@go-to-k/cdkd 0.299.3 → 0.299.5

package/dist/{deploy-engine-DEBgHf6Z.js → deploy-engine-D6CSo8Gj.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-Bj7qH5Ph.js";
-import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, H as truncateCodePoints, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as terminalSafe, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
-import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-Pn2m0R67.js";
+import { A as UNRENDERABLE, B as safeMsg, C as looksLikeCdkdGeneratedName, D as SAFE_MSG_ALTERED_CHAR, E as withoutGeneratedFallbackName, F as displaySafe, H as terminalSafe, I as displayStackName, L as isPasteableIdent, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, S as getCurrentStackName, T as withStackName, U as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, j as asIsMessage, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
+import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-dAY3-gXJ.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-DBXBcg0J.js";
-import { t as getCdkdVersion } from "./version-B7Gzz6TR.js";
+import { t as getCdkdVersion } from "./version-FFcDgFAc.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -5427,6 +5427,46 @@ async function readEarlierStateResources(s3, bucket, owner, key, max) {
 		}
 	}))).filter((r) => r !== void 0);
 }
+async function keyMayHaveVersions(s3, bucket, owner, key) {
+	try {
+		const listed = await s3.send(new ListObjectVersionsCommand({
+			Bucket: bucket,
+			...await owner(),
+			Prefix: key,
+			EncodingType: "url",
+			MaxKeys: 1
+		}));
+		return (listed.Versions ?? []).length + (listed.DeleteMarkers ?? []).length > 0 || listed.IsTruncated === true;
+	} catch {
+		return true;
+	}
+}
+async function listVersionedSubdirectories(s3, bucket, owner, prefix) {
+	const out = [];
+	let keyMarker;
+	let versionIdMarker;
+	for (;;) {
+		const listed = await s3.send(new ListObjectVersionsCommand({
+			Bucket: bucket,
+			...await owner(),
+			Prefix: prefix,
+			Delimiter: "/",
+			EncodingType: "url",
+			...keyMarker !== void 0 && { KeyMarker: keyMarker },
+			...versionIdMarker !== void 0 && { VersionIdMarker: versionIdMarker }
+		}));
+		for (const cp of listed.CommonPrefixes ?? []) {
+			const decoded = decodeListingKey(cp.Prefix);
+			if (decoded === void 0 || !decoded.startsWith(prefix)) continue;
+			const segment = decoded.slice(prefix.length).replace(/\/$/, "");
+			if (segment !== "") out.push(segment);
+		}
+		if (listed.IsTruncated !== true) return out;
+		if (listed.NextKeyMarker === void 0) throw new Error("a truncated version listing returned no NextKeyMarker");
+		keyMarker = decodeListingKey(listed.NextKeyMarker);
+		versionIdMarker = listed.NextVersionIdMarker;
+	}
+}
 
 //#endregion
 //#region src/state/retained-time.ts
@@ -5513,6 +5553,7 @@ function legacyProbeBelongsTo(probe, region) {
 }
 const KEPT_AT_CLOCK_TOLERANCE_MS = 2e3;
 const ROLLBACK_JOURNAL_OBJECT_DESCRIPTION = "the rollback journal, whose `failedOperations[].attemptedProperties` records the properties of the failed write verbatim";
+const STATE_RECORD_OBJECT_DESCRIPTION = "the stack's state record, which carries every resource's recorded properties and attributes";
 var S3StateBackend = class S3StateBackend {
 	logger = getLogger().child("S3StateBackend");
 	s3Client;
@@ -5767,6 +5808,49 @@ var S3StateBackend = class S3StateBackend {
 			await this.deleteRollbackJournal(stackName, region);
 		}
 	}
+	async purgeDeletedStateHistory(stackName, region) {
+		try {
+			await this.ensureClientForBucket();
+			const stateKey = this.getStateKey(stackName, region);
+			const shown = displayStackName(stackName);
+			let recordBack;
+			try {
+				recordBack = await this.headObject(stateKey);
+			} catch {
+				recordBack = true;
+			}
+			if (recordBack) {
+				this.logger.warn(safeMsg`Kept the earlier versions of the state record for ${shown}: the record exists again, or its absence could not be confirmed, so they may belong to a live record.`);
+				return;
+			}
+			const keys = [stateKey];
+			const legacyKey = this.getLegacyStateKey(stackName);
+			const mayHave = (key) => keyMayHaveVersions(this.s3Client, this.config.bucket, () => this.ownerParam(), key);
+			if (await mayHave(legacyKey)) {
+				const legacyProbe = await this.probeLegacyState(stackName);
+				const keptBecause = legacyProbe.kind === "unreadable" ? `the legacy record could not be read (${legacyProbe.reason})` : legacyProbe.kind !== "absent" ? "its current body belongs to another record of the stack" : await this.otherRegionHistoryState(stackName, region, mayHave);
+				if (keptBecause === "none") keys.push(legacyKey);
+				else {
+					const why = keptBecause === "exists" ? "another region of the stack still has state record versions, current or earlier, and the legacy versions may be that region's" : keptBecause === "unknown" ? "could not list the stack's other regions to confirm none of them still owns that history" : keptBecause;
+					this.logger.warn(safeMsg`Kept the earlier versions of the legacy state record for ${shown}: ${why}. cdkd state destroy purges them only once no other region of the stack has state record versions and the legacy record can be read; otherwise delete them by hand.`);
+				}
+			}
+			await this.purgeNoncurrentVersions(keys, { objectDescription: STATE_RECORD_OBJECT_DESCRIPTION });
+		} catch (error) {
+			this.logger.warn(safeMsg`Could not purge the earlier versions of the state record for ${displayStackName(stackName)}: ${describeAwsFailure(error).summary}. They remain readable via GetObject with a VersionId.`);
+		}
+	}
+	async otherRegionHistoryState(stackName, region, mayHave) {
+		const stackPrefix = `${this.config.prefix}/${stackName}/`;
+		try {
+			const regions = (await listVersionedSubdirectories(this.s3Client, this.config.bucket, () => this.ownerParam(), stackPrefix)).filter((segment) => segment !== region);
+			for (const other of regions) if (await mayHave(this.getStateKey(stackName, other))) return "exists";
+			return "none";
+		} catch (error) {
+			this.logger.debug(safeMsg`Could not list the other regions of ${displayStackName(stackName)}: ${displaySafe(describeAwsFailure(error).detail, { asciiOnly: true }) || "<unrenderable>"}`);
+			return "unknown";
+		}
+	}
 	async deleteLegacyState(stackName) {
 		await this.ensureClientForBucket();
 		const key = this.getLegacyStateKey(stackName);
@@ -7122,6 +7206,28 @@ function nanIfUncoercible(value) {
 //#endregion
 //#region src/deployment/secret-redaction/rules.ts
 const MIN_NEEDLE_LENGTH = 4;
+function printingNeedles(values) {
+	const out = /* @__PURE__ */ new Set();
+	for (const value of values) {
+		if (value.length < 4) continue;
+		out.add(value);
+		const flat = flattenedSpelling(value);
+		if (flat !== void 0 && flat.trim().length >= 4) out.add(flat);
+	}
+	return [...out];
+}
+const FLATTENED_MEMO_CAP = 4096;
+const flattenedMemo = /* @__PURE__ */ new Map();
+function flattenedSpelling(value) {
+	if (!SAFE_MSG_ALTERED_CHAR.test(value)) return void 0;
+	let flat = flattenedMemo.get(value);
+	if (flat === void 0) {
+		flat = safeMsg`${value}`;
+		if (flattenedMemo.size >= FLATTENED_MEMO_CAP) flattenedMemo.clear();
+		flattenedMemo.set(value, flat);
+	}
+	return flat === value ? void 0 : flat;
+}
 function escapeRegExp$2(value) {
 	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -7189,7 +7295,7 @@ const WHOLE_DYNAMIC_REFERENCE_PATTERN = new RegExp(`^\\{\\{resolve:${DYNAMIC_REF
 function isSingleDynamicReferenceToken(value) {
 	return WHOLE_DYNAMIC_REFERENCE_PATTERN.test(value);
 }
-function isPlainObject$5(value) {
+function isPlainObject$7(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
@@ -7438,7 +7544,7 @@ function crossStackSourceKey(source) {
 	}
 	if (key === "Fn::GetStackOutput") {
 		const args = source[key];
-		if (!isPlainObject$5(args)) return void 0;
+		if (!isPlainObject$7(args)) return void 0;
 		const stackName = Object.hasOwn(args, "StackName") ? literalStringOrUndefined(args["StackName"]) : void 0;
 		const outputName = Object.hasOwn(args, "OutputName") ? literalStringOrUndefined(args["OutputName"]) : void 0;
 		if (stackName === void 0 || outputName === void 0) return void 0;
@@ -7484,7 +7590,7 @@ function crossStackSourceKey(source) {
 		let template;
 		let variables;
 		if (typeof raw === "string") template = raw;
-		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$5(raw[1])) {
+		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$7(raw[1])) {
 			if (typeof raw[0] !== "string") return void 0;
 			template = raw[0];
 			variables = raw[1];
@@ -7727,12 +7833,12 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, rules = TEMPLATE_DERIVED_RULES) {
 	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$4) return;
 	if (secrets.size === 0) return;
-	if (!isPlainObject$5(resolvedProperties) || !isPlainObject$5(sourceProperties)) return;
+	if (!isPlainObject$7(resolvedProperties) || !isPlainObject$7(sourceProperties)) return;
 	if (!Object.hasOwn(resolvedProperties, "Parameters")) return;
 	if (!Object.hasOwn(sourceProperties, "Parameters")) return;
 	const resolvedParameters = resolvedProperties["Parameters"];
 	const sourceParameters = sourceProperties["Parameters"];
-	if (!isPlainObject$5(resolvedParameters) || !isPlainObject$5(sourceParameters)) return;
+	if (!isPlainObject$7(resolvedParameters) || !isPlainObject$7(sourceParameters)) return;
 	const positioned = redactSecretsForState(markSameGenerationBag({ ...resolvedParameters }), secrets, sourceParameters, rules);
 	let table = nestedStackParameterExpressions.get(secrets);
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
@@ -7781,7 +7887,7 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 		if (typeof resolvedValue !== "string") return void 0;
 		const sourceLeaf = sourceParameters[name];
 		if (typeof sourceLeaf === "string") return sourceLeaf;
-		if (!isPlainObject$5(sourceLeaf)) return void 0;
+		if (!isPlainObject$7(sourceLeaf)) return void 0;
 		const written = positioned[name];
 		if (typeof written !== "string") return void 0;
 		const rendered = intrinsicSkeletonSegments(sourceLeaf)?.map((s) => s === UNKNOWN_PART ? "\0" : s).join("");
@@ -7992,7 +8098,7 @@ function appendValuePlaceholderParts(value, out, budget, depth) {
 	if (budget.exhausted) return;
 	const literal = joinPartLiteralText(value);
 	if (literal !== void 0) return pushPlaceholderPart(out, literal, budget);
-	if (isPlainObject$5(value) && Object.keys(value).length === 1) {
+	if (isPlainObject$7(value) && Object.keys(value).length === 1) {
 		const ref = value["Ref"];
 		if (typeof ref === "string" && ref !== "") return pushPlaceholderPart(out, keyedPart({ Ref: ref }), budget);
 		if (depth >= MAX_PLACEHOLDER_DEPTH) {
@@ -8024,7 +8130,7 @@ function appendParameterPlaceholderParts(source, out, budget, depth) {
 		let template;
 		let variables = {};
 		if (typeof args === "string") template = args;
-		else if (Array.isArray(args) && args.length === 2 && isPlainObject$5(args[1])) {
+		else if (Array.isArray(args) && args.length === 2 && isPlainObject$7(args[1])) {
 			template = args[0];
 			variables = args[1];
 		} else return false;
@@ -8172,7 +8278,7 @@ function isUniquelyKeyedBy(items, key) {
 	if (items.length === 0) return false;
 	const seen = /* @__PURE__ */ new Set();
 	for (const item of items) {
-		if (!isPlainObject$5(item) || !Object.hasOwn(item, key)) return false;
+		if (!isPlainObject$7(item) || !Object.hasOwn(item, key)) return false;
 		const id = item[key];
 		if (typeof id !== "string" || id === "") return false;
 		if (seen.has(id)) return false;
@@ -8202,11 +8308,11 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		return positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration);
 	}
-	if ((typeof bag === "string" || Array.isArray(bag)) && isPlainObject$5(source)) {
+	if ((typeof bag === "string" || Array.isArray(bag)) && isPlainObject$7(source)) {
 		const inherited = positionByInheritedParameter(bag, source, secrets);
 		if (inherited !== void 0) return inherited;
 	}
-	if (typeof bag === "string" && isPlainObject$5(source)) {
+	if (typeof bag === "string" && isPlainObject$7(source)) {
 		const certified = positionByCrossStackSource(bag, source, secrets);
 		if (certified !== void 0) return certified;
 		const placeheld = positionByParameterPlaceholders(bag, source, secrets);
@@ -8216,7 +8322,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		const framed = positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIsSameGeneration);
 		if (framed !== void 0) return framed;
 	}
-	if (Array.isArray(bag) && isPlainObject$5(source)) {
+	if (Array.isArray(bag) && isPlainObject$7(source)) {
 		const positionedList = positionListByCrossStackSource(bag, source, secrets);
 		if (positionedList !== void 0) return positionedList;
 	}
@@ -8244,7 +8350,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration));
 	}
-	if (isPlainObject$5(bag) && hasPlainPrototype(bag) && isPlainObject$5(source)) {
+	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactSecretsForState(v, secrets);
 		return out;
@@ -8257,7 +8363,7 @@ function isReadbackProjectedFromState(rules) {
 function subtreeHasDynamicReference(value) {
 	if (isDynamicReferenceString(value)) return true;
 	if (Array.isArray(value)) return value.some(subtreeHasDynamicReference);
-	if (isPlainObject$5(value)) return Object.values(value).some(subtreeHasDynamicReference);
+	if (isPlainObject$7(value)) return Object.values(value).some(subtreeHasDynamicReference);
 	return false;
 }
 function pathCrossesDottedKey(bag, path) {
@@ -8332,8 +8438,8 @@ function deepEqualJsonValue(a, b) {
 		if (!Array.isArray(b) || a.length !== b.length) return false;
 		return a.every((item, i) => deepEqualJsonValue(item, b[i]));
 	}
-	if (isPlainObject$5(a)) {
-		if (!isPlainObject$5(b)) return false;
+	if (isPlainObject$7(a)) {
+		if (!isPlainObject$7(b)) return false;
 		if (!hasPlainPrototype(a) || !hasPlainPrototype(b)) return false;
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
@@ -8359,7 +8465,7 @@ function refuseUncertifiedSubtree(value, sourceLiterals, mark, seen = /* @__PURE
 		for (const item of value) out.push(refuseUncertifiedSubtree(item, sourceLiterals, mark, seen));
 		return out;
 	}
-	if (isPlainObject$5(value) && hasPlainPrototype(value)) {
+	if (isPlainObject$7(value) && hasPlainPrototype(value)) {
 		const out = Object.create(null);
 		seen.set(value, out);
 		for (const [k, v] of Object.entries(value)) out[k] = refuseUncertifiedSubtree(v, sourceLiterals, mark, seen);
@@ -8387,7 +8493,7 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 		return mark ? POSITION_DECIDED : source;
 	}
 	if (!subtreeHasDynamicReference(source)) return bag;
-	if (isPlainObject$5(bag) && hasPlainPrototype(bag) && isPlainObject$5(source)) {
+	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, failClosed, learn, mark) : v;
 		return out;
@@ -8414,14 +8520,14 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 function isDistinguishingAnchor(value) {
 	if (typeof value === "string") return value !== "";
 	if (Array.isArray(value)) return value.some(isDistinguishingAnchor);
-	if (isPlainObject$5(value)) return Object.values(value).some(isDistinguishingAnchor);
+	if (isPlainObject$7(value)) return Object.values(value).some(isDistinguishingAnchor);
 	return false;
 }
 const ANCHOR_REFERENCE_MASK = "<ref>";
 function anchorSignature(source) {
 	if (isDynamicReferenceString(source)) return ANCHOR_REFERENCE_MASK;
 	if (Array.isArray(source)) return `[${source.map(anchorSignature).sort().join(",")}]`;
-	if (isPlainObject$5(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
+	if (isPlainObject$7(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
 	return JSON.stringify(source) ?? "undefined";
 }
 function anchorsCorroboratePairing(bag, source, anchors) {
@@ -8431,8 +8537,8 @@ function anchorsCorroboratePairing(bag, source, anchors) {
 		return true;
 	}
 	if (isDynamicReferenceString(source)) return typeof bag === "string";
-	if (isPlainObject$5(source)) {
-		if (!isPlainObject$5(bag)) return false;
+	if (isPlainObject$7(source)) {
+		if (!isPlainObject$7(bag)) return false;
 		return Object.keys(source).every((k) => Object.hasOwn(bag, k) && anchorsCorroboratePairing(bag[k], source[k], anchors));
 	}
 	if (Array.isArray(source)) {
@@ -8523,13 +8629,13 @@ function learnMixedLeafNeedle(collector, bag, source) {
 	learnNeedle(collector, plaintext, token);
 }
 function asChild(marks, key) {
-	return isPlainObject$5(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
+	return isPlainObject$7(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
 }
 function asIndex(marks, index) {
 	return Array.isArray(marks) ? marks[index] : void 0;
 }
 function preferPositionDecisions(scanned, refused, bag, marks, inferred) {
-	if (isPlainObject$5(bag) && hasPlainPrototype(bag) && isPlainObject$5(refused) && isPlainObject$5(scanned)) {
+	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(refused) && isPlainObject$7(scanned)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(refused)) out[k] = preferPositionDecisions(scanned[k], v, bag[k], asChild(marks, k), inferred);
 		return out;
@@ -9039,6 +9145,11 @@ function passProvenanceFor(secrets, token) {
 	if (entry === void 0) return void 0;
 	return finalize(entry);
 }
+function passReadVersionsFor(secrets, token) {
+	if (secrets === void 0) return void 0;
+	const read = passProvenanceOf.get(secrets)?.get(token)?.readVersions;
+	return read === void 0 || read.size === 0 ? void 0 : read;
+}
 function finalize(entry) {
 	const out = {};
 	if (!entry.regionUnknown && entry.regions.size === 1) out.region = [...entry.regions][0];
@@ -9171,9 +9282,10 @@ function isSameGenerationBag(bag) {
 //#region src/deployment/secret-redaction/mask-errors.ts
 function maskSecretsInText(text, secrets) {
 	const logOnly = logOnlyValuesOf.get(secrets);
-	if (logOnly === void 0 || logOnly.size === 0) return maskRecordedSecretsInText(text, secrets);
-	if (text !== "" && (secrets.has(text) || logOnly.has(text))) return "***";
-	return maskMatchSpans(text, substringNeedles([...secrets.keys(), ...logOnly]), "***");
+	const noLogOnly = logOnly === void 0 || logOnly.size === 0;
+	if (secrets.size === 0 && noLogOnly) return text;
+	if (text !== "" && (secrets.has(text) || logOnly?.has(text) === true)) return "***";
+	return maskMatchSpans(text, printingNeedles(noLogOnly ? secrets.keys() : [...secrets.keys(), ...logOnly]), "***");
 }
 function maskRecordedSecretsInText(text, secrets) {
 	if (secrets.size === 0) return text;
@@ -9537,7 +9649,7 @@ function createUnionSecretMasker(bags) {
 				for (const plaintext of bag.keys()) needles.add(plaintext);
 				for (const plaintext of logOnlyValuesOf.get(bag) ?? []) needles.add(plaintext);
 			}
-			scanned = [...needles].filter((needle) => needle.length >= 4);
+			scanned = printingNeedles(needles);
 			stamp = now;
 		}
 		if (text !== "" && needles.has(text)) return "***";
@@ -9648,7 +9760,7 @@ function readsNoEchoSource(node, sources) {
 			if (typeof argument === "string") return subStringReadsNoEcho(argument, void 0, sources);
 			if (Array.isArray(argument)) {
 				const [text, variables] = argument;
-				const vars = isPlainObject$5(variables) ? variables : void 0;
+				const vars = isPlainObject$7(variables) ? variables : void 0;
 				if (typeof text === "string" && subStringReadsNoEcho(text, vars, sources)) return true;
 				return vars !== void 0 && Object.values(vars).some(walk);
 			}
@@ -9682,7 +9794,7 @@ function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
 		parameters: sources.parameters,
 		...sources.conditions !== void 0 && { conditions: sources.conditions }
 	};
-	const isBareDeclaredGetAtt = (node) => isPlainObject$5(node) && intrinsicKeyOf(node) === "Fn::GetAtt" && getAttReadsNoEcho(node["Fn::GetAtt"], sources);
+	const isBareDeclaredGetAtt = (node) => isPlainObject$7(node) && intrinsicKeyOf(node) === "Fn::GetAtt" && getAttReadsNoEcho(node["Fn::GetAtt"], sources);
 	const walk = (source, value, path) => {
 		if (value === void 0) return;
 		if (source === null || typeof source !== "object") return;
@@ -9698,7 +9810,7 @@ function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
 			const record = source;
 			const intrinsic = intrinsicKeyOf(record);
 			if (intrinsic === void 0) {
-				if (!isPlainObject$5(value)) {
+				if (!isPlainObject$7(value)) {
 					if (readsNoEchoSource(record, parametersOnly)) push(path, source);
 					return;
 				}
@@ -9746,7 +9858,7 @@ function maskWholeValue(value) {
 	if (value === null || value === void 0) return value;
 	if (typeof value === "string" && isSingleDynamicReferenceToken(value)) return value;
 	if (Array.isArray(value)) return value.map(maskWholeValue);
-	if (isPlainObject$5(value)) {
+	if (isPlainObject$7(value)) {
 		const out = {};
 		for (const [key, child] of Object.entries(value)) Object.defineProperty(out, key, {
 			value: maskWholeValue(child),
@@ -9769,7 +9881,7 @@ function readAt(bag, coordinate) {
 			node = node[segment];
 			continue;
 		}
-		if (!isPlainObject$5(node) || !Object.hasOwn(node, segment)) return {
+		if (!isPlainObject$7(node) || !Object.hasOwn(node, segment)) return {
 			found: false,
 			value: void 0
 		};
@@ -9785,7 +9897,7 @@ function valueAtCoordinate(bag, coordinate) {
 }
 function cloneContainer(node) {
 	if (Array.isArray(node)) return [...node];
-	if (isPlainObject$5(node)) return { ...node };
+	if (isPlainObject$7(node)) return { ...node };
 	return node;
 }
 function maskAtCoordinates(bag, coordinates) {
@@ -9852,20 +9964,20 @@ function readbackPathFor(readback, properties, coordinate) {
 			if (!Array.isArray(live)) return path.length === 0 ? void 0 : path;
 			const key = Array.isArray(desired) ? identityKeyFor(live, desired) : void 0;
 			const element = Array.isArray(desired) ? desired[segment] : void 0;
-			if (key === void 0 || !isPlainObject$5(element)) return path;
+			if (key === void 0 || !isPlainObject$7(element)) return path;
 			const identity = element[key];
-			const index = live.findIndex((item) => isPlainObject$5(item) && item[key] === identity);
+			const index = live.findIndex((item) => isPlainObject$7(item) && item[key] === identity);
 			if (index < 0) return path;
 			path.push(index);
 			live = live[index];
 			desired = element;
 			continue;
 		}
-		if (!isPlainObject$5(live)) return path.length === 0 ? void 0 : path;
+		if (!isPlainObject$7(live)) return path.length === 0 ? void 0 : path;
 		if (!Object.hasOwn(live, segment)) return void 0;
 		path.push(segment);
 		live = live[segment];
-		desired = isPlainObject$5(desired) ? desired[segment] : void 0;
+		desired = isPlainObject$7(desired) ? desired[segment] : void 0;
 	}
 	return path;
 }
@@ -9894,7 +10006,7 @@ function witnessNormalize(stored, today, v11) {
 	const confirmed = [];
 	const differing = [];
 	const walk = (s, t, v, path) => {
-		if (v !== "***" && containsMask(v) && (Array.isArray(v) ? !Array.isArray(s) || s.length !== v.length : isPlainObject$5(v) ? !isPlainObject$5(s) : false)) {
+		if (v !== "***" && containsMask(v) && (Array.isArray(v) ? !Array.isArray(s) || s.length !== v.length : isPlainObject$7(v) ? !isPlainObject$7(s) : false)) {
 			if (s === void 0 || containsMask(s)) return s;
 			if (jsonEqual(s, t)) {
 				confirmed.push(path);
@@ -9923,8 +10035,8 @@ function witnessNormalize(stored, today, v11) {
 			});
 			return changed ? out : s;
 		}
-		if (isPlainObject$5(v) && isPlainObject$5(s)) {
-			const tt = isPlainObject$5(t) ? t : {};
+		if (isPlainObject$7(v) && isPlainObject$7(s)) {
+			const tt = isPlainObject$7(t) ? t : {};
 			let out;
 			for (const key of Object.keys(v)) {
 				if (!Object.hasOwn(s, key)) continue;
@@ -9947,7 +10059,7 @@ function witnessNormalize(stored, today, v11) {
 function containsMask(value) {
 	if (value === "***") return true;
 	if (Array.isArray(value)) return value.some(containsMask);
-	if (isPlainObject$5(value)) return Object.values(value).some(containsMask);
+	if (isPlainObject$7(value)) return Object.values(value).some(containsMask);
 	return false;
 }
 function jsonEqual(a, b) {
@@ -9991,7 +10103,7 @@ function noEchoComparison(options) {
 					const out = node.map(walk);
 					return out.some((item, i) => item !== node[i]) ? out : node;
 				}
-				if (isPlainObject$5(node)) {
+				if (isPlainObject$7(node)) {
 					let out;
 					for (const [key, child] of Object.entries(node)) {
 						const next = walk(child);
@@ -11357,7 +11469,7 @@ const CREATE_ONLY_PATHS_SNAPSHOT = /* @__PURE__ */ new Map([
 	["AWS::AppSync::ApiKey", [["ApiId"]]],
 	["AWS::AppSync::DataSource", [["ApiId"], ["Name"]]],
 	["AWS::AppSync::GraphQLApi", []],
-	["AWS::AppSync::GraphQLSchema", [["ApiId"]]],
+	["AWS::AppSync::GraphQLSchema", []],
 	["AWS::AppSync::Resolver", [
 		["ApiId"],
 		["FieldName"],
@@ -11372,7 +11484,7 @@ const CREATE_ONLY_PATHS_SNAPSHOT = /* @__PURE__ */ new Map([
 		"BaseEvaluatorId"
 	], ["EvaluatorName"]]],
 	["AWS::BedrockAgentCore::Runtime", [["AgentRuntimeName"]]],
-	["AWS::Budgets::Budget", [["NotificationsWithSubscribers"]]],
+	["AWS::Budgets::Budget", [["Budget", "BudgetName"], ["NotificationsWithSubscribers"]]],
 	["AWS::CertificateManager::Certificate", [
 		["CertificateAuthorityArn"],
 		["CertificateExport"],
@@ -11863,7 +11975,7 @@ const CREATE_ONLY_PATHS_SNAPSHOT = /* @__PURE__ */ new Map([
 	]],
 	["AWS::RDS::DBProxyTargetGroup", [["DBProxyName"], ["TargetGroupName"]]],
 	["AWS::RDS::DBSubnetGroup", [["DBSubnetGroupName"]]],
-	["AWS::Route53::HostedZone", [["Name"]]],
+	["AWS::Route53::HostedZone", [["DelegationSetId"], ["Name"]]],
 	["AWS::Route53::RecordSet", [["HostedZoneId"], ["HostedZoneName"]]],
 	["AWS::S3::Bucket", [
 		["BucketName"],
@@ -12878,7 +12990,7 @@ function probeFoundSameId(resourceType, a, b) {
 //#region src/provisioning/config-shape.ts
 function readConfigString(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return fallback;
-	if (!isPlainObject$4(container) || isUnresolvedIntrinsicContainer(container)) {
+	if (!isPlainObject$6(container) || isUnresolvedIntrinsicContainer(container)) {
 		const detail = malformedShapeDetail(container);
 		if (options?.onUnusable) {
 			const named = fallback === "" ? "" : ` (${fallback})`;
@@ -12918,7 +13030,7 @@ function requireConfigArray(value, path, options) {
 	return value;
 }
 function requireConfigObject(value, path, options) {
-	if (!isPlainObject$4(value) || isUnresolvedIntrinsicContainer(value)) {
+	if (!isPlainObject$6(value) || isUnresolvedIntrinsicContainer(value)) {
 		const detail = malformedShapeDetail(value);
 		if (options?.onUnusable) {
 			options.onUnusable(`${path} must be an object ${detail}. Leaving this configuration unapplied here; the same value is REFUSED on a template-path create.`);
@@ -12930,7 +13042,7 @@ function requireConfigObject(value, path, options) {
 }
 function configStringRefusal(container, key, fallback, containerPath, options) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$4(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$6(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	return configValueRefusal(container[key], fallback, `${containerPath}.${key}`, options);
 }
 function coerceCfnBoolean(value) {
@@ -12943,7 +13055,7 @@ function coerceCfnBoolean(value) {
 }
 function configBooleanRefusal(container, key, containerPath) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$4(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$6(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	if (coerceCfnBoolean(value) !== void 0) return void 0;
@@ -12957,7 +13069,7 @@ function coerceCfnInteger(value) {
 }
 function configIntegerRefusal(container, key, containerPath, min, max) {
 	if (container === void 0 || container === null) return void 0;
-	if (!isPlainObject$4(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	if (!isPlainObject$6(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
 	const value = container[key];
 	if (value === void 0) return void 0;
 	const n = coerceCfnInteger(value);
@@ -12971,10 +13083,10 @@ function configValueRefusal(value, fallback, path, options) {
 	if (typeof value !== "string" || value.trim() === "") return `${path} must be a non-empty string ${malformedShapeDetail(value)}`;
 }
 function malformedShapeDetail(value) {
-	if (isPlainObject$4(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
+	if (isPlainObject$6(value) && isUnresolvedIntrinsicContainer(value)) return `(got ${describe(value)} — nothing substituted it before this call)`;
 	return `(got ${describe(value)}) — check for an unresolved intrinsic or a mis-nested template value`;
 }
-function isPlainObject$4(value) {
+function isPlainObject$6(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 const NAMEABLE_INTRINSIC_KEYS = /* @__PURE__ */ new Set([
@@ -13001,7 +13113,7 @@ function describe(value) {
 	if (value === null) return "null";
 	if (Array.isArray(value)) return "an array";
 	if (typeof value === "string") return value.trim() === "" ? "a blank string" : "a string";
-	if (isPlainObject$4(value) && isUnresolvedIntrinsicContainer(value)) {
+	if (isPlainObject$6(value) && isUnresolvedIntrinsicContainer(value)) {
 		const key = Object.keys(value)[0];
 		return NAMEABLE_INTRINSIC_KEYS.has(key) ? `an unresolved ${key} intrinsic` : "an unresolved intrinsic";
 	}
@@ -14323,7 +14435,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
-		readOnly: /* @__PURE__ */ new Set(["AnomalyDetectorId"]),
+		readOnly: /* @__PURE__ */ new Set(["Id"]),
 		ccRouteUnavailable: true
 	}],
 	["AWS::CodeBuild::Project", {
@@ -16186,8 +16298,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"QueryLoggingConfig",
 			"VPCs"
 		]),
-		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set(),
+		silentDrop: /* @__PURE__ */ new Map([["DelegationSetId", "not yet implemented by cdkd"]]),
+		createOnlyDrops: /* @__PURE__ */ new Set(["DelegationSetId"]),
 		readOnly: /* @__PURE__ */ new Set(["Id", "NameServers"]),
 		ccRouteUnavailable: false
 	}],
@@ -17891,7 +18003,7 @@ function maskedPropertyFingerprint(templateValue) {
 	return `${FINGERPRINT_PREFIX}${digest}`;
 }
 var UnknownInput = class extends Error {};
-function isPlainObject$3(value) {
+function isPlainObject$5(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 const DYNAMIC_REFERENCE_OPEN = "{{resolve:";
@@ -17911,7 +18023,7 @@ function carriesSecretValue(value, corpora) {
 	return false;
 }
 function parameterInputsFor(args) {
-	const declared = isPlainObject$3(args.template.Parameters) ? args.template.Parameters : {};
+	const declared = isPlainObject$5(args.template.Parameters) ? args.template.Parameters : {};
 	const values = args.values ?? {};
 	const inputs = /* @__PURE__ */ new Map();
 	const bound = {};
@@ -17922,7 +18034,7 @@ function parameterInputsFor(args) {
 			continue;
 		}
 		const value = values[name];
-		let secret = isPlainObject$3(definition) && declaresNoEcho(definition) || carriesSecretValue(value, []);
+		let secret = isPlainObject$5(definition) && declaresNoEcho(definition) || carriesSecretValue(value, []);
 		if (!secret && args.nestedChild === true && args.supplied !== void 0) {
 			if (Object.hasOwn(args.supplied, name)) {
 				const passed = args.passedClasses?.get(name);
@@ -17973,7 +18085,7 @@ function intrinsicKey(value) {
 const OPAQUE_ATTRIBUTE_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::CustomResource", NESTED_STACK_TYPE$4]);
 function hasOpaqueAttributes(logicalId, walk) {
 	const definition = walk.resources[logicalId];
-	const type = isPlainObject$3(definition) ? definition["Type"] : void 0;
+	const type = isPlainObject$5(definition) ? definition["Type"] : void 0;
 	return typeof type === "string" && (type.startsWith("Custom::") || OPAQUE_ATTRIBUTE_TYPES.has(type));
 }
 function getAttTarget(operand) {
@@ -17998,7 +18110,7 @@ function taintOf(logicalId, walk) {
 	const visit = (value) => {
 		if (typeof value === "string") return value.includes(DYNAMIC_REFERENCE_OPEN);
 		if (Array.isArray(value)) return value.some(visit);
-		if (!isPlainObject$3(value)) return false;
+		if (!isPlainObject$5(value)) return false;
 		const key = intrinsicKey(value);
 		const operand = key === void 0 ? void 0 : value[key];
 		let verdict = "clean";
@@ -18010,7 +18122,7 @@ function taintOf(logicalId, walk) {
 		else if (key === "Fn::FindInMap" && mapReadClass(operand, walk.sources.template) !== "clean") verdict = "tainted";
 		else if (key === "Fn::Sub") {
 			const text = Array.isArray(operand) ? operand[0] : operand;
-			const vars = Array.isArray(operand) && isPlainObject$3(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$5(operand[1]) ? operand[1] : {};
 			if (typeof text === "string") for (const name of subPlaceholders(text)) {
 				if (Object.hasOwn(vars, name)) continue;
 				const owner = name.includes(".") ? name.split(".")[0] : name;
@@ -18024,7 +18136,7 @@ function taintOf(logicalId, walk) {
 		return Object.values(value).some(visit);
 	};
 	const definition = walk.resources[logicalId];
-	const result = visit(isPlainObject$3(definition) ? definition["Properties"] : void 0) ? "tainted" : unknown ? "unknown" : "clean";
+	const result = visit(isPlainObject$5(definition) ? definition["Properties"] : void 0) ? "tainted" : unknown ? "unknown" : "clean";
 	walk.inProgress.delete(logicalId);
 	walk.taint.set(logicalId, result);
 	return result;
@@ -18040,7 +18152,7 @@ function conditionInput(name, walk) {
 	return typeof verdict === "boolean" ? verdict : "unknown";
 }
 function conditionClosure(name, walk) {
-	const definitions = isPlainObject$3(walk.sources.template.Conditions) ? walk.sources.template.Conditions : {};
+	const definitions = isPlainObject$5(walk.sources.template.Conditions) ? walk.sources.template.Conditions : {};
 	let secret = false;
 	let unknown = false;
 	let unread = false;
@@ -18055,7 +18167,7 @@ function conditionClosure(name, walk) {
 			value.forEach(visit);
 			return;
 		}
-		if (!isPlainObject$3(value)) return;
+		if (!isPlainObject$5(value)) return;
 		const keys = Object.keys(value);
 		if (keys.length === 1 && keys[0] === "Condition" && typeof value["Condition"] === "string") {
 			pending.push(value["Condition"]);
@@ -18088,7 +18200,7 @@ function conditionClosure(name, walk) {
 		if (key === "Fn::Sub") {
 			const operand = value["Fn::Sub"];
 			const text = Array.isArray(operand) ? operand[0] : operand;
-			const vars = Array.isArray(operand) && isPlainObject$3(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$5(operand[1]) ? operand[1] : {};
 			if (typeof text === "string") for (const name of subPlaceholders(text)) {
 				if (Object.hasOwn(vars, name)) continue;
 				if (name.includes(".") && !name.startsWith("AWS::")) secret = true;
@@ -18117,8 +18229,8 @@ function mapReadClass(operand, template) {
 	const mapName = Array.isArray(operand) ? operand[0] : void 0;
 	if (typeof mapName !== "string") return "unknown";
 	const mappings = template.Mappings;
-	const map = isPlainObject$3(mappings) && Object.hasOwn(mappings, mapName) ? mappings[mapName] : void 0;
-	if (!isPlainObject$3(map)) return "unknown";
+	const map = isPlainObject$5(mappings) && Object.hasOwn(mappings, mapName) ? mappings[mapName] : void 0;
+	if (!isPlainObject$5(map)) return "unknown";
 	return carriesSecretValue(map, []) ? "secret" : "clean";
 }
 async function resolvedInput(node, walk) {
@@ -18186,7 +18298,7 @@ async function inputForm(value, walk) {
 			concrete: parts.every((p) => p.concrete)
 		};
 	}
-	if (!isPlainObject$3(value)) return {
+	if (!isPlainObject$5(value)) return {
 		form: value,
 		concrete: true
 	};
@@ -18249,7 +18361,7 @@ async function inputForm(value, walk) {
 					concrete: false
 				};
 			}
-			const explicit = Array.isArray(operand) && isPlainObject$3(operand[1]) ? operand[1] : {};
+			const explicit = Array.isArray(operand) && isPlainObject$5(operand[1]) ? operand[1] : {};
 			const vars = await inputForm(explicit, walk);
 			const placeholders = [];
 			let concrete = vars.concrete && !text.includes(DYNAMIC_REFERENCE_OPEN);
@@ -18302,8 +18414,8 @@ function newWalk(sources, nested = {
 }) {
 	return {
 		sources,
-		resources: isPlainObject$3(sources.template.Resources) ? sources.template.Resources : {},
-		parameters: isPlainObject$3(sources.template.Parameters) ? sources.template.Parameters : {},
+		resources: isPlainObject$5(sources.template.Resources) ? sources.template.Resources : {},
+		parameters: isPlainObject$5(sources.template.Parameters) ? sources.template.Parameters : {},
 		taint: /* @__PURE__ */ new Map(),
 		inProgress: /* @__PURE__ */ new Set(),
 		stackChain: nested.stackChain,
@@ -18327,34 +18439,34 @@ function passedKey(passed) {
 function isNestedStackRow(logicalId, walk) {
 	if (!Object.hasOwn(walk.resources, logicalId)) return false;
 	const definition = walk.resources[logicalId];
-	return isPlainObject$3(definition) && definition["Type"] === NESTED_STACK_TYPE$4;
+	return isPlainObject$5(definition) && definition["Type"] === NESTED_STACK_TYPE$4;
 }
 function getAttAttribute(operand, target) {
 	if (Array.isArray(operand)) return operand.length === 2 && typeof operand[1] === "string" ? operand[1] : void 0;
 	return typeof operand === "string" ? operand.slice(target.length + 1) : void 0;
 }
 function rowParameters(definition) {
-	const properties = isPlainObject$3(definition) ? definition["Properties"] : void 0;
+	const properties = isPlainObject$5(definition) ? definition["Properties"] : void 0;
 	if (properties === void 0) return {};
-	if (!isPlainObject$3(properties)) return "unknown";
+	if (!isPlainObject$5(properties)) return "unknown";
 	const parameters = properties["Parameters"];
 	if (parameters === void 0) return {};
-	if (!isPlainObject$3(parameters) || intrinsicKey(parameters) !== void 0) return "unknown";
+	if (!isPlainObject$5(parameters) || intrinsicKey(parameters) !== void 0) return "unknown";
 	return parameters;
 }
 function childParameterInputs(template, passed) {
-	const declared = isPlainObject$3(template.Parameters) ? template.Parameters : {};
+	const declared = isPlainObject$5(template.Parameters) ? template.Parameters : {};
 	const inputs = /* @__PURE__ */ new Map();
 	for (const name of Object.keys(declared)) {
 		const definition = declared[name];
-		if (isPlainObject$3(definition) && declaresNoEcho(definition)) inputs.set(name, { kind: "secret" });
+		if (isPlainObject$5(definition) && declaresNoEcho(definition)) inputs.set(name, { kind: "secret" });
 		else if (passed.has(name)) {
 			const passedClass = passed.get(name);
 			inputs.set(name, passedClass === "clean" ? {
 				kind: "value",
 				value: void 0
 			} : passedClass === "unknown" ? { kind: "unknown" } : { kind: "secret" });
-		} else if (isPlainObject$3(definition) && Object.hasOwn(definition, "Default") && !carriesSecretValue(definition["Default"], [])) inputs.set(name, {
+		} else if (isPlainObject$5(definition) && Object.hasOwn(definition, "Default") && !carriesSecretValue(definition["Default"], [])) inputs.set(name, {
 			kind: "value",
 			value: definition["Default"]
 		});
@@ -18371,7 +18483,7 @@ function closureClass(closure) {
 	return closure.unread ? "unread" : "clean";
 }
 async function childOutputClass(loaded, outputName, passed, chain, shared) {
-	if (loaded === void 0 || !isPlainObject$3(loaded.template)) return "unknown";
+	if (loaded === void 0 || !isPlainObject$5(loaded.template)) return "unknown";
 	const scopeKey = JSON.stringify([loaded.identity, passedKey(passed)]);
 	const memoKey = JSON.stringify([scopeKey, outputName]);
 	const memo = shared.outputs.get(memoKey);
@@ -18384,8 +18496,8 @@ async function classifyChildOutput(loaded, outputName, passed, chain, shared, sc
 	if (++shared.steps > MAX_NESTED_OUTPUT_STEPS) return "unknown";
 	if (chain.includes(loaded.identity) || chain.length >= MAX_NESTED_OUTPUT_DEPTH) return "unknown";
 	const template = loaded.template;
-	const output = (isPlainObject$3(template.Outputs) ? template.Outputs : {})[outputName];
-	if (!isPlainObject$3(output) || !Object.hasOwn(output, "Value")) return "unknown";
+	const output = (isPlainObject$5(template.Outputs) ? template.Outputs : {})[outputName];
+	if (!isPlainObject$5(output) || !Object.hasOwn(output, "Value")) return "unknown";
 	const scope = {
 		walk: newWalk({
 			template,
@@ -18457,7 +18569,7 @@ async function expressionClass(value, scope) {
 		return result;
 	};
 	if (Array.isArray(value)) return all(value);
-	if (!isPlainObject$3(value)) return "clean";
+	if (!isPlainObject$5(value)) return "clean";
 	const key = intrinsicKey(value);
 	if (key === void 0) return all(Object.values(value));
 	const operand = value[key];
@@ -18472,7 +18584,7 @@ async function expressionClass(value, scope) {
 		case "Fn::Sub": {
 			const text = Array.isArray(operand) ? operand[0] : operand;
 			if (typeof text !== "string") return worseOf("unknown", await expressionClass(operand, scope));
-			const vars = Array.isArray(operand) && isPlainObject$3(operand[1]) ? operand[1] : {};
+			const vars = Array.isArray(operand) && isPlainObject$5(operand[1]) ? operand[1] : {};
 			let result = text.includes(DYNAMIC_REFERENCE_OPEN) ? "secret" : "clean";
 			result = worseOf(result, await all(Object.values(vars)));
 			for (const name of subPlaceholders(text)) {
@@ -18550,7 +18662,7 @@ async function classifyPassedParameters(parameters, sources) {
 }
 async function classifyPassed(parameters, sources, nested) {
 	const classes = /* @__PURE__ */ new Map();
-	if (!isPlainObject$3(parameters)) return classes;
+	if (!isPlainObject$5(parameters)) return classes;
 	for (const [name, expression] of Object.entries(parameters)) {
 		let passedClass;
 		try {
@@ -18591,7 +18703,7 @@ function possiblyMaskedKeys(resolvedProps, corpora) {
 	const wholeShortLeaf = (value) => {
 		if (typeof value === "string") return short.includes(value);
 		if (Array.isArray(value)) return value.some(wholeShortLeaf);
-		if (isPlainObject$3(value)) return Object.values(value).some(wholeShortLeaf);
+		if (isPlainObject$5(value)) return Object.values(value).some(wholeShortLeaf);
 		return false;
 	};
 	return Object.keys(resolvedProps).filter((key) => {
@@ -18622,7 +18734,7 @@ function maskedPropertyFingerprintsOf(record) {
 	const read = /* @__PURE__ */ new Map();
 	if (record === null || typeof record !== "object") return read;
 	const field = record.maskedPropertyFingerprints;
-	if (!isPlainObject$3(field)) return read;
+	if (!isPlainObject$5(field)) return read;
 	for (const [key, value] of Object.entries(field)) if (typeof value === "string" && value.startsWith(FINGERPRINT_PREFIX)) read.set(key, value);
 	return read;
 }
@@ -18630,7 +18742,7 @@ function maskedPropertyInputFingerprintsOf(record) {
 	const read = /* @__PURE__ */ new Map();
 	if (record === null || typeof record !== "object") return read;
 	const field = record.maskedPropertyInputFingerprints;
-	if (!isPlainObject$3(field)) return read;
+	if (!isPlainObject$5(field)) return read;
 	const text = maskedPropertyFingerprintsOf(record);
 	for (const [key, value] of Object.entries(field)) {
 		if (typeof value !== "string" || !value.startsWith(INPUT_FINGERPRINT_PREFIX)) continue;
@@ -18677,7 +18789,7 @@ async function movedMaskedProperties(record, templateProps, fingerprinter, onReb
 function withRebaselinedFingerprints(record, fingerprints) {
 	const text = maskedPropertyFingerprintsOf(record);
 	const field = record.maskedPropertyInputFingerprints;
-	const next = isPlainObject$3(field) ? Object.entries(field) : [];
+	const next = isPlainObject$5(field) ? Object.entries(field) : [];
 	let changed = false;
 	for (const [key, value] of Object.entries(fingerprints)) {
 		if (text.get(key) !== splitInputFingerprint(value).text) continue;
@@ -18710,10 +18822,10 @@ function withMaskedPropertyFingerprints(scrubbed, writtenBag, templateProps, sec
 		fingerprints = maskedPropertyFingerprintsFor(scrubbed.properties, templateProps);
 		inputs = boundInputFingerprints(fingerprints, inputFingerprints);
 	} else {
-		if (!isPlainObject$3(previous)) return scrubbed;
+		if (!isPlainObject$5(previous)) return scrubbed;
 		if (corpora.length === 0) return scrubbed;
 		fingerprints = { ...previous };
-		inputs = isPlainObject$3(previousInputs) ? { ...previousInputs } : void 0;
+		inputs = isPlainObject$5(previousInputs) ? { ...previousInputs } : void 0;
 	}
 	if (fingerprints !== void 0 && corpora.length > 0) {
 		const refused = Object.keys(fingerprints).filter((key) => Object.hasOwn(templateProps, key) && corpora.some((corpus) => templateCarriesNeedle(templateProps[key], corpus)));
@@ -19697,11 +19809,11 @@ function validReferenceRegion(region) {
 	if (typeof region !== "string") return void 0;
 	return canonicalizeRegion(region) === region && isClientSafeRegion(region) ? region : void 0;
 }
-function isPlainObject$2(value) {
+function isPlainObject$4(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function validateReferenceProvenance(token, raw) {
-	if (!isSingleDynamicReferenceToken(token) || !isPlainObject$2(raw)) return void 0;
+	if (!isSingleDynamicReferenceToken(token) || !isPlainObject$4(raw)) return void 0;
 	const versionsRaw = Object.hasOwn(raw, "versions") ? raw["versions"] : void 0;
 	const readRaw = Object.hasOwn(raw, "readVersions") ? raw["readVersions"] : void 0;
 	if (readRaw !== void 0) {
@@ -19719,11 +19831,11 @@ function validateReferenceProvenance(token, raw) {
 	return out;
 }
 function referenceProvenanceOf(record) {
-	if (!isPlainObject$2(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	if (!isPlainObject$4(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
 	return validatedBag(record["referenceProvenance"]);
 }
 function validatedBag(field) {
-	if (!isPlainObject$2(field)) return void 0;
+	if (!isPlainObject$4(field)) return void 0;
 	const out = Object.create(null);
 	for (const [token, raw] of Object.entries(field)) {
 		const entry = validateReferenceProvenance(token, raw);
@@ -19732,9 +19844,9 @@ function validatedBag(field) {
 	return { ...out };
 }
 function recordedProvenanceOf(record, token) {
-	if (!isPlainObject$2(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	if (!isPlainObject$4(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
 	const field = record["referenceProvenance"];
-	if (!isPlainObject$2(field) || !Object.hasOwn(field, token)) return void 0;
+	if (!isPlainObject$4(field) || !Object.hasOwn(field, token)) return void 0;
 	return validateReferenceProvenance(token, field[token]);
 }
 function recordedReferenceRegions(record) {
@@ -19756,7 +19868,7 @@ function regionsOf(field) {
 function keepHeldTokenProvenance(record) {
 	if (!hasReferenceProvenanceField(record)) return record;
 	const field = record.referenceProvenance;
-	if (!isPlainObject$2(field)) return record;
+	if (!isPlainObject$4(field)) return record;
 	const held = recordReferenceTokens(record);
 	const keys = Object.keys(field);
 	if (keys.every((token) => held.has(token))) return record;
@@ -19768,12 +19880,12 @@ function keepHeldTokenProvenance(record) {
 	};
 }
 function hasReferenceProvenanceField(record) {
-	return isPlainObject$2(record) && Object.hasOwn(record, "referenceProvenance") && record["referenceProvenance"] !== void 0;
+	return isPlainObject$4(record) && Object.hasOwn(record, "referenceProvenance") && record["referenceProvenance"] !== void 0;
 }
 function outputReferenceProvenanceOf(state, outputKey) {
-	if (!isPlainObject$2(state) || !Object.hasOwn(state, "outputReferenceProvenance")) return;
+	if (!isPlainObject$4(state) || !Object.hasOwn(state, "outputReferenceProvenance")) return;
 	const field = state["outputReferenceProvenance"];
-	if (!isPlainObject$2(field) || !Object.hasOwn(field, outputKey)) return void 0;
+	if (!isPlainObject$4(field) || !Object.hasOwn(field, outputKey)) return void 0;
 	return validatedBag(field[outputKey]);
 }
 function persistable(token, entry) {
@@ -19791,7 +19903,7 @@ function tokensUnderPaths(properties, paths) {
 			for (const item of value) descend(item, path, next);
 			return;
 		}
-		if (isPlainObject$2(value) && Object.hasOwn(value, path[at])) descend(value[path[at]], path, at + 1);
+		if (isPlainObject$4(value) && Object.hasOwn(value, path[at])) descend(value[path[at]], path, at + 1);
 	};
 	for (const path of paths) descend(properties, path, 0);
 	return out;
@@ -19834,7 +19946,7 @@ function unionWithPrevious(pass, before) {
 }
 function outputProvenanceForPersist(args) {
 	const { outputs, resolvedThisRun, carriedFrom, sinkOf } = args;
-	if (!resolvedThisRun) return carriedFrom !== void 0 && isPlainObject$2(carriedFrom.outputReferenceProvenance) ? carriedFrom.outputReferenceProvenance : void 0;
+	if (!resolvedThisRun) return carriedFrom !== void 0 && isPlainObject$4(carriedFrom.outputReferenceProvenance) ? carriedFrom.outputReferenceProvenance : void 0;
 	let out;
 	for (const [outputKey, value] of Object.entries(outputs)) {
 		const sink = sinkOf(outputKey);
@@ -19868,20 +19980,37 @@ function tokensOf(value) {
 }
 function recordedTokenRoutes(value, record) {
 	if (!hasReferenceProvenanceField(record)) return void 0;
+	return routesOf(tokensOf(value), (token) => recordedProvenanceOf(record, token));
+}
+function provenanceTokenRoutes(value, bag) {
+	if (bag === void 0) return void 0;
+	return routesOf(tokensOf(value), (token) => Object.hasOwn(bag, token) ? bag[token] : void 0);
+}
+function routesOf(tokens, entryOf) {
 	const routes = /* @__PURE__ */ new Map();
 	let recorded = false;
-	for (const token of tokensOf(value)) {
-		const entry = recordedProvenanceOf(record, token);
+	for (const token of tokens) {
+		const entry = entryOf(token);
 		const region = entry?.region;
 		const pin = entry?.versions?.length === 1 ? entry.versions[0] : void 0;
 		if (region !== void 0 || pin !== void 0) recorded = true;
 		routes.set(token, {
 			region,
-			pin
+			pin,
+			...entry?.versions !== void 0 && { versions: entry.versions }
 		});
 	}
 	return recorded ? routes : void 0;
 }
+function recordedTokenVersions(value, record) {
+	if (!hasReferenceProvenanceField(record)) return void 0;
+	let out;
+	for (const token of tokensOf(value)) {
+		const versions = recordedProvenanceOf(record, token)?.versions;
+		if (versions !== void 0 && versions.length > 0) (out ??= /* @__PURE__ */ new Map()).set(token, versions);
+	}
+	return out;
+}
 async function reresolveByRecordedRoutes(resolver, value, logicalId, context, origin, sourceKey, routes, defaults) {
 	const tokens = [...routes.keys()];
 	const regionOf = (token) => routes.get(token)?.region ?? defaults.region;
@@ -19918,9 +20047,12 @@ async function reresolveByRecordedRoutes(resolver, value, logicalId, context, or
 			return value;
 		}
 	}
-	const walkContext = pins.size > 0 ? {
+	const readVersions = /* @__PURE__ */ new Map();
+	for (const [token, route] of routes) if (route.versions !== void 0 && route.versions.length > 0) readVersions.set(token, route.versions);
+	const walkContext = pins.size > 0 || readVersions.size > 0 ? {
 		...context,
-		referencePins: pins
+		...pins.size > 0 && { referencePins: pins },
+		...readVersions.size > 0 && { recordedReadVersions: readVersions }
 	} : context;
 	const regions = new Set(tokens.map((token) => regionOf(token) ?? ""));
 	if (regions.size <= 1) {
@@ -20545,7 +20677,11 @@ async function reresolveRecordedReferences(value, logicalId, context, origin, so
 		servingAsRecordedLine();
 		return value;
 	}
-	return await this.reresolveCrossStackValue(value, void 0, context, origin, sourceKey);
+	const readVersions = recordedTokenVersions(value, record);
+	return await this.reresolveCrossStackValue(value, void 0, readVersions === void 0 ? context : {
+		...context,
+		recordedReadVersions: readVersions
+	}, origin, sourceKey);
 }
 async function referencesMatchPhysicalId(value, logicalId, context, routeOf) {
 	const record = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
@@ -20800,6 +20936,13 @@ function healMaskedOwnIdAttribute(logicalId, resource, attributeName, stored, co
 //#endregion
 //#region src/deployment/intrinsic-resolver/cross-stack.ts
 async function reresolveCrossStackValue(value, producerRegion, context, origin, sourceKey, producerOutput, producerRegionLogText) {
+	if (context.crossStackReads !== void 0 && producerOutput !== void 0 && producerOutput.crossAccount !== true && sourceKey !== void 0) context.crossStackReads.set(sourceKey, {
+		stackName: producerOutput.stackName,
+		region: producerOutput.region || this.resolverRegion || "",
+		outputKey: producerOutput.outputKey,
+		carriesToken: carriesDynamicReference(value),
+		...producerOutput.state !== void 0 && { state: producerOutput.state }
+	});
 	if (carriesSecretMask(value)) {
 		const recovered = producerOutput === void 0 || producerOutput.crossAccount === true ? void 0 : recoverMaskedOutput(credentialFingerprint(ambientCredentialConfig()), producerOutput.stackName, producerOutput.region, producerOutput.outputKey);
 		if (recovered !== void 0) {
@@ -20824,11 +20967,16 @@ async function reresolveCrossStackValue(value, producerRegion, context, origin,
 	if (context.recordedSecretValues !== void 0 && producerOutput !== void 0 && producerOutput.crossAccount !== true && context.stateBackend !== void 0 && context.skipDynamicReferences !== true) {
 		const plain = [...wholeStringLeavesOf(value)].filter((leaf) => !leaf.includes("{{resolve:") && !carriesSecretMask(leaf));
 		if (plain.length > 0) {
-			const ids = await producerPhysicalIds(context.recordedImports ?? context.recordedSecretValues, context.stateBackend, producerOutput.stackName, producerOutput.region || this.resolverRegion, () => this.logger.debug(safeMsg`Could not read the state of producer ${this.displayMasked(producerOutput.stackName, context)} for its physical ids; no cross-stack copy of one is kept (go-to-k/cdkd#4819)`));
+			const ids = physicalIdsOf(await producerStateOnce(this.resolverRegion, context, producerOutput, () => this.logger.debug(safeMsg`Could not read the state of producer ${this.displayMasked(producerOutput.stackName, context)} for its physical ids; no cross-stack copy of one is kept (go-to-k/cdkd#4819)`)));
 			for (const leaf of plain) if (ids.has(leaf)) recordPhysicalNameCopy(context.recordedSecretValues, leaf);
 		}
 	}
 	if (!carriesDynamicReference(value)) return value;
+	if (producerOutput !== void 0 && producerOutput.crossAccount !== true && context.recordedSecretValues !== void 0 && context.skipDynamicReferences !== true && context.provenanceCapture !== true) {
+		const state = await producerStateOnce(this.resolverRegion, context, producerOutput, () => this.logger.debug(safeMsg`Could not read the state of producer ${this.displayMasked(producerOutput.stackName, context)} for its recorded secret versions; its output is resolved at the current version`));
+		const routes = provenanceTokenRoutes(value, outputReferenceProvenanceOf(state, producerOutput.outputKey));
+		if (routes !== void 0) return await reresolveByRecordedRoutes(this, value, producerOutput.stackName, context, origin, sourceKey, routes, { region: producerRegion || void 0 });
+	}
 	const resolver = this.resolverForProducerRegion(producerRegion, context, producerRegionLogText);
 	const pinnedContext = {
 		...producerRegion ? withoutProducerRegions(context) : context,
@@ -20917,7 +21065,8 @@ async function resolveImportValue(importValueArg, context) {
 				found = {
 					value,
 					refStack,
-					lookupRegion
+					lookupRegion,
+					state
 				};
 				break;
 			}
@@ -20929,7 +21078,8 @@ async function resolveImportValue(importValueArg, context) {
 	if (found) return await this.reresolveCrossStackValue(found.value, found.lookupRegion, context, `Fn::ImportValue ${quotedRender(this.displayLeaf(exportName, context), "'")} (producer ${this.displayLeaf(found.refStack, context)} / ${this.displayLeaf(found.lookupRegion, context)})`, sourceKey, {
 		stackName: found.refStack,
 		region: found.lookupRegion,
-		outputKey: exportName
+		outputKey: exportName,
+		state: found.state
 	});
 	if (this.cfnFallback) {
 		const cfnExport = await this.lookupCfnExport(exportName, context);
@@ -20949,32 +21099,60 @@ function recordImport(context, exportName, producerStack, producerRegion) {
 		sourceRegion: producerRegion
 	});
 }
-const producerPhysicalIdReads = /* @__PURE__ */ new WeakMap();
-function producerPhysicalIds(scope, stateBackend, stackName, region, onFailure) {
-	let reads = producerPhysicalIdReads.get(scope);
+const producerStateReads = /* @__PURE__ */ new WeakMap();
+async function readProducerStateOnce(scope, stateBackend, stackName, region, onFailure, inHand) {
+	let reads = producerStateReads.get(scope);
 	if (reads === void 0) {
 		reads = /* @__PURE__ */ new Map();
-		producerPhysicalIdReads.set(scope, reads);
+		producerStateReads.set(scope, reads);
 	}
 	const key = JSON.stringify([stackName, region]);
 	let read = reads.get(key);
 	if (read === void 0) {
-		read = (async () => {
-			const ids = /* @__PURE__ */ new Set();
+		read = inHand !== void 0 ? Promise.resolve({
+			state: inHand,
+			failed: false
+		}) : (async () => {
+			if (stateBackend === void 0) return {
+				state: void 0,
+				failed: false
+			};
 			try {
-				const data = await stateBackend.getState(stackName, region);
-				for (const record of Object.values(data?.state.resources ?? {})) {
-					const id = record?.physicalId;
-					if (typeof id === "string" && id !== "") ids.add(id);
-				}
+				return {
+					state: (await stateBackend.getState(stackName, region))?.state ?? void 0,
+					failed: false
+				};
 			} catch {
-				onFailure();
+				return {
+					state: void 0,
+					failed: true
+				};
 			}
-			return ids;
 		})();
 		reads.set(key, read);
 	}
-	return read;
+	const { state, failed } = await read;
+	if (failed) onFailure();
+	return state;
+}
+function producerStateOnce(resolverRegion, context, producerOutput, onFailure) {
+	return readProducerStateOnce(context.recordedImports ?? context.recordedSecretValues ?? context, context.stateBackend, producerOutput.stackName, producerOutput.region || resolverRegion || "", onFailure, producerOutput.state);
+}
+const physicalIdsByState = /* @__PURE__ */ new WeakMap();
+function physicalIdsOf(state) {
+	if (state === void 0) return /* @__PURE__ */ new Set();
+	let ids = physicalIdsByState.get(state);
+	if (ids === void 0) {
+		const out = /* @__PURE__ */ new Set();
+		const resources = state.resources;
+		if (resources !== null && typeof resources === "object") for (const record of Object.values(resources)) {
+			const id = record?.physicalId;
+			if (typeof id === "string" && id !== "") out.add(id);
+		}
+		ids = out;
+		physicalIdsByState.set(state, ids);
+	}
+	return ids;
 }
 
 //#endregion
@@ -21517,7 +21695,7 @@ async function resolveGetStackOutput(arg, context) {
 		stackName,
 		region,
 		outputKey: outputName,
-		...roleArn ? { crossAccount: true } : {}
+		...roleArn ? { crossAccount: true } : { state: stateData.state }
 	}, loggedRegionText);
 }
 function recordOutputRead(context, producerStack, producerRegion, outputName) {
@@ -21637,13 +21815,19 @@ function secretVerdictScope(resolver) {
 }
 function recordProvenanceOfResolution(resolver, context, token, version) {
 	if (context === void 0 || context.provenanceSuppressed === true) return;
-	const resolution = {
-		region: canonicalizeRegion(resolver.explicitRegion),
-		version,
-		route: context.provenanceRoute ?? "literal"
-	};
-	if (context.recordedSecretValues !== void 0) recordReferenceResolution(context.recordedSecretValues, token, resolution);
-	if (context.provenanceSink !== void 0) recordReferenceResolution(context.provenanceSink, token, resolution);
+	const route = context.provenanceRoute ?? "literal";
+	const region = canonicalizeRegion(resolver.explicitRegion);
+	const recorded = route === "read" ? context.recordedReadVersions?.get(token) : void 0;
+	const versions = recorded !== void 0 && recorded.length > 0 ? recorded : [version];
+	for (const one of versions) {
+		const resolution = {
+			region,
+			version: one,
+			route
+		};
+		if (context.recordedSecretValues !== void 0) recordReferenceResolution(context.recordedSecretValues, token, resolution);
+		if (context.provenanceSink !== void 0) recordReferenceResolution(context.provenanceSink, token, resolution);
+	}
 }
 async function resolveDynamicReferences(value, context) {
 	return (await this.resolveDynamicReferencesWithLogTwin(value, value, context, void 0, true)).result;
@@ -23426,6 +23610,101 @@ IntrinsicFunctionResolver.prototype.noteRefStateMask = noteRefStateMask;
 IntrinsicFunctionResolver.prototype.clientsForRegion = clientsForRegion;
 IntrinsicFunctionResolver.prototype.serviceDiscoveryClient = serviceDiscoveryClient;
 
+//#endregion
+//#region src/analyzer/read-provenance-promotion.ts
+function isPlainObject$3(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function readsAcrossStacks(value) {
+	if (Array.isArray(value)) return value.some(readsAcrossStacks);
+	if (!isPlainObject$3(value)) return false;
+	if (Object.hasOwn(value, "Fn::ImportValue") || Object.hasOwn(value, "Fn::GetStackOutput")) return true;
+	return Object.values(value).some(readsAcrossStacks);
+}
+function recordedReadVersions(record) {
+	if (!isPlainObject$3(record) || !Object.hasOwn(record, "referenceProvenance")) return void 0;
+	const field = referenceProvenanceOf(record);
+	if (field === void 0) return void 0;
+	let out;
+	for (const [token, entry] of Object.entries(field)) if (entry.readVersions !== void 0 && entry.readVersions.length > 0) (out ??= /* @__PURE__ */ new Map()).set(token, entry.readVersions);
+	return out;
+}
+async function readProvenancePromotions(args) {
+	const { currentState, desiredTemplate, sources } = args;
+	const parser = args.parser ?? new TemplateParser();
+	const records = currentState.resources;
+	const parameters = isPlainObject$3(desiredTemplate.Parameters) ? desiredTemplate.Parameters : void 0;
+	const out = [];
+	for (const { logicalId, changeType } of args.rows) {
+		if (changeType !== "NO_CHANGE" && changeType !== "UPDATE") continue;
+		const record = Object.hasOwn(records, logicalId) ? records[logicalId] : void 0;
+		const readVersions = recordedReadVersions(record);
+		if (readVersions === void 0) continue;
+		const resource = Object.hasOwn(desiredTemplate.Resources, logicalId) ? desiredTemplate.Resources[logicalId] : void 0;
+		const properties = isPlainObject$3(resource?.Properties) ? resource.Properties : {};
+		const reads = [];
+		for (const [key, value] of Object.entries(properties)) {
+			const referenced = [...parser.extractReferences(value)].filter((id) => id !== logicalId);
+			const resourceIds = referenced.filter((id) => Object.hasOwn(desiredTemplate.Resources, id));
+			const readsParameter = parameters !== void 0 && referenced.some((id) => Object.hasOwn(parameters, id));
+			const crossStack = readsAcrossStacks(value);
+			if (resourceIds.length === 0 && !readsParameter && !crossStack) continue;
+			reads.push({
+				key,
+				value,
+				resources: resourceIds,
+				parameters: readsParameter,
+				crossStack
+			});
+		}
+		if (reads.length === 0) continue;
+		let crossStackBags = [];
+		if (sources?.crossStackOutputs !== void 0) {
+			const crossValues = reads.filter((r) => r.crossStack).map((r) => r.value);
+			if (crossValues.length > 0) crossStackBags = await sources.crossStackOutputs(crossValues);
+		}
+		const upstreamIds = new Set(reads.flatMap((r) => r.resources));
+		const readsAnyParameter = reads.some((r) => r.parameters);
+		const moved = [];
+		for (const [token, recorded] of readVersions) {
+			const domain = /* @__PURE__ */ new Set();
+			let member = false;
+			const join = (versions) => {
+				if (versions === void 0 || versions.length === 0) return;
+				member = true;
+				for (const version of versions) domain.add(version);
+			};
+			for (const id of upstreamIds) {
+				const upstream = Object.hasOwn(records, id) ? records[id] : void 0;
+				join(recordedProvenanceOf(upstream, token)?.versions);
+			}
+			if (readsAnyParameter && sources?.inherited !== void 0) join(sources.inherited.get(token)?.versions);
+			for (const bag of crossStackBags) if (Object.hasOwn(bag, token)) join(bag[token]?.versions);
+			if (!member) continue;
+			if (recorded.some((version) => !domain.has(version))) moved.push(token);
+		}
+		if (moved.length === 0) continue;
+		const recordProperties = isPlainObject$3(record?.properties) ? record.properties : {};
+		const keys = [];
+		for (const r of reads) {
+			if (!Object.hasOwn(recordProperties, r.key)) continue;
+			const held = referenceTokensIn(recordProperties[r.key]);
+			if (!moved.some((token) => held.has(token))) continue;
+			keys.push({
+				key: r.key,
+				upstreams: r.resources
+			});
+		}
+		if (keys.length === 0) continue;
+		out.push({
+			logicalId,
+			keys,
+			tokens: moved
+		});
+	}
+	return out;
+}
+
 //#endregion
 //#region src/analyzer/diff-calculator.ts
 const INTRINSIC_KEYS = /* @__PURE__ */ new Set([
@@ -23470,7 +23749,7 @@ var DiffCalculator = class DiffCalculator {
 	conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue) {
 		return this.replacementRules.conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue);
 	}
-	async calculateDiff(currentState, desiredTemplate, resolveFn, canonicalizeProperties, allowedUnsupportedProperties, freshParameters, maskForLog, recreateTargets, maskedInputs, refusalRecovery, noEchoCompare) {
+	async calculateDiff(currentState, desiredTemplate, resolveFn, canonicalizeProperties, allowedUnsupportedProperties, freshParameters, maskForLog, recreateTargets, maskedInputs, refusalRecovery, noEchoCompare, readProvenance) {
 		const changes = /* @__PURE__ */ new Map();
 		refuseMalformedResourceEntriesForDeploy(currentState, void 0, void 0, refusalRecovery);
 		refuseMalformedResourceProperties(currentState, void 0, void 0, refusalRecovery);
@@ -23600,7 +23879,12 @@ var DiffCalculator = class DiffCalculator {
 			const changeType = changes.get(logicalId)?.changeType;
 			if (changeType === "NO_CHANGE" || changeType === "UPDATE") forcedReplacements.add(logicalId);
 		}
+		const provenanceChanges = await this.promoteReadProvenanceDependents(changes, currentState, desiredTemplate, readProvenance);
 		const syntheticCreateOnlyPaths = await this.loadSyntheticCreateOnlyPaths(changes, desiredTemplate, rawGetAttRefs, freshParameters, forcedReplacements);
+		for (const { change, pc, upstreams } of provenanceChanges) {
+			const templateValue = desiredTemplate.Resources[change.logicalId]?.Properties?.[pc.path];
+			pc.requiresReplacement = this.syntheticRequiresReplacement(change.resourceType, pc.path, syntheticCreateOnlyPaths, upstreams.some((id) => isPlainReferenceTo(templateValue, id, desiredTemplate.Resources[id]?.Type)));
+		}
 		do
 			this.promoteReplacementDependents(changes, desiredTemplate, syntheticCreateOnlyPaths, forcedReplacements);
 		while (this.promoteInPlaceAttributeDependents(changes, desiredTemplate, rawGetAttRefs, syntheticCreateOnlyPaths, freshParameters));
@@ -23608,6 +23892,47 @@ var DiffCalculator = class DiffCalculator {
 		this.logger.debug(`Diff calculated: ${summary.create} CREATE, ${summary.update} UPDATE, ${summary.delete} DELETE, ${summary.noChange} NO_CHANGE`);
 		return changes;
 	}
+	async promoteReadProvenanceDependents(changes, currentState, desiredTemplate, sources) {
+		if (isKnownTokenFreeState(currentState)) return [];
+		const promotions = await readProvenancePromotions({
+			rows: changes.values(),
+			currentState,
+			desiredTemplate,
+			sources,
+			parser: this.parser
+		});
+		const out = [];
+		for (const promotion of promotions) {
+			const change = changes.get(promotion.logicalId);
+			if (change === void 0) continue;
+			const existingPaths = new Set((change.propertyChanges ?? []).map((pc) => pc.path));
+			const synthetic = [];
+			for (const { key, upstreams } of promotion.keys) {
+				if (existingPaths.has(key)) continue;
+				const pc = {
+					path: key,
+					oldValue: change.currentProperties?.[key],
+					newValue: change.desiredProperties?.[key],
+					requiresReplacement: false,
+					inPlacePropagated: true,
+					readProvenancePromoted: true
+				};
+				synthetic.push(pc);
+				out.push({
+					change,
+					pc,
+					upstreams
+				});
+			}
+			if (synthetic.length === 0) continue;
+			if (change.changeType === "NO_CHANGE") {
+				change.changeType = "UPDATE";
+				change.propertyChanges = synthetic;
+			} else change.propertyChanges = [...change.propertyChanges ?? [], ...synthetic];
+			this.logger.debug(safeMsg`UPDATE (promoted): ${promotion.logicalId} holds a secret reference read at a version its upstream no longer records (${synthetic.map((pc) => pc.path).join(", ")})`);
+		}
+		return out;
+	}
 	async loadSyntheticCreateOnlyPaths(changes, desiredTemplate, rawGetAttRefs, freshParameters, forcedReplacements) {
 		const loaded = /* @__PURE__ */ new Map();
 		const queue = [...freshParameters ?? []];
@@ -24809,8 +25134,8 @@ function compare(desired, previous, mask) {
 		if (!Array.isArray(desired) || desired.length !== previous.length) return "differs";
 		return combine(previous.map((item, i) => compare(desired[i], item, mask)));
 	}
-	if (isPlainObject$1(previous)) {
-		if (!isPlainObject$1(desired)) return "differs";
+	if (isPlainObject$2(previous)) {
+		if (!isPlainObject$2(desired)) return "differs";
 		if (!Object.keys(desired).every((k) => Object.prototype.hasOwnProperty.call(previous, k))) return "differs";
 		return combine(Object.keys(previous).map((k) => compare(desired[k], previous[k], mask)));
 	}
@@ -24836,7 +25161,7 @@ function resolvesReference(desired, previous, mask) {
 	const pattern = literals.map(escapeRegExp$1).join("[\\s\\S]*");
 	return new RegExp(`^${pattern}$`).test(desired);
 }
-function isPlainObject$1(value) {
+function isPlainObject$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function escapeRegExp$1(text) {
@@ -25627,7 +25952,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CsBxbRlH.js");
+			const { ASGProvider } = await import("./asg-provider-DZv4iAmI.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -25733,7 +26058,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-d15q7Rp5.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-C81KkPPG.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-J60TlCOp.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-BHEUW4UW.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -25961,7 +26286,8 @@ var CloudControlProvider = class {
 		const causeText = safeDisplay === "" ? "" : `: ${safeDisplay}`;
 		if (described.detail !== "") this.logger.debug(`${operation} ${logicalId}: the abandoned operation's underlying failure was: ${displaySafe(described.detail)}`);
 		const identifierClause = lastSeenIdentifier === void 0 ? "" : ` The last status cdkd read named the resource ${displaySafe(lastSeenIdentifier, { asciiOnly: true })}.`;
-		const error = new CloudControlWaitAbandonedError(`${operation} of ${logicalId} was accepted by Cloud Control API, but cdkd stopped waiting for it (${reason}${causeText}). The operation may still be running in AWS, and ${operation === "CREATE" ? "cdkd has NO state record for it, so any resource it creates is untracked by rollback and by cdkd destroy" : operation === "DELETE" ? "the resource may or may not have been removed; its state record is kept so a re-run can finish the delete" : "its state record still holds the PREVIOUS properties, so the record may no longer describe the live resource"}.${identifierClause} Check what it did with:\n  ${await this.buildResumeCommand(requestToken)}`, resourceType, logicalId, requestToken, operation, lastSeenIdentifier, cause instanceof Error ? cause : void 0);
+		const consequence = operation === "CREATE" ? "cdkd has NO state record for it, so any resource it creates is untracked by rollback and by cdkd destroy" : operation === "DELETE" ? "the resource may or may not have been removed; its state record is kept so a re-run can finish the delete" : "its state record still holds the PREVIOUS properties, so the record may no longer describe the live resource";
+		const error = new CloudControlWaitAbandonedError(safeMsg`${operation} of ${logicalId} was accepted by Cloud Control API, but cdkd stopped waiting for it ` + safeMsg`(${reason}${causeText}). The operation may still be running in AWS, and ${consequence}.` + `${identifierClause} Check what it did with:\n  ${await this.buildResumeCommand(requestToken)}`, resourceType, logicalId, requestToken, operation, lastSeenIdentifier, cause instanceof Error ? cause : void 0);
 		if (described.marker) markRedactedCause(error);
 		return operation === "CREATE" ? markNonRetryable(error) : error;
 	}
@@ -29545,6 +29871,7 @@ const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::AutoScaling::AutoScalingGroup", "{\"AvailabilityZoneDistribution\":\"object\",\"AvailabilityZoneIds\":\"array\",\"AvailabilityZoneImpairmentPolicy\":\"object\",\"AvailabilityZones\":\"array\",\"CapacityReservationSpecification\":\"object\",\"CapacityReservationSpecification.CapacityReservationTarget\":\"object\",\"CapacityReservationSpecification.CapacityReservationTarget.CapacityReservationIds\":\"array\",\"CapacityReservationSpecification.CapacityReservationTarget.CapacityReservationResourceGroupArns\":\"array\",\"InstanceLifecyclePolicy\":\"object\",\"InstanceLifecyclePolicy.RetentionTriggers\":\"object\",\"InstanceMaintenancePolicy\":\"object\",\"LaunchTemplate\":\"object\",\"LifecycleHookSpecificationList\":\"array\",\"LifecycleHookSpecificationList[]\":\"object\",\"LoadBalancerNames\":\"array\",\"MetricsCollection\":\"array\",\"MetricsCollection[]\":\"object\",\"MetricsCollection[].Metrics\":\"array\",\"MixedInstancesPolicy\":\"object\",\"MixedInstancesPolicy.InstancesDistribution\":\"object\",\"MixedInstancesPolicy.InstancesDistribution.DistributionSegments\":\"array\",\"MixedInstancesPolicy.InstancesDistribution.DistributionSegments[]\":\"object\",\"MixedInstancesPolicy.InstancesDistribution.DistributionSegments[].TargetCapacityTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.LaunchTemplateSpecification\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[]\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorCount\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorManufacturers\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorNames\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorTotalMemoryMiB\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AllowedInstanceTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselineEbsBandwidthMbps\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors.Cpu\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors.Cpu.References\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors.Cpu.References[]\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.CpuManufacturers\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.ExcludedInstanceTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.InstanceGenerations\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.LocalStorageTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.MemoryGiBPerVCpu\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.MemoryMiB\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.NetworkBandwidthGbps\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.NetworkInterfaceCount\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.TotalLocalStorageGB\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.VCpuCount\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].LaunchTemplateSpecification\":\"object\",\"NotificationConfiguration\":\"object\",\"NotificationConfiguration.NotificationTypes\":\"array\",\"NotificationConfigurations\":\"array\",\"NotificationConfigurations[]\":\"object\",\"NotificationConfigurations[].NotificationTypes\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"TargetGroupARNs\":\"array\",\"TerminationPolicies\":\"array\",\"TrafficSources\":\"array\",\"TrafficSources[]\":\"object\",\"VPCZoneIdentifier\":\"array\"}"],
 	["AWS::BedrockAgentCore::Evaluator", "{\"EvaluatorConfig\":\"object\",\"EvaluatorConfig.CodeBased\":\"object\",\"EvaluatorConfig.CodeBased.LambdaConfig\":\"object\",\"EvaluatorConfig.Derived\":\"object\",\"EvaluatorConfig.Derived.ModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.AdditionalModelRequestFields\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig.StopSequences\":\"array\",\"EvaluatorConfig.Derived.ModelConfig.ResponsesEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.ResponsesEvaluatorModelConfig.Reasoning\":\"object\",\"EvaluatorConfig.LlmAsAJudge\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.AdditionalModelRequestFields\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig.StopSequences\":\"array\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig.Reasoning\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical[]\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::BedrockAgentCore::Runtime", "{\"AgentRuntimeArtifact\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration.Code\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration.Code.S3\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration.EntryPoint\":\"array\",\"AgentRuntimeArtifact.ContainerConfiguration\":\"object\",\"AuthorizerConfiguration\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedAudience\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedClients\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedScopes\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.HostingEnvironments\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.HostingEnvironments[]\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.WorkloadIdentities\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[]\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[].AuthorizingClaimMatchValue\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[].AuthorizingClaimMatchValue.ClaimMatchValue\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[].AuthorizingClaimMatchValue.ClaimMatchValue.MatchValueStringList\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource.SecurityGroupIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource.SubnetIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource.Tags\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.SelfManagedLatticeResource\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[]\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource.SecurityGroupIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource.SubnetIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource.Tags\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.SelfManagedLatticeResource\":\"object\",\"CapacityProviderConfiguration\":\"object\",\"EnvironmentVariables\":\"object\",\"FilesystemConfigurations\":\"array\",\"FilesystemConfigurations[]\":\"object\",\"FilesystemConfigurations[].CapacityProviderVolume\":\"object\",\"FilesystemConfigurations[].EfsAccessPoint\":\"object\",\"FilesystemConfigurations[].S3FilesAccessPoint\":\"object\",\"FilesystemConfigurations[].SessionStorage\":\"object\",\"LifecycleConfiguration\":\"object\",\"NetworkConfiguration\":\"object\",\"NetworkConfiguration.NetworkModeConfig\":\"object\",\"NetworkConfiguration.NetworkModeConfig.SecurityGroups\":\"array\",\"NetworkConfiguration.NetworkModeConfig.Subnets\":\"array\",\"RequestHeaderConfiguration\":\"object\",\"RequestHeaderConfiguration.RequestHeaderAllowlist\":\"array\",\"Tags\":\"object\",\"WorkloadIdentityDetails\":\"object\"}"],
+	["AWS::Budgets::Budget", "{\"Budget\":\"object\",\"Budget.AutoAdjustData\":\"object\",\"Budget.AutoAdjustData.HistoricalOptions\":\"object\",\"Budget.BudgetLimit\":\"object\",\"Budget.CostFilters\":\"object\",\"Budget.CostTypes\":\"object\",\"Budget.FilterExpression\":\"object\",\"Budget.FilterExpression.And\":\"array\",\"Budget.FilterExpression.CostCategories\":\"object\",\"Budget.FilterExpression.CostCategories.MatchOptions\":\"array\",\"Budget.FilterExpression.CostCategories.Values\":\"array\",\"Budget.FilterExpression.Dimensions\":\"object\",\"Budget.FilterExpression.Dimensions.MatchOptions\":\"array\",\"Budget.FilterExpression.Dimensions.Values\":\"array\",\"Budget.FilterExpression.Or\":\"array\",\"Budget.FilterExpression.Tags\":\"object\",\"Budget.FilterExpression.Tags.MatchOptions\":\"array\",\"Budget.FilterExpression.Tags.Values\":\"array\",\"Budget.Metrics\":\"array\",\"Budget.PlannedBudgetLimits\":\"object\",\"Budget.TimePeriod\":\"object\",\"NotificationsWithSubscribers\":\"array\",\"NotificationsWithSubscribers[]\":\"object\",\"NotificationsWithSubscribers[].Notification\":\"object\",\"NotificationsWithSubscribers[].Subscribers\":\"array\",\"NotificationsWithSubscribers[].Subscribers[]\":\"object\",\"ResourceTags\":\"array\",\"ResourceTags[]\":\"object\"}"],
 	["AWS::CertificateManager::Certificate", "{\"DomainValidationOptions\":\"array\",\"DomainValidationOptions[]\":\"object\",\"SubjectAlternativeNames\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::CloudFormation::Stack", "{\"Capabilities\":\"array\",\"NotificationARNs\":\"array\",\"Outputs\":\"array\",\"Outputs[]\":\"object\",\"Parameters\":\"object\",\"StackPolicyBody\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::CloudFront::CloudFrontOriginAccessIdentity", "{\"CloudFrontOriginAccessIdentityConfig\":\"object\"}"],
@@ -29552,7 +29879,6 @@ const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::CloudFront::OriginAccessControl", "{\"OriginAccessControlConfig\":\"object\"}"],
 	["AWS::CloudTrail::Trail", "{\"AdvancedEventSelectors\":\"array\",\"AdvancedEventSelectors[]\":\"object\",\"AdvancedEventSelectors[].FieldSelectors\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[]\":\"object\",\"AdvancedEventSelectors[].FieldSelectors[].EndsWith\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].Equals\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].NotEndsWith\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].NotEquals\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].NotStartsWith\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].StartsWith\":\"array\",\"AggregationConfigurations\":\"array\",\"AggregationConfigurations[]\":\"object\",\"AggregationConfigurations[].Templates\":\"array\",\"EventSelectors\":\"array\",\"EventSelectors[]\":\"object\",\"EventSelectors[].DataResources\":\"array\",\"EventSelectors[].DataResources[]\":\"object\",\"EventSelectors[].DataResources[].Values\":\"array\",\"EventSelectors[].ExcludeManagementEventSources\":\"array\",\"InsightSelectors\":\"array\",\"InsightSelectors[]\":\"object\",\"InsightSelectors[].EventCategories\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::CloudWatch::Alarm", "{\"AlarmActions\":\"array\",\"Dimensions\":\"array\",\"Dimensions[]\":\"object\",\"EvaluationCriteria\":\"object\",\"EvaluationCriteria.PromQLCriteria\":\"object\",\"EvaluationWindow\":\"object\",\"EvaluationWindow.SlidingWindow\":\"object\",\"EvaluationWindow.WallClockWindow\":\"object\",\"InsufficientDataActions\":\"array\",\"Metrics\":\"array\",\"Metrics[]\":\"object\",\"Metrics[].MetricStat\":\"object\",\"Metrics[].MetricStat.Metric\":\"object\",\"Metrics[].MetricStat.Metric.Dimensions\":\"array\",\"Metrics[].MetricStat.Metric.Dimensions[]\":\"object\",\"OKActions\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"WarmUpConfiguration\":\"object\"}"],
-	["AWS::CloudWatch::AnomalyDetector", "{\"Configuration\":\"object\",\"Configuration.ExcludedTimeRanges\":\"array\",\"Configuration.ExcludedTimeRanges[]\":\"object\",\"Dimensions\":\"array\",\"Dimensions[]\":\"object\",\"MetricCharacteristics\":\"object\",\"MetricMathAnomalyDetector\":\"object\",\"MetricMathAnomalyDetector.MetricDataQueries\":\"array\",\"MetricMathAnomalyDetector.MetricDataQueries[]\":\"object\",\"MetricMathAnomalyDetector.MetricDataQueries[].MetricStat\":\"object\",\"MetricMathAnomalyDetector.MetricDataQueries[].MetricStat.Metric\":\"object\",\"MetricMathAnomalyDetector.MetricDataQueries[].MetricStat.Metric.Dimensions\":\"array\",\"MetricMathAnomalyDetector.MetricDataQueries[].MetricStat.Metric.Dimensions[]\":\"object\",\"SingleMetricAnomalyDetector\":\"object\",\"SingleMetricAnomalyDetector.Dimensions\":\"array\",\"SingleMetricAnomalyDetector.Dimensions[]\":\"object\"}"],
 	["AWS::CodeCommit::Repository", "{\"Code\":\"object\",\"Code.S3\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"Triggers\":\"array\",\"Triggers[]\":\"object\",\"Triggers[].Branches\":\"array\",\"Triggers[].Events\":\"array\"}"],
 	["AWS::Cognito::UserPool", "{\"AccountRecoverySetting\":\"object\",\"AccountRecoverySetting.RecoveryMechanisms\":\"array\",\"AccountRecoverySetting.RecoveryMechanisms[]\":\"object\",\"AdminCreateUserConfig\":\"object\",\"AdminCreateUserConfig.InviteMessageTemplate\":\"object\",\"AliasAttributes\":\"array\",\"AutoVerifiedAttributes\":\"array\",\"DeviceConfiguration\":\"object\",\"EmailConfiguration\":\"object\",\"EnabledMfas\":\"array\",\"IssuerConfiguration\":\"object\",\"KeyConfiguration\":\"object\",\"LambdaConfig\":\"object\",\"LambdaConfig.CustomEmailSender\":\"object\",\"LambdaConfig.CustomSMSSender\":\"object\",\"LambdaConfig.InboundFederation\":\"object\",\"LambdaConfig.PreTokenGenerationConfig\":\"object\",\"Policies\":\"object\",\"Policies.PasswordPolicy\":\"object\",\"Policies.SignInPolicy\":\"object\",\"Policies.SignInPolicy.AllowedFirstAuthFactors\":\"array\",\"Schema\":\"array\",\"Schema[]\":\"object\",\"Schema[].NumberAttributeConstraints\":\"object\",\"Schema[].StringAttributeConstraints\":\"object\",\"SmsConfiguration\":\"object\",\"SmsConfiguration.EumsSms\":\"object\",\"UserAttributeUpdateSettings\":\"object\",\"UserAttributeUpdateSettings.AttributesRequireVerificationBeforeUpdate\":\"array\",\"UserPoolAddOns\":\"object\",\"UserPoolAddOns.AdvancedSecurityAdditionalFlows\":\"object\",\"UserPoolTags\":\"object\",\"UsernameAttributes\":\"array\",\"UsernameConfiguration\":\"object\",\"VerificationMessageTemplate\":\"object\"}"],
 	["AWS::DLM::LifecyclePolicy", "{\"CrossRegionCopyTargets\":\"array\",\"CrossRegionCopyTargets[]\":\"object\",\"Exclusions\":\"object\",\"Exclusions.ExcludeTags\":\"array\",\"Exclusions.ExcludeTags[]\":\"object\",\"Exclusions.ExcludeVolumeTypes\":\"array\",\"PolicyDetails\":\"object\",\"PolicyDetails.Actions\":\"array\",\"PolicyDetails.Actions[]\":\"object\",\"PolicyDetails.Actions[].CrossRegionCopy\":\"array\",\"PolicyDetails.Actions[].CrossRegionCopy[]\":\"object\",\"PolicyDetails.Actions[].CrossRegionCopy[].EncryptionConfiguration\":\"object\",\"PolicyDetails.Actions[].CrossRegionCopy[].RetainRule\":\"object\",\"PolicyDetails.CrossRegionCopyTargets\":\"array\",\"PolicyDetails.CrossRegionCopyTargets[]\":\"object\",\"PolicyDetails.EventSource\":\"object\",\"PolicyDetails.EventSource.Parameters\":\"object\",\"PolicyDetails.EventSource.Parameters.SnapshotOwner\":\"array\",\"PolicyDetails.Exclusions\":\"object\",\"PolicyDetails.Exclusions.ExcludeTags\":\"array\",\"PolicyDetails.Exclusions.ExcludeTags[]\":\"object\",\"PolicyDetails.Exclusions.ExcludeVolumeTypes\":\"array\",\"PolicyDetails.Parameters\":\"object\",\"PolicyDetails.Parameters.ExcludeDataVolumeTags\":\"array\",\"PolicyDetails.Parameters.ExcludeDataVolumeTags[]\":\"object\",\"PolicyDetails.ResourceLocations\":\"array\",\"PolicyDetails.ResourceTypes\":\"array\",\"PolicyDetails.Schedules\":\"array\",\"PolicyDetails.Schedules[]\":\"object\",\"PolicyDetails.Schedules[].ArchiveRule\":\"object\",\"PolicyDetails.Schedules[].ArchiveRule.RetainRule\":\"object\",\"PolicyDetails.Schedules[].ArchiveRule.RetainRule.RetentionArchiveTier\":\"object\",\"PolicyDetails.Schedules[].CreateRule\":\"object\",\"PolicyDetails.Schedules[].CreateRule.Scripts\":\"array\",\"PolicyDetails.Schedules[].CreateRule.Scripts[]\":\"object\",\"PolicyDetails.Schedules[].CreateRule.Scripts[].Stages\":\"array\",\"PolicyDetails.Schedules[].CreateRule.Times\":\"array\",\"PolicyDetails.Schedules[].CrossRegionCopyRules\":\"array\",\"PolicyDetails.Schedules[].CrossRegionCopyRules[]\":\"object\",\"PolicyDetails.Schedules[].CrossRegionCopyRules[].DeprecateRule\":\"object\",\"PolicyDetails.Schedules[].CrossRegionCopyRules[].RetainRule\":\"object\",\"PolicyDetails.Schedules[].DeprecateRule\":\"object\",\"PolicyDetails.Schedules[].FastRestoreRule\":\"object\",\"PolicyDetails.Schedules[].FastRestoreRule.AvailabilityZoneIds\":\"array\",\"PolicyDetails.Schedules[].FastRestoreRule.AvailabilityZones\":\"array\",\"PolicyDetails.Schedules[].RetainRule\":\"object\",\"PolicyDetails.Schedules[].ShareRules\":\"array\",\"PolicyDetails.Schedules[].ShareRules[]\":\"object\",\"PolicyDetails.Schedules[].ShareRules[].TargetAccounts\":\"array\",\"PolicyDetails.Schedules[].TagsToAdd\":\"array\",\"PolicyDetails.Schedules[].TagsToAdd[]\":\"object\",\"PolicyDetails.Schedules[].VariableTags\":\"array\",\"PolicyDetails.Schedules[].VariableTags[]\":\"object\",\"PolicyDetails.TargetTags\":\"array\",\"PolicyDetails.TargetTags[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
@@ -29911,7 +30237,9 @@ var ProviderRegistry = class {
 		if (this.providers.get(resourceType)?.disableCcApiFallback === true) return "the type's SDK provider opts out of the Cloud Control fallback (disableCcApiFallback)";
 	}
 	buildUnroutableSilentDropMessage(resourceType, drops, reason) {
-		return `${resourceType} uses properties cdkd's SDK Provider does not handle, and this type cannot fall back to Cloud Control API (${reason}):\n${drops.map((d) => `  - ${d.property}: ${d.rationale}`).join("\n")}\nRemove the properties, or force the SDK provider path and accept the drop via --prefer-sdk-route ${drops.map((d) => `${resourceType}:${d.property}`).join(",")} (the provider may still reject the resource if the property is required).`;
+		const details = drops.map((d) => safeMsg`  - ${d.property}: ${d.rationale}`).join("\n");
+		const overrideHint = drops.map((d) => safeMsg`${resourceType}:${d.property}`).join(",");
+		return safeMsg`${resourceType} uses properties cdkd's SDK Provider does not handle, and ` + safeMsg`this type cannot fall back to Cloud Control API (${reason}):\n` + `${details}\nRemove the properties, or force the SDK provider path and accept the drop via --prefer-sdk-route ${overrideHint} (the provider may still reject the resource if the property is required).`;
 	}
 	getProvider(resourceType) {
 		return this.getProviderFor({ resourceType }).provider;
@@ -29985,7 +30313,7 @@ var ProviderRegistry = class {
 			const autoRouted = [...drops.map(({ property }) => property).filter((property) => !this.allowedUnsupportedProperties.has(`${resourceType}:${property}`)), ...unrecognizedRoute].sort((a, b) => a.localeCompare(b));
 			if (autoRouted.length > 0) {
 				const unroutable = this.ccRouteUnavailableReason(resourceType);
-				if (unroutable !== void 0) throw new Error(`${logicalId}: ${this.buildUnroutableSilentDropMessage(resourceType, drops.filter((d) => autoRouted.includes(d.property)), unroutable)}`);
+				if (unroutable !== void 0) throw new Error(safeMsg`${logicalId}: ` + this.buildUnroutableSilentDropMessage(resourceType, drops.filter((d) => autoRouted.includes(d.property)), unroutable));
 				const propList = autoRouted.join(", ");
 				const overrideHint = autoRouted.map((p) => `${resourceType}:${p}`).join(",");
 				const message = `${logicalId} (${resourceType}): routing via Cloud Control API (cdkd's SDK Provider does not yet wire ${propList} — CC API will forward the full property map.${unrecognizedRoute.length === 0 ? "" : ` ${unrecognizedRoute.join(", ")} ${unrecognizedRoute.length === 1 ? "is" : "are"} not in cdkd's CFn schema snapshot: Cloud Control applies a property AWS published since, and rejects a misspelled one as CloudFormation does.`} Override via --prefer-sdk-route ${overrideHint}.)`;
@@ -32135,9 +32463,9 @@ function handleOutputResolutionFailure(error, outputKey, outputs, secrets, inher
 	const detail = maskSecretsInText(error instanceof Error ? error.message || error.name : String(error), union);
 	if (this.options.strictGetAtt) {
 		const cause = typeof error === "string" ? maskSecretsInText(error, union) : maskSecretsInError(error, union);
-		throw new Error(`Failed to resolve output ${outputKey}: ${detail} (--strict-getatt promotes output resolution failures to deploy errors; drop the flag to skip the output instead)`, cause instanceof Error || typeof cause === "string" ? { cause } : {});
+		throw new Error(safeMsg`Failed to resolve output ${outputKey} ` + `(--strict-getatt promotes output resolution failures to deploy errors; ` + safeMsg`drop the flag to skip the output instead): ${asIsMessage(detail)}`, cause instanceof Error || typeof cause === "string" ? { cause } : {});
 	}
-	this.logger.warn(`Failed to resolve output ${outputKey}: ${detail}`);
+	this.logger.warn(safeMsg`Failed to resolve output ${outputKey}: ${asIsMessage(detail)}`);
 	outputs[outputKey] = void 0;
 }
 async function resolveOutputs(template, resources, stackName, digestSource, parameterValues, conditions) {
@@ -32158,7 +32486,7 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 	const refuseMaskedOutputReads = (outputKey, ownReads) => {
 		const added = ownReads.filter((read) => read.kind === "ref-state-key");
 		if (added.length === 0) return;
-		throw markNonRetryable(/* @__PURE__ */ new Error(`Cannot resolve ${added.map((read) => read.display).join(", ")} for output ${outputKey}: cdkd's recorded state holds only the redaction mask there, so this output would publish a value cdkd cannot confirm (for most such types the resource's raw physical id) instead of the value CloudFormation's Ref returns — a possibly wrong value that a consuming stack's Fn::ImportValue would accept and send to AWS. The output is not published. ${DeployEngine.maskedRecordRemedyFor(added, context.resources)}`));
+		throw markNonRetryable(/* @__PURE__ */ new Error(safeMsg`Cannot resolve ${added.map((read) => read.display).join(", ")} for output ${outputKey}: cdkd's recorded state ` + `holds only the redaction mask there, so this output would publish a value cdkd cannot confirm (for most such types the resource's raw physical id) instead of the value CloudFormation's Ref returns — a possibly wrong value that a consuming stack's Fn::ImportValue would accept and send to AWS. The output is not published. ${DeployEngine.maskedRecordRemedyFor(added, context.resources)}`));
 	};
 	const outputsPassSecrets = context.recordedSecretValues ?? EMPTY_SECRETS;
 	const outputsPassInherited = context.inheritedSecrets ?? EMPTY_SECRETS;
@@ -32168,7 +32496,7 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 	try {
 		for (const [outputKey, output] of Object.entries(template.Outputs)) {
 			if (isOutputSuppressedByCondition(output, conditions)) {
-				this.logger.debug(`Skipping output ${outputKey} — condition ${output.Condition} is false`);
+				this.logger.debug(safeMsg`Skipping output ${outputKey} — condition ${output.Condition} is false`);
 				continue;
 			}
 			const ownReads = [];
@@ -33556,11 +33884,16 @@ async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId,
 		resources: {},
 		recordedSecretValues: secrets
 	};
+	const pins = new ReplayPins(record, resolvers, execCtx, logicalId);
 	const walk = async (v, path) => {
 		if (typeof v === "string") {
 			if (!v.includes("{{resolve:")) return v;
 			refuseUnprovenReplaySecret(v, path, logicalId, execCtx, recordedRegions);
-			return await resolveLeafByRegion(v, path, logicalId, execCtx, resolvers, resolverContext, recordedRegions);
+			const leafPins = await pins.forLeaf(v, recordedRegions);
+			return await resolveLeafByRegion(v, path, logicalId, execCtx, resolvers, leafPins === void 0 ? resolverContext : {
+				...resolverContext,
+				referencePins: leafPins
+			}, recordedRegions);
 		}
 		if (Array.isArray(v)) {
 			const out = new Array(v.length);
@@ -33576,6 +33909,66 @@ async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId,
 	};
 	return await walk(props, "");
 }
+var ReplayPins = class {
+	recorded = /* @__PURE__ */ new Map();
+	verdicts = /* @__PURE__ */ new Map();
+	resolvers;
+	execCtx;
+	logicalId;
+	constructor(record, resolvers, execCtx, logicalId) {
+		this.resolvers = resolvers;
+		this.execCtx = execCtx;
+		this.logicalId = logicalId;
+		const field = referenceProvenanceOf(record);
+		for (const [token, entry] of Object.entries(field ?? {})) if (entry.versions?.length === 1) this.recorded.set(token, entry.versions[0]);
+	}
+	async forLeaf(leaf, recordedRegions) {
+		if (this.recorded.size === 0) return void 0;
+		let out;
+		for (const token of dynamicReferenceTokens(leaf)) {
+			const pin = this.recorded.get(token);
+			if (pin === void 0) continue;
+			if (!await this.usable(token, pin, recordedRegions)) continue;
+			(out ??= /* @__PURE__ */ new Map()).set(token, pin);
+		}
+		return out;
+	}
+	async usable(token, pin, recordedRegions) {
+		const known = this.verdicts.get(token);
+		if (known !== void 0) return known;
+		const verdict = classifyRecordedSecretRegion(token, this.execCtx.region, this.execCtx.importedProducerRegions, recordedRegions);
+		if (verdict.kind === "ambiguous") return false;
+		const resolver = verdict.kind === "named-region" ? this.resolvers.forRegion(verdict.region) : verdict.kind === "recorded-region" ? this.resolvers.forRecordedRegion(verdict.region) : this.resolvers.primary;
+		let ok;
+		try {
+			await resolver.resolveDynamicReferences(token, {
+				template: { Resources: {} },
+				resources: {},
+				recordedSecretValues: /* @__PURE__ */ new Map(),
+				provenanceSuppressed: true
+			});
+		} catch (err) {
+			if (isDeliberateResolutionRefusal(err)) throw err;
+		}
+		try {
+			const served = await resolver.resolveDynamicReferences(token, {
+				template: { Resources: {} },
+				resources: {},
+				recordedSecretValues: /* @__PURE__ */ new Map(),
+				provenanceSuppressed: true,
+				referencePins: /* @__PURE__ */ new Map([[token, pin]])
+			});
+			ok = served.includes("{{resolve:") || served.length >= 4;
+			if (!ok) getLogger().warn(safeMsg`Rollback of ${this.logicalId} restores a secret reference at its current version, not the version its record names: that value is shorter than four characters, so cdkd could not keep it out of state.`);
+		} catch (err) {
+			if (isDeliberateResolutionRefusal(err)) throw err;
+			getLogger().warn(safeMsg`Rollback of ${this.logicalId} could not read a secret at the version its record names (it may have been deprecated or deleted); restoring the current value instead.`);
+			ok = false;
+		}
+		this.verdicts.set(token, ok);
+		return ok;
+	}
+};
 function refuseMaskedReplayBaseline(props, logicalId, inert = []) {
 	if (props === void 0 || !carriesSecretMask(props)) return;
 	if (inert.length > 0 && masksOnlyAt(props, inert)) return;
@@ -35697,11 +36090,11 @@ async function adoptRollbackOrphans(currentState, effectiveTemplate) {
 	for (const notice of plan.notices) this.logger.info(maskSecretsInText(notice, named));
 	const adoptedFrom = /* @__PURE__ */ new Map();
 	adoptedOrphanRecords.set(this, adoptedFrom);
-	if (plan.refusals.length > 0) throw new Error(`Deploy refused — cdkd left ${plan.refusals.length} resource(s) in AWS that it cannot safely re-adopt:\n  ${plan.refusals.map((r) => maskSecretsInText(r, named)).join("\n  ")}`);
+	if (plan.refusals.length > 0) throw new Error(safeMsg`Deploy refused — cdkd left ${plan.refusals.length} resource(s) in AWS that it cannot ` + "safely re-adopt:" + plan.refusals.map((r) => safeMsg`\n  ${maskSecretsInText(r, named)}`).join(""));
 	for (const [logicalId, record] of Object.entries(plan.adopted)) {
 		adoptedFrom.set(logicalId, records.findLast((r) => r.logicalId === logicalId)?.state);
 		currentState.resources[logicalId] = record;
-		this.logger.info(`Adopting ${displayIdent(logicalId)} (${displayIdent(record.resourceType)}) left in AWS by an earlier rollback as ${displaySafe(maskSecretsInText(record.physicalId, named))}`);
+		this.logger.info(safeMsg`Adopting ${displayIdent(logicalId)} (${displayIdent(record.resourceType)}) left in AWS ` + safeMsg`by an earlier rollback as ${displaySafe(maskSecretsInText(record.physicalId, named))}`);
 	}
 	if (records.length > 0) currentState.orphans = plan.remaining;
 	return plan;
@@ -35878,7 +36271,7 @@ async function deleteRollbackJournalBestEffort(stackName, supersededLogicalIds =
 	try {
 		deleted = await this.stateBackend.deleteRollbackJournal(stackName, this.stackRegion);
 	} catch (err) {
-		this.logger.debug(safeMsg`Failed to delete rollback journal for ${stackName}: ${err instanceof Error ? err.message : String(err)}`);
+		this.logger.debug(safeMsg`Failed to delete rollback journal for ${displayStackName(stackName)}: ${err instanceof Error ? err.message : String(err)}`);
 		deleted = false;
 	}
 	if (deleted !== false) return true;
@@ -35886,7 +36279,7 @@ async function deleteRollbackJournalBestEffort(stackName, supersededLogicalIds =
 	try {
 		await this.stateBackend.markRollbackJournalSuperseded(stackName, this.stackRegion, supersededLogicalIds);
 	} catch (markErr) {
-		this.logger.debug(safeMsg`Failed to record superseded logical ids on the rollback journal for ${stackName}: ${markErr instanceof Error ? markErr.message : String(markErr)}`);
+		this.logger.debug(safeMsg`Failed to record superseded logical ids on the rollback journal for ${displayStackName(stackName)}: ${markErr instanceof Error ? markErr.message : String(markErr)}`);
 	}
 	return false;
 }
@@ -35895,7 +36288,7 @@ async function settleJournalAfterCleanRollback(stackName, failedOperations, init
 		try {
 			await this.stateBackend.popRollbackJournalSegment(stackName, this.stackRegion);
 		} catch (err) {
-			this.logger.debug(`Failed to pop the rollback journal segment after the clean rollback: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(safeMsg`Failed to pop the rollback journal segment after the clean rollback: ${asIsMessage(err instanceof Error ? err.message : String(err))}`);
 			return false;
 		}
 		return true;
@@ -35907,7 +36300,7 @@ async function settleJournalAfterCleanRollback(stackName, failedOperations, init
 		return false;
 	}
 	if (!await this.writeRollbackJournalSegment(stackName, [], failedOperations, "auto-rollback-clean", initialDeploy)) return true;
-	this.logger.info(`The automatic rollback restored the pre-deploy state. The failed resource's pre-failure record was kept — if it was left partially applied, revert it.\nRevert it with: ${pasteableCommand("cdkd rollback", [{
+	this.logger.info("The automatic rollback restored the pre-deploy state. The failed resource's pre-failure record was kept — if it was left partially applied, revert it." + safeMsg`\nRevert it with: ${pasteableCommand("cdkd rollback", [{
 		value: stackName,
 		hole: "stack"
 	}, { literal: "--revert-failed" }]).command}`);
@@ -35975,10 +36368,10 @@ async function writeRollbackJournalSegment(stackName, completedOperations, faile
 			...nestedPending?.previousCrossStackReads && { previousCrossStackReads: nestedPending.previousCrossStackReads }
 		};
 		await this.stateBackend.appendRollbackJournalSegment(stackName, this.stackRegion, segment);
-		this.logger.debug(`Rollback journal segment written (${reason})`);
+		this.logger.debug(safeMsg`Rollback journal segment written (${reason})`);
 		return true;
 	} catch (journalError) {
-		this.logger.warn(`Failed to write rollback journal: ${journalError instanceof Error ? journalError.message : String(journalError)}. 'cdkd rollback' will NOT be able to revert this deploy — use 'cdkd deploy' to resume or 'cdkd destroy' to clean up.`);
+		this.logger.warn(safeMsg`Failed to write rollback journal: ${asIsMessage(journalError instanceof Error ? journalError.message : String(journalError))}. ` + `'cdkd rollback' will NOT be able to revert this deploy — use 'cdkd deploy' to resume or 'cdkd destroy' to clean up.`);
 		return false;
 	}
 }
@@ -36293,7 +36686,7 @@ function kickOffObservedCapture(provider, logicalId, physicalId, resourceType, r
 			this.printingSecretsFor(logicalId),
 			this.fingerprintNoEchoValues
 		]);
-		this.logger.debug(mask(`observedProperties capture for ${logicalId} (${resourceType}) failed: ${err instanceof Error ? err.message : String(err)} — drift will fall back to template properties for this resource until the next successful deploy.`));
+		this.logger.debug(safeMsg`observedProperties capture for ${mask(logicalId)} (${mask(resourceType)}) failed: ${asIsMessage(mask(err instanceof Error ? err.message : String(err)))} — drift will fall back to template properties for this resource until the next successful deploy.`);
 	});
 	const promise = secrets === void 0 ? read() : withCurrentResourceSecrets(secrets, read);
 	this.observedCaptureTasks.set(logicalId, promise);
@@ -36387,8 +36780,8 @@ function stampReasonlessParameterRefusals(stateResources, template) {
 		};
 		stamped++;
 	}
-	if (namesParameter?.failedClosed !== void 0) this.logger.debug(`The template's parameter dependence could not be judged (${namesParameter.failedClosed}): every observed-baseline refusal recorded without a reason is treated as an unverifiable-parameter refusal (${stamped} stamped).`);
-	if (stamped > 0) this.logger.debug(`${stamped} resource(s) carry an observed-baseline refusal recorded without a reason by an older cdkd, and their template definition reads a template parameter: treated as an unverifiable-parameter refusal (kept until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter).`);
+	if (namesParameter?.failedClosed !== void 0) this.logger.debug(safeMsg`The template's parameter dependence could not be judged (${namesParameter.failedClosed}): every observed-baseline refusal recorded without a reason is treated as an unverifiable-parameter refusal (${stamped} stamped).`);
+	if (stamped > 0) this.logger.debug(safeMsg`${stamped} resource(s) carry an observed-baseline refusal recorded without a reason by an older cdkd, and their template definition reads a template parameter: treated as an unverifiable-parameter refusal (kept until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter).`);
 }
 function kickOffAutoRefreshObservedProperties(stateResources, crossStackReads) {
 	if (this.options.captureObservedState !== true) return;
@@ -36415,7 +36808,7 @@ function kickOffAutoRefreshObservedProperties(stateResources, crossStackReads) {
 			resource
 		});
 	}
-	if (refused > 0) this.logger.debug(`observed-properties auto-refresh SKIPPED for ${refused} resource(s) whose baseline a 'cdkd import' run refused: their recorded properties cannot position the redaction, so capturing an AWS readback against them could persist a resolved secret in plaintext. A deploy that actually CHANGES one of them restores its baseline, unless the refusal is an unverifiable-parameter one (only a replacement or a proving re-import discharges that); a NO_CHANGE deploy never does.`);
+	if (refused > 0) this.logger.debug(safeMsg`observed-properties auto-refresh SKIPPED for ${refused} resource(s) whose baseline a 'cdkd import' run refused: their recorded properties cannot position the redaction, so capturing an AWS readback against them could persist a resolved secret in plaintext. A deploy that actually CHANGES one of them restores its baseline, unless the refusal is an unverifiable-parameter one (only a replacement or a proving re-import discharges that); a NO_CHANGE deploy never does.`);
 	if (candidates.length === 0 && masked.length === 0) return;
 	const allSiblings = {};
 	for (const [lid, res] of Object.entries(stateResources)) allSiblings[lid] = {
@@ -36443,7 +36836,7 @@ function kickOffAutoRefreshObservedProperties(stateResources, crossStackReads) {
 		} : void 0);
 		toRefresh++;
 	}
-	if (toRefresh > 0) this.logger.warn(`cdkd state schema upgrade detected — refreshing observed-properties baseline for ${toRefresh} resource(s) (one-time, runs in parallel with deploy)`);
+	if (toRefresh > 0) this.logger.warn(safeMsg`cdkd state schema upgrade detected — refreshing observed-properties baseline for ${toRefresh} resource(s) (one-time, runs in parallel with deploy)`);
 	let producerRegions = [];
 	if (masked.length > 0) try {
 		producerRegions = producerRegionsFromState(crossStackReads);
@@ -36607,9 +37000,9 @@ function refuseRedactedAttributeReads(logicalId, resourceType, context) {
 	if (reads === void 0 || reads.length === 0) return;
 	if (reads.every((read) => read.kind === "attribute" && read.declaredNoEcho === true)) {
 		const producers = [...new Set(reads.map((read) => read.logicalId).filter((id) => !!id))];
-		throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: ${producers.map((id) => displayIdent(id)).join(", ")} declared ${reads.length === 1 ? "that attribute" : "those attributes"} NoEcho, so cdkd's recorded state holds only the redaction mask for ${reads.length === 1 ? "it" : "them"}, and cdkd does not re-run a producer to recover a value. Remedy: deploy a change to the producer in the SAME run as ${logicalId} (for a custom resource, change one of its properties, e.g. a nonce / version property, so its handler runs again and supplies the value), or stop declaring the value NoEcho.`, resourceType, logicalId);
+		throw new ProvisioningError(safeMsg`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: ` + safeMsg`${producers.map((id) => displayIdent(id)).join(", ")} declared ${reads.length === 1 ? "that attribute" : "those attributes"} NoEcho, ` + safeMsg`so cdkd's recorded state holds only the redaction mask for ${reads.length === 1 ? "it" : "them"}, ` + `and cdkd does not re-run a producer to recover a value. Remedy: deploy a change to the ` + safeMsg`producer in the SAME run as ${logicalId} (for a custom resource, change one of its ` + "properties, e.g. a nonce / version property, so its handler runs again and supplies the value), or stop declaring the value NoEcho.", resourceType, logicalId);
 	}
-	throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the redaction mask there, and the value is not recoverable from state. There are three ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all, or cdkd deploy '**' when either is inside a CDK Stage) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The value holds the Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records — so a deploy that leaves the resource or output holding it unchanged reads the mask again, and a re-import does not recover it. Remedy: have this resource build the value itself from the SECRET's own reference (the {{resolve:secretsmanager:...}} or {{resolve:ssm-secure:...}} reference, or a {{resolve:ssm:...}} of a SecureString parameter, that the encoding was made from) under its own Fn::Base64, instead of reading it from another resource's attribute or another stack's output — not by a {{resolve:ssm:...}} read of a String parameter holding the encoding, which cdkd treats as public and would record in state in the clear. (3) The resource is recorded through the Cloud Control fallback (by a deploy or by 'cdkd import'), which keeps in the clear only the Fn::GetAtt attributes it can vouch for and masks the rest. If the name above is not an Fn::GetAtt attribute CloudFormation accepts for that resource type, no record will ever hold it: stop reading it. If it is one, 'cdkd import' masked it because it could not vouch for the value, or could not read the schema and warned about it when it happened (if that warning named a missing cloudformation:DescribeType permission, grant it first); a deploy that creates or updates the resource records it, unless its value came from a secret. See https://github.com/go-to-k/cdkd/issues/2449. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources, true)}`, resourceType, logicalId);
+	throw new ProvisioningError(safeMsg`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the ` + `redaction mask there, and the value is not recoverable from state. There are three ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all, or cdkd deploy '**' when either is inside a CDK Stage) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The value holds the Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records — so a deploy that leaves the resource or output holding it unchanged reads the mask again, and a re-import does not recover it. Remedy: have this resource build the value itself from the SECRET's own reference (the {{resolve:secretsmanager:...}} or {{resolve:ssm-secure:...}} reference, or a {{resolve:ssm:...}} of a SecureString parameter, that the encoding was made from) under its own Fn::Base64, instead of reading it from another resource's attribute or another stack's output — not by a {{resolve:ssm:...}} read of a String parameter holding the encoding, which cdkd treats as public and would record in state in the clear. (3) The resource is recorded through the Cloud Control fallback (by a deploy or by 'cdkd import'), which keeps in the clear only the Fn::GetAtt attributes it can vouch for and masks the rest. If the name above is not an Fn::GetAtt attribute CloudFormation accepts for that resource type, no record will ever hold it: stop reading it. If it is one, 'cdkd import' masked it because it could not vouch for the value, or could not read the schema and warned about it when it happened (if that warning named a missing cloudformation:DescribeType permission, grant it first); a deploy that creates or updates the resource records it, unless its value came from a secret. See https://github.com/go-to-k/cdkd/issues/2449. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources, true)}`, resourceType, logicalId);
 }
 function allRecordedSecrets() {
 	const all = /* @__PURE__ */ new Map();
@@ -36801,7 +37194,8 @@ async function replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourc
 			maskSecrets: createUnionSecretMasker([secrets, this.secretNameBagFor(logicalId)])
 		}));
 	} catch (deleteError) {
-		throw new Error(maskSecretsInText(`Failed to delete old resource ${logicalId} (${currentResource.physicalId}) during the --replace delete-first fallback: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`, secrets), { cause: deleteError instanceof Error ? maskSecretsInError(deleteError, secrets) : void 0 });
+		const shownSecrets = unionOfSecretBags([secrets, this.printingSecretsFor(logicalId)]);
+		throw new Error(safeMsg`Failed to delete old resource ${maskSecretsInText(logicalId, shownSecrets)} ` + safeMsg`(${maskSecretsInText(currentResource.physicalId, shownSecrets)}) ` + `during the --replace delete-first fallback: ` + safeMsg`${asIsMessage(maskSecretsInText(deleteError instanceof Error ? deleteError.message : String(deleteError), shownSecrets))}`, { cause: deleteError instanceof Error ? maskSecretsInError(deleteError, secrets) : void 0 });
 	}
 	reportDeleteGuards(deleteResult, {
 		physicalId: currentResource.physicalId,
@@ -36810,9 +37204,9 @@ async function replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourc
 	});
 	const replaceSkipReason = deleteSkipReason(deleteResult);
 	if (replaceSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, replaceSkipReason, "during the --replace delete-first fallback"));
-	this.logger.info(`  ${green("✓")} Old resource deleted`);
+	this.logger.info(safeMsg`  ${green("✓")} Old resource deleted`);
 	this.oldDeletedBeforeCreate.add(logicalId);
-	this.logger.info(`  Re-creating ${logicalId}...`);
+	this.logger.info(safeMsg`  Re-creating ${logicalId}...`);
 	try {
 		return await withRetry(() => this.withRetry(() => withCurrentResourceSecrets(secrets, () => replaceProvider.create(logicalId, resourceType, replaceProps, createContext)), logicalId, void 0, void 0, replaceProvider), logicalId, {
 			maxRetries: 8,
@@ -36824,7 +37218,8 @@ async function replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourc
 			isRetryable: isRecreateRetryableError
 		});
 	} catch (recreateError) {
-		throw new Error(maskSecretsInText(`Failed to re-create ${logicalId} after the --replace delete-first fallback already deleted the old resource (${currentResource.physicalId}): ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. Re-run the deploy to create it fresh.`, secrets), { cause: recreateError instanceof Error ? maskSecretsInError(recreateError, secrets) : void 0 });
+		const shownSecrets = unionOfSecretBags([secrets, this.printingSecretsFor(logicalId)]);
+		throw new Error(safeMsg`Failed to re-create ${maskSecretsInText(logicalId, shownSecrets)} after the ` + safeMsg`--replace delete-first fallback already deleted the old resource (${maskSecretsInText(currentResource.physicalId, shownSecrets)}). ` + safeMsg`Re-run the deploy to create it fresh. Cause: ${asIsMessage(maskSecretsInText(recreateError instanceof Error ? recreateError.message : String(recreateError), shownSecrets))}`, { cause: recreateError instanceof Error ? maskSecretsInError(recreateError, secrets) : void 0 });
 	}
 }
 function typeChangeNameQuestion(resourceType, input) {
@@ -36916,7 +37311,7 @@ async function createFirstThenDeleteOld(input) {
 	await this.deleteReplacedAfterCreate(logicalId, input.oldResourceType, currentResource, input.deleteProvider, input.deleteProperties, finalSnapshotIdentifier, input.deletePolicy, secrets, input.deleteProvisionedBy, input.noEchoDeleteValues);
 	return createResult;
 }
-async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, deleteProvider, deleteProperties, finalSnapshotIdentifier, updateReplacePolicy, secrets, deleteProvisionedBy, noEchoDeleteValues) {
+async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, deleteProvider, deleteProperties, finalSnapshotIdentifier, updateReplacePolicy, secrets, deleteProvisionedBy, noEchoDeleteValues, isRetry = false) {
 	let deleteResult = void 0;
 	let deleteFailed = false;
 	const inlinePolicyClaimed = isStandaloneInlinePolicyType(oldResourceType) ? this.inlinePolicyClaimedFor(oldResourceType, logicalId, this.deployStateResources) : void 0;
@@ -36935,6 +37330,18 @@ async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentReso
 	} catch (deleteError) {
 		const deleteMsg = maskSecretsInText(deleteError instanceof Error ? deleteError.message : String(deleteError), secrets);
 		deleteFailed = true;
+		const deferred = this.deferredReplacedDeletes;
+		if (!isRetry && deferred !== void 0) {
+			this.logger.info(safeMsg`  Could not delete old ${logicalId} (${currentResource.physicalId}) yet: ${deleteMsg}. Retrying after the rest of the deploy.`);
+			deferred.set(logicalId, {
+				physicalId: currentResource.physicalId,
+				resourceType: oldResourceType,
+				provisionedBy: deleteProvisionedBy,
+				failureMessage: deleteMsg,
+				retry: () => this.deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, deleteProvider, deleteProperties, finalSnapshotIdentifier, updateReplacePolicy, secrets, deleteProvisionedBy, noEchoDeleteValues, true)
+			});
+			return;
+		}
 		this.logger.warn(safeMsg`  ⚠ Failed to delete old resource ${logicalId} (${currentResource.physicalId}): ${deleteMsg}`);
 	}
 	reportDeleteGuards(deleteResult, {
@@ -36945,8 +37352,67 @@ async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentReso
 	const skipReason = deleteSkipReason(deleteResult);
 	if (skipReason !== void 0) {
 		this.replacedDeleteSkips.set(logicalId, `the replaced ${oldResourceType} (${currentResource.physicalId}) was not deleted (${skipReason}) and is no longer tracked by cdkd`);
-		this.logger.warn(`  ⚠ ${deleteSkippedMessage(logicalId, currentResource.physicalId, skipReason, "while cleaning up the replaced resource", { commandFreeLine: true })}. Delete it manually — it is no longer tracked in state.`);
-	} else if (!deleteFailed) this.logger.info(`  ${green("✓")} Old resource deleted`);
+		this.logger.warn(safeMsg`  ⚠ ${deleteSkippedMessage(logicalId, currentResource.physicalId, skipReason, "while cleaning up the replaced resource", { commandFreeLine: true })}. Delete it manually — it is no longer tracked in state.`);
+	} else if (!deleteFailed) this.logger.info(isRetry ? safeMsg`  ${green("✓")} Old ${logicalId} (${currentResource.physicalId}) deleted` : safeMsg`  ${green("✓")} Old resource deleted`);
+}
+async function retryDeferredReplacedDeletes(stackName, counts) {
+	const deferred = this.deferredReplacedDeletes;
+	this.deferredReplacedDeletes = void 0;
+	if (deferred === void 0 || deferred.size === 0) return;
+	this.logger.info(safeMsg`Retrying the delete of ${deferred.size} replaced resource(s)`);
+	const retryOne = async (logicalId, entry) => {
+		const guards = [];
+		try {
+			await withPrintingSecrets(this.secretNameBagFor(logicalId), () => withStackRecords(this.stackRecordsView, () => collectDeleteGuards(guards, async () => {
+				this.logger.info(safeMsg`  Deleting old ${logicalId} (${entry.physicalId})...`);
+				try {
+					await entry.retry();
+				} catch {
+					this.logger.warn(safeMsg`  ⚠ Failed to delete old resource ${logicalId} (${entry.physicalId}): the retry failed unexpectedly`);
+				}
+			})));
+		} finally {
+			for (const guard of guards) this.recordEvent({
+				eventType: "RESOURCE_GUARD_INDETERMINATE",
+				stackName,
+				operation: "DELETE",
+				logicalId,
+				resourceType: guard.resourceType,
+				...guard.provisionedBy && { provisionedBy: guard.provisionedBy },
+				...guard.physicalId && { physicalId: maskSecretsInText(guard.physicalId, this.perResourceSecrets.get(logicalId) ?? EMPTY_SECRETS) },
+				guard: guard.guard,
+				reason: guard.reason
+			});
+		}
+		const skip = this.replacedDeleteSkips.get(logicalId);
+		if (skip === void 0) return;
+		this.replacedDeleteSkips.delete(logicalId);
+		if (entry.rowPartial !== true) {
+			counts.updated = Math.max(0, counts.updated - 1);
+			counts.updatePartial++;
+		}
+		this.recordEvent({
+			eventType: "RESOURCE_SKIPPED",
+			stackName,
+			operation: "UPDATE",
+			logicalId,
+			resourceType: entry.resourceType,
+			...entry.provisionedBy && { provisionedBy: entry.provisionedBy },
+			physicalId: entry.physicalId,
+			reason: skip
+		});
+	};
+	const queue = [...deferred];
+	const workers = Math.max(1, Math.min(this.options.concurrency ?? 1, queue.length));
+	await Promise.all(Array.from({ length: workers }, async () => {
+		for (let next = queue.shift(); next !== void 0; next = queue.shift()) await retryOne(...next);
+	}));
+}
+function warnUnretriedReplacedDeletes(why) {
+	const deferred = this.deferredReplacedDeletes;
+	this.deferredReplacedDeletes = void 0;
+	const note = why === "failed" ? "not retried: the deploy failed first" : "not retried: the deploy was interrupted";
+	for (const [logicalId, entry] of deferred ?? []) withPrintingSecrets(this.secretNameBagFor(logicalId), () => this.logger.warn(safeMsg`  ⚠ Failed to delete old resource ${logicalId} (${entry.physicalId}): ${entry.failureMessage} (${note})`));
 }
 
 //#endregion
@@ -37050,7 +37516,7 @@ async function readStaleAttributes(logicalId, resource, stackName) {
 		resourceType: resource.resourceType,
 		attributes
 	});
-	this.logger.debug(`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS — its state record lacked one a Fn::GetAtt asked for: ${Object.keys(attributes).length} attribute(s) read`);
+	this.logger.debug(safeMsg`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS — its state record lacked one a Fn::GetAtt asked for: ${Object.keys(attributes).length} attribute(s) read`);
 	return outcome;
 }
 function withHealedAttributes(logicalId, record) {
@@ -37077,8 +37543,8 @@ function auditResolvedAssetReferences(logicalId, resourceType, resolvedProps) {
 	if (!redirect) return;
 	const findings = findUnrewrittenAssetReferences(resolvedProps, redirect);
 	if (findings.length === 0) return;
-	const detail = findings.map((f) => `  - ${f.path}: still references '${f.source}'`).join("\n");
-	throw new ProvisioningError(`Unrewritten asset reference on '${logicalId}' (${resourceType}): this region uses cdkd-owned asset storage, but the following resolved properties still point at the CDK bootstrap storage that 'cdk gc' may garbage-collect:\n${detail}\nThis is a template shape cdkd's asset-reference rewrite did not cover — deploying it would split-brain the stack (assets in cdkd storage, properties reading the CDK bucket). Please report this at https://github.com/go-to-k/cdkd/issues with the property shape. Workaround: deploy with --use-cdk-bootstrap-assets to pin the legacy destinations for this app.`, resourceType, logicalId);
+	const detail = findings.map((f) => safeMsg`  - ${f.path}: still references '${f.source}'`).join("\n");
+	throw new ProvisioningError(safeMsg`Unrewritten asset reference on '${logicalId}' (${resourceType}): this region uses ` + `cdkd-owned asset storage, but the following resolved properties still point at the CDK bootstrap storage that 'cdk gc' may garbage-collect:\n${detail}\nThis is a template shape cdkd's asset-reference rewrite did not cover — deploying it would split-brain the stack (assets in cdkd storage, properties reading the CDK bucket). Please report this at https://github.com/go-to-k/cdkd/issues with the property shape. Workaround: deploy with --use-cdk-bootstrap-assets to pin the legacy destinations for this app.`, resourceType, logicalId);
 }
 function extractAllDependencies(template, logicalId) {
 	const resource = template?.Resources?.[logicalId];
@@ -37368,7 +37834,7 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 	if (progress) progress.current++;
 	const createPrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
 	renderer.removeTask(logicalId);
-	this.logger.info(`${createPrefix}${formatResourceLine("created", logicalId, resourceType)}`);
+	this.logger.info(safeMsg`${createPrefix}${formatResourceLine("created", logicalId, resourceType)}`);
 }
 async function refuseUnlicensedGeneratedName(input) {
 	const { logicalId, resourceType } = input;
@@ -40235,6 +40701,118 @@ function recordedProtectionNote(evidence, flags) {
 	return `${evidence}. AWS refuses to delete the resource while that protection is on, and cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and cdkd state destroy act on one), so ${flags} alone does not remove the old resource: depending on the replacement order, the deploy either fails at that delete or completes leaving the old resource, and its data, in AWS and no longer tracked by cdkd. Read ${DELETION_PROTECTION_DOC_POINTER} before you disable anything, then turn the protection off out of band (the console, or the service's own API) and re-run with ${flags}.`;
 }
 
+//#endregion
+//#region src/deployment/deploy-engine/read-provenance-moved.ts
+function occurrences(value, token) {
+	if (typeof value === "string") return value.includes(token) ? value.split(token).length - 1 : 0;
+	if (Array.isArray(value)) {
+		let n = 0;
+		for (const item of value) n += occurrences(item, token);
+		return n;
+	}
+	if (value !== null && typeof value === "object") {
+		let n = 0;
+		for (const item of Object.values(value)) n += occurrences(item, token);
+		return n;
+	}
+	return 0;
+}
+function readProvenanceMovedPaths(args) {
+	const paths = /* @__PURE__ */ new Set();
+	const tokens = [];
+	const field = referenceProvenanceOf(args.record);
+	if (field === void 0) return {
+		paths,
+		tokens
+	};
+	for (const [token, entry] of Object.entries(field)) {
+		const recorded = entry.readVersions;
+		if (recorded === void 0 || recorded.length === 0) continue;
+		const served = passReadVersionsFor(args.secrets, token);
+		if (served === void 0) continue;
+		if ([...served].every((version) => recorded.includes(version))) continue;
+		const held = /* @__PURE__ */ new Set();
+		for (const key of Object.keys(args.desiredRedacted)) {
+			const count = occurrences(args.desiredRedacted[key], token);
+			if (count === 0) continue;
+			if (count > (Object.hasOwn(args.templateProperties, key) ? occurrences(args.templateProperties[key], token) : 0)) held.add(key);
+		}
+		if (held.size === 0) continue;
+		for (const key of held) paths.add(key);
+		tokens.push({
+			token,
+			paths: held,
+			recorded,
+			served,
+			region: entry.region
+		});
+	}
+	return {
+		paths,
+		tokens
+	};
+}
+async function confirmValueMoves(moved, sameValue) {
+	const kept = [];
+	const unchanged = [];
+	for (const entry of moved.tokens) {
+		let equal = entry.recorded.length === 1 ? true : void 0;
+		for (const served of entry.served) {
+			if (equal !== true) break;
+			equal = await sameValue(entry, entry.recorded[0], served);
+		}
+		if (equal === true) unchanged.push(entry);
+		else kept.push(entry);
+	}
+	const paths = /* @__PURE__ */ new Set();
+	for (const entry of kept) for (const key of entry.paths) paths.add(key);
+	return {
+		moved: {
+			paths,
+			tokens: kept
+		},
+		unchanged
+	};
+}
+async function sameValueAtVersions(resolver, entry, recorded, served, base) {
+	const context = (pin) => ({
+		template: base.template,
+		resources: base.resources,
+		recordedSecretValues: /* @__PURE__ */ new Map(),
+		provenanceSuppressed: true,
+		referencePins: /* @__PURE__ */ new Map([[entry.token, pin]])
+	});
+	if (entry.region === void 0) return void 0;
+	const reader = resolver.resolverForRecordedRegion(entry.region);
+	try {
+		const now = await reader.resolveDynamicReferences(entry.token, context(served));
+		const then = await reader.resolveDynamicReferences(entry.token, context(recorded));
+		if (now.includes("{{resolve:") || then.includes("{{resolve:")) return void 0;
+		return now === then;
+	} catch (err) {
+		if (isDeliberateResolutionRefusal(err)) throw err;
+		return;
+	}
+}
+function withRefreshedReadVersions(record, unchanged) {
+	const field = referenceProvenanceOf(record);
+	if (field === void 0) return record;
+	const out = { ...field };
+	for (const { token, served } of unchanged) {
+		const before = Object.hasOwn(field, token) ? field[token] : void 0;
+		const previousRead = new Set(before?.readVersions ?? []);
+		const versions = [.../* @__PURE__ */ new Set([...(before?.versions ?? []).filter((version) => !previousRead.has(version)), ...served])].sort();
+		if (versions.length > 8) continue;
+		const next = validateReferenceProvenance(token, {
+			...before?.region !== void 0 && { region: before.region },
+			versions,
+			readVersions: [...served].sort()
+		});
+		if (next !== void 0) out[token] = next;
+	}
+	return withReferenceProvenance(record, out);
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/noecho.ts
 function noEchoExactEchoLeavesOf(record) {
@@ -42191,12 +42769,23 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	};
 	const suppliesFreshMaskOnlyValue = pendingParameterLeaves.size > 0 || Object.keys(resolvedProps).some((key) => otherFreshAt(key).length > 0);
 	const rewrittenPaths = readsProducerReplacedThisRun.call(this, template, logicalId, stateResources) ? redactionRewrittenPaths(resolvedProps, desiredForSkipCheck, comparisonCoordinates) : /* @__PURE__ */ new Set();
+	const { moved: provenanceMoved, unchanged: provenanceUnchanged } = await confirmValueMoves(readProvenanceMovedPaths({
+		record: currentResource,
+		templateProperties: desiredProps,
+		desiredRedacted: desiredForSkipCheck,
+		secrets: updateSecrets
+	}), (entry, recordedVersion, servedVersion) => sameValueAtVersions(this.resolver, entry, recordedVersion, servedVersion, {
+		template,
+		resources: stateResources
+	}));
+	for (const path of provenanceMoved.paths) rewrittenPaths.add(path);
+	if (provenanceMoved.paths.size > 0) this.logger.info(safeMsg`${logicalId} is sent: ${[...provenanceMoved.paths].sort().join(", ")} read a secret-derived value at a newer version than ${logicalId} was deployed with (its upstream changed since then)`);
 	const recordMatchesDesired = movedMasked.size === 0 && rewrittenPaths.size === 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten);
 	const applyAttributeOnlyUpdate = (attributeChanges) => {
 		const attrSummary = attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
 		this.logger.info(safeMsg`  ↻ ${logicalId} (${resourceType}) attribute update: ${attrSummary}`);
 		stateResources[logicalId] = {
-			...currentResource,
+			...stateResources[logicalId] ?? currentResource,
 			...this.extractTemplateAttributes(template, logicalId)
 		};
 		if (counts) counts.updated++;
@@ -42266,6 +42855,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	const differsWhy = (key) => !lateReplacementDeclined.has(key) ? "differs; the provider is not known to report this property exactly, so the difference may be its normalization" : lateCrossPrefixRefused ? "differs; the replacement was refused: see the state-prefix warning above" : `differs; the replacement was not approved (--require-approval=${this.options.requireApproval ?? "never"})`;
 	if (witnessMigrates && !typeChanged && echoCandidates.length > 0 && hasAddressablePhysicalId(currentResource)) await readOnce();
 	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && recordMatchesDesired) {
+		if (provenanceUnchanged.length > 0) stateResources[logicalId] = withRefreshedReadVersions(stateResources[logicalId] ?? currentResource, provenanceUnchanged);
 		if (change.attributeChanges && change.attributeChanges.length > 0) {
 			applyAttributeOnlyUpdate(change.attributeChanges);
 			return;
@@ -42411,6 +43001,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 				...remaining.length > 0 && { noEchoLeaves: remaining.map((c) => [...c]) }
 			};
 		}
+		if (provenanceUnchanged.length > 0) stateResources[logicalId] = withRefreshedReadVersions(stateResources[logicalId] ?? currentResource, provenanceUnchanged);
 		this.attemptedResolvedProps.delete(logicalId);
 		if (change.attributeChanges && change.attributeChanges.length > 0) {
 			applyAttributeOnlyUpdate(change.attributeChanges);
@@ -42590,20 +43181,20 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 		if (statefulReason && this.options.forceStatefulRecreation !== true) {
 			const immutableProps = change.propertyChanges?.filter((pc) => pc.requiresReplacement).map((pc) => pc.path).join(", ") || "Type";
 			const protection = recordedProtectionEvidence(oldResourceType, currentProps, currentResource.observedProperties, this.stackRegion);
-			throw markNonRetryable(new CdkdError(`${logicalId} (${oldResourceType}) requires replacement (immutable property changed: ${immutableProps}${typeChanged ? `, to ${resourceType}` : ""}) but it is a stateful resource — ${renderStatefulReason(statefulReason)}. ` + (protection ? `${recordedProtectionNote(protection, "--force-stateful-recreation")} Or change the resource's definition to avoid the immutable-property change.` : "Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change."), "STATEFUL_REPLACE_BLOCKED"));
+			throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${oldResourceType}) requires replacement (immutable property changed: ${immutableProps}${typeChanged ? `, to ${resourceType}` : ""}) but it is a stateful resource — ` + safeMsg`${renderStatefulReason(statefulReason)}. ` + (protection ? safeMsg`${recordedProtectionNote(protection, "--force-stateful-recreation")} Or change ` + `the resource's definition to avoid the immutable-property change.` : "Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change."), "STATEFUL_REPLACE_BLOCKED"));
 		}
 	}
 	if (recreateViaCcApi) {
 		const noCcRoute = this.providerRegistry.ccRouteUnavailableReason(resourceType);
-		if (noCcRoute !== void 0) throw markNonRetryable(new CdkdError(`--recreate-via-cc-api cannot recreate ${logicalId} (${resourceType}): Cloud Control API cannot create this type (${noCcRoute}). Nothing was deleted. Drop ${logicalId} from --recreate-via-cc-api.`, "RECREATE_TARGETS_INVALID"));
+		if (noCcRoute !== void 0) throw markNonRetryable(new CdkdError(safeMsg`--recreate-via-cc-api cannot recreate ${logicalId} (${resourceType}): Cloud ` + safeMsg`Control API cannot create this type (${noCcRoute}). Nothing was deleted. ` + safeMsg`Drop ${logicalId} from --recreate-via-cc-api.`, "RECREATE_TARGETS_INVALID"));
 		const ccBroken = ccBrokenReason(resourceType);
-		if (ccBroken !== void 0) throw markNonRetryable(new CdkdError(`--recreate-via-cc-api cannot move ${logicalId} (${resourceType}) to Cloud Control: ${ccBroken}, so cdkd keeps it on its SDK provider. Nothing was deleted. Drop ${logicalId} from --recreate-via-cc-api.`, "RECREATE_TARGETS_INVALID"));
+		if (ccBroken !== void 0) throw markNonRetryable(new CdkdError(safeMsg`--recreate-via-cc-api cannot move ${logicalId} (${resourceType}) to Cloud ` + safeMsg`Control: ${ccBroken}, so cdkd keeps it on its SDK provider. Nothing was ` + safeMsg`deleted. Drop ${logicalId} from --recreate-via-cc-api.`, "RECREATE_TARGETS_INVALID"));
 	}
 	let replacementReason;
 	if (recreateViaCcApi) replacementReason = "--recreate-via-cc-api flag (mid-life SDK→CC migration)";
 	else if (recreateViaSdkProvider) replacementReason = "--recreate-via-sdk-provider flag (mid-life CC→SDK migration)";
 	else replacementReason = `immutable properties changed: ${change.propertyChanges?.filter((pc) => pc.requiresReplacement).map((pc) => pc.path).join(", ")}`;
-	this.logger.info(`Replacing ${logicalId} (${typeChanged ? `${oldResourceType} -> ${resourceType}` : resourceType}) - ${replacementReason}`);
+	this.logger.info(safeMsg`Replacing ${logicalId} (${typeChanged ? `${oldResourceType} -> ${resourceType}` : resourceType}) - ${replacementReason}`);
 	const recreateDirectionHint = recreateViaCcApi ? "cc-api" : recreateViaSdkProvider ? "sdk" : void 0;
 	const replaceDecision = this.providerRegistry.getProviderFor({
 		resourceType,
@@ -42672,9 +43263,9 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 		if (updateReplacePolicy === "Retain") {
 			this.retainedOldOnReplacement.add(logicalId);
 			await noteRetainedResource(oldResourceType, logicalId);
-			this.logger.warn(`  ⚠ ${logicalId} has UpdateReplacePolicy: Retain — ${recreateFlagName} will leak the old physical resource (${currentResource.physicalId}). The new resource shares the same name where applicable; if the type has user-supplied names (e.g. functionName, bucketName), the create will deterministically collide with the retained orphan.`);
+			this.logger.warn(safeMsg`  ⚠ ${logicalId} has UpdateReplacePolicy: Retain — ${recreateFlagName} will ` + safeMsg`leak the old physical resource (${currentResource.physicalId}). The new ` + "resource shares the same name where applicable; if the type has user-supplied names (e.g. functionName, bucketName), the create will deterministically collide with the retained orphan.");
 		} else {
-			this.logger.info(`  Destroying old ${logicalId} (${currentResource.physicalId}) before recreate...`);
+			this.logger.info(safeMsg`  Destroying old ${logicalId} (${currentResource.physicalId}) before recreate...`);
 			const recreateFinalSnapshotId = await this.prepareFinalSnapshotForDelete(logicalId, oldResourceType, currentResource, updateReplacePolicy);
 			let recreateDeleteResult;
 			try {
@@ -42689,7 +43280,8 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 					maskSecrets: createUnionSecretMasker([updateSecrets, this.secretNameBagFor(logicalId)])
 				}));
 			} catch (deleteError) {
-				throw new Error(maskSecretsInText(`Failed to destroy old resource ${logicalId} (${currentResource.physicalId}) during ${recreateFlagName}: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`, updateSecrets), { cause: deleteError instanceof Error ? maskSecretsInError(deleteError, updateSecrets) : void 0 });
+				const shownSecrets = unionOfSecretBags([updateSecrets, this.printingSecretsFor(logicalId)]);
+				throw new Error(safeMsg`Failed to destroy old resource ${maskSecretsInText(logicalId, shownSecrets)} ` + safeMsg`(${maskSecretsInText(currentResource.physicalId, shownSecrets)}) during ${recreateFlagName}: ` + safeMsg`${asIsMessage(maskSecretsInText(deleteError instanceof Error ? deleteError.message : String(deleteError), shownSecrets))}`, { cause: deleteError instanceof Error ? maskSecretsInError(deleteError, updateSecrets) : void 0 });
 			}
 			reportDeleteGuards(recreateDeleteResult, {
 				physicalId: currentResource.physicalId,
@@ -42698,10 +43290,10 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			});
 			const recreateSkipReason = deleteSkipReason(recreateDeleteResult);
 			if (recreateSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, recreateSkipReason, `during ${recreateFlagName}`));
-			this.logger.info(`  ${green("✓")} Old resource deleted`);
+			this.logger.info(safeMsg`  ${green("✓")} Old resource deleted`);
 			this.oldDeletedBeforeCreate.add(logicalId);
 		}
-		this.logger.info(`  Creating new ${logicalId}...`);
+		this.logger.info(safeMsg`  Creating new ${logicalId}...`);
 		createResult = await withRetry(() => this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replaceProvider.create(logicalId, resourceType, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replaceProvider), logicalId, {
 			maxRetries: 8,
 			initialDelayMs: 2e3,
@@ -42711,9 +43303,9 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			onInterrupted: () => new InterruptedError(this.interruptCause ?? "user"),
 			isRetryable: isRecreateRetryableError
 		});
-		if (equalIdIsSameResource && updateReplacePolicy === "Retain" && createResult.physicalId === currentResource.physicalId) throw new CdkdError(`${logicalId} (${resourceType}) recreate returned the existing resource (${currentResource.physicalId}) instead of creating a new one — its Create API is name-idempotent — and UpdateReplacePolicy: Retain means the old resource was never destroyed, so the new properties were not applied. Rename the resource in your CDK code (or remove the explicit physical name) so the recreate can produce a genuinely new resource.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
+		if (equalIdIsSameResource && updateReplacePolicy === "Retain" && createResult.physicalId === currentResource.physicalId) throw new CdkdError(safeMsg`${logicalId} (${resourceType}) recreate returned the existing resource ` + safeMsg`(${currentResource.physicalId}) instead of creating a new one — its Create ` + "API is name-idempotent — and UpdateReplacePolicy: Retain means the old resource was never destroyed, so the new properties were not applied. Rename the resource in your CDK code (or remove the explicit physical name) so the recreate can produce a genuinely new resource.", "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
 	} else {
-		this.logger.info(`  Creating new ${logicalId}...`);
+		this.logger.info(safeMsg`  Creating new ${logicalId}...`);
 		let deletedOldFirst = lostWithParent !== void 0;
 		if (lostWithParent !== void 0) {
 			this.oldDeletedBeforeCreate.add(logicalId);
@@ -42733,7 +43325,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 				observed: currentResource.observedProperties,
 				physicalId: currentResource.physicalId
 			});
-			if (nameHeldElsewhere !== void 0) throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement, but the create-first attempt collided: ${createMsg}. ${renderNameHeldElsewhere(nameHeldElsewhere)}` + (this.options.replace === true ? ` — so --replace was NOT applied and nothing was deleted.` : updateReplacePolicy === "Retain" ? " — so removing UpdateReplacePolicy: Retain and re-running with `cdkd deploy --replace` would delete this resource and still collide." : " — so `cdkd deploy --replace` would delete this resource and still collide.") + " Choose a name no other resource holds, or delete the resource holding it if it is yours.", "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
+			if (nameHeldElsewhere !== void 0) throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement, but the create-first ` + safeMsg`attempt collided: ${createMsg}. ${renderNameHeldElsewhere(nameHeldElsewhere)}` + (this.options.replace === true ? ` — so --replace was NOT applied and nothing was deleted.` : updateReplacePolicy === "Retain" ? " — so removing UpdateReplacePolicy: Retain and re-running with `cdkd deploy --replace` would delete this resource and still collide." : " — so `cdkd deploy --replace` would delete this resource and still collide.") + " Choose a name no other resource holds, or delete the resource holding it if it is yours.", "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
 			const holder = replacementOldHoldsSentName({
 				createType: resourceType,
 				holderType: oldResourceType,
@@ -42751,26 +43343,26 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 				const flagClause = this.options.replace === true ? ` --replace was NOT applied and nothing was deleted.` : updateReplacePolicy === "Retain" ? " Nothing was deleted. UpdateReplacePolicy: Retain keeps the resource being replaced in place; removing it and re-running with `cdkd deploy --replace` would refuse the same way rather than delete it." : " Nothing was deleted, and `cdkd deploy --replace` would refuse the same way rather than delete it.";
 				throw markNonRetryable(new CdkdError(maskSecretsInText(`${displaySafe(logicalId)} (${displaySafe(resourceType)}) requires replacement, but the create-first attempt collided: ${holder.diagnosis} — ` + (holder.known ? "so another resource holds the colliding name (an orphan of an earlier attempt, or one made outside this stack), and deleting the resource being replaced would destroy it and collide again." + flagClause + " Remove or rename the resource holding that name if it is yours, then re-run the deploy." : "so if another resource holds it (an orphan of an earlier attempt, or one made outside this stack), deleting the resource being replaced would destroy it and collide again." + flagClause + " Remove or rename whatever holds that name if it is yours — if that is the resource being replaced itself, delete it by hand — then re-run the deploy.") + ` Underlying collision: ${createMsg}`, updateSecrets), "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
 			}
-			if (updateReplacePolicy === "Retain") throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. ${nameOrigin.descriptor}. ${nameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed.`, "NAMED_REPLACEMENT_COLLISION");
-			if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but the create-first attempt collided with the existing resource: ${createMsg}. ${nameOrigin.descriptor}, so the CloudFormation-style safe replacement order (create the new resource before deleting the old) cannot reuse the occupied name — CloudFormation refuses this shape with "cannot update a stack when a custom-named resource requires replacing". ${nameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated).`, "NAMED_REPLACEMENT_COLLISION");
-			this.logger.info(`  Create-first collided with the existing resource's name and --replace is set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
+			if (updateReplacePolicy === "Retain") throw new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement, but its physical name ` + `is still held by the existing resource AND UpdateReplacePolicy: Retain ` + safeMsg`pins that resource in place. ${nameOrigin.descriptor}. ` + safeMsg`${nameOrigin.remedy} — with Retain, the old resource keeps the name, so a ` + `same-name replacement can never proceed.`, "NAMED_REPLACEMENT_COLLISION");
+			if (this.options.replace !== true) throw new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement, but the create-first ` + safeMsg`attempt collided with the existing resource: ${createMsg}. ` + safeMsg`${nameOrigin.descriptor}, so the CloudFormation-style safe replacement ` + "order (create the new resource before deleting the old) cannot reuse the occupied name — CloudFormation refuses this shape with \"cannot update a stack when a custom-named resource requires replacing\". " + safeMsg`${nameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete ` + "the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated).", "NAMED_REPLACEMENT_COLLISION");
+			this.logger.info(`  Create-first collided with the existing resource's name and --replace is ` + safeMsg`set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
 			deletedOldFirst = true;
 			createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy, oldDeleteRoute.provisionedBy, noEchoDeleteValues);
 		}
 		if (equalIdIsSameResource && !deletedOldFirst && createResult.physicalId === currentResource.physicalId) {
 			const idempotentNameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
-			if (updateReplacePolicy === "Retain") throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its Create API is name-idempotent: the create-first attempt returned the existing resource (${currentResource.physicalId}) instead of creating a new one, and UpdateReplacePolicy: Retain pins that resource in place. ${idempotentNameOrigin.descriptor}. ${idempotentNameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
-			if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its Create API is name-idempotent: the create-first attempt returned the EXISTING resource (${currentResource.physicalId}) instead of creating a new one, so deleting the "old" resource would silently destroy the resource the deploy just reported as created. ${idempotentNameOrigin.descriptor}; ${idempotentNameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated). Note: this branch is also reached when the old resource was deleted out-of-band and the physical id is name-derived — there the create was a genuine fresh create; \`--replace\` converges that case too.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
-			this.logger.info(`  Create-first returned the existing resource (name-idempotent Create API) and --replace is set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
+			if (updateReplacePolicy === "Retain") throw new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement, but its Create API is ` + `name-idempotent: the create-first attempt returned the existing resource ` + safeMsg`(${currentResource.physicalId}) instead of creating a new one, and ` + `UpdateReplacePolicy: Retain pins that resource in place. ` + safeMsg`${idempotentNameOrigin.descriptor}. ${idempotentNameOrigin.remedy} — with ` + "Retain, the old resource keeps the name, so a same-name replacement can never proceed.", "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
+			if (this.options.replace !== true) throw new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement, but its Create API is ` + `name-idempotent: the create-first attempt returned the EXISTING resource ` + safeMsg`(${currentResource.physicalId}) instead of creating a new one, so deleting ` + `the "old" resource would silently destroy the resource the deploy just ` + safeMsg`reported as created. ${idempotentNameOrigin.descriptor}; ` + safeMsg`${idempotentNameOrigin.remedy}, or re-run with ` + "`cdkd deploy --replace` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated). Note: this branch is also reached when the old resource was deleted out-of-band and the physical id is name-derived — there the create was a genuine fresh create; `--replace` converges that case too.", "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
+			this.logger.info(`  Create-first returned the existing resource (name-idempotent Create API) ` + safeMsg`and --replace is set — deleting old ${logicalId} ` + safeMsg`(${currentResource.physicalId}) first...`);
 			deletedOldFirst = true;
 			createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy, oldDeleteRoute.provisionedBy, noEchoDeleteValues);
 		}
 		if (deletedOldFirst) {} else if (updateReplacePolicy === "Retain") {
 			this.retainedOldOnReplacement.add(logicalId);
 			await noteRetainedResource(oldResourceType, logicalId);
-			this.logger.info(`  Retaining old ${logicalId} (${currentResource.physicalId}) - UpdateReplacePolicy: Retain`);
+			this.logger.info(safeMsg`  Retaining old ${logicalId} (${currentResource.physicalId}) - UpdateReplacePolicy: Retain`);
 		} else {
-			this.logger.info(`  Deleting old ${logicalId} (${currentResource.physicalId})...`);
+			this.logger.info(safeMsg`  Deleting old ${logicalId} (${currentResource.physicalId})...`);
 			let cleanupFinalSnapshotId;
 			let snapshotBlockedDelete = false;
 			try {
@@ -42778,7 +43370,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			} catch (snapshotError) {
 				if (snapshotError instanceof CdkdError && snapshotError.code === "FINAL_SNAPSHOT_UNSUPPORTED") throw snapshotError;
 				snapshotBlockedDelete = true;
-				this.logger.warn(`  ⚠ Final snapshot for old ${logicalId} (${currentResource.physicalId}) failed: ${snapshotError instanceof Error ? snapshotError.message : String(snapshotError)}. The old resource was NOT deleted (UpdateReplacePolicy: Snapshot) — delete it manually once you have a snapshot; it is no longer tracked in state.`);
+				this.logger.warn(safeMsg`  ⚠ Final snapshot for old ${logicalId} (${currentResource.physicalId}) ` + safeMsg`failed: ${asIsMessage(snapshotError instanceof Error ? snapshotError.message : String(snapshotError))}. ` + "The old resource was NOT deleted (UpdateReplacePolicy: Snapshot) — delete it manually once you have a snapshot; it is no longer tracked in state.");
 			}
 			if (!snapshotBlockedDelete) await this.deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, oldDeleteProvider, currentResource.properties, cleanupFinalSnapshotId, updateReplacePolicy, updateSecrets, oldDeleteRoute.provisionedBy, noEchoDeleteValues);
 		}
@@ -42804,9 +43396,9 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 	const replacePrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
 	renderer.removeTask(logicalId);
 	const replacedSkip = this.replacedDeleteSkips.get(logicalId);
-	const replacedLine = `${replacePrefix}${yellow("↻")} ${bold(logicalId)} ${gray(`(${resourceType})`)} ${yellow("replaced")}`;
+	const replacedLine = safeMsg`${replacePrefix}${yellow("↻")} ${bold(logicalId)} ${gray(`(${resourceType})`)} ${yellow("replaced")}`;
 	if (replacedSkip !== void 0) {
-		this.logger.warn(replacedLine + " " + updatePartialMessage(replacedSkip));
+		this.logger.warn(safeMsg`${replacedLine} ${updatePartialMessage(replacedSkip)}`);
 		return;
 	}
 	this.logger.info(replacedLine);
@@ -42815,7 +43407,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 //#endregion
 //#region src/deployment/deploy-engine/update-in-place.ts
 async function updateInPlace({ conditions, counts, currentProps, currentPropsAsWritten, currentResource, dependencies, desiredForSkipCheckAsWritten, logicalId, noEchoHeldPaths, parameterValues, progress, renderer, resolvedProps, resourceType, stackName, stateResources, template, updateReplacePolicy, updateSecrets, reattach }) {
-	this.logger.debug(`Updating ${logicalId} (${resourceType})`);
+	this.logger.debug(safeMsg`Updating ${logicalId} (${resourceType})`);
 	const updateDecision = this.providerRegistry.getProviderFor({
 		resourceType,
 		properties: resolvedProps,
@@ -42829,12 +43421,12 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 		let message;
 		switch (exemptMode) {
 			case "cc-broken":
-				message = `${logicalId} (${resourceType}): moving to the SDK provider — Cloud Control cannot manage this type correctly. ${preserved}, and this routing is not optional.`;
+				message = safeMsg`${logicalId} (${resourceType}): moving to the SDK provider — Cloud ` + `Control cannot manage this type correctly. ${preserved}, and this routing is not optional.`;
 				break;
 			case "sdk-coverage":
-				message = `${logicalId} (${resourceType}): returning to the SDK provider — cdkd now covers every property this resource uses. ${preserved}; pass --pin-cc-api ${logicalId} to decline this for a deploy.`;
+				message = safeMsg`${logicalId} (${resourceType}): returning to the SDK provider — cdkd now ` + `covers every property this resource uses. ${preserved}; pass ` + safeMsg`--pin-cc-api ${logicalId} to decline this for a deploy.`;
 				break;
-			default: message = `${logicalId} (${resourceType}): moving to the SDK provider. ${preserved}.`;
+			default: message = safeMsg`${logicalId} (${resourceType}): moving to the SDK provider. ${preserved}.`;
 		}
 		this.logger.info(message);
 	}
@@ -42882,7 +43474,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 			const statefulReason = retainOldOnReplace ? null : isStatefulRecreateTargetForReplace(resourceType, currentProps, currentResource.observedProperties);
 			if (statefulReason && this.options.forceStatefulRecreation !== true) {
 				const protection = recordedProtectionEvidence(resourceType, currentProps, currentResource.observedProperties, this.stackRegion);
-				throw markNonRetryable(new CdkdError(replaceOptIn ? `--replace would DELETE + CREATE the stateful resource ${logicalId} (${resourceType}) — ${renderStatefulReason(statefulReason)}. ` + (protection ? `${recordedProtectionNote(protection, "--replace --force-stateful-recreation")} Or change the resource's definition to avoid the immutable-property change.` : "Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.") : `${logicalId} (${resourceType}) cannot be updated in place by the provisioning layer it routes through, so applying this change would DELETE + CREATE it — but it is a stateful resource: ${renderStatefulReason(statefulReason)}. ` + (protection ? `${recordedProtectionNote(protection, "--force-stateful-recreation")} Or change the resource's definition to avoid the update.` : "Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the update."), "STATEFUL_REPLACE_BLOCKED", updateError instanceof Error ? updateError : void 0));
+				throw markNonRetryable(new CdkdError(replaceOptIn ? safeMsg`--replace would DELETE + CREATE the stateful resource ${logicalId} ` + safeMsg`(${resourceType}) — ${renderStatefulReason(statefulReason)}. ` + (protection ? safeMsg`${recordedProtectionNote(protection, "--replace --force-stateful-recreation")} ` + `Or change the resource's definition to avoid the immutable-property change.` : "Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.") : safeMsg`${logicalId} (${resourceType}) cannot be updated in place by the ` + "provisioning layer it routes through, so applying this change would DELETE + CREATE it — but it is a stateful resource: " + safeMsg`${renderStatefulReason(statefulReason)}. ` + (protection ? safeMsg`${recordedProtectionNote(protection, "--force-stateful-recreation")} ` + `Or change the resource's definition to avoid the update.` : "Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the update."), "STATEFUL_REPLACE_BLOCKED", updateError instanceof Error ? updateError : void 0));
 			}
 			const replDecision = this.providerRegistry.getProviderFor({
 				resourceType,
@@ -42913,7 +43505,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 				secrets: updateSecrets,
 				inputSources: template && this.maskedInputSources(template, stateResources, this.noEchoConditions, stackName)
 			});
-			this.logger.info(retainOldOnReplace ? `UPDATE not supported for ${logicalId} (${resourceType}), replacing (CREATE only — UpdateReplacePolicy: Retain keeps the old resource)` : createFirst ? safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing (CREATE → DELETE — the new name differs from the old resource's)` : `UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE → CREATE)`);
+			this.logger.info(retainOldOnReplace ? safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing ` + `(CREATE only — UpdateReplacePolicy: Retain keeps the old resource)` : createFirst ? safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing (CREATE → DELETE — the new name differs from the old resource's)` : safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE → CREATE)`);
 			if (retainOldOnReplace) await noteRetainedResource(resourceType, logicalId);
 			if (!retainOldOnReplace && !createFirst) {
 				const fallbackUpdateReplacePolicy = template?.Resources?.[logicalId]?.UpdateReplacePolicy ?? currentResource.updateReplacePolicy;
@@ -42932,7 +43524,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 					}));
 				} catch (deleteError) {
 					const deleteMsg = deleteError instanceof Error ? deleteError.message : String(deleteError);
-					if (!isWaitAbandonedError(deleteError) && !isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound"))) this.logger.debug(`Old resource ${logicalId} already gone, proceeding with CREATE`);
+					if (!isWaitAbandonedError(deleteError) && !isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound"))) this.logger.debug(safeMsg`Old resource ${logicalId} already gone, proceeding with CREATE`);
 					else throw deleteError;
 				}
 				reportDeleteGuards(fallbackDeleteResult, {
@@ -42972,7 +43564,10 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 				}) : await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replProvider.create(logicalId, resourceType, replProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replProvider);
 			} catch (createError) {
 				if (createFirst) throw createError;
-				if (!retainOldOnReplace) throw new Error(maskSecretsInText(`Failed to create ${logicalId} after the UPDATE-not-supported replacement: the old resource (${currentResource.physicalId}) is now gone. Cause: ${createError instanceof Error ? createError.message : String(createError)}. Re-run the deploy to create it fresh.`, updateSecrets), { cause: createError instanceof Error ? createError : void 0 });
+				if (!retainOldOnReplace) {
+					const shownSecrets = unionOfSecretBags([updateSecrets, this.printingSecretsFor(logicalId)]);
+					throw new Error(safeMsg`Failed to create ${maskSecretsInText(logicalId, shownSecrets)} after the ` + safeMsg`UPDATE-not-supported replacement: the old resource (${maskSecretsInText(currentResource.physicalId, shownSecrets)}) ` + safeMsg`is now gone. Re-run the deploy to create it fresh. Cause: ${asIsMessage(maskSecretsInText(createError instanceof Error ? createError.message : String(createError), shownSecrets))}`, { cause: createError instanceof Error ? createError : void 0 });
+				}
 				if (!isNameCollisionErrorFrom(createError, logicalId)) throw createError;
 				const nameHeldElsewhere = replacementRequestsDifferentName({
 					oldResourceType: resourceType,
@@ -42982,9 +43577,9 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 					observed: currentResource.observedProperties,
 					physicalId: currentResource.physicalId
 				});
-				if (nameHeldElsewhere !== void 0) throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement because the provisioning layer cannot update it in place, but the create collided. ${renderNameHeldElsewhere(nameHeldElsewhere)} — so removing UpdateReplacePolicy: Retain would delete this resource and still collide. Choose a name no other resource holds, or delete the resource holding it if it is yours.`, "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
+				if (nameHeldElsewhere !== void 0) throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement because the ` + `provisioning layer cannot update it in place, but the create collided. ` + safeMsg`${renderNameHeldElsewhere(nameHeldElsewhere)} — so removing ` + "UpdateReplacePolicy: Retain would delete this resource and still collide. Choose a name no other resource holds, or delete the resource holding it if it is yours.", "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
 				const nameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
-				throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement because the provisioning layer cannot update it in place — but its physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. ${nameOrigin.descriptor}. ${nameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed. Removing UpdateReplacePolicy: Retain lets cdkd delete the old resource first, which destroys it and any data it holds.`, "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
+				throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement because the ` + "provisioning layer cannot update it in place — but its physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. " + safeMsg`${nameOrigin.descriptor}. ${nameOrigin.remedy} — with Retain, the old ` + "resource keeps the name, so a same-name replacement can never proceed. Removing UpdateReplacePolicy: Retain lets cdkd delete the old resource first, which destroys it and any data it holds.", "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
 			}
 			if (!retainOldOnReplace && !createFirst && createResult.physicalId === currentResource.physicalId && !equalIdNamesDifferentResources({
 				resourceType,
@@ -43000,10 +43595,10 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 					newProperties: resolvedProps
 				})) {
 					const idempotentNameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
-					throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its Create API is name-idempotent: the create returned the existing resource (${currentResource.physicalId}) instead of creating a new one, and UpdateReplacePolicy: Retain pins that resource in place, so the new properties were not applied. ${idempotentNameOrigin.descriptor}. ${idempotentNameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE"));
+					throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement, but its Create ` + `API is name-idempotent: the create returned the existing resource ` + safeMsg`(${currentResource.physicalId}) instead of creating a new one, and ` + `UpdateReplacePolicy: Retain pins that resource in place, so the new ` + safeMsg`properties were not applied. ${idempotentNameOrigin.descriptor}. ` + safeMsg`${idempotentNameOrigin.remedy} — with Retain, the old resource keeps ` + `the name, so a same-name replacement can never proceed.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE"));
 				}
 				this.retainedOldOnReplacement.add(logicalId);
-				this.logger.warn(`  ⚠ ${logicalId} has UpdateReplacePolicy: Retain — the old physical resource (${currentResource.physicalId}) is RETAINED and is no longer tracked by cdkd: it keeps running and incurring cost, and \`cdkd destroy\` will not remove it. Delete it yourself once you no longer need its data.`);
+				this.logger.warn(safeMsg`  ⚠ ${logicalId} has UpdateReplacePolicy: Retain — the old physical ` + safeMsg`resource (${currentResource.physicalId}) is RETAINED and is no longer ` + "tracked by cdkd: it keeps running and incurring cost, and `cdkd destroy` will not remove it. Delete it yourself once you no longer need its data.");
 				retainedSurvivorReason = `UpdateReplacePolicy: Retain kept the old ${resourceType} (${currentResource.physicalId}), now untracked by cdkd`;
 			}
 			const replacementResult = {
@@ -43034,7 +43629,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 			physicalId: result.physicalId,
 			properties: resolvedProps
 		});
-		this.logger.info(`Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`);
+		this.logger.info(safeMsg`Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`);
 	}
 	const dischargedByReplacement = result.wasReplaced === true && result.physicalId !== currentResource.physicalId;
 	const keepsParameterRefusal = !dischargedByReplacement && hasUnverifiableParameterRefusal(currentResource);
@@ -43063,7 +43658,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 		}
 	};
 	if (updatePartialReason(result) === void 0) this.recordInlinePolicyWrite(logicalId, "update");
-	if (keepsParameterRefusal) this.logger.debug(`observedProperties capture SKIPPED for updated ${logicalId} (${resourceType}): 'cdkd import' refused its baseline because a template parameter was not provably deployed at its 'Default', and this deploy bound the same 'Default' — an in-place update cannot show that AWS no longer holds the deployed value. The refusal stands until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter.`);
+	if (keepsParameterRefusal) this.logger.debug(safeMsg`observedProperties capture SKIPPED for updated ${logicalId} (${resourceType}): 'cdkd import' refused its baseline because a template parameter was not provably deployed at its 'Default', and this deploy bound the same 'Default' — an in-place update cannot show that AWS no longer holds the deployed value. The refusal stands until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter.`);
 	const updateCaptureSiblings = keepsParameterRefusal ? void 0 : await this.buildObservedCaptureSiblings(resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
 	if (!keepsParameterRefusal) this.kickOffObservedCapture(captureProvider, logicalId, result.physicalId, resourceType, resolvedProps, {
 		...updateCaptureSiblings,
@@ -43080,11 +43675,11 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 	const replacedSkip = this.replacedDeleteSkips.get(logicalId);
 	const shownPartial = updatePartial !== void 0 && replacedSkip !== void 0 ? `${updatePartial}; ${replacedSkip}` : updatePartial ?? replacedSkip;
 	if (shownPartial !== void 0) {
-		this.logger.warn(`${updatePrefix}${formatResourceLine("updated", logicalId, resourceType)} ` + updatePartialMessage(shownPartial));
+		this.logger.warn(safeMsg`${updatePrefix}${formatResourceLine("updated", logicalId, resourceType)} ` + safeMsg`${updatePartialMessage(shownPartial)}`);
 		if (updatePartial !== void 0) return { updatePartial };
 		return;
 	}
-	this.logger.info(`${updatePrefix}${formatResourceLine("updated", logicalId, resourceType)}`);
+	this.logger.info(safeMsg`${updatePrefix}${formatResourceLine("updated", logicalId, resourceType)}`);
 }
 
 //#endregion
@@ -43169,10 +43764,10 @@ async function provisionDelete(logicalId, change, stateResources, stackName, tem
 	const existingState = stateResources[logicalId];
 	const renderer = getLiveRenderer();
 	const currentResource = existingState;
-	if (!currentResource) throw new Error(`Cannot delete ${logicalId}: resource not found in state`);
+	if (!currentResource) throw new Error(safeMsg`Cannot delete ${logicalId}: resource not found in state`);
 	const deletionPolicy = currentResource.deletionPolicy ?? template?.Resources?.[logicalId]?.DeletionPolicy;
 	if (shouldRetainResource(deletionPolicy)) {
-		this.logger.info(`Retaining ${logicalId} (${resourceType}) - DeletionPolicy: ${deletionPolicy}`);
+		this.logger.info(safeMsg`Retaining ${logicalId} (${resourceType}) - DeletionPolicy: ${deletionPolicy}`);
 		delete stateResources[logicalId];
 		await noteRetainedResource(resourceType, logicalId);
 		if (keptForReadoption(currentResource)) {
@@ -43244,7 +43839,7 @@ Drop the record with: ${dropCommand}`);
 		provisionedBy: currentResource.provisionedBy
 	});
 	const deleteProvider = deleteRoute.provider;
-	this.logger.debug(`Deleting ${logicalId} (${resourceType})`);
+	this.logger.debug(safeMsg`Deleting ${logicalId} (${resourceType})`);
 	let deleteResult = void 0;
 	const inlinePolicyClaimed = this.inlinePolicyClaimedFor(resourceType, logicalId, stateResources);
 	try {
@@ -43260,7 +43855,7 @@ Drop the record with: ${dropCommand}`);
 		}), logicalId, 3, 5e3, deleteProvider);
 	} catch (deleteError) {
 		const msg = deleteError instanceof Error ? deleteError.message : String(deleteError);
-		if (!isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && !isWaitAbandonedError(deleteError) && (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException"))) this.logger.debug(`Resource ${logicalId} already deleted (${msg}), removing from state`);
+		if (!isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && !isWaitAbandonedError(deleteError) && (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException"))) this.logger.debug(safeMsg`Resource ${logicalId} already deleted (${asIsMessage(msg)}), removing from state`);
 		else throw deleteError;
 	}
 	reportDeleteGuards(deleteResult, {
@@ -43273,7 +43868,7 @@ Drop the record with: ${dropCommand}`);
 		if (progress) progress.current++;
 		const skipPrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
 		renderer.removeTask(logicalId);
-		this.logger.info(`${skipPrefix}${formatResourceLine("skipped", logicalId, resourceType, `skipped (${deleteSkipped})`)}`);
+		this.logger.info(safeMsg`${skipPrefix}${formatResourceLine("skipped", logicalId, resourceType, `skipped (${deleteSkipped})`)}`);
 		const nested = resourceType === "AWS::CloudFormation::Stack";
 		const recordStack = nested ? nestedChildStackName(stackName, logicalId) : stackName;
 		const interrupted = nested && deleteSkipped.endsWith(" was interrupted");
@@ -43285,7 +43880,7 @@ Drop the record with: ${dropCommand}`);
 			hole: nested ? "child-stack" : "stack",
 			opts: { plainIdent: true }
 		};
-		this.logger.warn(deleteSkippedMessage(logicalId, currentResource.physicalId, deleteSkipped, "while removing it from the template") + ". Its cdkd state record was KEPT, so the next 'cdkd deploy' re-attempts the delete. Repair the record first (for a nested stack it is the CHILD's own state, whose other resources may already be gone), or delete the resource by hand and drop the record." + (interrupted ? " The commands name the child stack record. Its destroy was interrupted: re-run 'cdkd deploy' to resume it, and drop the child record only if that cannot finish, after deleting by hand what the child still holds (the inspect command with --show-nested lists every level; a child with nested stacks of its own has records under '<child>~<logicalId>' too, each needing the same drop)." : nested ? " The commands name the child stack record. Dropping it drops every record the child still has and nothing reaches those resources again, so first delete by hand what the child still holds (the inspect command with --show-nested lists every level; a child with nested stacks of its own has records under '<child>~<logicalId>' too, each needing the same drop). The next 'cdkd deploy' then removes this row." : " Keep '--resource' on the drop: without it the command drops the record of every resource in this still-deployed stack.") + (accountClause === "" ? "" : ` ${accountClause}`) + `\nInspect it with: ${pasteableCommand("cdkd state show", [
+		this.logger.warn(safeMsg`${deleteSkippedMessage(logicalId, currentResource.physicalId, deleteSkipped, "while removing it from the template")}` + ". Its cdkd state record was KEPT, so the next 'cdkd deploy' re-attempts the delete. Repair the record first (for a nested stack it is the CHILD's own state, whose other resources may already be gone), or delete the resource by hand and drop the record." + (interrupted ? " The commands name the child stack record. Its destroy was interrupted: re-run 'cdkd deploy' to resume it, and drop the child record only if that cannot finish, after deleting by hand what the child still holds (the inspect command with --show-nested lists every level; a child with nested stacks of its own has records under '<child>~<logicalId>' too, each needing the same drop)." : nested ? " The commands name the child stack record. Dropping it drops every record the child still has and nothing reaches those resources again, so first delete by hand what the child still holds (the inspect command with --show-nested lists every level; a child with nested stacks of its own has records under '<child>~<logicalId>' too, each needing the same drop). The next 'cdkd deploy' then removes this row." : " Keep '--resource' on the drop: without it the command drops the record of every resource in this still-deployed stack.") + (accountClause === "" ? "" : safeMsg` ${accountClause}`) + safeMsg`\nInspect it with: ${pasteableCommand("cdkd state show", [
 			stackArg,
 			{
 				flag: "--stack-region",
@@ -43293,7 +43888,7 @@ Drop the record with: ${dropCommand}`);
 				hole: "region"
 			},
 			...account
-		]).command}\nDrop the record with: ${pasteableCommand("cdkd state orphan", [
+		]).command}` + safeMsg`\nDrop the record with: ${pasteableCommand("cdkd state orphan", [
 			stackArg,
 			{
 				flag: "--stack-region",
@@ -43316,7 +43911,7 @@ Drop the record with: ${dropCommand}`);
 	if (progress) progress.current++;
 	const deletePrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
 	renderer.removeTask(logicalId);
-	this.logger.info(`${deletePrefix}${formatResourceLine("deleted", logicalId, resourceType)}`);
+	this.logger.info(safeMsg`${deletePrefix}${formatResourceLine("deleted", logicalId, resourceType)}`);
 }
 
 //#endregion
@@ -43384,6 +43979,8 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 						}
 					} else updatePartial = `${updatePartial}; ${replacedSkip}`;
 				}
+				const deferred = this.deferredReplacedDeletes?.get(logicalId);
+				if (deferred !== void 0 && updatePartial !== void 0) deferred.rowPartial = true;
 				nestedChildUnaddressed = unaddressed;
 			} finally {
 				for (const guard of deleteGuards.splice(0)) this.recordEvent({
@@ -43408,7 +44005,7 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 				if (current !== void 0) current.warnSuffix = warnSuffix;
 				renderer.updateTaskLabel(logicalId, `${current?.label ?? baseLabel}${warnSuffix}`);
 				renderer.printAbove(() => {
-					this.logger.warn(`${logicalId} (${resourceType}) has been ${operationKind === "CREATE" ? "creating" : operationKind === "DELETE" ? "deleting" : "updating"} for ${minutes}m — still waiting`);
+					this.logger.warn(safeMsg`${logicalId} (${resourceType}) has been ${operationKind === "CREATE" ? "creating" : operationKind === "DELETE" ? "deleting" : "updating"} for ${minutes}m — still waiting`);
 				});
 			},
 			onTimeout: (elapsedMs) => new ResourceTimeoutError(logicalId, resourceType, this.stackRegion, elapsedMs, operationKind, timeoutMs)
@@ -43456,7 +44053,9 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 	} catch (error) {
 		renderer.removeTask(logicalId);
 		const message = error instanceof Error ? error.message : String(error);
-		this.logger.error(this.maskForResource(logicalId, `Failed to ${change.changeType.toLowerCase()} ${logicalId}: ${message}`));
+		const shownMessage = this.maskForResource(logicalId, message);
+		const shownId = safeMsg`${logicalId}`;
+		this.logger.error(this.maskForResource(logicalId, `Failed to ${change.changeType.toLowerCase()} ${shownId}: ${shownMessage}`));
 		const orphanAdvice = this.orphanedNameCollisionAdvice(change.changeType, logicalId, error);
 		if (orphanAdvice) this.logger.error(this.maskForResource(logicalId, orphanAdvice));
 		this.recordEvent({
@@ -43469,7 +44068,7 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 			durationMs: Date.now() - resourceStartedAt,
 			error: extractDeploymentEventError(error)
 		});
-		throw new ProvisioningError(`Failed to ${change.changeType.toLowerCase()} resource ${logicalId}`, resourceType, logicalId, stateResources[logicalId]?.physicalId, error instanceof Error ? maskSecretsInError(error, this.printingSecretsFor(logicalId) ?? EMPTY_SECRETS) : void 0);
+		throw new ProvisioningError(safeMsg`Failed to ${change.changeType.toLowerCase()} resource ${logicalId}`, resourceType, logicalId, stateResources[logicalId]?.physicalId, error instanceof Error ? maskSecretsInError(error, this.printingSecretsFor(logicalId) ?? EMPTY_SECRETS) : void 0);
 	} finally {
 		renderer.removeTask(logicalId);
 	}
@@ -43649,9 +44248,9 @@ async function executeDeployment(template, currentState, changes, dag, execution
 					migrateLegacy: migrate
 				});
 				if (migrate) pendingMigration = false;
-				this.logger.debug(`State saved after ${logicalId}`);
+				this.logger.debug(safeMsg`State saved after ${logicalId}`);
 			} catch (error) {
-				this.logger.warn(`Failed to save state after ${logicalId}: ${error instanceof Error ? error.message : String(error)}`);
+				this.logger.warn(safeMsg`Failed to save state after ${logicalId}: ${asIsMessage(error instanceof Error ? error.message : String(error))}`);
 			}
 		});
 	};
@@ -43660,6 +44259,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 	const settledUpdates = /* @__PURE__ */ new Set();
 	const inFlightWrites = /* @__PURE__ */ new Map();
 	this.stackRecordsView = deployStackRecordsView(newResources, currentState.resources, deleteChanges, (logicalId) => startedUpdates.has(logicalId) && !settledUpdates.has(logicalId), () => [...inFlightWrites.values()].map(({ write }) => write));
+	this.deferredReplacedDeletes = /* @__PURE__ */ new Map();
 	try {
 		const createUpdateIds = [];
 		for (const [id, change] of changes.entries()) {
@@ -43668,7 +44268,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			createUpdateIds.push(id);
 		}
 		if (createUpdateIds.length > 0) {
-			this.logger.info(`${cyan("Deploying")} ${cyan(createUpdateIds.length)} resource(s) (DAG: ${executionLevels.length} levels, max parallel: ${concurrency})`);
+			this.logger.info(safeMsg`${cyan("Deploying")} ${cyan(createUpdateIds.length)} resource(s) (DAG: ${executionLevels.length} levels, max parallel: ${concurrency})`);
 			const createUpdateExecutor = new DagExecutor();
 			const provisionable = new Set(createUpdateIds);
 			const createUpdateDeps = /* @__PURE__ */ new Map();
@@ -43837,7 +44437,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			if (this.interrupted && this.hasPending(createUpdateExecutor)) throw new InterruptedError(this.interruptCause ?? "user");
 		}
 		if (deleteChanges.size > 0) {
-			this.logger.info(`${red("Deleting")} ${red(deleteChanges.size)} resource(s)`);
+			this.logger.info(safeMsg`${red("Deleting")} ${red(deleteChanges.size)} resource(s)`);
 			const deleteDeps = this.buildDeletionDependencies(deleteChanges, currentState);
 			const deleteExecutor = new DagExecutor();
 			for (const id of deleteChanges) deleteExecutor.add({
@@ -43882,7 +44482,10 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			}
 			if (this.interrupted && this.hasPending(deleteExecutor)) throw new InterruptedError(this.interruptCause ?? "user");
 		}
+		if (this.interrupted) this.warnUnretriedReplacedDeletes("interrupted");
+		else await this.retryDeferredReplacedDeletes(stackName, actualCounts);
 	} catch (error) {
+		this.warnUnretriedReplacedDeletes(this.interruptCause === "user" ? "interrupted" : "failed");
 		const initialDeploy = currentEtag === void 0;
 		const written = /* @__PURE__ */ new Set([...this.restoredLostChildren, ...completedOperations.map((op) => op.logicalId)]);
 		for (const logicalId of this.updatesThatSentNothing) written.delete(logicalId);
@@ -43958,7 +44561,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			if (migrate) pendingMigration = false;
 			this.logger.debug("Partial state saved before rollback (orphaned resource tracking)");
 		} catch (saveError) {
-			this.logger.warn(`Failed to save partial state before rollback: ${saveError instanceof Error ? saveError.message : String(saveError)}`);
+			this.logger.warn(safeMsg`Failed to save partial state before rollback: ${asIsMessage(saveError instanceof Error ? saveError.message : String(saveError))}`);
 		}
 		let autoRollbackClean = false;
 		let autoRollbackJournaled = false;
@@ -43967,7 +44570,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 		let rollbackRemainingFailedOps = failedOperations;
 		if (error instanceof InterruptedError || isInterruptedWaitError(error) || this.interruptCause === "user") {
 			await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "interrupted", initialDeploy);
-			this.logger.info(`Partial state saved (${Object.keys(newResources).length} resources). Run deploy again to resume, 'cdkd rollback' to revert, or destroy to clean up.`);
+			this.logger.info(safeMsg`Partial state saved (${Object.keys(newResources).length} resources). ` + "Run deploy again to resume, 'cdkd rollback' to revert, or destroy to clean up.");
 			throw error;
 		}
 		if (this.options.noRollback) {
@@ -44006,7 +44609,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			this.logger.debug("State saved after deployment failure");
 			if (autoRollbackClean) await this.settleNestedChildrenAfterCleanRollback(stackName, rollbackSettledNested, await this.settleJournalAfterCleanRollback(stackName, rollbackRemainingFailedOps, initialDeploy));
 		} catch (saveError) {
-			this.logger.debug(`Retrying state save after rollback (ETag mismatch): ${saveError instanceof Error ? saveError.message : String(saveError)}`);
+			this.logger.debug(safeMsg`Retrying state save after rollback (ETag mismatch): ${asIsMessage(saveError instanceof Error ? saveError.message : String(saveError))}`);
 			try {
 				const freshEtag = (await this.stateBackend.getState(stackName, this.stackRegion))?.etag;
 				const postRollbackState = {
@@ -44025,7 +44628,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 				this.logger.debug("State saved after deployment failure (retry succeeded)");
 				if (autoRollbackClean) await this.settleNestedChildrenAfterCleanRollback(stackName, rollbackSettledNested, await this.settleJournalAfterCleanRollback(stackName, rollbackRemainingFailedOps, initialDeploy));
 			} catch (retryError) {
-				this.logger.warn(`Failed to save state after rollback: ${retryError instanceof Error ? retryError.message : String(retryError)}`);
+				this.logger.warn(safeMsg`Failed to save state after rollback: ${asIsMessage(retryError instanceof Error ? retryError.message : String(retryError))}`);
 			}
 		}
 		throw error;
@@ -44080,13 +44683,13 @@ async function persistStateAfterOutputFailure(stackName, currentState, newResour
 		});
 		this.logger.debug("State saved after output resolution failure");
 	} catch (saveError) {
-		this.logger.debug(`Retrying state save after output resolution failure (ETag mismatch): ${saveError instanceof Error ? saveError.message : String(saveError)}`);
+		this.logger.debug(safeMsg`Retrying state save after output resolution failure (ETag mismatch): ${asIsMessage(saveError instanceof Error ? saveError.message : String(saveError))}`);
 		try {
 			const freshEtag = (await this.stateBackend.getState(stackName, this.stackRegion))?.etag;
 			await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(buildState()), { ...freshEtag !== void 0 && { expectedEtag: freshEtag } });
 			this.logger.debug("State saved after output resolution failure (retry succeeded)");
 		} catch (retryError) {
-			this.logger.warn(`Failed to save state after output resolution failure: ${retryError instanceof Error ? retryError.message : String(retryError)} — resources were provisioned but not recorded; run deploy again to reconcile.`);
+			this.logger.warn(safeMsg`Failed to save state after output resolution failure: ${asIsMessage(retryError instanceof Error ? retryError.message : String(retryError))} — resources were provisioned but not recorded; run deploy again to reconcile.`);
 		}
 	}
 }
@@ -44924,18 +45527,18 @@ function conditionInputsFrom(args) {
 	};
 }
 const FINGERPRINT_LAYOUT = 1;
-function isPlainObject(value) {
+function isPlainObject$1(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function canonicalJson(value) {
 	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
-	if (isPlainObject(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+	if (isPlainObject$1(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
 	const encoded = JSON.stringify(value);
 	return encoded === void 0 ? "undefined" : encoded;
 }
 function walkModelledDefinition(value, declaredParameters, parameters, conditions) {
 	if (typeof value === "string") return !carriesDynamicReference(value);
-	if (!isPlainObject(value)) return false;
+	if (!isPlainObject$1(value)) return false;
 	const keys = Object.keys(value);
 	if (keys.length !== 1) return false;
 	const [key] = keys;
@@ -44958,8 +45561,8 @@ function walkModelledDefinition(value, declaredParameters, parameters, condition
 }
 function conditionFingerprint(template, name, inputOf) {
 	const definitions = template.Conditions;
-	if (!isPlainObject(definitions)) return void 0;
-	const declared = isPlainObject(template.Parameters) ? template.Parameters : {};
+	if (!isPlainObject$1(definitions)) return void 0;
+	const declared = isPlainObject$1(template.Parameters) ? template.Parameters : {};
 	const declaredNames = new Set(Object.keys(declared));
 	const closure = nullPrototypeRecord();
 	const parameters = /* @__PURE__ */ new Set();
@@ -44981,7 +45584,7 @@ function conditionFingerprint(template, name, inputOf) {
 	let hasToken = false;
 	for (const parameter of parameters) {
 		const definition = declared[parameter];
-		const type = isPlainObject(definition) ? definition["Type"] : void 0;
+		const type = isPlainObject$1(definition) ? definition["Type"] : void 0;
 		if (typeof type !== "string") return void 0;
 		const input = inputOf(parameter);
 		if (input === void 0) return void 0;
@@ -45012,7 +45615,7 @@ function collectIfConditionNames(value, names, conditions) {
 		for (const element of value) collectIfConditionNames(element, names, conditions);
 		return;
 	}
-	if (!isPlainObject(value)) return;
+	if (!isPlainObject$1(value)) return;
 	const ifArgs = value["Fn::If"];
 	if (Array.isArray(ifArgs) && typeof ifArgs[0] === "string") {
 		names.add(ifArgs[0]);
@@ -45026,9 +45629,9 @@ function collectIfConditionNames(value, names, conditions) {
 function conditionsReadByDiff(template, conditions) {
 	const names = /* @__PURE__ */ new Set();
 	for (const section of [template.Resources, template.Outputs]) {
-		if (!isPlainObject(section)) continue;
+		if (!isPlainObject$1(section)) continue;
 		for (const entry of Object.values(section)) {
-			if (!isPlainObject(entry)) continue;
+			if (!isPlainObject$1(entry)) continue;
 			const gate = entry["Condition"];
 			if (typeof gate === "string") {
 				names.add(gate);
@@ -45060,10 +45663,10 @@ function buildConditionVerdictRecord(template, conditions, inputOf) {
 function readRecordedConditionVerdicts(state) {
 	const read = nullPrototypeRecord();
 	const field = state?.conditionVerdicts;
-	if (!isPlainObject(field)) return read;
+	if (!isPlainObject$1(field)) return read;
 	for (const name of Object.keys(field)) {
 		const entry = field[name];
-		if (isPlainObject(entry) && typeof entry["verdict"] === "boolean" && typeof entry["fingerprint"] === "string") read[name] = {
+		if (isPlainObject$1(entry) && typeof entry["verdict"] === "boolean" && typeof entry["fingerprint"] === "string") read[name] = {
 			verdict: entry["verdict"],
 			fingerprint: entry["fingerprint"]
 		};
@@ -45106,11 +45709,11 @@ function deployConditionInputs(parameterValues, inheritedSecrets, shadowedBy = /
 function parentSuppliedValues(template, supplied, tokens) {
 	const names = /* @__PURE__ */ new Set();
 	if (supplied === void 0) return names;
-	const declared = isPlainObject(template.Parameters) ? template.Parameters : {};
+	const declared = isPlainObject$1(template.Parameters) ? template.Parameters : {};
 	for (const [name, value] of Object.entries(supplied)) {
 		if (tokens.has(name)) continue;
 		const definition = declared[name];
-		const fallback = isPlainObject(definition) ? definition["Default"] : void 0;
+		const fallback = isPlainObject$1(definition) ? definition["Default"] : void 0;
 		if (fallback === void 0 || String(fallback) !== String(value)) names.add(name);
 	}
 	return names;
@@ -45334,12 +45937,73 @@ function promoteRecreateTargets(changes, recreateTargets, stackName) {
 	};
 }
 
+//#endregion
+//#region src/deployment/read-provenance-sources.ts
+function isPlainObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function crossStackNodes(value, into = []) {
+	if (Array.isArray(value)) {
+		for (const item of value) crossStackNodes(item, into);
+		return into;
+	}
+	if (!isPlainObject(value)) return into;
+	const keys = Object.keys(value);
+	if (keys.length === 1 && (keys[0] === "Fn::ImportValue" || keys[0] === "Fn::GetStackOutput")) into.push(value);
+	for (const item of Object.values(value)) crossStackNodes(item, into);
+	return into;
+}
+function crossStackOutputProvenanceSource(reads, scope, stateBackend) {
+	return async (value) => {
+		const out = [];
+		for (const node of crossStackNodes(value)) {
+			const key = crossStackSourceKey(node);
+			if (key === void 0) continue;
+			const read = reads.get(key);
+			if (read === void 0 || !read.carriesToken) continue;
+			const state = await readProducerStateOnce(scope, stateBackend, read.stackName, read.region, () => void 0, read.state);
+			const bag = outputReferenceProvenanceOf(state, read.outputKey);
+			if (bag !== void 0) out.push(bag);
+		}
+		return out;
+	};
+}
+function inheritedProvenanceForChildDiff(args) {
+	const { row, rowRecord, parentRecords, parentTemplate } = args;
+	if (!args.rowProvisioned || rowRecord === void 0) return void 0;
+	const recordedParameters = isPlainObject(rowRecord.properties) ? rowRecord.properties["Parameters"] : void 0;
+	const tokens = referenceTokensIn(recordedParameters);
+	if (tokens.size === 0) return void 0;
+	const own = referenceProvenanceOf(rowRecord);
+	const upstreams = [...new TemplateParser().extractReferences(isPlainObject(row.Properties) ? row.Properties["Parameters"] : void 0)].filter((id) => Object.hasOwn(parentTemplate.Resources, id) && Object.hasOwn(parentRecords, id));
+	const out = /* @__PURE__ */ new Map();
+	for (const token of tokens) {
+		const versions = /* @__PURE__ */ new Set();
+		let region;
+		for (const id of upstreams) {
+			const entry = recordedProvenanceOf(parentRecords[id], token);
+			for (const version of entry?.versions ?? []) versions.add(version);
+			region ??= entry?.region;
+		}
+		if (versions.size > 0) {
+			out.set(token, {
+				...region !== void 0 && { region },
+				versions: [...versions].sort()
+			});
+			continue;
+		}
+		const recorded = own !== void 0 && Object.hasOwn(own, token) ? own[token] : void 0;
+		if (recorded !== void 0) out.set(token, recorded);
+	}
+	return out.size === 0 ? void 0 : out;
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/deploy-flow.ts
 const TAIL_WARM_CONNECTIONS = 3;
 async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 	const startTime = Date.now();
-	this.logger.debug(`Starting deployment for stack: ${stackName}`);
+	this.logger.debug(safeMsg`Starting deployment for stack: ${displayStackName(stackName)}`);
 	const renderer = getLiveRenderer();
 	this.interrupted = false;
 	this.interruptCause = null;
@@ -45385,7 +46049,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		refuseMalformedOrphanRecords(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
 		this.provenanceBaseline = provenanceBaselineOf(currentState, isKnownTokenFreeState(currentStateData?.state));
 		const migrationPending = currentStateData?.migrationPending ?? false;
-		this.logger.debug(`Loaded current state: ${Object.keys(currentState.resources).length} resources`);
+		this.logger.debug(safeMsg`Loaded current state: ${Object.keys(currentState.resources).length} resources`);
 		if (this.options.onCurrentStateLoaded) {
 			const gate = this.options.onCurrentStateLoaded(stackName, currentStateData?.state);
 			if (currentStateData === null || currentStateData === void 0) {
@@ -45411,10 +46075,10 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			};
 			if (journal && journal.segments.length > 0) {
 				const failedOnly = journal.segments.every((s) => s.operations.length === 0) && journal.segments.some((s) => (s.failedOperations?.length ?? 0) > 0);
-				this.logger.info(failedOnly ? `A previous deploy of ${displayStackName(stackName)} failed and was automatically rolled back. The failed resource may be partially applied — revert it, or continue deploying to fix forward (${this.options.parentStackInfo ? "a successful deploy of the top-level stack clears this note" : "a successful deploy clears this note"}).\nRevert it with: ${pasteableCommand("cdkd rollback", [{
+				this.logger.info(failedOnly ? safeMsg`A previous deploy of ${displayStackName(stackName)} failed and was automatically rolled back. ` + `The failed resource may be partially applied — revert it, or continue ` + safeMsg`deploying to fix forward (${this.options.parentStackInfo ? "a successful deploy of the top-level stack clears this note" : "a successful deploy clears this note"}).` + safeMsg`\nRevert it with: ${pasteableCommand("cdkd rollback", [{
 					value: stackName,
 					hole: "stack"
-				}, { literal: "--revert-failed" }]).command}` : `A previous deploy of ${displayStackName(stackName)} failed or was interrupted. Revert it, or continue deploying to fix forward.\nRevert it with: ${pasteableCommand("cdkd rollback", [{
+				}, { literal: "--revert-failed" }]).command}` : safeMsg`A previous deploy of ${displayStackName(stackName)} failed or was interrupted. Revert it, ` + `or continue deploying to fix forward.` + safeMsg`\nRevert it with: ${pasteableCommand("cdkd rollback", [{
 					value: stackName,
 					hole: "stack"
 				}]).command}`);
@@ -45422,13 +46086,13 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		} catch {}
 		this.stampReasonlessParameterRefusals(currentState.resources, template);
 		this.kickOffAutoRefreshObservedProperties(currentState.resources, currentState);
-		this.logger.debug(`Template has ${Object.keys(template.Resources || {}).length} resources`);
+		this.logger.debug(safeMsg`Template has ${Object.keys(template.Resources || {}).length} resources`);
 		const outputsDigestSource = structuredClone({
 			...template,
 			Resources: {}
 		});
 		const parameterValues = await this.resolver.resolveParameters(template, this.options.parameters, { ...this.options.inheritedSecrets && hasMaskableValues(this.options.inheritedSecrets) && { inheritedSecrets: this.options.inheritedSecrets } });
-		this.logger.debug(`Resolved ${Object.keys(parameterValues).length} parameters: ${Object.keys(parameterValues).join(", ")}`);
+		this.logger.debug(safeMsg`Resolved ${Object.keys(parameterValues).length} parameters: ${Object.keys(parameterValues).join(", ")}`);
 		poisonRenderedSpellingsCollidingIn(template, parameterValues, this.options.inheritedSecrets);
 		this.inheritedNoEchoParameters = /* @__PURE__ */ new Set([...this.freshNoEchoParameters(parameterValues) ?? [], ...this.options.passedNoEchoParameters ?? []]);
 		const backfillNoEchoValues = noEchoParameterValueSeed(template.Parameters, parameterValues, this.options.inheritedSecrets, this.options.parameters);
@@ -45448,7 +46112,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			parameters: parameterValues
 		}, stackName);
 		const conditions = await this.resolver.evaluateConditions(context);
-		this.logger.debug(`Evaluated ${Object.keys(conditions).length} conditions: ${Object.keys(conditions).join(", ")}`);
+		this.logger.debug(safeMsg`Evaluated ${Object.keys(conditions).length} conditions: ${Object.keys(conditions).join(", ")}`);
 		refuseNoValueOutputs(template.Outputs, conditions);
 		let conditionVerdicts;
 		if (conditionsReadByDiff(template, conditions).size > 0) {
@@ -45486,7 +46150,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		this.logger.debug(`All resource properties validated`);
 		const dag = this.dagBuilder.buildGraph(effectiveTemplate);
 		const executionLevels = this.dagBuilder.getExecutionLevels(dag);
-		this.logger.debug(`Dependency graph: ${executionLevels.length} execution levels`);
+		this.logger.debug(safeMsg`Dependency graph: ${executionLevels.length} execution levels`);
 		const diffResolverContext = this.buildResolverContext({
 			template: effectiveTemplate,
 			resources: currentState.resources,
@@ -45495,13 +46159,18 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		}, stackName);
 		diffResolverContext.bestEffort = true;
 		diffResolverContext.skipDynamicReferences = true;
+		const crossStackReads = /* @__PURE__ */ new Map();
+		diffResolverContext.crossStackReads = crossStackReads;
 		const diffResolveFn = (value) => this.resolver.resolve(value, diffResolverContext);
 		const maskedInputSourcesForDiff = this.maskedInputSources(effectiveTemplate, currentState.resources, conditions, stackName);
 		const maskedInputs = maskedInputSourcesForDiff && {
 			sources: maskedInputSourcesForDiff,
 			rebaselined: /* @__PURE__ */ new Map()
 		};
-		const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry), this.providerRegistry.getAllowedUnsupportedProperties?.(), freshNoEchoParametersWithDeclared(this.inheritedNoEchoParameters, effectiveTemplate), this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues, currentState.resources), recreateTargetIdsFor(this.options.recreateTargets, stackName), maskedInputs, this.options.refusalRecovery, this.noEchoDiffComparison(currentState.resources, effectiveTemplate, conditions, parameterValues, stackName));
+		const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry), this.providerRegistry.getAllowedUnsupportedProperties?.(), freshNoEchoParametersWithDeclared(this.inheritedNoEchoParameters, effectiveTemplate), this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues, currentState.resources), recreateTargetIdsFor(this.options.recreateTargets, stackName), maskedInputs, this.options.refusalRecovery, this.noEchoDiffComparison(currentState.resources, effectiveTemplate, conditions, parameterValues, stackName), {
+			...this.options.inheritedReferenceProvenance && { inherited: this.options.inheritedReferenceProvenance },
+			crossStackOutputs: crossStackOutputProvenanceSource(crossStackReads, this.recordedImports, this.stateBackend)
+		});
 		createOnlyPrefetch.cancel();
 		for (const [logicalId, fingerprints] of maskedInputs?.rebaselined ?? []) {
 			const record = currentState.resources[logicalId];
@@ -45581,8 +46250,8 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 				const outputsChanged = !outputMapsEqual(persistedOutputs, outputsToPersist);
 				const persistExportSet = new Set(exportNamesToPersist ?? []);
 				const exportSetChanged = exportNamesToPersist !== void 0 && (currentEffectiveExports.size !== persistExportSet.size || [...persistExportSet].some((k) => !currentEffectiveExports.has(k)));
-				if (merge?.kind === "kept" && !outputMapsEqual(persistedOutputs, resolvedOutputs)) this.logger.warn(`Outputs changed but one or more could not be resolved; keeping the previously persisted outputs. ${keptWholeReasonText(merge.reason)} A downstream Fn::ImportValue may fail until the next deploy.`);
-				else if (merge?.kind === "merged" && merge.carriedKeys.length > 0) this.logger.debug(`Kept the previously persisted value of ${merge.carriedKeys.length} output key(s), carried export aliases included, that could not be resolved (no-change path)`);
+				if (merge?.kind === "kept" && !outputMapsEqual(persistedOutputs, resolvedOutputs)) this.logger.warn(safeMsg`Outputs changed but one or more could not be resolved; keeping the previously persisted outputs. ${keptWholeReasonText(merge.reason)} ` + "A downstream Fn::ImportValue may fail until the next deploy.");
+				else if (merge?.kind === "merged" && merge.carriedKeys.length > 0) this.logger.debug(safeMsg`Kept the previously persisted value of ${merge.carriedKeys.length} output key(s), ` + "carried export aliases included, that could not be resolved (no-change path)");
 				const skippedOutputsChanged = !skippedOutputsEqual(currentState.skippedOutputs, this.skippedOutputs);
 				const healedAttributesPending = this.hasUnpersistedHeals(currentState.resources);
 				const conditionVerdictsChanged = !conditionVerdictRecordsEqual(readRecordedConditionVerdicts(currentState), conditionVerdicts);
@@ -45621,7 +46290,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 					else if (healedAttributesPending) this.logger.debug("Persisted attributes re-read from AWS for a stale record (no-change path)");
 					else this.logger.debug("Persisted skipped-outputs record (no outputs-value diff, no-change path)");
 				} catch (saveError) {
-					this.logger.warn(`Failed to persist no-change state update: ${saveError instanceof Error ? saveError.message : String(saveError)} — drift baseline / outputs will be re-resolved on next deploy.`);
+					this.logger.warn(safeMsg`Failed to persist no-change state update: ${asIsMessage(saveError instanceof Error ? saveError.message : String(saveError))} — drift baseline / outputs will be re-resolved on next deploy.`);
 				}
 			}
 			return {
@@ -45640,7 +46309,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		const createChanges = this.diffCalculator.filterByType(changes, "CREATE");
 		const updateChanges = this.diffCalculator.filterByType(changes, "UPDATE");
 		const deleteChanges = this.diffCalculator.filterByType(changes, "DELETE");
-		this.logger.info(`Changes: ${green(createChanges.length)} to create, ${yellow(updateChanges.length)} to update, ${red(deleteChanges.length)} to delete`);
+		this.logger.info(safeMsg`Changes: ${green(createChanges.length)} to create, ${yellow(updateChanges.length)} to update, ${red(deleteChanges.length)} to delete`);
 		if (this.options.dryRun) {
 			this.logger.info("Dry run mode - skipping actual deployment");
 			return {
@@ -45719,7 +46388,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			...newState,
 			conditionVerdicts
 		} : newState)), flushKeptForReadoption(this)]);
-		this.logger.debug(`State saved (ETag: ${newEtag})`);
+		this.logger.debug(safeMsg`State saved (ETag: ${newEtag})`);
 		const ledgerAndKeptCleanup = (async () => {
 			await forgetRecordedCreateTokens(Object.keys(newState.resources));
 			const readopted = await this.generatedNameGuard?.readoptedFromRetained() ?? [];
@@ -45780,7 +46449,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			await this.lockManager.releaseLock(stackName, this.stackRegion);
 			this.logger.debug("Lock released");
 		} catch (lockError) {
-			this.logger.warn(`Failed to release lock: ${lockError instanceof Error ? lockError.message : String(lockError)}`);
+			this.logger.warn(safeMsg`Failed to release lock: ${asIsMessage(lockError instanceof Error ? lockError.message : String(lockError))}`);
 		}
 	}
 }
@@ -45935,7 +46604,7 @@ function addImplicitDeleteDependencies(deleteIds, state, dependedBy) {
 				if (!dependedBy.has(id)) dependedBy.set(id, /* @__PURE__ */ new Set());
 				if (!dependedBy.get(id).has(depId)) {
 					dependedBy.get(id).add(depId);
-					this.logger.debug(`Implicit delete dependency: ${depId} (${depType}) must be deleted before ${id} (${resource.resourceType})`);
+					this.logger.debug(safeMsg`Implicit delete dependency: ${depId} (${depType}) must be deleted before ${id} (${resource.resourceType})`);
 				}
 			}
 		}
@@ -45949,7 +46618,7 @@ function addImplicitDeleteDependencies(deleteIds, state, dependedBy) {
 		if (!dependedBy.has(after)) dependedBy.set(after, /* @__PURE__ */ new Set());
 		if (!dependedBy.get(after).has(before)) {
 			dependedBy.get(after).add(before);
-			this.logger.debug(`Implicit delete dependency: ${before} (${scoped[before]?.resourceType}) must be deleted before ${after} (${scoped[after]?.resourceType})`);
+			this.logger.debug(safeMsg`Implicit delete dependency: ${before} (${scoped[before]?.resourceType}) must be deleted before ${after} (${scoped[after]?.resourceType})`);
 		}
 	}
 }
@@ -46014,6 +46683,7 @@ var DeployEngine = class {
 	noEchoExactEchoes = /* @__PURE__ */ new Map();
 	noEchoAttributeReads = /* @__PURE__ */ new Map();
 	replacedDeleteSkips = /* @__PURE__ */ new Map();
+	deferredReplacedDeletes = void 0;
 	secretNameNeedles = /* @__PURE__ */ new Map();
 	perResourceTemplateProps = /* @__PURE__ */ new Map();
 	perResourceResolvedType = /* @__PURE__ */ new Map();
@@ -46091,6 +46761,7 @@ var DeployEngine = class {
 		this.noEchoExactEchoes = /* @__PURE__ */ new Map();
 		this.noEchoAttributeReads = /* @__PURE__ */ new Map();
 		this.replacedDeleteSkips = /* @__PURE__ */ new Map();
+		this.deferredReplacedDeletes = void 0;
 		this.secretNameNeedles = /* @__PURE__ */ new Map();
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
 		this.constructPathTemplate = void 0;
@@ -46327,6 +46998,8 @@ DeployEngine.prototype.typeChangeNameQuestion = typeChangeNameQuestion;
 DeployEngine.prototype.checkedReplacementNameChange = checkedReplacementNameChange;
 DeployEngine.prototype.createFirstThenDeleteOld = createFirstThenDeleteOld;
 DeployEngine.prototype.deleteReplacedAfterCreate = deleteReplacedAfterCreate;
+DeployEngine.prototype.retryDeferredReplacedDeletes = retryDeferredReplacedDeletes;
+DeployEngine.prototype.warnUnretriedReplacedDeletes = warnUnretriedReplacedDeletes;
 DeployEngine.prototype.diffLogMasker = diffLogMasker;
 DeployEngine.prototype.freshNoEchoParameters = freshNoEchoParameters;
 DeployEngine.prototype.redactParametersForDiff = redactParametersForDiff;
@@ -46380,5 +47053,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { isTruthyCfnBoolean as $, NO_CC_HANDLERS_REASON as $a, resolveApp as $c, malformedLocalResourceEntriesWarning as $i, ledgerForStack as $n, shareLogOnlyValues as $o, sendableAssumeRoleCommand as $r, hasUnverifiableParameterRefusal as $s, seedsDeleteFirstGuard as $t, noEchoComparisonForTemplate as A, refuseMalformedResourceEntriesForOrphan as Aa, dockerSpawnEnvWithSensitive as Ac, refStateLookupFromResource as Ai, displayAssemblyPath as Al, journaledOrphanPrintingBag as An, TemplateParser as Ao, deleteIndeterminateGuards as Ar, wholeStringLeavesOf as As, dropFailedHint as At, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as B, repairMalformedOrphansForReadOnly as Ba, runDockerForeground as Bc, UNREADABLE_RESOURCES_MAP_ROW as Bi, PRE_DELETE_SNAPSHOT_TYPES as Bn, passedNoEchoParametersOf as Bo, reDisableInstanceApiTermination as Br, rebuildClientForBucketRegion as Bs, getStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedOutputsForDestroy as Ca, validateContainerRepoName as Cc, carriesDynamicReference as Ci, defineOwnKey as Cl, collectDeclaredOutputNames as Cn, templateResourceTypes as Co, applyCustomResourceResponseExpiration as Cr, carriesSecretMask as Cs, revertNestedChildFromJournal as Ct, withResourceDeadline as D, refuseMalformedResourceEntriesForDestroy as Da, describeDockerCapturedOutput as Dc, AWS_NO_VALUE as Di, ownValue as Dl, DEFAULT_RESOURCE_TIMEOUT_MS as Dn, lambdaFunctionNameForMask as Do, unchangedBehindSecretReference as Dr, recordNoEchoAttributeValues as Ds, getCurrentNestedStackContext as Dt, serviceTokenBlockingReason as E, refuseMalformedResourceEntriesForDeploy as Ea, resolveDockerContextDirectory as Ec, keepsSecretReferenceToken as Ei, nullPrototypeRecord as El, bindingSkippedOutputs as En, canonicalLambdaFunctionName as Eo, slowCcOperationTimeoutMs as Er, recordMaskOnlyValuesIn as Es, collectNestedChildUnaddressed as Et, PROTECTION_PROPERTY_BY_TYPE as F, refuseMalformedResourcesForDeploy as Fa, isMalformedEnvKey as Fc, declaresNoEcho as Fi, clearBucketRegionCache as Fl, secretNamedRecordNeedles as Fn, maskWholeValue as Fo, markWaitAbandoned as Fr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Fs, sameJournaledOrphans as Ft, resolveDynamoDbDeleteBudgetMs as G, unpreviewableOrphanRecords as Ga, stripForDisplay as Gc, hasReadableOutputs as Gi, isFinalSnapshotError as Gn, carryLogOnlyValues as Go, poisonRenderedSpellingsCollidingIn as Gr, isAccessDenied$1 as Gs, isJournaledOrphan as Gt, compensateRemovedDeletionProtection as H, repairMalformedResourceEntriesForReadOnly as Ha, warnFinchArgvExposure as Hc, deployRefusesOrphanRowsReason as Hi, ccRoutedFinalSnapshotError as Hn, readsNoEchoSource as Ho, DiffCalculator as Hr, CrossPrefixScanCache as Hs, removeProtectionTypeList as Ht, isProtectionValueActive as I, refuseMalformedResourcesForDestroy as Ia, partitionSensitiveEnv as Ic, JSON_LISTING_HOLE_VALUE as Ii, resolveBucketRegion as Il, stateSecretNameNeedles as In, maskedLeafCoordinatesOf as Io, disableInstanceApiTermination as Ir, isSingleDynamicReferenceToken as Is, replayFailedOperations as It, deleteTableWithIndexBusyRetry as J, withheldAccountClause as Ja, Synthesizer as Jc, isReadableResourceEntry as Ji, maskingRetryLogger as Jn, literalSplitDelimitersOf as Jo, applyRoleArnIfSet as Jr, acceptedCreateOnlyDropsOf as Js, planRollback as Jt, DELETE_INDEX_WAIT_PROCEED_NOTE as K, unreadableOrphanRecords as Ka, AssetManifestLoader as Kc, hasReadableResources as Ki, refusesFinalSnapshot as Kn, createUnionSecretMasker as Ko, producerLookupOver as Kr, isNotImplemented as Ks, isReplacementOrphan as Kt, perType as L, refuseMalformedResourcesForExport as La, redactDockerArgvValues as Lc, STATE_REGION_DIVERGED as Li, storedSecretNameNeedles as Ln, noEchoCoordinatesOf as Lo, ec2InstanceProtectionSite as Lr, LockManager as Ls, replayRollback as Lt, noEchoParameterNamesOf as M, refuseMalformedResourcePropertiesForDrift as Ma, formatDockerLoginError as Mc, withSharedDrainBudget as Mi, resolveAssemblyPath as Ml, orphanRecordsPrintingBag as Mn, isMarkedCoordinate as Mo, deleteSkipReason as Mr, STATE_SOURCED_CROSS_GENERATION_RULES as Ms, journaledOrphanLines as Mt, recordedProtectionEvidence as N, refuseMalformedResourcePropertiesForExport as Na, getDockerCmd as Nc, parameterInputsFor as Ni, injectAwsRegion as Nl, secretNamePrintingBag as Nn, maskAtCoordinates as No, withIndeterminateGuard as Nr, STATE_SOURCED_READBACK_RULES as Ns, loadJournaledOrphans as Nt, diffSecurity as O, refuseMalformedResourceEntriesForImport as Oa, describeDockerExecFailure as Oc, cfnRefValueFromPhysicalId as Oi, absoluteAssemblyPathEscape as Ol, DEFAULT_RESOURCE_WARN_AFTER_MS as On, sameLambdaFunctionAddress as Oo, RollbackInlinePolicyWriters as Or, recordNoEchoParameterFreshValue as Os, withNestedStackContext as Ot, recordedProtectionNote as P, refuseMalformedResourcePropertiesForOrphan as Pa, isDockerClientEnvKey as Pc, passedParameterClassesOf as Pi, injectedAwsRegionValue as Pl, secretNamePrintingBags as Pn, maskReadbackAtCoordinates as Po, isWaitAbandonedError as Pr, TEMPLATE_SOURCED_RULES as Ps, makeForeignHolderScan as Pt, hasCdkAutoDeleteTag as Q, withoutSilentDropProperties as Qa, loadCdkJson as Qc, malformedLocalOutputsWarning as Qi, earliestDefined as Qn, recordLogOnlyValue as Qo, isIamRoleArn as Qr, hasReasonlessBaselineRefusal as Qs, resolveReplacementOldType as Qt, readProtection as R, refuseMalformedState as Ra, redactedCause as Rc, STATE_RESOURCES_MALFORMED as Ri, extractDeploymentEventError as Rn, noEchoLeavesOf as Ro, isTerminationProtectionPropagationError as Rr, isLockInfoExpired as Rs, awaitInFlightSibling as Rt, keptForReadoption as S, refuseMalformedOutputs as Sa, validateAssetBucketName as Sc, isImpossibleEmptyStoredAttribute as Si, processStackMessages as Sl, noEchoParameterValueSeed as Sn, prefetchCreateOnlyPropertyPaths as So, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Sr, splitGetAttStringForm as Ss, recordDisplacedSkips as St, findServiceTokenRefusals as T, refuseMalformedResourceEntries as Ta, buildDockerImage as Tc, isNamelessDynamicReferenceError as Ti, hasPlainPrototype$1 as Tl, isExportAliasCollision as Tn, withRetry as To, CloudControlProvider as Tr, recordMaskOnlyValue as Ts, withNestedRevertRun as Tt, deleteBudgetKey as U, repairMalformedResourcePropertiesForReadOnly as Ua, escapeRegExp$3 as Uc, displayLogicalId as Ui, createPreDeleteFinalSnapshot as Un, valueAtCoordinate as Uo, INTRINSIC_KEYS as Ur, applyCrossPrefixScan as Us, recordAfterRollbackUpdate as Ut, beginDeleteWait as V, repairMalformedOutputsForReadOnly as Va, runDockerStreaming as Vc, accountArgs as Vi, buildFinalSnapshotIdentifier as Vn, readbackPathFor as Vo, reEnableInstanceApiTermination as Vr, CrossPrefixReadError as Vs, withStackRecords as Vt, resolveDynamoDbDeleteBudgetClock as W, repairMalformedResourcesForReadOnly as Wa, stripControlChars as Wc, hasReadableOrphans as Wi, effectiveDeletionPolicy as Wn, liveMatchesUnresolvedTokenFrame as Wo, IntrinsicFunctionResolver as Wr, crossPrefixDeniedWarning as Ws, demoteSupersededOrphans as Wt, ECR_AUTO_DELETE_IMAGES_TAG as X, findSilentDropProperties as Xa, getDefaultStateBucketName as Xc, malformedExportNamesWarning as Xi, findDestructiveChanges as Xn, printingCorpusOf as Xo, assertSendableRoleArn as Xr, exportNamesCarriedFrom as Xs, recordUnderIdIsNotOwn as Xt, waitForIndexesSettled as Y, findActionableSilentDrops as Ya, synthesisStatusMessage as Yc, malformedDriftResourcePropertiesWarning as Yi, constructPathOf as Yn, logOnlyValueCount as Yo, assertFlagRoleArn as Yr, describeRegionValueKind as Ys, recheckFailedPlan as Yt, S3_AUTO_DELETE_OBJECTS_TAG as Z, unwrittenCreateOnlyReplacement as Za, getLegacyStateBucketName as Zc, malformedExportSourceWarning as Zi, formatDestructiveChange as Zn, recordLogOnlyParameterValue as Zo, explicitRoleArnOrThrow as Zr, hasReadableExportSet as Zs, replacementNeverSwapped as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedOrphanRecords as _a, ensureAssetStorage as _c, regionLessSecretName as _i, PARTITION_TABLE as _l, secretSafeKeyDisplay as _n, readConfigString as _o, TemplateNoEchoReresolver as _r, recordNestedStackParameterExpressions as _s, displacedOpClause as _t, findNestedTemplateTreeDefect as a, malformedOrphansWarning as aa, shouldRetainResource as ac, keepHeldTokenProvenance as ai, resolveUseCdkBootstrapAssets as al, isRedactedRecordedValue as an, isStatefulRecreateTargetSync as ao, planTagDiff as ar, recordReferenceProvenanceEntry as as, cyan as at, lookupEachName as b, refuseMalformedOrphansForDestroy as ba, parseBootstrapMarker as bc, parameterTypeMayLoseSecretIdentity as bi, AssemblyReader as bl, exportNameSecretExposure as bn, requireConfigObject as bo, getCurrentResourceSecrets as br, recordAttributeIdCopy as bs, getNestedRevertRun as bt, renderNestedTemplateTreeDefect as c, malformedRenderedContainersWarning as ca, stringifyValue as cc, recordedReferenceRegions as ci, ssmResolvedValueType as cl, updatePartialMessage as cn, coerceWarmThroughput as co, tagMapAsList as cr, scrubResourceRecord as cs, red as ct, conditionInputsFrom as d, malformedResourcesWarning as da, createAssetRedirectResolver as dc, s3BucketDualStackDomainName as di, MIGRATE_TMP_PREFIX as dl, DeploymentEventsStore as dn, toFiniteNumber as do, stringifyIfAssigned as dr, DYNAMIC_REFERENCE_TOKEN_SCAN as ds, namesAnyDeclaredParameter as dt, malformedLocalResourcesWarning as ea, importableOutputKeys as ec, AWS_CREDENTIAL_ENV_KEYS as ei, resolveAutoAssetStorage as el, orphanDeleteNeedsIdentity as en, hasNoCloudControlHandlers as eo, reserveStackCreateToken as er, createSecretMasker as es, getPriorAttempts as et, parentSuppliedValues as f, malformedScrubResourceEntriesRefusalMessage as fa, loadPublishableAssetManifest as fc, s3BucketRegionalDomainName as fi, findLargeInlineResources as fl, WITHHELD_NAME_DISPLAY as fn, coerceCfnBoolean as fo, CC_BROKEN_REASON as fr, dynamicReferenceTokens as fs, reachableDivergentParameters as ft, mergeNoChangeOutputs as g, refuseMalformedNestedChildOutputs as ga, assertAssetBucketRegion as gc, producerRegionsFromState as gi, expectedOwnerParam as gl, secretBearingStateKeyWarning as gn, configStringRefusal as go, wouldReturnToSdkProvider as gr, inheritNestedStackParameterAssociations as gs, NESTED_PENDING_PARENT_REASON as gt, keptWholeReasonText as h, refuseDivergentRecordRegionForDestroy as ha, BOOTSTRAP_MARKER_PREFIX as hc, classifyReplaySecretRegion as hi, decodeListingKey as hl, secretBearing as hn, configIntegerRefusal as ho, isCustomResource as hr, identityKeyFor as hs, planOrphanAdoption as ht, childTemplateLoader as i, malformedOrphansRefusalMessage as ia, orphansCarriedFrom as ic, isSettledInstanceState as ii, resolveStateBucketWithDefaultAndSource as il, REDACTED_DELETE_ADDRESS_SKIP_REASON as in, isStatefulRecreateTargetForReplace as io, DBPROXY_TAG_OPTIONS as ir, markSameGenerationBag as is, bold as it, noEchoExactEchoLeavesOf as j, refuseMalformedResourcePropertiesForDestroy as ja, finchSecretArgvRefusal as jc, parseWebACLArn as ji, renderAssemblyPathEscape as jl, maskEventTextWithBoundBags as jn, canonicalCoordinates as jo, deleteLeftInPlace as jr, STATE_SOURCED_BASELINE_RULES as js, isHandledOrphan as jt, noEchoAttributeNamesOf as k, refuseMalformedResourceEntriesForImportSave as ka, describeDockerFailure as kc, isStalePlaceholderArnAttribute as ki, describeFileReadFailure as kl, completedReplayEntries as kn, DagBuilder as ko, UNSPECIFIED_SKIP_REASON as kr, recordProvenPublicExpression as ks, deleteJournaledOrphans as kt, templateIdentity as l, malformedResourceEntriesWarning as la, WorkGraph as lc, s3BucketArn as li, CFN_TEMPLATE_BODY_LIMIT as ll, updatePartialReason as ln, isWarmThroughputDecrease as lo, tagPlanWarning as lr, withPhysicalNameCopies as ls, yellow as lt, isSecretBearingReferenceString as m, previewableOrphanRecords as ma, AssetModeResolver as mc, classifyRecordedSecretRegion as mi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ml, exportAliasCollisionScrubWarning as mn, configBooleanRefusal as mo, ccBrokenReason as mr, pathCrossesDottedKey as ms, makeSiblingClaimReader as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedOrphanRecordsWarning as na, isReadableBag as nc, callerEnvCredentials as ni, resolveSkipPrefix as nl, getCurrentProducerRegions as nn, shownType as no, acquireIdempotencyToken as nr, maskSecretsInError as ns, formatResourceLine as nt, isAbsoluteAssetPath as o, malformedOutputsRefusalMessage as oa, AssetPublisher as oc, outputReferenceProvenanceOf as oi, stateBucketExistenceConfirmed as ol, redactedDeleteAddressFields as on, renderStatefulReason as oo, readTagList as or, snapshotPassProvenance as os, gray as ot, readRecordedConditionVerdicts as p, malformedStateRefusalMessage as pa, rewriteTemplateAssetReferences as pc, s3BucketWebsiteUrl as pi, uploadCfnTemplate as pl, displayTextOrWithheld as pn, coerceCfnInteger as po, ProviderRegistry as pr, isUncertifiedBaselineMaskPosition as ps, resourcesNamingDeclaredParameter as pt, INDEX_SETTLE_POLL_INTERVAL_MS as q, unreadableResourceEntries as qa, getDockerImageBySourceHash as qc, isReadableOrphanRecord as qi, unsupportedFinalSnapshotError as qn, hasMaskableValues as qo, refuseUnreadableCdkCrossAccountRefs as qr, splitImportedOps as qs, planFailedOps as qt, computeImplicitDeleteEdges as r, malformedOrphanRowsKeptWarning as ra, orphansAfterRollback as rc, envCredentialsAreAssumedRole as ri, resolveStateBucketWithDefault as rl, inheritProducerRegions as rn, MULTI_REGION_RECREATE_BLOCKED_TYPES as ro, DBPROXY_TAGS_WHAT as rr, maskSecretsInText as rs, createReadOnlyAttributeHealerFactory as rt, listNestedTemplateRows as s, malformedOutputsWarning as sa, isSensitiveAttributeName as sc, recordedOutputReferenceRegions as si, warnDeprecatedNoPrefixCliFlag as sl, redactedDeleteAddressSkip as sn, WARM_THROUGHPUT_MEMBERS as so, refuseMalformedDesiredTags as sr, redactSecretsForState as ss, green as st, DeployEngine as t, malformedOrphanRecordsRefusalMessage as ta, importableOutputs as tc, applyCallerIdentityCredentials as ti, resolveCaptureObservedState as tl, findNestedStackTypeChanges as tn, findReplacedReadersOfRecreateTargets as to, withCreateTokenLedger as tr, errorCauseChain as ts, markRefusedBeforeApplying as tt, conditionFingerprint as u, malformedResourcePropertiesWarning as ua, buildAssetRedirectMap as uc, s3BucketDomainName as ui, CFN_TEMPLATE_URL_LIMIT as ul, DeploymentEventsReader as un, toCfnInteger as uo, definedAttributes as ur, withoutPhysicalNameCopies as us, computeParameterTaint as ut, chunks as v, refuseMalformedOrphanRecordsForDestroy as va, getBootstrapMarkerKey as vc, coerceParameterTypedValue as vi, canonicalizeRegion as vl, carriedExportAliasExposure as vn, replayWarn as vo, readsNoEchoDeleteValues as vr, recoverMaskedOutput as vs, displacedPhysicalIdShown as vt, deferredServiceTokenWarning as w, refuseMalformedResourceAttributesForOrphan as wa, buildDenyExternalAccessPolicy as wc, carriesFetchableDynamicReference as wi, hasOwnKey as wl, collectPublishedOutputNames as wn, describeTypeWithThrottleRetry as wo, customResourceResponseExpirationWarning as wr, provenPublicValue as ws, revertedNestedRowIds as wt, withApiLimit as x, refuseMalformedOrphansForOrphan as xa, readBootstrapMarkerBody as xc, getAccountInfo as xi, StageLoadError as xl, isWholeDynamicReferenceValue as xn, requireConfigString as xo, withPrintingSecrets as xr, recordPhysicalNameCopy as xs, nestedChildStackName as xt, isAccessDeniedError as y, refuseMalformedOrphans as ya, isCrossRegionRedirect as yc, isUnboundTemplateParameter as yi, derivePartitionAndUrlSuffix as yl, exportNameNoEchoParameters as yn, requireConfigArray as yo, isCustomResourceType as yr, physicalNameCopiesOf as ys, dropSettledNestedJournals as yt, DynamoDBGlobalTableProvider as z, repairMalformedOrphanRecordsForReadOnly as za, redactedDockerCause as zc, UNREADABLE_ORPHANS_CONTAINER_ROW as zi, ATOMIC_FINAL_SNAPSHOT_TYPES as zn, noEchoOutputsComparison as zo, observeThenDisableInstanceApiTermination as zr, S3StateBackend as zs, destroyStackRecordsView as zt };
-//# sourceMappingURL=deploy-engine-DEBgHf6Z.js.map
+export { S3_AUTO_DELETE_OBJECTS_TAG as $, unwrittenCreateOnlyReplacement as $a, getLegacyStateBucketName as $c, malformedExportSourceWarning as $i, formatDestructiveChange as $n, recordLogOnlyParameterValue as $o, explicitRoleArnOrThrow as $r, hasReadableExportSet as $s, replacementNeverSwapped as $t, diffSecurity as A, refuseMalformedResourceEntriesForImport as Aa, describeDockerExecFailure as Ac, cfnRefValueFromPhysicalId as Ai, absoluteAssemblyPathEscape as Al, DEFAULT_RESOURCE_WARN_AFTER_MS as An, sameLambdaFunctionAddress as Ao, RollbackInlinePolicyWriters as Ar, recordNoEchoParameterFreshValue as As, withNestedStackContext as At, readProtection as B, refuseMalformedState as Ba, redactedCause as Bc, STATE_RESOURCES_MALFORMED as Bi, extractDeploymentEventError as Bn, noEchoLeavesOf as Bo, isTerminationProtectionPropagationError as Br, isLockInfoExpired as Bs, awaitInFlightSibling as Bt, withApiLimit as C, refuseMalformedOrphansForOrphan as Ca, readBootstrapMarkerBody as Cc, getAccountInfo as Ci, StageLoadError as Cl, isWholeDynamicReferenceValue as Cn, requireConfigString as Co, withPrintingSecrets as Cr, recordPhysicalNameCopy as Cs, nestedChildStackName as Ct, findServiceTokenRefusals as D, refuseMalformedResourceEntries as Da, buildDockerImage as Dc, isNamelessDynamicReferenceError as Di, hasPlainPrototype$1 as Dl, isExportAliasCollision as Dn, withRetry as Do, CloudControlProvider as Dr, recordMaskOnlyValue as Ds, withNestedRevertRun as Dt, deferredServiceTokenWarning as E, refuseMalformedResourceAttributesForOrphan as Ea, buildDenyExternalAccessPolicy as Ec, carriesFetchableDynamicReference as Ei, hasOwnKey as El, collectPublishedOutputNames as En, describeTypeWithThrottleRetry as Eo, customResourceResponseExpirationWarning as Er, provenPublicValue as Es, revertedNestedRowIds as Et, recordedProtectionEvidence as F, refuseMalformedResourcePropertiesForExport as Fa, getDockerCmd as Fc, parameterInputsFor as Fi, injectAwsRegion as Fl, secretNamePrintingBag as Fn, maskAtCoordinates as Fo, withIndeterminateGuard as Fr, STATE_SOURCED_READBACK_RULES as Fs, loadJournaledOrphans as Ft, deleteBudgetKey as G, repairMalformedResourcePropertiesForReadOnly as Ga, escapeRegExp$3 as Gc, displayLogicalId as Gi, createPreDeleteFinalSnapshot as Gn, valueAtCoordinate as Go, INTRINSIC_KEYS as Gr, applyCrossPrefixScan as Gs, recordAfterRollbackUpdate as Gt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as H, repairMalformedOrphansForReadOnly as Ha, runDockerForeground as Hc, UNREADABLE_RESOURCES_MAP_ROW as Hi, PRE_DELETE_SNAPSHOT_TYPES as Hn, passedNoEchoParametersOf as Ho, reDisableInstanceApiTermination as Hr, rebuildClientForBucketRegion as Hs, getStackRecords as Ht, recordedProtectionNote as I, refuseMalformedResourcePropertiesForOrphan as Ia, isDockerClientEnvKey as Ic, passedParameterClassesOf as Ii, injectedAwsRegionValue as Il, secretNamePrintingBags as In, maskReadbackAtCoordinates as Io, isWaitAbandonedError as Ir, TEMPLATE_SOURCED_RULES as Is, makeForeignHolderScan as It, DELETE_INDEX_WAIT_PROCEED_NOTE as J, unreadableOrphanRecords as Ja, AssetManifestLoader as Jc, hasReadableResources as Ji, refusesFinalSnapshot as Jn, createUnionSecretMasker as Jo, producerLookupOver as Jr, isNotImplemented as Js, isReplacementOrphan as Jt, resolveDynamoDbDeleteBudgetClock as K, repairMalformedResourcesForReadOnly as Ka, stripControlChars as Kc, hasReadableOrphans as Ki, effectiveDeletionPolicy as Kn, liveMatchesUnresolvedTokenFrame as Ko, IntrinsicFunctionResolver as Kr, crossPrefixDeniedWarning as Ks, demoteSupersededOrphans as Kt, PROTECTION_PROPERTY_BY_TYPE as L, refuseMalformedResourcesForDeploy as La, isMalformedEnvKey as Lc, declaresNoEcho as Li, clearBucketRegionCache as Ll, secretNamedRecordNeedles as Ln, maskWholeValue as Lo, markWaitAbandoned as Lr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ls, sameJournaledOrphans as Lt, noEchoComparisonForTemplate as M, refuseMalformedResourceEntriesForOrphan as Ma, dockerSpawnEnvWithSensitive as Mc, refStateLookupFromResource as Mi, displayAssemblyPath as Ml, journaledOrphanPrintingBag as Mn, TemplateParser as Mo, deleteIndeterminateGuards as Mr, wholeStringLeavesOf as Ms, dropFailedHint as Mt, noEchoExactEchoLeavesOf as N, refuseMalformedResourcePropertiesForDestroy as Na, finchSecretArgvRefusal as Nc, parseWebACLArn as Ni, renderAssemblyPathEscape as Nl, maskEventTextWithBoundBags as Nn, canonicalCoordinates as No, deleteLeftInPlace as Nr, STATE_SOURCED_BASELINE_RULES as Ns, isHandledOrphan as Nt, serviceTokenBlockingReason as O, refuseMalformedResourceEntriesForDeploy as Oa, resolveDockerContextDirectory as Oc, keepsSecretReferenceToken as Oi, nullPrototypeRecord as Ol, bindingSkippedOutputs as On, canonicalLambdaFunctionName as Oo, slowCcOperationTimeoutMs as Or, recordMaskOnlyValuesIn as Os, collectNestedChildUnaddressed as Ot, noEchoParameterNamesOf as P, refuseMalformedResourcePropertiesForDrift as Pa, formatDockerLoginError as Pc, withSharedDrainBudget as Pi, resolveAssemblyPath as Pl, orphanRecordsPrintingBag as Pn, isMarkedCoordinate as Po, deleteSkipReason as Pr, STATE_SOURCED_CROSS_GENERATION_RULES as Ps, journaledOrphanLines as Pt, ECR_AUTO_DELETE_IMAGES_TAG as Q, findSilentDropProperties as Qa, getDefaultStateBucketName as Qc, malformedExportNamesWarning as Qi, findDestructiveChanges as Qn, printingCorpusOf as Qo, assertSendableRoleArn as Qr, exportNamesCarriedFrom as Qs, recordUnderIdIsNotOwn as Qt, isProtectionValueActive as R, refuseMalformedResourcesForDestroy as Ra, partitionSensitiveEnv as Rc, JSON_LISTING_HOLE_VALUE as Ri, resolveBucketRegion as Rl, stateSecretNameNeedles as Rn, maskedLeafCoordinatesOf as Ro, disableInstanceApiTermination as Rr, isSingleDynamicReferenceToken as Rs, replayFailedOperations as Rt, lookupEachName as S, refuseMalformedOrphansForDestroy as Sa, parseBootstrapMarker as Sc, parameterTypeMayLoseSecretIdentity as Si, AssemblyReader as Sl, exportNameSecretExposure as Sn, requireConfigObject as So, getCurrentResourceSecrets as Sr, recordAttributeIdCopy as Ss, getNestedRevertRun as St, recordRetainedForReadoption as T, refuseMalformedOutputsForDestroy as Ta, validateContainerRepoName as Tc, carriesDynamicReference as Ti, defineOwnKey as Tl, collectDeclaredOutputNames as Tn, templateResourceTypes as To, applyCustomResourceResponseExpiration as Tr, carriesSecretMask as Ts, revertNestedChildFromJournal as Tt, beginDeleteWait as U, repairMalformedOutputsForReadOnly as Ua, runDockerStreaming as Uc, accountArgs as Ui, buildFinalSnapshotIdentifier as Un, readbackPathFor as Uo, reEnableInstanceApiTermination as Ur, CrossPrefixReadError as Us, withStackRecords as Ut, DynamoDBGlobalTableProvider as V, repairMalformedOrphanRecordsForReadOnly as Va, redactedDockerCause as Vc, UNREADABLE_ORPHANS_CONTAINER_ROW as Vi, ATOMIC_FINAL_SNAPSHOT_TYPES as Vn, noEchoOutputsComparison as Vo, observeThenDisableInstanceApiTermination as Vr, S3StateBackend as Vs, destroyStackRecordsView as Vt, compensateRemovedDeletionProtection as W, repairMalformedResourceEntriesForReadOnly as Wa, warnFinchArgvExposure as Wc, deployRefusesOrphanRowsReason as Wi, ccRoutedFinalSnapshotError as Wn, readsNoEchoSource as Wo, DiffCalculator as Wr, CrossPrefixScanCache as Ws, removeProtectionTypeList as Wt, deleteTableWithIndexBusyRetry as X, withheldAccountClause as Xa, Synthesizer as Xc, isReadableResourceEntry as Xi, maskingRetryLogger as Xn, literalSplitDelimitersOf as Xo, applyRoleArnIfSet as Xr, acceptedCreateOnlyDropsOf as Xs, planRollback as Xt, INDEX_SETTLE_POLL_INTERVAL_MS as Y, unreadableResourceEntries as Ya, getDockerImageBySourceHash as Yc, isReadableOrphanRecord as Yi, unsupportedFinalSnapshotError as Yn, hasMaskableValues as Yo, refuseUnreadableCdkCrossAccountRefs as Yr, splitImportedOps as Ys, planFailedOps as Yt, waitForIndexesSettled as Z, findActionableSilentDrops as Za, synthesisStatusMessage as Zc, malformedDriftResourcePropertiesWarning as Zi, constructPathOf as Zn, logOnlyValueCount as Zo, assertFlagRoleArn as Zr, describeRegionValueKind as Zs, recheckFailedPlan as Zt, keptWholeReasonText as _, refuseDivergentRecordRegionForDestroy as _a, BOOTSTRAP_MARKER_PREFIX as _c, classifyReplaySecretRegion as _i, decodeListingKey as _l, secretBearing as _n, configIntegerRefusal as _o, isCustomResource as _r, identityKeyFor as _s, planOrphanAdoption as _t, inheritedProvenanceForChildDiff as a, malformedOrphanRowsKeptWarning as aa, orphansAfterRollback as ac, envCredentialsAreAssumedRole as ai, resolveStateBucketWithDefault as al, inheritProducerRegions as an, MULTI_REGION_RECREATE_BLOCKED_TYPES as ao, DBPROXY_TAGS_WHAT as ar, maskSecretsInText as as, createReadOnlyAttributeHealerFactory as at, chunks as b, refuseMalformedOrphanRecordsForDestroy as ba, getBootstrapMarkerKey as bc, coerceParameterTypedValue as bi, canonicalizeRegion as bl, carriedExportAliasExposure as bn, replayWarn as bo, readsNoEchoDeleteValues as br, recoverMaskedOutput as bs, displacedPhysicalIdShown as bt, isAbsoluteAssetPath as c, malformedOutputsRefusalMessage as ca, AssetPublisher as cc, outputReferenceProvenanceOf as ci, stateBucketExistenceConfirmed as cl, redactedDeleteAddressFields as cn, renderStatefulReason as co, readTagList as cr, snapshotPassProvenance as cs, gray as ct, templateIdentity as d, malformedResourceEntriesWarning as da, WorkGraph as dc, s3BucketArn as di, CFN_TEMPLATE_BODY_LIMIT as dl, updatePartialReason as dn, isWarmThroughputDecrease as do, tagPlanWarning as dr, withPhysicalNameCopies as ds, yellow as dt, malformedLocalOutputsWarning as ea, hasReasonlessBaselineRefusal as ec, isIamRoleArn as ei, loadCdkJson as el, resolveReplacementOldType as en, withoutSilentDropProperties as eo, earliestDefined as er, recordLogOnlyValue as es, hasCdkAutoDeleteTag as et, conditionFingerprint as f, malformedResourcePropertiesWarning as fa, buildAssetRedirectMap as fc, s3BucketDomainName as fi, CFN_TEMPLATE_URL_LIMIT as fl, DeploymentEventsReader as fn, toCfnInteger as fo, definedAttributes as fr, withoutPhysicalNameCopies as fs, computeParameterTaint as ft, isSecretBearingReferenceString as g, previewableOrphanRecords as ga, AssetModeResolver as gc, classifyRecordedSecretRegion as gi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as gl, exportAliasCollisionScrubWarning as gn, configBooleanRefusal as go, ccBrokenReason as gr, pathCrossesDottedKey as gs, makeSiblingClaimReader as gt, readRecordedConditionVerdicts as h, malformedStateRefusalMessage as ha, rewriteTemplateAssetReferences as hc, s3BucketWebsiteUrl as hi, uploadCfnTemplate as hl, displayTextOrWithheld as hn, coerceCfnInteger as ho, ProviderRegistry as hr, isUncertifiedBaselineMaskPosition as hs, resourcesNamingDeclaredParameter as ht, crossStackOutputProvenanceSource as i, malformedOrphanRecordsWarning as ia, isReadableBag as ic, callerEnvCredentials as ii, resolveSkipPrefix as il, getCurrentProducerRegions as in, shownType as io, acquireIdempotencyToken as ir, maskSecretsInError as is, formatResourceLine as it, noEchoAttributeNamesOf as j, refuseMalformedResourceEntriesForImportSave as ja, describeDockerFailure as jc, isStalePlaceholderArnAttribute as ji, describeFileReadFailure as jl, completedReplayEntries as jn, DagBuilder as jo, UNSPECIFIED_SKIP_REASON as jr, recordProvenPublicExpression as js, deleteJournaledOrphans as jt, withResourceDeadline as k, refuseMalformedResourceEntriesForDestroy as ka, describeDockerCapturedOutput as kc, AWS_NO_VALUE as ki, ownValue as kl, DEFAULT_RESOURCE_TIMEOUT_MS as kn, lambdaFunctionNameForMask as ko, unchangedBehindSecretReference as kr, recordNoEchoAttributeValues as ks, getCurrentNestedStackContext as kt, listNestedTemplateRows as l, malformedOutputsWarning as la, isSensitiveAttributeName as lc, recordedOutputReferenceRegions as li, warnDeprecatedNoPrefixCliFlag as ll, redactedDeleteAddressSkip as ln, WARM_THROUGHPUT_MEMBERS as lo, refuseMalformedDesiredTags as lr, redactSecretsForState as ls, green as lt, parentSuppliedValues as m, malformedScrubResourceEntriesRefusalMessage as ma, loadPublishableAssetManifest as mc, s3BucketRegionalDomainName as mi, findLargeInlineResources as ml, WITHHELD_NAME_DISPLAY as mn, coerceCfnBoolean as mo, CC_BROKEN_REASON as mr, dynamicReferenceTokens as ms, reachableDivergentParameters as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedLocalResourcesWarning as na, importableOutputKeys as nc, AWS_CREDENTIAL_ENV_KEYS as ni, resolveAutoAssetStorage as nl, orphanDeleteNeedsIdentity as nn, hasNoCloudControlHandlers as no, reserveStackCreateToken as nr, createSecretMasker as ns, getPriorAttempts as nt, childTemplateLoader as o, malformedOrphansRefusalMessage as oa, orphansCarriedFrom as oc, isSettledInstanceState as oi, resolveStateBucketWithDefaultAndSource as ol, REDACTED_DELETE_ADDRESS_SKIP_REASON as on, isStatefulRecreateTargetForReplace as oo, DBPROXY_TAG_OPTIONS as or, markSameGenerationBag as os, bold as ot, conditionInputsFrom as p, malformedResourcesWarning as pa, createAssetRedirectResolver as pc, s3BucketDualStackDomainName as pi, MIGRATE_TMP_PREFIX as pl, DeploymentEventsStore as pn, toFiniteNumber as po, stringifyIfAssigned as pr, DYNAMIC_REFERENCE_TOKEN_SCAN as ps, namesAnyDeclaredParameter as pt, resolveDynamoDbDeleteBudgetMs as q, unpreviewableOrphanRecords as qa, stripForDisplay as qc, hasReadableOutputs as qi, isFinalSnapshotError as qn, carryLogOnlyValues as qo, poisonRenderedSpellingsCollidingIn as qr, isAccessDenied$1 as qs, isJournaledOrphan as qt, computeImplicitDeleteEdges as r, malformedOrphanRecordsRefusalMessage as ra, importableOutputs as rc, applyCallerIdentityCredentials as ri, resolveCaptureObservedState as rl, findNestedStackTypeChanges as rn, findReplacedReadersOfRecreateTargets as ro, withCreateTokenLedger as rr, errorCauseChain as rs, markRefusedBeforeApplying as rt, findNestedTemplateTreeDefect as s, malformedOrphansWarning as sa, shouldRetainResource as sc, keepHeldTokenProvenance as si, resolveUseCdkBootstrapAssets as sl, isRedactedRecordedValue as sn, isStatefulRecreateTargetSync as so, planTagDiff as sr, recordReferenceProvenanceEntry as ss, cyan as st, DeployEngine as t, malformedLocalResourceEntriesWarning as ta, hasUnverifiableParameterRefusal as tc, sendableAssumeRoleCommand as ti, resolveApp as tl, seedsDeleteFirstGuard as tn, NO_CC_HANDLERS_REASON as to, ledgerForStack as tr, shareLogOnlyValues as ts, isTruthyCfnBoolean as tt, renderNestedTemplateTreeDefect as u, malformedRenderedContainersWarning as ua, stringifyValue as uc, recordedReferenceRegions as ui, ssmResolvedValueType as ul, updatePartialMessage as un, coerceWarmThroughput as uo, tagMapAsList as ur, scrubResourceRecord as us, red as ut, mergeNoChangeOutputs as v, refuseMalformedNestedChildOutputs as va, assertAssetBucketRegion as vc, producerRegionsFromState as vi, expectedOwnerParam as vl, secretBearingStateKeyWarning as vn, configStringRefusal as vo, wouldReturnToSdkProvider as vr, inheritNestedStackParameterAssociations as vs, NESTED_PENDING_PARENT_REASON as vt, keptForReadoption as w, refuseMalformedOutputs as wa, validateAssetBucketName as wc, isImpossibleEmptyStoredAttribute as wi, processStackMessages as wl, noEchoParameterValueSeed as wn, prefetchCreateOnlyPropertyPaths as wo, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as wr, splitGetAttStringForm as ws, recordDisplacedSkips as wt, isAccessDeniedError as x, refuseMalformedOrphans as xa, isCrossRegionRedirect as xc, isUnboundTemplateParameter as xi, derivePartitionAndUrlSuffix as xl, exportNameNoEchoParameters as xn, requireConfigArray as xo, isCustomResourceType as xr, physicalNameCopiesOf as xs, dropSettledNestedJournals as xt, makeCanonicalizePropertiesFn as y, refuseMalformedOrphanRecords as ya, ensureAssetStorage as yc, regionLessSecretName as yi, PARTITION_TABLE as yl, secretSafeKeyDisplay as yn, readConfigString as yo, TemplateNoEchoReresolver as yr, recordNestedStackParameterExpressions as ys, displacedOpClause as yt, perType as z, refuseMalformedResourcesForExport as za, redactDockerArgvValues as zc, STATE_REGION_DIVERGED as zi, storedSecretNameNeedles as zn, noEchoCoordinatesOf as zo, ec2InstanceProtectionSite as zr, LockManager as zs, replayRollback as zt };
+//# sourceMappingURL=deploy-engine-D6CSo8Gj.js.map