@go-to-k/cdkd 0.296.27 → 0.296.28

package/dist/{deploy-engine-DC4Yblxp.js → deploy-engine-D4FdwPCi.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js"
 import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
 import { $ as protectedReplacementAdvice, $n as isIamPropagationError, $t as AccountIdUnavailableError, A as isQuotableImportValue, An as commandHole, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bt as sanitizeRecoveryValue, Ct as RETRY_AUXILIARY_OWNER, Dn as SHELL_ACTIVE, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as plainOrDescribed, G as runDeleteAttempt, Gn as isNameCooldownError, H as observeThenDisableProtection, Hn as isUpdateUnsupportedError, Ht as DEFAULT_STATE_PREFIX, In as quotedOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jt as withPasteableAwsProfile, Kn as isRecreateRetryableError, Kt as producerRecordKey, L as ProtectionFlipRegistry, Ln as shellBoundedDisplay, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mn as isInertUnquoted, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as pasteableCommand, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE_WHY, Ot as hasCreatedBeforeFailure, Pn as physicalIdShownBesideCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, R as compensateProtectionFlip, Rn as shellQuote, Rt as formatLockOperation, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Un as hasReplayMayCollide, Ut as injectiveKey, Vt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Wn as isNameCollisionErrorFrom, Xn as formatRetryClassificationSignals, Xt as ambientCredentialConfig, Yn as markReplayMayCollide, Yt as ambientClientDefaults, Zn as isAmbiguousCcHandlerErrorCode, Zt as clientDefaultsFor, _n as ResourceUpdateNotSupportedError, _t as createMaskedLogSinks, ar as isThrottlingError, at as startInterruptWatch, bn as StateError, bt as maskDeep, cr as wrapMaskedAwsError, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as MacroExpansionError, en as AssetError, er as isRetryableTransientError, f as removalWarning, fn as MalformedProducerRecordRefusalError, ft as logicalIdShown, gn as ResourceTimeoutError, gt as stateOrphanRecordRemedy, hn as ProvisioningError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as DependencyError, ir as isMarkedNonRetryable, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, kn as UNSHOWABLE_VALUE, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, m as withoutInjectedRemovals, mt as resourceTypeShown, nr as retryClassificationText, on as DynamicReferenceRegionAmbiguousError, or as markNonRetryable, ot as ElapsedBudgetRegistry, qn as isReplayedNameCollisionFrom, rn as CrossAccountSecretRefusalError, sn as IntrinsicResolutionRefusalError, sr as markRedactedCause, st as monotonicNowMs, tn as CdkdError, tr as isTransientServerError, un as LockError, ut as compositeIdSeparatorRefusal, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as normalizeAwsError, wt as carryCreatedBeforeFailure, xn as SynthesisError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as withheldTargetClause, zt as formatLockOwner } from "./iam-policy-targets-B61e5_Sk.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-Cs9QbaaH.js";
+import { t as getCdkdVersion } from "./version-B0JEGOLV.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4812,6 +4812,7 @@ function refuseMalformedOperation(shownStack, where, op) {
 		if (o["changeType"] !== "UPDATE") refuseMalformed(shownStack, `${where}.replacementOrphaned is only valid on an UPDATE.`);
 	}
 	if (o["wasReplaced"] !== void 0 && typeof o["wasReplaced"] !== "boolean") fail("wasReplaced", o["wasReplaced"], "a boolean when present");
+	if (o["oldDeletedBeforeCreate"] !== void 0 && typeof o["oldDeletedBeforeCreate"] !== "boolean") fail("oldDeletedBeforeCreate", o["oldDeletedBeforeCreate"], "a boolean when present");
 	if (o["physicalIdRecoveredFromError"] !== void 0 && typeof o["physicalIdRecoveredFromError"] !== "boolean") fail("physicalIdRecoveredFromError", o["physicalIdRecoveredFromError"], "a boolean when present");
 	if (o["physicalIdRecoveredFromError"] !== void 0 && o["changeType"] !== "CREATE") refuseMalformed(shownStack, `${where}.physicalIdRecoveredFromError is only valid on a CREATE (got changeType ${kind(o["changeType"])}).`);
 	const identity = o["createdResourceIdentity"];
@@ -6238,6 +6239,25 @@ const MIN_NEEDLE_LENGTH = 4;
 function escapeRegExp$2(value) {
 	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function maskMatchSpans(text, needles, mask) {
+	const spans = [];
+	for (const needle of needles) for (let at = text.indexOf(needle); at !== -1; at = text.indexOf(needle, at + 1)) spans.push([at, at + needle.length]);
+	if (spans.length === 0) return text;
+	spans.sort((a, b) => a[0] - b[0] || b[1] - a[1]);
+	let out = "";
+	let cursor = 0;
+	let [start, end] = spans[0];
+	for (const [nextStart, nextEnd] of spans.slice(1)) {
+		if (nextStart < end) {
+			end = Math.max(end, nextEnd);
+			continue;
+		}
+		out += text.slice(cursor, start) + mask;
+		cursor = end;
+		[start, end] = [nextStart, nextEnd];
+	}
+	return out + text.slice(cursor, start) + mask + text.slice(end);
+}
 function buildNeedleRegex(values) {
 	const needles = Array.from(new Set(values)).filter((v) => v.length >= 4).sort((a, b) => b.length - a.length);
 	if (needles.length === 0) return void 0;
@@ -8012,16 +8032,15 @@ function maskSecretsInText(text, secrets) {
 	const logOnly = logOnlyValuesOf.get(secrets);
 	if (logOnly === void 0 || logOnly.size === 0) return maskRecordedSecretsInText(text, secrets);
 	if (text !== "" && (secrets.has(text) || logOnly.has(text))) return "***";
-	const regex = buildNeedleRegex([...secrets.keys(), ...logOnly]);
-	if (!regex) return text;
-	return text.replace(regex, "***");
+	return maskMatchSpans(text, substringNeedles([...secrets.keys(), ...logOnly]), "***");
 }
 function maskRecordedSecretsInText(text, secrets) {
 	if (secrets.size === 0) return text;
 	if (text !== "" && secrets.has(text)) return "***";
-	const regex = buildNeedleRegex(secrets.keys());
-	if (!regex) return text;
-	return text.replace(regex, "***");
+	return maskMatchSpans(text, substringNeedles(secrets.keys()), "***");
+}
+function substringNeedles(values) {
+	return [...new Set(values)].filter((value) => value.length >= 4);
 }
 const ERROR_CAUSE_MASK_MAX_DEPTH = 20;
 function errorCauseChain(root) {
@@ -8368,7 +8387,7 @@ function createUnionSecretMasker(bags) {
 	const present = bags.filter((bag) => bag !== void 0);
 	let stamp;
 	let needles = /* @__PURE__ */ new Set();
-	let regex;
+	let scanned = [];
 	return (text) => {
 		const now = present.map((bag) => `${bag.size}:${logOnlyValueCount(bag)}`).join(",");
 		if (now !== stamp) {
@@ -8377,11 +8396,11 @@ function createUnionSecretMasker(bags) {
 				for (const plaintext of bag.keys()) needles.add(plaintext);
 				for (const plaintext of logOnlyValuesOf.get(bag) ?? []) needles.add(plaintext);
 			}
-			regex = buildNeedleRegex(needles);
+			scanned = [...needles].filter((needle) => needle.length >= 4);
 			stamp = now;
 		}
 		if (text !== "" && needles.has(text)) return "***";
-		return regex ? text.replace(regex, "***") : text;
+		return maskMatchSpans(text, scanned, "***");
 	};
 }
 function hasLogOnlyValues(secrets) {
@@ -22953,7 +22972,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BiMLPagi.js");
+			const { ASGProvider } = await import("./asg-provider-B3zcS87C.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -23059,7 +23078,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-iouJXdXX.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DME95IcZ.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-BfQsw4hw.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DF6Eh4Tl.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -27830,537 +27849,334 @@ function maskingRetryLogger(logger, secrets) {
 }
 
 //#endregion
-//#region src/deployment/deploy-engine/options.ts
-const DEFAULT_RESOURCE_WARN_AFTER_MS = 3e5;
-const DEFAULT_RESOURCE_TIMEOUT_MS = 18e5;
-
-//#endregion
-//#region src/deployment/deploy-engine/name-collision.ts
-function replacementNameOrigin(logicalId, physicalId) {
-	if (looksLikeCdkdGeneratedName(physicalId, logicalId, getCurrentStackName())) return {
-		descriptor: `The physical name (${physicalId}) was GENERATED by cdkd from the construct's logical id rather than declared in your template, and that derivation has no random component — so the new resource asks for exactly the name the existing one still holds`,
-		remedy: "Either give the resource an explicit physical name in your CDK code, or rename the CONSTRUCT (its id feeds the generated name — note that this replaces the resource rather than renaming it in place)"
-	};
-	return {
-		descriptor: `The resource has a user-supplied physical name (${physicalId})`,
-		remedy: "Either rename the resource in your CDK code (a fresh name lets the safe create-first order proceed)"
-	};
+//#region src/provisioning/final-snapshot.ts
+const ATOMIC_FINAL_SNAPSHOT_TYPES = /* @__PURE__ */ new Set([
+	"AWS::RDS::DBInstance",
+	"AWS::RDS::DBCluster",
+	"AWS::Neptune::DBCluster",
+	"AWS::DocDB::DBCluster",
+	"AWS::ElastiCache::CacheCluster"
+]);
+const PRE_DELETE_SNAPSHOT_TYPES = /* @__PURE__ */ new Set([
+	"AWS::EC2::Volume",
+	"AWS::Redshift::Cluster",
+	"AWS::ElastiCache::ReplicationGroup"
+]);
+function effectiveDeletionPolicy(resourceType, recorded, properties) {
+	if (recorded !== void 0) return recorded;
+	if (resourceType === "AWS::RDS::DBCluster") return "Snapshot";
+	if (resourceType === "AWS::RDS::DBInstance" && properties?.["DBClusterIdentifier"] === void 0) return "Snapshot";
 }
-function orphanedNameCollisionAdvice(changeType, logicalId, error) {
-	if (changeType !== "CREATE") return void 0;
-	if (!(error instanceof ProvisioningError)) return void 0;
-	const physicalId = error.physicalId;
-	if (!physicalId) return void 0;
-	const replayed = isReplayedNameCollisionFrom(error, logicalId, (link) => isAuxiliaryMarkOf(link, RETRY_AUXILIARY_OWNER));
-	if (!replayed && !isNameCollisionErrorFrom(error, logicalId)) return void 0;
-	const stackName = getCurrentStackName();
-	if (!looksLikeCdkdGeneratedName(physicalId, logicalId, stackName)) return void 0;
-	if (!stackName) return void 0;
-	const safeId = displaySafe(physicalId, { asciiOnly: true });
-	const safeStack = displaySafe(stackName, { asciiOnly: true });
-	const safeLogicalId = displaySafe(logicalId, { asciiOnly: true });
-	const idShown = isInertUnquoted(safeId);
-	const shownId = idShown ? safeId : "a name that cannot be shown safely here";
-	const shownLogicalId = isInertUnquoted(safeLogicalId) ? safeLogicalId : "A resource whose logical id cannot be shown safely here";
-	const diagnosis = replayed ? `${shownLogicalId}: the name AWS reports as taken (${shownId}) is most likely held by a resource THIS create made. An earlier attempt of it ended without a clear verdict (a server error, a dropped connection or a timeout, or a failure after the create call itself may have succeeded), and the retry then found the name taken. A dropped connection can also happen before the request reached AWS, so the holder may be another resource: confirm it is yours before deleting or importing it. cdkd records a resource only once its create succeeds, so this one is in no state file: no rollback or cdkd destroy will remove it, and re-running collides with it again.` : `${shownLogicalId}: the name AWS reports as taken (${shownId}) is one cdkd DERIVED from the logical id, and that derivation has no random component — so this is most likely a resource an earlier cdkd run left behind. A rollback leaves a resource carrying DeletionPolicy: Retain in AWS and drops it from state, as CloudFormation does; what differs is the name. CloudFormation would generate a fresh one for an unnamed resource and redeploy clean, whereas cdkd asks again for the name the orphan still holds — so re-running does not clear this.`;
-	const deleteArm = `If it is not a resource you want to keep, delete ${idShown ? safeId : "it"} in AWS — after confirming it holds nothing you need${replayed ? "" : ", since Retain is what kept it"} — and re-deploy.`;
-	let canImport;
-	try {
-		canImport = typeof this.providerRegistry.getProvider(error.resourceType).import === "function";
-	} catch {
-		canImport = false;
-	}
-	const commandNamesTheRightResource = safeId === physicalId && safeStack === stackName && safeLogicalId === logicalId;
-	const importableTarget = !stackName.includes("~");
-	if (!canImport || !commandNamesTheRightResource || !importableTarget) return `${diagnosis} ${!canImport ? `cdkd cannot adopt ${displaySafe(error.resourceType, { asciiOnly: true })} back into state (its provider implements no import)` : !importableTarget ? `this is a nested-stack child, whose stack name cdkd import cannot resolve` : `cdkd cannot render an import command that provably names this resource`}, so the way forward is to delete it. ${deleteArm}`;
-	const adopt = pasteableCommand("cdkd import", [{
-		value: stackName,
-		hole: "stack"
-	}, {
-		flag: "--resource",
-		value: `${logicalId}=${physicalId}`,
-		hole: "logicalId=physicalId"
-	}]);
-	return `${diagnosis} To recover, adopt it back into state instead of re-creating it, with the command below (a selective import merges into existing state and needs no --force while the resource is absent from it). CONFIRM IT IS YOURS FIRST — a name cdkd derives is predictable, so for a globally-namespaced type it can belong to another account, and the same stack deployed in another region derives the same name. ${deleteArm}${adopt.withheld.length === 0 ? "" : " The command below prints a quoted hole in place of a value cdkd will not name on a command line; replace it whole, quotes included, with your stack name or '<logicalId>=<name>', shell-quoted."}\nAdopt with: ${adopt.command}`;
+function replacementDeletePolicy(updateReplacePolicy) {
+	return updateReplacePolicy ?? "Delete";
 }
-
-//#endregion
-//#region src/analyzer/skipped-outputs.ts
-function canonicalJson$1(value) {
-	return JSON.stringify(value, (_key, v) => {
-		if (v !== null && typeof v === "object" && !Array.isArray(v)) {
-			const sorted = Object.create(null);
-			for (const k of Object.keys(v).sort()) sorted[k] = v[k];
-			return sorted;
-		}
-		return v;
-	});
+function finalSnapshotMechanism(resourceType, provisionedBy) {
+	if (ATOMIC_FINAL_SNAPSHOT_TYPES.has(resourceType)) return provisionedBy === "cc-api" ? "refuse-cc-routed" : "atomic-delete-parameter";
+	if (PRE_DELETE_SNAPSHOT_TYPES.has(resourceType)) return "pre-delete-snapshot";
+	return "refuse-unsupported-type";
 }
-const NO_ECHO_DEFAULT_MASK = "<cdkd:noecho-default>";
-function withNoEchoDefaultsMasked(parameters) {
-	if (parameters === null || typeof parameters !== "object" || Array.isArray(parameters)) return parameters;
-	const masked = Object.create(null);
-	for (const [name, decl] of Object.entries(parameters)) {
-		const body = decl;
-		masked[name] = typeof body === "object" && body !== null && body["NoEcho"] === true && "Default" in body ? {
-			...body,
-			Default: NO_ECHO_DEFAULT_MASK
-		} : decl;
-	}
-	return masked;
+function refusesFinalSnapshot(resourceType, provisionedBy) {
+	const mechanism = finalSnapshotMechanism(resourceType, provisionedBy);
+	return mechanism === "refuse-cc-routed" || mechanism === "refuse-unsupported-type";
 }
-function skippedOutputDigest(template, outputKey) {
-	const sections = Object.create(null);
-	for (const [section, body] of Object.entries(template)) {
-		if (section === "Resources" || section === "Outputs") continue;
-		sections[section] = section === "Parameters" ? withNoEchoDefaultsMasked(body) : body;
-	}
-	const entry = template.Outputs?.[outputKey];
-	return createHash("sha256").update(canonicalJson$1({
-		output: entry,
-		template: sections
-	})).digest("hex");
+function sanitizeSnapshotBase(physicalId) {
+	let base = physicalId.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
+	if (!/^[a-z]/.test(base)) base = `r${base}`;
+	return base;
 }
-function collectSkippedOutputs(template, resolvedOutputs) {
-	let record;
-	for (const [outputKey, value] of Object.entries(resolvedOutputs)) {
-		if (value !== void 0) continue;
-		record ??= Object.create(null);
-		record[outputKey] = skippedOutputDigest(template, outputKey);
-	}
-	return record;
+function finalSnapshotNamePrefix(physicalId, resourceType) {
+	return finalSnapshotNameCut(physicalId, resourceType).prefix;
 }
-function referencedLogicalIds(entry) {
-	const ids = /* @__PURE__ */ new Set();
-	const addName = (name) => {
-		const logicalId = name.split(".")[0];
-		if (logicalId !== void 0 && logicalId !== "" && !logicalId.startsWith("AWS::")) ids.add(logicalId);
-	};
-	const walk = (value) => {
-		if (Array.isArray(value)) {
-			for (const item of value) walk(item);
-			return;
-		}
-		if (value === null || typeof value !== "object") return;
-		const obj = value;
-		if (typeof obj["Ref"] === "string") addName(obj["Ref"]);
-		const getAtt = obj["Fn::GetAtt"];
-		if (typeof getAtt === "string") addName(getAtt);
-		else if (Array.isArray(getAtt) && typeof getAtt[0] === "string") addName(getAtt[0]);
-		for (const [key, nested] of Object.entries(obj)) {
-			if (key === "Fn::Sub") {
-				walkSub(nested);
-				continue;
-			}
-			walk(nested);
-		}
-	};
-	const walkSub = (sub) => {
-		const isPair = Array.isArray(sub);
-		const subTemplate = typeof sub === "string" ? sub : isPair ? sub[0] : void 0;
-		const variableMap = isPair && sub[1] !== null && typeof sub[1] === "object" ? sub[1] : void 0;
-		if (typeof subTemplate === "string") {
-			const declaredVars = new Set(variableMap === void 0 ? [] : Object.keys(variableMap));
-			for (const [, placeholder] of subTemplate.matchAll(/\$\{([^}]*)\}/g)) {
-				if (placeholder === void 0 || placeholder.startsWith("!")) continue;
-				if (declaredVars.has(placeholder)) continue;
-				addName(placeholder);
-			}
-		}
-		if (isPair) for (const [index, element] of sub.entries()) {
-			if (index === 1) {
-				if (variableMap !== void 0) for (const declared of Object.values(variableMap)) walk(declared);
-				continue;
-			}
-			walk(element);
-		}
-		else walk(sub);
+function finalSnapshotNameCut(physicalId, resourceType) {
+	const maxLength = resourceType === "AWS::ElastiCache::CacheCluster" || resourceType === "AWS::ElastiCache::ReplicationGroup" ? 50 : 255;
+	const sanitized = sanitizeSnapshotBase(physicalId);
+	const base = sanitized.slice(0, maxLength - 22).replace(/-+$/, "");
+	return {
+		prefix: `${base}-final-`,
+		sanitized,
+		kept: base.length
 	};
-	walk(entry);
-	return ids;
-}
-function bindingSkippedOutputs(pristineTemplate, record, changedLogicalIds) {
-	const binding = /* @__PURE__ */ new Set();
-	if (record === null || record === void 0) return binding;
-	const declared = pristineTemplate.Outputs ?? {};
-	for (const [outputKey, digest] of Object.entries(record)) {
-		if (!Object.prototype.hasOwnProperty.call(declared, outputKey)) continue;
-		const entry = declared[outputKey];
-		if (digest !== skippedOutputDigest(pristineTemplate, outputKey)) continue;
-		if (changedLogicalIds !== void 0 && [...referencedLogicalIds(entry)].some((id) => changedLogicalIds.has(id))) continue;
-		binding.add(outputKey);
-	}
-	return binding;
-}
-function skippedOutputsEqual(a, b) {
-	const aKeys = a === null || a === void 0 ? [] : Object.keys(a);
-	const bKeys = b === null || b === void 0 ? [] : Object.keys(b);
-	if (aKeys.length !== bKeys.length) return false;
-	return aKeys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && a?.[k] === b?.[k]);
 }
-
-//#endregion
-//#region src/deployment/outputs-export-alias/names.ts
-function isOutputSuppressedByCondition(output, conditions) {
-	return output.Condition !== void 0 && conditions?.[output.Condition] === false;
-}
-function collectPublishedOutputNames(outputs, conditions) {
-	const names = /* @__PURE__ */ new Set();
-	for (const [name, output] of Object.entries(outputs)) if (!isOutputSuppressedByCondition(output, conditions)) names.add(name);
-	return names;
-}
-function collectDeclaredOutputNames(outputs) {
-	return new Set(Object.keys(outputs));
+function buildFinalSnapshotIdentifier(physicalId, resourceType, now = /* @__PURE__ */ new Date()) {
+	const ts = now.toISOString().replace(/[-:]/g, "").replace(/\..*$/, "").replace("T", "-").toLowerCase();
+	return `${finalSnapshotNamePrefix(physicalId, resourceType)}${ts}`;
 }
-function isExportAliasCollision(exportName, outputKey, ownedOutputNames) {
-	return exportName !== outputKey && ownedOutputNames.has(exportName);
+const EBS_FINAL_SNAPSHOT_TAG_KEY = "cdkd:final-snapshot-of";
+const finalSnapshotDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
+const PRE_DELETE_SNAPSHOT_POLL_INTERVAL_MS = 5e3;
+const PRE_DELETE_SNAPSHOT_TIMEOUT_MS = 36e5;
+const REDSHIFT_CLUSTER_SETTLE_TIMEOUT_MS = 12e5;
+function errMsg(error) {
+	return describeAwsFailure(error).detail;
 }
-
-//#endregion
-//#region src/deployment/outputs-export-alias/secret-scan.ts
-const MIN_SECRET_NEEDLE = 4;
-const SECRET_SCAN_INVISIBLES = /[\p{Cc}\p{Cf}\p{Me}\p{Zl}\p{Zp}\p{Default_Ignorable_Code_Point}]/gu;
-const SECRET_DETECTION_ONLY = /\p{Mn}/gu;
-function detectionForms(canonical) {
-	return [canonical.normalize("NFD").replace(SECRET_DETECTION_ONLY, "").normalize("NFC"), canonical.normalize("NFKD").replace(SECRET_DETECTION_ONLY, "").normalize("NFKC")];
+function isVolumeNotFound(error) {
+	return (error instanceof Error ? error.name : "") === "InvalidVolume.NotFound" || errMsg(error).includes("InvalidVolume.NotFound");
 }
-const DETECTION_NEEDLES = /* @__PURE__ */ new WeakMap();
-function detectionNeedlesOf(secrets, plaintext, canonical) {
-	let cache = DETECTION_NEEDLES.get(secrets);
-	if (cache === void 0) {
-		cache = /* @__PURE__ */ new Map();
-		DETECTION_NEEDLES.set(secrets, cache);
+async function createEbsFinalSnapshot(client, volumeId, logicalId, logger) {
+	let snapshotId;
+	try {
+		snapshotId = (await client.send(new DescribeSnapshotsCommand({
+			OwnerIds: ["self"],
+			Filters: [{
+				Name: `tag:${EBS_FINAL_SNAPSHOT_TAG_KEY}`,
+				Values: [volumeId]
+			}, {
+				Name: "status",
+				Values: ["pending", "completed"]
+			}]
+		}))).Snapshots?.[0]?.SnapshotId;
+		if (snapshotId) logger.debug(`Reusing existing final snapshot ${snapshotId} for ${logicalId} (${volumeId}) from a previous destroy attempt`);
+	} catch (probeError) {
+		logger.debug(`Final-snapshot reuse probe failed for ${volumeId}: ${errMsg(probeError)}`);
 	}
-	let forms = cache.get(plaintext);
-	if (forms === void 0) {
-		forms = detectionForms(canonical);
-		cache.set(plaintext, forms);
+	if (!snapshotId) try {
+		snapshotId = (await client.send(new CreateSnapshotCommand({
+			VolumeId: volumeId,
+			Description: `cdkd final snapshot for ${volumeId} (DeletionPolicy: Snapshot)`,
+			TagSpecifications: [{
+				ResourceType: "snapshot",
+				Tags: [{
+					Key: EBS_FINAL_SNAPSHOT_TAG_KEY,
+					Value: volumeId
+				}]
+			}]
+		}))).SnapshotId;
+	} catch (createError) {
+		if (isVolumeNotFound(createError)) {
+			logger.debug(`Volume ${volumeId} no longer exists — skipping final snapshot for ${logicalId}`);
+			return null;
+		}
+		throw new CdkdError(`Failed to create the final snapshot for ${logicalId} (${volumeId}) required by DeletionPolicy: Snapshot: ${errMsg(createError)}. The volume was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
+	}
+	if (!snapshotId) throw new CdkdError(`CreateSnapshot for ${logicalId} (${volumeId}) returned no snapshot id. The volume was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
+	logger.info(`Creating final snapshot ${snapshotId} for ${logicalId} (${volumeId}) — DeletionPolicy: Snapshot`);
+	const deadline = Date.now() + PRE_DELETE_SNAPSHOT_TIMEOUT_MS;
+	let notFoundPolls = 0;
+	for (;;) {
+		let state;
+		try {
+			state = (await client.send(new DescribeSnapshotsCommand({ SnapshotIds: [snapshotId] }))).Snapshots?.[0]?.State;
+			notFoundPolls = 0;
+		} catch (pollError) {
+			if (((pollError instanceof Error ? pollError.name : "") === "InvalidSnapshot.NotFound" || errMsg(pollError).includes("InvalidSnapshot.NotFound")) && ++notFoundPolls <= 24) state = void 0;
+			else throw new CdkdError(`Failed while waiting for final snapshot ${snapshotId} of ${logicalId} (${volumeId}): ${errMsg(pollError)}. The volume was NOT deleted; re-run the destroy (the snapshot is reused, not duplicated).`, "FINAL_SNAPSHOT_FAILED", pollError instanceof Error ? pollError : void 0);
+		}
+		if (state === "completed") {
+			logger.info(`Final snapshot ${snapshotId} completed for ${logicalId} (${volumeId})`);
+			return snapshotId;
+		}
+		if (state === "error") throw new CdkdError(`Final snapshot ${snapshotId} for ${logicalId} (${volumeId}) entered 'error' state. The volume was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
+		if (Date.now() >= deadline) throw new CdkdError(`Timed out waiting for final snapshot ${snapshotId} of ${logicalId} (${volumeId}) to complete. The volume was NOT deleted; the snapshot continues in AWS — re-run the destroy once it completes (the existing snapshot is reused, not duplicated).`, "FINAL_SNAPSHOT_TIMEOUT");
+		await finalSnapshotDelays.sleep(PRE_DELETE_SNAPSHOT_POLL_INTERVAL_MS);
 	}
-	return forms;
-}
-function canonicalForSecretScan(text) {
-	return secretScanHaystacks(text)[0];
 }
-function secretScanHaystacks(text) {
-	const untrimmed = text.replace(SECRET_SCAN_INVISIBLES, "");
-	return [untrimmed.trim(), untrimmed];
+function isFinalSnapshotError(error) {
+	return error instanceof CdkdError && (error.code === "FINAL_SNAPSHOT_FAILED" || error.code === "FINAL_SNAPSHOT_TIMEOUT" || error.code === "FINAL_SNAPSHOT_UNSUPPORTED");
 }
-function canonicalNeedle(plaintext) {
-	return plaintext.replace(SECRET_SCAN_INVISIBLES, "");
+function ccRoutedFinalSnapshotError(logicalId, resourceType, skipFlagHint) {
+	return new CdkdError(`${logicalIdShown(logicalId)} (${resourceTypeShown(resourceType)}) has DeletionPolicy: Snapshot, but the resource is managed via the Cloud Control API route (provisionedBy: cc-api), which has no final-snapshot delete parameter — deleting it now would destroy its data WITHOUT the final snapshot the policy promises. Create a snapshot manually (e.g. aws rds create-db-snapshot / aws elasticache create-snapshot), then re-run with ${skipFlagHint} to delete WITHOUT cdkd's final snapshot (DATA LOSS otherwise), or retain the resource (DeletionPolicy: Retain) and delete it manually.`, "FINAL_SNAPSHOT_UNSUPPORTED");
 }
-function canonicalNeedles(secrets) {
-	const out = /* @__PURE__ */ new Map();
-	for (const [plaintext, expression] of secrets ?? []) {
-		const needle = canonicalNeedle(plaintext);
-		if (needle.length > 0) out.set(needle, expression);
-	}
-	return out;
+function unsupportedFinalSnapshotError(logicalId, resourceType, skipFlagHint) {
+	return new CdkdError(`${logicalIdShown(logicalId)} (${resourceTypeShown(resourceType)}) has DeletionPolicy: Snapshot, but cdkd does not implement final snapshots for this type (CloudFormation itself only supports Snapshot on: EC2 Volume, ElastiCache CacheCluster / ReplicationGroup, Neptune / RDS / DocDB clusters, RDS instances, Redshift clusters). Deleting it now would destroy its data WITHOUT the final snapshot the policy promises. Re-run with ${skipFlagHint} to delete WITHOUT a final snapshot (DATA LOSS), or retain the resource (DeletionPolicy: Retain) and delete it manually after snapshotting.`, "FINAL_SNAPSHOT_UNSUPPORTED");
 }
-function secretsPresentIn(text, secrets) {
-	if (!secrets || secrets.size === 0) return void 0;
-	const haystacks = secretScanHaystacks(text);
-	const [markedUntrimmed, foldedUntrimmed] = detectionForms(haystacks[1]);
-	const [markedTrimmed, foldedTrimmed] = detectionForms(haystacks[0]);
-	const wideHaystacks = [[
-		markedUntrimmed.trim(),
-		markedUntrimmed,
-		markedTrimmed
-	], [
-		foldedUntrimmed.trim(),
-		foldedUntrimmed,
-		foldedTrimmed
-	]];
-	const exposure = /* @__PURE__ */ new Map();
-	for (const [plaintext, expression] of secrets) {
-		const needle = canonicalNeedle(plaintext);
-		const canonicalHit = haystacks.some((haystack) => haystack === needle || needle.length >= 4 && haystack.includes(needle));
-		const [markedNeedle, foldedNeedle] = detectionNeedlesOf(secrets, plaintext, needle);
-		const hitIn = (wides, wideNeedle, floor) => wides.some((wide) => wide === wideNeedle || floor >= 4 && wide.includes(wideNeedle));
-		const wideHit = hitIn(wideHaystacks[0], markedNeedle, markedNeedle.length) || hitIn(wideHaystacks[1], foldedNeedle, Math.min(markedNeedle.length, foldedNeedle.length));
-		const rawHit = plaintext.length >= 4 && text.includes(plaintext);
-		if (canonicalHit || wideHit || rawHit) exposure.set(plaintext, expression);
+async function createPreDeleteFinalSnapshot(resourceType, physicalId, logicalId, clients, logger) {
+	switch (resourceType) {
+		case "AWS::EC2::Volume": return createEbsFinalSnapshot(clients.ec2, physicalId, logicalId, logger);
+		case "AWS::Redshift::Cluster": return createRedshiftFinalSnapshot(clients.redshift, physicalId, logicalId, logger);
+		case "AWS::ElastiCache::ReplicationGroup": return createReplicationGroupFinalSnapshot(clients.elastiCache, physicalId, logicalId, logger);
+		default: throw new CdkdError(`No pre-delete final-snapshot implementation for ${logicalId} (${resourceType}). The resource was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
 	}
-	return exposure.size > 0 ? exposure : void 0;
 }
-function exportNameSecretExposure(exportName, substitutedIntoName, recordedThisPass, noEchoParameterValues) {
-	const exposure = new Map(substitutedIntoName);
-	for (const [plaintext, expression] of secretsPresentIn(exportName, recordedThisPass) ?? []) exposure.set(plaintext, expression);
-	for (const corpus of [substitutedIntoName, noEchoParameterValues]) {
-		if (corpus === void 0) continue;
-		for (const [plaintext, expression] of secretsPresentIn(exportName, printingCorpusOf(corpus)) ?? []) if (!exposure.has(plaintext)) exposure.set(plaintext, expression);
+async function waitForNamedSnapshot(opts) {
+	const { snapshotId, logicalId, sourceId, noun, logger } = opts;
+	logger.info(`${opts.reused ? "Resuming" : "Creating"} final snapshot ${snapshotId} for ${logicalId} (${sourceId}) — DeletionPolicy: Snapshot`);
+	const deadline = Date.now() + PRE_DELETE_SNAPSHOT_TIMEOUT_MS;
+	let notFoundPolls = 0;
+	for (;;) {
+		let status;
+		try {
+			status = await opts.pollStatus();
+			notFoundPolls = 0;
+		} catch (pollError) {
+			if (opts.isTransientNotFound(pollError) && ++notFoundPolls <= 24) status = void 0;
+			else throw new CdkdError(`Failed while waiting for final snapshot ${snapshotId} of ${logicalId} (${sourceId}): ${errMsg(pollError)}. The ${noun} was NOT deleted; re-run the delete (the snapshot is reused, not duplicated).`, "FINAL_SNAPSHOT_FAILED", pollError instanceof Error ? pollError : void 0);
+		}
+		if (status === opts.readyStatus) {
+			logger.info(`Final snapshot ${snapshotId} ready for ${logicalId} (${sourceId})`);
+			return snapshotId;
+		}
+		if (status !== void 0 && opts.failedStatuses.includes(status)) throw new CdkdError(`Final snapshot ${snapshotId} for ${logicalId} (${sourceId}) entered '${status}' state. The ${noun} was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
+		if (Date.now() >= deadline) throw new CdkdError(`Timed out waiting for final snapshot ${snapshotId} of ${logicalId} (${sourceId}) to become ready. The ${noun} was NOT deleted; the snapshot continues in AWS — re-run the delete once it is ready (the existing snapshot is reused, not duplicated).`, "FINAL_SNAPSHOT_TIMEOUT");
+		await finalSnapshotDelays.sleep(PRE_DELETE_SNAPSHOT_POLL_INTERVAL_MS);
 	}
-	return exposure.size > 0 ? exposure : void 0;
-}
-function carriedExportAliasExposure(exportName, recordedThisPass, noEchoParameterValues) {
-	const carried = /* @__PURE__ */ new Map();
-	shareLogOnlyValues(carried, recordedThisPass);
-	const exposure = exportNameSecretExposure(exportName, carried, recordedThisPass, noEchoParameterValues);
-	if (exposure === void 0) return void 0;
-	return {
-		exposure,
-		noEchoOnly: isNoEchoOnlyExposure(exposure, carried, recordedThisPass)
-	};
 }
-function exportNameNoEchoParameters(exportName, sources) {
-	if (sources === void 0 || exportName === null || typeof exportName !== "object") return [];
-	return noEchoParametersReadBy(exportName, sources);
+function errorNameOrMessageIncludes(error, token) {
+	return (error instanceof Error ? error.name : "") === token || errMsg(error).includes(token);
 }
-function isNoEchoOnlyExposure(exposure, substitutedIntoName, recordedThisPass) {
-	for (const plaintext of exposure.keys()) if (substitutedIntoName.has(plaintext) || recordedThisPass?.has(plaintext) === true) return false;
-	return exposure.size > 0;
+const REUSE_PROBE_MAX_PAGES = 10;
+function generatedSnapshotNameMatcher(physicalId, resourceType) {
+	const escaped = finalSnapshotNamePrefix(physicalId, resourceType).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	return new RegExp(`^${escaped}\\d{8}-\\d{6}$`);
 }
-function noEchoParameterValueSeed(parameters, values, inherited, userParameters) {
-	const seed = /* @__PURE__ */ new Map();
-	if (values === void 0) return seed;
-	for (const [name, value] of Object.entries(values)) {
-		if (isWholeDynamicReferenceValue(value)) continue;
-		if (parameters?.[name]?.NoEcho === true) {
-			const type = parameters[name]?.Type;
-			const ssmTyped = typeof type === "string" && type.startsWith("AWS::SSM::Parameter::Value<");
-			const spelled = Object.prototype.hasOwnProperty.call(userParameters ?? {}, name) ? userParameters?.[name] : parameters[name]?.Default;
-			if (!(ssmTyped && typeof value === "string" && (typeof spelled === "string" || typeof spelled === "number") && value === String(spelled))) recordLogOnlyParameterValue(seed, value);
-			if (!ssmTyped && (typeof spelled === "string" || typeof spelled === "number") && !isWholeDynamicReferenceValue(spelled)) recordLogOnlyParameterValue(seed, String(spelled));
+const RESUMABLE_SNAPSHOT_STATUS = "creating";
+async function createRedshiftFinalSnapshot(client, clusterId, logicalId, logger) {
+	const matches = generatedSnapshotNameMatcher(clusterId, "AWS::Redshift::Cluster");
+	let snapshotId;
+	try {
+		let marker;
+		for (let page = 0; page < REUSE_PROBE_MAX_PAGES && !snapshotId; page++) {
+			const existing = await client.send(new DescribeClusterSnapshotsCommand({
+				ClusterIdentifier: clusterId,
+				SnapshotType: "manual",
+				...marker !== void 0 && { Marker: marker }
+			}));
+			snapshotId = existing.Snapshots?.find((s) => s.SnapshotIdentifier !== void 0 && matches.test(s.SnapshotIdentifier) && s.Status === RESUMABLE_SNAPSHOT_STATUS)?.SnapshotIdentifier;
+			marker = existing.Marker;
+			if (marker === void 0) break;
 		}
-		if (inherited !== void 0) carryLogOnlyValuesCarriedBy(inherited, seed, value);
+		if (snapshotId) logger.debug(`Resuming in-flight final snapshot ${snapshotId} for ${logicalId} (${clusterId}) from a previous delete attempt`);
+	} catch (probeError) {
+		logger.debug(`Final-snapshot reuse probe failed for ${clusterId}: ${errMsg(probeError)}`);
 	}
-	return seed;
-}
-function isWholeDynamicReferenceValue(value) {
-	if (typeof value === "string") return isSingleDynamicReferenceToken(value);
-	return Array.isArray(value) && value.length > 0 && value.every((element) => typeof element === "string" && isSingleDynamicReferenceToken(element));
-}
-function stateKeySecretExposure(key, secrets) {
-	return secretsPresentIn(key, secrets);
-}
-function maskEveryOccurrence(text, exposure) {
-	let out = text;
-	for (const value of Array.from(exposure.keys()).sort((a, b) => b.length - a.length)) out = out.split(value).join("***");
-	return out;
-}
-
-//#endregion
-//#region src/deployment/outputs-export-alias/warnings.ts
-function secretBearingExportNameWarning(outputKey, exportName, exposure, secrets, noEchoOnly = false) {
-	const corpus = printingCorpusOf(secrets ?? exposure);
-	const name = secretSafeKeyDisplay(exportName, corpus, exposure);
-	const shown = name.kind === "masked" ? `${maskedLabel(name.text)} ` : "";
-	const ownerForceMask = /* @__PURE__ */ new Map();
-	const ownerHaystacks = secretScanHaystacks(outputKey);
-	for (const [plaintext, expression] of exposure) {
-		const needle = canonicalNeedle(plaintext);
-		if (ownerHaystacks.some((haystack) => haystack === needle) || plaintext.length >= 4) ownerForceMask.set(plaintext, expression);
+	const reused = snapshotId !== void 0;
+	if (!snapshotId) {
+		const newId = buildFinalSnapshotIdentifier(clusterId, "AWS::Redshift::Cluster");
+		try {
+			await client.send(new CreateClusterSnapshotCommand({
+				SnapshotIdentifier: newId,
+				ClusterIdentifier: clusterId
+			}));
+			snapshotId = newId;
+		} catch (createError) {
+			if (errorNameOrMessageIncludes(createError, "ClusterNotFoundFault")) {
+				logger.debug(`Redshift cluster ${clusterId} no longer exists — skipping final snapshot for ${logicalId}`);
+				return null;
+			}
+			if (errorNameOrMessageIncludes(createError, "InvalidClusterStateFault")) {
+				logger.info(`Redshift cluster ${clusterId} is not in a snapshottable state (likely already deleting) — skipping the final snapshot for ${logicalId}: ${errMsg(createError)}`);
+				return null;
+			}
+			throw new CdkdError(`Failed to create the final snapshot for ${logicalId} (${clusterId}) required by DeletionPolicy: Snapshot: ${errMsg(createError)}. The cluster was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
+		}
 	}
-	const owner = displayTextOrWithheld(secretSafeKeyDisplay(outputKey, corpus, ownerForceMask));
-	if (noEchoOnly) return `Output ${owner} has an Export.Name that resolves to a value containing a secret ${shown}— skipping the export alias. The name contains the value of a NoEcho template parameter, or a value derived from one: the whole name at any length, or embedded at 4 or more characters, even where the match is a coincidence. An export name becomes a key in state.json and in the exports index, where the value would be stored in plaintext. An existing Fn::ImportValue of this name stops resolving. Rename the export, or choose a NoEcho value the name does not contain.`;
-	return `Output ${owner} has an Export.Name that resolves to a value containing a secret ${shown}— skipping the export alias. An export name becomes a key in state.json and in the exports index, and redaction rewrites VALUES only, so publishing it would persist the secret in plaintext. Use a non-secret Export.Name.`;
+	const readySnapshotId = await waitForNamedSnapshot({
+		snapshotId,
+		logicalId,
+		sourceId: clusterId,
+		noun: "cluster",
+		reused,
+		readyStatus: "available",
+		failedStatuses: [
+			"failed",
+			"cancelled",
+			"deleted"
+		],
+		pollStatus: async () => {
+			return (await client.send(new DescribeClusterSnapshotsCommand({ SnapshotIdentifier: snapshotId }))).Snapshots?.[0]?.Status;
+		},
+		isTransientNotFound: (e) => errorNameOrMessageIncludes(e, "ClusterSnapshotNotFoundFault"),
+		logger
+	});
+	await waitForRedshiftClusterSettled(client, clusterId, logicalId, logger);
+	return readySnapshotId;
 }
-function noEchoParameterExportNameWarning(outputKey, parameterNames, secrets) {
-	const owner = displayTextOrWithheld(secretSafeKeyDisplay(outputKey, printingCorpusOf(secrets)));
-	const names = parameterNames.map((name) => displayIdent(name, { listMember: true })).join(", ");
-	return `Output ${owner} has an Export.Name that reads the NoEcho template ${parameterNames.length === 1 ? "parameter" : "parameters"} ${names} — skipping the export alias. An export name becomes a key in state.json and in the exports index, where the value would be stored in plaintext, so a name built from a NoEcho parameter is refused whatever the value's length. An existing Fn::ImportValue of this name stops resolving. Build the Export.Name without the NoEcho parameter.`;
-}
-function mergedExposure(a, b) {
-	if (a === void 0) return b;
-	if (b === void 0) return a;
-	return new Map([...a, ...b]);
-}
-function secretSafeKeyDisplay(key, secrets, forceMask) {
-	const [shown, untrimmed] = secretScanHaystacks(key);
-	const exposure = mergedExposure(stateKeySecretExposure(key, secrets), forceMask === void 0 ? void 0 : secretsPresentIn(key, forceMask));
-	const mask = canonicalNeedles(forceMask);
-	for (const [plaintext, expression] of exposure ?? []) {
-		const needle = canonicalNeedle(plaintext);
-		if (needle.length > 0) mask.set(needle, expression);
-	}
-	if (mask.size === 0) return {
-		kind: "safe",
-		text: shown
-	};
-	const masked = maskEveryOccurrence(untrimmed, mask);
-	if (masked === untrimmed) return exposure ? { kind: "withheld" } : {
-		kind: "safe",
-		text: shown
-	};
-	if (stateKeySecretExposure(masked, secrets) || forceMask !== void 0 && secretsPresentIn(masked, forceMask)) return { kind: "withheld" };
-	return {
-		kind: "masked",
-		text: canonicalForSecretScan(masked)
-	};
-}
-function secretBearing(display) {
-	return display.kind !== "safe";
-}
-const WITHHELD_NAME_DISPLAY = "<name withheld: contains a secret>";
-function displayTextOrWithheld(display) {
-	return display.kind === "withheld" ? WITHHELD_NAME_DISPLAY : display.text;
-}
-function maskedLabel(maskedText) {
-	return /[^ -~]/.test(maskedText) ? "(masked, name withheld: it carries characters this line cannot show as tested)" : `(masked: ${displayIdent(maskedText)})`;
-}
-function secretBearingStateKeyWarning(stackName, display) {
-	const clause = display.kind === "masked" ? `${maskedLabel(display.text)} ` : `(the name is withheld: masking it would leave the secret readable) `;
-	return `State for ${displayStackName(canonicalForSecretScan(stackName))} holds an output KEY that renders a secret ${clause}— cdkd scrub cannot rewrite a key, only a value, because the key IS the export name consumers resolve by. Give that output a non-secret Export.Name and redeploy: the next deploy replaces state.outputs and the exports index entirely. ROTATE the exposed secret.`;
-}
-function exportAliasCollisionWarning(outputKey, exportName, secrets) {
-	const corpus = printingCorpusOf(secrets);
-	const shown = displayTextOrWithheld(secretSafeKeyDisplay(exportName, corpus));
-	const from = displayTextOrWithheld(secretSafeKeyDisplay(outputKey, corpus));
-	return `Output ${from} exports as "${shown}", which is also the name of another output in this stack — skipping the export alias, so output ${shown} keeps its own value and the export is not published. A consumer's Fn::ImportValue on "${shown}" therefore resolves to output ${shown}, NOT to ${from} (CloudFormation would publish both). Rename the export, or the colliding output.`;
-}
-function exportAliasCollisionScrubWarning(outputKey, exportName, secrets) {
-	const corpus = printingCorpusOf(secrets);
-	const nameDisplay = (name) => secretSafeKeyDisplay(name, corpus);
-	const exportDisplay = nameDisplay(exportName);
-	const shown = displayTextOrWithheld(exportDisplay);
-	const storedUnder = exportDisplay.kind === "withheld" ? "the stored value under that name" : `the stored value under "${shown}"`;
-	const ownerDisplay = nameDisplay(outputKey);
-	return `Output ${ownerDisplay.kind === "withheld" && exportDisplay.kind === "withheld" ? "<the owning output, name withheld: contains a secret>" : displayTextOrWithheld(ownerDisplay)} exports as ${exportDisplay.kind === "withheld" ? shown : `"${shown}"`}, which is also the name of another output in this stack — state cannot say which of the two ${storedUnder} came from, so that key is redacted by value match instead of by template position, and two references resolving to the same value could still collapse there. Rename the export, or the colliding output, and redeploy.`;
-}
-
-//#endregion
-//#region src/deployment/deploy-engine/outputs.ts
-var ForwardingSecrets = class extends Map {
-	target;
-	constructor(target) {
-		super();
-		this.target = target;
-	}
-	set(plaintext, expression) {
-		super.set(plaintext, expression);
-		this.target?.set(plaintext, expression);
-		return this;
-	}
-};
-function handleOutputResolutionFailure(error, outputKey, outputs, secrets, inheritedSecrets) {
-	const union = unionOfSecretBags([inheritedSecrets, secrets]);
-	const detail = maskSecretsInText(error instanceof Error ? error.message || error.name : String(error), union);
-	if (this.options.strictGetAtt) {
-		const cause = typeof error === "string" ? maskSecretsInText(error, union) : maskSecretsInError(error, union);
-		throw new Error(`Failed to resolve output ${outputKey}: ${detail} (--strict-getatt promotes output resolution failures to deploy errors; drop the flag to skip the output instead)`, cause instanceof Error || typeof cause === "string" ? { cause } : {});
+async function waitForRedshiftClusterSettled(client, clusterId, logicalId, logger) {
+	const deadline = Date.now() + REDSHIFT_CLUSTER_SETTLE_TIMEOUT_MS;
+	for (;;) {
+		let status;
+		try {
+			status = (await client.send(new DescribeClustersCommand({ ClusterIdentifier: clusterId }))).Clusters?.[0]?.ClusterStatus;
+		} catch (pollError) {
+			if (errorNameOrMessageIncludes(pollError, "ClusterNotFoundFault")) return;
+			logger.debug(`Could not read Redshift cluster ${clusterId} while waiting for it to settle: ${errMsg(pollError)}`);
+			return;
+		}
+		if (status === void 0 || status === "available") {
+			await finalSnapshotDelays.sleep(PRE_DELETE_SNAPSHOT_POLL_INTERVAL_MS);
+			return;
+		}
+		if (Date.now() >= deadline) {
+			logger.info(`Redshift cluster ${clusterId} (${logicalId}) is still '${status}' after the post-snapshot settle wait — proceeding with the delete anyway.`);
+			return;
+		}
+		logger.debug(`Waiting for Redshift cluster ${clusterId} to settle (status: ${status})`);
+		await finalSnapshotDelays.sleep(PRE_DELETE_SNAPSHOT_POLL_INTERVAL_MS);
 	}
-	this.logger.warn(`Failed to resolve output ${outputKey}: ${detail}`);
-	outputs[outputKey] = void 0;
 }
-async function resolveOutputs(template, resources, stackName, digestSource, parameterValues, conditions) {
-	this.resolvedExportNames = [];
-	this.carriedExportAliasRefusal = void 0;
-	if (!template.Outputs) {
-		this.carriedExportAliasRefusal = seedOnlyAliasRefusal(noEchoParameterValueSeed(template.Parameters, parameterValues, this.options.inheritedSecrets, this.options.parameters));
-		return {};
-	}
-	const outputs = Object.create(null);
-	const context = this.buildResolverContext({
-		template,
-		resources,
-		...parameterValues && { parameters: parameterValues },
-		...conditions && { conditions }
-	}, stackName);
-	context.printingSecrets = /* @__PURE__ */ new Map();
-	const refuseMaskedOutputReads = (outputKey, ownReads) => {
-		const added = ownReads.filter((read) => read.kind === "ref-state-key");
-		if (added.length === 0) return;
-		throw markNonRetryable(/* @__PURE__ */ new Error(`Cannot resolve ${added.map((read) => read.display).join(", ")} for output ${outputKey}: cdkd's recorded state holds only the redaction mask there, so this output would publish a value cdkd cannot confirm (for most such types the resource's raw physical id) instead of the value CloudFormation's Ref returns — a possibly wrong value that a consuming stack's Fn::ImportValue would accept and send to AWS. The output is not published. ${DeployEngine.maskedRecordRemedyFor(added, context.resources)}`));
-	};
-	const outputsPassSecrets = context.recordedSecretValues ?? EMPTY_SECRETS;
-	const outputsPassInherited = context.inheritedSecrets ?? EMPTY_SECRETS;
-	if (context.recordedSecretValues) this.outputsPassSecretMaps.push(context.recordedSecretValues);
-	const publishedOutputNames = collectPublishedOutputNames(template.Outputs, conditions);
-	let outputsPassCompleted = false;
+async function createReplicationGroupFinalSnapshot(client, replicationGroupId, logicalId, logger) {
+	let snapshotSource;
 	try {
-		for (const [outputKey, output] of Object.entries(template.Outputs)) {
-			if (isOutputSuppressedByCondition(output, conditions)) {
-				this.logger.debug(`Skipping output ${outputKey} — condition ${output.Condition} is false`);
-				continue;
-			}
-			const ownReads = [];
-			try {
-				const resolved = await this.resolver.resolve(output.Value, {
-					...context,
-					redactedAttributeReads: ownReads
-				});
-				refuseMaskedOutputReads(outputKey, ownReads);
-				if (resolved === void 0 && this.options.strictGetAtt) throw markNonRetryable(/* @__PURE__ */ new Error("the value resolved to nothing"));
-				outputs[outputKey] = resolved;
-			} catch (error) {
-				this.handleOutputResolutionFailure(error, outputKey, outputs, outputsPassSecrets, outputsPassInherited);
-			}
+		const group = (await client.send(new DescribeReplicationGroupsCommand({ ReplicationGroupId: replicationGroupId }))).ReplicationGroups?.[0];
+		if (group === void 0) {
+			logger.debug(`Replication group ${replicationGroupId} no longer exists — skipping final snapshot for ${logicalId}`);
+			return null;
 		}
-		const noEchoSeed = noEchoParameterValueSeed(template.Parameters, parameterValues, context.inheritedSecrets, this.options.parameters);
-		const noEchoSources = this.noEchoPositionSources(resources, template, conditions);
-		this.carriedExportAliasRefusal = (outputKey, exportName) => {
-			const verdict = carriedExportAliasExposure(exportName, outputsPassSecrets, noEchoSeed);
-			if (verdict === void 0) return void 0;
-			return secretBearingExportNameWarning(outputKey, exportName, verdict.exposure, context.recordedSecretValues, verdict.noEchoOnly);
-		};
-		const resolvedNames = [];
-		for (const [outputKey, output] of Object.entries(template.Outputs)) {
-			if (isOutputSuppressedByCondition(output, conditions)) continue;
-			if (!output.Export?.Name) continue;
-			const value = outputs[outputKey];
-			if (value === void 0) continue;
-			const nameSecrets = new ForwardingSecrets(context.recordedSecretValues);
-			if (context.recordedSecretValues) shareLogOnlyValues(nameSecrets, context.recordedSecretValues);
-			const nameReads = [];
-			let exportName;
-			try {
-				exportName = typeof output.Export.Name === "string" ? output.Export.Name : await this.resolver.resolve(output.Export.Name, {
-					...context,
-					recordedSecretValues: nameSecrets,
-					redactedAttributeReads: nameReads
-				});
-				refuseMaskedOutputReads(outputKey, nameReads);
-			} catch (error) {
-				this.handleOutputResolutionFailure(error, outputKey, outputs, outputsPassSecrets, outputsPassInherited);
-				continue;
-			}
-			if (typeof exportName !== "string") continue;
-			resolvedNames.push({
-				outputKey,
-				exportName,
-				value,
-				outputValue: output.Value,
-				nameSource: output.Export.Name,
-				nameSecrets
-			});
+		if (group.ClusterEnabled === true) snapshotSource = { ReplicationGroupId: replicationGroupId };
+		else {
+			const member = group.NodeGroups?.flatMap((n) => n.NodeGroupMembers ?? []).find((m) => m.CurrentRole === "primary")?.CacheClusterId ?? group.MemberClusters?.[0];
+			if (member === void 0) throw new CdkdError(`Replication group ${replicationGroupId} (${logicalId}) has cluster-mode disabled but reports no member cache cluster to snapshot. The replication group was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
+			snapshotSource = { CacheClusterId: member };
 		}
-		for (const { outputKey, exportName, value, outputValue, nameSource, nameSecrets } of resolvedNames) {
-			const noEchoParameters = exportNameNoEchoParameters(nameSource, noEchoSources);
-			const exposure = noEchoParameters.length > 0 ? void 0 : exportNameSecretExposure(exportName, nameSecrets, context.recordedSecretValues, noEchoSeed);
-			if (noEchoParameters.length > 0) this.logger.warn(noEchoParameterExportNameWarning(outputKey, noEchoParameters, outputsPassSecrets));
-			else if (exposure) this.logger.warn(secretBearingExportNameWarning(outputKey, exportName, exposure, context.recordedSecretValues, isNoEchoOnlyExposure(exposure, nameSecrets, context.recordedSecretValues)));
-			else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) this.logger.warn(exportAliasCollisionWarning(outputKey, exportName, outputsPassSecrets));
-			else {
-				outputs[exportName] = value;
-				if (!this.resolvedExportNames.includes(exportName)) this.resolvedExportNames.push(exportName);
-				this.outputsTemplateSource[exportName] = outputValue;
-			}
+	} catch (describeError) {
+		if (describeError instanceof CdkdError) throw describeError;
+		if (errorNameOrMessageIncludes(describeError, "ReplicationGroupNotFoundFault")) {
+			logger.debug(`Replication group ${replicationGroupId} no longer exists — skipping final snapshot for ${logicalId}`);
+			return null;
 		}
-		outputsPassCompleted = true;
-	} finally {
-		if (!outputsPassCompleted) this.outputsSourceUsable = false;
+		throw new CdkdError(`Failed to read replication group ${replicationGroupId} (${logicalId}) to pick the final snapshot source required by DeletionPolicy: Snapshot: ${errMsg(describeError)}. The replication group was NOT deleted.`, "FINAL_SNAPSHOT_FAILED", describeError instanceof Error ? describeError : void 0);
 	}
-	for (const [outputKey, output] of Object.entries(template.Outputs)) {
-		if (!publishedOutputNames.has(outputKey)) continue;
-		this.outputsTemplateSource[outputKey] = output.Value;
+	const matches = generatedSnapshotNameMatcher(replicationGroupId, "AWS::ElastiCache::ReplicationGroup");
+	let snapshotId;
+	try {
+		let marker;
+		for (let page = 0; page < REUSE_PROBE_MAX_PAGES && !snapshotId; page++) {
+			const existing = await client.send(new DescribeSnapshotsCommand$1({
+				...snapshotSource,
+				...marker !== void 0 && { Marker: marker }
+			}));
+			snapshotId = existing.Snapshots?.find((s) => s.SnapshotName !== void 0 && matches.test(s.SnapshotName) && s.SnapshotStatus === RESUMABLE_SNAPSHOT_STATUS)?.SnapshotName;
+			marker = existing.Marker;
+			if (marker === void 0) break;
+		}
+		if (snapshotId) logger.debug(`Resuming in-flight final snapshot ${snapshotId} for ${logicalId} (${replicationGroupId}) from a previous delete attempt`);
+	} catch (probeError) {
+		logger.debug(`Final-snapshot reuse probe failed for ${replicationGroupId}: ${errMsg(probeError)}`);
 	}
-	this.skippedOutputs = collectSkippedOutputs(digestSource, outputs);
-	return markSameGenerationBag(outputs);
-}
-function buildDisplayOutputs(template, resolvedOutputs) {
-	const display = {};
-	if (!template.Outputs) return display;
-	for (const key of Object.keys(template.Outputs)) {
-		const v = resolvedOutputs[key];
-		if (v !== void 0) display[key] = v;
+	const reused = snapshotId !== void 0;
+	if (!snapshotId) {
+		const newId = buildFinalSnapshotIdentifier(replicationGroupId, "AWS::ElastiCache::ReplicationGroup");
+		try {
+			await client.send(new CreateSnapshotCommand$1({
+				...snapshotSource,
+				SnapshotName: newId
+			}));
+			snapshotId = newId;
+		} catch (createError) {
+			if (errorNameOrMessageIncludes(createError, "ReplicationGroupNotFoundFault")) {
+				logger.debug(`Replication group ${replicationGroupId} no longer exists — skipping final snapshot for ${logicalId}`);
+				return null;
+			}
+			if (errorNameOrMessageIncludes(createError, "InvalidReplicationGroupStateFault")) {
+				logger.info(`Replication group ${replicationGroupId} is not in a snapshottable state (likely already deleting) — skipping the final snapshot for ${logicalId}: ${errMsg(createError)}`);
+				return null;
+			}
+			throw new CdkdError(`Failed to create the final snapshot for ${logicalId} (${replicationGroupId}) required by DeletionPolicy: Snapshot: ${errMsg(createError)}. The replication group was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
+		}
 	}
-	return display;
-}
-function seedOnlyAliasRefusal(seed) {
-	return (outputKey, exportName) => {
-		const verdict = carriedExportAliasExposure(exportName, /* @__PURE__ */ new Map(), seed);
-		if (verdict === void 0) return void 0;
-		return secretBearingExportNameWarning(outputKey, exportName, verdict.exposure, EMPTY_SECRETS, verdict.noEchoOnly);
-	};
+	return waitForNamedSnapshot({
+		snapshotId,
+		logicalId,
+		sourceId: replicationGroupId,
+		noun: "replication group",
+		reused,
+		readyStatus: "available",
+		failedStatuses: ["failed"],
+		pollStatus: async () => {
+			return (await client.send(new DescribeSnapshotsCommand$1({ SnapshotName: snapshotId }))).Snapshots?.[0]?.SnapshotStatus;
+		},
+		isTransientNotFound: (e) => errorNameOrMessageIncludes(e, "SnapshotNotFoundFault"),
+		logger
+	});
 }
 
 //#endregion
@@ -28388,1159 +28204,1378 @@ function extractDeploymentEventError(err) {
 }
 
 //#endregion
-//#region src/state/deployment-events-store.ts
-const DEPLOYMENT_EVENTS_MAX_INDEX_RUNS = 20;
-const FLUSH_INTERVAL_MS = 2e3;
-const FLUSH_EVENT_THRESHOLD = 50;
-function newDeploymentRunId(now = /* @__PURE__ */ new Date()) {
-	return `${now.toISOString().replace(/[-:.]/g, "")}-${randomUUID().slice(0, 8)}`;
+//#region src/deployment/rollback-executor/types.ts
+const NESTED_STACK_RESOURCE_TYPE$1 = "AWS::CloudFormation::Stack";
+const nonEmptyString = (v) => typeof v === "string" && v.length > 0;
+
+//#endregion
+//#region src/deployment/rollback-executor/messages.ts
+function throwIfDeleteSkipped(result, logicalId, physicalId, duringClause, guardScope) {
+	recordRollbackDeleteGuards(result, logicalId, physicalId, guardScope);
+	const reason = deleteSkipReason(result);
+	if (reason === void 0) return;
+	throw new Error(deleteSkippedMessage(logicalId, physicalId, reason, duringClause));
 }
-function deploymentEventsKey(prefix, stackName, region, runId) {
-	return `${prefix}/${stackName}/${region}/deployments/${runId}.jsonl`;
+function recordRollbackDeleteGuards(result, logicalId, physicalId, scope) {
+	for (const guard of deleteIndeterminateGuards(result)) scope.ctx.recordEvent?.({
+		eventType: "RESOURCE_GUARD_INDETERMINATE",
+		stackName: scope.stackName,
+		operation: "DELETE",
+		logicalId,
+		resourceType: scope.resourceType,
+		...scope.provisionedBy && { provisionedBy: scope.provisionedBy },
+		...physicalId && { physicalId: scope.mask(physicalId) },
+		guard: guard.guard,
+		reason: scope.mask(guard.reason)
+	});
 }
-function deploymentEventsIndexKey(prefix, stackName, region) {
-	return `${prefix}/${stackName}/${region}/deployments/index.json`;
+const SKIP_FINAL_SNAPSHOT_FLAG = "--skip-final-snapshot";
+const REPLAYING_STATE_CREATE_CONTEXT = { replayingState: true };
+function replayingStateCreateContext(secrets) {
+	return {
+		...REPLAYING_STATE_CREATE_CONTEXT,
+		maskSecrets: createSecretMasker(secrets)
+	};
 }
-function deploymentsDirPrefix(prefix, stackName, region) {
-	return `${prefix}/${stackName}/${region}/deployments/`;
+function maskedRollbackEventError(error, mask) {
+	const extracted = extractDeploymentEventError(error);
+	if (isOwnRemedyError(error)) return {
+		...extracted,
+		ownLines: true
+	};
+	const message = mask(extracted.message);
+	return message === extracted.message ? extracted : {
+		...extracted,
+		message
+	};
 }
-const DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION = "deployment-event streams and their index, whose recorded error messages can quote values the secret mask does not catch";
-async function deleteAndPurgeEventObjects(backend, keys, dirPrefix, scope = "deleted-keys") {
-	if (keys.length === 0) return void 0;
-	let swept;
-	try {
-		await backend.deleteRawObjects(keys);
-	} finally {
-		if (scope === "whole-dir") swept = await backend.purgeNoncurrentVersionsUnderPrefix(dirPrefix, { objectDescription: DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION });
-		else await backend.purgeNoncurrentVersions(keys, {
-			...keys.length > 1 && { listPrefix: dirPrefix },
-			objectDescription: DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION
-		});
-	}
-	return swept;
+function recordRollbackSkip(scope, op, reason) {
+	scope.result.warnings++;
+	scope.result.skipped++;
+	scope.ctx.recordEvent?.({
+		eventType: "ROLLBACK_RESOURCE_SKIPPED",
+		stackName: scope.stackName,
+		operation: op.changeType,
+		logicalId: op.logicalId,
+		resourceType: op.resourceType,
+		...op.provisionedBy && { provisionedBy: op.provisionedBy },
+		reason: scope.mask(reason)
+	});
 }
-function runIdTimestampMs(runId) {
-	const m = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})(\d{3})Z/.exec(runId);
-	if (!m) return null;
-	const iso = `${m[1]}-${m[2]}-${m[3]}T${m[4]}:${m[5]}:${m[6]}.${m[7]}Z`;
-	const ms = Date.parse(iso);
-	return Number.isNaN(ms) ? null : ms;
+function rollbackCannotAddress(record, opResourceType, route, physicalId) {
+	return !(record?.resourceType === "AWS::CloudFormation::Stack" && opResourceType === "AWS::CloudFormation::Stack" && record.provisionedBy !== "cc-api" && route !== "cc-api") && !hasAddressablePhysicalId({ physicalId });
 }
-function runIdFromJsonlKey(key, dirPrefix) {
-	if (!key.startsWith(dirPrefix) || !key.endsWith(".jsonl")) return null;
-	return key.slice(dirPrefix.length, -6);
+function retainedSurvivorId(record, op) {
+	if (hasAddressablePhysicalId(record)) return record.physicalId;
+	if (hasAddressablePhysicalId(op)) return op.physicalId;
 }
-var DeploymentEventsStore = class {
-	logger = getLogger().child("DeploymentEvents");
-	backend;
-	stackName;
-	region;
-	command;
-	runId;
-	cdkdVersion;
-	startedAt;
-	events = [];
-	persistedCount = 0;
-	flushTimer;
-	writeChain = Promise.resolve();
-	warnedOnce = false;
-	finalized = false;
-	constructor(backend, options) {
-		this.backend = backend;
-		this.stackName = options.stackName;
-		this.region = options.region;
-		this.command = options.command;
-		this.runId = options.runId ?? newDeploymentRunId();
-		this.cdkdVersion = options.cdkdVersion ?? getCdkdVersion();
-		this.startedAt = (/* @__PURE__ */ new Date()).toISOString();
-	}
-	record(event) {
-		try {
-			if (this.finalized) return;
-			this.events.push({
-				timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-				...event
-			});
-			if (this.events.length - this.persistedCount >= FLUSH_EVENT_THRESHOLD) this.scheduleFlush(0);
-			else this.scheduleFlush(FLUSH_INTERVAL_MS);
-		} catch {}
+const UNADDRESSABLE_SKIP_CAUSE = "Its recorded 'physicalId' is not a non-empty string, so cdkd cannot address the resource in AWS and sent nothing for it; the rollback left it and its state record exactly as they are.";
+const UNADDRESSABLE_JOURNAL_SKIP_CAUSE = "Its rollback-journal entry's 'physicalId' is not a non-empty string and no state record holds the resource, so cdkd cannot address it in AWS and sent nothing for it; if it was created in AWS, delete it manually.";
+function skipUnaddressableReplay(scope, logger, op, what, source = "record") {
+	if (source === "journal") {
+		logger.warn(safeMsg`  Rollback: Cannot ${what} ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}) ` + "— its rollback journal entry has no non-empty string 'physicalId' and no state record holds it, so cdkd cannot address it in AWS and sent nothing for it. If it was created in AWS, delete it manually.");
+		recordRollbackSkip(scope, op, UNADDRESSABLE_JOURNAL_SKIP_CAUSE);
+		return;
 	}
-	async finalize(result) {
-		if (this.finalized) return;
-		this.finalized = true;
-		if (this.flushTimer) {
-			clearTimeout(this.flushTimer);
-			this.flushTimer = void 0;
+	logger.warn(safeMsg`  Rollback: Cannot ${what} ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}) ` + "— its state record has no non-empty string 'physicalId', so cdkd cannot address it in AWS and sent nothing for it. The resource and its state record are left exactly as they are. Repair the record's 'physicalId' (inspect it with `cdkd state show`), then re-converge it with `cdkd deploy`.");
+	recordRollbackSkip(scope, op, UNADDRESSABLE_SKIP_CAUSE);
+}
+function effectiveProvisionedBy(record, fallbackProvisionedBy) {
+	return record?.provisionedBy ?? fallbackProvisionedBy;
+}
+function safe(value) {
+	return displayIdent(value);
+}
+const OWN_REMEDY_ERRORS = /* @__PURE__ */ new WeakSet();
+function isOwnRemedyError(error) {
+	return error instanceof Error && OWN_REMEDY_ERRORS.has(error);
+}
+function maskedFailureText(prefix, error, mask) {
+	const text = rollbackFailureText(error);
+	return prefix + (isOwnRemedyError(error) ? text : mask(text));
+}
+function ownRemedyError(error) {
+	OWN_REMEDY_ERRORS.add(error);
+	return error;
+}
+function rollbackFailureText(error) {
+	if (error instanceof Error && OWN_REMEDY_ERRORS.has(error)) return error.message.split("\n").map((line) => displaySafe(line)).join("\n");
+	return displaySafe(error instanceof Error ? error.message : String(error));
+}
+function collisionText(msg) {
+	return displayAwsMessage(displaySafe(msg).replace(/[\s\p{Cf}\p{Default_Ignorable_Code_Point}\u2800]{2,}/gu, " "));
+}
+function collisionLine(maskedMsg) {
+	return JSON.stringify(collisionText(maskedMsg));
+}
+const PASTEABLE_LOGICAL_ID = /^[A-Za-z0-9]{1,255}$/;
+function refusalLogicalId(logicalId) {
+	return typeof logicalId === "string" && PASTEABLE_LOGICAL_ID.test(logicalId) ? logicalId : "a resource whose logical id is not a plain CloudFormation logical id";
+}
+function shownLogicalId(logicalId) {
+	return typeof logicalId === "string" ? logicalIdShown(logicalId) : "a logical id that is not a plain identifier";
+}
+function shownChangeType(changeType) {
+	return typeof changeType === "string" ? plainOrDescribed(changeType, "change type") : "a change type that is not a plain identifier";
+}
+function refusalResourceType(resourceType) {
+	return typeof resourceType === "string" ? resourceTypeShown(resourceType) : "a resource type that is not a plain identifier";
+}
+function quotedPlainOr(value, what) {
+	if (typeof value !== "string" || Array.from(value).length > 255) return `a ${what} that is not a plain identifier`;
+	const unindexed = value.replace(/\[\d+\]/g, "");
+	return unindexed !== "" && plainIdentOr(unindexed, "") === unindexed ? `'${value}'` : `a ${what} that is not a plain identifier`;
+}
+const DESCRIBED_PHYSICAL_ID = "a physical id that is not a plain identifier";
+function refusalPhysicalId(maskedPhysicalId) {
+	return physicalIdShownBesideCommand(maskedPhysicalId, { maskToken: "***" }) ?? DESCRIBED_PHYSICAL_ID;
+}
+function describedPhysicalIdPointer(...shown) {
+	return shown.includes(DESCRIBED_PHYSICAL_ID) ? " A physical id is left out of the prose above: it is not a plain identifier — read it from the rollback journal or from the state record of the stack." : "";
+}
+function orphanRemedy(logicalId, ctx) {
+	if (ctx.nestedChildRevert === true) return {
+		offered: false,
+		clause: ` This op is reverted inside the revert of a nested stack for the rollback of its parent, where cdkd rollback --orphan cannot reach it: resolve the cause and re-run the rollback of the top-level stack, or re-deploy the top-level stack.${typeof logicalId === "string" && PASTEABLE_LOGICAL_ID.test(logicalId) ? "" : " The id is left out of the prose above: it is not a plain CloudFormation logical id — read it from cdkd events."}`,
+		line: ""
+	};
+	const pasteable = typeof logicalId === "string" && PASTEABLE_LOGICAL_ID.test(logicalId);
+	const idClause = pasteable ? "" : " The id is left out of the prose above and of that command: it is not a plain CloudFormation logical id, so a pasted command could be reshaped by the shell or name a different resource — read it from cdkd events and fill the quoted hole.";
+	const target = ctx.nestedChildStack === void 0 ? void 0 : pasteableCommand("cdkd rollback", [{
+		value: ctx.nestedChildStack,
+		hole: "stack",
+		opts: { plainIdent: true }
+	}, {
+		flag: "--stack-region",
+		value: ctx.region,
+		hole: "region",
+		opts: {
+			plainIdent: true,
+			maxCodePoints: 128
 		}
-		if (this.events.length === 0) return;
-		await this.enqueueWrite(async () => {
-			const indexRead = this.readIndexRuns();
-			indexRead.catch(() => {});
-			await this.doFlush();
-			await this.writeIndexAndPrune(result, await indexRead);
-		});
-	}
-	async writeIndexAndPrune(result, existingRuns) {
-		const { key, file, runs } = this.buildIndexUpdate(result, existingRuns);
-		const keptRunIds = runs.map((r) => r.runId);
-		const willPrune = keptRunIds.length >= 20;
-		const dirPrefix = deploymentsDirPrefix(this.backend.prefix, this.stackName, this.region);
-		const staleKeysRead = willPrune ? this.backend.listRawKeys(dirPrefix) : void 0;
-		staleKeysRead?.catch(() => {});
-		await this.backend.putRawObject(key, JSON.stringify(file, null, 2));
-		if (!staleKeysRead) return;
-		await this.pruneSupersededRunFiles(keptRunIds, dirPrefix, await staleKeysRead);
-	}
-	async drain() {
-		await this.writeChain;
+	}]);
+	const stackClause = target === void 0 ? "" : " This is the rollback of the nested stack itself, and only a rollback of the nested stack itself honours --orphan for this op, so the command names it." + withheldTargetClause(target, "stack", "cdkd rollback", "The name of the nested stack");
+	const rollbackVerb = (target ?? pasteableCommand("cdkd rollback")).command;
+	return {
+		offered: true,
+		clause: `${stackClause}${idClause}`,
+		line: `\nTo orphan it: ${rollbackVerb} --orphan ${pasteable ? logicalId : commandHole("id")}`
+	};
+}
+function rerunRollbackPhrase(ctx, topLevel) {
+	return ctx.nestedChildStack === void 0 ? topLevel : `the rollback of the nested stack ${quotedOrDescribed(ctx.nestedChildStack, "nested stack name")} itself`;
+}
+function rollbackFinalSnapshotId(resourceType, record, fallbackProvisionedBy) {
+	if (record.updateReplacePolicy !== "Snapshot") return void 0;
+	if (!ATOMIC_FINAL_SNAPSHOT_TYPES.has(resourceType)) return void 0;
+	if (effectiveProvisionedBy(record, fallbackProvisionedBy) === "cc-api") return void 0;
+	return buildFinalSnapshotIdentifier(record.physicalId, resourceType);
+}
+function rollbackRetainsNewResource(record) {
+	return record?.updateReplacePolicy === "Retain";
+}
+function retainedSurvivorMessages(logicalId, resourceType, survivorPhysicalId, stateClause, mask = (text) => text) {
+	const survivorId = mask(survivorPhysicalId);
+	const clause = mask(stateClause);
+	return {
+		warn: `  ⚠ ${safe(logicalId)} (${safe(resourceType)}) has UpdateReplacePolicy: Retain — the replacement's new physical resource (${displaySafe(survivorId)}) is RETAINED by this rollback and is no longer tracked by cdkd: it keeps running and incurring cost, and destroying the stack will not remove it. Delete it yourself once you no longer need it. ${displaySafe(clause)}`,
+		reason: `UpdateReplacePolicy: Retain kept the replacement's new ${resourceType} (${survivorId}); it is live, still billing, and no longer tracked by cdkd. ${clause}`
+	};
+}
+
+//#endregion
+//#region src/deployment/rollback-executor/names.ts
+function replayPrefixScope(input, logger, mask, restoring) {
+	const choice = replayPrefixChoice(input);
+	if (choice.kind === "not-applicable") return (fn) => fn();
+	const setting = (skip) => skip ? "SKIPPED" : "KEPT";
+	const subject = `${safe(input.logicalId)} (${safe(input.resourceType)})`;
+	const declared = choice.declared;
+	const secretDerived = declared !== void 0 && mask(declared) !== declared;
+	const withheld = secretDerived || choice.kind === "unreproduced" && declared === void 0;
+	const shown = (value) => displayIdent(mask(String(value)));
+	const quoted = (value) => {
+		const masked = mask(value);
+		const rendered = displayIdent(masked);
+		return rendered === masked ? `"${masked}"` : rendered;
+	};
+	if (choice.kind === "reproduced" && choice.skipPrefix !== choice.recorded) logger.info(mask(`  Rollback: ${restoring ? "re-creating" : "reverting"} ${subject} under the user-supplied-name prefix setting that created ` + (withheld ? `it (its physical id is withheld, as its name is secret-derived): ` : `${shown(input.physicalId)} (`) + `stack-name prefix ${setting(choice.skipPrefix)}; the failed deploy ran with it ${setting(choice.recorded)}${withheld ? "" : ")"}`));
+	else if (choice.kind === "unreproduced" && restoring) {
+		const idUnreadable = typeof input.physicalId !== "string" || input.physicalId === "";
+		const prop = safe(choice.property);
+		const unreadable = declared === void 0 ? idUnreadable ? `its ${prop} or its physical id` : `its ${prop}` : idUnreadable ? `its physical id` : void 0;
+		logger.warn(mask(`  ⚠ ${subject}: cdkd cannot tell which user-supplied-name prefix setting created the old resource (` + (withheld ? `its physical id is withheld, as its name is secret-derived or unreadable` : shown(input.physicalId)) + `) — ` + (choice.names === void 0 ? unreadable !== void 0 ? `cdkd cannot read ${unreadable} to compare` : `cdkd cannot derive the names its ${prop} takes to compare` : secretDerived ? `its ${prop} is secret-derived, and neither name it derives matches` : `its ${prop} derives to ${quoted(choice.names.skipped)} (prefix skipped) or ${quoted(choice.names.kept)} (prefix kept), and it is neither`) + `; re-creating it with the stack-name prefix ${setting(choice.skipPrefix)}, as the failed deploy ran, so it may come back under a different physical name.`));
 	}
-	scheduleFlush(delayMs) {
-		if (this.flushTimer) {
-			if (delayMs > 0) return;
-			clearTimeout(this.flushTimer);
+	const skip = choice.skipPrefix;
+	return (fn) => withSkipPrefix(skip, fn);
+}
+function createOpMasker(logger, secrets) {
+	const base = createMaskedLogSinks(logger, (text) => maskSecretsInText(text, secrets));
+	const pairs = [];
+	let sinks = base;
+	return {
+		mask: (text) => typeof text === "string" ? sinks.mask(text) : text,
+		addNamed: (record) => {
+			pairs.push(...secretDerivedNamePairs(record));
+			sinks = withDerivedNameMasks(logger, base, pairs);
 		}
-		this.flushTimer = setTimeout(() => {
-			this.flushTimer = void 0;
-			this.enqueueWrite(() => this.doFlush());
-		}, delayMs);
-		this.flushTimer.unref?.();
-	}
-	enqueueWrite(op) {
-		const next = this.writeChain.then(op).catch((err) => {
-			this.warnOnce(`Failed to persist deployment events for run ${this.runId}: ${describeAwsFailure(err).detail}`);
-		});
-		this.writeChain = next;
-		return next;
-	}
-	async doFlush() {
-		if (this.events.length === 0 || this.events.length === this.persistedCount) return;
-		const snapshotCount = this.events.length;
-		const body = this.events.slice(0, snapshotCount).map((e) => JSON.stringify(e)).join("\n");
-		await this.backend.putRawObject(deploymentEventsKey(this.backend.prefix, this.stackName, this.region, this.runId), body + "\n", "application/x-ndjson");
-		this.persistedCount = snapshotCount;
-	}
-	async readIndexRuns() {
-		const key = deploymentEventsIndexKey(this.backend.prefix, this.stackName, this.region);
-		try {
-			const raw = await this.backend.getRawObject(key);
-			if (raw !== null) {
-				const parsed = JSON.parse(raw);
-				if (Array.isArray(parsed.runs)) return parsed.runs;
+	};
+}
+const OTHER_SPELLED_NAME_KEYS = {
+	"AWS::Cognito::UserPoolDomain": ["Domain"],
+	"AWS::Cognito::UserPoolUser": ["Username"],
+	"AWS::ECS::TaskDefinition": ["Family"],
+	"AWS::ElastiCache::ReplicationGroup": ["ReplicationGroupId"],
+	"AWS::ElastiCache::User": ["UserId"],
+	"AWS::ElastiCache::UserGroup": ["UserGroupId"],
+	"AWS::SES::EmailIdentity": ["EmailIdentity"]
+};
+const COMPOSITE_SCOPE_LAST = /^(?:REGIONAL|CLOUDFRONT|GLOBAL)$/;
+const COMPOSITE_POOL_FIRST = /^[a-z]{2}(?:-gov)?-[a-z]+-\d+_[A-Za-z0-9]+$/;
+function idNameSegments(id) {
+	const segments = /* @__PURE__ */ new Set();
+	const arn = /^arn:[^:]*:([^:]*):[^:]*:[^:]*:(.+)$/.exec(id);
+	if (arn !== null) {
+		const service = arn[1];
+		const resource = arn[2];
+		const lambda = service === "lambda" ? /^(?:function|layer):([^:]+)(?::([^:]+))?/.exec(resource) : null;
+		if (lambda !== null) {
+			segments.add(lambda[1]);
+			const qualifier = lambda[2];
+			if (qualifier !== void 0 && !/^\d+$/.test(qualifier)) segments.add(qualifier);
+		} else {
+			const parts = resource.split(/[/:]/).filter((part) => part !== "");
+			let body = parts.length > 1 ? parts.slice(1) : parts;
+			if (body.length > 1 && /^\d+$/.test(body[body.length - 1])) body = body.slice(0, -1);
+			for (const part of body) {
+				segments.add(part);
+				if (service === "secretsmanager") segments.add(part.replace(/-[A-Za-z0-9]{6}$/, ""));
 			}
-		} catch (err) {
-			this.logger.debug(`Deployment-events index unreadable, rewriting: ${describeAwsFailure(err).detail}`);
 		}
-		return [];
 	}
-	buildIndexUpdate(result, existingRuns) {
-		const key = deploymentEventsIndexKey(this.backend.prefix, this.stackName, this.region);
-		const runs = [{
-			runId: this.runId,
-			command: this.command,
-			cdkdVersion: this.cdkdVersion,
-			startedAt: this.startedAt,
-			finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
-			result,
-			eventCount: this.persistedCount
-		}, ...existingRuns.filter((r) => r.runId !== this.runId)].slice(0, 20);
-		return {
-			key,
-			file: {
-				indexVersion: 1,
-				stackName: this.stackName,
-				region: this.region,
-				runs,
-				lastModified: Date.now()
-			},
-			runs
-		};
+	if (id.includes("/")) {
+		const afterSlash = id.slice(id.lastIndexOf("/") + 1);
+		segments.add(afterSlash);
+		segments.add(afterSlash.replace(/:\d+$/, ""));
 	}
-	async pruneSupersededRunFiles(keptRunIds, dirPrefix, keys) {
-		if (keptRunIds.length < 20) return;
-		const cutoff = keptRunIds.reduce((min, id) => id < min ? id : min, keptRunIds[0]);
-		const stale = keys.filter((k) => {
-			const runId = runIdFromJsonlKey(k, dirPrefix);
-			return runId !== null && runId < cutoff;
+	if (id.includes("|")) {
+		const parts = id.split("|");
+		parts.forEach((part, index) => {
+			if (part === "") return;
+			if (index === parts.length - 1 && parts.length > 1 && COMPOSITE_SCOPE_LAST.test(part)) return;
+			if (index === 0 && parts.length > 1 && COMPOSITE_POOL_FIRST.test(part)) return;
+			segments.add(part);
 		});
-		if (stale.length === 0) return;
-		await deleteAndPurgeEventObjects(this.backend, stale, dirPrefix);
-		this.logger.debug(`Pruned ${stale.length} superseded deployment-event stream(s) for ${this.stackName} (${this.region})`);
 	}
-	warnOnce(message) {
-		if (this.warnedOnce) {
-			this.logger.debug(message);
-			return;
-		}
-		this.warnedOnce = true;
-		this.logger.warn(`${message} — continuing; deployment events are best-effort and never block the run.`);
-	}
-};
-var DeploymentEventsReader = class {
-	backend;
-	constructor(backend) {
-		this.backend = backend;
-	}
-	async listRegions(stackName) {
-		const prefix = `${this.backend.prefix}/${stackName}/`;
-		const keys = await this.backend.listRawKeys(prefix);
-		const regions = /* @__PURE__ */ new Set();
-		for (const key of keys) {
-			const segments = key.slice(prefix.length).split("/");
-			if (segments.length === 3 && segments[1] === "deployments" && segments[0]) regions.add(segments[0]);
-		}
-		return [...regions].sort();
-	}
-	async listRuns(stackName, region) {
-		const key = deploymentEventsIndexKey(this.backend.prefix, stackName, region);
-		try {
-			const raw = await this.backend.getRawObject(key);
-			if (raw !== null) {
-				const parsed = JSON.parse(raw);
-				if (Array.isArray(parsed.runs)) return parsed.runs;
-			}
-		} catch {}
-		const dirPrefix = `${this.backend.prefix}/${stackName}/${region}/deployments/`;
-		const runIds = (await this.backend.listRawKeys(dirPrefix)).filter((k) => k.endsWith(".jsonl")).map((k) => k.slice(dirPrefix.length, -6)).sort().reverse();
-		return Promise.all(runIds.map((runId) => this.summarizeRunFromJsonl(stackName, region, runId)));
+	return [...segments].filter((segment) => segment.length >= 4 && segment !== id);
+}
+function ownEntry(table, key) {
+	return Object.hasOwn(table, key) ? table[key] : void 0;
+}
+function secretDerivedNamePairs(record) {
+	const { resourceType, properties, logicalId } = record;
+	if (typeof resourceType !== "string" || !isRestorableBag(properties)) return [];
+	const rewritten = reverseReplacementRewrittenNameTypes();
+	const named = /* @__PURE__ */ new Set();
+	const primary = Object.hasOwn(rewritten, resourceType) ? rewritten[resourceType].property : explicitNamePropertyFor(resourceType);
+	if (typeof primary === "string") named.add(primary);
+	for (const key of Object.keys(properties)) if (/(?:Name|Identifier)$/.test(key)) named.add(key);
+	for (const key of ownEntry(OTHER_SPELLED_NAME_KEYS, resourceType) ?? []) named.add(key);
+	const idSpellings = record.physicalIds.filter((id) => typeof id === "string" && id !== "").flatMap((id) => [
+		id,
+		...id.toLowerCase() === id || id.length < 4 ? [] : [id.toLowerCase()],
+		finalSnapshotNamePrefix(id, resourceType),
+		...idNameSegments(id)
+	]);
+	const pairs = [];
+	for (const key of named) {
+		if (!Object.hasOwn(properties, key)) continue;
+		const value = properties[key];
+		if (typeof value !== "string" || value === "") continue;
+		const derived = key === primary && !value.includes("{{resolve:") && value !== "***" ? rewrittenNameSpellings(resourceType, value, logicalId) : [];
+		for (const spelling of [...idSpellings, ...derived]) pairs.push([value, spelling]);
 	}
-	async summarizeRunFromJsonl(stackName, region, runId) {
-		const fallback = {
-			runId,
-			command: "deploy",
-			cdkdVersion: "unknown",
-			startedAt: "",
-			finishedAt: "",
-			result: "UNKNOWN",
-			eventCount: 0
-		};
-		let events = null;
-		try {
-			events = await this.readRunEvents(stackName, region, runId);
-		} catch {
-			return fallback;
-		}
-		if (events === null || events.length === 0) return fallback;
-		const started = events.find((e) => e.eventType === "RUN_STARTED");
-		let finished;
-		for (const e of events) if (e.eventType === "RUN_FINISHED") finished = e;
-		return {
-			runId,
-			command: started?.command ?? fallback.command,
-			cdkdVersion: started?.cdkdVersion ?? fallback.cdkdVersion,
-			startedAt: started?.timestamp ?? fallback.startedAt,
-			finishedAt: finished?.timestamp ?? fallback.finishedAt,
-			result: finished?.result ?? "UNKNOWN",
-			eventCount: events.length
-		};
+	return pairs;
+}
+function addRecordNames(opMasker, op, current) {
+	const { logicalId } = op;
+	for (const properties of [op.properties, op.attemptedProperties]) opMasker.addNamed({
+		resourceType: op.resourceType,
+		properties,
+		logicalId,
+		physicalIds: [op.physicalId]
+	});
+	for (const record of [op.previousState, current]) {
+		if (record === null || typeof record !== "object") continue;
+		opMasker.addNamed({
+			resourceType: record.resourceType ?? op.resourceType,
+			properties: record.properties,
+			logicalId,
+			physicalIds: [record.physicalId]
+		});
 	}
-	async readRunEvents(stackName, region, runId) {
-		const key = deploymentEventsKey(this.backend.prefix, stackName, region, runId);
-		const raw = await this.backend.getRawObject(key);
-		if (raw === null) return null;
-		const events = [];
-		for (const line of raw.split("\n")) {
-			const trimmed = line.trim();
-			if (!trimmed) continue;
-			try {
-				events.push(JSON.parse(trimmed));
-			} catch {}
-		}
-		return events;
+}
+const ABSENT_BASELINE_SKIP_CAUSE = "Its recorded previous state has no `properties` bag, so there is nothing to restore it to; the rollback left the resource exactly as it is.";
+function requireRestorableBaseline(bag, logger, { logicalId, consequence, remedy, retry }) {
+	if (isRestorableBag(bag)) return true;
+	if (bag === void 0) {
+		logger.warn(`  Rollback: Cannot restore ${shownLogicalId(logicalId)} \u2014 its recorded previous state has no \`properties\` bag, so there is nothing to restore it to. An empty desired state would ${consequence}. The resource is therefore left exactly as it is. ${remedy}`);
+		return false;
 	}
-	async pruneRuns(stackName, region, opts = {}) {
-		const dirPrefix = deploymentsDirPrefix(this.backend.prefix, stackName, region);
-		const keys = await this.backend.listRawKeys(dirPrefix);
-		const runIdsDesc = keys.map((k) => runIdFromJsonlKey(k, dirPrefix)).filter((id) => id !== null).sort().reverse();
-		const indexKey = deploymentEventsIndexKey(this.backend.prefix, stackName, region);
-		const indexExisted = keys.includes(indexKey);
-		if (opts.all === true) {
-			const toDelete = runIdsDesc.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
-			const earlierVersions = await deleteAndPurgeEventObjects(this.backend, [...toDelete, indexKey], dirPrefix, "whole-dir");
-			return {
-				deletedRunIds: runIdsDesc,
-				remainingRunIds: [],
-				indexDeleted: indexExisted,
-				...earlierVersions !== void 0 && { earlierVersions }
-			};
-		}
-		const noGuards = opts.keep === void 0 && opts.olderThanMs === void 0;
-		const keep = opts.keep ?? (noGuards ? 20 : void 0);
-		const protectedByCount = keep === void 0 ? /* @__PURE__ */ new Set() : new Set(runIdsDesc.slice(0, keep));
-		let candidates = runIdsDesc.filter((id) => !protectedByCount.has(id));
-		if (opts.olderThanMs !== void 0) {
-			const cutoff = (opts.now ?? /* @__PURE__ */ new Date()).getTime() - opts.olderThanMs;
-			candidates = candidates.filter((id) => {
-				const t = runIdTimestampMs(id);
-				return t !== null && t < cutoff;
+	const shape = bag === null ? "null" : Array.isArray(bag) ? "an array" : `a ${typeof bag}`;
+	throw new CdkdError(`Cannot roll ${shownLogicalId(logicalId)} back: its recorded previous state has a \`properties\` field that is not a property bag (${shape}), so cdkd cannot tell what to restore it to. Replaying it would do one of two things, and cdkd does neither: send the malformed value to the provider as-is, or send an empty desired state (which would ${consequence}). The rollback JOURNAL record is kept: once that record holds a property bag again, ${retry}. Otherwise fix forward with \`cdkd deploy\`, or remove the stack with \`cdkd destroy\`.`, "ROLLBACK_UNUSABLE_BASELINE");
+}
+function isRestorableBag(bag) {
+	return typeof bag === "object" && bag !== null && !Array.isArray(bag);
+}
+async function prepareCreateRollbackFinalSnapshot(op, provisionedBy, ctx, mask) {
+	const { logicalId, resourceType } = op;
+	const physicalId = op.physicalId;
+	switch (finalSnapshotMechanism(resourceType, provisionedBy)) {
+		case "atomic-delete-parameter": return buildFinalSnapshotIdentifier(physicalId, resourceType);
+		case "pre-delete-snapshot":
+			await createPreDeleteFinalSnapshot(resourceType, physicalId, logicalId, ctx.finalSnapshotClients ?? getAwsClients(), {
+				info: (message) => ctx.logger.info(mask(message)),
+				debug: (message) => ctx.logger.debug(mask(message))
 			});
-		}
-		if (candidates.length === 0) return {
-			deletedRunIds: [],
-			remainingRunIds: runIdsDesc,
-			indexDeleted: false
-		};
-		const deletedSet = new Set(candidates);
-		const deleteKeys = candidates.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
-		const remainingRunIds = runIdsDesc.filter((id) => !deletedSet.has(id));
-		if (remainingRunIds.length === 0) {
-			await deleteAndPurgeEventObjects(this.backend, [...deleteKeys, indexKey], dirPrefix);
-			return {
-				deletedRunIds: candidates,
-				remainingRunIds,
-				indexDeleted: indexExisted
-			};
-		}
-		await this.rewriteIndexAfterPrune(indexKey, stackName, region, deletedSet);
-		await deleteAndPurgeEventObjects(this.backend, deleteKeys, dirPrefix);
-		return {
-			deletedRunIds: candidates,
-			remainingRunIds,
-			indexDeleted: false
-		};
-	}
-	async rewriteIndexAfterPrune(indexKey, stackName, region, deletedRunIds) {
-		let raw;
-		try {
-			raw = await this.backend.getRawObject(indexKey);
-		} catch {
-			return;
-		}
-		if (raw === null) return;
-		let parsed;
-		try {
-			parsed = JSON.parse(raw);
-		} catch {
 			return;
-		}
-		if (!Array.isArray(parsed.runs)) return;
-		const remaining = parsed.runs.filter((r) => !deletedRunIds.has(r.runId));
-		if (remaining.length === parsed.runs.length) return;
-		const file = {
-			indexVersion: 1,
-			stackName,
-			region,
-			runs: remaining,
-			lastModified: Date.now()
-		};
-		await this.backend.putRawObject(indexKey, JSON.stringify(file, null, 2));
+		case "refuse-cc-routed": throw ccRoutedFinalSnapshotError(logicalId, resourceType, SKIP_FINAL_SNAPSHOT_FLAG);
+		case "refuse-unsupported-type": throw unsupportedFinalSnapshotError(logicalId, resourceType, SKIP_FINAL_SNAPSHOT_FLAG);
 	}
-};
+}
 
 //#endregion
-//#region src/provisioning/final-snapshot.ts
-const ATOMIC_FINAL_SNAPSHOT_TYPES = /* @__PURE__ */ new Set([
-	"AWS::RDS::DBInstance",
-	"AWS::RDS::DBCluster",
-	"AWS::Neptune::DBCluster",
-	"AWS::DocDB::DBCluster",
-	"AWS::ElastiCache::CacheCluster"
-]);
-const PRE_DELETE_SNAPSHOT_TYPES = /* @__PURE__ */ new Set([
-	"AWS::EC2::Volume",
-	"AWS::Redshift::Cluster",
-	"AWS::ElastiCache::ReplicationGroup"
-]);
-function effectiveDeletionPolicy(resourceType, recorded, properties) {
-	if (recorded !== void 0) return recorded;
-	if (resourceType === "AWS::RDS::DBCluster") return "Snapshot";
-	if (resourceType === "AWS::RDS::DBInstance" && properties?.["DBClusterIdentifier"] === void 0) return "Snapshot";
-}
-function replacementDeletePolicy(updateReplacePolicy) {
-	return updateReplacePolicy ?? "Delete";
-}
-function finalSnapshotMechanism(resourceType, provisionedBy) {
-	if (ATOMIC_FINAL_SNAPSHOT_TYPES.has(resourceType)) return provisionedBy === "cc-api" ? "refuse-cc-routed" : "atomic-delete-parameter";
-	if (PRE_DELETE_SNAPSHOT_TYPES.has(resourceType)) return "pre-delete-snapshot";
-	return "refuse-unsupported-type";
-}
-function refusesFinalSnapshot(resourceType, provisionedBy) {
-	const mechanism = finalSnapshotMechanism(resourceType, provisionedBy);
-	return mechanism === "refuse-cc-routed" || mechanism === "refuse-unsupported-type";
-}
-function sanitizeSnapshotBase(physicalId) {
-	let base = physicalId.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
-	if (!/^[a-z]/.test(base)) base = `r${base}`;
-	return base;
-}
-function finalSnapshotNamePrefix(physicalId, resourceType) {
-	return finalSnapshotNameCut(physicalId, resourceType).prefix;
-}
-function finalSnapshotNameCut(physicalId, resourceType) {
-	const maxLength = resourceType === "AWS::ElastiCache::CacheCluster" || resourceType === "AWS::ElastiCache::ReplicationGroup" ? 50 : 255;
-	const sanitized = sanitizeSnapshotBase(physicalId);
-	const base = sanitized.slice(0, maxLength - 22).replace(/-+$/, "");
-	return {
-		prefix: `${base}-final-`,
-		sanitized,
-		kept: base.length
+//#region src/deployment/secret-name-needles.ts
+function secretNameNeedlesOf(logicalId, record, secrets, options) {
+	const physicalId = typeof record?.physicalId === "string" && record.physicalId !== "" ? record.physicalId : void 0;
+	const bag = secrets !== void 0 && hasMaskableValues(secrets) ? secrets : void 0;
+	const mask = (text) => bag === void 0 ? text : maskSecretsInText(text, bag);
+	const unresolved = (value) => value.includes("{{resolve:") || value === "***";
+	const named = {
+		resourceType: record?.resourceType,
+		properties: record?.properties,
+		logicalId
 	};
-}
-function buildFinalSnapshotIdentifier(physicalId, resourceType, now = /* @__PURE__ */ new Date()) {
-	const ts = now.toISOString().replace(/[-:]/g, "").replace(/\..*$/, "").replace("T", "-").toLowerCase();
-	return `${finalSnapshotNamePrefix(physicalId, resourceType)}${ts}`;
-}
-const EBS_FINAL_SNAPSHOT_TAG_KEY = "cdkd:final-snapshot-of";
-const finalSnapshotDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
-const PRE_DELETE_SNAPSHOT_POLL_INTERVAL_MS = 5e3;
-const PRE_DELETE_SNAPSHOT_TIMEOUT_MS = 36e5;
-const REDSHIFT_CLUSTER_SETTLE_TIMEOUT_MS = 12e5;
-function errMsg(error) {
-	return describeAwsFailure(error).detail;
-}
-function isVolumeNotFound(error) {
-	return (error instanceof Error ? error.name : "") === "InvalidVolume.NotFound" || errMsg(error).includes("InvalidVolume.NotFound");
-}
-async function createEbsFinalSnapshot(client, volumeId, logicalId, logger) {
-	let snapshotId;
-	try {
-		snapshotId = (await client.send(new DescribeSnapshotsCommand({
-			OwnerIds: ["self"],
-			Filters: [{
-				Name: `tag:${EBS_FINAL_SNAPSHOT_TAG_KEY}`,
-				Values: [volumeId]
-			}, {
-				Name: "status",
-				Values: ["pending", "completed"]
-			}]
-		}))).Snapshots?.[0]?.SnapshotId;
-		if (snapshotId) logger.debug(`Reusing existing final snapshot ${snapshotId} for ${logicalId} (${volumeId}) from a previous destroy attempt`);
-	} catch (probeError) {
-		logger.debug(`Final-snapshot reuse probe failed for ${volumeId}: ${errMsg(probeError)}`);
-	}
-	if (!snapshotId) try {
-		snapshotId = (await client.send(new CreateSnapshotCommand({
-			VolumeId: volumeId,
-			Description: `cdkd final snapshot for ${volumeId} (DeletionPolicy: Snapshot)`,
-			TagSpecifications: [{
-				ResourceType: "snapshot",
-				Tags: [{
-					Key: EBS_FINAL_SNAPSHOT_TAG_KEY,
-					Value: volumeId
-				}]
-			}]
-		}))).SnapshotId;
-	} catch (createError) {
-		if (isVolumeNotFound(createError)) {
-			logger.debug(`Volume ${volumeId} no longer exists — skipping final snapshot for ${logicalId}`);
-			return null;
+	const needles = /* @__PURE__ */ new Set();
+	const add = (needle) => {
+		if (typeof needle === "string" && needle !== "") needles.add(needle);
+	};
+	for (const [raw, derived] of secretDerivedNamePairs({
+		...named,
+		physicalIds: []
+	})) if (typeof raw === "string" && !unresolved(raw) && isSecretDerivedValue(raw, mask)) add(derived);
+	for (const [raw, spelling] of secretDerivedNamePairs({
+		...named,
+		physicalIds: [physicalId ?? "cdkd-no-physical-id-yet"]
+	})) {
+		if (!isSecretDerivedValue(raw, mask)) continue;
+		if (unresolved(raw)) {
+			if (physicalId === void 0) continue;
+			add(spelling);
+		} else {
+			add(raw);
+			if (raw.toLowerCase() !== raw && raw.length >= 4) add(raw.toLowerCase());
 		}
-		throw new CdkdError(`Failed to create the final snapshot for ${logicalId} (${volumeId}) required by DeletionPolicy: Snapshot: ${errMsg(createError)}. The volume was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
 	}
-	if (!snapshotId) throw new CdkdError(`CreateSnapshot for ${logicalId} (${volumeId}) returned no snapshot id. The volume was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
-	logger.info(`Creating final snapshot ${snapshotId} for ${logicalId} (${volumeId}) — DeletionPolicy: Snapshot`);
-	const deadline = Date.now() + PRE_DELETE_SNAPSHOT_TIMEOUT_MS;
-	let notFoundPolls = 0;
-	for (;;) {
-		let state;
-		try {
-			state = (await client.send(new DescribeSnapshotsCommand({ SnapshotIds: [snapshotId] }))).Snapshots?.[0]?.State;
-			notFoundPolls = 0;
-		} catch (pollError) {
-			if (((pollError instanceof Error ? pollError.name : "") === "InvalidSnapshot.NotFound" || errMsg(pollError).includes("InvalidSnapshot.NotFound")) && ++notFoundPolls <= 24) state = void 0;
-			else throw new CdkdError(`Failed while waiting for final snapshot ${snapshotId} of ${logicalId} (${volumeId}): ${errMsg(pollError)}. The volume was NOT deleted; re-run the destroy (the snapshot is reused, not duplicated).`, "FINAL_SNAPSHOT_FAILED", pollError instanceof Error ? pollError : void 0);
-		}
-		if (state === "completed") {
-			logger.info(`Final snapshot ${snapshotId} completed for ${logicalId} (${volumeId})`);
-			return snapshotId;
+	const properties = record?.properties;
+	const path = properties !== null && typeof properties === "object" && Object.hasOwn(properties, "Path") ? properties["Path"] : void 0;
+	if (physicalId !== void 0 && isSecretDerivedValue(path, mask)) add(physicalId);
+	const embedded = options === void 0 ? secrets : options.embedded;
+	const embeddedBag = embedded !== void 0 && hasMaskableValues(embedded) ? embedded : void 0;
+	if (embeddedBag !== void 0 && physicalId !== void 0) {
+		for (const needle of printingCorpusOf(embeddedBag).keys()) if (needle !== "" && (needle === physicalId || needle.length >= 4 && physicalId.includes(needle))) add(needle);
+	}
+	if (physicalId !== void 0) for (const spelling of finalSnapshotSpellingsOf(physicalId, record?.resourceType, needles)) add(spelling);
+	return needles.size > 0 ? needles : void 0;
+}
+function finalSnapshotSpellingsOf(physicalId, resourceType, needles) {
+	if (typeof resourceType !== "string" || !(ATOMIC_FINAL_SNAPSHOT_TYPES.has(resourceType) || PRE_DELETE_SNAPSHOT_TYPES.has(resourceType))) return [];
+	const { prefix, sanitized, kept } = finalSnapshotNameCut(physicalId, resourceType);
+	const spellings = [];
+	for (const needle of needles) {
+		const folded = needle.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-{2,}/g, "-");
+		if (folded.length < 4) continue;
+		for (let at = sanitized.indexOf(folded); at !== -1; at = sanitized.indexOf(folded, at + 1)) {
+			if (at >= kept) break;
+			if (at + folded.length > kept) spellings.push(prefix);
+			else if (folded !== needle) spellings.push(folded);
 		}
-		if (state === "error") throw new CdkdError(`Final snapshot ${snapshotId} for ${logicalId} (${volumeId}) entered 'error' state. The volume was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
-		if (Date.now() >= deadline) throw new CdkdError(`Timed out waiting for final snapshot ${snapshotId} of ${logicalId} (${volumeId}) to complete. The volume was NOT deleted; the snapshot continues in AWS — re-run the destroy once it completes (the existing snapshot is reused, not duplicated).`, "FINAL_SNAPSHOT_TIMEOUT");
-		await finalSnapshotDelays.sleep(PRE_DELETE_SNAPSHOT_POLL_INTERVAL_MS);
 	}
+	return spellings;
+}
+function secretNamesReadBy(logicalId, record, resources, judge = () => ({
+	secrets: void 0,
+	embedded: void 0
+})) {
+	const read = /* @__PURE__ */ new Set();
+	const leaves = [...wholeStringLeavesOf(record?.properties)].filter((leaf) => leaf !== "");
+	if (leaves.length === 0) return read;
+	for (const [otherId, other] of Object.entries(resources)) {
+		if (otherId === logicalId) continue;
+		const bags = judge(otherId);
+		const needles = secretNameNeedlesOf(otherId, other, bags.secrets, { embedded: bags.embedded });
+		if (needles === void 0) continue;
+		for (const needle of needles) if (leaves.some((leaf) => leaf === needle || needle.length >= 4 && leaf.includes(needle))) read.add(needle);
+	}
+	return read;
 }
-function isFinalSnapshotError(error) {
-	return error instanceof CdkdError && (error.code === "FINAL_SNAPSHOT_FAILED" || error.code === "FINAL_SNAPSHOT_TIMEOUT" || error.code === "FINAL_SNAPSHOT_UNSUPPORTED");
-}
-function ccRoutedFinalSnapshotError(logicalId, resourceType, skipFlagHint) {
-	return new CdkdError(`${logicalIdShown(logicalId)} (${resourceTypeShown(resourceType)}) has DeletionPolicy: Snapshot, but the resource is managed via the Cloud Control API route (provisionedBy: cc-api), which has no final-snapshot delete parameter — deleting it now would destroy its data WITHOUT the final snapshot the policy promises. Create a snapshot manually (e.g. aws rds create-db-snapshot / aws elasticache create-snapshot), then re-run with ${skipFlagHint} to delete WITHOUT cdkd's final snapshot (DATA LOSS otherwise), or retain the resource (DeletionPolicy: Retain) and delete it manually.`, "FINAL_SNAPSHOT_UNSUPPORTED");
+function stateSecretNameNeedles(resources, secrets) {
+	return (logicalId) => secretNameNeedlesOf(logicalId, Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0, secrets, { embedded: void 0 });
 }
-function unsupportedFinalSnapshotError(logicalId, resourceType, skipFlagHint) {
-	return new CdkdError(`${logicalIdShown(logicalId)} (${resourceTypeShown(resourceType)}) has DeletionPolicy: Snapshot, but cdkd does not implement final snapshots for this type (CloudFormation itself only supports Snapshot on: EC2 Volume, ElastiCache CacheCluster / ReplicationGroup, Neptune / RDS / DocDB clusters, RDS instances, Redshift clusters). Deleting it now would destroy its data WITHOUT the final snapshot the policy promises. Re-run with ${skipFlagHint} to delete WITHOUT a final snapshot (DATA LOSS), or retain the resource (DeletionPolicy: Retain) and delete it manually after snapshotting.`, "FINAL_SNAPSHOT_UNSUPPORTED");
+function secretNamePrintingBag(logicalId, resources) {
+	const bag = /* @__PURE__ */ new Map();
+	const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+	for (const needle of secretNameNeedlesOf(logicalId, record, void 0) ?? []) recordLogOnlyValue(bag, needle);
+	for (const needle of secretNamesReadBy(logicalId, record, resources)) recordLogOnlyValue(bag, needle);
+	return bag;
 }
-async function createPreDeleteFinalSnapshot(resourceType, physicalId, logicalId, clients, logger) {
-	switch (resourceType) {
-		case "AWS::EC2::Volume": return createEbsFinalSnapshot(clients.ec2, physicalId, logicalId, logger);
-		case "AWS::Redshift::Cluster": return createRedshiftFinalSnapshot(clients.redshift, physicalId, logicalId, logger);
-		case "AWS::ElastiCache::ReplicationGroup": return createReplicationGroupFinalSnapshot(clients.elastiCache, physicalId, logicalId, logger);
-		default: throw new CdkdError(`No pre-delete final-snapshot implementation for ${logicalId} (${resourceType}). The resource was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
+function journaledOrphanPrintingBag(ops, stateResources) {
+	const bag = /* @__PURE__ */ new Map();
+	for (const op of ops) {
+		const record = {
+			resourceType: op.resourceType,
+			physicalId: op.physicalId,
+			properties: op.attemptedProperties
+		};
+		const replaced = Object.hasOwn(stateResources, op.logicalId) ? stateResources[op.logicalId] : void 0;
+		for (const needle of [
+			...secretNameNeedlesOf(op.logicalId, record, void 0) ?? [],
+			...secretNameNeedlesOf(op.logicalId, replaced, void 0) ?? [],
+			...secretNamesReadBy(op.logicalId, record, stateResources)
+		]) recordLogOnlyValue(bag, needle);
 	}
+	return bag;
 }
-async function waitForNamedSnapshot(opts) {
-	const { snapshotId, logicalId, sourceId, noun, logger } = opts;
-	logger.info(`${opts.reused ? "Resuming" : "Creating"} final snapshot ${snapshotId} for ${logicalId} (${sourceId}) — DeletionPolicy: Snapshot`);
-	const deadline = Date.now() + PRE_DELETE_SNAPSHOT_TIMEOUT_MS;
-	let notFoundPolls = 0;
-	for (;;) {
-		let status;
-		try {
-			status = await opts.pollStatus();
-			notFoundPolls = 0;
-		} catch (pollError) {
-			if (opts.isTransientNotFound(pollError) && ++notFoundPolls <= 24) status = void 0;
-			else throw new CdkdError(`Failed while waiting for final snapshot ${snapshotId} of ${logicalId} (${sourceId}): ${errMsg(pollError)}. The ${noun} was NOT deleted; re-run the delete (the snapshot is reused, not duplicated).`, "FINAL_SNAPSHOT_FAILED", pollError instanceof Error ? pollError : void 0);
-		}
-		if (status === opts.readyStatus) {
-			logger.info(`Final snapshot ${snapshotId} ready for ${logicalId} (${sourceId})`);
-			return snapshotId;
-		}
-		if (status !== void 0 && opts.failedStatuses.includes(status)) throw new CdkdError(`Final snapshot ${snapshotId} for ${logicalId} (${sourceId}) entered '${status}' state. The ${noun} was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
-		if (Date.now() >= deadline) throw new CdkdError(`Timed out waiting for final snapshot ${snapshotId} of ${logicalId} (${sourceId}) to become ready. The ${noun} was NOT deleted; the snapshot continues in AWS — re-run the delete once it is ready (the existing snapshot is reused, not duplicated).`, "FINAL_SNAPSHOT_TIMEOUT");
-		await finalSnapshotDelays.sleep(PRE_DELETE_SNAPSHOT_POLL_INTERVAL_MS);
+function completedReplayEntries(ops) {
+	return ops.flatMap((op) => [{
+		logicalId: op.logicalId,
+		resourceType: op.resourceType,
+		physicalId: op.physicalId,
+		properties: op.properties,
+		attemptedProperties: op.properties
+	}, ...op.previousState === void 0 ? [] : [{
+		logicalId: op.logicalId,
+		resourceType: op.previousState.resourceType,
+		physicalId: op.previousState.physicalId,
+		properties: op.previousState.properties,
+		attemptedProperties: op.previousState.properties
+	}]]);
+}
+function orphanRecordsPrintingBag(records) {
+	const bag = /* @__PURE__ */ new Map();
+	for (const entry of records) {
+		if (entry === null || typeof entry !== "object") continue;
+		const { logicalId, state } = entry;
+		if (typeof logicalId !== "string" || state === null || typeof state !== "object") continue;
+		for (const needle of secretNameNeedlesOf(logicalId, state, void 0) ?? []) recordLogOnlyValue(bag, needle);
 	}
+	return bag;
 }
-function errorNameOrMessageIncludes(error, token) {
-	return (error instanceof Error ? error.name : "") === token || errMsg(error).includes(token);
+const ORPHAN_COMMAND_LABEL = "To orphan it: ";
+function maskOutsideCommandLines(message, mask) {
+	const out = [];
+	let run = [];
+	const flush = () => {
+		if (run.length === 0) return;
+		const masked = mask(run.join("\n")).split("\n").map((line) => mask(line) === "***" ? "***" : line);
+		out.push(masked.join("\n"));
+		run = [];
+	};
+	for (const line of message.split("\n")) if (line.startsWith("To orphan it: ")) {
+		flush();
+		out.push(line);
+	} else run.push(line);
+	flush();
+	return out.join("\n");
 }
-const REUSE_PROBE_MAX_PAGES = 10;
-function generatedSnapshotNameMatcher(physicalId, resourceType) {
-	const escaped = finalSnapshotNamePrefix(physicalId, resourceType).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-	return new RegExp(`^${escaped}\\d{8}-\\d{6}$`);
+function maskEventTextWithBoundBags(event) {
+	if (event.reason === void 0 && event.error === void 0) return event;
+	const mask = currentLogLineMasker();
+	if (mask === void 0) return event;
+	const masked = { ...event };
+	if (masked.error?.message) {
+		const message = masked.error.ownLines === true ? maskOutsideCommandLines(masked.error.message, mask) : mask(masked.error.message);
+		masked.error = {
+			...masked.error,
+			message
+		};
+	}
+	if (masked.reason) masked.reason = mask(masked.reason);
+	return masked;
 }
-const RESUMABLE_SNAPSHOT_STATUS = "creating";
-async function createRedshiftFinalSnapshot(client, clusterId, logicalId, logger) {
-	const matches = generatedSnapshotNameMatcher(clusterId, "AWS::Redshift::Cluster");
-	let snapshotId;
+
+//#endregion
+//#region src/deployment/deploy-engine/options.ts
+const DEFAULT_RESOURCE_WARN_AFTER_MS = 3e5;
+const DEFAULT_RESOURCE_TIMEOUT_MS = 18e5;
+
+//#endregion
+//#region src/deployment/deploy-engine/name-collision.ts
+function replacementNameOrigin(logicalId, physicalId) {
+	if (looksLikeCdkdGeneratedName(physicalId, logicalId, getCurrentStackName())) return {
+		descriptor: `The physical name (${physicalId}) was GENERATED by cdkd from the construct's logical id rather than declared in your template, and that derivation has no random component — so the new resource asks for exactly the name the existing one still holds`,
+		remedy: "Either give the resource an explicit physical name in your CDK code, or rename the CONSTRUCT (its id feeds the generated name — note that this replaces the resource rather than renaming it in place)"
+	};
+	return {
+		descriptor: `The resource has a user-supplied physical name (${physicalId})`,
+		remedy: "Either rename the resource in your CDK code (a fresh name lets the safe create-first order proceed)"
+	};
+}
+function orphanedNameCollisionAdvice(changeType, logicalId, error) {
+	if (changeType !== "CREATE") return void 0;
+	if (!(error instanceof ProvisioningError)) return void 0;
+	const physicalId = error.physicalId;
+	if (!physicalId) return void 0;
+	const replayed = isReplayedNameCollisionFrom(error, logicalId, (link) => isAuxiliaryMarkOf(link, RETRY_AUXILIARY_OWNER));
+	if (!replayed && !isNameCollisionErrorFrom(error, logicalId)) return void 0;
+	const stackName = getCurrentStackName();
+	if (!looksLikeCdkdGeneratedName(physicalId, logicalId, stackName)) return void 0;
+	if (!stackName) return void 0;
+	const safeId = displaySafe(physicalId, { asciiOnly: true });
+	const safeStack = displaySafe(stackName, { asciiOnly: true });
+	const safeLogicalId = displaySafe(logicalId, { asciiOnly: true });
+	const idShown = isInertUnquoted(safeId);
+	const shownId = idShown ? safeId : "a name that cannot be shown safely here";
+	const shownLogicalId = isInertUnquoted(safeLogicalId) ? safeLogicalId : "A resource whose logical id cannot be shown safely here";
+	const diagnosis = replayed ? `${shownLogicalId}: the name AWS reports as taken (${shownId}) is most likely held by a resource THIS create made. An earlier attempt of it ended without a clear verdict (a server error, a dropped connection or a timeout, or a failure after the create call itself may have succeeded), and the retry then found the name taken. A dropped connection can also happen before the request reached AWS, so the holder may be another resource: confirm it is yours before deleting or importing it. cdkd records a resource only once its create succeeds, so this one is in no state file: no rollback or cdkd destroy will remove it, and re-running collides with it again.` : `${shownLogicalId}: the name AWS reports as taken (${shownId}) is one cdkd DERIVED from the logical id, and that derivation has no random component — so this is most likely a resource an earlier cdkd run left behind. A rollback leaves a resource carrying DeletionPolicy: Retain in AWS and drops it from state, as CloudFormation does; what differs is the name. CloudFormation would generate a fresh one for an unnamed resource and redeploy clean, whereas cdkd asks again for the name the orphan still holds — so re-running does not clear this.`;
+	const deleteArm = `If it is not a resource you want to keep, delete ${idShown ? safeId : "it"} in AWS — after confirming it holds nothing you need${replayed ? "" : ", since Retain is what kept it"} — and re-deploy.`;
+	let canImport;
 	try {
-		let marker;
-		for (let page = 0; page < REUSE_PROBE_MAX_PAGES && !snapshotId; page++) {
-			const existing = await client.send(new DescribeClusterSnapshotsCommand({
-				ClusterIdentifier: clusterId,
-				SnapshotType: "manual",
-				...marker !== void 0 && { Marker: marker }
-			}));
-			snapshotId = existing.Snapshots?.find((s) => s.SnapshotIdentifier !== void 0 && matches.test(s.SnapshotIdentifier) && s.Status === RESUMABLE_SNAPSHOT_STATUS)?.SnapshotIdentifier;
-			marker = existing.Marker;
-			if (marker === void 0) break;
-		}
-		if (snapshotId) logger.debug(`Resuming in-flight final snapshot ${snapshotId} for ${logicalId} (${clusterId}) from a previous delete attempt`);
-	} catch (probeError) {
-		logger.debug(`Final-snapshot reuse probe failed for ${clusterId}: ${errMsg(probeError)}`);
+		canImport = typeof this.providerRegistry.getProvider(error.resourceType).import === "function";
+	} catch {
+		canImport = false;
 	}
-	const reused = snapshotId !== void 0;
-	if (!snapshotId) {
-		const newId = buildFinalSnapshotIdentifier(clusterId, "AWS::Redshift::Cluster");
-		try {
-			await client.send(new CreateClusterSnapshotCommand({
-				SnapshotIdentifier: newId,
-				ClusterIdentifier: clusterId
-			}));
-			snapshotId = newId;
-		} catch (createError) {
-			if (errorNameOrMessageIncludes(createError, "ClusterNotFoundFault")) {
-				logger.debug(`Redshift cluster ${clusterId} no longer exists — skipping final snapshot for ${logicalId}`);
-				return null;
-			}
-			if (errorNameOrMessageIncludes(createError, "InvalidClusterStateFault")) {
-				logger.info(`Redshift cluster ${clusterId} is not in a snapshottable state (likely already deleting) — skipping the final snapshot for ${logicalId}: ${errMsg(createError)}`);
-				return null;
-			}
-			throw new CdkdError(`Failed to create the final snapshot for ${logicalId} (${clusterId}) required by DeletionPolicy: Snapshot: ${errMsg(createError)}. The cluster was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
+	const commandNamesTheRightResource = safeId === physicalId && safeStack === stackName && safeLogicalId === logicalId;
+	const importableTarget = !stackName.includes("~");
+	if (!canImport || !commandNamesTheRightResource || !importableTarget) return `${diagnosis} ${!canImport ? `cdkd cannot adopt ${displaySafe(error.resourceType, { asciiOnly: true })} back into state (its provider implements no import)` : !importableTarget ? `this is a nested-stack child, whose stack name cdkd import cannot resolve` : `cdkd cannot render an import command that provably names this resource`}, so the way forward is to delete it. ${deleteArm}`;
+	const adopt = pasteableCommand("cdkd import", [{
+		value: stackName,
+		hole: "stack"
+	}, {
+		flag: "--resource",
+		value: `${logicalId}=${physicalId}`,
+		hole: "logicalId=physicalId"
+	}]);
+	return `${diagnosis} To recover, adopt it back into state instead of re-creating it, with the command below (a selective import merges into existing state and needs no --force while the resource is absent from it). CONFIRM IT IS YOURS FIRST — a name cdkd derives is predictable, so for a globally-namespaced type it can belong to another account, and the same stack deployed in another region derives the same name. ${deleteArm}${adopt.withheld.length === 0 ? "" : " The command below prints a quoted hole in place of a value cdkd will not name on a command line; replace it whole, quotes included, with your stack name or '<logicalId>=<name>', shell-quoted."}\nAdopt with: ${adopt.command}`;
+}
+
+//#endregion
+//#region src/analyzer/skipped-outputs.ts
+function canonicalJson$1(value) {
+	return JSON.stringify(value, (_key, v) => {
+		if (v !== null && typeof v === "object" && !Array.isArray(v)) {
+			const sorted = Object.create(null);
+			for (const k of Object.keys(v).sort()) sorted[k] = v[k];
+			return sorted;
 		}
-	}
-	const readySnapshotId = await waitForNamedSnapshot({
-		snapshotId,
-		logicalId,
-		sourceId: clusterId,
-		noun: "cluster",
-		reused,
-		readyStatus: "available",
-		failedStatuses: [
-			"failed",
-			"cancelled",
-			"deleted"
-		],
-		pollStatus: async () => {
-			return (await client.send(new DescribeClusterSnapshotsCommand({ SnapshotIdentifier: snapshotId }))).Snapshots?.[0]?.Status;
-		},
-		isTransientNotFound: (e) => errorNameOrMessageIncludes(e, "ClusterSnapshotNotFoundFault"),
-		logger
+		return v;
 	});
-	await waitForRedshiftClusterSettled(client, clusterId, logicalId, logger);
-	return readySnapshotId;
 }
-async function waitForRedshiftClusterSettled(client, clusterId, logicalId, logger) {
-	const deadline = Date.now() + REDSHIFT_CLUSTER_SETTLE_TIMEOUT_MS;
-	for (;;) {
-		let status;
-		try {
-			status = (await client.send(new DescribeClustersCommand({ ClusterIdentifier: clusterId }))).Clusters?.[0]?.ClusterStatus;
-		} catch (pollError) {
-			if (errorNameOrMessageIncludes(pollError, "ClusterNotFoundFault")) return;
-			logger.debug(`Could not read Redshift cluster ${clusterId} while waiting for it to settle: ${errMsg(pollError)}`);
-			return;
-		}
-		if (status === void 0 || status === "available") {
-			await finalSnapshotDelays.sleep(PRE_DELETE_SNAPSHOT_POLL_INTERVAL_MS);
-			return;
-		}
-		if (Date.now() >= deadline) {
-			logger.info(`Redshift cluster ${clusterId} (${logicalId}) is still '${status}' after the post-snapshot settle wait — proceeding with the delete anyway.`);
-			return;
-		}
-		logger.debug(`Waiting for Redshift cluster ${clusterId} to settle (status: ${status})`);
-		await finalSnapshotDelays.sleep(PRE_DELETE_SNAPSHOT_POLL_INTERVAL_MS);
+const NO_ECHO_DEFAULT_MASK = "<cdkd:noecho-default>";
+function withNoEchoDefaultsMasked(parameters) {
+	if (parameters === null || typeof parameters !== "object" || Array.isArray(parameters)) return parameters;
+	const masked = Object.create(null);
+	for (const [name, decl] of Object.entries(parameters)) {
+		const body = decl;
+		masked[name] = typeof body === "object" && body !== null && body["NoEcho"] === true && "Default" in body ? {
+			...body,
+			Default: NO_ECHO_DEFAULT_MASK
+		} : decl;
 	}
+	return masked;
 }
-async function createReplicationGroupFinalSnapshot(client, replicationGroupId, logicalId, logger) {
-	let snapshotSource;
-	try {
-		const group = (await client.send(new DescribeReplicationGroupsCommand({ ReplicationGroupId: replicationGroupId }))).ReplicationGroups?.[0];
-		if (group === void 0) {
-			logger.debug(`Replication group ${replicationGroupId} no longer exists — skipping final snapshot for ${logicalId}`);
-			return null;
-		}
-		if (group.ClusterEnabled === true) snapshotSource = { ReplicationGroupId: replicationGroupId };
-		else {
-			const member = group.NodeGroups?.flatMap((n) => n.NodeGroupMembers ?? []).find((m) => m.CurrentRole === "primary")?.CacheClusterId ?? group.MemberClusters?.[0];
-			if (member === void 0) throw new CdkdError(`Replication group ${replicationGroupId} (${logicalId}) has cluster-mode disabled but reports no member cache cluster to snapshot. The replication group was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
-			snapshotSource = { CacheClusterId: member };
-		}
-	} catch (describeError) {
-		if (describeError instanceof CdkdError) throw describeError;
-		if (errorNameOrMessageIncludes(describeError, "ReplicationGroupNotFoundFault")) {
-			logger.debug(`Replication group ${replicationGroupId} no longer exists — skipping final snapshot for ${logicalId}`);
-			return null;
-		}
-		throw new CdkdError(`Failed to read replication group ${replicationGroupId} (${logicalId}) to pick the final snapshot source required by DeletionPolicy: Snapshot: ${errMsg(describeError)}. The replication group was NOT deleted.`, "FINAL_SNAPSHOT_FAILED", describeError instanceof Error ? describeError : void 0);
+function skippedOutputDigest(template, outputKey) {
+	const sections = Object.create(null);
+	for (const [section, body] of Object.entries(template)) {
+		if (section === "Resources" || section === "Outputs") continue;
+		sections[section] = section === "Parameters" ? withNoEchoDefaultsMasked(body) : body;
 	}
-	const matches = generatedSnapshotNameMatcher(replicationGroupId, "AWS::ElastiCache::ReplicationGroup");
-	let snapshotId;
-	try {
-		let marker;
-		for (let page = 0; page < REUSE_PROBE_MAX_PAGES && !snapshotId; page++) {
-			const existing = await client.send(new DescribeSnapshotsCommand$1({
-				...snapshotSource,
-				...marker !== void 0 && { Marker: marker }
-			}));
-			snapshotId = existing.Snapshots?.find((s) => s.SnapshotName !== void 0 && matches.test(s.SnapshotName) && s.SnapshotStatus === RESUMABLE_SNAPSHOT_STATUS)?.SnapshotName;
-			marker = existing.Marker;
-			if (marker === void 0) break;
-		}
-		if (snapshotId) logger.debug(`Resuming in-flight final snapshot ${snapshotId} for ${logicalId} (${replicationGroupId}) from a previous delete attempt`);
-	} catch (probeError) {
-		logger.debug(`Final-snapshot reuse probe failed for ${replicationGroupId}: ${errMsg(probeError)}`);
+	const entry = template.Outputs?.[outputKey];
+	return createHash("sha256").update(canonicalJson$1({
+		output: entry,
+		template: sections
+	})).digest("hex");
+}
+function collectSkippedOutputs(template, resolvedOutputs) {
+	let record;
+	for (const [outputKey, value] of Object.entries(resolvedOutputs)) {
+		if (value !== void 0) continue;
+		record ??= Object.create(null);
+		record[outputKey] = skippedOutputDigest(template, outputKey);
 	}
-	const reused = snapshotId !== void 0;
-	if (!snapshotId) {
-		const newId = buildFinalSnapshotIdentifier(replicationGroupId, "AWS::ElastiCache::ReplicationGroup");
-		try {
-			await client.send(new CreateSnapshotCommand$1({
-				...snapshotSource,
-				SnapshotName: newId
-			}));
-			snapshotId = newId;
-		} catch (createError) {
-			if (errorNameOrMessageIncludes(createError, "ReplicationGroupNotFoundFault")) {
-				logger.debug(`Replication group ${replicationGroupId} no longer exists — skipping final snapshot for ${logicalId}`);
-				return null;
+	return record;
+}
+function referencedLogicalIds(entry) {
+	const ids = /* @__PURE__ */ new Set();
+	const addName = (name) => {
+		const logicalId = name.split(".")[0];
+		if (logicalId !== void 0 && logicalId !== "" && !logicalId.startsWith("AWS::")) ids.add(logicalId);
+	};
+	const walk = (value) => {
+		if (Array.isArray(value)) {
+			for (const item of value) walk(item);
+			return;
+		}
+		if (value === null || typeof value !== "object") return;
+		const obj = value;
+		if (typeof obj["Ref"] === "string") addName(obj["Ref"]);
+		const getAtt = obj["Fn::GetAtt"];
+		if (typeof getAtt === "string") addName(getAtt);
+		else if (Array.isArray(getAtt) && typeof getAtt[0] === "string") addName(getAtt[0]);
+		for (const [key, nested] of Object.entries(obj)) {
+			if (key === "Fn::Sub") {
+				walkSub(nested);
+				continue;
 			}
-			if (errorNameOrMessageIncludes(createError, "InvalidReplicationGroupStateFault")) {
-				logger.info(`Replication group ${replicationGroupId} is not in a snapshottable state (likely already deleting) — skipping the final snapshot for ${logicalId}: ${errMsg(createError)}`);
-				return null;
+			walk(nested);
+		}
+	};
+	const walkSub = (sub) => {
+		const isPair = Array.isArray(sub);
+		const subTemplate = typeof sub === "string" ? sub : isPair ? sub[0] : void 0;
+		const variableMap = isPair && sub[1] !== null && typeof sub[1] === "object" ? sub[1] : void 0;
+		if (typeof subTemplate === "string") {
+			const declaredVars = new Set(variableMap === void 0 ? [] : Object.keys(variableMap));
+			for (const [, placeholder] of subTemplate.matchAll(/\$\{([^}]*)\}/g)) {
+				if (placeholder === void 0 || placeholder.startsWith("!")) continue;
+				if (declaredVars.has(placeholder)) continue;
+				addName(placeholder);
 			}
-			throw new CdkdError(`Failed to create the final snapshot for ${logicalId} (${replicationGroupId}) required by DeletionPolicy: Snapshot: ${errMsg(createError)}. The replication group was NOT deleted.`, "FINAL_SNAPSHOT_FAILED");
 		}
+		if (isPair) for (const [index, element] of sub.entries()) {
+			if (index === 1) {
+				if (variableMap !== void 0) for (const declared of Object.values(variableMap)) walk(declared);
+				continue;
+			}
+			walk(element);
+		}
+		else walk(sub);
+	};
+	walk(entry);
+	return ids;
+}
+function bindingSkippedOutputs(pristineTemplate, record, changedLogicalIds) {
+	const binding = /* @__PURE__ */ new Set();
+	if (record === null || record === void 0) return binding;
+	const declared = pristineTemplate.Outputs ?? {};
+	for (const [outputKey, digest] of Object.entries(record)) {
+		if (!Object.prototype.hasOwnProperty.call(declared, outputKey)) continue;
+		const entry = declared[outputKey];
+		if (digest !== skippedOutputDigest(pristineTemplate, outputKey)) continue;
+		if (changedLogicalIds !== void 0 && [...referencedLogicalIds(entry)].some((id) => changedLogicalIds.has(id))) continue;
+		binding.add(outputKey);
 	}
-	return waitForNamedSnapshot({
-		snapshotId,
-		logicalId,
-		sourceId: replicationGroupId,
-		noun: "replication group",
-		reused,
-		readyStatus: "available",
-		failedStatuses: ["failed"],
-		pollStatus: async () => {
-			return (await client.send(new DescribeSnapshotsCommand$1({ SnapshotName: snapshotId }))).Snapshots?.[0]?.SnapshotStatus;
-		},
-		isTransientNotFound: (e) => errorNameOrMessageIncludes(e, "SnapshotNotFoundFault"),
-		logger
-	});
+	return binding;
+}
+function skippedOutputsEqual(a, b) {
+	const aKeys = a === null || a === void 0 ? [] : Object.keys(a);
+	const bKeys = b === null || b === void 0 ? [] : Object.keys(b);
+	if (aKeys.length !== bKeys.length) return false;
+	return aKeys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && a?.[k] === b?.[k]);
 }
 
 //#endregion
-//#region src/deployment/rollback-executor/types.ts
-const NESTED_STACK_RESOURCE_TYPE$1 = "AWS::CloudFormation::Stack";
-const nonEmptyString = (v) => typeof v === "string" && v.length > 0;
+//#region src/deployment/outputs-export-alias/names.ts
+function isOutputSuppressedByCondition(output, conditions) {
+	return output.Condition !== void 0 && conditions?.[output.Condition] === false;
+}
+function collectPublishedOutputNames(outputs, conditions) {
+	const names = /* @__PURE__ */ new Set();
+	for (const [name, output] of Object.entries(outputs)) if (!isOutputSuppressedByCondition(output, conditions)) names.add(name);
+	return names;
+}
+function collectDeclaredOutputNames(outputs) {
+	return new Set(Object.keys(outputs));
+}
+function isExportAliasCollision(exportName, outputKey, ownedOutputNames) {
+	return exportName !== outputKey && ownedOutputNames.has(exportName);
+}
 
 //#endregion
-//#region src/deployment/rollback-executor/messages.ts
-function throwIfDeleteSkipped(result, logicalId, physicalId, duringClause, guardScope) {
-	recordRollbackDeleteGuards(result, logicalId, physicalId, guardScope);
-	const reason = deleteSkipReason(result);
-	if (reason === void 0) return;
-	throw new Error(deleteSkippedMessage(logicalId, physicalId, reason, duringClause));
+//#region src/deployment/outputs-export-alias/secret-scan.ts
+const MIN_SECRET_NEEDLE = 4;
+const SECRET_SCAN_INVISIBLES = /[\p{Cc}\p{Cf}\p{Me}\p{Zl}\p{Zp}\p{Default_Ignorable_Code_Point}]/gu;
+const SECRET_DETECTION_ONLY = /\p{Mn}/gu;
+function detectionForms(canonical) {
+	return [canonical.normalize("NFD").replace(SECRET_DETECTION_ONLY, "").normalize("NFC"), canonical.normalize("NFKD").replace(SECRET_DETECTION_ONLY, "").normalize("NFKC")];
 }
-function recordRollbackDeleteGuards(result, logicalId, physicalId, scope) {
-	for (const guard of deleteIndeterminateGuards(result)) scope.ctx.recordEvent?.({
-		eventType: "RESOURCE_GUARD_INDETERMINATE",
-		stackName: scope.stackName,
-		operation: "DELETE",
-		logicalId,
-		resourceType: scope.resourceType,
-		...scope.provisionedBy && { provisionedBy: scope.provisionedBy },
-		...physicalId && { physicalId: scope.mask(physicalId) },
-		guard: guard.guard,
-		reason: scope.mask(guard.reason)
-	});
+const DETECTION_NEEDLES = /* @__PURE__ */ new WeakMap();
+function detectionNeedlesOf(secrets, plaintext, canonical) {
+	let cache = DETECTION_NEEDLES.get(secrets);
+	if (cache === void 0) {
+		cache = /* @__PURE__ */ new Map();
+		DETECTION_NEEDLES.set(secrets, cache);
+	}
+	let forms = cache.get(plaintext);
+	if (forms === void 0) {
+		forms = detectionForms(canonical);
+		cache.set(plaintext, forms);
+	}
+	return forms;
+}
+function canonicalForSecretScan(text) {
+	return secretScanHaystacks(text)[0];
+}
+function secretScanHaystacks(text) {
+	const untrimmed = text.replace(SECRET_SCAN_INVISIBLES, "");
+	return [untrimmed.trim(), untrimmed];
+}
+function canonicalNeedle(plaintext) {
+	return plaintext.replace(SECRET_SCAN_INVISIBLES, "");
+}
+function canonicalNeedles(secrets) {
+	const out = /* @__PURE__ */ new Map();
+	for (const [plaintext, expression] of secrets ?? []) {
+		const needle = canonicalNeedle(plaintext);
+		if (needle.length > 0) out.set(needle, expression);
+	}
+	return out;
+}
+function secretsPresentIn(text, secrets) {
+	if (!secrets || secrets.size === 0) return void 0;
+	const haystacks = secretScanHaystacks(text);
+	const [markedUntrimmed, foldedUntrimmed] = detectionForms(haystacks[1]);
+	const [markedTrimmed, foldedTrimmed] = detectionForms(haystacks[0]);
+	const wideHaystacks = [[
+		markedUntrimmed.trim(),
+		markedUntrimmed,
+		markedTrimmed
+	], [
+		foldedUntrimmed.trim(),
+		foldedUntrimmed,
+		foldedTrimmed
+	]];
+	const exposure = /* @__PURE__ */ new Map();
+	for (const [plaintext, expression] of secrets) {
+		const needle = canonicalNeedle(plaintext);
+		const canonicalHit = haystacks.some((haystack) => haystack === needle || needle.length >= 4 && haystack.includes(needle));
+		const [markedNeedle, foldedNeedle] = detectionNeedlesOf(secrets, plaintext, needle);
+		const hitIn = (wides, wideNeedle, floor) => wides.some((wide) => wide === wideNeedle || floor >= 4 && wide.includes(wideNeedle));
+		const wideHit = hitIn(wideHaystacks[0], markedNeedle, markedNeedle.length) || hitIn(wideHaystacks[1], foldedNeedle, Math.min(markedNeedle.length, foldedNeedle.length));
+		const rawHit = plaintext.length >= 4 && text.includes(plaintext);
+		if (canonicalHit || wideHit || rawHit) exposure.set(plaintext, expression);
+	}
+	return exposure.size > 0 ? exposure : void 0;
+}
+function exportNameSecretExposure(exportName, substitutedIntoName, recordedThisPass, noEchoParameterValues) {
+	const exposure = new Map(substitutedIntoName);
+	for (const [plaintext, expression] of secretsPresentIn(exportName, recordedThisPass) ?? []) exposure.set(plaintext, expression);
+	for (const corpus of [substitutedIntoName, noEchoParameterValues]) {
+		if (corpus === void 0) continue;
+		for (const [plaintext, expression] of secretsPresentIn(exportName, printingCorpusOf(corpus)) ?? []) if (!exposure.has(plaintext)) exposure.set(plaintext, expression);
+	}
+	return exposure.size > 0 ? exposure : void 0;
 }
-const SKIP_FINAL_SNAPSHOT_FLAG = "--skip-final-snapshot";
-const REPLAYING_STATE_CREATE_CONTEXT = { replayingState: true };
-function replayingStateCreateContext(secrets) {
+function carriedExportAliasExposure(exportName, recordedThisPass, noEchoParameterValues) {
+	const carried = /* @__PURE__ */ new Map();
+	shareLogOnlyValues(carried, recordedThisPass);
+	const exposure = exportNameSecretExposure(exportName, carried, recordedThisPass, noEchoParameterValues);
+	if (exposure === void 0) return void 0;
 	return {
-		...REPLAYING_STATE_CREATE_CONTEXT,
-		maskSecrets: createSecretMasker(secrets)
-	};
-}
-function maskedRollbackEventError(error, mask) {
-	const extracted = extractDeploymentEventError(error);
-	if (isOwnRemedyError(error)) return {
-		...extracted,
-		ownLines: true
-	};
-	const message = mask(extracted.message);
-	return message === extracted.message ? extracted : {
-		...extracted,
-		message
+		exposure,
+		noEchoOnly: isNoEchoOnlyExposure(exposure, carried, recordedThisPass)
 	};
 }
-function recordRollbackSkip(scope, op, reason) {
-	scope.result.warnings++;
-	scope.result.skipped++;
-	scope.ctx.recordEvent?.({
-		eventType: "ROLLBACK_RESOURCE_SKIPPED",
-		stackName: scope.stackName,
-		operation: op.changeType,
-		logicalId: op.logicalId,
-		resourceType: op.resourceType,
-		...op.provisionedBy && { provisionedBy: op.provisionedBy },
-		reason: scope.mask(reason)
-	});
-}
-function rollbackCannotAddress(record, opResourceType, route, physicalId) {
-	return !(record?.resourceType === "AWS::CloudFormation::Stack" && opResourceType === "AWS::CloudFormation::Stack" && record.provisionedBy !== "cc-api" && route !== "cc-api") && !hasAddressablePhysicalId({ physicalId });
+function exportNameNoEchoParameters(exportName, sources) {
+	if (sources === void 0 || exportName === null || typeof exportName !== "object") return [];
+	return noEchoParametersReadBy(exportName, sources);
 }
-function retainedSurvivorId(record, op) {
-	if (hasAddressablePhysicalId(record)) return record.physicalId;
-	if (hasAddressablePhysicalId(op)) return op.physicalId;
+function isNoEchoOnlyExposure(exposure, substitutedIntoName, recordedThisPass) {
+	for (const plaintext of exposure.keys()) if (substitutedIntoName.has(plaintext) || recordedThisPass?.has(plaintext) === true) return false;
+	return exposure.size > 0;
 }
-const UNADDRESSABLE_SKIP_CAUSE = "Its recorded 'physicalId' is not a non-empty string, so cdkd cannot address the resource in AWS and sent nothing for it; the rollback left it and its state record exactly as they are.";
-const UNADDRESSABLE_JOURNAL_SKIP_CAUSE = "Its rollback-journal entry's 'physicalId' is not a non-empty string and no state record holds the resource, so cdkd cannot address it in AWS and sent nothing for it; if it was created in AWS, delete it manually.";
-function skipUnaddressableReplay(scope, logger, op, what, source = "record") {
-	if (source === "journal") {
-		logger.warn(safeMsg`  Rollback: Cannot ${what} ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}) ` + "— its rollback journal entry has no non-empty string 'physicalId' and no state record holds it, so cdkd cannot address it in AWS and sent nothing for it. If it was created in AWS, delete it manually.");
-		recordRollbackSkip(scope, op, UNADDRESSABLE_JOURNAL_SKIP_CAUSE);
-		return;
+function noEchoParameterValueSeed(parameters, values, inherited, userParameters) {
+	const seed = /* @__PURE__ */ new Map();
+	if (values === void 0) return seed;
+	for (const [name, value] of Object.entries(values)) {
+		if (isWholeDynamicReferenceValue(value)) continue;
+		if (parameters?.[name]?.NoEcho === true) {
+			const type = parameters[name]?.Type;
+			const ssmTyped = typeof type === "string" && type.startsWith("AWS::SSM::Parameter::Value<");
+			const spelled = Object.prototype.hasOwnProperty.call(userParameters ?? {}, name) ? userParameters?.[name] : parameters[name]?.Default;
+			if (!(ssmTyped && typeof value === "string" && (typeof spelled === "string" || typeof spelled === "number") && value === String(spelled))) recordLogOnlyParameterValue(seed, value);
+			if (!ssmTyped && (typeof spelled === "string" || typeof spelled === "number") && !isWholeDynamicReferenceValue(spelled)) recordLogOnlyParameterValue(seed, String(spelled));
+		}
+		if (inherited !== void 0) carryLogOnlyValuesCarriedBy(inherited, seed, value);
 	}
-	logger.warn(safeMsg`  Rollback: Cannot ${what} ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}) ` + "— its state record has no non-empty string 'physicalId', so cdkd cannot address it in AWS and sent nothing for it. The resource and its state record are left exactly as they are. Repair the record's 'physicalId' (inspect it with `cdkd state show`), then re-converge it with `cdkd deploy`.");
-	recordRollbackSkip(scope, op, UNADDRESSABLE_SKIP_CAUSE);
-}
-function effectiveProvisionedBy(record, fallbackProvisionedBy) {
-	return record?.provisionedBy ?? fallbackProvisionedBy;
+	return seed;
 }
-function safe(value) {
-	return displayIdent(value);
+function isWholeDynamicReferenceValue(value) {
+	if (typeof value === "string") return isSingleDynamicReferenceToken(value);
+	return Array.isArray(value) && value.length > 0 && value.every((element) => typeof element === "string" && isSingleDynamicReferenceToken(element));
 }
-const OWN_REMEDY_ERRORS = /* @__PURE__ */ new WeakSet();
-function isOwnRemedyError(error) {
-	return error instanceof Error && OWN_REMEDY_ERRORS.has(error);
+function stateKeySecretExposure(key, secrets) {
+	return secretsPresentIn(key, secrets);
 }
-function maskedFailureText(prefix, error, mask) {
-	const text = rollbackFailureText(error);
-	return prefix + (isOwnRemedyError(error) ? text : mask(text));
+function maskEveryOccurrence(text, exposure) {
+	let out = text;
+	for (const value of Array.from(exposure.keys()).sort((a, b) => b.length - a.length)) out = out.split(value).join("***");
+	return out;
 }
-function ownRemedyError(error) {
-	OWN_REMEDY_ERRORS.add(error);
-	return error;
+
+//#endregion
+//#region src/deployment/outputs-export-alias/warnings.ts
+function secretBearingExportNameWarning(outputKey, exportName, exposure, secrets, noEchoOnly = false) {
+	const corpus = printingCorpusOf(secrets ?? exposure);
+	const name = secretSafeKeyDisplay(exportName, corpus, exposure);
+	const shown = name.kind === "masked" ? `${maskedLabel(name.text)} ` : "";
+	const ownerForceMask = /* @__PURE__ */ new Map();
+	const ownerHaystacks = secretScanHaystacks(outputKey);
+	for (const [plaintext, expression] of exposure) {
+		const needle = canonicalNeedle(plaintext);
+		if (ownerHaystacks.some((haystack) => haystack === needle) || plaintext.length >= 4) ownerForceMask.set(plaintext, expression);
+	}
+	const owner = displayTextOrWithheld(secretSafeKeyDisplay(outputKey, corpus, ownerForceMask));
+	if (noEchoOnly) return `Output ${owner} has an Export.Name that resolves to a value containing a secret ${shown}— skipping the export alias. The name contains the value of a NoEcho template parameter, or a value derived from one: the whole name at any length, or embedded at 4 or more characters, even where the match is a coincidence. An export name becomes a key in state.json and in the exports index, where the value would be stored in plaintext. An existing Fn::ImportValue of this name stops resolving. Rename the export, or choose a NoEcho value the name does not contain.`;
+	return `Output ${owner} has an Export.Name that resolves to a value containing a secret ${shown}— skipping the export alias. An export name becomes a key in state.json and in the exports index, and redaction rewrites VALUES only, so publishing it would persist the secret in plaintext. Use a non-secret Export.Name.`;
 }
-function rollbackFailureText(error) {
-	if (error instanceof Error && OWN_REMEDY_ERRORS.has(error)) return error.message.split("\n").map((line) => displaySafe(line)).join("\n");
-	return displaySafe(error instanceof Error ? error.message : String(error));
+function noEchoParameterExportNameWarning(outputKey, parameterNames, secrets) {
+	const owner = displayTextOrWithheld(secretSafeKeyDisplay(outputKey, printingCorpusOf(secrets)));
+	const names = parameterNames.map((name) => displayIdent(name, { listMember: true })).join(", ");
+	return `Output ${owner} has an Export.Name that reads the NoEcho template ${parameterNames.length === 1 ? "parameter" : "parameters"} ${names} — skipping the export alias. An export name becomes a key in state.json and in the exports index, where the value would be stored in plaintext, so a name built from a NoEcho parameter is refused whatever the value's length. An existing Fn::ImportValue of this name stops resolving. Build the Export.Name without the NoEcho parameter.`;
 }
-function collisionText(msg) {
-	return displayAwsMessage(displaySafe(msg).replace(/[\s\p{Cf}\p{Default_Ignorable_Code_Point}\u2800]{2,}/gu, " "));
+function mergedExposure(a, b) {
+	if (a === void 0) return b;
+	if (b === void 0) return a;
+	return new Map([...a, ...b]);
 }
-function collisionLine(maskedMsg) {
-	return JSON.stringify(collisionText(maskedMsg));
+function secretSafeKeyDisplay(key, secrets, forceMask) {
+	const [shown, untrimmed] = secretScanHaystacks(key);
+	const exposure = mergedExposure(stateKeySecretExposure(key, secrets), forceMask === void 0 ? void 0 : secretsPresentIn(key, forceMask));
+	const mask = canonicalNeedles(forceMask);
+	for (const [plaintext, expression] of exposure ?? []) {
+		const needle = canonicalNeedle(plaintext);
+		if (needle.length > 0) mask.set(needle, expression);
+	}
+	if (mask.size === 0) return {
+		kind: "safe",
+		text: shown
+	};
+	const masked = maskEveryOccurrence(untrimmed, mask);
+	if (masked === untrimmed) return exposure ? { kind: "withheld" } : {
+		kind: "safe",
+		text: shown
+	};
+	if (stateKeySecretExposure(masked, secrets) || forceMask !== void 0 && secretsPresentIn(masked, forceMask)) return { kind: "withheld" };
+	return {
+		kind: "masked",
+		text: canonicalForSecretScan(masked)
+	};
 }
-const PASTEABLE_LOGICAL_ID = /^[A-Za-z0-9]{1,255}$/;
-function refusalLogicalId(logicalId) {
-	return typeof logicalId === "string" && PASTEABLE_LOGICAL_ID.test(logicalId) ? logicalId : "a resource whose logical id is not a plain CloudFormation logical id";
+function secretBearing(display) {
+	return display.kind !== "safe";
 }
-function shownLogicalId(logicalId) {
-	return typeof logicalId === "string" ? logicalIdShown(logicalId) : "a logical id that is not a plain identifier";
+const WITHHELD_NAME_DISPLAY = "<name withheld: contains a secret>";
+function displayTextOrWithheld(display) {
+	return display.kind === "withheld" ? WITHHELD_NAME_DISPLAY : display.text;
 }
-function shownChangeType(changeType) {
-	return typeof changeType === "string" ? plainOrDescribed(changeType, "change type") : "a change type that is not a plain identifier";
+function maskedLabel(maskedText) {
+	return /[^ -~]/.test(maskedText) ? "(masked, name withheld: it carries characters this line cannot show as tested)" : `(masked: ${displayIdent(maskedText)})`;
 }
-function refusalResourceType(resourceType) {
-	return typeof resourceType === "string" ? resourceTypeShown(resourceType) : "a resource type that is not a plain identifier";
+function secretBearingStateKeyWarning(stackName, display) {
+	const clause = display.kind === "masked" ? `${maskedLabel(display.text)} ` : `(the name is withheld: masking it would leave the secret readable) `;
+	return `State for ${displayStackName(canonicalForSecretScan(stackName))} holds an output KEY that renders a secret ${clause}— cdkd scrub cannot rewrite a key, only a value, because the key IS the export name consumers resolve by. Give that output a non-secret Export.Name and redeploy: the next deploy replaces state.outputs and the exports index entirely. ROTATE the exposed secret.`;
 }
-function quotedPlainOr(value, what) {
-	if (typeof value !== "string" || Array.from(value).length > 255) return `a ${what} that is not a plain identifier`;
-	const unindexed = value.replace(/\[\d+\]/g, "");
-	return unindexed !== "" && plainIdentOr(unindexed, "") === unindexed ? `'${value}'` : `a ${what} that is not a plain identifier`;
+function exportAliasCollisionWarning(outputKey, exportName, secrets) {
+	const corpus = printingCorpusOf(secrets);
+	const shown = displayTextOrWithheld(secretSafeKeyDisplay(exportName, corpus));
+	const from = displayTextOrWithheld(secretSafeKeyDisplay(outputKey, corpus));
+	return `Output ${from} exports as "${shown}", which is also the name of another output in this stack — skipping the export alias, so output ${shown} keeps its own value and the export is not published. A consumer's Fn::ImportValue on "${shown}" therefore resolves to output ${shown}, NOT to ${from} (CloudFormation would publish both). Rename the export, or the colliding output.`;
 }
-const DESCRIBED_PHYSICAL_ID = "a physical id that is not a plain identifier";
-function refusalPhysicalId(maskedPhysicalId) {
-	return physicalIdShownBesideCommand(maskedPhysicalId, { maskToken: "***" }) ?? DESCRIBED_PHYSICAL_ID;
+function exportAliasCollisionScrubWarning(outputKey, exportName, secrets) {
+	const corpus = printingCorpusOf(secrets);
+	const nameDisplay = (name) => secretSafeKeyDisplay(name, corpus);
+	const exportDisplay = nameDisplay(exportName);
+	const shown = displayTextOrWithheld(exportDisplay);
+	const storedUnder = exportDisplay.kind === "withheld" ? "the stored value under that name" : `the stored value under "${shown}"`;
+	const ownerDisplay = nameDisplay(outputKey);
+	return `Output ${ownerDisplay.kind === "withheld" && exportDisplay.kind === "withheld" ? "<the owning output, name withheld: contains a secret>" : displayTextOrWithheld(ownerDisplay)} exports as ${exportDisplay.kind === "withheld" ? shown : `"${shown}"`}, which is also the name of another output in this stack — state cannot say which of the two ${storedUnder} came from, so that key is redacted by value match instead of by template position, and two references resolving to the same value could still collapse there. Rename the export, or the colliding output, and redeploy.`;
 }
-function describedPhysicalIdPointer(...shown) {
-	return shown.includes(DESCRIBED_PHYSICAL_ID) ? " A physical id is left out of the prose above: it is not a plain identifier — read it from the rollback journal or from the state record of the stack." : "";
+
+//#endregion
+//#region src/deployment/deploy-engine/outputs.ts
+var ForwardingSecrets = class extends Map {
+	target;
+	constructor(target) {
+		super();
+		this.target = target;
+	}
+	set(plaintext, expression) {
+		super.set(plaintext, expression);
+		this.target?.set(plaintext, expression);
+		return this;
+	}
+};
+function handleOutputResolutionFailure(error, outputKey, outputs, secrets, inheritedSecrets) {
+	const union = unionOfSecretBags([inheritedSecrets, secrets]);
+	const detail = maskSecretsInText(error instanceof Error ? error.message || error.name : String(error), union);
+	if (this.options.strictGetAtt) {
+		const cause = typeof error === "string" ? maskSecretsInText(error, union) : maskSecretsInError(error, union);
+		throw new Error(`Failed to resolve output ${outputKey}: ${detail} (--strict-getatt promotes output resolution failures to deploy errors; drop the flag to skip the output instead)`, cause instanceof Error || typeof cause === "string" ? { cause } : {});
+	}
+	this.logger.warn(`Failed to resolve output ${outputKey}: ${detail}`);
+	outputs[outputKey] = void 0;
 }
-function orphanRemedy(logicalId, ctx) {
-	if (ctx.nestedChildRevert === true) return {
-		offered: false,
-		clause: ` This op is reverted inside the revert of a nested stack for the rollback of its parent, where cdkd rollback --orphan cannot reach it: resolve the cause and re-run the rollback of the top-level stack, or re-deploy the top-level stack.${typeof logicalId === "string" && PASTEABLE_LOGICAL_ID.test(logicalId) ? "" : " The id is left out of the prose above: it is not a plain CloudFormation logical id — read it from cdkd events."}`,
-		line: ""
+async function resolveOutputs(template, resources, stackName, digestSource, parameterValues, conditions) {
+	this.resolvedExportNames = [];
+	this.carriedExportAliasRefusal = void 0;
+	if (!template.Outputs) {
+		this.carriedExportAliasRefusal = seedOnlyAliasRefusal(noEchoParameterValueSeed(template.Parameters, parameterValues, this.options.inheritedSecrets, this.options.parameters));
+		return {};
+	}
+	const outputs = Object.create(null);
+	const context = this.buildResolverContext({
+		template,
+		resources,
+		...parameterValues && { parameters: parameterValues },
+		...conditions && { conditions }
+	}, stackName);
+	context.printingSecrets = /* @__PURE__ */ new Map();
+	const refuseMaskedOutputReads = (outputKey, ownReads) => {
+		const added = ownReads.filter((read) => read.kind === "ref-state-key");
+		if (added.length === 0) return;
+		throw markNonRetryable(/* @__PURE__ */ new Error(`Cannot resolve ${added.map((read) => read.display).join(", ")} for output ${outputKey}: cdkd's recorded state holds only the redaction mask there, so this output would publish a value cdkd cannot confirm (for most such types the resource's raw physical id) instead of the value CloudFormation's Ref returns — a possibly wrong value that a consuming stack's Fn::ImportValue would accept and send to AWS. The output is not published. ${DeployEngine.maskedRecordRemedyFor(added, context.resources)}`));
 	};
-	const pasteable = typeof logicalId === "string" && PASTEABLE_LOGICAL_ID.test(logicalId);
-	const idClause = pasteable ? "" : " The id is left out of the prose above and of that command: it is not a plain CloudFormation logical id, so a pasted command could be reshaped by the shell or name a different resource — read it from cdkd events and fill the quoted hole.";
-	const target = ctx.nestedChildStack === void 0 ? void 0 : pasteableCommand("cdkd rollback", [{
-		value: ctx.nestedChildStack,
-		hole: "stack",
-		opts: { plainIdent: true }
-	}, {
-		flag: "--stack-region",
-		value: ctx.region,
-		hole: "region",
-		opts: {
-			plainIdent: true,
-			maxCodePoints: 128
+	const outputsPassSecrets = context.recordedSecretValues ?? EMPTY_SECRETS;
+	const outputsPassInherited = context.inheritedSecrets ?? EMPTY_SECRETS;
+	if (context.recordedSecretValues) this.outputsPassSecretMaps.push(context.recordedSecretValues);
+	const publishedOutputNames = collectPublishedOutputNames(template.Outputs, conditions);
+	let outputsPassCompleted = false;
+	try {
+		for (const [outputKey, output] of Object.entries(template.Outputs)) {
+			if (isOutputSuppressedByCondition(output, conditions)) {
+				this.logger.debug(`Skipping output ${outputKey} — condition ${output.Condition} is false`);
+				continue;
+			}
+			const ownReads = [];
+			try {
+				const resolved = await this.resolver.resolve(output.Value, {
+					...context,
+					redactedAttributeReads: ownReads
+				});
+				refuseMaskedOutputReads(outputKey, ownReads);
+				if (resolved === void 0 && this.options.strictGetAtt) throw markNonRetryable(/* @__PURE__ */ new Error("the value resolved to nothing"));
+				outputs[outputKey] = resolved;
+			} catch (error) {
+				this.handleOutputResolutionFailure(error, outputKey, outputs, outputsPassSecrets, outputsPassInherited);
+			}
 		}
-	}]);
-	const stackClause = target === void 0 ? "" : " This is the rollback of the nested stack itself, and only a rollback of the nested stack itself honours --orphan for this op, so the command names it." + withheldTargetClause(target, "stack", "cdkd rollback", "The name of the nested stack");
-	const rollbackVerb = (target ?? pasteableCommand("cdkd rollback")).command;
-	return {
-		offered: true,
-		clause: `${stackClause}${idClause}`,
-		line: `\nTo orphan it: ${rollbackVerb} --orphan ${pasteable ? logicalId : commandHole("id")}`
-	};
-}
-function rerunRollbackPhrase(ctx, topLevel) {
-	return ctx.nestedChildStack === void 0 ? topLevel : `the rollback of the nested stack ${quotedOrDescribed(ctx.nestedChildStack, "nested stack name")} itself`;
-}
-function rollbackFinalSnapshotId(resourceType, record, fallbackProvisionedBy) {
-	if (record.updateReplacePolicy !== "Snapshot") return void 0;
-	if (!ATOMIC_FINAL_SNAPSHOT_TYPES.has(resourceType)) return void 0;
-	if (effectiveProvisionedBy(record, fallbackProvisionedBy) === "cc-api") return void 0;
-	return buildFinalSnapshotIdentifier(record.physicalId, resourceType);
+		const noEchoSeed = noEchoParameterValueSeed(template.Parameters, parameterValues, context.inheritedSecrets, this.options.parameters);
+		const noEchoSources = this.noEchoPositionSources(resources, template, conditions);
+		this.carriedExportAliasRefusal = (outputKey, exportName) => {
+			const verdict = carriedExportAliasExposure(exportName, outputsPassSecrets, noEchoSeed);
+			if (verdict === void 0) return void 0;
+			return secretBearingExportNameWarning(outputKey, exportName, verdict.exposure, context.recordedSecretValues, verdict.noEchoOnly);
+		};
+		const resolvedNames = [];
+		for (const [outputKey, output] of Object.entries(template.Outputs)) {
+			if (isOutputSuppressedByCondition(output, conditions)) continue;
+			if (!output.Export?.Name) continue;
+			const value = outputs[outputKey];
+			if (value === void 0) continue;
+			const nameSecrets = new ForwardingSecrets(context.recordedSecretValues);
+			if (context.recordedSecretValues) shareLogOnlyValues(nameSecrets, context.recordedSecretValues);
+			const nameReads = [];
+			let exportName;
+			try {
+				exportName = typeof output.Export.Name === "string" ? output.Export.Name : await this.resolver.resolve(output.Export.Name, {
+					...context,
+					recordedSecretValues: nameSecrets,
+					redactedAttributeReads: nameReads
+				});
+				refuseMaskedOutputReads(outputKey, nameReads);
+			} catch (error) {
+				this.handleOutputResolutionFailure(error, outputKey, outputs, outputsPassSecrets, outputsPassInherited);
+				continue;
+			}
+			if (typeof exportName !== "string") continue;
+			resolvedNames.push({
+				outputKey,
+				exportName,
+				value,
+				outputValue: output.Value,
+				nameSource: output.Export.Name,
+				nameSecrets
+			});
+		}
+		for (const { outputKey, exportName, value, outputValue, nameSource, nameSecrets } of resolvedNames) {
+			const noEchoParameters = exportNameNoEchoParameters(nameSource, noEchoSources);
+			const exposure = noEchoParameters.length > 0 ? void 0 : exportNameSecretExposure(exportName, nameSecrets, context.recordedSecretValues, noEchoSeed);
+			if (noEchoParameters.length > 0) this.logger.warn(noEchoParameterExportNameWarning(outputKey, noEchoParameters, outputsPassSecrets));
+			else if (exposure) this.logger.warn(secretBearingExportNameWarning(outputKey, exportName, exposure, context.recordedSecretValues, isNoEchoOnlyExposure(exposure, nameSecrets, context.recordedSecretValues)));
+			else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) this.logger.warn(exportAliasCollisionWarning(outputKey, exportName, outputsPassSecrets));
+			else {
+				outputs[exportName] = value;
+				if (!this.resolvedExportNames.includes(exportName)) this.resolvedExportNames.push(exportName);
+				this.outputsTemplateSource[exportName] = outputValue;
+			}
+		}
+		outputsPassCompleted = true;
+	} finally {
+		if (!outputsPassCompleted) this.outputsSourceUsable = false;
+	}
+	for (const [outputKey, output] of Object.entries(template.Outputs)) {
+		if (!publishedOutputNames.has(outputKey)) continue;
+		this.outputsTemplateSource[outputKey] = output.Value;
+	}
+	this.skippedOutputs = collectSkippedOutputs(digestSource, outputs);
+	return markSameGenerationBag(outputs);
 }
-function rollbackRetainsNewResource(record) {
-	return record?.updateReplacePolicy === "Retain";
+function buildDisplayOutputs(template, resolvedOutputs) {
+	const display = {};
+	if (!template.Outputs) return display;
+	for (const key of Object.keys(template.Outputs)) {
+		const v = resolvedOutputs[key];
+		if (v !== void 0) display[key] = v;
+	}
+	return display;
 }
-function retainedSurvivorMessages(logicalId, resourceType, survivorPhysicalId, stateClause, mask = (text) => text) {
-	const survivorId = mask(survivorPhysicalId);
-	const clause = mask(stateClause);
-	return {
-		warn: `  ⚠ ${safe(logicalId)} (${safe(resourceType)}) has UpdateReplacePolicy: Retain — the replacement's new physical resource (${displaySafe(survivorId)}) is RETAINED by this rollback and is no longer tracked by cdkd: it keeps running and incurring cost, and destroying the stack will not remove it. Delete it yourself once you no longer need it. ${displaySafe(clause)}`,
-		reason: `UpdateReplacePolicy: Retain kept the replacement's new ${resourceType} (${survivorId}); it is live, still billing, and no longer tracked by cdkd. ${clause}`
+function seedOnlyAliasRefusal(seed) {
+	return (outputKey, exportName) => {
+		const verdict = carriedExportAliasExposure(exportName, /* @__PURE__ */ new Map(), seed);
+		if (verdict === void 0) return void 0;
+		return secretBearingExportNameWarning(outputKey, exportName, verdict.exposure, EMPTY_SECRETS, verdict.noEchoOnly);
 	};
 }
 
 //#endregion
-//#region src/deployment/rollback-executor/names.ts
-function replayPrefixScope(input, logger, mask, restoring) {
-	const choice = replayPrefixChoice(input);
-	if (choice.kind === "not-applicable") return (fn) => fn();
-	const setting = (skip) => skip ? "SKIPPED" : "KEPT";
-	const subject = `${safe(input.logicalId)} (${safe(input.resourceType)})`;
-	const declared = choice.declared;
-	const secretDerived = declared !== void 0 && mask(declared) !== declared;
-	const withheld = secretDerived || choice.kind === "unreproduced" && declared === void 0;
-	const shown = (value) => displayIdent(mask(String(value)));
-	const quoted = (value) => {
-		const masked = mask(value);
-		const rendered = displayIdent(masked);
-		return rendered === masked ? `"${masked}"` : rendered;
-	};
-	if (choice.kind === "reproduced" && choice.skipPrefix !== choice.recorded) logger.info(mask(`  Rollback: ${restoring ? "re-creating" : "reverting"} ${subject} under the user-supplied-name prefix setting that created ` + (withheld ? `it (its physical id is withheld, as its name is secret-derived): ` : `${shown(input.physicalId)} (`) + `stack-name prefix ${setting(choice.skipPrefix)}; the failed deploy ran with it ${setting(choice.recorded)}${withheld ? "" : ")"}`));
-	else if (choice.kind === "unreproduced" && restoring) {
-		const idUnreadable = typeof input.physicalId !== "string" || input.physicalId === "";
-		const prop = safe(choice.property);
-		const unreadable = declared === void 0 ? idUnreadable ? `its ${prop} or its physical id` : `its ${prop}` : idUnreadable ? `its physical id` : void 0;
-		logger.warn(mask(`  ⚠ ${subject}: cdkd cannot tell which user-supplied-name prefix setting created the old resource (` + (withheld ? `its physical id is withheld, as its name is secret-derived or unreadable` : shown(input.physicalId)) + `) — ` + (choice.names === void 0 ? unreadable !== void 0 ? `cdkd cannot read ${unreadable} to compare` : `cdkd cannot derive the names its ${prop} takes to compare` : secretDerived ? `its ${prop} is secret-derived, and neither name it derives matches` : `its ${prop} derives to ${quoted(choice.names.skipped)} (prefix skipped) or ${quoted(choice.names.kept)} (prefix kept), and it is neither`) + `; re-creating it with the stack-name prefix ${setting(choice.skipPrefix)}, as the failed deploy ran, so it may come back under a different physical name.`));
+//#region src/state/deployment-events-store.ts
+const DEPLOYMENT_EVENTS_MAX_INDEX_RUNS = 20;
+const FLUSH_INTERVAL_MS = 2e3;
+const FLUSH_EVENT_THRESHOLD = 50;
+function newDeploymentRunId(now = /* @__PURE__ */ new Date()) {
+	return `${now.toISOString().replace(/[-:.]/g, "")}-${randomUUID().slice(0, 8)}`;
+}
+function deploymentEventsKey(prefix, stackName, region, runId) {
+	return `${prefix}/${stackName}/${region}/deployments/${runId}.jsonl`;
+}
+function deploymentEventsIndexKey(prefix, stackName, region) {
+	return `${prefix}/${stackName}/${region}/deployments/index.json`;
+}
+function deploymentsDirPrefix(prefix, stackName, region) {
+	return `${prefix}/${stackName}/${region}/deployments/`;
+}
+const DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION = "deployment-event streams and their index, whose recorded error messages can quote values the secret mask does not catch";
+async function deleteAndPurgeEventObjects(backend, keys, dirPrefix, scope = "deleted-keys") {
+	if (keys.length === 0) return void 0;
+	let swept;
+	try {
+		await backend.deleteRawObjects(keys);
+	} finally {
+		if (scope === "whole-dir") swept = await backend.purgeNoncurrentVersionsUnderPrefix(dirPrefix, { objectDescription: DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION });
+		else await backend.purgeNoncurrentVersions(keys, {
+			...keys.length > 1 && { listPrefix: dirPrefix },
+			objectDescription: DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION
+		});
 	}
-	const skip = choice.skipPrefix;
-	return (fn) => withSkipPrefix(skip, fn);
+	return swept;
 }
-function createOpMasker(logger, secrets) {
-	const base = createMaskedLogSinks(logger, (text) => maskSecretsInText(text, secrets));
-	const pairs = [];
-	let sinks = base;
-	return {
-		mask: (text) => typeof text === "string" ? sinks.mask(text) : text,
-		addNamed: (record) => {
-			pairs.push(...secretDerivedNamePairs(record));
-			sinks = withDerivedNameMasks(logger, base, pairs);
-		}
-	};
+function runIdTimestampMs(runId) {
+	const m = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})(\d{3})Z/.exec(runId);
+	if (!m) return null;
+	const iso = `${m[1]}-${m[2]}-${m[3]}T${m[4]}:${m[5]}:${m[6]}.${m[7]}Z`;
+	const ms = Date.parse(iso);
+	return Number.isNaN(ms) ? null : ms;
 }
-const OTHER_SPELLED_NAME_KEYS = {
-	"AWS::Cognito::UserPoolDomain": ["Domain"],
-	"AWS::Cognito::UserPoolUser": ["Username"],
-	"AWS::ECS::TaskDefinition": ["Family"],
-	"AWS::ElastiCache::ReplicationGroup": ["ReplicationGroupId"],
-	"AWS::ElastiCache::User": ["UserId"],
-	"AWS::ElastiCache::UserGroup": ["UserGroupId"],
-	"AWS::SES::EmailIdentity": ["EmailIdentity"]
-};
-const COMPOSITE_SCOPE_LAST = /^(?:REGIONAL|CLOUDFRONT|GLOBAL)$/;
-const COMPOSITE_POOL_FIRST = /^[a-z]{2}(?:-gov)?-[a-z]+-\d+_[A-Za-z0-9]+$/;
-function idNameSegments(id) {
-	const segments = /* @__PURE__ */ new Set();
-	const arn = /^arn:[^:]*:([^:]*):[^:]*:[^:]*:(.+)$/.exec(id);
-	if (arn !== null) {
-		const service = arn[1];
-		const resource = arn[2];
-		const lambda = service === "lambda" ? /^(?:function|layer):([^:]+)(?::([^:]+))?/.exec(resource) : null;
-		if (lambda !== null) {
-			segments.add(lambda[1]);
-			const qualifier = lambda[2];
-			if (qualifier !== void 0 && !/^\d+$/.test(qualifier)) segments.add(qualifier);
-		} else {
-			const parts = resource.split(/[/:]/).filter((part) => part !== "");
-			let body = parts.length > 1 ? parts.slice(1) : parts;
-			if (body.length > 1 && /^\d+$/.test(body[body.length - 1])) body = body.slice(0, -1);
-			for (const part of body) {
-				segments.add(part);
-				if (service === "secretsmanager") segments.add(part.replace(/-[A-Za-z0-9]{6}$/, ""));
-			}
+function runIdFromJsonlKey(key, dirPrefix) {
+	if (!key.startsWith(dirPrefix) || !key.endsWith(".jsonl")) return null;
+	return key.slice(dirPrefix.length, -6);
+}
+var DeploymentEventsStore = class {
+	logger = getLogger().child("DeploymentEvents");
+	backend;
+	stackName;
+	region;
+	command;
+	runId;
+	cdkdVersion;
+	startedAt;
+	events = [];
+	persistedCount = 0;
+	flushTimer;
+	writeChain = Promise.resolve();
+	warnedOnce = false;
+	finalized = false;
+	constructor(backend, options) {
+		this.backend = backend;
+		this.stackName = options.stackName;
+		this.region = options.region;
+		this.command = options.command;
+		this.runId = options.runId ?? newDeploymentRunId();
+		this.cdkdVersion = options.cdkdVersion ?? getCdkdVersion();
+		this.startedAt = (/* @__PURE__ */ new Date()).toISOString();
+	}
+	record(event) {
+		try {
+			if (this.finalized) return;
+			this.events.push({
+				timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+				...event
+			});
+			if (this.events.length - this.persistedCount >= FLUSH_EVENT_THRESHOLD) this.scheduleFlush(0);
+			else this.scheduleFlush(FLUSH_INTERVAL_MS);
+		} catch {}
+	}
+	async finalize(result) {
+		if (this.finalized) return;
+		this.finalized = true;
+		if (this.flushTimer) {
+			clearTimeout(this.flushTimer);
+			this.flushTimer = void 0;
 		}
+		if (this.events.length === 0) return;
+		await this.enqueueWrite(async () => {
+			const indexRead = this.readIndexRuns();
+			indexRead.catch(() => {});
+			await this.doFlush();
+			await this.writeIndexAndPrune(result, await indexRead);
+		});
 	}
-	if (id.includes("/")) {
-		const afterSlash = id.slice(id.lastIndexOf("/") + 1);
-		segments.add(afterSlash);
-		segments.add(afterSlash.replace(/:\d+$/, ""));
+	async writeIndexAndPrune(result, existingRuns) {
+		const { key, file, runs } = this.buildIndexUpdate(result, existingRuns);
+		const keptRunIds = runs.map((r) => r.runId);
+		const willPrune = keptRunIds.length >= 20;
+		const dirPrefix = deploymentsDirPrefix(this.backend.prefix, this.stackName, this.region);
+		const staleKeysRead = willPrune ? this.backend.listRawKeys(dirPrefix) : void 0;
+		staleKeysRead?.catch(() => {});
+		await this.backend.putRawObject(key, JSON.stringify(file, null, 2));
+		if (!staleKeysRead) return;
+		await this.pruneSupersededRunFiles(keptRunIds, dirPrefix, await staleKeysRead);
 	}
-	if (id.includes("|")) {
-		const parts = id.split("|");
-		parts.forEach((part, index) => {
-			if (part === "") return;
-			if (index === parts.length - 1 && parts.length > 1 && COMPOSITE_SCOPE_LAST.test(part)) return;
-			if (index === 0 && parts.length > 1 && COMPOSITE_POOL_FIRST.test(part)) return;
-			segments.add(part);
-		});
+	async drain() {
+		await this.writeChain;
 	}
-	return [...segments].filter((segment) => segment.length >= 4 && segment !== id);
-}
-function ownEntry(table, key) {
-	return Object.hasOwn(table, key) ? table[key] : void 0;
-}
-function secretDerivedNamePairs(record) {
-	const { resourceType, properties, logicalId } = record;
-	if (typeof resourceType !== "string" || !isRestorableBag(properties)) return [];
-	const rewritten = reverseReplacementRewrittenNameTypes();
-	const named = /* @__PURE__ */ new Set();
-	const primary = Object.hasOwn(rewritten, resourceType) ? rewritten[resourceType].property : explicitNamePropertyFor(resourceType);
-	if (typeof primary === "string") named.add(primary);
-	for (const key of Object.keys(properties)) if (/(?:Name|Identifier)$/.test(key)) named.add(key);
-	for (const key of ownEntry(OTHER_SPELLED_NAME_KEYS, resourceType) ?? []) named.add(key);
-	const idSpellings = record.physicalIds.filter((id) => typeof id === "string" && id !== "").flatMap((id) => [
-		id,
-		...id.toLowerCase() === id || id.length < 4 ? [] : [id.toLowerCase()],
-		finalSnapshotNamePrefix(id, resourceType),
-		...idNameSegments(id)
-	]);
-	const pairs = [];
-	for (const key of named) {
-		if (!Object.hasOwn(properties, key)) continue;
-		const value = properties[key];
-		if (typeof value !== "string" || value === "") continue;
-		const derived = key === primary && !value.includes("{{resolve:") && value !== "***" ? rewrittenNameSpellings(resourceType, value, logicalId) : [];
-		for (const spelling of [...idSpellings, ...derived]) pairs.push([value, spelling]);
+	scheduleFlush(delayMs) {
+		if (this.flushTimer) {
+			if (delayMs > 0) return;
+			clearTimeout(this.flushTimer);
+		}
+		this.flushTimer = setTimeout(() => {
+			this.flushTimer = void 0;
+			this.enqueueWrite(() => this.doFlush());
+		}, delayMs);
+		this.flushTimer.unref?.();
 	}
-	return pairs;
-}
-function addRecordNames(opMasker, op, current) {
-	const { logicalId } = op;
-	for (const properties of [op.properties, op.attemptedProperties]) opMasker.addNamed({
-		resourceType: op.resourceType,
-		properties,
-		logicalId,
-		physicalIds: [op.physicalId]
-	});
-	for (const record of [op.previousState, current]) {
-		if (record === null || typeof record !== "object") continue;
-		opMasker.addNamed({
-			resourceType: record.resourceType ?? op.resourceType,
-			properties: record.properties,
-			logicalId,
-			physicalIds: [record.physicalId]
+	enqueueWrite(op) {
+		const next = this.writeChain.then(op).catch((err) => {
+			this.warnOnce(`Failed to persist deployment events for run ${this.runId}: ${describeAwsFailure(err).detail}`);
 		});
+		this.writeChain = next;
+		return next;
 	}
-}
-const ABSENT_BASELINE_SKIP_CAUSE = "Its recorded previous state has no `properties` bag, so there is nothing to restore it to; the rollback left the resource exactly as it is.";
-function requireRestorableBaseline(bag, logger, { logicalId, consequence, remedy, retry }) {
-	if (isRestorableBag(bag)) return true;
-	if (bag === void 0) {
-		logger.warn(`  Rollback: Cannot restore ${shownLogicalId(logicalId)} \u2014 its recorded previous state has no \`properties\` bag, so there is nothing to restore it to. An empty desired state would ${consequence}. The resource is therefore left exactly as it is. ${remedy}`);
-		return false;
+	async doFlush() {
+		if (this.events.length === 0 || this.events.length === this.persistedCount) return;
+		const snapshotCount = this.events.length;
+		const body = this.events.slice(0, snapshotCount).map((e) => JSON.stringify(e)).join("\n");
+		await this.backend.putRawObject(deploymentEventsKey(this.backend.prefix, this.stackName, this.region, this.runId), body + "\n", "application/x-ndjson");
+		this.persistedCount = snapshotCount;
 	}
-	const shape = bag === null ? "null" : Array.isArray(bag) ? "an array" : `a ${typeof bag}`;
-	throw new CdkdError(`Cannot roll ${shownLogicalId(logicalId)} back: its recorded previous state has a \`properties\` field that is not a property bag (${shape}), so cdkd cannot tell what to restore it to. Replaying it would do one of two things, and cdkd does neither: send the malformed value to the provider as-is, or send an empty desired state (which would ${consequence}). The rollback JOURNAL record is kept: once that record holds a property bag again, ${retry}. Otherwise fix forward with \`cdkd deploy\`, or remove the stack with \`cdkd destroy\`.`, "ROLLBACK_UNUSABLE_BASELINE");
-}
-function isRestorableBag(bag) {
-	return typeof bag === "object" && bag !== null && !Array.isArray(bag);
-}
-async function prepareCreateRollbackFinalSnapshot(op, provisionedBy, ctx, mask) {
-	const { logicalId, resourceType } = op;
-	const physicalId = op.physicalId;
-	switch (finalSnapshotMechanism(resourceType, provisionedBy)) {
-		case "atomic-delete-parameter": return buildFinalSnapshotIdentifier(physicalId, resourceType);
-		case "pre-delete-snapshot":
-			await createPreDeleteFinalSnapshot(resourceType, physicalId, logicalId, ctx.finalSnapshotClients ?? getAwsClients(), {
-				info: (message) => ctx.logger.info(mask(message)),
-				debug: (message) => ctx.logger.debug(mask(message))
-			});
-			return;
-		case "refuse-cc-routed": throw ccRoutedFinalSnapshotError(logicalId, resourceType, SKIP_FINAL_SNAPSHOT_FLAG);
-		case "refuse-unsupported-type": throw unsupportedFinalSnapshotError(logicalId, resourceType, SKIP_FINAL_SNAPSHOT_FLAG);
+	async readIndexRuns() {
+		const key = deploymentEventsIndexKey(this.backend.prefix, this.stackName, this.region);
+		try {
+			const raw = await this.backend.getRawObject(key);
+			if (raw !== null) {
+				const parsed = JSON.parse(raw);
+				if (Array.isArray(parsed.runs)) return parsed.runs;
+			}
+		} catch (err) {
+			this.logger.debug(`Deployment-events index unreadable, rewriting: ${describeAwsFailure(err).detail}`);
+		}
+		return [];
 	}
-}
-
-//#endregion
-//#region src/deployment/secret-name-needles.ts
-function secretNameNeedlesOf(logicalId, record, secrets, options) {
-	const physicalId = typeof record?.physicalId === "string" && record.physicalId !== "" ? record.physicalId : void 0;
-	const bag = secrets !== void 0 && hasMaskableValues(secrets) ? secrets : void 0;
-	const mask = (text) => bag === void 0 ? text : maskSecretsInText(text, bag);
-	const unresolved = (value) => value.includes("{{resolve:") || value === "***";
-	const named = {
-		resourceType: record?.resourceType,
-		properties: record?.properties,
-		logicalId
-	};
-	const needles = /* @__PURE__ */ new Set();
-	const add = (needle) => {
-		if (typeof needle === "string" && needle !== "") needles.add(needle);
-	};
-	for (const [raw, derived] of secretDerivedNamePairs({
-		...named,
-		physicalIds: []
-	})) if (typeof raw === "string" && !unresolved(raw) && isSecretDerivedValue(raw, mask)) add(derived);
-	for (const [raw, spelling] of secretDerivedNamePairs({
-		...named,
-		physicalIds: [physicalId ?? "cdkd-no-physical-id-yet"]
-	})) {
-		if (!isSecretDerivedValue(raw, mask)) continue;
-		if (unresolved(raw)) {
-			if (physicalId === void 0) continue;
-			add(spelling);
-		} else {
-			add(raw);
-			if (raw.toLowerCase() !== raw && raw.length >= 4) add(raw.toLowerCase());
+	buildIndexUpdate(result, existingRuns) {
+		const key = deploymentEventsIndexKey(this.backend.prefix, this.stackName, this.region);
+		const runs = [{
+			runId: this.runId,
+			command: this.command,
+			cdkdVersion: this.cdkdVersion,
+			startedAt: this.startedAt,
+			finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			result,
+			eventCount: this.persistedCount
+		}, ...existingRuns.filter((r) => r.runId !== this.runId)].slice(0, 20);
+		return {
+			key,
+			file: {
+				indexVersion: 1,
+				stackName: this.stackName,
+				region: this.region,
+				runs,
+				lastModified: Date.now()
+			},
+			runs
+		};
+	}
+	async pruneSupersededRunFiles(keptRunIds, dirPrefix, keys) {
+		if (keptRunIds.length < 20) return;
+		const cutoff = keptRunIds.reduce((min, id) => id < min ? id : min, keptRunIds[0]);
+		const stale = keys.filter((k) => {
+			const runId = runIdFromJsonlKey(k, dirPrefix);
+			return runId !== null && runId < cutoff;
+		});
+		if (stale.length === 0) return;
+		await deleteAndPurgeEventObjects(this.backend, stale, dirPrefix);
+		this.logger.debug(`Pruned ${stale.length} superseded deployment-event stream(s) for ${this.stackName} (${this.region})`);
+	}
+	warnOnce(message) {
+		if (this.warnedOnce) {
+			this.logger.debug(message);
+			return;
 		}
+		this.warnedOnce = true;
+		this.logger.warn(`${message} — continuing; deployment events are best-effort and never block the run.`);
 	}
-	const properties = record?.properties;
-	const path = properties !== null && typeof properties === "object" && Object.hasOwn(properties, "Path") ? properties["Path"] : void 0;
-	if (physicalId !== void 0 && isSecretDerivedValue(path, mask)) add(physicalId);
-	const embedded = options === void 0 ? secrets : options.embedded;
-	const embeddedBag = embedded !== void 0 && hasMaskableValues(embedded) ? embedded : void 0;
-	if (embeddedBag !== void 0 && physicalId !== void 0) {
-		for (const needle of printingCorpusOf(embeddedBag).keys()) if (needle !== "" && (needle === physicalId || needle.length >= 4 && physicalId.includes(needle))) add(needle);
+};
+var DeploymentEventsReader = class {
+	backend;
+	constructor(backend) {
+		this.backend = backend;
 	}
-	if (physicalId !== void 0) for (const spelling of finalSnapshotSpellingsOf(physicalId, record?.resourceType, needles)) add(spelling);
-	return needles.size > 0 ? needles : void 0;
-}
-function finalSnapshotSpellingsOf(physicalId, resourceType, needles) {
-	if (typeof resourceType !== "string" || !(ATOMIC_FINAL_SNAPSHOT_TYPES.has(resourceType) || PRE_DELETE_SNAPSHOT_TYPES.has(resourceType))) return [];
-	const { prefix, sanitized, kept } = finalSnapshotNameCut(physicalId, resourceType);
-	const spellings = [];
-	for (const needle of needles) {
-		const folded = needle.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-{2,}/g, "-");
-		if (folded.length < 4) continue;
-		for (let at = sanitized.indexOf(folded); at !== -1; at = sanitized.indexOf(folded, at + 1)) {
-			if (at >= kept) break;
-			if (at + folded.length > kept) spellings.push(prefix);
-			else if (folded !== needle) spellings.push(folded);
+	async listRegions(stackName) {
+		const prefix = `${this.backend.prefix}/${stackName}/`;
+		const keys = await this.backend.listRawKeys(prefix);
+		const regions = /* @__PURE__ */ new Set();
+		for (const key of keys) {
+			const segments = key.slice(prefix.length).split("/");
+			if (segments.length === 3 && segments[1] === "deployments" && segments[0]) regions.add(segments[0]);
 		}
+		return [...regions].sort();
 	}
-	return spellings;
-}
-function secretNamesReadBy(logicalId, record, resources, judge = () => ({
-	secrets: void 0,
-	embedded: void 0
-})) {
-	const read = /* @__PURE__ */ new Set();
-	const leaves = [...wholeStringLeavesOf(record?.properties)].filter((leaf) => leaf !== "");
-	if (leaves.length === 0) return read;
-	for (const [otherId, other] of Object.entries(resources)) {
-		if (otherId === logicalId) continue;
-		const bags = judge(otherId);
-		const needles = secretNameNeedlesOf(otherId, other, bags.secrets, { embedded: bags.embedded });
-		if (needles === void 0) continue;
-		for (const needle of needles) if (leaves.some((leaf) => leaf === needle || needle.length >= 4 && leaf.includes(needle))) read.add(needle);
+	async listRuns(stackName, region) {
+		const key = deploymentEventsIndexKey(this.backend.prefix, stackName, region);
+		try {
+			const raw = await this.backend.getRawObject(key);
+			if (raw !== null) {
+				const parsed = JSON.parse(raw);
+				if (Array.isArray(parsed.runs)) return parsed.runs;
+			}
+		} catch {}
+		const dirPrefix = `${this.backend.prefix}/${stackName}/${region}/deployments/`;
+		const runIds = (await this.backend.listRawKeys(dirPrefix)).filter((k) => k.endsWith(".jsonl")).map((k) => k.slice(dirPrefix.length, -6)).sort().reverse();
+		return Promise.all(runIds.map((runId) => this.summarizeRunFromJsonl(stackName, region, runId)));
 	}
-	return read;
-}
-function stateSecretNameNeedles(resources, secrets) {
-	return (logicalId) => secretNameNeedlesOf(logicalId, Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0, secrets, { embedded: void 0 });
-}
-function secretNamePrintingBag(logicalId, resources) {
-	const bag = /* @__PURE__ */ new Map();
-	const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
-	for (const needle of secretNameNeedlesOf(logicalId, record, void 0) ?? []) recordLogOnlyValue(bag, needle);
-	for (const needle of secretNamesReadBy(logicalId, record, resources)) recordLogOnlyValue(bag, needle);
-	return bag;
-}
-function journaledOrphanPrintingBag(ops, stateResources) {
-	const bag = /* @__PURE__ */ new Map();
-	for (const op of ops) {
-		const record = {
-			resourceType: op.resourceType,
-			physicalId: op.physicalId,
-			properties: op.attemptedProperties
+	async summarizeRunFromJsonl(stackName, region, runId) {
+		const fallback = {
+			runId,
+			command: "deploy",
+			cdkdVersion: "unknown",
+			startedAt: "",
+			finishedAt: "",
+			result: "UNKNOWN",
+			eventCount: 0
+		};
+		let events = null;
+		try {
+			events = await this.readRunEvents(stackName, region, runId);
+		} catch {
+			return fallback;
+		}
+		if (events === null || events.length === 0) return fallback;
+		const started = events.find((e) => e.eventType === "RUN_STARTED");
+		let finished;
+		for (const e of events) if (e.eventType === "RUN_FINISHED") finished = e;
+		return {
+			runId,
+			command: started?.command ?? fallback.command,
+			cdkdVersion: started?.cdkdVersion ?? fallback.cdkdVersion,
+			startedAt: started?.timestamp ?? fallback.startedAt,
+			finishedAt: finished?.timestamp ?? fallback.finishedAt,
+			result: finished?.result ?? "UNKNOWN",
+			eventCount: events.length
 		};
-		const replaced = Object.hasOwn(stateResources, op.logicalId) ? stateResources[op.logicalId] : void 0;
-		for (const needle of [
-			...secretNameNeedlesOf(op.logicalId, record, void 0) ?? [],
-			...secretNameNeedlesOf(op.logicalId, replaced, void 0) ?? [],
-			...secretNamesReadBy(op.logicalId, record, stateResources)
-		]) recordLogOnlyValue(bag, needle);
 	}
-	return bag;
-}
-function completedReplayEntries(ops) {
-	return ops.flatMap((op) => [{
-		logicalId: op.logicalId,
-		resourceType: op.resourceType,
-		physicalId: op.physicalId,
-		properties: op.properties,
-		attemptedProperties: op.properties
-	}, ...op.previousState === void 0 ? [] : [{
-		logicalId: op.logicalId,
-		resourceType: op.previousState.resourceType,
-		physicalId: op.previousState.physicalId,
-		properties: op.previousState.properties,
-		attemptedProperties: op.previousState.properties
-	}]]);
-}
-function orphanRecordsPrintingBag(records) {
-	const bag = /* @__PURE__ */ new Map();
-	for (const entry of records) {
-		if (entry === null || typeof entry !== "object") continue;
-		const { logicalId, state } = entry;
-		if (typeof logicalId !== "string" || state === null || typeof state !== "object") continue;
-		for (const needle of secretNameNeedlesOf(logicalId, state, void 0) ?? []) recordLogOnlyValue(bag, needle);
+	async readRunEvents(stackName, region, runId) {
+		const key = deploymentEventsKey(this.backend.prefix, stackName, region, runId);
+		const raw = await this.backend.getRawObject(key);
+		if (raw === null) return null;
+		const events = [];
+		for (const line of raw.split("\n")) {
+			const trimmed = line.trim();
+			if (!trimmed) continue;
+			try {
+				events.push(JSON.parse(trimmed));
+			} catch {}
+		}
+		return events;
 	}
-	return bag;
-}
-const ORPHAN_COMMAND_LABEL = "To orphan it: ";
-function maskEventTextWithBoundBags(event) {
-	if (event.reason === void 0 && event.error === void 0) return event;
-	const mask = currentLogLineMasker();
-	if (mask === void 0) return event;
-	const masked = { ...event };
-	if (masked.error?.message) {
-		const message = masked.error.ownLines === true ? masked.error.message.split("\n").map((line) => line.startsWith(ORPHAN_COMMAND_LABEL) ? line : mask(line)).join("\n") : mask(masked.error.message);
-		masked.error = {
-			...masked.error,
-			message
+	async pruneRuns(stackName, region, opts = {}) {
+		const dirPrefix = deploymentsDirPrefix(this.backend.prefix, stackName, region);
+		const keys = await this.backend.listRawKeys(dirPrefix);
+		const runIdsDesc = keys.map((k) => runIdFromJsonlKey(k, dirPrefix)).filter((id) => id !== null).sort().reverse();
+		const indexKey = deploymentEventsIndexKey(this.backend.prefix, stackName, region);
+		const indexExisted = keys.includes(indexKey);
+		if (opts.all === true) {
+			const toDelete = runIdsDesc.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
+			const earlierVersions = await deleteAndPurgeEventObjects(this.backend, [...toDelete, indexKey], dirPrefix, "whole-dir");
+			return {
+				deletedRunIds: runIdsDesc,
+				remainingRunIds: [],
+				indexDeleted: indexExisted,
+				...earlierVersions !== void 0 && { earlierVersions }
+			};
+		}
+		const noGuards = opts.keep === void 0 && opts.olderThanMs === void 0;
+		const keep = opts.keep ?? (noGuards ? 20 : void 0);
+		const protectedByCount = keep === void 0 ? /* @__PURE__ */ new Set() : new Set(runIdsDesc.slice(0, keep));
+		let candidates = runIdsDesc.filter((id) => !protectedByCount.has(id));
+		if (opts.olderThanMs !== void 0) {
+			const cutoff = (opts.now ?? /* @__PURE__ */ new Date()).getTime() - opts.olderThanMs;
+			candidates = candidates.filter((id) => {
+				const t = runIdTimestampMs(id);
+				return t !== null && t < cutoff;
+			});
+		}
+		if (candidates.length === 0) return {
+			deletedRunIds: [],
+			remainingRunIds: runIdsDesc,
+			indexDeleted: false
+		};
+		const deletedSet = new Set(candidates);
+		const deleteKeys = candidates.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
+		const remainingRunIds = runIdsDesc.filter((id) => !deletedSet.has(id));
+		if (remainingRunIds.length === 0) {
+			await deleteAndPurgeEventObjects(this.backend, [...deleteKeys, indexKey], dirPrefix);
+			return {
+				deletedRunIds: candidates,
+				remainingRunIds,
+				indexDeleted: indexExisted
+			};
+		}
+		await this.rewriteIndexAfterPrune(indexKey, stackName, region, deletedSet);
+		await deleteAndPurgeEventObjects(this.backend, deleteKeys, dirPrefix);
+		return {
+			deletedRunIds: candidates,
+			remainingRunIds,
+			indexDeleted: false
 		};
 	}
-	if (masked.reason) masked.reason = mask(masked.reason);
-	return masked;
-}
+	async rewriteIndexAfterPrune(indexKey, stackName, region, deletedRunIds) {
+		let raw;
+		try {
+			raw = await this.backend.getRawObject(indexKey);
+		} catch {
+			return;
+		}
+		if (raw === null) return;
+		let parsed;
+		try {
+			parsed = JSON.parse(raw);
+		} catch {
+			return;
+		}
+		if (!Array.isArray(parsed.runs)) return;
+		const remaining = parsed.runs.filter((r) => !deletedRunIds.has(r.runId));
+		if (remaining.length === parsed.runs.length) return;
+		const file = {
+			indexVersion: 1,
+			stackName,
+			region,
+			runs: remaining,
+			lastModified: Date.now()
+		};
+		await this.backend.putRawObject(indexKey, JSON.stringify(file, null, 2));
+	}
+};
 
 //#endregion
 //#region src/deployment/update-outcome.ts
@@ -30209,6 +30244,61 @@ function sortRollbackCreates(createOps, stateResources, logger) {
 	logger?.debug(`Rollback CREATE deletion order: ${sorted.map((op) => op.logicalId).join(" → ")}`);
 	return sorted;
 }
+const deleteFirstBlockedBy = /* @__PURE__ */ new WeakMap();
+function markDeleteFirstBlocked(operations, failedOperations = []) {
+	const gone = [];
+	const add = (logicalId, physicalId, attributes) => {
+		if (typeof physicalId !== "string" || physicalId === "") return;
+		gone.push({
+			logicalId,
+			physicalId,
+			needles: [physicalId, ...identityAttributeValues(physicalId, attributes)]
+		});
+	};
+	for (const f of failedOperations) if (seedsDeleteFirstGuard(f)) add(f.logicalId, f.previousState?.physicalId, f.previousState?.attributes);
+	else if (f.changeType === "CREATE" && f.replacedResourceDeleted === true) add(f.logicalId, f.replacedPhysicalId, void 0);
+	for (const op of operations) {
+		const prev = op.previousState?.physicalId;
+		if (typeof prev !== "string" || prev === "") continue;
+		if (op.changeType === "DELETE" || op.changeType === "UPDATE" && op.physicalId !== prev && op.wasReplaced !== false && op.oldResourceRetained !== true) add(op.logicalId, prev, op.previousState?.attributes);
+	}
+	if (gone.length === 0) return;
+	for (const op of operations) {
+		if (op.oldDeletedBeforeCreate !== true) continue;
+		const props = op.previousState?.properties;
+		if (props === void 0) continue;
+		const hit = gone.find((g) => g.logicalId !== op.logicalId && someStringLeaf(props, (leaf) => g.needles.some((n) => namesResource(leaf, n))));
+		if (hit) deleteFirstBlockedBy.set(op, {
+			logicalId: hit.logicalId,
+			physicalId: hit.physicalId
+		});
+	}
+}
+function identityAttributeValues(physicalId, attributes) {
+	if (attributes === null || typeof attributes !== "object") return [];
+	const idSegments = new Set(physicalId.split(/[:/|]/).filter((t) => t !== ""));
+	const out = [];
+	for (const [key, value] of Object.entries(attributes)) {
+		if (typeof value !== "string" || value === "" || value === physicalId) continue;
+		const arnTail = value.startsWith("arn:") ? value.split(/[:/]/).at(-1) : void 0;
+		if (physicalId.length >= 8 && value.includes(physicalId) || arnTail !== void 0 && arnTail !== "" && idSegments.has(arnTail) || key === "DNSName") out.push(value);
+	}
+	return out;
+}
+function namesResource(leaf, needle) {
+	return leaf === needle || leaf.split(/[:/]/).includes(needle) || needle.includes("/") && (leaf.includes(`:${needle}:`) || leaf.endsWith(`:${needle}`)) || needle.length >= 16 && leaf.includes(needle);
+}
+function seedsDeleteFirstGuard(op) {
+	return op.changeType === "UPDATE" && (op.oldDeletedBeforeCreate === true || op.replacementOrphaned === "delete-first");
+}
+function deleteFirstBlocker(op) {
+	return deleteFirstBlockedBy.get(op);
+}
+function someStringLeaf(value, test, depth = 0) {
+	if (typeof value === "string") return test(value);
+	if (depth > 64 || value === null || typeof value !== "object") return false;
+	return (Array.isArray(value) ? value : Object.values(value)).some((child) => someStringLeaf(child, test, depth + 1));
+}
 
 //#endregion
 //#region src/deployment/rollback-executor/replay-noecho.ts
@@ -30796,7 +30886,10 @@ async function replayReverseReplacement(s) {
 		physicalIds: [prev.physicalId]
 	});
 	recordNestedStackParameterExpressions(secrets, oldType, resolvedPrevProps, prev.properties, STATE_DERIVED_RULES);
-	logger.info(`  Rollback: Reversing replacement of ${safe(op.logicalId)} (${typeChanged ? `${safe(op.resourceType)} -> ${safe(oldType)}` : safe(op.resourceType)}) — re-creating the old resource and deleting the new one`);
+	const deleteFirstBlocked = op.oldDeletedBeforeCreate === true && !rollbackRetainsNewResource(current) ? deleteFirstBlocker(op) : void 0;
+	if (deleteFirstBlocked !== void 0) logger.warn(mask(safeMsg`  Rollback: not deleting the new ${shownLogicalId(op.logicalId)} first: its old properties ` + safeMsg`name the resource ${shownLogicalId(deleteFirstBlocked.logicalId)} had before the same deploy ` + "replaced or deleted it, which this rollback may not be able to restore under that id — re-creating the old resource first, which keeps the new one if that fails"));
+	const reverseDeleteFirst = op.oldDeletedBeforeCreate === true && !rollbackRetainsNewResource(current) && deleteFirstBlocked === void 0;
+	logger.info(`  Rollback: Reversing replacement of ${safe(op.logicalId)} (${typeChanged ? `${safe(op.resourceType)} -> ${safe(oldType)}` : safe(op.resourceType)}) — ` + (reverseDeleteFirst ? `deleting the new resource and re-creating the old one` : `re-creating the old resource and deleting the new one`));
 	if (STATEFUL_TYPES.has(oldType)) logger.warn(`  ⚠ ${safe(op.logicalId)} (${safe(oldType)}) is a stateful type — the old physical resource's data was destroyed by the replacement and is NOT recovered by this rollback; the re-created resource starts empty.`);
 	const { provider: createProvider, provisionedBy: createProvisionedBy } = ctx.providerRegistry.getProviderFor({
 		resourceType: oldType,
@@ -30822,7 +30915,6 @@ async function replayReverseReplacement(s) {
 		mask
 	});
 	const newCopyClaimed = inlinePolicyWriters.claimedFor(op.resourceType, op.logicalId, stateResources);
-	let deletedNewFirst = false;
 	const recreateCleanup = {
 		op,
 		oldType,
@@ -30834,8 +30926,40 @@ async function replayReverseReplacement(s) {
 		logger,
 		mask
 	};
+	const deleteNewResourceFirst = async (purpose) => {
+		const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
+		const deleteNewFirstRoute = resolveNewDeleteRoute();
+		const deleteNewFirst = await deleteNewFirstRoute.provider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+			expectedRegion: ctx.region,
+			...newCopyClaimed && { inlinePolicyClaimed: newCopyClaimed },
+			...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
+			deletionPolicy: replacementDeletePolicy(current.updateReplacePolicy),
+			recordedAttributes: current.attributes,
+			recordedNoEchoLeaves: current.noEchoLeaves
+		});
+		throwIfDeleteSkipped(deleteNewFirst, op.logicalId, current.physicalId, purpose, newDeleteGuardScope(deleteNewFirstRoute.provisionedBy));
+		delete stateResources[op.logicalId];
+		await afterOp?.(op.logicalId);
+	};
+	const recreateAfterNewDeleted = async () => {
+		try {
+			return await createWithRollbackRetry(createProvider, () => inOriginalPrefix(() => withCurrentResourceSecrets(secrets, () => createProvider.create(op.logicalId, oldType, replayCreateProps(), replayingStateCreateContext(secrets)))), op.logicalId, logger, isInterrupted, mask, {
+				isRetryable: isRecreateRetryableError,
+				interruptedMessage: "Rollback interrupted while waiting for the new resource to release its name or slot"
+			});
+		} catch (recreateError) {
+			await deleteMarkedRecreate(recreateError, recreateCleanup);
+			throw new Error(mask(`Failed to re-create the old ${safe(op.logicalId)} after the new resource (${mask(current.physicalId)}) was already deleted: ${displaySafe(recreateError instanceof Error ? recreateError.message : String(recreateError))}. The resource is now absent — fix forward by re-deploying the stack.`), { cause: maskSecretsInError(recreateError instanceof Error ? recreateError : void 0, secrets) });
+		}
+	};
+	let deletedNewFirst = false;
 	let createResult;
-	try {
+	if (reverseDeleteFirst) {
+		logger.info(`  Rollback: the replacement deleted the old resource before creating the new one — ` + safeMsg`deleting the new resource (${mask(current.physicalId)}) first...`);
+		await deleteNewResourceFirst("while clearing the new resource before re-creating the old one (the replacement deleted the old one first)");
+		deletedNewFirst = true;
+		createResult = await recreateAfterNewDeleted();
+	} else try {
 		createResult = await createWithRollbackRetry(createProvider, () => inOriginalPrefix(() => withCurrentResourceSecrets(secrets, () => createProvider.create(op.logicalId, oldType, replayCreateProps(), replayingStateCreateContext(secrets)))), op.logicalId, logger, isInterrupted, mask, {
 			isRetryable: isNameCooldownError,
 			interruptedMessage: "Rollback interrupted while waiting out the name cooldown"
@@ -30867,31 +30991,16 @@ async function replayReverseReplacement(s) {
 			const newShown = refusalPhysicalId(mask(current.physicalId));
 			throw ownRemedyError(markNonRetryable(new CdkdError(mask(`Cannot reverse the replacement of ${refusalLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}): the re-create of the old resource (${oldShown}) collided with the name still held by the new one (${newShown}), and UpdateReplacePolicy: Retain pins that new resource in place, so cdkd will not delete it to free the name. Delete the new resource yourself, or remove UpdateReplacePolicy: Retain, then re-run `) + rerunRollbackPhrase(ctx, "cdkd rollback") + mask(` — the journal is kept, so the revert resumes from here.` + (remedy.offered ? " To leave THIS resource alone and let the rest of the rollback proceed, re-run with the command below: one op failure stops the segment loop, so a single pinned resource otherwise halts every OLDER segment too." : "") + `${remedy.clause}${describedPhysicalIdPointer(oldShown, newShown)}\nUnderlying collision: ${collisionLine(mask(msg))}`) + remedy.line, "NAMED_REPLACEMENT_COLLISION", maskSecretsInError(createError instanceof Error ? createError : void 0, secrets))));
 		}
-		logger.info(`  Rollback: re-create collided with the new resource's name — deleting the new resource (${displaySafe(mask(current.physicalId))}) first...` + (typeChanged ? ` (this op changed the resource's Type, ${safe(op.resourceType)} -> ${safe(oldType)}, which share a name space)` : ""));
-		{
-			const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
-			const deleteNewFirstRoute = resolveNewDeleteRoute();
-			const deleteNewFirst = await deleteNewFirstRoute.provider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
-				expectedRegion: ctx.region,
-				...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
-				deletionPolicy: replacementDeletePolicy(current.updateReplacePolicy),
-				recordedAttributes: current.attributes,
-				recordedNoEchoLeaves: current.noEchoLeaves
-			});
-			throwIfDeleteSkipped(deleteNewFirst, op.logicalId, current.physicalId, "while clearing the new resource so the old one could be re-created", newDeleteGuardScope(deleteNewFirstRoute.provisionedBy));
+		if (deleteFirstBlocked !== void 0) {
+			const remedy = orphanRemedy(op.logicalId, ctx);
+			const oldShown = refusalPhysicalId(mask(prev.physicalId));
+			const newShown = refusalPhysicalId(mask(current.physicalId));
+			throw ownRemedyError(markNonRetryable(new CdkdError(mask(`Cannot reverse the replacement of ${refusalLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}): the re-create of the old resource (${oldShown}) collided with the name still held by the new one (${newShown}), and the old resource's properties name what ${refusalLogicalId(deleteFirstBlocked.logicalId)} was before the same deploy replaced or deleted it, which this rollback may not be able to restore, so cdkd will not delete the new resource to free the name. Nothing was deleted. Re-deploy to fix forward, or re-run `) + rerunRollbackPhrase(ctx, "cdkd rollback") + mask(` once the old resource can be re-created — the journal is kept.` + (remedy.offered ? " To leave THIS resource alone and let the rest of the rollback proceed, re-run with the command below." : "") + `${remedy.clause}${describedPhysicalIdPointer(oldShown, newShown)}\nUnderlying collision: ${collisionLine(mask(msg))}`) + remedy.line, "NAMED_REPLACEMENT_COLLISION", maskSecretsInError(createError instanceof Error ? createError : void 0, secrets))));
 		}
+		logger.info(`  Rollback: re-create collided with the new resource's name — deleting the new resource (${displaySafe(mask(current.physicalId))}) first...` + (typeChanged ? ` (this op changed the resource's Type, ${safe(op.resourceType)} -> ${safe(oldType)}, which share a name space)` : ""));
+		await deleteNewResourceFirst("while clearing the new resource so the old one could be re-created");
 		deletedNewFirst = true;
-		delete stateResources[op.logicalId];
-		await afterOp?.(op.logicalId);
-		try {
-			createResult = await createWithRollbackRetry(createProvider, () => inOriginalPrefix(() => withCurrentResourceSecrets(secrets, () => createProvider.create(op.logicalId, oldType, replayCreateProps(), replayingStateCreateContext(secrets)))), op.logicalId, logger, isInterrupted, mask, {
-				isRetryable: isRecreateRetryableError,
-				interruptedMessage: "Rollback interrupted while waiting for the old name to release"
-			});
-		} catch (recreateError) {
-			await deleteMarkedRecreate(recreateError, recreateCleanup);
-			throw new Error(mask(`Failed to re-create the old ${safe(op.logicalId)} after the new resource (${mask(current.physicalId)}) was already deleted: ${displaySafe(recreateError instanceof Error ? recreateError.message : String(recreateError))}. The resource is now absent — fix forward by re-deploying the stack.`), { cause: maskSecretsInError(recreateError instanceof Error ? recreateError : void 0, secrets) });
-		}
+		createResult = await recreateAfterNewDeleted();
 	}
 	opMasker.addNamed({
 		resourceType: oldType,
@@ -31095,6 +31204,7 @@ async function replayRollbackUnbound(operations, stateResources, stackName, ctx,
 	});
 	const resolver = new ReplayResolvers(ctx.region);
 	inlinePolicyWriters.notePending(operations);
+	markDeleteFirstBlocked(operations, options.failedOperations);
 	const { createOps, otherOps } = partitionOps(operations);
 	for (let i = otherOps.length - 1; i >= 0; i--) {
 		if (options.isInterrupted?.()) {
@@ -32268,7 +32378,8 @@ async function revertNestedChildFromJournal(args) {
 				const replayed = await withPrintingSecrets(journaledOrphanPrintingBag(completedReplayEntries(split.replay), stateResources), () => replayRollback(split.replay, stateResources, childStackName, execCtx, {
 					afterOp: save,
 					onOrphan: (record) => mintedOrphans.push(record),
-					inlinePolicyWriters
+					inlinePolicyWriters,
+					failedOperations: segment.failedOperations
 				}));
 				for (const [id, below] of inner.settled) settledBelow.set(id, below);
 				return {
@@ -32537,7 +32648,10 @@ async function performRollback(completedOperations, stateResources, stackName, p
 				emitEnvelope: completedOperations.length === 0,
 				inlinePolicyWriters
 			})) : void 0,
-			result: await withPrintingSecrets(replayPrintingBag(this, completedReplayEntries(completedOperations), stateResources), () => replayRollback(completedOperations, stateResources, stackName, ctx, { inlinePolicyWriters })),
+			result: await withPrintingSecrets(replayPrintingBag(this, completedReplayEntries(completedOperations), stateResources), () => replayRollback(completedOperations, stateResources, stackName, ctx, {
+				inlinePolicyWriters,
+				failedOperations
+			})),
 			run: scope
 		};
 	});
@@ -33921,6 +34035,7 @@ function priorAttemptsInJournal(journal, logicalId, resourceType) {
 		for (const op of segment.failedOperations ?? []) {
 			if (op.logicalId !== logicalId || op.resourceType !== resourceType) continue;
 			if (op.changeType === "DELETE" || !isBag(op.attemptedProperties)) continue;
+			if (op.changeType === "UPDATE" && op.replacementOrphaned !== void 0) continue;
 			if (recordedAsNewResource(op)) continue;
 			bags.push(op.attemptedProperties);
 		}
@@ -39112,6 +39227,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 							physicalIdRecoveredFromError: true,
 							deletionPolicy: journaledOrphanPolicy(this.extractTemplateAttributes(template, logicalId).deletionPolicy)
 						},
+						...change.changeType === "UPDATE" && this.oldDeletedBeforeCreate.has(logicalId) && { oldDeletedBeforeCreate: true },
 						...orphanedBy !== void 0 && { replacementOrphaned: this.oldDeletedBeforeCreate.has(logicalId) ? "delete-first" : "create-first" },
 						...!refused && { attemptedProperties: this.attemptedResolvedProps.get(logicalId) }
 					};
@@ -39156,7 +39272,10 @@ async function executeDeployment(template, currentState, changes, dag, execution
 					previousState,
 					physicalId: newResources[logicalId]?.physicalId,
 					properties: newResources[logicalId]?.properties,
-					...change.changeType === "UPDATE" && { oldResourceRetained: this.retainedOldOnReplacement.has(logicalId) },
+					...change.changeType === "UPDATE" && {
+						oldResourceRetained: this.retainedOldOnReplacement.has(logicalId),
+						oldDeletedBeforeCreate: this.oldDeletedBeforeCreate.has(logicalId)
+					},
 					...change.changeType === "UPDATE" && this.updateWasReplaced.has(logicalId) && { wasReplaced: this.updateWasReplaced.get(logicalId) },
 					...change.changeType === "UPDATE" && previousState !== void 0 && { previousResourceType: previousState.resourceType }
 				});
@@ -40716,15 +40835,19 @@ var DeployEngine = class {
 		} catch {}
 	}
 	maskSecretsInEvent(event) {
-		const secrets = event.logicalId ? this.printingSecretsFor(event.logicalId) : void 0;
-		if (!secrets || !hasMaskableValues(secrets)) return event;
-		const next = { ...event };
-		if (next.error?.message) next.error = {
-			...next.error,
-			message: maskSecretsInText(next.error.message, secrets)
+		const own = event.logicalId ? this.printingSecretsFor(event.logicalId) : void 0;
+		if (own === void 0 || !hasMaskableValues(own)) return maskEventTextWithBoundBags(event);
+		const masked = withPrintingSecrets(own, () => maskEventTextWithBoundBags(event));
+		const message = masked.error?.message;
+		if (masked.error?.ownLines !== true || !message) return masked;
+		const commandLines = message.split("\n").map((line) => line.startsWith("To orphan it: ") ? maskSecretsInText(line, own) : line).join("\n");
+		return {
+			...masked,
+			error: {
+				...masked.error,
+				message: commandLines
+			}
 		};
-		if (next.reason) next.reason = maskSecretsInText(next.reason, secrets);
-		return next;
 	}
 	async withRetry(operation, logicalId, maxRetries, initialDelayMs, provider) {
 		if (provider?.disableOuterRetry) return operation();
@@ -40832,5 +40955,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { gray as $, templateResourceTypes as $a, refuseMalformedOutputsForDestroy as $i, definedAttributes as $n, STATE_SOURCED_BASELINE_RULES as $o, isImpossibleEmptyStoredAttribute as $r, redactDockerArgvValues as $s, updatePartialMessage as $t, perType as A, hasNoCloudControlHandlers as Aa, expectedOwnerParam as Ac, malformedLocalResourcesWarning as Ai, collectDeclaredOutputNames as An, createSecretMasker as Ao, classifyReplaySecretRegion as Ar, AssetModeResolver as As, awaitInFlightSibling as At, INDEX_SETTLE_POLL_INTERVAL_MS as B, toCfnInteger as Ba, nullPrototypeRecord as Bc, malformedResourcePropertiesWarning as Bi, RollbackInlinePolicyWriters as Bn, pathCrossesDottedKey as Bo, applyCallerIdentityCredentials as Br, buildDenyExternalAccessPolicy as Bs, planRollback as Bt, noEchoComparisonForTemplate as C, unreadableResourceEntries as Ca, CFN_TEMPLATE_BODY_LIMIT as Cc, isReadableOrphanRecord as Ci, secretBearingStateKeyWarning as Cn, hasMaskableValues as Co, observeThenDisableInstanceApiTermination as Cr, isSensitiveAttributeName as Cs, isHandledOrphan as Ct, recordedProtectionNote as D, unwrittenCreateOnlyReplacement as Da, uploadCfnTemplate as Dc, malformedExportSourceWarning as Di, exportNameSecretExposure as Dn, recordLogOnlyParameterValue as Do, INTRINSIC_KEYS as Dr, createAssetRedirectResolver as Ds, sameJournaledOrphans as Dt, recordedProtectionEvidence as E, findSilentDropProperties as Ea, findLargeInlineResources as Ec, malformedExportNamesWarning as Ei, exportNameNoEchoParameters as En, printingCorpusOf as Eo, DiffCalculator as Er, buildAssetRedirectMap as Es, makeForeignHolderScan as Et, compensateRemovedDeletionProtection as F, isStatefulRecreateTargetSync as Fa, StageLoadError as Fc, malformedOrphansWarning as Fi, DEFAULT_RESOURCE_WARN_AFTER_MS as Fn, redactSecretsForState as Fo, assertSendableRoleArn as Fr, isCrossRegionRedirect as Fs, recordAfterRollbackUpdate as Ft, hasCdkAutoDeleteTag as G, configIntegerRefusal as Ga, renderAssemblyPathEscape as Gc, refuseDivergentRecordRegionForDestroy as Gi, acquireIdempotencyToken as Gn, carriesSecretMask as Go, s3BucketDomainName as Gr, describeDockerFailure as Gs, orphanDeleteNeedsIdentity as Gt, waitForIndexesSettled as H, coerceCfnBoolean as Ha, absoluteAssemblyPathEscape as Hc, malformedScrubResourceEntriesRefusalMessage as Hi, ledgerForStack as Hn, inheritNestedStackParameterAssociations as Ho, envCredentialsAreAssumedRole as Hr, resolveDockerContextDirectory as Hs, recordUnderIdIsNotOwn as Ht, deleteBudgetKey as I, renderStatefulReason as Ia, processStackMessages as Ic, malformedOutputsRefusalMessage as Ii, maskingRetryLogger as In, scrubResourceRecord as Io, explicitRoleArnOrThrow as Ir, parseBootstrapMarker as Is, demoteSupersededOrphans as It, markRefusedBeforeApplying as J, replayWarn as Ja, resolveBucketRegion as Jc, refuseMalformedOrphanRecordsForDestroy as Ji, planTagDiff as Jn, recordMaskOnlyValuesIn as Jo, s3BucketWebsiteUrl as Jr, formatDockerLoginError as Js, inheritProducerRegions as Jt, isTruthyCfnBoolean as K, configStringRefusal as Ka, resolveAssemblyPath as Kc, refuseMalformedNestedChildOutputs as Ki, DBPROXY_TAGS_WHAT as Kn, provenPublicValue as Ko, s3BucketDualStackDomainName as Kr, dockerSpawnEnvWithSensitive as Ks, findNestedStackTypeChanges as Kt, resolveDynamoDbDeleteBudgetClock as L, WARM_THROUGHPUT_MEMBERS as La, defineOwnKey as Lc, malformedOutputsWarning as Li, constructPathOf as Ln, DYNAMIC_REFERENCE_TOKEN_SCAN as Lo, isIamRoleArn as Lr, readBootstrapMarkerBody as Ls, isJournaledOrphan as Lt, DynamoDBGlobalTableProvider as M, shownType as Ma, canonicalizeRegion as Mc, malformedOrphanRecordsWarning as Mi, isExportAliasCollision as Mn, maskSecretsInError as Mo, regionLessSecretName as Mr, assertAssetBucketRegion as Ms, getStackRecords as Mt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as N, MULTI_REGION_RECREATE_BLOCKED_TYPES as Na, derivePartitionAndUrlSuffix as Nc, malformedOrphanRowsKeptWarning as Ni, bindingSkippedOutputs as Nn, maskSecretsInText as No, applyRoleArnIfSet as Nr, ensureAssetStorage as Ns, withStackRecords as Nt, PROTECTION_PROPERTY_BY_TYPE as O, withoutSilentDropProperties as Oa, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Oc, malformedLocalOutputsWarning as Oi, isWholeDynamicReferenceValue as On, recordLogOnlyValue as Oo, IntrinsicFunctionResolver as Or, loadPublishableAssetManifest as Os, replayFailedOperations as Ot, beginDeleteWait as P, isStatefulRecreateTargetForReplace as Pa, AssemblyReader as Pc, malformedOrphansRefusalMessage as Pi, DEFAULT_RESOURCE_TIMEOUT_MS as Pn, markSameGenerationBag as Po, assertFlagRoleArn as Pr, getBootstrapMarkerKey as Ps, removeProtectionTypeList as Pt, cyan as Q, prefetchCreateOnlyPropertyPaths as Qa, refuseMalformedOutputs as Qi, tagPlanWarning as Qn, wholeStringLeavesOf as Qo, getAccountInfo as Qr, partitionSensitiveEnv as Qs, redactedDeleteAddressSkip as Qt, resolveDynamoDbDeleteBudgetMs as R, coerceWarmThroughput as Ra, hasOwnKey as Rc, malformedRenderedContainersWarning as Ri, findDestructiveChanges as Rn, dynamicReferenceTokens as Ro, sendableAssumeRoleCommand as Rr, validateAssetBucketName as Rs, isReplacementOrphan as Rt, noEchoAttributeNamesOf as S, unreadableOrphanRecords as Sa, ssmResolvedValueType as Sc, hasReadableResources as Si, secretBearing as Sn, createUnionSecretMasker as So, isTerminationProtectionPropagationError as Sr, AssetPublisher as Ss, dropFailedHint as St, noEchoParameterNamesOf as T, findActionableSilentDrops as Ta, MIGRATE_TMP_PREFIX as Tc, malformedDriftResourcePropertiesWarning as Ti, carriedExportAliasExposure as Tn, logOnlyValueCount as To, reEnableInstanceApiTermination as Tr, WorkGraph as Ts, loadJournaledOrphans as Tt, ECR_AUTO_DELETE_IMAGES_TAG as U, coerceCfnInteger as Ua, describeFileReadFailure as Uc, malformedStateRefusalMessage as Ui, reserveStackCreateToken as Un, recordNestedStackParameterExpressions as Uo, isSettledInstanceState as Ur, describeDockerCapturedOutput as Us, replacementNeverSwapped as Ut, deleteTableWithIndexBusyRetry as V, toFiniteNumber as Va, ownValue as Vc, malformedResourcesWarning as Vi, earliestDefined as Vn, identityKeyFor as Vo, callerEnvCredentials as Vr, buildDockerImage as Vs, recheckFailedPlan as Vt, S3_AUTO_DELETE_OBJECTS_TAG as W, configBooleanRefusal as Wa, displayAssemblyPath as Wc, previewableOrphanRecords as Wi, withCreateTokenLedger as Wn, recoverMaskedOutput as Wo, s3BucketArn as Wr, describeDockerExecFailure as Ws, resolveReplacementOldType as Wt, createReadOnlyAttributeHealerFactory as X, requireConfigObject as Xa, refuseMalformedOrphansForDestroy as Xi, refuseMalformedDesiredTags as Xn, recordNoEchoParameterFreshValue as Xo, isUnboundTemplateParameter as Xr, isDockerClientEnvKey as Xs, isRedactedRecordedValue as Xt, formatResourceLine as Y, requireConfigArray as Ya, refuseMalformedOrphans as Yi, readTagList as Yn, recordNoEchoAttributeValues as Yo, coerceParameterTypedValue as Yr, getDockerCmd as Ys, REDACTED_DELETE_ADDRESS_SKIP_REASON as Yt, bold as Z, requireConfigString as Za, refuseMalformedOrphansForOrphan as Zi, tagMapAsList as Zn, recordProvenPublicExpression as Zo, parameterTypeMayLoseSecretIdentity as Zr, isMalformedEnvKey as Zs, redactedDeleteAddressFields as Zt, makeCanonicalizePropertiesFn as _, repairMalformedOutputsForReadOnly as _a, resolveStateBucketWithDefault as _c, accountArgs as _i, DeploymentEventsStore as _n, readbackPathFor as _o, withIndeterminateGuard as _r, importableOutputs as _s, revertedNestedRowIds as _t, findNestedTemplateTreeDefect as a, refuseMalformedResourceEntriesForImportSave as aa, stripControlChars as ac, cfnRefValueFromPhysicalId as ai, secretNamePrintingBag as an, DagBuilder as ao, wouldReturnToSdkProvider as ar, LockManager as as, reachableDivergentParameters as at, serviceTokenBlockingReason as b, repairMalformedResourcesForReadOnly as ba, stateBucketExistenceConfirmed as bc, hasReadableOrphans as bi, displayTextOrWithheld as bn, liveMatchesUnresolvedTokenFrame as bo, disableInstanceApiTermination as br, orphansCarriedFrom as bs, withNestedStackContext as bt, renderNestedTemplateTreeDefect as c, refuseMalformedResourcePropertiesForDrift as ca, Synthesizer as cc, parseWebACLArn as ci, PRE_DELETE_SNAPSHOT_TYPES as cn, isMarkedCoordinate as co, isCustomResourceType as cr, rebuildClientForBucketRegion as cs, planOrphanAdoption as ct, conditionInputsFrom as d, refuseMalformedResourcesForDeploy as da, getLegacyStateBucketName as dc, passedParameterClassesOf as di, createPreDeleteFinalSnapshot as dn, maskWholeValue as do, CloudControlProvider as dr, describeRegionValueKind as ds, displacedPhysicalIdShown as dt, refuseMalformedResourceAttributesForOrphan as ea, redactedDockerCause as ec, carriesDynamicReference as ei, updatePartialReason as en, describeTypeWithThrottleRetry as eo, stringifyIfAssigned as er, STATE_SOURCED_CROSS_GENERATION_RULES as es, green as et, parentSuppliedValues as f, refuseMalformedResourcesForDestroy as fa, loadCdkJson as fc, JSON_LISTING_HOLE_VALUE as fi, effectiveDeletionPolicy as fn, maskedLeafCoordinatesOf as fo, slowCcOperationTimeoutMs as fr, exportNamesCarriedFrom as fs, dropSettledNestedJournals as ft, mergeNoChangeOutputs as g, repairMalformedOrphansForReadOnly as ga, resolveSkipPrefix as gc, UNREADABLE_RESOURCES_MAP_ROW as gi, DeploymentEventsReader as gn, passedNoEchoParametersOf as go, deleteSkipReason as gr, importableOutputKeys as gs, revertNestedChildFromJournal as gt, keptWholeReasonText as h, repairMalformedOrphanRecordsForReadOnly as ha, resolveCaptureObservedState as hc, UNREADABLE_ORPHANS_CONTAINER_ROW as hi, unsupportedFinalSnapshotError as hn, noEchoOutputsComparison as ho, deleteIndeterminateGuards as hr, hasUnverifiableParameterRefusal as hs, recordDisplacedSkips as ht, childTemplateLoader as i, refuseMalformedResourceEntriesForImport as ia, escapeRegExp$3 as ic, AWS_NO_VALUE as ii, orphanRecordsPrintingBag as in, sameLambdaFunctionAddress as io, isCustomResource as ir, isSingleDynamicReferenceToken as is, namesAnyDeclaredParameter as it, readProtection as j, findReplacedReadersOfRecreateTargets as ja, PARTITION_TABLE as jc, malformedOrphanRecordsRefusalMessage as ji, collectPublishedOutputNames as jn, errorCauseChain as jo, producerRegionsFromState as jr, BOOTSTRAP_MARKER_PREFIX as js, destroyStackRecordsView as jt, isProtectionValueActive as k, NO_CC_HANDLERS_REASON as ka, decodeListingKey as kc, malformedLocalResourceEntriesWarning as ki, noEchoParameterValueSeed as kn, shareLogOnlyValues as ko, poisonRenderedSpellingsCollidingIn as kr, rewriteTemplateAssetReferences as ks, replayRollback as kt, templateIdentity as l, refuseMalformedResourcePropertiesForExport as la, synthesisStatusMessage as lc, withSharedDrainBudget as li, buildFinalSnapshotIdentifier as ln, maskAtCoordinates as lo, getCurrentResourceSecrets as lr, splitImportedOps as ls, NESTED_PENDING_PARENT_REASON as lt, isSecretBearingReferenceString as m, refuseMalformedState as ma, resolveAutoAssetStorage as mc, STATE_RESOURCES_MALFORMED as mi, refusesFinalSnapshot as mn, noEchoLeavesOf as mo, UNSPECIFIED_SKIP_REASON as mr, hasReasonlessBaselineRefusal as ms, nestedChildStackName as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedResourceEntriesForDeploy as na, runDockerStreaming as nc, isNamelessDynamicReferenceError as ni, journaledOrphanPrintingBag as nn, canonicalLambdaFunctionName as no, ProviderRegistry as nr, TEMPLATE_SOURCED_RULES as ns, yellow as nt, isAbsoluteAssetPath as o, refuseMalformedResourceEntriesForOrphan as oa, AssetManifestLoader as oc, isStalePlaceholderArnAttribute as oi, stateSecretNameNeedles as on, TemplateParser as oo, TemplateNoEchoReresolver as or, isLockInfoExpired as os, resourcesNamingDeclaredParameter as ot, readRecordedConditionVerdicts as p, refuseMalformedResourcesForExport as pa, resolveApp as pc, STATE_REGION_DIVERGED as pi, isFinalSnapshotError as pn, noEchoCoordinatesOf as po, unchangedBehindSecretReference as pr, hasReadableExportSet as ps, getNestedRevertRun as pt, getPriorAttempts as q, readConfigString as qa, clearBucketRegionCache as qc, refuseMalformedOrphanRecords as qi, DBPROXY_TAG_OPTIONS as qn, recordMaskOnlyValue as qo, s3BucketRegionalDomainName as qr, finchSecretArgvRefusal as qs, getCurrentProducerRegions as qt, computeImplicitDeleteEdges as r, refuseMalformedResourceEntriesForDestroy as ra, warnFinchArgvExposure as rc, keepsSecretReferenceToken as ri, maskEventTextWithBoundBags as rn, lambdaFunctionNameForMask as ro, ccBrokenReason as rr, WHOLE_DYNAMIC_REFERENCE_PATTERN as rs, computeParameterTaint as rt, listNestedTemplateRows as s, refuseMalformedResourcePropertiesForDestroy as sa, getDockerImageBySourceHash as sc, refStateLookupFromResource as si, ATOMIC_FINAL_SNAPSHOT_TYPES as sn, canonicalCoordinates as so, readsNoEchoDeleteValues as sr, S3StateBackend as ss, makeSiblingClaimReader as st, DeployEngine as t, refuseMalformedResourceEntries as ta, runDockerForeground as tc, carriesFetchableDynamicReference as ti, completedReplayEntries as tn, withRetry as to, CC_BROKEN_REASON as tr, STATE_SOURCED_READBACK_RULES as ts, red as tt, conditionFingerprint as u, refuseMalformedResourcePropertiesForOrphan as ua, getDefaultStateBucketName as uc, parameterInputsFor as ui, ccRoutedFinalSnapshotError as un, maskReadbackAtCoordinates as uo, withPrintingSecrets as ur, acceptedCreateOnlyDropsOf as us, displacedOpClause as ut, deferredServiceTokenWarning as v, repairMalformedResourceEntriesForReadOnly as va, resolveStateBucketWithDefaultAndSource as vc, deployRefusesOrphanRowsReason as vi, extractDeploymentEventError as vn, readsNoEchoSource as vo, isWaitAbandonedError as vr, isReadableBag as vs, withNestedRevertRun as vt, noEchoExactEchoLeavesOf as w, withheldAccountClause as wa, CFN_TEMPLATE_URL_LIMIT as wc, isReadableResourceEntry as wi, secretSafeKeyDisplay as wn, literalSplitDelimitersOf as wo, reDisableInstanceApiTermination as wr, stringifyValue as ws, journaledOrphanLines as wt, withResourceDeadline as x, unpreviewableOrphanRecords as xa, warnDeprecatedNoPrefixCliFlag as xc, hasReadableOutputs as xi, exportAliasCollisionScrubWarning as xn, carryLogOnlyValues as xo, ec2InstanceProtectionSite as xr, shouldRetainResource as xs, deleteJournaledOrphans as xt, findServiceTokenRefusals as y, repairMalformedResourcePropertiesForReadOnly as ya, resolveUseCdkBootstrapAssets as yc, displayLogicalId as yi, WITHHELD_NAME_DISPLAY as yn, valueAtCoordinate as yo, markWaitAbandoned as yr, orphansAfterRollback as ys, getCurrentNestedStackContext as yt, DELETE_INDEX_WAIT_PROCEED_NOTE as z, isWarmThroughputDecrease as za, hasPlainPrototype$1 as zc, malformedResourceEntriesWarning as zi, formatDestructiveChange as zn, isUncertifiedBaselineMaskPosition as zo, AWS_CREDENTIAL_ENV_KEYS as zr, validateContainerRepoName as zs, planFailedOps as zt };
-//# sourceMappingURL=deploy-engine-DC4Yblxp.js.map
+export { gray as $, prefetchCreateOnlyPropertyPaths as $a, refuseMalformedOutputs as $i, tagPlanWarning as $n, wholeStringLeavesOf as $o, getAccountInfo as $r, partitionSensitiveEnv as $s, redactedDeleteAddressSkip as $t, perType as A, NO_CC_HANDLERS_REASON as Aa, decodeListingKey as Ac, malformedLocalResourceEntriesWarning as Ai, buildFinalSnapshotIdentifier as An, shareLogOnlyValues as Ao, poisonRenderedSpellingsCollidingIn as Ar, rewriteTemplateAssetReferences as As, awaitInFlightSibling as At, INDEX_SETTLE_POLL_INTERVAL_MS as B, isWarmThroughputDecrease as Ba, hasPlainPrototype$1 as Bc, malformedResourceEntriesWarning as Bi, formatDestructiveChange as Bn, isUncertifiedBaselineMaskPosition as Bo, AWS_CREDENTIAL_ENV_KEYS as Br, validateContainerRepoName as Bs, planRollback as Bt, noEchoComparisonForTemplate as C, unreadableOrphanRecords as Ca, ssmResolvedValueType as Cc, hasReadableResources as Ci, maskEventTextWithBoundBags as Cn, createUnionSecretMasker as Co, isTerminationProtectionPropagationError as Cr, AssetPublisher as Cs, isHandledOrphan as Ct, recordedProtectionNote as D, findSilentDropProperties as Da, findLargeInlineResources as Dc, malformedExportNamesWarning as Di, extractDeploymentEventError as Dn, printingCorpusOf as Do, DiffCalculator as Dr, buildAssetRedirectMap as Ds, sameJournaledOrphans as Dt, recordedProtectionEvidence as E, findActionableSilentDrops as Ea, MIGRATE_TMP_PREFIX as Ec, malformedDriftResourcePropertiesWarning as Ei, stateSecretNameNeedles as En, logOnlyValueCount as Eo, reEnableInstanceApiTermination as Er, WorkGraph as Es, makeForeignHolderScan as Et, compensateRemovedDeletionProtection as F, isStatefulRecreateTargetForReplace as Fa, AssemblyReader as Fc, malformedOrphansRefusalMessage as Fi, refusesFinalSnapshot as Fn, markSameGenerationBag as Fo, assertFlagRoleArn as Fr, getBootstrapMarkerKey as Fs, recordAfterRollbackUpdate as Ft, hasCdkAutoDeleteTag as G, configBooleanRefusal as Ga, displayAssemblyPath as Gc, previewableOrphanRecords as Gi, withCreateTokenLedger as Gn, recoverMaskedOutput as Go, s3BucketArn as Gr, describeDockerExecFailure as Gs, seedsDeleteFirstGuard as Gt, waitForIndexesSettled as H, toFiniteNumber as Ha, ownValue as Hc, malformedResourcesWarning as Hi, earliestDefined as Hn, identityKeyFor as Ho, callerEnvCredentials as Hr, buildDockerImage as Hs, recordUnderIdIsNotOwn as Ht, deleteBudgetKey as I, isStatefulRecreateTargetSync as Ia, StageLoadError as Ic, malformedOrphansWarning as Ii, unsupportedFinalSnapshotError as In, redactSecretsForState as Io, assertSendableRoleArn as Ir, isCrossRegionRedirect as Is, demoteSupersededOrphans as It, markRefusedBeforeApplying as J, readConfigString as Ja, clearBucketRegionCache as Jc, refuseMalformedOrphanRecords as Ji, DBPROXY_TAG_OPTIONS as Jn, recordMaskOnlyValue as Jo, s3BucketRegionalDomainName as Jr, finchSecretArgvRefusal as Js, getCurrentProducerRegions as Jt, isTruthyCfnBoolean as K, configIntegerRefusal as Ka, renderAssemblyPathEscape as Kc, refuseDivergentRecordRegionForDestroy as Ki, acquireIdempotencyToken as Kn, carriesSecretMask as Ko, s3BucketDomainName as Kr, describeDockerFailure as Ks, orphanDeleteNeedsIdentity as Kt, resolveDynamoDbDeleteBudgetClock as L, renderStatefulReason as La, processStackMessages as Lc, malformedOutputsRefusalMessage as Li, maskingRetryLogger as Ln, scrubResourceRecord as Lo, explicitRoleArnOrThrow as Lr, parseBootstrapMarker as Ls, isJournaledOrphan as Lt, DynamoDBGlobalTableProvider as M, findReplacedReadersOfRecreateTargets as Ma, PARTITION_TABLE as Mc, malformedOrphanRecordsRefusalMessage as Mi, createPreDeleteFinalSnapshot as Mn, errorCauseChain as Mo, producerRegionsFromState as Mr, BOOTSTRAP_MARKER_PREFIX as Ms, getStackRecords as Mt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as N, shownType as Na, canonicalizeRegion as Nc, malformedOrphanRecordsWarning as Ni, effectiveDeletionPolicy as Nn, maskSecretsInError as No, regionLessSecretName as Nr, assertAssetBucketRegion as Ns, withStackRecords as Nt, PROTECTION_PROPERTY_BY_TYPE as O, unwrittenCreateOnlyReplacement as Oa, uploadCfnTemplate as Oc, malformedExportSourceWarning as Oi, ATOMIC_FINAL_SNAPSHOT_TYPES as On, recordLogOnlyParameterValue as Oo, INTRINSIC_KEYS as Or, createAssetRedirectResolver as Os, replayFailedOperations as Ot, beginDeleteWait as P, MULTI_REGION_RECREATE_BLOCKED_TYPES as Pa, derivePartitionAndUrlSuffix as Pc, malformedOrphanRowsKeptWarning as Pi, isFinalSnapshotError as Pn, maskSecretsInText as Po, applyRoleArnIfSet as Pr, ensureAssetStorage as Ps, removeProtectionTypeList as Pt, cyan as Q, requireConfigString as Qa, refuseMalformedOrphansForOrphan as Qi, tagMapAsList as Qn, recordProvenPublicExpression as Qo, parameterTypeMayLoseSecretIdentity as Qr, isMalformedEnvKey as Qs, redactedDeleteAddressFields as Qt, resolveDynamoDbDeleteBudgetMs as R, WARM_THROUGHPUT_MEMBERS as Ra, defineOwnKey as Rc, malformedOutputsWarning as Ri, constructPathOf as Rn, DYNAMIC_REFERENCE_TOKEN_SCAN as Ro, isIamRoleArn as Rr, readBootstrapMarkerBody as Rs, isReplacementOrphan as Rt, noEchoAttributeNamesOf as S, unpreviewableOrphanRecords as Sa, warnDeprecatedNoPrefixCliFlag as Sc, hasReadableOutputs as Si, journaledOrphanPrintingBag as Sn, carryLogOnlyValues as So, ec2InstanceProtectionSite as Sr, shouldRetainResource as Ss, dropFailedHint as St, noEchoParameterNamesOf as T, withheldAccountClause as Ta, CFN_TEMPLATE_URL_LIMIT as Tc, isReadableResourceEntry as Ti, secretNamePrintingBag as Tn, literalSplitDelimitersOf as To, reDisableInstanceApiTermination as Tr, stringifyValue as Ts, loadJournaledOrphans as Tt, ECR_AUTO_DELETE_IMAGES_TAG as U, coerceCfnBoolean as Ua, absoluteAssemblyPathEscape as Uc, malformedScrubResourceEntriesRefusalMessage as Ui, ledgerForStack as Un, inheritNestedStackParameterAssociations as Uo, envCredentialsAreAssumedRole as Ur, resolveDockerContextDirectory as Us, replacementNeverSwapped as Ut, deleteTableWithIndexBusyRetry as V, toCfnInteger as Va, nullPrototypeRecord as Vc, malformedResourcePropertiesWarning as Vi, RollbackInlinePolicyWriters as Vn, pathCrossesDottedKey as Vo, applyCallerIdentityCredentials as Vr, buildDenyExternalAccessPolicy as Vs, recheckFailedPlan as Vt, S3_AUTO_DELETE_OBJECTS_TAG as W, coerceCfnInteger as Wa, describeFileReadFailure as Wc, malformedStateRefusalMessage as Wi, reserveStackCreateToken as Wn, recordNestedStackParameterExpressions as Wo, isSettledInstanceState as Wr, describeDockerCapturedOutput as Ws, resolveReplacementOldType as Wt, createReadOnlyAttributeHealerFactory as X, requireConfigArray as Xa, refuseMalformedOrphans as Xi, readTagList as Xn, recordNoEchoAttributeValues as Xo, coerceParameterTypedValue as Xr, getDockerCmd as Xs, REDACTED_DELETE_ADDRESS_SKIP_REASON as Xt, formatResourceLine as Y, replayWarn as Ya, resolveBucketRegion as Yc, refuseMalformedOrphanRecordsForDestroy as Yi, planTagDiff as Yn, recordMaskOnlyValuesIn as Yo, s3BucketWebsiteUrl as Yr, formatDockerLoginError as Ys, inheritProducerRegions as Yt, bold as Z, requireConfigObject as Za, refuseMalformedOrphansForDestroy as Zi, refuseMalformedDesiredTags as Zn, recordNoEchoParameterFreshValue as Zo, isUnboundTemplateParameter as Zr, isDockerClientEnvKey as Zs, isRedactedRecordedValue as Zt, makeCanonicalizePropertiesFn as _, repairMalformedOrphansForReadOnly as _a, resolveSkipPrefix as _c, UNREADABLE_RESOURCES_MAP_ROW as _i, isExportAliasCollision as _n, passedNoEchoParametersOf as _o, deleteSkipReason as _r, importableOutputKeys as _s, revertedNestedRowIds as _t, findNestedTemplateTreeDefect as a, refuseMalformedResourceEntriesForImport as aa, escapeRegExp$3 as ac, AWS_NO_VALUE as ai, displayTextOrWithheld as an, sameLambdaFunctionAddress as ao, isCustomResource as ar, isSingleDynamicReferenceToken as as, reachableDivergentParameters as at, serviceTokenBlockingReason as b, repairMalformedResourcePropertiesForReadOnly as ba, resolveUseCdkBootstrapAssets as bc, displayLogicalId as bi, DEFAULT_RESOURCE_WARN_AFTER_MS as bn, valueAtCoordinate as bo, markWaitAbandoned as br, orphansAfterRollback as bs, withNestedStackContext as bt, renderNestedTemplateTreeDefect as c, refuseMalformedResourcePropertiesForDestroy as ca, getDockerImageBySourceHash as cc, refStateLookupFromResource as ci, secretBearingStateKeyWarning as cn, canonicalCoordinates as co, readsNoEchoDeleteValues as cr, S3StateBackend as cs, planOrphanAdoption as ct, conditionInputsFrom as d, refuseMalformedResourcePropertiesForOrphan as da, getDefaultStateBucketName as dc, parameterInputsFor as di, exportNameNoEchoParameters as dn, maskReadbackAtCoordinates as do, withPrintingSecrets as dr, acceptedCreateOnlyDropsOf as ds, displacedPhysicalIdShown as dt, refuseMalformedOutputsForDestroy as ea, redactDockerArgvValues as ec, isImpossibleEmptyStoredAttribute as ei, updatePartialMessage as en, templateResourceTypes as eo, definedAttributes as er, STATE_SOURCED_BASELINE_RULES as es, green as et, parentSuppliedValues as f, refuseMalformedResourcesForDeploy as fa, getLegacyStateBucketName as fc, passedParameterClassesOf as fi, exportNameSecretExposure as fn, maskWholeValue as fo, CloudControlProvider as fr, describeRegionValueKind as fs, dropSettledNestedJournals as ft, mergeNoChangeOutputs as g, repairMalformedOrphanRecordsForReadOnly as ga, resolveCaptureObservedState as gc, UNREADABLE_ORPHANS_CONTAINER_ROW as gi, collectPublishedOutputNames as gn, noEchoOutputsComparison as go, deleteIndeterminateGuards as gr, hasUnverifiableParameterRefusal as gs, revertNestedChildFromJournal as gt, keptWholeReasonText as h, refuseMalformedState as ha, resolveAutoAssetStorage as hc, STATE_RESOURCES_MALFORMED as hi, collectDeclaredOutputNames as hn, noEchoLeavesOf as ho, UNSPECIFIED_SKIP_REASON as hr, hasReasonlessBaselineRefusal as hs, recordDisplacedSkips as ht, childTemplateLoader as i, refuseMalformedResourceEntriesForDestroy as ia, warnFinchArgvExposure as ic, keepsSecretReferenceToken as ii, WITHHELD_NAME_DISPLAY as in, lambdaFunctionNameForMask as io, ccBrokenReason as ir, WHOLE_DYNAMIC_REFERENCE_PATTERN as is, namesAnyDeclaredParameter as it, readProtection as j, hasNoCloudControlHandlers as ja, expectedOwnerParam as jc, malformedLocalResourcesWarning as ji, ccRoutedFinalSnapshotError as jn, createSecretMasker as jo, classifyReplaySecretRegion as jr, AssetModeResolver as js, destroyStackRecordsView as jt, isProtectionValueActive as k, withoutSilentDropProperties as ka, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as kc, malformedLocalOutputsWarning as ki, PRE_DELETE_SNAPSHOT_TYPES as kn, recordLogOnlyValue as ko, IntrinsicFunctionResolver as kr, loadPublishableAssetManifest as ks, replayRollback as kt, templateIdentity as l, refuseMalformedResourcePropertiesForDrift as la, Synthesizer as lc, parseWebACLArn as li, secretSafeKeyDisplay as ln, isMarkedCoordinate as lo, isCustomResourceType as lr, rebuildClientForBucketRegion as ls, NESTED_PENDING_PARENT_REASON as lt, isSecretBearingReferenceString as m, refuseMalformedResourcesForExport as ma, resolveApp as mc, STATE_REGION_DIVERGED as mi, noEchoParameterValueSeed as mn, noEchoCoordinatesOf as mo, unchangedBehindSecretReference as mr, hasReadableExportSet as ms, nestedChildStackName as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedResourceEntries as na, runDockerForeground as nc, carriesFetchableDynamicReference as ni, DeploymentEventsReader as nn, withRetry as no, CC_BROKEN_REASON as nr, STATE_SOURCED_READBACK_RULES as ns, yellow as nt, isAbsoluteAssetPath as o, refuseMalformedResourceEntriesForImportSave as oa, stripControlChars as oc, cfnRefValueFromPhysicalId as oi, exportAliasCollisionScrubWarning as on, DagBuilder as oo, wouldReturnToSdkProvider as or, LockManager as os, resourcesNamingDeclaredParameter as ot, readRecordedConditionVerdicts as p, refuseMalformedResourcesForDestroy as pa, loadCdkJson as pc, JSON_LISTING_HOLE_VALUE as pi, isWholeDynamicReferenceValue as pn, maskedLeafCoordinatesOf as po, slowCcOperationTimeoutMs as pr, exportNamesCarriedFrom as ps, getNestedRevertRun as pt, getPriorAttempts as q, configStringRefusal as qa, resolveAssemblyPath as qc, refuseMalformedNestedChildOutputs as qi, DBPROXY_TAGS_WHAT as qn, provenPublicValue as qo, s3BucketDualStackDomainName as qr, dockerSpawnEnvWithSensitive as qs, findNestedStackTypeChanges as qt, computeImplicitDeleteEdges as r, refuseMalformedResourceEntriesForDeploy as ra, runDockerStreaming as rc, isNamelessDynamicReferenceError as ri, DeploymentEventsStore as rn, canonicalLambdaFunctionName as ro, ProviderRegistry as rr, TEMPLATE_SOURCED_RULES as rs, computeParameterTaint as rt, listNestedTemplateRows as s, refuseMalformedResourceEntriesForOrphan as sa, AssetManifestLoader as sc, isStalePlaceholderArnAttribute as si, secretBearing as sn, TemplateParser as so, TemplateNoEchoReresolver as sr, isLockInfoExpired as ss, makeSiblingClaimReader as st, DeployEngine as t, refuseMalformedResourceAttributesForOrphan as ta, redactedDockerCause as tc, carriesDynamicReference as ti, updatePartialReason as tn, describeTypeWithThrottleRetry as to, stringifyIfAssigned as tr, STATE_SOURCED_CROSS_GENERATION_RULES as ts, red as tt, conditionFingerprint as u, refuseMalformedResourcePropertiesForExport as ua, synthesisStatusMessage as uc, withSharedDrainBudget as ui, carriedExportAliasExposure as un, maskAtCoordinates as uo, getCurrentResourceSecrets as ur, splitImportedOps as us, displacedOpClause as ut, deferredServiceTokenWarning as v, repairMalformedOutputsForReadOnly as va, resolveStateBucketWithDefault as vc, accountArgs as vi, bindingSkippedOutputs as vn, readbackPathFor as vo, withIndeterminateGuard as vr, importableOutputs as vs, withNestedRevertRun as vt, noEchoExactEchoLeavesOf as w, unreadableResourceEntries as wa, CFN_TEMPLATE_BODY_LIMIT as wc, isReadableOrphanRecord as wi, orphanRecordsPrintingBag as wn, hasMaskableValues as wo, observeThenDisableInstanceApiTermination as wr, isSensitiveAttributeName as ws, journaledOrphanLines as wt, withResourceDeadline as x, repairMalformedResourcesForReadOnly as xa, stateBucketExistenceConfirmed as xc, hasReadableOrphans as xi, completedReplayEntries as xn, liveMatchesUnresolvedTokenFrame as xo, disableInstanceApiTermination as xr, orphansCarriedFrom as xs, deleteJournaledOrphans as xt, findServiceTokenRefusals as y, repairMalformedResourceEntriesForReadOnly as ya, resolveStateBucketWithDefaultAndSource as yc, deployRefusesOrphanRowsReason as yi, DEFAULT_RESOURCE_TIMEOUT_MS as yn, readsNoEchoSource as yo, isWaitAbandonedError as yr, isReadableBag as ys, getCurrentNestedStackContext as yt, DELETE_INDEX_WAIT_PROCEED_NOTE as z, coerceWarmThroughput as za, hasOwnKey as zc, malformedRenderedContainersWarning as zi, findDestructiveChanges as zn, dynamicReferenceTokens as zo, sendableAssumeRoleCommand as zr, validateAssetBucketName as zs, planFailedOps as zt };
+//# sourceMappingURL=deploy-engine-D4FdwPCi.js.map