@go-to-k/cdkd 0.299.0 → 0.299.2

package/dist/{program-BgsCaZFy.js → program-TA6lNkLr.js}

@@ -2,8 +2,8 @@ import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients,
 import { A as UNRENDERABLE, B as stringifyJsonPayload, D as SAFE_MSG_ALTERED_CHAR, F as displayStackName, H as truncateCodePoints, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, T as withStackName, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, j as cutMarker, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
 import { $n as isAmbiguousOutcomeError, $t as credentialFingerprint, Bn as withheldTargetClause, D as VALUE_NOT_SHOWN, Dn as TIMEOUT_FLAG_RESOURCE_TYPE, E as assertRegionMatch, En as withErrorHandling, Ft as buildLockContentionMessage, G as runDeleteAttempt, Hn as setPasteableVerbFlags, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, It as forceQuitRecoveryClause, Jt as setPasteableAwsProfile, Kt as producerCoordinateKey, Ln as quotedOrDescribed, Lt as formatLockExpiry, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, P as remedyLogicalId, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Qt as clientDefaultsFor, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, Ut as DEFAULT_STATE_PREFIX, Vn as setPasteableRunFlags, Wt as injectiveKey, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, ar as isMarkedNonRetryable, bn as StackTerminationProtectionError, cn as IntrinsicResolutionRefusalError, en as AccountIdUnavailableError, ft as logicalIdShown, gn as ProvisioningError, hn as PartialFailureError, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, jn as commandHole, kn as SHELL_ACTIVE_WHY, ln as LocalInvokeBuildError$1, mn as NestedStackChildDirectDestroyError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as CdkdError, nr as isTransientServerError, nt as endCommandInterruptScope, on as DeployCancelledError, or as isThrottlingError, pn as MalformedProducerRecordRefusalError, qt as producerRecordKey, rr as retryClassificationText, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, t as IAM_PRINCIPAL_NAME, tr as isRetryableTransientError, tt as beginCommandInterruptScope, un as LocalStartServiceError, vn as ResourceUpdateNotSupportedError, xn as StateError, yn as StackHasActiveImportsError, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-Pn2m0R67.js";
 import { a as setAssumedRoleCredentials, n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-DBXBcg0J.js";
-import { $a as MULTI_REGION_RECREATE_BLOCKED_TYPES, $c as resolveStateBucketWithDefault, $i as malformedOrphanRowsKeptWarning, $o as maskSecretsInText, $r as isIamRoleArn, $s as orphansAfterRollback, $t as seedsDeleteFirstGuard, A as noEchoComparisonForTemplate, Aa as refuseMalformedResourcePropertiesForOrphan, Ac as isDockerClientEnvKey, Al as injectedAwsRegionValue, An as journaledOrphanPrintingBag, Ao as maskReadbackAtCoordinates, Ar as UNSPECIFIED_SKIP_REASON, As as TEMPLATE_SOURCED_RULES, At as dropFailedHint, Ba as repairMalformedResourcesForReadOnly, Bc as stripControlChars, Bi as hasReadableOrphans, Bn as PRE_DELETE_SNAPSHOT_TYPES, Bo as liveMatchesUnresolvedTokenFrame, Bs as crossPrefixDeniedWarning, C as recordRetainedForReadoption, Ca as refuseMalformedResourceEntriesForDestroy, Cc as describeDockerCapturedOutput, Ci as AWS_NO_VALUE, Cl as ownValue, Cn as collectDeclaredOutputNames, Cr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Cs as recordNoEchoAttributeValues, D as withResourceDeadline, Da as refuseMalformedResourcePropertiesForDestroy, Dc as finchSecretArgvRefusal, Dl as renderAssemblyPathEscape, Dn as DEFAULT_RESOURCE_TIMEOUT_MS, Do as canonicalCoordinates, Dr as slowCcOperationTimeoutMs, Ds as STATE_SOURCED_BASELINE_RULES, E as serviceTokenBlockingReason, Ea as refuseMalformedResourceEntriesForOrphan, Ec as dockerSpawnEnvWithSensitive, Ei as refStateLookupFromResource, El as displayAssemblyPath, En as bindingSkippedOutputs, Eo as TemplateParser, Er as CloudControlProvider, Es as wholeStringLeavesOf, Et as collectNestedChildUnaddressed, F as PROTECTION_PROPERTY_BY_TYPE, Fa as repairMalformedOrphanRecordsForReadOnly, Fc as redactedDockerCause, Fi as UNREADABLE_ORPHANS_CONTAINER_ROW, Fn as secretNamedRecordNeedles, Fo as noEchoOutputsComparison, Fr as isWaitAbandonedError, Fs as S3StateBackend, Ft as sameJournaledOrphans, Ga as findActionableSilentDrops, Gc as synthesisStatusMessage, Gi as malformedDriftResourcePropertiesWarning, Gn as isFinalSnapshotError, Go as logOnlyValueCount, Gr as IntrinsicFunctionResolver, Gs as describeRegionValueKind, Gt as isJournaledOrphan, Ha as unreadableOrphanRecords, Hc as AssetManifestLoader, Hi as hasReadableResources, Hn as ccRoutedFinalSnapshotError, Ho as createUnionSecretMasker, Hs as isNotImplemented, Ht as removeProtectionTypeList, I as isProtectionValueActive, Ia as repairMalformedOrphansForReadOnly, Ic as runDockerForeground, Ii as UNREADABLE_RESOURCES_MAP_ROW, In as stateSecretNameNeedles, Is as rebuildClientForBucketRegion, It as replayFailedOperations, Jc as loadCdkJson, Ji as malformedLocalOutputsWarning, Jn as maskingRetryLogger, Jo as recordLogOnlyValue, Jr as refuseUnreadableCdkCrossAccountRefs, Js as hasReasonlessBaselineRefusal, Jt as planRollback, Kc as getDefaultStateBucketName, Ki as malformedExportNamesWarning, Kn as refusesFinalSnapshot, Ko as printingCorpusOf, Kr as poisonRenderedSpellingsCollidingIn, Ks as exportNamesCarriedFrom, Kt as isReplacementOrphan, L as perType, La as repairMalformedOutputsForReadOnly, Lc as runDockerStreaming, Li as accountArgs, Ln as storedSecretNameNeedles, Lo as readbackPathFor, Ls as CrossPrefixReadError, Lt as replayRollback, M as noEchoParameterNamesOf, Ma as refuseMalformedResourcesForDestroy, Mc as partitionSensitiveEnv, Mi as JSON_LISTING_HOLE_VALUE, Ml as resolveBucketRegion, Mn as orphanRecordsPrintingBag, Mo as maskedLeafCoordinatesOf, Mr as deleteLeftInPlace, Ms as isSingleDynamicReferenceToken, Mt as journaledOrphanLines, N as recordedProtectionEvidence, Na as refuseMalformedResourcesForExport, Nc as redactDockerArgvValues, Ni as STATE_REGION_DIVERGED, Nn as secretNamePrintingBag, No as noEchoCoordinatesOf, Nr as deleteSkipReason, Ns as LockManager, Nt as loadJournaledOrphans, O as diffSecurity, Oa as refuseMalformedResourcePropertiesForDrift, Oc as formatDockerLoginError, Oi as withSharedDrainBudget, Ol as resolveAssemblyPath, On as DEFAULT_RESOURCE_WARN_AFTER_MS, Oo as isMarkedCoordinate, Os as STATE_SOURCED_CROSS_GENERATION_RULES, Ot as withNestedStackContext, P as recordedProtectionNote, Pa as refuseMalformedState, Pc as redactedCause, Pi as STATE_RESOURCES_MALFORMED, Pn as secretNamePrintingBags, Po as noEchoLeavesOf, Ps as isLockInfoExpired, Pt as makeForeignHolderScan, Qa as shownType, Qc as resolveSkipPrefix, Qi as malformedOrphanRecordsWarning, Qo as maskSecretsInError, Qr as explicitRoleArnOrThrow, Qs as isReadableBag, Qt as resolveReplacementOldType, R as readProtection, Ra as repairMalformedResourceEntriesForReadOnly, Rc as warnFinchArgvExposure, Ri as deployRefusesOrphanRowsReason, Rn as extractDeploymentEventError, Ro as readsNoEchoSource, Rs as CrossPrefixScanCache, S as keptForReadoption, Sa as refuseMalformedResourceEntriesForDeploy, Sc as resolveDockerContextDirectory, Si as keepsSecretReferenceToken, Sl as nullPrototypeRecord, Sn as noEchoParameterValueSeed, Sr as withPrintingSecrets, Ss as recordMaskOnlyValuesIn, St as recordDisplacedSkips, T as findServiceTokenRefusals, Ta as refuseMalformedResourceEntriesForImportSave, Tc as describeDockerFailure, Ti as isStalePlaceholderArnAttribute, Tl as describeFileReadFailure, Tn as isExportAliasCollision, To as DagBuilder, Tr as customResourceResponseExpirationWarning, Ts as recordProvenPublicExpression, Tt as withNestedRevertRun, Ua as unreadableResourceEntries, Uc as getDockerImageBySourceHash, Ui as isReadableOrphanRecord, Un as createPreDeleteFinalSnapshot, Uo as hasMaskableValues, Ur as DiffCalculator, Us as splitImportedOps, Ut as recordAfterRollbackUpdate, Va as unpreviewableOrphanRecords, Vc as stripForDisplay, Vi as hasReadableOutputs, Vn as buildFinalSnapshotIdentifier, Vo as carryLogOnlyValues, Vs as isAccessDenied, Vt as withStackRecords, Wa as withheldAccountClause, Wc as Synthesizer, Wi as isReadableResourceEntry, Wn as effectiveDeletionPolicy, Wo as literalSplitDelimitersOf, Wr as INTRINSIC_KEYS, Ws as acceptedCreateOnlyDropsOf, Wt as demoteSupersededOrphans, Xa as hasNoCloudControlHandlers, Xc as resolveAutoAssetStorage, Xi as malformedLocalResourcesWarning, Xn as findDestructiveChanges, Xo as createSecretMasker, Xr as assertFlagRoleArn, Xs as importableOutputKeys, Xt as recordUnderIdIsNotOwn, Ya as NO_CC_HANDLERS_REASON, Yc as resolveApp, Yi as malformedLocalResourceEntriesWarning, Yn as constructPathOf, Yo as shareLogOnlyValues, Yr as applyRoleArnIfSet, Ys as hasUnverifiableParameterRefusal, Yt as recheckFailedPlan, Za as findReplacedReadersOfRecreateTargets, Zc as resolveCaptureObservedState, Zi as malformedOrphanRecordsRefusalMessage, Zn as formatDestructiveChange, Zo as errorCauseChain, Zr as assertSendableRoleArn, Zs as importableOutputs, Zt as replacementNeverSwapped, _ as makeCanonicalizePropertiesFn, _a as refuseMalformedOrphansForOrphan, _c as readBootstrapMarkerBody, _i as getAccountInfo, _l as StageLoadError, _n as secretSafeKeyDisplay, _r as wouldReturnToSdkProvider, _s as recordPhysicalNameCopy, _t as displacedOpClause, a as findNestedTemplateTreeDefect, aa as malformedResourceEntriesWarning, ac as WorkGraph, al as CFN_TEMPLATE_BODY_LIMIT, as as withPhysicalNameCopies, at as cyan, ba as refuseMalformedResourceAttributesForOrphan, bc as buildDenyExternalAccessPolicy, bi as carriesFetchableDynamicReference, bl as hasOwnKey, bn as exportNameSecretExposure, bo as describeTypeWithThrottleRetry, br as isCustomResourceType$1, bs as provenPublicValue, c as renderNestedTemplateTreeDefect, ca as malformedScrubResourceEntriesRefusalMessage, cc as loadPublishableAssetManifest, cl as findLargeInlineResources, cn as updatePartialMessage, cs as dynamicReferenceTokens, ct as red, d as conditionInputsFrom, da as refuseDivergentRecordRegionForDestroy, dc as BOOTSTRAP_MARKER_PREFIX, di as classifyReplaySecretRegion, dl as decodeListingKey, dn as DeploymentEventsStore, ds as identityKeyFor, dt as namesAnyDeclaredParameter, ea as malformedOrphansRefusalMessage, ec as orphansCarriedFrom, ei as sendableAssumeRoleCommand, el as resolveStateBucketWithDefaultAndSource, en as orphanDeleteNeedsIdentity, eo as isStatefulRecreateTargetForReplace, er as ledgerForStack, es as markSameGenerationBag, f as parentSuppliedValues, fc as assertAssetBucketRegion, fi as producerRegionsFromState, fl as expectedOwnerParam, fn as WITHHELD_NAME_DISPLAY, fs as inheritNestedStackParameterAssociations, ft as reachableDivergentParameters, g as mergeNoChangeOutputs, ga as refuseMalformedOrphansForDestroy, gc as parseBootstrapMarker, gi as parameterTypeMayLoseSecretIdentity, gl as AssemblyReader, gn as secretBearingStateKeyWarning, gr as isCustomResource, gt as NESTED_PENDING_PARENT_REASON, h as keptWholeReasonText, ha as refuseMalformedOrphans, hc as isCrossRegionRedirect, hi as isUnboundTemplateParameter, hl as derivePartitionAndUrlSuffix, hn as secretBearing, hr as ccBrokenReason, hs as physicalNameCopiesOf, ht as planOrphanAdoption, i as childTemplateLoader, ia as malformedRenderedContainersWarning, ic as stringifyValue, ii as envCredentialsAreAssumedRole, il as ssmResolvedValueType, is as scrubResourceRecord, it as bold, j as noEchoExactEchoLeavesOf, ja as refuseMalformedResourcesForDeploy, jc as isMalformedEnvKey, ji as declaresNoEcho, jn as maskEventTextWithBoundBags, jo as maskWholeValue, jr as deleteIndeterminateGuards, js as WHOLE_DYNAMIC_REFERENCE_PATTERN, jt as isHandledOrphan, k as noEchoAttributeNamesOf, ka as refuseMalformedResourcePropertiesForExport, kc as getDockerCmd, ki as parameterInputsFor, kl as injectAwsRegion, kn as completedReplayEntries, ko as maskAtCoordinates, kr as RollbackInlinePolicyWriters, ks as STATE_SOURCED_READBACK_RULES, kt as deleteJournaledOrphans, l as templateIdentity, la as malformedStateRefusalMessage, lc as rewriteTemplateAssetReferences, ll as uploadCfnTemplate, ln as updatePartialReason, ls as isUncertifiedBaselineMaskPosition, lt as yellow, m as isSecretBearingReferenceString, ma as refuseMalformedOrphanRecordsForDestroy, mc as getBootstrapMarkerKey, mi as coerceParameterTypedValue, ml as canonicalizeRegion, mn as exportAliasCollisionScrubWarning, mr as ProviderRegistry, mt as makeSiblingClaimReader, n as IMPLICIT_DELETE_DEPENDENCIES, na as malformedOutputsRefusalMessage, nc as AssetPublisher, ni as applyCallerIdentityCredentials, nl as stateBucketExistenceConfirmed, no as renderStatefulReason, nr as withCreateTokenLedger, nt as formatResourceLine, o as isAbsoluteAssetPath, oa as malformedResourcePropertiesWarning, oc as buildAssetRedirectMap, ol as CFN_TEMPLATE_URL_LIMIT, ot as gray, p as readRecordedConditionVerdicts, pa as refuseMalformedOrphanRecords, pc as ensureAssetStorage, pi as regionLessSecretName, pl as PARTITION_TABLE, pn as displayTextOrWithheld, pr as CC_BROKEN_REASON, ps as recordNestedStackParameterExpressions, pt as resourcesNamingDeclaredParameter, qa as unwrittenCreateOnlyReplacement, qc as getLegacyStateBucketName, qi as malformedExportSourceWarning, qn as unsupportedFinalSnapshotError, qo as recordLogOnlyParameterValue, qr as producerLookupOver, qs as hasReadableExportSet, qt as planFailedOps, r as computeImplicitDeleteEdges, ra as malformedOutputsWarning, rc as isSensitiveAttributeName, ri as callerEnvCredentials, rl as warnDeprecatedNoPrefixCliFlag, rn as inheritProducerRegions, rs as redactSecretsForState, rt as createReadOnlyAttributeHealerFactory, s as listNestedTemplateRows, sa as malformedResourcesWarning, sc as createAssetRedirectResolver, sl as MIGRATE_TMP_PREFIX, ss as DYNAMIC_REFERENCE_TOKEN_SCAN, st as green, t as DeployEngine, ta as malformedOrphansWarning, tc as shouldRetainResource, ti as AWS_CREDENTIAL_ENV_KEYS, tl as resolveUseCdkBootstrapAssets, tn as findNestedStackTypeChanges, to as isStatefulRecreateTargetSync, u as conditionFingerprint, ua as previewableOrphanRecords, uc as AssetModeResolver, ul as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, un as DeploymentEventsReader, us as pathCrossesDottedKey, ut as computeParameterTaint, va as refuseMalformedOutputs, vc as validateAssetBucketName, vi as isImpossibleEmptyStoredAttribute, vl as processStackMessages, vn as carriedExportAliasExposure, vo as prefetchCreateOnlyPropertyPaths, vr as TemplateNoEchoReresolver, vs as splitGetAttStringForm, vt as displacedPhysicalIdShown, w as deferredServiceTokenWarning, wa as refuseMalformedResourceEntriesForImport, wc as describeDockerExecFailure, wi as cfnRefValueFromPhysicalId, wl as absoluteAssemblyPathEscape, wn as collectPublishedOutputNames, wr as applyCustomResourceResponseExpiration, ws as recordNoEchoParameterFreshValue, wt as revertedNestedRowIds, xa as refuseMalformedResourceEntries, xc as buildDockerImage, xi as isNamelessDynamicReferenceError, xl as hasPlainPrototype, xn as isWholeDynamicReferenceValue, xo as withRetry, xs as recordMaskOnlyValue, xt as nestedChildStackName$1, ya as refuseMalformedOutputsForDestroy, yc as validateContainerRepoName, yi as carriesDynamicReference, yl as defineOwnKey, yn as exportNameNoEchoParameters, yo as templateResourceTypes, yr as readsNoEchoDeleteValues, ys as carriesSecretMask, yt as dropSettledNestedJournals, za as repairMalformedResourcePropertiesForReadOnly, zc as escapeRegExp, zi as displayLogicalId, zn as ATOMIC_FINAL_SNAPSHOT_TYPES, zo as valueAtCoordinate, zs as applyCrossPrefixScan, zt as destroyStackRecordsView } from "./deploy-engine-4K_B3N08.js";
-import { t as getCdkdVersion } from "./version-DUCWZskc.js";
+import { $a as NO_CC_HANDLERS_REASON, $c as resolveApp, $i as malformedLocalResourceEntriesWarning, $n as ledgerForStack, $o as shareLogOnlyValues, $r as sendableAssumeRoleCommand, $s as hasUnverifiableParameterRefusal, $t as seedsDeleteFirstGuard, A as noEchoComparisonForTemplate, Aa as refuseMalformedResourceEntriesForOrphan, Ac as dockerSpawnEnvWithSensitive, Ai as refStateLookupFromResource, Al as displayAssemblyPath, An as journaledOrphanPrintingBag, Ao as TemplateParser, Ar as deleteIndeterminateGuards, As as wholeStringLeavesOf, At as dropFailedHint, Ba as repairMalformedOrphansForReadOnly, Bc as runDockerForeground, Bi as UNREADABLE_RESOURCES_MAP_ROW, Bn as PRE_DELETE_SNAPSHOT_TYPES, Bs as rebuildClientForBucketRegion, C as recordRetainedForReadoption, Ca as refuseMalformedOutputsForDestroy, Cc as validateContainerRepoName, Ci as carriesDynamicReference, Cl as defineOwnKey, Cn as collectDeclaredOutputNames, Co as templateResourceTypes, Cr as applyCustomResourceResponseExpiration, Cs as carriesSecretMask, D as withResourceDeadline, Da as refuseMalformedResourceEntriesForDestroy, Dc as describeDockerCapturedOutput, Di as AWS_NO_VALUE, Dl as ownValue, Dn as DEFAULT_RESOURCE_TIMEOUT_MS, Ds as recordNoEchoAttributeValues, E as serviceTokenBlockingReason, Ea as refuseMalformedResourceEntriesForDeploy, Ec as resolveDockerContextDirectory, Ei as keepsSecretReferenceToken, El as nullPrototypeRecord, En as bindingSkippedOutputs, Er as slowCcOperationTimeoutMs, Es as recordMaskOnlyValuesIn, Et as collectNestedChildUnaddressed, F as PROTECTION_PROPERTY_BY_TYPE, Fa as refuseMalformedResourcesForDeploy, Fc as isMalformedEnvKey, Fi as declaresNoEcho, Fn as secretNamedRecordNeedles, Fo as maskWholeValue, Fs as WHOLE_DYNAMIC_REFERENCE_PATTERN, Ft as sameJournaledOrphans, Ga as unpreviewableOrphanRecords, Gc as stripForDisplay, Gi as hasReadableOutputs, Gn as isFinalSnapshotError, Go as carryLogOnlyValues, Gr as poisonRenderedSpellingsCollidingIn, Gs as isAccessDenied, Gt as isJournaledOrphan, Ha as repairMalformedResourceEntriesForReadOnly, Hc as warnFinchArgvExposure, Hi as deployRefusesOrphanRowsReason, Hn as ccRoutedFinalSnapshotError, Ho as readsNoEchoSource, Hr as DiffCalculator, Hs as CrossPrefixScanCache, Ht as removeProtectionTypeList, I as isProtectionValueActive, Ia as refuseMalformedResourcesForDestroy, Ic as partitionSensitiveEnv, Ii as JSON_LISTING_HOLE_VALUE, Il as resolveBucketRegion, In as stateSecretNameNeedles, Io as maskedLeafCoordinatesOf, Is as isSingleDynamicReferenceToken, It as replayFailedOperations, Ja as withheldAccountClause, Jc as Synthesizer, Ji as isReadableResourceEntry, Jn as maskingRetryLogger, Jo as literalSplitDelimitersOf, Jr as applyRoleArnIfSet, Js as acceptedCreateOnlyDropsOf, Jt as planRollback, Ka as unreadableOrphanRecords, Kc as AssetManifestLoader, Ki as hasReadableResources, Kn as refusesFinalSnapshot, Ko as createUnionSecretMasker, Kr as producerLookupOver, Ks as isNotImplemented, Kt as isReplacementOrphan, L as perType, La as refuseMalformedResourcesForExport, Lc as redactDockerArgvValues, Li as STATE_REGION_DIVERGED, Ln as storedSecretNameNeedles, Lo as noEchoCoordinatesOf, Ls as LockManager, Lt as replayRollback, M as noEchoParameterNamesOf, Ma as refuseMalformedResourcePropertiesForDrift, Mc as formatDockerLoginError, Mi as withSharedDrainBudget, Ml as resolveAssemblyPath, Mn as orphanRecordsPrintingBag, Mo as isMarkedCoordinate, Mr as deleteSkipReason, Ms as STATE_SOURCED_CROSS_GENERATION_RULES, Mt as journaledOrphanLines, N as recordedProtectionEvidence, Na as refuseMalformedResourcePropertiesForExport, Nc as getDockerCmd, Ni as parameterInputsFor, Nl as injectAwsRegion, Nn as secretNamePrintingBag, No as maskAtCoordinates, Ns as STATE_SOURCED_READBACK_RULES, Nt as loadJournaledOrphans, O as diffSecurity, Oa as refuseMalformedResourceEntriesForImport, Oc as describeDockerExecFailure, Oi as cfnRefValueFromPhysicalId, Ol as absoluteAssemblyPathEscape, On as DEFAULT_RESOURCE_WARN_AFTER_MS, Or as RollbackInlinePolicyWriters, Os as recordNoEchoParameterFreshValue, Ot as withNestedStackContext, P as recordedProtectionNote, Pa as refuseMalformedResourcePropertiesForOrphan, Pc as isDockerClientEnvKey, Pl as injectedAwsRegionValue, Pn as secretNamePrintingBags, Po as maskReadbackAtCoordinates, Pr as isWaitAbandonedError, Ps as TEMPLATE_SOURCED_RULES, Pt as makeForeignHolderScan, Qc as loadCdkJson, Qi as malformedLocalOutputsWarning, Qo as recordLogOnlyValue, Qr as isIamRoleArn, Qs as hasReasonlessBaselineRefusal, Qt as resolveReplacementOldType, R as readProtection, Ra as refuseMalformedState, Rc as redactedCause, Ri as STATE_RESOURCES_MALFORMED, Rn as extractDeploymentEventError, Ro as noEchoLeavesOf, Rs as isLockInfoExpired, S as keptForReadoption, Sa as refuseMalformedOutputs, Sc as validateAssetBucketName, Si as isImpossibleEmptyStoredAttribute, Sl as processStackMessages, Sn as noEchoParameterValueSeed, So as prefetchCreateOnlyPropertyPaths, Sr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ss as splitGetAttStringForm, St as recordDisplacedSkips, T as findServiceTokenRefusals, Ta as refuseMalformedResourceEntries, Tc as buildDockerImage, Ti as isNamelessDynamicReferenceError, Tl as hasPlainPrototype, Tn as isExportAliasCollision, To as withRetry, Tr as CloudControlProvider, Ts as recordMaskOnlyValue, Tt as withNestedRevertRun, Ua as repairMalformedResourcePropertiesForReadOnly, Uc as escapeRegExp, Ui as displayLogicalId, Un as createPreDeleteFinalSnapshot, Uo as valueAtCoordinate, Ur as INTRINSIC_KEYS, Us as applyCrossPrefixScan, Ut as recordAfterRollbackUpdate, Va as repairMalformedOutputsForReadOnly, Vc as runDockerStreaming, Vi as accountArgs, Vn as buildFinalSnapshotIdentifier, Vo as readbackPathFor, Vs as CrossPrefixReadError, Vt as withStackRecords, Wa as repairMalformedResourcesForReadOnly, Wc as stripControlChars, Wi as hasReadableOrphans, Wn as effectiveDeletionPolicy, Wo as liveMatchesUnresolvedTokenFrame, Wr as IntrinsicFunctionResolver, Ws as crossPrefixDeniedWarning, Wt as demoteSupersededOrphans, Xc as getDefaultStateBucketName, Xi as malformedExportNamesWarning, Xn as findDestructiveChanges, Xo as printingCorpusOf, Xr as assertSendableRoleArn, Xs as exportNamesCarriedFrom, Xt as recordUnderIdIsNotOwn, Ya as findActionableSilentDrops, Yc as synthesisStatusMessage, Yi as malformedDriftResourcePropertiesWarning, Yn as constructPathOf, Yo as logOnlyValueCount, Yr as assertFlagRoleArn, Ys as describeRegionValueKind, Yt as recheckFailedPlan, Za as unwrittenCreateOnlyReplacement, Zc as getLegacyStateBucketName, Zi as malformedExportSourceWarning, Zn as formatDestructiveChange, Zo as recordLogOnlyParameterValue, Zr as explicitRoleArnOrThrow, Zs as hasReadableExportSet, Zt as replacementNeverSwapped, _ as makeCanonicalizePropertiesFn, _a as refuseMalformedOrphanRecords, _c as ensureAssetStorage, _i as regionLessSecretName, _l as PARTITION_TABLE, _n as secretSafeKeyDisplay, _r as TemplateNoEchoReresolver, _s as recordNestedStackParameterExpressions, _t as displacedOpClause, a as findNestedTemplateTreeDefect, aa as malformedOrphansWarning, ac as shouldRetainResource, ai as keepHeldTokenProvenance, al as resolveUseCdkBootstrapAssets, ao as isStatefulRecreateTargetSync, at as cyan, ba as refuseMalformedOrphansForDestroy, bc as parseBootstrapMarker, bi as parameterTypeMayLoseSecretIdentity, bl as AssemblyReader, bn as exportNameSecretExposure, c as renderNestedTemplateTreeDefect, ca as malformedRenderedContainersWarning, cc as stringifyValue, ci as recordedReferenceRegions, cl as ssmResolvedValueType, cn as updatePartialMessage, cs as scrubResourceRecord, ct as red, d as conditionInputsFrom, da as malformedResourcesWarning, dc as createAssetRedirectResolver, dl as MIGRATE_TMP_PREFIX, dn as DeploymentEventsStore, ds as DYNAMIC_REFERENCE_TOKEN_SCAN, dt as namesAnyDeclaredParameter, ea as malformedLocalResourcesWarning, ec as importableOutputKeys, ei as AWS_CREDENTIAL_ENV_KEYS, el as resolveAutoAssetStorage, en as orphanDeleteNeedsIdentity, eo as hasNoCloudControlHandlers, es as createSecretMasker, f as parentSuppliedValues, fa as malformedScrubResourceEntriesRefusalMessage, fc as loadPublishableAssetManifest, fl as findLargeInlineResources, fn as WITHHELD_NAME_DISPLAY, fr as CC_BROKEN_REASON, fs as dynamicReferenceTokens, ft as reachableDivergentParameters, g as mergeNoChangeOutputs, gc as assertAssetBucketRegion, gi as producerRegionsFromState, gl as expectedOwnerParam, gn as secretBearingStateKeyWarning, gr as wouldReturnToSdkProvider, gs as inheritNestedStackParameterAssociations, gt as NESTED_PENDING_PARENT_REASON, h as keptWholeReasonText, ha as refuseDivergentRecordRegionForDestroy, hc as BOOTSTRAP_MARKER_PREFIX, hi as classifyReplaySecretRegion, hl as decodeListingKey, hn as secretBearing, hr as isCustomResource, hs as identityKeyFor, ht as planOrphanAdoption, i as childTemplateLoader, ia as malformedOrphansRefusalMessage, ic as orphansCarriedFrom, il as resolveStateBucketWithDefaultAndSource, io as isStatefulRecreateTargetForReplace, is as markSameGenerationBag, it as bold, j as noEchoExactEchoLeavesOf, ja as refuseMalformedResourcePropertiesForDestroy, jc as finchSecretArgvRefusal, jl as renderAssemblyPathEscape, jn as maskEventTextWithBoundBags, jo as canonicalCoordinates, jr as deleteLeftInPlace, js as STATE_SOURCED_BASELINE_RULES, jt as isHandledOrphan, k as noEchoAttributeNamesOf, ka as refuseMalformedResourceEntriesForImportSave, kc as describeDockerFailure, ki as isStalePlaceholderArnAttribute, kl as describeFileReadFailure, kn as completedReplayEntries, ko as DagBuilder, kr as UNSPECIFIED_SKIP_REASON, ks as recordProvenPublicExpression, kt as deleteJournaledOrphans, l as templateIdentity, la as malformedResourceEntriesWarning, lc as WorkGraph, ll as CFN_TEMPLATE_BODY_LIMIT, ln as updatePartialReason, ls as withPhysicalNameCopies, lt as yellow, m as isSecretBearingReferenceString, ma as previewableOrphanRecords, mc as AssetModeResolver, mi as classifyRecordedSecretRegion, ml as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, mn as exportAliasCollisionScrubWarning, mr as ccBrokenReason, ms as pathCrossesDottedKey, mt as makeSiblingClaimReader, n as IMPLICIT_DELETE_DEPENDENCIES, na as malformedOrphanRecordsWarning, nc as isReadableBag, ni as callerEnvCredentials, nl as resolveSkipPrefix, no as shownType, ns as maskSecretsInError, nt as formatResourceLine, o as isAbsoluteAssetPath, oa as malformedOutputsRefusalMessage, oc as AssetPublisher, ol as stateBucketExistenceConfirmed, oo as renderStatefulReason, ot as gray, p as readRecordedConditionVerdicts, pa as malformedStateRefusalMessage, pc as rewriteTemplateAssetReferences, pl as uploadCfnTemplate, pn as displayTextOrWithheld, pr as ProviderRegistry, ps as isUncertifiedBaselineMaskPosition, pt as resourcesNamingDeclaredParameter, qa as unreadableResourceEntries, qc as getDockerImageBySourceHash, qi as isReadableOrphanRecord, qn as unsupportedFinalSnapshotError, qo as hasMaskableValues, qr as refuseUnreadableCdkCrossAccountRefs, qs as splitImportedOps, qt as planFailedOps, r as computeImplicitDeleteEdges, ra as malformedOrphanRowsKeptWarning, rc as orphansAfterRollback, ri as envCredentialsAreAssumedRole, rl as resolveStateBucketWithDefault, rn as inheritProducerRegions, ro as MULTI_REGION_RECREATE_BLOCKED_TYPES, rs as maskSecretsInText, rt as createReadOnlyAttributeHealerFactory, s as listNestedTemplateRows, sa as malformedOutputsWarning, sc as isSensitiveAttributeName, si as recordedOutputReferenceRegions, sl as warnDeprecatedNoPrefixCliFlag, ss as redactSecretsForState, st as green, t as DeployEngine, ta as malformedOrphanRecordsRefusalMessage, tc as importableOutputs, ti as applyCallerIdentityCredentials, tl as resolveCaptureObservedState, tn as findNestedStackTypeChanges, to as findReplacedReadersOfRecreateTargets, tr as withCreateTokenLedger, ts as errorCauseChain, u as conditionFingerprint, ua as malformedResourcePropertiesWarning, uc as buildAssetRedirectMap, ul as CFN_TEMPLATE_URL_LIMIT, un as DeploymentEventsReader, ut as computeParameterTaint, va as refuseMalformedOrphanRecordsForDestroy, vc as getBootstrapMarkerKey, vi as coerceParameterTypedValue, vl as canonicalizeRegion, vn as carriedExportAliasExposure, vr as readsNoEchoDeleteValues, vt as displacedPhysicalIdShown, w as deferredServiceTokenWarning, wa as refuseMalformedResourceAttributesForOrphan, wc as buildDenyExternalAccessPolicy, wi as carriesFetchableDynamicReference, wl as hasOwnKey, wn as collectPublishedOutputNames, wo as describeTypeWithThrottleRetry, wr as customResourceResponseExpirationWarning, ws as provenPublicValue, wt as revertedNestedRowIds, xa as refuseMalformedOrphansForOrphan, xc as readBootstrapMarkerBody, xi as getAccountInfo, xl as StageLoadError, xn as isWholeDynamicReferenceValue, xr as withPrintingSecrets, xs as recordPhysicalNameCopy, xt as nestedChildStackName$1, ya as refuseMalformedOrphans, yc as isCrossRegionRedirect, yi as isUnboundTemplateParameter, yl as derivePartitionAndUrlSuffix, yn as exportNameNoEchoParameters, yr as isCustomResourceType$1, ys as physicalNameCopiesOf, yt as dropSettledNestedJournals, za as repairMalformedOrphanRecordsForReadOnly, zc as redactedDockerCause, zi as UNREADABLE_ORPHANS_CONTAINER_ROW, zn as ATOMIC_FINAL_SNAPSHOT_TYPES, zo as noEchoOutputsComparison, zs as S3StateBackend, zt as destroyStackRecordsView } from "./deploy-engine-DlLwYRJk.js";
+import { t as getCdkdVersion } from "./version-Dz0rTkus.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -2561,7 +2561,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-DxHQcC1K.js");
+	providerClasses ??= import("./provider-classes-WJRB6zvO.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -7083,12 +7083,15 @@ var ScrubResolvers = class {
 		this.pinned.set(target, scoped);
 		return scoped;
 	}
+	forRecordedRegion(region) {
+		return this.primary.resolverForRecordedRegion(region);
+	}
 };
 function regionAmbiguousScrubSecretError(origin, stackName, secretName, foreignProducerRegions, stackRegion, secrets) {
 	return new ScrubRefusalError(`Scrub of ${displayStackName(stackName)} cannot re-resolve the secret reference ${maskedIdent(secretName, secrets)} in ${origin}: the reference carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.map((r) => displayIdent(r)).join(", ")}), so it may have been resolved in one of those rather than in ${displayIdent(stackRegion)}. A secret of the same name in two regions is two independent values, so scrub would look for the WRONG plaintext — leaving the real one in state while reporting the stack clean, and using the foreign value as a needle that can rewrite an unrelated literal. Refusing instead. Spell the reference as a full ARN, which names its region and is resolved there, then re-run 'cdkd scrub'.`, "SCRUB_SECRET_REGION_AMBIGUOUS");
 }
-function unresolvableForeignScrubSecretError(origin, stackName, secretName, region, cause, secrets) {
-	return new ScrubRefusalError(`Scrub of ${displayStackName(stackName)} could not resolve the secret reference ${maskedIdent(secretName, secrets)} in ${origin} in the region its ARN names (${displayIdent(region)}): ${maskSecretsInText(describeAwsFailure(cause).detail, secrets)}. Refusing rather than resolving it in the stack's own region, which would look for a different secret's value and report the stack clean over state that still holds the plaintext.`, "SCRUB_CROSS_REGION_SECRET_UNRESOLVED");
+function unresolvableForeignScrubSecretError(origin, stackName, secretName, region, cause, secrets, recorded = false) {
+	return new ScrubRefusalError(`Scrub of ${displayStackName(stackName)} could not resolve the secret reference ${maskedIdent(secretName, secrets)} in ${origin} in ${recorded ? "the region its state record names" : "the region its ARN names"} (${displayIdent(region)}): ${maskSecretsInText(describeAwsFailure(cause).detail, secrets)}. Refusing rather than resolving it in the stack's own region, which would look for a different secret's value and report the stack clean over state that still holds the plaintext.`, "SCRUB_CROSS_REGION_SECRET_UNRESOLVED");
 }
 const DYNAMIC_REFERENCE_OPENING = "{{resolve:";
 const SECRET_REFERENCE_OPENINGS = [
@@ -7112,7 +7115,16 @@ async function resolveForeignRegionTokens(leaf, stackName, ctx) {
 	const shownStackName = displayStackName(stackName);
 	const tokens = dynamicReferenceTokens(leaf);
 	if (isAssembledSecretReference(leaf, tokens.filter(isSecretReferenceToken))) return leaf;
-	const verdicts = tokens.map((token) => [token, classifyReplaySecretRegion(token, ctx.stackRegion, ctx.producerRegions)]);
+	const verdicts = tokens.map((token) => {
+		const verdict = classifyReplaySecretRegion(token, ctx.stackRegion, ctx.producerRegions);
+		const recorded = regionLessSecretName(token) === void 0 ? void 0 : ctx.recordedRegions?.get(token);
+		return [token, !(recorded !== void 0 && (canonicalizeRegion(recorded) !== canonicalizeRegion(ctx.stackRegion) || verdict.kind === "ambiguous")) ? verdict : {
+			kind: "named-region",
+			secretName: regionLessSecretName(token),
+			region: recorded,
+			recorded: true
+		}];
+	});
 	for (const [, verdict] of verdicts) if (verdict.kind === "ambiguous") throw regionAmbiguousScrubSecretError(ctx.origin, stackName, verdict.secretName, verdict.foreignProducerRegions, ctx.stackRegion, ctx.recordedSecretValues);
 	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region")) return leaf;
 	const localTokens = [];
@@ -7123,7 +7135,7 @@ async function resolveForeignRegionTokens(leaf, stackName, ctx) {
 		if (at < 0) throw new ScrubRefusalError(`Scrub of ${shownStackName} could not locate a scanned dynamic reference in ${ctx.origin}, in the value it was scanned from. Refusing rather than resolving it in ${displayIdent(ctx.stackRegion)}, which would be the wrong region for a reference that names another one. This is an internal invariant failure — please report it with the resource type and property path.`, "SCRUB_SECRET_TOKEN_SCAN_MISMATCH");
 		out += leaf.slice(cursor, at);
 		if (verdict.kind === "named-region") {
-			const resolver = ctx.resolvers.forRegion(verdict.region);
+			const resolver = "recorded" in verdict ? ctx.resolvers.forRecordedRegion(verdict.region) : ctx.resolvers.forRegion(verdict.region);
 			try {
 				out += await resolver.resolveDynamicReferences(token, {
 					template: { Resources: {} },
@@ -7131,7 +7143,7 @@ async function resolveForeignRegionTokens(leaf, stackName, ctx) {
 					recordedSecretValues: ctx.recordedSecretValues
 				});
 			} catch (err) {
-				throw unresolvableForeignScrubSecretError(ctx.origin, stackName, verdict.secretName, verdict.region, err, ctx.recordedSecretValues);
+				throw unresolvableForeignScrubSecretError(ctx.origin, stackName, verdict.secretName, verdict.region, err, ctx.recordedSecretValues, "recorded" in verdict);
 			}
 		} else {
 			out += token;
@@ -8044,7 +8056,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					producerRegions,
 					resolvers,
 					recordedSecretValues,
-					origin: `resource ${maskedIdent(logicalId, recordedSecretValues)}`
+					origin: `resource ${maskedIdent(logicalId, recordedSecretValues)}`,
+					recordedRegions: recordedReferenceRegions(state.resources?.[logicalId])
 				});
 				const resourceContext = resolverContext(recordedSecretValues);
 				await resolveCrossStackReads(resolveInput, resourceContext, crossStackReadOrigin("resource", "logical id", logicalId, recordedSecretValues));
@@ -8101,7 +8114,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					producerRegions,
 					resolvers,
 					recordedSecretValues,
-					origin: `orphan record ${maskedIdent(record.logicalId, recordedSecretValues)}`
+					origin: `orphan record ${maskedIdent(record.logicalId, recordedSecretValues)}`,
+					recordedRegions: recordedReferenceRegions(record.state)
 				});
 				const orphanContext = resolverContext(recordedSecretValues);
 				for (const [bagName, bagValue] of Object.entries(resolveInput)) {
@@ -8185,7 +8199,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					producerRegions,
 					resolvers,
 					recordedSecretValues: outputSecrets,
-					origin: `output ${maskedIdent(name, outputSecrets)}`
+					origin: `output ${maskedIdent(name, outputSecrets)}`,
+					recordedRegions: recordedOutputReferenceRegions(state, name)
 				});
 				const valueContext = resolverContext(outputSecrets);
 				await resolveCrossStackReads(valueSource, valueContext, crossStackReadOrigin("output", "output name", name, outputSecrets), { canRefuse: !isOutputSuppressed(name, output, conditions, state.outputs ?? {}) });
@@ -8327,7 +8342,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const scrubbed = secrets || templateProps ? scrubResourceRecord(positioned, ownSecrets, void 0, STATE_SOURCED_CROSS_GENERATION_RULES) : record;
 			const plan = noEchoPlans.byLogicalId.get(logicalId);
 			const migrationNeedles = scrubMigrationNeedles(plan, noEchoPublicTokens);
-			const written = applyScrubNoEcho(migrationNeedles === void 0 ? scrubbed : scrubResourceRecord(scrubbed, migrationNeedles, void 0, STATE_SOURCED_CROSS_GENERATION_RULES), record, plan);
+			const migrated = migrationNeedles === void 0 ? scrubbed : scrubResourceRecord(scrubbed, migrationNeedles, void 0, STATE_SOURCED_CROSS_GENERATION_RULES);
+			const written = keepHeldTokenProvenance(applyScrubNoEcho(migrated, record, plan));
 			if (JSON.stringify(written) !== JSON.stringify(record)) recordsChanged++;
 			newResources[logicalId] = written;
 		}
@@ -8336,7 +8352,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const needles = new Map(allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets));
 			for (const [plaintext, expression] of own ?? []) needles.set(plaintext, expression);
 			if (needles.size === 0) return record;
-			const scrubbed = scrubResourceRecord(record.state, needles, void 0, STATE_SOURCED_CROSS_GENERATION_RULES);
+			const scrubbed = keepHeldTokenProvenance(scrubResourceRecord(record.state, needles, void 0, STATE_SOURCED_CROSS_GENERATION_RULES));
 			if (JSON.stringify(scrubbed) === JSON.stringify(record.state)) return record;
 			recordsChanged++;
 			return {
@@ -9640,6 +9656,9 @@ var DriftSecretResolvers = class {
 		this.pinned.set(target, scoped);
 		return scoped;
 	}
+	forRecordedRegion(region) {
+		return this.primary.resolverForRecordedRegion(region);
+	}
 };
 var DriftSecretRefusalError = class DriftSecretRefusalError extends CdkdError {
 	driftSecretRefusal = true;
@@ -9691,9 +9710,10 @@ function regionAmbiguousDriftSecretError(logicalId, propertyPath, secretName, fo
 	const where = propertyPath === "" ? "" : ` property '${propertyPath}'`;
 	return new DriftSecretRefusalError(`${logicalId}${where}: the secret reference '${secretName}' carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.join(", ")}), so it may have been resolved in one of those rather than in '${consumerRegion}'. A secret of the same name in two regions is two independent values, so cdkd would compare against — and with --revert WRITE — the WRONG secret. Refusing instead. Spell the reference as a full ARN, which names its region and is resolved there, then re-run 'cdkd drift'.`, "DRIFT_SECRET_REGION_AMBIGUOUS");
 }
-function refuseUnprovenDriftSecret(leaf, propertyPath, logicalId, consumerRegion, evidence) {
+function refuseUnprovenDriftSecret(leaf, propertyPath, logicalId, consumerRegion, evidence, recordedRegions) {
 	if (evidence.complete) return;
 	for (const token of dynamicReferenceTokens(leaf)) {
+		if (recordedRegions?.has(token) === true) continue;
 		const name = classifyReplaySecretRegion(token, consumerRegion, evidence.regions).kind === "local" ? regionLessSecretName(token) : void 0;
 		if (name === void 0) continue;
 		const where = propertyPath === "" ? "" : ` property '${propertyPath}'`;
@@ -9747,17 +9767,17 @@ async function driftProducerRegionEvidence(state, stackName, region, stateBacken
 	const inherited = await driftProducerRegionEvidence(parent.state, parentName, parentRegion, stateBackend, depth + 1);
 	return inheritProducerRegions(own, inherited);
 }
-async function resolveDriftLeafByRegion(leaf, propertyPath, logicalId, consumerRegion, producerRegions, resolvers, ctx) {
-	const verdicts = dynamicReferenceTokens(leaf).map((token) => [token, classifyReplaySecretRegion(token, consumerRegion, producerRegions)]);
+async function resolveDriftLeafByRegion(leaf, propertyPath, logicalId, consumerRegion, producerRegions, resolvers, ctx, recordedRegions) {
+	const verdicts = dynamicReferenceTokens(leaf).map((token) => [token, classifyRecordedSecretRegion(token, consumerRegion, producerRegions, recordedRegions)]);
 	for (const [, verdict] of verdicts) if (verdict.kind === "ambiguous") throw regionAmbiguousDriftSecretError(logicalId, propertyPath, verdict.secretName, verdict.foreignProducerRegions, consumerRegion);
-	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region")) return await resolvers.primary.resolveDynamicReferences(leaf, ctx);
+	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region" || verdict.kind === "recorded-region")) return await resolvers.primary.resolveDynamicReferences(leaf, ctx);
 	let out = "";
 	let cursor = 0;
 	for (const [token, verdict] of verdicts) {
 		const at = leaf.indexOf(token, cursor);
 		if (at < 0) throw new DriftSecretRefusalError(`${logicalId}${propertyPath === "" ? "" : ` property '${propertyPath}'`}: could not locate a scanned dynamic reference in the value it was scanned from. Refusing rather than resolving it in '${consumerRegion}', which would be the wrong region for a reference that names another one. This is an internal invariant failure — please report it with the resource type and property path.`, "DRIFT_SECRET_TOKEN_SCAN_MISMATCH");
 		out += leaf.slice(cursor, at);
-		const resolver = verdict.kind === "named-region" ? resolvers.forRegion(verdict.region) : resolvers.primary;
+		const resolver = verdict.kind === "named-region" ? resolvers.forRegion(verdict.region) : verdict.kind === "recorded-region" ? resolvers.forRecordedRegion(verdict.region) : resolvers.primary;
 		out += await resolver.resolveDynamicReferences(token, ctx);
 		cursor = at + token.length;
 	}
@@ -9766,6 +9786,7 @@ async function resolveDriftLeafByRegion(leaf, propertyPath, logicalId, consumerR
 async function resolveStateSecretExpressions(props, resolvers, secrets, options) {
 	if (!containsDynamicReference$1(props)) return props;
 	const { secretPaths, onUnresolved, producerRegions, logicalId, consumerRegion } = options;
+	const recordedRegions = recordedReferenceRegions(options.record);
 	const ctx = {
 		template: { Resources: {} },
 		resources: {},
@@ -9774,8 +9795,8 @@ async function resolveStateSecretExpressions(props, resolvers, secrets, options)
 	const walk = async (v, path) => {
 		if (typeof v === "string") {
 			if (!v.includes("{{resolve:")) return v;
-			refuseUnprovenDriftSecret(v, path, logicalId, consumerRegion, producerRegions);
-			const resolved = await resolveDriftLeafByRegion(v, path, logicalId, consumerRegion, producerRegions.regions, resolvers, ctx);
+			refuseUnprovenDriftSecret(v, path, logicalId, consumerRegion, producerRegions, recordedRegions);
+			const resolved = await resolveDriftLeafByRegion(v, path, logicalId, consumerRegion, producerRegions.regions, resolvers, ctx, recordedRegions);
 			const survivors = survivingDynamicReferences(resolved).filter((t) => v.includes(t));
 			if (survivors.length > 0) onUnresolved?.(survivors, path);
 			if (carriesRecordedSecret(resolved, secrets)) secretPaths?.add(path);
@@ -10097,6 +10118,7 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 						onUnresolved: noteUnresolved,
 						logicalId,
 						consumerRegion: region,
+						record: resource,
 						producerRegions
 					});
 					if (useObserved) await resolveStateSecretExpressions(resource.properties ?? {}, secretResolvers, secrets, {
@@ -10104,6 +10126,7 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 						onUnresolved: noteUnresolved,
 						logicalId,
 						consumerRegion: region,
+						record: resource,
 						producerRegions
 					});
 				} catch (err) {
@@ -10842,12 +10865,14 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 							onUnresolved: noteUnresolved,
 							logicalId: outcome.logicalId,
 							consumerRegion: report.region,
+							record: stateResource,
 							producerRegions: revertProducerRegions
 						});
 						if (stateResource.observedProperties !== void 0) await resolveStateSecretExpressions(stateResource.properties ?? {}, revertSecretResolvers, secrets, {
 							onUnresolved: noteUnresolved,
 							logicalId: outcome.logicalId,
 							consumerRegion: report.region,
+							record: stateResource,
 							producerRegions: revertProducerRegions
 						});
 					} catch (err) {
@@ -10899,6 +10924,7 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 					try {
 						const updateResult = await withRetry(() => provider.update(outcome.logicalId, stateResource.physicalId, outcome.resourceType, newProperties, outcome.awsProperties, {
 							desiredFromAwsReadback: true,
+							declaredEmptyProperties: declaredEmptyProperties(stateResource.properties),
 							maskSecrets: createSecretMasker(secrets),
 							expectedRegion: report.region,
 							recordedAttributes: stateResource.attributes,
@@ -11382,6 +11408,21 @@ function otherPhysicalIds(resources, logicalId) {
 	for (const [id, record] of Object.entries(resources ?? {})) if (id !== logicalId && typeof record?.physicalId === "string") ids.push(record.physicalId);
 	return ids;
 }
+function declaredEmptyProperties(properties) {
+	const out = /* @__PURE__ */ new Set();
+	if (typeof properties !== "object" || properties === null || Array.isArray(properties)) return out;
+	const isEmpty = (v) => Array.isArray(v) && v.length === 0 || typeof v === "object" && v !== null && !Array.isArray(v) && Object.keys(v).length === 0;
+	for (const [key, value] of Object.entries(properties)) if (typeof value === "string") {
+		if (value.trim() === "") {
+			out.add(key);
+			continue;
+		}
+		try {
+			if (isEmpty(JSON.parse(value))) out.add(key);
+		} catch {}
+	} else if (isEmpty(value)) out.add(key);
+	return out;
+}
 
 //#endregion
 //#region src/cli/commands/stack-lock-guard.ts
@@ -11468,12 +11509,17 @@ async function acquireStackLock(opts) {
 //#endregion
 //#region src/provisioning/secret-principal-resolution.ts
 const TRANSIENT_RESOLUTION_MESSAGE = "Resolving a secret-derived IAM principal list was throttled or hit a server error";
-async function resolveSecretDerivedPrincipals(values, region, importedProducerRegions, makeResolver = (r) => new IntrinsicFunctionResolver(r)) {
+function resolvableVerdict(verdict) {
+	return verdict.kind === "local" || verdict.kind === "recorded-region";
+}
+async function resolveSecretDerivedPrincipals(values, region, importedProducerRegions, recordedRegions, makeResolver = (r) => new IntrinsicFunctionResolver(r)) {
 	if (!region) return void 0;
+	const stackRegion = region;
+	const verdictOf = (token) => classifyRecordedSecretRegion(token, stackRegion, importedProducerRegions, recordedRegions);
 	const entries = {};
 	for (const key of Object.keys(values)) {
 		const value = values[key];
-		if (!Array.isArray(value) || !value.every((entry) => typeof entry === "string" && !entry.includes("***") && (!entry.includes("{{resolve:") || dynamicReferenceTokens(entry).length > 0 && dynamicReferenceTokens(entry).every((t) => classifyReplaySecretRegion(t, region, importedProducerRegions).kind === "local")))) return;
+		if (!Array.isArray(value) || !value.every((entry) => typeof entry === "string" && !entry.includes("***") && (!entry.includes("{{resolve:") || dynamicReferenceTokens(entry).length > 0 && dynamicReferenceTokens(entry).every((t) => resolvableVerdict(verdictOf(t)))))) return;
 		entries[key] = value;
 	}
 	const secrets = /* @__PURE__ */ new Map();
@@ -11496,7 +11542,7 @@ async function resolveSecretDerivedPrincipals(values, region, importedProducerRe
 			let resolved;
 			try {
 				resolver ??= makeResolver(region);
-				resolved = await resolver.resolveDynamicReferences(entry, context);
+				resolved = await resolveEntry(entry, resolver, verdictOf, context);
 			} catch (error) {
 				if (isThrottlingError(error) || isTransientServerError(error)) throw new Error(TRANSIENT_RESOLUTION_MESSAGE, { cause: maskSecretsInError(error, secrets) });
 				return;
@@ -11516,6 +11562,21 @@ async function resolveSecretDerivedPrincipals(values, region, importedProducerRe
 		resolvedNames
 	};
 }
+async function resolveEntry(entry, primary, verdictOf, context) {
+	const tokens = dynamicReferenceTokens(entry).map((t) => [t, verdictOf(t)]);
+	if (!tokens.some(([, v]) => v.kind === "recorded-region")) return await primary.resolveDynamicReferences(entry, context);
+	let out = "";
+	let cursor = 0;
+	for (const [token, verdict] of tokens) {
+		const at = entry.indexOf(token, cursor);
+		if (at < 0) throw new Error("A scanned dynamic reference is not in the entry it was scanned from");
+		out += entry.slice(cursor, at);
+		const resolver = verdict.kind === "recorded-region" ? primary.resolverForRecordedRegion(verdict.region) : primary;
+		out += await resolver.resolveDynamicReferences(token, context);
+		cursor = at + token.length;
+	}
+	return out + entry.slice(cursor);
+}
 function isResolvableSecretPrincipalList(value) {
 	if (!Array.isArray(value) || !value.every((e) => typeof e === "string")) return false;
 	const entries = value;
@@ -12019,9 +12080,11 @@ async function runDestroyForStack(stackName, state, ctx) {
 					const timeoutMs = ctx.resourceTimeoutByType?.[resource.resourceType] ?? Math.max(providerMinTimeoutMs, slowTypeMinTimeoutMs, globalTimeoutMs);
 					let deleteResult;
 					let childLeftInAws = 0;
+					const recordedRegions = secretPrincipalRegions !== void 0 ? recordedReferenceRegions(resource) : void 0;
 					const secretPrincipalOptIn = secretPrincipalRegions !== void 0 ? {
 						importedProducerRegions: secretPrincipalRegions,
-						retryMemo: { detached: /* @__PURE__ */ new Set() }
+						retryMemo: { detached: /* @__PURE__ */ new Set() },
+						...recordedRegions !== void 0 && { recordedRegions }
 					} : void 0;
 					await withResourceDeadline(async () => {
 						const maxAttempts = provider.disableOuterRetry ? 0 : 3;
@@ -29343,4 +29406,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-BgsCaZFy.js.map
+//# sourceMappingURL=program-TA6lNkLr.js.map