@go-to-k/cdkd 0.296.13 → 0.296.15

package/dist/{deploy-engine-FDsHckZR.js → deploy-engine-CjLZZzyn.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js";
-import { A as displayIdent, C as withoutGeneratedFallbackName, D as UNRENDERABLE, E as STACK_REF_MAX_CODE_POINTS, F as plainIdentOr, I as safeMsg, M as displayStackName, N as isPasteableIdent, R as truncateCodePoints, S as withStackName, T as SECRET_REF_MAX_CODE_POINTS, _ as generateResourceNameWithFallback, b as looksLikeCdkdGeneratedName, c as installLogLineMaskerSource, g as generateResourceName, h as explicitNamePropertyFor, j as displaySafe, k as displayAwsMessage, l as getLiveRenderer, n as getLogger, p as applyDefaultNameForFallback, r as isStdoutReservedForPayload, s as currentLogLineMasker, v as getCurrentSkipPrefix, x as withSkipPrefix, y as getCurrentStackName } from "./logger-DAaB7GFO.js";
-import { $n as retryClassificationText, A as refusalTypeShown, An as pasteableCommand, At as UNREPRODUCIBLE_LOCK_CLAUSE, B as protectionFlipKey, Bn as hasReplayMayCollide, Bt as injectiveKey, C as assertRegionMatch, Ct as createdBeforeFailure, D as isQuotableImportValue, Dn as commandHole, Dt as isAuxiliaryMarkOf, En as UNSHOWABLE_VALUE, Et as isAuxiliaryFailure, F as compensateProtectionFlip, Fn as shellQuote, Ft as formatLockOperation, G as DELETION_PROTECTION_DOC_POINTER, Gt as withPasteableAwsProfile, H as runDeleteAttempt, Hn as isNameCooldownError, I as deleteWithProtectionCompensation, In as withheldTargetClause, It as formatLockOwner, Jn as isAmbiguousCcHandlerErrorCode, Jt as clientDefaultsFor, Kn as markReplayMayCollide, Kt as ambientClientDefaults, L as isTerminalDeleteFailure, Lt as sanitizeRecoveryValue, M as resolveExplicitPhysicalId, Mn as plainOrDescribed, Nn as quotedOrDescribed, O as normalizeAwsTagsToCfn, Ot as markAuxiliaryFailure, P as ProtectionFlipRegistry, Pn as shellBoundedDisplay, Pt as formatLockExpiry, Qn as isTransientServerError, Qt as CdkdError, Rt as CUSTOM_RESOURCE_RESPONSE_PREFIX, S as RESOURCE_NOT_FOUND, Tn as SHELL_ACTIVE_WHY, Tt as hasCreatedBeforeFailure, Un as isRecreateRetryableError, Ut as producerRecordKey, Vn as isNameCollisionErrorFrom, Wn as isReplayedNameCollisionFrom, X as protectedReplacementAdvice, Xn as isIamPropagationError, Xt as AccountIdUnavailableError, Y as pasteableAwsCommand, Yn as isAmbiguousOutcomeError, Yt as credentialFingerprint, Zn as isRetryableTransientError, Zt as AssetError, _n as StateError, _t as maskDeep, ar as isThrottlingError, at as canonicalizeRoute53QueryName, bt as RETRY_AUXILIARY_OWNER, cn as MacroExpansionError, cr as wrapMaskedAwsError, d as prepareRemovalForUpdate, dt as resourceTypeShown, en as CrossAccountSecretRefusalError, er as describeAwsFailure, f as removalWarning, fn as ProvisioningError, ft as segmentAfterAnchor, gt as isSecretDerivedValue, ht as createMaskedRetryLogger, i as holdsSecretDerivedEntry, in as IntrinsicResolutionRefusalError, ir as isMarkedNonRetryable, it as monotonicNowMs, jn as physicalIdShownBesideCommand, jt as buildForceUnlockCommand, k as quotedRemedyLogicalId, kn as isInertUnquoted, kt as markCreatedBeforeFailure, l as withUnchangedSecretPrincipalLists, ln as MalformedProducerRecordRefusalError, lt as logicalIdShown, m as withoutInjectedRemovals, mn as ResourceUpdateNotSupportedError, mt as createMaskedLogSinks, nr as safeStringify$1, nt as startInterruptWatch, or as markNonRetryable, pn as ResourceTimeoutError, pt as stateOrphanRecordRemedy, qn as formatRetryClassificationSignals, qt as ambientCredentialConfig, rn as DynamicReferenceRegionAmbiguousError, rt as ElapsedBudgetRegistry, sn as LockError, sr as markRedactedCause, st as compositeIdSeparatorRefusal, tn as DependencyError, tt as isInterruptedWaitError, vn as SynthesisError, vt as maskerOrIdentity, wn as SHELL_ACTIVE, wt as createdResourceIdentityBeforeFailure, x as withoutServerErrorRetries, xn as normalizeAwsError, xt as carryCreatedBeforeFailure, yt as withDerivedNameMasks, z as observeThenDisableProtection, zn as isUpdateUnsupportedError, zt as DEFAULT_STATE_PREFIX } from "./iam-policy-targets-elNafvpb.js";
+import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
+import { $ as protectedReplacementAdvice, $n as isIamPropagationError, $t as AccountIdUnavailableError, A as isQuotableImportValue, An as commandHole, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bt as sanitizeRecoveryValue, Ct as RETRY_AUXILIARY_OWNER, Dn as SHELL_ACTIVE, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as plainOrDescribed, G as runDeleteAttempt, Gn as isNameCooldownError, H as observeThenDisableProtection, Hn as isUpdateUnsupportedError, Ht as DEFAULT_STATE_PREFIX, In as quotedOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jt as withPasteableAwsProfile, Kn as isRecreateRetryableError, Kt as producerRecordKey, L as ProtectionFlipRegistry, Ln as shellBoundedDisplay, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mn as isInertUnquoted, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as pasteableCommand, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE_WHY, Ot as hasCreatedBeforeFailure, Pn as physicalIdShownBesideCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, R as compensateProtectionFlip, Rn as shellQuote, Rt as formatLockOperation, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Un as hasReplayMayCollide, Ut as injectiveKey, Vt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Wn as isNameCollisionErrorFrom, Xn as formatRetryClassificationSignals, Xt as ambientCredentialConfig, Yn as markReplayMayCollide, Yt as ambientClientDefaults, Zn as isAmbiguousCcHandlerErrorCode, Zt as clientDefaultsFor, _n as ResourceUpdateNotSupportedError, _t as createMaskedLogSinks, ar as isThrottlingError, at as startInterruptWatch, bn as StateError, bt as maskDeep, cr as wrapMaskedAwsError, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as MacroExpansionError, en as AssetError, er as isRetryableTransientError, f as removalWarning, fn as MalformedProducerRecordRefusalError, ft as logicalIdShown, gn as ResourceTimeoutError, gt as stateOrphanRecordRemedy, hn as ProvisioningError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as DependencyError, ir as isMarkedNonRetryable, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, kn as UNSHOWABLE_VALUE, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, m as withoutInjectedRemovals, mt as resourceTypeShown, nr as retryClassificationText, on as DynamicReferenceRegionAmbiguousError, or as markNonRetryable, ot as ElapsedBudgetRegistry, qn as isReplayedNameCollisionFrom, rn as CrossAccountSecretRefusalError, sn as IntrinsicResolutionRefusalError, sr as markRedactedCause, st as monotonicNowMs, tn as CdkdError, tr as isTransientServerError, un as LockError, ut as compositeIdSeparatorRefusal, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as normalizeAwsError, wt as carryCreatedBeforeFailure, xn as SynthesisError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as withheldTargetClause, zt as formatLockOwner } from "./iam-policy-targets-BoZuWtxK.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-B9EuX7Oh.js";
+import { t as getCdkdVersion } from "./version-Bdg2mYAM.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1279,7 +1279,7 @@ var ContextProviderRegistry = class {
 				results[entry.key] = value;
 				this.logger.debug(`Resolved context: ${shownKey}`);
 			} catch (error) {
-				const message = displayAwsMessage(error instanceof Error ? error.message : String(error));
+				const message = displayAwsMessage(describeAwsFailure(error).detail);
 				this.logger.error(`Context provider '${shownProvider}' failed: ${message}`);
 				results[entry.key] = {
 					[PROVIDER_ERROR_KEY]: message,
@@ -1423,6 +1423,9 @@ const PARTITION_TABLE = [
 function canonicalizeRegion(region) {
 	return typeof region === "string" ? region.toLowerCase() : region;
 }
+function sameRegion(a, b) {
+	return canonicalizeRegion(a) === canonicalizeRegion(b);
+}
 function derivePartitionAndUrlSuffix(region) {
 	const canonical = canonicalizeRegion(region);
 	for (const { prefix, partition, urlSuffix } of PARTITION_TABLE) if (canonical.startsWith(prefix)) return {
@@ -1493,7 +1496,7 @@ function resolveExpectedBucketOwner(client) {
 				secretAccessKey: credentials.secretAccessKey
 			});
 		} catch (error) {
-			getLogger().debug(`ExpectedBucketOwner resolution skipped (header omitted): ${String(error)}`);
+			getLogger().debug(`ExpectedBucketOwner resolution skipped (header omitted): ${safeStringify$1(error)}`);
 			clientCache.delete(client);
 			return;
 		}
@@ -1510,7 +1513,7 @@ async function recordResolvedAccountId(client, accountId) {
 		if (credentialsCache.has(accessKeyId)) return;
 		credentialsCache.set(accessKeyId, Promise.resolve(accountId));
 	} catch (error) {
-		getLogger().debug(`ExpectedBucketOwner seed skipped: ${String(error)}`);
+		getLogger().debug(`ExpectedBucketOwner seed skipped: ${safeStringify$1(error)}`);
 	}
 }
 async function expectedOwnerParam(client) {
@@ -1674,7 +1677,7 @@ function recordFailure(failed, key, reason) {
 	if (existing) existing.push(reason);
 	else failed.set(key, [reason]);
 }
-const describe$1 = (error) => error instanceof Error ? error.message : String(error);
+const describe$1 = (error) => describeAwsFailure(error).detail;
 const PREFIX_HANDLE_SUFFIX = "* (every key under this prefix)";
 async function purgeNoncurrentVersionsUnderPrefix(s3Client, bucket, prefix, options = {}) {
 	const logger = options.logger ?? getLogger().child("s3-version-purge");
@@ -2159,7 +2162,7 @@ function parseTemplateBody(body) {
 	return parsed;
 }
 function formatErr(err) {
-	return displayAwsMessage(err instanceof Error ? err.message : String(err));
+	return displayAwsMessage(describeAwsFailure(err).detail);
 }
 
 //#endregion
@@ -4113,7 +4116,7 @@ var AssetModeResolver = class {
 				marker
 			};
 		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
+			const message = describeAwsFailure(error).detail;
 			this.logger.warn(`Failed to auto-create cdkd asset storage for region ${quotedIfPlain(region, "that is not a plain identifier")}: ${message} Falling back to the CDK bootstrap destinations for this run — opt the region in with S3/ECR create permissions.\nBootstrap with: ${pasteableCommand("cdkd bootstrap", [{
 				flag: "--region",
 				value: region,
@@ -4445,7 +4448,7 @@ var WorkGraph = class {
 							nodeId: node.id,
 							error
 						});
-						this.logger.error(`Failed: ${node.id}: ${error instanceof Error ? error.message : String(error)}`);
+						this.logger.error(`Failed: ${node.id}: ${describeAwsFailure(error).detail}`);
 					}).finally(() => {
 						active[node.type]--;
 						dispatch();
@@ -4459,7 +4462,7 @@ var WorkGraph = class {
 					}
 					if (errors.length > 0) {
 						const skippedCount = [...this.nodes.values()].filter((n) => n.state === "skipped").length;
-						const msg = errors.map((e) => `  - ${e.nodeId}: ${e.error instanceof Error ? e.error.message : String(e.error)}`).join("\n");
+						const msg = errors.map((e) => `  - ${e.nodeId}: ${describeAwsFailure(e.error).detail}`).join("\n");
 						reject(/* @__PURE__ */ new Error(`${errors.length} node(s) failed${skippedCount > 0 ? `, ${skippedCount} skipped` : ""}:\n${msg}`));
 						return;
 					}
@@ -8656,7 +8659,7 @@ function canonicalJson$3(value) {
 	});
 }
 const PREVIOUS_NOECHO_VALUE = "(previous NoEcho value)";
-function parametersReadBy(node, sources) {
+function noEchoParametersReadBy(node, sources) {
 	return [...sources.parameters].filter((name) => readsNoEchoSource(node, {
 		parameters: /* @__PURE__ */ new Set([name]),
 		...sources.conditions !== void 0 && { conditions: sources.conditions }
@@ -8667,7 +8670,7 @@ function noEchoComparison(options) {
 	return ({ templateProperties, desired, current, record }) => {
 		const coordinates = noEchoCoordinatesOf(templateProperties, desired, sources);
 		const needles = [];
-		for (const name of parametersReadBy(templateProperties, sources)) {
+		for (const name of noEchoParametersReadBy(templateProperties, sources)) {
 			const value = values[name];
 			const leaves = Array.isArray(value) ? value : [value];
 			for (const leaf of leaves) if (typeof leaf === "string" && leaf.length >= minNeedleLength && !isSingleDynamicReferenceToken(leaf)) needles.push(leaf);
@@ -10910,6 +10913,14 @@ const CASE_INSENSITIVE_NAME_TYPES = /* @__PURE__ */ new Set([
 	"AWS::RDS::DBSubnetGroup"
 ]);
 const ASCII_CASE_INSENSITIVE_NAME_TYPES = /* @__PURE__ */ new Set(["AWS::Glue::Table"]);
+function physicalIdKey(resourceType, physicalId) {
+	if (CASE_INSENSITIVE_NAME_TYPES.has(resourceType)) return physicalId.toLowerCase();
+	if (ASCII_CASE_INSENSITIVE_NAME_TYPES.has(resourceType)) return physicalId.replace(/[A-Z]/g, (c) => c.toLowerCase());
+	return physicalId;
+}
+function samePhysicalId(resourceType, a, b) {
+	return physicalIdKey(resourceType, a) === physicalIdKey(resourceType, b);
+}
 const NO_PHYSICAL_ID_NAME_PROOF = /* @__PURE__ */ new Set(["AWS::Glue::Table"]);
 const GENERATED_NAME_VERBATIM = /* @__PURE__ */ new Set([
 	"AWS::CloudWatch::Alarm",
@@ -12162,6 +12173,10 @@ const CHILD_STORED_IN_PARENT = {
 		properties: ["GroupName"],
 		parentTypes: [IAM_GROUP]
 	},
+	"AWS::ApplicationAutoScaling::ScalingPolicy": {
+		properties: ["ScalingTargetId"],
+		parentTypes: ["AWS::ApplicationAutoScaling::ScalableTarget"]
+	},
 	"AWS::IAM::Policy": {
 		properties: [
 			"Roles",
@@ -19025,7 +19040,7 @@ async function resolveImportValue(importValueArg, context) {
 }
 function recordImport(context, exportName, producerStack, producerRegion) {
 	if (!context.recordedImports) return;
-	if (context.recordedImports.some((e) => e.exportName === exportName && e.sourceStack === producerStack && e.sourceRegion === producerRegion)) return;
+	if (context.recordedImports.some((e) => e.exportName === exportName && e.sourceStack === producerStack && sameRegion(e.sourceRegion, producerRegion))) return;
 	context.recordedImports.push({
 		exportName,
 		sourceStack: producerStack,
@@ -19077,7 +19092,7 @@ async function fetchAllCfnExports() {
 	return exports;
 }
 async function lookupCfnStackOutputs(stackName, region, context, loggedRegionText) {
-	const cacheKey = injectiveKey(region, stackName, credentialFingerprint(ambientCredentialConfig()));
+	const cacheKey = injectiveKey(canonicalizeRegion(region), stackName, credentialFingerprint(ambientCredentialConfig()));
 	let fetch = this.cfnStackOutputsCache.get(cacheKey);
 	if (!fetch) {
 		fetch = this.fetchCfnStackOutputs(stackName, region);
@@ -19107,7 +19122,8 @@ async function fetchCfnStackOutputs(stackName, region) {
 		throw error;
 	}
 }
-function getCfnClient(region) {
+function getCfnClient(rawRegion) {
+	const region = canonicalizeRegion(rawRegion);
 	const credentialConfig = ambientCredentialConfig();
 	const key = clientCacheKey(region, credentialConfig);
 	let client = this.cfnClients.get(key);
@@ -19149,7 +19165,7 @@ async function resolveGetStackOutput(arg, context) {
 		if (typeof raw !== "string" || raw === "") throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: RoleArn must be a literal string in the template (no Ref / Fn::GetAtt / Fn::Sub allowed for cross-account references). Got ${raw === null ? "null" : Array.isArray(raw) ? "array" : typeof raw}${typeof raw === "object" ? ` (intrinsic shape: ${this.displayMasked(JSON.stringify(raw).slice(0, 80), context)})` : ""}.`));
 		roleArn = raw;
 	}
-	if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: cannot reference own stack ${this.displayMaskedIdent(stackName, context, STACK_REF_MAX_CODE_POINTS)} in the same region ${this.displayMaskedIdent(loggedRegionText, context)}`));
+	if (!roleArn && context.stackName && context.stackName === stackName && sameRegion(region, this.resolverRegion)) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: cannot reference own stack ${this.displayMaskedIdent(stackName, context, STACK_REF_MAX_CODE_POINTS)} in the same region ${this.displayMaskedIdent(loggedRegionText, context)}`));
 	const loggedStackName = this.displayMaskedIdent(stackName, context, STACK_REF_MAX_CODE_POINTS);
 	const loggedOutputName = this.displayMaskedIdent(outputName, context);
 	const loggedRegion = this.displayMasked(loggedRegionText, context);
@@ -19195,7 +19211,7 @@ async function resolveGetStackOutput(arg, context) {
 }
 function recordOutputRead(context, producerStack, producerRegion, outputName) {
 	if (!context.recordedOutputReads) return;
-	if (context.recordedOutputReads.some((e) => e.sourceStack === producerStack && e.sourceRegion === producerRegion && e.outputName === outputName)) return;
+	if (context.recordedOutputReads.some((e) => e.sourceStack === producerStack && sameRegion(e.sourceRegion, producerRegion) && e.outputName === outputName)) return;
 	context.recordedOutputReads.push({
 		sourceStack: producerStack,
 		sourceRegion: producerRegion,
@@ -20926,7 +20942,7 @@ function clientsForRegion(targetRegion, targetLogText) {
 	const cacheKey = clientCacheKey(target, ambient.credentialConfig ?? {});
 	const cached = this.regionScopedClients.get(cacheKey);
 	if (cached) return cached;
-	if (canonicalizeRegion(ambient.configuredRegion) === target) return ambient;
+	if (sameRegion(ambient.configuredRegion, target)) return ambient;
 	const scoped = ambient.withRegion(target);
 	this.regionScopedClients.set(cacheKey, scoped);
 	this.logger.debug(`Using region-scoped AWS clients for ${displaySafe(loggedTarget)}`);
@@ -21067,7 +21083,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	resolverForProducerRegion(producerRegion, context, producerRegionLogText) {
 		if (!producerRegion) return this;
 		const target = canonicalizeRegion(producerRegion);
-		if (target === canonicalizeRegion(this.explicitRegion)) return this;
+		if (sameRegion(target, this.explicitRegion)) return this;
 		const regionText = producerRegionLogText !== void 0 ? canonicalizeRegion(producerRegionLogText) : this.regionLogText(producerRegion, context);
 		const guestRegionText = this.displayMasked(regionText, context);
 		const cached = this.producerRegionResolvers.get(target);
@@ -22700,7 +22716,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DeeIdM5B.js");
+			const { ASGProvider } = await import("./asg-provider-BbWC_1l5.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -22806,7 +22822,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-Q1U7N7ee.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-Bdc1YYxL.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-e6XtJAGl.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DlSon_pZ.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -27520,6 +27536,20 @@ function exportNameSecretExposure(exportName, substitutedIntoName, recordedThisP
 	}
 	return exposure.size > 0 ? exposure : void 0;
 }
+function carriedExportAliasExposure(exportName, recordedThisPass, noEchoParameterValues) {
+	const carried = /* @__PURE__ */ new Map();
+	shareLogOnlyValues(carried, recordedThisPass);
+	const exposure = exportNameSecretExposure(exportName, carried, recordedThisPass, noEchoParameterValues);
+	if (exposure === void 0) return void 0;
+	return {
+		exposure,
+		noEchoOnly: isNoEchoOnlyExposure(exposure, carried, recordedThisPass)
+	};
+}
+function exportNameNoEchoParameters(exportName, sources) {
+	if (sources === void 0 || exportName === null || typeof exportName !== "object") return [];
+	return noEchoParametersReadBy(exportName, sources);
+}
 function isNoEchoOnlyExposure(exposure, substitutedIntoName, recordedThisPass) {
 	for (const plaintext of exposure.keys()) if (substitutedIntoName.has(plaintext) || recordedThisPass?.has(plaintext) === true) return false;
 	return exposure.size > 0;
@@ -27569,6 +27599,11 @@ function secretBearingExportNameWarning(outputKey, exportName, exposure, secrets
 	if (noEchoOnly) return `Output ${owner} has an Export.Name that resolves to a value containing a secret ${shown}— skipping the export alias. The name contains the value of a NoEcho template parameter, or a value derived from one: the whole name at any length, or embedded at 4 or more characters, even where the match is a coincidence. An export name becomes a key in state.json and in the exports index, where the value would be stored in plaintext. An existing Fn::ImportValue of this name stops resolving. Rename the export, or choose a NoEcho value the name does not contain.`;
 	return `Output ${owner} has an Export.Name that resolves to a value containing a secret ${shown}— skipping the export alias. An export name becomes a key in state.json and in the exports index, and redaction rewrites VALUES only, so publishing it would persist the secret in plaintext. Use a non-secret Export.Name.`;
 }
+function noEchoParameterExportNameWarning(outputKey, parameterNames, secrets) {
+	const owner = displayTextOrWithheld(secretSafeKeyDisplay(outputKey, printingCorpusOf(secrets)));
+	const names = parameterNames.map((name) => displayIdent(name, { listMember: true })).join(", ");
+	return `Output ${owner} has an Export.Name that reads the NoEcho template ${parameterNames.length === 1 ? "parameter" : "parameters"} ${names} — skipping the export alias. An export name becomes a key in state.json and in the exports index, where the value would be stored in plaintext, so a name built from a NoEcho parameter is refused whatever the value's length. An existing Fn::ImportValue of this name stops resolving. Build the Export.Name without the NoEcho parameter.`;
+}
 function mergedExposure(a, b) {
 	if (a === void 0) return b;
 	if (b === void 0) return a;
@@ -27653,6 +27688,7 @@ function handleOutputResolutionFailure(error, outputKey, outputs, secrets, inher
 }
 async function resolveOutputs(template, resources, stackName, digestSource, parameterValues, conditions) {
 	this.resolvedExportNames = [];
+	this.carriedExportAliasRefusal = void 0;
 	if (!template.Outputs) return {};
 	const outputs = Object.create(null);
 	const context = this.buildResolverContext({
@@ -27692,6 +27728,12 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 			}
 		}
 		const noEchoSeed = noEchoParameterValueSeed(template.Parameters, parameterValues, context.inheritedSecrets, this.options.parameters);
+		const noEchoSources = this.noEchoPositionSources(resources, template, conditions);
+		this.carriedExportAliasRefusal = (outputKey, exportName) => {
+			const verdict = carriedExportAliasExposure(exportName, outputsPassSecrets, noEchoSeed);
+			if (verdict === void 0) return void 0;
+			return secretBearingExportNameWarning(outputKey, exportName, verdict.exposure, context.recordedSecretValues, verdict.noEchoOnly);
+		};
 		const resolvedNames = [];
 		for (const [outputKey, output] of Object.entries(template.Outputs)) {
 			if (isOutputSuppressedByCondition(output, conditions)) continue;
@@ -27719,12 +27761,15 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 				exportName,
 				value,
 				outputValue: output.Value,
+				nameSource: output.Export.Name,
 				nameSecrets
 			});
 		}
-		for (const { outputKey, exportName, value, outputValue, nameSecrets } of resolvedNames) {
-			const exposure = exportNameSecretExposure(exportName, nameSecrets, context.recordedSecretValues, noEchoSeed);
-			if (exposure) this.logger.warn(secretBearingExportNameWarning(outputKey, exportName, exposure, context.recordedSecretValues, isNoEchoOnlyExposure(exposure, nameSecrets, context.recordedSecretValues)));
+		for (const { outputKey, exportName, value, outputValue, nameSource, nameSecrets } of resolvedNames) {
+			const noEchoParameters = exportNameNoEchoParameters(nameSource, noEchoSources);
+			const exposure = noEchoParameters.length > 0 ? void 0 : exportNameSecretExposure(exportName, nameSecrets, context.recordedSecretValues, noEchoSeed);
+			if (noEchoParameters.length > 0) this.logger.warn(noEchoParameterExportNameWarning(outputKey, noEchoParameters, outputsPassSecrets));
+			else if (exposure) this.logger.warn(secretBearingExportNameWarning(outputKey, exportName, exposure, context.recordedSecretValues, isNoEchoOnlyExposure(exposure, nameSecrets, context.recordedSecretValues)));
 			else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) this.logger.warn(exportAliasCollisionWarning(outputKey, exportName, outputsPassSecrets));
 			else {
 				outputs[exportName] = value;
@@ -27897,7 +27942,7 @@ var DeploymentEventsStore = class {
 	}
 	enqueueWrite(op) {
 		const next = this.writeChain.then(op).catch((err) => {
-			this.warnOnce(`Failed to persist deployment events for run ${this.runId}: ${err instanceof Error ? err.message : String(err)}`);
+			this.warnOnce(`Failed to persist deployment events for run ${this.runId}: ${describeAwsFailure(err).detail}`);
 		});
 		this.writeChain = next;
 		return next;
@@ -27918,7 +27963,7 @@ var DeploymentEventsStore = class {
 				if (Array.isArray(parsed.runs)) return parsed.runs;
 			}
 		} catch (err) {
-			this.logger.debug(`Deployment-events index unreadable, rewriting: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`Deployment-events index unreadable, rewriting: ${describeAwsFailure(err).detail}`);
 		}
 		return [];
 	}
@@ -29305,7 +29350,7 @@ function classifyFailedOp(op, stateResources, siblings = []) {
 		if (op.physicalIdRecoveredFromError === false) return "skip-failed-superseded";
 		if (op.physicalIdRecoveredFromError === true) {
 			if (current) {
-				if (current.physicalId === op.physicalId) return "skip-failed-noop";
+				if (current.physicalId === op.physicalId || current.resourceType === op.resourceType && typeof current.physicalId === "string" && samePhysicalId(op.resourceType, current.physicalId, op.physicalId)) return "skip-failed-noop";
 				if (!isReplacedRecord(op, current) && !isProvenDistinctRecord(op, current)) return "skip-failed-mismatch";
 			}
 			if (stateHoldsPhysicalId(stateResources, op.resourceType, op.physicalId)) return "skip-failed-noop";
@@ -29356,14 +29401,14 @@ function replacedResourceDeleted(op, siblings) {
 	return siblings.some((s) => s !== op && isReplacementOrphan(s) && s.logicalId === op.logicalId && s.replacedPhysicalId === op.physicalId && s.replacedResourceDeleted === true);
 }
 function stateHoldsPhysicalId(stateResources, resourceType, physicalId) {
-	return Object.values(stateResources).some((r) => r?.resourceType === resourceType && r.physicalId === physicalId);
+	return Object.values(stateResources).some((r) => r?.resourceType === resourceType && typeof r.physicalId === "string" && samePhysicalId(resourceType, r.physicalId, physicalId));
 }
 function demoteSupersededOrphans(segments, orphans = []) {
 	let demoted = 0;
 	segments.forEach((segment, s) => {
 		for (const op of segment.failedOperations ?? []) {
 			if (op.changeType !== "CREATE" || op.physicalIdRecoveredFromError !== true) continue;
-			if (segments.slice(s + 1).some((t) => (t.operations ?? []).some((o) => mayOwn(o, op, true)) || (t.failedOperations ?? []).some((o) => mayOwn(o, op, false))) || segments.slice(s).some((t) => t.supersededLogicalIds?.includes(op.logicalId) === true) || orphans.some((o) => o?.logicalId === op.logicalId || o?.state?.resourceType === op.resourceType && o.state?.physicalId === op.physicalId)) {
+			if (segments.slice(s + 1).some((t) => (t.operations ?? []).some((o) => mayOwn(o, op, true)) || (t.failedOperations ?? []).some((o) => mayOwn(o, op, false))) || segments.slice(s).some((t) => t.supersededLogicalIds?.includes(op.logicalId) === true) || orphans.some((o) => o?.logicalId === op.logicalId || o?.state?.resourceType === op.resourceType && holdsSameId(op.resourceType, o.state?.physicalId, op.physicalId))) {
 				op.physicalIdRecoveredFromError = false;
 				demoted++;
 			}
@@ -29374,8 +29419,12 @@ function demoteSupersededOrphans(segments, orphans = []) {
 function mayOwn(o, orphan, completed) {
 	if (o?.resourceType !== orphan.resourceType) return false;
 	if (completed && o.changeType === "CREATE") return true;
-	if (o.physicalId === orphan.physicalId) return true;
-	return o.previousState?.physicalId === orphan.physicalId;
+	if (holdsSameId(orphan.resourceType, o.physicalId, orphan.physicalId)) return true;
+	return holdsSameId(orphan.resourceType, o.previousState?.physicalId, orphan.physicalId);
+}
+function holdsSameId(resourceType, held, orphanId) {
+	if (typeof held !== "string" || typeof orphanId !== "string") return held === orphanId;
+	return samePhysicalId(resourceType, held, orphanId);
 }
 function isJournaledOrphan(op) {
 	return op.changeType === "CREATE" && typeof op.physicalIdRecoveredFromError === "boolean";
@@ -30044,7 +30093,7 @@ async function deleteMarkedRecreate(error, s) {
 	if (madeId === void 0) return false;
 	const shown = `${shownLogicalId(s.op.logicalId)} (${refusalResourceType(s.oldType)})`;
 	const id = s.mask(madeId);
-	if (Object.values(s.stateResources).some((r) => r?.resourceType === s.oldType && r.physicalId === madeId)) return false;
+	if (Object.values(s.stateResources).some((r) => r?.resourceType === s.oldType && typeof r.physicalId === "string" && samePhysicalId(s.oldType, r.physicalId, madeId))) return false;
 	if (s.deletionPolicy === "Retain" || s.deletionPolicy === "Snapshot") {
 		s.logger.warn(safeMsg`  Rollback: the failed re-create of ${shown} made ${id} before failing; ` + safeMsg`it is left in AWS (DeletionPolicy: ${s.deletionPolicy}) and no record holds it — delete it yourself if it is not needed`);
 		return false;
@@ -33318,6 +33367,439 @@ async function replayFailedOperations(...args) {
 	return await withProducerRegions(() => replayProducerRegionEvidence(args[3]), () => withStackRecords(replayStackRecordsView(args[1]), () => replayFailedOperationsUnbound(...args)));
 }
 
+//#endregion
+//#region src/deployment/rollback-executor/journaled-orphans.ts
+const NONE = {
+	segments: [],
+	count: 0
+};
+async function loadJournaledOrphans(stateBackend, stackName, region, rollbackOrphans, logger, options = {}) {
+	let segments;
+	try {
+		const journal = await stateBackend.loadRollbackJournal(stackName, region);
+		if (!journal) return NONE;
+		segments = journal.segments;
+	} catch (err) {
+		const detail = err instanceof Error ? err.message : String(err);
+		logger.warn(safeMsg`Could not read the stack's rollback journal (${displaySafe(detail)}); ` + safeMsg`no resource it records for a failed CREATE is deleted, and ${options.unreadableOutcome ?? "a destroy that proceeds removes the journal with the state"}.`);
+		return {
+			...NONE,
+			unreadable: true
+		};
+	}
+	const physicalIdOnly = (ops) => ops.filter((op) => op.changeType !== "CREATE");
+	const evidence = segments.map((segment) => options.deployRunId !== void 0 && segment.reason === "nested-pending-parent" && segment.runId === options.deployRunId ? {
+		...segment,
+		operations: physicalIdOnly(segment.operations)
+	} : segment);
+	const newer = options.newerOperations ?? [];
+	if (newer.length > 0) evidence.push({ operations: physicalIdOnly(newer) });
+	demoteSupersededOrphans(evidence, Array.isArray(rollbackOrphans) ? rollbackOrphans : []);
+	const deployLogicalIds = new Set(newer.map((op) => op.logicalId));
+	for (const segment of segments) if (options.deployRunId !== void 0 && segment.reason === "nested-pending-parent" && segment.runId === options.deployRunId) for (const op of segment.operations) deployLogicalIds.add(op.logicalId);
+	const out = [];
+	let count = 0;
+	for (let s = segments.length - 1; s >= 0; s--) {
+		const segment = segments[s];
+		if (segment.reason === "nested-pending-parent") continue;
+		const replay = splitImportedOps(segment.failedOperations ?? [], segment).replay;
+		const ops = replay.filter(isJournaledOrphan);
+		if (ops.length === 0) continue;
+		const companions = replay.filter((op) => op.changeType === "UPDATE" && replacementNeverSwapped(op, ops));
+		out.push({
+			segment,
+			ops,
+			...companions.length > 0 && { companions }
+		});
+		count += ops.length;
+	}
+	return {
+		segments: out,
+		count,
+		deployLogicalIds
+	};
+}
+function journaledOrphanLines(orphans, logger) {
+	return orphans.segments.flatMap(({ ops }) => ops.map((op) => `  - ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)})  ${displacedPhysicalIdShown(op, logger) ?? "a physical id"}`));
+}
+function dropFailedCommands(stackName, region, logicalIds) {
+	const ids = [...new Set(logicalIds)];
+	if (ids.length === 0) return void 0;
+	const built = ids.map((id) => pasteableCommand("cdkd rollback", [
+		{
+			value: stackName,
+			hole: "stack",
+			opts: { plainIdent: true }
+		},
+		{
+			flag: "--stack-region",
+			value: region,
+			hole: "region",
+			opts: { plainIdent: true }
+		},
+		{
+			flag: "--drop-failed",
+			value: id,
+			hole: "logical-id",
+			opts: { plainIdent: true }
+		}
+	]));
+	const idWithheld = built.some((b) => b.withheld.some((w) => w.hole === "logical-id"));
+	return {
+		intro: `If cdkd can never delete ${ids.length === 1 ? "it" : "one of them"} (a cause you cannot fix), check the resource by hand, then drop just its rollback-journal entry; every other entry is kept.` + withheldTargetClause(built[0], "stack", "cdkd rollback", "This stack's name") + withheldTargetClause(built[0], "region", "cdkd rollback", "This stack's region") + (idWithheld ? " A logical id that is not a plain identifier is not named in the command below; read it from the stack's rollback-journal.json (next to its state.json)." : ""),
+		commands: built.map((b) => b.command)
+	};
+}
+function dropFailedHint(stackName, region, logicalIds) {
+	const hint = dropFailedCommands(stackName, region, logicalIds);
+	if (hint === void 0) return "";
+	return `\n${hint.intro}` + hint.commands.map((c) => `\nDrop with: ${c}`).join("");
+}
+function warnDropFailed(logger, stackName, region, logicalIds) {
+	const hint = dropFailedCommands(stackName, region, logicalIds);
+	if (hint === void 0) return;
+	logger.warn(safeMsg`${hint.intro}`);
+	for (const command of hint.commands) logger.warn(safeMsg`Drop with: ${command}`);
+}
+async function deleteJournaledOrphans(orphans, stateResources, stackName, ctx, options = {}) {
+	const total = {
+		failures: 0,
+		warnings: 0,
+		interrupted: false,
+		handled: [],
+		leftInPlace: 0,
+		failedLogicalIds: []
+	};
+	const inlinePolicyWriters = new RollbackInlinePolicyWriters();
+	const failedIds = total.failedLogicalIds;
+	const record = ctx.recordEvent;
+	const printing = journaledOrphanPrintingBag(orphans.segments.flatMap(({ ops, companions }) => [...companions ?? [], ...ops]), stateResources);
+	const maskedCtx = record === void 0 ? ctx : {
+		...ctx,
+		recordEvent: (event) => record(maskEventTextWithBoundBags(event))
+	};
+	for (const { segment, ops: orphanOps, companions } of orphans.segments) {
+		if (options.isInterrupted?.()) {
+			total.interrupted = true;
+			break;
+		}
+		const ops = [...companions ?? [], ...orphanOps];
+		const replay = () => withPrintingSecrets(printing, () => withStackName(stackName, () => replayFailedOperations(ops, stateResources, stackName, maskedCtx, {
+			emitEnvelope: false,
+			inlinePolicyWriters,
+			forDestroy: true,
+			...options.isInterrupted && { isInterrupted: options.isInterrupted }
+		})));
+		const result = segment.skipPrefix === void 0 ? await replay() : await withSkipPrefix(segment.skipPrefix, replay);
+		total.failures += result.failures;
+		total.warnings += result.warnings;
+		total.leftInPlace += result.leftInPlace;
+		const pending = new Set(result.remainingFailedOps);
+		for (const op of ops) if (!pending.has(op)) total.handled.push({
+			segment,
+			op
+		});
+		if (result.interrupted) {
+			total.interrupted = true;
+			break;
+		}
+		for (const op of orphanOps) if (pending.has(op)) failedIds.push(op.logicalId);
+	}
+	if (options.pointAtDrop !== false && failedIds.length > 0) {
+		ctx.logger.warn(safeMsg`${failedIds.length} resource(s) a failed deploy of stack ${displayIdent(stackName)} created ` + "could not be deleted (see above); the rollback journal, their only record, keeps them for a re-run.");
+		warnDropFailed(ctx.logger, stackName, ctx.region, failedIds);
+	}
+	return total;
+}
+async function settleJournaledOrphansOnSuccess(args) {
+	const { stateBackend, stackName, region, stateResources, newerOperations, ctx, logger } = args;
+	const stack = displayIdent(stackName);
+	const newerIds = newerOperations.map((op) => op.logicalId);
+	let orphans;
+	try {
+		orphans = await loadJournaledOrphans(stateBackend, stackName, region, args.rollbackOrphans, logger, {
+			newerOperations,
+			...args.deployRunId !== void 0 && { deployRunId: args.deployRunId },
+			unreadableOutcome: "the successful deploy removes the journal"
+		});
+	} catch (err) {
+		logger.warn(safeMsg`Could not act on the rollback journal of stack ${stack}: ${errorDetail(err)}. It is kept.`);
+		await markSuperseded(stateBackend, stackName, region, newerIds);
+		return {
+			unaddressed: 1,
+			keepJournal: true
+		};
+	}
+	if (orphans.count === 0) return {
+		unaddressed: 0,
+		keepJournal: false
+	};
+	const all = orphans.segments.flatMap(({ segment, ops }) => ops.map((op) => ({
+		segment,
+		op
+	})));
+	let kept = all;
+	let failedDeletes = [];
+	let leftInPlace = 0;
+	if (stateResources === void 0) logger.warn(safeMsg`The rollback journal of stack ${stack} records ${all.length} resource(s) a failed deploy ` + `created, but the stack's state cannot be read, so whether a record now owns them is unknown: none is deleted.`);
+	else {
+		logger.info(safeMsg`The rollback journal of stack ${stack} records ${all.length} resource(s) a failed deploy ` + `created that no state record holds; acting on them per their DeletionPolicy before the journal is removed:`);
+		for (const line of journaledOrphanLines(orphans, logger)) logger.info(line);
+		try {
+			const { unreadable, tracked } = await applySuccessRule(orphans, stateResources, orphans.deployLogicalIds ?? /* @__PURE__ */ new Set(), args.foreignHolder, stack, logger, args.isInterrupted, ctx);
+			const acting = {
+				segments: orphans.segments.map(({ segment, ops }) => ({
+					segment,
+					ops: ops.filter((op) => !unreadable.has(op) && !tracked.has(op))
+				})).filter(({ ops }) => ops.length > 0),
+				count: orphans.count - unreadable.size - tracked.size
+			};
+			const writtenThisRun = [...orphans.deployLogicalIds ?? []].filter((id) => Object.prototype.hasOwnProperty.call(stateResources, id)).map((id) => stateResources[id]).filter((r) => r !== void 0 && r !== null && typeof r === "object");
+			const outcome = await deleteJournaledOrphans(acting, { ...stateResources }, stackName, {
+				...ctx,
+				writtenThisRun
+			}, {
+				pointAtDrop: false,
+				...args.isInterrupted && { isInterrupted: args.isInterrupted }
+			});
+			leftInPlace = outcome.leftInPlace;
+			failedDeletes = outcome.failedLogicalIds;
+			kept = all.filter(({ segment, op }) => unreadable.has(op) || !tracked.has(op) && !isHandledOrphan(outcome.handled, segment, op));
+		} catch (err) {
+			logger.warn(safeMsg`Acting on the journaled resources of stack ${stack} failed: ${errorDetail(err)}`);
+		}
+	}
+	const keptOps = new Set(kept.map(({ op }) => op));
+	const skipped = all.filter(({ op }) => !keptOps.has(op) && op.physicalIdRecoveredFromError === false).length;
+	const clearedOrphans = all.filter(({ op }) => !keptOps.has(op));
+	const cleared = [...clearedOrphans, ...orphans.segments.flatMap(({ segment, companions }) => (companions ?? []).filter((c) => replacementNeverSwapped(c, clearedOrphans.filter((o) => o.segment === segment).map((o) => o.op))).map((op) => ({
+		segment,
+		op
+	})))];
+	const stripCleared = cleared.length === 0 ? void 0 : async () => {
+		try {
+			await stateBackend.dropRollbackJournalFailedOperations(stackName, region, (op, segment) => isHandledOrphan(cleared, segment, op));
+		} catch (err) {
+			logger.warn(safeMsg`Failed to remove the settled entries from the rollback journal of stack ${stack}: ` + safeMsg`${errorDetail(err)}. A cdkd rollback or cdkd destroy could act on them again; run a ` + "successful cdkd deploy of the stack first, which settles them again.");
+		}
+	};
+	if (kept.length === 0) return {
+		unaddressed: skipped + leftInPlace,
+		keepJournal: false,
+		...stripCleared && { stripCleared }
+	};
+	const keptIds = new Set(kept.map(({ op }) => op.logicalId));
+	const supersededIds = newerIds.filter((id) => !keptIds.has(id));
+	const demoted = kept.filter(({ op }) => op.physicalIdRecoveredFromError === false);
+	const reduce = () => stateBackend.reduceRollbackJournalToFailedOperations(stackName, region, (op, segment) => isHandledOrphan(kept, segment, op), supersededIds, (op, segment) => isHandledOrphan(demoted, segment, op));
+	let reduced = false;
+	for (let attempt = 0; attempt < 2 && !reduced; attempt++) try {
+		await reduce();
+		reduced = true;
+	} catch (err) {
+		if (attempt === 1) logger.warn(safeMsg`Failed to reduce the rollback journal of stack ${stack} to its undeleted resources: ` + safeMsg`${errorDetail(err)}. The whole journal is kept.`);
+	}
+	if (!reduced) {
+		await markSuperseded(stateBackend, stackName, region, supersededIds);
+		await stripCleared?.();
+	}
+	logger.warn(safeMsg`${kept.length} resource(s) a failed deploy of stack ${stack} created were not deleted ` + (reduced ? "(see above). The rollback journal, their only record, is kept with just them; the next " : "(see above). The rollback journal, their only record, is kept; the next ") + "successful deploy retries.");
+	warnDropFailed(logger, stackName, region, failedDeletes);
+	return {
+		unaddressed: kept.length + skipped + leftInPlace,
+		keepJournal: true
+	};
+}
+async function applySuccessRule(orphans, stateResources, deployLogicalIds, foreignHolder, stack, logger, isInterrupted, identityCtx) {
+	const unreadable = /* @__PURE__ */ new Set();
+	const tracked = /* @__PURE__ */ new Set();
+	let interrupted = false;
+	for (const { ops } of orphans.segments) for (const op of ops) {
+		if (op.physicalIdRecoveredFromError !== true || !op.physicalId) continue;
+		if (interrupted || isInterrupted?.()) {
+			interrupted = true;
+			unreadable.add(op);
+			continue;
+		}
+		const opId = op.physicalId;
+		if (Object.values(stateResources).some((r) => r?.resourceType === op.resourceType && typeof r.physicalId === "string" && samePhysicalId(op.resourceType, r.physicalId, opId))) {
+			tracked.add(op);
+			continue;
+		}
+		const hasRecord = Object.prototype.hasOwnProperty.call(stateResources, op.logicalId);
+		const record = hasRecord ? stateResources[op.logicalId] : void 0;
+		const recordUnderId = hasRecord && !isReplacedRecord(op, record);
+		if (recordUnderId || deployLogicalIds.has(op.logicalId)) {
+			const verdict = recordUnderId ? await recordIdentity(op, record, identityCtx, logger) : "unknown";
+			if (verdict === "same") {
+				tracked.add(op);
+				continue;
+			}
+			if (verdict !== "different") {
+				op.physicalIdRecoveredFromError = false;
+				continue;
+			}
+			markProvenDistinctFromRecord(op, record);
+		}
+		const holding = await foreignHolder(op.resourceType, op.physicalId);
+		if (holding === void 0) {
+			const created = await createdResourceStillThere(op, identityCtx);
+			if (created === "gone") {
+				logger.info(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is already gone: nothing to delete.`);
+				tracked.add(op);
+			} else if (created === "mismatch") {
+				logger.warn(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is not deleted: the resource now under its physical id is another ` + "one (its identity differs from the one that deploy recorded, so its name was reused).");
+				op.physicalIdRecoveredFromError = false;
+			} else if (created === "unproven") {
+				logger.warn(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is not deleted: nothing proves the resource now under its physical ` + "id is the one that deploy created (it may have been deleted and its name reused).");
+				op.physicalIdRecoveredFromError = false;
+			}
+			continue;
+		}
+		if (holding.kind === "held") {
+			logger.warn(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is not deleted: ${holding.by} holds a resource of that type under ` + "the same physical id.");
+			op.physicalIdRecoveredFromError = false;
+			continue;
+		}
+		logger.warn(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is not deleted: ${holding.what}, so whether another stack holds it is unknown.`);
+		unreadable.add(op);
+	}
+	return {
+		unreadable,
+		tracked
+	};
+}
+async function recordIdentity(op, record, ctx, logger) {
+	if (typeof record !== "object" || record === null || record.resourceType !== op.resourceType || typeof record.physicalId !== "string" || record.physicalId === "" || !op.physicalId) return "unknown";
+	try {
+		const { provider } = ctx.providerRegistry.getProviderFor({
+			resourceType: op.resourceType,
+			provisionedBy: op.provisionedBy
+		});
+		if (typeof provider.isSameResource !== "function") return "unknown";
+		return await provider.isSameResource(op.physicalId, {
+			physicalId: record.physicalId,
+			...record.provisionedBy !== void 0 && { provisionedBy: record.provisionedBy }
+		}, op.resourceType, { expectedRegion: ctx.region });
+	} catch (err) {
+		logger.debug(safeMsg`Could not compare ${logicalIdShown(op.logicalId)}'s journaled resource with its state record (${displaySafe(err instanceof Error ? err.name : typeof err)}).`);
+		return "unknown";
+	}
+}
+async function createdResourceStillThere(op, ctx) {
+	if (op.deletionPolicy === "Retain") return "proven";
+	if (!orphanDeleteNeedsIdentity(op.resourceType)) return "proven";
+	const physicalId = op.physicalId;
+	if (!physicalId) return "unproven";
+	const live = await readResourceIdentity(ctx.providerRegistry, {
+		resourceType: op.resourceType,
+		physicalId,
+		provisionedBy: op.provisionedBy
+	}, ctx.region);
+	if (live === RESOURCE_NOT_FOUND) return "gone";
+	const journaled = op.createdResourceIdentity;
+	if (typeof journaled !== "string" || journaled === "" || typeof live !== "string") return "unproven";
+	return live === journaled ? "proven" : "mismatch";
+}
+function makeForeignHolderScan(stateBackend) {
+	let scan;
+	const key = (type, id) => JSON.stringify([type, physicalIdKey(type, id)]);
+	const run = async () => {
+		const holders = /* @__PURE__ */ new Map();
+		let refs;
+		try {
+			refs = await stateBackend.listStacks();
+		} catch {
+			return {
+				holders,
+				unreadable: "the state bucket listing (it could not be read)"
+			};
+		}
+		let unreadable;
+		await Promise.all(refs.map(async (ref) => {
+			const named = (why) => safeMsg`the state record of stack ${displayIdent(ref.stackName)} (${why})`;
+			if (ref.region === void 0) {
+				unreadable ??= named("its region cannot be read");
+				return;
+			}
+			const region = ref.region;
+			let state;
+			try {
+				state = (await stateBackend.getState(ref.stackName, region))?.state;
+			} catch {
+				unreadable ??= named("it could not be read");
+				return;
+			}
+			if (state === void 0) return;
+			const resources = state.resources;
+			if (resources !== void 0 && (typeof resources !== "object" || resources === null || Array.isArray(resources))) {
+				unreadable ??= named("its resources cannot be read");
+				return;
+			}
+			if (!hasReadableOrphans(state) || unreadableOrphanRecords(state).length > 0) {
+				unreadable ??= named("its rollback-orphan records cannot be read");
+				return;
+			}
+			const held = [...Object.values(resources ?? {}), ...(state.orphans ?? []).map((record) => record.state)];
+			for (const record of held) {
+				const r = record;
+				if (typeof r?.resourceType !== "string" || typeof r.physicalId !== "string") continue;
+				const k = key(r.resourceType, r.physicalId);
+				const list = holders.get(k) ?? [];
+				list.push({
+					stackName: ref.stackName,
+					region
+				});
+				holders.set(k, list);
+			}
+		}));
+		return {
+			holders,
+			...unreadable !== void 0 && { unreadable }
+		};
+	};
+	return (self) => async (resourceType, physicalId) => {
+		scan ??= run();
+		const { holders, unreadable } = await scan;
+		const other = (holders.get(key(resourceType, physicalId)) ?? []).find((h) => !(h.stackName === self.stackName && h.region === self.region));
+		if (other) return {
+			kind: "held",
+			by: safeMsg`the state record of stack ${displayIdent(other.stackName)} (${displaySafe(other.region)})`
+		};
+		return unreadable === void 0 ? void 0 : {
+			kind: "unreadable",
+			what: unreadable
+		};
+	};
+}
+async function markSuperseded(stateBackend, stackName, region, ids) {
+	try {
+		await stateBackend.markRollbackJournalSuperseded(stackName, region, ids);
+	} catch {}
+}
+function errorDetail(err) {
+	return displaySafe(err instanceof Error ? err.message : String(err));
+}
+function isHandledOrphan(handled, segment, op) {
+	return handled.some((h) => h.segment.timestamp === segment.timestamp && h.segment.runId === segment.runId && h.op.logicalId === op.logicalId && h.op.changeType === op.changeType && h.op.resourceType === op.resourceType && h.op.physicalId === op.physicalId);
+}
+function orphanKey(segment, op) {
+	return JSON.stringify([
+		segment.timestamp,
+		segment.runId ?? null,
+		op.logicalId,
+		op.changeType,
+		op.resourceType,
+		op.physicalId ?? null
+	]);
+}
+function sameJournaledOrphans(a, b) {
+	const keys = (o) => o.segments.flatMap(({ segment, ops }) => ops.map((op) => orphanKey(segment, op))).sort();
+	const ka = keys(a);
+	const kb = keys(b);
+	return ka.length === kb.length && ka.every((k, i) => k === kb[i]);
+}
+
 //#endregion
 //#region src/provisioning/nested-stack-context.ts
 const storage$1 = new AsyncLocalStorage();
@@ -33417,7 +33899,7 @@ function getNestedRevertRun() {
 	return revertRunStorage.getStore();
 }
 function errorText(error) {
-	return displaySafe(error instanceof Error ? error.message : String(error));
+	return displaySafe(describeAwsFailure(error).detail);
 }
 function isPlainRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -33590,6 +34072,13 @@ async function revertNestedChildFromJournal(args) {
 			...ctx.options?.eventRecorder && { recordEvent: (event) => ctx.options.eventRecorder.record(maskEventTextWithBoundBags(event)) },
 			finalSnapshotClients: ctx.options?.finalSnapshotClients,
 			skipFinalSnapshot: ctx.options?.skipFinalSnapshot === true || ctx.destroyOptions?.skipFinalSnapshot === true,
+			...ctx.destroyOptions?.removeProtection === true && {
+				removeProtection: true,
+				foreignHolder: makeForeignHolderScan(ctx.stateBackend)({
+					stackName: childStackName,
+					region
+				})
+			},
 			importedProducerRegions: producerRegions.regions,
 			producerRegionsIncomplete: !producerRegions.complete,
 			nestedChildRevert: true
@@ -33674,7 +34163,7 @@ async function planOrphanAdoption(params) {
 			provider = params.getProvider(state.resourceType, state.provisionedBy);
 		} catch (error) {
 			outcome.remaining.push(record);
-			outcome.notices.push(`${shownId} (${shownType}) is still in AWS as ${shownPhysicalId} from an earlier rollback, but this build cannot route that type (${displayAwsMessage(error instanceof Error ? error.message : String(error))}) — cdkd is not adopting it.`);
+			outcome.notices.push(`${shownId} (${shownType}) is still in AWS as ${shownPhysicalId} from an earlier rollback, but this build cannot route that type (${displayAwsMessage(describeAwsFailure(error).detail)}) — cdkd is not adopting it.`);
 			continue;
 		}
 		if (!provider.import) {
@@ -33693,7 +34182,7 @@ async function planOrphanAdoption(params) {
 				knownPhysicalId: state.physicalId
 			});
 		} catch (error) {
-			outcome.notices.push(`${shownId} (${shownType}) is recorded as left in AWS as ${shownPhysicalId}, but cdkd could not confirm it exists (${displayAwsMessage(error instanceof Error ? error.message : String(error))}) — keeping the record and not adopting it this run.`);
+			outcome.notices.push(`${shownId} (${shownType}) is recorded as left in AWS as ${shownPhysicalId}, but cdkd could not confirm it exists (${displayAwsMessage(describeAwsFailure(error).detail)}) — keeping the record and not adopting it this run.`);
 			outcome.remaining.push(record);
 			continue;
 		}
@@ -33746,7 +34235,7 @@ function makeSiblingClaimReader(params) {
 		try {
 			refs = await stateBackend.listStacks();
 		} catch (error) {
-			logger.debug(`orphan adoption: could not list sibling stacks — ${displayAwsMessage(error instanceof Error ? error.message : String(error))}`);
+			logger.debug(`orphan adoption: could not list sibling stacks — ${displayAwsMessage(describeAwsFailure(error).detail)}`);
 			return claimed;
 		}
 		for (const ref of refs) {
@@ -33772,445 +34261,13 @@ function makeSiblingClaimReader(params) {
 					logger.debug(safeMsg`orphan adoption: ${displayStackName(ref.stackName)} holds ${unreadable.length} ` + safeMsg`resource record(s) with no readable physical id — ${named}` + safeMsg`${rest > 0 ? ` and ${rest} more` : ""} — skipped; the claim set is a lower ` + `bound without them`);
 				}
 			} catch (error) {
-				logger.debug(`orphan adoption: skipping unreadable state for ${displayStackName(ref.stackName)} — ${displayAwsMessage(error instanceof Error ? error.message : String(error))}`);
+				logger.debug(`orphan adoption: skipping unreadable state for ${displayStackName(ref.stackName)} — ${displayAwsMessage(describeAwsFailure(error).detail)}`);
 			}
 		}
 		return claimed;
 	};
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/journaled-orphans.ts
-const NONE = {
-	segments: [],
-	count: 0
-};
-async function loadJournaledOrphans(stateBackend, stackName, region, rollbackOrphans, logger, options = {}) {
-	let segments;
-	try {
-		const journal = await stateBackend.loadRollbackJournal(stackName, region);
-		if (!journal) return NONE;
-		segments = journal.segments;
-	} catch (err) {
-		const detail = err instanceof Error ? err.message : String(err);
-		logger.warn(safeMsg`Could not read the stack's rollback journal (${displaySafe(detail)}); ` + safeMsg`no resource it records for a failed CREATE is deleted, and ${options.unreadableOutcome ?? "a destroy that proceeds removes the journal with the state"}.`);
-		return {
-			...NONE,
-			unreadable: true
-		};
-	}
-	const physicalIdOnly = (ops) => ops.filter((op) => op.changeType !== "CREATE");
-	const evidence = segments.map((segment) => options.deployRunId !== void 0 && segment.reason === "nested-pending-parent" && segment.runId === options.deployRunId ? {
-		...segment,
-		operations: physicalIdOnly(segment.operations)
-	} : segment);
-	const newer = options.newerOperations ?? [];
-	if (newer.length > 0) evidence.push({ operations: physicalIdOnly(newer) });
-	demoteSupersededOrphans(evidence, Array.isArray(rollbackOrphans) ? rollbackOrphans : []);
-	const deployLogicalIds = new Set(newer.map((op) => op.logicalId));
-	for (const segment of segments) if (options.deployRunId !== void 0 && segment.reason === "nested-pending-parent" && segment.runId === options.deployRunId) for (const op of segment.operations) deployLogicalIds.add(op.logicalId);
-	const out = [];
-	let count = 0;
-	for (let s = segments.length - 1; s >= 0; s--) {
-		const segment = segments[s];
-		if (segment.reason === "nested-pending-parent") continue;
-		const replay = splitImportedOps(segment.failedOperations ?? [], segment).replay;
-		const ops = replay.filter(isJournaledOrphan);
-		if (ops.length === 0) continue;
-		const companions = replay.filter((op) => op.changeType === "UPDATE" && replacementNeverSwapped(op, ops));
-		out.push({
-			segment,
-			ops,
-			...companions.length > 0 && { companions }
-		});
-		count += ops.length;
-	}
-	return {
-		segments: out,
-		count,
-		deployLogicalIds
-	};
-}
-function journaledOrphanLines(orphans, logger) {
-	return orphans.segments.flatMap(({ ops }) => ops.map((op) => `  - ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)})  ${displacedPhysicalIdShown(op, logger) ?? "a physical id"}`));
-}
-function dropFailedCommands(stackName, region, logicalIds) {
-	const ids = [...new Set(logicalIds)];
-	if (ids.length === 0) return void 0;
-	const built = ids.map((id) => pasteableCommand("cdkd rollback", [
-		{
-			value: stackName,
-			hole: "stack",
-			opts: { plainIdent: true }
-		},
-		{
-			flag: "--stack-region",
-			value: region,
-			hole: "region",
-			opts: { plainIdent: true }
-		},
-		{
-			flag: "--drop-failed",
-			value: id,
-			hole: "logical-id",
-			opts: { plainIdent: true }
-		}
-	]));
-	const idWithheld = built.some((b) => b.withheld.some((w) => w.hole === "logical-id"));
-	return {
-		intro: `If cdkd can never delete ${ids.length === 1 ? "it" : "one of them"} (a cause you cannot fix), check the resource by hand, then drop just its rollback-journal entry; every other entry is kept.` + withheldTargetClause(built[0], "stack", "cdkd rollback", "This stack's name") + withheldTargetClause(built[0], "region", "cdkd rollback", "This stack's region") + (idWithheld ? " A logical id that is not a plain identifier is not named in the command below; read it from the stack's rollback-journal.json (next to its state.json)." : ""),
-		commands: built.map((b) => b.command)
-	};
-}
-function dropFailedHint(stackName, region, logicalIds) {
-	const hint = dropFailedCommands(stackName, region, logicalIds);
-	if (hint === void 0) return "";
-	return `\n${hint.intro}` + hint.commands.map((c) => `\nDrop with: ${c}`).join("");
-}
-function warnDropFailed(logger, stackName, region, logicalIds) {
-	const hint = dropFailedCommands(stackName, region, logicalIds);
-	if (hint === void 0) return;
-	logger.warn(safeMsg`${hint.intro}`);
-	for (const command of hint.commands) logger.warn(safeMsg`Drop with: ${command}`);
-}
-async function deleteJournaledOrphans(orphans, stateResources, stackName, ctx, options = {}) {
-	const total = {
-		failures: 0,
-		warnings: 0,
-		interrupted: false,
-		handled: [],
-		leftInPlace: 0,
-		failedLogicalIds: []
-	};
-	const inlinePolicyWriters = new RollbackInlinePolicyWriters();
-	const failedIds = total.failedLogicalIds;
-	const record = ctx.recordEvent;
-	const printing = journaledOrphanPrintingBag(orphans.segments.flatMap(({ ops, companions }) => [...companions ?? [], ...ops]), stateResources);
-	const maskedCtx = record === void 0 ? ctx : {
-		...ctx,
-		recordEvent: (event) => record(maskEventTextWithBoundBags(event))
-	};
-	for (const { segment, ops: orphanOps, companions } of orphans.segments) {
-		if (options.isInterrupted?.()) {
-			total.interrupted = true;
-			break;
-		}
-		const ops = [...companions ?? [], ...orphanOps];
-		const replay = () => withPrintingSecrets(printing, () => withStackName(stackName, () => replayFailedOperations(ops, stateResources, stackName, maskedCtx, {
-			emitEnvelope: false,
-			inlinePolicyWriters,
-			forDestroy: true,
-			...options.isInterrupted && { isInterrupted: options.isInterrupted }
-		})));
-		const result = segment.skipPrefix === void 0 ? await replay() : await withSkipPrefix(segment.skipPrefix, replay);
-		total.failures += result.failures;
-		total.warnings += result.warnings;
-		total.leftInPlace += result.leftInPlace;
-		const pending = new Set(result.remainingFailedOps);
-		for (const op of ops) if (!pending.has(op)) total.handled.push({
-			segment,
-			op
-		});
-		if (result.interrupted) {
-			total.interrupted = true;
-			break;
-		}
-		for (const op of orphanOps) if (pending.has(op)) failedIds.push(op.logicalId);
-	}
-	if (options.pointAtDrop !== false && failedIds.length > 0) {
-		ctx.logger.warn(safeMsg`${failedIds.length} resource(s) a failed deploy of stack ${displayIdent(stackName)} created ` + "could not be deleted (see above); the rollback journal, their only record, keeps them for a re-run.");
-		warnDropFailed(ctx.logger, stackName, ctx.region, failedIds);
-	}
-	return total;
-}
-async function settleJournaledOrphansOnSuccess(args) {
-	const { stateBackend, stackName, region, stateResources, newerOperations, ctx, logger } = args;
-	const stack = displayIdent(stackName);
-	const newerIds = newerOperations.map((op) => op.logicalId);
-	let orphans;
-	try {
-		orphans = await loadJournaledOrphans(stateBackend, stackName, region, args.rollbackOrphans, logger, {
-			newerOperations,
-			...args.deployRunId !== void 0 && { deployRunId: args.deployRunId },
-			unreadableOutcome: "the successful deploy removes the journal"
-		});
-	} catch (err) {
-		logger.warn(safeMsg`Could not act on the rollback journal of stack ${stack}: ${errorDetail(err)}. It is kept.`);
-		await markSuperseded(stateBackend, stackName, region, newerIds);
-		return {
-			unaddressed: 1,
-			keepJournal: true
-		};
-	}
-	if (orphans.count === 0) return {
-		unaddressed: 0,
-		keepJournal: false
-	};
-	const all = orphans.segments.flatMap(({ segment, ops }) => ops.map((op) => ({
-		segment,
-		op
-	})));
-	let kept = all;
-	let failedDeletes = [];
-	let leftInPlace = 0;
-	if (stateResources === void 0) logger.warn(safeMsg`The rollback journal of stack ${stack} records ${all.length} resource(s) a failed deploy ` + `created, but the stack's state cannot be read, so whether a record now owns them is unknown: none is deleted.`);
-	else {
-		logger.info(safeMsg`The rollback journal of stack ${stack} records ${all.length} resource(s) a failed deploy ` + `created that no state record holds; acting on them per their DeletionPolicy before the journal is removed:`);
-		for (const line of journaledOrphanLines(orphans, logger)) logger.info(line);
-		try {
-			const { unreadable, tracked } = await applySuccessRule(orphans, stateResources, orphans.deployLogicalIds ?? /* @__PURE__ */ new Set(), args.foreignHolder, stack, logger, args.isInterrupted, ctx);
-			const acting = {
-				segments: orphans.segments.map(({ segment, ops }) => ({
-					segment,
-					ops: ops.filter((op) => !unreadable.has(op) && !tracked.has(op))
-				})).filter(({ ops }) => ops.length > 0),
-				count: orphans.count - unreadable.size - tracked.size
-			};
-			const writtenThisRun = [...orphans.deployLogicalIds ?? []].filter((id) => Object.prototype.hasOwnProperty.call(stateResources, id)).map((id) => stateResources[id]).filter((r) => r !== void 0 && r !== null && typeof r === "object");
-			const outcome = await deleteJournaledOrphans(acting, { ...stateResources }, stackName, {
-				...ctx,
-				writtenThisRun
-			}, {
-				pointAtDrop: false,
-				...args.isInterrupted && { isInterrupted: args.isInterrupted }
-			});
-			leftInPlace = outcome.leftInPlace;
-			failedDeletes = outcome.failedLogicalIds;
-			kept = all.filter(({ segment, op }) => unreadable.has(op) || !tracked.has(op) && !isHandledOrphan(outcome.handled, segment, op));
-		} catch (err) {
-			logger.warn(safeMsg`Acting on the journaled resources of stack ${stack} failed: ${errorDetail(err)}`);
-		}
-	}
-	const keptOps = new Set(kept.map(({ op }) => op));
-	const skipped = all.filter(({ op }) => !keptOps.has(op) && op.physicalIdRecoveredFromError === false).length;
-	const clearedOrphans = all.filter(({ op }) => !keptOps.has(op));
-	const cleared = [...clearedOrphans, ...orphans.segments.flatMap(({ segment, companions }) => (companions ?? []).filter((c) => replacementNeverSwapped(c, clearedOrphans.filter((o) => o.segment === segment).map((o) => o.op))).map((op) => ({
-		segment,
-		op
-	})))];
-	const stripCleared = cleared.length === 0 ? void 0 : async () => {
-		try {
-			await stateBackend.dropRollbackJournalFailedOperations(stackName, region, (op, segment) => isHandledOrphan(cleared, segment, op));
-		} catch (err) {
-			logger.warn(safeMsg`Failed to remove the settled entries from the rollback journal of stack ${stack}: ` + safeMsg`${errorDetail(err)}. A cdkd rollback or cdkd destroy could act on them again; run a ` + "successful cdkd deploy of the stack first, which settles them again.");
-		}
-	};
-	if (kept.length === 0) return {
-		unaddressed: skipped + leftInPlace,
-		keepJournal: false,
-		...stripCleared && { stripCleared }
-	};
-	const keptIds = new Set(kept.map(({ op }) => op.logicalId));
-	const supersededIds = newerIds.filter((id) => !keptIds.has(id));
-	const demoted = kept.filter(({ op }) => op.physicalIdRecoveredFromError === false);
-	const reduce = () => stateBackend.reduceRollbackJournalToFailedOperations(stackName, region, (op, segment) => isHandledOrphan(kept, segment, op), supersededIds, (op, segment) => isHandledOrphan(demoted, segment, op));
-	let reduced = false;
-	for (let attempt = 0; attempt < 2 && !reduced; attempt++) try {
-		await reduce();
-		reduced = true;
-	} catch (err) {
-		if (attempt === 1) logger.warn(safeMsg`Failed to reduce the rollback journal of stack ${stack} to its undeleted resources: ` + safeMsg`${errorDetail(err)}. The whole journal is kept.`);
-	}
-	if (!reduced) {
-		await markSuperseded(stateBackend, stackName, region, supersededIds);
-		await stripCleared?.();
-	}
-	logger.warn(safeMsg`${kept.length} resource(s) a failed deploy of stack ${stack} created were not deleted ` + (reduced ? "(see above). The rollback journal, their only record, is kept with just them; the next " : "(see above). The rollback journal, their only record, is kept; the next ") + "successful deploy retries.");
-	warnDropFailed(logger, stackName, region, failedDeletes);
-	return {
-		unaddressed: kept.length + skipped + leftInPlace,
-		keepJournal: true
-	};
-}
-async function applySuccessRule(orphans, stateResources, deployLogicalIds, foreignHolder, stack, logger, isInterrupted, identityCtx) {
-	const unreadable = /* @__PURE__ */ new Set();
-	const tracked = /* @__PURE__ */ new Set();
-	let interrupted = false;
-	for (const { ops } of orphans.segments) for (const op of ops) {
-		if (op.physicalIdRecoveredFromError !== true || !op.physicalId) continue;
-		if (interrupted || isInterrupted?.()) {
-			interrupted = true;
-			unreadable.add(op);
-			continue;
-		}
-		if (Object.values(stateResources).some((r) => r?.resourceType === op.resourceType && r.physicalId === op.physicalId)) {
-			tracked.add(op);
-			continue;
-		}
-		const hasRecord = Object.prototype.hasOwnProperty.call(stateResources, op.logicalId);
-		const record = hasRecord ? stateResources[op.logicalId] : void 0;
-		const recordUnderId = hasRecord && !isReplacedRecord(op, record);
-		if (recordUnderId || deployLogicalIds.has(op.logicalId)) {
-			const verdict = recordUnderId ? await recordIdentity(op, record, identityCtx, logger) : "unknown";
-			if (verdict === "same") {
-				tracked.add(op);
-				continue;
-			}
-			if (verdict !== "different") {
-				op.physicalIdRecoveredFromError = false;
-				continue;
-			}
-			markProvenDistinctFromRecord(op, record);
-		}
-		const holding = await foreignHolder(op.resourceType, op.physicalId);
-		if (holding === void 0) {
-			const created = await createdResourceStillThere(op, identityCtx);
-			if (created === "gone") {
-				logger.info(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is already gone: nothing to delete.`);
-				tracked.add(op);
-			} else if (created === "mismatch") {
-				logger.warn(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is not deleted: the resource now under its physical id is another ` + "one (its identity differs from the one that deploy recorded, so its name was reused).");
-				op.physicalIdRecoveredFromError = false;
-			} else if (created === "unproven") {
-				logger.warn(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is not deleted: nothing proves the resource now under its physical ` + "id is the one that deploy created (it may have been deleted and its name reused).");
-				op.physicalIdRecoveredFromError = false;
-			}
-			continue;
-		}
-		if (holding.kind === "held") {
-			logger.warn(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is not deleted: ${holding.by} holds a resource of that type under ` + "the same physical id.");
-			op.physicalIdRecoveredFromError = false;
-			continue;
-		}
-		logger.warn(safeMsg`${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}), which a failed deploy ` + safeMsg`of stack ${stack} created, is not deleted: ${holding.what}, so whether another stack holds it is unknown.`);
-		unreadable.add(op);
-	}
-	return {
-		unreadable,
-		tracked
-	};
-}
-async function recordIdentity(op, record, ctx, logger) {
-	if (typeof record !== "object" || record === null || record.resourceType !== op.resourceType || typeof record.physicalId !== "string" || record.physicalId === "" || !op.physicalId) return "unknown";
-	try {
-		const { provider } = ctx.providerRegistry.getProviderFor({
-			resourceType: op.resourceType,
-			provisionedBy: op.provisionedBy
-		});
-		if (typeof provider.isSameResource !== "function") return "unknown";
-		return await provider.isSameResource(op.physicalId, {
-			physicalId: record.physicalId,
-			...record.provisionedBy !== void 0 && { provisionedBy: record.provisionedBy }
-		}, op.resourceType, { expectedRegion: ctx.region });
-	} catch (err) {
-		logger.debug(safeMsg`Could not compare ${logicalIdShown(op.logicalId)}'s journaled resource with its state record (${displaySafe(err instanceof Error ? err.name : typeof err)}).`);
-		return "unknown";
-	}
-}
-async function createdResourceStillThere(op, ctx) {
-	if (op.deletionPolicy === "Retain") return "proven";
-	if (!orphanDeleteNeedsIdentity(op.resourceType)) return "proven";
-	const physicalId = op.physicalId;
-	if (!physicalId) return "unproven";
-	const live = await readResourceIdentity(ctx.providerRegistry, {
-		resourceType: op.resourceType,
-		physicalId,
-		provisionedBy: op.provisionedBy
-	}, ctx.region);
-	if (live === RESOURCE_NOT_FOUND) return "gone";
-	const journaled = op.createdResourceIdentity;
-	if (typeof journaled !== "string" || journaled === "" || typeof live !== "string") return "unproven";
-	return live === journaled ? "proven" : "mismatch";
-}
-function makeForeignHolderScan(stateBackend) {
-	let scan;
-	const key = (type, id) => JSON.stringify([type, id]);
-	const run = async () => {
-		const holders = /* @__PURE__ */ new Map();
-		let refs;
-		try {
-			refs = await stateBackend.listStacks();
-		} catch {
-			return {
-				holders,
-				unreadable: "the state bucket listing (it could not be read)"
-			};
-		}
-		let unreadable;
-		await Promise.all(refs.map(async (ref) => {
-			const named = (why) => safeMsg`the state record of stack ${displayIdent(ref.stackName)} (${why})`;
-			if (ref.region === void 0) {
-				unreadable ??= named("its region cannot be read");
-				return;
-			}
-			const region = ref.region;
-			let state;
-			try {
-				state = (await stateBackend.getState(ref.stackName, region))?.state;
-			} catch {
-				unreadable ??= named("it could not be read");
-				return;
-			}
-			if (state === void 0) return;
-			const resources = state.resources;
-			if (resources !== void 0 && (typeof resources !== "object" || resources === null || Array.isArray(resources))) {
-				unreadable ??= named("its resources cannot be read");
-				return;
-			}
-			if (!hasReadableOrphans(state) || unreadableOrphanRecords(state).length > 0) {
-				unreadable ??= named("its rollback-orphan records cannot be read");
-				return;
-			}
-			const held = [...Object.values(resources ?? {}), ...(state.orphans ?? []).map((record) => record.state)];
-			for (const record of held) {
-				const r = record;
-				if (typeof r?.resourceType !== "string" || typeof r.physicalId !== "string") continue;
-				const k = key(r.resourceType, r.physicalId);
-				const list = holders.get(k) ?? [];
-				list.push({
-					stackName: ref.stackName,
-					region
-				});
-				holders.set(k, list);
-			}
-		}));
-		return {
-			holders,
-			...unreadable !== void 0 && { unreadable }
-		};
-	};
-	return (self) => async (resourceType, physicalId) => {
-		scan ??= run();
-		const { holders, unreadable } = await scan;
-		const other = (holders.get(key(resourceType, physicalId)) ?? []).find((h) => !(h.stackName === self.stackName && h.region === self.region));
-		if (other) return {
-			kind: "held",
-			by: safeMsg`the state record of stack ${displayIdent(other.stackName)} (${displaySafe(other.region)})`
-		};
-		return unreadable === void 0 ? void 0 : {
-			kind: "unreadable",
-			what: unreadable
-		};
-	};
-}
-async function markSuperseded(stateBackend, stackName, region, ids) {
-	try {
-		await stateBackend.markRollbackJournalSuperseded(stackName, region, ids);
-	} catch {}
-}
-function errorDetail(err) {
-	return displaySafe(err instanceof Error ? err.message : String(err));
-}
-function isHandledOrphan(handled, segment, op) {
-	return handled.some((h) => h.segment.timestamp === segment.timestamp && h.segment.runId === segment.runId && h.op.logicalId === op.logicalId && h.op.changeType === op.changeType && h.op.resourceType === op.resourceType && h.op.physicalId === op.physicalId);
-}
-function orphanKey(segment, op) {
-	return JSON.stringify([
-		segment.timestamp,
-		segment.runId ?? null,
-		op.logicalId,
-		op.changeType,
-		op.resourceType,
-		op.physicalId ?? null
-	]);
-}
-function sameJournaledOrphans(a, b) {
-	const keys = (o) => o.segments.flatMap(({ segment, ops }) => ops.map((op) => orphanKey(segment, op))).sort();
-	const ka = keys(a);
-	const kb = keys(b);
-	return ka.length === kb.length && ka.every((k, i) => k === kb[i]);
-}
-
 //#endregion
 //#region src/deployment/deploy-engine/rollback.ts
 function redactOperationsForJournal(operations) {
@@ -35755,8 +35812,8 @@ function buildResolverContext(base, stackName) {
 		...base.redactedAttributeReads && { redactedAttributeReads: base.redactedAttributeReads }
 	};
 }
-function printNestedStackReadsOnly(context, resourceType) {
-	if (resourceType === "AWS::CloudFormation::Stack") context.printingSecrets = /* @__PURE__ */ new Map();
+function printNestedStackReadsOnly(context, resourceType, rowPrintingRegistry) {
+	if (resourceType === "AWS::CloudFormation::Stack") context.printingSecrets = rowPrintingRegistry;
 }
 function getAttTargetOf(node) {
 	if (node === null || typeof node !== "object" || Array.isArray(node)) return void 0;
@@ -35824,7 +35881,7 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 	if (context.recordedSecretValues) this.perResourceSecrets.set(logicalId, context.recordedSecretValues);
 	const noEchoOverrides = await this.noEchoAttributeOverridesFor(desiredProps, stateResources, stackName);
 	if (noEchoOverrides !== void 0) context.noEchoAttributeOverrides = noEchoOverrides;
-	printNestedStackReadsOnly(context, resourceType);
+	printNestedStackReadsOnly(context, resourceType, this.secretNameBagFor(logicalId));
 	const resolvedProps = await this.resolver.resolve(desiredProps, context);
 	this.noteSecretNamedRecord(logicalId, {
 		resourceType,
@@ -36036,7 +36093,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	this.perResourceSecrets.set(logicalId, updateSecrets);
 	const noEchoOverrides = await this.noEchoAttributeOverridesFor(desiredProps, stateResources, stackName);
 	if (noEchoOverrides !== void 0) context.noEchoAttributeOverrides = noEchoOverrides;
-	printNestedStackReadsOnly(context, resourceType);
+	printNestedStackReadsOnly(context, resourceType, this.secretNameBagFor(logicalId));
 	const resolvedProps = await this.resolver.resolve(desiredProps, context);
 	this.noteSecretNamedRecord(logicalId, {
 		resourceType,
@@ -38156,7 +38213,7 @@ function hasOwn(bag, key) {
 	return Object.prototype.hasOwnProperty.call(bag, key);
 }
 function mergeNoChangeOutputs(input) {
-	const { persisted, resolved, declaredOutputs, previousExportNames, resolvedExportNames } = input;
+	const { persisted, resolved, declaredOutputs, previousExportNames, resolvedExportNames, refusesCarriedAlias } = input;
 	const failedKeys = Object.keys(resolved).filter((key) => resolved[key] === void 0);
 	const exportNameOf = (outputKey) => declaredOutputs !== void 0 && hasOwn(declaredOutputs, outputKey) ? declaredOutputs[outputKey]?.Export?.Name : void 0;
 	for (const outputKey of failedKeys) {
@@ -38173,15 +38230,26 @@ function mergeNoChangeOutputs(input) {
 	const addExport = (name) => {
 		exportNames.push(name);
 	};
+	const refusedAliases = [];
+	const carryAllowed = (outputKey, exportName) => {
+		const reason = refusesCarriedAlias(outputKey, exportName);
+		if (reason === void 0) return true;
+		refusedAliases.push({
+			outputKey,
+			exportName,
+			reason
+		});
+		return false;
+	};
 	for (const outputKey of failedKeys) {
 		const exportName = exportNameOf(outputKey);
 		if (hasOwn(persisted, outputKey)) {
 			outputs[outputKey] = persisted[outputKey];
 			carriedKeys.push(outputKey);
-			if (exportName === outputKey && previousExportNames.has(outputKey)) addExport(outputKey);
+			if (exportName === outputKey && previousExportNames.has(outputKey) && carryAllowed(outputKey, outputKey)) addExport(outputKey);
 		}
 		if (typeof exportName !== "string") continue;
-		if (previousExportNames.has(exportName) && hasOwn(persisted, exportName) && !hasOwn(resolved, exportName) && !hasOwn(outputs, exportName)) {
+		if (previousExportNames.has(exportName) && hasOwn(persisted, exportName) && !hasOwn(resolved, exportName) && !hasOwn(outputs, exportName) && carryAllowed(outputKey, exportName)) {
 			outputs[exportName] = persisted[exportName];
 			carriedKeys.push(exportName);
 			addExport(exportName);
@@ -38195,7 +38263,8 @@ function mergeNoChangeOutputs(input) {
 		kind: "merged",
 		outputs,
 		exportNames,
-		carriedKeys
+		carriedKeys,
+		refusedAliases
 	};
 }
 function keptWholeReasonText(reason) {
@@ -38891,7 +38960,8 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 					resolved: resolvedOutputs,
 					declaredOutputs: effectiveTemplate.Outputs,
 					previousExportNames: currentEffectiveExports,
-					resolvedExportNames: this.resolvedExportNames
+					resolvedExportNames: this.resolvedExportNames,
+					refusesCarriedAlias: (outputKey, exportName) => this.carriedExportAliasRefusal === void 0 ? "An export alias was not carried: no export-name verdict is available." : this.carriedExportAliasRefusal(outputKey, exportName)
 				}) : void 0;
 				if (merge?.kind === "merged") {
 					for (const key of merge.carriedKeys) Reflect.deleteProperty(this.outputsTemplateSource, key);
@@ -38901,6 +38971,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 					};
 				}
 				if (merge?.kind === "kept") this.outputsSourceUsable = false;
+				if (merge?.kind === "merged") for (const { reason } of merge.refusedAliases) this.logger.warn(reason);
 				const outputsToPersist = merge === void 0 ? resolvedOutputs : merge.kind === "merged" ? merge.outputs : persistedOutputs;
 				const exportNamesToPersist = merge === void 0 ? this.resolvedExportNames : merge.kind === "merged" ? merge.exportNames : void 0;
 				const outputsChanged = !outputMapsEqual(persistedOutputs, outputsToPersist);
@@ -39276,6 +39347,7 @@ var DeployEngine = class {
 	outputsPassSecretMaps = [];
 	outputsTemplateSource = Object.create(null);
 	resolvedExportNames = [];
+	carriedExportAliasRefusal;
 	skippedOutputs;
 	constructPathTemplate;
 	outputsSourceUsable = true;
@@ -39559,5 +39631,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { recordDisplacedSkips as $, noEchoLeavesOf as $a, refuseMalformedResourcesForDeploy as $i, withPrintingSecrets as $n, importableOutputs as $o, passedParameterClassesOf as $r, resolveStateBucketWithDefault as $s, secretNamePrintingBag as $t, gray as A, coerceCfnBoolean as Aa, resolveBucketRegion as Ac, malformedScrubResourceEntriesRefusalMessage as Ai, findDestructiveChanges as An, recordMaskOnlyValue as Ao, envCredentialsAreAssumedRole as Ar, formatDockerLoginError as As, removeProtectionTypeList as At, isHandledOrphan as B, prefetchCreateOnlyPropertyPaths as Ba, refuseMalformedOutputs as Bi, planTagDiff as Bn, isSingleDynamicReferenceToken as Bo, getAccountInfo as Br, escapeRegExp$3 as Bs, findNestedStackTypeChanges as Bt, recordedProtectionNote as C, isStatefulRecreateTargetSync as Ca, ownValue as Cc, malformedOrphansWarning as Ci, collectPublishedOutputNames as Cn, pathCrossesDottedKey as Co, assertSendableRoleArn as Cr, buildDockerImage as Cs, INDEX_SETTLE_POLL_INTERVAL_MS as Ct, createReadOnlyAttributeHealerFactory as D, isWarmThroughputDecrease as Da, renderAssemblyPathEscape as Dc, malformedResourceEntriesWarning as Di, DEFAULT_RESOURCE_WARN_AFTER_MS as Dn, identityKeyFor as Do, AWS_CREDENTIAL_ENV_KEYS as Dr, describeDockerFailure as Ds, S3_AUTO_DELETE_OBJECTS_TAG as Dt, formatResourceLine as E, coerceWarmThroughput as Ea, displayAssemblyPath as Ec, malformedRenderedContainersWarning as Ei, DEFAULT_RESOURCE_TIMEOUT_MS as En, recoverMaskedOutput as Eo, sendableAssumeRoleCommand as Er, describeDockerExecFailure as Es, ECR_AUTO_DELETE_IMAGES_TAG as Et, namesAnyDeclaredParameter as F, readConfigString as Fa, refuseMalformedOrphanRecords as Fi, reserveStackCreateToken as Fn, STATE_SOURCED_BASELINE_RULES as Fo, s3BucketRegionalDomainName as Fr, redactDockerArgvValues as Fs, isReplacementOrphan as Ft, makeSiblingClaimReader as G, lambdaFunctionNameForMask as Ga, refuseMalformedResourceEntriesForDestroy as Gi, definedAttributes as Gn, splitImportedOps as Go, keepsSecretReferenceToken as Gr, synthesisStatusMessage as Gs, redactedDeleteAddressFields as Gt, loadJournaledOrphans as H, describeTypeWithThrottleRetry as Ha, refuseMalformedResourceAttributesForOrphan as Hi, refuseMalformedDesiredTags as Hn, isLockInfoExpired as Ho, carriesDynamicReference as Hr, AssetManifestLoader as Hs, inheritProducerRegions as Ht, reachableDivergentParameters as I, replayWarn as Ia, refuseMalformedOrphanRecordsForDestroy as Ii, withCreateTokenLedger as In, STATE_SOURCED_CROSS_GENERATION_RULES as Io, s3BucketWebsiteUrl as Ir, redactedDockerCause as Is, planFailedOps as It, displacedOpClause as J, TemplateParser as Ja, refuseMalformedResourceEntriesForOrphan as Ji, ProviderRegistry as Jn, exportNamesCarriedFrom as Jo, isStalePlaceholderArnAttribute as Jr, loadCdkJson as Js, updatePartialReason as Jt, planOrphanAdoption as K, sameLambdaFunctionAddress as Ka, refuseMalformedResourceEntriesForImport as Ki, stringifyIfAssigned as Kn, acceptedCreateOnlyDropsOf as Ko, AWS_NO_VALUE as Kr, getDefaultStateBucketName as Ks, redactedDeleteAddressSkip as Kt, resourcesNamingDeclaredParameter as L, requireConfigArray as La, refuseMalformedOrphans as Li, acquireIdempotencyToken as Ln, STATE_SOURCED_READBACK_RULES as Lo, coerceParameterTypedValue as Lr, runDockerForeground as Ls, planRollback as Lt, red as M, configBooleanRefusal as Ma, previewableOrphanRecords as Mi, RollbackInlinePolicyWriters as Mn, recordNoEchoAttributeValues as Mo, s3BucketArn as Mr, isDockerClientEnvKey as Ms, recordAfterRollbackUpdate as Mt, yellow as N, configIntegerRefusal as Na, refuseDivergentRecordRegionForDestroy as Ni, earliestDefined as Nn, recordProvenPublicExpression as No, s3BucketDomainName as Nr, isMalformedEnvKey as Ns, demoteSupersededOrphans as Nt, bold as O, toCfnInteger as Oa, resolveAssemblyPath as Oc, malformedResourcePropertiesWarning as Oi, maskingRetryLogger as On, carriesSecretMask as Oo, applyCallerIdentityCredentials as Or, dockerSpawnEnvWithSensitive as Os, hasCdkAutoDeleteTag as Ot, computeParameterTaint as P, configStringRefusal as Pa, refuseMalformedNestedChildOutputs as Pi, ledgerForStack as Pn, wholeStringLeavesOf as Po, s3BucketDualStackDomainName as Pr, partitionSensitiveEnv as Ps, isJournaledOrphan as Pt, nestedChildStackName as Q, maskedLeafCoordinatesOf as Qa, refuseMalformedResourcePropertiesForOrphan as Qi, getCurrentResourceSecrets as Qn, importableOutputKeys as Qo, parameterInputsFor as Qr, resolveSkipPrefix as Qs, orphanRecordsPrintingBag as Qt, deleteJournaledOrphans as R, requireConfigObject as Ra, refuseMalformedOrphansForDestroy as Ri, DBPROXY_TAGS_WHAT as Rn, TEMPLATE_SOURCED_RULES as Ro, isUnboundTemplateParameter as Rr, runDockerStreaming as Rs, replacementNeverSwapped as Rt, recordedProtectionEvidence as S, isStatefulRecreateTargetForReplace as Sa, nullPrototypeRecord as Sc, malformedOrphansRefusalMessage as Si, collectDeclaredOutputNames as Sn, isUncertifiedBaselineMaskPosition as So, assertFlagRoleArn as Sr, buildDenyExternalAccessPolicy as Ss, DELETE_INDEX_WAIT_PROCEED_NOTE as St, markRefusedBeforeApplying as T, WARM_THROUGHPUT_MEMBERS as Ta, describeFileReadFailure as Tc, malformedOutputsWarning as Ti, bindingSkippedOutputs as Tn, recordNestedStackParameterExpressions as To, isIamRoleArn as Tr, describeDockerCapturedOutput as Ts, waitForIndexesSettled as Tt, makeForeignHolderScan as U, withRetry as Ua, refuseMalformedResourceEntries as Ui, tagMapAsList as Un, S3StateBackend as Uo, carriesFetchableDynamicReference as Ur, getDockerImageBySourceHash as Us, REDACTED_DELETE_ADDRESS_SKIP_REASON as Ut, journaledOrphanLines as V, templateResourceTypes as Va, refuseMalformedOutputsForDestroy as Vi, readTagList as Vn, LockManager as Vo, isImpossibleEmptyStoredAttribute as Vr, stripControlChars as Vs, getCurrentProducerRegions as Vt, sameJournaledOrphans as W, canonicalLambdaFunctionName as Wa, refuseMalformedResourceEntriesForDeploy as Wi, tagPlanWarning as Wn, rebuildClientForBucketRegion as Wo, isNamelessDynamicReferenceError as Wr, Synthesizer as Ws, isRedactedRecordedValue as Wt, dropSettledNestedJournals as X, maskReadbackAtCoordinates as Xa, refuseMalformedResourcePropertiesForDrift as Xi, wouldReturnToSdkProvider as Xn, hasReasonlessBaselineRefusal as Xo, parseWebACLArn as Xr, resolveAutoAssetStorage as Xs, journaledOrphanPrintingBag as Xt, displacedPhysicalIdShown as Y, isMarkedCoordinate as Ya, refuseMalformedResourcePropertiesForDestroy as Yi, ccBrokenReason as Yn, hasReadableExportSet as Yo, refStateLookupFromResource as Yr, resolveApp as Ys, completedReplayEntries as Yt, getNestedRevertRun as Z, maskWholeValue as Za, refuseMalformedResourcePropertiesForExport as Zi, isCustomResourceType as Zn, hasUnverifiableParameterRefusal as Zo, withSharedDrainBudget as Zr, resolveCaptureObservedState as Zs, maskEventTextWithBoundBags as Zt, makeCanonicalizePropertiesFn as _, NO_CC_HANDLERS_REASON as _a, StageLoadError as _c, malformedLocalResourceEntriesWarning as _i, secretBearingStateKeyWarning as _n, markSameGenerationBag as _o, IntrinsicFunctionResolver as _r, isCrossRegionRedirect as _s, beginDeleteWait as _t, findNestedTemplateTreeDefect as a, repairMalformedOutputsForReadOnly as aa, CFN_TEMPLATE_BODY_LIMIT as ac, accountArgs as ai, createPreDeleteFinalSnapshot as an, createUnionSecretMasker as ao, deleteSkipReason as ar, isSensitiveAttributeName as as, replayFailedOperations as at, noEchoParameterNamesOf as b, shownType as ba, hasOwnKey as bc, malformedOrphanRecordsWarning as bi, isWholeDynamicReferenceValue as bn, DYNAMIC_REFERENCE_TOKEN_SCAN as bo, regionLessSecretName as br, validateAssetBucketName as bs, resolveDynamoDbDeleteBudgetClock as bt, renderNestedTemplateTreeDefect as c, repairMalformedResourcesForReadOnly as ca, findLargeInlineResources as cc, hasReadableOrphans as ci, refusesFinalSnapshot as cn, logOnlyValueCount as co, markWaitAbandoned as cr, buildAssetRedirectMap as cs, destroyStackRecordsView as ct, conditionInputsFrom as d, unreadableResourceEntries as da, decodeListingKey as dc, isReadableOrphanRecord as di, DeploymentEventsStore as dn, recordLogOnlyValue as do, isTerminationProtectionPropagationError as dr, rewriteTemplateAssetReferences as ds, PROTECTION_PROPERTY_BY_TYPE as dt, refuseMalformedResourcesForDestroy as ea, resolveStateBucketWithDefaultAndSource as ec, JSON_LISTING_HOLE_VALUE as ei, stateSecretNameNeedles as en, noEchoOutputsComparison as eo, CloudControlProvider as er, isReadableBag as es, revertNestedChildFromJournal as et, parentSuppliedValues as f, withheldAccountClause as fa, expectedOwnerParam as fc, isReadableResourceEntry as fi, extractDeploymentEventError as fn, shareLogOnlyValues as fo, observeThenDisableInstanceApiTermination as fr, AssetModeResolver as fs, isProtectionValueActive as ft, mergeNoChangeOutputs as g, withoutSilentDropProperties as ga, AssemblyReader as gc, malformedLocalOutputsWarning as gi, secretBearing as gn, maskSecretsInText as go, INTRINSIC_KEYS as gr, getBootstrapMarkerKey as gs, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as gt, keptWholeReasonText as h, unwrittenCreateOnlyReplacement as ha, derivePartitionAndUrlSuffix as hc, malformedExportSourceWarning as hi, exportAliasCollisionScrubWarning as hn, maskSecretsInError as ho, DiffCalculator as hr, ensureAssetStorage as hs, DynamoDBGlobalTableProvider as ht, childTemplateLoader as i, repairMalformedOrphansForReadOnly as ia, ssmResolvedValueType as ic, UNREADABLE_RESOURCES_MAP_ROW as ii, ccRoutedFinalSnapshotError as in, carryLogOnlyValues as io, deleteIndeterminateGuards as ir, AssetPublisher as is, withNestedStackContext as it, green as j, coerceCfnInteger as ja, malformedStateRefusalMessage as ji, formatDestructiveChange as jn, recordMaskOnlyValuesIn as jo, isSettledInstanceState as jr, getDockerCmd as js, orphanDeleteNeedsIdentity as jt, cyan as k, toFiniteNumber as ka, clearBucketRegionCache as kc, malformedResourcesWarning as ki, constructPathOf as kn, provenPublicValue as ko, callerEnvCredentials as kr, finchSecretArgvRefusal as ks, isTruthyCfnBoolean as kt, templateIdentity as l, unpreviewableOrphanRecords as la, uploadCfnTemplate as lc, hasReadableOutputs as li, unsupportedFinalSnapshotError as ln, printingCorpusOf as lo, disableInstanceApiTermination as lr, createAssetRedirectResolver as ls, getStackRecords as lt, isSecretBearingReferenceString as m, findSilentDropProperties as ma, canonicalizeRegion as mc, malformedExportNamesWarning as mi, displayTextOrWithheld as mn, errorCauseChain as mo, reEnableInstanceApiTermination as mr, assertAssetBucketRegion as ms, readProtection as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedState as na, stateBucketExistenceConfirmed as nc, STATE_RESOURCES_MALFORMED as ni, PRE_DELETE_SNAPSHOT_TYPES as nn, readsNoEchoSource as no, unchangedBehindSecretReference as nr, orphansCarriedFrom as ns, withNestedRevertRun as nt, isAbsoluteAssetPath as o, repairMalformedResourceEntriesForReadOnly as oa, CFN_TEMPLATE_URL_LIMIT as oc, deployRefusesOrphanRowsReason as oi, effectiveDeletionPolicy as on, hasMaskableValues as oo, withIndeterminateGuard as or, stringifyValue as os, replayRollback as ot, readRecordedConditionVerdicts as p, findActionableSilentDrops as pa, PARTITION_TABLE as pc, malformedDriftResourcePropertiesWarning as pi, WITHHELD_NAME_DISPLAY as pn, createSecretMasker as po, reDisableInstanceApiTermination as pr, BOOTSTRAP_MARKER_PREFIX as ps, perType as pt, NESTED_PENDING_PARENT_REASON as q, DagBuilder as qa, refuseMalformedResourceEntriesForImportSave as qi, CC_BROKEN_REASON as qn, describeRegionValueKind as qo, cfnRefValueFromPhysicalId as qr, getLegacyStateBucketName as qs, updatePartialMessage as qt, computeImplicitDeleteEdges as r, repairMalformedOrphanRecordsForReadOnly as ra, warnDeprecatedNoPrefixCliFlag as rc, UNREADABLE_ORPHANS_CONTAINER_ROW as ri, buildFinalSnapshotIdentifier as rn, liveMatchesUnresolvedTokenFrame as ro, UNSPECIFIED_SKIP_REASON as rr, shouldRetainResource as rs, getCurrentNestedStackContext as rt, listNestedTemplateRows as s, repairMalformedResourcePropertiesForReadOnly as sa, MIGRATE_TMP_PREFIX as sc, displayLogicalId as si, isFinalSnapshotError as sn, literalSplitDelimitersOf as so, isWaitAbandonedError as sr, WorkGraph as ss, awaitInFlightSibling as st, DeployEngine as t, refuseMalformedResourcesForExport as ta, resolveUseCdkBootstrapAssets as tc, STATE_REGION_DIVERGED as ti, ATOMIC_FINAL_SNAPSHOT_TYPES as tn, passedNoEchoParametersOf as to, slowCcOperationTimeoutMs as tr, orphansAfterRollback as ts, revertedNestedRowIds as tt, conditionFingerprint as u, unreadableOrphanRecords as ua, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as uc, hasReadableResources as ui, DeploymentEventsReader as un, recordLogOnlyParameterValue as uo, ec2InstanceProtectionSite as ur, loadPublishableAssetManifest as us, withStackRecords as ut, noEchoAttributeNamesOf as v, hasNoCloudControlHandlers as va, processStackMessages as vc, malformedLocalResourcesWarning as vi, secretSafeKeyDisplay as vn, redactSecretsForState as vo, classifyReplaySecretRegion as vr, parseBootstrapMarker as vs, compensateRemovedDeletionProtection as vt, getPriorAttempts as w, renderStatefulReason as wa, absoluteAssemblyPathEscape as wc, malformedOutputsRefusalMessage as wi, isExportAliasCollision as wn, inheritNestedStackParameterAssociations as wo, explicitRoleArnOrThrow as wr, resolveDockerContextDirectory as ws, deleteTableWithIndexBusyRetry as wt, withResourceDeadline as x, MULTI_REGION_RECREATE_BLOCKED_TYPES as xa, hasPlainPrototype$1 as xc, malformedOrphanRowsKeptWarning as xi, noEchoParameterValueSeed as xn, dynamicReferenceTokens as xo, applyRoleArnIfSet as xr, validateContainerRepoName as xs, resolveDynamoDbDeleteBudgetMs as xt, noEchoComparisonForTemplate as y, findReplacedReadersOfRecreateTargets as ya, defineOwnKey as yc, malformedOrphanRecordsRefusalMessage as yi, exportNameSecretExposure as yn, scrubResourceRecord as yo, producerRegionsFromState as yr, readBootstrapMarkerBody as ys, deleteBudgetKey as yt, dropFailedHint as z, requireConfigString as za, refuseMalformedOrphansForOrphan as zi, DBPROXY_TAG_OPTIONS as zn, WHOLE_DYNAMIC_REFERENCE_PATTERN as zo, parameterTypeMayLoseSecretIdentity as zr, warnFinchArgvExposure as zs, resolveReplacementOldType as zt };
-//# sourceMappingURL=deploy-engine-FDsHckZR.js.map
+export { dropFailedHint as $, maskReadbackAtCoordinates as $a, refuseMalformedResourcePropertiesForDrift as $i, wouldReturnToSdkProvider as $n, hasReasonlessBaselineRefusal as $o, parseWebACLArn as $r, resolveAutoAssetStorage as $s, secretNamePrintingBag as $t, gray as A, isWarmThroughputDecrease as Aa, renderAssemblyPathEscape as Ac, malformedResourceEntriesWarning as Ai, maskingRetryLogger as An, identityKeyFor as Ao, AWS_CREDENTIAL_ENV_KEYS as Ar, describeDockerFailure as As, removeProtectionTypeList as At, NESTED_PENDING_PARENT_REASON as B, requireConfigArray as Ba, refuseMalformedOrphans as Bi, DBPROXY_TAGS_WHAT as Bn, STATE_SOURCED_READBACK_RULES as Bo, coerceParameterTypedValue as Br, runDockerForeground as Bs, findNestedStackTypeChanges as Bt, recordedProtectionNote as C, shownType as Ca, hasOwnKey as Cc, malformedOrphanRecordsWarning as Ci, noEchoParameterValueSeed as Cn, DYNAMIC_REFERENCE_TOKEN_SCAN as Co, regionLessSecretName as Cr, validateAssetBucketName as Cs, INDEX_SETTLE_POLL_INTERVAL_MS as Ct, createReadOnlyAttributeHealerFactory as D, renderStatefulReason as Da, absoluteAssemblyPathEscape as Dc, malformedOutputsRefusalMessage as Di, bindingSkippedOutputs as Dn, inheritNestedStackParameterAssociations as Do, explicitRoleArnOrThrow as Dr, resolveDockerContextDirectory as Ds, S3_AUTO_DELETE_OBJECTS_TAG as Dt, formatResourceLine as E, isStatefulRecreateTargetSync as Ea, ownValue as Ec, malformedOrphansWarning as Ei, isExportAliasCollision as En, pathCrossesDottedKey as Eo, assertSendableRoleArn as Er, buildDockerImage as Es, ECR_AUTO_DELETE_IMAGES_TAG as Et, namesAnyDeclaredParameter as F, configBooleanRefusal as Fa, previewableOrphanRecords as Fi, earliestDefined as Fn, recordNoEchoAttributeValues as Fo, s3BucketArn as Fr, isDockerClientEnvKey as Fs, isReplacementOrphan as Ft, nestedChildStackName as G, describeTypeWithThrottleRetry as Ga, refuseMalformedResourceAttributesForOrphan as Gi, tagMapAsList as Gn, isLockInfoExpired as Go, carriesDynamicReference as Gr, AssetManifestLoader as Gs, redactedDeleteAddressFields as Gt, displacedPhysicalIdShown as H, requireConfigString as Ha, refuseMalformedOrphansForOrphan as Hi, planTagDiff as Hn, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ho, parameterTypeMayLoseSecretIdentity as Hr, warnFinchArgvExposure as Hs, inheritProducerRegions as Ht, reachableDivergentParameters as I, configIntegerRefusal as Ia, refuseDivergentRecordRegionForDestroy as Ii, ledgerForStack as In, recordProvenPublicExpression as Io, s3BucketDomainName as Ir, isMalformedEnvKey as Is, planFailedOps as It, revertedNestedRowIds as J, lambdaFunctionNameForMask as Ja, refuseMalformedResourceEntriesForDestroy as Ji, stringifyIfAssigned as Jn, splitImportedOps as Jo, keepsSecretReferenceToken as Jr, synthesisStatusMessage as Js, updatePartialReason as Jt, recordDisplacedSkips as K, withRetry as Ka, refuseMalformedResourceEntries as Ki, tagPlanWarning as Kn, S3StateBackend as Ko, carriesFetchableDynamicReference as Kr, getDockerImageBySourceHash as Ks, redactedDeleteAddressSkip as Kt, resourcesNamingDeclaredParameter as L, configStringRefusal as La, refuseMalformedNestedChildOutputs as Li, reserveStackCreateToken as Ln, wholeStringLeavesOf as Lo, s3BucketDualStackDomainName as Lr, partitionSensitiveEnv as Ls, planRollback as Lt, red as M, toFiniteNumber as Ma, clearBucketRegionCache as Mc, malformedResourcesWarning as Mi, findDestructiveChanges as Mn, provenPublicValue as Mo, callerEnvCredentials as Mr, finchSecretArgvRefusal as Ms, recordAfterRollbackUpdate as Mt, yellow as N, coerceCfnBoolean as Na, resolveBucketRegion as Nc, malformedScrubResourceEntriesRefusalMessage as Ni, formatDestructiveChange as Nn, recordMaskOnlyValue as No, envCredentialsAreAssumedRole as Nr, formatDockerLoginError as Ns, demoteSupersededOrphans as Nt, bold as O, WARM_THROUGHPUT_MEMBERS as Oa, describeFileReadFailure as Oc, malformedOutputsWarning as Oi, DEFAULT_RESOURCE_TIMEOUT_MS as On, recordNestedStackParameterExpressions as Oo, isIamRoleArn as Or, describeDockerCapturedOutput as Os, hasCdkAutoDeleteTag as Ot, computeParameterTaint as P, coerceCfnInteger as Pa, malformedStateRefusalMessage as Pi, RollbackInlinePolicyWriters as Pn, recordMaskOnlyValuesIn as Po, isSettledInstanceState as Pr, getDockerCmd as Ps, isJournaledOrphan as Pt, deleteJournaledOrphans as Q, isMarkedCoordinate as Qa, refuseMalformedResourcePropertiesForDestroy as Qi, isCustomResource as Qn, hasReadableExportSet as Qo, refStateLookupFromResource as Qr, resolveApp as Qs, orphanRecordsPrintingBag as Qt, makeSiblingClaimReader as R, readConfigString as Ra, refuseMalformedOrphanRecords as Ri, withCreateTokenLedger as Rn, STATE_SOURCED_BASELINE_RULES as Ro, s3BucketRegionalDomainName as Rr, redactDockerArgvValues as Rs, replacementNeverSwapped as Rt, recordedProtectionEvidence as S, findReplacedReadersOfRecreateTargets as Sa, defineOwnKey as Sc, malformedOrphanRecordsRefusalMessage as Si, isWholeDynamicReferenceValue as Sn, scrubResourceRecord as So, producerRegionsFromState as Sr, readBootstrapMarkerBody as Ss, DELETE_INDEX_WAIT_PROCEED_NOTE as St, markRefusedBeforeApplying as T, isStatefulRecreateTargetForReplace as Ta, nullPrototypeRecord as Tc, malformedOrphansRefusalMessage as Ti, collectPublishedOutputNames as Tn, isUncertifiedBaselineMaskPosition as To, assertFlagRoleArn as Tr, buildDenyExternalAccessPolicy as Ts, waitForIndexesSettled as Tt, dropSettledNestedJournals as U, prefetchCreateOnlyPropertyPaths as Ua, refuseMalformedOutputs as Ui, readTagList as Un, isSingleDynamicReferenceToken as Uo, getAccountInfo as Ur, escapeRegExp$3 as Us, REDACTED_DELETE_ADDRESS_SKIP_REASON as Ut, displacedOpClause as V, requireConfigObject as Va, refuseMalformedOrphansForDestroy as Vi, DBPROXY_TAG_OPTIONS as Vn, TEMPLATE_SOURCED_RULES as Vo, isUnboundTemplateParameter as Vr, runDockerStreaming as Vs, getCurrentProducerRegions as Vt, getNestedRevertRun as W, templateResourceTypes as Wa, refuseMalformedOutputsForDestroy as Wi, refuseMalformedDesiredTags as Wn, LockManager as Wo, isImpossibleEmptyStoredAttribute as Wr, stripControlChars as Ws, isRedactedRecordedValue as Wt, getCurrentNestedStackContext as X, DagBuilder as Xa, refuseMalformedResourceEntriesForImportSave as Xi, ProviderRegistry as Xn, describeRegionValueKind as Xo, cfnRefValueFromPhysicalId as Xr, getLegacyStateBucketName as Xs, journaledOrphanPrintingBag as Xt, withNestedRevertRun as Y, sameLambdaFunctionAddress as Ya, refuseMalformedResourceEntriesForImport as Yi, CC_BROKEN_REASON as Yn, acceptedCreateOnlyDropsOf as Yo, AWS_NO_VALUE as Yr, getDefaultStateBucketName as Ys, completedReplayEntries as Yt, withNestedStackContext as Z, TemplateParser as Za, refuseMalformedResourceEntriesForOrphan as Zi, ccBrokenReason as Zn, exportNamesCarriedFrom as Zo, isStalePlaceholderArnAttribute as Zr, loadCdkJson as Zs, maskEventTextWithBoundBags as Zt, makeCanonicalizePropertiesFn as _, findSilentDropProperties as _a, canonicalizeRegion as _c, malformedExportNamesWarning as _i, secretBearingStateKeyWarning as _n, errorCauseChain as _o, reEnableInstanceApiTermination as _r, assertAssetBucketRegion as _s, beginDeleteWait as _t, findNestedTemplateTreeDefect as a, refuseMalformedState as aa, stateBucketExistenceConfirmed as ac, STATE_RESOURCES_MALFORMED as ai, createPreDeleteFinalSnapshot as an, readsNoEchoSource as ao, unchangedBehindSecretReference as ar, orphansCarriedFrom as as, replayFailedOperations as at, noEchoParameterNamesOf as b, NO_CC_HANDLERS_REASON as ba, StageLoadError as bc, malformedLocalResourceEntriesWarning as bi, exportNameNoEchoParameters as bn, markSameGenerationBag as bo, IntrinsicFunctionResolver as br, isCrossRegionRedirect as bs, resolveDynamoDbDeleteBudgetClock as bt, renderNestedTemplateTreeDefect as c, repairMalformedOutputsForReadOnly as ca, CFN_TEMPLATE_BODY_LIMIT as cc, accountArgs as ci, refusesFinalSnapshot as cn, createUnionSecretMasker as co, deleteSkipReason as cr, isSensitiveAttributeName as cs, destroyStackRecordsView as ct, conditionInputsFrom as d, repairMalformedResourcesForReadOnly as da, findLargeInlineResources as dc, hasReadableOrphans as di, DeploymentEventsStore as dn, logOnlyValueCount as do, markWaitAbandoned as dr, buildAssetRedirectMap as ds, PROTECTION_PROPERTY_BY_TYPE as dt, refuseMalformedResourcePropertiesForExport as ea, resolveCaptureObservedState as ec, withSharedDrainBudget as ei, stateSecretNameNeedles as en, maskWholeValue as eo, isCustomResourceType as er, hasUnverifiableParameterRefusal as es, isHandledOrphan as et, parentSuppliedValues as f, unpreviewableOrphanRecords as fa, uploadCfnTemplate as fc, hasReadableOutputs as fi, extractDeploymentEventError as fn, printingCorpusOf as fo, disableInstanceApiTermination as fr, createAssetRedirectResolver as fs, isProtectionValueActive as ft, mergeNoChangeOutputs as g, findActionableSilentDrops as ga, PARTITION_TABLE as gc, malformedDriftResourcePropertiesWarning as gi, secretBearing as gn, createSecretMasker as go, reDisableInstanceApiTermination as gr, BOOTSTRAP_MARKER_PREFIX as gs, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as gt, keptWholeReasonText as h, withheldAccountClause as ha, expectedOwnerParam as hc, isReadableResourceEntry as hi, exportAliasCollisionScrubWarning as hn, shareLogOnlyValues as ho, observeThenDisableInstanceApiTermination as hr, AssetModeResolver as hs, DynamoDBGlobalTableProvider as ht, childTemplateLoader as i, refuseMalformedResourcesForExport as ia, resolveUseCdkBootstrapAssets as ic, STATE_REGION_DIVERGED as ii, ccRoutedFinalSnapshotError as in, passedNoEchoParametersOf as io, slowCcOperationTimeoutMs as ir, orphansAfterRollback as is, sameJournaledOrphans as it, green as j, toCfnInteger as ja, resolveAssemblyPath as jc, malformedResourcePropertiesWarning as ji, constructPathOf as jn, carriesSecretMask as jo, applyCallerIdentityCredentials as jr, dockerSpawnEnvWithSensitive as js, orphanDeleteNeedsIdentity as jt, cyan as k, coerceWarmThroughput as ka, displayAssemblyPath as kc, malformedRenderedContainersWarning as ki, DEFAULT_RESOURCE_WARN_AFTER_MS as kn, recoverMaskedOutput as ko, sendableAssumeRoleCommand as kr, describeDockerExecFailure as ks, isTruthyCfnBoolean as kt, templateIdentity as l, repairMalformedResourceEntriesForReadOnly as la, CFN_TEMPLATE_URL_LIMIT as lc, deployRefusesOrphanRowsReason as li, unsupportedFinalSnapshotError as ln, hasMaskableValues as lo, withIndeterminateGuard as lr, stringifyValue as ls, getStackRecords as lt, isSecretBearingReferenceString as m, unreadableResourceEntries as ma, decodeListingKey as mc, isReadableOrphanRecord as mi, displayTextOrWithheld as mn, recordLogOnlyValue as mo, isTerminationProtectionPropagationError as mr, rewriteTemplateAssetReferences as ms, readProtection as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedResourcesForDeploy as na, resolveStateBucketWithDefault as nc, passedParameterClassesOf as ni, PRE_DELETE_SNAPSHOT_TYPES as nn, noEchoLeavesOf as no, withPrintingSecrets as nr, importableOutputs as ns, loadJournaledOrphans as nt, isAbsoluteAssetPath as o, repairMalformedOrphanRecordsForReadOnly as oa, warnDeprecatedNoPrefixCliFlag as oc, UNREADABLE_ORPHANS_CONTAINER_ROW as oi, effectiveDeletionPolicy as on, liveMatchesUnresolvedTokenFrame as oo, UNSPECIFIED_SKIP_REASON as or, shouldRetainResource as os, replayRollback as ot, readRecordedConditionVerdicts as p, unreadableOrphanRecords as pa, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as pc, hasReadableResources as pi, WITHHELD_NAME_DISPLAY as pn, recordLogOnlyParameterValue as po, ec2InstanceProtectionSite as pr, loadPublishableAssetManifest as ps, perType as pt, revertNestedChildFromJournal as q, canonicalLambdaFunctionName as qa, refuseMalformedResourceEntriesForDeploy as qi, definedAttributes as qn, rebuildClientForBucketRegion as qo, isNamelessDynamicReferenceError as qr, Synthesizer as qs, updatePartialMessage as qt, computeImplicitDeleteEdges as r, refuseMalformedResourcesForDestroy as ra, resolveStateBucketWithDefaultAndSource as rc, JSON_LISTING_HOLE_VALUE as ri, buildFinalSnapshotIdentifier as rn, noEchoOutputsComparison as ro, CloudControlProvider as rr, isReadableBag as rs, makeForeignHolderScan as rt, listNestedTemplateRows as s, repairMalformedOrphansForReadOnly as sa, ssmResolvedValueType as sc, UNREADABLE_RESOURCES_MAP_ROW as si, isFinalSnapshotError as sn, carryLogOnlyValues as so, deleteIndeterminateGuards as sr, AssetPublisher as ss, awaitInFlightSibling as st, DeployEngine as t, refuseMalformedResourcePropertiesForOrphan as ta, resolveSkipPrefix as tc, parameterInputsFor as ti, ATOMIC_FINAL_SNAPSHOT_TYPES as tn, maskedLeafCoordinatesOf as to, getCurrentResourceSecrets as tr, importableOutputKeys as ts, journaledOrphanLines as tt, conditionFingerprint as u, repairMalformedResourcePropertiesForReadOnly as ua, MIGRATE_TMP_PREFIX as uc, displayLogicalId as ui, DeploymentEventsReader as un, literalSplitDelimitersOf as uo, isWaitAbandonedError as ur, WorkGraph as us, withStackRecords as ut, noEchoAttributeNamesOf as v, unwrittenCreateOnlyReplacement as va, derivePartitionAndUrlSuffix as vc, malformedExportSourceWarning as vi, secretSafeKeyDisplay as vn, maskSecretsInError as vo, DiffCalculator as vr, ensureAssetStorage as vs, compensateRemovedDeletionProtection as vt, getPriorAttempts as w, MULTI_REGION_RECREATE_BLOCKED_TYPES as wa, hasPlainPrototype$1 as wc, malformedOrphanRowsKeptWarning as wi, collectDeclaredOutputNames as wn, dynamicReferenceTokens as wo, applyRoleArnIfSet as wr, validateContainerRepoName as ws, deleteTableWithIndexBusyRetry as wt, withResourceDeadline as x, hasNoCloudControlHandlers as xa, processStackMessages as xc, malformedLocalResourcesWarning as xi, exportNameSecretExposure as xn, redactSecretsForState as xo, classifyReplaySecretRegion as xr, parseBootstrapMarker as xs, resolveDynamoDbDeleteBudgetMs as xt, noEchoComparisonForTemplate as y, withoutSilentDropProperties as ya, AssemblyReader as yc, malformedLocalOutputsWarning as yi, carriedExportAliasExposure as yn, maskSecretsInText as yo, INTRINSIC_KEYS as yr, getBootstrapMarkerKey as ys, deleteBudgetKey as yt, planOrphanAdoption as z, replayWarn as za, refuseMalformedOrphanRecordsForDestroy as zi, acquireIdempotencyToken as zn, STATE_SOURCED_CROSS_GENERATION_RULES as zo, s3BucketWebsiteUrl as zr, redactedDockerCause as zs, resolveReplacementOldType as zt };
+//# sourceMappingURL=deploy-engine-CjLZZzyn.js.map