@go-to-k/cdkd 0.298.8 → 0.299.1

package/dist/{deploy-engine-HKmcD4Kn.js → deploy-engine-CZUhJ1IZ.js}

@@ -1,8 +1,8 @@
-import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js";
+import { r as getAwsClients, s as __exportAll } from "./aws-clients-Bj7qH5Ph.js";
 import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, H as truncateCodePoints, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as terminalSafe, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
-import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-CwKiK9nS.js";
-import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-n6UXfuUI.js";
+import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-Pn2m0R67.js";
+import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-DBXBcg0J.js";
+import { t as getCdkdVersion } from "./version-DMqEiJIt.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2308,7 +2308,7 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region, legacyF
 	logger.debug("No state bucket specified, resolving default from account...");
 	const { GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const { S3Client, HeadBucketCommand, ListObjectsV2Command } = await import("@aws-sdk/client-s3");
-	const { getAwsClients } = await import("./aws-clients-CnmtbrxD.js").then((n) => n.n);
+	const { getAwsClients } = await import("./aws-clients-Bj7qH5Ph.js").then((n) => n.n);
 	const { expectedOwnerParam, recordResolvedAccountId } = await Promise.resolve().then(() => expected_bucket_owner_exports);
 	const probeDeps = {
 		HeadBucketCommand,
@@ -4751,7 +4751,8 @@ const STATE_SCHEMA_VERSIONS_READABLE = [
 	8,
 	9,
 	10,
-	11
+	11,
+	12
 ];
 function hasUnverifiableParameterRefusal(record) {
 	return record?.observedBaselineRefused === true && record.observedBaselineRefusalReason === "unverifiable-parameter";
@@ -5482,6 +5483,19 @@ async function rebuildClientForBucketRegion(client, bucket, opts = {}) {
 	return replacement;
 }
 
+//#endregion
+//#region src/state/token-free-state.ts
+const tokenFreeStates = /* @__PURE__ */ new WeakSet();
+function bodyMayCarryReferences(body) {
+	return body.includes("{{resolve:") || body.includes("\"referenceProvenance\"") || body.includes("\"outputReferenceProvenance\"");
+}
+function markTokenFreeState(state) {
+	tokenFreeStates.add(state);
+}
+function isKnownTokenFreeState(state) {
+	return state !== void 0 && tokenFreeStates.has(state);
+}
+
 //#endregion
 //#region src/state/s3-state-backend.ts
 function errorDetail$2(error) {
@@ -5649,6 +5663,7 @@ var S3StateBackend = class S3StateBackend {
 			const bodyString = await response.Body.transformToString();
 			const parsed = this.parseStateBody(bodyString, stackName);
 			const { state, divergentBodyRegion } = this.adoptKeyRegion(parsed, region, shownStackName, shownRegionName);
+			if (!bodyMayCarryReferences(bodyString)) markTokenFreeState(state);
 			this.logger.debug(`Retrieved state: ${shownStackName} (${shownRegionName}), ETag: ${response.ETag}`);
 			return {
 				state,
@@ -5679,7 +5694,7 @@ var S3StateBackend = class S3StateBackend {
 		const { expectedEtag, migrateLegacy } = options;
 		const body = {
 			...state,
-			version: 11,
+			version: 12,
 			stackName,
 			region
 		};
@@ -7174,7 +7189,7 @@ const WHOLE_DYNAMIC_REFERENCE_PATTERN = new RegExp(`^\\{\\{resolve:${DYNAMIC_REF
 function isSingleDynamicReferenceToken(value) {
 	return WHOLE_DYNAMIC_REFERENCE_PATTERN.test(value);
 }
-function isPlainObject$4(value) {
+function isPlainObject$5(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
@@ -7423,7 +7438,7 @@ function crossStackSourceKey(source) {
 	}
 	if (key === "Fn::GetStackOutput") {
 		const args = source[key];
-		if (!isPlainObject$4(args)) return void 0;
+		if (!isPlainObject$5(args)) return void 0;
 		const stackName = Object.hasOwn(args, "StackName") ? literalStringOrUndefined(args["StackName"]) : void 0;
 		const outputName = Object.hasOwn(args, "OutputName") ? literalStringOrUndefined(args["OutputName"]) : void 0;
 		if (stackName === void 0 || outputName === void 0) return void 0;
@@ -7469,7 +7484,7 @@ function crossStackSourceKey(source) {
 		let template;
 		let variables;
 		if (typeof raw === "string") template = raw;
-		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$4(raw[1])) {
+		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$5(raw[1])) {
 			if (typeof raw[0] !== "string") return void 0;
 			template = raw[0];
 			variables = raw[1];
@@ -7712,12 +7727,12 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, rules = TEMPLATE_DERIVED_RULES) {
 	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$4) return;
 	if (secrets.size === 0) return;
-	if (!isPlainObject$4(resolvedProperties) || !isPlainObject$4(sourceProperties)) return;
+	if (!isPlainObject$5(resolvedProperties) || !isPlainObject$5(sourceProperties)) return;
 	if (!Object.hasOwn(resolvedProperties, "Parameters")) return;
 	if (!Object.hasOwn(sourceProperties, "Parameters")) return;
 	const resolvedParameters = resolvedProperties["Parameters"];
 	const sourceParameters = sourceProperties["Parameters"];
-	if (!isPlainObject$4(resolvedParameters) || !isPlainObject$4(sourceParameters)) return;
+	if (!isPlainObject$5(resolvedParameters) || !isPlainObject$5(sourceParameters)) return;
 	const positioned = redactSecretsForState(markSameGenerationBag({ ...resolvedParameters }), secrets, sourceParameters, rules);
 	let table = nestedStackParameterExpressions.get(secrets);
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
@@ -7766,7 +7781,7 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 		if (typeof resolvedValue !== "string") return void 0;
 		const sourceLeaf = sourceParameters[name];
 		if (typeof sourceLeaf === "string") return sourceLeaf;
-		if (!isPlainObject$4(sourceLeaf)) return void 0;
+		if (!isPlainObject$5(sourceLeaf)) return void 0;
 		const written = positioned[name];
 		if (typeof written !== "string") return void 0;
 		const rendered = intrinsicSkeletonSegments(sourceLeaf)?.map((s) => s === UNKNOWN_PART ? "\0" : s).join("");
@@ -7977,7 +7992,7 @@ function appendValuePlaceholderParts(value, out, budget, depth) {
 	if (budget.exhausted) return;
 	const literal = joinPartLiteralText(value);
 	if (literal !== void 0) return pushPlaceholderPart(out, literal, budget);
-	if (isPlainObject$4(value) && Object.keys(value).length === 1) {
+	if (isPlainObject$5(value) && Object.keys(value).length === 1) {
 		const ref = value["Ref"];
 		if (typeof ref === "string" && ref !== "") return pushPlaceholderPart(out, keyedPart({ Ref: ref }), budget);
 		if (depth >= MAX_PLACEHOLDER_DEPTH) {
@@ -8009,7 +8024,7 @@ function appendParameterPlaceholderParts(source, out, budget, depth) {
 		let template;
 		let variables = {};
 		if (typeof args === "string") template = args;
-		else if (Array.isArray(args) && args.length === 2 && isPlainObject$4(args[1])) {
+		else if (Array.isArray(args) && args.length === 2 && isPlainObject$5(args[1])) {
 			template = args[0];
 			variables = args[1];
 		} else return false;
@@ -8157,7 +8172,7 @@ function isUniquelyKeyedBy(items, key) {
 	if (items.length === 0) return false;
 	const seen = /* @__PURE__ */ new Set();
 	for (const item of items) {
-		if (!isPlainObject$4(item) || !Object.hasOwn(item, key)) return false;
+		if (!isPlainObject$5(item) || !Object.hasOwn(item, key)) return false;
 		const id = item[key];
 		if (typeof id !== "string" || id === "") return false;
 		if (seen.has(id)) return false;
@@ -8187,11 +8202,11 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		return positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration);
 	}
-	if ((typeof bag === "string" || Array.isArray(bag)) && isPlainObject$4(source)) {
+	if ((typeof bag === "string" || Array.isArray(bag)) && isPlainObject$5(source)) {
 		const inherited = positionByInheritedParameter(bag, source, secrets);
 		if (inherited !== void 0) return inherited;
 	}
-	if (typeof bag === "string" && isPlainObject$4(source)) {
+	if (typeof bag === "string" && isPlainObject$5(source)) {
 		const certified = positionByCrossStackSource(bag, source, secrets);
 		if (certified !== void 0) return certified;
 		const placeheld = positionByParameterPlaceholders(bag, source, secrets);
@@ -8201,7 +8216,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		const framed = positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIsSameGeneration);
 		if (framed !== void 0) return framed;
 	}
-	if (Array.isArray(bag) && isPlainObject$4(source)) {
+	if (Array.isArray(bag) && isPlainObject$5(source)) {
 		const positionedList = positionListByCrossStackSource(bag, source, secrets);
 		if (positionedList !== void 0) return positionedList;
 	}
@@ -8229,7 +8244,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration));
 	}
-	if (isPlainObject$4(bag) && hasPlainPrototype(bag) && isPlainObject$4(source)) {
+	if (isPlainObject$5(bag) && hasPlainPrototype(bag) && isPlainObject$5(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactSecretsForState(v, secrets);
 		return out;
@@ -8242,7 +8257,7 @@ function isReadbackProjectedFromState(rules) {
 function subtreeHasDynamicReference(value) {
 	if (isDynamicReferenceString(value)) return true;
 	if (Array.isArray(value)) return value.some(subtreeHasDynamicReference);
-	if (isPlainObject$4(value)) return Object.values(value).some(subtreeHasDynamicReference);
+	if (isPlainObject$5(value)) return Object.values(value).some(subtreeHasDynamicReference);
 	return false;
 }
 function pathCrossesDottedKey(bag, path) {
@@ -8317,8 +8332,8 @@ function deepEqualJsonValue(a, b) {
 		if (!Array.isArray(b) || a.length !== b.length) return false;
 		return a.every((item, i) => deepEqualJsonValue(item, b[i]));
 	}
-	if (isPlainObject$4(a)) {
-		if (!isPlainObject$4(b)) return false;
+	if (isPlainObject$5(a)) {
+		if (!isPlainObject$5(b)) return false;
 		if (!hasPlainPrototype(a) || !hasPlainPrototype(b)) return false;
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
@@ -8344,7 +8359,7 @@ function refuseUncertifiedSubtree(value, sourceLiterals, mark, seen = /* @__PURE
 		for (const item of value) out.push(refuseUncertifiedSubtree(item, sourceLiterals, mark, seen));
 		return out;
 	}
-	if (isPlainObject$4(value) && hasPlainPrototype(value)) {
+	if (isPlainObject$5(value) && hasPlainPrototype(value)) {
 		const out = Object.create(null);
 		seen.set(value, out);
 		for (const [k, v] of Object.entries(value)) out[k] = refuseUncertifiedSubtree(v, sourceLiterals, mark, seen);
@@ -8372,7 +8387,7 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 		return mark ? POSITION_DECIDED : source;
 	}
 	if (!subtreeHasDynamicReference(source)) return bag;
-	if (isPlainObject$4(bag) && hasPlainPrototype(bag) && isPlainObject$4(source)) {
+	if (isPlainObject$5(bag) && hasPlainPrototype(bag) && isPlainObject$5(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, failClosed, learn, mark) : v;
 		return out;
@@ -8399,14 +8414,14 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 function isDistinguishingAnchor(value) {
 	if (typeof value === "string") return value !== "";
 	if (Array.isArray(value)) return value.some(isDistinguishingAnchor);
-	if (isPlainObject$4(value)) return Object.values(value).some(isDistinguishingAnchor);
+	if (isPlainObject$5(value)) return Object.values(value).some(isDistinguishingAnchor);
 	return false;
 }
 const ANCHOR_REFERENCE_MASK = "<ref>";
 function anchorSignature(source) {
 	if (isDynamicReferenceString(source)) return ANCHOR_REFERENCE_MASK;
 	if (Array.isArray(source)) return `[${source.map(anchorSignature).sort().join(",")}]`;
-	if (isPlainObject$4(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
+	if (isPlainObject$5(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
 	return JSON.stringify(source) ?? "undefined";
 }
 function anchorsCorroboratePairing(bag, source, anchors) {
@@ -8416,8 +8431,8 @@ function anchorsCorroboratePairing(bag, source, anchors) {
 		return true;
 	}
 	if (isDynamicReferenceString(source)) return typeof bag === "string";
-	if (isPlainObject$4(source)) {
-		if (!isPlainObject$4(bag)) return false;
+	if (isPlainObject$5(source)) {
+		if (!isPlainObject$5(bag)) return false;
 		return Object.keys(source).every((k) => Object.hasOwn(bag, k) && anchorsCorroboratePairing(bag[k], source[k], anchors));
 	}
 	if (Array.isArray(source)) {
@@ -8508,13 +8523,13 @@ function learnMixedLeafNeedle(collector, bag, source) {
 	learnNeedle(collector, plaintext, token);
 }
 function asChild(marks, key) {
-	return isPlainObject$4(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
+	return isPlainObject$5(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
 }
 function asIndex(marks, index) {
 	return Array.isArray(marks) ? marks[index] : void 0;
 }
 function preferPositionDecisions(scanned, refused, bag, marks, inferred) {
-	if (isPlainObject$4(bag) && hasPlainPrototype(bag) && isPlainObject$4(refused) && isPlainObject$4(scanned)) {
+	if (isPlainObject$5(bag) && hasPlainPrototype(bag) && isPlainObject$5(refused) && isPlainObject$5(scanned)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(refused)) out[k] = preferPositionDecisions(scanned[k], v, bag[k], asChild(marks, k), inferred);
 		return out;
@@ -8953,6 +8968,95 @@ function positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIs
 	}, bagIsSameGeneration);
 }
 
+//#endregion
+//#region src/deployment/secret-redaction/reference-provenance.ts
+const passProvenanceOf = /* @__PURE__ */ new WeakMap();
+const MAX_REFERENCE_VERSIONS = 8;
+function entryFor(secrets, token) {
+	let table = passProvenanceOf.get(secrets);
+	if (table === void 0) {
+		table = /* @__PURE__ */ new Map();
+		passProvenanceOf.set(secrets, table);
+	}
+	let entry = table.get(token);
+	if (entry === void 0) {
+		entry = {
+			regions: /* @__PURE__ */ new Set(),
+			regionUnknown: false,
+			versions: /* @__PURE__ */ new Set(),
+			versionUnknown: false,
+			readVersions: /* @__PURE__ */ new Set()
+		};
+		table.set(token, entry);
+	}
+	return entry;
+}
+function recordReferenceResolution(secrets, token, resolution) {
+	const entry = entryFor(secrets, token);
+	if (resolution.region === void 0) entry.regionUnknown = true;
+	else entry.regions.add(resolution.region);
+	if (resolution.version === void 0) {
+		entry.versionUnknown = true;
+		return;
+	}
+	entry.versions.add(resolution.version);
+	if (resolution.route === "read") entry.readVersions.add(resolution.version);
+}
+function recordReferenceProvenanceEntry(secrets, token, provenance, route) {
+	const entry = entryFor(secrets, token);
+	if (provenance.region === void 0) entry.regionUnknown = true;
+	else entry.regions.add(provenance.region);
+	if (provenance.versions === void 0 || provenance.versions.length === 0) {
+		entry.versionUnknown = true;
+		return;
+	}
+	for (const version of provenance.versions) {
+		entry.versions.add(version);
+		if (route === "read") entry.readVersions.add(version);
+	}
+	if (route === "literal") for (const version of provenance.readVersions ?? []) entry.readVersions.add(version);
+}
+function mergeReferenceProvenance(from, to) {
+	const source = passProvenanceOf.get(from);
+	if (source === void 0 || from === to) return;
+	for (const [token, entry] of source) {
+		const target = entryFor(to, token);
+		for (const region of entry.regions) target.regions.add(region);
+		target.regionUnknown ||= entry.regionUnknown;
+		for (const version of entry.versions) target.versions.add(version);
+		target.versionUnknown ||= entry.versionUnknown;
+		for (const version of entry.readVersions) target.readVersions.add(version);
+	}
+}
+function hasPassProvenance(secrets) {
+	if (secrets === void 0) return false;
+	const table = passProvenanceOf.get(secrets);
+	return table !== void 0 && table.size > 0;
+}
+function passProvenanceFor(secrets, token) {
+	if (secrets === void 0) return void 0;
+	const entry = passProvenanceOf.get(secrets)?.get(token);
+	if (entry === void 0) return void 0;
+	return finalize(entry);
+}
+function finalize(entry) {
+	const out = {};
+	if (!entry.regionUnknown && entry.regions.size === 1) out.region = [...entry.regions][0];
+	if (!entry.versionUnknown && entry.versions.size > 0 && entry.versions.size <= 8) {
+		out.versions = [...entry.versions].sort();
+		if (entry.readVersions.size > 0) out.readVersions = [...entry.readVersions].sort();
+	}
+	return out;
+}
+function snapshotPassProvenance(secrets) {
+	if (secrets === void 0) return void 0;
+	const table = passProvenanceOf.get(secrets);
+	if (table === void 0 || table.size === 0) return void 0;
+	const out = /* @__PURE__ */ new Map();
+	for (const [token, entry] of table) out.set(token, finalize(entry));
+	return out;
+}
+
 //#endregion
 //#region src/deployment/secret-redaction/pairs.ts
 const resolvedPairsOf = /* @__PURE__ */ new WeakMap();
@@ -8973,6 +9077,7 @@ function recordResolvedPair(secrets, expression, plaintext) {
 }
 function mergeResolvedPairs(from, to) {
 	carryMaskOnlyMarks(from, to);
+	mergeReferenceProvenance(from, to);
 	const pairs = resolvedPairsOf.get(from);
 	if (pairs === void 0) return;
 	for (const [expression, plaintext] of pairs) if (typeof plaintext === "string") recordResolvedPair(to, expression, plaintext);
@@ -9543,7 +9648,7 @@ function readsNoEchoSource(node, sources) {
 			if (typeof argument === "string") return subStringReadsNoEcho(argument, void 0, sources);
 			if (Array.isArray(argument)) {
 				const [text, variables] = argument;
-				const vars = isPlainObject$4(variables) ? variables : void 0;
+				const vars = isPlainObject$5(variables) ? variables : void 0;
 				if (typeof text === "string" && subStringReadsNoEcho(text, vars, sources)) return true;
 				return vars !== void 0 && Object.values(vars).some(walk);
 			}
@@ -9577,7 +9682,7 @@ function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
 		parameters: sources.parameters,
 		...sources.conditions !== void 0 && { conditions: sources.conditions }
 	};
-	const isBareDeclaredGetAtt = (node) => isPlainObject$4(node) && intrinsicKeyOf(node) === "Fn::GetAtt" && getAttReadsNoEcho(node["Fn::GetAtt"], sources);
+	const isBareDeclaredGetAtt = (node) => isPlainObject$5(node) && intrinsicKeyOf(node) === "Fn::GetAtt" && getAttReadsNoEcho(node["Fn::GetAtt"], sources);
 	const walk = (source, value, path) => {
 		if (value === void 0) return;
 		if (source === null || typeof source !== "object") return;
@@ -9593,7 +9698,7 @@ function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
 			const record = source;
 			const intrinsic = intrinsicKeyOf(record);
 			if (intrinsic === void 0) {
-				if (!isPlainObject$4(value)) {
+				if (!isPlainObject$5(value)) {
 					if (readsNoEchoSource(record, parametersOnly)) push(path, source);
 					return;
 				}
@@ -9641,7 +9746,7 @@ function maskWholeValue(value) {
 	if (value === null || value === void 0) return value;
 	if (typeof value === "string" && isSingleDynamicReferenceToken(value)) return value;
 	if (Array.isArray(value)) return value.map(maskWholeValue);
-	if (isPlainObject$4(value)) {
+	if (isPlainObject$5(value)) {
 		const out = {};
 		for (const [key, child] of Object.entries(value)) Object.defineProperty(out, key, {
 			value: maskWholeValue(child),
@@ -9664,7 +9769,7 @@ function readAt(bag, coordinate) {
 			node = node[segment];
 			continue;
 		}
-		if (!isPlainObject$4(node) || !Object.hasOwn(node, segment)) return {
+		if (!isPlainObject$5(node) || !Object.hasOwn(node, segment)) return {
 			found: false,
 			value: void 0
 		};
@@ -9680,7 +9785,7 @@ function valueAtCoordinate(bag, coordinate) {
 }
 function cloneContainer(node) {
 	if (Array.isArray(node)) return [...node];
-	if (isPlainObject$4(node)) return { ...node };
+	if (isPlainObject$5(node)) return { ...node };
 	return node;
 }
 function maskAtCoordinates(bag, coordinates) {
@@ -9747,20 +9852,20 @@ function readbackPathFor(readback, properties, coordinate) {
 			if (!Array.isArray(live)) return path.length === 0 ? void 0 : path;
 			const key = Array.isArray(desired) ? identityKeyFor(live, desired) : void 0;
 			const element = Array.isArray(desired) ? desired[segment] : void 0;
-			if (key === void 0 || !isPlainObject$4(element)) return path;
+			if (key === void 0 || !isPlainObject$5(element)) return path;
 			const identity = element[key];
-			const index = live.findIndex((item) => isPlainObject$4(item) && item[key] === identity);
+			const index = live.findIndex((item) => isPlainObject$5(item) && item[key] === identity);
 			if (index < 0) return path;
 			path.push(index);
 			live = live[index];
 			desired = element;
 			continue;
 		}
-		if (!isPlainObject$4(live)) return path.length === 0 ? void 0 : path;
+		if (!isPlainObject$5(live)) return path.length === 0 ? void 0 : path;
 		if (!Object.hasOwn(live, segment)) return void 0;
 		path.push(segment);
 		live = live[segment];
-		desired = isPlainObject$4(desired) ? desired[segment] : void 0;
+		desired = isPlainObject$5(desired) ? desired[segment] : void 0;
 	}
 	return path;
 }
@@ -9789,7 +9894,7 @@ function witnessNormalize(stored, today, v11) {
 	const confirmed = [];
 	const differing = [];
 	const walk = (s, t, v, path) => {
-		if (v !== "***" && containsMask(v) && (Array.isArray(v) ? !Array.isArray(s) || s.length !== v.length : isPlainObject$4(v) ? !isPlainObject$4(s) : false)) {
+		if (v !== "***" && containsMask(v) && (Array.isArray(v) ? !Array.isArray(s) || s.length !== v.length : isPlainObject$5(v) ? !isPlainObject$5(s) : false)) {
 			if (s === void 0 || containsMask(s)) return s;
 			if (jsonEqual(s, t)) {
 				confirmed.push(path);
@@ -9818,8 +9923,8 @@ function witnessNormalize(stored, today, v11) {
 			});
 			return changed ? out : s;
 		}
-		if (isPlainObject$4(v) && isPlainObject$4(s)) {
-			const tt = isPlainObject$4(t) ? t : {};
+		if (isPlainObject$5(v) && isPlainObject$5(s)) {
+			const tt = isPlainObject$5(t) ? t : {};
 			let out;
 			for (const key of Object.keys(v)) {
 				if (!Object.hasOwn(s, key)) continue;
@@ -9842,7 +9947,7 @@ function witnessNormalize(stored, today, v11) {
 function containsMask(value) {
 	if (value === "***") return true;
 	if (Array.isArray(value)) return value.some(containsMask);
-	if (isPlainObject$4(value)) return Object.values(value).some(containsMask);
+	if (isPlainObject$5(value)) return Object.values(value).some(containsMask);
 	return false;
 }
 function jsonEqual(a, b) {
@@ -9886,7 +9991,7 @@ function noEchoComparison(options) {
 					const out = node.map(walk);
 					return out.some((item, i) => item !== node[i]) ? out : node;
 				}
-				if (isPlainObject$4(node)) {
+				if (isPlainObject$5(node)) {
 					let out;
 					for (const [key, child] of Object.entries(node)) {
 						const next = walk(child);
@@ -11813,6 +11918,14 @@ const inFlightLookups = /* @__PURE__ */ new Map();
 function getCreateOnlyPropertyPaths(resourceType) {
 	return lookupCreateOnlyPropertyPaths(resourceType, false);
 }
+function cachedCreateOnlyPropertyPaths(resourceType) {
+	if (hasNoRegistrySchema(resourceType)) return Promise.resolve([]);
+	if (inFlightLookups.has(resourceType)) return void 0;
+	const cached = createOnlyPropertiesCache.get(resourceType);
+	if (cached !== void 0) return cached;
+	const snapshot = CREATE_ONLY_PATHS_SNAPSHOT.get(resourceType);
+	return snapshot === void 0 ? void 0 : Promise.resolve(snapshot);
+}
 function prefetchCreateOnlyPropertyPaths(resourceTypes) {
 	const started = [];
 	for (const type of new Set(resourceTypes)) {
@@ -12765,7 +12878,7 @@ function probeFoundSameId(resourceType, a, b) {
 //#region src/provisioning/config-shape.ts
 function readConfigString(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return fallback;
-	if (!isPlainObject$3(container) || isUnresolvedIntrinsicContainer(container)) {
+	if (!isPlainObject$4(container) || isUnresolvedIntrinsicContainer(container)) {
 		const detail = malformedShapeDetail(container);
 		if (options?.onUnusable) {
 			const named = fallback === "" ? "" : ` (${fallback})`;
@@ -12805,7 +12918,7 @@ function requireConfigArray(value, path, options) {
 	return value;
 }
 function requireConfigObject(value, path, options) {
-	if (!isPlainObject$3(value) || isUnresolvedIntrinsicContainer(value)) {
+	if (!isPlainObject$4(value) || isUnresolvedIntrinsicContainer(value)) {
 		const detail = malformedShapeDetail(value);
 		if (options?.onUnusable) {
 			options.onUnusable(`${path} must be an object ${detail}. Leaving this configuration unapplied here; the same value is REFUSED on a template-path create.`);
@@ -12817,7 +12930,7 @@ function requireConfigObject(value, path, options) {
 }
 function configStringRefusal(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$3(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$4(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	return configValueRefusal(container[key], fallback, `${containerPath}.${key}`, options);
 }
 function coerceCfnBoolean(value) {
@@ -12830,7 +12943,7 @@ function coerceCfnBoolean(value) {
 }
 function configBooleanRefusal(container, key, containerPath) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$3(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$4(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	if (coerceCfnBoolean(value) !== void 0) return void 0;
@@ -12844,7 +12957,7 @@ function coerceCfnInteger(value) {
 }
 function configIntegerRefusal(container, key, containerPath, min, max) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$3(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$4(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	const n = coerceCfnInteger(value);
@@ -12858,10 +12971,10 @@ function configValueRefusal(value, fallback, path, options) {
 	if (typeof value !== "string" || value.trim() === "") return `${path} must be a non-empty string ${malformedShapeDetail(value)}`;
 }
 function malformedShapeDetail(value) {
-	if (isPlainObject$3(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
+	if (isPlainObject$4(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
 	return `(got ${describe(value)}) — check for an unresolved intrinsic or a mis-nested template value`;
 }
-function isPlainObject$3(value) {
+function isPlainObject$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 const NAMEABLE_INTRINSIC_KEYS = /* @__PURE__ */ new Set([
@@ -12888,7 +13001,7 @@ function describe(value) {
 	if (value === null) return "null";
 	if (Array.isArray(value)) return "an array";
 	if (typeof value === "string") return value.trim() === "" ? "a blank string" : "a string";
-	if (isPlainObject$3(value) && isUnresolvedIntrinsicContainer(value)) {
+	if (isPlainObject$4(value) && isUnresolvedIntrinsicContainer(value)) {
 		const key = Object.keys(value)[0];
 		return NAMEABLE_INTRINSIC_KEYS.has(key) ? `an unresolved ${key} intrinsic` : "an unresolved intrinsic";
 	}
@@ -17778,7 +17891,7 @@ function maskedPropertyFingerprint(templateValue) {
 	return `${FINGERPRINT_PREFIX}${digest}`;
 }
 var UnknownInput = class extends Error {};
-function isPlainObject$2(value) {
+function isPlainObject$3(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 const DYNAMIC_REFERENCE_OPEN = "{{resolve:";
@@ -17798,7 +17911,7 @@ function carriesSecretValue(value, corpora) {
 	return false;
 }
 function parameterInputsFor(args) {
-	const declared = isPlainObject$2(args.template.Parameters) ? args.template.Parameters : {};
+	const declared = isPlainObject$3(args.template.Parameters) ? args.template.Parameters : {};
 	const values = args.values ?? {};
 	const inputs = /* @__PURE__ */ new Map();
 	const bound = {};
@@ -17809,7 +17922,7 @@ function parameterInputsFor(args) {
 			continue;
 		}
 		const value = values[name];
-		let secret = isPlainObject$2(definition) && declaresNoEcho(definition) || carriesSecretValue(value, []);
+		let secret = isPlainObject$3(definition) && declaresNoEcho(definition) || carriesSecretValue(value, []);
 		if (!secret && args.nestedChild === true && args.supplied !== void 0) {
 			if (Object.hasOwn(args.supplied, name)) {
 				const passed = args.passedClasses?.get(name);
@@ -17860,7 +17973,7 @@ function intrinsicKey(value) {
 const OPAQUE_ATTRIBUTE_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::CustomResource", NESTED_STACK_TYPE$4]);
 function hasOpaqueAttributes(logicalId, walk) {
 	const definition = walk.resources[logicalId];
-	const type = isPlainObject$2(definition) ? definition["Type"] : void 0;
+	const type = isPlainObject$3(definition) ? definition["Type"] : void 0;
 	return typeof type === "string" && (type.startsWith("Custom::") || OPAQUE_ATTRIBUTE_TYPES.has(type));
 }
 function getAttTarget(operand) {
@@ -17885,7 +17998,7 @@ function taintOf(logicalId, walk) {
 	const visit = (value) => {
 		if (typeof value === "string") return value.includes(DYNAMIC_REFERENCE_OPEN);
 		if (Array.isArray(value)) return value.some(visit);
-		if (!isPlainObject$2(value)) return false;
+		if (!isPlainObject$3(value)) return false;
 		const key = intrinsicKey(value);
 		const operand = key === void 0 ? void 0 : value[key];
 		let verdict = "clean";
@@ -17897,7 +18010,7 @@ function taintOf(logicalId, walk) {
 		else if (key === "Fn::FindInMap" && mapReadClass(operand, walk.sources.template) !== "clean") verdict = "tainted";
 		else if (key === "Fn::Sub") {
 			const text = Array.isArray(operand) ? operand[0] : operand;
-			const vars = Array.isArray(operand) && isPlainObject$2(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$3(operand[1]) ? operand[1] : {};
 			if (typeof text === "string") for (const name of subPlaceholders(text)) {
 				if (Object.hasOwn(vars, name)) continue;
 				const owner = name.includes(".") ? name.split(".")[0] : name;
@@ -17911,7 +18024,7 @@ function taintOf(logicalId, walk) {
 		return Object.values(value).some(visit);
 	};
 	const definition = walk.resources[logicalId];
-	const result = visit(isPlainObject$2(definition) ? definition["Properties"] : void 0) ? "tainted" : unknown ? "unknown" : "clean";
+	const result = visit(isPlainObject$3(definition) ? definition["Properties"] : void 0) ? "tainted" : unknown ? "unknown" : "clean";
 	walk.inProgress.delete(logicalId);
 	walk.taint.set(logicalId, result);
 	return result;
@@ -17927,7 +18040,7 @@ function conditionInput(name, walk) {
 	return typeof verdict === "boolean" ? verdict : "unknown";
 }
 function conditionClosure(name, walk) {
-	const definitions = isPlainObject$2(walk.sources.template.Conditions) ? walk.sources.template.Conditions : {};
+	const definitions = isPlainObject$3(walk.sources.template.Conditions) ? walk.sources.template.Conditions : {};
 	let secret = false;
 	let unknown = false;
 	let unread = false;
@@ -17942,7 +18055,7 @@ function conditionClosure(name, walk) {
 			value.forEach(visit);
 			return;
 		}
-		if (!isPlainObject$2(value)) return;
+		if (!isPlainObject$3(value)) return;
 		const keys = Object.keys(value);
 		if (keys.length === 1 && keys[0] === "Condition" && typeof value["Condition"] === "string") {
 			pending.push(value["Condition"]);
@@ -17975,7 +18088,7 @@ function conditionClosure(name, walk) {
 		if (key === "Fn::Sub") {
 			const operand = value["Fn::Sub"];
 			const text = Array.isArray(operand) ? operand[0] : operand;
-			const vars = Array.isArray(operand) && isPlainObject$2(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$3(operand[1]) ? operand[1] : {};
 			if (typeof text === "string") for (const name of subPlaceholders(text)) {
 				if (Object.hasOwn(vars, name)) continue;
 				if (name.includes(".") && !name.startsWith("AWS::")) secret = true;
@@ -18004,8 +18117,8 @@ function mapReadClass(operand, template) {
 	const mapName = Array.isArray(operand) ? operand[0] : void 0;
 	if (typeof mapName !== "string") return "unknown";
 	const mappings = template.Mappings;
-	const map = isPlainObject$2(mappings) && Object.hasOwn(mappings, mapName) ? mappings[mapName] : void 0;
-	if (!isPlainObject$2(map)) return "unknown";
+	const map = isPlainObject$3(mappings) && Object.hasOwn(mappings, mapName) ? mappings[mapName] : void 0;
+	if (!isPlainObject$3(map)) return "unknown";
 	return carriesSecretValue(map, []) ? "secret" : "clean";
 }
 async function resolvedInput(node, walk) {
@@ -18073,7 +18186,7 @@ async function inputForm(value, walk) {
 			concrete: parts.every((p) => p.concrete)
 		};
 	}
-	if (!isPlainObject$2(value)) return {
+	if (!isPlainObject$3(value)) return {
 		form: value,
 		concrete: true
 	};
@@ -18136,7 +18249,7 @@ async function inputForm(value, walk) {
 					concrete: false
 				};
 			}
-			const explicit = Array.isArray(operand) && isPlainObject$2(operand[1]) ? operand[1] : {};
+			const explicit = Array.isArray(operand) && isPlainObject$3(operand[1]) ? operand[1] : {};
 			const vars = await inputForm(explicit, walk);
 			const placeholders = [];
 			let concrete = vars.concrete && !text.includes(DYNAMIC_REFERENCE_OPEN);
@@ -18189,8 +18302,8 @@ function newWalk(sources, nested = {
 }) {
 	return {
 		sources,
-		resources: isPlainObject$2(sources.template.Resources) ? sources.template.Resources : {},
-		parameters: isPlainObject$2(sources.template.Parameters) ? sources.template.Parameters : {},
+		resources: isPlainObject$3(sources.template.Resources) ? sources.template.Resources : {},
+		parameters: isPlainObject$3(sources.template.Parameters) ? sources.template.Parameters : {},
 		taint: /* @__PURE__ */ new Map(),
 		inProgress: /* @__PURE__ */ new Set(),
 		stackChain: nested.stackChain,
@@ -18214,34 +18327,34 @@ function passedKey(passed) {
 function isNestedStackRow(logicalId, walk) {
 	if (!Object.hasOwn(walk.resources, logicalId)) return false;
 	const definition = walk.resources[logicalId];
-	return isPlainObject$2(definition) && definition["Type"] === NESTED_STACK_TYPE$4;
+	return isPlainObject$3(definition) && definition["Type"] === NESTED_STACK_TYPE$4;
 }
 function getAttAttribute(operand, target) {
 	if (Array.isArray(operand)) return operand.length === 2 && typeof operand[1] === "string" ? operand[1] : void 0;
 	return typeof operand === "string" ? operand.slice(target.length + 1) : void 0;
 }
 function rowParameters(definition) {
-	const properties = isPlainObject$2(definition) ? definition["Properties"] : void 0;
+	const properties = isPlainObject$3(definition) ? definition["Properties"] : void 0;
 	if (properties === void 0) return {};
-	if (!isPlainObject$2(properties)) return "unknown";
+	if (!isPlainObject$3(properties)) return "unknown";
 	const parameters = properties["Parameters"];
 	if (parameters === void 0) return {};
-	if (!isPlainObject$2(parameters) || intrinsicKey(parameters) !== void 0) return "unknown";
+	if (!isPlainObject$3(parameters) || intrinsicKey(parameters) !== void 0) return "unknown";
 	return parameters;
 }
 function childParameterInputs(template, passed) {
-	const declared = isPlainObject$2(template.Parameters) ? template.Parameters : {};
+	const declared = isPlainObject$3(template.Parameters) ? template.Parameters : {};
 	const inputs = /* @__PURE__ */ new Map();
 	for (const name of Object.keys(declared)) {
 		const definition = declared[name];
-		if (isPlainObject$2(definition) && declaresNoEcho(definition)) inputs.set(name, { kind: "secret" });
+		if (isPlainObject$3(definition) && declaresNoEcho(definition)) inputs.set(name, { kind: "secret" });
 		else if (passed.has(name)) {
 			const passedClass = passed.get(name);
 			inputs.set(name, passedClass === "clean" ? {
 				kind: "value",
 				value: void 0
 			} : passedClass === "unknown" ? { kind: "unknown" } : { kind: "secret" });
-		} else if (isPlainObject$2(definition) && Object.hasOwn(definition, "Default") && !carriesSecretValue(definition["Default"], [])) inputs.set(name, {
+		} else if (isPlainObject$3(definition) && Object.hasOwn(definition, "Default") && !carriesSecretValue(definition["Default"], [])) inputs.set(name, {
 			kind: "value",
 			value: definition["Default"]
 		});
@@ -18258,7 +18371,7 @@ function closureClass(closure) {
 	return closure.unread ? "unread" : "clean";
 }
 async function childOutputClass(loaded, outputName, passed, chain, shared) {
-	if (loaded === void 0 || !isPlainObject$2(loaded.template)) return "unknown";
+	if (loaded === void 0 || !isPlainObject$3(loaded.template)) return "unknown";
 	const scopeKey = JSON.stringify([loaded.identity, passedKey(passed)]);
 	const memoKey = JSON.stringify([scopeKey, outputName]);
 	const memo = shared.outputs.get(memoKey);
@@ -18271,8 +18384,8 @@ async function classifyChildOutput(loaded, outputName, passed, chain, shared, sc
 	if (++shared.steps > MAX_NESTED_OUTPUT_STEPS) return "unknown";
 	if (chain.includes(loaded.identity) || chain.length >= MAX_NESTED_OUTPUT_DEPTH) return "unknown";
 	const template = loaded.template;
-	const output = (isPlainObject$2(template.Outputs) ? template.Outputs : {})[outputName];
-	if (!isPlainObject$2(output) || !Object.hasOwn(output, "Value")) return "unknown";
+	const output = (isPlainObject$3(template.Outputs) ? template.Outputs : {})[outputName];
+	if (!isPlainObject$3(output) || !Object.hasOwn(output, "Value")) return "unknown";
 	const scope = {
 		walk: newWalk({
 			template,
@@ -18344,7 +18457,7 @@ async function expressionClass(value, scope) {
 		return result;
 	};
 	if (Array.isArray(value)) return all(value);
-	if (!isPlainObject$2(value)) return "clean";
+	if (!isPlainObject$3(value)) return "clean";
 	const key = intrinsicKey(value);
 	if (key === void 0) return all(Object.values(value));
 	const operand = value[key];
@@ -18359,7 +18472,7 @@ async function expressionClass(value, scope) {
 		case "Fn::Sub": {
 			const text = Array.isArray(operand) ? operand[0] : operand;
 			if (typeof text !== "string") return worseOf("unknown", await expressionClass(operand, scope));
-			const vars = Array.isArray(operand) && isPlainObject$2(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$3(operand[1]) ? operand[1] : {};
 			let result = text.includes(DYNAMIC_REFERENCE_OPEN) ? "secret" : "clean";
 			result = worseOf(result, await all(Object.values(vars)));
 			for (const name of subPlaceholders(text)) {
@@ -18437,7 +18550,7 @@ async function classifyPassedParameters(parameters, sources) {
 }
 async function classifyPassed(parameters, sources, nested) {
 	const classes = /* @__PURE__ */ new Map();
-	if (!isPlainObject$2(parameters)) return classes;
+	if (!isPlainObject$3(parameters)) return classes;
 	for (const [name, expression] of Object.entries(parameters)) {
 		let passedClass;
 		try {
@@ -18478,7 +18591,7 @@ function possiblyMaskedKeys(resolvedProps, corpora) {
 	const wholeShortLeaf = (value) => {
 		if (typeof value === "string") return short.includes(value);
 		if (Array.isArray(value)) return value.some(wholeShortLeaf);
-		if (isPlainObject$2(value)) return Object.values(value).some(wholeShortLeaf);
+		if (isPlainObject$3(value)) return Object.values(value).some(wholeShortLeaf);
 		return false;
 	};
 	return Object.keys(resolvedProps).filter((key) => {
@@ -18509,7 +18622,7 @@ function maskedPropertyFingerprintsOf(record) {
 	const read = /* @__PURE__ */ new Map();
 	if (record === null || typeof record !== "object") return read;
 	const field = record.maskedPropertyFingerprints;
-	if (!isPlainObject$2(field)) return read;
+	if (!isPlainObject$3(field)) return read;
 	for (const [key, value] of Object.entries(field)) if (typeof value === "string" && value.startsWith(FINGERPRINT_PREFIX)) read.set(key, value);
 	return read;
 }
@@ -18517,7 +18630,7 @@ function maskedPropertyInputFingerprintsOf(record) {
 	const read = /* @__PURE__ */ new Map();
 	if (record === null || typeof record !== "object") return read;
 	const field = record.maskedPropertyInputFingerprints;
-	if (!isPlainObject$2(field)) return read;
+	if (!isPlainObject$3(field)) return read;
 	const text = maskedPropertyFingerprintsOf(record);
 	for (const [key, value] of Object.entries(field)) {
 		if (typeof value !== "string" || !value.startsWith(INPUT_FINGERPRINT_PREFIX)) continue;
@@ -18564,7 +18677,7 @@ async function movedMaskedProperties(record, templateProps, fingerprinter, onReb
 function withRebaselinedFingerprints(record, fingerprints) {
 	const text = maskedPropertyFingerprintsOf(record);
 	const field = record.maskedPropertyInputFingerprints;
-	const next = isPlainObject$2(field) ? Object.entries(field) : [];
+	const next = isPlainObject$3(field) ? Object.entries(field) : [];
 	let changed = false;
 	for (const [key, value] of Object.entries(fingerprints)) {
 		if (text.get(key) !== splitInputFingerprint(value).text) continue;
@@ -18597,10 +18710,10 @@ function withMaskedPropertyFingerprints(scrubbed, writtenBag, templateProps, sec
 		fingerprints = maskedPropertyFingerprintsFor(scrubbed.properties, templateProps);
 		inputs = boundInputFingerprints(fingerprints, inputFingerprints);
 	} else {
-		if (!isPlainObject$2(previous)) return scrubbed;
+		if (!isPlainObject$3(previous)) return scrubbed;
 		if (corpora.length === 0) return scrubbed;
 		fingerprints = { ...previous };
-		inputs = isPlainObject$2(previousInputs) ? { ...previousInputs } : void 0;
+		inputs = isPlainObject$3(previousInputs) ? { ...previousInputs } : void 0;
 	}
 	if (fingerprints !== void 0 && corpora.length > 0) {
 		const refused = Object.keys(fingerprints).filter((key) => Object.hasOwn(templateProps, key) && corpora.some((corpus) => templateCarriesNeedle(templateProps[key], corpus)));
@@ -19350,6 +19463,14 @@ function classifyReplaySecretRegion(expression, consumerRegion, importedProducer
 		foreignProducerRegions
 	};
 }
+function classifyRecordedSecretRegion(expression, consumerRegion, importedProducerRegions, recordedRegions) {
+	const recorded = recordedRegions?.get(expression);
+	if (recorded === void 0 || regionLessSecretName(expression) === void 0) return classifyReplaySecretRegion(expression, consumerRegion, importedProducerRegions);
+	return canonicalizeRegion(recorded) === canonicalizeRegion(consumerRegion) ? { kind: "local" } : {
+		kind: "recorded-region",
+		region: recorded
+	};
+}
 
 //#endregion
 //#region src/utils/s3-endpoints.ts
@@ -19538,6 +19659,335 @@ async function constructAttributeForCoreTypes(resource, attributeName, context,
 	return NOT_CONSTRUCTED;
 }
 
+//#endregion
+//#region src/deployment/reference-provenance-record.ts
+const SSM_VERSION = /^[0-9]{1,10}$/;
+const SECRETS_MANAGER_VERSION = /^[A-Za-z0-9_+=.@/-]{32,64}$/;
+function referenceTokensIn(value, into = /* @__PURE__ */ new Set()) {
+	const walk = (v) => {
+		if (typeof v === "string") {
+			if (!v.includes("{{resolve:")) return;
+			for (const token of dynamicReferenceTokens(v)) into.add(token);
+			return;
+		}
+		if (Array.isArray(v)) {
+			for (const item of v) walk(item);
+			return;
+		}
+		if (v !== null && typeof v === "object") for (const item of Object.values(v)) walk(item);
+	};
+	walk(value);
+	return into;
+}
+function recordReferenceTokens(record) {
+	const tokens = referenceTokensIn(record.properties);
+	referenceTokensIn(record.attributes, tokens);
+	referenceTokensIn(record.observedProperties, tokens);
+	return tokens;
+}
+function versionShapeOf(token) {
+	if (token.startsWith("{{resolve:secretsmanager:")) return SECRETS_MANAGER_VERSION;
+	if (token.startsWith("{{resolve:ssm:") || token.startsWith("{{resolve:ssm-secure:")) return SSM_VERSION;
+}
+function isValidReferenceVersion(token, version) {
+	const shape = versionShapeOf(token);
+	return shape !== void 0 && typeof version === "string" && shape.test(version);
+}
+function validReferenceRegion(region) {
+	if (typeof region !== "string") return void 0;
+	return canonicalizeRegion(region) === region && isClientSafeRegion(region) ? region : void 0;
+}
+function isPlainObject$2(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function validateReferenceProvenance(token, raw) {
+	if (!isSingleDynamicReferenceToken(token) || !isPlainObject$2(raw)) return void 0;
+	const versionsRaw = Object.hasOwn(raw, "versions") ? raw["versions"] : void 0;
+	const readRaw = Object.hasOwn(raw, "readVersions") ? raw["readVersions"] : void 0;
+	if (readRaw !== void 0) {
+		if (!Array.isArray(readRaw)) return void 0;
+		const all = Array.isArray(versionsRaw) ? versionsRaw : [];
+		if (!readRaw.every((v) => all.includes(v))) return void 0;
+	}
+	const out = {};
+	const region = validReferenceRegion(Object.hasOwn(raw, "region") ? raw["region"] : void 0);
+	if (region !== void 0) out.region = region;
+	if (Array.isArray(versionsRaw) && versionsRaw.length > 0 && versionsRaw.length <= 8 && versionsRaw.every((v) => isValidReferenceVersion(token, v)) && (readRaw === void 0 || readRaw.every((v) => typeof v === "string"))) {
+		out.versions = [...new Set(versionsRaw)].sort();
+		if (readRaw !== void 0 && readRaw.length > 0) out.readVersions = [...new Set(readRaw)].sort();
+	}
+	return out;
+}
+function referenceProvenanceOf(record) {
+	if (!isPlainObject$2(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	return validatedBag(record["referenceProvenance"]);
+}
+function validatedBag(field) {
+	if (!isPlainObject$2(field)) return void 0;
+	const out = Object.create(null);
+	for (const [token, raw] of Object.entries(field)) {
+		const entry = validateReferenceProvenance(token, raw);
+		if (entry !== void 0) out[token] = entry;
+	}
+	return { ...out };
+}
+function recordedProvenanceOf(record, token) {
+	if (!isPlainObject$2(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	const field = record["referenceProvenance"];
+	if (!isPlainObject$2(field) || !Object.hasOwn(field, token)) return void 0;
+	return validateReferenceProvenance(token, field[token]);
+}
+function recordedReferenceRegions(record) {
+	const field = referenceProvenanceOf(record);
+	return field === void 0 ? void 0 : regionsOf(field);
+}
+function recordedOutputReferenceRegions(state, outputKey) {
+	const field = outputReferenceProvenanceOf(state, outputKey);
+	return field === void 0 ? void 0 : regionsOf(field);
+}
+function regionsOf(field) {
+	let out;
+	for (const [token, entry] of Object.entries(field)) {
+		if (entry.region === void 0) continue;
+		(out ??= /* @__PURE__ */ new Map()).set(token, entry.region);
+	}
+	return out;
+}
+function keepHeldTokenProvenance(record) {
+	if (!hasReferenceProvenanceField(record)) return record;
+	const field = record.referenceProvenance;
+	if (!isPlainObject$2(field)) return record;
+	const held = recordReferenceTokens(record);
+	const keys = Object.keys(field);
+	if (keys.every((token) => held.has(token))) return record;
+	const kept = {};
+	for (const token of keys) if (held.has(token)) kept[token] = field[token];
+	return {
+		...record,
+		referenceProvenance: kept
+	};
+}
+function hasReferenceProvenanceField(record) {
+	return isPlainObject$2(record) && Object.hasOwn(record, "referenceProvenance") && record["referenceProvenance"] !== void 0;
+}
+function outputReferenceProvenanceOf(state, outputKey) {
+	if (!isPlainObject$2(state) || !Object.hasOwn(state, "outputReferenceProvenance")) return;
+	const field = state["outputReferenceProvenance"];
+	if (!isPlainObject$2(field) || !Object.hasOwn(field, outputKey)) return void 0;
+	return validatedBag(field[outputKey]);
+}
+function persistable(token, entry) {
+	return (entry === void 0 ? void 0 : validateReferenceProvenance(token, entry)) ?? {};
+}
+function tokensUnderPaths(properties, paths) {
+	const out = /* @__PURE__ */ new Set();
+	const descend = (value, path, at) => {
+		if (at === path.length) {
+			referenceTokensIn(value, out);
+			return;
+		}
+		if (Array.isArray(value)) {
+			const next = path[at] === "*" ? at + 1 : at;
+			for (const item of value) descend(item, path, next);
+			return;
+		}
+		if (isPlainObject$2(value) && Object.hasOwn(value, path[at])) descend(value[path[at]], path, at + 1);
+	};
+	for (const path of paths) descend(properties, path, 0);
+	return out;
+}
+function provenanceForWrittenRecord(args) {
+	const { record, secrets, previous, inPlace } = args;
+	const previousField = inPlace === void 0 ? void 0 : referenceProvenanceOf(previous);
+	if (!hasPassProvenance(secrets) && previousField === void 0 && args.walkWithoutPassProvenance !== true) return;
+	const tokens = recordReferenceTokens(record);
+	if (tokens.size === 0) return void 0;
+	let kept;
+	if (inPlace !== void 0) {
+		kept = inPlace.createOnly === "all" ? tokens : tokensUnderPaths(record.properties, inPlace.createOnly);
+		if (inPlace.attributesCarried) referenceTokensIn(record.attributes, kept);
+	}
+	const out = {};
+	for (const token of [...tokens].sort()) {
+		const pass = passProvenanceFor(secrets, token);
+		if (kept === void 0 || !kept.has(token)) {
+			out[token] = persistable(token, pass);
+			continue;
+		}
+		const before = previousField !== void 0 && Object.hasOwn(previousField, token) ? previousField[token] : void 0;
+		if (pass === void 0) {
+			out[token] = before === void 0 ? {} : { ...before };
+			continue;
+		}
+		out[token] = persistable(token, unionWithPrevious(pass, before));
+	}
+	return out;
+}
+function unionWithPrevious(pass, before) {
+	const out = {};
+	if (pass.region !== void 0 && (before?.region === void 0 || before.region === pass.region)) out.region = pass.region;
+	if (pass.versions !== void 0 && before?.versions !== void 0) {
+		out.versions = [.../* @__PURE__ */ new Set([...before.versions, ...pass.versions])].sort();
+		if (pass.readVersions !== void 0) out.readVersions = [...pass.readVersions];
+	}
+	return out;
+}
+function outputProvenanceForPersist(args) {
+	const { outputs, resolvedThisRun, carriedFrom, sinkOf } = args;
+	if (!resolvedThisRun) return carriedFrom !== void 0 && isPlainObject$2(carriedFrom.outputReferenceProvenance) ? carriedFrom.outputReferenceProvenance : void 0;
+	let out;
+	for (const [outputKey, value] of Object.entries(outputs)) {
+		const sink = sinkOf(outputKey);
+		if (!hasPassProvenance(sink)) continue;
+		const tokens = referenceTokensIn(value);
+		if (tokens.size === 0) continue;
+		const entries = {};
+		for (const token of [...tokens].sort()) entries[token] = persistable(token, passProvenanceFor(sink, token));
+		out ??= Object.create(null);
+		out[outputKey] = entries;
+	}
+	return out === void 0 ? void 0 : { ...out };
+}
+const KEEP_REFERENCE_PROVENANCE = Symbol("keep reference provenance");
+function withReferenceProvenance(record, field) {
+	if (field === KEEP_REFERENCE_PROVENANCE) return record;
+	if (field === void 0 && !Object.hasOwn(record, "referenceProvenance")) return record;
+	const { referenceProvenance: _previous, ...rest } = record;
+	return field === void 0 ? rest : {
+		...rest,
+		referenceProvenance: field
+	};
+}
+
+//#endregion
+//#region src/deployment/intrinsic-resolver/recorded-reference-routes.ts
+function tokensOf(value) {
+	const out = /* @__PURE__ */ new Set();
+	for (const leaf of wholeStringLeavesOf(value)) for (const token of dynamicReferenceTokens(leaf)) out.add(token);
+	return [...out];
+}
+function recordedTokenRoutes(value, record) {
+	if (!hasReferenceProvenanceField(record)) return void 0;
+	const routes = /* @__PURE__ */ new Map();
+	let recorded = false;
+	for (const token of tokensOf(value)) {
+		const entry = recordedProvenanceOf(record, token);
+		const region = entry?.region;
+		const pin = entry?.versions?.length === 1 ? entry.versions[0] : void 0;
+		if (region !== void 0 || pin !== void 0) recorded = true;
+		routes.set(token, {
+			region,
+			pin
+		});
+	}
+	return recorded ? routes : void 0;
+}
+async function reresolveByRecordedRoutes(resolver, value, logicalId, context, origin, sourceKey, routes, defaults) {
+	const tokens = [...routes.keys()];
+	const regionOf = (token) => routes.get(token)?.region ?? defaults.region;
+	const unrouted = tokens.filter((token) => routes.get(token)?.region === void 0);
+	if (defaults.proofs !== void 0 && unrouted.length > 0) {
+		if (!defaults.proofs.regionProven(unrouted)) {
+			defaults.proofs.onRegionUnproven();
+			return value;
+		}
+	}
+	const routeOf = (token) => {
+		const region = regionOf(token);
+		return region ? {
+			resolver: resolver.resolverForProducerRegion(region, context),
+			context: withoutProducerRegions(context)
+		} : {
+			resolver,
+			context
+		};
+	};
+	const pins = /* @__PURE__ */ new Map();
+	for (const token of tokens) {
+		const pin = routes.get(token)?.pin;
+		if (pin === void 0) continue;
+		const read = await readsPinnedVersion(token, pin, routeOf(token));
+		if (read === "read") pins.set(token, pin);
+		else if (read === "failed" && context.provenanceCapture !== true) resolver.logger.warn(safeMsg`Could not read the secret version ${resolver.displayMasked(logicalId, context)} was deployed with for ${resolver.displayMasked(origin, context)} (it may have been deprecated or deleted); ${defaults.proofs === void 0 ? "serving its current value instead" : "checking its current value against the physical id instead"}.`);
+		if (read === "short" && defaults.proofs === void 0 && context.provenanceCapture !== true) resolver.logger.warn(safeMsg`Not serving ${resolver.displayMasked(origin, context)} at the secret version ${resolver.displayMasked(logicalId, context)} was deployed with: that value is shorter than four characters, so cdkd could not keep it out of state; serving its current value instead.`);
+	}
+	if (defaults.proofs !== void 0) {
+		const unpinned = tokens.filter((token) => !pins.has(token));
+		if (unpinned.length > 0 && !await defaults.proofs.generationProven(unpinned, routeOf)) {
+			defaults.proofs.onGenerationUnproven();
+			return value;
+		}
+	}
+	const walkContext = pins.size > 0 ? {
+		...context,
+		referencePins: pins
+	} : context;
+	const regions = new Set(tokens.map((token) => regionOf(token) ?? ""));
+	if (regions.size <= 1) {
+		const [only] = regions;
+		return await resolver.reresolveCrossStackValue(value, only || void 0, walkContext, origin, sourceKey);
+	}
+	return await rebuildByToken(value, async (token) => String(await resolver.reresolveCrossStackValue(token, regionOf(token), walkContext, origin, void 0)));
+}
+const failedPins = /* @__PURE__ */ new WeakMap();
+async function readsPinnedVersion(token, pin, { resolver, context }) {
+	const key = injectiveKey(token, pin);
+	let failed = failedPins.get(resolver);
+	if (failed?.has(key) === true) return "known";
+	const { abandonedResolutions: _collected, ...throwing } = context;
+	const quiet = {
+		...throwing,
+		provenanceSuppressed: true
+	};
+	try {
+		await resolver.resolveDynamicReferences(token, quiet);
+	} catch (err) {
+		if (isDeliberateResolutionRefusal(err)) throw err;
+	}
+	try {
+		const served = await resolver.resolveDynamicReferences(token, {
+			...quiet,
+			referencePins: /* @__PURE__ */ new Map([[token, pin]])
+		});
+		return !served.includes("{{resolve:") && served.length < 4 ? "short" : "read";
+	} catch (err) {
+		if (isDeliberateResolutionRefusal(err)) throw err;
+		resolver.logger.debug(safeMsg`Pinned read of ${resolver.displayMasked(token, context)} failed: ${resolver.displayMasked(err instanceof Error ? err.message : String(err), context)}`);
+		if (!isThrottlingError(err)) {
+			if (failed === void 0) {
+				failed = /* @__PURE__ */ new Set();
+				failedPins.set(resolver, failed);
+			}
+			failed.add(key);
+		}
+		return "failed";
+	}
+}
+async function rebuildByToken(value, resolveToken) {
+	if (typeof value === "string") {
+		let out = "";
+		let cursor = 0;
+		for (const token of dynamicReferenceTokens(value)) {
+			const at = value.indexOf(token, cursor);
+			if (at < 0) throw new Error("Internal invariant: a scanned dynamic reference was not found in the value it was scanned from");
+			out += value.slice(cursor, at) + await resolveToken(token);
+			cursor = at + token.length;
+		}
+		return out + value.slice(cursor);
+	}
+	if (Array.isArray(value)) {
+		const out = new Array(value.length);
+		for (let i = 0; i < value.length; i++) out[i] = await rebuildByToken(value[i], resolveToken);
+		return out;
+	}
+	if (value !== null && typeof value === "object") {
+		const out = Object.create(null);
+		for (const [k, v] of Object.entries(value)) out[k] = await rebuildByToken(v, resolveToken);
+		return out;
+	}
+	return value;
+}
+
 //#endregion
 //#region src/deployment/intrinsic-resolver/getatt-construct-app.ts
 async function constructAttributeForAppTypes(resource, attributeName, context, logicalId, resourceType, physicalId, accountId, partition, region) {
@@ -19942,7 +20392,14 @@ async function resolveGetAtt(getAtt, context) {
 				structured: isStructured(flatValue),
 				redacted: isSensitiveAttributeName(attributeName)
 			})}`);
-			if (reresolvesNestedReference) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${this.displayLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
+			if (reresolvesNestedReference) {
+				const childRegion = nestedStackChildRegionFromLocalArn(resource.physicalId);
+				const nestedOrigin = `nested stack ${logicalId} ${this.displayLeaf(attributeName, context)}`;
+				const nestedSourceKey = crossStackSourceKey({ "Fn::GetAtt": getAtt });
+				const routes = context.recordedSecretValues === void 0 || carriesSecretMask(flatValue) ? void 0 : recordedTokenRoutes(flatValue, resource);
+				if (routes !== void 0) return await reresolveByRecordedRoutes(this, flatValue, logicalId, context, nestedOrigin, nestedSourceKey, routes, { region: childRegion });
+				return await this.reresolveCrossStackValue(flatValue, childRegion, context, nestedOrigin, nestedSourceKey);
+			}
 			return await this.reresolveRecordedReferences(notedFlatValue, logicalId, context, `${logicalId}.${this.displayLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 		}
 		if (attributeName.includes(".")) {
@@ -20026,6 +20483,17 @@ function recordProducerSecretPairs(logicalId, value, context) {
 	if (bag === void 0 || context.producerSecrets === void 0) return;
 	const producer = context.producerSecrets(logicalId);
 	if (producer === void 0 || producer === bag || producer.size === 0) return;
+	if (hasPassProvenance(producer)) {
+		const served = [...wholeStringLeavesOf(value)];
+		for (const [plaintext, expression] of producer) {
+			if (plaintext.length < 4 || !expression.startsWith("{{resolve:")) continue;
+			if (!served.some((leaf) => leaf.includes(plaintext))) continue;
+			const entry = passProvenanceFor(producer, expression);
+			if (entry === void 0) continue;
+			recordReferenceProvenanceEntry(bag, expression, entry, "read");
+			if (context.provenanceSink !== void 0) recordReferenceProvenanceEntry(context.provenanceSink, expression, entry, "read");
+		}
+	}
 	const preRun = context.producerPreRunPhysicalId?.(logicalId);
 	const record = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
 	if (typeof preRun !== "string" || record?.physicalId !== preRun) return;
@@ -20053,21 +20521,38 @@ function recordSecretNamedRead(logicalId, value, context) {
 async function reresolveRecordedReferences(value, logicalId, context, origin, sourceKey) {
 	if (!carriesDynamicReference(value) || carriesSecretMask(value)) return value;
 	if (context.recordedSecretValues === void 0) return value;
+	const notReresolvingLine = () => this.logger.debug(safeMsg`Not re-resolving the reference(s) in ${this.displayMasked(origin, context)}: the template of ${this.displayMasked(logicalId, context)} does not spell them, and this stack may read a stack in another region, so the region that resolved them is unknown`);
+	const servingAsRecordedLine = () => this.logger.warn(safeMsg`Serving ${this.displayMasked(origin, context)} as recorded, with its {{resolve:...}} reference(s) unresolved: cdkd cannot confirm the secret still holds the value ${this.displayMasked(logicalId, context)} was deployed with, because its physical id does not contain it. Either the secret changed since then (update ${this.displayMasked(logicalId, context)} so cdkd deploys it with the new value), or the value is not part of its name (a custom resource's Data, a name shorter than four characters), and cdkd sends the recorded reference as before.`);
+	const record = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
+	const routes = recordedTokenRoutes(value, record);
+	if (routes !== void 0) return await reresolveByRecordedRoutes(this, value, logicalId, context, origin, sourceKey, routes, {
+		region: void 0,
+		proofs: {
+			regionProven: (tokens) => referencesProvenLocal(tokens, logicalId, context) || referencesRegionProven(tokens, context, this.resolverRegion),
+			onRegionUnproven: notReresolvingLine,
+			generationProven: (tokens, routeOf) => this.referencesMatchPhysicalId(tokens, logicalId, context, routeOf),
+			onGenerationUnproven: () => {
+				if (context.provenanceCapture !== true) servingAsRecordedLine();
+			}
+		}
+	});
 	if (!referencesProvenLocal(value, logicalId, context) && !referencesRegionProven(value, context, this.resolverRegion)) {
-		this.logger.debug(safeMsg`Not re-resolving the reference(s) in ${this.displayMasked(origin, context)}: the template of ${this.displayMasked(logicalId, context)} does not spell them, and this stack may read a stack in another region, so the region that resolved them is unknown`);
+		notReresolvingLine();
 		return value;
 	}
 	if (!await this.referencesMatchPhysicalId(value, logicalId, context)) {
-		this.logger.warn(safeMsg`Serving ${this.displayMasked(origin, context)} as recorded, with its {{resolve:...}} reference(s) unresolved: cdkd cannot confirm the secret still holds the value ${this.displayMasked(logicalId, context)} was deployed with, because its physical id does not contain it. Either the secret changed since then (update ${this.displayMasked(logicalId, context)} so cdkd deploys it with the new value), or the value is not part of its name (a custom resource's Data, a name shorter than four characters), and cdkd sends the recorded reference as before.`);
+		if (context.provenanceCapture) return value;
+		servingAsRecordedLine();
 		return value;
 	}
 	return await this.reresolveCrossStackValue(value, void 0, context, origin, sourceKey);
 }
-async function referencesMatchPhysicalId(value, logicalId, context) {
+async function referencesMatchPhysicalId(value, logicalId, context, routeOf) {
 	const record = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
 	const physicalId = typeof record?.physicalId === "string" ? record.physicalId.toLowerCase() : "";
 	for (const leaf of wholeStringLeavesOf(value)) for (const token of dynamicReferenceTokens(leaf)) {
-		const plaintext = await this.resolveDynamicReferences(token, context);
+		const route = routeOf?.(token);
+		const plaintext = route === void 0 ? await this.resolveDynamicReferences(token, context) : await route.resolver.resolveDynamicReferences(token, route.context);
 		if (plaintext.includes("{{resolve:")) continue;
 		if (plaintext.length < 4) return false;
 		if (!physicalId.includes(plaintext.toLowerCase())) return false;
@@ -20345,7 +20830,10 @@ async function reresolveCrossStackValue(value, producerRegion, context, origin,
 	}
 	if (!carriesDynamicReference(value)) return value;
 	const resolver = this.resolverForProducerRegion(producerRegion, context, producerRegionLogText);
-	const pinnedContext = producerRegion ? withoutProducerRegions(context) : context;
+	const pinnedContext = {
+		...producerRegion ? withoutProducerRegions(context) : context,
+		provenanceRoute: "read"
+	};
 	const walk = async (v) => {
 		if (typeof v === "string") return v.includes("{{resolve:") ? await resolver.resolveDynamicReferences(v, pinnedContext) : v;
 		if (Array.isArray(v)) {
@@ -21147,6 +21635,16 @@ async function getCrossAccountStackState(roleArn, stackName, region, context) {
 function secretVerdictScope(resolver) {
 	return injectiveKey(credentialFingerprint(ambientCredentialConfig()), canonicalizeRegion(resolver.explicitRegion) ?? "");
 }
+function recordProvenanceOfResolution(resolver, context, token, version) {
+	if (context === void 0 || context.provenanceSuppressed === true) return;
+	const resolution = {
+		region: canonicalizeRegion(resolver.explicitRegion),
+		version,
+		route: context.provenanceRoute ?? "literal"
+	};
+	if (context.recordedSecretValues !== void 0) recordReferenceResolution(context.recordedSecretValues, token, resolution);
+	if (context.provenanceSink !== void 0) recordReferenceResolution(context.provenanceSink, token, resolution);
+}
 async function resolveDynamicReferences(value, context) {
 	return (await this.resolveDynamicReferencesWithLogTwin(value, value, context, void 0, true)).result;
 }
@@ -21205,15 +21703,23 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 				if (!foreign.complete || foreign.substitutions.length !== 1) complete = false;
 				continue;
 			}
-			const dynamicReferenceCacheKey = injectiveKey(credentialFingerprint(ambientCredentialConfig()), fullMatch);
-			const cached = this.cachedDynamicReferences.get(dynamicReferenceCacheKey);
+			const pin = context?.referencePins?.get(fullMatch);
+			const credentialKey = credentialFingerprint(ambientCredentialConfig());
+			let dynamicReferenceCacheKey = injectiveKey(credentialKey, fullMatch);
+			let cached = this.cachedDynamicReferences.get(dynamicReferenceCacheKey);
+			const pinnedGeneration = pin !== void 0 && cached?.version !== pin;
+			if (pinnedGeneration) {
+				dynamicReferenceCacheKey = injectiveKey(credentialKey, fullMatch, pin);
+				cached = this.cachedDynamicReferences.get(dynamicReferenceCacheKey);
+			}
 			if (cached) {
 				if (cached.secret && cached.value && !persistedText) this.refuseSecretAssembledReference(fullMatch, tokenLogText, context);
 				const recorded = context?.recordedSecretValues;
 				if (cached.secret && cached.value && recorded) {
 					recorded.set(cached.value, fullMatch);
-					recordResolvedPair(recorded, fullMatch, cached.value);
+					if (!pinnedGeneration) recordResolvedPair(recorded, fullMatch, cached.value);
 				}
+				if (cached.secret && cached.value) recordProvenanceOfResolution(this, context, fullMatch, cached.version);
 				if (service === "ssm" && !cached.secret && recorded && !this.producerRegionGuest) recordProvenPublicExpression(recorded, fullMatch, cached.value);
 				result = result.replace(fullMatch, () => cached.value);
 				twin = twin.replace(fullMatch, () => cached.secret && cached.value ? "***" : cached.value);
@@ -21229,17 +21735,22 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 			let isSecret = isKnownSecret;
 			let cacheable = true;
 			let pinSecureVerdict = false;
-			if (service === "secretsmanager") resolved = await this.resolveSecretsManagerReference(inner, context, nameLogText);
-			else if (service === "ssm") {
+			let resolvedVersion;
+			if (service === "secretsmanager") {
+				const versionOut = {};
+				resolved = await this.resolveSecretsManagerReference(inner, context, nameLogText, versionOut, pinnedGeneration ? pin : void 0);
+				resolvedVersion = versionOut.version;
+			} else if (service === "ssm") {
 				const decrypt = context?.skipDynamicReferences !== true;
-				const param = await this.resolveSSMReference(parts, decrypt, "ssm", context, nameLogText);
+				const param = await this.resolveSSMReference(parts, decrypt, "ssm", context, nameLogText, pinnedGeneration ? pin : void 0);
 				const proofBag = context?.recordedSecretValues;
+				const writesVerdict = !pinnedGeneration;
 				if (param.type === "SecureString") {
 					if (proofBag) contradictProvenPublicExpression(proofBag, fullMatch);
-					if (decrypt) pinSecureVerdict = true;
-					else if (persistedText || !this.tokenAssembledForRecording(fullMatch, tokenLogText, context)) this.pinSecretVerdict(fullMatch, true, verdictScope);
+					if (decrypt) pinSecureVerdict = writesVerdict;
+					else if (writesVerdict && (persistedText || !this.tokenAssembledForRecording(fullMatch, tokenLogText, context))) this.pinSecretVerdict(fullMatch, true, verdictScope);
 				} else if (!param.secure) {
-					this.pinSecretVerdict(fullMatch, false, verdictScope);
+					if (writesVerdict) this.pinSecretVerdict(fullMatch, false, verdictScope);
 					if (proofBag && !this.producerRegionGuest) recordProvenPublicExpression(proofBag, fullMatch, param.value);
 				} else {
 					if (proofBag) contradictProvenPublicExpression(proofBag, fullMatch);
@@ -21253,11 +21764,13 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 					}
 				}
 				resolved = param.value;
+				resolvedVersion = param.version;
 			} else if (service === "ssm-secure") {
-				const param = await this.resolveSSMReference(parts, true, "ssm-secure", context, nameLogText);
+				const param = await this.resolveSSMReference(parts, true, "ssm-secure", context, nameLogText, pinnedGeneration ? pin : void 0);
 				if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${this.displayMasked(tokenLogText, context)}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
 				isSecret = true;
 				resolved = param.value;
+				resolvedVersion = param.version;
 			} else {
 				if (!persistedText && this.tokenAssembledFromSecret(fullMatch, tokenLogText, context)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${this.displayMasked(tokenLogText, context)}: its service is not one cdkd resolves (secretsmanager, ssm, ssm-secure), and the reference was assembled from a secret value, so leaving it as written would send that value to AWS and record it in state in the clear.`));
 				this.logger.warn(this.displayMasked(`Unsupported dynamic reference service: ${this.displayMasked(nameLogText(String(service)), context)}`, context));
@@ -21268,14 +21781,16 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 			if (pinSecureVerdict) this.pinSecretVerdict(fullMatch, true, verdictScope);
 			if (cacheable) this.cachedDynamicReferences.set(dynamicReferenceCacheKey, {
 				value: resolved,
-				secret: isSecret
+				secret: isSecret,
+				...resolvedVersion !== void 0 && { version: resolvedVersion }
 			});
 			if (isSecret && resolved) {
 				const recorded = context?.recordedSecretValues;
 				if (recorded) {
 					recorded.set(resolved, fullMatch);
-					recordResolvedPair(recorded, fullMatch, resolved);
+					if (!pinnedGeneration) recordResolvedPair(recorded, fullMatch, resolved);
 				}
+				recordProvenanceOfResolution(this, context, fullMatch, resolvedVersion);
 				if (service === "secretsmanager" || service === "ssm-secure") this.pinSecretVerdict(fullMatch, true, verdictScope);
 			}
 			result = result.replace(fullMatch, () => resolved);
@@ -21312,7 +21827,7 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 
 //#endregion
 //#region src/deployment/intrinsic-resolver/dynamic-ref-lookups.ts
-async function resolveSecretsManagerReference(inner, context, nameLogText) {
+async function resolveSecretsManagerReference(inner, context, nameLogText, versionOut, pinVersion) {
 	const afterService = inner.substring(15);
 	let secretId;
 	let jsonKey = "";
@@ -21339,7 +21854,10 @@ async function resolveSecretsManagerReference(inner, context, nameLogText) {
 		versionStage = remainingParts[1] || "";
 		versionId = remainingParts[2] || "";
 	} else secretId = afterService;
-	if (!versionStage) versionStage = "AWSCURRENT";
+	if (pinVersion !== void 0) {
+		versionStage = "";
+		versionId = pinVersion;
+	} else if (!versionStage) versionStage = "AWSCURRENT";
 	if (!secretId) throw markNonRetryable(/* @__PURE__ */ new Error("Dynamic reference: secretsmanager SECRET_ID is required"));
 	const loggedSecretId = this.displayMasked(nameLogText(secretId), context);
 	const loggedJsonKey = this.displayMasked(nameLogText(jsonKey), context);
@@ -21350,11 +21868,13 @@ async function resolveSecretsManagerReference(inner, context, nameLogText) {
 		...versionStage && versionStage !== "" && { VersionStage: versionStage },
 		...versionId && versionId !== "" && { VersionId: versionId }
 	});
-	const secretString = (await this.sendWithThrottleRetry(() => client.send(command), `secretsmanager:${loggedSecretId}`, this.namedRequestMasks([
+	const response = await this.sendWithThrottleRetry(() => client.send(command), `secretsmanager:${loggedSecretId}`, this.namedRequestMasks([
 		[secretId, loggedSecretId],
 		[versionStage, this.displayMasked(nameLogText(versionStage), context)],
 		[versionId, this.displayMasked(nameLogText(versionId), context)]
-	], context))).SecretString;
+	], context));
+	const secretString = response.SecretString;
+	if (versionOut !== void 0 && typeof response.VersionId === "string") versionOut.version = response.VersionId;
 	if (!secretString) throw markNonRetryable(/* @__PURE__ */ new Error(`Dynamic reference: secret ${quotedRender(loggedSecretId, "'")} does not contain a SecretString value`));
 	if (jsonKey) try {
 		const parsed = JSON.parse(secretString);
@@ -21379,11 +21899,12 @@ async function sendWithThrottleRetry(operation, label, masks) {
 		throw masks.error(error);
 	}
 }
-async function resolveSSMReference(parts, decrypt, service, context, nameLogText) {
-	const parameterName = parts.slice(1).join(":");
+async function resolveSSMReference(parts, decrypt, service, context, nameLogText, pinVersion) {
+	const namedParameter = parts.slice(1).join(":");
+	const parameterName = pinVersion === void 0 ? namedParameter : `${withoutSsmSelector(namedParameter)}:${pinVersion}`;
 	if (!parameterName) throw markNonRetryable(/* @__PURE__ */ new Error(`Dynamic reference: ${service} PARAMETER_NAME is required`));
-	const loggedParameterName = this.displayMasked(nameLogText(parameterName), context);
-	this.logger.debug(`Resolving dynamic reference: ${service}:${loggedParameterName}`);
+	const loggedParameterName = this.displayMasked(nameLogText(namedParameter), context);
+	this.logger.debug(`Resolving dynamic reference: ${service}:${loggedParameterName}${pinVersion === void 0 ? "" : ` (version ${pinVersion})`}`);
 	const client = this.clientsForRegion(this.explicitRegion).ssm;
 	const command = new GetParameterCommand({
 		Name: parameterName,
@@ -21394,17 +21915,25 @@ async function resolveSSMReference(parts, decrypt, service, context, nameLogText
 	if (paramValue === void 0 || paramValue === null) throw markNonRetryable(/* @__PURE__ */ new Error(`Dynamic reference: SSM parameter ${quotedRender(loggedParameterName, "'")} not found or has no value`));
 	const paramType = response.Parameter?.Type;
 	const secure = paramType !== "String" && paramType !== "StringList";
-	if (secure && paramType !== "SecureString" && !this.warnedUnrecognizedSsmTypes.has(injectiveKey(parameterName, String(paramType)))) {
-		this.warnedUnrecognizedSsmTypes.add(injectiveKey(parameterName, String(paramType)));
+	if (secure && paramType !== "SecureString" && !this.warnedUnrecognizedSsmTypes.has(injectiveKey(namedParameter, String(paramType)))) {
+		this.warnedUnrecognizedSsmTypes.add(injectiveKey(namedParameter, String(paramType)));
 		const reported = paramType === void 0 ? "(absent)" : quotedRender(this.displayMasked(String(paramType), context), "'");
 		this.logger.warn(`SSM parameter ${quotedRender(loggedParameterName, "'")} reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:${service}:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`);
 	}
+	const paramVersion = response.Parameter?.Version;
 	return {
 		value: paramValue,
 		secure,
-		type: paramType
+		type: paramType,
+		...typeof paramVersion === "number" && Number.isSafeInteger(paramVersion) && { version: String(paramVersion) }
 	};
 }
+function withoutSsmSelector(parameterName) {
+	const arnName = parameterName.startsWith("arn:") ? parameterName.indexOf(":parameter/") : -1;
+	const nameStart = arnName < 0 ? 0 : arnName + 11;
+	const selector = parameterName.indexOf(":", nameStart);
+	return selector < 0 ? parameterName : parameterName.slice(0, selector);
+}
 
 //#endregion
 //#region src/deployment/intrinsic-resolver/string-functions.ts
@@ -22401,7 +22930,10 @@ function recordInheritedParameterSecrets(parameterName, value, context) {
 	if (inherited && recorded) recordInheritedNoEchoListElements(this, inherited, recorded, value, context);
 	if (!inherited || inherited.size === 0 || !recorded) return;
 	for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) {
-		recorded.set(plaintext, carriedExpressionFor(inherited, parameterName, value, plaintext, expression));
+		const carried = carriedExpressionFor(inherited, parameterName, value, plaintext, expression);
+		recorded.set(plaintext, carried);
+		const parentEntry = context.inheritedReferenceProvenance?.get(carried);
+		if (parentEntry !== void 0) recordReferenceProvenanceEntry(recorded, carried, parentEntry, "read");
 		recordInheritedParameterRead(recorded, inherited, parameterName);
 		carryFreshNoEchoMark(inherited, recorded, plaintext);
 	}
@@ -22750,6 +23282,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		}
 		return resolved;
 	}
+	resolverForRecordedRegion(region) {
+		return this.resolverForProducerRegion(region);
+	}
 	resolverForProducerRegion(producerRegion, context, producerRegionLogText) {
 		if (!producerRegion) return this;
 		const target = canonicalizeRegion(producerRegion);
@@ -25092,7 +25627,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-B8N6UPAH.js");
+			const { ASGProvider } = await import("./asg-provider-BxW2FkQz.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -25198,7 +25733,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-BdUme0V8.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-D3Qcci3J.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-Bz8JUYBp.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-D7sAjt4U.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -30005,6 +30540,161 @@ async function reserveStackCreateToken(options) {
 	};
 }
 
+//#endregion
+//#region src/deployment/deploy-value-equality.ts
+function isReplacementCeiling(pc) {
+	return pc.requiresReplacement && (pc.inPlacePropagated === true || pc.replacementPropagated === true);
+}
+function keyOrderFreeJson(value) {
+	return JSON.stringify(value, (_key, node) => {
+		if (node === null || typeof node !== "object" || Array.isArray(node)) return node;
+		const sorted = Object.create(null);
+		for (const key of Object.keys(node).sort()) sorted[key] = node[key];
+		return sorted;
+	});
+}
+function liveHoldsFreshLeaves(live, leaves) {
+	for (const leaf of leaves) {
+		let node = live;
+		for (const segment of leaf.path) {
+			if (typeof segment === "number") {
+				if (!Array.isArray(node) || segment >= node.length) return false;
+				node = node[segment];
+				continue;
+			}
+			if (node === null || typeof node !== "object" || Array.isArray(node)) return false;
+			if (!Object.prototype.hasOwnProperty.call(node, segment)) return false;
+			node = node[segment];
+		}
+		if (typeof leaf.plaintext === "string") {
+			if (typeof node !== "string" || node !== leaf.plaintext) return false;
+		} else if (node === void 0 || keyOrderFreeJson(node) !== keyOrderFreeJson(leaf.plaintext)) return false;
+	}
+	return true;
+}
+function outputMapsEqual(a, b) {
+	return deepEqualValue(a, b);
+}
+function deepEqualValue(a, b) {
+	if (a === b) return true;
+	if (a == null || b == null) return a === b;
+	if (typeof a !== typeof b) return false;
+	if (typeof a !== "object") return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((v, i) => deepEqualValue(v, b[i]));
+	}
+	const ao = a;
+	const bo = b;
+	const ak = Object.keys(ao);
+	if (ak.length !== Object.keys(bo).length) return false;
+	for (const k of ak) {
+		if (!Object.prototype.hasOwnProperty.call(bo, k)) return false;
+		if (!deepEqualValue(ao[k], bo[k])) return false;
+	}
+	return true;
+}
+
+//#endregion
+//#region src/deployment/deploy-engine/provenance-capture.ts
+function kickOffProvenanceCapture(args) {
+	const { noChange, resources, template } = args;
+	let chain = Promise.resolve();
+	for (const logicalId of noChange) {
+		const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+		if (record === void 0 || hasReferenceProvenanceField(record)) continue;
+		const tokens = recordReferenceTokens(record);
+		if (tokens.size === 0) continue;
+		const properties = (Object.hasOwn(template.Resources, logicalId) ? template.Resources[logicalId] : void 0)?.Properties ?? {};
+		const task = chain.then(() => captureOne(this, logicalId, record, tokens, properties, args)).catch(() => ({
+			record,
+			field: void 0
+		}));
+		chain = task;
+		this.provenanceCaptureTasks.set(logicalId, task);
+	}
+}
+function warnUnattributed(engine, logicalId) {
+	engine.logger.warn(safeMsg`Could not record where the secret reference(s) in ${logicalId} were resolved (state schema v12 migration). cdkd keeps its previous handling of them; update ${logicalId} to record it.`);
+}
+async function captureOne(engine, logicalId, record, tokens, properties, args) {
+	const bag = /* @__PURE__ */ new Map();
+	const { attributeHealer: _healer, ...base } = engine.buildResolverContext({
+		template: args.template,
+		resources: { ...args.resources },
+		...args.parameters && { parameters: args.parameters },
+		...args.conditions && { conditions: args.conditions }
+	}, args.stackName);
+	const { producerSecrets: _producer, ...withoutRecorders } = base;
+	const context = {
+		...withoutRecorders,
+		recordedSecretValues: bag,
+		recordedImports: [],
+		recordedOutputReads: [],
+		staleAttributeHeal: { phase: "probe" },
+		printingSecrets: /* @__PURE__ */ new Map(),
+		provenanceCapture: true
+	};
+	const stored = record.properties ?? {};
+	for (const [key, value] of Object.entries(properties)) {
+		if (!Object.hasOwn(stored, key) || recordReferenceTokens({ properties: stored[key] }).size === 0) continue;
+		try {
+			await engine.resolver.resolve(structuredClone(value), context);
+		} catch (error) {
+			if (isThrottlingError(error)) return {
+				record,
+				field: void 0
+			};
+		}
+	}
+	const physicalId = typeof record.physicalId === "string" ? record.physicalId.toLowerCase() : "";
+	const field = {};
+	let unattributed = false;
+	for (const token of [...tokens].sort()) {
+		const pass = passProvenanceFor(bag, token);
+		const plaintext = resolvedPlaintextOf(bag, token);
+		const named = plaintext !== void 0 && plaintext.length >= 4 && physicalId.includes(plaintext.toLowerCase());
+		const entry = validateReferenceProvenance(token, {
+			...pass?.region !== void 0 && { region: pass.region },
+			...named && pass?.versions !== void 0 && { versions: pass.versions }
+		}) ?? {};
+		if (entry.region === void 0 && entry.versions === void 0) unattributed = true;
+		field[token] = entry;
+	}
+	if (unattributed) warnUnattributed(engine, logicalId);
+	return {
+		record,
+		field
+	};
+}
+async function drainProvenanceCaptures(stateResources) {
+	if (this.provenanceCaptureTasks.size === 0) return 0;
+	const entries = [...this.provenanceCaptureTasks.entries()];
+	this.provenanceCaptureTasks.clear();
+	const outcomes = await Promise.all(entries.map(([, task]) => task));
+	let installed = 0;
+	for (let i = 0; i < entries.length; i++) {
+		const logicalId = entries[i][0];
+		const { record, field } = outcomes[i];
+		if (field === void 0) continue;
+		const target = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+		if (target === void 0 || target.physicalId !== record.physicalId || target.resourceType !== record.resourceType) continue;
+		stateResources[logicalId] = {
+			...target,
+			referenceProvenance: field
+		};
+		installed++;
+	}
+	return installed;
+}
+function provenanceBaselineOf(state, tokenFree) {
+	return {
+		outputs: state.outputs,
+		...state.outputReferenceProvenance !== void 0 && { outputReferenceProvenance: state.outputReferenceProvenance },
+		tokenFree
+	};
+}
+
 //#endregion
 //#region src/analyzer/destructive-changes.ts
 const IGNORED_RESOURCE_TYPES = /* @__PURE__ */ new Set(["AWS::CDK::Metadata"]);
@@ -31482,10 +32172,13 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 				continue;
 			}
 			const ownReads = [];
+			const provenanceSink = /* @__PURE__ */ new Map();
+			this.outputProvenanceSinks.set(outputKey, provenanceSink);
 			try {
 				const resolved = await this.resolver.resolve(output.Value, {
 					...context,
-					redactedAttributeReads: ownReads
+					redactedAttributeReads: ownReads,
+					provenanceSink
 				});
 				refuseMaskedOutputReads(outputKey, ownReads);
 				if (resolved === void 0 && this.options.strictGetAtt) throw markNonRetryable(/* @__PURE__ */ new Error("the value resolved to nothing"));
@@ -31540,6 +32233,8 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 			else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) this.logger.warn(exportAliasCollisionWarning(outputKey, exportName, outputsPassSecrets));
 			else {
 				outputs[exportName] = value;
+				const aliasedSink = this.outputProvenanceSinks.get(outputKey);
+				if (aliasedSink !== void 0) this.outputProvenanceSinks.set(exportName, aliasedSink);
 				if (!this.resolvedExportNames.includes(exportName)) this.resolvedExportNames.push(exportName);
 				this.outputsTemplateSource[exportName] = outputValue;
 			}
@@ -31553,6 +32248,8 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 		this.outputsTemplateSource[outputKey] = output.Value;
 	}
 	this.skippedOutputs = collectSkippedOutputs(digestSource, outputs);
+	this.outputsResolvedThisRun.add(outputs);
+	this.resolvedOutputsBag = outputs;
 	return markSameGenerationBag(outputs);
 }
 function buildDisplayOutputs(template, resolvedOutputs) {
@@ -32085,15 +32782,19 @@ var ReplayResolvers = class {
 		this.pinned.set(target, scoped);
 		return scoped;
 	}
+	forRecordedRegion(region) {
+		return this.primary.resolverForRecordedRegion(region);
+	}
 };
 function regionAmbiguousReplaySecretError(logicalId, propertyPath, secretName, foreignProducerRegions, consumerRegion, execCtx) {
 	const where = propertyPath === "" ? "" : ` property ${quotedPlainOr(propertyPath, "property path")}`;
 	const error = new CdkdError(`Rollback of ${shownLogicalId(logicalId)}${where} cannot re-resolve the secret reference ${quotedPlainOr(secretName, "secret name")}: the reference carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.map((r) => plainOrDescribed(r, "region")).join(", ")}), so it may have been resolved in one of those rather than in ${quotedOrDescribed(consumerRegion, "region")}. A secret of the same name in two regions is two independent values, so replaying this would write the WRONG secret to a live resource. Refusing instead. Resolve the reference in its own region and set the property directly (or spell it as a full ARN, which names its region and is resolved there), then re-run ${rerunRollbackPhrase(execCtx, "'cdkd rollback'")}.`, "ROLLBACK_SECRET_REGION_AMBIGUOUS");
 	return markNonRetryable(error);
 }
-function refuseUnprovenReplaySecret(leaf, propertyPath, logicalId, execCtx) {
+function refuseUnprovenReplaySecret(leaf, propertyPath, logicalId, execCtx, recordedRegions) {
 	if (execCtx.producerRegionsIncomplete !== true) return;
 	for (const token of dynamicReferenceTokens(leaf)) {
+		if (recordedRegions?.has(token) === true) continue;
 		const name = classifyReplaySecretRegion(token, execCtx.region, execCtx.importedProducerRegions).kind === "local" ? regionLessSecretName(token) : void 0;
 		if (name !== void 0) throw regionUnknownReplaySecretError(logicalId, propertyPath, name, execCtx.region, execCtx);
 	}
@@ -32102,17 +32803,17 @@ function regionUnknownReplaySecretError(logicalId, propertyPath, secretName, con
 	const where = propertyPath === "" ? "" : ` property ${quotedPlainOr(propertyPath, "property path")}`;
 	return new CdkdError(`Rollback of ${shownLogicalId(logicalId)}${where} cannot re-resolve the secret reference ${quotedPlainOr(secretName, "secret name")}: the reference carries no region of its own, and this is a nested stack, and the cross-region reads its parent made are not known to this replay, so the parent may have resolved it in another region than ${quotedOrDescribed(consumerRegion, "region")}. A secret of the same name in two regions is two independent values, so replaying this could write the WRONG secret to a live resource. Refusing instead. Where the journal of the top-level stack still holds this run, roll back the top-level stack instead, which supplies its regions. Otherwise resolve the reference in its own region and set the property directly (or spell it as a full ARN, which names its region and is resolved there), then re-run ${rerunRollbackPhrase(execCtx, "'cdkd rollback'")}.`, "ROLLBACK_SECRET_REGION_AMBIGUOUS");
 }
-async function resolveLeafByRegion(leaf, propertyPath, logicalId, execCtx, resolvers, resolverContext) {
-	const verdicts = dynamicReferenceTokens(leaf).map((token) => [token, classifyReplaySecretRegion(token, execCtx.region, execCtx.importedProducerRegions)]);
+async function resolveLeafByRegion(leaf, propertyPath, logicalId, execCtx, resolvers, resolverContext, recordedRegions) {
+	const verdicts = dynamicReferenceTokens(leaf).map((token) => [token, classifyRecordedSecretRegion(token, execCtx.region, execCtx.importedProducerRegions, recordedRegions)]);
 	for (const [, verdict] of verdicts) if (verdict.kind === "ambiguous") throw regionAmbiguousReplaySecretError(logicalId, propertyPath, verdict.secretName, verdict.foreignProducerRegions, execCtx.region, execCtx);
-	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region")) return await resolvers.primary.resolveDynamicReferences(leaf, resolverContext);
+	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region" || verdict.kind === "recorded-region")) return await resolvers.primary.resolveDynamicReferences(leaf, resolverContext);
 	let out = "";
 	let cursor = 0;
 	for (const [token, verdict] of verdicts) {
 		const at = leaf.indexOf(token, cursor);
 		if (at < 0) throw new CdkdError(`Rollback of ${logicalId}${propertyPath === "" ? "" : ` property '${propertyPath}'`} could not locate a scanned dynamic reference in the value it was scanned from. Refusing rather than resolving it in '${execCtx.region}', which would be the wrong region for a reference that names another one. This is an internal invariant failure — please report it with the resource type and property path.`, "ROLLBACK_SECRET_TOKEN_SCAN_MISMATCH");
 		out += leaf.slice(cursor, at);
-		const resolver = verdict.kind === "named-region" ? resolvers.forRegion(verdict.region) : resolvers.primary;
+		const resolver = verdict.kind === "named-region" ? resolvers.forRegion(verdict.region) : verdict.kind === "recorded-region" ? resolvers.forRecordedRegion(verdict.region) : resolvers.primary;
 		out += await resolver.resolveDynamicReferences(token, resolverContext);
 		cursor = at + token.length;
 	}
@@ -32847,8 +33548,9 @@ function maskRestoredNoEchoRecord(record, baseline, substituted = []) {
 
 //#endregion
 //#region src/deployment/rollback-executor/replay-props.ts
-async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId) {
+async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId, record) {
 	if (props === void 0) return void 0;
+	const recordedRegions = recordedReferenceRegions(record);
 	const resolverContext = {
 		template: { Resources: {} },
 		resources: {},
@@ -32857,8 +33559,8 @@ async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId)
 	const walk = async (v, path) => {
 		if (typeof v === "string") {
 			if (!v.includes("{{resolve:")) return v;
-			refuseUnprovenReplaySecret(v, path, logicalId, execCtx);
-			return await resolveLeafByRegion(v, path, logicalId, execCtx, resolvers, resolverContext);
+			refuseUnprovenReplaySecret(v, path, logicalId, execCtx, recordedRegions);
+			return await resolveLeafByRegion(v, path, logicalId, execCtx, resolvers, resolverContext, recordedRegions);
 		}
 		if (Array.isArray(v)) {
 			const out = new Array(v.length);
@@ -33171,7 +33873,7 @@ async function replayRevert(s) {
 		provisionedBy: op.provisionedBy
 	});
 	const noEcho = await substituteMarkedNoEchoLeaves({
-		desired: await resolveReplayProps(previousState.properties, resolver, secrets, ctx, op.logicalId),
+		desired: await resolveReplayProps(previousState.properties, resolver, secrets, ctx, op.logicalId, previousState),
 		baseline: previousState,
 		live: current,
 		logicalId: op.logicalId,
@@ -33183,7 +33885,7 @@ async function replayRevert(s) {
 	const desiredProps = noEcho.desired;
 	refuseMaskedReplayBaseline(desiredProps, op.logicalId, noEcho.inert);
 	logger.info(`  Rollback: Restoring ${safe(op.logicalId)} (${safe(op.resourceType)}) to previous state`);
-	const currentProps = noEcho.onPreviousSide(await resolveReplayProps(current.properties, resolver, secrets, ctx, op.logicalId));
+	const currentProps = noEcho.onPreviousSide(await resolveReplayProps(current.properties, resolver, secrets, ctx, op.logicalId, current));
 	recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, previousState.properties, STATE_DERIVED_RULES);
 	opMasker.addNamed({
 		resourceType: op.resourceType,
@@ -33259,7 +33961,7 @@ async function replayReverseReplacement(s) {
 		skipUnaddressableReplay(s, logger, op, "reverse the replacement of");
 		return;
 	}
-	const resolvedPrevProps = await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId) ?? {};
+	const resolvedPrevProps = await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId, prev) ?? {};
 	refuseMarkedNoEchoRecreate(resolvedPrevProps, noEchoLeavesOf(prev), op.logicalId);
 	refuseMaskedReplayBaseline(resolvedPrevProps, op.logicalId);
 	opMasker.addNamed({
@@ -33941,7 +34643,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						provisionedBy: op.provisionedBy ?? current.provisionedBy
 					});
 					const noEcho = await substituteMarkedNoEchoLeaves({
-						desired: await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId),
+						desired: await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId, prev),
 						baseline: prev,
 						live: current,
 						logicalId: op.logicalId,
@@ -33952,7 +34654,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 					});
 					const desiredProps = noEcho.desired;
 					refuseMaskedReplayBaseline(desiredProps, op.logicalId, noEcho.inert);
-					const attemptedProps = noEcho.onPreviousSide(await resolveReplayProps(op.attemptedProperties ?? current.properties, resolver, secrets, ctx, op.logicalId));
+					const attemptedProps = noEcho.onPreviousSide(await resolveReplayProps(op.attemptedProperties ?? current.properties, resolver, secrets, ctx, op.logicalId, op.attemptedProperties === void 0 ? current : void 0));
 					recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, prev.properties, STATE_DERIVED_RULES);
 					opMasker.addNamed({
 						resourceType: op.resourceType,
@@ -34700,7 +35402,7 @@ async function revertNestedChildFromJournal(args) {
 		const { skippedOutputs: _dropped, ...carried } = base;
 		const next = () => ({
 			...carried,
-			version: 11,
+			version: 12,
 			region,
 			resources: { ...stateResources },
 			...orphansAfterRollback(base, mintedOrphans),
@@ -34716,6 +35418,7 @@ async function revertNestedChildFromJournal(args) {
 			const state = next();
 			if (!restoring) return state;
 			if (restoredOutputs && !restoredOutputs.exportNames) delete state.exportNames;
+			if (restoredOutputs) delete state.outputReferenceProvenance;
 			if (restoredReads && !restoredReads.imports) delete state.imports;
 			if (restoredReads && !restoredReads.outputReads) delete state.outputReads;
 			return state;
@@ -35596,7 +36299,8 @@ function kickOffObservedCapture(provider, logicalId, physicalId, resourceType, r
 	this.observedCaptureTasks.set(logicalId, promise);
 }
 async function drainObservedCaptures(stateResources) {
-	if (this.observedCaptureTasks.size === 0) return 0;
+	const captured = await this.drainProvenanceCaptures(stateResources);
+	if (this.observedCaptureTasks.size === 0) return captured;
 	const entries = Array.from(this.observedCaptureTasks.entries());
 	this.observedCaptureTasks.clear();
 	const resolved = await Promise.all(entries.map(([, p]) => p));
@@ -35612,7 +36316,7 @@ async function drainObservedCaptures(stateResources) {
 			target.observedProperties = recapturedFrom !== void 0 ? observed : markSameGenerationBag({ ...observed });
 		}
 	}
-	return installed;
+	return installed + captured;
 }
 const STANDALONE_SIBLING = {
 	Roles: {
@@ -35795,61 +36499,6 @@ function kickOffMaskedBaselineRecapture(provider, logicalId, resource, producerR
 	this.observedCaptureTasks.set(logicalId, task);
 }
 
-//#endregion
-//#region src/deployment/deploy-value-equality.ts
-function isReplacementCeiling(pc) {
-	return pc.requiresReplacement && (pc.inPlacePropagated === true || pc.replacementPropagated === true);
-}
-function keyOrderFreeJson(value) {
-	return JSON.stringify(value, (_key, node) => {
-		if (node === null || typeof node !== "object" || Array.isArray(node)) return node;
-		const sorted = Object.create(null);
-		for (const key of Object.keys(node).sort()) sorted[key] = node[key];
-		return sorted;
-	});
-}
-function liveHoldsFreshLeaves(live, leaves) {
-	for (const leaf of leaves) {
-		let node = live;
-		for (const segment of leaf.path) {
-			if (typeof segment === "number") {
-				if (!Array.isArray(node) || segment >= node.length) return false;
-				node = node[segment];
-				continue;
-			}
-			if (node === null || typeof node !== "object" || Array.isArray(node)) return false;
-			if (!Object.prototype.hasOwnProperty.call(node, segment)) return false;
-			node = node[segment];
-		}
-		if (typeof leaf.plaintext === "string") {
-			if (typeof node !== "string" || node !== leaf.plaintext) return false;
-		} else if (node === void 0 || keyOrderFreeJson(node) !== keyOrderFreeJson(leaf.plaintext)) return false;
-	}
-	return true;
-}
-function outputMapsEqual(a, b) {
-	return deepEqualValue(a, b);
-}
-function deepEqualValue(a, b) {
-	if (a === b) return true;
-	if (a == null || b == null) return a === b;
-	if (typeof a !== typeof b) return false;
-	if (typeof a !== "object") return false;
-	if (Array.isArray(a) || Array.isArray(b)) {
-		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-		return a.every((v, i) => deepEqualValue(v, b[i]));
-	}
-	const ao = a;
-	const bo = b;
-	const ak = Object.keys(ao);
-	if (ak.length !== Object.keys(bo).length) return false;
-	for (const k of ak) {
-		if (!Object.prototype.hasOwnProperty.call(bo, k)) return false;
-		if (!deepEqualValue(ao[k], bo[k])) return false;
-	}
-	return true;
-}
-
 //#endregion
 //#region src/deployment/deploy-engine/masking.ts
 function diffLogMasker(diffSecrets, template, parameterValues, resources) {
@@ -35906,6 +36555,11 @@ function absorbOutputsPassSecrets() {
 	}
 }
 function redactOutputs(outputs) {
+	const redacted = redactOutputsBag.call(this, outputs);
+	if (this.outputsResolvedThisRun.has(outputs)) this.outputsResolvedThisRun.add(redacted);
+	return redacted;
+}
+function redactOutputsBag(outputs) {
 	this.absorbOutputsPassSecrets();
 	if (this.outputSecrets.size === 0) return this.maskOutputsByPosition(outputs);
 	return this.maskOutputsByPosition(redactSecretsForState(outputs, this.outputSecrets, this.outputsSourceUsable ? this.outputsTemplateSource : void 0, TEMPLATE_SOURCED_RULES));
@@ -36557,6 +37211,7 @@ function buildResolverContext(base, stackName) {
 		attributeHealer: (logicalId, resource) => this.healStaleAttributes(logicalId, resource, stackName),
 		...this.options.inheritedSecrets && hasMaskableValues(this.options.inheritedSecrets) && { inheritedSecrets: this.options.inheritedSecrets },
 		...this.options.inheritedPhysicalNameCopies && { inheritedPhysicalNameCopies: this.options.inheritedPhysicalNameCopies },
+		...this.options.inheritedReferenceProvenance && { inheritedReferenceProvenance: this.options.inheritedReferenceProvenance },
 		recordedSecretValues,
 		noEchoAttributeResources: this.noEchoAttributeResources,
 		secretNameNeedles: (logicalId) => this.noteSecretNamedRecord(logicalId, Object.hasOwn(base.resources, logicalId) ? base.resources[logicalId] : void 0),
@@ -42369,6 +43024,10 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 		} else throw updateError;
 	}
 	this.updateWasReplaced.set(logicalId, result.wasReplaced === true);
+	if (result.wasReplaced !== true && (hasPassProvenance(updateSecrets) || referenceProvenanceOf(currentResource) !== void 0)) {
+		const cached = cachedCreateOnlyPropertyPaths(resourceType);
+		this.inPlaceCreateOnlyPaths.set(logicalId, cached === void 0 ? "all" : await cached.catch(() => "all"));
+	}
 	if (result.wasReplaced) {
 		this.noteSecretNamedRecord(logicalId, {
 			resourceType,
@@ -42972,7 +43631,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 		saveChain = saveChain.then(async () => {
 			try {
 				const partialState = {
-					version: 11,
+					version: 12,
 					region: this.stackRegion,
 					stackName: currentState.stackName,
 					resources: newResources,
@@ -43279,7 +43938,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 		}
 		try {
 			const preRollbackState = {
-				version: 11,
+				version: 12,
 				region: this.stackRegion,
 				stackName: currentState.stackName,
 				resources: newResources,
@@ -43332,7 +43991,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 		}
 		try {
 			const postRollbackState = {
-				version: 11,
+				version: 12,
 				region: this.stackRegion,
 				stackName: currentState.stackName,
 				resources: newResources,
@@ -43351,7 +44010,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			try {
 				const freshEtag = (await this.stateBackend.getState(stackName, this.stackRegion))?.etag;
 				const postRollbackState = {
-					version: 11,
+					version: 12,
 					region: this.stackRegion,
 					stackName: currentState.stackName,
 					resources: newResources,
@@ -43384,7 +44043,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 	}
 	return {
 		state: {
-			version: 11,
+			version: 12,
 			region: this.stackRegion,
 			stackName: currentState.stackName,
 			resources: newResources,
@@ -43402,7 +44061,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 }
 async function persistStateAfterOutputFailure(stackName, currentState, newResources, currentEtag, pendingMigration) {
 	const buildState = () => ({
-		version: 11,
+		version: 12,
 		region: this.stackRegion,
 		stackName: currentState.stackName,
 		resources: newResources,
@@ -44707,7 +45366,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		const currentStateData = await this.stateBackend.getState(stackName, this.stackRegion);
 		noteDeployStateRecord(currentStateData?.state !== void 0);
 		const currentState = currentStateData?.state ?? {
-			version: 11,
+			version: 12,
 			region: this.stackRegion,
 			stackName,
 			resources: {},
@@ -44724,6 +45383,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		refuseMalformedResourceProperties(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
 		refuseMalformedOrphans(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
 		refuseMalformedOrphanRecords(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
+		this.provenanceBaseline = provenanceBaselineOf(currentState, isKnownTokenFreeState(currentStateData?.state));
 		const migrationPending = currentStateData?.migrationPending ?? false;
 		this.logger.debug(`Loaded current state: ${Object.keys(currentState.resources).length} resources`);
 		if (this.options.onCurrentStateLoaded) {
@@ -44879,8 +45539,20 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			firstDeployStateGate = void 0;
 			await gate;
 		}
+		const startProvenanceCapture = () => {
+			if (this.options.dryRun || isKnownTokenFreeState(currentStateData?.state)) return;
+			this.kickOffProvenanceCapture({
+				noChange: this.diffCalculator.filterByType(changes, "NO_CHANGE").map((change) => change.logicalId),
+				resources: currentState.resources,
+				template: effectiveTemplate,
+				parameters: parameterValues,
+				conditions,
+				stackName
+			});
+		};
 		if (!this.diffCalculator.hasChanges(changes)) {
 			this.logger.info("No changes detected. Stack is up to date.");
+			startProvenanceCapture();
 			let persistedOutputs = currentState.outputs ?? {};
 			if (!this.options.dryRun) {
 				const resolvedOutputs = this.redactOutputs(await withSharedDrainBudget(() => this.resolveOutputs(effectiveTemplate, currentState.resources, stackName, outputsDigestSource, parameterValues, conditions)));
@@ -44918,9 +45590,10 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 					options: this.options,
 					stackName
 				});
-				if (observedRefresh || maskedFingerprintsBackfilled || conditionVerdictsChanged || outputsChanged || exportSetChanged || skippedOutputsChanged || orphansChanged || healedAttributesPending) try {
+				const outputProvenanceBackfill = !outputsChanged && currentState.outputReferenceProvenance === void 0 && this.provenanceBaseline?.tokenFree === false && this.outputReferenceProvenanceFor(persistedOutputs, this.redactOutputs(persistedOutputs)) !== void 0;
+				if (observedRefresh || outputProvenanceBackfill || maskedFingerprintsBackfilled || conditionVerdictsChanged || outputsChanged || exportSetChanged || skippedOutputsChanged || orphansChanged || healedAttributesPending) try {
 					const refreshedState = {
-						version: 11,
+						version: 12,
 						region: this.stackRegion,
 						stackName: currentState.stackName,
 						resources: currentState.resources,
@@ -45030,6 +45703,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			recreateTargetIds: recreateTargetIdsFor(this.options.recreateTargets, stackName),
 			secretMask: () => this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues, currentState.resources)
 		})) this.generatedNameGuard?.noteApprovalPrompted();
+		startProvenanceCapture();
 		this.generatedNameGuard?.recordPlannedIntents();
 		this.resolver.resetPhysicalIdFallbackCount();
 		const progress = {
@@ -45365,6 +46039,12 @@ var DeployEngine = class {
 	restoredLostChildren = /* @__PURE__ */ new Set();
 	updatesThatSentNothing = /* @__PURE__ */ new Set();
 	updateWasReplaced = /* @__PURE__ */ new Map();
+	inPlaceCreateOnlyPaths = /* @__PURE__ */ new Map();
+	outputProvenanceSinks = /* @__PURE__ */ new Map();
+	outputsResolvedThisRun = /* @__PURE__ */ new WeakSet();
+	provenanceBaseline = void 0;
+	resolvedOutputsBag = void 0;
+	provenanceCaptureTasks = /* @__PURE__ */ new Map();
 	oldDeletedBeforeCreate = /* @__PURE__ */ new Set();
 	healBaseline = {};
 	runProducerRegionEvidence = void 0;
@@ -45434,6 +46114,12 @@ var DeployEngine = class {
 		this.restoredLostChildren = /* @__PURE__ */ new Set();
 		this.updatesThatSentNothing = /* @__PURE__ */ new Set();
 		this.updateWasReplaced = /* @__PURE__ */ new Map();
+		this.inPlaceCreateOnlyPaths = /* @__PURE__ */ new Map();
+		this.outputProvenanceSinks = /* @__PURE__ */ new Map();
+		this.outputsResolvedThisRun = /* @__PURE__ */ new WeakSet();
+		this.provenanceBaseline = void 0;
+		this.resolvedOutputsBag = void 0;
+		this.provenanceCaptureTasks = /* @__PURE__ */ new Map();
 		this.oldDeletedBeforeCreate = /* @__PURE__ */ new Set();
 		this.healBaseline = {};
 		this.runProducerRegionEvidence = void 0;
@@ -45454,7 +46140,7 @@ var DeployEngine = class {
 			const templateProps = this.perResourceTemplateProps.get(logicalId);
 			const scrubbed = scrubResourceRecord(this.withHealedAttributes(logicalId, record), secrets ?? /* @__PURE__ */ new Map(), templateProps);
 			const noEchoScrubbed = this.applyNoEchoPersist(logicalId, record, this.withNoEchoExactEchoes(logicalId, scrubbed), templateProps, state.resources, secrets);
-			resources[logicalId] = withConstructPath(withMaskedPropertyFingerprints(noEchoScrubbed, record.properties, templateProps, secrets, this.fingerprintNoEchoValues, this.perResourceInputFingerprints.get(logicalId)), constructPathOf(this.constructPathTemplate, logicalId));
+			resources[logicalId] = withReferenceProvenance(withConstructPath(withMaskedPropertyFingerprints(noEchoScrubbed, record.properties, templateProps, secrets, this.fingerprintNoEchoValues, this.perResourceInputFingerprints.get(logicalId)), constructPathOf(this.constructPathTemplate, logicalId)), this.referenceProvenanceToPersist(logicalId, record, noEchoScrubbed, secrets));
 		}
 		const orphans = state.orphans?.map((entry) => {
 			const sameResource = this.perResourceResolvedType.get(entry.logicalId) === entry.state.resourceType;
@@ -45466,14 +46152,51 @@ var DeployEngine = class {
 		});
 		const outputs = this.redactOutputs(state.outputs);
 		const crossStackReads = this.redactCrossStackReads(state);
+		const { outputReferenceProvenance: _incoming, ...rest } = state;
+		const outputReferenceProvenance = this.outputReferenceProvenanceFor(state.outputs, outputs);
 		return {
-			...state,
+			...rest,
 			resources,
 			outputs,
 			...orphans === void 0 ? {} : { orphans },
-			...crossStackReads
+			...crossStackReads,
+			...outputReferenceProvenance !== void 0 && { outputReferenceProvenance }
 		};
 	}
+	outputReferenceProvenanceFor(outputs, redacted) {
+		const sinkOf = (outputKey) => this.outputProvenanceSinks.get(outputKey);
+		const baseline = this.provenanceBaseline;
+		if (!this.outputsResolvedThisRun.has(outputs) && baseline !== void 0 && outputs === baseline.outputs && baseline.outputReferenceProvenance === void 0 && !baseline.tokenFree && this.resolvedOutputsBag !== void 0 && outputMapsEqual(this.redactOutputs(this.resolvedOutputsBag), redacted)) return outputProvenanceForPersist({
+			outputs: redacted,
+			resolvedThisRun: true,
+			carriedFrom: void 0,
+			sinkOf
+		});
+		return outputProvenanceForPersist({
+			outputs: redacted,
+			resolvedThisRun: this.outputsResolvedThisRun.has(outputs),
+			carriedFrom: baseline !== void 0 && outputs === baseline.outputs ? baseline : void 0,
+			sinkOf
+		});
+	}
+	referenceProvenanceToPersist(logicalId, record, scrubbed, secrets) {
+		const sameGeneration = isSameGenerationBag(record.properties);
+		if (!sameGeneration && !isWrittenFromDeployedTemplate(record.properties)) return KEEP_REFERENCE_PROVENANCE;
+		const previous = Object.hasOwn(this.healBaseline, logicalId) ? this.healBaseline[logicalId] : void 0;
+		if (this.updatesThatSentNothing.has(logicalId) && previous !== void 0) return previous.referenceProvenance;
+		const createOnly = sameGeneration ? this.inPlaceCreateOnlyPaths.get(logicalId) : "all";
+		const inPlace = this.updateWasReplaced.get(logicalId) === false && previous !== void 0 ? {
+			createOnly: createOnly ?? "all",
+			attributesCarried: record.attributes !== void 0 && record.attributes === previous.attributes
+		} : void 0;
+		return provenanceForWrittenRecord({
+			record: scrubbed,
+			secrets,
+			previous,
+			inPlace,
+			walkWithoutPassProvenance: this.provenanceBaseline?.tokenFree !== true
+		});
+	}
 	redactCrossStackReads(state) {
 		if (state.imports === void 0 && state.outputReads === void 0) return {};
 		const secrets = this.allRecordedSecrets();
@@ -45622,6 +46345,8 @@ DeployEngine.prototype.namingSecretsFor = namingSecretsFor;
 DeployEngine.prototype.noteSecretNamedReads = noteSecretNamedReads;
 DeployEngine.prototype.kickOffObservedCapture = kickOffObservedCapture;
 DeployEngine.prototype.drainObservedCaptures = drainObservedCaptures;
+DeployEngine.prototype.kickOffProvenanceCapture = kickOffProvenanceCapture;
+DeployEngine.prototype.drainProvenanceCaptures = drainProvenanceCaptures;
 DeployEngine.prototype.buildObservedCaptureSiblings = buildObservedCaptureSiblings;
 DeployEngine.prototype.stampReasonlessParameterRefusals = stampReasonlessParameterRefusals;
 DeployEngine.prototype.kickOffAutoRefreshObservedProperties = kickOffAutoRefreshObservedProperties;
@@ -45655,5 +46380,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { isTruthyCfnBoolean as $, isStatefulRecreateTargetForReplace as $a, stateBucketExistenceConfirmed as $c, malformedOrphansRefusalMessage as $i, ledgerForStack as $n, markSameGenerationBag as $o, sendableAssumeRoleCommand as $r, AssetPublisher as $s, seedsDeleteFirstGuard as $t, noEchoComparisonForTemplate as A, refuseMalformedResourcesForDeploy as Aa, redactDockerArgvValues as Ac, declaresNoEcho as Ai, journaledOrphanPrintingBag as An, maskWholeValue as Ao, deleteIndeterminateGuards as Ar, LockManager as As, dropFailedHint as At, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as B, unpreviewableOrphanRecords as Ba, getDockerImageBySourceHash as Bc, hasReadableOutputs as Bi, PRE_DELETE_SNAPSHOT_TYPES as Bn, carryLogOnlyValues as Bo, reDisableInstanceApiTermination as Br, splitImportedOps as Bs, getStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedResourceEntriesForImport as Ca, dockerSpawnEnvWithSensitive as Cc, cfnRefValueFromPhysicalId as Ci, displayAssemblyPath as Cl, collectDeclaredOutputNames as Cn, sameLambdaFunctionAddress as Co, applyCustomResourceResponseExpiration as Cr, wholeStringLeavesOf as Cs, revertNestedChildFromJournal as Ct, withResourceDeadline as D, refuseMalformedResourcePropertiesForDrift as Da, isDockerClientEnvKey as Dc, withSharedDrainBudget as Di, injectedAwsRegionValue as Dl, DEFAULT_RESOURCE_TIMEOUT_MS as Dn, isMarkedCoordinate as Do, unchangedBehindSecretReference as Dr, TEMPLATE_SOURCED_RULES as Ds, getCurrentNestedStackContext as Dt, serviceTokenBlockingReason as E, refuseMalformedResourcePropertiesForDestroy as Ea, getDockerCmd as Ec, parseWebACLArn as Ei, injectAwsRegion as El, bindingSkippedOutputs as En, canonicalCoordinates as Eo, slowCcOperationTimeoutMs as Er, STATE_SOURCED_READBACK_RULES as Es, collectNestedChildUnaddressed as Et, PROTECTION_PROPERTY_BY_TYPE as F, repairMalformedOrphansForReadOnly as Fa, warnFinchArgvExposure as Fc, UNREADABLE_RESOURCES_MAP_ROW as Fi, secretNamedRecordNeedles as Fn, passedNoEchoParametersOf as Fo, markWaitAbandoned as Fr, CrossPrefixScanCache as Fs, sameJournaledOrphans as Ft, resolveDynamoDbDeleteBudgetMs as G, findSilentDropProperties as Ga, loadCdkJson as Gc, malformedExportNamesWarning as Gi, isFinalSnapshotError as Gn, printingCorpusOf as Go, poisonRenderedSpellingsCollidingIn as Gr, hasReasonlessBaselineRefusal as Gs, isJournaledOrphan as Gt, compensateRemovedDeletionProtection as H, unreadableResourceEntries as Ha, synthesisStatusMessage as Hc, isReadableOrphanRecord as Hi, ccRoutedFinalSnapshotError as Hn, hasMaskableValues as Ho, DiffCalculator as Hr, describeRegionValueKind as Hs, removeProtectionTypeList as Ht, isProtectionValueActive as I, repairMalformedOutputsForReadOnly as Ia, escapeRegExp$3 as Ic, accountArgs as Ii, stateSecretNameNeedles as In, readbackPathFor as Io, disableInstanceApiTermination as Ir, applyCrossPrefixScan as Is, replayFailedOperations as It, deleteTableWithIndexBusyRetry as J, NO_CC_HANDLERS_REASON as Ja, resolveCaptureObservedState as Jc, malformedLocalResourceEntriesWarning as Ji, maskingRetryLogger as Jn, shareLogOnlyValues as Jo, applyRoleArnIfSet as Jr, importableOutputs as Js, planRollback as Jt, DELETE_INDEX_WAIT_PROCEED_NOTE as K, unwrittenCreateOnlyReplacement as Ka, resolveApp as Kc, malformedExportSourceWarning as Ki, refusesFinalSnapshot as Kn, recordLogOnlyParameterValue as Ko, producerLookupOver as Kr, hasUnverifiableParameterRefusal as Ks, isReplacementOrphan as Kt, perType as L, repairMalformedResourceEntriesForReadOnly as La, stripControlChars as Lc, deployRefusesOrphanRowsReason as Li, storedSecretNameNeedles as Ln, readsNoEchoSource as Lo, ec2InstanceProtectionSite as Lr, crossPrefixDeniedWarning as Ls, replayRollback as Lt, noEchoParameterNamesOf as M, refuseMalformedResourcesForExport as Ma, redactedDockerCause as Mc, STATE_REGION_DIVERGED as Mi, orphanRecordsPrintingBag as Mn, noEchoCoordinatesOf as Mo, deleteSkipReason as Mr, S3StateBackend as Ms, journaledOrphanLines as Mt, recordedProtectionEvidence as N, refuseMalformedState as Na, runDockerForeground as Nc, STATE_RESOURCES_MALFORMED as Ni, secretNamePrintingBag as Nn, noEchoLeavesOf as No, withIndeterminateGuard as Nr, rebuildClientForBucketRegion as Ns, loadJournaledOrphans as Nt, diffSecurity as O, refuseMalformedResourcePropertiesForExport as Oa, isMalformedEnvKey as Oc, parameterInputsFor as Oi, clearBucketRegionCache as Ol, DEFAULT_RESOURCE_WARN_AFTER_MS as On, maskAtCoordinates as Oo, RollbackInlinePolicyWriters as Or, WHOLE_DYNAMIC_REFERENCE_PATTERN as Os, withNestedStackContext as Ot, recordedProtectionNote as P, repairMalformedOrphanRecordsForReadOnly as Pa, runDockerStreaming as Pc, UNREADABLE_ORPHANS_CONTAINER_ROW as Pi, secretNamePrintingBags as Pn, noEchoOutputsComparison as Po, isWaitAbandonedError as Pr, CrossPrefixReadError as Ps, makeForeignHolderScan as Pt, hasCdkAutoDeleteTag as Q, MULTI_REGION_RECREATE_BLOCKED_TYPES as Qa, resolveUseCdkBootstrapAssets as Qc, malformedOrphanRowsKeptWarning as Qi, earliestDefined as Qn, maskSecretsInText as Qo, isIamRoleArn as Qr, shouldRetainResource as Qs, resolveReplacementOldType as Qt, readProtection as R, repairMalformedResourcePropertiesForReadOnly as Ra, stripForDisplay as Rc, displayLogicalId as Ri, extractDeploymentEventError as Rn, valueAtCoordinate as Ro, isTerminationProtectionPropagationError as Rr, isAccessDenied$1 as Rs, awaitInFlightSibling as Rt, keptForReadoption as S, refuseMalformedResourceEntriesForDestroy as Sa, describeDockerFailure as Sc, AWS_NO_VALUE as Si, describeFileReadFailure as Sl, noEchoParameterValueSeed as Sn, lambdaFunctionNameForMask as So, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Sr, recordProvenPublicExpression as Ss, recordDisplacedSkips as St, findServiceTokenRefusals as T, refuseMalformedResourceEntriesForOrphan as Ta, formatDockerLoginError as Tc, refStateLookupFromResource as Ti, resolveAssemblyPath as Tl, isExportAliasCollision as Tn, TemplateParser as To, CloudControlProvider as Tr, STATE_SOURCED_CROSS_GENERATION_RULES as Ts, withNestedRevertRun as Tt, deleteBudgetKey as U, withheldAccountClause as Ua, getDefaultStateBucketName as Uc, isReadableResourceEntry as Ui, createPreDeleteFinalSnapshot as Un, literalSplitDelimitersOf as Uo, INTRINSIC_KEYS as Ur, exportNamesCarriedFrom as Us, recordAfterRollbackUpdate as Ut, beginDeleteWait as V, unreadableOrphanRecords as Va, Synthesizer as Vc, hasReadableResources as Vi, buildFinalSnapshotIdentifier as Vn, createUnionSecretMasker as Vo, reEnableInstanceApiTermination as Vr, acceptedCreateOnlyDropsOf as Vs, withStackRecords as Vt, resolveDynamoDbDeleteBudgetClock as W, findActionableSilentDrops as Wa, getLegacyStateBucketName as Wc, malformedDriftResourcePropertiesWarning as Wi, effectiveDeletionPolicy as Wn, logOnlyValueCount as Wo, IntrinsicFunctionResolver as Wr, hasReadableExportSet as Ws, demoteSupersededOrphans as Wt, ECR_AUTO_DELETE_IMAGES_TAG as X, findReplacedReadersOfRecreateTargets as Xa, resolveStateBucketWithDefault as Xc, malformedOrphanRecordsRefusalMessage as Xi, findDestructiveChanges as Xn, errorCauseChain as Xo, assertSendableRoleArn as Xr, orphansAfterRollback as Xs, recordUnderIdIsNotOwn as Xt, waitForIndexesSettled as Y, hasNoCloudControlHandlers as Ya, resolveSkipPrefix as Yc, malformedLocalResourcesWarning as Yi, constructPathOf as Yn, createSecretMasker as Yo, assertFlagRoleArn as Yr, isReadableBag as Ys, recheckFailedPlan as Yt, S3_AUTO_DELETE_OBJECTS_TAG as Z, shownType as Za, resolveStateBucketWithDefaultAndSource as Zc, malformedOrphanRecordsWarning as Zi, formatDestructiveChange as Zn, maskSecretsInError as Zo, explicitRoleArnOrThrow as Zr, orphansCarriedFrom as Zs, replacementNeverSwapped as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedOutputs as _a, buildDenyExternalAccessPolicy as _c, isImpossibleEmptyStoredAttribute as _i, hasOwnKey as _l, secretSafeKeyDisplay as _n, prefetchCreateOnlyPropertyPaths as _o, TemplateNoEchoReresolver as _r, provenPublicValue as _s, displacedOpClause as _t, findNestedTemplateTreeDefect as a, malformedResourcePropertiesWarning as aa, loadPublishableAssetManifest as ac, s3BucketArn as ai, findLargeInlineResources as al, isRedactedRecordedValue as an, toCfnInteger as ao, planTagDiff as ar, dynamicReferenceTokens as as, cyan as at, lookupEachName as b, refuseMalformedResourceEntries as ba, describeDockerCapturedOutput as bc, isNamelessDynamicReferenceError as bi, ownValue as bl, exportNameSecretExposure as bn, withRetry as bo, getCurrentResourceSecrets as br, recordNoEchoAttributeValues as bs, getNestedRevertRun as bt, renderNestedTemplateTreeDefect as c, malformedStateRefusalMessage as ca, BOOTSTRAP_MARKER_PREFIX as cc, s3BucketRegionalDomainName as ci, decodeListingKey as cl, updatePartialMessage as cn, coerceCfnInteger as co, tagMapAsList as cr, identityKeyFor as cs, red as ct, conditionInputsFrom as d, refuseMalformedNestedChildOutputs as da, getBootstrapMarkerKey as dc, producerRegionsFromState as di, canonicalizeRegion as dl, DeploymentEventsStore as dn, configStringRefusal as do, stringifyIfAssigned as dr, recoverMaskedOutput as ds, namesAnyDeclaredParameter as dt, malformedOrphansWarning as ea, isSensitiveAttributeName as ec, AWS_CREDENTIAL_ENV_KEYS as ei, warnDeprecatedNoPrefixCliFlag as el, orphanDeleteNeedsIdentity as en, isStatefulRecreateTargetSync as eo, reserveStackCreateToken as er, redactSecretsForState as es, getPriorAttempts as et, parentSuppliedValues as f, refuseMalformedOrphanRecords as fa, isCrossRegionRedirect as fc, regionLessSecretName as fi, derivePartitionAndUrlSuffix as fl, WITHHELD_NAME_DISPLAY as fn, readConfigString as fo, CC_BROKEN_REASON as fr, physicalNameCopiesOf as fs, reachableDivergentParameters as ft, mergeNoChangeOutputs as g, refuseMalformedOrphansForOrphan as ga, validateContainerRepoName as gc, getAccountInfo as gi, defineOwnKey as gl, secretBearingStateKeyWarning as gn, requireConfigString as go, wouldReturnToSdkProvider as gr, carriesSecretMask as gs, NESTED_PENDING_PARENT_REASON as gt, keptWholeReasonText as h, refuseMalformedOrphansForDestroy as ha, validateAssetBucketName as hc, parameterTypeMayLoseSecretIdentity as hi, processStackMessages as hl, secretBearing as hn, requireConfigObject as ho, isCustomResource as hr, splitGetAttStringForm as hs, planOrphanAdoption as ht, childTemplateLoader as i, malformedResourceEntriesWarning as ia, createAssetRedirectResolver as ic, isSettledInstanceState as ii, MIGRATE_TMP_PREFIX as il, REDACTED_DELETE_ADDRESS_SKIP_REASON as in, isWarmThroughputDecrease as io, DBPROXY_TAG_OPTIONS as ir, DYNAMIC_REFERENCE_TOKEN_SCAN as is, bold as it, noEchoExactEchoLeavesOf as j, refuseMalformedResourcesForDestroy as ja, redactedCause as jc, JSON_LISTING_HOLE_VALUE as ji, maskEventTextWithBoundBags as jn, maskedLeafCoordinatesOf as jo, deleteLeftInPlace as jr, isLockInfoExpired as js, isHandledOrphan as jt, noEchoAttributeNamesOf as k, refuseMalformedResourcePropertiesForOrphan as ka, partitionSensitiveEnv as kc, passedParameterClassesOf as ki, resolveBucketRegion as kl, completedReplayEntries as kn, maskReadbackAtCoordinates as ko, UNSPECIFIED_SKIP_REASON as kr, isSingleDynamicReferenceToken as ks, deleteJournaledOrphans as kt, templateIdentity as l, previewableOrphanRecords as la, assertAssetBucketRegion as lc, s3BucketWebsiteUrl as li, expectedOwnerParam as ll, updatePartialReason as ln, configBooleanRefusal as lo, tagPlanWarning as lr, inheritNestedStackParameterAssociations as ls, yellow as lt, isSecretBearingReferenceString as m, refuseMalformedOrphans as ma, readBootstrapMarkerBody as mc, isUnboundTemplateParameter as mi, StageLoadError as ml, exportAliasCollisionScrubWarning as mn, requireConfigArray as mo, ccBrokenReason as mr, recordPhysicalNameCopy as ms, makeSiblingClaimReader as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedOutputsWarning as na, WorkGraph as nc, callerEnvCredentials as ni, CFN_TEMPLATE_BODY_LIMIT as nl, getCurrentProducerRegions as nn, WARM_THROUGHPUT_MEMBERS as no, acquireIdempotencyToken as nr, withPhysicalNameCopies as ns, formatResourceLine as nt, isAbsoluteAssetPath as o, malformedResourcesWarning as oa, rewriteTemplateAssetReferences as oc, s3BucketDomainName as oi, uploadCfnTemplate as ol, redactedDeleteAddressFields as on, toFiniteNumber as oo, readTagList as or, isUncertifiedBaselineMaskPosition as os, gray as ot, readRecordedConditionVerdicts as p, refuseMalformedOrphanRecordsForDestroy as pa, parseBootstrapMarker as pc, coerceParameterTypedValue as pi, AssemblyReader as pl, displayTextOrWithheld as pn, replayWarn as po, ProviderRegistry as pr, recordAttributeIdCopy as ps, resourcesNamingDeclaredParameter as pt, INDEX_SETTLE_POLL_INTERVAL_MS as q, withoutSilentDropProperties as qa, resolveAutoAssetStorage as qc, malformedLocalOutputsWarning as qi, unsupportedFinalSnapshotError as qn, recordLogOnlyValue as qo, refuseUnreadableCdkCrossAccountRefs as qr, importableOutputKeys as qs, planFailedOps as qt, computeImplicitDeleteEdges as r, malformedRenderedContainersWarning as ra, buildAssetRedirectMap as rc, envCredentialsAreAssumedRole as ri, CFN_TEMPLATE_URL_LIMIT as rl, inheritProducerRegions as rn, coerceWarmThroughput as ro, DBPROXY_TAGS_WHAT as rr, withoutPhysicalNameCopies as rs, createReadOnlyAttributeHealerFactory as rt, listNestedTemplateRows as s, malformedScrubResourceEntriesRefusalMessage as sa, AssetModeResolver as sc, s3BucketDualStackDomainName as si, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as sl, redactedDeleteAddressSkip as sn, coerceCfnBoolean as so, refuseMalformedDesiredTags as sr, pathCrossesDottedKey as ss, green as st, DeployEngine as t, malformedOutputsRefusalMessage as ta, stringifyValue as tc, applyCallerIdentityCredentials as ti, ssmResolvedValueType as tl, findNestedStackTypeChanges as tn, renderStatefulReason as to, withCreateTokenLedger as tr, scrubResourceRecord as ts, markRefusedBeforeApplying as tt, conditionFingerprint as u, refuseDivergentRecordRegionForDestroy as ua, ensureAssetStorage as uc, classifyReplaySecretRegion as ui, PARTITION_TABLE as ul, DeploymentEventsReader as un, configIntegerRefusal as uo, definedAttributes as ur, recordNestedStackParameterExpressions as us, computeParameterTaint as ut, chunks as v, refuseMalformedOutputsForDestroy as va, buildDockerImage as vc, carriesDynamicReference as vi, hasPlainPrototype$1 as vl, carriedExportAliasExposure as vn, templateResourceTypes as vo, readsNoEchoDeleteValues as vr, recordMaskOnlyValue as vs, displacedPhysicalIdShown as vt, deferredServiceTokenWarning as w, refuseMalformedResourceEntriesForImportSave as wa, finchSecretArgvRefusal as wc, isStalePlaceholderArnAttribute as wi, renderAssemblyPathEscape as wl, collectPublishedOutputNames as wn, DagBuilder as wo, customResourceResponseExpirationWarning as wr, STATE_SOURCED_BASELINE_RULES as ws, revertedNestedRowIds as wt, withApiLimit as x, refuseMalformedResourceEntriesForDeploy as xa, describeDockerExecFailure as xc, keepsSecretReferenceToken as xi, absoluteAssemblyPathEscape as xl, isWholeDynamicReferenceValue as xn, canonicalLambdaFunctionName as xo, withPrintingSecrets as xr, recordNoEchoParameterFreshValue as xs, nestedChildStackName as xt, isAccessDeniedError as y, refuseMalformedResourceAttributesForOrphan as ya, resolveDockerContextDirectory as yc, carriesFetchableDynamicReference as yi, nullPrototypeRecord as yl, exportNameNoEchoParameters as yn, describeTypeWithThrottleRetry as yo, isCustomResourceType as yr, recordMaskOnlyValuesIn as ys, dropSettledNestedJournals as yt, DynamoDBGlobalTableProvider as z, repairMalformedResourcesForReadOnly as za, AssetManifestLoader as zc, hasReadableOrphans as zi, ATOMIC_FINAL_SNAPSHOT_TYPES as zn, liveMatchesUnresolvedTokenFrame as zo, observeThenDisableInstanceApiTermination as zr, isNotImplemented as zs, destroyStackRecordsView as zt };
-//# sourceMappingURL=deploy-engine-HKmcD4Kn.js.map
+export { isTruthyCfnBoolean as $, NO_CC_HANDLERS_REASON as $a, resolveApp as $c, malformedLocalResourceEntriesWarning as $i, ledgerForStack as $n, shareLogOnlyValues as $o, sendableAssumeRoleCommand as $r, hasUnverifiableParameterRefusal as $s, seedsDeleteFirstGuard as $t, noEchoComparisonForTemplate as A, refuseMalformedResourceEntriesForOrphan as Aa, dockerSpawnEnvWithSensitive as Ac, refStateLookupFromResource as Ai, displayAssemblyPath as Al, journaledOrphanPrintingBag as An, TemplateParser as Ao, deleteIndeterminateGuards as Ar, wholeStringLeavesOf as As, dropFailedHint as At, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as B, repairMalformedOrphansForReadOnly as Ba, runDockerForeground as Bc, UNREADABLE_RESOURCES_MAP_ROW as Bi, PRE_DELETE_SNAPSHOT_TYPES as Bn, passedNoEchoParametersOf as Bo, reDisableInstanceApiTermination as Br, rebuildClientForBucketRegion as Bs, getStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedOutputsForDestroy as Ca, validateContainerRepoName as Cc, carriesDynamicReference as Ci, defineOwnKey as Cl, collectDeclaredOutputNames as Cn, templateResourceTypes as Co, applyCustomResourceResponseExpiration as Cr, carriesSecretMask as Cs, revertNestedChildFromJournal as Ct, withResourceDeadline as D, refuseMalformedResourceEntriesForDestroy as Da, describeDockerCapturedOutput as Dc, AWS_NO_VALUE as Di, ownValue as Dl, DEFAULT_RESOURCE_TIMEOUT_MS as Dn, lambdaFunctionNameForMask as Do, unchangedBehindSecretReference as Dr, recordNoEchoAttributeValues as Ds, getCurrentNestedStackContext as Dt, serviceTokenBlockingReason as E, refuseMalformedResourceEntriesForDeploy as Ea, resolveDockerContextDirectory as Ec, keepsSecretReferenceToken as Ei, nullPrototypeRecord as El, bindingSkippedOutputs as En, canonicalLambdaFunctionName as Eo, slowCcOperationTimeoutMs as Er, recordMaskOnlyValuesIn as Es, collectNestedChildUnaddressed as Et, PROTECTION_PROPERTY_BY_TYPE as F, refuseMalformedResourcesForDeploy as Fa, isMalformedEnvKey as Fc, declaresNoEcho as Fi, clearBucketRegionCache as Fl, secretNamedRecordNeedles as Fn, maskWholeValue as Fo, markWaitAbandoned as Fr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Fs, sameJournaledOrphans as Ft, resolveDynamoDbDeleteBudgetMs as G, unpreviewableOrphanRecords as Ga, stripForDisplay as Gc, hasReadableOutputs as Gi, isFinalSnapshotError as Gn, carryLogOnlyValues as Go, poisonRenderedSpellingsCollidingIn as Gr, isAccessDenied$1 as Gs, isJournaledOrphan as Gt, compensateRemovedDeletionProtection as H, repairMalformedResourceEntriesForReadOnly as Ha, warnFinchArgvExposure as Hc, deployRefusesOrphanRowsReason as Hi, ccRoutedFinalSnapshotError as Hn, readsNoEchoSource as Ho, DiffCalculator as Hr, CrossPrefixScanCache as Hs, removeProtectionTypeList as Ht, isProtectionValueActive as I, refuseMalformedResourcesForDestroy as Ia, partitionSensitiveEnv as Ic, JSON_LISTING_HOLE_VALUE as Ii, resolveBucketRegion as Il, stateSecretNameNeedles as In, maskedLeafCoordinatesOf as Io, disableInstanceApiTermination as Ir, isSingleDynamicReferenceToken as Is, replayFailedOperations as It, deleteTableWithIndexBusyRetry as J, withheldAccountClause as Ja, Synthesizer as Jc, isReadableResourceEntry as Ji, maskingRetryLogger as Jn, literalSplitDelimitersOf as Jo, applyRoleArnIfSet as Jr, acceptedCreateOnlyDropsOf as Js, planRollback as Jt, DELETE_INDEX_WAIT_PROCEED_NOTE as K, unreadableOrphanRecords as Ka, AssetManifestLoader as Kc, hasReadableResources as Ki, refusesFinalSnapshot as Kn, createUnionSecretMasker as Ko, producerLookupOver as Kr, isNotImplemented as Ks, isReplacementOrphan as Kt, perType as L, refuseMalformedResourcesForExport as La, redactDockerArgvValues as Lc, STATE_REGION_DIVERGED as Li, storedSecretNameNeedles as Ln, noEchoCoordinatesOf as Lo, ec2InstanceProtectionSite as Lr, LockManager as Ls, replayRollback as Lt, noEchoParameterNamesOf as M, refuseMalformedResourcePropertiesForDrift as Ma, formatDockerLoginError as Mc, withSharedDrainBudget as Mi, resolveAssemblyPath as Ml, orphanRecordsPrintingBag as Mn, isMarkedCoordinate as Mo, deleteSkipReason as Mr, STATE_SOURCED_CROSS_GENERATION_RULES as Ms, journaledOrphanLines as Mt, recordedProtectionEvidence as N, refuseMalformedResourcePropertiesForExport as Na, getDockerCmd as Nc, parameterInputsFor as Ni, injectAwsRegion as Nl, secretNamePrintingBag as Nn, maskAtCoordinates as No, withIndeterminateGuard as Nr, STATE_SOURCED_READBACK_RULES as Ns, loadJournaledOrphans as Nt, diffSecurity as O, refuseMalformedResourceEntriesForImport as Oa, describeDockerExecFailure as Oc, cfnRefValueFromPhysicalId as Oi, absoluteAssemblyPathEscape as Ol, DEFAULT_RESOURCE_WARN_AFTER_MS as On, sameLambdaFunctionAddress as Oo, RollbackInlinePolicyWriters as Or, recordNoEchoParameterFreshValue as Os, withNestedStackContext as Ot, recordedProtectionNote as P, refuseMalformedResourcePropertiesForOrphan as Pa, isDockerClientEnvKey as Pc, passedParameterClassesOf as Pi, injectedAwsRegionValue as Pl, secretNamePrintingBags as Pn, maskReadbackAtCoordinates as Po, isWaitAbandonedError as Pr, TEMPLATE_SOURCED_RULES as Ps, makeForeignHolderScan as Pt, hasCdkAutoDeleteTag as Q, withoutSilentDropProperties as Qa, loadCdkJson as Qc, malformedLocalOutputsWarning as Qi, earliestDefined as Qn, recordLogOnlyValue as Qo, isIamRoleArn as Qr, hasReasonlessBaselineRefusal as Qs, resolveReplacementOldType as Qt, readProtection as R, refuseMalformedState as Ra, redactedCause as Rc, STATE_RESOURCES_MALFORMED as Ri, extractDeploymentEventError as Rn, noEchoLeavesOf as Ro, isTerminationProtectionPropagationError as Rr, isLockInfoExpired as Rs, awaitInFlightSibling as Rt, keptForReadoption as S, refuseMalformedOutputs as Sa, validateAssetBucketName as Sc, isImpossibleEmptyStoredAttribute as Si, processStackMessages as Sl, noEchoParameterValueSeed as Sn, prefetchCreateOnlyPropertyPaths as So, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Sr, splitGetAttStringForm as Ss, recordDisplacedSkips as St, findServiceTokenRefusals as T, refuseMalformedResourceEntries as Ta, buildDockerImage as Tc, isNamelessDynamicReferenceError as Ti, hasPlainPrototype$1 as Tl, isExportAliasCollision as Tn, withRetry as To, CloudControlProvider as Tr, recordMaskOnlyValue as Ts, withNestedRevertRun as Tt, deleteBudgetKey as U, repairMalformedResourcePropertiesForReadOnly as Ua, escapeRegExp$3 as Uc, displayLogicalId as Ui, createPreDeleteFinalSnapshot as Un, valueAtCoordinate as Uo, INTRINSIC_KEYS as Ur, applyCrossPrefixScan as Us, recordAfterRollbackUpdate as Ut, beginDeleteWait as V, repairMalformedOutputsForReadOnly as Va, runDockerStreaming as Vc, accountArgs as Vi, buildFinalSnapshotIdentifier as Vn, readbackPathFor as Vo, reEnableInstanceApiTermination as Vr, CrossPrefixReadError as Vs, withStackRecords as Vt, resolveDynamoDbDeleteBudgetClock as W, repairMalformedResourcesForReadOnly as Wa, stripControlChars as Wc, hasReadableOrphans as Wi, effectiveDeletionPolicy as Wn, liveMatchesUnresolvedTokenFrame as Wo, IntrinsicFunctionResolver as Wr, crossPrefixDeniedWarning as Ws, demoteSupersededOrphans as Wt, ECR_AUTO_DELETE_IMAGES_TAG as X, findSilentDropProperties as Xa, getDefaultStateBucketName as Xc, malformedExportNamesWarning as Xi, findDestructiveChanges as Xn, printingCorpusOf as Xo, assertSendableRoleArn as Xr, exportNamesCarriedFrom as Xs, recordUnderIdIsNotOwn as Xt, waitForIndexesSettled as Y, findActionableSilentDrops as Ya, synthesisStatusMessage as Yc, malformedDriftResourcePropertiesWarning as Yi, constructPathOf as Yn, logOnlyValueCount as Yo, assertFlagRoleArn as Yr, describeRegionValueKind as Ys, recheckFailedPlan as Yt, S3_AUTO_DELETE_OBJECTS_TAG as Z, unwrittenCreateOnlyReplacement as Za, getLegacyStateBucketName as Zc, malformedExportSourceWarning as Zi, formatDestructiveChange as Zn, recordLogOnlyParameterValue as Zo, explicitRoleArnOrThrow as Zr, hasReadableExportSet as Zs, replacementNeverSwapped as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedOrphanRecords as _a, ensureAssetStorage as _c, regionLessSecretName as _i, PARTITION_TABLE as _l, secretSafeKeyDisplay as _n, readConfigString as _o, TemplateNoEchoReresolver as _r, recordNestedStackParameterExpressions as _s, displacedOpClause as _t, findNestedTemplateTreeDefect as a, malformedOrphansWarning as aa, shouldRetainResource as ac, keepHeldTokenProvenance as ai, resolveUseCdkBootstrapAssets as al, isRedactedRecordedValue as an, isStatefulRecreateTargetSync as ao, planTagDiff as ar, recordReferenceProvenanceEntry as as, cyan as at, lookupEachName as b, refuseMalformedOrphansForDestroy as ba, parseBootstrapMarker as bc, parameterTypeMayLoseSecretIdentity as bi, AssemblyReader as bl, exportNameSecretExposure as bn, requireConfigObject as bo, getCurrentResourceSecrets as br, recordAttributeIdCopy as bs, getNestedRevertRun as bt, renderNestedTemplateTreeDefect as c, malformedRenderedContainersWarning as ca, stringifyValue as cc, recordedReferenceRegions as ci, ssmResolvedValueType as cl, updatePartialMessage as cn, coerceWarmThroughput as co, tagMapAsList as cr, scrubResourceRecord as cs, red as ct, conditionInputsFrom as d, malformedResourcesWarning as da, createAssetRedirectResolver as dc, s3BucketDualStackDomainName as di, MIGRATE_TMP_PREFIX as dl, DeploymentEventsStore as dn, toFiniteNumber as do, stringifyIfAssigned as dr, DYNAMIC_REFERENCE_TOKEN_SCAN as ds, namesAnyDeclaredParameter as dt, malformedLocalResourcesWarning as ea, importableOutputKeys as ec, AWS_CREDENTIAL_ENV_KEYS as ei, resolveAutoAssetStorage as el, orphanDeleteNeedsIdentity as en, hasNoCloudControlHandlers as eo, reserveStackCreateToken as er, createSecretMasker as es, getPriorAttempts as et, parentSuppliedValues as f, malformedScrubResourceEntriesRefusalMessage as fa, loadPublishableAssetManifest as fc, s3BucketRegionalDomainName as fi, findLargeInlineResources as fl, WITHHELD_NAME_DISPLAY as fn, coerceCfnBoolean as fo, CC_BROKEN_REASON as fr, dynamicReferenceTokens as fs, reachableDivergentParameters as ft, mergeNoChangeOutputs as g, refuseMalformedNestedChildOutputs as ga, assertAssetBucketRegion as gc, producerRegionsFromState as gi, expectedOwnerParam as gl, secretBearingStateKeyWarning as gn, configStringRefusal as go, wouldReturnToSdkProvider as gr, inheritNestedStackParameterAssociations as gs, NESTED_PENDING_PARENT_REASON as gt, keptWholeReasonText as h, refuseDivergentRecordRegionForDestroy as ha, BOOTSTRAP_MARKER_PREFIX as hc, classifyReplaySecretRegion as hi, decodeListingKey as hl, secretBearing as hn, configIntegerRefusal as ho, isCustomResource as hr, identityKeyFor as hs, planOrphanAdoption as ht, childTemplateLoader as i, malformedOrphansRefusalMessage as ia, orphansCarriedFrom as ic, isSettledInstanceState as ii, resolveStateBucketWithDefaultAndSource as il, REDACTED_DELETE_ADDRESS_SKIP_REASON as in, isStatefulRecreateTargetForReplace as io, DBPROXY_TAG_OPTIONS as ir, markSameGenerationBag as is, bold as it, noEchoExactEchoLeavesOf as j, refuseMalformedResourcePropertiesForDestroy as ja, finchSecretArgvRefusal as jc, parseWebACLArn as ji, renderAssemblyPathEscape as jl, maskEventTextWithBoundBags as jn, canonicalCoordinates as jo, deleteLeftInPlace as jr, STATE_SOURCED_BASELINE_RULES as js, isHandledOrphan as jt, noEchoAttributeNamesOf as k, refuseMalformedResourceEntriesForImportSave as ka, describeDockerFailure as kc, isStalePlaceholderArnAttribute as ki, describeFileReadFailure as kl, completedReplayEntries as kn, DagBuilder as ko, UNSPECIFIED_SKIP_REASON as kr, recordProvenPublicExpression as ks, deleteJournaledOrphans as kt, templateIdentity as l, malformedResourceEntriesWarning as la, WorkGraph as lc, s3BucketArn as li, CFN_TEMPLATE_BODY_LIMIT as ll, updatePartialReason as ln, isWarmThroughputDecrease as lo, tagPlanWarning as lr, withPhysicalNameCopies as ls, yellow as lt, isSecretBearingReferenceString as m, previewableOrphanRecords as ma, AssetModeResolver as mc, classifyRecordedSecretRegion as mi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ml, exportAliasCollisionScrubWarning as mn, configBooleanRefusal as mo, ccBrokenReason as mr, pathCrossesDottedKey as ms, makeSiblingClaimReader as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedOrphanRecordsWarning as na, isReadableBag as nc, callerEnvCredentials as ni, resolveSkipPrefix as nl, getCurrentProducerRegions as nn, shownType as no, acquireIdempotencyToken as nr, maskSecretsInError as ns, formatResourceLine as nt, isAbsoluteAssetPath as o, malformedOutputsRefusalMessage as oa, AssetPublisher as oc, outputReferenceProvenanceOf as oi, stateBucketExistenceConfirmed as ol, redactedDeleteAddressFields as on, renderStatefulReason as oo, readTagList as or, snapshotPassProvenance as os, gray as ot, readRecordedConditionVerdicts as p, malformedStateRefusalMessage as pa, rewriteTemplateAssetReferences as pc, s3BucketWebsiteUrl as pi, uploadCfnTemplate as pl, displayTextOrWithheld as pn, coerceCfnInteger as po, ProviderRegistry as pr, isUncertifiedBaselineMaskPosition as ps, resourcesNamingDeclaredParameter as pt, INDEX_SETTLE_POLL_INTERVAL_MS as q, unreadableResourceEntries as qa, getDockerImageBySourceHash as qc, isReadableOrphanRecord as qi, unsupportedFinalSnapshotError as qn, hasMaskableValues as qo, refuseUnreadableCdkCrossAccountRefs as qr, splitImportedOps as qs, planFailedOps as qt, computeImplicitDeleteEdges as r, malformedOrphanRowsKeptWarning as ra, orphansAfterRollback as rc, envCredentialsAreAssumedRole as ri, resolveStateBucketWithDefault as rl, inheritProducerRegions as rn, MULTI_REGION_RECREATE_BLOCKED_TYPES as ro, DBPROXY_TAGS_WHAT as rr, maskSecretsInText as rs, createReadOnlyAttributeHealerFactory as rt, listNestedTemplateRows as s, malformedOutputsWarning as sa, isSensitiveAttributeName as sc, recordedOutputReferenceRegions as si, warnDeprecatedNoPrefixCliFlag as sl, redactedDeleteAddressSkip as sn, WARM_THROUGHPUT_MEMBERS as so, refuseMalformedDesiredTags as sr, redactSecretsForState as ss, green as st, DeployEngine as t, malformedOrphanRecordsRefusalMessage as ta, importableOutputs as tc, applyCallerIdentityCredentials as ti, resolveCaptureObservedState as tl, findNestedStackTypeChanges as tn, findReplacedReadersOfRecreateTargets as to, withCreateTokenLedger as tr, errorCauseChain as ts, markRefusedBeforeApplying as tt, conditionFingerprint as u, malformedResourcePropertiesWarning as ua, buildAssetRedirectMap as uc, s3BucketDomainName as ui, CFN_TEMPLATE_URL_LIMIT as ul, DeploymentEventsReader as un, toCfnInteger as uo, definedAttributes as ur, withoutPhysicalNameCopies as us, computeParameterTaint as ut, chunks as v, refuseMalformedOrphanRecordsForDestroy as va, getBootstrapMarkerKey as vc, coerceParameterTypedValue as vi, canonicalizeRegion as vl, carriedExportAliasExposure as vn, replayWarn as vo, readsNoEchoDeleteValues as vr, recoverMaskedOutput as vs, displacedPhysicalIdShown as vt, deferredServiceTokenWarning as w, refuseMalformedResourceAttributesForOrphan as wa, buildDenyExternalAccessPolicy as wc, carriesFetchableDynamicReference as wi, hasOwnKey as wl, collectPublishedOutputNames as wn, describeTypeWithThrottleRetry as wo, customResourceResponseExpirationWarning as wr, provenPublicValue as ws, revertedNestedRowIds as wt, withApiLimit as x, refuseMalformedOrphansForOrphan as xa, readBootstrapMarkerBody as xc, getAccountInfo as xi, StageLoadError as xl, isWholeDynamicReferenceValue as xn, requireConfigString as xo, withPrintingSecrets as xr, recordPhysicalNameCopy as xs, nestedChildStackName as xt, isAccessDeniedError as y, refuseMalformedOrphans as ya, isCrossRegionRedirect as yc, isUnboundTemplateParameter as yi, derivePartitionAndUrlSuffix as yl, exportNameNoEchoParameters as yn, requireConfigArray as yo, isCustomResourceType as yr, physicalNameCopiesOf as ys, dropSettledNestedJournals as yt, DynamoDBGlobalTableProvider as z, repairMalformedOrphanRecordsForReadOnly as za, redactedDockerCause as zc, UNREADABLE_ORPHANS_CONTAINER_ROW as zi, ATOMIC_FINAL_SNAPSHOT_TYPES as zn, noEchoOutputsComparison as zo, observeThenDisableInstanceApiTermination as zr, S3StateBackend as zs, destroyStackRecordsView as zt };
+//# sourceMappingURL=deploy-engine-CZUhJ1IZ.js.map