@go-to-k/cdkd 0.296.21 → 0.296.23

package/dist/{deploy-engine-CFgNpsEy.js → deploy-engine-B0TGnXSs.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js"
 import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
 import { $ as protectedReplacementAdvice, $n as isIamPropagationError, $t as AccountIdUnavailableError, A as isQuotableImportValue, An as commandHole, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bt as sanitizeRecoveryValue, Ct as RETRY_AUXILIARY_OWNER, Dn as SHELL_ACTIVE, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as plainOrDescribed, G as runDeleteAttempt, Gn as isNameCooldownError, H as observeThenDisableProtection, Hn as isUpdateUnsupportedError, Ht as DEFAULT_STATE_PREFIX, In as quotedOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jt as withPasteableAwsProfile, Kn as isRecreateRetryableError, Kt as producerRecordKey, L as ProtectionFlipRegistry, Ln as shellBoundedDisplay, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mn as isInertUnquoted, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as pasteableCommand, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE_WHY, Ot as hasCreatedBeforeFailure, Pn as physicalIdShownBesideCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, R as compensateProtectionFlip, Rn as shellQuote, Rt as formatLockOperation, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Un as hasReplayMayCollide, Ut as injectiveKey, Vt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Wn as isNameCollisionErrorFrom, Xn as formatRetryClassificationSignals, Xt as ambientCredentialConfig, Yn as markReplayMayCollide, Yt as ambientClientDefaults, Zn as isAmbiguousCcHandlerErrorCode, Zt as clientDefaultsFor, _n as ResourceUpdateNotSupportedError, _t as createMaskedLogSinks, ar as isThrottlingError, at as startInterruptWatch, bn as StateError, bt as maskDeep, cr as wrapMaskedAwsError, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as MacroExpansionError, en as AssetError, er as isRetryableTransientError, f as removalWarning, fn as MalformedProducerRecordRefusalError, ft as logicalIdShown, gn as ResourceTimeoutError, gt as stateOrphanRecordRemedy, hn as ProvisioningError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as DependencyError, ir as isMarkedNonRetryable, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, kn as UNSHOWABLE_VALUE, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, m as withoutInjectedRemovals, mt as resourceTypeShown, nr as retryClassificationText, on as DynamicReferenceRegionAmbiguousError, or as markNonRetryable, ot as ElapsedBudgetRegistry, qn as isReplayedNameCollisionFrom, rn as CrossAccountSecretRefusalError, sn as IntrinsicResolutionRefusalError, sr as markRedactedCause, st as monotonicNowMs, tn as CdkdError, tr as isTransientServerError, un as LockError, ut as compositeIdSeparatorRefusal, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as normalizeAwsError, wt as carryCreatedBeforeFailure, xn as SynthesisError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as withheldTargetClause, zt as formatLockOwner } from "./iam-policy-targets-BoZuWtxK.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-_h48bvqX.js";
+import { t as getCdkdVersion } from "./version-DqZBOzXK.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -22952,7 +22952,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-D5_Zlj5T.js");
+			const { ASGProvider } = await import("./asg-provider-CJ_0sDJ0.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -23058,7 +23058,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-CE85wFCg.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DGI_r9C8.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-B9-Nsiua.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-eboBIa2N.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -24259,7 +24259,7 @@ const CR_NO_SERVICE_TOKEN_SKIP_REASON = "no ServiceToken in state — Delete han
 const CR_MASKED_SERVICE_TOKEN_SKIP_REASON = "masked ServiceToken in state — Delete handler not invoked";
 const CR_NOECHO_PROPERTIES_SKIP_REASON = "NoEcho mask in recorded properties — Delete handler not invoked";
 const CR_MASKED_PROPERTIES_SKIP_REASON = "redaction mask in properties — Delete handler not invoked";
-const NOECHO_RERESOLUTION_BOUND = "cdkd re-resolves such a coordinate only where it holds the template ('cdkd destroy' with the app), and only while today's template reads a NoEcho parameter there with the property's text and inputs unchanged; an attribute a producer declared NoEcho has no template value to re-resolve.";
+const NOECHO_RERESOLUTION_BOUND = "cdkd re-resolves such a coordinate only where it holds the template ('cdkd destroy' with the app, or 'cdkd deploy --recreate-via-cc-api' naming this resource), and only while today's template reads a NoEcho parameter there with the property's text and inputs unchanged; an attribute a producer declared NoEcho has no template value to re-resolve.";
 function noEchoPropertiesRemedy(context, logicalId) {
 	return context?.stackDestroy === true ? `cdkd is KEEPING the state record and the run exits non-zero, and every re-run skips it again. Tear down what the handler manages by hand, then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}.` : "This delete is not part of a stack destroy (a 'cdkd deploy' template removal, replacement or rollback, or a 'cdkd rollback'). For a resource removed from the template the record is KEPT and every 'cdkd deploy' skips it again: tear down what the handler manages by hand. " + crDeploySkipTail(logicalId);
 }
@@ -29788,6 +29788,93 @@ function renderNestedStackTypeChangeRefusal(typeChanges, stackName) {
 	return `Refusing to deploy ${stackName}: ` + (typeChanges.length === 1 ? `a resource changes its Type ` : `${typeChanges.length} resources change their Type `) + `into or out of ${NESTED_STACK_RESOURCE_TYPE}, which cdkd does not replace in place (issue #2668).\n${rows.join("\n")}\n  Deploy this as two changes instead: give the new resource a DIFFERENT logical id (in CDK, rename the construct) so the existing row is deleted through its own type's provider and the new one is created under its own — or remove the resource in one deploy and add its replacement in the next. There is no flag that overrides this refusal.`;
 }
 
+//#endregion
+//#region src/deployment/rollback-executor/orphan-identity.ts
+const UNIQUE_PHYSICAL_ID_TYPES = /* @__PURE__ */ new Set([
+	"AWS::EC2::VPC",
+	"AWS::EC2::Subnet",
+	"AWS::EC2::EIP",
+	"AWS::EC2::NatGateway",
+	"AWS::EC2::SecurityGroup",
+	"AWS::EC2::Instance",
+	"AWS::EFS::FileSystem",
+	"AWS::EFS::MountTarget",
+	"AWS::FSx::FileSystem",
+	"AWS::KMS::Key",
+	"AWS::CertificateManager::Certificate",
+	"AWS::ElasticLoadBalancingV2::LoadBalancer",
+	"AWS::ElasticLoadBalancingV2::TargetGroup",
+	"AWS::ElasticLoadBalancingV2::Listener",
+	"AWS::EMR::Cluster",
+	"AWS::EMR::InstanceGroupConfig",
+	"AWS::EMR::InstanceFleetConfig",
+	"AWS::Cognito::UserPool",
+	"AWS::Route53::HostedZone",
+	"AWS::ServiceDiscovery::PrivateDnsNamespace",
+	"AWS::ServiceDiscovery::PublicDnsNamespace",
+	"AWS::ServiceDiscovery::HttpNamespace",
+	"AWS::ServiceDiscovery::Service",
+	"AWS::AppSync::GraphQLApi",
+	"AWS::IAM::AccessKey",
+	"AWS::Kinesis::StreamConsumer"
+]);
+const CONTENT_COMPARED_DELETE_TYPES = /* @__PURE__ */ new Set(["AWS::SQS::QueuePolicy", "AWS::SNS::TopicPolicy"]);
+const CDKD_NAMESPACE_ID_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::Stack"]);
+function orphanDeleteNeedsIdentity(resourceType) {
+	return !UNIQUE_PHYSICAL_ID_TYPES.has(resourceType) && !CONTENT_COMPARED_DELETE_TYPES.has(resourceType) && !CDKD_NAMESPACE_ID_TYPES.has(resourceType);
+}
+const RESOURCE_IDENTITY_TIMEOUT_MS = 1e4;
+async function readResourceIdentity(providerRegistry, target, region, timeoutMs = RESOURCE_IDENTITY_TIMEOUT_MS) {
+	let timer;
+	const timedOut = new Promise((resolve) => {
+		timer = setTimeout(() => resolve(void 0), timeoutMs);
+	});
+	try {
+		return await Promise.race([askResourceIdentity(providerRegistry, target, region), timedOut]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+async function askResourceIdentity(providerRegistry, target, region) {
+	try {
+		const { provider } = providerRegistry.getProviderFor({
+			resourceType: target.resourceType,
+			provisionedBy: target.provisionedBy
+		});
+		if (typeof provider.resourceIdentity !== "function") return void 0;
+		const identity = await provider.resourceIdentity(target.physicalId, target.resourceType, { expectedRegion: region });
+		if (identity === RESOURCE_NOT_FOUND) return RESOURCE_NOT_FOUND;
+		return typeof identity === "string" && identity !== "" ? identity : void 0;
+	} catch {
+		return;
+	}
+}
+async function createdResourceStillThere(op, ctx) {
+	if (op.deletionPolicy === "Retain") return "proven";
+	if (!orphanDeleteNeedsIdentity(op.resourceType)) return "proven";
+	const physicalId = op.physicalId;
+	if (!physicalId) return "unproven";
+	const live = await readResourceIdentity(ctx.providerRegistry, {
+		resourceType: op.resourceType,
+		physicalId,
+		provisionedBy: op.provisionedBy
+	}, ctx.region);
+	if (live === RESOURCE_NOT_FOUND) return "gone";
+	const journaled = op.createdResourceIdentity;
+	if (typeof journaled !== "string" || journaled === "" || typeof live !== "string") return "unproven";
+	return live === journaled ? "proven" : "mismatch";
+}
+async function askForeignHolder(foreignHolder, op) {
+	try {
+		return await foreignHolder(op.resourceType, op.physicalId);
+	} catch {
+		return {
+			kind: "unreadable",
+			what: "the other stacks' state records (the scan failed)"
+		};
+	}
+}
+
 //#endregion
 //#region src/deployment/rollback-executor/plan.ts
 function journaledOldTypes(op) {
@@ -29989,6 +30076,61 @@ function planFailedOps(failedOps, stateResources) {
 		effectiveProvisionedBy: effectiveProvisionedBy(failedOpOwnRecord(op, stateResources), op.provisionedBy)
 	}));
 }
+const undecidedAtPreview = /* @__PURE__ */ new WeakSet();
+async function recheckMismatchedFailedCreate(op, action, stateResources, siblings, ctx, timeoutMs = RESOURCE_IDENTITY_TIMEOUT_MS, preview = false) {
+	if (preview && action === "skip-failed-mismatch") {
+		const rechecked = await recheckMismatchedFailedCreate(op, action, stateResources, siblings, ctx, timeoutMs);
+		if (rechecked === action) undecidedAtPreview.add(op);
+		return rechecked;
+	}
+	if (action !== "skip-failed-mismatch" || op.changeType !== "CREATE" || op.physicalIdRecoveredFromError !== true || typeof op.physicalId !== "string" || op.physicalId === "") return action;
+	const record = Object.hasOwn(stateResources, op.logicalId) ? stateResources[op.logicalId] : void 0;
+	if (record === void 0 || record.resourceType !== op.resourceType || typeof record.physicalId !== "string" || record.physicalId === "") return action;
+	if (undecidedAtPreview.has(op)) return action;
+	const journaledId = op.physicalId;
+	const ask = async () => {
+		try {
+			const { provider } = ctx.providerRegistry.getProviderFor({
+				resourceType: op.resourceType,
+				provisionedBy: op.provisionedBy
+			});
+			if (typeof provider.isSameResource !== "function") return "unknown";
+			return await provider.isSameResource(journaledId, {
+				physicalId: record.physicalId,
+				...record.provisionedBy !== void 0 && { provisionedBy: record.provisionedBy }
+			}, op.resourceType, { expectedRegion: ctx.region });
+		} catch (error) {
+			ctx.logger?.debug(safeMsg`Re-check of the kept orphan ${shownLogicalId(op.logicalId)} failed (${error instanceof Error ? error.name : typeof error}); keeping the skip`);
+			return "unknown";
+		}
+	};
+	let timer;
+	const timedOut = new Promise((resolve) => {
+		timer = setTimeout(() => resolve("unknown"), timeoutMs);
+	});
+	let verdict;
+	try {
+		verdict = await Promise.race([ask(), timedOut]);
+	} finally {
+		clearTimeout(timer);
+	}
+	if (verdict !== "different") return action;
+	markProvenDistinctFromRecord(op, record);
+	return classifyFailedOp(op, stateResources, siblings);
+}
+async function recheckFailedPlan(plan, stateResources, ctx, timeoutMs = RESOURCE_IDENTITY_TIMEOUT_MS) {
+	const failedOps = plan.map((item) => item.op);
+	const out = [];
+	for (const item of plan) {
+		const action = await recheckMismatchedFailedCreate(item.op, item.action, stateResources, failedOps, ctx, timeoutMs, true);
+		out.push(action === item.action ? item : {
+			...item,
+			action,
+			effectiveProvisionedBy: effectiveProvisionedBy(failedOpOwnRecord(item.op, stateResources), item.op.provisionedBy)
+		});
+	}
+	return out;
+}
 function planRollback(operations, stateResources, orphanLogicalIds = /* @__PURE__ */ new Set()) {
 	const { createOps, otherOps } = partitionOps(operations);
 	return [...[...otherOps].reverse(), ...sortRollbackCreates(createOps, stateResources)].map((op) => {
@@ -30667,93 +30809,6 @@ async function deleteMarkedRecreate(error, s) {
 	return false;
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/orphan-identity.ts
-const UNIQUE_PHYSICAL_ID_TYPES = /* @__PURE__ */ new Set([
-	"AWS::EC2::VPC",
-	"AWS::EC2::Subnet",
-	"AWS::EC2::EIP",
-	"AWS::EC2::NatGateway",
-	"AWS::EC2::SecurityGroup",
-	"AWS::EC2::Instance",
-	"AWS::EFS::FileSystem",
-	"AWS::EFS::MountTarget",
-	"AWS::FSx::FileSystem",
-	"AWS::KMS::Key",
-	"AWS::CertificateManager::Certificate",
-	"AWS::ElasticLoadBalancingV2::LoadBalancer",
-	"AWS::ElasticLoadBalancingV2::TargetGroup",
-	"AWS::ElasticLoadBalancingV2::Listener",
-	"AWS::EMR::Cluster",
-	"AWS::EMR::InstanceGroupConfig",
-	"AWS::EMR::InstanceFleetConfig",
-	"AWS::Cognito::UserPool",
-	"AWS::Route53::HostedZone",
-	"AWS::ServiceDiscovery::PrivateDnsNamespace",
-	"AWS::ServiceDiscovery::PublicDnsNamespace",
-	"AWS::ServiceDiscovery::HttpNamespace",
-	"AWS::ServiceDiscovery::Service",
-	"AWS::AppSync::GraphQLApi",
-	"AWS::IAM::AccessKey",
-	"AWS::Kinesis::StreamConsumer"
-]);
-const CONTENT_COMPARED_DELETE_TYPES = /* @__PURE__ */ new Set(["AWS::SQS::QueuePolicy", "AWS::SNS::TopicPolicy"]);
-const CDKD_NAMESPACE_ID_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::Stack"]);
-function orphanDeleteNeedsIdentity(resourceType) {
-	return !UNIQUE_PHYSICAL_ID_TYPES.has(resourceType) && !CONTENT_COMPARED_DELETE_TYPES.has(resourceType) && !CDKD_NAMESPACE_ID_TYPES.has(resourceType);
-}
-const RESOURCE_IDENTITY_TIMEOUT_MS = 1e4;
-async function readResourceIdentity(providerRegistry, target, region, timeoutMs = RESOURCE_IDENTITY_TIMEOUT_MS) {
-	let timer;
-	const timedOut = new Promise((resolve) => {
-		timer = setTimeout(() => resolve(void 0), timeoutMs);
-	});
-	try {
-		return await Promise.race([askResourceIdentity(providerRegistry, target, region), timedOut]);
-	} finally {
-		clearTimeout(timer);
-	}
-}
-async function askResourceIdentity(providerRegistry, target, region) {
-	try {
-		const { provider } = providerRegistry.getProviderFor({
-			resourceType: target.resourceType,
-			provisionedBy: target.provisionedBy
-		});
-		if (typeof provider.resourceIdentity !== "function") return void 0;
-		const identity = await provider.resourceIdentity(target.physicalId, target.resourceType, { expectedRegion: region });
-		if (identity === RESOURCE_NOT_FOUND) return RESOURCE_NOT_FOUND;
-		return typeof identity === "string" && identity !== "" ? identity : void 0;
-	} catch {
-		return;
-	}
-}
-async function createdResourceStillThere(op, ctx) {
-	if (op.deletionPolicy === "Retain") return "proven";
-	if (!orphanDeleteNeedsIdentity(op.resourceType)) return "proven";
-	const physicalId = op.physicalId;
-	if (!physicalId) return "unproven";
-	const live = await readResourceIdentity(ctx.providerRegistry, {
-		resourceType: op.resourceType,
-		physicalId,
-		provisionedBy: op.provisionedBy
-	}, ctx.region);
-	if (live === RESOURCE_NOT_FOUND) return "gone";
-	const journaled = op.createdResourceIdentity;
-	if (typeof journaled !== "string" || journaled === "" || typeof live !== "string") return "unproven";
-	return live === journaled ? "proven" : "mismatch";
-}
-async function askForeignHolder(foreignHolder, op) {
-	try {
-		return await foreignHolder(op.resourceType, op.physicalId);
-	} catch {
-		return {
-			kind: "unreadable",
-			what: "the other stacks' state records (the scan failed)"
-		};
-	}
-}
-
 //#endregion
 //#region src/provisioning/remove-protection-types.ts
 const SDK_REMOVE_PROTECTION_TYPES = [
@@ -31002,7 +31057,13 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 			break;
 		}
 		const op = failedOps[i];
-		const action = classifyFailedOp(op, stateResources, failedOps);
+		const classified = classifyFailedOp(op, stateResources, failedOps);
+		const action = ctx.foreignHolder === void 0 ? classified : await recheckMismatchedFailedCreate(op, classified, stateResources, failedOps, ctx);
+		if (classified === "skip-failed-mismatch" && options.isInterrupted?.()) {
+			result.interrupted = true;
+			for (let j = i; j >= 0; j--) pending.add(failedOps[j]);
+			break;
+		}
 		const secrets = /* @__PURE__ */ new Map();
 		const opMasker = createOpMasker(logger, secrets);
 		const mask = opMasker.mask;
@@ -37136,6 +37197,115 @@ function isNoEchoPromotionOnly(change) {
 	return change.changeType === "UPDATE" && (change.attributeChanges?.length ?? 0) === 0 && (change.propertyChanges?.length ?? 0) > 0 && change.propertyChanges.every((pc) => pc.noEchoPromoted === true);
 }
 
+//#endregion
+//#region src/deployment/custom-resource-service-token.ts
+const SERVICE_TOKEN_CHANGE_REFUSED = "CUSTOM_RESOURCE_SERVICE_TOKEN_CHANGED";
+function uncomparableToken(value) {
+	if (value === void 0 || value === null || value === "") return "absent";
+	if (typeof value !== "string") return "not-a-string";
+	if (value.includes("***")) return "masked";
+	if (dynamicReferenceTokens(value).length > 0) return "reference";
+}
+const SERVICE_TOKEN = "ServiceToken";
+function serviceTokenChange(change) {
+	return change.propertyChanges?.find((pc) => pc.path === SERVICE_TOKEN);
+}
+function isSynthetic(pc) {
+	return pc.replacementPropagated === true || pc.inPlacePropagated === true || pc.noEchoPromoted === true;
+}
+function isUnmovedPromotion(pc) {
+	return pc.noEchoPromoted === true || pc.inPlacePropagated === true;
+}
+function diffMovedServiceToken(change) {
+	const pc = serviceTokenChange(change);
+	return pc !== void 0 && !isUnmovedPromotion(pc);
+}
+function findServiceTokenRefusals(input) {
+	const refused = [];
+	const deferred = [];
+	for (const [logicalId, change] of input.changes) {
+		if (change.changeType !== "UPDATE" || !isCustomResourceType(change.resourceType)) continue;
+		if (!Object.hasOwn(input.stateResources, logicalId)) continue;
+		const record = input.stateResources[logicalId];
+		if (record === void 0 || record.resourceType !== change.resourceType) continue;
+		if (input.recreateTargetIds?.has(logicalId) === true) continue;
+		const pc = serviceTokenChange(change);
+		if (pc === void 0) continue;
+		const recordedToken = record.properties?.[SERVICE_TOKEN];
+		const recordedProblem = uncomparableToken(recordedToken);
+		if (recordedProblem !== void 0) {
+			if (isUnmovedPromotion(pc)) continue;
+			refused.push({
+				logicalId,
+				resourceType: change.resourceType,
+				kind: "unjudgeable",
+				recorded: recordedProblem
+			});
+			continue;
+		}
+		const desired = pc.newValue;
+		if (!isSynthetic(pc) && uncomparableToken(desired) === void 0) {
+			if (desired !== recordedToken) refused.push({
+				logicalId,
+				resourceType: change.resourceType,
+				kind: "changed",
+				desired
+			});
+			continue;
+		}
+		if (pc.replacementPropagated === true || pc.inPlacePropagated === true && pc.noEchoPromoted !== true || desired !== null && typeof desired === "object" && !isSynthetic(pc)) deferred.push({
+			logicalId,
+			resourceType: change.resourceType
+		});
+	}
+	return {
+		refused,
+		deferred
+	};
+}
+function serviceTokenUpdateRefusal(input) {
+	if (!isCustomResourceType(input.resourceType) || input.recordedType !== input.resourceType) return;
+	const recordedProblem = uncomparableToken(input.recorded);
+	if (recordedProblem !== void 0) return input.diffSawTokenChange ? {
+		logicalId: input.logicalId,
+		resourceType: input.resourceType,
+		kind: "unjudgeable",
+		recorded: recordedProblem
+	} : void 0;
+	if (uncomparableToken(input.desired) !== void 0) return void 0;
+	if (input.desired === input.recorded) return void 0;
+	return {
+		logicalId: input.logicalId,
+		resourceType: input.resourceType,
+		kind: "changed",
+		desired: input.desired
+	};
+}
+const UNCOMPARABLE_TEXT = {
+	absent: "missing",
+	masked: `the redaction mask '${"***"}'`,
+	reference: "a '{{resolve:...}}' dynamic reference",
+	"not-a-string": "not a string"
+};
+function rowText(refusal, mask) {
+	const id = displayIdent(refusal.logicalId);
+	if (refusal.kind === "changed") return `${id}: ServiceToken changes to ${displayIdent(mask(refusal.desired))}, away from the handler its record names.`;
+	return `${id}: its recorded ServiceToken is ${UNCOMPARABLE_TEXT[refusal.recorded]}, so cdkd cannot tell whether this deploy changes it.`;
+}
+const REMEDY = "To move a custom resource to a different handler, give it a new logical id (in CDK, a new construct id, or overrideLogicalId on its CfnResource): the deploy then creates the new resource through the new handler and deletes the old one through its old handler. To keep the existing resource, deploy its previous ServiceToken.";
+const UNJUDGEABLE_REMEDY = `Where the recorded ServiceToken is unreadable and the handler did not change, put the ARN of the handler that created this resource (the one it was last deployed with, not the one the template names now) back as ServiceToken in state.json (a ServiceToken fed by a NoEcho parameter is recorded only as '${"***"}': feed it from a plain value) and re-deploy.`;
+function renderServiceTokenRefusal(refusals, stackName, mask = (text) => text) {
+	const rows = refusals.map((refusal) => `  - ${rowText(refusal, mask)}`);
+	return `Refusing to deploy ${stackName}: ` + (refusals.length === 1 ? `a custom resource's ServiceToken changes` : `${refusals.length} custom resources' ServiceTokens change`) + `, which CloudFormation does not allow ("Modifying service token is not allowed") (issue #4749). Nothing was sent to either handler.
+${rows.join("\n")}\n  ${REMEDY}` + (refusals.some((refusal) => refusal.kind === "unjudgeable") ? `\n  ${UNJUDGEABLE_REMEDY}` : "");
+}
+function serviceTokenBlockingReason(refusal, mask) {
+	return `${rowText(refusal, mask)} cdkd deploy refuses a changed custom-resource ServiceToken, as CloudFormation does (issue #4749); give the custom resource a new logical id to move it to another handler.`;
+}
+function deferredServiceTokenWarning(row) {
+	return `${displayIdent(row.logicalId)}: its ServiceToken reads a resource this deploy replaces, creates or updates, or a value this preview cannot resolve. If it resolves to a different ARN than the one recorded, cdkd deploy refuses the update before invoking any handler and rolls back (issue #4749). A replaced backing function is already deleted by then and the rollback re-creates it; if that fails, the record names a function that no longer exists.`;
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/update.ts
 function isWhollyMask(value) {
@@ -37587,6 +37757,15 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		updateSecrets,
 		lostWithParent
 	}));
+	const serviceTokenRefusal = serviceTokenUpdateRefusal({
+		logicalId,
+		resourceType,
+		recordedType: currentResource.resourceType,
+		recorded: currentResource.properties?.["ServiceToken"],
+		desired: resolvedProps["ServiceToken"],
+		diffSawTokenChange: diffMovedServiceToken(change)
+	});
+	if (serviceTokenRefusal !== void 0) throw markRefusedBeforeApplying(markNonRetryable(new CdkdError(renderServiceTokenRefusal([serviceTokenRefusal], stackName, createSecretMasker(updateSecrets)), SERVICE_TOKEN_CHANGE_REFUSED)));
 	return markRestored(await this.updateInPlace({
 		conditions,
 		counts,
@@ -39733,6 +39912,15 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			stateResources: currentState.resources
 		});
 		if (nestedStackTypeChanges.length > 0) throw markNonRetryable(new CdkdError(renderNestedStackTypeChangeRefusal(nestedStackTypeChanges, stackName), "TYPE_CHANGE_NESTED_STACK"));
+		const serviceTokenRefusals = findServiceTokenRefusals({
+			changes,
+			stateResources: currentState.resources,
+			recreateTargetIds: recreateTargetIdsFor(this.options.recreateTargets, stackName)
+		}).refused;
+		if (serviceTokenRefusals.length > 0) {
+			const mask = this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues);
+			throw markNonRetryable(new CdkdError(renderServiceTokenRefusal(serviceTokenRefusals, stackName, mask), SERVICE_TOKEN_CHANGE_REFUSED));
+		}
 		const recreatePromotion = promoteRecreateTargets(changes, this.options.recreateTargets, stackName);
 		for (const id of recreatePromotion.promoted) this.logger.debug(safeMsg`UPDATE (recreate target): ${id} has no template change; recreating it as requested`);
 		for (const { logicalId, flag, changeType } of recreatePromotion.unreached) this.logger.warn(changeType === void 0 ? safeMsg`${flag} ${logicalId}: not recreated, this deploy has no such resource.` : safeMsg`${flag} ${logicalId}: not recreated, this deploy will ${changeType.toLowerCase()} it instead.`);
@@ -40433,5 +40621,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { computeParameterTaint as $, DagBuilder as $a, refuseMalformedResourceEntriesForImportSave as $i, wouldReturnToSdkProvider as $n, describeRegionValueKind as $o, cfnRefValueFromPhysicalId as $r, getLegacyStateBucketName as $s, secretNamePrintingBag as $t, beginDeleteWait as A, renderStatefulReason as Aa, absoluteAssemblyPathEscape as Ac, malformedOutputsRefusalMessage as Ai, maskingRetryLogger as An, identityKeyFor as Ao, explicitRoleArnOrThrow as Ar, resolveDockerContextDirectory as As, removeProtectionTypeList as At, S3_AUTO_DELETE_OBJECTS_TAG as B, configStringRefusal as Ba, refuseMalformedNestedChildOutputs as Bi, DBPROXY_TAGS_WHAT as Bn, wholeStringLeavesOf as Bo, s3BucketDualStackDomainName as Br, partitionSensitiveEnv as Bs, findNestedStackTypeChanges as Bt, recordedProtectionNote as C, NO_CC_HANDLERS_REASON as Ca, StageLoadError as Cc, malformedLocalResourceEntriesWarning as Ci, noEchoParameterValueSeed as Cn, markSameGenerationBag as Co, poisonRenderedSpellingsCollidingIn as Cr, isCrossRegionRedirect as Cs, sameJournaledOrphans as Ct, readProtection as D, MULTI_REGION_RECREATE_BLOCKED_TYPES as Da, hasPlainPrototype$1 as Dc, malformedOrphanRowsKeptWarning as Di, bindingSkippedOutputs as Dn, dynamicReferenceTokens as Do, applyRoleArnIfSet as Dr, validateContainerRepoName as Ds, destroyStackRecordsView as Dt, perType as E, shownType as Ea, hasOwnKey as Ec, malformedOrphanRecordsWarning as Ei, isExportAliasCollision as En, DYNAMIC_REFERENCE_TOKEN_SCAN as Eo, regionLessSecretName as Er, validateAssetBucketName as Es, awaitInFlightSibling as Et, DELETE_INDEX_WAIT_PROCEED_NOTE as F, toFiniteNumber as Fa, clearBucketRegionCache as Fc, malformedResourcesWarning as Fi, earliestDefined as Fn, provenPublicValue as Fo, callerEnvCredentials as Fr, finchSecretArgvRefusal as Fs, isReplacementOrphan as Ft, formatResourceLine as G, requireConfigString as Ga, refuseMalformedOrphansForOrphan as Gi, tagMapAsList as Gn, WHOLE_DYNAMIC_REFERENCE_PATTERN as Go, parameterTypeMayLoseSecretIdentity as Gr, warnFinchArgvExposure as Gs, redactedDeleteAddressFields as Gt, isTruthyCfnBoolean as H, replayWarn as Ha, refuseMalformedOrphanRecordsForDestroy as Hi, planTagDiff as Hn, STATE_SOURCED_CROSS_GENERATION_RULES as Ho, s3BucketWebsiteUrl as Hr, redactedDockerCause as Hs, inheritProducerRegions as Ht, INDEX_SETTLE_POLL_INTERVAL_MS as I, coerceCfnBoolean as Ia, resolveBucketRegion as Ic, malformedScrubResourceEntriesRefusalMessage as Ii, ledgerForStack as In, recordMaskOnlyValue as Io, envCredentialsAreAssumedRole as Ir, formatDockerLoginError as Is, planFailedOps as It, cyan as J, describeTypeWithThrottleRetry as Ja, refuseMalformedResourceAttributesForOrphan as Ji, stringifyIfAssigned as Jn, isLockInfoExpired as Jo, carriesDynamicReference as Jr, AssetManifestLoader as Js, updatePartialReason as Jt, createReadOnlyAttributeHealerFactory as K, prefetchCreateOnlyPropertyPaths as Ka, refuseMalformedOutputs as Ki, tagPlanWarning as Kn, isSingleDynamicReferenceToken as Ko, getAccountInfo as Kr, escapeRegExp$3 as Ks, redactedDeleteAddressSkip as Kt, deleteTableWithIndexBusyRetry as L, coerceCfnInteger as La, malformedStateRefusalMessage as Li, reserveStackCreateToken as Ln, recordMaskOnlyValuesIn as Lo, isSettledInstanceState as Lr, getDockerCmd as Ls, planRollback as Lt, deleteBudgetKey as M, coerceWarmThroughput as Ma, displayAssemblyPath as Mc, malformedRenderedContainersWarning as Mi, findDestructiveChanges as Mn, recordNestedStackParameterExpressions as Mo, sendableAssumeRoleCommand as Mr, describeDockerExecFailure as Ms, recordAfterRollbackUpdate as Mt, resolveDynamoDbDeleteBudgetClock as N, isWarmThroughputDecrease as Na, renderAssemblyPathEscape as Nc, malformedResourceEntriesWarning as Ni, formatDestructiveChange as Nn, recoverMaskedOutput as No, AWS_CREDENTIAL_ENV_KEYS as Nr, describeDockerFailure as Ns, demoteSupersededOrphans as Nt, DynamoDBGlobalTableProvider as O, isStatefulRecreateTargetForReplace as Oa, nullPrototypeRecord as Oc, malformedOrphansRefusalMessage as Oi, DEFAULT_RESOURCE_TIMEOUT_MS as On, isUncertifiedBaselineMaskPosition as Oo, assertFlagRoleArn as Or, buildDenyExternalAccessPolicy as Os, getStackRecords as Ot, resolveDynamoDbDeleteBudgetMs as P, toCfnInteger as Pa, resolveAssemblyPath as Pc, malformedResourcePropertiesWarning as Pi, RollbackInlinePolicyWriters as Pn, carriesSecretMask as Po, applyCallerIdentityCredentials as Pr, dockerSpawnEnvWithSensitive as Ps, isJournaledOrphan as Pt, yellow as Q, sameLambdaFunctionAddress as Qa, refuseMalformedResourceEntriesForImport as Qi, isCustomResource as Qn, acceptedCreateOnlyDropsOf as Qo, AWS_NO_VALUE as Qr, getDefaultStateBucketName as Qs, orphanRecordsPrintingBag as Qt, waitForIndexesSettled as R, configBooleanRefusal as Ra, previewableOrphanRecords as Ri, withCreateTokenLedger as Rn, recordNoEchoAttributeValues as Ro, s3BucketArn as Rr, isDockerClientEnvKey as Rs, replacementNeverSwapped as Rt, recordedProtectionEvidence as S, withoutSilentDropProperties as Sa, AssemblyReader as Sc, malformedLocalOutputsWarning as Si, isWholeDynamicReferenceValue as Sn, maskSecretsInText as So, IntrinsicFunctionResolver as Sr, getBootstrapMarkerKey as Ss, makeForeignHolderScan as St, isProtectionValueActive as T, findReplacedReadersOfRecreateTargets as Ta, defineOwnKey as Tc, malformedOrphanRecordsRefusalMessage as Ti, collectPublishedOutputNames as Tn, scrubResourceRecord as To, producerRegionsFromState as Tr, readBootstrapMarkerBody as Ts, replayRollback as Tt, getPriorAttempts as U, requireConfigArray as Ua, refuseMalformedOrphans as Ui, readTagList as Un, STATE_SOURCED_READBACK_RULES as Uo, coerceParameterTypedValue as Ur, runDockerForeground as Us, REDACTED_DELETE_ADDRESS_SKIP_REASON as Ut, hasCdkAutoDeleteTag as V, readConfigString as Va, refuseMalformedOrphanRecords as Vi, DBPROXY_TAG_OPTIONS as Vn, STATE_SOURCED_BASELINE_RULES as Vo, s3BucketRegionalDomainName as Vr, redactDockerArgvValues as Vs, getCurrentProducerRegions as Vt, markRefusedBeforeApplying as W, requireConfigObject as Wa, refuseMalformedOrphansForDestroy as Wi, refuseMalformedDesiredTags as Wn, TEMPLATE_SOURCED_RULES as Wo, isUnboundTemplateParameter as Wr, runDockerStreaming as Ws, isRedactedRecordedValue as Wt, green as X, canonicalLambdaFunctionName as Xa, refuseMalformedResourceEntriesForDeploy as Xi, ProviderRegistry as Xn, rebuildClientForBucketRegion as Xo, isNamelessDynamicReferenceError as Xr, Synthesizer as Xs, journaledOrphanPrintingBag as Xt, gray as Y, withRetry as Ya, refuseMalformedResourceEntries as Yi, CC_BROKEN_REASON as Yn, S3StateBackend as Yo, carriesFetchableDynamicReference as Yr, getDockerImageBySourceHash as Ys, completedReplayEntries as Yt, red as Z, lambdaFunctionNameForMask as Za, refuseMalformedResourceEntriesForDestroy as Zi, ccBrokenReason as Zn, splitImportedOps as Zo, keepsSecretReferenceToken as Zr, synthesisStatusMessage as Zs, maskEventTextWithBoundBags as Zt, makeCanonicalizePropertiesFn as _, unreadableResourceEntries as _a, decodeListingKey as _c, isReadableOrphanRecord as _i, secretBearingStateKeyWarning as _n, recordLogOnlyValue as _o, observeThenDisableInstanceApiTermination as _r, rewriteTemplateAssetReferences as _s, deleteJournaledOrphans as _t, findNestedTemplateTreeDefect as a, refuseMalformedResourcesForDeploy as aa, resolveStateBucketWithDefault as ac, passedParameterClassesOf as ai, createPreDeleteFinalSnapshot as an, noEchoLeavesOf as ao, CloudControlProvider as ar, importableOutputs as as, NESTED_PENDING_PARENT_REASON as at, noEchoComparisonForTemplate as b, findSilentDropProperties as ba, canonicalizeRegion as bc, malformedExportNamesWarning as bi, exportNameNoEchoParameters as bn, errorCauseChain as bo, DiffCalculator as br, assertAssetBucketRegion as bs, journaledOrphanLines as bt, renderNestedTemplateTreeDefect as c, refuseMalformedState as ca, stateBucketExistenceConfirmed as cc, STATE_RESOURCES_MALFORMED as ci, refusesFinalSnapshot as cn, readsNoEchoSource as co, UNSPECIFIED_SKIP_REASON as cr, orphansCarriedFrom as cs, dropSettledNestedJournals as ct, conditionInputsFrom as d, repairMalformedOutputsForReadOnly as da, CFN_TEMPLATE_BODY_LIMIT as dc, accountArgs as di, DeploymentEventsStore as dn, createUnionSecretMasker as do, withIndeterminateGuard as dr, isSensitiveAttributeName as ds, recordDisplacedSkips as dt, refuseMalformedResourceEntriesForOrphan as ea, loadCdkJson as ec, isStalePlaceholderArnAttribute as ei, stateSecretNameNeedles as en, TemplateParser as eo, TemplateNoEchoReresolver as er, exportNamesCarriedFrom as es, namesAnyDeclaredParameter as et, parentSuppliedValues as f, repairMalformedResourceEntriesForReadOnly as fa, CFN_TEMPLATE_URL_LIMIT as fc, deployRefusesOrphanRowsReason as fi, extractDeploymentEventError as fn, hasMaskableValues as fo, isWaitAbandonedError as fr, stringifyValue as fs, revertNestedChildFromJournal as ft, mergeNoChangeOutputs as g, unreadableOrphanRecords as ga, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as gc, hasReadableResources as gi, secretBearing as gn, recordLogOnlyParameterValue as go, isTerminationProtectionPropagationError as gr, loadPublishableAssetManifest as gs, withNestedStackContext as gt, keptWholeReasonText as h, unpreviewableOrphanRecords as ha, uploadCfnTemplate as hc, hasReadableOutputs as hi, exportAliasCollisionScrubWarning as hn, printingCorpusOf as ho, ec2InstanceProtectionSite as hr, createAssetRedirectResolver as hs, getCurrentNestedStackContext as ht, childTemplateLoader as i, refuseMalformedResourcePropertiesForOrphan as ia, resolveSkipPrefix as ic, parameterInputsFor as ii, ccRoutedFinalSnapshotError as in, maskedLeafCoordinatesOf as io, withPrintingSecrets as ir, importableOutputKeys as is, planOrphanAdoption as it, compensateRemovedDeletionProtection as j, WARM_THROUGHPUT_MEMBERS as ja, describeFileReadFailure as jc, malformedOutputsWarning as ji, constructPathOf as jn, inheritNestedStackParameterAssociations as jo, isIamRoleArn as jr, describeDockerCapturedOutput as js, orphanDeleteNeedsIdentity as jt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as k, isStatefulRecreateTargetSync as ka, ownValue as kc, malformedOrphansWarning as ki, DEFAULT_RESOURCE_WARN_AFTER_MS as kn, pathCrossesDottedKey as ko, assertSendableRoleArn as kr, buildDockerImage as ks, withStackRecords as kt, templateIdentity as l, repairMalformedOrphanRecordsForReadOnly as la, warnDeprecatedNoPrefixCliFlag as lc, UNREADABLE_ORPHANS_CONTAINER_ROW as li, unsupportedFinalSnapshotError as ln, liveMatchesUnresolvedTokenFrame as lo, deleteIndeterminateGuards as lr, shouldRetainResource as ls, getNestedRevertRun as lt, isSecretBearingReferenceString as m, repairMalformedResourcesForReadOnly as ma, findLargeInlineResources as mc, hasReadableOrphans as mi, displayTextOrWithheld as mn, logOnlyValueCount as mo, disableInstanceApiTermination as mr, buildAssetRedirectMap as ms, withNestedRevertRun as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedResourcePropertiesForDrift as na, resolveAutoAssetStorage as nc, parseWebACLArn as ni, PRE_DELETE_SNAPSHOT_TYPES as nn, maskReadbackAtCoordinates as no, isCustomResourceType as nr, hasReasonlessBaselineRefusal as ns, resourcesNamingDeclaredParameter as nt, isAbsoluteAssetPath as o, refuseMalformedResourcesForDestroy as oa, resolveStateBucketWithDefaultAndSource as oc, JSON_LISTING_HOLE_VALUE as oi, effectiveDeletionPolicy as on, noEchoOutputsComparison as oo, slowCcOperationTimeoutMs as or, isReadableBag as os, displacedOpClause as ot, readRecordedConditionVerdicts as p, repairMalformedResourcePropertiesForReadOnly as pa, MIGRATE_TMP_PREFIX as pc, displayLogicalId as pi, WITHHELD_NAME_DISPLAY as pn, literalSplitDelimitersOf as po, markWaitAbandoned as pr, WorkGraph as ps, revertedNestedRowIds as pt, bold as q, templateResourceTypes as qa, refuseMalformedOutputsForDestroy as qi, definedAttributes as qn, LockManager as qo, isImpossibleEmptyStoredAttribute as qr, stripControlChars as qs, updatePartialMessage as qt, computeImplicitDeleteEdges as r, refuseMalformedResourcePropertiesForExport as ra, resolveCaptureObservedState as rc, withSharedDrainBudget as ri, buildFinalSnapshotIdentifier as rn, maskWholeValue as ro, getCurrentResourceSecrets as rr, hasUnverifiableParameterRefusal as rs, makeSiblingClaimReader as rt, listNestedTemplateRows as s, refuseMalformedResourcesForExport as sa, resolveUseCdkBootstrapAssets as sc, STATE_REGION_DIVERGED as si, isFinalSnapshotError as sn, passedNoEchoParametersOf as so, unchangedBehindSecretReference as sr, orphansAfterRollback as ss, displacedPhysicalIdShown as st, DeployEngine as t, refuseMalformedResourcePropertiesForDestroy as ta, resolveApp as tc, refStateLookupFromResource as ti, ATOMIC_FINAL_SNAPSHOT_TYPES as tn, isMarkedCoordinate as to, readsNoEchoDeleteValues as tr, hasReadableExportSet as ts, reachableDivergentParameters as tt, conditionFingerprint as u, repairMalformedOrphansForReadOnly as ua, ssmResolvedValueType as uc, UNREADABLE_RESOURCES_MAP_ROW as ui, DeploymentEventsReader as un, carryLogOnlyValues as uo, deleteSkipReason as ur, AssetPublisher as us, nestedChildStackName as ut, withResourceDeadline as v, withheldAccountClause as va, expectedOwnerParam as vc, isReadableResourceEntry as vi, secretSafeKeyDisplay as vn, shareLogOnlyValues as vo, reDisableInstanceApiTermination as vr, AssetModeResolver as vs, dropFailedHint as vt, PROTECTION_PROPERTY_BY_TYPE as w, hasNoCloudControlHandlers as wa, processStackMessages as wc, malformedLocalResourcesWarning as wi, collectDeclaredOutputNames as wn, redactSecretsForState as wo, classifyReplaySecretRegion as wr, parseBootstrapMarker as ws, replayFailedOperations as wt, noEchoParameterNamesOf as x, unwrittenCreateOnlyReplacement as xa, derivePartitionAndUrlSuffix as xc, malformedExportSourceWarning as xi, exportNameSecretExposure as xn, maskSecretsInError as xo, INTRINSIC_KEYS as xr, ensureAssetStorage as xs, loadJournaledOrphans as xt, noEchoAttributeNamesOf as y, findActionableSilentDrops as ya, PARTITION_TABLE as yc, malformedDriftResourcePropertiesWarning as yi, carriedExportAliasExposure as yn, createSecretMasker as yo, reEnableInstanceApiTermination as yr, BOOTSTRAP_MARKER_PREFIX as ys, isHandledOrphan as yt, ECR_AUTO_DELETE_IMAGES_TAG as z, configIntegerRefusal as za, refuseDivergentRecordRegionForDestroy as zi, acquireIdempotencyToken as zn, recordProvenPublicExpression as zo, s3BucketDomainName as zr, isMalformedEnvKey as zs, resolveReplacementOldType as zt };
-//# sourceMappingURL=deploy-engine-CFgNpsEy.js.map
+export { green as $, describeTypeWithThrottleRetry as $a, refuseMalformedResourceAttributesForOrphan as $i, stringifyIfAssigned as $n, isLockInfoExpired as $o, carriesDynamicReference as $r, AssetManifestLoader as $s, updatePartialReason as $t, readProtection as A, findReplacedReadersOfRecreateTargets as Aa, defineOwnKey as Ac, malformedOrphanRecordsRefusalMessage as Ai, collectPublishedOutputNames as An, scrubResourceRecord as Ao, producerRegionsFromState as Ar, readBootstrapMarkerBody as As, destroyStackRecordsView as At, deleteTableWithIndexBusyRetry as B, toFiniteNumber as Ba, clearBucketRegionCache as Bc, malformedResourcesWarning as Bi, earliestDefined as Bn, provenPublicValue as Bo, callerEnvCredentials as Br, finchSecretArgvRefusal as Bs, recheckFailedPlan as Bt, noEchoComparisonForTemplate as C, withheldAccountClause as Ca, expectedOwnerParam as Cc, isReadableResourceEntry as Ci, secretSafeKeyDisplay as Cn, shareLogOnlyValues as Co, reDisableInstanceApiTermination as Cr, AssetModeResolver as Cs, journaledOrphanLines as Ct, PROTECTION_PROPERTY_BY_TYPE as D, withoutSilentDropProperties as Da, AssemblyReader as Dc, malformedLocalOutputsWarning as Di, isWholeDynamicReferenceValue as Dn, maskSecretsInText as Do, IntrinsicFunctionResolver as Dr, getBootstrapMarkerKey as Ds, replayFailedOperations as Dt, recordedProtectionNote as E, unwrittenCreateOnlyReplacement as Ea, derivePartitionAndUrlSuffix as Ec, malformedExportSourceWarning as Ei, exportNameSecretExposure as En, maskSecretsInError as Eo, INTRINSIC_KEYS as Er, ensureAssetStorage as Es, sameJournaledOrphans as Et, deleteBudgetKey as F, renderStatefulReason as Fa, absoluteAssemblyPathEscape as Fc, malformedOutputsRefusalMessage as Fi, maskingRetryLogger as Fn, identityKeyFor as Fo, explicitRoleArnOrThrow as Fr, resolveDockerContextDirectory as Fs, demoteSupersededOrphans as Ft, isTruthyCfnBoolean as G, configStringRefusal as Ga, refuseMalformedNestedChildOutputs as Gi, DBPROXY_TAGS_WHAT as Gn, wholeStringLeavesOf as Go, s3BucketDualStackDomainName as Gr, partitionSensitiveEnv as Gs, findNestedStackTypeChanges as Gt, ECR_AUTO_DELETE_IMAGES_TAG as H, coerceCfnInteger as Ha, malformedStateRefusalMessage as Hi, reserveStackCreateToken as Hn, recordMaskOnlyValuesIn as Ho, isSettledInstanceState as Hr, getDockerCmd as Hs, replacementNeverSwapped as Ht, resolveDynamoDbDeleteBudgetClock as I, WARM_THROUGHPUT_MEMBERS as Ia, describeFileReadFailure as Ic, malformedOutputsWarning as Ii, constructPathOf as In, inheritNestedStackParameterAssociations as Io, isIamRoleArn as Ir, describeDockerCapturedOutput as Is, isJournaledOrphan as It, formatResourceLine as J, requireConfigArray as Ja, refuseMalformedOrphans as Ji, readTagList as Jn, STATE_SOURCED_READBACK_RULES as Jo, coerceParameterTypedValue as Jr, runDockerForeground as Js, REDACTED_DELETE_ADDRESS_SKIP_REASON as Jt, getPriorAttempts as K, readConfigString as Ka, refuseMalformedOrphanRecords as Ki, DBPROXY_TAG_OPTIONS as Kn, STATE_SOURCED_BASELINE_RULES as Ko, s3BucketRegionalDomainName as Kr, redactDockerArgvValues as Ks, getCurrentProducerRegions as Kt, resolveDynamoDbDeleteBudgetMs as L, coerceWarmThroughput as La, displayAssemblyPath as Lc, malformedRenderedContainersWarning as Li, findDestructiveChanges as Ln, recordNestedStackParameterExpressions as Lo, sendableAssumeRoleCommand as Lr, describeDockerExecFailure as Ls, isReplacementOrphan as Lt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as M, MULTI_REGION_RECREATE_BLOCKED_TYPES as Ma, hasPlainPrototype$1 as Mc, malformedOrphanRowsKeptWarning as Mi, bindingSkippedOutputs as Mn, dynamicReferenceTokens as Mo, applyRoleArnIfSet as Mr, validateContainerRepoName as Ms, withStackRecords as Mt, beginDeleteWait as N, isStatefulRecreateTargetForReplace as Na, nullPrototypeRecord as Nc, malformedOrphansRefusalMessage as Ni, DEFAULT_RESOURCE_TIMEOUT_MS as Nn, isUncertifiedBaselineMaskPosition as No, assertFlagRoleArn as Nr, buildDenyExternalAccessPolicy as Ns, removeProtectionTypeList as Nt, isProtectionValueActive as O, NO_CC_HANDLERS_REASON as Oa, StageLoadError as Oc, malformedLocalResourceEntriesWarning as Oi, noEchoParameterValueSeed as On, markSameGenerationBag as Oo, poisonRenderedSpellingsCollidingIn as Or, isCrossRegionRedirect as Os, replayRollback as Ot, compensateRemovedDeletionProtection as P, isStatefulRecreateTargetSync as Pa, ownValue as Pc, malformedOrphansWarning as Pi, DEFAULT_RESOURCE_WARN_AFTER_MS as Pn, pathCrossesDottedKey as Po, assertSendableRoleArn as Pr, buildDockerImage as Ps, recordAfterRollbackUpdate as Pt, gray as Q, templateResourceTypes as Qa, refuseMalformedOutputsForDestroy as Qi, definedAttributes as Qn, LockManager as Qo, isImpossibleEmptyStoredAttribute as Qr, stripControlChars as Qs, updatePartialMessage as Qt, DELETE_INDEX_WAIT_PROCEED_NOTE as R, isWarmThroughputDecrease as Ra, renderAssemblyPathEscape as Rc, malformedResourceEntriesWarning as Ri, formatDestructiveChange as Rn, recoverMaskedOutput as Ro, AWS_CREDENTIAL_ENV_KEYS as Rr, describeDockerFailure as Rs, planFailedOps as Rt, noEchoAttributeNamesOf as S, unreadableResourceEntries as Sa, decodeListingKey as Sc, isReadableOrphanRecord as Si, secretBearingStateKeyWarning as Sn, recordLogOnlyValue as So, observeThenDisableInstanceApiTermination as Sr, rewriteTemplateAssetReferences as Ss, isHandledOrphan as St, recordedProtectionEvidence as T, findSilentDropProperties as Ta, canonicalizeRegion as Tc, malformedExportNamesWarning as Ti, exportNameNoEchoParameters as Tn, errorCauseChain as To, DiffCalculator as Tr, assertAssetBucketRegion as Ts, makeForeignHolderScan as Tt, S3_AUTO_DELETE_OBJECTS_TAG as U, configBooleanRefusal as Ua, previewableOrphanRecords as Ui, withCreateTokenLedger as Un, recordNoEchoAttributeValues as Uo, s3BucketArn as Ur, isDockerClientEnvKey as Us, resolveReplacementOldType as Ut, waitForIndexesSettled as V, coerceCfnBoolean as Va, resolveBucketRegion as Vc, malformedScrubResourceEntriesRefusalMessage as Vi, ledgerForStack as Vn, recordMaskOnlyValue as Vo, envCredentialsAreAssumedRole as Vr, formatDockerLoginError as Vs, recordUnderIdIsNotOwn as Vt, hasCdkAutoDeleteTag as W, configIntegerRefusal as Wa, refuseDivergentRecordRegionForDestroy as Wi, acquireIdempotencyToken as Wn, recordProvenPublicExpression as Wo, s3BucketDomainName as Wr, isMalformedEnvKey as Ws, orphanDeleteNeedsIdentity as Wt, bold as X, requireConfigString as Xa, refuseMalformedOrphansForOrphan as Xi, tagMapAsList as Xn, WHOLE_DYNAMIC_REFERENCE_PATTERN as Xo, parameterTypeMayLoseSecretIdentity as Xr, warnFinchArgvExposure as Xs, redactedDeleteAddressFields as Xt, createReadOnlyAttributeHealerFactory as Y, requireConfigObject as Ya, refuseMalformedOrphansForDestroy as Yi, refuseMalformedDesiredTags as Yn, TEMPLATE_SOURCED_RULES as Yo, isUnboundTemplateParameter as Yr, runDockerStreaming as Ys, isRedactedRecordedValue as Yt, cyan as Z, prefetchCreateOnlyPropertyPaths as Za, refuseMalformedOutputs as Zi, tagPlanWarning as Zn, isSingleDynamicReferenceToken as Zo, getAccountInfo as Zr, escapeRegExp$3 as Zs, redactedDeleteAddressSkip as Zt, makeCanonicalizePropertiesFn as _, repairMalformedResourceEntriesForReadOnly as _a, CFN_TEMPLATE_URL_LIMIT as _c, deployRefusesOrphanRowsReason as _i, extractDeploymentEventError as _n, hasMaskableValues as _o, isWaitAbandonedError as _r, stringifyValue as _s, withNestedRevertRun as _t, findNestedTemplateTreeDefect as a, refuseMalformedResourceEntriesForOrphan as aa, loadCdkJson as ac, isStalePlaceholderArnAttribute as ai, stateSecretNameNeedles as an, TemplateParser as ao, TemplateNoEchoReresolver as ar, exportNamesCarriedFrom as as, resourcesNamingDeclaredParameter as at, serviceTokenBlockingReason as b, unpreviewableOrphanRecords as ba, uploadCfnTemplate as bc, hasReadableOutputs as bi, exportAliasCollisionScrubWarning as bn, printingCorpusOf as bo, ec2InstanceProtectionSite as br, createAssetRedirectResolver as bs, deleteJournaledOrphans as bt, renderNestedTemplateTreeDefect as c, refuseMalformedResourcePropertiesForExport as ca, resolveCaptureObservedState as cc, withSharedDrainBudget as ci, buildFinalSnapshotIdentifier as cn, maskWholeValue as co, getCurrentResourceSecrets as cr, hasUnverifiableParameterRefusal as cs, NESTED_PENDING_PARENT_REASON as ct, conditionInputsFrom as d, refuseMalformedResourcesForDestroy as da, resolveStateBucketWithDefaultAndSource as dc, JSON_LISTING_HOLE_VALUE as di, effectiveDeletionPolicy as dn, noEchoOutputsComparison as do, slowCcOperationTimeoutMs as dr, isReadableBag as ds, dropSettledNestedJournals as dt, refuseMalformedResourceEntries as ea, getDockerImageBySourceHash as ec, carriesFetchableDynamicReference as ei, completedReplayEntries as en, withRetry as eo, CC_BROKEN_REASON as er, S3StateBackend as es, red as et, parentSuppliedValues as f, refuseMalformedResourcesForExport as fa, resolveUseCdkBootstrapAssets as fc, STATE_REGION_DIVERGED as fi, isFinalSnapshotError as fn, passedNoEchoParametersOf as fo, unchangedBehindSecretReference as fr, orphansAfterRollback as fs, getNestedRevertRun as ft, mergeNoChangeOutputs as g, repairMalformedOutputsForReadOnly as ga, CFN_TEMPLATE_BODY_LIMIT as gc, accountArgs as gi, DeploymentEventsStore as gn, createUnionSecretMasker as go, withIndeterminateGuard as gr, isSensitiveAttributeName as gs, revertedNestedRowIds as gt, keptWholeReasonText as h, repairMalformedOrphansForReadOnly as ha, ssmResolvedValueType as hc, UNREADABLE_RESOURCES_MAP_ROW as hi, DeploymentEventsReader as hn, carryLogOnlyValues as ho, deleteSkipReason as hr, AssetPublisher as hs, revertNestedChildFromJournal as ht, childTemplateLoader as i, refuseMalformedResourceEntriesForImportSave as ia, getLegacyStateBucketName as ic, cfnRefValueFromPhysicalId as ii, secretNamePrintingBag as in, DagBuilder as io, wouldReturnToSdkProvider as ir, describeRegionValueKind as is, reachableDivergentParameters as it, DynamoDBGlobalTableProvider as j, shownType as ja, hasOwnKey as jc, malformedOrphanRecordsWarning as ji, isExportAliasCollision as jn, DYNAMIC_REFERENCE_TOKEN_SCAN as jo, regionLessSecretName as jr, validateAssetBucketName as js, getStackRecords as jt, perType as k, hasNoCloudControlHandlers as ka, processStackMessages as kc, malformedLocalResourcesWarning as ki, collectDeclaredOutputNames as kn, redactSecretsForState as ko, classifyReplaySecretRegion as kr, parseBootstrapMarker as ks, awaitInFlightSibling as kt, templateIdentity as l, refuseMalformedResourcePropertiesForOrphan as la, resolveSkipPrefix as lc, parameterInputsFor as li, ccRoutedFinalSnapshotError as ln, maskedLeafCoordinatesOf as lo, withPrintingSecrets as lr, importableOutputKeys as ls, displacedOpClause as lt, isSecretBearingReferenceString as m, repairMalformedOrphanRecordsForReadOnly as ma, warnDeprecatedNoPrefixCliFlag as mc, UNREADABLE_ORPHANS_CONTAINER_ROW as mi, unsupportedFinalSnapshotError as mn, liveMatchesUnresolvedTokenFrame as mo, deleteIndeterminateGuards as mr, shouldRetainResource as ms, recordDisplacedSkips as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedResourceEntriesForDestroy as na, synthesisStatusMessage as nc, keepsSecretReferenceToken as ni, maskEventTextWithBoundBags as nn, lambdaFunctionNameForMask as no, ccBrokenReason as nr, splitImportedOps as ns, computeParameterTaint as nt, isAbsoluteAssetPath as o, refuseMalformedResourcePropertiesForDestroy as oa, resolveApp as oc, refStateLookupFromResource as oi, ATOMIC_FINAL_SNAPSHOT_TYPES as on, isMarkedCoordinate as oo, readsNoEchoDeleteValues as or, hasReadableExportSet as os, makeSiblingClaimReader as ot, readRecordedConditionVerdicts as p, refuseMalformedState as pa, stateBucketExistenceConfirmed as pc, STATE_RESOURCES_MALFORMED as pi, refusesFinalSnapshot as pn, readsNoEchoSource as po, UNSPECIFIED_SKIP_REASON as pr, orphansCarriedFrom as ps, nestedChildStackName as pt, markRefusedBeforeApplying as q, replayWarn as qa, refuseMalformedOrphanRecordsForDestroy as qi, planTagDiff as qn, STATE_SOURCED_CROSS_GENERATION_RULES as qo, s3BucketWebsiteUrl as qr, redactedDockerCause as qs, inheritProducerRegions as qt, computeImplicitDeleteEdges as r, refuseMalformedResourceEntriesForImport as ra, getDefaultStateBucketName as rc, AWS_NO_VALUE as ri, orphanRecordsPrintingBag as rn, sameLambdaFunctionAddress as ro, isCustomResource as rr, acceptedCreateOnlyDropsOf as rs, namesAnyDeclaredParameter as rt, listNestedTemplateRows as s, refuseMalformedResourcePropertiesForDrift as sa, resolveAutoAssetStorage as sc, parseWebACLArn as si, PRE_DELETE_SNAPSHOT_TYPES as sn, maskReadbackAtCoordinates as so, isCustomResourceType as sr, hasReasonlessBaselineRefusal as ss, planOrphanAdoption as st, DeployEngine as t, refuseMalformedResourceEntriesForDeploy as ta, Synthesizer as tc, isNamelessDynamicReferenceError as ti, journaledOrphanPrintingBag as tn, canonicalLambdaFunctionName as to, ProviderRegistry as tr, rebuildClientForBucketRegion as ts, yellow as tt, conditionFingerprint as u, refuseMalformedResourcesForDeploy as ua, resolveStateBucketWithDefault as uc, passedParameterClassesOf as ui, createPreDeleteFinalSnapshot as un, noEchoLeavesOf as uo, CloudControlProvider as ur, importableOutputs as us, displacedPhysicalIdShown as ut, deferredServiceTokenWarning as v, repairMalformedResourcePropertiesForReadOnly as va, MIGRATE_TMP_PREFIX as vc, displayLogicalId as vi, WITHHELD_NAME_DISPLAY as vn, literalSplitDelimitersOf as vo, markWaitAbandoned as vr, WorkGraph as vs, getCurrentNestedStackContext as vt, noEchoParameterNamesOf as w, findActionableSilentDrops as wa, PARTITION_TABLE as wc, malformedDriftResourcePropertiesWarning as wi, carriedExportAliasExposure as wn, createSecretMasker as wo, reEnableInstanceApiTermination as wr, BOOTSTRAP_MARKER_PREFIX as ws, loadJournaledOrphans as wt, withResourceDeadline as x, unreadableOrphanRecords as xa, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as xc, hasReadableResources as xi, secretBearing as xn, recordLogOnlyParameterValue as xo, isTerminationProtectionPropagationError as xr, loadPublishableAssetManifest as xs, dropFailedHint as xt, findServiceTokenRefusals as y, repairMalformedResourcesForReadOnly as ya, findLargeInlineResources as yc, hasReadableOrphans as yi, displayTextOrWithheld as yn, logOnlyValueCount as yo, disableInstanceApiTermination as yr, buildAssetRedirectMap as ys, withNestedStackContext as yt, INDEX_SETTLE_POLL_INTERVAL_MS as z, toCfnInteger as za, resolveAssemblyPath as zc, malformedResourcePropertiesWarning as zi, RollbackInlinePolicyWriters as zn, carriesSecretMask as zo, applyCallerIdentityCredentials as zr, dockerSpawnEnvWithSensitive as zs, planRollback as zt };
+//# sourceMappingURL=deploy-engine-B0TGnXSs.js.map