@go-to-k/cdkd 0.296.11 → 0.296.13

package/dist/{program-w_06Pj_g.js → program-1S4fU3m4.js}

@@ -1,9 +1,9 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-CnmtbrxD.js";
 import { A as displayIdent, D as UNRENDERABLE, E as STACK_REF_MAX_CODE_POINTS, F as plainIdentOr, I as safeMsg, L as stringifyJsonPayload, M as displayStackName, N as isPasteableIdent, O as cutMarker, R as truncateCodePoints, S as withStackName, T as SECRET_REF_MAX_CODE_POINTS, d as PATTERN_B_NAME_PROPERTIES, f as PATTERN_B_RESOURCE_TYPES, g as generateResourceName, h as explicitNamePropertyFor, i as reserveStdoutForPayload, j as displaySafe, k as displayAwsMessage, l as getLiveRenderer, m as derivesPatternBName, n as getLogger, o as runStackBuffered, r as isStdoutReservedForPayload, u as PATTERN_B_NAME_OPTIONS, w as SAFE_MSG_ALTERED_CHAR, x as withSkipPrefix } from "./logger-DAaB7GFO.js";
-import { An as setPasteableVerbFlags, At as CUSTOM_RESOURCE_RESPONSE_PREFIX, Bt as clientDefaultsFor, Ct as buildForceUnlockCommand, Dn as shellQuote, Dt as formatLockOperation, En as shellBoundedDisplay, Et as formatLockExpiry, F as runDeleteAttempt, Ft as producerRecordKey, G as beginCommandInterruptScope, Gn as retryClassificationText, Ht as AccountIdUnavailableError, It as setPasteableAwsProfile, J as isInterruptedWaitError, Jn as safeStringify, Jt as DeployCancelledError, K as endCommandInterruptScope, Kn as describeAwsFailure, Kt as CrossAccountSecretRefusalError, Lt as withPasteableAwsProfile, Mt as injectiveKey, On as withheldTargetClause, Ot as formatLockOwner, Pt as producerCoordinateKey, Qn as markNonRetryable, Qt as LocalStartServiceError, Rt as ambientClientDefaults, Sn as pasteableCommand, St as UNREPRODUCIBLE_LOCK_CLAUSE, Tn as quotedOrDescribed, Tt as forceQuitRecoveryClause, Un as isRetryableTransientError, V as isAwsCliLiteral, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, Wn as isTransientServerError, Wt as CdkdError, Xn as isMarkedNonRetryable, Xt as IntrinsicResolutionRefusalError, Yt as DynamicReferenceRegionAmbiguousError, Zn as isThrottlingError, Zt as LocalInvokeBuildError$1, _ as VALUE_NOT_SHOWN, _n as SHELL_ACTIVE_WHY, an as ResourceTimeoutError, cn as StackTerminationProtectionError, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, hn as TIMEOUT_FLAG_RESOURCE_TYPE, in as ProvisioningError, it as resourceTypeShown, jt as DEFAULT_STATE_PREFIX, kn as setPasteableRunFlags, mn as withErrorHandling, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as NestedStackChildDirectDestroyError, nt as logicalIdShown, on as ResourceUpdateNotSupportedError, pn as normalizeAwsError, q as interruptWatchListenerCount, rn as PartialFailureError, s as readRecordedPrincipals, sn as StackHasActiveImportsError, t as IAM_PRINCIPAL_NAME, tn as MalformedProducerRecordRefusalError, un as SynthesisError, w as remedyLogicalId, wn as plainOrDescribed, wt as buildLockContentionMessage, xn as isInertUnquoted, yn as commandHole, zt as ambientCredentialConfig } from "./iam-policy-targets-BREzwsG6.js";
+import { $ as endCommandInterruptScope, $n as retryClassificationText, An as pasteableCommand, At as UNREPRODUCIBLE_LOCK_CLAUSE, Bt as injectiveKey, C as assertRegionMatch, Cn as TIMEOUT_FLAG_RESOURCE_TYPE, Dn as commandHole, Fn as shellQuote, Ft as formatLockOperation, Gt as withPasteableAwsProfile, H as runDeleteAttempt, Ht as producerCoordinateKey, In as withheldTargetClause, It as formatLockOwner, J as isAwsCliLiteral, Jt as clientDefaultsFor, Kt as ambientClientDefaults, Ln as setPasteableRunFlags, Mn as plainOrDescribed, Mt as buildLockContentionMessage, Nn as quotedOrDescribed, Nt as forceQuitRecoveryClause, Pn as shellBoundedDisplay, Pt as formatLockExpiry, Q as beginCommandInterruptScope, Qn as isTransientServerError, Qt as CdkdError, Rn as setPasteableVerbFlags, Rt as CUSTOM_RESOURCE_RESPONSE_PREFIX, S as RESOURCE_NOT_FOUND, Sn as withErrorHandling, Tn as SHELL_ACTIVE_WHY, Ut as producerRecordKey, Wt as setPasteableAwsProfile, Xt as AccountIdUnavailableError, Yn as isAmbiguousOutcomeError, Yt as credentialFingerprint, Zn as isRetryableTransientError, an as LocalInvokeBuildError$1, ar as isThrottlingError, dn as PartialFailureError, dt as resourceTypeShown, en as CrossAccountSecretRefusalError, er as describeAwsFailure, et as interruptWatchListenerCount, fn as ProvisioningError, gn as StackTerminationProtectionError, hn as StackHasActiveImportsError, in as IntrinsicResolutionRefusalError, ir as isMarkedNonRetryable, j as remedyLogicalId, jt as buildForceUnlockCommand, kn as isInertUnquoted, ln as MalformedProducerRecordRefusalError, lt as logicalIdShown, mn as ResourceUpdateNotSupportedError, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as DeployCancelledError, nr as safeStringify, on as LocalStartServiceError, or as markNonRetryable, pn as ResourceTimeoutError, qt as ambientCredentialConfig, rn as DynamicReferenceRegionAmbiguousError, s as readRecordedPrincipals, t as IAM_PRINCIPAL_NAME, tt as isInterruptedWaitError, un as NestedStackChildDirectDestroyError, vn as SynthesisError, w as VALUE_NOT_SHOWN, xn as normalizeAwsError, zt as DEFAULT_STATE_PREFIX } from "./iam-policy-targets-elNafvpb.js";
 import { n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as resourcesNamingDeclaredParameter, $a as createSecretMasker, $i as repairMalformedOutputsForReadOnly, $n as deleteSkipReason, $o as BOOTSTRAP_MARKER_PREFIX, $r as accountArgs, $s as PARTITION_TABLE, $t as effectiveDeletionPolicy, Ai as refuseMalformedOrphanRecordsForDestroy, Ao as rebuildClientForBucketRegion, As as Synthesizer, At as planRollback, Bi as refuseMalformedResourceEntriesForImport, Bn as CC_BROKEN_REASON, Bo as isReadableBag, Br as AWS_NO_VALUE, Bs as resolveStateBucketWithDefaultAndSource, Bt as updatePartialMessage, C as perType, Ci as malformedResourcesWarning, Cn as findDestructiveChanges, Co as STATE_SOURCED_READBACK_RULES, Cr as callerEnvCredentials, Cs as runDockerForeground, Di as refuseDivergentRecordRegionForDestroy, Dn as ledgerForStack, Do as LockManager, Ds as stripControlChars, Dt as isJournaledOrphan, Ei as previewableOrphanRecords, Eo as isSingleDynamicReferenceToken, Es as escapeRegExp, Et as demoteSupersededOrphans, Fa as templateResourceTypes, Fi as refuseMalformedOutputsForDestroy, Fo as hasReadableExportSet, Fr as isImpossibleEmptyStoredAttribute, Fs as resolveApp, Ft as inheritProducerRegions, G as cyan, Ga as createUnionSecretMasker, Gi as refuseMalformedResourcePropertiesForExport, Go as isSensitiveAttributeName, Gr as withSharedDrainBudget, Gs as CFN_TEMPLATE_BODY_LIMIT, Gt as orphanRecordsPrintingBag, H as formatResourceLine, Ha as TemplateParser, Hi as refuseMalformedResourceEntriesForOrphan, Hn as ccBrokenReason, Ho as orphansCarriedFrom, Hr as isStalePlaceholderArnAttribute, Hs as stateBucketExistenceConfirmed, Ht as completedReplayEntries, Ia as describeTypeWithThrottleRetry, Ii as refuseMalformedResourceAttributesForOrphan, Io as hasReasonlessBaselineRefusal, Ir as carriesDynamicReference, Is as resolveAutoAssetStorage, J as red, Ja as logOnlyValueCount, Ji as refuseMalformedResourcesForDestroy, Jn as slowCcOperationTimeoutMs, Jo as buildAssetRedirectMap, Jr as JSON_LISTING_HOLE_VALUE, Js as findLargeInlineResources, Jt as ATOMIC_FINAL_SNAPSHOT_TYPES, K as gray, Ka as hasMaskableValues, Ki as refuseMalformedResourcePropertiesForOrphan, Kn as withPrintingSecrets, Ko as stringifyValue, Kr as parameterInputsFor, Ks as CFN_TEMPLATE_URL_LIMIT, Kt as secretNamePrintingBag, La as withRetry, Li as refuseMalformedResourceEntries, Lo as hasUnverifiableParameterRefusal, Lr as carriesFetchableDynamicReference, Ls as resolveCaptureObservedState, Mi as refuseMalformedOrphansForDestroy, Mo as acceptedCreateOnlyDropsOf, Mr as isUnboundTemplateParameter, Ms as getDefaultStateBucketName, Mt as resolveReplacementOldType, Ni as refuseMalformedOrphansForOrphan, No as describeRegionValueKind, Nr as parameterTypeMayLoseSecretIdentity, Ns as getLegacyStateBucketName, Nt as findNestedStackTypeChanges, Oo as isLockInfoExpired, Os as AssetManifestLoader, Ot as isReplacementOrphan, Pa as prefetchCreateOnlyPropertyPaths, Pi as refuseMalformedOutputs, Po as exportNamesCarriedFrom, Pr as getAccountInfo, Ps as loadCdkJson, Q as reachableDivergentParameters, Qa as shareLogOnlyValues, Qi as repairMalformedOrphansForReadOnly, Qn as deleteIndeterminateGuards, Qo as AssetModeResolver, Qr as UNREADABLE_RESOURCES_MAP_ROW, Qs as expectedOwnerParam, Qt as createPreDeleteFinalSnapshot, Ri as refuseMalformedResourceEntriesForDeploy, Ro as importableOutputKeys, Rr as isNamelessDynamicReferenceError, Rs as resolveSkipPrefix, S as isProtectionValueActive, Si as malformedResourcePropertiesWarning, Sn as constructPathOf, So as STATE_SOURCED_CROSS_GENERATION_RULES, Sr as applyCallerIdentityCredentials, Ss as redactedDockerCause, St as destroyStackRecordsView, Ti as malformedStateRefusalMessage, Tn as RollbackInlinePolicyWriters, To as WHOLE_DYNAMIC_REFERENCE_PATTERN, Ts as warnFinchArgvExposure, Tt as recordAfterRollbackUpdate, U as createReadOnlyAttributeHealerFactory, Ua as liveMatchesUnresolvedTokenFrame, Ui as refuseMalformedResourcePropertiesForDestroy, Un as wouldReturnToSdkProvider, Uo as shouldRetainResource, Ur as refStateLookupFromResource, Us as warnDeprecatedNoPrefixCliFlag, Ut as journaledOrphanPrintingBag, Va as DagBuilder, Vi as refuseMalformedResourceEntriesForImportSave, Vn as ProviderRegistry, Vo as orphansAfterRollback, Vr as cfnRefValueFromPhysicalId, Vs as resolveUseCdkBootstrapAssets, Vt as updatePartialReason, W as bold, Wa as carryLogOnlyValues, Wi as refuseMalformedResourcePropertiesForDrift, Wn as isCustomResourceType$1, Wo as AssetPublisher, Ws as ssmResolvedValueType, Wt as maskEventTextWithBoundBags, X as computeParameterTaint, Xa as recordLogOnlyParameterValue, Xi as refuseMalformedState, Xo as loadPublishableAssetManifest, Xr as STATE_RESOURCES_MALFORMED, Xs as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Xt as buildFinalSnapshotIdentifier, Y as yellow, Ya as printingCorpusOf, Yi as refuseMalformedResourcesForExport, Yn as ccProtectionRegistryTypes, Yo as createAssetRedirectResolver, Yr as STATE_REGION_DIVERGED, Ys as uploadCfnTemplate, Yt as PRE_DELETE_SNAPSHOT_TYPES, Z as namesAnyDeclaredParameter, Za as recordLogOnlyValue, Zi as repairMalformedOrphanRecordsForReadOnly, Zn as UNSPECIFIED_SKIP_REASON, Zo as rewriteTemplateAssetReferences, Zr as UNREADABLE_ORPHANS_CONTAINER_ROW, Zs as decodeListingKey, Zt as ccRoutedFinalSnapshotError, _ as makeCanonicalizePropertiesFn, _a as isStatefulRecreateTargetSync, _i as malformedOrphansWarning, _n as isExportAliasCollision, _o as recordMaskOnlyValuesIn, _r as assertSendableRoleArn, _s as getDockerCmd, a as findNestedTemplateTreeDefect, aa as unreadableResourceEntries, ac as defineOwnKey, ai as isReadableOrphanRecord, an as extractDeploymentEventError, ao as scrubResourceRecord, as as readBootstrapMarkerBody, at as makeSiblingClaimReader, b as recordedProtectionNote, bi as malformedRenderedContainersWarning, bn as DEFAULT_RESOURCE_WARN_AFTER_MS, bo as wholeStringLeavesOf, br as sendableAssumeRoleCommand, bs as partitionSensitiveEnv, bt as replayRollback, c as renderNestedTemplateTreeDefect, cc as nullPrototypeRecord, ci as malformedExportNamesWarning, cn as exportAliasCollisionScrubWarning, co as isUncertifiedBaselineMaskPosition, cs as buildDenyExternalAccessPolicy, ct as displacedOpClause, d as conditionInputsFrom, da as NO_CC_HANDLERS_REASON, dc as describeFileReadFailure, di as malformedLocalResourceEntriesWarning, dn as secretSafeKeyDisplay, do as recordNestedStackParameterExpressions, dr as IntrinsicFunctionResolver, ds as describeDockerCapturedOutput, ea as repairMalformedResourceEntriesForReadOnly, ec as canonicalizeRegion, ei as deployRefusesOrphanRowsReason, en as isFinalSnapshotError, eo as errorCauseChain, es as assertAssetBucketRegion, et as deleteJournaledOrphans, f as parentSuppliedValues, fa as hasNoCloudControlHandlers, fc as displayAssemblyPath, fi as malformedLocalResourcesWarning, fn as exportNameSecretExposure, fr as classifyReplaySecretRegion, fs as describeDockerExecFailure, ft as nestedChildStackName$1, g as mergeNoChangeOutputs, ga as isStatefulRecreateTargetForReplace, gc as resolveBucketRegion, gi as malformedOrphansRefusalMessage, gn as collectPublishedOutputNames, go as recordMaskOnlyValue, gr as assertFlagRoleArn, gs as formatDockerLoginError, gt as withNestedRevertRun, h as keptWholeReasonText, ha as MULTI_REGION_RECREATE_BLOCKED_TYPES, hi as malformedOrphanRowsKeptWarning, hn as collectDeclaredOutputNames, ho as provenPublicValue, hr as applyRoleArnIfSet, hs as finchSecretArgvRefusal, ht as revertedNestedRowIds, i as childTemplateLoader, ia as unreadableOrphanRecords, ic as processStackMessages, ii as hasReadableResources, in as DeploymentEventsStore, io as redactSecretsForState, is as parseBootstrapMarker, it as sameJournaledOrphans, ji as refuseMalformedOrphans, jo as splitImportedOps, jr as coerceParameterTypedValue, js as synthesisStatusMessage, jt as replacementNeverSwapped, ki as refuseMalformedOrphanRecords, kn as withCreateTokenLedger, ko as S3StateBackend, ks as getDockerImageBySourceHash, kt as planFailedOps, l as templateIdentity, la as unwrittenCreateOnlyReplacement, lc as ownValue, li as malformedExportSourceWarning, ln as secretBearing, lo as pathCrossesDottedKey, lr as DiffCalculator, ls as buildDockerImage, lt as displacedPhysicalIdShown, m as isSecretBearingReferenceString, ma as shownType, mc as resolveAssemblyPath, mi as malformedOrphanRecordsWarning, mn as noEchoParameterValueSeed, mo as carriesSecretMask, mr as regionLessSecretName, ms as dockerSpawnEnvWithSensitive, n as IMPLICIT_DELETE_DEPENDENCIES, na as repairMalformedResourcesForReadOnly, nc as AssemblyReader, ni as hasReadableOrphans, nn as unsupportedFinalSnapshotError, no as maskSecretsInText, ns as getBootstrapMarkerKey, nt as journaledOrphanLines, o as isAbsoluteAssetPath, oa as withheldAccountClause, oc as hasOwnKey, oi as isReadableResourceEntry, on as WITHHELD_NAME_DISPLAY, oo as DYNAMIC_REFERENCE_TOKEN_SCAN, os as validateAssetBucketName, ot as planOrphanAdoption, p as readRecordedConditionVerdicts, pa as findReplacedReadersOfRecreateTargets, pc as renderAssemblyPathEscape, pi as malformedOrphanRecordsRefusalMessage, pn as isWholeDynamicReferenceValue, po as identityKeyFor, pr as producerRegionsFromState, ps as describeDockerFailure, pt as recordDisplacedSkips, q as green, qa as literalSplitDelimitersOf, qi as refuseMalformedResourcesForDeploy, qn as CloudControlProvider, qo as WorkGraph, qs as MIGRATE_TMP_PREFIX, qt as stateSecretNameNeedles, r as computeImplicitDeleteEdges, ra as unpreviewableOrphanRecords, rc as StageLoadError, ri as hasReadableOutputs, rn as DeploymentEventsReader, ro as markSameGenerationBag, rs as isCrossRegionRedirect, rt as loadJournaledOrphans, s as listNestedTemplateRows, sa as findActionableSilentDrops, sc as hasPlainPrototype, si as malformedDriftResourcePropertiesWarning, sn as displayTextOrWithheld, so as dynamicReferenceTokens, ss as validateContainerRepoName, st as NESTED_PENDING_PARENT_REASON, t as DeployEngine, ta as repairMalformedResourcePropertiesForReadOnly, tc as derivePartitionAndUrlSuffix, ti as displayLogicalId, tn as refusesFinalSnapshot, to as maskSecretsInError, tr as isWaitAbandonedError, ts as ensureAssetStorage, tt as isHandledOrphan, u as conditionFingerprint, uc as absoluteAssemblyPathEscape, ui as malformedLocalOutputsWarning, un as secretBearingStateKeyWarning, uo as inheritNestedStackParameterAssociations, ur as INTRINSIC_KEYS, us as resolveDockerContextDirectory, ut as dropSettledNestedJournals, v as withResourceDeadline, va as renderStatefulReason, vi as malformedOutputsRefusalMessage, vn as bindingSkippedOutputs, vo as recordNoEchoAttributeValues, vr as explicitRoleArnOrThrow, vs as isDockerClientEnvKey, vt as withNestedStackContext, w as readProtection, wi as malformedScrubResourceEntriesRefusalMessage, wn as formatDestructiveChange, wo as TEMPLATE_SOURCED_RULES, wr as envCredentialsAreAssumedRole, ws as runDockerStreaming, wt as withStackRecords, x as PROTECTION_PROPERTY_BY_TYPE, xi as malformedResourceEntriesWarning, xn as maskingRetryLogger, xo as STATE_SOURCED_BASELINE_RULES, xr as AWS_CREDENTIAL_ENV_KEYS, xs as redactDockerArgvValues, y as recordedProtectionEvidence, yi as malformedOutputsWarning, yn as DEFAULT_RESOURCE_TIMEOUT_MS, yo as recordProvenPublicExpression, yr as isIamRoleArn, ys as isMalformedEnvKey, yt as replayFailedOperations, zi as refuseMalformedResourceEntriesForDestroy, zo as importableOutputs, zr as keepsSecretReferenceToken, zs as resolveStateBucketWithDefault } from "./deploy-engine-aXeTL7rk.js";
-import { t as getCdkdVersion } from "./version-BJ10lRpQ.js";
+import { $ as recordDisplacedSkips, $a as noEchoLeavesOf, $i as refuseMalformedResourcesForDeploy, $n as withPrintingSecrets, $o as importableOutputs, $s as resolveStateBucketWithDefault, $t as secretNamePrintingBag, A as gray, Ac as resolveBucketRegion, Ai as malformedScrubResourceEntriesRefusalMessage, An as findDestructiveChanges, Ao as recordMaskOnlyValue, Ar as envCredentialsAreAssumedRole, As as formatDockerLoginError, At as removeProtectionTypeList, B as isHandledOrphan, Ba as prefetchCreateOnlyPropertyPaths, Bi as refuseMalformedOutputs, Bo as isSingleDynamicReferenceToken, Br as getAccountInfo, Bs as escapeRegExp, Bt as findNestedStackTypeChanges, C as recordedProtectionNote, Ca as isStatefulRecreateTargetSync, Cc as ownValue, Ci as malformedOrphansWarning, Cn as collectPublishedOutputNames, Co as pathCrossesDottedKey, Cr as assertSendableRoleArn, Cs as buildDockerImage, D as createReadOnlyAttributeHealerFactory, Dc as renderAssemblyPathEscape, Di as malformedResourceEntriesWarning, Dn as DEFAULT_RESOURCE_WARN_AFTER_MS, Do as identityKeyFor, Dr as AWS_CREDENTIAL_ENV_KEYS, Ds as describeDockerFailure, E as formatResourceLine, Ec as displayAssemblyPath, Ei as malformedRenderedContainersWarning, En as DEFAULT_RESOURCE_TIMEOUT_MS, Er as sendableAssumeRoleCommand, Es as describeDockerExecFailure, F as namesAnyDeclaredParameter, Fi as refuseMalformedOrphanRecords, Fo as STATE_SOURCED_BASELINE_RULES, Fs as redactDockerArgvValues, Ft as isReplacementOrphan, G as makeSiblingClaimReader, Gi as refuseMalformedResourceEntriesForDestroy, Go as splitImportedOps, Gr as keepsSecretReferenceToken, Gs as synthesisStatusMessage, H as loadJournaledOrphans, Ha as describeTypeWithThrottleRetry, Hi as refuseMalformedResourceAttributesForOrphan, Ho as isLockInfoExpired, Hr as carriesDynamicReference, Hs as AssetManifestLoader, Ht as inheritProducerRegions, I as reachableDivergentParameters, Ii as refuseMalformedOrphanRecordsForDestroy, In as withCreateTokenLedger, Io as STATE_SOURCED_CROSS_GENERATION_RULES, Is as redactedDockerCause, It as planFailedOps, J as displacedOpClause, Ja as TemplateParser, Ji as refuseMalformedResourceEntriesForOrphan, Jn as ProviderRegistry, Jo as exportNamesCarriedFrom, Jr as isStalePlaceholderArnAttribute, Js as loadCdkJson, Jt as updatePartialReason, K as planOrphanAdoption, Ki as refuseMalformedResourceEntriesForImport, Ko as acceptedCreateOnlyDropsOf, Kr as AWS_NO_VALUE, Ks as getDefaultStateBucketName, L as resourcesNamingDeclaredParameter, Li as refuseMalformedOrphans, Lo as STATE_SOURCED_READBACK_RULES, Lr as coerceParameterTypedValue, Ls as runDockerForeground, Lt as planRollback, M as red, Mi as previewableOrphanRecords, Mn as RollbackInlinePolicyWriters, Mo as recordNoEchoAttributeValues, Ms as isDockerClientEnvKey, Mt as recordAfterRollbackUpdate, N as yellow, Ni as refuseDivergentRecordRegionForDestroy, No as recordProvenPublicExpression, Ns as isMalformedEnvKey, Nt as demoteSupersededOrphans, O as bold, Oc as resolveAssemblyPath, Oi as malformedResourcePropertiesWarning, On as maskingRetryLogger, Oo as carriesSecretMask, Or as applyCallerIdentityCredentials, Os as dockerSpawnEnvWithSensitive, P as computeParameterTaint, Pn as ledgerForStack, Po as wholeStringLeavesOf, Ps as partitionSensitiveEnv, Pt as isJournaledOrphan, Q as nestedChildStackName$1, Qa as maskedLeafCoordinatesOf, Qi as refuseMalformedResourcePropertiesForOrphan, Qo as importableOutputKeys, Qr as parameterInputsFor, Qs as resolveSkipPrefix, Qt as orphanRecordsPrintingBag, R as deleteJournaledOrphans, Ri as refuseMalformedOrphansForDestroy, Ro as TEMPLATE_SOURCED_RULES, Rr as isUnboundTemplateParameter, Rs as runDockerStreaming, Rt as replacementNeverSwapped, S as recordedProtectionEvidence, Sa as isStatefulRecreateTargetForReplace, Sc as nullPrototypeRecord, Si as malformedOrphansRefusalMessage, Sn as collectDeclaredOutputNames, So as isUncertifiedBaselineMaskPosition, Sr as assertFlagRoleArn, Ss as buildDenyExternalAccessPolicy, Tc as describeFileReadFailure, Ti as malformedOutputsWarning, Tn as bindingSkippedOutputs, To as recordNestedStackParameterExpressions, Tr as isIamRoleArn, Ts as describeDockerCapturedOutput, U as makeForeignHolderScan, Ua as withRetry, Ui as refuseMalformedResourceEntries, Uo as S3StateBackend, Ur as carriesFetchableDynamicReference, Us as getDockerImageBySourceHash, V as journaledOrphanLines, Va as templateResourceTypes, Vi as refuseMalformedOutputsForDestroy, Vo as LockManager, Vr as isImpossibleEmptyStoredAttribute, Vs as stripControlChars, W as sameJournaledOrphans, Wi as refuseMalformedResourceEntriesForDeploy, Wo as rebuildClientForBucketRegion, Wr as isNamelessDynamicReferenceError, Ws as Synthesizer, X as dropSettledNestedJournals, Xa as maskReadbackAtCoordinates, Xi as refuseMalformedResourcePropertiesForDrift, Xn as wouldReturnToSdkProvider, Xo as hasReasonlessBaselineRefusal, Xs as resolveAutoAssetStorage, Xt as journaledOrphanPrintingBag, Y as displacedPhysicalIdShown, Ya as isMarkedCoordinate, Yi as refuseMalformedResourcePropertiesForDestroy, Yn as ccBrokenReason, Yo as hasReadableExportSet, Yr as refStateLookupFromResource, Ys as resolveApp, Yt as completedReplayEntries, Za as maskWholeValue, Zi as refuseMalformedResourcePropertiesForExport, Zn as isCustomResourceType$1, Zo as hasUnverifiableParameterRefusal, Zr as withSharedDrainBudget, Zs as resolveCaptureObservedState, Zt as maskEventTextWithBoundBags, _ as makeCanonicalizePropertiesFn, _a as NO_CC_HANDLERS_REASON, _c as StageLoadError, _i as malformedLocalResourceEntriesWarning, _n as secretBearingStateKeyWarning, _o as markSameGenerationBag, _r as IntrinsicFunctionResolver, _s as isCrossRegionRedirect, a as findNestedTemplateTreeDefect, aa as repairMalformedOutputsForReadOnly, ac as CFN_TEMPLATE_BODY_LIMIT, ai as accountArgs, an as createPreDeleteFinalSnapshot, ao as createUnionSecretMasker, ar as deleteSkipReason, as as isSensitiveAttributeName, at as replayFailedOperations, b as noEchoParameterNamesOf, ba as shownType, bc as hasOwnKey, bi as malformedOrphanRecordsWarning, bn as isWholeDynamicReferenceValue, bo as DYNAMIC_REFERENCE_TOKEN_SCAN, br as regionLessSecretName, bs as validateAssetBucketName, c as renderNestedTemplateTreeDefect, ca as repairMalformedResourcesForReadOnly, cc as findLargeInlineResources, ci as hasReadableOrphans, cn as refusesFinalSnapshot, co as logOnlyValueCount, cs as buildAssetRedirectMap, ct as destroyStackRecordsView, d as conditionInputsFrom, da as unreadableResourceEntries, dc as decodeListingKey, di as isReadableOrphanRecord, dn as DeploymentEventsStore, do as recordLogOnlyValue, ds as rewriteTemplateAssetReferences, dt as PROTECTION_PROPERTY_BY_TYPE, ea as refuseMalformedResourcesForDestroy, ec as resolveStateBucketWithDefaultAndSource, ei as JSON_LISTING_HOLE_VALUE, en as stateSecretNameNeedles, eo as noEchoOutputsComparison, er as CloudControlProvider, es as isReadableBag, f as parentSuppliedValues, fa as withheldAccountClause, fc as expectedOwnerParam, fi as isReadableResourceEntry, fn as extractDeploymentEventError, fo as shareLogOnlyValues, fs as AssetModeResolver, ft as isProtectionValueActive, g as mergeNoChangeOutputs, gc as AssemblyReader, gi as malformedLocalOutputsWarning, gn as secretBearing, go as maskSecretsInText, gr as INTRINSIC_KEYS, gs as getBootstrapMarkerKey, h as keptWholeReasonText, ha as unwrittenCreateOnlyReplacement, hc as derivePartitionAndUrlSuffix, hi as malformedExportSourceWarning, hn as exportAliasCollisionScrubWarning, ho as maskSecretsInError, hr as DiffCalculator, hs as ensureAssetStorage, i as childTemplateLoader, ia as repairMalformedOrphansForReadOnly, ic as ssmResolvedValueType, ii as UNREADABLE_RESOURCES_MAP_ROW, in as ccRoutedFinalSnapshotError, io as carryLogOnlyValues, ir as deleteIndeterminateGuards, is as AssetPublisher, it as withNestedStackContext, j as green, ji as malformedStateRefusalMessage, jn as formatDestructiveChange, jo as recordMaskOnlyValuesIn, js as getDockerCmd, jt as orphanDeleteNeedsIdentity, k as cyan, ki as malformedResourcesWarning, kn as constructPathOf, ko as provenPublicValue, kr as callerEnvCredentials, ks as finchSecretArgvRefusal, l as templateIdentity, la as unpreviewableOrphanRecords, lc as uploadCfnTemplate, li as hasReadableOutputs, ln as unsupportedFinalSnapshotError, lo as printingCorpusOf, ls as createAssetRedirectResolver, m as isSecretBearingReferenceString, mc as canonicalizeRegion, mi as malformedExportNamesWarning, mn as displayTextOrWithheld, mo as errorCauseChain, ms as assertAssetBucketRegion, mt as readProtection, n as IMPLICIT_DELETE_DEPENDENCIES, na as refuseMalformedState, nc as stateBucketExistenceConfirmed, ni as STATE_RESOURCES_MALFORMED, nn as PRE_DELETE_SNAPSHOT_TYPES, no as readsNoEchoSource, ns as orphansCarriedFrom, nt as withNestedRevertRun, o as isAbsoluteAssetPath, oa as repairMalformedResourceEntriesForReadOnly, oc as CFN_TEMPLATE_URL_LIMIT, oi as deployRefusesOrphanRowsReason, on as effectiveDeletionPolicy, oo as hasMaskableValues, os as stringifyValue, ot as replayRollback, p as readRecordedConditionVerdicts, pa as findActionableSilentDrops, pc as PARTITION_TABLE, pi as malformedDriftResourcePropertiesWarning, pn as WITHHELD_NAME_DISPLAY, po as createSecretMasker, ps as BOOTSTRAP_MARKER_PREFIX, pt as perType, q as NESTED_PENDING_PARENT_REASON, qa as DagBuilder, qi as refuseMalformedResourceEntriesForImportSave, qn as CC_BROKEN_REASON, qo as describeRegionValueKind, qr as cfnRefValueFromPhysicalId, qs as getLegacyStateBucketName, qt as updatePartialMessage, r as computeImplicitDeleteEdges, ra as repairMalformedOrphanRecordsForReadOnly, rc as warnDeprecatedNoPrefixCliFlag, ri as UNREADABLE_ORPHANS_CONTAINER_ROW, rn as buildFinalSnapshotIdentifier, ro as liveMatchesUnresolvedTokenFrame, rr as UNSPECIFIED_SKIP_REASON, rs as shouldRetainResource, s as listNestedTemplateRows, sa as repairMalformedResourcePropertiesForReadOnly, sc as MIGRATE_TMP_PREFIX, si as displayLogicalId, sn as isFinalSnapshotError, so as literalSplitDelimitersOf, sr as isWaitAbandonedError, ss as WorkGraph, t as DeployEngine, ta as refuseMalformedResourcesForExport, tc as resolveUseCdkBootstrapAssets, ti as STATE_REGION_DIVERGED, tn as ATOMIC_FINAL_SNAPSHOT_TYPES, tr as slowCcOperationTimeoutMs, ts as orphansAfterRollback, tt as revertedNestedRowIds, u as conditionFingerprint, ua as unreadableOrphanRecords, uc as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, ui as hasReadableResources, un as DeploymentEventsReader, uo as recordLogOnlyParameterValue, us as loadPublishableAssetManifest, ut as withStackRecords, v as noEchoAttributeNamesOf, va as hasNoCloudControlHandlers, vc as processStackMessages, vi as malformedLocalResourcesWarning, vn as secretSafeKeyDisplay, vo as redactSecretsForState, vr as classifyReplaySecretRegion, vs as parseBootstrapMarker, wa as renderStatefulReason, wc as absoluteAssemblyPathEscape, wi as malformedOutputsRefusalMessage, wn as isExportAliasCollision, wo as inheritNestedStackParameterAssociations, wr as explicitRoleArnOrThrow, ws as resolveDockerContextDirectory, x as withResourceDeadline, xa as MULTI_REGION_RECREATE_BLOCKED_TYPES, xc as hasPlainPrototype, xi as malformedOrphanRowsKeptWarning, xn as noEchoParameterValueSeed, xo as dynamicReferenceTokens, xr as applyRoleArnIfSet, xs as validateContainerRepoName, y as noEchoComparisonForTemplate, ya as findReplacedReadersOfRecreateTargets, yc as defineOwnKey, yi as malformedOrphanRecordsRefusalMessage, yn as exportNameSecretExposure, yo as scrubResourceRecord, yr as producerRegionsFromState, ys as readBootstrapMarkerBody, z as dropFailedHint, zi as refuseMalformedOrphansForOrphan, zo as WHOLE_DYNAMIC_REFERENCE_PATTERN, zr as parameterTypeMayLoseSecretIdentity, zs as warnFinchArgvExposure, zt as resolveReplacementOldType } from "./deploy-engine-FDsHckZR.js";
+import { t as getCdkdVersion } from "./version-B9EuX7Oh.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -69,32 +69,6 @@ function describeStateKey(key, suffix = STATE_FILE_SUFFIX, knownPrefix) {
 }
 const STATE_KEY_MAX_CODE_POINTS = STACK_REF_MAX_CODE_POINTS + 64;
 
-//#endregion
-//#region src/provisioning/remove-protection-types.ts
-const SDK_REMOVE_PROTECTION_TYPES = [
-	"AWS::Logs::LogGroup",
-	"AWS::RDS::DBInstance",
-	"AWS::RDS::DBCluster",
-	"AWS::DocDB::DBCluster",
-	"AWS::Neptune::DBCluster",
-	"AWS::Neptune::DBInstance",
-	"AWS::DynamoDB::Table",
-	"AWS::DynamoDB::GlobalTable",
-	"AWS::EC2::Instance",
-	"AWS::Cognito::UserPool",
-	"AWS::AutoScaling::AutoScalingGroup",
-	"AWS::ElasticLoadBalancingV2::LoadBalancer",
-	"AWS::EMR::Cluster"
-];
-function removeProtectionTypes() {
-	return [...SDK_REMOVE_PROTECTION_TYPES, ...ccProtectionRegistryTypes()];
-}
-function removeProtectionTypeList() {
-	const types = removeProtectionTypes();
-	if (types.length < 2) return types.join("");
-	return `${types.slice(0, -1).join(", ")}, and ${types[types.length - 1]}`;
-}
-
 //#endregion
 //#region src/cli/options.ts
 function parseContextOptions(contextArgs) {
@@ -2421,7 +2395,7 @@ function collectCrossStackRefs(node, onRef) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-4lVceW9g.js");
+	providerClasses ??= import("./provider-classes-hW6X0dKh.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -2943,7 +2917,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 					const syncValidation = validateRecreateTargets({
 						template: stackInfo.template,
 						state: stateForRecreateCheck?.state ?? {
-							version: 10,
+							version: 11,
 							stackName: stackInfo.stackName,
 							region: stackRegion,
 							resources: {},
@@ -2978,7 +2952,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 						const replacedReaders = await findReplacedReadersOfRecreateTargets({
 							template: stackInfo.template,
 							state: stateForRecreateCheck?.state ?? {
-								version: 10,
+								version: 11,
 								stackName: stackInfo.stackName,
 								region: stackRegion,
 								resources: {},
@@ -4233,7 +4207,7 @@ async function loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery
 			region,
 			resources: {},
 			outputs: {},
-			version: 10,
+			version: 11,
 			lastModified: Date.now()
 		},
 		unreadable: [],
@@ -4377,7 +4351,8 @@ function maskOutputChangeForDisplay(change, mask, nameCorpus) {
 	return changed ? shown : change;
 }
 async function computeStackDiff(currentState, template, region, stackName, stateBackend, diffCalculator, options = {}) {
-	const { parameters, canonicalizeProperties, cfnFallback, inheritSecretBearingTemplate, inheritedSecrets, attributeHealer, parentUnresolvedParameters } = options;
+	const { parameters, canonicalizeProperties, cfnFallback, inheritSecretBearingTemplate, inheritedSecrets, attributeHealer, parentUnresolvedParameters, inheritedNoEchoParameters } = options;
+	const noEchoParametersOf = (t) => /* @__PURE__ */ new Set([...noEchoParameterNamesOf(t), ...inheritedNoEchoParameters ?? []]);
 	const inheritedForResolver = inheritedSecrets !== void 0 && hasMaskableValues(inheritedSecrets) ? inheritedSecrets : void 0;
 	const intrinsicResolver = new IntrinsicFunctionResolver(region, { cfnFallback: cfnFallback ?? true });
 	const outputsDigestSource = structuredClone({
@@ -4604,7 +4579,12 @@ async function computeStackDiff(currentState, template, region, stackName, state
 			}
 		} };
 	}
-	const changes = await diffCalculator.calculateDiff(stateForDiff, effectiveTemplate, resolveFn, canonicalizeProperties, void 0, void 0, maskForLog, void 0, maskedInputs, options.refusalRecovery);
+	const changes = await diffCalculator.calculateDiff(stateForDiff, effectiveTemplate, resolveFn, canonicalizeProperties, void 0, void 0, maskForLog, void 0, maskedInputs, options.refusalRecovery, noEchoComparisonForTemplate(effectiveTemplate, conditions === void 0 ? void 0 : Object.fromEntries(Object.entries(conditions).filter(([name]) => !stillUnknown.includes(name))), mergedParameters, stateForDiff.resources, /* @__PURE__ */ new Set([region, stackName]), inheritedNoEchoParameters));
+	const noEchoReaders = Object.keys(effectiveTemplate.Resources ?? {}).filter((logicalId) => changes.get(logicalId)?.changeType === "NO_CHANGE" && readsNoEchoSource(effectiveTemplate.Resources?.[logicalId]?.Properties, {
+		parameters: noEchoParametersOf(effectiveTemplate),
+		...conditions !== void 0 && { conditions: Object.fromEntries(Object.entries(conditions).filter(([name]) => !stillUnknown.includes(name))) }
+	}));
+	if (noEchoReaders.length > 0) logger.info(safeMsg`Stack ${displayStackName(stackName)}: ${String(noEchoReaders.length)} unchanged resource(s) read a NoEcho parameter, whose value state holds only as ***: the deploy compares it with AWS, and updates a resource whose value changed.`);
 	const nestedStackTypeChanges = findNestedStackTypeChanges({
 		changes,
 		stateResources: stateForDiff.resources
@@ -4619,13 +4599,26 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		noEchoParameterValues: noEchoParameterValueSeed(effectiveTemplate.Parameters, mergedParameters, inheritedForResolver, parameters)
 	});
 	const templateHasSecretReference = resolved.templateHasSecretReference || inheritSecretBearingTemplate === true || !everyConditionKnown && templateHasSecretDynamicReference(template);
-	const diffOutputsAgainst = (desired, exportNames, forceLegacyRecord = false) => computeOutputsDiff(currentState.outputs, desired, exportNames, resolved.secretSourceKeys, {
-		declaredKeys: resolved.declaredKeys,
-		templateHasSecretReference,
-		forceLegacyRecord,
-		secretBearingExportNames: resolved.secretBearingExportNames,
-		storedExportNames: Array.isArray(currentState.exportNames) ? currentState.exportNames.filter((name) => typeof name === "string") : void 0
+	const outputTemplateValues = Object.create(null);
+	for (const [name, definition] of Object.entries(effectiveTemplate.Outputs ?? {})) outputTemplateValues[name] = definition?.Value;
+	const compareNoEchoOutputs = noEchoOutputsComparison(outputTemplateValues, {
+		parameters: noEchoParametersOf(effectiveTemplate),
+		attributeIsNoEcho: (logicalId, attribute) => {
+			const names = (Object.hasOwn(stateForDiff.resources, logicalId) ? stateForDiff.resources[logicalId] : void 0)?.noEchoAttributeNames;
+			return Array.isArray(names) && names.includes(attribute);
+		},
+		...conditions !== void 0 && { conditions: Object.fromEntries(Object.entries(conditions).filter(([name]) => !stillUnknown.includes(name))) }
 	});
+	const diffOutputsAgainst = (rawDesired, exportNames, forceLegacyRecord = false) => {
+		const { current: storedOutputs, desired } = compareNoEchoOutputs(currentState.outputs, rawDesired);
+		return computeOutputsDiff(storedOutputs, desired, exportNames, resolved.secretSourceKeys, {
+			declaredKeys: resolved.declaredKeys,
+			templateHasSecretReference,
+			forceLegacyRecord,
+			secretBearingExportNames: resolved.secretBearingExportNames,
+			storedExportNames: Array.isArray(currentState.exportNames) ? currentState.exportNames.filter((name) => typeof name === "string") : void 0
+		});
+	};
 	let outputChanges = [];
 	if (!resolved.resolutionFailed) outputChanges = diffOutputsAgainst(resolved.outputs, resolved.exportNames);
 	else {
@@ -4676,6 +4669,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		printingSecrets,
 		resolvedParameters: mergedParameters,
 		conditions,
+		knownConditions: conditions === void 0 ? void 0 : Object.fromEntries(Object.entries(conditions).filter(([name]) => !stillUnknown.includes(name))),
 		trust: {
 			parameters: trustedParameters,
 			conditions: trustedConditions,
@@ -4832,6 +4826,20 @@ function rowValueTrusted(value, parentState, parentConditions, trust) {
 		plainObjects: false
 	})(value);
 }
+function noEchoFedChildParameters(parentStackRow, parentNoEchoParameters, parentConditions, parentResources) {
+	const fed = /* @__PURE__ */ new Set();
+	const rawParams = parentStackRow.Properties?.["Parameters"];
+	if (rawParams === null || typeof rawParams !== "object") return fed;
+	for (const [name, value] of Object.entries(rawParams)) if (readsNoEchoSource(value, {
+		parameters: parentNoEchoParameters,
+		attributeIsNoEcho: (logicalId, attribute) => {
+			const names = (Object.hasOwn(parentResources, logicalId) ? parentResources[logicalId] : void 0)?.noEchoAttributeNames;
+			return Array.isArray(names) && names.includes(attribute);
+		},
+		...parentConditions !== void 0 && { conditions: parentConditions }
+	})) fed.add(name);
+	return fed;
+}
 async function resolveChildStackParameters(parentStackRow, parentTemplate, parentState, region, parentStackName, stateBackend, parentParameters, parentConditions, cfnFallback, printingSecrets, attributeHealer, unresolvedKeys, trust) {
 	const rawParams = parentStackRow.Properties?.["Parameters"];
 	if (!rawParams || typeof rawParams !== "object" || Array.isArray(rawParams)) return {};
@@ -4871,7 +4879,7 @@ function recordedTemplateResources(template, state) {
 	return recorded;
 }
 async function buildDiffTree(args) {
-	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, parentUnresolvedParameters, canonicalizeProperties, assetRedirect, cfnFallback, previewOrphanAdoption, attributeHealerFor, ancestorTemplatePaths, isNestedChild, inheritedSecrets, refusalRecovery } = args;
+	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, parentUnresolvedParameters, canonicalizeProperties, assetRedirect, cfnFallback, previewOrphanAdoption, attributeHealerFor, ancestorTemplatePaths, isNestedChild, inheritedSecrets, inheritedNoEchoParameters, refusalRecovery } = args;
 	const attributeHealer = attributeHealerFor?.(stackName, region);
 	const { state, unreadable, unreadableContainers, deployRefusals } = await loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery);
 	const createOnlyPrefetch = prefetchCreateOnlyPropertyPaths(templateResourceTypes(recordedTemplateResources(template, state)));
@@ -4885,6 +4893,7 @@ async function buildDiffTree(args) {
 			...cfnFallback !== void 0 && { cfnFallback },
 			...previewOrphanAdoption && { previewOrphanAdoption },
 			...inheritedSecrets && { inheritedSecrets },
+			...inheritedNoEchoParameters && { inheritedNoEchoParameters },
 			...attributeHealer && { attributeHealer },
 			...refusalRecovery && { refusalRecovery },
 			inheritSecretBearingTemplate: false,
@@ -4894,7 +4903,7 @@ async function buildDiffTree(args) {
 	} finally {
 		createOnlyPrefetch.cancel();
 	}
-	const { changes, outputChanges, adoptedOrphans, adoptedRecords, blocking, unreadableOrphans, deployRefusals: adoptedDeployRefusals, effectiveTemplate, printingSecrets, resolvedParameters, conditions, trust } = stackDiff;
+	const { changes, outputChanges, adoptedOrphans, adoptedRecords, blocking, unreadableOrphans, deployRefusals: adoptedDeployRefusals, effectiveTemplate, printingSecrets, resolvedParameters, conditions, knownConditions, trust } = stackDiff;
 	const stateAfterAdoption = Object.keys(adoptedRecords).length > 0 ? {
 		...state,
 		resources: {
@@ -4937,6 +4946,7 @@ async function buildDiffTree(args) {
 		const grandchildTemplates = indexNestedChildTemplates(childTemplate, childTemplatePath);
 		if (assetRedirect) rewriteTemplateAssetReferences(childTemplate, assetRedirect);
 		const childUnresolvedParameters = /* @__PURE__ */ new Set();
+		const childNoEchoParameters = noEchoFedChildParameters(resource, /* @__PURE__ */ new Set([...noEchoParameterNamesOf(effectiveTemplate), ...inheritedNoEchoParameters ?? []]), knownConditions, stateAfterAdoption.resources);
 		const childParameters = await resolveChildStackParameters(resource, effectiveTemplate, stateAfterAdoption, region, stackName, stateBackend, resolvedParameters, conditions, cfnFallback, printingSecrets, attributeHealer, childUnresolvedParameters, trust);
 		node.children.push(await buildDiffTree({
 			stackName: childStackName,
@@ -4958,6 +4968,7 @@ async function buildDiffTree(args) {
 			isNestedChild: true,
 			parentHasSecretReference: secretBearingAbove,
 			inheritedSecrets: printingSecrets,
+			...childNoEchoParameters.size > 0 && { inheritedNoEchoParameters: childNoEchoParameters },
 			...refusalRecovery && { refusalRecovery }
 		}));
 	}
@@ -7921,6 +7932,33 @@ function equalModuloMask(state, aws, mask) {
 	if (aKeys.length !== Object.keys(bObj).length) return false;
 	return aKeys.every((key) => Object.prototype.hasOwnProperty.call(bObj, key) && equalModuloMask(aObj[key], bObj[key], mask));
 }
+function equalModuloMarkedMask(state, aws, mask, coordinate, isMarked) {
+	const a = jsonForm(state);
+	const b = jsonForm(aws);
+	if (isMarked(coordinate) && isWhollyMask(a, mask)) return b !== void 0 && b !== null;
+	if (a === mask && typeof b === "string") return true;
+	if (a === b) return true;
+	if (a === null || b === null || a === void 0 || b === void 0) return a === b;
+	if (typeof a !== typeof b || typeof a !== "object") return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((v, i) => equalModuloMarkedMask(v, b[i], mask, [...coordinate, i], isMarked));
+	}
+	const aObj = a;
+	const bObj = b;
+	const aKeys = Object.keys(aObj);
+	if (aKeys.length !== Object.keys(bObj).length) return false;
+	return aKeys.every((key) => Object.prototype.hasOwnProperty.call(bObj, key) && equalModuloMarkedMask(aObj[key], bObj[key], mask, [...coordinate, key], isMarked));
+}
+function isWhollyMask(value, mask) {
+	if (value === mask) return true;
+	if (Array.isArray(value)) return value.length > 0 && value.every((v) => isWhollyMask(v, mask));
+	if (isPlainObject(value)) {
+		const values = Object.values(value);
+		return values.length > 0 && values.every((v) => isWhollyMask(v, mask));
+	}
+	return false;
+}
 function isPlainObject(value) {
 	return typeof value === "object" && value !== null;
 }
@@ -8214,7 +8252,7 @@ function notComparedOutcomes(report) {
 function outcomeExitSignal(outcome) {
 	return matchOutcome(outcome, {
 		drifted: () => "drifted",
-		notCompared: (n) => n.notComparedCause === "unresolvedToken" ? "none" : "incomplete",
+		notCompared: (n) => n.notComparedCause === "unresolvedToken" || n.notComparedCause === "noEchoParameter" ? "none" : "incomplete",
 		clean: () => "none",
 		unsupported: () => "none",
 		skipped: () => "none",
@@ -8254,6 +8292,10 @@ const UNCOMPARED_REASONS = {
 		kind: "unknown",
 		phrase: "only PARTIALLY compared: their state records a `{{resolve:...}}` spelling cdkd resolves for nobody, which no re-run can clear"
 	},
+	noEchoParameter: {
+		kind: "unknown",
+		phrase: "only PARTIALLY compared: their state holds a NoEcho parameter value only as the redaction mask, which no re-run can clear"
+	},
 	unsupported: {
 		kind: "byDesign",
 		phrase: "not compared AT ALL: their provider does not support drift detection yet"
@@ -8267,6 +8309,7 @@ const ANY_OF_IT_COMPARED = {
 	refused: true,
 	unresolvedToken: true,
 	uncertifiedBaseline: true,
+	noEchoParameter: true,
 	readFailed: false,
 	readAborted: false,
 	baselineRefused: false,
@@ -8658,6 +8701,7 @@ function notComparedReason(cause, record) {
 		unreadableRecord: "its state record is not readable as a resource — not an object, carrying no resource type, or holding a 'properties' map that is not an object — so there was nothing to compare (repair or re-import the record)",
 		unreadableMap: "the record's whole 'resources' map is not a JSON object, so no resource in it could be read or compared (repair or re-import the record)",
 		baselineRefused: "a `cdkd import` run refused to capture its observed baseline, so the only baseline available is the recorded properties that refusal already found untrustworthy" + (refusedRemedy === void 0 ? " (deploy a change to this resource to restore one)" : `. ${refusedRemedy}`),
+		noEchoParameter: `its state holds a NoEcho parameter's value only as the redaction mask${noEchoPathsClause(record)}, so that value was not compared — every other property was (permanent by design; a deploy compares it with AWS)`,
 		uncertifiedBaseline: "its recorded baseline holds the redaction mask at a position cdkd could not pair with the secret reference there, so that position was not compared — every other property was (deploy a change to this resource to re-capture the baseline)"
 	}[cause];
 }
@@ -8790,6 +8834,51 @@ async function resolveStateSecretExpressions(props, resolvers, secrets, options)
 	};
 	return await walk(props, "");
 }
+function noEchoPathsClause(record) {
+	const marked = record === void 0 ? void 0 : noEchoLeavesOf(record);
+	if (marked === void 0 || marked.length === 0) return "";
+	return ` at ${marked.map((coordinate) => coordinate.map((segment, i) => typeof segment === "number" ? `[${segment}]` : i === 0 ? segment : `.${segment}`).join("")).map((path) => displaySafe(path)).join(", ")}`;
+}
+function revertPathSegments(path) {
+	const segments = [];
+	for (const part of path.split(".")) {
+		const match = /^([^[]*)((?:\[\d+\])*)$/.exec(part);
+		if (match === null) {
+			segments.push(part);
+			continue;
+		}
+		if (match[1] !== "") segments.push(match[1]);
+		for (const index of match[2].matchAll(/\[(\d+)\]/g)) segments.push(Number(index[1]));
+	}
+	return segments;
+}
+function partitionNoEchoParameterChanges(changes, record, baseline) {
+	const marked = noEchoLeavesOf(record);
+	if (marked === void 0 || marked.length === 0) return {
+		kept: changes,
+		noEchoParameterPaths: []
+	};
+	const properties = record.properties ?? {};
+	const isMarked = (coordinate) => isMarkedCoordinate(coordinate, marked) || marked.some((leaf) => leaf.length > coordinate.length && coordinate.every((segment, i) => String(segment) === String(leaf[i])));
+	const kept = [];
+	const noEchoParameterPaths = [];
+	for (const change of changes) {
+		const coordinate = change.path.split(".");
+		if (marked.some((leaf) => {
+			const n = Math.min(leaf.length, coordinate.length);
+			for (let i = 0; i < n; i++) if (leaf[i] !== coordinate[i]) return false;
+			return true;
+		}) && carriesSecretMask(change.stateValue) && !pathCrossesDottedKey(properties, change.path) && !pathCrossesDottedKey(baseline, change.path) && equalModuloMarkedMask(change.stateValue, change.awsValue, "***", coordinate, isMarked)) {
+			noEchoParameterPaths.push(change.path);
+			continue;
+		}
+		kept.push(change);
+	}
+	return {
+		kept,
+		noEchoParameterPaths
+	};
+}
 function partitionUncertifiedBaselineChanges(changes, properties, baseline) {
 	const kept = [];
 	const uncertifiedPaths = [];
@@ -9073,13 +9162,14 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				} : protocolNormalized;
 				const paired = provider.canonicalizeDriftPair ? await provider.canonicalizeDriftPair(resource.resourceType, canonicalized.baseline, canonicalized.aws, resource.properties ?? {}) : canonicalized;
 				const nameBaseline = canonicalizeDerivedPatternBName(resource.resourceType, paired.baseline, paired.aws);
-				const partitioned = partitionUncertifiedBaselineChanges(calculateResourceDrift(nameBaseline, paired.aws, {
+				const noEchoPartitioned = partitionNoEchoParameterChanges(calculateResourceDrift(nameBaseline, paired.aws, {
 					ignorePaths: observedIgnorePaths.length ? [...ignorePaths, ...observedIgnorePaths] : ignorePaths,
 					unionWalkObjects: useObserved,
 					unorderedPaths
-				}), resource.properties ?? {}, baseline);
+				}), resource, baseline);
+				const partitioned = partitionUncertifiedBaselineChanges(noEchoPartitioned.kept, resource.properties ?? {}, baseline);
 				const reported = redactDriftChanges(partitioned.kept, secrets, secretResolutionFailed ? seededSecretPaths : secretPaths, maskSecretPaths);
-				const notComparedCause = secretResolutionFailed ? "refused" : partitioned.uncertifiedPaths.length > 0 ? "uncertifiedBaseline" : unresolvedTokens.size > 0 ? "unresolvedToken" : void 0;
+				const notComparedCause = secretResolutionFailed ? "refused" : partitioned.uncertifiedPaths.length > 0 ? "uncertifiedBaseline" : unresolvedTokens.size > 0 ? "unresolvedToken" : noEchoPartitioned.noEchoParameterPaths.length > 0 ? "noEchoParameter" : void 0;
 				if (reported.changes.length === 0) {
 					if (notComparedCause !== void 0) outcomes.push({
 						kind: "notCompared",
@@ -9100,6 +9190,7 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 					awsProperties: aws,
 					secrets,
 					uncertifiedPaths: partitioned.uncertifiedPaths,
+					noEchoParameterPaths: noEchoPartitioned.noEchoParameterPaths,
 					secretsIncomplete: secretResolutionFailed || unresolvedTokens.size > 0,
 					notComparedCause
 				});
@@ -9818,11 +9909,20 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 					let newProperties;
 					try {
 						if (provider.canonicalizeDriftPair) desiredProperties = (await provider.canonicalizeDriftPair(outcome.resourceType, desiredProperties, outcome.awsProperties, stateResource.properties ?? {})).baseline;
-						const certifiedOverlay = overlayLiveAtUncertifiedPaths(buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties, { preserveUntemplated: stateResource.observedProperties === void 0 }), outcome.uncertifiedPaths, outcome.awsProperties, desiredProperties, secrets, new Set(outcome.changes.map((change) => change.path.split(".", 1)[0] ?? "")));
+						const certifiedOverlay = overlayLiveAtUncertifiedPaths(buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties, { preserveUntemplated: stateResource.observedProperties === void 0 }), [...outcome.uncertifiedPaths, ...outcome.noEchoParameterPaths ?? []], outcome.awsProperties, desiredProperties, secrets, new Set(outcome.changes.map((change) => change.path.split(".", 1)[0] ?? "")));
 						const maskPreserved = preserveLiveValuesAtMaskedLeaves(unresolvedTokens.size > 0 ? preserveLiveValuesAtUnresolvedTokens(certifiedOverlay, outcome.awsProperties, unresolvedTokens, secrets) : certifiedOverlay, outcome.awsProperties, secrets, certifiedOverlay);
 						if (maskPreserved.unpreservablePaths.length > 0) {
 							totalUnresolvable++;
-							logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): refused to revert ${maskSecretsInText(maskPreserved.unpreservablePaths.join(", "), secrets)} — the recorded baseline holds only the redaction mask there, and AWS reports nothing to preserve, so cdkd has no value it may write. Three causes leave such a mask, and the record does not say which: a NoEcho custom-resource value (force that custom resource to update — change one of its properties, e.g. a nonce — and re-deploy, so its handler runs again and supplies the value); the Fn::Base64 encoding of a secret value, which cdkd never records (deploy a change to this resource, which sends it the encoded value again); or a readback position cdkd could not certify when the baseline was captured (deploy a change to this resource, so its baseline is re-captured). A re-deploy that leaves this resource unchanged sends it nothing, so it resolves this refusal for none of them.`);
+							const marked = noEchoLeavesOf(stateResource);
+							if (marked !== void 0 && maskPreserved.unpreservablePaths.every((path) => isMarkedCoordinate(revertPathSegments(path), marked))) {
+								const refusedPaths = maskSecretsInText(maskPreserved.unpreservablePaths.join(", "), secrets);
+								logger.error(safeMsg`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): refused to revert ${refusedPaths} — a NoEcho template parameter feeds it, the recorded baseline holds only the redaction mask there, and AWS reports nothing to preserve, so cdkd has no value it may write. Deploy the stack with the parameter's value to set it.`);
+								return;
+							}
+							const markedRefused = marked === void 0 ? [] : maskPreserved.unpreservablePaths.filter((path) => isMarkedCoordinate(revertPathSegments(path), marked));
+							const markedAmong = markedRefused.length > 0;
+							const markedPaths = maskSecretsInText(markedRefused.join(", "), secrets);
+							logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): refused to revert ${maskSecretsInText(maskPreserved.unpreservablePaths.join(", "), secrets)} — the recorded baseline holds only the redaction mask there, and AWS reports nothing to preserve, so cdkd has no value it may write. ${markedAmong ? `Where a NoEcho template parameter feeds a path (${markedPaths}), deploy the stack with the parameter's value to set it. For the other paths, three` : "Three"} causes leave such a mask, and the record does not say which: a NoEcho custom-resource value (force that custom resource to update — change one of its properties, e.g. a nonce — and re-deploy, so its handler runs again and supplies the value); the Fn::Base64 encoding of a secret value, which cdkd never records (deploy a change to this resource, which sends it the encoded value again); or a readback position cdkd could not certify when the baseline was captured (deploy a change to this resource, so its baseline is re-captured). A re-deploy that leaves this resource unchanged sends it nothing, so it resolves this refusal for none of them.`);
 							return;
 						}
 						newProperties = maskPreserved.properties;
@@ -9846,7 +9946,7 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 						try {
 							if (updateResult?.effectiveProperties) {
 								const delta = collectNarrowedTopLevelKeys(newProperties, updateResult.effectiveProperties);
-								if (Object.keys(delta).length > 0) narrowedByLogicalId.set(outcome.logicalId, keepBaselineAtUncertifiedPaths(redactSecretsForState(delta, secrets, revertBaseline, stateResource.observedProperties !== void 0 ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES), outcome.uncertifiedPaths, revertBaseline));
+								if (Object.keys(delta).length > 0) narrowedByLogicalId.set(outcome.logicalId, keepBaselineAtUncertifiedPaths(redactSecretsForState(delta, secrets, revertBaseline, stateResource.observedProperties !== void 0 ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES), [...outcome.uncertifiedPaths, ...outcome.noEchoParameterPaths ?? []], revertBaseline));
 							}
 						} catch (captureErr) {
 							logger.warn(`  ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, but the provider's reported effective properties could not be read — ${maskSecretsInText(captureErr instanceof Error ? captureErr.message : String(captureErr), secrets)}`);
@@ -9855,7 +9955,9 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 							if (updateResult !== void 0) {
 								const noEchoDeclared = recordNoEchoAttributeValues(updateResult, secrets, newProperties);
 								const next = recordAfterRollbackUpdate(stateResource, updateResult);
-								const attributes = next.attributes === void 0 ? void 0 : keepRecordedAttributesOverMask(redactSecretsForState(next.attributes, secrets), next.attributes, stateResource.attributes, noEchoDeclared);
+								const keptAttributes = next.attributes === void 0 ? void 0 : keepRecordedAttributesOverMask(redactSecretsForState(next.attributes, secrets), next.attributes, stateResource.attributes, noEchoDeclared);
+								const declaredNames = noEchoAttributeNamesOf(stateResource) ?? [];
+								const attributes = keptAttributes === void 0 || declaredNames.length === 0 ? keptAttributes : Object.fromEntries(Object.entries(keptAttributes).map(([name, value]) => [name, declaredNames.includes(name) ? maskWholeValue(value) : value]));
 								if (next.physicalId !== stateResource.physicalId || !sameRecordedJson(attributes, stateResource.attributes)) reRecordedByLogicalId.set(outcome.logicalId, {
 									physicalId: next.physicalId,
 									attributes
@@ -10429,6 +10531,16 @@ function countProtectedResources(state) {
 	}
 	return count;
 }
+function countProtectedJournaledOrphans(orphans, region) {
+	let count = 0;
+	for (const { ops } of orphans.segments) for (const op of ops) {
+		if (op.physicalIdRecoveredFromError !== true || op.deletionPolicy === "Retain") continue;
+		if (orphanDeleteNeedsIdentity(op.resourceType) && !op.createdResourceIdentity) continue;
+		const locator = perType(PROTECTION_PROPERTY_BY_TYPE, op.resourceType);
+		if (locator && isProtectionValueActive(op.resourceType, readProtection(op.attemptedProperties, locator, region))) count++;
+	}
+	return count;
+}
 async function runDestroyForStack(stackName, state, ctx) {
 	const providerClasses = await loadProviderClasses();
 	const logger = getLogger();
@@ -10503,7 +10615,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 	}
 	logger.info(`\nResources to be deleted (${resourceCount}):`);
 	for (const [logicalId, resource] of Object.entries(state.resources)) logger.info(`  - ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)})`);
-	const protectedCount = ctx.removeProtection ? countProtectedResources(state) : 0;
+	const protectedCount = ctx.removeProtection ? countProtectedResources(state) + countProtectedJournaledOrphans(journaledOrphans, state.region) : 0;
 	const orphansAtDestroy = state.orphans ?? [];
 	if (orphansAtDestroy.length > 0) {
 		logger.info(`\n${orphansAtDestroy.length} resource(s) are still in AWS from an earlier failed deploy. cdkd left them there because their DeletionPolicy is Retain (CDK's RemovalPolicy.RETAIN), and has been tracking them so a later deploy of this stack could adopt them back instead of colliding with their names.`);
@@ -10667,6 +10779,13 @@ async function runDestroyForStack(stackName, state, ctx) {
 				...ctx.eventRecorder !== void 0 && { recordEvent: (event) => ctx.eventRecorder.record(event) },
 				finalSnapshotClients: destroyAwsClients ?? ctx.baseAwsClients,
 				skipFinalSnapshot: ctx.skipFinalSnapshot === true,
+				...ctx.removeProtection === true && {
+					removeProtection: true,
+					foreignHolder: makeForeignHolderScan(ctx.stateBackend)({
+						stackName,
+						region: regionForState
+					})
+				},
 				importedProducerRegions: producerRegionsFromState(state),
 				...state.parentStack !== void 0 && { producerRegionsIncomplete: true }
 			}, { isInterrupted: () => lock.interrupted });
@@ -10820,6 +10939,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 								...ctx.skipFinalSnapshot === true && { skipFinalSnapshot: true },
 								...secretPrincipalOptIn !== void 0 && { resolveSecretDerivedPrincipals: secretPrincipalOptIn },
 								recordedAttributes: resource.attributes,
+								recordedNoEchoLeaves: resource.noEchoLeaves,
 								...ctx.stackDestroy === true && { stackDestroy: true }
 							}))) ?? void 0;
 							lastDeleteError = null;
@@ -11435,6 +11555,141 @@ function createDestroyCommand() {
 	return cmd;
 }
 
+//#endregion
+//#region src/cli/commands/rollback-drop-failed.ts
+function refuseDropFailedConflicts(options) {
+	const conflicting = [
+		...(options.orphan ?? []).length > 0 ? ["--orphan"] : [],
+		...options.revertFailed === true ? ["--revert-failed"] : [],
+		...options.skipFinalSnapshot === true ? ["--skip-final-snapshot"] : []
+	];
+	if (conflicting.length === 0) return;
+	throw new CdkdError(`--drop-failed cannot be combined with ${conflicting.join(", ")}: it replays nothing, it only removes one entry from the rollback journal. Run the rollback and the drop as separate commands.`, "ROLLBACK_DROP_FAILED_CONFLICT");
+}
+function selectDropTarget(segments, logicalId, stackShown) {
+	const named = logicalIdShown(logicalId);
+	const droppable = [];
+	let otherFailed = 0;
+	let completed = 0;
+	const droppableIds = /* @__PURE__ */ new Set();
+	segments.forEach((segment, index) => {
+		const failed = segment.failedOperations ?? [];
+		const replay = segment.reason === "nested-pending-parent" ? [] : splitImportedOps(failed, segment).replay;
+		for (const op of replay) if (isDroppable(op)) droppableIds.add(op.logicalId);
+		for (const op of failed) {
+			if (op.logicalId !== logicalId) continue;
+			if (replay.includes(op) && isDroppable(op)) droppable.push({
+				segment,
+				segmentNumber: index + 1,
+				op,
+				companions: replay.filter((c) => c.changeType === "UPDATE" && replacementNeverSwapped(c, [op]))
+			});
+			else otherFailed++;
+		}
+		completed += segment.operations.filter((op) => op.logicalId === logicalId).length;
+	});
+	if (droppable.length === 1) return droppable[0];
+	if (droppable.length > 1) throw new CdkdError(`The rollback journal of ${stackShown} holds ${droppable.length} entries for ${named} that --drop-failed could drop (segments ${droppable.map((d) => d.segmentNumber).join(", ")}), and it drops exactly one, so it does not choose. Nothing was changed. Remove the entry you mean from the stack's rollback-journal.json (next to its state.json) by hand.`, "ROLLBACK_DROP_FAILED_AMBIGUOUS");
+	if (otherFailed > 0) throw new CdkdError(`The rollback journal of ${stackShown} holds no entry for ${named} that --drop-failed can drop: it drops only a failed CREATE whose resource cdkd proved it made, journaled as its only record, the entry cdkd destroy and cdkd deploy keep retrying. ${named}'s failed operation(s) are of another kind, or one a newer journal entry may own; neither blocks either command. Nothing was changed.`, "ROLLBACK_DROP_FAILED_NOT_ORPHAN");
+	if (completed > 0) throw new CdkdError(`${named} is a completed operation in the rollback journal of ${stackShown}, not a failed one; --drop-failed drops failed operations only. Nothing was changed. To leave a completed operation out of a rollback, pass --orphan with its logical id.`, "ROLLBACK_DROP_FAILED_COMPLETED");
+	const ids = [...droppableIds].map(logicalIdShown);
+	throw new CdkdError(`The rollback journal of ${stackShown} has no entry for ${named}. Nothing was changed. ` + (ids.length === 0 ? "It holds no entry --drop-failed can drop." : `Entries --drop-failed can drop: ${ids.join(", ")}.`), "ROLLBACK_DROP_FAILED_UNKNOWN");
+}
+function isDroppable(op) {
+	return isJournaledOrphan(op) && op.physicalIdRecoveredFromError === true;
+}
+const POLICY_TARGETS = {
+	"AWS::SQS::QueuePolicy": "Queues",
+	"AWS::SNS::TopicPolicy": "Topics"
+};
+function dropTargetLines(target, segmentCount, logger) {
+	const { op } = target;
+	const lines = [`  - ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)})  ${displacedPhysicalIdShown(op, logger) ?? "a physical id"}  [failed CREATE, segment ${target.segmentNumber}/${segmentCount}]`];
+	const targetsKey = Object.hasOwn(POLICY_TARGETS, op.resourceType) ? POLICY_TARGETS[op.resourceType] : void 0;
+	const targets = targetsKey === void 0 ? void 0 : op.attemptedProperties?.[targetsKey];
+	if (Array.isArray(targets) && targets.length > 0) {
+		lines.push(`    ${targetsKey} it was attached to:`);
+		for (const t of targets) lines.push(`      - ${typeof t === "string" && t !== "" ? displacedPhysicalIdShown(op, logger, t) ?? "a value" : "a value that is not a string"}`);
+	}
+	if (target.companions.length > 0) lines.push(`    (with the failed replacement UPDATE recorded beside it, which names no resource of its own)`);
+	return lines;
+}
+async function confirmDrop(question) {
+	return confirmOrRefuse(question, {
+		suffix: " (y/N): ",
+		refusal: "The cdkd rollback --drop-failed confirmation prompt cannot run in a non-interactive environment. Pass --force (or -y / --yes) to confirm the drop, or run the command from a real terminal."
+	});
+}
+async function dropFailedJournalEntry(args) {
+	const { stateBackend, lockManager, stackName, region, logicalId, logger } = args;
+	const stackShown = `stack ${plainOrDescribed(stackName, "stack name")} (${plainOrDescribed(region, "region")})`;
+	let interrupted = false;
+	const sigintHandler = () => {
+		process.stderr.write("\nInterrupted — the rollback journal is not changed.\n");
+		interrupted = true;
+	};
+	process.on("SIGINT", sigintHandler);
+	const unforwardSigterm = forwardSigtermToSigint();
+	try {
+		await lockManager.acquireLockWithRetry(stackName, region, void 0, "rollback");
+	} catch (error) {
+		process.removeListener("SIGINT", sigintHandler);
+		unforwardSigterm();
+		throw error;
+	}
+	try {
+		const journal = await stateBackend.loadRollbackJournal(stackName, region);
+		if (!journal || journal.segments.length === 0) throw new CdkdError(`${stackShown.charAt(0).toUpperCase()}${stackShown.slice(1)} has no rollback journal; nothing to drop.`, "ROLLBACK_DROP_FAILED_NO_JOURNAL");
+		let stateData;
+		try {
+			stateData = await stateBackend.getState(stackName, region);
+		} catch (err) {
+			throw new CdkdError(`Could not read the state record of ${stackShown} (${err instanceof Error ? err.name : "an error"}), which the drop needs to mask the entry. Nothing was changed; re-run once it can be read.`, "ROLLBACK_DROP_FAILED_STATE_UNREADABLE");
+		}
+		const resources = stateData ? stateData.state.resources : {};
+		if (!isReadableBag(resources)) throw new CdkdError(`The state record of ${stackShown} holds resources that cannot be read, which the drop needs to mask the entry. Nothing was changed.`, "ROLLBACK_DROP_FAILED_STATE_UNREADABLE");
+		const stateResources = resources;
+		const judged = structuredClone(journal.segments);
+		demoteSupersededOrphans(judged);
+		const target = selectDropTarget(judged, logicalId, stackShown);
+		const drop = [target.op, ...target.companions].map((op) => ({
+			segment: target.segment,
+			op
+		}));
+		if (journal.segments.reduce((n, segment) => n + (segment.failedOperations ?? []).filter((op) => isHandledOrphan(drop, segment, op)).length, 0) !== drop.length) throw new CdkdError(`The rollback journal of ${stackShown} holds another entry identical to ${logicalIdShown(logicalId)}'s, so dropping it by its identity would drop more than one. Nothing was changed. Remove the entry you mean from the stack's rollback-journal.json (next to its state.json) by hand.`, "ROLLBACK_DROP_FAILED_AMBIGUOUS");
+		const printing = journaledOrphanPrintingBag(judged.flatMap((segment) => segment.failedOperations ?? []), stateResources);
+		withPrintingSecrets(printing, () => {
+			logger.info(safeMsg`\nDrop one entry from the rollback journal of ${stackShown}:`);
+			for (const line of dropTargetLines(target, journal.segments.length, logger)) logger.info(line);
+			logger.info("\nThis removes only the journal entry, which is cdkd's last record of that resource. Nothing is deleted in AWS: check the resource above by hand, and delete it yourself if it should not stay. cdkd destroy and cdkd deploy then no longer act on it.\n");
+		});
+		const stopIfInterrupted = () => {
+			if (!interrupted) return;
+			throw new CdkdError("Interrupted before the rollback journal was changed; nothing was dropped.", "ROLLBACK_DROP_FAILED_INTERRUPTED");
+		};
+		stopIfInterrupted();
+		if (!args.skipConfirmation) {
+			if (!await (args.confirm ?? confirmDrop)("Drop this entry from the rollback journal?")) {
+				logger.info("Drop cancelled; the rollback journal is not changed.");
+				return;
+			}
+		}
+		stopIfInterrupted();
+		const removed = await stateBackend.dropRollbackJournalFailedOperations(stackName, region, (op, segment) => isHandledOrphan(drop, segment, op));
+		if (removed !== drop.length) throw new CdkdError(`The rollback journal of ${stackShown} was rewritten with ${removed} entr${removed === 1 ? "y" : "ies"} removed where ${drop.length} ${drop.length === 1 ? "was" : "were"} expected: it changed under the stack lock. Inspect the stack's rollback-journal.json (next to its state.json).`, "ROLLBACK_DROP_FAILED_CHANGED");
+		logger.info(safeMsg`Dropped ${logicalIdShown(logicalId)}'s entry from the rollback journal of ${stackShown}. ` + "Nothing was deleted in AWS; every other entry is kept.");
+	} finally {
+		try {
+			await lockManager.releaseLock(stackName, region).catch((err) => {
+				logger.warn(safeMsg`Failed to release the lock of ${stackShown}: ${err instanceof Error ? err.name : "an error"}`);
+			});
+		} finally {
+			process.removeListener("SIGINT", sigintHandler);
+			unforwardSigterm();
+		}
+	}
+}
+
 //#endregion
 //#region src/deployment/public-ssm-proof.ts
 var PublicSsmProver = class {
@@ -13956,6 +14211,15 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 			});
 			continue;
 		}
+		const noEchoLeaves = noEchoLeavesOf(stateEntry);
+		if (noEchoLeaves !== void 0 && noEchoLeaves.length > 0 && carriesSecretMask(stateEntry.properties) && !carriesSecretMask(withoutCoordinates(stateEntry.properties, noEchoLeaves))) {
+			blocked.push({
+				logicalId,
+				resourceType,
+				reason: "a NoEcho template parameter feeds at least one property, and cdkd state holds only the redaction mask ('***') there, so the export has no value to declare for it. Export this stack without that resource and adopt it into CloudFormation by hand, passing the parameter value yourself."
+			});
+			continue;
+		}
 		if (carriesSecretMask(stateEntry.properties)) {
 			blocked.push({
 				logicalId,
@@ -15447,6 +15711,29 @@ function createExportCommand() {
 	cmd.addOption(deprecatedRegionOption);
 	return cmd;
 }
+function withoutCoordinates(bag, coordinates) {
+	const placeholder = Symbol("noecho-leaf");
+	const marked = coordinates.reduce((current, coordinate) => replaceAtCoordinate(current, coordinate, placeholder), bag);
+	return JSON.parse(JSON.stringify(marked, (_key, value) => value === placeholder ? null : value));
+}
+function replaceAtCoordinate(node, coordinate, replacement) {
+	if (coordinate.length === 0) return replacement;
+	const [head, ...rest] = coordinate;
+	if (Array.isArray(node) && typeof head === "number" && head < node.length) {
+		const copy = [...node];
+		copy[head] = replaceAtCoordinate(node[head], rest, replacement);
+		return copy;
+	}
+	if (node !== null && typeof node === "object" && !Array.isArray(node) && typeof head === "string") {
+		const record = node;
+		if (!Object.hasOwn(record, head)) return node;
+		return {
+			...record,
+			[head]: replaceAtCoordinate(record[head], rest, replacement)
+		};
+	}
+	return node;
+}
 
 //#endregion
 //#region src/cli/commands/state.ts
@@ -16778,7 +17065,7 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 						logger.warn(safeMsg`  ✗ ${displayStackName(stackName)}/${displayIdent(logicalId)} ` + safeMsg`(${displayIdent(resource.resourceType)}): ` + `not found in AWS — it was deleted outside cdkd; 'cdkd drift' reports it as deleted.`);
 						return;
 					}
-					resource.observedProperties = redactSecretsForState(observed, await publicSsmProver.proofBagFor(resource.properties ?? {}), resource.properties ?? {}, STATE_SOURCED_BASELINE_RULES);
+					resource.observedProperties = redactSecretsForState(maskReadbackAtCoordinates(observed, resource.properties ?? {}, [...maskedLeafCoordinatesOf(resource.properties ?? {}), ...noEchoLeavesOf(resource) ?? []]), await publicSsmProver.proofBagFor(resource.properties ?? {}), resource.properties ?? {}, STATE_SOURCED_BASELINE_RULES);
 					refreshed++;
 				} catch (err) {
 					failed++;
@@ -16969,6 +17256,7 @@ async function rollbackCommand(stackArg, options) {
 		process.env["CDKD_NO_LIVE"] = "1";
 	}
 	warnIfDeprecatedRegion(options);
+	if (options.dropFailed !== void 0) refuseDropFailedConflicts(options);
 	const setup = await setupStateBackend(options);
 	const skipConfirmation = options.force === true || options.yes === true;
 	let stackAwsClients;
@@ -16999,6 +17287,18 @@ async function rollbackCommand(stackArg, options) {
 		}
 		const stackName = ref.stackName;
 		const region = ref.region ?? setup.region;
+		if (options.dropFailed !== void 0) {
+			await dropFailedJournalEntry({
+				stateBackend: setup.stateBackend,
+				lockManager: setup.lockManager,
+				stackName,
+				region,
+				logicalId: options.dropFailed,
+				skipConfirmation,
+				logger
+			});
+			return;
+		}
 		stackAwsClients = new AwsClients({
 			region,
 			...options.profile && { profile: options.profile }
@@ -17098,7 +17398,7 @@ async function rollbackCommand(stackArg, options) {
 			}
 			logger.info("");
 			if (!skipConfirmation) {
-				if (!await confirm(`Roll back ${stackRegionShown(stackName, region)}?`)) {
+				if (!await confirm(`Roll back ${stackRegionShown(stackName, region)}` + (options.removeProtection === true ? ", TURNING DELETION PROTECTION OFF on the resources it deletes from this stack?" : "?"))) {
 					logger.info("Rollback cancelled");
 					return;
 				}
@@ -17120,6 +17420,13 @@ async function rollbackCommand(stackArg, options) {
 				recordEvent: (e) => eventRecorder.record(maskEventTextWithBoundBags(e)),
 				finalSnapshotClients,
 				skipFinalSnapshot: options.skipFinalSnapshot === true,
+				...options.removeProtection === true && {
+					removeProtection: true,
+					foreignHolder: makeForeignHolderScan(setup.stateBackend)({
+						stackName,
+						region
+					})
+				},
 				importedProducerRegions: producerRegionsFromState(baseState),
 				...(stackName.includes("~") || baseState.parentStack !== void 0) && { producerRegionsIncomplete: true }
 			};
@@ -17129,7 +17436,7 @@ async function rollbackCommand(stackArg, options) {
 				const { skippedOutputs: _droppedByRollback, ...carriedState } = baseState;
 				const next = () => ({
 					...carriedState,
-					version: 10,
+					version: 11,
 					region,
 					resources: { ...stateResources },
 					...orphansAfterRollback(baseState, mintedOrphans),
@@ -17158,6 +17465,7 @@ async function rollbackCommand(stackArg, options) {
 			const oldestInitialDeploy = journal.segments[0]?.initialDeploy === true;
 			let totalFailures = 0;
 			let totalWarnings = 0;
+			const failedOrphanIds = [];
 			const inlinePolicyWriters = new RollbackInlinePolicyWriters();
 			const failedOpsPrinting = journaledOrphanPrintingBag(journal.segments.flatMap((s) => s.failedOperations ?? []), stateResources);
 			try {
@@ -17202,6 +17510,7 @@ async function rollbackCommand(stackArg, options) {
 								})));
 								failedOpFailures = failedResult.failures;
 								failedOpWarnings = failedResult.warnings;
+								for (const op of failedResult.remainingFailedOps) if (isJournaledOrphan(op) && op.physicalIdRecoveredFromError === true) failedOrphanIds.push(op.logicalId);
 								const remaining = [
 									...failedOps.imported,
 									...failedOps.displaced,
@@ -17265,7 +17574,7 @@ async function rollbackCommand(stackArg, options) {
 			}
 			if (declinedDivergentRewrite) throw new PartialFailureError(`Rollback stopped: ${declinedDivergentReason}.` + (totalFailures > 0 ? ` ${totalFailures} operation(s) also failed.` : "") + " Journal preserved (this segment, any older ones, and their failed operations) — re-run the rollback once the record's region field matches its key.");
 			if (interrupted) throw new PartialFailureError(`Rollback interrupted. Journal preserved — re-run the rollback to finish.` + rerunRollback(stackName));
-			if (totalFailures > 0) throw new PartialFailureError(`Rollback completed with ${totalFailures} failed operation(s). Journal preserved — re-run the rollback to retry.` + rerunRollback(stackName));
+			if (totalFailures > 0) throw new PartialFailureError(`Rollback completed with ${totalFailures} failed operation(s). Journal preserved — re-run the rollback to retry.` + dropFailedHint(stackName, region, failedOrphanIds) + rerunRollback(stackName));
 			if (totalWarnings > 0) throw new PartialFailureError(`Rollback completed with ${totalWarnings} skipped/unrecoverable operation(s) (see warnings above).`);
 			logger.info(`\nRollback of ${stackRegionShown(stackName, region)} complete.`);
 		} finally {
@@ -17378,7 +17687,7 @@ function applyFailedPlanToPreview(plan, previewState, skipFinalSnapshot) {
 	}
 }
 function createRollbackCommand() {
-	const cmd = new Command("rollback").description("Revert a stack to its pre-deploy state after a failed --no-rollback / interrupted deploy or a partially-failed automatic rollback (state-driven, no synth needed).").argument("[stack]", "Stack name to roll back (defaults to the single journaled stack)").addOption(new Option("--force", "Skip the confirmation prompt").default(false)).addOption(new Option("--orphan <logicalId>", "Skip the given resource during replay (repeatable). Mirrors cdk rollback --orphan.").argParser((value, previous) => [...previous ?? [], value])).addOption(new Option("--revert-failed", "Also attempt to revert the resource whose operation FAILED mid-deploy. Off by default: the remote state of the failed resource is unknown, so force-applying its previous state is opt-in.").default(false)).addOption(skipFinalSnapshotOption).addOption(stackRegionOption()).addHelpText("after", [
+	const cmd = new Command("rollback").description("Revert a stack to its pre-deploy state after a failed --no-rollback / interrupted deploy or a partially-failed automatic rollback (state-driven, no synth needed).").argument("[stack]", "Stack name to roll back (defaults to the single journaled stack)").addOption(new Option("--force", "Skip the confirmation prompt").default(false)).addOption(new Option("--orphan <logicalId>", "Skip the given resource during replay (repeatable). Mirrors cdk rollback --orphan.").argParser((value, previous) => [...previous ?? [], value])).addOption(new Option("--revert-failed", "Also attempt to revert the resource whose operation FAILED mid-deploy. Off by default: the remote state of the failed resource is unknown, so force-applying its previous state is opt-in.").default(false)).addOption(new Option("--drop-failed <logicalId>", "Remove ONE journaled failed CREATE (a resource cdkd proved it made, journaled as its only record) from the rollback journal, after checking that resource by hand. Replays nothing and deletes nothing in AWS; every other entry is kept.")).addOption(skipFinalSnapshotOption).addOption(new Option("--remove-protection", `Turn deletion protection off before this stack's rollback deletes a resource the failed deploy left: one its state records from a completed CREATE, or one a failed CREATE left behind (a journaled orphan, or under --revert-failed the failed CREATE itself) when cdkd can prove it is that resource and no other stack holds it. A nested stack it deletes cascades the flag to that child's resources; a resource reverted inside an existing nested stack keeps its protection. Covers ${removeProtectionTypeList()}.`).default(false)).addOption(stackRegionOption()).addHelpText("after", [
 		"",
 		"Examples:",
 		"  cdkd rollback MyStack",
@@ -17387,7 +17696,9 @@ function createRollbackCommand() {
 		"  cdkd rollback MyStack --orphan MyBucket --orphan MyTable",
 		"  cdkd rollback MyStack --revert-failed   # also revert the failed in-flight resource",
 		"  cdkd rollback MyStack --skip-final-snapshot  # DeletionPolicy Snapshot → delete without the snapshot",
+		"  cdkd rollback MyStack --remove-protection   # also delete protected resources the failed deploy left",
 		"  cdkd rollback MyStack --stack-region us-west-2",
+		"  cdkd rollback MyStack --drop-failed MyQueuePolicy  # forget one undeletable failed CREATE",
 		"",
 		"Exit codes: 0 = clean, 2 = partial (journal kept for re-run), 1 = hard error."
 	].join("\n")).action(withErrorHandling(rollbackCommand));
@@ -19094,6 +19405,19 @@ function reimportedAttributes(row, prior) {
 		keptRecordedKeys: keptRecordedKeys.sort()
 	};
 }
+function withDeclaredNoEchoMasked(attributes, declared) {
+	if (!Array.isArray(declared)) return attributes;
+	const names = declared.filter((name) => typeof name === "string" && hasOwnKey(attributes, name) && !carriesSecretMask(attributes[name]) && attributes[name] !== void 0 && attributes[name] !== null);
+	if (names.length === 0) return attributes;
+	const masked = Object.create(Object.getPrototypeOf(attributes));
+	for (const [key, value] of Object.entries(attributes)) defineOwnKey(masked, key, names.includes(key) ? maskWholeValue(value) : value);
+	return masked;
+}
+function noEchoAttributeNamesCarried(prior, attributes) {
+	if (!Array.isArray(prior) || attributes === void 0) return {};
+	const kept = prior.filter((name) => typeof name === "string" && hasOwnKey(attributes, name) && carriesSecretMask(attributes[name]));
+	return kept.length > 0 ? { noEchoAttributeNames: kept } : {};
+}
 function buildStackState(stackName, region, rows, templateParser, template, existingState, selectiveMode) {
 	const resources = selectiveMode && existingState ? { ...existingState.resources } : {};
 	const parameterNames = new Set(Object.keys(template.Parameters ?? {}));
@@ -19105,7 +19429,9 @@ function buildStackState(stackName, region, rows, templateParser, template, exis
 		const deps = [...templateParser.extractDependencies(tmplResource)].filter((dep) => !parameterNames.has(dep));
 		const prior = existingState?.resources[row.logicalId];
 		const priorAttributes = prior && prior.physicalId === row.physicalId ? prior.attributes : void 0;
-		const { attributes, stillMaskedKeys, keptRecordedKeys } = reimportedAttributes(row.attributes, priorAttributes);
+		const reimported = reimportedAttributes(row.attributes, priorAttributes);
+		const { stillMaskedKeys, keptRecordedKeys } = reimported;
+		const attributes = withDeclaredNoEchoMasked(reimported.attributes, prior && prior.physicalId === row.physicalId ? prior.noEchoAttributeNames : void 0);
 		if (keptRecordedKeys.length > 0) getLogger().info(safeMsg`${displayIdent(row.logicalId)}: this import recorded ` + safeMsg`${keptRecordedKeys.map((key) => displayIdent(key)).join(", ")} only as the ` + "redaction mask, so the previously recorded value is kept; a deploy that updates the resource rewrites it.");
 		if (stillMaskedKeys.length > 0) {
 			const keys = stillMaskedKeys.map((key) => displayIdent(key)).join(", ");
@@ -19117,6 +19443,7 @@ function buildStackState(stackName, region, rows, templateParser, template, exis
 			resourceType: row.resourceType,
 			properties: tmplResource.Properties ?? {},
 			attributes,
+			...noEchoAttributeNamesCarried(prior && prior.physicalId === row.physicalId ? prior.noEchoAttributeNames : void 0, attributes),
 			dependencies: deps,
 			deletionPolicy: tmplResource.DeletionPolicy,
 			updateReplacePolicy: tmplResource.UpdateReplacePolicy,
@@ -19130,7 +19457,7 @@ function buildStackState(stackName, region, rows, templateParser, template, exis
 	}
 	if (namesParameter?.failedClosed !== void 0) getLogger().debug(`The template's parameter dependence could not be judged (${namesParameter.failedClosed}): every prior observed-baseline refusal recorded without a reason is carried as an unverifiable-parameter refusal.`);
 	return {
-		version: 10,
+		version: 11,
 		stackName,
 		region,
 		resources,
@@ -26951,4 +27278,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-w_06Pj_g.js.map
+//# sourceMappingURL=program-1S4fU3m4.js.map