@go-to-k/cdkd 0.299.8 → 0.300.0

package/dist/{deploy-engine-BU3iY59A.js → deploy-engine-C-4ho8TJ.js}

@@ -1,8 +1,8 @@
-import { r as getAwsClients, s as __exportAll } from "./aws-clients-Bj7qH5Ph.js";
+import { r as getAwsClients, s as __exportAll } from "./aws-clients-B_CEQGE1.js";
 import { A as UNRENDERABLE, B as safeMsg, C as looksLikeCdkdGeneratedName, D as SAFE_MSG_ALTERED_CHAR, E as withoutGeneratedFallbackName, F as displaySafe, H as terminalSafe, I as displayStackName, L as isPasteableIdent, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, S as getCurrentStackName, T as withStackName, U as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, j as asIsMessage, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-dAY3-gXJ.js";
+import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-BxP3yqlr.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-DBXBcg0J.js";
-import { t as getCdkdVersion } from "./version-BtTEjOpj.js";
+import { t as getCdkdVersion } from "./version-CXGQKplb.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2308,7 +2308,7 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region, legacyF
 	logger.debug("No state bucket specified, resolving default from account...");
 	const { GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const { S3Client, HeadBucketCommand, ListObjectsV2Command } = await import("@aws-sdk/client-s3");
-	const { getAwsClients } = await import("./aws-clients-Bj7qH5Ph.js").then((n) => n.n);
+	const { getAwsClients } = await import("./aws-clients-B_CEQGE1.js").then((n) => n.n);
 	const { expectedOwnerParam, recordResolvedAccountId } = await Promise.resolve().then(() => expected_bucket_owner_exports);
 	const probeDeps = {
 		HeadBucketCommand,
@@ -4846,7 +4846,7 @@ function retainedOldPhysicalId(op) {
 	const prevType = op.previousState?.resourceType;
 	const oldType = op.previousResourceType ?? (typeof prevType === "string" && prevType !== "" ? prevType : void 0);
 	if (!(prev !== journalOpPhysicalId(op) || oldType !== void 0 && oldType !== op.resourceType)) return void 0;
-	return op.oldResourceRetained !== false ? prev : void 0;
+	return op.oldResourceRetained !== false || op.oldResourceMaySurvive !== void 0 ? prev : void 0;
 }
 function isMarkFor(mark, op) {
 	const own = journalOpPhysicalId(op);
@@ -4892,6 +4892,7 @@ function refuseMalformedOperation(shownStack, where, op) {
 	}
 	if (o["wasReplaced"] !== void 0 && typeof o["wasReplaced"] !== "boolean") fail("wasReplaced", o["wasReplaced"], "a boolean when present");
 	if (o["oldDeletedBeforeCreate"] !== void 0 && typeof o["oldDeletedBeforeCreate"] !== "boolean") fail("oldDeletedBeforeCreate", o["oldDeletedBeforeCreate"], "a boolean when present");
+	if (o["oldResourceMaySurvive"] !== void 0 && !["kept", "unconfirmed"].includes(o["oldResourceMaySurvive"])) fail("oldResourceMaySurvive", o["oldResourceMaySurvive"], "kept or unconfirmed when present");
 	if (o["physicalIdRecoveredFromError"] !== void 0 && typeof o["physicalIdRecoveredFromError"] !== "boolean") fail("physicalIdRecoveredFromError", o["physicalIdRecoveredFromError"], "a boolean when present");
 	if (o["physicalIdRecoveredFromError"] !== void 0 && o["changeType"] !== "CREATE") refuseMalformed(shownStack, `${where}.physicalIdRecoveredFromError is only valid on a CREATE (got changeType ${kind(o["changeType"])}).`);
 	const identity = o["createdResourceIdentity"];
@@ -8080,13 +8081,43 @@ function positionByInheritedParameter(bag, source, secrets) {
 }
 const REREAD_TRIGGERS = /* @__PURE__ */ new Set(["Fn::Select", "Fn::Split"]);
 const MAX_REREAD_DEPTH = 16;
-function evaluatePureRead(node, bind, depth = 0) {
+function splitOutsideDynamicReferences(text, delimiter, standsForSecret) {
+	if (delimiter === "") return text.split(delimiter);
+	const spans = dynamicReferenceSpans(text).filter((span) => {
+		const token = text.slice(span.start, span.end);
+		return spanNamesResolvableService(token) && standsForSecret(token);
+	});
+	if (spans.length === 0) return text.split(delimiter);
+	const pieces = [];
+	let cursor = 0;
+	let from = 0;
+	for (;;) {
+		const at = text.indexOf(delimiter, from);
+		if (at === -1) break;
+		const end = at + delimiter.length;
+		const token = spans.find((span) => span.start < end && at < span.end);
+		if (token !== void 0) {
+			from = token.end;
+			continue;
+		}
+		pieces.push(text.slice(cursor, at));
+		cursor = end;
+		from = end;
+	}
+	pieces.push(text.slice(cursor));
+	return pieces;
+}
+function standsForInheritedSecret(parentSecrets, token) {
+	return parentSecrets !== void 0 && resolvedPlaintextOf(parentSecrets, token) !== void 0;
+}
+const plainSplit = (text, delimiter) => text.split(delimiter);
+function evaluatePureRead(node, bind, split, depth = 0) {
 	if (depth > MAX_REREAD_DEPTH) return void 0;
 	if (typeof node === "string") return node.includes("{{resolve:") ? void 0 : { value: node };
 	if (Array.isArray(node)) {
 		const out = [];
 		for (const element of node) {
-			const evaluated = evaluatePureRead(element, bind, depth + 1);
+			const evaluated = evaluatePureRead(element, bind, split, depth + 1);
 			if (evaluated === void 0) return void 0;
 			out.push(evaluated.value);
 		}
@@ -8103,19 +8134,19 @@ function evaluatePureRead(node, bind, depth = 0) {
 		const index = args[0];
 		const position = typeof index === "number" ? index : typeof index === "string" && /^(0|[1-9][0-9]*)$/.test(index) ? Number(index) : void 0;
 		if (position === void 0 || !Number.isSafeInteger(position) || position < 0) return void 0;
-		const list = evaluatePureRead(args[1], bind, depth + 1);
+		const list = evaluatePureRead(args[1], bind, split, depth + 1);
 		if (list === void 0 || !Array.isArray(list.value) || position >= list.value.length) return;
 		return { value: list.value[position] };
 	}
 	const delimiter = args[0];
 	if (typeof delimiter !== "string") return void 0;
 	if (key === "Fn::Split") {
-		const value = evaluatePureRead(args[1], bind, depth + 1);
+		const value = evaluatePureRead(args[1], bind, split, depth + 1);
 		if (value === void 0 || typeof value.value !== "string") return void 0;
-		return { value: value.value.split(delimiter) };
+		return { value: split(value.value, delimiter) };
 	}
 	if (key === "Fn::Join") {
-		const parts = evaluatePureRead(args[1], bind, depth + 1);
+		const parts = evaluatePureRead(args[1], bind, split, depth + 1);
 		if (parts === void 0 || !Array.isArray(parts.value)) return void 0;
 		if (!parts.value.every((part) => typeof part === "string")) return void 0;
 		return { value: parts.value.join(delimiter) };
@@ -8137,12 +8168,12 @@ function rendersReadTo(spelling, parentSecrets, value) {
 }
 function rereadParameterExpression(source, bind, parentSecrets) {
 	if (!holdsRereadTrigger(source)) return void 0;
-	const resolved = evaluatePureRead(source, bind);
+	const resolved = evaluatePureRead(source, bind, plainSplit);
 	if (resolved === void 0) return void 0;
 	const redacted = evaluatePureRead(source, (name) => {
 		const bound = bind(name);
 		return bound && { value: redactInheritedParameterValue(parentSecrets, name, bound.value) };
-	});
+	}, (text, delimiter) => splitOutsideDynamicReferences(text, delimiter, (token) => standsForInheritedSecret(parentSecrets, token)));
 	if (redacted === void 0) return void 0;
 	if (!rendersReadTo(redacted.value, parentSecrets, resolved.value)) return void 0;
 	return {
@@ -9617,14 +9648,16 @@ function carryListElementFragments(needles, to, value) {
 		for (const fragment of fragments) recordLogOnlyValue(to, fragment);
 	}
 }
-function recordLogOnlySplitFragments(from, to, text, delimiter) {
+function recordLogOnlySplitFragments(from, to, text, delimiter, printed) {
 	if (delimiter === "") return;
+	const splits = [text.split(delimiter)];
+	if (printed !== void 0 && (printed.length !== splits[0].length || printed.some((piece, i) => piece !== splits[0][i]))) splits.push(printed);
 	for (const bag of from) {
 		if (bag === void 0) continue;
-		for (const needle of [...logOnlyValuesOf.get(bag) ?? []]) for (const fragment of fragmentsOfNeedleIn(text, delimiter, needle)) if (fragment !== needle) recordLogOnlyValue(to, fragment);
+		for (const needle of [...logOnlyValuesOf.get(bag) ?? []]) for (const pieces of splits) for (const fragment of fragmentsOfNeedleIn(text, delimiter, needle, pieces)) if (fragment !== needle) recordLogOnlyValue(to, fragment);
 	}
 }
-function fragmentsOfNeedleIn(text, delimiter, needle) {
+function fragmentsOfNeedleIn(text, delimiter, needle, pieces = text.split(delimiter)) {
 	const fragments = /* @__PURE__ */ new Set();
 	if (needle === "") return fragments;
 	const starts = [];
@@ -9633,7 +9666,7 @@ function fragmentsOfNeedleIn(text, delimiter, needle) {
 	if (starts.length === 0) return fragments;
 	const spans = [];
 	let offset = 0;
-	for (const piece of text.split(delimiter)) {
+	for (const piece of pieces) {
 		spans.push([offset, offset + piece.length]);
 		offset += piece.length + delimiter.length;
 	}
@@ -11922,6 +11955,7 @@ const CREATE_ONLY_PATHS_SNAPSHOT = /* @__PURE__ */ new Map([
 		["LicenseInfo"]
 	]],
 	["AWS::Lambda::MicrovmImage", [["Name"]]],
+	["AWS::Lambda::NetworkConnector", [["Name"]]],
 	["AWS::Lambda::Permission", [
 		["Action"],
 		["EventSourceToken"],
@@ -11934,6 +11968,19 @@ const CREATE_ONLY_PATHS_SNAPSHOT = /* @__PURE__ */ new Map([
 		["SourceArn"]
 	]],
 	["AWS::Lambda::Url", [["Qualifier"], ["TargetFunctionArn"]]],
+	["AWS::Lambda::WebFunctionEndpoint", [
+		["EndpointName"],
+		["EndpointType"],
+		["FunctionName"],
+		["Regions"]
+	]],
+	["AWS::Lambda::WebFunctionRevision", [
+		["BuildConfig"],
+		["Description"],
+		["FunctionName"],
+		["KmsKeyArn"],
+		["ServiceConfig"]
+	]],
 	["AWS::Logs::LogGroup", [["LogGroupName"]]],
 	["AWS::Neptune::DBCluster", [
 		["AvailabilityZones"],
@@ -12380,6 +12427,11 @@ const REVERSE_REPLACEMENT_NAME_KEYS = {
 	"AWS::KinesisFirehose::DeliveryStream": flat("DeliveryStreamName"),
 	"AWS::KMS::Alias": flat("AliasName"),
 	"AWS::Lambda::MicrovmImage": flat("Name"),
+	"AWS::Lambda::NetworkConnector": flat("Name"),
+	"AWS::Lambda::WebFunctionEndpoint": {
+		name: [["EndpointName"]],
+		scope: [["FunctionName"]]
+	},
 	"AWS::Pipes::Pipe": flat("Name"),
 	"AWS::RDS::DBProxyTargetGroup": {
 		name: [["TargetGroupName"]],
@@ -12422,6 +12474,7 @@ const NOT_NAME_KEYED_TYPES = /* @__PURE__ */ new Set([
 	"AWS::IAM::Policy",
 	"AWS::Lambda::EventInvokeConfig",
 	"AWS::Lambda::Permission",
+	"AWS::Lambda::WebFunctionRevision",
 	"AWS::Route53::HostedZone"
 ]);
 const CASE_INSENSITIVE_NAME_TYPES = /* @__PURE__ */ new Set([
@@ -14534,7 +14587,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
-		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		readOnly: /* @__PURE__ */ new Set(["AnomalyDetectorId"]),
 		ccRouteUnavailable: true
 	}],
 	["AWS::CodeBuild::Project", {
@@ -15951,6 +16004,23 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		]),
 		ccRouteUnavailable: false
 	}],
+	["AWS::Lambda::NetworkConnector", {
+		handled: /* @__PURE__ */ new Set([
+			"Configuration",
+			"Name",
+			"OperatorRole",
+			"Tags"
+		]),
+		silentDrop: /* @__PURE__ */ new Map(),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"Arn",
+			"LatestVersion",
+			"LatestVersionArn",
+			"State"
+		]),
+		ccRouteUnavailable: false
+	}],
 	["AWS::Lambda::Permission", {
 		handled: /* @__PURE__ */ new Set([
 			"Action",
@@ -15981,6 +16051,54 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		readOnly: /* @__PURE__ */ new Set(["FunctionArn", "FunctionUrl"]),
 		ccRouteUnavailable: false
 	}],
+	["AWS::Lambda::WebFunctionEndpoint", {
+		handled: /* @__PURE__ */ new Set([
+			"AuthType",
+			"Description",
+			"EndpointName",
+			"EndpointType",
+			"FunctionName",
+			"Regions",
+			"RevisionWeights",
+			"ScalingConfig",
+			"ThrottleConfig"
+		]),
+		silentDrop: /* @__PURE__ */ new Map(),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"CreatedAt",
+			"DomainName",
+			"EndpointArn",
+			"FunctionArn",
+			"RegionalEndpoints",
+			"State",
+			"StateReason",
+			"UpdatedAt",
+			"UpdateStatus",
+			"UpdateStatusReason"
+		]),
+		ccRouteUnavailable: false
+	}],
+	["AWS::Lambda::WebFunctionRevision", {
+		handled: /* @__PURE__ */ new Set([
+			"BuildConfig",
+			"Description",
+			"FunctionName",
+			"KmsKeyArn",
+			"ServiceConfig"
+		]),
+		silentDrop: /* @__PURE__ */ new Map(),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"CreatedAt",
+			"FunctionArn",
+			"RevisionArn",
+			"RevisionId",
+			"State",
+			"StateReason"
+		]),
+		ccRouteUnavailable: false
+	}],
 	["AWS::Logs::LogGroup", {
 		handled: /* @__PURE__ */ new Set([
 			"BearerTokenAuthenticationEnabled",
@@ -21964,6 +22082,7 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 			const verdictScope = secretVerdictScope(this);
 			const isKnownSecret = service === "secretsmanager" || service === "ssm-secure" || isScopedSecretVerdict(verdictScope, fullMatch);
 			if (isKnownSecret && context?.skipDynamicReferences) {
+				context.skippedSecretReferences?.add(fullMatch);
 				complete = false;
 				continue;
 			}
@@ -22042,6 +22161,7 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 				isSecret = param.secure;
 				if (param.secure) {
 					if (!decrypt) {
+						context?.skippedSecretReferences?.add(fullMatch);
 						complete = false;
 						continue;
 					}
@@ -22390,6 +22510,12 @@ function describeSplitValueSource(value) {
 		kind: "getatt"
 	};
 }
+function splitValueResolvesReferences(value) {
+	if (typeof value === "string") return true;
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const keys = Object.keys(value);
+	return keys.length === 1 && (keys[0] === "Fn::Join" || keys[0] === "Fn::Sub");
+}
 async function resolveSplit(splitArgs, context) {
 	const [delimiter, value] = splitArgs;
 	const resolvedValue = await this.resolveValue(value, context);
@@ -22402,22 +22528,22 @@ async function resolveSplit(splitArgs, context) {
 		}
 		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Split: the value to split${sourceClause} must be a string, got ${resolvedValue === null ? "null" : typeof resolvedValue}. Fn::Split accepts only a string; check the value or the intrinsic that produced it.`));
 	}
-	const result = resolvedValue.split(delimiter);
+	const result = context.skipDynamicReferences === true && typeof delimiter === "string" ? splitOutsideDynamicReferences(resolvedValue, delimiter, splitValueResolvesReferences(value) ? () => true : (token) => standsForInheritedSecret(context.inheritedSecrets, token) || context.secretStandInTokens?.has(token) === true) : resolvedValue.split(delimiter);
 	let lineContext = context;
 	if (this.hasLogOnlyNeedles(context)) {
-		if (context.recordedSecretValues) recordLogOnlySplitFragments([context.inheritedSecrets, context.recordedSecretValues], context.recordedSecretValues, resolvedValue, String(delimiter));
+		if (context.recordedSecretValues) recordLogOnlySplitFragments([context.inheritedSecrets, context.recordedSecretValues], context.recordedSecretValues, resolvedValue, String(delimiter), result);
 		else {
 			const linePieces = /* @__PURE__ */ new Map();
 			if (context.printingSecrets !== void 0) carryLogOnlyValues(context.printingSecrets, linePieces);
-			recordLogOnlySplitFragments([context.inheritedSecrets], linePieces, resolvedValue, String(delimiter));
+			recordLogOnlySplitFragments([context.inheritedSecrets], linePieces, resolvedValue, String(delimiter), result);
 			lineContext = {
 				...context,
 				printingSecrets: linePieces
 			};
 		}
 	}
-	if (context.printingSecrets !== void 0 && hasLogOnlyValues(context.printingSecrets)) recordLogOnlySplitFragments([context.printingSecrets], context.printingSecrets, resolvedValue, String(delimiter));
-	if (context.secretNameSink !== void 0 && hasLogOnlyValues(context.secretNameSink)) recordLogOnlySplitFragments([context.secretNameSink], context.secretNameSink, resolvedValue, String(delimiter));
+	if (context.printingSecrets !== void 0 && hasLogOnlyValues(context.printingSecrets)) recordLogOnlySplitFragments([context.printingSecrets], context.printingSecrets, resolvedValue, String(delimiter), result);
+	if (context.secretNameSink !== void 0 && hasLogOnlyValues(context.secretNameSink)) recordLogOnlySplitFragments([context.secretNameSink], context.secretNameSink, resolvedValue, String(delimiter), result);
 	const pieceTwins = String(delimiter) === "" && this.maskRenderedNeedlesForLog(resolvedValue, lineContext) !== resolvedValue ? result.map(() => "***") : this.splitLogTwins(resolvedValue, delimiter, result, context);
 	this.logger.debug(`Resolved Fn::Split: split by ${this.splitDelimiterRender(String(delimiter), lineContext)} resolved to ${this.logRender(JSON.stringify(this.maskValueLeaves(pieceTwins, lineContext)), lineContext, { structured: true })}`);
 	return result;
@@ -23212,16 +23338,23 @@ function recordInheritedParameterSecrets(parameterName, value, context) {
 	if (recorded) carryPhysicalNameCopiesCarriedBy(context, recorded, value);
 	if (inherited && recorded) recordInheritedNoEchoListElements(this, inherited, recorded, value, context);
 	if (!inherited || inherited.size === 0 || !recorded) return;
+	const mirror = parameterReadMirrors.get(recorded);
 	recordInheritedParameterValue(recorded, inherited, parameterName, value);
+	if (mirror) recordInheritedParameterValue(mirror, inherited, parameterName, value);
 	for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) {
 		const carried = carriedExpressionFor(inherited, parameterName, value, plaintext, expression);
 		recorded.set(plaintext, carried);
 		const parentEntry = context.inheritedReferenceProvenance?.get(carried);
 		if (parentEntry !== void 0) recordReferenceProvenanceEntry(recorded, carried, parentEntry, "read");
 		recordInheritedParameterRead(recorded, inherited, parameterName);
+		if (mirror) recordInheritedParameterRead(mirror, inherited, parameterName);
 		carryFreshNoEchoMark(inherited, recorded, plaintext);
 	}
 }
+const parameterReadMirrors = /* @__PURE__ */ new WeakMap();
+function mirrorInheritedParameterReads(passSecrets, persistSecrets) {
+	if (passSecrets !== persistSecrets) parameterReadMirrors.set(passSecrets, persistSecrets);
+}
 function carryPhysicalNameCopiesCarriedBy(context, recorded, value) {
 	const names = context.inheritedPhysicalNameCopies ?? (context.inheritedSecrets && physicalNameCopiesOf.get(context.inheritedSecrets));
 	if (names === void 0 || names.size === 0) return;
@@ -23238,15 +23371,25 @@ function poisonRenderedSpellingsCollidingIn(template, parameterValues, inherited
 	const names = new Set(Object.keys(parameterValues));
 	if (names.size < 2) return;
 	const groups = [];
-	if (template.Resources !== null && typeof template.Resources === "object") for (const resource of Object.values(template.Resources)) groups.push([resource, false]);
-	if (template.Outputs !== void 0) groups.push([template.Outputs, true]);
+	if (template.Resources !== null && typeof template.Resources === "object") for (const resource of Object.values(template.Resources)) groups.push([{
+		node: resource,
+		mode: "resource"
+	}]);
+	if (template.Outputs !== void 0) groups.push(outputsGroupParts(template.Outputs));
 	const bind = (name) => Object.hasOwn(parameterValues, name) ? { value: parameterValues[name] } : void 0;
 	const withdrawn = /* @__PURE__ */ new Set();
 	for (;;) {
-		const fresh = [...collidingRenderedNames(groups.map(([group, slotOnly]) => parameterReadsOf(group, names, slotOnly ? void 0 : {
-			bind,
-			inherited
-		})).filter((reads) => reads.size >= 2), parameterValues, inherited)].filter((name) => !withdrawn.has(name));
+		const fresh = [...collidingRenderedNames(groups.map((parts) => {
+			const reads = /* @__PURE__ */ new Map();
+			for (const { node, mode } of parts) {
+				const reread = mode === "slot" ? void 0 : {
+					bind,
+					inherited
+				};
+				for (const [name, slotRead] of parameterReadsOf(node, names, reread, mode !== "output")) reads.set(name, slotRead || reads.get(name) === true);
+			}
+			return reads;
+		}).filter((reads) => reads.size >= 2), parameterValues, inherited)].filter((name) => !withdrawn.has(name));
 		if (fresh.length === 0) return;
 		for (const name of fresh) {
 			withdrawn.add(name);
@@ -23287,14 +23430,14 @@ function collidingRenderedNames(readsByGroup, parameterValues, inherited) {
 	return withdraw;
 }
 const POSITIONED_INTRINSICS = /* @__PURE__ */ new Set(["Fn::Join", "Fn::Sub"]);
-function parameterReadsOf(node, names, reread) {
+function parameterReadsOf(node, names, reread, positionsArrays) {
 	const reads = /* @__PURE__ */ new Map();
 	const add = (name, slotRead) => {
 		reads.set(name, slotRead || reads.get(name) === true);
 	};
 	const visit = (value, slotRead, atLeaf) => {
 		if (Array.isArray(value)) {
-			const mayShrink = value.some((element) => element !== null && typeof element === "object" && !Array.isArray(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue"));
+			const mayShrink = atLeaf && !positionsArrays || value.some((element) => element !== null && typeof element === "object" && !Array.isArray(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue"));
 			for (const element of value) visit(element, slotRead || mayShrink, atLeaf && !mayShrink);
 			return;
 		}
@@ -23307,17 +23450,72 @@ function parameterReadsOf(node, names, reread) {
 		}
 		const ref = record["Ref"];
 		if (typeof ref === "string" && names.has(ref)) add(ref, slotRead);
+		const placeholderSlot = !positionsArrays && unkeyedPlaceholderParts(record, (name) => certifiesPlaceholder(name, reread)) > MAX_UNKEYED_PARTS;
 		const sub = record["Fn::Sub"];
 		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
 		if (typeof text === "string") for (const match of text.matchAll(/\$\{([^}!][^}]*)\}/g)) {
 			const name = match[1].trim();
-			if (names.has(name)) add(name, slotRead);
+			if (names.has(name)) add(name, slotRead || placeholderSlot);
 		}
-		for (const [key, child] of Object.entries(record)) visit(child, slotRead || key.startsWith("Fn::") && !POSITIONED_INTRINSICS.has(key), atLeaf && !intrinsic);
+		for (const [key, child] of Object.entries(record)) visit(child, slotRead || placeholderSlot || key.startsWith("Fn::") && !POSITIONED_INTRINSICS.has(key), atLeaf && !intrinsic);
 	};
 	visit(node, reread === void 0, true);
 	return reads;
 }
+const MAX_UNKEYED_PARTS = 1;
+function certifiesPlaceholder(name, reread) {
+	if (reread === void 0) return false;
+	const bound = reread.bind(name);
+	if (bound === void 0) return false;
+	if (inheritedSecretsCarriedBy(bound.value, reread.inherited).length === 0) return false;
+	return typeof inheritedParameterExpression(reread.inherited, name, bound.value) === "string";
+}
+function unkeyedPlaceholderParts(record, certified) {
+	const keyed = (value) => typeof value === "string" || value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 1 && typeof value["Ref"] === "string" && certified(value["Ref"]);
+	if (Object.hasOwn(record, "Fn::Join")) {
+		const args = record["Fn::Join"];
+		if (!Array.isArray(args) || args.length !== 2 || !Array.isArray(args[1])) return Number.POSITIVE_INFINITY;
+		return args[1].filter((part) => !keyed(part)).length;
+	}
+	if (Object.hasOwn(record, "Fn::Sub")) {
+		const args = record["Fn::Sub"];
+		const [template, variables] = typeof args === "string" ? [args, {}] : Array.isArray(args) ? [args[0], args[1]] : [];
+		if (typeof template !== "string" || variables === null || typeof variables !== "object") return Number.POSITIVE_INFINITY;
+		let unkeyed = 0;
+		for (const hit of template.matchAll(/\$\{(!)?([^}]*)\}/g)) {
+			const name = hit[2] ?? "";
+			if (hit[1] === "!" || name === "") continue;
+			if (!(Object.hasOwn(variables, name) ? keyed(variables[name]) : certified(name))) unkeyed += 1;
+		}
+		return unkeyed;
+	}
+	return 0;
+}
+function outputsGroupParts(outputs) {
+	if (outputs === null || typeof outputs !== "object" || Array.isArray(outputs)) return [{
+		node: outputs,
+		mode: "slot"
+	}];
+	const parts = [];
+	for (const output of Object.values(outputs)) {
+		if (output === null || typeof output !== "object" || Array.isArray(output)) {
+			parts.push({
+				node: output,
+				mode: "slot"
+			});
+			continue;
+		}
+		const { Value: value, ...rest } = output;
+		parts.push({
+			node: value,
+			mode: "output"
+		}, {
+			node: rest,
+			mode: "slot"
+		});
+	}
+	return parts;
+}
 function refNamesIn(node, names) {
 	const found = /* @__PURE__ */ new Set();
 	const visit = (value) => {
@@ -25231,6 +25429,62 @@ var JsonPatchGenerator = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/guardduty-detector-patch.ts
+const DETECTOR_TYPE = "AWS::GuardDuty::Detector";
+const READ_BACK_KEYS = ["Features", "DataSources"];
+function withGuardDutyDetectorReadBackOps(resourceType, patch, desired, readback) {
+	if (resourceType !== DETECTOR_TYPE || patch.length === 0) return patch;
+	let out = patch;
+	if (readback) {
+		out = patch.map((op) => op.path === "/Features" ? narrowToChangedFeatures(op, readback.previous["Features"]) : op);
+		if (out.some((op) => op.path === "/Features" && op.op !== "remove")) out = out.map((op) => op.path === "/DataSources" ? {
+			op: "remove",
+			path: "/DataSources"
+		} : op);
+	}
+	const extra = [];
+	for (const key of READ_BACK_KEYS) {
+		if (out.some((op) => op.path === `/${key}`)) continue;
+		if (readback) {
+			if (Object.prototype.hasOwnProperty.call(readback.previous, key)) extra.push({
+				op: "remove",
+				path: `/${key}`
+			});
+			continue;
+		}
+		extra.push(Object.prototype.hasOwnProperty.call(desired, key) ? {
+			op: "add",
+			path: `/${key}`,
+			value: desired[key]
+		} : {
+			op: "remove",
+			path: `/${key}`
+		});
+	}
+	return extra.length === 0 && out === patch ? patch : [...out, ...extra];
+}
+function narrowToChangedFeatures(op, current) {
+	if (!Array.isArray(op.value) || !Array.isArray(current)) return op;
+	const byName = /* @__PURE__ */ new Map();
+	for (const entry of current) byName.set(featureName(entry), entry);
+	const changed = [];
+	for (const entry of op.value) {
+		const name = featureName(entry);
+		if (name === void 0) return op;
+		if (!isDeepStrictEqual(entry, byName.get(name))) changed.push(entry);
+	}
+	if (changed.length === 0) throw markNonRetryable(/* @__PURE__ */ new Error("cannot revert Features: the live list differs from the recorded baseline only in the order of its entries or in entries GuardDuty added, which UpdateDetector cannot undo, so nothing on this detector was reverted. cdkd drift --accept would record the live list, but it records the live value of EVERY drifted property of the stack, not only Features: revert any other drift on this detector first (for example with aws guardduty update-detector), then run it."));
+	return {
+		...op,
+		value: changed
+	};
+}
+function featureName(entry) {
+	const name = entry?.["Name"];
+	return typeof name === "string" ? name : void 0;
+}
+
 //#endregion
 //#region src/provisioning/secret-reference-immutable.ts
 const IDENTITY = maskerOrIdentity(void 0);
@@ -26020,6 +26274,7 @@ var CloudControlProvider = class {
 					};
 				}
 			}
+			patch = withGuardDutyDetectorReadBackOps(resourceType, patch, cleanProperties, context?.desiredFromAwsReadback === true ? { previous: cleanPreviousProperties } : void 0);
 			this.logger.debug(`Generated ${patch.length} patch operations for ${logicalId}: ${JSON.stringify(patch.map((op) => {
 				const anyOp = op;
 				return {
@@ -26076,7 +26331,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-ebjf5E8o.js");
+			const { ASGProvider } = await import("./asg-provider-COcKVcvZ.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -26182,7 +26437,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-Br3hPyHP.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CuJF3t-Q.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-QKN-WHF3.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-Bnr2VC6V.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -29344,6 +29599,24 @@ const NESTED_REQUIRED = /* @__PURE__ */ new Map([
 		["Resources", ["MinimumMemoryInMiB"]],
 		["Tags", ["Key"]]
 	])],
+	["AWS::Lambda::NetworkConnector", /* @__PURE__ */ new Map([
+		["Configuration", ["VpcEgressConfiguration"]],
+		["Configuration.VpcEgressConfiguration", [
+			"AssociatedComputeResourceTypes",
+			"NetworkProtocol",
+			"SecurityGroupIds",
+			"SubnetIds"
+		]],
+		["Tags", ["Key"]]
+	])],
+	["AWS::Lambda::WebFunctionEndpoint", /* @__PURE__ */ new Map([["RevisionWeights", ["RevisionId", "Weight"]]])],
+	["AWS::Lambda::WebFunctionRevision", /* @__PURE__ */ new Map([
+		["BuildConfig", ["CodeConfig", "RuntimeConfig"]],
+		["BuildConfig.CodeConfig", ["S3Object"]],
+		["BuildConfig.CodeConfig.S3Object", ["Bucket", "Key"]],
+		["BuildConfig.RuntimeConfig", ["Runtime"]],
+		["ServiceConfig", ["ExecutionRoleArn"]]
+	])],
 	["AWS::Logs::LogGroup", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
 	["AWS::Neptune::DBCluster", /* @__PURE__ */ new Map([
 		["AssociatedRoles", ["RoleArn"]],
@@ -30058,7 +30331,10 @@ const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::Lambda::Function", "{\"Architectures\":\"array\",\"CapacityProviderConfig\":\"object\",\"CapacityProviderConfig.LambdaManagedInstancesCapacityProviderConfig\":\"object\",\"Code\":\"object\",\"DeadLetterConfig\":\"object\",\"DurableConfig\":\"object\",\"Environment\":\"object\",\"Environment.Variables\":\"object\",\"EphemeralStorage\":\"object\",\"FileSystemConfigs\":\"array\",\"FileSystemConfigs[]\":\"object\",\"FileSystemConfigs[].S3FilesConfig\":\"object\",\"FunctionScalingConfig\":\"object\",\"ImageConfig\":\"object\",\"ImageConfig.Command\":\"array\",\"ImageConfig.EntryPoint\":\"array\",\"Layers\":\"array\",\"LoggingConfig\":\"object\",\"RuntimeManagementConfig\":\"object\",\"SnapStart\":\"object\",\"SnapStartResponse\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"TenancyConfig\":\"object\",\"TracingConfig\":\"object\",\"VpcConfig\":\"object\",\"VpcConfig.SecurityGroupIds\":\"array\",\"VpcConfig.SubnetIds\":\"array\"}"],
 	["AWS::Lambda::LayerVersion", "{\"CompatibleArchitectures\":\"array\",\"CompatibleRuntimes\":\"array\",\"Content\":\"object\"}"],
 	["AWS::Lambda::MicrovmImage", "{\"AdditionalOsCapabilities\":\"array\",\"CodeArtifact\":\"object\",\"CpuConfigurations\":\"array\",\"CpuConfigurations[]\":\"object\",\"EgressNetworkConnectors\":\"array\",\"EnvironmentVariables\":\"array\",\"EnvironmentVariables[]\":\"object\",\"Hooks\":\"object\",\"Hooks.MicrovmHooks\":\"object\",\"Hooks.MicrovmImageHooks\":\"object\",\"Logging\":\"object\",\"Logging.CloudWatch\":\"object\",\"Resources\":\"array\",\"Resources[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
+	["AWS::Lambda::NetworkConnector", "{\"Configuration\":\"object\",\"Configuration.VpcEgressConfiguration\":\"object\",\"Configuration.VpcEgressConfiguration.AssociatedComputeResourceTypes\":\"array\",\"Configuration.VpcEgressConfiguration.SecurityGroupIds\":\"array\",\"Configuration.VpcEgressConfiguration.SubnetIds\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::Lambda::Url", "{\"Cors\":\"object\",\"Cors.AllowHeaders\":\"array\",\"Cors.AllowMethods\":\"array\",\"Cors.AllowOrigins\":\"array\",\"Cors.ExposeHeaders\":\"array\"}"],
+	["AWS::Lambda::WebFunctionEndpoint", "{\"RegionalEndpoints\":\"object\",\"Regions\":\"array\",\"RevisionWeights\":\"array\",\"RevisionWeights[]\":\"object\",\"ScalingConfig\":\"object\",\"ThrottleConfig\":\"object\"}"],
+	["AWS::Lambda::WebFunctionRevision", "{\"BuildConfig\":\"object\",\"BuildConfig.CodeConfig\":\"object\",\"BuildConfig.CodeConfig.S3Object\":\"object\",\"BuildConfig.RuntimeConfig\":\"object\",\"ServiceConfig\":\"object\",\"ServiceConfig.EnvironmentVariables\":\"object\",\"ServiceConfig.TelemetryConfig\":\"object\",\"ServiceConfig.TelemetryConfig.LoggingConfig\":\"object\"}"],
 	["AWS::Logs::LogGroup", "{\"DataProtectionPolicy\":\"object\",\"FieldIndexPolicies\":\"array\",\"FieldIndexPolicies[]\":\"object\",\"ResourcePolicyDocument\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::Neptune::DBCluster", "{\"AssociatedRoles\":\"array\",\"AssociatedRoles[]\":\"object\",\"AvailabilityZones\":\"array\",\"EnableCloudwatchLogsExports\":\"array\",\"ServerlessScalingConfiguration\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"VpcSecurityGroupIds\":\"array\"}"],
 	["AWS::Neptune::DBInstance", "{\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
@@ -30220,6 +30496,24 @@ const STICKY_CC_MIGRATION_EXEMPT = /* @__PURE__ */ new Map([
 		issue: "https://github.com/go-to-k/cdkd/issues/2719",
 		integFixture: "cc-to-sdk-reroute"
 	}],
+	["AWS::Lambda::WebFunctionRevision", {
+		mode: "sdk-coverage",
+		physicalIdForm: "both layers store the revision ARN: the schema primaryIdentifier is RevisionArn and LambdaWebFunctionRevisionProvider.create records the CreateWebFunctionRevision revisionArn",
+		issue: "https://github.com/go-to-k/cdkd/issues/4926",
+		integFixture: "lambda-web-function-revision-replace"
+	}],
+	["AWS::Lambda::WebFunctionEndpoint", {
+		mode: "sdk-coverage",
+		physicalIdForm: "both layers store the endpoint ARN: the schema primaryIdentifier is EndpointArn and LambdaWebFunctionEndpointProvider.create records the CreateWebFunctionEndpoint endpointArn",
+		issue: "https://github.com/go-to-k/cdkd/issues/4926",
+		integFixture: "lambda-web-function-revision-replace"
+	}],
+	["AWS::Lambda::NetworkConnector", {
+		mode: "sdk-coverage",
+		physicalIdForm: "both layers store the connector ARN: the schema primaryIdentifier is Arn and LambdaNetworkConnectorProvider.create records the CreateNetworkConnector Arn",
+		issue: "https://github.com/go-to-k/cdkd/issues/4928",
+		integFixture: "lambda-network-connector"
+	}],
 	["AWS::ElasticLoadBalancingV2::Listener", {
 		mode: "sdk-coverage",
 		physicalIdForm: "both layers store the listener ARN: the schema primaryIdentifier is ListenerArn and ELBv2Provider.create records the CreateListener ListenerArn",
@@ -32614,7 +32908,11 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 	};
 	const outputsPassSecrets = context.recordedSecretValues ?? EMPTY_SECRETS;
 	const outputsPassInherited = context.inheritedSecrets ?? EMPTY_SECRETS;
-	if (context.recordedSecretValues) this.outputsPassSecretMaps.push(context.recordedSecretValues);
+	if (context.recordedSecretValues) {
+		this.outputsPassSecretMaps.push(context.recordedSecretValues);
+		mirrorInheritedParameterReads(context.recordedSecretValues, this.outputSecrets);
+		if (this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0) inheritNestedStackParameterAssociations(this.outputSecrets, this.options.inheritedSecrets);
+	}
 	const publishedOutputNames = collectPublishedOutputNames(template.Outputs, conditions);
 	let outputsPassCompleted = false;
 	try {
@@ -34291,24 +34589,25 @@ async function replayDelete(s) {
 
 //#endregion
 //#region src/deployment/rollback-executor/replay-revert.ts
-async function replayReadopt(s) {
+async function replayReadopt(s, survivor) {
 	const { op, stateResources, stackName, ctx, result, inlinePolicyWriters, afterOp, logger, mask } = s;
+	const oldKind = survivor === void 0 ? "retained" : "surviving";
 	const current = stateResources[op.logicalId];
 	const prev = op.previousState;
 	const oldShown = hasAddressablePhysicalId({ physicalId: prev.physicalId }) ? displaySafe(mask(prev.physicalId)) : "no recorded id";
 	const unprovenCopyRefusal = (reason) => {
 		const remedy = orphanRemedy(op.logicalId, ctx);
-		return ownRemedyError(markNonRetryable(new CdkdError(safeMsg`Cannot reverse the replacement of ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}): ` + reason + ` The retained old resource (${oldShown}) is named only by the rollback journal, so the JOURNAL is kept. Check both resources by hand.` + (remedy.offered ? ` To leave this one as it is, re-run ${rerunRollbackPhrase(ctx, "`cdkd rollback`")} with the command below; that also drops the journal's only record of the retained old resource (${oldShown}), so note that id first.` : ` No repair of the state record makes this op succeed on a re-run.`) + remedy.clause + remedy.line, STATE_RESOURCES_MALFORMED)));
+		return ownRemedyError(markNonRetryable(new CdkdError(safeMsg`Cannot reverse the replacement of ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}): ` + reason + ` The ${oldKind} old resource (${oldShown}) is named only by the rollback journal, so the JOURNAL is kept. Check both resources by hand.` + (remedy.offered ? ` To leave this one as it is, re-run ${rerunRollbackPhrase(ctx, "`cdkd rollback`")} with the command below; that also drops the journal's only record of the ${oldKind} old resource (${oldShown}), so note that id first.` : ` No repair of the state record makes this op succeed on a re-run.`) + remedy.clause + remedy.line, STATE_RESOURCES_MALFORMED)));
 	};
 	const opIdUnusable = op.physicalId !== void 0 && !hasAddressablePhysicalId(op);
 	if (!rollbackRetainsNewResource(current) && rollbackCannotAddress(current, op.resourceType, current.provisionedBy ?? op.provisionedBy, current.physicalId)) {
 		if (opIdUnusable) throw unprovenCopyRefusal("neither its state record nor its rollback journal entry has a non-empty string 'physicalId' for the replacement's new resource, so cdkd cannot address that resource in AWS or tell which resource it is, and sent nothing.");
 		const target = op.physicalId === void 0 ? void 0 : refusalPhysicalId(mask(String(op.physicalId)));
-		const repair = target === void 0 ? `Repair the record's 'physicalId' to the id of the replacement's NEW resource (inspect it with \`cdkd state show\`): the journal does not record that id, and the re-run DELETES the resource the repaired record names as the new copy, so name the right one. Then re-run ${rerunRollbackPhrase(ctx, "`cdkd rollback`")}.` : `Repair the record's 'physicalId' to ${target}, the replacement's new resource the journal records (inspect it with \`cdkd state show\`); the re-run deletes it and re-adopts the old one. Any other id stops the revert and drops the journal's only record of the retained old resource (${oldShown}). Then re-run ${rerunRollbackPhrase(ctx, "`cdkd rollback`")}.` + (describedPhysicalIdPointer(target) !== "" ? " That id is left out of the prose above: it is not a plain identifier — read it from the rollback journal." : target.includes("***") ? ` That id is shown masked — read the full value from the rollback journal.` : "");
-		throw new CdkdError(safeMsg`Cannot reverse the replacement of ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}): ` + `its state record has no non-empty string 'physicalId', so cdkd cannot address the new resource in AWS to delete it, and sent nothing. The retained old resource (${oldShown}) is named only by the rollback journal, so the JOURNAL is kept. ` + repair, STATE_RESOURCES_MALFORMED);
+		const repair = target === void 0 ? `Repair the record's 'physicalId' to the id of the replacement's NEW resource (inspect it with \`cdkd state show\`): the journal does not record that id, and the re-run DELETES the resource the repaired record names as the new copy, so name the right one. Then re-run ${rerunRollbackPhrase(ctx, "`cdkd rollback`")}.` : `Repair the record's 'physicalId' to ${target}, the replacement's new resource the journal records (inspect it with \`cdkd state show\`); the re-run deletes it and re-adopts the old one. Any other id stops the revert and drops the journal's only record of the ${oldKind} old resource (${oldShown}). Then re-run ${rerunRollbackPhrase(ctx, "`cdkd rollback`")}.` + (describedPhysicalIdPointer(target) !== "" ? " That id is left out of the prose above: it is not a plain identifier — read it from the rollback journal." : target.includes("***") ? ` That id is shown masked — read the full value from the rollback journal.` : "");
+		throw new CdkdError(safeMsg`Cannot reverse the replacement of ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}): ` + `its state record has no non-empty string 'physicalId', so cdkd cannot address the new resource in AWS to delete it, and sent nothing. The ${oldKind} old resource (${oldShown}) is named only by the rollback journal, so the JOURNAL is kept. ` + repair, STATE_RESOURCES_MALFORMED);
 	}
 	if (!rollbackRetainsNewResource(current) && opIdUnusable && current.physicalId !== op.physicalId) throw unprovenCopyRefusal("its rollback journal entry has no non-empty string 'physicalId' for the replacement's new resource, so cdkd cannot tell whether the resource state records under this id is that one, and did not delete it; nothing was sent.");
-	logger.info(`  Rollback: Reversing replacement of ${safe(op.logicalId)} (${safe(op.resourceType)}) — deleting the new resource and re-adopting the retained old one (${displaySafe(mask(prev.physicalId))})`);
+	logger.info(`  Rollback: Reversing replacement of ${safe(op.logicalId)} (${safe(op.resourceType)}) — deleting the new resource and re-adopting the ${oldKind} old one (${displaySafe(mask(prev.physicalId))})`);
 	let survivorReason;
 	const survivorId = retainedSurvivorId(current, op);
 	if (rollbackRetainsNewResource(current)) {
@@ -34332,7 +34631,7 @@ async function replayReadopt(s) {
 			recordedNoEchoLeaves: current.noEchoLeaves,
 			maskSecrets: mask
 		}));
-		throwIfDeleteSkipped(readoptDelete, op.logicalId, current.physicalId, "while reversing its replacement (re-adopting the retained old resource)", {
+		throwIfDeleteSkipped(readoptDelete, op.logicalId, current.physicalId, `while reversing its replacement (re-adopting the ${oldKind} old resource)`, {
 			ctx,
 			stackName,
 			resourceType: op.resourceType,
@@ -34341,7 +34640,7 @@ async function replayReadopt(s) {
 		});
 	}
 	stateResources[op.logicalId] = prev;
-	logger.info(`  Rollback: ${safe(op.logicalId)} restored to the retained old resource`);
+	logger.info(`  Rollback: ${safe(op.logicalId)} restored to the ${oldKind} old resource`);
 	await afterOp?.(op.logicalId);
 	const survivorProvisionedBy = current.provisionedBy;
 	ctx.recordEvent?.({
@@ -34351,9 +34650,10 @@ async function replayReadopt(s) {
 		logicalId: op.logicalId,
 		resourceType: op.resourceType,
 		...op.provisionedBy && { provisionedBy: op.provisionedBy },
+		...survivorReason === void 0 && survivor !== void 0 && { reason: mask(survivor.reason) },
 		...survivorReason !== void 0 && {
 			...survivorId !== void 0 && { physicalId: survivorId },
-			reason: mask(survivorReason),
+			reason: mask(survivor === void 0 ? survivorReason : `${survivorReason}; ${survivor.reason}`),
 			...survivorProvisionedBy && { provisionedBy: survivorProvisionedBy }
 		}
 	});
@@ -34455,6 +34755,73 @@ async function replayRevert(s) {
 	});
 }
 
+//#endregion
+//#region src/deployment/rollback-executor/replaced-survivor.ts
+const DELETE_REFUSAL_NAMES = /* @__PURE__ */ new Set([
+	"AccessDenied",
+	"AccessDeniedException",
+	"UnauthorizedOperation",
+	"AuthorizationError",
+	"DependencyViolation",
+	"DeleteConflict",
+	"DeleteConflictException"
+]);
+function replacedDeleteFailureVerdict(error) {
+	let current = error;
+	for (let depth = 0; depth < 10 && current != null; depth++) {
+		if (typeof current !== "object") break;
+		const link = current;
+		for (const name of [
+			link.name,
+			link.Code,
+			link.code
+		]) if (typeof name === "string" && DELETE_REFUSAL_NAMES.has(name)) return "kept";
+		current = link.cause;
+	}
+	return "unconfirmed";
+}
+const REPLACED_SURVIVOR_PROBE_TIMEOUT_MS = 3e4;
+const INTERRUPT_POLL_MS = 250;
+async function probeReplacedSurvivor(s, oldType, timeoutMs = REPLACED_SURVIVOR_PROBE_TIMEOUT_MS) {
+	if (s.isInterrupted?.() === true) return "interrupted";
+	let timer;
+	let poll;
+	const stopped = new Promise((resolve) => {
+		timer = setTimeout(() => resolve("unknown"), timeoutMs);
+		if (s.isInterrupted !== void 0) {
+			const interrupted = s.isInterrupted;
+			poll = setInterval(() => {
+				if (interrupted()) resolve("interrupted");
+			}, INTERRUPT_POLL_MS);
+		}
+	});
+	try {
+		return await Promise.race([readSurvivor(s, oldType), stopped]);
+	} finally {
+		clearTimeout(timer);
+		clearInterval(poll);
+	}
+}
+async function readSurvivor(s, oldType) {
+	const prev = s.op.previousState;
+	const physicalId = prev?.physicalId;
+	if (typeof physicalId !== "string" || physicalId === "") return "unknown";
+	try {
+		const { provider } = s.ctx.providerRegistry.getProviderFor({
+			resourceType: oldType,
+			provisionedBy: prev?.provisionedBy
+		});
+		if (typeof provider.readCurrentState !== "function") return "unreadable";
+		const read = await withReplayDeletePrinting(s, () => provider.readCurrentState(physicalId, s.op.logicalId, oldType, prev?.properties));
+		if (read === RESOURCE_NOT_FOUND) return "gone";
+		if (read === void 0) return "unreadable";
+		if (typeof read !== "object" || read === null || Array.isArray(read)) return "unknown";
+		return Object.keys(read).length > 0 ? "exists" : "unreadable";
+	} catch {
+		return "unknown";
+	}
+}
+
 //#endregion
 //#region src/deployment/rollback-executor/replay-reverse-replacement.ts
 async function replayReverseReplacement(s) {
@@ -34464,6 +34831,18 @@ async function replayReverseReplacement(s) {
 	const oldTypeRouting = resolveReplacementOldType(op);
 	if (!oldTypeRouting.ok) throw unroutableReplacementError(op, oldTypeRouting.reason, ctx);
 	const oldType = oldTypeRouting.oldType;
+	if (op.oldResourceMaySurvive !== void 0) {
+		const survivor = await probeReplacedSurvivor(s, oldType);
+		if (survivor === "exists" && op.oldResourceMaySurvive !== "kept") throw survivorUnprovenRefusal(s, oldType, "maybe-deleting");
+		if (survivor === "exists") {
+			const oldShown = refusalPhysicalId(mask(String(prev.physicalId)));
+			logger.warn(safeMsg`  ⚠ Rollback: the old resource of ${shownLogicalId(op.logicalId)} (${oldShown}) still ` + "exists — the deploy's delete of it was not confirmed — so it is re-adopted instead of re-created. Part of it may have been removed before that delete failed: check it " + safeMsg`with cdkd drift after the rollback.${describedPhysicalIdPointer(oldShown)}`);
+			result.warnings++;
+			return replayReadopt(s, { reason: "the old resource survived a delete that was refused or never sent during the deploy and was re-adopted instead of re-created; the provider may have run part of that delete, so check it with cdkd drift" });
+		}
+		if (survivor !== "gone") throw survivorUnprovenRefusal(s, oldType, survivor);
+		logger.info(safeMsg`  Rollback: the old resource of ${safe(op.logicalId)} (${mask(String(prev.physicalId))}) is gone — re-creating it`);
+	}
 	const typeChanged = oldType !== op.resourceType;
 	if (!requireRestorableBaseline(prev.properties, logger, {
 		logicalId: op.logicalId,
@@ -34713,6 +35092,15 @@ async function deleteMarkedRecreate(error, s) {
 	s.logger.warn(safeMsg`  Rollback: could not delete ${id}, which the failed re-create of ${shown} made before ` + safeMsg`failing (${s.mask(failure)}); no record holds it — delete it yourself`);
 	return false;
 }
+function survivorUnprovenRefusal(s, oldType, verdict) {
+	const { op, ctx, mask } = s;
+	const remedy = orphanRemedy(op.logicalId, ctx);
+	const oldId = op.previousState?.physicalId;
+	const oldShown = hasAddressablePhysicalId({ physicalId: oldId }) ? refusalPhysicalId(mask(String(oldId))) : "no recorded id";
+	const rerun = rerunRollbackPhrase(ctx, "cdkd rollback");
+	const why = verdict === "unreadable" ? "cdkd has no read for this resource type that can tell whether it does. Re-creating it could duplicate it or collide with it" : verdict === "interrupted" ? `the rollback was interrupted before cdkd could read whether it does; re-running ${rerun} reads it` : verdict === "unknown" ? `cdkd could not read whether it does (the read failed or did not answer in time); re-running ${rerun} reads it again. Re-creating it could duplicate it or collide with it` : `AWS still reports it, but its failed delete may have been accepted and still be running, or only partly ran. Re-adopting it could leave neither resource once a running delete finishes, or one that delete already stripped; once AWS reports it gone, re-running ${rerun} re-creates it`;
+	return ownRemedyError(markNonRetryable(new CdkdError(`Cannot reverse the replacement of ${refusalLogicalId(op.logicalId)} (${refusalResourceType(oldType)}): the deploy did not confirm that it deleted the old resource (${oldShown}), so it may still exist, and ${why}. Nothing was sent and the journal is kept.` + (remedy.offered ? " To keep the new resource in its place instead, re-run with the command below, then delete the old resource by hand if it still exists." : "") + `${remedy.clause}${describedPhysicalIdPointer(oldShown)}` + remedy.line, "REPLACED_SURVIVOR_UNPROVEN")));
+}
 
 //#endregion
 //#region src/provisioning/remove-protection-types.ts
@@ -35760,7 +36148,7 @@ function displacedOpClause(op, marks, logger) {
 	const retainedOld = retainedOldPhysicalId(op);
 	if (retainedOld !== void 0 && marks.some((m) => isMarkFor(m, op))) {
 		const shownOld = displacedPhysicalIdShown(op, logger, retainedOld);
-		return `replaced ${shownOld} ${op.oldResourceRetained === true ? "but kept it (UpdateReplacePolicy: Retain)" : "and may have kept it (the journal records no verdict)"}; cdkd import adopted the replacement, so ${shownOld} is left untracked`;
+		return `replaced ${shownOld} ${op.oldResourceRetained === true ? "but kept it (UpdateReplacePolicy: Retain)" : op.oldResourceMaySurvive !== void 0 ? "and may have kept it (its delete was not confirmed)" : "and may have kept it (the journal records no verdict)"}; cdkd import adopted the replacement, so ${shownOld} is left untracked`;
 	}
 	const shownId = displacedPhysicalIdShown(op, logger);
 	return shownId !== void 0 ? `recorded ${shownId}, which cdkd import has since replaced under this id` : "recorded no physical id, and cdkd import has since put another resource under this id";
@@ -37454,6 +37842,7 @@ async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentReso
 	} catch (deleteError) {
 		const deleteMsg = maskSecretsInText(deleteError instanceof Error ? deleteError.message : String(deleteError), secrets);
 		deleteFailed = true;
+		this.replacedOldMaySurvive.set(logicalId, this.replacedOldMaySurvive.get(logicalId) === "unconfirmed" ? "unconfirmed" : replacedDeleteFailureVerdict(deleteError));
 		const deferred = this.deferredReplacedDeletes;
 		if (!isRetry && deferred !== void 0) {
 			this.logger.info(safeMsg`  Could not delete old ${logicalId} (${currentResource.physicalId}) yet: ${deleteMsg}. Retrying after the rest of the deploy.`);
@@ -37475,9 +37864,13 @@ async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentReso
 	});
 	const skipReason = deleteSkipReason(deleteResult);
 	if (skipReason !== void 0) {
+		this.replacedOldMaySurvive.set(logicalId, "unconfirmed");
 		this.replacedDeleteSkips.set(logicalId, `the replaced ${oldResourceType} (${currentResource.physicalId}) was not deleted (${skipReason}) and is no longer tracked by cdkd`);
 		this.logger.warn(safeMsg`  ⚠ ${deleteSkippedMessage(logicalId, currentResource.physicalId, skipReason, "while cleaning up the replaced resource", { commandFreeLine: true })}. Delete it manually — it is no longer tracked in state.`);
-	} else if (!deleteFailed) this.logger.info(isRetry ? safeMsg`  ${green("✓")} Old ${logicalId} (${currentResource.physicalId}) deleted` : safeMsg`  ${green("✓")} Old resource deleted`);
+	} else if (!deleteFailed) {
+		if (isRetry) this.replacedOldMaySurvive.delete(logicalId);
+		this.logger.info(isRetry ? safeMsg`  ${green("✓")} Old ${logicalId} (${currentResource.physicalId}) deleted` : safeMsg`  ${green("✓")} Old resource deleted`);
+	}
 }
 async function retryDeferredReplacedDeletes(stackName, counts) {
 	const deferred = this.deferredReplacedDeletes;
@@ -37619,6 +38012,19 @@ function isHealEligible(logicalId, resource) {
 	const loaded = Object.hasOwn(this.healBaseline, logicalId) ? this.healBaseline[logicalId] : void 0;
 	return loaded !== void 0 && loaded.physicalId === resource.physicalId && loaded.attributes === resource.attributes && !isHealExcludedType(resource.resourceType);
 }
+const healJudges = /* @__PURE__ */ new WeakMap();
+function healPrintingBag(baseline, logicalId, resource) {
+	if (!Object.hasOwn(baseline, logicalId) || baseline[logicalId] !== resource) return secretNamePrintingBag(logicalId, {
+		...baseline,
+		[logicalId]: resource
+	});
+	let judge = healJudges.get(baseline);
+	if (judge === void 0) {
+		judge = secretNamePrintingBags(baseline, void 0);
+		healJudges.set(baseline, judge);
+	}
+	return judge(logicalId);
+}
 async function readStaleAttributes(logicalId, resource, stackName) {
 	const { provider } = this.providerRegistry.getProviderFor({
 		resourceType: resource.resourceType,
@@ -37626,13 +38032,13 @@ async function readStaleAttributes(logicalId, resource, stackName) {
 		provisionedBy: resource.provisionedBy,
 		previousProperties: resource.properties
 	});
-	const outcome = await readRecordAttributes({
+	const outcome = await withPrintingSecrets(healPrintingBag(this.healBaseline, logicalId, resource), () => readRecordAttributes({
 		provider,
 		logicalId,
 		resource,
 		stackName,
 		region: this.stackRegion
-	});
+	}));
 	if (outcome.kind !== "read") return outcome;
 	const { attributes } = outcome;
 	if (Object.keys(attributes).length > 0) this.healedAttributes.set(logicalId, {
@@ -42695,7 +43101,7 @@ const REMEDY = "To move a custom resource to a different handler, give it a new
 const UNJUDGEABLE_REMEDY = `Where the recorded ServiceToken is unreadable and the handler did not change, put the ARN of the handler that created this resource (the one it was last deployed with, not the one the template names now) back as ServiceToken in state.json (a ServiceToken fed by a NoEcho parameter is recorded only as '${"***"}': feed it from a plain value) and re-deploy.`;
 function renderServiceTokenRefusal(refusals, stackName, mask = (text) => text) {
 	const rows = refusals.map((refusal) => `  - ${rowText(refusal, mask)}`);
-	return `Refusing to deploy ${stackName}: ` + (refusals.length === 1 ? `a custom resource's ServiceToken changes` : `${refusals.length} custom resources' ServiceTokens change`) + `, which CloudFormation does not allow ("Modifying service token is not allowed"). Nothing was sent to either handler.
+	return safeMsg`Refusing to deploy ${displayStackName(stackName)}: ` + (refusals.length === 1 ? `a custom resource's ServiceToken changes` : `${refusals.length} custom resources' ServiceTokens change`) + `, which CloudFormation does not allow ("Modifying service token is not allowed"). Nothing was sent to either handler.
 ${rows.join("\n")}\n  ${REMEDY}` + (refusals.some((refusal) => refusal.kind === "unjudgeable") ? `\n  ${UNJUDGEABLE_REMEDY}` : "");
 }
 function serviceTokenBlockingReason(refusal, mask) {
@@ -42741,7 +43147,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	const existingState = stateResources[logicalId];
 	const renderer = getLiveRenderer();
 	const currentResource = existingState;
-	if (!currentResource) throw new Error(`Cannot update ${logicalId}: resource not found in state`);
+	if (!currentResource) throw new Error(safeMsg`Cannot update ${logicalId}: resource not found in state`);
 	const oldResourceType = currentResource.resourceType;
 	const typeChanged = oldResourceType !== resourceType;
 	const desiredProps = change.desiredProperties || {};
@@ -42984,7 +43390,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 			applyAttributeOnlyUpdate(change.attributeChanges);
 			return;
 		}
-		this.logger.debug(`Skipping ${logicalId}: no actual changes after intrinsic function resolution`);
+		this.logger.debug(safeMsg`Skipping ${logicalId}: no actual changes after intrinsic function resolution`);
 		if (counts) counts.skipped++;
 		return;
 	}
@@ -43249,7 +43655,7 @@ function unwrittenCreateOnlyRefusal(input) {
 	const keep = [.../* @__PURE__ */ new Set([...unwritten, ...routeDriving])].sort((a, b) => a.localeCompare(b)).map((property) => `${resourceType}:${property}`).join(",");
 	const replaceFlags = nested ? "--replace (which creates the new resource before deleting the old one, so a resource holding a unique value other than its name, such as a CIDR block, collides)" : `--recreate-via-cc-api ${logicalId}, which deletes the old resource first (--replace also works, but creates the new one first, so a resource holding a unique value other than its name, such as a CIDR block, collides)`;
 	const routed = [...routeDriving].sort((a, b) => a.localeCompare(b)).join(", ");
-	return `${logicalId} (${resourceType}): ${list} ${one ? "is" : "are"} create-only, and the state record holds ${one ? "it" : "them"} although this type's SDK provider never writes ${one ? "it" : "them"}, so AWS does not. This deploy routes the resource through Cloud Control (--prefer-sdk-route does not cover ${routed}), and applying a create-only property means replacing the resource, which cdkd does not do on its own. This resource was not changed. To replace it and apply ${list}, re-run with ${replaceFlags}; a stateful resource also needs --force-stateful-recreation.` + (protectionEvidence !== void 0 ? ` ${recordedProtectionNote(protectionEvidence, nested ? "--replace" : `--recreate-via-cc-api ${logicalId} or --replace`)}` : "") + ` To keep dropping ${one ? "it" : "them"}, re-run with --prefer-sdk-route ${keep}.`;
+	return safeMsg`${logicalId} (${resourceType}): ${list} ${one ? "is" : "are"} create-only, and the ` + `state record holds ${one ? "it" : "them"} although this type's SDK provider never writes ${one ? "it" : "them"}, so AWS does not. This deploy routes the resource through ` + safeMsg`Cloud Control (--prefer-sdk-route does not cover ${routed}), and applying a create-only ` + `property means replacing the resource, which cdkd does not do on its own. This ` + safeMsg`resource was not changed. To replace it and apply ${list}, re-run with ${replaceFlags}; a ` + `stateful resource also needs --force-stateful-recreation.` + (protectionEvidence !== void 0 ? safeMsg` ${recordedProtectionNote(protectionEvidence, nested ? "--replace" : `--recreate-via-cc-api ${logicalId} or --replace`)}` : "") + safeMsg` To keep dropping ${one ? "it" : "them"}, re-run with --prefer-sdk-route ${keep}.`;
 }
 function scalarLeavesOf(value, into = /* @__PURE__ */ new Set()) {
 	if (typeof value === "string") into.add(value);
@@ -43494,6 +43900,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			} catch (snapshotError) {
 				if (snapshotError instanceof CdkdError && snapshotError.code === "FINAL_SNAPSHOT_UNSUPPORTED") throw snapshotError;
 				snapshotBlockedDelete = true;
+				this.replacedOldMaySurvive.set(logicalId, "kept");
 				this.logger.warn(safeMsg`  ⚠ Final snapshot for old ${logicalId} (${currentResource.physicalId}) ` + safeMsg`failed: ${asIsMessage(snapshotError instanceof Error ? snapshotError.message : String(snapshotError))}. ` + "The old resource was NOT deleted (UpdateReplacePolicy: Snapshot) — delete it manually once you have a snapshot; it is no longer tracked in state.");
 			}
 			if (!snapshotBlockedDelete) await this.deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, oldDeleteProvider, currentResource.properties, cleanupFinalSnapshotId, updateReplacePolicy, updateSecrets, oldDeleteRoute.provisionedBy, noEchoDeleteValues);
@@ -43604,6 +44011,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 			...removal.context
 		})), logicalId, void 0, void 0, updateProvider);
 		if (result.sentNothing === true) this.updatesThatSentNothing.add(logicalId);
+		if (result.wasReplaced === true && result.outcome === "partial") this.replacedOldMaySurvive.set(logicalId, result.oldResourceSurvivor === "kept" ? "kept" : "unconfirmed");
 		result = withoutInjectedRemovals(result, removal.injected);
 		if (removal.unhandled.length > 0) this.logger.warn(removalWarning(logicalId, resourceType, removal.unhandled));
 	} catch (updateError) {
@@ -44566,6 +44974,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 						oldResourceRetained: this.retainedOldOnReplacement.has(logicalId),
 						oldDeletedBeforeCreate: this.oldDeletedBeforeCreate.has(logicalId)
 					},
+					...change.changeType === "UPDATE" && this.replacedOldMaySurvive.has(logicalId) && { oldResourceMaySurvive: this.replacedOldMaySurvive.get(logicalId) },
 					...change.changeType === "UPDATE" && this.updateWasReplaced.has(logicalId) && { wasReplaced: this.updateWasReplaced.get(logicalId) },
 					...change.changeType === "UPDATE" && previousState !== void 0 && { previousResourceType: previousState.resourceType }
 				});
@@ -44626,7 +45035,16 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			if (this.interrupted && this.hasPending(deleteExecutor)) throw new InterruptedError(this.interruptCause ?? "user");
 		}
 		if (this.interrupted) this.warnUnretriedReplacedDeletes("interrupted");
-		else await this.retryDeferredReplacedDeletes(stackName, actualCounts);
+		else try {
+			await this.retryDeferredReplacedDeletes(stackName, actualCounts);
+		} finally {
+			for (const op of completedOperations) {
+				if (op.changeType !== "UPDATE") continue;
+				const verdict = this.replacedOldMaySurvive.get(op.logicalId);
+				if (verdict !== void 0) op.oldResourceMaySurvive = verdict;
+				else delete op.oldResourceMaySurvive;
+			}
+		}
 	} catch (error) {
 		this.warnUnretriedReplacedDeletes(this.interruptCause === "user" ? "interrupted" : "failed");
 		const initialDeploy = currentEtag === void 0;
@@ -46848,6 +47266,7 @@ var DeployEngine = class {
 	generatedNameGuard;
 	liveTaskLabels = /* @__PURE__ */ new Map();
 	retainedOldOnReplacement = /* @__PURE__ */ new Set();
+	replacedOldMaySurvive = /* @__PURE__ */ new Map();
 	recreatedUnderSameId = /* @__PURE__ */ new Set();
 	restoredLostChildren = /* @__PURE__ */ new Set();
 	updatesThatSentNothing = /* @__PURE__ */ new Set();
@@ -46924,6 +47343,7 @@ var DeployEngine = class {
 		this.outputsSourceUsable = true;
 		this.skippedOutputs = void 0;
 		this.retainedOldOnReplacement = /* @__PURE__ */ new Set();
+		this.replacedOldMaySurvive = /* @__PURE__ */ new Map();
 		this.recreatedUnderSameId = /* @__PURE__ */ new Set();
 		this.restoredLostChildren = /* @__PURE__ */ new Set();
 		this.updatesThatSentNothing = /* @__PURE__ */ new Set();
@@ -47196,5 +47616,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { S3_AUTO_DELETE_OBJECTS_TAG as $, unwrittenCreateOnlyReplacement as $a, getLegacyStateBucketName as $c, malformedExportSourceWarning as $i, formatDestructiveChange as $n, recordLogOnlyParameterValue as $o, explicitRoleArnOrThrow as $r, hasReadableExportSet as $s, replacementNeverSwapped as $t, diffSecurity as A, refuseMalformedResourceEntriesForImport as Aa, describeDockerExecFailure as Ac, cfnRefValueFromPhysicalId as Ai, absoluteAssemblyPathEscape as Al, DEFAULT_RESOURCE_WARN_AFTER_MS as An, sameLambdaFunctionAddress as Ao, RollbackInlinePolicyWriters as Ar, recordNoEchoParameterFreshValue as As, withNestedStackContext as At, readProtection as B, refuseMalformedState as Ba, redactedCause as Bc, STATE_RESOURCES_MALFORMED as Bi, extractDeploymentEventError as Bn, noEchoLeavesOf as Bo, isTerminationProtectionPropagationError as Br, isLockInfoExpired as Bs, awaitInFlightSibling as Bt, withApiLimit as C, refuseMalformedOrphansForOrphan as Ca, readBootstrapMarkerBody as Cc, getAccountInfo as Ci, StageLoadError as Cl, isWholeDynamicReferenceValue as Cn, requireConfigString as Co, withPrintingSecrets as Cr, recordPhysicalNameCopy as Cs, nestedChildStackName as Ct, findServiceTokenRefusals as D, refuseMalformedResourceEntries as Da, buildDockerImage as Dc, isNamelessDynamicReferenceError as Di, hasPlainPrototype$1 as Dl, isExportAliasCollision as Dn, withRetry as Do, CloudControlProvider as Dr, recordMaskOnlyValue as Ds, withNestedRevertRun as Dt, deferredServiceTokenWarning as E, refuseMalformedResourceAttributesForOrphan as Ea, buildDenyExternalAccessPolicy as Ec, carriesFetchableDynamicReference as Ei, hasOwnKey as El, collectPublishedOutputNames as En, describeTypeWithThrottleRetry as Eo, customResourceResponseExpirationWarning as Er, provenPublicValue as Es, revertedNestedRowIds as Et, recordedProtectionEvidence as F, refuseMalformedResourcePropertiesForExport as Fa, getDockerCmd as Fc, parameterInputsFor as Fi, injectAwsRegion as Fl, secretNamePrintingBag as Fn, maskAtCoordinates as Fo, withIndeterminateGuard as Fr, STATE_SOURCED_READBACK_RULES as Fs, loadJournaledOrphans as Ft, deleteBudgetKey as G, repairMalformedResourcePropertiesForReadOnly as Ga, escapeRegExp$3 as Gc, displayLogicalId as Gi, createPreDeleteFinalSnapshot as Gn, valueAtCoordinate as Go, INTRINSIC_KEYS as Gr, applyCrossPrefixScan as Gs, recordAfterRollbackUpdate as Gt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as H, repairMalformedOrphansForReadOnly as Ha, runDockerForeground as Hc, UNREADABLE_RESOURCES_MAP_ROW as Hi, PRE_DELETE_SNAPSHOT_TYPES as Hn, passedNoEchoParametersOf as Ho, reDisableInstanceApiTermination as Hr, rebuildClientForBucketRegion as Hs, getStackRecords as Ht, recordedProtectionNote as I, refuseMalformedResourcePropertiesForOrphan as Ia, isDockerClientEnvKey as Ic, passedParameterClassesOf as Ii, injectedAwsRegionValue as Il, secretNamePrintingBags as In, maskReadbackAtCoordinates as Io, isWaitAbandonedError as Ir, TEMPLATE_SOURCED_RULES as Is, makeForeignHolderScan as It, DELETE_INDEX_WAIT_PROCEED_NOTE as J, unreadableOrphanRecords as Ja, AssetManifestLoader as Jc, hasReadableResources as Ji, refusesFinalSnapshot as Jn, createUnionSecretMasker as Jo, producerLookupOver as Jr, isNotImplemented as Js, isReplacementOrphan as Jt, resolveDynamoDbDeleteBudgetClock as K, repairMalformedResourcesForReadOnly as Ka, stripControlChars as Kc, hasReadableOrphans as Ki, effectiveDeletionPolicy as Kn, liveMatchesUnresolvedTokenFrame as Ko, IntrinsicFunctionResolver as Kr, crossPrefixDeniedWarning as Ks, demoteSupersededOrphans as Kt, PROTECTION_PROPERTY_BY_TYPE as L, refuseMalformedResourcesForDeploy as La, isMalformedEnvKey as Lc, declaresNoEcho as Li, clearBucketRegionCache as Ll, secretNamedRecordNeedles as Ln, maskWholeValue as Lo, markWaitAbandoned as Lr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ls, sameJournaledOrphans as Lt, noEchoComparisonForTemplate as M, refuseMalformedResourceEntriesForOrphan as Ma, dockerSpawnEnvWithSensitive as Mc, refStateLookupFromResource as Mi, displayAssemblyPath as Ml, journaledOrphanPrintingBag as Mn, TemplateParser as Mo, deleteIndeterminateGuards as Mr, wholeStringLeavesOf as Ms, dropFailedHint as Mt, noEchoExactEchoLeavesOf as N, refuseMalformedResourcePropertiesForDestroy as Na, finchSecretArgvRefusal as Nc, parseWebACLArn as Ni, renderAssemblyPathEscape as Nl, maskEventTextWithBoundBags as Nn, canonicalCoordinates as No, deleteLeftInPlace as Nr, STATE_SOURCED_BASELINE_RULES as Ns, isHandledOrphan as Nt, serviceTokenBlockingReason as O, refuseMalformedResourceEntriesForDeploy as Oa, resolveDockerContextDirectory as Oc, keepsSecretReferenceToken as Oi, nullPrototypeRecord as Ol, bindingSkippedOutputs as On, canonicalLambdaFunctionName as Oo, slowCcOperationTimeoutMs as Or, recordMaskOnlyValuesIn as Os, collectNestedChildUnaddressed as Ot, noEchoParameterNamesOf as P, refuseMalformedResourcePropertiesForDrift as Pa, formatDockerLoginError as Pc, withSharedDrainBudget as Pi, resolveAssemblyPath as Pl, orphanRecordsPrintingBag as Pn, isMarkedCoordinate as Po, deleteSkipReason as Pr, STATE_SOURCED_CROSS_GENERATION_RULES as Ps, journaledOrphanLines as Pt, ECR_AUTO_DELETE_IMAGES_TAG as Q, findSilentDropProperties as Qa, getDefaultStateBucketName as Qc, malformedExportNamesWarning as Qi, findDestructiveChanges as Qn, printingCorpusOf as Qo, assertSendableRoleArn as Qr, exportNamesCarriedFrom as Qs, recordUnderIdIsNotOwn as Qt, isProtectionValueActive as R, refuseMalformedResourcesForDestroy as Ra, partitionSensitiveEnv as Rc, JSON_LISTING_HOLE_VALUE as Ri, resolveBucketRegion as Rl, stateSecretNameNeedles as Rn, maskedLeafCoordinatesOf as Ro, disableInstanceApiTermination as Rr, isSingleDynamicReferenceToken as Rs, replayFailedOperations as Rt, lookupEachName as S, refuseMalformedOrphansForDestroy as Sa, parseBootstrapMarker as Sc, parameterTypeMayLoseSecretIdentity as Si, AssemblyReader as Sl, exportNameSecretExposure as Sn, requireConfigObject as So, getCurrentResourceSecrets as Sr, recordAttributeIdCopy as Ss, getNestedRevertRun as St, recordRetainedForReadoption as T, refuseMalformedOutputsForDestroy as Ta, validateContainerRepoName as Tc, carriesDynamicReference as Ti, defineOwnKey as Tl, collectDeclaredOutputNames as Tn, templateResourceTypes as To, applyCustomResourceResponseExpiration as Tr, carriesSecretMask as Ts, revertNestedChildFromJournal as Tt, beginDeleteWait as U, repairMalformedOutputsForReadOnly as Ua, runDockerStreaming as Uc, accountArgs as Ui, buildFinalSnapshotIdentifier as Un, readbackPathFor as Uo, reEnableInstanceApiTermination as Ur, CrossPrefixReadError as Us, withStackRecords as Ut, DynamoDBGlobalTableProvider as V, repairMalformedOrphanRecordsForReadOnly as Va, redactedDockerCause as Vc, UNREADABLE_ORPHANS_CONTAINER_ROW as Vi, ATOMIC_FINAL_SNAPSHOT_TYPES as Vn, noEchoOutputsComparison as Vo, observeThenDisableInstanceApiTermination as Vr, S3StateBackend as Vs, destroyStackRecordsView as Vt, compensateRemovedDeletionProtection as W, repairMalformedResourceEntriesForReadOnly as Wa, warnFinchArgvExposure as Wc, deployRefusesOrphanRowsReason as Wi, ccRoutedFinalSnapshotError as Wn, readsNoEchoSource as Wo, DiffCalculator as Wr, CrossPrefixScanCache as Ws, removeProtectionTypeList as Wt, deleteTableWithIndexBusyRetry as X, withheldAccountClause as Xa, Synthesizer as Xc, isReadableResourceEntry as Xi, maskingRetryLogger as Xn, literalSplitDelimitersOf as Xo, applyRoleArnIfSet as Xr, acceptedCreateOnlyDropsOf as Xs, planRollback as Xt, INDEX_SETTLE_POLL_INTERVAL_MS as Y, unreadableResourceEntries as Ya, getDockerImageBySourceHash as Yc, isReadableOrphanRecord as Yi, unsupportedFinalSnapshotError as Yn, hasMaskableValues as Yo, refuseUnreadableCdkCrossAccountRefs as Yr, splitImportedOps as Ys, planFailedOps as Yt, waitForIndexesSettled as Z, findActionableSilentDrops as Za, synthesisStatusMessage as Zc, malformedDriftResourcePropertiesWarning as Zi, constructPathOf as Zn, logOnlyValueCount as Zo, assertFlagRoleArn as Zr, describeRegionValueKind as Zs, recheckFailedPlan as Zt, keptWholeReasonText as _, refuseDivergentRecordRegionForDestroy as _a, BOOTSTRAP_MARKER_PREFIX as _c, classifyReplaySecretRegion as _i, decodeListingKey as _l, secretBearing as _n, configIntegerRefusal as _o, isCustomResource as _r, identityKeyFor as _s, planOrphanAdoption as _t, inheritedProvenanceForChildDiff as a, malformedOrphanRowsKeptWarning as aa, orphansAfterRollback as ac, envCredentialsAreAssumedRole as ai, resolveStateBucketWithDefault as al, inheritProducerRegions as an, MULTI_REGION_RECREATE_BLOCKED_TYPES as ao, DBPROXY_TAGS_WHAT as ar, maskSecretsInText as as, createReadOnlyAttributeHealerFactory as at, chunks as b, refuseMalformedOrphanRecordsForDestroy as ba, getBootstrapMarkerKey as bc, coerceParameterTypedValue as bi, canonicalizeRegion as bl, carriedExportAliasExposure as bn, replayWarn as bo, readsNoEchoDeleteValues as br, recoverMaskedOutput as bs, displacedPhysicalIdShown as bt, isAbsoluteAssetPath as c, malformedOutputsRefusalMessage as ca, AssetPublisher as cc, outputReferenceProvenanceOf as ci, stateBucketExistenceConfirmed as cl, redactedDeleteAddressFields as cn, renderStatefulReason as co, readTagList as cr, snapshotPassProvenance as cs, gray as ct, templateIdentity as d, malformedResourceEntriesWarning as da, WorkGraph as dc, s3BucketArn as di, CFN_TEMPLATE_BODY_LIMIT as dl, updatePartialReason as dn, isWarmThroughputDecrease as do, tagPlanWarning as dr, withPhysicalNameCopies as ds, yellow as dt, malformedLocalOutputsWarning as ea, hasReasonlessBaselineRefusal as ec, isIamRoleArn as ei, loadCdkJson as el, resolveReplacementOldType as en, withoutSilentDropProperties as eo, earliestDefined as er, recordLogOnlyValue as es, hasCdkAutoDeleteTag as et, conditionFingerprint as f, malformedResourcePropertiesWarning as fa, buildAssetRedirectMap as fc, s3BucketDomainName as fi, CFN_TEMPLATE_URL_LIMIT as fl, DeploymentEventsReader as fn, toCfnInteger as fo, definedAttributes as fr, withoutPhysicalNameCopies as fs, computeParameterTaint as ft, isSecretBearingReferenceString as g, previewableOrphanRecords as ga, AssetModeResolver as gc, classifyRecordedSecretRegion as gi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as gl, exportAliasCollisionScrubWarning as gn, configBooleanRefusal as go, ccBrokenReason as gr, pathCrossesDottedKey as gs, makeSiblingClaimReader as gt, readRecordedConditionVerdicts as h, malformedStateRefusalMessage as ha, rewriteTemplateAssetReferences as hc, s3BucketWebsiteUrl as hi, uploadCfnTemplate as hl, displayTextOrWithheld as hn, coerceCfnInteger as ho, ProviderRegistry as hr, isUncertifiedBaselineMaskPosition as hs, resourcesNamingDeclaredParameter as ht, crossStackOutputProvenanceSource as i, malformedOrphanRecordsWarning as ia, isReadableBag as ic, callerEnvCredentials as ii, resolveSkipPrefix as il, getCurrentProducerRegions as in, shownType as io, acquireIdempotencyToken as ir, maskSecretsInError as is, formatResourceLine as it, noEchoAttributeNamesOf as j, refuseMalformedResourceEntriesForImportSave as ja, describeDockerFailure as jc, isStalePlaceholderArnAttribute as ji, describeFileReadFailure as jl, completedReplayEntries as jn, DagBuilder as jo, UNSPECIFIED_SKIP_REASON as jr, recordProvenPublicExpression as js, deleteJournaledOrphans as jt, withResourceDeadline as k, refuseMalformedResourceEntriesForDestroy as ka, describeDockerCapturedOutput as kc, AWS_NO_VALUE as ki, ownValue as kl, DEFAULT_RESOURCE_TIMEOUT_MS as kn, lambdaFunctionNameForMask as ko, unchangedBehindSecretReference as kr, recordNoEchoAttributeValues as ks, getCurrentNestedStackContext as kt, listNestedTemplateRows as l, malformedOutputsWarning as la, isSensitiveAttributeName as lc, recordedOutputReferenceRegions as li, warnDeprecatedNoPrefixCliFlag as ll, redactedDeleteAddressSkip as ln, WARM_THROUGHPUT_MEMBERS as lo, refuseMalformedDesiredTags as lr, redactSecretsForState as ls, green as lt, parentSuppliedValues as m, malformedScrubResourceEntriesRefusalMessage as ma, loadPublishableAssetManifest as mc, s3BucketRegionalDomainName as mi, findLargeInlineResources as ml, WITHHELD_NAME_DISPLAY as mn, coerceCfnBoolean as mo, CC_BROKEN_REASON as mr, dynamicReferenceTokens as ms, reachableDivergentParameters as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedLocalResourcesWarning as na, importableOutputKeys as nc, AWS_CREDENTIAL_ENV_KEYS as ni, resolveAutoAssetStorage as nl, orphanDeleteNeedsIdentity as nn, hasNoCloudControlHandlers as no, reserveStackCreateToken as nr, createSecretMasker as ns, getPriorAttempts as nt, childTemplateLoader as o, malformedOrphansRefusalMessage as oa, orphansCarriedFrom as oc, isSettledInstanceState as oi, resolveStateBucketWithDefaultAndSource as ol, REDACTED_DELETE_ADDRESS_SKIP_REASON as on, isStatefulRecreateTargetForReplace as oo, DBPROXY_TAG_OPTIONS as or, markSameGenerationBag as os, bold as ot, conditionInputsFrom as p, malformedResourcesWarning as pa, createAssetRedirectResolver as pc, s3BucketDualStackDomainName as pi, MIGRATE_TMP_PREFIX as pl, DeploymentEventsStore as pn, toFiniteNumber as po, stringifyIfAssigned as pr, DYNAMIC_REFERENCE_TOKEN_SCAN as ps, namesAnyDeclaredParameter as pt, resolveDynamoDbDeleteBudgetMs as q, unpreviewableOrphanRecords as qa, stripForDisplay as qc, hasReadableOutputs as qi, isFinalSnapshotError as qn, carryLogOnlyValues as qo, poisonRenderedSpellingsCollidingIn as qr, isAccessDenied$1 as qs, isJournaledOrphan as qt, computeImplicitDeleteEdges as r, malformedOrphanRecordsRefusalMessage as ra, importableOutputs as rc, applyCallerIdentityCredentials as ri, resolveCaptureObservedState as rl, findNestedStackTypeChanges as rn, findReplacedReadersOfRecreateTargets as ro, withCreateTokenLedger as rr, errorCauseChain as rs, markRefusedBeforeApplying as rt, findNestedTemplateTreeDefect as s, malformedOrphansWarning as sa, shouldRetainResource as sc, keepHeldTokenProvenance as si, resolveUseCdkBootstrapAssets as sl, isRedactedRecordedValue as sn, isStatefulRecreateTargetSync as so, planTagDiff as sr, recordReferenceProvenanceEntry as ss, cyan as st, DeployEngine as t, malformedLocalResourceEntriesWarning as ta, hasUnverifiableParameterRefusal as tc, sendableAssumeRoleCommand as ti, resolveApp as tl, seedsDeleteFirstGuard as tn, NO_CC_HANDLERS_REASON as to, ledgerForStack as tr, shareLogOnlyValues as ts, isTruthyCfnBoolean as tt, renderNestedTemplateTreeDefect as u, malformedRenderedContainersWarning as ua, stringifyValue as uc, recordedReferenceRegions as ui, ssmResolvedValueType as ul, updatePartialMessage as un, coerceWarmThroughput as uo, tagMapAsList as ur, scrubResourceRecord as us, red as ut, mergeNoChangeOutputs as v, refuseMalformedNestedChildOutputs as va, assertAssetBucketRegion as vc, producerRegionsFromState as vi, expectedOwnerParam as vl, secretBearingStateKeyWarning as vn, configStringRefusal as vo, wouldReturnToSdkProvider as vr, inheritNestedStackParameterAssociations as vs, NESTED_PENDING_PARENT_REASON as vt, keptForReadoption as w, refuseMalformedOutputs as wa, validateAssetBucketName as wc, isImpossibleEmptyStoredAttribute as wi, processStackMessages as wl, noEchoParameterValueSeed as wn, prefetchCreateOnlyPropertyPaths as wo, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as wr, splitGetAttStringForm as ws, recordDisplacedSkips as wt, isAccessDeniedError as x, refuseMalformedOrphans as xa, isCrossRegionRedirect as xc, isUnboundTemplateParameter as xi, derivePartitionAndUrlSuffix as xl, exportNameNoEchoParameters as xn, requireConfigArray as xo, isCustomResourceType as xr, physicalNameCopiesOf as xs, dropSettledNestedJournals as xt, makeCanonicalizePropertiesFn as y, refuseMalformedOrphanRecords as ya, ensureAssetStorage as yc, regionLessSecretName as yi, PARTITION_TABLE as yl, secretSafeKeyDisplay as yn, readConfigString as yo, TemplateNoEchoReresolver as yr, recordNestedStackParameterExpressions as ys, displacedOpClause as yt, perType as z, refuseMalformedResourcesForExport as za, redactDockerArgvValues as zc, STATE_REGION_DIVERGED as zi, storedSecretNameNeedles as zn, noEchoCoordinatesOf as zo, ec2InstanceProtectionSite as zr, LockManager as zs, replayRollback as zt };
-//# sourceMappingURL=deploy-engine-BU3iY59A.js.map
+export { S3_AUTO_DELETE_OBJECTS_TAG as $, findSilentDropProperties as $a, synthesisStatusMessage as $c, malformedExportNamesWarning as $i, findDestructiveChanges as $n, printingCorpusOf as $o, assertSendableRoleArn as $r, describeRegionValueKind as $s, recordUnderIdIsNotOwn as $t, diffSecurity as A, refuseMalformedResourceEntriesForDestroy as Aa, resolveDockerContextDirectory as Ac, AWS_NO_VALUE as Ai, nullPrototypeRecord as Al, DEFAULT_RESOURCE_TIMEOUT_MS as An, lambdaFunctionNameForMask as Ao, unchangedBehindSecretReference as Ar, recordMaskOnlyValuesIn as As, withNestedStackContext as At, readProtection as B, refuseMalformedResourcesForExport as Ba, partitionSensitiveEnv as Bc, STATE_REGION_DIVERGED as Bi, resolveBucketRegion as Bl, storedSecretNameNeedles as Bn, noEchoCoordinatesOf as Bo, ec2InstanceProtectionSite as Br, isSingleDynamicReferenceToken as Bs, awaitInFlightSibling as Bt, withApiLimit as C, refuseMalformedOrphansForDestroy as Ca, isCrossRegionRedirect as Cc, parameterTypeMayLoseSecretIdentity as Ci, derivePartitionAndUrlSuffix as Cl, exportNameSecretExposure as Cn, requireConfigObject as Co, getCurrentResourceSecrets as Cr, physicalNameCopiesOf as Cs, nestedChildStackName as Ct, findServiceTokenRefusals as D, refuseMalformedResourceAttributesForOrphan as Da, validateContainerRepoName as Dc, carriesFetchableDynamicReference as Di, defineOwnKey as Dl, collectPublishedOutputNames as Dn, describeTypeWithThrottleRetry as Do, customResourceResponseExpirationWarning as Dr, carriesSecretMask as Ds, withNestedRevertRun as Dt, deferredServiceTokenWarning as E, refuseMalformedOutputsForDestroy as Ea, validateAssetBucketName as Ec, carriesDynamicReference as Ei, processStackMessages as El, collectDeclaredOutputNames as En, templateResourceTypes as Eo, applyCustomResourceResponseExpiration as Er, splitGetAttStringForm as Es, revertedNestedRowIds as Et, recordedProtectionEvidence as F, refuseMalformedResourcePropertiesForDrift as Fa, finchSecretArgvRefusal as Fc, withSharedDrainBudget as Fi, renderAssemblyPathEscape as Fl, orphanRecordsPrintingBag as Fn, isMarkedCoordinate as Fo, deleteSkipReason as Fr, STATE_SOURCED_BASELINE_RULES as Fs, loadJournaledOrphans as Ft, deleteBudgetKey as G, repairMalformedResourceEntriesForReadOnly as Ga, runDockerStreaming as Gc, deployRefusesOrphanRowsReason as Gi, ccRoutedFinalSnapshotError as Gn, readsNoEchoSource as Go, DiffCalculator as Gr, CrossPrefixReadError as Gs, replacedDeleteFailureVerdict as Gt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as H, repairMalformedOrphanRecordsForReadOnly as Ha, redactedCause as Hc, UNREADABLE_ORPHANS_CONTAINER_ROW as Hi, ATOMIC_FINAL_SNAPSHOT_TYPES as Hn, noEchoOutputsComparison as Ho, observeThenDisableInstanceApiTermination as Hr, isLockInfoExpired as Hs, getStackRecords as Ht, recordedProtectionNote as I, refuseMalformedResourcePropertiesForExport as Ia, formatDockerLoginError as Ic, parameterInputsFor as Ii, resolveAssemblyPath as Il, secretNamePrintingBag as In, maskAtCoordinates as Io, withIndeterminateGuard as Ir, STATE_SOURCED_CROSS_GENERATION_RULES as Is, makeForeignHolderScan as It, DELETE_INDEX_WAIT_PROCEED_NOTE as J, unpreviewableOrphanRecords as Ja, stripControlChars as Jc, hasReadableOutputs as Ji, isFinalSnapshotError as Jn, carryLogOnlyValues as Jo, poisonRenderedSpellingsCollidingIn as Jr, crossPrefixDeniedWarning as Js, isJournaledOrphan as Jt, resolveDynamoDbDeleteBudgetClock as K, repairMalformedResourcePropertiesForReadOnly as Ka, warnFinchArgvExposure as Kc, displayLogicalId as Ki, createPreDeleteFinalSnapshot as Kn, valueAtCoordinate as Ko, INTRINSIC_KEYS as Kr, CrossPrefixScanCache as Ks, recordAfterRollbackUpdate as Kt, PROTECTION_PROPERTY_BY_TYPE as L, refuseMalformedResourcePropertiesForOrphan as La, getDockerCmd as Lc, passedParameterClassesOf as Li, injectAwsRegion as Ll, secretNamePrintingBags as Ln, maskReadbackAtCoordinates as Lo, isWaitAbandonedError as Lr, STATE_SOURCED_READBACK_RULES as Ls, sameJournaledOrphans as Lt, noEchoComparisonForTemplate as M, refuseMalformedResourceEntriesForImportSave as Ma, describeDockerExecFailure as Mc, isStalePlaceholderArnAttribute as Mi, absoluteAssemblyPathEscape as Ml, completedReplayEntries as Mn, DagBuilder as Mo, UNSPECIFIED_SKIP_REASON as Mr, recordNoEchoParameterFreshValue as Ms, dropFailedHint as Mt, noEchoExactEchoLeavesOf as N, refuseMalformedResourceEntriesForOrphan as Na, describeDockerFailure as Nc, refStateLookupFromResource as Ni, describeFileReadFailure as Nl, journaledOrphanPrintingBag as Nn, TemplateParser as No, deleteIndeterminateGuards as Nr, recordProvenPublicExpression as Ns, isHandledOrphan as Nt, serviceTokenBlockingReason as O, refuseMalformedResourceEntries as Oa, buildDenyExternalAccessPolicy as Oc, isNamelessDynamicReferenceError as Oi, hasOwnKey as Ol, isExportAliasCollision as On, withRetry as Oo, CloudControlProvider as Or, provenPublicValue as Os, collectNestedChildUnaddressed as Ot, noEchoParameterNamesOf as P, refuseMalformedResourcePropertiesForDestroy as Pa, dockerSpawnEnvWithSensitive as Pc, parseWebACLArn as Pi, displayAssemblyPath as Pl, maskEventTextWithBoundBags as Pn, canonicalCoordinates as Po, deleteLeftInPlace as Pr, wholeStringLeavesOf as Ps, journaledOrphanLines as Pt, ECR_AUTO_DELETE_IMAGES_TAG as Q, findActionableSilentDrops as Qa, Synthesizer as Qc, malformedDriftResourcePropertiesWarning as Qi, constructPathOf as Qn, logOnlyValueCount as Qo, assertFlagRoleArn as Qr, acceptedCreateOnlyDropsOf as Qs, recheckFailedPlan as Qt, isProtectionValueActive as R, refuseMalformedResourcesForDeploy as Ra, isDockerClientEnvKey as Rc, declaresNoEcho as Ri, injectedAwsRegionValue as Rl, secretNamedRecordNeedles as Rn, maskWholeValue as Ro, markWaitAbandoned as Rr, TEMPLATE_SOURCED_RULES as Rs, replayFailedOperations as Rt, lookupEachName as S, refuseMalformedOrphans as Sa, getBootstrapMarkerKey as Sc, isUnboundTemplateParameter as Si, canonicalizeRegion as Sl, exportNameNoEchoParameters as Sn, requireConfigArray as So, isCustomResourceType as Sr, recoverMaskedOutput as Ss, getNestedRevertRun as St, recordRetainedForReadoption as T, refuseMalformedOutputs as Ta, readBootstrapMarkerBody as Tc, isImpossibleEmptyStoredAttribute as Ti, StageLoadError as Tl, noEchoParameterValueSeed as Tn, prefetchCreateOnlyPropertyPaths as To, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Tr, recordPhysicalNameCopy as Ts, revertNestedChildFromJournal as Tt, beginDeleteWait as U, repairMalformedOrphansForReadOnly as Ua, redactedDockerCause as Uc, UNREADABLE_RESOURCES_MAP_ROW as Ui, PRE_DELETE_SNAPSHOT_TYPES as Un, passedNoEchoParametersOf as Uo, reDisableInstanceApiTermination as Ur, S3StateBackend as Us, withStackRecords as Ut, DynamoDBGlobalTableProvider as V, refuseMalformedState as Va, redactDockerArgvValues as Vc, STATE_RESOURCES_MALFORMED as Vi, extractDeploymentEventError as Vn, noEchoLeavesOf as Vo, isTerminationProtectionPropagationError as Vr, LockManager as Vs, destroyStackRecordsView as Vt, compensateRemovedDeletionProtection as W, repairMalformedOutputsForReadOnly as Wa, runDockerForeground as Wc, accountArgs as Wi, buildFinalSnapshotIdentifier as Wn, readbackPathFor as Wo, reEnableInstanceApiTermination as Wr, rebuildClientForBucketRegion as Ws, removeProtectionTypeList as Wt, deleteTableWithIndexBusyRetry as X, unreadableResourceEntries as Xa, AssetManifestLoader as Xc, isReadableOrphanRecord as Xi, unsupportedFinalSnapshotError as Xn, hasMaskableValues as Xo, refuseUnreadableCdkCrossAccountRefs as Xr, isNotImplemented as Xs, planFailedOps as Xt, INDEX_SETTLE_POLL_INTERVAL_MS as Y, unreadableOrphanRecords as Ya, stripForDisplay as Yc, hasReadableResources as Yi, refusesFinalSnapshot as Yn, createUnionSecretMasker as Yo, producerLookupOver as Yr, isAccessDenied$1 as Ys, isReplacementOrphan as Yt, waitForIndexesSettled as Z, withheldAccountClause as Za, getDockerImageBySourceHash as Zc, isReadableResourceEntry as Zi, maskingRetryLogger as Zn, literalSplitDelimitersOf as Zo, applyRoleArnIfSet as Zr, splitImportedOps as Zs, planRollback as Zt, keptWholeReasonText as _, previewableOrphanRecords as _a, rewriteTemplateAssetReferences as _c, classifyRecordedSecretRegion as _i, uploadCfnTemplate as _l, exportAliasCollisionScrubWarning as _n, configBooleanRefusal as _o, ccBrokenReason as _r, isUncertifiedBaselineMaskPosition as _s, planOrphanAdoption as _t, inheritedProvenanceForChildDiff as a, malformedOrphanRecordsWarning as aa, importableOutputs as ac, callerEnvCredentials as ai, resolveCaptureObservedState as al, getCurrentProducerRegions as an, shownType as ao, acquireIdempotencyToken as ar, errorCauseChain as as, createReadOnlyAttributeHealerFactory as at, chunks as b, refuseMalformedOrphanRecords as ba, assertAssetBucketRegion as bc, regionLessSecretName as bi, expectedOwnerParam as bl, secretSafeKeyDisplay as bn, readConfigString as bo, TemplateNoEchoReresolver as br, inheritNestedStackParameterAssociations as bs, displacedPhysicalIdShown as bt, isAbsoluteAssetPath as c, malformedOrphansWarning as ca, orphansCarriedFrom as cc, keepHeldTokenProvenance as ci, resolveStateBucketWithDefaultAndSource as cl, isRedactedRecordedValue as cn, isStatefulRecreateTargetSync as co, planTagDiff as cr, markSameGenerationBag as cs, gray as ct, templateIdentity as d, malformedRenderedContainersWarning as da, isSensitiveAttributeName as dc, recordedReferenceRegions as di, warnDeprecatedNoPrefixCliFlag as dl, updatePartialMessage as dn, coerceWarmThroughput as do, tagMapAsList as dr, redactSecretsForState as ds, yellow as dt, malformedExportSourceWarning as ea, exportNamesCarriedFrom as ec, explicitRoleArnOrThrow as ei, getDefaultStateBucketName as el, replacementNeverSwapped as en, unwrittenCreateOnlyReplacement as eo, formatDestructiveChange as er, recordLogOnlyParameterValue as es, hasCdkAutoDeleteTag as et, conditionFingerprint as f, malformedResourceEntriesWarning as fa, stringifyValue as fc, s3BucketArn as fi, ssmResolvedValueType as fl, updatePartialReason as fn, isWarmThroughputDecrease as fo, tagPlanWarning as fr, scrubResourceRecord as fs, computeParameterTaint as ft, isSecretBearingReferenceString as g, malformedStateRefusalMessage as ga, loadPublishableAssetManifest as gc, s3BucketWebsiteUrl as gi, findLargeInlineResources as gl, displayTextOrWithheld as gn, coerceCfnInteger as go, ProviderRegistry as gr, dynamicReferenceTokens as gs, makeSiblingClaimReader as gt, readRecordedConditionVerdicts as h, malformedScrubResourceEntriesRefusalMessage as ha, createAssetRedirectResolver as hc, s3BucketRegionalDomainName as hi, MIGRATE_TMP_PREFIX as hl, WITHHELD_NAME_DISPLAY as hn, coerceCfnBoolean as ho, CC_BROKEN_REASON as hr, DYNAMIC_REFERENCE_TOKEN_SCAN as hs, resourcesNamingDeclaredParameter as ht, crossStackOutputProvenanceSource as i, malformedOrphanRecordsRefusalMessage as ia, importableOutputKeys as ic, applyCallerIdentityCredentials as ii, resolveAutoAssetStorage as il, findNestedStackTypeChanges as in, findReplacedReadersOfRecreateTargets as io, withCreateTokenLedger as ir, createSecretMasker as is, formatResourceLine as it, noEchoAttributeNamesOf as j, refuseMalformedResourceEntriesForImport as ja, describeDockerCapturedOutput as jc, cfnRefValueFromPhysicalId as ji, ownValue as jl, DEFAULT_RESOURCE_WARN_AFTER_MS as jn, sameLambdaFunctionAddress as jo, RollbackInlinePolicyWriters as jr, recordNoEchoAttributeValues as js, deleteJournaledOrphans as jt, withResourceDeadline as k, refuseMalformedResourceEntriesForDeploy as ka, buildDockerImage as kc, keepsSecretReferenceToken as ki, hasPlainPrototype$1 as kl, bindingSkippedOutputs as kn, canonicalLambdaFunctionName as ko, slowCcOperationTimeoutMs as kr, recordMaskOnlyValue as ks, getCurrentNestedStackContext as kt, listNestedTemplateRows as l, malformedOutputsRefusalMessage as la, shouldRetainResource as lc, outputReferenceProvenanceOf as li, resolveUseCdkBootstrapAssets as ll, redactedDeleteAddressFields as ln, renderStatefulReason as lo, readTagList as lr, recordReferenceProvenanceEntry as ls, green as lt, parentSuppliedValues as m, malformedResourcesWarning as ma, buildAssetRedirectMap as mc, s3BucketDualStackDomainName as mi, CFN_TEMPLATE_URL_LIMIT as ml, DeploymentEventsStore as mn, toFiniteNumber as mo, stringifyIfAssigned as mr, withoutPhysicalNameCopies as ms, reachableDivergentParameters as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedLocalResourceEntriesWarning as na, hasReasonlessBaselineRefusal as nc, sendableAssumeRoleCommand as ni, loadCdkJson as nl, seedsDeleteFirstGuard as nn, NO_CC_HANDLERS_REASON as no, ledgerForStack as nr, shareLogOnlyValues as ns, getPriorAttempts as nt, childTemplateLoader as o, malformedOrphanRowsKeptWarning as oa, isReadableBag as oc, envCredentialsAreAssumedRole as oi, resolveSkipPrefix as ol, inheritProducerRegions as on, MULTI_REGION_RECREATE_BLOCKED_TYPES as oo, DBPROXY_TAGS_WHAT as or, maskSecretsInError as os, bold as ot, conditionInputsFrom as p, malformedResourcePropertiesWarning as pa, WorkGraph as pc, s3BucketDomainName as pi, CFN_TEMPLATE_BODY_LIMIT as pl, DeploymentEventsReader as pn, toCfnInteger as po, definedAttributes as pr, withPhysicalNameCopies as ps, namesAnyDeclaredParameter as pt, resolveDynamoDbDeleteBudgetMs as q, repairMalformedResourcesForReadOnly as qa, escapeRegExp$3 as qc, hasReadableOrphans as qi, effectiveDeletionPolicy as qn, liveMatchesUnresolvedTokenFrame as qo, IntrinsicFunctionResolver as qr, applyCrossPrefixScan as qs, demoteSupersededOrphans as qt, computeImplicitDeleteEdges as r, malformedLocalResourcesWarning as ra, hasUnverifiableParameterRefusal as rc, AWS_CREDENTIAL_ENV_KEYS as ri, resolveApp as rl, orphanDeleteNeedsIdentity as rn, hasNoCloudControlHandlers as ro, reserveStackCreateToken as rr, unionOfSecretBags as rs, markRefusedBeforeApplying as rt, findNestedTemplateTreeDefect as s, malformedOrphansRefusalMessage as sa, orphansAfterRollback as sc, isSettledInstanceState as si, resolveStateBucketWithDefault as sl, REDACTED_DELETE_ADDRESS_SKIP_REASON as sn, isStatefulRecreateTargetForReplace as so, DBPROXY_TAG_OPTIONS as sr, maskSecretsInText as ss, cyan as st, DeployEngine as t, malformedLocalOutputsWarning as ta, hasReadableExportSet as tc, isIamRoleArn as ti, getLegacyStateBucketName as tl, resolveReplacementOldType as tn, withoutSilentDropProperties as to, earliestDefined as tr, recordLogOnlyValue as ts, isTruthyCfnBoolean as tt, renderNestedTemplateTreeDefect as u, malformedOutputsWarning as ua, AssetPublisher as uc, recordedOutputReferenceRegions as ui, stateBucketExistenceConfirmed as ul, redactedDeleteAddressSkip as un, WARM_THROUGHPUT_MEMBERS as uo, refuseMalformedDesiredTags as ur, snapshotPassProvenance as us, red as ut, mergeNoChangeOutputs as v, refuseDivergentRecordRegionForDestroy as va, AssetModeResolver as vc, classifyReplaySecretRegion as vi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as vl, secretBearing as vn, configIntegerRefusal as vo, isCustomResource as vr, pathCrossesDottedKey as vs, NESTED_PENDING_PARENT_REASON as vt, keptForReadoption as w, refuseMalformedOrphansForOrphan as wa, parseBootstrapMarker as wc, getAccountInfo as wi, AssemblyReader as wl, isWholeDynamicReferenceValue as wn, requireConfigString as wo, withPrintingSecrets as wr, recordAttributeIdCopy as ws, recordDisplacedSkips as wt, isAccessDeniedError as x, refuseMalformedOrphanRecordsForDestroy as xa, ensureAssetStorage as xc, coerceParameterTypedValue as xi, PARTITION_TABLE as xl, carriedExportAliasExposure as xn, replayWarn as xo, readsNoEchoDeleteValues as xr, recordNestedStackParameterExpressions as xs, dropSettledNestedJournals as xt, makeCanonicalizePropertiesFn as y, refuseMalformedNestedChildOutputs as ya, BOOTSTRAP_MARKER_PREFIX as yc, producerRegionsFromState as yi, decodeListingKey as yl, secretBearingStateKeyWarning as yn, configStringRefusal as yo, wouldReturnToSdkProvider as yr, identityKeyFor as ys, displacedOpClause as yt, perType as z, refuseMalformedResourcesForDestroy as za, isMalformedEnvKey as zc, JSON_LISTING_HOLE_VALUE as zi, clearBucketRegionCache as zl, stateSecretNameNeedles as zn, maskedLeafCoordinatesOf as zo, disableInstanceApiTermination as zr, WHOLE_DYNAMIC_REFERENCE_PATTERN as zs, replayRollback as zt };
+//# sourceMappingURL=deploy-engine-C-4ho8TJ.js.map