@go-to-k/cdkd 0.296.0 → 0.296.2

package/dist/{deploy-engine-D7204v7Z.js → deploy-engine-C_Eg-RHm.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js"
 import { A as displaySafe, E as UNRENDERABLE, F as safeMsg, L as truncateCodePoints, M as isPasteableIdent, O as displayAwsMessage, P as plainIdentOr, S as withoutGeneratedFallbackName, T as STACK_REF_MAX_CODE_POINTS, _ as getCurrentSkipPrefix, b as withSkipPrefix, c as getLiveRenderer, f as applyDefaultNameForFallback, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, m as explicitNamePropertyFor, n as getLogger, r as isStdoutReservedForPayload, s as installLogLineMaskerSource, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS, x as withStackName, y as looksLikeCdkdGeneratedName } from "./logger-Dvc7ddKe.js";
 import { $n as markRedactedCause, $t as LockError, A as isTerminalDeleteFailure, At as CUSTOM_RESOURCE_RESPONSE_PREFIX, Bn as isAmbiguousCcHandlerErrorCode, Bt as clientDefaultsFor, C as refusalTypeShown, Cn as physicalIdShownBesideCommand, Ct as buildForceUnlockCommand, D as ProtectionFlipRegistry, Dn as shellQuote, Dt as formatLockOperation, En as shellBoundedDisplay, Et as formatLockExpiry, Fn as isRecreateRetryableError, Ft as producerRecordKey, Gn as retryClassificationText, H as pasteableAwsCommand, Hn as isIamPropagationError, Ht as AccountIdUnavailableError, In as isReplayedNameCollisionFrom, J as isInterruptedWaitError, Jn as safeStringify$1, Kn as describeAwsFailure, Kt as CrossAccountSecretRefusalError, Lt as withPasteableAwsProfile, M as observeThenDisableProtection, Mn as hasReplayMayCollide, Mt as injectiveKey, N as protectionFlipKey, Nn as isNameCollisionErrorFrom, O as compensateProtectionFlip, On as withheldTargetClause, Ot as formatLockOwner, Pn as isNameCooldownError, Q as canonicalizeRoute53QueryName, Qn as markNonRetryable, R as DELETION_PROTECTION_DOC_POINTER, Rn as markReplayMayCollide, Rt as ambientClientDefaults, S as quotedRemedyLogicalId, Sn as pasteableCommand, St as UNREPRODUCIBLE_LOCK_CLAUSE, T as resolveExplicitPhysicalId, Tn as quotedOrDescribed, U as protectedReplacementAdvice, Un as isRetryableTransientError, Ut as AssetError, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, Wn as isTransientServerError, Wt as CdkdError, X as ElapsedBudgetRegistry, Xn as isMarkedNonRetryable, Xt as IntrinsicResolutionRefusalError, Y as startInterruptWatch, Yt as DynamicReferenceRegionAmbiguousError, Z as monotonicNowMs, Zn as isThrottlingError, _n as SHELL_ACTIVE_WHY, _t as hasCreatedBeforeFailure, an as ResourceTimeoutError, at as segmentAfterAnchor, b as isQuotableImportValue, bt as markAuxiliaryFailure, ct as createMaskedRetryLogger, d as prepareRemovalForUpdate, dt as maskerOrIdentity, en as MacroExpansionError, er as wrapMaskedAwsError, et as compositeIdSeparatorRefusal, f as removalWarning, ft as withDerivedNameMasks, g as assertRegionMatch, gn as SHELL_ACTIVE, gt as createdBeforeFailure, h as RESOURCE_NOT_FOUND, i as holdsSecretDerivedEntry, in as ProvisioningError, it as resourceTypeShown, jn as isUpdateUnsupportedError, jt as DEFAULT_STATE_PREFIX, k as deleteWithProtectionCompensation, kt as sanitizeRecoveryValue, l as withUnchangedSecretPrincipalLists, ln as StateError, lt as isSecretDerivedValue, m as withoutInjectedRemovals, mt as carryCreatedBeforeFailure, nt as logicalIdShown, on as ResourceUpdateNotSupportedError, ot as stateOrphanRecordRemedy, pn as normalizeAwsError, pt as RETRY_AUXILIARY_OWNER, qt as DependencyError, st as createMaskedLogSinks, tn as MalformedProducerRecordRefusalError, un as SynthesisError, ut as maskDeep, vn as UNSHOWABLE_VALUE, vt as isAuxiliaryFailure, wn as plainOrDescribed, x as normalizeAwsTagsToCfn, xn as isInertUnquoted, xt as markCreatedBeforeFailure, yn as commandHole, yt as isAuxiliaryMarkOf, zn as formatRetryClassificationSignals, zt as ambientCredentialConfig } from "./iam-policy-targets-DSDSdxXz.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-DUHDmEhz.js";
+import { t as getCdkdVersion } from "./version-WJhcQQ3m.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4803,6 +4803,11 @@ function refuseMalformedOperation(shownStack, where, op) {
 	const attempted = o["attemptedProperties"];
 	if (attempted !== void 0 && (typeof attempted !== "object" || attempted === null || Array.isArray(attempted))) fail("attemptedProperties", attempted, "an object when present");
 	if (o["oldResourceRetained"] !== void 0 && typeof o["oldResourceRetained"] !== "boolean") fail("oldResourceRetained", o["oldResourceRetained"], "a boolean when present");
+	if (o["replacementOrphaned"] !== void 0) {
+		if (!["create-first", "delete-first"].includes(o["replacementOrphaned"])) fail("replacementOrphaned", o["replacementOrphaned"], "create-first or delete-first when present");
+		if (o["changeType"] !== "UPDATE") refuseMalformed(shownStack, `${where}.replacementOrphaned is only valid on an UPDATE.`);
+	}
+	if (o["wasReplaced"] !== void 0 && typeof o["wasReplaced"] !== "boolean") fail("wasReplaced", o["wasReplaced"], "a boolean when present");
 	if (o["physicalIdRecoveredFromError"] !== void 0 && typeof o["physicalIdRecoveredFromError"] !== "boolean") fail("physicalIdRecoveredFromError", o["physicalIdRecoveredFromError"], "a boolean when present");
 	if (o["physicalIdRecoveredFromError"] !== void 0 && o["changeType"] !== "CREATE") refuseMalformed(shownStack, `${where}.physicalIdRecoveredFromError is only valid on a CREATE (got changeType ${kind(o["changeType"])}).`);
 	if (o["deletionPolicy"] !== void 0 && ![
@@ -4811,6 +4816,16 @@ function refuseMalformedOperation(shownStack, where, op) {
 		"Snapshot",
 		"RetainExceptOnCreate"
 	].includes(o["deletionPolicy"])) fail("deletionPolicy", o["deletionPolicy"], "one of Delete, Retain, Snapshot, RetainExceptOnCreate when present");
+	const replacedId = o["replacedPhysicalId"];
+	const replacedType = o["replacedResourceType"];
+	if (o["replacedResourceDeleted"] !== void 0 && replacedId === void 0) refuseMalformed(shownStack, `${where}.replacedResourceDeleted is only valid beside replacedPhysicalId.`);
+	if (replacedId !== void 0 || replacedType !== void 0) {
+		if (typeof replacedId !== "string" || replacedId === "") fail("replacedPhysicalId", replacedId, "a non-empty string beside replacedResourceType");
+		if (typeof replacedType !== "string" || replacedType === "") fail("replacedResourceType", replacedType, "a non-empty string beside replacedPhysicalId");
+		if (typeof o["physicalIdRecoveredFromError"] !== "boolean") refuseMalformed(shownStack, `${where}.replacedPhysicalId is only valid on a CREATE carrying physicalIdRecoveredFromError.`);
+		if (o["replacedResourceDeleted"] !== void 0 && o["replacedResourceDeleted"] !== true) fail("replacedResourceDeleted", o["replacedResourceDeleted"], "true when present");
+		if (replacedId === o["physicalId"]) refuseMalformed(shownStack, `${where}.replacedPhysicalId must differ from the op's own physicalId.`);
+	}
 	if (o["previousResourceType"] !== void 0 && typeof o["previousResourceType"] !== "string") fail("previousResourceType", o["previousResourceType"], "a string when present");
 }
 function kind(v) {
@@ -7674,6 +7689,10 @@ const CLASSIFIER_IDENTIFIER_FIELDS = /* @__PURE__ */ new Set([
 function isAuxiliaryAnchor(key, descriptor) {
 	return key === "logicalId" && descriptor.enumerable === false && descriptor.writable === false && typeof descriptor.value === "string" && descriptor.value.endsWith("/auxiliary");
 }
+const CREATED_BEFORE_FAILURE_MARK = Symbol.for("cdkd.createdBeforeFailure");
+function isCreatedBeforeFailureMark(key, descriptor) {
+	return key === CREATED_BEFORE_FAILURE_MARK && descriptor.enumerable === false && descriptor.writable === false && typeof descriptor.value === "object" && descriptor.value !== null && Object.isFrozen(descriptor.value);
+}
 function isPlainContainer(value) {
 	const proto = Object.getPrototypeOf(value);
 	return Array.isArray(value) ? proto === Array.prototype : proto === Object.prototype || proto === null;
@@ -7761,7 +7780,7 @@ function maskSecretsInError(error, secrets, extraMask) {
 			if (key === "message" || key === "cause" || key === "stack") continue;
 			const descriptor = Object.getOwnPropertyDescriptor(link, key);
 			if (!descriptor) continue;
-			descriptors[key] = typeof key === "string" && CLASSIFIER_IDENTIFIER_FIELDS.has(key) && typeof descriptor.value === "string" || isAuxiliaryAnchor(key, descriptor) ? descriptor : maskDescriptorValue(descriptor, maskText);
+			descriptors[key] = typeof key === "string" && CLASSIFIER_IDENTIFIER_FIELDS.has(key) && typeof descriptor.value === "string" || isAuxiliaryAnchor(key, descriptor) || isCreatedBeforeFailureMark(key, descriptor) ? descriptor : maskDescriptorValue(descriptor, maskText);
 			if (descriptors[key] !== descriptor) changed = true;
 		}
 		let cause = Object.getOwnPropertyDescriptor(link, "cause");
@@ -17975,6 +17994,7 @@ async function resolveGetAtt(getAtt, context) {
 	}
 	const resource = this.lookupResourceRecord(logicalId, "Fn::GetAtt", context);
 	if (!resource) throw markNonRetryable(/* @__PURE__ */ new Error(`Resource ${this.displayMasked(logicalId, context)} not found for Fn::GetAtt`));
+	recordSecretNamedRead(logicalId, void 0, context);
 	if (!(resource.resourceType === "AWS::EC2::VPC" && attributeName === "Ipv6CidrBlocks") && resource.attributes !== void 0) {
 		const storedValue = Object.hasOwn(resource.attributes, attributeName) ? resource.attributes[attributeName] : void 0;
 		const flatValue = isImpossibleEmptyStoredAttribute(resource.resourceType, attributeName, storedValue) ? void 0 : storedValue;
@@ -18028,6 +18048,7 @@ async function resolveGetAtt(getAtt, context) {
 		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${loggedLogicalId}, ${this.displayMasked(attributeName, context)}]: the nested stack ${quotedRender(loggedLogicalId, "'")} declares no output named ${quotedRender(this.displayMasked(this.outputNameLogText(attributeName, context), context), "'")}. Its outputs are ${this.displayMasked(declaredText, context)}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
 	}
 	const value = await this.constructWithStaleRecordHeal(resource, attributeName, context, logicalId);
+	recordSecretNamedRead(logicalId, value, context);
 	this.logger.debug(`Resolved Fn::GetAtt: ${this.logRender(logicalId, context)}.${this.logRender(attributeName, context)} resolved to ${this.logRender(stringifyAttributeForLog(attributeName, this.maskValueLeaves(value, context)), context, {
 		structured: isStructured(value),
 		redacted: isSensitiveAttributeName(attributeName)
@@ -18057,6 +18078,7 @@ function publicNoEchoTokens(context, producer) {
 	return tokens;
 }
 function noteAttributeSecrecy(logicalId, attributeName, value, context) {
+	recordSecretNamedRead(logicalId, value, context);
 	const declared = context.noEchoAttributeResources?.get(logicalId);
 	if ((declared === true || declared !== void 0 && declared.has(attributeName)) && context.recordedSecretValues) recordFreshNoEchoValuesIn(value, context.recordedSecretValues, void 0, this.publicNoEchoTokens(context, logicalId));
 	if (context.redactedAttributeReads !== void 0 && carriesSecretMask(value)) {
@@ -18070,6 +18092,17 @@ function noteAttributeSecrecy(logicalId, attributeName, value, context) {
 	}
 	return value;
 }
+function recordSecretNamedRead(logicalId, value, context) {
+	const bag = context.printingSecrets ?? context.recordedSecretValues;
+	if (bag === void 0 || context.secretNameNeedles === void 0) return;
+	const needles = context.secretNameNeedles(logicalId);
+	if (needles === void 0) return;
+	for (const needle of needles) recordLogOnlyValue(bag, needle);
+	for (const leaf of wholeStringLeavesOf(value)) for (const needle of needles) if (needle.length >= 4 && leaf.includes(needle)) {
+		recordLogOnlyValue(bag, leaf);
+		break;
+	}
+}
 function rejectPlaceholderArnAttribute(resource, attributeName, value, logicalId, context, healOutcome) {
 	if (!isStalePlaceholderArnAttribute(resource.resourceType, attributeName, value)) return;
 	throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: the recorded value ${quotedRender(stringifyValue(this.maskValueLeaves(value, context)), "\"")} is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. ` + this.staleRecordRemedy(healOutcome, context)));
@@ -20197,6 +20230,7 @@ async function resolveRef(logicalId, context, onParameter) {
 	const resource = this.lookupResourceRecord(logicalId, "Ref", context);
 	if (resource) {
 		const refValue = this.resolveRefValue(logicalId, resource, context);
+		recordSecretNamedRead(logicalId, refValue, context);
 		this.logger.debug(`Resolved Ref to resource: ${this.logRender(logicalId, context)} resolved to ${this.logRender(String(refValue), context)}`);
 		return refValue;
 	}
@@ -21997,7 +22031,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-AVCcoXnQ.js");
+			const { ASGProvider } = await import("./asg-provider-DedWRf1j.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -22103,7 +22137,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-DltlcDiQ.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-D1t9NgT-.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-DQwvPJXB.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-D2SmeISr.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -22926,6 +22960,10 @@ function withCurrentResourceSecrets(secrets, fn) {
 	const outer = boundSecretBagsStore.getStore() ?? [];
 	return boundSecretBagsStore.run([...outer, secrets], () => currentResourceSecretsStore.run(secrets, fn));
 }
+function withPrintingSecrets(secrets, fn) {
+	const outer = boundSecretBagsStore.getStore() ?? [];
+	return boundSecretBagsStore.run([...outer, secrets], fn);
+}
 function getCurrentResourceSecrets() {
 	return currentResourceSecretsStore.getStore();
 }
@@ -26931,6 +26969,7 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 		...parameterValues && { parameters: parameterValues },
 		...conditions && { conditions }
 	}, stackName);
+	context.printingSecrets = /* @__PURE__ */ new Map();
 	const refuseMaskedOutputReads = (outputKey, ownReads) => {
 		const added = ownReads.filter((read) => read.kind === "ref-state-key");
 		if (added.length === 0) return;
@@ -28324,7 +28363,7 @@ function isTypeChangeOp(op) {
 	return stamped !== void 0 && stamped !== op.resourceType || recorded !== void 0 && recorded !== op.resourceType;
 }
 function isReplacementOp(op) {
-	return op.changeType === "UPDATE" && op.previousState?.physicalId !== void 0 && (op.previousState.physicalId !== op.physicalId || isTypeChangeOp(op) || equalIdNamesDifferentResources({
+	return op.changeType === "UPDATE" && op.previousState?.physicalId !== void 0 && (op.previousState.physicalId !== op.physicalId && op.wasReplaced !== false || isTypeChangeOp(op) || equalIdNamesDifferentResources({
 		resourceType: op.resourceType,
 		physicalId: op.physicalId,
 		oldProperties: op.previousState.properties,
@@ -28385,14 +28424,17 @@ function classifyRollbackOp(op, stateResources, orphanLogicalIds) {
 	if (op.previousState && deepEqual$1(current.properties, op.previousState.properties)) return "skip-already-done";
 	return "revert";
 }
-function classifyFailedOp(op, stateResources) {
+function classifyFailedOp(op, stateResources, siblings = []) {
 	if (op.changeType === "DELETE") return "skip-failed-noop";
 	const current = stateResources[op.logicalId];
 	if (op.changeType === "CREATE") {
 		if (!op.physicalId) return "skip-failed-unknown";
 		if (op.physicalIdRecoveredFromError === false) return "skip-failed-superseded";
 		if (op.physicalIdRecoveredFromError === true) {
-			if (current) return current.physicalId === op.physicalId ? "skip-failed-noop" : "skip-failed-mismatch";
+			if (current) {
+				if (current.physicalId === op.physicalId) return "skip-failed-noop";
+				if (!isReplacedRecord(op, current)) return "skip-failed-mismatch";
+			}
 			if (stateHoldsPhysicalId(stateResources, op.resourceType, op.physicalId)) return "skip-failed-noop";
 			const orphanPolicy = effectiveDeletionPolicy(op.resourceType, op.deletionPolicy, op.attemptedProperties);
 			if (orphanPolicy === "Retain") return "orphan-failed-create-retain";
@@ -28407,9 +28449,25 @@ function classifyFailedOp(op, stateResources) {
 		return "delete-failed-create";
 	}
 	if (!current || !op.previousState) return "skip-failed-absent";
+	if (op.replacementOrphaned !== void 0 || replacementNeverSwapped(op, siblings)) return current.physicalId === op.physicalId && (op.replacementOrphaned === "delete-first" || replacedResourceDeleted(op, siblings)) ? "skip-failed-replaced-deleted" : "skip-failed-noop";
 	if (isTypeChangeOp(op)) return "skip-failed-type-change";
 	return "revert-failed-update";
 }
+function isReplacementOrphan(op) {
+	return op.changeType === "CREATE" && op.replacedPhysicalId !== void 0;
+}
+function isReplacedRecord(op, record) {
+	return isReplacementOrphan(op) && record !== void 0 && record.physicalId === op.replacedPhysicalId && record.resourceType === op.replacedResourceType;
+}
+function failedOpOwnRecord(op, stateResources) {
+	return isReplacementOrphan(op) ? void 0 : stateResources[op.logicalId];
+}
+function replacementNeverSwapped(op, siblings) {
+	return siblings.some((s) => s !== op && isReplacementOrphan(s) && s.logicalId === op.logicalId && s.replacedPhysicalId === op.physicalId);
+}
+function replacedResourceDeleted(op, siblings) {
+	return siblings.some((s) => s !== op && isReplacementOrphan(s) && s.logicalId === op.logicalId && s.replacedPhysicalId === op.physicalId && s.replacedResourceDeleted === true);
+}
 function stateHoldsPhysicalId(stateResources, resourceType, physicalId) {
 	return Object.values(stateResources).some((r) => r?.resourceType === resourceType && r.physicalId === physicalId);
 }
@@ -28438,8 +28496,8 @@ function isJournaledOrphan(op) {
 function planFailedOps(failedOps, stateResources) {
 	return failedOps.map((op) => ({
 		op,
-		action: classifyFailedOp(op, stateResources),
-		effectiveProvisionedBy: effectiveProvisionedBy(stateResources[op.logicalId], op.provisionedBy)
+		action: classifyFailedOp(op, stateResources, failedOps),
+		effectiveProvisionedBy: effectiveProvisionedBy(failedOpOwnRecord(op, stateResources), op.provisionedBy)
 	}));
 }
 function planRollback(operations, stateResources, orphanLogicalIds = /* @__PURE__ */ new Set()) {
@@ -28913,6 +28971,17 @@ async function replayReverseReplacement(s) {
 	});
 	const newCopyClaimed = inlinePolicyWriters.claimedFor(op.resourceType, op.logicalId, stateResources);
 	let deletedNewFirst = false;
+	const recreateCleanup = {
+		op,
+		oldType,
+		provider: createProvider,
+		properties: prev.properties,
+		deletionPolicy: effectiveDeletionPolicy(oldType, prev.deletionPolicy, prev.properties),
+		stateResources,
+		region: ctx.region,
+		logger,
+		mask
+	};
 	let createResult;
 	try {
 		createResult = await createWithRollbackRetry(createProvider, () => inOriginalPrefix(() => withCurrentResourceSecrets(secrets, () => createProvider.create(op.logicalId, oldType, replayCreateProps(), replayingStateCreateContext(secrets)))), op.logicalId, logger, isInterrupted, mask, {
@@ -28920,8 +28989,9 @@ async function replayReverseReplacement(s) {
 			interruptedMessage: "Rollback interrupted while waiting out the name cooldown"
 		});
 	} catch (createError) {
+		const deletedMade = await deleteMarkedRecreate(createError, recreateCleanup);
 		const msg = createError instanceof Error ? createError.message : String(createError);
-		if (!isNameCollisionErrorFrom(createError, op.logicalId)) throw createError;
+		if (!isNameCollisionErrorFrom(createError, op.logicalId) || deletedMade) throw createError;
 		const holder = inOriginalPrefix(() => reverseReplacementNewHoldsName({
 			oldResourceType: oldType,
 			newResourceType: op.resourceType,
@@ -28966,6 +29036,7 @@ async function replayReverseReplacement(s) {
 				interruptedMessage: "Rollback interrupted while waiting for the old name to release"
 			});
 		} catch (recreateError) {
+			await deleteMarkedRecreate(recreateError, recreateCleanup);
 			throw new Error(mask(`Failed to re-create the old ${safe(op.logicalId)} after the new resource (${mask(current.physicalId)}) was already deleted: ${displaySafe(recreateError instanceof Error ? recreateError.message : String(recreateError))}. The resource is now absent — fix forward by re-deploying the stack.`), { cause: maskSecretsInError(recreateError instanceof Error ? recreateError : void 0, secrets) });
 		}
 	}
@@ -29046,6 +29117,31 @@ async function replayReverseReplacement(s) {
 		...adoptedLiveNewResource && { reason: mask("The re-create returned the live new resource instead of re-creating the old one (its Create API is name-idempotent), so the replacement was NOT fully reversed: the old resource's original properties may not have been re-applied. Inspect it with `cdkd drift` and run `cdkd deploy` to reconcile.") }
 	});
 }
+async function deleteMarkedRecreate(error, s) {
+	const madeId = createdBeforeFailure(error, s.op.logicalId, s.oldType);
+	if (madeId === void 0) return false;
+	const shown = `${shownLogicalId(s.op.logicalId)} (${refusalResourceType(s.oldType)})`;
+	const id = s.mask(madeId);
+	if (Object.values(s.stateResources).some((r) => r?.resourceType === s.oldType && r.physicalId === madeId)) return false;
+	if (s.deletionPolicy === "Retain" || s.deletionPolicy === "Snapshot") {
+		s.logger.warn(safeMsg`  Rollback: the failed re-create of ${shown} made ${id} before failing; ` + safeMsg`it is left in AWS (DeletionPolicy: ${s.deletionPolicy}) and no record holds it — delete it yourself if it is not needed`);
+		return false;
+	}
+	s.logger.info(safeMsg`  Rollback: deleting ${id}, which the failed re-create of ${shown} made before failing`);
+	let failure;
+	try {
+		const outcome = await s.provider.delete(s.op.logicalId, madeId, s.oldType, s.properties, {
+			expectedRegion: s.region,
+			deletionPolicy: "Delete"
+		});
+		failure = deleteSkipReason(outcome);
+	} catch (deleteError) {
+		failure = deleteError instanceof Error ? deleteError.message : String(deleteError);
+	}
+	if (failure === void 0) return true;
+	s.logger.warn(safeMsg`  Rollback: could not delete ${id}, which the failed re-create of ${shown} made before ` + safeMsg`failing (${s.mask(failure)}); no record holds it — delete it yourself`);
+	return false;
+}
 
 //#endregion
 //#region src/deployment/stack-records-scope.ts
@@ -29245,7 +29341,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 			break;
 		}
 		const op = failedOps[i];
-		const action = classifyFailedOp(op, stateResources);
+		const action = classifyFailedOp(op, stateResources, failedOps);
 		const secrets = /* @__PURE__ */ new Map();
 		const opMasker = createOpMasker(logger, secrets);
 		const mask = opMasker.mask;
@@ -29267,6 +29363,10 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 					logger.warn(safeMsg`  Rollback: Skipping failed CREATE of ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}) — it recorded ${mask(String(op.physicalId))}, which is not the resource state tracks under this id; manual attention may be required`);
 					recordRollbackSkip(skipScope, op, "The failed CREATE recorded a physical id other than the one state now tracks under this logical id, so the rollback left it as it is; manual attention may be required.");
 					break;
+				case "skip-failed-replaced-deleted":
+					logger.warn(safeMsg`  Rollback: Skipping failed UPDATE of ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}) — its replacement deleted the old resource ${mask(String(op.physicalId))} before the new one's create failed, so there is nothing to revert` + (options.forDestroy === true ? "; the destroy drops its record with the stack" : "; state still records it, and a deploy whose template still replaces it creates it again"));
+					recordRollbackSkip(skipScope, op, "The failed UPDATE was a replacement that deleted the old resource before its create failed, so there is nothing to revert it onto; state still records the deleted resource.");
+					break;
 				case "skip-failed-superseded":
 					logger.warn(safeMsg`  Rollback: Skipping failed CREATE of ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}) — it created ${mask(String(op.physicalId))} before failing, and a later deploy or rollback may own a resource under that id now; if it is not in use, delete it manually`);
 					recordRollbackSkip(skipScope, op, "The failed CREATE created its resource before failing, but a later deploy or rollback may own a resource under that id now, so the rollback left it as it is; manual attention may be required.");
@@ -29284,7 +29384,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 					recordRollbackSkip(skipScope, op, `The failed UPDATE was a Type change (${String(op.previousState?.resourceType)} -> ${String(op.resourceType)}), which is a replacement, and its remote state is unknown, so it cannot be reverted in place.`);
 					break;
 				case "orphan-failed-create-retain": {
-					const failedCreateRecord = stateResources[op.logicalId];
+					const failedCreateRecord = failedOpOwnRecord(op, stateResources);
 					const orphanProvisionedBy = effectiveProvisionedBy(failedCreateRecord, op.provisionedBy);
 					createRollbackRoute = orphanProvisionedBy;
 					if (failedCreateRecord) {
@@ -29296,7 +29396,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						result.orphaned.push(orphaned);
 						options.onOrphan?.(orphaned);
 					}
-					delete stateResources[op.logicalId];
+					if (!isReplacementOrphan(op)) delete stateResources[op.logicalId];
 					await noteRetainedResource(op.resourceType, op.logicalId);
 					logger.info(`  Rollback: leaving partially-created ${safe(op.logicalId)} (${safe(op.resourceType)}) in AWS (DeletionPolicy: Retain)` + (failedCreateRecord ? " — removed from state" : " — it was never in state"));
 					await options.afterOp?.(op.logicalId);
@@ -29312,7 +29412,8 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 				}
 				case "delete-failed-create":
 				case "delete-failed-create-with-final-snapshot": {
-					const deleteProvisionedBy = effectiveProvisionedBy(stateResources[op.logicalId], op.provisionedBy);
+					const failedCreateRecord = failedOpOwnRecord(op, stateResources);
+					const deleteProvisionedBy = effectiveProvisionedBy(failedCreateRecord, op.provisionedBy);
 					createRollbackRoute = deleteProvisionedBy;
 					const snapshotPolicy = action === "delete-failed-create-with-final-snapshot";
 					const takeFinalSnapshot = snapshotPolicy && ctx.skipFinalSnapshot !== true;
@@ -29330,7 +29431,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
 						...ctx.skipFinalSnapshot === true && { skipFinalSnapshot: true },
 						deletionPolicy: snapshotPolicy ? "Snapshot" : "Delete",
-						recordedAttributes: stateResources[op.logicalId]?.attributes
+						recordedAttributes: failedCreateRecord?.attributes
 					});
 					throwIfDeleteSkipped(failedCreateDelete, op.logicalId, op.physicalId, "while deleting the partially-created resource", {
 						ctx,
@@ -29339,7 +29440,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						provisionedBy: deleteRoutedVia,
 						mask
 					});
-					delete stateResources[op.logicalId];
+					if (!isReplacementOrphan(op)) delete stateResources[op.logicalId];
 					await options.afterOp?.(op.logicalId);
 					ctx.recordEvent?.({
 						eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
@@ -29439,7 +29540,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 				error: maskedRollbackEventError(revertError, mask)
 			});
 		}
-		inlinePolicyWriters.noteOutcome(op, action === "skip-failed-noop" || action === "skip-failed-mismatch" || action === "skip-failed-superseded" || ownRecord(stateResources, op.logicalId) !== recordBefore);
+		inlinePolicyWriters.noteOutcome(op, action === "skip-failed-noop" || action === "skip-failed-mismatch" || action === "skip-failed-superseded" || action === "skip-failed-replaced-deleted" || ownRecord(stateResources, op.logicalId) !== recordBefore || isReplacementOrphan(op) && !pending.has(op) && (action === "delete-failed-create" || action === "delete-failed-create-with-final-snapshot" || action === "orphan-failed-create-retain"));
 	}
 	if (result.interrupted) await restoreHeldInlinePolicies(inlinePolicyWriters, stateResources, stackName, ctx, result, { refuseAll: true });
 	if (emitEnvelope) ctx.recordEvent?.({
@@ -29952,11 +30053,14 @@ async function loadJournaledOrphans(stateBackend, stackName, region, rollbackOrp
 	for (let s = segments.length - 1; s >= 0; s--) {
 		const segment = segments[s];
 		if (segment.reason === "nested-pending-parent") continue;
-		const ops = splitImportedOps(segment.failedOperations ?? [], segment).replay.filter(isJournaledOrphan);
+		const replay = splitImportedOps(segment.failedOperations ?? [], segment).replay;
+		const ops = replay.filter(isJournaledOrphan);
 		if (ops.length === 0) continue;
+		const companions = replay.filter((op) => op.changeType === "UPDATE" && replacementNeverSwapped(op, ops));
 		out.push({
 			segment,
-			ops
+			ops,
+			...companions.length > 0 && { companions }
 		});
 		count += ops.length;
 	}
@@ -29977,14 +30081,16 @@ async function deleteJournaledOrphans(orphans, stateResources, stackName, ctx, o
 		handled: []
 	};
 	const inlinePolicyWriters = new RollbackInlinePolicyWriters();
-	for (const { segment, ops } of orphans.segments) {
+	for (const { segment, ops: orphanOps, companions } of orphans.segments) {
 		if (options.isInterrupted?.()) {
 			total.interrupted = true;
 			break;
 		}
+		const ops = [...companions ?? [], ...orphanOps];
 		const replay = () => withStackName(stackName, () => replayFailedOperations(ops, stateResources, stackName, ctx, {
 			emitEnvelope: false,
 			inlinePolicyWriters,
+			forDestroy: true,
 			...options.isInterrupted && { isInterrupted: options.isInterrupted }
 		}));
 		const result = segment.skipPrefix === void 0 ? await replay() : await withSkipPrefix(segment.skipPrefix, replay);
@@ -30050,7 +30156,11 @@ async function settleJournaledOrphansOnSuccess(args) {
 	}
 	const keptOps = new Set(kept.map(({ op }) => op));
 	const skipped = all.filter(({ op }) => !keptOps.has(op) && op.physicalIdRecoveredFromError === false).length;
-	const cleared = all.filter(({ op }) => !keptOps.has(op));
+	const clearedOrphans = all.filter(({ op }) => !keptOps.has(op));
+	const cleared = [...clearedOrphans, ...orphans.segments.flatMap(({ segment, companions }) => (companions ?? []).filter((c) => replacementNeverSwapped(c, clearedOrphans.filter((o) => o.segment === segment).map((o) => o.op))).map((op) => ({
+		segment,
+		op
+	})))];
 	const stripCleared = cleared.length === 0 ? void 0 : async () => {
 		try {
 			await stateBackend.dropRollbackJournalFailedOperations(stackName, region, (op, segment) => isHandledOrphan(cleared, segment, op));
@@ -30099,7 +30209,7 @@ async function applySuccessRule(orphans, stateResources, deployLogicalIds, forei
 			tracked.add(op);
 			continue;
 		}
-		if (Object.prototype.hasOwnProperty.call(stateResources, op.logicalId) || deployLogicalIds.has(op.logicalId)) {
+		if (Object.prototype.hasOwnProperty.call(stateResources, op.logicalId) && !isReplacedRecord(op, stateResources[op.logicalId]) || deployLogicalIds.has(op.logicalId)) {
 			op.physicalIdRecoveredFromError = false;
 			continue;
 		}
@@ -30269,7 +30379,7 @@ async function performRollback(completedOperations, stateResources, stackName, p
 	const orphanIndexes = [];
 	const orphanOps = [];
 	failedOperations.forEach((op, i) => {
-		if (!isJournaledOrphan(op)) return;
+		if (!isJournaledOrphan(op) && !(op.changeType === "UPDATE" && replacementNeverSwapped(op, failedOperations))) return;
 		orphanIndexes.push(i);
 		orphanOps.push({ ...op });
 	});
@@ -31062,7 +31172,88 @@ async function readReaderForFreshNoEchoCeiling(logicalId, currentResource, secre
 	}
 }
 function maskForResource(logicalId, text) {
-	return maskSecretsInText(text, this.perResourceSecrets.get(logicalId) ?? EMPTY_SECRETS);
+	return maskSecretsInText(text, this.printingSecretsFor(logicalId) ?? EMPTY_SECRETS);
+}
+function secretNameNeedlesOf(logicalId, record, secrets, options) {
+	const physicalId = typeof record?.physicalId === "string" && record.physicalId !== "" ? record.physicalId : void 0;
+	const bag = secrets !== void 0 && hasMaskableValues(secrets) ? secrets : void 0;
+	const mask = (text) => bag === void 0 ? text : maskSecretsInText(text, bag);
+	const unresolved = (value) => value.includes("{{resolve:") || value === "***";
+	const named = {
+		resourceType: record?.resourceType,
+		properties: record?.properties,
+		logicalId
+	};
+	const needles = /* @__PURE__ */ new Set();
+	const add = (needle) => {
+		if (typeof needle === "string" && needle !== "") needles.add(needle);
+	};
+	for (const [raw, derived] of secretDerivedNamePairs({
+		...named,
+		physicalIds: []
+	})) if (typeof raw === "string" && !unresolved(raw) && isSecretDerivedValue(raw, mask)) add(derived);
+	for (const [raw, spelling] of secretDerivedNamePairs({
+		...named,
+		physicalIds: [physicalId ?? "cdkd-no-physical-id-yet"]
+	})) {
+		if (!isSecretDerivedValue(raw, mask)) continue;
+		if (unresolved(raw)) {
+			if (physicalId === void 0) continue;
+			add(spelling);
+		} else {
+			add(raw);
+			if (raw.toLowerCase() !== raw && raw.length >= 4) add(raw.toLowerCase());
+		}
+	}
+	const properties = record?.properties;
+	const path = properties !== null && typeof properties === "object" && Object.hasOwn(properties, "Path") ? properties["Path"] : void 0;
+	if (physicalId !== void 0 && isSecretDerivedValue(path, mask)) add(physicalId);
+	const embedded = options === void 0 ? secrets : options.embedded;
+	const embeddedBag = embedded !== void 0 && hasMaskableValues(embedded) ? embedded : void 0;
+	if (embeddedBag !== void 0 && physicalId !== void 0) {
+		for (const needle of printingCorpusOf(embeddedBag).keys()) if (needle !== "" && (needle === physicalId || needle.length >= 4 && physicalId.includes(needle))) add(needle);
+	}
+	return needles.size > 0 ? needles : void 0;
+}
+function secretNameBagFor(logicalId) {
+	let bag = this.secretNameNeedles.get(logicalId);
+	if (bag === void 0) {
+		bag = /* @__PURE__ */ new Map();
+		this.secretNameNeedles.set(logicalId, bag);
+	}
+	return bag;
+}
+function noteSecretNamedRecord(logicalId, record) {
+	const needles = secretNameNeedlesOf(logicalId, record, this.namingSecretsFor(logicalId), { embedded: this.perResourceSecrets.get(logicalId) });
+	if (needles === void 0) return void 0;
+	const registry = this.secretNameBagFor(logicalId);
+	for (const needle of needles) recordLogOnlyValue(registry, needle);
+	return needles;
+}
+function namingSecretsFor(logicalId) {
+	const own = this.perResourceSecrets.get(logicalId);
+	const noEcho = this.fingerprintNoEchoValues;
+	if (!hasMaskableValues(noEcho)) return own;
+	return unionOfSecretBags([own, noEcho]);
+}
+function noteSecretNamedReads(logicalId, record, resources) {
+	const leaves = [...wholeStringLeavesOf(record?.properties)].filter((leaf) => leaf !== "");
+	if (leaves.length === 0) return;
+	for (const [otherId, other] of Object.entries(resources)) {
+		if (otherId === logicalId) continue;
+		const needles = secretNameNeedlesOf(otherId, other, this.namingSecretsFor(otherId), { embedded: this.perResourceSecrets.get(otherId) });
+		if (needles === void 0) continue;
+		const read = [...needles].filter((needle) => leaves.some((leaf) => leaf === needle || needle.length >= 4 && leaf.includes(needle)));
+		if (read.length === 0) continue;
+		const registry = this.secretNameBagFor(logicalId);
+		for (const needle of read) recordLogOnlyValue(registry, needle);
+	}
+}
+function printingSecretsFor(logicalId) {
+	const secrets = this.perResourceSecrets.get(logicalId);
+	const registry = this.secretNameNeedles.get(logicalId);
+	if (!hasMaskableValues(registry)) return secrets;
+	return unionOfSecretBags([secrets, registry]);
 }
 function maskedRecordRemedyFor(reads, resources, causeScoped = false) {
 	const NESTED_STACK_RESOURCE_TYPE = "AWS::CloudFormation::Stack";
@@ -31184,6 +31375,7 @@ async function replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourc
 	const replaceSkipReason = deleteSkipReason(deleteResult);
 	if (replaceSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, replaceSkipReason, "during the --replace delete-first fallback"));
 	this.logger.info(`  ${green("✓")} Old resource deleted`);
+	this.oldDeletedBeforeCreate.add(logicalId);
 	this.logger.info(`  Re-creating ${logicalId}...`);
 	try {
 		return await withRetry(() => this.withRetry(() => withCurrentResourceSecrets(secrets, () => replaceProvider.create(logicalId, resourceType, replaceProps, createContext)), logicalId, void 0, void 0, replaceProvider), logicalId, {
@@ -31556,6 +31748,82 @@ function isRefusedBeforeApplying(error, logicalId) {
 	return false;
 }
 
+//#endregion
+//#region src/deployment/deploy-engine/resolver-context.ts
+function buildResolverContext(base, stackName) {
+	const recordedSecretValues = /* @__PURE__ */ new Map();
+	if (this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0) inheritNestedStackParameterAssociations(recordedSecretValues, this.options.inheritedSecrets);
+	return {
+		template: base.template,
+		resources: base.resources,
+		...base.parameters && Object.keys(base.parameters).length > 0 && { parameters: base.parameters },
+		...base.conditions && Object.keys(base.conditions).length > 0 && { conditions: base.conditions },
+		stateBackend: this.stateBackend,
+		stackName,
+		...this.exportIndexStore && { exportIndex: this.exportIndexStore },
+		recordedImports: this.recordedImports,
+		recordedOutputReads: this.recordedOutputReads,
+		attributeHealer: (logicalId, resource) => this.healStaleAttributes(logicalId, resource, stackName),
+		...this.options.inheritedSecrets && hasMaskableValues(this.options.inheritedSecrets) && { inheritedSecrets: this.options.inheritedSecrets },
+		recordedSecretValues,
+		noEchoAttributeResources: this.noEchoAttributeResources,
+		secretNameNeedles: (logicalId) => this.noteSecretNamedRecord(logicalId, Object.hasOwn(base.resources, logicalId) ? base.resources[logicalId] : void 0),
+		...base.redactedAttributeReads && { redactedAttributeReads: base.redactedAttributeReads }
+	};
+}
+function printNestedStackReadsOnly(context, resourceType) {
+	if (resourceType === "AWS::CloudFormation::Stack") context.printingSecrets = /* @__PURE__ */ new Map();
+}
+function getAttTargetOf(node) {
+	if (node === null || typeof node !== "object" || Array.isArray(node)) return void 0;
+	const getAtt = node["Fn::GetAtt"];
+	if (Array.isArray(getAtt) && typeof getAtt[0] === "string") return getAtt[0];
+	if (typeof getAtt === "string") return getAtt.split(".")[0];
+}
+function maskedInputSources(template, resources, conditions, stackName) {
+	const parameters = this.fingerprintParameters;
+	if (parameters === void 0) return void 0;
+	return {
+		template,
+		parameterInput: parameters.parameterInput,
+		conditions,
+		childTemplate: this.fingerprintChildTemplates,
+		resolve: async (node) => {
+			const { attributeHealer: _healer, ...base } = this.buildResolverContext({
+				template,
+				resources,
+				parameters: parameters.bound,
+				...conditions && { conditions }
+			}, stackName);
+			const context = {
+				...base,
+				recordedImports: [],
+				recordedOutputReads: [],
+				bestEffort: true,
+				skipDynamicReferences: true,
+				staleAttributeHeal: { phase: "probe" },
+				printingSecrets: /* @__PURE__ */ new Map()
+			};
+			const value = await this.resolver.resolve(structuredClone(node), context);
+			const secrets = context.recordedSecretValues;
+			const target = getAttTargetOf(node);
+			const targetSecrets = target === void 0 ? void 0 : this.perResourceSecrets.get(target);
+			if (targetSecrets !== void 0 && hasMaskableValues(targetSecrets)) {
+				const probe = { value };
+				const redacted = redactSecretsForState(probe, targetSecrets);
+				if (JSON.stringify(redacted) !== JSON.stringify(probe)) return {
+					value,
+					keepAsWritten: true
+				};
+			}
+			return {
+				value,
+				...secrets && { secrets }
+			};
+		}
+	};
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/create.ts
 async function provisionCreate(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
@@ -31570,7 +31838,12 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 		redactedAttributeReads: []
 	}, stackName);
 	if (context.recordedSecretValues) this.perResourceSecrets.set(logicalId, context.recordedSecretValues);
+	printNestedStackReadsOnly(context, resourceType);
 	const resolvedProps = await this.resolver.resolve(desiredProps, context);
+	this.noteSecretNamedRecord(logicalId, {
+		resourceType,
+		properties: resolvedProps
+	});
 	this.refuseRedactedAttributeReads(logicalId, resourceType, context);
 	this.perResourceTemplateProps.set(logicalId, desiredProps);
 	const fingerprintSources = template && this.maskedInputSources(template, stateResources, conditions, stackName);
@@ -34462,7 +34735,13 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	}, stackName);
 	const updateSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
 	this.perResourceSecrets.set(logicalId, updateSecrets);
+	printNestedStackReadsOnly(context, resourceType);
 	const resolvedProps = await this.resolver.resolve(desiredProps, context);
+	this.noteSecretNamedRecord(logicalId, {
+		resourceType,
+		physicalId: stateResources[logicalId]?.physicalId,
+		properties: resolvedProps
+	});
 	this.perResourceTemplateProps.set(logicalId, desiredProps);
 	this.perResourceResolvedType.set(logicalId, resourceType);
 	recordNestedStackParameterExpressions(updateSecrets, resourceType, resolvedProps, desiredProps);
@@ -34789,6 +35068,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			const recreateSkipReason = deleteSkipReason(recreateDeleteResult);
 			if (recreateSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, recreateSkipReason, `during ${recreateFlagName}`));
 			this.logger.info(`  ${green("✓")} Old resource deleted`);
+			this.oldDeletedBeforeCreate.add(logicalId);
 		}
 		this.logger.info(`  Creating new ${logicalId}...`);
 		createResult = await withRetry(() => this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replaceProvider.create(logicalId, resourceType, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replaceProvider), logicalId, {
@@ -34804,7 +35084,10 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 	} else {
 		this.logger.info(`  Creating new ${logicalId}...`);
 		let deletedOldFirst = lostWithParent !== void 0;
-		if (lostWithParent !== void 0) this.logger.info(safeMsg`  ${logicalId} went with ${lostWithParent}, which was destroyed and re-created under the same id: re-creating it`);
+		if (lostWithParent !== void 0) {
+			this.oldDeletedBeforeCreate.add(logicalId);
+			this.logger.info(safeMsg`  ${logicalId} went with ${lostWithParent}, which was destroyed and re-created under the same id: re-creating it`);
+		}
 		try {
 			createResult = await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replaceProvider.create(logicalId, resourceType, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replaceProvider);
 		} catch (createError) {
@@ -35009,6 +35292,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 				});
 				const fallbackSkipReason = deleteSkipReason(fallbackDeleteResult);
 				if (fallbackSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, fallbackSkipReason, "during the UPDATE-not-supported replacement"));
+				this.oldDeletedBeforeCreate.add(logicalId);
 			}
 			let retainedSurvivorReason;
 			let createResult;
@@ -35088,7 +35372,15 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 			captureProvider = replProvider;
 		} else throw updateError;
 	}
-	if (result.wasReplaced) this.logger.info(`Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`);
+	this.updateWasReplaced.set(logicalId, result.wasReplaced === true);
+	if (result.wasReplaced) {
+		this.noteSecretNamedRecord(logicalId, {
+			resourceType,
+			physicalId: result.physicalId,
+			properties: resolvedProps
+		});
+		this.logger.info(`Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`);
+	}
 	const dischargedByReplacement = result.wasReplaced === true && result.physicalId !== currentResource.physicalId;
 	const keepsParameterRefusal = !dischargedByReplacement && hasUnverifiableParameterRefusal(currentResource);
 	const carriedAttributes = result.attributes ?? (result.wasReplaced ? void 0 : currentResource.attributes);
@@ -35184,21 +35476,32 @@ async function provisionDelete(logicalId, change, stateResources, stackName, tem
 		const skipPrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
 		renderer.removeTask(logicalId);
 		this.logger.info(`${skipPrefix}${formatResourceLine("skipped", logicalId, resourceType, `skipped (${deleteSkipped})`)}`);
-		this.logger.warn(deleteSkippedMessage(logicalId, currentResource.physicalId, deleteSkipped, "while removing it from the template") + `. Its cdkd state record was KEPT, so the next 'cdkd deploy' re-attempts the delete. Repair the record first (for a nested stack it is the CHILD's own state, whose other resources may already be gone), or delete the resource by hand and drop the record.\nInspect it with: ${pasteableCommand("cdkd state show", [{
-			value: stackName,
-			hole: "stack"
-		}, {
-			flag: "--stack-region",
-			value: this.stackRegion,
-			hole: "region"
-		}]).command}\nDrop the record with: ${pasteableCommand("cdkd state orphan", [{
-			value: stackName,
-			hole: "stack"
-		}, {
+		const nested = resourceType === "AWS::CloudFormation::Stack";
+		const recordStack = nested ? nestedChildStackName(stackName, logicalId) : stackName;
+		const interrupted = nested && deleteSkipped.endsWith(" was interrupted");
+		const stackArg = {
+			value: recordStack,
+			hole: nested ? "child-stack" : "stack",
+			opts: { plainIdent: true }
+		};
+		this.logger.warn(deleteSkippedMessage(logicalId, currentResource.physicalId, deleteSkipped, "while removing it from the template") + ". Its cdkd state record was KEPT, so the next 'cdkd deploy' re-attempts the delete. Repair the record first (for a nested stack it is the CHILD's own state, whose other resources may already be gone), or delete the resource by hand and drop the record." + (interrupted ? " The commands name the child stack record. Its destroy was interrupted: re-run 'cdkd deploy' to resume it, and drop the child record only if that cannot finish, after deleting by hand what the child still holds (the inspect command with --show-nested lists every level; a child with nested stacks of its own has records under '<child>~<logicalId>' too, each needing the same drop)." : nested ? " The commands name the child stack record. Dropping it drops every record the child still has and nothing reaches those resources again, so first delete by hand what the child still holds (the inspect command with --show-nested lists every level; a child with nested stacks of its own has records under '<child>~<logicalId>' too, each needing the same drop). The next 'cdkd deploy' then removes this row." : " Keep '--resource' on the drop: without it the command drops the record of every resource in this still-deployed stack.") + `\nInspect it with: ${pasteableCommand("cdkd state show", [stackArg, {
 			flag: "--stack-region",
 			value: this.stackRegion,
 			hole: "region"
-		}]).command}`);
+		}]).command}\nDrop the record with: ${pasteableCommand("cdkd state orphan", [
+			stackArg,
+			{
+				flag: "--stack-region",
+				value: this.stackRegion,
+				hole: "region"
+			},
+			...nested ? [] : [{
+				flag: "--resource",
+				value: logicalId,
+				hole: "logicalId",
+				opts: { plainIdent: true }
+			}]
+		]).command}`);
 		if (counts) counts.deleteSkipped++;
 		return { deleteSkipped };
 	}
@@ -35343,10 +35646,13 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 	let updatePartial;
 	const physicalIdBeforeUpdate = stateResources[logicalId]?.physicalId;
 	const provisionedByBeforeUpdate = stateResources[logicalId]?.provisionedBy;
+	this.noteSecretNamedRecord(logicalId, stateResources[logicalId]);
+	if (change.changeType === "DELETE") this.noteSecretNamedReads(logicalId, stateResources[logicalId], stateResources);
+	const printingRegistry = this.secretNameBagFor(logicalId);
 	let nestedChildUnaddressed;
 	const deleteGuards = [];
 	try {
-		await withResourceDeadline(async () => {
+		await withPrintingSecrets(printingRegistry, () => withResourceDeadline(async () => {
 			try {
 				const { value: bodyResult, unaddressed } = await collectDeleteGuards(deleteGuards, () => collectNestedChildUnaddressed(() => this.provisionResourceBody(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress)));
 				deleteSkipped = bodyResult?.deleteSkipped;
@@ -35360,7 +35666,7 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 					logicalId,
 					resourceType: guard.resourceType,
 					...guard.provisionedBy && { provisionedBy: guard.provisionedBy },
-					...guard.physicalId && { physicalId: this.maskForResource(logicalId, guard.physicalId) },
+					...guard.physicalId && { physicalId: maskSecretsInText(guard.physicalId, this.perResourceSecrets.get(logicalId) ?? EMPTY_SECRETS) },
 					guard: guard.guard,
 					reason: guard.reason
 				});
@@ -35379,7 +35685,7 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 				});
 			},
 			onTimeout: (elapsedMs) => new ResourceTimeoutError(logicalId, resourceType, this.stackRegion, elapsedMs, operationKind, timeoutMs)
-		});
+		}));
 		if (counts && nestedChildUnaddressed) {
 			counts.deleteSkipped += nestedChildUnaddressed.deleteSkipped;
 			counts.updatePartial += nestedChildUnaddressed.updatePartial;
@@ -35436,7 +35742,7 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 			durationMs: Date.now() - resourceStartedAt,
 			error: extractDeploymentEventError(error)
 		});
-		throw new ProvisioningError(`Failed to ${change.changeType.toLowerCase()} resource ${logicalId}`, resourceType, logicalId, stateResources[logicalId]?.physicalId, error instanceof Error ? maskSecretsInError(error, this.perResourceSecrets.get(logicalId) ?? EMPTY_SECRETS) : void 0);
+		throw new ProvisioningError(`Failed to ${change.changeType.toLowerCase()} resource ${logicalId}`, resourceType, logicalId, stateResources[logicalId]?.physicalId, error instanceof Error ? maskSecretsInError(error, this.printingSecretsFor(logicalId) ?? EMPTY_SECRETS) : void 0);
 	} finally {
 		renderer.removeTask(logicalId);
 	}
@@ -35570,6 +35876,11 @@ var DagExecutor = class {
 
 //#endregion
 //#region src/deployment/deploy-engine/execute.ts
+const NO_REPLACEMENT_ORPHAN_TYPES = /* @__PURE__ */ new Set([
+	"AWS::CloudFormation::Stack",
+	"AWS::SQS::QueuePolicy",
+	"AWS::SNS::TopicPolicy"
+]);
 async function executeDeployment(template, currentState, changes, dag, executionLevels, stackName, outputsDigestSource, parameterValues, conditions, currentEtag, progress, migrationPending = false) {
 	const concurrency = this.options.concurrency;
 	this.deployChanges = changes;
@@ -35704,6 +36015,13 @@ async function executeDeployment(template, currentState, changes, dag, execution
 					const statePhysicalId = newResources[logicalId]?.physicalId ?? previousState?.physicalId;
 					if (refused && change.changeType === "CREATE" && statePhysicalId === void 0) throw provisionError;
 					const createdId = change.changeType === "CREATE" && statePhysicalId === void 0 ? createdBeforeFailure(provisionError, logicalId, change.resourceType) : void 0;
+					const heldRecord = newResources[logicalId] ?? previousState;
+					const replaced = change.changeType === "UPDATE" && !NO_REPLACEMENT_ORPHAN_TYPES.has(change.resourceType) && statePhysicalId !== void 0 && statePhysicalId !== "" && heldRecord?.physicalId === statePhysicalId ? heldRecord : void 0;
+					const replacementCreatedId = replaced ? createdBeforeFailure(provisionError, logicalId, change.resourceType) : void 0;
+					const orphanedBy = replaced !== void 0 && replacementCreatedId !== void 0 && replacementCreatedId !== replaced.physicalId ? {
+						record: replaced,
+						createdId: replacementCreatedId
+					} : void 0;
 					failedOperations.push({
 						logicalId,
 						changeType: change.changeType,
@@ -35715,6 +36033,20 @@ async function executeDeployment(template, currentState, changes, dag, execution
 							physicalIdRecoveredFromError: true,
 							deletionPolicy: journaledOrphanPolicy(this.extractTemplateAttributes(template, logicalId).deletionPolicy)
 						},
+						...orphanedBy !== void 0 && { replacementOrphaned: this.oldDeletedBeforeCreate.has(logicalId) ? "delete-first" : "create-first" },
+						...!refused && { attemptedProperties: this.attemptedResolvedProps.get(logicalId) }
+					});
+					if (orphanedBy !== void 0) failedOperations.push({
+						logicalId,
+						changeType: "CREATE",
+						resourceType: change.resourceType,
+						provisionedBy: "sdk",
+						physicalId: orphanedBy.createdId,
+						physicalIdRecoveredFromError: true,
+						deletionPolicy: journaledOrphanPolicy(this.extractTemplateAttributes(template, logicalId).deletionPolicy),
+						replacedPhysicalId: orphanedBy.record.physicalId,
+						replacedResourceType: orphanedBy.record.resourceType,
+						...this.oldDeletedBeforeCreate.has(logicalId) && { replacedResourceDeleted: true },
 						...!refused && { attemptedProperties: this.attemptedResolvedProps.get(logicalId) }
 					});
 					throw provisionError;
@@ -35728,6 +36060,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 					physicalId: newResources[logicalId]?.physicalId,
 					properties: newResources[logicalId]?.properties,
 					...change.changeType === "UPDATE" && { oldResourceRetained: this.retainedOldOnReplacement.has(logicalId) },
+					...change.changeType === "UPDATE" && this.updateWasReplaced.has(logicalId) && { wasReplaced: this.updateWasReplaced.get(logicalId) },
 					...change.changeType === "UPDATE" && previousState !== void 0 && { previousResourceType: previousState.resourceType }
 				});
 				saveStateAfterResource(logicalId);
@@ -35884,7 +36217,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			autoRollbackClean = autoRollbackJournaled && rollbackResult.failures === 0 && rollbackResult.skipped === 0;
 			if (rollbackResult.failures === 0 && rollbackResult.skipped > 0) {
 				this.logger.warn(safeMsg`The automatic rollback could not revert ${rollbackResult.skipped} operation(s) ` + `(see the warnings above; each is recorded as a ROLLBACK_RESOURCE_SKIPPED event).` + (autoRollbackJournaled ? ` The rollback journal keeps them.` : ""));
-				if (autoRollbackJournaled && this.options.parentStackInfo === void 0 && failedOperations.some((op) => op.changeType !== "DELETE")) this.logger.warn(safeMsg`The record of the operation that failed is kept too. Revert it with: ${pasteableCommand("cdkd rollback", [{
+				if (autoRollbackJournaled && this.options.parentStackInfo === void 0 && rollbackResult.remainingFailedOps.some((op) => op.changeType !== "DELETE")) this.logger.warn(safeMsg`The record of the operation that failed is kept too. Revert it with: ${pasteableCommand("cdkd rollback", [{
 					value: stackName,
 					hole: "stack"
 				}, { literal: "--revert-failed" }]).command}`);
@@ -36899,77 +37232,6 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 	}
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/resolver-context.ts
-function buildResolverContext(base, stackName) {
-	const recordedSecretValues = /* @__PURE__ */ new Map();
-	if (this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0) inheritNestedStackParameterAssociations(recordedSecretValues, this.options.inheritedSecrets);
-	return {
-		template: base.template,
-		resources: base.resources,
-		...base.parameters && Object.keys(base.parameters).length > 0 && { parameters: base.parameters },
-		...base.conditions && Object.keys(base.conditions).length > 0 && { conditions: base.conditions },
-		stateBackend: this.stateBackend,
-		stackName,
-		...this.exportIndexStore && { exportIndex: this.exportIndexStore },
-		recordedImports: this.recordedImports,
-		recordedOutputReads: this.recordedOutputReads,
-		attributeHealer: (logicalId, resource) => this.healStaleAttributes(logicalId, resource, stackName),
-		...this.options.inheritedSecrets && hasMaskableValues(this.options.inheritedSecrets) && { inheritedSecrets: this.options.inheritedSecrets },
-		recordedSecretValues,
-		noEchoAttributeResources: this.noEchoAttributeResources,
-		...base.redactedAttributeReads && { redactedAttributeReads: base.redactedAttributeReads }
-	};
-}
-function getAttTargetOf(node) {
-	if (node === null || typeof node !== "object" || Array.isArray(node)) return void 0;
-	const getAtt = node["Fn::GetAtt"];
-	if (Array.isArray(getAtt) && typeof getAtt[0] === "string") return getAtt[0];
-	if (typeof getAtt === "string") return getAtt.split(".")[0];
-}
-function maskedInputSources(template, resources, conditions, stackName) {
-	const parameters = this.fingerprintParameters;
-	if (parameters === void 0) return void 0;
-	return {
-		template,
-		parameterInput: parameters.parameterInput,
-		conditions,
-		childTemplate: this.fingerprintChildTemplates,
-		resolve: async (node) => {
-			const { attributeHealer: _healer, ...base } = this.buildResolverContext({
-				template,
-				resources,
-				parameters: parameters.bound,
-				...conditions && { conditions }
-			}, stackName);
-			const context = {
-				...base,
-				recordedImports: [],
-				recordedOutputReads: [],
-				bestEffort: true,
-				skipDynamicReferences: true,
-				staleAttributeHeal: { phase: "probe" }
-			};
-			const value = await this.resolver.resolve(structuredClone(node), context);
-			const secrets = context.recordedSecretValues;
-			const target = getAttTargetOf(node);
-			const targetSecrets = target === void 0 ? void 0 : this.perResourceSecrets.get(target);
-			if (targetSecrets !== void 0 && hasMaskableValues(targetSecrets)) {
-				const probe = { value };
-				const redacted = redactSecretsForState(probe, targetSecrets);
-				if (JSON.stringify(redacted) !== JSON.stringify(probe)) return {
-					value,
-					keepAsWritten: true
-				};
-			}
-			return {
-				value,
-				...secrets && { secrets }
-			};
-		}
-	};
-}
-
 //#endregion
 //#region src/deployment/label-routing.ts
 function deriveLabelRouting(change, existingState, registry, forceCcApi = false) {
@@ -37190,6 +37452,7 @@ var DeployEngine = class {
 	recordedOutputReads = [];
 	perResourceSecrets = /* @__PURE__ */ new Map();
 	noEchoAttributeResources = /* @__PURE__ */ new Map();
+	secretNameNeedles = /* @__PURE__ */ new Map();
 	perResourceTemplateProps = /* @__PURE__ */ new Map();
 	perResourceResolvedType = /* @__PURE__ */ new Map();
 	fingerprintNoEchoValues = void 0;
@@ -37209,6 +37472,8 @@ var DeployEngine = class {
 	recreatedUnderSameId = /* @__PURE__ */ new Set();
 	restoredLostChildren = /* @__PURE__ */ new Set();
 	updatesThatSentNothing = /* @__PURE__ */ new Set();
+	updateWasReplaced = /* @__PURE__ */ new Map();
+	oldDeletedBeforeCreate = /* @__PURE__ */ new Set();
 	healBaseline = {};
 	deployChanges = /* @__PURE__ */ new Map();
 	stackRecordsView = void 0;
@@ -37242,6 +37507,7 @@ var DeployEngine = class {
 		this.recordedOutputReads = [];
 		this.perResourceSecrets = /* @__PURE__ */ new Map();
 		this.noEchoAttributeResources = /* @__PURE__ */ new Map();
+		this.secretNameNeedles = /* @__PURE__ */ new Map();
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
 		this.constructPathTemplate = void 0;
 		this.perResourceResolvedType = /* @__PURE__ */ new Map();
@@ -37260,6 +37526,8 @@ var DeployEngine = class {
 		this.recreatedUnderSameId = /* @__PURE__ */ new Set();
 		this.restoredLostChildren = /* @__PURE__ */ new Set();
 		this.updatesThatSentNothing = /* @__PURE__ */ new Set();
+		this.updateWasReplaced = /* @__PURE__ */ new Map();
+		this.oldDeletedBeforeCreate = /* @__PURE__ */ new Set();
 		this.healBaseline = {};
 		this.deployChanges = /* @__PURE__ */ new Map();
 		this.inlinePolicyWriters = /* @__PURE__ */ new Map();
@@ -37357,7 +37625,7 @@ var DeployEngine = class {
 		} catch {}
 	}
 	maskSecretsInEvent(event) {
-		const secrets = event.logicalId ? this.perResourceSecrets.get(event.logicalId) : void 0;
+		const secrets = event.logicalId ? this.printingSecretsFor(event.logicalId) : void 0;
 		if (!secrets || !hasMaskableValues(secrets)) return event;
 		const next = { ...event };
 		if (next.error?.message) next.error = {
@@ -37433,6 +37701,11 @@ DeployEngine.prototype.refuseRedactedAttributeReads = refuseRedactedAttributeRea
 DeployEngine.prototype.allRecordedSecrets = allRecordedSecrets;
 DeployEngine.prototype.readReaderForFreshNoEchoCeiling = readReaderForFreshNoEchoCeiling;
 DeployEngine.prototype.maskForResource = maskForResource;
+DeployEngine.prototype.secretNameBagFor = secretNameBagFor;
+DeployEngine.prototype.noteSecretNamedRecord = noteSecretNamedRecord;
+DeployEngine.prototype.printingSecretsFor = printingSecretsFor;
+DeployEngine.prototype.namingSecretsFor = namingSecretsFor;
+DeployEngine.prototype.noteSecretNamedReads = noteSecretNamedReads;
 DeployEngine.prototype.kickOffObservedCapture = kickOffObservedCapture;
 DeployEngine.prototype.drainObservedCaptures = drainObservedCaptures;
 DeployEngine.prototype.buildObservedCaptureSiblings = buildObservedCaptureSiblings;
@@ -37457,5 +37730,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { resourcesNamingDeclaredParameter as $, dynamicReferenceTokens as $a, withoutSilentDropProperties as $i, reEnableInstanceApiTermination as $n, resolveDockerContextDirectory as $o, malformedExportSourceWarning as $r, absoluteAssemblyPathEscape as $s, displayTextOrWithheld as $t, resolveDynamoDbDeleteBudgetClock as A, DagBuilder as Aa, refuseMalformedResourceEntriesForImport as Ai, definedAttributes as An, orphansAfterRollback as Ao, keepsSecretReferenceToken as Ar, resolveUseCdkBootstrapAssets as As, resolveReplacementOldType as At, getPriorAttempts as B, printingCorpusOf as Ba, refuseMalformedState as Bi, ccProtectionRegistryTypes as Bn, rewriteTemplateAssetReferences as Bo, STATE_REGION_DIVERGED as Br, decodeListingKey as Bs, isFinalSnapshotError as Bt, perType as C, prefetchCreateOnlyPropertyPaths as Ca, refuseMalformedOrphansForOrphan as Ci, DBPROXY_TAGS_WHAT as Cn, exportNamesCarriedFrom as Co, isUnboundTemplateParameter as Cr, loadCdkJson as Cs, getStackRecords as Ct, beginDeleteWait as D, canonicalLambdaFunctionName as Da, refuseMalformedResourceEntries as Di, refuseMalformedDesiredTags as Dn, importableOutputKeys as Do, carriesDynamicReference as Dr, resolveSkipPrefix as Ds, isJournaledOrphan as Dt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as E, withRetry as Ea, refuseMalformedResourceAttributesForOrphan as Ei, readTagList as En, hasUnverifiableParameterRefusal as Eo, isImpossibleEmptyStoredAttribute as Er, resolveCaptureObservedState as Es, demoteSupersededOrphans as Et, waitForIndexesSettled as F, carryLogOnlyValues as Fa, refuseMalformedResourcePropertiesForExport as Fi, wouldReturnToSdkProvider as Fn, stringifyValue as Fo, parseWebACLArn as Fr, CFN_TEMPLATE_URL_LIMIT as Fs, PRE_DELETE_SNAPSHOT_TYPES as Ft, cyan as G, errorCauseChain as Ga, repairMalformedResourcePropertiesForReadOnly as Gi, withIndeterminateGuard as Gn, getBootstrapMarkerKey as Go, displayLogicalId as Gr, AssemblyReader as Gs, redactedDeleteAddressFields as Gt, formatResourceLine as H, recordLogOnlyValue as Ha, repairMalformedOrphansForReadOnly as Hi, UNSPECIFIED_SKIP_REASON as Hn, BOOTSTRAP_MARKER_PREFIX as Ho, UNREADABLE_ORPHANS_CONTAINER_ROW as Hr, PARTITION_TABLE as Hs, unsupportedFinalSnapshotError as Ht, ECR_AUTO_DELETE_IMAGES_TAG as I, createUnionSecretMasker as Ia, refuseMalformedResourcePropertiesForOrphan as Ii, isCustomResourceType as In, WorkGraph as Io, withSharedDrainBudget as Ir, MIGRATE_TMP_PREFIX as Is, buildFinalSnapshotIdentifier as It, red as J, markSameGenerationBag as Ja, unreadableOrphanRecords as Ji, disableInstanceApiTermination as Jn, readBootstrapMarkerBody as Jo, hasReadableResources as Jr, defineOwnKey as Js, updatePartialReason as Jt, gray as K, maskSecretsInError as Ka, repairMalformedResourcesForReadOnly as Ki, isWaitAbandonedError as Kn, isCrossRegionRedirect as Ko, hasReadableOrphans as Kr, StageLoadError as Ks, redactedDeleteAddressSkip as Kt, S3_AUTO_DELETE_OBJECTS_TAG as L, hasMaskableValues as La, refuseMalformedResourcesForDeploy as Li, getCurrentResourceSecrets as Ln, buildAssetRedirectMap as Lo, parameterInputsFor as Lr, findLargeInlineResources as Ls, ccRoutedFinalSnapshotError as Lt, DELETE_INDEX_WAIT_PROCEED_NOTE as M, liveMatchesUnresolvedTokenFrame as Ma, refuseMalformedResourceEntriesForOrphan as Mi, CC_BROKEN_REASON as Mn, shouldRetainResource as Mo, cfnRefValueFromPhysicalId as Mr, warnDeprecatedNoPrefixCliFlag as Ms, getCurrentProducerRegions as Mt, INDEX_SETTLE_POLL_INTERVAL_MS as N, inheritNestedStackParameterAssociations as Na, refuseMalformedResourcePropertiesForDestroy as Ni, ProviderRegistry as Nn, AssetPublisher as No, isStalePlaceholderArnAttribute as Nr, ssmResolvedValueType as Ns, inheritProducerRegions as Nt, compensateRemovedDeletionProtection as O, lambdaFunctionNameForMask as Oa, refuseMalformedResourceEntriesForDeploy as Oi, tagMapAsList as On, importableOutputs as Oo, carriesFetchableDynamicReference as Or, resolveStateBucketWithDefault as Os, planFailedOps as Ot, deleteTableWithIndexBusyRetry as P, recordNestedStackParameterExpressions as Pa, refuseMalformedResourcePropertiesForDrift as Pi, ccBrokenReason as Pn, isSensitiveAttributeName as Po, refStateLookupFromResource as Pr, CFN_TEMPLATE_BODY_LIMIT as Ps, ATOMIC_FINAL_SNAPSHOT_TYPES as Pt, reachableDivergentParameters as Q, DYNAMIC_REFERENCE_TOKEN_SCAN as Qa, unwrittenCreateOnlyReplacement as Qi, reDisableInstanceApiTermination as Qn, buildDockerImage as Qo, malformedExportNamesWarning as Qr, ownValue as Qs, WITHHELD_NAME_DISPLAY as Qt, hasCdkAutoDeleteTag as R, literalSplitDelimitersOf as Ra, refuseMalformedResourcesForDestroy as Ri, CloudControlProvider as Rn, createAssetRedirectResolver as Ro, passedParameterClassesOf as Rr, uploadCfnTemplate as Rs, createPreDeleteFinalSnapshot as Rt, isProtectionValueActive as S, requireConfigString as Sa, refuseMalformedOrphansForDestroy as Si, acquireIdempotencyToken as Sn, describeRegionValueKind as So, coerceParameterTypedValue as Sr, getLegacyStateBucketName as Ss, destroyStackRecordsView as St, DynamoDBGlobalTableProvider as T, describeTypeWithThrottleRetry as Ta, refuseMalformedOutputsForDestroy as Ti, planTagDiff as Tn, hasReasonlessBaselineRefusal as To, getAccountInfo as Tr, resolveAutoAssetStorage as Ts, recordAfterRollbackUpdate as Tt, createReadOnlyAttributeHealerFactory as U, shareLogOnlyValues as Ua, repairMalformedOutputsForReadOnly as Ui, deleteIndeterminateGuards as Un, assertAssetBucketRegion as Uo, UNREADABLE_RESOURCES_MAP_ROW as Ur, canonicalizeRegion as Us, REDACTED_DELETE_ADDRESS_SKIP_REASON as Ut, markRefusedBeforeApplying as V, recordLogOnlyParameterValue as Va, repairMalformedOrphanRecordsForReadOnly as Vi, unchangedBehindSecretReference as Vn, AssetModeResolver as Vo, STATE_RESOURCES_MALFORMED as Vr, expectedOwnerParam as Vs, refusesFinalSnapshot as Vt, bold as W, createSecretMasker as Wa, repairMalformedResourceEntriesForReadOnly as Wi, deleteSkipReason as Wn, ensureAssetStorage as Wo, deployRefusesOrphanRowsReason as Wr, derivePartitionAndUrlSuffix as Ws, isRedactedRecordedValue as Wt, computeParameterTaint as X, scrubResourceRecord as Xa, findActionableSilentDrops as Xi, isTerminationProtectionPropagationError as Xn, validateContainerRepoName as Xo, isReadableResourceEntry as Xr, hasPlainPrototype$1 as Xs, DeploymentEventsStore as Xt, yellow as Y, redactSecretsForState as Ya, unreadableResourceEntries as Yi, ec2InstanceProtectionSite as Yn, validateAssetBucketName as Yo, isReadableOrphanRecord as Yr, hasOwnKey as Ys, DeploymentEventsReader as Yt, namesAnyDeclaredParameter as Z, recoverMaskedOutput as Za, findSilentDropProperties as Zi, observeThenDisableInstanceApiTermination as Zn, buildDenyExternalAccessPolicy as Zo, malformedDriftResourcePropertiesWarning as Zr, nullPrototypeRecord as Zs, extractDeploymentEventError as Zt, makeCanonicalizePropertiesFn as _, configStringRefusal as _a, refuseDivergentRecordRegionForDestroy as _i, RollbackInlinePolicyWriters as _n, isLockInfoExpired as _o, s3BucketArn as _r, AssetManifestLoader as _s, getCurrentNestedStackContext as _t, findNestedTemplateTreeDefect as a, isStatefulRecreateTargetForReplace as aa, resolveBucketRegion as ac, malformedOrphanRowsKeptWarning as ai, isWholeDynamicReferenceValue as an, recordMaskOnlyValue as ao, regionLessSecretName as ar, formatDockerLoginError as as, makeSiblingClaimReader as at, recordedProtectionNote as b, requireConfigArray as ba, refuseMalformedOrphanRecordsForDestroy as bi, reserveStackCreateToken as bn, splitImportedOps as bo, s3BucketRegionalDomainName as br, synthesisStatusMessage as bs, replayRollback as bt, renderNestedTemplateTreeDefect as c, WARM_THROUGHPUT_MEMBERS as ca, malformedOutputsRefusalMessage as ci, collectPublishedOutputNames as cn, recordProvenPublicExpression as co, assertSendableRoleArn as cr, isMalformedEnvKey as cs, displacedOpClause as ct, conditionInputsFrom as d, toCfnInteger as da, malformedResourceEntriesWarning as di, DEFAULT_RESOURCE_TIMEOUT_MS as dn, STATE_SOURCED_CROSS_GENERATION_RULES as do, sendableAssumeRoleCommand as dr, redactedDockerCause as ds, getNestedRevertRun as dt, NO_CC_HANDLERS_REASON as ea, describeFileReadFailure as ec, malformedLocalOutputsWarning as ei, exportAliasCollisionScrubWarning as en, isUncertifiedBaselineMaskPosition as eo, DiffCalculator as er, describeDockerCapturedOutput as es, deleteJournaledOrphans as et, parentSuppliedValues as f, toFiniteNumber as fa, malformedResourcePropertiesWarning as fi, DEFAULT_RESOURCE_WARN_AFTER_MS as fn, STATE_SOURCED_READBACK_RULES as fo, AWS_CREDENTIAL_ENV_KEYS as fr, runDockerForeground as fs, nestedChildStackName as ft, mergeNoChangeOutputs as g, configIntegerRefusal as ga, previewableOrphanRecords as gi, formatDestructiveChange as gn, LockManager as go, isSettledInstanceState as gr, stripControlChars as gs, withNestedRevertRun as gt, keptWholeReasonText as h, configBooleanRefusal as ha, malformedStateRefusalMessage as hi, findDestructiveChanges as hn, isSingleDynamicReferenceToken as ho, envCredentialsAreAssumedRole as hr, escapeRegExp$3 as hs, revertedNestedRowIds as ht, childTemplateLoader as i, MULTI_REGION_RECREATE_BLOCKED_TYPES as ia, clearBucketRegionCache as ic, malformedOrphanRecordsWarning as ii, exportNameSecretExposure as in, provenPublicValue as io, producerRegionsFromState as ir, finchSecretArgvRefusal as is, sameJournaledOrphans as it, resolveDynamoDbDeleteBudgetMs as j, TemplateParser as ja, refuseMalformedResourceEntriesForImportSave as ji, stringifyIfAssigned as jn, orphansCarriedFrom as jo, AWS_NO_VALUE as jr, stateBucketExistenceConfirmed as js, findNestedStackTypeChanges as jt, deleteBudgetKey as k, sameLambdaFunctionAddress as ka, refuseMalformedResourceEntriesForDestroy as ki, tagPlanWarning as kn, isReadableBag as ko, isNamelessDynamicReferenceError as kr, resolveStateBucketWithDefaultAndSource as ks, planRollback as kt, templateIdentity as l, coerceWarmThroughput as la, malformedOutputsWarning as li, isExportAliasCollision as ln, wholeStringLeavesOf as lo, explicitRoleArnOrThrow as lr, partitionSensitiveEnv as ls, displacedPhysicalIdShown as lt, isSecretBearingReferenceString as m, coerceCfnInteger as ma, malformedScrubResourceEntriesRefusalMessage as mi, constructPathOf as mn, WHOLE_DYNAMIC_REFERENCE_PATTERN as mo, callerEnvCredentials as mr, warnFinchArgvExposure as ms, revertNestedChildFromJournal as mt, IMPLICIT_DELETE_DEPENDENCIES as n, findReplacedReadersOfRecreateTargets as na, renderAssemblyPathEscape as nc, malformedLocalResourcesWarning as ni, secretBearingStateKeyWarning as nn, identityKeyFor as no, IntrinsicFunctionResolver as nr, describeDockerFailure as ns, journaledOrphanLines as nt, isAbsoluteAssetPath as o, isStatefulRecreateTargetSync as oa, malformedOrphansRefusalMessage as oi, noEchoParameterValueSeed as on, recordMaskOnlyValuesIn as oo, applyRoleArnIfSet as or, getDockerCmd as os, planOrphanAdoption as ot, readRecordedConditionVerdicts as p, coerceCfnBoolean as pa, malformedResourcesWarning as pi, maskingRetryLogger as pn, TEMPLATE_SOURCED_RULES as po, applyCallerIdentityCredentials as pr, runDockerStreaming as ps, recordDisplacedSkips as pt, green as q, maskSecretsInText as qa, unpreviewableOrphanRecords as qi, markWaitAbandoned as qn, parseBootstrapMarker as qo, hasReadableOutputs as qr, processStackMessages as qs, updatePartialMessage as qt, computeImplicitDeleteEdges as r, shownType as ra, resolveAssemblyPath as rc, malformedOrphanRecordsRefusalMessage as ri, secretSafeKeyDisplay as rn, carriesSecretMask as ro, classifyReplaySecretRegion as rr, dockerSpawnEnvWithSensitive as rs, loadJournaledOrphans as rt, listNestedTemplateRows as s, renderStatefulReason as sa, malformedOrphansWarning as si, collectDeclaredOutputNames as sn, recordNoEchoAttributeValues as so, assertFlagRoleArn as sr, isDockerClientEnvKey as ss, NESTED_PENDING_PARENT_REASON as st, DeployEngine as t, hasNoCloudControlHandlers as ta, displayAssemblyPath as tc, malformedLocalResourceEntriesWarning as ti, secretBearing as tn, pathCrossesDottedKey as to, INTRINSIC_KEYS as tr, describeDockerExecFailure as ts, isHandledOrphan as tt, conditionFingerprint as u, isWarmThroughputDecrease as ua, malformedRenderedContainersWarning as ui, bindingSkippedOutputs as un, STATE_SOURCED_BASELINE_RULES as uo, isIamRoleArn as ur, redactDockerArgvValues as us, dropSettledNestedJournals as ut, withResourceDeadline as v, readConfigString as va, refuseMalformedNestedChildOutputs as vi, earliestDefined as vn, S3StateBackend as vo, s3BucketDomainName as vr, getDockerImageBySourceHash as vs, withNestedStackContext as vt, readProtection as w, templateResourceTypes as wa, refuseMalformedOutputs as wi, DBPROXY_TAG_OPTIONS as wn, hasReadableExportSet as wo, parameterTypeMayLoseSecretIdentity as wr, resolveApp as ws, withStackRecords as wt, PROTECTION_PROPERTY_BY_TYPE as x, requireConfigObject as xa, refuseMalformedOrphans as xi, withCreateTokenLedger as xn, acceptedCreateOnlyDropsOf as xo, s3BucketWebsiteUrl as xr, getDefaultStateBucketName as xs, awaitInFlightSibling as xt, recordedProtectionEvidence as y, replayWarn as ya, refuseMalformedOrphanRecords as yi, ledgerForStack as yn, rebuildClientForBucketRegion as yo, s3BucketDualStackDomainName as yr, Synthesizer as ys, replayFailedOperations as yt, isTruthyCfnBoolean as z, logOnlyValueCount as za, refuseMalformedResourcesForExport as zi, slowCcOperationTimeoutMs as zn, loadPublishableAssetManifest as zo, JSON_LISTING_HOLE_VALUE as zr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as zs, effectiveDeletionPolicy as zt };
-//# sourceMappingURL=deploy-engine-D7204v7Z.js.map
+export { resourcesNamingDeclaredParameter as $, recoverMaskedOutput as $a, findSilentDropProperties as $i, observeThenDisableInstanceApiTermination as $n, buildDenyExternalAccessPolicy as $o, malformedDriftResourcePropertiesWarning as $r, nullPrototypeRecord as $s, extractDeploymentEventError as $t, resolveDynamoDbDeleteBudgetClock as A, lambdaFunctionNameForMask as Aa, refuseMalformedResourceEntriesForDeploy as Ai, tagMapAsList as An, importableOutputs as Ao, carriesFetchableDynamicReference as Ar, resolveStateBucketWithDefault as As, planRollback as At, getPriorAttempts as B, literalSplitDelimitersOf as Ba, refuseMalformedResourcesForDestroy as Bi, CloudControlProvider as Bn, createAssetRedirectResolver as Bo, passedParameterClassesOf as Br, uploadCfnTemplate as Bs, createPreDeleteFinalSnapshot as Bt, perType as C, requireConfigObject as Ca, refuseMalformedOrphans as Ci, withCreateTokenLedger as Cn, acceptedCreateOnlyDropsOf as Co, s3BucketWebsiteUrl as Cr, getDefaultStateBucketName as Cs, getStackRecords as Ct, beginDeleteWait as D, describeTypeWithThrottleRetry as Da, refuseMalformedOutputsForDestroy as Di, planTagDiff as Dn, hasReasonlessBaselineRefusal as Do, getAccountInfo as Dr, resolveAutoAssetStorage as Ds, isJournaledOrphan as Dt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as E, templateResourceTypes as Ea, refuseMalformedOutputs as Ei, DBPROXY_TAG_OPTIONS as En, hasReadableExportSet as Eo, parameterTypeMayLoseSecretIdentity as Er, resolveApp as Es, demoteSupersededOrphans as Et, waitForIndexesSettled as F, inheritNestedStackParameterAssociations as Fa, refuseMalformedResourcePropertiesForDestroy as Fi, ProviderRegistry as Fn, AssetPublisher as Fo, isStalePlaceholderArnAttribute as Fr, ssmResolvedValueType as Fs, inheritProducerRegions as Ft, cyan as G, shareLogOnlyValues as Ga, repairMalformedOutputsForReadOnly as Gi, deleteIndeterminateGuards as Gn, assertAssetBucketRegion as Go, UNREADABLE_RESOURCES_MAP_ROW as Gr, canonicalizeRegion as Gs, REDACTED_DELETE_ADDRESS_SKIP_REASON as Gt, formatResourceLine as H, printingCorpusOf as Ha, refuseMalformedState as Hi, ccProtectionRegistryTypes as Hn, rewriteTemplateAssetReferences as Ho, STATE_REGION_DIVERGED as Hr, decodeListingKey as Hs, isFinalSnapshotError as Ht, ECR_AUTO_DELETE_IMAGES_TAG as I, recordNestedStackParameterExpressions as Ia, refuseMalformedResourcePropertiesForDrift as Ii, ccBrokenReason as In, isSensitiveAttributeName as Io, refStateLookupFromResource as Ir, CFN_TEMPLATE_BODY_LIMIT as Is, ATOMIC_FINAL_SNAPSHOT_TYPES as It, red as J, maskSecretsInError as Ja, repairMalformedResourcesForReadOnly as Ji, isWaitAbandonedError as Jn, isCrossRegionRedirect as Jo, hasReadableOrphans as Jr, StageLoadError as Js, redactedDeleteAddressSkip as Jt, gray as K, createSecretMasker as Ka, repairMalformedResourceEntriesForReadOnly as Ki, deleteSkipReason as Kn, ensureAssetStorage as Ko, deployRefusesOrphanRowsReason as Kr, derivePartitionAndUrlSuffix as Ks, isRedactedRecordedValue as Kt, S3_AUTO_DELETE_OBJECTS_TAG as L, carryLogOnlyValues as La, refuseMalformedResourcePropertiesForExport as Li, wouldReturnToSdkProvider as Ln, stringifyValue as Lo, parseWebACLArn as Lr, CFN_TEMPLATE_URL_LIMIT as Ls, PRE_DELETE_SNAPSHOT_TYPES as Lt, DELETE_INDEX_WAIT_PROCEED_NOTE as M, DagBuilder as Ma, refuseMalformedResourceEntriesForImport as Mi, definedAttributes as Mn, orphansAfterRollback as Mo, keepsSecretReferenceToken as Mr, resolveUseCdkBootstrapAssets as Ms, resolveReplacementOldType as Mt, INDEX_SETTLE_POLL_INTERVAL_MS as N, TemplateParser as Na, refuseMalformedResourceEntriesForImportSave as Ni, stringifyIfAssigned as Nn, orphansCarriedFrom as No, AWS_NO_VALUE as Nr, stateBucketExistenceConfirmed as Ns, findNestedStackTypeChanges as Nt, compensateRemovedDeletionProtection as O, withRetry as Oa, refuseMalformedResourceAttributesForOrphan as Oi, readTagList as On, hasUnverifiableParameterRefusal as Oo, isImpossibleEmptyStoredAttribute as Or, resolveCaptureObservedState as Os, isReplacementOrphan as Ot, deleteTableWithIndexBusyRetry as P, liveMatchesUnresolvedTokenFrame as Pa, refuseMalformedResourceEntriesForOrphan as Pi, CC_BROKEN_REASON as Pn, shouldRetainResource as Po, cfnRefValueFromPhysicalId as Pr, warnDeprecatedNoPrefixCliFlag as Ps, getCurrentProducerRegions as Pt, reachableDivergentParameters as Q, scrubResourceRecord as Qa, findActionableSilentDrops as Qi, isTerminationProtectionPropagationError as Qn, validateContainerRepoName as Qo, isReadableResourceEntry as Qr, hasPlainPrototype$1 as Qs, DeploymentEventsStore as Qt, hasCdkAutoDeleteTag as R, createUnionSecretMasker as Ra, refuseMalformedResourcePropertiesForOrphan as Ri, isCustomResourceType as Rn, WorkGraph as Ro, withSharedDrainBudget as Rr, MIGRATE_TMP_PREFIX as Rs, buildFinalSnapshotIdentifier as Rt, isProtectionValueActive as S, requireConfigArray as Sa, refuseMalformedOrphanRecordsForDestroy as Si, reserveStackCreateToken as Sn, splitImportedOps as So, s3BucketRegionalDomainName as Sr, synthesisStatusMessage as Ss, destroyStackRecordsView as St, DynamoDBGlobalTableProvider as T, prefetchCreateOnlyPropertyPaths as Ta, refuseMalformedOrphansForOrphan as Ti, DBPROXY_TAGS_WHAT as Tn, exportNamesCarriedFrom as To, isUnboundTemplateParameter as Tr, loadCdkJson as Ts, recordAfterRollbackUpdate as Tt, createReadOnlyAttributeHealerFactory as U, recordLogOnlyParameterValue as Ua, repairMalformedOrphanRecordsForReadOnly as Ui, unchangedBehindSecretReference as Un, AssetModeResolver as Uo, STATE_RESOURCES_MALFORMED as Ur, expectedOwnerParam as Us, refusesFinalSnapshot as Ut, markRefusedBeforeApplying as V, logOnlyValueCount as Va, refuseMalformedResourcesForExport as Vi, slowCcOperationTimeoutMs as Vn, loadPublishableAssetManifest as Vo, JSON_LISTING_HOLE_VALUE as Vr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Vs, effectiveDeletionPolicy as Vt, bold as W, recordLogOnlyValue as Wa, repairMalformedOrphansForReadOnly as Wi, UNSPECIFIED_SKIP_REASON as Wn, BOOTSTRAP_MARKER_PREFIX as Wo, UNREADABLE_ORPHANS_CONTAINER_ROW as Wr, PARTITION_TABLE as Ws, unsupportedFinalSnapshotError as Wt, computeParameterTaint as X, markSameGenerationBag as Xa, unreadableOrphanRecords as Xi, disableInstanceApiTermination as Xn, readBootstrapMarkerBody as Xo, hasReadableResources as Xr, defineOwnKey as Xs, updatePartialReason as Xt, yellow as Y, maskSecretsInText as Ya, unpreviewableOrphanRecords as Yi, markWaitAbandoned as Yn, parseBootstrapMarker as Yo, hasReadableOutputs as Yr, processStackMessages as Ys, updatePartialMessage as Yt, namesAnyDeclaredParameter as Z, redactSecretsForState as Za, unreadableResourceEntries as Zi, ec2InstanceProtectionSite as Zn, validateAssetBucketName as Zo, isReadableOrphanRecord as Zr, hasOwnKey as Zs, DeploymentEventsReader as Zt, makeCanonicalizePropertiesFn as _, configBooleanRefusal as _a, malformedStateRefusalMessage as _i, findDestructiveChanges as _n, isSingleDynamicReferenceToken as _o, envCredentialsAreAssumedRole as _r, escapeRegExp$3 as _s, getCurrentNestedStackContext as _t, findNestedTemplateTreeDefect as a, shownType as aa, resolveAssemblyPath as ac, malformedOrphanRecordsRefusalMessage as ai, secretSafeKeyDisplay as an, carriesSecretMask as ao, classifyReplaySecretRegion as ar, dockerSpawnEnvWithSensitive as as, makeSiblingClaimReader as at, recordedProtectionNote as b, readConfigString as ba, refuseMalformedNestedChildOutputs as bi, earliestDefined as bn, S3StateBackend as bo, s3BucketDomainName as br, getDockerImageBySourceHash as bs, replayRollback as bt, renderNestedTemplateTreeDefect as c, isStatefulRecreateTargetSync as ca, malformedOrphansRefusalMessage as ci, noEchoParameterValueSeed as cn, recordMaskOnlyValuesIn as co, applyRoleArnIfSet as cr, getDockerCmd as cs, displacedOpClause as ct, conditionInputsFrom as d, coerceWarmThroughput as da, malformedOutputsWarning as di, isExportAliasCollision as dn, wholeStringLeavesOf as do, explicitRoleArnOrThrow as dr, partitionSensitiveEnv as ds, getNestedRevertRun as dt, unwrittenCreateOnlyReplacement as ea, ownValue as ec, malformedExportNamesWarning as ei, WITHHELD_NAME_DISPLAY as en, DYNAMIC_REFERENCE_TOKEN_SCAN as eo, reDisableInstanceApiTermination as er, buildDockerImage as es, deleteJournaledOrphans as et, parentSuppliedValues as f, isWarmThroughputDecrease as fa, malformedRenderedContainersWarning as fi, bindingSkippedOutputs as fn, STATE_SOURCED_BASELINE_RULES as fo, isIamRoleArn as fr, redactDockerArgvValues as fs, nestedChildStackName as ft, mergeNoChangeOutputs as g, coerceCfnInteger as ga, malformedScrubResourceEntriesRefusalMessage as gi, constructPathOf as gn, WHOLE_DYNAMIC_REFERENCE_PATTERN as go, callerEnvCredentials as gr, warnFinchArgvExposure as gs, withNestedRevertRun as gt, keptWholeReasonText as h, coerceCfnBoolean as ha, malformedResourcesWarning as hi, maskingRetryLogger as hn, TEMPLATE_SOURCED_RULES as ho, applyCallerIdentityCredentials as hr, runDockerStreaming as hs, revertedNestedRowIds as ht, childTemplateLoader as i, findReplacedReadersOfRecreateTargets as ia, renderAssemblyPathEscape as ic, malformedLocalResourcesWarning as ii, secretBearingStateKeyWarning as in, identityKeyFor as io, IntrinsicFunctionResolver as ir, describeDockerFailure as is, sameJournaledOrphans as it, resolveDynamoDbDeleteBudgetMs as j, sameLambdaFunctionAddress as ja, refuseMalformedResourceEntriesForDestroy as ji, tagPlanWarning as jn, isReadableBag as jo, isNamelessDynamicReferenceError as jr, resolveStateBucketWithDefaultAndSource as js, replacementNeverSwapped as jt, deleteBudgetKey as k, canonicalLambdaFunctionName as ka, refuseMalformedResourceEntries as ki, refuseMalformedDesiredTags as kn, importableOutputKeys as ko, carriesDynamicReference as kr, resolveSkipPrefix as ks, planFailedOps as kt, templateIdentity as l, renderStatefulReason as la, malformedOrphansWarning as li, collectDeclaredOutputNames as ln, recordNoEchoAttributeValues as lo, assertFlagRoleArn as lr, isDockerClientEnvKey as ls, displacedPhysicalIdShown as lt, isSecretBearingReferenceString as m, toFiniteNumber as ma, malformedResourcePropertiesWarning as mi, DEFAULT_RESOURCE_WARN_AFTER_MS as mn, STATE_SOURCED_READBACK_RULES as mo, AWS_CREDENTIAL_ENV_KEYS as mr, runDockerForeground as ms, revertNestedChildFromJournal as mt, IMPLICIT_DELETE_DEPENDENCIES as n, NO_CC_HANDLERS_REASON as na, describeFileReadFailure as nc, malformedLocalOutputsWarning as ni, exportAliasCollisionScrubWarning as nn, isUncertifiedBaselineMaskPosition as no, DiffCalculator as nr, describeDockerCapturedOutput as ns, journaledOrphanLines as nt, isAbsoluteAssetPath as o, MULTI_REGION_RECREATE_BLOCKED_TYPES as oa, clearBucketRegionCache as oc, malformedOrphanRecordsWarning as oi, exportNameSecretExposure as on, provenPublicValue as oo, producerRegionsFromState as or, finchSecretArgvRefusal as os, planOrphanAdoption as ot, readRecordedConditionVerdicts as p, toCfnInteger as pa, malformedResourceEntriesWarning as pi, DEFAULT_RESOURCE_TIMEOUT_MS as pn, STATE_SOURCED_CROSS_GENERATION_RULES as po, sendableAssumeRoleCommand as pr, redactedDockerCause as ps, recordDisplacedSkips as pt, green as q, errorCauseChain as qa, repairMalformedResourcePropertiesForReadOnly as qi, withIndeterminateGuard as qn, getBootstrapMarkerKey as qo, displayLogicalId as qr, AssemblyReader as qs, redactedDeleteAddressFields as qt, computeImplicitDeleteEdges as r, hasNoCloudControlHandlers as ra, displayAssemblyPath as rc, malformedLocalResourceEntriesWarning as ri, secretBearing as rn, pathCrossesDottedKey as ro, INTRINSIC_KEYS as rr, describeDockerExecFailure as rs, loadJournaledOrphans as rt, listNestedTemplateRows as s, isStatefulRecreateTargetForReplace as sa, resolveBucketRegion as sc, malformedOrphanRowsKeptWarning as si, isWholeDynamicReferenceValue as sn, recordMaskOnlyValue as so, regionLessSecretName as sr, formatDockerLoginError as ss, NESTED_PENDING_PARENT_REASON as st, DeployEngine as t, withoutSilentDropProperties as ta, absoluteAssemblyPathEscape as tc, malformedExportSourceWarning as ti, displayTextOrWithheld as tn, dynamicReferenceTokens as to, reEnableInstanceApiTermination as tr, resolveDockerContextDirectory as ts, isHandledOrphan as tt, conditionFingerprint as u, WARM_THROUGHPUT_MEMBERS as ua, malformedOutputsRefusalMessage as ui, collectPublishedOutputNames as un, recordProvenPublicExpression as uo, assertSendableRoleArn as ur, isMalformedEnvKey as us, dropSettledNestedJournals as ut, withResourceDeadline as v, configIntegerRefusal as va, previewableOrphanRecords as vi, formatDestructiveChange as vn, LockManager as vo, isSettledInstanceState as vr, stripControlChars as vs, withNestedStackContext as vt, readProtection as w, requireConfigString as wa, refuseMalformedOrphansForDestroy as wi, acquireIdempotencyToken as wn, describeRegionValueKind as wo, coerceParameterTypedValue as wr, getLegacyStateBucketName as ws, withStackRecords as wt, PROTECTION_PROPERTY_BY_TYPE as x, replayWarn as xa, refuseMalformedOrphanRecords as xi, ledgerForStack as xn, rebuildClientForBucketRegion as xo, s3BucketDualStackDomainName as xr, Synthesizer as xs, awaitInFlightSibling as xt, recordedProtectionEvidence as y, configStringRefusal as ya, refuseDivergentRecordRegionForDestroy as yi, RollbackInlinePolicyWriters as yn, isLockInfoExpired as yo, s3BucketArn as yr, AssetManifestLoader as ys, replayFailedOperations as yt, isTruthyCfnBoolean as z, hasMaskableValues as za, refuseMalformedResourcesForDeploy as zi, getCurrentResourceSecrets as zn, buildAssetRedirectMap as zo, parameterInputsFor as zr, findLargeInlineResources as zs, ccRoutedFinalSnapshotError as zt };
+//# sourceMappingURL=deploy-engine-C_Eg-RHm.js.map