@go-to-k/cdkd 0.296.12 → 0.296.14

package/dist/{deploy-engine-CrYi7ta5.js → deploy-engine-Z_zHC0jz.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js";
-import { A as displayIdent, C as withoutGeneratedFallbackName, D as UNRENDERABLE, E as STACK_REF_MAX_CODE_POINTS, F as plainIdentOr, I as safeMsg, M as displayStackName, N as isPasteableIdent, R as truncateCodePoints, S as withStackName, T as SECRET_REF_MAX_CODE_POINTS, _ as generateResourceNameWithFallback, b as looksLikeCdkdGeneratedName, c as installLogLineMaskerSource, g as generateResourceName, h as explicitNamePropertyFor, j as displaySafe, k as displayAwsMessage, l as getLiveRenderer, n as getLogger, p as applyDefaultNameForFallback, r as isStdoutReservedForPayload, s as currentLogLineMasker, v as getCurrentSkipPrefix, x as withSkipPrefix, y as getCurrentStackName } from "./logger-DAaB7GFO.js";
-import { $n as retryClassificationText, A as refusalTypeShown, An as pasteableCommand, At as UNREPRODUCIBLE_LOCK_CLAUSE, B as protectionFlipKey, Bn as hasReplayMayCollide, Bt as injectiveKey, C as assertRegionMatch, Ct as createdBeforeFailure, D as isQuotableImportValue, Dn as commandHole, Dt as isAuxiliaryMarkOf, En as UNSHOWABLE_VALUE, Et as isAuxiliaryFailure, F as compensateProtectionFlip, Fn as shellQuote, Ft as formatLockOperation, G as DELETION_PROTECTION_DOC_POINTER, Gt as withPasteableAwsProfile, H as runDeleteAttempt, Hn as isNameCooldownError, I as deleteWithProtectionCompensation, In as withheldTargetClause, It as formatLockOwner, Jn as isAmbiguousCcHandlerErrorCode, Jt as clientDefaultsFor, Kn as markReplayMayCollide, Kt as ambientClientDefaults, L as isTerminalDeleteFailure, Lt as sanitizeRecoveryValue, M as resolveExplicitPhysicalId, Mn as plainOrDescribed, Nn as quotedOrDescribed, O as normalizeAwsTagsToCfn, Ot as markAuxiliaryFailure, P as ProtectionFlipRegistry, Pn as shellBoundedDisplay, Pt as formatLockExpiry, Qn as isTransientServerError, Qt as CdkdError, Rt as CUSTOM_RESOURCE_RESPONSE_PREFIX, S as RESOURCE_NOT_FOUND, Tn as SHELL_ACTIVE_WHY, Tt as hasCreatedBeforeFailure, Un as isRecreateRetryableError, Ut as producerRecordKey, Vn as isNameCollisionErrorFrom, Wn as isReplayedNameCollisionFrom, X as protectedReplacementAdvice, Xn as isIamPropagationError, Xt as AccountIdUnavailableError, Y as pasteableAwsCommand, Yn as isAmbiguousOutcomeError, Yt as credentialFingerprint, Zn as isRetryableTransientError, Zt as AssetError, _n as StateError, _t as maskDeep, ar as isThrottlingError, at as canonicalizeRoute53QueryName, bt as RETRY_AUXILIARY_OWNER, cn as MacroExpansionError, cr as wrapMaskedAwsError, d as prepareRemovalForUpdate, dt as resourceTypeShown, en as CrossAccountSecretRefusalError, er as describeAwsFailure, f as removalWarning, fn as ProvisioningError, ft as segmentAfterAnchor, gt as isSecretDerivedValue, ht as createMaskedRetryLogger, i as holdsSecretDerivedEntry, in as IntrinsicResolutionRefusalError, ir as isMarkedNonRetryable, it as monotonicNowMs, jn as physicalIdShownBesideCommand, jt as buildForceUnlockCommand, k as quotedRemedyLogicalId, kn as isInertUnquoted, kt as markCreatedBeforeFailure, l as withUnchangedSecretPrincipalLists, ln as MalformedProducerRecordRefusalError, lt as logicalIdShown, m as withoutInjectedRemovals, mn as ResourceUpdateNotSupportedError, mt as createMaskedLogSinks, nr as safeStringify$1, nt as startInterruptWatch, or as markNonRetryable, pn as ResourceTimeoutError, pt as stateOrphanRecordRemedy, qn as formatRetryClassificationSignals, qt as ambientCredentialConfig, rn as DynamicReferenceRegionAmbiguousError, rt as ElapsedBudgetRegistry, sn as LockError, sr as markRedactedCause, st as compositeIdSeparatorRefusal, tn as DependencyError, tt as isInterruptedWaitError, vn as SynthesisError, vt as maskerOrIdentity, wn as SHELL_ACTIVE, wt as createdResourceIdentityBeforeFailure, x as withoutServerErrorRetries, xn as normalizeAwsError, xt as carryCreatedBeforeFailure, yt as withDerivedNameMasks, z as observeThenDisableProtection, zn as isUpdateUnsupportedError, zt as DEFAULT_STATE_PREFIX } from "./iam-policy-targets-elNafvpb.js";
+import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
+import { $ as protectedReplacementAdvice, $n as isIamPropagationError, $t as AccountIdUnavailableError, A as isQuotableImportValue, An as commandHole, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bt as sanitizeRecoveryValue, Ct as RETRY_AUXILIARY_OWNER, Dn as SHELL_ACTIVE, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as plainOrDescribed, G as runDeleteAttempt, Gn as isNameCooldownError, H as observeThenDisableProtection, Hn as isUpdateUnsupportedError, Ht as DEFAULT_STATE_PREFIX, In as quotedOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jt as withPasteableAwsProfile, Kn as isRecreateRetryableError, Kt as producerRecordKey, L as ProtectionFlipRegistry, Ln as shellBoundedDisplay, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mn as isInertUnquoted, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as pasteableCommand, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE_WHY, Ot as hasCreatedBeforeFailure, Pn as physicalIdShownBesideCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, R as compensateProtectionFlip, Rn as shellQuote, Rt as formatLockOperation, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Un as hasReplayMayCollide, Ut as injectiveKey, Vt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Wn as isNameCollisionErrorFrom, Xn as formatRetryClassificationSignals, Xt as ambientCredentialConfig, Yn as markReplayMayCollide, Yt as ambientClientDefaults, Zn as isAmbiguousCcHandlerErrorCode, Zt as clientDefaultsFor, _n as ResourceUpdateNotSupportedError, _t as createMaskedLogSinks, ar as isThrottlingError, at as startInterruptWatch, bn as StateError, bt as maskDeep, cr as wrapMaskedAwsError, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as MacroExpansionError, en as AssetError, er as isRetryableTransientError, f as removalWarning, fn as MalformedProducerRecordRefusalError, ft as logicalIdShown, gn as ResourceTimeoutError, gt as stateOrphanRecordRemedy, hn as ProvisioningError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as DependencyError, ir as isMarkedNonRetryable, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, kn as UNSHOWABLE_VALUE, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, m as withoutInjectedRemovals, mt as resourceTypeShown, nr as retryClassificationText, on as DynamicReferenceRegionAmbiguousError, or as markNonRetryable, ot as ElapsedBudgetRegistry, qn as isReplayedNameCollisionFrom, rn as CrossAccountSecretRefusalError, sn as IntrinsicResolutionRefusalError, sr as markRedactedCause, st as monotonicNowMs, tn as CdkdError, tr as isTransientServerError, un as LockError, ut as compositeIdSeparatorRefusal, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as normalizeAwsError, wt as carryCreatedBeforeFailure, xn as SynthesisError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as withheldTargetClause, zt as formatLockOwner } from "./iam-policy-targets-BoZuWtxK.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-B8WzrPJT.js";
+import { t as getCdkdVersion } from "./version-1NhJbqzi.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1279,7 +1279,7 @@ var ContextProviderRegistry = class {
 				results[entry.key] = value;
 				this.logger.debug(`Resolved context: ${shownKey}`);
 			} catch (error) {
-				const message = displayAwsMessage(error instanceof Error ? error.message : String(error));
+				const message = displayAwsMessage(describeAwsFailure(error).detail);
 				this.logger.error(`Context provider '${shownProvider}' failed: ${message}`);
 				results[entry.key] = {
 					[PROVIDER_ERROR_KEY]: message,
@@ -1493,7 +1493,7 @@ function resolveExpectedBucketOwner(client) {
 				secretAccessKey: credentials.secretAccessKey
 			});
 		} catch (error) {
-			getLogger().debug(`ExpectedBucketOwner resolution skipped (header omitted): ${String(error)}`);
+			getLogger().debug(`ExpectedBucketOwner resolution skipped (header omitted): ${safeStringify$1(error)}`);
 			clientCache.delete(client);
 			return;
 		}
@@ -1510,7 +1510,7 @@ async function recordResolvedAccountId(client, accountId) {
 		if (credentialsCache.has(accessKeyId)) return;
 		credentialsCache.set(accessKeyId, Promise.resolve(accountId));
 	} catch (error) {
-		getLogger().debug(`ExpectedBucketOwner seed skipped: ${String(error)}`);
+		getLogger().debug(`ExpectedBucketOwner seed skipped: ${safeStringify$1(error)}`);
 	}
 }
 async function expectedOwnerParam(client) {
@@ -1674,7 +1674,7 @@ function recordFailure(failed, key, reason) {
 	if (existing) existing.push(reason);
 	else failed.set(key, [reason]);
 }
-const describe$1 = (error) => error instanceof Error ? error.message : String(error);
+const describe$1 = (error) => describeAwsFailure(error).detail;
 const PREFIX_HANDLE_SUFFIX = "* (every key under this prefix)";
 async function purgeNoncurrentVersionsUnderPrefix(s3Client, bucket, prefix, options = {}) {
 	const logger = options.logger ?? getLogger().child("s3-version-purge");
@@ -2159,7 +2159,7 @@ function parseTemplateBody(body) {
 	return parsed;
 }
 function formatErr(err) {
-	return displayAwsMessage(err instanceof Error ? err.message : String(err));
+	return displayAwsMessage(describeAwsFailure(err).detail);
 }
 
 //#endregion
@@ -4113,7 +4113,7 @@ var AssetModeResolver = class {
 				marker
 			};
 		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
+			const message = describeAwsFailure(error).detail;
 			this.logger.warn(`Failed to auto-create cdkd asset storage for region ${quotedIfPlain(region, "that is not a plain identifier")}: ${message} Falling back to the CDK bootstrap destinations for this run — opt the region in with S3/ECR create permissions.\nBootstrap with: ${pasteableCommand("cdkd bootstrap", [{
 				flag: "--region",
 				value: region,
@@ -4445,7 +4445,7 @@ var WorkGraph = class {
 							nodeId: node.id,
 							error
 						});
-						this.logger.error(`Failed: ${node.id}: ${error instanceof Error ? error.message : String(error)}`);
+						this.logger.error(`Failed: ${node.id}: ${describeAwsFailure(error).detail}`);
 					}).finally(() => {
 						active[node.type]--;
 						dispatch();
@@ -4459,7 +4459,7 @@ var WorkGraph = class {
 					}
 					if (errors.length > 0) {
 						const skippedCount = [...this.nodes.values()].filter((n) => n.state === "skipped").length;
-						const msg = errors.map((e) => `  - ${e.nodeId}: ${e.error instanceof Error ? e.error.message : String(e.error)}`).join("\n");
+						const msg = errors.map((e) => `  - ${e.nodeId}: ${describeAwsFailure(e.error).detail}`).join("\n");
 						reject(/* @__PURE__ */ new Error(`${errors.length} node(s) failed${skippedCount > 0 ? `, ${skippedCount} skipped` : ""}:\n${msg}`));
 						return;
 					}
@@ -9744,6 +9744,7 @@ var ReplacementRulesRegistry = class {
 			"TaskRoleArn",
 			"Volumes"
 		]) });
+		this.rules.set("AWS::ElasticLoadBalancingV2::ListenerRule", { replacementProperties: /* @__PURE__ */ new Set(["ListenerArn"]) });
 		this.logger.debug(`Initialized replacement rules for ${this.rules.size} resource types`);
 	}
 };
@@ -10909,6 +10910,14 @@ const CASE_INSENSITIVE_NAME_TYPES = /* @__PURE__ */ new Set([
 	"AWS::RDS::DBSubnetGroup"
 ]);
 const ASCII_CASE_INSENSITIVE_NAME_TYPES = /* @__PURE__ */ new Set(["AWS::Glue::Table"]);
+function physicalIdKey(resourceType, physicalId) {
+	if (CASE_INSENSITIVE_NAME_TYPES.has(resourceType)) return physicalId.toLowerCase();
+	if (ASCII_CASE_INSENSITIVE_NAME_TYPES.has(resourceType)) return physicalId.replace(/[A-Z]/g, (c) => c.toLowerCase());
+	return physicalId;
+}
+function samePhysicalId(resourceType, a, b) {
+	return physicalIdKey(resourceType, a) === physicalIdKey(resourceType, b);
+}
 const NO_PHYSICAL_ID_NAME_PROOF = /* @__PURE__ */ new Set(["AWS::Glue::Table"]);
 const GENERATED_NAME_VERBATIM = /* @__PURE__ */ new Set([
 	"AWS::CloudWatch::Alarm",
@@ -11921,20 +11930,30 @@ async function findReplacedReadersOfRecreateTargets(input) {
 		let pending = schemaCreateOnly.get(type);
 		if (!pending) {
 			pending = (async () => {
-				const whole = (await getCreateOnlyPropertyPaths(type)).filter((path) => path.length === 1).map((path) => path[0]);
-				if (whole.length === 0) return /* @__PURE__ */ new Set();
+				const whole = new Set((await getCreateOnlyPropertyPaths(type)).filter((path) => path.length === 1).map((path) => path[0]));
+				if (whole.size === 0) return {
+					whole,
+					confirmable: whole
+				};
 				const writeOnly = await tryGetTopLevelWriteOnlyProperties(type);
-				if (writeOnly === void 0) return /* @__PURE__ */ new Set();
-				return new Set(whole.filter((key) => !writeOnly.has(key)));
+				if (writeOnly === void 0) return {
+					whole,
+					confirmable: /* @__PURE__ */ new Set()
+				};
+				return {
+					whole,
+					confirmable: new Set([...whole].filter((key) => !writeOnly.has(key)))
+				};
 			})();
 			schemaCreateOnly.set(type, pending);
 		}
 		return pending;
 	};
-	const isCreateOnly = async (type, key) => {
+	const isCreateOnly = async (type, key, plainReference) => {
 		if (rules.requiresReplacement(type, key, void 0, void 0)) return true;
 		if (rules.isClassified(type, key)) return false;
-		return (await wholeCreateOnlyKeys(type)).has(key);
+		const keys = await wholeCreateOnlyKeys(type);
+		return plainReference ? keys.whole.has(key) : keys.confirmable.has(key);
 	};
 	const found = [];
 	const replaced = new Set(targets);
@@ -11949,7 +11968,8 @@ async function findReplacedReadersOfRecreateTargets(input) {
 			const properties = [];
 			for (const key of keys) {
 				if (stableTargets.has(replacedId) && idOnly.get(replacedId)?.get(readerId)?.has(key)) continue;
-				if (await isCreateOnly(resource.Type, key)) properties.push(key);
+				const plain = isPlainReferenceTo(resource.Properties?.[key], replacedId, resources[replacedId]?.Type);
+				if (await isCreateOnly(resource.Type, key, plain)) properties.push(key);
 			}
 			if (properties.length === 0) continue;
 			replaced.add(readerId);
@@ -12006,6 +12026,18 @@ function recreateKeepsPhysicalId(resource, record) {
 	const name = properties[property];
 	return typeof name === "string" && name !== "" && record.physicalId === name;
 }
+function isPlainReferenceTo(value, id, type) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const keys = Object.keys(value);
+	if (keys.length !== 1) return false;
+	const obj = value;
+	if (keys[0] === "Ref") return obj["Ref"] === id;
+	if (keys[0] !== "Fn::GetAtt") return false;
+	if (type === void 0 || type === "AWS::CloudFormation::CustomResource" || type === "AWS::CloudFormation::Stack" || type.startsWith("Custom::")) return false;
+	const target = obj["Fn::GetAtt"];
+	if (Array.isArray(target)) return target.length === 2 && target[0] === id && typeof target[1] === "string";
+	return typeof target === "string" && target.startsWith(`${id}.`) && target.length > id.length + 1;
+}
 function readsOnlyId(value, id) {
 	let other = false;
 	let ids = 0;
@@ -12138,6 +12170,10 @@ const CHILD_STORED_IN_PARENT = {
 		properties: ["GroupName"],
 		parentTypes: [IAM_GROUP]
 	},
+	"AWS::ApplicationAutoScaling::ScalingPolicy": {
+		properties: ["ScalingTargetId"],
+		parentTypes: ["AWS::ApplicationAutoScaling::ScalableTarget"]
+	},
 	"AWS::IAM::Policy": {
 		properties: [
 			"Roles",
@@ -21405,26 +21441,37 @@ var DiffCalculator = class DiffCalculator {
 		}
 		const types = candidateKeys.keys();
 		await Promise.all([...types].map(async (type) => {
-			const paths = await getCreateOnlyPropertyPaths(type);
-			const keys = candidateKeys.get(type);
-			if (!paths.some((path) => path.length === 1 && keys.has(path[0]))) {
-				loaded.set(type, paths);
+			const whole = new Set((await getCreateOnlyPropertyPaths(type)).filter((path) => path.length === 1).map((path) => path[0]));
+			if (![...candidateKeys.get(type)].some((key) => whole.has(key))) {
+				loaded.set(type, {
+					whole,
+					unconfirmable: /* @__PURE__ */ new Set()
+				});
 				return;
 			}
 			const writeOnly = await tryGetTopLevelWriteOnlyProperties(type);
 			if (writeOnly === void 0) {
-				this.logger.debug(safeMsg`Write-only properties of ${type} unknown: no create-only replacement ceiling for its promoted readers`);
-				loaded.set(type, paths.filter((path) => path.length !== 1));
+				this.logger.debug(safeMsg`Write-only properties of ${type} unknown: no create-only replacement ceiling for its promoted readers but a plain reference to a replaced resource`);
+				loaded.set(type, {
+					whole,
+					unconfirmable: "all"
+				});
 				return;
 			}
-			loaded.set(type, paths.filter((path) => !(path.length === 1 && writeOnly.has(path[0]))));
+			loaded.set(type, {
+				whole,
+				unconfirmable: new Set([...whole].filter((key) => writeOnly.has(key)))
+			});
 		}));
 		return loaded;
 	}
-	syntheticRequiresReplacement(resourceType, propKey, syntheticCreateOnlyPaths) {
+	syntheticRequiresReplacement(resourceType, propKey, syntheticCreateOnlyPaths, plainReference) {
 		if (this.replacementRules.requiresReplacement(resourceType, propKey, void 0, void 0)) return true;
 		if (this.replacementRules.isClassified(resourceType, propKey)) return false;
-		return (syntheticCreateOnlyPaths.get(resourceType) ?? []).some((path) => path.length === 1 && path[0] === propKey);
+		const createOnly = syntheticCreateOnlyPaths.get(resourceType);
+		if (createOnly === void 0 || !createOnly.whole.has(propKey)) return false;
+		if (plainReference) return true;
+		return createOnly.unconfirmable !== "all" && !createOnly.unconfirmable.has(propKey);
 	}
 	promoteReplacementDependents(changes, desiredTemplate, syntheticCreateOnlyPaths, forcedReplacements) {
 		const queue = [];
@@ -21468,7 +21515,7 @@ var DiffCalculator = class DiffCalculator {
 						oldValue,
 						newValue,
 						replacementPropagated: true,
-						requiresReplacement: this.syntheticRequiresReplacement(change.resourceType, propKey, syntheticCreateOnlyPaths) || namesRecreatedParent(change.resourceType, propKey, changes.get(replacedId)?.resourceType)
+						requiresReplacement: this.syntheticRequiresReplacement(change.resourceType, propKey, syntheticCreateOnlyPaths, isPlainReferenceTo(desiredTemplate.Resources[dependentId]?.Properties?.[propKey], replacedId, desiredTemplate.Resources[replacedId]?.Type)) || namesRecreatedParent(change.resourceType, propKey, changes.get(replacedId)?.resourceType)
 					});
 				}
 				if (syntheticChanges.length === 0) continue;
@@ -21543,7 +21590,7 @@ var DiffCalculator = class DiffCalculator {
 					path: propKey,
 					oldValue: change.currentProperties?.[propKey],
 					newValue: change.desiredProperties?.[propKey],
-					requiresReplacement: this.syntheticRequiresReplacement(change.resourceType, propKey, syntheticCreateOnlyPaths),
+					requiresReplacement: this.syntheticRequiresReplacement(change.resourceType, propKey, syntheticCreateOnlyPaths, false),
 					inPlacePropagated: true,
 					...noEchoPromoted && { noEchoPromoted: true }
 				});
@@ -22665,7 +22712,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DoaukzYL.js");
+			const { ASGProvider } = await import("./asg-provider-eXsnCQh2.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -22771,7 +22818,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-V_uJHUSX.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-ppi8nIX-.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-6YeZRRfW.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-ZYVwKq6K.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -27862,7 +27909,7 @@ var DeploymentEventsStore = class {
 	}
 	enqueueWrite(op) {
 		const next = this.writeChain.then(op).catch((err) => {
-			this.warnOnce(`Failed to persist deployment events for run ${this.runId}: ${err instanceof Error ? err.message : String(err)}`);
+			this.warnOnce(`Failed to persist deployment events for run ${this.runId}: ${describeAwsFailure(err).detail}`);
 		});
 		this.writeChain = next;
 		return next;
@@ -27883,7 +27930,7 @@ var DeploymentEventsStore = class {
 				if (Array.isArray(parsed.runs)) return parsed.runs;
 			}
 		} catch (err) {
-			this.logger.debug(`Deployment-events index unreadable, rewriting: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`Deployment-events index unreadable, rewriting: ${describeAwsFailure(err).detail}`);
 		}
 		return [];
 	}
@@ -29270,7 +29317,7 @@ function classifyFailedOp(op, stateResources, siblings = []) {
 		if (op.physicalIdRecoveredFromError === false) return "skip-failed-superseded";
 		if (op.physicalIdRecoveredFromError === true) {
 			if (current) {
-				if (current.physicalId === op.physicalId) return "skip-failed-noop";
+				if (current.physicalId === op.physicalId || current.resourceType === op.resourceType && typeof current.physicalId === "string" && samePhysicalId(op.resourceType, current.physicalId, op.physicalId)) return "skip-failed-noop";
 				if (!isReplacedRecord(op, current) && !isProvenDistinctRecord(op, current)) return "skip-failed-mismatch";
 			}
 			if (stateHoldsPhysicalId(stateResources, op.resourceType, op.physicalId)) return "skip-failed-noop";
@@ -29321,14 +29368,14 @@ function replacedResourceDeleted(op, siblings) {
 	return siblings.some((s) => s !== op && isReplacementOrphan(s) && s.logicalId === op.logicalId && s.replacedPhysicalId === op.physicalId && s.replacedResourceDeleted === true);
 }
 function stateHoldsPhysicalId(stateResources, resourceType, physicalId) {
-	return Object.values(stateResources).some((r) => r?.resourceType === resourceType && r.physicalId === physicalId);
+	return Object.values(stateResources).some((r) => r?.resourceType === resourceType && typeof r.physicalId === "string" && samePhysicalId(resourceType, r.physicalId, physicalId));
 }
 function demoteSupersededOrphans(segments, orphans = []) {
 	let demoted = 0;
 	segments.forEach((segment, s) => {
 		for (const op of segment.failedOperations ?? []) {
 			if (op.changeType !== "CREATE" || op.physicalIdRecoveredFromError !== true) continue;
-			if (segments.slice(s + 1).some((t) => (t.operations ?? []).some((o) => mayOwn(o, op, true)) || (t.failedOperations ?? []).some((o) => mayOwn(o, op, false))) || segments.slice(s).some((t) => t.supersededLogicalIds?.includes(op.logicalId) === true) || orphans.some((o) => o?.logicalId === op.logicalId || o?.state?.resourceType === op.resourceType && o.state?.physicalId === op.physicalId)) {
+			if (segments.slice(s + 1).some((t) => (t.operations ?? []).some((o) => mayOwn(o, op, true)) || (t.failedOperations ?? []).some((o) => mayOwn(o, op, false))) || segments.slice(s).some((t) => t.supersededLogicalIds?.includes(op.logicalId) === true) || orphans.some((o) => o?.logicalId === op.logicalId || o?.state?.resourceType === op.resourceType && holdsSameId(op.resourceType, o.state?.physicalId, op.physicalId))) {
 				op.physicalIdRecoveredFromError = false;
 				demoted++;
 			}
@@ -29339,8 +29386,12 @@ function demoteSupersededOrphans(segments, orphans = []) {
 function mayOwn(o, orphan, completed) {
 	if (o?.resourceType !== orphan.resourceType) return false;
 	if (completed && o.changeType === "CREATE") return true;
-	if (o.physicalId === orphan.physicalId) return true;
-	return o.previousState?.physicalId === orphan.physicalId;
+	if (holdsSameId(orphan.resourceType, o.physicalId, orphan.physicalId)) return true;
+	return holdsSameId(orphan.resourceType, o.previousState?.physicalId, orphan.physicalId);
+}
+function holdsSameId(resourceType, held, orphanId) {
+	if (typeof held !== "string" || typeof orphanId !== "string") return held === orphanId;
+	return samePhysicalId(resourceType, held, orphanId);
 }
 function isJournaledOrphan(op) {
 	return op.changeType === "CREATE" && typeof op.physicalIdRecoveredFromError === "boolean";
@@ -29608,8 +29659,11 @@ async function replayDelete(s) {
 		provisionedBy: deleteProvisionedBy
 	});
 	const createRollbackClaimed = inlinePolicyWriters.claimedFor(op.resourceType, op.logicalId, stateResources);
-	const createRollbackDelete = await provider.delete(op.logicalId, op.physicalId, op.resourceType, op.properties, {
+	const removeProtection = ctx.removeProtection === true;
+	const physicalId = op.physicalId;
+	const deleteCreated = () => provider.delete(op.logicalId, physicalId, op.resourceType, op.properties, {
 		expectedRegion: ctx.region,
+		...removeProtection && { removeProtection: true },
 		...createRollbackClaimed && { inlinePolicyClaimed: createRollbackClaimed },
 		...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
 		...ctx.skipFinalSnapshot === true && { skipFinalSnapshot: true },
@@ -29617,6 +29671,7 @@ async function replayDelete(s) {
 		recordedAttributes: stateResources[op.logicalId]?.attributes,
 		recordedNoEchoLeaves: stateResources[op.logicalId]?.noEchoLeaves
 	});
+	const createRollbackDelete = removeProtection ? await runDeleteAttempt(true, deleteCreated) : await deleteCreated();
 	throwIfDeleteSkipped(createRollbackDelete, op.logicalId, op.physicalId, "while rolling back its CREATE", {
 		ctx,
 		stackName,
@@ -30005,7 +30060,7 @@ async function deleteMarkedRecreate(error, s) {
 	if (madeId === void 0) return false;
 	const shown = `${shownLogicalId(s.op.logicalId)} (${refusalResourceType(s.oldType)})`;
 	const id = s.mask(madeId);
-	if (Object.values(s.stateResources).some((r) => r?.resourceType === s.oldType && r.physicalId === madeId)) return false;
+	if (Object.values(s.stateResources).some((r) => r?.resourceType === s.oldType && typeof r.physicalId === "string" && samePhysicalId(s.oldType, r.physicalId, madeId))) return false;
 	if (s.deletionPolicy === "Retain" || s.deletionPolicy === "Snapshot") {
 		s.logger.warn(safeMsg`  Rollback: the failed re-create of ${shown} made ${id} before failing; ` + safeMsg`it is left in AWS (DeletionPolicy: ${s.deletionPolicy}) and no record holds it — delete it yourself if it is not needed`);
 		return false;
@@ -33279,6 +33334,439 @@ async function replayFailedOperations(...args) {
 	return await withProducerRegions(() => replayProducerRegionEvidence(args[3]), () => withStackRecords(replayStackRecordsView(args[1]), () => replayFailedOperationsUnbound(...args)));
 }
 
+//#endregion
+//#region src/deployment/rollback-executor/journaled-orphans.ts
+const NONE = {
+	segments: [],
+	count: 0
+};
+async function loadJournaledOrphans(stateBackend, stackName, region, rollbackOrphans, logger, options = {}) {
+	let segments;
+	try {
+		const journal = await stateBackend.loadRollbackJournal(stackName, region);
+		if (!journal) return NONE;
+		segments = journal.segments;
+	} catch (err) {
+		const detail = err instanceof Error ? err.message : String(err);
+		logger.warn(safeMsg`Could not read the stack's rollback journal (${displaySafe(detail)}); ` + safeMsg`no resource it records for a failed CREATE is deleted, and ${options.unreadableOutcome ?? "a destroy that proceeds removes the journal with the state"}.`);
+		return {
+			...NONE,
+			unreadable: true
+		};
+	}
+	const physicalIdOnly = (ops) => ops.filter((op) => op.changeType !== "CREATE");
+	const evidence = segments.map((segment) => options.deployRunId !== void 0 && segment.reason === "nested-pending-parent" && segment.runId === options.deployRunId ? {
+		...segment,
+		operations: physicalIdOnly(segment.operations)
+	} : segment);
+	const newer = options.newerOperations ?? [];
+	if (newer.length > 0) evidence.push({ operations: physicalIdOnly(newer) });
+	demoteSupersededOrphans(evidence, Array.isArray(rollbackOrphans) ? rollbackOrphans : []);
+	const deployLogicalIds = new Set(newer.map((op) => op.logicalId));
+	for (const segment of segments) if (options.deployRunId !== void 0 && segment.reason === "nested-pending-parent" && segment.runId === options.deployRunId) for (const op of segment.operations) deployLogicalIds.add(op.logicalId);
+	const out = [];
+	let count = 0;
+	for (let s = segments.length - 1; s >= 0; s--) {
+		const segment = segments[s];
+		if (segment.reason === "nested-pending-parent") continue;
+		const replay = splitImportedOps(segment.failedOperations ?? [], segment).replay;
+		const ops = replay.filter(isJournaledOrphan);
+		if (ops.length === 0) continue;
+		const companions = replay.filter((op) => op.changeType === "UPDATE" && replacementNeverSwapped(op, ops));
+		out.push({
+			segment,
+			ops,
+			...companions.length > 0 && { companions }
+		});
+		count += ops.length;
+	}
+	return {
+		segments: out,
+		count,
+		deployLogicalIds
+	};
+}
+function journaledOrphanLines(orphans, logger) {
+	return orphans.segments.flatMap(({ ops }) => ops.map((op) => `  - ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)})  ${displacedPhysicalIdShown(op, logger) ?? "a physical id"}`));
+}
+function dropFailedCommands(stackName, region, logicalIds) {
+	const ids = [...new Set(logicalIds)];
+	if (ids.length === 0) return void 0;
+	const built = ids.map((id) => pasteableCommand("cdkd rollback", [
+		{
+			value: stackName,
+			hole: "stack",
+			opts: { plainIdent: true }
+		},
+		{
+			flag: "--stack-region",
+			value: region,
+			hole: "region",
+			opts: { plainIdent: true }
+		},
+		{
+			flag: "--drop-failed",
+			value: id,
+			hole: "logical-id",
+			opts: { plainIdent: true }
+		}
+	]));
+	const idWithheld = built.some((b) => b.withheld.some((w) => w.hole === "logical-id"));
+	return {
+		intro: `If cdkd can never delete ${ids.length === 1 ? "it" : "one of them"} (a cause you cannot fix), check the resource by hand, then drop just its rollback-journal entry; every other entry is kept.` + withheldTargetClause(built[0], "stack", "cdkd rollback", "This stack's name") + withheldTargetClause(built[0], "region", "cdkd rollback", "This stack's region") + (idWithheld ? " A logical id that is not a plain identifier is not named in the command below; read it from the stack's rollback-journal.json (next to its state.json)." : ""),
+		commands: built.map((b) => b.command)
+	};
+}
+function dropFailedHint(stackName, region, logicalIds) {
+	const hint = dropFailedCommands(stackName, region, logicalIds);
+	if (hint === void 0) return "";
+	return `\n${hint.intro}` + hint.commands.map((c) => `\nDrop with: ${c}`).join("");
+}
+function warnDropFailed(logger, stackName, region, logicalIds) {
+	const hint = dropFailedCommands(stackName, region, logicalIds);
+	if (hint === void 0) return;
+	logger.warn(safeMsg`${hint.intro}`);
+	for (const command of hint.commands) logger.warn(safeMsg`Drop with: ${command}`);
+}
+async function deleteJournaledOrphans(orphans, stateResources, stackName, ctx, options = {}) {
+	const total = {
+		failures: 0,
+		warnings: 0,
+		interrupted: false,
+		handled: [],
+		leftInPlace: 0,
+		failedLogicalIds: []
+	};
+	const inlinePolicyWriters = new RollbackInlinePolicyWriters();
+	const failedIds = total.failedLogicalIds;
+	const record = ctx.recordEvent;
+	const printing = journaledOrphanPrintingBag(orphans.segments.flatMap(({ ops, companions }) => [...companions ?? [], ...ops]), stateResources);
+	const maskedCtx = record === void 0 ? ctx : {
+		...ctx,
+		recordEvent: (event) => record(maskEventTextWithBoundBags(event))
+	};
+	for (const { segment, ops: orphanOps, companions } of orphans.segments) {
+		if (options.isInterrupted?.()) {
+			total.interrupted = true;
+			break;
+		}
+		const ops = [...companions ?? [], ...orphanOps];
+		const replay = () => withPrintingSecrets(printing, () => withStackName(stackName, () => replayFailedOperations(ops, stateResources, stackName, maskedCtx, {
+			emitEnvelope: false,
+			inlinePolicyWriters,
+			forDestroy: true,
+			...options.isInterrupted && { isInterrupted: options.isInterrupted }
+		})));
+		const result = segment.skipPrefix === void 0 ? await replay() : await withSkipPrefix(segment.skipPrefix, replay);
+		total.failures += result.failures;
+		total.warnings += result.warnings;
+		total.leftInPlace += result.leftInPlace;
+		const pending = new Set(result.remainingFailedOps);
+		for (const op of ops) if (!pending.has(op)) total.handled.push({
+			segment,
+			op
+		});
+		if (result.interrupted) {
+			total.interrupted = true;
+			break;
+		}
+		for (const op of orphanOps) if (pending.has(op)) failedIds.push(op.logicalId);
+	}
+	if (options.pointAtDrop !== false && failedIds.length > 0) {
+		ctx.logger.warn(safeMsg`${failedIds.length} resource(s) a failed deploy of stack ${displayIdent(stackName)} created ` + "could not be deleted (see above); the rollback journal, their only record, keeps them for a re-run.");
+		warnDropFailed(ctx.logger, stackName, ctx.region, failedIds);
+	}
+	return total;
+}
+async function settleJournaledOrphansOnSuccess(args) {
+	const { stateBackend, stackName, region, stateResources, newerOperations, ctx, logger } = args;
+	const stack = displayIdent(stackName);
+	const newerIds = newerOperations.map((op) => op.logicalId);
+	let orphans;
+	try {
+		orphans = await loadJournaledOrphans(stateBackend, stackName, region, args.rollbackOrphans, logger, {
+			newerOperations,
+			...args.deployRunId !== void 0 && { deployRunId: args.deployRunId },
+			unreadableOutcome: "the successful deploy removes the journal"
+		});
+	} catch (err) {
+		logger.warn(safeMsg`Could not act on the rollback journal of stack ${stack}: ${errorDetail(err)}. It is kept.`);
+		await markSuperseded(stateBackend, stackName, region, newerIds);
+		return {
+			unaddressed: 1,
+			keepJournal: true
+		};
+	}
+	if (orphans.count === 0) return {
+		unaddressed: 0,
+		keepJournal: false
+	};
+	const all = orphans.segments.flatMap(({ segment, ops }) => ops.map((op) => ({
+		segment,
+		op
+	})));
+	let kept = all;
+	let failedDeletes = [];
+	let leftInPlace = 0;
+	if (stateResources === void 0) logger.warn(safeMsg`The rollback journal of stack ${stack} records ${all.length} resource(s) a failed deploy ` + `created, but the stack's state cannot be read, so whether a record now owns them is unknown: none is deleted.`);
+	else {
+		logger.info(safeMsg`The rollback journal of stack ${stack} records ${all.length} resource(s) a failed deploy ` + `created that no state record holds; acting on them per their DeletionPolicy before the journal is removed:`);
+		for (const line of journaledOrphanLines(orphans, logger)) logger.info(line);
+		try {
+			const { unreadable, tracked } = await applySuccessRule(orphans, stateResources, orphans.deployLogicalIds ?? /* @__PURE__ */ new Set(), args.foreignHolder, stack, logger, args.isInterrupted, ctx);
+			const acting = {
+				segments: orphans.segments.map(({ segment, ops }) => ({
+					segment,
+					ops: ops.filter((op) => !unreadable.has(op) && !tracked.has(op))
+				})).filter(({ ops }) => ops.length > 0),
+				count: orphans.count - unreadable.size - tracked.size
+			};
+			const writtenThisRun = [...orphans.deployLogicalIds ?? []].filter((id) => Object.prototype.hasOwnProperty.call(stateResources, id)).map((id) => stateResources[id]).filter((r) => r !== void 0 && r !== null && typeof r === "object");
+			const outcome = await deleteJournaledOrphans(acting, { ...stateResources }, stackName, {
+				...ctx,
+				writtenThisRun
+			}, {
+				pointAtDrop: false,
+				...args.isInterrupted && { isInterrupted: args.isInterrupted }
+			});
+			leftInPlace = outcome.leftInPlace;
+			failedDeletes = outcome.failedLogicalIds;
+			kept = all.filter(({ segment, op }) => unreadable.has(op) || !tracked.has(op) && !isHandledOrphan(outcome.handled, segment, op));
+		} catch (err) {
+			logger.warn(safeMsg`Acting on the journaled resources of stack ${stack} failed: ${errorDetail(err)}`);
+		}
+	}
+	const keptOps = new Set(kept.map(({ op }) => op));
+	const skipped = all.filter(({ op }) => !keptOps.has(op) && op.physicalIdRecoveredFromError === false).length;
+	const clearedOrphans = all.filter(({ op }) => !keptOps.has(op));
+	const cleared = [...clearedOrphans, ...orphans.segments.flatMap(({ segment, companions }) => (companions ?? []).filter((c) => replacementNeverSwapped(c, clearedOrphans.filter((o) => o.segment === segment).map((o) => o.op))).map((op) => ({
+		segment,
+		op
+	})))];
+	const stripCleared = cleared.length === 0 ? void 0 : async () => {
+		try {
+			await stateBackend.dropRollbackJournalFailedOperations(stackName, region, (op, segment) => isHandledOrphan(cleared, segment, op));
+		} catch (err) {
+			logger.warn(safeMsg`Failed to remove the settled entries from the rollback journal of stack ${stack}: ` + safeMsg`${errorDetail(err)}. A cdkd rollback or cdkd destroy could act on them again; run a ` + "successful cdkd deploy of the stack first, which settles them again.");
+		}
+	};
+	if (kept.length === 0) return {
+		unaddressed: skipped + leftInPlace,
+		keepJournal: false,
+		...stripCleared && { stripCleared }
+	};
+	const keptIds = new Set(kept.map(({ op }) => op.logicalId));
+	const supersededIds = newerIds.filter((id) => !keptIds.has(id));
+	const demoted = kept.filter(({ op }) => op.physicalIdRecoveredFromError === false);
+	const reduce = () => stateBackend.reduceRollbackJournalToFailedOperations(stackName, region, (op, segment) => isHandledOrphan(kept, segment, op), supersededIds, (op, segment) => isHandledOrphan(demoted, segment, op));
+	let reduced = false;
+	for (let attempt = 0; attempt < 2 && !reduced; attempt++) try {
+		await reduce();
+		reduced = true;
+	} catch (err) {
+		if (attempt === 1) logger.warn(safeMsg`Failed to reduce the rollback journal of stack ${stack} to its undeleted resources: ` + safeMsg`${errorDetail(err)}. The whole journal is kept.`);
+	}
+	if (!reduced) {
+		await markSuperseded(stateBackend, stackName, region, supersededIds);
+		await stripCleared?.();
+	}
+	logger.warn(safeMsg`${kept.length} resource(s) a failed deploy of stack ${stack} created were not deleted ` + (reduced ? "(see above). The rollback journal, their only record, is kept with just them; the next " : "(see above). The rollback journal, their only record, is kept; the next ") + "successful deploy retries.");
+	warnDropFailed(logger, stackName, region, failedDeletes);
+	return {
+		unaddressed: kept.length + skipped + leftInPlace,
+		keepJournal: true
+	};
+}
+async function applySuccessRule(orphans, stateResources, deployLogicalIds, foreignHolder, stack, logger, isInterrupted, identityCtx) {
+	const unreadable = /* @__PURE__ */ new Set();
+	const tracked = /* @__PURE__ */ new Set();
+	let interrupted = false;
+	for (const { ops } of orphans.segments) for (const op of ops) {
+		if (op.physicalIdRecoveredFromError !== true || !op.physicalId) continue;
+		if (interrupted || isInterrupted?.()) {
+			interrupted = true;
+			unreadable.add(op);
+			continue;
+		}
+		const opId = op.physicalId;
+		if (Object.values(stateResources).some((r) => r?.resourceType === op.resourceType && typeof r.physicalId === "string" && samePhysicalId(op.resourceType, r.physicalId, opId))) {
+			tracked.add(op);
+			continue;
+		}
+		const hasRecord = Object.prototype.hasOwnProperty.call(stateResources, op.logicalId);
+		const record = hasRecord ? stateResources[op.logicalId] : void 0;
+		const recordUnderId = hasRecord && !isReplacedRecord(op, record);
+		if (recordUnderId || deployLogicalIds.has(op.logicalId)) {
+			const verdict = recordUnderId ? await recordIdentity(op, record, identityCtx, logger) : "unknown";
+			if (verdict === "same") {
+				tracked.add(op);
+				continue;
+			}
+			if (verdict !== "different") {
+				op.physicalIdRecoveredFromError = false;
+				continue;
+			}
+			markProvenDistinctFromRecord(op, record);
+		}
+		const holding = await foreignHolder(op.resourceType, op.physicalId);
+		if (holding === void 0) {
+			const created = await createdResourceStillThere(op, identityCtx);
+			if (created === "gone") {
+				logger.info(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is already gone: nothing to delete.`);
+				tracked.add(op);
+			} else if (created === "mismatch") {
+				logger.warn(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is not deleted: the resource now under its physical id is another ` + "one (its identity differs from the one that deploy recorded, so its name was reused).");
+				op.physicalIdRecoveredFromError = false;
+			} else if (created === "unproven") {
+				logger.warn(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is not deleted: nothing proves the resource now under its physical ` + "id is the one that deploy created (it may have been deleted and its name reused).");
+				op.physicalIdRecoveredFromError = false;
+			}
+			continue;
+		}
+		if (holding.kind === "held") {
+			logger.warn(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is not deleted: ${holding.by} holds a resource of that type under ` + "the same physical id.");
+			op.physicalIdRecoveredFromError = false;
+			continue;
+		}
+		logger.warn(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is not deleted: ${holding.what}, so whether another stack holds it is unknown.`);
+		unreadable.add(op);
+	}
+	return {
+		unreadable,
+		tracked
+	};
+}
+async function recordIdentity(op, record, ctx, logger) {
+	if (typeof record !== "object" || record === null || record.resourceType !== op.resourceType || typeof record.physicalId !== "string" || record.physicalId === "" || !op.physicalId) return "unknown";
+	try {
+		const { provider } = ctx.providerRegistry.getProviderFor({
+			resourceType: op.resourceType,
+			provisionedBy: op.provisionedBy
+		});
+		if (typeof provider.isSameResource !== "function") return "unknown";
+		return await provider.isSameResource(op.physicalId, {
+			physicalId: record.physicalId,
+			...record.provisionedBy !== void 0 && { provisionedBy: record.provisionedBy }
+		}, op.resourceType, { expectedRegion: ctx.region });
+	} catch (err) {
+		logger.debug(safeMsg`Could not compare ${logicalIdShown(op.logicalId)}'s journaled resource with its state record (${displaySafe(err instanceof Error ? err.name : typeof err)}).`);
+		return "unknown";
+	}
+}
+async function createdResourceStillThere(op, ctx) {
+	if (op.deletionPolicy === "Retain") return "proven";
+	if (!orphanDeleteNeedsIdentity(op.resourceType)) return "proven";
+	const physicalId = op.physicalId;
+	if (!physicalId) return "unproven";
+	const live = await readResourceIdentity(ctx.providerRegistry, {
+		resourceType: op.resourceType,
+		physicalId,
+		provisionedBy: op.provisionedBy
+	}, ctx.region);
+	if (live === RESOURCE_NOT_FOUND) return "gone";
+	const journaled = op.createdResourceIdentity;
+	if (typeof journaled !== "string" || journaled === "" || typeof live !== "string") return "unproven";
+	return live === journaled ? "proven" : "mismatch";
+}
+function makeForeignHolderScan(stateBackend) {
+	let scan;
+	const key = (type, id) => JSON.stringify([type, physicalIdKey(type, id)]);
+	const run = async () => {
+		const holders = /* @__PURE__ */ new Map();
+		let refs;
+		try {
+			refs = await stateBackend.listStacks();
+		} catch {
+			return {
+				holders,
+				unreadable: "the state bucket listing (it could not be read)"
+			};
+		}
+		let unreadable;
+		await Promise.all(refs.map(async (ref) => {
+			const named = (why) => safeMsg`the state record of stack ${displayIdent(ref.stackName)} (${why})`;
+			if (ref.region === void 0) {
+				unreadable ??= named("its region cannot be read");
+				return;
+			}
+			const region = ref.region;
+			let state;
+			try {
+				state = (await stateBackend.getState(ref.stackName, region))?.state;
+			} catch {
+				unreadable ??= named("it could not be read");
+				return;
+			}
+			if (state === void 0) return;
+			const resources = state.resources;
+			if (resources !== void 0 && (typeof resources !== "object" || resources === null || Array.isArray(resources))) {
+				unreadable ??= named("its resources cannot be read");
+				return;
+			}
+			if (!hasReadableOrphans(state) || unreadableOrphanRecords(state).length > 0) {
+				unreadable ??= named("its rollback-orphan records cannot be read");
+				return;
+			}
+			const held = [...Object.values(resources ?? {}), ...(state.orphans ?? []).map((record) => record.state)];
+			for (const record of held) {
+				const r = record;
+				if (typeof r?.resourceType !== "string" || typeof r.physicalId !== "string") continue;
+				const k = key(r.resourceType, r.physicalId);
+				const list = holders.get(k) ?? [];
+				list.push({
+					stackName: ref.stackName,
+					region
+				});
+				holders.set(k, list);
+			}
+		}));
+		return {
+			holders,
+			...unreadable !== void 0 && { unreadable }
+		};
+	};
+	return (self) => async (resourceType, physicalId) => {
+		scan ??= run();
+		const { holders, unreadable } = await scan;
+		const other = (holders.get(key(resourceType, physicalId)) ?? []).find((h) => !(h.stackName === self.stackName && h.region === self.region));
+		if (other) return {
+			kind: "held",
+			by: safeMsg`the state record of stack ${displayIdent(other.stackName)} (${displaySafe(other.region)})`
+		};
+		return unreadable === void 0 ? void 0 : {
+			kind: "unreadable",
+			what: unreadable
+		};
+	};
+}
+async function markSuperseded(stateBackend, stackName, region, ids) {
+	try {
+		await stateBackend.markRollbackJournalSuperseded(stackName, region, ids);
+	} catch {}
+}
+function errorDetail(err) {
+	return displaySafe(err instanceof Error ? err.message : String(err));
+}
+function isHandledOrphan(handled, segment, op) {
+	return handled.some((h) => h.segment.timestamp === segment.timestamp && h.segment.runId === segment.runId && h.op.logicalId === op.logicalId && h.op.changeType === op.changeType && h.op.resourceType === op.resourceType && h.op.physicalId === op.physicalId);
+}
+function orphanKey(segment, op) {
+	return JSON.stringify([
+		segment.timestamp,
+		segment.runId ?? null,
+		op.logicalId,
+		op.changeType,
+		op.resourceType,
+		op.physicalId ?? null
+	]);
+}
+function sameJournaledOrphans(a, b) {
+	const keys = (o) => o.segments.flatMap(({ segment, ops }) => ops.map((op) => orphanKey(segment, op))).sort();
+	const ka = keys(a);
+	const kb = keys(b);
+	return ka.length === kb.length && ka.every((k, i) => k === kb[i]);
+}
+
 //#endregion
 //#region src/provisioning/nested-stack-context.ts
 const storage$1 = new AsyncLocalStorage();
@@ -33378,7 +33866,7 @@ function getNestedRevertRun() {
 	return revertRunStorage.getStore();
 }
 function errorText(error) {
-	return displaySafe(error instanceof Error ? error.message : String(error));
+	return displaySafe(describeAwsFailure(error).detail);
 }
 function isPlainRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -33551,6 +34039,13 @@ async function revertNestedChildFromJournal(args) {
 			...ctx.options?.eventRecorder && { recordEvent: (event) => ctx.options.eventRecorder.record(maskEventTextWithBoundBags(event)) },
 			finalSnapshotClients: ctx.options?.finalSnapshotClients,
 			skipFinalSnapshot: ctx.options?.skipFinalSnapshot === true || ctx.destroyOptions?.skipFinalSnapshot === true,
+			...ctx.destroyOptions?.removeProtection === true && {
+				removeProtection: true,
+				foreignHolder: makeForeignHolderScan(ctx.stateBackend)({
+					stackName: childStackName,
+					region
+				})
+			},
 			importedProducerRegions: producerRegions.regions,
 			producerRegionsIncomplete: !producerRegions.complete,
 			nestedChildRevert: true
@@ -33635,7 +34130,7 @@ async function planOrphanAdoption(params) {
 			provider = params.getProvider(state.resourceType, state.provisionedBy);
 		} catch (error) {
 			outcome.remaining.push(record);
-			outcome.notices.push(`${shownId} (${shownType}) is still in AWS as ${shownPhysicalId} from an earlier rollback, but this build cannot route that type (${displayAwsMessage(error instanceof Error ? error.message : String(error))}) — cdkd is not adopting it.`);
+			outcome.notices.push(`${shownId} (${shownType}) is still in AWS as ${shownPhysicalId} from an earlier rollback, but this build cannot route that type (${displayAwsMessage(describeAwsFailure(error).detail)}) — cdkd is not adopting it.`);
 			continue;
 		}
 		if (!provider.import) {
@@ -33654,7 +34149,7 @@ async function planOrphanAdoption(params) {
 				knownPhysicalId: state.physicalId
 			});
 		} catch (error) {
-			outcome.notices.push(`${shownId} (${shownType}) is recorded as left in AWS as ${shownPhysicalId}, but cdkd could not confirm it exists (${displayAwsMessage(error instanceof Error ? error.message : String(error))}) — keeping the record and not adopting it this run.`);
+			outcome.notices.push(`${shownId} (${shownType}) is recorded as left in AWS as ${shownPhysicalId}, but cdkd could not confirm it exists (${displayAwsMessage(describeAwsFailure(error).detail)}) — keeping the record and not adopting it this run.`);
 			outcome.remaining.push(record);
 			continue;
 		}
@@ -33707,7 +34202,7 @@ function makeSiblingClaimReader(params) {
 		try {
 			refs = await stateBackend.listStacks();
 		} catch (error) {
-			logger.debug(`orphan adoption: could not list sibling stacks — ${displayAwsMessage(error instanceof Error ? error.message : String(error))}`);
+			logger.debug(`orphan adoption: could not list sibling stacks — ${displayAwsMessage(describeAwsFailure(error).detail)}`);
 			return claimed;
 		}
 		for (const ref of refs) {
@@ -33733,445 +34228,13 @@ function makeSiblingClaimReader(params) {
 					logger.debug(safeMsg`orphan adoption: ${displayStackName(ref.stackName)} holds ${unreadable.length} ` + safeMsg`resource record(s) with no readable physical id — ${named}` + safeMsg`${rest > 0 ? ` and ${rest} more` : ""} — skipped; the claim set is a lower ` + `bound without them`);
 				}
 			} catch (error) {
-				logger.debug(`orphan adoption: skipping unreadable state for ${displayStackName(ref.stackName)} — ${displayAwsMessage(error instanceof Error ? error.message : String(error))}`);
+				logger.debug(`orphan adoption: skipping unreadable state for ${displayStackName(ref.stackName)} — ${displayAwsMessage(describeAwsFailure(error).detail)}`);
 			}
 		}
 		return claimed;
 	};
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/journaled-orphans.ts
-const NONE = {
-	segments: [],
-	count: 0
-};
-async function loadJournaledOrphans(stateBackend, stackName, region, rollbackOrphans, logger, options = {}) {
-	let segments;
-	try {
-		const journal = await stateBackend.loadRollbackJournal(stackName, region);
-		if (!journal) return NONE;
-		segments = journal.segments;
-	} catch (err) {
-		const detail = err instanceof Error ? err.message : String(err);
-		logger.warn(safeMsg`Could not read the stack's rollback journal (${displaySafe(detail)}); ` + safeMsg`no resource it records for a failed CREATE is deleted, and ${options.unreadableOutcome ?? "a destroy that proceeds removes the journal with the state"}.`);
-		return {
-			...NONE,
-			unreadable: true
-		};
-	}
-	const physicalIdOnly = (ops) => ops.filter((op) => op.changeType !== "CREATE");
-	const evidence = segments.map((segment) => options.deployRunId !== void 0 && segment.reason === "nested-pending-parent" && segment.runId === options.deployRunId ? {
-		...segment,
-		operations: physicalIdOnly(segment.operations)
-	} : segment);
-	const newer = options.newerOperations ?? [];
-	if (newer.length > 0) evidence.push({ operations: physicalIdOnly(newer) });
-	demoteSupersededOrphans(evidence, Array.isArray(rollbackOrphans) ? rollbackOrphans : []);
-	const deployLogicalIds = new Set(newer.map((op) => op.logicalId));
-	for (const segment of segments) if (options.deployRunId !== void 0 && segment.reason === "nested-pending-parent" && segment.runId === options.deployRunId) for (const op of segment.operations) deployLogicalIds.add(op.logicalId);
-	const out = [];
-	let count = 0;
-	for (let s = segments.length - 1; s >= 0; s--) {
-		const segment = segments[s];
-		if (segment.reason === "nested-pending-parent") continue;
-		const replay = splitImportedOps(segment.failedOperations ?? [], segment).replay;
-		const ops = replay.filter(isJournaledOrphan);
-		if (ops.length === 0) continue;
-		const companions = replay.filter((op) => op.changeType === "UPDATE" && replacementNeverSwapped(op, ops));
-		out.push({
-			segment,
-			ops,
-			...companions.length > 0 && { companions }
-		});
-		count += ops.length;
-	}
-	return {
-		segments: out,
-		count,
-		deployLogicalIds
-	};
-}
-function journaledOrphanLines(orphans, logger) {
-	return orphans.segments.flatMap(({ ops }) => ops.map((op) => `  - ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)})  ${displacedPhysicalIdShown(op, logger) ?? "a physical id"}`));
-}
-function dropFailedCommands(stackName, region, logicalIds) {
-	const ids = [...new Set(logicalIds)];
-	if (ids.length === 0) return void 0;
-	const built = ids.map((id) => pasteableCommand("cdkd rollback", [
-		{
-			value: stackName,
-			hole: "stack",
-			opts: { plainIdent: true }
-		},
-		{
-			flag: "--stack-region",
-			value: region,
-			hole: "region",
-			opts: { plainIdent: true }
-		},
-		{
-			flag: "--drop-failed",
-			value: id,
-			hole: "logical-id",
-			opts: { plainIdent: true }
-		}
-	]));
-	const idWithheld = built.some((b) => b.withheld.some((w) => w.hole === "logical-id"));
-	return {
-		intro: `If cdkd can never delete ${ids.length === 1 ? "it" : "one of them"} (a cause you cannot fix), check the resource by hand, then drop just its rollback-journal entry; every other entry is kept.` + withheldTargetClause(built[0], "stack", "cdkd rollback", "This stack's name") + withheldTargetClause(built[0], "region", "cdkd rollback", "This stack's region") + (idWithheld ? " A logical id that is not a plain identifier is not named in the command below; read it from the stack's rollback-journal.json (next to its state.json)." : ""),
-		commands: built.map((b) => b.command)
-	};
-}
-function dropFailedHint(stackName, region, logicalIds) {
-	const hint = dropFailedCommands(stackName, region, logicalIds);
-	if (hint === void 0) return "";
-	return `\n${hint.intro}` + hint.commands.map((c) => `\nDrop with: ${c}`).join("");
-}
-function warnDropFailed(logger, stackName, region, logicalIds) {
-	const hint = dropFailedCommands(stackName, region, logicalIds);
-	if (hint === void 0) return;
-	logger.warn(safeMsg`${hint.intro}`);
-	for (const command of hint.commands) logger.warn(safeMsg`Drop with: ${command}`);
-}
-async function deleteJournaledOrphans(orphans, stateResources, stackName, ctx, options = {}) {
-	const total = {
-		failures: 0,
-		warnings: 0,
-		interrupted: false,
-		handled: [],
-		leftInPlace: 0,
-		failedLogicalIds: []
-	};
-	const inlinePolicyWriters = new RollbackInlinePolicyWriters();
-	const failedIds = total.failedLogicalIds;
-	const record = ctx.recordEvent;
-	const printing = journaledOrphanPrintingBag(orphans.segments.flatMap(({ ops, companions }) => [...companions ?? [], ...ops]), stateResources);
-	const maskedCtx = record === void 0 ? ctx : {
-		...ctx,
-		recordEvent: (event) => record(maskEventTextWithBoundBags(event))
-	};
-	for (const { segment, ops: orphanOps, companions } of orphans.segments) {
-		if (options.isInterrupted?.()) {
-			total.interrupted = true;
-			break;
-		}
-		const ops = [...companions ?? [], ...orphanOps];
-		const replay = () => withPrintingSecrets(printing, () => withStackName(stackName, () => replayFailedOperations(ops, stateResources, stackName, maskedCtx, {
-			emitEnvelope: false,
-			inlinePolicyWriters,
-			forDestroy: true,
-			...options.isInterrupted && { isInterrupted: options.isInterrupted }
-		})));
-		const result = segment.skipPrefix === void 0 ? await replay() : await withSkipPrefix(segment.skipPrefix, replay);
-		total.failures += result.failures;
-		total.warnings += result.warnings;
-		total.leftInPlace += result.leftInPlace;
-		const pending = new Set(result.remainingFailedOps);
-		for (const op of ops) if (!pending.has(op)) total.handled.push({
-			segment,
-			op
-		});
-		if (result.interrupted) {
-			total.interrupted = true;
-			break;
-		}
-		for (const op of orphanOps) if (pending.has(op)) failedIds.push(op.logicalId);
-	}
-	if (options.pointAtDrop !== false && failedIds.length > 0) {
-		ctx.logger.warn(safeMsg`${failedIds.length} resource(s) a failed deploy of stack ${displayIdent(stackName)} created ` + "could not be deleted (see above); the rollback journal, their only record, keeps them for a re-run.");
-		warnDropFailed(ctx.logger, stackName, ctx.region, failedIds);
-	}
-	return total;
-}
-async function settleJournaledOrphansOnSuccess(args) {
-	const { stateBackend, stackName, region, stateResources, newerOperations, ctx, logger } = args;
-	const stack = displayIdent(stackName);
-	const newerIds = newerOperations.map((op) => op.logicalId);
-	let orphans;
-	try {
-		orphans = await loadJournaledOrphans(stateBackend, stackName, region, args.rollbackOrphans, logger, {
-			newerOperations,
-			...args.deployRunId !== void 0 && { deployRunId: args.deployRunId },
-			unreadableOutcome: "the successful deploy removes the journal"
-		});
-	} catch (err) {
-		logger.warn(safeMsg`Could not act on the rollback journal of stack ${stack}: ${errorDetail(err)}. It is kept.`);
-		await markSuperseded(stateBackend, stackName, region, newerIds);
-		return {
-			unaddressed: 1,
-			keepJournal: true
-		};
-	}
-	if (orphans.count === 0) return {
-		unaddressed: 0,
-		keepJournal: false
-	};
-	const all = orphans.segments.flatMap(({ segment, ops }) => ops.map((op) => ({
-		segment,
-		op
-	})));
-	let kept = all;
-	let failedDeletes = [];
-	let leftInPlace = 0;
-	if (stateResources === void 0) logger.warn(safeMsg`The rollback journal of stack ${stack} records ${all.length} resource(s) a failed deploy ` + `created, but the stack's state cannot be read, so whether a record now owns them is unknown: none is deleted.`);
-	else {
-		logger.info(safeMsg`The rollback journal of stack ${stack} records ${all.length} resource(s) a failed deploy ` + `created that no state record holds; acting on them per their DeletionPolicy before the journal is removed:`);
-		for (const line of journaledOrphanLines(orphans, logger)) logger.info(line);
-		try {
-			const { unreadable, tracked } = await applySuccessRule(orphans, stateResources, orphans.deployLogicalIds ?? /* @__PURE__ */ new Set(), args.foreignHolder, stack, logger, args.isInterrupted, ctx);
-			const acting = {
-				segments: orphans.segments.map(({ segment, ops }) => ({
-					segment,
-					ops: ops.filter((op) => !unreadable.has(op) && !tracked.has(op))
-				})).filter(({ ops }) => ops.length > 0),
-				count: orphans.count - unreadable.size - tracked.size
-			};
-			const writtenThisRun = [...orphans.deployLogicalIds ?? []].filter((id) => Object.prototype.hasOwnProperty.call(stateResources, id)).map((id) => stateResources[id]).filter((r) => r !== void 0 && r !== null && typeof r === "object");
-			const outcome = await deleteJournaledOrphans(acting, { ...stateResources }, stackName, {
-				...ctx,
-				writtenThisRun
-			}, {
-				pointAtDrop: false,
-				...args.isInterrupted && { isInterrupted: args.isInterrupted }
-			});
-			leftInPlace = outcome.leftInPlace;
-			failedDeletes = outcome.failedLogicalIds;
-			kept = all.filter(({ segment, op }) => unreadable.has(op) || !tracked.has(op) && !isHandledOrphan(outcome.handled, segment, op));
-		} catch (err) {
-			logger.warn(safeMsg`Acting on the journaled resources of stack ${stack} failed: ${errorDetail(err)}`);
-		}
-	}
-	const keptOps = new Set(kept.map(({ op }) => op));
-	const skipped = all.filter(({ op }) => !keptOps.has(op) && op.physicalIdRecoveredFromError === false).length;
-	const clearedOrphans = all.filter(({ op }) => !keptOps.has(op));
-	const cleared = [...clearedOrphans, ...orphans.segments.flatMap(({ segment, companions }) => (companions ?? []).filter((c) => replacementNeverSwapped(c, clearedOrphans.filter((o) => o.segment === segment).map((o) => o.op))).map((op) => ({
-		segment,
-		op
-	})))];
-	const stripCleared = cleared.length === 0 ? void 0 : async () => {
-		try {
-			await stateBackend.dropRollbackJournalFailedOperations(stackName, region, (op, segment) => isHandledOrphan(cleared, segment, op));
-		} catch (err) {
-			logger.warn(safeMsg`Failed to remove the settled entries from the rollback journal of stack ${stack}: ` + safeMsg`${errorDetail(err)}. A cdkd rollback or cdkd destroy could act on them again; run a ` + "successful cdkd deploy of the stack first, which settles them again.");
-		}
-	};
-	if (kept.length === 0) return {
-		unaddressed: skipped + leftInPlace,
-		keepJournal: false,
-		...stripCleared && { stripCleared }
-	};
-	const keptIds = new Set(kept.map(({ op }) => op.logicalId));
-	const supersededIds = newerIds.filter((id) => !keptIds.has(id));
-	const demoted = kept.filter(({ op }) => op.physicalIdRecoveredFromError === false);
-	const reduce = () => stateBackend.reduceRollbackJournalToFailedOperations(stackName, region, (op, segment) => isHandledOrphan(kept, segment, op), supersededIds, (op, segment) => isHandledOrphan(demoted, segment, op));
-	let reduced = false;
-	for (let attempt = 0; attempt < 2 && !reduced; attempt++) try {
-		await reduce();
-		reduced = true;
-	} catch (err) {
-		if (attempt === 1) logger.warn(safeMsg`Failed to reduce the rollback journal of stack ${stack} to its undeleted resources: ` + safeMsg`${errorDetail(err)}. The whole journal is kept.`);
-	}
-	if (!reduced) {
-		await markSuperseded(stateBackend, stackName, region, supersededIds);
-		await stripCleared?.();
-	}
-	logger.warn(safeMsg`${kept.length} resource(s) a failed deploy of stack ${stack} created were not deleted ` + (reduced ? "(see above). The rollback journal, their only record, is kept with just them; the next " : "(see above). The rollback journal, their only record, is kept; the next ") + "successful deploy retries.");
-	warnDropFailed(logger, stackName, region, failedDeletes);
-	return {
-		unaddressed: kept.length + skipped + leftInPlace,
-		keepJournal: true
-	};
-}
-async function applySuccessRule(orphans, stateResources, deployLogicalIds, foreignHolder, stack, logger, isInterrupted, identityCtx) {
-	const unreadable = /* @__PURE__ */ new Set();
-	const tracked = /* @__PURE__ */ new Set();
-	let interrupted = false;
-	for (const { ops } of orphans.segments) for (const op of ops) {
-		if (op.physicalIdRecoveredFromError !== true || !op.physicalId) continue;
-		if (interrupted || isInterrupted?.()) {
-			interrupted = true;
-			unreadable.add(op);
-			continue;
-		}
-		if (Object.values(stateResources).some((r) => r?.resourceType === op.resourceType && r.physicalId === op.physicalId)) {
-			tracked.add(op);
-			continue;
-		}
-		const hasRecord = Object.prototype.hasOwnProperty.call(stateResources, op.logicalId);
-		const record = hasRecord ? stateResources[op.logicalId] : void 0;
-		const recordUnderId = hasRecord && !isReplacedRecord(op, record);
-		if (recordUnderId || deployLogicalIds.has(op.logicalId)) {
-			const verdict = recordUnderId ? await recordIdentity(op, record, identityCtx, logger) : "unknown";
-			if (verdict === "same") {
-				tracked.add(op);
-				continue;
-			}
-			if (verdict !== "different") {
-				op.physicalIdRecoveredFromError = false;
-				continue;
-			}
-			markProvenDistinctFromRecord(op, record);
-		}
-		const holding = await foreignHolder(op.resourceType, op.physicalId);
-		if (holding === void 0) {
-			const created = await createdResourceStillThere(op, identityCtx);
-			if (created === "gone") {
-				logger.info(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is already gone: nothing to delete.`);
-				tracked.add(op);
-			} else if (created === "mismatch") {
-				logger.warn(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is not deleted: the resource now under its physical id is another ` + "one (its identity differs from the one that deploy recorded, so its name was reused).");
-				op.physicalIdRecoveredFromError = false;
-			} else if (created === "unproven") {
-				logger.warn(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is not deleted: nothing proves the resource now under its physical ` + "id is the one that deploy created (it may have been deleted and its name reused).");
-				op.physicalIdRecoveredFromError = false;
-			}
-			continue;
-		}
-		if (holding.kind === "held") {
-			logger.warn(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is not deleted: ${holding.by} holds a resource of that type under ` + "the same physical id.");
-			op.physicalIdRecoveredFromError = false;
-			continue;
-		}
-		logger.warn(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is not deleted: ${holding.what}, so whether another stack holds it is unknown.`);
-		unreadable.add(op);
-	}
-	return {
-		unreadable,
-		tracked
-	};
-}
-async function recordIdentity(op, record, ctx, logger) {
-	if (typeof record !== "object" || record === null || record.resourceType !== op.resourceType || typeof record.physicalId !== "string" || record.physicalId === "" || !op.physicalId) return "unknown";
-	try {
-		const { provider } = ctx.providerRegistry.getProviderFor({
-			resourceType: op.resourceType,
-			provisionedBy: op.provisionedBy
-		});
-		if (typeof provider.isSameResource !== "function") return "unknown";
-		return await provider.isSameResource(op.physicalId, {
-			physicalId: record.physicalId,
-			...record.provisionedBy !== void 0 && { provisionedBy: record.provisionedBy }
-		}, op.resourceType, { expectedRegion: ctx.region });
-	} catch (err) {
-		logger.debug(safeMsg`Could not compare ${logicalIdShown(op.logicalId)}'s journaled resource with its state record (${displaySafe(err instanceof Error ? err.name : typeof err)}).`);
-		return "unknown";
-	}
-}
-async function createdResourceStillThere(op, ctx) {
-	if (op.deletionPolicy === "Retain") return "proven";
-	if (!orphanDeleteNeedsIdentity(op.resourceType)) return "proven";
-	const physicalId = op.physicalId;
-	if (!physicalId) return "unproven";
-	const live = await readResourceIdentity(ctx.providerRegistry, {
-		resourceType: op.resourceType,
-		physicalId,
-		provisionedBy: op.provisionedBy
-	}, ctx.region);
-	if (live === RESOURCE_NOT_FOUND) return "gone";
-	const journaled = op.createdResourceIdentity;
-	if (typeof journaled !== "string" || journaled === "" || typeof live !== "string") return "unproven";
-	return live === journaled ? "proven" : "mismatch";
-}
-function makeForeignHolderScan(stateBackend) {
-	let scan;
-	const key = (type, id) => JSON.stringify([type, id]);
-	const run = async () => {
-		const holders = /* @__PURE__ */ new Map();
-		let refs;
-		try {
-			refs = await stateBackend.listStacks();
-		} catch {
-			return {
-				holders,
-				unreadable: "the state bucket listing (it could not be read)"
-			};
-		}
-		let unreadable;
-		await Promise.all(refs.map(async (ref) => {
-			const named = (why) => safeMsg`the state record of stack ${displayIdent(ref.stackName)} (${why})`;
-			if (ref.region === void 0) {
-				unreadable ??= named("its region cannot be read");
-				return;
-			}
-			const region = ref.region;
-			let state;
-			try {
-				state = (await stateBackend.getState(ref.stackName, region))?.state;
-			} catch {
-				unreadable ??= named("it could not be read");
-				return;
-			}
-			if (state === void 0) return;
-			const resources = state.resources;
-			if (resources !== void 0 && (typeof resources !== "object" || resources === null || Array.isArray(resources))) {
-				unreadable ??= named("its resources cannot be read");
-				return;
-			}
-			if (!hasReadableOrphans(state) || unreadableOrphanRecords(state).length > 0) {
-				unreadable ??= named("its rollback-orphan records cannot be read");
-				return;
-			}
-			const held = [...Object.values(resources ?? {}), ...(state.orphans ?? []).map((record) => record.state)];
-			for (const record of held) {
-				const r = record;
-				if (typeof r?.resourceType !== "string" || typeof r.physicalId !== "string") continue;
-				const k = key(r.resourceType, r.physicalId);
-				const list = holders.get(k) ?? [];
-				list.push({
-					stackName: ref.stackName,
-					region
-				});
-				holders.set(k, list);
-			}
-		}));
-		return {
-			holders,
-			...unreadable !== void 0 && { unreadable }
-		};
-	};
-	return (self) => async (resourceType, physicalId) => {
-		scan ??= run();
-		const { holders, unreadable } = await scan;
-		const other = (holders.get(key(resourceType, physicalId)) ?? []).find((h) => !(h.stackName === self.stackName && h.region === self.region));
-		if (other) return {
-			kind: "held",
-			by: safeMsg`the state record of stack ${displayIdent(other.stackName)} (${displaySafe(other.region)})`
-		};
-		return unreadable === void 0 ? void 0 : {
-			kind: "unreadable",
-			what: unreadable
-		};
-	};
-}
-async function markSuperseded(stateBackend, stackName, region, ids) {
-	try {
-		await stateBackend.markRollbackJournalSuperseded(stackName, region, ids);
-	} catch {}
-}
-function errorDetail(err) {
-	return displaySafe(err instanceof Error ? err.message : String(err));
-}
-function isHandledOrphan(handled, segment, op) {
-	return handled.some((h) => h.segment.timestamp === segment.timestamp && h.segment.runId === segment.runId && h.op.logicalId === op.logicalId && h.op.changeType === op.changeType && h.op.resourceType === op.resourceType && h.op.physicalId === op.physicalId);
-}
-function orphanKey(segment, op) {
-	return JSON.stringify([
-		segment.timestamp,
-		segment.runId ?? null,
-		op.logicalId,
-		op.changeType,
-		op.resourceType,
-		op.physicalId ?? null
-	]);
-}
-function sameJournaledOrphans(a, b) {
-	const keys = (o) => o.segments.flatMap(({ segment, ops }) => ops.map((op) => orphanKey(segment, op))).sort();
-	const ka = keys(a);
-	const kb = keys(b);
-	return ka.length === kb.length && ka.every((k, i) => k === kb[i]);
-}
-
 //#endregion
 //#region src/deployment/deploy-engine/rollback.ts
 function redactOperationsForJournal(operations) {
@@ -35716,8 +35779,8 @@ function buildResolverContext(base, stackName) {
 		...base.redactedAttributeReads && { redactedAttributeReads: base.redactedAttributeReads }
 	};
 }
-function printNestedStackReadsOnly(context, resourceType) {
-	if (resourceType === "AWS::CloudFormation::Stack") context.printingSecrets = /* @__PURE__ */ new Map();
+function printNestedStackReadsOnly(context, resourceType, rowPrintingRegistry) {
+	if (resourceType === "AWS::CloudFormation::Stack") context.printingSecrets = rowPrintingRegistry;
 }
 function getAttTargetOf(node) {
 	if (node === null || typeof node !== "object" || Array.isArray(node)) return void 0;
@@ -35785,7 +35848,7 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 	if (context.recordedSecretValues) this.perResourceSecrets.set(logicalId, context.recordedSecretValues);
 	const noEchoOverrides = await this.noEchoAttributeOverridesFor(desiredProps, stateResources, stackName);
 	if (noEchoOverrides !== void 0) context.noEchoAttributeOverrides = noEchoOverrides;
-	printNestedStackReadsOnly(context, resourceType);
+	printNestedStackReadsOnly(context, resourceType, this.secretNameBagFor(logicalId));
 	const resolvedProps = await this.resolver.resolve(desiredProps, context);
 	this.noteSecretNamedRecord(logicalId, {
 		resourceType,
@@ -35997,7 +36060,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	this.perResourceSecrets.set(logicalId, updateSecrets);
 	const noEchoOverrides = await this.noEchoAttributeOverridesFor(desiredProps, stateResources, stackName);
 	if (noEchoOverrides !== void 0) context.noEchoAttributeOverrides = noEchoOverrides;
-	printNestedStackReadsOnly(context, resourceType);
+	printNestedStackReadsOnly(context, resourceType, this.secretNameBagFor(logicalId));
 	const resolvedProps = await this.resolver.resolve(desiredProps, context);
 	this.noteSecretNamedRecord(logicalId, {
 		resourceType,
@@ -39520,5 +39583,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { recordDisplacedSkips as $, noEchoLeavesOf as $a, refuseMalformedResourcesForDeploy as $i, withPrintingSecrets as $n, importableOutputs as $o, passedParameterClassesOf as $r, resolveStateBucketWithDefault as $s, secretNamePrintingBag as $t, gray as A, coerceCfnBoolean as Aa, resolveBucketRegion as Ac, malformedScrubResourceEntriesRefusalMessage as Ai, findDestructiveChanges as An, recordMaskOnlyValue as Ao, envCredentialsAreAssumedRole as Ar, formatDockerLoginError as As, removeProtectionTypeList as At, isHandledOrphan as B, prefetchCreateOnlyPropertyPaths as Ba, refuseMalformedOutputs as Bi, planTagDiff as Bn, isSingleDynamicReferenceToken as Bo, getAccountInfo as Br, escapeRegExp$3 as Bs, findNestedStackTypeChanges as Bt, recordedProtectionNote as C, isStatefulRecreateTargetSync as Ca, ownValue as Cc, malformedOrphansWarning as Ci, collectPublishedOutputNames as Cn, pathCrossesDottedKey as Co, assertSendableRoleArn as Cr, buildDockerImage as Cs, INDEX_SETTLE_POLL_INTERVAL_MS as Ct, createReadOnlyAttributeHealerFactory as D, isWarmThroughputDecrease as Da, renderAssemblyPathEscape as Dc, malformedResourceEntriesWarning as Di, DEFAULT_RESOURCE_WARN_AFTER_MS as Dn, identityKeyFor as Do, AWS_CREDENTIAL_ENV_KEYS as Dr, describeDockerFailure as Ds, S3_AUTO_DELETE_OBJECTS_TAG as Dt, formatResourceLine as E, coerceWarmThroughput as Ea, displayAssemblyPath as Ec, malformedRenderedContainersWarning as Ei, DEFAULT_RESOURCE_TIMEOUT_MS as En, recoverMaskedOutput as Eo, sendableAssumeRoleCommand as Er, describeDockerExecFailure as Es, ECR_AUTO_DELETE_IMAGES_TAG as Et, namesAnyDeclaredParameter as F, readConfigString as Fa, refuseMalformedOrphanRecords as Fi, reserveStackCreateToken as Fn, STATE_SOURCED_BASELINE_RULES as Fo, s3BucketRegionalDomainName as Fr, redactDockerArgvValues as Fs, isReplacementOrphan as Ft, makeSiblingClaimReader as G, lambdaFunctionNameForMask as Ga, refuseMalformedResourceEntriesForDestroy as Gi, definedAttributes as Gn, splitImportedOps as Go, keepsSecretReferenceToken as Gr, synthesisStatusMessage as Gs, redactedDeleteAddressFields as Gt, loadJournaledOrphans as H, describeTypeWithThrottleRetry as Ha, refuseMalformedResourceAttributesForOrphan as Hi, refuseMalformedDesiredTags as Hn, isLockInfoExpired as Ho, carriesDynamicReference as Hr, AssetManifestLoader as Hs, inheritProducerRegions as Ht, reachableDivergentParameters as I, replayWarn as Ia, refuseMalformedOrphanRecordsForDestroy as Ii, withCreateTokenLedger as In, STATE_SOURCED_CROSS_GENERATION_RULES as Io, s3BucketWebsiteUrl as Ir, redactedDockerCause as Is, planFailedOps as It, displacedOpClause as J, TemplateParser as Ja, refuseMalformedResourceEntriesForOrphan as Ji, ProviderRegistry as Jn, exportNamesCarriedFrom as Jo, isStalePlaceholderArnAttribute as Jr, loadCdkJson as Js, updatePartialReason as Jt, planOrphanAdoption as K, sameLambdaFunctionAddress as Ka, refuseMalformedResourceEntriesForImport as Ki, stringifyIfAssigned as Kn, acceptedCreateOnlyDropsOf as Ko, AWS_NO_VALUE as Kr, getDefaultStateBucketName as Ks, redactedDeleteAddressSkip as Kt, resourcesNamingDeclaredParameter as L, requireConfigArray as La, refuseMalformedOrphans as Li, acquireIdempotencyToken as Ln, STATE_SOURCED_READBACK_RULES as Lo, coerceParameterTypedValue as Lr, runDockerForeground as Ls, planRollback as Lt, red as M, configBooleanRefusal as Ma, previewableOrphanRecords as Mi, RollbackInlinePolicyWriters as Mn, recordNoEchoAttributeValues as Mo, s3BucketArn as Mr, isDockerClientEnvKey as Ms, recordAfterRollbackUpdate as Mt, yellow as N, configIntegerRefusal as Na, refuseDivergentRecordRegionForDestroy as Ni, earliestDefined as Nn, recordProvenPublicExpression as No, s3BucketDomainName as Nr, isMalformedEnvKey as Ns, demoteSupersededOrphans as Nt, bold as O, toCfnInteger as Oa, resolveAssemblyPath as Oc, malformedResourcePropertiesWarning as Oi, maskingRetryLogger as On, carriesSecretMask as Oo, applyCallerIdentityCredentials as Or, dockerSpawnEnvWithSensitive as Os, hasCdkAutoDeleteTag as Ot, computeParameterTaint as P, configStringRefusal as Pa, refuseMalformedNestedChildOutputs as Pi, ledgerForStack as Pn, wholeStringLeavesOf as Po, s3BucketDualStackDomainName as Pr, partitionSensitiveEnv as Ps, isJournaledOrphan as Pt, nestedChildStackName as Q, maskedLeafCoordinatesOf as Qa, refuseMalformedResourcePropertiesForOrphan as Qi, getCurrentResourceSecrets as Qn, importableOutputKeys as Qo, parameterInputsFor as Qr, resolveSkipPrefix as Qs, orphanRecordsPrintingBag as Qt, deleteJournaledOrphans as R, requireConfigObject as Ra, refuseMalformedOrphansForDestroy as Ri, DBPROXY_TAGS_WHAT as Rn, TEMPLATE_SOURCED_RULES as Ro, isUnboundTemplateParameter as Rr, runDockerStreaming as Rs, replacementNeverSwapped as Rt, recordedProtectionEvidence as S, isStatefulRecreateTargetForReplace as Sa, nullPrototypeRecord as Sc, malformedOrphansRefusalMessage as Si, collectDeclaredOutputNames as Sn, isUncertifiedBaselineMaskPosition as So, assertFlagRoleArn as Sr, buildDenyExternalAccessPolicy as Ss, DELETE_INDEX_WAIT_PROCEED_NOTE as St, markRefusedBeforeApplying as T, WARM_THROUGHPUT_MEMBERS as Ta, describeFileReadFailure as Tc, malformedOutputsWarning as Ti, bindingSkippedOutputs as Tn, recordNestedStackParameterExpressions as To, isIamRoleArn as Tr, describeDockerCapturedOutput as Ts, waitForIndexesSettled as Tt, makeForeignHolderScan as U, withRetry as Ua, refuseMalformedResourceEntries as Ui, tagMapAsList as Un, S3StateBackend as Uo, carriesFetchableDynamicReference as Ur, getDockerImageBySourceHash as Us, REDACTED_DELETE_ADDRESS_SKIP_REASON as Ut, journaledOrphanLines as V, templateResourceTypes as Va, refuseMalformedOutputsForDestroy as Vi, readTagList as Vn, LockManager as Vo, isImpossibleEmptyStoredAttribute as Vr, stripControlChars as Vs, getCurrentProducerRegions as Vt, sameJournaledOrphans as W, canonicalLambdaFunctionName as Wa, refuseMalformedResourceEntriesForDeploy as Wi, tagPlanWarning as Wn, rebuildClientForBucketRegion as Wo, isNamelessDynamicReferenceError as Wr, Synthesizer as Ws, isRedactedRecordedValue as Wt, dropSettledNestedJournals as X, maskReadbackAtCoordinates as Xa, refuseMalformedResourcePropertiesForDrift as Xi, wouldReturnToSdkProvider as Xn, hasReasonlessBaselineRefusal as Xo, parseWebACLArn as Xr, resolveAutoAssetStorage as Xs, journaledOrphanPrintingBag as Xt, displacedPhysicalIdShown as Y, isMarkedCoordinate as Ya, refuseMalformedResourcePropertiesForDestroy as Yi, ccBrokenReason as Yn, hasReadableExportSet as Yo, refStateLookupFromResource as Yr, resolveApp as Ys, completedReplayEntries as Yt, getNestedRevertRun as Z, maskWholeValue as Za, refuseMalformedResourcePropertiesForExport as Zi, isCustomResourceType as Zn, hasUnverifiableParameterRefusal as Zo, withSharedDrainBudget as Zr, resolveCaptureObservedState as Zs, maskEventTextWithBoundBags as Zt, makeCanonicalizePropertiesFn as _, NO_CC_HANDLERS_REASON as _a, StageLoadError as _c, malformedLocalResourceEntriesWarning as _i, secretBearingStateKeyWarning as _n, markSameGenerationBag as _o, IntrinsicFunctionResolver as _r, isCrossRegionRedirect as _s, beginDeleteWait as _t, findNestedTemplateTreeDefect as a, repairMalformedOutputsForReadOnly as aa, CFN_TEMPLATE_BODY_LIMIT as ac, accountArgs as ai, createPreDeleteFinalSnapshot as an, createUnionSecretMasker as ao, deleteSkipReason as ar, isSensitiveAttributeName as as, replayFailedOperations as at, noEchoParameterNamesOf as b, shownType as ba, hasOwnKey as bc, malformedOrphanRecordsWarning as bi, isWholeDynamicReferenceValue as bn, DYNAMIC_REFERENCE_TOKEN_SCAN as bo, regionLessSecretName as br, validateAssetBucketName as bs, resolveDynamoDbDeleteBudgetClock as bt, renderNestedTemplateTreeDefect as c, repairMalformedResourcesForReadOnly as ca, findLargeInlineResources as cc, hasReadableOrphans as ci, refusesFinalSnapshot as cn, logOnlyValueCount as co, markWaitAbandoned as cr, buildAssetRedirectMap as cs, destroyStackRecordsView as ct, conditionInputsFrom as d, unreadableResourceEntries as da, decodeListingKey as dc, isReadableOrphanRecord as di, DeploymentEventsStore as dn, recordLogOnlyValue as do, isTerminationProtectionPropagationError as dr, rewriteTemplateAssetReferences as ds, PROTECTION_PROPERTY_BY_TYPE as dt, refuseMalformedResourcesForDestroy as ea, resolveStateBucketWithDefaultAndSource as ec, JSON_LISTING_HOLE_VALUE as ei, stateSecretNameNeedles as en, noEchoOutputsComparison as eo, CloudControlProvider as er, isReadableBag as es, revertNestedChildFromJournal as et, parentSuppliedValues as f, withheldAccountClause as fa, expectedOwnerParam as fc, isReadableResourceEntry as fi, extractDeploymentEventError as fn, shareLogOnlyValues as fo, observeThenDisableInstanceApiTermination as fr, AssetModeResolver as fs, isProtectionValueActive as ft, mergeNoChangeOutputs as g, withoutSilentDropProperties as ga, AssemblyReader as gc, malformedLocalOutputsWarning as gi, secretBearing as gn, maskSecretsInText as go, INTRINSIC_KEYS as gr, getBootstrapMarkerKey as gs, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as gt, keptWholeReasonText as h, unwrittenCreateOnlyReplacement as ha, derivePartitionAndUrlSuffix as hc, malformedExportSourceWarning as hi, exportAliasCollisionScrubWarning as hn, maskSecretsInError as ho, DiffCalculator as hr, ensureAssetStorage as hs, DynamoDBGlobalTableProvider as ht, childTemplateLoader as i, repairMalformedOrphansForReadOnly as ia, ssmResolvedValueType as ic, UNREADABLE_RESOURCES_MAP_ROW as ii, ccRoutedFinalSnapshotError as in, carryLogOnlyValues as io, deleteIndeterminateGuards as ir, AssetPublisher as is, withNestedStackContext as it, green as j, coerceCfnInteger as ja, malformedStateRefusalMessage as ji, formatDestructiveChange as jn, recordMaskOnlyValuesIn as jo, isSettledInstanceState as jr, getDockerCmd as js, orphanDeleteNeedsIdentity as jt, cyan as k, toFiniteNumber as ka, clearBucketRegionCache as kc, malformedResourcesWarning as ki, constructPathOf as kn, provenPublicValue as ko, callerEnvCredentials as kr, finchSecretArgvRefusal as ks, isTruthyCfnBoolean as kt, templateIdentity as l, unpreviewableOrphanRecords as la, uploadCfnTemplate as lc, hasReadableOutputs as li, unsupportedFinalSnapshotError as ln, printingCorpusOf as lo, disableInstanceApiTermination as lr, createAssetRedirectResolver as ls, getStackRecords as lt, isSecretBearingReferenceString as m, findSilentDropProperties as ma, canonicalizeRegion as mc, malformedExportNamesWarning as mi, displayTextOrWithheld as mn, errorCauseChain as mo, reEnableInstanceApiTermination as mr, assertAssetBucketRegion as ms, readProtection as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedState as na, stateBucketExistenceConfirmed as nc, STATE_RESOURCES_MALFORMED as ni, PRE_DELETE_SNAPSHOT_TYPES as nn, readsNoEchoSource as no, unchangedBehindSecretReference as nr, orphansCarriedFrom as ns, withNestedRevertRun as nt, isAbsoluteAssetPath as o, repairMalformedResourceEntriesForReadOnly as oa, CFN_TEMPLATE_URL_LIMIT as oc, deployRefusesOrphanRowsReason as oi, effectiveDeletionPolicy as on, hasMaskableValues as oo, withIndeterminateGuard as or, stringifyValue as os, replayRollback as ot, readRecordedConditionVerdicts as p, findActionableSilentDrops as pa, PARTITION_TABLE as pc, malformedDriftResourcePropertiesWarning as pi, WITHHELD_NAME_DISPLAY as pn, createSecretMasker as po, reDisableInstanceApiTermination as pr, BOOTSTRAP_MARKER_PREFIX as ps, perType as pt, NESTED_PENDING_PARENT_REASON as q, DagBuilder as qa, refuseMalformedResourceEntriesForImportSave as qi, CC_BROKEN_REASON as qn, describeRegionValueKind as qo, cfnRefValueFromPhysicalId as qr, getLegacyStateBucketName as qs, updatePartialMessage as qt, computeImplicitDeleteEdges as r, repairMalformedOrphanRecordsForReadOnly as ra, warnDeprecatedNoPrefixCliFlag as rc, UNREADABLE_ORPHANS_CONTAINER_ROW as ri, buildFinalSnapshotIdentifier as rn, liveMatchesUnresolvedTokenFrame as ro, UNSPECIFIED_SKIP_REASON as rr, shouldRetainResource as rs, getCurrentNestedStackContext as rt, listNestedTemplateRows as s, repairMalformedResourcePropertiesForReadOnly as sa, MIGRATE_TMP_PREFIX as sc, displayLogicalId as si, isFinalSnapshotError as sn, literalSplitDelimitersOf as so, isWaitAbandonedError as sr, WorkGraph as ss, awaitInFlightSibling as st, DeployEngine as t, refuseMalformedResourcesForExport as ta, resolveUseCdkBootstrapAssets as tc, STATE_REGION_DIVERGED as ti, ATOMIC_FINAL_SNAPSHOT_TYPES as tn, passedNoEchoParametersOf as to, slowCcOperationTimeoutMs as tr, orphansAfterRollback as ts, revertedNestedRowIds as tt, conditionFingerprint as u, unreadableOrphanRecords as ua, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as uc, hasReadableResources as ui, DeploymentEventsReader as un, recordLogOnlyParameterValue as uo, ec2InstanceProtectionSite as ur, loadPublishableAssetManifest as us, withStackRecords as ut, noEchoAttributeNamesOf as v, hasNoCloudControlHandlers as va, processStackMessages as vc, malformedLocalResourcesWarning as vi, secretSafeKeyDisplay as vn, redactSecretsForState as vo, classifyReplaySecretRegion as vr, parseBootstrapMarker as vs, compensateRemovedDeletionProtection as vt, getPriorAttempts as w, renderStatefulReason as wa, absoluteAssemblyPathEscape as wc, malformedOutputsRefusalMessage as wi, isExportAliasCollision as wn, inheritNestedStackParameterAssociations as wo, explicitRoleArnOrThrow as wr, resolveDockerContextDirectory as ws, deleteTableWithIndexBusyRetry as wt, withResourceDeadline as x, MULTI_REGION_RECREATE_BLOCKED_TYPES as xa, hasPlainPrototype$1 as xc, malformedOrphanRowsKeptWarning as xi, noEchoParameterValueSeed as xn, dynamicReferenceTokens as xo, applyRoleArnIfSet as xr, validateContainerRepoName as xs, resolveDynamoDbDeleteBudgetMs as xt, noEchoComparisonForTemplate as y, findReplacedReadersOfRecreateTargets as ya, defineOwnKey as yc, malformedOrphanRecordsRefusalMessage as yi, exportNameSecretExposure as yn, scrubResourceRecord as yo, producerRegionsFromState as yr, readBootstrapMarkerBody as ys, deleteBudgetKey as yt, dropFailedHint as z, requireConfigString as za, refuseMalformedOrphansForOrphan as zi, DBPROXY_TAG_OPTIONS as zn, WHOLE_DYNAMIC_REFERENCE_PATTERN as zo, parameterTypeMayLoseSecretIdentity as zr, warnFinchArgvExposure as zs, resolveReplacementOldType as zt };
-//# sourceMappingURL=deploy-engine-CrYi7ta5.js.map
+export { dropFailedHint as $, maskedLeafCoordinatesOf as $a, refuseMalformedResourcePropertiesForOrphan as $i, getCurrentResourceSecrets as $n, importableOutputKeys as $o, parameterInputsFor as $r, resolveSkipPrefix as $s, secretNamePrintingBag as $t, gray as A, toFiniteNumber as Aa, clearBucketRegionCache as Ac, malformedResourcesWarning as Ai, findDestructiveChanges as An, provenPublicValue as Ao, callerEnvCredentials as Ar, finchSecretArgvRefusal as As, removeProtectionTypeList as At, NESTED_PENDING_PARENT_REASON as B, requireConfigString as Ba, refuseMalformedOrphansForOrphan as Bi, planTagDiff as Bn, WHOLE_DYNAMIC_REFERENCE_PATTERN as Bo, parameterTypeMayLoseSecretIdentity as Br, warnFinchArgvExposure as Bs, findNestedStackTypeChanges as Bt, recordedProtectionNote as C, isStatefulRecreateTargetForReplace as Ca, nullPrototypeRecord as Cc, malformedOrphansRefusalMessage as Ci, collectPublishedOutputNames as Cn, isUncertifiedBaselineMaskPosition as Co, assertFlagRoleArn as Cr, buildDenyExternalAccessPolicy as Cs, INDEX_SETTLE_POLL_INTERVAL_MS as Ct, createReadOnlyAttributeHealerFactory as D, coerceWarmThroughput as Da, displayAssemblyPath as Dc, malformedRenderedContainersWarning as Di, DEFAULT_RESOURCE_WARN_AFTER_MS as Dn, recoverMaskedOutput as Do, sendableAssumeRoleCommand as Dr, describeDockerExecFailure as Ds, S3_AUTO_DELETE_OBJECTS_TAG as Dt, formatResourceLine as E, WARM_THROUGHPUT_MEMBERS as Ea, describeFileReadFailure as Ec, malformedOutputsWarning as Ei, DEFAULT_RESOURCE_TIMEOUT_MS as En, recordNestedStackParameterExpressions as Eo, isIamRoleArn as Er, describeDockerCapturedOutput as Es, ECR_AUTO_DELETE_IMAGES_TAG as Et, namesAnyDeclaredParameter as F, configStringRefusal as Fa, refuseMalformedNestedChildOutputs as Fi, reserveStackCreateToken as Fn, wholeStringLeavesOf as Fo, s3BucketDualStackDomainName as Fr, partitionSensitiveEnv as Fs, isReplacementOrphan as Ft, nestedChildStackName as G, canonicalLambdaFunctionName as Ga, refuseMalformedResourceEntriesForDeploy as Gi, definedAttributes as Gn, rebuildClientForBucketRegion as Go, isNamelessDynamicReferenceError as Gr, Synthesizer as Gs, redactedDeleteAddressFields as Gt, displacedPhysicalIdShown as H, templateResourceTypes as Ha, refuseMalformedOutputsForDestroy as Hi, refuseMalformedDesiredTags as Hn, LockManager as Ho, isImpossibleEmptyStoredAttribute as Hr, stripControlChars as Hs, inheritProducerRegions as Ht, reachableDivergentParameters as I, readConfigString as Ia, refuseMalformedOrphanRecords as Ii, withCreateTokenLedger as In, STATE_SOURCED_BASELINE_RULES as Io, s3BucketRegionalDomainName as Ir, redactDockerArgvValues as Is, planFailedOps as It, revertedNestedRowIds as J, DagBuilder as Ja, refuseMalformedResourceEntriesForImportSave as Ji, ProviderRegistry as Jn, describeRegionValueKind as Jo, cfnRefValueFromPhysicalId as Jr, getLegacyStateBucketName as Js, updatePartialReason as Jt, recordDisplacedSkips as K, lambdaFunctionNameForMask as Ka, refuseMalformedResourceEntriesForDestroy as Ki, stringifyIfAssigned as Kn, splitImportedOps as Ko, keepsSecretReferenceToken as Kr, synthesisStatusMessage as Ks, redactedDeleteAddressSkip as Kt, resourcesNamingDeclaredParameter as L, replayWarn as La, refuseMalformedOrphanRecordsForDestroy as Li, acquireIdempotencyToken as Ln, STATE_SOURCED_CROSS_GENERATION_RULES as Lo, s3BucketWebsiteUrl as Lr, redactedDockerCause as Ls, planRollback as Lt, red as M, coerceCfnInteger as Ma, malformedStateRefusalMessage as Mi, RollbackInlinePolicyWriters as Mn, recordMaskOnlyValuesIn as Mo, isSettledInstanceState as Mr, getDockerCmd as Ms, recordAfterRollbackUpdate as Mt, yellow as N, configBooleanRefusal as Na, previewableOrphanRecords as Ni, earliestDefined as Nn, recordNoEchoAttributeValues as No, s3BucketArn as Nr, isDockerClientEnvKey as Ns, demoteSupersededOrphans as Nt, bold as O, isWarmThroughputDecrease as Oa, renderAssemblyPathEscape as Oc, malformedResourceEntriesWarning as Oi, maskingRetryLogger as On, identityKeyFor as Oo, AWS_CREDENTIAL_ENV_KEYS as Or, describeDockerFailure as Os, hasCdkAutoDeleteTag as Ot, computeParameterTaint as P, configIntegerRefusal as Pa, refuseDivergentRecordRegionForDestroy as Pi, ledgerForStack as Pn, recordProvenPublicExpression as Po, s3BucketDomainName as Pr, isMalformedEnvKey as Ps, isJournaledOrphan as Pt, deleteJournaledOrphans as Q, maskWholeValue as Qa, refuseMalformedResourcePropertiesForExport as Qi, isCustomResourceType as Qn, hasUnverifiableParameterRefusal as Qo, withSharedDrainBudget as Qr, resolveCaptureObservedState as Qs, orphanRecordsPrintingBag as Qt, makeSiblingClaimReader as R, requireConfigArray as Ra, refuseMalformedOrphans as Ri, DBPROXY_TAGS_WHAT as Rn, STATE_SOURCED_READBACK_RULES as Ro, coerceParameterTypedValue as Rr, runDockerForeground as Rs, replacementNeverSwapped as Rt, recordedProtectionEvidence as S, MULTI_REGION_RECREATE_BLOCKED_TYPES as Sa, hasPlainPrototype$1 as Sc, malformedOrphanRowsKeptWarning as Si, collectDeclaredOutputNames as Sn, dynamicReferenceTokens as So, applyRoleArnIfSet as Sr, validateContainerRepoName as Ss, DELETE_INDEX_WAIT_PROCEED_NOTE as St, markRefusedBeforeApplying as T, renderStatefulReason as Ta, absoluteAssemblyPathEscape as Tc, malformedOutputsRefusalMessage as Ti, bindingSkippedOutputs as Tn, inheritNestedStackParameterAssociations as To, explicitRoleArnOrThrow as Tr, resolveDockerContextDirectory as Ts, waitForIndexesSettled as Tt, dropSettledNestedJournals as U, describeTypeWithThrottleRetry as Ua, refuseMalformedResourceAttributesForOrphan as Ui, tagMapAsList as Un, isLockInfoExpired as Uo, carriesDynamicReference as Ur, AssetManifestLoader as Us, REDACTED_DELETE_ADDRESS_SKIP_REASON as Ut, displacedOpClause as V, prefetchCreateOnlyPropertyPaths as Va, refuseMalformedOutputs as Vi, readTagList as Vn, isSingleDynamicReferenceToken as Vo, getAccountInfo as Vr, escapeRegExp$3 as Vs, getCurrentProducerRegions as Vt, getNestedRevertRun as W, withRetry as Wa, refuseMalformedResourceEntries as Wi, tagPlanWarning as Wn, S3StateBackend as Wo, carriesFetchableDynamicReference as Wr, getDockerImageBySourceHash as Ws, isRedactedRecordedValue as Wt, getCurrentNestedStackContext as X, isMarkedCoordinate as Xa, refuseMalformedResourcePropertiesForDestroy as Xi, isCustomResource as Xn, hasReadableExportSet as Xo, refStateLookupFromResource as Xr, resolveApp as Xs, journaledOrphanPrintingBag as Xt, withNestedRevertRun as Y, TemplateParser as Ya, refuseMalformedResourceEntriesForOrphan as Yi, ccBrokenReason as Yn, exportNamesCarriedFrom as Yo, isStalePlaceholderArnAttribute as Yr, loadCdkJson as Ys, completedReplayEntries as Yt, withNestedStackContext as Z, maskReadbackAtCoordinates as Za, refuseMalformedResourcePropertiesForDrift as Zi, wouldReturnToSdkProvider as Zn, hasReasonlessBaselineRefusal as Zo, parseWebACLArn as Zr, resolveAutoAssetStorage as Zs, maskEventTextWithBoundBags as Zt, makeCanonicalizePropertiesFn as _, withoutSilentDropProperties as _a, AssemblyReader as _c, malformedLocalOutputsWarning as _i, secretBearingStateKeyWarning as _n, maskSecretsInText as _o, INTRINSIC_KEYS as _r, getBootstrapMarkerKey as _s, beginDeleteWait as _t, findNestedTemplateTreeDefect as a, repairMalformedOrphansForReadOnly as aa, ssmResolvedValueType as ac, UNREADABLE_RESOURCES_MAP_ROW as ai, createPreDeleteFinalSnapshot as an, carryLogOnlyValues as ao, deleteIndeterminateGuards as ar, AssetPublisher as as, replayFailedOperations as at, noEchoParameterNamesOf as b, findReplacedReadersOfRecreateTargets as ba, defineOwnKey as bc, malformedOrphanRecordsRefusalMessage as bi, isWholeDynamicReferenceValue as bn, scrubResourceRecord as bo, producerRegionsFromState as br, readBootstrapMarkerBody as bs, resolveDynamoDbDeleteBudgetClock as bt, renderNestedTemplateTreeDefect as c, repairMalformedResourcePropertiesForReadOnly as ca, MIGRATE_TMP_PREFIX as cc, displayLogicalId as ci, refusesFinalSnapshot as cn, literalSplitDelimitersOf as co, isWaitAbandonedError as cr, WorkGraph as cs, destroyStackRecordsView as ct, conditionInputsFrom as d, unreadableOrphanRecords as da, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as dc, hasReadableResources as di, DeploymentEventsStore as dn, recordLogOnlyParameterValue as do, ec2InstanceProtectionSite as dr, loadPublishableAssetManifest as ds, PROTECTION_PROPERTY_BY_TYPE as dt, refuseMalformedResourcesForDeploy as ea, resolveStateBucketWithDefault as ec, passedParameterClassesOf as ei, stateSecretNameNeedles as en, noEchoLeavesOf as eo, withPrintingSecrets as er, importableOutputs as es, isHandledOrphan as et, parentSuppliedValues as f, unreadableResourceEntries as fa, decodeListingKey as fc, isReadableOrphanRecord as fi, extractDeploymentEventError as fn, recordLogOnlyValue as fo, isTerminationProtectionPropagationError as fr, rewriteTemplateAssetReferences as fs, isProtectionValueActive as ft, mergeNoChangeOutputs as g, unwrittenCreateOnlyReplacement as ga, derivePartitionAndUrlSuffix as gc, malformedExportSourceWarning as gi, secretBearing as gn, maskSecretsInError as go, DiffCalculator as gr, ensureAssetStorage as gs, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as gt, keptWholeReasonText as h, findSilentDropProperties as ha, canonicalizeRegion as hc, malformedExportNamesWarning as hi, exportAliasCollisionScrubWarning as hn, errorCauseChain as ho, reEnableInstanceApiTermination as hr, assertAssetBucketRegion as hs, DynamoDBGlobalTableProvider as ht, childTemplateLoader as i, repairMalformedOrphanRecordsForReadOnly as ia, warnDeprecatedNoPrefixCliFlag as ic, UNREADABLE_ORPHANS_CONTAINER_ROW as ii, ccRoutedFinalSnapshotError as in, liveMatchesUnresolvedTokenFrame as io, UNSPECIFIED_SKIP_REASON as ir, shouldRetainResource as is, sameJournaledOrphans as it, green as j, coerceCfnBoolean as ja, resolveBucketRegion as jc, malformedScrubResourceEntriesRefusalMessage as ji, formatDestructiveChange as jn, recordMaskOnlyValue as jo, envCredentialsAreAssumedRole as jr, formatDockerLoginError as js, orphanDeleteNeedsIdentity as jt, cyan as k, toCfnInteger as ka, resolveAssemblyPath as kc, malformedResourcePropertiesWarning as ki, constructPathOf as kn, carriesSecretMask as ko, applyCallerIdentityCredentials as kr, dockerSpawnEnvWithSensitive as ks, isTruthyCfnBoolean as kt, templateIdentity as l, repairMalformedResourcesForReadOnly as la, findLargeInlineResources as lc, hasReadableOrphans as li, unsupportedFinalSnapshotError as ln, logOnlyValueCount as lo, markWaitAbandoned as lr, buildAssetRedirectMap as ls, getStackRecords as lt, isSecretBearingReferenceString as m, findActionableSilentDrops as ma, PARTITION_TABLE as mc, malformedDriftResourcePropertiesWarning as mi, displayTextOrWithheld as mn, createSecretMasker as mo, reDisableInstanceApiTermination as mr, BOOTSTRAP_MARKER_PREFIX as ms, readProtection as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedResourcesForExport as na, resolveUseCdkBootstrapAssets as nc, STATE_REGION_DIVERGED as ni, PRE_DELETE_SNAPSHOT_TYPES as nn, passedNoEchoParametersOf as no, slowCcOperationTimeoutMs as nr, orphansAfterRollback as ns, loadJournaledOrphans as nt, isAbsoluteAssetPath as o, repairMalformedOutputsForReadOnly as oa, CFN_TEMPLATE_BODY_LIMIT as oc, accountArgs as oi, effectiveDeletionPolicy as on, createUnionSecretMasker as oo, deleteSkipReason as or, isSensitiveAttributeName as os, replayRollback as ot, readRecordedConditionVerdicts as p, withheldAccountClause as pa, expectedOwnerParam as pc, isReadableResourceEntry as pi, WITHHELD_NAME_DISPLAY as pn, shareLogOnlyValues as po, observeThenDisableInstanceApiTermination as pr, AssetModeResolver as ps, perType as pt, revertNestedChildFromJournal as q, sameLambdaFunctionAddress as qa, refuseMalformedResourceEntriesForImport as qi, CC_BROKEN_REASON as qn, acceptedCreateOnlyDropsOf as qo, AWS_NO_VALUE as qr, getDefaultStateBucketName as qs, updatePartialMessage as qt, computeImplicitDeleteEdges as r, refuseMalformedState as ra, stateBucketExistenceConfirmed as rc, STATE_RESOURCES_MALFORMED as ri, buildFinalSnapshotIdentifier as rn, readsNoEchoSource as ro, unchangedBehindSecretReference as rr, orphansCarriedFrom as rs, makeForeignHolderScan as rt, listNestedTemplateRows as s, repairMalformedResourceEntriesForReadOnly as sa, CFN_TEMPLATE_URL_LIMIT as sc, deployRefusesOrphanRowsReason as si, isFinalSnapshotError as sn, hasMaskableValues as so, withIndeterminateGuard as sr, stringifyValue as ss, awaitInFlightSibling as st, DeployEngine as t, refuseMalformedResourcesForDestroy as ta, resolveStateBucketWithDefaultAndSource as tc, JSON_LISTING_HOLE_VALUE as ti, ATOMIC_FINAL_SNAPSHOT_TYPES as tn, noEchoOutputsComparison as to, CloudControlProvider as tr, isReadableBag as ts, journaledOrphanLines as tt, conditionFingerprint as u, unpreviewableOrphanRecords as ua, uploadCfnTemplate as uc, hasReadableOutputs as ui, DeploymentEventsReader as un, printingCorpusOf as uo, disableInstanceApiTermination as ur, createAssetRedirectResolver as us, withStackRecords as ut, noEchoAttributeNamesOf as v, NO_CC_HANDLERS_REASON as va, StageLoadError as vc, malformedLocalResourceEntriesWarning as vi, secretSafeKeyDisplay as vn, markSameGenerationBag as vo, IntrinsicFunctionResolver as vr, isCrossRegionRedirect as vs, compensateRemovedDeletionProtection as vt, getPriorAttempts as w, isStatefulRecreateTargetSync as wa, ownValue as wc, malformedOrphansWarning as wi, isExportAliasCollision as wn, pathCrossesDottedKey as wo, assertSendableRoleArn as wr, buildDockerImage as ws, deleteTableWithIndexBusyRetry as wt, withResourceDeadline as x, shownType as xa, hasOwnKey as xc, malformedOrphanRecordsWarning as xi, noEchoParameterValueSeed as xn, DYNAMIC_REFERENCE_TOKEN_SCAN as xo, regionLessSecretName as xr, validateAssetBucketName as xs, resolveDynamoDbDeleteBudgetMs as xt, noEchoComparisonForTemplate as y, hasNoCloudControlHandlers as ya, processStackMessages as yc, malformedLocalResourcesWarning as yi, exportNameSecretExposure as yn, redactSecretsForState as yo, classifyReplaySecretRegion as yr, parseBootstrapMarker as ys, deleteBudgetKey as yt, planOrphanAdoption as z, requireConfigObject as za, refuseMalformedOrphansForDestroy as zi, DBPROXY_TAG_OPTIONS as zn, TEMPLATE_SOURCED_RULES as zo, isUnboundTemplateParameter as zr, runDockerStreaming as zs, resolveReplacementOldType as zt };
+//# sourceMappingURL=deploy-engine-Z_zHC0jz.js.map