@go-to-k/cdkd 0.295.1 → 0.296.1

package/dist/{deploy-engine-DG-oC9YK.js → deploy-engine-xlct0Hcm.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js";
-import { A as displaySafe, E as UNRENDERABLE, F as safeMsg, L as truncateCodePoints, M as isPasteableIdent, O as displayAwsMessage, P as plainIdentOr, S as withoutGeneratedFallbackName, T as STACK_REF_MAX_CODE_POINTS, _ as getCurrentSkipPrefix, b as withSkipPrefix, c as getLiveRenderer, f as applyDefaultNameForFallback, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, m as explicitNamePropertyFor, n as getLogger, r as isStdoutReservedForPayload, s as installLogLineMaskerSource, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS, x as withStackName, y as looksLikeCdkdGeneratedName } from "./logger-B46YMG0h.js";
-import { $t as StateError, A as isTerminalDeleteFailure, An as isAmbiguousCcHandlerErrorCode, At as clientDefaultsFor, Bn as isMarkedNonRetryable, Bt as IntrinsicResolutionRefusalError, C as refusalTypeShown, Cn as isNameCollisionErrorFrom, D as ProtectionFlipRegistry, Dt as withPasteableAwsProfile, En as isReplayedNameCollisionFrom, Fn as retryClassificationText, Gt as MalformedProducerRecordRefusalError, H as pasteableAwsCommand, Hn as markNonRetryable, In as describeAwsFailure, It as CrossAccountSecretRefusalError, J as isInterruptedWaitError, Jt as ProvisioningError, Lt as DependencyError, M as observeThenDisableProtection, Mn as isIamPropagationError, Mt as AccountIdUnavailableError, N as protectionFlipKey, Nn as isRetryableTransientError, Nt as AssetError, O as compensateProtectionFlip, On as markReplayMayCollide, Ot as ambientClientDefaults, Pn as isTransientServerError, Pt as CdkdError, Q as canonicalizeRoute53QueryName, R as DELETION_PROTECTION_DOC_POINTER, Rn as safeStringify$1, S as quotedRemedyLogicalId, Sn as hasReplayMayCollide, St as injectiveKey, T as resolveExplicitPhysicalId, Tn as isRecreateRetryableError, Tt as producerRecordKey, U as protectedReplacementAdvice, Un as markRedactedCause, Ut as LockError, Vn as isThrottlingError, Wn as wrapMaskedAwsError, Wt as MacroExpansionError, X as ElapsedBudgetRegistry, Xt as ResourceUpdateNotSupportedError, Y as startInterruptWatch, Yt as ResourceTimeoutError, Z as monotonicNowMs, _n as shellQuote, _t as formatLockOperation, at as segmentAfterAnchor, b as isQuotableImportValue, bt as CUSTOM_RESOURCE_RESPONSE_PREFIX, cn as UNSHOWABLE_VALUE, ct as isSecretDerivedValue, d as prepareRemovalForUpdate, dn as isInertUnquoted, dt as withDerivedNameMasks, en as SynthesisError, et as compositeIdSeparatorRefusal, f as removalWarning, fn as pasteableCommand, ft as UNREPRODUCIBLE_LOCK_CLAUSE, g as assertRegionMatch, gn as shellBoundedDisplay, gt as formatLockExpiry, h as RESOURCE_NOT_FOUND, hn as quotedOrDescribed, i as holdsSecretDerivedEntry, it as resourceTypeShown, jn as isAmbiguousOutcomeError, jt as credentialFingerprint, k as deleteWithProtectionCompensation, kn as formatRetryClassificationSignals, kt as ambientCredentialConfig, l as withUnchangedSecretPrincipalLists, ln as commandHole, lt as maskDeep, m as withoutInjectedRemovals, mn as plainOrDescribed, nt as logicalIdShown, on as SHELL_ACTIVE, ot as createMaskedLogSinks, pn as physicalIdShownBesideCommand, pt as buildForceUnlockCommand, rn as normalizeAwsError, sn as SHELL_ACTIVE_WHY, st as createMaskedRetryLogger, ut as maskerOrIdentity, vn as withheldTargetClause, vt as formatLockOwner, wn as isNameCooldownError, x as normalizeAwsTagsToCfn, xn as isUpdateUnsupportedError, xt as DEFAULT_STATE_PREFIX, yt as sanitizeRecoveryValue, zt as DynamicReferenceRegionAmbiguousError } from "./iam-policy-targets-CMSQGQnm.js";
+import { A as displaySafe, E as UNRENDERABLE, F as safeMsg, L as truncateCodePoints, M as isPasteableIdent, O as displayAwsMessage, P as plainIdentOr, S as withoutGeneratedFallbackName, T as STACK_REF_MAX_CODE_POINTS, _ as getCurrentSkipPrefix, b as withSkipPrefix, c as getLiveRenderer, f as applyDefaultNameForFallback, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, m as explicitNamePropertyFor, n as getLogger, r as isStdoutReservedForPayload, s as installLogLineMaskerSource, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS, x as withStackName, y as looksLikeCdkdGeneratedName } from "./logger-Dvc7ddKe.js";
+import { $n as markRedactedCause, $t as LockError, A as isTerminalDeleteFailure, At as CUSTOM_RESOURCE_RESPONSE_PREFIX, Bn as isAmbiguousCcHandlerErrorCode, Bt as clientDefaultsFor, C as refusalTypeShown, Cn as physicalIdShownBesideCommand, Ct as buildForceUnlockCommand, D as ProtectionFlipRegistry, Dn as shellQuote, Dt as formatLockOperation, En as shellBoundedDisplay, Et as formatLockExpiry, Fn as isRecreateRetryableError, Ft as producerRecordKey, Gn as retryClassificationText, H as pasteableAwsCommand, Hn as isIamPropagationError, Ht as AccountIdUnavailableError, In as isReplayedNameCollisionFrom, J as isInterruptedWaitError, Jn as safeStringify$1, Kn as describeAwsFailure, Kt as CrossAccountSecretRefusalError, Lt as withPasteableAwsProfile, M as observeThenDisableProtection, Mn as hasReplayMayCollide, Mt as injectiveKey, N as protectionFlipKey, Nn as isNameCollisionErrorFrom, O as compensateProtectionFlip, On as withheldTargetClause, Ot as formatLockOwner, Pn as isNameCooldownError, Q as canonicalizeRoute53QueryName, Qn as markNonRetryable, R as DELETION_PROTECTION_DOC_POINTER, Rn as markReplayMayCollide, Rt as ambientClientDefaults, S as quotedRemedyLogicalId, Sn as pasteableCommand, St as UNREPRODUCIBLE_LOCK_CLAUSE, T as resolveExplicitPhysicalId, Tn as quotedOrDescribed, U as protectedReplacementAdvice, Un as isRetryableTransientError, Ut as AssetError, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, Wn as isTransientServerError, Wt as CdkdError, X as ElapsedBudgetRegistry, Xn as isMarkedNonRetryable, Xt as IntrinsicResolutionRefusalError, Y as startInterruptWatch, Yt as DynamicReferenceRegionAmbiguousError, Z as monotonicNowMs, Zn as isThrottlingError, _n as SHELL_ACTIVE_WHY, _t as hasCreatedBeforeFailure, an as ResourceTimeoutError, at as segmentAfterAnchor, b as isQuotableImportValue, bt as markAuxiliaryFailure, ct as createMaskedRetryLogger, d as prepareRemovalForUpdate, dt as maskerOrIdentity, en as MacroExpansionError, er as wrapMaskedAwsError, et as compositeIdSeparatorRefusal, f as removalWarning, ft as withDerivedNameMasks, g as assertRegionMatch, gn as SHELL_ACTIVE, gt as createdBeforeFailure, h as RESOURCE_NOT_FOUND, i as holdsSecretDerivedEntry, in as ProvisioningError, it as resourceTypeShown, jn as isUpdateUnsupportedError, jt as DEFAULT_STATE_PREFIX, k as deleteWithProtectionCompensation, kt as sanitizeRecoveryValue, l as withUnchangedSecretPrincipalLists, ln as StateError, lt as isSecretDerivedValue, m as withoutInjectedRemovals, mt as carryCreatedBeforeFailure, nt as logicalIdShown, on as ResourceUpdateNotSupportedError, ot as stateOrphanRecordRemedy, pn as normalizeAwsError, pt as RETRY_AUXILIARY_OWNER, qt as DependencyError, st as createMaskedLogSinks, tn as MalformedProducerRecordRefusalError, un as SynthesisError, ut as maskDeep, vn as UNSHOWABLE_VALUE, vt as isAuxiliaryFailure, wn as plainOrDescribed, x as normalizeAwsTagsToCfn, xn as isInertUnquoted, xt as markCreatedBeforeFailure, yn as commandHole, yt as isAuxiliaryMarkOf, zn as formatRetryClassificationSignals, zt as ambientCredentialConfig } from "./iam-policy-targets-DSDSdxXz.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-Bqzsng8Y.js";
+import { t as getCdkdVersion } from "./version-Dpc_HYX0.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4976,7 +4976,7 @@ async function rebuildClientForBucketRegion(client, bucket, opts = {}) {
 
 //#endregion
 //#region src/state/s3-state-backend.ts
-function errorDetail$1(error) {
+function errorDetail$2(error) {
 	return displaySafe(error instanceof Error ? error.message : error, { asciiOnly: true }) || "<unrenderable>";
 }
 const LEGACY_KEY_DEPTH = 2;
@@ -5096,7 +5096,7 @@ var S3StateBackend = class {
 		} catch (error) {
 			if (!isNoSuchKey(error)) {
 				if (error instanceof StateError) throw error;
-				throw new StateError(`Failed to get state for stack ${shownStackName} (${shownRegionName}): ${errorDetail$1(error)}`, error instanceof Error ? error : void 0);
+				throw new StateError(`Failed to get state for stack ${shownStackName} (${shownRegionName}): ${errorDetail$2(error)}`, error instanceof Error ? error : void 0);
 			}
 			this.logger.debug(`No state at new key for stack: ${shownStackName} (${shownRegionName})`);
 		}
@@ -5143,7 +5143,7 @@ var S3StateBackend = class {
 				}));
 				this.logger.info(`Migrated state for stack ${this.displayName(stackName)} to region-scoped layout (${displayIdent(region)})`);
 			} catch (deleteError) {
-				this.logger.warn(`Migrated stack ${this.displayName(stackName)} to new key, but failed to delete legacy key: ${errorDetail$1(deleteError)}`);
+				this.logger.warn(`Migrated stack ${this.displayName(stackName)} to new key, but failed to delete legacy key: ${errorDetail$2(deleteError)}`);
 			}
 			await notifyStateSaved(stackName, region);
 			return response.ETag;
@@ -5153,7 +5153,7 @@ var S3StateBackend = class {
 				bucket: this.config.bucket,
 				operation: "PutObject"
 			});
-			throw new StateError(`Failed to save state for stack ${this.stackRef(stackName, region)}: ${errorDetail$1(normalized)}`, normalized);
+			throw new StateError(`Failed to save state for stack ${this.stackRef(stackName, region)}: ${errorDetail$2(normalized)}`, normalized);
 		}
 	}
 	async deleteState(stackName, region) {
@@ -5185,7 +5185,7 @@ var S3StateBackend = class {
 				bucket: this.config.bucket,
 				operation: "DeleteObject"
 			});
-			throw new StateError(`Failed to delete state for stack ${this.stackRef(stackName, region)}: ${errorDetail$1(normalized)}`, normalized);
+			throw new StateError(`Failed to delete state for stack ${this.stackRef(stackName, region)}: ${errorDetail$2(normalized)}`, normalized);
 		} finally {
 			await this.deleteRollbackJournal(stackName, region);
 		}
@@ -5207,7 +5207,7 @@ var S3StateBackend = class {
 				bucket: this.config.bucket,
 				operation: "DeleteObject"
 			});
-			throw new StateError(`Failed to delete legacy state for stack ${displayStackName(stackName)}: ${errorDetail$1(normalized)}`, normalized);
+			throw new StateError(`Failed to delete legacy state for stack ${displayStackName(stackName)}: ${errorDetail$2(normalized)}`, normalized);
 		}
 	}
 	async listStacks() {
@@ -5378,7 +5378,7 @@ var S3StateBackend = class {
 			});
 		} catch (error) {
 			const describing = options.objectDescription ? ` (${options.objectDescription})` : "";
-			this.logger.warn(`Could not purge noncurrent versions of ${keys.length} key(s) in bucket '${this.config.bucket}': the purge could not be started. Their previous versions survive and remain readable via GetObject with a VersionId${describing}. Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key(s) by hand. Underlying error: ${errorDetail$1(error)}`);
+			this.logger.warn(`Could not purge noncurrent versions of ${keys.length} key(s) in bucket '${this.config.bucket}': the purge could not be started. Their previous versions survive and remain readable via GetObject with a VersionId${describing}. Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key(s) by hand. Underlying error: ${errorDetail$2(error)}`);
 		}
 	}
 	async purgeNoncurrentVersionsUnderPrefix(keyPrefix, options = {}) {
@@ -5392,7 +5392,7 @@ var S3StateBackend = class {
 		} catch (error) {
 			const prefixShown = displayIdent(keyPrefix, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
 			const describing = options.objectDescription ? ` (${options.objectDescription})` : "";
-			this.logger.warn(safeMsg`Could not purge noncurrent versions under the prefix ${prefixShown} in bucket ${this.config.bucket}: the purge could not be started. Their previous versions survive and remain readable via GetObject with a VersionId${describing}. Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the prefix by hand. Underlying error: ${errorDetail$1(error)}`);
+			this.logger.warn(safeMsg`Could not purge noncurrent versions under the prefix ${prefixShown} in bucket ${this.config.bucket}: the purge could not be started. Their previous versions survive and remain readable via GetObject with a VersionId${describing}. Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the prefix by hand. Underlying error: ${errorDetail$2(error)}`);
 			return {
 				deletedBodies: 0,
 				complete: false
@@ -5418,7 +5418,7 @@ var S3StateBackend = class {
 			await this.saveCreateTokenLedger(stackName, region, ledger);
 		} catch (error) {
 			const normalized = normalizeAwsError(error, { bucket: this.config.bucket });
-			throw new StateError(`Failed to renew the create-token ledger of stack ${this.stackRef(stackName, region)}: ${errorDetail$1(normalized)}. The state record was left in place; re-run once the ledger can be written.`, normalized);
+			throw new StateError(`Failed to renew the create-token ledger of stack ${this.stackRef(stackName, region)}: ${errorDetail$2(normalized)}. The state record was left in place; re-run once the ledger can be written.`, normalized);
 		}
 	}
 	async deleteCreateTokenLedger(stackName, region) {
@@ -5435,7 +5435,7 @@ var S3StateBackend = class {
 				bucket: this.config.bucket,
 				operation: "DeleteObject"
 			});
-			throw new StateError(`Failed to delete the create-token ledger for stack ${this.stackRef(stackName, region)}: ${errorDetail$1(normalized)}. The state record was left in place; re-run once the ledger can be deleted.`, normalized);
+			throw new StateError(`Failed to delete the create-token ledger for stack ${this.stackRef(stackName, region)}: ${errorDetail$2(normalized)}. The state record was left in place; re-run once the ledger can be deleted.`, normalized);
 		}
 	}
 	async loadRollbackJournal(stackName, region) {
@@ -5461,6 +5461,58 @@ var S3StateBackend = class {
 		else newest.failedOperations = remaining;
 		await this.putRawObject(this.getRollbackJournalKey(stackName, region), JSON.stringify(journal, null, 2));
 	}
+	async dropRollbackJournalFailedOperations(stackName, region, drop) {
+		const journal = await this.loadRollbackJournal(stackName, region);
+		if (!journal) return 0;
+		let removed = 0;
+		for (const segment of journal.segments) {
+			if (!segment.failedOperations) continue;
+			const kept = segment.failedOperations.filter((op) => !drop(op, segment));
+			removed += segment.failedOperations.length - kept.length;
+			if (kept.length === 0) delete segment.failedOperations;
+			else segment.failedOperations = kept;
+		}
+		if (removed === 0) return 0;
+		await this.putRawObject(this.getRollbackJournalKey(stackName, region), JSON.stringify(journal, null, 2));
+		return removed;
+	}
+	async reduceRollbackJournalToFailedOperations(stackName, region, keep, supersededLogicalIds = [], demote = () => false) {
+		const journal = await this.loadRollbackJournal(stackName, region);
+		if (!journal) return 0;
+		const carried = new Set(supersededLogicalIds);
+		const kept = [];
+		let count = 0;
+		const keptBySegment = journal.segments.map((segment) => (segment.failedOperations ?? []).filter((op) => keep(op, segment)).map((op) => op.physicalIdRecoveredFromError === true && demote(op, segment) ? {
+			...op,
+			physicalIdRecoveredFromError: false
+		} : op));
+		const keptIds = new Set(keptBySegment.flat().map((op) => op.logicalId));
+		for (let s = journal.segments.length - 1; s >= 0; s--) {
+			const segment = journal.segments[s];
+			for (const op of segment.operations) carried.add(op.logicalId);
+			for (const id of segment.supersededLogicalIds ?? []) carried.add(id);
+			const failed = keptBySegment[s];
+			if (failed.length === 0) continue;
+			const reduced = {
+				...segment,
+				initialDeploy: false,
+				operations: [],
+				failedOperations: failed
+			};
+			delete reduced.previousOutputs;
+			delete reduced.previousCrossStackReads;
+			addSupersededIds(reduced, [...carried].filter((id) => !keptIds.has(id) || segment.supersededLogicalIds?.includes(id)));
+			kept.unshift(reduced);
+			count += failed.length;
+		}
+		if (kept.length === 0) {
+			await this.deleteRollbackJournal(stackName, region);
+			return 0;
+		}
+		journal.segments = kept;
+		await this.putRawObject(this.getRollbackJournalKey(stackName, region), JSON.stringify(journal, null, 2));
+		return count;
+	}
 	async popRollbackJournalSegment(stackName, region) {
 		const journal = await this.loadRollbackJournal(stackName, region);
 		if (!journal || journal.segments.length === 0) {
@@ -5529,7 +5581,7 @@ var S3StateBackend = class {
 		} catch (error) {
 			if (!isNoSuchKey(error) && error.name !== "NotFound") {
 				gone = false;
-				this.logger.warn(`Failed to delete rollback journal for ${this.stackRef(stackName, region)}: ${errorDetail$1(error)}`);
+				this.logger.warn(`Failed to delete rollback journal for ${this.stackRef(stackName, region)}: ${errorDetail$2(error)}`);
 			}
 		}
 		await this.purgeNoncurrentVersions([key], { objectDescription: "the rollback journal, whose `failedOperations[].attemptedProperties` records the properties of the failed write verbatim" });
@@ -5647,7 +5699,7 @@ var S3StateBackend = class {
 			};
 		} catch (error) {
 			if (isNoSuchKey(error)) return null;
-			throw new StateError(`Failed to get legacy state for stack ${this.displayName(stackName)}: ${errorDetail$1(error)}`, error instanceof Error ? error : void 0);
+			throw new StateError(`Failed to get legacy state for stack ${this.displayName(stackName)}: ${errorDetail$2(error)}`, error instanceof Error ? error : void 0);
 		}
 	}
 	parseStateBody(bodyString, stackName) {
@@ -5699,7 +5751,7 @@ function safeSegment(value) {
 function stackRef(stackName, region) {
 	return region === void 0 ? safeSegment(stackName) : `${safeSegment(stackName)} (${safeSegment(region)})`;
 }
-function errorDetail(error) {
+function errorDetail$1(error) {
 	return displaySafe(error instanceof Error ? error.message : error, { asciiOnly: true }) || "<unrenderable>";
 }
 function isLockInfoExpired(lockInfo) {
@@ -5835,7 +5887,7 @@ var LockManager = class {
 				}
 				return false;
 			}
-			throw new LockError(`Failed to acquire lock for stack ${safeSegment(stackName)} (${safeSegment(region)}): ` + errorDetail(error), error instanceof Error ? error : void 0);
+			throw new LockError(`Failed to acquire lock for stack ${safeSegment(stackName)} (${safeSegment(region)}): ` + errorDetail$1(error), error instanceof Error ? error : void 0);
 		}
 	}
 	async putLockObject(key, lockInfo, condition = { IfNoneMatch: "*" }) {
@@ -5890,7 +5942,7 @@ var LockManager = class {
 				return null;
 			}
 			if (error instanceof LockError) throw error;
-			throw new LockError(`Failed to get lock info for stack ${shownStack}: ${errorDetail(error)}`, error instanceof Error ? error : void 0);
+			throw new LockError(`Failed to get lock info for stack ${shownStack}: ${errorDetail$1(error)}`, error instanceof Error ? error : void 0);
 		}
 	}
 	async isLocked(stackName, region) {
@@ -5938,16 +5990,16 @@ var LockManager = class {
 					this.logger.warn(`Not releasing the lock for stack ${stackRef(stackName, region)}: the conditional delete could not be evaluated here, and this process could not confirm the lock is still its own. Leaving it in place rather than risk deleting another process's lock. It expires on its own, or clear it with cdkd force-unlock. If this repeats, grant s3:GetObject on the lock key -- a delete conditioned on an ETag requires it.`);
 					return;
 				}
-				this.logger.debug(`Conditional lock release for stack ${stackRef(stackName, region)} is not supported here (${errorDetail(error)}); retrying unconditionally`);
+				this.logger.debug(`Conditional lock release for stack ${stackRef(stackName, region)} is not supported here (${errorDetail$1(error)}); retrying unconditionally`);
 				try {
 					await this.deleteLock(stackName, region);
 					this.logger.debug(`Lock released for stack: ${stackRef(stackName, region)}`);
 					return;
 				} catch (fallbackError) {
-					throw new LockError(`Failed to release lock for stack ${stackRef(stackName, region)}: ${errorDetail(fallbackError)}`, fallbackError instanceof Error ? fallbackError : void 0);
+					throw new LockError(`Failed to release lock for stack ${stackRef(stackName, region)}: ${errorDetail$1(fallbackError)}`, fallbackError instanceof Error ? fallbackError : void 0);
 				}
 			}
-			throw new LockError(`Failed to release lock for stack ${stackRef(stackName, region)}: ${errorDetail(error)}`, error instanceof Error ? error : void 0);
+			throw new LockError(`Failed to release lock for stack ${stackRef(stackName, region)}: ${errorDetail$1(error)}`, error instanceof Error ? error : void 0);
 		} finally {
 			await this.purgeLockVersions(this.getLockKey(stackName, region), "release");
 		}
@@ -6006,7 +6058,7 @@ var LockManager = class {
 				objectDescription: LOCK_OBJECT_DESCRIPTION
 			});
 		} catch (error) {
-			report(`Could not purge noncurrent versions of the lock key ${displayIdent(key, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })} in bucket '${this.config.bucket}': the purge could not be started. Their previous versions survive and remain readable via GetObject with a VersionId (${LOCK_OBJECT_DESCRIPTION}). Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key by hand. Underlying error: ${errorDetail(error)}`);
+			report(`Could not purge noncurrent versions of the lock key ${displayIdent(key, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })} in bucket '${this.config.bucket}': the purge could not be started. Their previous versions survive and remain readable via GetObject with a VersionId (${LOCK_OBJECT_DESCRIPTION}). Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key by hand. Underlying error: ${errorDetail$1(error)}`);
 		}
 	}
 	trackHeldLock(args) {
@@ -6086,7 +6138,7 @@ var LockManager = class {
 				this.logger.warn(`Lost the lock for stack ${stackRef(held.stackName, held.region)} while the operation was still running: the lock object has been replaced or removed. Another cdkd process may now be writing to this stack concurrently. This process will not delete the current lock when it finishes.`);
 				return;
 			}
-			this.logger.debug(`Lock renewal for stack ${stackRef(held.stackName, held.region)} failed, will retry: ${errorDetail(error)}`);
+			this.logger.debug(`Lock renewal for stack ${stackRef(held.stackName, held.region)} failed, will retry: ${errorDetail$1(error)}`);
 			if (!held.warnedPastExpiry && Date.now() >= held.info.expiresAt) {
 				held.warnedPastExpiry = true;
 				this.logger.warn(`Lock renewal for stack ${stackRef(held.stackName, held.region)} has been failing long enough that the lock expired at ${new Date(held.info.expiresAt).toISOString()}. Another cdkd process can now take it while this operation is still running. Renewal keeps retrying.`);
@@ -7622,6 +7674,10 @@ const CLASSIFIER_IDENTIFIER_FIELDS = /* @__PURE__ */ new Set([
 function isAuxiliaryAnchor(key, descriptor) {
 	return key === "logicalId" && descriptor.enumerable === false && descriptor.writable === false && typeof descriptor.value === "string" && descriptor.value.endsWith("/auxiliary");
 }
+const CREATED_BEFORE_FAILURE_MARK = Symbol.for("cdkd.createdBeforeFailure");
+function isCreatedBeforeFailureMark(key, descriptor) {
+	return key === CREATED_BEFORE_FAILURE_MARK && descriptor.enumerable === false && descriptor.writable === false && typeof descriptor.value === "object" && descriptor.value !== null && Object.isFrozen(descriptor.value);
+}
 function isPlainContainer(value) {
 	const proto = Object.getPrototypeOf(value);
 	return Array.isArray(value) ? proto === Array.prototype : proto === Object.prototype || proto === null;
@@ -7709,7 +7765,7 @@ function maskSecretsInError(error, secrets, extraMask) {
 			if (key === "message" || key === "cause" || key === "stack") continue;
 			const descriptor = Object.getOwnPropertyDescriptor(link, key);
 			if (!descriptor) continue;
-			descriptors[key] = typeof key === "string" && CLASSIFIER_IDENTIFIER_FIELDS.has(key) && typeof descriptor.value === "string" || isAuxiliaryAnchor(key, descriptor) ? descriptor : maskDescriptorValue(descriptor, maskText);
+			descriptors[key] = typeof key === "string" && CLASSIFIER_IDENTIFIER_FIELDS.has(key) && typeof descriptor.value === "string" || isAuxiliaryAnchor(key, descriptor) || isCreatedBeforeFailureMark(key, descriptor) ? descriptor : maskDescriptorValue(descriptor, maskText);
 			if (descriptors[key] !== descriptor) changed = true;
 		}
 		let cause = Object.getOwnPropertyDescriptor(link, "cause");
@@ -9107,129 +9163,6 @@ var ReplacementRulesRegistry = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/auxiliary-failure.ts
-const AUXILIARY_LOGICAL_ID_SUFFIX = "/auxiliary";
-const MAX_DEPTH = 5;
-function auxiliaryLogicalId(ownerLogicalId) {
-	return `${ownerLogicalId}${AUXILIARY_LOGICAL_ID_SUFFIX}`;
-}
-const RETRY_AUXILIARY_OWNER = "withRetry";
-function isAuxiliaryMarkOf(link, ownerLogicalId) {
-	try {
-		if (typeof link !== "object" && typeof link !== "function" || link === null) return false;
-		const own = Object.getOwnPropertyDescriptor(link, "logicalId");
-		return isAuxiliaryMark(own) && own?.value === auxiliaryLogicalId(ownerLogicalId);
-	} catch {
-		return false;
-	}
-}
-function isAuxiliaryMark(descriptor) {
-	return descriptor !== void 0 && descriptor.enumerable === false && descriptor.writable === false && typeof descriptor.value === "string" && descriptor.value.endsWith(AUXILIARY_LOGICAL_ID_SUFFIX);
-}
-function isAuxiliaryFailure(error) {
-	try {
-		let current = error;
-		for (let depth = 0; depth < MAX_DEPTH && typeof current === "object" && current !== null; depth++) {
-			if (isAuxiliaryMark(Object.getOwnPropertyDescriptor(current, "logicalId"))) return true;
-			current = current.cause;
-		}
-	} catch {}
-	return false;
-}
-const CREATED_BEFORE_FAILURE = Symbol.for("cdkd.createdBeforeFailure");
-function markCreatedBeforeFailure(error, ownerLogicalId, resourceType, physicalId) {
-	try {
-		if (typeof error !== "object" || error === null || !Object.isExtensible(error)) return error;
-		if (physicalId === "") return error;
-		Object.defineProperty(error, CREATED_BEFORE_FAILURE, {
-			value: Object.freeze({
-				logicalId: ownerLogicalId,
-				resourceType,
-				physicalId
-			}),
-			enumerable: false,
-			writable: false,
-			configurable: true
-		});
-	} catch {}
-	return error;
-}
-function createdMarkOn(link) {
-	const value = link[CREATED_BEFORE_FAILURE];
-	if (typeof value !== "object" || value === null) return void 0;
-	const { logicalId, resourceType, physicalId } = value;
-	if (typeof logicalId !== "string" || typeof resourceType !== "string" || typeof physicalId !== "string" || physicalId === "") return;
-	return {
-		logicalId,
-		resourceType,
-		physicalId
-	};
-}
-function createdBeforeFailure(error, logicalId, resourceType) {
-	try {
-		let current = error;
-		for (let depth = 0; depth < 10 && typeof current === "object" && current !== null; depth++) {
-			const mark = createdMarkOn(current);
-			if (mark) return mark.logicalId === logicalId && mark.resourceType === resourceType ? mark.physicalId : void 0;
-			const own = Object.getOwnPropertyDescriptor(current, "logicalId");
-			if (typeof own?.value === "string" && own.value !== logicalId && !isAuxiliaryMarkOf(current, logicalId)) return;
-			current = current.cause;
-		}
-	} catch {}
-}
-function hasCreatedBeforeFailure(error) {
-	try {
-		let current = error;
-		for (let depth = 0; depth < 10 && typeof current === "object" && current !== null; depth++) {
-			if (createdMarkOn(current)) return true;
-			current = current.cause;
-		}
-	} catch {}
-	return false;
-}
-function carryCreatedBeforeFailure(from, to) {
-	try {
-		if (typeof to !== "object" || to === null) return to;
-		let current = from;
-		let mark;
-		for (let depth = 0; depth < 10 && typeof current === "object" && current !== null && !mark; depth++) {
-			mark = createdMarkOn(current);
-			current = current.cause;
-		}
-		if (!mark) return to;
-		let probe = to;
-		for (let depth = 0; depth < 10 && typeof probe === "object" && probe !== null; depth++) {
-			if (createdMarkOn(probe)) return to;
-			probe = probe.cause;
-		}
-		return markCreatedBeforeFailure(to, mark.logicalId, mark.resourceType, mark.physicalId);
-	} catch {
-		return to;
-	}
-}
-function markAuxiliaryFailure(error, ownerLogicalId) {
-	try {
-		let current = error;
-		for (let depth = 0; depth < MAX_DEPTH && typeof current === "object" && current !== null; depth++) {
-			const own = Object.getOwnPropertyDescriptor(current, "logicalId");
-			if (typeof own?.value === "string") {
-				if (isAuxiliaryMark(own)) return error;
-			} else {
-				if (Object.isExtensible(current) && own?.configurable !== false) Object.defineProperty(current, "logicalId", {
-					value: auxiliaryLogicalId(ownerLogicalId),
-					enumerable: false,
-					writable: false,
-					configurable: true
-				});
-				return error;
-			}
-			current = current.cause;
-		}
-	} catch {}
-	return error;
-}
-
 //#endregion
 //#region src/deployment/retry.ts
 const IAM_PROPAGATION_INITIAL_DELAY_MS = 250;
@@ -15291,10 +15224,10 @@ function refuseMalformedResourcesForDestroy(state, stackName, region, recovery)
 	throw markNonRetryable(new CdkdError(malformedDestroyResourcesRefusalMessage(stackName, region, recovery), STATE_RESOURCES_MALFORMED));
 }
 const STATE_REGION_DIVERGED = "STATE_REGION_DIVERGED";
-function divergentRecordRegionRefusalMessage(stackName, keyRegion, divergentBodyRegion, resourceCount, recovery) {
+function divergentRecordRegionRefusalMessage(stackName, keyRegion, divergentBodyRegion, resourceCount, recovery, provenOrphans = 0) {
 	const cap = STACK_REF_MAX_CODE_POINTS;
 	const exact = rendersExactly(stackName, cap) && rendersExactly(keyRegion, cap) && isPasteableIdent(stackName) && isPasteableIdent(keyRegion);
-	const lists = resourceCount === void 0 ? "its resources map cannot be read" : `it still lists ${resourceCount} resource${resourceCount === 1 ? "" : "s"}`;
+	const lists = resourceCount === void 0 ? "its resources map cannot be read" : resourceCount === 0 && provenOrphans > 0 ? `its rollback journal holds ${provenOrphans} failed create${provenOrphans === 1 ? "" : "s"} whose resource the destroy would delete` : `it still lists ${resourceCount} resource${resourceCount === 1 ? "" : "s"}`;
 	const kind = describeRegionValueKind(divergentBodyRegion);
 	const opening = exact ? `cdkd will not destroy stack ${shellQuote(safeIdentifier(stackName, cap))} (${shellQuote(safeIdentifier(keyRegion, cap))}): the state record read from that region's key carries a 'region' of its own (${kind}) that is not the key's, and ${lists}` : `cdkd will not destroy the state record this command loaded: it carries a 'region' of its own (${kind}) that is not the region of the key it was read from, and ${lists}`;
 	const listing = withheldListingPointer(recovery);
@@ -15302,11 +15235,11 @@ function divergentRecordRegionRefusalMessage(stackName, keyRegion, divergentBody
 	const remedy = exact ? "Re-run with --verbose to see what the record's region field holds, then either destroy against the region the resources are really in, or repair that field to match the key it is stored under and re-run. " + withheldAccountClause(withheldAccounts, "the command at the end of this message prints") + "To drop the record and leave the live resources standing, spelled out rather than pasteable because that command DELETES a record: " + dropRecordTemplate(recovery) : "This record's stack name or region does NOT render exactly — what any surrounding output shows is a sanitized form, and another record may render identically — so this message names no target and offers no command against one. List the records with " + (listing.line === void 0 ? `${WITHHELD_LISTING_POINTER}. Inspect it with: ${inspectCommand(void 0, void 0)}` : `${listing.pointer}.` + destroyAccountClause(recovery) + `\n${listing.line}\nInspect it with: ${inspectCommand(void 0, void 0, recovery)}`);
 	return `${opening} ${resourceCount === void 0 ? `— so cdkd can neither count what it would delete nor tell which region it is in` : `— so cdkd cannot tell which region those resources are in`}. cdkd stamps the key's region into every record it writes, so this record was not written by cdkd. Destroying against the key's region would issue every delete there; if the record's own region is the honest half, each delete comes back not-found, which this command reads as ALREADY DELETED — it would report success, remove the record, and leave every resource standing in the other region with nothing naming it. ${remedy}`;
 }
-function refuseDivergentRecordRegionForDestroy(state, stackName, keyRegion, divergentBodyRegion, recovery) {
+function refuseDivergentRecordRegionForDestroy(state, stackName, keyRegion, divergentBodyRegion, recovery, provenOrphans = 0) {
 	if (divergentBodyRegion === void 0) return;
 	const resourceCount = isReadableBag(state.resources) ? Object.keys(state.resources).length : void 0;
-	if (resourceCount === 0) return;
-	throw markNonRetryable(new CdkdError(divergentRecordRegionRefusalMessage(stackName, keyRegion, divergentBodyRegion, resourceCount, recovery), STATE_REGION_DIVERGED));
+	if (resourceCount === 0 && provenOrphans === 0) return;
+	throw markNonRetryable(new CdkdError(divergentRecordRegionRefusalMessage(stackName, keyRegion, divergentBodyRegion, resourceCount, recovery, provenOrphans), STATE_REGION_DIVERGED));
 }
 function malformedDeployResourcesRefusalMessage(rawStackName, rawRegion) {
 	const stackName = absentIfEmpty(rawStackName);
@@ -15994,7 +15927,7 @@ function isPlainObject$2(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 const DYNAMIC_REFERENCE_OPEN = "{{resolve:";
-const NESTED_STACK_TYPE$2 = "AWS::CloudFormation::Stack";
+const NESTED_STACK_TYPE$3 = "AWS::CloudFormation::Stack";
 const NESTED_OUTPUT_PREFIX = "Outputs.";
 function carriesSecretValue(value, corpora) {
 	if (carriesSecretMask(value)) return true;
@@ -16069,7 +16002,7 @@ function intrinsicKey(value) {
 	const key = keys[0];
 	return key === "Ref" || key.startsWith("Fn::") ? key : void 0;
 }
-const OPAQUE_ATTRIBUTE_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::CustomResource", NESTED_STACK_TYPE$2]);
+const OPAQUE_ATTRIBUTE_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::CustomResource", NESTED_STACK_TYPE$3]);
 function hasOpaqueAttributes(logicalId, walk) {
 	const definition = walk.resources[logicalId];
 	const type = isPlainObject$2(definition) ? definition["Type"] : void 0;
@@ -16426,7 +16359,7 @@ function passedKey(passed) {
 function isNestedStackRow(logicalId, walk) {
 	if (!Object.hasOwn(walk.resources, logicalId)) return false;
 	const definition = walk.resources[logicalId];
-	return isPlainObject$2(definition) && definition["Type"] === NESTED_STACK_TYPE$2;
+	return isPlainObject$2(definition) && definition["Type"] === NESTED_STACK_TYPE$3;
 }
 function getAttAttribute(operand, target) {
 	if (Array.isArray(operand)) return operand.length === 2 && typeof operand[1] === "string" ? operand[1] : void 0;
@@ -18046,6 +17979,7 @@ async function resolveGetAtt(getAtt, context) {
 	}
 	const resource = this.lookupResourceRecord(logicalId, "Fn::GetAtt", context);
 	if (!resource) throw markNonRetryable(/* @__PURE__ */ new Error(`Resource ${this.displayMasked(logicalId, context)} not found for Fn::GetAtt`));
+	recordSecretNamedRead(logicalId, void 0, context);
 	if (!(resource.resourceType === "AWS::EC2::VPC" && attributeName === "Ipv6CidrBlocks") && resource.attributes !== void 0) {
 		const storedValue = Object.hasOwn(resource.attributes, attributeName) ? resource.attributes[attributeName] : void 0;
 		const flatValue = isImpossibleEmptyStoredAttribute(resource.resourceType, attributeName, storedValue) ? void 0 : storedValue;
@@ -18099,6 +18033,7 @@ async function resolveGetAtt(getAtt, context) {
 		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${loggedLogicalId}, ${this.displayMasked(attributeName, context)}]: the nested stack ${quotedRender(loggedLogicalId, "'")} declares no output named ${quotedRender(this.displayMasked(this.outputNameLogText(attributeName, context), context), "'")}. Its outputs are ${this.displayMasked(declaredText, context)}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
 	}
 	const value = await this.constructWithStaleRecordHeal(resource, attributeName, context, logicalId);
+	recordSecretNamedRead(logicalId, value, context);
 	this.logger.debug(`Resolved Fn::GetAtt: ${this.logRender(logicalId, context)}.${this.logRender(attributeName, context)} resolved to ${this.logRender(stringifyAttributeForLog(attributeName, this.maskValueLeaves(value, context)), context, {
 		structured: isStructured(value),
 		redacted: isSensitiveAttributeName(attributeName)
@@ -18128,6 +18063,7 @@ function publicNoEchoTokens(context, producer) {
 	return tokens;
 }
 function noteAttributeSecrecy(logicalId, attributeName, value, context) {
+	recordSecretNamedRead(logicalId, value, context);
 	const declared = context.noEchoAttributeResources?.get(logicalId);
 	if ((declared === true || declared !== void 0 && declared.has(attributeName)) && context.recordedSecretValues) recordFreshNoEchoValuesIn(value, context.recordedSecretValues, void 0, this.publicNoEchoTokens(context, logicalId));
 	if (context.redactedAttributeReads !== void 0 && carriesSecretMask(value)) {
@@ -18141,6 +18077,17 @@ function noteAttributeSecrecy(logicalId, attributeName, value, context) {
 	}
 	return value;
 }
+function recordSecretNamedRead(logicalId, value, context) {
+	const bag = context.printingSecrets ?? context.recordedSecretValues;
+	if (bag === void 0 || context.secretNameNeedles === void 0) return;
+	const needles = context.secretNameNeedles(logicalId);
+	if (needles === void 0) return;
+	for (const needle of needles) recordLogOnlyValue(bag, needle);
+	for (const leaf of wholeStringLeavesOf(value)) for (const needle of needles) if (needle.length >= 4 && leaf.includes(needle)) {
+		recordLogOnlyValue(bag, leaf);
+		break;
+	}
+}
 function rejectPlaceholderArnAttribute(resource, attributeName, value, logicalId, context, healOutcome) {
 	if (!isStalePlaceholderArnAttribute(resource.resourceType, attributeName, value)) return;
 	throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: the recorded value ${quotedRender(stringifyValue(this.maskValueLeaves(value, context)), "\"")} is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. ` + this.staleRecordRemedy(healOutcome, context)));
@@ -20268,6 +20215,7 @@ async function resolveRef(logicalId, context, onParameter) {
 	const resource = this.lookupResourceRecord(logicalId, "Ref", context);
 	if (resource) {
 		const refValue = this.resolveRefValue(logicalId, resource, context);
+		recordSecretNamedRead(logicalId, refValue, context);
 		this.logger.debug(`Resolved Ref to resource: ${this.logRender(logicalId, context)} resolved to ${this.logRender(String(refValue), context)}`);
 		return refValue;
 	}
@@ -22068,7 +22016,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CbwOK2TQ.js");
+			const { ASGProvider } = await import("./asg-provider-BwWy0pBH.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -22174,7 +22122,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-COCDd7bS.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-TnGNCeLX.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-McCDKyXN.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-Cdp4jX8S.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -22997,6 +22945,10 @@ function withCurrentResourceSecrets(secrets, fn) {
 	const outer = boundSecretBagsStore.getStore() ?? [];
 	return boundSecretBagsStore.run([...outer, secrets], () => currentResourceSecretsStore.run(secrets, fn));
 }
+function withPrintingSecrets(secrets, fn) {
+	const outer = boundSecretBagsStore.getStore() ?? [];
+	return boundSecretBagsStore.run([...outer, secrets], fn);
+}
 function getCurrentResourceSecrets() {
 	return currentResourceSecretsStore.getStore();
 }
@@ -23073,8 +23025,34 @@ const CR_MASKED_SERVICE_TOKEN_SKIP_REASON = "masked ServiceToken in state — De
 const CR_REFERENCE_SERVICE_TOKEN_SKIP_REASON = "dynamic reference as ServiceToken in state — handler not invoked";
 const CR_DELETE_INVOKE_FAILED_SKIP_REASON = "Delete request to the handler did not complete — resource unproven";
 const CR_DELETE_HANDLER_FAILED_SKIP_REASON = "Delete handler reported FAILED — resource unproven";
-const CR_SKIP_NOT_A_RETRY_CAVEAT = "NOTE this record is a POINTER, not a retry: the same destroy run deletes the backing Lambda, so the next 'cdkd destroy' finds the handler gone and DROPS this record (issue 804 pre-check). Tear the resource down by hand, then clear the stack's records with 'cdkd state orphan <stack> --stack-region <region>' — that command drops EVERY record for the stack in that region, not just this one.";
+const CR_BACKING_LAMBDA_GONE_SKIP_REASON = "backing Lambda function is gone — Delete handler not invoked";
+function crSkipNotARetryCaveat(context, logicalId) {
+	return `NOTE this record is a POINTER, not a retry: the same destroy run deletes the backing Lambda, so the next 'cdkd destroy' cannot reach the handler either: it skips this resource again and keeps the record (issue 2115). Tear the resource down by hand, then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}.`;
+}
 const DEPLOY_SKIP_CAVEAT = "NOTE this arm is ALSO reached from cdkd deploy. Since issue 1762 the DELETE of a resource removed from the template behaves like destroy — the record is KEPT and the next deploy re-attempts it — but a REPLACEMENT / rollback delete FAILS the resource instead (https://github.com/go-to-k/cdkd/issues/1762), leaving the old one untracked; there, tear the resource down by hand.";
+function crDeployNoStateOrphan(logicalId) {
+	return `For a resource removed from the template, to give up on the delete and stop tracking it, drop the record with ${stateOrphanRecordRemedy(void 0, logicalId)}.`;
+}
+function crDeploySkipTail(logicalId) {
+	return "Meanwhile 'cdkd deploy --allow-unaddressed' exits 0 (a deploy-only flag; 'cdkd rollback' has none); the record stays and each deploy re-attempts the delete. A delete-first REPLACEMENT or a rollback delete usually FAILS the resource and keeps the record (https://github.com/go-to-k/cdkd/issues/1762). Where the other copy already exists (a replacement that created the new resource first, or a rollback that re-created the old one first), the skip only warns and the surviving copy is no longer tracked, so tear it down by hand. " + crDeployNoStateOrphan(logicalId);
+}
+const CR_DEPLOY_HANDLER_SKIP_HEAD = "This delete is not part of a stack destroy (a 'cdkd deploy' template removal, replacement or rollback, or a 'cdkd rollback'). For a resource removed from the template the record is KEPT and the next 'cdkd deploy' re-sends the Delete: fix what made it fail (the handler's Delete logic, or what stopped the invoke) and re-deploy. That reaches the handler only while its function exists: if this deploy also deleted the backing Lambda, the next deploy finds it gone and DROPS the record with a warning, so tear down what the handler manages by hand. ";
+const CR_DEPLOY_UNADDRESSABLE_HEAD = "This delete is not part of a stack destroy (a 'cdkd deploy' template removal, replacement or rollback, or a 'cdkd rollback'). For a resource removed from the template the record is KEPT and every 'cdkd deploy' skips it again until ServiceToken is restored: put the provider's Lambda function or SNS topic ARN back in state.json and re-deploy, which sends the Delete while that handler exists. If its Lambda function is gone, that deploy DROPS the record with a warning instead, so tear down what the handler manages by hand. ";
+function crDestroyUnaddressableRemedy(context, logicalId) {
+	return `Tear the resource down by hand, then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}. Restoring ServiceToken (the provider's Lambda function or SNS topic ARN) in state.json and re-running helps only while that handler still exists: a destroy goes on to delete its backing Lambda.`;
+}
+function handlerSkipRemedy(context, logicalId) {
+	return context?.stackDestroy === true ? ` — cdkd is KEEPING the state record and the run exits non-zero. ${crSkipNotARetryCaveat(context, logicalId)}` : `. ${CR_DEPLOY_HANDLER_SKIP_HEAD}${crDeploySkipTail(logicalId)}`;
+}
+function crUnresolvedTokenUpdateRemedy() {
+	return "This indicates an unresolved value in the template, or, on a rollback, in the resource's recorded state. Check that the template resolves ServiceToken to the provider's Lambda function or SNS topic ARN and re-deploy; a rollback replays the recorded value, so restore the template and re-deploy instead. Do not drop this record with 'cdkd state orphan', with or without --resource: the template still declares the resource, so the next deploy would send the handler a fresh Create and leave what it already manages untracked.";
+}
+function unresolvedTokenDeleteRemedy(context, logicalId) {
+	return context?.stackDestroy === true ? `re-run 'cdkd import', or drop the record with ${stateOrphanRecordRemedy(context, logicalId)}, to recover.` : `put the provider's Lambda function or SNS topic ARN back as ServiceToken in state.json and re-run to recover. ${crDeployNoStateOrphan(logicalId)}`;
+}
+function unaddressableServiceTokenRemedy(context, logicalId) {
+	return context?.stackDestroy === true ? crDestroyUnaddressableRemedy(context, logicalId) : `${CR_DEPLOY_UNADDRESSABLE_HEAD}${crDeploySkipTail(logicalId)}`;
+}
 function isCustomResourceResponsePayload(value) {
 	if (typeof value !== "object" || value === null) return false;
 	const payload = value;
@@ -23417,7 +23395,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 		this.logger.debug(`Creating custom resource ${logicalId} (${resourceType})`);
 		const serviceToken = properties["ServiceToken"];
 		if (!serviceToken) throw new ProvisioningError(`ServiceToken is required for custom resource ${logicalId}`, resourceType, logicalId);
-		if (typeof serviceToken !== "string") throw new ProvisioningError(`Custom Resource ${logicalId}: ServiceToken is not a resolved string ARN (got ${typeof serviceToken}). This usually indicates state was written by a pre-fix cdkd import; re-run 'cdkd import' or 'cdkd state orphan <stack> --stack-region <region>' to recover.`, resourceType, logicalId);
+		if (typeof serviceToken !== "string") throw new ProvisioningError(`Custom Resource ${logicalId}: ServiceToken is not a resolved string ARN (got ${typeof serviceToken}). This indicates an unresolved value in the template, or, on a rollback, in the resource's recorded state. Check that the template resolves ServiceToken to the provider's Lambda function or SNS topic ARN; a rollback replays the recorded value, so restore the template and re-deploy instead.`, resourceType, logicalId);
 		this.refuseResolvedSecret(logicalId, resourceType, properties);
 		try {
 			const cfnResponse = await this.invokeCustomResourceWithRetry(serviceToken, logicalId, "Create", (invocation) => ({
@@ -23448,7 +23426,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 		this.logger.debug(`Updating custom resource ${logicalId}: ${physicalId} (${resourceType})`);
 		const serviceToken = properties["ServiceToken"];
 		if (!serviceToken) throw new ProvisioningError(`ServiceToken is required for custom resource ${logicalId}`, resourceType, logicalId, physicalId);
-		if (typeof serviceToken !== "string") throw new ProvisioningError(`Custom Resource ${logicalId}: ServiceToken is not a resolved string ARN (got ${typeof serviceToken}). This usually indicates state was written by a pre-fix cdkd import; re-run 'cdkd import' or 'cdkd state orphan <stack> --stack-region <region>' to recover.`, resourceType, logicalId, physicalId);
+		if (typeof serviceToken !== "string") throw new ProvisioningError(`Custom Resource ${logicalId}: ServiceToken is not a resolved string ARN (got ${typeof serviceToken}). ` + crUnresolvedTokenUpdateRemedy(), resourceType, logicalId, physicalId);
 		this.refuseResolvedSecret(logicalId, resourceType, properties, physicalId, previousProperties);
 		try {
 			const cfnResponse = await this.invokeCustomResourceWithRetry(serviceToken, logicalId, "Update", (invocation) => ({
@@ -23478,7 +23456,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 			throw new ProvisioningError(`Failed to update custom resource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async delete(logicalId, physicalId, resourceType, properties, _context) {
+	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting custom resource ${logicalId}: ${physicalId} (${resourceType})`);
 		if (!properties) {
 			this.logger.warn(`No properties available for custom resource ${logicalId}, skipping deletion — the handler is never invoked, so anything this custom resource manages is LEFT IN PLACE. Restore the record's properties in state.json and re-run, or tear the resource down by hand. ${DEPLOY_SKIP_CAVEAT}`);
@@ -23495,23 +23473,30 @@ var CustomResourceProvider = class CustomResourceProvider {
 				reason: CR_NO_SERVICE_TOKEN_SKIP_REASON
 			};
 		}
-		if (typeof serviceToken !== "string") throw new ProvisioningError(`Custom Resource ${logicalId}: ServiceToken is not a resolved string ARN (got ${typeof serviceToken}). This usually indicates state was written by a pre-fix cdkd import; re-run 'cdkd import' or 'cdkd state orphan <stack> --stack-region <region>' to recover.`, resourceType, logicalId, physicalId);
+		if (typeof serviceToken !== "string") throw new ProvisioningError(`Custom Resource ${logicalId}: ServiceToken is not a resolved string ARN (got ${typeof serviceToken}). This usually indicates state was written by a pre-fix cdkd import; ` + unresolvedTokenDeleteRemedy(context, logicalId), resourceType, logicalId, physicalId);
 		if (carriesSecretMask(serviceToken)) {
-			this.logger.warn(safeMsg`ServiceToken for custom resource ${logicalId} is recorded in state as the redaction ` + safeMsg`mask '${"***"}' (a NoEcho value this resource reads equals, or is contained ` + "in, its ServiceToken), so cdkd cannot address the handler; skipping deletion — anything this custom resource manages is LEFT IN PLACE. Re-deploying does not repair the record while that attribute still carries the value. Tear the resource down by hand, then clear the stack's records with 'cdkd state orphan <stack> --stack-region <region>' — that command drops EVERY record for the stack in that region, not just this one. Restoring ServiceToken (the provider's Lambda function or SNS topic ARN) in state.json and re-running helps only while that handler still exists: a destroy goes on to delete its backing Lambda. " + safeMsg`${DEPLOY_SKIP_CAVEAT}`);
+			this.logger.warn(safeMsg`ServiceToken for custom resource ${logicalId} is recorded in state as the redaction ` + safeMsg`mask '${"***"}' (a NoEcho value this resource reads equals, or is contained ` + "in, its ServiceToken), so cdkd cannot address the handler; skipping deletion — anything this custom resource manages is LEFT IN PLACE. Re-deploying does not repair the record while that attribute still carries the value. " + safeMsg`${unaddressableServiceTokenRemedy(context, logicalId)}`);
 			return {
 				outcome: "skipped",
 				reason: CR_MASKED_SERVICE_TOKEN_SKIP_REASON
 			};
 		}
 		if (dynamicReferenceTokens(serviceToken).length > 0) {
-			this.logger.warn(safeMsg`ServiceToken for custom resource ${logicalId} is recorded in state as a ` + "'{{resolve:...}}' dynamic reference, which cdkd does not resolve on delete, so it cannot address the handler; skipping deletion — anything this custom resource manages is LEFT IN PLACE. CloudFormation does not support secure (secretsmanager / ssm-secure) dynamic references in custom resources, and cdkd now refuses such a template at deploy time. Tear the resource down by hand, then clear the stack's records with 'cdkd state orphan <stack> --stack-region <region>' — that command drops EVERY record for the stack in that region, not just this one. Restoring ServiceToken (the provider's Lambda function or SNS topic ARN) in state.json and re-running helps only while that handler still exists: a destroy goes on to delete its backing Lambda. " + safeMsg`${DEPLOY_SKIP_CAVEAT}`);
+			this.logger.warn(safeMsg`ServiceToken for custom resource ${logicalId} is recorded in state as a ` + "'{{resolve:...}}' dynamic reference, which cdkd does not resolve on delete, so it cannot address the handler; skipping deletion — anything this custom resource manages is LEFT IN PLACE. CloudFormation does not support secure (secretsmanager / ssm-secure) dynamic references in custom resources, and cdkd now refuses such a template at deploy time. " + safeMsg`${unaddressableServiceTokenRemedy(context, logicalId)}`);
 			return {
 				outcome: "skipped",
 				reason: CR_REFERENCE_SERVICE_TOKEN_SKIP_REASON
 			};
 		}
 		if (!this.isSnsServiceToken(serviceToken) && await this.isBackingLambdaGone(serviceToken)) {
-			this.logger.warn(`Backing Lambda for custom resource ${logicalId} no longer exists (${serviceToken}); treating the custom resource as already deleted and DROPPING its state record. The handler can never run again, so if its teardown was never PROVEN — e.g. an earlier run reported this resource as skipped (issue 2054) — whatever it manages is still LIVE and is now untracked by cdkd. Check for leftovers before treating the stack as gone.`);
+			if (context?.stackDestroy === true) {
+				this.logger.warn(safeMsg`Backing Lambda for custom resource ${logicalId} no longer exists (${serviceToken}), so ` + "its Delete handler cannot be invoked and cdkd cannot confirm the resource was deleted; skipping deletion — anything this custom resource manages may still be LIVE. cdkd is KEEPING the state record and the run exits non-zero, as CloudFormation leaves such a stack DELETE_FAILED. A re-run skips it again unless a function with that exact ARN exists again (e.g. a shared provider stack destroyed before this one, then redeployed). Otherwise confirm by hand that whatever it manages is gone (or tear it down), then drop the record with " + safeMsg`${stateOrphanRecordRemedy(context, logicalId)}.`);
+				return {
+					outcome: "skipped",
+					reason: CR_BACKING_LAMBDA_GONE_SKIP_REASON
+				};
+			}
+			this.logger.warn(safeMsg`Backing Lambda for custom resource ${logicalId} no longer exists (${serviceToken}); ` + "treating the custom resource as already deleted and DROPPING its state record, as CloudFormation ignores a delete failure in an update's cleanup phase. The handler can never run again, so if its teardown was never PROVEN, whatever it manages may still be LIVE and is now untracked by cdkd. Check for leftovers by hand.");
 			return;
 		}
 		try {
@@ -23526,7 +23511,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				ResourceProperties: this.stringifyProperties(properties)
 			}), DELETE_PATH_UNMASKED);
 			if (cfnResponse.Status === "FAILED") {
-				this.logger.warn(`Custom resource delete handler returned FAILED for ${logicalId}: ${cfnResponse.Reason || "Unknown reason"}. The handler reported that it did NOT delete, so anything this custom resource manages is LEFT IN PLACE — cdkd is KEEPING the state record and the run exits non-zero. ${CR_SKIP_NOT_A_RETRY_CAVEAT} ('cdkd deploy' also accepts --allow-unaddressed, which forces exit 0; 'cdkd destroy' has no such flag.) ${DEPLOY_SKIP_CAVEAT}`);
+				this.logger.warn(`Custom resource delete handler returned FAILED for ${logicalId}: ${cfnResponse.Reason || "Unknown reason"}. The handler reported that it did NOT delete, so anything this custom resource manages is LEFT IN PLACE${handlerSkipRemedy(context, logicalId)}`);
 				return {
 					outcome: "skipped",
 					reason: CR_DELETE_HANDLER_FAILED_SKIP_REASON
@@ -23534,7 +23519,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 			}
 			this.logger.debug(`Successfully deleted custom resource ${logicalId}`);
 		} catch (error) {
-			this.logger.warn(`Failed to delete custom resource ${logicalId}, but continuing: ${describeAwsFailure(error).detail}. The Delete handler did not complete, so anything this custom resource manages may still be LIVE — cdkd is KEEPING the state record and the run exits non-zero. ${CR_SKIP_NOT_A_RETRY_CAVEAT} ${DEPLOY_SKIP_CAVEAT}`);
+			this.logger.warn(`Failed to delete custom resource ${logicalId}, but continuing: ${describeAwsFailure(error).detail}. The Delete handler did not complete, so anything this custom resource manages may still be LIVE${handlerSkipRemedy(context, logicalId)}`);
 			return {
 				outcome: "skipped",
 				reason: CR_DELETE_INVOKE_FAILED_SKIP_REASON
@@ -26482,6 +26467,81 @@ function ownPoliciesChange(change) {
 	return (change?.propertyChanges ?? []).some((c) => c.path === "Policies" && c.inPlacePropagated !== true && c.replacementPropagated !== true);
 }
 
+//#endregion
+//#region src/analyzer/destructive-changes.ts
+const IGNORED_RESOURCE_TYPES = /* @__PURE__ */ new Set(["AWS::CDK::Metadata"]);
+const PATH_METADATA_KEY = "aws:cdk:path";
+function findDestructiveChanges(stackName, changes, records, template, recreateTargets = /* @__PURE__ */ new Set()) {
+	const found = [];
+	for (const change of changes) {
+		const record = Object.hasOwn(records, change.logicalId) ? records[change.logicalId] : void 0;
+		const resourceType = record?.resourceType ?? change.resourceType;
+		if (IGNORED_RESOURCE_TYPES.has(resourceType) || IGNORED_RESOURCE_TYPES.has(change.resourceType)) continue;
+		const impact = change.changeType === "UPDATE" && recreateTargets.has(change.logicalId) ? "WILL_REPLACE" : destructiveImpactOf(change, record);
+		if (impact === void 0) continue;
+		const recorded = typeof record?.constructPath === "string" ? record.constructPath : void 0;
+		const constructPath = constructPathOf(template, change.logicalId) ?? recorded;
+		found.push({
+			stackName,
+			logicalId: change.logicalId,
+			resourceType,
+			...constructPath !== void 0 && { constructPath },
+			impact
+		});
+	}
+	return found;
+}
+function destructiveImpactOf(change, record) {
+	switch (change.changeType) {
+		case "DELETE": return shouldRetainResource(record?.deletionPolicy) ? "WILL_ORPHAN" : "WILL_DESTROY";
+		case "UPDATE": {
+			if (record !== void 0 && record.resourceType !== change.resourceType) return "WILL_REPLACE";
+			let mayReplace = false;
+			for (const pc of change.propertyChanges ?? []) {
+				if (!pc.requiresReplacement) continue;
+				if (pc.inPlacePropagated === true || pc.replacementPropagated === true) mayReplace = true;
+				else return "WILL_REPLACE";
+			}
+			return mayReplace ? "MAY_REPLACE" : void 0;
+		}
+		default: return;
+	}
+}
+function constructPathOf(template, logicalId) {
+	const resources = template?.Resources;
+	if (resources === void 0 || !Object.hasOwn(resources, logicalId)) return void 0;
+	const path = resources[logicalId]?.Metadata?.[PATH_METADATA_KEY];
+	return typeof path === "string" && path !== "" ? path : void 0;
+}
+function describeDestructiveImpact(impact) {
+	switch (impact) {
+		case "WILL_REPLACE": return "will be replaced";
+		case "MAY_REPLACE": return "may be replaced";
+		case "WILL_DESTROY": return "will be destroyed";
+		case "WILL_ORPHAN": return "will be orphaned";
+	}
+}
+function formatDestructiveChange(change) {
+	const path = change.constructPath !== void 0 ? `${displaySafe(displayPath(change.constructPath))} ` : "";
+	return `${displayIdent(change.stackName)}: ${displaySafe(change.resourceType)} ${path}${displayIdent(change.logicalId)} ${describeDestructiveImpact(change.impact)}`;
+}
+function displayPath(constructPath) {
+	let parts = constructPath.replace(/^\//, "").split("/");
+	if (parts.length > 1) {
+		parts = parts.slice(1);
+		const last = parts[parts.length - 1];
+		if (parts.length > 1 && (last === "Resource" || last === "Default")) parts = parts.slice(0, -1);
+	}
+	return parts.join("/");
+}
+function withConstructPath(record, path) {
+	if (path === void 0 || record.constructPath === path) return record;
+	return {
+		...record,
+		constructPath: path
+	};
+}
+
 //#endregion
 //#region src/deployment/masking-retry-logger.ts
 function maskingRetryLogger(logger, secrets) {
@@ -26894,6 +26954,7 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 		...parameterValues && { parameters: parameterValues },
 		...conditions && { conditions }
 	}, stackName);
+	context.printingSecrets = /* @__PURE__ */ new Map();
 	const refuseMaskedOutputReads = (outputKey, ownReads) => {
 		const added = ownReads.filter((read) => read.kind === "ref-state-key");
 		if (added.length === 0) return;
@@ -27377,9 +27438,9 @@ const REDACTED_DELETE_ADDRESS_SKIP_REASON = "redacted address property in state
 function redactedDeleteAddressFields(fields) {
 	return Object.keys(fields).filter((key) => isRedactedRecordedValue(fields[key]));
 }
-function redactedDeleteAddressSkip(logger, logicalId, what, redactedFields) {
+function redactedDeleteAddressSkip(logger, logicalId, what, redactedFields, context) {
 	if (redactedFields.length === 0) return void 0;
-	logger.warn(safeMsg`${what} ${logicalId} is recorded in state with ${redactedFields.join(", ")} ` + "redacted (the '***' mask of a NoEcho value it read, or a secret '{{resolve:...}}' reference), which names nothing in AWS; skipping deletion — no AWS call is issued, so the resource is LEFT IN PLACE unless a parent resource this run also deletes removes it (then only the record is stale). Re-deploying records the same redaction again. The state record is KEPT and the run reports the skip: on 'cdkd destroy' / 'cdkd state destroy' (which exits non-zero) and, since issue 1762, on the plain DELETE of a resource removed from the template during cdkd deploy. Remove the resource by hand, then clear the stack's records with 'cdkd state orphan <stack>' — that command drops EVERY record for the stack, not just this one. NOTE a deploy-side REPLACEMENT or rollback delete instead FAILS the resource (https://github.com/go-to-k/cdkd/issues/1762) — the old resource is left untracked there, so remove it by hand.");
+	logger.warn(safeMsg`${what} ${logicalId} is recorded in state with ${redactedFields.join(", ")} ` + "redacted (the '***' mask of a NoEcho value it read, or a secret '{{resolve:...}}' reference), which names nothing in AWS; skipping deletion — no AWS call is issued, so the resource is LEFT IN PLACE unless a parent resource this run also deletes removes it (then only the record is stale). Re-deploying records the same redaction again. The state record is KEPT and the run reports the skip: on 'cdkd destroy' / 'cdkd state destroy' (which exits non-zero) and, since issue 1762, on the plain DELETE of a resource removed from the template during cdkd deploy. Remove the resource by hand, " + safeMsg`then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}. ` + "NOTE a deploy-side REPLACEMENT or rollback delete instead FAILS the resource (https://github.com/go-to-k/cdkd/issues/1762) — the old resource is left untracked there, so remove it by hand.");
 	return {
 		outcome: "skipped",
 		reason: REDACTED_DELETE_ADDRESS_SKIP_REASON
@@ -28395,6 +28456,9 @@ function mayOwn(o, orphan, completed) {
 	if (o.physicalId === orphan.physicalId) return true;
 	return o.previousState?.physicalId === orphan.physicalId;
 }
+function isJournaledOrphan(op) {
+	return op.changeType === "CREATE" && typeof op.physicalIdRecoveredFromError === "boolean";
+}
 function planFailedOps(failedOps, stateResources) {
 	return failedOps.map((op) => ({
 		op,
@@ -29278,7 +29342,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 					const takeFinalSnapshot = snapshotPolicy && ctx.skipFinalSnapshot !== true;
 					let finalSnapshotIdentifier;
 					if (takeFinalSnapshot) finalSnapshotIdentifier = await prepareCreateRollbackFinalSnapshot(op, deleteProvisionedBy, ctx, mask);
-					logger.info(`  Rollback: deleting partially-created ${safe(op.logicalId)} (${safe(op.resourceType)}) (--revert-failed)` + (takeFinalSnapshot ? " — DeletionPolicy: Snapshot" : "") + (snapshotPolicy && !takeFinalSnapshot ? " — DeletionPolicy: Snapshot NOT taken (--skip-final-snapshot)" : ""));
+					logger.info(`  Rollback: deleting partially-created ${safe(op.logicalId)} (${safe(op.resourceType)})` + (takeFinalSnapshot ? " — DeletionPolicy: Snapshot" : "") + (snapshotPolicy && !takeFinalSnapshot ? " — DeletionPolicy: Snapshot NOT taken (--skip-final-snapshot)" : ""));
 					const { provider, provisionedBy: deleteRoutedVia } = ctx.providerRegistry.getProviderFor({
 						resourceType: op.resourceType,
 						provisionedBy: deleteProvisionedBy
@@ -29292,7 +29356,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						deletionPolicy: snapshotPolicy ? "Snapshot" : "Delete",
 						recordedAttributes: stateResources[op.logicalId]?.attributes
 					});
-					throwIfDeleteSkipped(failedCreateDelete, op.logicalId, op.physicalId, "while deleting the partially-created resource (--revert-failed)", {
+					throwIfDeleteSkipped(failedCreateDelete, op.logicalId, op.physicalId, "while deleting the partially-created resource", {
 						ctx,
 						stackName,
 						resourceType: op.resourceType,
@@ -29444,7 +29508,7 @@ async function collectNestedChildUnaddressed(fn) {
 //#endregion
 //#region src/deployment/nested-child-journal.ts
 const NESTED_PENDING_PARENT_REASON = "nested-pending-parent";
-const NESTED_STACK_TYPE$1 = "AWS::CloudFormation::Stack";
+const NESTED_STACK_TYPE$2 = "AWS::CloudFormation::Stack";
 const MAX_NESTED_WALK_DEPTH = 32;
 function nestedChildStackName(parentStackName, logicalId) {
 	return `${parentStackName}~${logicalId}`;
@@ -29500,7 +29564,7 @@ function recordDisplacedSkips(recordEvent, stackName, ops) {
 	});
 }
 function revertedNestedRowIds(ops) {
-	return ops.filter((op) => op.resourceType === NESTED_STACK_TYPE$1 && op.changeType === "UPDATE").map((op) => op.logicalId);
+	return ops.filter((op) => op.resourceType === NESTED_STACK_TYPE$2 && op.changeType === "UPDATE").map((op) => op.logicalId);
 }
 const revertRunStorage = new AsyncLocalStorage();
 function withNestedRevertRun(runId, fn) {
@@ -29526,7 +29590,7 @@ async function dropNestedChildJournals(args) {
 	if (!isPlainRecord(resources)) return;
 	if (depthExceeded(depth, parentStackName, logger)) return;
 	for (const [logicalId, record] of Object.entries(resources)) {
-		if (!isPlainRecord(record) || record["resourceType"] !== NESTED_STACK_TYPE$1) continue;
+		if (!isPlainRecord(record) || record["resourceType"] !== NESTED_STACK_TYPE$2) continue;
 		const child = nestedChildStackName(parentStackName, logicalId);
 		try {
 			const data = await stateBackend.getState(child, region);
@@ -29540,13 +29604,34 @@ async function dropNestedChildJournals(args) {
 			warnUncleared(logger, child, error);
 		}
 		try {
-			await withChildLock(args.lockManager, child, region, logger, () => stateBackend.deleteRollbackJournal(child, region));
-			logger.debug(safeMsg`Deleted the rollback journal of nested stack ${displaySafe(child)}`);
+			if (await withChildLock(args.lockManager, child, region, logger, async () => {
+				if (args.beforeDelete) {
+					if (!await args.beforeDelete(child, await readOwnRecord(stateBackend, child, region))) return false;
+				}
+				let gone;
+				try {
+					gone = await stateBackend.deleteRollbackJournal(child, region);
+				} catch (error) {
+					await args.onDeleteFailed?.(child);
+					throw error;
+				}
+				if (gone === false) {
+					await args.onDeleteFailed?.(child);
+					return false;
+				}
+				return true;
+			})) logger.debug(safeMsg`Deleted the rollback journal of nested stack ${displaySafe(child)}`);
 		} catch (error) {
 			warnUncleared(logger, child, error);
 		}
 	}
 }
+async function readOwnRecord(stateBackend, child, region) {
+	try {
+		const data = await stateBackend.getState(child, region);
+		if (data && isPlainRecord(data.state) && isPlainRecord(data.state.resources) && (data.state.stackName === void 0 || data.state.stackName === child)) return data.state;
+	} catch {}
+}
 async function dropSettledNestedJournals(args) {
 	const { stateBackend, parentStackName, region, runId, logger } = args;
 	const depth = args.depth ?? 0;
@@ -29856,6 +29941,306 @@ function makeSiblingClaimReader(params) {
 	};
 }
 
+//#endregion
+//#region src/deployment/rollback-executor/journaled-orphans.ts
+const NONE = {
+	segments: [],
+	count: 0
+};
+async function loadJournaledOrphans(stateBackend, stackName, region, rollbackOrphans, logger, options = {}) {
+	let segments;
+	try {
+		const journal = await stateBackend.loadRollbackJournal(stackName, region);
+		if (!journal) return NONE;
+		segments = journal.segments;
+	} catch (err) {
+		const detail = err instanceof Error ? err.message : String(err);
+		logger.warn(safeMsg`Could not read the stack's rollback journal (${displaySafe(detail)}); ` + safeMsg`no resource it records for a failed CREATE is deleted, and ${options.unreadableOutcome ?? "a destroy that proceeds removes the journal with the state"}.`);
+		return {
+			...NONE,
+			unreadable: true
+		};
+	}
+	const physicalIdOnly = (ops) => ops.filter((op) => op.changeType !== "CREATE");
+	const evidence = segments.map((segment) => options.deployRunId !== void 0 && segment.reason === "nested-pending-parent" && segment.runId === options.deployRunId ? {
+		...segment,
+		operations: physicalIdOnly(segment.operations)
+	} : segment);
+	const newer = options.newerOperations ?? [];
+	if (newer.length > 0) evidence.push({ operations: physicalIdOnly(newer) });
+	demoteSupersededOrphans(evidence, Array.isArray(rollbackOrphans) ? rollbackOrphans : []);
+	const deployLogicalIds = new Set(newer.map((op) => op.logicalId));
+	for (const segment of segments) if (options.deployRunId !== void 0 && segment.reason === "nested-pending-parent" && segment.runId === options.deployRunId) for (const op of segment.operations) deployLogicalIds.add(op.logicalId);
+	const out = [];
+	let count = 0;
+	for (let s = segments.length - 1; s >= 0; s--) {
+		const segment = segments[s];
+		if (segment.reason === "nested-pending-parent") continue;
+		const ops = splitImportedOps(segment.failedOperations ?? [], segment).replay.filter(isJournaledOrphan);
+		if (ops.length === 0) continue;
+		out.push({
+			segment,
+			ops
+		});
+		count += ops.length;
+	}
+	return {
+		segments: out,
+		count,
+		deployLogicalIds
+	};
+}
+function journaledOrphanLines(orphans, logger) {
+	return orphans.segments.flatMap(({ ops }) => ops.map((op) => `  - ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)})  ${displacedPhysicalIdShown(op, logger) ?? "a physical id"}`));
+}
+async function deleteJournaledOrphans(orphans, stateResources, stackName, ctx, options = {}) {
+	const total = {
+		failures: 0,
+		warnings: 0,
+		interrupted: false,
+		handled: []
+	};
+	const inlinePolicyWriters = new RollbackInlinePolicyWriters();
+	for (const { segment, ops } of orphans.segments) {
+		if (options.isInterrupted?.()) {
+			total.interrupted = true;
+			break;
+		}
+		const replay = () => withStackName(stackName, () => replayFailedOperations(ops, stateResources, stackName, ctx, {
+			emitEnvelope: false,
+			inlinePolicyWriters,
+			...options.isInterrupted && { isInterrupted: options.isInterrupted }
+		}));
+		const result = segment.skipPrefix === void 0 ? await replay() : await withSkipPrefix(segment.skipPrefix, replay);
+		total.failures += result.failures;
+		total.warnings += result.warnings;
+		const pending = new Set(result.remainingFailedOps);
+		for (const op of ops) if (!pending.has(op)) total.handled.push({
+			segment,
+			op
+		});
+		if (result.interrupted) {
+			total.interrupted = true;
+			break;
+		}
+	}
+	return total;
+}
+async function settleJournaledOrphansOnSuccess(args) {
+	const { stateBackend, stackName, region, stateResources, newerOperations, ctx, logger } = args;
+	const stack = displayIdent(stackName);
+	const newerIds = newerOperations.map((op) => op.logicalId);
+	let orphans;
+	try {
+		orphans = await loadJournaledOrphans(stateBackend, stackName, region, args.rollbackOrphans, logger, {
+			newerOperations,
+			...args.deployRunId !== void 0 && { deployRunId: args.deployRunId },
+			unreadableOutcome: "the successful deploy removes the journal"
+		});
+	} catch (err) {
+		logger.warn(safeMsg`Could not act on the rollback journal of stack ${stack}: ${errorDetail(err)}. It is kept.`);
+		await markSuperseded(stateBackend, stackName, region, newerIds);
+		return {
+			unaddressed: 1,
+			keepJournal: true
+		};
+	}
+	if (orphans.count === 0) return {
+		unaddressed: 0,
+		keepJournal: false
+	};
+	const all = orphans.segments.flatMap(({ segment, ops }) => ops.map((op) => ({
+		segment,
+		op
+	})));
+	let kept = all;
+	if (stateResources === void 0) logger.warn(safeMsg`The rollback journal of stack ${stack} records ${all.length} resource(s) a failed deploy ` + `created, but the stack's state cannot be read, so whether a record now owns them is unknown: none is deleted.`);
+	else {
+		logger.info(safeMsg`The rollback journal of stack ${stack} records ${all.length} resource(s) a failed deploy ` + `created that no state record holds; acting on them per their DeletionPolicy before the journal is removed:`);
+		for (const line of journaledOrphanLines(orphans, logger)) logger.info(line);
+		try {
+			const { unreadable, tracked } = await applySuccessRule(orphans, stateResources, orphans.deployLogicalIds ?? /* @__PURE__ */ new Set(), args.foreignHolder, stack, logger, args.isInterrupted);
+			const outcome = await deleteJournaledOrphans({
+				segments: orphans.segments.map(({ segment, ops }) => ({
+					segment,
+					ops: ops.filter((op) => !unreadable.has(op) && !tracked.has(op))
+				})).filter(({ ops }) => ops.length > 0),
+				count: orphans.count - unreadable.size - tracked.size
+			}, { ...stateResources }, stackName, ctx, args.isInterrupted ? { isInterrupted: args.isInterrupted } : {});
+			kept = all.filter(({ segment, op }) => unreadable.has(op) || !tracked.has(op) && !isHandledOrphan(outcome.handled, segment, op));
+		} catch (err) {
+			logger.warn(safeMsg`Acting on the journaled resources of stack ${stack} failed: ${errorDetail(err)}`);
+		}
+	}
+	const keptOps = new Set(kept.map(({ op }) => op));
+	const skipped = all.filter(({ op }) => !keptOps.has(op) && op.physicalIdRecoveredFromError === false).length;
+	const cleared = all.filter(({ op }) => !keptOps.has(op));
+	const stripCleared = cleared.length === 0 ? void 0 : async () => {
+		try {
+			await stateBackend.dropRollbackJournalFailedOperations(stackName, region, (op, segment) => isHandledOrphan(cleared, segment, op));
+		} catch (err) {
+			logger.warn(safeMsg`Failed to remove the settled entries from the rollback journal of stack ${stack}: ` + safeMsg`${errorDetail(err)}. A cdkd rollback or cdkd destroy could act on them again; run a ` + "successful cdkd deploy of the stack first, which settles them again.");
+		}
+	};
+	if (kept.length === 0) return {
+		unaddressed: skipped,
+		keepJournal: false,
+		...stripCleared && { stripCleared }
+	};
+	const keptIds = new Set(kept.map(({ op }) => op.logicalId));
+	const supersededIds = newerIds.filter((id) => !keptIds.has(id));
+	const demoted = kept.filter(({ op }) => op.physicalIdRecoveredFromError === false);
+	const reduce = () => stateBackend.reduceRollbackJournalToFailedOperations(stackName, region, (op, segment) => isHandledOrphan(kept, segment, op), supersededIds, (op, segment) => isHandledOrphan(demoted, segment, op));
+	let reduced = false;
+	for (let attempt = 0; attempt < 2 && !reduced; attempt++) try {
+		await reduce();
+		reduced = true;
+	} catch (err) {
+		if (attempt === 1) logger.warn(safeMsg`Failed to reduce the rollback journal of stack ${stack} to its undeleted resources: ` + safeMsg`${errorDetail(err)}. The whole journal is kept.`);
+	}
+	if (!reduced) {
+		await markSuperseded(stateBackend, stackName, region, supersededIds);
+		await stripCleared?.();
+	}
+	logger.warn(safeMsg`${kept.length} resource(s) a failed deploy of stack ${stack} created were not deleted ` + (reduced ? "(see above). The rollback journal, their only record, is kept with just them; the next " : "(see above). The rollback journal, their only record, is kept; the next ") + "successful deploy retries.");
+	return {
+		unaddressed: kept.length + skipped,
+		keepJournal: true
+	};
+}
+async function applySuccessRule(orphans, stateResources, deployLogicalIds, foreignHolder, stack, logger, isInterrupted) {
+	const unreadable = /* @__PURE__ */ new Set();
+	const tracked = /* @__PURE__ */ new Set();
+	let interrupted = false;
+	for (const { ops } of orphans.segments) for (const op of ops) {
+		if (op.physicalIdRecoveredFromError !== true || !op.physicalId) continue;
+		if (interrupted || isInterrupted?.()) {
+			interrupted = true;
+			unreadable.add(op);
+			continue;
+		}
+		if (Object.values(stateResources).some((r) => r?.resourceType === op.resourceType && r.physicalId === op.physicalId)) {
+			tracked.add(op);
+			continue;
+		}
+		if (Object.prototype.hasOwnProperty.call(stateResources, op.logicalId) || deployLogicalIds.has(op.logicalId)) {
+			op.physicalIdRecoveredFromError = false;
+			continue;
+		}
+		const holding = await foreignHolder(op.resourceType, op.physicalId);
+		if (holding === void 0) continue;
+		if (holding.kind === "held") {
+			logger.warn(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is not deleted: ${holding.by} holds a resource of that type under ` + "the same physical id.");
+			op.physicalIdRecoveredFromError = false;
+			continue;
+		}
+		logger.warn(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is not deleted: ${holding.what}, so whether another stack holds it is unknown.`);
+		unreadable.add(op);
+	}
+	return {
+		unreadable,
+		tracked
+	};
+}
+function makeForeignHolderScan(stateBackend) {
+	let scan;
+	const key = (type, id) => JSON.stringify([type, id]);
+	const run = async () => {
+		const holders = /* @__PURE__ */ new Map();
+		let refs;
+		try {
+			refs = await stateBackend.listStacks();
+		} catch {
+			return {
+				holders,
+				unreadable: "the state bucket listing (it could not be read)"
+			};
+		}
+		let unreadable;
+		await Promise.all(refs.map(async (ref) => {
+			const named = (why) => safeMsg`the state record of stack ${displayIdent(ref.stackName)} (${why})`;
+			if (ref.region === void 0) {
+				unreadable ??= named("its region cannot be read");
+				return;
+			}
+			const region = ref.region;
+			let state;
+			try {
+				state = (await stateBackend.getState(ref.stackName, region))?.state;
+			} catch {
+				unreadable ??= named("it could not be read");
+				return;
+			}
+			if (state === void 0) return;
+			const resources = state.resources;
+			if (resources !== void 0 && (typeof resources !== "object" || resources === null || Array.isArray(resources))) {
+				unreadable ??= named("its resources cannot be read");
+				return;
+			}
+			if (!hasReadableOrphans(state) || unreadableOrphanRecords(state).length > 0) {
+				unreadable ??= named("its rollback-orphan records cannot be read");
+				return;
+			}
+			const held = [...Object.values(resources ?? {}), ...(state.orphans ?? []).map((record) => record.state)];
+			for (const record of held) {
+				const r = record;
+				if (typeof r?.resourceType !== "string" || typeof r.physicalId !== "string") continue;
+				const k = key(r.resourceType, r.physicalId);
+				const list = holders.get(k) ?? [];
+				list.push({
+					stackName: ref.stackName,
+					region
+				});
+				holders.set(k, list);
+			}
+		}));
+		return {
+			holders,
+			...unreadable !== void 0 && { unreadable }
+		};
+	};
+	return (self) => async (resourceType, physicalId) => {
+		scan ??= run();
+		const { holders, unreadable } = await scan;
+		const other = (holders.get(key(resourceType, physicalId)) ?? []).find((h) => !(h.stackName === self.stackName && h.region === self.region));
+		if (other) return {
+			kind: "held",
+			by: safeMsg`the state record of stack ${displayIdent(other.stackName)} (${displaySafe(other.region)})`
+		};
+		return unreadable === void 0 ? void 0 : {
+			kind: "unreadable",
+			what: unreadable
+		};
+	};
+}
+async function markSuperseded(stateBackend, stackName, region, ids) {
+	try {
+		await stateBackend.markRollbackJournalSuperseded(stackName, region, ids);
+	} catch {}
+}
+function errorDetail(err) {
+	return displaySafe(err instanceof Error ? err.message : String(err));
+}
+function isHandledOrphan(handled, segment, op) {
+	return handled.some((h) => h.segment.timestamp === segment.timestamp && h.segment.runId === segment.runId && h.op.logicalId === op.logicalId && h.op.changeType === op.changeType && h.op.resourceType === op.resourceType && h.op.physicalId === op.physicalId);
+}
+function orphanKey(segment, op) {
+	return JSON.stringify([
+		segment.timestamp,
+		segment.runId ?? null,
+		op.logicalId,
+		op.changeType,
+		op.resourceType,
+		op.physicalId ?? null
+	]);
+}
+function sameJournaledOrphans(a, b) {
+	const keys = (o) => o.segments.flatMap(({ segment, ops }) => ops.map((op) => orphanKey(segment, op))).sort();
+	const ka = keys(a);
+	const kb = keys(b);
+	return ka.length === kb.length && ka.every((k, i) => k === kb[i]);
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/rollback.ts
 function redactOperationsForJournal(operations) {
@@ -29904,33 +30289,109 @@ async function adoptRollbackOrphans(currentState, effectiveTemplate) {
 	if (records.length > 0) currentState.orphans = plan.remaining;
 	return plan;
 }
-async function performRollback(completedOperations, stateResources, stackName, previousState) {
+async function performRollback(completedOperations, stateResources, stackName, previousState, failedOperations = [], priorOrphans = []) {
+	const orphanIndexes = [];
+	const orphanOps = [];
+	failedOperations.forEach((op, i) => {
+		if (!isJournaledOrphan(op)) return;
+		orphanIndexes.push(i);
+		orphanOps.push({ ...op });
+	});
+	demoteSupersededOrphans([{
+		operations: completedOperations,
+		failedOperations: orphanOps
+	}], priorOrphans);
+	const ctx = this.rollbackExecutorContext(previousState, stackName);
+	const inlinePolicyWriters = new RollbackInlinePolicyWriters();
 	const runId = this.options.eventRecorder?.runId;
-	const { result, run } = await withNestedRevertRun(runId, async (scope) => ({
-		result: await replayRollback(completedOperations, stateResources, stackName, this.rollbackExecutorContext(previousState, stackName)),
-		run: scope
-	}));
+	const { result, failed, run } = await withNestedRevertRun(runId, async (scope) => {
+		return {
+			failed: orphanOps.length > 0 ? await replayFailedOperations(orphanOps, stateResources, stackName, ctx, {
+				emitEnvelope: completedOperations.length === 0,
+				inlinePolicyWriters
+			}) : void 0,
+			result: await replayRollback(completedOperations, stateResources, stackName, ctx, { inlinePolicyWriters }),
+			run: scope
+		};
+	});
+	const pendingOrphans = new Set(failed?.remainingFailedOps ?? []);
+	const handled = new Set(orphanIndexes.filter((_, k) => !pendingOrphans.has(orphanOps[k])));
 	return {
-		failures: result.failures,
-		warnings: result.warnings + run.warnings,
-		skipped: result.skipped,
-		orphaned: result.orphaned,
-		settledNested: run.settled
+		failures: result.failures + (failed?.failures ?? 0),
+		warnings: result.warnings + run.warnings + (failed?.warnings ?? 0),
+		skipped: result.skipped + (failed?.skipped ?? 0),
+		orphaned: [...failed?.orphaned ?? [], ...result.orphaned],
+		settledNested: run.settled,
+		remainingFailedOps: failedOperations.filter((_, i) => !handled.has(i))
 	};
 }
 async function settleJournalAfterSuccess(stackName, completedOperations, previousState, finalResources, initialDeploy) {
 	if (this.options.parentStackInfo) {
 		await this.writeRollbackJournalSegment(stackName, completedOperations, [], NESTED_PENDING_PARENT_REASON, initialDeploy, nestedPendingSnapshot(previousState));
-		return;
-	}
-	await Promise.all([this.deleteRollbackJournalBestEffort(stackName, completedOperations.map((op) => op.logicalId)), dropNestedChildJournals({
+		return 0;
+	}
+	let nestedLeft = 0;
+	const foreignHolderFor = makeForeignHolderScan(this.stateBackend);
+	const deployRunId = this.options.eventRecorder?.runId;
+	const stripOnFailure = /* @__PURE__ */ new Map();
+	const [ownLeft] = await Promise.all([(async () => {
+		const own = await settleJournaledOrphansOnSuccess({
+			stateBackend: this.stateBackend,
+			stackName,
+			region: this.stackRegion,
+			stateResources: finalResources,
+			rollbackOrphans: previousState.orphans,
+			newerOperations: completedOperations,
+			...deployRunId !== void 0 && { deployRunId },
+			foreignHolder: foreignHolderFor({
+				stackName,
+				region: this.stackRegion
+			}),
+			ctx: this.rollbackExecutorContext(previousState, stackName),
+			isInterrupted: () => this.interrupted,
+			logger: this.logger
+		});
+		if (own.keepJournal) return own.unaddressed;
+		if (!await this.deleteRollbackJournalBestEffort(stackName, completedOperations.map((op) => op.logicalId))) await own.stripCleared?.();
+		return own.unaddressed;
+	})(), dropNestedChildJournals({
 		stateBackend: this.stateBackend,
 		lockManager: this.lockManager,
 		parentStackName: stackName,
 		region: this.stackRegion,
 		resources: finalResources,
-		logger: this.logger
+		logger: this.logger,
+		beforeDelete: async (child, childRecord) => {
+			const childState = childRecord !== void 0 && hasReadableOrphans(childRecord) ? childRecord : void 0;
+			const settled = await settleJournaledOrphansOnSuccess({
+				stateBackend: this.stateBackend,
+				stackName: child,
+				region: this.stackRegion,
+				stateResources: childState?.resources,
+				rollbackOrphans: childState?.orphans,
+				newerOperations: [],
+				...deployRunId !== void 0 && { deployRunId },
+				foreignHolder: foreignHolderFor({
+					stackName: child,
+					region: this.stackRegion
+				}),
+				isInterrupted: () => this.interrupted,
+				ctx: {
+					...this.rollbackExecutorContext(childState ?? previousState, child),
+					producerRegionsIncomplete: true,
+					nestedChildStack: child
+				},
+				logger: this.logger
+			});
+			nestedLeft += settled.unaddressed;
+			if (settled.stripCleared) stripOnFailure.set(child, settled.stripCleared);
+			return !settled.keepJournal;
+		},
+		onDeleteFailed: async (child) => {
+			await stripOnFailure.get(child)?.();
+		}
 	})]);
+	return ownLeft + nestedLeft;
 }
 async function deleteRollbackJournalBestEffort(stackName, supersededLogicalIds = []) {
 	let deleted;
@@ -29940,12 +30401,14 @@ async function deleteRollbackJournalBestEffort(stackName, supersededLogicalIds =
 		this.logger.debug(safeMsg`Failed to delete rollback journal for ${stackName}: ${err instanceof Error ? err.message : String(err)}`);
 		deleted = false;
 	}
-	if (deleted !== false || supersededLogicalIds.length === 0) return;
+	if (deleted !== false) return true;
+	if (supersededLogicalIds.length === 0) return false;
 	try {
 		await this.stateBackend.markRollbackJournalSuperseded(stackName, this.stackRegion, supersededLogicalIds);
 	} catch (markErr) {
 		this.logger.debug(safeMsg`Failed to record superseded logical ids on the rollback journal for ${stackName}: ${markErr instanceof Error ? markErr.message : String(markErr)}`);
 	}
+	return false;
 }
 async function settleJournalAfterCleanRollback(stackName, failedOperations, initialDeploy) {
 	if (failedOperations.length === 0) {
@@ -30623,7 +31086,88 @@ async function readReaderForFreshNoEchoCeiling(logicalId, currentResource, secre
 	}
 }
 function maskForResource(logicalId, text) {
-	return maskSecretsInText(text, this.perResourceSecrets.get(logicalId) ?? EMPTY_SECRETS);
+	return maskSecretsInText(text, this.printingSecretsFor(logicalId) ?? EMPTY_SECRETS);
+}
+function secretNameNeedlesOf(logicalId, record, secrets, options) {
+	const physicalId = typeof record?.physicalId === "string" && record.physicalId !== "" ? record.physicalId : void 0;
+	const bag = secrets !== void 0 && hasMaskableValues(secrets) ? secrets : void 0;
+	const mask = (text) => bag === void 0 ? text : maskSecretsInText(text, bag);
+	const unresolved = (value) => value.includes("{{resolve:") || value === "***";
+	const named = {
+		resourceType: record?.resourceType,
+		properties: record?.properties,
+		logicalId
+	};
+	const needles = /* @__PURE__ */ new Set();
+	const add = (needle) => {
+		if (typeof needle === "string" && needle !== "") needles.add(needle);
+	};
+	for (const [raw, derived] of secretDerivedNamePairs({
+		...named,
+		physicalIds: []
+	})) if (typeof raw === "string" && !unresolved(raw) && isSecretDerivedValue(raw, mask)) add(derived);
+	for (const [raw, spelling] of secretDerivedNamePairs({
+		...named,
+		physicalIds: [physicalId ?? "cdkd-no-physical-id-yet"]
+	})) {
+		if (!isSecretDerivedValue(raw, mask)) continue;
+		if (unresolved(raw)) {
+			if (physicalId === void 0) continue;
+			add(spelling);
+		} else {
+			add(raw);
+			if (raw.toLowerCase() !== raw && raw.length >= 4) add(raw.toLowerCase());
+		}
+	}
+	const properties = record?.properties;
+	const path = properties !== null && typeof properties === "object" && Object.hasOwn(properties, "Path") ? properties["Path"] : void 0;
+	if (physicalId !== void 0 && isSecretDerivedValue(path, mask)) add(physicalId);
+	const embedded = options === void 0 ? secrets : options.embedded;
+	const embeddedBag = embedded !== void 0 && hasMaskableValues(embedded) ? embedded : void 0;
+	if (embeddedBag !== void 0 && physicalId !== void 0) {
+		for (const needle of printingCorpusOf(embeddedBag).keys()) if (needle !== "" && (needle === physicalId || needle.length >= 4 && physicalId.includes(needle))) add(needle);
+	}
+	return needles.size > 0 ? needles : void 0;
+}
+function secretNameBagFor(logicalId) {
+	let bag = this.secretNameNeedles.get(logicalId);
+	if (bag === void 0) {
+		bag = /* @__PURE__ */ new Map();
+		this.secretNameNeedles.set(logicalId, bag);
+	}
+	return bag;
+}
+function noteSecretNamedRecord(logicalId, record) {
+	const needles = secretNameNeedlesOf(logicalId, record, this.namingSecretsFor(logicalId), { embedded: this.perResourceSecrets.get(logicalId) });
+	if (needles === void 0) return void 0;
+	const registry = this.secretNameBagFor(logicalId);
+	for (const needle of needles) recordLogOnlyValue(registry, needle);
+	return needles;
+}
+function namingSecretsFor(logicalId) {
+	const own = this.perResourceSecrets.get(logicalId);
+	const noEcho = this.fingerprintNoEchoValues;
+	if (!hasMaskableValues(noEcho)) return own;
+	return unionOfSecretBags([own, noEcho]);
+}
+function noteSecretNamedReads(logicalId, record, resources) {
+	const leaves = [...wholeStringLeavesOf(record?.properties)].filter((leaf) => leaf !== "");
+	if (leaves.length === 0) return;
+	for (const [otherId, other] of Object.entries(resources)) {
+		if (otherId === logicalId) continue;
+		const needles = secretNameNeedlesOf(otherId, other, this.namingSecretsFor(otherId), { embedded: this.perResourceSecrets.get(otherId) });
+		if (needles === void 0) continue;
+		const read = [...needles].filter((needle) => leaves.some((leaf) => leaf === needle || needle.length >= 4 && leaf.includes(needle)));
+		if (read.length === 0) continue;
+		const registry = this.secretNameBagFor(logicalId);
+		for (const needle of read) recordLogOnlyValue(registry, needle);
+	}
+}
+function printingSecretsFor(logicalId) {
+	const secrets = this.perResourceSecrets.get(logicalId);
+	const registry = this.secretNameNeedles.get(logicalId);
+	if (!hasMaskableValues(registry)) return secrets;
+	return unionOfSecretBags([secrets, registry]);
 }
 function maskedRecordRemedyFor(reads, resources, causeScoped = false) {
 	const NESTED_STACK_RESOURCE_TYPE = "AWS::CloudFormation::Stack";
@@ -31117,6 +31661,82 @@ function isRefusedBeforeApplying(error, logicalId) {
 	return false;
 }
 
+//#endregion
+//#region src/deployment/deploy-engine/resolver-context.ts
+function buildResolverContext(base, stackName) {
+	const recordedSecretValues = /* @__PURE__ */ new Map();
+	if (this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0) inheritNestedStackParameterAssociations(recordedSecretValues, this.options.inheritedSecrets);
+	return {
+		template: base.template,
+		resources: base.resources,
+		...base.parameters && Object.keys(base.parameters).length > 0 && { parameters: base.parameters },
+		...base.conditions && Object.keys(base.conditions).length > 0 && { conditions: base.conditions },
+		stateBackend: this.stateBackend,
+		stackName,
+		...this.exportIndexStore && { exportIndex: this.exportIndexStore },
+		recordedImports: this.recordedImports,
+		recordedOutputReads: this.recordedOutputReads,
+		attributeHealer: (logicalId, resource) => this.healStaleAttributes(logicalId, resource, stackName),
+		...this.options.inheritedSecrets && hasMaskableValues(this.options.inheritedSecrets) && { inheritedSecrets: this.options.inheritedSecrets },
+		recordedSecretValues,
+		noEchoAttributeResources: this.noEchoAttributeResources,
+		secretNameNeedles: (logicalId) => this.noteSecretNamedRecord(logicalId, Object.hasOwn(base.resources, logicalId) ? base.resources[logicalId] : void 0),
+		...base.redactedAttributeReads && { redactedAttributeReads: base.redactedAttributeReads }
+	};
+}
+function printNestedStackReadsOnly(context, resourceType) {
+	if (resourceType === "AWS::CloudFormation::Stack") context.printingSecrets = /* @__PURE__ */ new Map();
+}
+function getAttTargetOf(node) {
+	if (node === null || typeof node !== "object" || Array.isArray(node)) return void 0;
+	const getAtt = node["Fn::GetAtt"];
+	if (Array.isArray(getAtt) && typeof getAtt[0] === "string") return getAtt[0];
+	if (typeof getAtt === "string") return getAtt.split(".")[0];
+}
+function maskedInputSources(template, resources, conditions, stackName) {
+	const parameters = this.fingerprintParameters;
+	if (parameters === void 0) return void 0;
+	return {
+		template,
+		parameterInput: parameters.parameterInput,
+		conditions,
+		childTemplate: this.fingerprintChildTemplates,
+		resolve: async (node) => {
+			const { attributeHealer: _healer, ...base } = this.buildResolverContext({
+				template,
+				resources,
+				parameters: parameters.bound,
+				...conditions && { conditions }
+			}, stackName);
+			const context = {
+				...base,
+				recordedImports: [],
+				recordedOutputReads: [],
+				bestEffort: true,
+				skipDynamicReferences: true,
+				staleAttributeHeal: { phase: "probe" },
+				printingSecrets: /* @__PURE__ */ new Map()
+			};
+			const value = await this.resolver.resolve(structuredClone(node), context);
+			const secrets = context.recordedSecretValues;
+			const target = getAttTargetOf(node);
+			const targetSecrets = target === void 0 ? void 0 : this.perResourceSecrets.get(target);
+			if (targetSecrets !== void 0 && hasMaskableValues(targetSecrets)) {
+				const probe = { value };
+				const redacted = redactSecretsForState(probe, targetSecrets);
+				if (JSON.stringify(redacted) !== JSON.stringify(probe)) return {
+					value,
+					keepAsWritten: true
+				};
+			}
+			return {
+				value,
+				...secrets && { secrets }
+			};
+		}
+	};
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/create.ts
 async function provisionCreate(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
@@ -31131,7 +31751,12 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 		redactedAttributeReads: []
 	}, stackName);
 	if (context.recordedSecretValues) this.perResourceSecrets.set(logicalId, context.recordedSecretValues);
+	printNestedStackReadsOnly(context, resourceType);
 	const resolvedProps = await this.resolver.resolve(desiredProps, context);
+	this.noteSecretNamedRecord(logicalId, {
+		resourceType,
+		properties: resolvedProps
+	});
 	this.refuseRedactedAttributeReads(logicalId, resourceType, context);
 	this.perResourceTemplateProps.set(logicalId, desiredProps);
 	const fingerprintSources = template && this.maskedInputSources(template, stateResources, conditions, stackName);
@@ -31737,6 +32362,7 @@ var DynamoDBGlobalTableProvider = class {
 			};
 		} catch (wiringError) {
 			warn(`Wiring failed after CreateTable for ${tableName}; attempting best-effort cleanup`);
+			let tableLeftBehind = false;
 			try {
 				const replicasForCleanup = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.Replicas ?? [];
 				for (const replica of replicasForCleanup) {
@@ -31755,12 +32381,15 @@ var DynamoDBGlobalTableProvider = class {
 				}
 				await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: tableName }));
 			} catch (cleanupErr) {
+				tableLeftBehind = true;
 				const cleanupMsg = describeAwsFailure(cleanupErr).detail;
 				warn(`Partial-create cleanup failed for ${tableName}: ${cleanupMsg}. To remove the orphaned AWS-side table, run: ` + pasteableAwsCommand(maskSecrets)`aws dynamodb delete-table --table-name ${tableName}`.render());
 			}
 			markAuxiliaryFailure(wiringError, logicalId);
 			const cause = wiringError instanceof Error ? wiringError : void 0;
-			throw this.wrapMaskedError(log, wiringError, (text) => new ProvisioningError(`Failed to create DynamoDB GlobalTable ${logicalId}: ${text}`, resourceType, logicalId, tableName, cause));
+			const thrown = this.wrapMaskedError(log, wiringError, (text) => new ProvisioningError(`Failed to create DynamoDB GlobalTable ${logicalId}: ${text}`, resourceType, logicalId, tableName, cause));
+			if (tableLeftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, tableName);
+			throw thrown;
 		}
 	}
 	reportThroughputDiagnostics(diagnostics, logicalId, physicalId, maskSecrets = (text) => text) {
@@ -34019,7 +34648,13 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	}, stackName);
 	const updateSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
 	this.perResourceSecrets.set(logicalId, updateSecrets);
+	printNestedStackReadsOnly(context, resourceType);
 	const resolvedProps = await this.resolver.resolve(desiredProps, context);
+	this.noteSecretNamedRecord(logicalId, {
+		resourceType,
+		physicalId: stateResources[logicalId]?.physicalId,
+		properties: resolvedProps
+	});
 	this.perResourceTemplateProps.set(logicalId, desiredProps);
 	this.perResourceResolvedType.set(logicalId, resourceType);
 	recordNestedStackParameterExpressions(updateSecrets, resourceType, resolvedProps, desiredProps);
@@ -34645,7 +35280,14 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 			captureProvider = replProvider;
 		} else throw updateError;
 	}
-	if (result.wasReplaced) this.logger.info(`Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`);
+	if (result.wasReplaced) {
+		this.noteSecretNamedRecord(logicalId, {
+			resourceType,
+			physicalId: result.physicalId,
+			properties: resolvedProps
+		});
+		this.logger.info(`Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`);
+	}
 	const dischargedByReplacement = result.wasReplaced === true && result.physicalId !== currentResource.physicalId;
 	const keepsParameterRefusal = !dischargedByReplacement && hasUnverifiableParameterRefusal(currentResource);
 	const carriedAttributes = result.attributes ?? (result.wasReplaced ? void 0 : currentResource.attributes);
@@ -34741,21 +35383,32 @@ async function provisionDelete(logicalId, change, stateResources, stackName, tem
 		const skipPrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
 		renderer.removeTask(logicalId);
 		this.logger.info(`${skipPrefix}${formatResourceLine("skipped", logicalId, resourceType, `skipped (${deleteSkipped})`)}`);
-		this.logger.warn(deleteSkippedMessage(logicalId, currentResource.physicalId, deleteSkipped, "while removing it from the template") + `. Its cdkd state record was KEPT, so the next 'cdkd deploy' re-attempts the delete. Repair the record first (for a nested stack it is the CHILD's own state, whose other resources may already be gone), or delete the resource by hand and drop the record.\nInspect it with: ${pasteableCommand("cdkd state show", [{
-			value: stackName,
-			hole: "stack"
-		}, {
-			flag: "--stack-region",
-			value: this.stackRegion,
-			hole: "region"
-		}]).command}\nDrop the record with: ${pasteableCommand("cdkd state orphan", [{
-			value: stackName,
-			hole: "stack"
-		}, {
+		const nested = resourceType === "AWS::CloudFormation::Stack";
+		const recordStack = nested ? nestedChildStackName(stackName, logicalId) : stackName;
+		const interrupted = nested && deleteSkipped.endsWith(" was interrupted");
+		const stackArg = {
+			value: recordStack,
+			hole: nested ? "child-stack" : "stack",
+			opts: { plainIdent: true }
+		};
+		this.logger.warn(deleteSkippedMessage(logicalId, currentResource.physicalId, deleteSkipped, "while removing it from the template") + ". Its cdkd state record was KEPT, so the next 'cdkd deploy' re-attempts the delete. Repair the record first (for a nested stack it is the CHILD's own state, whose other resources may already be gone), or delete the resource by hand and drop the record." + (interrupted ? " The commands name the child stack record. Its destroy was interrupted: re-run 'cdkd deploy' to resume it, and drop the child record only if that cannot finish, after deleting by hand what the child still holds (the inspect command with --show-nested lists every level; a child with nested stacks of its own has records under '<child>~<logicalId>' too, each needing the same drop)." : nested ? " The commands name the child stack record. Dropping it drops every record the child still has and nothing reaches those resources again, so first delete by hand what the child still holds (the inspect command with --show-nested lists every level; a child with nested stacks of its own has records under '<child>~<logicalId>' too, each needing the same drop). The next 'cdkd deploy' then removes this row." : " Keep '--resource' on the drop: without it the command drops the record of every resource in this still-deployed stack.") + `\nInspect it with: ${pasteableCommand("cdkd state show", [stackArg, {
 			flag: "--stack-region",
 			value: this.stackRegion,
 			hole: "region"
-		}]).command}`);
+		}]).command}\nDrop the record with: ${pasteableCommand("cdkd state orphan", [
+			stackArg,
+			{
+				flag: "--stack-region",
+				value: this.stackRegion,
+				hole: "region"
+			},
+			...nested ? [] : [{
+				flag: "--resource",
+				value: logicalId,
+				hole: "logicalId",
+				opts: { plainIdent: true }
+			}]
+		]).command}`);
 		if (counts) counts.deleteSkipped++;
 		return { deleteSkipped };
 	}
@@ -34782,31 +35435,61 @@ function validateOptions(opts) {
 }
 async function withResourceDeadline(operation, opts) {
 	validateOptions(opts);
-	const startedAt = Date.now();
 	return new Promise((resolve, reject) => {
 		let settled = false;
+		let timedOut = false;
+		let warned = false;
 		let warnTimer;
 		let timeoutTimer;
+		let elapsedBeforePause = 0;
+		let runningSince = Date.now();
+		let pauses = 0;
+		const elapsed = () => elapsedBeforePause + (pauses > 0 ? 0 : Date.now() - runningSince);
 		const cleanup = () => {
 			if (warnTimer !== void 0) clearTimeout(warnTimer);
 			if (timeoutTimer !== void 0) clearTimeout(timeoutTimer);
 			warnTimer = void 0;
 			timeoutTimer = void 0;
 		};
-		if (opts.onWarn) warnTimer = setTimeout(() => {
-			if (settled) return;
-			try {
-				opts.onWarn(Date.now() - startedAt);
-			} catch {}
-		}, opts.warnAfterMs);
-		timeoutTimer = setTimeout(() => {
-			if (settled) return;
-			settled = true;
-			cleanup();
-			const elapsed = Date.now() - startedAt;
-			reject(opts.onTimeout(elapsed));
-		}, opts.timeoutMs);
-		Promise.resolve().then(() => operation()).then((value) => {
+		const arm = () => {
+			if (opts.onWarn && !warned) warnTimer = setTimeout(() => {
+				if (settled) return;
+				warned = true;
+				try {
+					opts.onWarn(elapsed());
+				} catch {}
+			}, Math.max(0, opts.warnAfterMs - elapsed()));
+			timeoutTimer = setTimeout(() => {
+				if (settled) return;
+				settled = true;
+				timedOut = true;
+				cleanup();
+				reject(opts.onTimeout(elapsed()));
+			}, Math.max(0, opts.timeoutMs - elapsed()));
+		};
+		arm();
+		const outer = deadlineScope.getStore();
+		const control = {
+			pause: () => {
+				pauses += 1;
+				if (pauses === 1) {
+					elapsedBeforePause += Date.now() - runningSince;
+					cleanup();
+				}
+				outer?.pause();
+			},
+			resume: () => {
+				if (pauses === 0) return;
+				pauses -= 1;
+				if (pauses === 0) {
+					runningSince = Date.now();
+					if (!settled) arm();
+				}
+				outer?.resume();
+			},
+			expired: () => timedOut || (outer?.expired() ?? false)
+		};
+		Promise.resolve().then(() => deadlineScope.run(control, operation)).then((value) => {
 			if (settled) return;
 			settled = true;
 			cleanup();
@@ -34819,6 +35502,20 @@ async function withResourceDeadline(operation, opts) {
 		});
 	});
 }
+const deadlineScope = new AsyncLocalStorage();
+async function whileEnclosingDeadlinesPaused(fn) {
+	const control = deadlineScope.getStore();
+	if (control === void 0) return fn();
+	control.pause();
+	try {
+		return await fn();
+	} finally {
+		control.resume();
+	}
+}
+function enclosingDeadlineExpired() {
+	return deadlineScope.getStore()?.expired() ?? false;
+}
 
 //#endregion
 //#region src/deployment/deploy-engine/provision.ts
@@ -34856,10 +35553,13 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 	let updatePartial;
 	const physicalIdBeforeUpdate = stateResources[logicalId]?.physicalId;
 	const provisionedByBeforeUpdate = stateResources[logicalId]?.provisionedBy;
+	this.noteSecretNamedRecord(logicalId, stateResources[logicalId]);
+	if (change.changeType === "DELETE") this.noteSecretNamedReads(logicalId, stateResources[logicalId], stateResources);
+	const printingRegistry = this.secretNameBagFor(logicalId);
 	let nestedChildUnaddressed;
 	const deleteGuards = [];
 	try {
-		await withResourceDeadline(async () => {
+		await withPrintingSecrets(printingRegistry, () => withResourceDeadline(async () => {
 			try {
 				const { value: bodyResult, unaddressed } = await collectDeleteGuards(deleteGuards, () => collectNestedChildUnaddressed(() => this.provisionResourceBody(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress)));
 				deleteSkipped = bodyResult?.deleteSkipped;
@@ -34873,7 +35573,7 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 					logicalId,
 					resourceType: guard.resourceType,
 					...guard.provisionedBy && { provisionedBy: guard.provisionedBy },
-					...guard.physicalId && { physicalId: this.maskForResource(logicalId, guard.physicalId) },
+					...guard.physicalId && { physicalId: maskSecretsInText(guard.physicalId, this.perResourceSecrets.get(logicalId) ?? EMPTY_SECRETS) },
 					guard: guard.guard,
 					reason: guard.reason
 				});
@@ -34892,7 +35592,7 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 				});
 			},
 			onTimeout: (elapsedMs) => new ResourceTimeoutError(logicalId, resourceType, this.stackRegion, elapsedMs, operationKind, timeoutMs)
-		});
+		}));
 		if (counts && nestedChildUnaddressed) {
 			counts.deleteSkipped += nestedChildUnaddressed.deleteSkipped;
 			counts.updatePartial += nestedChildUnaddressed.updatePartial;
@@ -34949,7 +35649,7 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 			durationMs: Date.now() - resourceStartedAt,
 			error: extractDeploymentEventError(error)
 		});
-		throw new ProvisioningError(`Failed to ${change.changeType.toLowerCase()} resource ${logicalId}`, resourceType, logicalId, stateResources[logicalId]?.physicalId, error instanceof Error ? maskSecretsInError(error, this.perResourceSecrets.get(logicalId) ?? EMPTY_SECRETS) : void 0);
+		throw new ProvisioningError(`Failed to ${change.changeType.toLowerCase()} resource ${logicalId}`, resourceType, logicalId, stateResources[logicalId]?.physicalId, error instanceof Error ? maskSecretsInError(error, this.printingSecretsFor(logicalId) ?? EMPTY_SECRETS) : void 0);
 	} finally {
 		renderer.removeTask(logicalId);
 	}
@@ -35381,6 +36081,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 		let autoRollbackJournaled = false;
 		let rollbackOrphans = [];
 		let rollbackSettledNested = /* @__PURE__ */ new Map();
+		let rollbackRemainingFailedOps = failedOperations;
 		if (error instanceof InterruptedError || isInterruptedWaitError(error) || this.interruptCause === "user") {
 			await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "interrupted", initialDeploy);
 			this.logger.info(`Partial state saved (${Object.keys(newResources).length} resources). Run deploy again to resume, 'cdkd rollback' to revert, or destroy to clean up.`);
@@ -35392,7 +36093,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			this.logger.warn(safeMsg`Partial state has been saved. ${this.recoveryHint("Run 'cdkd deploy' to resume, 'cdkd rollback' to revert, or destroy to clean up.")}`);
 		} else {
 			autoRollbackJournaled = await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "auto-rollback-started", initialDeploy);
-			const rollbackResult = await this.performRollback(completedOperations, newResources, stackName, currentState);
+			const rollbackResult = await this.performRollback(completedOperations, newResources, stackName, currentState, failedOperations, currentState.orphans ?? []);
 			autoRollbackClean = autoRollbackJournaled && rollbackResult.failures === 0 && rollbackResult.skipped === 0;
 			if (rollbackResult.failures === 0 && rollbackResult.skipped > 0) {
 				this.logger.warn(safeMsg`The automatic rollback could not revert ${rollbackResult.skipped} operation(s) ` + `(see the warnings above; each is recorded as a ROLLBACK_RESOURCE_SKIPPED event).` + (autoRollbackJournaled ? ` The rollback journal keeps them.` : ""));
@@ -35403,6 +36104,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			}
 			rollbackOrphans = rollbackResult.orphaned;
 			rollbackSettledNested = rollbackResult.settledNested;
+			rollbackRemainingFailedOps = rollbackResult.remainingFailedOps;
 		}
 		try {
 			const postRollbackState = {
@@ -35419,7 +36121,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			};
 			await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(postRollbackState), { ...currentEtag !== void 0 && { expectedEtag: currentEtag } });
 			this.logger.debug("State saved after deployment failure");
-			if (autoRollbackClean) await this.settleNestedChildrenAfterCleanRollback(stackName, rollbackSettledNested, await this.settleJournalAfterCleanRollback(stackName, failedOperations, initialDeploy));
+			if (autoRollbackClean) await this.settleNestedChildrenAfterCleanRollback(stackName, rollbackSettledNested, await this.settleJournalAfterCleanRollback(stackName, rollbackRemainingFailedOps, initialDeploy));
 		} catch (saveError) {
 			this.logger.debug(`Retrying state save after rollback (ETag mismatch): ${saveError instanceof Error ? saveError.message : String(saveError)}`);
 			try {
@@ -35438,7 +36140,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 				};
 				await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(postRollbackState), { ...freshEtag !== void 0 && { expectedEtag: freshEtag } });
 				this.logger.debug("State saved after deployment failure (retry succeeded)");
-				if (autoRollbackClean) await this.settleNestedChildrenAfterCleanRollback(stackName, rollbackSettledNested, await this.settleJournalAfterCleanRollback(stackName, failedOperations, initialDeploy));
+				if (autoRollbackClean) await this.settleNestedChildrenAfterCleanRollback(stackName, rollbackSettledNested, await this.settleJournalAfterCleanRollback(stackName, rollbackRemainingFailedOps, initialDeploy));
 			} catch (retryError) {
 				this.logger.warn(`Failed to save state after rollback: ${retryError instanceof Error ? retryError.message : String(retryError)}`);
 			}
@@ -35610,6 +36312,62 @@ function refuseNoValueOutputs(outputs, conditions) {
 	throw markNonRetryable(/* @__PURE__ */ new Error(`Output ${offending.join(", ")} evaluates to AWS::NoValue, and CloudFormation rejects the template for it ("The Value field of every Outputs member must evaluate to a String") before creating anything. To publish an Output only sometimes, give it a Condition instead of selecting AWS::NoValue in its Value.`));
 }
 
+//#endregion
+//#region src/deployment/deployment-approval.ts
+const NESTED_STACK_TYPE$1 = "AWS::CloudFormation::Stack";
+async function requireDeploymentApproval(args) {
+	const level = args.options.requireApproval ?? "never";
+	const approve = args.options.approveDeployment;
+	if (level === "never" || approve === void 0) return;
+	const changes = [...args.changes].filter((c) => c.changeType !== "NO_CHANGE");
+	const destructiveChanges = findDestructiveChanges(args.stackName, changes, args.records, args.template, new Set(args.recreateTargetIds ?? []));
+	const onlyNestedUpdates = changes.every((c) => c.changeType === "UPDATE" && c.resourceType === NESTED_STACK_TYPE$1);
+	if (!(level === "destructive" ? destructiveChanges.length > 0 : changes.length > 0 && !onlyNestedUpdates)) return;
+	const count = (type) => changes.filter((c) => c.changeType === type).length;
+	if (enclosingDeadlineExpired()) throw approvalAfterTimeout(args.stackName);
+	let approved;
+	try {
+		approved = await whileEnclosingDeadlinesPaused(() => approve({
+			stackName: args.stackName,
+			level,
+			counts: {
+				create: count("CREATE"),
+				update: count("UPDATE"),
+				delete: count("DELETE")
+			},
+			destructiveChanges
+		}));
+	} catch (error) {
+		throw error instanceof Error ? markNonRetryable(error) : error;
+	}
+	if (!approved) throw markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${args.stackName} was not approved (--require-approval=${level}). Nothing was changed.`, "DEPLOY_NOT_APPROVED"));
+}
+function approvalAfterTimeout(stackName) {
+	return markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${stackName} was not started: its parent's nested-stack row already timed out (--resource-timeout). Nothing was changed.`, "DEPLOY_APPROVAL_AFTER_TIMEOUT"));
+}
+async function requireOutputsOnlyApproval(args) {
+	const approve = args.options.approveDeployment;
+	if (args.options.requireApproval !== "any-change" || approve === void 0) return;
+	if (enclosingDeadlineExpired()) throw approvalAfterTimeout(args.stackName);
+	let approved;
+	try {
+		approved = await whileEnclosingDeadlinesPaused(() => approve({
+			stackName: args.stackName,
+			level: "any-change",
+			counts: {
+				create: 0,
+				update: 0,
+				delete: 0
+			},
+			destructiveChanges: [],
+			outputsOnly: true
+		}));
+	} catch (error) {
+		throw error instanceof Error ? markNonRetryable(error) : error;
+	}
+	if (!approved) throw markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${args.stackName} was not approved (--require-approval=any-change). Nothing was changed.`, "DEPLOY_NOT_APPROVED"));
+}
+
 //#endregion
 //#region src/deployment/condition-verdicts.ts
 function conditionInputsFrom(args) {
@@ -36137,6 +36895,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			}));
 		}
 		const effectiveTemplate = this.templateParser.filterResourcesByCondition(template, conditions);
+		this.constructPathTemplate = effectiveTemplate;
 		const orphanCountBeforeAdoption = (currentState.orphans ?? []).length;
 		const orphanPlan = await this.adoptRollbackOrphans(currentState, effectiveTemplate);
 		if (Object.keys(orphanPlan.adopted).length > 0) {
@@ -36230,6 +36989,10 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 				const skippedOutputsChanged = !skippedOutputsEqual(currentState.skippedOutputs, this.skippedOutputs);
 				const healedAttributesPending = this.hasUnpersistedHeals(currentState.resources);
 				const conditionVerdictsChanged = !conditionVerdictRecordsEqual(readRecordedConditionVerdicts(currentState), conditionVerdicts);
+				if (outputsChanged || exportSetChanged && currentState.exportNames !== void 0) await requireOutputsOnlyApproval({
+					options: this.options,
+					stackName
+				});
 				if (observedRefresh || maskedFingerprintsBackfilled || conditionVerdictsChanged || outputsChanged || exportSetChanged || skippedOutputsChanged || orphansChanged || healedAttributesPending) try {
 					const refreshedState = {
 						version: 10,
@@ -36263,13 +37026,12 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 					this.logger.warn(`Failed to persist no-change state update: ${saveError instanceof Error ? saveError.message : String(saveError)} — drift baseline / outputs will be re-resolved on next deploy.`);
 				}
 			}
-			if (!this.options.dryRun) await this.settleJournalAfterSuccess(stackName, [], currentState, currentState.resources, currentEtag === void 0);
 			return {
 				stackName,
 				created: 0,
 				updated: 0,
 				deleted: 0,
-				deleteSkipped: 0,
+				deleteSkipped: this.options.dryRun ? 0 : await this.settleJournalAfterSuccess(stackName, [], currentState, currentState.resources, currentEtag === void 0),
 				updatePartial: 0,
 				unchanged: Object.keys(currentState.resources).length,
 				durationMs: Date.now() - startTime,
@@ -36295,6 +37057,14 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 				attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
 			};
 		}
+		await requireDeploymentApproval({
+			options: this.options,
+			stackName,
+			changes: changes.values(),
+			records: currentState.resources,
+			template: effectiveTemplate,
+			recreateTargetIds: recreateTargetIdsFor(this.options.recreateTargets, stackName)
+		});
 		this.resolver.resetPhysicalIdFallbackCount();
 		const progress = {
 			current: 0,
@@ -36308,7 +37078,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		} : newState));
 		this.logger.debug(`State saved (ETag: ${newEtag})`);
 		await forgetRecordedCreateTokens(Object.keys(newState.resources));
-		await Promise.all([this.settleJournalAfterSuccess(stackName, completedOperations, currentState, newState.resources, currentEtag === void 0), this.exportIndexStore ? this.exportIndexStore.updateForStack(stackName, this.stackRegion, importableOutputs({
+		const [journaledOrphansLeft] = await Promise.all([this.settleJournalAfterSuccess(stackName, completedOperations, currentState, newState.resources, currentEtag === void 0), this.exportIndexStore ? this.exportIndexStore.updateForStack(stackName, this.stackRegion, importableOutputs({
 			...newState,
 			outputs: this.redactOutputs(newState.outputs)
 		})) : Promise.resolve()]);
@@ -36319,7 +37089,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			created: actualCounts.created,
 			updated: actualCounts.updated,
 			deleted: actualCounts.deleted,
-			deleteSkipped: actualCounts.deleteSkipped,
+			deleteSkipped: actualCounts.deleteSkipped + journaledOrphansLeft,
 			updatePartial: actualCounts.updatePartial,
 			nestedUpdatePartial: actualCounts.nestedUpdatePartial,
 			unchanged: unchangedCount,
@@ -36342,77 +37112,6 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 	}
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/resolver-context.ts
-function buildResolverContext(base, stackName) {
-	const recordedSecretValues = /* @__PURE__ */ new Map();
-	if (this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0) inheritNestedStackParameterAssociations(recordedSecretValues, this.options.inheritedSecrets);
-	return {
-		template: base.template,
-		resources: base.resources,
-		...base.parameters && Object.keys(base.parameters).length > 0 && { parameters: base.parameters },
-		...base.conditions && Object.keys(base.conditions).length > 0 && { conditions: base.conditions },
-		stateBackend: this.stateBackend,
-		stackName,
-		...this.exportIndexStore && { exportIndex: this.exportIndexStore },
-		recordedImports: this.recordedImports,
-		recordedOutputReads: this.recordedOutputReads,
-		attributeHealer: (logicalId, resource) => this.healStaleAttributes(logicalId, resource, stackName),
-		...this.options.inheritedSecrets && hasMaskableValues(this.options.inheritedSecrets) && { inheritedSecrets: this.options.inheritedSecrets },
-		recordedSecretValues,
-		noEchoAttributeResources: this.noEchoAttributeResources,
-		...base.redactedAttributeReads && { redactedAttributeReads: base.redactedAttributeReads }
-	};
-}
-function getAttTargetOf(node) {
-	if (node === null || typeof node !== "object" || Array.isArray(node)) return void 0;
-	const getAtt = node["Fn::GetAtt"];
-	if (Array.isArray(getAtt) && typeof getAtt[0] === "string") return getAtt[0];
-	if (typeof getAtt === "string") return getAtt.split(".")[0];
-}
-function maskedInputSources(template, resources, conditions, stackName) {
-	const parameters = this.fingerprintParameters;
-	if (parameters === void 0) return void 0;
-	return {
-		template,
-		parameterInput: parameters.parameterInput,
-		conditions,
-		childTemplate: this.fingerprintChildTemplates,
-		resolve: async (node) => {
-			const { attributeHealer: _healer, ...base } = this.buildResolverContext({
-				template,
-				resources,
-				parameters: parameters.bound,
-				...conditions && { conditions }
-			}, stackName);
-			const context = {
-				...base,
-				recordedImports: [],
-				recordedOutputReads: [],
-				bestEffort: true,
-				skipDynamicReferences: true,
-				staleAttributeHeal: { phase: "probe" }
-			};
-			const value = await this.resolver.resolve(structuredClone(node), context);
-			const secrets = context.recordedSecretValues;
-			const target = getAttTargetOf(node);
-			const targetSecrets = target === void 0 ? void 0 : this.perResourceSecrets.get(target);
-			if (targetSecrets !== void 0 && hasMaskableValues(targetSecrets)) {
-				const probe = { value };
-				const redacted = redactSecretsForState(probe, targetSecrets);
-				if (JSON.stringify(redacted) !== JSON.stringify(probe)) return {
-					value,
-					keepAsWritten: true
-				};
-			}
-			return {
-				value,
-				...secrets && { secrets }
-			};
-		}
-	};
-}
-
 //#endregion
 //#region src/deployment/label-routing.ts
 function deriveLabelRouting(change, existingState, registry, forceCcApi = false) {
@@ -36633,6 +37332,7 @@ var DeployEngine = class {
 	recordedOutputReads = [];
 	perResourceSecrets = /* @__PURE__ */ new Map();
 	noEchoAttributeResources = /* @__PURE__ */ new Map();
+	secretNameNeedles = /* @__PURE__ */ new Map();
 	perResourceTemplateProps = /* @__PURE__ */ new Map();
 	perResourceResolvedType = /* @__PURE__ */ new Map();
 	fingerprintNoEchoValues = void 0;
@@ -36644,6 +37344,7 @@ var DeployEngine = class {
 	outputsTemplateSource = Object.create(null);
 	resolvedExportNames = [];
 	skippedOutputs;
+	constructPathTemplate;
 	outputsSourceUsable = true;
 	attemptedResolvedProps = /* @__PURE__ */ new Map();
 	liveTaskLabels = /* @__PURE__ */ new Map();
@@ -36684,7 +37385,9 @@ var DeployEngine = class {
 		this.recordedOutputReads = [];
 		this.perResourceSecrets = /* @__PURE__ */ new Map();
 		this.noEchoAttributeResources = /* @__PURE__ */ new Map();
+		this.secretNameNeedles = /* @__PURE__ */ new Map();
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
+		this.constructPathTemplate = void 0;
 		this.perResourceResolvedType = /* @__PURE__ */ new Map();
 		this.fingerprintNoEchoValues = void 0;
 		this.fingerprintParameters = void 0;
@@ -36717,7 +37420,7 @@ var DeployEngine = class {
 			const secrets = this.perResourceSecrets.get(logicalId);
 			const templateProps = this.perResourceTemplateProps.get(logicalId);
 			const scrubbed = scrubResourceRecord(this.withHealedAttributes(logicalId, record), secrets ?? /* @__PURE__ */ new Map(), templateProps);
-			resources[logicalId] = withMaskedPropertyFingerprints(scrubbed, record.properties, templateProps, secrets, this.fingerprintNoEchoValues, this.perResourceInputFingerprints.get(logicalId));
+			resources[logicalId] = withConstructPath(withMaskedPropertyFingerprints(scrubbed, record.properties, templateProps, secrets, this.fingerprintNoEchoValues, this.perResourceInputFingerprints.get(logicalId)), constructPathOf(this.constructPathTemplate, logicalId));
 		}
 		const orphans = state.orphans?.map((entry) => {
 			const sameResource = this.perResourceResolvedType.get(entry.logicalId) === entry.state.resourceType;
@@ -36798,7 +37501,7 @@ var DeployEngine = class {
 		} catch {}
 	}
 	maskSecretsInEvent(event) {
-		const secrets = event.logicalId ? this.perResourceSecrets.get(event.logicalId) : void 0;
+		const secrets = event.logicalId ? this.printingSecretsFor(event.logicalId) : void 0;
 		if (!secrets || !hasMaskableValues(secrets)) return event;
 		const next = { ...event };
 		if (next.error?.message) next.error = {
@@ -36874,6 +37577,11 @@ DeployEngine.prototype.refuseRedactedAttributeReads = refuseRedactedAttributeRea
 DeployEngine.prototype.allRecordedSecrets = allRecordedSecrets;
 DeployEngine.prototype.readReaderForFreshNoEchoCeiling = readReaderForFreshNoEchoCeiling;
 DeployEngine.prototype.maskForResource = maskForResource;
+DeployEngine.prototype.secretNameBagFor = secretNameBagFor;
+DeployEngine.prototype.noteSecretNamedRecord = noteSecretNamedRecord;
+DeployEngine.prototype.printingSecretsFor = printingSecretsFor;
+DeployEngine.prototype.namingSecretsFor = namingSecretsFor;
+DeployEngine.prototype.noteSecretNamedReads = noteSecretNamedReads;
 DeployEngine.prototype.kickOffObservedCapture = kickOffObservedCapture;
 DeployEngine.prototype.drainObservedCaptures = drainObservedCaptures;
 DeployEngine.prototype.buildObservedCaptureSiblings = buildObservedCaptureSiblings;
@@ -36898,5 +37606,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { resourcesNamingDeclaredParameter as $, recordMaskOnlyValuesIn as $a, WARM_THROUGHPUT_MEMBERS as $i, assertSendableRoleArn as $n, getDockerCmd as $o, malformedOutputsRefusalMessage as $r, isWholeDynamicReferenceValue as $t, resolveDynamoDbDeleteBudgetClock as A, hasMaskableValues as Aa, refuseMalformedResourcesForExport as Ai, slowCcOperationTimeoutMs as An, buildAssetRedirectMap as Ao, JSON_LISTING_HOLE_VALUE as Ar, uploadCfnTemplate as As, buildFinalSnapshotIdentifier as At, getPriorAttempts as B, maskSecretsInText as Ba, unreadableResourceEntries as Bi, ec2InstanceProtectionSite as Bn, parseBootstrapMarker as Bo, isReadableOrphanRecord as Br, defineOwnKey as Bs, redactedDeleteAddressSkip as Bt, perType as C, DagBuilder as Ca, refuseMalformedResourceEntriesForOrphan as Ci, CC_BROKEN_REASON as Cn, orphansAfterRollback as Co, cfnRefValueFromPhysicalId as Cr, stateBucketExistenceConfirmed as Cs, planRollback as Ct, beginDeleteWait as D, recordNestedStackParameterExpressions as Da, refuseMalformedResourcePropertiesForOrphan as Di, isCustomResourceType as Dn, isSensitiveAttributeName as Do, withSharedDrainBudget as Dr, CFN_TEMPLATE_URL_LIMIT as Ds, inheritProducerRegions as Dt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as E, inheritNestedStackParameterAssociations as Ea, refuseMalformedResourcePropertiesForExport as Ei, wouldReturnToSdkProvider as En, AssetPublisher as Eo, parseWebACLArn as Er, CFN_TEMPLATE_BODY_LIMIT as Es, getCurrentProducerRegions as Et, waitForIndexesSettled as F, recordLogOnlyValue as Fa, repairMalformedResourceEntriesForReadOnly as Fi, deleteSkipReason as Fn, BOOTSTRAP_MARKER_PREFIX as Fo, deployRefusesOrphanRowsReason as Fr, canonicalizeRegion as Fs, refusesFinalSnapshot as Ft, cyan as G, DYNAMIC_REFERENCE_TOKEN_SCAN as Ga, NO_CC_HANDLERS_REASON as Gi, DiffCalculator as Gn, buildDockerImage as Go, malformedLocalOutputsWarning as Gr, absoluteAssemblyPathEscape as Gs, extractDeploymentEventError as Gt, formatResourceLine as H, redactSecretsForState as Ha, findSilentDropProperties as Hi, observeThenDisableInstanceApiTermination as Hn, validateAssetBucketName as Ho, malformedDriftResourcePropertiesWarning as Hr, hasPlainPrototype$1 as Hs, updatePartialReason as Ht, ECR_AUTO_DELETE_IMAGES_TAG as I, shareLogOnlyValues as Ia, repairMalformedResourcePropertiesForReadOnly as Ii, withIndeterminateGuard as In, assertAssetBucketRegion as Io, displayLogicalId as Ir, derivePartitionAndUrlSuffix as Is, unsupportedFinalSnapshotError as It, red as J, pathCrossesDottedKey as Ja, shownType as Ji, classifyReplaySecretRegion as Jn, describeDockerExecFailure as Jo, malformedOrphanRecordsRefusalMessage as Jr, renderAssemblyPathEscape as Js, exportAliasCollisionScrubWarning as Jt, gray as K, dynamicReferenceTokens as Ka, hasNoCloudControlHandlers as Ki, INTRINSIC_KEYS as Kn, resolveDockerContextDirectory as Ko, malformedLocalResourceEntriesWarning as Kr, describeFileReadFailure as Ks, WITHHELD_NAME_DISPLAY as Kt, S3_AUTO_DELETE_OBJECTS_TAG as L, createSecretMasker as La, repairMalformedResourcesForReadOnly as Li, isWaitAbandonedError as Ln, ensureAssetStorage as Lo, hasReadableOrphans as Lr, AssemblyReader as Ls, REDACTED_DELETE_ADDRESS_SKIP_REASON as Lt, DELETE_INDEX_WAIT_PROCEED_NOTE as M, logOnlyValueCount as Ma, repairMalformedOrphanRecordsForReadOnly as Mi, unchangedBehindSecretReference as Mn, loadPublishableAssetManifest as Mo, STATE_RESOURCES_MALFORMED as Mr, decodeListingKey as Ms, createPreDeleteFinalSnapshot as Mt, INDEX_SETTLE_POLL_INTERVAL_MS as N, printingCorpusOf as Na, repairMalformedOrphansForReadOnly as Ni, UNSPECIFIED_SKIP_REASON as Nn, rewriteTemplateAssetReferences as No, UNREADABLE_ORPHANS_CONTAINER_ROW as Nr, expectedOwnerParam as Ns, effectiveDeletionPolicy as Nt, compensateRemovedDeletionProtection as O, carryLogOnlyValues as Oa, refuseMalformedResourcesForDeploy as Oi, getCurrentResourceSecrets as On, stringifyValue as Oo, parameterInputsFor as Or, MIGRATE_TMP_PREFIX as Os, ATOMIC_FINAL_SNAPSHOT_TYPES as Ot, deleteTableWithIndexBusyRetry as P, recordLogOnlyParameterValue as Pa, repairMalformedOutputsForReadOnly as Pi, deleteIndeterminateGuards as Pn, AssetModeResolver as Po, UNREADABLE_RESOURCES_MAP_ROW as Pr, PARTITION_TABLE as Ps, isFinalSnapshotError as Pt, reachableDivergentParameters as Q, recordMaskOnlyValue as Qa, renderStatefulReason as Qi, assertFlagRoleArn as Qn, formatDockerLoginError as Qo, malformedOrphansWarning as Qr, exportNameSecretExposure as Qt, hasCdkAutoDeleteTag as R, errorCauseChain as Ra, unpreviewableOrphanRecords as Ri, markWaitAbandoned as Rn, getBootstrapMarkerKey as Ro, hasReadableOutputs as Rr, StageLoadError as Rs, isRedactedRecordedValue as Rt, isProtectionValueActive as S, sameLambdaFunctionAddress as Sa, refuseMalformedResourceEntriesForImportSave as Si, stringifyIfAssigned as Sn, isReadableBag as So, AWS_NO_VALUE as Sr, resolveUseCdkBootstrapAssets as Ss, planFailedOps as St, DynamoDBGlobalTableProvider as T, liveMatchesUnresolvedTokenFrame as Ta, refuseMalformedResourcePropertiesForDrift as Ti, ccBrokenReason as Tn, shouldRetainResource as To, refStateLookupFromResource as Tr, ssmResolvedValueType as Ts, findNestedStackTypeChanges as Tt, createReadOnlyAttributeHealerFactory as U, scrubResourceRecord as Ua, unwrittenCreateOnlyReplacement as Ui, reDisableInstanceApiTermination as Un, validateContainerRepoName as Uo, malformedExportNamesWarning as Ur, nullPrototypeRecord as Us, DeploymentEventsReader as Ut, markRefusedBeforeApplying as V, markSameGenerationBag as Va, findActionableSilentDrops as Vi, isTerminationProtectionPropagationError as Vn, readBootstrapMarkerBody as Vo, isReadableResourceEntry as Vr, hasOwnKey as Vs, updatePartialMessage as Vt, bold as W, recoverMaskedOutput as Wa, withoutSilentDropProperties as Wi, reEnableInstanceApiTermination as Wn, buildDenyExternalAccessPolicy as Wo, malformedExportSourceWarning as Wr, ownValue as Ws, DeploymentEventsStore as Wt, computeParameterTaint as X, carriesSecretMask as Xa, isStatefulRecreateTargetForReplace as Xi, regionLessSecretName as Xn, dockerSpawnEnvWithSensitive as Xo, malformedOrphanRowsKeptWarning as Xr, clearBucketRegionCache as Xs, secretBearingStateKeyWarning as Xt, yellow as Y, identityKeyFor as Ya, MULTI_REGION_RECREATE_BLOCKED_TYPES as Yi, producerRegionsFromState as Yn, describeDockerFailure as Yo, malformedOrphanRecordsWarning as Yr, resolveAssemblyPath as Ys, secretBearing as Yt, namesAnyDeclaredParameter as Z, provenPublicValue as Za, isStatefulRecreateTargetSync as Zi, applyRoleArnIfSet as Zn, finchSecretArgvRefusal as Zo, malformedOrphansRefusalMessage as Zr, resolveBucketRegion as Zs, secretSafeKeyDisplay as Zt, makeCanonicalizePropertiesFn as _, withRetry as _a, refuseMalformedResourceAttributesForOrphan as _i, readTagList as _n, hasReadableExportSet as _o, isImpossibleEmptyStoredAttribute as _r, resolveAutoAssetStorage as _s, destroyStackRecordsView as _t, findNestedTemplateTreeDefect as a, coerceCfnInteger as aa, malformedScrubResourceEntriesRefusalMessage as ai, DEFAULT_RESOURCE_TIMEOUT_MS as an, STATE_SOURCED_READBACK_RULES as ao, callerEnvCredentials as ar, runDockerForeground as as, dropSettledNestedJournals as at, recordedProtectionNote as b, canonicalLambdaFunctionName as ba, refuseMalformedResourceEntriesForDestroy as bi, tagPlanWarning as bn, importableOutputKeys as bo, isNamelessDynamicReferenceError as br, resolveStateBucketWithDefault as bs, recordAfterRollbackUpdate as bt, renderNestedTemplateTreeDefect as c, configStringRefusal as ca, refuseDivergentRecordRegionForDestroy as ci, RollbackInlinePolicyWriters as cn, isSingleDynamicReferenceToken as co, s3BucketArn as cr, escapeRegExp$3 as cs, recordDisplacedSkips as ct, conditionInputsFrom as d, requireConfigArray as da, refuseMalformedOrphanRecordsForDestroy as di, reserveStackCreateToken as dn, S3StateBackend as do, s3BucketRegionalDomainName as dr, getDockerImageBySourceHash as ds, withNestedRevertRun as dt, coerceWarmThroughput as ea, malformedOutputsWarning as ei, noEchoParameterValueSeed as en, recordNoEchoAttributeValues as eo, explicitRoleArnOrThrow as er, isDockerClientEnvKey as es, makeSiblingClaimReader as et, parentSuppliedValues as f, requireConfigObject as fa, refuseMalformedOrphans as fi, withCreateTokenLedger as fn, rebuildClientForBucketRegion as fo, s3BucketWebsiteUrl as fr, Synthesizer as fs, getCurrentNestedStackContext as ft, mergeNoChangeOutputs as g, describeTypeWithThrottleRetry as ga, refuseMalformedOutputsForDestroy as gi, planTagDiff as gn, exportNamesCarriedFrom as go, getAccountInfo as gr, resolveApp as gs, awaitInFlightSibling as gt, keptWholeReasonText as h, templateResourceTypes as ha, refuseMalformedOutputs as hi, DBPROXY_TAG_OPTIONS as hn, describeRegionValueKind as ho, parameterTypeMayLoseSecretIdentity as hr, getLegacyStateBucketName as hs, replayRollback as ht, childTemplateLoader as i, coerceCfnBoolean as ia, malformedResourcesWarning as ii, bindingSkippedOutputs as in, STATE_SOURCED_CROSS_GENERATION_RULES as io, applyCallerIdentityCredentials as ir, redactedDockerCause as is, displacedPhysicalIdShown as it, resolveDynamoDbDeleteBudgetMs as j, literalSplitDelimitersOf as ja, refuseMalformedState as ji, ccProtectionRegistryTypes as jn, createAssetRedirectResolver as jo, STATE_REGION_DIVERGED as jr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as js, ccRoutedFinalSnapshotError as jt, deleteBudgetKey as k, createUnionSecretMasker as ka, refuseMalformedResourcesForDestroy as ki, CloudControlProvider as kn, WorkGraph as ko, passedParameterClassesOf as kr, findLargeInlineResources as ks, PRE_DELETE_SNAPSHOT_TYPES as kt, templateIdentity as l, readConfigString as la, refuseMalformedNestedChildOutputs as li, earliestDefined as ln, LockManager as lo, s3BucketDomainName as lr, stripControlChars as ls, revertNestedChildFromJournal as lt, isSecretBearingReferenceString as m, prefetchCreateOnlyPropertyPaths as ma, refuseMalformedOrphansForOrphan as mi, DBPROXY_TAGS_WHAT as mn, acceptedCreateOnlyDropsOf as mo, isUnboundTemplateParameter as mr, getDefaultStateBucketName as ms, replayFailedOperations as mt, IMPLICIT_DELETE_DEPENDENCIES as n, toCfnInteger as na, malformedResourceEntriesWarning as ni, collectPublishedOutputNames as nn, wholeStringLeavesOf as no, sendableAssumeRoleCommand as nr, partitionSensitiveEnv as ns, NESTED_PENDING_PARENT_REASON as nt, isAbsoluteAssetPath as o, configBooleanRefusal as oa, malformedStateRefusalMessage as oi, DEFAULT_RESOURCE_WARN_AFTER_MS as on, TEMPLATE_SOURCED_RULES as oo, envCredentialsAreAssumedRole as or, runDockerStreaming as os, getNestedRevertRun as ot, readRecordedConditionVerdicts as p, requireConfigString as pa, refuseMalformedOrphansForDestroy as pi, acquireIdempotencyToken as pn, splitImportedOps as po, coerceParameterTypedValue as pr, synthesisStatusMessage as ps, withNestedStackContext as pt, green as q, isUncertifiedBaselineMaskPosition as qa, findReplacedReadersOfRecreateTargets as qi, IntrinsicFunctionResolver as qn, describeDockerCapturedOutput as qo, malformedLocalResourcesWarning as qr, displayAssemblyPath as qs, displayTextOrWithheld as qt, computeImplicitDeleteEdges as r, toFiniteNumber as ra, malformedResourcePropertiesWarning as ri, isExportAliasCollision as rn, STATE_SOURCED_BASELINE_RULES as ro, AWS_CREDENTIAL_ENV_KEYS as rr, redactDockerArgvValues as rs, displacedOpClause as rt, listNestedTemplateRows as s, configIntegerRefusal as sa, previewableOrphanRecords as si, maskingRetryLogger as sn, WHOLE_DYNAMIC_REFERENCE_PATTERN as so, isSettledInstanceState as sr, warnFinchArgvExposure as ss, nestedChildStackName as st, DeployEngine as t, isWarmThroughputDecrease as ta, malformedRenderedContainersWarning as ti, collectDeclaredOutputNames as tn, recordProvenPublicExpression as to, isIamRoleArn as tr, isMalformedEnvKey as ts, planOrphanAdoption as tt, conditionFingerprint as u, replayWarn as ua, refuseMalformedOrphanRecords as ui, ledgerForStack as un, isLockInfoExpired as uo, s3BucketDualStackDomainName as ur, AssetManifestLoader as us, revertedNestedRowIds as ut, withResourceDeadline as v, markAuxiliaryFailure as va, refuseMalformedResourceEntries as vi, refuseMalformedDesiredTags as vn, hasReasonlessBaselineRefusal as vo, carriesDynamicReference as vr, resolveCaptureObservedState as vs, getStackRecords as vt, readProtection as w, TemplateParser as wa, refuseMalformedResourcePropertiesForDestroy as wi, ProviderRegistry as wn, orphansCarriedFrom as wo, isStalePlaceholderArnAttribute as wr, warnDeprecatedNoPrefixCliFlag as ws, resolveReplacementOldType as wt, PROTECTION_PROPERTY_BY_TYPE as x, lambdaFunctionNameForMask as xa, refuseMalformedResourceEntriesForImport as xi, definedAttributes as xn, importableOutputs as xo, keepsSecretReferenceToken as xr, resolveStateBucketWithDefaultAndSource as xs, demoteSupersededOrphans as xt, recordedProtectionEvidence as y, markCreatedBeforeFailure as ya, refuseMalformedResourceEntriesForDeploy as yi, tagMapAsList as yn, hasUnverifiableParameterRefusal as yo, carriesFetchableDynamicReference as yr, resolveSkipPrefix as ys, withStackRecords as yt, isTruthyCfnBoolean as z, maskSecretsInError as za, unreadableOrphanRecords as zi, disableInstanceApiTermination as zn, isCrossRegionRedirect as zo, hasReadableResources as zr, processStackMessages as zs, redactedDeleteAddressFields as zt };
-//# sourceMappingURL=deploy-engine-DG-oC9YK.js.map
+export { resourcesNamingDeclaredParameter as $, dynamicReferenceTokens as $a, withoutSilentDropProperties as $i, reEnableInstanceApiTermination as $n, resolveDockerContextDirectory as $o, malformedExportSourceWarning as $r, absoluteAssemblyPathEscape as $s, displayTextOrWithheld as $t, resolveDynamoDbDeleteBudgetClock as A, DagBuilder as Aa, refuseMalformedResourceEntriesForImport as Ai, definedAttributes as An, orphansAfterRollback as Ao, keepsSecretReferenceToken as Ar, resolveUseCdkBootstrapAssets as As, resolveReplacementOldType as At, getPriorAttempts as B, printingCorpusOf as Ba, refuseMalformedState as Bi, ccProtectionRegistryTypes as Bn, rewriteTemplateAssetReferences as Bo, STATE_REGION_DIVERGED as Br, decodeListingKey as Bs, isFinalSnapshotError as Bt, perType as C, prefetchCreateOnlyPropertyPaths as Ca, refuseMalformedOrphansForOrphan as Ci, DBPROXY_TAGS_WHAT as Cn, exportNamesCarriedFrom as Co, isUnboundTemplateParameter as Cr, loadCdkJson as Cs, getStackRecords as Ct, beginDeleteWait as D, canonicalLambdaFunctionName as Da, refuseMalformedResourceEntries as Di, refuseMalformedDesiredTags as Dn, importableOutputKeys as Do, carriesDynamicReference as Dr, resolveSkipPrefix as Ds, isJournaledOrphan as Dt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as E, withRetry as Ea, refuseMalformedResourceAttributesForOrphan as Ei, readTagList as En, hasUnverifiableParameterRefusal as Eo, isImpossibleEmptyStoredAttribute as Er, resolveCaptureObservedState as Es, demoteSupersededOrphans as Et, waitForIndexesSettled as F, carryLogOnlyValues as Fa, refuseMalformedResourcePropertiesForExport as Fi, wouldReturnToSdkProvider as Fn, stringifyValue as Fo, parseWebACLArn as Fr, CFN_TEMPLATE_URL_LIMIT as Fs, PRE_DELETE_SNAPSHOT_TYPES as Ft, cyan as G, errorCauseChain as Ga, repairMalformedResourcePropertiesForReadOnly as Gi, withIndeterminateGuard as Gn, getBootstrapMarkerKey as Go, displayLogicalId as Gr, AssemblyReader as Gs, redactedDeleteAddressFields as Gt, formatResourceLine as H, recordLogOnlyValue as Ha, repairMalformedOrphansForReadOnly as Hi, UNSPECIFIED_SKIP_REASON as Hn, BOOTSTRAP_MARKER_PREFIX as Ho, UNREADABLE_ORPHANS_CONTAINER_ROW as Hr, PARTITION_TABLE as Hs, unsupportedFinalSnapshotError as Ht, ECR_AUTO_DELETE_IMAGES_TAG as I, createUnionSecretMasker as Ia, refuseMalformedResourcePropertiesForOrphan as Ii, isCustomResourceType as In, WorkGraph as Io, withSharedDrainBudget as Ir, MIGRATE_TMP_PREFIX as Is, buildFinalSnapshotIdentifier as It, red as J, markSameGenerationBag as Ja, unreadableOrphanRecords as Ji, disableInstanceApiTermination as Jn, readBootstrapMarkerBody as Jo, hasReadableResources as Jr, defineOwnKey as Js, updatePartialReason as Jt, gray as K, maskSecretsInError as Ka, repairMalformedResourcesForReadOnly as Ki, isWaitAbandonedError as Kn, isCrossRegionRedirect as Ko, hasReadableOrphans as Kr, StageLoadError as Ks, redactedDeleteAddressSkip as Kt, S3_AUTO_DELETE_OBJECTS_TAG as L, hasMaskableValues as La, refuseMalformedResourcesForDeploy as Li, getCurrentResourceSecrets as Ln, buildAssetRedirectMap as Lo, parameterInputsFor as Lr, findLargeInlineResources as Ls, ccRoutedFinalSnapshotError as Lt, DELETE_INDEX_WAIT_PROCEED_NOTE as M, liveMatchesUnresolvedTokenFrame as Ma, refuseMalformedResourceEntriesForOrphan as Mi, CC_BROKEN_REASON as Mn, shouldRetainResource as Mo, cfnRefValueFromPhysicalId as Mr, warnDeprecatedNoPrefixCliFlag as Ms, getCurrentProducerRegions as Mt, INDEX_SETTLE_POLL_INTERVAL_MS as N, inheritNestedStackParameterAssociations as Na, refuseMalformedResourcePropertiesForDestroy as Ni, ProviderRegistry as Nn, AssetPublisher as No, isStalePlaceholderArnAttribute as Nr, ssmResolvedValueType as Ns, inheritProducerRegions as Nt, compensateRemovedDeletionProtection as O, lambdaFunctionNameForMask as Oa, refuseMalformedResourceEntriesForDeploy as Oi, tagMapAsList as On, importableOutputs as Oo, carriesFetchableDynamicReference as Or, resolveStateBucketWithDefault as Os, planFailedOps as Ot, deleteTableWithIndexBusyRetry as P, recordNestedStackParameterExpressions as Pa, refuseMalformedResourcePropertiesForDrift as Pi, ccBrokenReason as Pn, isSensitiveAttributeName as Po, refStateLookupFromResource as Pr, CFN_TEMPLATE_BODY_LIMIT as Ps, ATOMIC_FINAL_SNAPSHOT_TYPES as Pt, reachableDivergentParameters as Q, DYNAMIC_REFERENCE_TOKEN_SCAN as Qa, unwrittenCreateOnlyReplacement as Qi, reDisableInstanceApiTermination as Qn, buildDockerImage as Qo, malformedExportNamesWarning as Qr, ownValue as Qs, WITHHELD_NAME_DISPLAY as Qt, hasCdkAutoDeleteTag as R, literalSplitDelimitersOf as Ra, refuseMalformedResourcesForDestroy as Ri, CloudControlProvider as Rn, createAssetRedirectResolver as Ro, passedParameterClassesOf as Rr, uploadCfnTemplate as Rs, createPreDeleteFinalSnapshot as Rt, isProtectionValueActive as S, requireConfigString as Sa, refuseMalformedOrphansForDestroy as Si, acquireIdempotencyToken as Sn, describeRegionValueKind as So, coerceParameterTypedValue as Sr, getLegacyStateBucketName as Ss, destroyStackRecordsView as St, DynamoDBGlobalTableProvider as T, describeTypeWithThrottleRetry as Ta, refuseMalformedOutputsForDestroy as Ti, planTagDiff as Tn, hasReasonlessBaselineRefusal as To, getAccountInfo as Tr, resolveAutoAssetStorage as Ts, recordAfterRollbackUpdate as Tt, createReadOnlyAttributeHealerFactory as U, shareLogOnlyValues as Ua, repairMalformedOutputsForReadOnly as Ui, deleteIndeterminateGuards as Un, assertAssetBucketRegion as Uo, UNREADABLE_RESOURCES_MAP_ROW as Ur, canonicalizeRegion as Us, REDACTED_DELETE_ADDRESS_SKIP_REASON as Ut, markRefusedBeforeApplying as V, recordLogOnlyParameterValue as Va, repairMalformedOrphanRecordsForReadOnly as Vi, unchangedBehindSecretReference as Vn, AssetModeResolver as Vo, STATE_RESOURCES_MALFORMED as Vr, expectedOwnerParam as Vs, refusesFinalSnapshot as Vt, bold as W, createSecretMasker as Wa, repairMalformedResourceEntriesForReadOnly as Wi, deleteSkipReason as Wn, ensureAssetStorage as Wo, deployRefusesOrphanRowsReason as Wr, derivePartitionAndUrlSuffix as Ws, isRedactedRecordedValue as Wt, computeParameterTaint as X, scrubResourceRecord as Xa, findActionableSilentDrops as Xi, isTerminationProtectionPropagationError as Xn, validateContainerRepoName as Xo, isReadableResourceEntry as Xr, hasPlainPrototype$1 as Xs, DeploymentEventsStore as Xt, yellow as Y, redactSecretsForState as Ya, unreadableResourceEntries as Yi, ec2InstanceProtectionSite as Yn, validateAssetBucketName as Yo, isReadableOrphanRecord as Yr, hasOwnKey as Ys, DeploymentEventsReader as Yt, namesAnyDeclaredParameter as Z, recoverMaskedOutput as Za, findSilentDropProperties as Zi, observeThenDisableInstanceApiTermination as Zn, buildDenyExternalAccessPolicy as Zo, malformedDriftResourcePropertiesWarning as Zr, nullPrototypeRecord as Zs, extractDeploymentEventError as Zt, makeCanonicalizePropertiesFn as _, configStringRefusal as _a, refuseDivergentRecordRegionForDestroy as _i, RollbackInlinePolicyWriters as _n, isLockInfoExpired as _o, s3BucketArn as _r, AssetManifestLoader as _s, getCurrentNestedStackContext as _t, findNestedTemplateTreeDefect as a, isStatefulRecreateTargetForReplace as aa, resolveBucketRegion as ac, malformedOrphanRowsKeptWarning as ai, isWholeDynamicReferenceValue as an, recordMaskOnlyValue as ao, regionLessSecretName as ar, formatDockerLoginError as as, makeSiblingClaimReader as at, recordedProtectionNote as b, requireConfigArray as ba, refuseMalformedOrphanRecordsForDestroy as bi, reserveStackCreateToken as bn, splitImportedOps as bo, s3BucketRegionalDomainName as br, synthesisStatusMessage as bs, replayRollback as bt, renderNestedTemplateTreeDefect as c, WARM_THROUGHPUT_MEMBERS as ca, malformedOutputsRefusalMessage as ci, collectPublishedOutputNames as cn, recordProvenPublicExpression as co, assertSendableRoleArn as cr, isMalformedEnvKey as cs, displacedOpClause as ct, conditionInputsFrom as d, toCfnInteger as da, malformedResourceEntriesWarning as di, DEFAULT_RESOURCE_TIMEOUT_MS as dn, STATE_SOURCED_CROSS_GENERATION_RULES as do, sendableAssumeRoleCommand as dr, redactedDockerCause as ds, getNestedRevertRun as dt, NO_CC_HANDLERS_REASON as ea, describeFileReadFailure as ec, malformedLocalOutputsWarning as ei, exportAliasCollisionScrubWarning as en, isUncertifiedBaselineMaskPosition as eo, DiffCalculator as er, describeDockerCapturedOutput as es, deleteJournaledOrphans as et, parentSuppliedValues as f, toFiniteNumber as fa, malformedResourcePropertiesWarning as fi, DEFAULT_RESOURCE_WARN_AFTER_MS as fn, STATE_SOURCED_READBACK_RULES as fo, AWS_CREDENTIAL_ENV_KEYS as fr, runDockerForeground as fs, nestedChildStackName as ft, mergeNoChangeOutputs as g, configIntegerRefusal as ga, previewableOrphanRecords as gi, formatDestructiveChange as gn, LockManager as go, isSettledInstanceState as gr, stripControlChars as gs, withNestedRevertRun as gt, keptWholeReasonText as h, configBooleanRefusal as ha, malformedStateRefusalMessage as hi, findDestructiveChanges as hn, isSingleDynamicReferenceToken as ho, envCredentialsAreAssumedRole as hr, escapeRegExp$3 as hs, revertedNestedRowIds as ht, childTemplateLoader as i, MULTI_REGION_RECREATE_BLOCKED_TYPES as ia, clearBucketRegionCache as ic, malformedOrphanRecordsWarning as ii, exportNameSecretExposure as in, provenPublicValue as io, producerRegionsFromState as ir, finchSecretArgvRefusal as is, sameJournaledOrphans as it, resolveDynamoDbDeleteBudgetMs as j, TemplateParser as ja, refuseMalformedResourceEntriesForImportSave as ji, stringifyIfAssigned as jn, orphansCarriedFrom as jo, AWS_NO_VALUE as jr, stateBucketExistenceConfirmed as js, findNestedStackTypeChanges as jt, deleteBudgetKey as k, sameLambdaFunctionAddress as ka, refuseMalformedResourceEntriesForDestroy as ki, tagPlanWarning as kn, isReadableBag as ko, isNamelessDynamicReferenceError as kr, resolveStateBucketWithDefaultAndSource as ks, planRollback as kt, templateIdentity as l, coerceWarmThroughput as la, malformedOutputsWarning as li, isExportAliasCollision as ln, wholeStringLeavesOf as lo, explicitRoleArnOrThrow as lr, partitionSensitiveEnv as ls, displacedPhysicalIdShown as lt, isSecretBearingReferenceString as m, coerceCfnInteger as ma, malformedScrubResourceEntriesRefusalMessage as mi, constructPathOf as mn, WHOLE_DYNAMIC_REFERENCE_PATTERN as mo, callerEnvCredentials as mr, warnFinchArgvExposure as ms, revertNestedChildFromJournal as mt, IMPLICIT_DELETE_DEPENDENCIES as n, findReplacedReadersOfRecreateTargets as na, renderAssemblyPathEscape as nc, malformedLocalResourcesWarning as ni, secretBearingStateKeyWarning as nn, identityKeyFor as no, IntrinsicFunctionResolver as nr, describeDockerFailure as ns, journaledOrphanLines as nt, isAbsoluteAssetPath as o, isStatefulRecreateTargetSync as oa, malformedOrphansRefusalMessage as oi, noEchoParameterValueSeed as on, recordMaskOnlyValuesIn as oo, applyRoleArnIfSet as or, getDockerCmd as os, planOrphanAdoption as ot, readRecordedConditionVerdicts as p, coerceCfnBoolean as pa, malformedResourcesWarning as pi, maskingRetryLogger as pn, TEMPLATE_SOURCED_RULES as po, applyCallerIdentityCredentials as pr, runDockerStreaming as ps, recordDisplacedSkips as pt, green as q, maskSecretsInText as qa, unpreviewableOrphanRecords as qi, markWaitAbandoned as qn, parseBootstrapMarker as qo, hasReadableOutputs as qr, processStackMessages as qs, updatePartialMessage as qt, computeImplicitDeleteEdges as r, shownType as ra, resolveAssemblyPath as rc, malformedOrphanRecordsRefusalMessage as ri, secretSafeKeyDisplay as rn, carriesSecretMask as ro, classifyReplaySecretRegion as rr, dockerSpawnEnvWithSensitive as rs, loadJournaledOrphans as rt, listNestedTemplateRows as s, renderStatefulReason as sa, malformedOrphansWarning as si, collectDeclaredOutputNames as sn, recordNoEchoAttributeValues as so, assertFlagRoleArn as sr, isDockerClientEnvKey as ss, NESTED_PENDING_PARENT_REASON as st, DeployEngine as t, hasNoCloudControlHandlers as ta, displayAssemblyPath as tc, malformedLocalResourceEntriesWarning as ti, secretBearing as tn, pathCrossesDottedKey as to, INTRINSIC_KEYS as tr, describeDockerExecFailure as ts, isHandledOrphan as tt, conditionFingerprint as u, isWarmThroughputDecrease as ua, malformedRenderedContainersWarning as ui, bindingSkippedOutputs as un, STATE_SOURCED_BASELINE_RULES as uo, isIamRoleArn as ur, redactDockerArgvValues as us, dropSettledNestedJournals as ut, withResourceDeadline as v, readConfigString as va, refuseMalformedNestedChildOutputs as vi, earliestDefined as vn, S3StateBackend as vo, s3BucketDomainName as vr, getDockerImageBySourceHash as vs, withNestedStackContext as vt, readProtection as w, templateResourceTypes as wa, refuseMalformedOutputs as wi, DBPROXY_TAG_OPTIONS as wn, hasReadableExportSet as wo, parameterTypeMayLoseSecretIdentity as wr, resolveApp as ws, withStackRecords as wt, PROTECTION_PROPERTY_BY_TYPE as x, requireConfigObject as xa, refuseMalformedOrphans as xi, withCreateTokenLedger as xn, acceptedCreateOnlyDropsOf as xo, s3BucketWebsiteUrl as xr, getDefaultStateBucketName as xs, awaitInFlightSibling as xt, recordedProtectionEvidence as y, replayWarn as ya, refuseMalformedOrphanRecords as yi, ledgerForStack as yn, rebuildClientForBucketRegion as yo, s3BucketDualStackDomainName as yr, Synthesizer as ys, replayFailedOperations as yt, isTruthyCfnBoolean as z, logOnlyValueCount as za, refuseMalformedResourcesForExport as zi, slowCcOperationTimeoutMs as zn, loadPublishableAssetManifest as zo, JSON_LISTING_HOLE_VALUE as zr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as zs, effectiveDeletionPolicy as zt };
+//# sourceMappingURL=deploy-engine-xlct0Hcm.js.map