@go-to-k/cdkd 0.299.3 → 0.299.4

package/dist/{deploy-engine-DEBgHf6Z.js → deploy-engine-DWIbDQdg.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-Bj7qH5Ph.js"
 import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, H as truncateCodePoints, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as terminalSafe, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
 import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-Pn2m0R67.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-DBXBcg0J.js";
-import { t as getCdkdVersion } from "./version-B7Gzz6TR.js";
+import { t as getCdkdVersion } from "./version-B-AQELPJ.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -5427,6 +5427,46 @@ async function readEarlierStateResources(s3, bucket, owner, key, max) {
 		}
 	}))).filter((r) => r !== void 0);
 }
+async function keyMayHaveVersions(s3, bucket, owner, key) {
+	try {
+		const listed = await s3.send(new ListObjectVersionsCommand({
+			Bucket: bucket,
+			...await owner(),
+			Prefix: key,
+			EncodingType: "url",
+			MaxKeys: 1
+		}));
+		return (listed.Versions ?? []).length + (listed.DeleteMarkers ?? []).length > 0 || listed.IsTruncated === true;
+	} catch {
+		return true;
+	}
+}
+async function listVersionedSubdirectories(s3, bucket, owner, prefix) {
+	const out = [];
+	let keyMarker;
+	let versionIdMarker;
+	for (;;) {
+		const listed = await s3.send(new ListObjectVersionsCommand({
+			Bucket: bucket,
+			...await owner(),
+			Prefix: prefix,
+			Delimiter: "/",
+			EncodingType: "url",
+			...keyMarker !== void 0 && { KeyMarker: keyMarker },
+			...versionIdMarker !== void 0 && { VersionIdMarker: versionIdMarker }
+		}));
+		for (const cp of listed.CommonPrefixes ?? []) {
+			const decoded = decodeListingKey(cp.Prefix);
+			if (decoded === void 0 || !decoded.startsWith(prefix)) continue;
+			const segment = decoded.slice(prefix.length).replace(/\/$/, "");
+			if (segment !== "") out.push(segment);
+		}
+		if (listed.IsTruncated !== true) return out;
+		if (listed.NextKeyMarker === void 0) throw new Error("a truncated version listing returned no NextKeyMarker");
+		keyMarker = decodeListingKey(listed.NextKeyMarker);
+		versionIdMarker = listed.NextVersionIdMarker;
+	}
+}
 
 //#endregion
 //#region src/state/retained-time.ts
@@ -5513,6 +5553,7 @@ function legacyProbeBelongsTo(probe, region) {
 }
 const KEPT_AT_CLOCK_TOLERANCE_MS = 2e3;
 const ROLLBACK_JOURNAL_OBJECT_DESCRIPTION = "the rollback journal, whose `failedOperations[].attemptedProperties` records the properties of the failed write verbatim";
+const STATE_RECORD_OBJECT_DESCRIPTION = "the stack's state record, which carries every resource's recorded properties and attributes";
 var S3StateBackend = class S3StateBackend {
 	logger = getLogger().child("S3StateBackend");
 	s3Client;
@@ -5767,6 +5808,49 @@ var S3StateBackend = class S3StateBackend {
 			await this.deleteRollbackJournal(stackName, region);
 		}
 	}
+	async purgeDeletedStateHistory(stackName, region) {
+		try {
+			await this.ensureClientForBucket();
+			const stateKey = this.getStateKey(stackName, region);
+			const shown = displayStackName(stackName);
+			let recordBack;
+			try {
+				recordBack = await this.headObject(stateKey);
+			} catch {
+				recordBack = true;
+			}
+			if (recordBack) {
+				this.logger.warn(safeMsg`Kept the earlier versions of the state record for ${shown}: the record exists again, or its absence could not be confirmed, so they may belong to a live record.`);
+				return;
+			}
+			const keys = [stateKey];
+			const legacyKey = this.getLegacyStateKey(stackName);
+			const mayHave = (key) => keyMayHaveVersions(this.s3Client, this.config.bucket, () => this.ownerParam(), key);
+			if (await mayHave(legacyKey)) {
+				const legacyProbe = await this.probeLegacyState(stackName);
+				const keptBecause = legacyProbe.kind === "unreadable" ? `the legacy record could not be read (${legacyProbe.reason})` : legacyProbe.kind !== "absent" ? "its current body belongs to another record of the stack" : await this.otherRegionHistoryState(stackName, region, mayHave);
+				if (keptBecause === "none") keys.push(legacyKey);
+				else {
+					const why = keptBecause === "exists" ? "another region of the stack still has state record versions, current or earlier, and the legacy versions may be that region's" : keptBecause === "unknown" ? "could not list the stack's other regions to confirm none of them still owns that history" : keptBecause;
+					this.logger.warn(safeMsg`Kept the earlier versions of the legacy state record for ${shown}: ${why}. cdkd state destroy purges them only once no other region of the stack has state record versions and the legacy record can be read; otherwise delete them by hand.`);
+				}
+			}
+			await this.purgeNoncurrentVersions(keys, { objectDescription: STATE_RECORD_OBJECT_DESCRIPTION });
+		} catch (error) {
+			this.logger.warn(safeMsg`Could not purge the earlier versions of the state record for ${displayStackName(stackName)}: ${describeAwsFailure(error).summary}. They remain readable via GetObject with a VersionId.`);
+		}
+	}
+	async otherRegionHistoryState(stackName, region, mayHave) {
+		const stackPrefix = `${this.config.prefix}/${stackName}/`;
+		try {
+			const regions = (await listVersionedSubdirectories(this.s3Client, this.config.bucket, () => this.ownerParam(), stackPrefix)).filter((segment) => segment !== region);
+			for (const other of regions) if (await mayHave(this.getStateKey(stackName, other))) return "exists";
+			return "none";
+		} catch (error) {
+			this.logger.debug(safeMsg`Could not list the other regions of ${displayStackName(stackName)}: ${displaySafe(describeAwsFailure(error).detail, { asciiOnly: true }) || "<unrenderable>"}`);
+			return "unknown";
+		}
+	}
 	async deleteLegacyState(stackName) {
 		await this.ensureClientForBucket();
 		const key = this.getLegacyStateKey(stackName);
@@ -7189,7 +7273,7 @@ const WHOLE_DYNAMIC_REFERENCE_PATTERN = new RegExp(`^\\{\\{resolve:${DYNAMIC_REF
 function isSingleDynamicReferenceToken(value) {
 	return WHOLE_DYNAMIC_REFERENCE_PATTERN.test(value);
 }
-function isPlainObject$5(value) {
+function isPlainObject$7(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
@@ -7438,7 +7522,7 @@ function crossStackSourceKey(source) {
 	}
 	if (key === "Fn::GetStackOutput") {
 		const args = source[key];
-		if (!isPlainObject$5(args)) return void 0;
+		if (!isPlainObject$7(args)) return void 0;
 		const stackName = Object.hasOwn(args, "StackName") ? literalStringOrUndefined(args["StackName"]) : void 0;
 		const outputName = Object.hasOwn(args, "OutputName") ? literalStringOrUndefined(args["OutputName"]) : void 0;
 		if (stackName === void 0 || outputName === void 0) return void 0;
@@ -7484,7 +7568,7 @@ function crossStackSourceKey(source) {
 		let template;
 		let variables;
 		if (typeof raw === "string") template = raw;
-		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$5(raw[1])) {
+		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$7(raw[1])) {
 			if (typeof raw[0] !== "string") return void 0;
 			template = raw[0];
 			variables = raw[1];
@@ -7727,12 +7811,12 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, rules = TEMPLATE_DERIVED_RULES) {
 	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$4) return;
 	if (secrets.size === 0) return;
-	if (!isPlainObject$5(resolvedProperties) || !isPlainObject$5(sourceProperties)) return;
+	if (!isPlainObject$7(resolvedProperties) || !isPlainObject$7(sourceProperties)) return;
 	if (!Object.hasOwn(resolvedProperties, "Parameters")) return;
 	if (!Object.hasOwn(sourceProperties, "Parameters")) return;
 	const resolvedParameters = resolvedProperties["Parameters"];
 	const sourceParameters = sourceProperties["Parameters"];
-	if (!isPlainObject$5(resolvedParameters) || !isPlainObject$5(sourceParameters)) return;
+	if (!isPlainObject$7(resolvedParameters) || !isPlainObject$7(sourceParameters)) return;
 	const positioned = redactSecretsForState(markSameGenerationBag({ ...resolvedParameters }), secrets, sourceParameters, rules);
 	let table = nestedStackParameterExpressions.get(secrets);
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
@@ -7781,7 +7865,7 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 		if (typeof resolvedValue !== "string") return void 0;
 		const sourceLeaf = sourceParameters[name];
 		if (typeof sourceLeaf === "string") return sourceLeaf;
-		if (!isPlainObject$5(sourceLeaf)) return void 0;
+		if (!isPlainObject$7(sourceLeaf)) return void 0;
 		const written = positioned[name];
 		if (typeof written !== "string") return void 0;
 		const rendered = intrinsicSkeletonSegments(sourceLeaf)?.map((s) => s === UNKNOWN_PART ? "\0" : s).join("");
@@ -7992,7 +8076,7 @@ function appendValuePlaceholderParts(value, out, budget, depth) {
 	if (budget.exhausted) return;
 	const literal = joinPartLiteralText(value);
 	if (literal !== void 0) return pushPlaceholderPart(out, literal, budget);
-	if (isPlainObject$5(value) && Object.keys(value).length === 1) {
+	if (isPlainObject$7(value) && Object.keys(value).length === 1) {
 		const ref = value["Ref"];
 		if (typeof ref === "string" && ref !== "") return pushPlaceholderPart(out, keyedPart({ Ref: ref }), budget);
 		if (depth >= MAX_PLACEHOLDER_DEPTH) {
@@ -8024,7 +8108,7 @@ function appendParameterPlaceholderParts(source, out, budget, depth) {
 		let template;
 		let variables = {};
 		if (typeof args === "string") template = args;
-		else if (Array.isArray(args) && args.length === 2 && isPlainObject$5(args[1])) {
+		else if (Array.isArray(args) && args.length === 2 && isPlainObject$7(args[1])) {
 			template = args[0];
 			variables = args[1];
 		} else return false;
@@ -8172,7 +8256,7 @@ function isUniquelyKeyedBy(items, key) {
 	if (items.length === 0) return false;
 	const seen = /* @__PURE__ */ new Set();
 	for (const item of items) {
-		if (!isPlainObject$5(item) || !Object.hasOwn(item, key)) return false;
+		if (!isPlainObject$7(item) || !Object.hasOwn(item, key)) return false;
 		const id = item[key];
 		if (typeof id !== "string" || id === "") return false;
 		if (seen.has(id)) return false;
@@ -8202,11 +8286,11 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		return positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration);
 	}
-	if ((typeof bag === "string" || Array.isArray(bag)) && isPlainObject$5(source)) {
+	if ((typeof bag === "string" || Array.isArray(bag)) && isPlainObject$7(source)) {
 		const inherited = positionByInheritedParameter(bag, source, secrets);
 		if (inherited !== void 0) return inherited;
 	}
-	if (typeof bag === "string" && isPlainObject$5(source)) {
+	if (typeof bag === "string" && isPlainObject$7(source)) {
 		const certified = positionByCrossStackSource(bag, source, secrets);
 		if (certified !== void 0) return certified;
 		const placeheld = positionByParameterPlaceholders(bag, source, secrets);
@@ -8216,7 +8300,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		const framed = positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIsSameGeneration);
 		if (framed !== void 0) return framed;
 	}
-	if (Array.isArray(bag) && isPlainObject$5(source)) {
+	if (Array.isArray(bag) && isPlainObject$7(source)) {
 		const positionedList = positionListByCrossStackSource(bag, source, secrets);
 		if (positionedList !== void 0) return positionedList;
 	}
@@ -8244,7 +8328,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration));
 	}
-	if (isPlainObject$5(bag) && hasPlainPrototype(bag) && isPlainObject$5(source)) {
+	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactSecretsForState(v, secrets);
 		return out;
@@ -8257,7 +8341,7 @@ function isReadbackProjectedFromState(rules) {
 function subtreeHasDynamicReference(value) {
 	if (isDynamicReferenceString(value)) return true;
 	if (Array.isArray(value)) return value.some(subtreeHasDynamicReference);
-	if (isPlainObject$5(value)) return Object.values(value).some(subtreeHasDynamicReference);
+	if (isPlainObject$7(value)) return Object.values(value).some(subtreeHasDynamicReference);
 	return false;
 }
 function pathCrossesDottedKey(bag, path) {
@@ -8332,8 +8416,8 @@ function deepEqualJsonValue(a, b) {
 		if (!Array.isArray(b) || a.length !== b.length) return false;
 		return a.every((item, i) => deepEqualJsonValue(item, b[i]));
 	}
-	if (isPlainObject$5(a)) {
-		if (!isPlainObject$5(b)) return false;
+	if (isPlainObject$7(a)) {
+		if (!isPlainObject$7(b)) return false;
 		if (!hasPlainPrototype(a) || !hasPlainPrototype(b)) return false;
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
@@ -8359,7 +8443,7 @@ function refuseUncertifiedSubtree(value, sourceLiterals, mark, seen = /* @__PURE
 		for (const item of value) out.push(refuseUncertifiedSubtree(item, sourceLiterals, mark, seen));
 		return out;
 	}
-	if (isPlainObject$5(value) && hasPlainPrototype(value)) {
+	if (isPlainObject$7(value) && hasPlainPrototype(value)) {
 		const out = Object.create(null);
 		seen.set(value, out);
 		for (const [k, v] of Object.entries(value)) out[k] = refuseUncertifiedSubtree(v, sourceLiterals, mark, seen);
@@ -8387,7 +8471,7 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 		return mark ? POSITION_DECIDED : source;
 	}
 	if (!subtreeHasDynamicReference(source)) return bag;
-	if (isPlainObject$5(bag) && hasPlainPrototype(bag) && isPlainObject$5(source)) {
+	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, failClosed, learn, mark) : v;
 		return out;
@@ -8414,14 +8498,14 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 function isDistinguishingAnchor(value) {
 	if (typeof value === "string") return value !== "";
 	if (Array.isArray(value)) return value.some(isDistinguishingAnchor);
-	if (isPlainObject$5(value)) return Object.values(value).some(isDistinguishingAnchor);
+	if (isPlainObject$7(value)) return Object.values(value).some(isDistinguishingAnchor);
 	return false;
 }
 const ANCHOR_REFERENCE_MASK = "<ref>";
 function anchorSignature(source) {
 	if (isDynamicReferenceString(source)) return ANCHOR_REFERENCE_MASK;
 	if (Array.isArray(source)) return `[${source.map(anchorSignature).sort().join(",")}]`;
-	if (isPlainObject$5(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
+	if (isPlainObject$7(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
 	return JSON.stringify(source) ?? "undefined";
 }
 function anchorsCorroboratePairing(bag, source, anchors) {
@@ -8431,8 +8515,8 @@ function anchorsCorroboratePairing(bag, source, anchors) {
 		return true;
 	}
 	if (isDynamicReferenceString(source)) return typeof bag === "string";
-	if (isPlainObject$5(source)) {
-		if (!isPlainObject$5(bag)) return false;
+	if (isPlainObject$7(source)) {
+		if (!isPlainObject$7(bag)) return false;
 		return Object.keys(source).every((k) => Object.hasOwn(bag, k) && anchorsCorroboratePairing(bag[k], source[k], anchors));
 	}
 	if (Array.isArray(source)) {
@@ -8523,13 +8607,13 @@ function learnMixedLeafNeedle(collector, bag, source) {
 	learnNeedle(collector, plaintext, token);
 }
 function asChild(marks, key) {
-	return isPlainObject$5(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
+	return isPlainObject$7(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
 }
 function asIndex(marks, index) {
 	return Array.isArray(marks) ? marks[index] : void 0;
 }
 function preferPositionDecisions(scanned, refused, bag, marks, inferred) {
-	if (isPlainObject$5(bag) && hasPlainPrototype(bag) && isPlainObject$5(refused) && isPlainObject$5(scanned)) {
+	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(refused) && isPlainObject$7(scanned)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(refused)) out[k] = preferPositionDecisions(scanned[k], v, bag[k], asChild(marks, k), inferred);
 		return out;
@@ -9039,6 +9123,11 @@ function passProvenanceFor(secrets, token) {
 	if (entry === void 0) return void 0;
 	return finalize(entry);
 }
+function passReadVersionsFor(secrets, token) {
+	if (secrets === void 0) return void 0;
+	const read = passProvenanceOf.get(secrets)?.get(token)?.readVersions;
+	return read === void 0 || read.size === 0 ? void 0 : read;
+}
 function finalize(entry) {
 	const out = {};
 	if (!entry.regionUnknown && entry.regions.size === 1) out.region = [...entry.regions][0];
@@ -9648,7 +9737,7 @@ function readsNoEchoSource(node, sources) {
 			if (typeof argument === "string") return subStringReadsNoEcho(argument, void 0, sources);
 			if (Array.isArray(argument)) {
 				const [text, variables] = argument;
-				const vars = isPlainObject$5(variables) ? variables : void 0;
+				const vars = isPlainObject$7(variables) ? variables : void 0;
 				if (typeof text === "string" && subStringReadsNoEcho(text, vars, sources)) return true;
 				return vars !== void 0 && Object.values(vars).some(walk);
 			}
@@ -9682,7 +9771,7 @@ function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
 		parameters: sources.parameters,
 		...sources.conditions !== void 0 && { conditions: sources.conditions }
 	};
-	const isBareDeclaredGetAtt = (node) => isPlainObject$5(node) && intrinsicKeyOf(node) === "Fn::GetAtt" && getAttReadsNoEcho(node["Fn::GetAtt"], sources);
+	const isBareDeclaredGetAtt = (node) => isPlainObject$7(node) && intrinsicKeyOf(node) === "Fn::GetAtt" && getAttReadsNoEcho(node["Fn::GetAtt"], sources);
 	const walk = (source, value, path) => {
 		if (value === void 0) return;
 		if (source === null || typeof source !== "object") return;
@@ -9698,7 +9787,7 @@ function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
 			const record = source;
 			const intrinsic = intrinsicKeyOf(record);
 			if (intrinsic === void 0) {
-				if (!isPlainObject$5(value)) {
+				if (!isPlainObject$7(value)) {
 					if (readsNoEchoSource(record, parametersOnly)) push(path, source);
 					return;
 				}
@@ -9746,7 +9835,7 @@ function maskWholeValue(value) {
 	if (value === null || value === void 0) return value;
 	if (typeof value === "string" && isSingleDynamicReferenceToken(value)) return value;
 	if (Array.isArray(value)) return value.map(maskWholeValue);
-	if (isPlainObject$5(value)) {
+	if (isPlainObject$7(value)) {
 		const out = {};
 		for (const [key, child] of Object.entries(value)) Object.defineProperty(out, key, {
 			value: maskWholeValue(child),
@@ -9769,7 +9858,7 @@ function readAt(bag, coordinate) {
 			node = node[segment];
 			continue;
 		}
-		if (!isPlainObject$5(node) || !Object.hasOwn(node, segment)) return {
+		if (!isPlainObject$7(node) || !Object.hasOwn(node, segment)) return {
 			found: false,
 			value: void 0
 		};
@@ -9785,7 +9874,7 @@ function valueAtCoordinate(bag, coordinate) {
 }
 function cloneContainer(node) {
 	if (Array.isArray(node)) return [...node];
-	if (isPlainObject$5(node)) return { ...node };
+	if (isPlainObject$7(node)) return { ...node };
 	return node;
 }
 function maskAtCoordinates(bag, coordinates) {
@@ -9852,20 +9941,20 @@ function readbackPathFor(readback, properties, coordinate) {
 			if (!Array.isArray(live)) return path.length === 0 ? void 0 : path;
 			const key = Array.isArray(desired) ? identityKeyFor(live, desired) : void 0;
 			const element = Array.isArray(desired) ? desired[segment] : void 0;
-			if (key === void 0 || !isPlainObject$5(element)) return path;
+			if (key === void 0 || !isPlainObject$7(element)) return path;
 			const identity = element[key];
-			const index = live.findIndex((item) => isPlainObject$5(item) && item[key] === identity);
+			const index = live.findIndex((item) => isPlainObject$7(item) && item[key] === identity);
 			if (index < 0) return path;
 			path.push(index);
 			live = live[index];
 			desired = element;
 			continue;
 		}
-		if (!isPlainObject$5(live)) return path.length === 0 ? void 0 : path;
+		if (!isPlainObject$7(live)) return path.length === 0 ? void 0 : path;
 		if (!Object.hasOwn(live, segment)) return void 0;
 		path.push(segment);
 		live = live[segment];
-		desired = isPlainObject$5(desired) ? desired[segment] : void 0;
+		desired = isPlainObject$7(desired) ? desired[segment] : void 0;
 	}
 	return path;
 }
@@ -9894,7 +9983,7 @@ function witnessNormalize(stored, today, v11) {
 	const confirmed = [];
 	const differing = [];
 	const walk = (s, t, v, path) => {
-		if (v !== "***" && containsMask(v) && (Array.isArray(v) ? !Array.isArray(s) || s.length !== v.length : isPlainObject$5(v) ? !isPlainObject$5(s) : false)) {
+		if (v !== "***" && containsMask(v) && (Array.isArray(v) ? !Array.isArray(s) || s.length !== v.length : isPlainObject$7(v) ? !isPlainObject$7(s) : false)) {
 			if (s === void 0 || containsMask(s)) return s;
 			if (jsonEqual(s, t)) {
 				confirmed.push(path);
@@ -9923,8 +10012,8 @@ function witnessNormalize(stored, today, v11) {
 			});
 			return changed ? out : s;
 		}
-		if (isPlainObject$5(v) && isPlainObject$5(s)) {
-			const tt = isPlainObject$5(t) ? t : {};
+		if (isPlainObject$7(v) && isPlainObject$7(s)) {
+			const tt = isPlainObject$7(t) ? t : {};
 			let out;
 			for (const key of Object.keys(v)) {
 				if (!Object.hasOwn(s, key)) continue;
@@ -9947,7 +10036,7 @@ function witnessNormalize(stored, today, v11) {
 function containsMask(value) {
 	if (value === "***") return true;
 	if (Array.isArray(value)) return value.some(containsMask);
-	if (isPlainObject$5(value)) return Object.values(value).some(containsMask);
+	if (isPlainObject$7(value)) return Object.values(value).some(containsMask);
 	return false;
 }
 function jsonEqual(a, b) {
@@ -9991,7 +10080,7 @@ function noEchoComparison(options) {
 					const out = node.map(walk);
 					return out.some((item, i) => item !== node[i]) ? out : node;
 				}
-				if (isPlainObject$5(node)) {
+				if (isPlainObject$7(node)) {
 					let out;
 					for (const [key, child] of Object.entries(node)) {
 						const next = walk(child);
@@ -12878,7 +12967,7 @@ function probeFoundSameId(resourceType, a, b) {
 //#region src/provisioning/config-shape.ts
 function readConfigString(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return fallback;
-	if (!isPlainObject$4(container) || isUnresolvedIntrinsicContainer(container)) {
+	if (!isPlainObject$6(container) || isUnresolvedIntrinsicContainer(container)) {
 		const detail = malformedShapeDetail(container);
 		if (options?.onUnusable) {
 			const named = fallback === "" ? "" : ` (${fallback})`;
@@ -12918,7 +13007,7 @@ function requireConfigArray(value, path, options) {
 	return value;
 }
 function requireConfigObject(value, path, options) {
-	if (!isPlainObject$4(value) || isUnresolvedIntrinsicContainer(value)) {
+	if (!isPlainObject$6(value) || isUnresolvedIntrinsicContainer(value)) {
 		const detail = malformedShapeDetail(value);
 		if (options?.onUnusable) {
 			options.onUnusable(`${path} must be an object ${detail}. Leaving this configuration unapplied here; the same value is REFUSED on a template-path create.`);
@@ -12930,7 +13019,7 @@ function requireConfigObject(value, path, options) {
 }
 function configStringRefusal(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$4(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$6(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	return configValueRefusal(container[key], fallback, `${containerPath}.${key}`, options);
 }
 function coerceCfnBoolean(value) {
@@ -12943,7 +13032,7 @@ function coerceCfnBoolean(value) {
 }
 function configBooleanRefusal(container, key, containerPath) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$4(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$6(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	if (coerceCfnBoolean(value) !== void 0) return void 0;
@@ -12957,7 +13046,7 @@ function coerceCfnInteger(value) {
 }
 function configIntegerRefusal(container, key, containerPath, min, max) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$4(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$6(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	const n = coerceCfnInteger(value);
@@ -12971,10 +13060,10 @@ function configValueRefusal(value, fallback, path, options) {
 	if (typeof value !== "string" || value.trim() === "") return `${path} must be a non-empty string ${malformedShapeDetail(value)}`;
 }
 function malformedShapeDetail(value) {
-	if (isPlainObject$4(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
+	if (isPlainObject$6(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
 	return `(got ${describe(value)}) — check for an unresolved intrinsic or a mis-nested template value`;
 }
-function isPlainObject$4(value) {
+function isPlainObject$6(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 const NAMEABLE_INTRINSIC_KEYS = /* @__PURE__ */ new Set([
@@ -13001,7 +13090,7 @@ function describe(value) {
 	if (value === null) return "null";
 	if (Array.isArray(value)) return "an array";
 	if (typeof value === "string") return value.trim() === "" ? "a blank string" : "a string";
-	if (isPlainObject$4(value) && isUnresolvedIntrinsicContainer(value)) {
+	if (isPlainObject$6(value) && isUnresolvedIntrinsicContainer(value)) {
 		const key = Object.keys(value)[0];
 		return NAMEABLE_INTRINSIC_KEYS.has(key) ? `an unresolved ${key} intrinsic` : "an unresolved intrinsic";
 	}
@@ -17891,7 +17980,7 @@ function maskedPropertyFingerprint(templateValue) {
 	return `${FINGERPRINT_PREFIX}${digest}`;
 }
 var UnknownInput = class extends Error {};
-function isPlainObject$3(value) {
+function isPlainObject$5(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 const DYNAMIC_REFERENCE_OPEN = "{{resolve:";
@@ -17911,7 +18000,7 @@ function carriesSecretValue(value, corpora) {
 	return false;
 }
 function parameterInputsFor(args) {
-	const declared = isPlainObject$3(args.template.Parameters) ? args.template.Parameters : {};
+	const declared = isPlainObject$5(args.template.Parameters) ? args.template.Parameters : {};
 	const values = args.values ?? {};
 	const inputs = /* @__PURE__ */ new Map();
 	const bound = {};
@@ -17922,7 +18011,7 @@ function parameterInputsFor(args) {
 			continue;
 		}
 		const value = values[name];
-		let secret = isPlainObject$3(definition) && declaresNoEcho(definition) || carriesSecretValue(value, []);
+		let secret = isPlainObject$5(definition) && declaresNoEcho(definition) || carriesSecretValue(value, []);
 		if (!secret && args.nestedChild === true && args.supplied !== void 0) {
 			if (Object.hasOwn(args.supplied, name)) {
 				const passed = args.passedClasses?.get(name);
@@ -17973,7 +18062,7 @@ function intrinsicKey(value) {
 const OPAQUE_ATTRIBUTE_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::CustomResource", NESTED_STACK_TYPE$4]);
 function hasOpaqueAttributes(logicalId, walk) {
 	const definition = walk.resources[logicalId];
-	const type = isPlainObject$3(definition) ? definition["Type"] : void 0;
+	const type = isPlainObject$5(definition) ? definition["Type"] : void 0;
 	return typeof type === "string" && (type.startsWith("Custom::") || OPAQUE_ATTRIBUTE_TYPES.has(type));
 }
 function getAttTarget(operand) {
@@ -17998,7 +18087,7 @@ function taintOf(logicalId, walk) {
 	const visit = (value) => {
 		if (typeof value === "string") return value.includes(DYNAMIC_REFERENCE_OPEN);
 		if (Array.isArray(value)) return value.some(visit);
-		if (!isPlainObject$3(value)) return false;
+		if (!isPlainObject$5(value)) return false;
 		const key = intrinsicKey(value);
 		const operand = key === void 0 ? void 0 : value[key];
 		let verdict = "clean";
@@ -18010,7 +18099,7 @@ function taintOf(logicalId, walk) {
 		else if (key === "Fn::FindInMap" && mapReadClass(operand, walk.sources.template) !== "clean") verdict = "tainted";
 		else if (key === "Fn::Sub") {
 			const text = Array.isArray(operand) ? operand[0] : operand;
-			const vars = Array.isArray(operand) && isPlainObject$3(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$5(operand[1]) ? operand[1] : {};
 			if (typeof text === "string") for (const name of subPlaceholders(text)) {
 				if (Object.hasOwn(vars, name)) continue;
 				const owner = name.includes(".") ? name.split(".")[0] : name;
@@ -18024,7 +18113,7 @@ function taintOf(logicalId, walk) {
 		return Object.values(value).some(visit);
 	};
 	const definition = walk.resources[logicalId];
-	const result = visit(isPlainObject$3(definition) ? definition["Properties"] : void 0) ? "tainted" : unknown ? "unknown" : "clean";
+	const result = visit(isPlainObject$5(definition) ? definition["Properties"] : void 0) ? "tainted" : unknown ? "unknown" : "clean";
 	walk.inProgress.delete(logicalId);
 	walk.taint.set(logicalId, result);
 	return result;
@@ -18040,7 +18129,7 @@ function conditionInput(name, walk) {
 	return typeof verdict === "boolean" ? verdict : "unknown";
 }
 function conditionClosure(name, walk) {
-	const definitions = isPlainObject$3(walk.sources.template.Conditions) ? walk.sources.template.Conditions : {};
+	const definitions = isPlainObject$5(walk.sources.template.Conditions) ? walk.sources.template.Conditions : {};
 	let secret = false;
 	let unknown = false;
 	let unread = false;
@@ -18055,7 +18144,7 @@ function conditionClosure(name, walk) {
 			value.forEach(visit);
 			return;
 		}
-		if (!isPlainObject$3(value)) return;
+		if (!isPlainObject$5(value)) return;
 		const keys = Object.keys(value);
 		if (keys.length === 1 && keys[0] === "Condition" && typeof value["Condition"] === "string") {
 			pending.push(value["Condition"]);
@@ -18088,7 +18177,7 @@ function conditionClosure(name, walk) {
 		if (key === "Fn::Sub") {
 			const operand = value["Fn::Sub"];
 			const text = Array.isArray(operand) ? operand[0] : operand;
-			const vars = Array.isArray(operand) && isPlainObject$3(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$5(operand[1]) ? operand[1] : {};
 			if (typeof text === "string") for (const name of subPlaceholders(text)) {
 				if (Object.hasOwn(vars, name)) continue;
 				if (name.includes(".") && !name.startsWith("AWS::")) secret = true;
@@ -18117,8 +18206,8 @@ function mapReadClass(operand, template) {
 	const mapName = Array.isArray(operand) ? operand[0] : void 0;
 	if (typeof mapName !== "string") return "unknown";
 	const mappings = template.Mappings;
-	const map = isPlainObject$3(mappings) && Object.hasOwn(mappings, mapName) ? mappings[mapName] : void 0;
-	if (!isPlainObject$3(map)) return "unknown";
+	const map = isPlainObject$5(mappings) && Object.hasOwn(mappings, mapName) ? mappings[mapName] : void 0;
+	if (!isPlainObject$5(map)) return "unknown";
 	return carriesSecretValue(map, []) ? "secret" : "clean";
 }
 async function resolvedInput(node, walk) {
@@ -18186,7 +18275,7 @@ async function inputForm(value, walk) {
 			concrete: parts.every((p) => p.concrete)
 		};
 	}
-	if (!isPlainObject$3(value)) return {
+	if (!isPlainObject$5(value)) return {
 		form: value,
 		concrete: true
 	};
@@ -18249,7 +18338,7 @@ async function inputForm(value, walk) {
 					concrete: false
 				};
 			}
-			const explicit = Array.isArray(operand) && isPlainObject$3(operand[1]) ? operand[1] : {};
+			const explicit = Array.isArray(operand) && isPlainObject$5(operand[1]) ? operand[1] : {};
 			const vars = await inputForm(explicit, walk);
 			const placeholders = [];
 			let concrete = vars.concrete && !text.includes(DYNAMIC_REFERENCE_OPEN);
@@ -18302,8 +18391,8 @@ function newWalk(sources, nested = {
 }) {
 	return {
 		sources,
-		resources: isPlainObject$3(sources.template.Resources) ? sources.template.Resources : {},
-		parameters: isPlainObject$3(sources.template.Parameters) ? sources.template.Parameters : {},
+		resources: isPlainObject$5(sources.template.Resources) ? sources.template.Resources : {},
+		parameters: isPlainObject$5(sources.template.Parameters) ? sources.template.Parameters : {},
 		taint: /* @__PURE__ */ new Map(),
 		inProgress: /* @__PURE__ */ new Set(),
 		stackChain: nested.stackChain,
@@ -18327,34 +18416,34 @@ function passedKey(passed) {
 function isNestedStackRow(logicalId, walk) {
 	if (!Object.hasOwn(walk.resources, logicalId)) return false;
 	const definition = walk.resources[logicalId];
-	return isPlainObject$3(definition) && definition["Type"] === NESTED_STACK_TYPE$4;
+	return isPlainObject$5(definition) && definition["Type"] === NESTED_STACK_TYPE$4;
 }
 function getAttAttribute(operand, target) {
 	if (Array.isArray(operand)) return operand.length === 2 && typeof operand[1] === "string" ? operand[1] : void 0;
 	return typeof operand === "string" ? operand.slice(target.length + 1) : void 0;
 }
 function rowParameters(definition) {
-	const properties = isPlainObject$3(definition) ? definition["Properties"] : void 0;
+	const properties = isPlainObject$5(definition) ? definition["Properties"] : void 0;
 	if (properties === void 0) return {};
-	if (!isPlainObject$3(properties)) return "unknown";
+	if (!isPlainObject$5(properties)) return "unknown";
 	const parameters = properties["Parameters"];
 	if (parameters === void 0) return {};
-	if (!isPlainObject$3(parameters) || intrinsicKey(parameters) !== void 0) return "unknown";
+	if (!isPlainObject$5(parameters) || intrinsicKey(parameters) !== void 0) return "unknown";
 	return parameters;
 }
 function childParameterInputs(template, passed) {
-	const declared = isPlainObject$3(template.Parameters) ? template.Parameters : {};
+	const declared = isPlainObject$5(template.Parameters) ? template.Parameters : {};
 	const inputs = /* @__PURE__ */ new Map();
 	for (const name of Object.keys(declared)) {
 		const definition = declared[name];
-		if (isPlainObject$3(definition) && declaresNoEcho(definition)) inputs.set(name, { kind: "secret" });
+		if (isPlainObject$5(definition) && declaresNoEcho(definition)) inputs.set(name, { kind: "secret" });
 		else if (passed.has(name)) {
 			const passedClass = passed.get(name);
 			inputs.set(name, passedClass === "clean" ? {
 				kind: "value",
 				value: void 0
 			} : passedClass === "unknown" ? { kind: "unknown" } : { kind: "secret" });
-		} else if (isPlainObject$3(definition) && Object.hasOwn(definition, "Default") && !carriesSecretValue(definition["Default"], [])) inputs.set(name, {
+		} else if (isPlainObject$5(definition) && Object.hasOwn(definition, "Default") && !carriesSecretValue(definition["Default"], [])) inputs.set(name, {
 			kind: "value",
 			value: definition["Default"]
 		});
@@ -18371,7 +18460,7 @@ function closureClass(closure) {
 	return closure.unread ? "unread" : "clean";
 }
 async function childOutputClass(loaded, outputName, passed, chain, shared) {
-	if (loaded === void 0 || !isPlainObject$3(loaded.template)) return "unknown";
+	if (loaded === void 0 || !isPlainObject$5(loaded.template)) return "unknown";
 	const scopeKey = JSON.stringify([loaded.identity, passedKey(passed)]);
 	const memoKey = JSON.stringify([scopeKey, outputName]);
 	const memo = shared.outputs.get(memoKey);
@@ -18384,8 +18473,8 @@ async function classifyChildOutput(loaded, outputName, passed, chain, shared, sc
 	if (++shared.steps > MAX_NESTED_OUTPUT_STEPS) return "unknown";
 	if (chain.includes(loaded.identity) || chain.length >= MAX_NESTED_OUTPUT_DEPTH) return "unknown";
 	const template = loaded.template;
-	const output = (isPlainObject$3(template.Outputs) ? template.Outputs : {})[outputName];
-	if (!isPlainObject$3(output) || !Object.hasOwn(output, "Value")) return "unknown";
+	const output = (isPlainObject$5(template.Outputs) ? template.Outputs : {})[outputName];
+	if (!isPlainObject$5(output) || !Object.hasOwn(output, "Value")) return "unknown";
 	const scope = {
 		walk: newWalk({
 			template,
@@ -18457,7 +18546,7 @@ async function expressionClass(value, scope) {
 		return result;
 	};
 	if (Array.isArray(value)) return all(value);
-	if (!isPlainObject$3(value)) return "clean";
+	if (!isPlainObject$5(value)) return "clean";
 	const key = intrinsicKey(value);
 	if (key === void 0) return all(Object.values(value));
 	const operand = value[key];
@@ -18472,7 +18561,7 @@ async function expressionClass(value, scope) {
 		case "Fn::Sub": {
 			const text = Array.isArray(operand) ? operand[0] : operand;
 			if (typeof text !== "string") return worseOf("unknown", await expressionClass(operand, scope));
-			const vars = Array.isArray(operand) && isPlainObject$3(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$5(operand[1]) ? operand[1] : {};
 			let result = text.includes(DYNAMIC_REFERENCE_OPEN) ? "secret" : "clean";
 			result = worseOf(result, await all(Object.values(vars)));
 			for (const name of subPlaceholders(text)) {
@@ -18550,7 +18639,7 @@ async function classifyPassedParameters(parameters, sources) {
 }
 async function classifyPassed(parameters, sources, nested) {
 	const classes = /* @__PURE__ */ new Map();
-	if (!isPlainObject$3(parameters)) return classes;
+	if (!isPlainObject$5(parameters)) return classes;
 	for (const [name, expression] of Object.entries(parameters)) {
 		let passedClass;
 		try {
@@ -18591,7 +18680,7 @@ function possiblyMaskedKeys(resolvedProps, corpora) {
 	const wholeShortLeaf = (value) => {
 		if (typeof value === "string") return short.includes(value);
 		if (Array.isArray(value)) return value.some(wholeShortLeaf);
-		if (isPlainObject$3(value)) return Object.values(value).some(wholeShortLeaf);
+		if (isPlainObject$5(value)) return Object.values(value).some(wholeShortLeaf);
 		return false;
 	};
 	return Object.keys(resolvedProps).filter((key) => {
@@ -18622,7 +18711,7 @@ function maskedPropertyFingerprintsOf(record) {
 	const read = /* @__PURE__ */ new Map();
 	if (record === null || typeof record !== "object") return read;
 	const field = record.maskedPropertyFingerprints;
-	if (!isPlainObject$3(field)) return read;
+	if (!isPlainObject$5(field)) return read;
 	for (const [key, value] of Object.entries(field)) if (typeof value === "string" && value.startsWith(FINGERPRINT_PREFIX)) read.set(key, value);
 	return read;
 }
@@ -18630,7 +18719,7 @@ function maskedPropertyInputFingerprintsOf(record) {
 	const read = /* @__PURE__ */ new Map();
 	if (record === null || typeof record !== "object") return read;
 	const field = record.maskedPropertyInputFingerprints;
-	if (!isPlainObject$3(field)) return read;
+	if (!isPlainObject$5(field)) return read;
 	const text = maskedPropertyFingerprintsOf(record);
 	for (const [key, value] of Object.entries(field)) {
 		if (typeof value !== "string" || !value.startsWith(INPUT_FINGERPRINT_PREFIX)) continue;
@@ -18677,7 +18766,7 @@ async function movedMaskedProperties(record, templateProps, fingerprinter, onReb
 function withRebaselinedFingerprints(record, fingerprints) {
 	const text = maskedPropertyFingerprintsOf(record);
 	const field = record.maskedPropertyInputFingerprints;
-	const next = isPlainObject$3(field) ? Object.entries(field) : [];
+	const next = isPlainObject$5(field) ? Object.entries(field) : [];
 	let changed = false;
 	for (const [key, value] of Object.entries(fingerprints)) {
 		if (text.get(key) !== splitInputFingerprint(value).text) continue;
@@ -18710,10 +18799,10 @@ function withMaskedPropertyFingerprints(scrubbed, writtenBag, templateProps, sec
 		fingerprints = maskedPropertyFingerprintsFor(scrubbed.properties, templateProps);
 		inputs = boundInputFingerprints(fingerprints, inputFingerprints);
 	} else {
-		if (!isPlainObject$3(previous)) return scrubbed;
+		if (!isPlainObject$5(previous)) return scrubbed;
 		if (corpora.length === 0) return scrubbed;
 		fingerprints = { ...previous };
-		inputs = isPlainObject$3(previousInputs) ? { ...previousInputs } : void 0;
+		inputs = isPlainObject$5(previousInputs) ? { ...previousInputs } : void 0;
 	}
 	if (fingerprints !== void 0 && corpora.length > 0) {
 		const refused = Object.keys(fingerprints).filter((key) => Object.hasOwn(templateProps, key) && corpora.some((corpus) => templateCarriesNeedle(templateProps[key], corpus)));
@@ -19697,11 +19786,11 @@ function validReferenceRegion(region) {
 	if (typeof region !== "string") return void 0;
 	return canonicalizeRegion(region) === region && isClientSafeRegion(region) ? region : void 0;
 }
-function isPlainObject$2(value) {
+function isPlainObject$4(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function validateReferenceProvenance(token, raw) {
-	if (!isSingleDynamicReferenceToken(token) || !isPlainObject$2(raw)) return void 0;
+	if (!isSingleDynamicReferenceToken(token) || !isPlainObject$4(raw)) return void 0;
 	const versionsRaw = Object.hasOwn(raw, "versions") ? raw["versions"] : void 0;
 	const readRaw = Object.hasOwn(raw, "readVersions") ? raw["readVersions"] : void 0;
 	if (readRaw !== void 0) {
@@ -19719,11 +19808,11 @@ function validateReferenceProvenance(token, raw) {
 	return out;
 }
 function referenceProvenanceOf(record) {
-	if (!isPlainObject$2(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	if (!isPlainObject$4(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
 	return validatedBag(record["referenceProvenance"]);
 }
 function validatedBag(field) {
-	if (!isPlainObject$2(field)) return void 0;
+	if (!isPlainObject$4(field)) return void 0;
 	const out = Object.create(null);
 	for (const [token, raw] of Object.entries(field)) {
 		const entry = validateReferenceProvenance(token, raw);
@@ -19732,9 +19821,9 @@ function validatedBag(field) {
 	return { ...out };
 }
 function recordedProvenanceOf(record, token) {
-	if (!isPlainObject$2(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	if (!isPlainObject$4(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
 	const field = record["referenceProvenance"];
-	if (!isPlainObject$2(field) || !Object.hasOwn(field, token)) return void 0;
+	if (!isPlainObject$4(field) || !Object.hasOwn(field, token)) return void 0;
 	return validateReferenceProvenance(token, field[token]);
 }
 function recordedReferenceRegions(record) {
@@ -19756,7 +19845,7 @@ function regionsOf(field) {
 function keepHeldTokenProvenance(record) {
 	if (!hasReferenceProvenanceField(record)) return record;
 	const field = record.referenceProvenance;
-	if (!isPlainObject$2(field)) return record;
+	if (!isPlainObject$4(field)) return record;
 	const held = recordReferenceTokens(record);
 	const keys = Object.keys(field);
 	if (keys.every((token) => held.has(token))) return record;
@@ -19768,12 +19857,12 @@ function keepHeldTokenProvenance(record) {
 	};
 }
 function hasReferenceProvenanceField(record) {
-	return isPlainObject$2(record) && Object.hasOwn(record, "referenceProvenance") && record["referenceProvenance"] !== void 0;
+	return isPlainObject$4(record) && Object.hasOwn(record, "referenceProvenance") && record["referenceProvenance"] !== void 0;
 }
 function outputReferenceProvenanceOf(state, outputKey) {
-	if (!isPlainObject$2(state) || !Object.hasOwn(state, "outputReferenceProvenance")) return;
+	if (!isPlainObject$4(state) || !Object.hasOwn(state, "outputReferenceProvenance")) return;
 	const field = state["outputReferenceProvenance"];
-	if (!isPlainObject$2(field) || !Object.hasOwn(field, outputKey)) return void 0;
+	if (!isPlainObject$4(field) || !Object.hasOwn(field, outputKey)) return void 0;
 	return validatedBag(field[outputKey]);
 }
 function persistable(token, entry) {
@@ -19791,7 +19880,7 @@ function tokensUnderPaths(properties, paths) {
 			for (const item of value) descend(item, path, next);
 			return;
 		}
-		if (isPlainObject$2(value) && Object.hasOwn(value, path[at])) descend(value[path[at]], path, at + 1);
+		if (isPlainObject$4(value) && Object.hasOwn(value, path[at])) descend(value[path[at]], path, at + 1);
 	};
 	for (const path of paths) descend(properties, path, 0);
 	return out;
@@ -19834,7 +19923,7 @@ function unionWithPrevious(pass, before) {
 }
 function outputProvenanceForPersist(args) {
 	const { outputs, resolvedThisRun, carriedFrom, sinkOf } = args;
-	if (!resolvedThisRun) return carriedFrom !== void 0 && isPlainObject$2(carriedFrom.outputReferenceProvenance) ? carriedFrom.outputReferenceProvenance : void 0;
+	if (!resolvedThisRun) return carriedFrom !== void 0 && isPlainObject$4(carriedFrom.outputReferenceProvenance) ? carriedFrom.outputReferenceProvenance : void 0;
 	let out;
 	for (const [outputKey, value] of Object.entries(outputs)) {
 		const sink = sinkOf(outputKey);
@@ -19868,20 +19957,37 @@ function tokensOf(value) {
 }
 function recordedTokenRoutes(value, record) {
 	if (!hasReferenceProvenanceField(record)) return void 0;
+	return routesOf(tokensOf(value), (token) => recordedProvenanceOf(record, token));
+}
+function provenanceTokenRoutes(value, bag) {
+	if (bag === void 0) return void 0;
+	return routesOf(tokensOf(value), (token) => Object.hasOwn(bag, token) ? bag[token] : void 0);
+}
+function routesOf(tokens, entryOf) {
 	const routes = /* @__PURE__ */ new Map();
 	let recorded = false;
-	for (const token of tokensOf(value)) {
-		const entry = recordedProvenanceOf(record, token);
+	for (const token of tokens) {
+		const entry = entryOf(token);
 		const region = entry?.region;
 		const pin = entry?.versions?.length === 1 ? entry.versions[0] : void 0;
 		if (region !== void 0 || pin !== void 0) recorded = true;
 		routes.set(token, {
 			region,
-			pin
+			pin,
+			...entry?.versions !== void 0 && { versions: entry.versions }
 		});
 	}
 	return recorded ? routes : void 0;
 }
+function recordedTokenVersions(value, record) {
+	if (!hasReferenceProvenanceField(record)) return void 0;
+	let out;
+	for (const token of tokensOf(value)) {
+		const versions = recordedProvenanceOf(record, token)?.versions;
+		if (versions !== void 0 && versions.length > 0) (out ??= /* @__PURE__ */ new Map()).set(token, versions);
+	}
+	return out;
+}
 async function reresolveByRecordedRoutes(resolver, value, logicalId, context, origin, sourceKey, routes, defaults) {
 	const tokens = [...routes.keys()];
 	const regionOf = (token) => routes.get(token)?.region ?? defaults.region;
@@ -19918,9 +20024,12 @@ async function reresolveByRecordedRoutes(resolver, value, logicalId, context, or
 			return value;
 		}
 	}
-	const walkContext = pins.size > 0 ? {
+	const readVersions = /* @__PURE__ */ new Map();
+	for (const [token, route] of routes) if (route.versions !== void 0 && route.versions.length > 0) readVersions.set(token, route.versions);
+	const walkContext = pins.size > 0 || readVersions.size > 0 ? {
 		...context,
-		referencePins: pins
+		...pins.size > 0 && { referencePins: pins },
+		...readVersions.size > 0 && { recordedReadVersions: readVersions }
 	} : context;
 	const regions = new Set(tokens.map((token) => regionOf(token) ?? ""));
 	if (regions.size <= 1) {
@@ -20545,7 +20654,11 @@ async function reresolveRecordedReferences(value, logicalId, context, origin, so
 		servingAsRecordedLine();
 		return value;
 	}
-	return await this.reresolveCrossStackValue(value, void 0, context, origin, sourceKey);
+	const readVersions = recordedTokenVersions(value, record);
+	return await this.reresolveCrossStackValue(value, void 0, readVersions === void 0 ? context : {
+		...context,
+		recordedReadVersions: readVersions
+	}, origin, sourceKey);
 }
 async function referencesMatchPhysicalId(value, logicalId, context, routeOf) {
 	const record = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
@@ -20800,6 +20913,13 @@ function healMaskedOwnIdAttribute(logicalId, resource, attributeName, stored, co
 //#endregion
 //#region src/deployment/intrinsic-resolver/cross-stack.ts
 async function reresolveCrossStackValue(value, producerRegion, context, origin, sourceKey, producerOutput, producerRegionLogText) {
+	if (context.crossStackReads !== void 0 && producerOutput !== void 0 && producerOutput.crossAccount !== true && sourceKey !== void 0) context.crossStackReads.set(sourceKey, {
+		stackName: producerOutput.stackName,
+		region: producerOutput.region || this.resolverRegion || "",
+		outputKey: producerOutput.outputKey,
+		carriesToken: carriesDynamicReference(value),
+		...producerOutput.state !== void 0 && { state: producerOutput.state }
+	});
 	if (carriesSecretMask(value)) {
 		const recovered = producerOutput === void 0 || producerOutput.crossAccount === true ? void 0 : recoverMaskedOutput(credentialFingerprint(ambientCredentialConfig()), producerOutput.stackName, producerOutput.region, producerOutput.outputKey);
 		if (recovered !== void 0) {
@@ -20824,11 +20944,16 @@ async function reresolveCrossStackValue(value, producerRegion, context, origin,
 	if (context.recordedSecretValues !== void 0 && producerOutput !== void 0 && producerOutput.crossAccount !== true && context.stateBackend !== void 0 && context.skipDynamicReferences !== true) {
 		const plain = [...wholeStringLeavesOf(value)].filter((leaf) => !leaf.includes("{{resolve:") && !carriesSecretMask(leaf));
 		if (plain.length > 0) {
-			const ids = await producerPhysicalIds(context.recordedImports ?? context.recordedSecretValues, context.stateBackend, producerOutput.stackName, producerOutput.region || this.resolverRegion, () => this.logger.debug(safeMsg`Could not read the state of producer ${this.displayMasked(producerOutput.stackName, context)} for its physical ids; no cross-stack copy of one is kept (go-to-k/cdkd#4819)`));
+			const ids = physicalIdsOf(await producerStateOnce(this.resolverRegion, context, producerOutput, () => this.logger.debug(safeMsg`Could not read the state of producer ${this.displayMasked(producerOutput.stackName, context)} for its physical ids; no cross-stack copy of one is kept (go-to-k/cdkd#4819)`)));
 			for (const leaf of plain) if (ids.has(leaf)) recordPhysicalNameCopy(context.recordedSecretValues, leaf);
 		}
 	}
 	if (!carriesDynamicReference(value)) return value;
+	if (producerOutput !== void 0 && producerOutput.crossAccount !== true && context.recordedSecretValues !== void 0 && context.skipDynamicReferences !== true && context.provenanceCapture !== true) {
+		const state = await producerStateOnce(this.resolverRegion, context, producerOutput, () => this.logger.debug(safeMsg`Could not read the state of producer ${this.displayMasked(producerOutput.stackName, context)} for its recorded secret versions; its output is resolved at the current version`));
+		const routes = provenanceTokenRoutes(value, outputReferenceProvenanceOf(state, producerOutput.outputKey));
+		if (routes !== void 0) return await reresolveByRecordedRoutes(this, value, producerOutput.stackName, context, origin, sourceKey, routes, { region: producerRegion || void 0 });
+	}
 	const resolver = this.resolverForProducerRegion(producerRegion, context, producerRegionLogText);
 	const pinnedContext = {
 		...producerRegion ? withoutProducerRegions(context) : context,
@@ -20917,7 +21042,8 @@ async function resolveImportValue(importValueArg, context) {
 				found = {
 					value,
 					refStack,
-					lookupRegion
+					lookupRegion,
+					state
 				};
 				break;
 			}
@@ -20929,7 +21055,8 @@ async function resolveImportValue(importValueArg, context) {
 	if (found) return await this.reresolveCrossStackValue(found.value, found.lookupRegion, context, `Fn::ImportValue ${quotedRender(this.displayLeaf(exportName, context), "'")} (producer ${this.displayLeaf(found.refStack, context)} / ${this.displayLeaf(found.lookupRegion, context)})`, sourceKey, {
 		stackName: found.refStack,
 		region: found.lookupRegion,
-		outputKey: exportName
+		outputKey: exportName,
+		state: found.state
 	});
 	if (this.cfnFallback) {
 		const cfnExport = await this.lookupCfnExport(exportName, context);
@@ -20949,32 +21076,60 @@ function recordImport(context, exportName, producerStack, producerRegion) {
 		sourceRegion: producerRegion
 	});
 }
-const producerPhysicalIdReads = /* @__PURE__ */ new WeakMap();
-function producerPhysicalIds(scope, stateBackend, stackName, region, onFailure) {
-	let reads = producerPhysicalIdReads.get(scope);
+const producerStateReads = /* @__PURE__ */ new WeakMap();
+async function readProducerStateOnce(scope, stateBackend, stackName, region, onFailure, inHand) {
+	let reads = producerStateReads.get(scope);
 	if (reads === void 0) {
 		reads = /* @__PURE__ */ new Map();
-		producerPhysicalIdReads.set(scope, reads);
+		producerStateReads.set(scope, reads);
 	}
 	const key = JSON.stringify([stackName, region]);
 	let read = reads.get(key);
 	if (read === void 0) {
-		read = (async () => {
-			const ids = /* @__PURE__ */ new Set();
+		read = inHand !== void 0 ? Promise.resolve({
+			state: inHand,
+			failed: false
+		}) : (async () => {
+			if (stateBackend === void 0) return {
+				state: void 0,
+				failed: false
+			};
 			try {
-				const data = await stateBackend.getState(stackName, region);
-				for (const record of Object.values(data?.state.resources ?? {})) {
-					const id = record?.physicalId;
-					if (typeof id === "string" && id !== "") ids.add(id);
-				}
+				return {
+					state: (await stateBackend.getState(stackName, region))?.state ?? void 0,
+					failed: false
+				};
 			} catch {
-				onFailure();
+				return {
+					state: void 0,
+					failed: true
+				};
 			}
-			return ids;
 		})();
 		reads.set(key, read);
 	}
-	return read;
+	const { state, failed } = await read;
+	if (failed) onFailure();
+	return state;
+}
+function producerStateOnce(resolverRegion, context, producerOutput, onFailure) {
+	return readProducerStateOnce(context.recordedImports ?? context.recordedSecretValues ?? context, context.stateBackend, producerOutput.stackName, producerOutput.region || resolverRegion || "", onFailure, producerOutput.state);
+}
+const physicalIdsByState = /* @__PURE__ */ new WeakMap();
+function physicalIdsOf(state) {
+	if (state === void 0) return /* @__PURE__ */ new Set();
+	let ids = physicalIdsByState.get(state);
+	if (ids === void 0) {
+		const out = /* @__PURE__ */ new Set();
+		const resources = state.resources;
+		if (resources !== null && typeof resources === "object") for (const record of Object.values(resources)) {
+			const id = record?.physicalId;
+			if (typeof id === "string" && id !== "") out.add(id);
+		}
+		ids = out;
+		physicalIdsByState.set(state, ids);
+	}
+	return ids;
 }
 
 //#endregion
@@ -21517,7 +21672,7 @@ async function resolveGetStackOutput(arg, context) {
 		stackName,
 		region,
 		outputKey: outputName,
-		...roleArn ? { crossAccount: true } : {}
+		...roleArn ? { crossAccount: true } : { state: stateData.state }
 	}, loggedRegionText);
 }
 function recordOutputRead(context, producerStack, producerRegion, outputName) {
@@ -21637,13 +21792,19 @@ function secretVerdictScope(resolver) {
 }
 function recordProvenanceOfResolution(resolver, context, token, version) {
 	if (context === void 0 || context.provenanceSuppressed === true) return;
-	const resolution = {
-		region: canonicalizeRegion(resolver.explicitRegion),
-		version,
-		route: context.provenanceRoute ?? "literal"
-	};
-	if (context.recordedSecretValues !== void 0) recordReferenceResolution(context.recordedSecretValues, token, resolution);
-	if (context.provenanceSink !== void 0) recordReferenceResolution(context.provenanceSink, token, resolution);
+	const route = context.provenanceRoute ?? "literal";
+	const region = canonicalizeRegion(resolver.explicitRegion);
+	const recorded = route === "read" ? context.recordedReadVersions?.get(token) : void 0;
+	const versions = recorded !== void 0 && recorded.length > 0 ? recorded : [version];
+	for (const one of versions) {
+		const resolution = {
+			region,
+			version: one,
+			route
+		};
+		if (context.recordedSecretValues !== void 0) recordReferenceResolution(context.recordedSecretValues, token, resolution);
+		if (context.provenanceSink !== void 0) recordReferenceResolution(context.provenanceSink, token, resolution);
+	}
 }
 async function resolveDynamicReferences(value, context) {
 	return (await this.resolveDynamicReferencesWithLogTwin(value, value, context, void 0, true)).result;
@@ -23426,6 +23587,101 @@ IntrinsicFunctionResolver.prototype.noteRefStateMask = noteRefStateMask;
 IntrinsicFunctionResolver.prototype.clientsForRegion = clientsForRegion;
 IntrinsicFunctionResolver.prototype.serviceDiscoveryClient = serviceDiscoveryClient;
 
+//#endregion
+//#region src/analyzer/read-provenance-promotion.ts
+function isPlainObject$3(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function readsAcrossStacks(value) {
+	if (Array.isArray(value)) return value.some(readsAcrossStacks);
+	if (!isPlainObject$3(value)) return false;
+	if (Object.hasOwn(value, "Fn::ImportValue") || Object.hasOwn(value, "Fn::GetStackOutput")) return true;
+	return Object.values(value).some(readsAcrossStacks);
+}
+function recordedReadVersions(record) {
+	if (!isPlainObject$3(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	const field = referenceProvenanceOf(record);
+	if (field === void 0) return void 0;
+	let out;
+	for (const [token, entry] of Object.entries(field)) if (entry.readVersions !== void 0 && entry.readVersions.length > 0) (out ??= /* @__PURE__ */ new Map()).set(token, entry.readVersions);
+	return out;
+}
+async function readProvenancePromotions(args) {
+	const { currentState, desiredTemplate, sources } = args;
+	const parser = args.parser ?? new TemplateParser();
+	const records = currentState.resources;
+	const parameters = isPlainObject$3(desiredTemplate.Parameters) ? desiredTemplate.Parameters : void 0;
+	const out = [];
+	for (const { logicalId, changeType } of args.rows) {
+		if (changeType !== "NO_CHANGE" && changeType !== "UPDATE") continue;
+		const record = Object.hasOwn(records, logicalId) ? records[logicalId] : void 0;
+		const readVersions = recordedReadVersions(record);
+		if (readVersions === void 0) continue;
+		const resource = Object.hasOwn(desiredTemplate.Resources, logicalId) ? desiredTemplate.Resources[logicalId] : void 0;
+		const properties = isPlainObject$3(resource?.Properties) ? resource.Properties : {};
+		const reads = [];
+		for (const [key, value] of Object.entries(properties)) {
+			const referenced = [...parser.extractReferences(value)].filter((id) => id !== logicalId);
+			const resourceIds = referenced.filter((id) => Object.hasOwn(desiredTemplate.Resources, id));
+			const readsParameter = parameters !== void 0 && referenced.some((id) => Object.hasOwn(parameters, id));
+			const crossStack = readsAcrossStacks(value);
+			if (resourceIds.length === 0 && !readsParameter && !crossStack) continue;
+			reads.push({
+				key,
+				value,
+				resources: resourceIds,
+				parameters: readsParameter,
+				crossStack
+			});
+		}
+		if (reads.length === 0) continue;
+		let crossStackBags = [];
+		if (sources?.crossStackOutputs !== void 0) {
+			const crossValues = reads.filter((r) => r.crossStack).map((r) => r.value);
+			if (crossValues.length > 0) crossStackBags = await sources.crossStackOutputs(crossValues);
+		}
+		const upstreamIds = new Set(reads.flatMap((r) => r.resources));
+		const readsAnyParameter = reads.some((r) => r.parameters);
+		const moved = [];
+		for (const [token, recorded] of readVersions) {
+			const domain = /* @__PURE__ */ new Set();
+			let member = false;
+			const join = (versions) => {
+				if (versions === void 0 || versions.length === 0) return;
+				member = true;
+				for (const version of versions) domain.add(version);
+			};
+			for (const id of upstreamIds) {
+				const upstream = Object.hasOwn(records, id) ? records[id] : void 0;
+				join(recordedProvenanceOf(upstream, token)?.versions);
+			}
+			if (readsAnyParameter && sources?.inherited !== void 0) join(sources.inherited.get(token)?.versions);
+			for (const bag of crossStackBags) if (Object.hasOwn(bag, token)) join(bag[token]?.versions);
+			if (!member) continue;
+			if (recorded.some((version) => !domain.has(version))) moved.push(token);
+		}
+		if (moved.length === 0) continue;
+		const recordProperties = isPlainObject$3(record?.properties) ? record.properties : {};
+		const keys = [];
+		for (const r of reads) {
+			if (!Object.hasOwn(recordProperties, r.key)) continue;
+			const held = referenceTokensIn(recordProperties[r.key]);
+			if (!moved.some((token) => held.has(token))) continue;
+			keys.push({
+				key: r.key,
+				upstreams: r.resources
+			});
+		}
+		if (keys.length === 0) continue;
+		out.push({
+			logicalId,
+			keys,
+			tokens: moved
+		});
+	}
+	return out;
+}
+
 //#endregion
 //#region src/analyzer/diff-calculator.ts
 const INTRINSIC_KEYS = /* @__PURE__ */ new Set([
@@ -23470,7 +23726,7 @@ var DiffCalculator = class DiffCalculator {
 	conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue) {
 		return this.replacementRules.conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue);
 	}
-	async calculateDiff(currentState, desiredTemplate, resolveFn, canonicalizeProperties, allowedUnsupportedProperties, freshParameters, maskForLog, recreateTargets, maskedInputs, refusalRecovery, noEchoCompare) {
+	async calculateDiff(currentState, desiredTemplate, resolveFn, canonicalizeProperties, allowedUnsupportedProperties, freshParameters, maskForLog, recreateTargets, maskedInputs, refusalRecovery, noEchoCompare, readProvenance) {
 		const changes = /* @__PURE__ */ new Map();
 		refuseMalformedResourceEntriesForDeploy(currentState, void 0, void 0, refusalRecovery);
 		refuseMalformedResourceProperties(currentState, void 0, void 0, refusalRecovery);
@@ -23600,7 +23856,12 @@ var DiffCalculator = class DiffCalculator {
 			const changeType = changes.get(logicalId)?.changeType;
 			if (changeType === "NO_CHANGE" || changeType === "UPDATE") forcedReplacements.add(logicalId);
 		}
+		const provenanceChanges = await this.promoteReadProvenanceDependents(changes, currentState, desiredTemplate, readProvenance);
 		const syntheticCreateOnlyPaths = await this.loadSyntheticCreateOnlyPaths(changes, desiredTemplate, rawGetAttRefs, freshParameters, forcedReplacements);
+		for (const { change, pc, upstreams } of provenanceChanges) {
+			const templateValue = desiredTemplate.Resources[change.logicalId]?.Properties?.[pc.path];
+			pc.requiresReplacement = this.syntheticRequiresReplacement(change.resourceType, pc.path, syntheticCreateOnlyPaths, upstreams.some((id) => isPlainReferenceTo(templateValue, id, desiredTemplate.Resources[id]?.Type)));
+		}
 		do
 			this.promoteReplacementDependents(changes, desiredTemplate, syntheticCreateOnlyPaths, forcedReplacements);
 		while (this.promoteInPlaceAttributeDependents(changes, desiredTemplate, rawGetAttRefs, syntheticCreateOnlyPaths, freshParameters));
@@ -23608,6 +23869,47 @@ var DiffCalculator = class DiffCalculator {
 		this.logger.debug(`Diff calculated: ${summary.create} CREATE, ${summary.update} UPDATE, ${summary.delete} DELETE, ${summary.noChange} NO_CHANGE`);
 		return changes;
 	}
+	async promoteReadProvenanceDependents(changes, currentState, desiredTemplate, sources) {
+		if (isKnownTokenFreeState(currentState)) return [];
+		const promotions = await readProvenancePromotions({
+			rows: changes.values(),
+			currentState,
+			desiredTemplate,
+			sources,
+			parser: this.parser
+		});
+		const out = [];
+		for (const promotion of promotions) {
+			const change = changes.get(promotion.logicalId);
+			if (change === void 0) continue;
+			const existingPaths = new Set((change.propertyChanges ?? []).map((pc) => pc.path));
+			const synthetic = [];
+			for (const { key, upstreams } of promotion.keys) {
+				if (existingPaths.has(key)) continue;
+				const pc = {
+					path: key,
+					oldValue: change.currentProperties?.[key],
+					newValue: change.desiredProperties?.[key],
+					requiresReplacement: false,
+					inPlacePropagated: true,
+					readProvenancePromoted: true
+				};
+				synthetic.push(pc);
+				out.push({
+					change,
+					pc,
+					upstreams
+				});
+			}
+			if (synthetic.length === 0) continue;
+			if (change.changeType === "NO_CHANGE") {
+				change.changeType = "UPDATE";
+				change.propertyChanges = synthetic;
+			} else change.propertyChanges = [...change.propertyChanges ?? [], ...synthetic];
+			this.logger.debug(safeMsg`UPDATE (promoted): ${promotion.logicalId} holds a secret reference read at a version its upstream no longer records (${synthetic.map((pc) => pc.path).join(", ")})`);
+		}
+		return out;
+	}
 	async loadSyntheticCreateOnlyPaths(changes, desiredTemplate, rawGetAttRefs, freshParameters, forcedReplacements) {
 		const loaded = /* @__PURE__ */ new Map();
 		const queue = [...freshParameters ?? []];
@@ -24809,8 +25111,8 @@ function compare(desired, previous, mask) {
 		if (!Array.isArray(desired) || desired.length !== previous.length) return "differs";
 		return combine(previous.map((item, i) => compare(desired[i], item, mask)));
 	}
-	if (isPlainObject$1(previous)) {
-		if (!isPlainObject$1(desired)) return "differs";
+	if (isPlainObject$2(previous)) {
+		if (!isPlainObject$2(desired)) return "differs";
 		if (!Object.keys(desired).every((k) => Object.prototype.hasOwnProperty.call(previous, k))) return "differs";
 		return combine(Object.keys(previous).map((k) => compare(desired[k], previous[k], mask)));
 	}
@@ -24836,7 +25138,7 @@ function resolvesReference(desired, previous, mask) {
 	const pattern = literals.map(escapeRegExp$1).join("[\\s\\S]*");
 	return new RegExp(`^${pattern}$`).test(desired);
 }
-function isPlainObject$1(value) {
+function isPlainObject$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function escapeRegExp$1(text) {
@@ -25627,7 +25929,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CsBxbRlH.js");
+			const { ASGProvider } = await import("./asg-provider-BtUUjRnI.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -25733,7 +26035,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-d15q7Rp5.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-C81KkPPG.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-B9gz-giS.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-Bkrw65eO.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -33556,11 +33858,16 @@ async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId,
 		resources: {},
 		recordedSecretValues: secrets
 	};
+	const pins = new ReplayPins(record, resolvers, execCtx, logicalId);
 	const walk = async (v, path) => {
 		if (typeof v === "string") {
 			if (!v.includes("{{resolve:")) return v;
 			refuseUnprovenReplaySecret(v, path, logicalId, execCtx, recordedRegions);
-			return await resolveLeafByRegion(v, path, logicalId, execCtx, resolvers, resolverContext, recordedRegions);
+			const leafPins = await pins.forLeaf(v, recordedRegions);
+			return await resolveLeafByRegion(v, path, logicalId, execCtx, resolvers, leafPins === void 0 ? resolverContext : {
+				...resolverContext,
+				referencePins: leafPins
+			}, recordedRegions);
 		}
 		if (Array.isArray(v)) {
 			const out = new Array(v.length);
@@ -33576,6 +33883,66 @@ async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId,
 	};
 	return await walk(props, "");
 }
+var ReplayPins = class {
+	recorded = /* @__PURE__ */ new Map();
+	verdicts = /* @__PURE__ */ new Map();
+	resolvers;
+	execCtx;
+	logicalId;
+	constructor(record, resolvers, execCtx, logicalId) {
+		this.resolvers = resolvers;
+		this.execCtx = execCtx;
+		this.logicalId = logicalId;
+		const field = referenceProvenanceOf(record);
+		for (const [token, entry] of Object.entries(field ?? {})) if (entry.versions?.length === 1) this.recorded.set(token, entry.versions[0]);
+	}
+	async forLeaf(leaf, recordedRegions) {
+		if (this.recorded.size === 0) return void 0;
+		let out;
+		for (const token of dynamicReferenceTokens(leaf)) {
+			const pin = this.recorded.get(token);
+			if (pin === void 0) continue;
+			if (!await this.usable(token, pin, recordedRegions)) continue;
+			(out ??= /* @__PURE__ */ new Map()).set(token, pin);
+		}
+		return out;
+	}
+	async usable(token, pin, recordedRegions) {
+		const known = this.verdicts.get(token);
+		if (known !== void 0) return known;
+		const verdict = classifyRecordedSecretRegion(token, this.execCtx.region, this.execCtx.importedProducerRegions, recordedRegions);
+		if (verdict.kind === "ambiguous") return false;
+		const resolver = verdict.kind === "named-region" ? this.resolvers.forRegion(verdict.region) : verdict.kind === "recorded-region" ? this.resolvers.forRecordedRegion(verdict.region) : this.resolvers.primary;
+		let ok;
+		try {
+			await resolver.resolveDynamicReferences(token, {
+				template: { Resources: {} },
+				resources: {},
+				recordedSecretValues: /* @__PURE__ */ new Map(),
+				provenanceSuppressed: true
+			});
+		} catch (err) {
+			if (isDeliberateResolutionRefusal(err)) throw err;
+		}
+		try {
+			const served = await resolver.resolveDynamicReferences(token, {
+				template: { Resources: {} },
+				resources: {},
+				recordedSecretValues: /* @__PURE__ */ new Map(),
+				provenanceSuppressed: true,
+				referencePins: /* @__PURE__ */ new Map([[token, pin]])
+			});
+			ok = served.includes("{{resolve:") || served.length >= 4;
+			if (!ok) getLogger().warn(safeMsg`Rollback of ${this.logicalId} restores a secret reference at its current version, not the version its record names: that value is shorter than four characters, so cdkd could not keep it out of state.`);
+		} catch (err) {
+			if (isDeliberateResolutionRefusal(err)) throw err;
+			getLogger().warn(safeMsg`Rollback of ${this.logicalId} could not read a secret at the version its record names (it may have been deprecated or deleted); restoring the current value instead.`);
+			ok = false;
+		}
+		this.verdicts.set(token, ok);
+		return ok;
+	}
+};
 function refuseMaskedReplayBaseline(props, logicalId, inert = []) {
 	if (props === void 0 || !carriesSecretMask(props)) return;
 	if (inert.length > 0 && masksOnlyAt(props, inert)) return;
@@ -40235,6 +40602,118 @@ function recordedProtectionNote(evidence, flags) {
 	return `${evidence}. AWS refuses to delete the resource while that protection is on, and cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and cdkd state destroy act on one), so ${flags} alone does not remove the old resource: depending on the replacement order, the deploy either fails at that delete or completes leaving the old resource, and its data, in AWS and no longer tracked by cdkd. Read ${DELETION_PROTECTION_DOC_POINTER} before you disable anything, then turn the protection off out of band (the console, or the service's own API) and re-run with ${flags}.`;
 }
 
+//#endregion
+//#region src/deployment/deploy-engine/read-provenance-moved.ts
+function occurrences(value, token) {
+	if (typeof value === "string") return value.includes(token) ? value.split(token).length - 1 : 0;
+	if (Array.isArray(value)) {
+		let n = 0;
+		for (const item of value) n += occurrences(item, token);
+		return n;
+	}
+	if (value !== null && typeof value === "object") {
+		let n = 0;
+		for (const item of Object.values(value)) n += occurrences(item, token);
+		return n;
+	}
+	return 0;
+}
+function readProvenanceMovedPaths(args) {
+	const paths = /* @__PURE__ */ new Set();
+	const tokens = [];
+	const field = referenceProvenanceOf(args.record);
+	if (field === void 0) return {
+		paths,
+		tokens
+	};
+	for (const [token, entry] of Object.entries(field)) {
+		const recorded = entry.readVersions;
+		if (recorded === void 0 || recorded.length === 0) continue;
+		const served = passReadVersionsFor(args.secrets, token);
+		if (served === void 0) continue;
+		if ([...served].every((version) => recorded.includes(version))) continue;
+		const held = /* @__PURE__ */ new Set();
+		for (const key of Object.keys(args.desiredRedacted)) {
+			const count = occurrences(args.desiredRedacted[key], token);
+			if (count === 0) continue;
+			if (count > (Object.hasOwn(args.templateProperties, key) ? occurrences(args.templateProperties[key], token) : 0)) held.add(key);
+		}
+		if (held.size === 0) continue;
+		for (const key of held) paths.add(key);
+		tokens.push({
+			token,
+			paths: held,
+			recorded,
+			served,
+			region: entry.region
+		});
+	}
+	return {
+		paths,
+		tokens
+	};
+}
+async function confirmValueMoves(moved, sameValue) {
+	const kept = [];
+	const unchanged = [];
+	for (const entry of moved.tokens) {
+		let equal = entry.recorded.length === 1 ? true : void 0;
+		for (const served of entry.served) {
+			if (equal !== true) break;
+			equal = await sameValue(entry, entry.recorded[0], served);
+		}
+		if (equal === true) unchanged.push(entry);
+		else kept.push(entry);
+	}
+	const paths = /* @__PURE__ */ new Set();
+	for (const entry of kept) for (const key of entry.paths) paths.add(key);
+	return {
+		moved: {
+			paths,
+			tokens: kept
+		},
+		unchanged
+	};
+}
+async function sameValueAtVersions(resolver, entry, recorded, served, base) {
+	const context = (pin) => ({
+		template: base.template,
+		resources: base.resources,
+		recordedSecretValues: /* @__PURE__ */ new Map(),
+		provenanceSuppressed: true,
+		referencePins: /* @__PURE__ */ new Map([[entry.token, pin]])
+	});
+	if (entry.region === void 0) return void 0;
+	const reader = resolver.resolverForRecordedRegion(entry.region);
+	try {
+		const now = await reader.resolveDynamicReferences(entry.token, context(served));
+		const then = await reader.resolveDynamicReferences(entry.token, context(recorded));
+		if (now.includes("{{resolve:") || then.includes("{{resolve:")) return void 0;
+		return now === then;
+	} catch (err) {
+		if (isDeliberateResolutionRefusal(err)) throw err;
+		return;
+	}
+}
+function withRefreshedReadVersions(record, unchanged) {
+	const field = referenceProvenanceOf(record);
+	if (field === void 0) return record;
+	const out = { ...field };
+	for (const { token, served } of unchanged) {
+		const before = Object.hasOwn(field, token) ? field[token] : void 0;
+		const previousRead = new Set(before?.readVersions ?? []);
+		const versions = [.../* @__PURE__ */ new Set([...(before?.versions ?? []).filter((version) => !previousRead.has(version)), ...served])].sort();
+		if (versions.length > 8) continue;
+		const next = validateReferenceProvenance(token, {
+			...before?.region !== void 0 && { region: before.region },
+			versions,
+			readVersions: [...served].sort()
+		});
+		if (next !== void 0) out[token] = next;
+	}
+	return withReferenceProvenance(record, out);
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/noecho.ts
 function noEchoExactEchoLeavesOf(record) {
@@ -42191,12 +42670,23 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	};
 	const suppliesFreshMaskOnlyValue = pendingParameterLeaves.size > 0 || Object.keys(resolvedProps).some((key) => otherFreshAt(key).length > 0);
 	const rewrittenPaths = readsProducerReplacedThisRun.call(this, template, logicalId, stateResources) ? redactionRewrittenPaths(resolvedProps, desiredForSkipCheck, comparisonCoordinates) : /* @__PURE__ */ new Set();
+	const { moved: provenanceMoved, unchanged: provenanceUnchanged } = await confirmValueMoves(readProvenanceMovedPaths({
+		record: currentResource,
+		templateProperties: desiredProps,
+		desiredRedacted: desiredForSkipCheck,
+		secrets: updateSecrets
+	}), (entry, recordedVersion, servedVersion) => sameValueAtVersions(this.resolver, entry, recordedVersion, servedVersion, {
+		template,
+		resources: stateResources
+	}));
+	for (const path of provenanceMoved.paths) rewrittenPaths.add(path);
+	if (provenanceMoved.paths.size > 0) this.logger.info(safeMsg`${logicalId} is sent: ${[...provenanceMoved.paths].sort().join(", ")} read a secret-derived value at a newer version than ${logicalId} was deployed with (its upstream changed since then)`);
 	const recordMatchesDesired = movedMasked.size === 0 && rewrittenPaths.size === 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten);
 	const applyAttributeOnlyUpdate = (attributeChanges) => {
 		const attrSummary = attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
 		this.logger.info(safeMsg`  ↻ ${logicalId} (${resourceType}) attribute update: ${attrSummary}`);
 		stateResources[logicalId] = {
-			...currentResource,
+			...stateResources[logicalId] ?? currentResource,
 			...this.extractTemplateAttributes(template, logicalId)
 		};
 		if (counts) counts.updated++;
@@ -42266,6 +42756,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	const differsWhy = (key) => !lateReplacementDeclined.has(key) ? "differs; the provider is not known to report this property exactly, so the difference may be its normalization" : lateCrossPrefixRefused ? "differs; the replacement was refused: see the state-prefix warning above" : `differs; the replacement was not approved (--require-approval=${this.options.requireApproval ?? "never"})`;
 	if (witnessMigrates && !typeChanged && echoCandidates.length > 0 && hasAddressablePhysicalId(currentResource)) await readOnce();
 	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && recordMatchesDesired) {
+		if (provenanceUnchanged.length > 0) stateResources[logicalId] = withRefreshedReadVersions(stateResources[logicalId] ?? currentResource, provenanceUnchanged);
 		if (change.attributeChanges && change.attributeChanges.length > 0) {
 			applyAttributeOnlyUpdate(change.attributeChanges);
 			return;
@@ -42411,6 +42902,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 				...remaining.length > 0 && { noEchoLeaves: remaining.map((c) => [...c]) }
 			};
 		}
+		if (provenanceUnchanged.length > 0) stateResources[logicalId] = withRefreshedReadVersions(stateResources[logicalId] ?? currentResource, provenanceUnchanged);
 		this.attemptedResolvedProps.delete(logicalId);
 		if (change.attributeChanges && change.attributeChanges.length > 0) {
 			applyAttributeOnlyUpdate(change.attributeChanges);
@@ -44924,18 +45416,18 @@ function conditionInputsFrom(args) {
 	};
 }
 const FINGERPRINT_LAYOUT = 1;
-function isPlainObject(value) {
+function isPlainObject$1(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function canonicalJson(value) {
 	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
-	if (isPlainObject(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+	if (isPlainObject$1(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
 	const encoded = JSON.stringify(value);
 	return encoded === void 0 ? "undefined" : encoded;
 }
 function walkModelledDefinition(value, declaredParameters, parameters, conditions) {
 	if (typeof value === "string") return !carriesDynamicReference(value);
-	if (!isPlainObject(value)) return false;
+	if (!isPlainObject$1(value)) return false;
 	const keys = Object.keys(value);
 	if (keys.length !== 1) return false;
 	const [key] = keys;
@@ -44958,8 +45450,8 @@ function walkModelledDefinition(value, declaredParameters, parameters, condition
 }
 function conditionFingerprint(template, name, inputOf) {
 	const definitions = template.Conditions;
-	if (!isPlainObject(definitions)) return void 0;
-	const declared = isPlainObject(template.Parameters) ? template.Parameters : {};
+	if (!isPlainObject$1(definitions)) return void 0;
+	const declared = isPlainObject$1(template.Parameters) ? template.Parameters : {};
 	const declaredNames = new Set(Object.keys(declared));
 	const closure = nullPrototypeRecord();
 	const parameters = /* @__PURE__ */ new Set();
@@ -44981,7 +45473,7 @@ function conditionFingerprint(template, name, inputOf) {
 	let hasToken = false;
 	for (const parameter of parameters) {
 		const definition = declared[parameter];
-		const type = isPlainObject(definition) ? definition["Type"] : void 0;
+		const type = isPlainObject$1(definition) ? definition["Type"] : void 0;
 		if (typeof type !== "string") return void 0;
 		const input = inputOf(parameter);
 		if (input === void 0) return void 0;
@@ -45012,7 +45504,7 @@ function collectIfConditionNames(value, names, conditions) {
 		for (const element of value) collectIfConditionNames(element, names, conditions);
 		return;
 	}
-	if (!isPlainObject(value)) return;
+	if (!isPlainObject$1(value)) return;
 	const ifArgs = value["Fn::If"];
 	if (Array.isArray(ifArgs) && typeof ifArgs[0] === "string") {
 		names.add(ifArgs[0]);
@@ -45026,9 +45518,9 @@ function collectIfConditionNames(value, names, conditions) {
 function conditionsReadByDiff(template, conditions) {
 	const names = /* @__PURE__ */ new Set();
 	for (const section of [template.Resources, template.Outputs]) {
-		if (!isPlainObject(section)) continue;
+		if (!isPlainObject$1(section)) continue;
 		for (const entry of Object.values(section)) {
-			if (!isPlainObject(entry)) continue;
+			if (!isPlainObject$1(entry)) continue;
 			const gate = entry["Condition"];
 			if (typeof gate === "string") {
 				names.add(gate);
@@ -45060,10 +45552,10 @@ function buildConditionVerdictRecord(template, conditions, inputOf) {
 function readRecordedConditionVerdicts(state) {
 	const read = nullPrototypeRecord();
 	const field = state?.conditionVerdicts;
-	if (!isPlainObject(field)) return read;
+	if (!isPlainObject$1(field)) return read;
 	for (const name of Object.keys(field)) {
 		const entry = field[name];
-		if (isPlainObject(entry) && typeof entry["verdict"] === "boolean" && typeof entry["fingerprint"] === "string") read[name] = {
+		if (isPlainObject$1(entry) && typeof entry["verdict"] === "boolean" && typeof entry["fingerprint"] === "string") read[name] = {
 			verdict: entry["verdict"],
 			fingerprint: entry["fingerprint"]
 		};
@@ -45106,11 +45598,11 @@ function deployConditionInputs(parameterValues, inheritedSecrets, shadowedBy = /
 function parentSuppliedValues(template, supplied, tokens) {
 	const names = /* @__PURE__ */ new Set();
 	if (supplied === void 0) return names;
-	const declared = isPlainObject(template.Parameters) ? template.Parameters : {};
+	const declared = isPlainObject$1(template.Parameters) ? template.Parameters : {};
 	for (const [name, value] of Object.entries(supplied)) {
 		if (tokens.has(name)) continue;
 		const definition = declared[name];
-		const fallback = isPlainObject(definition) ? definition["Default"] : void 0;
+		const fallback = isPlainObject$1(definition) ? definition["Default"] : void 0;
 		if (fallback === void 0 || String(fallback) !== String(value)) names.add(name);
 	}
 	return names;
@@ -45334,6 +45826,67 @@ function promoteRecreateTargets(changes, recreateTargets, stackName) {
 	};
 }
 
+//#endregion
+//#region src/deployment/read-provenance-sources.ts
+function isPlainObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function crossStackNodes(value, into = []) {
+	if (Array.isArray(value)) {
+		for (const item of value) crossStackNodes(item, into);
+		return into;
+	}
+	if (!isPlainObject(value)) return into;
+	const keys = Object.keys(value);
+	if (keys.length === 1 && (keys[0] === "Fn::ImportValue" || keys[0] === "Fn::GetStackOutput")) into.push(value);
+	for (const item of Object.values(value)) crossStackNodes(item, into);
+	return into;
+}
+function crossStackOutputProvenanceSource(reads, scope, stateBackend) {
+	return async (value) => {
+		const out = [];
+		for (const node of crossStackNodes(value)) {
+			const key = crossStackSourceKey(node);
+			if (key === void 0) continue;
+			const read = reads.get(key);
+			if (read === void 0 || !read.carriesToken) continue;
+			const state = await readProducerStateOnce(scope, stateBackend, read.stackName, read.region, () => void 0, read.state);
+			const bag = outputReferenceProvenanceOf(state, read.outputKey);
+			if (bag !== void 0) out.push(bag);
+		}
+		return out;
+	};
+}
+function inheritedProvenanceForChildDiff(args) {
+	const { row, rowRecord, parentRecords, parentTemplate } = args;
+	if (!args.rowProvisioned || rowRecord === void 0) return void 0;
+	const recordedParameters = isPlainObject(rowRecord.properties) ? rowRecord.properties["Parameters"] : void 0;
+	const tokens = referenceTokensIn(recordedParameters);
+	if (tokens.size === 0) return void 0;
+	const own = referenceProvenanceOf(rowRecord);
+	const upstreams = [...new TemplateParser().extractReferences(isPlainObject(row.Properties) ? row.Properties["Parameters"] : void 0)].filter((id) => Object.hasOwn(parentTemplate.Resources, id) && Object.hasOwn(parentRecords, id));
+	const out = /* @__PURE__ */ new Map();
+	for (const token of tokens) {
+		const versions = /* @__PURE__ */ new Set();
+		let region;
+		for (const id of upstreams) {
+			const entry = recordedProvenanceOf(parentRecords[id], token);
+			for (const version of entry?.versions ?? []) versions.add(version);
+			region ??= entry?.region;
+		}
+		if (versions.size > 0) {
+			out.set(token, {
+				...region !== void 0 && { region },
+				versions: [...versions].sort()
+			});
+			continue;
+		}
+		const recorded = own !== void 0 && Object.hasOwn(own, token) ? own[token] : void 0;
+		if (recorded !== void 0) out.set(token, recorded);
+	}
+	return out.size === 0 ? void 0 : out;
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/deploy-flow.ts
 const TAIL_WARM_CONNECTIONS = 3;
@@ -45495,13 +46048,18 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		}, stackName);
 		diffResolverContext.bestEffort = true;
 		diffResolverContext.skipDynamicReferences = true;
+		const crossStackReads = /* @__PURE__ */ new Map();
+		diffResolverContext.crossStackReads = crossStackReads;
 		const diffResolveFn = (value) => this.resolver.resolve(value, diffResolverContext);
 		const maskedInputSourcesForDiff = this.maskedInputSources(effectiveTemplate, currentState.resources, conditions, stackName);
 		const maskedInputs = maskedInputSourcesForDiff && {
 			sources: maskedInputSourcesForDiff,
 			rebaselined: /* @__PURE__ */ new Map()
 		};
-		const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry), this.providerRegistry.getAllowedUnsupportedProperties?.(), freshNoEchoParametersWithDeclared(this.inheritedNoEchoParameters, effectiveTemplate), this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues, currentState.resources), recreateTargetIdsFor(this.options.recreateTargets, stackName), maskedInputs, this.options.refusalRecovery, this.noEchoDiffComparison(currentState.resources, effectiveTemplate, conditions, parameterValues, stackName));
+		const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry), this.providerRegistry.getAllowedUnsupportedProperties?.(), freshNoEchoParametersWithDeclared(this.inheritedNoEchoParameters, effectiveTemplate), this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues, currentState.resources), recreateTargetIdsFor(this.options.recreateTargets, stackName), maskedInputs, this.options.refusalRecovery, this.noEchoDiffComparison(currentState.resources, effectiveTemplate, conditions, parameterValues, stackName), {
+			...this.options.inheritedReferenceProvenance && { inherited: this.options.inheritedReferenceProvenance },
+			crossStackOutputs: crossStackOutputProvenanceSource(crossStackReads, this.recordedImports, this.stateBackend)
+		});
 		createOnlyPrefetch.cancel();
 		for (const [logicalId, fingerprints] of maskedInputs?.rebaselined ?? []) {
 			const record = currentState.resources[logicalId];
@@ -46380,5 +46938,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { isTruthyCfnBoolean as $, NO_CC_HANDLERS_REASON as $a, resolveApp as $c, malformedLocalResourceEntriesWarning as $i, ledgerForStack as $n, shareLogOnlyValues as $o, sendableAssumeRoleCommand as $r, hasUnverifiableParameterRefusal as $s, seedsDeleteFirstGuard as $t, noEchoComparisonForTemplate as A, refuseMalformedResourceEntriesForOrphan as Aa, dockerSpawnEnvWithSensitive as Ac, refStateLookupFromResource as Ai, displayAssemblyPath as Al, journaledOrphanPrintingBag as An, TemplateParser as Ao, deleteIndeterminateGuards as Ar, wholeStringLeavesOf as As, dropFailedHint as At, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as B, repairMalformedOrphansForReadOnly as Ba, runDockerForeground as Bc, UNREADABLE_RESOURCES_MAP_ROW as Bi, PRE_DELETE_SNAPSHOT_TYPES as Bn, passedNoEchoParametersOf as Bo, reDisableInstanceApiTermination as Br, rebuildClientForBucketRegion as Bs, getStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedOutputsForDestroy as Ca, validateContainerRepoName as Cc, carriesDynamicReference as Ci, defineOwnKey as Cl, collectDeclaredOutputNames as Cn, templateResourceTypes as Co, applyCustomResourceResponseExpiration as Cr, carriesSecretMask as Cs, revertNestedChildFromJournal as Ct, withResourceDeadline as D, refuseMalformedResourceEntriesForDestroy as Da, describeDockerCapturedOutput as Dc, AWS_NO_VALUE as Di, ownValue as Dl, DEFAULT_RESOURCE_TIMEOUT_MS as Dn, lambdaFunctionNameForMask as Do, unchangedBehindSecretReference as Dr, recordNoEchoAttributeValues as Ds, getCurrentNestedStackContext as Dt, serviceTokenBlockingReason as E, refuseMalformedResourceEntriesForDeploy as Ea, resolveDockerContextDirectory as Ec, keepsSecretReferenceToken as Ei, nullPrototypeRecord as El, bindingSkippedOutputs as En, canonicalLambdaFunctionName as Eo, slowCcOperationTimeoutMs as Er, recordMaskOnlyValuesIn as Es, collectNestedChildUnaddressed as Et, PROTECTION_PROPERTY_BY_TYPE as F, refuseMalformedResourcesForDeploy as Fa, isMalformedEnvKey as Fc, declaresNoEcho as Fi, clearBucketRegionCache as Fl, secretNamedRecordNeedles as Fn, maskWholeValue as Fo, markWaitAbandoned as Fr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Fs, sameJournaledOrphans as Ft, resolveDynamoDbDeleteBudgetMs as G, unpreviewableOrphanRecords as Ga, stripForDisplay as Gc, hasReadableOutputs as Gi, isFinalSnapshotError as Gn, carryLogOnlyValues as Go, poisonRenderedSpellingsCollidingIn as Gr, isAccessDenied$1 as Gs, isJournaledOrphan as Gt, compensateRemovedDeletionProtection as H, repairMalformedResourceEntriesForReadOnly as Ha, warnFinchArgvExposure as Hc, deployRefusesOrphanRowsReason as Hi, ccRoutedFinalSnapshotError as Hn, readsNoEchoSource as Ho, DiffCalculator as Hr, CrossPrefixScanCache as Hs, removeProtectionTypeList as Ht, isProtectionValueActive as I, refuseMalformedResourcesForDestroy as Ia, partitionSensitiveEnv as Ic, JSON_LISTING_HOLE_VALUE as Ii, resolveBucketRegion as Il, stateSecretNameNeedles as In, maskedLeafCoordinatesOf as Io, disableInstanceApiTermination as Ir, isSingleDynamicReferenceToken as Is, replayFailedOperations as It, deleteTableWithIndexBusyRetry as J, withheldAccountClause as Ja, Synthesizer as Jc, isReadableResourceEntry as Ji, maskingRetryLogger as Jn, literalSplitDelimitersOf as Jo, applyRoleArnIfSet as Jr, acceptedCreateOnlyDropsOf as Js, planRollback as Jt, DELETE_INDEX_WAIT_PROCEED_NOTE as K, unreadableOrphanRecords as Ka, AssetManifestLoader as Kc, hasReadableResources as Ki, refusesFinalSnapshot as Kn, createUnionSecretMasker as Ko, producerLookupOver as Kr, isNotImplemented as Ks, isReplacementOrphan as Kt, perType as L, refuseMalformedResourcesForExport as La, redactDockerArgvValues as Lc, STATE_REGION_DIVERGED as Li, storedSecretNameNeedles as Ln, noEchoCoordinatesOf as Lo, ec2InstanceProtectionSite as Lr, LockManager as Ls, replayRollback as Lt, noEchoParameterNamesOf as M, refuseMalformedResourcePropertiesForDrift as Ma, formatDockerLoginError as Mc, withSharedDrainBudget as Mi, resolveAssemblyPath as Ml, orphanRecordsPrintingBag as Mn, isMarkedCoordinate as Mo, deleteSkipReason as Mr, STATE_SOURCED_CROSS_GENERATION_RULES as Ms, journaledOrphanLines as Mt, recordedProtectionEvidence as N, refuseMalformedResourcePropertiesForExport as Na, getDockerCmd as Nc, parameterInputsFor as Ni, injectAwsRegion as Nl, secretNamePrintingBag as Nn, maskAtCoordinates as No, withIndeterminateGuard as Nr, STATE_SOURCED_READBACK_RULES as Ns, loadJournaledOrphans as Nt, diffSecurity as O, refuseMalformedResourceEntriesForImport as Oa, describeDockerExecFailure as Oc, cfnRefValueFromPhysicalId as Oi, absoluteAssemblyPathEscape as Ol, DEFAULT_RESOURCE_WARN_AFTER_MS as On, sameLambdaFunctionAddress as Oo, RollbackInlinePolicyWriters as Or, recordNoEchoParameterFreshValue as Os, withNestedStackContext as Ot, recordedProtectionNote as P, refuseMalformedResourcePropertiesForOrphan as Pa, isDockerClientEnvKey as Pc, passedParameterClassesOf as Pi, injectedAwsRegionValue as Pl, secretNamePrintingBags as Pn, maskReadbackAtCoordinates as Po, isWaitAbandonedError as Pr, TEMPLATE_SOURCED_RULES as Ps, makeForeignHolderScan as Pt, hasCdkAutoDeleteTag as Q, withoutSilentDropProperties as Qa, loadCdkJson as Qc, malformedLocalOutputsWarning as Qi, earliestDefined as Qn, recordLogOnlyValue as Qo, isIamRoleArn as Qr, hasReasonlessBaselineRefusal as Qs, resolveReplacementOldType as Qt, readProtection as R, refuseMalformedState as Ra, redactedCause as Rc, STATE_RESOURCES_MALFORMED as Ri, extractDeploymentEventError as Rn, noEchoLeavesOf as Ro, isTerminationProtectionPropagationError as Rr, isLockInfoExpired as Rs, awaitInFlightSibling as Rt, keptForReadoption as S, refuseMalformedOutputs as Sa, validateAssetBucketName as Sc, isImpossibleEmptyStoredAttribute as Si, processStackMessages as Sl, noEchoParameterValueSeed as Sn, prefetchCreateOnlyPropertyPaths as So, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Sr, splitGetAttStringForm as Ss, recordDisplacedSkips as St, findServiceTokenRefusals as T, refuseMalformedResourceEntries as Ta, buildDockerImage as Tc, isNamelessDynamicReferenceError as Ti, hasPlainPrototype$1 as Tl, isExportAliasCollision as Tn, withRetry as To, CloudControlProvider as Tr, recordMaskOnlyValue as Ts, withNestedRevertRun as Tt, deleteBudgetKey as U, repairMalformedResourcePropertiesForReadOnly as Ua, escapeRegExp$3 as Uc, displayLogicalId as Ui, createPreDeleteFinalSnapshot as Un, valueAtCoordinate as Uo, INTRINSIC_KEYS as Ur, applyCrossPrefixScan as Us, recordAfterRollbackUpdate as Ut, beginDeleteWait as V, repairMalformedOutputsForReadOnly as Va, runDockerStreaming as Vc, accountArgs as Vi, buildFinalSnapshotIdentifier as Vn, readbackPathFor as Vo, reEnableInstanceApiTermination as Vr, CrossPrefixReadError as Vs, withStackRecords as Vt, resolveDynamoDbDeleteBudgetClock as W, repairMalformedResourcesForReadOnly as Wa, stripControlChars as Wc, hasReadableOrphans as Wi, effectiveDeletionPolicy as Wn, liveMatchesUnresolvedTokenFrame as Wo, IntrinsicFunctionResolver as Wr, crossPrefixDeniedWarning as Ws, demoteSupersededOrphans as Wt, ECR_AUTO_DELETE_IMAGES_TAG as X, findSilentDropProperties as Xa, getDefaultStateBucketName as Xc, malformedExportNamesWarning as Xi, findDestructiveChanges as Xn, printingCorpusOf as Xo, assertSendableRoleArn as Xr, exportNamesCarriedFrom as Xs, recordUnderIdIsNotOwn as Xt, waitForIndexesSettled as Y, findActionableSilentDrops as Ya, synthesisStatusMessage as Yc, malformedDriftResourcePropertiesWarning as Yi, constructPathOf as Yn, logOnlyValueCount as Yo, assertFlagRoleArn as Yr, describeRegionValueKind as Ys, recheckFailedPlan as Yt, S3_AUTO_DELETE_OBJECTS_TAG as Z, unwrittenCreateOnlyReplacement as Za, getLegacyStateBucketName as Zc, malformedExportSourceWarning as Zi, formatDestructiveChange as Zn, recordLogOnlyParameterValue as Zo, explicitRoleArnOrThrow as Zr, hasReadableExportSet as Zs, replacementNeverSwapped as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedOrphanRecords as _a, ensureAssetStorage as _c, regionLessSecretName as _i, PARTITION_TABLE as _l, secretSafeKeyDisplay as _n, readConfigString as _o, TemplateNoEchoReresolver as _r, recordNestedStackParameterExpressions as _s, displacedOpClause as _t, findNestedTemplateTreeDefect as a, malformedOrphansWarning as aa, shouldRetainResource as ac, keepHeldTokenProvenance as ai, resolveUseCdkBootstrapAssets as al, isRedactedRecordedValue as an, isStatefulRecreateTargetSync as ao, planTagDiff as ar, recordReferenceProvenanceEntry as as, cyan as at, lookupEachName as b, refuseMalformedOrphansForDestroy as ba, parseBootstrapMarker as bc, parameterTypeMayLoseSecretIdentity as bi, AssemblyReader as bl, exportNameSecretExposure as bn, requireConfigObject as bo, getCurrentResourceSecrets as br, recordAttributeIdCopy as bs, getNestedRevertRun as bt, renderNestedTemplateTreeDefect as c, malformedRenderedContainersWarning as ca, stringifyValue as cc, recordedReferenceRegions as ci, ssmResolvedValueType as cl, updatePartialMessage as cn, coerceWarmThroughput as co, tagMapAsList as cr, scrubResourceRecord as cs, red as ct, conditionInputsFrom as d, malformedResourcesWarning as da, createAssetRedirectResolver as dc, s3BucketDualStackDomainName as di, MIGRATE_TMP_PREFIX as dl, DeploymentEventsStore as dn, toFiniteNumber as do, stringifyIfAssigned as dr, DYNAMIC_REFERENCE_TOKEN_SCAN as ds, namesAnyDeclaredParameter as dt, malformedLocalResourcesWarning as ea, importableOutputKeys as ec, AWS_CREDENTIAL_ENV_KEYS as ei, resolveAutoAssetStorage as el, orphanDeleteNeedsIdentity as en, hasNoCloudControlHandlers as eo, reserveStackCreateToken as er, createSecretMasker as es, getPriorAttempts as et, parentSuppliedValues as f, malformedScrubResourceEntriesRefusalMessage as fa, loadPublishableAssetManifest as fc, s3BucketRegionalDomainName as fi, findLargeInlineResources as fl, WITHHELD_NAME_DISPLAY as fn, coerceCfnBoolean as fo, CC_BROKEN_REASON as fr, dynamicReferenceTokens as fs, reachableDivergentParameters as ft, mergeNoChangeOutputs as g, refuseMalformedNestedChildOutputs as ga, assertAssetBucketRegion as gc, producerRegionsFromState as gi, expectedOwnerParam as gl, secretBearingStateKeyWarning as gn, configStringRefusal as go, wouldReturnToSdkProvider as gr, inheritNestedStackParameterAssociations as gs, NESTED_PENDING_PARENT_REASON as gt, keptWholeReasonText as h, refuseDivergentRecordRegionForDestroy as ha, BOOTSTRAP_MARKER_PREFIX as hc, classifyReplaySecretRegion as hi, decodeListingKey as hl, secretBearing as hn, configIntegerRefusal as ho, isCustomResource as hr, identityKeyFor as hs, planOrphanAdoption as ht, childTemplateLoader as i, malformedOrphansRefusalMessage as ia, orphansCarriedFrom as ic, isSettledInstanceState as ii, resolveStateBucketWithDefaultAndSource as il, REDACTED_DELETE_ADDRESS_SKIP_REASON as in, isStatefulRecreateTargetForReplace as io, DBPROXY_TAG_OPTIONS as ir, markSameGenerationBag as is, bold as it, noEchoExactEchoLeavesOf as j, refuseMalformedResourcePropertiesForDestroy as ja, finchSecretArgvRefusal as jc, parseWebACLArn as ji, renderAssemblyPathEscape as jl, maskEventTextWithBoundBags as jn, canonicalCoordinates as jo, deleteLeftInPlace as jr, STATE_SOURCED_BASELINE_RULES as js, isHandledOrphan as jt, noEchoAttributeNamesOf as k, refuseMalformedResourceEntriesForImportSave as ka, describeDockerFailure as kc, isStalePlaceholderArnAttribute as ki, describeFileReadFailure as kl, completedReplayEntries as kn, DagBuilder as ko, UNSPECIFIED_SKIP_REASON as kr, recordProvenPublicExpression as ks, deleteJournaledOrphans as kt, templateIdentity as l, malformedResourceEntriesWarning as la, WorkGraph as lc, s3BucketArn as li, CFN_TEMPLATE_BODY_LIMIT as ll, updatePartialReason as ln, isWarmThroughputDecrease as lo, tagPlanWarning as lr, withPhysicalNameCopies as ls, yellow as lt, isSecretBearingReferenceString as m, previewableOrphanRecords as ma, AssetModeResolver as mc, classifyRecordedSecretRegion as mi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ml, exportAliasCollisionScrubWarning as mn, configBooleanRefusal as mo, ccBrokenReason as mr, pathCrossesDottedKey as ms, makeSiblingClaimReader as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedOrphanRecordsWarning as na, isReadableBag as nc, callerEnvCredentials as ni, resolveSkipPrefix as nl, getCurrentProducerRegions as nn, shownType as no, acquireIdempotencyToken as nr, maskSecretsInError as ns, formatResourceLine as nt, isAbsoluteAssetPath as o, malformedOutputsRefusalMessage as oa, AssetPublisher as oc, outputReferenceProvenanceOf as oi, stateBucketExistenceConfirmed as ol, redactedDeleteAddressFields as on, renderStatefulReason as oo, readTagList as or, snapshotPassProvenance as os, gray as ot, readRecordedConditionVerdicts as p, malformedStateRefusalMessage as pa, rewriteTemplateAssetReferences as pc, s3BucketWebsiteUrl as pi, uploadCfnTemplate as pl, displayTextOrWithheld as pn, coerceCfnInteger as po, ProviderRegistry as pr, isUncertifiedBaselineMaskPosition as ps, resourcesNamingDeclaredParameter as pt, INDEX_SETTLE_POLL_INTERVAL_MS as q, unreadableResourceEntries as qa, getDockerImageBySourceHash as qc, isReadableOrphanRecord as qi, unsupportedFinalSnapshotError as qn, hasMaskableValues as qo, refuseUnreadableCdkCrossAccountRefs as qr, splitImportedOps as qs, planFailedOps as qt, computeImplicitDeleteEdges as r, malformedOrphanRowsKeptWarning as ra, orphansAfterRollback as rc, envCredentialsAreAssumedRole as ri, resolveStateBucketWithDefault as rl, inheritProducerRegions as rn, MULTI_REGION_RECREATE_BLOCKED_TYPES as ro, DBPROXY_TAGS_WHAT as rr, maskSecretsInText as rs, createReadOnlyAttributeHealerFactory as rt, listNestedTemplateRows as s, malformedOutputsWarning as sa, isSensitiveAttributeName as sc, recordedOutputReferenceRegions as si, warnDeprecatedNoPrefixCliFlag as sl, redactedDeleteAddressSkip as sn, WARM_THROUGHPUT_MEMBERS as so, refuseMalformedDesiredTags as sr, redactSecretsForState as ss, green as st, DeployEngine as t, malformedOrphanRecordsRefusalMessage as ta, importableOutputs as tc, applyCallerIdentityCredentials as ti, resolveCaptureObservedState as tl, findNestedStackTypeChanges as tn, findReplacedReadersOfRecreateTargets as to, withCreateTokenLedger as tr, errorCauseChain as ts, markRefusedBeforeApplying as tt, conditionFingerprint as u, malformedResourcePropertiesWarning as ua, buildAssetRedirectMap as uc, s3BucketDomainName as ui, CFN_TEMPLATE_URL_LIMIT as ul, DeploymentEventsReader as un, toCfnInteger as uo, definedAttributes as ur, withoutPhysicalNameCopies as us, computeParameterTaint as ut, chunks as v, refuseMalformedOrphanRecordsForDestroy as va, getBootstrapMarkerKey as vc, coerceParameterTypedValue as vi, canonicalizeRegion as vl, carriedExportAliasExposure as vn, replayWarn as vo, readsNoEchoDeleteValues as vr, recoverMaskedOutput as vs, displacedPhysicalIdShown as vt, deferredServiceTokenWarning as w, refuseMalformedResourceAttributesForOrphan as wa, buildDenyExternalAccessPolicy as wc, carriesFetchableDynamicReference as wi, hasOwnKey as wl, collectPublishedOutputNames as wn, describeTypeWithThrottleRetry as wo, customResourceResponseExpirationWarning as wr, provenPublicValue as ws, revertedNestedRowIds as wt, withApiLimit as x, refuseMalformedOrphansForOrphan as xa, readBootstrapMarkerBody as xc, getAccountInfo as xi, StageLoadError as xl, isWholeDynamicReferenceValue as xn, requireConfigString as xo, withPrintingSecrets as xr, recordPhysicalNameCopy as xs, nestedChildStackName as xt, isAccessDeniedError as y, refuseMalformedOrphans as ya, isCrossRegionRedirect as yc, isUnboundTemplateParameter as yi, derivePartitionAndUrlSuffix as yl, exportNameNoEchoParameters as yn, requireConfigArray as yo, isCustomResourceType as yr, physicalNameCopiesOf as ys, dropSettledNestedJournals as yt, DynamoDBGlobalTableProvider as z, repairMalformedOrphanRecordsForReadOnly as za, redactedDockerCause as zc, UNREADABLE_ORPHANS_CONTAINER_ROW as zi, ATOMIC_FINAL_SNAPSHOT_TYPES as zn, noEchoOutputsComparison as zo, observeThenDisableInstanceApiTermination as zr, S3StateBackend as zs, destroyStackRecordsView as zt };
-//# sourceMappingURL=deploy-engine-DEBgHf6Z.js.map
+export { S3_AUTO_DELETE_OBJECTS_TAG as $, unwrittenCreateOnlyReplacement as $a, getLegacyStateBucketName as $c, malformedExportSourceWarning as $i, formatDestructiveChange as $n, recordLogOnlyParameterValue as $o, explicitRoleArnOrThrow as $r, hasReadableExportSet as $s, replacementNeverSwapped as $t, diffSecurity as A, refuseMalformedResourceEntriesForImport as Aa, describeDockerExecFailure as Ac, cfnRefValueFromPhysicalId as Ai, absoluteAssemblyPathEscape as Al, DEFAULT_RESOURCE_WARN_AFTER_MS as An, sameLambdaFunctionAddress as Ao, RollbackInlinePolicyWriters as Ar, recordNoEchoParameterFreshValue as As, withNestedStackContext as At, readProtection as B, refuseMalformedState as Ba, redactedCause as Bc, STATE_RESOURCES_MALFORMED as Bi, extractDeploymentEventError as Bn, noEchoLeavesOf as Bo, isTerminationProtectionPropagationError as Br, isLockInfoExpired as Bs, awaitInFlightSibling as Bt, withApiLimit as C, refuseMalformedOrphansForOrphan as Ca, readBootstrapMarkerBody as Cc, getAccountInfo as Ci, StageLoadError as Cl, isWholeDynamicReferenceValue as Cn, requireConfigString as Co, withPrintingSecrets as Cr, recordPhysicalNameCopy as Cs, nestedChildStackName as Ct, findServiceTokenRefusals as D, refuseMalformedResourceEntries as Da, buildDockerImage as Dc, isNamelessDynamicReferenceError as Di, hasPlainPrototype$1 as Dl, isExportAliasCollision as Dn, withRetry as Do, CloudControlProvider as Dr, recordMaskOnlyValue as Ds, withNestedRevertRun as Dt, deferredServiceTokenWarning as E, refuseMalformedResourceAttributesForOrphan as Ea, buildDenyExternalAccessPolicy as Ec, carriesFetchableDynamicReference as Ei, hasOwnKey as El, collectPublishedOutputNames as En, describeTypeWithThrottleRetry as Eo, customResourceResponseExpirationWarning as Er, provenPublicValue as Es, revertedNestedRowIds as Et, recordedProtectionEvidence as F, refuseMalformedResourcePropertiesForExport as Fa, getDockerCmd as Fc, parameterInputsFor as Fi, injectAwsRegion as Fl, secretNamePrintingBag as Fn, maskAtCoordinates as Fo, withIndeterminateGuard as Fr, STATE_SOURCED_READBACK_RULES as Fs, loadJournaledOrphans as Ft, deleteBudgetKey as G, repairMalformedResourcePropertiesForReadOnly as Ga, escapeRegExp$3 as Gc, displayLogicalId as Gi, createPreDeleteFinalSnapshot as Gn, valueAtCoordinate as Go, INTRINSIC_KEYS as Gr, applyCrossPrefixScan as Gs, recordAfterRollbackUpdate as Gt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as H, repairMalformedOrphansForReadOnly as Ha, runDockerForeground as Hc, UNREADABLE_RESOURCES_MAP_ROW as Hi, PRE_DELETE_SNAPSHOT_TYPES as Hn, passedNoEchoParametersOf as Ho, reDisableInstanceApiTermination as Hr, rebuildClientForBucketRegion as Hs, getStackRecords as Ht, recordedProtectionNote as I, refuseMalformedResourcePropertiesForOrphan as Ia, isDockerClientEnvKey as Ic, passedParameterClassesOf as Ii, injectedAwsRegionValue as Il, secretNamePrintingBags as In, maskReadbackAtCoordinates as Io, isWaitAbandonedError as Ir, TEMPLATE_SOURCED_RULES as Is, makeForeignHolderScan as It, DELETE_INDEX_WAIT_PROCEED_NOTE as J, unreadableOrphanRecords as Ja, AssetManifestLoader as Jc, hasReadableResources as Ji, refusesFinalSnapshot as Jn, createUnionSecretMasker as Jo, producerLookupOver as Jr, isNotImplemented as Js, isReplacementOrphan as Jt, resolveDynamoDbDeleteBudgetClock as K, repairMalformedResourcesForReadOnly as Ka, stripControlChars as Kc, hasReadableOrphans as Ki, effectiveDeletionPolicy as Kn, liveMatchesUnresolvedTokenFrame as Ko, IntrinsicFunctionResolver as Kr, crossPrefixDeniedWarning as Ks, demoteSupersededOrphans as Kt, PROTECTION_PROPERTY_BY_TYPE as L, refuseMalformedResourcesForDeploy as La, isMalformedEnvKey as Lc, declaresNoEcho as Li, clearBucketRegionCache as Ll, secretNamedRecordNeedles as Ln, maskWholeValue as Lo, markWaitAbandoned as Lr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ls, sameJournaledOrphans as Lt, noEchoComparisonForTemplate as M, refuseMalformedResourceEntriesForOrphan as Ma, dockerSpawnEnvWithSensitive as Mc, refStateLookupFromResource as Mi, displayAssemblyPath as Ml, journaledOrphanPrintingBag as Mn, TemplateParser as Mo, deleteIndeterminateGuards as Mr, wholeStringLeavesOf as Ms, dropFailedHint as Mt, noEchoExactEchoLeavesOf as N, refuseMalformedResourcePropertiesForDestroy as Na, finchSecretArgvRefusal as Nc, parseWebACLArn as Ni, renderAssemblyPathEscape as Nl, maskEventTextWithBoundBags as Nn, canonicalCoordinates as No, deleteLeftInPlace as Nr, STATE_SOURCED_BASELINE_RULES as Ns, isHandledOrphan as Nt, serviceTokenBlockingReason as O, refuseMalformedResourceEntriesForDeploy as Oa, resolveDockerContextDirectory as Oc, keepsSecretReferenceToken as Oi, nullPrototypeRecord as Ol, bindingSkippedOutputs as On, canonicalLambdaFunctionName as Oo, slowCcOperationTimeoutMs as Or, recordMaskOnlyValuesIn as Os, collectNestedChildUnaddressed as Ot, noEchoParameterNamesOf as P, refuseMalformedResourcePropertiesForDrift as Pa, formatDockerLoginError as Pc, withSharedDrainBudget as Pi, resolveAssemblyPath as Pl, orphanRecordsPrintingBag as Pn, isMarkedCoordinate as Po, deleteSkipReason as Pr, STATE_SOURCED_CROSS_GENERATION_RULES as Ps, journaledOrphanLines as Pt, ECR_AUTO_DELETE_IMAGES_TAG as Q, findSilentDropProperties as Qa, getDefaultStateBucketName as Qc, malformedExportNamesWarning as Qi, findDestructiveChanges as Qn, printingCorpusOf as Qo, assertSendableRoleArn as Qr, exportNamesCarriedFrom as Qs, recordUnderIdIsNotOwn as Qt, isProtectionValueActive as R, refuseMalformedResourcesForDestroy as Ra, partitionSensitiveEnv as Rc, JSON_LISTING_HOLE_VALUE as Ri, resolveBucketRegion as Rl, stateSecretNameNeedles as Rn, maskedLeafCoordinatesOf as Ro, disableInstanceApiTermination as Rr, isSingleDynamicReferenceToken as Rs, replayFailedOperations as Rt, lookupEachName as S, refuseMalformedOrphansForDestroy as Sa, parseBootstrapMarker as Sc, parameterTypeMayLoseSecretIdentity as Si, AssemblyReader as Sl, exportNameSecretExposure as Sn, requireConfigObject as So, getCurrentResourceSecrets as Sr, recordAttributeIdCopy as Ss, getNestedRevertRun as St, recordRetainedForReadoption as T, refuseMalformedOutputsForDestroy as Ta, validateContainerRepoName as Tc, carriesDynamicReference as Ti, defineOwnKey as Tl, collectDeclaredOutputNames as Tn, templateResourceTypes as To, applyCustomResourceResponseExpiration as Tr, carriesSecretMask as Ts, revertNestedChildFromJournal as Tt, beginDeleteWait as U, repairMalformedOutputsForReadOnly as Ua, runDockerStreaming as Uc, accountArgs as Ui, buildFinalSnapshotIdentifier as Un, readbackPathFor as Uo, reEnableInstanceApiTermination as Ur, CrossPrefixReadError as Us, withStackRecords as Ut, DynamoDBGlobalTableProvider as V, repairMalformedOrphanRecordsForReadOnly as Va, redactedDockerCause as Vc, UNREADABLE_ORPHANS_CONTAINER_ROW as Vi, ATOMIC_FINAL_SNAPSHOT_TYPES as Vn, noEchoOutputsComparison as Vo, observeThenDisableInstanceApiTermination as Vr, S3StateBackend as Vs, destroyStackRecordsView as Vt, compensateRemovedDeletionProtection as W, repairMalformedResourceEntriesForReadOnly as Wa, warnFinchArgvExposure as Wc, deployRefusesOrphanRowsReason as Wi, ccRoutedFinalSnapshotError as Wn, readsNoEchoSource as Wo, DiffCalculator as Wr, CrossPrefixScanCache as Ws, removeProtectionTypeList as Wt, deleteTableWithIndexBusyRetry as X, withheldAccountClause as Xa, Synthesizer as Xc, isReadableResourceEntry as Xi, maskingRetryLogger as Xn, literalSplitDelimitersOf as Xo, applyRoleArnIfSet as Xr, acceptedCreateOnlyDropsOf as Xs, planRollback as Xt, INDEX_SETTLE_POLL_INTERVAL_MS as Y, unreadableResourceEntries as Ya, getDockerImageBySourceHash as Yc, isReadableOrphanRecord as Yi, unsupportedFinalSnapshotError as Yn, hasMaskableValues as Yo, refuseUnreadableCdkCrossAccountRefs as Yr, splitImportedOps as Ys, planFailedOps as Yt, waitForIndexesSettled as Z, findActionableSilentDrops as Za, synthesisStatusMessage as Zc, malformedDriftResourcePropertiesWarning as Zi, constructPathOf as Zn, logOnlyValueCount as Zo, assertFlagRoleArn as Zr, describeRegionValueKind as Zs, recheckFailedPlan as Zt, keptWholeReasonText as _, refuseDivergentRecordRegionForDestroy as _a, BOOTSTRAP_MARKER_PREFIX as _c, classifyReplaySecretRegion as _i, decodeListingKey as _l, secretBearing as _n, configIntegerRefusal as _o, isCustomResource as _r, identityKeyFor as _s, planOrphanAdoption as _t, inheritedProvenanceForChildDiff as a, malformedOrphanRowsKeptWarning as aa, orphansAfterRollback as ac, envCredentialsAreAssumedRole as ai, resolveStateBucketWithDefault as al, inheritProducerRegions as an, MULTI_REGION_RECREATE_BLOCKED_TYPES as ao, DBPROXY_TAGS_WHAT as ar, maskSecretsInText as as, createReadOnlyAttributeHealerFactory as at, chunks as b, refuseMalformedOrphanRecordsForDestroy as ba, getBootstrapMarkerKey as bc, coerceParameterTypedValue as bi, canonicalizeRegion as bl, carriedExportAliasExposure as bn, replayWarn as bo, readsNoEchoDeleteValues as br, recoverMaskedOutput as bs, displacedPhysicalIdShown as bt, isAbsoluteAssetPath as c, malformedOutputsRefusalMessage as ca, AssetPublisher as cc, outputReferenceProvenanceOf as ci, stateBucketExistenceConfirmed as cl, redactedDeleteAddressFields as cn, renderStatefulReason as co, readTagList as cr, snapshotPassProvenance as cs, gray as ct, templateIdentity as d, malformedResourceEntriesWarning as da, WorkGraph as dc, s3BucketArn as di, CFN_TEMPLATE_BODY_LIMIT as dl, updatePartialReason as dn, isWarmThroughputDecrease as do, tagPlanWarning as dr, withPhysicalNameCopies as ds, yellow as dt, malformedLocalOutputsWarning as ea, hasReasonlessBaselineRefusal as ec, isIamRoleArn as ei, loadCdkJson as el, resolveReplacementOldType as en, withoutSilentDropProperties as eo, earliestDefined as er, recordLogOnlyValue as es, hasCdkAutoDeleteTag as et, conditionFingerprint as f, malformedResourcePropertiesWarning as fa, buildAssetRedirectMap as fc, s3BucketDomainName as fi, CFN_TEMPLATE_URL_LIMIT as fl, DeploymentEventsReader as fn, toCfnInteger as fo, definedAttributes as fr, withoutPhysicalNameCopies as fs, computeParameterTaint as ft, isSecretBearingReferenceString as g, previewableOrphanRecords as ga, AssetModeResolver as gc, classifyRecordedSecretRegion as gi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as gl, exportAliasCollisionScrubWarning as gn, configBooleanRefusal as go, ccBrokenReason as gr, pathCrossesDottedKey as gs, makeSiblingClaimReader as gt, readRecordedConditionVerdicts as h, malformedStateRefusalMessage as ha, rewriteTemplateAssetReferences as hc, s3BucketWebsiteUrl as hi, uploadCfnTemplate as hl, displayTextOrWithheld as hn, coerceCfnInteger as ho, ProviderRegistry as hr, isUncertifiedBaselineMaskPosition as hs, resourcesNamingDeclaredParameter as ht, crossStackOutputProvenanceSource as i, malformedOrphanRecordsWarning as ia, isReadableBag as ic, callerEnvCredentials as ii, resolveSkipPrefix as il, getCurrentProducerRegions as in, shownType as io, acquireIdempotencyToken as ir, maskSecretsInError as is, formatResourceLine as it, noEchoAttributeNamesOf as j, refuseMalformedResourceEntriesForImportSave as ja, describeDockerFailure as jc, isStalePlaceholderArnAttribute as ji, describeFileReadFailure as jl, completedReplayEntries as jn, DagBuilder as jo, UNSPECIFIED_SKIP_REASON as jr, recordProvenPublicExpression as js, deleteJournaledOrphans as jt, withResourceDeadline as k, refuseMalformedResourceEntriesForDestroy as ka, describeDockerCapturedOutput as kc, AWS_NO_VALUE as ki, ownValue as kl, DEFAULT_RESOURCE_TIMEOUT_MS as kn, lambdaFunctionNameForMask as ko, unchangedBehindSecretReference as kr, recordNoEchoAttributeValues as ks, getCurrentNestedStackContext as kt, listNestedTemplateRows as l, malformedOutputsWarning as la, isSensitiveAttributeName as lc, recordedOutputReferenceRegions as li, warnDeprecatedNoPrefixCliFlag as ll, redactedDeleteAddressSkip as ln, WARM_THROUGHPUT_MEMBERS as lo, refuseMalformedDesiredTags as lr, redactSecretsForState as ls, green as lt, parentSuppliedValues as m, malformedScrubResourceEntriesRefusalMessage as ma, loadPublishableAssetManifest as mc, s3BucketRegionalDomainName as mi, findLargeInlineResources as ml, WITHHELD_NAME_DISPLAY as mn, coerceCfnBoolean as mo, CC_BROKEN_REASON as mr, dynamicReferenceTokens as ms, reachableDivergentParameters as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedLocalResourcesWarning as na, importableOutputKeys as nc, AWS_CREDENTIAL_ENV_KEYS as ni, resolveAutoAssetStorage as nl, orphanDeleteNeedsIdentity as nn, hasNoCloudControlHandlers as no, reserveStackCreateToken as nr, createSecretMasker as ns, getPriorAttempts as nt, childTemplateLoader as o, malformedOrphansRefusalMessage as oa, orphansCarriedFrom as oc, isSettledInstanceState as oi, resolveStateBucketWithDefaultAndSource as ol, REDACTED_DELETE_ADDRESS_SKIP_REASON as on, isStatefulRecreateTargetForReplace as oo, DBPROXY_TAG_OPTIONS as or, markSameGenerationBag as os, bold as ot, conditionInputsFrom as p, malformedResourcesWarning as pa, createAssetRedirectResolver as pc, s3BucketDualStackDomainName as pi, MIGRATE_TMP_PREFIX as pl, DeploymentEventsStore as pn, toFiniteNumber as po, stringifyIfAssigned as pr, DYNAMIC_REFERENCE_TOKEN_SCAN as ps, namesAnyDeclaredParameter as pt, resolveDynamoDbDeleteBudgetMs as q, unpreviewableOrphanRecords as qa, stripForDisplay as qc, hasReadableOutputs as qi, isFinalSnapshotError as qn, carryLogOnlyValues as qo, poisonRenderedSpellingsCollidingIn as qr, isAccessDenied$1 as qs, isJournaledOrphan as qt, computeImplicitDeleteEdges as r, malformedOrphanRecordsRefusalMessage as ra, importableOutputs as rc, applyCallerIdentityCredentials as ri, resolveCaptureObservedState as rl, findNestedStackTypeChanges as rn, findReplacedReadersOfRecreateTargets as ro, withCreateTokenLedger as rr, errorCauseChain as rs, markRefusedBeforeApplying as rt, findNestedTemplateTreeDefect as s, malformedOrphansWarning as sa, shouldRetainResource as sc, keepHeldTokenProvenance as si, resolveUseCdkBootstrapAssets as sl, isRedactedRecordedValue as sn, isStatefulRecreateTargetSync as so, planTagDiff as sr, recordReferenceProvenanceEntry as ss, cyan as st, DeployEngine as t, malformedLocalResourceEntriesWarning as ta, hasUnverifiableParameterRefusal as tc, sendableAssumeRoleCommand as ti, resolveApp as tl, seedsDeleteFirstGuard as tn, NO_CC_HANDLERS_REASON as to, ledgerForStack as tr, shareLogOnlyValues as ts, isTruthyCfnBoolean as tt, renderNestedTemplateTreeDefect as u, malformedRenderedContainersWarning as ua, stringifyValue as uc, recordedReferenceRegions as ui, ssmResolvedValueType as ul, updatePartialMessage as un, coerceWarmThroughput as uo, tagMapAsList as ur, scrubResourceRecord as us, red as ut, mergeNoChangeOutputs as v, refuseMalformedNestedChildOutputs as va, assertAssetBucketRegion as vc, producerRegionsFromState as vi, expectedOwnerParam as vl, secretBearingStateKeyWarning as vn, configStringRefusal as vo, wouldReturnToSdkProvider as vr, inheritNestedStackParameterAssociations as vs, NESTED_PENDING_PARENT_REASON as vt, keptForReadoption as w, refuseMalformedOutputs as wa, validateAssetBucketName as wc, isImpossibleEmptyStoredAttribute as wi, processStackMessages as wl, noEchoParameterValueSeed as wn, prefetchCreateOnlyPropertyPaths as wo, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as wr, splitGetAttStringForm as ws, recordDisplacedSkips as wt, isAccessDeniedError as x, refuseMalformedOrphans as xa, isCrossRegionRedirect as xc, isUnboundTemplateParameter as xi, derivePartitionAndUrlSuffix as xl, exportNameNoEchoParameters as xn, requireConfigArray as xo, isCustomResourceType as xr, physicalNameCopiesOf as xs, dropSettledNestedJournals as xt, makeCanonicalizePropertiesFn as y, refuseMalformedOrphanRecords as ya, ensureAssetStorage as yc, regionLessSecretName as yi, PARTITION_TABLE as yl, secretSafeKeyDisplay as yn, readConfigString as yo, TemplateNoEchoReresolver as yr, recordNestedStackParameterExpressions as ys, displacedOpClause as yt, perType as z, refuseMalformedResourcesForExport as za, redactDockerArgvValues as zc, STATE_REGION_DIVERGED as zi, storedSecretNameNeedles as zn, noEchoCoordinatesOf as zo, ec2InstanceProtectionSite as zr, LockManager as zs, replayRollback as zt };
+//# sourceMappingURL=deploy-engine-DWIbDQdg.js.map