace it and apply ${list}, re-run with ${replaceFlags}; a stateful resource also needs --force-stateful-recreation.` + (protectionEvidence !== void 0 ? ` ${recordedProtectionNote(protectionEvidence, nested ? "--replace" : `--recreate-via-cc-api ${logicalId} or --replace`)}` : "") + ` To keep dropping ${one ? "it" : "them"}, re-run with --prefer-sdk-route ${keep}.`;
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/update-replace.ts
 async function updateByReplacement({ change, counts, currentProps, currentResource, dependencies, logicalId, oldResourceType, progress, propertyDrivenReplacement, recreateFlagged, recreateViaCcApi, recreateViaSdkProvider, renderer, resolvedProps, resourceType, stackName, stateResources, template, typeChanged, updateReplacePolicy, updateSecrets, lostWithParent }) {
@@ -32423,10 +32653,12 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 	}
 	this.registerNoEchoAttributes(logicalId, createResult, updateSecrets, resolvedProps);
 	if (equalIdIsSameResource && createResult.physicalId === currentResource.physicalId) this.recreatedUnderSameId.add(logicalId);
+	const recordedReplacementProperties = this.propertiesToRecord(resolvedProps, createResult, resourceType, replaceDecision.provisionedBy);
 	stateResources[logicalId] = {
 		physicalId: createResult.physicalId,
 		resourceType,
-		properties: this.propertiesToRecord(resolvedProps, createResult, resourceType, replaceDecision.provisionedBy),
+		properties: recordedReplacementProperties,
+		...acceptedCreateOnlyDropsField(recordedReplacementProperties, resourceType, replaceDecision.provisionedBy, "new-resource"),
 		...createResult.attributes && { attributes: createResult.attributes },
 		...dependencies && dependencies.length > 0 && { dependencies },
 		...this.extractTemplateAttributes(template, logicalId),
@@ -32633,17 +32865,20 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 		} else throw updateError;
 	}
 	if (result.wasReplaced) this.logger.info(`Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`);
-	const keepsParameterRefusal = !(result.wasReplaced === true && result.physicalId !== currentResource.physicalId) && hasUnverifiableParameterRefusal(currentResource);
+	const dischargedByReplacement = result.wasReplaced === true && result.physicalId !== currentResource.physicalId;
+	const keepsParameterRefusal = !dischargedByReplacement && hasUnverifiableParameterRefusal(currentResource);
 	const carriedAttributes = result.attributes ?? (result.wasReplaced ? void 0 : currentResource.attributes);
 	this.registerNoEchoAttributes(logicalId, {
 		...carriedAttributes && { attributes: carriedAttributes },
 		...result.noEchoAttributes === true && { noEchoAttributes: true },
 		...result.noEchoAttributeNames && { noEchoAttributeNames: result.noEchoAttributeNames }
 	}, updateSecrets, resolvedProps);
+	const recordedProperties = this.propertiesToRecord(resolvedProps, result, resourceType, resultProvisionedBy);
 	stateResources[logicalId] = {
 		physicalId: result.physicalId,
 		resourceType,
-		properties: this.propertiesToRecord(resolvedProps, result, resourceType, resultProvisionedBy),
+		properties: recordedProperties,
+		...acceptedCreateOnlyDropsField(recordedProperties, resourceType, resultProvisionedBy, dischargedByReplacement ? "new-resource" : "in-place", currentResource),
 		...carriedAttributes && { attributes: carriedAttributes },
 		...dependencies && dependencies.length > 0 && { dependencies },
 		...this.extractTemplateAttributes(template, logicalId),
@@ -32798,75 +33033,6 @@ async function withResourceDeadline(operation, opts) {
 	});
 }
 
-//#endregion
-//#region src/deployment/prior-attempt-scope.ts
-const priorAttemptStore = new AsyncLocalStorage();
-function withPriorAttempts(lookup, fn) {
-	return priorAttemptStore.run(lookup, fn);
-}
-function priorAttemptLookup(logicalId, attempts) {
-	let landed = false;
-	return {
-		logicalId,
-		attempts,
-		notePossiblyLanded: () => {
-			landed = true;
-		},
-		possiblyLanded: () => landed
-	};
-}
-function getPriorAttempts(logicalId) {
-	const bound = priorAttemptStore.getStore();
-	return bound?.logicalId === logicalId ? bound : void 0;
-}
-function priorAttemptsInJournal(journal, logicalId, resourceType) {
-	let bags = [];
-	for (const segment of journal?.segments ?? []) {
-		if (segment.operations.some((op) => op.logicalId === logicalId)) bags = [];
-		for (const op of segment.failedOperations ?? []) {
-			if (op.logicalId !== logicalId || op.resourceType !== resourceType) continue;
-			if (op.changeType === "DELETE" || !isBag(op.attemptedProperties)) continue;
-			if (recordedAsNewResource(op)) continue;
-			bags.push(op.attemptedProperties);
-		}
-		if (segment.supersededLogicalIds?.includes(logicalId)) bags = [];
-	}
-	return bags;
-}
-function recordedAsNewResource(op) {
-	if (typeof op.physicalId !== "string" || op.physicalId === "") return false;
-	if (op.changeType === "CREATE") return true;
-	const previous = op.previousState?.physicalId;
-	return typeof previous === "string" && previous !== op.physicalId;
-}
-function isBag(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-const REFUSED_BEFORE_APPLYING = Symbol.for("cdkd.refusedBeforeApplying");
-const MAX_CAUSE_DEPTH = 10;
-function markRefusedBeforeApplying(error) {
-	if (!Object.isExtensible(error)) return error;
-	Object.defineProperty(error, REFUSED_BEFORE_APPLYING, {
-		value: true,
-		enumerable: false,
-		configurable: true,
-		writable: false
-	});
-	return error;
-}
-function isRefusedBeforeApplying(error, logicalId) {
-	let current = error;
-	for (let depth = 0; depth < MAX_CAUSE_DEPTH && current != null; depth++) {
-		if (typeof current === "object" || typeof current === "function") {
-			const linkId = current.logicalId;
-			if (typeof linkId === "string" && linkId !== logicalId) return false;
-			if (current[REFUSED_BEFORE_APPLYING] === true) return true;
-		}
-		current = current.cause;
-	}
-	return false;
-}
-
 //#endregion
 //#region src/deployment/deploy-engine/provision.ts
 async function provisionResource(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
@@ -33245,14 +33411,17 @@ async function executeDeployment(template, currentState, changes, dag, execution
 				} catch (provisionError) {
 					this.interrupted = true;
 					this.interruptCause ??= "sibling-failure";
+					const refused = isRefusedBeforeApplying(provisionError, logicalId);
+					const physicalId = newResources[logicalId]?.physicalId ?? previousState?.physicalId;
+					if (refused && change.changeType === "CREATE" && physicalId === void 0) throw provisionError;
 					failedOperations.push({
 						logicalId,
 						changeType: change.changeType,
 						resourceType: change.resourceType,
 						provisionedBy: newResources[logicalId]?.provisionedBy ?? previousState?.provisionedBy,
 						...previousState && { previousState },
-						physicalId: newResources[logicalId]?.physicalId ?? previousState?.physicalId,
-						...!isRefusedBeforeApplying(provisionError, logicalId) && { attemptedProperties: this.attemptedResolvedProps.get(logicalId) }
+						physicalId,
+						...!refused && { attemptedProperties: this.attemptedResolvedProps.get(logicalId) }
 					});
 					throw provisionError;
 				}
@@ -33402,6 +33571,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			this.logger.warn(`Failed to save partial state before rollback: ${saveError instanceof Error ? saveError.message : String(saveError)}`);
 		}
 		let autoRollbackClean = false;
+		let autoRollbackJournaled = false;
 		let rollbackOrphans = [];
 		let rollbackSettledNested = /* @__PURE__ */ new Map();
 		if (error instanceof InterruptedError || isInterruptedWaitError(error) || this.interruptCause === "user") {
@@ -33414,9 +33584,16 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			this.logger.warn("Deployment failed. --no-rollback is set, skipping rollback.");
 			this.logger.warn(safeMsg`Partial state has been saved. ${this.recoveryHint("Run 'cdkd deploy' to resume, 'cdkd rollback' to revert, or destroy to clean up.")}`);
 		} else {
-			await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "auto-rollback-started", initialDeploy);
+			autoRollbackJournaled = await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "auto-rollback-started", initialDeploy);
 			const rollbackResult = await this.performRollback(completedOperations, newResources, stackName, currentState);
-			autoRollbackClean = rollbackResult.failures === 0;
+			autoRollbackClean = autoRollbackJournaled && rollbackResult.failures === 0 && rollbackResult.skipped === 0;
+			if (rollbackResult.failures === 0 && rollbackResult.skipped > 0) {
+				this.logger.warn(safeMsg`The automatic rollback could not revert ${rollbackResult.skipped} operation(s) ` + `(see the warnings above; each is recorded as a ROLLBACK_RESOURCE_SKIPPED event).` + (autoRollbackJournaled ? ` The rollback journal keeps them.` : ""));
+				if (autoRollbackJournaled && this.options.parentStackInfo === void 0 && failedOperations.some((op) => op.changeType !== "DELETE")) this.logger.warn(safeMsg`The record of the operation that failed is kept too. Revert it with: ${pasteableCommand("cdkd rollback", [{
+					value: stackName,
+					hole: "stack"
+				}, { literal: "--revert-failed" }]).command}`);
+			}
 			rollbackOrphans = rollbackResult.orphaned;
 			rollbackSettledNested = rollbackResult.settledNested;
 		}
@@ -34218,37 +34395,6 @@ function preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) {
 	return applyDefaultNameForFallback(logicalId, resourceType, resolvedProps);
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/record-shape.ts
-function auditResolvedAssetReferences(logicalId, resourceType, resolvedProps) {
-	const redirect = this.options.assetRedirect;
-	if (!redirect) return;
-	const findings = findUnrewrittenAssetReferences(resolvedProps, redirect);
-	if (findings.length === 0) return;
-	const detail = findings.map((f) => `  - ${f.path}: still references '${f.source}'`).join("\n");
-	throw new ProvisioningError(`Unrewritten asset reference on '${logicalId}' (${resourceType}): this region uses cdkd-owned asset storage, but the following resolved properties still point at the CDK bootstrap storage that 'cdk gc' may garbage-collect:\n${detail}\nThis is a template shape cdkd's asset-reference rewrite did not cover — deploying it would split-brain the stack (assets in cdkd storage, properties reading the CDK bucket). Please report this at https://github.com/go-to-k/cdkd/issues with the property shape. Workaround: deploy with --use-cdk-bootstrap-assets to pin the legacy destinations for this app.`, resourceType, logicalId);
-}
-function extractAllDependencies(template, logicalId) {
-	const resource = template?.Resources?.[logicalId];
-	if (!resource) return void 0;
-	const parser = new TemplateParser();
-	const parameterNames = new Set(Object.keys(template?.Parameters ?? {}));
-	const deps = [...parser.extractDependencies(resource)].filter((dep) => !parameterNames.has(dep));
-	return deps.length > 0 ? deps : void 0;
-}
-function propertiesToRecord(desiredProperties, result, resourceType, provisionedBy) {
-	if (result.effectiveProperties) return provisionedBy === "sdk" ? withoutSilentDropProperties(resourceType, result.effectiveProperties) : result.effectiveProperties;
-	const written = provisionedBy === "sdk" ? withoutSilentDropProperties(resourceType, desiredProperties) : desiredProperties;
-	return markSameGenerationBag(written);
-}
-function extractTemplateAttributes(template, logicalId) {
-	const resource = template?.Resources?.[logicalId];
-	return {
-		deletionPolicy: resource?.DeletionPolicy,
-		updateReplacePolicy: resource?.UpdateReplacePolicy
-	};
-}
-
 //#endregion
 //#region src/analyzer/implicit-delete-deps.ts
 const IMPLICIT_DELETE_DEPENDENCIES = {
@@ -34679,5 +34825,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { nestedChildStackName as $, shouldRetainResource as $a, markAuxiliaryFailure as $i, isUnboundTemplateParameter as $n, ssmResolvedValueType as $o, refuseMalformedOutputsForDestroy as $r, DBPROXY_TAGS_WHAT as $t, deleteTableWithIndexBusyRetry as A, carriesSecretMask as Aa, MULTI_REGION_RECREATE_BLOCKED_TYPES as Ai, DiffCalculator as An, partitionSensitiveEnv as Ao, malformedLocalResourcesWarning as Ar, extractDeploymentEventError as At, gray as B, isLockInfoExpired as Ba, coerceCfnInteger as Bi, isIamRoleArn as Bn, Synthesizer as Bo, malformedResourcePropertiesWarning as Br, collectDeclaredOutputNames as Bt, beginDeleteWait as C, scrubResourceRecord as Ca, findActionableSilentDrops as Ci, markWaitAbandoned as Cn, describeDockerFailure as Co, isReadableOrphanRecord as Cr, resolveAssemblyPath as Cs, isFinalSnapshotError as Ct, resolveDynamoDbDeleteBudgetMs as D, isUncertifiedBaselineMaskPosition as Da, hasNoCloudControlHandlers as Di, observeThenDisableInstanceApiTermination as Dn, getDockerCmd as Do, malformedExportSourceWarning as Dr, updatePartialReason as Dt, resolveDynamoDbDeleteBudgetClock as E, dynamicReferenceTokens as Ea, NO_CC_HANDLERS_REASON as Ei, isTerminationProtectionPropagationError as En, formatDockerLoginError as Eo, malformedExportNamesWarning as Er, updatePartialMessage as Et, isTruthyCfnBoolean as F, STATE_SOURCED_READBACK_RULES as Fa, coerceWarmThroughput as Fi, regionLessSecretName as Fn, warnFinchArgvExposure as Fo, malformedOrphansWarning as Fr, secretBearingStateKeyWarning as Ft, namesAnyDeclaredParameter as G, hasReadableExportSet as Ga, replayWarn as Gi, envCredentialsAreAssumedRole as Gn, resolveAutoAssetStorage as Go, refuseDivergentRecordRegionForDestroy as Gr, DEFAULT_RESOURCE_WARN_AFTER_MS as Gt, red as H, rebuildClientForBucketRegion as Ha, configIntegerRefusal as Hi, AWS_CREDENTIAL_ENV_KEYS as Hn, getDefaultStateBucketName as Ho, malformedScrubResourceEntriesRefusalMessage as Hr, isExportAliasCollision as Ht, formatResourceLine as I, TEMPLATE_SOURCED_RULES as Ia, isWarmThroughputDecrease as Ii, applyRoleArnIfSet as In, escapeRegExp$2 as Io, malformedOutputsRefusalMessage as Ir, secretSafeKeyDisplay as It, makeSiblingClaimReader as J, importableOutputKeys as Ja, requireConfigString as Ji, s3BucketDomainName as Jn, resolveStateBucketWithDefault as Jo, refuseMalformedOrphanRecordsForDestroy as Jr, earliestDefined as Jt, reachableDivergentParameters as K, hasReasonlessBaselineRefusal as Ka, requireConfigArray as Ki, isSettledInstanceState as Kn, resolveCaptureObservedState as Ko, refuseMalformedNestedChildOutputs as Kr, maskingRetryLogger as Kt, createReadOnlyAttributeHealerFactory as L, WHOLE_DYNAMIC_REFERENCE_PATTERN as La, toCfnInteger as Li, assertFlagRoleArn as Ln, stripControlChars as Lo, malformedOutputsWarning as Lr, exportNameSecretExposure as Lt, ECR_AUTO_DELETE_IMAGES_TAG as M, recordMaskOnlyValuesIn as Ma, isStatefulRecreateTargetSync as Mi, IntrinsicFunctionResolver as Mn, redactedDockerCause as Mo, malformedOrphanRecordsWarning as Mr, displayTextOrWithheld as Mt, S3_AUTO_DELETE_OBJECTS_TAG as N, STATE_SOURCED_BASELINE_RULES as Na, renderStatefulReason as Ni, classifyReplaySecretRegion as Nn, runDockerForeground as No, malformedOrphanRowsKeptWarning as Nr, exportAliasCollisionScrubWarning as Nt, DELETE_INDEX_WAIT_PROCEED_NOTE as O, pathCrossesDottedKey as Oa, findReplacedReadersOfRecreateTargets as Oi, reDisableInstanceApiTermination as On, isDockerClientEnvKey as Oo, malformedLocalOutputsWarning as Or, DeploymentEventsReader as Ot, hasCdkAutoDeleteTag as P, STATE_SOURCED_CROSS_GENERATION_RULES as Pa, WARM_THROUGHPUT_MEMBERS as Pi, producerRegionsFromState as Pn, runDockerStreaming as Po, malformedOrphansRefusalMessage as Pr, secretBearing as Pt, getNestedRevertRun as Q, orphansCarriedFrom as Qa, withRetry as Qi, coerceParameterTypedValue as Qn, warnDeprecatedNoPrefixCliFlag as Qo, refuseMalformedOutputs as Qr, acquireIdempotencyToken as Qt, bold as R, isSingleDynamicReferenceToken as Ra, toFiniteNumber as Ri, assertSendableRoleArn as Rn, AssetManifestLoader as Ro, malformedRenderedContainersWarning as Rr, isWholeDynamicReferenceValue as Rt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as S, redactSecretsForState as Sa, unreadableResourceEntries as Si, isWaitAbandonedError as Sn, describeDockerExecFailure as So, hasReadableResources as Sr, renderAssemblyPathEscape as Ss, effectiveDeletionPolicy as St, deleteBudgetKey as T, DYNAMIC_REFERENCE_TOKEN_SCAN as Ta, withoutSilentDropProperties as Ti, ec2InstanceProtectionSite as Tn, finchSecretArgvRefusal as To, malformedDriftResourcePropertiesWarning as Tr, resolveBucketRegion as Ts, unsupportedFinalSnapshotError as Tt, yellow as U, describeRegionValueKind as Ua, configStringRefusal as Ui, applyCallerIdentityCredentials as Un, getLegacyStateBucketName as Uo, malformedStateRefusalMessage as Ur, bindingSkippedOutputs as Ut, green as V, S3StateBackend as Va, configBooleanRefusal as Vi, sendableAssumeRoleCommand as Vn, synthesisStatusMessage as Vo, malformedResourcesWarning as Vr, collectPublishedOutputNames as Vt, computeParameterTaint as W, exportNamesCarriedFrom as Wa, readConfigString as Wi, callerEnvCredentials as Wn, resolveApp as Wo, previewableOrphanRecords as Wr, DEFAULT_RESOURCE_TIMEOUT_MS as Wt, NESTED_PENDING_PARENT_REASON as X, isReadableBag as Xa, templateResourceTypes as Xi, s3BucketRegionalDomainName as Xn, resolveUseCdkBootstrapAssets as Xo, refuseMalformedOrphansForDestroy as Xr, reserveStackCreateToken as Xt, planOrphanAdoption as Y, importableOutputs as Ya, prefetchCreateOnlyPropertyPaths as Yi, s3BucketDualStackDomainName as Yn, resolveStateBucketWithDefaultAndSource as Yo, refuseMalformedOrphans as Yr, ledgerForStack as Yt, dropSettledNestedJournals as Z, orphansAfterRollback as Za, describeTypeWithThrottleRetry as Zi, s3BucketWebsiteUrl as Zn, stateBucketExistenceConfirmed as Zo, refuseMalformedOrphansForOrphan as Zr, withCreateTokenLedger as Zt, PROTECTION_PROPERTY_BY_TYPE as _, createSecretMasker as _a, repairMalformedResourceEntriesForReadOnly as _i, unchangedBehindSecretReference as _n, validateContainerRepoName as _o, UNREADABLE_RESOURCES_MAP_ROW as _r, nullPrototypeRecord as _s, ATOMIC_FINAL_SNAPSHOT_TYPES as _t, conditionInputsFrom as a, liveMatchesUnresolvedTokenFrame as aa, refuseMalformedResourceEntriesForImportSave as ai, tagPlanWarning as an, createAssetRedirectResolver as ao, isNamelessDynamicReferenceError as ar, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as as, replayFailedOperations as at, readProtection as b, maskSecretsInText as ba, unpreviewableOrphanRecords as bi, deleteSkipReason as bn, resolveDockerContextDirectory as bo, hasReadableOrphans as br, describeFileReadFailure as bs, ccRoutedFinalSnapshotError as bt, isSecretBearingReferenceString as c, carryLogOnlyValues as ca, refuseMalformedResourcePropertiesForExport as ci, CC_BROKEN_REASON as cn, AssetModeResolver as co, cfnRefValueFromPhysicalId as cr, PARTITION_TABLE as cs, destroyStackRecordsView as ct, makeCanonicalizePropertiesFn as d, literalSplitDelimitersOf as da, refuseMalformedResourcesForDestroy as di, wouldReturnToSdkProvider as dn, ensureAssetStorage as do, parseWebACLArn as dr, AssemblyReader as ds, planFailedOps as dt, canonicalLambdaFunctionName as ea, refuseMalformedResourceAttributesForOrphan as ei, DBPROXY_TAG_OPTIONS as en, AssetPublisher as eo, parameterTypeMayLoseSecretIdentity as er, CFN_TEMPLATE_BODY_LIMIT as es, revertNestedChildFromJournal as et, getPriorAttempts as f, logOnlyValueCount as fa, refuseMalformedResourcesForExport as fi, isCustomResourceType as fn, getBootstrapMarkerKey as fo, withSharedDrainBudget as fr, StageLoadError as fs, planRollback as ft, recordedProtectionNote as g, shareLogOnlyValues as ga, repairMalformedOutputsForReadOnly as gi, ccProtectionRegistryTypes as gn, validateAssetBucketName as go, UNREADABLE_ORPHANS_CONTAINER_ROW as gr, hasPlainPrototype$1 as gs, inheritProducerRegions as gt, recordedProtectionEvidence as h, recordLogOnlyValue as ha, repairMalformedOrphansForReadOnly as hi, slowCcOperationTimeoutMs as hn, readBootstrapMarkerBody as ho, STATE_RESOURCES_MALFORMED as hr, hasOwnKey as hs, getCurrentProducerRegions as ht, conditionFingerprint as i, TemplateParser as ia, refuseMalformedResourceEntriesForImport as ii, tagMapAsList as in, buildAssetRedirectMap as io, carriesFetchableDynamicReference as ir, uploadCfnTemplate as is, withNestedStackContext as it, waitForIndexesSettled as j, recordMaskOnlyValue as ja, isStatefulRecreateTargetForReplace as ji, INTRINSIC_KEYS as jn, redactDockerArgvValues as jo, malformedOrphanRecordsRefusalMessage as jr, WITHHELD_NAME_DISPLAY as jt, INDEX_SETTLE_POLL_INTERVAL_MS as k, identityKeyFor as ka, shownType as ki, reEnableInstanceApiTermination as kn, isMalformedEnvKey as ko, malformedLocalResourceEntriesWarning as kr, DeploymentEventsStore as kt, keptWholeReasonText as l, createUnionSecretMasker as la, refuseMalformedResourcePropertiesForOrphan as li, ProviderRegistry as ln, BOOTSTRAP_MARKER_PREFIX as lo, isStalePlaceholderArnAttribute as lr, canonicalizeRegion as ls, getStackRecords as lt, withResourceDeadline as m, recordLogOnlyParameterValue as ma, repairMalformedOrphanRecordsForReadOnly as mi, CloudControlProvider as mn, parseBootstrapMarker as mo, STATE_REGION_DIVERGED as mr, defineOwnKey as ms, findNestedStackTypeChanges as mt, IMPLICIT_DELETE_DEPENDENCIES as n, sameLambdaFunctionAddress as na, refuseMalformedResourceEntriesForDeploy as ni, readTagList as nn, stringifyValue as no, isImpossibleEmptyStoredAttribute as nr, MIGRATE_TMP_PREFIX as ns, withNestedRevertRun as nt, parentSuppliedValues as o, inheritNestedStackParameterAssociations as oa, refuseMalformedResourceEntriesForOrphan as oi, definedAttributes as on, loadPublishableAssetManifest as oo, keepsSecretReferenceToken as or, decodeListingKey as os, replayRollback as ot, markRefusedBeforeApplying as p, printingCorpusOf as pa, refuseMalformedState as pi, getCurrentResourceSecrets as pn, isCrossRegionRedirect as po, JSON_LISTING_HOLE_VALUE as pr, processStackMessages as ps, resolveReplacementOldType as pt, resourcesNamingDeclaredParameter as q, hasUnverifiableParameterRefusal as qa, requireConfigObject as qi, s3BucketArn as qn, resolveSkipPrefix as qo, refuseMalformedOrphanRecords as qr, RollbackInlinePolicyWriters as qt, computeImplicitDeleteEdges as r, DagBuilder as ra, refuseMalformedResourceEntriesForDestroy as ri, refuseMalformedDesiredTags as rn, WorkGraph as ro, carriesDynamicReference as rr, findLargeInlineResources as rs, getCurrentNestedStackContext as rt, readRecordedConditionVerdicts as s, recordNestedStackParameterExpressions as sa, refuseMalformedResourcePropertiesForDrift as si, stringifyIfAssigned as sn, rewriteTemplateAssetReferences as so, AWS_NO_VALUE as sr, expectedOwnerParam as ss, awaitInFlightSibling as st, DeployEngine as t, lambdaFunctionNameForMask as ta, refuseMalformedResourceEntries as ti, planTagDiff as tn, isSensitiveAttributeName as to, getAccountInfo as tr, CFN_TEMPLATE_URL_LIMIT as ts, revertedNestedRowIds as tt, mergeNoChangeOutputs as u, hasMaskableValues as ua, refuseMalformedResourcesForDeploy as ui, ccBrokenReason as un, assertAssetBucketRegion as uo, refStateLookupFromResource as ur, derivePartitionAndUrlSuffix as us, withStackRecords as ut, isProtectionValueActive as v, errorCauseChain as va, repairMalformedResourcePropertiesForReadOnly as vi, UNSPECIFIED_SKIP_REASON as vn, buildDenyExternalAccessPolicy as vo, deployRefusesOrphanRowsReason as vr, ownValue as vs, PRE_DELETE_SNAPSHOT_TYPES as vt, compensateRemovedDeletionProtection as w, recoverMaskedOutput as wa, findSilentDropProperties as wi, disableInstanceApiTermination as wn, dockerSpawnEnvWithSensitive as wo, isReadableResourceEntry as wr, clearBucketRegionCache as ws, refusesFinalSnapshot as wt, DynamoDBGlobalTableProvider as x, markSameGenerationBag as xa, unreadableOrphanRecords as xi, withIndeterminateGuard as xn, describeDockerCapturedOutput as xo, hasReadableOutputs as xr, displayAssemblyPath as xs, createPreDeleteFinalSnapshot as xt, perType as y, maskSecretsInError as ya, repairMalformedResourcesForReadOnly as yi, deleteIndeterminateGuards as yn, buildDockerImage as yo, displayLogicalId as yr, absoluteAssemblyPathEscape as ys, buildFinalSnapshotIdentifier as yt, cyan as z, LockManager as za, coerceCfnBoolean as zi, explicitRoleArnOrThrow as zn, getDockerImageBySourceHash as zo, malformedResourceEntriesWarning as zr, noEchoParameterValueSeed as zt };
-//# sourceMappingURL=deploy-engine-C5kAhscq.js.map
+export { nestedChildStackName as $, importableOutputs as $a, describeTypeWithThrottleRetry as $i, coerceParameterTypedValue as $n, resolveStateBucketWithDefaultAndSource as $o, refuseMalformedOutputs as $r, acquireIdempotencyToken as $t, ECR_AUTO_DELETE_IMAGES_TAG as A, pathCrossesDottedKey as Aa, findReplacedReadersOfRecreateTargets as Ai, reEnableInstanceApiTermination as An, formatDockerLoginError as Ao, malformedLocalResourceEntriesWarning as Ar, DeploymentEventsStore as At, gray as B, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ba, toFiniteNumber as Bi, explicitRoleArnOrThrow as Bn, escapeRegExp$2 as Bo, malformedResourceEntriesWarning as Br, noEchoParameterValueSeed as Bt, deleteBudgetKey as C, markSameGenerationBag as Ca, unreadableResourceEntries as Ci, isWaitAbandonedError as Cn, buildDockerImage as Co, hasReadableResources as Cr, absoluteAssemblyPathEscape as Cs, effectiveDeletionPolicy as Ct, INDEX_SETTLE_POLL_INTERVAL_MS as D, DYNAMIC_REFERENCE_TOKEN_SCAN as Da, withoutSilentDropProperties as Di, isTerminationProtectionPropagationError as Dn, describeDockerFailure as Do, malformedExportNamesWarning as Dr, resolveAssemblyPath as Ds, updatePartialMessage as Dt, DELETE_INDEX_WAIT_PROCEED_NOTE as E, recoverMaskedOutput as Ea, unwrittenCreateOnlyReplacement as Ei, ec2InstanceProtectionSite as En, describeDockerExecFailure as Eo, malformedDriftResourcePropertiesWarning as Er, renderAssemblyPathEscape as Es, unsupportedFinalSnapshotError as Et, markRefusedBeforeApplying as F, recordNoEchoAttributeValues as Fa, renderStatefulReason as Fi, producerRegionsFromState as Fn, redactDockerArgvValues as Fo, malformedOrphansRefusalMessage as Fr, secretBearing as Ft, namesAnyDeclaredParameter as G, rebuildClientForBucketRegion as Ga, configStringRefusal as Gi, callerEnvCredentials as Gn, synthesisStatusMessage as Go, previewableOrphanRecords as Gr, DEFAULT_RESOURCE_TIMEOUT_MS as Gt, red as H, LockManager as Ha, coerceCfnInteger as Hi, sendableAssumeRoleCommand as Hn, AssetManifestLoader as Ho, malformedResourcesWarning as Hr, collectPublishedOutputNames as Ht, formatResourceLine as I, STATE_SOURCED_BASELINE_RULES as Ia, WARM_THROUGHPUT_MEMBERS as Ii, regionLessSecretName as In, redactedDockerCause as Io, malformedOrphansWarning as Ir, secretBearingStateKeyWarning as It, makeSiblingClaimReader as J, exportNamesCarriedFrom as Ja, requireConfigArray as Ji, s3BucketArn as Jn, resolveApp as Jo, refuseMalformedOrphanRecords as Jr, RollbackInlinePolicyWriters as Jt, reachableDivergentParameters as K, acceptedCreateOnlyDropsOf as Ka, readConfigString as Ki, envCredentialsAreAssumedRole as Kn, getDefaultStateBucketName as Ko, refuseDivergentRecordRegionForDestroy as Kr, DEFAULT_RESOURCE_WARN_AFTER_MS as Kt, createReadOnlyAttributeHealerFactory as L, STATE_SOURCED_CROSS_GENERATION_RULES as La, coerceWarmThroughput as Li, applyRoleArnIfSet as Ln, runDockerForeground as Lo, malformedOutputsRefusalMessage as Lr, secretSafeKeyDisplay as Lt, hasCdkAutoDeleteTag as M, carriesSecretMask as Ma, MULTI_REGION_RECREATE_BLOCKED_TYPES as Mi, INTRINSIC_KEYS as Mn, isDockerClientEnvKey as Mo, malformedOrphanRecordsRefusalMessage as Mr, WITHHELD_NAME_DISPLAY as Mt, isTruthyCfnBoolean as N, recordMaskOnlyValue as Na, isStatefulRecreateTargetForReplace as Ni, IntrinsicFunctionResolver as Nn, isMalformedEnvKey as No, malformedOrphanRecordsWarning as Nr, displayTextOrWithheld as Nt, deleteTableWithIndexBusyRetry as O, dynamicReferenceTokens as Oa, NO_CC_HANDLERS_REASON as Oi, observeThenDisableInstanceApiTermination as On, dockerSpawnEnvWithSensitive as Oo, malformedExportSourceWarning as Or, clearBucketRegionCache as Os, updatePartialReason as Ot, getPriorAttempts as P, recordMaskOnlyValuesIn as Pa, isStatefulRecreateTargetSync as Pi, classifyReplaySecretRegion as Pn, partitionSensitiveEnv as Po, malformedOrphanRowsKeptWarning as Pr, exportAliasCollisionScrubWarning as Pt, getNestedRevertRun as Q, importableOutputKeys as Qa, templateResourceTypes as Qi, s3BucketWebsiteUrl as Qn, resolveStateBucketWithDefault as Qo, refuseMalformedOrphansForOrphan as Qr, withCreateTokenLedger as Qt, bold as R, STATE_SOURCED_READBACK_RULES as Ra, isWarmThroughputDecrease as Ri, assertFlagRoleArn as Rn, runDockerStreaming as Ro, malformedOutputsWarning as Rr, exportNameSecretExposure as Rt, compensateRemovedDeletionProtection as S, maskSecretsInText as Sa, unreadableOrphanRecords as Si, withIndeterminateGuard as Sn, buildDenyExternalAccessPolicy as So, hasReadableOutputs as Sr, ownValue as Ss, createPreDeleteFinalSnapshot as St, resolveDynamoDbDeleteBudgetMs as T, scrubResourceRecord as Ta, findSilentDropProperties as Ti, disableInstanceApiTermination as Tn, describeDockerCapturedOutput as To, isReadableResourceEntry as Tr, displayAssemblyPath as Ts, refusesFinalSnapshot as Tt, yellow as U, isLockInfoExpired as Ua, configBooleanRefusal as Ui, AWS_CREDENTIAL_ENV_KEYS as Un, getDockerImageBySourceHash as Uo, malformedScrubResourceEntriesRefusalMessage as Ur, isExportAliasCollision as Ut, green as V, isSingleDynamicReferenceToken as Va, coerceCfnBoolean as Vi, isIamRoleArn as Vn, stripControlChars as Vo, malformedResourcePropertiesWarning as Vr, collectDeclaredOutputNames as Vt, computeParameterTaint as W, S3StateBackend as Wa, configIntegerRefusal as Wi, applyCallerIdentityCredentials as Wn, Synthesizer as Wo, malformedStateRefusalMessage as Wr, bindingSkippedOutputs as Wt, NESTED_PENDING_PARENT_REASON as X, hasReasonlessBaselineRefusal as Xa, requireConfigString as Xi, s3BucketDualStackDomainName as Xn, resolveCaptureObservedState as Xo, refuseMalformedOrphans as Xr, ledgerForStack as Xt, planOrphanAdoption as Y, hasReadableExportSet as Ya, requireConfigObject as Yi, s3BucketDomainName as Yn, resolveAutoAssetStorage as Yo, refuseMalformedOrphanRecordsForDestroy as Yr, earliestDefined as Yt, dropSettledNestedJournals as Z, hasUnverifiableParameterRefusal as Za, prefetchCreateOnlyPropertyPaths as Zi, s3BucketRegionalDomainName as Zn, resolveSkipPrefix as Zo, refuseMalformedOrphansForDestroy as Zr, reserveStackCreateToken as Zt, perType as _, recordLogOnlyValue as _a, repairMalformedOutputsForReadOnly as _i, ccProtectionRegistryTypes as _n, isCrossRegionRedirect as _o, UNREADABLE_ORPHANS_CONTAINER_ROW as _r, processStackMessages as _s, inheritProducerRegions as _t, conditionInputsFrom as a, DagBuilder as aa, refuseMalformedResourceEntriesForImport as ai, tagMapAsList as an, isSensitiveAttributeName as ao, carriesFetchableDynamicReference as ar, CFN_TEMPLATE_URL_LIMIT as as, replayFailedOperations as at, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as b, errorCauseChain as ba, repairMalformedResourcesForReadOnly as bi, deleteIndeterminateGuards as bn, validateAssetBucketName as bo, displayLogicalId as br, hasPlainPrototype$1 as bs, buildFinalSnapshotIdentifier as bt, isSecretBearingReferenceString as c, inheritNestedStackParameterAssociations as ca, refuseMalformedResourcePropertiesForDrift as ci, stringifyIfAssigned as cn, buildAssetRedirectMap as co, AWS_NO_VALUE as cr, uploadCfnTemplate as cs, destroyStackRecordsView as ct, makeCanonicalizePropertiesFn as d, createUnionSecretMasker as da, refuseMalformedResourcesForDeploy as di, ccBrokenReason as dn, rewriteTemplateAssetReferences as do, refStateLookupFromResource as dr, expectedOwnerParam as ds, recordAfterRollbackUpdate as dt, withRetry as ea, refuseMalformedOutputsForDestroy as ei, DBPROXY_TAGS_WHAT as en, isReadableBag as eo, isUnboundTemplateParameter as er, resolveUseCdkBootstrapAssets as es, revertNestedChildFromJournal as et, withResourceDeadline as f, hasMaskableValues as fa, refuseMalformedResourcesForDestroy as fi, wouldReturnToSdkProvider as fn, AssetModeResolver as fo, parseWebACLArn as fr, PARTITION_TABLE as fs, planFailedOps as ft, isProtectionValueActive as g, recordLogOnlyParameterValue as ga, repairMalformedOrphansForReadOnly as gi, slowCcOperationTimeoutMs as gn, getBootstrapMarkerKey as go, STATE_RESOURCES_MALFORMED as gr, StageLoadError as gs, getCurrentProducerRegions as gt, PROTECTION_PROPERTY_BY_TYPE as h, printingCorpusOf as ha, repairMalformedOrphanRecordsForReadOnly as hi, CloudControlProvider as hn, ensureAssetStorage as ho, STATE_REGION_DIVERGED as hr, AssemblyReader as hs, findNestedStackTypeChanges as ht, conditionFingerprint as i, sameLambdaFunctionAddress as ia, refuseMalformedResourceEntriesForDestroy as ii, refuseMalformedDesiredTags as in, AssetPublisher as io, carriesDynamicReference as ir, CFN_TEMPLATE_BODY_LIMIT as is, withNestedStackContext as it, S3_AUTO_DELETE_OBJECTS_TAG as j, identityKeyFor as ja, shownType as ji, DiffCalculator as jn, getDockerCmd as jo, malformedLocalResourcesWarning as jr, extractDeploymentEventError as jt, waitForIndexesSettled as k, isUncertifiedBaselineMaskPosition as ka, hasNoCloudControlHandlers as ki, reDisableInstanceApiTermination as kn, finchSecretArgvRefusal as ko, malformedLocalOutputsWarning as kr, resolveBucketRegion as ks, DeploymentEventsReader as kt, keptWholeReasonText as l, recordNestedStackParameterExpressions as la, refuseMalformedResourcePropertiesForExport as li, CC_BROKEN_REASON as ln, createAssetRedirectResolver as lo, cfnRefValueFromPhysicalId as lr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ls, getStackRecords as lt, recordedProtectionNote as m, logOnlyValueCount as ma, refuseMalformedState as mi, getCurrentResourceSecrets as mn, assertAssetBucketRegion as mo, JSON_LISTING_HOLE_VALUE as mr, derivePartitionAndUrlSuffix as ms, resolveReplacementOldType as mt, IMPLICIT_DELETE_DEPENDENCIES as n, canonicalLambdaFunctionName as na, refuseMalformedResourceEntries as ni, planTagDiff as nn, orphansCarriedFrom as no, getAccountInfo as nr, warnDeprecatedNoPrefixCliFlag as ns, withNestedRevertRun as nt, parentSuppliedValues as o, TemplateParser as oa, refuseMalformedResourceEntriesForImportSave as oi, tagPlanWarning as on, stringifyValue as oo, isNamelessDynamicReferenceError as or, MIGRATE_TMP_PREFIX as os, replayRollback as ot, recordedProtectionEvidence as p, literalSplitDelimitersOf as pa, refuseMalformedResourcesForExport as pi, isCustomResourceType as pn, BOOTSTRAP_MARKER_PREFIX as po, withSharedDrainBudget as pr, canonicalizeRegion as ps, planRollback as pt, resourcesNamingDeclaredParameter as q, describeRegionValueKind as qa, replayWarn as qi, isSettledInstanceState as qn, getLegacyStateBucketName as qo, refuseMalformedNestedChildOutputs as qr, maskingRetryLogger as qt, computeImplicitDeleteEdges as r, lambdaFunctionNameForMask as ra, refuseMalformedResourceEntriesForDeploy as ri, readTagList as rn, shouldRetainResource as ro, isImpossibleEmptyStoredAttribute as rr, ssmResolvedValueType as rs, getCurrentNestedStackContext as rt, readRecordedConditionVerdicts as s, liveMatchesUnresolvedTokenFrame as sa, refuseMalformedResourceEntriesForOrphan as si, definedAttributes as sn, WorkGraph as so, keepsSecretReferenceToken as sr, findLargeInlineResources as ss, awaitInFlightSibling as st, DeployEngine as t, markAuxiliaryFailure as ta, refuseMalformedResourceAttributesForOrphan as ti, DBPROXY_TAG_OPTIONS as tn, orphansAfterRollback as to, parameterTypeMayLoseSecretIdentity as tr, stateBucketExistenceConfirmed as ts, revertedNestedRowIds as tt, mergeNoChangeOutputs as u, carryLogOnlyValues as ua, refuseMalformedResourcePropertiesForOrphan as ui, ProviderRegistry as un, loadPublishableAssetManifest as uo, isStalePlaceholderArnAttribute as ur, decodeListingKey as us, withStackRecords as ut, readProtection as v, shareLogOnlyValues as va, repairMalformedResourceEntriesForReadOnly as vi, unchangedBehindSecretReference as vn, parseBootstrapMarker as vo, UNREADABLE_RESOURCES_MAP_ROW as vr, defineOwnKey as vs, ATOMIC_FINAL_SNAPSHOT_TYPES as vt, resolveDynamoDbDeleteBudgetClock as w, redactSecretsForState as wa, findActionableSilentDrops as wi, markWaitAbandoned as wn, resolveDockerContextDirectory as wo, isReadableOrphanRecord as wr, describeFileReadFailure as ws, isFinalSnapshotError as wt, beginDeleteWait as x, maskSecretsInError as xa, unpreviewableOrphanRecords as xi, deleteSkipReason as xn, validateContainerRepoName as xo, hasReadableOrphans as xr, nullPrototypeRecord as xs, ccRoutedFinalSnapshotError as xt, DynamoDBGlobalTableProvider as y, createSecretMasker as ya, repairMalformedResourcePropertiesForReadOnly as yi, UNSPECIFIED_SKIP_REASON as yn, readBootstrapMarkerBody as yo, deployRefusesOrphanRowsReason as yr, hasOwnKey as ys, PRE_DELETE_SNAPSHOT_TYPES as yt, cyan as z, TEMPLATE_SOURCED_RULES as za, toCfnInteger as zi, assertSendableRoleArn as zn, warnFinchArgvExposure as zo, malformedRenderedContainersWarning as zr, isWholeDynamicReferenceValue as zt };
+//# sourceMappingURL=deploy-engine-BTOCDCWf.js.map