@go-to-k/cdkd 0.296.28 → 0.296.29

package/dist/{deploy-engine-D4FdwPCi.js → deploy-engine-Bt-8KvUj.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js";
 import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
-import { $ as protectedReplacementAdvice, $n as isIamPropagationError, $t as AccountIdUnavailableError, A as isQuotableImportValue, An as commandHole, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bt as sanitizeRecoveryValue, Ct as RETRY_AUXILIARY_OWNER, Dn as SHELL_ACTIVE, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as plainOrDescribed, G as runDeleteAttempt, Gn as isNameCooldownError, H as observeThenDisableProtection, Hn as isUpdateUnsupportedError, Ht as DEFAULT_STATE_PREFIX, In as quotedOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jt as withPasteableAwsProfile, Kn as isRecreateRetryableError, Kt as producerRecordKey, L as ProtectionFlipRegistry, Ln as shellBoundedDisplay, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mn as isInertUnquoted, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as pasteableCommand, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE_WHY, Ot as hasCreatedBeforeFailure, Pn as physicalIdShownBesideCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, R as compensateProtectionFlip, Rn as shellQuote, Rt as formatLockOperation, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Un as hasReplayMayCollide, Ut as injectiveKey, Vt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Wn as isNameCollisionErrorFrom, Xn as formatRetryClassificationSignals, Xt as ambientCredentialConfig, Yn as markReplayMayCollide, Yt as ambientClientDefaults, Zn as isAmbiguousCcHandlerErrorCode, Zt as clientDefaultsFor, _n as ResourceUpdateNotSupportedError, _t as createMaskedLogSinks, ar as isThrottlingError, at as startInterruptWatch, bn as StateError, bt as maskDeep, cr as wrapMaskedAwsError, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as MacroExpansionError, en as AssetError, er as isRetryableTransientError, f as removalWarning, fn as MalformedProducerRecordRefusalError, ft as logicalIdShown, gn as ResourceTimeoutError, gt as stateOrphanRecordRemedy, hn as ProvisioningError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as DependencyError, ir as isMarkedNonRetryable, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, kn as UNSHOWABLE_VALUE, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, m as withoutInjectedRemovals, mt as resourceTypeShown, nr as retryClassificationText, on as DynamicReferenceRegionAmbiguousError, or as markNonRetryable, ot as ElapsedBudgetRegistry, qn as isReplayedNameCollisionFrom, rn as CrossAccountSecretRefusalError, sn as IntrinsicResolutionRefusalError, sr as markRedactedCause, st as monotonicNowMs, tn as CdkdError, tr as isTransientServerError, un as LockError, ut as compositeIdSeparatorRefusal, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as normalizeAwsError, wt as carryCreatedBeforeFailure, xn as SynthesisError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as withheldTargetClause, zt as formatLockOwner } from "./iam-policy-targets-B61e5_Sk.js";
+import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-Cz2tPxXk.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-B0JEGOLV.js";
+import { t as getCdkdVersion } from "./version-DyV_xwRX.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4937,14 +4937,16 @@ function parseCreateTokenLedger(body) {
 		for (const [logicalId, entry] of Object.entries(rawSent)) if (isSent(entry)) sent[logicalId] = {
 			base: entry.base,
 			token: entry.token,
-			firstSentAt: entry.firstSentAt
+			firstSentAt: entry.firstSentAt,
+			...typeof entry.failedAt === "number" && Number.isFinite(entry.failedAt) && { failedAt: entry.failedAt }
 		};
 	}
 	return {
 		ledgerVersion: 1,
 		nonce: doc["nonce"],
 		sent,
-		...doc["stateRecorded"] === true && { stateRecorded: true }
+		...doc["stateRecorded"] === true && { stateRecorded: true },
+		...typeof doc["abandonedAt"] === "number" && Number.isFinite(doc["abandonedAt"]) && { abandonedAt: doc["abandonedAt"] }
 	};
 }
 const stateSavedObserver = new AsyncLocalStorage();
@@ -4955,6 +4957,409 @@ async function notifyStateSaved(stackName, region) {
 	await stateSavedObserver.getStore()?.(stackName, region);
 }
 
+//#endregion
+//#region src/state/cross-prefix-stack-scan.ts
+function journalCanOwnResources(journal) {
+	return recordCanOwnResources({ resources: {} }, journal);
+}
+function recordCanOwnResources(record, journal) {
+	const resources = record.resources;
+	if (resources === null || typeof resources !== "object" || Array.isArray(resources)) return true;
+	if (Object.keys(resources).length > 0) return true;
+	const orphans = record.orphans;
+	if (orphans !== void 0 && (!Array.isArray(orphans) || orphans.length > 0)) return true;
+	if (journal === null) return false;
+	const segments = journal.segments;
+	if (!Array.isArray(segments)) return true;
+	return segments.some((seg) => {
+		if (seg === null || typeof seg !== "object" || Array.isArray(seg)) return true;
+		const ops = seg.operations;
+		if (ops !== void 0 && (!Array.isArray(ops) || ops.length > 0)) return true;
+		const failed = seg.failedOperations;
+		if (failed === void 0) return false;
+		if (!Array.isArray(failed)) return true;
+		return failed.some((op) => op === null || typeof op !== "object" || op.physicalId !== void 0);
+	});
+}
+var CrossPrefixReadError = class extends Error {
+	key;
+	cause;
+	constructor(key, cause) {
+		super(`reading ${displayIdent(key, { maxCodePoints: 1024 })} failed (${errorName$1(cause, "an unknown error")})`);
+		this.name = "CrossPrefixReadError";
+		this.key = key;
+		this.cause = cause;
+	}
+};
+const PROBE_CONCURRENCY = 50;
+function unwrapCause(error) {
+	return error instanceof CrossPrefixReadError ? error.cause : error;
+}
+function isNotImplemented(error) {
+	const name = error?.name;
+	const status = error?.$metadata?.httpStatusCode;
+	return name === "NotImplemented" || status === 501;
+}
+function isAccessDenied(error) {
+	let current = error;
+	for (let depth = 0; depth < 5 && current !== null && typeof current === "object"; depth++) {
+		const name = current.name;
+		if (name === "AccessDenied" || name === "Forbidden" || name === "AllAccessDisabled") return true;
+		if (current.$metadata?.httpStatusCode === 403) return true;
+		current = current.cause;
+	}
+	return false;
+}
+function candidatePrefixPasses(segments, own) {
+	const seen = /* @__PURE__ */ new Set([own]);
+	const pass = (names) => {
+		const out = [];
+		for (const name of names) {
+			if (seen.has(name)) continue;
+			seen.add(name);
+			out.push(name);
+		}
+		return out;
+	};
+	return [pass(segments), pass(segments.map((p) => `${p}/`))];
+}
+async function scanOtherPrefixesForStack(target, stackName, region) {
+	let segments;
+	try {
+		segments = await target.listTopLevelPrefixes();
+	} catch (error) {
+		return isAccessDenied(error) ? {
+			kind: "denied",
+			error,
+			stage: "list"
+		} : {
+			kind: "failed",
+			error
+		};
+	}
+	const found = [];
+	const stale = [];
+	let denied;
+	let failed;
+	const probeAll = async (candidates) => {
+		let next = 0;
+		const worker = async () => {
+			while (found.length === 0 && next < candidates.length) {
+				const prefix = candidates[next++];
+				try {
+					const held = await target.recordUnderPrefix(prefix, stackName, region);
+					if (held === "holder") found.push(prefix);
+					else if (held === "empty") stale.push(prefix);
+				} catch (error) {
+					if (isAccessDenied(error)) denied ??= error;
+					else failed ??= error;
+				}
+			}
+		};
+		await Promise.all(Array.from({ length: Math.min(50, candidates.length) }, () => worker()));
+	};
+	const [segmentsThemselves, twins] = candidatePrefixPasses(segments, target.prefix);
+	await probeAll([...segmentsThemselves, ...twins]);
+	const extra = stale.length > 0 ? { stale } : {};
+	if (found.length > 0) return {
+		kind: "found",
+		prefixes: found,
+		...extra
+	};
+	if (failed !== void 0) return {
+		kind: "failed",
+		error: failed,
+		...extra
+	};
+	if (denied !== void 0) return {
+		kind: "denied",
+		error: denied,
+		stage: "probe",
+		...extra
+	};
+	return {
+		kind: "clear",
+		...extra
+	};
+}
+function withSharedListing(target) {
+	let listing;
+	let inFlight = 0;
+	let seq = 0;
+	let prestarted = 0;
+	const keyOf = (stackName, region) => JSON.stringify([stackName, region]);
+	const ranks = /* @__PURE__ */ new Map();
+	const rankOf = (stackName, region) => ranks.get(keyOf(stackName, region)) ?? Number.MAX_SAFE_INTEGER;
+	const heap = [];
+	const before = (a, b) => a.rank < b.rank || a.rank === b.rank && a.seq < b.seq;
+	const swap = (i, j) => {
+		const t = heap[i];
+		heap[i] = heap[j];
+		heap[j] = t;
+	};
+	const siftUp = (i) => {
+		while (i > 0) {
+			const parent = i - 1 >> 1;
+			if (!before(heap[i], heap[parent])) return;
+			swap(i, parent);
+			i = parent;
+		}
+	};
+	const siftDown = (i) => {
+		for (;;) {
+			const l = 2 * i + 1;
+			const r = l + 1;
+			let best = i;
+			if (l < heap.length && before(heap[l], heap[best])) best = l;
+			if (r < heap.length && before(heap[r], heap[best])) best = r;
+			if (best === i) return;
+			swap(i, best);
+			i = best;
+		}
+	};
+	const popBest = () => {
+		const top = heap[0];
+		const last = heap.pop();
+		if (heap.length > 0) {
+			heap[0] = last;
+			siftDown(0);
+		}
+		return top;
+	};
+	const admitBest = () => {
+		while (inFlight < 50 && heap.length > 0) {
+			inFlight++;
+			popBest().resolve();
+		}
+	};
+	const acquire = async (stackName, region) => {
+		const rank = rankOf(stackName, region);
+		if (inFlight < 50 && (heap.length === 0 || heap[0].rank >= rank)) {
+			inFlight++;
+			return;
+		}
+		const key = keyOf(stackName, region);
+		await new Promise((resolve) => {
+			heap.push({
+				key,
+				rank,
+				seq: seq++,
+				resolve
+			});
+			siftUp(heap.length - 1);
+		});
+	};
+	const release = () => {
+		inFlight--;
+		admitBest();
+	};
+	return {
+		prefix: target.prefix,
+		rank: (stackName, region, when) => {
+			const key = keyOf(stackName, region);
+			if (when === "prestart") {
+				if (!ranks.has(key)) ranks.set(key, prestarted++);
+				return;
+			}
+			if (ranks.get(key) === -1) return;
+			ranks.set(key, -1);
+			let moved = false;
+			for (const w of heap) if (w.key === key) {
+				w.rank = -1;
+				moved = true;
+			}
+			if (moved) for (let i = (heap.length >> 1) - 1; i >= 0; i--) siftDown(i);
+		},
+		listTopLevelPrefixes: () => listing ??= target.listTopLevelPrefixes(),
+		recordUnderPrefix: async (prefix, stackName, region) => {
+			await acquire(stackName, region);
+			try {
+				return await target.recordUnderPrefix(prefix, stackName, region);
+			} finally {
+				release();
+			}
+		}
+	};
+}
+var CrossPrefixScanCache = class {
+	target;
+	scans = /* @__PURE__ */ new Map();
+	constructor(target) {
+		this.target = withSharedListing(target);
+	}
+	full(stackName, region, when = "now") {
+		this.target.rank(stackName, region, when);
+		const key = JSON.stringify([stackName, region]);
+		let scan = this.scans.get(key);
+		if (scan === void 0) {
+			scan = scanOtherPrefixesForStack(this.target, stackName, region);
+			this.scans.set(key, scan);
+		}
+		return scan;
+	}
+};
+const STACK_UNDER_OTHER_PREFIX = "STACK_UNDER_OTHER_STATE_PREFIX";
+const UNSUPPORTED_SENTENCE = "A stack name is unique per account and region, as in CloudFormation: deploying one stack name under two state prefixes is unsupported, because both deployments use the same cdkd-generated resource names, and a failed deploy, a destroy, or a deploy that deletes or replaces of either one deletes resources the other's record also names.";
+function subjectText(s) {
+	return `${displayStackName(s.stackName)} (${displayIdent(s.region)})`;
+}
+const LISTED_PREFIXES = 5;
+function prefixesText(prefixes) {
+	const shown = prefixes.slice(0, LISTED_PREFIXES).map((p) => displayIdent(p, { listMember: true })).join(", ");
+	const more = prefixes.length - LISTED_PREFIXES;
+	return more > 0 ? `${shown} and ${more} more` : shown;
+}
+function stateCommand(verb, s, prefix) {
+	const account = recoveryCommandFlags({
+		profile: s.recovery?.profile,
+		stateBucket: s.recovery?.stateBucket ?? s.bucket
+	});
+	return pasteableCommand(`cdkd state ${verb}`, [
+		{
+			value: s.stackName,
+			hole: "stack"
+		},
+		{
+			flag: "--stack-region",
+			value: s.region,
+			hole: "region"
+		},
+		{
+			flag: "--state-prefix",
+			value: prefix,
+			hole: "prefix"
+		}
+	], account.flags).command;
+}
+function releaseRemedy(s, prefixes, destroyToo) {
+	const first = prefixes[0];
+	if (prefixes.length === 1 && destroyToo) return `\`${stateCommand("destroy", s, first)}\` deletes its resources and its record, \`${stateCommand("orphan", s, first)}\` drops only its record.`;
+	if (prefixes.length === 1) return `drop the other record with \`cdkd state orphan\` (it removes only the record, never a resource): \`${stateCommand("orphan", s, first)}\`.`;
+	return `release each other record with \`cdkd state orphan\` (it removes only the record, never a resource; a destroy under one of them is refused while another still records the stack, and the check stops at the first ones it finds, so re-run it until none is named), e.g. \`${stateCommand("orphan", s, first)}\`, then the same with each other prefix.`;
+}
+const VERB = {
+	deploy: "deploy",
+	destroy: "destroy",
+	rollback: "roll back",
+	"deploy-destructive": "deploy",
+	"deploy-late-replace": "replace a resource of"
+};
+const NOTHING = {
+	deploy: "No resource of this stack was created.",
+	destroy: "Nothing was deleted.",
+	rollback: "Nothing was reverted or deleted.",
+	"deploy-destructive": "No resource of this stack was changed.",
+	"deploy-late-replace": "That resource is kept, so the new value is not applied; the rest of the deploy goes on."
+};
+function deployUnderOtherPrefixMessage(s, prefixes) {
+	return `Refusing to deploy stack ${subjectText(s)}: it is already recorded under another state prefix of bucket ${displayIdent(s.bucket)} (${prefixesText(prefixes)}). ${UNSUPPORTED_SENTENCE} ${NOTHING.deploy} Either deploy it under that prefix (pass the same --state-prefix it was deployed with), give this stack another name, or, if the other deployment is no longer wanted, ${prefixes.length === 1 ? "remove it first: " : ""}` + releaseRemedy(s, prefixes, true);
+}
+function destroyUnderOtherPrefixMessage(s, prefixes, action = "destroy") {
+	return `Refusing to ${VERB[action]} stack ${subjectText(s)}: it is also recorded under another state prefix of bucket ${displayIdent(s.bucket)} (${prefixesText(prefixes)}). ${UNSUPPORTED_SENTENCE} ${NOTHING[action]} Keep one record per stack name and region: once you have confirmed which record describes the deployment you want to keep, ${releaseRemedy(s, prefixes, false)} Then re-run.`;
+}
+function destructiveDeployUnderOtherPrefixMessage(s, prefixes, action = "deploy-destructive") {
+	return `${action === "deploy-late-replace" ? `Refusing to replace a resource of stack ${subjectText(s)} (a replacement this deploy found only on reading the resource back)` : `Refusing to deploy stack ${subjectText(s)}: this deploy deletes or replaces resources`}, and the stack is also recorded under another state prefix of bucket ${displayIdent(s.bucket)} (${prefixesText(prefixes)}). ${UNSUPPORTED_SENTENCE} ${NOTHING[action]} Keep one record per stack name and region: once you have confirmed which record describes the deployment you want to keep, ${releaseRemedy(s, prefixes, false)} Then re-run.`;
+}
+function staleRecordNotice(s, prefixes) {
+	return `Note: bucket ${displayIdent(s.bucket)} also holds a record of stack ${subjectText(s)} under another state prefix (${prefixesText(prefixes)}) that owns no resource -- the leftover of a failed first deploy. It does not block this command; remove it with \`${stateCommand("orphan", s, prefixes[0])}\`${prefixes.length > 1 ? ", and the same with each other prefix" : ""}.`;
+}
+function errorName$1(error, fallback) {
+	const subject = error instanceof CrossPrefixReadError ? error.cause : error;
+	return subject !== null && typeof subject === "object" && typeof subject.name === "string" ? displaySafe(subject.name, { asciiOnly: true }) : fallback;
+}
+function failedKeyText(error) {
+	return error instanceof CrossPrefixReadError ? ` reading s3 object ${displayIdent(error.key, { maxCodePoints: 1024 })}` : "";
+}
+function crossPrefixDeniedWarning(s, error, stage = "probe") {
+	if (stage === "registry" && isNotImplemented(unwrapCause(error))) return `Could not use the stack registry for stack ${subjectText(s)}: the state bucket's endpoint does not implement a conditional write${failedKeyText(error)} (${errorName$1(error, "NotImplemented")}), so the bucket's other state prefixes were scanned instead, which is slower. Continuing.`;
+	if (stage === "registry") return `Could not use the stack registry for stack ${subjectText(s)}: S3 refused${failedKeyText(error)} (${errorName$1(error, "AccessDenied")}), so the bucket's other state prefixes were scanned instead, which is slower. Grant s3:GetObject, s3:PutObject and s3:DeleteObject on ${displayIdent(s.bucket)}/_cdkd-registry/* to use it. Continuing.`;
+	const what = stage === "list" ? `S3 refused to list bucket ${displayIdent(s.bucket)}` : `S3 refused a read under another state prefix of bucket ${displayIdent(s.bucket)}`;
+	return `Could not check the other state prefixes for stack ${subjectText(s)}: ${what} (${errorName$1(error, "AccessDenied")}). Continuing. Deploying one stack name under two state prefixes in one account and region is unsupported.`;
+}
+function inProgressUnderOtherPrefixMessage(s, action, prefix) {
+	const account = recoveryCommandFlags({
+		profile: s.recovery?.profile,
+		stateBucket: s.recovery?.stateBucket ?? s.bucket
+	});
+	const unlock = pasteableCommand("cdkd force-unlock", [
+		{
+			value: s.stackName,
+			hole: "stack"
+		},
+		{
+			flag: "--stack-region",
+			value: s.region,
+			hole: "region"
+		},
+		{
+			flag: "--state-prefix",
+			value: prefix,
+			hole: "prefix"
+		}
+	], account.flags).command;
+	return `Refusing to ${VERB[action]} stack ${subjectText(s)}: bucket ${displayIdent(s.bucket)} assigns it to state prefix ${displayIdent(prefix)}, which records nothing for it yet but holds its lock, so a deploy there may be in progress. ${UNSUPPORTED_SENTENCE} ${NOTHING[action]} Re-run once that deploy has finished; if none is running, remove its lock with \`${unlock}\` and re-run.`;
+}
+function crossPrefixFailedMessage(s, action, error) {
+	return `Refusing to ${VERB[action]} stack ${subjectText(s)}: cdkd could not check whether the bucket ${displayIdent(s.bucket)} records it under another state prefix (${errorName$1(error, "an unknown error")}${failedKeyText(error)}). ${UNSUPPORTED_SENTENCE} ${NOTHING[action]} Re-run once the check can succeed.`;
+}
+function applyCrossPrefixScan(result, s, action, warn, info) {
+	if (result.kind !== "in-progress" && result.stale !== void 0 && result.stale.length > 0) info?.(staleRecordNotice(s, result.stale));
+	switch (result.kind) {
+		case "clear": return;
+		case "denied":
+			warn(crossPrefixDeniedWarning(s, result.error, result.stage));
+			return;
+		case "found": {
+			const message = action === "deploy" ? deployUnderOtherPrefixMessage(s, result.prefixes) : action === "deploy-destructive" || action === "deploy-late-replace" ? destructiveDeployUnderOtherPrefixMessage(s, result.prefixes, action) : destroyUnderOtherPrefixMessage(s, result.prefixes, action);
+			throw new CdkdError(message, STACK_UNDER_OTHER_PREFIX);
+		}
+		case "failed": throw new CdkdError(crossPrefixFailedMessage(s, action, result.error), STACK_UNDER_OTHER_PREFIX);
+		case "in-progress": throw new CdkdError(inProgressUnderOtherPrefixMessage(s, action, result.prefix), STACK_UNDER_OTHER_PREFIX);
+	}
+}
+
+//#endregion
+//#region src/state/earlier-state-versions.ts
+async function readEarlierStateResources(s3, bucket, owner, key, max) {
+	const versions = ((await s3.send(new ListObjectVersionsCommand({
+		Bucket: bucket,
+		...owner,
+		Prefix: key,
+		EncodingType: "url",
+		MaxKeys: max + 1
+	}))).Versions ?? []).filter((v) => decodeListingKey(v.Key) === key && typeof v.VersionId === "string").sort((a, b) => (b.LastModified?.getTime() ?? 0) - (a.LastModified?.getTime() ?? 0)).slice(0, max);
+	return (await Promise.all(versions.map(async (v) => {
+		const body = await (await s3.send(new GetObjectCommand({
+			Bucket: bucket,
+			...owner,
+			Key: key,
+			VersionId: v.VersionId
+		}))).Body?.transformToString();
+		if (body === void 0) return void 0;
+		try {
+			const parsed = JSON.parse(body);
+			if (parsed === null || typeof parsed.resources !== "object" || parsed.resources === null) return;
+			return {
+				resources: parsed.resources,
+				...v.LastModified instanceof Date && { writtenAt: v.LastModified.getTime() }
+			};
+		} catch {
+			return;
+		}
+	}))).filter((r) => r !== void 0);
+}
+
+//#endregion
+//#region src/state/retained-time.ts
+var RetainedTimeUnconfirmedError = class extends Error {
+	cause;
+	constructor(cause) {
+		super("the kept-resource record was written, but its time could not be confirmed from S3");
+		this.name = "RetainedTimeUnconfirmedError";
+		this.cause = cause;
+	}
+};
+
 //#endregion
 //#region src/utils/bucket-region-client.ts
 async function rebuildClientForBucketRegion(client, bucket, opts = {}) {
@@ -5014,12 +5419,14 @@ function legacyProbeBelongsTo(probe, region) {
 		case "unreadable": return false;
 	}
 }
-var S3StateBackend = class {
+const KEPT_AT_CLOCK_TOLERANCE_MS = 2e3;
+var S3StateBackend = class S3StateBackend {
 	logger = getLogger().child("S3StateBackend");
 	s3Client;
 	config;
 	clientOpts;
 	clientResolved = false;
+	scanClient;
 	resolveInFlight = null;
 	constructor(s3Client, config, clientOpts = {}) {
 		this.s3Client = s3Client;
@@ -5028,6 +5435,19 @@ var S3StateBackend = class {
 	}
 	destroyClient() {
 		this.s3Client.destroy();
+		this.scanClient?.destroy();
+	}
+	async clientForScan() {
+		await this.ensureClientForBucket();
+		if (this.scanClient !== void 0) return this.scanClient;
+		if (!(this.s3Client instanceof S3Client)) return this.s3Client;
+		const region = await this.s3Client.config.region();
+		this.scanClient = new S3Client({
+			...awsClientDefaults(this.clientOpts.profile ? { profile: this.clientOpts.profile } : {}),
+			region,
+			credentials: this.s3Client.config.credentials
+		});
+		return this.scanClient;
 	}
 	get prefix() {
 		return this.config.prefix;
@@ -5295,6 +5715,87 @@ var S3StateBackend = class {
 			throw new StateError(`Failed to list stacks: ${normalized.message}`, normalized);
 		}
 	}
+	async listTopLevelPrefixes() {
+		const client = await this.clientForScan();
+		const out = [];
+		let continuationToken;
+		do {
+			const response = await client.send(new ListObjectsV2Command({
+				Bucket: this.config.bucket,
+				...await this.ownerParam(),
+				Delimiter: "/",
+				EncodingType: "url",
+				...continuationToken && { ContinuationToken: continuationToken }
+			}));
+			for (const cp of response.CommonPrefixes ?? []) {
+				let decoded;
+				try {
+					decoded = decodeListingKey(cp.Prefix);
+				} catch {
+					this.logger.debug(safeMsg`Skipping a top-level prefix of bucket ${this.config.bucket} that is not valid URL encoding: ${cp.Prefix ?? ""}`);
+					continue;
+				}
+				if (decoded === void 0 || !decoded.endsWith("/")) continue;
+				if (decoded === `${"_cdkd-registry"}/`) continue;
+				out.push(decoded.slice(0, -1));
+			}
+			continuationToken = response.IsTruncated ? response.NextContinuationToken : void 0;
+		} while (continuationToken);
+		return out;
+	}
+	async recordUnderPrefix(prefix, stackName, region) {
+		const client = await this.clientForScan();
+		const sibling = new S3StateBackend(client, {
+			...this.config,
+			prefix
+		}, this.clientOpts);
+		sibling.clientResolved = true;
+		const stackDir = `${prefix}/${stackName}/`;
+		let listed;
+		try {
+			listed = await client.send(new ListObjectsV2Command({
+				Bucket: this.config.bucket,
+				...await this.ownerParam(),
+				Prefix: stackDir,
+				MaxKeys: 1,
+				EncodingType: "url"
+			}));
+		} catch (error) {
+			throw new CrossPrefixReadError(stackDir, error);
+		}
+		if ((listed.KeyCount ?? listed.Contents?.length ?? 0) === 0) return "absent";
+		const read = async (key) => {
+			let body;
+			try {
+				body = await sibling.getRawObject(key);
+			} catch (error) {
+				throw new CrossPrefixReadError(key, error);
+			}
+			if (body === null) return null;
+			if (body.trim() === "") throw new CrossPrefixReadError(key, Object.assign(/* @__PURE__ */ new Error("empty object"), { name: "EmptyObject" }));
+			let value;
+			try {
+				value = JSON.parse(body);
+			} catch (error) {
+				throw new CrossPrefixReadError(key, error);
+			}
+			if (value === null || typeof value !== "object" || Array.isArray(value)) throw new CrossPrefixReadError(key, /* @__PURE__ */ new TypeError("not a JSON object"));
+			return value;
+		};
+		const [scoped, legacy, journal] = await Promise.all([
+			read(sibling.getStateKey(stackName, region)),
+			read(sibling.getLegacyStateKey(stackName)),
+			read(sibling.getRollbackJournalKey(stackName, region))
+		]);
+		let record;
+		if (scoped !== null) record = scoped;
+		else if (legacy !== null) {
+			const bodyRegion = legacy["region"];
+			if (!bodyRegion || bodyRegion === region) record = legacy;
+		}
+		if (record === void 0 && journal === null) return "absent";
+		return recordCanOwnResources(record ?? { resources: {} }, journal) ? "holder" : "empty";
+	}
 	async putRawObject(key, body, contentType = "application/json") {
 		await this.ensureClientForBucket();
 		await this.s3Client.send(new PutObjectCommand({
@@ -5306,6 +5807,176 @@ var S3StateBackend = class {
 			ContentType: contentType
 		}));
 	}
+	async earlierStateResources(stackName, region, max = 10) {
+		await this.ensureClientForBucket();
+		return readEarlierStateResources(this.s3Client, this.config.bucket, await this.ownerParam(), this.getStateKey(stackName, region), max);
+	}
+	getRetainedKey(stackName, region) {
+		return `${this.config.prefix}/${stackName}/${region}/retained.json`;
+	}
+	async loadRetainedResources(stackName, region) {
+		return await this.loadRetainedRecord(stackName, region) ?? [];
+	}
+	async loadRetainedRecord(stackName, region) {
+		const key = this.getRetainedKey(stackName, region);
+		let body;
+		try {
+			body = await this.getRawObject(key);
+		} catch (error) {
+			throw new CrossPrefixReadError(key, error);
+		}
+		if (body === null) return null;
+		const entries = parseRetainedResources(body);
+		if (entries === void 0) throw new CrossPrefixReadError(key, Object.assign(/* @__PURE__ */ new Error("not a retained-resource record"), { name: "MalformedRecord" }));
+		return entries;
+	}
+	async ensureRetainedTombstone(stackName, region) {
+		await this.ensureClientForBucket();
+		const key = this.getRetainedKey(stackName, region);
+		const put = async () => this.s3Client.send(new PutObjectCommand({
+			Bucket: this.config.bucket,
+			...await this.ownerParam(),
+			Key: key,
+			Body: JSON.stringify({
+				retainedVersion: 1,
+				resources: []
+			}),
+			ContentType: "application/json",
+			IfNoneMatch: "*"
+		}));
+		try {
+			try {
+				await put();
+			} catch (error) {
+				if (!isConditionalConflict(error)) throw error;
+				await put();
+			}
+		} catch (error) {
+			if (isConditionFailure(error) && !isConditionalConflict(error)) return;
+			if (!isNotImplemented(error)) throw error;
+			if (await this.loadRetainedRecord(stackName, region) === null) await this.saveRetainedResources(stackName, region, []);
+		}
+	}
+	async saveRetainedResources(stackName, region, entries) {
+		await this.ensureClientForBucket();
+		const key = this.getRetainedKey(stackName, region);
+		const put = (resources) => this.ownerParam().then((owner) => this.s3Client.send(new PutObjectCommand({
+			Bucket: this.config.bucket,
+			...owner,
+			Key: key,
+			Body: JSON.stringify({
+				retainedVersion: 1,
+				resources
+			}),
+			ContentType: "application/json"
+		})));
+		const fresh = new Set(entries.filter((e) => e.keptAt === void 0));
+		const provisional = Date.now();
+		await put(entries.map((e) => fresh.has(e) ? {
+			...e,
+			keptAt: provisional
+		} : e));
+		if (fresh.size === 0) return;
+		try {
+			const head = await this.s3Client.send(new HeadObjectCommand({
+				Bucket: this.config.bucket,
+				...await this.ownerParam(),
+				Key: key
+			}));
+			const keptAt = head.LastModified instanceof Date ? head.LastModified.getTime() : void 0;
+			if (keptAt === void 0) throw new Error("S3 reported no LastModified");
+			if (Math.abs(keptAt - provisional) <= KEPT_AT_CLOCK_TOLERANCE_MS) return;
+			await put(entries.map((e) => fresh.has(e) ? {
+				...e,
+				keptAt
+			} : e));
+		} catch (error) {
+			throw new RetainedTimeUnconfirmedError(error);
+		}
+	}
+	registryMarkerKey(stackName, region) {
+		return `${REGISTRY_ROOT}/${region}/${stackName}.json`;
+	}
+	async getRegistryMarker(stackName, region) {
+		await this.ensureClientForBucket();
+		const key = this.registryMarkerKey(stackName, region);
+		let body;
+		let etag;
+		try {
+			const response = await this.s3Client.send(new GetObjectCommand({
+				Bucket: this.config.bucket,
+				...await this.ownerParam(),
+				Key: key
+			}));
+			body = await response.Body?.transformToString();
+			etag = response.ETag;
+		} catch (error) {
+			if (isNoSuchKey(error) || error.name === "NotFound") return null;
+			throw new CrossPrefixReadError(key, error);
+		}
+		const prefix = registryMarkerPrefix(body);
+		if (prefix === void 0 || etag === void 0) throw new CrossPrefixReadError(key, Object.assign(/* @__PURE__ */ new Error("not a registry marker"), { name: "MalformedMarker" }));
+		return {
+			prefix,
+			etag
+		};
+	}
+	async claimRegistryMarker(stackName, region, ifMatch) {
+		await this.ensureClientForBucket();
+		const key = this.registryMarkerKey(stackName, region);
+		try {
+			await this.s3Client.send(new PutObjectCommand({
+				Bucket: this.config.bucket,
+				...await this.ownerParam(),
+				Key: key,
+				Body: JSON.stringify({ prefix: this.config.prefix }),
+				ContentType: "application/json",
+				...ifMatch === void 0 ? { IfNoneMatch: "*" } : { IfMatch: ifMatch }
+			}));
+			return "claimed";
+		} catch (error) {
+			if (isConditionFailure(error)) return "conflict";
+			throw new CrossPrefixReadError(key, error);
+		}
+	}
+	async releaseRegistryMarker(stackName, region, known) {
+		const marker = known !== void 0 && (known === null || known.etag !== "") ? known : await this.getRegistryMarker(stackName, region);
+		if (marker === null) return "absent";
+		if (marker.prefix !== this.config.prefix) return "elsewhere";
+		const key = this.registryMarkerKey(stackName, region);
+		try {
+			await this.s3Client.send(new DeleteObjectCommand({
+				Bucket: this.config.bucket,
+				...await this.ownerParam(),
+				Key: key,
+				IfMatch: marker.etag
+			}));
+			return "released";
+		} catch (error) {
+			if (isConditionFailure(error)) return "elsewhere";
+			if (!isNotImplemented(error)) throw error;
+		}
+		const again = await this.getRegistryMarker(stackName, region);
+		if (again === null) return "absent";
+		if (again.prefix !== this.config.prefix || again.etag !== marker.etag) return "elsewhere";
+		await this.s3Client.send(new DeleteObjectCommand({
+			Bucket: this.config.bucket,
+			...await this.ownerParam(),
+			Key: key
+		}));
+		return "released";
+	}
+	async lockUnderPrefix(prefix, stackName, region) {
+		await this.ensureClientForBucket();
+		const keys = [`${prefix}/${stackName}/${region}/lock.json`, `${prefix}/${stackName}/lock.json`];
+		return (await Promise.all(keys.map(async (key) => {
+			try {
+				return await this.headObject(key);
+			} catch (error) {
+				throw new CrossPrefixReadError(key, error);
+			}
+		}))).some(Boolean);
+	}
 	async getRawObject(key) {
 		await this.ensureClientForBucket();
 		try {
@@ -5750,6 +6421,53 @@ var S3StateBackend = class {
 		return parsed;
 	}
 };
+function parseRetainedResources(body) {
+	let value;
+	try {
+		value = JSON.parse(body);
+	} catch {
+		return;
+	}
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const doc = value;
+	if (doc.retainedVersion !== 1 || !Array.isArray(doc.resources)) return void 0;
+	const out = [];
+	for (const entry of doc.resources) {
+		const e = entry;
+		if (typeof e?.logicalId === "string" && typeof e.resourceType === "string" && typeof e.physicalId === "string" && e.physicalId !== "") out.push({
+			logicalId: e.logicalId,
+			resourceType: e.resourceType,
+			physicalId: e.physicalId,
+			...typeof e.keptAt === "number" && Number.isFinite(e.keptAt) && { keptAt: e.keptAt }
+		});
+	}
+	return out;
+}
+const REGISTRY_ROOT = "_cdkd-registry";
+function registryMarkerPrefix(body) {
+	if (body === void 0) return void 0;
+	let value;
+	try {
+		value = JSON.parse(body);
+	} catch {
+		return;
+	}
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const prefix = value.prefix;
+	if (typeof prefix !== "string" || prefix.length > 1024) return void 0;
+	if (/[\u0000-\u001f\u007f<>]/.test(prefix)) return void 0;
+	return prefix;
+}
+function isConditionalConflict(error) {
+	const name = error?.name;
+	const status = error?.$metadata?.httpStatusCode;
+	return name === "ConditionalRequestConflict" || status === 409 && name !== "PreconditionFailed";
+}
+function isConditionFailure(error) {
+	const name = error?.name;
+	const status = error?.$metadata?.httpStatusCode;
+	return name === "PreconditionFailed" || name === "ConditionalRequestConflict" || status === 412 || status === 409;
+}
 function isNoSuchKey(error) {
 	if (error instanceof NoSuchKey) return true;
 	return error?.name === "NoSuchKey";
@@ -5768,6 +6486,15 @@ function addSupersededIds(segment, ids) {
 const MAX_RENEWAL_INTERVAL_MS = 12e4;
 const RENEWAL_TTL_FRACTION = 4;
 const MIN_RENEWAL_INTERVAL_MS = 1e3;
+function renewalIntervalFor(ttlMs) {
+	return Math.max(MIN_RENEWAL_INTERVAL_MS, Math.min(MAX_RENEWAL_INTERVAL_MS, Math.floor(ttlMs / RENEWAL_TTL_FRACTION)));
+}
+function abandonedRunHorizon(record) {
+	if (record.lastModified === void 0) return void 0;
+	const ttlMs = Number(record.info.expiresAt) - record.lastModified;
+	const interval = Number.isFinite(ttlMs) && ttlMs > 0 ? renewalIntervalFor(ttlMs) : MAX_RENEWAL_INTERVAL_MS;
+	return record.lastModified + interval;
+}
 const RELEASED_LOCK_REACQUIRE_LIMIT = 3;
 const LOCK_OBJECT_DESCRIPTION = "a stack lock heartbeat, which records the lock owner, its acquisition timestamp, its deadline and the operation name — no secret, but one row per renewal";
 function safeSegment(value) {
@@ -5791,6 +6518,7 @@ var LockManager = class {
 	renewalIntervalMs;
 	renewalDisabled;
 	heldLocks = /* @__PURE__ */ new Map();
+	abandonedLocks = /* @__PURE__ */ new Map();
 	clientResolved = false;
 	resolveInFlight = null;
 	constructor(s3Client, config, options) {
@@ -5800,7 +6528,7 @@ var LockManager = class {
 		if (!(ttlMinutes > 0) || !Number.isFinite(ttlMinutes)) throw new LockError(`Lock TTL must be a positive number of minutes (got ${String(ttlMinutes)}). A non-positive TTL makes every lock born expired, and the renewal interval clamps to its floor, so the heartbeat would spin one request per second for the life of the process.`);
 		this.ttlMs = ttlMinutes * 60 * 1e3;
 		this.renewalDisabled = options?.disableRenewal === true;
-		this.renewalIntervalMs = Math.max(MIN_RENEWAL_INTERVAL_MS, Math.min(MAX_RENEWAL_INTERVAL_MS, Math.floor(this.ttlMs / RENEWAL_TTL_FRACTION)));
+		this.renewalIntervalMs = renewalIntervalFor(this.ttlMs);
 	}
 	async ownerParam() {
 		return expectedOwnerParam(this.s3Client);
@@ -5889,6 +6617,8 @@ var LockManager = class {
 					}
 					const why = Number.isFinite(existing.info.expiresAt) ? "A live cdkd process renews its lock well inside the TTL, so this normally means the previous owner crashed or was suspended" : `Its expiresAt is not a finite number, which cdkd treats as already expired`;
 					this.logger.warn(`Took over an EXPIRED lock for stack: ${safeSegment(stackName)} (${safeSegment(region)}, owner: ${formatLockOwner(existing.info.owner)}, ${formatLockExpiry(existing.info.expiresAt)}). ${why} -- if it is in fact still running, both processes are now writing to the same stack.`);
+					const abandonedAt = abandonedRunHorizon(existing);
+					if (abandonedAt !== void 0) this.abandonedLocks.set(key, abandonedAt);
 					try {
 						const retryEtag = await this.putLockObject(key, lockInfo);
 						this.logger.debug(`Lock acquired for stack: ${stackRef(stackName, region)} after expired lock cleanup, owner: ${displaySafe(lockOwner)}`);
@@ -5959,7 +6689,8 @@ var LockManager = class {
 			this.logger.debug(`Lock info for stack: ${shownStack}:`, lockInfo);
 			return {
 				info: lockInfo,
-				etag: response.ETag
+				etag: response.ETag,
+				...response.LastModified instanceof Date && { lastModified: response.LastModified.getTime() }
 			};
 		} catch (error) {
 			if (error instanceof NoSuchKey) {
@@ -6042,9 +6773,13 @@ var LockManager = class {
 	sameLockIdentity(a, b) {
 		return displaySafe(a.owner) === displaySafe(b.owner) && a.timestamp === b.timestamp;
 	}
-	async forceReleaseLock(stackName, region) {
+	abandonedRunEndedBy(stackName, region) {
+		return this.abandonedLocks.get(this.getLockKey(stackName, region));
+	}
+	async forceReleaseLock(stackName, region, beforeDelete) {
 		const where = stackRef(stackName, region);
-		const lockInfo = await this.getLockInfo(stackName, region).catch(() => null);
+		const record = await this.getLockRecord(stackName, region).catch(() => null);
+		const lockInfo = record?.info ?? null;
 		this.logger.warn(lockInfo ? `Force releasing lock for stack: ${where}, owner: ${formatLockOwner(lockInfo.owner)}${lockInfo.operation ? `, operation: ${formatLockOperation(lockInfo.operation)}` : ""}, expired: ${this.isLockExpired(lockInfo)}` : `Force releasing lock for stack: ${where} (no lock body read — absent or unparseable; deleting the object either way, since a lock cdkd cannot read is a lock nothing else can clear)`);
 		const key = this.getLockKey(stackName, region);
 		const held = this.heldLocks.get(key);
@@ -6052,11 +6787,14 @@ var LockManager = class {
 			this.stopRenewal(held);
 			held.releasing = Promise.resolve();
 		}
+		const horizon = record ? abandonedRunHorizon(record) : void 0;
+		if (horizon !== void 0 && beforeDelete !== void 0) await beforeDelete(horizon).catch(() => void 0);
 		try {
 			await this.deleteLock(stackName, region);
 		} finally {
 			await this.purgeLockVersions(key, "reap");
 		}
+		return horizon;
 	}
 	async deleteLock(stackName, region, etag) {
 		await this.ensureClientForBucket();
@@ -11311,7 +12049,7 @@ const DERIVED_GENERATED_NAMES = {
 	},
 	"AWS::S3::Bucket": {
 		file: "s3-bucket-provider.ts",
-		source: "generateResourceName(logicalId, {\n        maxLength: 63,\n        lowercase: true,\n        allowedPattern: /[^a-z0-9.-]/g,\n      })",
+		source: "generateResourceName(logicalId, {\n      maxLength: 63,\n      lowercase: true,\n      allowedPattern: /[^a-z0-9.-]/g,\n    })",
 		derive: (id) => generateResourceName(id, {
 			maxLength: 63,
 			lowercase: true,
@@ -22972,7 +23710,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-B3zcS87C.js");
+			const { ASGProvider } = await import("./asg-provider-UKRukGI_.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -23078,7 +23816,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-BfQsw4hw.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DF6Eh4Tl.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-DgbVxaPP.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-B9InVgs6.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -25661,7 +26399,7 @@ const NESTED_REQUIRED = /* @__PURE__ */ new Map([
 		["ContainerDefinitions.LinuxParameters.Tmpfs", ["Size"]],
 		["ContainerDefinitions.LogConfiguration", ["LogDriver"]],
 		["ContainerDefinitions.LogConfiguration.SecretOptions", ["Name", "ValueFrom"]],
-		["ContainerDefinitions.ResourceRequirements", ["Type", "Value"]],
+		["ContainerDefinitions.ResourceRequirements", ["Type"]],
 		["ContainerDefinitions.Secrets", ["Name", "ValueFrom"]],
 		["ContainerDefinitions.Ulimits", [
 			"HardLimit",
@@ -27003,9 +27741,12 @@ var ProviderRegistry = class {
 		this.providers.delete(resourceType);
 	}
 	getProviderFor(input) {
+		const debug = (message) => {
+			if (input.quiet !== true) this.logger.debug(message);
+		};
 		const { resourceType, properties, provisionedBy } = input;
 		if (isCustomResource(resourceType)) {
-			this.logger.debug(`Using Custom Resource provider for ${resourceType}`);
+			debug(`Using Custom Resource provider for ${resourceType}`);
 			return {
 				provider: this.customResourceProvider,
 				provisionedBy: "sdk"
@@ -27020,7 +27761,7 @@ var ProviderRegistry = class {
 				allowedUnsupportedProperties: this.allowedUnsupportedProperties,
 				forceCcApi: input.forceCcApi === true
 			})) {
-				this.logger.debug(`Routing ${resourceType} via Cloud Control (state-recorded provisionedBy=cc-api)`);
+				debug(`Routing ${resourceType} via Cloud Control (state-recorded provisionedBy=cc-api)`);
 				return {
 					provider: this.cloudControlProvider,
 					provisionedBy: "cc-api"
@@ -27032,9 +27773,9 @@ var ProviderRegistry = class {
 		if (specificProvider) {
 			const actionableDrops = findActionableSilentDrops(resourceType, properties, this.allowedUnsupportedProperties, input.previousProperties);
 			if (actionableDrops.length === 0) {
-				this.logger.debug(`Using specific SDK provider for ${resourceType}`);
+				debug(`Using specific SDK provider for ${resourceType}`);
 				if (returningToSdk) {
-					this.logger.debug(`${resourceType} is returning to its SDK provider from a state-recorded cc-api route; physical id is preserved`);
+					debug(`${resourceType} is returning to its SDK provider from a state-recorded cc-api route; physical id is preserved`);
 					return {
 						provider: specificProvider,
 						provisionedBy: "sdk",
@@ -27048,7 +27789,7 @@ var ProviderRegistry = class {
 			}
 			const unroutable = this.ccRouteUnavailableReason(resourceType);
 			if (unroutable !== void 0) throw new Error(this.buildUnroutableSilentDropMessage(resourceType, actionableDrops, unroutable));
-			this.logger.debug(`Auto-routing ${resourceType} via Cloud Control (silent-drop properties: ${actionableDrops.map((d) => d.property).join(", ")})`);
+			debug(`Auto-routing ${resourceType} via Cloud Control (silent-drop properties: ${actionableDrops.map((d) => d.property).join(", ")})`);
 			return {
 				provider: this.cloudControlProvider,
 				provisionedBy: "cc-api",
@@ -27056,14 +27797,14 @@ var ProviderRegistry = class {
 			};
 		}
 		if (CloudControlProvider.isSupportedResourceType(resourceType)) {
-			this.logger.debug(`Using Cloud Control API provider for ${resourceType}`);
+			debug(`Using Cloud Control API provider for ${resourceType}`);
 			return {
 				provider: this.cloudControlProvider,
 				provisionedBy: "cc-api"
 			};
 		}
 		if (this.allowedUnsupportedTypes.has(resourceType)) {
-			this.logger.debug(`Routing escape-hatch-allowed type ${resourceType} through Cloud Control API`);
+			debug(`Routing escape-hatch-allowed type ${resourceType} through Cloud Control API`);
 			return {
 				provider: this.cloudControlProvider,
 				provisionedBy: "cc-api"
@@ -27336,7 +28077,7 @@ function recordedTagsUnreadableWarning(resourceType, id, applied) {
 //#endregion
 //#region src/provisioning/providers/idempotency-token.ts
 const PROCESS_NONCE = randomUUID();
-const inFlight = /* @__PURE__ */ new Map();
+const inFlight$1 = /* @__PURE__ */ new Map();
 const generations = /* @__PURE__ */ new Map();
 const MAX_TRACKED_GENERATIONS = 1e5;
 const tokenKey = (scope, logicalId, maxLength, charset) => injectiveKey(scope, ambientRegion() ?? "", getCurrentStackName() ?? "", logicalId, maxLength, charset);
@@ -27347,14 +28088,14 @@ const derive = (key, generation, maxLength, charset) => {
 function acquireIdempotencyToken(options) {
 	const { scope, logicalId, maxLength = 64, charset = "default" } = options;
 	const key = tokenKey(scope, logicalId, maxLength, charset);
-	const existing = inFlight.get(key);
+	const existing = inFlight$1.get(key);
 	const value = existing ?? derive(key, generations.get(key) ?? 0, maxLength, charset);
-	if (existing === void 0) inFlight.set(key, value);
+	if (existing === void 0) inFlight$1.set(key, value);
 	return {
 		value,
 		release: () => {
-			if (!inFlight.has(key)) return;
-			inFlight.delete(key);
+			if (!inFlight$1.has(key)) return;
+			inFlight$1.delete(key);
 			const generation = (generations.get(key) ?? 0) + 1;
 			if (!generations.has(key) && generations.size >= MAX_TRACKED_GENERATIONS) {
 				const oldest = generations.keys().next();
@@ -27379,6 +28120,7 @@ function stackScopedCreateToken(options) {
 //#region src/provisioning/providers/create-token-ledger.ts
 var CreateTokenLedger = class {
 	doc;
+	loadedAbsent = false;
 	stale = false;
 	startedThisDeploy = false;
 	replaceRecordedLedger = false;
@@ -27404,8 +28146,10 @@ var CreateTokenLedger = class {
 	}
 	async current() {
 		if (this.doc !== void 0 && !this.stale) return this.doc;
+		if (this.loadedAbsent && !this.stale) return null;
 		const loaded = await this.store.load();
 		this.stale = false;
+		this.loadedAbsent = loaded === null;
 		if (loaded !== null && this.replaceRecordedLedger && loaded.stateRecorded === true) {
 			this.logger.info("This stack has no state record but its create-token ledger outlived an earlier one; starting a fresh ledger, so this deploy does not take over resources that deployment left.");
 			this.doc = emptyCreateTokenLedger(randomUUID());
@@ -27492,6 +28236,85 @@ var CreateTokenLedger = class {
 			}
 		});
 	}
+	sentEntries() {
+		return this.serialized(async () => {
+			try {
+				return { ...(await this.current())?.sent ?? {} };
+			} catch (error) {
+				this.stale = true;
+				throw error;
+			}
+		});
+	}
+	recordSent(entries, firstSentAt) {
+		return this.serialized(async () => {
+			try {
+				let doc = await this.current();
+				if (doc === null) {
+					doc = emptyCreateTokenLedger(randomUUID());
+					this.doc = doc;
+					this.startedThisDeploy = true;
+				}
+				let changed = false;
+				for (const entry of entries) {
+					const recorded = doc.sent[entry.logicalId];
+					if (recorded?.base === entry.base && recorded.token === entry.token) continue;
+					doc.sent[entry.logicalId] = {
+						base: entry.base,
+						token: entry.token,
+						firstSentAt
+					};
+					changed = true;
+				}
+				if (changed) await this.persist(doc);
+			} catch (error) {
+				this.stale = true;
+				throw error;
+			}
+		});
+	}
+	abandonedAt() {
+		return this.serialized(async () => (await this.current())?.abandonedAt);
+	}
+	noteAbandoned(at) {
+		return this.serialized(async () => {
+			try {
+				const doc = await this.current();
+				if (doc === null) return;
+				if (!Object.values(doc.sent).some((e) => e.base.startsWith("adopt-by-name:")) || doc.abandonedAt !== void 0 && doc.abandonedAt >= at) return;
+				doc.abandonedAt = at;
+				await this.persist(doc);
+			} catch (error) {
+				this.stale = true;
+				throw error;
+			}
+		});
+	}
+	settleAdoptingCreates(drop, failedAt) {
+		return this.serialized(async () => {
+			try {
+				const doc = await this.current();
+				if (doc === null) return;
+				const adopting = (id) => doc.sent[id]?.base.startsWith(ADOPTING_CREATE_BASE) === true;
+				let changed = false;
+				for (const id of drop) {
+					if (!adopting(id)) continue;
+					delete doc.sent[id];
+					changed = true;
+				}
+				for (const [id, at] of failedAt) {
+					const entry = adopting(id) ? doc.sent[id] : void 0;
+					if (entry === void 0 || entry.failedAt !== void 0) continue;
+					entry.failedAt = at;
+					changed = true;
+				}
+				if (changed) await this.persist(doc);
+			} catch (error) {
+				this.stale = true;
+				throw error;
+			}
+		});
+	}
 	forget(logicalIds) {
 		return this.serialized(async () => {
 			try {
@@ -27537,6 +28360,39 @@ function ledgerForStack(backend, stackName, region) {
 	});
 }
 const ledgerStore = new AsyncLocalStorage();
+const ADOPTING_CREATE_BASE = "adopt-by-name:";
+async function recordedAdoptingCreates() {
+	const ledger = ledgerStore.getStore();
+	if (ledger === void 0) return void 0;
+	const out = /* @__PURE__ */ new Map();
+	for (const [logicalId, entry] of Object.entries(await ledger.sentEntries())) if (entry.base.startsWith("adopt-by-name:")) out.set(logicalId, {
+		resourceType: entry.base.slice(14),
+		name: entry.token,
+		firstSentAt: entry.firstSentAt,
+		...entry.failedAt !== void 0 && { failedAt: entry.failedAt }
+	});
+	return out;
+}
+async function recordAdoptingCreates(creates) {
+	const ledger = ledgerStore.getStore();
+	if (ledger === void 0 || creates.length === 0) return;
+	await ledger.recordSent(creates.map((c) => ({
+		logicalId: c.logicalId,
+		base: `${ADOPTING_CREATE_BASE}${c.resourceType}`,
+		token: c.name
+	})), Date.now());
+}
+async function noteAbandonedRun(at) {
+	const ledger = ledgerStore.getStore();
+	if (ledger === void 0) return true;
+	return ledger.noteAbandoned(at).then(() => true, () => false);
+}
+async function ledgerAbandonedAt() {
+	return ledgerStore.getStore()?.abandonedAt();
+}
+async function settleAdoptingCreates(drop, failedAt = /* @__PURE__ */ new Map()) {
+	await ledgerStore.getStore()?.settleAdoptingCreates(drop, failedAt);
+}
 function withCreateTokenLedger(ledger, fn) {
 	return ledgerStore.run(ledger, () => withStateSavedObserver((stackName, region) => ledger.noteStateSaved(stackName, region), fn));
 }
@@ -28280,6 +29136,25 @@ function skipUnaddressableReplay(scope, logger, op, what, source = "record") {
 	logger.warn(safeMsg`  Rollback: Cannot ${what} ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}) ` + "— its state record has no non-empty string 'physicalId', so cdkd cannot address it in AWS and sent nothing for it. The resource and its state record are left exactly as they are. Repair the record's 'physicalId' (inspect it with `cdkd state show`), then re-converge it with `cdkd deploy`.");
 	recordRollbackSkip(scope, op, UNADDRESSABLE_SKIP_CAUSE);
 }
+async function keptForAnotherHolder(scope, logger, op, physicalId) {
+	const ask = scope.ctx.createdResourceHolder;
+	if (ask === void 0) return false;
+	let holding;
+	try {
+		holding = await ask(op.resourceType, physicalId);
+	} catch {
+		holding = {
+			kind: "unreadable",
+			what: "the other stacks' state records (the check failed)"
+		};
+	}
+	if (holding === void 0) return false;
+	const why = holding.kind === "held" ? `${holding.by} holds it` : `${holding.what}, so it is not known whether another deployment owns it`;
+	const retry = holding.kind === "unreadable" && holding.retryable === true ? scope.ctx.createdResourceRetryCommand : void 0;
+	logger.warn(safeMsg`  Rollback: Keeping created resource ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}) ` + safeMsg`\u2014 ${why}. The failed deploy may have adopted a resource that existed under its name, so the rollback does not delete it; the rollback journal keeps it.` + (retry === void 0 ? "" : safeMsg` Once S3 can be read, finish the rollback with: ${retry}`));
+	recordRollbackSkip(scope, op, "Another state record holds this resource, or it could not be checked, so the rollback did not delete it.");
+	return true;
+}
 function effectiveProvisionedBy(record, fallbackProvisionedBy) {
 	return record?.provisionedBy ?? fallbackProvisionedBy;
 }
@@ -30644,6 +31519,7 @@ async function replayDelete(s) {
 		skipUnaddressableReplay(s, logger, op, "delete created resource");
 		return;
 	}
+	if (await keptForAnotherHolder(s, logger, op, op.physicalId)) return;
 	s.createRollbackRoute = deleteProvisionedBy;
 	const snapshotPolicy = action === "delete-with-final-snapshot";
 	const takeFinalSnapshot = snapshotPolicy && ctx.skipFinalSnapshot !== true;
@@ -31440,6 +32316,10 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						skipUnaddressableReplay(skipScope, logger, op, "delete partially-created resource", failedCreateRecord ? "record" : "journal");
 						break;
 					}
+					if (await keptForAnotherHolder(skipScope, logger, op, op.physicalId)) {
+						pending.add(op);
+						break;
+					}
 					const orphanDeleteChecked = op.physicalIdRecoveredFromError === true && ctx.foreignHolder !== void 0 && ctx.orphanDeleteProven?.has(op) !== true;
 					if (orphanDeleteChecked) {
 						const verdict = await journaledOrphanKeepReason({
@@ -32636,7 +33516,16 @@ async function performRollback(completedOperations, stateResources, stackName, p
 		operations: completedOperations,
 		failedOperations: orphanOps
 	}], priorOrphans);
-	const ctx = this.rollbackExecutorContext(previousState, stackName);
+	const crossPrefixHolder = this.options.crossPrefixHolder;
+	let crossPrefixAnswer;
+	const ctx = {
+		...this.rollbackExecutorContext(previousState, stackName),
+		createdResourceRetryCommand: pasteableCommand("cdkd rollback", [{
+			value: (this.options.parentStackInfo?.parentStack ?? stackName).split("~")[0],
+			hole: "stack"
+		}], recoveryCommandFlags(this.options.refusalRecovery).flags).command,
+		createdResourceHolder: crossPrefixHolder === void 0 ? void 0 : () => crossPrefixAnswer ??= crossPrefixHolder(stackName)
+	};
 	const inlinePolicyWriters = new RollbackInlinePolicyWriters();
 	const runId = this.options.eventRecorder?.runId;
 	const { result, failed, run } = await withNestedRevertRun(runId, async (scope) => {
@@ -32666,6 +33555,21 @@ async function performRollback(completedOperations, stateResources, stackName, p
 		remainingFailedOps: failedOperations.filter((_, i) => !handled.has(i))
 	};
 }
+function foreignHolderResolver(engine) {
+	const sameBucketHolderFor = makeForeignHolderScan(engine.stateBackend);
+	const crossPrefixHolder = engine.options.crossPrefixHolder;
+	const crossPrefixAnswers = /* @__PURE__ */ new Map();
+	return (self) => async (resourceType, physicalId) => {
+		const held = await sameBucketHolderFor(self)(resourceType, physicalId);
+		if (held !== void 0 || crossPrefixHolder === void 0) return held;
+		let answer = crossPrefixAnswers.get(self.stackName);
+		if (answer === void 0) {
+			answer = crossPrefixHolder(self.stackName);
+			crossPrefixAnswers.set(self.stackName, answer);
+		}
+		return answer;
+	};
+}
 async function settleJournalAfterSuccess(stackName, completedOperations, previousState, finalResources, initialDeploy) {
 	if (this.options.parentStackInfo) {
 		await this.writeRollbackJournalSegment(stackName, completedOperations, [], NESTED_PENDING_PARENT_REASON, initialDeploy, nestedPendingSnapshot(previousState, (name) => {
@@ -32677,7 +33581,7 @@ async function settleJournalAfterSuccess(stackName, completedOperations, previou
 		return 0;
 	}
 	let nestedLeft = 0;
-	const foreignHolderFor = makeForeignHolderScan(this.stateBackend);
+	const foreignHolderFor = foreignHolderResolver(this);
 	const deployRunId = this.options.eventRecorder?.runId;
 	const stripOnFailure = /* @__PURE__ */ new Map();
 	const [ownLeft] = await Promise.all([(async () => {
@@ -34197,6 +35101,13 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 	});
 	const createProvider = createDecision.provider;
 	const createProps = createDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
+	await refuseUnlicensedGeneratedName.call(this, {
+		logicalId,
+		resourceType,
+		stackName,
+		createdVia: createDecision.provisionedBy,
+		resolvedProps
+	});
 	await refuseTakenCreateName.call(this, {
 		logicalId,
 		resourceType,
@@ -34207,7 +35118,15 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 		secrets: createSecrets,
 		stateResources
 	});
-	const result = await this.withRetry(() => withCurrentResourceSecrets(createSecrets, () => createProvider.create(logicalId, resourceType, createProps, { maskSecrets: createSecretMasker(createSecrets) })), logicalId, void 0, void 0, createProvider);
+	this.generatedNameGuard?.noteSent(logicalId);
+	let result;
+	try {
+		result = await this.withRetry(() => withCurrentResourceSecrets(createSecrets, () => createProvider.create(logicalId, resourceType, createProps, { maskSecrets: createSecretMasker(createSecrets) })), logicalId, void 0, void 0, createProvider);
+	} catch (error) {
+		this.generatedNameGuard?.noteFailed(logicalId, error);
+		throw error;
+	}
+	this.generatedNameGuard?.noteReturned(logicalId);
 	this.registerNoEchoAttributes(logicalId, result, createSecrets, resolvedProps);
 	const dependencies = this.extractAllDependencies(template, logicalId);
 	const templateAttrs = this.extractTemplateAttributes(template, logicalId);
@@ -34235,6 +35154,46 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 	renderer.removeTask(logicalId);
 	this.logger.info(`${createPrefix}${formatResourceLine("created", logicalId, resourceType)}`);
 }
+async function refuseUnlicensedGeneratedName(input) {
+	const { logicalId, resourceType } = input;
+	const asked = this.generatedNameGuard?.candidate(logicalId);
+	if (asked === void 0 || input.createdVia === "cc-api") return;
+	const verdict = await this.generatedNameGuard.admit(logicalId, input.resolvedProps);
+	if (verdict === void 0) return;
+	const subject = `${displaySafe(logicalId)} (${displaySafe(resourceType)})`;
+	const named = `the cdkd-generated ${asked.property ?? "name"} ${displaySafe(asked.name)}`;
+	const adoptsText = "its create API hands back or overwrites an existing resource of that name instead of refusing it";
+	const refuse = (message) => {
+		throw markNonRetryable(markRefusedBeforeApplying(new CdkdError(message, "GENERATED_NAME_HELD")));
+	};
+	switch (verdict.kind) {
+		case "free":
+		case "licensed": return;
+		case "unchecked":
+			this.logger.warn(safeMsg`${subject} is created with ${named} without checking whether another resource already ` + safeMsg`holds it: the lookup was refused (${describeAwsFailure(verdict.error).summary}). ` + "Grant this identity the type's Describe / List permission to have cdkd refuse taking over another deployment's resource.");
+			return;
+		case "failed":
+			if (isInterruptedWaitError(verdict.error)) throw verdict.error;
+			return refuse(`${subject} is created with ${named}, and ${adoptsText}, but cdkd could not check whether another resource already holds it (${describeAwsFailure(verdict.error).summary}). ${displaySafe(logicalId)} was not created. Re-run the deploy once the check can succeed.`);
+		case "held": {
+			const nested = input.stackName.includes("~");
+			const top = input.stackName.split("~")[0];
+			const importLine = nested ? `adopt it through the top-level stack ${quotedOrDescribed(top, "stack name")} with \`cdkd import\`` : `adopt it with \`${pasteableCommand("cdkd import", [{
+				value: input.stackName,
+				hole: "stack"
+			}, {
+				flag: "--resource",
+				value: `${logicalId}=${verdict.holder}`,
+				hole: "logicalId=physicalId"
+			}], recoveryCommandFlags(this.options.refusalRecovery).flags).command}\``;
+			if (verdict.ownIntent !== void 0) {
+				const why = verdict.ownIntent === "abandoned" ? "a deploy of this stack that was killed or force-unlocked" : "a create of this stack that came back failed (a timeout or a server error)";
+				return refuse(`${subject} would be created with ${named}, which an existing resource (${displaySafe(verdict.holder)}) already holds. This stack's create-token ledger records that ${why} sent this name, but this type reports no creation time, so cdkd cannot tell that resource is the one it made rather than another deployment's created since. Since ${adoptsText}, creating it would take that resource over. ${displaySafe(logicalId)} was not created. The likely cause: the resource is this stack's own, from that deploy. If it is, ${importLine} and re-run; if it is not, this stack is also deployed under another state backend (go-to-k/cdkd#4705).`);
+			}
+			return refuse(`${subject} would be created with ${named}, which an existing resource (${displaySafe(verdict.holder)}) already holds, and nothing this stack records names that resource: not its state, its rollback journal or create-token ledger, nor what a destroy of it under this state prefix kept. Since ${adoptsText}, creating it would take that resource over, as CloudFormation refuses with "already exists". ${displaySafe(logicalId)} was not created. The likely cause: this stack is also deployed under another state backend (another --state-prefix, --state-bucket or account), where cdkd generates the same names. One stack name per account and region is supported (go-to-k/cdkd#4705): deploy it under one backend only, or give this stack another name. If the resource is this stack's own, ${importLine} and re-run.`);
+		}
+	}
+}
 async function refuseTakenCreateName(input) {
 	const { logicalId, resourceType, secrets } = input;
 	const question = createNameQuestion({
@@ -37450,11 +38409,11 @@ const NESTED_STACK_TYPE$1 = "AWS::CloudFormation::Stack";
 async function requireDeploymentApproval(args) {
 	const level = args.options.requireApproval ?? "never";
 	const approve = args.options.approveDeployment;
-	if (level === "never" || approve === void 0) return;
+	if (level === "never" || approve === void 0) return false;
 	const changes = [...args.changes].filter((c) => c.changeType !== "NO_CHANGE" && !isNoEchoPromotionOnly(c));
 	const destructiveChanges = findDestructiveChanges(args.stackName, changes, args.records, args.template, new Set(args.recreateTargetIds ?? []));
 	const onlyNestedUpdates = changes.every((c) => c.changeType === "UPDATE" && c.resourceType === NESTED_STACK_TYPE$1);
-	if (!(level === "destructive" ? destructiveChanges.length > 0 : changes.length > 0 && !onlyNestedUpdates)) return;
+	if (!(level === "destructive" ? destructiveChanges.length > 0 : changes.length > 0 && !onlyNestedUpdates)) return false;
 	const count = (type) => changes.filter((c) => c.changeType === type).length;
 	if (enclosingDeadlineExpired()) throw approvalAfterTimeout(args.stackName);
 	let approved;
@@ -37473,6 +38432,16 @@ async function requireDeploymentApproval(args) {
 		throw error instanceof Error ? markNonRetryable(error) : error;
 	}
 	if (!approved) throw markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${args.stackName} was not approved (--require-approval=${level}). Nothing was changed.`, "DEPLOY_NOT_APPROVED"));
+	return approve.autoApproves !== true;
+}
+async function checkDestructivePlan(args) {
+	const hook = args.options.onDestructivePlan;
+	if (hook === void 0) return;
+	const changes = [...args.changes].filter((c) => c.changeType !== "NO_CHANGE" && !isNoEchoPromotionOnly(c));
+	const destroying = findDestructiveChanges(args.stackName, changes, args.records, args.template, new Set(args.recreateTargetIds ?? [])).filter((c) => c.impact !== "WILL_ORPHAN");
+	const nestedRowChanges = changes.some((c) => c.resourceType === NESTED_STACK_TYPE$1 && (c.changeType === "CREATE" || c.changeType === "UPDATE"));
+	if (destroying.length === 0 && !nestedRowChanges) return;
+	await hook(args.stackName, destroying);
 }
 async function approveLateReplacement(args) {
 	const level = args.options.requireApproval ?? "never";
@@ -37480,7 +38449,7 @@ async function approveLateReplacement(args) {
 	if (level === "never" || approve === void 0) return true;
 	if (enclosingDeadlineExpired()) return false;
 	try {
-		return await whileEnclosingDeadlinesPaused(() => approve({
+		const approved = await whileEnclosingDeadlinesPaused(() => approve({
 			stackName: args.stackName,
 			level,
 			counts: {
@@ -37490,6 +38459,8 @@ async function approveLateReplacement(args) {
 			},
 			destructiveChanges: findDestructiveChanges(args.stackName, [args.change], args.records, args.template)
 		}));
+		if (approve.autoApproves !== true) args.onAsked?.();
+		return approved;
 	} catch {
 		return false;
 	}
@@ -37836,27 +38807,42 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	};
 	let replacedAnyway = false;
 	let lateApproval;
+	let lateCrossPrefixRefused = false;
 	const approveReplacementOf = (pc) => {
 		if (replacedAnyway) return Promise.resolve(true);
 		const { noEchoPromoted: _promoted, ...asReplacement } = pc;
-		lateApproval ??= approveLateReplacement({
-			options: this.options,
-			stackName,
-			change: {
-				...change,
-				changeType: "UPDATE",
-				propertyChanges: [{
-					...asReplacement,
-					requiresReplacement: true
-				}]
-			},
-			records: stateResources,
-			template
-		});
+		const asChange = {
+			...change,
+			changeType: "UPDATE",
+			propertyChanges: [{
+				...asReplacement,
+				requiresReplacement: true
+			}]
+		};
+		lateApproval ??= (async () => {
+			const crossPrefixGate = this.options.onDestructivePlan;
+			if (crossPrefixGate !== void 0) try {
+				await crossPrefixGate(stackName, findDestructiveChanges(stackName, [asChange], stateResources, template), "late");
+			} catch (error) {
+				if (!(error instanceof CdkdError) || error.code !== "STACK_UNDER_OTHER_STATE_PREFIX") throw error;
+				lateCrossPrefixRefused = true;
+				if (counts) counts.crossPrefixKept = (counts.crossPrefixKept ?? 0) + 1;
+				this.logger.warn(error.message);
+				return false;
+			}
+			return approveLateReplacement({
+				options: this.options,
+				stackName,
+				change: asChange,
+				records: stateResources,
+				template,
+				onAsked: () => this.generatedNameGuard?.noteApprovalPrompted()
+			});
+		})();
 		return lateApproval;
 	};
 	const lateReplacementDeclined = /* @__PURE__ */ new Set();
-	const differsWhy = (key) => lateReplacementDeclined.has(key) ? `differs; the replacement was not approved (--require-approval=${this.options.requireApproval ?? "never"})` : "differs; the provider is not known to report this property exactly, so the difference may be its normalization";
+	const differsWhy = (key) => !lateReplacementDeclined.has(key) ? "differs; the provider is not known to report this property exactly, so the difference may be its normalization" : lateCrossPrefixRefused ? "differs; the replacement was refused: see the state-prefix warning above" : `differs; the replacement was not approved (--require-approval=${this.options.requireApproval ?? "never"})`;
 	if (unmarkedRecord && !typeChanged && echoCandidates.length > 0 && hasAddressablePhysicalId(currentResource)) await readOnce();
 	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && recordMatchesDesired) {
 		if (change.attributeChanges && change.attributeChanges.length > 0) {
@@ -38649,8 +39635,83 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 	this.logger.info(`${updatePrefix}${formatResourceLine("updated", logicalId, resourceType)}`);
 }
 
+//#endregion
+//#region src/deployment/retained-readoption.ts
+function keptForReadoption(resource) {
+	if (!replacementCreateAdoptsName(resource.resourceType, resource.provisionedBy)) return false;
+	if (typeof resource.physicalId !== "string" || resource.physicalId === "") return false;
+	const property = explicitNamePropertyFor(resource.resourceType);
+	const properties = resource.properties;
+	return property === void 0 || !properties?.[property];
+}
+async function recordRetainedForReadoption(backend, stackName, region, kept, logger, earlier) {
+	if (kept.length === 0) {
+		try {
+			await backend.ensureRetainedTombstone(stackName, region);
+		} catch (error) {
+			logger.warn(safeMsg`Could not write the empty kept-resource record of ${displayStackName(stackName)} ` + safeMsg`(${describeAwsFailure(error).summary}). Until one exists, a later deploy here may ` + `take back a resource an older cdkd kept; 'cdkd state orphan' writes it.`);
+		}
+		return;
+	}
+	try {
+		const keptIds = new Set(kept.map((k) => k.logicalId));
+		const before = await (earlier ?? backend.loadRetainedRecord(stackName, region)) ?? [];
+		await backend.saveRetainedResources(stackName, region, [...before.filter((e) => !keptIds.has(e.logicalId)), ...kept]);
+	} catch (error) {
+		if (error instanceof RetainedTimeUnconfirmedError) {
+			logger.warn(safeMsg`Recorded the ${String(kept.length)} kept resource(s) of ${displayStackName(stackName)} ` + safeMsg`a later deploy takes back by name, but their time could not be confirmed from S3 ` + safeMsg`(${describeAwsFailure(error.cause).summary}); they carry this machine's clock instead.`);
+			return;
+		}
+		logger.warn(safeMsg`Could not record the ${String(kept.length)} kept resource(s) of ${displayStackName(stackName)} ` + safeMsg`a later deploy takes back by name (${describeAwsFailure(error).summary}). That deploy ` + `refuses to create them over the kept ones; adopt them with 'cdkd import' then.`);
+	}
+}
+var KeptForReadoption = class {
+	entries = [];
+	earlier;
+	inFlight;
+	backend;
+	stackName;
+	region;
+	logger;
+	constructor(backend, stackName, region, logger) {
+		this.backend = backend;
+		this.stackName = stackName;
+		this.region = region;
+		this.logger = logger;
+	}
+	get size() {
+		return this.entries.length;
+	}
+	add(entry) {
+		this.entries.push(entry);
+		if (this.earlier === void 0) {
+			this.earlier = Promise.resolve().then(() => this.backend.loadRetainedRecord(this.stackName, this.region));
+			this.earlier.catch(() => void 0);
+		}
+	}
+	async flush() {
+		if (this.inFlight !== void 0) await this.inFlight;
+		if (this.entries.length === 0) return;
+		const kept = this.entries;
+		const earlier = this.earlier;
+		this.entries = [];
+		this.earlier = void 0;
+		const write = recordRetainedForReadoption(this.backend, this.stackName, this.region, kept, this.logger, earlier);
+		this.inFlight = write;
+		try {
+			await write;
+		} finally {
+			if (this.inFlight === write) this.inFlight = void 0;
+		}
+	}
+};
+
 //#endregion
 //#region src/deployment/deploy-engine/delete.ts
+const keptByEngine = /* @__PURE__ */ new WeakMap();
+async function flushKeptForReadoption(engine) {
+	await keptByEngine.get(engine)?.flush();
+}
 async function provisionDelete(logicalId, change, stateResources, stackName, template, counts, progress) {
 	const resourceType = change.resourceType;
 	const existingState = stateResources[logicalId];
@@ -38662,6 +39723,18 @@ async function provisionDelete(logicalId, change, stateResources, stackName, tem
 		this.logger.info(`Retaining ${logicalId} (${resourceType}) - DeletionPolicy: ${deletionPolicy}`);
 		delete stateResources[logicalId];
 		await noteRetainedResource(resourceType, logicalId);
+		if (keptForReadoption(currentResource)) {
+			let kept = keptByEngine.get(this);
+			if (kept === void 0) {
+				kept = new KeptForReadoption(this.stateBackend, stackName, this.stackRegion, this.logger);
+				keptByEngine.set(this, kept);
+			}
+			kept.add({
+				logicalId,
+				resourceType,
+				physicalId: currentResource.physicalId
+			});
+		}
 		return;
 	}
 	if (!(currentResource.resourceType === "AWS::CloudFormation::Stack" && currentResource.provisionedBy !== "cc-api") && !hasAddressablePhysicalId(currentResource)) {
@@ -39548,6 +40621,707 @@ function journaledOrphanPolicy(policy) {
 	return policy === "Delete" || policy === "Retain" || policy === "Snapshot" || policy === "RetainExceptOnCreate" ? policy : "Retain";
 }
 
+//#endregion
+//#region src/provisioning/name-lookup.ts
+const inFlight = /* @__PURE__ */ new Map();
+const waiting = /* @__PURE__ */ new Map();
+async function withApiLimit(api, max, fn) {
+	if ((inFlight.get(api) ?? 0) >= max) await new Promise((resolve) => {
+		const queue = waiting.get(api) ?? [];
+		queue.push(resolve);
+		waiting.set(api, queue);
+	});
+	else inFlight.set(api, (inFlight.get(api) ?? 0) + 1);
+	try {
+		return await fn();
+	} finally {
+		const next = waiting.get(api)?.shift();
+		if (next) next();
+		else inFlight.set(api, (inFlight.get(api) ?? 1) - 1);
+	}
+}
+function chunks(items, size) {
+	const out = [];
+	for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size));
+	return out;
+}
+async function lookupEachName(names, api, concurrency, lookupOne) {
+	const found = /* @__PURE__ */ new Map();
+	await Promise.all(names.map((name) => withApiLimit(api, concurrency, async () => {
+		const holder = await lookupOne(name);
+		if (holder !== void 0) found.set(name, holder);
+	})));
+	return found;
+}
+function isAccessDeniedError(error) {
+	const name = error?.name;
+	const status = error?.$metadata?.httpStatusCode;
+	return name === "AccessDenied" || name === "AccessDeniedException" || name === "AuthorizationError" || name === "UnauthorizedOperation" || status === 403;
+}
+
+//#endregion
+//#region src/deployment/generated-name-guard.ts
+const GROUP_WINDOW_MS = 15;
+const DEFAULT_TIMING = {
+	now: () => Date.now(),
+	sleep: (ms) => new Promise((resolve) => {
+		setTimeout(resolve, ms).unref?.();
+	}),
+	cooldownMs: 65e3,
+	cooldownStepMs: 1e4
+};
+const STILL_LISTED_WHILE_DELETING = /* @__PURE__ */ new Set(["AWS::SQS::Queue", "AWS::S3::Bucket"]);
+const PER_NAME_CONCURRENCY = { "AWS::SNS::Topic": 4 };
+const DEFAULT_PER_NAME_CONCURRENCY = 10;
+const KEPT_AT_SKEW_MS = 6e4;
+function provenNothingCreated(error, logicalId, resourceType) {
+	if (createdBeforeFailure(error, logicalId, resourceType) !== void 0) return false;
+	if (isAmbiguousOutcomeError(error) || isThrottlingError(error)) return false;
+	let current = error;
+	for (let depth = 0; depth < 8 && current !== null && typeof current === "object"; depth++) {
+		const status = current.$metadata?.httpStatusCode;
+		if (typeof status === "number") return status >= 400 && status < 500 && status !== 408 && status !== 429;
+		current = current.cause;
+	}
+	return false;
+}
+var GeneratedNameGuard = class GeneratedNameGuard {
+	verdicts = /* @__PURE__ */ new Map();
+	decidedAt = /* @__PURE__ */ new Map();
+	candidates = /* @__PURE__ */ new Map();
+	recorded = /* @__PURE__ */ new Set();
+	sent = /* @__PURE__ */ new Set();
+	returned = /* @__PURE__ */ new Set();
+	rejected = /* @__PURE__ */ new Set();
+	failedAt = /* @__PURE__ */ new Map();
+	firstVerdicts = /* @__PURE__ */ new Map();
+	plannedWrites;
+	plannedIds = /* @__PURE__ */ new Set();
+	groupPending = [];
+	groupNext;
+	groupInFlight = Promise.resolve();
+	queued = [];
+	flushing;
+	writes = /* @__PURE__ */ new Set();
+	evidenceRead;
+	abandonedRead;
+	historyRead;
+	recordedRead;
+	input;
+	timing;
+	constructor(input) {
+		this.input = input;
+		this.timing = {
+			...DEFAULT_TIMING,
+			...input.timing
+		};
+	}
+	static start(input) {
+		const candidates = [];
+		for (const change of input.changes) {
+			if (change.changeType !== "CREATE") continue;
+			const properties = change.desiredProperties ?? {};
+			let decision;
+			let name;
+			let deferred = false;
+			try {
+				decision = input.providerFor({
+					resourceType: change.resourceType,
+					properties
+				});
+				if (!replacementCreateAdoptsName(change.resourceType, decision.provisionedBy)) continue;
+				name = decision.provider.generatedCreateName?.(change.resourceType, change.logicalId, properties);
+				deferred = decision.provider.lookupNeedsResolvedProperties?.(change.resourceType, properties) === true;
+			} catch {
+				continue;
+			}
+			if (typeof name !== "string" || name === "") continue;
+			candidates.push({
+				logicalId: change.logicalId,
+				resourceType: change.resourceType,
+				name,
+				property: explicitNamePropertyFor(change.resourceType),
+				provider: decision.provider,
+				properties,
+				deferred
+			});
+		}
+		if (candidates.length === 0) return void 0;
+		const guard = new GeneratedNameGuard(input);
+		for (const c of candidates) guard.candidates.set(c.logicalId, c);
+		guard.ask(candidates.filter((c) => !c.deferred));
+		return guard;
+	}
+	ask(candidates) {
+		const { verdicts, first } = this.resolve(candidates);
+		for (const [logicalId, verdict] of verdicts) this.verdicts.set(logicalId, verdict);
+		for (const [logicalId, verdict] of first) this.firstVerdicts.set(logicalId, verdict);
+	}
+	resolve(candidates) {
+		const out = /* @__PURE__ */ new Map();
+		const first = /* @__PURE__ */ new Map();
+		const byType = /* @__PURE__ */ new Map();
+		for (const c of candidates) byType.set(c.resourceType, [...byType.get(c.resourceType) ?? [], c]);
+		for (const group of byType.values()) {
+			const decided = this.run(group).catch((error) => ({
+				verdicts: new Map(group.map((c) => [c.logicalId, {
+					kind: "failed",
+					error
+				}])),
+				deleting: []
+			}));
+			let waited;
+			for (const c of group) {
+				first.set(c.logicalId, decided.then(({ verdicts }) => verdicts.get(c.logicalId) ?? { kind: "free" }));
+				out.set(c.logicalId, decided.then(async ({ verdicts, deleting }) => {
+					let verdict = verdicts.get(c.logicalId) ?? { kind: "free" };
+					if (deleting.includes(c)) {
+						waited ??= this.waitOutDeletion(deleting);
+						verdict = (await waited).get(c.logicalId) ?? verdict;
+					}
+					this.decidedAt.set(c.logicalId, this.timing.now());
+					return verdict;
+				}));
+			}
+		}
+		return {
+			verdicts: out,
+			first
+		};
+	}
+	noteApprovalPrompted() {
+		const stale = [...this.decidedAt.keys()].map((id) => this.candidates.get(id)).filter((c) => !c.deferred && !this.sent.has(c.logicalId));
+		if (stale.length === 0) return;
+		const previous = new Map(stale.map((c) => [c.logicalId, this.verdicts.get(c.logicalId)]));
+		const { verdicts, first } = this.resolve(stale);
+		const keepEarlier = (id, fresh, warn) => fresh.then(async (v) => {
+			if (v.kind !== "failed" && v.kind !== "unchecked") return v;
+			const earlier = await previous.get(id);
+			if (earlier.kind !== "free" && earlier.kind !== "licensed") return v;
+			if (warn) this.input.warn?.(`${displaySafe(id)}: could not re-read whether a resource holds its generated name after the approval prompt; acting on the earlier lookup.`);
+			return earlier;
+		});
+		for (const [id, fresh] of verdicts) this.verdicts.set(id, keepEarlier(id, fresh, true));
+		for (const [id, fresh] of first) this.firstVerdicts.set(id, keepEarlier(id, fresh, false));
+	}
+	recordPlannedIntents() {
+		if (this.plannedWrites !== void 0) return;
+		this.plannedWrites = /* @__PURE__ */ new Map();
+		const byType = /* @__PURE__ */ new Map();
+		for (const c of this.candidates.values()) {
+			if (c.deferred) continue;
+			byType.set(c.resourceType, [...byType.get(c.resourceType) ?? [], c]);
+		}
+		let typesWaiting = byType.size;
+		let allArrived;
+		const arrived = new Promise((resolve) => allArrived = resolve);
+		const window = new Promise((resolve) => {
+			setTimeout(resolve, GROUP_WINDOW_MS).unref?.();
+		});
+		this.groupInFlight = Promise.race([arrived, window]);
+		const arrive = () => {
+			typesWaiting--;
+			if (typesWaiting === 0) allArrived();
+		};
+		for (const [resourceType, group] of byType) {
+			const write = (async () => {
+				let verdicts;
+				try {
+					verdicts = await Promise.all(group.map((c) => this.firstVerdicts.get(c.logicalId) ?? this.verdicts.get(c.logicalId)));
+				} finally {
+					arrive();
+				}
+				const batch = group.filter((_c, i) => verdicts[i].kind === "free" || verdicts[i].kind === "licensed");
+				if (batch.length === 0) return;
+				for (const c of batch) this.plannedIds.add(c.logicalId);
+				await this.commitPlanned(batch);
+			})();
+			this.plannedWrites.set(resourceType, write);
+			this.writes.add(write);
+			write.catch(() => void 0);
+		}
+	}
+	get size() {
+		return this.candidates.size;
+	}
+	verdict(logicalId) {
+		return this.verdicts.get(logicalId);
+	}
+	candidate(logicalId) {
+		const c = this.candidates.get(logicalId);
+		return c === void 0 ? void 0 : {
+			name: c.name,
+			property: c.property
+		};
+	}
+	async admit(logicalId, resolvedProperties) {
+		const c = this.candidates.get(logicalId);
+		if (c === void 0) return void 0;
+		if (c.deferred && !this.verdicts.has(logicalId)) this.ask([{
+			...c,
+			properties: resolvedProperties,
+			deferred: false
+		}]);
+		const verdict = await this.verdicts.get(logicalId);
+		if (verdict.kind !== "free" && verdict.kind !== "licensed") return verdict;
+		try {
+			const planned = this.plannedWrites?.get(c.resourceType);
+			if (planned !== void 0) try {
+				await planned;
+			} catch (error) {
+				if (this.plannedIds.has(logicalId)) throw error;
+			}
+			await this.recordIntent(c);
+		} catch (error) {
+			return {
+				kind: "failed",
+				error
+			};
+		}
+		return verdict;
+	}
+	noteSent(logicalId) {
+		if (this.candidates.has(logicalId)) this.sent.add(logicalId);
+	}
+	noteReturned(logicalId) {
+		if (this.candidates.has(logicalId)) this.returned.add(logicalId);
+	}
+	noteFailed(logicalId, error) {
+		const c = this.candidates.get(logicalId);
+		if (c === void 0) return;
+		if (provenNothingCreated(error, logicalId, c.resourceType)) this.rejected.add(logicalId);
+		else if (!this.failedAt.has(logicalId)) this.failedAt.set(logicalId, this.timing.now());
+	}
+	async settle() {
+		await Promise.all([...this.writes].map((w) => w.catch(() => void 0)));
+		const drop = [...this.recorded].filter((id) => !this.sent.has(id) || this.returned.has(id) || this.rejected.has(id));
+		const failedAt = new Map([...this.failedAt].filter(([id]) => this.recorded.has(id) && !drop.includes(id)));
+		if (drop.length === 0 && failedAt.size === 0) return;
+		let lastError;
+		for (let attempt = 0; attempt < 2; attempt++) try {
+			await settleAdoptingCreates(drop, failedAt);
+			return;
+		} catch (error) {
+			lastError = error;
+		}
+		const bounded = await noteAbandonedRun(this.timing.now());
+		this.input.warn?.(safeMsg`Could not clear this deploy's unsent name-adopting creates from the stack's create-token ledger (${describeAwsFailure(lastError).summary}). ` + (bounded ? "They license only what existed by now; a later deploy may refuse a resource of those names, which `cdkd import` adopts." : "Nor could the ledger record when this deploy ended: a later deploy may take back a resource of those names that another deployment creates. They are cleared by the next successful deploy."));
+	}
+	async readoptedFromRetained() {
+		const out = [];
+		for (const [logicalId, verdict] of this.verdicts) {
+			if (!this.returned.has(logicalId)) continue;
+			const v = await verdict;
+			if (v.kind === "licensed" && (v.via === "retained" || v.via === "history")) out.push(logicalId);
+		}
+		return out;
+	}
+	recordIntent(c) {
+		if (this.recorded.has(c.logicalId)) return Promise.resolve();
+		this.queued.push(c);
+		if (this.flushing === void 0) {
+			const flush = new Promise((resolve) => setImmediate(resolve)).then(async () => {
+				const batch = this.queued;
+				this.queued = [];
+				if (this.flushing === flush) this.flushing = void 0;
+				await this.writeIntents(batch);
+			});
+			this.flushing = flush;
+			this.writes.add(flush);
+		}
+		return this.flushing;
+	}
+	commitPlanned(batch) {
+		this.groupPending.push(...batch);
+		if (this.groupNext === void 0) {
+			const next = this.groupInFlight.then(() => void 0, () => void 0).then(async () => {
+				const carried = this.groupPending;
+				this.groupPending = [];
+				this.groupNext = void 0;
+				await this.writeIntents(carried);
+			});
+			this.groupNext = next;
+			this.groupInFlight = next;
+		}
+		return this.groupNext;
+	}
+	async writeIntents(batch) {
+		await recordAdoptingCreates(batch.map((b) => ({
+			logicalId: b.logicalId,
+			resourceType: b.resourceType,
+			name: b.name
+		})));
+		for (const b of batch) this.recorded.add(b.logicalId);
+	}
+	recordedIntents() {
+		this.recordedRead ??= recordedAdoptingCreates();
+		return this.recordedRead;
+	}
+	async run(candidates) {
+		const input = this.input;
+		const out = /* @__PURE__ */ new Map();
+		const recorded = this.recordedIntents().then((r) => ({
+			ok: true,
+			value: r
+		}), (error) => ({
+			ok: false,
+			error
+		}));
+		const { found, typeFailures } = await lookupAll(input, candidates);
+		let evidence;
+		if (found.size > 0) {
+			this.evidenceRead ??= loadEvidence(input);
+			evidence = await this.evidenceRead.catch((error) => ({ error }));
+		}
+		const recordedResult = await recorded;
+		const unlicensed = [];
+		for (const c of candidates) {
+			const failure = typeFailures.get(c.resourceType);
+			if (failure !== void 0) {
+				out.set(c.logicalId, isAccessDeniedError(failure) ? {
+					kind: "unchecked",
+					error: failure
+				} : {
+					kind: "failed",
+					error: failure
+				});
+				continue;
+			}
+			const holder = found.get(c.logicalId);
+			if (holder === void 0) {
+				out.set(c.logicalId, { kind: "free" });
+				continue;
+			}
+			if (!recordedResult.ok) {
+				out.set(c.logicalId, {
+					kind: "failed",
+					error: recordedResult.error
+				});
+				continue;
+			}
+			const intent = recordedResult.value?.get(c.logicalId);
+			let ownIntent;
+			if (intent !== void 0 && intent.resourceType === c.resourceType && intent.name === c.name) {
+				const abandonedAt = await this.abandonedRunAt();
+				const byIntent = await this.licenseIfCreatedAfterIntent(c, holder, intent, abandonedAt !== void 0 && intent.firstSentAt <= abandonedAt ? abandonedAt : void 0);
+				if (byIntent.kind !== "held") {
+					out.set(c.logicalId, byIntent);
+					continue;
+				}
+				ownIntent = byIntent.ownIntent;
+			}
+			if (evidence === void 0 || "error" in evidence) {
+				out.set(c.logicalId, {
+					kind: "failed",
+					error: evidence !== void 0 && "error" in evidence ? evidence.error : /* @__PURE__ */ new Error("no evidence")
+				});
+				continue;
+			}
+			const named = evidence.namedBy(c.resourceType, holder);
+			if (named !== void 0) {
+				out.set(c.logicalId, await this.licenseIfKeptBefore(c, holder, named));
+				if (out.get(c.logicalId).kind === "held") unlicensed.push(c);
+				continue;
+			}
+			out.set(c.logicalId, {
+				kind: "held",
+				holder,
+				...ownIntent && { ownIntent }
+			});
+			unlicensed.push(c);
+		}
+		if (unlicensed.length > 0 && input.loadKeptInHistory !== void 0 && evidence !== void 0 && !("error" in evidence) && evidence.retainedAbsent) {
+			let kept;
+			try {
+				this.historyRead ??= input.loadKeptInHistory();
+				kept = await this.historyRead;
+			} catch {
+				kept = [];
+			}
+			for (const c of [...unlicensed]) {
+				const holder = found.get(c.logicalId);
+				const match = kept.find((k) => k.logicalId === c.logicalId && k.resourceType === c.resourceType && probeFoundSameId(c.resourceType, k.physicalId, holder));
+				if (match === void 0) continue;
+				const verdict = await this.licenseIfKeptBefore(c, holder, {
+					via: "history",
+					...match.keptAt !== void 0 && { keptAt: match.keptAt }
+				});
+				out.set(c.logicalId, verdict);
+				if (verdict.kind !== "held") unlicensed.splice(unlicensed.indexOf(c), 1);
+			}
+		}
+		return {
+			verdicts: out,
+			deleting: unlicensed.filter((c) => STILL_LISTED_WHILE_DELETING.has(c.resourceType))
+		};
+	}
+	async licenseIfKeptBefore(c, holder, named) {
+		const licensed = {
+			kind: "licensed",
+			holder,
+			via: named.via
+		};
+		if (named.via !== "retained" && named.via !== "history" || named.keptAt === void 0) return licensed;
+		if (c.provider.holderCreatedAt === void 0) return licensed;
+		let createdAt;
+		try {
+			createdAt = await withSkipPrefix(true, () => c.provider.holderCreatedAt(c.resourceType, holder));
+		} catch (error) {
+			if (!isAccessDeniedError(error)) return {
+				kind: "failed",
+				error
+			};
+			this.creationTimeDenied(c, holder, error);
+			return licensed;
+		}
+		if (createdAt === void 0 || createdAt <= named.keptAt + KEPT_AT_SKEW_MS) return licensed;
+		return {
+			kind: "held",
+			holder
+		};
+	}
+	async licenseIfCreatedAfterIntent(c, holder, intent, abandonedAt) {
+		const licensed = {
+			kind: "licensed",
+			holder,
+			via: "ledger"
+		};
+		const held = {
+			kind: "held",
+			holder
+		};
+		const byName = abandonedAt !== void 0 ? {
+			kind: "held",
+			holder,
+			ownIntent: "abandoned"
+		} : intent.failedAt !== void 0 ? {
+			kind: "held",
+			holder,
+			ownIntent: "failed"
+		} : licensed;
+		if (c.provider.holderCreatedAt === void 0) return byName;
+		let createdAt;
+		try {
+			createdAt = await withSkipPrefix(true, () => c.provider.holderCreatedAt(c.resourceType, holder));
+		} catch (error) {
+			if (!isAccessDeniedError(error)) return {
+				kind: "failed",
+				error
+			};
+			this.creationTimeDenied(c, holder, error);
+			return byName;
+		}
+		if (createdAt === void 0) return byName;
+		const { firstSentAt, failedAt } = intent;
+		if (Number.isFinite(firstSentAt) && createdAt < firstSentAt - KEPT_AT_SKEW_MS) return held;
+		for (const until of [abandonedAt, failedAt]) if (until !== void 0 && createdAt > until + KEPT_AT_SKEW_MS) return held;
+		return licensed;
+	}
+	creationTimeDenied(c, holder, error) {
+		this.input.warn?.(safeMsg`${c.logicalId}: could not read when ${holder} was created (${describeAwsFailure(error).summary}); ` + "deciding by its name alone, as for a type that reports no creation time. Grant the type's Describe permission to narrow that.");
+	}
+	async abandonedRunAt() {
+		this.abandonedRead ??= ledgerAbandonedAt().catch(() => void 0).then((fromLedger) => {
+			const at = [fromLedger, this.input.abandonedRunAt].filter((v) => typeof v === "number" && Number.isFinite(v));
+			return at.length > 0 ? Math.max(...at) : void 0;
+		});
+		return this.abandonedRead;
+	}
+	async waitOutDeletion(candidates) {
+		const out = /* @__PURE__ */ new Map();
+		let pending = [...candidates];
+		const until = this.timing.now() + this.timing.cooldownMs;
+		const watch = startInterruptWatch("generated-name deletion cooldown");
+		try {
+			while (pending.length > 0 && this.timing.now() < until) {
+				await this.sleepUnlessInterrupted(this.timing.cooldownStepMs, watch);
+				if (watch.isInterrupted()) {
+					for (const c of pending) out.set(c.logicalId, {
+						kind: "failed",
+						error: watch.onInterrupted()
+					});
+					return out;
+				}
+				const { found, typeFailures } = await lookupAll(this.input, pending);
+				pending = pending.filter((c) => {
+					if (typeFailures.has(c.resourceType)) return true;
+					if (found.has(c.logicalId)) return true;
+					out.set(c.logicalId, { kind: "free" });
+					return false;
+				});
+			}
+			return out;
+		} finally {
+			watch.dispose();
+		}
+	}
+	sleepUnlessInterrupted(ms, watch) {
+		if (watch.isInterrupted()) return Promise.resolve();
+		let timer;
+		const interrupted = new Promise((resolve) => {
+			timer = setInterval(() => {
+				if (watch.isInterrupted()) resolve();
+			}, 200);
+			timer.unref?.();
+		});
+		return Promise.race([this.timing.sleep(ms), interrupted]).finally(() => clearInterval(timer));
+	}
+};
+function isPermanentRedirect(error) {
+	const e = error;
+	return e?.name === "PermanentRedirect" || e?.$metadata?.httpStatusCode === 301 || e?.$response?.statusCode === 301;
+}
+async function lookupAll(input, candidates) {
+	const byType = /* @__PURE__ */ new Map();
+	for (const c of candidates) byType.set(c.resourceType, [...byType.get(c.resourceType) ?? [], c]);
+	const found = /* @__PURE__ */ new Map();
+	const typeFailures = /* @__PURE__ */ new Map();
+	await Promise.all([...byType].map(async ([resourceType, group]) => {
+		try {
+			const holders = await lookupType(input, resourceType, group);
+			for (const c of group) {
+				const holder = holders.get(c.name);
+				if (holder !== void 0) found.set(c.logicalId, holder);
+			}
+		} catch (error) {
+			typeFailures.set(resourceType, error);
+		}
+	}));
+	return {
+		found,
+		typeFailures
+	};
+}
+async function loadEvidence(input) {
+	const [journal, retained] = await Promise.all([input.loadJournal(), input.loadRetained()]);
+	const sources = [];
+	for (const record of Object.values(input.records)) if (typeof record?.physicalId === "string") sources.push({
+		via: "record",
+		type: record.resourceType,
+		id: record.physicalId
+	});
+	for (const orphan of input.orphans ?? []) {
+		const s = orphan.state;
+		if (typeof s?.physicalId === "string") sources.push({
+			via: "orphan",
+			type: s.resourceType,
+			id: s.physicalId
+		});
+	}
+	for (const segment of journal?.segments ?? []) for (const op of [...segment.operations ?? [], ...segment.failedOperations ?? []]) if (typeof op.physicalId === "string" && op.physicalId !== "") sources.push({
+		via: "journal",
+		type: op.resourceType,
+		id: op.physicalId
+	});
+	for (const r of retained ?? []) sources.push({
+		via: "retained",
+		type: r.resourceType,
+		id: r.physicalId,
+		...r.keptAt !== void 0 && { keptAt: r.keptAt }
+	});
+	return {
+		retainedAbsent: retained === null,
+		namedBy: (resourceType, holder) => {
+			const hit = sources.find((s) => s.type === resourceType && probeFoundSameId(resourceType, s.id, holder));
+			return hit === void 0 ? void 0 : {
+				via: hit.via,
+				...hit.keptAt !== void 0 && { keptAt: hit.keptAt }
+			};
+		}
+	};
+}
+async function lookupType(input, resourceType, group) {
+	const provider = group[0].provider;
+	const names = group.map((c) => c.name);
+	return withSkipPrefix(true, async () => {
+		if (provider.lookupNames !== void 0) return provider.lookupNames(resourceType, names, {
+			region: input.region,
+			stackName: input.stackName,
+			propertiesByName: new Map(group.map((c) => [c.name, c.properties]))
+		});
+		const lookup = provider.import?.bind(provider);
+		if (lookup === void 0) return /* @__PURE__ */ new Map();
+		const byName = new Map(group.map((c) => [c.name, c]));
+		const account = ["AWS::SNS::Topic", "AWS::StepFunctions::StateMachine"].includes(resourceType) ? await input.accountInfo() : void 0;
+		const concurrency = PER_NAME_CONCURRENCY[resourceType] ?? DEFAULT_PER_NAME_CONCURRENCY;
+		return lookupEachName(names, `${resourceType}:import`, concurrency, async (name) => {
+			const c = byName.get(name);
+			const arn = account !== void 0 ? createLookupArn(resourceType, name, account) : void 0;
+			if (arn !== void 0 && "unbuildable" in arn) throw new Error(`cannot build the ARN ${resourceType} name ${name} would take`);
+			let found;
+			try {
+				found = await lookup({
+					logicalId: c.logicalId,
+					resourceType,
+					stackName: input.stackName,
+					region: input.region,
+					properties: c.property === void 0 ? c.properties : {
+						...c.properties,
+						[c.property]: name
+					},
+					...arn !== void 0 && { knownPhysicalId: arn.arn }
+				});
+			} catch (error) {
+				if (resourceType === "AWS::S3::Bucket" && isPermanentRedirect(error)) return name;
+				throw error;
+			}
+			return found?.physicalId;
+		});
+	});
+}
+
+//#endregion
+//#region src/deployment/kept-in-history.ts
+function keptInEarlierRecords(records) {
+	const out = [];
+	for (const record of records) for (const [logicalId, raw] of Object.entries(record.resources)) {
+		if (raw === null || typeof raw !== "object") continue;
+		const r = raw;
+		if (typeof r.resourceType !== "string" || typeof r.physicalId !== "string") continue;
+		if (r.physicalId === "") continue;
+		if (!shouldRetainResource(r.deletionPolicy)) continue;
+		out.push({
+			logicalId,
+			resourceType: r.resourceType,
+			physicalId: r.physicalId,
+			...record.writtenAt !== void 0 && { keptAt: record.writtenAt }
+		});
+	}
+	return out;
+}
+function keptInEventHistory(runs, stackName) {
+	const made = /* @__PURE__ */ new Map();
+	const out = [];
+	for (const events of runs) for (const e of events) {
+		if (e.stackName !== stackName || typeof e.logicalId !== "string") continue;
+		if (typeof e.resourceType !== "string") continue;
+		if (e.eventType === "RESOURCE_SUCCEEDED" && (e.operation === "CREATE" || e.operation === "UPDATE") && typeof e.physicalId === "string" && e.physicalId !== "") made.set(e.logicalId, {
+			resourceType: e.resourceType,
+			physicalId: e.physicalId
+		});
+		else if (e.eventType === "RESOURCE_RETAINED") {
+			const m = made.get(e.logicalId);
+			if (m !== void 0 && m.resourceType === e.resourceType) {
+				const keptAt = Date.parse(e.timestamp);
+				out.push({
+					logicalId: e.logicalId,
+					...m,
+					...Number.isFinite(keptAt) && { keptAt }
+				});
+			}
+		}
+	}
+	return out;
+}
+async function loadKeptInHistory(sources, stackName, region) {
+	const runsOf = stackName.split("~")[0];
+	const [records, runs] = await Promise.all([sources.earlierStateResources(stackName, region).catch(() => []), (async () => {
+		const listed = (await sources.listRuns(runsOf, region)).slice(0, 20);
+		return (await Promise.all(listed.map((r) => sources.readRunEvents(runsOf, region, r.runId).catch(() => null)))).filter((e) => e !== null).reverse();
+	})().catch(() => [])]);
+	return [...keptInEarlierRecords(records), ...keptInEventHistory(runs, stackName)];
+}
+
 //#endregion
 //#region src/provisioning/canonicalize-properties.ts
 function makeCanonicalizePropertiesFn(registry) {
@@ -40108,6 +41882,9 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		process.removeListener("SIGINT", sigintHandler);
 		throw error;
 	}
+	let firstDeployStateGate;
+	let firstDeploy = false;
+	let failed = false;
 	try {
 		renderer.start();
 		const currentStateData = await this.stateBackend.getState(stackName, this.stackRegion);
@@ -40131,7 +41908,14 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		refuseMalformedOrphanRecords(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
 		const migrationPending = currentStateData?.migrationPending ?? false;
 		this.logger.debug(`Loaded current state: ${Object.keys(currentState.resources).length} resources`);
-		if (this.options.onCurrentStateLoaded) await this.options.onCurrentStateLoaded(stackName, currentStateData?.state);
+		if (this.options.onCurrentStateLoaded) {
+			const gate = this.options.onCurrentStateLoaded(stackName, currentStateData?.state);
+			if (currentStateData === null || currentStateData === void 0) {
+				firstDeployStateGate = gate;
+				firstDeploy = true;
+				gate.catch(() => void 0);
+			} else await gate;
+		}
 		try {
 			const loaded = await this.stateBackend.loadRollbackJournal(stackName, this.stackRegion);
 			const journal = loaded && {
@@ -40262,6 +42046,11 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			conditions,
 			forceStatefulRecreation: this.options.forceStatefulRecreation === true
 		});
+		if (firstDeployStateGate !== void 0) {
+			const gate = firstDeployStateGate;
+			firstDeployStateGate = void 0;
+			await gate;
+		}
 		if (!this.diffCalculator.hasChanges(changes)) {
 			this.logger.info("No changes detected. Stack is up to date.");
 			let persistedOutputs = currentState.outputs ?? {};
@@ -40369,7 +42158,34 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			const readers = [...changes.values()].filter(isNoEchoPromotionOnly).length;
 			this.logger.info(safeMsg`No changes detected in the template. Comparing ${String(readers)} resource(s) that read a NoEcho parameter with AWS.`);
 		}
-		await requireDeploymentApproval({
+		const abandonedRunAt = this.lockManager.abandonedRunEndedBy?.(stackName, this.stackRegion);
+		if (abandonedRunAt !== void 0) await noteAbandonedRun(abandonedRunAt);
+		this.generatedNameGuard = GeneratedNameGuard.start({
+			stackName,
+			region: this.stackRegion,
+			changes: changes.values(),
+			providerFor: (input) => this.providerRegistry.getProviderFor({
+				...input,
+				quiet: true
+			}),
+			records: currentState.resources,
+			orphans: currentState.orphans,
+			loadJournal: () => this.stateBackend.loadRollbackJournal(stackName, this.stackRegion),
+			loadRetained: () => this.stateBackend.loadRetainedRecord(stackName, this.stackRegion),
+			loadKeptInHistory: () => {
+				const reader = new DeploymentEventsReader(this.stateBackend);
+				return loadKeptInHistory({
+					earlierStateResources: (s, r) => this.stateBackend.earlierStateResources(s, r),
+					listRuns: (s, r) => reader.listRuns(s, r),
+					readRunEvents: (s, r, id) => reader.readRunEvents(s, r, id)
+				}, stackName, this.stackRegion);
+			},
+			accountInfo: () => getAccountInfo(this.stackRegion),
+			warn: (message) => this.logger.warn(message),
+			...abandonedRunAt !== void 0 && { abandonedRunAt }
+		});
+		if (this.generatedNameGuard !== void 0) this.logger.debug(safeMsg`Generated-name check: looking up ${String(this.generatedNameGuard.size)} planned create(s)`);
+		await checkDestructivePlan({
 			options: this.options,
 			stackName,
 			changes: changes.values(),
@@ -40377,6 +42193,15 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			template: effectiveTemplate,
 			recreateTargetIds: recreateTargetIdsFor(this.options.recreateTargets, stackName)
 		});
+		if (await requireDeploymentApproval({
+			options: this.options,
+			stackName,
+			changes: changes.values(),
+			records: currentState.resources,
+			template: effectiveTemplate,
+			recreateTargetIds: recreateTargetIdsFor(this.options.recreateTargets, stackName)
+		})) this.generatedNameGuard?.noteApprovalPrompted();
+		this.generatedNameGuard?.recordPlannedIntents();
 		this.resolver.resetPhysicalIdFallbackCount();
 		const progress = {
 			current: 0,
@@ -40384,16 +42209,29 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		};
 		const { state: newState, actualCounts, completedOperations } = await withProducerRegions(() => this.producerRegionEvidence(currentState), () => this.executeDeployment(effectiveTemplate, currentState, changes, dag, executionLevels, stackName, outputsDigestSource, parameterValues, conditions, currentEtag, progress, migrationPending));
 		await this.drainObservedCaptures(newState.resources);
-		const newEtag = await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(conditionVerdicts ? {
+		const [newEtag] = await Promise.all([this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(conditionVerdicts ? {
 			...newState,
 			conditionVerdicts
-		} : newState));
+		} : newState)), flushKeptForReadoption(this)]);
 		this.logger.debug(`State saved (ETag: ${newEtag})`);
-		await forgetRecordedCreateTokens(Object.keys(newState.resources));
-		const [journaledOrphansLeft] = await Promise.all([this.settleJournalAfterSuccess(stackName, completedOperations, currentState, newState.resources, currentEtag === void 0), this.exportIndexStore ? this.exportIndexStore.updateForStack(stackName, this.stackRegion, importableOutputs({
-			...newState,
-			outputs: this.redactOutputs(newState.outputs)
-		})) : Promise.resolve()]);
+		const ledgerAndKeptCleanup = (async () => {
+			await forgetRecordedCreateTokens(Object.keys(newState.resources));
+			const readopted = await this.generatedNameGuard?.readoptedFromRetained() ?? [];
+			if (readopted.length > 0) try {
+				const kept = await this.stateBackend.loadRetainedResources(stackName, this.stackRegion);
+				await this.stateBackend.saveRetainedResources(stackName, this.stackRegion, kept.filter((entry) => !readopted.includes(entry.logicalId)));
+			} catch (error) {
+				this.logger.debug(safeMsg`Could not clear re-adopted resources from the kept-resource record: ${describeAwsFailure(error).summary}`);
+			}
+		})();
+		const [journaledOrphansLeft] = await Promise.all([
+			this.settleJournalAfterSuccess(stackName, completedOperations, currentState, newState.resources, currentEtag === void 0),
+			this.exportIndexStore ? this.exportIndexStore.updateForStack(stackName, this.stackRegion, importableOutputs({
+				...newState,
+				outputs: this.redactOutputs(newState.outputs)
+			})) : Promise.resolve(),
+			ledgerAndKeptCleanup
+		]);
 		const durationMs = Date.now() - startTime;
 		const unchangedCount = this.diffCalculator.filterByType(changes, "NO_CHANGE").length + actualCounts.skipped;
 		return {
@@ -40404,17 +42242,33 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			deleteSkipped: actualCounts.deleteSkipped + journaledOrphansLeft,
 			updatePartial: actualCounts.updatePartial,
 			nestedUpdatePartial: actualCounts.nestedUpdatePartial,
+			...(actualCounts.crossPrefixKept ?? 0) > 0 && { crossPrefixKept: actualCounts.crossPrefixKept },
 			unchanged: unchangedCount,
 			durationMs,
 			outputs: this.buildDisplayOutputs(template, this.redactOutputs(newState.outputs ?? {})),
 			attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
 		};
+	} catch (error) {
+		failed = true;
+		if (firstDeployStateGate !== void 0) await firstDeployStateGate;
+		throw error;
 	} finally {
 		try {
 			renderer.stop();
 		} catch {}
 		process.removeListener("SIGINT", sigintHandler);
 		this.observedCaptureTasks.clear();
+		try {
+			await flushKeptForReadoption(this);
+			await this.generatedNameGuard?.settle();
+		} catch {}
+		if (firstDeploy && failed && this.options.onFirstDeployLeftNoRecord && !this.options.dryRun) try {
+			const left = await this.stateBackend.getState(stackName, this.stackRegion);
+			const journal = left === null ? await this.stateBackend.loadRollbackJournal(stackName, this.stackRegion) : void 0;
+			if (left === null && !journalCanOwnResources(journal ?? null)) await this.options.onFirstDeployLeftNoRecord(stackName);
+		} catch (error) {
+			this.logger.debug(safeMsg`Could not check whether the failed first deploy left a record: ${describeAwsFailure(error).summary}`);
+		}
 		try {
 			await this.lockManager.releaseLock(stackName, this.stackRegion);
 			this.logger.debug("Lock released");
@@ -40668,6 +42522,7 @@ var DeployEngine = class {
 	constructPathTemplate;
 	outputsSourceUsable = true;
 	attemptedResolvedProps = /* @__PURE__ */ new Map();
+	generatedNameGuard;
 	liveTaskLabels = /* @__PURE__ */ new Map();
 	retainedOldOnReplacement = /* @__PURE__ */ new Set();
 	recreatedUnderSameId = /* @__PURE__ */ new Set();
@@ -40725,6 +42580,7 @@ var DeployEngine = class {
 		this.fingerprintChildTemplates = void 0;
 		this.perResourceInputFingerprints = /* @__PURE__ */ new Map();
 		this.attemptedResolvedProps = /* @__PURE__ */ new Map();
+		this.generatedNameGuard = void 0;
 		this.liveTaskLabels = /* @__PURE__ */ new Map();
 		this.outputSecrets = /* @__PURE__ */ new Map();
 		this.outputsPassSecretMaps = [];
@@ -40955,5 +42811,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { gray as $, prefetchCreateOnlyPropertyPaths as $a, refuseMalformedOutputs as $i, tagPlanWarning as $n, wholeStringLeavesOf as $o, getAccountInfo as $r, partitionSensitiveEnv as $s, redactedDeleteAddressSkip as $t, perType as A, NO_CC_HANDLERS_REASON as Aa, decodeListingKey as Ac, malformedLocalResourceEntriesWarning as Ai, buildFinalSnapshotIdentifier as An, shareLogOnlyValues as Ao, poisonRenderedSpellingsCollidingIn as Ar, rewriteTemplateAssetReferences as As, awaitInFlightSibling as At, INDEX_SETTLE_POLL_INTERVAL_MS as B, isWarmThroughputDecrease as Ba, hasPlainPrototype$1 as Bc, malformedResourceEntriesWarning as Bi, formatDestructiveChange as Bn, isUncertifiedBaselineMaskPosition as Bo, AWS_CREDENTIAL_ENV_KEYS as Br, validateContainerRepoName as Bs, planRollback as Bt, noEchoComparisonForTemplate as C, unreadableOrphanRecords as Ca, ssmResolvedValueType as Cc, hasReadableResources as Ci, maskEventTextWithBoundBags as Cn, createUnionSecretMasker as Co, isTerminationProtectionPropagationError as Cr, AssetPublisher as Cs, isHandledOrphan as Ct, recordedProtectionNote as D, findSilentDropProperties as Da, findLargeInlineResources as Dc, malformedExportNamesWarning as Di, extractDeploymentEventError as Dn, printingCorpusOf as Do, DiffCalculator as Dr, buildAssetRedirectMap as Ds, sameJournaledOrphans as Dt, recordedProtectionEvidence as E, findActionableSilentDrops as Ea, MIGRATE_TMP_PREFIX as Ec, malformedDriftResourcePropertiesWarning as Ei, stateSecretNameNeedles as En, logOnlyValueCount as Eo, reEnableInstanceApiTermination as Er, WorkGraph as Es, makeForeignHolderScan as Et, compensateRemovedDeletionProtection as F, isStatefulRecreateTargetForReplace as Fa, AssemblyReader as Fc, malformedOrphansRefusalMessage as Fi, refusesFinalSnapshot as Fn, markSameGenerationBag as Fo, assertFlagRoleArn as Fr, getBootstrapMarkerKey as Fs, recordAfterRollbackUpdate as Ft, hasCdkAutoDeleteTag as G, configBooleanRefusal as Ga, displayAssemblyPath as Gc, previewableOrphanRecords as Gi, withCreateTokenLedger as Gn, recoverMaskedOutput as Go, s3BucketArn as Gr, describeDockerExecFailure as Gs, seedsDeleteFirstGuard as Gt, waitForIndexesSettled as H, toFiniteNumber as Ha, ownValue as Hc, malformedResourcesWarning as Hi, earliestDefined as Hn, identityKeyFor as Ho, callerEnvCredentials as Hr, buildDockerImage as Hs, recordUnderIdIsNotOwn as Ht, deleteBudgetKey as I, isStatefulRecreateTargetSync as Ia, StageLoadError as Ic, malformedOrphansWarning as Ii, unsupportedFinalSnapshotError as In, redactSecretsForState as Io, assertSendableRoleArn as Ir, isCrossRegionRedirect as Is, demoteSupersededOrphans as It, markRefusedBeforeApplying as J, readConfigString as Ja, clearBucketRegionCache as Jc, refuseMalformedOrphanRecords as Ji, DBPROXY_TAG_OPTIONS as Jn, recordMaskOnlyValue as Jo, s3BucketRegionalDomainName as Jr, finchSecretArgvRefusal as Js, getCurrentProducerRegions as Jt, isTruthyCfnBoolean as K, configIntegerRefusal as Ka, renderAssemblyPathEscape as Kc, refuseDivergentRecordRegionForDestroy as Ki, acquireIdempotencyToken as Kn, carriesSecretMask as Ko, s3BucketDomainName as Kr, describeDockerFailure as Ks, orphanDeleteNeedsIdentity as Kt, resolveDynamoDbDeleteBudgetClock as L, renderStatefulReason as La, processStackMessages as Lc, malformedOutputsRefusalMessage as Li, maskingRetryLogger as Ln, scrubResourceRecord as Lo, explicitRoleArnOrThrow as Lr, parseBootstrapMarker as Ls, isJournaledOrphan as Lt, DynamoDBGlobalTableProvider as M, findReplacedReadersOfRecreateTargets as Ma, PARTITION_TABLE as Mc, malformedOrphanRecordsRefusalMessage as Mi, createPreDeleteFinalSnapshot as Mn, errorCauseChain as Mo, producerRegionsFromState as Mr, BOOTSTRAP_MARKER_PREFIX as Ms, getStackRecords as Mt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as N, shownType as Na, canonicalizeRegion as Nc, malformedOrphanRecordsWarning as Ni, effectiveDeletionPolicy as Nn, maskSecretsInError as No, regionLessSecretName as Nr, assertAssetBucketRegion as Ns, withStackRecords as Nt, PROTECTION_PROPERTY_BY_TYPE as O, unwrittenCreateOnlyReplacement as Oa, uploadCfnTemplate as Oc, malformedExportSourceWarning as Oi, ATOMIC_FINAL_SNAPSHOT_TYPES as On, recordLogOnlyParameterValue as Oo, INTRINSIC_KEYS as Or, createAssetRedirectResolver as Os, replayFailedOperations as Ot, beginDeleteWait as P, MULTI_REGION_RECREATE_BLOCKED_TYPES as Pa, derivePartitionAndUrlSuffix as Pc, malformedOrphanRowsKeptWarning as Pi, isFinalSnapshotError as Pn, maskSecretsInText as Po, applyRoleArnIfSet as Pr, ensureAssetStorage as Ps, removeProtectionTypeList as Pt, cyan as Q, requireConfigString as Qa, refuseMalformedOrphansForOrphan as Qi, tagMapAsList as Qn, recordProvenPublicExpression as Qo, parameterTypeMayLoseSecretIdentity as Qr, isMalformedEnvKey as Qs, redactedDeleteAddressFields as Qt, resolveDynamoDbDeleteBudgetMs as R, WARM_THROUGHPUT_MEMBERS as Ra, defineOwnKey as Rc, malformedOutputsWarning as Ri, constructPathOf as Rn, DYNAMIC_REFERENCE_TOKEN_SCAN as Ro, isIamRoleArn as Rr, readBootstrapMarkerBody as Rs, isReplacementOrphan as Rt, noEchoAttributeNamesOf as S, unpreviewableOrphanRecords as Sa, warnDeprecatedNoPrefixCliFlag as Sc, hasReadableOutputs as Si, journaledOrphanPrintingBag as Sn, carryLogOnlyValues as So, ec2InstanceProtectionSite as Sr, shouldRetainResource as Ss, dropFailedHint as St, noEchoParameterNamesOf as T, withheldAccountClause as Ta, CFN_TEMPLATE_URL_LIMIT as Tc, isReadableResourceEntry as Ti, secretNamePrintingBag as Tn, literalSplitDelimitersOf as To, reDisableInstanceApiTermination as Tr, stringifyValue as Ts, loadJournaledOrphans as Tt, ECR_AUTO_DELETE_IMAGES_TAG as U, coerceCfnBoolean as Ua, absoluteAssemblyPathEscape as Uc, malformedScrubResourceEntriesRefusalMessage as Ui, ledgerForStack as Un, inheritNestedStackParameterAssociations as Uo, envCredentialsAreAssumedRole as Ur, resolveDockerContextDirectory as Us, replacementNeverSwapped as Ut, deleteTableWithIndexBusyRetry as V, toCfnInteger as Va, nullPrototypeRecord as Vc, malformedResourcePropertiesWarning as Vi, RollbackInlinePolicyWriters as Vn, pathCrossesDottedKey as Vo, applyCallerIdentityCredentials as Vr, buildDenyExternalAccessPolicy as Vs, recheckFailedPlan as Vt, S3_AUTO_DELETE_OBJECTS_TAG as W, coerceCfnInteger as Wa, describeFileReadFailure as Wc, malformedStateRefusalMessage as Wi, reserveStackCreateToken as Wn, recordNestedStackParameterExpressions as Wo, isSettledInstanceState as Wr, describeDockerCapturedOutput as Ws, resolveReplacementOldType as Wt, createReadOnlyAttributeHealerFactory as X, requireConfigArray as Xa, refuseMalformedOrphans as Xi, readTagList as Xn, recordNoEchoAttributeValues as Xo, coerceParameterTypedValue as Xr, getDockerCmd as Xs, REDACTED_DELETE_ADDRESS_SKIP_REASON as Xt, formatResourceLine as Y, replayWarn as Ya, resolveBucketRegion as Yc, refuseMalformedOrphanRecordsForDestroy as Yi, planTagDiff as Yn, recordMaskOnlyValuesIn as Yo, s3BucketWebsiteUrl as Yr, formatDockerLoginError as Ys, inheritProducerRegions as Yt, bold as Z, requireConfigObject as Za, refuseMalformedOrphansForDestroy as Zi, refuseMalformedDesiredTags as Zn, recordNoEchoParameterFreshValue as Zo, isUnboundTemplateParameter as Zr, isDockerClientEnvKey as Zs, isRedactedRecordedValue as Zt, makeCanonicalizePropertiesFn as _, repairMalformedOrphansForReadOnly as _a, resolveSkipPrefix as _c, UNREADABLE_RESOURCES_MAP_ROW as _i, isExportAliasCollision as _n, passedNoEchoParametersOf as _o, deleteSkipReason as _r, importableOutputKeys as _s, revertedNestedRowIds as _t, findNestedTemplateTreeDefect as a, refuseMalformedResourceEntriesForImport as aa, escapeRegExp$3 as ac, AWS_NO_VALUE as ai, displayTextOrWithheld as an, sameLambdaFunctionAddress as ao, isCustomResource as ar, isSingleDynamicReferenceToken as as, reachableDivergentParameters as at, serviceTokenBlockingReason as b, repairMalformedResourcePropertiesForReadOnly as ba, resolveUseCdkBootstrapAssets as bc, displayLogicalId as bi, DEFAULT_RESOURCE_WARN_AFTER_MS as bn, valueAtCoordinate as bo, markWaitAbandoned as br, orphansAfterRollback as bs, withNestedStackContext as bt, renderNestedTemplateTreeDefect as c, refuseMalformedResourcePropertiesForDestroy as ca, getDockerImageBySourceHash as cc, refStateLookupFromResource as ci, secretBearingStateKeyWarning as cn, canonicalCoordinates as co, readsNoEchoDeleteValues as cr, S3StateBackend as cs, planOrphanAdoption as ct, conditionInputsFrom as d, refuseMalformedResourcePropertiesForOrphan as da, getDefaultStateBucketName as dc, parameterInputsFor as di, exportNameNoEchoParameters as dn, maskReadbackAtCoordinates as do, withPrintingSecrets as dr, acceptedCreateOnlyDropsOf as ds, displacedPhysicalIdShown as dt, refuseMalformedOutputsForDestroy as ea, redactDockerArgvValues as ec, isImpossibleEmptyStoredAttribute as ei, updatePartialMessage as en, templateResourceTypes as eo, definedAttributes as er, STATE_SOURCED_BASELINE_RULES as es, green as et, parentSuppliedValues as f, refuseMalformedResourcesForDeploy as fa, getLegacyStateBucketName as fc, passedParameterClassesOf as fi, exportNameSecretExposure as fn, maskWholeValue as fo, CloudControlProvider as fr, describeRegionValueKind as fs, dropSettledNestedJournals as ft, mergeNoChangeOutputs as g, repairMalformedOrphanRecordsForReadOnly as ga, resolveCaptureObservedState as gc, UNREADABLE_ORPHANS_CONTAINER_ROW as gi, collectPublishedOutputNames as gn, noEchoOutputsComparison as go, deleteIndeterminateGuards as gr, hasUnverifiableParameterRefusal as gs, revertNestedChildFromJournal as gt, keptWholeReasonText as h, refuseMalformedState as ha, resolveAutoAssetStorage as hc, STATE_RESOURCES_MALFORMED as hi, collectDeclaredOutputNames as hn, noEchoLeavesOf as ho, UNSPECIFIED_SKIP_REASON as hr, hasReasonlessBaselineRefusal as hs, recordDisplacedSkips as ht, childTemplateLoader as i, refuseMalformedResourceEntriesForDestroy as ia, warnFinchArgvExposure as ic, keepsSecretReferenceToken as ii, WITHHELD_NAME_DISPLAY as in, lambdaFunctionNameForMask as io, ccBrokenReason as ir, WHOLE_DYNAMIC_REFERENCE_PATTERN as is, namesAnyDeclaredParameter as it, readProtection as j, hasNoCloudControlHandlers as ja, expectedOwnerParam as jc, malformedLocalResourcesWarning as ji, ccRoutedFinalSnapshotError as jn, createSecretMasker as jo, classifyReplaySecretRegion as jr, AssetModeResolver as js, destroyStackRecordsView as jt, isProtectionValueActive as k, withoutSilentDropProperties as ka, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as kc, malformedLocalOutputsWarning as ki, PRE_DELETE_SNAPSHOT_TYPES as kn, recordLogOnlyValue as ko, IntrinsicFunctionResolver as kr, loadPublishableAssetManifest as ks, replayRollback as kt, templateIdentity as l, refuseMalformedResourcePropertiesForDrift as la, Synthesizer as lc, parseWebACLArn as li, secretSafeKeyDisplay as ln, isMarkedCoordinate as lo, isCustomResourceType as lr, rebuildClientForBucketRegion as ls, NESTED_PENDING_PARENT_REASON as lt, isSecretBearingReferenceString as m, refuseMalformedResourcesForExport as ma, resolveApp as mc, STATE_REGION_DIVERGED as mi, noEchoParameterValueSeed as mn, noEchoCoordinatesOf as mo, unchangedBehindSecretReference as mr, hasReadableExportSet as ms, nestedChildStackName as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedResourceEntries as na, runDockerForeground as nc, carriesFetchableDynamicReference as ni, DeploymentEventsReader as nn, withRetry as no, CC_BROKEN_REASON as nr, STATE_SOURCED_READBACK_RULES as ns, yellow as nt, isAbsoluteAssetPath as o, refuseMalformedResourceEntriesForImportSave as oa, stripControlChars as oc, cfnRefValueFromPhysicalId as oi, exportAliasCollisionScrubWarning as on, DagBuilder as oo, wouldReturnToSdkProvider as or, LockManager as os, resourcesNamingDeclaredParameter as ot, readRecordedConditionVerdicts as p, refuseMalformedResourcesForDestroy as pa, loadCdkJson as pc, JSON_LISTING_HOLE_VALUE as pi, isWholeDynamicReferenceValue as pn, maskedLeafCoordinatesOf as po, slowCcOperationTimeoutMs as pr, exportNamesCarriedFrom as ps, getNestedRevertRun as pt, getPriorAttempts as q, configStringRefusal as qa, resolveAssemblyPath as qc, refuseMalformedNestedChildOutputs as qi, DBPROXY_TAGS_WHAT as qn, provenPublicValue as qo, s3BucketDualStackDomainName as qr, dockerSpawnEnvWithSensitive as qs, findNestedStackTypeChanges as qt, computeImplicitDeleteEdges as r, refuseMalformedResourceEntriesForDeploy as ra, runDockerStreaming as rc, isNamelessDynamicReferenceError as ri, DeploymentEventsStore as rn, canonicalLambdaFunctionName as ro, ProviderRegistry as rr, TEMPLATE_SOURCED_RULES as rs, computeParameterTaint as rt, listNestedTemplateRows as s, refuseMalformedResourceEntriesForOrphan as sa, AssetManifestLoader as sc, isStalePlaceholderArnAttribute as si, secretBearing as sn, TemplateParser as so, TemplateNoEchoReresolver as sr, isLockInfoExpired as ss, makeSiblingClaimReader as st, DeployEngine as t, refuseMalformedResourceAttributesForOrphan as ta, redactedDockerCause as tc, carriesDynamicReference as ti, updatePartialReason as tn, describeTypeWithThrottleRetry as to, stringifyIfAssigned as tr, STATE_SOURCED_CROSS_GENERATION_RULES as ts, red as tt, conditionFingerprint as u, refuseMalformedResourcePropertiesForExport as ua, synthesisStatusMessage as uc, withSharedDrainBudget as ui, carriedExportAliasExposure as un, maskAtCoordinates as uo, getCurrentResourceSecrets as ur, splitImportedOps as us, displacedOpClause as ut, deferredServiceTokenWarning as v, repairMalformedOutputsForReadOnly as va, resolveStateBucketWithDefault as vc, accountArgs as vi, bindingSkippedOutputs as vn, readbackPathFor as vo, withIndeterminateGuard as vr, importableOutputs as vs, withNestedRevertRun as vt, noEchoExactEchoLeavesOf as w, unreadableResourceEntries as wa, CFN_TEMPLATE_BODY_LIMIT as wc, isReadableOrphanRecord as wi, orphanRecordsPrintingBag as wn, hasMaskableValues as wo, observeThenDisableInstanceApiTermination as wr, isSensitiveAttributeName as ws, journaledOrphanLines as wt, withResourceDeadline as x, repairMalformedResourcesForReadOnly as xa, stateBucketExistenceConfirmed as xc, hasReadableOrphans as xi, completedReplayEntries as xn, liveMatchesUnresolvedTokenFrame as xo, disableInstanceApiTermination as xr, orphansCarriedFrom as xs, deleteJournaledOrphans as xt, findServiceTokenRefusals as y, repairMalformedResourceEntriesForReadOnly as ya, resolveStateBucketWithDefaultAndSource as yc, deployRefusesOrphanRowsReason as yi, DEFAULT_RESOURCE_TIMEOUT_MS as yn, readsNoEchoSource as yo, isWaitAbandonedError as yr, isReadableBag as ys, getCurrentNestedStackContext as yt, DELETE_INDEX_WAIT_PROCEED_NOTE as z, coerceWarmThroughput as za, hasOwnKey as zc, malformedRenderedContainersWarning as zi, findDestructiveChanges as zn, dynamicReferenceTokens as zo, sendableAssumeRoleCommand as zr, validateAssetBucketName as zs, planFailedOps as zt };
-//# sourceMappingURL=deploy-engine-D4FdwPCi.js.map
+export { getPriorAttempts as $, configStringRefusal as $a, nullPrototypeRecord as $c, refuseMalformedNestedChildOutputs as $i, DBPROXY_TAGS_WHAT as $n, provenPublicValue as $o, s3BucketDualStackDomainName as $r, buildDenyExternalAccessPolicy as $s, findNestedStackTypeChanges as $t, noEchoExactEchoLeavesOf as A, unreadableResourceEntries as Aa, resolveStateBucketWithDefault as Ac, isReadableOrphanRecord as Ai, orphanRecordsPrintingBag as An, hasMaskableValues as Ao, observeThenDisableInstanceApiTermination as Ar, importableOutputs as As, journaledOrphanLines as At, beginDeleteWait as B, MULTI_REGION_RECREATE_BLOCKED_TYPES as Ba, uploadCfnTemplate as Bc, malformedOrphanRowsKeptWarning as Bi, isFinalSnapshotError as Bn, maskSecretsInText as Bo, applyRoleArnIfSet as Br, createAssetRedirectResolver as Bs, removeProtectionTypeList as Bt, recordRetainedForReadoption as C, repairMalformedOrphansForReadOnly as Ca, getDefaultStateBucketName as Cc, UNREADABLE_RESOURCES_MAP_ROW as Ci, isExportAliasCollision as Cn, passedNoEchoParametersOf as Co, deleteSkipReason as Cr, acceptedCreateOnlyDropsOf as Cs, revertedNestedRowIds as Ct, withResourceDeadline as D, repairMalformedResourcesForReadOnly as Da, resolveAutoAssetStorage as Dc, hasReadableOrphans as Di, completedReplayEntries as Dn, liveMatchesUnresolvedTokenFrame as Do, disableInstanceApiTermination as Dr, hasReasonlessBaselineRefusal as Ds, deleteJournaledOrphans as Dt, serviceTokenBlockingReason as E, repairMalformedResourcePropertiesForReadOnly as Ea, resolveApp as Ec, displayLogicalId as Ei, DEFAULT_RESOURCE_WARN_AFTER_MS as En, valueAtCoordinate as Eo, markWaitAbandoned as Er, hasReadableExportSet as Es, withNestedStackContext as Et, isProtectionValueActive as F, withoutSilentDropProperties as Fa, ssmResolvedValueType as Fc, malformedLocalOutputsWarning as Fi, PRE_DELETE_SNAPSHOT_TYPES as Fn, recordLogOnlyValue as Fo, IntrinsicFunctionResolver as Fr, AssetPublisher as Fs, replayRollback as Ft, DELETE_INDEX_WAIT_PROCEED_NOTE as G, coerceWarmThroughput as Ga, canonicalizeRegion as Gc, malformedRenderedContainersWarning as Gi, findDestructiveChanges as Gn, dynamicReferenceTokens as Go, sendableAssumeRoleCommand as Gr, assertAssetBucketRegion as Gs, planFailedOps as Gt, deleteBudgetKey as H, isStatefulRecreateTargetSync as Ha, decodeListingKey as Hc, malformedOrphansWarning as Hi, unsupportedFinalSnapshotError as Hn, redactSecretsForState as Ho, assertSendableRoleArn as Hr, rewriteTemplateAssetReferences as Hs, demoteSupersededOrphans as Ht, perType as I, NO_CC_HANDLERS_REASON as Ia, CFN_TEMPLATE_BODY_LIMIT as Ic, malformedLocalResourceEntriesWarning as Ii, buildFinalSnapshotIdentifier as In, shareLogOnlyValues as Io, poisonRenderedSpellingsCollidingIn as Ir, isSensitiveAttributeName as Is, awaitInFlightSibling as It, waitForIndexesSettled as J, toFiniteNumber as Ja, StageLoadError as Jc, malformedResourcesWarning as Ji, earliestDefined as Jn, identityKeyFor as Jo, callerEnvCredentials as Jr, isCrossRegionRedirect as Js, recordUnderIdIsNotOwn as Jt, INDEX_SETTLE_POLL_INTERVAL_MS as K, isWarmThroughputDecrease as Ka, derivePartitionAndUrlSuffix as Kc, malformedResourceEntriesWarning as Ki, formatDestructiveChange as Kn, isUncertifiedBaselineMaskPosition as Ko, AWS_CREDENTIAL_ENV_KEYS as Kr, ensureAssetStorage as Ks, planRollback as Kt, readProtection as L, hasNoCloudControlHandlers as La, CFN_TEMPLATE_URL_LIMIT as Lc, malformedLocalResourcesWarning as Li, ccRoutedFinalSnapshotError as Ln, createSecretMasker as Lo, classifyReplaySecretRegion as Lr, stringifyValue as Ls, destroyStackRecordsView as Lt, recordedProtectionEvidence as M, findActionableSilentDrops as Ma, resolveUseCdkBootstrapAssets as Mc, malformedDriftResourcePropertiesWarning as Mi, stateSecretNameNeedles as Mn, logOnlyValueCount as Mo, reEnableInstanceApiTermination as Mr, orphansAfterRollback as Ms, makeForeignHolderScan as Mt, recordedProtectionNote as N, findSilentDropProperties as Na, stateBucketExistenceConfirmed as Nc, malformedExportNamesWarning as Ni, extractDeploymentEventError as Nn, printingCorpusOf as No, DiffCalculator as Nr, orphansCarriedFrom as Ns, sameJournaledOrphans as Nt, noEchoAttributeNamesOf as O, unpreviewableOrphanRecords as Oa, resolveCaptureObservedState as Oc, hasReadableOutputs as Oi, journaledOrphanPrintingBag as On, carryLogOnlyValues as Oo, ec2InstanceProtectionSite as Or, hasUnverifiableParameterRefusal as Os, dropFailedHint as Ot, PROTECTION_PROPERTY_BY_TYPE as P, unwrittenCreateOnlyReplacement as Pa, warnDeprecatedNoPrefixCliFlag as Pc, malformedExportSourceWarning as Pi, ATOMIC_FINAL_SNAPSHOT_TYPES as Pn, recordLogOnlyParameterValue as Po, INTRINSIC_KEYS as Pr, shouldRetainResource as Ps, replayFailedOperations as Pt, isTruthyCfnBoolean as Q, configIntegerRefusal as Qa, hasPlainPrototype$1 as Qc, refuseDivergentRecordRegionForDestroy as Qi, acquireIdempotencyToken as Qn, carriesSecretMask as Qo, s3BucketDomainName as Qr, validateContainerRepoName as Qs, orphanDeleteNeedsIdentity as Qt, DynamoDBGlobalTableProvider as R, findReplacedReadersOfRecreateTargets as Ra, MIGRATE_TMP_PREFIX as Rc, malformedOrphanRecordsRefusalMessage as Ri, createPreDeleteFinalSnapshot as Rn, errorCauseChain as Ro, producerRegionsFromState as Rr, WorkGraph as Rs, getStackRecords as Rt, keptForReadoption as S, repairMalformedOrphanRecordsForReadOnly as Sa, synthesisStatusMessage as Sc, UNREADABLE_ORPHANS_CONTAINER_ROW as Si, collectPublishedOutputNames as Sn, noEchoOutputsComparison as So, deleteIndeterminateGuards as Sr, splitImportedOps as Ss, revertNestedChildFromJournal as St, findServiceTokenRefusals as T, repairMalformedResourceEntriesForReadOnly as Ta, loadCdkJson as Tc, deployRefusesOrphanRowsReason as Ti, DEFAULT_RESOURCE_TIMEOUT_MS as Tn, readsNoEchoSource as To, isWaitAbandonedError as Tr, exportNamesCarriedFrom as Ts, getCurrentNestedStackContext as Tt, resolveDynamoDbDeleteBudgetClock as U, renderStatefulReason as Ua, expectedOwnerParam as Uc, malformedOutputsRefusalMessage as Ui, maskingRetryLogger as Un, scrubResourceRecord as Uo, explicitRoleArnOrThrow as Ur, AssetModeResolver as Us, isJournaledOrphan as Ut, compensateRemovedDeletionProtection as V, isStatefulRecreateTargetForReplace as Va, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Vc, malformedOrphansRefusalMessage as Vi, refusesFinalSnapshot as Vn, markSameGenerationBag as Vo, assertFlagRoleArn as Vr, loadPublishableAssetManifest as Vs, recordAfterRollbackUpdate as Vt, resolveDynamoDbDeleteBudgetMs as W, WARM_THROUGHPUT_MEMBERS as Wa, PARTITION_TABLE as Wc, malformedOutputsWarning as Wi, constructPathOf as Wn, DYNAMIC_REFERENCE_TOKEN_SCAN as Wo, isIamRoleArn as Wr, BOOTSTRAP_MARKER_PREFIX as Ws, isReplacementOrphan as Wt, S3_AUTO_DELETE_OBJECTS_TAG as X, coerceCfnInteger as Xa, defineOwnKey as Xc, malformedStateRefusalMessage as Xi, reserveStackCreateToken as Xn, recordNestedStackParameterExpressions as Xo, isSettledInstanceState as Xr, readBootstrapMarkerBody as Xs, resolveReplacementOldType as Xt, ECR_AUTO_DELETE_IMAGES_TAG as Y, coerceCfnBoolean as Ya, processStackMessages as Yc, malformedScrubResourceEntriesRefusalMessage as Yi, ledgerForStack as Yn, inheritNestedStackParameterAssociations as Yo, envCredentialsAreAssumedRole as Yr, parseBootstrapMarker as Ys, replacementNeverSwapped as Yt, hasCdkAutoDeleteTag as Z, configBooleanRefusal as Za, hasOwnKey as Zc, previewableOrphanRecords as Zi, withCreateTokenLedger as Zn, recoverMaskedOutput as Zo, s3BucketArn as Zr, validateAssetBucketName as Zs, seedsDeleteFirstGuard as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedResourcePropertiesForOrphan as _a, escapeRegExp$3 as _c, parameterInputsFor as _i, exportNameNoEchoParameters as _n, maskReadbackAtCoordinates as _o, withPrintingSecrets as _r, CrossPrefixScanCache as _s, displacedPhysicalIdShown as _t, findNestedTemplateTreeDefect as a, refuseMalformedOutputs as aa, dockerSpawnEnvWithSensitive as ac, getAccountInfo as ai, resolveAssemblyPath as al, redactedDeleteAddressSkip as an, prefetchCreateOnlyPropertyPaths as ao, tagPlanWarning as ar, wholeStringLeavesOf as as, gray as at, lookupEachName as b, refuseMalformedResourcesForExport as ba, getDockerImageBySourceHash as bc, STATE_REGION_DIVERGED as bi, noEchoParameterValueSeed as bn, noEchoCoordinatesOf as bo, unchangedBehindSecretReference as br, isAccessDenied as bs, nestedChildStackName as bt, renderNestedTemplateTreeDefect as c, refuseMalformedResourceEntries as ca, getDockerCmd as cc, carriesFetchableDynamicReference as ci, DeploymentEventsReader as cn, withRetry as co, CC_BROKEN_REASON as cr, STATE_SOURCED_READBACK_RULES as cs, yellow as ct, conditionInputsFrom as d, refuseMalformedResourceEntriesForImport as da, partitionSensitiveEnv as dc, AWS_NO_VALUE as di, displayTextOrWithheld as dn, sameLambdaFunctionAddress as do, isCustomResource as dr, isSingleDynamicReferenceToken as ds, reachableDivergentParameters as dt, refuseMalformedOrphanRecords as ea, buildDockerImage as ec, s3BucketRegionalDomainName as ei, ownValue as el, getCurrentProducerRegions as en, readConfigString as eo, DBPROXY_TAG_OPTIONS as er, recordMaskOnlyValue as es, markRefusedBeforeApplying as et, parentSuppliedValues as f, refuseMalformedResourceEntriesForImportSave as fa, redactDockerArgvValues as fc, cfnRefValueFromPhysicalId as fi, exportAliasCollisionScrubWarning as fn, DagBuilder as fo, wouldReturnToSdkProvider as fr, LockManager as fs, resourcesNamingDeclaredParameter as ft, mergeNoChangeOutputs as g, refuseMalformedResourcePropertiesForExport as ga, warnFinchArgvExposure as gc, withSharedDrainBudget as gi, carriedExportAliasExposure as gn, maskAtCoordinates as go, getCurrentResourceSecrets as gr, CrossPrefixReadError as gs, displacedOpClause as gt, keptWholeReasonText as h, refuseMalformedResourcePropertiesForDrift as ha, runDockerStreaming as hc, parseWebACLArn as hi, secretSafeKeyDisplay as hn, isMarkedCoordinate as ho, isCustomResourceType as hr, rebuildClientForBucketRegion as hs, NESTED_PENDING_PARENT_REASON as ht, childTemplateLoader as i, refuseMalformedOrphansForOrphan as ia, describeDockerFailure as ic, parameterTypeMayLoseSecretIdentity as ii, renderAssemblyPathEscape as il, redactedDeleteAddressFields as in, requireConfigString as io, tagMapAsList as ir, recordProvenPublicExpression as is, cyan as it, noEchoParameterNamesOf as j, withheldAccountClause as ja, resolveStateBucketWithDefaultAndSource as jc, isReadableResourceEntry as ji, secretNamePrintingBag as jn, literalSplitDelimitersOf as jo, reDisableInstanceApiTermination as jr, isReadableBag as js, loadJournaledOrphans as jt, noEchoComparisonForTemplate as k, unreadableOrphanRecords as ka, resolveSkipPrefix as kc, hasReadableResources as ki, maskEventTextWithBoundBags as kn, createUnionSecretMasker as ko, isTerminationProtectionPropagationError as kr, importableOutputKeys as ks, isHandledOrphan as kt, templateIdentity as l, refuseMalformedResourceEntriesForDeploy as la, isDockerClientEnvKey as lc, isNamelessDynamicReferenceError as li, DeploymentEventsStore as ln, canonicalLambdaFunctionName as lo, ProviderRegistry as lr, TEMPLATE_SOURCED_RULES as ls, computeParameterTaint as lt, isSecretBearingReferenceString as m, refuseMalformedResourcePropertiesForDestroy as ma, runDockerForeground as mc, refStateLookupFromResource as mi, secretBearingStateKeyWarning as mn, canonicalCoordinates as mo, readsNoEchoDeleteValues as mr, S3StateBackend as ms, planOrphanAdoption as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedOrphans as na, describeDockerCapturedOutput as nc, coerceParameterTypedValue as ni, describeFileReadFailure as nl, REDACTED_DELETE_ADDRESS_SKIP_REASON as nn, requireConfigArray as no, readTagList as nr, recordNoEchoAttributeValues as ns, createReadOnlyAttributeHealerFactory as nt, isAbsoluteAssetPath as o, refuseMalformedOutputsForDestroy as oa, finchSecretArgvRefusal as oc, isImpossibleEmptyStoredAttribute as oi, clearBucketRegionCache as ol, updatePartialMessage as on, templateResourceTypes as oo, definedAttributes as or, STATE_SOURCED_BASELINE_RULES as os, green as ot, readRecordedConditionVerdicts as p, refuseMalformedResourceEntriesForOrphan as pa, redactedDockerCause as pc, isStalePlaceholderArnAttribute as pi, secretBearing as pn, TemplateParser as po, TemplateNoEchoReresolver as pr, isLockInfoExpired as ps, makeSiblingClaimReader as pt, deleteTableWithIndexBusyRetry as q, toCfnInteger as qa, AssemblyReader as qc, malformedResourcePropertiesWarning as qi, RollbackInlinePolicyWriters as qn, pathCrossesDottedKey as qo, applyCallerIdentityCredentials as qr, getBootstrapMarkerKey as qs, recheckFailedPlan as qt, computeImplicitDeleteEdges as r, refuseMalformedOrphansForDestroy as ra, describeDockerExecFailure as rc, isUnboundTemplateParameter as ri, displayAssemblyPath as rl, isRedactedRecordedValue as rn, requireConfigObject as ro, refuseMalformedDesiredTags as rr, recordNoEchoParameterFreshValue as rs, bold as rt, listNestedTemplateRows as s, refuseMalformedResourceAttributesForOrphan as sa, formatDockerLoginError as sc, carriesDynamicReference as si, resolveBucketRegion as sl, updatePartialReason as sn, describeTypeWithThrottleRetry as so, stringifyIfAssigned as sr, STATE_SOURCED_CROSS_GENERATION_RULES as ss, red as st, DeployEngine as t, refuseMalformedOrphanRecordsForDestroy as ta, resolveDockerContextDirectory as tc, s3BucketWebsiteUrl as ti, absoluteAssemblyPathEscape as tl, inheritProducerRegions as tn, replayWarn as to, planTagDiff as tr, recordMaskOnlyValuesIn as ts, formatResourceLine as tt, conditionFingerprint as u, refuseMalformedResourceEntriesForDestroy as ua, isMalformedEnvKey as uc, keepsSecretReferenceToken as ui, WITHHELD_NAME_DISPLAY as un, lambdaFunctionNameForMask as uo, ccBrokenReason as ur, WHOLE_DYNAMIC_REFERENCE_PATTERN as us, namesAnyDeclaredParameter as ut, chunks as v, refuseMalformedResourcesForDeploy as va, stripControlChars as vc, passedParameterClassesOf as vi, exportNameSecretExposure as vn, maskWholeValue as vo, CloudControlProvider as vr, applyCrossPrefixScan as vs, dropSettledNestedJournals as vt, deferredServiceTokenWarning as w, repairMalformedOutputsForReadOnly as wa, getLegacyStateBucketName as wc, accountArgs as wi, bindingSkippedOutputs as wn, readbackPathFor as wo, withIndeterminateGuard as wr, describeRegionValueKind as ws, withNestedRevertRun as wt, withApiLimit as x, refuseMalformedState as xa, Synthesizer as xc, STATE_RESOURCES_MALFORMED as xi, collectDeclaredOutputNames as xn, noEchoLeavesOf as xo, UNSPECIFIED_SKIP_REASON as xr, isNotImplemented as xs, recordDisplacedSkips as xt, isAccessDeniedError as y, refuseMalformedResourcesForDestroy as ya, AssetManifestLoader as yc, JSON_LISTING_HOLE_VALUE as yi, isWholeDynamicReferenceValue as yn, maskedLeafCoordinatesOf as yo, slowCcOperationTimeoutMs as yr, crossPrefixDeniedWarning as ys, getNestedRevertRun as yt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as z, shownType as za, findLargeInlineResources as zc, malformedOrphanRecordsWarning as zi, effectiveDeletionPolicy as zn, maskSecretsInError as zo, regionLessSecretName as zr, buildAssetRedirectMap as zs, withStackRecords as zt };
+//# sourceMappingURL=deploy-engine-Bt-8KvUj.js.map