@go-to-k/cdkd 0.295.0 → 0.296.0

package/dist/{deploy-engine-CuI_h_Ml.js → deploy-engine-D7204v7Z.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js";
-import { A as displaySafe, E as UNRENDERABLE, F as safeMsg, L as truncateCodePoints, M as isPasteableIdent, O as displayAwsMessage, P as plainIdentOr, S as withoutGeneratedFallbackName, T as STACK_REF_MAX_CODE_POINTS, _ as getCurrentSkipPrefix, b as withSkipPrefix, c as getLiveRenderer, f as applyDefaultNameForFallback, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, m as explicitNamePropertyFor, n as getLogger, r as isStdoutReservedForPayload, s as installLogLineMaskerSource, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS, x as withStackName, y as looksLikeCdkdGeneratedName } from "./logger-B46YMG0h.js";
-import { $t as StateError, A as isTerminalDeleteFailure, An as isAmbiguousCcHandlerErrorCode, At as clientDefaultsFor, Bn as isMarkedNonRetryable, Bt as IntrinsicResolutionRefusalError, C as refusalTypeShown, Cn as isNameCollisionErrorFrom, D as ProtectionFlipRegistry, Dt as withPasteableAwsProfile, En as isReplayedNameCollisionFrom, Fn as retryClassificationText, Gt as MalformedProducerRecordRefusalError, H as pasteableAwsCommand, Hn as markNonRetryable, In as describeAwsFailure, It as CrossAccountSecretRefusalError, J as isInterruptedWaitError, Jt as ProvisioningError, Lt as DependencyError, M as observeThenDisableProtection, Mn as isIamPropagationError, Mt as AccountIdUnavailableError, N as protectionFlipKey, Nn as isRetryableTransientError, Nt as AssetError, O as compensateProtectionFlip, On as markReplayMayCollide, Ot as ambientClientDefaults, Pn as isTransientServerError, Pt as CdkdError, Q as canonicalizeRoute53QueryName, R as DELETION_PROTECTION_DOC_POINTER, Rn as safeStringify$1, S as quotedRemedyLogicalId, Sn as hasReplayMayCollide, St as injectiveKey, T as resolveExplicitPhysicalId, Tn as isRecreateRetryableError, Tt as producerRecordKey, U as protectedReplacementAdvice, Un as markRedactedCause, Ut as LockError, Vn as isThrottlingError, Wn as wrapMaskedAwsError, Wt as MacroExpansionError, X as ElapsedBudgetRegistry, Xt as ResourceUpdateNotSupportedError, Y as startInterruptWatch, Yt as ResourceTimeoutError, Z as monotonicNowMs, _n as shellQuote, _t as formatLockOperation, at as segmentAfterAnchor, b as isQuotableImportValue, bt as CUSTOM_RESOURCE_RESPONSE_PREFIX, cn as UNSHOWABLE_VALUE, ct as isSecretDerivedValue, d as prepareRemovalForUpdate, dn as isInertUnquoted, dt as withDerivedNameMasks, en as SynthesisError, et as compositeIdSeparatorRefusal, f as removalWarning, fn as pasteableCommand, ft as UNREPRODUCIBLE_LOCK_CLAUSE, g as assertRegionMatch, gn as shellBoundedDisplay, gt as formatLockExpiry, h as RESOURCE_NOT_FOUND, hn as quotedOrDescribed, i as holdsSecretDerivedEntry, it as resourceTypeShown, jn as isAmbiguousOutcomeError, jt as credentialFingerprint, k as deleteWithProtectionCompensation, kn as formatRetryClassificationSignals, kt as ambientCredentialConfig, l as withUnchangedSecretPrincipalLists, ln as commandHole, lt as maskDeep, m as withoutInjectedRemovals, mn as plainOrDescribed, nt as logicalIdShown, on as SHELL_ACTIVE, ot as createMaskedLogSinks, pn as physicalIdShownBesideCommand, pt as buildForceUnlockCommand, rn as normalizeAwsError, sn as SHELL_ACTIVE_WHY, st as createMaskedRetryLogger, ut as maskerOrIdentity, vn as withheldTargetClause, vt as formatLockOwner, wn as isNameCooldownError, x as normalizeAwsTagsToCfn, xn as isUpdateUnsupportedError, xt as DEFAULT_STATE_PREFIX, yt as sanitizeRecoveryValue, zt as DynamicReferenceRegionAmbiguousError } from "./iam-policy-targets-CMSQGQnm.js";
+import { A as displaySafe, E as UNRENDERABLE, F as safeMsg, L as truncateCodePoints, M as isPasteableIdent, O as displayAwsMessage, P as plainIdentOr, S as withoutGeneratedFallbackName, T as STACK_REF_MAX_CODE_POINTS, _ as getCurrentSkipPrefix, b as withSkipPrefix, c as getLiveRenderer, f as applyDefaultNameForFallback, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, m as explicitNamePropertyFor, n as getLogger, r as isStdoutReservedForPayload, s as installLogLineMaskerSource, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS, x as withStackName, y as looksLikeCdkdGeneratedName } from "./logger-Dvc7ddKe.js";
+import { $n as markRedactedCause, $t as LockError, A as isTerminalDeleteFailure, At as CUSTOM_RESOURCE_RESPONSE_PREFIX, Bn as isAmbiguousCcHandlerErrorCode, Bt as clientDefaultsFor, C as refusalTypeShown, Cn as physicalIdShownBesideCommand, Ct as buildForceUnlockCommand, D as ProtectionFlipRegistry, Dn as shellQuote, Dt as formatLockOperation, En as shellBoundedDisplay, Et as formatLockExpiry, Fn as isRecreateRetryableError, Ft as producerRecordKey, Gn as retryClassificationText, H as pasteableAwsCommand, Hn as isIamPropagationError, Ht as AccountIdUnavailableError, In as isReplayedNameCollisionFrom, J as isInterruptedWaitError, Jn as safeStringify$1, Kn as describeAwsFailure, Kt as CrossAccountSecretRefusalError, Lt as withPasteableAwsProfile, M as observeThenDisableProtection, Mn as hasReplayMayCollide, Mt as injectiveKey, N as protectionFlipKey, Nn as isNameCollisionErrorFrom, O as compensateProtectionFlip, On as withheldTargetClause, Ot as formatLockOwner, Pn as isNameCooldownError, Q as canonicalizeRoute53QueryName, Qn as markNonRetryable, R as DELETION_PROTECTION_DOC_POINTER, Rn as markReplayMayCollide, Rt as ambientClientDefaults, S as quotedRemedyLogicalId, Sn as pasteableCommand, St as UNREPRODUCIBLE_LOCK_CLAUSE, T as resolveExplicitPhysicalId, Tn as quotedOrDescribed, U as protectedReplacementAdvice, Un as isRetryableTransientError, Ut as AssetError, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, Wn as isTransientServerError, Wt as CdkdError, X as ElapsedBudgetRegistry, Xn as isMarkedNonRetryable, Xt as IntrinsicResolutionRefusalError, Y as startInterruptWatch, Yt as DynamicReferenceRegionAmbiguousError, Z as monotonicNowMs, Zn as isThrottlingError, _n as SHELL_ACTIVE_WHY, _t as hasCreatedBeforeFailure, an as ResourceTimeoutError, at as segmentAfterAnchor, b as isQuotableImportValue, bt as markAuxiliaryFailure, ct as createMaskedRetryLogger, d as prepareRemovalForUpdate, dt as maskerOrIdentity, en as MacroExpansionError, er as wrapMaskedAwsError, et as compositeIdSeparatorRefusal, f as removalWarning, ft as withDerivedNameMasks, g as assertRegionMatch, gn as SHELL_ACTIVE, gt as createdBeforeFailure, h as RESOURCE_NOT_FOUND, i as holdsSecretDerivedEntry, in as ProvisioningError, it as resourceTypeShown, jn as isUpdateUnsupportedError, jt as DEFAULT_STATE_PREFIX, k as deleteWithProtectionCompensation, kt as sanitizeRecoveryValue, l as withUnchangedSecretPrincipalLists, ln as StateError, lt as isSecretDerivedValue, m as withoutInjectedRemovals, mt as carryCreatedBeforeFailure, nt as logicalIdShown, on as ResourceUpdateNotSupportedError, ot as stateOrphanRecordRemedy, pn as normalizeAwsError, pt as RETRY_AUXILIARY_OWNER, qt as DependencyError, st as createMaskedLogSinks, tn as MalformedProducerRecordRefusalError, un as SynthesisError, ut as maskDeep, vn as UNSHOWABLE_VALUE, vt as isAuxiliaryFailure, wn as plainOrDescribed, x as normalizeAwsTagsToCfn, xn as isInertUnquoted, xt as markCreatedBeforeFailure, yn as commandHole, yt as isAuxiliaryMarkOf, zn as formatRetryClassificationSignals, zt as ambientCredentialConfig } from "./iam-policy-targets-DSDSdxXz.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-CMMITJVg.js";
+import { t as getCdkdVersion } from "./version-DUHDmEhz.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2705,7 +2705,7 @@ var FileAssetPublisher = class {
 
 //#endregion
 //#region src/utils/regexp.ts
-function escapeRegExp$2(value) {
+function escapeRegExp$3(value) {
 	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function stripControlChars(value) {
@@ -3123,7 +3123,7 @@ function trailingShortFlagOfCluster(arg) {
 	for (const flag of ARGV_VALUE_BEARING_FLAGS) if (flag.length === 2 && flag.startsWith("-") && flag[1] !== "-" && flag[1] === last) return flag;
 }
 const ARGV_VALUE_TOKEN_RE = (() => {
-	const alternation = [...ARGV_VALUE_BEARING_FLAGS].sort((a, b) => b.length - a.length || a.localeCompare(b)).map(escapeRegExp$2).join("|");
+	const alternation = [...ARGV_VALUE_BEARING_FLAGS].sort((a, b) => b.length - a.length || a.localeCompare(b)).map(escapeRegExp$3).join("|");
 	if (alternation.length === 0 || [...ARGV_VALUE_BEARING_FLAGS].some((f) => f.trim() === "")) throw new Error("ARGV_VALUE_BEARING_FLAGS is empty or holds an empty flag: the token scan would match every k=v");
 	return new RegExp(`(^|\\s)(${alternation})(\\s+|=)([^\\s=]*)=\\S*`, "g");
 })();
@@ -4133,10 +4133,10 @@ function flattenAssetPlaceholders(value, accountId, region, partition = "aws") {
 	return value.replace(/\$\{AWS::AccountId\}/g, accountId).replace(/\$\{AWS::Region\}/g, region).replace(/\$\{AWS::Partition\}/g, partition);
 }
 function isDefaultBootstrapBucketName(name, accountId, region) {
-	return new RegExp(`^cdk-[a-z0-9]+-assets-${accountId}-${escapeRegExp$2(region)}$`).test(name);
+	return new RegExp(`^cdk-[a-z0-9]+-assets-${accountId}-${escapeRegExp$3(region)}$`).test(name);
 }
 function isDefaultBootstrapRepoName(name, accountId, region) {
-	return new RegExp(`^cdk-[a-z0-9]+-container-assets-${accountId}-${escapeRegExp$2(region)}$`).test(name);
+	return new RegExp(`^cdk-[a-z0-9]+-container-assets-${accountId}-${escapeRegExp$3(region)}$`).test(name);
 }
 function buildAssetRedirectMap(manifest, marker, accountId, region, partition = "aws") {
 	const buckets = /* @__PURE__ */ new Map();
@@ -4145,7 +4145,7 @@ function buildAssetRedirectMap(manifest, marker, accountId, region, partition =
 	const addForms = (rawName, flattened, target) => {
 		sources.set(flattened, target);
 		if (rawName !== flattened) sources.set(rawName, target);
-		const suffixRe = new RegExp(`-${accountId}-${escapeRegExp$2(region)}$`);
+		const suffixRe = new RegExp(`-${accountId}-${escapeRegExp$3(region)}$`);
 		for (const suffix of [
 			"-${AWS::AccountId}-${AWS::Region}",
 			`-\${AWS::AccountId}-${region}`,
@@ -4186,7 +4186,7 @@ function buildAssetRedirectMap(manifest, marker, accountId, region, partition =
 	};
 }
 function buildBoundaryRegex(source) {
-	return new RegExp(`(?<![A-Za-z0-9_.-])${escapeRegExp$2(source)}(?![A-Za-z0-9_-])`, "g");
+	return new RegExp(`(?<![A-Za-z0-9_.-])${escapeRegExp$3(source)}(?![A-Za-z0-9_-])`, "g");
 }
 function rewriteString(value, map, counter) {
 	let result = value;
@@ -4803,6 +4803,14 @@ function refuseMalformedOperation(shownStack, where, op) {
 	const attempted = o["attemptedProperties"];
 	if (attempted !== void 0 && (typeof attempted !== "object" || attempted === null || Array.isArray(attempted))) fail("attemptedProperties", attempted, "an object when present");
 	if (o["oldResourceRetained"] !== void 0 && typeof o["oldResourceRetained"] !== "boolean") fail("oldResourceRetained", o["oldResourceRetained"], "a boolean when present");
+	if (o["physicalIdRecoveredFromError"] !== void 0 && typeof o["physicalIdRecoveredFromError"] !== "boolean") fail("physicalIdRecoveredFromError", o["physicalIdRecoveredFromError"], "a boolean when present");
+	if (o["physicalIdRecoveredFromError"] !== void 0 && o["changeType"] !== "CREATE") refuseMalformed(shownStack, `${where}.physicalIdRecoveredFromError is only valid on a CREATE (got changeType ${kind(o["changeType"])}).`);
+	if (o["deletionPolicy"] !== void 0 && ![
+		"Delete",
+		"Retain",
+		"Snapshot",
+		"RetainExceptOnCreate"
+	].includes(o["deletionPolicy"])) fail("deletionPolicy", o["deletionPolicy"], "one of Delete, Retain, Snapshot, RetainExceptOnCreate when present");
 	if (o["previousResourceType"] !== void 0 && typeof o["previousResourceType"] !== "string") fail("previousResourceType", o["previousResourceType"], "a string when present");
 }
 function kind(v) {
@@ -4968,7 +4976,7 @@ async function rebuildClientForBucketRegion(client, bucket, opts = {}) {
 
 //#endregion
 //#region src/state/s3-state-backend.ts
-function errorDetail$1(error) {
+function errorDetail$2(error) {
 	return displaySafe(error instanceof Error ? error.message : error, { asciiOnly: true }) || "<unrenderable>";
 }
 const LEGACY_KEY_DEPTH = 2;
@@ -5088,7 +5096,7 @@ var S3StateBackend = class {
 		} catch (error) {
 			if (!isNoSuchKey(error)) {
 				if (error instanceof StateError) throw error;
-				throw new StateError(`Failed to get state for stack ${shownStackName} (${shownRegionName}): ${errorDetail$1(error)}`, error instanceof Error ? error : void 0);
+				throw new StateError(`Failed to get state for stack ${shownStackName} (${shownRegionName}): ${errorDetail$2(error)}`, error instanceof Error ? error : void 0);
 			}
 			this.logger.debug(`No state at new key for stack: ${shownStackName} (${shownRegionName})`);
 		}
@@ -5135,7 +5143,7 @@ var S3StateBackend = class {
 				}));
 				this.logger.info(`Migrated state for stack ${this.displayName(stackName)} to region-scoped layout (${displayIdent(region)})`);
 			} catch (deleteError) {
-				this.logger.warn(`Migrated stack ${this.displayName(stackName)} to new key, but failed to delete legacy key: ${errorDetail$1(deleteError)}`);
+				this.logger.warn(`Migrated stack ${this.displayName(stackName)} to new key, but failed to delete legacy key: ${errorDetail$2(deleteError)}`);
 			}
 			await notifyStateSaved(stackName, region);
 			return response.ETag;
@@ -5145,7 +5153,7 @@ var S3StateBackend = class {
 				bucket: this.config.bucket,
 				operation: "PutObject"
 			});
-			throw new StateError(`Failed to save state for stack ${this.stackRef(stackName, region)}: ${errorDetail$1(normalized)}`, normalized);
+			throw new StateError(`Failed to save state for stack ${this.stackRef(stackName, region)}: ${errorDetail$2(normalized)}`, normalized);
 		}
 	}
 	async deleteState(stackName, region) {
@@ -5177,7 +5185,7 @@ var S3StateBackend = class {
 				bucket: this.config.bucket,
 				operation: "DeleteObject"
 			});
-			throw new StateError(`Failed to delete state for stack ${this.stackRef(stackName, region)}: ${errorDetail$1(normalized)}`, normalized);
+			throw new StateError(`Failed to delete state for stack ${this.stackRef(stackName, region)}: ${errorDetail$2(normalized)}`, normalized);
 		} finally {
 			await this.deleteRollbackJournal(stackName, region);
 		}
@@ -5199,7 +5207,7 @@ var S3StateBackend = class {
 				bucket: this.config.bucket,
 				operation: "DeleteObject"
 			});
-			throw new StateError(`Failed to delete legacy state for stack ${displayStackName(stackName)}: ${errorDetail$1(normalized)}`, normalized);
+			throw new StateError(`Failed to delete legacy state for stack ${displayStackName(stackName)}: ${errorDetail$2(normalized)}`, normalized);
 		}
 	}
 	async listStacks() {
@@ -5370,7 +5378,7 @@ var S3StateBackend = class {
 			});
 		} catch (error) {
 			const describing = options.objectDescription ? ` (${options.objectDescription})` : "";
-			this.logger.warn(`Could not purge noncurrent versions of ${keys.length} key(s) in bucket '${this.config.bucket}': the purge could not be started. Their previous versions survive and remain readable via GetObject with a VersionId${describing}. Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key(s) by hand. Underlying error: ${errorDetail$1(error)}`);
+			this.logger.warn(`Could not purge noncurrent versions of ${keys.length} key(s) in bucket '${this.config.bucket}': the purge could not be started. Their previous versions survive and remain readable via GetObject with a VersionId${describing}. Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key(s) by hand. Underlying error: ${errorDetail$2(error)}`);
 		}
 	}
 	async purgeNoncurrentVersionsUnderPrefix(keyPrefix, options = {}) {
@@ -5384,7 +5392,7 @@ var S3StateBackend = class {
 		} catch (error) {
 			const prefixShown = displayIdent(keyPrefix, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
 			const describing = options.objectDescription ? ` (${options.objectDescription})` : "";
-			this.logger.warn(safeMsg`Could not purge noncurrent versions under the prefix ${prefixShown} in bucket ${this.config.bucket}: the purge could not be started. Their previous versions survive and remain readable via GetObject with a VersionId${describing}. Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the prefix by hand. Underlying error: ${errorDetail$1(error)}`);
+			this.logger.warn(safeMsg`Could not purge noncurrent versions under the prefix ${prefixShown} in bucket ${this.config.bucket}: the purge could not be started. Their previous versions survive and remain readable via GetObject with a VersionId${describing}. Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the prefix by hand. Underlying error: ${errorDetail$2(error)}`);
 			return {
 				deletedBodies: 0,
 				complete: false
@@ -5410,7 +5418,7 @@ var S3StateBackend = class {
 			await this.saveCreateTokenLedger(stackName, region, ledger);
 		} catch (error) {
 			const normalized = normalizeAwsError(error, { bucket: this.config.bucket });
-			throw new StateError(`Failed to renew the create-token ledger of stack ${this.stackRef(stackName, region)}: ${errorDetail$1(normalized)}. The state record was left in place; re-run once the ledger can be written.`, normalized);
+			throw new StateError(`Failed to renew the create-token ledger of stack ${this.stackRef(stackName, region)}: ${errorDetail$2(normalized)}. The state record was left in place; re-run once the ledger can be written.`, normalized);
 		}
 	}
 	async deleteCreateTokenLedger(stackName, region) {
@@ -5427,7 +5435,7 @@ var S3StateBackend = class {
 				bucket: this.config.bucket,
 				operation: "DeleteObject"
 			});
-			throw new StateError(`Failed to delete the create-token ledger for stack ${this.stackRef(stackName, region)}: ${errorDetail$1(normalized)}. The state record was left in place; re-run once the ledger can be deleted.`, normalized);
+			throw new StateError(`Failed to delete the create-token ledger for stack ${this.stackRef(stackName, region)}: ${errorDetail$2(normalized)}. The state record was left in place; re-run once the ledger can be deleted.`, normalized);
 		}
 	}
 	async loadRollbackJournal(stackName, region) {
@@ -5453,6 +5461,58 @@ var S3StateBackend = class {
 		else newest.failedOperations = remaining;
 		await this.putRawObject(this.getRollbackJournalKey(stackName, region), JSON.stringify(journal, null, 2));
 	}
+	async dropRollbackJournalFailedOperations(stackName, region, drop) {
+		const journal = await this.loadRollbackJournal(stackName, region);
+		if (!journal) return 0;
+		let removed = 0;
+		for (const segment of journal.segments) {
+			if (!segment.failedOperations) continue;
+			const kept = segment.failedOperations.filter((op) => !drop(op, segment));
+			removed += segment.failedOperations.length - kept.length;
+			if (kept.length === 0) delete segment.failedOperations;
+			else segment.failedOperations = kept;
+		}
+		if (removed === 0) return 0;
+		await this.putRawObject(this.getRollbackJournalKey(stackName, region), JSON.stringify(journal, null, 2));
+		return removed;
+	}
+	async reduceRollbackJournalToFailedOperations(stackName, region, keep, supersededLogicalIds = [], demote = () => false) {
+		const journal = await this.loadRollbackJournal(stackName, region);
+		if (!journal) return 0;
+		const carried = new Set(supersededLogicalIds);
+		const kept = [];
+		let count = 0;
+		const keptBySegment = journal.segments.map((segment) => (segment.failedOperations ?? []).filter((op) => keep(op, segment)).map((op) => op.physicalIdRecoveredFromError === true && demote(op, segment) ? {
+			...op,
+			physicalIdRecoveredFromError: false
+		} : op));
+		const keptIds = new Set(keptBySegment.flat().map((op) => op.logicalId));
+		for (let s = journal.segments.length - 1; s >= 0; s--) {
+			const segment = journal.segments[s];
+			for (const op of segment.operations) carried.add(op.logicalId);
+			for (const id of segment.supersededLogicalIds ?? []) carried.add(id);
+			const failed = keptBySegment[s];
+			if (failed.length === 0) continue;
+			const reduced = {
+				...segment,
+				initialDeploy: false,
+				operations: [],
+				failedOperations: failed
+			};
+			delete reduced.previousOutputs;
+			delete reduced.previousCrossStackReads;
+			addSupersededIds(reduced, [...carried].filter((id) => !keptIds.has(id) || segment.supersededLogicalIds?.includes(id)));
+			kept.unshift(reduced);
+			count += failed.length;
+		}
+		if (kept.length === 0) {
+			await this.deleteRollbackJournal(stackName, region);
+			return 0;
+		}
+		journal.segments = kept;
+		await this.putRawObject(this.getRollbackJournalKey(stackName, region), JSON.stringify(journal, null, 2));
+		return count;
+	}
 	async popRollbackJournalSegment(stackName, region) {
 		const journal = await this.loadRollbackJournal(stackName, region);
 		if (!journal || journal.segments.length === 0) {
@@ -5521,7 +5581,7 @@ var S3StateBackend = class {
 		} catch (error) {
 			if (!isNoSuchKey(error) && error.name !== "NotFound") {
 				gone = false;
-				this.logger.warn(`Failed to delete rollback journal for ${this.stackRef(stackName, region)}: ${errorDetail$1(error)}`);
+				this.logger.warn(`Failed to delete rollback journal for ${this.stackRef(stackName, region)}: ${errorDetail$2(error)}`);
 			}
 		}
 		await this.purgeNoncurrentVersions([key], { objectDescription: "the rollback journal, whose `failedOperations[].attemptedProperties` records the properties of the failed write verbatim" });
@@ -5639,7 +5699,7 @@ var S3StateBackend = class {
 			};
 		} catch (error) {
 			if (isNoSuchKey(error)) return null;
-			throw new StateError(`Failed to get legacy state for stack ${this.displayName(stackName)}: ${errorDetail$1(error)}`, error instanceof Error ? error : void 0);
+			throw new StateError(`Failed to get legacy state for stack ${this.displayName(stackName)}: ${errorDetail$2(error)}`, error instanceof Error ? error : void 0);
 		}
 	}
 	parseStateBody(bodyString, stackName) {
@@ -5691,7 +5751,7 @@ function safeSegment(value) {
 function stackRef(stackName, region) {
 	return region === void 0 ? safeSegment(stackName) : `${safeSegment(stackName)} (${safeSegment(region)})`;
 }
-function errorDetail(error) {
+function errorDetail$1(error) {
 	return displaySafe(error instanceof Error ? error.message : error, { asciiOnly: true }) || "<unrenderable>";
 }
 function isLockInfoExpired(lockInfo) {
@@ -5827,7 +5887,7 @@ var LockManager = class {
 				}
 				return false;
 			}
-			throw new LockError(`Failed to acquire lock for stack ${safeSegment(stackName)} (${safeSegment(region)}): ` + errorDetail(error), error instanceof Error ? error : void 0);
+			throw new LockError(`Failed to acquire lock for stack ${safeSegment(stackName)} (${safeSegment(region)}): ` + errorDetail$1(error), error instanceof Error ? error : void 0);
 		}
 	}
 	async putLockObject(key, lockInfo, condition = { IfNoneMatch: "*" }) {
@@ -5882,7 +5942,7 @@ var LockManager = class {
 				return null;
 			}
 			if (error instanceof LockError) throw error;
-			throw new LockError(`Failed to get lock info for stack ${shownStack}: ${errorDetail(error)}`, error instanceof Error ? error : void 0);
+			throw new LockError(`Failed to get lock info for stack ${shownStack}: ${errorDetail$1(error)}`, error instanceof Error ? error : void 0);
 		}
 	}
 	async isLocked(stackName, region) {
@@ -5930,16 +5990,16 @@ var LockManager = class {
 					this.logger.warn(`Not releasing the lock for stack ${stackRef(stackName, region)}: the conditional delete could not be evaluated here, and this process could not confirm the lock is still its own. Leaving it in place rather than risk deleting another process's lock. It expires on its own, or clear it with cdkd force-unlock. If this repeats, grant s3:GetObject on the lock key -- a delete conditioned on an ETag requires it.`);
 					return;
 				}
-				this.logger.debug(`Conditional lock release for stack ${stackRef(stackName, region)} is not supported here (${errorDetail(error)}); retrying unconditionally`);
+				this.logger.debug(`Conditional lock release for stack ${stackRef(stackName, region)} is not supported here (${errorDetail$1(error)}); retrying unconditionally`);
 				try {
 					await this.deleteLock(stackName, region);
 					this.logger.debug(`Lock released for stack: ${stackRef(stackName, region)}`);
 					return;
 				} catch (fallbackError) {
-					throw new LockError(`Failed to release lock for stack ${stackRef(stackName, region)}: ${errorDetail(fallbackError)}`, fallbackError instanceof Error ? fallbackError : void 0);
+					throw new LockError(`Failed to release lock for stack ${stackRef(stackName, region)}: ${errorDetail$1(fallbackError)}`, fallbackError instanceof Error ? fallbackError : void 0);
 				}
 			}
-			throw new LockError(`Failed to release lock for stack ${stackRef(stackName, region)}: ${errorDetail(error)}`, error instanceof Error ? error : void 0);
+			throw new LockError(`Failed to release lock for stack ${stackRef(stackName, region)}: ${errorDetail$1(error)}`, error instanceof Error ? error : void 0);
 		} finally {
 			await this.purgeLockVersions(this.getLockKey(stackName, region), "release");
 		}
@@ -5998,7 +6058,7 @@ var LockManager = class {
 				objectDescription: LOCK_OBJECT_DESCRIPTION
 			});
 		} catch (error) {
-			report(`Could not purge noncurrent versions of the lock key ${displayIdent(key, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })} in bucket '${this.config.bucket}': the purge could not be started. Their previous versions survive and remain readable via GetObject with a VersionId (${LOCK_OBJECT_DESCRIPTION}). Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key by hand. Underlying error: ${errorDetail(error)}`);
+			report(`Could not purge noncurrent versions of the lock key ${displayIdent(key, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })} in bucket '${this.config.bucket}': the purge could not be started. Their previous versions survive and remain readable via GetObject with a VersionId (${LOCK_OBJECT_DESCRIPTION}). Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key by hand. Underlying error: ${errorDetail$1(error)}`);
 		}
 	}
 	trackHeldLock(args) {
@@ -6078,7 +6138,7 @@ var LockManager = class {
 				this.logger.warn(`Lost the lock for stack ${stackRef(held.stackName, held.region)} while the operation was still running: the lock object has been replaced or removed. Another cdkd process may now be writing to this stack concurrently. This process will not delete the current lock when it finishes.`);
 				return;
 			}
-			this.logger.debug(`Lock renewal for stack ${stackRef(held.stackName, held.region)} failed, will retry: ${errorDetail(error)}`);
+			this.logger.debug(`Lock renewal for stack ${stackRef(held.stackName, held.region)} failed, will retry: ${errorDetail$1(error)}`);
 			if (!held.warnedPastExpiry && Date.now() >= held.info.expiresAt) {
 				held.warnedPastExpiry = true;
 				this.logger.warn(`Lock renewal for stack ${stackRef(held.stackName, held.region)} has been failing long enough that the lock expired at ${new Date(held.info.expiresAt).toISOString()}. Another cdkd process can now take it while this operation is still running. Renewal keeps retrying.`);
@@ -6151,13 +6211,13 @@ function nanIfUncoercible(value) {
 //#endregion
 //#region src/deployment/secret-redaction/rules.ts
 const MIN_NEEDLE_LENGTH = 4;
-function escapeRegExp$1(value) {
+function escapeRegExp$2(value) {
 	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function buildNeedleRegex(values) {
 	const needles = Array.from(new Set(values)).filter((v) => v.length >= 4).sort((a, b) => b.length - a.length);
 	if (needles.length === 0) return void 0;
-	return new RegExp(needles.map(escapeRegExp$1).join("|"), "g");
+	return new RegExp(needles.map(escapeRegExp$2).join("|"), "g");
 }
 const TEMPLATE_DERIVED_RULES = {
 	descendArrays: true,
@@ -7323,7 +7383,7 @@ function intrinsicSkeletonPattern(source) {
 	return anchoredSkeletonPattern(segments);
 }
 function anchoredSkeletonPattern(segments) {
-	const body = joinSkeletonSegments(segments.map((segment) => segment === UNKNOWN_PART ? SKELETON_WILDCARD : escapeRegExp$1(segment)));
+	const body = joinSkeletonSegments(segments.map((segment) => segment === UNKNOWN_PART ? SKELETON_WILDCARD : escapeRegExp$2(segment)));
 	return body === void 0 ? void 0 : new RegExp(`^${body}$`);
 }
 const UNKNOWN_PART = Symbol("unknown intrinsic part");
@@ -9099,58 +9159,6 @@ var ReplacementRulesRegistry = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/auxiliary-failure.ts
-const AUXILIARY_LOGICAL_ID_SUFFIX = "/auxiliary";
-const MAX_DEPTH = 5;
-function auxiliaryLogicalId(ownerLogicalId) {
-	return `${ownerLogicalId}${AUXILIARY_LOGICAL_ID_SUFFIX}`;
-}
-const RETRY_AUXILIARY_OWNER = "withRetry";
-function isAuxiliaryMarkOf(link, ownerLogicalId) {
-	try {
-		if (typeof link !== "object" && typeof link !== "function" || link === null) return false;
-		const own = Object.getOwnPropertyDescriptor(link, "logicalId");
-		return isAuxiliaryMark(own) && own?.value === auxiliaryLogicalId(ownerLogicalId);
-	} catch {
-		return false;
-	}
-}
-function isAuxiliaryMark(descriptor) {
-	return descriptor !== void 0 && descriptor.enumerable === false && descriptor.writable === false && typeof descriptor.value === "string" && descriptor.value.endsWith(AUXILIARY_LOGICAL_ID_SUFFIX);
-}
-function isAuxiliaryFailure(error) {
-	try {
-		let current = error;
-		for (let depth = 0; depth < MAX_DEPTH && typeof current === "object" && current !== null; depth++) {
-			if (isAuxiliaryMark(Object.getOwnPropertyDescriptor(current, "logicalId"))) return true;
-			current = current.cause;
-		}
-	} catch {}
-	return false;
-}
-function markAuxiliaryFailure(error, ownerLogicalId) {
-	try {
-		let current = error;
-		for (let depth = 0; depth < MAX_DEPTH && typeof current === "object" && current !== null; depth++) {
-			const own = Object.getOwnPropertyDescriptor(current, "logicalId");
-			if (typeof own?.value === "string") {
-				if (isAuxiliaryMark(own)) return error;
-			} else {
-				if (Object.isExtensible(current) && own?.configurable !== false) Object.defineProperty(current, "logicalId", {
-					value: auxiliaryLogicalId(ownerLogicalId),
-					enumerable: false,
-					writable: false,
-					configurable: true
-				});
-				return error;
-			}
-			current = current.cause;
-		}
-	} catch {}
-	return error;
-}
-
 //#endregion
 //#region src/deployment/retry.ts
 const IAM_PROPAGATION_INITIAL_DELAY_MS = 250;
@@ -9175,11 +9183,14 @@ async function withRetry(operation, logicalId, opts = {}) {
 	let nameCooldownSleptMs = 0;
 	let serverErrorRetries = 0;
 	let replayMayCollide = false;
+	let previousError;
 	const settle = (error) => replayMayCollide ? markReplayMayCollide(markAuxiliaryFailure(error, RETRY_AUXILIARY_OWNER)) : error;
 	for (let attempt = 0; attempt <= attemptCeiling; attempt++) try {
 		return await operation();
 	} catch (error) {
 		lastError = error;
+		const carried = carryCreatedBeforeFailure(previousError, error);
+		if (hasCreatedBeforeFailure(carried) || !hasCreatedBeforeFailure(previousError)) previousError = carried;
 		if (isAuxiliaryFailure(error) || hasReplayMayCollide(error) || isAmbiguousOutcomeError(error)) replayMayCollide = true;
 		const message = describeAwsFailure(error).detail;
 		const classifyText = retryClassificationText(error);
@@ -15209,10 +15220,10 @@ function refuseMalformedResourcesForDestroy(state, stackName, region, recovery)
 	throw markNonRetryable(new CdkdError(malformedDestroyResourcesRefusalMessage(stackName, region, recovery), STATE_RESOURCES_MALFORMED));
 }
 const STATE_REGION_DIVERGED = "STATE_REGION_DIVERGED";
-function divergentRecordRegionRefusalMessage(stackName, keyRegion, divergentBodyRegion, resourceCount, recovery) {
+function divergentRecordRegionRefusalMessage(stackName, keyRegion, divergentBodyRegion, resourceCount, recovery, provenOrphans = 0) {
 	const cap = STACK_REF_MAX_CODE_POINTS;
 	const exact = rendersExactly(stackName, cap) && rendersExactly(keyRegion, cap) && isPasteableIdent(stackName) && isPasteableIdent(keyRegion);
-	const lists = resourceCount === void 0 ? "its resources map cannot be read" : `it still lists ${resourceCount} resource${resourceCount === 1 ? "" : "s"}`;
+	const lists = resourceCount === void 0 ? "its resources map cannot be read" : resourceCount === 0 && provenOrphans > 0 ? `its rollback journal holds ${provenOrphans} failed create${provenOrphans === 1 ? "" : "s"} whose resource the destroy would delete` : `it still lists ${resourceCount} resource${resourceCount === 1 ? "" : "s"}`;
 	const kind = describeRegionValueKind(divergentBodyRegion);
 	const opening = exact ? `cdkd will not destroy stack ${shellQuote(safeIdentifier(stackName, cap))} (${shellQuote(safeIdentifier(keyRegion, cap))}): the state record read from that region's key carries a 'region' of its own (${kind}) that is not the key's, and ${lists}` : `cdkd will not destroy the state record this command loaded: it carries a 'region' of its own (${kind}) that is not the region of the key it was read from, and ${lists}`;
 	const listing = withheldListingPointer(recovery);
@@ -15220,11 +15231,11 @@ function divergentRecordRegionRefusalMessage(stackName, keyRegion, divergentBody
 	const remedy = exact ? "Re-run with --verbose to see what the record's region field holds, then either destroy against the region the resources are really in, or repair that field to match the key it is stored under and re-run. " + withheldAccountClause(withheldAccounts, "the command at the end of this message prints") + "To drop the record and leave the live resources standing, spelled out rather than pasteable because that command DELETES a record: " + dropRecordTemplate(recovery) : "This record's stack name or region does NOT render exactly — what any surrounding output shows is a sanitized form, and another record may render identically — so this message names no target and offers no command against one. List the records with " + (listing.line === void 0 ? `${WITHHELD_LISTING_POINTER}. Inspect it with: ${inspectCommand(void 0, void 0)}` : `${listing.pointer}.` + destroyAccountClause(recovery) + `\n${listing.line}\nInspect it with: ${inspectCommand(void 0, void 0, recovery)}`);
 	return `${opening} ${resourceCount === void 0 ? `— so cdkd can neither count what it would delete nor tell which region it is in` : `— so cdkd cannot tell which region those resources are in`}. cdkd stamps the key's region into every record it writes, so this record was not written by cdkd. Destroying against the key's region would issue every delete there; if the record's own region is the honest half, each delete comes back not-found, which this command reads as ALREADY DELETED — it would report success, remove the record, and leave every resource standing in the other region with nothing naming it. ${remedy}`;
 }
-function refuseDivergentRecordRegionForDestroy(state, stackName, keyRegion, divergentBodyRegion, recovery) {
+function refuseDivergentRecordRegionForDestroy(state, stackName, keyRegion, divergentBodyRegion, recovery, provenOrphans = 0) {
 	if (divergentBodyRegion === void 0) return;
 	const resourceCount = isReadableBag(state.resources) ? Object.keys(state.resources).length : void 0;
-	if (resourceCount === 0) return;
-	throw markNonRetryable(new CdkdError(divergentRecordRegionRefusalMessage(stackName, keyRegion, divergentBodyRegion, resourceCount, recovery), STATE_REGION_DIVERGED));
+	if (resourceCount === 0 && provenOrphans === 0) return;
+	throw markNonRetryable(new CdkdError(divergentRecordRegionRefusalMessage(stackName, keyRegion, divergentBodyRegion, resourceCount, recovery, provenOrphans), STATE_REGION_DIVERGED));
 }
 function malformedDeployResourcesRefusalMessage(rawStackName, rawRegion) {
 	const stackName = absentIfEmpty(rawStackName);
@@ -15663,6 +15674,16 @@ function malformedDestroyResourceEntriesRefusalMessage(rawStackName, rawRegion,
 	const region = absentIfEmpty(rawRegion);
 	return `${namedEntriesClause(stackName, region, logicalIds)} 'cdkd destroy' DELETES what this map names, so it refuses rather than continuing: a null row stops the run on a bare TypeError in the listing above the prompt; a false, 0 or empty-string row is SKIPPED as 'not found in state' and the record removed with its resource still live in AWS; and any other row it cannot read, unless its own deletion policy retains it, is routed to a provider on whatever its type field holds — nothing, or a non-string — with a physical id nothing checked, so its delete either fails on a type-lookup error that names the row but not what is wrong with its record, after every readable row not retained was deleted, or is counted done, the record removed and success reported with its resource still live. Nothing was deleted or written FOR THIS STACK. Repair the row first; 'cdkd state orphan' drops the whole record with every resource left standing, which is more than this row asks for. ${inspectClause(stackName, region, recovery)}Inspect the record with: ` + inspectCommand(stackName, region, recovery);
 }
+function refuseMalformedResourcePropertiesForDestroy(state, stackName, region, recovery) {
+	const unreadable = unreadableResourcePropertyBags(state);
+	if (unreadable.length === 0) return;
+	throw markNonRetryable(new CdkdError(malformedDestroyResourcePropertiesRefusalMessage(stackName, region, unreadable, recovery), STATE_RESOURCES_MALFORMED));
+}
+function malformedDestroyResourcePropertiesRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return `${namedPropertyBagsDiagnosis(stackName, region, logicalIds)} 'cdkd destroy' hands that map to the resource's delete, which reads keys off it — whether an RDS DB instance takes a final snapshot, whether an ECR repository is emptied first — so it refuses rather than continuing: the provider would get the torn value as it stands, and reading the map as EMPTY answers each of those keys as absent, a delete that fails or takes the wrong branch after every resource ordered before it was deleted. Nothing was deleted or written FOR THIS STACK. Repair the map first; 'cdkd state orphan' drops the whole record with every resource left standing, which is more than this asks for. ${inspectClause(stackName, region, recovery)}Inspect the record with: ` + inspectCommand(stackName, region, recovery);
+}
 function refuseMalformedResourceEntriesForImport(state, reimportedLogicalIds, stackName, region, recovery) {
 	const reimported = new Set(reimportedLogicalIds);
 	const unreadable = unreadableResourceEntries(state).filter((id) => !reimported.has(id));
@@ -15902,7 +15923,7 @@ function isPlainObject$2(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 const DYNAMIC_REFERENCE_OPEN = "{{resolve:";
-const NESTED_STACK_TYPE$2 = "AWS::CloudFormation::Stack";
+const NESTED_STACK_TYPE$3 = "AWS::CloudFormation::Stack";
 const NESTED_OUTPUT_PREFIX = "Outputs.";
 function carriesSecretValue(value, corpora) {
 	if (carriesSecretMask(value)) return true;
@@ -15977,7 +15998,7 @@ function intrinsicKey(value) {
 	const key = keys[0];
 	return key === "Ref" || key.startsWith("Fn::") ? key : void 0;
 }
-const OPAQUE_ATTRIBUTE_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::CustomResource", NESTED_STACK_TYPE$2]);
+const OPAQUE_ATTRIBUTE_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::CustomResource", NESTED_STACK_TYPE$3]);
 function hasOpaqueAttributes(logicalId, walk) {
 	const definition = walk.resources[logicalId];
 	const type = isPlainObject$2(definition) ? definition["Type"] : void 0;
@@ -16334,7 +16355,7 @@ function passedKey(passed) {
 function isNestedStackRow(logicalId, walk) {
 	if (!Object.hasOwn(walk.resources, logicalId)) return false;
 	const definition = walk.resources[logicalId];
-	return isPlainObject$2(definition) && definition["Type"] === NESTED_STACK_TYPE$2;
+	return isPlainObject$2(definition) && definition["Type"] === NESTED_STACK_TYPE$3;
 }
 function getAttAttribute(operand, target) {
 	if (Array.isArray(operand)) return operand.length === 2 && typeof operand[1] === "string" ? operand[1] : void 0;
@@ -21381,13 +21402,13 @@ function resolvesReference(desired, previous, mask) {
 		rest = rest.slice(at + token.length);
 	}
 	literals.push(rest);
-	const pattern = literals.map(escapeRegExp).join("[\\s\\S]*");
+	const pattern = literals.map(escapeRegExp$1).join("[\\s\\S]*");
 	return new RegExp(`^${pattern}$`).test(desired);
 }
 function isPlainObject$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function escapeRegExp(text) {
+function escapeRegExp$1(text) {
 	return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
@@ -21795,7 +21816,10 @@ function isCcConflict(error) {
 }
 var CloudControlProvider = class {
 	cloudControlClient;
-	logger = getLogger().child("CloudControlProvider");
+	baseLogger = getLogger().child("CloudControlProvider");
+	get logger() {
+		return idLogScope.getStore() ?? this.baseLogger;
+	}
 	patchGenerator = new JsonPatchGenerator();
 	warnedUnresolvableSchemaTypes = /* @__PURE__ */ new Set();
 	protectionFlips = new ProtectionFlipRegistry();
@@ -21810,7 +21834,12 @@ var CloudControlProvider = class {
 		const awsClients = getAwsClients();
 		this.cloudControlClient = awsClients.cloudControl;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
+		const mask = maskerOrIdentity(context?.maskSecrets);
+		const idLog = new IdScrubLog(this.logger, mask, holdsSecretDerivedLeaf(properties, mask));
+		return inIdLogScope(idLog, () => this.createInIdLogScope(logicalId, resourceType, properties, idLog));
+	}
+	async createInIdLogScope(logicalId, resourceType, properties, idLog) {
 		this.logger.debug(`Creating resource ${logicalId} (${resourceType})`);
 		try {
 			const ccProperties = stringifyJsonProperties(resourceType, stripNullValues(properties));
@@ -21824,6 +21853,7 @@ var CloudControlProvider = class {
 			this.logger.debug(`Create request submitted for ${logicalId}, token: ${createResponse.ProgressEvent.RequestToken}`);
 			const progressEvent = await this.waitForOperation(createResponse.ProgressEvent.RequestToken, logicalId, "CREATE", resourceType);
 			if (!progressEvent.Identifier) throw new ProvisioningError(`Failed to create resource ${logicalId}: No physical ID returned`, resourceType, logicalId);
+			idLog.addId(progressEvent.Identifier);
 			this.logger.debug(`Created resource ${logicalId}, physical ID: ${progressEvent.Identifier}`);
 			const result = { physicalId: progressEvent.Identifier };
 			if (progressEvent.ResourceModel) result.attributes = this.parseResourceModel(progressEvent.ResourceModel);
@@ -21831,6 +21861,7 @@ var CloudControlProvider = class {
 			result.attributes = await this.enrichResourceAttributes(resourceType, progressEvent.Identifier, result.attributes);
 			return result;
 		} catch (error) {
+			idLog.addId(identifierCarriedBy(error));
 			await this.cleanupFailedCreateRemnant(error, resourceType, logicalId);
 			this.handleError(error, "CREATE", resourceType, logicalId);
 		}
@@ -21851,7 +21882,10 @@ var CloudControlProvider = class {
 		} catch (cleanupError) {
 			const message = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
 			if (isWaitAbandonedError(cleanupError)) {
-				this.logger.warn(`Could not confirm whether the remnant ${error.physicalId} left by the failed CREATE of ${logicalId} was removed (a retry may fail with AlreadyExists until it is removed manually): ${displaySafe(message)}`);
+				const line = `Could not confirm whether the remnant ${error.physicalId} left by the failed CREATE of ${logicalId} was removed (a retry may fail with AlreadyExists until it is removed manually): ${displaySafe(message)}`;
+				const log = this.logger;
+				if (log instanceof IdScrubLog) log.warnKeepingResume(line, abandonedRequestTokens(cleanupError));
+				else log.warn(line);
 				return;
 			}
 			if (isNotFoundMessage(message)) {
@@ -21862,7 +21896,12 @@ var CloudControlProvider = class {
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
-		const idLog = updateIdLogSink(this.logger, physicalId, properties, previousProperties, context?.maskSecrets);
+		const mask = maskerOrIdentity(context?.maskSecrets);
+		const idLog = new IdScrubLog(this.logger, mask, holdsSecretDerivedLeaf(properties, mask) || holdsSecretDerivedLeaf(previousProperties, mask));
+		idLog.addId(physicalId);
+		return inIdLogScope(idLog, () => this.updateInIdLogScope(logicalId, physicalId, resourceType, properties, previousProperties, context, idLog));
+	}
+	async updateInIdLogScope(logicalId, physicalId, resourceType, properties, previousProperties, context, idLog) {
 		idLog.debug(`Updating resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		await this.assertRecordedRegionAgainstClient("pre-update", context?.expectedRegion, resourceType, logicalId, physicalId);
 		try {
@@ -21936,26 +21975,41 @@ var CloudControlProvider = class {
 			this.handleError(error, "UPDATE", resourceType, logicalId, physicalId);
 		}
 	}
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
+	async delete(logicalId, physicalId, resourceType, properties, context) {
+		const mask = maskerOrIdentity(void 0);
+		const idLog = new IdScrubLog(this.logger, mask, holdsSecretDerivedLeaf(properties, mask));
+		idLog.addId(physicalId);
+		const result = await inIdLogScope(idLog, () => this.deleteInIdLogScope(logicalId, physicalId, resourceType, properties, context));
+		if (!idLog.withheld || !result) return result;
+		return {
+			...result,
+			...result.outcome === "skipped" && { reason: idLog.scrub(result.reason) },
+			...Array.isArray(result.indeterminateGuards) && { indeterminateGuards: result.indeterminateGuards.map((guard) => ({
+				...guard,
+				reason: idLog.scrub(guard.reason)
+			})) }
+		};
+	}
+	async deleteInIdLogScope(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		await this.assertRecordedRegionAgainstClient("pre-delete", context?.expectedRegion, resourceType, logicalId, physicalId);
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DuAHOXvT.js");
+			const { ASGProvider } = await import("./asg-provider-AVCcoXnQ.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
 				asgProvider = new ASGProvider();
 				this.asgDeleteDelegates.set(delegateRegion, asgProvider);
 			}
-			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
+			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, properties, context), indeterminateGuard);
 		}
 		if ((context?.deletionPolicy === "Delete" || context?.skipFinalSnapshot === true) && SDK_DELETE_FAMILIES.has(resourceType)) {
-			if (deletesThroughSdkProvider(resourceType, _properties)) {
+			if (deletesThroughSdkProvider(resourceType, properties)) {
 				const delegate = await this.sdkDeleteDelegateInCcRegion(resourceType, logicalId, physicalId);
-				return withIndeterminateGuard(await delegate.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
+				return withIndeterminateGuard(await delegate.delete(logicalId, physicalId, resourceType, properties, context), indeterminateGuard);
 			}
 			this.logger.warn(safeMsg`${logicalId} (${resourceType}) records a GlobalClusterIdentifier cdkd cannot detach it from, so it is deleted through ` + `Cloud Control, which handles the global-cluster membership. Its handler ` + safeMsg`can take a manual final snapshot of ${physicalId}, which cdkd does not record; ` + `delete it yourself if you do not want it.`);
 		}
@@ -22049,7 +22103,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-D6_Rcnub.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-BGVccWhg.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-DltlcDiQ.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-D1t9NgT-.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -22752,20 +22806,94 @@ var CloudControlProvider = class {
 		return masked;
 	}
 };
-function updateIdLogSink(logger, physicalId, properties, previousProperties, maskSecrets) {
-	const mask = maskerOrIdentity(maskSecrets);
-	const raw = updateIdWithheld(properties, previousProperties, mask) ? [physicalId, ...physicalId.split("|")].filter((needle) => needle !== "") : [];
-	const masked = raw.map((needle) => mask(needle));
-	const needles = [.../* @__PURE__ */ new Set([...raw, ...masked.filter((m, i) => m !== "" && m !== raw[i] && m !== "***")])].sort((a, b) => b.length - a.length);
-	const scrub = (message) => needles.reduce((text, needle) => text.split(needle).join("***"), mask(message));
-	return {
-		debug: (message) => logger.debug(scrub(message)),
-		warn: (message) => logger.warn(scrub(message)),
-		withheld: needles.length > 0
-	};
+var IdScrubLog = class {
+	needles = [];
+	base;
+	mask;
+	evidence;
+	constructor(base, mask, evidence) {
+		this.base = base;
+		this.mask = mask;
+		this.evidence = evidence;
+	}
+	get withheld() {
+		return this.needles.length > 0;
+	}
+	addId(id) {
+		if (!this.evidence || id === void 0 || id === "") return;
+		const parts = [id, ...id.split("|")].filter((needle) => needle !== "");
+		const raw = [...new Set(parts.flatMap((part) => [
+			part,
+			displaySafe(part),
+			displaySafe(part, { asciiOnly: true })
+		]))].filter((needle) => needle !== "" && needle !== "***");
+		const masked = raw.map((needle) => this.mask(needle));
+		this.needles = [.../* @__PURE__ */ new Set([
+			...this.needles,
+			...raw,
+			...masked.filter((m, i) => m !== "" && m !== raw[i] && m !== "***")
+		])].sort((a, b) => b.length - a.length);
+	}
+	scrub = (text) => this.needles.reduce((out, needle) => out.split(needle).join("***"), this.mask(text));
+	scrubKeepingResume(text, requestTokens) {
+		const tokens = requestTokens.filter((token) => token !== "");
+		if (tokens.length === 0) return this.scrub(text);
+		const keep = new RegExp(`(${[RESUME_COMMAND.source, ...tokens.map(escapeRegExp)].join("|")})`);
+		return text.split(keep).map((segment, i) => i % 2 === 1 ? this.mask(segment) : this.scrub(segment)).join("");
+	}
+	scrubError(error) {
+		if (this.needles.length === 0 || !(error instanceof Error)) return error;
+		const original = errorCauseChain(error);
+		const tokens = abandonedRequestTokens(error);
+		const scrubbed = maskSecretsInError(error, /* @__PURE__ */ new Map(), (text) => this.scrubKeepingResume(text, tokens));
+		const clones = errorCauseChain(scrubbed);
+		original.forEach((link, i) => {
+			const clone = clones[i];
+			if (clone === void 0 || clone === link) return;
+			for (const key of VERBATIM_ERROR_FIELDS) {
+				const descriptor = Object.getOwnPropertyDescriptor(link, key);
+				if (descriptor === void 0 || typeof descriptor.value !== "string") continue;
+				try {
+					Object.defineProperty(clone, key, descriptor);
+				} catch {}
+			}
+		});
+		return scrubbed;
+	}
+	warnKeepingResume(message, requestTokens) {
+		this.base.warn(this.scrubKeepingResume(message, requestTokens));
+	}
+	debug(message) {
+		this.base.debug(this.scrub(message));
+	}
+	info(message) {
+		this.base.info(this.scrub(message));
+	}
+	warn(message) {
+		this.base.warn(this.scrub(message));
+	}
+	error(message) {
+		this.base.error(this.scrub(message));
+	}
+};
+const VERBATIM_ERROR_FIELDS = ["logicalId", "resourceType"];
+function escapeRegExp(text) {
+	return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+const RESUME_COMMAND = /aws(?: --profile (?:'(?:[^'\n]|'\\'')*'|\S+))? cloudcontrol get-resource-request-status --request-token \S+(?: --region \S+)?/;
+function abandonedRequestTokens(error) {
+	return error instanceof Error ? errorCauseChain(error).flatMap((link) => link instanceof CloudControlWaitAbandonedError ? [link.requestToken] : []) : [];
+}
+const idLogScope = new AsyncLocalStorage();
+async function inIdLogScope(idLog, fn) {
+	try {
+		return await idLogScope.run(idLog, fn);
+	} catch (error) {
+		throw idLog.scrubError(error);
+	}
 }
-function updateIdWithheld(properties, previousProperties, mask) {
-	return holdsSecretDerivedLeaf(properties, mask) || holdsSecretDerivedLeaf(previousProperties, mask);
+function identifierCarriedBy(error) {
+	return error instanceof ProvisioningError ? error.physicalId : void 0;
 }
 function holdsSecretDerivedLeaf(value, mask, depth = 0) {
 	if (typeof value === "string") return isSecretDerivedValue(value, mask);
@@ -22874,8 +23002,34 @@ const CR_MASKED_SERVICE_TOKEN_SKIP_REASON = "masked ServiceToken in state — De
 const CR_REFERENCE_SERVICE_TOKEN_SKIP_REASON = "dynamic reference as ServiceToken in state — handler not invoked";
 const CR_DELETE_INVOKE_FAILED_SKIP_REASON = "Delete request to the handler did not complete — resource unproven";
 const CR_DELETE_HANDLER_FAILED_SKIP_REASON = "Delete handler reported FAILED — resource unproven";
-const CR_SKIP_NOT_A_RETRY_CAVEAT = "NOTE this record is a POINTER, not a retry: the same destroy run deletes the backing Lambda, so the next 'cdkd destroy' finds the handler gone and DROPS this record (issue 804 pre-check). Tear the resource down by hand, then clear the stack's records with 'cdkd state orphan <stack> --stack-region <region>' — that command drops EVERY record for the stack in that region, not just this one.";
+const CR_BACKING_LAMBDA_GONE_SKIP_REASON = "backing Lambda function is gone — Delete handler not invoked";
+function crSkipNotARetryCaveat(context, logicalId) {
+	return `NOTE this record is a POINTER, not a retry: the same destroy run deletes the backing Lambda, so the next 'cdkd destroy' cannot reach the handler either: it skips this resource again and keeps the record (issue 2115). Tear the resource down by hand, then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}.`;
+}
 const DEPLOY_SKIP_CAVEAT = "NOTE this arm is ALSO reached from cdkd deploy. Since issue 1762 the DELETE of a resource removed from the template behaves like destroy — the record is KEPT and the next deploy re-attempts it — but a REPLACEMENT / rollback delete FAILS the resource instead (https://github.com/go-to-k/cdkd/issues/1762), leaving the old one untracked; there, tear the resource down by hand.";
+function crDeployNoStateOrphan(logicalId) {
+	return `For a resource removed from the template, to give up on the delete and stop tracking it, drop the record with ${stateOrphanRecordRemedy(void 0, logicalId)}.`;
+}
+function crDeploySkipTail(logicalId) {
+	return "Meanwhile 'cdkd deploy --allow-unaddressed' exits 0 (a deploy-only flag; 'cdkd rollback' has none); the record stays and each deploy re-attempts the delete. A delete-first REPLACEMENT or a rollback delete usually FAILS the resource and keeps the record (https://github.com/go-to-k/cdkd/issues/1762). Where the other copy already exists (a replacement that created the new resource first, or a rollback that re-created the old one first), the skip only warns and the surviving copy is no longer tracked, so tear it down by hand. " + crDeployNoStateOrphan(logicalId);
+}
+const CR_DEPLOY_HANDLER_SKIP_HEAD = "This delete is not part of a stack destroy (a 'cdkd deploy' template removal, replacement or rollback, or a 'cdkd rollback'). For a resource removed from the template the record is KEPT and the next 'cdkd deploy' re-sends the Delete: fix what made it fail (the handler's Delete logic, or what stopped the invoke) and re-deploy. That reaches the handler only while its function exists: if this deploy also deleted the backing Lambda, the next deploy finds it gone and DROPS the record with a warning, so tear down what the handler manages by hand. ";
+const CR_DEPLOY_UNADDRESSABLE_HEAD = "This delete is not part of a stack destroy (a 'cdkd deploy' template removal, replacement or rollback, or a 'cdkd rollback'). For a resource removed from the template the record is KEPT and every 'cdkd deploy' skips it again until ServiceToken is restored: put the provider's Lambda function or SNS topic ARN back in state.json and re-deploy, which sends the Delete while that handler exists. If its Lambda function is gone, that deploy DROPS the record with a warning instead, so tear down what the handler manages by hand. ";
+function crDestroyUnaddressableRemedy(context, logicalId) {
+	return `Tear the resource down by hand, then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}. Restoring ServiceToken (the provider's Lambda function or SNS topic ARN) in state.json and re-running helps only while that handler still exists: a destroy goes on to delete its backing Lambda.`;
+}
+function handlerSkipRemedy(context, logicalId) {
+	return context?.stackDestroy === true ? ` — cdkd is KEEPING the state record and the run exits non-zero. ${crSkipNotARetryCaveat(context, logicalId)}` : `. ${CR_DEPLOY_HANDLER_SKIP_HEAD}${crDeploySkipTail(logicalId)}`;
+}
+function crUnresolvedTokenUpdateRemedy() {
+	return "This indicates an unresolved value in the template, or, on a rollback, in the resource's recorded state. Check that the template resolves ServiceToken to the provider's Lambda function or SNS topic ARN and re-deploy; a rollback replays the recorded value, so restore the template and re-deploy instead. Do not drop this record with 'cdkd state orphan', with or without --resource: the template still declares the resource, so the next deploy would send the handler a fresh Create and leave what it already manages untracked.";
+}
+function unresolvedTokenDeleteRemedy(context, logicalId) {
+	return context?.stackDestroy === true ? `re-run 'cdkd import', or drop the record with ${stateOrphanRecordRemedy(context, logicalId)}, to recover.` : `put the provider's Lambda function or SNS topic ARN back as ServiceToken in state.json and re-run to recover. ${crDeployNoStateOrphan(logicalId)}`;
+}
+function unaddressableServiceTokenRemedy(context, logicalId) {
+	return context?.stackDestroy === true ? crDestroyUnaddressableRemedy(context, logicalId) : `${CR_DEPLOY_UNADDRESSABLE_HEAD}${crDeploySkipTail(logicalId)}`;
+}
 function isCustomResourceResponsePayload(value) {
 	if (typeof value !== "object" || value === null) return false;
 	const payload = value;
@@ -23218,7 +23372,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 		this.logger.debug(`Creating custom resource ${logicalId} (${resourceType})`);
 		const serviceToken = properties["ServiceToken"];
 		if (!serviceToken) throw new ProvisioningError(`ServiceToken is required for custom resource ${logicalId}`, resourceType, logicalId);
-		if (typeof serviceToken !== "string") throw new ProvisioningError(`Custom Resource ${logicalId}: ServiceToken is not a resolved string ARN (got ${typeof serviceToken}). This usually indicates state was written by a pre-fix cdkd import; re-run 'cdkd import' or 'cdkd state orphan <stack> --stack-region <region>' to recover.`, resourceType, logicalId);
+		if (typeof serviceToken !== "string") throw new ProvisioningError(`Custom Resource ${logicalId}: ServiceToken is not a resolved string ARN (got ${typeof serviceToken}). This indicates an unresolved value in the template, or, on a rollback, in the resource's recorded state. Check that the template resolves ServiceToken to the provider's Lambda function or SNS topic ARN; a rollback replays the recorded value, so restore the template and re-deploy instead.`, resourceType, logicalId);
 		this.refuseResolvedSecret(logicalId, resourceType, properties);
 		try {
 			const cfnResponse = await this.invokeCustomResourceWithRetry(serviceToken, logicalId, "Create", (invocation) => ({
@@ -23249,7 +23403,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 		this.logger.debug(`Updating custom resource ${logicalId}: ${physicalId} (${resourceType})`);
 		const serviceToken = properties["ServiceToken"];
 		if (!serviceToken) throw new ProvisioningError(`ServiceToken is required for custom resource ${logicalId}`, resourceType, logicalId, physicalId);
-		if (typeof serviceToken !== "string") throw new ProvisioningError(`Custom Resource ${logicalId}: ServiceToken is not a resolved string ARN (got ${typeof serviceToken}). This usually indicates state was written by a pre-fix cdkd import; re-run 'cdkd import' or 'cdkd state orphan <stack> --stack-region <region>' to recover.`, resourceType, logicalId, physicalId);
+		if (typeof serviceToken !== "string") throw new ProvisioningError(`Custom Resource ${logicalId}: ServiceToken is not a resolved string ARN (got ${typeof serviceToken}). ` + crUnresolvedTokenUpdateRemedy(), resourceType, logicalId, physicalId);
 		this.refuseResolvedSecret(logicalId, resourceType, properties, physicalId, previousProperties);
 		try {
 			const cfnResponse = await this.invokeCustomResourceWithRetry(serviceToken, logicalId, "Update", (invocation) => ({
@@ -23279,7 +23433,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 			throw new ProvisioningError(`Failed to update custom resource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async delete(logicalId, physicalId, resourceType, properties, _context) {
+	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting custom resource ${logicalId}: ${physicalId} (${resourceType})`);
 		if (!properties) {
 			this.logger.warn(`No properties available for custom resource ${logicalId}, skipping deletion — the handler is never invoked, so anything this custom resource manages is LEFT IN PLACE. Restore the record's properties in state.json and re-run, or tear the resource down by hand. ${DEPLOY_SKIP_CAVEAT}`);
@@ -23296,23 +23450,30 @@ var CustomResourceProvider = class CustomResourceProvider {
 				reason: CR_NO_SERVICE_TOKEN_SKIP_REASON
 			};
 		}
-		if (typeof serviceToken !== "string") throw new ProvisioningError(`Custom Resource ${logicalId}: ServiceToken is not a resolved string ARN (got ${typeof serviceToken}). This usually indicates state was written by a pre-fix cdkd import; re-run 'cdkd import' or 'cdkd state orphan <stack> --stack-region <region>' to recover.`, resourceType, logicalId, physicalId);
+		if (typeof serviceToken !== "string") throw new ProvisioningError(`Custom Resource ${logicalId}: ServiceToken is not a resolved string ARN (got ${typeof serviceToken}). This usually indicates state was written by a pre-fix cdkd import; ` + unresolvedTokenDeleteRemedy(context, logicalId), resourceType, logicalId, physicalId);
 		if (carriesSecretMask(serviceToken)) {
-			this.logger.warn(safeMsg`ServiceToken for custom resource ${logicalId} is recorded in state as the redaction ` + safeMsg`mask '${"***"}' (a NoEcho value this resource reads equals, or is contained ` + "in, its ServiceToken), so cdkd cannot address the handler; skipping deletion — anything this custom resource manages is LEFT IN PLACE. Re-deploying does not repair the record while that attribute still carries the value. Tear the resource down by hand, then clear the stack's records with 'cdkd state orphan <stack> --stack-region <region>' — that command drops EVERY record for the stack in that region, not just this one. Restoring ServiceToken (the provider's Lambda function or SNS topic ARN) in state.json and re-running helps only while that handler still exists: a destroy goes on to delete its backing Lambda. " + safeMsg`${DEPLOY_SKIP_CAVEAT}`);
+			this.logger.warn(safeMsg`ServiceToken for custom resource ${logicalId} is recorded in state as the redaction ` + safeMsg`mask '${"***"}' (a NoEcho value this resource reads equals, or is contained ` + "in, its ServiceToken), so cdkd cannot address the handler; skipping deletion — anything this custom resource manages is LEFT IN PLACE. Re-deploying does not repair the record while that attribute still carries the value. " + safeMsg`${unaddressableServiceTokenRemedy(context, logicalId)}`);
 			return {
 				outcome: "skipped",
 				reason: CR_MASKED_SERVICE_TOKEN_SKIP_REASON
 			};
 		}
 		if (dynamicReferenceTokens(serviceToken).length > 0) {
-			this.logger.warn(safeMsg`ServiceToken for custom resource ${logicalId} is recorded in state as a ` + "'{{resolve:...}}' dynamic reference, which cdkd does not resolve on delete, so it cannot address the handler; skipping deletion — anything this custom resource manages is LEFT IN PLACE. CloudFormation does not support secure (secretsmanager / ssm-secure) dynamic references in custom resources, and cdkd now refuses such a template at deploy time. Tear the resource down by hand, then clear the stack's records with 'cdkd state orphan <stack> --stack-region <region>' — that command drops EVERY record for the stack in that region, not just this one. Restoring ServiceToken (the provider's Lambda function or SNS topic ARN) in state.json and re-running helps only while that handler still exists: a destroy goes on to delete its backing Lambda. " + safeMsg`${DEPLOY_SKIP_CAVEAT}`);
+			this.logger.warn(safeMsg`ServiceToken for custom resource ${logicalId} is recorded in state as a ` + "'{{resolve:...}}' dynamic reference, which cdkd does not resolve on delete, so it cannot address the handler; skipping deletion — anything this custom resource manages is LEFT IN PLACE. CloudFormation does not support secure (secretsmanager / ssm-secure) dynamic references in custom resources, and cdkd now refuses such a template at deploy time. " + safeMsg`${unaddressableServiceTokenRemedy(context, logicalId)}`);
 			return {
 				outcome: "skipped",
 				reason: CR_REFERENCE_SERVICE_TOKEN_SKIP_REASON
 			};
 		}
 		if (!this.isSnsServiceToken(serviceToken) && await this.isBackingLambdaGone(serviceToken)) {
-			this.logger.warn(`Backing Lambda for custom resource ${logicalId} no longer exists (${serviceToken}); treating the custom resource as already deleted and DROPPING its state record. The handler can never run again, so if its teardown was never PROVEN — e.g. an earlier run reported this resource as skipped (issue 2054) — whatever it manages is still LIVE and is now untracked by cdkd. Check for leftovers before treating the stack as gone.`);
+			if (context?.stackDestroy === true) {
+				this.logger.warn(safeMsg`Backing Lambda for custom resource ${logicalId} no longer exists (${serviceToken}), so ` + "its Delete handler cannot be invoked and cdkd cannot confirm the resource was deleted; skipping deletion — anything this custom resource manages may still be LIVE. cdkd is KEEPING the state record and the run exits non-zero, as CloudFormation leaves such a stack DELETE_FAILED. A re-run skips it again unless a function with that exact ARN exists again (e.g. a shared provider stack destroyed before this one, then redeployed). Otherwise confirm by hand that whatever it manages is gone (or tear it down), then drop the record with " + safeMsg`${stateOrphanRecordRemedy(context, logicalId)}.`);
+				return {
+					outcome: "skipped",
+					reason: CR_BACKING_LAMBDA_GONE_SKIP_REASON
+				};
+			}
+			this.logger.warn(safeMsg`Backing Lambda for custom resource ${logicalId} no longer exists (${serviceToken}); ` + "treating the custom resource as already deleted and DROPPING its state record, as CloudFormation ignores a delete failure in an update's cleanup phase. The handler can never run again, so if its teardown was never PROVEN, whatever it manages may still be LIVE and is now untracked by cdkd. Check for leftovers by hand.");
 			return;
 		}
 		try {
@@ -23327,7 +23488,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				ResourceProperties: this.stringifyProperties(properties)
 			}), DELETE_PATH_UNMASKED);
 			if (cfnResponse.Status === "FAILED") {
-				this.logger.warn(`Custom resource delete handler returned FAILED for ${logicalId}: ${cfnResponse.Reason || "Unknown reason"}. The handler reported that it did NOT delete, so anything this custom resource manages is LEFT IN PLACE — cdkd is KEEPING the state record and the run exits non-zero. ${CR_SKIP_NOT_A_RETRY_CAVEAT} ('cdkd deploy' also accepts --allow-unaddressed, which forces exit 0; 'cdkd destroy' has no such flag.) ${DEPLOY_SKIP_CAVEAT}`);
+				this.logger.warn(`Custom resource delete handler returned FAILED for ${logicalId}: ${cfnResponse.Reason || "Unknown reason"}. The handler reported that it did NOT delete, so anything this custom resource manages is LEFT IN PLACE${handlerSkipRemedy(context, logicalId)}`);
 				return {
 					outcome: "skipped",
 					reason: CR_DELETE_HANDLER_FAILED_SKIP_REASON
@@ -23335,7 +23496,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 			}
 			this.logger.debug(`Successfully deleted custom resource ${logicalId}`);
 		} catch (error) {
-			this.logger.warn(`Failed to delete custom resource ${logicalId}, but continuing: ${describeAwsFailure(error).detail}. The Delete handler did not complete, so anything this custom resource manages may still be LIVE — cdkd is KEEPING the state record and the run exits non-zero. ${CR_SKIP_NOT_A_RETRY_CAVEAT} ${DEPLOY_SKIP_CAVEAT}`);
+			this.logger.warn(`Failed to delete custom resource ${logicalId}, but continuing: ${describeAwsFailure(error).detail}. The Delete handler did not complete, so anything this custom resource manages may still be LIVE${handlerSkipRemedy(context, logicalId)}`);
 			return {
 				outcome: "skipped",
 				reason: CR_DELETE_INVOKE_FAILED_SKIP_REASON
@@ -26283,6 +26444,81 @@ function ownPoliciesChange(change) {
 	return (change?.propertyChanges ?? []).some((c) => c.path === "Policies" && c.inPlacePropagated !== true && c.replacementPropagated !== true);
 }
 
+//#endregion
+//#region src/analyzer/destructive-changes.ts
+const IGNORED_RESOURCE_TYPES = /* @__PURE__ */ new Set(["AWS::CDK::Metadata"]);
+const PATH_METADATA_KEY = "aws:cdk:path";
+function findDestructiveChanges(stackName, changes, records, template, recreateTargets = /* @__PURE__ */ new Set()) {
+	const found = [];
+	for (const change of changes) {
+		const record = Object.hasOwn(records, change.logicalId) ? records[change.logicalId] : void 0;
+		const resourceType = record?.resourceType ?? change.resourceType;
+		if (IGNORED_RESOURCE_TYPES.has(resourceType) || IGNORED_RESOURCE_TYPES.has(change.resourceType)) continue;
+		const impact = change.changeType === "UPDATE" && recreateTargets.has(change.logicalId) ? "WILL_REPLACE" : destructiveImpactOf(change, record);
+		if (impact === void 0) continue;
+		const recorded = typeof record?.constructPath === "string" ? record.constructPath : void 0;
+		const constructPath = constructPathOf(template, change.logicalId) ?? recorded;
+		found.push({
+			stackName,
+			logicalId: change.logicalId,
+			resourceType,
+			...constructPath !== void 0 && { constructPath },
+			impact
+		});
+	}
+	return found;
+}
+function destructiveImpactOf(change, record) {
+	switch (change.changeType) {
+		case "DELETE": return shouldRetainResource(record?.deletionPolicy) ? "WILL_ORPHAN" : "WILL_DESTROY";
+		case "UPDATE": {
+			if (record !== void 0 && record.resourceType !== change.resourceType) return "WILL_REPLACE";
+			let mayReplace = false;
+			for (const pc of change.propertyChanges ?? []) {
+				if (!pc.requiresReplacement) continue;
+				if (pc.inPlacePropagated === true || pc.replacementPropagated === true) mayReplace = true;
+				else return "WILL_REPLACE";
+			}
+			return mayReplace ? "MAY_REPLACE" : void 0;
+		}
+		default: return;
+	}
+}
+function constructPathOf(template, logicalId) {
+	const resources = template?.Resources;
+	if (resources === void 0 || !Object.hasOwn(resources, logicalId)) return void 0;
+	const path = resources[logicalId]?.Metadata?.[PATH_METADATA_KEY];
+	return typeof path === "string" && path !== "" ? path : void 0;
+}
+function describeDestructiveImpact(impact) {
+	switch (impact) {
+		case "WILL_REPLACE": return "will be replaced";
+		case "MAY_REPLACE": return "may be replaced";
+		case "WILL_DESTROY": return "will be destroyed";
+		case "WILL_ORPHAN": return "will be orphaned";
+	}
+}
+function formatDestructiveChange(change) {
+	const path = change.constructPath !== void 0 ? `${displaySafe(displayPath(change.constructPath))} ` : "";
+	return `${displayIdent(change.stackName)}: ${displaySafe(change.resourceType)} ${path}${displayIdent(change.logicalId)} ${describeDestructiveImpact(change.impact)}`;
+}
+function displayPath(constructPath) {
+	let parts = constructPath.replace(/^\//, "").split("/");
+	if (parts.length > 1) {
+		parts = parts.slice(1);
+		const last = parts[parts.length - 1];
+		if (parts.length > 1 && (last === "Resource" || last === "Default")) parts = parts.slice(0, -1);
+	}
+	return parts.join("/");
+}
+function withConstructPath(record, path) {
+	if (path === void 0 || record.constructPath === path) return record;
+	return {
+		...record,
+		constructPath: path
+	};
+}
+
 //#endregion
 //#region src/deployment/masking-retry-logger.ts
 function maskingRetryLogger(logger, secrets) {
@@ -27178,9 +27414,9 @@ const REDACTED_DELETE_ADDRESS_SKIP_REASON = "redacted address property in state
 function redactedDeleteAddressFields(fields) {
 	return Object.keys(fields).filter((key) => isRedactedRecordedValue(fields[key]));
 }
-function redactedDeleteAddressSkip(logger, logicalId, what, redactedFields) {
+function redactedDeleteAddressSkip(logger, logicalId, what, redactedFields, context) {
 	if (redactedFields.length === 0) return void 0;
-	logger.warn(safeMsg`${what} ${logicalId} is recorded in state with ${redactedFields.join(", ")} ` + "redacted (the '***' mask of a NoEcho value it read, or a secret '{{resolve:...}}' reference), which names nothing in AWS; skipping deletion — no AWS call is issued, so the resource is LEFT IN PLACE unless a parent resource this run also deletes removes it (then only the record is stale). Re-deploying records the same redaction again. The state record is KEPT and the run reports the skip: on 'cdkd destroy' / 'cdkd state destroy' (which exits non-zero) and, since issue 1762, on the plain DELETE of a resource removed from the template during cdkd deploy. Remove the resource by hand, then clear the stack's records with 'cdkd state orphan <stack>' — that command drops EVERY record for the stack, not just this one. NOTE a deploy-side REPLACEMENT or rollback delete instead FAILS the resource (https://github.com/go-to-k/cdkd/issues/1762) — the old resource is left untracked there, so remove it by hand.");
+	logger.warn(safeMsg`${what} ${logicalId} is recorded in state with ${redactedFields.join(", ")} ` + "redacted (the '***' mask of a NoEcho value it read, or a secret '{{resolve:...}}' reference), which names nothing in AWS; skipping deletion — no AWS call is issued, so the resource is LEFT IN PLACE unless a parent resource this run also deletes removes it (then only the record is stale). Re-deploying records the same redaction again. The state record is KEPT and the run reports the skip: on 'cdkd destroy' / 'cdkd state destroy' (which exits non-zero) and, since issue 1762, on the plain DELETE of a resource removed from the template during cdkd deploy. Remove the resource by hand, " + safeMsg`then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}. ` + "NOTE a deploy-side REPLACEMENT or rollback delete instead FAILS the resource (https://github.com/go-to-k/cdkd/issues/1762) — the old resource is left untracked there, so remove it by hand.");
 	return {
 		outcome: "skipped",
 		reason: REDACTED_DELETE_ADDRESS_SKIP_REASON
@@ -28154,6 +28390,15 @@ function classifyFailedOp(op, stateResources) {
 	const current = stateResources[op.logicalId];
 	if (op.changeType === "CREATE") {
 		if (!op.physicalId) return "skip-failed-unknown";
+		if (op.physicalIdRecoveredFromError === false) return "skip-failed-superseded";
+		if (op.physicalIdRecoveredFromError === true) {
+			if (current) return current.physicalId === op.physicalId ? "skip-failed-noop" : "skip-failed-mismatch";
+			if (stateHoldsPhysicalId(stateResources, op.resourceType, op.physicalId)) return "skip-failed-noop";
+			const orphanPolicy = effectiveDeletionPolicy(op.resourceType, op.deletionPolicy, op.attemptedProperties);
+			if (orphanPolicy === "Retain") return "orphan-failed-create-retain";
+			if (orphanPolicy === "Snapshot") return "delete-failed-create-with-final-snapshot";
+			return "delete-failed-create";
+		}
 		if (!current) return "skip-failed-noop";
 		if (current.physicalId !== op.physicalId) return "skip-failed-mismatch";
 		const policy = effectiveDeletionPolicy(current.resourceType, current.deletionPolicy, current.properties);
@@ -28165,6 +28410,31 @@ function classifyFailedOp(op, stateResources) {
 	if (isTypeChangeOp(op)) return "skip-failed-type-change";
 	return "revert-failed-update";
 }
+function stateHoldsPhysicalId(stateResources, resourceType, physicalId) {
+	return Object.values(stateResources).some((r) => r?.resourceType === resourceType && r.physicalId === physicalId);
+}
+function demoteSupersededOrphans(segments, orphans = []) {
+	let demoted = 0;
+	segments.forEach((segment, s) => {
+		for (const op of segment.failedOperations ?? []) {
+			if (op.changeType !== "CREATE" || op.physicalIdRecoveredFromError !== true) continue;
+			if (segments.slice(s + 1).some((t) => (t.operations ?? []).some((o) => mayOwn(o, op, true)) || (t.failedOperations ?? []).some((o) => mayOwn(o, op, false))) || segments.slice(s).some((t) => t.supersededLogicalIds?.includes(op.logicalId) === true) || orphans.some((o) => o?.logicalId === op.logicalId || o?.state?.resourceType === op.resourceType && o.state?.physicalId === op.physicalId)) {
+				op.physicalIdRecoveredFromError = false;
+				demoted++;
+			}
+		}
+	});
+	return demoted;
+}
+function mayOwn(o, orphan, completed) {
+	if (o?.resourceType !== orphan.resourceType) return false;
+	if (completed && o.changeType === "CREATE") return true;
+	if (o.physicalId === orphan.physicalId) return true;
+	return o.previousState?.physicalId === orphan.physicalId;
+}
+function isJournaledOrphan(op) {
+	return op.changeType === "CREATE" && typeof op.physicalIdRecoveredFromError === "boolean";
+}
 function planFailedOps(failedOps, stateResources) {
 	return failedOps.map((op) => ({
 		op,
@@ -28997,6 +29267,10 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 					logger.warn(safeMsg`  Rollback: Skipping failed CREATE of ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}) — it recorded ${mask(String(op.physicalId))}, which is not the resource state tracks under this id; manual attention may be required`);
 					recordRollbackSkip(skipScope, op, "The failed CREATE recorded a physical id other than the one state now tracks under this logical id, so the rollback left it as it is; manual attention may be required.");
 					break;
+				case "skip-failed-superseded":
+					logger.warn(safeMsg`  Rollback: Skipping failed CREATE of ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}) — it created ${mask(String(op.physicalId))} before failing, and a later deploy or rollback may own a resource under that id now; if it is not in use, delete it manually`);
+					recordRollbackSkip(skipScope, op, "The failed CREATE created its resource before failing, but a later deploy or rollback may own a resource under that id now, so the rollback left it as it is; manual attention may be required.");
+					break;
 				case "skip-failed-unknown":
 					logger.warn(`  Rollback: failed CREATE of ${safe(op.logicalId)} (${safe(op.resourceType)}) recorded no physical id — if it was partially created in AWS, delete it manually`);
 					recordRollbackSkip(skipScope, op, "The failed CREATE recorded no physical id, so the rollback cannot address it; if it was partially created in AWS, delete it manually.");
@@ -29024,7 +29298,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 					}
 					delete stateResources[op.logicalId];
 					await noteRetainedResource(op.resourceType, op.logicalId);
-					logger.info(`  Rollback: leaving partially-created ${safe(op.logicalId)} (${safe(op.resourceType)}) in AWS (DeletionPolicy: Retain) — removed from state`);
+					logger.info(`  Rollback: leaving partially-created ${safe(op.logicalId)} (${safe(op.resourceType)}) in AWS (DeletionPolicy: Retain)` + (failedCreateRecord ? " — removed from state" : " — it was never in state"));
 					await options.afterOp?.(op.logicalId);
 					ctx.recordEvent?.({
 						eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
@@ -29044,7 +29318,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 					const takeFinalSnapshot = snapshotPolicy && ctx.skipFinalSnapshot !== true;
 					let finalSnapshotIdentifier;
 					if (takeFinalSnapshot) finalSnapshotIdentifier = await prepareCreateRollbackFinalSnapshot(op, deleteProvisionedBy, ctx, mask);
-					logger.info(`  Rollback: deleting partially-created ${safe(op.logicalId)} (${safe(op.resourceType)}) (--revert-failed)` + (takeFinalSnapshot ? " — DeletionPolicy: Snapshot" : "") + (snapshotPolicy && !takeFinalSnapshot ? " — DeletionPolicy: Snapshot NOT taken (--skip-final-snapshot)" : ""));
+					logger.info(`  Rollback: deleting partially-created ${safe(op.logicalId)} (${safe(op.resourceType)})` + (takeFinalSnapshot ? " — DeletionPolicy: Snapshot" : "") + (snapshotPolicy && !takeFinalSnapshot ? " — DeletionPolicy: Snapshot NOT taken (--skip-final-snapshot)" : ""));
 					const { provider, provisionedBy: deleteRoutedVia } = ctx.providerRegistry.getProviderFor({
 						resourceType: op.resourceType,
 						provisionedBy: deleteProvisionedBy
@@ -29058,7 +29332,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						deletionPolicy: snapshotPolicy ? "Snapshot" : "Delete",
 						recordedAttributes: stateResources[op.logicalId]?.attributes
 					});
-					throwIfDeleteSkipped(failedCreateDelete, op.logicalId, op.physicalId, "while deleting the partially-created resource (--revert-failed)", {
+					throwIfDeleteSkipped(failedCreateDelete, op.logicalId, op.physicalId, "while deleting the partially-created resource", {
 						ctx,
 						stackName,
 						resourceType: op.resourceType,
@@ -29165,7 +29439,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 				error: maskedRollbackEventError(revertError, mask)
 			});
 		}
-		inlinePolicyWriters.noteOutcome(op, action === "skip-failed-noop" || action === "skip-failed-mismatch" || ownRecord(stateResources, op.logicalId) !== recordBefore);
+		inlinePolicyWriters.noteOutcome(op, action === "skip-failed-noop" || action === "skip-failed-mismatch" || action === "skip-failed-superseded" || ownRecord(stateResources, op.logicalId) !== recordBefore);
 	}
 	if (result.interrupted) await restoreHeldInlinePolicies(inlinePolicyWriters, stateResources, stackName, ctx, result, { refuseAll: true });
 	if (emitEnvelope) ctx.recordEvent?.({
@@ -29210,7 +29484,7 @@ async function collectNestedChildUnaddressed(fn) {
 //#endregion
 //#region src/deployment/nested-child-journal.ts
 const NESTED_PENDING_PARENT_REASON = "nested-pending-parent";
-const NESTED_STACK_TYPE$1 = "AWS::CloudFormation::Stack";
+const NESTED_STACK_TYPE$2 = "AWS::CloudFormation::Stack";
 const MAX_NESTED_WALK_DEPTH = 32;
 function nestedChildStackName(parentStackName, logicalId) {
 	return `${parentStackName}~${logicalId}`;
@@ -29266,7 +29540,7 @@ function recordDisplacedSkips(recordEvent, stackName, ops) {
 	});
 }
 function revertedNestedRowIds(ops) {
-	return ops.filter((op) => op.resourceType === NESTED_STACK_TYPE$1 && op.changeType === "UPDATE").map((op) => op.logicalId);
+	return ops.filter((op) => op.resourceType === NESTED_STACK_TYPE$2 && op.changeType === "UPDATE").map((op) => op.logicalId);
 }
 const revertRunStorage = new AsyncLocalStorage();
 function withNestedRevertRun(runId, fn) {
@@ -29292,7 +29566,7 @@ async function dropNestedChildJournals(args) {
 	if (!isPlainRecord(resources)) return;
 	if (depthExceeded(depth, parentStackName, logger)) return;
 	for (const [logicalId, record] of Object.entries(resources)) {
-		if (!isPlainRecord(record) || record["resourceType"] !== NESTED_STACK_TYPE$1) continue;
+		if (!isPlainRecord(record) || record["resourceType"] !== NESTED_STACK_TYPE$2) continue;
 		const child = nestedChildStackName(parentStackName, logicalId);
 		try {
 			const data = await stateBackend.getState(child, region);
@@ -29306,13 +29580,34 @@ async function dropNestedChildJournals(args) {
 			warnUncleared(logger, child, error);
 		}
 		try {
-			await withChildLock(args.lockManager, child, region, logger, () => stateBackend.deleteRollbackJournal(child, region));
-			logger.debug(safeMsg`Deleted the rollback journal of nested stack ${displaySafe(child)}`);
+			if (await withChildLock(args.lockManager, child, region, logger, async () => {
+				if (args.beforeDelete) {
+					if (!await args.beforeDelete(child, await readOwnRecord(stateBackend, child, region))) return false;
+				}
+				let gone;
+				try {
+					gone = await stateBackend.deleteRollbackJournal(child, region);
+				} catch (error) {
+					await args.onDeleteFailed?.(child);
+					throw error;
+				}
+				if (gone === false) {
+					await args.onDeleteFailed?.(child);
+					return false;
+				}
+				return true;
+			})) logger.debug(safeMsg`Deleted the rollback journal of nested stack ${displaySafe(child)}`);
 		} catch (error) {
 			warnUncleared(logger, child, error);
 		}
 	}
 }
+async function readOwnRecord(stateBackend, child, region) {
+	try {
+		const data = await stateBackend.getState(child, region);
+		if (data && isPlainRecord(data.state) && isPlainRecord(data.state.resources) && (data.state.stackName === void 0 || data.state.stackName === child)) return data.state;
+	} catch {}
+}
 async function dropSettledNestedJournals(args) {
 	const { stateBackend, parentStackName, region, runId, logger } = args;
 	const depth = args.depth ?? 0;
@@ -29622,6 +29917,306 @@ function makeSiblingClaimReader(params) {
 	};
 }
 
+//#endregion
+//#region src/deployment/rollback-executor/journaled-orphans.ts
+const NONE = {
+	segments: [],
+	count: 0
+};
+async function loadJournaledOrphans(stateBackend, stackName, region, rollbackOrphans, logger, options = {}) {
+	let segments;
+	try {
+		const journal = await stateBackend.loadRollbackJournal(stackName, region);
+		if (!journal) return NONE;
+		segments = journal.segments;
+	} catch (err) {
+		const detail = err instanceof Error ? err.message : String(err);
+		logger.warn(safeMsg`Could not read the stack's rollback journal (${displaySafe(detail)}); ` + safeMsg`no resource it records for a failed CREATE is deleted, and ${options.unreadableOutcome ?? "a destroy that proceeds removes the journal with the state"}.`);
+		return {
+			...NONE,
+			unreadable: true
+		};
+	}
+	const physicalIdOnly = (ops) => ops.filter((op) => op.changeType !== "CREATE");
+	const evidence = segments.map((segment) => options.deployRunId !== void 0 && segment.reason === "nested-pending-parent" && segment.runId === options.deployRunId ? {
+		...segment,
+		operations: physicalIdOnly(segment.operations)
+	} : segment);
+	const newer = options.newerOperations ?? [];
+	if (newer.length > 0) evidence.push({ operations: physicalIdOnly(newer) });
+	demoteSupersededOrphans(evidence, Array.isArray(rollbackOrphans) ? rollbackOrphans : []);
+	const deployLogicalIds = new Set(newer.map((op) => op.logicalId));
+	for (const segment of segments) if (options.deployRunId !== void 0 && segment.reason === "nested-pending-parent" && segment.runId === options.deployRunId) for (const op of segment.operations) deployLogicalIds.add(op.logicalId);
+	const out = [];
+	let count = 0;
+	for (let s = segments.length - 1; s >= 0; s--) {
+		const segment = segments[s];
+		if (segment.reason === "nested-pending-parent") continue;
+		const ops = splitImportedOps(segment.failedOperations ?? [], segment).replay.filter(isJournaledOrphan);
+		if (ops.length === 0) continue;
+		out.push({
+			segment,
+			ops
+		});
+		count += ops.length;
+	}
+	return {
+		segments: out,
+		count,
+		deployLogicalIds
+	};
+}
+function journaledOrphanLines(orphans, logger) {
+	return orphans.segments.flatMap(({ ops }) => ops.map((op) => `  - ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)})  ${displacedPhysicalIdShown(op, logger) ?? "a physical id"}`));
+}
+async function deleteJournaledOrphans(orphans, stateResources, stackName, ctx, options = {}) {
+	const total = {
+		failures: 0,
+		warnings: 0,
+		interrupted: false,
+		handled: []
+	};
+	const inlinePolicyWriters = new RollbackInlinePolicyWriters();
+	for (const { segment, ops } of orphans.segments) {
+		if (options.isInterrupted?.()) {
+			total.interrupted = true;
+			break;
+		}
+		const replay = () => withStackName(stackName, () => replayFailedOperations(ops, stateResources, stackName, ctx, {
+			emitEnvelope: false,
+			inlinePolicyWriters,
+			...options.isInterrupted && { isInterrupted: options.isInterrupted }
+		}));
+		const result = segment.skipPrefix === void 0 ? await replay() : await withSkipPrefix(segment.skipPrefix, replay);
+		total.failures += result.failures;
+		total.warnings += result.warnings;
+		const pending = new Set(result.remainingFailedOps);
+		for (const op of ops) if (!pending.has(op)) total.handled.push({
+			segment,
+			op
+		});
+		if (result.interrupted) {
+			total.interrupted = true;
+			break;
+		}
+	}
+	return total;
+}
+async function settleJournaledOrphansOnSuccess(args) {
+	const { stateBackend, stackName, region, stateResources, newerOperations, ctx, logger } = args;
+	const stack = displayIdent(stackName);
+	const newerIds = newerOperations.map((op) => op.logicalId);
+	let orphans;
+	try {
+		orphans = await loadJournaledOrphans(stateBackend, stackName, region, args.rollbackOrphans, logger, {
+			newerOperations,
+			...args.deployRunId !== void 0 && { deployRunId: args.deployRunId },
+			unreadableOutcome: "the successful deploy removes the journal"
+		});
+	} catch (err) {
+		logger.warn(safeMsg`Could not act on the rollback journal of stack ${stack}: ${errorDetail(err)}. It is kept.`);
+		await markSuperseded(stateBackend, stackName, region, newerIds);
+		return {
+			unaddressed: 1,
+			keepJournal: true
+		};
+	}
+	if (orphans.count === 0) return {
+		unaddressed: 0,
+		keepJournal: false
+	};
+	const all = orphans.segments.flatMap(({ segment, ops }) => ops.map((op) => ({
+		segment,
+		op
+	})));
+	let kept = all;
+	if (stateResources === void 0) logger.warn(safeMsg`The rollback journal of stack ${stack} records ${all.length} resource(s) a failed deploy ` + `created, but the stack's state cannot be read, so whether a record now owns them is unknown: none is deleted.`);
+	else {
+		logger.info(safeMsg`The rollback journal of stack ${stack} records ${all.length} resource(s) a failed deploy ` + `created that no state record holds; acting on them per their DeletionPolicy before the journal is removed:`);
+		for (const line of journaledOrphanLines(orphans, logger)) logger.info(line);
+		try {
+			const { unreadable, tracked } = await applySuccessRule(orphans, stateResources, orphans.deployLogicalIds ?? /* @__PURE__ */ new Set(), args.foreignHolder, stack, logger, args.isInterrupted);
+			const outcome = await deleteJournaledOrphans({
+				segments: orphans.segments.map(({ segment, ops }) => ({
+					segment,
+					ops: ops.filter((op) => !unreadable.has(op) && !tracked.has(op))
+				})).filter(({ ops }) => ops.length > 0),
+				count: orphans.count - unreadable.size - tracked.size
+			}, { ...stateResources }, stackName, ctx, args.isInterrupted ? { isInterrupted: args.isInterrupted } : {});
+			kept = all.filter(({ segment, op }) => unreadable.has(op) || !tracked.has(op) && !isHandledOrphan(outcome.handled, segment, op));
+		} catch (err) {
+			logger.warn(safeMsg`Acting on the journaled resources of stack ${stack} failed: ${errorDetail(err)}`);
+		}
+	}
+	const keptOps = new Set(kept.map(({ op }) => op));
+	const skipped = all.filter(({ op }) => !keptOps.has(op) && op.physicalIdRecoveredFromError === false).length;
+	const cleared = all.filter(({ op }) => !keptOps.has(op));
+	const stripCleared = cleared.length === 0 ? void 0 : async () => {
+		try {
+			await stateBackend.dropRollbackJournalFailedOperations(stackName, region, (op, segment) => isHandledOrphan(cleared, segment, op));
+		} catch (err) {
+			logger.warn(safeMsg`Failed to remove the settled entries from the rollback journal of stack ${stack}: ` + safeMsg`${errorDetail(err)}. A cdkd rollback or cdkd destroy could act on them again; run a ` + "successful cdkd deploy of the stack first, which settles them again.");
+		}
+	};
+	if (kept.length === 0) return {
+		unaddressed: skipped,
+		keepJournal: false,
+		...stripCleared && { stripCleared }
+	};
+	const keptIds = new Set(kept.map(({ op }) => op.logicalId));
+	const supersededIds = newerIds.filter((id) => !keptIds.has(id));
+	const demoted = kept.filter(({ op }) => op.physicalIdRecoveredFromError === false);
+	const reduce = () => stateBackend.reduceRollbackJournalToFailedOperations(stackName, region, (op, segment) => isHandledOrphan(kept, segment, op), supersededIds, (op, segment) => isHandledOrphan(demoted, segment, op));
+	let reduced = false;
+	for (let attempt = 0; attempt < 2 && !reduced; attempt++) try {
+		await reduce();
+		reduced = true;
+	} catch (err) {
+		if (attempt === 1) logger.warn(safeMsg`Failed to reduce the rollback journal of stack ${stack} to its undeleted resources: ` + safeMsg`${errorDetail(err)}. The whole journal is kept.`);
+	}
+	if (!reduced) {
+		await markSuperseded(stateBackend, stackName, region, supersededIds);
+		await stripCleared?.();
+	}
+	logger.warn(safeMsg`${kept.length} resource(s) a failed deploy of stack ${stack} created were not deleted ` + (reduced ? "(see above). The rollback journal, their only record, is kept with just them; the next " : "(see above). The rollback journal, their only record, is kept; the next ") + "successful deploy retries.");
+	return {
+		unaddressed: kept.length + skipped,
+		keepJournal: true
+	};
+}
+async function applySuccessRule(orphans, stateResources, deployLogicalIds, foreignHolder, stack, logger, isInterrupted) {
+	const unreadable = /* @__PURE__ */ new Set();
+	const tracked = /* @__PURE__ */ new Set();
+	let interrupted = false;
+	for (const { ops } of orphans.segments) for (const op of ops) {
+		if (op.physicalIdRecoveredFromError !== true || !op.physicalId) continue;
+		if (interrupted || isInterrupted?.()) {
+			interrupted = true;
+			unreadable.add(op);
+			continue;
+		}
+		if (Object.values(stateResources).some((r) => r?.resourceType === op.resourceType && r.physicalId === op.physicalId)) {
+			tracked.add(op);
+			continue;
+		}
+		if (Object.prototype.hasOwnProperty.call(stateResources, op.logicalId) || deployLogicalIds.has(op.logicalId)) {
+			op.physicalIdRecoveredFromError = false;
+			continue;
+		}
+		const holding = await foreignHolder(op.resourceType, op.physicalId);
+		if (holding === void 0) continue;
+		if (holding.kind === "held") {
+			logger.warn(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is not deleted: ${holding.by} holds a resource of that type under ` + "the same physical id.");
+			op.physicalIdRecoveredFromError = false;
+			continue;
+		}
+		logger.warn(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is not deleted: ${holding.what}, so whether another stack holds it is unknown.`);
+		unreadable.add(op);
+	}
+	return {
+		unreadable,
+		tracked
+	};
+}
+function makeForeignHolderScan(stateBackend) {
+	let scan;
+	const key = (type, id) => JSON.stringify([type, id]);
+	const run = async () => {
+		const holders = /* @__PURE__ */ new Map();
+		let refs;
+		try {
+			refs = await stateBackend.listStacks();
+		} catch {
+			return {
+				holders,
+				unreadable: "the state bucket listing (it could not be read)"
+			};
+		}
+		let unreadable;
+		await Promise.all(refs.map(async (ref) => {
+			const named = (why) => safeMsg`the state record of stack ${displayIdent(ref.stackName)} (${why})`;
+			if (ref.region === void 0) {
+				unreadable ??= named("its region cannot be read");
+				return;
+			}
+			const region = ref.region;
+			let state;
+			try {
+				state = (await stateBackend.getState(ref.stackName, region))?.state;
+			} catch {
+				unreadable ??= named("it could not be read");
+				return;
+			}
+			if (state === void 0) return;
+			const resources = state.resources;
+			if (resources !== void 0 && (typeof resources !== "object" || resources === null || Array.isArray(resources))) {
+				unreadable ??= named("its resources cannot be read");
+				return;
+			}
+			if (!hasReadableOrphans(state) || unreadableOrphanRecords(state).length > 0) {
+				unreadable ??= named("its rollback-orphan records cannot be read");
+				return;
+			}
+			const held = [...Object.values(resources ?? {}), ...(state.orphans ?? []).map((record) => record.state)];
+			for (const record of held) {
+				const r = record;
+				if (typeof r?.resourceType !== "string" || typeof r.physicalId !== "string") continue;
+				const k = key(r.resourceType, r.physicalId);
+				const list = holders.get(k) ?? [];
+				list.push({
+					stackName: ref.stackName,
+					region
+				});
+				holders.set(k, list);
+			}
+		}));
+		return {
+			holders,
+			...unreadable !== void 0 && { unreadable }
+		};
+	};
+	return (self) => async (resourceType, physicalId) => {
+		scan ??= run();
+		const { holders, unreadable } = await scan;
+		const other = (holders.get(key(resourceType, physicalId)) ?? []).find((h) => !(h.stackName === self.stackName && h.region === self.region));
+		if (other) return {
+			kind: "held",
+			by: safeMsg`the state record of stack ${displayIdent(other.stackName)} (${displaySafe(other.region)})`
+		};
+		return unreadable === void 0 ? void 0 : {
+			kind: "unreadable",
+			what: unreadable
+		};
+	};
+}
+async function markSuperseded(stateBackend, stackName, region, ids) {
+	try {
+		await stateBackend.markRollbackJournalSuperseded(stackName, region, ids);
+	} catch {}
+}
+function errorDetail(err) {
+	return displaySafe(err instanceof Error ? err.message : String(err));
+}
+function isHandledOrphan(handled, segment, op) {
+	return handled.some((h) => h.segment.timestamp === segment.timestamp && h.segment.runId === segment.runId && h.op.logicalId === op.logicalId && h.op.changeType === op.changeType && h.op.resourceType === op.resourceType && h.op.physicalId === op.physicalId);
+}
+function orphanKey(segment, op) {
+	return JSON.stringify([
+		segment.timestamp,
+		segment.runId ?? null,
+		op.logicalId,
+		op.changeType,
+		op.resourceType,
+		op.physicalId ?? null
+	]);
+}
+function sameJournaledOrphans(a, b) {
+	const keys = (o) => o.segments.flatMap(({ segment, ops }) => ops.map((op) => orphanKey(segment, op))).sort();
+	const ka = keys(a);
+	const kb = keys(b);
+	return ka.length === kb.length && ka.every((k, i) => k === kb[i]);
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/rollback.ts
 function redactOperationsForJournal(operations) {
@@ -29670,33 +30265,109 @@ async function adoptRollbackOrphans(currentState, effectiveTemplate) {
 	if (records.length > 0) currentState.orphans = plan.remaining;
 	return plan;
 }
-async function performRollback(completedOperations, stateResources, stackName, previousState) {
+async function performRollback(completedOperations, stateResources, stackName, previousState, failedOperations = [], priorOrphans = []) {
+	const orphanIndexes = [];
+	const orphanOps = [];
+	failedOperations.forEach((op, i) => {
+		if (!isJournaledOrphan(op)) return;
+		orphanIndexes.push(i);
+		orphanOps.push({ ...op });
+	});
+	demoteSupersededOrphans([{
+		operations: completedOperations,
+		failedOperations: orphanOps
+	}], priorOrphans);
+	const ctx = this.rollbackExecutorContext(previousState, stackName);
+	const inlinePolicyWriters = new RollbackInlinePolicyWriters();
 	const runId = this.options.eventRecorder?.runId;
-	const { result, run } = await withNestedRevertRun(runId, async (scope) => ({
-		result: await replayRollback(completedOperations, stateResources, stackName, this.rollbackExecutorContext(previousState, stackName)),
-		run: scope
-	}));
+	const { result, failed, run } = await withNestedRevertRun(runId, async (scope) => {
+		return {
+			failed: orphanOps.length > 0 ? await replayFailedOperations(orphanOps, stateResources, stackName, ctx, {
+				emitEnvelope: completedOperations.length === 0,
+				inlinePolicyWriters
+			}) : void 0,
+			result: await replayRollback(completedOperations, stateResources, stackName, ctx, { inlinePolicyWriters }),
+			run: scope
+		};
+	});
+	const pendingOrphans = new Set(failed?.remainingFailedOps ?? []);
+	const handled = new Set(orphanIndexes.filter((_, k) => !pendingOrphans.has(orphanOps[k])));
 	return {
-		failures: result.failures,
-		warnings: result.warnings + run.warnings,
-		skipped: result.skipped,
-		orphaned: result.orphaned,
-		settledNested: run.settled
+		failures: result.failures + (failed?.failures ?? 0),
+		warnings: result.warnings + run.warnings + (failed?.warnings ?? 0),
+		skipped: result.skipped + (failed?.skipped ?? 0),
+		orphaned: [...failed?.orphaned ?? [], ...result.orphaned],
+		settledNested: run.settled,
+		remainingFailedOps: failedOperations.filter((_, i) => !handled.has(i))
 	};
 }
 async function settleJournalAfterSuccess(stackName, completedOperations, previousState, finalResources, initialDeploy) {
 	if (this.options.parentStackInfo) {
 		await this.writeRollbackJournalSegment(stackName, completedOperations, [], NESTED_PENDING_PARENT_REASON, initialDeploy, nestedPendingSnapshot(previousState));
-		return;
-	}
-	await Promise.all([this.deleteRollbackJournalBestEffort(stackName, completedOperations.map((op) => op.logicalId)), dropNestedChildJournals({
+		return 0;
+	}
+	let nestedLeft = 0;
+	const foreignHolderFor = makeForeignHolderScan(this.stateBackend);
+	const deployRunId = this.options.eventRecorder?.runId;
+	const stripOnFailure = /* @__PURE__ */ new Map();
+	const [ownLeft] = await Promise.all([(async () => {
+		const own = await settleJournaledOrphansOnSuccess({
+			stateBackend: this.stateBackend,
+			stackName,
+			region: this.stackRegion,
+			stateResources: finalResources,
+			rollbackOrphans: previousState.orphans,
+			newerOperations: completedOperations,
+			...deployRunId !== void 0 && { deployRunId },
+			foreignHolder: foreignHolderFor({
+				stackName,
+				region: this.stackRegion
+			}),
+			ctx: this.rollbackExecutorContext(previousState, stackName),
+			isInterrupted: () => this.interrupted,
+			logger: this.logger
+		});
+		if (own.keepJournal) return own.unaddressed;
+		if (!await this.deleteRollbackJournalBestEffort(stackName, completedOperations.map((op) => op.logicalId))) await own.stripCleared?.();
+		return own.unaddressed;
+	})(), dropNestedChildJournals({
 		stateBackend: this.stateBackend,
 		lockManager: this.lockManager,
 		parentStackName: stackName,
 		region: this.stackRegion,
 		resources: finalResources,
-		logger: this.logger
+		logger: this.logger,
+		beforeDelete: async (child, childRecord) => {
+			const childState = childRecord !== void 0 && hasReadableOrphans(childRecord) ? childRecord : void 0;
+			const settled = await settleJournaledOrphansOnSuccess({
+				stateBackend: this.stateBackend,
+				stackName: child,
+				region: this.stackRegion,
+				stateResources: childState?.resources,
+				rollbackOrphans: childState?.orphans,
+				newerOperations: [],
+				...deployRunId !== void 0 && { deployRunId },
+				foreignHolder: foreignHolderFor({
+					stackName: child,
+					region: this.stackRegion
+				}),
+				isInterrupted: () => this.interrupted,
+				ctx: {
+					...this.rollbackExecutorContext(childState ?? previousState, child),
+					producerRegionsIncomplete: true,
+					nestedChildStack: child
+				},
+				logger: this.logger
+			});
+			nestedLeft += settled.unaddressed;
+			if (settled.stripCleared) stripOnFailure.set(child, settled.stripCleared);
+			return !settled.keepJournal;
+		},
+		onDeleteFailed: async (child) => {
+			await stripOnFailure.get(child)?.();
+		}
 	})]);
+	return ownLeft + nestedLeft;
 }
 async function deleteRollbackJournalBestEffort(stackName, supersededLogicalIds = []) {
 	let deleted;
@@ -29706,12 +30377,14 @@ async function deleteRollbackJournalBestEffort(stackName, supersededLogicalIds =
 		this.logger.debug(safeMsg`Failed to delete rollback journal for ${stackName}: ${err instanceof Error ? err.message : String(err)}`);
 		deleted = false;
 	}
-	if (deleted !== false || supersededLogicalIds.length === 0) return;
+	if (deleted !== false) return true;
+	if (supersededLogicalIds.length === 0) return false;
 	try {
 		await this.stateBackend.markRollbackJournalSuperseded(stackName, this.stackRegion, supersededLogicalIds);
 	} catch (markErr) {
 		this.logger.debug(safeMsg`Failed to record superseded logical ids on the rollback journal for ${stackName}: ${markErr instanceof Error ? markErr.message : String(markErr)}`);
 	}
+	return false;
 }
 async function settleJournalAfterCleanRollback(stackName, failedOperations, initialDeploy) {
 	if (failedOperations.length === 0) {
@@ -30850,6 +31523,7 @@ function priorAttemptsInJournal(journal, logicalId, resourceType) {
 }
 function recordedAsNewResource(op) {
 	if (typeof op.physicalId !== "string" || op.physicalId === "") return false;
+	if (op.physicalIdRecoveredFromError === true) return false;
 	if (op.changeType === "CREATE") return true;
 	const previous = op.previousState?.physicalId;
 	return typeof previous === "string" && previous !== op.physicalId;
@@ -31502,6 +32176,7 @@ var DynamoDBGlobalTableProvider = class {
 			};
 		} catch (wiringError) {
 			warn(`Wiring failed after CreateTable for ${tableName}; attempting best-effort cleanup`);
+			let tableLeftBehind = false;
 			try {
 				const replicasForCleanup = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.Replicas ?? [];
 				for (const replica of replicasForCleanup) {
@@ -31520,12 +32195,15 @@ var DynamoDBGlobalTableProvider = class {
 				}
 				await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: tableName }));
 			} catch (cleanupErr) {
+				tableLeftBehind = true;
 				const cleanupMsg = describeAwsFailure(cleanupErr).detail;
 				warn(`Partial-create cleanup failed for ${tableName}: ${cleanupMsg}. To remove the orphaned AWS-side table, run: ` + pasteableAwsCommand(maskSecrets)`aws dynamodb delete-table --table-name ${tableName}`.render());
 			}
 			markAuxiliaryFailure(wiringError, logicalId);
 			const cause = wiringError instanceof Error ? wiringError : void 0;
-			throw this.wrapMaskedError(log, wiringError, (text) => new ProvisioningError(`Failed to create DynamoDB GlobalTable ${logicalId}: ${text}`, resourceType, logicalId, tableName, cause));
+			const thrown = this.wrapMaskedError(log, wiringError, (text) => new ProvisioningError(`Failed to create DynamoDB GlobalTable ${logicalId}: ${text}`, resourceType, logicalId, tableName, cause));
+			if (tableLeftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, tableName);
+			throw thrown;
 		}
 	}
 	reportThroughputDiagnostics(diagnostics, logicalId, physicalId, maskSecrets = (text) => text) {
@@ -34547,31 +35225,61 @@ function validateOptions(opts) {
 }
 async function withResourceDeadline(operation, opts) {
 	validateOptions(opts);
-	const startedAt = Date.now();
 	return new Promise((resolve, reject) => {
 		let settled = false;
+		let timedOut = false;
+		let warned = false;
 		let warnTimer;
 		let timeoutTimer;
+		let elapsedBeforePause = 0;
+		let runningSince = Date.now();
+		let pauses = 0;
+		const elapsed = () => elapsedBeforePause + (pauses > 0 ? 0 : Date.now() - runningSince);
 		const cleanup = () => {
 			if (warnTimer !== void 0) clearTimeout(warnTimer);
 			if (timeoutTimer !== void 0) clearTimeout(timeoutTimer);
 			warnTimer = void 0;
 			timeoutTimer = void 0;
 		};
-		if (opts.onWarn) warnTimer = setTimeout(() => {
-			if (settled) return;
-			try {
-				opts.onWarn(Date.now() - startedAt);
-			} catch {}
-		}, opts.warnAfterMs);
-		timeoutTimer = setTimeout(() => {
-			if (settled) return;
-			settled = true;
-			cleanup();
-			const elapsed = Date.now() - startedAt;
-			reject(opts.onTimeout(elapsed));
-		}, opts.timeoutMs);
-		Promise.resolve().then(() => operation()).then((value) => {
+		const arm = () => {
+			if (opts.onWarn && !warned) warnTimer = setTimeout(() => {
+				if (settled) return;
+				warned = true;
+				try {
+					opts.onWarn(elapsed());
+				} catch {}
+			}, Math.max(0, opts.warnAfterMs - elapsed()));
+			timeoutTimer = setTimeout(() => {
+				if (settled) return;
+				settled = true;
+				timedOut = true;
+				cleanup();
+				reject(opts.onTimeout(elapsed()));
+			}, Math.max(0, opts.timeoutMs - elapsed()));
+		};
+		arm();
+		const outer = deadlineScope.getStore();
+		const control = {
+			pause: () => {
+				pauses += 1;
+				if (pauses === 1) {
+					elapsedBeforePause += Date.now() - runningSince;
+					cleanup();
+				}
+				outer?.pause();
+			},
+			resume: () => {
+				if (pauses === 0) return;
+				pauses -= 1;
+				if (pauses === 0) {
+					runningSince = Date.now();
+					if (!settled) arm();
+				}
+				outer?.resume();
+			},
+			expired: () => timedOut || (outer?.expired() ?? false)
+		};
+		Promise.resolve().then(() => deadlineScope.run(control, operation)).then((value) => {
 			if (settled) return;
 			settled = true;
 			cleanup();
@@ -34584,6 +35292,20 @@ async function withResourceDeadline(operation, opts) {
 		});
 	});
 }
+const deadlineScope = new AsyncLocalStorage();
+async function whileEnclosingDeadlinesPaused(fn) {
+	const control = deadlineScope.getStore();
+	if (control === void 0) return fn();
+	control.pause();
+	try {
+		return await fn();
+	} finally {
+		control.resume();
+	}
+}
+function enclosingDeadlineExpired() {
+	return deadlineScope.getStore()?.expired() ?? false;
+}
 
 //#endregion
 //#region src/deployment/deploy-engine/provision.ts
@@ -34979,15 +35701,20 @@ async function executeDeployment(template, currentState, changes, dag, execution
 					this.interrupted = true;
 					this.interruptCause ??= "sibling-failure";
 					const refused = isRefusedBeforeApplying(provisionError, logicalId);
-					const physicalId = newResources[logicalId]?.physicalId ?? previousState?.physicalId;
-					if (refused && change.changeType === "CREATE" && physicalId === void 0) throw provisionError;
+					const statePhysicalId = newResources[logicalId]?.physicalId ?? previousState?.physicalId;
+					if (refused && change.changeType === "CREATE" && statePhysicalId === void 0) throw provisionError;
+					const createdId = change.changeType === "CREATE" && statePhysicalId === void 0 ? createdBeforeFailure(provisionError, logicalId, change.resourceType) : void 0;
 					failedOperations.push({
 						logicalId,
 						changeType: change.changeType,
 						resourceType: change.resourceType,
-						provisionedBy: newResources[logicalId]?.provisionedBy ?? previousState?.provisionedBy,
+						provisionedBy: createdId !== void 0 ? "sdk" : newResources[logicalId]?.provisionedBy ?? previousState?.provisionedBy,
 						...previousState && { previousState },
-						physicalId,
+						physicalId: createdId ?? statePhysicalId,
+						...createdId !== void 0 && {
+							physicalIdRecoveredFromError: true,
+							deletionPolicy: journaledOrphanPolicy(this.extractTemplateAttributes(template, logicalId).deletionPolicy)
+						},
 						...!refused && { attemptedProperties: this.attemptedResolvedProps.get(logicalId) }
 					});
 					throw provisionError;
@@ -35141,6 +35868,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 		let autoRollbackJournaled = false;
 		let rollbackOrphans = [];
 		let rollbackSettledNested = /* @__PURE__ */ new Map();
+		let rollbackRemainingFailedOps = failedOperations;
 		if (error instanceof InterruptedError || isInterruptedWaitError(error) || this.interruptCause === "user") {
 			await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "interrupted", initialDeploy);
 			this.logger.info(`Partial state saved (${Object.keys(newResources).length} resources). Run deploy again to resume, 'cdkd rollback' to revert, or destroy to clean up.`);
@@ -35152,7 +35880,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			this.logger.warn(safeMsg`Partial state has been saved. ${this.recoveryHint("Run 'cdkd deploy' to resume, 'cdkd rollback' to revert, or destroy to clean up.")}`);
 		} else {
 			autoRollbackJournaled = await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "auto-rollback-started", initialDeploy);
-			const rollbackResult = await this.performRollback(completedOperations, newResources, stackName, currentState);
+			const rollbackResult = await this.performRollback(completedOperations, newResources, stackName, currentState, failedOperations, currentState.orphans ?? []);
 			autoRollbackClean = autoRollbackJournaled && rollbackResult.failures === 0 && rollbackResult.skipped === 0;
 			if (rollbackResult.failures === 0 && rollbackResult.skipped > 0) {
 				this.logger.warn(safeMsg`The automatic rollback could not revert ${rollbackResult.skipped} operation(s) ` + `(see the warnings above; each is recorded as a ROLLBACK_RESOURCE_SKIPPED event).` + (autoRollbackJournaled ? ` The rollback journal keeps them.` : ""));
@@ -35163,6 +35891,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			}
 			rollbackOrphans = rollbackResult.orphaned;
 			rollbackSettledNested = rollbackResult.settledNested;
+			rollbackRemainingFailedOps = rollbackResult.remainingFailedOps;
 		}
 		try {
 			const postRollbackState = {
@@ -35179,7 +35908,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			};
 			await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(postRollbackState), { ...currentEtag !== void 0 && { expectedEtag: currentEtag } });
 			this.logger.debug("State saved after deployment failure");
-			if (autoRollbackClean) await this.settleNestedChildrenAfterCleanRollback(stackName, rollbackSettledNested, await this.settleJournalAfterCleanRollback(stackName, failedOperations, initialDeploy));
+			if (autoRollbackClean) await this.settleNestedChildrenAfterCleanRollback(stackName, rollbackSettledNested, await this.settleJournalAfterCleanRollback(stackName, rollbackRemainingFailedOps, initialDeploy));
 		} catch (saveError) {
 			this.logger.debug(`Retrying state save after rollback (ETag mismatch): ${saveError instanceof Error ? saveError.message : String(saveError)}`);
 			try {
@@ -35198,7 +35927,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 				};
 				await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(postRollbackState), { ...freshEtag !== void 0 && { expectedEtag: freshEtag } });
 				this.logger.debug("State saved after deployment failure (retry succeeded)");
-				if (autoRollbackClean) await this.settleNestedChildrenAfterCleanRollback(stackName, rollbackSettledNested, await this.settleJournalAfterCleanRollback(stackName, failedOperations, initialDeploy));
+				if (autoRollbackClean) await this.settleNestedChildrenAfterCleanRollback(stackName, rollbackSettledNested, await this.settleJournalAfterCleanRollback(stackName, rollbackRemainingFailedOps, initialDeploy));
 			} catch (retryError) {
 				this.logger.warn(`Failed to save state after rollback: ${retryError instanceof Error ? retryError.message : String(retryError)}`);
 			}
@@ -35265,6 +35994,10 @@ async function persistStateAfterOutputFailure(stackName, currentState, newResour
 		}
 	}
 }
+function journaledOrphanPolicy(policy) {
+	if (policy === void 0) return void 0;
+	return policy === "Delete" || policy === "Retain" || policy === "Snapshot" || policy === "RetainExceptOnCreate" ? policy : "Retain";
+}
 
 //#endregion
 //#region src/provisioning/canonicalize-properties.ts
@@ -35366,6 +36099,62 @@ function refuseNoValueOutputs(outputs, conditions) {
 	throw markNonRetryable(/* @__PURE__ */ new Error(`Output ${offending.join(", ")} evaluates to AWS::NoValue, and CloudFormation rejects the template for it ("The Value field of every Outputs member must evaluate to a String") before creating anything. To publish an Output only sometimes, give it a Condition instead of selecting AWS::NoValue in its Value.`));
 }
 
+//#endregion
+//#region src/deployment/deployment-approval.ts
+const NESTED_STACK_TYPE$1 = "AWS::CloudFormation::Stack";
+async function requireDeploymentApproval(args) {
+	const level = args.options.requireApproval ?? "never";
+	const approve = args.options.approveDeployment;
+	if (level === "never" || approve === void 0) return;
+	const changes = [...args.changes].filter((c) => c.changeType !== "NO_CHANGE");
+	const destructiveChanges = findDestructiveChanges(args.stackName, changes, args.records, args.template, new Set(args.recreateTargetIds ?? []));
+	const onlyNestedUpdates = changes.every((c) => c.changeType === "UPDATE" && c.resourceType === NESTED_STACK_TYPE$1);
+	if (!(level === "destructive" ? destructiveChanges.length > 0 : changes.length > 0 && !onlyNestedUpdates)) return;
+	const count = (type) => changes.filter((c) => c.changeType === type).length;
+	if (enclosingDeadlineExpired()) throw approvalAfterTimeout(args.stackName);
+	let approved;
+	try {
+		approved = await whileEnclosingDeadlinesPaused(() => approve({
+			stackName: args.stackName,
+			level,
+			counts: {
+				create: count("CREATE"),
+				update: count("UPDATE"),
+				delete: count("DELETE")
+			},
+			destructiveChanges
+		}));
+	} catch (error) {
+		throw error instanceof Error ? markNonRetryable(error) : error;
+	}
+	if (!approved) throw markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${args.stackName} was not approved (--require-approval=${level}). Nothing was changed.`, "DEPLOY_NOT_APPROVED"));
+}
+function approvalAfterTimeout(stackName) {
+	return markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${stackName} was not started: its parent's nested-stack row already timed out (--resource-timeout). Nothing was changed.`, "DEPLOY_APPROVAL_AFTER_TIMEOUT"));
+}
+async function requireOutputsOnlyApproval(args) {
+	const approve = args.options.approveDeployment;
+	if (args.options.requireApproval !== "any-change" || approve === void 0) return;
+	if (enclosingDeadlineExpired()) throw approvalAfterTimeout(args.stackName);
+	let approved;
+	try {
+		approved = await whileEnclosingDeadlinesPaused(() => approve({
+			stackName: args.stackName,
+			level: "any-change",
+			counts: {
+				create: 0,
+				update: 0,
+				delete: 0
+			},
+			destructiveChanges: [],
+			outputsOnly: true
+		}));
+	} catch (error) {
+		throw error instanceof Error ? markNonRetryable(error) : error;
+	}
+	if (!approved) throw markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${args.stackName} was not approved (--require-approval=any-change). Nothing was changed.`, "DEPLOY_NOT_APPROVED"));
+}
+
 //#endregion
 //#region src/deployment/condition-verdicts.ts
 function conditionInputsFrom(args) {
@@ -35893,6 +36682,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			}));
 		}
 		const effectiveTemplate = this.templateParser.filterResourcesByCondition(template, conditions);
+		this.constructPathTemplate = effectiveTemplate;
 		const orphanCountBeforeAdoption = (currentState.orphans ?? []).length;
 		const orphanPlan = await this.adoptRollbackOrphans(currentState, effectiveTemplate);
 		if (Object.keys(orphanPlan.adopted).length > 0) {
@@ -35986,6 +36776,10 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 				const skippedOutputsChanged = !skippedOutputsEqual(currentState.skippedOutputs, this.skippedOutputs);
 				const healedAttributesPending = this.hasUnpersistedHeals(currentState.resources);
 				const conditionVerdictsChanged = !conditionVerdictRecordsEqual(readRecordedConditionVerdicts(currentState), conditionVerdicts);
+				if (outputsChanged || exportSetChanged && currentState.exportNames !== void 0) await requireOutputsOnlyApproval({
+					options: this.options,
+					stackName
+				});
 				if (observedRefresh || maskedFingerprintsBackfilled || conditionVerdictsChanged || outputsChanged || exportSetChanged || skippedOutputsChanged || orphansChanged || healedAttributesPending) try {
 					const refreshedState = {
 						version: 10,
@@ -36019,13 +36813,12 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 					this.logger.warn(`Failed to persist no-change state update: ${saveError instanceof Error ? saveError.message : String(saveError)} — drift baseline / outputs will be re-resolved on next deploy.`);
 				}
 			}
-			if (!this.options.dryRun) await this.settleJournalAfterSuccess(stackName, [], currentState, currentState.resources, currentEtag === void 0);
 			return {
 				stackName,
 				created: 0,
 				updated: 0,
 				deleted: 0,
-				deleteSkipped: 0,
+				deleteSkipped: this.options.dryRun ? 0 : await this.settleJournalAfterSuccess(stackName, [], currentState, currentState.resources, currentEtag === void 0),
 				updatePartial: 0,
 				unchanged: Object.keys(currentState.resources).length,
 				durationMs: Date.now() - startTime,
@@ -36051,6 +36844,14 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 				attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
 			};
 		}
+		await requireDeploymentApproval({
+			options: this.options,
+			stackName,
+			changes: changes.values(),
+			records: currentState.resources,
+			template: effectiveTemplate,
+			recreateTargetIds: recreateTargetIdsFor(this.options.recreateTargets, stackName)
+		});
 		this.resolver.resetPhysicalIdFallbackCount();
 		const progress = {
 			current: 0,
@@ -36064,7 +36865,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		} : newState));
 		this.logger.debug(`State saved (ETag: ${newEtag})`);
 		await forgetRecordedCreateTokens(Object.keys(newState.resources));
-		await Promise.all([this.settleJournalAfterSuccess(stackName, completedOperations, currentState, newState.resources, currentEtag === void 0), this.exportIndexStore ? this.exportIndexStore.updateForStack(stackName, this.stackRegion, importableOutputs({
+		const [journaledOrphansLeft] = await Promise.all([this.settleJournalAfterSuccess(stackName, completedOperations, currentState, newState.resources, currentEtag === void 0), this.exportIndexStore ? this.exportIndexStore.updateForStack(stackName, this.stackRegion, importableOutputs({
 			...newState,
 			outputs: this.redactOutputs(newState.outputs)
 		})) : Promise.resolve()]);
@@ -36075,7 +36876,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			created: actualCounts.created,
 			updated: actualCounts.updated,
 			deleted: actualCounts.deleted,
-			deleteSkipped: actualCounts.deleteSkipped,
+			deleteSkipped: actualCounts.deleteSkipped + journaledOrphansLeft,
 			updatePartial: actualCounts.updatePartial,
 			nestedUpdatePartial: actualCounts.nestedUpdatePartial,
 			unchanged: unchangedCount,
@@ -36400,6 +37201,7 @@ var DeployEngine = class {
 	outputsTemplateSource = Object.create(null);
 	resolvedExportNames = [];
 	skippedOutputs;
+	constructPathTemplate;
 	outputsSourceUsable = true;
 	attemptedResolvedProps = /* @__PURE__ */ new Map();
 	liveTaskLabels = /* @__PURE__ */ new Map();
@@ -36441,6 +37243,7 @@ var DeployEngine = class {
 		this.perResourceSecrets = /* @__PURE__ */ new Map();
 		this.noEchoAttributeResources = /* @__PURE__ */ new Map();
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
+		this.constructPathTemplate = void 0;
 		this.perResourceResolvedType = /* @__PURE__ */ new Map();
 		this.fingerprintNoEchoValues = void 0;
 		this.fingerprintParameters = void 0;
@@ -36473,7 +37276,7 @@ var DeployEngine = class {
 			const secrets = this.perResourceSecrets.get(logicalId);
 			const templateProps = this.perResourceTemplateProps.get(logicalId);
 			const scrubbed = scrubResourceRecord(this.withHealedAttributes(logicalId, record), secrets ?? /* @__PURE__ */ new Map(), templateProps);
-			resources[logicalId] = withMaskedPropertyFingerprints(scrubbed, record.properties, templateProps, secrets, this.fingerprintNoEchoValues, this.perResourceInputFingerprints.get(logicalId));
+			resources[logicalId] = withConstructPath(withMaskedPropertyFingerprints(scrubbed, record.properties, templateProps, secrets, this.fingerprintNoEchoValues, this.perResourceInputFingerprints.get(logicalId)), constructPathOf(this.constructPathTemplate, logicalId));
 		}
 		const orphans = state.orphans?.map((entry) => {
 			const sameResource = this.perResourceResolvedType.get(entry.logicalId) === entry.state.resourceType;
@@ -36654,5 +37457,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { resourcesNamingDeclaredParameter as $, wholeStringLeavesOf as $a, isWarmThroughputDecrease as $i, explicitRoleArnOrThrow as $n, partitionSensitiveEnv as $o, malformedOutputsWarning as $r, noEchoParameterValueSeed as $t, resolveDynamoDbDeleteBudgetClock as A, printingCorpusOf as Aa, repairMalformedOrphanRecordsForReadOnly as Ai, ccProtectionRegistryTypes as An, rewriteTemplateAssetReferences as Ao, STATE_REGION_DIVERGED as Ar, expectedOwnerParam as As, ccRoutedFinalSnapshotError as At, getPriorAttempts as B, scrubResourceRecord as Ba, findSilentDropProperties as Bi, isTerminationProtectionPropagationError as Bn, validateContainerRepoName as Bo, isReadableResourceEntry as Br, nullPrototypeRecord as Bs, updatePartialMessage as Bt, perType as C, inheritNestedStackParameterAssociations as Ca, refuseMalformedResourcePropertiesForDrift as Ci, ProviderRegistry as Cn, AssetPublisher as Co, isStalePlaceholderArnAttribute as Cr, CFN_TEMPLATE_BODY_LIMIT as Cs, resolveReplacementOldType as Ct, beginDeleteWait as D, hasMaskableValues as Da, refuseMalformedResourcesForDestroy as Di, getCurrentResourceSecrets as Dn, buildAssetRedirectMap as Do, parameterInputsFor as Dr, uploadCfnTemplate as Ds, ATOMIC_FINAL_SNAPSHOT_TYPES as Dt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as E, createUnionSecretMasker as Ea, refuseMalformedResourcesForDeploy as Ei, isCustomResourceType as En, WorkGraph as Eo, withSharedDrainBudget as Er, findLargeInlineResources as Es, inheritProducerRegions as Et, waitForIndexesSettled as F, errorCauseChain as Fa, repairMalformedResourcesForReadOnly as Fi, withIndeterminateGuard as Fn, getBootstrapMarkerKey as Fo, displayLogicalId as Fr, StageLoadError as Fs, unsupportedFinalSnapshotError as Ft, cyan as G, pathCrossesDottedKey as Ga, findReplacedReadersOfRecreateTargets as Gi, INTRINSIC_KEYS as Gn, describeDockerExecFailure as Go, malformedLocalResourceEntriesWarning as Gr, renderAssemblyPathEscape as Gs, WITHHELD_NAME_DISPLAY as Gt, formatResourceLine as H, DYNAMIC_REFERENCE_TOKEN_SCAN as Ha, withoutSilentDropProperties as Hi, reDisableInstanceApiTermination as Hn, buildDockerImage as Ho, malformedExportNamesWarning as Hr, absoluteAssemblyPathEscape as Hs, DeploymentEventsReader as Ht, ECR_AUTO_DELETE_IMAGES_TAG as I, maskSecretsInError as Ia, unpreviewableOrphanRecords as Ii, isWaitAbandonedError as In, isCrossRegionRedirect as Io, hasReadableOrphans as Ir, processStackMessages as Is, REDACTED_DELETE_ADDRESS_SKIP_REASON as It, red as J, provenPublicValue as Ja, isStatefulRecreateTargetForReplace as Ji, producerRegionsFromState as Jn, finchSecretArgvRefusal as Jo, malformedOrphanRecordsWarning as Jr, resolveBucketRegion as Js, secretBearing as Jt, gray as K, identityKeyFor as Ka, shownType as Ki, IntrinsicFunctionResolver as Kn, describeDockerFailure as Ko, malformedLocalResourcesWarning as Kr, resolveAssemblyPath as Ks, displayTextOrWithheld as Kt, S3_AUTO_DELETE_OBJECTS_TAG as L, maskSecretsInText as La, unreadableOrphanRecords as Li, markWaitAbandoned as Ln, parseBootstrapMarker as Lo, hasReadableOutputs as Lr, defineOwnKey as Ls, isRedactedRecordedValue as Lt, DELETE_INDEX_WAIT_PROCEED_NOTE as M, recordLogOnlyValue as Ma, repairMalformedOutputsForReadOnly as Mi, UNSPECIFIED_SKIP_REASON as Mn, BOOTSTRAP_MARKER_PREFIX as Mo, UNREADABLE_ORPHANS_CONTAINER_ROW as Mr, canonicalizeRegion as Ms, effectiveDeletionPolicy as Mt, INDEX_SETTLE_POLL_INTERVAL_MS as N, shareLogOnlyValues as Na, repairMalformedResourceEntriesForReadOnly as Ni, deleteIndeterminateGuards as Nn, assertAssetBucketRegion as No, UNREADABLE_RESOURCES_MAP_ROW as Nr, derivePartitionAndUrlSuffix as Ns, isFinalSnapshotError as Nt, compensateRemovedDeletionProtection as O, literalSplitDelimitersOf as Oa, refuseMalformedResourcesForExport as Oi, CloudControlProvider as On, createAssetRedirectResolver as Oo, passedParameterClassesOf as Or, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Os, PRE_DELETE_SNAPSHOT_TYPES as Ot, deleteTableWithIndexBusyRetry as P, createSecretMasker as Pa, repairMalformedResourcePropertiesForReadOnly as Pi, deleteSkipReason as Pn, ensureAssetStorage as Po, deployRefusesOrphanRowsReason as Pr, AssemblyReader as Ps, refusesFinalSnapshot as Pt, reachableDivergentParameters as Q, recordProvenPublicExpression as Qa, coerceWarmThroughput as Qi, assertSendableRoleArn as Qn, isMalformedEnvKey as Qo, malformedOutputsRefusalMessage as Qr, isWholeDynamicReferenceValue as Qt, hasCdkAutoDeleteTag as R, markSameGenerationBag as Ra, unreadableResourceEntries as Ri, disableInstanceApiTermination as Rn, readBootstrapMarkerBody as Ro, hasReadableResources as Rr, hasOwnKey as Rs, redactedDeleteAddressFields as Rt, isProtectionValueActive as S, liveMatchesUnresolvedTokenFrame as Sa, refuseMalformedResourceEntriesForOrphan as Si, CC_BROKEN_REASON as Sn, shouldRetainResource as So, cfnRefValueFromPhysicalId as Sr, ssmResolvedValueType as Ss, planRollback as St, DynamoDBGlobalTableProvider as T, carryLogOnlyValues as Ta, refuseMalformedResourcePropertiesForOrphan as Ti, wouldReturnToSdkProvider as Tn, stringifyValue as To, parseWebACLArn as Tr, MIGRATE_TMP_PREFIX as Ts, getCurrentProducerRegions as Tt, createReadOnlyAttributeHealerFactory as U, dynamicReferenceTokens as Ua, NO_CC_HANDLERS_REASON as Ui, reEnableInstanceApiTermination as Un, resolveDockerContextDirectory as Uo, malformedExportSourceWarning as Ur, describeFileReadFailure as Us, DeploymentEventsStore as Ut, markRefusedBeforeApplying as V, recoverMaskedOutput as Va, unwrittenCreateOnlyReplacement as Vi, observeThenDisableInstanceApiTermination as Vn, buildDenyExternalAccessPolicy as Vo, malformedDriftResourcePropertiesWarning as Vr, ownValue as Vs, updatePartialReason as Vt, bold as W, isUncertifiedBaselineMaskPosition as Wa, hasNoCloudControlHandlers as Wi, DiffCalculator as Wn, describeDockerCapturedOutput as Wo, malformedLocalOutputsWarning as Wr, displayAssemblyPath as Ws, extractDeploymentEventError as Wt, computeParameterTaint as X, recordMaskOnlyValuesIn as Xa, renderStatefulReason as Xi, applyRoleArnIfSet as Xn, getDockerCmd as Xo, malformedOrphansRefusalMessage as Xr, secretSafeKeyDisplay as Xt, yellow as Y, recordMaskOnlyValue as Ya, isStatefulRecreateTargetSync as Yi, regionLessSecretName as Yn, formatDockerLoginError as Yo, malformedOrphanRowsKeptWarning as Yr, secretBearingStateKeyWarning as Yt, namesAnyDeclaredParameter as Z, recordNoEchoAttributeValues as Za, WARM_THROUGHPUT_MEMBERS as Zi, assertFlagRoleArn as Zn, isDockerClientEnvKey as Zo, malformedOrphansWarning as Zr, exportNameSecretExposure as Zt, makeCanonicalizePropertiesFn as _, canonicalLambdaFunctionName as _a, refuseMalformedResourceEntries as _i, refuseMalformedDesiredTags as _n, importableOutputKeys as _o, carriesDynamicReference as _r, resolveStateBucketWithDefault as _s, destroyStackRecordsView as _t, findNestedTemplateTreeDefect as a, configIntegerRefusal as aa, malformedStateRefusalMessage as ai, DEFAULT_RESOURCE_WARN_AFTER_MS as an, isSingleDynamicReferenceToken as ao, envCredentialsAreAssumedRole as ar, escapeRegExp$2 as as, dropSettledNestedJournals as at, recordedProtectionNote as b, DagBuilder as ba, refuseMalformedResourceEntriesForImport as bi, definedAttributes as bn, orphansAfterRollback as bo, keepsSecretReferenceToken as br, stateBucketExistenceConfirmed as bs, recordAfterRollbackUpdate as bt, renderNestedTemplateTreeDefect as c, replayWarn as ca, refuseMalformedNestedChildOutputs as ci, earliestDefined as cn, S3StateBackend as co, s3BucketDomainName as cr, getDockerImageBySourceHash as cs, recordDisplacedSkips as ct, conditionInputsFrom as d, requireConfigString as da, refuseMalformedOrphans as di, withCreateTokenLedger as dn, acceptedCreateOnlyDropsOf as do, s3BucketWebsiteUrl as dr, getDefaultStateBucketName as ds, withNestedRevertRun as dt, toCfnInteger as ea, malformedRenderedContainersWarning as ei, collectDeclaredOutputNames as en, STATE_SOURCED_BASELINE_RULES as eo, isIamRoleArn as er, redactDockerArgvValues as es, makeSiblingClaimReader as et, parentSuppliedValues as f, prefetchCreateOnlyPropertyPaths as fa, refuseMalformedOrphansForDestroy as fi, acquireIdempotencyToken as fn, describeRegionValueKind as fo, coerceParameterTypedValue as fr, getLegacyStateBucketName as fs, getCurrentNestedStackContext as ft, mergeNoChangeOutputs as g, markAuxiliaryFailure as ga, refuseMalformedResourceAttributesForOrphan as gi, readTagList as gn, hasUnverifiableParameterRefusal as go, isImpossibleEmptyStoredAttribute as gr, resolveSkipPrefix as gs, awaitInFlightSibling as gt, keptWholeReasonText as h, withRetry as ha, refuseMalformedOutputsForDestroy as hi, planTagDiff as hn, hasReasonlessBaselineRefusal as ho, getAccountInfo as hr, resolveCaptureObservedState as hs, replayRollback as ht, childTemplateLoader as i, configBooleanRefusal as ia, malformedScrubResourceEntriesRefusalMessage as ii, DEFAULT_RESOURCE_TIMEOUT_MS as in, WHOLE_DYNAMIC_REFERENCE_PATTERN as io, callerEnvCredentials as ir, warnFinchArgvExposure as is, displacedPhysicalIdShown as it, resolveDynamoDbDeleteBudgetMs as j, recordLogOnlyParameterValue as ja, repairMalformedOrphansForReadOnly as ji, unchangedBehindSecretReference as jn, AssetModeResolver as jo, STATE_RESOURCES_MALFORMED as jr, PARTITION_TABLE as js, createPreDeleteFinalSnapshot as jt, deleteBudgetKey as k, logOnlyValueCount as ka, refuseMalformedState as ki, slowCcOperationTimeoutMs as kn, loadPublishableAssetManifest as ko, JSON_LISTING_HOLE_VALUE as kr, decodeListingKey as ks, buildFinalSnapshotIdentifier as kt, templateIdentity as l, requireConfigArray as la, refuseMalformedOrphanRecords as li, ledgerForStack as ln, rebuildClientForBucketRegion as lo, s3BucketDualStackDomainName as lr, Synthesizer as ls, revertNestedChildFromJournal as lt, isSecretBearingReferenceString as m, describeTypeWithThrottleRetry as ma, refuseMalformedOutputs as mi, DBPROXY_TAG_OPTIONS as mn, hasReadableExportSet as mo, parameterTypeMayLoseSecretIdentity as mr, resolveAutoAssetStorage as ms, replayFailedOperations as mt, IMPLICIT_DELETE_DEPENDENCIES as n, coerceCfnBoolean as na, malformedResourcePropertiesWarning as ni, isExportAliasCollision as nn, STATE_SOURCED_READBACK_RULES as no, AWS_CREDENTIAL_ENV_KEYS as nr, runDockerForeground as ns, NESTED_PENDING_PARENT_REASON as nt, isAbsoluteAssetPath as o, configStringRefusal as oa, previewableOrphanRecords as oi, maskingRetryLogger as on, LockManager as oo, isSettledInstanceState as or, stripControlChars as os, getNestedRevertRun as ot, readRecordedConditionVerdicts as p, templateResourceTypes as pa, refuseMalformedOrphansForOrphan as pi, DBPROXY_TAGS_WHAT as pn, exportNamesCarriedFrom as po, isUnboundTemplateParameter as pr, resolveApp as ps, withNestedStackContext as pt, green as q, carriesSecretMask as qa, MULTI_REGION_RECREATE_BLOCKED_TYPES as qi, classifyReplaySecretRegion as qn, dockerSpawnEnvWithSensitive as qo, malformedOrphanRecordsRefusalMessage as qr, clearBucketRegionCache as qs, exportAliasCollisionScrubWarning as qt, computeImplicitDeleteEdges as r, coerceCfnInteger as ra, malformedResourcesWarning as ri, bindingSkippedOutputs as rn, TEMPLATE_SOURCED_RULES as ro, applyCallerIdentityCredentials as rr, runDockerStreaming as rs, displacedOpClause as rt, listNestedTemplateRows as s, readConfigString as sa, refuseDivergentRecordRegionForDestroy as si, RollbackInlinePolicyWriters as sn, isLockInfoExpired as so, s3BucketArn as sr, AssetManifestLoader as ss, nestedChildStackName as st, DeployEngine as t, toFiniteNumber as ta, malformedResourceEntriesWarning as ti, collectPublishedOutputNames as tn, STATE_SOURCED_CROSS_GENERATION_RULES as to, sendableAssumeRoleCommand as tr, redactedDockerCause as ts, planOrphanAdoption as tt, conditionFingerprint as u, requireConfigObject as ua, refuseMalformedOrphanRecordsForDestroy as ui, reserveStackCreateToken as un, splitImportedOps as uo, s3BucketRegionalDomainName as ur, synthesisStatusMessage as us, revertedNestedRowIds as ut, withResourceDeadline as v, lambdaFunctionNameForMask as va, refuseMalformedResourceEntriesForDeploy as vi, tagMapAsList as vn, importableOutputs as vo, carriesFetchableDynamicReference as vr, resolveStateBucketWithDefaultAndSource as vs, getStackRecords as vt, readProtection as w, recordNestedStackParameterExpressions as wa, refuseMalformedResourcePropertiesForExport as wi, ccBrokenReason as wn, isSensitiveAttributeName as wo, refStateLookupFromResource as wr, CFN_TEMPLATE_URL_LIMIT as ws, findNestedStackTypeChanges as wt, PROTECTION_PROPERTY_BY_TYPE as x, TemplateParser as xa, refuseMalformedResourceEntriesForImportSave as xi, stringifyIfAssigned as xn, orphansCarriedFrom as xo, AWS_NO_VALUE as xr, warnDeprecatedNoPrefixCliFlag as xs, planFailedOps as xt, recordedProtectionEvidence as y, sameLambdaFunctionAddress as ya, refuseMalformedResourceEntriesForDestroy as yi, tagPlanWarning as yn, isReadableBag as yo, isNamelessDynamicReferenceError as yr, resolveUseCdkBootstrapAssets as ys, withStackRecords as yt, isTruthyCfnBoolean as z, redactSecretsForState as za, findActionableSilentDrops as zi, ec2InstanceProtectionSite as zn, validateAssetBucketName as zo, isReadableOrphanRecord as zr, hasPlainPrototype$1 as zs, redactedDeleteAddressSkip as zt };
-//# sourceMappingURL=deploy-engine-CuI_h_Ml.js.map
+export { resourcesNamingDeclaredParameter as $, dynamicReferenceTokens as $a, withoutSilentDropProperties as $i, reEnableInstanceApiTermination as $n, resolveDockerContextDirectory as $o, malformedExportSourceWarning as $r, absoluteAssemblyPathEscape as $s, displayTextOrWithheld as $t, resolveDynamoDbDeleteBudgetClock as A, DagBuilder as Aa, refuseMalformedResourceEntriesForImport as Ai, definedAttributes as An, orphansAfterRollback as Ao, keepsSecretReferenceToken as Ar, resolveUseCdkBootstrapAssets as As, resolveReplacementOldType as At, getPriorAttempts as B, printingCorpusOf as Ba, refuseMalformedState as Bi, ccProtectionRegistryTypes as Bn, rewriteTemplateAssetReferences as Bo, STATE_REGION_DIVERGED as Br, decodeListingKey as Bs, isFinalSnapshotError as Bt, perType as C, prefetchCreateOnlyPropertyPaths as Ca, refuseMalformedOrphansForOrphan as Ci, DBPROXY_TAGS_WHAT as Cn, exportNamesCarriedFrom as Co, isUnboundTemplateParameter as Cr, loadCdkJson as Cs, getStackRecords as Ct, beginDeleteWait as D, canonicalLambdaFunctionName as Da, refuseMalformedResourceEntries as Di, refuseMalformedDesiredTags as Dn, importableOutputKeys as Do, carriesDynamicReference as Dr, resolveSkipPrefix as Ds, isJournaledOrphan as Dt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as E, withRetry as Ea, refuseMalformedResourceAttributesForOrphan as Ei, readTagList as En, hasUnverifiableParameterRefusal as Eo, isImpossibleEmptyStoredAttribute as Er, resolveCaptureObservedState as Es, demoteSupersededOrphans as Et, waitForIndexesSettled as F, carryLogOnlyValues as Fa, refuseMalformedResourcePropertiesForExport as Fi, wouldReturnToSdkProvider as Fn, stringifyValue as Fo, parseWebACLArn as Fr, CFN_TEMPLATE_URL_LIMIT as Fs, PRE_DELETE_SNAPSHOT_TYPES as Ft, cyan as G, errorCauseChain as Ga, repairMalformedResourcePropertiesForReadOnly as Gi, withIndeterminateGuard as Gn, getBootstrapMarkerKey as Go, displayLogicalId as Gr, AssemblyReader as Gs, redactedDeleteAddressFields as Gt, formatResourceLine as H, recordLogOnlyValue as Ha, repairMalformedOrphansForReadOnly as Hi, UNSPECIFIED_SKIP_REASON as Hn, BOOTSTRAP_MARKER_PREFIX as Ho, UNREADABLE_ORPHANS_CONTAINER_ROW as Hr, PARTITION_TABLE as Hs, unsupportedFinalSnapshotError as Ht, ECR_AUTO_DELETE_IMAGES_TAG as I, createUnionSecretMasker as Ia, refuseMalformedResourcePropertiesForOrphan as Ii, isCustomResourceType as In, WorkGraph as Io, withSharedDrainBudget as Ir, MIGRATE_TMP_PREFIX as Is, buildFinalSnapshotIdentifier as It, red as J, markSameGenerationBag as Ja, unreadableOrphanRecords as Ji, disableInstanceApiTermination as Jn, readBootstrapMarkerBody as Jo, hasReadableResources as Jr, defineOwnKey as Js, updatePartialReason as Jt, gray as K, maskSecretsInError as Ka, repairMalformedResourcesForReadOnly as Ki, isWaitAbandonedError as Kn, isCrossRegionRedirect as Ko, hasReadableOrphans as Kr, StageLoadError as Ks, redactedDeleteAddressSkip as Kt, S3_AUTO_DELETE_OBJECTS_TAG as L, hasMaskableValues as La, refuseMalformedResourcesForDeploy as Li, getCurrentResourceSecrets as Ln, buildAssetRedirectMap as Lo, parameterInputsFor as Lr, findLargeInlineResources as Ls, ccRoutedFinalSnapshotError as Lt, DELETE_INDEX_WAIT_PROCEED_NOTE as M, liveMatchesUnresolvedTokenFrame as Ma, refuseMalformedResourceEntriesForOrphan as Mi, CC_BROKEN_REASON as Mn, shouldRetainResource as Mo, cfnRefValueFromPhysicalId as Mr, warnDeprecatedNoPrefixCliFlag as Ms, getCurrentProducerRegions as Mt, INDEX_SETTLE_POLL_INTERVAL_MS as N, inheritNestedStackParameterAssociations as Na, refuseMalformedResourcePropertiesForDestroy as Ni, ProviderRegistry as Nn, AssetPublisher as No, isStalePlaceholderArnAttribute as Nr, ssmResolvedValueType as Ns, inheritProducerRegions as Nt, compensateRemovedDeletionProtection as O, lambdaFunctionNameForMask as Oa, refuseMalformedResourceEntriesForDeploy as Oi, tagMapAsList as On, importableOutputs as Oo, carriesFetchableDynamicReference as Or, resolveStateBucketWithDefault as Os, planFailedOps as Ot, deleteTableWithIndexBusyRetry as P, recordNestedStackParameterExpressions as Pa, refuseMalformedResourcePropertiesForDrift as Pi, ccBrokenReason as Pn, isSensitiveAttributeName as Po, refStateLookupFromResource as Pr, CFN_TEMPLATE_BODY_LIMIT as Ps, ATOMIC_FINAL_SNAPSHOT_TYPES as Pt, reachableDivergentParameters as Q, DYNAMIC_REFERENCE_TOKEN_SCAN as Qa, unwrittenCreateOnlyReplacement as Qi, reDisableInstanceApiTermination as Qn, buildDockerImage as Qo, malformedExportNamesWarning as Qr, ownValue as Qs, WITHHELD_NAME_DISPLAY as Qt, hasCdkAutoDeleteTag as R, literalSplitDelimitersOf as Ra, refuseMalformedResourcesForDestroy as Ri, CloudControlProvider as Rn, createAssetRedirectResolver as Ro, passedParameterClassesOf as Rr, uploadCfnTemplate as Rs, createPreDeleteFinalSnapshot as Rt, isProtectionValueActive as S, requireConfigString as Sa, refuseMalformedOrphansForDestroy as Si, acquireIdempotencyToken as Sn, describeRegionValueKind as So, coerceParameterTypedValue as Sr, getLegacyStateBucketName as Ss, destroyStackRecordsView as St, DynamoDBGlobalTableProvider as T, describeTypeWithThrottleRetry as Ta, refuseMalformedOutputsForDestroy as Ti, planTagDiff as Tn, hasReasonlessBaselineRefusal as To, getAccountInfo as Tr, resolveAutoAssetStorage as Ts, recordAfterRollbackUpdate as Tt, createReadOnlyAttributeHealerFactory as U, shareLogOnlyValues as Ua, repairMalformedOutputsForReadOnly as Ui, deleteIndeterminateGuards as Un, assertAssetBucketRegion as Uo, UNREADABLE_RESOURCES_MAP_ROW as Ur, canonicalizeRegion as Us, REDACTED_DELETE_ADDRESS_SKIP_REASON as Ut, markRefusedBeforeApplying as V, recordLogOnlyParameterValue as Va, repairMalformedOrphanRecordsForReadOnly as Vi, unchangedBehindSecretReference as Vn, AssetModeResolver as Vo, STATE_RESOURCES_MALFORMED as Vr, expectedOwnerParam as Vs, refusesFinalSnapshot as Vt, bold as W, createSecretMasker as Wa, repairMalformedResourceEntriesForReadOnly as Wi, deleteSkipReason as Wn, ensureAssetStorage as Wo, deployRefusesOrphanRowsReason as Wr, derivePartitionAndUrlSuffix as Ws, isRedactedRecordedValue as Wt, computeParameterTaint as X, scrubResourceRecord as Xa, findActionableSilentDrops as Xi, isTerminationProtectionPropagationError as Xn, validateContainerRepoName as Xo, isReadableResourceEntry as Xr, hasPlainPrototype$1 as Xs, DeploymentEventsStore as Xt, yellow as Y, redactSecretsForState as Ya, unreadableResourceEntries as Yi, ec2InstanceProtectionSite as Yn, validateAssetBucketName as Yo, isReadableOrphanRecord as Yr, hasOwnKey as Ys, DeploymentEventsReader as Yt, namesAnyDeclaredParameter as Z, recoverMaskedOutput as Za, findSilentDropProperties as Zi, observeThenDisableInstanceApiTermination as Zn, buildDenyExternalAccessPolicy as Zo, malformedDriftResourcePropertiesWarning as Zr, nullPrototypeRecord as Zs, extractDeploymentEventError as Zt, makeCanonicalizePropertiesFn as _, configStringRefusal as _a, refuseDivergentRecordRegionForDestroy as _i, RollbackInlinePolicyWriters as _n, isLockInfoExpired as _o, s3BucketArn as _r, AssetManifestLoader as _s, getCurrentNestedStackContext as _t, findNestedTemplateTreeDefect as a, isStatefulRecreateTargetForReplace as aa, resolveBucketRegion as ac, malformedOrphanRowsKeptWarning as ai, isWholeDynamicReferenceValue as an, recordMaskOnlyValue as ao, regionLessSecretName as ar, formatDockerLoginError as as, makeSiblingClaimReader as at, recordedProtectionNote as b, requireConfigArray as ba, refuseMalformedOrphanRecordsForDestroy as bi, reserveStackCreateToken as bn, splitImportedOps as bo, s3BucketRegionalDomainName as br, synthesisStatusMessage as bs, replayRollback as bt, renderNestedTemplateTreeDefect as c, WARM_THROUGHPUT_MEMBERS as ca, malformedOutputsRefusalMessage as ci, collectPublishedOutputNames as cn, recordProvenPublicExpression as co, assertSendableRoleArn as cr, isMalformedEnvKey as cs, displacedOpClause as ct, conditionInputsFrom as d, toCfnInteger as da, malformedResourceEntriesWarning as di, DEFAULT_RESOURCE_TIMEOUT_MS as dn, STATE_SOURCED_CROSS_GENERATION_RULES as do, sendableAssumeRoleCommand as dr, redactedDockerCause as ds, getNestedRevertRun as dt, NO_CC_HANDLERS_REASON as ea, describeFileReadFailure as ec, malformedLocalOutputsWarning as ei, exportAliasCollisionScrubWarning as en, isUncertifiedBaselineMaskPosition as eo, DiffCalculator as er, describeDockerCapturedOutput as es, deleteJournaledOrphans as et, parentSuppliedValues as f, toFiniteNumber as fa, malformedResourcePropertiesWarning as fi, DEFAULT_RESOURCE_WARN_AFTER_MS as fn, STATE_SOURCED_READBACK_RULES as fo, AWS_CREDENTIAL_ENV_KEYS as fr, runDockerForeground as fs, nestedChildStackName as ft, mergeNoChangeOutputs as g, configIntegerRefusal as ga, previewableOrphanRecords as gi, formatDestructiveChange as gn, LockManager as go, isSettledInstanceState as gr, stripControlChars as gs, withNestedRevertRun as gt, keptWholeReasonText as h, configBooleanRefusal as ha, malformedStateRefusalMessage as hi, findDestructiveChanges as hn, isSingleDynamicReferenceToken as ho, envCredentialsAreAssumedRole as hr, escapeRegExp$3 as hs, revertedNestedRowIds as ht, childTemplateLoader as i, MULTI_REGION_RECREATE_BLOCKED_TYPES as ia, clearBucketRegionCache as ic, malformedOrphanRecordsWarning as ii, exportNameSecretExposure as in, provenPublicValue as io, producerRegionsFromState as ir, finchSecretArgvRefusal as is, sameJournaledOrphans as it, resolveDynamoDbDeleteBudgetMs as j, TemplateParser as ja, refuseMalformedResourceEntriesForImportSave as ji, stringifyIfAssigned as jn, orphansCarriedFrom as jo, AWS_NO_VALUE as jr, stateBucketExistenceConfirmed as js, findNestedStackTypeChanges as jt, deleteBudgetKey as k, sameLambdaFunctionAddress as ka, refuseMalformedResourceEntriesForDestroy as ki, tagPlanWarning as kn, isReadableBag as ko, isNamelessDynamicReferenceError as kr, resolveStateBucketWithDefaultAndSource as ks, planRollback as kt, templateIdentity as l, coerceWarmThroughput as la, malformedOutputsWarning as li, isExportAliasCollision as ln, wholeStringLeavesOf as lo, explicitRoleArnOrThrow as lr, partitionSensitiveEnv as ls, displacedPhysicalIdShown as lt, isSecretBearingReferenceString as m, coerceCfnInteger as ma, malformedScrubResourceEntriesRefusalMessage as mi, constructPathOf as mn, WHOLE_DYNAMIC_REFERENCE_PATTERN as mo, callerEnvCredentials as mr, warnFinchArgvExposure as ms, revertNestedChildFromJournal as mt, IMPLICIT_DELETE_DEPENDENCIES as n, findReplacedReadersOfRecreateTargets as na, renderAssemblyPathEscape as nc, malformedLocalResourcesWarning as ni, secretBearingStateKeyWarning as nn, identityKeyFor as no, IntrinsicFunctionResolver as nr, describeDockerFailure as ns, journaledOrphanLines as nt, isAbsoluteAssetPath as o, isStatefulRecreateTargetSync as oa, malformedOrphansRefusalMessage as oi, noEchoParameterValueSeed as on, recordMaskOnlyValuesIn as oo, applyRoleArnIfSet as or, getDockerCmd as os, planOrphanAdoption as ot, readRecordedConditionVerdicts as p, coerceCfnBoolean as pa, malformedResourcesWarning as pi, maskingRetryLogger as pn, TEMPLATE_SOURCED_RULES as po, applyCallerIdentityCredentials as pr, runDockerStreaming as ps, recordDisplacedSkips as pt, green as q, maskSecretsInText as qa, unpreviewableOrphanRecords as qi, markWaitAbandoned as qn, parseBootstrapMarker as qo, hasReadableOutputs as qr, processStackMessages as qs, updatePartialMessage as qt, computeImplicitDeleteEdges as r, shownType as ra, resolveAssemblyPath as rc, malformedOrphanRecordsRefusalMessage as ri, secretSafeKeyDisplay as rn, carriesSecretMask as ro, classifyReplaySecretRegion as rr, dockerSpawnEnvWithSensitive as rs, loadJournaledOrphans as rt, listNestedTemplateRows as s, renderStatefulReason as sa, malformedOrphansWarning as si, collectDeclaredOutputNames as sn, recordNoEchoAttributeValues as so, assertFlagRoleArn as sr, isDockerClientEnvKey as ss, NESTED_PENDING_PARENT_REASON as st, DeployEngine as t, hasNoCloudControlHandlers as ta, displayAssemblyPath as tc, malformedLocalResourceEntriesWarning as ti, secretBearing as tn, pathCrossesDottedKey as to, INTRINSIC_KEYS as tr, describeDockerExecFailure as ts, isHandledOrphan as tt, conditionFingerprint as u, isWarmThroughputDecrease as ua, malformedRenderedContainersWarning as ui, bindingSkippedOutputs as un, STATE_SOURCED_BASELINE_RULES as uo, isIamRoleArn as ur, redactDockerArgvValues as us, dropSettledNestedJournals as ut, withResourceDeadline as v, readConfigString as va, refuseMalformedNestedChildOutputs as vi, earliestDefined as vn, S3StateBackend as vo, s3BucketDomainName as vr, getDockerImageBySourceHash as vs, withNestedStackContext as vt, readProtection as w, templateResourceTypes as wa, refuseMalformedOutputs as wi, DBPROXY_TAG_OPTIONS as wn, hasReadableExportSet as wo, parameterTypeMayLoseSecretIdentity as wr, resolveApp as ws, withStackRecords as wt, PROTECTION_PROPERTY_BY_TYPE as x, requireConfigObject as xa, refuseMalformedOrphans as xi, withCreateTokenLedger as xn, acceptedCreateOnlyDropsOf as xo, s3BucketWebsiteUrl as xr, getDefaultStateBucketName as xs, awaitInFlightSibling as xt, recordedProtectionEvidence as y, replayWarn as ya, refuseMalformedOrphanRecords as yi, ledgerForStack as yn, rebuildClientForBucketRegion as yo, s3BucketDualStackDomainName as yr, Synthesizer as ys, replayFailedOperations as yt, isTruthyCfnBoolean as z, logOnlyValueCount as za, refuseMalformedResourcesForExport as zi, slowCcOperationTimeoutMs as zn, loadPublishableAssetManifest as zo, JSON_LISTING_HOLE_VALUE as zr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as zs, effectiveDeletionPolicy as zt };
+//# sourceMappingURL=deploy-engine-D7204v7Z.js.map