@go-to-k/cdkd 0.296.3 → 0.296.5

package/dist/{deploy-engine-Dre6eDNJ.js → deploy-engine-Cm7z6aQk.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js";
-import { A as displaySafe, E as UNRENDERABLE, F as safeMsg, L as truncateCodePoints, M as isPasteableIdent, O as displayAwsMessage, P as plainIdentOr, S as withoutGeneratedFallbackName, T as STACK_REF_MAX_CODE_POINTS, _ as getCurrentSkipPrefix, b as withSkipPrefix, c as getLiveRenderer, f as applyDefaultNameForFallback, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, m as explicitNamePropertyFor, n as getLogger, r as isStdoutReservedForPayload, s as installLogLineMaskerSource, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS, x as withStackName, y as looksLikeCdkdGeneratedName } from "./logger-Dvc7ddKe.js";
-import { $n as markRedactedCause, $t as LockError, A as isTerminalDeleteFailure, At as CUSTOM_RESOURCE_RESPONSE_PREFIX, Bn as isAmbiguousCcHandlerErrorCode, Bt as clientDefaultsFor, C as refusalTypeShown, Cn as physicalIdShownBesideCommand, Ct as buildForceUnlockCommand, D as ProtectionFlipRegistry, Dn as shellQuote, Dt as formatLockOperation, En as shellBoundedDisplay, Et as formatLockExpiry, Fn as isRecreateRetryableError, Ft as producerRecordKey, Gn as retryClassificationText, H as pasteableAwsCommand, Hn as isIamPropagationError, Ht as AccountIdUnavailableError, In as isReplayedNameCollisionFrom, J as isInterruptedWaitError, Jn as safeStringify$1, Kn as describeAwsFailure, Kt as CrossAccountSecretRefusalError, Lt as withPasteableAwsProfile, M as observeThenDisableProtection, Mn as hasReplayMayCollide, Mt as injectiveKey, N as protectionFlipKey, Nn as isNameCollisionErrorFrom, O as compensateProtectionFlip, On as withheldTargetClause, Ot as formatLockOwner, Pn as isNameCooldownError, Q as canonicalizeRoute53QueryName, Qn as markNonRetryable, R as DELETION_PROTECTION_DOC_POINTER, Rn as markReplayMayCollide, Rt as ambientClientDefaults, S as quotedRemedyLogicalId, Sn as pasteableCommand, St as UNREPRODUCIBLE_LOCK_CLAUSE, T as resolveExplicitPhysicalId, Tn as quotedOrDescribed, U as protectedReplacementAdvice, Un as isRetryableTransientError, Ut as AssetError, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, Wn as isTransientServerError, Wt as CdkdError, X as ElapsedBudgetRegistry, Xn as isMarkedNonRetryable, Xt as IntrinsicResolutionRefusalError, Y as startInterruptWatch, Yt as DynamicReferenceRegionAmbiguousError, Z as monotonicNowMs, Zn as isThrottlingError, _n as SHELL_ACTIVE_WHY, _t as hasCreatedBeforeFailure, an as ResourceTimeoutError, at as segmentAfterAnchor, b as isQuotableImportValue, bt as markAuxiliaryFailure, ct as createMaskedRetryLogger, d as prepareRemovalForUpdate, dt as maskerOrIdentity, en as MacroExpansionError, er as wrapMaskedAwsError, et as compositeIdSeparatorRefusal, f as removalWarning, ft as withDerivedNameMasks, g as assertRegionMatch, gn as SHELL_ACTIVE, gt as createdBeforeFailure, h as RESOURCE_NOT_FOUND, i as holdsSecretDerivedEntry, in as ProvisioningError, it as resourceTypeShown, jn as isUpdateUnsupportedError, jt as DEFAULT_STATE_PREFIX, k as deleteWithProtectionCompensation, kt as sanitizeRecoveryValue, l as withUnchangedSecretPrincipalLists, ln as StateError, lt as isSecretDerivedValue, m as withoutInjectedRemovals, mt as carryCreatedBeforeFailure, nt as logicalIdShown, on as ResourceUpdateNotSupportedError, ot as stateOrphanRecordRemedy, pn as normalizeAwsError, pt as RETRY_AUXILIARY_OWNER, qt as DependencyError, st as createMaskedLogSinks, tn as MalformedProducerRecordRefusalError, un as SynthesisError, ut as maskDeep, vn as UNSHOWABLE_VALUE, vt as isAuxiliaryFailure, wn as plainOrDescribed, x as normalizeAwsTagsToCfn, xn as isInertUnquoted, xt as markCreatedBeforeFailure, yn as commandHole, yt as isAuxiliaryMarkOf, zn as formatRetryClassificationSignals, zt as ambientCredentialConfig } from "./iam-policy-targets-DSDSdxXz.js";
+import { A as displayIdent, C as withoutGeneratedFallbackName, D as UNRENDERABLE, E as STACK_REF_MAX_CODE_POINTS, F as plainIdentOr, I as safeMsg, M as displayStackName, N as isPasteableIdent, R as truncateCodePoints, S as withStackName, T as SECRET_REF_MAX_CODE_POINTS, _ as generateResourceNameWithFallback, b as looksLikeCdkdGeneratedName, c as installLogLineMaskerSource, g as generateResourceName, h as explicitNamePropertyFor, j as displaySafe, k as displayAwsMessage, l as getLiveRenderer, n as getLogger, p as applyDefaultNameForFallback, r as isStdoutReservedForPayload, s as currentLogLineMasker, v as getCurrentSkipPrefix, x as withSkipPrefix, y as getCurrentStackName } from "./logger-DAaB7GFO.js";
+import { $n as markRedactedCause, $t as LockError, A as isTerminalDeleteFailure, At as CUSTOM_RESOURCE_RESPONSE_PREFIX, Bn as isAmbiguousCcHandlerErrorCode, Bt as clientDefaultsFor, C as refusalTypeShown, Cn as physicalIdShownBesideCommand, Ct as buildForceUnlockCommand, D as ProtectionFlipRegistry, Dn as shellQuote, Dt as formatLockOperation, En as shellBoundedDisplay, Et as formatLockExpiry, Fn as isRecreateRetryableError, Ft as producerRecordKey, Gn as retryClassificationText, H as pasteableAwsCommand, Hn as isIamPropagationError, Ht as AccountIdUnavailableError, In as isReplayedNameCollisionFrom, J as isInterruptedWaitError, Jn as safeStringify$1, Kn as describeAwsFailure, Kt as CrossAccountSecretRefusalError, Lt as withPasteableAwsProfile, M as observeThenDisableProtection, Mn as hasReplayMayCollide, Mt as injectiveKey, N as protectionFlipKey, Nn as isNameCollisionErrorFrom, O as compensateProtectionFlip, On as withheldTargetClause, Ot as formatLockOwner, Pn as isNameCooldownError, Q as canonicalizeRoute53QueryName, Qn as markNonRetryable, R as DELETION_PROTECTION_DOC_POINTER, Rn as markReplayMayCollide, Rt as ambientClientDefaults, S as quotedRemedyLogicalId, Sn as pasteableCommand, St as UNREPRODUCIBLE_LOCK_CLAUSE, T as resolveExplicitPhysicalId, Tn as quotedOrDescribed, U as protectedReplacementAdvice, Un as isRetryableTransientError, Ut as AssetError, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, Wn as isTransientServerError, Wt as CdkdError, X as ElapsedBudgetRegistry, Xn as isMarkedNonRetryable, Xt as IntrinsicResolutionRefusalError, Y as startInterruptWatch, Yt as DynamicReferenceRegionAmbiguousError, Z as monotonicNowMs, Zn as isThrottlingError, _n as SHELL_ACTIVE_WHY, _t as hasCreatedBeforeFailure, an as ResourceTimeoutError, at as segmentAfterAnchor, b as isQuotableImportValue, bt as markAuxiliaryFailure, ct as createMaskedRetryLogger, d as prepareRemovalForUpdate, dt as maskerOrIdentity, en as MacroExpansionError, er as wrapMaskedAwsError, et as compositeIdSeparatorRefusal, f as removalWarning, ft as withDerivedNameMasks, g as assertRegionMatch, gn as SHELL_ACTIVE, gt as createdBeforeFailure, h as RESOURCE_NOT_FOUND, i as holdsSecretDerivedEntry, in as ProvisioningError, it as resourceTypeShown, jn as isUpdateUnsupportedError, jt as DEFAULT_STATE_PREFIX, k as deleteWithProtectionCompensation, kt as sanitizeRecoveryValue, l as withUnchangedSecretPrincipalLists, ln as StateError, lt as isSecretDerivedValue, m as withoutInjectedRemovals, mt as carryCreatedBeforeFailure, nt as logicalIdShown, on as ResourceUpdateNotSupportedError, ot as stateOrphanRecordRemedy, pn as normalizeAwsError, pt as RETRY_AUXILIARY_OWNER, qt as DependencyError, st as createMaskedLogSinks, tn as MalformedProducerRecordRefusalError, un as SynthesisError, ut as maskDeep, vn as UNSHOWABLE_VALUE, vt as isAuxiliaryFailure, wn as plainOrDescribed, x as normalizeAwsTagsToCfn, xn as isInertUnquoted, xt as markCreatedBeforeFailure, yn as commandHole, yt as isAuxiliaryMarkOf, zn as formatRetryClassificationSignals, zt as ambientCredentialConfig } from "./iam-policy-targets-td1X_kKN.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-B5LYpWJH.js";
+import { t as getCdkdVersion } from "./version-CjMP26Dj.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -15777,6 +15777,15 @@ function hasStringPhysicalId(entry) {
 	const physicalId = entry.physicalId;
 	return typeof physicalId === "string" && physicalId !== "";
 }
+function hasAddressablePhysicalId(entry) {
+	const physicalId = entry.physicalId;
+	return typeof physicalId === "string" && physicalId.trim() !== "";
+}
+function unaddressableUpdateRefusalMessage(rawStackName, rawRegion, logicalId, resourceType) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return `${stackClause(stackName, region)} holds a record for ${displayIdent(logicalId)} (${displayIdent(resourceType)}) with no non-empty string 'physicalId', so cdkd cannot address that resource in AWS and did not try to update it. 'cdkd deploy' fails on it rather than skipping it, since a skipped update would end the deploy without the template's change. Nothing was sent for this resource. Repair the record's 'physicalId' and re-run. ${inspectClause(stackName, region)}Inspect the record with: ` + inspectCommand(stackName, region);
+}
 function unpreviewableOrphanRecords(state) {
 	if (!Array.isArray(state.orphans)) return [];
 	const rows = state.orphans;
@@ -18093,7 +18102,7 @@ function noteAttributeSecrecy(logicalId, attributeName, value, context) {
 	return value;
 }
 function recordSecretNamedRead(logicalId, value, context) {
-	const bag = context.printingSecrets ?? context.recordedSecretValues;
+	const bag = context.secretNameSink ?? context.printingSecrets ?? context.recordedSecretValues;
 	if (bag === void 0 || context.secretNameNeedles === void 0) return;
 	const needles = context.secretNameNeedles(logicalId);
 	if (needles === void 0) return;
@@ -19395,6 +19404,7 @@ async function resolveSplit(splitArgs, context) {
 		}
 	}
 	if (context.printingSecrets !== void 0 && hasLogOnlyValues(context.printingSecrets)) recordLogOnlySplitFragments([context.printingSecrets], context.printingSecrets, resolvedValue, String(delimiter));
+	if (context.secretNameSink !== void 0 && hasLogOnlyValues(context.secretNameSink)) recordLogOnlySplitFragments([context.secretNameSink], context.secretNameSink, resolvedValue, String(delimiter));
 	const pieceTwins = String(delimiter) === "" && this.maskRenderedNeedlesForLog(resolvedValue, lineContext) !== resolvedValue ? result.map(() => "***") : this.splitLogTwins(resolvedValue, delimiter, result, context);
 	this.logger.debug(`Resolved Fn::Split: split by ${this.splitDelimiterRender(String(delimiter), lineContext)} resolved to ${this.logRender(JSON.stringify(this.maskValueLeaves(pieceTwins, lineContext)), lineContext, { structured: true })}`);
 	return result;
@@ -19717,7 +19727,11 @@ async function resolveBase64(value, context) {
 	}
 	if (context.recordedSecretValues && this.hasLogOnlyNeedles(context) && this.maskPrintedNeedlesForLog(resolvedValue, context) !== this.maskNeedlesForLog(resolvedValue, context)) recordLogOnlyValue(context.recordedSecretValues, result);
 	const printing = context.printingSecrets;
-	if (printing !== void 0 && hasMaskableValues(printing) && this.maskRenderedNeedlesForLog(resolvedValue, context) !== this.maskPrintedNeedlesForLog(resolvedValue, context)) recordLogOnlyValue(printing, result);
+	let withPrinting;
+	const maskedWithPrinting = () => withPrinting ??= this.maskNeedlesOfBags(resolvedValue, context, printing);
+	if (printing !== void 0 && hasMaskableValues(printing) && maskedWithPrinting() !== this.maskPrintedNeedlesForLog(resolvedValue, context)) recordLogOnlyValue(printing, result);
+	const sink = context.secretNameSink;
+	if (sink !== void 0 && hasMaskableValues(sink) && this.maskNeedlesOfBags(resolvedValue, context, printing, sink) !== maskedWithPrinting()) recordLogOnlyValue(sink, result);
 	this.logger.debug(`Resolved Fn::Base64: ${this.logRender(inputLogText, context)} resolved to ${this.logRender(inputLogText !== resolvedValue ? "***" : result, context)}`);
 	return result;
 }
@@ -19851,7 +19865,7 @@ function bigIntToIPv6(n) {
 function maskSecretsRaw(text, context) {
 	const registered = this.registeredLogTwin(text, context);
 	const needled = this.maskNeedlesForLog(text, context);
-	if (this.hasLogOnlyNeedles(context) || hasMaskableValues(context?.printingSecrets)) {
+	if (this.hasLogOnlyNeedles(context) || hasMaskableValues(context?.printingSecrets) || hasMaskableValues(context?.secretNameSink)) {
 		const printed = this.maskRenderedNeedlesForLog(text, context);
 		if (printed !== needled) return registered === void 0 ? printed : "***";
 	}
@@ -19882,13 +19896,13 @@ function maskPrintedNeedlesForLog(text, context) {
 	return this.maskNeedlesOfBags(text, context);
 }
 function maskRenderedNeedlesForLog(text, context) {
-	return this.maskNeedlesOfBags(text, context, context?.printingSecrets);
+	return this.maskNeedlesOfBags(text, context, context?.printingSecrets, context?.secretNameSink);
 }
-function maskNeedlesOfBags(text, context, printing) {
+function maskNeedlesOfBags(text, context, ...printing) {
 	const union = unionOfSecretBags([
 		context?.inheritedSecrets,
 		context?.recordedSecretValues,
-		printing
+		...printing
 	]);
 	return hasMaskableValues(union) ? maskSecretsInText(text, union) : text;
 }
@@ -21286,6 +21300,11 @@ function deleteSkipReason(result) {
 	const trimmed = result.reason.trim();
 	return trimmed === "" ? UNSPECIFIED_SKIP_REASON : trimmed;
 }
+function deleteLeftInPlace(result) {
+	if (result === void 0 || result.outcome !== "deleted") return void 0;
+	const left = result.leftInPlace;
+	return typeof left === "string" && left.length > 0 ? left : void 0;
+}
 const UNSPECIFIED_SKIP_REASON = "no reason reported by the provider";
 function deleteSkippedMessage(logicalId, physicalId, reason, duringClause, opts) {
 	return `cdkd did not confirm ${plainOrDescribed(logicalId, "logical id")} (${opts?.commandFreeLine === true ? displayIdent(physicalId, { maxCodePoints: 613 }) : skipPhysicalIdShown(physicalId)}) was deleted ${duringClause}, so it may still exist: ${skipReasonShown(reason)}`;
@@ -22031,7 +22050,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CksS_6jO.js");
+			const { ASGProvider } = await import("./asg-provider-DhyYUns2.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -22137,7 +22156,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-Dl--9uQU.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-B1GRQ6UO.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-B0JrOskT.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DCgJR2NX.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -23317,6 +23336,9 @@ function describeCfnResponseBody(body, parsed) {
 	const line = `Status=${capForLog(status)} PhysicalResourceId=${capForLog(physicalId)} ${dataPart}`;
 	return line.length > DESCRIBE_MAX_LINE_CHARS ? `${line.slice(0, DESCRIBE_MAX_LINE_CHARS)}...(${line.length} chars total)` : line;
 }
+function respondedPhysicalId(response) {
+	return hasAddressablePhysicalId({ physicalId: response.PhysicalResourceId }) ? response.PhysicalResourceId : void 0;
+}
 var CustomResourceProvider = class CustomResourceProvider {
 	lambdaClient;
 	snsClient;
@@ -23423,7 +23445,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				ResourceProperties: this.stringifyProperties(properties)
 			}), maskerOrIdentity(context?.maskSecrets));
 			if (cfnResponse.Status === "FAILED") throw new Error(`Custom resource handler returned FAILED: ${cfnResponse.Reason || "Unknown reason"}`);
-			const physicalId = cfnResponse.PhysicalResourceId || logicalId;
+			const physicalId = respondedPhysicalId(cfnResponse) ?? logicalId;
 			const attributes = cfnResponse.Data || {};
 			this.logger.debug(`Successfully created custom resource ${logicalId}: ${physicalId}`);
 			return {
@@ -23456,7 +23478,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				OldResourceProperties: this.stringifyProperties(previousProperties)
 			}), maskerOrIdentity(context?.maskSecrets));
 			if (cfnResponse.Status === "FAILED") throw new Error(`Custom resource handler returned FAILED: ${cfnResponse.Reason || "Unknown reason"}`);
-			const newPhysicalId = cfnResponse.PhysicalResourceId || physicalId;
+			const newPhysicalId = respondedPhysicalId(cfnResponse) ?? physicalId;
 			const wasReplaced = newPhysicalId !== physicalId;
 			const attributes = cfnResponse.Data || {};
 			this.logger.debug(`Successfully updated custom resource ${logicalId}: ${newPhysicalId}${wasReplaced ? " (replaced)" : ""}`);
@@ -28239,7 +28261,8 @@ var ReplayResolvers = class {
 };
 function regionAmbiguousReplaySecretError(logicalId, propertyPath, secretName, foreignProducerRegions, consumerRegion, execCtx) {
 	const where = propertyPath === "" ? "" : ` property ${quotedPlainOr(propertyPath, "property path")}`;
-	return new CdkdError(`Rollback of ${shownLogicalId(logicalId)}${where} cannot re-resolve the secret reference ${quotedPlainOr(secretName, "secret name")}: the reference carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.map((r) => plainOrDescribed(r, "region")).join(", ")}), so it may have been resolved in one of those rather than in ${quotedOrDescribed(consumerRegion, "region")}. A secret of the same name in two regions is two independent values, so replaying this would write the WRONG secret to a live resource. Refusing instead. Resolve the reference in its own region and set the property directly (or spell it as a full ARN, which names its region and is resolved there), then re-run ${rerunRollbackPhrase(execCtx, "'cdkd rollback'")}.`, "ROLLBACK_SECRET_REGION_AMBIGUOUS");
+	const error = new CdkdError(`Rollback of ${shownLogicalId(logicalId)}${where} cannot re-resolve the secret reference ${quotedPlainOr(secretName, "secret name")}: the reference carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.map((r) => plainOrDescribed(r, "region")).join(", ")}), so it may have been resolved in one of those rather than in ${quotedOrDescribed(consumerRegion, "region")}. A secret of the same name in two regions is two independent values, so replaying this would write the WRONG secret to a live resource. Refusing instead. Resolve the reference in its own region and set the property directly (or spell it as a full ARN, which names its region and is resolved there), then re-run ${rerunRollbackPhrase(execCtx, "'cdkd rollback'")}.`, "ROLLBACK_SECRET_REGION_AMBIGUOUS");
+	return markNonRetryable(error);
 }
 function refuseUnprovenReplaySecret(leaf, propertyPath, logicalId, execCtx) {
 	if (execCtx.producerRegionsIncomplete !== true) return;
@@ -29324,7 +29347,8 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 		skipped: 0,
 		interrupted: false,
 		remainingFailedOps: [],
-		orphaned: []
+		orphaned: [],
+		leftInPlace: 0
 	};
 	const { logger } = ctx;
 	const resolver = new ReplayResolvers(ctx.region);
@@ -29431,7 +29455,12 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
 						...ctx.skipFinalSnapshot === true && { skipFinalSnapshot: true },
 						deletionPolicy: snapshotPolicy ? "Snapshot" : "Delete",
-						recordedAttributes: failedCreateRecord?.attributes
+						recordedAttributes: failedCreateRecord?.attributes,
+						...op.physicalIdRecoveredFromError === true && {
+							failedCreateOrphan: true,
+							resolveAttemptedProperties: () => resolveReplayProps(op.attemptedProperties, resolver, secrets, ctx, op.logicalId),
+							...ctx.writtenThisRun !== void 0 && { writtenThisRun: ctx.writtenThisRun }
+						}
 					});
 					throwIfDeleteSkipped(failedCreateDelete, op.logicalId, op.physicalId, "while deleting the partially-created resource", {
 						ctx,
@@ -29440,6 +29469,12 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						provisionedBy: deleteRoutedVia,
 						mask
 					});
+					const leftInPlace = deleteLeftInPlace(failedCreateDelete);
+					if (leftInPlace !== void 0) {
+						logger.warn(safeMsg`  Rollback: deleted partially-created ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}) only in part — ${leftInPlace}; manual attention may be required`);
+						result.warnings++;
+						result.leftInPlace++;
+					}
 					if (!isReplacementOrphan(op)) delete stateResources[op.logicalId];
 					await options.afterOp?.(op.logicalId);
 					ctx.recordEvent?.({
@@ -30018,6 +30053,105 @@ function makeSiblingClaimReader(params) {
 	};
 }
 
+//#endregion
+//#region src/deployment/secret-name-needles.ts
+function secretNameNeedlesOf(logicalId, record, secrets, options) {
+	const physicalId = typeof record?.physicalId === "string" && record.physicalId !== "" ? record.physicalId : void 0;
+	const bag = secrets !== void 0 && hasMaskableValues(secrets) ? secrets : void 0;
+	const mask = (text) => bag === void 0 ? text : maskSecretsInText(text, bag);
+	const unresolved = (value) => value.includes("{{resolve:") || value === "***";
+	const named = {
+		resourceType: record?.resourceType,
+		properties: record?.properties,
+		logicalId
+	};
+	const needles = /* @__PURE__ */ new Set();
+	const add = (needle) => {
+		if (typeof needle === "string" && needle !== "") needles.add(needle);
+	};
+	for (const [raw, derived] of secretDerivedNamePairs({
+		...named,
+		physicalIds: []
+	})) if (typeof raw === "string" && !unresolved(raw) && isSecretDerivedValue(raw, mask)) add(derived);
+	for (const [raw, spelling] of secretDerivedNamePairs({
+		...named,
+		physicalIds: [physicalId ?? "cdkd-no-physical-id-yet"]
+	})) {
+		if (!isSecretDerivedValue(raw, mask)) continue;
+		if (unresolved(raw)) {
+			if (physicalId === void 0) continue;
+			add(spelling);
+		} else {
+			add(raw);
+			if (raw.toLowerCase() !== raw && raw.length >= 4) add(raw.toLowerCase());
+		}
+	}
+	const properties = record?.properties;
+	const path = properties !== null && typeof properties === "object" && Object.hasOwn(properties, "Path") ? properties["Path"] : void 0;
+	if (physicalId !== void 0 && isSecretDerivedValue(path, mask)) add(physicalId);
+	const embedded = options === void 0 ? secrets : options.embedded;
+	const embeddedBag = embedded !== void 0 && hasMaskableValues(embedded) ? embedded : void 0;
+	if (embeddedBag !== void 0 && physicalId !== void 0) {
+		for (const needle of printingCorpusOf(embeddedBag).keys()) if (needle !== "" && (needle === physicalId || needle.length >= 4 && physicalId.includes(needle))) add(needle);
+	}
+	return needles.size > 0 ? needles : void 0;
+}
+function secretNamesReadBy(logicalId, record, resources, judge = () => ({
+	secrets: void 0,
+	embedded: void 0
+})) {
+	const read = /* @__PURE__ */ new Set();
+	const leaves = [...wholeStringLeavesOf(record?.properties)].filter((leaf) => leaf !== "");
+	if (leaves.length === 0) return read;
+	for (const [otherId, other] of Object.entries(resources)) {
+		if (otherId === logicalId) continue;
+		const bags = judge(otherId);
+		const needles = secretNameNeedlesOf(otherId, other, bags.secrets, { embedded: bags.embedded });
+		if (needles === void 0) continue;
+		for (const needle of needles) if (leaves.some((leaf) => leaf === needle || needle.length >= 4 && leaf.includes(needle))) read.add(needle);
+	}
+	return read;
+}
+function stateSecretNameNeedles(resources, secrets) {
+	return (logicalId) => secretNameNeedlesOf(logicalId, Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0, secrets, { embedded: void 0 });
+}
+function secretNamePrintingBag(logicalId, resources) {
+	const bag = /* @__PURE__ */ new Map();
+	const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+	for (const needle of secretNameNeedlesOf(logicalId, record, void 0) ?? []) recordLogOnlyValue(bag, needle);
+	for (const needle of secretNamesReadBy(logicalId, record, resources)) recordLogOnlyValue(bag, needle);
+	return bag;
+}
+function journaledOrphanPrintingBag(ops, stateResources) {
+	const bag = /* @__PURE__ */ new Map();
+	for (const op of ops) {
+		const record = {
+			resourceType: op.resourceType,
+			physicalId: op.physicalId,
+			properties: op.attemptedProperties
+		};
+		const replaced = Object.hasOwn(stateResources, op.logicalId) ? stateResources[op.logicalId] : void 0;
+		for (const needle of [
+			...secretNameNeedlesOf(op.logicalId, record, void 0) ?? [],
+			...secretNameNeedlesOf(op.logicalId, replaced, void 0) ?? [],
+			...secretNamesReadBy(op.logicalId, record, stateResources)
+		]) recordLogOnlyValue(bag, needle);
+	}
+	return bag;
+}
+function maskEventTextWithBoundBags(event) {
+	if (event.reason === void 0 && event.error === void 0) return event;
+	const mask = currentLogLineMasker();
+	if (mask === void 0) return event;
+	const masked = { ...event };
+	if (masked.error?.message && masked.error.ownLines !== true) masked.error = {
+		...masked.error,
+		message: mask(masked.error.message)
+	};
+	if (masked.reason) masked.reason = mask(masked.reason);
+	return masked;
+}
+
 //#endregion
 //#region src/deployment/rollback-executor/journaled-orphans.ts
 const NONE = {
@@ -30078,24 +30212,32 @@ async function deleteJournaledOrphans(orphans, stateResources, stackName, ctx, o
 		failures: 0,
 		warnings: 0,
 		interrupted: false,
-		handled: []
+		handled: [],
+		leftInPlace: 0
 	};
 	const inlinePolicyWriters = new RollbackInlinePolicyWriters();
+	const record = ctx.recordEvent;
+	const printing = journaledOrphanPrintingBag(orphans.segments.flatMap(({ ops, companions }) => [...companions ?? [], ...ops]), stateResources);
+	const maskedCtx = record === void 0 ? ctx : {
+		...ctx,
+		recordEvent: (event) => record(maskEventTextWithBoundBags(event))
+	};
 	for (const { segment, ops: orphanOps, companions } of orphans.segments) {
 		if (options.isInterrupted?.()) {
 			total.interrupted = true;
 			break;
 		}
 		const ops = [...companions ?? [], ...orphanOps];
-		const replay = () => withStackName(stackName, () => replayFailedOperations(ops, stateResources, stackName, ctx, {
+		const replay = () => withPrintingSecrets(printing, () => withStackName(stackName, () => replayFailedOperations(ops, stateResources, stackName, maskedCtx, {
 			emitEnvelope: false,
 			inlinePolicyWriters,
 			forDestroy: true,
 			...options.isInterrupted && { isInterrupted: options.isInterrupted }
-		}));
+		})));
 		const result = segment.skipPrefix === void 0 ? await replay() : await withSkipPrefix(segment.skipPrefix, replay);
 		total.failures += result.failures;
 		total.warnings += result.warnings;
+		total.leftInPlace += result.leftInPlace;
 		const pending = new Set(result.remainingFailedOps);
 		for (const op of ops) if (!pending.has(op)) total.handled.push({
 			segment,
@@ -30136,19 +30278,26 @@ async function settleJournaledOrphansOnSuccess(args) {
 		op
 	})));
 	let kept = all;
+	let leftInPlace = 0;
 	if (stateResources === void 0) logger.warn(safeMsg`The rollback journal of stack ${stack} records ${all.length} resource(s) a failed deploy ` + `created, but the stack's state cannot be read, so whether a record now owns them is unknown: none is deleted.`);
 	else {
 		logger.info(safeMsg`The rollback journal of stack ${stack} records ${all.length} resource(s) a failed deploy ` + `created that no state record holds; acting on them per their DeletionPolicy before the journal is removed:`);
 		for (const line of journaledOrphanLines(orphans, logger)) logger.info(line);
 		try {
 			const { unreadable, tracked } = await applySuccessRule(orphans, stateResources, orphans.deployLogicalIds ?? /* @__PURE__ */ new Set(), args.foreignHolder, stack, logger, args.isInterrupted);
-			const outcome = await deleteJournaledOrphans({
+			const acting = {
 				segments: orphans.segments.map(({ segment, ops }) => ({
 					segment,
 					ops: ops.filter((op) => !unreadable.has(op) && !tracked.has(op))
 				})).filter(({ ops }) => ops.length > 0),
 				count: orphans.count - unreadable.size - tracked.size
-			}, { ...stateResources }, stackName, ctx, args.isInterrupted ? { isInterrupted: args.isInterrupted } : {});
+			};
+			const writtenThisRun = [...orphans.deployLogicalIds ?? []].filter((id) => Object.prototype.hasOwnProperty.call(stateResources, id)).map((id) => stateResources[id]).filter((r) => r !== void 0 && r !== null && typeof r === "object");
+			const outcome = await deleteJournaledOrphans(acting, { ...stateResources }, stackName, {
+				...ctx,
+				writtenThisRun
+			}, args.isInterrupted ? { isInterrupted: args.isInterrupted } : {});
+			leftInPlace = outcome.leftInPlace;
 			kept = all.filter(({ segment, op }) => unreadable.has(op) || !tracked.has(op) && !isHandledOrphan(outcome.handled, segment, op));
 		} catch (err) {
 			logger.warn(safeMsg`Acting on the journaled resources of stack ${stack} failed: ${errorDetail(err)}`);
@@ -30169,7 +30318,7 @@ async function settleJournaledOrphansOnSuccess(args) {
 		}
 	};
 	if (kept.length === 0) return {
-		unaddressed: skipped,
+		unaddressed: skipped + leftInPlace,
 		keepJournal: false,
 		...stripCleared && { stripCleared }
 	};
@@ -30190,7 +30339,7 @@ async function settleJournaledOrphansOnSuccess(args) {
 	}
 	logger.warn(safeMsg`${kept.length} resource(s) a failed deploy of stack ${stack} created were not deleted ` + (reduced ? "(see above). The rollback journal, their only record, is kept with just them; the next " : "(see above). The rollback journal, their only record, is kept; the next ") + "successful deploy retries.");
 	return {
-		unaddressed: kept.length + skipped,
+		unaddressed: kept.length + skipped + leftInPlace,
 		keepJournal: true
 	};
 }
@@ -30366,15 +30515,46 @@ async function adoptRollbackOrphans(currentState, effectiveTemplate) {
 		}),
 		logger: { debug: (m) => this.logger.debug(m) }
 	});
-	for (const notice of plan.notices) this.logger.info(notice);
-	if (plan.refusals.length > 0) throw new Error(`Deploy refused — cdkd left ${plan.refusals.length} resource(s) in AWS that it cannot safely re-adopt:\n  ${plan.refusals.join("\n  ")}`);
+	const named = /* @__PURE__ */ new Map();
+	for (const entry of records) {
+		if (entry === null || typeof entry !== "object") continue;
+		const { logicalId, state } = entry;
+		if (typeof logicalId !== "string" || state === null || typeof state !== "object") continue;
+		for (const needle of secretNameNeedlesOf(logicalId, state, void 0) ?? []) recordLogOnlyValue(named, needle);
+	}
+	for (const notice of plan.notices) this.logger.info(maskSecretsInText(notice, named));
+	if (plan.refusals.length > 0) throw new Error(`Deploy refused — cdkd left ${plan.refusals.length} resource(s) in AWS that it cannot safely re-adopt:\n  ${plan.refusals.map((r) => maskSecretsInText(r, named)).join("\n  ")}`);
 	for (const [logicalId, record] of Object.entries(plan.adopted)) {
 		currentState.resources[logicalId] = record;
-		this.logger.info(`Adopting ${displayIdent(logicalId)} (${displayIdent(record.resourceType)}) left in AWS by an earlier rollback as ${displaySafe(record.physicalId)}`);
+		this.logger.info(`Adopting ${displayIdent(logicalId)} (${displayIdent(record.resourceType)}) left in AWS by an earlier rollback as ${displaySafe(maskSecretsInText(record.physicalId, named))}`);
 	}
 	if (records.length > 0) currentState.orphans = plan.remaining;
 	return plan;
 }
+function orphanReplayPrintingBag(engine, orphanOps, stateResources) {
+	const read = /* @__PURE__ */ new Map();
+	for (const op of orphanOps) {
+		const names = secretNamesReadBy(op.logicalId, { properties: op.attemptedProperties }, stateResources, (otherId) => ({
+			secrets: engine.namingSecretsFor(otherId),
+			embedded: engine.perResourceSecrets.get(otherId)
+		}));
+		for (const needle of names) recordLogOnlyValue(read, needle);
+	}
+	const own = /* @__PURE__ */ new Map();
+	for (const op of orphanOps) {
+		const needles = secretNameNeedlesOf(op.logicalId, {
+			resourceType: op.resourceType,
+			physicalId: op.physicalId,
+			properties: op.attemptedProperties
+		}, engine.namingSecretsFor(op.logicalId), { embedded: engine.perResourceSecrets.get(op.logicalId) });
+		for (const needle of needles ?? []) recordLogOnlyValue(own, needle);
+	}
+	return unionOfSecretBags([
+		...orphanOps.map((op) => engine.printingSecretsFor(op.logicalId)),
+		own,
+		read
+	]);
+}
 async function performRollback(completedOperations, stateResources, stackName, previousState, failedOperations = [], priorOrphans = []) {
 	const orphanIndexes = [];
 	const orphanOps = [];
@@ -30392,10 +30572,10 @@ async function performRollback(completedOperations, stateResources, stackName, p
 	const runId = this.options.eventRecorder?.runId;
 	const { result, failed, run } = await withNestedRevertRun(runId, async (scope) => {
 		return {
-			failed: orphanOps.length > 0 ? await replayFailedOperations(orphanOps, stateResources, stackName, ctx, {
+			failed: orphanOps.length > 0 ? await withPrintingSecrets(orphanReplayPrintingBag(this, orphanOps, stateResources), () => replayFailedOperations(orphanOps, stateResources, stackName, ctx, {
 				emitEnvelope: completedOperations.length === 0,
 				inlinePolicyWriters
-			}) : void 0,
+			})) : void 0,
 			result: await replayRollback(completedOperations, stateResources, stackName, ctx, { inlinePolicyWriters }),
 			run: scope
 		};
@@ -30542,7 +30722,7 @@ function rollbackExecutorContext(previousState, stackName) {
 		providerRegistry: this.providerRegistry,
 		region: this.stackRegion,
 		logger: this.logger,
-		recordEvent: (event) => this.recordEvent(event),
+		recordEvent: (event) => this.recordEvent(maskEventTextWithBoundBags(event)),
 		finalSnapshotClients: this.options.finalSnapshotClients,
 		skipFinalSnapshot: this.options.skipFinalSnapshot,
 		...this.options.parentStackInfo && { nestedChildStack: stackName },
@@ -30980,6 +31160,7 @@ function kickOffAutoRefreshObservedProperties(stateResources, crossStackReads) {
 	const candidates = [];
 	const masked = [];
 	for (const [logicalId, resource] of Object.entries(stateResources)) {
+		if (!hasAddressablePhysicalId(resource)) continue;
 		if (resource.observedProperties !== void 0) {
 			if (isMaskedBaselineRecaptureCandidate(resource)) masked.push({
 				logicalId,
@@ -31174,47 +31355,6 @@ async function readReaderForFreshNoEchoCeiling(logicalId, currentResource, secre
 function maskForResource(logicalId, text) {
 	return maskSecretsInText(text, this.printingSecretsFor(logicalId) ?? EMPTY_SECRETS);
 }
-function secretNameNeedlesOf(logicalId, record, secrets, options) {
-	const physicalId = typeof record?.physicalId === "string" && record.physicalId !== "" ? record.physicalId : void 0;
-	const bag = secrets !== void 0 && hasMaskableValues(secrets) ? secrets : void 0;
-	const mask = (text) => bag === void 0 ? text : maskSecretsInText(text, bag);
-	const unresolved = (value) => value.includes("{{resolve:") || value === "***";
-	const named = {
-		resourceType: record?.resourceType,
-		properties: record?.properties,
-		logicalId
-	};
-	const needles = /* @__PURE__ */ new Set();
-	const add = (needle) => {
-		if (typeof needle === "string" && needle !== "") needles.add(needle);
-	};
-	for (const [raw, derived] of secretDerivedNamePairs({
-		...named,
-		physicalIds: []
-	})) if (typeof raw === "string" && !unresolved(raw) && isSecretDerivedValue(raw, mask)) add(derived);
-	for (const [raw, spelling] of secretDerivedNamePairs({
-		...named,
-		physicalIds: [physicalId ?? "cdkd-no-physical-id-yet"]
-	})) {
-		if (!isSecretDerivedValue(raw, mask)) continue;
-		if (unresolved(raw)) {
-			if (physicalId === void 0) continue;
-			add(spelling);
-		} else {
-			add(raw);
-			if (raw.toLowerCase() !== raw && raw.length >= 4) add(raw.toLowerCase());
-		}
-	}
-	const properties = record?.properties;
-	const path = properties !== null && typeof properties === "object" && Object.hasOwn(properties, "Path") ? properties["Path"] : void 0;
-	if (physicalId !== void 0 && isSecretDerivedValue(path, mask)) add(physicalId);
-	const embedded = options === void 0 ? secrets : options.embedded;
-	const embeddedBag = embedded !== void 0 && hasMaskableValues(embedded) ? embedded : void 0;
-	if (embeddedBag !== void 0 && physicalId !== void 0) {
-		for (const needle of printingCorpusOf(embeddedBag).keys()) if (needle !== "" && (needle === physicalId || needle.length >= 4 && physicalId.includes(needle))) add(needle);
-	}
-	return needles.size > 0 ? needles : void 0;
-}
 function secretNameBagFor(logicalId) {
 	let bag = this.secretNameNeedles.get(logicalId);
 	if (bag === void 0) {
@@ -31237,17 +31377,13 @@ function namingSecretsFor(logicalId) {
 	return unionOfSecretBags([own, noEcho]);
 }
 function noteSecretNamedReads(logicalId, record, resources) {
-	const leaves = [...wholeStringLeavesOf(record?.properties)].filter((leaf) => leaf !== "");
-	if (leaves.length === 0) return;
-	for (const [otherId, other] of Object.entries(resources)) {
-		if (otherId === logicalId) continue;
-		const needles = secretNameNeedlesOf(otherId, other, this.namingSecretsFor(otherId), { embedded: this.perResourceSecrets.get(otherId) });
-		if (needles === void 0) continue;
-		const read = [...needles].filter((needle) => leaves.some((leaf) => leaf === needle || needle.length >= 4 && leaf.includes(needle)));
-		if (read.length === 0) continue;
-		const registry = this.secretNameBagFor(logicalId);
-		for (const needle of read) recordLogOnlyValue(registry, needle);
-	}
+	const read = secretNamesReadBy(logicalId, record, resources, (otherId) => ({
+		secrets: this.namingSecretsFor(otherId),
+		embedded: this.perResourceSecrets.get(otherId)
+	}));
+	if (read.size === 0) return;
+	const registry = this.secretNameBagFor(logicalId);
+	for (const needle of read) recordLogOnlyValue(registry, needle);
 }
 function printingSecretsFor(logicalId) {
 	const secrets = this.perResourceSecrets.get(logicalId);
@@ -31511,6 +31647,7 @@ async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentReso
 async function readRecordAttributes(input) {
 	const { provider, logicalId, resource, stackName, region } = input;
 	if (!provider.import) return { kind: "not-attempted" };
+	if (!hasAddressablePhysicalId(resource)) return { kind: "not-attempted" };
 	const found = await provider.import({
 		logicalId,
 		resourceType: resource.resourceType,
@@ -34807,6 +34944,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		return;
 	}
 	this.refuseRedactedAttributeReads(logicalId, resourceType, context);
+	if (!(currentResource.resourceType === "AWS::CloudFormation::Stack" && currentResource.provisionedBy !== "cc-api") && !hasAddressablePhysicalId(currentResource)) throw markRefusedBeforeApplying(markNonRetryable(new CdkdError(unaddressableUpdateRefusalMessage(stackName, this.stackRegion, logicalId, oldResourceType), STATE_RESOURCES_MALFORMED)));
 	this.attemptedResolvedProps.set(logicalId, resolvedProps);
 	const noEchoHeldPaths = /* @__PURE__ */ new Set();
 	if (change.propertyChanges?.some((pc) => pc.requiresReplacement) === true) {
@@ -35453,6 +35591,46 @@ async function provisionDelete(logicalId, change, stateResources, stackName, tem
 		await noteRetainedResource(resourceType, logicalId);
 		return;
 	}
+	if (!(currentResource.resourceType === "AWS::CloudFormation::Stack" && currentResource.provisionedBy !== "cc-api") && !hasAddressablePhysicalId(currentResource)) {
+		const reason = "state record has no physical id";
+		if (progress) progress.current++;
+		const skipPrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
+		renderer.removeTask(logicalId);
+		const skipLine = formatResourceLine("skipped", logicalId, resourceType, `skipped (${reason})`);
+		this.logger.info(safeMsg`${skipPrefix}${skipLine}`);
+		const showCommand = pasteableCommand("cdkd state show", [{
+			value: stackName,
+			hole: "stack",
+			opts: { plainIdent: true }
+		}, {
+			flag: "--stack-region",
+			value: this.stackRegion,
+			hole: "region"
+		}]).command;
+		const dropCommand = pasteableCommand("cdkd state orphan", [
+			{
+				value: stackName,
+				hole: "stack",
+				opts: { plainIdent: true }
+			},
+			{
+				flag: "--stack-region",
+				value: this.stackRegion,
+				hole: "region"
+			},
+			{
+				flag: "--resource",
+				value: logicalId,
+				hole: "logicalId",
+				opts: { plainIdent: true }
+			}
+		]).command;
+		this.logger.warn(safeMsg`Resource ${displaySafe(logicalId)} (${displaySafe(resourceType)}) has no non-empty string 'physicalId' in its state record, so cdkd cannot address it in AWS and did not try to delete it while removing it from the template. Its cdkd state record was KEPT, so the next 'cdkd deploy' re-attempts the delete. Repair the record's 'physicalId', or delete the resource by hand and drop the record.
+Inspect it with: ${showCommand}
+Drop the record with: ${dropCommand}`);
+		if (counts) counts.deleteSkipped++;
+		return { deleteSkipped: reason };
+	}
 	const governingPolicy = effectiveDeletionPolicy(resourceType, deletionPolicy, currentResource.properties);
 	const finalSnapshotIdentifier = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, governingPolicy);
 	const deleteRoute = this.providerRegistry.getProviderFor({
@@ -35711,7 +35889,7 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 				logicalId,
 				resourceType,
 				...stateResources[logicalId]?.provisionedBy ? { provisionedBy: stateResources[logicalId]?.provisionedBy } : labelRouting && { provisionedBy: labelRouting },
-				...stateResources[logicalId]?.physicalId && { physicalId: stateResources[logicalId]?.physicalId },
+				...stateResources[logicalId] !== void 0 && hasAddressablePhysicalId(stateResources[logicalId]) && { physicalId: stateResources[logicalId].physicalId },
 				reason: deleteSkipped,
 				durationMs: Date.now() - resourceStartedAt
 			});
@@ -36966,6 +37144,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		refuseMalformedOutputs(currentState, stackName, this.stackRegion);
 		refuseMalformedResourcesForDeploy(currentState, stackName, this.stackRegion);
 		refuseMalformedResourceEntriesForDeploy(currentState, stackName, this.stackRegion);
+		refuseMalformedResourceProperties(currentState, stackName, this.stackRegion);
 		refuseMalformedOrphans(currentState, stackName, this.stackRegion);
 		refuseMalformedOrphanRecords(currentState, stackName, this.stackRegion);
 		const migrationPending = currentStateData?.migrationPending ?? false;
@@ -37742,5 +37921,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { resourcesNamingDeclaredParameter as $, recoverMaskedOutput as $a, findSilentDropProperties as $i, observeThenDisableInstanceApiTermination as $n, buildDenyExternalAccessPolicy as $o, malformedDriftResourcePropertiesWarning as $r, nullPrototypeRecord as $s, extractDeploymentEventError as $t, resolveDynamoDbDeleteBudgetClock as A, lambdaFunctionNameForMask as Aa, refuseMalformedResourceEntriesForDeploy as Ai, tagMapAsList as An, importableOutputs as Ao, carriesFetchableDynamicReference as Ar, resolveStateBucketWithDefault as As, planRollback as At, getPriorAttempts as B, literalSplitDelimitersOf as Ba, refuseMalformedResourcesForDestroy as Bi, CloudControlProvider as Bn, createAssetRedirectResolver as Bo, passedParameterClassesOf as Br, uploadCfnTemplate as Bs, createPreDeleteFinalSnapshot as Bt, perType as C, requireConfigObject as Ca, refuseMalformedOrphans as Ci, withCreateTokenLedger as Cn, acceptedCreateOnlyDropsOf as Co, s3BucketWebsiteUrl as Cr, getDefaultStateBucketName as Cs, getStackRecords as Ct, beginDeleteWait as D, describeTypeWithThrottleRetry as Da, refuseMalformedOutputsForDestroy as Di, planTagDiff as Dn, hasReasonlessBaselineRefusal as Do, getAccountInfo as Dr, resolveAutoAssetStorage as Ds, isJournaledOrphan as Dt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as E, templateResourceTypes as Ea, refuseMalformedOutputs as Ei, DBPROXY_TAG_OPTIONS as En, hasReadableExportSet as Eo, parameterTypeMayLoseSecretIdentity as Er, resolveApp as Es, demoteSupersededOrphans as Et, waitForIndexesSettled as F, inheritNestedStackParameterAssociations as Fa, refuseMalformedResourcePropertiesForDestroy as Fi, ProviderRegistry as Fn, AssetPublisher as Fo, isStalePlaceholderArnAttribute as Fr, ssmResolvedValueType as Fs, inheritProducerRegions as Ft, cyan as G, shareLogOnlyValues as Ga, repairMalformedOutputsForReadOnly as Gi, deleteIndeterminateGuards as Gn, assertAssetBucketRegion as Go, UNREADABLE_RESOURCES_MAP_ROW as Gr, canonicalizeRegion as Gs, REDACTED_DELETE_ADDRESS_SKIP_REASON as Gt, formatResourceLine as H, printingCorpusOf as Ha, refuseMalformedState as Hi, ccProtectionRegistryTypes as Hn, rewriteTemplateAssetReferences as Ho, STATE_REGION_DIVERGED as Hr, decodeListingKey as Hs, isFinalSnapshotError as Ht, ECR_AUTO_DELETE_IMAGES_TAG as I, recordNestedStackParameterExpressions as Ia, refuseMalformedResourcePropertiesForDrift as Ii, ccBrokenReason as In, isSensitiveAttributeName as Io, refStateLookupFromResource as Ir, CFN_TEMPLATE_BODY_LIMIT as Is, ATOMIC_FINAL_SNAPSHOT_TYPES as It, red as J, maskSecretsInError as Ja, repairMalformedResourcesForReadOnly as Ji, isWaitAbandonedError as Jn, isCrossRegionRedirect as Jo, hasReadableOrphans as Jr, StageLoadError as Js, redactedDeleteAddressSkip as Jt, gray as K, createSecretMasker as Ka, repairMalformedResourceEntriesForReadOnly as Ki, deleteSkipReason as Kn, ensureAssetStorage as Ko, deployRefusesOrphanRowsReason as Kr, derivePartitionAndUrlSuffix as Ks, isRedactedRecordedValue as Kt, S3_AUTO_DELETE_OBJECTS_TAG as L, carryLogOnlyValues as La, refuseMalformedResourcePropertiesForExport as Li, wouldReturnToSdkProvider as Ln, stringifyValue as Lo, parseWebACLArn as Lr, CFN_TEMPLATE_URL_LIMIT as Ls, PRE_DELETE_SNAPSHOT_TYPES as Lt, DELETE_INDEX_WAIT_PROCEED_NOTE as M, DagBuilder as Ma, refuseMalformedResourceEntriesForImport as Mi, definedAttributes as Mn, orphansAfterRollback as Mo, keepsSecretReferenceToken as Mr, resolveUseCdkBootstrapAssets as Ms, resolveReplacementOldType as Mt, INDEX_SETTLE_POLL_INTERVAL_MS as N, TemplateParser as Na, refuseMalformedResourceEntriesForImportSave as Ni, stringifyIfAssigned as Nn, orphansCarriedFrom as No, AWS_NO_VALUE as Nr, stateBucketExistenceConfirmed as Ns, findNestedStackTypeChanges as Nt, compensateRemovedDeletionProtection as O, withRetry as Oa, refuseMalformedResourceAttributesForOrphan as Oi, readTagList as On, hasUnverifiableParameterRefusal as Oo, isImpossibleEmptyStoredAttribute as Or, resolveCaptureObservedState as Os, isReplacementOrphan as Ot, deleteTableWithIndexBusyRetry as P, liveMatchesUnresolvedTokenFrame as Pa, refuseMalformedResourceEntriesForOrphan as Pi, CC_BROKEN_REASON as Pn, shouldRetainResource as Po, cfnRefValueFromPhysicalId as Pr, warnDeprecatedNoPrefixCliFlag as Ps, getCurrentProducerRegions as Pt, reachableDivergentParameters as Q, scrubResourceRecord as Qa, findActionableSilentDrops as Qi, isTerminationProtectionPropagationError as Qn, validateContainerRepoName as Qo, isReadableResourceEntry as Qr, hasPlainPrototype$1 as Qs, DeploymentEventsStore as Qt, hasCdkAutoDeleteTag as R, createUnionSecretMasker as Ra, refuseMalformedResourcePropertiesForOrphan as Ri, isCustomResourceType as Rn, WorkGraph as Ro, withSharedDrainBudget as Rr, MIGRATE_TMP_PREFIX as Rs, buildFinalSnapshotIdentifier as Rt, isProtectionValueActive as S, requireConfigArray as Sa, refuseMalformedOrphanRecordsForDestroy as Si, reserveStackCreateToken as Sn, splitImportedOps as So, s3BucketRegionalDomainName as Sr, synthesisStatusMessage as Ss, destroyStackRecordsView as St, DynamoDBGlobalTableProvider as T, prefetchCreateOnlyPropertyPaths as Ta, refuseMalformedOrphansForOrphan as Ti, DBPROXY_TAGS_WHAT as Tn, exportNamesCarriedFrom as To, isUnboundTemplateParameter as Tr, loadCdkJson as Ts, recordAfterRollbackUpdate as Tt, createReadOnlyAttributeHealerFactory as U, recordLogOnlyParameterValue as Ua, repairMalformedOrphanRecordsForReadOnly as Ui, unchangedBehindSecretReference as Un, AssetModeResolver as Uo, STATE_RESOURCES_MALFORMED as Ur, expectedOwnerParam as Us, refusesFinalSnapshot as Ut, markRefusedBeforeApplying as V, logOnlyValueCount as Va, refuseMalformedResourcesForExport as Vi, slowCcOperationTimeoutMs as Vn, loadPublishableAssetManifest as Vo, JSON_LISTING_HOLE_VALUE as Vr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Vs, effectiveDeletionPolicy as Vt, bold as W, recordLogOnlyValue as Wa, repairMalformedOrphansForReadOnly as Wi, UNSPECIFIED_SKIP_REASON as Wn, BOOTSTRAP_MARKER_PREFIX as Wo, UNREADABLE_ORPHANS_CONTAINER_ROW as Wr, PARTITION_TABLE as Ws, unsupportedFinalSnapshotError as Wt, computeParameterTaint as X, markSameGenerationBag as Xa, unreadableOrphanRecords as Xi, disableInstanceApiTermination as Xn, readBootstrapMarkerBody as Xo, hasReadableResources as Xr, defineOwnKey as Xs, updatePartialReason as Xt, yellow as Y, maskSecretsInText as Ya, unpreviewableOrphanRecords as Yi, markWaitAbandoned as Yn, parseBootstrapMarker as Yo, hasReadableOutputs as Yr, processStackMessages as Ys, updatePartialMessage as Yt, namesAnyDeclaredParameter as Z, redactSecretsForState as Za, unreadableResourceEntries as Zi, ec2InstanceProtectionSite as Zn, validateAssetBucketName as Zo, isReadableOrphanRecord as Zr, hasOwnKey as Zs, DeploymentEventsReader as Zt, makeCanonicalizePropertiesFn as _, configBooleanRefusal as _a, malformedStateRefusalMessage as _i, findDestructiveChanges as _n, isSingleDynamicReferenceToken as _o, envCredentialsAreAssumedRole as _r, escapeRegExp$3 as _s, getCurrentNestedStackContext as _t, findNestedTemplateTreeDefect as a, shownType as aa, resolveAssemblyPath as ac, malformedOrphanRecordsRefusalMessage as ai, secretSafeKeyDisplay as an, carriesSecretMask as ao, classifyReplaySecretRegion as ar, dockerSpawnEnvWithSensitive as as, makeSiblingClaimReader as at, recordedProtectionNote as b, readConfigString as ba, refuseMalformedNestedChildOutputs as bi, earliestDefined as bn, S3StateBackend as bo, s3BucketDomainName as br, getDockerImageBySourceHash as bs, replayRollback as bt, renderNestedTemplateTreeDefect as c, isStatefulRecreateTargetSync as ca, malformedOrphansRefusalMessage as ci, noEchoParameterValueSeed as cn, recordMaskOnlyValuesIn as co, applyRoleArnIfSet as cr, getDockerCmd as cs, displacedOpClause as ct, conditionInputsFrom as d, coerceWarmThroughput as da, malformedOutputsWarning as di, isExportAliasCollision as dn, wholeStringLeavesOf as do, explicitRoleArnOrThrow as dr, partitionSensitiveEnv as ds, getNestedRevertRun as dt, unwrittenCreateOnlyReplacement as ea, ownValue as ec, malformedExportNamesWarning as ei, WITHHELD_NAME_DISPLAY as en, DYNAMIC_REFERENCE_TOKEN_SCAN as eo, reDisableInstanceApiTermination as er, buildDockerImage as es, deleteJournaledOrphans as et, parentSuppliedValues as f, isWarmThroughputDecrease as fa, malformedRenderedContainersWarning as fi, bindingSkippedOutputs as fn, STATE_SOURCED_BASELINE_RULES as fo, isIamRoleArn as fr, redactDockerArgvValues as fs, nestedChildStackName as ft, mergeNoChangeOutputs as g, coerceCfnInteger as ga, malformedScrubResourceEntriesRefusalMessage as gi, constructPathOf as gn, WHOLE_DYNAMIC_REFERENCE_PATTERN as go, callerEnvCredentials as gr, warnFinchArgvExposure as gs, withNestedRevertRun as gt, keptWholeReasonText as h, coerceCfnBoolean as ha, malformedResourcesWarning as hi, maskingRetryLogger as hn, TEMPLATE_SOURCED_RULES as ho, applyCallerIdentityCredentials as hr, runDockerStreaming as hs, revertedNestedRowIds as ht, childTemplateLoader as i, findReplacedReadersOfRecreateTargets as ia, renderAssemblyPathEscape as ic, malformedLocalResourcesWarning as ii, secretBearingStateKeyWarning as in, identityKeyFor as io, IntrinsicFunctionResolver as ir, describeDockerFailure as is, sameJournaledOrphans as it, resolveDynamoDbDeleteBudgetMs as j, sameLambdaFunctionAddress as ja, refuseMalformedResourceEntriesForDestroy as ji, tagPlanWarning as jn, isReadableBag as jo, isNamelessDynamicReferenceError as jr, resolveStateBucketWithDefaultAndSource as js, replacementNeverSwapped as jt, deleteBudgetKey as k, canonicalLambdaFunctionName as ka, refuseMalformedResourceEntries as ki, refuseMalformedDesiredTags as kn, importableOutputKeys as ko, carriesDynamicReference as kr, resolveSkipPrefix as ks, planFailedOps as kt, templateIdentity as l, renderStatefulReason as la, malformedOrphansWarning as li, collectDeclaredOutputNames as ln, recordNoEchoAttributeValues as lo, assertFlagRoleArn as lr, isDockerClientEnvKey as ls, displacedPhysicalIdShown as lt, isSecretBearingReferenceString as m, toFiniteNumber as ma, malformedResourcePropertiesWarning as mi, DEFAULT_RESOURCE_WARN_AFTER_MS as mn, STATE_SOURCED_READBACK_RULES as mo, AWS_CREDENTIAL_ENV_KEYS as mr, runDockerForeground as ms, revertNestedChildFromJournal as mt, IMPLICIT_DELETE_DEPENDENCIES as n, NO_CC_HANDLERS_REASON as na, describeFileReadFailure as nc, malformedLocalOutputsWarning as ni, exportAliasCollisionScrubWarning as nn, isUncertifiedBaselineMaskPosition as no, DiffCalculator as nr, describeDockerCapturedOutput as ns, journaledOrphanLines as nt, isAbsoluteAssetPath as o, MULTI_REGION_RECREATE_BLOCKED_TYPES as oa, clearBucketRegionCache as oc, malformedOrphanRecordsWarning as oi, exportNameSecretExposure as on, provenPublicValue as oo, producerRegionsFromState as or, finchSecretArgvRefusal as os, planOrphanAdoption as ot, readRecordedConditionVerdicts as p, toCfnInteger as pa, malformedResourceEntriesWarning as pi, DEFAULT_RESOURCE_TIMEOUT_MS as pn, STATE_SOURCED_CROSS_GENERATION_RULES as po, sendableAssumeRoleCommand as pr, redactedDockerCause as ps, recordDisplacedSkips as pt, green as q, errorCauseChain as qa, repairMalformedResourcePropertiesForReadOnly as qi, withIndeterminateGuard as qn, getBootstrapMarkerKey as qo, displayLogicalId as qr, AssemblyReader as qs, redactedDeleteAddressFields as qt, computeImplicitDeleteEdges as r, hasNoCloudControlHandlers as ra, displayAssemblyPath as rc, malformedLocalResourceEntriesWarning as ri, secretBearing as rn, pathCrossesDottedKey as ro, INTRINSIC_KEYS as rr, describeDockerExecFailure as rs, loadJournaledOrphans as rt, listNestedTemplateRows as s, isStatefulRecreateTargetForReplace as sa, resolveBucketRegion as sc, malformedOrphanRowsKeptWarning as si, isWholeDynamicReferenceValue as sn, recordMaskOnlyValue as so, regionLessSecretName as sr, formatDockerLoginError as ss, NESTED_PENDING_PARENT_REASON as st, DeployEngine as t, withoutSilentDropProperties as ta, absoluteAssemblyPathEscape as tc, malformedExportSourceWarning as ti, displayTextOrWithheld as tn, dynamicReferenceTokens as to, reEnableInstanceApiTermination as tr, resolveDockerContextDirectory as ts, isHandledOrphan as tt, conditionFingerprint as u, WARM_THROUGHPUT_MEMBERS as ua, malformedOutputsRefusalMessage as ui, collectPublishedOutputNames as un, recordProvenPublicExpression as uo, assertSendableRoleArn as ur, isMalformedEnvKey as us, dropSettledNestedJournals as ut, withResourceDeadline as v, configIntegerRefusal as va, previewableOrphanRecords as vi, formatDestructiveChange as vn, LockManager as vo, isSettledInstanceState as vr, stripControlChars as vs, withNestedStackContext as vt, readProtection as w, requireConfigString as wa, refuseMalformedOrphansForDestroy as wi, acquireIdempotencyToken as wn, describeRegionValueKind as wo, coerceParameterTypedValue as wr, getLegacyStateBucketName as ws, withStackRecords as wt, PROTECTION_PROPERTY_BY_TYPE as x, replayWarn as xa, refuseMalformedOrphanRecords as xi, ledgerForStack as xn, rebuildClientForBucketRegion as xo, s3BucketDualStackDomainName as xr, Synthesizer as xs, awaitInFlightSibling as xt, recordedProtectionEvidence as y, configStringRefusal as ya, refuseDivergentRecordRegionForDestroy as yi, RollbackInlinePolicyWriters as yn, isLockInfoExpired as yo, s3BucketArn as yr, AssetManifestLoader as ys, replayFailedOperations as yt, isTruthyCfnBoolean as z, hasMaskableValues as za, refuseMalformedResourcesForDeploy as zi, getCurrentResourceSecrets as zn, buildAssetRedirectMap as zo, parameterInputsFor as zr, findLargeInlineResources as zs, ccRoutedFinalSnapshotError as zt };
-//# sourceMappingURL=deploy-engine-Dre6eDNJ.js.map
+export { resourcesNamingDeclaredParameter as $, maskSecretsInError as $a, repairMalformedResourcesForReadOnly as $i, isWaitAbandonedError as $n, isCrossRegionRedirect as $o, hasReadableOrphans as $r, StageLoadError as $s, updatePartialMessage as $t, resolveDynamoDbDeleteBudgetClock as A, prefetchCreateOnlyPropertyPaths as Aa, refuseMalformedOrphansForOrphan as Ai, DBPROXY_TAG_OPTIONS as An, exportNamesCarriedFrom as Ao, isUnboundTemplateParameter as Ar, loadCdkJson as As, demoteSupersededOrphans as At, getPriorAttempts as B, inheritNestedStackParameterAssociations as Ba, refuseMalformedResourcePropertiesForDestroy as Bi, ccBrokenReason as Bn, AssetPublisher as Bo, isStalePlaceholderArnAttribute as Br, ssmResolvedValueType as Bs, ATOMIC_FINAL_SNAPSHOT_TYPES as Bt, perType as C, configIntegerRefusal as Ca, previewableOrphanRecords as Ci, RollbackInlinePolicyWriters as Cn, LockManager as Co, isSettledInstanceState as Cr, stripControlChars as Cs, replayFailedOperations as Ct, beginDeleteWait as D, requireConfigArray as Da, refuseMalformedOrphanRecordsForDestroy as Di, withCreateTokenLedger as Dn, splitImportedOps as Do, s3BucketRegionalDomainName as Dr, synthesisStatusMessage as Ds, getStackRecords as Dt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as E, replayWarn as Ea, refuseMalformedOrphanRecords as Ei, reserveStackCreateToken as En, rebuildClientForBucketRegion as Eo, s3BucketDualStackDomainName as Er, Synthesizer as Es, destroyStackRecordsView as Et, waitForIndexesSettled as F, lambdaFunctionNameForMask as Fa, refuseMalformedResourceEntriesForDeploy as Fi, tagPlanWarning as Fn, importableOutputs as Fo, carriesFetchableDynamicReference as Fr, resolveStateBucketWithDefault as Fs, replacementNeverSwapped as Ft, cyan as G, literalSplitDelimitersOf as Ga, refuseMalformedResourcesForDestroy as Gi, CloudControlProvider as Gn, createAssetRedirectResolver as Go, passedParameterClassesOf as Gr, uploadCfnTemplate as Gs, effectiveDeletionPolicy as Gt, formatResourceLine as H, carryLogOnlyValues as Ha, refuseMalformedResourcePropertiesForExport as Hi, isCustomResourceType as Hn, stringifyValue as Ho, parseWebACLArn as Hr, CFN_TEMPLATE_URL_LIMIT as Hs, buildFinalSnapshotIdentifier as Ht, ECR_AUTO_DELETE_IMAGES_TAG as I, sameLambdaFunctionAddress as Ia, refuseMalformedResourceEntriesForDestroy as Ii, definedAttributes as In, isReadableBag as Io, isNamelessDynamicReferenceError as Ir, resolveStateBucketWithDefaultAndSource as Is, resolveReplacementOldType as It, red as J, recordLogOnlyParameterValue as Ja, repairMalformedOrphanRecordsForReadOnly as Ji, unchangedBehindSecretReference as Jn, AssetModeResolver as Jo, STATE_RESOURCES_MALFORMED as Jr, expectedOwnerParam as Js, unsupportedFinalSnapshotError as Jt, gray as K, logOnlyValueCount as Ka, refuseMalformedResourcesForExport as Ki, slowCcOperationTimeoutMs as Kn, loadPublishableAssetManifest as Ko, JSON_LISTING_HOLE_VALUE as Kr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ks, isFinalSnapshotError as Kt, S3_AUTO_DELETE_OBJECTS_TAG as L, DagBuilder as La, refuseMalformedResourceEntriesForImport as Li, stringifyIfAssigned as Ln, orphansAfterRollback as Lo, keepsSecretReferenceToken as Lr, resolveUseCdkBootstrapAssets as Ls, findNestedStackTypeChanges as Lt, DELETE_INDEX_WAIT_PROCEED_NOTE as M, describeTypeWithThrottleRetry as Ma, refuseMalformedOutputsForDestroy as Mi, readTagList as Mn, hasReasonlessBaselineRefusal as Mo, getAccountInfo as Mr, resolveAutoAssetStorage as Ms, isReplacementOrphan as Mt, INDEX_SETTLE_POLL_INTERVAL_MS as N, withRetry as Na, refuseMalformedResourceAttributesForOrphan as Ni, refuseMalformedDesiredTags as Nn, hasUnverifiableParameterRefusal as No, isImpossibleEmptyStoredAttribute as Nr, resolveCaptureObservedState as Ns, planFailedOps as Nt, compensateRemovedDeletionProtection as O, requireConfigObject as Oa, refuseMalformedOrphans as Oi, acquireIdempotencyToken as On, acceptedCreateOnlyDropsOf as Oo, s3BucketWebsiteUrl as Or, getDefaultStateBucketName as Os, withStackRecords as Ot, deleteTableWithIndexBusyRetry as P, canonicalLambdaFunctionName as Pa, refuseMalformedResourceEntries as Pi, tagMapAsList as Pn, importableOutputKeys as Po, carriesDynamicReference as Pr, resolveSkipPrefix as Ps, planRollback as Pt, reachableDivergentParameters as Q, errorCauseChain as Qa, repairMalformedResourcePropertiesForReadOnly as Qi, withIndeterminateGuard as Qn, getBootstrapMarkerKey as Qo, displayLogicalId as Qr, AssemblyReader as Qs, redactedDeleteAddressSkip as Qt, hasCdkAutoDeleteTag as R, TemplateParser as Ra, refuseMalformedResourceEntriesForImportSave as Ri, CC_BROKEN_REASON as Rn, orphansCarriedFrom as Ro, AWS_NO_VALUE as Rr, stateBucketExistenceConfirmed as Rs, getCurrentProducerRegions as Rt, isProtectionValueActive as S, configBooleanRefusal as Sa, malformedStateRefusalMessage as Si, formatDestructiveChange as Sn, isSingleDynamicReferenceToken as So, envCredentialsAreAssumedRole as Sr, escapeRegExp$3 as Ss, withNestedStackContext as St, DynamoDBGlobalTableProvider as T, readConfigString as Ta, refuseMalformedNestedChildOutputs as Ti, ledgerForStack as Tn, S3StateBackend as To, s3BucketDomainName as Tr, getDockerImageBySourceHash as Ts, awaitInFlightSibling as Tt, createReadOnlyAttributeHealerFactory as U, createUnionSecretMasker as Ua, refuseMalformedResourcePropertiesForOrphan as Ui, getCurrentResourceSecrets as Un, WorkGraph as Uo, withSharedDrainBudget as Ur, MIGRATE_TMP_PREFIX as Us, ccRoutedFinalSnapshotError as Ut, markRefusedBeforeApplying as V, recordNestedStackParameterExpressions as Va, refuseMalformedResourcePropertiesForDrift as Vi, wouldReturnToSdkProvider as Vn, isSensitiveAttributeName as Vo, refStateLookupFromResource as Vr, CFN_TEMPLATE_BODY_LIMIT as Vs, PRE_DELETE_SNAPSHOT_TYPES as Vt, bold as W, hasMaskableValues as Wa, refuseMalformedResourcesForDeploy as Wi, withPrintingSecrets as Wn, buildAssetRedirectMap as Wo, parameterInputsFor as Wr, findLargeInlineResources as Ws, createPreDeleteFinalSnapshot as Wt, computeParameterTaint as X, shareLogOnlyValues as Xa, repairMalformedOutputsForReadOnly as Xi, deleteIndeterminateGuards as Xn, assertAssetBucketRegion as Xo, UNREADABLE_RESOURCES_MAP_ROW as Xr, canonicalizeRegion as Xs, isRedactedRecordedValue as Xt, yellow as Y, recordLogOnlyValue as Ya, repairMalformedOrphansForReadOnly as Yi, UNSPECIFIED_SKIP_REASON as Yn, BOOTSTRAP_MARKER_PREFIX as Yo, UNREADABLE_ORPHANS_CONTAINER_ROW as Yr, PARTITION_TABLE as Ys, REDACTED_DELETE_ADDRESS_SKIP_REASON as Yt, namesAnyDeclaredParameter as Z, createSecretMasker as Za, repairMalformedResourceEntriesForReadOnly as Zi, deleteSkipReason as Zn, ensureAssetStorage as Zo, deployRefusesOrphanRowsReason as Zr, derivePartitionAndUrlSuffix as Zs, redactedDeleteAddressFields as Zt, makeCanonicalizePropertiesFn as _, isWarmThroughputDecrease as _a, malformedRenderedContainersWarning as _i, DEFAULT_RESOURCE_TIMEOUT_MS as _n, STATE_SOURCED_BASELINE_RULES as _o, isIamRoleArn as _r, redactDockerArgvValues as _s, recordDisplacedSkips as _t, findNestedTemplateTreeDefect as a, unwrittenCreateOnlyReplacement as aa, ownValue as ac, malformedExportNamesWarning as ai, displayTextOrWithheld as an, DYNAMIC_REFERENCE_TOKEN_SCAN as ao, reDisableInstanceApiTermination as ar, buildDockerImage as as, journaledOrphanPrintingBag as at, recordedProtectionNote as b, coerceCfnBoolean as ba, malformedResourcesWarning as bi, constructPathOf as bn, TEMPLATE_SOURCED_RULES as bo, applyCallerIdentityCredentials as br, runDockerStreaming as bs, withNestedRevertRun as bt, renderNestedTemplateTreeDefect as c, hasNoCloudControlHandlers as ca, displayAssemblyPath as cc, malformedLocalResourceEntriesWarning as ci, secretBearingStateKeyWarning as cn, pathCrossesDottedKey as co, INTRINSIC_KEYS as cr, describeDockerExecFailure as cs, stateSecretNameNeedles as ct, conditionInputsFrom as d, MULTI_REGION_RECREATE_BLOCKED_TYPES as da, clearBucketRegionCache as dc, malformedOrphanRecordsWarning as di, isWholeDynamicReferenceValue as dn, provenPublicValue as do, producerRegionsFromState as dr, finchSecretArgvRefusal as ds, NESTED_PENDING_PARENT_REASON as dt, unpreviewableOrphanRecords as ea, processStackMessages as ec, hasReadableOutputs as ei, updatePartialReason as en, maskSecretsInText as eo, markWaitAbandoned as er, parseBootstrapMarker as es, deleteJournaledOrphans as et, parentSuppliedValues as f, isStatefulRecreateTargetForReplace as fa, resolveBucketRegion as fc, malformedOrphanRowsKeptWarning as fi, noEchoParameterValueSeed as fn, recordMaskOnlyValue as fo, regionLessSecretName as fr, formatDockerLoginError as fs, displacedOpClause as ft, mergeNoChangeOutputs as g, coerceWarmThroughput as ga, malformedOutputsWarning as gi, bindingSkippedOutputs as gn, wholeStringLeavesOf as go, explicitRoleArnOrThrow as gr, partitionSensitiveEnv as gs, nestedChildStackName as gt, keptWholeReasonText as h, WARM_THROUGHPUT_MEMBERS as ha, malformedOutputsRefusalMessage as hi, isExportAliasCollision as hn, recordProvenPublicExpression as ho, assertSendableRoleArn as hr, isMalformedEnvKey as hs, getNestedRevertRun as ht, childTemplateLoader as i, findSilentDropProperties as ia, nullPrototypeRecord as ic, malformedDriftResourcePropertiesWarning as ii, WITHHELD_NAME_DISPLAY as in, recoverMaskedOutput as io, observeThenDisableInstanceApiTermination as ir, buildDenyExternalAccessPolicy as is, sameJournaledOrphans as it, resolveDynamoDbDeleteBudgetMs as j, templateResourceTypes as ja, refuseMalformedOutputs as ji, planTagDiff as jn, hasReadableExportSet as jo, parameterTypeMayLoseSecretIdentity as jr, resolveApp as js, isJournaledOrphan as jt, deleteBudgetKey as k, requireConfigString as ka, refuseMalformedOrphansForDestroy as ki, DBPROXY_TAGS_WHAT as kn, describeRegionValueKind as ko, coerceParameterTypedValue as kr, getLegacyStateBucketName as ks, recordAfterRollbackUpdate as kt, templateIdentity as l, findReplacedReadersOfRecreateTargets as la, renderAssemblyPathEscape as lc, malformedLocalResourcesWarning as li, secretSafeKeyDisplay as ln, identityKeyFor as lo, IntrinsicFunctionResolver as lr, describeDockerFailure as ls, makeSiblingClaimReader as lt, isSecretBearingReferenceString as m, renderStatefulReason as ma, malformedOrphansWarning as mi, collectPublishedOutputNames as mn, recordNoEchoAttributeValues as mo, assertFlagRoleArn as mr, isDockerClientEnvKey as ms, dropSettledNestedJournals as mt, IMPLICIT_DELETE_DEPENDENCIES as n, unreadableResourceEntries as na, hasOwnKey as nc, isReadableOrphanRecord as ni, DeploymentEventsStore as nn, redactSecretsForState as no, ec2InstanceProtectionSite as nr, validateAssetBucketName as ns, journaledOrphanLines as nt, isAbsoluteAssetPath as o, withoutSilentDropProperties as oa, absoluteAssemblyPathEscape as oc, malformedExportSourceWarning as oi, exportAliasCollisionScrubWarning as on, dynamicReferenceTokens as oo, reEnableInstanceApiTermination as or, resolveDockerContextDirectory as os, maskEventTextWithBoundBags as ot, readRecordedConditionVerdicts as p, isStatefulRecreateTargetSync as pa, malformedOrphansRefusalMessage as pi, collectDeclaredOutputNames as pn, recordMaskOnlyValuesIn as po, applyRoleArnIfSet as pr, getDockerCmd as ps, displacedPhysicalIdShown as pt, green as q, printingCorpusOf as qa, refuseMalformedState as qi, ccProtectionRegistryTypes as qn, rewriteTemplateAssetReferences as qo, STATE_REGION_DIVERGED as qr, decodeListingKey as qs, refusesFinalSnapshot as qt, computeImplicitDeleteEdges as r, findActionableSilentDrops as ra, hasPlainPrototype$1 as rc, isReadableResourceEntry as ri, extractDeploymentEventError as rn, scrubResourceRecord as ro, isTerminationProtectionPropagationError as rr, validateContainerRepoName as rs, loadJournaledOrphans as rt, listNestedTemplateRows as s, NO_CC_HANDLERS_REASON as sa, describeFileReadFailure as sc, malformedLocalOutputsWarning as si, secretBearing as sn, isUncertifiedBaselineMaskPosition as so, DiffCalculator as sr, describeDockerCapturedOutput as ss, secretNamePrintingBag as st, DeployEngine as t, unreadableOrphanRecords as ta, defineOwnKey as tc, hasReadableResources as ti, DeploymentEventsReader as tn, markSameGenerationBag as to, disableInstanceApiTermination as tr, readBootstrapMarkerBody as ts, isHandledOrphan as tt, conditionFingerprint as u, shownType as ua, resolveAssemblyPath as uc, malformedOrphanRecordsRefusalMessage as ui, exportNameSecretExposure as un, carriesSecretMask as uo, classifyReplaySecretRegion as ur, dockerSpawnEnvWithSensitive as us, planOrphanAdoption as ut, withResourceDeadline as v, toCfnInteger as va, malformedResourceEntriesWarning as vi, DEFAULT_RESOURCE_WARN_AFTER_MS as vn, STATE_SOURCED_CROSS_GENERATION_RULES as vo, sendableAssumeRoleCommand as vr, redactedDockerCause as vs, revertNestedChildFromJournal as vt, readProtection as w, configStringRefusal as wa, refuseDivergentRecordRegionForDestroy as wi, earliestDefined as wn, isLockInfoExpired as wo, s3BucketArn as wr, AssetManifestLoader as ws, replayRollback as wt, PROTECTION_PROPERTY_BY_TYPE as x, coerceCfnInteger as xa, malformedScrubResourceEntriesRefusalMessage as xi, findDestructiveChanges as xn, WHOLE_DYNAMIC_REFERENCE_PATTERN as xo, callerEnvCredentials as xr, warnFinchArgvExposure as xs, getCurrentNestedStackContext as xt, recordedProtectionEvidence as y, toFiniteNumber as ya, malformedResourcePropertiesWarning as yi, maskingRetryLogger as yn, STATE_SOURCED_READBACK_RULES as yo, AWS_CREDENTIAL_ENV_KEYS as yr, runDockerForeground as ys, revertedNestedRowIds as yt, isTruthyCfnBoolean as z, liveMatchesUnresolvedTokenFrame as za, refuseMalformedResourceEntriesForOrphan as zi, ProviderRegistry as zn, shouldRetainResource as zo, cfnRefValueFromPhysicalId as zr, warnDeprecatedNoPrefixCliFlag as zs, inheritProducerRegions as zt };
+//# sourceMappingURL=deploy-engine-Cm7z6aQk.js.map