@go-to-k/cdkd 0.294.9 → 0.294.10

package/dist/{deploy-engine-BTOCDCWf.js → deploy-engine-RCOtmm4V.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js"
 import { A as displaySafe, E as UNRENDERABLE, F as safeMsg, L as truncateCodePoints, M as isPasteableIdent, O as displayAwsMessage, P as plainIdentOr, S as withoutGeneratedFallbackName, T as STACK_REF_MAX_CODE_POINTS, _ as getCurrentSkipPrefix, b as withSkipPrefix, c as getLiveRenderer, f as applyDefaultNameForFallback, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, m as explicitNamePropertyFor, n as getLogger, r as isStdoutReservedForPayload, s as installLogLineMaskerSource, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS, x as withStackName, y as looksLikeCdkdGeneratedName } from "./logger-B46YMG0h.js";
 import { $t as StateError, A as isTerminalDeleteFailure, An as isAmbiguousCcHandlerErrorCode, At as clientDefaultsFor, Bn as isMarkedNonRetryable, Bt as IntrinsicResolutionRefusalError, C as refusalTypeShown, Cn as isNameCollisionErrorFrom, D as ProtectionFlipRegistry, Dt as withPasteableAwsProfile, En as isReplayedNameCollisionFrom, Fn as retryClassificationText, Gt as MalformedProducerRecordRefusalError, H as pasteableAwsCommand, Hn as markNonRetryable, In as describeAwsFailure, It as CrossAccountSecretRefusalError, J as isInterruptedWaitError, Jt as ProvisioningError, Lt as DependencyError, M as observeThenDisableProtection, Mn as isIamPropagationError, Mt as AccountIdUnavailableError, N as protectionFlipKey, Nn as isRetryableTransientError, Nt as AssetError, O as compensateProtectionFlip, On as markReplayMayCollide, Ot as ambientClientDefaults, Pn as isTransientServerError, Pt as CdkdError, Q as canonicalizeRoute53QueryName, R as DELETION_PROTECTION_DOC_POINTER, Rn as safeStringify$1, S as quotedRemedyLogicalId, Sn as hasReplayMayCollide, St as injectiveKey, T as resolveExplicitPhysicalId, Tn as isRecreateRetryableError, Tt as producerRecordKey, U as protectedReplacementAdvice, Un as markRedactedCause, Ut as LockError, Vn as isThrottlingError, Wn as wrapMaskedAwsError, Wt as MacroExpansionError, X as ElapsedBudgetRegistry, Xt as ResourceUpdateNotSupportedError, Y as startInterruptWatch, Yt as ResourceTimeoutError, Z as monotonicNowMs, _n as shellQuote, _t as formatLockOperation, at as segmentAfterAnchor, b as isQuotableImportValue, bt as CUSTOM_RESOURCE_RESPONSE_PREFIX, cn as UNSHOWABLE_VALUE, ct as isSecretDerivedValue, d as prepareRemovalForUpdate, dn as isInertUnquoted, dt as withDerivedNameMasks, en as SynthesisError, et as compositeIdSeparatorRefusal, f as removalWarning, fn as pasteableCommand, ft as UNREPRODUCIBLE_LOCK_CLAUSE, g as assertRegionMatch, gn as shellBoundedDisplay, gt as formatLockExpiry, h as RESOURCE_NOT_FOUND, hn as quotedOrDescribed, i as holdsSecretDerivedEntry, it as resourceTypeShown, jn as isAmbiguousOutcomeError, jt as credentialFingerprint, k as deleteWithProtectionCompensation, kn as formatRetryClassificationSignals, kt as ambientCredentialConfig, l as withUnchangedSecretPrincipalLists, ln as commandHole, lt as maskDeep, m as withoutInjectedRemovals, mn as plainOrDescribed, nt as logicalIdShown, on as SHELL_ACTIVE, ot as createMaskedLogSinks, pn as physicalIdShownBesideCommand, pt as buildForceUnlockCommand, rn as normalizeAwsError, sn as SHELL_ACTIVE_WHY, st as createMaskedRetryLogger, ut as maskerOrIdentity, vn as withheldTargetClause, vt as formatLockOwner, wn as isNameCooldownError, x as normalizeAwsTagsToCfn, xn as isUpdateUnsupportedError, xt as DEFAULT_STATE_PREFIX, yt as sanitizeRecoveryValue, zt as DynamicReferenceRegionAmbiguousError } from "./iam-policy-targets-CMSQGQnm.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-QrNvZCe0.js";
+import { t as getCdkdVersion } from "./version-BNo3JdVW.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -15683,6 +15683,120 @@ function malformedOrphansForOrphanRefusalMessage(rawStackName, rawRegion, logica
 	return orphanRefusal(stackName, region, recovery, `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read — ${namedOrphanRows(logicalIds)} — because the record has no string 'logicalId' or shares it with another row, or its 'state' is not an object, names no resource type, has no non-empty string 'physicalId', or holds a 'properties' or 'attributes' map that is not an object. The record is malformed or truncated. ${verbatim} Those records are not inert: they are what the next 'cdkd deploy' may re-adopt into 'resources' and what 'cdkd diff' previews for adoption, so continuing would report success over damage the next command meets.`, "'cdkd orphan' cannot remove such a record itself: it is not in 'resources', so it has no construct path. Repair the record by hand rather than deleting it — it is the only record that an earlier failed deploy left its resource live in AWS.", ORPHANS_DROP_CAVEAT);
 }
 
+//#endregion
+//#region src/deployment/masked-property-fingerprints.ts
+const FINGERPRINT_LAYOUT$1 = 1;
+function canonicalJson$2(value) {
+	if (value === void 0) return "null";
+	if (Array.isArray(value)) return `[${value.map(canonicalJson$2).join(",")}]`;
+	if (value !== null && typeof value === "object") {
+		const record = value;
+		return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson$2(record[key])}`).join(",")}}`;
+	}
+	return JSON.stringify(value) ?? "null";
+}
+const REFUSED_FINGERPRINT = "refused:secret-in-template";
+const FINGERPRINT_PREFIX = "sha256:";
+function templateCarriesNeedle(templateValue, secrets) {
+	const text = canonicalJson$2(templateValue);
+	for (const needle of printingCorpusOf(secrets).keys()) {
+		if (needle.length < 4) continue;
+		if (text.includes(needle) || text.includes(JSON.stringify(needle).slice(1, -1))) return true;
+	}
+	return false;
+}
+function maskedPropertyFingerprint(templateValue) {
+	const digest = createHash("sha256").update(canonicalJson$2({
+		layout: FINGERPRINT_LAYOUT$1,
+		value: templateValue
+	})).digest("hex");
+	return `${FINGERPRINT_PREFIX}${digest}`;
+}
+function maskedPropertyFingerprintsFor(recordedProperties, templateProps) {
+	const entries = [];
+	for (const key of Object.keys(recordedProperties)) {
+		if (!Object.hasOwn(templateProps, key)) continue;
+		if (!carriesSecretMask(recordedProperties[key])) continue;
+		entries.push([key, maskedPropertyFingerprint(templateProps[key])]);
+	}
+	return entries.length > 0 ? Object.fromEntries(entries) : void 0;
+}
+function maskedPropertyFingerprintsOf(record) {
+	const read = /* @__PURE__ */ new Map();
+	if (record === null || typeof record !== "object") return read;
+	const field = record.maskedPropertyFingerprints;
+	if (field === null || typeof field !== "object" || Array.isArray(field)) return read;
+	for (const [key, value] of Object.entries(field)) if (typeof value === "string" && value.startsWith(FINGERPRINT_PREFIX)) read.set(key, value);
+	return read;
+}
+function movedMaskedProperties(record, templateProps) {
+	const recorded = maskedPropertyFingerprintsOf(record);
+	if (recorded.size === 0) return [];
+	const properties = record.properties;
+	if (properties === null || typeof properties !== "object") return [];
+	const moved = [];
+	for (const [key, fingerprint] of recorded) {
+		if (!Object.hasOwn(templateProps, key) || !Object.hasOwn(properties, key)) continue;
+		if (!carriesSecretMask(properties[key])) continue;
+		if (maskedPropertyFingerprint(templateProps[key]) !== fingerprint) moved.push(key);
+	}
+	return moved;
+}
+const writtenFromDeployedTemplate = /* @__PURE__ */ new WeakSet();
+function markWrittenFromDeployedTemplate(bag) {
+	writtenFromDeployedTemplate.add(bag);
+	return bag;
+}
+function withMaskedPropertyFingerprints(scrubbed, writtenBag, templateProps, secrets, noEchoParameterValues) {
+	if (templateProps === void 0) return scrubbed;
+	const corpora = [secrets, noEchoParameterValues].filter((corpus) => corpus !== void 0);
+	const written = writtenBag !== null && typeof writtenBag === "object" && writtenFromDeployedTemplate.has(writtenBag);
+	const { maskedPropertyFingerprints: previous, ...rest } = scrubbed;
+	let fingerprints;
+	if (written) fingerprints = maskedPropertyFingerprintsFor(scrubbed.properties, templateProps);
+	else {
+		if (previous === void 0 || previous === null || typeof previous !== "object") return scrubbed;
+		if (corpora.length === 0) return scrubbed;
+		fingerprints = { ...previous };
+	}
+	if (fingerprints !== void 0 && corpora.length > 0) {
+		const refused = Object.keys(fingerprints).filter((key) => Object.hasOwn(templateProps, key) && corpora.some((corpus) => templateCarriesNeedle(templateProps[key], corpus)));
+		if (refused.length > 0) fingerprints = Object.fromEntries(Object.entries(fingerprints).map(([key, value]) => [key, refused.includes(key) ? REFUSED_FINGERPRINT : value]));
+	}
+	if (!written && JSON.stringify(fingerprints) === JSON.stringify(previous)) return scrubbed;
+	return fingerprints === void 0 ? rest : {
+		...rest,
+		maskedPropertyFingerprints: fingerprints
+	};
+}
+function backfillMaskedPropertyFingerprints(resources, template, noEchoParameterValues) {
+	const declared = template?.Resources;
+	if (declared === void 0 || declared === null) return 0;
+	let stamped = 0;
+	for (const [logicalId, record] of Object.entries(resources)) {
+		if (record === null || typeof record !== "object") continue;
+		const field = record.maskedPropertyFingerprints;
+		if (field !== void 0 && (field === null || typeof field !== "object" || Array.isArray(field))) continue;
+		const existing = field ?? {};
+		if (!Object.hasOwn(declared, logicalId)) continue;
+		const definition = declared[logicalId];
+		if (definition === void 0 || definition.Type !== record.resourceType) continue;
+		const properties = record.properties;
+		if (properties === null || typeof properties !== "object" || Array.isArray(properties)) continue;
+		const fingerprints = maskedPropertyFingerprintsFor(properties, definition.Properties ?? {});
+		if (fingerprints === void 0) continue;
+		const templateProps = definition.Properties ?? {};
+		const added = Object.entries(fingerprints).filter(([key]) => !Object.hasOwn(existing, key)).map(([key, value]) => noEchoParameterValues !== void 0 && templateCarriesNeedle(templateProps[key], noEchoParameterValues) ? [key, REFUSED_FINGERPRINT] : [key, value]);
+		if (added.length === 0) continue;
+		resources[logicalId] = {
+			...record,
+			maskedPropertyFingerprints: Object.fromEntries([...Object.entries(existing), ...added])
+		};
+		stamped++;
+	}
+	return stamped;
+}
+
 //#endregion
 //#region src/deployment/drain-budget.ts
 const drainDeadlines = new AsyncLocalStorage();
@@ -19473,6 +19587,22 @@ var DiffCalculator = class DiffCalculator {
 				if (droppedKeys.length > 0) this.logger.warn(`${logicalId} (${desiredResource.Type}): part of the declared properties cannot be sent as declared and is ignored when comparing against deployed state — the provider narrows them (${droppedKeys.join(", ")}). Fix the template to declare only what the resource supports; until then changes to the ignored keys have no effect.`);
 				else if (canonicalizeProperties && !this.valuesEqual(desiredPropsForCompare, desiredAfterDrops)) this.logger.debug(`${logicalId} (${desiredResource.Type}): the provider normalizes part of the declared properties before sending them; the comparison uses the normalized form. Nothing is dropped.`);
 				const propertyChanges = await this.compareProperties(desiredResource.Type, currentPropsForCompare, desiredPropsForCompare, maskForLog);
+				const reported = new Set(propertyChanges.map((pc) => pc.path));
+				for (const key of movedMaskedProperties(currentResource, rawDesiredProps)) {
+					if (reported.has(key)) continue;
+					if (!Object.hasOwn(currentPropsForCompare, key)) continue;
+					if (!Object.hasOwn(desiredPropsForCompare, key)) continue;
+					const oldValue = currentPropsForCompare[key];
+					const newValue = desiredPropsForCompare[key];
+					propertyChanges.push({
+						path: key,
+						oldValue,
+						newValue,
+						requiresReplacement: await this.maskedEditRequiresReplacement(desiredResource.Type, key, oldValue, newValue),
+						maskedExpressionChanged: true
+					});
+					this.logger.debug(safeMsg`${logicalId}: ${key} is recorded masked and its template expression changed (go-to-k/cdkd#4451)`);
+				}
 				const attributeChanges = this.compareAttributes(currentResource, desiredResource);
 				if (propertyChanges.length > 0 || attributeChanges.length > 0) {
 					changes.set(logicalId, {
@@ -19839,6 +19969,11 @@ var DiffCalculator = class DiffCalculator {
 		}
 		return changes;
 	}
+	async maskedEditRequiresReplacement(resourceType, key, oldValue, newValue) {
+		if (this.replacementRules.requiresReplacement(resourceType, key, oldValue, newValue)) return true;
+		if (this.replacementRules.isClassified(resourceType, key)) return false;
+		return (await getCreateOnlyPropertyPaths(resourceType)).some((path) => path.length === 1 && path[0] === key);
+	}
 	static INTRINSIC_KEYS = INTRINSIC_KEYS;
 	static isIntrinsic(value) {
 		if (value === null || value === void 0 || typeof value !== "object" || Array.isArray(value)) return false;
@@ -20779,7 +20914,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-3uLGAhIx.js");
+			const { ASGProvider } = await import("./asg-provider-BFlmarbF.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -20885,7 +21020,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-J6zl27x3.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-BQ-CGoYJ.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-DqHELwjV.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CHnIs1hG.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -24938,30 +25073,47 @@ async function reserveStackCreateToken(options) {
 //#region src/deployment/inline-policy-claims.ts
 function isInlinePolicyClaimedByCompletedWriter(args, kind, principal, policyName) {
 	const { selfLogicalId, writers, changes, stateResources } = args;
-	const same = (a, b) => typeof a === "string" && IAM_NAME.test(a) && a.toLowerCase() === b.toLowerCase();
 	for (const [lid, write] of writers) {
 		if (lid === selfLogicalId || !Object.hasOwn(stateResources, lid)) continue;
 		const record = stateResources[lid];
 		if (record.provisionedBy === "cc-api") continue;
 		const props = record.properties ?? {};
 		if (record.resourceType === "AWS::IAM::Policy") {
-			if (!same(record.physicalId, policyName)) continue;
+			if (!sameIamName(record.physicalId, policyName)) continue;
 			const listed = props[POLICY_LIST_FIELDS[kind]];
-			if (Array.isArray(listed) && listed.some((p) => same(p, principal))) return true;
+			if (Array.isArray(listed) && listed.some((p) => sameIamName(p, principal))) return true;
 			continue;
 		}
 		if (!Object.hasOwn(PRINCIPAL_KINDS, record.resourceType)) continue;
 		if (PRINCIPAL_KINDS[record.resourceType] !== kind) continue;
-		if (!same(record.physicalId, principal)) continue;
+		if (!sameIamName(record.physicalId, principal)) continue;
 		if (write !== "create" && !ownPoliciesChange(changes.get(lid))) continue;
 		const policies = props["Policies"];
 		if (!Array.isArray(policies)) continue;
-		if (policies.some((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) && same(entry["PolicyName"], policyName))) return true;
+		if (policies.some((entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) && sameIamName(entry["PolicyName"], policyName))) return true;
 	}
 	return false;
 }
 var RollbackInlinePolicyWriters = class {
 	entries = /* @__PURE__ */ new Map();
+	removals = /* @__PURE__ */ new Map();
+	unsettled = /* @__PURE__ */ new Map();
+	notePending(ops) {
+		for (const op of ops) if (!this.unsettled.has(op)) this.unsettled.set(op, {
+			logicalId: op.logicalId,
+			state: "pending"
+		});
+	}
+	noteOutcome(op, completed) {
+		if (!completed) {
+			this.unsettled.set(op, {
+				logicalId: op.logicalId,
+				state: "failed"
+			});
+			return;
+		}
+		for (const [key, entry] of this.unsettled) if (key === op || entry.logicalId === op.logicalId) this.unsettled.delete(key);
+	}
 	record(logicalId, write, record, policiesChanged, via) {
 		if (via === "cc-api") {
 			this.entries.delete(logicalId);
@@ -24993,15 +25145,100 @@ var RollbackInlinePolicyWriters = class {
 					}]
 				});
 			}
-			return isInlinePolicyClaimedByCompletedWriter({
+			const claimed = isInlinePolicyClaimedByCompletedWriter({
 				selfLogicalId: logicalId,
 				writers,
 				changes,
 				stateResources
 			}, kind, principal, policyName);
+			if (!claimed) {
+				const key = removalKey(kind, principal, policyName);
+				const noted = this.removals.get(key) ?? {
+					kind,
+					principal,
+					policyName,
+					removers: /* @__PURE__ */ new Map()
+				};
+				noted.removers.set(logicalId, stateResources[logicalId]);
+				this.removals.set(key, noted);
+			}
+			return claimed;
 		};
 	}
+	takeHeldRemovals(stateResources) {
+		const held = [];
+		for (const [key, { kind, principal, policyName, removers }] of this.removals) {
+			const { holders, unreadable } = inlinePolicyHolders(stateResources, kind, principal, policyName);
+			const others = holders.filter((h) => !removers.has(h.logicalId) || stateResources[h.logicalId] !== removers.get(h.logicalId));
+			if (others.length === 0) continue;
+			this.removals.delete(key);
+			const open = new Set([...this.unsettled.values()].map((u) => u.logicalId));
+			const unsettled = [...new Set(others.map((h) => h.logicalId))].filter((id) => open.has(id));
+			held.push({
+				kind,
+				holders: others,
+				unreadable,
+				unsettled
+			});
+		}
+		return held;
+	}
 };
+function inlinePolicyHolders(stateResources, kind, principal, policyName) {
+	const holders = [];
+	const unreadable = [];
+	const unnamed = (v) => typeof v !== "string" || !IAM_NAME.test(v);
+	for (const [logicalId, record] of Object.entries(stateResources)) {
+		if (record === null || typeof record !== "object") continue;
+		const props = record.properties ?? {};
+		if (record.resourceType === "AWS::IAM::Policy") {
+			const nameMatches = sameIamName(record.physicalId, policyName);
+			if (!nameMatches && !unnamed(record.physicalId)) continue;
+			const listed = props[POLICY_LIST_FIELDS[kind]];
+			const entries = Array.isArray(listed) ? listed : [];
+			const named = entries.find((p) => sameIamName(p, principal));
+			if (nameMatches && typeof named === "string") holders.push({
+				logicalId,
+				principal: named,
+				policyName: record.physicalId,
+				document: props["PolicyDocument"]
+			});
+			else if (named !== void 0 || entries.some(unnamed)) unreadable.push(logicalId);
+			continue;
+		}
+		if (!Object.hasOwn(PRINCIPAL_KINDS, record.resourceType)) continue;
+		if (PRINCIPAL_KINDS[record.resourceType] !== kind) continue;
+		const principalMatches = sameIamName(record.physicalId, principal);
+		if (!principalMatches && !unnamed(record.physicalId)) continue;
+		const policies = props["Policies"];
+		if (!Array.isArray(policies)) continue;
+		for (const entry of policies) {
+			if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+			const name = entry["PolicyName"];
+			if (principalMatches && sameIamName(name, policyName)) holders.push({
+				logicalId,
+				principal: record.physicalId,
+				policyName: name,
+				document: entry["PolicyDocument"]
+			});
+			else if (unnamed(name) || sameIamName(name, policyName)) unreadable.push(logicalId);
+		}
+	}
+	return {
+		holders,
+		unreadable: [...new Set(unreadable)]
+	};
+}
+function sameIamName(a, b) {
+	return typeof a === "string" && IAM_NAME.test(a) && a.toLowerCase() === b.toLowerCase();
+}
+function removalKey(kind, principal, policyName) {
+	return JSON.stringify([
+		kind,
+		principal.toLowerCase(),
+		policyName.toLowerCase()
+	]);
+}
 const IAM_NAME = /^[\w+=,.@-]+$/;
 const POLICY_LIST_FIELDS = {
 	role: "Roles",
@@ -25877,6 +26114,31 @@ function updatePartialMessage(reason) {
 	return `partial (${reason})`;
 }
 
+//#endregion
+//#region src/provisioning/redacted-delete-address.ts
+function isRedactedRecordedValue(value) {
+	if (carriesSecretMask(value)) return true;
+	let text;
+	try {
+		text = typeof value === "string" ? value : JSON.stringify(value);
+	} catch {
+		return false;
+	}
+	return text !== void 0 && dynamicReferenceTokens(text).length > 0;
+}
+const REDACTED_DELETE_ADDRESS_SKIP_REASON = "redacted address property in state — no delete issued";
+function redactedDeleteAddressFields(fields) {
+	return Object.keys(fields).filter((key) => isRedactedRecordedValue(fields[key]));
+}
+function redactedDeleteAddressSkip(logger, logicalId, what, redactedFields) {
+	if (redactedFields.length === 0) return void 0;
+	logger.warn(safeMsg`${what} ${logicalId} is recorded in state with ${redactedFields.join(", ")} ` + "redacted (the '***' mask of a NoEcho value it read, or a secret '{{resolve:...}}' reference), which names nothing in AWS; skipping deletion — no AWS call is issued, so the resource is LEFT IN PLACE unless a parent resource this run also deletes removes it (then only the record is stale). Re-deploying records the same redaction again. The state record is KEPT and the run reports the skip: on 'cdkd destroy' / 'cdkd state destroy' (which exits non-zero) and, since issue 1762, on the plain DELETE of a resource removed from the template during cdkd deploy. Remove the resource by hand, then clear the stack's records with 'cdkd state orphan <stack>' — that command drops EVERY record for the stack, not just this one. NOTE a deploy-side REPLACEMENT or rollback delete instead FAILS the resource (https://github.com/go-to-k/cdkd/issues/1762) — the old resource is left untracked there, so remove it by hand.");
+	return {
+		outcome: "skipped",
+		reason: REDACTED_DELETE_ADDRESS_SKIP_REASON
+	};
+}
+
 //#endregion
 //#region src/provisioning/final-snapshot.ts
 const ATOMIC_FINAL_SNAPSHOT_TYPES = /* @__PURE__ */ new Set([
@@ -26204,30 +26466,6 @@ async function createReplicationGroupFinalSnapshot(client, replicationGroupId, l
 const NESTED_STACK_RESOURCE_TYPE$1 = "AWS::CloudFormation::Stack";
 const nonEmptyString = (v) => typeof v === "string" && v.length > 0;
 
-//#endregion
-//#region src/deployment/producer-regions-scope.ts
-const producerRegionsStore = new AsyncLocalStorage();
-function withProducerRegions(evidence, fn) {
-	return producerRegionsStore.run(evidence, fn);
-}
-function getCurrentProducerRegions() {
-	return producerRegionsStore.getStore();
-}
-function inheritProducerRegions(own, inherited) {
-	const seen = /* @__PURE__ */ new Set();
-	const regions = [];
-	for (const region of [...own, ...inherited?.regions ?? []]) {
-		const canonical = canonicalizeRegion(region);
-		if (!canonical || seen.has(canonical)) continue;
-		seen.add(canonical);
-		regions.push(region);
-	}
-	return {
-		regions,
-		complete: inherited?.complete === true
-	};
-}
-
 //#endregion
 //#region src/deployment/rollback-executor/messages.ts
 function throwIfDeleteSkipped(result, logicalId, physicalId, duringClause) {
@@ -26371,6 +26609,271 @@ function retainedSurvivorMessages(logicalId, resourceType, survivorPhysicalId, s
 	};
 }
 
+//#endregion
+//#region src/deployment/rollback-executor/names.ts
+function replayPrefixScope(input, logger, mask, restoring) {
+	const choice = replayPrefixChoice(input);
+	if (choice.kind === "not-applicable") return (fn) => fn();
+	const setting = (skip) => skip ? "SKIPPED" : "KEPT";
+	const subject = `${safe(input.logicalId)} (${safe(input.resourceType)})`;
+	const declared = choice.declared;
+	const secretDerived = declared !== void 0 && mask(declared) !== declared;
+	const withheld = secretDerived || choice.kind === "unreproduced" && declared === void 0;
+	const shown = (value) => displayIdent(mask(String(value)));
+	const quoted = (value) => {
+		const masked = mask(value);
+		const rendered = displayIdent(masked);
+		return rendered === masked ? `"${masked}"` : rendered;
+	};
+	if (choice.kind === "reproduced" && choice.skipPrefix !== choice.recorded) logger.info(mask(`  Rollback: ${restoring ? "re-creating" : "reverting"} ${subject} under the user-supplied-name prefix setting that created ` + (withheld ? `it (its physical id is withheld, as its name is secret-derived): ` : `${shown(input.physicalId)} (`) + `stack-name prefix ${setting(choice.skipPrefix)}; the failed deploy ran with it ${setting(choice.recorded)}${withheld ? "" : ")"}`));
+	else if (choice.kind === "unreproduced" && restoring) {
+		const idUnreadable = typeof input.physicalId !== "string" || input.physicalId === "";
+		const prop = safe(choice.property);
+		const unreadable = declared === void 0 ? idUnreadable ? `its ${prop} or its physical id` : `its ${prop}` : idUnreadable ? `its physical id` : void 0;
+		logger.warn(mask(`  ⚠ ${subject}: cdkd cannot tell which user-supplied-name prefix setting created the old resource (` + (withheld ? `its physical id is withheld, as its name is secret-derived or unreadable` : shown(input.physicalId)) + `) — ` + (choice.names === void 0 ? unreadable !== void 0 ? `cdkd cannot read ${unreadable} to compare` : `cdkd cannot derive the names its ${prop} takes to compare` : secretDerived ? `its ${prop} is secret-derived, and neither name it derives matches` : `its ${prop} derives to ${quoted(choice.names.skipped)} (prefix skipped) or ${quoted(choice.names.kept)} (prefix kept), and it is neither`) + `; re-creating it with the stack-name prefix ${setting(choice.skipPrefix)}, as the failed deploy ran, so it may come back under a different physical name.`));
+	}
+	const skip = choice.skipPrefix;
+	return (fn) => withSkipPrefix(skip, fn);
+}
+function createOpMasker(logger, secrets) {
+	const base = createMaskedLogSinks(logger, (text) => maskSecretsInText(text, secrets));
+	const pairs = [];
+	let sinks = base;
+	return {
+		mask: (text) => typeof text === "string" ? sinks.mask(text) : text,
+		addNamed: (record) => {
+			pairs.push(...secretDerivedNamePairs(record));
+			sinks = withDerivedNameMasks(logger, base, pairs);
+		}
+	};
+}
+const OTHER_SPELLED_NAME_KEYS = {
+	"AWS::Cognito::UserPoolDomain": ["Domain"],
+	"AWS::Cognito::UserPoolUser": ["Username"],
+	"AWS::ECS::TaskDefinition": ["Family"],
+	"AWS::ElastiCache::ReplicationGroup": ["ReplicationGroupId"],
+	"AWS::ElastiCache::User": ["UserId"],
+	"AWS::ElastiCache::UserGroup": ["UserGroupId"],
+	"AWS::SES::EmailIdentity": ["EmailIdentity"]
+};
+const COMPOSITE_SCOPE_LAST = /^(?:REGIONAL|CLOUDFRONT|GLOBAL)$/;
+const COMPOSITE_POOL_FIRST = /^[a-z]{2}(?:-gov)?-[a-z]+-\d+_[A-Za-z0-9]+$/;
+function idNameSegments(id) {
+	const segments = /* @__PURE__ */ new Set();
+	const arn = /^arn:[^:]*:([^:]*):[^:]*:[^:]*:(.+)$/.exec(id);
+	if (arn !== null) {
+		const service = arn[1];
+		const resource = arn[2];
+		const lambda = service === "lambda" ? /^(?:function|layer):([^:]+)(?::([^:]+))?/.exec(resource) : null;
+		if (lambda !== null) {
+			segments.add(lambda[1]);
+			const qualifier = lambda[2];
+			if (qualifier !== void 0 && !/^\d+$/.test(qualifier)) segments.add(qualifier);
+		} else {
+			const parts = resource.split(/[/:]/).filter((part) => part !== "");
+			let body = parts.length > 1 ? parts.slice(1) : parts;
+			if (body.length > 1 && /^\d+$/.test(body[body.length - 1])) body = body.slice(0, -1);
+			for (const part of body) {
+				segments.add(part);
+				if (service === "secretsmanager") segments.add(part.replace(/-[A-Za-z0-9]{6}$/, ""));
+			}
+		}
+	}
+	if (id.includes("/")) {
+		const afterSlash = id.slice(id.lastIndexOf("/") + 1);
+		segments.add(afterSlash);
+		segments.add(afterSlash.replace(/:\d+$/, ""));
+	}
+	if (id.includes("|")) {
+		const parts = id.split("|");
+		parts.forEach((part, index) => {
+			if (part === "") return;
+			if (index === parts.length - 1 && parts.length > 1 && COMPOSITE_SCOPE_LAST.test(part)) return;
+			if (index === 0 && parts.length > 1 && COMPOSITE_POOL_FIRST.test(part)) return;
+			segments.add(part);
+		});
+	}
+	return [...segments].filter((segment) => segment.length >= 4 && segment !== id);
+}
+function ownEntry(table, key) {
+	return Object.hasOwn(table, key) ? table[key] : void 0;
+}
+function secretDerivedNamePairs(record) {
+	const { resourceType, properties, logicalId } = record;
+	if (typeof resourceType !== "string" || !isRestorableBag(properties)) return [];
+	const rewritten = reverseReplacementRewrittenNameTypes();
+	const named = /* @__PURE__ */ new Set();
+	const primary = Object.hasOwn(rewritten, resourceType) ? rewritten[resourceType].property : explicitNamePropertyFor(resourceType);
+	if (typeof primary === "string") named.add(primary);
+	for (const key of Object.keys(properties)) if (/(?:Name|Identifier)$/.test(key)) named.add(key);
+	for (const key of ownEntry(OTHER_SPELLED_NAME_KEYS, resourceType) ?? []) named.add(key);
+	const idSpellings = record.physicalIds.filter((id) => typeof id === "string" && id !== "").flatMap((id) => [
+		id,
+		...id.toLowerCase() === id || id.length < 4 ? [] : [id.toLowerCase()],
+		finalSnapshotNamePrefix(id, resourceType),
+		...idNameSegments(id)
+	]);
+	const pairs = [];
+	for (const key of named) {
+		if (!Object.hasOwn(properties, key)) continue;
+		const value = properties[key];
+		if (typeof value !== "string" || value === "") continue;
+		const derived = key === primary && !value.includes("{{resolve:") && value !== "***" ? rewrittenNameSpellings(resourceType, value, logicalId) : [];
+		for (const spelling of [...idSpellings, ...derived]) pairs.push([value, spelling]);
+	}
+	return pairs;
+}
+function addRecordNames(opMasker, op, current) {
+	const { logicalId } = op;
+	for (const properties of [op.properties, op.attemptedProperties]) opMasker.addNamed({
+		resourceType: op.resourceType,
+		properties,
+		logicalId,
+		physicalIds: [op.physicalId]
+	});
+	for (const record of [op.previousState, current]) {
+		if (record === null || typeof record !== "object") continue;
+		opMasker.addNamed({
+			resourceType: record.resourceType ?? op.resourceType,
+			properties: record.properties,
+			logicalId,
+			physicalIds: [record.physicalId]
+		});
+	}
+}
+const ABSENT_BASELINE_SKIP_CAUSE = "Its recorded previous state has no `properties` bag, so there is nothing to restore it to; the rollback left the resource exactly as it is.";
+function requireRestorableBaseline(bag, logger, { logicalId, consequence, remedy, retry }) {
+	if (isRestorableBag(bag)) return true;
+	if (bag === void 0) {
+		logger.warn(`  Rollback: Cannot restore ${shownLogicalId(logicalId)} \u2014 its recorded previous state has no \`properties\` bag, so there is nothing to restore it to. An empty desired state would ${consequence}. The resource is therefore left exactly as it is. ${remedy}`);
+		return false;
+	}
+	const shape = bag === null ? "null" : Array.isArray(bag) ? "an array" : `a ${typeof bag}`;
+	throw new CdkdError(`Cannot roll ${shownLogicalId(logicalId)} back: its recorded previous state has a \`properties\` field that is not a property bag (${shape}), so cdkd cannot tell what to restore it to. Replaying it would do one of two things, and cdkd does neither: send the malformed value to the provider as-is, or send an empty desired state (which would ${consequence}). The rollback JOURNAL record is kept: once that record holds a property bag again, ${retry}. Otherwise fix forward with \`cdkd deploy\`, or remove the stack with \`cdkd destroy\`.`, "ROLLBACK_UNUSABLE_BASELINE");
+}
+function isRestorableBag(bag) {
+	return typeof bag === "object" && bag !== null && !Array.isArray(bag);
+}
+async function prepareCreateRollbackFinalSnapshot(op, provisionedBy, ctx, mask) {
+	const { logicalId, resourceType } = op;
+	const physicalId = op.physicalId;
+	switch (finalSnapshotMechanism(resourceType, provisionedBy)) {
+		case "atomic-delete-parameter": return buildFinalSnapshotIdentifier(physicalId, resourceType);
+		case "pre-delete-snapshot":
+			await createPreDeleteFinalSnapshot(resourceType, physicalId, logicalId, ctx.finalSnapshotClients ?? getAwsClients(), {
+				info: (message) => ctx.logger.info(mask(message)),
+				debug: (message) => ctx.logger.debug(mask(message))
+			});
+			return;
+		case "refuse-cc-routed": throw ccRoutedFinalSnapshotError(logicalId, resourceType, SKIP_FINAL_SNAPSHOT_FLAG);
+		case "refuse-unsupported-type": throw unsupportedFinalSnapshotError(logicalId, resourceType, SKIP_FINAL_SNAPSHOT_FLAG);
+	}
+}
+
+//#endregion
+//#region src/deployment/rollback-executor/replay-inline-policy-restore.ts
+async function restoreHeldInlinePolicies(writers, stateResources, stackName, ctx, result, options = {}) {
+	for (const removal of writers.takeHeldRemovals(stateResources)) await restoreOne(removal, stateResources, stackName, ctx, result, options.refuseAll === true);
+}
+async function restoreOne({ kind, holders, unreadable, unsettled }, stateResources, stackName, ctx, result, refuseAll) {
+	const { logger } = ctx;
+	const ids = [...new Set(holders.map((h) => h.logicalId))].map((id) => safe(id)).join(", ");
+	const lost = safeMsg`the ${kind} it is on lacks that inline policy until the resource is next updated, or ` + `'cdkd drift <stack> --revert' restores it`;
+	if (refuseAll || unsettled.length > 0) {
+		const pending = refuseAll ? ids : unsettled.map((id) => safe(id)).join(", ");
+		logger.warn(safeMsg`  Rollback: an inline policy this rollback removed is recorded by ${ids}, but the ` + safeMsg`rollback of ${pending} has not completed, so that record may be the failed ` + safeMsg`deploy's and cdkd did not put it back; ${lost}.`);
+		result.warnings++;
+		return;
+	}
+	if (unreadable.length > 0) {
+		logger.warn(safeMsg`  Rollback: an inline policy this rollback removed is recorded by ${ids}, and ` + safeMsg`${unreadable.map((id) => safe(id)).join(", ")} may record it too under a redacted ` + safeMsg`name, so cdkd did not put it back; ${lost}.`);
+		result.warnings++;
+		return;
+	}
+	const documents = holders.map((h) => serializedDocument(h.document));
+	if (documents.some((d) => d === void 0)) {
+		logger.warn(safeMsg`  Rollback: an inline policy this rollback removed is still recorded by ${ids}, but its ` + safeMsg`recorded document is absent or redacted, so cdkd did not put it back; ${lost}.`);
+		result.warnings++;
+		return;
+	}
+	if (new Set(documents).size > 1) {
+		logger.warn(safeMsg`  Rollback: an inline policy this rollback removed is recorded by ${ids} with different ` + safeMsg`documents under one name on one ${kind}, so cdkd put neither back; ${lost}.`);
+		result.warnings++;
+		return;
+	}
+	const holder = holders[0];
+	const secrets = /* @__PURE__ */ new Map();
+	for (const h of holders) {
+		const bag = ctx.logOnlyNeedlesFor?.(h.logicalId);
+		if (bag) carryLogOnlyValues(bag, secrets);
+	}
+	const masker = createOpMasker(logger, secrets);
+	for (const h of holders) {
+		const record = stateResources[h.logicalId];
+		addRecordNames(masker, {
+			logicalId: h.logicalId,
+			resourceType: record?.resourceType,
+			physicalId: record?.physicalId
+		}, record);
+	}
+	try {
+		const { provider, provisionedBy } = ctx.providerRegistry.getProviderFor({
+			resourceType: "AWS::IAM::Policy",
+			provisionedBy: "sdk"
+		});
+		if (provisionedBy !== "sdk") throw new Error("AWS::IAM::Policy is not routed to its SDK provider");
+		await provider.create(holder.logicalId, "AWS::IAM::Policy", {
+			PolicyName: holder.policyName,
+			PolicyDocument: holder.document,
+			[POLICY_LIST_FIELDS[kind]]: [holder.principal]
+		}, { maskSecrets: masker.mask });
+	} catch (error) {
+		logger.warn(maskedFailureText(safeMsg`  Rollback: could not put back the inline policy ${ids} records on its ${kind} ` + safeMsg`(${lost}): `, error, masker.mask));
+		result.warnings++;
+		return;
+	}
+	logger.info(safeMsg`  Rollback: put back the inline policy ${ids} records on its ${kind}`);
+	const holderType = stateResources[holder.logicalId]?.resourceType;
+	ctx.recordEvent?.({
+		eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
+		stackName,
+		operation: "UPDATE",
+		logicalId: holder.logicalId,
+		...typeof holderType === "string" && { resourceType: holderType },
+		provisionedBy: "sdk",
+		reason: `Put back the inline policy this resource records on its ${kind}, which the rollback had removed from it.`
+	});
+}
+function serializedDocument(document) {
+	if (typeof document === "string") return document.length > 0 && !isRedactedRecordedValue(document) ? document : void 0;
+	if (document === null || typeof document !== "object" || Array.isArray(document)) return;
+	return isRedactedRecordedValue(document) ? void 0 : JSON.stringify(document);
+}
+
+//#endregion
+//#region src/deployment/producer-regions-scope.ts
+const producerRegionsStore = new AsyncLocalStorage();
+function withProducerRegions(evidence, fn) {
+	return producerRegionsStore.run(evidence, fn);
+}
+function getCurrentProducerRegions() {
+	return producerRegionsStore.getStore();
+}
+function inheritProducerRegions(own, inherited) {
+	const seen = /* @__PURE__ */ new Set();
+	const regions = [];
+	for (const region of [...own, ...inherited?.regions ?? []]) {
+		const canonical = canonicalizeRegion(region);
+		if (!canonical || seen.has(canonical)) continue;
+		seen.add(canonical);
+		regions.push(region);
+	}
+	return {
+		regions,
+		complete: inherited?.complete === true
+	};
+}
+
 //#endregion
 //#region src/deployment/rollback-executor/replay-secrets.ts
 function replayProducerRegionEvidence(ctx) {
@@ -26674,167 +27177,6 @@ function sortRollbackCreates(createOps, stateResources, logger) {
 	return sorted;
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/names.ts
-function replayPrefixScope(input, logger, mask, restoring) {
-	const choice = replayPrefixChoice(input);
-	if (choice.kind === "not-applicable") return (fn) => fn();
-	const setting = (skip) => skip ? "SKIPPED" : "KEPT";
-	const subject = `${safe(input.logicalId)} (${safe(input.resourceType)})`;
-	const declared = choice.declared;
-	const secretDerived = declared !== void 0 && mask(declared) !== declared;
-	const withheld = secretDerived || choice.kind === "unreproduced" && declared === void 0;
-	const shown = (value) => displayIdent(mask(String(value)));
-	const quoted = (value) => {
-		const masked = mask(value);
-		const rendered = displayIdent(masked);
-		return rendered === masked ? `"${masked}"` : rendered;
-	};
-	if (choice.kind === "reproduced" && choice.skipPrefix !== choice.recorded) logger.info(mask(`  Rollback: ${restoring ? "re-creating" : "reverting"} ${subject} under the user-supplied-name prefix setting that created ` + (withheld ? `it (its physical id is withheld, as its name is secret-derived): ` : `${shown(input.physicalId)} (`) + `stack-name prefix ${setting(choice.skipPrefix)}; the failed deploy ran with it ${setting(choice.recorded)}${withheld ? "" : ")"}`));
-	else if (choice.kind === "unreproduced" && restoring) {
-		const idUnreadable = typeof input.physicalId !== "string" || input.physicalId === "";
-		const prop = safe(choice.property);
-		const unreadable = declared === void 0 ? idUnreadable ? `its ${prop} or its physical id` : `its ${prop}` : idUnreadable ? `its physical id` : void 0;
-		logger.warn(mask(`  ⚠ ${subject}: cdkd cannot tell which user-supplied-name prefix setting created the old resource (` + (withheld ? `its physical id is withheld, as its name is secret-derived or unreadable` : shown(input.physicalId)) + `) — ` + (choice.names === void 0 ? unreadable !== void 0 ? `cdkd cannot read ${unreadable} to compare` : `cdkd cannot derive the names its ${prop} takes to compare` : secretDerived ? `its ${prop} is secret-derived, and neither name it derives matches` : `its ${prop} derives to ${quoted(choice.names.skipped)} (prefix skipped) or ${quoted(choice.names.kept)} (prefix kept), and it is neither`) + `; re-creating it with the stack-name prefix ${setting(choice.skipPrefix)}, as the failed deploy ran, so it may come back under a different physical name.`));
-	}
-	const skip = choice.skipPrefix;
-	return (fn) => withSkipPrefix(skip, fn);
-}
-function createOpMasker(logger, secrets) {
-	const base = createMaskedLogSinks(logger, (text) => maskSecretsInText(text, secrets));
-	const pairs = [];
-	let sinks = base;
-	return {
-		mask: (text) => typeof text === "string" ? sinks.mask(text) : text,
-		addNamed: (record) => {
-			pairs.push(...secretDerivedNamePairs(record));
-			sinks = withDerivedNameMasks(logger, base, pairs);
-		}
-	};
-}
-const OTHER_SPELLED_NAME_KEYS = {
-	"AWS::Cognito::UserPoolDomain": ["Domain"],
-	"AWS::Cognito::UserPoolUser": ["Username"],
-	"AWS::ECS::TaskDefinition": ["Family"],
-	"AWS::ElastiCache::ReplicationGroup": ["ReplicationGroupId"],
-	"AWS::ElastiCache::User": ["UserId"],
-	"AWS::ElastiCache::UserGroup": ["UserGroupId"],
-	"AWS::SES::EmailIdentity": ["EmailIdentity"]
-};
-const COMPOSITE_SCOPE_LAST = /^(?:REGIONAL|CLOUDFRONT|GLOBAL)$/;
-const COMPOSITE_POOL_FIRST = /^[a-z]{2}(?:-gov)?-[a-z]+-\d+_[A-Za-z0-9]+$/;
-function idNameSegments(id) {
-	const segments = /* @__PURE__ */ new Set();
-	const arn = /^arn:[^:]*:([^:]*):[^:]*:[^:]*:(.+)$/.exec(id);
-	if (arn !== null) {
-		const service = arn[1];
-		const resource = arn[2];
-		const lambda = service === "lambda" ? /^(?:function|layer):([^:]+)(?::([^:]+))?/.exec(resource) : null;
-		if (lambda !== null) {
-			segments.add(lambda[1]);
-			const qualifier = lambda[2];
-			if (qualifier !== void 0 && !/^\d+$/.test(qualifier)) segments.add(qualifier);
-		} else {
-			const parts = resource.split(/[/:]/).filter((part) => part !== "");
-			let body = parts.length > 1 ? parts.slice(1) : parts;
-			if (body.length > 1 && /^\d+$/.test(body[body.length - 1])) body = body.slice(0, -1);
-			for (const part of body) {
-				segments.add(part);
-				if (service === "secretsmanager") segments.add(part.replace(/-[A-Za-z0-9]{6}$/, ""));
-			}
-		}
-	}
-	if (id.includes("/")) {
-		const afterSlash = id.slice(id.lastIndexOf("/") + 1);
-		segments.add(afterSlash);
-		segments.add(afterSlash.replace(/:\d+$/, ""));
-	}
-	if (id.includes("|")) {
-		const parts = id.split("|");
-		parts.forEach((part, index) => {
-			if (part === "") return;
-			if (index === parts.length - 1 && parts.length > 1 && COMPOSITE_SCOPE_LAST.test(part)) return;
-			if (index === 0 && parts.length > 1 && COMPOSITE_POOL_FIRST.test(part)) return;
-			segments.add(part);
-		});
-	}
-	return [...segments].filter((segment) => segment.length >= 4 && segment !== id);
-}
-function ownEntry(table, key) {
-	return Object.hasOwn(table, key) ? table[key] : void 0;
-}
-function secretDerivedNamePairs(record) {
-	const { resourceType, properties, logicalId } = record;
-	if (typeof resourceType !== "string" || !isRestorableBag(properties)) return [];
-	const rewritten = reverseReplacementRewrittenNameTypes();
-	const named = /* @__PURE__ */ new Set();
-	const primary = Object.hasOwn(rewritten, resourceType) ? rewritten[resourceType].property : explicitNamePropertyFor(resourceType);
-	if (typeof primary === "string") named.add(primary);
-	for (const key of Object.keys(properties)) if (/(?:Name|Identifier)$/.test(key)) named.add(key);
-	for (const key of ownEntry(OTHER_SPELLED_NAME_KEYS, resourceType) ?? []) named.add(key);
-	const idSpellings = record.physicalIds.filter((id) => typeof id === "string" && id !== "").flatMap((id) => [
-		id,
-		...id.toLowerCase() === id || id.length < 4 ? [] : [id.toLowerCase()],
-		finalSnapshotNamePrefix(id, resourceType),
-		...idNameSegments(id)
-	]);
-	const pairs = [];
-	for (const key of named) {
-		if (!Object.hasOwn(properties, key)) continue;
-		const value = properties[key];
-		if (typeof value !== "string" || value === "") continue;
-		const derived = key === primary && !value.includes("{{resolve:") && value !== "***" ? rewrittenNameSpellings(resourceType, value, logicalId) : [];
-		for (const spelling of [...idSpellings, ...derived]) pairs.push([value, spelling]);
-	}
-	return pairs;
-}
-function addRecordNames(opMasker, op, current) {
-	const { logicalId } = op;
-	for (const properties of [op.properties, op.attemptedProperties]) opMasker.addNamed({
-		resourceType: op.resourceType,
-		properties,
-		logicalId,
-		physicalIds: [op.physicalId]
-	});
-	for (const record of [op.previousState, current]) {
-		if (record === null || typeof record !== "object") continue;
-		opMasker.addNamed({
-			resourceType: record.resourceType ?? op.resourceType,
-			properties: record.properties,
-			logicalId,
-			physicalIds: [record.physicalId]
-		});
-	}
-}
-const ABSENT_BASELINE_SKIP_CAUSE = "Its recorded previous state has no `properties` bag, so there is nothing to restore it to; the rollback left the resource exactly as it is.";
-function requireRestorableBaseline(bag, logger, { logicalId, consequence, remedy, retry }) {
-	if (isRestorableBag(bag)) return true;
-	if (bag === void 0) {
-		logger.warn(`  Rollback: Cannot restore ${shownLogicalId(logicalId)} \u2014 its recorded previous state has no \`properties\` bag, so there is nothing to restore it to. An empty desired state would ${consequence}. The resource is therefore left exactly as it is. ${remedy}`);
-		return false;
-	}
-	const shape = bag === null ? "null" : Array.isArray(bag) ? "an array" : `a ${typeof bag}`;
-	throw new CdkdError(`Cannot roll ${shownLogicalId(logicalId)} back: its recorded previous state has a \`properties\` field that is not a property bag (${shape}), so cdkd cannot tell what to restore it to. Replaying it would do one of two things, and cdkd does neither: send the malformed value to the provider as-is, or send an empty desired state (which would ${consequence}). The rollback JOURNAL record is kept: once that record holds a property bag again, ${retry}. Otherwise fix forward with \`cdkd deploy\`, or remove the stack with \`cdkd destroy\`.`, "ROLLBACK_UNUSABLE_BASELINE");
-}
-function isRestorableBag(bag) {
-	return typeof bag === "object" && bag !== null && !Array.isArray(bag);
-}
-async function prepareCreateRollbackFinalSnapshot(op, provisionedBy, ctx, mask) {
-	const { logicalId, resourceType } = op;
-	const physicalId = op.physicalId;
-	switch (finalSnapshotMechanism(resourceType, provisionedBy)) {
-		case "atomic-delete-parameter": return buildFinalSnapshotIdentifier(physicalId, resourceType);
-		case "pre-delete-snapshot":
-			await createPreDeleteFinalSnapshot(resourceType, physicalId, logicalId, ctx.finalSnapshotClients ?? getAwsClients(), {
-				info: (message) => ctx.logger.info(mask(message)),
-				debug: (message) => ctx.logger.debug(mask(message))
-			});
-			return;
-		case "refuse-cc-routed": throw ccRoutedFinalSnapshotError(logicalId, resourceType, SKIP_FINAL_SNAPSHOT_FLAG);
-		case "refuse-unsupported-type": throw unsupportedFinalSnapshotError(logicalId, resourceType, SKIP_FINAL_SNAPSHOT_FLAG);
-	}
-}
-
 //#endregion
 //#region src/deployment/rollback-executor/replay-props.ts
 async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId) {
@@ -27410,6 +27752,7 @@ async function replayRollbackUnbound(operations, stateResources, stackName, ctx,
 	};
 	if (operations.length === 0) {
 		ctx.logger.info("No completed operations to roll back.");
+		await restoreHeldInlinePolicies(inlinePolicyWriters, stateResources, stackName, ctx, result);
 		return result;
 	}
 	ctx.logger.info(`Rolling back ${operations.length} completed operation(s)...`);
@@ -27418,6 +27761,7 @@ async function replayRollbackUnbound(operations, stateResources, stackName, ctx,
 		stackName
 	});
 	const resolver = new ReplayResolvers(ctx.region);
+	inlinePolicyWriters.notePending(operations);
 	const { createOps, otherOps } = partitionOps(operations);
 	for (let i = otherOps.length - 1; i >= 0; i--) {
 		if (options.isInterrupted?.()) {
@@ -27436,6 +27780,7 @@ async function replayRollbackUnbound(operations, stateResources, stackName, ctx,
 			await replaySingle(op, stateResources, stackName, ctx, resolver, orphanLogicalIds, result, options.onOrphan, inlinePolicyWriters, options.afterOp, options.isInterrupted);
 		}
 	}
+	await restoreHeldInlinePolicies(inlinePolicyWriters, stateResources, stackName, ctx, result);
 	ctx.logger.info("Rollback completed. Some resources may remain if deletion failed.");
 	ctx.recordEvent?.({
 		eventType: "ROLLBACK_FINISHED",
@@ -27470,6 +27815,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 		mask,
 		createRollbackRoute: void 0
 	};
+	const recordBefore = ownRecord(stateResources, op.logicalId);
 	try {
 		addRecordNames(opMasker, op, stateResources[op.logicalId]);
 		switch (action) {
@@ -27514,8 +27860,13 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 			...failedRoute && { provisionedBy: failedRoute },
 			error: maskedRollbackEventError(rollbackError, mask)
 		});
+	} finally {
+		inlinePolicyWriters.noteOutcome(op, action === "skip-already-done" || ownRecord(stateResources, op.logicalId) !== recordBefore);
 	}
 }
+function ownRecord(stateResources, logicalId) {
+	return Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+}
 async function replayFailedOperationsUnbound(failedOps, stateResources, stackName, ctx, options = {}) {
 	const inlinePolicyWriters = options.inlinePolicyWriters ?? new RollbackInlinePolicyWriters();
 	const result = {
@@ -27552,6 +27903,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 			mask
 		};
 		let createRollbackRoute;
+		const recordBefore = ownRecord(stateResources, op.logicalId);
 		try {
 			addRecordNames(opMasker, op, stateResources[op.logicalId]);
 			switch (action) {
@@ -27720,7 +28072,9 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 				error: maskedRollbackEventError(revertError, mask)
 			});
 		}
+		inlinePolicyWriters.noteOutcome(op, action === "skip-failed-noop" || ownRecord(stateResources, op.logicalId) !== recordBefore);
 	}
+	if (result.interrupted) await restoreHeldInlinePolicies(inlinePolicyWriters, stateResources, stackName, ctx, result, { refuseAll: true });
 	if (emitEnvelope) ctx.recordEvent?.({
 		eventType: "ROLLBACK_FINISHED",
 		stackName
@@ -29264,9 +29618,9 @@ function extractAllDependencies(template, logicalId) {
 	return deps.length > 0 ? deps : void 0;
 }
 function propertiesToRecord(desiredProperties, result, resourceType, provisionedBy) {
-	if (result.effectiveProperties) return provisionedBy === "sdk" ? withoutSilentDropProperties(resourceType, result.effectiveProperties) : result.effectiveProperties;
+	if (result.effectiveProperties) return markWrittenFromDeployedTemplate(provisionedBy === "sdk" ? withoutSilentDropProperties(resourceType, result.effectiveProperties) : result.effectiveProperties);
 	const written = provisionedBy === "sdk" ? withoutSilentDropProperties(resourceType, desiredProperties) : desiredProperties;
-	return markSameGenerationBag(written);
+	return markWrittenFromDeployedTemplate(markSameGenerationBag(written));
 }
 function extractTemplateAttributes(template, logicalId) {
 	const resource = template?.Resources?.[logicalId];
@@ -32276,12 +32630,14 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	const lostChild = lostCandidate?.mode === "reattach" || lostCandidate !== void 0 && Object.hasOwn(resolvedProps, lostCandidate.property) && Object.hasOwn(currentProps, lostCandidate.property) && keyOrderFreeJson(resolvedProps[lostCandidate.property]) === keyOrderFreeJson(currentProps[lostCandidate.property]) ? lostCandidate : void 0;
 	const lostWithParent = lostChild?.mode === "recreate" ? lostChild.parent : void 0;
 	const suppliesFreshMaskOnlyValue = carriesFreshNoEchoValue(resolvedProps, updateSecrets);
+	const movedMasked = new Set(movedMaskedProperties(currentResource, desiredProps));
 	const desiredForSkipCheck = redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps);
 	const allowedSilentDrops = this.providerRegistry.getAllowedUnsupportedProperties?.();
 	const desiredForSkipCheckAsWritten = currentResource.provisionedBy !== "cc-api" && allowedSilentDrops ? withoutAcceptedSilentDropProperties(resourceType, desiredForSkipCheck, allowedSilentDrops, currentResource.properties) : desiredForSkipCheck;
 	const allowedForRecord = allowedSilentDrops ?? /* @__PURE__ */ new Set();
 	const createOnlyEvidence = acceptedCreateOnlyDropsOf(currentResource);
 	const currentPropsAsWritten = currentResource.provisionedBy === "cc-api" ? currentProps : withoutUnwrittenSilentDropProperties(resourceType, currentProps, desiredForSkipCheck, allowedForRecord, createOnlyEvidence);
+	const recordMatchesDesired = movedMasked.size === 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten);
 	const applyAttributeOnlyUpdate = (attributeChanges) => {
 		const attrSummary = attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
 		this.logger.info(safeMsg`  ↻ ${logicalId} (${resourceType}) attribute update: ${attrSummary}`);
@@ -32295,7 +32651,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		renderer.removeTask(logicalId);
 		this.logger.info(safeMsg`${attrPrefix}${formatResourceLine("updated", logicalId, resourceType, "updated (metadata)")}`);
 	};
-	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten)) {
+	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && recordMatchesDesired) {
 		if (change.attributeChanges && change.attributeChanges.length > 0) {
 			applyAttributeOnlyUpdate(change.attributeChanges);
 			return;
@@ -32320,7 +32676,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 				lowered.push(pc);
 				continue;
 			}
-			const moved = keyOrderFreeJson(desiredForSkipCheckAsWritten[pc.path]) !== keyOrderFreeJson(currentPropsAsWritten[pc.path]);
+			const moved = movedMasked.has(pc.path) || keyOrderFreeJson(desiredForSkipCheckAsWritten[pc.path]) !== keyOrderFreeJson(currentPropsAsWritten[pc.path]);
 			const conditionalVerdict = moved && !typeChanged && isReplacementCeiling(pc) ? this.diffCalculator.conditionalReplacementVerdict?.(resourceType, pc.path, currentPropsAsWritten[pc.path], desiredForSkipCheckAsWritten[pc.path]) : void 0;
 			if (moved && conditionalVerdict !== false) {
 				lowered.push(pc);
@@ -32352,7 +32708,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		}
 		change.propertyChanges = lowered;
 	}
-	if (noEchoHeldPaths.size > 0 && !typeChanged && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten) && Object.entries(resolvedProps).every(([key, value]) => noEchoHeldPaths.has(key) || freshNoEchoLeafPositions(value, updateSecrets).length === 0)) {
+	if (noEchoHeldPaths.size > 0 && !typeChanged && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && recordMatchesDesired && Object.entries(resolvedProps).every(([key, value]) => noEchoHeldPaths.has(key) || freshNoEchoLeafPositions(value, updateSecrets).length === 0)) {
 		this.logger.debug(safeMsg`Skipping ${logicalId}: AWS already holds every NoEcho value it carries, and nothing else changed`);
 		this.attemptedResolvedProps.delete(logicalId);
 		if (change.attributeChanges && change.attributeChanges.length > 0) {
@@ -34118,6 +34474,9 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		});
 		const parameterValues = await this.resolver.resolveParameters(template, this.options.parameters, { ...this.options.inheritedSecrets && hasMaskableValues(this.options.inheritedSecrets) && { inheritedSecrets: this.options.inheritedSecrets } });
 		this.logger.debug(`Resolved ${Object.keys(parameterValues).length} parameters: ${Object.keys(parameterValues).join(", ")}`);
+		const backfillNoEchoValues = noEchoParameterValueSeed(template.Parameters, parameterValues, this.options.inheritedSecrets, this.options.parameters);
+		this.fingerprintNoEchoValues = backfillNoEchoValues;
+		let maskedFingerprintsBackfilled = backfillMaskedPropertyFingerprints(currentState.resources, template, backfillNoEchoValues) > 0;
 		const context = this.buildResolverContext({
 			template,
 			resources: currentState.resources,
@@ -34139,7 +34498,10 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		const effectiveTemplate = this.templateParser.filterResourcesByCondition(template, conditions);
 		const orphanCountBeforeAdoption = (currentState.orphans ?? []).length;
 		const orphanPlan = await this.adoptRollbackOrphans(currentState, effectiveTemplate);
-		if (Object.keys(orphanPlan.adopted).length > 0) this.stampReasonlessParameterRefusals(currentState.resources, template);
+		if (Object.keys(orphanPlan.adopted).length > 0) {
+			this.stampReasonlessParameterRefusals(currentState.resources, template);
+			if (backfillMaskedPropertyFingerprints(currentState.resources, template, backfillNoEchoValues) > 0) maskedFingerprintsBackfilled = true;
+		}
 		const orphansChanged = Object.keys(orphanPlan.adopted).length > 0 || (currentState.orphans ?? []).length !== orphanCountBeforeAdoption;
 		const resourceTypes = new Set(Object.values(effectiveTemplate.Resources || {}).map((r) => r.Type).filter((type) => type !== "AWS::CDK::Metadata"));
 		this.providerRegistry.validateResourceTypes(resourceTypes);
@@ -34216,7 +34578,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 				const skippedOutputsChanged = !skippedOutputsEqual(currentState.skippedOutputs, this.skippedOutputs);
 				const healedAttributesPending = this.hasUnpersistedHeals(currentState.resources);
 				const conditionVerdictsChanged = !conditionVerdictRecordsEqual(readRecordedConditionVerdicts(currentState), conditionVerdicts);
-				if (observedRefresh || conditionVerdictsChanged || outputsChanged || exportSetChanged || skippedOutputsChanged || orphansChanged || healedAttributesPending) try {
+				if (observedRefresh || maskedFingerprintsBackfilled || conditionVerdictsChanged || outputsChanged || exportSetChanged || skippedOutputsChanged || orphansChanged || healedAttributesPending) try {
 					const refreshedState = {
 						version: 10,
 						region: this.stackRegion,
@@ -34573,6 +34935,7 @@ var DeployEngine = class {
 	noEchoAttributeResources = /* @__PURE__ */ new Map();
 	perResourceTemplateProps = /* @__PURE__ */ new Map();
 	perResourceResolvedType = /* @__PURE__ */ new Map();
+	fingerprintNoEchoValues = void 0;
 	outputSecrets = /* @__PURE__ */ new Map();
 	outputsPassSecretMaps = [];
 	outputsTemplateSource = Object.create(null);
@@ -34620,6 +34983,7 @@ var DeployEngine = class {
 		this.noEchoAttributeResources = /* @__PURE__ */ new Map();
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
 		this.perResourceResolvedType = /* @__PURE__ */ new Map();
+		this.fingerprintNoEchoValues = void 0;
 		this.attemptedResolvedProps = /* @__PURE__ */ new Map();
 		this.liveTaskLabels = /* @__PURE__ */ new Map();
 		this.outputSecrets = /* @__PURE__ */ new Map();
@@ -34646,13 +35010,15 @@ var DeployEngine = class {
 		for (const [logicalId, record] of Object.entries(state.resources)) {
 			const secrets = this.perResourceSecrets.get(logicalId);
 			const templateProps = this.perResourceTemplateProps.get(logicalId);
-			resources[logicalId] = scrubResourceRecord(this.withHealedAttributes(logicalId, record), secrets ?? /* @__PURE__ */ new Map(), templateProps);
+			const scrubbed = scrubResourceRecord(this.withHealedAttributes(logicalId, record), secrets ?? /* @__PURE__ */ new Map(), templateProps);
+			resources[logicalId] = withMaskedPropertyFingerprints(scrubbed, record.properties, templateProps, secrets, this.fingerprintNoEchoValues);
 		}
 		const orphans = state.orphans?.map((entry) => {
 			const sameResource = this.perResourceResolvedType.get(entry.logicalId) === entry.state.resourceType;
+			const orphanTemplateProps = sameResource ? this.perResourceTemplateProps.get(entry.logicalId) : void 0;
 			return {
 				...entry,
-				state: scrubResourceRecord(entry.state, (sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), sameResource ? this.perResourceTemplateProps.get(entry.logicalId) : void 0)
+				state: withMaskedPropertyFingerprints(scrubResourceRecord(entry.state, (sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), orphanTemplateProps), entry.state.properties, orphanTemplateProps, sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0, sameResource ? this.fingerprintNoEchoValues : void 0)
 			};
 		});
 		const outputs = this.redactOutputs(state.outputs);
@@ -34825,5 +35191,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { nestedChildStackName as $, importableOutputs as $a, describeTypeWithThrottleRetry as $i, coerceParameterTypedValue as $n, resolveStateBucketWithDefaultAndSource as $o, refuseMalformedOutputs as $r, acquireIdempotencyToken as $t, ECR_AUTO_DELETE_IMAGES_TAG as A, pathCrossesDottedKey as Aa, findReplacedReadersOfRecreateTargets as Ai, reEnableInstanceApiTermination as An, formatDockerLoginError as Ao, malformedLocalResourceEntriesWarning as Ar, DeploymentEventsStore as At, gray as B, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ba, toFiniteNumber as Bi, explicitRoleArnOrThrow as Bn, escapeRegExp$2 as Bo, malformedResourceEntriesWarning as Br, noEchoParameterValueSeed as Bt, deleteBudgetKey as C, markSameGenerationBag as Ca, unreadableResourceEntries as Ci, isWaitAbandonedError as Cn, buildDockerImage as Co, hasReadableResources as Cr, absoluteAssemblyPathEscape as Cs, effectiveDeletionPolicy as Ct, INDEX_SETTLE_POLL_INTERVAL_MS as D, DYNAMIC_REFERENCE_TOKEN_SCAN as Da, withoutSilentDropProperties as Di, isTerminationProtectionPropagationError as Dn, describeDockerFailure as Do, malformedExportNamesWarning as Dr, resolveAssemblyPath as Ds, updatePartialMessage as Dt, DELETE_INDEX_WAIT_PROCEED_NOTE as E, recoverMaskedOutput as Ea, unwrittenCreateOnlyReplacement as Ei, ec2InstanceProtectionSite as En, describeDockerExecFailure as Eo, malformedDriftResourcePropertiesWarning as Er, renderAssemblyPathEscape as Es, unsupportedFinalSnapshotError as Et, markRefusedBeforeApplying as F, recordNoEchoAttributeValues as Fa, renderStatefulReason as Fi, producerRegionsFromState as Fn, redactDockerArgvValues as Fo, malformedOrphansRefusalMessage as Fr, secretBearing as Ft, namesAnyDeclaredParameter as G, rebuildClientForBucketRegion as Ga, configStringRefusal as Gi, callerEnvCredentials as Gn, synthesisStatusMessage as Go, previewableOrphanRecords as Gr, DEFAULT_RESOURCE_TIMEOUT_MS as Gt, red as H, LockManager as Ha, coerceCfnInteger as Hi, sendableAssumeRoleCommand as Hn, AssetManifestLoader as Ho, malformedResourcesWarning as Hr, collectPublishedOutputNames as Ht, formatResourceLine as I, STATE_SOURCED_BASELINE_RULES as Ia, WARM_THROUGHPUT_MEMBERS as Ii, regionLessSecretName as In, redactedDockerCause as Io, malformedOrphansWarning as Ir, secretBearingStateKeyWarning as It, makeSiblingClaimReader as J, exportNamesCarriedFrom as Ja, requireConfigArray as Ji, s3BucketArn as Jn, resolveApp as Jo, refuseMalformedOrphanRecords as Jr, RollbackInlinePolicyWriters as Jt, reachableDivergentParameters as K, acceptedCreateOnlyDropsOf as Ka, readConfigString as Ki, envCredentialsAreAssumedRole as Kn, getDefaultStateBucketName as Ko, refuseDivergentRecordRegionForDestroy as Kr, DEFAULT_RESOURCE_WARN_AFTER_MS as Kt, createReadOnlyAttributeHealerFactory as L, STATE_SOURCED_CROSS_GENERATION_RULES as La, coerceWarmThroughput as Li, applyRoleArnIfSet as Ln, runDockerForeground as Lo, malformedOutputsRefusalMessage as Lr, secretSafeKeyDisplay as Lt, hasCdkAutoDeleteTag as M, carriesSecretMask as Ma, MULTI_REGION_RECREATE_BLOCKED_TYPES as Mi, INTRINSIC_KEYS as Mn, isDockerClientEnvKey as Mo, malformedOrphanRecordsRefusalMessage as Mr, WITHHELD_NAME_DISPLAY as Mt, isTruthyCfnBoolean as N, recordMaskOnlyValue as Na, isStatefulRecreateTargetForReplace as Ni, IntrinsicFunctionResolver as Nn, isMalformedEnvKey as No, malformedOrphanRecordsWarning as Nr, displayTextOrWithheld as Nt, deleteTableWithIndexBusyRetry as O, dynamicReferenceTokens as Oa, NO_CC_HANDLERS_REASON as Oi, observeThenDisableInstanceApiTermination as On, dockerSpawnEnvWithSensitive as Oo, malformedExportSourceWarning as Or, clearBucketRegionCache as Os, updatePartialReason as Ot, getPriorAttempts as P, recordMaskOnlyValuesIn as Pa, isStatefulRecreateTargetSync as Pi, classifyReplaySecretRegion as Pn, partitionSensitiveEnv as Po, malformedOrphanRowsKeptWarning as Pr, exportAliasCollisionScrubWarning as Pt, getNestedRevertRun as Q, importableOutputKeys as Qa, templateResourceTypes as Qi, s3BucketWebsiteUrl as Qn, resolveStateBucketWithDefault as Qo, refuseMalformedOrphansForOrphan as Qr, withCreateTokenLedger as Qt, bold as R, STATE_SOURCED_READBACK_RULES as Ra, isWarmThroughputDecrease as Ri, assertFlagRoleArn as Rn, runDockerStreaming as Ro, malformedOutputsWarning as Rr, exportNameSecretExposure as Rt, compensateRemovedDeletionProtection as S, maskSecretsInText as Sa, unreadableOrphanRecords as Si, withIndeterminateGuard as Sn, buildDenyExternalAccessPolicy as So, hasReadableOutputs as Sr, ownValue as Ss, createPreDeleteFinalSnapshot as St, resolveDynamoDbDeleteBudgetMs as T, scrubResourceRecord as Ta, findSilentDropProperties as Ti, disableInstanceApiTermination as Tn, describeDockerCapturedOutput as To, isReadableResourceEntry as Tr, displayAssemblyPath as Ts, refusesFinalSnapshot as Tt, yellow as U, isLockInfoExpired as Ua, configBooleanRefusal as Ui, AWS_CREDENTIAL_ENV_KEYS as Un, getDockerImageBySourceHash as Uo, malformedScrubResourceEntriesRefusalMessage as Ur, isExportAliasCollision as Ut, green as V, isSingleDynamicReferenceToken as Va, coerceCfnBoolean as Vi, isIamRoleArn as Vn, stripControlChars as Vo, malformedResourcePropertiesWarning as Vr, collectDeclaredOutputNames as Vt, computeParameterTaint as W, S3StateBackend as Wa, configIntegerRefusal as Wi, applyCallerIdentityCredentials as Wn, Synthesizer as Wo, malformedStateRefusalMessage as Wr, bindingSkippedOutputs as Wt, NESTED_PENDING_PARENT_REASON as X, hasReasonlessBaselineRefusal as Xa, requireConfigString as Xi, s3BucketDualStackDomainName as Xn, resolveCaptureObservedState as Xo, refuseMalformedOrphans as Xr, ledgerForStack as Xt, planOrphanAdoption as Y, hasReadableExportSet as Ya, requireConfigObject as Yi, s3BucketDomainName as Yn, resolveAutoAssetStorage as Yo, refuseMalformedOrphanRecordsForDestroy as Yr, earliestDefined as Yt, dropSettledNestedJournals as Z, hasUnverifiableParameterRefusal as Za, prefetchCreateOnlyPropertyPaths as Zi, s3BucketRegionalDomainName as Zn, resolveSkipPrefix as Zo, refuseMalformedOrphansForDestroy as Zr, reserveStackCreateToken as Zt, perType as _, recordLogOnlyValue as _a, repairMalformedOutputsForReadOnly as _i, ccProtectionRegistryTypes as _n, isCrossRegionRedirect as _o, UNREADABLE_ORPHANS_CONTAINER_ROW as _r, processStackMessages as _s, inheritProducerRegions as _t, conditionInputsFrom as a, DagBuilder as aa, refuseMalformedResourceEntriesForImport as ai, tagMapAsList as an, isSensitiveAttributeName as ao, carriesFetchableDynamicReference as ar, CFN_TEMPLATE_URL_LIMIT as as, replayFailedOperations as at, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as b, errorCauseChain as ba, repairMalformedResourcesForReadOnly as bi, deleteIndeterminateGuards as bn, validateAssetBucketName as bo, displayLogicalId as br, hasPlainPrototype$1 as bs, buildFinalSnapshotIdentifier as bt, isSecretBearingReferenceString as c, inheritNestedStackParameterAssociations as ca, refuseMalformedResourcePropertiesForDrift as ci, stringifyIfAssigned as cn, buildAssetRedirectMap as co, AWS_NO_VALUE as cr, uploadCfnTemplate as cs, destroyStackRecordsView as ct, makeCanonicalizePropertiesFn as d, createUnionSecretMasker as da, refuseMalformedResourcesForDeploy as di, ccBrokenReason as dn, rewriteTemplateAssetReferences as do, refStateLookupFromResource as dr, expectedOwnerParam as ds, recordAfterRollbackUpdate as dt, withRetry as ea, refuseMalformedOutputsForDestroy as ei, DBPROXY_TAGS_WHAT as en, isReadableBag as eo, isUnboundTemplateParameter as er, resolveUseCdkBootstrapAssets as es, revertNestedChildFromJournal as et, withResourceDeadline as f, hasMaskableValues as fa, refuseMalformedResourcesForDestroy as fi, wouldReturnToSdkProvider as fn, AssetModeResolver as fo, parseWebACLArn as fr, PARTITION_TABLE as fs, planFailedOps as ft, isProtectionValueActive as g, recordLogOnlyParameterValue as ga, repairMalformedOrphansForReadOnly as gi, slowCcOperationTimeoutMs as gn, getBootstrapMarkerKey as go, STATE_RESOURCES_MALFORMED as gr, StageLoadError as gs, getCurrentProducerRegions as gt, PROTECTION_PROPERTY_BY_TYPE as h, printingCorpusOf as ha, repairMalformedOrphanRecordsForReadOnly as hi, CloudControlProvider as hn, ensureAssetStorage as ho, STATE_REGION_DIVERGED as hr, AssemblyReader as hs, findNestedStackTypeChanges as ht, conditionFingerprint as i, sameLambdaFunctionAddress as ia, refuseMalformedResourceEntriesForDestroy as ii, refuseMalformedDesiredTags as in, AssetPublisher as io, carriesDynamicReference as ir, CFN_TEMPLATE_BODY_LIMIT as is, withNestedStackContext as it, S3_AUTO_DELETE_OBJECTS_TAG as j, identityKeyFor as ja, shownType as ji, DiffCalculator as jn, getDockerCmd as jo, malformedLocalResourcesWarning as jr, extractDeploymentEventError as jt, waitForIndexesSettled as k, isUncertifiedBaselineMaskPosition as ka, hasNoCloudControlHandlers as ki, reDisableInstanceApiTermination as kn, finchSecretArgvRefusal as ko, malformedLocalOutputsWarning as kr, resolveBucketRegion as ks, DeploymentEventsReader as kt, keptWholeReasonText as l, recordNestedStackParameterExpressions as la, refuseMalformedResourcePropertiesForExport as li, CC_BROKEN_REASON as ln, createAssetRedirectResolver as lo, cfnRefValueFromPhysicalId as lr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ls, getStackRecords as lt, recordedProtectionNote as m, logOnlyValueCount as ma, refuseMalformedState as mi, getCurrentResourceSecrets as mn, assertAssetBucketRegion as mo, JSON_LISTING_HOLE_VALUE as mr, derivePartitionAndUrlSuffix as ms, resolveReplacementOldType as mt, IMPLICIT_DELETE_DEPENDENCIES as n, canonicalLambdaFunctionName as na, refuseMalformedResourceEntries as ni, planTagDiff as nn, orphansCarriedFrom as no, getAccountInfo as nr, warnDeprecatedNoPrefixCliFlag as ns, withNestedRevertRun as nt, parentSuppliedValues as o, TemplateParser as oa, refuseMalformedResourceEntriesForImportSave as oi, tagPlanWarning as on, stringifyValue as oo, isNamelessDynamicReferenceError as or, MIGRATE_TMP_PREFIX as os, replayRollback as ot, recordedProtectionEvidence as p, literalSplitDelimitersOf as pa, refuseMalformedResourcesForExport as pi, isCustomResourceType as pn, BOOTSTRAP_MARKER_PREFIX as po, withSharedDrainBudget as pr, canonicalizeRegion as ps, planRollback as pt, resourcesNamingDeclaredParameter as q, describeRegionValueKind as qa, replayWarn as qi, isSettledInstanceState as qn, getLegacyStateBucketName as qo, refuseMalformedNestedChildOutputs as qr, maskingRetryLogger as qt, computeImplicitDeleteEdges as r, lambdaFunctionNameForMask as ra, refuseMalformedResourceEntriesForDeploy as ri, readTagList as rn, shouldRetainResource as ro, isImpossibleEmptyStoredAttribute as rr, ssmResolvedValueType as rs, getCurrentNestedStackContext as rt, readRecordedConditionVerdicts as s, liveMatchesUnresolvedTokenFrame as sa, refuseMalformedResourceEntriesForOrphan as si, definedAttributes as sn, WorkGraph as so, keepsSecretReferenceToken as sr, findLargeInlineResources as ss, awaitInFlightSibling as st, DeployEngine as t, markAuxiliaryFailure as ta, refuseMalformedResourceAttributesForOrphan as ti, DBPROXY_TAG_OPTIONS as tn, orphansAfterRollback as to, parameterTypeMayLoseSecretIdentity as tr, stateBucketExistenceConfirmed as ts, revertedNestedRowIds as tt, mergeNoChangeOutputs as u, carryLogOnlyValues as ua, refuseMalformedResourcePropertiesForOrphan as ui, ProviderRegistry as un, loadPublishableAssetManifest as uo, isStalePlaceholderArnAttribute as ur, decodeListingKey as us, withStackRecords as ut, readProtection as v, shareLogOnlyValues as va, repairMalformedResourceEntriesForReadOnly as vi, unchangedBehindSecretReference as vn, parseBootstrapMarker as vo, UNREADABLE_RESOURCES_MAP_ROW as vr, defineOwnKey as vs, ATOMIC_FINAL_SNAPSHOT_TYPES as vt, resolveDynamoDbDeleteBudgetClock as w, redactSecretsForState as wa, findActionableSilentDrops as wi, markWaitAbandoned as wn, resolveDockerContextDirectory as wo, isReadableOrphanRecord as wr, describeFileReadFailure as ws, isFinalSnapshotError as wt, beginDeleteWait as x, maskSecretsInError as xa, unpreviewableOrphanRecords as xi, deleteSkipReason as xn, validateContainerRepoName as xo, hasReadableOrphans as xr, nullPrototypeRecord as xs, ccRoutedFinalSnapshotError as xt, DynamoDBGlobalTableProvider as y, createSecretMasker as ya, repairMalformedResourcePropertiesForReadOnly as yi, UNSPECIFIED_SKIP_REASON as yn, readBootstrapMarkerBody as yo, deployRefusesOrphanRowsReason as yr, hasOwnKey as ys, PRE_DELETE_SNAPSHOT_TYPES as yt, cyan as z, TEMPLATE_SOURCED_RULES as za, toCfnInteger as zi, assertSendableRoleArn as zn, warnFinchArgvExposure as zo, malformedRenderedContainersWarning as zr, isWholeDynamicReferenceValue as zt };
-//# sourceMappingURL=deploy-engine-BTOCDCWf.js.map
+export { nestedChildStackName as $, hasReadableExportSet as $a, requireConfigObject as $i, s3BucketDomainName as $n, resolveAutoAssetStorage as $o, refuseMalformedOrphanRecordsForDestroy as $r, earliestDefined as $t, ECR_AUTO_DELETE_IMAGES_TAG as A, recoverMaskedOutput as Aa, unwrittenCreateOnlyReplacement as Ai, ec2InstanceProtectionSite as An, describeDockerExecFailure as Ao, malformedDriftResourcePropertiesWarning as Ar, renderAssemblyPathEscape as As, redactedDeleteAddressSkip as At, gray as B, STATE_SOURCED_BASELINE_RULES as Ba, WARM_THROUGHPUT_MEMBERS as Bi, regionLessSecretName as Bn, redactedDockerCause as Bo, malformedOrphansWarning as Br, secretBearingStateKeyWarning as Bt, deleteBudgetKey as C, createSecretMasker as Ca, repairMalformedResourcePropertiesForReadOnly as Ci, UNSPECIFIED_SKIP_REASON as Cn, readBootstrapMarkerBody as Co, deployRefusesOrphanRowsReason as Cr, hasOwnKey as Cs, effectiveDeletionPolicy as Ct, INDEX_SETTLE_POLL_INTERVAL_MS as D, markSameGenerationBag as Da, unreadableResourceEntries as Di, isWaitAbandonedError as Dn, buildDockerImage as Do, hasReadableResources as Dr, absoluteAssemblyPathEscape as Ds, REDACTED_DELETE_ADDRESS_SKIP_REASON as Dt, DELETE_INDEX_WAIT_PROCEED_NOTE as E, maskSecretsInText as Ea, unreadableOrphanRecords as Ei, withIndeterminateGuard as En, buildDenyExternalAccessPolicy as Eo, hasReadableOutputs as Er, ownValue as Es, unsupportedFinalSnapshotError as Et, markRefusedBeforeApplying as F, identityKeyFor as Fa, shownType as Fi, DiffCalculator as Fn, getDockerCmd as Fo, malformedLocalResourcesWarning as Fr, extractDeploymentEventError as Ft, namesAnyDeclaredParameter as G, isSingleDynamicReferenceToken as Ga, coerceCfnBoolean as Gi, isIamRoleArn as Gn, stripControlChars as Go, malformedResourcePropertiesWarning as Gr, collectDeclaredOutputNames as Gt, red as H, STATE_SOURCED_READBACK_RULES as Ha, isWarmThroughputDecrease as Hi, assertFlagRoleArn as Hn, runDockerStreaming as Ho, malformedOutputsWarning as Hr, exportNameSecretExposure as Ht, formatResourceLine as I, carriesSecretMask as Ia, MULTI_REGION_RECREATE_BLOCKED_TYPES as Ii, INTRINSIC_KEYS as In, isDockerClientEnvKey as Io, malformedOrphanRecordsRefusalMessage as Ir, WITHHELD_NAME_DISPLAY as It, makeSiblingClaimReader as J, S3StateBackend as Ja, configIntegerRefusal as Ji, applyCallerIdentityCredentials as Jn, Synthesizer as Jo, malformedStateRefusalMessage as Jr, bindingSkippedOutputs as Jt, reachableDivergentParameters as K, LockManager as Ka, coerceCfnInteger as Ki, sendableAssumeRoleCommand as Kn, AssetManifestLoader as Ko, malformedResourcesWarning as Kr, collectPublishedOutputNames as Kt, createReadOnlyAttributeHealerFactory as L, recordMaskOnlyValue as La, isStatefulRecreateTargetForReplace as Li, IntrinsicFunctionResolver as Ln, isMalformedEnvKey as Lo, malformedOrphanRecordsWarning as Lr, displayTextOrWithheld as Lt, hasCdkAutoDeleteTag as M, dynamicReferenceTokens as Ma, NO_CC_HANDLERS_REASON as Mi, observeThenDisableInstanceApiTermination as Mn, dockerSpawnEnvWithSensitive as Mo, malformedExportSourceWarning as Mr, clearBucketRegionCache as Ms, updatePartialReason as Mt, isTruthyCfnBoolean as N, isUncertifiedBaselineMaskPosition as Na, hasNoCloudControlHandlers as Ni, reDisableInstanceApiTermination as Nn, finchSecretArgvRefusal as No, malformedLocalOutputsWarning as Nr, resolveBucketRegion as Ns, DeploymentEventsReader as Nt, deleteTableWithIndexBusyRetry as O, redactSecretsForState as Oa, findActionableSilentDrops as Oi, markWaitAbandoned as On, resolveDockerContextDirectory as Oo, isReadableOrphanRecord as Or, describeFileReadFailure as Os, isRedactedRecordedValue as Ot, getPriorAttempts as P, pathCrossesDottedKey as Pa, findReplacedReadersOfRecreateTargets as Pi, reEnableInstanceApiTermination as Pn, formatDockerLoginError as Po, malformedLocalResourceEntriesWarning as Pr, DeploymentEventsStore as Pt, getNestedRevertRun as Q, exportNamesCarriedFrom as Qa, requireConfigArray as Qi, s3BucketArn as Qn, resolveApp as Qo, refuseMalformedOrphanRecords as Qr, RollbackInlinePolicyWriters as Qt, bold as R, recordMaskOnlyValuesIn as Ra, isStatefulRecreateTargetSync as Ri, classifyReplaySecretRegion as Rn, partitionSensitiveEnv as Ro, malformedOrphanRowsKeptWarning as Rr, exportAliasCollisionScrubWarning as Rt, compensateRemovedDeletionProtection as S, shareLogOnlyValues as Sa, repairMalformedResourceEntriesForReadOnly as Si, unchangedBehindSecretReference as Sn, parseBootstrapMarker as So, UNREADABLE_RESOURCES_MAP_ROW as Sr, defineOwnKey as Ss, createPreDeleteFinalSnapshot as St, resolveDynamoDbDeleteBudgetMs as T, maskSecretsInError as Ta, unpreviewableOrphanRecords as Ti, deleteSkipReason as Tn, validateContainerRepoName as To, hasReadableOrphans as Tr, nullPrototypeRecord as Ts, refusesFinalSnapshot as Tt, yellow as U, TEMPLATE_SOURCED_RULES as Ua, toCfnInteger as Ui, assertSendableRoleArn as Un, warnFinchArgvExposure as Uo, malformedRenderedContainersWarning as Ur, isWholeDynamicReferenceValue as Ut, green as V, STATE_SOURCED_CROSS_GENERATION_RULES as Va, coerceWarmThroughput as Vi, applyRoleArnIfSet as Vn, runDockerForeground as Vo, malformedOutputsRefusalMessage as Vr, secretSafeKeyDisplay as Vt, computeParameterTaint as W, WHOLE_DYNAMIC_REFERENCE_PATTERN as Wa, toFiniteNumber as Wi, explicitRoleArnOrThrow as Wn, escapeRegExp$2 as Wo, malformedResourceEntriesWarning as Wr, noEchoParameterValueSeed as Wt, NESTED_PENDING_PARENT_REASON as X, acceptedCreateOnlyDropsOf as Xa, readConfigString as Xi, envCredentialsAreAssumedRole as Xn, getDefaultStateBucketName as Xo, refuseDivergentRecordRegionForDestroy as Xr, DEFAULT_RESOURCE_WARN_AFTER_MS as Xt, planOrphanAdoption as Y, rebuildClientForBucketRegion as Ya, configStringRefusal as Yi, callerEnvCredentials as Yn, synthesisStatusMessage as Yo, previewableOrphanRecords as Yr, DEFAULT_RESOURCE_TIMEOUT_MS as Yt, dropSettledNestedJournals as Z, describeRegionValueKind as Za, replayWarn as Zi, isSettledInstanceState as Zn, getLegacyStateBucketName as Zo, refuseMalformedNestedChildOutputs as Zr, maskingRetryLogger as Zt, perType as _, literalSplitDelimitersOf as _a, refuseMalformedResourcesForExport as _i, isCustomResourceType as _n, BOOTSTRAP_MARKER_PREFIX as _o, withSharedDrainBudget as _r, canonicalizeRegion as _s, inheritProducerRegions as _t, conditionInputsFrom as a, markAuxiliaryFailure as aa, refuseMalformedResourceAttributesForOrphan as ai, DBPROXY_TAG_OPTIONS as an, orphansAfterRollback as ao, parameterTypeMayLoseSecretIdentity as ar, stateBucketExistenceConfirmed as as, replayFailedOperations as at, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as b, recordLogOnlyParameterValue as ba, repairMalformedOrphansForReadOnly as bi, slowCcOperationTimeoutMs as bn, getBootstrapMarkerKey as bo, STATE_RESOURCES_MALFORMED as br, StageLoadError as bs, buildFinalSnapshotIdentifier as bt, isSecretBearingReferenceString as c, sameLambdaFunctionAddress as ca, refuseMalformedResourceEntriesForDestroy as ci, refuseMalformedDesiredTags as cn, AssetPublisher as co, carriesDynamicReference as cr, CFN_TEMPLATE_BODY_LIMIT as cs, destroyStackRecordsView as ct, makeCanonicalizePropertiesFn as d, liveMatchesUnresolvedTokenFrame as da, refuseMalformedResourceEntriesForOrphan as di, definedAttributes as dn, WorkGraph as do, keepsSecretReferenceToken as dr, findLargeInlineResources as ds, recordAfterRollbackUpdate as dt, requireConfigString as ea, refuseMalformedOrphans as ei, ledgerForStack as en, hasReasonlessBaselineRefusal as eo, s3BucketDualStackDomainName as er, resolveCaptureObservedState as es, revertNestedChildFromJournal as et, withResourceDeadline as f, inheritNestedStackParameterAssociations as fa, refuseMalformedResourcePropertiesForDrift as fi, stringifyIfAssigned as fn, buildAssetRedirectMap as fo, AWS_NO_VALUE as fr, uploadCfnTemplate as fs, planFailedOps as ft, isProtectionValueActive as g, hasMaskableValues as ga, refuseMalformedResourcesForDestroy as gi, wouldReturnToSdkProvider as gn, AssetModeResolver as go, parseWebACLArn as gr, PARTITION_TABLE as gs, getCurrentProducerRegions as gt, PROTECTION_PROPERTY_BY_TYPE as h, createUnionSecretMasker as ha, refuseMalformedResourcesForDeploy as hi, ccBrokenReason as hn, rewriteTemplateAssetReferences as ho, refStateLookupFromResource as hr, expectedOwnerParam as hs, findNestedStackTypeChanges as ht, conditionFingerprint as i, withRetry as ia, refuseMalformedOutputsForDestroy as ii, DBPROXY_TAGS_WHAT as in, isReadableBag as io, isUnboundTemplateParameter as ir, resolveUseCdkBootstrapAssets as is, withNestedStackContext as it, S3_AUTO_DELETE_OBJECTS_TAG as j, DYNAMIC_REFERENCE_TOKEN_SCAN as ja, withoutSilentDropProperties as ji, isTerminationProtectionPropagationError as jn, describeDockerFailure as jo, malformedExportNamesWarning as jr, resolveAssemblyPath as js, updatePartialMessage as jt, waitForIndexesSettled as k, scrubResourceRecord as ka, findSilentDropProperties as ki, disableInstanceApiTermination as kn, describeDockerCapturedOutput as ko, isReadableResourceEntry as kr, displayAssemblyPath as ks, redactedDeleteAddressFields as kt, keptWholeReasonText as l, DagBuilder as la, refuseMalformedResourceEntriesForImport as li, tagMapAsList as ln, isSensitiveAttributeName as lo, carriesFetchableDynamicReference as lr, CFN_TEMPLATE_URL_LIMIT as ls, getStackRecords as lt, recordedProtectionNote as m, carryLogOnlyValues as ma, refuseMalformedResourcePropertiesForOrphan as mi, ProviderRegistry as mn, loadPublishableAssetManifest as mo, isStalePlaceholderArnAttribute as mr, decodeListingKey as ms, resolveReplacementOldType as mt, IMPLICIT_DELETE_DEPENDENCIES as n, templateResourceTypes as na, refuseMalformedOrphansForOrphan as ni, withCreateTokenLedger as nn, importableOutputKeys as no, s3BucketWebsiteUrl as nr, resolveStateBucketWithDefault as ns, withNestedRevertRun as nt, parentSuppliedValues as o, canonicalLambdaFunctionName as oa, refuseMalformedResourceEntries as oi, planTagDiff as on, orphansCarriedFrom as oo, getAccountInfo as or, warnDeprecatedNoPrefixCliFlag as os, replayRollback as ot, recordedProtectionEvidence as p, recordNestedStackParameterExpressions as pa, refuseMalformedResourcePropertiesForExport as pi, CC_BROKEN_REASON as pn, createAssetRedirectResolver as po, cfnRefValueFromPhysicalId as pr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ps, planRollback as pt, resourcesNamingDeclaredParameter as q, isLockInfoExpired as qa, configBooleanRefusal as qi, AWS_CREDENTIAL_ENV_KEYS as qn, getDockerImageBySourceHash as qo, malformedScrubResourceEntriesRefusalMessage as qr, isExportAliasCollision as qt, computeImplicitDeleteEdges as r, describeTypeWithThrottleRetry as ra, refuseMalformedOutputs as ri, acquireIdempotencyToken as rn, importableOutputs as ro, coerceParameterTypedValue as rr, resolveStateBucketWithDefaultAndSource as rs, getCurrentNestedStackContext as rt, readRecordedConditionVerdicts as s, lambdaFunctionNameForMask as sa, refuseMalformedResourceEntriesForDeploy as si, readTagList as sn, shouldRetainResource as so, isImpossibleEmptyStoredAttribute as sr, ssmResolvedValueType as ss, awaitInFlightSibling as st, DeployEngine as t, prefetchCreateOnlyPropertyPaths as ta, refuseMalformedOrphansForDestroy as ti, reserveStackCreateToken as tn, hasUnverifiableParameterRefusal as to, s3BucketRegionalDomainName as tr, resolveSkipPrefix as ts, revertedNestedRowIds as tt, mergeNoChangeOutputs as u, TemplateParser as ua, refuseMalformedResourceEntriesForImportSave as ui, tagPlanWarning as un, stringifyValue as uo, isNamelessDynamicReferenceError as ur, MIGRATE_TMP_PREFIX as us, withStackRecords as ut, readProtection as v, logOnlyValueCount as va, refuseMalformedState as vi, getCurrentResourceSecrets as vn, assertAssetBucketRegion as vo, JSON_LISTING_HOLE_VALUE as vr, derivePartitionAndUrlSuffix as vs, ATOMIC_FINAL_SNAPSHOT_TYPES as vt, resolveDynamoDbDeleteBudgetClock as w, errorCauseChain as wa, repairMalformedResourcesForReadOnly as wi, deleteIndeterminateGuards as wn, validateAssetBucketName as wo, displayLogicalId as wr, hasPlainPrototype$1 as ws, isFinalSnapshotError as wt, beginDeleteWait as x, recordLogOnlyValue as xa, repairMalformedOutputsForReadOnly as xi, ccProtectionRegistryTypes as xn, isCrossRegionRedirect as xo, UNREADABLE_ORPHANS_CONTAINER_ROW as xr, processStackMessages as xs, ccRoutedFinalSnapshotError as xt, DynamoDBGlobalTableProvider as y, printingCorpusOf as ya, repairMalformedOrphanRecordsForReadOnly as yi, CloudControlProvider as yn, ensureAssetStorage as yo, STATE_REGION_DIVERGED as yr, AssemblyReader as ys, PRE_DELETE_SNAPSHOT_TYPES as yt, cyan as z, recordNoEchoAttributeValues as za, renderStatefulReason as zi, producerRegionsFromState as zn, redactDockerArgvValues as zo, malformedOrphansRefusalMessage as zr, secretBearing as zt };
+//# sourceMappingURL=deploy-engine-RCOtmm4V.js.map