@go-to-k/cdkd 0.296.28 → 0.296.30

package/dist/{deploy-engine-D4FdwPCi.js → deploy-engine-BuPc2Dfc.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js";
 import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
-import { $ as protectedReplacementAdvice, $n as isIamPropagationError, $t as AccountIdUnavailableError, A as isQuotableImportValue, An as commandHole, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bt as sanitizeRecoveryValue, Ct as RETRY_AUXILIARY_OWNER, Dn as SHELL_ACTIVE, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as plainOrDescribed, G as runDeleteAttempt, Gn as isNameCooldownError, H as observeThenDisableProtection, Hn as isUpdateUnsupportedError, Ht as DEFAULT_STATE_PREFIX, In as quotedOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jt as withPasteableAwsProfile, Kn as isRecreateRetryableError, Kt as producerRecordKey, L as ProtectionFlipRegistry, Ln as shellBoundedDisplay, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mn as isInertUnquoted, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as pasteableCommand, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE_WHY, Ot as hasCreatedBeforeFailure, Pn as physicalIdShownBesideCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, R as compensateProtectionFlip, Rn as shellQuote, Rt as formatLockOperation, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Un as hasReplayMayCollide, Ut as injectiveKey, Vt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Wn as isNameCollisionErrorFrom, Xn as formatRetryClassificationSignals, Xt as ambientCredentialConfig, Yn as markReplayMayCollide, Yt as ambientClientDefaults, Zn as isAmbiguousCcHandlerErrorCode, Zt as clientDefaultsFor, _n as ResourceUpdateNotSupportedError, _t as createMaskedLogSinks, ar as isThrottlingError, at as startInterruptWatch, bn as StateError, bt as maskDeep, cr as wrapMaskedAwsError, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as MacroExpansionError, en as AssetError, er as isRetryableTransientError, f as removalWarning, fn as MalformedProducerRecordRefusalError, ft as logicalIdShown, gn as ResourceTimeoutError, gt as stateOrphanRecordRemedy, hn as ProvisioningError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as DependencyError, ir as isMarkedNonRetryable, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, kn as UNSHOWABLE_VALUE, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, m as withoutInjectedRemovals, mt as resourceTypeShown, nr as retryClassificationText, on as DynamicReferenceRegionAmbiguousError, or as markNonRetryable, ot as ElapsedBudgetRegistry, qn as isReplayedNameCollisionFrom, rn as CrossAccountSecretRefusalError, sn as IntrinsicResolutionRefusalError, sr as markRedactedCause, st as monotonicNowMs, tn as CdkdError, tr as isTransientServerError, un as LockError, ut as compositeIdSeparatorRefusal, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as normalizeAwsError, wt as carryCreatedBeforeFailure, xn as SynthesisError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as withheldTargetClause, zt as formatLockOwner } from "./iam-policy-targets-B61e5_Sk.js";
+import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-Cz2tPxXk.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-B0JEGOLV.js";
+import { t as getCdkdVersion } from "./version-B__YmKBy.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4937,14 +4937,16 @@ function parseCreateTokenLedger(body) {
 		for (const [logicalId, entry] of Object.entries(rawSent)) if (isSent(entry)) sent[logicalId] = {
 			base: entry.base,
 			token: entry.token,
-			firstSentAt: entry.firstSentAt
+			firstSentAt: entry.firstSentAt,
+			...typeof entry.failedAt === "number" && Number.isFinite(entry.failedAt) && { failedAt: entry.failedAt }
 		};
 	}
 	return {
 		ledgerVersion: 1,
 		nonce: doc["nonce"],
 		sent,
-		...doc["stateRecorded"] === true && { stateRecorded: true }
+		...doc["stateRecorded"] === true && { stateRecorded: true },
+		...typeof doc["abandonedAt"] === "number" && Number.isFinite(doc["abandonedAt"]) && { abandonedAt: doc["abandonedAt"] }
 	};
 }
 const stateSavedObserver = new AsyncLocalStorage();
@@ -4955,6 +4957,409 @@ async function notifyStateSaved(stackName, region) {
 	await stateSavedObserver.getStore()?.(stackName, region);
 }
 
+//#endregion
+//#region src/state/cross-prefix-stack-scan.ts
+function journalCanOwnResources(journal) {
+	return recordCanOwnResources({ resources: {} }, journal);
+}
+function recordCanOwnResources(record, journal) {
+	const resources = record.resources;
+	if (resources === null || typeof resources !== "object" || Array.isArray(resources)) return true;
+	if (Object.keys(resources).length > 0) return true;
+	const orphans = record.orphans;
+	if (orphans !== void 0 && (!Array.isArray(orphans) || orphans.length > 0)) return true;
+	if (journal === null) return false;
+	const segments = journal.segments;
+	if (!Array.isArray(segments)) return true;
+	return segments.some((seg) => {
+		if (seg === null || typeof seg !== "object" || Array.isArray(seg)) return true;
+		const ops = seg.operations;
+		if (ops !== void 0 && (!Array.isArray(ops) || ops.length > 0)) return true;
+		const failed = seg.failedOperations;
+		if (failed === void 0) return false;
+		if (!Array.isArray(failed)) return true;
+		return failed.some((op) => op === null || typeof op !== "object" || op.physicalId !== void 0);
+	});
+}
+var CrossPrefixReadError = class extends Error {
+	key;
+	cause;
+	constructor(key, cause) {
+		super(`reading ${displayIdent(key, { maxCodePoints: 1024 })} failed (${errorName$1(cause, "an unknown error")})`);
+		this.name = "CrossPrefixReadError";
+		this.key = key;
+		this.cause = cause;
+	}
+};
+const PROBE_CONCURRENCY = 50;
+function unwrapCause(error) {
+	return error instanceof CrossPrefixReadError ? error.cause : error;
+}
+function isNotImplemented(error) {
+	const name = error?.name;
+	const status = error?.$metadata?.httpStatusCode;
+	return name === "NotImplemented" || status === 501;
+}
+function isAccessDenied(error) {
+	let current = error;
+	for (let depth = 0; depth < 5 && current !== null && typeof current === "object"; depth++) {
+		const name = current.name;
+		if (name === "AccessDenied" || name === "Forbidden" || name === "AllAccessDisabled") return true;
+		if (current.$metadata?.httpStatusCode === 403) return true;
+		current = current.cause;
+	}
+	return false;
+}
+function candidatePrefixPasses(segments, own) {
+	const seen = /* @__PURE__ */ new Set([own]);
+	const pass = (names) => {
+		const out = [];
+		for (const name of names) {
+			if (seen.has(name)) continue;
+			seen.add(name);
+			out.push(name);
+		}
+		return out;
+	};
+	return [pass(segments), pass(segments.map((p) => `${p}/`))];
+}
+async function scanOtherPrefixesForStack(target, stackName, region) {
+	let segments;
+	try {
+		segments = await target.listTopLevelPrefixes();
+	} catch (error) {
+		return isAccessDenied(error) ? {
+			kind: "denied",
+			error,
+			stage: "list"
+		} : {
+			kind: "failed",
+			error
+		};
+	}
+	const found = [];
+	const stale = [];
+	let denied;
+	let failed;
+	const probeAll = async (candidates) => {
+		let next = 0;
+		const worker = async () => {
+			while (found.length === 0 && next < candidates.length) {
+				const prefix = candidates[next++];
+				try {
+					const held = await target.recordUnderPrefix(prefix, stackName, region);
+					if (held === "holder") found.push(prefix);
+					else if (held === "empty") stale.push(prefix);
+				} catch (error) {
+					if (isAccessDenied(error)) denied ??= error;
+					else failed ??= error;
+				}
+			}
+		};
+		await Promise.all(Array.from({ length: Math.min(50, candidates.length) }, () => worker()));
+	};
+	const [segmentsThemselves, twins] = candidatePrefixPasses(segments, target.prefix);
+	await probeAll([...segmentsThemselves, ...twins]);
+	const extra = stale.length > 0 ? { stale } : {};
+	if (found.length > 0) return {
+		kind: "found",
+		prefixes: found,
+		...extra
+	};
+	if (failed !== void 0) return {
+		kind: "failed",
+		error: failed,
+		...extra
+	};
+	if (denied !== void 0) return {
+		kind: "denied",
+		error: denied,
+		stage: "probe",
+		...extra
+	};
+	return {
+		kind: "clear",
+		...extra
+	};
+}
+function withSharedListing(target) {
+	let listing;
+	let inFlight = 0;
+	let seq = 0;
+	let prestarted = 0;
+	const keyOf = (stackName, region) => JSON.stringify([stackName, region]);
+	const ranks = /* @__PURE__ */ new Map();
+	const rankOf = (stackName, region) => ranks.get(keyOf(stackName, region)) ?? Number.MAX_SAFE_INTEGER;
+	const heap = [];
+	const before = (a, b) => a.rank < b.rank || a.rank === b.rank && a.seq < b.seq;
+	const swap = (i, j) => {
+		const t = heap[i];
+		heap[i] = heap[j];
+		heap[j] = t;
+	};
+	const siftUp = (i) => {
+		while (i > 0) {
+			const parent = i - 1 >> 1;
+			if (!before(heap[i], heap[parent])) return;
+			swap(i, parent);
+			i = parent;
+		}
+	};
+	const siftDown = (i) => {
+		for (;;) {
+			const l = 2 * i + 1;
+			const r = l + 1;
+			let best = i;
+			if (l < heap.length && before(heap[l], heap[best])) best = l;
+			if (r < heap.length && before(heap[r], heap[best])) best = r;
+			if (best === i) return;
+			swap(i, best);
+			i = best;
+		}
+	};
+	const popBest = () => {
+		const top = heap[0];
+		const last = heap.pop();
+		if (heap.length > 0) {
+			heap[0] = last;
+			siftDown(0);
+		}
+		return top;
+	};
+	const admitBest = () => {
+		while (inFlight < 50 && heap.length > 0) {
+			inFlight++;
+			popBest().resolve();
+		}
+	};
+	const acquire = async (stackName, region) => {
+		const rank = rankOf(stackName, region);
+		if (inFlight < 50 && (heap.length === 0 || heap[0].rank >= rank)) {
+			inFlight++;
+			return;
+		}
+		const key = keyOf(stackName, region);
+		await new Promise((resolve) => {
+			heap.push({
+				key,
+				rank,
+				seq: seq++,
+				resolve
+			});
+			siftUp(heap.length - 1);
+		});
+	};
+	const release = () => {
+		inFlight--;
+		admitBest();
+	};
+	return {
+		prefix: target.prefix,
+		rank: (stackName, region, when) => {
+			const key = keyOf(stackName, region);
+			if (when === "prestart") {
+				if (!ranks.has(key)) ranks.set(key, prestarted++);
+				return;
+			}
+			if (ranks.get(key) === -1) return;
+			ranks.set(key, -1);
+			let moved = false;
+			for (const w of heap) if (w.key === key) {
+				w.rank = -1;
+				moved = true;
+			}
+			if (moved) for (let i = (heap.length >> 1) - 1; i >= 0; i--) siftDown(i);
+		},
+		listTopLevelPrefixes: () => listing ??= target.listTopLevelPrefixes(),
+		recordUnderPrefix: async (prefix, stackName, region) => {
+			await acquire(stackName, region);
+			try {
+				return await target.recordUnderPrefix(prefix, stackName, region);
+			} finally {
+				release();
+			}
+		}
+	};
+}
+var CrossPrefixScanCache = class {
+	target;
+	scans = /* @__PURE__ */ new Map();
+	constructor(target) {
+		this.target = withSharedListing(target);
+	}
+	full(stackName, region, when = "now") {
+		this.target.rank(stackName, region, when);
+		const key = JSON.stringify([stackName, region]);
+		let scan = this.scans.get(key);
+		if (scan === void 0) {
+			scan = scanOtherPrefixesForStack(this.target, stackName, region);
+			this.scans.set(key, scan);
+		}
+		return scan;
+	}
+};
+const STACK_UNDER_OTHER_PREFIX = "STACK_UNDER_OTHER_STATE_PREFIX";
+const UNSUPPORTED_SENTENCE = "A stack name is unique per account and region, as in CloudFormation: deploying one stack name under two state prefixes is unsupported, because both deployments use the same cdkd-generated resource names, and a failed deploy, a destroy, or a deploy that deletes or replaces of either one deletes resources the other's record also names.";
+function subjectText(s) {
+	return `${displayStackName(s.stackName)} (${displayIdent(s.region)})`;
+}
+const LISTED_PREFIXES = 5;
+function prefixesText(prefixes) {
+	const shown = prefixes.slice(0, LISTED_PREFIXES).map((p) => displayIdent(p, { listMember: true })).join(", ");
+	const more = prefixes.length - LISTED_PREFIXES;
+	return more > 0 ? `${shown} and ${more} more` : shown;
+}
+function stateCommand(verb, s, prefix) {
+	const account = recoveryCommandFlags({
+		profile: s.recovery?.profile,
+		stateBucket: s.recovery?.stateBucket ?? s.bucket
+	});
+	return pasteableCommand(`cdkd state ${verb}`, [
+		{
+			value: s.stackName,
+			hole: "stack"
+		},
+		{
+			flag: "--stack-region",
+			value: s.region,
+			hole: "region"
+		},
+		{
+			flag: "--state-prefix",
+			value: prefix,
+			hole: "prefix"
+		}
+	], account.flags).command;
+}
+function releaseRemedy(s, prefixes, destroyToo) {
+	const first = prefixes[0];
+	if (prefixes.length === 1 && destroyToo) return `\`${stateCommand("destroy", s, first)}\` deletes its resources and its record, \`${stateCommand("orphan", s, first)}\` drops only its record.`;
+	if (prefixes.length === 1) return `drop the other record with \`cdkd state orphan\` (it removes only the record, never a resource): \`${stateCommand("orphan", s, first)}\`.`;
+	return `release each other record with \`cdkd state orphan\` (it removes only the record, never a resource; a destroy under one of them is refused while another still records the stack, and the check stops at the first ones it finds, so re-run it until none is named), e.g. \`${stateCommand("orphan", s, first)}\`, then the same with each other prefix.`;
+}
+const VERB = {
+	deploy: "deploy",
+	destroy: "destroy",
+	rollback: "roll back",
+	"deploy-destructive": "deploy",
+	"deploy-late-replace": "replace a resource of"
+};
+const NOTHING = {
+	deploy: "No resource of this stack was created.",
+	destroy: "Nothing was deleted.",
+	rollback: "Nothing was reverted or deleted.",
+	"deploy-destructive": "No resource of this stack was changed.",
+	"deploy-late-replace": "That resource is kept, so the new value is not applied; the rest of the deploy goes on."
+};
+function deployUnderOtherPrefixMessage(s, prefixes) {
+	return `Refusing to deploy stack ${subjectText(s)}: it is already recorded under another state prefix of bucket ${displayIdent(s.bucket)} (${prefixesText(prefixes)}). ${UNSUPPORTED_SENTENCE} ${NOTHING.deploy} Either deploy it under that prefix (pass the same --state-prefix it was deployed with), give this stack another name, or, if the other deployment is no longer wanted, ${prefixes.length === 1 ? "remove it first: " : ""}` + releaseRemedy(s, prefixes, true);
+}
+function destroyUnderOtherPrefixMessage(s, prefixes, action = "destroy") {
+	return `Refusing to ${VERB[action]} stack ${subjectText(s)}: it is also recorded under another state prefix of bucket ${displayIdent(s.bucket)} (${prefixesText(prefixes)}). ${UNSUPPORTED_SENTENCE} ${NOTHING[action]} Keep one record per stack name and region: once you have confirmed which record describes the deployment you want to keep, ${releaseRemedy(s, prefixes, false)} Then re-run.`;
+}
+function destructiveDeployUnderOtherPrefixMessage(s, prefixes, action = "deploy-destructive") {
+	return `${action === "deploy-late-replace" ? `Refusing to replace a resource of stack ${subjectText(s)} (a replacement this deploy found only on reading the resource back)` : `Refusing to deploy stack ${subjectText(s)}: this deploy deletes or replaces resources`}, and the stack is also recorded under another state prefix of bucket ${displayIdent(s.bucket)} (${prefixesText(prefixes)}). ${UNSUPPORTED_SENTENCE} ${NOTHING[action]} Keep one record per stack name and region: once you have confirmed which record describes the deployment you want to keep, ${releaseRemedy(s, prefixes, false)} Then re-run.`;
+}
+function staleRecordNotice(s, prefixes) {
+	return `Note: bucket ${displayIdent(s.bucket)} also holds a record of stack ${subjectText(s)} under another state prefix (${prefixesText(prefixes)}) that owns no resource -- the leftover of a failed first deploy. It does not block this command; remove it with \`${stateCommand("orphan", s, prefixes[0])}\`${prefixes.length > 1 ? ", and the same with each other prefix" : ""}.`;
+}
+function errorName$1(error, fallback) {
+	const subject = error instanceof CrossPrefixReadError ? error.cause : error;
+	return subject !== null && typeof subject === "object" && typeof subject.name === "string" ? displaySafe(subject.name, { asciiOnly: true }) : fallback;
+}
+function failedKeyText(error) {
+	return error instanceof CrossPrefixReadError ? ` reading s3 object ${displayIdent(error.key, { maxCodePoints: 1024 })}` : "";
+}
+function crossPrefixDeniedWarning(s, error, stage = "probe") {
+	if (stage === "registry" && isNotImplemented(unwrapCause(error))) return `Could not use the stack registry for stack ${subjectText(s)}: the state bucket's endpoint does not implement a conditional write${failedKeyText(error)} (${errorName$1(error, "NotImplemented")}), so the bucket's other state prefixes were scanned instead, which is slower. Continuing.`;
+	if (stage === "registry") return `Could not use the stack registry for stack ${subjectText(s)}: S3 refused${failedKeyText(error)} (${errorName$1(error, "AccessDenied")}), so the bucket's other state prefixes were scanned instead, which is slower. Grant s3:GetObject, s3:PutObject and s3:DeleteObject on ${displayIdent(s.bucket)}/_cdkd-registry/* to use it. Continuing.`;
+	const what = stage === "list" ? `S3 refused to list bucket ${displayIdent(s.bucket)}` : `S3 refused a read under another state prefix of bucket ${displayIdent(s.bucket)}`;
+	return `Could not check the other state prefixes for stack ${subjectText(s)}: ${what} (${errorName$1(error, "AccessDenied")}). Continuing. Deploying one stack name under two state prefixes in one account and region is unsupported.`;
+}
+function inProgressUnderOtherPrefixMessage(s, action, prefix) {
+	const account = recoveryCommandFlags({
+		profile: s.recovery?.profile,
+		stateBucket: s.recovery?.stateBucket ?? s.bucket
+	});
+	const unlock = pasteableCommand("cdkd force-unlock", [
+		{
+			value: s.stackName,
+			hole: "stack"
+		},
+		{
+			flag: "--stack-region",
+			value: s.region,
+			hole: "region"
+		},
+		{
+			flag: "--state-prefix",
+			value: prefix,
+			hole: "prefix"
+		}
+	], account.flags).command;
+	return `Refusing to ${VERB[action]} stack ${subjectText(s)}: bucket ${displayIdent(s.bucket)} assigns it to state prefix ${displayIdent(prefix)}, which records nothing for it yet but holds its lock, so a deploy there may be in progress. ${UNSUPPORTED_SENTENCE} ${NOTHING[action]} Re-run once that deploy has finished; if none is running, remove its lock with \`${unlock}\` and re-run.`;
+}
+function crossPrefixFailedMessage(s, action, error) {
+	return `Refusing to ${VERB[action]} stack ${subjectText(s)}: cdkd could not check whether the bucket ${displayIdent(s.bucket)} records it under another state prefix (${errorName$1(error, "an unknown error")}${failedKeyText(error)}). ${UNSUPPORTED_SENTENCE} ${NOTHING[action]} Re-run once the check can succeed.`;
+}
+function applyCrossPrefixScan(result, s, action, warn, info) {
+	if (result.kind !== "in-progress" && result.stale !== void 0 && result.stale.length > 0) info?.(staleRecordNotice(s, result.stale));
+	switch (result.kind) {
+		case "clear": return;
+		case "denied":
+			warn(crossPrefixDeniedWarning(s, result.error, result.stage));
+			return;
+		case "found": {
+			const message = action === "deploy" ? deployUnderOtherPrefixMessage(s, result.prefixes) : action === "deploy-destructive" || action === "deploy-late-replace" ? destructiveDeployUnderOtherPrefixMessage(s, result.prefixes, action) : destroyUnderOtherPrefixMessage(s, result.prefixes, action);
+			throw new CdkdError(message, STACK_UNDER_OTHER_PREFIX);
+		}
+		case "failed": throw new CdkdError(crossPrefixFailedMessage(s, action, result.error), STACK_UNDER_OTHER_PREFIX);
+		case "in-progress": throw new CdkdError(inProgressUnderOtherPrefixMessage(s, action, result.prefix), STACK_UNDER_OTHER_PREFIX);
+	}
+}
+
+//#endregion
+//#region src/state/earlier-state-versions.ts
+async function readEarlierStateResources(s3, bucket, owner, key, max) {
+	const versions = ((await s3.send(new ListObjectVersionsCommand({
+		Bucket: bucket,
+		...owner,
+		Prefix: key,
+		EncodingType: "url",
+		MaxKeys: max + 1
+	}))).Versions ?? []).filter((v) => decodeListingKey(v.Key) === key && typeof v.VersionId === "string").sort((a, b) => (b.LastModified?.getTime() ?? 0) - (a.LastModified?.getTime() ?? 0)).slice(0, max);
+	return (await Promise.all(versions.map(async (v) => {
+		const body = await (await s3.send(new GetObjectCommand({
+			Bucket: bucket,
+			...owner,
+			Key: key,
+			VersionId: v.VersionId
+		}))).Body?.transformToString();
+		if (body === void 0) return void 0;
+		try {
+			const parsed = JSON.parse(body);
+			if (parsed === null || typeof parsed.resources !== "object" || parsed.resources === null) return;
+			return {
+				resources: parsed.resources,
+				...v.LastModified instanceof Date && { writtenAt: v.LastModified.getTime() }
+			};
+		} catch {
+			return;
+		}
+	}))).filter((r) => r !== void 0);
+}
+
+//#endregion
+//#region src/state/retained-time.ts
+var RetainedTimeUnconfirmedError = class extends Error {
+	cause;
+	constructor(cause) {
+		super("the kept-resource record was written, but its time could not be confirmed from S3");
+		this.name = "RetainedTimeUnconfirmedError";
+		this.cause = cause;
+	}
+};
+
 //#endregion
 //#region src/utils/bucket-region-client.ts
 async function rebuildClientForBucketRegion(client, bucket, opts = {}) {
@@ -5014,12 +5419,14 @@ function legacyProbeBelongsTo(probe, region) {
 		case "unreadable": return false;
 	}
 }
-var S3StateBackend = class {
+const KEPT_AT_CLOCK_TOLERANCE_MS = 2e3;
+var S3StateBackend = class S3StateBackend {
 	logger = getLogger().child("S3StateBackend");
 	s3Client;
 	config;
 	clientOpts;
 	clientResolved = false;
+	scanClient;
 	resolveInFlight = null;
 	constructor(s3Client, config, clientOpts = {}) {
 		this.s3Client = s3Client;
@@ -5028,6 +5435,19 @@ var S3StateBackend = class {
 	}
 	destroyClient() {
 		this.s3Client.destroy();
+		this.scanClient?.destroy();
+	}
+	async clientForScan() {
+		await this.ensureClientForBucket();
+		if (this.scanClient !== void 0) return this.scanClient;
+		if (!(this.s3Client instanceof S3Client)) return this.s3Client;
+		const region = await this.s3Client.config.region();
+		this.scanClient = new S3Client({
+			...awsClientDefaults(this.clientOpts.profile ? { profile: this.clientOpts.profile } : {}),
+			region,
+			credentials: this.s3Client.config.credentials
+		});
+		return this.scanClient;
 	}
 	get prefix() {
 		return this.config.prefix;
@@ -5295,6 +5715,87 @@ var S3StateBackend = class {
 			throw new StateError(`Failed to list stacks: ${normalized.message}`, normalized);
 		}
 	}
+	async listTopLevelPrefixes() {
+		const client = await this.clientForScan();
+		const out = [];
+		let continuationToken;
+		do {
+			const response = await client.send(new ListObjectsV2Command({
+				Bucket: this.config.bucket,
+				...await this.ownerParam(),
+				Delimiter: "/",
+				EncodingType: "url",
+				...continuationToken && { ContinuationToken: continuationToken }
+			}));
+			for (const cp of response.CommonPrefixes ?? []) {
+				let decoded;
+				try {
+					decoded = decodeListingKey(cp.Prefix);
+				} catch {
+					this.logger.debug(safeMsg`Skipping a top-level prefix of bucket ${this.config.bucket} that is not valid URL encoding: ${cp.Prefix ?? ""}`);
+					continue;
+				}
+				if (decoded === void 0 || !decoded.endsWith("/")) continue;
+				if (decoded === `${"_cdkd-registry"}/`) continue;
+				out.push(decoded.slice(0, -1));
+			}
+			continuationToken = response.IsTruncated ? response.NextContinuationToken : void 0;
+		} while (continuationToken);
+		return out;
+	}
+	async recordUnderPrefix(prefix, stackName, region) {
+		const client = await this.clientForScan();
+		const sibling = new S3StateBackend(client, {
+			...this.config,
+			prefix
+		}, this.clientOpts);
+		sibling.clientResolved = true;
+		const stackDir = `${prefix}/${stackName}/`;
+		let listed;
+		try {
+			listed = await client.send(new ListObjectsV2Command({
+				Bucket: this.config.bucket,
+				...await this.ownerParam(),
+				Prefix: stackDir,
+				MaxKeys: 1,
+				EncodingType: "url"
+			}));
+		} catch (error) {
+			throw new CrossPrefixReadError(stackDir, error);
+		}
+		if ((listed.KeyCount ?? listed.Contents?.length ?? 0) === 0) return "absent";
+		const read = async (key) => {
+			let body;
+			try {
+				body = await sibling.getRawObject(key);
+			} catch (error) {
+				throw new CrossPrefixReadError(key, error);
+			}
+			if (body === null) return null;
+			if (body.trim() === "") throw new CrossPrefixReadError(key, Object.assign(/* @__PURE__ */ new Error("empty object"), { name: "EmptyObject" }));
+			let value;
+			try {
+				value = JSON.parse(body);
+			} catch (error) {
+				throw new CrossPrefixReadError(key, error);
+			}
+			if (value === null || typeof value !== "object" || Array.isArray(value)) throw new CrossPrefixReadError(key, /* @__PURE__ */ new TypeError("not a JSON object"));
+			return value;
+		};
+		const [scoped, legacy, journal] = await Promise.all([
+			read(sibling.getStateKey(stackName, region)),
+			read(sibling.getLegacyStateKey(stackName)),
+			read(sibling.getRollbackJournalKey(stackName, region))
+		]);
+		let record;
+		if (scoped !== null) record = scoped;
+		else if (legacy !== null) {
+			const bodyRegion = legacy["region"];
+			if (!bodyRegion || bodyRegion === region) record = legacy;
+		}
+		if (record === void 0 && journal === null) return "absent";
+		return recordCanOwnResources(record ?? { resources: {} }, journal) ? "holder" : "empty";
+	}
 	async putRawObject(key, body, contentType = "application/json") {
 		await this.ensureClientForBucket();
 		await this.s3Client.send(new PutObjectCommand({
@@ -5306,6 +5807,176 @@ var S3StateBackend = class {
 			ContentType: contentType
 		}));
 	}
+	async earlierStateResources(stackName, region, max = 10) {
+		await this.ensureClientForBucket();
+		return readEarlierStateResources(this.s3Client, this.config.bucket, await this.ownerParam(), this.getStateKey(stackName, region), max);
+	}
+	getRetainedKey(stackName, region) {
+		return `${this.config.prefix}/${stackName}/${region}/retained.json`;
+	}
+	async loadRetainedResources(stackName, region) {
+		return await this.loadRetainedRecord(stackName, region) ?? [];
+	}
+	async loadRetainedRecord(stackName, region) {
+		const key = this.getRetainedKey(stackName, region);
+		let body;
+		try {
+			body = await this.getRawObject(key);
+		} catch (error) {
+			throw new CrossPrefixReadError(key, error);
+		}
+		if (body === null) return null;
+		const entries = parseRetainedResources(body);
+		if (entries === void 0) throw new CrossPrefixReadError(key, Object.assign(/* @__PURE__ */ new Error("not a retained-resource record"), { name: "MalformedRecord" }));
+		return entries;
+	}
+	async ensureRetainedTombstone(stackName, region) {
+		await this.ensureClientForBucket();
+		const key = this.getRetainedKey(stackName, region);
+		const put = async () => this.s3Client.send(new PutObjectCommand({
+			Bucket: this.config.bucket,
+			...await this.ownerParam(),
+			Key: key,
+			Body: JSON.stringify({
+				retainedVersion: 1,
+				resources: []
+			}),
+			ContentType: "application/json",
+			IfNoneMatch: "*"
+		}));
+		try {
+			try {
+				await put();
+			} catch (error) {
+				if (!isConditionalConflict(error)) throw error;
+				await put();
+			}
+		} catch (error) {
+			if (isConditionFailure(error) && !isConditionalConflict(error)) return;
+			if (!isNotImplemented(error)) throw error;
+			if (await this.loadRetainedRecord(stackName, region) === null) await this.saveRetainedResources(stackName, region, []);
+		}
+	}
+	async saveRetainedResources(stackName, region, entries) {
+		await this.ensureClientForBucket();
+		const key = this.getRetainedKey(stackName, region);
+		const put = (resources) => this.ownerParam().then((owner) => this.s3Client.send(new PutObjectCommand({
+			Bucket: this.config.bucket,
+			...owner,
+			Key: key,
+			Body: JSON.stringify({
+				retainedVersion: 1,
+				resources
+			}),
+			ContentType: "application/json"
+		})));
+		const fresh = new Set(entries.filter((e) => e.keptAt === void 0));
+		const provisional = Date.now();
+		await put(entries.map((e) => fresh.has(e) ? {
+			...e,
+			keptAt: provisional
+		} : e));
+		if (fresh.size === 0) return;
+		try {
+			const head = await this.s3Client.send(new HeadObjectCommand({
+				Bucket: this.config.bucket,
+				...await this.ownerParam(),
+				Key: key
+			}));
+			const keptAt = head.LastModified instanceof Date ? head.LastModified.getTime() : void 0;
+			if (keptAt === void 0) throw new Error("S3 reported no LastModified");
+			if (Math.abs(keptAt - provisional) <= KEPT_AT_CLOCK_TOLERANCE_MS) return;
+			await put(entries.map((e) => fresh.has(e) ? {
+				...e,
+				keptAt
+			} : e));
+		} catch (error) {
+			throw new RetainedTimeUnconfirmedError(error);
+		}
+	}
+	registryMarkerKey(stackName, region) {
+		return `${REGISTRY_ROOT}/${region}/${stackName}.json`;
+	}
+	async getRegistryMarker(stackName, region) {
+		await this.ensureClientForBucket();
+		const key = this.registryMarkerKey(stackName, region);
+		let body;
+		let etag;
+		try {
+			const response = await this.s3Client.send(new GetObjectCommand({
+				Bucket: this.config.bucket,
+				...await this.ownerParam(),
+				Key: key
+			}));
+			body = await response.Body?.transformToString();
+			etag = response.ETag;
+		} catch (error) {
+			if (isNoSuchKey(error) || error.name === "NotFound") return null;
+			throw new CrossPrefixReadError(key, error);
+		}
+		const prefix = registryMarkerPrefix(body);
+		if (prefix === void 0 || etag === void 0) throw new CrossPrefixReadError(key, Object.assign(/* @__PURE__ */ new Error("not a registry marker"), { name: "MalformedMarker" }));
+		return {
+			prefix,
+			etag
+		};
+	}
+	async claimRegistryMarker(stackName, region, ifMatch) {
+		await this.ensureClientForBucket();
+		const key = this.registryMarkerKey(stackName, region);
+		try {
+			await this.s3Client.send(new PutObjectCommand({
+				Bucket: this.config.bucket,
+				...await this.ownerParam(),
+				Key: key,
+				Body: JSON.stringify({ prefix: this.config.prefix }),
+				ContentType: "application/json",
+				...ifMatch === void 0 ? { IfNoneMatch: "*" } : { IfMatch: ifMatch }
+			}));
+			return "claimed";
+		} catch (error) {
+			if (isConditionFailure(error)) return "conflict";
+			throw new CrossPrefixReadError(key, error);
+		}
+	}
+	async releaseRegistryMarker(stackName, region, known) {
+		const marker = known !== void 0 && (known === null || known.etag !== "") ? known : await this.getRegistryMarker(stackName, region);
+		if (marker === null) return "absent";
+		if (marker.prefix !== this.config.prefix) return "elsewhere";
+		const key = this.registryMarkerKey(stackName, region);
+		try {
+			await this.s3Client.send(new DeleteObjectCommand({
+				Bucket: this.config.bucket,
+				...await this.ownerParam(),
+				Key: key,
+				IfMatch: marker.etag
+			}));
+			return "released";
+		} catch (error) {
+			if (isConditionFailure(error)) return "elsewhere";
+			if (!isNotImplemented(error)) throw error;
+		}
+		const again = await this.getRegistryMarker(stackName, region);
+		if (again === null) return "absent";
+		if (again.prefix !== this.config.prefix || again.etag !== marker.etag) return "elsewhere";
+		await this.s3Client.send(new DeleteObjectCommand({
+			Bucket: this.config.bucket,
+			...await this.ownerParam(),
+			Key: key
+		}));
+		return "released";
+	}
+	async lockUnderPrefix(prefix, stackName, region) {
+		await this.ensureClientForBucket();
+		const keys = [`${prefix}/${stackName}/${region}/lock.json`, `${prefix}/${stackName}/lock.json`];
+		return (await Promise.all(keys.map(async (key) => {
+			try {
+				return await this.headObject(key);
+			} catch (error) {
+				throw new CrossPrefixReadError(key, error);
+			}
+		}))).some(Boolean);
+	}
 	async getRawObject(key) {
 		await this.ensureClientForBucket();
 		try {
@@ -5750,6 +6421,53 @@ var S3StateBackend = class {
 		return parsed;
 	}
 };
+function parseRetainedResources(body) {
+	let value;
+	try {
+		value = JSON.parse(body);
+	} catch {
+		return;
+	}
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const doc = value;
+	if (doc.retainedVersion !== 1 || !Array.isArray(doc.resources)) return void 0;
+	const out = [];
+	for (const entry of doc.resources) {
+		const e = entry;
+		if (typeof e?.logicalId === "string" && typeof e.resourceType === "string" && typeof e.physicalId === "string" && e.physicalId !== "") out.push({
+			logicalId: e.logicalId,
+			resourceType: e.resourceType,
+			physicalId: e.physicalId,
+			...typeof e.keptAt === "number" && Number.isFinite(e.keptAt) && { keptAt: e.keptAt }
+		});
+	}
+	return out;
+}
+const REGISTRY_ROOT = "_cdkd-registry";
+function registryMarkerPrefix(body) {
+	if (body === void 0) return void 0;
+	let value;
+	try {
+		value = JSON.parse(body);
+	} catch {
+		return;
+	}
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const prefix = value.prefix;
+	if (typeof prefix !== "string" || prefix.length > 1024) return void 0;
+	if (/[\u0000-\u001f\u007f<>]/.test(prefix)) return void 0;
+	return prefix;
+}
+function isConditionalConflict(error) {
+	const name = error?.name;
+	const status = error?.$metadata?.httpStatusCode;
+	return name === "ConditionalRequestConflict" || status === 409 && name !== "PreconditionFailed";
+}
+function isConditionFailure(error) {
+	const name = error?.name;
+	const status = error?.$metadata?.httpStatusCode;
+	return name === "PreconditionFailed" || name === "ConditionalRequestConflict" || status === 412 || status === 409;
+}
 function isNoSuchKey(error) {
 	if (error instanceof NoSuchKey) return true;
 	return error?.name === "NoSuchKey";
@@ -5768,6 +6486,15 @@ function addSupersededIds(segment, ids) {
 const MAX_RENEWAL_INTERVAL_MS = 12e4;
 const RENEWAL_TTL_FRACTION = 4;
 const MIN_RENEWAL_INTERVAL_MS = 1e3;
+function renewalIntervalFor(ttlMs) {
+	return Math.max(MIN_RENEWAL_INTERVAL_MS, Math.min(MAX_RENEWAL_INTERVAL_MS, Math.floor(ttlMs / RENEWAL_TTL_FRACTION)));
+}
+function abandonedRunHorizon(record) {
+	if (record.lastModified === void 0) return void 0;
+	const ttlMs = Number(record.info.expiresAt) - record.lastModified;
+	const interval = Number.isFinite(ttlMs) && ttlMs > 0 ? renewalIntervalFor(ttlMs) : MAX_RENEWAL_INTERVAL_MS;
+	return record.lastModified + interval;
+}
 const RELEASED_LOCK_REACQUIRE_LIMIT = 3;
 const LOCK_OBJECT_DESCRIPTION = "a stack lock heartbeat, which records the lock owner, its acquisition timestamp, its deadline and the operation name — no secret, but one row per renewal";
 function safeSegment(value) {
@@ -5791,6 +6518,7 @@ var LockManager = class {
 	renewalIntervalMs;
 	renewalDisabled;
 	heldLocks = /* @__PURE__ */ new Map();
+	abandonedLocks = /* @__PURE__ */ new Map();
 	clientResolved = false;
 	resolveInFlight = null;
 	constructor(s3Client, config, options) {
@@ -5800,7 +6528,7 @@ var LockManager = class {
 		if (!(ttlMinutes > 0) || !Number.isFinite(ttlMinutes)) throw new LockError(`Lock TTL must be a positive number of minutes (got ${String(ttlMinutes)}). A non-positive TTL makes every lock born expired, and the renewal interval clamps to its floor, so the heartbeat would spin one request per second for the life of the process.`);
 		this.ttlMs = ttlMinutes * 60 * 1e3;
 		this.renewalDisabled = options?.disableRenewal === true;
-		this.renewalIntervalMs = Math.max(MIN_RENEWAL_INTERVAL_MS, Math.min(MAX_RENEWAL_INTERVAL_MS, Math.floor(this.ttlMs / RENEWAL_TTL_FRACTION)));
+		this.renewalIntervalMs = renewalIntervalFor(this.ttlMs);
 	}
 	async ownerParam() {
 		return expectedOwnerParam(this.s3Client);
@@ -5889,6 +6617,8 @@ var LockManager = class {
 					}
 					const why = Number.isFinite(existing.info.expiresAt) ? "A live cdkd process renews its lock well inside the TTL, so this normally means the previous owner crashed or was suspended" : `Its expiresAt is not a finite number, which cdkd treats as already expired`;
 					this.logger.warn(`Took over an EXPIRED lock for stack: ${safeSegment(stackName)} (${safeSegment(region)}, owner: ${formatLockOwner(existing.info.owner)}, ${formatLockExpiry(existing.info.expiresAt)}). ${why} -- if it is in fact still running, both processes are now writing to the same stack.`);
+					const abandonedAt = abandonedRunHorizon(existing);
+					if (abandonedAt !== void 0) this.abandonedLocks.set(key, abandonedAt);
 					try {
 						const retryEtag = await this.putLockObject(key, lockInfo);
 						this.logger.debug(`Lock acquired for stack: ${stackRef(stackName, region)} after expired lock cleanup, owner: ${displaySafe(lockOwner)}`);
@@ -5959,7 +6689,8 @@ var LockManager = class {
 			this.logger.debug(`Lock info for stack: ${shownStack}:`, lockInfo);
 			return {
 				info: lockInfo,
-				etag: response.ETag
+				etag: response.ETag,
+				...response.LastModified instanceof Date && { lastModified: response.LastModified.getTime() }
 			};
 		} catch (error) {
 			if (error instanceof NoSuchKey) {
@@ -6042,9 +6773,13 @@ var LockManager = class {
 	sameLockIdentity(a, b) {
 		return displaySafe(a.owner) === displaySafe(b.owner) && a.timestamp === b.timestamp;
 	}
-	async forceReleaseLock(stackName, region) {
+	abandonedRunEndedBy(stackName, region) {
+		return this.abandonedLocks.get(this.getLockKey(stackName, region));
+	}
+	async forceReleaseLock(stackName, region, beforeDelete) {
 		const where = stackRef(stackName, region);
-		const lockInfo = await this.getLockInfo(stackName, region).catch(() => null);
+		const record = await this.getLockRecord(stackName, region).catch(() => null);
+		const lockInfo = record?.info ?? null;
 		this.logger.warn(lockInfo ? `Force releasing lock for stack: ${where}, owner: ${formatLockOwner(lockInfo.owner)}${lockInfo.operation ? `, operation: ${formatLockOperation(lockInfo.operation)}` : ""}, expired: ${this.isLockExpired(lockInfo)}` : `Force releasing lock for stack: ${where} (no lock body read — absent or unparseable; deleting the object either way, since a lock cdkd cannot read is a lock nothing else can clear)`);
 		const key = this.getLockKey(stackName, region);
 		const held = this.heldLocks.get(key);
@@ -6052,11 +6787,14 @@ var LockManager = class {
 			this.stopRenewal(held);
 			held.releasing = Promise.resolve();
 		}
+		const horizon = record ? abandonedRunHorizon(record) : void 0;
+		if (horizon !== void 0 && beforeDelete !== void 0) await beforeDelete(horizon).catch(() => void 0);
 		try {
 			await this.deleteLock(stackName, region);
 		} finally {
 			await this.purgeLockVersions(key, "reap");
 		}
+		return horizon;
 	}
 	async deleteLock(stackName, region, etag) {
 		await this.ensureClientForBucket();
@@ -11311,7 +12049,7 @@ const DERIVED_GENERATED_NAMES = {
 	},
 	"AWS::S3::Bucket": {
 		file: "s3-bucket-provider.ts",
-		source: "generateResourceName(logicalId, {\n        maxLength: 63,\n        lowercase: true,\n        allowedPattern: /[^a-z0-9.-]/g,\n      })",
+		source: "generateResourceName(logicalId, {\n      maxLength: 63,\n      lowercase: true,\n      allowedPattern: /[^a-z0-9.-]/g,\n    })",
 		derive: (id) => generateResourceName(id, {
 			maxLength: 63,
 			lowercase: true,
@@ -22972,7 +23710,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-B3zcS87C.js");
+			const { ASGProvider } = await import("./asg-provider-BaabA371.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -23078,7 +23816,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-BfQsw4hw.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DF6Eh4Tl.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-IBY6fDvN.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-5yc_bOJ-.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -25661,7 +26399,7 @@ const NESTED_REQUIRED = /* @__PURE__ */ new Map([
 		["ContainerDefinitions.LinuxParameters.Tmpfs", ["Size"]],
 		["ContainerDefinitions.LogConfiguration", ["LogDriver"]],
 		["ContainerDefinitions.LogConfiguration.SecretOptions", ["Name", "ValueFrom"]],
-		["ContainerDefinitions.ResourceRequirements", ["Type", "Value"]],
+		["ContainerDefinitions.ResourceRequirements", ["Type"]],
 		["ContainerDefinitions.Secrets", ["Name", "ValueFrom"]],
 		["ContainerDefinitions.Ulimits", [
 			"HardLimit",
@@ -27003,9 +27741,12 @@ var ProviderRegistry = class {
 		this.providers.delete(resourceType);
 	}
 	getProviderFor(input) {
+		const debug = (message) => {
+			if (input.quiet !== true) this.logger.debug(message);
+		};
 		const { resourceType, properties, provisionedBy } = input;
 		if (isCustomResource(resourceType)) {
-			this.logger.debug(`Using Custom Resource provider for ${resourceType}`);
+			debug(`Using Custom Resource provider for ${resourceType}`);
 			return {
 				provider: this.customResourceProvider,
 				provisionedBy: "sdk"
@@ -27020,7 +27761,7 @@ var ProviderRegistry = class {
 				allowedUnsupportedProperties: this.allowedUnsupportedProperties,
 				forceCcApi: input.forceCcApi === true
 			})) {
-				this.logger.debug(`Routing ${resourceType} via Cloud Control (state-recorded provisionedBy=cc-api)`);
+				debug(`Routing ${resourceType} via Cloud Control (state-recorded provisionedBy=cc-api)`);
 				return {
 					provider: this.cloudControlProvider,
 					provisionedBy: "cc-api"
@@ -27032,9 +27773,9 @@ var ProviderRegistry = class {
 		if (specificProvider) {
 			const actionableDrops = findActionableSilentDrops(resourceType, properties, this.allowedUnsupportedProperties, input.previousProperties);
 			if (actionableDrops.length === 0) {
-				this.logger.debug(`Using specific SDK provider for ${resourceType}`);
+				debug(`Using specific SDK provider for ${resourceType}`);
 				if (returningToSdk) {
-					this.logger.debug(`${resourceType} is returning to its SDK provider from a state-recorded cc-api route; physical id is preserved`);
+					debug(`${resourceType} is returning to its SDK provider from a state-recorded cc-api route; physical id is preserved`);
 					return {
 						provider: specificProvider,
 						provisionedBy: "sdk",
@@ -27048,7 +27789,7 @@ var ProviderRegistry = class {
 			}
 			const unroutable = this.ccRouteUnavailableReason(resourceType);
 			if (unroutable !== void 0) throw new Error(this.buildUnroutableSilentDropMessage(resourceType, actionableDrops, unroutable));
-			this.logger.debug(`Auto-routing ${resourceType} via Cloud Control (silent-drop properties: ${actionableDrops.map((d) => d.property).join(", ")})`);
+			debug(`Auto-routing ${resourceType} via Cloud Control (silent-drop properties: ${actionableDrops.map((d) => d.property).join(", ")})`);
 			return {
 				provider: this.cloudControlProvider,
 				provisionedBy: "cc-api",
@@ -27056,14 +27797,14 @@ var ProviderRegistry = class {
 			};
 		}
 		if (CloudControlProvider.isSupportedResourceType(resourceType)) {
-			this.logger.debug(`Using Cloud Control API provider for ${resourceType}`);
+			debug(`Using Cloud Control API provider for ${resourceType}`);
 			return {
 				provider: this.cloudControlProvider,
 				provisionedBy: "cc-api"
 			};
 		}
 		if (this.allowedUnsupportedTypes.has(resourceType)) {
-			this.logger.debug(`Routing escape-hatch-allowed type ${resourceType} through Cloud Control API`);
+			debug(`Routing escape-hatch-allowed type ${resourceType} through Cloud Control API`);
 			return {
 				provider: this.cloudControlProvider,
 				provisionedBy: "cc-api"
@@ -27336,7 +28077,7 @@ function recordedTagsUnreadableWarning(resourceType, id, applied) {
 //#endregion
 //#region src/provisioning/providers/idempotency-token.ts
 const PROCESS_NONCE = randomUUID();
-const inFlight = /* @__PURE__ */ new Map();
+const inFlight$1 = /* @__PURE__ */ new Map();
 const generations = /* @__PURE__ */ new Map();
 const MAX_TRACKED_GENERATIONS = 1e5;
 const tokenKey = (scope, logicalId, maxLength, charset) => injectiveKey(scope, ambientRegion() ?? "", getCurrentStackName() ?? "", logicalId, maxLength, charset);
@@ -27347,14 +28088,14 @@ const derive = (key, generation, maxLength, charset) => {
 function acquireIdempotencyToken(options) {
 	const { scope, logicalId, maxLength = 64, charset = "default" } = options;
 	const key = tokenKey(scope, logicalId, maxLength, charset);
-	const existing = inFlight.get(key);
+	const existing = inFlight$1.get(key);
 	const value = existing ?? derive(key, generations.get(key) ?? 0, maxLength, charset);
-	if (existing === void 0) inFlight.set(key, value);
+	if (existing === void 0) inFlight$1.set(key, value);
 	return {
 		value,
 		release: () => {
-			if (!inFlight.has(key)) return;
-			inFlight.delete(key);
+			if (!inFlight$1.has(key)) return;
+			inFlight$1.delete(key);
 			const generation = (generations.get(key) ?? 0) + 1;
 			if (!generations.has(key) && generations.size >= MAX_TRACKED_GENERATIONS) {
 				const oldest = generations.keys().next();
@@ -27379,6 +28120,7 @@ function stackScopedCreateToken(options) {
 //#region src/provisioning/providers/create-token-ledger.ts
 var CreateTokenLedger = class {
 	doc;
+	loadedAbsent = false;
 	stale = false;
 	startedThisDeploy = false;
 	replaceRecordedLedger = false;
@@ -27404,8 +28146,10 @@ var CreateTokenLedger = class {
 	}
 	async current() {
 		if (this.doc !== void 0 && !this.stale) return this.doc;
+		if (this.loadedAbsent && !this.stale) return null;
 		const loaded = await this.store.load();
 		this.stale = false;
+		this.loadedAbsent = loaded === null;
 		if (loaded !== null && this.replaceRecordedLedger && loaded.stateRecorded === true) {
 			this.logger.info("This stack has no state record but its create-token ledger outlived an earlier one; starting a fresh ledger, so this deploy does not take over resources that deployment left.");
 			this.doc = emptyCreateTokenLedger(randomUUID());
@@ -27492,6 +28236,85 @@ var CreateTokenLedger = class {
 			}
 		});
 	}
+	sentEntries() {
+		return this.serialized(async () => {
+			try {
+				return { ...(await this.current())?.sent ?? {} };
+			} catch (error) {
+				this.stale = true;
+				throw error;
+			}
+		});
+	}
+	recordSent(entries, firstSentAt) {
+		return this.serialized(async () => {
+			try {
+				let doc = await this.current();
+				if (doc === null) {
+					doc = emptyCreateTokenLedger(randomUUID());
+					this.doc = doc;
+					this.startedThisDeploy = true;
+				}
+				let changed = false;
+				for (const entry of entries) {
+					const recorded = doc.sent[entry.logicalId];
+					if (recorded?.base === entry.base && recorded.token === entry.token) continue;
+					doc.sent[entry.logicalId] = {
+						base: entry.base,
+						token: entry.token,
+						firstSentAt
+					};
+					changed = true;
+				}
+				if (changed) await this.persist(doc);
+			} catch (error) {
+				this.stale = true;
+				throw error;
+			}
+		});
+	}
+	abandonedAt() {
+		return this.serialized(async () => (await this.current())?.abandonedAt);
+	}
+	noteAbandoned(at) {
+		return this.serialized(async () => {
+			try {
+				const doc = await this.current();
+				if (doc === null) return;
+				if (!Object.values(doc.sent).some((e) => e.base.startsWith("adopt-by-name:")) || doc.abandonedAt !== void 0 && doc.abandonedAt >= at) return;
+				doc.abandonedAt = at;
+				await this.persist(doc);
+			} catch (error) {
+				this.stale = true;
+				throw error;
+			}
+		});
+	}
+	settleAdoptingCreates(drop, failedAt) {
+		return this.serialized(async () => {
+			try {
+				const doc = await this.current();
+				if (doc === null) return;
+				const adopting = (id) => doc.sent[id]?.base.startsWith(ADOPTING_CREATE_BASE) === true;
+				let changed = false;
+				for (const id of drop) {
+					if (!adopting(id)) continue;
+					delete doc.sent[id];
+					changed = true;
+				}
+				for (const [id, at] of failedAt) {
+					const entry = adopting(id) ? doc.sent[id] : void 0;
+					if (entry === void 0 || entry.failedAt !== void 0) continue;
+					entry.failedAt = at;
+					changed = true;
+				}
+				if (changed) await this.persist(doc);
+			} catch (error) {
+				this.stale = true;
+				throw error;
+			}
+		});
+	}
 	forget(logicalIds) {
 		return this.serialized(async () => {
 			try {
@@ -27537,6 +28360,39 @@ function ledgerForStack(backend, stackName, region) {
 	});
 }
 const ledgerStore = new AsyncLocalStorage();
+const ADOPTING_CREATE_BASE = "adopt-by-name:";
+async function recordedAdoptingCreates() {
+	const ledger = ledgerStore.getStore();
+	if (ledger === void 0) return void 0;
+	const out = /* @__PURE__ */ new Map();
+	for (const [logicalId, entry] of Object.entries(await ledger.sentEntries())) if (entry.base.startsWith("adopt-by-name:")) out.set(logicalId, {
+		resourceType: entry.base.slice(14),
+		name: entry.token,
+		firstSentAt: entry.firstSentAt,
+		...entry.failedAt !== void 0 && { failedAt: entry.failedAt }
+	});
+	return out;
+}
+async function recordAdoptingCreates(creates) {
+	const ledger = ledgerStore.getStore();
+	if (ledger === void 0 || creates.length === 0) return;
+	await ledger.recordSent(creates.map((c) => ({
+		logicalId: c.logicalId,
+		base: `${ADOPTING_CREATE_BASE}${c.resourceType}`,
+		token: c.name
+	})), Date.now());
+}
+async function noteAbandonedRun(at) {
+	const ledger = ledgerStore.getStore();
+	if (ledger === void 0) return true;
+	return ledger.noteAbandoned(at).then(() => true, () => false);
+}
+async function ledgerAbandonedAt() {
+	return ledgerStore.getStore()?.abandonedAt();
+}
+async function settleAdoptingCreates(drop, failedAt = /* @__PURE__ */ new Map()) {
+	await ledgerStore.getStore()?.settleAdoptingCreates(drop, failedAt);
+}
 function withCreateTokenLedger(ledger, fn) {
 	return ledgerStore.run(ledger, () => withStateSavedObserver((stackName, region) => ledger.noteStateSaved(stackName, region), fn));
 }
@@ -28280,6 +29136,25 @@ function skipUnaddressableReplay(scope, logger, op, what, source = "record") {
 	logger.warn(safeMsg`  Rollback: Cannot ${what} ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}) ` + "— its state record has no non-empty string 'physicalId', so cdkd cannot address it in AWS and sent nothing for it. The resource and its state record are left exactly as they are. Repair the record's 'physicalId' (inspect it with `cdkd state show`), then re-converge it with `cdkd deploy`.");
 	recordRollbackSkip(scope, op, UNADDRESSABLE_SKIP_CAUSE);
 }
+async function keptForAnotherHolder(scope, logger, op, physicalId) {
+	const ask = scope.ctx.createdResourceHolder;
+	if (ask === void 0) return false;
+	let holding;
+	try {
+		holding = await ask(op.resourceType, physicalId);
+	} catch {
+		holding = {
+			kind: "unreadable",
+			what: "the other stacks' state records (the check failed)"
+		};
+	}
+	if (holding === void 0) return false;
+	const why = holding.kind === "held" ? `${holding.by} holds it` : `${holding.what}, so it is not known whether another deployment owns it`;
+	const retry = holding.kind === "unreadable" && holding.retryable === true ? scope.ctx.createdResourceRetryCommand : void 0;
+	logger.warn(safeMsg`  Rollback: Keeping created resource ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}) ` + safeMsg`\u2014 ${why}. The failed deploy may have adopted a resource that existed under its name, so the rollback does not delete it; the rollback journal keeps it.` + (retry === void 0 ? "" : safeMsg` Once S3 can be read, finish the rollback with: ${retry}`));
+	recordRollbackSkip(scope, op, "Another state record holds this resource, or it could not be checked, so the rollback did not delete it.");
+	return true;
+}
 function effectiveProvisionedBy(record, fallbackProvisionedBy) {
 	return record?.provisionedBy ?? fallbackProvisionedBy;
 }
@@ -30644,6 +31519,7 @@ async function replayDelete(s) {
 		skipUnaddressableReplay(s, logger, op, "delete created resource");
 		return;
 	}
+	if (await keptForAnotherHolder(s, logger, op, op.physicalId)) return;
 	s.createRollbackRoute = deleteProvisionedBy;
 	const snapshotPolicy = action === "delete-with-final-snapshot";
 	const takeFinalSnapshot = snapshotPolicy && ctx.skipFinalSnapshot !== true;
@@ -31440,6 +32316,10 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						skipUnaddressableReplay(skipScope, logger, op, "delete partially-created resource", failedCreateRecord ? "record" : "journal");
 						break;
 					}
+					if (await keptForAnotherHolder(skipScope, logger, op, op.physicalId)) {
+						pending.add(op);
+						break;
+					}
 					const orphanDeleteChecked = op.physicalIdRecoveredFromError === true && ctx.foreignHolder !== void 0 && ctx.orphanDeleteProven?.has(op) !== true;
 					if (orphanDeleteChecked) {
 						const verdict = await journaledOrphanKeepReason({
@@ -32636,7 +33516,16 @@ async function performRollback(completedOperations, stateResources, stackName, p
 		operations: completedOperations,
 		failedOperations: orphanOps
 	}], priorOrphans);
-	const ctx = this.rollbackExecutorContext(previousState, stackName);
+	const crossPrefixHolder = this.options.crossPrefixHolder;
+	let crossPrefixAnswer;
+	const ctx = {
+		...this.rollbackExecutorContext(previousState, stackName),
+		createdResourceRetryCommand: pasteableCommand("cdkd rollback", [{
+			value: (this.options.parentStackInfo?.parentStack ?? stackName).split("~")[0],
+			hole: "stack"
+		}], recoveryCommandFlags(this.options.refusalRecovery).flags).command,
+		createdResourceHolder: crossPrefixHolder === void 0 ? void 0 : () => crossPrefixAnswer ??= crossPrefixHolder(stackName)
+	};
 	const inlinePolicyWriters = new RollbackInlinePolicyWriters();
 	const runId = this.options.eventRecorder?.runId;
 	const { result, failed, run } = await withNestedRevertRun(runId, async (scope) => {
@@ -32666,6 +33555,21 @@ async function performRollback(completedOperations, stateResources, stackName, p
 		remainingFailedOps: failedOperations.filter((_, i) => !handled.has(i))
 	};
 }
+function foreignHolderResolver(engine) {
+	const sameBucketHolderFor = makeForeignHolderScan(engine.stateBackend);
+	const crossPrefixHolder = engine.options.crossPrefixHolder;
+	const crossPrefixAnswers = /* @__PURE__ */ new Map();
+	return (self) => async (resourceType, physicalId) => {
+		const held = await sameBucketHolderFor(self)(resourceType, physicalId);
+		if (held !== void 0 || crossPrefixHolder === void 0) return held;
+		let answer = crossPrefixAnswers.get(self.stackName);
+		if (answer === void 0) {
+			answer = crossPrefixHolder(self.stackName);
+			crossPrefixAnswers.set(self.stackName, answer);
+		}
+		return answer;
+	};
+}
 async function settleJournalAfterSuccess(stackName, completedOperations, previousState, finalResources, initialDeploy) {
 	if (this.options.parentStackInfo) {
 		await this.writeRollbackJournalSegment(stackName, completedOperations, [], NESTED_PENDING_PARENT_REASON, initialDeploy, nestedPendingSnapshot(previousState, (name) => {
@@ -32677,7 +33581,7 @@ async function settleJournalAfterSuccess(stackName, completedOperations, previou
 		return 0;
 	}
 	let nestedLeft = 0;
-	const foreignHolderFor = makeForeignHolderScan(this.stateBackend);
+	const foreignHolderFor = foreignHolderResolver(this);
 	const deployRunId = this.options.eventRecorder?.runId;
 	const stripOnFailure = /* @__PURE__ */ new Map();
 	const [ownLeft] = await Promise.all([(async () => {
@@ -34197,6 +35101,13 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 	});
 	const createProvider = createDecision.provider;
 	const createProps = createDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
+	await refuseUnlicensedGeneratedName.call(this, {
+		logicalId,
+		resourceType,
+		stackName,
+		createdVia: createDecision.provisionedBy,
+		resolvedProps
+	});
 	await refuseTakenCreateName.call(this, {
 		logicalId,
 		resourceType,
@@ -34207,7 +35118,15 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 		secrets: createSecrets,
 		stateResources
 	});
-	const result = await this.withRetry(() => withCurrentResourceSecrets(createSecrets, () => createProvider.create(logicalId, resourceType, createProps, { maskSecrets: createSecretMasker(createSecrets) })), logicalId, void 0, void 0, createProvider);
+	this.generatedNameGuard?.noteSent(logicalId);
+	let result;
+	try {
+		result = await this.withRetry(() => withCurrentResourceSecrets(createSecrets, () => createProvider.create(logicalId, resourceType, createProps, { maskSecrets: createSecretMasker(createSecrets) })), logicalId, void 0, void 0, createProvider);
+	} catch (error) {
+		this.generatedNameGuard?.noteFailed(logicalId, error);
+		throw error;
+	}
+	this.generatedNameGuard?.noteReturned(logicalId);
 	this.registerNoEchoAttributes(logicalId, result, createSecrets, resolvedProps);
 	const dependencies = this.extractAllDependencies(template, logicalId);
 	const templateAttrs = this.extractTemplateAttributes(template, logicalId);
@@ -34235,6 +35154,46 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 	renderer.removeTask(logicalId);
 	this.logger.info(`${createPrefix}${formatResourceLine("created", logicalId, resourceType)}`);
 }
+async function refuseUnlicensedGeneratedName(input) {
+	const { logicalId, resourceType } = input;
+	const asked = this.generatedNameGuard?.candidate(logicalId);
+	if (asked === void 0 || input.createdVia === "cc-api") return;
+	const verdict = await this.generatedNameGuard.admit(logicalId, input.resolvedProps);
+	if (verdict === void 0) return;
+	const subject = `${displaySafe(logicalId)} (${displaySafe(resourceType)})`;
+	const named = `the cdkd-generated ${asked.property ?? "name"} ${displaySafe(asked.name)}`;
+	const adoptsText = "its create API hands back or overwrites an existing resource of that name instead of refusing it";
+	const refuse = (message) => {
+		throw markNonRetryable(markRefusedBeforeApplying(new CdkdError(message, "GENERATED_NAME_HELD")));
+	};
+	switch (verdict.kind) {
+		case "free":
+		case "licensed": return;
+		case "unchecked":
+			this.logger.warn(safeMsg`${subject} is created with ${named} without checking whether another resource already ` + safeMsg`holds it: the lookup was refused (${describeAwsFailure(verdict.error).summary}). ` + "Grant this identity the type's Describe / List permission to have cdkd refuse taking over another deployment's resource.");
+			return;
+		case "failed":
+			if (isInterruptedWaitError(verdict.error)) throw verdict.error;
+			return refuse(`${subject} is created with ${named}, and ${adoptsText}, but cdkd could not check whether another resource already holds it (${describeAwsFailure(verdict.error).summary}). ${displaySafe(logicalId)} was not created. Re-run the deploy once the check can succeed.`);
+		case "held": {
+			const nested = input.stackName.includes("~");
+			const top = input.stackName.split("~")[0];
+			const importLine = nested ? `adopt it through the top-level stack ${quotedOrDescribed(top, "stack name")} with \`cdkd import\`` : `adopt it with \`${pasteableCommand("cdkd import", [{
+				value: input.stackName,
+				hole: "stack"
+			}, {
+				flag: "--resource",
+				value: `${logicalId}=${verdict.holder}`,
+				hole: "logicalId=physicalId"
+			}], recoveryCommandFlags(this.options.refusalRecovery).flags).command}\``;
+			if (verdict.ownIntent !== void 0) {
+				const why = verdict.ownIntent === "abandoned" ? "a deploy of this stack that was killed or force-unlocked" : "a create of this stack that came back failed (a timeout or a server error)";
+				return refuse(`${subject} would be created with ${named}, which an existing resource (${displaySafe(verdict.holder)}) already holds. This stack's create-token ledger records that ${why} sent this name, but this type reports no creation time, so cdkd cannot tell that resource is the one it made rather than another deployment's created since. Since ${adoptsText}, creating it would take that resource over. ${displaySafe(logicalId)} was not created. The likely cause: the resource is this stack's own, from that deploy. If it is, ${importLine} and re-run; if it is not, this stack is also deployed under another state backend (go-to-k/cdkd#4705).`);
+			}
+			return refuse(`${subject} would be created with ${named}, which an existing resource (${displaySafe(verdict.holder)}) already holds, and nothing this stack records names that resource: not its state, its rollback journal or create-token ledger, nor what a destroy of it under this state prefix kept. Since ${adoptsText}, creating it would take that resource over, as CloudFormation refuses with "already exists". ${displaySafe(logicalId)} was not created. The likely cause: this stack is also deployed under another state backend (another --state-prefix, --state-bucket or account), where cdkd generates the same names. One stack name per account and region is supported (go-to-k/cdkd#4705): deploy it under one backend only, or give this stack another name. If the resource is this stack's own, ${importLine} and re-run.`);
+		}
+	}
+}
 async function refuseTakenCreateName(input) {
 	const { logicalId, resourceType, secrets } = input;
 	const question = createNameQuestion({
@@ -34517,6 +35476,9 @@ function isResourceNotFoundError(error) {
 
 //#endregion
 //#region src/provisioning/providers/dynamodb-globaltable-provider.ts
+function isTableName(id) {
+	return /^[A-Za-z0-9_.-]{3,255}$/.test(id);
+}
 const DRIFT_STRIPPED_INDEX_MEMBERS = [{
 	listKey: "GlobalSecondaryIndexes",
 	member: "WarmThroughput"
@@ -34757,8 +35719,9 @@ var DynamoDBGlobalTableProvider = class {
 			toSdkReplicaThroughputOverrides(replica, billingMode, diagnostics, {}, maskSecrets);
 		}
 		this.reportThroughputDiagnostics(diagnostics, logicalId, tableName, maskSecrets);
+		let createdTableId;
 		try {
-			await (await this.getCreateClient()).send(new CreateTableCommand(createParams));
+			createdTableId = (await (await this.getCreateClient()).send(new CreateTableCommand(createParams)))?.TableDescription?.TableId;
 			log.debug(`CreateTable initiated for ${log.value(tableName)}, waiting for ACTIVE`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -34834,7 +35797,7 @@ var DynamoDBGlobalTableProvider = class {
 			markAuxiliaryFailure(wiringError, logicalId);
 			const cause = wiringError instanceof Error ? wiringError : void 0;
 			const thrown = this.wrapMaskedError(log, wiringError, (text) => new ProvisioningError(`Failed to create DynamoDB GlobalTable ${logicalId}: ${text}`, resourceType, logicalId, tableName, cause));
-			if (tableLeftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, tableName);
+			if (tableLeftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, tableName, createdTableId);
 			throw thrown;
 		}
 	}
@@ -35770,7 +36733,8 @@ var DynamoDBGlobalTableProvider = class {
 			if (error instanceof ResourceNotFoundException$1) {
 				const clientRegion = await this.dynamoDBClient.config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`DynamoDB GlobalTable ${physicalId} does not exist, skipping`);
+				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  DynamoDB GlobalTable ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+				else this.logger.debug(`DynamoDB GlobalTable ${physicalId} does not exist, skipping`);
 				this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 				this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 				return;
@@ -35779,6 +36743,36 @@ var DynamoDBGlobalTableProvider = class {
 			throw new ProvisioningError(`Failed to delete DynamoDB GlobalTable ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		if (resourceType !== "AWS::DynamoDB::GlobalTable") return "unknown";
+		if (!isTableName(journaledPhysicalId) || !isTableName(record.physicalId)) return "unknown";
+		if (journaledPhysicalId === record.physicalId) return "same";
+		if (await this.dynamoDBClient.config.region() !== context.expectedRegion) return "unknown";
+		const recordTableId = await this.readTableIdIfExists(record.physicalId);
+		if (recordTableId === void 0) return "unknown";
+		const journaledTableId = await this.readTableIdIfExists(journaledPhysicalId);
+		if (journaledTableId === void 0) return "different";
+		return journaledTableId === recordTableId ? "same" : "different";
+	}
+	async resourceIdentity(physicalId, resourceType, context) {
+		if (resourceType !== "AWS::DynamoDB::GlobalTable" || !isTableName(physicalId)) return;
+		if (await this.dynamoDBClient.config.region() !== context.expectedRegion) return void 0;
+		const live = await this.readTableIdIfExists(physicalId);
+		return live === void 0 ? RESOURCE_NOT_FOUND : live;
+	}
+	async readTableIdIfExists(tableName) {
+		let response;
+		try {
+			response = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$1) return void 0;
+			throw error;
+		}
+		if (response.Table?.TableName !== tableName) throw new Error("DescribeTable answered for another table than the one asked for");
+		const tableId = response.Table.TableId;
+		if (typeof tableId !== "string" || tableId === "") throw new Error("DescribeTable returned no TableId");
+		return tableId;
+	}
 	async getAttribute(physicalId, _resourceType, attributeName) {
 		const cacheKey = injectiveKey(physicalId, attributeName);
 		if (this.attributeCache.has(cacheKey)) return this.attributeCache.get(cacheKey);
@@ -37450,11 +38444,11 @@ const NESTED_STACK_TYPE$1 = "AWS::CloudFormation::Stack";
 async function requireDeploymentApproval(args) {
 	const level = args.options.requireApproval ?? "never";
 	const approve = args.options.approveDeployment;
-	if (level === "never" || approve === void 0) return;
+	if (level === "never" || approve === void 0) return false;
 	const changes = [...args.changes].filter((c) => c.changeType !== "NO_CHANGE" && !isNoEchoPromotionOnly(c));
 	const destructiveChanges = findDestructiveChanges(args.stackName, changes, args.records, args.template, new Set(args.recreateTargetIds ?? []));
 	const onlyNestedUpdates = changes.every((c) => c.changeType === "UPDATE" && c.resourceType === NESTED_STACK_TYPE$1);
-	if (!(level === "destructive" ? destructiveChanges.length > 0 : changes.length > 0 && !onlyNestedUpdates)) return;
+	if (!(level === "destructive" ? destructiveChanges.length > 0 : changes.length > 0 && !onlyNestedUpdates)) return false;
 	const count = (type) => changes.filter((c) => c.changeType === type).length;
 	if (enclosingDeadlineExpired()) throw approvalAfterTimeout(args.stackName);
 	let approved;
@@ -37473,6 +38467,16 @@ async function requireDeploymentApproval(args) {
 		throw error instanceof Error ? markNonRetryable(error) : error;
 	}
 	if (!approved) throw markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${args.stackName} was not approved (--require-approval=${level}). Nothing was changed.`, "DEPLOY_NOT_APPROVED"));
+	return approve.autoApproves !== true;
+}
+async function checkDestructivePlan(args) {
+	const hook = args.options.onDestructivePlan;
+	if (hook === void 0) return;
+	const changes = [...args.changes].filter((c) => c.changeType !== "NO_CHANGE" && !isNoEchoPromotionOnly(c));
+	const destroying = findDestructiveChanges(args.stackName, changes, args.records, args.template, new Set(args.recreateTargetIds ?? [])).filter((c) => c.impact !== "WILL_ORPHAN");
+	const nestedRowChanges = changes.some((c) => c.resourceType === NESTED_STACK_TYPE$1 && (c.changeType === "CREATE" || c.changeType === "UPDATE"));
+	if (destroying.length === 0 && !nestedRowChanges) return;
+	await hook(args.stackName, destroying);
 }
 async function approveLateReplacement(args) {
 	const level = args.options.requireApproval ?? "never";
@@ -37480,7 +38484,7 @@ async function approveLateReplacement(args) {
 	if (level === "never" || approve === void 0) return true;
 	if (enclosingDeadlineExpired()) return false;
 	try {
-		return await whileEnclosingDeadlinesPaused(() => approve({
+		const approved = await whileEnclosingDeadlinesPaused(() => approve({
 			stackName: args.stackName,
 			level,
 			counts: {
@@ -37490,6 +38494,8 @@ async function approveLateReplacement(args) {
 			},
 			destructiveChanges: findDestructiveChanges(args.stackName, [args.change], args.records, args.template)
 		}));
+		if (approve.autoApproves !== true) args.onAsked?.();
+		return approved;
 	} catch {
 		return false;
 	}
@@ -37836,27 +38842,42 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	};
 	let replacedAnyway = false;
 	let lateApproval;
+	let lateCrossPrefixRefused = false;
 	const approveReplacementOf = (pc) => {
 		if (replacedAnyway) return Promise.resolve(true);
 		const { noEchoPromoted: _promoted, ...asReplacement } = pc;
-		lateApproval ??= approveLateReplacement({
-			options: this.options,
-			stackName,
-			change: {
-				...change,
-				changeType: "UPDATE",
-				propertyChanges: [{
-					...asReplacement,
-					requiresReplacement: true
-				}]
-			},
-			records: stateResources,
-			template
-		});
+		const asChange = {
+			...change,
+			changeType: "UPDATE",
+			propertyChanges: [{
+				...asReplacement,
+				requiresReplacement: true
+			}]
+		};
+		lateApproval ??= (async () => {
+			const crossPrefixGate = this.options.onDestructivePlan;
+			if (crossPrefixGate !== void 0) try {
+				await crossPrefixGate(stackName, findDestructiveChanges(stackName, [asChange], stateResources, template), "late");
+			} catch (error) {
+				if (!(error instanceof CdkdError) || error.code !== "STACK_UNDER_OTHER_STATE_PREFIX") throw error;
+				lateCrossPrefixRefused = true;
+				if (counts) counts.crossPrefixKept = (counts.crossPrefixKept ?? 0) + 1;
+				this.logger.warn(error.message);
+				return false;
+			}
+			return approveLateReplacement({
+				options: this.options,
+				stackName,
+				change: asChange,
+				records: stateResources,
+				template,
+				onAsked: () => this.generatedNameGuard?.noteApprovalPrompted()
+			});
+		})();
 		return lateApproval;
 	};
 	const lateReplacementDeclined = /* @__PURE__ */ new Set();
-	const differsWhy = (key) => lateReplacementDeclined.has(key) ? `differs; the replacement was not approved (--require-approval=${this.options.requireApproval ?? "never"})` : "differs; the provider is not known to report this property exactly, so the difference may be its normalization";
+	const differsWhy = (key) => !lateReplacementDeclined.has(key) ? "differs; the provider is not known to report this property exactly, so the difference may be its normalization" : lateCrossPrefixRefused ? "differs; the replacement was refused: see the state-prefix warning above" : `differs; the replacement was not approved (--require-approval=${this.options.requireApproval ?? "never"})`;
 	if (unmarkedRecord && !typeChanged && echoCandidates.length > 0 && hasAddressablePhysicalId(currentResource)) await readOnce();
 	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && recordMatchesDesired) {
 		if (change.attributeChanges && change.attributeChanges.length > 0) {
@@ -38649,8 +39670,83 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 	this.logger.info(`${updatePrefix}${formatResourceLine("updated", logicalId, resourceType)}`);
 }
 
+//#endregion
+//#region src/deployment/retained-readoption.ts
+function keptForReadoption(resource) {
+	if (!replacementCreateAdoptsName(resource.resourceType, resource.provisionedBy)) return false;
+	if (typeof resource.physicalId !== "string" || resource.physicalId === "") return false;
+	const property = explicitNamePropertyFor(resource.resourceType);
+	const properties = resource.properties;
+	return property === void 0 || !properties?.[property];
+}
+async function recordRetainedForReadoption(backend, stackName, region, kept, logger, earlier) {
+	if (kept.length === 0) {
+		try {
+			await backend.ensureRetainedTombstone(stackName, region);
+		} catch (error) {
+			logger.warn(safeMsg`Could not write the empty kept-resource record of ${displayStackName(stackName)} ` + safeMsg`(${describeAwsFailure(error).summary}). Until one exists, a later deploy here may ` + `take back a resource an older cdkd kept; 'cdkd state orphan' writes it.`);
+		}
+		return;
+	}
+	try {
+		const keptIds = new Set(kept.map((k) => k.logicalId));
+		const before = await (earlier ?? backend.loadRetainedRecord(stackName, region)) ?? [];
+		await backend.saveRetainedResources(stackName, region, [...before.filter((e) => !keptIds.has(e.logicalId)), ...kept]);
+	} catch (error) {
+		if (error instanceof RetainedTimeUnconfirmedError) {
+			logger.warn(safeMsg`Recorded the ${String(kept.length)} kept resource(s) of ${displayStackName(stackName)} ` + safeMsg`a later deploy takes back by name, but their time could not be confirmed from S3 ` + safeMsg`(${describeAwsFailure(error.cause).summary}); they carry this machine's clock instead.`);
+			return;
+		}
+		logger.warn(safeMsg`Could not record the ${String(kept.length)} kept resource(s) of ${displayStackName(stackName)} ` + safeMsg`a later deploy takes back by name (${describeAwsFailure(error).summary}). That deploy ` + `refuses to create them over the kept ones; adopt them with 'cdkd import' then.`);
+	}
+}
+var KeptForReadoption = class {
+	entries = [];
+	earlier;
+	inFlight;
+	backend;
+	stackName;
+	region;
+	logger;
+	constructor(backend, stackName, region, logger) {
+		this.backend = backend;
+		this.stackName = stackName;
+		this.region = region;
+		this.logger = logger;
+	}
+	get size() {
+		return this.entries.length;
+	}
+	add(entry) {
+		this.entries.push(entry);
+		if (this.earlier === void 0) {
+			this.earlier = Promise.resolve().then(() => this.backend.loadRetainedRecord(this.stackName, this.region));
+			this.earlier.catch(() => void 0);
+		}
+	}
+	async flush() {
+		if (this.inFlight !== void 0) await this.inFlight;
+		if (this.entries.length === 0) return;
+		const kept = this.entries;
+		const earlier = this.earlier;
+		this.entries = [];
+		this.earlier = void 0;
+		const write = recordRetainedForReadoption(this.backend, this.stackName, this.region, kept, this.logger, earlier);
+		this.inFlight = write;
+		try {
+			await write;
+		} finally {
+			if (this.inFlight === write) this.inFlight = void 0;
+		}
+	}
+};
+
 //#endregion
 //#region src/deployment/deploy-engine/delete.ts
+const keptByEngine = /* @__PURE__ */ new WeakMap();
+async function flushKeptForReadoption(engine) {
+	await keptByEngine.get(engine)?.flush();
+}
 async function provisionDelete(logicalId, change, stateResources, stackName, template, counts, progress) {
 	const resourceType = change.resourceType;
 	const existingState = stateResources[logicalId];
@@ -38662,6 +39758,18 @@ async function provisionDelete(logicalId, change, stateResources, stackName, tem
 		this.logger.info(`Retaining ${logicalId} (${resourceType}) - DeletionPolicy: ${deletionPolicy}`);
 		delete stateResources[logicalId];
 		await noteRetainedResource(resourceType, logicalId);
+		if (keptForReadoption(currentResource)) {
+			let kept = keptByEngine.get(this);
+			if (kept === void 0) {
+				kept = new KeptForReadoption(this.stateBackend, stackName, this.stackRegion, this.logger);
+				keptByEngine.set(this, kept);
+			}
+			kept.add({
+				logicalId,
+				resourceType,
+				physicalId: currentResource.physicalId
+			});
+		}
 		return;
 	}
 	if (!(currentResource.resourceType === "AWS::CloudFormation::Stack" && currentResource.provisionedBy !== "cc-api") && !hasAddressablePhysicalId(currentResource)) {
@@ -39548,6 +40656,707 @@ function journaledOrphanPolicy(policy) {
 	return policy === "Delete" || policy === "Retain" || policy === "Snapshot" || policy === "RetainExceptOnCreate" ? policy : "Retain";
 }
 
+//#endregion
+//#region src/provisioning/name-lookup.ts
+const inFlight = /* @__PURE__ */ new Map();
+const waiting = /* @__PURE__ */ new Map();
+async function withApiLimit(api, max, fn) {
+	if ((inFlight.get(api) ?? 0) >= max) await new Promise((resolve) => {
+		const queue = waiting.get(api) ?? [];
+		queue.push(resolve);
+		waiting.set(api, queue);
+	});
+	else inFlight.set(api, (inFlight.get(api) ?? 0) + 1);
+	try {
+		return await fn();
+	} finally {
+		const next = waiting.get(api)?.shift();
+		if (next) next();
+		else inFlight.set(api, (inFlight.get(api) ?? 1) - 1);
+	}
+}
+function chunks(items, size) {
+	const out = [];
+	for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size));
+	return out;
+}
+async function lookupEachName(names, api, concurrency, lookupOne) {
+	const found = /* @__PURE__ */ new Map();
+	await Promise.all(names.map((name) => withApiLimit(api, concurrency, async () => {
+		const holder = await lookupOne(name);
+		if (holder !== void 0) found.set(name, holder);
+	})));
+	return found;
+}
+function isAccessDeniedError(error) {
+	const name = error?.name;
+	const status = error?.$metadata?.httpStatusCode;
+	return name === "AccessDenied" || name === "AccessDeniedException" || name === "AuthorizationError" || name === "UnauthorizedOperation" || status === 403;
+}
+
+//#endregion
+//#region src/deployment/generated-name-guard.ts
+const GROUP_WINDOW_MS = 15;
+const DEFAULT_TIMING = {
+	now: () => Date.now(),
+	sleep: (ms) => new Promise((resolve) => {
+		setTimeout(resolve, ms).unref?.();
+	}),
+	cooldownMs: 65e3,
+	cooldownStepMs: 1e4
+};
+const STILL_LISTED_WHILE_DELETING = /* @__PURE__ */ new Set(["AWS::SQS::Queue", "AWS::S3::Bucket"]);
+const PER_NAME_CONCURRENCY = { "AWS::SNS::Topic": 4 };
+const DEFAULT_PER_NAME_CONCURRENCY = 10;
+const KEPT_AT_SKEW_MS = 6e4;
+function provenNothingCreated(error, logicalId, resourceType) {
+	if (createdBeforeFailure(error, logicalId, resourceType) !== void 0) return false;
+	if (isAmbiguousOutcomeError(error) || isThrottlingError(error)) return false;
+	let current = error;
+	for (let depth = 0; depth < 8 && current !== null && typeof current === "object"; depth++) {
+		const status = current.$metadata?.httpStatusCode;
+		if (typeof status === "number") return status >= 400 && status < 500 && status !== 408 && status !== 429;
+		current = current.cause;
+	}
+	return false;
+}
+var GeneratedNameGuard = class GeneratedNameGuard {
+	verdicts = /* @__PURE__ */ new Map();
+	decidedAt = /* @__PURE__ */ new Map();
+	candidates = /* @__PURE__ */ new Map();
+	recorded = /* @__PURE__ */ new Set();
+	sent = /* @__PURE__ */ new Set();
+	returned = /* @__PURE__ */ new Set();
+	rejected = /* @__PURE__ */ new Set();
+	failedAt = /* @__PURE__ */ new Map();
+	firstVerdicts = /* @__PURE__ */ new Map();
+	plannedWrites;
+	plannedIds = /* @__PURE__ */ new Set();
+	groupPending = [];
+	groupNext;
+	groupInFlight = Promise.resolve();
+	queued = [];
+	flushing;
+	writes = /* @__PURE__ */ new Set();
+	evidenceRead;
+	abandonedRead;
+	historyRead;
+	recordedRead;
+	input;
+	timing;
+	constructor(input) {
+		this.input = input;
+		this.timing = {
+			...DEFAULT_TIMING,
+			...input.timing
+		};
+	}
+	static start(input) {
+		const candidates = [];
+		for (const change of input.changes) {
+			if (change.changeType !== "CREATE") continue;
+			const properties = change.desiredProperties ?? {};
+			let decision;
+			let name;
+			let deferred = false;
+			try {
+				decision = input.providerFor({
+					resourceType: change.resourceType,
+					properties
+				});
+				if (!replacementCreateAdoptsName(change.resourceType, decision.provisionedBy)) continue;
+				name = decision.provider.generatedCreateName?.(change.resourceType, change.logicalId, properties);
+				deferred = decision.provider.lookupNeedsResolvedProperties?.(change.resourceType, properties) === true;
+			} catch {
+				continue;
+			}
+			if (typeof name !== "string" || name === "") continue;
+			candidates.push({
+				logicalId: change.logicalId,
+				resourceType: change.resourceType,
+				name,
+				property: explicitNamePropertyFor(change.resourceType),
+				provider: decision.provider,
+				properties,
+				deferred
+			});
+		}
+		if (candidates.length === 0) return void 0;
+		const guard = new GeneratedNameGuard(input);
+		for (const c of candidates) guard.candidates.set(c.logicalId, c);
+		guard.ask(candidates.filter((c) => !c.deferred));
+		return guard;
+	}
+	ask(candidates) {
+		const { verdicts, first } = this.resolve(candidates);
+		for (const [logicalId, verdict] of verdicts) this.verdicts.set(logicalId, verdict);
+		for (const [logicalId, verdict] of first) this.firstVerdicts.set(logicalId, verdict);
+	}
+	resolve(candidates) {
+		const out = /* @__PURE__ */ new Map();
+		const first = /* @__PURE__ */ new Map();
+		const byType = /* @__PURE__ */ new Map();
+		for (const c of candidates) byType.set(c.resourceType, [...byType.get(c.resourceType) ?? [], c]);
+		for (const group of byType.values()) {
+			const decided = this.run(group).catch((error) => ({
+				verdicts: new Map(group.map((c) => [c.logicalId, {
+					kind: "failed",
+					error
+				}])),
+				deleting: []
+			}));
+			let waited;
+			for (const c of group) {
+				first.set(c.logicalId, decided.then(({ verdicts }) => verdicts.get(c.logicalId) ?? { kind: "free" }));
+				out.set(c.logicalId, decided.then(async ({ verdicts, deleting }) => {
+					let verdict = verdicts.get(c.logicalId) ?? { kind: "free" };
+					if (deleting.includes(c)) {
+						waited ??= this.waitOutDeletion(deleting);
+						verdict = (await waited).get(c.logicalId) ?? verdict;
+					}
+					this.decidedAt.set(c.logicalId, this.timing.now());
+					return verdict;
+				}));
+			}
+		}
+		return {
+			verdicts: out,
+			first
+		};
+	}
+	noteApprovalPrompted() {
+		const stale = [...this.decidedAt.keys()].map((id) => this.candidates.get(id)).filter((c) => !c.deferred && !this.sent.has(c.logicalId));
+		if (stale.length === 0) return;
+		const previous = new Map(stale.map((c) => [c.logicalId, this.verdicts.get(c.logicalId)]));
+		const { verdicts, first } = this.resolve(stale);
+		const keepEarlier = (id, fresh, warn) => fresh.then(async (v) => {
+			if (v.kind !== "failed" && v.kind !== "unchecked") return v;
+			const earlier = await previous.get(id);
+			if (earlier.kind !== "free" && earlier.kind !== "licensed") return v;
+			if (warn) this.input.warn?.(`${displaySafe(id)}: could not re-read whether a resource holds its generated name after the approval prompt; acting on the earlier lookup.`);
+			return earlier;
+		});
+		for (const [id, fresh] of verdicts) this.verdicts.set(id, keepEarlier(id, fresh, true));
+		for (const [id, fresh] of first) this.firstVerdicts.set(id, keepEarlier(id, fresh, false));
+	}
+	recordPlannedIntents() {
+		if (this.plannedWrites !== void 0) return;
+		this.plannedWrites = /* @__PURE__ */ new Map();
+		const byType = /* @__PURE__ */ new Map();
+		for (const c of this.candidates.values()) {
+			if (c.deferred) continue;
+			byType.set(c.resourceType, [...byType.get(c.resourceType) ?? [], c]);
+		}
+		let typesWaiting = byType.size;
+		let allArrived;
+		const arrived = new Promise((resolve) => allArrived = resolve);
+		const window = new Promise((resolve) => {
+			setTimeout(resolve, GROUP_WINDOW_MS).unref?.();
+		});
+		this.groupInFlight = Promise.race([arrived, window]);
+		const arrive = () => {
+			typesWaiting--;
+			if (typesWaiting === 0) allArrived();
+		};
+		for (const [resourceType, group] of byType) {
+			const write = (async () => {
+				let verdicts;
+				try {
+					verdicts = await Promise.all(group.map((c) => this.firstVerdicts.get(c.logicalId) ?? this.verdicts.get(c.logicalId)));
+				} finally {
+					arrive();
+				}
+				const batch = group.filter((_c, i) => verdicts[i].kind === "free" || verdicts[i].kind === "licensed");
+				if (batch.length === 0) return;
+				for (const c of batch) this.plannedIds.add(c.logicalId);
+				await this.commitPlanned(batch);
+			})();
+			this.plannedWrites.set(resourceType, write);
+			this.writes.add(write);
+			write.catch(() => void 0);
+		}
+	}
+	get size() {
+		return this.candidates.size;
+	}
+	verdict(logicalId) {
+		return this.verdicts.get(logicalId);
+	}
+	candidate(logicalId) {
+		const c = this.candidates.get(logicalId);
+		return c === void 0 ? void 0 : {
+			name: c.name,
+			property: c.property
+		};
+	}
+	async admit(logicalId, resolvedProperties) {
+		const c = this.candidates.get(logicalId);
+		if (c === void 0) return void 0;
+		if (c.deferred && !this.verdicts.has(logicalId)) this.ask([{
+			...c,
+			properties: resolvedProperties,
+			deferred: false
+		}]);
+		const verdict = await this.verdicts.get(logicalId);
+		if (verdict.kind !== "free" && verdict.kind !== "licensed") return verdict;
+		try {
+			const planned = this.plannedWrites?.get(c.resourceType);
+			if (planned !== void 0) try {
+				await planned;
+			} catch (error) {
+				if (this.plannedIds.has(logicalId)) throw error;
+			}
+			await this.recordIntent(c);
+		} catch (error) {
+			return {
+				kind: "failed",
+				error
+			};
+		}
+		return verdict;
+	}
+	noteSent(logicalId) {
+		if (this.candidates.has(logicalId)) this.sent.add(logicalId);
+	}
+	noteReturned(logicalId) {
+		if (this.candidates.has(logicalId)) this.returned.add(logicalId);
+	}
+	noteFailed(logicalId, error) {
+		const c = this.candidates.get(logicalId);
+		if (c === void 0) return;
+		if (provenNothingCreated(error, logicalId, c.resourceType)) this.rejected.add(logicalId);
+		else if (!this.failedAt.has(logicalId)) this.failedAt.set(logicalId, this.timing.now());
+	}
+	async settle() {
+		await Promise.all([...this.writes].map((w) => w.catch(() => void 0)));
+		const drop = [...this.recorded].filter((id) => !this.sent.has(id) || this.returned.has(id) || this.rejected.has(id));
+		const failedAt = new Map([...this.failedAt].filter(([id]) => this.recorded.has(id) && !drop.includes(id)));
+		if (drop.length === 0 && failedAt.size === 0) return;
+		let lastError;
+		for (let attempt = 0; attempt < 2; attempt++) try {
+			await settleAdoptingCreates(drop, failedAt);
+			return;
+		} catch (error) {
+			lastError = error;
+		}
+		const bounded = await noteAbandonedRun(this.timing.now());
+		this.input.warn?.(safeMsg`Could not clear this deploy's unsent name-adopting creates from the stack's create-token ledger (${describeAwsFailure(lastError).summary}). ` + (bounded ? "They license only what existed by now; a later deploy may refuse a resource of those names, which `cdkd import` adopts." : "Nor could the ledger record when this deploy ended: a later deploy may take back a resource of those names that another deployment creates. They are cleared by the next successful deploy."));
+	}
+	async readoptedFromRetained() {
+		const out = [];
+		for (const [logicalId, verdict] of this.verdicts) {
+			if (!this.returned.has(logicalId)) continue;
+			const v = await verdict;
+			if (v.kind === "licensed" && (v.via === "retained" || v.via === "history")) out.push(logicalId);
+		}
+		return out;
+	}
+	recordIntent(c) {
+		if (this.recorded.has(c.logicalId)) return Promise.resolve();
+		this.queued.push(c);
+		if (this.flushing === void 0) {
+			const flush = new Promise((resolve) => setImmediate(resolve)).then(async () => {
+				const batch = this.queued;
+				this.queued = [];
+				if (this.flushing === flush) this.flushing = void 0;
+				await this.writeIntents(batch);
+			});
+			this.flushing = flush;
+			this.writes.add(flush);
+		}
+		return this.flushing;
+	}
+	commitPlanned(batch) {
+		this.groupPending.push(...batch);
+		if (this.groupNext === void 0) {
+			const next = this.groupInFlight.then(() => void 0, () => void 0).then(async () => {
+				const carried = this.groupPending;
+				this.groupPending = [];
+				this.groupNext = void 0;
+				await this.writeIntents(carried);
+			});
+			this.groupNext = next;
+			this.groupInFlight = next;
+		}
+		return this.groupNext;
+	}
+	async writeIntents(batch) {
+		await recordAdoptingCreates(batch.map((b) => ({
+			logicalId: b.logicalId,
+			resourceType: b.resourceType,
+			name: b.name
+		})));
+		for (const b of batch) this.recorded.add(b.logicalId);
+	}
+	recordedIntents() {
+		this.recordedRead ??= recordedAdoptingCreates();
+		return this.recordedRead;
+	}
+	async run(candidates) {
+		const input = this.input;
+		const out = /* @__PURE__ */ new Map();
+		const recorded = this.recordedIntents().then((r) => ({
+			ok: true,
+			value: r
+		}), (error) => ({
+			ok: false,
+			error
+		}));
+		const { found, typeFailures } = await lookupAll(input, candidates);
+		let evidence;
+		if (found.size > 0) {
+			this.evidenceRead ??= loadEvidence(input);
+			evidence = await this.evidenceRead.catch((error) => ({ error }));
+		}
+		const recordedResult = await recorded;
+		const unlicensed = [];
+		for (const c of candidates) {
+			const failure = typeFailures.get(c.resourceType);
+			if (failure !== void 0) {
+				out.set(c.logicalId, isAccessDeniedError(failure) ? {
+					kind: "unchecked",
+					error: failure
+				} : {
+					kind: "failed",
+					error: failure
+				});
+				continue;
+			}
+			const holder = found.get(c.logicalId);
+			if (holder === void 0) {
+				out.set(c.logicalId, { kind: "free" });
+				continue;
+			}
+			if (!recordedResult.ok) {
+				out.set(c.logicalId, {
+					kind: "failed",
+					error: recordedResult.error
+				});
+				continue;
+			}
+			const intent = recordedResult.value?.get(c.logicalId);
+			let ownIntent;
+			if (intent !== void 0 && intent.resourceType === c.resourceType && intent.name === c.name) {
+				const abandonedAt = await this.abandonedRunAt();
+				const byIntent = await this.licenseIfCreatedAfterIntent(c, holder, intent, abandonedAt !== void 0 && intent.firstSentAt <= abandonedAt ? abandonedAt : void 0);
+				if (byIntent.kind !== "held") {
+					out.set(c.logicalId, byIntent);
+					continue;
+				}
+				ownIntent = byIntent.ownIntent;
+			}
+			if (evidence === void 0 || "error" in evidence) {
+				out.set(c.logicalId, {
+					kind: "failed",
+					error: evidence !== void 0 && "error" in evidence ? evidence.error : /* @__PURE__ */ new Error("no evidence")
+				});
+				continue;
+			}
+			const named = evidence.namedBy(c.resourceType, holder);
+			if (named !== void 0) {
+				out.set(c.logicalId, await this.licenseIfKeptBefore(c, holder, named));
+				if (out.get(c.logicalId).kind === "held") unlicensed.push(c);
+				continue;
+			}
+			out.set(c.logicalId, {
+				kind: "held",
+				holder,
+				...ownIntent && { ownIntent }
+			});
+			unlicensed.push(c);
+		}
+		if (unlicensed.length > 0 && input.loadKeptInHistory !== void 0 && evidence !== void 0 && !("error" in evidence) && evidence.retainedAbsent) {
+			let kept;
+			try {
+				this.historyRead ??= input.loadKeptInHistory();
+				kept = await this.historyRead;
+			} catch {
+				kept = [];
+			}
+			for (const c of [...unlicensed]) {
+				const holder = found.get(c.logicalId);
+				const match = kept.find((k) => k.logicalId === c.logicalId && k.resourceType === c.resourceType && probeFoundSameId(c.resourceType, k.physicalId, holder));
+				if (match === void 0) continue;
+				const verdict = await this.licenseIfKeptBefore(c, holder, {
+					via: "history",
+					...match.keptAt !== void 0 && { keptAt: match.keptAt }
+				});
+				out.set(c.logicalId, verdict);
+				if (verdict.kind !== "held") unlicensed.splice(unlicensed.indexOf(c), 1);
+			}
+		}
+		return {
+			verdicts: out,
+			deleting: unlicensed.filter((c) => STILL_LISTED_WHILE_DELETING.has(c.resourceType))
+		};
+	}
+	async licenseIfKeptBefore(c, holder, named) {
+		const licensed = {
+			kind: "licensed",
+			holder,
+			via: named.via
+		};
+		if (named.via !== "retained" && named.via !== "history" || named.keptAt === void 0) return licensed;
+		if (c.provider.holderCreatedAt === void 0) return licensed;
+		let createdAt;
+		try {
+			createdAt = await withSkipPrefix(true, () => c.provider.holderCreatedAt(c.resourceType, holder));
+		} catch (error) {
+			if (!isAccessDeniedError(error)) return {
+				kind: "failed",
+				error
+			};
+			this.creationTimeDenied(c, holder, error);
+			return licensed;
+		}
+		if (createdAt === void 0 || createdAt <= named.keptAt + KEPT_AT_SKEW_MS) return licensed;
+		return {
+			kind: "held",
+			holder
+		};
+	}
+	async licenseIfCreatedAfterIntent(c, holder, intent, abandonedAt) {
+		const licensed = {
+			kind: "licensed",
+			holder,
+			via: "ledger"
+		};
+		const held = {
+			kind: "held",
+			holder
+		};
+		const byName = abandonedAt !== void 0 ? {
+			kind: "held",
+			holder,
+			ownIntent: "abandoned"
+		} : intent.failedAt !== void 0 ? {
+			kind: "held",
+			holder,
+			ownIntent: "failed"
+		} : licensed;
+		if (c.provider.holderCreatedAt === void 0) return byName;
+		let createdAt;
+		try {
+			createdAt = await withSkipPrefix(true, () => c.provider.holderCreatedAt(c.resourceType, holder));
+		} catch (error) {
+			if (!isAccessDeniedError(error)) return {
+				kind: "failed",
+				error
+			};
+			this.creationTimeDenied(c, holder, error);
+			return byName;
+		}
+		if (createdAt === void 0) return byName;
+		const { firstSentAt, failedAt } = intent;
+		if (Number.isFinite(firstSentAt) && createdAt < firstSentAt - KEPT_AT_SKEW_MS) return held;
+		for (const until of [abandonedAt, failedAt]) if (until !== void 0 && createdAt > until + KEPT_AT_SKEW_MS) return held;
+		return licensed;
+	}
+	creationTimeDenied(c, holder, error) {
+		this.input.warn?.(safeMsg`${c.logicalId}: could not read when ${holder} was created (${describeAwsFailure(error).summary}); ` + "deciding by its name alone, as for a type that reports no creation time. Grant the type's Describe permission to narrow that.");
+	}
+	async abandonedRunAt() {
+		this.abandonedRead ??= ledgerAbandonedAt().catch(() => void 0).then((fromLedger) => {
+			const at = [fromLedger, this.input.abandonedRunAt].filter((v) => typeof v === "number" && Number.isFinite(v));
+			return at.length > 0 ? Math.max(...at) : void 0;
+		});
+		return this.abandonedRead;
+	}
+	async waitOutDeletion(candidates) {
+		const out = /* @__PURE__ */ new Map();
+		let pending = [...candidates];
+		const until = this.timing.now() + this.timing.cooldownMs;
+		const watch = startInterruptWatch("generated-name deletion cooldown");
+		try {
+			while (pending.length > 0 && this.timing.now() < until) {
+				await this.sleepUnlessInterrupted(this.timing.cooldownStepMs, watch);
+				if (watch.isInterrupted()) {
+					for (const c of pending) out.set(c.logicalId, {
+						kind: "failed",
+						error: watch.onInterrupted()
+					});
+					return out;
+				}
+				const { found, typeFailures } = await lookupAll(this.input, pending);
+				pending = pending.filter((c) => {
+					if (typeFailures.has(c.resourceType)) return true;
+					if (found.has(c.logicalId)) return true;
+					out.set(c.logicalId, { kind: "free" });
+					return false;
+				});
+			}
+			return out;
+		} finally {
+			watch.dispose();
+		}
+	}
+	sleepUnlessInterrupted(ms, watch) {
+		if (watch.isInterrupted()) return Promise.resolve();
+		let timer;
+		const interrupted = new Promise((resolve) => {
+			timer = setInterval(() => {
+				if (watch.isInterrupted()) resolve();
+			}, 200);
+			timer.unref?.();
+		});
+		return Promise.race([this.timing.sleep(ms), interrupted]).finally(() => clearInterval(timer));
+	}
+};
+function isPermanentRedirect(error) {
+	const e = error;
+	return e?.name === "PermanentRedirect" || e?.$metadata?.httpStatusCode === 301 || e?.$response?.statusCode === 301;
+}
+async function lookupAll(input, candidates) {
+	const byType = /* @__PURE__ */ new Map();
+	for (const c of candidates) byType.set(c.resourceType, [...byType.get(c.resourceType) ?? [], c]);
+	const found = /* @__PURE__ */ new Map();
+	const typeFailures = /* @__PURE__ */ new Map();
+	await Promise.all([...byType].map(async ([resourceType, group]) => {
+		try {
+			const holders = await lookupType(input, resourceType, group);
+			for (const c of group) {
+				const holder = holders.get(c.name);
+				if (holder !== void 0) found.set(c.logicalId, holder);
+			}
+		} catch (error) {
+			typeFailures.set(resourceType, error);
+		}
+	}));
+	return {
+		found,
+		typeFailures
+	};
+}
+async function loadEvidence(input) {
+	const [journal, retained] = await Promise.all([input.loadJournal(), input.loadRetained()]);
+	const sources = [];
+	for (const record of Object.values(input.records)) if (typeof record?.physicalId === "string") sources.push({
+		via: "record",
+		type: record.resourceType,
+		id: record.physicalId
+	});
+	for (const orphan of input.orphans ?? []) {
+		const s = orphan.state;
+		if (typeof s?.physicalId === "string") sources.push({
+			via: "orphan",
+			type: s.resourceType,
+			id: s.physicalId
+		});
+	}
+	for (const segment of journal?.segments ?? []) for (const op of [...segment.operations ?? [], ...segment.failedOperations ?? []]) if (typeof op.physicalId === "string" && op.physicalId !== "") sources.push({
+		via: "journal",
+		type: op.resourceType,
+		id: op.physicalId
+	});
+	for (const r of retained ?? []) sources.push({
+		via: "retained",
+		type: r.resourceType,
+		id: r.physicalId,
+		...r.keptAt !== void 0 && { keptAt: r.keptAt }
+	});
+	return {
+		retainedAbsent: retained === null,
+		namedBy: (resourceType, holder) => {
+			const hit = sources.find((s) => s.type === resourceType && probeFoundSameId(resourceType, s.id, holder));
+			return hit === void 0 ? void 0 : {
+				via: hit.via,
+				...hit.keptAt !== void 0 && { keptAt: hit.keptAt }
+			};
+		}
+	};
+}
+async function lookupType(input, resourceType, group) {
+	const provider = group[0].provider;
+	const names = group.map((c) => c.name);
+	return withSkipPrefix(true, async () => {
+		if (provider.lookupNames !== void 0) return provider.lookupNames(resourceType, names, {
+			region: input.region,
+			stackName: input.stackName,
+			propertiesByName: new Map(group.map((c) => [c.name, c.properties]))
+		});
+		const lookup = provider.import?.bind(provider);
+		if (lookup === void 0) return /* @__PURE__ */ new Map();
+		const byName = new Map(group.map((c) => [c.name, c]));
+		const account = ["AWS::SNS::Topic", "AWS::StepFunctions::StateMachine"].includes(resourceType) ? await input.accountInfo() : void 0;
+		const concurrency = PER_NAME_CONCURRENCY[resourceType] ?? DEFAULT_PER_NAME_CONCURRENCY;
+		return lookupEachName(names, `${resourceType}:import`, concurrency, async (name) => {
+			const c = byName.get(name);
+			const arn = account !== void 0 ? createLookupArn(resourceType, name, account) : void 0;
+			if (arn !== void 0 && "unbuildable" in arn) throw new Error(`cannot build the ARN ${resourceType} name ${name} would take`);
+			let found;
+			try {
+				found = await lookup({
+					logicalId: c.logicalId,
+					resourceType,
+					stackName: input.stackName,
+					region: input.region,
+					properties: c.property === void 0 ? c.properties : {
+						...c.properties,
+						[c.property]: name
+					},
+					...arn !== void 0 && { knownPhysicalId: arn.arn }
+				});
+			} catch (error) {
+				if (resourceType === "AWS::S3::Bucket" && isPermanentRedirect(error)) return name;
+				throw error;
+			}
+			return found?.physicalId;
+		});
+	});
+}
+
+//#endregion
+//#region src/deployment/kept-in-history.ts
+function keptInEarlierRecords(records) {
+	const out = [];
+	for (const record of records) for (const [logicalId, raw] of Object.entries(record.resources)) {
+		if (raw === null || typeof raw !== "object") continue;
+		const r = raw;
+		if (typeof r.resourceType !== "string" || typeof r.physicalId !== "string") continue;
+		if (r.physicalId === "") continue;
+		if (!shouldRetainResource(r.deletionPolicy)) continue;
+		out.push({
+			logicalId,
+			resourceType: r.resourceType,
+			physicalId: r.physicalId,
+			...record.writtenAt !== void 0 && { keptAt: record.writtenAt }
+		});
+	}
+	return out;
+}
+function keptInEventHistory(runs, stackName) {
+	const made = /* @__PURE__ */ new Map();
+	const out = [];
+	for (const events of runs) for (const e of events) {
+		if (e.stackName !== stackName || typeof e.logicalId !== "string") continue;
+		if (typeof e.resourceType !== "string") continue;
+		if (e.eventType === "RESOURCE_SUCCEEDED" && (e.operation === "CREATE" || e.operation === "UPDATE") && typeof e.physicalId === "string" && e.physicalId !== "") made.set(e.logicalId, {
+			resourceType: e.resourceType,
+			physicalId: e.physicalId
+		});
+		else if (e.eventType === "RESOURCE_RETAINED") {
+			const m = made.get(e.logicalId);
+			if (m !== void 0 && m.resourceType === e.resourceType) {
+				const keptAt = Date.parse(e.timestamp);
+				out.push({
+					logicalId: e.logicalId,
+					...m,
+					...Number.isFinite(keptAt) && { keptAt }
+				});
+			}
+		}
+	}
+	return out;
+}
+async function loadKeptInHistory(sources, stackName, region) {
+	const runsOf = stackName.split("~")[0];
+	const [records, runs] = await Promise.all([sources.earlierStateResources(stackName, region).catch(() => []), (async () => {
+		const listed = (await sources.listRuns(runsOf, region)).slice(0, 20);
+		return (await Promise.all(listed.map((r) => sources.readRunEvents(runsOf, region, r.runId).catch(() => null)))).filter((e) => e !== null).reverse();
+	})().catch(() => [])]);
+	return [...keptInEarlierRecords(records), ...keptInEventHistory(runs, stackName)];
+}
+
 //#endregion
 //#region src/provisioning/canonicalize-properties.ts
 function makeCanonicalizePropertiesFn(registry) {
@@ -40108,6 +41917,9 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		process.removeListener("SIGINT", sigintHandler);
 		throw error;
 	}
+	let firstDeployStateGate;
+	let firstDeploy = false;
+	let failed = false;
 	try {
 		renderer.start();
 		const currentStateData = await this.stateBackend.getState(stackName, this.stackRegion);
@@ -40131,7 +41943,14 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		refuseMalformedOrphanRecords(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
 		const migrationPending = currentStateData?.migrationPending ?? false;
 		this.logger.debug(`Loaded current state: ${Object.keys(currentState.resources).length} resources`);
-		if (this.options.onCurrentStateLoaded) await this.options.onCurrentStateLoaded(stackName, currentStateData?.state);
+		if (this.options.onCurrentStateLoaded) {
+			const gate = this.options.onCurrentStateLoaded(stackName, currentStateData?.state);
+			if (currentStateData === null || currentStateData === void 0) {
+				firstDeployStateGate = gate;
+				firstDeploy = true;
+				gate.catch(() => void 0);
+			} else await gate;
+		}
 		try {
 			const loaded = await this.stateBackend.loadRollbackJournal(stackName, this.stackRegion);
 			const journal = loaded && {
@@ -40262,6 +42081,11 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			conditions,
 			forceStatefulRecreation: this.options.forceStatefulRecreation === true
 		});
+		if (firstDeployStateGate !== void 0) {
+			const gate = firstDeployStateGate;
+			firstDeployStateGate = void 0;
+			await gate;
+		}
 		if (!this.diffCalculator.hasChanges(changes)) {
 			this.logger.info("No changes detected. Stack is up to date.");
 			let persistedOutputs = currentState.outputs ?? {};
@@ -40369,7 +42193,34 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			const readers = [...changes.values()].filter(isNoEchoPromotionOnly).length;
 			this.logger.info(safeMsg`No changes detected in the template. Comparing ${String(readers)} resource(s) that read a NoEcho parameter with AWS.`);
 		}
-		await requireDeploymentApproval({
+		const abandonedRunAt = this.lockManager.abandonedRunEndedBy?.(stackName, this.stackRegion);
+		if (abandonedRunAt !== void 0) await noteAbandonedRun(abandonedRunAt);
+		this.generatedNameGuard = GeneratedNameGuard.start({
+			stackName,
+			region: this.stackRegion,
+			changes: changes.values(),
+			providerFor: (input) => this.providerRegistry.getProviderFor({
+				...input,
+				quiet: true
+			}),
+			records: currentState.resources,
+			orphans: currentState.orphans,
+			loadJournal: () => this.stateBackend.loadRollbackJournal(stackName, this.stackRegion),
+			loadRetained: () => this.stateBackend.loadRetainedRecord(stackName, this.stackRegion),
+			loadKeptInHistory: () => {
+				const reader = new DeploymentEventsReader(this.stateBackend);
+				return loadKeptInHistory({
+					earlierStateResources: (s, r) => this.stateBackend.earlierStateResources(s, r),
+					listRuns: (s, r) => reader.listRuns(s, r),
+					readRunEvents: (s, r, id) => reader.readRunEvents(s, r, id)
+				}, stackName, this.stackRegion);
+			},
+			accountInfo: () => getAccountInfo(this.stackRegion),
+			warn: (message) => this.logger.warn(message),
+			...abandonedRunAt !== void 0 && { abandonedRunAt }
+		});
+		if (this.generatedNameGuard !== void 0) this.logger.debug(safeMsg`Generated-name check: looking up ${String(this.generatedNameGuard.size)} planned create(s)`);
+		await checkDestructivePlan({
 			options: this.options,
 			stackName,
 			changes: changes.values(),
@@ -40377,6 +42228,15 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			template: effectiveTemplate,
 			recreateTargetIds: recreateTargetIdsFor(this.options.recreateTargets, stackName)
 		});
+		if (await requireDeploymentApproval({
+			options: this.options,
+			stackName,
+			changes: changes.values(),
+			records: currentState.resources,
+			template: effectiveTemplate,
+			recreateTargetIds: recreateTargetIdsFor(this.options.recreateTargets, stackName)
+		})) this.generatedNameGuard?.noteApprovalPrompted();
+		this.generatedNameGuard?.recordPlannedIntents();
 		this.resolver.resetPhysicalIdFallbackCount();
 		const progress = {
 			current: 0,
@@ -40384,16 +42244,29 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		};
 		const { state: newState, actualCounts, completedOperations } = await withProducerRegions(() => this.producerRegionEvidence(currentState), () => this.executeDeployment(effectiveTemplate, currentState, changes, dag, executionLevels, stackName, outputsDigestSource, parameterValues, conditions, currentEtag, progress, migrationPending));
 		await this.drainObservedCaptures(newState.resources);
-		const newEtag = await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(conditionVerdicts ? {
+		const [newEtag] = await Promise.all([this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(conditionVerdicts ? {
 			...newState,
 			conditionVerdicts
-		} : newState));
+		} : newState)), flushKeptForReadoption(this)]);
 		this.logger.debug(`State saved (ETag: ${newEtag})`);
-		await forgetRecordedCreateTokens(Object.keys(newState.resources));
-		const [journaledOrphansLeft] = await Promise.all([this.settleJournalAfterSuccess(stackName, completedOperations, currentState, newState.resources, currentEtag === void 0), this.exportIndexStore ? this.exportIndexStore.updateForStack(stackName, this.stackRegion, importableOutputs({
-			...newState,
-			outputs: this.redactOutputs(newState.outputs)
-		})) : Promise.resolve()]);
+		const ledgerAndKeptCleanup = (async () => {
+			await forgetRecordedCreateTokens(Object.keys(newState.resources));
+			const readopted = await this.generatedNameGuard?.readoptedFromRetained() ?? [];
+			if (readopted.length > 0) try {
+				const kept = await this.stateBackend.loadRetainedResources(stackName, this.stackRegion);
+				await this.stateBackend.saveRetainedResources(stackName, this.stackRegion, kept.filter((entry) => !readopted.includes(entry.logicalId)));
+			} catch (error) {
+				this.logger.debug(safeMsg`Could not clear re-adopted resources from the kept-resource record: ${describeAwsFailure(error).summary}`);
+			}
+		})();
+		const [journaledOrphansLeft] = await Promise.all([
+			this.settleJournalAfterSuccess(stackName, completedOperations, currentState, newState.resources, currentEtag === void 0),
+			this.exportIndexStore ? this.exportIndexStore.updateForStack(stackName, this.stackRegion, importableOutputs({
+				...newState,
+				outputs: this.redactOutputs(newState.outputs)
+			})) : Promise.resolve(),
+			ledgerAndKeptCleanup
+		]);
 		const durationMs = Date.now() - startTime;
 		const unchangedCount = this.diffCalculator.filterByType(changes, "NO_CHANGE").length + actualCounts.skipped;
 		return {
@@ -40404,17 +42277,33 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			deleteSkipped: actualCounts.deleteSkipped + journaledOrphansLeft,
 			updatePartial: actualCounts.updatePartial,
 			nestedUpdatePartial: actualCounts.nestedUpdatePartial,
+			...(actualCounts.crossPrefixKept ?? 0) > 0 && { crossPrefixKept: actualCounts.crossPrefixKept },
 			unchanged: unchangedCount,
 			durationMs,
 			outputs: this.buildDisplayOutputs(template, this.redactOutputs(newState.outputs ?? {})),
 			attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
 		};
+	} catch (error) {
+		failed = true;
+		if (firstDeployStateGate !== void 0) await firstDeployStateGate;
+		throw error;
 	} finally {
 		try {
 			renderer.stop();
 		} catch {}
 		process.removeListener("SIGINT", sigintHandler);
 		this.observedCaptureTasks.clear();
+		try {
+			await flushKeptForReadoption(this);
+			await this.generatedNameGuard?.settle();
+		} catch {}
+		if (firstDeploy && failed && this.options.onFirstDeployLeftNoRecord && !this.options.dryRun) try {
+			const left = await this.stateBackend.getState(stackName, this.stackRegion);
+			const journal = left === null ? await this.stateBackend.loadRollbackJournal(stackName, this.stackRegion) : void 0;
+			if (left === null && !journalCanOwnResources(journal ?? null)) await this.options.onFirstDeployLeftNoRecord(stackName);
+		} catch (error) {
+			this.logger.debug(safeMsg`Could not check whether the failed first deploy left a record: ${describeAwsFailure(error).summary}`);
+		}
 		try {
 			await this.lockManager.releaseLock(stackName, this.stackRegion);
 			this.logger.debug("Lock released");
@@ -40668,6 +42557,7 @@ var DeployEngine = class {
 	constructPathTemplate;
 	outputsSourceUsable = true;
 	attemptedResolvedProps = /* @__PURE__ */ new Map();
+	generatedNameGuard;
 	liveTaskLabels = /* @__PURE__ */ new Map();
 	retainedOldOnReplacement = /* @__PURE__ */ new Set();
 	recreatedUnderSameId = /* @__PURE__ */ new Set();
@@ -40725,6 +42615,7 @@ var DeployEngine = class {
 		this.fingerprintChildTemplates = void 0;
 		this.perResourceInputFingerprints = /* @__PURE__ */ new Map();
 		this.attemptedResolvedProps = /* @__PURE__ */ new Map();
+		this.generatedNameGuard = void 0;
 		this.liveTaskLabels = /* @__PURE__ */ new Map();
 		this.outputSecrets = /* @__PURE__ */ new Map();
 		this.outputsPassSecretMaps = [];
@@ -40955,5 +42846,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { gray as $, prefetchCreateOnlyPropertyPaths as $a, refuseMalformedOutputs as $i, tagPlanWarning as $n, wholeStringLeavesOf as $o, getAccountInfo as $r, partitionSensitiveEnv as $s, redactedDeleteAddressSkip as $t, perType as A, NO_CC_HANDLERS_REASON as Aa, decodeListingKey as Ac, malformedLocalResourceEntriesWarning as Ai, buildFinalSnapshotIdentifier as An, shareLogOnlyValues as Ao, poisonRenderedSpellingsCollidingIn as Ar, rewriteTemplateAssetReferences as As, awaitInFlightSibling as At, INDEX_SETTLE_POLL_INTERVAL_MS as B, isWarmThroughputDecrease as Ba, hasPlainPrototype$1 as Bc, malformedResourceEntriesWarning as Bi, formatDestructiveChange as Bn, isUncertifiedBaselineMaskPosition as Bo, AWS_CREDENTIAL_ENV_KEYS as Br, validateContainerRepoName as Bs, planRollback as Bt, noEchoComparisonForTemplate as C, unreadableOrphanRecords as Ca, ssmResolvedValueType as Cc, hasReadableResources as Ci, maskEventTextWithBoundBags as Cn, createUnionSecretMasker as Co, isTerminationProtectionPropagationError as Cr, AssetPublisher as Cs, isHandledOrphan as Ct, recordedProtectionNote as D, findSilentDropProperties as Da, findLargeInlineResources as Dc, malformedExportNamesWarning as Di, extractDeploymentEventError as Dn, printingCorpusOf as Do, DiffCalculator as Dr, buildAssetRedirectMap as Ds, sameJournaledOrphans as Dt, recordedProtectionEvidence as E, findActionableSilentDrops as Ea, MIGRATE_TMP_PREFIX as Ec, malformedDriftResourcePropertiesWarning as Ei, stateSecretNameNeedles as En, logOnlyValueCount as Eo, reEnableInstanceApiTermination as Er, WorkGraph as Es, makeForeignHolderScan as Et, compensateRemovedDeletionProtection as F, isStatefulRecreateTargetForReplace as Fa, AssemblyReader as Fc, malformedOrphansRefusalMessage as Fi, refusesFinalSnapshot as Fn, markSameGenerationBag as Fo, assertFlagRoleArn as Fr, getBootstrapMarkerKey as Fs, recordAfterRollbackUpdate as Ft, hasCdkAutoDeleteTag as G, configBooleanRefusal as Ga, displayAssemblyPath as Gc, previewableOrphanRecords as Gi, withCreateTokenLedger as Gn, recoverMaskedOutput as Go, s3BucketArn as Gr, describeDockerExecFailure as Gs, seedsDeleteFirstGuard as Gt, waitForIndexesSettled as H, toFiniteNumber as Ha, ownValue as Hc, malformedResourcesWarning as Hi, earliestDefined as Hn, identityKeyFor as Ho, callerEnvCredentials as Hr, buildDockerImage as Hs, recordUnderIdIsNotOwn as Ht, deleteBudgetKey as I, isStatefulRecreateTargetSync as Ia, StageLoadError as Ic, malformedOrphansWarning as Ii, unsupportedFinalSnapshotError as In, redactSecretsForState as Io, assertSendableRoleArn as Ir, isCrossRegionRedirect as Is, demoteSupersededOrphans as It, markRefusedBeforeApplying as J, readConfigString as Ja, clearBucketRegionCache as Jc, refuseMalformedOrphanRecords as Ji, DBPROXY_TAG_OPTIONS as Jn, recordMaskOnlyValue as Jo, s3BucketRegionalDomainName as Jr, finchSecretArgvRefusal as Js, getCurrentProducerRegions as Jt, isTruthyCfnBoolean as K, configIntegerRefusal as Ka, renderAssemblyPathEscape as Kc, refuseDivergentRecordRegionForDestroy as Ki, acquireIdempotencyToken as Kn, carriesSecretMask as Ko, s3BucketDomainName as Kr, describeDockerFailure as Ks, orphanDeleteNeedsIdentity as Kt, resolveDynamoDbDeleteBudgetClock as L, renderStatefulReason as La, processStackMessages as Lc, malformedOutputsRefusalMessage as Li, maskingRetryLogger as Ln, scrubResourceRecord as Lo, explicitRoleArnOrThrow as Lr, parseBootstrapMarker as Ls, isJournaledOrphan as Lt, DynamoDBGlobalTableProvider as M, findReplacedReadersOfRecreateTargets as Ma, PARTITION_TABLE as Mc, malformedOrphanRecordsRefusalMessage as Mi, createPreDeleteFinalSnapshot as Mn, errorCauseChain as Mo, producerRegionsFromState as Mr, BOOTSTRAP_MARKER_PREFIX as Ms, getStackRecords as Mt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as N, shownType as Na, canonicalizeRegion as Nc, malformedOrphanRecordsWarning as Ni, effectiveDeletionPolicy as Nn, maskSecretsInError as No, regionLessSecretName as Nr, assertAssetBucketRegion as Ns, withStackRecords as Nt, PROTECTION_PROPERTY_BY_TYPE as O, unwrittenCreateOnlyReplacement as Oa, uploadCfnTemplate as Oc, malformedExportSourceWarning as Oi, ATOMIC_FINAL_SNAPSHOT_TYPES as On, recordLogOnlyParameterValue as Oo, INTRINSIC_KEYS as Or, createAssetRedirectResolver as Os, replayFailedOperations as Ot, beginDeleteWait as P, MULTI_REGION_RECREATE_BLOCKED_TYPES as Pa, derivePartitionAndUrlSuffix as Pc, malformedOrphanRowsKeptWarning as Pi, isFinalSnapshotError as Pn, maskSecretsInText as Po, applyRoleArnIfSet as Pr, ensureAssetStorage as Ps, removeProtectionTypeList as Pt, cyan as Q, requireConfigString as Qa, refuseMalformedOrphansForOrphan as Qi, tagMapAsList as Qn, recordProvenPublicExpression as Qo, parameterTypeMayLoseSecretIdentity as Qr, isMalformedEnvKey as Qs, redactedDeleteAddressFields as Qt, resolveDynamoDbDeleteBudgetMs as R, WARM_THROUGHPUT_MEMBERS as Ra, defineOwnKey as Rc, malformedOutputsWarning as Ri, constructPathOf as Rn, DYNAMIC_REFERENCE_TOKEN_SCAN as Ro, isIamRoleArn as Rr, readBootstrapMarkerBody as Rs, isReplacementOrphan as Rt, noEchoAttributeNamesOf as S, unpreviewableOrphanRecords as Sa, warnDeprecatedNoPrefixCliFlag as Sc, hasReadableOutputs as Si, journaledOrphanPrintingBag as Sn, carryLogOnlyValues as So, ec2InstanceProtectionSite as Sr, shouldRetainResource as Ss, dropFailedHint as St, noEchoParameterNamesOf as T, withheldAccountClause as Ta, CFN_TEMPLATE_URL_LIMIT as Tc, isReadableResourceEntry as Ti, secretNamePrintingBag as Tn, literalSplitDelimitersOf as To, reDisableInstanceApiTermination as Tr, stringifyValue as Ts, loadJournaledOrphans as Tt, ECR_AUTO_DELETE_IMAGES_TAG as U, coerceCfnBoolean as Ua, absoluteAssemblyPathEscape as Uc, malformedScrubResourceEntriesRefusalMessage as Ui, ledgerForStack as Un, inheritNestedStackParameterAssociations as Uo, envCredentialsAreAssumedRole as Ur, resolveDockerContextDirectory as Us, replacementNeverSwapped as Ut, deleteTableWithIndexBusyRetry as V, toCfnInteger as Va, nullPrototypeRecord as Vc, malformedResourcePropertiesWarning as Vi, RollbackInlinePolicyWriters as Vn, pathCrossesDottedKey as Vo, applyCallerIdentityCredentials as Vr, buildDenyExternalAccessPolicy as Vs, recheckFailedPlan as Vt, S3_AUTO_DELETE_OBJECTS_TAG as W, coerceCfnInteger as Wa, describeFileReadFailure as Wc, malformedStateRefusalMessage as Wi, reserveStackCreateToken as Wn, recordNestedStackParameterExpressions as Wo, isSettledInstanceState as Wr, describeDockerCapturedOutput as Ws, resolveReplacementOldType as Wt, createReadOnlyAttributeHealerFactory as X, requireConfigArray as Xa, refuseMalformedOrphans as Xi, readTagList as Xn, recordNoEchoAttributeValues as Xo, coerceParameterTypedValue as Xr, getDockerCmd as Xs, REDACTED_DELETE_ADDRESS_SKIP_REASON as Xt, formatResourceLine as Y, replayWarn as Ya, resolveBucketRegion as Yc, refuseMalformedOrphanRecordsForDestroy as Yi, planTagDiff as Yn, recordMaskOnlyValuesIn as Yo, s3BucketWebsiteUrl as Yr, formatDockerLoginError as Ys, inheritProducerRegions as Yt, bold as Z, requireConfigObject as Za, refuseMalformedOrphansForDestroy as Zi, refuseMalformedDesiredTags as Zn, recordNoEchoParameterFreshValue as Zo, isUnboundTemplateParameter as Zr, isDockerClientEnvKey as Zs, isRedactedRecordedValue as Zt, makeCanonicalizePropertiesFn as _, repairMalformedOrphansForReadOnly as _a, resolveSkipPrefix as _c, UNREADABLE_RESOURCES_MAP_ROW as _i, isExportAliasCollision as _n, passedNoEchoParametersOf as _o, deleteSkipReason as _r, importableOutputKeys as _s, revertedNestedRowIds as _t, findNestedTemplateTreeDefect as a, refuseMalformedResourceEntriesForImport as aa, escapeRegExp$3 as ac, AWS_NO_VALUE as ai, displayTextOrWithheld as an, sameLambdaFunctionAddress as ao, isCustomResource as ar, isSingleDynamicReferenceToken as as, reachableDivergentParameters as at, serviceTokenBlockingReason as b, repairMalformedResourcePropertiesForReadOnly as ba, resolveUseCdkBootstrapAssets as bc, displayLogicalId as bi, DEFAULT_RESOURCE_WARN_AFTER_MS as bn, valueAtCoordinate as bo, markWaitAbandoned as br, orphansAfterRollback as bs, withNestedStackContext as bt, renderNestedTemplateTreeDefect as c, refuseMalformedResourcePropertiesForDestroy as ca, getDockerImageBySourceHash as cc, refStateLookupFromResource as ci, secretBearingStateKeyWarning as cn, canonicalCoordinates as co, readsNoEchoDeleteValues as cr, S3StateBackend as cs, planOrphanAdoption as ct, conditionInputsFrom as d, refuseMalformedResourcePropertiesForOrphan as da, getDefaultStateBucketName as dc, parameterInputsFor as di, exportNameNoEchoParameters as dn, maskReadbackAtCoordinates as do, withPrintingSecrets as dr, acceptedCreateOnlyDropsOf as ds, displacedPhysicalIdShown as dt, refuseMalformedOutputsForDestroy as ea, redactDockerArgvValues as ec, isImpossibleEmptyStoredAttribute as ei, updatePartialMessage as en, templateResourceTypes as eo, definedAttributes as er, STATE_SOURCED_BASELINE_RULES as es, green as et, parentSuppliedValues as f, refuseMalformedResourcesForDeploy as fa, getLegacyStateBucketName as fc, passedParameterClassesOf as fi, exportNameSecretExposure as fn, maskWholeValue as fo, CloudControlProvider as fr, describeRegionValueKind as fs, dropSettledNestedJournals as ft, mergeNoChangeOutputs as g, repairMalformedOrphanRecordsForReadOnly as ga, resolveCaptureObservedState as gc, UNREADABLE_ORPHANS_CONTAINER_ROW as gi, collectPublishedOutputNames as gn, noEchoOutputsComparison as go, deleteIndeterminateGuards as gr, hasUnverifiableParameterRefusal as gs, revertNestedChildFromJournal as gt, keptWholeReasonText as h, refuseMalformedState as ha, resolveAutoAssetStorage as hc, STATE_RESOURCES_MALFORMED as hi, collectDeclaredOutputNames as hn, noEchoLeavesOf as ho, UNSPECIFIED_SKIP_REASON as hr, hasReasonlessBaselineRefusal as hs, recordDisplacedSkips as ht, childTemplateLoader as i, refuseMalformedResourceEntriesForDestroy as ia, warnFinchArgvExposure as ic, keepsSecretReferenceToken as ii, WITHHELD_NAME_DISPLAY as in, lambdaFunctionNameForMask as io, ccBrokenReason as ir, WHOLE_DYNAMIC_REFERENCE_PATTERN as is, namesAnyDeclaredParameter as it, readProtection as j, hasNoCloudControlHandlers as ja, expectedOwnerParam as jc, malformedLocalResourcesWarning as ji, ccRoutedFinalSnapshotError as jn, createSecretMasker as jo, classifyReplaySecretRegion as jr, AssetModeResolver as js, destroyStackRecordsView as jt, isProtectionValueActive as k, withoutSilentDropProperties as ka, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as kc, malformedLocalOutputsWarning as ki, PRE_DELETE_SNAPSHOT_TYPES as kn, recordLogOnlyValue as ko, IntrinsicFunctionResolver as kr, loadPublishableAssetManifest as ks, replayRollback as kt, templateIdentity as l, refuseMalformedResourcePropertiesForDrift as la, Synthesizer as lc, parseWebACLArn as li, secretSafeKeyDisplay as ln, isMarkedCoordinate as lo, isCustomResourceType as lr, rebuildClientForBucketRegion as ls, NESTED_PENDING_PARENT_REASON as lt, isSecretBearingReferenceString as m, refuseMalformedResourcesForExport as ma, resolveApp as mc, STATE_REGION_DIVERGED as mi, noEchoParameterValueSeed as mn, noEchoCoordinatesOf as mo, unchangedBehindSecretReference as mr, hasReadableExportSet as ms, nestedChildStackName as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedResourceEntries as na, runDockerForeground as nc, carriesFetchableDynamicReference as ni, DeploymentEventsReader as nn, withRetry as no, CC_BROKEN_REASON as nr, STATE_SOURCED_READBACK_RULES as ns, yellow as nt, isAbsoluteAssetPath as o, refuseMalformedResourceEntriesForImportSave as oa, stripControlChars as oc, cfnRefValueFromPhysicalId as oi, exportAliasCollisionScrubWarning as on, DagBuilder as oo, wouldReturnToSdkProvider as or, LockManager as os, resourcesNamingDeclaredParameter as ot, readRecordedConditionVerdicts as p, refuseMalformedResourcesForDestroy as pa, loadCdkJson as pc, JSON_LISTING_HOLE_VALUE as pi, isWholeDynamicReferenceValue as pn, maskedLeafCoordinatesOf as po, slowCcOperationTimeoutMs as pr, exportNamesCarriedFrom as ps, getNestedRevertRun as pt, getPriorAttempts as q, configStringRefusal as qa, resolveAssemblyPath as qc, refuseMalformedNestedChildOutputs as qi, DBPROXY_TAGS_WHAT as qn, provenPublicValue as qo, s3BucketDualStackDomainName as qr, dockerSpawnEnvWithSensitive as qs, findNestedStackTypeChanges as qt, computeImplicitDeleteEdges as r, refuseMalformedResourceEntriesForDeploy as ra, runDockerStreaming as rc, isNamelessDynamicReferenceError as ri, DeploymentEventsStore as rn, canonicalLambdaFunctionName as ro, ProviderRegistry as rr, TEMPLATE_SOURCED_RULES as rs, computeParameterTaint as rt, listNestedTemplateRows as s, refuseMalformedResourceEntriesForOrphan as sa, AssetManifestLoader as sc, isStalePlaceholderArnAttribute as si, secretBearing as sn, TemplateParser as so, TemplateNoEchoReresolver as sr, isLockInfoExpired as ss, makeSiblingClaimReader as st, DeployEngine as t, refuseMalformedResourceAttributesForOrphan as ta, redactedDockerCause as tc, carriesDynamicReference as ti, updatePartialReason as tn, describeTypeWithThrottleRetry as to, stringifyIfAssigned as tr, STATE_SOURCED_CROSS_GENERATION_RULES as ts, red as tt, conditionFingerprint as u, refuseMalformedResourcePropertiesForExport as ua, synthesisStatusMessage as uc, withSharedDrainBudget as ui, carriedExportAliasExposure as un, maskAtCoordinates as uo, getCurrentResourceSecrets as ur, splitImportedOps as us, displacedOpClause as ut, deferredServiceTokenWarning as v, repairMalformedOutputsForReadOnly as va, resolveStateBucketWithDefault as vc, accountArgs as vi, bindingSkippedOutputs as vn, readbackPathFor as vo, withIndeterminateGuard as vr, importableOutputs as vs, withNestedRevertRun as vt, noEchoExactEchoLeavesOf as w, unreadableResourceEntries as wa, CFN_TEMPLATE_BODY_LIMIT as wc, isReadableOrphanRecord as wi, orphanRecordsPrintingBag as wn, hasMaskableValues as wo, observeThenDisableInstanceApiTermination as wr, isSensitiveAttributeName as ws, journaledOrphanLines as wt, withResourceDeadline as x, repairMalformedResourcesForReadOnly as xa, stateBucketExistenceConfirmed as xc, hasReadableOrphans as xi, completedReplayEntries as xn, liveMatchesUnresolvedTokenFrame as xo, disableInstanceApiTermination as xr, orphansCarriedFrom as xs, deleteJournaledOrphans as xt, findServiceTokenRefusals as y, repairMalformedResourceEntriesForReadOnly as ya, resolveStateBucketWithDefaultAndSource as yc, deployRefusesOrphanRowsReason as yi, DEFAULT_RESOURCE_TIMEOUT_MS as yn, readsNoEchoSource as yo, isWaitAbandonedError as yr, isReadableBag as ys, getCurrentNestedStackContext as yt, DELETE_INDEX_WAIT_PROCEED_NOTE as z, coerceWarmThroughput as za, hasOwnKey as zc, malformedRenderedContainersWarning as zi, findDestructiveChanges as zn, dynamicReferenceTokens as zo, sendableAssumeRoleCommand as zr, validateAssetBucketName as zs, planFailedOps as zt };
-//# sourceMappingURL=deploy-engine-D4FdwPCi.js.map
+export { getPriorAttempts as $, configBooleanRefusal as $a, hasOwnKey as $c, previewableOrphanRecords as $i, acquireIdempotencyToken as $n, recoverMaskedOutput as $o, s3BucketArn as $r, validateAssetBucketName as $s, orphanDeleteNeedsIdentity as $t, noEchoExactEchoLeavesOf as A, unpreviewableOrphanRecords as Aa, resolveCaptureObservedState as Ac, hasReadableOutputs as Ai, maskEventTextWithBoundBags as An, carryLogOnlyValues as Ao, ec2InstanceProtectionSite as Ar, hasUnverifiableParameterRefusal as As, isHandledOrphan as At, beginDeleteWait as B, findReplacedReadersOfRecreateTargets as Ba, MIGRATE_TMP_PREFIX as Bc, malformedOrphanRecordsRefusalMessage as Bi, effectiveDeletionPolicy as Bn, errorCauseChain as Bo, producerRegionsFromState as Br, WorkGraph as Bs, withStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedState as Ca, Synthesizer as Cc, STATE_RESOURCES_MALFORMED as Ci, collectPublishedOutputNames as Cn, noEchoLeavesOf as Co, deleteIndeterminateGuards as Cr, isNotImplemented as Cs, revertedNestedRowIds as Ct, withResourceDeadline as D, repairMalformedResourceEntriesForReadOnly as Da, loadCdkJson as Dc, deployRefusesOrphanRowsReason as Di, DEFAULT_RESOURCE_WARN_AFTER_MS as Dn, readsNoEchoSource as Do, isWaitAbandonedError as Dr, exportNamesCarriedFrom as Ds, withNestedStackContext as Dt, serviceTokenBlockingReason as E, repairMalformedOutputsForReadOnly as Ea, getLegacyStateBucketName as Ec, accountArgs as Ei, DEFAULT_RESOURCE_TIMEOUT_MS as En, readbackPathFor as Eo, withIndeterminateGuard as Er, describeRegionValueKind as Es, getCurrentNestedStackContext as Et, isProtectionValueActive as F, findSilentDropProperties as Fa, stateBucketExistenceConfirmed as Fc, malformedExportNamesWarning as Fi, ATOMIC_FINAL_SNAPSHOT_TYPES as Fn, printingCorpusOf as Fo, DiffCalculator as Fr, orphansCarriedFrom as Fs, replayFailedOperations as Ft, DELETE_INDEX_WAIT_PROCEED_NOTE as G, renderStatefulReason as Ga, expectedOwnerParam as Gc, malformedOutputsRefusalMessage as Gi, constructPathOf as Gn, scrubResourceRecord as Go, explicitRoleArnOrThrow as Gr, AssetModeResolver as Gs, isReplacementOrphan as Gt, deleteBudgetKey as H, MULTI_REGION_RECREATE_BLOCKED_TYPES as Ha, uploadCfnTemplate as Hc, malformedOrphanRowsKeptWarning as Hi, refusesFinalSnapshot as Hn, maskSecretsInText as Ho, applyRoleArnIfSet as Hr, createAssetRedirectResolver as Hs, recordAfterRollbackUpdate as Ht, perType as I, unwrittenCreateOnlyReplacement as Ia, warnDeprecatedNoPrefixCliFlag as Ic, malformedExportSourceWarning as Ii, PRE_DELETE_SNAPSHOT_TYPES as In, recordLogOnlyParameterValue as Io, INTRINSIC_KEYS as Ir, shouldRetainResource as Is, replayRollback as It, waitForIndexesSettled as J, isWarmThroughputDecrease as Ja, derivePartitionAndUrlSuffix as Jc, malformedResourceEntriesWarning as Ji, RollbackInlinePolicyWriters as Jn, isUncertifiedBaselineMaskPosition as Jo, AWS_CREDENTIAL_ENV_KEYS as Jr, ensureAssetStorage as Js, recheckFailedPlan as Jt, INDEX_SETTLE_POLL_INTERVAL_MS as K, WARM_THROUGHPUT_MEMBERS as Ka, PARTITION_TABLE as Kc, malformedOutputsWarning as Ki, findDestructiveChanges as Kn, DYNAMIC_REFERENCE_TOKEN_SCAN as Ko, isIamRoleArn as Kr, BOOTSTRAP_MARKER_PREFIX as Ks, planFailedOps as Kt, readProtection as L, withoutSilentDropProperties as La, ssmResolvedValueType as Lc, malformedLocalOutputsWarning as Li, buildFinalSnapshotIdentifier as Ln, recordLogOnlyValue as Lo, IntrinsicFunctionResolver as Lr, AssetPublisher as Ls, awaitInFlightSibling as Lt, recordedProtectionEvidence as M, unreadableResourceEntries as Ma, resolveStateBucketWithDefault as Mc, isReadableOrphanRecord as Mi, secretNamePrintingBag as Mn, hasMaskableValues as Mo, observeThenDisableInstanceApiTermination as Mr, importableOutputs as Ms, loadJournaledOrphans as Mt, recordedProtectionNote as N, withheldAccountClause as Na, resolveStateBucketWithDefaultAndSource as Nc, isReadableResourceEntry as Ni, stateSecretNameNeedles as Nn, literalSplitDelimitersOf as No, reDisableInstanceApiTermination as Nr, isReadableBag as Ns, makeForeignHolderScan as Nt, noEchoAttributeNamesOf as O, repairMalformedResourcePropertiesForReadOnly as Oa, resolveApp as Oc, displayLogicalId as Oi, completedReplayEntries as On, valueAtCoordinate as Oo, markWaitAbandoned as Or, hasReadableExportSet as Os, deleteJournaledOrphans as Ot, PROTECTION_PROPERTY_BY_TYPE as P, findActionableSilentDrops as Pa, resolveUseCdkBootstrapAssets as Pc, malformedDriftResourcePropertiesWarning as Pi, extractDeploymentEventError as Pn, logOnlyValueCount as Po, reEnableInstanceApiTermination as Pr, orphansAfterRollback as Ps, sameJournaledOrphans as Pt, isTruthyCfnBoolean as Q, coerceCfnInteger as Qa, defineOwnKey as Qc, malformedStateRefusalMessage as Qi, withCreateTokenLedger as Qn, recordNestedStackParameterExpressions as Qo, isSettledInstanceState as Qr, readBootstrapMarkerBody as Qs, seedsDeleteFirstGuard as Qt, DynamoDBGlobalTableProvider as R, NO_CC_HANDLERS_REASON as Ra, CFN_TEMPLATE_BODY_LIMIT as Rc, malformedLocalResourceEntriesWarning as Ri, ccRoutedFinalSnapshotError as Rn, shareLogOnlyValues as Ro, poisonRenderedSpellingsCollidingIn as Rr, isSensitiveAttributeName as Rs, destroyStackRecordsView as Rt, keptForReadoption as S, refuseMalformedResourcesForExport as Sa, getDockerImageBySourceHash as Sc, STATE_REGION_DIVERGED as Si, collectDeclaredOutputNames as Sn, noEchoCoordinatesOf as So, UNSPECIFIED_SKIP_REASON as Sr, isAccessDenied as Ss, revertNestedChildFromJournal as St, findServiceTokenRefusals as T, repairMalformedOrphansForReadOnly as Ta, getDefaultStateBucketName as Tc, UNREADABLE_RESOURCES_MAP_ROW as Ti, bindingSkippedOutputs as Tn, passedNoEchoParametersOf as To, deleteSkipReason as Tr, acceptedCreateOnlyDropsOf as Ts, collectNestedChildUnaddressed as Tt, resolveDynamoDbDeleteBudgetClock as U, isStatefulRecreateTargetForReplace as Ua, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Uc, malformedOrphansRefusalMessage as Ui, unsupportedFinalSnapshotError as Un, markSameGenerationBag as Uo, assertFlagRoleArn as Ur, loadPublishableAssetManifest as Us, demoteSupersededOrphans as Ut, compensateRemovedDeletionProtection as V, shownType as Va, findLargeInlineResources as Vc, malformedOrphanRecordsWarning as Vi, isFinalSnapshotError as Vn, maskSecretsInError as Vo, regionLessSecretName as Vr, buildAssetRedirectMap as Vs, removeProtectionTypeList as Vt, resolveDynamoDbDeleteBudgetMs as W, isStatefulRecreateTargetSync as Wa, decodeListingKey as Wc, malformedOrphansWarning as Wi, maskingRetryLogger as Wn, redactSecretsForState as Wo, assertSendableRoleArn as Wr, rewriteTemplateAssetReferences as Ws, isJournaledOrphan as Wt, S3_AUTO_DELETE_OBJECTS_TAG as X, toFiniteNumber as Xa, StageLoadError as Xc, malformedResourcesWarning as Xi, ledgerForStack as Xn, identityKeyFor as Xo, callerEnvCredentials as Xr, isCrossRegionRedirect as Xs, replacementNeverSwapped as Xt, ECR_AUTO_DELETE_IMAGES_TAG as Y, toCfnInteger as Ya, AssemblyReader as Yc, malformedResourcePropertiesWarning as Yi, earliestDefined as Yn, pathCrossesDottedKey as Yo, applyCallerIdentityCredentials as Yr, getBootstrapMarkerKey as Ys, recordUnderIdIsNotOwn as Yt, hasCdkAutoDeleteTag as Z, coerceCfnBoolean as Za, processStackMessages as Zc, malformedScrubResourceEntriesRefusalMessage as Zi, reserveStackCreateToken as Zn, inheritNestedStackParameterAssociations as Zo, envCredentialsAreAssumedRole as Zr, parseBootstrapMarker as Zs, resolveReplacementOldType as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedResourcePropertiesForDrift as _a, runDockerStreaming as _c, parseWebACLArn as _i, carriedExportAliasExposure as _n, isMarkedCoordinate as _o, getCurrentResourceSecrets as _r, rebuildClientForBucketRegion as _s, displacedPhysicalIdShown as _t, findNestedTemplateTreeDefect as a, refuseMalformedOrphansForDestroy as aa, describeDockerExecFailure as ac, isUnboundTemplateParameter as ai, displayAssemblyPath as al, redactedDeleteAddressFields as an, requireConfigObject as ao, tagMapAsList as ar, recordNoEchoParameterFreshValue as as, gray as at, lookupEachName as b, refuseMalformedResourcesForDeploy as ba, stripControlChars as bc, passedParameterClassesOf as bi, isWholeDynamicReferenceValue as bn, maskWholeValue as bo, slowCcOperationTimeoutMs as br, applyCrossPrefixScan as bs, nestedChildStackName as bt, renderNestedTemplateTreeDefect as c, refuseMalformedOutputsForDestroy as ca, finchSecretArgvRefusal as cc, isImpossibleEmptyStoredAttribute as ci, clearBucketRegionCache as cl, updatePartialReason as cn, templateResourceTypes as co, stringifyIfAssigned as cr, STATE_SOURCED_BASELINE_RULES as cs, yellow as ct, conditionInputsFrom as d, refuseMalformedResourceEntriesForDeploy as da, isDockerClientEnvKey as dc, isNamelessDynamicReferenceError as di, WITHHELD_NAME_DISPLAY as dn, canonicalLambdaFunctionName as do, ccBrokenReason as dr, TEMPLATE_SOURCED_RULES as ds, reachableDivergentParameters as dt, refuseDivergentRecordRegionForDestroy as ea, validateContainerRepoName as ec, s3BucketDomainName as ei, hasPlainPrototype$1 as el, findNestedStackTypeChanges as en, configIntegerRefusal as eo, DBPROXY_TAGS_WHAT as er, carriesSecretMask as es, markRefusedBeforeApplying as et, parentSuppliedValues as f, refuseMalformedResourceEntriesForDestroy as fa, isMalformedEnvKey as fc, keepsSecretReferenceToken as fi, displayTextOrWithheld as fn, lambdaFunctionNameForMask as fo, isCustomResource as fr, WHOLE_DYNAMIC_REFERENCE_PATTERN as fs, resourcesNamingDeclaredParameter as ft, mergeNoChangeOutputs as g, refuseMalformedResourcePropertiesForDestroy as ga, runDockerForeground as gc, refStateLookupFromResource as gi, secretSafeKeyDisplay as gn, canonicalCoordinates as go, isCustomResourceType as gr, S3StateBackend as gs, displacedOpClause as gt, keptWholeReasonText as h, refuseMalformedResourceEntriesForOrphan as ha, redactedDockerCause as hc, isStalePlaceholderArnAttribute as hi, secretBearingStateKeyWarning as hn, TemplateParser as ho, readsNoEchoDeleteValues as hr, isLockInfoExpired as hs, NESTED_PENDING_PARENT_REASON as ht, childTemplateLoader as i, refuseMalformedOrphans as ia, describeDockerCapturedOutput as ic, coerceParameterTypedValue as ii, describeFileReadFailure as il, isRedactedRecordedValue as in, requireConfigArray as io, refuseMalformedDesiredTags as ir, recordNoEchoAttributeValues as is, cyan as it, noEchoParameterNamesOf as j, unreadableOrphanRecords as ja, resolveSkipPrefix as jc, hasReadableResources as ji, orphanRecordsPrintingBag as jn, createUnionSecretMasker as jo, isTerminationProtectionPropagationError as jr, importableOutputKeys as js, journaledOrphanLines as jt, noEchoComparisonForTemplate as k, repairMalformedResourcesForReadOnly as ka, resolveAutoAssetStorage as kc, hasReadableOrphans as ki, journaledOrphanPrintingBag as kn, liveMatchesUnresolvedTokenFrame as ko, disableInstanceApiTermination as kr, hasReasonlessBaselineRefusal as ks, dropFailedHint as kt, templateIdentity as l, refuseMalformedResourceAttributesForOrphan as la, formatDockerLoginError as lc, carriesDynamicReference as li, resolveBucketRegion as ll, DeploymentEventsReader as ln, describeTypeWithThrottleRetry as lo, CC_BROKEN_REASON as lr, STATE_SOURCED_CROSS_GENERATION_RULES as ls, computeParameterTaint as lt, isSecretBearingReferenceString as m, refuseMalformedResourceEntriesForImportSave as ma, redactDockerArgvValues as mc, cfnRefValueFromPhysicalId as mi, secretBearing as mn, DagBuilder as mo, TemplateNoEchoReresolver as mr, LockManager as ms, planOrphanAdoption as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedOrphanRecords as na, buildDockerImage as nc, s3BucketRegionalDomainName as ni, ownValue as nl, inheritProducerRegions as nn, readConfigString as no, planTagDiff as nr, recordMaskOnlyValue as ns, createReadOnlyAttributeHealerFactory as nt, isAbsoluteAssetPath as o, refuseMalformedOrphansForOrphan as oa, describeDockerFailure as oc, parameterTypeMayLoseSecretIdentity as oi, renderAssemblyPathEscape as ol, redactedDeleteAddressSkip as on, requireConfigString as oo, tagPlanWarning as or, recordProvenPublicExpression as os, green as ot, readRecordedConditionVerdicts as p, refuseMalformedResourceEntriesForImport as pa, partitionSensitiveEnv as pc, AWS_NO_VALUE as pi, exportAliasCollisionScrubWarning as pn, sameLambdaFunctionAddress as po, wouldReturnToSdkProvider as pr, isSingleDynamicReferenceToken as ps, makeSiblingClaimReader as pt, deleteTableWithIndexBusyRetry as q, coerceWarmThroughput as qa, canonicalizeRegion as qc, malformedRenderedContainersWarning as qi, formatDestructiveChange as qn, dynamicReferenceTokens as qo, sendableAssumeRoleCommand as qr, assertAssetBucketRegion as qs, planRollback as qt, computeImplicitDeleteEdges as r, refuseMalformedOrphanRecordsForDestroy as ra, resolveDockerContextDirectory as rc, s3BucketWebsiteUrl as ri, absoluteAssemblyPathEscape as rl, REDACTED_DELETE_ADDRESS_SKIP_REASON as rn, replayWarn as ro, readTagList as rr, recordMaskOnlyValuesIn as rs, bold as rt, listNestedTemplateRows as s, refuseMalformedOutputs as sa, dockerSpawnEnvWithSensitive as sc, getAccountInfo as si, resolveAssemblyPath as sl, updatePartialMessage as sn, prefetchCreateOnlyPropertyPaths as so, definedAttributes as sr, wholeStringLeavesOf as ss, red as st, DeployEngine as t, refuseMalformedNestedChildOutputs as ta, buildDenyExternalAccessPolicy as tc, s3BucketDualStackDomainName as ti, nullPrototypeRecord as tl, getCurrentProducerRegions as tn, configStringRefusal as to, DBPROXY_TAG_OPTIONS as tr, provenPublicValue as ts, formatResourceLine as tt, conditionFingerprint as u, refuseMalformedResourceEntries as ua, getDockerCmd as uc, carriesFetchableDynamicReference as ui, DeploymentEventsStore as un, withRetry as uo, ProviderRegistry as ur, STATE_SOURCED_READBACK_RULES as us, namesAnyDeclaredParameter as ut, chunks as v, refuseMalformedResourcePropertiesForExport as va, warnFinchArgvExposure as vc, withSharedDrainBudget as vi, exportNameNoEchoParameters as vn, maskAtCoordinates as vo, withPrintingSecrets as vr, CrossPrefixReadError as vs, dropSettledNestedJournals as vt, deferredServiceTokenWarning as w, repairMalformedOrphanRecordsForReadOnly as wa, synthesisStatusMessage as wc, UNREADABLE_ORPHANS_CONTAINER_ROW as wi, isExportAliasCollision as wn, noEchoOutputsComparison as wo, deleteLeftInPlace as wr, splitImportedOps as ws, withNestedRevertRun as wt, withApiLimit as x, refuseMalformedResourcesForDestroy as xa, AssetManifestLoader as xc, JSON_LISTING_HOLE_VALUE as xi, noEchoParameterValueSeed as xn, maskedLeafCoordinatesOf as xo, unchangedBehindSecretReference as xr, crossPrefixDeniedWarning as xs, recordDisplacedSkips as xt, isAccessDeniedError as y, refuseMalformedResourcePropertiesForOrphan as ya, escapeRegExp$3 as yc, parameterInputsFor as yi, exportNameSecretExposure as yn, maskReadbackAtCoordinates as yo, CloudControlProvider as yr, CrossPrefixScanCache as ys, getNestedRevertRun as yt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as z, hasNoCloudControlHandlers as za, CFN_TEMPLATE_URL_LIMIT as zc, malformedLocalResourcesWarning as zi, createPreDeleteFinalSnapshot as zn, createSecretMasker as zo, classifyReplaySecretRegion as zr, stringifyValue as zs, getStackRecords as zt };
+//# sourceMappingURL=deploy-engine-BuPc2Dfc.js.map