@go-to-k/cdkd 0.296.4 → 0.296.6

package/dist/{deploy-engine-HCnNEpdp.js → deploy-engine-BPcBCyUE.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js";
-import { A as displaySafe, E as UNRENDERABLE, F as safeMsg, L as truncateCodePoints, M as isPasteableIdent, O as displayAwsMessage, P as plainIdentOr, S as withoutGeneratedFallbackName, T as STACK_REF_MAX_CODE_POINTS, _ as getCurrentSkipPrefix, b as withSkipPrefix, c as getLiveRenderer, f as applyDefaultNameForFallback, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, m as explicitNamePropertyFor, n as getLogger, r as isStdoutReservedForPayload, s as installLogLineMaskerSource, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS, x as withStackName, y as looksLikeCdkdGeneratedName } from "./logger-Dvc7ddKe.js";
-import { $n as markRedactedCause, $t as LockError, A as isTerminalDeleteFailure, At as CUSTOM_RESOURCE_RESPONSE_PREFIX, Bn as isAmbiguousCcHandlerErrorCode, Bt as clientDefaultsFor, C as refusalTypeShown, Cn as physicalIdShownBesideCommand, Ct as buildForceUnlockCommand, D as ProtectionFlipRegistry, Dn as shellQuote, Dt as formatLockOperation, En as shellBoundedDisplay, Et as formatLockExpiry, Fn as isRecreateRetryableError, Ft as producerRecordKey, Gn as retryClassificationText, H as pasteableAwsCommand, Hn as isIamPropagationError, Ht as AccountIdUnavailableError, In as isReplayedNameCollisionFrom, J as isInterruptedWaitError, Jn as safeStringify$1, Kn as describeAwsFailure, Kt as CrossAccountSecretRefusalError, Lt as withPasteableAwsProfile, M as observeThenDisableProtection, Mn as hasReplayMayCollide, Mt as injectiveKey, N as protectionFlipKey, Nn as isNameCollisionErrorFrom, O as compensateProtectionFlip, On as withheldTargetClause, Ot as formatLockOwner, Pn as isNameCooldownError, Q as canonicalizeRoute53QueryName, Qn as markNonRetryable, R as DELETION_PROTECTION_DOC_POINTER, Rn as markReplayMayCollide, Rt as ambientClientDefaults, S as quotedRemedyLogicalId, Sn as pasteableCommand, St as UNREPRODUCIBLE_LOCK_CLAUSE, T as resolveExplicitPhysicalId, Tn as quotedOrDescribed, U as protectedReplacementAdvice, Un as isRetryableTransientError, Ut as AssetError, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, Wn as isTransientServerError, Wt as CdkdError, X as ElapsedBudgetRegistry, Xn as isMarkedNonRetryable, Xt as IntrinsicResolutionRefusalError, Y as startInterruptWatch, Yt as DynamicReferenceRegionAmbiguousError, Z as monotonicNowMs, Zn as isThrottlingError, _n as SHELL_ACTIVE_WHY, _t as hasCreatedBeforeFailure, an as ResourceTimeoutError, at as segmentAfterAnchor, b as isQuotableImportValue, bt as markAuxiliaryFailure, ct as createMaskedRetryLogger, d as prepareRemovalForUpdate, dt as maskerOrIdentity, en as MacroExpansionError, er as wrapMaskedAwsError, et as compositeIdSeparatorRefusal, f as removalWarning, ft as withDerivedNameMasks, g as assertRegionMatch, gn as SHELL_ACTIVE, gt as createdBeforeFailure, h as RESOURCE_NOT_FOUND, i as holdsSecretDerivedEntry, in as ProvisioningError, it as resourceTypeShown, jn as isUpdateUnsupportedError, jt as DEFAULT_STATE_PREFIX, k as deleteWithProtectionCompensation, kt as sanitizeRecoveryValue, l as withUnchangedSecretPrincipalLists, ln as StateError, lt as isSecretDerivedValue, m as withoutInjectedRemovals, mt as carryCreatedBeforeFailure, nt as logicalIdShown, on as ResourceUpdateNotSupportedError, ot as stateOrphanRecordRemedy, pn as normalizeAwsError, pt as RETRY_AUXILIARY_OWNER, qt as DependencyError, st as createMaskedLogSinks, tn as MalformedProducerRecordRefusalError, un as SynthesisError, ut as maskDeep, vn as UNSHOWABLE_VALUE, vt as isAuxiliaryFailure, wn as plainOrDescribed, x as normalizeAwsTagsToCfn, xn as isInertUnquoted, xt as markCreatedBeforeFailure, yn as commandHole, yt as isAuxiliaryMarkOf, zn as formatRetryClassificationSignals, zt as ambientCredentialConfig } from "./iam-policy-targets-DSDSdxXz.js";
+import { A as displayIdent, C as withoutGeneratedFallbackName, D as UNRENDERABLE, E as STACK_REF_MAX_CODE_POINTS, F as plainIdentOr, I as safeMsg, M as displayStackName, N as isPasteableIdent, R as truncateCodePoints, S as withStackName, T as SECRET_REF_MAX_CODE_POINTS, _ as generateResourceNameWithFallback, b as looksLikeCdkdGeneratedName, c as installLogLineMaskerSource, g as generateResourceName, h as explicitNamePropertyFor, j as displaySafe, k as displayAwsMessage, l as getLiveRenderer, n as getLogger, p as applyDefaultNameForFallback, r as isStdoutReservedForPayload, s as currentLogLineMasker, v as getCurrentSkipPrefix, x as withSkipPrefix, y as getCurrentStackName } from "./logger-DAaB7GFO.js";
+import { $n as markRedactedCause, $t as LockError, A as isTerminalDeleteFailure, At as CUSTOM_RESOURCE_RESPONSE_PREFIX, Bn as isAmbiguousCcHandlerErrorCode, Bt as clientDefaultsFor, C as refusalTypeShown, Cn as physicalIdShownBesideCommand, Ct as buildForceUnlockCommand, D as ProtectionFlipRegistry, Dn as shellQuote, Dt as formatLockOperation, En as shellBoundedDisplay, Et as formatLockExpiry, Fn as isRecreateRetryableError, Ft as producerRecordKey, Gn as retryClassificationText, H as pasteableAwsCommand, Hn as isIamPropagationError, Ht as AccountIdUnavailableError, In as isReplayedNameCollisionFrom, J as isInterruptedWaitError, Jn as safeStringify$1, Kn as describeAwsFailure, Kt as CrossAccountSecretRefusalError, Lt as withPasteableAwsProfile, M as observeThenDisableProtection, Mn as hasReplayMayCollide, Mt as injectiveKey, N as protectionFlipKey, Nn as isNameCollisionErrorFrom, O as compensateProtectionFlip, On as withheldTargetClause, Ot as formatLockOwner, Pn as isNameCooldownError, Q as canonicalizeRoute53QueryName, Qn as markNonRetryable, R as DELETION_PROTECTION_DOC_POINTER, Rn as markReplayMayCollide, Rt as ambientClientDefaults, S as quotedRemedyLogicalId, Sn as pasteableCommand, St as UNREPRODUCIBLE_LOCK_CLAUSE, T as resolveExplicitPhysicalId, Tn as quotedOrDescribed, U as protectedReplacementAdvice, Un as isRetryableTransientError, Ut as AssetError, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, Wn as isTransientServerError, Wt as CdkdError, X as ElapsedBudgetRegistry, Xn as isMarkedNonRetryable, Xt as IntrinsicResolutionRefusalError, Y as startInterruptWatch, Yt as DynamicReferenceRegionAmbiguousError, Z as monotonicNowMs, Zn as isThrottlingError, _n as SHELL_ACTIVE_WHY, _t as hasCreatedBeforeFailure, an as ResourceTimeoutError, at as segmentAfterAnchor, b as isQuotableImportValue, bt as markAuxiliaryFailure, ct as createMaskedRetryLogger, d as prepareRemovalForUpdate, dt as maskerOrIdentity, en as MacroExpansionError, er as wrapMaskedAwsError, et as compositeIdSeparatorRefusal, f as removalWarning, ft as withDerivedNameMasks, g as assertRegionMatch, gn as SHELL_ACTIVE, gt as createdBeforeFailure, h as RESOURCE_NOT_FOUND, i as holdsSecretDerivedEntry, in as ProvisioningError, it as resourceTypeShown, jn as isUpdateUnsupportedError, jt as DEFAULT_STATE_PREFIX, k as deleteWithProtectionCompensation, kt as sanitizeRecoveryValue, l as withUnchangedSecretPrincipalLists, ln as StateError, lt as isSecretDerivedValue, m as withoutInjectedRemovals, mt as carryCreatedBeforeFailure, nt as logicalIdShown, on as ResourceUpdateNotSupportedError, ot as stateOrphanRecordRemedy, pn as normalizeAwsError, pt as RETRY_AUXILIARY_OWNER, qt as DependencyError, st as createMaskedLogSinks, tn as MalformedProducerRecordRefusalError, un as SynthesisError, ut as maskDeep, vn as UNSHOWABLE_VALUE, vt as isAuxiliaryFailure, wn as plainOrDescribed, x as normalizeAwsTagsToCfn, xn as isInertUnquoted, xt as markCreatedBeforeFailure, yn as commandHole, yt as isAuxiliaryMarkOf, zn as formatRetryClassificationSignals, zt as ambientCredentialConfig } from "./iam-policy-targets-td1X_kKN.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-D557_3cB.js";
+import { t as getCdkdVersion } from "./version-BgqcIKdb.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -15777,6 +15777,15 @@ function hasStringPhysicalId(entry) {
 	const physicalId = entry.physicalId;
 	return typeof physicalId === "string" && physicalId !== "";
 }
+function hasAddressablePhysicalId(entry) {
+	const physicalId = entry.physicalId;
+	return typeof physicalId === "string" && physicalId.trim() !== "";
+}
+function unaddressableUpdateRefusalMessage(rawStackName, rawRegion, logicalId, resourceType) {
+	const stackName = absentIfEmpty(rawStackName);
+	const region = absentIfEmpty(rawRegion);
+	return `${stackClause(stackName, region)} holds a record for ${displayIdent(logicalId)} (${displayIdent(resourceType)}) with no non-empty string 'physicalId', so cdkd cannot address that resource in AWS and did not try to update it. 'cdkd deploy' fails on it rather than skipping it, since a skipped update would end the deploy without the template's change. Nothing was sent for this resource. Repair the record's 'physicalId' and re-run. ${inspectClause(stackName, region)}Inspect the record with: ` + inspectCommand(stackName, region);
+}
 function unpreviewableOrphanRecords(state) {
 	if (!Array.isArray(state.orphans)) return [];
 	const rows = state.orphans;
@@ -21291,6 +21300,11 @@ function deleteSkipReason(result) {
 	const trimmed = result.reason.trim();
 	return trimmed === "" ? UNSPECIFIED_SKIP_REASON : trimmed;
 }
+function deleteLeftInPlace(result) {
+	if (result === void 0 || result.outcome !== "deleted") return void 0;
+	const left = result.leftInPlace;
+	return typeof left === "string" && left.length > 0 ? left : void 0;
+}
 const UNSPECIFIED_SKIP_REASON = "no reason reported by the provider";
 function deleteSkippedMessage(logicalId, physicalId, reason, duringClause, opts) {
 	return `cdkd did not confirm ${plainOrDescribed(logicalId, "logical id")} (${opts?.commandFreeLine === true ? displayIdent(physicalId, { maxCodePoints: 613 }) : skipPhysicalIdShown(physicalId)}) was deleted ${duringClause}, so it may still exist: ${skipReasonShown(reason)}`;
@@ -22036,7 +22050,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BSdCtfW_.js");
+			const { ASGProvider } = await import("./asg-provider-C1TlpooI.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -22142,7 +22156,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-DzPUon_U.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-ChV-yRZP.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-DeGFzOUc.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CvY6ekmg.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -23322,6 +23336,9 @@ function describeCfnResponseBody(body, parsed) {
 	const line = `Status=${capForLog(status)} PhysicalResourceId=${capForLog(physicalId)} ${dataPart}`;
 	return line.length > DESCRIBE_MAX_LINE_CHARS ? `${line.slice(0, DESCRIBE_MAX_LINE_CHARS)}...(${line.length} chars total)` : line;
 }
+function respondedPhysicalId(response) {
+	return hasAddressablePhysicalId({ physicalId: response.PhysicalResourceId }) ? response.PhysicalResourceId : void 0;
+}
 var CustomResourceProvider = class CustomResourceProvider {
 	lambdaClient;
 	snsClient;
@@ -23428,7 +23445,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				ResourceProperties: this.stringifyProperties(properties)
 			}), maskerOrIdentity(context?.maskSecrets));
 			if (cfnResponse.Status === "FAILED") throw new Error(`Custom resource handler returned FAILED: ${cfnResponse.Reason || "Unknown reason"}`);
-			const physicalId = cfnResponse.PhysicalResourceId || logicalId;
+			const physicalId = respondedPhysicalId(cfnResponse) ?? logicalId;
 			const attributes = cfnResponse.Data || {};
 			this.logger.debug(`Successfully created custom resource ${logicalId}: ${physicalId}`);
 			return {
@@ -23461,7 +23478,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				OldResourceProperties: this.stringifyProperties(previousProperties)
 			}), maskerOrIdentity(context?.maskSecrets));
 			if (cfnResponse.Status === "FAILED") throw new Error(`Custom resource handler returned FAILED: ${cfnResponse.Reason || "Unknown reason"}`);
-			const newPhysicalId = cfnResponse.PhysicalResourceId || physicalId;
+			const newPhysicalId = respondedPhysicalId(cfnResponse) ?? physicalId;
 			const wasReplaced = newPhysicalId !== physicalId;
 			const attributes = cfnResponse.Data || {};
 			this.logger.debug(`Successfully updated custom resource ${logicalId}: ${newPhysicalId}${wasReplaced ? " (replaced)" : ""}`);
@@ -27429,44 +27446,6 @@ var DeploymentEventsReader = class {
 	}
 };
 
-//#endregion
-//#region src/deployment/update-outcome.ts
-function updatePartialReason(result) {
-	if (!result || result.outcome !== "partial") return void 0;
-	if (typeof result.reason !== "string") return UNSPECIFIED_PARTIAL_REASON;
-	const trimmed = result.reason.trim();
-	return trimmed === "" ? UNSPECIFIED_PARTIAL_REASON : trimmed;
-}
-const UNSPECIFIED_PARTIAL_REASON = "provider reported a partial update without a reason";
-function updatePartialMessage(reason) {
-	return `partial (${reason})`;
-}
-
-//#endregion
-//#region src/provisioning/redacted-delete-address.ts
-function isRedactedRecordedValue(value) {
-	if (carriesSecretMask(value)) return true;
-	let text;
-	try {
-		text = typeof value === "string" ? value : JSON.stringify(value);
-	} catch {
-		return false;
-	}
-	return text !== void 0 && dynamicReferenceTokens(text).length > 0;
-}
-const REDACTED_DELETE_ADDRESS_SKIP_REASON = "redacted address property in state — no delete issued";
-function redactedDeleteAddressFields(fields) {
-	return Object.keys(fields).filter((key) => isRedactedRecordedValue(fields[key]));
-}
-function redactedDeleteAddressSkip(logger, logicalId, what, redactedFields, context) {
-	if (redactedFields.length === 0) return void 0;
-	logger.warn(safeMsg`${what} ${logicalId} is recorded in state with ${redactedFields.join(", ")} ` + "redacted (the '***' mask of a NoEcho value it read, or a secret '{{resolve:...}}' reference), which names nothing in AWS; skipping deletion — no AWS call is issued, so the resource is LEFT IN PLACE unless a parent resource this run also deletes removes it (then only the record is stale). Re-deploying records the same redaction again. The state record is KEPT and the run reports the skip: on 'cdkd destroy' / 'cdkd state destroy' (which exits non-zero) and, since issue 1762, on the plain DELETE of a resource removed from the template during cdkd deploy. Remove the resource by hand, " + safeMsg`then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}. ` + "NOTE a deploy-side REPLACEMENT or rollback delete instead FAILS the resource (https://github.com/go-to-k/cdkd/issues/1762) — the old resource is left untracked there, so remove it by hand.");
-	return {
-		outcome: "skipped",
-		reason: REDACTED_DELETE_ADDRESS_SKIP_REASON
-	};
-}
-
 //#endregion
 //#region src/provisioning/final-snapshot.ts
 const ATOMIC_FINAL_SNAPSHOT_TYPES = /* @__PURE__ */ new Set([
@@ -28112,6 +28091,172 @@ async function prepareCreateRollbackFinalSnapshot(op, provisionedBy, ctx, mask)
 	}
 }
 
+//#endregion
+//#region src/deployment/secret-name-needles.ts
+function secretNameNeedlesOf(logicalId, record, secrets, options) {
+	const physicalId = typeof record?.physicalId === "string" && record.physicalId !== "" ? record.physicalId : void 0;
+	const bag = secrets !== void 0 && hasMaskableValues(secrets) ? secrets : void 0;
+	const mask = (text) => bag === void 0 ? text : maskSecretsInText(text, bag);
+	const unresolved = (value) => value.includes("{{resolve:") || value === "***";
+	const named = {
+		resourceType: record?.resourceType,
+		properties: record?.properties,
+		logicalId
+	};
+	const needles = /* @__PURE__ */ new Set();
+	const add = (needle) => {
+		if (typeof needle === "string" && needle !== "") needles.add(needle);
+	};
+	for (const [raw, derived] of secretDerivedNamePairs({
+		...named,
+		physicalIds: []
+	})) if (typeof raw === "string" && !unresolved(raw) && isSecretDerivedValue(raw, mask)) add(derived);
+	for (const [raw, spelling] of secretDerivedNamePairs({
+		...named,
+		physicalIds: [physicalId ?? "cdkd-no-physical-id-yet"]
+	})) {
+		if (!isSecretDerivedValue(raw, mask)) continue;
+		if (unresolved(raw)) {
+			if (physicalId === void 0) continue;
+			add(spelling);
+		} else {
+			add(raw);
+			if (raw.toLowerCase() !== raw && raw.length >= 4) add(raw.toLowerCase());
+		}
+	}
+	const properties = record?.properties;
+	const path = properties !== null && typeof properties === "object" && Object.hasOwn(properties, "Path") ? properties["Path"] : void 0;
+	if (physicalId !== void 0 && isSecretDerivedValue(path, mask)) add(physicalId);
+	const embedded = options === void 0 ? secrets : options.embedded;
+	const embeddedBag = embedded !== void 0 && hasMaskableValues(embedded) ? embedded : void 0;
+	if (embeddedBag !== void 0 && physicalId !== void 0) {
+		for (const needle of printingCorpusOf(embeddedBag).keys()) if (needle !== "" && (needle === physicalId || needle.length >= 4 && physicalId.includes(needle))) add(needle);
+	}
+	return needles.size > 0 ? needles : void 0;
+}
+function secretNamesReadBy(logicalId, record, resources, judge = () => ({
+	secrets: void 0,
+	embedded: void 0
+})) {
+	const read = /* @__PURE__ */ new Set();
+	const leaves = [...wholeStringLeavesOf(record?.properties)].filter((leaf) => leaf !== "");
+	if (leaves.length === 0) return read;
+	for (const [otherId, other] of Object.entries(resources)) {
+		if (otherId === logicalId) continue;
+		const bags = judge(otherId);
+		const needles = secretNameNeedlesOf(otherId, other, bags.secrets, { embedded: bags.embedded });
+		if (needles === void 0) continue;
+		for (const needle of needles) if (leaves.some((leaf) => leaf === needle || needle.length >= 4 && leaf.includes(needle))) read.add(needle);
+	}
+	return read;
+}
+function stateSecretNameNeedles(resources, secrets) {
+	return (logicalId) => secretNameNeedlesOf(logicalId, Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0, secrets, { embedded: void 0 });
+}
+function secretNamePrintingBag(logicalId, resources) {
+	const bag = /* @__PURE__ */ new Map();
+	const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+	for (const needle of secretNameNeedlesOf(logicalId, record, void 0) ?? []) recordLogOnlyValue(bag, needle);
+	for (const needle of secretNamesReadBy(logicalId, record, resources)) recordLogOnlyValue(bag, needle);
+	return bag;
+}
+function journaledOrphanPrintingBag(ops, stateResources) {
+	const bag = /* @__PURE__ */ new Map();
+	for (const op of ops) {
+		const record = {
+			resourceType: op.resourceType,
+			physicalId: op.physicalId,
+			properties: op.attemptedProperties
+		};
+		const replaced = Object.hasOwn(stateResources, op.logicalId) ? stateResources[op.logicalId] : void 0;
+		for (const needle of [
+			...secretNameNeedlesOf(op.logicalId, record, void 0) ?? [],
+			...secretNameNeedlesOf(op.logicalId, replaced, void 0) ?? [],
+			...secretNamesReadBy(op.logicalId, record, stateResources)
+		]) recordLogOnlyValue(bag, needle);
+	}
+	return bag;
+}
+function completedReplayEntries(ops) {
+	return ops.flatMap((op) => [{
+		logicalId: op.logicalId,
+		resourceType: op.resourceType,
+		physicalId: op.physicalId,
+		properties: op.properties,
+		attemptedProperties: op.properties
+	}, ...op.previousState === void 0 ? [] : [{
+		logicalId: op.logicalId,
+		resourceType: op.previousState.resourceType,
+		physicalId: op.previousState.physicalId,
+		properties: op.previousState.properties,
+		attemptedProperties: op.previousState.properties
+	}]]);
+}
+function orphanRecordsPrintingBag(records) {
+	const bag = /* @__PURE__ */ new Map();
+	for (const entry of records) {
+		if (entry === null || typeof entry !== "object") continue;
+		const { logicalId, state } = entry;
+		if (typeof logicalId !== "string" || state === null || typeof state !== "object") continue;
+		for (const needle of secretNameNeedlesOf(logicalId, state, void 0) ?? []) recordLogOnlyValue(bag, needle);
+	}
+	return bag;
+}
+const ORPHAN_COMMAND_LABEL = "To orphan it: ";
+function maskEventTextWithBoundBags(event) {
+	if (event.reason === void 0 && event.error === void 0) return event;
+	const mask = currentLogLineMasker();
+	if (mask === void 0) return event;
+	const masked = { ...event };
+	if (masked.error?.message) {
+		const message = masked.error.ownLines === true ? masked.error.message.split("\n").map((line) => line.startsWith(ORPHAN_COMMAND_LABEL) ? line : mask(line)).join("\n") : mask(masked.error.message);
+		masked.error = {
+			...masked.error,
+			message
+		};
+	}
+	if (masked.reason) masked.reason = mask(masked.reason);
+	return masked;
+}
+
+//#endregion
+//#region src/deployment/update-outcome.ts
+function updatePartialReason(result) {
+	if (!result || result.outcome !== "partial") return void 0;
+	if (typeof result.reason !== "string") return UNSPECIFIED_PARTIAL_REASON;
+	const trimmed = result.reason.trim();
+	return trimmed === "" ? UNSPECIFIED_PARTIAL_REASON : trimmed;
+}
+const UNSPECIFIED_PARTIAL_REASON = "provider reported a partial update without a reason";
+function updatePartialMessage(reason) {
+	return `partial (${reason})`;
+}
+
+//#endregion
+//#region src/provisioning/redacted-delete-address.ts
+function isRedactedRecordedValue(value) {
+	if (carriesSecretMask(value)) return true;
+	let text;
+	try {
+		text = typeof value === "string" ? value : JSON.stringify(value);
+	} catch {
+		return false;
+	}
+	return text !== void 0 && dynamicReferenceTokens(text).length > 0;
+}
+const REDACTED_DELETE_ADDRESS_SKIP_REASON = "redacted address property in state — no delete issued";
+function redactedDeleteAddressFields(fields) {
+	return Object.keys(fields).filter((key) => isRedactedRecordedValue(fields[key]));
+}
+function redactedDeleteAddressSkip(logger, logicalId, what, redactedFields, context) {
+	if (redactedFields.length === 0) return void 0;
+	logger.warn(safeMsg`${what} ${logicalId} is recorded in state with ${redactedFields.join(", ")} ` + "redacted (the '***' mask of a NoEcho value it read, or a secret '{{resolve:...}}' reference), which names nothing in AWS; skipping deletion — no AWS call is issued, so the resource is LEFT IN PLACE unless a parent resource this run also deletes removes it (then only the record is stale). Re-deploying records the same redaction again. The state record is KEPT and the run reports the skip: on 'cdkd destroy' / 'cdkd state destroy' (which exits non-zero) and, since issue 1762, on the plain DELETE of a resource removed from the template during cdkd deploy. Remove the resource by hand, " + safeMsg`then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}. ` + "NOTE a deploy-side REPLACEMENT or rollback delete instead FAILS the resource (https://github.com/go-to-k/cdkd/issues/1762) — the old resource is left untracked there, so remove it by hand.");
+	return {
+		outcome: "skipped",
+		reason: REDACTED_DELETE_ADDRESS_SKIP_REASON
+	};
+}
+
 //#endregion
 //#region src/deployment/rollback-executor/replay-inline-policy-restore.ts
 async function restoreHeldInlinePolicies(writers, stateResources, stackName, ctx, result, options = {}) {
@@ -28244,7 +28389,8 @@ var ReplayResolvers = class {
 };
 function regionAmbiguousReplaySecretError(logicalId, propertyPath, secretName, foreignProducerRegions, consumerRegion, execCtx) {
 	const where = propertyPath === "" ? "" : ` property ${quotedPlainOr(propertyPath, "property path")}`;
-	return new CdkdError(`Rollback of ${shownLogicalId(logicalId)}${where} cannot re-resolve the secret reference ${quotedPlainOr(secretName, "secret name")}: the reference carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.map((r) => plainOrDescribed(r, "region")).join(", ")}), so it may have been resolved in one of those rather than in ${quotedOrDescribed(consumerRegion, "region")}. A secret of the same name in two regions is two independent values, so replaying this would write the WRONG secret to a live resource. Refusing instead. Resolve the reference in its own region and set the property directly (or spell it as a full ARN, which names its region and is resolved there), then re-run ${rerunRollbackPhrase(execCtx, "'cdkd rollback'")}.`, "ROLLBACK_SECRET_REGION_AMBIGUOUS");
+	const error = new CdkdError(`Rollback of ${shownLogicalId(logicalId)}${where} cannot re-resolve the secret reference ${quotedPlainOr(secretName, "secret name")}: the reference carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.map((r) => plainOrDescribed(r, "region")).join(", ")}), so it may have been resolved in one of those rather than in ${quotedOrDescribed(consumerRegion, "region")}. A secret of the same name in two regions is two independent values, so replaying this would write the WRONG secret to a live resource. Refusing instead. Resolve the reference in its own region and set the property directly (or spell it as a full ARN, which names its region and is resolved there), then re-run ${rerunRollbackPhrase(execCtx, "'cdkd rollback'")}.`, "ROLLBACK_SECRET_REGION_AMBIGUOUS");
+	return markNonRetryable(error);
 }
 function refuseUnprovenReplaySecret(leaf, propertyPath, logicalId, execCtx) {
 	if (execCtx.producerRegionsIncomplete !== true) return;
@@ -29329,7 +29475,8 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 		skipped: 0,
 		interrupted: false,
 		remainingFailedOps: [],
-		orphaned: []
+		orphaned: [],
+		leftInPlace: 0
 	};
 	const { logger } = ctx;
 	const resolver = new ReplayResolvers(ctx.region);
@@ -29436,7 +29583,12 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
 						...ctx.skipFinalSnapshot === true && { skipFinalSnapshot: true },
 						deletionPolicy: snapshotPolicy ? "Snapshot" : "Delete",
-						recordedAttributes: failedCreateRecord?.attributes
+						recordedAttributes: failedCreateRecord?.attributes,
+						...op.physicalIdRecoveredFromError === true && {
+							failedCreateOrphan: true,
+							resolveAttemptedProperties: () => resolveReplayProps(op.attemptedProperties, resolver, secrets, ctx, op.logicalId),
+							...ctx.writtenThisRun !== void 0 && { writtenThisRun: ctx.writtenThisRun }
+						}
 					});
 					throwIfDeleteSkipped(failedCreateDelete, op.logicalId, op.physicalId, "while deleting the partially-created resource", {
 						ctx,
@@ -29445,6 +29597,12 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						provisionedBy: deleteRoutedVia,
 						mask
 					});
+					const leftInPlace = deleteLeftInPlace(failedCreateDelete);
+					if (leftInPlace !== void 0) {
+						logger.warn(safeMsg`  Rollback: deleted partially-created ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}) only in part — ${leftInPlace}; manual attention may be required`);
+						result.warnings++;
+						result.leftInPlace++;
+					}
 					if (!isReplacementOrphan(op)) delete stateResources[op.logicalId];
 					await options.afterOp?.(op.logicalId);
 					ctx.recordEvent?.({
@@ -29831,7 +29989,7 @@ async function revertNestedChildFromJournal(args) {
 			providerRegistry: ctx.providerRegistry,
 			region,
 			logger,
-			...ctx.options?.eventRecorder && { recordEvent: (event) => ctx.options.eventRecorder.record(event) },
+			...ctx.options?.eventRecorder && { recordEvent: (event) => ctx.options.eventRecorder.record(maskEventTextWithBoundBags(event)) },
 			finalSnapshotClients: ctx.options?.finalSnapshotClients,
 			skipFinalSnapshot: ctx.options?.skipFinalSnapshot === true || ctx.destroyOptions?.skipFinalSnapshot === true,
 			importedProducerRegions: producerRegions.regions,
@@ -29853,11 +30011,11 @@ async function revertNestedChildFromJournal(args) {
 			const skipPrefix = segment.skipPrefix ?? getCurrentSkipPrefix();
 			const split = splitImportedOps(segment.operations, segment);
 			const result = await withNestedStackContext(childCtx, () => withSkipPrefix(skipPrefix, () => withStackName(childStackName, () => withCreateTokenLedger(ledgerForStack(ctx.stateBackend, childStackName, region), () => withNestedRevertRun(runId, async (inner) => {
-				const replayed = await replayRollback(split.replay, stateResources, childStackName, execCtx, {
+				const replayed = await withPrintingSecrets(journaledOrphanPrintingBag(completedReplayEntries(split.replay), stateResources), () => replayRollback(split.replay, stateResources, childStackName, execCtx, {
 					afterOp: save,
 					onOrphan: (record) => mintedOrphans.push(record),
 					inlinePolicyWriters
-				});
+				}));
 				for (const [id, below] of inner.settled) settledBelow.set(id, below);
 				return {
 					...replayed,
@@ -30083,24 +30241,32 @@ async function deleteJournaledOrphans(orphans, stateResources, stackName, ctx, o
 		failures: 0,
 		warnings: 0,
 		interrupted: false,
-		handled: []
+		handled: [],
+		leftInPlace: 0
 	};
 	const inlinePolicyWriters = new RollbackInlinePolicyWriters();
+	const record = ctx.recordEvent;
+	const printing = journaledOrphanPrintingBag(orphans.segments.flatMap(({ ops, companions }) => [...companions ?? [], ...ops]), stateResources);
+	const maskedCtx = record === void 0 ? ctx : {
+		...ctx,
+		recordEvent: (event) => record(maskEventTextWithBoundBags(event))
+	};
 	for (const { segment, ops: orphanOps, companions } of orphans.segments) {
 		if (options.isInterrupted?.()) {
 			total.interrupted = true;
 			break;
 		}
 		const ops = [...companions ?? [], ...orphanOps];
-		const replay = () => withStackName(stackName, () => replayFailedOperations(ops, stateResources, stackName, ctx, {
+		const replay = () => withPrintingSecrets(printing, () => withStackName(stackName, () => replayFailedOperations(ops, stateResources, stackName, maskedCtx, {
 			emitEnvelope: false,
 			inlinePolicyWriters,
 			forDestroy: true,
 			...options.isInterrupted && { isInterrupted: options.isInterrupted }
-		}));
+		})));
 		const result = segment.skipPrefix === void 0 ? await replay() : await withSkipPrefix(segment.skipPrefix, replay);
 		total.failures += result.failures;
 		total.warnings += result.warnings;
+		total.leftInPlace += result.leftInPlace;
 		const pending = new Set(result.remainingFailedOps);
 		for (const op of ops) if (!pending.has(op)) total.handled.push({
 			segment,
@@ -30141,19 +30307,26 @@ async function settleJournaledOrphansOnSuccess(args) {
 		op
 	})));
 	let kept = all;
+	let leftInPlace = 0;
 	if (stateResources === void 0) logger.warn(safeMsg`The rollback journal of stack ${stack} records ${all.length} resource(s) a failed deploy ` + `created, but the stack's state cannot be read, so whether a record now owns them is unknown: none is deleted.`);
 	else {
 		logger.info(safeMsg`The rollback journal of stack ${stack} records ${all.length} resource(s) a failed deploy ` + `created that no state record holds; acting on them per their DeletionPolicy before the journal is removed:`);
 		for (const line of journaledOrphanLines(orphans, logger)) logger.info(line);
 		try {
 			const { unreadable, tracked } = await applySuccessRule(orphans, stateResources, orphans.deployLogicalIds ?? /* @__PURE__ */ new Set(), args.foreignHolder, stack, logger, args.isInterrupted);
-			const outcome = await deleteJournaledOrphans({
+			const acting = {
 				segments: orphans.segments.map(({ segment, ops }) => ({
 					segment,
 					ops: ops.filter((op) => !unreadable.has(op) && !tracked.has(op))
 				})).filter(({ ops }) => ops.length > 0),
 				count: orphans.count - unreadable.size - tracked.size
-			}, { ...stateResources }, stackName, ctx, args.isInterrupted ? { isInterrupted: args.isInterrupted } : {});
+			};
+			const writtenThisRun = [...orphans.deployLogicalIds ?? []].filter((id) => Object.prototype.hasOwnProperty.call(stateResources, id)).map((id) => stateResources[id]).filter((r) => r !== void 0 && r !== null && typeof r === "object");
+			const outcome = await deleteJournaledOrphans(acting, { ...stateResources }, stackName, {
+				...ctx,
+				writtenThisRun
+			}, args.isInterrupted ? { isInterrupted: args.isInterrupted } : {});
+			leftInPlace = outcome.leftInPlace;
 			kept = all.filter(({ segment, op }) => unreadable.has(op) || !tracked.has(op) && !isHandledOrphan(outcome.handled, segment, op));
 		} catch (err) {
 			logger.warn(safeMsg`Acting on the journaled resources of stack ${stack} failed: ${errorDetail(err)}`);
@@ -30174,7 +30347,7 @@ async function settleJournaledOrphansOnSuccess(args) {
 		}
 	};
 	if (kept.length === 0) return {
-		unaddressed: skipped,
+		unaddressed: skipped + leftInPlace,
 		keepJournal: false,
 		...stripCleared && { stripCleared }
 	};
@@ -30195,7 +30368,7 @@ async function settleJournaledOrphansOnSuccess(args) {
 	}
 	logger.warn(safeMsg`${kept.length} resource(s) a failed deploy of stack ${stack} created were not deleted ` + (reduced ? "(see above). The rollback journal, their only record, is kept with just them; the next " : "(see above). The rollback journal, their only record, is kept; the next ") + "successful deploy retries.");
 	return {
-		unaddressed: kept.length + skipped,
+		unaddressed: kept.length + skipped + leftInPlace,
 		keepJournal: true
 	};
 }
@@ -30349,7 +30522,8 @@ function redactOperationsForJournal(operations) {
 }
 async function adoptRollbackOrphans(currentState, effectiveTemplate) {
 	const records = currentState.orphans ?? [];
-	const plan = await planOrphanAdoption({
+	const named = orphanRecordsPrintingBag(records);
+	const plan = await withPrintingSecrets(named, () => planOrphanAdoption({
 		records,
 		managedLogicalIds: new Set(Object.keys(currentState.resources)),
 		template: effectiveTemplate,
@@ -30370,16 +30544,40 @@ async function adoptRollbackOrphans(currentState, effectiveTemplate) {
 			logger: this.logger
 		}),
 		logger: { debug: (m) => this.logger.debug(m) }
-	});
-	for (const notice of plan.notices) this.logger.info(notice);
-	if (plan.refusals.length > 0) throw new Error(`Deploy refused — cdkd left ${plan.refusals.length} resource(s) in AWS that it cannot safely re-adopt:\n  ${plan.refusals.join("\n  ")}`);
+	}));
+	for (const notice of plan.notices) this.logger.info(maskSecretsInText(notice, named));
+	if (plan.refusals.length > 0) throw new Error(`Deploy refused — cdkd left ${plan.refusals.length} resource(s) in AWS that it cannot safely re-adopt:\n  ${plan.refusals.map((r) => maskSecretsInText(r, named)).join("\n  ")}`);
 	for (const [logicalId, record] of Object.entries(plan.adopted)) {
 		currentState.resources[logicalId] = record;
-		this.logger.info(`Adopting ${displayIdent(logicalId)} (${displayIdent(record.resourceType)}) left in AWS by an earlier rollback as ${displaySafe(record.physicalId)}`);
+		this.logger.info(`Adopting ${displayIdent(logicalId)} (${displayIdent(record.resourceType)}) left in AWS by an earlier rollback as ${displaySafe(maskSecretsInText(record.physicalId, named))}`);
 	}
 	if (records.length > 0) currentState.orphans = plan.remaining;
 	return plan;
 }
+function replayPrintingBag(engine, entries, stateResources) {
+	const read = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		const names = secretNamesReadBy(entry.logicalId, { properties: entry.properties }, stateResources, (otherId) => ({
+			secrets: engine.namingSecretsFor(otherId),
+			embedded: engine.perResourceSecrets.get(otherId)
+		}));
+		for (const needle of names) recordLogOnlyValue(read, needle);
+	}
+	const own = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		const needles = secretNameNeedlesOf(entry.logicalId, {
+			resourceType: entry.resourceType,
+			physicalId: entry.physicalId,
+			properties: entry.properties
+		}, engine.namingSecretsFor(entry.logicalId), { embedded: engine.perResourceSecrets.get(entry.logicalId) });
+		for (const needle of needles ?? []) recordLogOnlyValue(own, needle);
+	}
+	return unionOfSecretBags([
+		...entries.map((entry) => engine.printingSecretsFor(entry.logicalId)),
+		own,
+		read
+	]);
+}
 async function performRollback(completedOperations, stateResources, stackName, previousState, failedOperations = [], priorOrphans = []) {
 	const orphanIndexes = [];
 	const orphanOps = [];
@@ -30397,11 +30595,14 @@ async function performRollback(completedOperations, stateResources, stackName, p
 	const runId = this.options.eventRecorder?.runId;
 	const { result, failed, run } = await withNestedRevertRun(runId, async (scope) => {
 		return {
-			failed: orphanOps.length > 0 ? await replayFailedOperations(orphanOps, stateResources, stackName, ctx, {
+			failed: orphanOps.length > 0 ? await withPrintingSecrets(replayPrintingBag(this, orphanOps.map((op) => ({
+				...op,
+				properties: op.attemptedProperties
+			})), stateResources), () => replayFailedOperations(orphanOps, stateResources, stackName, ctx, {
 				emitEnvelope: completedOperations.length === 0,
 				inlinePolicyWriters
-			}) : void 0,
-			result: await replayRollback(completedOperations, stateResources, stackName, ctx, { inlinePolicyWriters }),
+			})) : void 0,
+			result: await withPrintingSecrets(replayPrintingBag(this, completedReplayEntries(completedOperations), stateResources), () => replayRollback(completedOperations, stateResources, stackName, ctx, { inlinePolicyWriters })),
 			run: scope
 		};
 	});
@@ -30547,7 +30748,7 @@ function rollbackExecutorContext(previousState, stackName) {
 		providerRegistry: this.providerRegistry,
 		region: this.stackRegion,
 		logger: this.logger,
-		recordEvent: (event) => this.recordEvent(event),
+		recordEvent: (event) => this.recordEvent(maskEventTextWithBoundBags(event)),
 		finalSnapshotClients: this.options.finalSnapshotClients,
 		skipFinalSnapshot: this.options.skipFinalSnapshot,
 		...this.options.parentStackInfo && { nestedChildStack: stackName },
@@ -30985,6 +31186,7 @@ function kickOffAutoRefreshObservedProperties(stateResources, crossStackReads) {
 	const candidates = [];
 	const masked = [];
 	for (const [logicalId, resource] of Object.entries(stateResources)) {
+		if (!hasAddressablePhysicalId(resource)) continue;
 		if (resource.observedProperties !== void 0) {
 			if (isMaskedBaselineRecaptureCandidate(resource)) masked.push({
 				logicalId,
@@ -31080,76 +31282,6 @@ function kickOffMaskedBaselineRecapture(provider, logicalId, resource, producerR
 	this.observedCaptureTasks.set(logicalId, task);
 }
 
-//#endregion
-//#region src/deployment/secret-name-needles.ts
-function secretNameNeedlesOf(logicalId, record, secrets, options) {
-	const physicalId = typeof record?.physicalId === "string" && record.physicalId !== "" ? record.physicalId : void 0;
-	const bag = secrets !== void 0 && hasMaskableValues(secrets) ? secrets : void 0;
-	const mask = (text) => bag === void 0 ? text : maskSecretsInText(text, bag);
-	const unresolved = (value) => value.includes("{{resolve:") || value === "***";
-	const named = {
-		resourceType: record?.resourceType,
-		properties: record?.properties,
-		logicalId
-	};
-	const needles = /* @__PURE__ */ new Set();
-	const add = (needle) => {
-		if (typeof needle === "string" && needle !== "") needles.add(needle);
-	};
-	for (const [raw, derived] of secretDerivedNamePairs({
-		...named,
-		physicalIds: []
-	})) if (typeof raw === "string" && !unresolved(raw) && isSecretDerivedValue(raw, mask)) add(derived);
-	for (const [raw, spelling] of secretDerivedNamePairs({
-		...named,
-		physicalIds: [physicalId ?? "cdkd-no-physical-id-yet"]
-	})) {
-		if (!isSecretDerivedValue(raw, mask)) continue;
-		if (unresolved(raw)) {
-			if (physicalId === void 0) continue;
-			add(spelling);
-		} else {
-			add(raw);
-			if (raw.toLowerCase() !== raw && raw.length >= 4) add(raw.toLowerCase());
-		}
-	}
-	const properties = record?.properties;
-	const path = properties !== null && typeof properties === "object" && Object.hasOwn(properties, "Path") ? properties["Path"] : void 0;
-	if (physicalId !== void 0 && isSecretDerivedValue(path, mask)) add(physicalId);
-	const embedded = options === void 0 ? secrets : options.embedded;
-	const embeddedBag = embedded !== void 0 && hasMaskableValues(embedded) ? embedded : void 0;
-	if (embeddedBag !== void 0 && physicalId !== void 0) {
-		for (const needle of printingCorpusOf(embeddedBag).keys()) if (needle !== "" && (needle === physicalId || needle.length >= 4 && physicalId.includes(needle))) add(needle);
-	}
-	return needles.size > 0 ? needles : void 0;
-}
-function secretNamesReadBy(logicalId, record, resources, judge = () => ({
-	secrets: void 0,
-	embedded: void 0
-})) {
-	const read = /* @__PURE__ */ new Set();
-	const leaves = [...wholeStringLeavesOf(record?.properties)].filter((leaf) => leaf !== "");
-	if (leaves.length === 0) return read;
-	for (const [otherId, other] of Object.entries(resources)) {
-		if (otherId === logicalId) continue;
-		const bags = judge(otherId);
-		const needles = secretNameNeedlesOf(otherId, other, bags.secrets, { embedded: bags.embedded });
-		if (needles === void 0) continue;
-		for (const needle of needles) if (leaves.some((leaf) => leaf === needle || needle.length >= 4 && leaf.includes(needle))) read.add(needle);
-	}
-	return read;
-}
-function stateSecretNameNeedles(resources, secrets) {
-	return (logicalId) => secretNameNeedlesOf(logicalId, Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0, secrets, { embedded: void 0 });
-}
-function secretNamePrintingBag(logicalId, resources) {
-	const bag = /* @__PURE__ */ new Map();
-	const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
-	for (const needle of secretNameNeedlesOf(logicalId, record, void 0) ?? []) recordLogOnlyValue(bag, needle);
-	for (const needle of secretNamesReadBy(logicalId, record, resources)) recordLogOnlyValue(bag, needle);
-	return bag;
-}
-
 //#endregion
 //#region src/deployment/deploy-engine/masking.ts
 function diffLogMasker(diffSecrets, template, parameterValues) {
@@ -31541,6 +31673,7 @@ async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentReso
 async function readRecordAttributes(input) {
 	const { provider, logicalId, resource, stackName, region } = input;
 	if (!provider.import) return { kind: "not-attempted" };
+	if (!hasAddressablePhysicalId(resource)) return { kind: "not-attempted" };
 	const found = await provider.import({
 		logicalId,
 		resourceType: resource.resourceType,
@@ -34837,6 +34970,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		return;
 	}
 	this.refuseRedactedAttributeReads(logicalId, resourceType, context);
+	if (!(currentResource.resourceType === "AWS::CloudFormation::Stack" && currentResource.provisionedBy !== "cc-api") && !hasAddressablePhysicalId(currentResource)) throw markRefusedBeforeApplying(markNonRetryable(new CdkdError(unaddressableUpdateRefusalMessage(stackName, this.stackRegion, logicalId, oldResourceType), STATE_RESOURCES_MALFORMED)));
 	this.attemptedResolvedProps.set(logicalId, resolvedProps);
 	const noEchoHeldPaths = /* @__PURE__ */ new Set();
 	if (change.propertyChanges?.some((pc) => pc.requiresReplacement) === true) {
@@ -35483,6 +35617,46 @@ async function provisionDelete(logicalId, change, stateResources, stackName, tem
 		await noteRetainedResource(resourceType, logicalId);
 		return;
 	}
+	if (!(currentResource.resourceType === "AWS::CloudFormation::Stack" && currentResource.provisionedBy !== "cc-api") && !hasAddressablePhysicalId(currentResource)) {
+		const reason = "state record has no physical id";
+		if (progress) progress.current++;
+		const skipPrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
+		renderer.removeTask(logicalId);
+		const skipLine = formatResourceLine("skipped", logicalId, resourceType, `skipped (${reason})`);
+		this.logger.info(safeMsg`${skipPrefix}${skipLine}`);
+		const showCommand = pasteableCommand("cdkd state show", [{
+			value: stackName,
+			hole: "stack",
+			opts: { plainIdent: true }
+		}, {
+			flag: "--stack-region",
+			value: this.stackRegion,
+			hole: "region"
+		}]).command;
+		const dropCommand = pasteableCommand("cdkd state orphan", [
+			{
+				value: stackName,
+				hole: "stack",
+				opts: { plainIdent: true }
+			},
+			{
+				flag: "--stack-region",
+				value: this.stackRegion,
+				hole: "region"
+			},
+			{
+				flag: "--resource",
+				value: logicalId,
+				hole: "logicalId",
+				opts: { plainIdent: true }
+			}
+		]).command;
+		this.logger.warn(safeMsg`Resource ${displaySafe(logicalId)} (${displaySafe(resourceType)}) has no non-empty string 'physicalId' in its state record, so cdkd cannot address it in AWS and did not try to delete it while removing it from the template. Its cdkd state record was KEPT, so the next 'cdkd deploy' re-attempts the delete. Repair the record's 'physicalId', or delete the resource by hand and drop the record.
+Inspect it with: ${showCommand}
+Drop the record with: ${dropCommand}`);
+		if (counts) counts.deleteSkipped++;
+		return { deleteSkipped: reason };
+	}
 	const governingPolicy = effectiveDeletionPolicy(resourceType, deletionPolicy, currentResource.properties);
 	const finalSnapshotIdentifier = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, governingPolicy);
 	const deleteRoute = this.providerRegistry.getProviderFor({
@@ -35741,7 +35915,7 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 				logicalId,
 				resourceType,
 				...stateResources[logicalId]?.provisionedBy ? { provisionedBy: stateResources[logicalId]?.provisionedBy } : labelRouting && { provisionedBy: labelRouting },
-				...stateResources[logicalId]?.physicalId && { physicalId: stateResources[logicalId]?.physicalId },
+				...stateResources[logicalId] !== void 0 && hasAddressablePhysicalId(stateResources[logicalId]) && { physicalId: stateResources[logicalId].physicalId },
 				reason: deleteSkipped,
 				durationMs: Date.now() - resourceStartedAt
 			});
@@ -36996,6 +37170,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		refuseMalformedOutputs(currentState, stackName, this.stackRegion);
 		refuseMalformedResourcesForDeploy(currentState, stackName, this.stackRegion);
 		refuseMalformedResourceEntriesForDeploy(currentState, stackName, this.stackRegion);
+		refuseMalformedResourceProperties(currentState, stackName, this.stackRegion);
 		refuseMalformedOrphans(currentState, stackName, this.stackRegion);
 		refuseMalformedOrphanRecords(currentState, stackName, this.stackRegion);
 		const migrationPending = currentStateData?.migrationPending ?? false;
@@ -37772,5 +37947,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { namesAnyDeclaredParameter as $, markSameGenerationBag as $a, unreadableOrphanRecords as $i, disableInstanceApiTermination as $n, readBootstrapMarkerBody as $o, hasReadableResources as $r, defineOwnKey as $s, DeploymentEventsReader as $t, resolveDynamoDbDeleteBudgetClock as A, describeTypeWithThrottleRetry as Aa, refuseMalformedOutputsForDestroy as Ai, readTagList as An, hasReasonlessBaselineRefusal as Ao, getAccountInfo as Ar, resolveAutoAssetStorage as As, isReplacementOrphan as At, getPriorAttempts as B, carryLogOnlyValues as Ba, refuseMalformedResourcePropertiesForExport as Bi, isCustomResourceType as Bn, stringifyValue as Bo, parseWebACLArn as Br, CFN_TEMPLATE_URL_LIMIT as Bs, buildFinalSnapshotIdentifier as Bt, perType as C, readConfigString as Ca, refuseMalformedNestedChildOutputs as Ci, ledgerForStack as Cn, S3StateBackend as Co, s3BucketDomainName as Cr, getDockerImageBySourceHash as Cs, awaitInFlightSibling as Ct, beginDeleteWait as D, requireConfigString as Da, refuseMalformedOrphansForDestroy as Di, DBPROXY_TAGS_WHAT as Dn, describeRegionValueKind as Do, coerceParameterTypedValue as Dr, getLegacyStateBucketName as Ds, recordAfterRollbackUpdate as Dt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as E, requireConfigObject as Ea, refuseMalformedOrphans as Ei, acquireIdempotencyToken as En, acceptedCreateOnlyDropsOf as Eo, s3BucketWebsiteUrl as Er, getDefaultStateBucketName as Es, withStackRecords as Et, waitForIndexesSettled as F, DagBuilder as Fa, refuseMalformedResourceEntriesForImport as Fi, stringifyIfAssigned as Fn, orphansAfterRollback as Fo, keepsSecretReferenceToken as Fr, resolveUseCdkBootstrapAssets as Fs, findNestedStackTypeChanges as Ft, cyan as G, printingCorpusOf as Ga, refuseMalformedState as Gi, ccProtectionRegistryTypes as Gn, rewriteTemplateAssetReferences as Go, STATE_REGION_DIVERGED as Gr, decodeListingKey as Gs, refusesFinalSnapshot as Gt, formatResourceLine as H, hasMaskableValues as Ha, refuseMalformedResourcesForDeploy as Hi, withPrintingSecrets as Hn, buildAssetRedirectMap as Ho, parameterInputsFor as Hr, findLargeInlineResources as Hs, createPreDeleteFinalSnapshot as Ht, ECR_AUTO_DELETE_IMAGES_TAG as I, TemplateParser as Ia, refuseMalformedResourceEntriesForImportSave as Ii, CC_BROKEN_REASON as In, orphansCarriedFrom as Io, AWS_NO_VALUE as Ir, stateBucketExistenceConfirmed as Is, getCurrentProducerRegions as It, red as J, shareLogOnlyValues as Ja, repairMalformedOutputsForReadOnly as Ji, deleteIndeterminateGuards as Jn, assertAssetBucketRegion as Jo, UNREADABLE_RESOURCES_MAP_ROW as Jr, canonicalizeRegion as Js, isRedactedRecordedValue as Jt, gray as K, recordLogOnlyParameterValue as Ka, repairMalformedOrphanRecordsForReadOnly as Ki, unchangedBehindSecretReference as Kn, AssetModeResolver as Ko, STATE_RESOURCES_MALFORMED as Kr, expectedOwnerParam as Ks, unsupportedFinalSnapshotError as Kt, S3_AUTO_DELETE_OBJECTS_TAG as L, liveMatchesUnresolvedTokenFrame as La, refuseMalformedResourceEntriesForOrphan as Li, ProviderRegistry as Ln, shouldRetainResource as Lo, cfnRefValueFromPhysicalId as Lr, warnDeprecatedNoPrefixCliFlag as Ls, inheritProducerRegions as Lt, DELETE_INDEX_WAIT_PROCEED_NOTE as M, canonicalLambdaFunctionName as Ma, refuseMalformedResourceEntries as Mi, tagMapAsList as Mn, importableOutputKeys as Mo, carriesDynamicReference as Mr, resolveSkipPrefix as Ms, planRollback as Mt, INDEX_SETTLE_POLL_INTERVAL_MS as N, lambdaFunctionNameForMask as Na, refuseMalformedResourceEntriesForDeploy as Ni, tagPlanWarning as Nn, importableOutputs as No, carriesFetchableDynamicReference as Nr, resolveStateBucketWithDefault as Ns, replacementNeverSwapped as Nt, compensateRemovedDeletionProtection as O, prefetchCreateOnlyPropertyPaths as Oa, refuseMalformedOrphansForOrphan as Oi, DBPROXY_TAG_OPTIONS as On, exportNamesCarriedFrom as Oo, isUnboundTemplateParameter as Or, loadCdkJson as Os, demoteSupersededOrphans as Ot, deleteTableWithIndexBusyRetry as P, sameLambdaFunctionAddress as Pa, refuseMalformedResourceEntriesForDestroy as Pi, definedAttributes as Pn, isReadableBag as Po, isNamelessDynamicReferenceError as Pr, resolveStateBucketWithDefaultAndSource as Ps, resolveReplacementOldType as Pt, computeParameterTaint as Q, maskSecretsInText as Qa, unpreviewableOrphanRecords as Qi, markWaitAbandoned as Qn, parseBootstrapMarker as Qo, hasReadableOutputs as Qr, processStackMessages as Qs, updatePartialReason as Qt, hasCdkAutoDeleteTag as R, inheritNestedStackParameterAssociations as Ra, refuseMalformedResourcePropertiesForDestroy as Ri, ccBrokenReason as Rn, AssetPublisher as Ro, isStalePlaceholderArnAttribute as Rr, ssmResolvedValueType as Rs, ATOMIC_FINAL_SNAPSHOT_TYPES as Rt, isProtectionValueActive as S, configStringRefusal as Sa, refuseDivergentRecordRegionForDestroy as Si, earliestDefined as Sn, isLockInfoExpired as So, s3BucketArn as Sr, AssetManifestLoader as Ss, replayRollback as St, DynamoDBGlobalTableProvider as T, requireConfigArray as Ta, refuseMalformedOrphanRecordsForDestroy as Ti, withCreateTokenLedger as Tn, splitImportedOps as To, s3BucketRegionalDomainName as Tr, synthesisStatusMessage as Ts, getStackRecords as Tt, createReadOnlyAttributeHealerFactory as U, literalSplitDelimitersOf as Ua, refuseMalformedResourcesForDestroy as Ui, CloudControlProvider as Un, createAssetRedirectResolver as Uo, passedParameterClassesOf as Ur, uploadCfnTemplate as Us, effectiveDeletionPolicy as Ut, markRefusedBeforeApplying as V, createUnionSecretMasker as Va, refuseMalformedResourcePropertiesForOrphan as Vi, getCurrentResourceSecrets as Vn, WorkGraph as Vo, withSharedDrainBudget as Vr, MIGRATE_TMP_PREFIX as Vs, ccRoutedFinalSnapshotError as Vt, bold as W, logOnlyValueCount as Wa, refuseMalformedResourcesForExport as Wi, slowCcOperationTimeoutMs as Wn, loadPublishableAssetManifest as Wo, JSON_LISTING_HOLE_VALUE as Wr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ws, isFinalSnapshotError as Wt, secretNamePrintingBag as X, errorCauseChain as Xa, repairMalformedResourcePropertiesForReadOnly as Xi, withIndeterminateGuard as Xn, getBootstrapMarkerKey as Xo, displayLogicalId as Xr, AssemblyReader as Xs, redactedDeleteAddressSkip as Xt, yellow as Y, createSecretMasker as Ya, repairMalformedResourceEntriesForReadOnly as Yi, deleteSkipReason as Yn, ensureAssetStorage as Yo, deployRefusesOrphanRowsReason as Yr, derivePartitionAndUrlSuffix as Ys, redactedDeleteAddressFields as Yt, stateSecretNameNeedles as Z, maskSecretsInError as Za, repairMalformedResourcesForReadOnly as Zi, isWaitAbandonedError as Zn, isCrossRegionRedirect as Zo, hasReadableOrphans as Zr, StageLoadError as Zs, updatePartialMessage as Zt, makeCanonicalizePropertiesFn as _, toFiniteNumber as _a, malformedResourcePropertiesWarning as _i, maskingRetryLogger as _n, STATE_SOURCED_READBACK_RULES as _o, AWS_CREDENTIAL_ENV_KEYS as _r, runDockerForeground as _s, revertedNestedRowIds as _t, findNestedTemplateTreeDefect as a, NO_CC_HANDLERS_REASON as aa, describeFileReadFailure as ac, malformedLocalOutputsWarning as ai, secretBearing as an, isUncertifiedBaselineMaskPosition as ao, DiffCalculator as ar, describeDockerCapturedOutput as as, loadJournaledOrphans as at, recordedProtectionNote as b, configBooleanRefusal as ba, malformedStateRefusalMessage as bi, formatDestructiveChange as bn, isSingleDynamicReferenceToken as bo, envCredentialsAreAssumedRole as br, escapeRegExp$3 as bs, withNestedStackContext as bt, renderNestedTemplateTreeDefect as c, shownType as ca, resolveAssemblyPath as cc, malformedOrphanRecordsRefusalMessage as ci, exportNameSecretExposure as cn, carriesSecretMask as co, classifyReplaySecretRegion as cr, dockerSpawnEnvWithSensitive as cs, planOrphanAdoption as ct, conditionInputsFrom as d, isStatefulRecreateTargetSync as da, malformedOrphansRefusalMessage as di, collectDeclaredOutputNames as dn, recordMaskOnlyValuesIn as do, applyRoleArnIfSet as dr, getDockerCmd as ds, displacedPhysicalIdShown as dt, unreadableResourceEntries as ea, hasOwnKey as ec, isReadableOrphanRecord as ei, DeploymentEventsStore as en, redactSecretsForState as eo, ec2InstanceProtectionSite as er, validateAssetBucketName as es, reachableDivergentParameters as et, parentSuppliedValues as f, renderStatefulReason as fa, malformedOrphansWarning as fi, collectPublishedOutputNames as fn, recordNoEchoAttributeValues as fo, assertFlagRoleArn as fr, isDockerClientEnvKey as fs, dropSettledNestedJournals as ft, mergeNoChangeOutputs as g, toCfnInteger as ga, malformedResourceEntriesWarning as gi, DEFAULT_RESOURCE_WARN_AFTER_MS as gn, STATE_SOURCED_CROSS_GENERATION_RULES as go, sendableAssumeRoleCommand as gr, redactedDockerCause as gs, revertNestedChildFromJournal as gt, keptWholeReasonText as h, isWarmThroughputDecrease as ha, malformedRenderedContainersWarning as hi, DEFAULT_RESOURCE_TIMEOUT_MS as hn, STATE_SOURCED_BASELINE_RULES as ho, isIamRoleArn as hr, redactDockerArgvValues as hs, recordDisplacedSkips as ht, childTemplateLoader as i, withoutSilentDropProperties as ia, absoluteAssemblyPathEscape as ic, malformedExportSourceWarning as ii, exportAliasCollisionScrubWarning as in, dynamicReferenceTokens as io, reEnableInstanceApiTermination as ir, resolveDockerContextDirectory as is, journaledOrphanLines as it, resolveDynamoDbDeleteBudgetMs as j, withRetry as ja, refuseMalformedResourceAttributesForOrphan as ji, refuseMalformedDesiredTags as jn, hasUnverifiableParameterRefusal as jo, isImpossibleEmptyStoredAttribute as jr, resolveCaptureObservedState as js, planFailedOps as jt, deleteBudgetKey as k, templateResourceTypes as ka, refuseMalformedOutputs as ki, planTagDiff as kn, hasReadableExportSet as ko, parameterTypeMayLoseSecretIdentity as kr, resolveApp as ks, isJournaledOrphan as kt, templateIdentity as l, MULTI_REGION_RECREATE_BLOCKED_TYPES as la, clearBucketRegionCache as lc, malformedOrphanRecordsWarning as li, isWholeDynamicReferenceValue as ln, provenPublicValue as lo, producerRegionsFromState as lr, finchSecretArgvRefusal as ls, NESTED_PENDING_PARENT_REASON as lt, isSecretBearingReferenceString as m, coerceWarmThroughput as ma, malformedOutputsWarning as mi, bindingSkippedOutputs as mn, wholeStringLeavesOf as mo, explicitRoleArnOrThrow as mr, partitionSensitiveEnv as ms, nestedChildStackName as mt, IMPLICIT_DELETE_DEPENDENCIES as n, findSilentDropProperties as na, nullPrototypeRecord as nc, malformedDriftResourcePropertiesWarning as ni, WITHHELD_NAME_DISPLAY as nn, recoverMaskedOutput as no, observeThenDisableInstanceApiTermination as nr, buildDenyExternalAccessPolicy as ns, deleteJournaledOrphans as nt, isAbsoluteAssetPath as o, hasNoCloudControlHandlers as oa, displayAssemblyPath as oc, malformedLocalResourceEntriesWarning as oi, secretBearingStateKeyWarning as on, pathCrossesDottedKey as oo, INTRINSIC_KEYS as or, describeDockerExecFailure as os, sameJournaledOrphans as ot, readRecordedConditionVerdicts as p, WARM_THROUGHPUT_MEMBERS as pa, malformedOutputsRefusalMessage as pi, isExportAliasCollision as pn, recordProvenPublicExpression as po, assertSendableRoleArn as pr, isMalformedEnvKey as ps, getNestedRevertRun as pt, green as q, recordLogOnlyValue as qa, repairMalformedOrphansForReadOnly as qi, UNSPECIFIED_SKIP_REASON as qn, BOOTSTRAP_MARKER_PREFIX as qo, UNREADABLE_ORPHANS_CONTAINER_ROW as qr, PARTITION_TABLE as qs, REDACTED_DELETE_ADDRESS_SKIP_REASON as qt, computeImplicitDeleteEdges as r, unwrittenCreateOnlyReplacement as ra, ownValue as rc, malformedExportNamesWarning as ri, displayTextOrWithheld as rn, DYNAMIC_REFERENCE_TOKEN_SCAN as ro, reDisableInstanceApiTermination as rr, buildDockerImage as rs, isHandledOrphan as rt, listNestedTemplateRows as s, findReplacedReadersOfRecreateTargets as sa, renderAssemblyPathEscape as sc, malformedLocalResourcesWarning as si, secretSafeKeyDisplay as sn, identityKeyFor as so, IntrinsicFunctionResolver as sr, describeDockerFailure as ss, makeSiblingClaimReader as st, DeployEngine as t, findActionableSilentDrops as ta, hasPlainPrototype$1 as tc, isReadableResourceEntry as ti, extractDeploymentEventError as tn, scrubResourceRecord as to, isTerminationProtectionPropagationError as tr, validateContainerRepoName as ts, resourcesNamingDeclaredParameter as tt, conditionFingerprint as u, isStatefulRecreateTargetForReplace as ua, resolveBucketRegion as uc, malformedOrphanRowsKeptWarning as ui, noEchoParameterValueSeed as un, recordMaskOnlyValue as uo, regionLessSecretName as ur, formatDockerLoginError as us, displacedOpClause as ut, withResourceDeadline as v, coerceCfnBoolean as va, malformedResourcesWarning as vi, constructPathOf as vn, TEMPLATE_SOURCED_RULES as vo, applyCallerIdentityCredentials as vr, runDockerStreaming as vs, withNestedRevertRun as vt, readProtection as w, replayWarn as wa, refuseMalformedOrphanRecords as wi, reserveStackCreateToken as wn, rebuildClientForBucketRegion as wo, s3BucketDualStackDomainName as wr, Synthesizer as ws, destroyStackRecordsView as wt, PROTECTION_PROPERTY_BY_TYPE as x, configIntegerRefusal as xa, previewableOrphanRecords as xi, RollbackInlinePolicyWriters as xn, LockManager as xo, isSettledInstanceState as xr, stripControlChars as xs, replayFailedOperations as xt, recordedProtectionEvidence as y, coerceCfnInteger as ya, malformedScrubResourceEntriesRefusalMessage as yi, findDestructiveChanges as yn, WHOLE_DYNAMIC_REFERENCE_PATTERN as yo, callerEnvCredentials as yr, warnFinchArgvExposure as ys, getCurrentNestedStackContext as yt, isTruthyCfnBoolean as z, recordNestedStackParameterExpressions as za, refuseMalformedResourcePropertiesForDrift as zi, wouldReturnToSdkProvider as zn, isSensitiveAttributeName as zo, refStateLookupFromResource as zr, CFN_TEMPLATE_BODY_LIMIT as zs, PRE_DELETE_SNAPSHOT_TYPES as zt };
-//# sourceMappingURL=deploy-engine-HCnNEpdp.js.map
+export { resourcesNamingDeclaredParameter as $, createSecretMasker as $a, repairMalformedResourceEntriesForReadOnly as $i, deleteSkipReason as $n, ensureAssetStorage as $o, deployRefusesOrphanRowsReason as $r, derivePartitionAndUrlSuffix as $s, effectiveDeletionPolicy as $t, resolveDynamoDbDeleteBudgetClock as A, requireConfigObject as Aa, refuseMalformedOrphans as Ai, acquireIdempotencyToken as An, acceptedCreateOnlyDropsOf as Ao, s3BucketWebsiteUrl as Ar, getDefaultStateBucketName as As, planRollback as At, getPriorAttempts as B, TemplateParser as Ba, refuseMalformedResourceEntriesForImportSave as Bi, CC_BROKEN_REASON as Bn, orphansCarriedFrom as Bo, AWS_NO_VALUE as Br, stateBucketExistenceConfirmed as Bs, updatePartialMessage as Bt, perType as C, coerceCfnInteger as Ca, malformedScrubResourceEntriesRefusalMessage as Ci, findDestructiveChanges as Cn, WHOLE_DYNAMIC_REFERENCE_PATTERN as Co, callerEnvCredentials as Cr, warnFinchArgvExposure as Cs, getStackRecords as Ct, beginDeleteWait as D, readConfigString as Da, refuseMalformedNestedChildOutputs as Di, ledgerForStack as Dn, S3StateBackend as Do, s3BucketDomainName as Dr, getDockerImageBySourceHash as Ds, isJournaledOrphan as Dt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as E, configStringRefusal as Ea, refuseDivergentRecordRegionForDestroy as Ei, earliestDefined as En, isLockInfoExpired as Eo, s3BucketArn as Er, AssetManifestLoader as Es, demoteSupersededOrphans as Et, waitForIndexesSettled as F, withRetry as Fa, refuseMalformedResourceAttributesForOrphan as Fi, refuseMalformedDesiredTags as Fn, hasUnverifiableParameterRefusal as Fo, isImpossibleEmptyStoredAttribute as Fr, resolveCaptureObservedState as Fs, inheritProducerRegions as Ft, cyan as G, createUnionSecretMasker as Ga, refuseMalformedResourcePropertiesForOrphan as Gi, getCurrentResourceSecrets as Gn, WorkGraph as Go, withSharedDrainBudget as Gr, MIGRATE_TMP_PREFIX as Gs, orphanRecordsPrintingBag as Gt, formatResourceLine as H, inheritNestedStackParameterAssociations as Ha, refuseMalformedResourcePropertiesForDestroy as Hi, ccBrokenReason as Hn, AssetPublisher as Ho, isStalePlaceholderArnAttribute as Hr, ssmResolvedValueType as Hs, completedReplayEntries as Ht, ECR_AUTO_DELETE_IMAGES_TAG as I, canonicalLambdaFunctionName as Ia, refuseMalformedResourceEntries as Ii, tagMapAsList as In, importableOutputKeys as Io, carriesDynamicReference as Ir, resolveSkipPrefix as Is, REDACTED_DELETE_ADDRESS_SKIP_REASON as It, red as J, logOnlyValueCount as Ja, refuseMalformedResourcesForExport as Ji, slowCcOperationTimeoutMs as Jn, loadPublishableAssetManifest as Jo, JSON_LISTING_HOLE_VALUE as Jr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Js, ATOMIC_FINAL_SNAPSHOT_TYPES as Jt, gray as K, hasMaskableValues as Ka, refuseMalformedResourcesForDeploy as Ki, withPrintingSecrets as Kn, buildAssetRedirectMap as Ko, parameterInputsFor as Kr, findLargeInlineResources as Ks, secretNamePrintingBag as Kt, S3_AUTO_DELETE_OBJECTS_TAG as L, lambdaFunctionNameForMask as La, refuseMalformedResourceEntriesForDeploy as Li, tagPlanWarning as Ln, importableOutputs as Lo, carriesFetchableDynamicReference as Lr, resolveStateBucketWithDefault as Ls, isRedactedRecordedValue as Lt, DELETE_INDEX_WAIT_PROCEED_NOTE as M, prefetchCreateOnlyPropertyPaths as Ma, refuseMalformedOrphansForOrphan as Mi, DBPROXY_TAG_OPTIONS as Mn, exportNamesCarriedFrom as Mo, isUnboundTemplateParameter as Mr, loadCdkJson as Ms, resolveReplacementOldType as Mt, INDEX_SETTLE_POLL_INTERVAL_MS as N, templateResourceTypes as Na, refuseMalformedOutputs as Ni, planTagDiff as Nn, hasReadableExportSet as No, parameterTypeMayLoseSecretIdentity as Nr, resolveApp as Ns, findNestedStackTypeChanges as Nt, compensateRemovedDeletionProtection as O, replayWarn as Oa, refuseMalformedOrphanRecords as Oi, reserveStackCreateToken as On, rebuildClientForBucketRegion as Oo, s3BucketDualStackDomainName as Or, Synthesizer as Os, isReplacementOrphan as Ot, deleteTableWithIndexBusyRetry as P, describeTypeWithThrottleRetry as Pa, refuseMalformedOutputsForDestroy as Pi, readTagList as Pn, hasReasonlessBaselineRefusal as Po, getAccountInfo as Pr, resolveAutoAssetStorage as Ps, getCurrentProducerRegions as Pt, reachableDivergentParameters as Q, shareLogOnlyValues as Qa, repairMalformedOutputsForReadOnly as Qi, deleteIndeterminateGuards as Qn, assertAssetBucketRegion as Qo, UNREADABLE_RESOURCES_MAP_ROW as Qr, canonicalizeRegion as Qs, createPreDeleteFinalSnapshot as Qt, hasCdkAutoDeleteTag as R, sameLambdaFunctionAddress as Ra, refuseMalformedResourceEntriesForDestroy as Ri, definedAttributes as Rn, isReadableBag as Ro, isNamelessDynamicReferenceError as Rr, resolveStateBucketWithDefaultAndSource as Rs, redactedDeleteAddressFields as Rt, isProtectionValueActive as S, coerceCfnBoolean as Sa, malformedResourcesWarning as Si, constructPathOf as Sn, TEMPLATE_SOURCED_RULES as So, applyCallerIdentityCredentials as Sr, runDockerStreaming as Ss, destroyStackRecordsView as St, DynamoDBGlobalTableProvider as T, configIntegerRefusal as Ta, previewableOrphanRecords as Ti, RollbackInlinePolicyWriters as Tn, LockManager as To, isSettledInstanceState as Tr, stripControlChars as Ts, recordAfterRollbackUpdate as Tt, createReadOnlyAttributeHealerFactory as U, recordNestedStackParameterExpressions as Ua, refuseMalformedResourcePropertiesForDrift as Ui, wouldReturnToSdkProvider as Un, isSensitiveAttributeName as Uo, refStateLookupFromResource as Ur, CFN_TEMPLATE_BODY_LIMIT as Us, journaledOrphanPrintingBag as Ut, markRefusedBeforeApplying as V, liveMatchesUnresolvedTokenFrame as Va, refuseMalformedResourceEntriesForOrphan as Vi, ProviderRegistry as Vn, shouldRetainResource as Vo, cfnRefValueFromPhysicalId as Vr, warnDeprecatedNoPrefixCliFlag as Vs, updatePartialReason as Vt, bold as W, carryLogOnlyValues as Wa, refuseMalformedResourcePropertiesForExport as Wi, isCustomResourceType as Wn, stringifyValue as Wo, parseWebACLArn as Wr, CFN_TEMPLATE_URL_LIMIT as Ws, maskEventTextWithBoundBags as Wt, computeParameterTaint as X, recordLogOnlyParameterValue as Xa, repairMalformedOrphanRecordsForReadOnly as Xi, unchangedBehindSecretReference as Xn, AssetModeResolver as Xo, STATE_RESOURCES_MALFORMED as Xr, expectedOwnerParam as Xs, buildFinalSnapshotIdentifier as Xt, yellow as Y, printingCorpusOf as Ya, refuseMalformedState as Yi, ccProtectionRegistryTypes as Yn, rewriteTemplateAssetReferences as Yo, STATE_REGION_DIVERGED as Yr, decodeListingKey as Ys, PRE_DELETE_SNAPSHOT_TYPES as Yt, namesAnyDeclaredParameter as Z, recordLogOnlyValue as Za, repairMalformedOrphansForReadOnly as Zi, UNSPECIFIED_SKIP_REASON as Zn, BOOTSTRAP_MARKER_PREFIX as Zo, UNREADABLE_ORPHANS_CONTAINER_ROW as Zr, PARTITION_TABLE as Zs, ccRoutedFinalSnapshotError as Zt, makeCanonicalizePropertiesFn as _, WARM_THROUGHPUT_MEMBERS as _a, malformedOutputsRefusalMessage as _i, isExportAliasCollision as _n, recordProvenPublicExpression as _o, assertSendableRoleArn as _r, isMalformedEnvKey as _s, getCurrentNestedStackContext as _t, findNestedTemplateTreeDefect as a, findActionableSilentDrops as aa, hasPlainPrototype$1 as ac, isReadableResourceEntry as ai, extractDeploymentEventError as an, scrubResourceRecord as ao, isTerminationProtectionPropagationError as ar, validateContainerRepoName as as, makeSiblingClaimReader as at, recordedProtectionNote as b, toCfnInteger as ba, malformedResourceEntriesWarning as bi, DEFAULT_RESOURCE_WARN_AFTER_MS as bn, STATE_SOURCED_CROSS_GENERATION_RULES as bo, sendableAssumeRoleCommand as br, redactedDockerCause as bs, replayRollback as bt, renderNestedTemplateTreeDefect as c, withoutSilentDropProperties as ca, absoluteAssemblyPathEscape as cc, malformedExportSourceWarning as ci, exportAliasCollisionScrubWarning as cn, dynamicReferenceTokens as co, reEnableInstanceApiTermination as cr, resolveDockerContextDirectory as cs, displacedOpClause as ct, conditionInputsFrom as d, findReplacedReadersOfRecreateTargets as da, renderAssemblyPathEscape as dc, malformedLocalResourcesWarning as di, secretSafeKeyDisplay as dn, identityKeyFor as do, IntrinsicFunctionResolver as dr, describeDockerFailure as ds, getNestedRevertRun as dt, repairMalformedResourcePropertiesForReadOnly as ea, AssemblyReader as ec, displayLogicalId as ei, isFinalSnapshotError as en, errorCauseChain as eo, withIndeterminateGuard as er, getBootstrapMarkerKey as es, deleteJournaledOrphans as et, parentSuppliedValues as f, shownType as fa, resolveAssemblyPath as fc, malformedOrphanRecordsRefusalMessage as fi, exportNameSecretExposure as fn, carriesSecretMask as fo, classifyReplaySecretRegion as fr, dockerSpawnEnvWithSensitive as fs, nestedChildStackName as ft, mergeNoChangeOutputs as g, renderStatefulReason as ga, malformedOrphansWarning as gi, collectPublishedOutputNames as gn, recordNoEchoAttributeValues as go, assertFlagRoleArn as gr, isDockerClientEnvKey as gs, withNestedRevertRun as gt, keptWholeReasonText as h, isStatefulRecreateTargetSync as ha, malformedOrphansRefusalMessage as hi, collectDeclaredOutputNames as hn, recordMaskOnlyValuesIn as ho, applyRoleArnIfSet as hr, getDockerCmd as hs, revertedNestedRowIds as ht, childTemplateLoader as i, unreadableResourceEntries as ia, hasOwnKey as ic, isReadableOrphanRecord as ii, DeploymentEventsStore as in, redactSecretsForState as io, ec2InstanceProtectionSite as ir, validateAssetBucketName as is, sameJournaledOrphans as it, resolveDynamoDbDeleteBudgetMs as j, requireConfigString as ja, refuseMalformedOrphansForDestroy as ji, DBPROXY_TAGS_WHAT as jn, describeRegionValueKind as jo, coerceParameterTypedValue as jr, getLegacyStateBucketName as js, replacementNeverSwapped as jt, deleteBudgetKey as k, requireConfigArray as ka, refuseMalformedOrphanRecordsForDestroy as ki, withCreateTokenLedger as kn, splitImportedOps as ko, s3BucketRegionalDomainName as kr, synthesisStatusMessage as ks, planFailedOps as kt, templateIdentity as l, NO_CC_HANDLERS_REASON as la, describeFileReadFailure as lc, malformedLocalOutputsWarning as li, secretBearing as ln, isUncertifiedBaselineMaskPosition as lo, DiffCalculator as lr, describeDockerCapturedOutput as ls, displacedPhysicalIdShown as lt, isSecretBearingReferenceString as m, isStatefulRecreateTargetForReplace as ma, resolveBucketRegion as mc, malformedOrphanRowsKeptWarning as mi, noEchoParameterValueSeed as mn, recordMaskOnlyValue as mo, regionLessSecretName as mr, formatDockerLoginError as ms, revertNestedChildFromJournal as mt, IMPLICIT_DELETE_DEPENDENCIES as n, unpreviewableOrphanRecords as na, processStackMessages as nc, hasReadableOutputs as ni, unsupportedFinalSnapshotError as nn, maskSecretsInText as no, markWaitAbandoned as nr, parseBootstrapMarker as ns, journaledOrphanLines as nt, isAbsoluteAssetPath as o, findSilentDropProperties as oa, nullPrototypeRecord as oc, malformedDriftResourcePropertiesWarning as oi, WITHHELD_NAME_DISPLAY as on, recoverMaskedOutput as oo, observeThenDisableInstanceApiTermination as or, buildDenyExternalAccessPolicy as os, planOrphanAdoption as ot, readRecordedConditionVerdicts as p, MULTI_REGION_RECREATE_BLOCKED_TYPES as pa, clearBucketRegionCache as pc, malformedOrphanRecordsWarning as pi, isWholeDynamicReferenceValue as pn, provenPublicValue as po, producerRegionsFromState as pr, finchSecretArgvRefusal as ps, recordDisplacedSkips as pt, green as q, literalSplitDelimitersOf as qa, refuseMalformedResourcesForDestroy as qi, CloudControlProvider as qn, createAssetRedirectResolver as qo, passedParameterClassesOf as qr, uploadCfnTemplate as qs, stateSecretNameNeedles as qt, computeImplicitDeleteEdges as r, unreadableOrphanRecords as ra, defineOwnKey as rc, hasReadableResources as ri, DeploymentEventsReader as rn, markSameGenerationBag as ro, disableInstanceApiTermination as rr, readBootstrapMarkerBody as rs, loadJournaledOrphans as rt, listNestedTemplateRows as s, unwrittenCreateOnlyReplacement as sa, ownValue as sc, malformedExportNamesWarning as si, displayTextOrWithheld as sn, DYNAMIC_REFERENCE_TOKEN_SCAN as so, reDisableInstanceApiTermination as sr, buildDockerImage as ss, NESTED_PENDING_PARENT_REASON as st, DeployEngine as t, repairMalformedResourcesForReadOnly as ta, StageLoadError as tc, hasReadableOrphans as ti, refusesFinalSnapshot as tn, maskSecretsInError as to, isWaitAbandonedError as tr, isCrossRegionRedirect as ts, isHandledOrphan as tt, conditionFingerprint as u, hasNoCloudControlHandlers as ua, displayAssemblyPath as uc, malformedLocalResourceEntriesWarning as ui, secretBearingStateKeyWarning as un, pathCrossesDottedKey as uo, INTRINSIC_KEYS as ur, describeDockerExecFailure as us, dropSettledNestedJournals as ut, withResourceDeadline as v, coerceWarmThroughput as va, malformedOutputsWarning as vi, bindingSkippedOutputs as vn, wholeStringLeavesOf as vo, explicitRoleArnOrThrow as vr, partitionSensitiveEnv as vs, withNestedStackContext as vt, readProtection as w, configBooleanRefusal as wa, malformedStateRefusalMessage as wi, formatDestructiveChange as wn, isSingleDynamicReferenceToken as wo, envCredentialsAreAssumedRole as wr, escapeRegExp$3 as ws, withStackRecords as wt, PROTECTION_PROPERTY_BY_TYPE as x, toFiniteNumber as xa, malformedResourcePropertiesWarning as xi, maskingRetryLogger as xn, STATE_SOURCED_READBACK_RULES as xo, AWS_CREDENTIAL_ENV_KEYS as xr, runDockerForeground as xs, awaitInFlightSibling as xt, recordedProtectionEvidence as y, isWarmThroughputDecrease as ya, malformedRenderedContainersWarning as yi, DEFAULT_RESOURCE_TIMEOUT_MS as yn, STATE_SOURCED_BASELINE_RULES as yo, isIamRoleArn as yr, redactDockerArgvValues as ys, replayFailedOperations as yt, isTruthyCfnBoolean as z, DagBuilder as za, refuseMalformedResourceEntriesForImport as zi, stringifyIfAssigned as zn, orphansAfterRollback as zo, keepsSecretReferenceToken as zr, resolveUseCdkBootstrapAssets as zs, redactedDeleteAddressSkip as zt };
+//# sourceMappingURL=deploy-engine-BPcBCyUE.js.map