@go-to-k/cdkd 0.296.6 → 0.296.7

package/dist/{deploy-engine-BPcBCyUE.js → deploy-engine-wyaJUA8V.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js"
 import { A as displayIdent, C as withoutGeneratedFallbackName, D as UNRENDERABLE, E as STACK_REF_MAX_CODE_POINTS, F as plainIdentOr, I as safeMsg, M as displayStackName, N as isPasteableIdent, R as truncateCodePoints, S as withStackName, T as SECRET_REF_MAX_CODE_POINTS, _ as generateResourceNameWithFallback, b as looksLikeCdkdGeneratedName, c as installLogLineMaskerSource, g as generateResourceName, h as explicitNamePropertyFor, j as displaySafe, k as displayAwsMessage, l as getLiveRenderer, n as getLogger, p as applyDefaultNameForFallback, r as isStdoutReservedForPayload, s as currentLogLineMasker, v as getCurrentSkipPrefix, x as withSkipPrefix, y as getCurrentStackName } from "./logger-DAaB7GFO.js";
 import { $n as markRedactedCause, $t as LockError, A as isTerminalDeleteFailure, At as CUSTOM_RESOURCE_RESPONSE_PREFIX, Bn as isAmbiguousCcHandlerErrorCode, Bt as clientDefaultsFor, C as refusalTypeShown, Cn as physicalIdShownBesideCommand, Ct as buildForceUnlockCommand, D as ProtectionFlipRegistry, Dn as shellQuote, Dt as formatLockOperation, En as shellBoundedDisplay, Et as formatLockExpiry, Fn as isRecreateRetryableError, Ft as producerRecordKey, Gn as retryClassificationText, H as pasteableAwsCommand, Hn as isIamPropagationError, Ht as AccountIdUnavailableError, In as isReplayedNameCollisionFrom, J as isInterruptedWaitError, Jn as safeStringify$1, Kn as describeAwsFailure, Kt as CrossAccountSecretRefusalError, Lt as withPasteableAwsProfile, M as observeThenDisableProtection, Mn as hasReplayMayCollide, Mt as injectiveKey, N as protectionFlipKey, Nn as isNameCollisionErrorFrom, O as compensateProtectionFlip, On as withheldTargetClause, Ot as formatLockOwner, Pn as isNameCooldownError, Q as canonicalizeRoute53QueryName, Qn as markNonRetryable, R as DELETION_PROTECTION_DOC_POINTER, Rn as markReplayMayCollide, Rt as ambientClientDefaults, S as quotedRemedyLogicalId, Sn as pasteableCommand, St as UNREPRODUCIBLE_LOCK_CLAUSE, T as resolveExplicitPhysicalId, Tn as quotedOrDescribed, U as protectedReplacementAdvice, Un as isRetryableTransientError, Ut as AssetError, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, Wn as isTransientServerError, Wt as CdkdError, X as ElapsedBudgetRegistry, Xn as isMarkedNonRetryable, Xt as IntrinsicResolutionRefusalError, Y as startInterruptWatch, Yt as DynamicReferenceRegionAmbiguousError, Z as monotonicNowMs, Zn as isThrottlingError, _n as SHELL_ACTIVE_WHY, _t as hasCreatedBeforeFailure, an as ResourceTimeoutError, at as segmentAfterAnchor, b as isQuotableImportValue, bt as markAuxiliaryFailure, ct as createMaskedRetryLogger, d as prepareRemovalForUpdate, dt as maskerOrIdentity, en as MacroExpansionError, er as wrapMaskedAwsError, et as compositeIdSeparatorRefusal, f as removalWarning, ft as withDerivedNameMasks, g as assertRegionMatch, gn as SHELL_ACTIVE, gt as createdBeforeFailure, h as RESOURCE_NOT_FOUND, i as holdsSecretDerivedEntry, in as ProvisioningError, it as resourceTypeShown, jn as isUpdateUnsupportedError, jt as DEFAULT_STATE_PREFIX, k as deleteWithProtectionCompensation, kt as sanitizeRecoveryValue, l as withUnchangedSecretPrincipalLists, ln as StateError, lt as isSecretDerivedValue, m as withoutInjectedRemovals, mt as carryCreatedBeforeFailure, nt as logicalIdShown, on as ResourceUpdateNotSupportedError, ot as stateOrphanRecordRemedy, pn as normalizeAwsError, pt as RETRY_AUXILIARY_OWNER, qt as DependencyError, st as createMaskedLogSinks, tn as MalformedProducerRecordRefusalError, un as SynthesisError, ut as maskDeep, vn as UNSHOWABLE_VALUE, vt as isAuxiliaryFailure, wn as plainOrDescribed, x as normalizeAwsTagsToCfn, xn as isInertUnquoted, xt as markCreatedBeforeFailure, yn as commandHole, yt as isAuxiliaryMarkOf, zn as formatRetryClassificationSignals, zt as ambientCredentialConfig } from "./iam-policy-targets-td1X_kKN.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-BgqcIKdb.js";
+import { t as getCdkdVersion } from "./version-LalLOhpQ.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -6822,6 +6822,330 @@ function positionListByCrossStackSource(bag, source, secrets) {
 	return certifiedListForLeaf(secrets, association, bag);
 }
 
+//#endregion
+//#region src/deployment/secret-redaction/fresh-noecho.ts
+function embedsFreshNoEchoValue(text, secrets) {
+	const fresh = freshNoEchoValuesOf.get(secrets);
+	if (fresh === void 0) return false;
+	for (const value of fresh) if (isMaskOnlyPlaintext(secrets, value) && text.includes(value)) return true;
+	return false;
+}
+function carriesFreshNoEchoValue(value, secrets) {
+	const isFresh = freshNoEchoLeafTest(secrets);
+	if (isFresh === void 0) return false;
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (node) => {
+		if (typeof node === "string") return isFresh(node);
+		if (node === null || typeof node !== "object") return false;
+		if (seen.has(node)) return false;
+		seen.add(node);
+		if (Array.isArray(node)) return node.some((item) => walk(item));
+		return Object.values(node).some((child) => walk(child));
+	};
+	return walk(value);
+}
+function freshNoEchoLeafPositions(value, secrets) {
+	const isFresh = freshNoEchoLeafTest(secrets);
+	if (isFresh === void 0) return [];
+	const leaves = [];
+	const ancestors = /* @__PURE__ */ new Set();
+	const walk = (node, path) => {
+		if (typeof node === "string") {
+			if (isFresh(node)) leaves.push({
+				path,
+				plaintext: node
+			});
+			return;
+		}
+		if (node === null || typeof node !== "object") return;
+		if (ancestors.has(node)) return;
+		ancestors.add(node);
+		if (Array.isArray(node)) node.forEach((item, index) => walk(item, [...path, index]));
+		else for (const [key, child] of Object.entries(node)) walk(child, [...path, key]);
+		ancestors.delete(node);
+	};
+	walk(value, []);
+	return leaves;
+}
+function freshNoEchoLeafTest(secrets) {
+	const fresh = freshNoEchoValuesOf.get(secrets);
+	if (fresh === void 0 || fresh.size === 0) return void 0;
+	const needles = containmentNeedlesOf(secrets).filter((needle) => fresh.has(needle));
+	return (leaf) => fresh.has(leaf) && isMaskOnlyPlaintext(secrets, leaf) || leaf !== "***" && embedsNeedleOutsideReferences(leaf, needles, secrets);
+}
+function containmentNeedlesOf(secrets) {
+	const values = containmentValuesOf.get(secrets);
+	if (values === void 0 || values.size === 0) return [];
+	const needles = [];
+	for (const value of values) if (value.length >= 4 && isMaskOnlyPlaintext(secrets, value)) needles.push(value);
+	return needles;
+}
+function isStrictlyInsideASpan(spans, start, end) {
+	return spans.some((span) => span.start <= start && end <= span.end && (span.start !== start || span.end !== end));
+}
+function embedsNeedleOutsideReferences(leaf, needles, secrets) {
+	let spans;
+	for (const needle of needles) for (let at = leaf.indexOf(needle); at >= 0; at = leaf.indexOf(needle, at + 1)) {
+		spans ??= isDynamicReferenceString(leaf) ? resolvableReferenceSpans(leaf, new Set(secrets.values())) : [];
+		if (!isStrictlyInsideASpan(spans, at, at + needle.length)) return true;
+	}
+	return false;
+}
+function flattenEmbeddedNoEchoLeaves(value, secrets) {
+	const needles = containmentNeedlesOf(secrets);
+	if (needles.length === 0) return value;
+	const flattens = (leaf) => leaf !== "***" && embedsNeedleOutsideReferences(leaf, needles, secrets);
+	const walk = (node) => {
+		if (typeof node === "string") return flattens(node) ? "***" : node;
+		if (node === null || typeof node !== "object") return node;
+		if (Array.isArray(node)) {
+			let changed = false;
+			const out = node.map((item) => {
+				const next = walk(item);
+				if (next !== item) changed = true;
+				return next;
+			});
+			return changed ? out : node;
+		}
+		if (isOrdinaryDate(node)) {
+			const persisted = node.toJSON();
+			return typeof persisted === "string" && flattens(persisted) ? "***" : node;
+		}
+		let out;
+		for (const [key, child] of Object.entries(node)) {
+			const next = walk(child);
+			if (next === child) continue;
+			out ??= Object.assign(Object.create(null), node);
+			out[key] = next;
+		}
+		return out ?? node;
+	};
+	return walk(value);
+}
+function substringNeedlesOf(secrets) {
+	const needles = [];
+	for (const plaintext of secrets.keys()) if (!isMaskOnlyPlaintext(secrets, plaintext)) needles.push(plaintext);
+	return needles;
+}
+function recordedExpressionsOf(secrets) {
+	const expressions = /* @__PURE__ */ new Set();
+	for (const [plaintext, expression] of secrets) if (!isMaskOnlyPlaintext(secrets, plaintext)) expressions.add(expression);
+	return expressions;
+}
+const recoverableMaskedOutputs = /* @__PURE__ */ new Map();
+function maskedOutputKey(identity, stackName, region, outputKey) {
+	return `${identity}\u0000${stackName}\u0000${region}\u0000${outputKey}`;
+}
+function recordRecoverableMaskedOutput(identity, stackName, region, outputKey, plaintext) {
+	recoverableMaskedOutputs.set(maskedOutputKey(identity, stackName, region, outputKey), plaintext);
+}
+function recoverMaskedOutput(identity, stackName, region, outputKey) {
+	return recoverableMaskedOutputs.get(maskedOutputKey(identity, stackName, region, outputKey));
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/nested-stack.ts
+const NESTED_STACK_RESOURCE_TYPE$4 = "AWS::CloudFormation::Stack";
+const nestedStackParameterExpressions = /* @__PURE__ */ new WeakMap();
+const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
+function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, rules = TEMPLATE_DERIVED_RULES) {
+	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$4) return;
+	if (secrets.size === 0) return;
+	if (!isPlainObject$4(resolvedProperties) || !isPlainObject$4(sourceProperties)) return;
+	if (!Object.hasOwn(resolvedProperties, "Parameters")) return;
+	if (!Object.hasOwn(sourceProperties, "Parameters")) return;
+	const resolvedParameters = resolvedProperties["Parameters"];
+	const sourceParameters = sourceProperties["Parameters"];
+	if (!isPlainObject$4(resolvedParameters) || !isPlainObject$4(sourceParameters)) return;
+	const positioned = redactSecretsForState(markSameGenerationBag({ ...resolvedParameters }), secrets, sourceParameters, rules);
+	let table = nestedStackParameterExpressions.get(secrets);
+	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
+		if (typeof resolvedValue !== "string" || !secrets.has(resolvedValue)) continue;
+		const expression = positioned[name];
+		if (typeof expression !== "string") continue;
+		if (!isSingleDynamicReferenceToken(expression)) continue;
+		const sourceLeaf = sourceParameters[name];
+		if (typeof sourceLeaf === "string" && expression !== sourceLeaf) continue;
+		if (expression === resolvedValue) continue;
+		const seenResolvingTo = plaintextIndexOf(secrets).get(expression);
+		if (seenResolvingTo !== void 0 && seenResolvingTo !== resolvedValue) continue;
+		if (typeof sourceLeaf === "string" && resolvedPlaintextOf(secrets, expression) !== resolvedValue) continue;
+		if (table === void 0) {
+			table = /* @__PURE__ */ new Map();
+			nestedStackParameterExpressions.set(secrets, table);
+		}
+		storeAssociation(table, name, expression, resolvedValue);
+	}
+	const framesByValue = /* @__PURE__ */ new Map();
+	const tokensOf = /* @__PURE__ */ new Map();
+	const frameSpellings = /* @__PURE__ */ new Map();
+	const frameSpellingOf = (name) => {
+		if (!frameSpellings.has(name)) frameSpellings.set(name, computeFrameSpelling(name));
+		return frameSpellings.get(name);
+	};
+	const computeFrameSpelling = (name) => {
+		const resolvedValue = resolvedParameters[name];
+		if (typeof resolvedValue !== "string") return void 0;
+		const sourceLeaf = sourceParameters[name];
+		if (typeof sourceLeaf === "string") return sourceLeaf;
+		if (!isPlainObject$4(sourceLeaf)) return void 0;
+		const written = positioned[name];
+		if (typeof written !== "string") return void 0;
+		const rendered = intrinsicSkeletonSegments(sourceLeaf)?.map((s) => s === UNKNOWN_PART ? "\0" : s).join("");
+		const spans = rendered === void 0 ? [] : dynamicReferenceSpans(rendered);
+		if (rendered !== void 0 && spans.length === 1) {
+			const [span] = spans;
+			const ownToken = rendered.slice(span.start, span.end);
+			if (written !== resolvedValue && SPELLED_SECRET_REFERENCE_PREFIXES.some((prefix) => ownToken.startsWith(prefix))) return written;
+		}
+		const substituted = substitutedSpellingOf(secrets, sourceLeaf, resolvedValue);
+		if (substituted === void 0) return void 0;
+		return written === resolvedValue || written === substituted ? substituted : void 0;
+	};
+	const certifiedSpellingOf = (name) => {
+		const sourceLeaf = sourceParameters[name];
+		if (typeof sourceLeaf === "string") return positioned[name] === sourceLeaf ? sourceLeaf : void 0;
+		return frameSpellingOf(name);
+	};
+	const unwrittenValues = /* @__PURE__ */ new Set();
+	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
+		if (typeof resolvedValue !== "string") continue;
+		const spelling = frameSpellingOf(name);
+		const frame = spelling === void 0 ? void 0 : singleSpanFrame(resolvedValue, spelling);
+		const frames = framesByValue.get(resolvedValue) ?? /* @__PURE__ */ new Set();
+		const unframed = frame === void 0 || resolvedPlaintextOf(secrets, frame.token) !== frame.middle;
+		frames.add(unframed ? UNFRAMED_SPELLING : `${frame.prefix.length}:${frame.prefix}${frame.suffix}`);
+		framesByValue.set(resolvedValue, frames);
+		if (!unframed) {
+			const tokens = tokensOf.get(resolvedValue) ?? /* @__PURE__ */ new Set();
+			tokens.add(frame.token);
+			tokensOf.set(resolvedValue, tokens);
+			if (typeof sourceParameters[name] !== "string" && positioned[name] !== spelling) unwrittenValues.add(resolvedValue);
+		}
+	}
+	for (const value of unwrittenValues) if (tokensOf.get(value)?.size !== 1) framesByValue.get(value)?.add(UNFRAMED_SPELLING);
+	const rowWithoutParameters = {};
+	for (const [key, value] of Object.entries(resolvedProperties)) if (key !== "Parameters") rowWithoutParameters[key] = value;
+	const outsideLeaves = wholeStringLeavesOf(rowWithoutParameters);
+	const framed = /* @__PURE__ */ new Map();
+	const framedByName = [];
+	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
+		if (typeof resolvedValue !== "string") continue;
+		const spelling = certifiedSpellingOf(name);
+		if (spelling === void 0) continue;
+		if (redactSecretsForState(resolvedValue, secrets) !== resolvedValue) continue;
+		const frame = singleSpanFrame(resolvedValue, spelling);
+		if (frame === void 0 || resolvedPlaintextOf(secrets, frame.token) !== frame.middle) continue;
+		if (framesByValue.get(resolvedValue)?.size !== 1) continue;
+		const isNeedle = resolvedValue.length >= 4;
+		const rewrites = (leaf) => leaf === resolvedValue || isNeedle && leaf.includes(resolvedValue);
+		let embedded = false;
+		for (const leaf of outsideLeaves) if (rewrites(leaf)) {
+			embedded = true;
+			break;
+		}
+		for (const other of Object.values(resolvedParameters)) {
+			if (embedded) break;
+			if (typeof other === "string") {
+				if (other !== resolvedValue && rewrites(other)) embedded = true;
+				continue;
+			}
+			for (const leaf of wholeStringLeavesOf(other)) if (rewrites(leaf)) {
+				embedded = true;
+				break;
+			}
+		}
+		if (embedded) continue;
+		framedByName.push([
+			name,
+			spelling,
+			resolvedValue
+		]);
+		if (secrets.get(frame.middle) !== frame.token && tokensOf.get(resolvedValue)?.size !== 1) continue;
+		framed.set(resolvedValue, spelling);
+	}
+	for (const [plaintext, expression] of framed) secrets.set(plaintext, expression);
+	for (const [name, expression, plaintext] of framedByName) {
+		if (table === void 0) {
+			table = /* @__PURE__ */ new Map();
+			nestedStackParameterExpressions.set(secrets, table);
+		}
+		storeAssociation(table, name, expression, plaintext);
+	}
+}
+function inheritNestedStackParameterAssociations(childSecrets, parentSecrets) {
+	const table = nestedStackParameterExpressions.get(parentSecrets);
+	if (table === void 0 || table.size === 0) return;
+	let associations = crossStackAssociations.get(childSecrets);
+	for (const [name, association] of table) {
+		const key = crossStackSourceKey({ Ref: name });
+		if (key === void 0) continue;
+		if (associations === void 0) {
+			associations = /* @__PURE__ */ new Map();
+			crossStackAssociations.set(childSecrets, associations);
+		}
+		if (typeof association === "symbol") {
+			associations.set(key, association);
+			continue;
+		}
+		storeAssociation(associations, key, association.expression, association.plaintext);
+	}
+}
+function inheritedParameterExpression(parentSecrets, parameterName, resolvedValue) {
+	const association = nestedStackParameterExpressions.get(parentSecrets)?.get(parameterName);
+	if (association === void 0 || typeof association === "symbol") return void 0;
+	if (Array.isArray(resolvedValue)) return certifiedListForLeaf(parentSecrets, association, resolvedValue);
+	return certifiedExpressionForLeaf(parentSecrets, association, resolvedValue);
+}
+const inheritedParameterReads = /* @__PURE__ */ new WeakMap();
+const POISONED_PARAMETER_READS = Symbol("cdkd.inherited-parameter-reads.poisoned");
+function recordInheritedParameterRead(childSecrets, parentSecrets, parameterName) {
+	const reads = inheritedParameterReads.get(childSecrets);
+	if (reads === void 0) {
+		inheritedParameterReads.set(childSecrets, {
+			parent: parentSecrets,
+			names: /* @__PURE__ */ new Set([parameterName])
+		});
+		return;
+	}
+	if (typeof reads === "symbol") return;
+	if (reads.parent !== parentSecrets) {
+		inheritedParameterReads.set(childSecrets, POISONED_PARAMETER_READS);
+		return;
+	}
+	reads.names.add(parameterName);
+}
+function redactInheritedParameterValue(parentSecrets, parameterName, value) {
+	return inheritedParameterExpression(parentSecrets, parameterName, value) ?? redactSecretsForState(value, parentSecrets);
+}
+function positionByInheritedParameter(bag, source, secrets) {
+	const keys = Object.keys(source);
+	if (keys.length !== 1 || keys[0] !== "Ref") return void 0;
+	const name = source["Ref"];
+	if (typeof name !== "string") return void 0;
+	const reads = inheritedParameterReads.get(secrets);
+	if (reads === void 0 || typeof reads === "symbol" || !reads.names.has(name)) return;
+	if (typeof bag !== "string" && !Array.isArray(bag)) return void 0;
+	if (carriesChildOnlyPlaintext(bag, secrets, reads.parent)) return void 0;
+	const answer = redactInheritedParameterValue(reads.parent, name, bag);
+	if (!deepEqualJsonValue(redactSecretsForState(answer, secrets), answer)) return void 0;
+	return answer;
+}
+function carriesChildOnlyPlaintext(value, childSecrets, parentSecrets) {
+	const parentNeedles = new Set(substringNeedlesOf(parentSecrets));
+	const childNeedles = new Set(substringNeedlesOf(childSecrets));
+	const childOnly = [...childSecrets.keys()].filter((plaintext) => plaintext !== "" && (!parentSecrets.has(plaintext) || childNeedles.has(plaintext) && !parentNeedles.has(plaintext)));
+	for (const needle of parentNeedles) if (needle.length >= 4 && !childSecrets.has(needle)) childOnly.push(needle);
+	if (childOnly.length === 0) return false;
+	const visit = (node) => {
+		if (typeof node === "string") return childOnly.some((plaintext) => node.includes(plaintext));
+		if (Array.isArray(node)) return node.some(visit);
+		if (node !== null && typeof node === "object") return Object.values(node).some(visit);
+		return false;
+	};
+	return visit(value);
+}
+
 //#endregion
 //#region src/deployment/secret-redaction/redact-path.ts
 function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameGeneration) {
@@ -6835,6 +7159,10 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		return positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration);
 	}
+	if ((typeof bag === "string" || Array.isArray(bag)) && isPlainObject$4(source)) {
+		const inherited = positionByInheritedParameter(bag, source, secrets);
+		if (inherited !== void 0) return inherited;
+	}
 	if (typeof bag === "string" && isPlainObject$4(source)) {
 		const certified = positionByCrossStackSource(bag, source, secrets);
 		if (certified !== void 0) return certified;
@@ -7189,127 +7517,6 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 	};
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/fresh-noecho.ts
-function embedsFreshNoEchoValue(text, secrets) {
-	const fresh = freshNoEchoValuesOf.get(secrets);
-	if (fresh === void 0) return false;
-	for (const value of fresh) if (isMaskOnlyPlaintext(secrets, value) && text.includes(value)) return true;
-	return false;
-}
-function carriesFreshNoEchoValue(value, secrets) {
-	const isFresh = freshNoEchoLeafTest(secrets);
-	if (isFresh === void 0) return false;
-	const seen = /* @__PURE__ */ new Set();
-	const walk = (node) => {
-		if (typeof node === "string") return isFresh(node);
-		if (node === null || typeof node !== "object") return false;
-		if (seen.has(node)) return false;
-		seen.add(node);
-		if (Array.isArray(node)) return node.some((item) => walk(item));
-		return Object.values(node).some((child) => walk(child));
-	};
-	return walk(value);
-}
-function freshNoEchoLeafPositions(value, secrets) {
-	const isFresh = freshNoEchoLeafTest(secrets);
-	if (isFresh === void 0) return [];
-	const leaves = [];
-	const ancestors = /* @__PURE__ */ new Set();
-	const walk = (node, path) => {
-		if (typeof node === "string") {
-			if (isFresh(node)) leaves.push({
-				path,
-				plaintext: node
-			});
-			return;
-		}
-		if (node === null || typeof node !== "object") return;
-		if (ancestors.has(node)) return;
-		ancestors.add(node);
-		if (Array.isArray(node)) node.forEach((item, index) => walk(item, [...path, index]));
-		else for (const [key, child] of Object.entries(node)) walk(child, [...path, key]);
-		ancestors.delete(node);
-	};
-	walk(value, []);
-	return leaves;
-}
-function freshNoEchoLeafTest(secrets) {
-	const fresh = freshNoEchoValuesOf.get(secrets);
-	if (fresh === void 0 || fresh.size === 0) return void 0;
-	const needles = containmentNeedlesOf(secrets).filter((needle) => fresh.has(needle));
-	return (leaf) => fresh.has(leaf) && isMaskOnlyPlaintext(secrets, leaf) || leaf !== "***" && embedsNeedleOutsideReferences(leaf, needles, secrets);
-}
-function containmentNeedlesOf(secrets) {
-	const values = containmentValuesOf.get(secrets);
-	if (values === void 0 || values.size === 0) return [];
-	const needles = [];
-	for (const value of values) if (value.length >= 4 && isMaskOnlyPlaintext(secrets, value)) needles.push(value);
-	return needles;
-}
-function isStrictlyInsideASpan(spans, start, end) {
-	return spans.some((span) => span.start <= start && end <= span.end && (span.start !== start || span.end !== end));
-}
-function embedsNeedleOutsideReferences(leaf, needles, secrets) {
-	let spans;
-	for (const needle of needles) for (let at = leaf.indexOf(needle); at >= 0; at = leaf.indexOf(needle, at + 1)) {
-		spans ??= isDynamicReferenceString(leaf) ? resolvableReferenceSpans(leaf, new Set(secrets.values())) : [];
-		if (!isStrictlyInsideASpan(spans, at, at + needle.length)) return true;
-	}
-	return false;
-}
-function flattenEmbeddedNoEchoLeaves(value, secrets) {
-	const needles = containmentNeedlesOf(secrets);
-	if (needles.length === 0) return value;
-	const flattens = (leaf) => leaf !== "***" && embedsNeedleOutsideReferences(leaf, needles, secrets);
-	const walk = (node) => {
-		if (typeof node === "string") return flattens(node) ? "***" : node;
-		if (node === null || typeof node !== "object") return node;
-		if (Array.isArray(node)) {
-			let changed = false;
-			const out = node.map((item) => {
-				const next = walk(item);
-				if (next !== item) changed = true;
-				return next;
-			});
-			return changed ? out : node;
-		}
-		if (isOrdinaryDate(node)) {
-			const persisted = node.toJSON();
-			return typeof persisted === "string" && flattens(persisted) ? "***" : node;
-		}
-		let out;
-		for (const [key, child] of Object.entries(node)) {
-			const next = walk(child);
-			if (next === child) continue;
-			out ??= Object.assign(Object.create(null), node);
-			out[key] = next;
-		}
-		return out ?? node;
-	};
-	return walk(value);
-}
-function substringNeedlesOf(secrets) {
-	const needles = [];
-	for (const plaintext of secrets.keys()) if (!isMaskOnlyPlaintext(secrets, plaintext)) needles.push(plaintext);
-	return needles;
-}
-function recordedExpressionsOf(secrets) {
-	const expressions = /* @__PURE__ */ new Set();
-	for (const [plaintext, expression] of secrets) if (!isMaskOnlyPlaintext(secrets, plaintext)) expressions.add(expression);
-	return expressions;
-}
-const recoverableMaskedOutputs = /* @__PURE__ */ new Map();
-function maskedOutputKey(identity, stackName, region, outputKey) {
-	return `${identity}\u0000${stackName}\u0000${region}\u0000${outputKey}`;
-}
-function recordRecoverableMaskedOutput(identity, stackName, region, outputKey, plaintext) {
-	recoverableMaskedOutputs.set(maskedOutputKey(identity, stackName, region, outputKey), plaintext);
-}
-function recoverMaskedOutput(identity, stackName, region, outputKey) {
-	return recoverableMaskedOutputs.get(maskedOutputKey(identity, stackName, region, outputKey));
-}
-
 //#endregion
 //#region src/deployment/secret-redaction/redact-state.ts
 function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RULES) {
@@ -8023,161 +8230,6 @@ function hasMaskableValues(secrets) {
 	return logOnly !== void 0 && logOnly.size > 0;
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/nested-stack.ts
-const NESTED_STACK_RESOURCE_TYPE$4 = "AWS::CloudFormation::Stack";
-const nestedStackParameterExpressions = /* @__PURE__ */ new WeakMap();
-const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
-function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, rules = TEMPLATE_DERIVED_RULES) {
-	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$4) return;
-	if (secrets.size === 0) return;
-	if (!isPlainObject$4(resolvedProperties) || !isPlainObject$4(sourceProperties)) return;
-	if (!Object.hasOwn(resolvedProperties, "Parameters")) return;
-	if (!Object.hasOwn(sourceProperties, "Parameters")) return;
-	const resolvedParameters = resolvedProperties["Parameters"];
-	const sourceParameters = sourceProperties["Parameters"];
-	if (!isPlainObject$4(resolvedParameters) || !isPlainObject$4(sourceParameters)) return;
-	const positioned = redactSecretsForState(markSameGenerationBag({ ...resolvedParameters }), secrets, sourceParameters, rules);
-	let table = nestedStackParameterExpressions.get(secrets);
-	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
-		if (typeof resolvedValue !== "string" || !secrets.has(resolvedValue)) continue;
-		const expression = positioned[name];
-		if (typeof expression !== "string") continue;
-		if (!isSingleDynamicReferenceToken(expression)) continue;
-		const sourceLeaf = sourceParameters[name];
-		if (typeof sourceLeaf === "string" && expression !== sourceLeaf) continue;
-		if (expression === resolvedValue) continue;
-		const seenResolvingTo = plaintextIndexOf(secrets).get(expression);
-		if (seenResolvingTo !== void 0 && seenResolvingTo !== resolvedValue) continue;
-		if (typeof sourceLeaf === "string" && resolvedPlaintextOf(secrets, expression) !== resolvedValue) continue;
-		if (table === void 0) {
-			table = /* @__PURE__ */ new Map();
-			nestedStackParameterExpressions.set(secrets, table);
-		}
-		storeAssociation(table, name, expression, resolvedValue);
-	}
-	const framesByValue = /* @__PURE__ */ new Map();
-	const tokensOf = /* @__PURE__ */ new Map();
-	const frameSpellings = /* @__PURE__ */ new Map();
-	const frameSpellingOf = (name) => {
-		if (!frameSpellings.has(name)) frameSpellings.set(name, computeFrameSpelling(name));
-		return frameSpellings.get(name);
-	};
-	const computeFrameSpelling = (name) => {
-		const resolvedValue = resolvedParameters[name];
-		if (typeof resolvedValue !== "string") return void 0;
-		const sourceLeaf = sourceParameters[name];
-		if (typeof sourceLeaf === "string") return sourceLeaf;
-		if (!isPlainObject$4(sourceLeaf)) return void 0;
-		const written = positioned[name];
-		if (typeof written !== "string") return void 0;
-		const rendered = intrinsicSkeletonSegments(sourceLeaf)?.map((s) => s === UNKNOWN_PART ? "\0" : s).join("");
-		const spans = rendered === void 0 ? [] : dynamicReferenceSpans(rendered);
-		if (rendered !== void 0 && spans.length === 1) {
-			const [span] = spans;
-			const ownToken = rendered.slice(span.start, span.end);
-			if (written !== resolvedValue && SPELLED_SECRET_REFERENCE_PREFIXES.some((prefix) => ownToken.startsWith(prefix))) return written;
-		}
-		const substituted = substitutedSpellingOf(secrets, sourceLeaf, resolvedValue);
-		if (substituted === void 0) return void 0;
-		return written === resolvedValue || written === substituted ? substituted : void 0;
-	};
-	const certifiedSpellingOf = (name) => {
-		const sourceLeaf = sourceParameters[name];
-		if (typeof sourceLeaf === "string") return positioned[name] === sourceLeaf ? sourceLeaf : void 0;
-		return frameSpellingOf(name);
-	};
-	const unwrittenValues = /* @__PURE__ */ new Set();
-	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
-		if (typeof resolvedValue !== "string") continue;
-		const spelling = frameSpellingOf(name);
-		const frame = spelling === void 0 ? void 0 : singleSpanFrame(resolvedValue, spelling);
-		const frames = framesByValue.get(resolvedValue) ?? /* @__PURE__ */ new Set();
-		const unframed = frame === void 0 || resolvedPlaintextOf(secrets, frame.token) !== frame.middle;
-		frames.add(unframed ? UNFRAMED_SPELLING : `${frame.prefix.length}:${frame.prefix}${frame.suffix}`);
-		framesByValue.set(resolvedValue, frames);
-		if (!unframed) {
-			const tokens = tokensOf.get(resolvedValue) ?? /* @__PURE__ */ new Set();
-			tokens.add(frame.token);
-			tokensOf.set(resolvedValue, tokens);
-			if (typeof sourceParameters[name] !== "string" && positioned[name] !== spelling) unwrittenValues.add(resolvedValue);
-		}
-	}
-	for (const value of unwrittenValues) if (tokensOf.get(value)?.size !== 1) framesByValue.get(value)?.add(UNFRAMED_SPELLING);
-	const rowWithoutParameters = {};
-	for (const [key, value] of Object.entries(resolvedProperties)) if (key !== "Parameters") rowWithoutParameters[key] = value;
-	const outsideLeaves = wholeStringLeavesOf(rowWithoutParameters);
-	const framed = /* @__PURE__ */ new Map();
-	const framedByName = [];
-	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
-		if (typeof resolvedValue !== "string") continue;
-		const spelling = certifiedSpellingOf(name);
-		if (spelling === void 0) continue;
-		if (redactSecretsForState(resolvedValue, secrets) !== resolvedValue) continue;
-		const frame = singleSpanFrame(resolvedValue, spelling);
-		if (frame === void 0 || resolvedPlaintextOf(secrets, frame.token) !== frame.middle) continue;
-		if (framesByValue.get(resolvedValue)?.size !== 1) continue;
-		const isNeedle = resolvedValue.length >= 4;
-		const rewrites = (leaf) => leaf === resolvedValue || isNeedle && leaf.includes(resolvedValue);
-		let embedded = false;
-		for (const leaf of outsideLeaves) if (rewrites(leaf)) {
-			embedded = true;
-			break;
-		}
-		for (const other of Object.values(resolvedParameters)) {
-			if (embedded) break;
-			if (typeof other === "string") {
-				if (other !== resolvedValue && rewrites(other)) embedded = true;
-				continue;
-			}
-			for (const leaf of wholeStringLeavesOf(other)) if (rewrites(leaf)) {
-				embedded = true;
-				break;
-			}
-		}
-		if (embedded) continue;
-		framedByName.push([
-			name,
-			spelling,
-			resolvedValue
-		]);
-		if (secrets.get(frame.middle) !== frame.token && tokensOf.get(resolvedValue)?.size !== 1) continue;
-		framed.set(resolvedValue, spelling);
-	}
-	for (const [plaintext, expression] of framed) secrets.set(plaintext, expression);
-	for (const [name, expression, plaintext] of framedByName) {
-		if (table === void 0) {
-			table = /* @__PURE__ */ new Map();
-			nestedStackParameterExpressions.set(secrets, table);
-		}
-		storeAssociation(table, name, expression, plaintext);
-	}
-}
-function inheritNestedStackParameterAssociations(childSecrets, parentSecrets) {
-	const table = nestedStackParameterExpressions.get(parentSecrets);
-	if (table === void 0 || table.size === 0) return;
-	let associations = crossStackAssociations.get(childSecrets);
-	for (const [name, association] of table) {
-		const key = crossStackSourceKey({ Ref: name });
-		if (key === void 0) continue;
-		if (associations === void 0) {
-			associations = /* @__PURE__ */ new Map();
-			crossStackAssociations.set(childSecrets, associations);
-		}
-		if (typeof association === "symbol") {
-			associations.set(key, association);
-			continue;
-		}
-		storeAssociation(associations, key, association.expression, association.plaintext);
-	}
-}
-function inheritedParameterExpression(parentSecrets, parameterName, resolvedValue) {
-	const association = nestedStackParameterExpressions.get(parentSecrets)?.get(parameterName);
-	if (association === void 0 || typeof association === "symbol") return void 0;
-	if (Array.isArray(resolvedValue)) return certifiedListForLeaf(parentSecrets, association, resolvedValue);
-	return certifiedExpressionForLeaf(parentSecrets, association, resolvedValue);
-}
-
 //#endregion
 //#region src/deployment/secret-redaction/unresolved-token-frame.ts
 function liveMatchesUnresolvedTokenFrame(send, live, unresolvedTokens, secrets) {
@@ -17993,7 +18045,7 @@ async function resolveGetAtt(getAtt, context) {
 		const [rawLogicalId, rawAttributeName] = getAtt;
 		logicalId = rawLogicalId;
 		const resolvedAttributeName = await this.resolveValue(rawAttributeName, context);
-		if (typeof resolvedAttributeName !== "string") throw new Error(`Fn::GetAtt attribute name for ${this.displayMasked(logicalId, context)} must resolve to a string, got ${typeof resolvedAttributeName}: ${stringifyValue(this.maskValueLeaves(resolvedAttributeName, context))}`);
+		if (typeof resolvedAttributeName !== "string") throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetAtt attribute name for ${this.displayMasked(logicalId, context)} must resolve to a string, got ${typeof resolvedAttributeName}: ${stringifyValue(this.maskValueLeaves(resolvedAttributeName, context))}`));
 		attributeName = resolvedAttributeName;
 	} else {
 		const split = splitGetAttStringForm(getAtt);
@@ -18335,8 +18387,8 @@ function pinSecretVerdict(expression, secret, scope) {
 async function resolveImportValue(importValueArg, context) {
 	const sourceKey = crossStackSourceKey({ "Fn::ImportValue": importValueArg });
 	const exportName = await this.resolveValue(importValueArg, context);
-	if (typeof exportName !== "string") throw new Error(`Fn::ImportValue: export name must resolve to a string, got ${typeof exportName}`);
-	if (!context.stateBackend) throw new Error("Fn::ImportValue: state backend is required for cross-stack references");
+	if (typeof exportName !== "string") throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::ImportValue: export name must resolve to a string, got ${typeof exportName}`));
+	if (!context.stateBackend) throw markNonRetryable(/* @__PURE__ */ new Error("Fn::ImportValue: state backend is required for cross-stack references"));
 	const loggedExportName = this.displayMasked(exportName, context);
 	this.logger.debug(`Resolving Fn::ImportValue: ${loggedExportName}`);
 	if (context.exportIndex) {
@@ -18516,32 +18568,32 @@ function getCfnClient(region) {
 //#endregion
 //#region src/deployment/intrinsic-resolver/stack-output.ts
 async function resolveGetStackOutput(arg, context) {
-	if (!arg || typeof arg !== "object" || Array.isArray(arg)) throw new Error(`Fn::GetStackOutput: argument must be an object with StackName/OutputName/Region/RoleArn, got ${arg === null ? "null" : Array.isArray(arg) ? "array" : typeof arg}`);
+	if (!arg || typeof arg !== "object" || Array.isArray(arg)) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: argument must be an object with StackName/OutputName/Region/RoleArn, got ${arg === null ? "null" : Array.isArray(arg) ? "array" : typeof arg}`));
 	const args = arg;
-	if (!("StackName" in args)) throw new Error("Fn::GetStackOutput: StackName is required");
-	if (!("OutputName" in args)) throw new Error("Fn::GetStackOutput: OutputName is required");
+	if (!("StackName" in args)) throw markNonRetryable(/* @__PURE__ */ new Error("Fn::GetStackOutput: StackName is required"));
+	if (!("OutputName" in args)) throw markNonRetryable(/* @__PURE__ */ new Error("Fn::GetStackOutput: OutputName is required"));
 	const sourceKey = crossStackSourceKey({ "Fn::GetStackOutput": args });
 	const stackName = await this.resolveValue(args["StackName"], context);
-	if (typeof stackName !== "string" || stackName === "") throw new Error(`Fn::GetStackOutput: StackName must resolve to a non-empty string, got ${typeof stackName}`);
+	if (typeof stackName !== "string" || stackName === "") throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: StackName must resolve to a non-empty string, got ${typeof stackName}`));
 	const outputName = await this.resolveValue(args["OutputName"], context);
-	if (typeof outputName !== "string" || outputName === "") throw new Error(`Fn::GetStackOutput: OutputName must resolve to a non-empty string, got ${typeof outputName}`);
+	if (typeof outputName !== "string" || outputName === "") throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: OutputName must resolve to a non-empty string, got ${typeof outputName}`));
 	let region = this.resolverRegion;
 	let loggedRegionText = this.logTextOfLeaf(region, context);
 	if ("Region" in args && args["Region"] !== void 0 && args["Region"] !== null) {
 		const resolvedRegion = await this.resolveValue(args["Region"], context);
-		if (typeof resolvedRegion !== "string" || resolvedRegion === "") throw new Error(`Fn::GetStackOutput: Region must resolve to a non-empty string, got ${typeof resolvedRegion}`);
+		if (typeof resolvedRegion !== "string" || resolvedRegion === "") throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: Region must resolve to a non-empty string, got ${typeof resolvedRegion}`));
 		const requestedRegion = canonicalizeRegion(resolvedRegion);
-		if (!isClientSafeRegion(requestedRegion)) throw new Error(`Fn::GetStackOutput: ${this.displayMaskedIdent(this.logTextOfLeaf(resolvedRegion, context) !== resolvedRegion ? "***" : resolvedRegion, context, 64)} is not a valid AWS region name. The region selects both the AWS endpoint and the state-file key, so cdkd will not use it.`);
+		if (!isClientSafeRegion(requestedRegion)) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: ${this.displayMaskedIdent(this.logTextOfLeaf(resolvedRegion, context) !== resolvedRegion ? "***" : resolvedRegion, context, 64)} is not a valid AWS region name. The region selects both the AWS endpoint and the state-file key, so cdkd will not use it.`));
 		region = requestedRegion;
 		loggedRegionText = this.regionLogText(resolvedRegion, context);
 	}
 	let roleArn;
 	if ("RoleArn" in args && args["RoleArn"] !== void 0 && args["RoleArn"] !== null) {
 		const raw = args["RoleArn"];
-		if (typeof raw !== "string" || raw === "") throw new Error(`Fn::GetStackOutput: RoleArn must be a literal string in the template (no Ref / Fn::GetAtt / Fn::Sub allowed for cross-account references). Got ${raw === null ? "null" : Array.isArray(raw) ? "array" : typeof raw}${typeof raw === "object" ? ` (intrinsic shape: ${this.displayMasked(JSON.stringify(raw).slice(0, 80), context)})` : ""}.`);
+		if (typeof raw !== "string" || raw === "") throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: RoleArn must be a literal string in the template (no Ref / Fn::GetAtt / Fn::Sub allowed for cross-account references). Got ${raw === null ? "null" : Array.isArray(raw) ? "array" : typeof raw}${typeof raw === "object" ? ` (intrinsic shape: ${this.displayMasked(JSON.stringify(raw).slice(0, 80), context)})` : ""}.`));
 		roleArn = raw;
 	}
-	if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw new Error(`Fn::GetStackOutput: cannot reference own stack ${this.displayMaskedIdent(stackName, context, STACK_REF_MAX_CODE_POINTS)} in the same region ${this.displayMaskedIdent(loggedRegionText, context)}`);
+	if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: cannot reference own stack ${this.displayMaskedIdent(stackName, context, STACK_REF_MAX_CODE_POINTS)} in the same region ${this.displayMaskedIdent(loggedRegionText, context)}`));
 	const loggedStackName = this.displayMaskedIdent(stackName, context, STACK_REF_MAX_CODE_POINTS);
 	const loggedOutputName = this.displayMaskedIdent(outputName, context);
 	const loggedRegion = this.displayMasked(loggedRegionText, context);
@@ -18559,7 +18611,7 @@ async function resolveGetStackOutput(arg, context) {
 			if (cfnOutputs) {
 				if (!Object.hasOwn(cfnOutputs, outputName)) {
 					const available = this.describeAvailableOutputs(Object.keys(cfnOutputs), context);
-					throw new Error(`Fn::GetStackOutput: output ${loggedOutputName} not found in CloudFormation stack ${loggedStackName} (${displayIdent(loggedRegion)}). Available outputs: ${available}`);
+					throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: output ${loggedOutputName} not found in CloudFormation stack ${loggedStackName} (${displayIdent(loggedRegion)}). Available outputs: ${available}`));
 				}
 				const value = cfnOutputs[outputName];
 				this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName} (from CloudFormation stack outputs; weak reference — producer is not cdkd-managed)`);
@@ -18572,7 +18624,7 @@ async function resolveGetStackOutput(arg, context) {
 	const outputs = stateData.state.outputs ?? {};
 	if (!Object.hasOwn(outputs, outputName)) {
 		const available = this.describeAvailableOutputs(Object.keys(outputs), context);
-		throw new Error(`Fn::GetStackOutput: output ${loggedOutputName} not found in stack ${loggedStackName} (${displayIdent(loggedRegion)}). Available outputs: ${available}`);
+		throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: output ${loggedOutputName} not found in stack ${loggedStackName} (${displayIdent(loggedRegion)}). Available outputs: ${available}`));
 	}
 	const value = outputs[outputName];
 	this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${shownRoleArn}` : ""} (${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
@@ -18825,7 +18877,7 @@ async function applyRoleArnIfSet(opts) {
 //#endregion
 //#region src/deployment/intrinsic-resolver/stack-state.ts
 async function getSameAccountStackState(stackName, region, context) {
-	if (!context.stateBackend) throw new Error("Fn::GetStackOutput: state backend is required for cross-stack references");
+	if (!context.stateBackend) throw markNonRetryable(/* @__PURE__ */ new Error("Fn::GetStackOutput: state backend is required for cross-stack references"));
 	return context.stateBackend.getState(stackName, region);
 }
 async function getCrossAccountStackState(roleArn, stackName, region, context) {
@@ -18834,7 +18886,7 @@ async function getCrossAccountStackState(roleArn, stackName, region, context) {
 		const shownRoleArn = displayIdent(roleArn, { maxCodePoints: 613 });
 		const bounded = !/\s/.test(roleArn) && shownRoleArn === roleArn ? `'${shownRoleArn}'` : shellBoundedDisplay(shownRoleArn);
 		const subject = bounded === "a value that cannot be shown safely here" ? `the RoleArn argument (${UNSHOWABLE_VALUE})` : `RoleArn ${bounded}`;
-		throw new Error(`Fn::GetStackOutput: ${subject} is not a valid IAM role ARN. Expected shape: arn:<partition>:iam::<12-digit-account-id>:role/<role-name> (e.g. arn:aws:iam::123456789012:role/MyRole, arn:aws-us-gov:iam::...).`);
+		throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: ${subject} is not a valid IAM role ARN. Expected shape: arn:<partition>:iam::<12-digit-account-id>:role/<role-name> (e.g. arn:aws:iam::123456789012:role/MyRole, arn:aws-us-gov:iam::...).`));
 	}
 	const credentials = await assumeRoleForCrossAccountStateRead(roleArn);
 	const { bucket, region: bucketRegion } = await resolveCrossAccountStateBucket(parsed.accountId, credentials);
@@ -19139,7 +19191,7 @@ async function resolveSecretsManagerReference(inner, context, nameLogText) {
 		versionId = remainingParts[2] || "";
 	} else secretId = afterService;
 	if (!versionStage) versionStage = "AWSCURRENT";
-	if (!secretId) throw new Error("Dynamic reference: secretsmanager SECRET_ID is required");
+	if (!secretId) throw markNonRetryable(/* @__PURE__ */ new Error("Dynamic reference: secretsmanager SECRET_ID is required"));
 	const loggedSecretId = this.displayMasked(nameLogText(secretId), context);
 	const loggedJsonKey = this.displayMasked(nameLogText(jsonKey), context);
 	this.logger.debug(`Resolving dynamic reference: secretsmanager:${loggedSecretId}:SecretString:${loggedJsonKey}:${this.displayMasked(nameLogText(versionStage), context)}:${this.displayMasked(nameLogText(versionId), context)}`);
@@ -19154,14 +19206,14 @@ async function resolveSecretsManagerReference(inner, context, nameLogText) {
 		[versionStage, this.displayMasked(nameLogText(versionStage), context)],
 		[versionId, this.displayMasked(nameLogText(versionId), context)]
 	], context))).SecretString;
-	if (!secretString) throw new Error(`Dynamic reference: secret ${quotedRender(loggedSecretId, "'")} does not contain a SecretString value`);
+	if (!secretString) throw markNonRetryable(/* @__PURE__ */ new Error(`Dynamic reference: secret ${quotedRender(loggedSecretId, "'")} does not contain a SecretString value`));
 	if (jsonKey) try {
 		const parsed = JSON.parse(secretString);
 		const keyValue = Object.hasOwn(parsed, jsonKey) ? parsed[jsonKey] : void 0;
-		if (keyValue === void 0) throw new Error(`Dynamic reference: key ${quotedRender(loggedJsonKey, "'")} not found in secret ${quotedRender(loggedSecretId, "'")}`);
+		if (keyValue === void 0) throw markNonRetryable(/* @__PURE__ */ new Error(`Dynamic reference: key ${quotedRender(loggedJsonKey, "'")} not found in secret ${quotedRender(loggedSecretId, "'")}`));
 		return stringifyValue(keyValue);
 	} catch (error) {
-		if (error instanceof SyntaxError) throw new Error(`Dynamic reference: secret ${quotedRender(loggedSecretId, "'")} is not valid JSON but JSON_KEY ${quotedRender(loggedJsonKey, "'")} was specified`);
+		if (error instanceof SyntaxError) throw markNonRetryable(/* @__PURE__ */ new Error(`Dynamic reference: secret ${quotedRender(loggedSecretId, "'")} is not valid JSON but JSON_KEY ${quotedRender(loggedJsonKey, "'")} was specified`));
 		throw error;
 	}
 	return secretString;
@@ -19180,7 +19232,7 @@ async function sendWithThrottleRetry(operation, label, masks) {
 }
 async function resolveSSMReference(parts, decrypt, service, context, nameLogText) {
 	const parameterName = parts.slice(1).join(":");
-	if (!parameterName) throw new Error(`Dynamic reference: ${service} PARAMETER_NAME is required`);
+	if (!parameterName) throw markNonRetryable(/* @__PURE__ */ new Error(`Dynamic reference: ${service} PARAMETER_NAME is required`));
 	const loggedParameterName = this.displayMasked(nameLogText(parameterName), context);
 	this.logger.debug(`Resolving dynamic reference: ${service}:${loggedParameterName}`);
 	const client = this.clientsForRegion(this.explicitRegion).ssm;
@@ -19190,7 +19242,7 @@ async function resolveSSMReference(parts, decrypt, service, context, nameLogText
 	});
 	const response = await this.sendWithThrottleRetry(() => client.send(command), `${service}:${loggedParameterName}`, this.namedRequestMasks([[parameterName, loggedParameterName]], context));
 	const paramValue = response.Parameter?.Value;
-	if (paramValue === void 0 || paramValue === null) throw new Error(`Dynamic reference: SSM parameter ${quotedRender(loggedParameterName, "'")} not found or has no value`);
+	if (paramValue === void 0 || paramValue === null) throw markNonRetryable(/* @__PURE__ */ new Error(`Dynamic reference: SSM parameter ${quotedRender(loggedParameterName, "'")} not found or has no value`));
 	const paramType = response.Parameter?.Type;
 	const secure = paramType !== "String" && paramType !== "StringList";
 	if (secure && paramType !== "SecureString" && !this.warnedUnrecognizedSsmTypes.has(injectiveKey(parameterName, String(paramType)))) {
@@ -19234,7 +19286,7 @@ async function resolveJoin(joinArgs, context, source) {
 	const [delimiter, rawValues] = joinArgs;
 	let values = rawValues;
 	if (!Array.isArray(values)) values = await this.resolveValue(values, context);
-	if (!Array.isArray(values)) throw new Error(`Fn::Join's second argument must be a list (an array literal or a list-returning intrinsic such as Fn::Cidr / Fn::GetAZs / Fn::Split / a Ref to a list-typed parameter — any List<...> type or CommaDelimitedList), but resolved to ${typeof values}`);
+	if (!Array.isArray(values)) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::Join's second argument must be a list (an array literal or a list-returning intrinsic such as Fn::Cidr / Fn::GetAZs / Fn::Split / a Ref to a list-typed parameter — any List<...> type or CommaDelimitedList), but resolved to ${typeof values}`));
 	const literalList = Array.isArray(rawValues);
 	const resolvedParts = await allSettledKeepingFirstRejection(() => values.map(async (v) => {
 		if (typeof v === "string") {
@@ -19317,7 +19369,7 @@ async function resolveSelect(selectArgs, context) {
 		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Select: the index${sourceClause} must resolve to a non-negative integer (a number, or its decimal string with no leading zero), got ${this.describeOperandShape(resolvedIndex, context)}. Use a literal, a Ref to a parameter or an Fn::FindInMap that yields one.`));
 	}
 	const resolvedList = await this.resolveValue(list, context);
-	if (!Array.isArray(resolvedList)) throw new Error(`Fn::Select: list must be an array, got ${typeof resolvedList}`);
+	if (!Array.isArray(resolvedList)) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::Select: list must be an array, got ${typeof resolvedList}`));
 	const loggedPosition = this.displayMasked(String(position), context);
 	if (position >= resolvedList.length) {
 		if (loggedPosition !== String(position)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Select: the index ${loggedPosition} is out of bounds (array length: ${resolvedList.length}), and it resolves from a secret value, so cdkd will not write it into the OutOfBounds placeholder.`));
@@ -19653,7 +19705,7 @@ async function resolveConditionReference(conditionName, context) {
 	return false;
 }
 async function resolveAnd(conditions, context) {
-	if (!Array.isArray(conditions) || conditions.length < 2 || conditions.length > 10) throw new Error(`Fn::And requires between 2 and 10 conditions, got ${conditions.length}`);
+	if (!Array.isArray(conditions) || conditions.length < 2 || conditions.length > 10) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::And requires between 2 and 10 conditions, got ${conditions.length}`));
 	const results = [];
 	for (const condition of conditions) {
 		const resolved = await this.resolveValue(condition, context);
@@ -19664,7 +19716,7 @@ async function resolveAnd(conditions, context) {
 	return result;
 }
 async function resolveOr(conditions, context) {
-	if (!Array.isArray(conditions) || conditions.length < 2 || conditions.length > 10) throw new Error(`Fn::Or requires between 2 and 10 conditions, got ${conditions.length}`);
+	if (!Array.isArray(conditions) || conditions.length < 2 || conditions.length > 10) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::Or requires between 2 and 10 conditions, got ${conditions.length}`));
 	const results = [];
 	for (const condition of conditions) {
 		const resolved = await this.resolveValue(condition, context);
@@ -19675,7 +19727,7 @@ async function resolveOr(conditions, context) {
 	return result;
 }
 async function resolveNot(notArgs, context) {
-	if (!Array.isArray(notArgs) || notArgs.length !== 1) throw new Error(`Fn::Not requires exactly one condition, got ${Array.isArray(notArgs) ? notArgs.length : 0}`);
+	if (!Array.isArray(notArgs) || notArgs.length !== 1) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::Not requires exactly one condition, got ${Array.isArray(notArgs) ? notArgs.length : 0}`));
 	const [condition] = notArgs;
 	const resolved = await this.resolveValue(condition, context);
 	const result = !resolved;
@@ -19693,20 +19745,20 @@ async function resolveFindInMap(findInMapArgs, context) {
 	const map = mappings != null && Object.hasOwn(mappings, mapName) ? mappings[mapName] : void 0;
 	if (!mappings) {
 		if (hasDefaultValue) return await resolveDefault();
-		throw new Error(`Fn::FindInMap: no Mappings section found in template`);
+		throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::FindInMap: no Mappings section found in template`));
 	}
 	if (!map) {
 		if (hasDefaultValue) return await resolveDefault();
-		throw new Error(`Fn::FindInMap: mapping ${quotedRender(this.displayMasked(mapName, context), "'")} not found in Mappings section`);
+		throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::FindInMap: mapping ${quotedRender(this.displayMasked(mapName, context), "'")} not found in Mappings section`));
 	}
 	const topLevel = Object.hasOwn(map, topLevelKey) ? map[topLevelKey] : void 0;
 	if (!topLevel || typeof topLevel !== "object") {
 		if (hasDefaultValue) return await resolveDefault();
-		throw new Error(`Fn::FindInMap: top-level key ${quotedRender(this.displayMasked(topLevelKey, context), "'")} not found in mapping ${quotedRender(this.displayMasked(mapName, context), "'")}`);
+		throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::FindInMap: top-level key ${quotedRender(this.displayMasked(topLevelKey, context), "'")} not found in mapping ${quotedRender(this.displayMasked(mapName, context), "'")}`));
 	}
 	if (!Object.hasOwn(topLevel, secondLevelKey)) {
 		if (hasDefaultValue) return await resolveDefault();
-		throw new Error(`Fn::FindInMap: second-level key ${quotedRender(this.displayMasked(secondLevelKey, context), "'")} not found in mapping ${quotedRender(this.displayMasked(mapName, context), "'")} under top-level key ${quotedRender(this.displayMasked(topLevelKey, context), "'")}`);
+		throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::FindInMap: second-level key ${quotedRender(this.displayMasked(secondLevelKey, context), "'")} not found in mapping ${quotedRender(this.displayMasked(mapName, context), "'")} under top-level key ${quotedRender(this.displayMasked(topLevelKey, context), "'")}`));
 	}
 	const result = topLevel[secondLevelKey];
 	this.logger.debug(`Resolved Fn::FindInMap: ${this.logRender(mapName, context)}.${this.logRender(topLevelKey, context)}.${this.logRender(secondLevelKey, context)} resolved to ${this.logRender(JSON.stringify(this.maskValueLeaves(result, context)), context, { structured: true })}`);
@@ -19714,7 +19766,7 @@ async function resolveFindInMap(findInMapArgs, context) {
 }
 async function resolveBase64(value, context) {
 	const resolvedValue = await this.resolveValue(value, context);
-	if (typeof resolvedValue !== "string") throw new Error(`Fn::Base64: value must resolve to a string, got ${typeof resolvedValue}`);
+	if (typeof resolvedValue !== "string") throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::Base64: value must resolve to a string, got ${typeof resolvedValue}`));
 	if (context.skipDynamicReferences === true && keepsSecretReferenceToken(resolvedValue) && !(context.recordedSecretValues !== void 0 && embedsFreshNoEchoValue(resolvedValue, context.recordedSecretValues))) {
 		this.logger.debug(safeMsg`Resolved Fn::Base64: ${this.logRender(this.logTextOfLeaf(resolvedValue, context), context)} resolved to ${"***"} (an unresolved secret reference, compared as the mask the deploy persists)`);
 		return "***";
@@ -19742,7 +19794,7 @@ async function resolveGetAZs(value, context) {
 	let loggedRegionText;
 	if (typeof resolvedValue === "string" && resolvedValue !== "") {
 		const requested = canonicalizeRegion(resolvedValue);
-		if (!isClientSafeRegion(requested)) throw new Error(`Fn::GetAZs: the value ${quotedRender(this.displayMasked(this.logTextOfLeaf(resolvedValue, context) !== resolvedValue ? "***" : resolvedValue, context).slice(0, 64), "'")} is not a valid AWS region name. A region is substituted into the AWS service hostname, so cdkd will not build a client from it.`);
+		if (!isClientSafeRegion(requested)) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetAZs: the value ${quotedRender(this.displayMasked(this.logTextOfLeaf(resolvedValue, context) !== resolvedValue ? "***" : resolvedValue, context).slice(0, 64), "'")} is not a valid AWS region name. A region is substituted into the AWS service hostname, so cdkd will not build a client from it.`));
 		region = requested;
 		clientRegion = requested;
 		loggedRegionText = this.regionLogText(resolvedValue, context);
@@ -19771,7 +19823,7 @@ async function resolveGetAZs(value, context) {
 		const masks = this.namedRequestMasks([[region, loggedRegion]], context);
 		throw new Error(`Fn::GetAZs: failed to describe availability zones for region ${quotedRender(loggedRegion, "'")}: ${masks.text(error instanceof Error ? error.message : String(error))}`);
 	}
-	if (azNames.length === 0) throw new Error(`Fn::GetAZs: no availability zones returned for region ${quotedRender(this.displayMasked(loggedRegionText ?? region, context), "'")}. Either the region is not enabled on this account (opt-in regions must be enabled before use), or the request was answered by a different region's endpoint.`);
+	if (azNames.length === 0) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetAZs: no availability zones returned for region ${quotedRender(this.displayMasked(loggedRegionText ?? region, context), "'")}. Either the region is not enabled on this account (opt-in regions must be enabled before use), or the request was answered by a different region's endpoint.`));
 	cachedAvailabilityZones.set(azCacheKey, azNames);
 	this.logger.debug(`Resolved Fn::GetAZs: ${this.logRender(loggedRegionText ?? region, context)} resolved to ${this.logRender(JSON.stringify(this.maskValueLeaves(azNames, context)), context, { structured: true })}`);
 	return azNames;
@@ -19797,7 +19849,7 @@ async function resolveCidr(args, context) {
 	const ipBlock = await this.resolveValue(rawIpBlock, context);
 	const count = Number(await this.resolveValue(rawCount, context));
 	const cidrBits = Number(await this.resolveValue(rawCidrBits, context));
-	if (!ipBlock || typeof ipBlock !== "string") throw new Error(`Fn::Cidr: ipBlock must be a string, got ${typeof ipBlock}: ${JSON.stringify(this.maskValueLeaves(ipBlock, context))}`);
+	if (!ipBlock || typeof ipBlock !== "string") throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::Cidr: ipBlock must be a string, got ${typeof ipBlock}: ${JSON.stringify(this.maskValueLeaves(ipBlock, context))}`));
 	this.logger.debug(`Resolving Fn::Cidr: ipBlock=${this.displayMasked(JSON.stringify(this.maskValueLeaves(ipBlock, context)), context)}, count=${this.displayMasked(String(count), context)}, cidrBits=${this.displayMasked(String(cidrBits), context)}`);
 	const isIpv6 = ipBlock.includes(":");
 	const results = [];
@@ -20095,7 +20147,7 @@ async function resolveParameters(template, userParameters, options) {
 	let referencedNames;
 	for (const [name, definition] of Object.entries(templateParameters)) {
 		const paramDef = definition;
-		if (isUnboundTemplateParameter(name, template, userParameters)) throw new Error(`Parameter ${maskInherited(name)} is required but no value was provided and no default exists`);
+		if (isUnboundTemplateParameter(name, template, userParameters)) throw markNonRetryable(/* @__PURE__ */ new Error(`Parameter ${maskInherited(name)} is required but no value was provided and no default exists`));
 		if (userParameters && Object.hasOwn(userParameters, name)) {
 			const userValue = userParameters[name];
 			if (userValue !== void 0) {
@@ -20197,6 +20249,7 @@ function recordInheritedParameterSecrets(parameterName, value, context) {
 	for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) {
 		const own = inheritedParameterExpression(inherited, parameterName, plaintext);
 		recorded.set(plaintext, typeof own === "string" ? own : expression);
+		recordInheritedParameterRead(recorded, inherited, parameterName);
 		carryFreshNoEchoMark(inherited, recorded, plaintext);
 	}
 }
@@ -20420,7 +20473,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if ("Fn::GetAZs" in obj) return await this.resolveGetAZs(obj["Fn::GetAZs"], context);
 		if ("Fn::Cidr" in obj) return await this.resolveCidr(obj["Fn::Cidr"], context);
 		const unknownIntrinsicKey = detectUnknownIntrinsicKey(obj);
-		if (unknownIntrinsicKey !== void 0) throw buildUnknownIntrinsicError(unknownIntrinsicKey);
+		if (unknownIntrinsicKey !== void 0) throw markNonRetryable(buildUnknownIntrinsicError(unknownIntrinsicKey));
 		const resolved = {};
 		for (const [key, val] of Object.entries(obj)) {
 			const resolvedVal = context.abandonedResolutions === void 0 ? await this.resolveValue(val, context) : await this.resolveKeyUnit(key, val, context, context.abandonedResolutions);
@@ -22050,7 +22103,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-C1TlpooI.js");
+			const { ASGProvider } = await import("./asg-provider-BU0YONBp.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -22156,7 +22209,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-DeGFzOUc.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CvY6ekmg.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-Cf5P2so_.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-C3f-vDOh.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -27827,6 +27880,24 @@ function recordRollbackSkip(scope, op, reason) {
 		reason: scope.mask(reason)
 	});
 }
+function rollbackCannotAddress(record, opResourceType, route, physicalId) {
+	return !(record?.resourceType === "AWS::CloudFormation::Stack" && opResourceType === "AWS::CloudFormation::Stack" && record.provisionedBy !== "cc-api" && route !== "cc-api") && !hasAddressablePhysicalId({ physicalId });
+}
+function retainedSurvivorId(record, op) {
+	if (hasAddressablePhysicalId(record)) return record.physicalId;
+	if (hasAddressablePhysicalId(op)) return op.physicalId;
+}
+const UNADDRESSABLE_SKIP_CAUSE = "Its recorded 'physicalId' is not a non-empty string, so cdkd cannot address the resource in AWS and sent nothing for it; the rollback left it and its state record exactly as they are.";
+const UNADDRESSABLE_JOURNAL_SKIP_CAUSE = "Its rollback-journal entry's 'physicalId' is not a non-empty string and no state record holds the resource, so cdkd cannot address it in AWS and sent nothing for it; if it was created in AWS, delete it manually.";
+function skipUnaddressableReplay(scope, logger, op, what, source = "record") {
+	if (source === "journal") {
+		logger.warn(safeMsg`  Rollback: Cannot ${what} ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}) ` + "— its rollback journal entry has no non-empty string 'physicalId' and no state record holds it, so cdkd cannot address it in AWS and sent nothing for it. If it was created in AWS, delete it manually.");
+		recordRollbackSkip(scope, op, UNADDRESSABLE_JOURNAL_SKIP_CAUSE);
+		return;
+	}
+	logger.warn(safeMsg`  Rollback: Cannot ${what} ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}) ` + "— its state record has no non-empty string 'physicalId', so cdkd cannot address it in AWS and sent nothing for it. The resource and its state record are left exactly as they are. Repair the record's 'physicalId' (inspect it with `cdkd state show`), then re-converge it with `cdkd deploy`.");
+	recordRollbackSkip(scope, op, UNADDRESSABLE_SKIP_CAUSE);
+}
 function effectiveProvisionedBy(record, fallbackProvisionedBy) {
 	return record?.provisionedBy ?? fallbackProvisionedBy;
 }
@@ -28565,6 +28636,15 @@ function classifyRollbackOp(op, stateResources, orphanLogicalIds) {
 			oldProperties: op.previousState.properties,
 			newProperties: current.properties
 		})) return "skip-already-done";
+		const retainedOld = op.oldResourceRetained ?? op.previousState.updateReplacePolicy === "Retain";
+		if (rollbackCannotAddress(current, op.resourceType, current.provisionedBy ?? op.provisionedBy, current.physicalId)) {
+			if (!resolveReplacementOldType(op).ok) return "refuse-replacement-routing";
+			return retainedOld ? "reverse-replacement-readopt" : "reverse-replacement";
+		}
+		if (retainedOld && op.physicalId !== void 0 && !hasAddressablePhysicalId(op)) {
+			if (!resolveReplacementOldType(op).ok) return "refuse-replacement-routing";
+			return "reverse-replacement-readopt";
+		}
 		if (op.physicalId !== void 0 && current.physicalId !== op.physicalId) {
 			if (sameTypeAsOld && deepEqual$1(current.properties, op.previousState.properties)) return "skip-already-done";
 			return "skip-mismatch";
@@ -28584,7 +28664,7 @@ function classifyFailedOp(op, stateResources, siblings = []) {
 		if (op.physicalIdRecoveredFromError === true) {
 			if (current) {
 				if (current.physicalId === op.physicalId) return "skip-failed-noop";
-				if (!isReplacedRecord(op, current)) return "skip-failed-mismatch";
+				if (!isReplacedRecord(op, current) && !isProvenDistinctRecord(op, current)) return "skip-failed-mismatch";
 			}
 			if (stateHoldsPhysicalId(stateResources, op.resourceType, op.physicalId)) return "skip-failed-noop";
 			const orphanPolicy = effectiveDeletionPolicy(op.resourceType, op.deletionPolicy, op.attemptedProperties);
@@ -28611,7 +28691,21 @@ function isReplacedRecord(op, record) {
 	return isReplacementOrphan(op) && record !== void 0 && record.physicalId === op.replacedPhysicalId && record.resourceType === op.replacedResourceType;
 }
 function failedOpOwnRecord(op, stateResources) {
-	return isReplacementOrphan(op) ? void 0 : stateResources[op.logicalId];
+	return recordUnderIdIsNotOwn(op, stateResources) ? void 0 : stateResources[op.logicalId];
+}
+const provenDistinctFrom = /* @__PURE__ */ new WeakMap();
+function markProvenDistinctFromRecord(op, record) {
+	provenDistinctFrom.set(op, {
+		physicalId: record.physicalId,
+		resourceType: record.resourceType
+	});
+}
+function isProvenDistinctRecord(op, record) {
+	const verdict = provenDistinctFrom.get(op);
+	return verdict !== void 0 && record !== void 0 && record.physicalId === verdict.physicalId && record.resourceType === verdict.resourceType;
+}
+function recordUnderIdIsNotOwn(op, stateResources) {
+	return isReplacementOrphan(op) || isProvenDistinctRecord(op, Object.hasOwn(stateResources, op.logicalId) ? stateResources[op.logicalId] : void 0);
 }
 function replacementNeverSwapped(op, siblings) {
 	return siblings.some((s) => s !== op && isReplacementOrphan(s) && s.logicalId === op.logicalId && s.replacedPhysicalId === op.physicalId);
@@ -28892,6 +28986,10 @@ async function replayDelete(s) {
 		return;
 	}
 	const deleteProvisionedBy = effectiveProvisionedBy(stateResources[op.logicalId], op.provisionedBy);
+	if (rollbackCannotAddress(stateResources[op.logicalId], op.resourceType, deleteProvisionedBy, op.physicalId)) {
+		skipUnaddressableReplay(s, logger, op, "delete created resource");
+		return;
+	}
 	s.createRollbackRoute = deleteProvisionedBy;
 	const snapshotPolicy = action === "delete-with-final-snapshot";
 	const takeFinalSnapshot = snapshotPolicy && ctx.skipFinalSnapshot !== true;
@@ -28937,10 +29035,24 @@ async function replayReadopt(s) {
 	const { op, stateResources, stackName, ctx, result, inlinePolicyWriters, afterOp, logger, mask } = s;
 	const current = stateResources[op.logicalId];
 	const prev = op.previousState;
+	const oldShown = hasAddressablePhysicalId({ physicalId: prev.physicalId }) ? displaySafe(mask(prev.physicalId)) : "no recorded id";
+	const unprovenCopyRefusal = (reason) => {
+		const remedy = orphanRemedy(op.logicalId, ctx);
+		return ownRemedyError(markNonRetryable(new CdkdError(safeMsg`Cannot reverse the replacement of ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}): ` + reason + ` The retained old resource (${oldShown}) is named only by the rollback journal, so the JOURNAL is kept. Check both resources by hand.` + (remedy.offered ? ` To leave this one as it is, re-run ${rerunRollbackPhrase(ctx, "`cdkd rollback`")} with the command below; that also drops the journal's only record of the retained old resource (${oldShown}), so note that id first.` : ` No repair of the state record makes this op succeed on a re-run.`) + remedy.clause + remedy.line, STATE_RESOURCES_MALFORMED)));
+	};
+	const opIdUnusable = op.physicalId !== void 0 && !hasAddressablePhysicalId(op);
+	if (!rollbackRetainsNewResource(current) && rollbackCannotAddress(current, op.resourceType, current.provisionedBy ?? op.provisionedBy, current.physicalId)) {
+		if (opIdUnusable) throw unprovenCopyRefusal("neither its state record nor its rollback journal entry has a non-empty string 'physicalId' for the replacement's new resource, so cdkd cannot address that resource in AWS or tell which resource it is, and sent nothing.");
+		const target = op.physicalId === void 0 ? void 0 : refusalPhysicalId(mask(String(op.physicalId)));
+		const repair = target === void 0 ? `Repair the record's 'physicalId' to the id of the replacement's NEW resource (inspect it with \`cdkd state show\`): the journal does not record that id, and the re-run DELETES the resource the repaired record names as the new copy, so name the right one. Then re-run ${rerunRollbackPhrase(ctx, "`cdkd rollback`")}.` : `Repair the record's 'physicalId' to ${target}, the replacement's new resource the journal records (inspect it with \`cdkd state show\`); the re-run deletes it and re-adopts the old one. Any other id stops the revert and drops the journal's only record of the retained old resource (${oldShown}). Then re-run ${rerunRollbackPhrase(ctx, "`cdkd rollback`")}.` + (describedPhysicalIdPointer(target) !== "" ? " That id is left out of the prose above: it is not a plain identifier — read it from the rollback journal." : target.includes("***") ? ` That id is shown masked — read the full value from the rollback journal.` : "");
+		throw new CdkdError(safeMsg`Cannot reverse the replacement of ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}): ` + `its state record has no non-empty string 'physicalId', so cdkd cannot address the new resource in AWS to delete it, and sent nothing. The retained old resource (${oldShown}) is named only by the rollback journal, so the JOURNAL is kept. ` + repair, STATE_RESOURCES_MALFORMED);
+	}
+	if (!rollbackRetainsNewResource(current) && opIdUnusable && current.physicalId !== op.physicalId) throw unprovenCopyRefusal("its rollback journal entry has no non-empty string 'physicalId' for the replacement's new resource, so cdkd cannot tell whether the resource state records under this id is that one, and did not delete it; nothing was sent.");
 	logger.info(`  Rollback: Reversing replacement of ${safe(op.logicalId)} (${safe(op.resourceType)}) — deleting the new resource and re-adopting the retained old one (${displaySafe(mask(prev.physicalId))})`);
 	let survivorReason;
+	const survivorId = retainedSurvivorId(current, op);
 	if (rollbackRetainsNewResource(current)) {
-		const survivorMessages = retainedSurvivorMessages(op.logicalId, op.resourceType, current.physicalId, `State is restored to the old resource (${prev.physicalId}).`, mask);
+		const survivorMessages = retainedSurvivorMessages(op.logicalId, op.resourceType, survivorId ?? "no recorded id", `State is restored to the old resource (${prev.physicalId}).`, mask);
 		logger.warn(survivorMessages.warn);
 		survivorReason = survivorMessages.reason;
 		result.warnings++;
@@ -28978,7 +29090,7 @@ async function replayReadopt(s) {
 		resourceType: op.resourceType,
 		...op.provisionedBy && { provisionedBy: op.provisionedBy },
 		...survivorReason !== void 0 && {
-			physicalId: current.physicalId,
+			...survivorId !== void 0 && { physicalId: survivorId },
 			reason: mask(survivorReason),
 			...survivorProvisionedBy && { provisionedBy: survivorProvisionedBy }
 		}
@@ -29007,6 +29119,10 @@ async function replayRevert(s) {
 		recordRollbackSkip(s, op, ABSENT_BASELINE_SKIP_CAUSE);
 		return;
 	}
+	if (rollbackCannotAddress(current, op.resourceType, op.provisionedBy, current.physicalId)) {
+		skipUnaddressableReplay(s, logger, op, "restore");
+		return;
+	}
 	logger.info(`  Rollback: Restoring ${safe(op.logicalId)} (${safe(op.resourceType)}) to previous state`);
 	const { provider, provisionedBy: revertVia } = ctx.providerRegistry.getProviderFor({
 		resourceType: op.resourceType,
@@ -29086,6 +29202,10 @@ async function replayReverseReplacement(s) {
 		recordRollbackSkip(s, op, ABSENT_BASELINE_SKIP_CAUSE);
 		return;
 	}
+	if (!rollbackRetainsNewResource(current) && rollbackCannotAddress(current, op.resourceType, current.provisionedBy ?? op.provisionedBy, current.physicalId)) {
+		skipUnaddressableReplay(s, logger, op, "reverse the replacement of");
+		return;
+	}
 	const resolvedPrevProps = await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId) ?? {};
 	refuseMaskedReplayBaseline(resolvedPrevProps, op.logicalId);
 	opMasker.addNamed({
@@ -29228,8 +29348,9 @@ async function replayReverseReplacement(s) {
 	if (!adoptedLiveNewResource) inlinePolicyWriters.record(op.logicalId, "create", stateResources[op.logicalId], false, createProvisionedBy);
 	await afterOp?.(op.logicalId);
 	let survivorReason;
+	const survivorId = retainedSurvivorId(current, op);
 	if (!deletedNewFirst && !adoptedLiveNewResource && rollbackRetainsNewResource(current)) {
-		const survivorMessages = retainedSurvivorMessages(op.logicalId, op.resourceType, current.physicalId, `State records the re-created old resource (${stateResources[op.logicalId]?.physicalId ?? prev.physicalId}).`, mask);
+		const survivorMessages = retainedSurvivorMessages(op.logicalId, op.resourceType, survivorId ?? "no recorded id", `State records the re-created old resource (${stateResources[op.logicalId]?.physicalId ?? prev.physicalId}).`, mask);
 		logger.warn(survivorMessages.warn);
 		survivorReason = survivorMessages.reason;
 		result.warnings++;
@@ -29261,7 +29382,7 @@ async function replayReverseReplacement(s) {
 		resourceType: op.resourceType,
 		...op.provisionedBy && { provisionedBy: op.provisionedBy },
 		...survivorReason !== void 0 && {
-			physicalId: current.physicalId,
+			...survivorId !== void 0 && { physicalId: survivorId },
 			reason: mask(survivorReason),
 			...survivorProvisionedBy && { provisionedBy: survivorProvisionedBy }
 		},
@@ -29548,7 +29669,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						result.orphaned.push(orphaned);
 						options.onOrphan?.(orphaned);
 					}
-					if (!isReplacementOrphan(op)) delete stateResources[op.logicalId];
+					if (!recordUnderIdIsNotOwn(op, stateResources)) delete stateResources[op.logicalId];
 					await noteRetainedResource(op.resourceType, op.logicalId);
 					logger.info(`  Rollback: leaving partially-created ${safe(op.logicalId)} (${safe(op.resourceType)}) in AWS (DeletionPolicy: Retain)` + (failedCreateRecord ? " — removed from state" : " — it was never in state"));
 					await options.afterOp?.(op.logicalId);
@@ -29566,6 +29687,10 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 				case "delete-failed-create-with-final-snapshot": {
 					const failedCreateRecord = failedOpOwnRecord(op, stateResources);
 					const deleteProvisionedBy = effectiveProvisionedBy(failedCreateRecord, op.provisionedBy);
+					if (rollbackCannotAddress(failedCreateRecord, op.resourceType, deleteProvisionedBy, op.physicalId)) {
+						skipUnaddressableReplay(skipScope, logger, op, "delete partially-created resource", failedCreateRecord ? "record" : "journal");
+						break;
+					}
 					createRollbackRoute = deleteProvisionedBy;
 					const snapshotPolicy = action === "delete-failed-create-with-final-snapshot";
 					const takeFinalSnapshot = snapshotPolicy && ctx.skipFinalSnapshot !== true;
@@ -29603,7 +29728,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						result.warnings++;
 						result.leftInPlace++;
 					}
-					if (!isReplacementOrphan(op)) delete stateResources[op.logicalId];
+					if (!recordUnderIdIsNotOwn(op, stateResources)) delete stateResources[op.logicalId];
 					await options.afterOp?.(op.logicalId);
 					ctx.recordEvent?.({
 						eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
@@ -29627,6 +29752,10 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						recordRollbackSkip(skipScope, op, ABSENT_BASELINE_SKIP_CAUSE);
 						break;
 					}
+					if (rollbackCannotAddress(current, op.resourceType, op.provisionedBy ?? current.provisionedBy, current.physicalId)) {
+						skipUnaddressableReplay(skipScope, logger, op, "force-revert failed UPDATE of");
+						break;
+					}
 					logger.info(`  Rollback: force-reverting failed UPDATE of ${safe(op.logicalId)} (${safe(op.resourceType)}) to its pre-deploy properties (--revert-failed; remote state is unknown)`);
 					const { provider, provisionedBy: revertVia } = ctx.providerRegistry.getProviderFor({
 						resourceType: op.resourceType,
@@ -29703,7 +29832,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 				error: maskedRollbackEventError(revertError, mask)
 			});
 		}
-		inlinePolicyWriters.noteOutcome(op, action === "skip-failed-noop" || action === "skip-failed-mismatch" || action === "skip-failed-superseded" || action === "skip-failed-replaced-deleted" || ownRecord(stateResources, op.logicalId) !== recordBefore || isReplacementOrphan(op) && !pending.has(op) && (action === "delete-failed-create" || action === "delete-failed-create-with-final-snapshot" || action === "orphan-failed-create-retain"));
+		inlinePolicyWriters.noteOutcome(op, action === "skip-failed-noop" || action === "skip-failed-mismatch" || action === "skip-failed-superseded" || action === "skip-failed-replaced-deleted" || ownRecord(stateResources, op.logicalId) !== recordBefore || recordUnderIdIsNotOwn(op, stateResources) && !pending.has(op) && (action === "delete-failed-create" || action === "delete-failed-create-with-final-snapshot" || action === "orphan-failed-create-retain"));
 	}
 	if (result.interrupted) await restoreHeldInlinePolicies(inlinePolicyWriters, stateResources, stackName, ctx, result, { refuseAll: true });
 	if (emitEnvelope) ctx.recordEvent?.({
@@ -30313,7 +30442,7 @@ async function settleJournaledOrphansOnSuccess(args) {
 		logger.info(safeMsg`The rollback journal of stack ${stack} records ${all.length} resource(s) a failed deploy ` + `created that no state record holds; acting on them per their DeletionPolicy before the journal is removed:`);
 		for (const line of journaledOrphanLines(orphans, logger)) logger.info(line);
 		try {
-			const { unreadable, tracked } = await applySuccessRule(orphans, stateResources, orphans.deployLogicalIds ?? /* @__PURE__ */ new Set(), args.foreignHolder, stack, logger, args.isInterrupted);
+			const { unreadable, tracked } = await applySuccessRule(orphans, stateResources, orphans.deployLogicalIds ?? /* @__PURE__ */ new Set(), args.foreignHolder, stack, logger, args.isInterrupted, ctx);
 			const acting = {
 				segments: orphans.segments.map(({ segment, ops }) => ({
 					segment,
@@ -30372,7 +30501,7 @@ async function settleJournaledOrphansOnSuccess(args) {
 		keepJournal: true
 	};
 }
-async function applySuccessRule(orphans, stateResources, deployLogicalIds, foreignHolder, stack, logger, isInterrupted) {
+async function applySuccessRule(orphans, stateResources, deployLogicalIds, foreignHolder, stack, logger, isInterrupted, identityCtx) {
 	const unreadable = /* @__PURE__ */ new Set();
 	const tracked = /* @__PURE__ */ new Set();
 	let interrupted = false;
@@ -30387,9 +30516,20 @@ async function applySuccessRule(orphans, stateResources, deployLogicalIds, forei
 			tracked.add(op);
 			continue;
 		}
-		if (Object.prototype.hasOwnProperty.call(stateResources, op.logicalId) && !isReplacedRecord(op, stateResources[op.logicalId]) || deployLogicalIds.has(op.logicalId)) {
-			op.physicalIdRecoveredFromError = false;
-			continue;
+		const hasRecord = Object.prototype.hasOwnProperty.call(stateResources, op.logicalId);
+		const record = hasRecord ? stateResources[op.logicalId] : void 0;
+		const recordUnderId = hasRecord && !isReplacedRecord(op, record);
+		if (recordUnderId || deployLogicalIds.has(op.logicalId)) {
+			const verdict = recordUnderId ? await recordIdentity(op, record, identityCtx, logger) : "unknown";
+			if (verdict === "same") {
+				tracked.add(op);
+				continue;
+			}
+			if (verdict !== "different") {
+				op.physicalIdRecoveredFromError = false;
+				continue;
+			}
+			markProvenDistinctFromRecord(op, record);
 		}
 		const holding = await foreignHolder(op.resourceType, op.physicalId);
 		if (holding === void 0) continue;
@@ -30406,6 +30546,23 @@ async function applySuccessRule(orphans, stateResources, deployLogicalIds, forei
 		tracked
 	};
 }
+async function recordIdentity(op, record, ctx, logger) {
+	if (typeof record !== "object" || record === null || record.resourceType !== op.resourceType || typeof record.physicalId !== "string" || record.physicalId === "" || !op.physicalId) return "unknown";
+	try {
+		const { provider } = ctx.providerRegistry.getProviderFor({
+			resourceType: op.resourceType,
+			provisionedBy: op.provisionedBy
+		});
+		if (typeof provider.isSameResource !== "function") return "unknown";
+		return await provider.isSameResource(op.physicalId, {
+			physicalId: record.physicalId,
+			...record.provisionedBy !== void 0 && { provisionedBy: record.provisionedBy }
+		}, op.resourceType, { expectedRegion: ctx.region });
+	} catch (err) {
+		logger.debug(safeMsg`Could not compare ${logicalIdShown(op.logicalId)}'s journaled resource with its state record (${displaySafe(err instanceof Error ? err.name : typeof err)}).`);
+		return "unknown";
+	}
+}
 function makeForeignHolderScan(stateBackend) {
 	let scan;
 	const key = (type, id) => JSON.stringify([type, id]);
@@ -31307,7 +31464,7 @@ function redactParametersForDiff(parameterValues) {
 	const inherited = this.options.inheritedSecrets;
 	if (!inherited || inherited.size === 0) return parameterValues;
 	const out = Object.create(null);
-	for (const [name, value] of Object.entries(parameterValues)) out[name] = inheritedParameterExpression(inherited, name, value) ?? redactSecretsForState(value, inherited);
+	for (const [name, value] of Object.entries(parameterValues)) out[name] = redactInheritedParameterValue(inherited, name, value);
 	return out;
 }
 function rememberRecoverableMaskedOutputs(stackName, resolved, redacted) {
@@ -31527,7 +31684,7 @@ async function replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourc
 			recordedAttributes: currentResource.attributes
 		});
 	} catch (deleteError) {
-		throw new Error(maskSecretsInText(`Failed to delete old resource ${logicalId} (${currentResource.physicalId}) during the --replace delete-first fallback: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`, secrets));
+		throw new Error(maskSecretsInText(`Failed to delete old resource ${logicalId} (${currentResource.physicalId}) during the --replace delete-first fallback: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`, secrets), { cause: deleteError instanceof Error ? maskSecretsInError(deleteError, secrets) : void 0 });
 	}
 	reportDeleteGuards(deleteResult, {
 		physicalId: currentResource.physicalId,
@@ -31550,7 +31707,7 @@ async function replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourc
 			isRetryable: isRecreateRetryableError
 		});
 	} catch (recreateError) {
-		throw new Error(maskSecretsInText(`Failed to re-create ${logicalId} after the --replace delete-first fallback already deleted the old resource (${currentResource.physicalId}): ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. Re-run the deploy to create it fresh.`, secrets), { cause: recreateError instanceof Error ? recreateError : void 0 });
+		throw new Error(maskSecretsInText(`Failed to re-create ${logicalId} after the --replace delete-first fallback already deleted the old resource (${currentResource.physicalId}): ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. Re-run the deploy to create it fresh.`, secrets), { cause: recreateError instanceof Error ? maskSecretsInError(recreateError, secrets) : void 0 });
 	}
 }
 function typeChangeNameQuestion(resourceType, input) {
@@ -35234,7 +35391,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 					recordedAttributes: currentResource.attributes
 				});
 			} catch (deleteError) {
-				throw new Error(`Failed to destroy old resource ${logicalId} (${currentResource.physicalId}) during ${recreateFlagName}: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`);
+				throw new Error(maskSecretsInText(`Failed to destroy old resource ${logicalId} (${currentResource.physicalId}) during ${recreateFlagName}: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`, updateSecrets), { cause: deleteError instanceof Error ? maskSecretsInError(deleteError, updateSecrets) : void 0 });
 			}
 			reportDeleteGuards(recreateDeleteResult, {
 				physicalId: currentResource.physicalId,
@@ -37947,5 +38104,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { resourcesNamingDeclaredParameter as $, createSecretMasker as $a, repairMalformedResourceEntriesForReadOnly as $i, deleteSkipReason as $n, ensureAssetStorage as $o, deployRefusesOrphanRowsReason as $r, derivePartitionAndUrlSuffix as $s, effectiveDeletionPolicy as $t, resolveDynamoDbDeleteBudgetClock as A, requireConfigObject as Aa, refuseMalformedOrphans as Ai, acquireIdempotencyToken as An, acceptedCreateOnlyDropsOf as Ao, s3BucketWebsiteUrl as Ar, getDefaultStateBucketName as As, planRollback as At, getPriorAttempts as B, TemplateParser as Ba, refuseMalformedResourceEntriesForImportSave as Bi, CC_BROKEN_REASON as Bn, orphansCarriedFrom as Bo, AWS_NO_VALUE as Br, stateBucketExistenceConfirmed as Bs, updatePartialMessage as Bt, perType as C, coerceCfnInteger as Ca, malformedScrubResourceEntriesRefusalMessage as Ci, findDestructiveChanges as Cn, WHOLE_DYNAMIC_REFERENCE_PATTERN as Co, callerEnvCredentials as Cr, warnFinchArgvExposure as Cs, getStackRecords as Ct, beginDeleteWait as D, readConfigString as Da, refuseMalformedNestedChildOutputs as Di, ledgerForStack as Dn, S3StateBackend as Do, s3BucketDomainName as Dr, getDockerImageBySourceHash as Ds, isJournaledOrphan as Dt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as E, configStringRefusal as Ea, refuseDivergentRecordRegionForDestroy as Ei, earliestDefined as En, isLockInfoExpired as Eo, s3BucketArn as Er, AssetManifestLoader as Es, demoteSupersededOrphans as Et, waitForIndexesSettled as F, withRetry as Fa, refuseMalformedResourceAttributesForOrphan as Fi, refuseMalformedDesiredTags as Fn, hasUnverifiableParameterRefusal as Fo, isImpossibleEmptyStoredAttribute as Fr, resolveCaptureObservedState as Fs, inheritProducerRegions as Ft, cyan as G, createUnionSecretMasker as Ga, refuseMalformedResourcePropertiesForOrphan as Gi, getCurrentResourceSecrets as Gn, WorkGraph as Go, withSharedDrainBudget as Gr, MIGRATE_TMP_PREFIX as Gs, orphanRecordsPrintingBag as Gt, formatResourceLine as H, inheritNestedStackParameterAssociations as Ha, refuseMalformedResourcePropertiesForDestroy as Hi, ccBrokenReason as Hn, AssetPublisher as Ho, isStalePlaceholderArnAttribute as Hr, ssmResolvedValueType as Hs, completedReplayEntries as Ht, ECR_AUTO_DELETE_IMAGES_TAG as I, canonicalLambdaFunctionName as Ia, refuseMalformedResourceEntries as Ii, tagMapAsList as In, importableOutputKeys as Io, carriesDynamicReference as Ir, resolveSkipPrefix as Is, REDACTED_DELETE_ADDRESS_SKIP_REASON as It, red as J, logOnlyValueCount as Ja, refuseMalformedResourcesForExport as Ji, slowCcOperationTimeoutMs as Jn, loadPublishableAssetManifest as Jo, JSON_LISTING_HOLE_VALUE as Jr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Js, ATOMIC_FINAL_SNAPSHOT_TYPES as Jt, gray as K, hasMaskableValues as Ka, refuseMalformedResourcesForDeploy as Ki, withPrintingSecrets as Kn, buildAssetRedirectMap as Ko, parameterInputsFor as Kr, findLargeInlineResources as Ks, secretNamePrintingBag as Kt, S3_AUTO_DELETE_OBJECTS_TAG as L, lambdaFunctionNameForMask as La, refuseMalformedResourceEntriesForDeploy as Li, tagPlanWarning as Ln, importableOutputs as Lo, carriesFetchableDynamicReference as Lr, resolveStateBucketWithDefault as Ls, isRedactedRecordedValue as Lt, DELETE_INDEX_WAIT_PROCEED_NOTE as M, prefetchCreateOnlyPropertyPaths as Ma, refuseMalformedOrphansForOrphan as Mi, DBPROXY_TAG_OPTIONS as Mn, exportNamesCarriedFrom as Mo, isUnboundTemplateParameter as Mr, loadCdkJson as Ms, resolveReplacementOldType as Mt, INDEX_SETTLE_POLL_INTERVAL_MS as N, templateResourceTypes as Na, refuseMalformedOutputs as Ni, planTagDiff as Nn, hasReadableExportSet as No, parameterTypeMayLoseSecretIdentity as Nr, resolveApp as Ns, findNestedStackTypeChanges as Nt, compensateRemovedDeletionProtection as O, replayWarn as Oa, refuseMalformedOrphanRecords as Oi, reserveStackCreateToken as On, rebuildClientForBucketRegion as Oo, s3BucketDualStackDomainName as Or, Synthesizer as Os, isReplacementOrphan as Ot, deleteTableWithIndexBusyRetry as P, describeTypeWithThrottleRetry as Pa, refuseMalformedOutputsForDestroy as Pi, readTagList as Pn, hasReasonlessBaselineRefusal as Po, getAccountInfo as Pr, resolveAutoAssetStorage as Ps, getCurrentProducerRegions as Pt, reachableDivergentParameters as Q, shareLogOnlyValues as Qa, repairMalformedOutputsForReadOnly as Qi, deleteIndeterminateGuards as Qn, assertAssetBucketRegion as Qo, UNREADABLE_RESOURCES_MAP_ROW as Qr, canonicalizeRegion as Qs, createPreDeleteFinalSnapshot as Qt, hasCdkAutoDeleteTag as R, sameLambdaFunctionAddress as Ra, refuseMalformedResourceEntriesForDestroy as Ri, definedAttributes as Rn, isReadableBag as Ro, isNamelessDynamicReferenceError as Rr, resolveStateBucketWithDefaultAndSource as Rs, redactedDeleteAddressFields as Rt, isProtectionValueActive as S, coerceCfnBoolean as Sa, malformedResourcesWarning as Si, constructPathOf as Sn, TEMPLATE_SOURCED_RULES as So, applyCallerIdentityCredentials as Sr, runDockerStreaming as Ss, destroyStackRecordsView as St, DynamoDBGlobalTableProvider as T, configIntegerRefusal as Ta, previewableOrphanRecords as Ti, RollbackInlinePolicyWriters as Tn, LockManager as To, isSettledInstanceState as Tr, stripControlChars as Ts, recordAfterRollbackUpdate as Tt, createReadOnlyAttributeHealerFactory as U, recordNestedStackParameterExpressions as Ua, refuseMalformedResourcePropertiesForDrift as Ui, wouldReturnToSdkProvider as Un, isSensitiveAttributeName as Uo, refStateLookupFromResource as Ur, CFN_TEMPLATE_BODY_LIMIT as Us, journaledOrphanPrintingBag as Ut, markRefusedBeforeApplying as V, liveMatchesUnresolvedTokenFrame as Va, refuseMalformedResourceEntriesForOrphan as Vi, ProviderRegistry as Vn, shouldRetainResource as Vo, cfnRefValueFromPhysicalId as Vr, warnDeprecatedNoPrefixCliFlag as Vs, updatePartialReason as Vt, bold as W, carryLogOnlyValues as Wa, refuseMalformedResourcePropertiesForExport as Wi, isCustomResourceType as Wn, stringifyValue as Wo, parseWebACLArn as Wr, CFN_TEMPLATE_URL_LIMIT as Ws, maskEventTextWithBoundBags as Wt, computeParameterTaint as X, recordLogOnlyParameterValue as Xa, repairMalformedOrphanRecordsForReadOnly as Xi, unchangedBehindSecretReference as Xn, AssetModeResolver as Xo, STATE_RESOURCES_MALFORMED as Xr, expectedOwnerParam as Xs, buildFinalSnapshotIdentifier as Xt, yellow as Y, printingCorpusOf as Ya, refuseMalformedState as Yi, ccProtectionRegistryTypes as Yn, rewriteTemplateAssetReferences as Yo, STATE_REGION_DIVERGED as Yr, decodeListingKey as Ys, PRE_DELETE_SNAPSHOT_TYPES as Yt, namesAnyDeclaredParameter as Z, recordLogOnlyValue as Za, repairMalformedOrphansForReadOnly as Zi, UNSPECIFIED_SKIP_REASON as Zn, BOOTSTRAP_MARKER_PREFIX as Zo, UNREADABLE_ORPHANS_CONTAINER_ROW as Zr, PARTITION_TABLE as Zs, ccRoutedFinalSnapshotError as Zt, makeCanonicalizePropertiesFn as _, WARM_THROUGHPUT_MEMBERS as _a, malformedOutputsRefusalMessage as _i, isExportAliasCollision as _n, recordProvenPublicExpression as _o, assertSendableRoleArn as _r, isMalformedEnvKey as _s, getCurrentNestedStackContext as _t, findNestedTemplateTreeDefect as a, findActionableSilentDrops as aa, hasPlainPrototype$1 as ac, isReadableResourceEntry as ai, extractDeploymentEventError as an, scrubResourceRecord as ao, isTerminationProtectionPropagationError as ar, validateContainerRepoName as as, makeSiblingClaimReader as at, recordedProtectionNote as b, toCfnInteger as ba, malformedResourceEntriesWarning as bi, DEFAULT_RESOURCE_WARN_AFTER_MS as bn, STATE_SOURCED_CROSS_GENERATION_RULES as bo, sendableAssumeRoleCommand as br, redactedDockerCause as bs, replayRollback as bt, renderNestedTemplateTreeDefect as c, withoutSilentDropProperties as ca, absoluteAssemblyPathEscape as cc, malformedExportSourceWarning as ci, exportAliasCollisionScrubWarning as cn, dynamicReferenceTokens as co, reEnableInstanceApiTermination as cr, resolveDockerContextDirectory as cs, displacedOpClause as ct, conditionInputsFrom as d, findReplacedReadersOfRecreateTargets as da, renderAssemblyPathEscape as dc, malformedLocalResourcesWarning as di, secretSafeKeyDisplay as dn, identityKeyFor as do, IntrinsicFunctionResolver as dr, describeDockerFailure as ds, getNestedRevertRun as dt, repairMalformedResourcePropertiesForReadOnly as ea, AssemblyReader as ec, displayLogicalId as ei, isFinalSnapshotError as en, errorCauseChain as eo, withIndeterminateGuard as er, getBootstrapMarkerKey as es, deleteJournaledOrphans as et, parentSuppliedValues as f, shownType as fa, resolveAssemblyPath as fc, malformedOrphanRecordsRefusalMessage as fi, exportNameSecretExposure as fn, carriesSecretMask as fo, classifyReplaySecretRegion as fr, dockerSpawnEnvWithSensitive as fs, nestedChildStackName as ft, mergeNoChangeOutputs as g, renderStatefulReason as ga, malformedOrphansWarning as gi, collectPublishedOutputNames as gn, recordNoEchoAttributeValues as go, assertFlagRoleArn as gr, isDockerClientEnvKey as gs, withNestedRevertRun as gt, keptWholeReasonText as h, isStatefulRecreateTargetSync as ha, malformedOrphansRefusalMessage as hi, collectDeclaredOutputNames as hn, recordMaskOnlyValuesIn as ho, applyRoleArnIfSet as hr, getDockerCmd as hs, revertedNestedRowIds as ht, childTemplateLoader as i, unreadableResourceEntries as ia, hasOwnKey as ic, isReadableOrphanRecord as ii, DeploymentEventsStore as in, redactSecretsForState as io, ec2InstanceProtectionSite as ir, validateAssetBucketName as is, sameJournaledOrphans as it, resolveDynamoDbDeleteBudgetMs as j, requireConfigString as ja, refuseMalformedOrphansForDestroy as ji, DBPROXY_TAGS_WHAT as jn, describeRegionValueKind as jo, coerceParameterTypedValue as jr, getLegacyStateBucketName as js, replacementNeverSwapped as jt, deleteBudgetKey as k, requireConfigArray as ka, refuseMalformedOrphanRecordsForDestroy as ki, withCreateTokenLedger as kn, splitImportedOps as ko, s3BucketRegionalDomainName as kr, synthesisStatusMessage as ks, planFailedOps as kt, templateIdentity as l, NO_CC_HANDLERS_REASON as la, describeFileReadFailure as lc, malformedLocalOutputsWarning as li, secretBearing as ln, isUncertifiedBaselineMaskPosition as lo, DiffCalculator as lr, describeDockerCapturedOutput as ls, displacedPhysicalIdShown as lt, isSecretBearingReferenceString as m, isStatefulRecreateTargetForReplace as ma, resolveBucketRegion as mc, malformedOrphanRowsKeptWarning as mi, noEchoParameterValueSeed as mn, recordMaskOnlyValue as mo, regionLessSecretName as mr, formatDockerLoginError as ms, revertNestedChildFromJournal as mt, IMPLICIT_DELETE_DEPENDENCIES as n, unpreviewableOrphanRecords as na, processStackMessages as nc, hasReadableOutputs as ni, unsupportedFinalSnapshotError as nn, maskSecretsInText as no, markWaitAbandoned as nr, parseBootstrapMarker as ns, journaledOrphanLines as nt, isAbsoluteAssetPath as o, findSilentDropProperties as oa, nullPrototypeRecord as oc, malformedDriftResourcePropertiesWarning as oi, WITHHELD_NAME_DISPLAY as on, recoverMaskedOutput as oo, observeThenDisableInstanceApiTermination as or, buildDenyExternalAccessPolicy as os, planOrphanAdoption as ot, readRecordedConditionVerdicts as p, MULTI_REGION_RECREATE_BLOCKED_TYPES as pa, clearBucketRegionCache as pc, malformedOrphanRecordsWarning as pi, isWholeDynamicReferenceValue as pn, provenPublicValue as po, producerRegionsFromState as pr, finchSecretArgvRefusal as ps, recordDisplacedSkips as pt, green as q, literalSplitDelimitersOf as qa, refuseMalformedResourcesForDestroy as qi, CloudControlProvider as qn, createAssetRedirectResolver as qo, passedParameterClassesOf as qr, uploadCfnTemplate as qs, stateSecretNameNeedles as qt, computeImplicitDeleteEdges as r, unreadableOrphanRecords as ra, defineOwnKey as rc, hasReadableResources as ri, DeploymentEventsReader as rn, markSameGenerationBag as ro, disableInstanceApiTermination as rr, readBootstrapMarkerBody as rs, loadJournaledOrphans as rt, listNestedTemplateRows as s, unwrittenCreateOnlyReplacement as sa, ownValue as sc, malformedExportNamesWarning as si, displayTextOrWithheld as sn, DYNAMIC_REFERENCE_TOKEN_SCAN as so, reDisableInstanceApiTermination as sr, buildDockerImage as ss, NESTED_PENDING_PARENT_REASON as st, DeployEngine as t, repairMalformedResourcesForReadOnly as ta, StageLoadError as tc, hasReadableOrphans as ti, refusesFinalSnapshot as tn, maskSecretsInError as to, isWaitAbandonedError as tr, isCrossRegionRedirect as ts, isHandledOrphan as tt, conditionFingerprint as u, hasNoCloudControlHandlers as ua, displayAssemblyPath as uc, malformedLocalResourceEntriesWarning as ui, secretBearingStateKeyWarning as un, pathCrossesDottedKey as uo, INTRINSIC_KEYS as ur, describeDockerExecFailure as us, dropSettledNestedJournals as ut, withResourceDeadline as v, coerceWarmThroughput as va, malformedOutputsWarning as vi, bindingSkippedOutputs as vn, wholeStringLeavesOf as vo, explicitRoleArnOrThrow as vr, partitionSensitiveEnv as vs, withNestedStackContext as vt, readProtection as w, configBooleanRefusal as wa, malformedStateRefusalMessage as wi, formatDestructiveChange as wn, isSingleDynamicReferenceToken as wo, envCredentialsAreAssumedRole as wr, escapeRegExp$3 as ws, withStackRecords as wt, PROTECTION_PROPERTY_BY_TYPE as x, toFiniteNumber as xa, malformedResourcePropertiesWarning as xi, maskingRetryLogger as xn, STATE_SOURCED_READBACK_RULES as xo, AWS_CREDENTIAL_ENV_KEYS as xr, runDockerForeground as xs, awaitInFlightSibling as xt, recordedProtectionEvidence as y, isWarmThroughputDecrease as ya, malformedRenderedContainersWarning as yi, DEFAULT_RESOURCE_TIMEOUT_MS as yn, STATE_SOURCED_BASELINE_RULES as yo, isIamRoleArn as yr, redactDockerArgvValues as ys, replayFailedOperations as yt, isTruthyCfnBoolean as z, DagBuilder as za, refuseMalformedResourceEntriesForImport as zi, stringifyIfAssigned as zn, orphansAfterRollback as zo, keepsSecretReferenceToken as zr, resolveUseCdkBootstrapAssets as zs, redactedDeleteAddressSkip as zt };
-//# sourceMappingURL=deploy-engine-BPcBCyUE.js.map
+export { resourcesNamingDeclaredParameter as $, maskSecretsInError as $a, repairMalformedResourceEntriesForReadOnly as $i, deleteSkipReason as $n, ensureAssetStorage as $o, deployRefusesOrphanRowsReason as $r, derivePartitionAndUrlSuffix as $s, effectiveDeletionPolicy as $t, resolveDynamoDbDeleteBudgetClock as A, requireConfigObject as Aa, refuseMalformedOrphans as Ai, acquireIdempotencyToken as An, acceptedCreateOnlyDropsOf as Ao, s3BucketWebsiteUrl as Ar, getDefaultStateBucketName as As, planRollback as At, getPriorAttempts as B, TemplateParser as Ba, refuseMalformedResourceEntriesForImportSave as Bi, CC_BROKEN_REASON as Bn, orphansCarriedFrom as Bo, AWS_NO_VALUE as Br, stateBucketExistenceConfirmed as Bs, updatePartialMessage as Bt, perType as C, coerceCfnInteger as Ca, malformedScrubResourceEntriesRefusalMessage as Ci, findDestructiveChanges as Cn, WHOLE_DYNAMIC_REFERENCE_PATTERN as Co, callerEnvCredentials as Cr, warnFinchArgvExposure as Cs, getStackRecords as Ct, beginDeleteWait as D, readConfigString as Da, refuseMalformedNestedChildOutputs as Di, ledgerForStack as Dn, S3StateBackend as Do, s3BucketDomainName as Dr, getDockerImageBySourceHash as Ds, isJournaledOrphan as Dt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as E, configStringRefusal as Ea, refuseDivergentRecordRegionForDestroy as Ei, earliestDefined as En, isLockInfoExpired as Eo, s3BucketArn as Er, AssetManifestLoader as Es, demoteSupersededOrphans as Et, waitForIndexesSettled as F, withRetry as Fa, refuseMalformedResourceAttributesForOrphan as Fi, refuseMalformedDesiredTags as Fn, hasUnverifiableParameterRefusal as Fo, isImpossibleEmptyStoredAttribute as Fr, resolveCaptureObservedState as Fs, inheritProducerRegions as Ft, cyan as G, literalSplitDelimitersOf as Ga, refuseMalformedResourcePropertiesForOrphan as Gi, getCurrentResourceSecrets as Gn, WorkGraph as Go, withSharedDrainBudget as Gr, MIGRATE_TMP_PREFIX as Gs, orphanRecordsPrintingBag as Gt, formatResourceLine as H, carryLogOnlyValues as Ha, refuseMalformedResourcePropertiesForDestroy as Hi, ccBrokenReason as Hn, AssetPublisher as Ho, isStalePlaceholderArnAttribute as Hr, ssmResolvedValueType as Hs, completedReplayEntries as Ht, ECR_AUTO_DELETE_IMAGES_TAG as I, canonicalLambdaFunctionName as Ia, refuseMalformedResourceEntries as Ii, tagMapAsList as In, importableOutputKeys as Io, carriesDynamicReference as Ir, resolveSkipPrefix as Is, REDACTED_DELETE_ADDRESS_SKIP_REASON as It, red as J, recordLogOnlyParameterValue as Ja, refuseMalformedResourcesForExport as Ji, slowCcOperationTimeoutMs as Jn, loadPublishableAssetManifest as Jo, JSON_LISTING_HOLE_VALUE as Jr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Js, ATOMIC_FINAL_SNAPSHOT_TYPES as Jt, gray as K, logOnlyValueCount as Ka, refuseMalformedResourcesForDeploy as Ki, withPrintingSecrets as Kn, buildAssetRedirectMap as Ko, parameterInputsFor as Kr, findLargeInlineResources as Ks, secretNamePrintingBag as Kt, S3_AUTO_DELETE_OBJECTS_TAG as L, lambdaFunctionNameForMask as La, refuseMalformedResourceEntriesForDeploy as Li, tagPlanWarning as Ln, importableOutputs as Lo, carriesFetchableDynamicReference as Lr, resolveStateBucketWithDefault as Ls, isRedactedRecordedValue as Lt, DELETE_INDEX_WAIT_PROCEED_NOTE as M, prefetchCreateOnlyPropertyPaths as Ma, refuseMalformedOrphansForOrphan as Mi, DBPROXY_TAG_OPTIONS as Mn, exportNamesCarriedFrom as Mo, isUnboundTemplateParameter as Mr, loadCdkJson as Ms, resolveReplacementOldType as Mt, INDEX_SETTLE_POLL_INTERVAL_MS as N, templateResourceTypes as Na, refuseMalformedOutputs as Ni, planTagDiff as Nn, hasReadableExportSet as No, parameterTypeMayLoseSecretIdentity as Nr, resolveApp as Ns, findNestedStackTypeChanges as Nt, compensateRemovedDeletionProtection as O, replayWarn as Oa, refuseMalformedOrphanRecords as Oi, reserveStackCreateToken as On, rebuildClientForBucketRegion as Oo, s3BucketDualStackDomainName as Or, Synthesizer as Os, isReplacementOrphan as Ot, deleteTableWithIndexBusyRetry as P, describeTypeWithThrottleRetry as Pa, refuseMalformedOutputsForDestroy as Pi, readTagList as Pn, hasReasonlessBaselineRefusal as Po, getAccountInfo as Pr, resolveAutoAssetStorage as Ps, getCurrentProducerRegions as Pt, reachableDivergentParameters as Q, errorCauseChain as Qa, repairMalformedOutputsForReadOnly as Qi, deleteIndeterminateGuards as Qn, assertAssetBucketRegion as Qo, UNREADABLE_RESOURCES_MAP_ROW as Qr, canonicalizeRegion as Qs, createPreDeleteFinalSnapshot as Qt, hasCdkAutoDeleteTag as R, sameLambdaFunctionAddress as Ra, refuseMalformedResourceEntriesForDestroy as Ri, definedAttributes as Rn, isReadableBag as Ro, isNamelessDynamicReferenceError as Rr, resolveStateBucketWithDefaultAndSource as Rs, redactedDeleteAddressFields as Rt, isProtectionValueActive as S, coerceCfnBoolean as Sa, malformedResourcesWarning as Si, constructPathOf as Sn, TEMPLATE_SOURCED_RULES as So, applyCallerIdentityCredentials as Sr, runDockerStreaming as Ss, destroyStackRecordsView as St, DynamoDBGlobalTableProvider as T, configIntegerRefusal as Ta, previewableOrphanRecords as Ti, RollbackInlinePolicyWriters as Tn, LockManager as To, isSettledInstanceState as Tr, stripControlChars as Ts, recordAfterRollbackUpdate as Tt, createReadOnlyAttributeHealerFactory as U, createUnionSecretMasker as Ua, refuseMalformedResourcePropertiesForDrift as Ui, wouldReturnToSdkProvider as Un, isSensitiveAttributeName as Uo, refStateLookupFromResource as Ur, CFN_TEMPLATE_BODY_LIMIT as Us, journaledOrphanPrintingBag as Ut, markRefusedBeforeApplying as V, liveMatchesUnresolvedTokenFrame as Va, refuseMalformedResourceEntriesForOrphan as Vi, ProviderRegistry as Vn, shouldRetainResource as Vo, cfnRefValueFromPhysicalId as Vr, warnDeprecatedNoPrefixCliFlag as Vs, updatePartialReason as Vt, bold as W, hasMaskableValues as Wa, refuseMalformedResourcePropertiesForExport as Wi, isCustomResourceType as Wn, stringifyValue as Wo, parseWebACLArn as Wr, CFN_TEMPLATE_URL_LIMIT as Ws, maskEventTextWithBoundBags as Wt, computeParameterTaint as X, shareLogOnlyValues as Xa, repairMalformedOrphanRecordsForReadOnly as Xi, unchangedBehindSecretReference as Xn, AssetModeResolver as Xo, STATE_RESOURCES_MALFORMED as Xr, expectedOwnerParam as Xs, buildFinalSnapshotIdentifier as Xt, yellow as Y, recordLogOnlyValue as Ya, refuseMalformedState as Yi, ccProtectionRegistryTypes as Yn, rewriteTemplateAssetReferences as Yo, STATE_REGION_DIVERGED as Yr, decodeListingKey as Ys, PRE_DELETE_SNAPSHOT_TYPES as Yt, namesAnyDeclaredParameter as Z, createSecretMasker as Za, repairMalformedOrphansForReadOnly as Zi, UNSPECIFIED_SKIP_REASON as Zn, BOOTSTRAP_MARKER_PREFIX as Zo, UNREADABLE_ORPHANS_CONTAINER_ROW as Zr, PARTITION_TABLE as Zs, ccRoutedFinalSnapshotError as Zt, makeCanonicalizePropertiesFn as _, WARM_THROUGHPUT_MEMBERS as _a, malformedOutputsRefusalMessage as _i, isExportAliasCollision as _n, recordProvenPublicExpression as _o, assertSendableRoleArn as _r, isMalformedEnvKey as _s, getCurrentNestedStackContext as _t, findNestedTemplateTreeDefect as a, findActionableSilentDrops as aa, hasPlainPrototype$1 as ac, isReadableResourceEntry as ai, extractDeploymentEventError as an, dynamicReferenceTokens as ao, isTerminationProtectionPropagationError as ar, validateContainerRepoName as as, makeSiblingClaimReader as at, recordedProtectionNote as b, toCfnInteger as ba, malformedResourceEntriesWarning as bi, DEFAULT_RESOURCE_WARN_AFTER_MS as bn, STATE_SOURCED_CROSS_GENERATION_RULES as bo, sendableAssumeRoleCommand as br, redactedDockerCause as bs, replayRollback as bt, renderNestedTemplateTreeDefect as c, withoutSilentDropProperties as ca, absoluteAssemblyPathEscape as cc, malformedExportSourceWarning as ci, exportAliasCollisionScrubWarning as cn, inheritNestedStackParameterAssociations as co, reEnableInstanceApiTermination as cr, resolveDockerContextDirectory as cs, displacedOpClause as ct, conditionInputsFrom as d, findReplacedReadersOfRecreateTargets as da, renderAssemblyPathEscape as dc, malformedLocalResourcesWarning as di, secretSafeKeyDisplay as dn, identityKeyFor as do, IntrinsicFunctionResolver as dr, describeDockerFailure as ds, getNestedRevertRun as dt, repairMalformedResourcePropertiesForReadOnly as ea, AssemblyReader as ec, displayLogicalId as ei, isFinalSnapshotError as en, maskSecretsInText as eo, withIndeterminateGuard as er, getBootstrapMarkerKey as es, deleteJournaledOrphans as et, parentSuppliedValues as f, shownType as fa, resolveAssemblyPath as fc, malformedOrphanRecordsRefusalMessage as fi, exportNameSecretExposure as fn, carriesSecretMask as fo, classifyReplaySecretRegion as fr, dockerSpawnEnvWithSensitive as fs, nestedChildStackName as ft, mergeNoChangeOutputs as g, renderStatefulReason as ga, malformedOrphansWarning as gi, collectPublishedOutputNames as gn, recordNoEchoAttributeValues as go, assertFlagRoleArn as gr, isDockerClientEnvKey as gs, withNestedRevertRun as gt, keptWholeReasonText as h, isStatefulRecreateTargetSync as ha, malformedOrphansRefusalMessage as hi, collectDeclaredOutputNames as hn, recordMaskOnlyValuesIn as ho, applyRoleArnIfSet as hr, getDockerCmd as hs, revertedNestedRowIds as ht, childTemplateLoader as i, unreadableResourceEntries as ia, hasOwnKey as ic, isReadableOrphanRecord as ii, DeploymentEventsStore as in, DYNAMIC_REFERENCE_TOKEN_SCAN as io, ec2InstanceProtectionSite as ir, validateAssetBucketName as is, sameJournaledOrphans as it, resolveDynamoDbDeleteBudgetMs as j, requireConfigString as ja, refuseMalformedOrphansForDestroy as ji, DBPROXY_TAGS_WHAT as jn, describeRegionValueKind as jo, coerceParameterTypedValue as jr, getLegacyStateBucketName as js, replacementNeverSwapped as jt, deleteBudgetKey as k, requireConfigArray as ka, refuseMalformedOrphanRecordsForDestroy as ki, withCreateTokenLedger as kn, splitImportedOps as ko, s3BucketRegionalDomainName as kr, synthesisStatusMessage as ks, planFailedOps as kt, templateIdentity as l, NO_CC_HANDLERS_REASON as la, describeFileReadFailure as lc, malformedLocalOutputsWarning as li, secretBearing as ln, recordNestedStackParameterExpressions as lo, DiffCalculator as lr, describeDockerCapturedOutput as ls, displacedPhysicalIdShown as lt, isSecretBearingReferenceString as m, isStatefulRecreateTargetForReplace as ma, resolveBucketRegion as mc, malformedOrphanRowsKeptWarning as mi, noEchoParameterValueSeed as mn, recordMaskOnlyValue as mo, regionLessSecretName as mr, formatDockerLoginError as ms, revertNestedChildFromJournal as mt, IMPLICIT_DELETE_DEPENDENCIES as n, unpreviewableOrphanRecords as na, processStackMessages as nc, hasReadableOutputs as ni, unsupportedFinalSnapshotError as nn, redactSecretsForState as no, markWaitAbandoned as nr, parseBootstrapMarker as ns, journaledOrphanLines as nt, isAbsoluteAssetPath as o, findSilentDropProperties as oa, nullPrototypeRecord as oc, malformedDriftResourcePropertiesWarning as oi, WITHHELD_NAME_DISPLAY as on, isUncertifiedBaselineMaskPosition as oo, observeThenDisableInstanceApiTermination as or, buildDenyExternalAccessPolicy as os, planOrphanAdoption as ot, readRecordedConditionVerdicts as p, MULTI_REGION_RECREATE_BLOCKED_TYPES as pa, clearBucketRegionCache as pc, malformedOrphanRecordsWarning as pi, isWholeDynamicReferenceValue as pn, provenPublicValue as po, producerRegionsFromState as pr, finchSecretArgvRefusal as ps, recordDisplacedSkips as pt, green as q, printingCorpusOf as qa, refuseMalformedResourcesForDestroy as qi, CloudControlProvider as qn, createAssetRedirectResolver as qo, passedParameterClassesOf as qr, uploadCfnTemplate as qs, stateSecretNameNeedles as qt, computeImplicitDeleteEdges as r, unreadableOrphanRecords as ra, defineOwnKey as rc, hasReadableResources as ri, DeploymentEventsReader as rn, scrubResourceRecord as ro, disableInstanceApiTermination as rr, readBootstrapMarkerBody as rs, loadJournaledOrphans as rt, listNestedTemplateRows as s, unwrittenCreateOnlyReplacement as sa, ownValue as sc, malformedExportNamesWarning as si, displayTextOrWithheld as sn, pathCrossesDottedKey as so, reDisableInstanceApiTermination as sr, buildDockerImage as ss, NESTED_PENDING_PARENT_REASON as st, DeployEngine as t, repairMalformedResourcesForReadOnly as ta, StageLoadError as tc, hasReadableOrphans as ti, refusesFinalSnapshot as tn, markSameGenerationBag as to, isWaitAbandonedError as tr, isCrossRegionRedirect as ts, isHandledOrphan as tt, conditionFingerprint as u, hasNoCloudControlHandlers as ua, displayAssemblyPath as uc, malformedLocalResourceEntriesWarning as ui, secretBearingStateKeyWarning as un, recoverMaskedOutput as uo, INTRINSIC_KEYS as ur, describeDockerExecFailure as us, dropSettledNestedJournals as ut, withResourceDeadline as v, coerceWarmThroughput as va, malformedOutputsWarning as vi, bindingSkippedOutputs as vn, wholeStringLeavesOf as vo, explicitRoleArnOrThrow as vr, partitionSensitiveEnv as vs, withNestedStackContext as vt, readProtection as w, configBooleanRefusal as wa, malformedStateRefusalMessage as wi, formatDestructiveChange as wn, isSingleDynamicReferenceToken as wo, envCredentialsAreAssumedRole as wr, escapeRegExp$3 as ws, withStackRecords as wt, PROTECTION_PROPERTY_BY_TYPE as x, toFiniteNumber as xa, malformedResourcePropertiesWarning as xi, maskingRetryLogger as xn, STATE_SOURCED_READBACK_RULES as xo, AWS_CREDENTIAL_ENV_KEYS as xr, runDockerForeground as xs, awaitInFlightSibling as xt, recordedProtectionEvidence as y, isWarmThroughputDecrease as ya, malformedRenderedContainersWarning as yi, DEFAULT_RESOURCE_TIMEOUT_MS as yn, STATE_SOURCED_BASELINE_RULES as yo, isIamRoleArn as yr, redactDockerArgvValues as ys, replayFailedOperations as yt, isTruthyCfnBoolean as z, DagBuilder as za, refuseMalformedResourceEntriesForImport as zi, stringifyIfAssigned as zn, orphansAfterRollback as zo, keepsSecretReferenceToken as zr, resolveUseCdkBootstrapAssets as zs, redactedDeleteAddressSkip as zt };
+//# sourceMappingURL=deploy-engine-wyaJUA8V.js.map