@go-to-k/cdkd 0.299.0 → 0.299.2

package/dist/{deploy-engine-4K_B3N08.js → deploy-engine-DlLwYRJk.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-Bj7qH5Ph.js"
 import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, H as truncateCodePoints, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as terminalSafe, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
 import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-Pn2m0R67.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-DBXBcg0J.js";
-import { t as getCdkdVersion } from "./version-DUCWZskc.js";
+import { t as getCdkdVersion } from "./version-Dz0rTkus.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -19463,6 +19463,14 @@ function classifyReplaySecretRegion(expression, consumerRegion, importedProducer
 		foreignProducerRegions
 	};
 }
+function classifyRecordedSecretRegion(expression, consumerRegion, importedProducerRegions, recordedRegions) {
+	const recorded = recordedRegions?.get(expression);
+	if (recorded === void 0 || regionLessSecretName(expression) === void 0) return classifyReplaySecretRegion(expression, consumerRegion, importedProducerRegions);
+	return canonicalizeRegion(recorded) === canonicalizeRegion(consumerRegion) ? { kind: "local" } : {
+		kind: "recorded-region",
+		region: recorded
+	};
+}
 
 //#endregion
 //#region src/utils/s3-endpoints.ts
@@ -19651,6 +19659,335 @@ async function constructAttributeForCoreTypes(resource, attributeName, context,
 	return NOT_CONSTRUCTED;
 }
 
+//#endregion
+//#region src/deployment/reference-provenance-record.ts
+const SSM_VERSION = /^[0-9]{1,10}$/;
+const SECRETS_MANAGER_VERSION = /^[A-Za-z0-9_+=.@/-]{32,64}$/;
+function referenceTokensIn(value, into = /* @__PURE__ */ new Set()) {
+	const walk = (v) => {
+		if (typeof v === "string") {
+			if (!v.includes("{{resolve:")) return;
+			for (const token of dynamicReferenceTokens(v)) into.add(token);
+			return;
+		}
+		if (Array.isArray(v)) {
+			for (const item of v) walk(item);
+			return;
+		}
+		if (v !== null && typeof v === "object") for (const item of Object.values(v)) walk(item);
+	};
+	walk(value);
+	return into;
+}
+function recordReferenceTokens(record) {
+	const tokens = referenceTokensIn(record.properties);
+	referenceTokensIn(record.attributes, tokens);
+	referenceTokensIn(record.observedProperties, tokens);
+	return tokens;
+}
+function versionShapeOf(token) {
+	if (token.startsWith("{{resolve:secretsmanager:")) return SECRETS_MANAGER_VERSION;
+	if (token.startsWith("{{resolve:ssm:") || token.startsWith("{{resolve:ssm-secure:")) return SSM_VERSION;
+}
+function isValidReferenceVersion(token, version) {
+	const shape = versionShapeOf(token);
+	return shape !== void 0 && typeof version === "string" && shape.test(version);
+}
+function validReferenceRegion(region) {
+	if (typeof region !== "string") return void 0;
+	return canonicalizeRegion(region) === region && isClientSafeRegion(region) ? region : void 0;
+}
+function isPlainObject$2(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function validateReferenceProvenance(token, raw) {
+	if (!isSingleDynamicReferenceToken(token) || !isPlainObject$2(raw)) return void 0;
+	const versionsRaw = Object.hasOwn(raw, "versions") ? raw["versions"] : void 0;
+	const readRaw = Object.hasOwn(raw, "readVersions") ? raw["readVersions"] : void 0;
+	if (readRaw !== void 0) {
+		if (!Array.isArray(readRaw)) return void 0;
+		const all = Array.isArray(versionsRaw) ? versionsRaw : [];
+		if (!readRaw.every((v) => all.includes(v))) return void 0;
+	}
+	const out = {};
+	const region = validReferenceRegion(Object.hasOwn(raw, "region") ? raw["region"] : void 0);
+	if (region !== void 0) out.region = region;
+	if (Array.isArray(versionsRaw) && versionsRaw.length > 0 && versionsRaw.length <= 8 && versionsRaw.every((v) => isValidReferenceVersion(token, v)) && (readRaw === void 0 || readRaw.every((v) => typeof v === "string"))) {
+		out.versions = [...new Set(versionsRaw)].sort();
+		if (readRaw !== void 0 && readRaw.length > 0) out.readVersions = [...new Set(readRaw)].sort();
+	}
+	return out;
+}
+function referenceProvenanceOf(record) {
+	if (!isPlainObject$2(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	return validatedBag(record["referenceProvenance"]);
+}
+function validatedBag(field) {
+	if (!isPlainObject$2(field)) return void 0;
+	const out = Object.create(null);
+	for (const [token, raw] of Object.entries(field)) {
+		const entry = validateReferenceProvenance(token, raw);
+		if (entry !== void 0) out[token] = entry;
+	}
+	return { ...out };
+}
+function recordedProvenanceOf(record, token) {
+	if (!isPlainObject$2(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	const field = record["referenceProvenance"];
+	if (!isPlainObject$2(field) || !Object.hasOwn(field, token)) return void 0;
+	return validateReferenceProvenance(token, field[token]);
+}
+function recordedReferenceRegions(record) {
+	const field = referenceProvenanceOf(record);
+	return field === void 0 ? void 0 : regionsOf(field);
+}
+function recordedOutputReferenceRegions(state, outputKey) {
+	const field = outputReferenceProvenanceOf(state, outputKey);
+	return field === void 0 ? void 0 : regionsOf(field);
+}
+function regionsOf(field) {
+	let out;
+	for (const [token, entry] of Object.entries(field)) {
+		if (entry.region === void 0) continue;
+		(out ??= /* @__PURE__ */ new Map()).set(token, entry.region);
+	}
+	return out;
+}
+function keepHeldTokenProvenance(record) {
+	if (!hasReferenceProvenanceField(record)) return record;
+	const field = record.referenceProvenance;
+	if (!isPlainObject$2(field)) return record;
+	const held = recordReferenceTokens(record);
+	const keys = Object.keys(field);
+	if (keys.every((token) => held.has(token))) return record;
+	const kept = {};
+	for (const token of keys) if (held.has(token)) kept[token] = field[token];
+	return {
+		...record,
+		referenceProvenance: kept
+	};
+}
+function hasReferenceProvenanceField(record) {
+	return isPlainObject$2(record) && Object.hasOwn(record, "referenceProvenance") && record["referenceProvenance"] !== void 0;
+}
+function outputReferenceProvenanceOf(state, outputKey) {
+	if (!isPlainObject$2(state) || !Object.hasOwn(state, "outputReferenceProvenance")) return;
+	const field = state["outputReferenceProvenance"];
+	if (!isPlainObject$2(field) || !Object.hasOwn(field, outputKey)) return void 0;
+	return validatedBag(field[outputKey]);
+}
+function persistable(token, entry) {
+	return (entry === void 0 ? void 0 : validateReferenceProvenance(token, entry)) ?? {};
+}
+function tokensUnderPaths(properties, paths) {
+	const out = /* @__PURE__ */ new Set();
+	const descend = (value, path, at) => {
+		if (at === path.length) {
+			referenceTokensIn(value, out);
+			return;
+		}
+		if (Array.isArray(value)) {
+			const next = path[at] === "*" ? at + 1 : at;
+			for (const item of value) descend(item, path, next);
+			return;
+		}
+		if (isPlainObject$2(value) && Object.hasOwn(value, path[at])) descend(value[path[at]], path, at + 1);
+	};
+	for (const path of paths) descend(properties, path, 0);
+	return out;
+}
+function provenanceForWrittenRecord(args) {
+	const { record, secrets, previous, inPlace } = args;
+	const previousField = inPlace === void 0 ? void 0 : referenceProvenanceOf(previous);
+	if (!hasPassProvenance(secrets) && previousField === void 0 && args.walkWithoutPassProvenance !== true) return;
+	const tokens = recordReferenceTokens(record);
+	if (tokens.size === 0) return void 0;
+	let kept;
+	if (inPlace !== void 0) {
+		kept = inPlace.createOnly === "all" ? tokens : tokensUnderPaths(record.properties, inPlace.createOnly);
+		if (inPlace.attributesCarried) referenceTokensIn(record.attributes, kept);
+	}
+	const out = {};
+	for (const token of [...tokens].sort()) {
+		const pass = passProvenanceFor(secrets, token);
+		if (kept === void 0 || !kept.has(token)) {
+			out[token] = persistable(token, pass);
+			continue;
+		}
+		const before = previousField !== void 0 && Object.hasOwn(previousField, token) ? previousField[token] : void 0;
+		if (pass === void 0) {
+			out[token] = before === void 0 ? {} : { ...before };
+			continue;
+		}
+		out[token] = persistable(token, unionWithPrevious(pass, before));
+	}
+	return out;
+}
+function unionWithPrevious(pass, before) {
+	const out = {};
+	if (pass.region !== void 0 && (before?.region === void 0 || before.region === pass.region)) out.region = pass.region;
+	if (pass.versions !== void 0 && before?.versions !== void 0) {
+		out.versions = [.../* @__PURE__ */ new Set([...before.versions, ...pass.versions])].sort();
+		if (pass.readVersions !== void 0) out.readVersions = [...pass.readVersions];
+	}
+	return out;
+}
+function outputProvenanceForPersist(args) {
+	const { outputs, resolvedThisRun, carriedFrom, sinkOf } = args;
+	if (!resolvedThisRun) return carriedFrom !== void 0 && isPlainObject$2(carriedFrom.outputReferenceProvenance) ? carriedFrom.outputReferenceProvenance : void 0;
+	let out;
+	for (const [outputKey, value] of Object.entries(outputs)) {
+		const sink = sinkOf(outputKey);
+		if (!hasPassProvenance(sink)) continue;
+		const tokens = referenceTokensIn(value);
+		if (tokens.size === 0) continue;
+		const entries = {};
+		for (const token of [...tokens].sort()) entries[token] = persistable(token, passProvenanceFor(sink, token));
+		out ??= Object.create(null);
+		out[outputKey] = entries;
+	}
+	return out === void 0 ? void 0 : { ...out };
+}
+const KEEP_REFERENCE_PROVENANCE = Symbol("keep reference provenance");
+function withReferenceProvenance(record, field) {
+	if (field === KEEP_REFERENCE_PROVENANCE) return record;
+	if (field === void 0 && !Object.hasOwn(record, "referenceProvenance")) return record;
+	const { referenceProvenance: _previous, ...rest } = record;
+	return field === void 0 ? rest : {
+		...rest,
+		referenceProvenance: field
+	};
+}
+
+//#endregion
+//#region src/deployment/intrinsic-resolver/recorded-reference-routes.ts
+function tokensOf(value) {
+	const out = /* @__PURE__ */ new Set();
+	for (const leaf of wholeStringLeavesOf(value)) for (const token of dynamicReferenceTokens(leaf)) out.add(token);
+	return [...out];
+}
+function recordedTokenRoutes(value, record) {
+	if (!hasReferenceProvenanceField(record)) return void 0;
+	const routes = /* @__PURE__ */ new Map();
+	let recorded = false;
+	for (const token of tokensOf(value)) {
+		const entry = recordedProvenanceOf(record, token);
+		const region = entry?.region;
+		const pin = entry?.versions?.length === 1 ? entry.versions[0] : void 0;
+		if (region !== void 0 || pin !== void 0) recorded = true;
+		routes.set(token, {
+			region,
+			pin
+		});
+	}
+	return recorded ? routes : void 0;
+}
+async function reresolveByRecordedRoutes(resolver, value, logicalId, context, origin, sourceKey, routes, defaults) {
+	const tokens = [...routes.keys()];
+	const regionOf = (token) => routes.get(token)?.region ?? defaults.region;
+	const unrouted = tokens.filter((token) => routes.get(token)?.region === void 0);
+	if (defaults.proofs !== void 0 && unrouted.length > 0) {
+		if (!defaults.proofs.regionProven(unrouted)) {
+			defaults.proofs.onRegionUnproven();
+			return value;
+		}
+	}
+	const routeOf = (token) => {
+		const region = regionOf(token);
+		return region ? {
+			resolver: resolver.resolverForProducerRegion(region, context),
+			context: withoutProducerRegions(context)
+		} : {
+			resolver,
+			context
+		};
+	};
+	const pins = /* @__PURE__ */ new Map();
+	for (const token of tokens) {
+		const pin = routes.get(token)?.pin;
+		if (pin === void 0) continue;
+		const read = await readsPinnedVersion(token, pin, routeOf(token));
+		if (read === "read") pins.set(token, pin);
+		else if (read === "failed" && context.provenanceCapture !== true) resolver.logger.warn(safeMsg`Could not read the secret version ${resolver.displayMasked(logicalId, context)} was deployed with for ${resolver.displayMasked(origin, context)} (it may have been deprecated or deleted); ${defaults.proofs === void 0 ? "serving its current value instead" : "checking its current value against the physical id instead"}.`);
+		if (read === "short" && defaults.proofs === void 0 && context.provenanceCapture !== true) resolver.logger.warn(safeMsg`Not serving ${resolver.displayMasked(origin, context)} at the secret version ${resolver.displayMasked(logicalId, context)} was deployed with: that value is shorter than four characters, so cdkd could not keep it out of state; serving its current value instead.`);
+	}
+	if (defaults.proofs !== void 0) {
+		const unpinned = tokens.filter((token) => !pins.has(token));
+		if (unpinned.length > 0 && !await defaults.proofs.generationProven(unpinned, routeOf)) {
+			defaults.proofs.onGenerationUnproven();
+			return value;
+		}
+	}
+	const walkContext = pins.size > 0 ? {
+		...context,
+		referencePins: pins
+	} : context;
+	const regions = new Set(tokens.map((token) => regionOf(token) ?? ""));
+	if (regions.size <= 1) {
+		const [only] = regions;
+		return await resolver.reresolveCrossStackValue(value, only || void 0, walkContext, origin, sourceKey);
+	}
+	return await rebuildByToken(value, async (token) => String(await resolver.reresolveCrossStackValue(token, regionOf(token), walkContext, origin, void 0)));
+}
+const failedPins = /* @__PURE__ */ new WeakMap();
+async function readsPinnedVersion(token, pin, { resolver, context }) {
+	const key = injectiveKey(token, pin);
+	let failed = failedPins.get(resolver);
+	if (failed?.has(key) === true) return "known";
+	const { abandonedResolutions: _collected, ...throwing } = context;
+	const quiet = {
+		...throwing,
+		provenanceSuppressed: true
+	};
+	try {
+		await resolver.resolveDynamicReferences(token, quiet);
+	} catch (err) {
+		if (isDeliberateResolutionRefusal(err)) throw err;
+	}
+	try {
+		const served = await resolver.resolveDynamicReferences(token, {
+			...quiet,
+			referencePins: /* @__PURE__ */ new Map([[token, pin]])
+		});
+		return !served.includes("{{resolve:") && served.length < 4 ? "short" : "read";
+	} catch (err) {
+		if (isDeliberateResolutionRefusal(err)) throw err;
+		resolver.logger.debug(safeMsg`Pinned read of ${resolver.displayMasked(token, context)} failed: ${resolver.displayMasked(err instanceof Error ? err.message : String(err), context)}`);
+		if (!isThrottlingError(err)) {
+			if (failed === void 0) {
+				failed = /* @__PURE__ */ new Set();
+				failedPins.set(resolver, failed);
+			}
+			failed.add(key);
+		}
+		return "failed";
+	}
+}
+async function rebuildByToken(value, resolveToken) {
+	if (typeof value === "string") {
+		let out = "";
+		let cursor = 0;
+		for (const token of dynamicReferenceTokens(value)) {
+			const at = value.indexOf(token, cursor);
+			if (at < 0) throw new Error("Internal invariant: a scanned dynamic reference was not found in the value it was scanned from");
+			out += value.slice(cursor, at) + await resolveToken(token);
+			cursor = at + token.length;
+		}
+		return out + value.slice(cursor);
+	}
+	if (Array.isArray(value)) {
+		const out = new Array(value.length);
+		for (let i = 0; i < value.length; i++) out[i] = await rebuildByToken(value[i], resolveToken);
+		return out;
+	}
+	if (value !== null && typeof value === "object") {
+		const out = Object.create(null);
+		for (const [k, v] of Object.entries(value)) out[k] = await rebuildByToken(v, resolveToken);
+		return out;
+	}
+	return value;
+}
+
 //#endregion
 //#region src/deployment/intrinsic-resolver/getatt-construct-app.ts
 async function constructAttributeForAppTypes(resource, attributeName, context, logicalId, resourceType, physicalId, accountId, partition, region) {
@@ -20055,7 +20392,14 @@ async function resolveGetAtt(getAtt, context) {
 				structured: isStructured(flatValue),
 				redacted: isSensitiveAttributeName(attributeName)
 			})}`);
-			if (reresolvesNestedReference) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${this.displayLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
+			if (reresolvesNestedReference) {
+				const childRegion = nestedStackChildRegionFromLocalArn(resource.physicalId);
+				const nestedOrigin = `nested stack ${logicalId} ${this.displayLeaf(attributeName, context)}`;
+				const nestedSourceKey = crossStackSourceKey({ "Fn::GetAtt": getAtt });
+				const routes = context.recordedSecretValues === void 0 || carriesSecretMask(flatValue) ? void 0 : recordedTokenRoutes(flatValue, resource);
+				if (routes !== void 0) return await reresolveByRecordedRoutes(this, flatValue, logicalId, context, nestedOrigin, nestedSourceKey, routes, { region: childRegion });
+				return await this.reresolveCrossStackValue(flatValue, childRegion, context, nestedOrigin, nestedSourceKey);
+			}
 			return await this.reresolveRecordedReferences(notedFlatValue, logicalId, context, `${logicalId}.${this.displayLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 		}
 		if (attributeName.includes(".")) {
@@ -20177,22 +20521,38 @@ function recordSecretNamedRead(logicalId, value, context) {
 async function reresolveRecordedReferences(value, logicalId, context, origin, sourceKey) {
 	if (!carriesDynamicReference(value) || carriesSecretMask(value)) return value;
 	if (context.recordedSecretValues === void 0) return value;
+	const notReresolvingLine = () => this.logger.debug(safeMsg`Not re-resolving the reference(s) in ${this.displayMasked(origin, context)}: the template of ${this.displayMasked(logicalId, context)} does not spell them, and this stack may read a stack in another region, so the region that resolved them is unknown`);
+	const servingAsRecordedLine = () => this.logger.warn(safeMsg`Serving ${this.displayMasked(origin, context)} as recorded, with its {{resolve:...}} reference(s) unresolved: cdkd cannot confirm the secret still holds the value ${this.displayMasked(logicalId, context)} was deployed with, because its physical id does not contain it. Either the secret changed since then (update ${this.displayMasked(logicalId, context)} so cdkd deploys it with the new value), or the value is not part of its name (a custom resource's Data, a name shorter than four characters), and cdkd sends the recorded reference as before.`);
+	const record = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
+	const routes = recordedTokenRoutes(value, record);
+	if (routes !== void 0) return await reresolveByRecordedRoutes(this, value, logicalId, context, origin, sourceKey, routes, {
+		region: void 0,
+		proofs: {
+			regionProven: (tokens) => referencesProvenLocal(tokens, logicalId, context) || referencesRegionProven(tokens, context, this.resolverRegion),
+			onRegionUnproven: notReresolvingLine,
+			generationProven: (tokens, routeOf) => this.referencesMatchPhysicalId(tokens, logicalId, context, routeOf),
+			onGenerationUnproven: () => {
+				if (context.provenanceCapture !== true) servingAsRecordedLine();
+			}
+		}
+	});
 	if (!referencesProvenLocal(value, logicalId, context) && !referencesRegionProven(value, context, this.resolverRegion)) {
-		this.logger.debug(safeMsg`Not re-resolving the reference(s) in ${this.displayMasked(origin, context)}: the template of ${this.displayMasked(logicalId, context)} does not spell them, and this stack may read a stack in another region, so the region that resolved them is unknown`);
+		notReresolvingLine();
 		return value;
 	}
 	if (!await this.referencesMatchPhysicalId(value, logicalId, context)) {
 		if (context.provenanceCapture) return value;
-		this.logger.warn(safeMsg`Serving ${this.displayMasked(origin, context)} as recorded, with its {{resolve:...}} reference(s) unresolved: cdkd cannot confirm the secret still holds the value ${this.displayMasked(logicalId, context)} was deployed with, because its physical id does not contain it. Either the secret changed since then (update ${this.displayMasked(logicalId, context)} so cdkd deploys it with the new value), or the value is not part of its name (a custom resource's Data, a name shorter than four characters), and cdkd sends the recorded reference as before.`);
+		servingAsRecordedLine();
 		return value;
 	}
 	return await this.reresolveCrossStackValue(value, void 0, context, origin, sourceKey);
 }
-async function referencesMatchPhysicalId(value, logicalId, context) {
+async function referencesMatchPhysicalId(value, logicalId, context, routeOf) {
 	const record = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
 	const physicalId = typeof record?.physicalId === "string" ? record.physicalId.toLowerCase() : "";
 	for (const leaf of wholeStringLeavesOf(value)) for (const token of dynamicReferenceTokens(leaf)) {
-		const plaintext = await this.resolveDynamicReferences(token, context);
+		const route = routeOf?.(token);
+		const plaintext = route === void 0 ? await this.resolveDynamicReferences(token, context) : await route.resolver.resolveDynamicReferences(token, route.context);
 		if (plaintext.includes("{{resolve:")) continue;
 		if (plaintext.length < 4) return false;
 		if (!physicalId.includes(plaintext.toLowerCase())) return false;
@@ -21276,7 +21636,7 @@ function secretVerdictScope(resolver) {
 	return injectiveKey(credentialFingerprint(ambientCredentialConfig()), canonicalizeRegion(resolver.explicitRegion) ?? "");
 }
 function recordProvenanceOfResolution(resolver, context, token, version) {
-	if (context === void 0) return;
+	if (context === void 0 || context.provenanceSuppressed === true) return;
 	const resolution = {
 		region: canonicalizeRegion(resolver.explicitRegion),
 		version,
@@ -21343,14 +21703,21 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 				if (!foreign.complete || foreign.substitutions.length !== 1) complete = false;
 				continue;
 			}
-			const dynamicReferenceCacheKey = injectiveKey(credentialFingerprint(ambientCredentialConfig()), fullMatch);
-			const cached = this.cachedDynamicReferences.get(dynamicReferenceCacheKey);
+			const pin = context?.referencePins?.get(fullMatch);
+			const credentialKey = credentialFingerprint(ambientCredentialConfig());
+			let dynamicReferenceCacheKey = injectiveKey(credentialKey, fullMatch);
+			let cached = this.cachedDynamicReferences.get(dynamicReferenceCacheKey);
+			const pinnedGeneration = pin !== void 0 && cached?.version !== pin;
+			if (pinnedGeneration) {
+				dynamicReferenceCacheKey = injectiveKey(credentialKey, fullMatch, pin);
+				cached = this.cachedDynamicReferences.get(dynamicReferenceCacheKey);
+			}
 			if (cached) {
 				if (cached.secret && cached.value && !persistedText) this.refuseSecretAssembledReference(fullMatch, tokenLogText, context);
 				const recorded = context?.recordedSecretValues;
 				if (cached.secret && cached.value && recorded) {
 					recorded.set(cached.value, fullMatch);
-					recordResolvedPair(recorded, fullMatch, cached.value);
+					if (!pinnedGeneration) recordResolvedPair(recorded, fullMatch, cached.value);
 				}
 				if (cached.secret && cached.value) recordProvenanceOfResolution(this, context, fullMatch, cached.version);
 				if (service === "ssm" && !cached.secret && recorded && !this.producerRegionGuest) recordProvenPublicExpression(recorded, fullMatch, cached.value);
@@ -21371,18 +21738,19 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 			let resolvedVersion;
 			if (service === "secretsmanager") {
 				const versionOut = {};
-				resolved = await this.resolveSecretsManagerReference(inner, context, nameLogText, versionOut);
+				resolved = await this.resolveSecretsManagerReference(inner, context, nameLogText, versionOut, pinnedGeneration ? pin : void 0);
 				resolvedVersion = versionOut.version;
 			} else if (service === "ssm") {
 				const decrypt = context?.skipDynamicReferences !== true;
-				const param = await this.resolveSSMReference(parts, decrypt, "ssm", context, nameLogText);
+				const param = await this.resolveSSMReference(parts, decrypt, "ssm", context, nameLogText, pinnedGeneration ? pin : void 0);
 				const proofBag = context?.recordedSecretValues;
+				const writesVerdict = !pinnedGeneration;
 				if (param.type === "SecureString") {
 					if (proofBag) contradictProvenPublicExpression(proofBag, fullMatch);
-					if (decrypt) pinSecureVerdict = true;
-					else if (persistedText || !this.tokenAssembledForRecording(fullMatch, tokenLogText, context)) this.pinSecretVerdict(fullMatch, true, verdictScope);
+					if (decrypt) pinSecureVerdict = writesVerdict;
+					else if (writesVerdict && (persistedText || !this.tokenAssembledForRecording(fullMatch, tokenLogText, context))) this.pinSecretVerdict(fullMatch, true, verdictScope);
 				} else if (!param.secure) {
-					this.pinSecretVerdict(fullMatch, false, verdictScope);
+					if (writesVerdict) this.pinSecretVerdict(fullMatch, false, verdictScope);
 					if (proofBag && !this.producerRegionGuest) recordProvenPublicExpression(proofBag, fullMatch, param.value);
 				} else {
 					if (proofBag) contradictProvenPublicExpression(proofBag, fullMatch);
@@ -21398,7 +21766,7 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 				resolved = param.value;
 				resolvedVersion = param.version;
 			} else if (service === "ssm-secure") {
-				const param = await this.resolveSSMReference(parts, true, "ssm-secure", context, nameLogText);
+				const param = await this.resolveSSMReference(parts, true, "ssm-secure", context, nameLogText, pinnedGeneration ? pin : void 0);
 				if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${this.displayMasked(tokenLogText, context)}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
 				isSecret = true;
 				resolved = param.value;
@@ -21420,7 +21788,7 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 				const recorded = context?.recordedSecretValues;
 				if (recorded) {
 					recorded.set(resolved, fullMatch);
-					recordResolvedPair(recorded, fullMatch, resolved);
+					if (!pinnedGeneration) recordResolvedPair(recorded, fullMatch, resolved);
 				}
 				recordProvenanceOfResolution(this, context, fullMatch, resolvedVersion);
 				if (service === "secretsmanager" || service === "ssm-secure") this.pinSecretVerdict(fullMatch, true, verdictScope);
@@ -21459,7 +21827,7 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 
 //#endregion
 //#region src/deployment/intrinsic-resolver/dynamic-ref-lookups.ts
-async function resolveSecretsManagerReference(inner, context, nameLogText, versionOut) {
+async function resolveSecretsManagerReference(inner, context, nameLogText, versionOut, pinVersion) {
 	const afterService = inner.substring(15);
 	let secretId;
 	let jsonKey = "";
@@ -21486,7 +21854,10 @@ async function resolveSecretsManagerReference(inner, context, nameLogText, versi
 		versionStage = remainingParts[1] || "";
 		versionId = remainingParts[2] || "";
 	} else secretId = afterService;
-	if (!versionStage) versionStage = "AWSCURRENT";
+	if (pinVersion !== void 0) {
+		versionStage = "";
+		versionId = pinVersion;
+	} else if (!versionStage) versionStage = "AWSCURRENT";
 	if (!secretId) throw markNonRetryable(/* @__PURE__ */ new Error("Dynamic reference: secretsmanager SECRET_ID is required"));
 	const loggedSecretId = this.displayMasked(nameLogText(secretId), context);
 	const loggedJsonKey = this.displayMasked(nameLogText(jsonKey), context);
@@ -21528,11 +21899,12 @@ async function sendWithThrottleRetry(operation, label, masks) {
 		throw masks.error(error);
 	}
 }
-async function resolveSSMReference(parts, decrypt, service, context, nameLogText) {
-	const parameterName = parts.slice(1).join(":");
+async function resolveSSMReference(parts, decrypt, service, context, nameLogText, pinVersion) {
+	const namedParameter = parts.slice(1).join(":");
+	const parameterName = pinVersion === void 0 ? namedParameter : `${withoutSsmSelector(namedParameter)}:${pinVersion}`;
 	if (!parameterName) throw markNonRetryable(/* @__PURE__ */ new Error(`Dynamic reference: ${service} PARAMETER_NAME is required`));
-	const loggedParameterName = this.displayMasked(nameLogText(parameterName), context);
-	this.logger.debug(`Resolving dynamic reference: ${service}:${loggedParameterName}`);
+	const loggedParameterName = this.displayMasked(nameLogText(namedParameter), context);
+	this.logger.debug(`Resolving dynamic reference: ${service}:${loggedParameterName}${pinVersion === void 0 ? "" : ` (version ${pinVersion})`}`);
 	const client = this.clientsForRegion(this.explicitRegion).ssm;
 	const command = new GetParameterCommand({
 		Name: parameterName,
@@ -21543,8 +21915,8 @@ async function resolveSSMReference(parts, decrypt, service, context, nameLogText
 	if (paramValue === void 0 || paramValue === null) throw markNonRetryable(/* @__PURE__ */ new Error(`Dynamic reference: SSM parameter ${quotedRender(loggedParameterName, "'")} not found or has no value`));
 	const paramType = response.Parameter?.Type;
 	const secure = paramType !== "String" && paramType !== "StringList";
-	if (secure && paramType !== "SecureString" && !this.warnedUnrecognizedSsmTypes.has(injectiveKey(parameterName, String(paramType)))) {
-		this.warnedUnrecognizedSsmTypes.add(injectiveKey(parameterName, String(paramType)));
+	if (secure && paramType !== "SecureString" && !this.warnedUnrecognizedSsmTypes.has(injectiveKey(namedParameter, String(paramType)))) {
+		this.warnedUnrecognizedSsmTypes.add(injectiveKey(namedParameter, String(paramType)));
 		const reported = paramType === void 0 ? "(absent)" : quotedRender(this.displayMasked(String(paramType), context), "'");
 		this.logger.warn(`SSM parameter ${quotedRender(loggedParameterName, "'")} reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:${service}:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`);
 	}
@@ -21556,6 +21928,12 @@ async function resolveSSMReference(parts, decrypt, service, context, nameLogText
 		...typeof paramVersion === "number" && Number.isSafeInteger(paramVersion) && { version: String(paramVersion) }
 	};
 }
+function withoutSsmSelector(parameterName) {
+	const arnName = parameterName.startsWith("arn:") ? parameterName.indexOf(":parameter/") : -1;
+	const nameStart = arnName < 0 ? 0 : arnName + 11;
+	const selector = parameterName.indexOf(":", nameStart);
+	return selector < 0 ? parameterName : parameterName.slice(0, selector);
+}
 
 //#endregion
 //#region src/deployment/intrinsic-resolver/string-functions.ts
@@ -22904,6 +23282,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		}
 		return resolved;
 	}
+	resolverForRecordedRegion(region) {
+		return this.resolverForProducerRegion(region);
+	}
 	resolverForProducerRegion(producerRegion, context, producerRegionLogText) {
 		if (!producerRegion) return this;
 		const target = canonicalizeRegion(producerRegion);
@@ -24428,8 +24809,8 @@ function compare(desired, previous, mask) {
 		if (!Array.isArray(desired) || desired.length !== previous.length) return "differs";
 		return combine(previous.map((item, i) => compare(desired[i], item, mask)));
 	}
-	if (isPlainObject$2(previous)) {
-		if (!isPlainObject$2(desired)) return "differs";
+	if (isPlainObject$1(previous)) {
+		if (!isPlainObject$1(desired)) return "differs";
 		if (!Object.keys(desired).every((k) => Object.prototype.hasOwnProperty.call(previous, k))) return "differs";
 		return combine(Object.keys(previous).map((k) => compare(desired[k], previous[k], mask)));
 	}
@@ -24455,7 +24836,7 @@ function resolvesReference(desired, previous, mask) {
 	const pattern = literals.map(escapeRegExp$1).join("[\\s\\S]*");
 	return new RegExp(`^${pattern}$`).test(desired);
 }
-function isPlainObject$2(value) {
+function isPlainObject$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function escapeRegExp$1(text) {
@@ -25246,7 +25627,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CGN1a3d3.js");
+			const { ASGProvider } = await import("./asg-provider-C6USPLiS.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -25352,7 +25733,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-BO3U39K0.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CR19ID_J.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-DcUEh3d2.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-Ba5va85p.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -30214,170 +30595,6 @@ function deepEqualValue(a, b) {
 	return true;
 }
 
-//#endregion
-//#region src/deployment/reference-provenance-record.ts
-const SSM_VERSION = /^[0-9]{1,10}$/;
-const SECRETS_MANAGER_VERSION = /^[A-Za-z0-9_+=.@/-]{32,64}$/;
-function referenceTokensIn(value, into = /* @__PURE__ */ new Set()) {
-	const walk = (v) => {
-		if (typeof v === "string") {
-			if (!v.includes("{{resolve:")) return;
-			for (const token of dynamicReferenceTokens(v)) into.add(token);
-			return;
-		}
-		if (Array.isArray(v)) {
-			for (const item of v) walk(item);
-			return;
-		}
-		if (v !== null && typeof v === "object") for (const item of Object.values(v)) walk(item);
-	};
-	walk(value);
-	return into;
-}
-function recordReferenceTokens(record) {
-	const tokens = referenceTokensIn(record.properties);
-	referenceTokensIn(record.attributes, tokens);
-	referenceTokensIn(record.observedProperties, tokens);
-	return tokens;
-}
-function versionShapeOf(token) {
-	if (token.startsWith("{{resolve:secretsmanager:")) return SECRETS_MANAGER_VERSION;
-	if (token.startsWith("{{resolve:ssm:") || token.startsWith("{{resolve:ssm-secure:")) return SSM_VERSION;
-}
-function isValidReferenceVersion(token, version) {
-	const shape = versionShapeOf(token);
-	return shape !== void 0 && typeof version === "string" && shape.test(version);
-}
-function validReferenceRegion(region) {
-	if (typeof region !== "string") return void 0;
-	return canonicalizeRegion(region) === region && isClientSafeRegion(region) ? region : void 0;
-}
-function isPlainObject$1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function validateReferenceProvenance(token, raw) {
-	if (!isSingleDynamicReferenceToken(token) || !isPlainObject$1(raw)) return void 0;
-	const versionsRaw = Object.hasOwn(raw, "versions") ? raw["versions"] : void 0;
-	const readRaw = Object.hasOwn(raw, "readVersions") ? raw["readVersions"] : void 0;
-	if (readRaw !== void 0) {
-		if (!Array.isArray(readRaw)) return void 0;
-		const all = Array.isArray(versionsRaw) ? versionsRaw : [];
-		if (!readRaw.every((v) => all.includes(v))) return void 0;
-	}
-	const out = {};
-	const region = validReferenceRegion(Object.hasOwn(raw, "region") ? raw["region"] : void 0);
-	if (region !== void 0) out.region = region;
-	if (Array.isArray(versionsRaw) && versionsRaw.length > 0 && versionsRaw.length <= 8 && versionsRaw.every((v) => isValidReferenceVersion(token, v)) && (readRaw === void 0 || readRaw.every((v) => typeof v === "string"))) {
-		out.versions = [...new Set(versionsRaw)].sort();
-		if (readRaw !== void 0 && readRaw.length > 0) out.readVersions = [...new Set(readRaw)].sort();
-	}
-	return out;
-}
-function referenceProvenanceOf(record) {
-	if (!isPlainObject$1(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
-	return validatedBag(record["referenceProvenance"]);
-}
-function validatedBag(field) {
-	if (!isPlainObject$1(field)) return void 0;
-	const out = Object.create(null);
-	for (const [token, raw] of Object.entries(field)) {
-		const entry = validateReferenceProvenance(token, raw);
-		if (entry !== void 0) out[token] = entry;
-	}
-	return { ...out };
-}
-function hasReferenceProvenanceField(record) {
-	return isPlainObject$1(record) && Object.hasOwn(record, "referenceProvenance") && record["referenceProvenance"] !== void 0;
-}
-function outputReferenceProvenanceOf(state, outputKey) {
-	if (!isPlainObject$1(state) || !Object.hasOwn(state, "outputReferenceProvenance")) return;
-	const field = state["outputReferenceProvenance"];
-	if (!isPlainObject$1(field) || !Object.hasOwn(field, outputKey)) return void 0;
-	return validatedBag(field[outputKey]);
-}
-function persistable(token, entry) {
-	return (entry === void 0 ? void 0 : validateReferenceProvenance(token, entry)) ?? {};
-}
-function tokensUnderPaths(properties, paths) {
-	const out = /* @__PURE__ */ new Set();
-	const descend = (value, path, at) => {
-		if (at === path.length) {
-			referenceTokensIn(value, out);
-			return;
-		}
-		if (Array.isArray(value)) {
-			const next = path[at] === "*" ? at + 1 : at;
-			for (const item of value) descend(item, path, next);
-			return;
-		}
-		if (isPlainObject$1(value) && Object.hasOwn(value, path[at])) descend(value[path[at]], path, at + 1);
-	};
-	for (const path of paths) descend(properties, path, 0);
-	return out;
-}
-function provenanceForWrittenRecord(args) {
-	const { record, secrets, previous, inPlace } = args;
-	const previousField = inPlace === void 0 ? void 0 : referenceProvenanceOf(previous);
-	if (!hasPassProvenance(secrets) && previousField === void 0 && args.walkWithoutPassProvenance !== true) return;
-	const tokens = recordReferenceTokens(record);
-	if (tokens.size === 0) return void 0;
-	let kept;
-	if (inPlace !== void 0) {
-		kept = inPlace.createOnly === "all" ? tokens : tokensUnderPaths(record.properties, inPlace.createOnly);
-		if (inPlace.attributesCarried) referenceTokensIn(record.attributes, kept);
-	}
-	const out = {};
-	for (const token of [...tokens].sort()) {
-		const pass = passProvenanceFor(secrets, token);
-		if (kept === void 0 || !kept.has(token)) {
-			out[token] = persistable(token, pass);
-			continue;
-		}
-		const before = previousField !== void 0 && Object.hasOwn(previousField, token) ? previousField[token] : void 0;
-		if (pass === void 0) {
-			out[token] = before === void 0 ? {} : { ...before };
-			continue;
-		}
-		out[token] = persistable(token, unionWithPrevious(pass, before));
-	}
-	return out;
-}
-function unionWithPrevious(pass, before) {
-	const out = {};
-	if (pass.region !== void 0 && (before?.region === void 0 || before.region === pass.region)) out.region = pass.region;
-	if (pass.versions !== void 0 && before?.versions !== void 0) {
-		out.versions = [.../* @__PURE__ */ new Set([...before.versions, ...pass.versions])].sort();
-		if (pass.readVersions !== void 0) out.readVersions = [...pass.readVersions];
-	}
-	return out;
-}
-function outputProvenanceForPersist(args) {
-	const { outputs, resolvedThisRun, carriedFrom, sinkOf } = args;
-	if (!resolvedThisRun) return carriedFrom !== void 0 && isPlainObject$1(carriedFrom.outputReferenceProvenance) ? carriedFrom.outputReferenceProvenance : void 0;
-	let out;
-	for (const [outputKey, value] of Object.entries(outputs)) {
-		const sink = sinkOf(outputKey);
-		if (!hasPassProvenance(sink)) continue;
-		const tokens = referenceTokensIn(value);
-		if (tokens.size === 0) continue;
-		const entries = {};
-		for (const token of [...tokens].sort()) entries[token] = persistable(token, passProvenanceFor(sink, token));
-		out ??= Object.create(null);
-		out[outputKey] = entries;
-	}
-	return out === void 0 ? void 0 : { ...out };
-}
-const KEEP_REFERENCE_PROVENANCE = Symbol("keep reference provenance");
-function withReferenceProvenance(record, field) {
-	if (field === KEEP_REFERENCE_PROVENANCE) return record;
-	if (field === void 0 && !Object.hasOwn(record, "referenceProvenance")) return record;
-	const { referenceProvenance: _previous, ...rest } = record;
-	return field === void 0 ? rest : {
-		...rest,
-		referenceProvenance: field
-	};
-}
-
 //#endregion
 //#region src/deployment/deploy-engine/provenance-capture.ts
 function kickOffProvenanceCapture(args) {
@@ -32565,15 +32782,19 @@ var ReplayResolvers = class {
 		this.pinned.set(target, scoped);
 		return scoped;
 	}
+	forRecordedRegion(region) {
+		return this.primary.resolverForRecordedRegion(region);
+	}
 };
 function regionAmbiguousReplaySecretError(logicalId, propertyPath, secretName, foreignProducerRegions, consumerRegion, execCtx) {
 	const where = propertyPath === "" ? "" : ` property ${quotedPlainOr(propertyPath, "property path")}`;
 	const error = new CdkdError(`Rollback of ${shownLogicalId(logicalId)}${where} cannot re-resolve the secret reference ${quotedPlainOr(secretName, "secret name")}: the reference carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.map((r) => plainOrDescribed(r, "region")).join(", ")}), so it may have been resolved in one of those rather than in ${quotedOrDescribed(consumerRegion, "region")}. A secret of the same name in two regions is two independent values, so replaying this would write the WRONG secret to a live resource. Refusing instead. Resolve the reference in its own region and set the property directly (or spell it as a full ARN, which names its region and is resolved there), then re-run ${rerunRollbackPhrase(execCtx, "'cdkd rollback'")}.`, "ROLLBACK_SECRET_REGION_AMBIGUOUS");
 	return markNonRetryable(error);
 }
-function refuseUnprovenReplaySecret(leaf, propertyPath, logicalId, execCtx) {
+function refuseUnprovenReplaySecret(leaf, propertyPath, logicalId, execCtx, recordedRegions) {
 	if (execCtx.producerRegionsIncomplete !== true) return;
 	for (const token of dynamicReferenceTokens(leaf)) {
+		if (recordedRegions?.has(token) === true) continue;
 		const name = classifyReplaySecretRegion(token, execCtx.region, execCtx.importedProducerRegions).kind === "local" ? regionLessSecretName(token) : void 0;
 		if (name !== void 0) throw regionUnknownReplaySecretError(logicalId, propertyPath, name, execCtx.region, execCtx);
 	}
@@ -32582,17 +32803,17 @@ function regionUnknownReplaySecretError(logicalId, propertyPath, secretName, con
 	const where = propertyPath === "" ? "" : ` property ${quotedPlainOr(propertyPath, "property path")}`;
 	return new CdkdError(`Rollback of ${shownLogicalId(logicalId)}${where} cannot re-resolve the secret reference ${quotedPlainOr(secretName, "secret name")}: the reference carries no region of its own, and this is a nested stack, and the cross-region reads its parent made are not known to this replay, so the parent may have resolved it in another region than ${quotedOrDescribed(consumerRegion, "region")}. A secret of the same name in two regions is two independent values, so replaying this could write the WRONG secret to a live resource. Refusing instead. Where the journal of the top-level stack still holds this run, roll back the top-level stack instead, which supplies its regions. Otherwise resolve the reference in its own region and set the property directly (or spell it as a full ARN, which names its region and is resolved there), then re-run ${rerunRollbackPhrase(execCtx, "'cdkd rollback'")}.`, "ROLLBACK_SECRET_REGION_AMBIGUOUS");
 }
-async function resolveLeafByRegion(leaf, propertyPath, logicalId, execCtx, resolvers, resolverContext) {
-	const verdicts = dynamicReferenceTokens(leaf).map((token) => [token, classifyReplaySecretRegion(token, execCtx.region, execCtx.importedProducerRegions)]);
+async function resolveLeafByRegion(leaf, propertyPath, logicalId, execCtx, resolvers, resolverContext, recordedRegions) {
+	const verdicts = dynamicReferenceTokens(leaf).map((token) => [token, classifyRecordedSecretRegion(token, execCtx.region, execCtx.importedProducerRegions, recordedRegions)]);
 	for (const [, verdict] of verdicts) if (verdict.kind === "ambiguous") throw regionAmbiguousReplaySecretError(logicalId, propertyPath, verdict.secretName, verdict.foreignProducerRegions, execCtx.region, execCtx);
-	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region")) return await resolvers.primary.resolveDynamicReferences(leaf, resolverContext);
+	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region" || verdict.kind === "recorded-region")) return await resolvers.primary.resolveDynamicReferences(leaf, resolverContext);
 	let out = "";
 	let cursor = 0;
 	for (const [token, verdict] of verdicts) {
 		const at = leaf.indexOf(token, cursor);
 		if (at < 0) throw new CdkdError(`Rollback of ${logicalId}${propertyPath === "" ? "" : ` property '${propertyPath}'`} could not locate a scanned dynamic reference in the value it was scanned from. Refusing rather than resolving it in '${execCtx.region}', which would be the wrong region for a reference that names another one. This is an internal invariant failure — please report it with the resource type and property path.`, "ROLLBACK_SECRET_TOKEN_SCAN_MISMATCH");
 		out += leaf.slice(cursor, at);
-		const resolver = verdict.kind === "named-region" ? resolvers.forRegion(verdict.region) : resolvers.primary;
+		const resolver = verdict.kind === "named-region" ? resolvers.forRegion(verdict.region) : verdict.kind === "recorded-region" ? resolvers.forRecordedRegion(verdict.region) : resolvers.primary;
 		out += await resolver.resolveDynamicReferences(token, resolverContext);
 		cursor = at + token.length;
 	}
@@ -33327,8 +33548,9 @@ function maskRestoredNoEchoRecord(record, baseline, substituted = []) {
 
 //#endregion
 //#region src/deployment/rollback-executor/replay-props.ts
-async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId) {
+async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId, record) {
 	if (props === void 0) return void 0;
+	const recordedRegions = recordedReferenceRegions(record);
 	const resolverContext = {
 		template: { Resources: {} },
 		resources: {},
@@ -33337,8 +33559,8 @@ async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId)
 	const walk = async (v, path) => {
 		if (typeof v === "string") {
 			if (!v.includes("{{resolve:")) return v;
-			refuseUnprovenReplaySecret(v, path, logicalId, execCtx);
-			return await resolveLeafByRegion(v, path, logicalId, execCtx, resolvers, resolverContext);
+			refuseUnprovenReplaySecret(v, path, logicalId, execCtx, recordedRegions);
+			return await resolveLeafByRegion(v, path, logicalId, execCtx, resolvers, resolverContext, recordedRegions);
 		}
 		if (Array.isArray(v)) {
 			const out = new Array(v.length);
@@ -33651,7 +33873,7 @@ async function replayRevert(s) {
 		provisionedBy: op.provisionedBy
 	});
 	const noEcho = await substituteMarkedNoEchoLeaves({
-		desired: await resolveReplayProps(previousState.properties, resolver, secrets, ctx, op.logicalId),
+		desired: await resolveReplayProps(previousState.properties, resolver, secrets, ctx, op.logicalId, previousState),
 		baseline: previousState,
 		live: current,
 		logicalId: op.logicalId,
@@ -33663,7 +33885,7 @@ async function replayRevert(s) {
 	const desiredProps = noEcho.desired;
 	refuseMaskedReplayBaseline(desiredProps, op.logicalId, noEcho.inert);
 	logger.info(`  Rollback: Restoring ${safe(op.logicalId)} (${safe(op.resourceType)}) to previous state`);
-	const currentProps = noEcho.onPreviousSide(await resolveReplayProps(current.properties, resolver, secrets, ctx, op.logicalId));
+	const currentProps = noEcho.onPreviousSide(await resolveReplayProps(current.properties, resolver, secrets, ctx, op.logicalId, current));
 	recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, previousState.properties, STATE_DERIVED_RULES);
 	opMasker.addNamed({
 		resourceType: op.resourceType,
@@ -33739,7 +33961,7 @@ async function replayReverseReplacement(s) {
 		skipUnaddressableReplay(s, logger, op, "reverse the replacement of");
 		return;
 	}
-	const resolvedPrevProps = await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId) ?? {};
+	const resolvedPrevProps = await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId, prev) ?? {};
 	refuseMarkedNoEchoRecreate(resolvedPrevProps, noEchoLeavesOf(prev), op.logicalId);
 	refuseMaskedReplayBaseline(resolvedPrevProps, op.logicalId);
 	opMasker.addNamed({
@@ -34421,7 +34643,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						provisionedBy: op.provisionedBy ?? current.provisionedBy
 					});
 					const noEcho = await substituteMarkedNoEchoLeaves({
-						desired: await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId),
+						desired: await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId, prev),
 						baseline: prev,
 						live: current,
 						logicalId: op.logicalId,
@@ -34432,7 +34654,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 					});
 					const desiredProps = noEcho.desired;
 					refuseMaskedReplayBaseline(desiredProps, op.logicalId, noEcho.inert);
-					const attemptedProps = noEcho.onPreviousSide(await resolveReplayProps(op.attemptedProperties ?? current.properties, resolver, secrets, ctx, op.logicalId));
+					const attemptedProps = noEcho.onPreviousSide(await resolveReplayProps(op.attemptedProperties ?? current.properties, resolver, secrets, ctx, op.logicalId, op.attemptedProperties === void 0 ? current : void 0));
 					recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, prev.properties, STATE_DERIVED_RULES);
 					opMasker.addNamed({
 						resourceType: op.resourceType,
@@ -46158,5 +46380,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { isTruthyCfnBoolean as $, MULTI_REGION_RECREATE_BLOCKED_TYPES as $a, resolveStateBucketWithDefault as $c, malformedOrphanRowsKeptWarning as $i, earliestDefined as $n, maskSecretsInText as $o, isIamRoleArn as $r, orphansAfterRollback as $s, seedsDeleteFirstGuard as $t, noEchoComparisonForTemplate as A, refuseMalformedResourcePropertiesForOrphan as Aa, isDockerClientEnvKey as Ac, passedParameterClassesOf as Ai, injectedAwsRegionValue as Al, journaledOrphanPrintingBag as An, maskReadbackAtCoordinates as Ao, UNSPECIFIED_SKIP_REASON as Ar, TEMPLATE_SOURCED_RULES as As, dropFailedHint as At, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as B, repairMalformedResourcesForReadOnly as Ba, stripControlChars as Bc, hasReadableOrphans as Bi, PRE_DELETE_SNAPSHOT_TYPES as Bn, liveMatchesUnresolvedTokenFrame as Bo, observeThenDisableInstanceApiTermination as Br, crossPrefixDeniedWarning as Bs, getStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedResourceEntriesForDestroy as Ca, describeDockerCapturedOutput as Cc, AWS_NO_VALUE as Ci, ownValue as Cl, collectDeclaredOutputNames as Cn, lambdaFunctionNameForMask as Co, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Cr, recordNoEchoAttributeValues as Cs, revertNestedChildFromJournal as Ct, withResourceDeadline as D, refuseMalformedResourcePropertiesForDestroy as Da, finchSecretArgvRefusal as Dc, parseWebACLArn as Di, renderAssemblyPathEscape as Dl, DEFAULT_RESOURCE_TIMEOUT_MS as Dn, canonicalCoordinates as Do, slowCcOperationTimeoutMs as Dr, STATE_SOURCED_BASELINE_RULES as Ds, getCurrentNestedStackContext as Dt, serviceTokenBlockingReason as E, refuseMalformedResourceEntriesForOrphan as Ea, dockerSpawnEnvWithSensitive as Ec, refStateLookupFromResource as Ei, displayAssemblyPath as El, bindingSkippedOutputs as En, TemplateParser as Eo, CloudControlProvider as Er, wholeStringLeavesOf as Es, collectNestedChildUnaddressed as Et, PROTECTION_PROPERTY_BY_TYPE as F, repairMalformedOrphanRecordsForReadOnly as Fa, redactedDockerCause as Fc, UNREADABLE_ORPHANS_CONTAINER_ROW as Fi, secretNamedRecordNeedles as Fn, noEchoOutputsComparison as Fo, isWaitAbandonedError as Fr, S3StateBackend as Fs, sameJournaledOrphans as Ft, resolveDynamoDbDeleteBudgetMs as G, findActionableSilentDrops as Ga, synthesisStatusMessage as Gc, malformedDriftResourcePropertiesWarning as Gi, isFinalSnapshotError as Gn, logOnlyValueCount as Go, IntrinsicFunctionResolver as Gr, describeRegionValueKind as Gs, isJournaledOrphan as Gt, compensateRemovedDeletionProtection as H, unreadableOrphanRecords as Ha, AssetManifestLoader as Hc, hasReadableResources as Hi, ccRoutedFinalSnapshotError as Hn, createUnionSecretMasker as Ho, reEnableInstanceApiTermination as Hr, isNotImplemented as Hs, removeProtectionTypeList as Ht, isProtectionValueActive as I, repairMalformedOrphansForReadOnly as Ia, runDockerForeground as Ic, UNREADABLE_RESOURCES_MAP_ROW as Ii, stateSecretNameNeedles as In, passedNoEchoParametersOf as Io, markWaitAbandoned as Ir, rebuildClientForBucketRegion as Is, replayFailedOperations as It, deleteTableWithIndexBusyRetry as J, withoutSilentDropProperties as Ja, loadCdkJson as Jc, malformedLocalOutputsWarning as Ji, maskingRetryLogger as Jn, recordLogOnlyValue as Jo, refuseUnreadableCdkCrossAccountRefs as Jr, hasReasonlessBaselineRefusal as Js, planRollback as Jt, DELETE_INDEX_WAIT_PROCEED_NOTE as K, findSilentDropProperties as Ka, getDefaultStateBucketName as Kc, malformedExportNamesWarning as Ki, refusesFinalSnapshot as Kn, printingCorpusOf as Ko, poisonRenderedSpellingsCollidingIn as Kr, exportNamesCarriedFrom as Ks, isReplacementOrphan as Kt, perType as L, repairMalformedOutputsForReadOnly as La, runDockerStreaming as Lc, accountArgs as Li, storedSecretNameNeedles as Ln, readbackPathFor as Lo, disableInstanceApiTermination as Lr, CrossPrefixReadError as Ls, replayRollback as Lt, noEchoParameterNamesOf as M, refuseMalformedResourcesForDestroy as Ma, partitionSensitiveEnv as Mc, JSON_LISTING_HOLE_VALUE as Mi, resolveBucketRegion as Ml, orphanRecordsPrintingBag as Mn, maskedLeafCoordinatesOf as Mo, deleteLeftInPlace as Mr, isSingleDynamicReferenceToken as Ms, journaledOrphanLines as Mt, recordedProtectionEvidence as N, refuseMalformedResourcesForExport as Na, redactDockerArgvValues as Nc, STATE_REGION_DIVERGED as Ni, secretNamePrintingBag as Nn, noEchoCoordinatesOf as No, deleteSkipReason as Nr, LockManager as Ns, loadJournaledOrphans as Nt, diffSecurity as O, refuseMalformedResourcePropertiesForDrift as Oa, formatDockerLoginError as Oc, withSharedDrainBudget as Oi, resolveAssemblyPath as Ol, DEFAULT_RESOURCE_WARN_AFTER_MS as On, isMarkedCoordinate as Oo, unchangedBehindSecretReference as Or, STATE_SOURCED_CROSS_GENERATION_RULES as Os, withNestedStackContext as Ot, recordedProtectionNote as P, refuseMalformedState as Pa, redactedCause as Pc, STATE_RESOURCES_MALFORMED as Pi, secretNamePrintingBags as Pn, noEchoLeavesOf as Po, withIndeterminateGuard as Pr, isLockInfoExpired as Ps, makeForeignHolderScan as Pt, hasCdkAutoDeleteTag as Q, shownType as Qa, resolveSkipPrefix as Qc, malformedOrphanRecordsWarning as Qi, outputReferenceProvenanceOf as Qn, maskSecretsInError as Qo, explicitRoleArnOrThrow as Qr, isReadableBag as Qs, resolveReplacementOldType as Qt, readProtection as R, repairMalformedResourceEntriesForReadOnly as Ra, warnFinchArgvExposure as Rc, deployRefusesOrphanRowsReason as Ri, extractDeploymentEventError as Rn, readsNoEchoSource as Ro, ec2InstanceProtectionSite as Rr, CrossPrefixScanCache as Rs, awaitInFlightSibling as Rt, keptForReadoption as S, refuseMalformedResourceEntriesForDeploy as Sa, resolveDockerContextDirectory as Sc, keepsSecretReferenceToken as Si, nullPrototypeRecord as Sl, noEchoParameterValueSeed as Sn, canonicalLambdaFunctionName as So, withPrintingSecrets as Sr, recordMaskOnlyValuesIn as Ss, recordDisplacedSkips as St, findServiceTokenRefusals as T, refuseMalformedResourceEntriesForImportSave as Ta, describeDockerFailure as Tc, isStalePlaceholderArnAttribute as Ti, describeFileReadFailure as Tl, isExportAliasCollision as Tn, DagBuilder as To, customResourceResponseExpirationWarning as Tr, recordProvenPublicExpression as Ts, withNestedRevertRun as Tt, deleteBudgetKey as U, unreadableResourceEntries as Ua, getDockerImageBySourceHash as Uc, isReadableOrphanRecord as Ui, createPreDeleteFinalSnapshot as Un, hasMaskableValues as Uo, DiffCalculator as Ur, splitImportedOps as Us, recordAfterRollbackUpdate as Ut, beginDeleteWait as V, unpreviewableOrphanRecords as Va, stripForDisplay as Vc, hasReadableOutputs as Vi, buildFinalSnapshotIdentifier as Vn, carryLogOnlyValues as Vo, reDisableInstanceApiTermination as Vr, isAccessDenied$1 as Vs, withStackRecords as Vt, resolveDynamoDbDeleteBudgetClock as W, withheldAccountClause as Wa, Synthesizer as Wc, isReadableResourceEntry as Wi, effectiveDeletionPolicy as Wn, literalSplitDelimitersOf as Wo, INTRINSIC_KEYS as Wr, acceptedCreateOnlyDropsOf as Ws, demoteSupersededOrphans as Wt, ECR_AUTO_DELETE_IMAGES_TAG as X, hasNoCloudControlHandlers as Xa, resolveAutoAssetStorage as Xc, malformedLocalResourcesWarning as Xi, findDestructiveChanges as Xn, createSecretMasker as Xo, assertFlagRoleArn as Xr, importableOutputKeys as Xs, recordUnderIdIsNotOwn as Xt, waitForIndexesSettled as Y, NO_CC_HANDLERS_REASON as Ya, resolveApp as Yc, malformedLocalResourceEntriesWarning as Yi, constructPathOf as Yn, shareLogOnlyValues as Yo, applyRoleArnIfSet as Yr, hasUnverifiableParameterRefusal as Ys, recheckFailedPlan as Yt, S3_AUTO_DELETE_OBJECTS_TAG as Z, findReplacedReadersOfRecreateTargets as Za, resolveCaptureObservedState as Zc, malformedOrphanRecordsRefusalMessage as Zi, formatDestructiveChange as Zn, errorCauseChain as Zo, assertSendableRoleArn as Zr, importableOutputs as Zs, replacementNeverSwapped as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedOrphansForOrphan as _a, readBootstrapMarkerBody as _c, getAccountInfo as _i, StageLoadError as _l, secretSafeKeyDisplay as _n, requireConfigString as _o, wouldReturnToSdkProvider as _r, recordPhysicalNameCopy as _s, displacedOpClause as _t, findNestedTemplateTreeDefect as a, malformedResourceEntriesWarning as aa, WorkGraph as ac, isSettledInstanceState as ai, CFN_TEMPLATE_BODY_LIMIT as al, isRedactedRecordedValue as an, isWarmThroughputDecrease as ao, DBPROXY_TAG_OPTIONS as ar, withPhysicalNameCopies as as, cyan as at, lookupEachName as b, refuseMalformedResourceAttributesForOrphan as ba, buildDenyExternalAccessPolicy as bc, carriesFetchableDynamicReference as bi, hasOwnKey as bl, exportNameSecretExposure as bn, describeTypeWithThrottleRetry as bo, isCustomResourceType as br, provenPublicValue as bs, getNestedRevertRun as bt, renderNestedTemplateTreeDefect as c, malformedScrubResourceEntriesRefusalMessage as ca, loadPublishableAssetManifest as cc, s3BucketDualStackDomainName as ci, findLargeInlineResources as cl, updatePartialMessage as cn, coerceCfnBoolean as co, refuseMalformedDesiredTags as cr, dynamicReferenceTokens as cs, red as ct, conditionInputsFrom as d, refuseDivergentRecordRegionForDestroy as da, BOOTSTRAP_MARKER_PREFIX as dc, classifyReplaySecretRegion as di, decodeListingKey as dl, DeploymentEventsStore as dn, configIntegerRefusal as do, definedAttributes as dr, identityKeyFor as ds, namesAnyDeclaredParameter as dt, malformedOrphansRefusalMessage as ea, orphansCarriedFrom as ec, sendableAssumeRoleCommand as ei, resolveStateBucketWithDefaultAndSource as el, orphanDeleteNeedsIdentity as en, isStatefulRecreateTargetForReplace as eo, ledgerForStack as er, markSameGenerationBag as es, getPriorAttempts as et, parentSuppliedValues as f, refuseMalformedNestedChildOutputs as fa, assertAssetBucketRegion as fc, producerRegionsFromState as fi, expectedOwnerParam as fl, WITHHELD_NAME_DISPLAY as fn, configStringRefusal as fo, stringifyIfAssigned as fr, inheritNestedStackParameterAssociations as fs, reachableDivergentParameters as ft, mergeNoChangeOutputs as g, refuseMalformedOrphansForDestroy as ga, parseBootstrapMarker as gc, parameterTypeMayLoseSecretIdentity as gi, AssemblyReader as gl, secretBearingStateKeyWarning as gn, requireConfigObject as go, isCustomResource as gr, recordAttributeIdCopy as gs, NESTED_PENDING_PARENT_REASON as gt, keptWholeReasonText as h, refuseMalformedOrphans as ha, isCrossRegionRedirect as hc, isUnboundTemplateParameter as hi, derivePartitionAndUrlSuffix as hl, secretBearing as hn, requireConfigArray as ho, ccBrokenReason as hr, physicalNameCopiesOf as hs, planOrphanAdoption as ht, childTemplateLoader as i, malformedRenderedContainersWarning as ia, stringifyValue as ic, envCredentialsAreAssumedRole as ii, ssmResolvedValueType as il, REDACTED_DELETE_ADDRESS_SKIP_REASON as in, coerceWarmThroughput as io, DBPROXY_TAGS_WHAT as ir, scrubResourceRecord as is, bold as it, noEchoExactEchoLeavesOf as j, refuseMalformedResourcesForDeploy as ja, isMalformedEnvKey as jc, declaresNoEcho as ji, clearBucketRegionCache as jl, maskEventTextWithBoundBags as jn, maskWholeValue as jo, deleteIndeterminateGuards as jr, WHOLE_DYNAMIC_REFERENCE_PATTERN as js, isHandledOrphan as jt, noEchoAttributeNamesOf as k, refuseMalformedResourcePropertiesForExport as ka, getDockerCmd as kc, parameterInputsFor as ki, injectAwsRegion as kl, completedReplayEntries as kn, maskAtCoordinates as ko, RollbackInlinePolicyWriters as kr, STATE_SOURCED_READBACK_RULES as ks, deleteJournaledOrphans as kt, templateIdentity as l, malformedStateRefusalMessage as la, rewriteTemplateAssetReferences as lc, s3BucketRegionalDomainName as li, uploadCfnTemplate as ll, updatePartialReason as ln, coerceCfnInteger as lo, tagMapAsList as lr, isUncertifiedBaselineMaskPosition as ls, yellow as lt, isSecretBearingReferenceString as m, refuseMalformedOrphanRecordsForDestroy as ma, getBootstrapMarkerKey as mc, coerceParameterTypedValue as mi, canonicalizeRegion as ml, exportAliasCollisionScrubWarning as mn, replayWarn as mo, ProviderRegistry as mr, recoverMaskedOutput as ms, makeSiblingClaimReader as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedOutputsRefusalMessage as na, AssetPublisher as nc, applyCallerIdentityCredentials as ni, stateBucketExistenceConfirmed as nl, getCurrentProducerRegions as nn, renderStatefulReason as no, withCreateTokenLedger as nr, snapshotPassProvenance as ns, formatResourceLine as nt, isAbsoluteAssetPath as o, malformedResourcePropertiesWarning as oa, buildAssetRedirectMap as oc, s3BucketArn as oi, CFN_TEMPLATE_URL_LIMIT as ol, redactedDeleteAddressFields as on, toCfnInteger as oo, planTagDiff as or, withoutPhysicalNameCopies as os, gray as ot, readRecordedConditionVerdicts as p, refuseMalformedOrphanRecords as pa, ensureAssetStorage as pc, regionLessSecretName as pi, PARTITION_TABLE as pl, displayTextOrWithheld as pn, readConfigString as po, CC_BROKEN_REASON as pr, recordNestedStackParameterExpressions as ps, resourcesNamingDeclaredParameter as pt, INDEX_SETTLE_POLL_INTERVAL_MS as q, unwrittenCreateOnlyReplacement as qa, getLegacyStateBucketName as qc, malformedExportSourceWarning as qi, unsupportedFinalSnapshotError as qn, recordLogOnlyParameterValue as qo, producerLookupOver as qr, hasReadableExportSet as qs, planFailedOps as qt, computeImplicitDeleteEdges as r, malformedOutputsWarning as ra, isSensitiveAttributeName as rc, callerEnvCredentials as ri, warnDeprecatedNoPrefixCliFlag as rl, inheritProducerRegions as rn, WARM_THROUGHPUT_MEMBERS as ro, acquireIdempotencyToken as rr, redactSecretsForState as rs, createReadOnlyAttributeHealerFactory as rt, listNestedTemplateRows as s, malformedResourcesWarning as sa, createAssetRedirectResolver as sc, s3BucketDomainName as si, MIGRATE_TMP_PREFIX as sl, redactedDeleteAddressSkip as sn, toFiniteNumber as so, readTagList as sr, DYNAMIC_REFERENCE_TOKEN_SCAN as ss, green as st, DeployEngine as t, malformedOrphansWarning as ta, shouldRetainResource as tc, AWS_CREDENTIAL_ENV_KEYS as ti, resolveUseCdkBootstrapAssets as tl, findNestedStackTypeChanges as tn, isStatefulRecreateTargetSync as to, reserveStackCreateToken as tr, recordReferenceProvenanceEntry as ts, markRefusedBeforeApplying as tt, conditionFingerprint as u, previewableOrphanRecords as ua, AssetModeResolver as uc, s3BucketWebsiteUrl as ui, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ul, DeploymentEventsReader as un, configBooleanRefusal as uo, tagPlanWarning as ur, pathCrossesDottedKey as us, computeParameterTaint as ut, chunks as v, refuseMalformedOutputs as va, validateAssetBucketName as vc, isImpossibleEmptyStoredAttribute as vi, processStackMessages as vl, carriedExportAliasExposure as vn, prefetchCreateOnlyPropertyPaths as vo, TemplateNoEchoReresolver as vr, splitGetAttStringForm as vs, displacedPhysicalIdShown as vt, deferredServiceTokenWarning as w, refuseMalformedResourceEntriesForImport as wa, describeDockerExecFailure as wc, cfnRefValueFromPhysicalId as wi, absoluteAssemblyPathEscape as wl, collectPublishedOutputNames as wn, sameLambdaFunctionAddress as wo, applyCustomResourceResponseExpiration as wr, recordNoEchoParameterFreshValue as ws, revertedNestedRowIds as wt, withApiLimit as x, refuseMalformedResourceEntries as xa, buildDockerImage as xc, isNamelessDynamicReferenceError as xi, hasPlainPrototype$1 as xl, isWholeDynamicReferenceValue as xn, withRetry as xo, getCurrentResourceSecrets as xr, recordMaskOnlyValue as xs, nestedChildStackName as xt, isAccessDeniedError as y, refuseMalformedOutputsForDestroy as ya, validateContainerRepoName as yc, carriesDynamicReference as yi, defineOwnKey as yl, exportNameNoEchoParameters as yn, templateResourceTypes as yo, readsNoEchoDeleteValues as yr, carriesSecretMask as ys, dropSettledNestedJournals as yt, DynamoDBGlobalTableProvider as z, repairMalformedResourcePropertiesForReadOnly as za, escapeRegExp$3 as zc, displayLogicalId as zi, ATOMIC_FINAL_SNAPSHOT_TYPES as zn, valueAtCoordinate as zo, isTerminationProtectionPropagationError as zr, applyCrossPrefixScan as zs, destroyStackRecordsView as zt };
-//# sourceMappingURL=deploy-engine-4K_B3N08.js.map
+export { isTruthyCfnBoolean as $, NO_CC_HANDLERS_REASON as $a, resolveApp as $c, malformedLocalResourceEntriesWarning as $i, ledgerForStack as $n, shareLogOnlyValues as $o, sendableAssumeRoleCommand as $r, hasUnverifiableParameterRefusal as $s, seedsDeleteFirstGuard as $t, noEchoComparisonForTemplate as A, refuseMalformedResourceEntriesForOrphan as Aa, dockerSpawnEnvWithSensitive as Ac, refStateLookupFromResource as Ai, displayAssemblyPath as Al, journaledOrphanPrintingBag as An, TemplateParser as Ao, deleteIndeterminateGuards as Ar, wholeStringLeavesOf as As, dropFailedHint as At, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as B, repairMalformedOrphansForReadOnly as Ba, runDockerForeground as Bc, UNREADABLE_RESOURCES_MAP_ROW as Bi, PRE_DELETE_SNAPSHOT_TYPES as Bn, passedNoEchoParametersOf as Bo, reDisableInstanceApiTermination as Br, rebuildClientForBucketRegion as Bs, getStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedOutputsForDestroy as Ca, validateContainerRepoName as Cc, carriesDynamicReference as Ci, defineOwnKey as Cl, collectDeclaredOutputNames as Cn, templateResourceTypes as Co, applyCustomResourceResponseExpiration as Cr, carriesSecretMask as Cs, revertNestedChildFromJournal as Ct, withResourceDeadline as D, refuseMalformedResourceEntriesForDestroy as Da, describeDockerCapturedOutput as Dc, AWS_NO_VALUE as Di, ownValue as Dl, DEFAULT_RESOURCE_TIMEOUT_MS as Dn, lambdaFunctionNameForMask as Do, unchangedBehindSecretReference as Dr, recordNoEchoAttributeValues as Ds, getCurrentNestedStackContext as Dt, serviceTokenBlockingReason as E, refuseMalformedResourceEntriesForDeploy as Ea, resolveDockerContextDirectory as Ec, keepsSecretReferenceToken as Ei, nullPrototypeRecord as El, bindingSkippedOutputs as En, canonicalLambdaFunctionName as Eo, slowCcOperationTimeoutMs as Er, recordMaskOnlyValuesIn as Es, collectNestedChildUnaddressed as Et, PROTECTION_PROPERTY_BY_TYPE as F, refuseMalformedResourcesForDeploy as Fa, isMalformedEnvKey as Fc, declaresNoEcho as Fi, clearBucketRegionCache as Fl, secretNamedRecordNeedles as Fn, maskWholeValue as Fo, markWaitAbandoned as Fr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Fs, sameJournaledOrphans as Ft, resolveDynamoDbDeleteBudgetMs as G, unpreviewableOrphanRecords as Ga, stripForDisplay as Gc, hasReadableOutputs as Gi, isFinalSnapshotError as Gn, carryLogOnlyValues as Go, poisonRenderedSpellingsCollidingIn as Gr, isAccessDenied$1 as Gs, isJournaledOrphan as Gt, compensateRemovedDeletionProtection as H, repairMalformedResourceEntriesForReadOnly as Ha, warnFinchArgvExposure as Hc, deployRefusesOrphanRowsReason as Hi, ccRoutedFinalSnapshotError as Hn, readsNoEchoSource as Ho, DiffCalculator as Hr, CrossPrefixScanCache as Hs, removeProtectionTypeList as Ht, isProtectionValueActive as I, refuseMalformedResourcesForDestroy as Ia, partitionSensitiveEnv as Ic, JSON_LISTING_HOLE_VALUE as Ii, resolveBucketRegion as Il, stateSecretNameNeedles as In, maskedLeafCoordinatesOf as Io, disableInstanceApiTermination as Ir, isSingleDynamicReferenceToken as Is, replayFailedOperations as It, deleteTableWithIndexBusyRetry as J, withheldAccountClause as Ja, Synthesizer as Jc, isReadableResourceEntry as Ji, maskingRetryLogger as Jn, literalSplitDelimitersOf as Jo, applyRoleArnIfSet as Jr, acceptedCreateOnlyDropsOf as Js, planRollback as Jt, DELETE_INDEX_WAIT_PROCEED_NOTE as K, unreadableOrphanRecords as Ka, AssetManifestLoader as Kc, hasReadableResources as Ki, refusesFinalSnapshot as Kn, createUnionSecretMasker as Ko, producerLookupOver as Kr, isNotImplemented as Ks, isReplacementOrphan as Kt, perType as L, refuseMalformedResourcesForExport as La, redactDockerArgvValues as Lc, STATE_REGION_DIVERGED as Li, storedSecretNameNeedles as Ln, noEchoCoordinatesOf as Lo, ec2InstanceProtectionSite as Lr, LockManager as Ls, replayRollback as Lt, noEchoParameterNamesOf as M, refuseMalformedResourcePropertiesForDrift as Ma, formatDockerLoginError as Mc, withSharedDrainBudget as Mi, resolveAssemblyPath as Ml, orphanRecordsPrintingBag as Mn, isMarkedCoordinate as Mo, deleteSkipReason as Mr, STATE_SOURCED_CROSS_GENERATION_RULES as Ms, journaledOrphanLines as Mt, recordedProtectionEvidence as N, refuseMalformedResourcePropertiesForExport as Na, getDockerCmd as Nc, parameterInputsFor as Ni, injectAwsRegion as Nl, secretNamePrintingBag as Nn, maskAtCoordinates as No, withIndeterminateGuard as Nr, STATE_SOURCED_READBACK_RULES as Ns, loadJournaledOrphans as Nt, diffSecurity as O, refuseMalformedResourceEntriesForImport as Oa, describeDockerExecFailure as Oc, cfnRefValueFromPhysicalId as Oi, absoluteAssemblyPathEscape as Ol, DEFAULT_RESOURCE_WARN_AFTER_MS as On, sameLambdaFunctionAddress as Oo, RollbackInlinePolicyWriters as Or, recordNoEchoParameterFreshValue as Os, withNestedStackContext as Ot, recordedProtectionNote as P, refuseMalformedResourcePropertiesForOrphan as Pa, isDockerClientEnvKey as Pc, passedParameterClassesOf as Pi, injectedAwsRegionValue as Pl, secretNamePrintingBags as Pn, maskReadbackAtCoordinates as Po, isWaitAbandonedError as Pr, TEMPLATE_SOURCED_RULES as Ps, makeForeignHolderScan as Pt, hasCdkAutoDeleteTag as Q, withoutSilentDropProperties as Qa, loadCdkJson as Qc, malformedLocalOutputsWarning as Qi, earliestDefined as Qn, recordLogOnlyValue as Qo, isIamRoleArn as Qr, hasReasonlessBaselineRefusal as Qs, resolveReplacementOldType as Qt, readProtection as R, refuseMalformedState as Ra, redactedCause as Rc, STATE_RESOURCES_MALFORMED as Ri, extractDeploymentEventError as Rn, noEchoLeavesOf as Ro, isTerminationProtectionPropagationError as Rr, isLockInfoExpired as Rs, awaitInFlightSibling as Rt, keptForReadoption as S, refuseMalformedOutputs as Sa, validateAssetBucketName as Sc, isImpossibleEmptyStoredAttribute as Si, processStackMessages as Sl, noEchoParameterValueSeed as Sn, prefetchCreateOnlyPropertyPaths as So, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Sr, splitGetAttStringForm as Ss, recordDisplacedSkips as St, findServiceTokenRefusals as T, refuseMalformedResourceEntries as Ta, buildDockerImage as Tc, isNamelessDynamicReferenceError as Ti, hasPlainPrototype$1 as Tl, isExportAliasCollision as Tn, withRetry as To, CloudControlProvider as Tr, recordMaskOnlyValue as Ts, withNestedRevertRun as Tt, deleteBudgetKey as U, repairMalformedResourcePropertiesForReadOnly as Ua, escapeRegExp$3 as Uc, displayLogicalId as Ui, createPreDeleteFinalSnapshot as Un, valueAtCoordinate as Uo, INTRINSIC_KEYS as Ur, applyCrossPrefixScan as Us, recordAfterRollbackUpdate as Ut, beginDeleteWait as V, repairMalformedOutputsForReadOnly as Va, runDockerStreaming as Vc, accountArgs as Vi, buildFinalSnapshotIdentifier as Vn, readbackPathFor as Vo, reEnableInstanceApiTermination as Vr, CrossPrefixReadError as Vs, withStackRecords as Vt, resolveDynamoDbDeleteBudgetClock as W, repairMalformedResourcesForReadOnly as Wa, stripControlChars as Wc, hasReadableOrphans as Wi, effectiveDeletionPolicy as Wn, liveMatchesUnresolvedTokenFrame as Wo, IntrinsicFunctionResolver as Wr, crossPrefixDeniedWarning as Ws, demoteSupersededOrphans as Wt, ECR_AUTO_DELETE_IMAGES_TAG as X, findSilentDropProperties as Xa, getDefaultStateBucketName as Xc, malformedExportNamesWarning as Xi, findDestructiveChanges as Xn, printingCorpusOf as Xo, assertSendableRoleArn as Xr, exportNamesCarriedFrom as Xs, recordUnderIdIsNotOwn as Xt, waitForIndexesSettled as Y, findActionableSilentDrops as Ya, synthesisStatusMessage as Yc, malformedDriftResourcePropertiesWarning as Yi, constructPathOf as Yn, logOnlyValueCount as Yo, assertFlagRoleArn as Yr, describeRegionValueKind as Ys, recheckFailedPlan as Yt, S3_AUTO_DELETE_OBJECTS_TAG as Z, unwrittenCreateOnlyReplacement as Za, getLegacyStateBucketName as Zc, malformedExportSourceWarning as Zi, formatDestructiveChange as Zn, recordLogOnlyParameterValue as Zo, explicitRoleArnOrThrow as Zr, hasReadableExportSet as Zs, replacementNeverSwapped as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedOrphanRecords as _a, ensureAssetStorage as _c, regionLessSecretName as _i, PARTITION_TABLE as _l, secretSafeKeyDisplay as _n, readConfigString as _o, TemplateNoEchoReresolver as _r, recordNestedStackParameterExpressions as _s, displacedOpClause as _t, findNestedTemplateTreeDefect as a, malformedOrphansWarning as aa, shouldRetainResource as ac, keepHeldTokenProvenance as ai, resolveUseCdkBootstrapAssets as al, isRedactedRecordedValue as an, isStatefulRecreateTargetSync as ao, planTagDiff as ar, recordReferenceProvenanceEntry as as, cyan as at, lookupEachName as b, refuseMalformedOrphansForDestroy as ba, parseBootstrapMarker as bc, parameterTypeMayLoseSecretIdentity as bi, AssemblyReader as bl, exportNameSecretExposure as bn, requireConfigObject as bo, getCurrentResourceSecrets as br, recordAttributeIdCopy as bs, getNestedRevertRun as bt, renderNestedTemplateTreeDefect as c, malformedRenderedContainersWarning as ca, stringifyValue as cc, recordedReferenceRegions as ci, ssmResolvedValueType as cl, updatePartialMessage as cn, coerceWarmThroughput as co, tagMapAsList as cr, scrubResourceRecord as cs, red as ct, conditionInputsFrom as d, malformedResourcesWarning as da, createAssetRedirectResolver as dc, s3BucketDualStackDomainName as di, MIGRATE_TMP_PREFIX as dl, DeploymentEventsStore as dn, toFiniteNumber as do, stringifyIfAssigned as dr, DYNAMIC_REFERENCE_TOKEN_SCAN as ds, namesAnyDeclaredParameter as dt, malformedLocalResourcesWarning as ea, importableOutputKeys as ec, AWS_CREDENTIAL_ENV_KEYS as ei, resolveAutoAssetStorage as el, orphanDeleteNeedsIdentity as en, hasNoCloudControlHandlers as eo, reserveStackCreateToken as er, createSecretMasker as es, getPriorAttempts as et, parentSuppliedValues as f, malformedScrubResourceEntriesRefusalMessage as fa, loadPublishableAssetManifest as fc, s3BucketRegionalDomainName as fi, findLargeInlineResources as fl, WITHHELD_NAME_DISPLAY as fn, coerceCfnBoolean as fo, CC_BROKEN_REASON as fr, dynamicReferenceTokens as fs, reachableDivergentParameters as ft, mergeNoChangeOutputs as g, refuseMalformedNestedChildOutputs as ga, assertAssetBucketRegion as gc, producerRegionsFromState as gi, expectedOwnerParam as gl, secretBearingStateKeyWarning as gn, configStringRefusal as go, wouldReturnToSdkProvider as gr, inheritNestedStackParameterAssociations as gs, NESTED_PENDING_PARENT_REASON as gt, keptWholeReasonText as h, refuseDivergentRecordRegionForDestroy as ha, BOOTSTRAP_MARKER_PREFIX as hc, classifyReplaySecretRegion as hi, decodeListingKey as hl, secretBearing as hn, configIntegerRefusal as ho, isCustomResource as hr, identityKeyFor as hs, planOrphanAdoption as ht, childTemplateLoader as i, malformedOrphansRefusalMessage as ia, orphansCarriedFrom as ic, isSettledInstanceState as ii, resolveStateBucketWithDefaultAndSource as il, REDACTED_DELETE_ADDRESS_SKIP_REASON as in, isStatefulRecreateTargetForReplace as io, DBPROXY_TAG_OPTIONS as ir, markSameGenerationBag as is, bold as it, noEchoExactEchoLeavesOf as j, refuseMalformedResourcePropertiesForDestroy as ja, finchSecretArgvRefusal as jc, parseWebACLArn as ji, renderAssemblyPathEscape as jl, maskEventTextWithBoundBags as jn, canonicalCoordinates as jo, deleteLeftInPlace as jr, STATE_SOURCED_BASELINE_RULES as js, isHandledOrphan as jt, noEchoAttributeNamesOf as k, refuseMalformedResourceEntriesForImportSave as ka, describeDockerFailure as kc, isStalePlaceholderArnAttribute as ki, describeFileReadFailure as kl, completedReplayEntries as kn, DagBuilder as ko, UNSPECIFIED_SKIP_REASON as kr, recordProvenPublicExpression as ks, deleteJournaledOrphans as kt, templateIdentity as l, malformedResourceEntriesWarning as la, WorkGraph as lc, s3BucketArn as li, CFN_TEMPLATE_BODY_LIMIT as ll, updatePartialReason as ln, isWarmThroughputDecrease as lo, tagPlanWarning as lr, withPhysicalNameCopies as ls, yellow as lt, isSecretBearingReferenceString as m, previewableOrphanRecords as ma, AssetModeResolver as mc, classifyRecordedSecretRegion as mi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ml, exportAliasCollisionScrubWarning as mn, configBooleanRefusal as mo, ccBrokenReason as mr, pathCrossesDottedKey as ms, makeSiblingClaimReader as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedOrphanRecordsWarning as na, isReadableBag as nc, callerEnvCredentials as ni, resolveSkipPrefix as nl, getCurrentProducerRegions as nn, shownType as no, acquireIdempotencyToken as nr, maskSecretsInError as ns, formatResourceLine as nt, isAbsoluteAssetPath as o, malformedOutputsRefusalMessage as oa, AssetPublisher as oc, outputReferenceProvenanceOf as oi, stateBucketExistenceConfirmed as ol, redactedDeleteAddressFields as on, renderStatefulReason as oo, readTagList as or, snapshotPassProvenance as os, gray as ot, readRecordedConditionVerdicts as p, malformedStateRefusalMessage as pa, rewriteTemplateAssetReferences as pc, s3BucketWebsiteUrl as pi, uploadCfnTemplate as pl, displayTextOrWithheld as pn, coerceCfnInteger as po, ProviderRegistry as pr, isUncertifiedBaselineMaskPosition as ps, resourcesNamingDeclaredParameter as pt, INDEX_SETTLE_POLL_INTERVAL_MS as q, unreadableResourceEntries as qa, getDockerImageBySourceHash as qc, isReadableOrphanRecord as qi, unsupportedFinalSnapshotError as qn, hasMaskableValues as qo, refuseUnreadableCdkCrossAccountRefs as qr, splitImportedOps as qs, planFailedOps as qt, computeImplicitDeleteEdges as r, malformedOrphanRowsKeptWarning as ra, orphansAfterRollback as rc, envCredentialsAreAssumedRole as ri, resolveStateBucketWithDefault as rl, inheritProducerRegions as rn, MULTI_REGION_RECREATE_BLOCKED_TYPES as ro, DBPROXY_TAGS_WHAT as rr, maskSecretsInText as rs, createReadOnlyAttributeHealerFactory as rt, listNestedTemplateRows as s, malformedOutputsWarning as sa, isSensitiveAttributeName as sc, recordedOutputReferenceRegions as si, warnDeprecatedNoPrefixCliFlag as sl, redactedDeleteAddressSkip as sn, WARM_THROUGHPUT_MEMBERS as so, refuseMalformedDesiredTags as sr, redactSecretsForState as ss, green as st, DeployEngine as t, malformedOrphanRecordsRefusalMessage as ta, importableOutputs as tc, applyCallerIdentityCredentials as ti, resolveCaptureObservedState as tl, findNestedStackTypeChanges as tn, findReplacedReadersOfRecreateTargets as to, withCreateTokenLedger as tr, errorCauseChain as ts, markRefusedBeforeApplying as tt, conditionFingerprint as u, malformedResourcePropertiesWarning as ua, buildAssetRedirectMap as uc, s3BucketDomainName as ui, CFN_TEMPLATE_URL_LIMIT as ul, DeploymentEventsReader as un, toCfnInteger as uo, definedAttributes as ur, withoutPhysicalNameCopies as us, computeParameterTaint as ut, chunks as v, refuseMalformedOrphanRecordsForDestroy as va, getBootstrapMarkerKey as vc, coerceParameterTypedValue as vi, canonicalizeRegion as vl, carriedExportAliasExposure as vn, replayWarn as vo, readsNoEchoDeleteValues as vr, recoverMaskedOutput as vs, displacedPhysicalIdShown as vt, deferredServiceTokenWarning as w, refuseMalformedResourceAttributesForOrphan as wa, buildDenyExternalAccessPolicy as wc, carriesFetchableDynamicReference as wi, hasOwnKey as wl, collectPublishedOutputNames as wn, describeTypeWithThrottleRetry as wo, customResourceResponseExpirationWarning as wr, provenPublicValue as ws, revertedNestedRowIds as wt, withApiLimit as x, refuseMalformedOrphansForOrphan as xa, readBootstrapMarkerBody as xc, getAccountInfo as xi, StageLoadError as xl, isWholeDynamicReferenceValue as xn, requireConfigString as xo, withPrintingSecrets as xr, recordPhysicalNameCopy as xs, nestedChildStackName as xt, isAccessDeniedError as y, refuseMalformedOrphans as ya, isCrossRegionRedirect as yc, isUnboundTemplateParameter as yi, derivePartitionAndUrlSuffix as yl, exportNameNoEchoParameters as yn, requireConfigArray as yo, isCustomResourceType as yr, physicalNameCopiesOf as ys, dropSettledNestedJournals as yt, DynamoDBGlobalTableProvider as z, repairMalformedOrphanRecordsForReadOnly as za, redactedDockerCause as zc, UNREADABLE_ORPHANS_CONTAINER_ROW as zi, ATOMIC_FINAL_SNAPSHOT_TYPES as zn, noEchoOutputsComparison as zo, observeThenDisableInstanceApiTermination as zr, S3StateBackend as zs, destroyStackRecordsView as zt };
+//# sourceMappingURL=deploy-engine-DlLwYRJk.js.map