@go-to-k/cdkd 0.299.4 → 0.299.6

package/dist/{deploy-engine-DWIbDQdg.js → deploy-engine-DZhdwU1d.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-Bj7qH5Ph.js";
-import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, H as truncateCodePoints, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as terminalSafe, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
-import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-Pn2m0R67.js";
+import { A as UNRENDERABLE, B as safeMsg, C as looksLikeCdkdGeneratedName, D as SAFE_MSG_ALTERED_CHAR, E as withoutGeneratedFallbackName, F as displaySafe, H as terminalSafe, I as displayStackName, L as isPasteableIdent, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, S as getCurrentStackName, T as withStackName, U as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, j as asIsMessage, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
+import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-dAY3-gXJ.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-DBXBcg0J.js";
-import { t as getCdkdVersion } from "./version-B-AQELPJ.js";
+import { t as getCdkdVersion } from "./version--k430Kj8.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7206,6 +7206,28 @@ function nanIfUncoercible(value) {
 //#endregion
 //#region src/deployment/secret-redaction/rules.ts
 const MIN_NEEDLE_LENGTH = 4;
+function printingNeedles(values) {
+	const out = /* @__PURE__ */ new Set();
+	for (const value of values) {
+		if (value.length < 4) continue;
+		out.add(value);
+		const flat = flattenedSpelling(value);
+		if (flat !== void 0 && flat.trim().length >= 4) out.add(flat);
+	}
+	return [...out];
+}
+const FLATTENED_MEMO_CAP = 4096;
+const flattenedMemo = /* @__PURE__ */ new Map();
+function flattenedSpelling(value) {
+	if (!SAFE_MSG_ALTERED_CHAR.test(value)) return void 0;
+	let flat = flattenedMemo.get(value);
+	if (flat === void 0) {
+		flat = safeMsg`${value}`;
+		if (flattenedMemo.size >= FLATTENED_MEMO_CAP) flattenedMemo.clear();
+		flattenedMemo.set(value, flat);
+	}
+	return flat === value ? void 0 : flat;
+}
 function escapeRegExp$2(value) {
 	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -9260,9 +9282,10 @@ function isSameGenerationBag(bag) {
 //#region src/deployment/secret-redaction/mask-errors.ts
 function maskSecretsInText(text, secrets) {
 	const logOnly = logOnlyValuesOf.get(secrets);
-	if (logOnly === void 0 || logOnly.size === 0) return maskRecordedSecretsInText(text, secrets);
-	if (text !== "" && (secrets.has(text) || logOnly.has(text))) return "***";
-	return maskMatchSpans(text, substringNeedles([...secrets.keys(), ...logOnly]), "***");
+	const noLogOnly = logOnly === void 0 || logOnly.size === 0;
+	if (secrets.size === 0 && noLogOnly) return text;
+	if (text !== "" && (secrets.has(text) || logOnly?.has(text) === true)) return "***";
+	return maskMatchSpans(text, printingNeedles(noLogOnly ? secrets.keys() : [...secrets.keys(), ...logOnly]), "***");
 }
 function maskRecordedSecretsInText(text, secrets) {
 	if (secrets.size === 0) return text;
@@ -9626,7 +9649,7 @@ function createUnionSecretMasker(bags) {
 				for (const plaintext of bag.keys()) needles.add(plaintext);
 				for (const plaintext of logOnlyValuesOf.get(bag) ?? []) needles.add(plaintext);
 			}
-			scanned = [...needles].filter((needle) => needle.length >= 4);
+			scanned = printingNeedles(needles);
 			stamp = now;
 		}
 		if (text !== "" && needles.has(text)) return "***";
@@ -11446,7 +11469,7 @@ const CREATE_ONLY_PATHS_SNAPSHOT = /* @__PURE__ */ new Map([
 	["AWS::AppSync::ApiKey", [["ApiId"]]],
 	["AWS::AppSync::DataSource", [["ApiId"], ["Name"]]],
 	["AWS::AppSync::GraphQLApi", []],
-	["AWS::AppSync::GraphQLSchema", [["ApiId"]]],
+	["AWS::AppSync::GraphQLSchema", []],
 	["AWS::AppSync::Resolver", [
 		["ApiId"],
 		["FieldName"],
@@ -11461,7 +11484,7 @@ const CREATE_ONLY_PATHS_SNAPSHOT = /* @__PURE__ */ new Map([
 		"BaseEvaluatorId"
 	], ["EvaluatorName"]]],
 	["AWS::BedrockAgentCore::Runtime", [["AgentRuntimeName"]]],
-	["AWS::Budgets::Budget", [["NotificationsWithSubscribers"]]],
+	["AWS::Budgets::Budget", [["Budget", "BudgetName"], ["NotificationsWithSubscribers"]]],
 	["AWS::CertificateManager::Certificate", [
 		["CertificateAuthorityArn"],
 		["CertificateExport"],
@@ -11952,7 +11975,7 @@ const CREATE_ONLY_PATHS_SNAPSHOT = /* @__PURE__ */ new Map([
 	]],
 	["AWS::RDS::DBProxyTargetGroup", [["DBProxyName"], ["TargetGroupName"]]],
 	["AWS::RDS::DBSubnetGroup", [["DBSubnetGroupName"]]],
-	["AWS::Route53::HostedZone", [["Name"]]],
+	["AWS::Route53::HostedZone", [["DelegationSetId"], ["Name"]]],
 	["AWS::Route53::RecordSet", [["HostedZoneId"], ["HostedZoneName"]]],
 	["AWS::S3::Bucket", [
 		["BucketName"],
@@ -14412,7 +14435,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
-		readOnly: /* @__PURE__ */ new Set(["AnomalyDetectorId"]),
+		readOnly: /* @__PURE__ */ new Set(["Id"]),
 		ccRouteUnavailable: true
 	}],
 	["AWS::CodeBuild::Project", {
@@ -16275,8 +16298,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"QueryLoggingConfig",
 			"VPCs"
 		]),
-		silentDrop: /* @__PURE__ */ new Map(),
-		createOnlyDrops: /* @__PURE__ */ new Set(),
+		silentDrop: /* @__PURE__ */ new Map([["DelegationSetId", "not yet implemented by cdkd"]]),
+		createOnlyDrops: /* @__PURE__ */ new Set(["DelegationSetId"]),
 		readOnly: /* @__PURE__ */ new Set(["Id", "NameServers"]),
 		ccRouteUnavailable: false
 	}],
@@ -25929,7 +25952,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BtUUjRnI.js");
+			const { ASGProvider } = await import("./asg-provider-SsXASjNc.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -26035,7 +26058,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-B9gz-giS.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-Bkrw65eO.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider--_cLSeij.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-eZd5MtAD.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -26263,7 +26286,8 @@ var CloudControlProvider = class {
 		const causeText = safeDisplay === "" ? "" : `: ${safeDisplay}`;
 		if (described.detail !== "") this.logger.debug(`${operation} ${logicalId}: the abandoned operation's underlying failure was: ${displaySafe(described.detail)}`);
 		const identifierClause = lastSeenIdentifier === void 0 ? "" : ` The last status cdkd read named the resource ${displaySafe(lastSeenIdentifier, { asciiOnly: true })}.`;
-		const error = new CloudControlWaitAbandonedError(`${operation} of ${logicalId} was accepted by Cloud Control API, but cdkd stopped waiting for it (${reason}${causeText}). The operation may still be running in AWS, and ${operation === "CREATE" ? "cdkd has NO state record for it, so any resource it creates is untracked by rollback and by cdkd destroy" : operation === "DELETE" ? "the resource may or may not have been removed; its state record is kept so a re-run can finish the delete" : "its state record still holds the PREVIOUS properties, so the record may no longer describe the live resource"}.${identifierClause} Check what it did with:\n  ${await this.buildResumeCommand(requestToken)}`, resourceType, logicalId, requestToken, operation, lastSeenIdentifier, cause instanceof Error ? cause : void 0);
+		const consequence = operation === "CREATE" ? "cdkd has NO state record for it, so any resource it creates is untracked by rollback and by cdkd destroy" : operation === "DELETE" ? "the resource may or may not have been removed; its state record is kept so a re-run can finish the delete" : "its state record still holds the PREVIOUS properties, so the record may no longer describe the live resource";
+		const error = new CloudControlWaitAbandonedError(safeMsg`${operation} of ${logicalId} was accepted by Cloud Control API, but cdkd stopped waiting for it ` + safeMsg`(${reason}${causeText}). The operation may still be running in AWS, and ${consequence}.` + `${identifierClause} Check what it did with:\n  ${await this.buildResumeCommand(requestToken)}`, resourceType, logicalId, requestToken, operation, lastSeenIdentifier, cause instanceof Error ? cause : void 0);
 		if (described.marker) markRedactedCause(error);
 		return operation === "CREATE" ? markNonRetryable(error) : error;
 	}
@@ -29847,6 +29871,7 @@ const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::AutoScaling::AutoScalingGroup", "{\"AvailabilityZoneDistribution\":\"object\",\"AvailabilityZoneIds\":\"array\",\"AvailabilityZoneImpairmentPolicy\":\"object\",\"AvailabilityZones\":\"array\",\"CapacityReservationSpecification\":\"object\",\"CapacityReservationSpecification.CapacityReservationTarget\":\"object\",\"CapacityReservationSpecification.CapacityReservationTarget.CapacityReservationIds\":\"array\",\"CapacityReservationSpecification.CapacityReservationTarget.CapacityReservationResourceGroupArns\":\"array\",\"InstanceLifecyclePolicy\":\"object\",\"InstanceLifecyclePolicy.RetentionTriggers\":\"object\",\"InstanceMaintenancePolicy\":\"object\",\"LaunchTemplate\":\"object\",\"LifecycleHookSpecificationList\":\"array\",\"LifecycleHookSpecificationList[]\":\"object\",\"LoadBalancerNames\":\"array\",\"MetricsCollection\":\"array\",\"MetricsCollection[]\":\"object\",\"MetricsCollection[].Metrics\":\"array\",\"MixedInstancesPolicy\":\"object\",\"MixedInstancesPolicy.InstancesDistribution\":\"object\",\"MixedInstancesPolicy.InstancesDistribution.DistributionSegments\":\"array\",\"MixedInstancesPolicy.InstancesDistribution.DistributionSegments[]\":\"object\",\"MixedInstancesPolicy.InstancesDistribution.DistributionSegments[].TargetCapacityTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.LaunchTemplateSpecification\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[]\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorCount\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorManufacturers\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorNames\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorTotalMemoryMiB\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AllowedInstanceTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselineEbsBandwidthMbps\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors.Cpu\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors.Cpu.References\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors.Cpu.References[]\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.CpuManufacturers\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.ExcludedInstanceTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.InstanceGenerations\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.LocalStorageTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.MemoryGiBPerVCpu\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.MemoryMiB\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.NetworkBandwidthGbps\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.NetworkInterfaceCount\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.TotalLocalStorageGB\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.VCpuCount\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].LaunchTemplateSpecification\":\"object\",\"NotificationConfiguration\":\"object\",\"NotificationConfiguration.NotificationTypes\":\"array\",\"NotificationConfigurations\":\"array\",\"NotificationConfigurations[]\":\"object\",\"NotificationConfigurations[].NotificationTypes\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"TargetGroupARNs\":\"array\",\"TerminationPolicies\":\"array\",\"TrafficSources\":\"array\",\"TrafficSources[]\":\"object\",\"VPCZoneIdentifier\":\"array\"}"],
 	["AWS::BedrockAgentCore::Evaluator", "{\"EvaluatorConfig\":\"object\",\"EvaluatorConfig.CodeBased\":\"object\",\"EvaluatorConfig.CodeBased.LambdaConfig\":\"object\",\"EvaluatorConfig.Derived\":\"object\",\"EvaluatorConfig.Derived.ModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.AdditionalModelRequestFields\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig.StopSequences\":\"array\",\"EvaluatorConfig.Derived.ModelConfig.ResponsesEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.ResponsesEvaluatorModelConfig.Reasoning\":\"object\",\"EvaluatorConfig.LlmAsAJudge\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.AdditionalModelRequestFields\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig.StopSequences\":\"array\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig.Reasoning\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical[]\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::BedrockAgentCore::Runtime", "{\"AgentRuntimeArtifact\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration.Code\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration.Code.S3\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration.EntryPoint\":\"array\",\"AgentRuntimeArtifact.ContainerConfiguration\":\"object\",\"AuthorizerConfiguration\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedAudience\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedClients\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedScopes\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.HostingEnvironments\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.HostingEnvironments[]\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.WorkloadIdentities\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[]\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[].AuthorizingClaimMatchValue\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[].AuthorizingClaimMatchValue.ClaimMatchValue\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[].AuthorizingClaimMatchValue.ClaimMatchValue.MatchValueStringList\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource.SecurityGroupIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource.SubnetIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource.Tags\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.SelfManagedLatticeResource\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[]\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource.SecurityGroupIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource.SubnetIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource.Tags\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.SelfManagedLatticeResource\":\"object\",\"CapacityProviderConfiguration\":\"object\",\"EnvironmentVariables\":\"object\",\"FilesystemConfigurations\":\"array\",\"FilesystemConfigurations[]\":\"object\",\"FilesystemConfigurations[].CapacityProviderVolume\":\"object\",\"FilesystemConfigurations[].EfsAccessPoint\":\"object\",\"FilesystemConfigurations[].S3FilesAccessPoint\":\"object\",\"FilesystemConfigurations[].SessionStorage\":\"object\",\"LifecycleConfiguration\":\"object\",\"NetworkConfiguration\":\"object\",\"NetworkConfiguration.NetworkModeConfig\":\"object\",\"NetworkConfiguration.NetworkModeConfig.SecurityGroups\":\"array\",\"NetworkConfiguration.NetworkModeConfig.Subnets\":\"array\",\"RequestHeaderConfiguration\":\"object\",\"RequestHeaderConfiguration.RequestHeaderAllowlist\":\"array\",\"Tags\":\"object\",\"WorkloadIdentityDetails\":\"object\"}"],
+	["AWS::Budgets::Budget", "{\"Budget\":\"object\",\"Budget.AutoAdjustData\":\"object\",\"Budget.AutoAdjustData.HistoricalOptions\":\"object\",\"Budget.BudgetLimit\":\"object\",\"Budget.CostFilters\":\"object\",\"Budget.CostTypes\":\"object\",\"Budget.FilterExpression\":\"object\",\"Budget.FilterExpression.And\":\"array\",\"Budget.FilterExpression.CostCategories\":\"object\",\"Budget.FilterExpression.CostCategories.MatchOptions\":\"array\",\"Budget.FilterExpression.CostCategories.Values\":\"array\",\"Budget.FilterExpression.Dimensions\":\"object\",\"Budget.FilterExpression.Dimensions.MatchOptions\":\"array\",\"Budget.FilterExpression.Dimensions.Values\":\"array\",\"Budget.FilterExpression.Or\":\"array\",\"Budget.FilterExpression.Tags\":\"object\",\"Budget.FilterExpression.Tags.MatchOptions\":\"array\",\"Budget.FilterExpression.Tags.Values\":\"array\",\"Budget.Metrics\":\"array\",\"Budget.PlannedBudgetLimits\":\"object\",\"Budget.TimePeriod\":\"object\",\"NotificationsWithSubscribers\":\"array\",\"NotificationsWithSubscribers[]\":\"object\",\"NotificationsWithSubscribers[].Notification\":\"object\",\"NotificationsWithSubscribers[].Subscribers\":\"array\",\"NotificationsWithSubscribers[].Subscribers[]\":\"object\",\"ResourceTags\":\"array\",\"ResourceTags[]\":\"object\"}"],
 	["AWS::CertificateManager::Certificate", "{\"DomainValidationOptions\":\"array\",\"DomainValidationOptions[]\":\"object\",\"SubjectAlternativeNames\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::CloudFormation::Stack", "{\"Capabilities\":\"array\",\"NotificationARNs\":\"array\",\"Outputs\":\"array\",\"Outputs[]\":\"object\",\"Parameters\":\"object\",\"StackPolicyBody\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::CloudFront::CloudFrontOriginAccessIdentity", "{\"CloudFrontOriginAccessIdentityConfig\":\"object\"}"],
@@ -29854,7 +29879,6 @@ const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::CloudFront::OriginAccessControl", "{\"OriginAccessControlConfig\":\"object\"}"],
 	["AWS::CloudTrail::Trail", "{\"AdvancedEventSelectors\":\"array\",\"AdvancedEventSelectors[]\":\"object\",\"AdvancedEventSelectors[].FieldSelectors\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[]\":\"object\",\"AdvancedEventSelectors[].FieldSelectors[].EndsWith\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].Equals\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].NotEndsWith\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].NotEquals\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].NotStartsWith\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].StartsWith\":\"array\",\"AggregationConfigurations\":\"array\",\"AggregationConfigurations[]\":\"object\",\"AggregationConfigurations[].Templates\":\"array\",\"EventSelectors\":\"array\",\"EventSelectors[]\":\"object\",\"EventSelectors[].DataResources\":\"array\",\"EventSelectors[].DataResources[]\":\"object\",\"EventSelectors[].DataResources[].Values\":\"array\",\"EventSelectors[].ExcludeManagementEventSources\":\"array\",\"InsightSelectors\":\"array\",\"InsightSelectors[]\":\"object\",\"InsightSelectors[].EventCategories\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::CloudWatch::Alarm", "{\"AlarmActions\":\"array\",\"Dimensions\":\"array\",\"Dimensions[]\":\"object\",\"EvaluationCriteria\":\"object\",\"EvaluationCriteria.PromQLCriteria\":\"object\",\"EvaluationWindow\":\"object\",\"EvaluationWindow.SlidingWindow\":\"object\",\"EvaluationWindow.WallClockWindow\":\"object\",\"InsufficientDataActions\":\"array\",\"Metrics\":\"array\",\"Metrics[]\":\"object\",\"Metrics[].MetricStat\":\"object\",\"Metrics[].MetricStat.Metric\":\"object\",\"Metrics[].MetricStat.Metric.Dimensions\":\"array\",\"Metrics[].MetricStat.Metric.Dimensions[]\":\"object\",\"OKActions\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"WarmUpConfiguration\":\"object\"}"],
-	["AWS::CloudWatch::AnomalyDetector", "{\"Configuration\":\"object\",\"Configuration.ExcludedTimeRanges\":\"array\",\"Configuration.ExcludedTimeRanges[]\":\"object\",\"Dimensions\":\"array\",\"Dimensions[]\":\"object\",\"MetricCharacteristics\":\"object\",\"MetricMathAnomalyDetector\":\"object\",\"MetricMathAnomalyDetector.MetricDataQueries\":\"array\",\"MetricMathAnomalyDetector.MetricDataQueries[]\":\"object\",\"MetricMathAnomalyDetector.MetricDataQueries[].MetricStat\":\"object\",\"MetricMathAnomalyDetector.MetricDataQueries[].MetricStat.Metric\":\"object\",\"MetricMathAnomalyDetector.MetricDataQueries[].MetricStat.Metric.Dimensions\":\"array\",\"MetricMathAnomalyDetector.MetricDataQueries[].MetricStat.Metric.Dimensions[]\":\"object\",\"SingleMetricAnomalyDetector\":\"object\",\"SingleMetricAnomalyDetector.Dimensions\":\"array\",\"SingleMetricAnomalyDetector.Dimensions[]\":\"object\"}"],
 	["AWS::CodeCommit::Repository", "{\"Code\":\"object\",\"Code.S3\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"Triggers\":\"array\",\"Triggers[]\":\"object\",\"Triggers[].Branches\":\"array\",\"Triggers[].Events\":\"array\"}"],
 	["AWS::Cognito::UserPool", "{\"AccountRecoverySetting\":\"object\",\"AccountRecoverySetting.RecoveryMechanisms\":\"array\",\"AccountRecoverySetting.RecoveryMechanisms[]\":\"object\",\"AdminCreateUserConfig\":\"object\",\"AdminCreateUserConfig.InviteMessageTemplate\":\"object\",\"AliasAttributes\":\"array\",\"AutoVerifiedAttributes\":\"array\",\"DeviceConfiguration\":\"object\",\"EmailConfiguration\":\"object\",\"EnabledMfas\":\"array\",\"IssuerConfiguration\":\"object\",\"KeyConfiguration\":\"object\",\"LambdaConfig\":\"object\",\"LambdaConfig.CustomEmailSender\":\"object\",\"LambdaConfig.CustomSMSSender\":\"object\",\"LambdaConfig.InboundFederation\":\"object\",\"LambdaConfig.PreTokenGenerationConfig\":\"object\",\"Policies\":\"object\",\"Policies.PasswordPolicy\":\"object\",\"Policies.SignInPolicy\":\"object\",\"Policies.SignInPolicy.AllowedFirstAuthFactors\":\"array\",\"Schema\":\"array\",\"Schema[]\":\"object\",\"Schema[].NumberAttributeConstraints\":\"object\",\"Schema[].StringAttributeConstraints\":\"object\",\"SmsConfiguration\":\"object\",\"SmsConfiguration.EumsSms\":\"object\",\"UserAttributeUpdateSettings\":\"object\",\"UserAttributeUpdateSettings.AttributesRequireVerificationBeforeUpdate\":\"array\",\"UserPoolAddOns\":\"object\",\"UserPoolAddOns.AdvancedSecurityAdditionalFlows\":\"object\",\"UserPoolTags\":\"object\",\"UsernameAttributes\":\"array\",\"UsernameConfiguration\":\"object\",\"VerificationMessageTemplate\":\"object\"}"],
 	["AWS::DLM::LifecyclePolicy", "{\"CrossRegionCopyTargets\":\"array\",\"CrossRegionCopyTargets[]\":\"object\",\"Exclusions\":\"object\",\"Exclusions.ExcludeTags\":\"array\",\"Exclusions.ExcludeTags[]\":\"object\",\"Exclusions.ExcludeVolumeTypes\":\"array\",\"PolicyDetails\":\"object\",\"PolicyDetails.Actions\":\"array\",\"PolicyDetails.Actions[]\":\"object\",\"PolicyDetails.Actions[].CrossRegionCopy\":\"array\",\"PolicyDetails.Actions[].CrossRegionCopy[]\":\"object\",\"PolicyDetails.Actions[].CrossRegionCopy[].EncryptionConfiguration\":\"object\",\"PolicyDetails.Actions[].CrossRegionCopy[].RetainRule\":\"object\",\"PolicyDetails.CrossRegionCopyTargets\":\"array\",\"PolicyDetails.CrossRegionCopyTargets[]\":\"object\",\"PolicyDetails.EventSource\":\"object\",\"PolicyDetails.EventSource.Parameters\":\"object\",\"PolicyDetails.EventSource.Parameters.SnapshotOwner\":\"array\",\"PolicyDetails.Exclusions\":\"object\",\"PolicyDetails.Exclusions.ExcludeTags\":\"array\",\"PolicyDetails.Exclusions.ExcludeTags[]\":\"object\",\"PolicyDetails.Exclusions.ExcludeVolumeTypes\":\"array\",\"PolicyDetails.Parameters\":\"object\",\"PolicyDetails.Parameters.ExcludeDataVolumeTags\":\"array\",\"PolicyDetails.Parameters.ExcludeDataVolumeTags[]\":\"object\",\"PolicyDetails.ResourceLocations\":\"array\",\"PolicyDetails.ResourceTypes\":\"array\",\"PolicyDetails.Schedules\":\"array\",\"PolicyDetails.Schedules[]\":\"object\",\"PolicyDetails.Schedules[].ArchiveRule\":\"object\",\"PolicyDetails.Schedules[].ArchiveRule.RetainRule\":\"object\",\"PolicyDetails.Schedules[].ArchiveRule.RetainRule.RetentionArchiveTier\":\"object\",\"PolicyDetails.Schedules[].CreateRule\":\"object\",\"PolicyDetails.Schedules[].CreateRule.Scripts\":\"array\",\"PolicyDetails.Schedules[].CreateRule.Scripts[]\":\"object\",\"PolicyDetails.Schedules[].CreateRule.Scripts[].Stages\":\"array\",\"PolicyDetails.Schedules[].CreateRule.Times\":\"array\",\"PolicyDetails.Schedules[].CrossRegionCopyRules\":\"array\",\"PolicyDetails.Schedules[].CrossRegionCopyRules[]\":\"object\",\"PolicyDetails.Schedules[].CrossRegionCopyRules[].DeprecateRule\":\"object\",\"PolicyDetails.Schedules[].CrossRegionCopyRules[].RetainRule\":\"object\",\"PolicyDetails.Schedules[].DeprecateRule\":\"object\",\"PolicyDetails.Schedules[].FastRestoreRule\":\"object\",\"PolicyDetails.Schedules[].FastRestoreRule.AvailabilityZoneIds\":\"array\",\"PolicyDetails.Schedules[].FastRestoreRule.AvailabilityZones\":\"array\",\"PolicyDetails.Schedules[].RetainRule\":\"object\",\"PolicyDetails.Schedules[].ShareRules\":\"array\",\"PolicyDetails.Schedules[].ShareRules[]\":\"object\",\"PolicyDetails.Schedules[].ShareRules[].TargetAccounts\":\"array\",\"PolicyDetails.Schedules[].TagsToAdd\":\"array\",\"PolicyDetails.Schedules[].TagsToAdd[]\":\"object\",\"PolicyDetails.Schedules[].VariableTags\":\"array\",\"PolicyDetails.Schedules[].VariableTags[]\":\"object\",\"PolicyDetails.TargetTags\":\"array\",\"PolicyDetails.TargetTags[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
@@ -30213,7 +30237,9 @@ var ProviderRegistry = class {
 		if (this.providers.get(resourceType)?.disableCcApiFallback === true) return "the type's SDK provider opts out of the Cloud Control fallback (disableCcApiFallback)";
 	}
 	buildUnroutableSilentDropMessage(resourceType, drops, reason) {
-		return `${resourceType} uses properties cdkd's SDK Provider does not handle, and this type cannot fall back to Cloud Control API (${reason}):\n${drops.map((d) => `  - ${d.property}: ${d.rationale}`).join("\n")}\nRemove the properties, or force the SDK provider path and accept the drop via --prefer-sdk-route ${drops.map((d) => `${resourceType}:${d.property}`).join(",")} (the provider may still reject the resource if the property is required).`;
+		const details = drops.map((d) => safeMsg`  - ${d.property}: ${d.rationale}`).join("\n");
+		const overrideHint = drops.map((d) => safeMsg`${resourceType}:${d.property}`).join(",");
+		return safeMsg`${resourceType} uses properties cdkd's SDK Provider does not handle, and ` + safeMsg`this type cannot fall back to Cloud Control API (${reason}):\n` + `${details}\nRemove the properties, or force the SDK provider path and accept the drop via --prefer-sdk-route ${overrideHint} (the provider may still reject the resource if the property is required).`;
 	}
 	getProvider(resourceType) {
 		return this.getProviderFor({ resourceType }).provider;
@@ -30287,7 +30313,7 @@ var ProviderRegistry = class {
 			const autoRouted = [...drops.map(({ property }) => property).filter((property) => !this.allowedUnsupportedProperties.has(`${resourceType}:${property}`)), ...unrecognizedRoute].sort((a, b) => a.localeCompare(b));
 			if (autoRouted.length > 0) {
 				const unroutable = this.ccRouteUnavailableReason(resourceType);
-				if (unroutable !== void 0) throw new Error(`${logicalId}: ${this.buildUnroutableSilentDropMessage(resourceType, drops.filter((d) => autoRouted.includes(d.property)), unroutable)}`);
+				if (unroutable !== void 0) throw new Error(safeMsg`${logicalId}: ` + this.buildUnroutableSilentDropMessage(resourceType, drops.filter((d) => autoRouted.includes(d.property)), unroutable));
 				const propList = autoRouted.join(", ");
 				const overrideHint = autoRouted.map((p) => `${resourceType}:${p}`).join(",");
 				const message = `${logicalId} (${resourceType}): routing via Cloud Control API (cdkd's SDK Provider does not yet wire ${propList} — CC API will forward the full property map.${unrecognizedRoute.length === 0 ? "" : ` ${unrecognizedRoute.join(", ")} ${unrecognizedRoute.length === 1 ? "is" : "are"} not in cdkd's CFn schema snapshot: Cloud Control applies a property AWS published since, and rejects a misspelled one as CloudFormation does.`} Override via --prefer-sdk-route ${overrideHint}.)`;
@@ -32437,9 +32463,9 @@ function handleOutputResolutionFailure(error, outputKey, outputs, secrets, inher
 	const detail = maskSecretsInText(error instanceof Error ? error.message || error.name : String(error), union);
 	if (this.options.strictGetAtt) {
 		const cause = typeof error === "string" ? maskSecretsInText(error, union) : maskSecretsInError(error, union);
-		throw new Error(`Failed to resolve output ${outputKey}: ${detail} (--strict-getatt promotes output resolution failures to deploy errors; drop the flag to skip the output instead)`, cause instanceof Error || typeof cause === "string" ? { cause } : {});
+		throw new Error(safeMsg`Failed to resolve output ${outputKey} ` + `(--strict-getatt promotes output resolution failures to deploy errors; ` + safeMsg`drop the flag to skip the output instead): ${asIsMessage(detail)}`, cause instanceof Error || typeof cause === "string" ? { cause } : {});
 	}
-	this.logger.warn(`Failed to resolve output ${outputKey}: ${detail}`);
+	this.logger.warn(safeMsg`Failed to resolve output ${outputKey}: ${asIsMessage(detail)}`);
 	outputs[outputKey] = void 0;
 }
 async function resolveOutputs(template, resources, stackName, digestSource, parameterValues, conditions) {
@@ -32460,7 +32486,7 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 	const refuseMaskedOutputReads = (outputKey, ownReads) => {
 		const added = ownReads.filter((read) => read.kind === "ref-state-key");
 		if (added.length === 0) return;
-		throw markNonRetryable(/* @__PURE__ */ new Error(`Cannot resolve ${added.map((read) => read.display).join(", ")} for output ${outputKey}: cdkd's recorded state holds only the redaction mask there, so this output would publish a value cdkd cannot confirm (for most such types the resource's raw physical id) instead of the value CloudFormation's Ref returns — a possibly wrong value that a consuming stack's Fn::ImportValue would accept and send to AWS. The output is not published. ${DeployEngine.maskedRecordRemedyFor(added, context.resources)}`));
+		throw markNonRetryable(/* @__PURE__ */ new Error(safeMsg`Cannot resolve ${added.map((read) => read.display).join(", ")} for output ${outputKey}: cdkd's recorded state ` + `holds only the redaction mask there, so this output would publish a value cdkd cannot confirm (for most such types the resource's raw physical id) instead of the value CloudFormation's Ref returns — a possibly wrong value that a consuming stack's Fn::ImportValue would accept and send to AWS. The output is not published. ${DeployEngine.maskedRecordRemedyFor(added, context.resources)}`));
 	};
 	const outputsPassSecrets = context.recordedSecretValues ?? EMPTY_SECRETS;
 	const outputsPassInherited = context.inheritedSecrets ?? EMPTY_SECRETS;
@@ -32470,7 +32496,7 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 	try {
 		for (const [outputKey, output] of Object.entries(template.Outputs)) {
 			if (isOutputSuppressedByCondition(output, conditions)) {
-				this.logger.debug(`Skipping output ${outputKey} — condition ${output.Condition} is false`);
+				this.logger.debug(safeMsg`Skipping output ${outputKey} — condition ${output.Condition} is false`);
 				continue;
 			}
 			const ownReads = [];
@@ -36064,11 +36090,11 @@ async function adoptRollbackOrphans(currentState, effectiveTemplate) {
 	for (const notice of plan.notices) this.logger.info(maskSecretsInText(notice, named));
 	const adoptedFrom = /* @__PURE__ */ new Map();
 	adoptedOrphanRecords.set(this, adoptedFrom);
-	if (plan.refusals.length > 0) throw new Error(`Deploy refused — cdkd left ${plan.refusals.length} resource(s) in AWS that it cannot safely re-adopt:\n  ${plan.refusals.map((r) => maskSecretsInText(r, named)).join("\n  ")}`);
+	if (plan.refusals.length > 0) throw new Error(safeMsg`Deploy refused — cdkd left ${plan.refusals.length} resource(s) in AWS that it cannot ` + "safely re-adopt:" + plan.refusals.map((r) => safeMsg`\n  ${maskSecretsInText(r, named)}`).join(""));
 	for (const [logicalId, record] of Object.entries(plan.adopted)) {
 		adoptedFrom.set(logicalId, records.findLast((r) => r.logicalId === logicalId)?.state);
 		currentState.resources[logicalId] = record;
-		this.logger.info(`Adopting ${displayIdent(logicalId)} (${displayIdent(record.resourceType)}) left in AWS by an earlier rollback as ${displaySafe(maskSecretsInText(record.physicalId, named))}`);
+		this.logger.info(safeMsg`Adopting ${displayIdent(logicalId)} (${displayIdent(record.resourceType)}) left in AWS ` + safeMsg`by an earlier rollback as ${displaySafe(maskSecretsInText(record.physicalId, named))}`);
 	}
 	if (records.length > 0) currentState.orphans = plan.remaining;
 	return plan;
@@ -36245,7 +36271,7 @@ async function deleteRollbackJournalBestEffort(stackName, supersededLogicalIds =
 	try {
 		deleted = await this.stateBackend.deleteRollbackJournal(stackName, this.stackRegion);
 	} catch (err) {
-		this.logger.debug(safeMsg`Failed to delete rollback journal for ${stackName}: ${err instanceof Error ? err.message : String(err)}`);
+		this.logger.debug(safeMsg`Failed to delete rollback journal for ${displayStackName(stackName)}: ${err instanceof Error ? err.message : String(err)}`);
 		deleted = false;
 	}
 	if (deleted !== false) return true;
@@ -36253,7 +36279,7 @@ async function deleteRollbackJournalBestEffort(stackName, supersededLogicalIds =
 	try {
 		await this.stateBackend.markRollbackJournalSuperseded(stackName, this.stackRegion, supersededLogicalIds);
 	} catch (markErr) {
-		this.logger.debug(safeMsg`Failed to record superseded logical ids on the rollback journal for ${stackName}: ${markErr instanceof Error ? markErr.message : String(markErr)}`);
+		this.logger.debug(safeMsg`Failed to record superseded logical ids on the rollback journal for ${displayStackName(stackName)}: ${markErr instanceof Error ? markErr.message : String(markErr)}`);
 	}
 	return false;
 }
@@ -36262,7 +36288,7 @@ async function settleJournalAfterCleanRollback(stackName, failedOperations, init
 		try {
 			await this.stateBackend.popRollbackJournalSegment(stackName, this.stackRegion);
 		} catch (err) {
-			this.logger.debug(`Failed to pop the rollback journal segment after the clean rollback: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(safeMsg`Failed to pop the rollback journal segment after the clean rollback: ${asIsMessage(err instanceof Error ? err.message : String(err))}`);
 			return false;
 		}
 		return true;
@@ -36274,7 +36300,7 @@ async function settleJournalAfterCleanRollback(stackName, failedOperations, init
 		return false;
 	}
 	if (!await this.writeRollbackJournalSegment(stackName, [], failedOperations, "auto-rollback-clean", initialDeploy)) return true;
-	this.logger.info(`The automatic rollback restored the pre-deploy state. The failed resource's pre-failure record was kept — if it was left partially applied, revert it.\nRevert it with: ${pasteableCommand("cdkd rollback", [{
+	this.logger.info("The automatic rollback restored the pre-deploy state. The failed resource's pre-failure record was kept — if it was left partially applied, revert it." + safeMsg`\nRevert it with: ${pasteableCommand("cdkd rollback", [{
 		value: stackName,
 		hole: "stack"
 	}, { literal: "--revert-failed" }]).command}`);
@@ -36342,10 +36368,10 @@ async function writeRollbackJournalSegment(stackName, completedOperations, faile
 			...nestedPending?.previousCrossStackReads && { previousCrossStackReads: nestedPending.previousCrossStackReads }
 		};
 		await this.stateBackend.appendRollbackJournalSegment(stackName, this.stackRegion, segment);
-		this.logger.debug(`Rollback journal segment written (${reason})`);
+		this.logger.debug(safeMsg`Rollback journal segment written (${reason})`);
 		return true;
 	} catch (journalError) {
-		this.logger.warn(`Failed to write rollback journal: ${journalError instanceof Error ? journalError.message : String(journalError)}. 'cdkd rollback' will NOT be able to revert this deploy — use 'cdkd deploy' to resume or 'cdkd destroy' to clean up.`);
+		this.logger.warn(safeMsg`Failed to write rollback journal: ${asIsMessage(journalError instanceof Error ? journalError.message : String(journalError))}. ` + `'cdkd rollback' will NOT be able to revert this deploy — use 'cdkd deploy' to resume or 'cdkd destroy' to clean up.`);
 		return false;
 	}
 }
@@ -36660,7 +36686,7 @@ function kickOffObservedCapture(provider, logicalId, physicalId, resourceType, r
 			this.printingSecretsFor(logicalId),
 			this.fingerprintNoEchoValues
 		]);
-		this.logger.debug(mask(`observedProperties capture for ${logicalId} (${resourceType}) failed: ${err instanceof Error ? err.message : String(err)} — drift will fall back to template properties for this resource until the next successful deploy.`));
+		this.logger.debug(safeMsg`observedProperties capture for ${mask(logicalId)} (${mask(resourceType)}) failed: ${asIsMessage(mask(err instanceof Error ? err.message : String(err)))} — drift will fall back to template properties for this resource until the next successful deploy.`);
 	});
 	const promise = secrets === void 0 ? read() : withCurrentResourceSecrets(secrets, read);
 	this.observedCaptureTasks.set(logicalId, promise);
@@ -36754,8 +36780,8 @@ function stampReasonlessParameterRefusals(stateResources, template) {
 		};
 		stamped++;
 	}
-	if (namesParameter?.failedClosed !== void 0) this.logger.debug(`The template's parameter dependence could not be judged (${namesParameter.failedClosed}): every observed-baseline refusal recorded without a reason is treated as an unverifiable-parameter refusal (${stamped} stamped).`);
-	if (stamped > 0) this.logger.debug(`${stamped} resource(s) carry an observed-baseline refusal recorded without a reason by an older cdkd, and their template definition reads a template parameter: treated as an unverifiable-parameter refusal (kept until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter).`);
+	if (namesParameter?.failedClosed !== void 0) this.logger.debug(safeMsg`The template's parameter dependence could not be judged (${namesParameter.failedClosed}): every observed-baseline refusal recorded without a reason is treated as an unverifiable-parameter refusal (${stamped} stamped).`);
+	if (stamped > 0) this.logger.debug(safeMsg`${stamped} resource(s) carry an observed-baseline refusal recorded without a reason by an older cdkd, and their template definition reads a template parameter: treated as an unverifiable-parameter refusal (kept until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter).`);
 }
 function kickOffAutoRefreshObservedProperties(stateResources, crossStackReads) {
 	if (this.options.captureObservedState !== true) return;
@@ -36782,7 +36808,7 @@ function kickOffAutoRefreshObservedProperties(stateResources, crossStackReads) {
 			resource
 		});
 	}
-	if (refused > 0) this.logger.debug(`observed-properties auto-refresh SKIPPED for ${refused} resource(s) whose baseline a 'cdkd import' run refused: their recorded properties cannot position the redaction, so capturing an AWS readback against them could persist a resolved secret in plaintext. A deploy that actually CHANGES one of them restores its baseline, unless the refusal is an unverifiable-parameter one (only a replacement or a proving re-import discharges that); a NO_CHANGE deploy never does.`);
+	if (refused > 0) this.logger.debug(safeMsg`observed-properties auto-refresh SKIPPED for ${refused} resource(s) whose baseline a 'cdkd import' run refused: their recorded properties cannot position the redaction, so capturing an AWS readback against them could persist a resolved secret in plaintext. A deploy that actually CHANGES one of them restores its baseline, unless the refusal is an unverifiable-parameter one (only a replacement or a proving re-import discharges that); a NO_CHANGE deploy never does.`);
 	if (candidates.length === 0 && masked.length === 0) return;
 	const allSiblings = {};
 	for (const [lid, res] of Object.entries(stateResources)) allSiblings[lid] = {
@@ -36810,7 +36836,7 @@ function kickOffAutoRefreshObservedProperties(stateResources, crossStackReads) {
 		} : void 0);
 		toRefresh++;
 	}
-	if (toRefresh > 0) this.logger.warn(`cdkd state schema upgrade detected — refreshing observed-properties baseline for ${toRefresh} resource(s) (one-time, runs in parallel with deploy)`);
+	if (toRefresh > 0) this.logger.warn(safeMsg`cdkd state schema upgrade detected — refreshing observed-properties baseline for ${toRefresh} resource(s) (one-time, runs in parallel with deploy)`);
 	let producerRegions = [];
 	if (masked.length > 0) try {
 		producerRegions = producerRegionsFromState(crossStackReads);
@@ -36974,9 +37000,9 @@ function refuseRedactedAttributeReads(logicalId, resourceType, context) {
 	if (reads === void 0 || reads.length === 0) return;
 	if (reads.every((read) => read.kind === "attribute" && read.declaredNoEcho === true)) {
 		const producers = [...new Set(reads.map((read) => read.logicalId).filter((id) => !!id))];
-		throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: ${producers.map((id) => displayIdent(id)).join(", ")} declared ${reads.length === 1 ? "that attribute" : "those attributes"} NoEcho, so cdkd's recorded state holds only the redaction mask for ${reads.length === 1 ? "it" : "them"}, and cdkd does not re-run a producer to recover a value. Remedy: deploy a change to the producer in the SAME run as ${logicalId} (for a custom resource, change one of its properties, e.g. a nonce / version property, so its handler runs again and supplies the value), or stop declaring the value NoEcho.`, resourceType, logicalId);
+		throw new ProvisioningError(safeMsg`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: ` + safeMsg`${producers.map((id) => displayIdent(id)).join(", ")} declared ${reads.length === 1 ? "that attribute" : "those attributes"} NoEcho, ` + safeMsg`so cdkd's recorded state holds only the redaction mask for ${reads.length === 1 ? "it" : "them"}, ` + `and cdkd does not re-run a producer to recover a value. Remedy: deploy a change to the ` + safeMsg`producer in the SAME run as ${logicalId} (for a custom resource, change one of its ` + "properties, e.g. a nonce / version property, so its handler runs again and supplies the value), or stop declaring the value NoEcho.", resourceType, logicalId);
 	}
-	throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the redaction mask there, and the value is not recoverable from state. There are three ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all, or cdkd deploy '**' when either is inside a CDK Stage) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The value holds the Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records — so a deploy that leaves the resource or output holding it unchanged reads the mask again, and a re-import does not recover it. Remedy: have this resource build the value itself from the SECRET's own reference (the {{resolve:secretsmanager:...}} or {{resolve:ssm-secure:...}} reference, or a {{resolve:ssm:...}} of a SecureString parameter, that the encoding was made from) under its own Fn::Base64, instead of reading it from another resource's attribute or another stack's output — not by a {{resolve:ssm:...}} read of a String parameter holding the encoding, which cdkd treats as public and would record in state in the clear. (3) The resource is recorded through the Cloud Control fallback (by a deploy or by 'cdkd import'), which keeps in the clear only the Fn::GetAtt attributes it can vouch for and masks the rest. If the name above is not an Fn::GetAtt attribute CloudFormation accepts for that resource type, no record will ever hold it: stop reading it. If it is one, 'cdkd import' masked it because it could not vouch for the value, or could not read the schema and warned about it when it happened (if that warning named a missing cloudformation:DescribeType permission, grant it first); a deploy that creates or updates the resource records it, unless its value came from a secret. See https://github.com/go-to-k/cdkd/issues/2449. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources, true)}`, resourceType, logicalId);
+	throw new ProvisioningError(safeMsg`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the ` + `redaction mask there, and the value is not recoverable from state. There are three ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all, or cdkd deploy '**' when either is inside a CDK Stage) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The value holds the Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records — so a deploy that leaves the resource or output holding it unchanged reads the mask again, and a re-import does not recover it. Remedy: have this resource build the value itself from the SECRET's own reference (the {{resolve:secretsmanager:...}} or {{resolve:ssm-secure:...}} reference, or a {{resolve:ssm:...}} of a SecureString parameter, that the encoding was made from) under its own Fn::Base64, instead of reading it from another resource's attribute or another stack's output — not by a {{resolve:ssm:...}} read of a String parameter holding the encoding, which cdkd treats as public and would record in state in the clear. (3) The resource is recorded through the Cloud Control fallback (by a deploy or by 'cdkd import'), which keeps in the clear only the Fn::GetAtt attributes it can vouch for and masks the rest. If the name above is not an Fn::GetAtt attribute CloudFormation accepts for that resource type, no record will ever hold it: stop reading it. If it is one, 'cdkd import' masked it because it could not vouch for the value, or could not read the schema and warned about it when it happened (if that warning named a missing cloudformation:DescribeType permission, grant it first); a deploy that creates or updates the resource records it, unless its value came from a secret. See https://github.com/go-to-k/cdkd/issues/2449. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources, true)}`, resourceType, logicalId);
 }
 function allRecordedSecrets() {
 	const all = /* @__PURE__ */ new Map();
@@ -37168,7 +37194,8 @@ async function replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourc
 			maskSecrets: createUnionSecretMasker([secrets, this.secretNameBagFor(logicalId)])
 		}));
 	} catch (deleteError) {
-		throw new Error(maskSecretsInText(`Failed to delete old resource ${logicalId} (${currentResource.physicalId}) during the --replace delete-first fallback: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`, secrets), { cause: deleteError instanceof Error ? maskSecretsInError(deleteError, secrets) : void 0 });
+		const shownSecrets = unionOfSecretBags([secrets, this.printingSecretsFor(logicalId)]);
+		throw new Error(safeMsg`Failed to delete old resource ${maskSecretsInText(logicalId, shownSecrets)} ` + safeMsg`(${maskSecretsInText(currentResource.physicalId, shownSecrets)}) ` + `during the --replace delete-first fallback: ` + safeMsg`${asIsMessage(maskSecretsInText(deleteError instanceof Error ? deleteError.message : String(deleteError), shownSecrets))}`, { cause: deleteError instanceof Error ? maskSecretsInError(deleteError, secrets) : void 0 });
 	}
 	reportDeleteGuards(deleteResult, {
 		physicalId: currentResource.physicalId,
@@ -37177,9 +37204,9 @@ async function replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourc
 	});
 	const replaceSkipReason = deleteSkipReason(deleteResult);
 	if (replaceSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, replaceSkipReason, "during the --replace delete-first fallback"));
-	this.logger.info(`  ${green("✓")} Old resource deleted`);
+	this.logger.info(safeMsg`  ${green("✓")} Old resource deleted`);
 	this.oldDeletedBeforeCreate.add(logicalId);
-	this.logger.info(`  Re-creating ${logicalId}...`);
+	this.logger.info(safeMsg`  Re-creating ${logicalId}...`);
 	try {
 		return await withRetry(() => this.withRetry(() => withCurrentResourceSecrets(secrets, () => replaceProvider.create(logicalId, resourceType, replaceProps, createContext)), logicalId, void 0, void 0, replaceProvider), logicalId, {
 			maxRetries: 8,
@@ -37191,7 +37218,8 @@ async function replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourc
 			isRetryable: isRecreateRetryableError
 		});
 	} catch (recreateError) {
-		throw new Error(maskSecretsInText(`Failed to re-create ${logicalId} after the --replace delete-first fallback already deleted the old resource (${currentResource.physicalId}): ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. Re-run the deploy to create it fresh.`, secrets), { cause: recreateError instanceof Error ? maskSecretsInError(recreateError, secrets) : void 0 });
+		const shownSecrets = unionOfSecretBags([secrets, this.printingSecretsFor(logicalId)]);
+		throw new Error(safeMsg`Failed to re-create ${maskSecretsInText(logicalId, shownSecrets)} after the ` + safeMsg`--replace delete-first fallback already deleted the old resource (${maskSecretsInText(currentResource.physicalId, shownSecrets)}). ` + safeMsg`Re-run the deploy to create it fresh. Cause: ${asIsMessage(maskSecretsInText(recreateError instanceof Error ? recreateError.message : String(recreateError), shownSecrets))}`, { cause: recreateError instanceof Error ? maskSecretsInError(recreateError, secrets) : void 0 });
 	}
 }
 function typeChangeNameQuestion(resourceType, input) {
@@ -37283,7 +37311,7 @@ async function createFirstThenDeleteOld(input) {
 	await this.deleteReplacedAfterCreate(logicalId, input.oldResourceType, currentResource, input.deleteProvider, input.deleteProperties, finalSnapshotIdentifier, input.deletePolicy, secrets, input.deleteProvisionedBy, input.noEchoDeleteValues);
 	return createResult;
 }
-async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, deleteProvider, deleteProperties, finalSnapshotIdentifier, updateReplacePolicy, secrets, deleteProvisionedBy, noEchoDeleteValues) {
+async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, deleteProvider, deleteProperties, finalSnapshotIdentifier, updateReplacePolicy, secrets, deleteProvisionedBy, noEchoDeleteValues, isRetry = false) {
 	let deleteResult = void 0;
 	let deleteFailed = false;
 	const inlinePolicyClaimed = isStandaloneInlinePolicyType(oldResourceType) ? this.inlinePolicyClaimedFor(oldResourceType, logicalId, this.deployStateResources) : void 0;
@@ -37302,6 +37330,18 @@ async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentReso
 	} catch (deleteError) {
 		const deleteMsg = maskSecretsInText(deleteError instanceof Error ? deleteError.message : String(deleteError), secrets);
 		deleteFailed = true;
+		const deferred = this.deferredReplacedDeletes;
+		if (!isRetry && deferred !== void 0) {
+			this.logger.info(safeMsg`  Could not delete old ${logicalId} (${currentResource.physicalId}) yet: ${deleteMsg}. Retrying after the rest of the deploy.`);
+			deferred.set(logicalId, {
+				physicalId: currentResource.physicalId,
+				resourceType: oldResourceType,
+				provisionedBy: deleteProvisionedBy,
+				failureMessage: deleteMsg,
+				retry: () => this.deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, deleteProvider, deleteProperties, finalSnapshotIdentifier, updateReplacePolicy, secrets, deleteProvisionedBy, noEchoDeleteValues, true)
+			});
+			return;
+		}
 		this.logger.warn(safeMsg`  ⚠ Failed to delete old resource ${logicalId} (${currentResource.physicalId}): ${deleteMsg}`);
 	}
 	reportDeleteGuards(deleteResult, {
@@ -37312,8 +37352,67 @@ async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentReso
 	const skipReason = deleteSkipReason(deleteResult);
 	if (skipReason !== void 0) {
 		this.replacedDeleteSkips.set(logicalId, `the replaced ${oldResourceType} (${currentResource.physicalId}) was not deleted (${skipReason}) and is no longer tracked by cdkd`);
-		this.logger.warn(`  ⚠ ${deleteSkippedMessage(logicalId, currentResource.physicalId, skipReason, "while cleaning up the replaced resource", { commandFreeLine: true })}. Delete it manually — it is no longer tracked in state.`);
-	} else if (!deleteFailed) this.logger.info(`  ${green("✓")} Old resource deleted`);
+		this.logger.warn(safeMsg`  ⚠ ${deleteSkippedMessage(logicalId, currentResource.physicalId, skipReason, "while cleaning up the replaced resource", { commandFreeLine: true })}. Delete it manually — it is no longer tracked in state.`);
+	} else if (!deleteFailed) this.logger.info(isRetry ? safeMsg`  ${green("✓")} Old ${logicalId} (${currentResource.physicalId}) deleted` : safeMsg`  ${green("✓")} Old resource deleted`);
+}
+async function retryDeferredReplacedDeletes(stackName, counts) {
+	const deferred = this.deferredReplacedDeletes;
+	this.deferredReplacedDeletes = void 0;
+	if (deferred === void 0 || deferred.size === 0) return;
+	this.logger.info(safeMsg`Retrying the delete of ${deferred.size} replaced resource(s)`);
+	const retryOne = async (logicalId, entry) => {
+		const guards = [];
+		try {
+			await withPrintingSecrets(this.secretNameBagFor(logicalId), () => withStackRecords(this.stackRecordsView, () => collectDeleteGuards(guards, async () => {
+				this.logger.info(safeMsg`  Deleting old ${logicalId} (${entry.physicalId})...`);
+				try {
+					await entry.retry();
+				} catch {
+					this.logger.warn(safeMsg`  ⚠ Failed to delete old resource ${logicalId} (${entry.physicalId}): the retry failed unexpectedly`);
+				}
+			})));
+		} finally {
+			for (const guard of guards) this.recordEvent({
+				eventType: "RESOURCE_GUARD_INDETERMINATE",
+				stackName,
+				operation: "DELETE",
+				logicalId,
+				resourceType: guard.resourceType,
+				...guard.provisionedBy && { provisionedBy: guard.provisionedBy },
+				...guard.physicalId && { physicalId: maskSecretsInText(guard.physicalId, this.perResourceSecrets.get(logicalId) ?? EMPTY_SECRETS) },
+				guard: guard.guard,
+				reason: guard.reason
+			});
+		}
+		const skip = this.replacedDeleteSkips.get(logicalId);
+		if (skip === void 0) return;
+		this.replacedDeleteSkips.delete(logicalId);
+		if (entry.rowPartial !== true) {
+			counts.updated = Math.max(0, counts.updated - 1);
+			counts.updatePartial++;
+		}
+		this.recordEvent({
+			eventType: "RESOURCE_SKIPPED",
+			stackName,
+			operation: "UPDATE",
+			logicalId,
+			resourceType: entry.resourceType,
+			...entry.provisionedBy && { provisionedBy: entry.provisionedBy },
+			physicalId: entry.physicalId,
+			reason: skip
+		});
+	};
+	const queue = [...deferred];
+	const workers = Math.max(1, Math.min(this.options.concurrency ?? 1, queue.length));
+	await Promise.all(Array.from({ length: workers }, async () => {
+		for (let next = queue.shift(); next !== void 0; next = queue.shift()) await retryOne(...next);
+	}));
+}
+function warnUnretriedReplacedDeletes(why) {
+	const deferred = this.deferredReplacedDeletes;
+	this.deferredReplacedDeletes = void 0;
+	const note = why === "failed" ? "not retried: the deploy failed first" : "not retried: the deploy was interrupted";
+	for (const [logicalId, entry] of deferred ?? []) withPrintingSecrets(this.secretNameBagFor(logicalId), () => this.logger.warn(safeMsg`  ⚠ Failed to delete old resource ${logicalId} (${entry.physicalId}): ${entry.failureMessage} (${note})`));
 }
 
 //#endregion
@@ -37417,7 +37516,7 @@ async function readStaleAttributes(logicalId, resource, stackName) {
 		resourceType: resource.resourceType,
 		attributes
 	});
-	this.logger.debug(`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS — its state record lacked one a Fn::GetAtt asked for: ${Object.keys(attributes).length} attribute(s) read`);
+	this.logger.debug(safeMsg`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS — its state record lacked one a Fn::GetAtt asked for: ${Object.keys(attributes).length} attribute(s) read`);
 	return outcome;
 }
 function withHealedAttributes(logicalId, record) {
@@ -37444,8 +37543,8 @@ function auditResolvedAssetReferences(logicalId, resourceType, resolvedProps) {
 	if (!redirect) return;
 	const findings = findUnrewrittenAssetReferences(resolvedProps, redirect);
 	if (findings.length === 0) return;
-	const detail = findings.map((f) => `  - ${f.path}: still references '${f.source}'`).join("\n");
-	throw new ProvisioningError(`Unrewritten asset reference on '${logicalId}' (${resourceType}): this region uses cdkd-owned asset storage, but the following resolved properties still point at the CDK bootstrap storage that 'cdk gc' may garbage-collect:\n${detail}\nThis is a template shape cdkd's asset-reference rewrite did not cover — deploying it would split-brain the stack (assets in cdkd storage, properties reading the CDK bucket). Please report this at https://github.com/go-to-k/cdkd/issues with the property shape. Workaround: deploy with --use-cdk-bootstrap-assets to pin the legacy destinations for this app.`, resourceType, logicalId);
+	const detail = findings.map((f) => safeMsg`  - ${f.path}: still references '${f.source}'`).join("\n");
+	throw new ProvisioningError(safeMsg`Unrewritten asset reference on '${logicalId}' (${resourceType}): this region uses ` + `cdkd-owned asset storage, but the following resolved properties still point at the CDK bootstrap storage that 'cdk gc' may garbage-collect:\n${detail}\nThis is a template shape cdkd's asset-reference rewrite did not cover — deploying it would split-brain the stack (assets in cdkd storage, properties reading the CDK bucket). Please report this at https://github.com/go-to-k/cdkd/issues with the property shape. Workaround: deploy with --use-cdk-bootstrap-assets to pin the legacy destinations for this app.`, resourceType, logicalId);
 }
 function extractAllDependencies(template, logicalId) {
 	const resource = template?.Resources?.[logicalId];
@@ -37735,7 +37834,7 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 	if (progress) progress.current++;
 	const createPrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
 	renderer.removeTask(logicalId);
-	this.logger.info(`${createPrefix}${formatResourceLine("created", logicalId, resourceType)}`);
+	this.logger.info(safeMsg`${createPrefix}${formatResourceLine("created", logicalId, resourceType)}`);
 }
 async function refuseUnlicensedGeneratedName(input) {
 	const { logicalId, resourceType } = input;
@@ -43082,20 +43181,20 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 		if (statefulReason && this.options.forceStatefulRecreation !== true) {
 			const immutableProps = change.propertyChanges?.filter((pc) => pc.requiresReplacement).map((pc) => pc.path).join(", ") || "Type";
 			const protection = recordedProtectionEvidence(oldResourceType, currentProps, currentResource.observedProperties, this.stackRegion);
-			throw markNonRetryable(new CdkdError(`${logicalId} (${oldResourceType}) requires replacement (immutable property changed: ${immutableProps}${typeChanged ? `, to ${resourceType}` : ""}) but it is a stateful resource — ${renderStatefulReason(statefulReason)}. ` + (protection ? `${recordedProtectionNote(protection, "--force-stateful-recreation")} Or change the resource's definition to avoid the immutable-property change.` : "Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change."), "STATEFUL_REPLACE_BLOCKED"));
+			throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${oldResourceType}) requires replacement (immutable property changed: ${immutableProps}${typeChanged ? `, to ${resourceType}` : ""}) but it is a stateful resource — ` + safeMsg`${renderStatefulReason(statefulReason)}. ` + (protection ? safeMsg`${recordedProtectionNote(protection, "--force-stateful-recreation")} Or change ` + `the resource's definition to avoid the immutable-property change.` : "Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change."), "STATEFUL_REPLACE_BLOCKED"));
 		}
 	}
 	if (recreateViaCcApi) {
 		const noCcRoute = this.providerRegistry.ccRouteUnavailableReason(resourceType);
-		if (noCcRoute !== void 0) throw markNonRetryable(new CdkdError(`--recreate-via-cc-api cannot recreate ${logicalId} (${resourceType}): Cloud Control API cannot create this type (${noCcRoute}). Nothing was deleted. Drop ${logicalId} from --recreate-via-cc-api.`, "RECREATE_TARGETS_INVALID"));
+		if (noCcRoute !== void 0) throw markNonRetryable(new CdkdError(safeMsg`--recreate-via-cc-api cannot recreate ${logicalId} (${resourceType}): Cloud ` + safeMsg`Control API cannot create this type (${noCcRoute}). Nothing was deleted. ` + safeMsg`Drop ${logicalId} from --recreate-via-cc-api.`, "RECREATE_TARGETS_INVALID"));
 		const ccBroken = ccBrokenReason(resourceType);
-		if (ccBroken !== void 0) throw markNonRetryable(new CdkdError(`--recreate-via-cc-api cannot move ${logicalId} (${resourceType}) to Cloud Control: ${ccBroken}, so cdkd keeps it on its SDK provider. Nothing was deleted. Drop ${logicalId} from --recreate-via-cc-api.`, "RECREATE_TARGETS_INVALID"));
+		if (ccBroken !== void 0) throw markNonRetryable(new CdkdError(safeMsg`--recreate-via-cc-api cannot move ${logicalId} (${resourceType}) to Cloud ` + safeMsg`Control: ${ccBroken}, so cdkd keeps it on its SDK provider. Nothing was ` + safeMsg`deleted. Drop ${logicalId} from --recreate-via-cc-api.`, "RECREATE_TARGETS_INVALID"));
 	}
 	let replacementReason;
 	if (recreateViaCcApi) replacementReason = "--recreate-via-cc-api flag (mid-life SDK→CC migration)";
 	else if (recreateViaSdkProvider) replacementReason = "--recreate-via-sdk-provider flag (mid-life CC→SDK migration)";
 	else replacementReason = `immutable properties changed: ${change.propertyChanges?.filter((pc) => pc.requiresReplacement).map((pc) => pc.path).join(", ")}`;
-	this.logger.info(`Replacing ${logicalId} (${typeChanged ? `${oldResourceType} -> ${resourceType}` : resourceType}) - ${replacementReason}`);
+	this.logger.info(safeMsg`Replacing ${logicalId} (${typeChanged ? `${oldResourceType} -> ${resourceType}` : resourceType}) - ${replacementReason}`);
 	const recreateDirectionHint = recreateViaCcApi ? "cc-api" : recreateViaSdkProvider ? "sdk" : void 0;
 	const replaceDecision = this.providerRegistry.getProviderFor({
 		resourceType,
@@ -43164,9 +43263,9 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 		if (updateReplacePolicy === "Retain") {
 			this.retainedOldOnReplacement.add(logicalId);
 			await noteRetainedResource(oldResourceType, logicalId);
-			this.logger.warn(`  ⚠ ${logicalId} has UpdateReplacePolicy: Retain — ${recreateFlagName} will leak the old physical resource (${currentResource.physicalId}). The new resource shares the same name where applicable; if the type has user-supplied names (e.g. functionName, bucketName), the create will deterministically collide with the retained orphan.`);
+			this.logger.warn(safeMsg`  ⚠ ${logicalId} has UpdateReplacePolicy: Retain — ${recreateFlagName} will ` + safeMsg`leak the old physical resource (${currentResource.physicalId}). The new ` + "resource shares the same name where applicable; if the type has user-supplied names (e.g. functionName, bucketName), the create will deterministically collide with the retained orphan.");
 		} else {
-			this.logger.info(`  Destroying old ${logicalId} (${currentResource.physicalId}) before recreate...`);
+			this.logger.info(safeMsg`  Destroying old ${logicalId} (${currentResource.physicalId}) before recreate...`);
 			const recreateFinalSnapshotId = await this.prepareFinalSnapshotForDelete(logicalId, oldResourceType, currentResource, updateReplacePolicy);
 			let recreateDeleteResult;
 			try {
@@ -43181,7 +43280,8 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 					maskSecrets: createUnionSecretMasker([updateSecrets, this.secretNameBagFor(logicalId)])
 				}));
 			} catch (deleteError) {
-				throw new Error(maskSecretsInText(`Failed to destroy old resource ${logicalId} (${currentResource.physicalId}) during ${recreateFlagName}: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`, updateSecrets), { cause: deleteError instanceof Error ? maskSecretsInError(deleteError, updateSecrets) : void 0 });
+				const shownSecrets = unionOfSecretBags([updateSecrets, this.printingSecretsFor(logicalId)]);
+				throw new Error(safeMsg`Failed to destroy old resource ${maskSecretsInText(logicalId, shownSecrets)} ` + safeMsg`(${maskSecretsInText(currentResource.physicalId, shownSecrets)}) during ${recreateFlagName}: ` + safeMsg`${asIsMessage(maskSecretsInText(deleteError instanceof Error ? deleteError.message : String(deleteError), shownSecrets))}`, { cause: deleteError instanceof Error ? maskSecretsInError(deleteError, updateSecrets) : void 0 });
 			}
 			reportDeleteGuards(recreateDeleteResult, {
 				physicalId: currentResource.physicalId,
@@ -43190,10 +43290,10 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			});
 			const recreateSkipReason = deleteSkipReason(recreateDeleteResult);
 			if (recreateSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, recreateSkipReason, `during ${recreateFlagName}`));
-			this.logger.info(`  ${green("✓")} Old resource deleted`);
+			this.logger.info(safeMsg`  ${green("✓")} Old resource deleted`);
 			this.oldDeletedBeforeCreate.add(logicalId);
 		}
-		this.logger.info(`  Creating new ${logicalId}...`);
+		this.logger.info(safeMsg`  Creating new ${logicalId}...`);
 		createResult = await withRetry(() => this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replaceProvider.create(logicalId, resourceType, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replaceProvider), logicalId, {
 			maxRetries: 8,
 			initialDelayMs: 2e3,
@@ -43203,9 +43303,9 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			onInterrupted: () => new InterruptedError(this.interruptCause ?? "user"),
 			isRetryable: isRecreateRetryableError
 		});
-		if (equalIdIsSameResource && updateReplacePolicy === "Retain" && createResult.physicalId === currentResource.physicalId) throw new CdkdError(`${logicalId} (${resourceType}) recreate returned the existing resource (${currentResource.physicalId}) instead of creating a new one — its Create API is name-idempotent — and UpdateReplacePolicy: Retain means the old resource was never destroyed, so the new properties were not applied. Rename the resource in your CDK code (or remove the explicit physical name) so the recreate can produce a genuinely new resource.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
+		if (equalIdIsSameResource && updateReplacePolicy === "Retain" && createResult.physicalId === currentResource.physicalId) throw new CdkdError(safeMsg`${logicalId} (${resourceType}) recreate returned the existing resource ` + safeMsg`(${currentResource.physicalId}) instead of creating a new one — its Create ` + "API is name-idempotent — and UpdateReplacePolicy: Retain means the old resource was never destroyed, so the new properties were not applied. Rename the resource in your CDK code (or remove the explicit physical name) so the recreate can produce a genuinely new resource.", "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
 	} else {
-		this.logger.info(`  Creating new ${logicalId}...`);
+		this.logger.info(safeMsg`  Creating new ${logicalId}...`);
 		let deletedOldFirst = lostWithParent !== void 0;
 		if (lostWithParent !== void 0) {
 			this.oldDeletedBeforeCreate.add(logicalId);
@@ -43225,7 +43325,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 				observed: currentResource.observedProperties,
 				physicalId: currentResource.physicalId
 			});
-			if (nameHeldElsewhere !== void 0) throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement, but the create-first attempt collided: ${createMsg}. ${renderNameHeldElsewhere(nameHeldElsewhere)}` + (this.options.replace === true ? ` — so --replace was NOT applied and nothing was deleted.` : updateReplacePolicy === "Retain" ? " — so removing UpdateReplacePolicy: Retain and re-running with `cdkd deploy --replace` would delete this resource and still collide." : " — so `cdkd deploy --replace` would delete this resource and still collide.") + " Choose a name no other resource holds, or delete the resource holding it if it is yours.", "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
+			if (nameHeldElsewhere !== void 0) throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement, but the create-first ` + safeMsg`attempt collided: ${createMsg}. ${renderNameHeldElsewhere(nameHeldElsewhere)}` + (this.options.replace === true ? ` — so --replace was NOT applied and nothing was deleted.` : updateReplacePolicy === "Retain" ? " — so removing UpdateReplacePolicy: Retain and re-running with `cdkd deploy --replace` would delete this resource and still collide." : " — so `cdkd deploy --replace` would delete this resource and still collide.") + " Choose a name no other resource holds, or delete the resource holding it if it is yours.", "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
 			const holder = replacementOldHoldsSentName({
 				createType: resourceType,
 				holderType: oldResourceType,
@@ -43243,26 +43343,26 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 				const flagClause = this.options.replace === true ? ` --replace was NOT applied and nothing was deleted.` : updateReplacePolicy === "Retain" ? " Nothing was deleted. UpdateReplacePolicy: Retain keeps the resource being replaced in place; removing it and re-running with `cdkd deploy --replace` would refuse the same way rather than delete it." : " Nothing was deleted, and `cdkd deploy --replace` would refuse the same way rather than delete it.";
 				throw markNonRetryable(new CdkdError(maskSecretsInText(`${displaySafe(logicalId)} (${displaySafe(resourceType)}) requires replacement, but the create-first attempt collided: ${holder.diagnosis} — ` + (holder.known ? "so another resource holds the colliding name (an orphan of an earlier attempt, or one made outside this stack), and deleting the resource being replaced would destroy it and collide again." + flagClause + " Remove or rename the resource holding that name if it is yours, then re-run the deploy." : "so if another resource holds it (an orphan of an earlier attempt, or one made outside this stack), deleting the resource being replaced would destroy it and collide again." + flagClause + " Remove or rename whatever holds that name if it is yours — if that is the resource being replaced itself, delete it by hand — then re-run the deploy.") + ` Underlying collision: ${createMsg}`, updateSecrets), "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
 			}
-			if (updateReplacePolicy === "Retain") throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. ${nameOrigin.descriptor}. ${nameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed.`, "NAMED_REPLACEMENT_COLLISION");
-			if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but the create-first attempt collided with the existing resource: ${createMsg}. ${nameOrigin.descriptor}, so the CloudFormation-style safe replacement order (create the new resource before deleting the old) cannot reuse the occupied name — CloudFormation refuses this shape with "cannot update a stack when a custom-named resource requires replacing". ${nameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated).`, "NAMED_REPLACEMENT_COLLISION");
-			this.logger.info(`  Create-first collided with the existing resource's name and --replace is set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
+			if (updateReplacePolicy === "Retain") throw new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement, but its physical name ` + `is still held by the existing resource AND UpdateReplacePolicy: Retain ` + safeMsg`pins that resource in place. ${nameOrigin.descriptor}. ` + safeMsg`${nameOrigin.remedy} — with Retain, the old resource keeps the name, so a ` + `same-name replacement can never proceed.`, "NAMED_REPLACEMENT_COLLISION");
+			if (this.options.replace !== true) throw new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement, but the create-first ` + safeMsg`attempt collided with the existing resource: ${createMsg}. ` + safeMsg`${nameOrigin.descriptor}, so the CloudFormation-style safe replacement ` + "order (create the new resource before deleting the old) cannot reuse the occupied name — CloudFormation refuses this shape with \"cannot update a stack when a custom-named resource requires replacing\". " + safeMsg`${nameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete ` + "the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated).", "NAMED_REPLACEMENT_COLLISION");
+			this.logger.info(`  Create-first collided with the existing resource's name and --replace is ` + safeMsg`set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
 			deletedOldFirst = true;
 			createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy, oldDeleteRoute.provisionedBy, noEchoDeleteValues);
 		}
 		if (equalIdIsSameResource && !deletedOldFirst && createResult.physicalId === currentResource.physicalId) {
 			const idempotentNameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
-			if (updateReplacePolicy === "Retain") throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its Create API is name-idempotent: the create-first attempt returned the existing resource (${currentResource.physicalId}) instead of creating a new one, and UpdateReplacePolicy: Retain pins that resource in place. ${idempotentNameOrigin.descriptor}. ${idempotentNameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
-			if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its Create API is name-idempotent: the create-first attempt returned the EXISTING resource (${currentResource.physicalId}) instead of creating a new one, so deleting the "old" resource would silently destroy the resource the deploy just reported as created. ${idempotentNameOrigin.descriptor}; ${idempotentNameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated). Note: this branch is also reached when the old resource was deleted out-of-band and the physical id is name-derived — there the create was a genuine fresh create; \`--replace\` converges that case too.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
-			this.logger.info(`  Create-first returned the existing resource (name-idempotent Create API) and --replace is set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
+			if (updateReplacePolicy === "Retain") throw new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement, but its Create API is ` + `name-idempotent: the create-first attempt returned the existing resource ` + safeMsg`(${currentResource.physicalId}) instead of creating a new one, and ` + `UpdateReplacePolicy: Retain pins that resource in place. ` + safeMsg`${idempotentNameOrigin.descriptor}. ${idempotentNameOrigin.remedy} — with ` + "Retain, the old resource keeps the name, so a same-name replacement can never proceed.", "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
+			if (this.options.replace !== true) throw new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement, but its Create API is ` + `name-idempotent: the create-first attempt returned the EXISTING resource ` + safeMsg`(${currentResource.physicalId}) instead of creating a new one, so deleting ` + `the "old" resource would silently destroy the resource the deploy just ` + safeMsg`reported as created. ${idempotentNameOrigin.descriptor}; ` + safeMsg`${idempotentNameOrigin.remedy}, or re-run with ` + "`cdkd deploy --replace` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated). Note: this branch is also reached when the old resource was deleted out-of-band and the physical id is name-derived — there the create was a genuine fresh create; `--replace` converges that case too.", "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
+			this.logger.info(`  Create-first returned the existing resource (name-idempotent Create API) ` + safeMsg`and --replace is set — deleting old ${logicalId} ` + safeMsg`(${currentResource.physicalId}) first...`);
 			deletedOldFirst = true;
 			createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy, oldDeleteRoute.provisionedBy, noEchoDeleteValues);
 		}
 		if (deletedOldFirst) {} else if (updateReplacePolicy === "Retain") {
 			this.retainedOldOnReplacement.add(logicalId);
 			await noteRetainedResource(oldResourceType, logicalId);
-			this.logger.info(`  Retaining old ${logicalId} (${currentResource.physicalId}) - UpdateReplacePolicy: Retain`);
+			this.logger.info(safeMsg`  Retaining old ${logicalId} (${currentResource.physicalId}) - UpdateReplacePolicy: Retain`);
 		} else {
-			this.logger.info(`  Deleting old ${logicalId} (${currentResource.physicalId})...`);
+			this.logger.info(safeMsg`  Deleting old ${logicalId} (${currentResource.physicalId})...`);
 			let cleanupFinalSnapshotId;
 			let snapshotBlockedDelete = false;
 			try {
@@ -43270,7 +43370,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			} catch (snapshotError) {
 				if (snapshotError instanceof CdkdError && snapshotError.code === "FINAL_SNAPSHOT_UNSUPPORTED") throw snapshotError;
 				snapshotBlockedDelete = true;
-				this.logger.warn(`  ⚠ Final snapshot for old ${logicalId} (${currentResource.physicalId}) failed: ${snapshotError instanceof Error ? snapshotError.message : String(snapshotError)}. The old resource was NOT deleted (UpdateReplacePolicy: Snapshot) — delete it manually once you have a snapshot; it is no longer tracked in state.`);
+				this.logger.warn(safeMsg`  ⚠ Final snapshot for old ${logicalId} (${currentResource.physicalId}) ` + safeMsg`failed: ${asIsMessage(snapshotError instanceof Error ? snapshotError.message : String(snapshotError))}. ` + "The old resource was NOT deleted (UpdateReplacePolicy: Snapshot) — delete it manually once you have a snapshot; it is no longer tracked in state.");
 			}
 			if (!snapshotBlockedDelete) await this.deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, oldDeleteProvider, currentResource.properties, cleanupFinalSnapshotId, updateReplacePolicy, updateSecrets, oldDeleteRoute.provisionedBy, noEchoDeleteValues);
 		}
@@ -43296,18 +43396,34 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 	const replacePrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
 	renderer.removeTask(logicalId);
 	const replacedSkip = this.replacedDeleteSkips.get(logicalId);
-	const replacedLine = `${replacePrefix}${yellow("↻")} ${bold(logicalId)} ${gray(`(${resourceType})`)} ${yellow("replaced")}`;
+	const replacedLine = safeMsg`${replacePrefix}${yellow("↻")} ${bold(logicalId)} ${gray(`(${resourceType})`)} ${yellow("replaced")}`;
 	if (replacedSkip !== void 0) {
-		this.logger.warn(replacedLine + " " + updatePartialMessage(replacedSkip));
+		this.logger.warn(safeMsg`${replacedLine} ${updatePartialMessage(replacedSkip)}`);
 		return;
 	}
 	this.logger.info(replacedLine);
 }
 
+//#endregion
+//#region src/provisioning/cc-autoroute-update-remedy.ts
+const TYPE_FORMAT = /^[A-Z][A-Za-z0-9]+(::[A-Z][A-Za-z0-9]+)+$/;
+const PROPERTY_FORMAT = /^[A-Z][A-Za-z0-9]*$/;
+const LOGICAL_ID_FORMAT = /^[A-Za-z][A-Za-z0-9]{0,254}$/;
+function ccAutoRouteUpdateFailureRemedy(logicalId, resourceType, autoRoutedProperties, nestedChild = false) {
+	const id = LOGICAL_ID_FORMAT.test(logicalId) ? logicalId : "<logicalId>";
+	const type = TYPE_FORMAT.test(resourceType) ? resourceType : "<Type>";
+	const props = autoRoutedProperties.map((p) => PROPERTY_FORMAT.test(p) ? p : "<Property>");
+	const shown = props.length > 0 ? props.join(", ") : "a property";
+	const override = props.length > 0 ? props.map((p) => `${type}:${p}`).join(",") : `${type}:<Property>`;
+	const them = props.length === 1 ? "that property" : "those properties";
+	const preferSdk = `keep it on the SDK provider without sending ${them} with --prefer-sdk-route ${override}`;
+	return `\nThis update moved the resource from its SDK provider to Cloud Control API, because the SDK provider does not handle ${shown}. Cloud Control addresses it by the physical id the SDK provider recorded, and for some types that is not an identifier Cloud Control accepts. ` + (nestedChild ? `It is in a nested stack, which --recreate-via-cc-api cannot address: ${preferSdk}, or remove ${them} from the template.` : `Two ways through: re-create the resource on Cloud Control with --recreate-via-cc-api ${id} (destroys and re-creates it), or ${preferSdk}.`);
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/update-in-place.ts
 async function updateInPlace({ conditions, counts, currentProps, currentPropsAsWritten, currentResource, dependencies, desiredForSkipCheckAsWritten, logicalId, noEchoHeldPaths, parameterValues, progress, renderer, resolvedProps, resourceType, stackName, stateResources, template, updateReplacePolicy, updateSecrets, reattach }) {
-	this.logger.debug(`Updating ${logicalId} (${resourceType})`);
+	this.logger.debug(safeMsg`Updating ${logicalId} (${resourceType})`);
 	const updateDecision = this.providerRegistry.getProviderFor({
 		resourceType,
 		properties: resolvedProps,
@@ -43321,12 +43437,12 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 		let message;
 		switch (exemptMode) {
 			case "cc-broken":
-				message = `${logicalId} (${resourceType}): moving to the SDK provider — Cloud Control cannot manage this type correctly. ${preserved}, and this routing is not optional.`;
+				message = safeMsg`${logicalId} (${resourceType}): moving to the SDK provider — Cloud ` + `Control cannot manage this type correctly. ${preserved}, and this routing is not optional.`;
 				break;
 			case "sdk-coverage":
-				message = `${logicalId} (${resourceType}): returning to the SDK provider — cdkd now covers every property this resource uses. ${preserved}; pass --pin-cc-api ${logicalId} to decline this for a deploy.`;
+				message = safeMsg`${logicalId} (${resourceType}): returning to the SDK provider — cdkd now ` + `covers every property this resource uses. ${preserved}; pass ` + safeMsg`--pin-cc-api ${logicalId} to decline this for a deploy.`;
 				break;
-			default: message = `${logicalId} (${resourceType}): moving to the SDK provider. ${preserved}.`;
+			default: message = safeMsg`${logicalId} (${resourceType}): moving to the SDK provider. ${preserved}.`;
 		}
 		this.logger.info(message);
 	}
@@ -43374,7 +43490,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 			const statefulReason = retainOldOnReplace ? null : isStatefulRecreateTargetForReplace(resourceType, currentProps, currentResource.observedProperties);
 			if (statefulReason && this.options.forceStatefulRecreation !== true) {
 				const protection = recordedProtectionEvidence(resourceType, currentProps, currentResource.observedProperties, this.stackRegion);
-				throw markNonRetryable(new CdkdError(replaceOptIn ? `--replace would DELETE + CREATE the stateful resource ${logicalId} (${resourceType}) — ${renderStatefulReason(statefulReason)}. ` + (protection ? `${recordedProtectionNote(protection, "--replace --force-stateful-recreation")} Or change the resource's definition to avoid the immutable-property change.` : "Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.") : `${logicalId} (${resourceType}) cannot be updated in place by the provisioning layer it routes through, so applying this change would DELETE + CREATE it — but it is a stateful resource: ${renderStatefulReason(statefulReason)}. ` + (protection ? `${recordedProtectionNote(protection, "--force-stateful-recreation")} Or change the resource's definition to avoid the update.` : "Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the update."), "STATEFUL_REPLACE_BLOCKED", updateError instanceof Error ? updateError : void 0));
+				throw markNonRetryable(new CdkdError(replaceOptIn ? safeMsg`--replace would DELETE + CREATE the stateful resource ${logicalId} ` + safeMsg`(${resourceType}) — ${renderStatefulReason(statefulReason)}. ` + (protection ? safeMsg`${recordedProtectionNote(protection, "--replace --force-stateful-recreation")} ` + `Or change the resource's definition to avoid the immutable-property change.` : "Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.") : safeMsg`${logicalId} (${resourceType}) cannot be updated in place by the ` + "provisioning layer it routes through, so applying this change would DELETE + CREATE it — but it is a stateful resource: " + safeMsg`${renderStatefulReason(statefulReason)}. ` + (protection ? safeMsg`${recordedProtectionNote(protection, "--force-stateful-recreation")} ` + `Or change the resource's definition to avoid the update.` : "Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the update."), "STATEFUL_REPLACE_BLOCKED", updateError instanceof Error ? updateError : void 0));
 			}
 			const replDecision = this.providerRegistry.getProviderFor({
 				resourceType,
@@ -43405,7 +43521,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 				secrets: updateSecrets,
 				inputSources: template && this.maskedInputSources(template, stateResources, this.noEchoConditions, stackName)
 			});
-			this.logger.info(retainOldOnReplace ? `UPDATE not supported for ${logicalId} (${resourceType}), replacing (CREATE only — UpdateReplacePolicy: Retain keeps the old resource)` : createFirst ? safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing (CREATE → DELETE — the new name differs from the old resource's)` : `UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE → CREATE)`);
+			this.logger.info(retainOldOnReplace ? safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing ` + `(CREATE only — UpdateReplacePolicy: Retain keeps the old resource)` : createFirst ? safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing (CREATE → DELETE — the new name differs from the old resource's)` : safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE → CREATE)`);
 			if (retainOldOnReplace) await noteRetainedResource(resourceType, logicalId);
 			if (!retainOldOnReplace && !createFirst) {
 				const fallbackUpdateReplacePolicy = template?.Resources?.[logicalId]?.UpdateReplacePolicy ?? currentResource.updateReplacePolicy;
@@ -43424,7 +43540,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 					}));
 				} catch (deleteError) {
 					const deleteMsg = deleteError instanceof Error ? deleteError.message : String(deleteError);
-					if (!isWaitAbandonedError(deleteError) && !isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound"))) this.logger.debug(`Old resource ${logicalId} already gone, proceeding with CREATE`);
+					if (!isWaitAbandonedError(deleteError) && !isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound"))) this.logger.debug(safeMsg`Old resource ${logicalId} already gone, proceeding with CREATE`);
 					else throw deleteError;
 				}
 				reportDeleteGuards(fallbackDeleteResult, {
@@ -43464,7 +43580,10 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 				}) : await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replProvider.create(logicalId, resourceType, replProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replProvider);
 			} catch (createError) {
 				if (createFirst) throw createError;
-				if (!retainOldOnReplace) throw new Error(maskSecretsInText(`Failed to create ${logicalId} after the UPDATE-not-supported replacement: the old resource (${currentResource.physicalId}) is now gone. Cause: ${createError instanceof Error ? createError.message : String(createError)}. Re-run the deploy to create it fresh.`, updateSecrets), { cause: createError instanceof Error ? createError : void 0 });
+				if (!retainOldOnReplace) {
+					const shownSecrets = unionOfSecretBags([updateSecrets, this.printingSecretsFor(logicalId)]);
+					throw new Error(safeMsg`Failed to create ${maskSecretsInText(logicalId, shownSecrets)} after the ` + safeMsg`UPDATE-not-supported replacement: the old resource (${maskSecretsInText(currentResource.physicalId, shownSecrets)}) ` + safeMsg`is now gone. Re-run the deploy to create it fresh. Cause: ${asIsMessage(maskSecretsInText(createError instanceof Error ? createError.message : String(createError), shownSecrets))}`, { cause: createError instanceof Error ? createError : void 0 });
+				}
 				if (!isNameCollisionErrorFrom(createError, logicalId)) throw createError;
 				const nameHeldElsewhere = replacementRequestsDifferentName({
 					oldResourceType: resourceType,
@@ -43474,9 +43593,9 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 					observed: currentResource.observedProperties,
 					physicalId: currentResource.physicalId
 				});
-				if (nameHeldElsewhere !== void 0) throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement because the provisioning layer cannot update it in place, but the create collided. ${renderNameHeldElsewhere(nameHeldElsewhere)} — so removing UpdateReplacePolicy: Retain would delete this resource and still collide. Choose a name no other resource holds, or delete the resource holding it if it is yours.`, "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
+				if (nameHeldElsewhere !== void 0) throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement because the ` + `provisioning layer cannot update it in place, but the create collided. ` + safeMsg`${renderNameHeldElsewhere(nameHeldElsewhere)} — so removing ` + "UpdateReplacePolicy: Retain would delete this resource and still collide. Choose a name no other resource holds, or delete the resource holding it if it is yours.", "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
 				const nameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
-				throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement because the provisioning layer cannot update it in place — but its physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. ${nameOrigin.descriptor}. ${nameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed. Removing UpdateReplacePolicy: Retain lets cdkd delete the old resource first, which destroys it and any data it holds.`, "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
+				throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement because the ` + "provisioning layer cannot update it in place — but its physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. " + safeMsg`${nameOrigin.descriptor}. ${nameOrigin.remedy} — with Retain, the old ` + "resource keeps the name, so a same-name replacement can never proceed. Removing UpdateReplacePolicy: Retain lets cdkd delete the old resource first, which destroys it and any data it holds.", "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
 			}
 			if (!retainOldOnReplace && !createFirst && createResult.physicalId === currentResource.physicalId && !equalIdNamesDifferentResources({
 				resourceType,
@@ -43492,10 +43611,10 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 					newProperties: resolvedProps
 				})) {
 					const idempotentNameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
-					throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its Create API is name-idempotent: the create returned the existing resource (${currentResource.physicalId}) instead of creating a new one, and UpdateReplacePolicy: Retain pins that resource in place, so the new properties were not applied. ${idempotentNameOrigin.descriptor}. ${idempotentNameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE"));
+					throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement, but its Create ` + `API is name-idempotent: the create returned the existing resource ` + safeMsg`(${currentResource.physicalId}) instead of creating a new one, and ` + `UpdateReplacePolicy: Retain pins that resource in place, so the new ` + safeMsg`properties were not applied. ${idempotentNameOrigin.descriptor}. ` + safeMsg`${idempotentNameOrigin.remedy} — with Retain, the old resource keeps ` + `the name, so a same-name replacement can never proceed.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE"));
 				}
 				this.retainedOldOnReplacement.add(logicalId);
-				this.logger.warn(`  ⚠ ${logicalId} has UpdateReplacePolicy: Retain — the old physical resource (${currentResource.physicalId}) is RETAINED and is no longer tracked by cdkd: it keeps running and incurring cost, and \`cdkd destroy\` will not remove it. Delete it yourself once you no longer need its data.`);
+				this.logger.warn(safeMsg`  ⚠ ${logicalId} has UpdateReplacePolicy: Retain — the old physical ` + safeMsg`resource (${currentResource.physicalId}) is RETAINED and is no longer ` + "tracked by cdkd: it keeps running and incurring cost, and `cdkd destroy` will not remove it. Delete it yourself once you no longer need its data.");
 				retainedSurvivorReason = `UpdateReplacePolicy: Retain kept the old ${resourceType} (${currentResource.physicalId}), now untracked by cdkd`;
 			}
 			const replacementResult = {
@@ -43513,7 +43632,10 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 			result = replacementResult;
 			resultProvisionedBy = replDecision.provisionedBy;
 			captureProvider = replProvider;
-		} else throw updateError;
+		} else {
+			if (currentResource.provisionedBy !== "cc-api" && updateDecision.ccRouteReason !== void 0 && updateError instanceof Error && !isInterruptedWaitError(updateError) && !isWaitAbandonedError(updateError)) updateError.message += ccAutoRouteUpdateFailureRemedy(logicalId, resourceType, updateDecision.ccRouteReason.properties, this.options.parentStackInfo !== void 0);
+			throw updateError;
+		}
 	}
 	this.updateWasReplaced.set(logicalId, result.wasReplaced === true);
 	if (result.wasReplaced !== true && (hasPassProvenance(updateSecrets) || referenceProvenanceOf(currentResource) !== void 0)) {
@@ -43526,7 +43648,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 			physicalId: result.physicalId,
 			properties: resolvedProps
 		});
-		this.logger.info(`Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`);
+		this.logger.info(safeMsg`Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`);
 	}
 	const dischargedByReplacement = result.wasReplaced === true && result.physicalId !== currentResource.physicalId;
 	const keepsParameterRefusal = !dischargedByReplacement && hasUnverifiableParameterRefusal(currentResource);
@@ -43555,7 +43677,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 		}
 	};
 	if (updatePartialReason(result) === void 0) this.recordInlinePolicyWrite(logicalId, "update");
-	if (keepsParameterRefusal) this.logger.debug(`observedProperties capture SKIPPED for updated ${logicalId} (${resourceType}): 'cdkd import' refused its baseline because a template parameter was not provably deployed at its 'Default', and this deploy bound the same 'Default' — an in-place update cannot show that AWS no longer holds the deployed value. The refusal stands until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter.`);
+	if (keepsParameterRefusal) this.logger.debug(safeMsg`observedProperties capture SKIPPED for updated ${logicalId} (${resourceType}): 'cdkd import' refused its baseline because a template parameter was not provably deployed at its 'Default', and this deploy bound the same 'Default' — an in-place update cannot show that AWS no longer holds the deployed value. The refusal stands until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter.`);
 	const updateCaptureSiblings = keepsParameterRefusal ? void 0 : await this.buildObservedCaptureSiblings(resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
 	if (!keepsParameterRefusal) this.kickOffObservedCapture(captureProvider, logicalId, result.physicalId, resourceType, resolvedProps, {
 		...updateCaptureSiblings,
@@ -43572,11 +43694,11 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 	const replacedSkip = this.replacedDeleteSkips.get(logicalId);
 	const shownPartial = updatePartial !== void 0 && replacedSkip !== void 0 ? `${updatePartial}; ${replacedSkip}` : updatePartial ?? replacedSkip;
 	if (shownPartial !== void 0) {
-		this.logger.warn(`${updatePrefix}${formatResourceLine("updated", logicalId, resourceType)} ` + updatePartialMessage(shownPartial));
+		this.logger.warn(safeMsg`${updatePrefix}${formatResourceLine("updated", logicalId, resourceType)} ` + safeMsg`${updatePartialMessage(shownPartial)}`);
 		if (updatePartial !== void 0) return { updatePartial };
 		return;
 	}
-	this.logger.info(`${updatePrefix}${formatResourceLine("updated", logicalId, resourceType)}`);
+	this.logger.info(safeMsg`${updatePrefix}${formatResourceLine("updated", logicalId, resourceType)}`);
 }
 
 //#endregion
@@ -43661,10 +43783,10 @@ async function provisionDelete(logicalId, change, stateResources, stackName, tem
 	const existingState = stateResources[logicalId];
 	const renderer = getLiveRenderer();
 	const currentResource = existingState;
-	if (!currentResource) throw new Error(`Cannot delete ${logicalId}: resource not found in state`);
+	if (!currentResource) throw new Error(safeMsg`Cannot delete ${logicalId}: resource not found in state`);
 	const deletionPolicy = currentResource.deletionPolicy ?? template?.Resources?.[logicalId]?.DeletionPolicy;
 	if (shouldRetainResource(deletionPolicy)) {
-		this.logger.info(`Retaining ${logicalId} (${resourceType}) - DeletionPolicy: ${deletionPolicy}`);
+		this.logger.info(safeMsg`Retaining ${logicalId} (${resourceType}) - DeletionPolicy: ${deletionPolicy}`);
 		delete stateResources[logicalId];
 		await noteRetainedResource(resourceType, logicalId);
 		if (keptForReadoption(currentResource)) {
@@ -43736,7 +43858,7 @@ Drop the record with: ${dropCommand}`);
 		provisionedBy: currentResource.provisionedBy
 	});
 	const deleteProvider = deleteRoute.provider;
-	this.logger.debug(`Deleting ${logicalId} (${resourceType})`);
+	this.logger.debug(safeMsg`Deleting ${logicalId} (${resourceType})`);
 	let deleteResult = void 0;
 	const inlinePolicyClaimed = this.inlinePolicyClaimedFor(resourceType, logicalId, stateResources);
 	try {
@@ -43752,7 +43874,7 @@ Drop the record with: ${dropCommand}`);
 		}), logicalId, 3, 5e3, deleteProvider);
 	} catch (deleteError) {
 		const msg = deleteError instanceof Error ? deleteError.message : String(deleteError);
-		if (!isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && !isWaitAbandonedError(deleteError) && (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException"))) this.logger.debug(`Resource ${logicalId} already deleted (${msg}), removing from state`);
+		if (!isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && !isWaitAbandonedError(deleteError) && (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException"))) this.logger.debug(safeMsg`Resource ${logicalId} already deleted (${asIsMessage(msg)}), removing from state`);
 		else throw deleteError;
 	}
 	reportDeleteGuards(deleteResult, {
@@ -43765,7 +43887,7 @@ Drop the record with: ${dropCommand}`);
 		if (progress) progress.current++;
 		const skipPrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
 		renderer.removeTask(logicalId);
-		this.logger.info(`${skipPrefix}${formatResourceLine("skipped", logicalId, resourceType, `skipped (${deleteSkipped})`)}`);
+		this.logger.info(safeMsg`${skipPrefix}${formatResourceLine("skipped", logicalId, resourceType, `skipped (${deleteSkipped})`)}`);
 		const nested = resourceType === "AWS::CloudFormation::Stack";
 		const recordStack = nested ? nestedChildStackName(stackName, logicalId) : stackName;
 		const interrupted = nested && deleteSkipped.endsWith(" was interrupted");
@@ -43777,7 +43899,7 @@ Drop the record with: ${dropCommand}`);
 			hole: nested ? "child-stack" : "stack",
 			opts: { plainIdent: true }
 		};
-		this.logger.warn(deleteSkippedMessage(logicalId, currentResource.physicalId, deleteSkipped, "while removing it from the template") + ". Its cdkd state record was KEPT, so the next 'cdkd deploy' re-attempts the delete. Repair the record first (for a nested stack it is the CHILD's own state, whose other resources may already be gone), or delete the resource by hand and drop the record." + (interrupted ? " The commands name the child stack record. Its destroy was interrupted: re-run 'cdkd deploy' to resume it, and drop the child record only if that cannot finish, after deleting by hand what the child still holds (the inspect command with --show-nested lists every level; a child with nested stacks of its own has records under '<child>~<logicalId>' too, each needing the same drop)." : nested ? " The commands name the child stack record. Dropping it drops every record the child still has and nothing reaches those resources again, so first delete by hand what the child still holds (the inspect command with --show-nested lists every level; a child with nested stacks of its own has records under '<child>~<logicalId>' too, each needing the same drop). The next 'cdkd deploy' then removes this row." : " Keep '--resource' on the drop: without it the command drops the record of every resource in this still-deployed stack.") + (accountClause === "" ? "" : ` ${accountClause}`) + `\nInspect it with: ${pasteableCommand("cdkd state show", [
+		this.logger.warn(safeMsg`${deleteSkippedMessage(logicalId, currentResource.physicalId, deleteSkipped, "while removing it from the template")}` + ". Its cdkd state record was KEPT, so the next 'cdkd deploy' re-attempts the delete. Repair the record first (for a nested stack it is the CHILD's own state, whose other resources may already be gone), or delete the resource by hand and drop the record." + (interrupted ? " The commands name the child stack record. Its destroy was interrupted: re-run 'cdkd deploy' to resume it, and drop the child record only if that cannot finish, after deleting by hand what the child still holds (the inspect command with --show-nested lists every level; a child with nested stacks of its own has records under '<child>~<logicalId>' too, each needing the same drop)." : nested ? " The commands name the child stack record. Dropping it drops every record the child still has and nothing reaches those resources again, so first delete by hand what the child still holds (the inspect command with --show-nested lists every level; a child with nested stacks of its own has records under '<child>~<logicalId>' too, each needing the same drop). The next 'cdkd deploy' then removes this row." : " Keep '--resource' on the drop: without it the command drops the record of every resource in this still-deployed stack.") + (accountClause === "" ? "" : safeMsg` ${accountClause}`) + safeMsg`\nInspect it with: ${pasteableCommand("cdkd state show", [
 			stackArg,
 			{
 				flag: "--stack-region",
@@ -43785,7 +43907,7 @@ Drop the record with: ${dropCommand}`);
 				hole: "region"
 			},
 			...account
-		]).command}\nDrop the record with: ${pasteableCommand("cdkd state orphan", [
+		]).command}` + safeMsg`\nDrop the record with: ${pasteableCommand("cdkd state orphan", [
 			stackArg,
 			{
 				flag: "--stack-region",
@@ -43808,7 +43930,7 @@ Drop the record with: ${dropCommand}`);
 	if (progress) progress.current++;
 	const deletePrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
 	renderer.removeTask(logicalId);
-	this.logger.info(`${deletePrefix}${formatResourceLine("deleted", logicalId, resourceType)}`);
+	this.logger.info(safeMsg`${deletePrefix}${formatResourceLine("deleted", logicalId, resourceType)}`);
 }
 
 //#endregion
@@ -43876,6 +43998,8 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 						}
 					} else updatePartial = `${updatePartial}; ${replacedSkip}`;
 				}
+				const deferred = this.deferredReplacedDeletes?.get(logicalId);
+				if (deferred !== void 0 && updatePartial !== void 0) deferred.rowPartial = true;
 				nestedChildUnaddressed = unaddressed;
 			} finally {
 				for (const guard of deleteGuards.splice(0)) this.recordEvent({
@@ -43900,7 +44024,7 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 				if (current !== void 0) current.warnSuffix = warnSuffix;
 				renderer.updateTaskLabel(logicalId, `${current?.label ?? baseLabel}${warnSuffix}`);
 				renderer.printAbove(() => {
-					this.logger.warn(`${logicalId} (${resourceType}) has been ${operationKind === "CREATE" ? "creating" : operationKind === "DELETE" ? "deleting" : "updating"} for ${minutes}m — still waiting`);
+					this.logger.warn(safeMsg`${logicalId} (${resourceType}) has been ${operationKind === "CREATE" ? "creating" : operationKind === "DELETE" ? "deleting" : "updating"} for ${minutes}m — still waiting`);
 				});
 			},
 			onTimeout: (elapsedMs) => new ResourceTimeoutError(logicalId, resourceType, this.stackRegion, elapsedMs, operationKind, timeoutMs)
@@ -43948,7 +44072,9 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 	} catch (error) {
 		renderer.removeTask(logicalId);
 		const message = error instanceof Error ? error.message : String(error);
-		this.logger.error(this.maskForResource(logicalId, `Failed to ${change.changeType.toLowerCase()} ${logicalId}: ${message}`));
+		const shownMessage = this.maskForResource(logicalId, message);
+		const shownId = safeMsg`${logicalId}`;
+		this.logger.error(this.maskForResource(logicalId, `Failed to ${change.changeType.toLowerCase()} ${shownId}: ${shownMessage}`));
 		const orphanAdvice = this.orphanedNameCollisionAdvice(change.changeType, logicalId, error);
 		if (orphanAdvice) this.logger.error(this.maskForResource(logicalId, orphanAdvice));
 		this.recordEvent({
@@ -43961,7 +44087,7 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 			durationMs: Date.now() - resourceStartedAt,
 			error: extractDeploymentEventError(error)
 		});
-		throw new ProvisioningError(`Failed to ${change.changeType.toLowerCase()} resource ${logicalId}`, resourceType, logicalId, stateResources[logicalId]?.physicalId, error instanceof Error ? maskSecretsInError(error, this.printingSecretsFor(logicalId) ?? EMPTY_SECRETS) : void 0);
+		throw new ProvisioningError(safeMsg`Failed to ${change.changeType.toLowerCase()} resource ${logicalId}`, resourceType, logicalId, stateResources[logicalId]?.physicalId, error instanceof Error ? maskSecretsInError(error, this.printingSecretsFor(logicalId) ?? EMPTY_SECRETS) : void 0);
 	} finally {
 		renderer.removeTask(logicalId);
 	}
@@ -44141,9 +44267,9 @@ async function executeDeployment(template, currentState, changes, dag, execution
 					migrateLegacy: migrate
 				});
 				if (migrate) pendingMigration = false;
-				this.logger.debug(`State saved after ${logicalId}`);
+				this.logger.debug(safeMsg`State saved after ${logicalId}`);
 			} catch (error) {
-				this.logger.warn(`Failed to save state after ${logicalId}: ${error instanceof Error ? error.message : String(error)}`);
+				this.logger.warn(safeMsg`Failed to save state after ${logicalId}: ${asIsMessage(error instanceof Error ? error.message : String(error))}`);
 			}
 		});
 	};
@@ -44152,6 +44278,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 	const settledUpdates = /* @__PURE__ */ new Set();
 	const inFlightWrites = /* @__PURE__ */ new Map();
 	this.stackRecordsView = deployStackRecordsView(newResources, currentState.resources, deleteChanges, (logicalId) => startedUpdates.has(logicalId) && !settledUpdates.has(logicalId), () => [...inFlightWrites.values()].map(({ write }) => write));
+	this.deferredReplacedDeletes = /* @__PURE__ */ new Map();
 	try {
 		const createUpdateIds = [];
 		for (const [id, change] of changes.entries()) {
@@ -44160,7 +44287,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			createUpdateIds.push(id);
 		}
 		if (createUpdateIds.length > 0) {
-			this.logger.info(`${cyan("Deploying")} ${cyan(createUpdateIds.length)} resource(s) (DAG: ${executionLevels.length} levels, max parallel: ${concurrency})`);
+			this.logger.info(safeMsg`${cyan("Deploying")} ${cyan(createUpdateIds.length)} resource(s) (DAG: ${executionLevels.length} levels, max parallel: ${concurrency})`);
 			const createUpdateExecutor = new DagExecutor();
 			const provisionable = new Set(createUpdateIds);
 			const createUpdateDeps = /* @__PURE__ */ new Map();
@@ -44329,7 +44456,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			if (this.interrupted && this.hasPending(createUpdateExecutor)) throw new InterruptedError(this.interruptCause ?? "user");
 		}
 		if (deleteChanges.size > 0) {
-			this.logger.info(`${red("Deleting")} ${red(deleteChanges.size)} resource(s)`);
+			this.logger.info(safeMsg`${red("Deleting")} ${red(deleteChanges.size)} resource(s)`);
 			const deleteDeps = this.buildDeletionDependencies(deleteChanges, currentState);
 			const deleteExecutor = new DagExecutor();
 			for (const id of deleteChanges) deleteExecutor.add({
@@ -44374,7 +44501,10 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			}
 			if (this.interrupted && this.hasPending(deleteExecutor)) throw new InterruptedError(this.interruptCause ?? "user");
 		}
+		if (this.interrupted) this.warnUnretriedReplacedDeletes("interrupted");
+		else await this.retryDeferredReplacedDeletes(stackName, actualCounts);
 	} catch (error) {
+		this.warnUnretriedReplacedDeletes(this.interruptCause === "user" ? "interrupted" : "failed");
 		const initialDeploy = currentEtag === void 0;
 		const written = /* @__PURE__ */ new Set([...this.restoredLostChildren, ...completedOperations.map((op) => op.logicalId)]);
 		for (const logicalId of this.updatesThatSentNothing) written.delete(logicalId);
@@ -44450,7 +44580,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			if (migrate) pendingMigration = false;
 			this.logger.debug("Partial state saved before rollback (orphaned resource tracking)");
 		} catch (saveError) {
-			this.logger.warn(`Failed to save partial state before rollback: ${saveError instanceof Error ? saveError.message : String(saveError)}`);
+			this.logger.warn(safeMsg`Failed to save partial state before rollback: ${asIsMessage(saveError instanceof Error ? saveError.message : String(saveError))}`);
 		}
 		let autoRollbackClean = false;
 		let autoRollbackJournaled = false;
@@ -44459,7 +44589,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 		let rollbackRemainingFailedOps = failedOperations;
 		if (error instanceof InterruptedError || isInterruptedWaitError(error) || this.interruptCause === "user") {
 			await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "interrupted", initialDeploy);
-			this.logger.info(`Partial state saved (${Object.keys(newResources).length} resources). Run deploy again to resume, 'cdkd rollback' to revert, or destroy to clean up.`);
+			this.logger.info(safeMsg`Partial state saved (${Object.keys(newResources).length} resources). ` + "Run deploy again to resume, 'cdkd rollback' to revert, or destroy to clean up.");
 			throw error;
 		}
 		if (this.options.noRollback) {
@@ -44498,7 +44628,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			this.logger.debug("State saved after deployment failure");
 			if (autoRollbackClean) await this.settleNestedChildrenAfterCleanRollback(stackName, rollbackSettledNested, await this.settleJournalAfterCleanRollback(stackName, rollbackRemainingFailedOps, initialDeploy));
 		} catch (saveError) {
-			this.logger.debug(`Retrying state save after rollback (ETag mismatch): ${saveError instanceof Error ? saveError.message : String(saveError)}`);
+			this.logger.debug(safeMsg`Retrying state save after rollback (ETag mismatch): ${asIsMessage(saveError instanceof Error ? saveError.message : String(saveError))}`);
 			try {
 				const freshEtag = (await this.stateBackend.getState(stackName, this.stackRegion))?.etag;
 				const postRollbackState = {
@@ -44517,7 +44647,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 				this.logger.debug("State saved after deployment failure (retry succeeded)");
 				if (autoRollbackClean) await this.settleNestedChildrenAfterCleanRollback(stackName, rollbackSettledNested, await this.settleJournalAfterCleanRollback(stackName, rollbackRemainingFailedOps, initialDeploy));
 			} catch (retryError) {
-				this.logger.warn(`Failed to save state after rollback: ${retryError instanceof Error ? retryError.message : String(retryError)}`);
+				this.logger.warn(safeMsg`Failed to save state after rollback: ${asIsMessage(retryError instanceof Error ? retryError.message : String(retryError))}`);
 			}
 		}
 		throw error;
@@ -44572,13 +44702,13 @@ async function persistStateAfterOutputFailure(stackName, currentState, newResour
 		});
 		this.logger.debug("State saved after output resolution failure");
 	} catch (saveError) {
-		this.logger.debug(`Retrying state save after output resolution failure (ETag mismatch): ${saveError instanceof Error ? saveError.message : String(saveError)}`);
+		this.logger.debug(safeMsg`Retrying state save after output resolution failure (ETag mismatch): ${asIsMessage(saveError instanceof Error ? saveError.message : String(saveError))}`);
 		try {
 			const freshEtag = (await this.stateBackend.getState(stackName, this.stackRegion))?.etag;
 			await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(buildState()), { ...freshEtag !== void 0 && { expectedEtag: freshEtag } });
 			this.logger.debug("State saved after output resolution failure (retry succeeded)");
 		} catch (retryError) {
-			this.logger.warn(`Failed to save state after output resolution failure: ${retryError instanceof Error ? retryError.message : String(retryError)} — resources were provisioned but not recorded; run deploy again to reconcile.`);
+			this.logger.warn(safeMsg`Failed to save state after output resolution failure: ${asIsMessage(retryError instanceof Error ? retryError.message : String(retryError))} — resources were provisioned but not recorded; run deploy again to reconcile.`);
 		}
 	}
 }
@@ -45892,7 +46022,7 @@ function inheritedProvenanceForChildDiff(args) {
 const TAIL_WARM_CONNECTIONS = 3;
 async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 	const startTime = Date.now();
-	this.logger.debug(`Starting deployment for stack: ${stackName}`);
+	this.logger.debug(safeMsg`Starting deployment for stack: ${displayStackName(stackName)}`);
 	const renderer = getLiveRenderer();
 	this.interrupted = false;
 	this.interruptCause = null;
@@ -45938,7 +46068,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		refuseMalformedOrphanRecords(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
 		this.provenanceBaseline = provenanceBaselineOf(currentState, isKnownTokenFreeState(currentStateData?.state));
 		const migrationPending = currentStateData?.migrationPending ?? false;
-		this.logger.debug(`Loaded current state: ${Object.keys(currentState.resources).length} resources`);
+		this.logger.debug(safeMsg`Loaded current state: ${Object.keys(currentState.resources).length} resources`);
 		if (this.options.onCurrentStateLoaded) {
 			const gate = this.options.onCurrentStateLoaded(stackName, currentStateData?.state);
 			if (currentStateData === null || currentStateData === void 0) {
@@ -45964,10 +46094,10 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			};
 			if (journal && journal.segments.length > 0) {
 				const failedOnly = journal.segments.every((s) => s.operations.length === 0) && journal.segments.some((s) => (s.failedOperations?.length ?? 0) > 0);
-				this.logger.info(failedOnly ? `A previous deploy of ${displayStackName(stackName)} failed and was automatically rolled back. The failed resource may be partially applied — revert it, or continue deploying to fix forward (${this.options.parentStackInfo ? "a successful deploy of the top-level stack clears this note" : "a successful deploy clears this note"}).\nRevert it with: ${pasteableCommand("cdkd rollback", [{
+				this.logger.info(failedOnly ? safeMsg`A previous deploy of ${displayStackName(stackName)} failed and was automatically rolled back. ` + `The failed resource may be partially applied — revert it, or continue ` + safeMsg`deploying to fix forward (${this.options.parentStackInfo ? "a successful deploy of the top-level stack clears this note" : "a successful deploy clears this note"}).` + safeMsg`\nRevert it with: ${pasteableCommand("cdkd rollback", [{
 					value: stackName,
 					hole: "stack"
-				}, { literal: "--revert-failed" }]).command}` : `A previous deploy of ${displayStackName(stackName)} failed or was interrupted. Revert it, or continue deploying to fix forward.\nRevert it with: ${pasteableCommand("cdkd rollback", [{
+				}, { literal: "--revert-failed" }]).command}` : safeMsg`A previous deploy of ${displayStackName(stackName)} failed or was interrupted. Revert it, ` + `or continue deploying to fix forward.` + safeMsg`\nRevert it with: ${pasteableCommand("cdkd rollback", [{
 					value: stackName,
 					hole: "stack"
 				}]).command}`);
@@ -45975,13 +46105,13 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		} catch {}
 		this.stampReasonlessParameterRefusals(currentState.resources, template);
 		this.kickOffAutoRefreshObservedProperties(currentState.resources, currentState);
-		this.logger.debug(`Template has ${Object.keys(template.Resources || {}).length} resources`);
+		this.logger.debug(safeMsg`Template has ${Object.keys(template.Resources || {}).length} resources`);
 		const outputsDigestSource = structuredClone({
 			...template,
 			Resources: {}
 		});
 		const parameterValues = await this.resolver.resolveParameters(template, this.options.parameters, { ...this.options.inheritedSecrets && hasMaskableValues(this.options.inheritedSecrets) && { inheritedSecrets: this.options.inheritedSecrets } });
-		this.logger.debug(`Resolved ${Object.keys(parameterValues).length} parameters: ${Object.keys(parameterValues).join(", ")}`);
+		this.logger.debug(safeMsg`Resolved ${Object.keys(parameterValues).length} parameters: ${Object.keys(parameterValues).join(", ")}`);
 		poisonRenderedSpellingsCollidingIn(template, parameterValues, this.options.inheritedSecrets);
 		this.inheritedNoEchoParameters = /* @__PURE__ */ new Set([...this.freshNoEchoParameters(parameterValues) ?? [], ...this.options.passedNoEchoParameters ?? []]);
 		const backfillNoEchoValues = noEchoParameterValueSeed(template.Parameters, parameterValues, this.options.inheritedSecrets, this.options.parameters);
@@ -46001,7 +46131,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			parameters: parameterValues
 		}, stackName);
 		const conditions = await this.resolver.evaluateConditions(context);
-		this.logger.debug(`Evaluated ${Object.keys(conditions).length} conditions: ${Object.keys(conditions).join(", ")}`);
+		this.logger.debug(safeMsg`Evaluated ${Object.keys(conditions).length} conditions: ${Object.keys(conditions).join(", ")}`);
 		refuseNoValueOutputs(template.Outputs, conditions);
 		let conditionVerdicts;
 		if (conditionsReadByDiff(template, conditions).size > 0) {
@@ -46039,7 +46169,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		this.logger.debug(`All resource properties validated`);
 		const dag = this.dagBuilder.buildGraph(effectiveTemplate);
 		const executionLevels = this.dagBuilder.getExecutionLevels(dag);
-		this.logger.debug(`Dependency graph: ${executionLevels.length} execution levels`);
+		this.logger.debug(safeMsg`Dependency graph: ${executionLevels.length} execution levels`);
 		const diffResolverContext = this.buildResolverContext({
 			template: effectiveTemplate,
 			resources: currentState.resources,
@@ -46139,8 +46269,8 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 				const outputsChanged = !outputMapsEqual(persistedOutputs, outputsToPersist);
 				const persistExportSet = new Set(exportNamesToPersist ?? []);
 				const exportSetChanged = exportNamesToPersist !== void 0 && (currentEffectiveExports.size !== persistExportSet.size || [...persistExportSet].some((k) => !currentEffectiveExports.has(k)));
-				if (merge?.kind === "kept" && !outputMapsEqual(persistedOutputs, resolvedOutputs)) this.logger.warn(`Outputs changed but one or more could not be resolved; keeping the previously persisted outputs. ${keptWholeReasonText(merge.reason)} A downstream Fn::ImportValue may fail until the next deploy.`);
-				else if (merge?.kind === "merged" && merge.carriedKeys.length > 0) this.logger.debug(`Kept the previously persisted value of ${merge.carriedKeys.length} output key(s), carried export aliases included, that could not be resolved (no-change path)`);
+				if (merge?.kind === "kept" && !outputMapsEqual(persistedOutputs, resolvedOutputs)) this.logger.warn(safeMsg`Outputs changed but one or more could not be resolved; keeping the previously persisted outputs. ${keptWholeReasonText(merge.reason)} ` + "A downstream Fn::ImportValue may fail until the next deploy.");
+				else if (merge?.kind === "merged" && merge.carriedKeys.length > 0) this.logger.debug(safeMsg`Kept the previously persisted value of ${merge.carriedKeys.length} output key(s), ` + "carried export aliases included, that could not be resolved (no-change path)");
 				const skippedOutputsChanged = !skippedOutputsEqual(currentState.skippedOutputs, this.skippedOutputs);
 				const healedAttributesPending = this.hasUnpersistedHeals(currentState.resources);
 				const conditionVerdictsChanged = !conditionVerdictRecordsEqual(readRecordedConditionVerdicts(currentState), conditionVerdicts);
@@ -46179,7 +46309,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 					else if (healedAttributesPending) this.logger.debug("Persisted attributes re-read from AWS for a stale record (no-change path)");
 					else this.logger.debug("Persisted skipped-outputs record (no outputs-value diff, no-change path)");
 				} catch (saveError) {
-					this.logger.warn(`Failed to persist no-change state update: ${saveError instanceof Error ? saveError.message : String(saveError)} — drift baseline / outputs will be re-resolved on next deploy.`);
+					this.logger.warn(safeMsg`Failed to persist no-change state update: ${asIsMessage(saveError instanceof Error ? saveError.message : String(saveError))} — drift baseline / outputs will be re-resolved on next deploy.`);
 				}
 			}
 			return {
@@ -46198,7 +46328,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		const createChanges = this.diffCalculator.filterByType(changes, "CREATE");
 		const updateChanges = this.diffCalculator.filterByType(changes, "UPDATE");
 		const deleteChanges = this.diffCalculator.filterByType(changes, "DELETE");
-		this.logger.info(`Changes: ${green(createChanges.length)} to create, ${yellow(updateChanges.length)} to update, ${red(deleteChanges.length)} to delete`);
+		this.logger.info(safeMsg`Changes: ${green(createChanges.length)} to create, ${yellow(updateChanges.length)} to update, ${red(deleteChanges.length)} to delete`);
 		if (this.options.dryRun) {
 			this.logger.info("Dry run mode - skipping actual deployment");
 			return {
@@ -46277,7 +46407,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			...newState,
 			conditionVerdicts
 		} : newState)), flushKeptForReadoption(this)]);
-		this.logger.debug(`State saved (ETag: ${newEtag})`);
+		this.logger.debug(safeMsg`State saved (ETag: ${newEtag})`);
 		const ledgerAndKeptCleanup = (async () => {
 			await forgetRecordedCreateTokens(Object.keys(newState.resources));
 			const readopted = await this.generatedNameGuard?.readoptedFromRetained() ?? [];
@@ -46338,7 +46468,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			await this.lockManager.releaseLock(stackName, this.stackRegion);
 			this.logger.debug("Lock released");
 		} catch (lockError) {
-			this.logger.warn(`Failed to release lock: ${lockError instanceof Error ? lockError.message : String(lockError)}`);
+			this.logger.warn(safeMsg`Failed to release lock: ${asIsMessage(lockError instanceof Error ? lockError.message : String(lockError))}`);
 		}
 	}
 }
@@ -46493,7 +46623,7 @@ function addImplicitDeleteDependencies(deleteIds, state, dependedBy) {
 				if (!dependedBy.has(id)) dependedBy.set(id, /* @__PURE__ */ new Set());
 				if (!dependedBy.get(id).has(depId)) {
 					dependedBy.get(id).add(depId);
-					this.logger.debug(`Implicit delete dependency: ${depId} (${depType}) must be deleted before ${id} (${resource.resourceType})`);
+					this.logger.debug(safeMsg`Implicit delete dependency: ${depId} (${depType}) must be deleted before ${id} (${resource.resourceType})`);
 				}
 			}
 		}
@@ -46507,7 +46637,7 @@ function addImplicitDeleteDependencies(deleteIds, state, dependedBy) {
 		if (!dependedBy.has(after)) dependedBy.set(after, /* @__PURE__ */ new Set());
 		if (!dependedBy.get(after).has(before)) {
 			dependedBy.get(after).add(before);
-			this.logger.debug(`Implicit delete dependency: ${before} (${scoped[before]?.resourceType}) must be deleted before ${after} (${scoped[after]?.resourceType})`);
+			this.logger.debug(safeMsg`Implicit delete dependency: ${before} (${scoped[before]?.resourceType}) must be deleted before ${after} (${scoped[after]?.resourceType})`);
 		}
 	}
 }
@@ -46572,6 +46702,7 @@ var DeployEngine = class {
 	noEchoExactEchoes = /* @__PURE__ */ new Map();
 	noEchoAttributeReads = /* @__PURE__ */ new Map();
 	replacedDeleteSkips = /* @__PURE__ */ new Map();
+	deferredReplacedDeletes = void 0;
 	secretNameNeedles = /* @__PURE__ */ new Map();
 	perResourceTemplateProps = /* @__PURE__ */ new Map();
 	perResourceResolvedType = /* @__PURE__ */ new Map();
@@ -46649,6 +46780,7 @@ var DeployEngine = class {
 		this.noEchoExactEchoes = /* @__PURE__ */ new Map();
 		this.noEchoAttributeReads = /* @__PURE__ */ new Map();
 		this.replacedDeleteSkips = /* @__PURE__ */ new Map();
+		this.deferredReplacedDeletes = void 0;
 		this.secretNameNeedles = /* @__PURE__ */ new Map();
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
 		this.constructPathTemplate = void 0;
@@ -46885,6 +47017,8 @@ DeployEngine.prototype.typeChangeNameQuestion = typeChangeNameQuestion;
 DeployEngine.prototype.checkedReplacementNameChange = checkedReplacementNameChange;
 DeployEngine.prototype.createFirstThenDeleteOld = createFirstThenDeleteOld;
 DeployEngine.prototype.deleteReplacedAfterCreate = deleteReplacedAfterCreate;
+DeployEngine.prototype.retryDeferredReplacedDeletes = retryDeferredReplacedDeletes;
+DeployEngine.prototype.warnUnretriedReplacedDeletes = warnUnretriedReplacedDeletes;
 DeployEngine.prototype.diffLogMasker = diffLogMasker;
 DeployEngine.prototype.freshNoEchoParameters = freshNoEchoParameters;
 DeployEngine.prototype.redactParametersForDiff = redactParametersForDiff;
@@ -46939,4 +47073,4 @@ DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice
 
 //#endregion
 export { S3_AUTO_DELETE_OBJECTS_TAG as $, unwrittenCreateOnlyReplacement as $a, getLegacyStateBucketName as $c, malformedExportSourceWarning as $i, formatDestructiveChange as $n, recordLogOnlyParameterValue as $o, explicitRoleArnOrThrow as $r, hasReadableExportSet as $s, replacementNeverSwapped as $t, diffSecurity as A, refuseMalformedResourceEntriesForImport as Aa, describeDockerExecFailure as Ac, cfnRefValueFromPhysicalId as Ai, absoluteAssemblyPathEscape as Al, DEFAULT_RESOURCE_WARN_AFTER_MS as An, sameLambdaFunctionAddress as Ao, RollbackInlinePolicyWriters as Ar, recordNoEchoParameterFreshValue as As, withNestedStackContext as At, readProtection as B, refuseMalformedState as Ba, redactedCause as Bc, STATE_RESOURCES_MALFORMED as Bi, extractDeploymentEventError as Bn, noEchoLeavesOf as Bo, isTerminationProtectionPropagationError as Br, isLockInfoExpired as Bs, awaitInFlightSibling as Bt, withApiLimit as C, refuseMalformedOrphansForOrphan as Ca, readBootstrapMarkerBody as Cc, getAccountInfo as Ci, StageLoadError as Cl, isWholeDynamicReferenceValue as Cn, requireConfigString as Co, withPrintingSecrets as Cr, recordPhysicalNameCopy as Cs, nestedChildStackName as Ct, findServiceTokenRefusals as D, refuseMalformedResourceEntries as Da, buildDockerImage as Dc, isNamelessDynamicReferenceError as Di, hasPlainPrototype$1 as Dl, isExportAliasCollision as Dn, withRetry as Do, CloudControlProvider as Dr, recordMaskOnlyValue as Ds, withNestedRevertRun as Dt, deferredServiceTokenWarning as E, refuseMalformedResourceAttributesForOrphan as Ea, buildDenyExternalAccessPolicy as Ec, carriesFetchableDynamicReference as Ei, hasOwnKey as El, collectPublishedOutputNames as En, describeTypeWithThrottleRetry as Eo, customResourceResponseExpirationWarning as Er, provenPublicValue as Es, revertedNestedRowIds as Et, recordedProtectionEvidence as F, refuseMalformedResourcePropertiesForExport as Fa, getDockerCmd as Fc, parameterInputsFor as Fi, injectAwsRegion as Fl, secretNamePrintingBag as Fn, maskAtCoordinates as Fo, withIndeterminateGuard as Fr, STATE_SOURCED_READBACK_RULES as Fs, loadJournaledOrphans as Ft, deleteBudgetKey as G, repairMalformedResourcePropertiesForReadOnly as Ga, escapeRegExp$3 as Gc, displayLogicalId as Gi, createPreDeleteFinalSnapshot as Gn, valueAtCoordinate as Go, INTRINSIC_KEYS as Gr, applyCrossPrefixScan as Gs, recordAfterRollbackUpdate as Gt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as H, repairMalformedOrphansForReadOnly as Ha, runDockerForeground as Hc, UNREADABLE_RESOURCES_MAP_ROW as Hi, PRE_DELETE_SNAPSHOT_TYPES as Hn, passedNoEchoParametersOf as Ho, reDisableInstanceApiTermination as Hr, rebuildClientForBucketRegion as Hs, getStackRecords as Ht, recordedProtectionNote as I, refuseMalformedResourcePropertiesForOrphan as Ia, isDockerClientEnvKey as Ic, passedParameterClassesOf as Ii, injectedAwsRegionValue as Il, secretNamePrintingBags as In, maskReadbackAtCoordinates as Io, isWaitAbandonedError as Ir, TEMPLATE_SOURCED_RULES as Is, makeForeignHolderScan as It, DELETE_INDEX_WAIT_PROCEED_NOTE as J, unreadableOrphanRecords as Ja, AssetManifestLoader as Jc, hasReadableResources as Ji, refusesFinalSnapshot as Jn, createUnionSecretMasker as Jo, producerLookupOver as Jr, isNotImplemented as Js, isReplacementOrphan as Jt, resolveDynamoDbDeleteBudgetClock as K, repairMalformedResourcesForReadOnly as Ka, stripControlChars as Kc, hasReadableOrphans as Ki, effectiveDeletionPolicy as Kn, liveMatchesUnresolvedTokenFrame as Ko, IntrinsicFunctionResolver as Kr, crossPrefixDeniedWarning as Ks, demoteSupersededOrphans as Kt, PROTECTION_PROPERTY_BY_TYPE as L, refuseMalformedResourcesForDeploy as La, isMalformedEnvKey as Lc, declaresNoEcho as Li, clearBucketRegionCache as Ll, secretNamedRecordNeedles as Ln, maskWholeValue as Lo, markWaitAbandoned as Lr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ls, sameJournaledOrphans as Lt, noEchoComparisonForTemplate as M, refuseMalformedResourceEntriesForOrphan as Ma, dockerSpawnEnvWithSensitive as Mc, refStateLookupFromResource as Mi, displayAssemblyPath as Ml, journaledOrphanPrintingBag as Mn, TemplateParser as Mo, deleteIndeterminateGuards as Mr, wholeStringLeavesOf as Ms, dropFailedHint as Mt, noEchoExactEchoLeavesOf as N, refuseMalformedResourcePropertiesForDestroy as Na, finchSecretArgvRefusal as Nc, parseWebACLArn as Ni, renderAssemblyPathEscape as Nl, maskEventTextWithBoundBags as Nn, canonicalCoordinates as No, deleteLeftInPlace as Nr, STATE_SOURCED_BASELINE_RULES as Ns, isHandledOrphan as Nt, serviceTokenBlockingReason as O, refuseMalformedResourceEntriesForDeploy as Oa, resolveDockerContextDirectory as Oc, keepsSecretReferenceToken as Oi, nullPrototypeRecord as Ol, bindingSkippedOutputs as On, canonicalLambdaFunctionName as Oo, slowCcOperationTimeoutMs as Or, recordMaskOnlyValuesIn as Os, collectNestedChildUnaddressed as Ot, noEchoParameterNamesOf as P, refuseMalformedResourcePropertiesForDrift as Pa, formatDockerLoginError as Pc, withSharedDrainBudget as Pi, resolveAssemblyPath as Pl, orphanRecordsPrintingBag as Pn, isMarkedCoordinate as Po, deleteSkipReason as Pr, STATE_SOURCED_CROSS_GENERATION_RULES as Ps, journaledOrphanLines as Pt, ECR_AUTO_DELETE_IMAGES_TAG as Q, findSilentDropProperties as Qa, getDefaultStateBucketName as Qc, malformedExportNamesWarning as Qi, findDestructiveChanges as Qn, printingCorpusOf as Qo, assertSendableRoleArn as Qr, exportNamesCarriedFrom as Qs, recordUnderIdIsNotOwn as Qt, isProtectionValueActive as R, refuseMalformedResourcesForDestroy as Ra, partitionSensitiveEnv as Rc, JSON_LISTING_HOLE_VALUE as Ri, resolveBucketRegion as Rl, stateSecretNameNeedles as Rn, maskedLeafCoordinatesOf as Ro, disableInstanceApiTermination as Rr, isSingleDynamicReferenceToken as Rs, replayFailedOperations as Rt, lookupEachName as S, refuseMalformedOrphansForDestroy as Sa, parseBootstrapMarker as Sc, parameterTypeMayLoseSecretIdentity as Si, AssemblyReader as Sl, exportNameSecretExposure as Sn, requireConfigObject as So, getCurrentResourceSecrets as Sr, recordAttributeIdCopy as Ss, getNestedRevertRun as St, recordRetainedForReadoption as T, refuseMalformedOutputsForDestroy as Ta, validateContainerRepoName as Tc, carriesDynamicReference as Ti, defineOwnKey as Tl, collectDeclaredOutputNames as Tn, templateResourceTypes as To, applyCustomResourceResponseExpiration as Tr, carriesSecretMask as Ts, revertNestedChildFromJournal as Tt, beginDeleteWait as U, repairMalformedOutputsForReadOnly as Ua, runDockerStreaming as Uc, accountArgs as Ui, buildFinalSnapshotIdentifier as Un, readbackPathFor as Uo, reEnableInstanceApiTermination as Ur, CrossPrefixReadError as Us, withStackRecords as Ut, DynamoDBGlobalTableProvider as V, repairMalformedOrphanRecordsForReadOnly as Va, redactedDockerCause as Vc, UNREADABLE_ORPHANS_CONTAINER_ROW as Vi, ATOMIC_FINAL_SNAPSHOT_TYPES as Vn, noEchoOutputsComparison as Vo, observeThenDisableInstanceApiTermination as Vr, S3StateBackend as Vs, destroyStackRecordsView as Vt, compensateRemovedDeletionProtection as W, repairMalformedResourceEntriesForReadOnly as Wa, warnFinchArgvExposure as Wc, deployRefusesOrphanRowsReason as Wi, ccRoutedFinalSnapshotError as Wn, readsNoEchoSource as Wo, DiffCalculator as Wr, CrossPrefixScanCache as Ws, removeProtectionTypeList as Wt, deleteTableWithIndexBusyRetry as X, withheldAccountClause as Xa, Synthesizer as Xc, isReadableResourceEntry as Xi, maskingRetryLogger as Xn, literalSplitDelimitersOf as Xo, applyRoleArnIfSet as Xr, acceptedCreateOnlyDropsOf as Xs, planRollback as Xt, INDEX_SETTLE_POLL_INTERVAL_MS as Y, unreadableResourceEntries as Ya, getDockerImageBySourceHash as Yc, isReadableOrphanRecord as Yi, unsupportedFinalSnapshotError as Yn, hasMaskableValues as Yo, refuseUnreadableCdkCrossAccountRefs as Yr, splitImportedOps as Ys, planFailedOps as Yt, waitForIndexesSettled as Z, findActionableSilentDrops as Za, synthesisStatusMessage as Zc, malformedDriftResourcePropertiesWarning as Zi, constructPathOf as Zn, logOnlyValueCount as Zo, assertFlagRoleArn as Zr, describeRegionValueKind as Zs, recheckFailedPlan as Zt, keptWholeReasonText as _, refuseDivergentRecordRegionForDestroy as _a, BOOTSTRAP_MARKER_PREFIX as _c, classifyReplaySecretRegion as _i, decodeListingKey as _l, secretBearing as _n, configIntegerRefusal as _o, isCustomResource as _r, identityKeyFor as _s, planOrphanAdoption as _t, inheritedProvenanceForChildDiff as a, malformedOrphanRowsKeptWarning as aa, orphansAfterRollback as ac, envCredentialsAreAssumedRole as ai, resolveStateBucketWithDefault as al, inheritProducerRegions as an, MULTI_REGION_RECREATE_BLOCKED_TYPES as ao, DBPROXY_TAGS_WHAT as ar, maskSecretsInText as as, createReadOnlyAttributeHealerFactory as at, chunks as b, refuseMalformedOrphanRecordsForDestroy as ba, getBootstrapMarkerKey as bc, coerceParameterTypedValue as bi, canonicalizeRegion as bl, carriedExportAliasExposure as bn, replayWarn as bo, readsNoEchoDeleteValues as br, recoverMaskedOutput as bs, displacedPhysicalIdShown as bt, isAbsoluteAssetPath as c, malformedOutputsRefusalMessage as ca, AssetPublisher as cc, outputReferenceProvenanceOf as ci, stateBucketExistenceConfirmed as cl, redactedDeleteAddressFields as cn, renderStatefulReason as co, readTagList as cr, snapshotPassProvenance as cs, gray as ct, templateIdentity as d, malformedResourceEntriesWarning as da, WorkGraph as dc, s3BucketArn as di, CFN_TEMPLATE_BODY_LIMIT as dl, updatePartialReason as dn, isWarmThroughputDecrease as do, tagPlanWarning as dr, withPhysicalNameCopies as ds, yellow as dt, malformedLocalOutputsWarning as ea, hasReasonlessBaselineRefusal as ec, isIamRoleArn as ei, loadCdkJson as el, resolveReplacementOldType as en, withoutSilentDropProperties as eo, earliestDefined as er, recordLogOnlyValue as es, hasCdkAutoDeleteTag as et, conditionFingerprint as f, malformedResourcePropertiesWarning as fa, buildAssetRedirectMap as fc, s3BucketDomainName as fi, CFN_TEMPLATE_URL_LIMIT as fl, DeploymentEventsReader as fn, toCfnInteger as fo, definedAttributes as fr, withoutPhysicalNameCopies as fs, computeParameterTaint as ft, isSecretBearingReferenceString as g, previewableOrphanRecords as ga, AssetModeResolver as gc, classifyRecordedSecretRegion as gi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as gl, exportAliasCollisionScrubWarning as gn, configBooleanRefusal as go, ccBrokenReason as gr, pathCrossesDottedKey as gs, makeSiblingClaimReader as gt, readRecordedConditionVerdicts as h, malformedStateRefusalMessage as ha, rewriteTemplateAssetReferences as hc, s3BucketWebsiteUrl as hi, uploadCfnTemplate as hl, displayTextOrWithheld as hn, coerceCfnInteger as ho, ProviderRegistry as hr, isUncertifiedBaselineMaskPosition as hs, resourcesNamingDeclaredParameter as ht, crossStackOutputProvenanceSource as i, malformedOrphanRecordsWarning as ia, isReadableBag as ic, callerEnvCredentials as ii, resolveSkipPrefix as il, getCurrentProducerRegions as in, shownType as io, acquireIdempotencyToken as ir, maskSecretsInError as is, formatResourceLine as it, noEchoAttributeNamesOf as j, refuseMalformedResourceEntriesForImportSave as ja, describeDockerFailure as jc, isStalePlaceholderArnAttribute as ji, describeFileReadFailure as jl, completedReplayEntries as jn, DagBuilder as jo, UNSPECIFIED_SKIP_REASON as jr, recordProvenPublicExpression as js, deleteJournaledOrphans as jt, withResourceDeadline as k, refuseMalformedResourceEntriesForDestroy as ka, describeDockerCapturedOutput as kc, AWS_NO_VALUE as ki, ownValue as kl, DEFAULT_RESOURCE_TIMEOUT_MS as kn, lambdaFunctionNameForMask as ko, unchangedBehindSecretReference as kr, recordNoEchoAttributeValues as ks, getCurrentNestedStackContext as kt, listNestedTemplateRows as l, malformedOutputsWarning as la, isSensitiveAttributeName as lc, recordedOutputReferenceRegions as li, warnDeprecatedNoPrefixCliFlag as ll, redactedDeleteAddressSkip as ln, WARM_THROUGHPUT_MEMBERS as lo, refuseMalformedDesiredTags as lr, redactSecretsForState as ls, green as lt, parentSuppliedValues as m, malformedScrubResourceEntriesRefusalMessage as ma, loadPublishableAssetManifest as mc, s3BucketRegionalDomainName as mi, findLargeInlineResources as ml, WITHHELD_NAME_DISPLAY as mn, coerceCfnBoolean as mo, CC_BROKEN_REASON as mr, dynamicReferenceTokens as ms, reachableDivergentParameters as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedLocalResourcesWarning as na, importableOutputKeys as nc, AWS_CREDENTIAL_ENV_KEYS as ni, resolveAutoAssetStorage as nl, orphanDeleteNeedsIdentity as nn, hasNoCloudControlHandlers as no, reserveStackCreateToken as nr, createSecretMasker as ns, getPriorAttempts as nt, childTemplateLoader as o, malformedOrphansRefusalMessage as oa, orphansCarriedFrom as oc, isSettledInstanceState as oi, resolveStateBucketWithDefaultAndSource as ol, REDACTED_DELETE_ADDRESS_SKIP_REASON as on, isStatefulRecreateTargetForReplace as oo, DBPROXY_TAG_OPTIONS as or, markSameGenerationBag as os, bold as ot, conditionInputsFrom as p, malformedResourcesWarning as pa, createAssetRedirectResolver as pc, s3BucketDualStackDomainName as pi, MIGRATE_TMP_PREFIX as pl, DeploymentEventsStore as pn, toFiniteNumber as po, stringifyIfAssigned as pr, DYNAMIC_REFERENCE_TOKEN_SCAN as ps, namesAnyDeclaredParameter as pt, resolveDynamoDbDeleteBudgetMs as q, unpreviewableOrphanRecords as qa, stripForDisplay as qc, hasReadableOutputs as qi, isFinalSnapshotError as qn, carryLogOnlyValues as qo, poisonRenderedSpellingsCollidingIn as qr, isAccessDenied$1 as qs, isJournaledOrphan as qt, computeImplicitDeleteEdges as r, malformedOrphanRecordsRefusalMessage as ra, importableOutputs as rc, applyCallerIdentityCredentials as ri, resolveCaptureObservedState as rl, findNestedStackTypeChanges as rn, findReplacedReadersOfRecreateTargets as ro, withCreateTokenLedger as rr, errorCauseChain as rs, markRefusedBeforeApplying as rt, findNestedTemplateTreeDefect as s, malformedOrphansWarning as sa, shouldRetainResource as sc, keepHeldTokenProvenance as si, resolveUseCdkBootstrapAssets as sl, isRedactedRecordedValue as sn, isStatefulRecreateTargetSync as so, planTagDiff as sr, recordReferenceProvenanceEntry as ss, cyan as st, DeployEngine as t, malformedLocalResourceEntriesWarning as ta, hasUnverifiableParameterRefusal as tc, sendableAssumeRoleCommand as ti, resolveApp as tl, seedsDeleteFirstGuard as tn, NO_CC_HANDLERS_REASON as to, ledgerForStack as tr, shareLogOnlyValues as ts, isTruthyCfnBoolean as tt, renderNestedTemplateTreeDefect as u, malformedRenderedContainersWarning as ua, stringifyValue as uc, recordedReferenceRegions as ui, ssmResolvedValueType as ul, updatePartialMessage as un, coerceWarmThroughput as uo, tagMapAsList as ur, scrubResourceRecord as us, red as ut, mergeNoChangeOutputs as v, refuseMalformedNestedChildOutputs as va, assertAssetBucketRegion as vc, producerRegionsFromState as vi, expectedOwnerParam as vl, secretBearingStateKeyWarning as vn, configStringRefusal as vo, wouldReturnToSdkProvider as vr, inheritNestedStackParameterAssociations as vs, NESTED_PENDING_PARENT_REASON as vt, keptForReadoption as w, refuseMalformedOutputs as wa, validateAssetBucketName as wc, isImpossibleEmptyStoredAttribute as wi, processStackMessages as wl, noEchoParameterValueSeed as wn, prefetchCreateOnlyPropertyPaths as wo, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as wr, splitGetAttStringForm as ws, recordDisplacedSkips as wt, isAccessDeniedError as x, refuseMalformedOrphans as xa, isCrossRegionRedirect as xc, isUnboundTemplateParameter as xi, derivePartitionAndUrlSuffix as xl, exportNameNoEchoParameters as xn, requireConfigArray as xo, isCustomResourceType as xr, physicalNameCopiesOf as xs, dropSettledNestedJournals as xt, makeCanonicalizePropertiesFn as y, refuseMalformedOrphanRecords as ya, ensureAssetStorage as yc, regionLessSecretName as yi, PARTITION_TABLE as yl, secretSafeKeyDisplay as yn, readConfigString as yo, TemplateNoEchoReresolver as yr, recordNestedStackParameterExpressions as ys, displacedOpClause as yt, perType as z, refuseMalformedResourcesForExport as za, redactDockerArgvValues as zc, STATE_REGION_DIVERGED as zi, storedSecretNameNeedles as zn, noEchoCoordinatesOf as zo, ec2InstanceProtectionSite as zr, LockManager as zs, replayRollback as zt };
-//# sourceMappingURL=deploy-engine-DWIbDQdg.js.map
+//# sourceMappingURL=deploy-engine-DZhdwU1d.js.map