@go-to-k/cdkd 0.298.8 → 0.299.0

package/dist/{deploy-engine-HKmcD4Kn.js → deploy-engine-4K_B3N08.js}

@@ -1,8 +1,8 @@
-import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js";
+import { r as getAwsClients, s as __exportAll } from "./aws-clients-Bj7qH5Ph.js";
 import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, H as truncateCodePoints, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as terminalSafe, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
-import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-CwKiK9nS.js";
-import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-n6UXfuUI.js";
+import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-Pn2m0R67.js";
+import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-DBXBcg0J.js";
+import { t as getCdkdVersion } from "./version-DUCWZskc.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2308,7 +2308,7 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region, legacyF
 	logger.debug("No state bucket specified, resolving default from account...");
 	const { GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const { S3Client, HeadBucketCommand, ListObjectsV2Command } = await import("@aws-sdk/client-s3");
-	const { getAwsClients } = await import("./aws-clients-CnmtbrxD.js").then((n) => n.n);
+	const { getAwsClients } = await import("./aws-clients-Bj7qH5Ph.js").then((n) => n.n);
 	const { expectedOwnerParam, recordResolvedAccountId } = await Promise.resolve().then(() => expected_bucket_owner_exports);
 	const probeDeps = {
 		HeadBucketCommand,
@@ -4751,7 +4751,8 @@ const STATE_SCHEMA_VERSIONS_READABLE = [
 	8,
 	9,
 	10,
-	11
+	11,
+	12
 ];
 function hasUnverifiableParameterRefusal(record) {
 	return record?.observedBaselineRefused === true && record.observedBaselineRefusalReason === "unverifiable-parameter";
@@ -5482,6 +5483,19 @@ async function rebuildClientForBucketRegion(client, bucket, opts = {}) {
 	return replacement;
 }
 
+//#endregion
+//#region src/state/token-free-state.ts
+const tokenFreeStates = /* @__PURE__ */ new WeakSet();
+function bodyMayCarryReferences(body) {
+	return body.includes("{{resolve:") || body.includes("\"referenceProvenance\"") || body.includes("\"outputReferenceProvenance\"");
+}
+function markTokenFreeState(state) {
+	tokenFreeStates.add(state);
+}
+function isKnownTokenFreeState(state) {
+	return state !== void 0 && tokenFreeStates.has(state);
+}
+
 //#endregion
 //#region src/state/s3-state-backend.ts
 function errorDetail$2(error) {
@@ -5649,6 +5663,7 @@ var S3StateBackend = class S3StateBackend {
 			const bodyString = await response.Body.transformToString();
 			const parsed = this.parseStateBody(bodyString, stackName);
 			const { state, divergentBodyRegion } = this.adoptKeyRegion(parsed, region, shownStackName, shownRegionName);
+			if (!bodyMayCarryReferences(bodyString)) markTokenFreeState(state);
 			this.logger.debug(`Retrieved state: ${shownStackName} (${shownRegionName}), ETag: ${response.ETag}`);
 			return {
 				state,
@@ -5679,7 +5694,7 @@ var S3StateBackend = class S3StateBackend {
 		const { expectedEtag, migrateLegacy } = options;
 		const body = {
 			...state,
-			version: 11,
+			version: 12,
 			stackName,
 			region
 		};
@@ -7174,7 +7189,7 @@ const WHOLE_DYNAMIC_REFERENCE_PATTERN = new RegExp(`^\\{\\{resolve:${DYNAMIC_REF
 function isSingleDynamicReferenceToken(value) {
 	return WHOLE_DYNAMIC_REFERENCE_PATTERN.test(value);
 }
-function isPlainObject$4(value) {
+function isPlainObject$5(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
@@ -7423,7 +7438,7 @@ function crossStackSourceKey(source) {
 	}
 	if (key === "Fn::GetStackOutput") {
 		const args = source[key];
-		if (!isPlainObject$4(args)) return void 0;
+		if (!isPlainObject$5(args)) return void 0;
 		const stackName = Object.hasOwn(args, "StackName") ? literalStringOrUndefined(args["StackName"]) : void 0;
 		const outputName = Object.hasOwn(args, "OutputName") ? literalStringOrUndefined(args["OutputName"]) : void 0;
 		if (stackName === void 0 || outputName === void 0) return void 0;
@@ -7469,7 +7484,7 @@ function crossStackSourceKey(source) {
 		let template;
 		let variables;
 		if (typeof raw === "string") template = raw;
-		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$4(raw[1])) {
+		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$5(raw[1])) {
 			if (typeof raw[0] !== "string") return void 0;
 			template = raw[0];
 			variables = raw[1];
@@ -7712,12 +7727,12 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, rules = TEMPLATE_DERIVED_RULES) {
 	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$4) return;
 	if (secrets.size === 0) return;
-	if (!isPlainObject$4(resolvedProperties) || !isPlainObject$4(sourceProperties)) return;
+	if (!isPlainObject$5(resolvedProperties) || !isPlainObject$5(sourceProperties)) return;
 	if (!Object.hasOwn(resolvedProperties, "Parameters")) return;
 	if (!Object.hasOwn(sourceProperties, "Parameters")) return;
 	const resolvedParameters = resolvedProperties["Parameters"];
 	const sourceParameters = sourceProperties["Parameters"];
-	if (!isPlainObject$4(resolvedParameters) || !isPlainObject$4(sourceParameters)) return;
+	if (!isPlainObject$5(resolvedParameters) || !isPlainObject$5(sourceParameters)) return;
 	const positioned = redactSecretsForState(markSameGenerationBag({ ...resolvedParameters }), secrets, sourceParameters, rules);
 	let table = nestedStackParameterExpressions.get(secrets);
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
@@ -7766,7 +7781,7 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 		if (typeof resolvedValue !== "string") return void 0;
 		const sourceLeaf = sourceParameters[name];
 		if (typeof sourceLeaf === "string") return sourceLeaf;
-		if (!isPlainObject$4(sourceLeaf)) return void 0;
+		if (!isPlainObject$5(sourceLeaf)) return void 0;
 		const written = positioned[name];
 		if (typeof written !== "string") return void 0;
 		const rendered = intrinsicSkeletonSegments(sourceLeaf)?.map((s) => s === UNKNOWN_PART ? "\0" : s).join("");
@@ -7977,7 +7992,7 @@ function appendValuePlaceholderParts(value, out, budget, depth) {
 	if (budget.exhausted) return;
 	const literal = joinPartLiteralText(value);
 	if (literal !== void 0) return pushPlaceholderPart(out, literal, budget);
-	if (isPlainObject$4(value) && Object.keys(value).length === 1) {
+	if (isPlainObject$5(value) && Object.keys(value).length === 1) {
 		const ref = value["Ref"];
 		if (typeof ref === "string" && ref !== "") return pushPlaceholderPart(out, keyedPart({ Ref: ref }), budget);
 		if (depth >= MAX_PLACEHOLDER_DEPTH) {
@@ -8009,7 +8024,7 @@ function appendParameterPlaceholderParts(source, out, budget, depth) {
 		let template;
 		let variables = {};
 		if (typeof args === "string") template = args;
-		else if (Array.isArray(args) && args.length === 2 && isPlainObject$4(args[1])) {
+		else if (Array.isArray(args) && args.length === 2 && isPlainObject$5(args[1])) {
 			template = args[0];
 			variables = args[1];
 		} else return false;
@@ -8157,7 +8172,7 @@ function isUniquelyKeyedBy(items, key) {
 	if (items.length === 0) return false;
 	const seen = /* @__PURE__ */ new Set();
 	for (const item of items) {
-		if (!isPlainObject$4(item) || !Object.hasOwn(item, key)) return false;
+		if (!isPlainObject$5(item) || !Object.hasOwn(item, key)) return false;
 		const id = item[key];
 		if (typeof id !== "string" || id === "") return false;
 		if (seen.has(id)) return false;
@@ -8187,11 +8202,11 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		return positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration);
 	}
-	if ((typeof bag === "string" || Array.isArray(bag)) && isPlainObject$4(source)) {
+	if ((typeof bag === "string" || Array.isArray(bag)) && isPlainObject$5(source)) {
 		const inherited = positionByInheritedParameter(bag, source, secrets);
 		if (inherited !== void 0) return inherited;
 	}
-	if (typeof bag === "string" && isPlainObject$4(source)) {
+	if (typeof bag === "string" && isPlainObject$5(source)) {
 		const certified = positionByCrossStackSource(bag, source, secrets);
 		if (certified !== void 0) return certified;
 		const placeheld = positionByParameterPlaceholders(bag, source, secrets);
@@ -8201,7 +8216,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		const framed = positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIsSameGeneration);
 		if (framed !== void 0) return framed;
 	}
-	if (Array.isArray(bag) && isPlainObject$4(source)) {
+	if (Array.isArray(bag) && isPlainObject$5(source)) {
 		const positionedList = positionListByCrossStackSource(bag, source, secrets);
 		if (positionedList !== void 0) return positionedList;
 	}
@@ -8229,7 +8244,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration));
 	}
-	if (isPlainObject$4(bag) && hasPlainPrototype(bag) && isPlainObject$4(source)) {
+	if (isPlainObject$5(bag) && hasPlainPrototype(bag) && isPlainObject$5(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactSecretsForState(v, secrets);
 		return out;
@@ -8242,7 +8257,7 @@ function isReadbackProjectedFromState(rules) {
 function subtreeHasDynamicReference(value) {
 	if (isDynamicReferenceString(value)) return true;
 	if (Array.isArray(value)) return value.some(subtreeHasDynamicReference);
-	if (isPlainObject$4(value)) return Object.values(value).some(subtreeHasDynamicReference);
+	if (isPlainObject$5(value)) return Object.values(value).some(subtreeHasDynamicReference);
 	return false;
 }
 function pathCrossesDottedKey(bag, path) {
@@ -8317,8 +8332,8 @@ function deepEqualJsonValue(a, b) {
 		if (!Array.isArray(b) || a.length !== b.length) return false;
 		return a.every((item, i) => deepEqualJsonValue(item, b[i]));
 	}
-	if (isPlainObject$4(a)) {
-		if (!isPlainObject$4(b)) return false;
+	if (isPlainObject$5(a)) {
+		if (!isPlainObject$5(b)) return false;
 		if (!hasPlainPrototype(a) || !hasPlainPrototype(b)) return false;
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
@@ -8344,7 +8359,7 @@ function refuseUncertifiedSubtree(value, sourceLiterals, mark, seen = /* @__PURE
 		for (const item of value) out.push(refuseUncertifiedSubtree(item, sourceLiterals, mark, seen));
 		return out;
 	}
-	if (isPlainObject$4(value) && hasPlainPrototype(value)) {
+	if (isPlainObject$5(value) && hasPlainPrototype(value)) {
 		const out = Object.create(null);
 		seen.set(value, out);
 		for (const [k, v] of Object.entries(value)) out[k] = refuseUncertifiedSubtree(v, sourceLiterals, mark, seen);
@@ -8372,7 +8387,7 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 		return mark ? POSITION_DECIDED : source;
 	}
 	if (!subtreeHasDynamicReference(source)) return bag;
-	if (isPlainObject$4(bag) && hasPlainPrototype(bag) && isPlainObject$4(source)) {
+	if (isPlainObject$5(bag) && hasPlainPrototype(bag) && isPlainObject$5(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, failClosed, learn, mark) : v;
 		return out;
@@ -8399,14 +8414,14 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 function isDistinguishingAnchor(value) {
 	if (typeof value === "string") return value !== "";
 	if (Array.isArray(value)) return value.some(isDistinguishingAnchor);
-	if (isPlainObject$4(value)) return Object.values(value).some(isDistinguishingAnchor);
+	if (isPlainObject$5(value)) return Object.values(value).some(isDistinguishingAnchor);
 	return false;
 }
 const ANCHOR_REFERENCE_MASK = "<ref>";
 function anchorSignature(source) {
 	if (isDynamicReferenceString(source)) return ANCHOR_REFERENCE_MASK;
 	if (Array.isArray(source)) return `[${source.map(anchorSignature).sort().join(",")}]`;
-	if (isPlainObject$4(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
+	if (isPlainObject$5(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
 	return JSON.stringify(source) ?? "undefined";
 }
 function anchorsCorroboratePairing(bag, source, anchors) {
@@ -8416,8 +8431,8 @@ function anchorsCorroboratePairing(bag, source, anchors) {
 		return true;
 	}
 	if (isDynamicReferenceString(source)) return typeof bag === "string";
-	if (isPlainObject$4(source)) {
-		if (!isPlainObject$4(bag)) return false;
+	if (isPlainObject$5(source)) {
+		if (!isPlainObject$5(bag)) return false;
 		return Object.keys(source).every((k) => Object.hasOwn(bag, k) && anchorsCorroboratePairing(bag[k], source[k], anchors));
 	}
 	if (Array.isArray(source)) {
@@ -8508,13 +8523,13 @@ function learnMixedLeafNeedle(collector, bag, source) {
 	learnNeedle(collector, plaintext, token);
 }
 function asChild(marks, key) {
-	return isPlainObject$4(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
+	return isPlainObject$5(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
 }
 function asIndex(marks, index) {
 	return Array.isArray(marks) ? marks[index] : void 0;
 }
 function preferPositionDecisions(scanned, refused, bag, marks, inferred) {
-	if (isPlainObject$4(bag) && hasPlainPrototype(bag) && isPlainObject$4(refused) && isPlainObject$4(scanned)) {
+	if (isPlainObject$5(bag) && hasPlainPrototype(bag) && isPlainObject$5(refused) && isPlainObject$5(scanned)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(refused)) out[k] = preferPositionDecisions(scanned[k], v, bag[k], asChild(marks, k), inferred);
 		return out;
@@ -8953,6 +8968,95 @@ function positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIs
 	}, bagIsSameGeneration);
 }
 
+//#endregion
+//#region src/deployment/secret-redaction/reference-provenance.ts
+const passProvenanceOf = /* @__PURE__ */ new WeakMap();
+const MAX_REFERENCE_VERSIONS = 8;
+function entryFor(secrets, token) {
+	let table = passProvenanceOf.get(secrets);
+	if (table === void 0) {
+		table = /* @__PURE__ */ new Map();
+		passProvenanceOf.set(secrets, table);
+	}
+	let entry = table.get(token);
+	if (entry === void 0) {
+		entry = {
+			regions: /* @__PURE__ */ new Set(),
+			regionUnknown: false,
+			versions: /* @__PURE__ */ new Set(),
+			versionUnknown: false,
+			readVersions: /* @__PURE__ */ new Set()
+		};
+		table.set(token, entry);
+	}
+	return entry;
+}
+function recordReferenceResolution(secrets, token, resolution) {
+	const entry = entryFor(secrets, token);
+	if (resolution.region === void 0) entry.regionUnknown = true;
+	else entry.regions.add(resolution.region);
+	if (resolution.version === void 0) {
+		entry.versionUnknown = true;
+		return;
+	}
+	entry.versions.add(resolution.version);
+	if (resolution.route === "read") entry.readVersions.add(resolution.version);
+}
+function recordReferenceProvenanceEntry(secrets, token, provenance, route) {
+	const entry = entryFor(secrets, token);
+	if (provenance.region === void 0) entry.regionUnknown = true;
+	else entry.regions.add(provenance.region);
+	if (provenance.versions === void 0 || provenance.versions.length === 0) {
+		entry.versionUnknown = true;
+		return;
+	}
+	for (const version of provenance.versions) {
+		entry.versions.add(version);
+		if (route === "read") entry.readVersions.add(version);
+	}
+	if (route === "literal") for (const version of provenance.readVersions ?? []) entry.readVersions.add(version);
+}
+function mergeReferenceProvenance(from, to) {
+	const source = passProvenanceOf.get(from);
+	if (source === void 0 || from === to) return;
+	for (const [token, entry] of source) {
+		const target = entryFor(to, token);
+		for (const region of entry.regions) target.regions.add(region);
+		target.regionUnknown ||= entry.regionUnknown;
+		for (const version of entry.versions) target.versions.add(version);
+		target.versionUnknown ||= entry.versionUnknown;
+		for (const version of entry.readVersions) target.readVersions.add(version);
+	}
+}
+function hasPassProvenance(secrets) {
+	if (secrets === void 0) return false;
+	const table = passProvenanceOf.get(secrets);
+	return table !== void 0 && table.size > 0;
+}
+function passProvenanceFor(secrets, token) {
+	if (secrets === void 0) return void 0;
+	const entry = passProvenanceOf.get(secrets)?.get(token);
+	if (entry === void 0) return void 0;
+	return finalize(entry);
+}
+function finalize(entry) {
+	const out = {};
+	if (!entry.regionUnknown && entry.regions.size === 1) out.region = [...entry.regions][0];
+	if (!entry.versionUnknown && entry.versions.size > 0 && entry.versions.size <= 8) {
+		out.versions = [...entry.versions].sort();
+		if (entry.readVersions.size > 0) out.readVersions = [...entry.readVersions].sort();
+	}
+	return out;
+}
+function snapshotPassProvenance(secrets) {
+	if (secrets === void 0) return void 0;
+	const table = passProvenanceOf.get(secrets);
+	if (table === void 0 || table.size === 0) return void 0;
+	const out = /* @__PURE__ */ new Map();
+	for (const [token, entry] of table) out.set(token, finalize(entry));
+	return out;
+}
+
 //#endregion
 //#region src/deployment/secret-redaction/pairs.ts
 const resolvedPairsOf = /* @__PURE__ */ new WeakMap();
@@ -8973,6 +9077,7 @@ function recordResolvedPair(secrets, expression, plaintext) {
 }
 function mergeResolvedPairs(from, to) {
 	carryMaskOnlyMarks(from, to);
+	mergeReferenceProvenance(from, to);
 	const pairs = resolvedPairsOf.get(from);
 	if (pairs === void 0) return;
 	for (const [expression, plaintext] of pairs) if (typeof plaintext === "string") recordResolvedPair(to, expression, plaintext);
@@ -9543,7 +9648,7 @@ function readsNoEchoSource(node, sources) {
 			if (typeof argument === "string") return subStringReadsNoEcho(argument, void 0, sources);
 			if (Array.isArray(argument)) {
 				const [text, variables] = argument;
-				const vars = isPlainObject$4(variables) ? variables : void 0;
+				const vars = isPlainObject$5(variables) ? variables : void 0;
 				if (typeof text === "string" && subStringReadsNoEcho(text, vars, sources)) return true;
 				return vars !== void 0 && Object.values(vars).some(walk);
 			}
@@ -9577,7 +9682,7 @@ function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
 		parameters: sources.parameters,
 		...sources.conditions !== void 0 && { conditions: sources.conditions }
 	};
-	const isBareDeclaredGetAtt = (node) => isPlainObject$4(node) && intrinsicKeyOf(node) === "Fn::GetAtt" && getAttReadsNoEcho(node["Fn::GetAtt"], sources);
+	const isBareDeclaredGetAtt = (node) => isPlainObject$5(node) && intrinsicKeyOf(node) === "Fn::GetAtt" && getAttReadsNoEcho(node["Fn::GetAtt"], sources);
 	const walk = (source, value, path) => {
 		if (value === void 0) return;
 		if (source === null || typeof source !== "object") return;
@@ -9593,7 +9698,7 @@ function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
 			const record = source;
 			const intrinsic = intrinsicKeyOf(record);
 			if (intrinsic === void 0) {
-				if (!isPlainObject$4(value)) {
+				if (!isPlainObject$5(value)) {
 					if (readsNoEchoSource(record, parametersOnly)) push(path, source);
 					return;
 				}
@@ -9641,7 +9746,7 @@ function maskWholeValue(value) {
 	if (value === null || value === void 0) return value;
 	if (typeof value === "string" && isSingleDynamicReferenceToken(value)) return value;
 	if (Array.isArray(value)) return value.map(maskWholeValue);
-	if (isPlainObject$4(value)) {
+	if (isPlainObject$5(value)) {
 		const out = {};
 		for (const [key, child] of Object.entries(value)) Object.defineProperty(out, key, {
 			value: maskWholeValue(child),
@@ -9664,7 +9769,7 @@ function readAt(bag, coordinate) {
 			node = node[segment];
 			continue;
 		}
-		if (!isPlainObject$4(node) || !Object.hasOwn(node, segment)) return {
+		if (!isPlainObject$5(node) || !Object.hasOwn(node, segment)) return {
 			found: false,
 			value: void 0
 		};
@@ -9680,7 +9785,7 @@ function valueAtCoordinate(bag, coordinate) {
 }
 function cloneContainer(node) {
 	if (Array.isArray(node)) return [...node];
-	if (isPlainObject$4(node)) return { ...node };
+	if (isPlainObject$5(node)) return { ...node };
 	return node;
 }
 function maskAtCoordinates(bag, coordinates) {
@@ -9747,20 +9852,20 @@ function readbackPathFor(readback, properties, coordinate) {
 			if (!Array.isArray(live)) return path.length === 0 ? void 0 : path;
 			const key = Array.isArray(desired) ? identityKeyFor(live, desired) : void 0;
 			const element = Array.isArray(desired) ? desired[segment] : void 0;
-			if (key === void 0 || !isPlainObject$4(element)) return path;
+			if (key === void 0 || !isPlainObject$5(element)) return path;
 			const identity = element[key];
-			const index = live.findIndex((item) => isPlainObject$4(item) && item[key] === identity);
+			const index = live.findIndex((item) => isPlainObject$5(item) && item[key] === identity);
 			if (index < 0) return path;
 			path.push(index);
 			live = live[index];
 			desired = element;
 			continue;
 		}
-		if (!isPlainObject$4(live)) return path.length === 0 ? void 0 : path;
+		if (!isPlainObject$5(live)) return path.length === 0 ? void 0 : path;
 		if (!Object.hasOwn(live, segment)) return void 0;
 		path.push(segment);
 		live = live[segment];
-		desired = isPlainObject$4(desired) ? desired[segment] : void 0;
+		desired = isPlainObject$5(desired) ? desired[segment] : void 0;
 	}
 	return path;
 }
@@ -9789,7 +9894,7 @@ function witnessNormalize(stored, today, v11) {
 	const confirmed = [];
 	const differing = [];
 	const walk = (s, t, v, path) => {
-		if (v !== "***" && containsMask(v) && (Array.isArray(v) ? !Array.isArray(s) || s.length !== v.length : isPlainObject$4(v) ? !isPlainObject$4(s) : false)) {
+		if (v !== "***" && containsMask(v) && (Array.isArray(v) ? !Array.isArray(s) || s.length !== v.length : isPlainObject$5(v) ? !isPlainObject$5(s) : false)) {
 			if (s === void 0 || containsMask(s)) return s;
 			if (jsonEqual(s, t)) {
 				confirmed.push(path);
@@ -9818,8 +9923,8 @@ function witnessNormalize(stored, today, v11) {
 			});
 			return changed ? out : s;
 		}
-		if (isPlainObject$4(v) && isPlainObject$4(s)) {
-			const tt = isPlainObject$4(t) ? t : {};
+		if (isPlainObject$5(v) && isPlainObject$5(s)) {
+			const tt = isPlainObject$5(t) ? t : {};
 			let out;
 			for (const key of Object.keys(v)) {
 				if (!Object.hasOwn(s, key)) continue;
@@ -9842,7 +9947,7 @@ function witnessNormalize(stored, today, v11) {
 function containsMask(value) {
 	if (value === "***") return true;
 	if (Array.isArray(value)) return value.some(containsMask);
-	if (isPlainObject$4(value)) return Object.values(value).some(containsMask);
+	if (isPlainObject$5(value)) return Object.values(value).some(containsMask);
 	return false;
 }
 function jsonEqual(a, b) {
@@ -9886,7 +9991,7 @@ function noEchoComparison(options) {
 					const out = node.map(walk);
 					return out.some((item, i) => item !== node[i]) ? out : node;
 				}
-				if (isPlainObject$4(node)) {
+				if (isPlainObject$5(node)) {
 					let out;
 					for (const [key, child] of Object.entries(node)) {
 						const next = walk(child);
@@ -11813,6 +11918,14 @@ const inFlightLookups = /* @__PURE__ */ new Map();
 function getCreateOnlyPropertyPaths(resourceType) {
 	return lookupCreateOnlyPropertyPaths(resourceType, false);
 }
+function cachedCreateOnlyPropertyPaths(resourceType) {
+	if (hasNoRegistrySchema(resourceType)) return Promise.resolve([]);
+	if (inFlightLookups.has(resourceType)) return void 0;
+	const cached = createOnlyPropertiesCache.get(resourceType);
+	if (cached !== void 0) return cached;
+	const snapshot = CREATE_ONLY_PATHS_SNAPSHOT.get(resourceType);
+	return snapshot === void 0 ? void 0 : Promise.resolve(snapshot);
+}
 function prefetchCreateOnlyPropertyPaths(resourceTypes) {
 	const started = [];
 	for (const type of new Set(resourceTypes)) {
@@ -12765,7 +12878,7 @@ function probeFoundSameId(resourceType, a, b) {
 //#region src/provisioning/config-shape.ts
 function readConfigString(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return fallback;
-	if (!isPlainObject$3(container) || isUnresolvedIntrinsicContainer(container)) {
+	if (!isPlainObject$4(container) || isUnresolvedIntrinsicContainer(container)) {
 		const detail = malformedShapeDetail(container);
 		if (options?.onUnusable) {
 			const named = fallback === "" ? "" : ` (${fallback})`;
@@ -12805,7 +12918,7 @@ function requireConfigArray(value, path, options) {
 	return value;
 }
 function requireConfigObject(value, path, options) {
-	if (!isPlainObject$3(value) || isUnresolvedIntrinsicContainer(value)) {
+	if (!isPlainObject$4(value) || isUnresolvedIntrinsicContainer(value)) {
 		const detail = malformedShapeDetail(value);
 		if (options?.onUnusable) {
 			options.onUnusable(`${path} must be an object ${detail}. Leaving this configuration unapplied here; the same value is REFUSED on a template-path create.`);
@@ -12817,7 +12930,7 @@ function requireConfigObject(value, path, options) {
 }
 function configStringRefusal(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$3(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$4(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	return configValueRefusal(container[key], fallback, `${containerPath}.${key}`, options);
 }
 function coerceCfnBoolean(value) {
@@ -12830,7 +12943,7 @@ function coerceCfnBoolean(value) {
 }
 function configBooleanRefusal(container, key, containerPath) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$3(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$4(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	if (coerceCfnBoolean(value) !== void 0) return void 0;
@@ -12844,7 +12957,7 @@ function coerceCfnInteger(value) {
 }
 function configIntegerRefusal(container, key, containerPath, min, max) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$3(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$4(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	const n = coerceCfnInteger(value);
@@ -12858,10 +12971,10 @@ function configValueRefusal(value, fallback, path, options) {
 	if (typeof value !== "string" || value.trim() === "") return `${path} must be a non-empty string ${malformedShapeDetail(value)}`;
 }
 function malformedShapeDetail(value) {
-	if (isPlainObject$3(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
+	if (isPlainObject$4(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
 	return `(got ${describe(value)}) — check for an unresolved intrinsic or a mis-nested template value`;
 }
-function isPlainObject$3(value) {
+function isPlainObject$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 const NAMEABLE_INTRINSIC_KEYS = /* @__PURE__ */ new Set([
@@ -12888,7 +13001,7 @@ function describe(value) {
 	if (value === null) return "null";
 	if (Array.isArray(value)) return "an array";
 	if (typeof value === "string") return value.trim() === "" ? "a blank string" : "a string";
-	if (isPlainObject$3(value) && isUnresolvedIntrinsicContainer(value)) {
+	if (isPlainObject$4(value) && isUnresolvedIntrinsicContainer(value)) {
 		const key = Object.keys(value)[0];
 		return NAMEABLE_INTRINSIC_KEYS.has(key) ? `an unresolved ${key} intrinsic` : "an unresolved intrinsic";
 	}
@@ -17778,7 +17891,7 @@ function maskedPropertyFingerprint(templateValue) {
 	return `${FINGERPRINT_PREFIX}${digest}`;
 }
 var UnknownInput = class extends Error {};
-function isPlainObject$2(value) {
+function isPlainObject$3(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 const DYNAMIC_REFERENCE_OPEN = "{{resolve:";
@@ -17798,7 +17911,7 @@ function carriesSecretValue(value, corpora) {
 	return false;
 }
 function parameterInputsFor(args) {
-	const declared = isPlainObject$2(args.template.Parameters) ? args.template.Parameters : {};
+	const declared = isPlainObject$3(args.template.Parameters) ? args.template.Parameters : {};
 	const values = args.values ?? {};
 	const inputs = /* @__PURE__ */ new Map();
 	const bound = {};
@@ -17809,7 +17922,7 @@ function parameterInputsFor(args) {
 			continue;
 		}
 		const value = values[name];
-		let secret = isPlainObject$2(definition) && declaresNoEcho(definition) || carriesSecretValue(value, []);
+		let secret = isPlainObject$3(definition) && declaresNoEcho(definition) || carriesSecretValue(value, []);
 		if (!secret && args.nestedChild === true && args.supplied !== void 0) {
 			if (Object.hasOwn(args.supplied, name)) {
 				const passed = args.passedClasses?.get(name);
@@ -17860,7 +17973,7 @@ function intrinsicKey(value) {
 const OPAQUE_ATTRIBUTE_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::CustomResource", NESTED_STACK_TYPE$4]);
 function hasOpaqueAttributes(logicalId, walk) {
 	const definition = walk.resources[logicalId];
-	const type = isPlainObject$2(definition) ? definition["Type"] : void 0;
+	const type = isPlainObject$3(definition) ? definition["Type"] : void 0;
 	return typeof type === "string" && (type.startsWith("Custom::") || OPAQUE_ATTRIBUTE_TYPES.has(type));
 }
 function getAttTarget(operand) {
@@ -17885,7 +17998,7 @@ function taintOf(logicalId, walk) {
 	const visit = (value) => {
 		if (typeof value === "string") return value.includes(DYNAMIC_REFERENCE_OPEN);
 		if (Array.isArray(value)) return value.some(visit);
-		if (!isPlainObject$2(value)) return false;
+		if (!isPlainObject$3(value)) return false;
 		const key = intrinsicKey(value);
 		const operand = key === void 0 ? void 0 : value[key];
 		let verdict = "clean";
@@ -17897,7 +18010,7 @@ function taintOf(logicalId, walk) {
 		else if (key === "Fn::FindInMap" && mapReadClass(operand, walk.sources.template) !== "clean") verdict = "tainted";
 		else if (key === "Fn::Sub") {
 			const text = Array.isArray(operand) ? operand[0] : operand;
-			const vars = Array.isArray(operand) && isPlainObject$2(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$3(operand[1]) ? operand[1] : {};
 			if (typeof text === "string") for (const name of subPlaceholders(text)) {
 				if (Object.hasOwn(vars, name)) continue;
 				const owner = name.includes(".") ? name.split(".")[0] : name;
@@ -17911,7 +18024,7 @@ function taintOf(logicalId, walk) {
 		return Object.values(value).some(visit);
 	};
 	const definition = walk.resources[logicalId];
-	const result = visit(isPlainObject$2(definition) ? definition["Properties"] : void 0) ? "tainted" : unknown ? "unknown" : "clean";
+	const result = visit(isPlainObject$3(definition) ? definition["Properties"] : void 0) ? "tainted" : unknown ? "unknown" : "clean";
 	walk.inProgress.delete(logicalId);
 	walk.taint.set(logicalId, result);
 	return result;
@@ -17927,7 +18040,7 @@ function conditionInput(name, walk) {
 	return typeof verdict === "boolean" ? verdict : "unknown";
 }
 function conditionClosure(name, walk) {
-	const definitions = isPlainObject$2(walk.sources.template.Conditions) ? walk.sources.template.Conditions : {};
+	const definitions = isPlainObject$3(walk.sources.template.Conditions) ? walk.sources.template.Conditions : {};
 	let secret = false;
 	let unknown = false;
 	let unread = false;
@@ -17942,7 +18055,7 @@ function conditionClosure(name, walk) {
 			value.forEach(visit);
 			return;
 		}
-		if (!isPlainObject$2(value)) return;
+		if (!isPlainObject$3(value)) return;
 		const keys = Object.keys(value);
 		if (keys.length === 1 && keys[0] === "Condition" && typeof value["Condition"] === "string") {
 			pending.push(value["Condition"]);
@@ -17975,7 +18088,7 @@ function conditionClosure(name, walk) {
 		if (key === "Fn::Sub") {
 			const operand = value["Fn::Sub"];
 			const text = Array.isArray(operand) ? operand[0] : operand;
-			const vars = Array.isArray(operand) && isPlainObject$2(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$3(operand[1]) ? operand[1] : {};
 			if (typeof text === "string") for (const name of subPlaceholders(text)) {
 				if (Object.hasOwn(vars, name)) continue;
 				if (name.includes(".") && !name.startsWith("AWS::")) secret = true;
@@ -18004,8 +18117,8 @@ function mapReadClass(operand, template) {
 	const mapName = Array.isArray(operand) ? operand[0] : void 0;
 	if (typeof mapName !== "string") return "unknown";
 	const mappings = template.Mappings;
-	const map = isPlainObject$2(mappings) && Object.hasOwn(mappings, mapName) ? mappings[mapName] : void 0;
-	if (!isPlainObject$2(map)) return "unknown";
+	const map = isPlainObject$3(mappings) && Object.hasOwn(mappings, mapName) ? mappings[mapName] : void 0;
+	if (!isPlainObject$3(map)) return "unknown";
 	return carriesSecretValue(map, []) ? "secret" : "clean";
 }
 async function resolvedInput(node, walk) {
@@ -18073,7 +18186,7 @@ async function inputForm(value, walk) {
 			concrete: parts.every((p) => p.concrete)
 		};
 	}
-	if (!isPlainObject$2(value)) return {
+	if (!isPlainObject$3(value)) return {
 		form: value,
 		concrete: true
 	};
@@ -18136,7 +18249,7 @@ async function inputForm(value, walk) {
 					concrete: false
 				};
 			}
-			const explicit = Array.isArray(operand) && isPlainObject$2(operand[1]) ? operand[1] : {};
+			const explicit = Array.isArray(operand) && isPlainObject$3(operand[1]) ? operand[1] : {};
 			const vars = await inputForm(explicit, walk);
 			const placeholders = [];
 			let concrete = vars.concrete && !text.includes(DYNAMIC_REFERENCE_OPEN);
@@ -18189,8 +18302,8 @@ function newWalk(sources, nested = {
 }) {
 	return {
 		sources,
-		resources: isPlainObject$2(sources.template.Resources) ? sources.template.Resources : {},
-		parameters: isPlainObject$2(sources.template.Parameters) ? sources.template.Parameters : {},
+		resources: isPlainObject$3(sources.template.Resources) ? sources.template.Resources : {},
+		parameters: isPlainObject$3(sources.template.Parameters) ? sources.template.Parameters : {},
 		taint: /* @__PURE__ */ new Map(),
 		inProgress: /* @__PURE__ */ new Set(),
 		stackChain: nested.stackChain,
@@ -18214,34 +18327,34 @@ function passedKey(passed) {
 function isNestedStackRow(logicalId, walk) {
 	if (!Object.hasOwn(walk.resources, logicalId)) return false;
 	const definition = walk.resources[logicalId];
-	return isPlainObject$2(definition) && definition["Type"] === NESTED_STACK_TYPE$4;
+	return isPlainObject$3(definition) && definition["Type"] === NESTED_STACK_TYPE$4;
 }
 function getAttAttribute(operand, target) {
 	if (Array.isArray(operand)) return operand.length === 2 && typeof operand[1] === "string" ? operand[1] : void 0;
 	return typeof operand === "string" ? operand.slice(target.length + 1) : void 0;
 }
 function rowParameters(definition) {
-	const properties = isPlainObject$2(definition) ? definition["Properties"] : void 0;
+	const properties = isPlainObject$3(definition) ? definition["Properties"] : void 0;
 	if (properties === void 0) return {};
-	if (!isPlainObject$2(properties)) return "unknown";
+	if (!isPlainObject$3(properties)) return "unknown";
 	const parameters = properties["Parameters"];
 	if (parameters === void 0) return {};
-	if (!isPlainObject$2(parameters) || intrinsicKey(parameters) !== void 0) return "unknown";
+	if (!isPlainObject$3(parameters) || intrinsicKey(parameters) !== void 0) return "unknown";
 	return parameters;
 }
 function childParameterInputs(template, passed) {
-	const declared = isPlainObject$2(template.Parameters) ? template.Parameters : {};
+	const declared = isPlainObject$3(template.Parameters) ? template.Parameters : {};
 	const inputs = /* @__PURE__ */ new Map();
 	for (const name of Object.keys(declared)) {
 		const definition = declared[name];
-		if (isPlainObject$2(definition) && declaresNoEcho(definition)) inputs.set(name, { kind: "secret" });
+		if (isPlainObject$3(definition) && declaresNoEcho(definition)) inputs.set(name, { kind: "secret" });
 		else if (passed.has(name)) {
 			const passedClass = passed.get(name);
 			inputs.set(name, passedClass === "clean" ? {
 				kind: "value",
 				value: void 0
 			} : passedClass === "unknown" ? { kind: "unknown" } : { kind: "secret" });
-		} else if (isPlainObject$2(definition) && Object.hasOwn(definition, "Default") && !carriesSecretValue(definition["Default"], [])) inputs.set(name, {
+		} else if (isPlainObject$3(definition) && Object.hasOwn(definition, "Default") && !carriesSecretValue(definition["Default"], [])) inputs.set(name, {
 			kind: "value",
 			value: definition["Default"]
 		});
@@ -18258,7 +18371,7 @@ function closureClass(closure) {
 	return closure.unread ? "unread" : "clean";
 }
 async function childOutputClass(loaded, outputName, passed, chain, shared) {
-	if (loaded === void 0 || !isPlainObject$2(loaded.template)) return "unknown";
+	if (loaded === void 0 || !isPlainObject$3(loaded.template)) return "unknown";
 	const scopeKey = JSON.stringify([loaded.identity, passedKey(passed)]);
 	const memoKey = JSON.stringify([scopeKey, outputName]);
 	const memo = shared.outputs.get(memoKey);
@@ -18271,8 +18384,8 @@ async function classifyChildOutput(loaded, outputName, passed, chain, shared, sc
 	if (++shared.steps > MAX_NESTED_OUTPUT_STEPS) return "unknown";
 	if (chain.includes(loaded.identity) || chain.length >= MAX_NESTED_OUTPUT_DEPTH) return "unknown";
 	const template = loaded.template;
-	const output = (isPlainObject$2(template.Outputs) ? template.Outputs : {})[outputName];
-	if (!isPlainObject$2(output) || !Object.hasOwn(output, "Value")) return "unknown";
+	const output = (isPlainObject$3(template.Outputs) ? template.Outputs : {})[outputName];
+	if (!isPlainObject$3(output) || !Object.hasOwn(output, "Value")) return "unknown";
 	const scope = {
 		walk: newWalk({
 			template,
@@ -18344,7 +18457,7 @@ async function expressionClass(value, scope) {
 		return result;
 	};
 	if (Array.isArray(value)) return all(value);
-	if (!isPlainObject$2(value)) return "clean";
+	if (!isPlainObject$3(value)) return "clean";
 	const key = intrinsicKey(value);
 	if (key === void 0) return all(Object.values(value));
 	const operand = value[key];
@@ -18359,7 +18472,7 @@ async function expressionClass(value, scope) {
 		case "Fn::Sub": {
 			const text = Array.isArray(operand) ? operand[0] : operand;
 			if (typeof text !== "string") return worseOf("unknown", await expressionClass(operand, scope));
-			const vars = Array.isArray(operand) && isPlainObject$2(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$3(operand[1]) ? operand[1] : {};
 			let result = text.includes(DYNAMIC_REFERENCE_OPEN) ? "secret" : "clean";
 			result = worseOf(result, await all(Object.values(vars)));
 			for (const name of subPlaceholders(text)) {
@@ -18437,7 +18550,7 @@ async function classifyPassedParameters(parameters, sources) {
 }
 async function classifyPassed(parameters, sources, nested) {
 	const classes = /* @__PURE__ */ new Map();
-	if (!isPlainObject$2(parameters)) return classes;
+	if (!isPlainObject$3(parameters)) return classes;
 	for (const [name, expression] of Object.entries(parameters)) {
 		let passedClass;
 		try {
@@ -18478,7 +18591,7 @@ function possiblyMaskedKeys(resolvedProps, corpora) {
 	const wholeShortLeaf = (value) => {
 		if (typeof value === "string") return short.includes(value);
 		if (Array.isArray(value)) return value.some(wholeShortLeaf);
-		if (isPlainObject$2(value)) return Object.values(value).some(wholeShortLeaf);
+		if (isPlainObject$3(value)) return Object.values(value).some(wholeShortLeaf);
 		return false;
 	};
 	return Object.keys(resolvedProps).filter((key) => {
@@ -18509,7 +18622,7 @@ function maskedPropertyFingerprintsOf(record) {
 	const read = /* @__PURE__ */ new Map();
 	if (record === null || typeof record !== "object") return read;
 	const field = record.maskedPropertyFingerprints;
-	if (!isPlainObject$2(field)) return read;
+	if (!isPlainObject$3(field)) return read;
 	for (const [key, value] of Object.entries(field)) if (typeof value === "string" && value.startsWith(FINGERPRINT_PREFIX)) read.set(key, value);
 	return read;
 }
@@ -18517,7 +18630,7 @@ function maskedPropertyInputFingerprintsOf(record) {
 	const read = /* @__PURE__ */ new Map();
 	if (record === null || typeof record !== "object") return read;
 	const field = record.maskedPropertyInputFingerprints;
-	if (!isPlainObject$2(field)) return read;
+	if (!isPlainObject$3(field)) return read;
 	const text = maskedPropertyFingerprintsOf(record);
 	for (const [key, value] of Object.entries(field)) {
 		if (typeof value !== "string" || !value.startsWith(INPUT_FINGERPRINT_PREFIX)) continue;
@@ -18564,7 +18677,7 @@ async function movedMaskedProperties(record, templateProps, fingerprinter, onReb
 function withRebaselinedFingerprints(record, fingerprints) {
 	const text = maskedPropertyFingerprintsOf(record);
 	const field = record.maskedPropertyInputFingerprints;
-	const next = isPlainObject$2(field) ? Object.entries(field) : [];
+	const next = isPlainObject$3(field) ? Object.entries(field) : [];
 	let changed = false;
 	for (const [key, value] of Object.entries(fingerprints)) {
 		if (text.get(key) !== splitInputFingerprint(value).text) continue;
@@ -18597,10 +18710,10 @@ function withMaskedPropertyFingerprints(scrubbed, writtenBag, templateProps, sec
 		fingerprints = maskedPropertyFingerprintsFor(scrubbed.properties, templateProps);
 		inputs = boundInputFingerprints(fingerprints, inputFingerprints);
 	} else {
-		if (!isPlainObject$2(previous)) return scrubbed;
+		if (!isPlainObject$3(previous)) return scrubbed;
 		if (corpora.length === 0) return scrubbed;
 		fingerprints = { ...previous };
-		inputs = isPlainObject$2(previousInputs) ? { ...previousInputs } : void 0;
+		inputs = isPlainObject$3(previousInputs) ? { ...previousInputs } : void 0;
 	}
 	if (fingerprints !== void 0 && corpora.length > 0) {
 		const refused = Object.keys(fingerprints).filter((key) => Object.hasOwn(templateProps, key) && corpora.some((corpus) => templateCarriesNeedle(templateProps[key], corpus)));
@@ -20026,6 +20139,17 @@ function recordProducerSecretPairs(logicalId, value, context) {
 	if (bag === void 0 || context.producerSecrets === void 0) return;
 	const producer = context.producerSecrets(logicalId);
 	if (producer === void 0 || producer === bag || producer.size === 0) return;
+	if (hasPassProvenance(producer)) {
+		const served = [...wholeStringLeavesOf(value)];
+		for (const [plaintext, expression] of producer) {
+			if (plaintext.length < 4 || !expression.startsWith("{{resolve:")) continue;
+			if (!served.some((leaf) => leaf.includes(plaintext))) continue;
+			const entry = passProvenanceFor(producer, expression);
+			if (entry === void 0) continue;
+			recordReferenceProvenanceEntry(bag, expression, entry, "read");
+			if (context.provenanceSink !== void 0) recordReferenceProvenanceEntry(context.provenanceSink, expression, entry, "read");
+		}
+	}
 	const preRun = context.producerPreRunPhysicalId?.(logicalId);
 	const record = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
 	if (typeof preRun !== "string" || record?.physicalId !== preRun) return;
@@ -20058,6 +20182,7 @@ async function reresolveRecordedReferences(value, logicalId, context, origin, so
 		return value;
 	}
 	if (!await this.referencesMatchPhysicalId(value, logicalId, context)) {
+		if (context.provenanceCapture) return value;
 		this.logger.warn(safeMsg`Serving ${this.displayMasked(origin, context)} as recorded, with its {{resolve:...}} reference(s) unresolved: cdkd cannot confirm the secret still holds the value ${this.displayMasked(logicalId, context)} was deployed with, because its physical id does not contain it. Either the secret changed since then (update ${this.displayMasked(logicalId, context)} so cdkd deploys it with the new value), or the value is not part of its name (a custom resource's Data, a name shorter than four characters), and cdkd sends the recorded reference as before.`);
 		return value;
 	}
@@ -20345,7 +20470,10 @@ async function reresolveCrossStackValue(value, producerRegion, context, origin,
 	}
 	if (!carriesDynamicReference(value)) return value;
 	const resolver = this.resolverForProducerRegion(producerRegion, context, producerRegionLogText);
-	const pinnedContext = producerRegion ? withoutProducerRegions(context) : context;
+	const pinnedContext = {
+		...producerRegion ? withoutProducerRegions(context) : context,
+		provenanceRoute: "read"
+	};
 	const walk = async (v) => {
 		if (typeof v === "string") return v.includes("{{resolve:") ? await resolver.resolveDynamicReferences(v, pinnedContext) : v;
 		if (Array.isArray(v)) {
@@ -21147,6 +21275,16 @@ async function getCrossAccountStackState(roleArn, stackName, region, context) {
 function secretVerdictScope(resolver) {
 	return injectiveKey(credentialFingerprint(ambientCredentialConfig()), canonicalizeRegion(resolver.explicitRegion) ?? "");
 }
+function recordProvenanceOfResolution(resolver, context, token, version) {
+	if (context === void 0) return;
+	const resolution = {
+		region: canonicalizeRegion(resolver.explicitRegion),
+		version,
+		route: context.provenanceRoute ?? "literal"
+	};
+	if (context.recordedSecretValues !== void 0) recordReferenceResolution(context.recordedSecretValues, token, resolution);
+	if (context.provenanceSink !== void 0) recordReferenceResolution(context.provenanceSink, token, resolution);
+}
 async function resolveDynamicReferences(value, context) {
 	return (await this.resolveDynamicReferencesWithLogTwin(value, value, context, void 0, true)).result;
 }
@@ -21214,6 +21352,7 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 					recorded.set(cached.value, fullMatch);
 					recordResolvedPair(recorded, fullMatch, cached.value);
 				}
+				if (cached.secret && cached.value) recordProvenanceOfResolution(this, context, fullMatch, cached.version);
 				if (service === "ssm" && !cached.secret && recorded && !this.producerRegionGuest) recordProvenPublicExpression(recorded, fullMatch, cached.value);
 				result = result.replace(fullMatch, () => cached.value);
 				twin = twin.replace(fullMatch, () => cached.secret && cached.value ? "***" : cached.value);
@@ -21229,8 +21368,12 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 			let isSecret = isKnownSecret;
 			let cacheable = true;
 			let pinSecureVerdict = false;
-			if (service === "secretsmanager") resolved = await this.resolveSecretsManagerReference(inner, context, nameLogText);
-			else if (service === "ssm") {
+			let resolvedVersion;
+			if (service === "secretsmanager") {
+				const versionOut = {};
+				resolved = await this.resolveSecretsManagerReference(inner, context, nameLogText, versionOut);
+				resolvedVersion = versionOut.version;
+			} else if (service === "ssm") {
 				const decrypt = context?.skipDynamicReferences !== true;
 				const param = await this.resolveSSMReference(parts, decrypt, "ssm", context, nameLogText);
 				const proofBag = context?.recordedSecretValues;
@@ -21253,11 +21396,13 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 					}
 				}
 				resolved = param.value;
+				resolvedVersion = param.version;
 			} else if (service === "ssm-secure") {
 				const param = await this.resolveSSMReference(parts, true, "ssm-secure", context, nameLogText);
 				if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${this.displayMasked(tokenLogText, context)}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
 				isSecret = true;
 				resolved = param.value;
+				resolvedVersion = param.version;
 			} else {
 				if (!persistedText && this.tokenAssembledFromSecret(fullMatch, tokenLogText, context)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${this.displayMasked(tokenLogText, context)}: its service is not one cdkd resolves (secretsmanager, ssm, ssm-secure), and the reference was assembled from a secret value, so leaving it as written would send that value to AWS and record it in state in the clear.`));
 				this.logger.warn(this.displayMasked(`Unsupported dynamic reference service: ${this.displayMasked(nameLogText(String(service)), context)}`, context));
@@ -21268,7 +21413,8 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 			if (pinSecureVerdict) this.pinSecretVerdict(fullMatch, true, verdictScope);
 			if (cacheable) this.cachedDynamicReferences.set(dynamicReferenceCacheKey, {
 				value: resolved,
-				secret: isSecret
+				secret: isSecret,
+				...resolvedVersion !== void 0 && { version: resolvedVersion }
 			});
 			if (isSecret && resolved) {
 				const recorded = context?.recordedSecretValues;
@@ -21276,6 +21422,7 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 					recorded.set(resolved, fullMatch);
 					recordResolvedPair(recorded, fullMatch, resolved);
 				}
+				recordProvenanceOfResolution(this, context, fullMatch, resolvedVersion);
 				if (service === "secretsmanager" || service === "ssm-secure") this.pinSecretVerdict(fullMatch, true, verdictScope);
 			}
 			result = result.replace(fullMatch, () => resolved);
@@ -21312,7 +21459,7 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 
 //#endregion
 //#region src/deployment/intrinsic-resolver/dynamic-ref-lookups.ts
-async function resolveSecretsManagerReference(inner, context, nameLogText) {
+async function resolveSecretsManagerReference(inner, context, nameLogText, versionOut) {
 	const afterService = inner.substring(15);
 	let secretId;
 	let jsonKey = "";
@@ -21350,11 +21497,13 @@ async function resolveSecretsManagerReference(inner, context, nameLogText) {
 		...versionStage && versionStage !== "" && { VersionStage: versionStage },
 		...versionId && versionId !== "" && { VersionId: versionId }
 	});
-	const secretString = (await this.sendWithThrottleRetry(() => client.send(command), `secretsmanager:${loggedSecretId}`, this.namedRequestMasks([
+	const response = await this.sendWithThrottleRetry(() => client.send(command), `secretsmanager:${loggedSecretId}`, this.namedRequestMasks([
 		[secretId, loggedSecretId],
 		[versionStage, this.displayMasked(nameLogText(versionStage), context)],
 		[versionId, this.displayMasked(nameLogText(versionId), context)]
-	], context))).SecretString;
+	], context));
+	const secretString = response.SecretString;
+	if (versionOut !== void 0 && typeof response.VersionId === "string") versionOut.version = response.VersionId;
 	if (!secretString) throw markNonRetryable(/* @__PURE__ */ new Error(`Dynamic reference: secret ${quotedRender(loggedSecretId, "'")} does not contain a SecretString value`));
 	if (jsonKey) try {
 		const parsed = JSON.parse(secretString);
@@ -21399,10 +21548,12 @@ async function resolveSSMReference(parts, decrypt, service, context, nameLogText
 		const reported = paramType === void 0 ? "(absent)" : quotedRender(this.displayMasked(String(paramType), context), "'");
 		this.logger.warn(`SSM parameter ${quotedRender(loggedParameterName, "'")} reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:${service}:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`);
 	}
+	const paramVersion = response.Parameter?.Version;
 	return {
 		value: paramValue,
 		secure,
-		type: paramType
+		type: paramType,
+		...typeof paramVersion === "number" && Number.isSafeInteger(paramVersion) && { version: String(paramVersion) }
 	};
 }
 
@@ -22401,7 +22552,10 @@ function recordInheritedParameterSecrets(parameterName, value, context) {
 	if (inherited && recorded) recordInheritedNoEchoListElements(this, inherited, recorded, value, context);
 	if (!inherited || inherited.size === 0 || !recorded) return;
 	for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) {
-		recorded.set(plaintext, carriedExpressionFor(inherited, parameterName, value, plaintext, expression));
+		const carried = carriedExpressionFor(inherited, parameterName, value, plaintext, expression);
+		recorded.set(plaintext, carried);
+		const parentEntry = context.inheritedReferenceProvenance?.get(carried);
+		if (parentEntry !== void 0) recordReferenceProvenanceEntry(recorded, carried, parentEntry, "read");
 		recordInheritedParameterRead(recorded, inherited, parameterName);
 		carryFreshNoEchoMark(inherited, recorded, plaintext);
 	}
@@ -24274,8 +24428,8 @@ function compare(desired, previous, mask) {
 		if (!Array.isArray(desired) || desired.length !== previous.length) return "differs";
 		return combine(previous.map((item, i) => compare(desired[i], item, mask)));
 	}
-	if (isPlainObject$1(previous)) {
-		if (!isPlainObject$1(desired)) return "differs";
+	if (isPlainObject$2(previous)) {
+		if (!isPlainObject$2(desired)) return "differs";
 		if (!Object.keys(desired).every((k) => Object.prototype.hasOwnProperty.call(previous, k))) return "differs";
 		return combine(Object.keys(previous).map((k) => compare(desired[k], previous[k], mask)));
 	}
@@ -24301,7 +24455,7 @@ function resolvesReference(desired, previous, mask) {
 	const pattern = literals.map(escapeRegExp$1).join("[\\s\\S]*");
 	return new RegExp(`^${pattern}$`).test(desired);
 }
-function isPlainObject$1(value) {
+function isPlainObject$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function escapeRegExp$1(text) {
@@ -25092,7 +25246,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-B8N6UPAH.js");
+			const { ASGProvider } = await import("./asg-provider-CGN1a3d3.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -25198,7 +25352,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-BdUme0V8.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-D3Qcci3J.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-BO3U39K0.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CR19ID_J.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -30005,6 +30159,325 @@ async function reserveStackCreateToken(options) {
 	};
 }
 
+//#endregion
+//#region src/deployment/deploy-value-equality.ts
+function isReplacementCeiling(pc) {
+	return pc.requiresReplacement && (pc.inPlacePropagated === true || pc.replacementPropagated === true);
+}
+function keyOrderFreeJson(value) {
+	return JSON.stringify(value, (_key, node) => {
+		if (node === null || typeof node !== "object" || Array.isArray(node)) return node;
+		const sorted = Object.create(null);
+		for (const key of Object.keys(node).sort()) sorted[key] = node[key];
+		return sorted;
+	});
+}
+function liveHoldsFreshLeaves(live, leaves) {
+	for (const leaf of leaves) {
+		let node = live;
+		for (const segment of leaf.path) {
+			if (typeof segment === "number") {
+				if (!Array.isArray(node) || segment >= node.length) return false;
+				node = node[segment];
+				continue;
+			}
+			if (node === null || typeof node !== "object" || Array.isArray(node)) return false;
+			if (!Object.prototype.hasOwnProperty.call(node, segment)) return false;
+			node = node[segment];
+		}
+		if (typeof leaf.plaintext === "string") {
+			if (typeof node !== "string" || node !== leaf.plaintext) return false;
+		} else if (node === void 0 || keyOrderFreeJson(node) !== keyOrderFreeJson(leaf.plaintext)) return false;
+	}
+	return true;
+}
+function outputMapsEqual(a, b) {
+	return deepEqualValue(a, b);
+}
+function deepEqualValue(a, b) {
+	if (a === b) return true;
+	if (a == null || b == null) return a === b;
+	if (typeof a !== typeof b) return false;
+	if (typeof a !== "object") return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((v, i) => deepEqualValue(v, b[i]));
+	}
+	const ao = a;
+	const bo = b;
+	const ak = Object.keys(ao);
+	if (ak.length !== Object.keys(bo).length) return false;
+	for (const k of ak) {
+		if (!Object.prototype.hasOwnProperty.call(bo, k)) return false;
+		if (!deepEqualValue(ao[k], bo[k])) return false;
+	}
+	return true;
+}
+
+//#endregion
+//#region src/deployment/reference-provenance-record.ts
+const SSM_VERSION = /^[0-9]{1,10}$/;
+const SECRETS_MANAGER_VERSION = /^[A-Za-z0-9_+=.@/-]{32,64}$/;
+function referenceTokensIn(value, into = /* @__PURE__ */ new Set()) {
+	const walk = (v) => {
+		if (typeof v === "string") {
+			if (!v.includes("{{resolve:")) return;
+			for (const token of dynamicReferenceTokens(v)) into.add(token);
+			return;
+		}
+		if (Array.isArray(v)) {
+			for (const item of v) walk(item);
+			return;
+		}
+		if (v !== null && typeof v === "object") for (const item of Object.values(v)) walk(item);
+	};
+	walk(value);
+	return into;
+}
+function recordReferenceTokens(record) {
+	const tokens = referenceTokensIn(record.properties);
+	referenceTokensIn(record.attributes, tokens);
+	referenceTokensIn(record.observedProperties, tokens);
+	return tokens;
+}
+function versionShapeOf(token) {
+	if (token.startsWith("{{resolve:secretsmanager:")) return SECRETS_MANAGER_VERSION;
+	if (token.startsWith("{{resolve:ssm:") || token.startsWith("{{resolve:ssm-secure:")) return SSM_VERSION;
+}
+function isValidReferenceVersion(token, version) {
+	const shape = versionShapeOf(token);
+	return shape !== void 0 && typeof version === "string" && shape.test(version);
+}
+function validReferenceRegion(region) {
+	if (typeof region !== "string") return void 0;
+	return canonicalizeRegion(region) === region && isClientSafeRegion(region) ? region : void 0;
+}
+function isPlainObject$1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function validateReferenceProvenance(token, raw) {
+	if (!isSingleDynamicReferenceToken(token) || !isPlainObject$1(raw)) return void 0;
+	const versionsRaw = Object.hasOwn(raw, "versions") ? raw["versions"] : void 0;
+	const readRaw = Object.hasOwn(raw, "readVersions") ? raw["readVersions"] : void 0;
+	if (readRaw !== void 0) {
+		if (!Array.isArray(readRaw)) return void 0;
+		const all = Array.isArray(versionsRaw) ? versionsRaw : [];
+		if (!readRaw.every((v) => all.includes(v))) return void 0;
+	}
+	const out = {};
+	const region = validReferenceRegion(Object.hasOwn(raw, "region") ? raw["region"] : void 0);
+	if (region !== void 0) out.region = region;
+	if (Array.isArray(versionsRaw) && versionsRaw.length > 0 && versionsRaw.length <= 8 && versionsRaw.every((v) => isValidReferenceVersion(token, v)) && (readRaw === void 0 || readRaw.every((v) => typeof v === "string"))) {
+		out.versions = [...new Set(versionsRaw)].sort();
+		if (readRaw !== void 0 && readRaw.length > 0) out.readVersions = [...new Set(readRaw)].sort();
+	}
+	return out;
+}
+function referenceProvenanceOf(record) {
+	if (!isPlainObject$1(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	return validatedBag(record["referenceProvenance"]);
+}
+function validatedBag(field) {
+	if (!isPlainObject$1(field)) return void 0;
+	const out = Object.create(null);
+	for (const [token, raw] of Object.entries(field)) {
+		const entry = validateReferenceProvenance(token, raw);
+		if (entry !== void 0) out[token] = entry;
+	}
+	return { ...out };
+}
+function hasReferenceProvenanceField(record) {
+	return isPlainObject$1(record) && Object.hasOwn(record, "referenceProvenance") && record["referenceProvenance"] !== void 0;
+}
+function outputReferenceProvenanceOf(state, outputKey) {
+	if (!isPlainObject$1(state) || !Object.hasOwn(state, "outputReferenceProvenance")) return;
+	const field = state["outputReferenceProvenance"];
+	if (!isPlainObject$1(field) || !Object.hasOwn(field, outputKey)) return void 0;
+	return validatedBag(field[outputKey]);
+}
+function persistable(token, entry) {
+	return (entry === void 0 ? void 0 : validateReferenceProvenance(token, entry)) ?? {};
+}
+function tokensUnderPaths(properties, paths) {
+	const out = /* @__PURE__ */ new Set();
+	const descend = (value, path, at) => {
+		if (at === path.length) {
+			referenceTokensIn(value, out);
+			return;
+		}
+		if (Array.isArray(value)) {
+			const next = path[at] === "*" ? at + 1 : at;
+			for (const item of value) descend(item, path, next);
+			return;
+		}
+		if (isPlainObject$1(value) && Object.hasOwn(value, path[at])) descend(value[path[at]], path, at + 1);
+	};
+	for (const path of paths) descend(properties, path, 0);
+	return out;
+}
+function provenanceForWrittenRecord(args) {
+	const { record, secrets, previous, inPlace } = args;
+	const previousField = inPlace === void 0 ? void 0 : referenceProvenanceOf(previous);
+	if (!hasPassProvenance(secrets) && previousField === void 0 && args.walkWithoutPassProvenance !== true) return;
+	const tokens = recordReferenceTokens(record);
+	if (tokens.size === 0) return void 0;
+	let kept;
+	if (inPlace !== void 0) {
+		kept = inPlace.createOnly === "all" ? tokens : tokensUnderPaths(record.properties, inPlace.createOnly);
+		if (inPlace.attributesCarried) referenceTokensIn(record.attributes, kept);
+	}
+	const out = {};
+	for (const token of [...tokens].sort()) {
+		const pass = passProvenanceFor(secrets, token);
+		if (kept === void 0 || !kept.has(token)) {
+			out[token] = persistable(token, pass);
+			continue;
+		}
+		const before = previousField !== void 0 && Object.hasOwn(previousField, token) ? previousField[token] : void 0;
+		if (pass === void 0) {
+			out[token] = before === void 0 ? {} : { ...before };
+			continue;
+		}
+		out[token] = persistable(token, unionWithPrevious(pass, before));
+	}
+	return out;
+}
+function unionWithPrevious(pass, before) {
+	const out = {};
+	if (pass.region !== void 0 && (before?.region === void 0 || before.region === pass.region)) out.region = pass.region;
+	if (pass.versions !== void 0 && before?.versions !== void 0) {
+		out.versions = [.../* @__PURE__ */ new Set([...before.versions, ...pass.versions])].sort();
+		if (pass.readVersions !== void 0) out.readVersions = [...pass.readVersions];
+	}
+	return out;
+}
+function outputProvenanceForPersist(args) {
+	const { outputs, resolvedThisRun, carriedFrom, sinkOf } = args;
+	if (!resolvedThisRun) return carriedFrom !== void 0 && isPlainObject$1(carriedFrom.outputReferenceProvenance) ? carriedFrom.outputReferenceProvenance : void 0;
+	let out;
+	for (const [outputKey, value] of Object.entries(outputs)) {
+		const sink = sinkOf(outputKey);
+		if (!hasPassProvenance(sink)) continue;
+		const tokens = referenceTokensIn(value);
+		if (tokens.size === 0) continue;
+		const entries = {};
+		for (const token of [...tokens].sort()) entries[token] = persistable(token, passProvenanceFor(sink, token));
+		out ??= Object.create(null);
+		out[outputKey] = entries;
+	}
+	return out === void 0 ? void 0 : { ...out };
+}
+const KEEP_REFERENCE_PROVENANCE = Symbol("keep reference provenance");
+function withReferenceProvenance(record, field) {
+	if (field === KEEP_REFERENCE_PROVENANCE) return record;
+	if (field === void 0 && !Object.hasOwn(record, "referenceProvenance")) return record;
+	const { referenceProvenance: _previous, ...rest } = record;
+	return field === void 0 ? rest : {
+		...rest,
+		referenceProvenance: field
+	};
+}
+
+//#endregion
+//#region src/deployment/deploy-engine/provenance-capture.ts
+function kickOffProvenanceCapture(args) {
+	const { noChange, resources, template } = args;
+	let chain = Promise.resolve();
+	for (const logicalId of noChange) {
+		const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+		if (record === void 0 || hasReferenceProvenanceField(record)) continue;
+		const tokens = recordReferenceTokens(record);
+		if (tokens.size === 0) continue;
+		const properties = (Object.hasOwn(template.Resources, logicalId) ? template.Resources[logicalId] : void 0)?.Properties ?? {};
+		const task = chain.then(() => captureOne(this, logicalId, record, tokens, properties, args)).catch(() => ({
+			record,
+			field: void 0
+		}));
+		chain = task;
+		this.provenanceCaptureTasks.set(logicalId, task);
+	}
+}
+function warnUnattributed(engine, logicalId) {
+	engine.logger.warn(safeMsg`Could not record where the secret reference(s) in ${logicalId} were resolved (state schema v12 migration). cdkd keeps its previous handling of them; update ${logicalId} to record it.`);
+}
+async function captureOne(engine, logicalId, record, tokens, properties, args) {
+	const bag = /* @__PURE__ */ new Map();
+	const { attributeHealer: _healer, ...base } = engine.buildResolverContext({
+		template: args.template,
+		resources: { ...args.resources },
+		...args.parameters && { parameters: args.parameters },
+		...args.conditions && { conditions: args.conditions }
+	}, args.stackName);
+	const { producerSecrets: _producer, ...withoutRecorders } = base;
+	const context = {
+		...withoutRecorders,
+		recordedSecretValues: bag,
+		recordedImports: [],
+		recordedOutputReads: [],
+		staleAttributeHeal: { phase: "probe" },
+		printingSecrets: /* @__PURE__ */ new Map(),
+		provenanceCapture: true
+	};
+	const stored = record.properties ?? {};
+	for (const [key, value] of Object.entries(properties)) {
+		if (!Object.hasOwn(stored, key) || recordReferenceTokens({ properties: stored[key] }).size === 0) continue;
+		try {
+			await engine.resolver.resolve(structuredClone(value), context);
+		} catch (error) {
+			if (isThrottlingError(error)) return {
+				record,
+				field: void 0
+			};
+		}
+	}
+	const physicalId = typeof record.physicalId === "string" ? record.physicalId.toLowerCase() : "";
+	const field = {};
+	let unattributed = false;
+	for (const token of [...tokens].sort()) {
+		const pass = passProvenanceFor(bag, token);
+		const plaintext = resolvedPlaintextOf(bag, token);
+		const named = plaintext !== void 0 && plaintext.length >= 4 && physicalId.includes(plaintext.toLowerCase());
+		const entry = validateReferenceProvenance(token, {
+			...pass?.region !== void 0 && { region: pass.region },
+			...named && pass?.versions !== void 0 && { versions: pass.versions }
+		}) ?? {};
+		if (entry.region === void 0 && entry.versions === void 0) unattributed = true;
+		field[token] = entry;
+	}
+	if (unattributed) warnUnattributed(engine, logicalId);
+	return {
+		record,
+		field
+	};
+}
+async function drainProvenanceCaptures(stateResources) {
+	if (this.provenanceCaptureTasks.size === 0) return 0;
+	const entries = [...this.provenanceCaptureTasks.entries()];
+	this.provenanceCaptureTasks.clear();
+	const outcomes = await Promise.all(entries.map(([, task]) => task));
+	let installed = 0;
+	for (let i = 0; i < entries.length; i++) {
+		const logicalId = entries[i][0];
+		const { record, field } = outcomes[i];
+		if (field === void 0) continue;
+		const target = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+		if (target === void 0 || target.physicalId !== record.physicalId || target.resourceType !== record.resourceType) continue;
+		stateResources[logicalId] = {
+			...target,
+			referenceProvenance: field
+		};
+		installed++;
+	}
+	return installed;
+}
+function provenanceBaselineOf(state, tokenFree) {
+	return {
+		outputs: state.outputs,
+		...state.outputReferenceProvenance !== void 0 && { outputReferenceProvenance: state.outputReferenceProvenance },
+		tokenFree
+	};
+}
+
 //#endregion
 //#region src/analyzer/destructive-changes.ts
 const IGNORED_RESOURCE_TYPES = /* @__PURE__ */ new Set(["AWS::CDK::Metadata"]);
@@ -31482,10 +31955,13 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 				continue;
 			}
 			const ownReads = [];
+			const provenanceSink = /* @__PURE__ */ new Map();
+			this.outputProvenanceSinks.set(outputKey, provenanceSink);
 			try {
 				const resolved = await this.resolver.resolve(output.Value, {
 					...context,
-					redactedAttributeReads: ownReads
+					redactedAttributeReads: ownReads,
+					provenanceSink
 				});
 				refuseMaskedOutputReads(outputKey, ownReads);
 				if (resolved === void 0 && this.options.strictGetAtt) throw markNonRetryable(/* @__PURE__ */ new Error("the value resolved to nothing"));
@@ -31540,6 +32016,8 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 			else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) this.logger.warn(exportAliasCollisionWarning(outputKey, exportName, outputsPassSecrets));
 			else {
 				outputs[exportName] = value;
+				const aliasedSink = this.outputProvenanceSinks.get(outputKey);
+				if (aliasedSink !== void 0) this.outputProvenanceSinks.set(exportName, aliasedSink);
 				if (!this.resolvedExportNames.includes(exportName)) this.resolvedExportNames.push(exportName);
 				this.outputsTemplateSource[exportName] = outputValue;
 			}
@@ -31553,6 +32031,8 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 		this.outputsTemplateSource[outputKey] = output.Value;
 	}
 	this.skippedOutputs = collectSkippedOutputs(digestSource, outputs);
+	this.outputsResolvedThisRun.add(outputs);
+	this.resolvedOutputsBag = outputs;
 	return markSameGenerationBag(outputs);
 }
 function buildDisplayOutputs(template, resolvedOutputs) {
@@ -34700,7 +35180,7 @@ async function revertNestedChildFromJournal(args) {
 		const { skippedOutputs: _dropped, ...carried } = base;
 		const next = () => ({
 			...carried,
-			version: 11,
+			version: 12,
 			region,
 			resources: { ...stateResources },
 			...orphansAfterRollback(base, mintedOrphans),
@@ -34716,6 +35196,7 @@ async function revertNestedChildFromJournal(args) {
 			const state = next();
 			if (!restoring) return state;
 			if (restoredOutputs && !restoredOutputs.exportNames) delete state.exportNames;
+			if (restoredOutputs) delete state.outputReferenceProvenance;
 			if (restoredReads && !restoredReads.imports) delete state.imports;
 			if (restoredReads && !restoredReads.outputReads) delete state.outputReads;
 			return state;
@@ -35596,7 +36077,8 @@ function kickOffObservedCapture(provider, logicalId, physicalId, resourceType, r
 	this.observedCaptureTasks.set(logicalId, promise);
 }
 async function drainObservedCaptures(stateResources) {
-	if (this.observedCaptureTasks.size === 0) return 0;
+	const captured = await this.drainProvenanceCaptures(stateResources);
+	if (this.observedCaptureTasks.size === 0) return captured;
 	const entries = Array.from(this.observedCaptureTasks.entries());
 	this.observedCaptureTasks.clear();
 	const resolved = await Promise.all(entries.map(([, p]) => p));
@@ -35612,7 +36094,7 @@ async function drainObservedCaptures(stateResources) {
 			target.observedProperties = recapturedFrom !== void 0 ? observed : markSameGenerationBag({ ...observed });
 		}
 	}
-	return installed;
+	return installed + captured;
 }
 const STANDALONE_SIBLING = {
 	Roles: {
@@ -35795,61 +36277,6 @@ function kickOffMaskedBaselineRecapture(provider, logicalId, resource, producerR
 	this.observedCaptureTasks.set(logicalId, task);
 }
 
-//#endregion
-//#region src/deployment/deploy-value-equality.ts
-function isReplacementCeiling(pc) {
-	return pc.requiresReplacement && (pc.inPlacePropagated === true || pc.replacementPropagated === true);
-}
-function keyOrderFreeJson(value) {
-	return JSON.stringify(value, (_key, node) => {
-		if (node === null || typeof node !== "object" || Array.isArray(node)) return node;
-		const sorted = Object.create(null);
-		for (const key of Object.keys(node).sort()) sorted[key] = node[key];
-		return sorted;
-	});
-}
-function liveHoldsFreshLeaves(live, leaves) {
-	for (const leaf of leaves) {
-		let node = live;
-		for (const segment of leaf.path) {
-			if (typeof segment === "number") {
-				if (!Array.isArray(node) || segment >= node.length) return false;
-				node = node[segment];
-				continue;
-			}
-			if (node === null || typeof node !== "object" || Array.isArray(node)) return false;
-			if (!Object.prototype.hasOwnProperty.call(node, segment)) return false;
-			node = node[segment];
-		}
-		if (typeof leaf.plaintext === "string") {
-			if (typeof node !== "string" || node !== leaf.plaintext) return false;
-		} else if (node === void 0 || keyOrderFreeJson(node) !== keyOrderFreeJson(leaf.plaintext)) return false;
-	}
-	return true;
-}
-function outputMapsEqual(a, b) {
-	return deepEqualValue(a, b);
-}
-function deepEqualValue(a, b) {
-	if (a === b) return true;
-	if (a == null || b == null) return a === b;
-	if (typeof a !== typeof b) return false;
-	if (typeof a !== "object") return false;
-	if (Array.isArray(a) || Array.isArray(b)) {
-		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-		return a.every((v, i) => deepEqualValue(v, b[i]));
-	}
-	const ao = a;
-	const bo = b;
-	const ak = Object.keys(ao);
-	if (ak.length !== Object.keys(bo).length) return false;
-	for (const k of ak) {
-		if (!Object.prototype.hasOwnProperty.call(bo, k)) return false;
-		if (!deepEqualValue(ao[k], bo[k])) return false;
-	}
-	return true;
-}
-
 //#endregion
 //#region src/deployment/deploy-engine/masking.ts
 function diffLogMasker(diffSecrets, template, parameterValues, resources) {
@@ -35906,6 +36333,11 @@ function absorbOutputsPassSecrets() {
 	}
 }
 function redactOutputs(outputs) {
+	const redacted = redactOutputsBag.call(this, outputs);
+	if (this.outputsResolvedThisRun.has(outputs)) this.outputsResolvedThisRun.add(redacted);
+	return redacted;
+}
+function redactOutputsBag(outputs) {
 	this.absorbOutputsPassSecrets();
 	if (this.outputSecrets.size === 0) return this.maskOutputsByPosition(outputs);
 	return this.maskOutputsByPosition(redactSecretsForState(outputs, this.outputSecrets, this.outputsSourceUsable ? this.outputsTemplateSource : void 0, TEMPLATE_SOURCED_RULES));
@@ -36557,6 +36989,7 @@ function buildResolverContext(base, stackName) {
 		attributeHealer: (logicalId, resource) => this.healStaleAttributes(logicalId, resource, stackName),
 		...this.options.inheritedSecrets && hasMaskableValues(this.options.inheritedSecrets) && { inheritedSecrets: this.options.inheritedSecrets },
 		...this.options.inheritedPhysicalNameCopies && { inheritedPhysicalNameCopies: this.options.inheritedPhysicalNameCopies },
+		...this.options.inheritedReferenceProvenance && { inheritedReferenceProvenance: this.options.inheritedReferenceProvenance },
 		recordedSecretValues,
 		noEchoAttributeResources: this.noEchoAttributeResources,
 		secretNameNeedles: (logicalId) => this.noteSecretNamedRecord(logicalId, Object.hasOwn(base.resources, logicalId) ? base.resources[logicalId] : void 0),
@@ -42369,6 +42802,10 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 		} else throw updateError;
 	}
 	this.updateWasReplaced.set(logicalId, result.wasReplaced === true);
+	if (result.wasReplaced !== true && (hasPassProvenance(updateSecrets) || referenceProvenanceOf(currentResource) !== void 0)) {
+		const cached = cachedCreateOnlyPropertyPaths(resourceType);
+		this.inPlaceCreateOnlyPaths.set(logicalId, cached === void 0 ? "all" : await cached.catch(() => "all"));
+	}
 	if (result.wasReplaced) {
 		this.noteSecretNamedRecord(logicalId, {
 			resourceType,
@@ -42972,7 +43409,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 		saveChain = saveChain.then(async () => {
 			try {
 				const partialState = {
-					version: 11,
+					version: 12,
 					region: this.stackRegion,
 					stackName: currentState.stackName,
 					resources: newResources,
@@ -43279,7 +43716,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 		}
 		try {
 			const preRollbackState = {
-				version: 11,
+				version: 12,
 				region: this.stackRegion,
 				stackName: currentState.stackName,
 				resources: newResources,
@@ -43332,7 +43769,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 		}
 		try {
 			const postRollbackState = {
-				version: 11,
+				version: 12,
 				region: this.stackRegion,
 				stackName: currentState.stackName,
 				resources: newResources,
@@ -43351,7 +43788,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			try {
 				const freshEtag = (await this.stateBackend.getState(stackName, this.stackRegion))?.etag;
 				const postRollbackState = {
-					version: 11,
+					version: 12,
 					region: this.stackRegion,
 					stackName: currentState.stackName,
 					resources: newResources,
@@ -43384,7 +43821,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 	}
 	return {
 		state: {
-			version: 11,
+			version: 12,
 			region: this.stackRegion,
 			stackName: currentState.stackName,
 			resources: newResources,
@@ -43402,7 +43839,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 }
 async function persistStateAfterOutputFailure(stackName, currentState, newResources, currentEtag, pendingMigration) {
 	const buildState = () => ({
-		version: 11,
+		version: 12,
 		region: this.stackRegion,
 		stackName: currentState.stackName,
 		resources: newResources,
@@ -44707,7 +45144,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		const currentStateData = await this.stateBackend.getState(stackName, this.stackRegion);
 		noteDeployStateRecord(currentStateData?.state !== void 0);
 		const currentState = currentStateData?.state ?? {
-			version: 11,
+			version: 12,
 			region: this.stackRegion,
 			stackName,
 			resources: {},
@@ -44724,6 +45161,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		refuseMalformedResourceProperties(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
 		refuseMalformedOrphans(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
 		refuseMalformedOrphanRecords(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
+		this.provenanceBaseline = provenanceBaselineOf(currentState, isKnownTokenFreeState(currentStateData?.state));
 		const migrationPending = currentStateData?.migrationPending ?? false;
 		this.logger.debug(`Loaded current state: ${Object.keys(currentState.resources).length} resources`);
 		if (this.options.onCurrentStateLoaded) {
@@ -44879,8 +45317,20 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			firstDeployStateGate = void 0;
 			await gate;
 		}
+		const startProvenanceCapture = () => {
+			if (this.options.dryRun || isKnownTokenFreeState(currentStateData?.state)) return;
+			this.kickOffProvenanceCapture({
+				noChange: this.diffCalculator.filterByType(changes, "NO_CHANGE").map((change) => change.logicalId),
+				resources: currentState.resources,
+				template: effectiveTemplate,
+				parameters: parameterValues,
+				conditions,
+				stackName
+			});
+		};
 		if (!this.diffCalculator.hasChanges(changes)) {
 			this.logger.info("No changes detected. Stack is up to date.");
+			startProvenanceCapture();
 			let persistedOutputs = currentState.outputs ?? {};
 			if (!this.options.dryRun) {
 				const resolvedOutputs = this.redactOutputs(await withSharedDrainBudget(() => this.resolveOutputs(effectiveTemplate, currentState.resources, stackName, outputsDigestSource, parameterValues, conditions)));
@@ -44918,9 +45368,10 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 					options: this.options,
 					stackName
 				});
-				if (observedRefresh || maskedFingerprintsBackfilled || conditionVerdictsChanged || outputsChanged || exportSetChanged || skippedOutputsChanged || orphansChanged || healedAttributesPending) try {
+				const outputProvenanceBackfill = !outputsChanged && currentState.outputReferenceProvenance === void 0 && this.provenanceBaseline?.tokenFree === false && this.outputReferenceProvenanceFor(persistedOutputs, this.redactOutputs(persistedOutputs)) !== void 0;
+				if (observedRefresh || outputProvenanceBackfill || maskedFingerprintsBackfilled || conditionVerdictsChanged || outputsChanged || exportSetChanged || skippedOutputsChanged || orphansChanged || healedAttributesPending) try {
 					const refreshedState = {
-						version: 11,
+						version: 12,
 						region: this.stackRegion,
 						stackName: currentState.stackName,
 						resources: currentState.resources,
@@ -45030,6 +45481,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			recreateTargetIds: recreateTargetIdsFor(this.options.recreateTargets, stackName),
 			secretMask: () => this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues, currentState.resources)
 		})) this.generatedNameGuard?.noteApprovalPrompted();
+		startProvenanceCapture();
 		this.generatedNameGuard?.recordPlannedIntents();
 		this.resolver.resetPhysicalIdFallbackCount();
 		const progress = {
@@ -45365,6 +45817,12 @@ var DeployEngine = class {
 	restoredLostChildren = /* @__PURE__ */ new Set();
 	updatesThatSentNothing = /* @__PURE__ */ new Set();
 	updateWasReplaced = /* @__PURE__ */ new Map();
+	inPlaceCreateOnlyPaths = /* @__PURE__ */ new Map();
+	outputProvenanceSinks = /* @__PURE__ */ new Map();
+	outputsResolvedThisRun = /* @__PURE__ */ new WeakSet();
+	provenanceBaseline = void 0;
+	resolvedOutputsBag = void 0;
+	provenanceCaptureTasks = /* @__PURE__ */ new Map();
 	oldDeletedBeforeCreate = /* @__PURE__ */ new Set();
 	healBaseline = {};
 	runProducerRegionEvidence = void 0;
@@ -45434,6 +45892,12 @@ var DeployEngine = class {
 		this.restoredLostChildren = /* @__PURE__ */ new Set();
 		this.updatesThatSentNothing = /* @__PURE__ */ new Set();
 		this.updateWasReplaced = /* @__PURE__ */ new Map();
+		this.inPlaceCreateOnlyPaths = /* @__PURE__ */ new Map();
+		this.outputProvenanceSinks = /* @__PURE__ */ new Map();
+		this.outputsResolvedThisRun = /* @__PURE__ */ new WeakSet();
+		this.provenanceBaseline = void 0;
+		this.resolvedOutputsBag = void 0;
+		this.provenanceCaptureTasks = /* @__PURE__ */ new Map();
 		this.oldDeletedBeforeCreate = /* @__PURE__ */ new Set();
 		this.healBaseline = {};
 		this.runProducerRegionEvidence = void 0;
@@ -45454,7 +45918,7 @@ var DeployEngine = class {
 			const templateProps = this.perResourceTemplateProps.get(logicalId);
 			const scrubbed = scrubResourceRecord(this.withHealedAttributes(logicalId, record), secrets ?? /* @__PURE__ */ new Map(), templateProps);
 			const noEchoScrubbed = this.applyNoEchoPersist(logicalId, record, this.withNoEchoExactEchoes(logicalId, scrubbed), templateProps, state.resources, secrets);
-			resources[logicalId] = withConstructPath(withMaskedPropertyFingerprints(noEchoScrubbed, record.properties, templateProps, secrets, this.fingerprintNoEchoValues, this.perResourceInputFingerprints.get(logicalId)), constructPathOf(this.constructPathTemplate, logicalId));
+			resources[logicalId] = withReferenceProvenance(withConstructPath(withMaskedPropertyFingerprints(noEchoScrubbed, record.properties, templateProps, secrets, this.fingerprintNoEchoValues, this.perResourceInputFingerprints.get(logicalId)), constructPathOf(this.constructPathTemplate, logicalId)), this.referenceProvenanceToPersist(logicalId, record, noEchoScrubbed, secrets));
 		}
 		const orphans = state.orphans?.map((entry) => {
 			const sameResource = this.perResourceResolvedType.get(entry.logicalId) === entry.state.resourceType;
@@ -45466,14 +45930,51 @@ var DeployEngine = class {
 		});
 		const outputs = this.redactOutputs(state.outputs);
 		const crossStackReads = this.redactCrossStackReads(state);
+		const { outputReferenceProvenance: _incoming, ...rest } = state;
+		const outputReferenceProvenance = this.outputReferenceProvenanceFor(state.outputs, outputs);
 		return {
-			...state,
+			...rest,
 			resources,
 			outputs,
 			...orphans === void 0 ? {} : { orphans },
-			...crossStackReads
+			...crossStackReads,
+			...outputReferenceProvenance !== void 0 && { outputReferenceProvenance }
 		};
 	}
+	outputReferenceProvenanceFor(outputs, redacted) {
+		const sinkOf = (outputKey) => this.outputProvenanceSinks.get(outputKey);
+		const baseline = this.provenanceBaseline;
+		if (!this.outputsResolvedThisRun.has(outputs) && baseline !== void 0 && outputs === baseline.outputs && baseline.outputReferenceProvenance === void 0 && !baseline.tokenFree && this.resolvedOutputsBag !== void 0 && outputMapsEqual(this.redactOutputs(this.resolvedOutputsBag), redacted)) return outputProvenanceForPersist({
+			outputs: redacted,
+			resolvedThisRun: true,
+			carriedFrom: void 0,
+			sinkOf
+		});
+		return outputProvenanceForPersist({
+			outputs: redacted,
+			resolvedThisRun: this.outputsResolvedThisRun.has(outputs),
+			carriedFrom: baseline !== void 0 && outputs === baseline.outputs ? baseline : void 0,
+			sinkOf
+		});
+	}
+	referenceProvenanceToPersist(logicalId, record, scrubbed, secrets) {
+		const sameGeneration = isSameGenerationBag(record.properties);
+		if (!sameGeneration && !isWrittenFromDeployedTemplate(record.properties)) return KEEP_REFERENCE_PROVENANCE;
+		const previous = Object.hasOwn(this.healBaseline, logicalId) ? this.healBaseline[logicalId] : void 0;
+		if (this.updatesThatSentNothing.has(logicalId) && previous !== void 0) return previous.referenceProvenance;
+		const createOnly = sameGeneration ? this.inPlaceCreateOnlyPaths.get(logicalId) : "all";
+		const inPlace = this.updateWasReplaced.get(logicalId) === false && previous !== void 0 ? {
+			createOnly: createOnly ?? "all",
+			attributesCarried: record.attributes !== void 0 && record.attributes === previous.attributes
+		} : void 0;
+		return provenanceForWrittenRecord({
+			record: scrubbed,
+			secrets,
+			previous,
+			inPlace,
+			walkWithoutPassProvenance: this.provenanceBaseline?.tokenFree !== true
+		});
+	}
 	redactCrossStackReads(state) {
 		if (state.imports === void 0 && state.outputReads === void 0) return {};
 		const secrets = this.allRecordedSecrets();
@@ -45622,6 +46123,8 @@ DeployEngine.prototype.namingSecretsFor = namingSecretsFor;
 DeployEngine.prototype.noteSecretNamedReads = noteSecretNamedReads;
 DeployEngine.prototype.kickOffObservedCapture = kickOffObservedCapture;
 DeployEngine.prototype.drainObservedCaptures = drainObservedCaptures;
+DeployEngine.prototype.kickOffProvenanceCapture = kickOffProvenanceCapture;
+DeployEngine.prototype.drainProvenanceCaptures = drainProvenanceCaptures;
 DeployEngine.prototype.buildObservedCaptureSiblings = buildObservedCaptureSiblings;
 DeployEngine.prototype.stampReasonlessParameterRefusals = stampReasonlessParameterRefusals;
 DeployEngine.prototype.kickOffAutoRefreshObservedProperties = kickOffAutoRefreshObservedProperties;
@@ -45655,5 +46158,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { isTruthyCfnBoolean as $, isStatefulRecreateTargetForReplace as $a, stateBucketExistenceConfirmed as $c, malformedOrphansRefusalMessage as $i, ledgerForStack as $n, markSameGenerationBag as $o, sendableAssumeRoleCommand as $r, AssetPublisher as $s, seedsDeleteFirstGuard as $t, noEchoComparisonForTemplate as A, refuseMalformedResourcesForDeploy as Aa, redactDockerArgvValues as Ac, declaresNoEcho as Ai, journaledOrphanPrintingBag as An, maskWholeValue as Ao, deleteIndeterminateGuards as Ar, LockManager as As, dropFailedHint as At, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as B, unpreviewableOrphanRecords as Ba, getDockerImageBySourceHash as Bc, hasReadableOutputs as Bi, PRE_DELETE_SNAPSHOT_TYPES as Bn, carryLogOnlyValues as Bo, reDisableInstanceApiTermination as Br, splitImportedOps as Bs, getStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedResourceEntriesForImport as Ca, dockerSpawnEnvWithSensitive as Cc, cfnRefValueFromPhysicalId as Ci, displayAssemblyPath as Cl, collectDeclaredOutputNames as Cn, sameLambdaFunctionAddress as Co, applyCustomResourceResponseExpiration as Cr, wholeStringLeavesOf as Cs, revertNestedChildFromJournal as Ct, withResourceDeadline as D, refuseMalformedResourcePropertiesForDrift as Da, isDockerClientEnvKey as Dc, withSharedDrainBudget as Di, injectedAwsRegionValue as Dl, DEFAULT_RESOURCE_TIMEOUT_MS as Dn, isMarkedCoordinate as Do, unchangedBehindSecretReference as Dr, TEMPLATE_SOURCED_RULES as Ds, getCurrentNestedStackContext as Dt, serviceTokenBlockingReason as E, refuseMalformedResourcePropertiesForDestroy as Ea, getDockerCmd as Ec, parseWebACLArn as Ei, injectAwsRegion as El, bindingSkippedOutputs as En, canonicalCoordinates as Eo, slowCcOperationTimeoutMs as Er, STATE_SOURCED_READBACK_RULES as Es, collectNestedChildUnaddressed as Et, PROTECTION_PROPERTY_BY_TYPE as F, repairMalformedOrphansForReadOnly as Fa, warnFinchArgvExposure as Fc, UNREADABLE_RESOURCES_MAP_ROW as Fi, secretNamedRecordNeedles as Fn, passedNoEchoParametersOf as Fo, markWaitAbandoned as Fr, CrossPrefixScanCache as Fs, sameJournaledOrphans as Ft, resolveDynamoDbDeleteBudgetMs as G, findSilentDropProperties as Ga, loadCdkJson as Gc, malformedExportNamesWarning as Gi, isFinalSnapshotError as Gn, printingCorpusOf as Go, poisonRenderedSpellingsCollidingIn as Gr, hasReasonlessBaselineRefusal as Gs, isJournaledOrphan as Gt, compensateRemovedDeletionProtection as H, unreadableResourceEntries as Ha, synthesisStatusMessage as Hc, isReadableOrphanRecord as Hi, ccRoutedFinalSnapshotError as Hn, hasMaskableValues as Ho, DiffCalculator as Hr, describeRegionValueKind as Hs, removeProtectionTypeList as Ht, isProtectionValueActive as I, repairMalformedOutputsForReadOnly as Ia, escapeRegExp$3 as Ic, accountArgs as Ii, stateSecretNameNeedles as In, readbackPathFor as Io, disableInstanceApiTermination as Ir, applyCrossPrefixScan as Is, replayFailedOperations as It, deleteTableWithIndexBusyRetry as J, NO_CC_HANDLERS_REASON as Ja, resolveCaptureObservedState as Jc, malformedLocalResourceEntriesWarning as Ji, maskingRetryLogger as Jn, shareLogOnlyValues as Jo, applyRoleArnIfSet as Jr, importableOutputs as Js, planRollback as Jt, DELETE_INDEX_WAIT_PROCEED_NOTE as K, unwrittenCreateOnlyReplacement as Ka, resolveApp as Kc, malformedExportSourceWarning as Ki, refusesFinalSnapshot as Kn, recordLogOnlyParameterValue as Ko, producerLookupOver as Kr, hasUnverifiableParameterRefusal as Ks, isReplacementOrphan as Kt, perType as L, repairMalformedResourceEntriesForReadOnly as La, stripControlChars as Lc, deployRefusesOrphanRowsReason as Li, storedSecretNameNeedles as Ln, readsNoEchoSource as Lo, ec2InstanceProtectionSite as Lr, crossPrefixDeniedWarning as Ls, replayRollback as Lt, noEchoParameterNamesOf as M, refuseMalformedResourcesForExport as Ma, redactedDockerCause as Mc, STATE_REGION_DIVERGED as Mi, orphanRecordsPrintingBag as Mn, noEchoCoordinatesOf as Mo, deleteSkipReason as Mr, S3StateBackend as Ms, journaledOrphanLines as Mt, recordedProtectionEvidence as N, refuseMalformedState as Na, runDockerForeground as Nc, STATE_RESOURCES_MALFORMED as Ni, secretNamePrintingBag as Nn, noEchoLeavesOf as No, withIndeterminateGuard as Nr, rebuildClientForBucketRegion as Ns, loadJournaledOrphans as Nt, diffSecurity as O, refuseMalformedResourcePropertiesForExport as Oa, isMalformedEnvKey as Oc, parameterInputsFor as Oi, clearBucketRegionCache as Ol, DEFAULT_RESOURCE_WARN_AFTER_MS as On, maskAtCoordinates as Oo, RollbackInlinePolicyWriters as Or, WHOLE_DYNAMIC_REFERENCE_PATTERN as Os, withNestedStackContext as Ot, recordedProtectionNote as P, repairMalformedOrphanRecordsForReadOnly as Pa, runDockerStreaming as Pc, UNREADABLE_ORPHANS_CONTAINER_ROW as Pi, secretNamePrintingBags as Pn, noEchoOutputsComparison as Po, isWaitAbandonedError as Pr, CrossPrefixReadError as Ps, makeForeignHolderScan as Pt, hasCdkAutoDeleteTag as Q, MULTI_REGION_RECREATE_BLOCKED_TYPES as Qa, resolveUseCdkBootstrapAssets as Qc, malformedOrphanRowsKeptWarning as Qi, earliestDefined as Qn, maskSecretsInText as Qo, isIamRoleArn as Qr, shouldRetainResource as Qs, resolveReplacementOldType as Qt, readProtection as R, repairMalformedResourcePropertiesForReadOnly as Ra, stripForDisplay as Rc, displayLogicalId as Ri, extractDeploymentEventError as Rn, valueAtCoordinate as Ro, isTerminationProtectionPropagationError as Rr, isAccessDenied$1 as Rs, awaitInFlightSibling as Rt, keptForReadoption as S, refuseMalformedResourceEntriesForDestroy as Sa, describeDockerFailure as Sc, AWS_NO_VALUE as Si, describeFileReadFailure as Sl, noEchoParameterValueSeed as Sn, lambdaFunctionNameForMask as So, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Sr, recordProvenPublicExpression as Ss, recordDisplacedSkips as St, findServiceTokenRefusals as T, refuseMalformedResourceEntriesForOrphan as Ta, formatDockerLoginError as Tc, refStateLookupFromResource as Ti, resolveAssemblyPath as Tl, isExportAliasCollision as Tn, TemplateParser as To, CloudControlProvider as Tr, STATE_SOURCED_CROSS_GENERATION_RULES as Ts, withNestedRevertRun as Tt, deleteBudgetKey as U, withheldAccountClause as Ua, getDefaultStateBucketName as Uc, isReadableResourceEntry as Ui, createPreDeleteFinalSnapshot as Un, literalSplitDelimitersOf as Uo, INTRINSIC_KEYS as Ur, exportNamesCarriedFrom as Us, recordAfterRollbackUpdate as Ut, beginDeleteWait as V, unreadableOrphanRecords as Va, Synthesizer as Vc, hasReadableResources as Vi, buildFinalSnapshotIdentifier as Vn, createUnionSecretMasker as Vo, reEnableInstanceApiTermination as Vr, acceptedCreateOnlyDropsOf as Vs, withStackRecords as Vt, resolveDynamoDbDeleteBudgetClock as W, findActionableSilentDrops as Wa, getLegacyStateBucketName as Wc, malformedDriftResourcePropertiesWarning as Wi, effectiveDeletionPolicy as Wn, logOnlyValueCount as Wo, IntrinsicFunctionResolver as Wr, hasReadableExportSet as Ws, demoteSupersededOrphans as Wt, ECR_AUTO_DELETE_IMAGES_TAG as X, findReplacedReadersOfRecreateTargets as Xa, resolveStateBucketWithDefault as Xc, malformedOrphanRecordsRefusalMessage as Xi, findDestructiveChanges as Xn, errorCauseChain as Xo, assertSendableRoleArn as Xr, orphansAfterRollback as Xs, recordUnderIdIsNotOwn as Xt, waitForIndexesSettled as Y, hasNoCloudControlHandlers as Ya, resolveSkipPrefix as Yc, malformedLocalResourcesWarning as Yi, constructPathOf as Yn, createSecretMasker as Yo, assertFlagRoleArn as Yr, isReadableBag as Ys, recheckFailedPlan as Yt, S3_AUTO_DELETE_OBJECTS_TAG as Z, shownType as Za, resolveStateBucketWithDefaultAndSource as Zc, malformedOrphanRecordsWarning as Zi, formatDestructiveChange as Zn, maskSecretsInError as Zo, explicitRoleArnOrThrow as Zr, orphansCarriedFrom as Zs, replacementNeverSwapped as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedOutputs as _a, buildDenyExternalAccessPolicy as _c, isImpossibleEmptyStoredAttribute as _i, hasOwnKey as _l, secretSafeKeyDisplay as _n, prefetchCreateOnlyPropertyPaths as _o, TemplateNoEchoReresolver as _r, provenPublicValue as _s, displacedOpClause as _t, findNestedTemplateTreeDefect as a, malformedResourcePropertiesWarning as aa, loadPublishableAssetManifest as ac, s3BucketArn as ai, findLargeInlineResources as al, isRedactedRecordedValue as an, toCfnInteger as ao, planTagDiff as ar, dynamicReferenceTokens as as, cyan as at, lookupEachName as b, refuseMalformedResourceEntries as ba, describeDockerCapturedOutput as bc, isNamelessDynamicReferenceError as bi, ownValue as bl, exportNameSecretExposure as bn, withRetry as bo, getCurrentResourceSecrets as br, recordNoEchoAttributeValues as bs, getNestedRevertRun as bt, renderNestedTemplateTreeDefect as c, malformedStateRefusalMessage as ca, BOOTSTRAP_MARKER_PREFIX as cc, s3BucketRegionalDomainName as ci, decodeListingKey as cl, updatePartialMessage as cn, coerceCfnInteger as co, tagMapAsList as cr, identityKeyFor as cs, red as ct, conditionInputsFrom as d, refuseMalformedNestedChildOutputs as da, getBootstrapMarkerKey as dc, producerRegionsFromState as di, canonicalizeRegion as dl, DeploymentEventsStore as dn, configStringRefusal as do, stringifyIfAssigned as dr, recoverMaskedOutput as ds, namesAnyDeclaredParameter as dt, malformedOrphansWarning as ea, isSensitiveAttributeName as ec, AWS_CREDENTIAL_ENV_KEYS as ei, warnDeprecatedNoPrefixCliFlag as el, orphanDeleteNeedsIdentity as en, isStatefulRecreateTargetSync as eo, reserveStackCreateToken as er, redactSecretsForState as es, getPriorAttempts as et, parentSuppliedValues as f, refuseMalformedOrphanRecords as fa, isCrossRegionRedirect as fc, regionLessSecretName as fi, derivePartitionAndUrlSuffix as fl, WITHHELD_NAME_DISPLAY as fn, readConfigString as fo, CC_BROKEN_REASON as fr, physicalNameCopiesOf as fs, reachableDivergentParameters as ft, mergeNoChangeOutputs as g, refuseMalformedOrphansForOrphan as ga, validateContainerRepoName as gc, getAccountInfo as gi, defineOwnKey as gl, secretBearingStateKeyWarning as gn, requireConfigString as go, wouldReturnToSdkProvider as gr, carriesSecretMask as gs, NESTED_PENDING_PARENT_REASON as gt, keptWholeReasonText as h, refuseMalformedOrphansForDestroy as ha, validateAssetBucketName as hc, parameterTypeMayLoseSecretIdentity as hi, processStackMessages as hl, secretBearing as hn, requireConfigObject as ho, isCustomResource as hr, splitGetAttStringForm as hs, planOrphanAdoption as ht, childTemplateLoader as i, malformedResourceEntriesWarning as ia, createAssetRedirectResolver as ic, isSettledInstanceState as ii, MIGRATE_TMP_PREFIX as il, REDACTED_DELETE_ADDRESS_SKIP_REASON as in, isWarmThroughputDecrease as io, DBPROXY_TAG_OPTIONS as ir, DYNAMIC_REFERENCE_TOKEN_SCAN as is, bold as it, noEchoExactEchoLeavesOf as j, refuseMalformedResourcesForDestroy as ja, redactedCause as jc, JSON_LISTING_HOLE_VALUE as ji, maskEventTextWithBoundBags as jn, maskedLeafCoordinatesOf as jo, deleteLeftInPlace as jr, isLockInfoExpired as js, isHandledOrphan as jt, noEchoAttributeNamesOf as k, refuseMalformedResourcePropertiesForOrphan as ka, partitionSensitiveEnv as kc, passedParameterClassesOf as ki, resolveBucketRegion as kl, completedReplayEntries as kn, maskReadbackAtCoordinates as ko, UNSPECIFIED_SKIP_REASON as kr, isSingleDynamicReferenceToken as ks, deleteJournaledOrphans as kt, templateIdentity as l, previewableOrphanRecords as la, assertAssetBucketRegion as lc, s3BucketWebsiteUrl as li, expectedOwnerParam as ll, updatePartialReason as ln, configBooleanRefusal as lo, tagPlanWarning as lr, inheritNestedStackParameterAssociations as ls, yellow as lt, isSecretBearingReferenceString as m, refuseMalformedOrphans as ma, readBootstrapMarkerBody as mc, isUnboundTemplateParameter as mi, StageLoadError as ml, exportAliasCollisionScrubWarning as mn, requireConfigArray as mo, ccBrokenReason as mr, recordPhysicalNameCopy as ms, makeSiblingClaimReader as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedOutputsWarning as na, WorkGraph as nc, callerEnvCredentials as ni, CFN_TEMPLATE_BODY_LIMIT as nl, getCurrentProducerRegions as nn, WARM_THROUGHPUT_MEMBERS as no, acquireIdempotencyToken as nr, withPhysicalNameCopies as ns, formatResourceLine as nt, isAbsoluteAssetPath as o, malformedResourcesWarning as oa, rewriteTemplateAssetReferences as oc, s3BucketDomainName as oi, uploadCfnTemplate as ol, redactedDeleteAddressFields as on, toFiniteNumber as oo, readTagList as or, isUncertifiedBaselineMaskPosition as os, gray as ot, readRecordedConditionVerdicts as p, refuseMalformedOrphanRecordsForDestroy as pa, parseBootstrapMarker as pc, coerceParameterTypedValue as pi, AssemblyReader as pl, displayTextOrWithheld as pn, replayWarn as po, ProviderRegistry as pr, recordAttributeIdCopy as ps, resourcesNamingDeclaredParameter as pt, INDEX_SETTLE_POLL_INTERVAL_MS as q, withoutSilentDropProperties as qa, resolveAutoAssetStorage as qc, malformedLocalOutputsWarning as qi, unsupportedFinalSnapshotError as qn, recordLogOnlyValue as qo, refuseUnreadableCdkCrossAccountRefs as qr, importableOutputKeys as qs, planFailedOps as qt, computeImplicitDeleteEdges as r, malformedRenderedContainersWarning as ra, buildAssetRedirectMap as rc, envCredentialsAreAssumedRole as ri, CFN_TEMPLATE_URL_LIMIT as rl, inheritProducerRegions as rn, coerceWarmThroughput as ro, DBPROXY_TAGS_WHAT as rr, withoutPhysicalNameCopies as rs, createReadOnlyAttributeHealerFactory as rt, listNestedTemplateRows as s, malformedScrubResourceEntriesRefusalMessage as sa, AssetModeResolver as sc, s3BucketDualStackDomainName as si, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as sl, redactedDeleteAddressSkip as sn, coerceCfnBoolean as so, refuseMalformedDesiredTags as sr, pathCrossesDottedKey as ss, green as st, DeployEngine as t, malformedOutputsRefusalMessage as ta, stringifyValue as tc, applyCallerIdentityCredentials as ti, ssmResolvedValueType as tl, findNestedStackTypeChanges as tn, renderStatefulReason as to, withCreateTokenLedger as tr, scrubResourceRecord as ts, markRefusedBeforeApplying as tt, conditionFingerprint as u, refuseDivergentRecordRegionForDestroy as ua, ensureAssetStorage as uc, classifyReplaySecretRegion as ui, PARTITION_TABLE as ul, DeploymentEventsReader as un, configIntegerRefusal as uo, definedAttributes as ur, recordNestedStackParameterExpressions as us, computeParameterTaint as ut, chunks as v, refuseMalformedOutputsForDestroy as va, buildDockerImage as vc, carriesDynamicReference as vi, hasPlainPrototype$1 as vl, carriedExportAliasExposure as vn, templateResourceTypes as vo, readsNoEchoDeleteValues as vr, recordMaskOnlyValue as vs, displacedPhysicalIdShown as vt, deferredServiceTokenWarning as w, refuseMalformedResourceEntriesForImportSave as wa, finchSecretArgvRefusal as wc, isStalePlaceholderArnAttribute as wi, renderAssemblyPathEscape as wl, collectPublishedOutputNames as wn, DagBuilder as wo, customResourceResponseExpirationWarning as wr, STATE_SOURCED_BASELINE_RULES as ws, revertedNestedRowIds as wt, withApiLimit as x, refuseMalformedResourceEntriesForDeploy as xa, describeDockerExecFailure as xc, keepsSecretReferenceToken as xi, absoluteAssemblyPathEscape as xl, isWholeDynamicReferenceValue as xn, canonicalLambdaFunctionName as xo, withPrintingSecrets as xr, recordNoEchoParameterFreshValue as xs, nestedChildStackName as xt, isAccessDeniedError as y, refuseMalformedResourceAttributesForOrphan as ya, resolveDockerContextDirectory as yc, carriesFetchableDynamicReference as yi, nullPrototypeRecord as yl, exportNameNoEchoParameters as yn, describeTypeWithThrottleRetry as yo, isCustomResourceType as yr, recordMaskOnlyValuesIn as ys, dropSettledNestedJournals as yt, DynamoDBGlobalTableProvider as z, repairMalformedResourcesForReadOnly as za, AssetManifestLoader as zc, hasReadableOrphans as zi, ATOMIC_FINAL_SNAPSHOT_TYPES as zn, liveMatchesUnresolvedTokenFrame as zo, observeThenDisableInstanceApiTermination as zr, isNotImplemented as zs, destroyStackRecordsView as zt };
-//# sourceMappingURL=deploy-engine-HKmcD4Kn.js.map
+export { isTruthyCfnBoolean as $, MULTI_REGION_RECREATE_BLOCKED_TYPES as $a, resolveStateBucketWithDefault as $c, malformedOrphanRowsKeptWarning as $i, earliestDefined as $n, maskSecretsInText as $o, isIamRoleArn as $r, orphansAfterRollback as $s, seedsDeleteFirstGuard as $t, noEchoComparisonForTemplate as A, refuseMalformedResourcePropertiesForOrphan as Aa, isDockerClientEnvKey as Ac, passedParameterClassesOf as Ai, injectedAwsRegionValue as Al, journaledOrphanPrintingBag as An, maskReadbackAtCoordinates as Ao, UNSPECIFIED_SKIP_REASON as Ar, TEMPLATE_SOURCED_RULES as As, dropFailedHint as At, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as B, repairMalformedResourcesForReadOnly as Ba, stripControlChars as Bc, hasReadableOrphans as Bi, PRE_DELETE_SNAPSHOT_TYPES as Bn, liveMatchesUnresolvedTokenFrame as Bo, observeThenDisableInstanceApiTermination as Br, crossPrefixDeniedWarning as Bs, getStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedResourceEntriesForDestroy as Ca, describeDockerCapturedOutput as Cc, AWS_NO_VALUE as Ci, ownValue as Cl, collectDeclaredOutputNames as Cn, lambdaFunctionNameForMask as Co, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Cr, recordNoEchoAttributeValues as Cs, revertNestedChildFromJournal as Ct, withResourceDeadline as D, refuseMalformedResourcePropertiesForDestroy as Da, finchSecretArgvRefusal as Dc, parseWebACLArn as Di, renderAssemblyPathEscape as Dl, DEFAULT_RESOURCE_TIMEOUT_MS as Dn, canonicalCoordinates as Do, slowCcOperationTimeoutMs as Dr, STATE_SOURCED_BASELINE_RULES as Ds, getCurrentNestedStackContext as Dt, serviceTokenBlockingReason as E, refuseMalformedResourceEntriesForOrphan as Ea, dockerSpawnEnvWithSensitive as Ec, refStateLookupFromResource as Ei, displayAssemblyPath as El, bindingSkippedOutputs as En, TemplateParser as Eo, CloudControlProvider as Er, wholeStringLeavesOf as Es, collectNestedChildUnaddressed as Et, PROTECTION_PROPERTY_BY_TYPE as F, repairMalformedOrphanRecordsForReadOnly as Fa, redactedDockerCause as Fc, UNREADABLE_ORPHANS_CONTAINER_ROW as Fi, secretNamedRecordNeedles as Fn, noEchoOutputsComparison as Fo, isWaitAbandonedError as Fr, S3StateBackend as Fs, sameJournaledOrphans as Ft, resolveDynamoDbDeleteBudgetMs as G, findActionableSilentDrops as Ga, synthesisStatusMessage as Gc, malformedDriftResourcePropertiesWarning as Gi, isFinalSnapshotError as Gn, logOnlyValueCount as Go, IntrinsicFunctionResolver as Gr, describeRegionValueKind as Gs, isJournaledOrphan as Gt, compensateRemovedDeletionProtection as H, unreadableOrphanRecords as Ha, AssetManifestLoader as Hc, hasReadableResources as Hi, ccRoutedFinalSnapshotError as Hn, createUnionSecretMasker as Ho, reEnableInstanceApiTermination as Hr, isNotImplemented as Hs, removeProtectionTypeList as Ht, isProtectionValueActive as I, repairMalformedOrphansForReadOnly as Ia, runDockerForeground as Ic, UNREADABLE_RESOURCES_MAP_ROW as Ii, stateSecretNameNeedles as In, passedNoEchoParametersOf as Io, markWaitAbandoned as Ir, rebuildClientForBucketRegion as Is, replayFailedOperations as It, deleteTableWithIndexBusyRetry as J, withoutSilentDropProperties as Ja, loadCdkJson as Jc, malformedLocalOutputsWarning as Ji, maskingRetryLogger as Jn, recordLogOnlyValue as Jo, refuseUnreadableCdkCrossAccountRefs as Jr, hasReasonlessBaselineRefusal as Js, planRollback as Jt, DELETE_INDEX_WAIT_PROCEED_NOTE as K, findSilentDropProperties as Ka, getDefaultStateBucketName as Kc, malformedExportNamesWarning as Ki, refusesFinalSnapshot as Kn, printingCorpusOf as Ko, poisonRenderedSpellingsCollidingIn as Kr, exportNamesCarriedFrom as Ks, isReplacementOrphan as Kt, perType as L, repairMalformedOutputsForReadOnly as La, runDockerStreaming as Lc, accountArgs as Li, storedSecretNameNeedles as Ln, readbackPathFor as Lo, disableInstanceApiTermination as Lr, CrossPrefixReadError as Ls, replayRollback as Lt, noEchoParameterNamesOf as M, refuseMalformedResourcesForDestroy as Ma, partitionSensitiveEnv as Mc, JSON_LISTING_HOLE_VALUE as Mi, resolveBucketRegion as Ml, orphanRecordsPrintingBag as Mn, maskedLeafCoordinatesOf as Mo, deleteLeftInPlace as Mr, isSingleDynamicReferenceToken as Ms, journaledOrphanLines as Mt, recordedProtectionEvidence as N, refuseMalformedResourcesForExport as Na, redactDockerArgvValues as Nc, STATE_REGION_DIVERGED as Ni, secretNamePrintingBag as Nn, noEchoCoordinatesOf as No, deleteSkipReason as Nr, LockManager as Ns, loadJournaledOrphans as Nt, diffSecurity as O, refuseMalformedResourcePropertiesForDrift as Oa, formatDockerLoginError as Oc, withSharedDrainBudget as Oi, resolveAssemblyPath as Ol, DEFAULT_RESOURCE_WARN_AFTER_MS as On, isMarkedCoordinate as Oo, unchangedBehindSecretReference as Or, STATE_SOURCED_CROSS_GENERATION_RULES as Os, withNestedStackContext as Ot, recordedProtectionNote as P, refuseMalformedState as Pa, redactedCause as Pc, STATE_RESOURCES_MALFORMED as Pi, secretNamePrintingBags as Pn, noEchoLeavesOf as Po, withIndeterminateGuard as Pr, isLockInfoExpired as Ps, makeForeignHolderScan as Pt, hasCdkAutoDeleteTag as Q, shownType as Qa, resolveSkipPrefix as Qc, malformedOrphanRecordsWarning as Qi, outputReferenceProvenanceOf as Qn, maskSecretsInError as Qo, explicitRoleArnOrThrow as Qr, isReadableBag as Qs, resolveReplacementOldType as Qt, readProtection as R, repairMalformedResourceEntriesForReadOnly as Ra, warnFinchArgvExposure as Rc, deployRefusesOrphanRowsReason as Ri, extractDeploymentEventError as Rn, readsNoEchoSource as Ro, ec2InstanceProtectionSite as Rr, CrossPrefixScanCache as Rs, awaitInFlightSibling as Rt, keptForReadoption as S, refuseMalformedResourceEntriesForDeploy as Sa, resolveDockerContextDirectory as Sc, keepsSecretReferenceToken as Si, nullPrototypeRecord as Sl, noEchoParameterValueSeed as Sn, canonicalLambdaFunctionName as So, withPrintingSecrets as Sr, recordMaskOnlyValuesIn as Ss, recordDisplacedSkips as St, findServiceTokenRefusals as T, refuseMalformedResourceEntriesForImportSave as Ta, describeDockerFailure as Tc, isStalePlaceholderArnAttribute as Ti, describeFileReadFailure as Tl, isExportAliasCollision as Tn, DagBuilder as To, customResourceResponseExpirationWarning as Tr, recordProvenPublicExpression as Ts, withNestedRevertRun as Tt, deleteBudgetKey as U, unreadableResourceEntries as Ua, getDockerImageBySourceHash as Uc, isReadableOrphanRecord as Ui, createPreDeleteFinalSnapshot as Un, hasMaskableValues as Uo, DiffCalculator as Ur, splitImportedOps as Us, recordAfterRollbackUpdate as Ut, beginDeleteWait as V, unpreviewableOrphanRecords as Va, stripForDisplay as Vc, hasReadableOutputs as Vi, buildFinalSnapshotIdentifier as Vn, carryLogOnlyValues as Vo, reDisableInstanceApiTermination as Vr, isAccessDenied$1 as Vs, withStackRecords as Vt, resolveDynamoDbDeleteBudgetClock as W, withheldAccountClause as Wa, Synthesizer as Wc, isReadableResourceEntry as Wi, effectiveDeletionPolicy as Wn, literalSplitDelimitersOf as Wo, INTRINSIC_KEYS as Wr, acceptedCreateOnlyDropsOf as Ws, demoteSupersededOrphans as Wt, ECR_AUTO_DELETE_IMAGES_TAG as X, hasNoCloudControlHandlers as Xa, resolveAutoAssetStorage as Xc, malformedLocalResourcesWarning as Xi, findDestructiveChanges as Xn, createSecretMasker as Xo, assertFlagRoleArn as Xr, importableOutputKeys as Xs, recordUnderIdIsNotOwn as Xt, waitForIndexesSettled as Y, NO_CC_HANDLERS_REASON as Ya, resolveApp as Yc, malformedLocalResourceEntriesWarning as Yi, constructPathOf as Yn, shareLogOnlyValues as Yo, applyRoleArnIfSet as Yr, hasUnverifiableParameterRefusal as Ys, recheckFailedPlan as Yt, S3_AUTO_DELETE_OBJECTS_TAG as Z, findReplacedReadersOfRecreateTargets as Za, resolveCaptureObservedState as Zc, malformedOrphanRecordsRefusalMessage as Zi, formatDestructiveChange as Zn, errorCauseChain as Zo, assertSendableRoleArn as Zr, importableOutputs as Zs, replacementNeverSwapped as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedOrphansForOrphan as _a, readBootstrapMarkerBody as _c, getAccountInfo as _i, StageLoadError as _l, secretSafeKeyDisplay as _n, requireConfigString as _o, wouldReturnToSdkProvider as _r, recordPhysicalNameCopy as _s, displacedOpClause as _t, findNestedTemplateTreeDefect as a, malformedResourceEntriesWarning as aa, WorkGraph as ac, isSettledInstanceState as ai, CFN_TEMPLATE_BODY_LIMIT as al, isRedactedRecordedValue as an, isWarmThroughputDecrease as ao, DBPROXY_TAG_OPTIONS as ar, withPhysicalNameCopies as as, cyan as at, lookupEachName as b, refuseMalformedResourceAttributesForOrphan as ba, buildDenyExternalAccessPolicy as bc, carriesFetchableDynamicReference as bi, hasOwnKey as bl, exportNameSecretExposure as bn, describeTypeWithThrottleRetry as bo, isCustomResourceType as br, provenPublicValue as bs, getNestedRevertRun as bt, renderNestedTemplateTreeDefect as c, malformedScrubResourceEntriesRefusalMessage as ca, loadPublishableAssetManifest as cc, s3BucketDualStackDomainName as ci, findLargeInlineResources as cl, updatePartialMessage as cn, coerceCfnBoolean as co, refuseMalformedDesiredTags as cr, dynamicReferenceTokens as cs, red as ct, conditionInputsFrom as d, refuseDivergentRecordRegionForDestroy as da, BOOTSTRAP_MARKER_PREFIX as dc, classifyReplaySecretRegion as di, decodeListingKey as dl, DeploymentEventsStore as dn, configIntegerRefusal as do, definedAttributes as dr, identityKeyFor as ds, namesAnyDeclaredParameter as dt, malformedOrphansRefusalMessage as ea, orphansCarriedFrom as ec, sendableAssumeRoleCommand as ei, resolveStateBucketWithDefaultAndSource as el, orphanDeleteNeedsIdentity as en, isStatefulRecreateTargetForReplace as eo, ledgerForStack as er, markSameGenerationBag as es, getPriorAttempts as et, parentSuppliedValues as f, refuseMalformedNestedChildOutputs as fa, assertAssetBucketRegion as fc, producerRegionsFromState as fi, expectedOwnerParam as fl, WITHHELD_NAME_DISPLAY as fn, configStringRefusal as fo, stringifyIfAssigned as fr, inheritNestedStackParameterAssociations as fs, reachableDivergentParameters as ft, mergeNoChangeOutputs as g, refuseMalformedOrphansForDestroy as ga, parseBootstrapMarker as gc, parameterTypeMayLoseSecretIdentity as gi, AssemblyReader as gl, secretBearingStateKeyWarning as gn, requireConfigObject as go, isCustomResource as gr, recordAttributeIdCopy as gs, NESTED_PENDING_PARENT_REASON as gt, keptWholeReasonText as h, refuseMalformedOrphans as ha, isCrossRegionRedirect as hc, isUnboundTemplateParameter as hi, derivePartitionAndUrlSuffix as hl, secretBearing as hn, requireConfigArray as ho, ccBrokenReason as hr, physicalNameCopiesOf as hs, planOrphanAdoption as ht, childTemplateLoader as i, malformedRenderedContainersWarning as ia, stringifyValue as ic, envCredentialsAreAssumedRole as ii, ssmResolvedValueType as il, REDACTED_DELETE_ADDRESS_SKIP_REASON as in, coerceWarmThroughput as io, DBPROXY_TAGS_WHAT as ir, scrubResourceRecord as is, bold as it, noEchoExactEchoLeavesOf as j, refuseMalformedResourcesForDeploy as ja, isMalformedEnvKey as jc, declaresNoEcho as ji, clearBucketRegionCache as jl, maskEventTextWithBoundBags as jn, maskWholeValue as jo, deleteIndeterminateGuards as jr, WHOLE_DYNAMIC_REFERENCE_PATTERN as js, isHandledOrphan as jt, noEchoAttributeNamesOf as k, refuseMalformedResourcePropertiesForExport as ka, getDockerCmd as kc, parameterInputsFor as ki, injectAwsRegion as kl, completedReplayEntries as kn, maskAtCoordinates as ko, RollbackInlinePolicyWriters as kr, STATE_SOURCED_READBACK_RULES as ks, deleteJournaledOrphans as kt, templateIdentity as l, malformedStateRefusalMessage as la, rewriteTemplateAssetReferences as lc, s3BucketRegionalDomainName as li, uploadCfnTemplate as ll, updatePartialReason as ln, coerceCfnInteger as lo, tagMapAsList as lr, isUncertifiedBaselineMaskPosition as ls, yellow as lt, isSecretBearingReferenceString as m, refuseMalformedOrphanRecordsForDestroy as ma, getBootstrapMarkerKey as mc, coerceParameterTypedValue as mi, canonicalizeRegion as ml, exportAliasCollisionScrubWarning as mn, replayWarn as mo, ProviderRegistry as mr, recoverMaskedOutput as ms, makeSiblingClaimReader as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedOutputsRefusalMessage as na, AssetPublisher as nc, applyCallerIdentityCredentials as ni, stateBucketExistenceConfirmed as nl, getCurrentProducerRegions as nn, renderStatefulReason as no, withCreateTokenLedger as nr, snapshotPassProvenance as ns, formatResourceLine as nt, isAbsoluteAssetPath as o, malformedResourcePropertiesWarning as oa, buildAssetRedirectMap as oc, s3BucketArn as oi, CFN_TEMPLATE_URL_LIMIT as ol, redactedDeleteAddressFields as on, toCfnInteger as oo, planTagDiff as or, withoutPhysicalNameCopies as os, gray as ot, readRecordedConditionVerdicts as p, refuseMalformedOrphanRecords as pa, ensureAssetStorage as pc, regionLessSecretName as pi, PARTITION_TABLE as pl, displayTextOrWithheld as pn, readConfigString as po, CC_BROKEN_REASON as pr, recordNestedStackParameterExpressions as ps, resourcesNamingDeclaredParameter as pt, INDEX_SETTLE_POLL_INTERVAL_MS as q, unwrittenCreateOnlyReplacement as qa, getLegacyStateBucketName as qc, malformedExportSourceWarning as qi, unsupportedFinalSnapshotError as qn, recordLogOnlyParameterValue as qo, producerLookupOver as qr, hasReadableExportSet as qs, planFailedOps as qt, computeImplicitDeleteEdges as r, malformedOutputsWarning as ra, isSensitiveAttributeName as rc, callerEnvCredentials as ri, warnDeprecatedNoPrefixCliFlag as rl, inheritProducerRegions as rn, WARM_THROUGHPUT_MEMBERS as ro, acquireIdempotencyToken as rr, redactSecretsForState as rs, createReadOnlyAttributeHealerFactory as rt, listNestedTemplateRows as s, malformedResourcesWarning as sa, createAssetRedirectResolver as sc, s3BucketDomainName as si, MIGRATE_TMP_PREFIX as sl, redactedDeleteAddressSkip as sn, toFiniteNumber as so, readTagList as sr, DYNAMIC_REFERENCE_TOKEN_SCAN as ss, green as st, DeployEngine as t, malformedOrphansWarning as ta, shouldRetainResource as tc, AWS_CREDENTIAL_ENV_KEYS as ti, resolveUseCdkBootstrapAssets as tl, findNestedStackTypeChanges as tn, isStatefulRecreateTargetSync as to, reserveStackCreateToken as tr, recordReferenceProvenanceEntry as ts, markRefusedBeforeApplying as tt, conditionFingerprint as u, previewableOrphanRecords as ua, AssetModeResolver as uc, s3BucketWebsiteUrl as ui, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ul, DeploymentEventsReader as un, configBooleanRefusal as uo, tagPlanWarning as ur, pathCrossesDottedKey as us, computeParameterTaint as ut, chunks as v, refuseMalformedOutputs as va, validateAssetBucketName as vc, isImpossibleEmptyStoredAttribute as vi, processStackMessages as vl, carriedExportAliasExposure as vn, prefetchCreateOnlyPropertyPaths as vo, TemplateNoEchoReresolver as vr, splitGetAttStringForm as vs, displacedPhysicalIdShown as vt, deferredServiceTokenWarning as w, refuseMalformedResourceEntriesForImport as wa, describeDockerExecFailure as wc, cfnRefValueFromPhysicalId as wi, absoluteAssemblyPathEscape as wl, collectPublishedOutputNames as wn, sameLambdaFunctionAddress as wo, applyCustomResourceResponseExpiration as wr, recordNoEchoParameterFreshValue as ws, revertedNestedRowIds as wt, withApiLimit as x, refuseMalformedResourceEntries as xa, buildDockerImage as xc, isNamelessDynamicReferenceError as xi, hasPlainPrototype$1 as xl, isWholeDynamicReferenceValue as xn, withRetry as xo, getCurrentResourceSecrets as xr, recordMaskOnlyValue as xs, nestedChildStackName as xt, isAccessDeniedError as y, refuseMalformedOutputsForDestroy as ya, validateContainerRepoName as yc, carriesDynamicReference as yi, defineOwnKey as yl, exportNameNoEchoParameters as yn, templateResourceTypes as yo, readsNoEchoDeleteValues as yr, carriesSecretMask as ys, dropSettledNestedJournals as yt, DynamoDBGlobalTableProvider as z, repairMalformedResourcePropertiesForReadOnly as za, escapeRegExp$3 as zc, displayLogicalId as zi, ATOMIC_FINAL_SNAPSHOT_TYPES as zn, valueAtCoordinate as zo, isTerminationProtectionPropagationError as zr, applyCrossPrefixScan as zs, destroyStackRecordsView as zt };
+//# sourceMappingURL=deploy-engine-4K_B3N08.js.map