@go-to-k/cdkd 0.299.8 → 0.300.1

package/dist/{deploy-engine-BU3iY59A.js → deploy-engine-BK4gG_5A.js}

@@ -1,8 +1,8 @@
-import { r as getAwsClients, s as __exportAll } from "./aws-clients-Bj7qH5Ph.js";
+import { r as getAwsClients, s as __exportAll } from "./aws-clients-B_CEQGE1.js";
 import { A as UNRENDERABLE, B as safeMsg, C as looksLikeCdkdGeneratedName, D as SAFE_MSG_ALTERED_CHAR, E as withoutGeneratedFallbackName, F as displaySafe, H as terminalSafe, I as displayStackName, L as isPasteableIdent, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, S as getCurrentStackName, T as withStackName, U as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, j as asIsMessage, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-dAY3-gXJ.js";
+import { $ as protectedReplacementAdvice, $n as formatRetryClassificationSignals, $t as ambientCredentialConfig, A as isQuotableImportValue, An as SHELL_ACTIVE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, Ct as RETRY_AUXILIARY_OWNER, Dn as normalizeAwsError, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as isUpdateUnsupportedError, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as withheldTargetClause, Ht as recoveryCommandFlags, In as pasteableCommand, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as isNameCooldownError, Kn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as physicalIdShownBesideCommand, M as quotedRemedyLogicalId, Mn as UNSHOWABLE_VALUE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Ot as hasCreatedBeforeFailure, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as plainOrDescribed, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Ut as sanitizeRecoveryValue, Vn as shellQuote, Vt as formatLockOwner, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isReplayedNameCollisionFrom, Yn as isRecreateRetryableError, Yt as producerRecordKey, Zt as withPasteableAwsProfile, _t as createMaskedLogSinks, ar as retryClassificationText, at as startInterruptWatch, bn as ResourceUpdateNotSupportedError, bt as maskDeep, cr as isThrottlingError, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dr as wrapMaskedAwsError, en as clientDefaultsFor, er as isAmbiguousCcHandlerErrorCode, f as removalWarning, ft as logicalIdShown, gt as stateOrphanRecordRemedy, hn as MalformedProducerRecordRefusalError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isTransientServerError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as SHELL_ACTIVE_WHY, jt as markAuxiliaryFailure, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DynamicReferenceRegionAmbiguousError, lr as markNonRetryable, m as withoutInjectedRemovals, mn as MacroExpansionError, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as isIamPropagationError, on as CrossAccountSecretRefusalError, ot as ElapsedBudgetRegistry, pn as LockError, qn as isNameCollisionErrorFrom, rn as AssetError, rr as isRetryableTransientError, sn as DependencyError, sr as isMarkedNonRetryable, st as monotonicNowMs, tn as credentialFingerprint, tr as isAmbiguousOutcomeError, un as IntrinsicResolutionRefusalError, ur as markRedactedCause, ut as compositeIdSeparatorRefusal, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as SynthesisError, wt as carryCreatedBeforeFailure, xt as maskerOrIdentity, yn as ResourceTimeoutError, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-DAs3w7QW.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-DBXBcg0J.js";
-import { t as getCdkdVersion } from "./version-BtTEjOpj.js";
+import { t as getCdkdVersion } from "./version-DTSDiQcV.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2308,7 +2308,7 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region, legacyF
 	logger.debug("No state bucket specified, resolving default from account...");
 	const { GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const { S3Client, HeadBucketCommand, ListObjectsV2Command } = await import("@aws-sdk/client-s3");
-	const { getAwsClients } = await import("./aws-clients-Bj7qH5Ph.js").then((n) => n.n);
+	const { getAwsClients } = await import("./aws-clients-B_CEQGE1.js").then((n) => n.n);
 	const { expectedOwnerParam, recordResolvedAccountId } = await Promise.resolve().then(() => expected_bucket_owner_exports);
 	const probeDeps = {
 		HeadBucketCommand,
@@ -4846,7 +4846,7 @@ function retainedOldPhysicalId(op) {
 	const prevType = op.previousState?.resourceType;
 	const oldType = op.previousResourceType ?? (typeof prevType === "string" && prevType !== "" ? prevType : void 0);
 	if (!(prev !== journalOpPhysicalId(op) || oldType !== void 0 && oldType !== op.resourceType)) return void 0;
-	return op.oldResourceRetained !== false ? prev : void 0;
+	return op.oldResourceRetained !== false || op.oldResourceMaySurvive !== void 0 ? prev : void 0;
 }
 function isMarkFor(mark, op) {
 	const own = journalOpPhysicalId(op);
@@ -4892,6 +4892,7 @@ function refuseMalformedOperation(shownStack, where, op) {
 	}
 	if (o["wasReplaced"] !== void 0 && typeof o["wasReplaced"] !== "boolean") fail("wasReplaced", o["wasReplaced"], "a boolean when present");
 	if (o["oldDeletedBeforeCreate"] !== void 0 && typeof o["oldDeletedBeforeCreate"] !== "boolean") fail("oldDeletedBeforeCreate", o["oldDeletedBeforeCreate"], "a boolean when present");
+	if (o["oldResourceMaySurvive"] !== void 0 && !["kept", "unconfirmed"].includes(o["oldResourceMaySurvive"])) fail("oldResourceMaySurvive", o["oldResourceMaySurvive"], "kept or unconfirmed when present");
 	if (o["physicalIdRecoveredFromError"] !== void 0 && typeof o["physicalIdRecoveredFromError"] !== "boolean") fail("physicalIdRecoveredFromError", o["physicalIdRecoveredFromError"], "a boolean when present");
 	if (o["physicalIdRecoveredFromError"] !== void 0 && o["changeType"] !== "CREATE") refuseMalformed(shownStack, `${where}.physicalIdRecoveredFromError is only valid on a CREATE (got changeType ${kind(o["changeType"])}).`);
 	const identity = o["createdResourceIdentity"];
@@ -8050,9 +8051,16 @@ function parameterReadsFor(childSecrets, parentSecrets) {
 	}
 	return reads;
 }
-function recordInheritedParameterValue(childSecrets, parentSecrets, parameterName, value) {
+function recordInheritedParameterValue(childSecrets, parentSecrets, parameterName, value, declared) {
 	const reads = parameterReadsFor(childSecrets, parentSecrets);
 	if (reads === void 0) return;
+	if (declared !== void 0) {
+		if (reads.declared === void 0) reads.declared = declared;
+		else if (reads.declared.size !== declared.size || [...declared].some((name) => !reads.declared.has(name))) {
+			inheritedParameterReads.set(childSecrets, POISONED_PARAMETER_READS);
+			return;
+		}
+	}
 	if (reads.values.has(parameterName)) {
 		if (!deepEqualJsonValue(reads.values.get(parameterName), value)) inheritedParameterReads.set(childSecrets, POISONED_PARAMETER_READS);
 		return;
@@ -8078,16 +8086,53 @@ function positionByInheritedParameter(bag, source, secrets) {
 	if (!deepEqualJsonValue(redactSecretsForState(answer, secrets), answer)) return void 0;
 	return answer;
 }
-const REREAD_TRIGGERS = /* @__PURE__ */ new Set(["Fn::Select", "Fn::Split"]);
+const REREAD_TRIGGERS = /* @__PURE__ */ new Set([
+	"Fn::Select",
+	"Fn::Split",
+	"Fn::If"
+]);
 const MAX_REREAD_DEPTH = 16;
-function evaluatePureRead(node, bind, depth = 0) {
+const MAX_REREAD_CONDITIONS = 4;
+const REREAD_NO_VALUE = Symbol("cdkd.reread.no-value");
+function splitOutsideDynamicReferences(text, delimiter, standsForSecret) {
+	if (delimiter === "") return text.split(delimiter);
+	const spans = dynamicReferenceSpans(text).filter((span) => {
+		const token = text.slice(span.start, span.end);
+		return spanNamesResolvableService(token) && standsForSecret(token);
+	});
+	if (spans.length === 0) return text.split(delimiter);
+	const pieces = [];
+	let cursor = 0;
+	let from = 0;
+	for (;;) {
+		const at = text.indexOf(delimiter, from);
+		if (at === -1) break;
+		const end = at + delimiter.length;
+		const token = spans.find((span) => span.start < end && at < span.end);
+		if (token !== void 0) {
+			from = token.end;
+			continue;
+		}
+		pieces.push(text.slice(cursor, at));
+		cursor = end;
+		from = end;
+	}
+	pieces.push(text.slice(cursor));
+	return pieces;
+}
+function standsForInheritedSecret(parentSecrets, token) {
+	return parentSecrets !== void 0 && resolvedPlaintextOf(parentSecrets, token) !== void 0;
+}
+const plainSplit = (text, delimiter) => text.split(delimiter);
+function evaluatePureRead(node, bind, split, choose, depth = 0) {
 	if (depth > MAX_REREAD_DEPTH) return void 0;
+	const evaluate = (child) => evaluatePureRead(child, bind, split, choose, depth + 1);
 	if (typeof node === "string") return node.includes("{{resolve:") ? void 0 : { value: node };
 	if (Array.isArray(node)) {
 		const out = [];
 		for (const element of node) {
-			const evaluated = evaluatePureRead(element, bind, depth + 1);
-			if (evaluated === void 0) return void 0;
+			const evaluated = evaluate(element);
+			if (evaluated === void 0 || evaluated.value === REREAD_NO_VALUE) return void 0;
 			out.push(evaluated.value);
 		}
 		return { value: out };
@@ -8097,30 +8142,77 @@ function evaluatePureRead(node, bind, depth = 0) {
 	if (keys.length !== 1) return void 0;
 	const key = keys[0];
 	const args = node[key];
-	if (key === "Ref") return typeof args === "string" ? bind(args) : void 0;
+	if (key === "Ref") {
+		if (args === "AWS::NoValue") return { value: REREAD_NO_VALUE };
+		return typeof args === "string" ? bind(args) : void 0;
+	}
+	if (key === "Fn::If") {
+		if (!Array.isArray(args) || args.length !== 3 || typeof args[0] !== "string") return void 0;
+		return evaluate(choose(args[0]) ? args[1] : args[2]);
+	}
+	if (key === "Fn::Sub") return evaluatePureSub(args, bind, evaluate);
 	if (!Array.isArray(args) || args.length !== 2) return void 0;
 	if (key === "Fn::Select") {
 		const index = args[0];
 		const position = typeof index === "number" ? index : typeof index === "string" && /^(0|[1-9][0-9]*)$/.test(index) ? Number(index) : void 0;
 		if (position === void 0 || !Number.isSafeInteger(position) || position < 0) return void 0;
-		const list = evaluatePureRead(args[1], bind, depth + 1);
+		const list = evaluate(args[1]);
 		if (list === void 0 || !Array.isArray(list.value) || position >= list.value.length) return;
 		return { value: list.value[position] };
 	}
 	const delimiter = args[0];
 	if (typeof delimiter !== "string") return void 0;
 	if (key === "Fn::Split") {
-		const value = evaluatePureRead(args[1], bind, depth + 1);
+		const value = evaluate(args[1]);
 		if (value === void 0 || typeof value.value !== "string") return void 0;
-		return { value: value.value.split(delimiter) };
+		return { value: split(value.value, delimiter) };
 	}
 	if (key === "Fn::Join") {
-		const parts = evaluatePureRead(args[1], bind, depth + 1);
+		const parts = evaluate(args[1]);
 		if (parts === void 0 || !Array.isArray(parts.value)) return void 0;
 		if (!parts.value.every((part) => typeof part === "string")) return void 0;
 		return { value: parts.value.join(delimiter) };
 	}
 }
+function evaluatePureSub(args, bind, evaluate) {
+	const [text, variables] = typeof args === "string" ? [args, {}] : Array.isArray(args) && args.length === 2 ? [args[0], args[1]] : [void 0, void 0];
+	if (typeof text !== "string" || text.includes("{{resolve:") || !isPlainObject$7(variables)) return;
+	const bound = /* @__PURE__ */ new Map();
+	for (const [name, variable] of Object.entries(variables)) {
+		const evaluated = evaluate(variable);
+		if (evaluated === void 0 || typeof evaluated.value !== "string") return void 0;
+		bound.set(name, evaluated.value);
+	}
+	let out = "";
+	let cursor = 0;
+	for (const match of text.matchAll(/\$\{(!)?([^}]*)\}/g)) {
+		const name = match[2] ?? "";
+		let replacement;
+		if (match[1] === "!") replacement = `\${${name}}`;
+		else if (name === "") replacement = match[0];
+		else if (bound.has(name)) replacement = bound.get(name);
+		else {
+			if (name.startsWith("AWS::") || name.includes(".")) return void 0;
+			const value = bind(name);
+			if (value === void 0 || typeof value.value !== "string") return void 0;
+			replacement = value.value;
+		}
+		out += text.slice(cursor, match.index) + replacement;
+		cursor = match.index + match[0].length;
+	}
+	return { value: out + text.slice(cursor) };
+}
+function collectRereadConditions(node, names, depth = 0) {
+	if (depth > MAX_REREAD_DEPTH) return false;
+	if (Array.isArray(node)) return node.every((element) => collectRereadConditions(element, names, depth + 1));
+	if (!isPlainObject$7(node)) return true;
+	if (Object.hasOwn(node, "Fn::If")) {
+		const args = node["Fn::If"];
+		if (!Array.isArray(args) || typeof args[0] !== "string") return false;
+		names.add(args[0]);
+	}
+	return Object.values(node).every((child) => collectRereadConditions(child, names, depth + 1));
+}
 function holdsRereadTrigger(node, depth = 0) {
 	if (depth > MAX_REREAD_DEPTH) return false;
 	if (Array.isArray(node)) return node.some((element) => holdsRereadTrigger(element, depth + 1));
@@ -8135,29 +8227,61 @@ function rendersReadTo(spelling, parentSecrets, value) {
 	if (Array.isArray(spelling) && Array.isArray(value) && spelling.length === value.length) return spelling.every((element, i) => rendersReadTo(element, parentSecrets, value[i]));
 	return false;
 }
-function rereadParameterExpression(source, bind, parentSecrets) {
+const REREAD_UNBOUND = Symbol("cdkd.reread.unbound");
+function rereadAssignments(source, bind, parentSecrets, untakenWhenUnbound = () => false) {
 	if (!holdsRereadTrigger(source)) return void 0;
-	const resolved = evaluatePureRead(source, bind);
-	if (resolved === void 0) return void 0;
-	const redacted = evaluatePureRead(source, (name) => {
+	const conditions = /* @__PURE__ */ new Set();
+	if (!collectRereadConditions(source, conditions)) return void 0;
+	if (conditions.size > MAX_REREAD_CONDITIONS) return void 0;
+	const names = [...conditions];
+	const redactedBind = (name) => {
 		const bound = bind(name);
 		return bound && { value: redactInheritedParameterValue(parentSecrets, name, bound.value) };
-	});
-	if (redacted === void 0) return void 0;
-	if (!rendersReadTo(redacted.value, parentSecrets, resolved.value)) return void 0;
-	return {
-		resolved: resolved.value,
-		redacted: redacted.value
 	};
+	const tokenSplit = (text, delimiter) => splitOutsideDynamicReferences(text, delimiter, (token) => standsForInheritedSecret(parentSecrets, token));
+	const out = [];
+	for (let assignment = 0; assignment < 2 ** names.length; assignment++) {
+		const choose = (condition) => Math.floor(assignment / 2 ** names.indexOf(condition)) % 2 === 1;
+		let unbound = false;
+		const tracked = (name) => {
+			const bound = bind(name);
+			if (bound === void 0 && untakenWhenUnbound(name)) unbound = true;
+			return bound;
+		};
+		const resolved = evaluatePureRead(source, tracked, plainSplit, choose);
+		const redacted = resolved && evaluatePureRead(source, redactedBind, tokenSplit, choose);
+		if (unbound) out.push(REREAD_UNBOUND);
+		else if (resolved === void 0 || redacted === void 0) out.push(void 0);
+		else if (resolved.value === REREAD_NO_VALUE || redacted.value === REREAD_NO_VALUE) out.push(resolved.value === redacted.value ? REREAD_NO_VALUE : void 0);
+		else if (!rendersReadTo(redacted.value, parentSecrets, resolved.value)) out.push(void 0);
+		else out.push({
+			resolved: resolved.value,
+			redacted: redacted.value
+		});
+	}
+	return out;
+}
+function rereadParameterExpression(source, bind, parentSecrets) {
+	const assignments = rereadAssignments(source, bind, parentSecrets);
+	if (assignments === void 0 || assignments.includes(void 0) || assignments.includes(REREAD_UNBOUND)) return;
+	const rereads = assignments.filter((entry) => entry !== void 0 && entry !== REREAD_NO_VALUE && entry !== REREAD_UNBOUND);
+	if (rereads.length === 0 || ambiguousRereads(rereads)) return void 0;
+	return rereads[0];
+}
+function ambiguousRereads(rereads) {
+	return rereads.some((a, i) => rereads.slice(i + 1).some((b) => deepEqualJsonValue(a.resolved, b.resolved) && !deepEqualJsonValue(a.redacted, b.redacted)));
 }
 function positionByParameterReread(bag, source, secrets) {
 	const reads = inheritedParameterReads.get(secrets);
 	if (reads === void 0 || typeof reads === "symbol") return void 0;
 	if (typeof bag !== "string" && !Array.isArray(bag)) return void 0;
-	const reread = rereadParameterExpression(source, (name) => reads.values.has(name) ? { value: reads.values.get(name) } : void 0, reads.parent);
-	if (reread === void 0 || !deepEqualJsonValue(reread.resolved, bag)) return void 0;
+	const declared = reads.declared;
+	const assignments = rereadAssignments(source, (name) => reads.values.has(name) ? { value: reads.values.get(name) } : void 0, reads.parent, (name) => declared?.has(name) === true);
+	if (assignments === void 0 || assignments.includes(void 0)) return void 0;
+	const matching = assignments.filter((entry) => entry !== void 0 && entry !== REREAD_NO_VALUE && entry !== REREAD_UNBOUND && deepEqualJsonValue(entry.resolved, bag));
+	if (matching.length === 0 || ambiguousRereads(matching)) return void 0;
 	if (carriesChildOnlyPlaintext(bag, secrets, reads.parent)) return void 0;
-	const answer = reread.redacted;
+	const answer = matching[0].redacted;
 	if (!deepEqualJsonValue(redactSecretsForState(answer, secrets), answer)) return void 0;
 	return answer;
 }
@@ -8394,6 +8518,78 @@ function positionListByCrossStackSource(bag, source, secrets) {
 
 //#endregion
 //#region src/deployment/secret-redaction/redact-path.ts
+const NEVER_DROPPING_INTRINSICS = /* @__PURE__ */ new Set([
+	"Fn::Join",
+	"Fn::Sub",
+	"Fn::Select",
+	"Fn::Split",
+	"Fn::GetAtt"
+]);
+function arrayElementDrop(element, depth = 0) {
+	if (depth > 16) return "unknown";
+	if (!isPlainObject$7(element)) return "never";
+	if (Object.hasOwn(element, "Ref")) return element["Ref"] === "AWS::NoValue" ? "always" : "never";
+	const keys = Object.keys(element);
+	if (keys.filter((key) => key.startsWith("Fn::") || key === "Condition").length === 0) return "never";
+	if (keys.length !== 1) return "unknown";
+	if (NEVER_DROPPING_INTRINSICS.has(keys[0])) return "never";
+	if (keys[0] !== "Fn::If") return "unknown";
+	const args = element["Fn::If"];
+	if (!Array.isArray(args) || args.length !== 3) return "unknown";
+	const branches = [arrayElementDrop(args[1], depth + 1), arrayElementDrop(args[2], depth + 1)];
+	if (branches.includes("unknown")) return "unknown";
+	if (branches.every((branch) => branch === "never")) return "never";
+	if (branches.every((branch) => branch === "always")) return "always";
+	return "maybe";
+}
+function sourceElementsKeptFor(source, bagLength) {
+	const drops = source.map((element) => arrayElementDrop(element));
+	if (drops.includes("unknown")) return void 0;
+	const always = drops.filter((drop) => drop === "always").length;
+	const maybe = drops.filter((drop) => drop === "maybe").length;
+	const dropped = source.length - bagLength;
+	let dropMaybe;
+	if (dropped === always) dropMaybe = false;
+	else if (dropped === always + maybe) dropMaybe = true;
+	else return void 0;
+	return source.filter((_, i) => drops[i] === "never" || drops[i] === "maybe" && !dropMaybe);
+}
+function keptLiteralsCorroborate(kept, bag, secrets) {
+	return kept.every((element, i) => keptElementCorroborates(element, bag[i], secrets));
+}
+function isIntrinsicNode(value) {
+	if (!isPlainObject$7(value)) return false;
+	const keys = Object.keys(value);
+	return keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"));
+}
+function keptElementCorroborates(source, bag, secrets, depth = 0) {
+	if (depth > 16) return false;
+	if (typeof source === "string") {
+		if (!source.includes("{{resolve:")) return source === bag;
+		return isSingleDynamicReferenceToken(source) && resolvedPlaintextOf(secrets, source) === bag;
+	}
+	if (source === null || typeof source !== "object") return source === bag;
+	if (isIntrinsicNode(source)) return true;
+	if (Array.isArray(source)) return Array.isArray(bag) && bag.length === source.length && source.every((element, i) => keptElementCorroborates(element, bag[i], secrets, depth + 1));
+	if (!isPlainObject$7(source) || !isPlainObject$7(bag)) return false;
+	if (Object.keys(bag).some((key) => !Object.hasOwn(source, key))) return false;
+	return Object.entries(source).every(([key, value]) => Object.hasOwn(bag, key) ? keptElementCorroborates(value, bag[key], secrets, depth + 1) : arrayElementDrop(value) === "always" || arrayElementDrop(value) === "maybe");
+}
+function corroboratesWhateverResolves(source, depth = 0) {
+	if (depth > 16) return false;
+	if (typeof source === "string") return !source.includes("{{resolve:");
+	if (source === null || typeof source !== "object") return true;
+	if (isIntrinsicNode(source)) return true;
+	if (Array.isArray(source)) return source.every((element) => arrayElementDrop(element) === "never" && corroboratesWhateverResolves(element, depth + 1));
+	if (!isPlainObject$7(source)) return false;
+	if (Object.keys(source).some((key) => key === "Ref" || key.startsWith("Fn::"))) return false;
+	return Object.values(source).every((value) => arrayElementDrop(value) !== "unknown" && corroboratesWhateverResolves(value, depth + 1));
+}
+function arrayPairsWhateverDrops(source) {
+	if (!source.some((element) => isPlainObject$7(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue" || Array.isArray(element["Fn::FindInMap"]) && element["Fn::FindInMap"].length > 3))) return true;
+	const drops = source.map((element) => arrayElementDrop(element));
+	return !drops.includes("unknown") && drops.filter((drop) => drop === "maybe").length <= 1 && source.every((element) => corroboratesWhateverResolves(element));
+}
 function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameGeneration) {
 	if (isDynamicReferenceString(source) && typeof bag === "string") {
 		if (isSingleDynamicReferenceToken(source) && (rules.trustAnyExpression || isKnownSecretExpression(source, secretExpressions))) {
@@ -8448,6 +8644,10 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 			});
 		}
 		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration));
+		if (rules.descendArrays && bag.length < source.length) {
+			const kept = sourceElementsKeptFor(source, bag.length);
+			if (kept !== void 0 && keptLiteralsCorroborate(kept, bag, secrets)) return bag.map((item, i) => redactByPath(item, kept[i], secrets, rules, secretExpressions, bagIsSameGeneration));
+		}
 	}
 	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source)) {
 		const out = Object.create(null);
@@ -9617,14 +9817,16 @@ function carryListElementFragments(needles, to, value) {
 		for (const fragment of fragments) recordLogOnlyValue(to, fragment);
 	}
 }
-function recordLogOnlySplitFragments(from, to, text, delimiter) {
+function recordLogOnlySplitFragments(from, to, text, delimiter, printed) {
 	if (delimiter === "") return;
+	const splits = [text.split(delimiter)];
+	if (printed !== void 0 && (printed.length !== splits[0].length || printed.some((piece, i) => piece !== splits[0][i]))) splits.push(printed);
 	for (const bag of from) {
 		if (bag === void 0) continue;
-		for (const needle of [...logOnlyValuesOf.get(bag) ?? []]) for (const fragment of fragmentsOfNeedleIn(text, delimiter, needle)) if (fragment !== needle) recordLogOnlyValue(to, fragment);
+		for (const needle of [...logOnlyValuesOf.get(bag) ?? []]) for (const pieces of splits) for (const fragment of fragmentsOfNeedleIn(text, delimiter, needle, pieces)) if (fragment !== needle) recordLogOnlyValue(to, fragment);
 	}
 }
-function fragmentsOfNeedleIn(text, delimiter, needle) {
+function fragmentsOfNeedleIn(text, delimiter, needle, pieces = text.split(delimiter)) {
 	const fragments = /* @__PURE__ */ new Set();
 	if (needle === "") return fragments;
 	const starts = [];
@@ -9633,7 +9835,7 @@ function fragmentsOfNeedleIn(text, delimiter, needle) {
 	if (starts.length === 0) return fragments;
 	const spans = [];
 	let offset = 0;
-	for (const piece of text.split(delimiter)) {
+	for (const piece of pieces) {
 		spans.push([offset, offset + piece.length]);
 		offset += piece.length + delimiter.length;
 	}
@@ -11299,12 +11501,19 @@ async function withRetry(operation, logicalId, opts = {}) {
 		return await operation();
 	} catch (error) {
 		lastError = error;
+		const replayMadeAnother = replayMadeAnotherResource(previousError, error);
 		const carried = carryCreatedBeforeFailure(previousError, error);
 		if (hasCreatedBeforeFailure(carried) || !hasCreatedBeforeFailure(previousError)) previousError = carried;
 		if (isAuxiliaryFailure(error) || hasReplayMayCollide(error) || isAmbiguousOutcomeError(error)) replayMayCollide = true;
 		const message = describeAwsFailure(error).detail;
 		const classifyText = retryClassificationText(error);
 		if (isMarkedNonRetryable(error)) throw settle(error);
+		if (replayMadeAnother) {
+			try {
+				opts.logger?.warn?.(safeMsg`${shownId}: not retrying - a retried create made another resource instead of resuming the one an earlier attempt left behind, and only the latest is recorded for \`cdkd rollback --revert-failed\`. Find the earlier one and delete it by hand`);
+			} catch {}
+			throw settle(error);
+		}
 		const retryable = opts.isRetryable ? opts.isRetryable(classifyText, error) : isRetryableTransientError(error, classifyText);
 		const propagation = defaultSchedule && isIamPropagationError(classifyText);
 		if (propagation) sawPropagation = true;
@@ -11922,6 +12131,7 @@ const CREATE_ONLY_PATHS_SNAPSHOT = /* @__PURE__ */ new Map([
 		["LicenseInfo"]
 	]],
 	["AWS::Lambda::MicrovmImage", [["Name"]]],
+	["AWS::Lambda::NetworkConnector", [["Name"]]],
 	["AWS::Lambda::Permission", [
 		["Action"],
 		["EventSourceToken"],
@@ -11934,6 +12144,19 @@ const CREATE_ONLY_PATHS_SNAPSHOT = /* @__PURE__ */ new Map([
 		["SourceArn"]
 	]],
 	["AWS::Lambda::Url", [["Qualifier"], ["TargetFunctionArn"]]],
+	["AWS::Lambda::WebFunctionEndpoint", [
+		["EndpointName"],
+		["EndpointType"],
+		["FunctionName"],
+		["Regions"]
+	]],
+	["AWS::Lambda::WebFunctionRevision", [
+		["BuildConfig"],
+		["Description"],
+		["FunctionName"],
+		["KmsKeyArn"],
+		["ServiceConfig"]
+	]],
 	["AWS::Logs::LogGroup", [["LogGroupName"]]],
 	["AWS::Neptune::DBCluster", [
 		["AvailabilityZones"],
@@ -12380,6 +12603,11 @@ const REVERSE_REPLACEMENT_NAME_KEYS = {
 	"AWS::KinesisFirehose::DeliveryStream": flat("DeliveryStreamName"),
 	"AWS::KMS::Alias": flat("AliasName"),
 	"AWS::Lambda::MicrovmImage": flat("Name"),
+	"AWS::Lambda::NetworkConnector": flat("Name"),
+	"AWS::Lambda::WebFunctionEndpoint": {
+		name: [["EndpointName"]],
+		scope: [["FunctionName"]]
+	},
 	"AWS::Pipes::Pipe": flat("Name"),
 	"AWS::RDS::DBProxyTargetGroup": {
 		name: [["TargetGroupName"]],
@@ -12422,6 +12650,7 @@ const NOT_NAME_KEYED_TYPES = /* @__PURE__ */ new Set([
 	"AWS::IAM::Policy",
 	"AWS::Lambda::EventInvokeConfig",
 	"AWS::Lambda::Permission",
+	"AWS::Lambda::WebFunctionRevision",
 	"AWS::Route53::HostedZone"
 ]);
 const CASE_INSENSITIVE_NAME_TYPES = /* @__PURE__ */ new Set([
@@ -14534,7 +14763,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
-		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		readOnly: /* @__PURE__ */ new Set(["AnomalyDetectorId"]),
 		ccRouteUnavailable: true
 	}],
 	["AWS::CodeBuild::Project", {
@@ -15951,6 +16180,23 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		]),
 		ccRouteUnavailable: false
 	}],
+	["AWS::Lambda::NetworkConnector", {
+		handled: /* @__PURE__ */ new Set([
+			"Configuration",
+			"Name",
+			"OperatorRole",
+			"Tags"
+		]),
+		silentDrop: /* @__PURE__ */ new Map(),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"Arn",
+			"LatestVersion",
+			"LatestVersionArn",
+			"State"
+		]),
+		ccRouteUnavailable: false
+	}],
 	["AWS::Lambda::Permission", {
 		handled: /* @__PURE__ */ new Set([
 			"Action",
@@ -15981,6 +16227,54 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		readOnly: /* @__PURE__ */ new Set(["FunctionArn", "FunctionUrl"]),
 		ccRouteUnavailable: false
 	}],
+	["AWS::Lambda::WebFunctionEndpoint", {
+		handled: /* @__PURE__ */ new Set([
+			"AuthType",
+			"Description",
+			"EndpointName",
+			"EndpointType",
+			"FunctionName",
+			"Regions",
+			"RevisionWeights",
+			"ScalingConfig",
+			"ThrottleConfig"
+		]),
+		silentDrop: /* @__PURE__ */ new Map(),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"CreatedAt",
+			"DomainName",
+			"EndpointArn",
+			"FunctionArn",
+			"RegionalEndpoints",
+			"State",
+			"StateReason",
+			"UpdatedAt",
+			"UpdateStatus",
+			"UpdateStatusReason"
+		]),
+		ccRouteUnavailable: false
+	}],
+	["AWS::Lambda::WebFunctionRevision", {
+		handled: /* @__PURE__ */ new Set([
+			"BuildConfig",
+			"Description",
+			"FunctionName",
+			"KmsKeyArn",
+			"ServiceConfig"
+		]),
+		silentDrop: /* @__PURE__ */ new Map(),
+		createOnlyDrops: /* @__PURE__ */ new Set(),
+		readOnly: /* @__PURE__ */ new Set([
+			"CreatedAt",
+			"FunctionArn",
+			"RevisionArn",
+			"RevisionId",
+			"State",
+			"StateReason"
+		]),
+		ccRouteUnavailable: false
+	}],
 	["AWS::Logs::LogGroup", {
 		handled: /* @__PURE__ */ new Set([
 			"BearerTokenAuthenticationEnabled",
@@ -21964,6 +22258,7 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 			const verdictScope = secretVerdictScope(this);
 			const isKnownSecret = service === "secretsmanager" || service === "ssm-secure" || isScopedSecretVerdict(verdictScope, fullMatch);
 			if (isKnownSecret && context?.skipDynamicReferences) {
+				context.skippedSecretReferences?.add(fullMatch);
 				complete = false;
 				continue;
 			}
@@ -22042,6 +22337,7 @@ async function resolveDynamicReferencesWithLogTwin(value, logTwin, context, inhe
 				isSecret = param.secure;
 				if (param.secure) {
 					if (!decrypt) {
+						context?.skippedSecretReferences?.add(fullMatch);
 						complete = false;
 						continue;
 					}
@@ -22390,6 +22686,12 @@ function describeSplitValueSource(value) {
 		kind: "getatt"
 	};
 }
+function splitValueResolvesReferences(value) {
+	if (typeof value === "string") return true;
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const keys = Object.keys(value);
+	return keys.length === 1 && (keys[0] === "Fn::Join" || keys[0] === "Fn::Sub");
+}
 async function resolveSplit(splitArgs, context) {
 	const [delimiter, value] = splitArgs;
 	const resolvedValue = await this.resolveValue(value, context);
@@ -22402,22 +22704,22 @@ async function resolveSplit(splitArgs, context) {
 		}
 		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Split: the value to split${sourceClause} must be a string, got ${resolvedValue === null ? "null" : typeof resolvedValue}. Fn::Split accepts only a string; check the value or the intrinsic that produced it.`));
 	}
-	const result = resolvedValue.split(delimiter);
+	const result = context.skipDynamicReferences === true && typeof delimiter === "string" ? splitOutsideDynamicReferences(resolvedValue, delimiter, splitValueResolvesReferences(value) ? () => true : (token) => standsForInheritedSecret(context.inheritedSecrets, token) || context.secretStandInTokens?.has(token) === true) : resolvedValue.split(delimiter);
 	let lineContext = context;
 	if (this.hasLogOnlyNeedles(context)) {
-		if (context.recordedSecretValues) recordLogOnlySplitFragments([context.inheritedSecrets, context.recordedSecretValues], context.recordedSecretValues, resolvedValue, String(delimiter));
+		if (context.recordedSecretValues) recordLogOnlySplitFragments([context.inheritedSecrets, context.recordedSecretValues], context.recordedSecretValues, resolvedValue, String(delimiter), result);
 		else {
 			const linePieces = /* @__PURE__ */ new Map();
 			if (context.printingSecrets !== void 0) carryLogOnlyValues(context.printingSecrets, linePieces);
-			recordLogOnlySplitFragments([context.inheritedSecrets], linePieces, resolvedValue, String(delimiter));
+			recordLogOnlySplitFragments([context.inheritedSecrets], linePieces, resolvedValue, String(delimiter), result);
 			lineContext = {
 				...context,
 				printingSecrets: linePieces
 			};
 		}
 	}
-	if (context.printingSecrets !== void 0 && hasLogOnlyValues(context.printingSecrets)) recordLogOnlySplitFragments([context.printingSecrets], context.printingSecrets, resolvedValue, String(delimiter));
-	if (context.secretNameSink !== void 0 && hasLogOnlyValues(context.secretNameSink)) recordLogOnlySplitFragments([context.secretNameSink], context.secretNameSink, resolvedValue, String(delimiter));
+	if (context.printingSecrets !== void 0 && hasLogOnlyValues(context.printingSecrets)) recordLogOnlySplitFragments([context.printingSecrets], context.printingSecrets, resolvedValue, String(delimiter), result);
+	if (context.secretNameSink !== void 0 && hasLogOnlyValues(context.secretNameSink)) recordLogOnlySplitFragments([context.secretNameSink], context.secretNameSink, resolvedValue, String(delimiter), result);
 	const pieceTwins = String(delimiter) === "" && this.maskRenderedNeedlesForLog(resolvedValue, lineContext) !== resolvedValue ? result.map(() => "***") : this.splitLogTwins(resolvedValue, delimiter, result, context);
 	this.logger.debug(`Resolved Fn::Split: split by ${this.splitDelimiterRender(String(delimiter), lineContext)} resolved to ${this.logRender(JSON.stringify(this.maskValueLeaves(pieceTwins, lineContext)), lineContext, { structured: true })}`);
 	return result;
@@ -23212,16 +23514,35 @@ function recordInheritedParameterSecrets(parameterName, value, context) {
 	if (recorded) carryPhysicalNameCopiesCarriedBy(context, recorded, value);
 	if (inherited && recorded) recordInheritedNoEchoListElements(this, inherited, recorded, value, context);
 	if (!inherited || inherited.size === 0 || !recorded) return;
-	recordInheritedParameterValue(recorded, inherited, parameterName, value);
+	const mirror = parameterReadMirrors.get(recorded);
+	const declared = declaredParameterNames(context);
+	recordInheritedParameterValue(recorded, inherited, parameterName, value, declared);
+	if (mirror) recordInheritedParameterValue(mirror, inherited, parameterName, value, declared);
 	for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) {
 		const carried = carriedExpressionFor(inherited, parameterName, value, plaintext, expression);
 		recorded.set(plaintext, carried);
 		const parentEntry = context.inheritedReferenceProvenance?.get(carried);
 		if (parentEntry !== void 0) recordReferenceProvenanceEntry(recorded, carried, parentEntry, "read");
 		recordInheritedParameterRead(recorded, inherited, parameterName);
+		if (mirror) recordInheritedParameterRead(mirror, inherited, parameterName);
 		carryFreshNoEchoMark(inherited, recorded, plaintext);
 	}
 }
+function declaredParameterNames(context) {
+	const declared = context.template?.Parameters;
+	if (declared === null || typeof declared !== "object") return void 0;
+	let names = declaredNamesCache.get(declared);
+	if (names === void 0) {
+		names = new Set(Object.keys(declared));
+		declaredNamesCache.set(declared, names);
+	}
+	return names;
+}
+const declaredNamesCache = /* @__PURE__ */ new WeakMap();
+const parameterReadMirrors = /* @__PURE__ */ new WeakMap();
+function mirrorInheritedParameterReads(passSecrets, persistSecrets) {
+	if (passSecrets !== persistSecrets) parameterReadMirrors.set(passSecrets, persistSecrets);
+}
 function carryPhysicalNameCopiesCarriedBy(context, recorded, value) {
 	const names = context.inheritedPhysicalNameCopies ?? (context.inheritedSecrets && physicalNameCopiesOf.get(context.inheritedSecrets));
 	if (names === void 0 || names.size === 0) return;
@@ -23238,15 +23559,25 @@ function poisonRenderedSpellingsCollidingIn(template, parameterValues, inherited
 	const names = new Set(Object.keys(parameterValues));
 	if (names.size < 2) return;
 	const groups = [];
-	if (template.Resources !== null && typeof template.Resources === "object") for (const resource of Object.values(template.Resources)) groups.push([resource, false]);
-	if (template.Outputs !== void 0) groups.push([template.Outputs, true]);
+	if (template.Resources !== null && typeof template.Resources === "object") for (const resource of Object.values(template.Resources)) groups.push([{
+		node: resource,
+		mode: "resource"
+	}]);
+	if (template.Outputs !== void 0) groups.push(outputsGroupParts(template.Outputs));
 	const bind = (name) => Object.hasOwn(parameterValues, name) ? { value: parameterValues[name] } : void 0;
 	const withdrawn = /* @__PURE__ */ new Set();
 	for (;;) {
-		const fresh = [...collidingRenderedNames(groups.map(([group, slotOnly]) => parameterReadsOf(group, names, slotOnly ? void 0 : {
-			bind,
-			inherited
-		})).filter((reads) => reads.size >= 2), parameterValues, inherited)].filter((name) => !withdrawn.has(name));
+		const fresh = [...collidingRenderedNames(groups.map((parts) => {
+			const reads = /* @__PURE__ */ new Map();
+			for (const { node, mode } of parts) {
+				const reread = mode === "slot" ? void 0 : {
+					bind,
+					inherited
+				};
+				for (const [name, slotRead] of parameterReadsOf(node, names, reread, mode !== "output")) reads.set(name, slotRead || reads.get(name) === true);
+			}
+			return reads;
+		}).filter((reads) => reads.size >= 2), parameterValues, inherited)].filter((name) => !withdrawn.has(name));
 		if (fresh.length === 0) return;
 		for (const name of fresh) {
 			withdrawn.add(name);
@@ -23287,14 +23618,14 @@ function collidingRenderedNames(readsByGroup, parameterValues, inherited) {
 	return withdraw;
 }
 const POSITIONED_INTRINSICS = /* @__PURE__ */ new Set(["Fn::Join", "Fn::Sub"]);
-function parameterReadsOf(node, names, reread) {
+function parameterReadsOf(node, names, reread, positionsArrays) {
 	const reads = /* @__PURE__ */ new Map();
 	const add = (name, slotRead) => {
 		reads.set(name, slotRead || reads.get(name) === true);
 	};
 	const visit = (value, slotRead, atLeaf) => {
 		if (Array.isArray(value)) {
-			const mayShrink = value.some((element) => element !== null && typeof element === "object" && !Array.isArray(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue"));
+			const mayShrink = atLeaf ? !positionsArrays || !arrayPairsWhateverDrops(value) : value.some((element) => element !== null && typeof element === "object" && !Array.isArray(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue"));
 			for (const element of value) visit(element, slotRead || mayShrink, atLeaf && !mayShrink);
 			return;
 		}
@@ -23307,17 +23638,72 @@ function parameterReadsOf(node, names, reread) {
 		}
 		const ref = record["Ref"];
 		if (typeof ref === "string" && names.has(ref)) add(ref, slotRead);
+		const placeholderSlot = !positionsArrays && unkeyedPlaceholderParts(record, (name) => certifiesPlaceholder(name, reread)) > MAX_UNKEYED_PARTS;
 		const sub = record["Fn::Sub"];
 		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
 		if (typeof text === "string") for (const match of text.matchAll(/\$\{([^}!][^}]*)\}/g)) {
 			const name = match[1].trim();
-			if (names.has(name)) add(name, slotRead);
+			if (names.has(name)) add(name, slotRead || placeholderSlot);
 		}
-		for (const [key, child] of Object.entries(record)) visit(child, slotRead || key.startsWith("Fn::") && !POSITIONED_INTRINSICS.has(key), atLeaf && !intrinsic);
+		for (const [key, child] of Object.entries(record)) visit(child, slotRead || placeholderSlot || key.startsWith("Fn::") && !POSITIONED_INTRINSICS.has(key), atLeaf && !intrinsic);
 	};
 	visit(node, reread === void 0, true);
 	return reads;
 }
+const MAX_UNKEYED_PARTS = 1;
+function certifiesPlaceholder(name, reread) {
+	if (reread === void 0) return false;
+	const bound = reread.bind(name);
+	if (bound === void 0) return false;
+	if (inheritedSecretsCarriedBy(bound.value, reread.inherited).length === 0) return false;
+	return typeof inheritedParameterExpression(reread.inherited, name, bound.value) === "string";
+}
+function unkeyedPlaceholderParts(record, certified) {
+	const keyed = (value) => typeof value === "string" || value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 1 && typeof value["Ref"] === "string" && certified(value["Ref"]);
+	if (Object.hasOwn(record, "Fn::Join")) {
+		const args = record["Fn::Join"];
+		if (!Array.isArray(args) || args.length !== 2 || !Array.isArray(args[1])) return Number.POSITIVE_INFINITY;
+		return args[1].filter((part) => !keyed(part)).length;
+	}
+	if (Object.hasOwn(record, "Fn::Sub")) {
+		const args = record["Fn::Sub"];
+		const [template, variables] = typeof args === "string" ? [args, {}] : Array.isArray(args) ? [args[0], args[1]] : [];
+		if (typeof template !== "string" || variables === null || typeof variables !== "object") return Number.POSITIVE_INFINITY;
+		let unkeyed = 0;
+		for (const hit of template.matchAll(/\$\{(!)?([^}]*)\}/g)) {
+			const name = hit[2] ?? "";
+			if (hit[1] === "!" || name === "") continue;
+			if (!(Object.hasOwn(variables, name) ? keyed(variables[name]) : certified(name))) unkeyed += 1;
+		}
+		return unkeyed;
+	}
+	return 0;
+}
+function outputsGroupParts(outputs) {
+	if (outputs === null || typeof outputs !== "object" || Array.isArray(outputs)) return [{
+		node: outputs,
+		mode: "slot"
+	}];
+	const parts = [];
+	for (const output of Object.values(outputs)) {
+		if (output === null || typeof output !== "object" || Array.isArray(output)) {
+			parts.push({
+				node: output,
+				mode: "slot"
+			});
+			continue;
+		}
+		const { Value: value, ...rest } = output;
+		parts.push({
+			node: value,
+			mode: "output"
+		}, {
+			node: rest,
+			mode: "slot"
+		});
+	}
+	return parts;
+}
 function refNamesIn(node, names) {
 	const found = /* @__PURE__ */ new Set();
 	const visit = (value) => {
@@ -23328,6 +23714,12 @@ function refNamesIn(node, names) {
 		if (value === null || typeof value !== "object") return;
 		const record = value;
 		if (typeof record["Ref"] === "string" && names.has(record["Ref"])) found.add(record["Ref"]);
+		const sub = record["Fn::Sub"];
+		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
+		if (typeof text === "string") for (const match of text.matchAll(/\$\{([^}!][^}]*)\}/g)) {
+			const name = match[1].trim();
+			if (names.has(name)) found.add(name);
+		}
 		for (const child of Object.values(record)) visit(child);
 	};
 	visit(node);
@@ -25231,6 +25623,62 @@ var JsonPatchGenerator = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/guardduty-detector-patch.ts
+const DETECTOR_TYPE = "AWS::GuardDuty::Detector";
+const READ_BACK_KEYS = ["Features", "DataSources"];
+function withGuardDutyDetectorReadBackOps(resourceType, patch, desired, readback) {
+	if (resourceType !== DETECTOR_TYPE || patch.length === 0) return patch;
+	let out = patch;
+	if (readback) {
+		out = patch.map((op) => op.path === "/Features" ? narrowToChangedFeatures(op, readback.previous["Features"]) : op);
+		if (out.some((op) => op.path === "/Features" && op.op !== "remove")) out = out.map((op) => op.path === "/DataSources" ? {
+			op: "remove",
+			path: "/DataSources"
+		} : op);
+	}
+	const extra = [];
+	for (const key of READ_BACK_KEYS) {
+		if (out.some((op) => op.path === `/${key}`)) continue;
+		if (readback) {
+			if (Object.prototype.hasOwnProperty.call(readback.previous, key)) extra.push({
+				op: "remove",
+				path: `/${key}`
+			});
+			continue;
+		}
+		extra.push(Object.prototype.hasOwnProperty.call(desired, key) ? {
+			op: "add",
+			path: `/${key}`,
+			value: desired[key]
+		} : {
+			op: "remove",
+			path: `/${key}`
+		});
+	}
+	return extra.length === 0 && out === patch ? patch : [...out, ...extra];
+}
+function narrowToChangedFeatures(op, current) {
+	if (!Array.isArray(op.value) || !Array.isArray(current)) return op;
+	const byName = /* @__PURE__ */ new Map();
+	for (const entry of current) byName.set(featureName(entry), entry);
+	const changed = [];
+	for (const entry of op.value) {
+		const name = featureName(entry);
+		if (name === void 0) return op;
+		if (!isDeepStrictEqual(entry, byName.get(name))) changed.push(entry);
+	}
+	if (changed.length === 0) throw markNonRetryable(/* @__PURE__ */ new Error("cannot revert Features: the live list differs from the recorded baseline only in the order of its entries or in entries GuardDuty added, which UpdateDetector cannot undo, so nothing on this detector was reverted. cdkd drift --accept would record the live list, but it records the live value of EVERY drifted property of the stack, not only Features: revert any other drift on this detector first (for example with aws guardduty update-detector), then run it."));
+	return {
+		...op,
+		value: changed
+	};
+}
+function featureName(entry) {
+	const name = entry?.["Name"];
+	return typeof name === "string" ? name : void 0;
+}
+
 //#endregion
 //#region src/provisioning/secret-reference-immutable.ts
 const IDENTITY = maskerOrIdentity(void 0);
@@ -26020,6 +26468,7 @@ var CloudControlProvider = class {
 					};
 				}
 			}
+			patch = withGuardDutyDetectorReadBackOps(resourceType, patch, cleanProperties, context?.desiredFromAwsReadback === true ? { previous: cleanPreviousProperties } : void 0);
 			this.logger.debug(`Generated ${patch.length} patch operations for ${logicalId}: ${JSON.stringify(patch.map((op) => {
 				const anyOp = op;
 				return {
@@ -26076,7 +26525,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-ebjf5E8o.js");
+			const { ASGProvider } = await import("./asg-provider-BS5i71bK.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -26182,7 +26631,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-Br3hPyHP.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CuJF3t-Q.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-DraxDuQq.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CqZ1FaqT.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -29344,6 +29793,24 @@ const NESTED_REQUIRED = /* @__PURE__ */ new Map([
 		["Resources", ["MinimumMemoryInMiB"]],
 		["Tags", ["Key"]]
 	])],
+	["AWS::Lambda::NetworkConnector", /* @__PURE__ */ new Map([
+		["Configuration", ["VpcEgressConfiguration"]],
+		["Configuration.VpcEgressConfiguration", [
+			"AssociatedComputeResourceTypes",
+			"NetworkProtocol",
+			"SecurityGroupIds",
+			"SubnetIds"
+		]],
+		["Tags", ["Key"]]
+	])],
+	["AWS::Lambda::WebFunctionEndpoint", /* @__PURE__ */ new Map([["RevisionWeights", ["RevisionId", "Weight"]]])],
+	["AWS::Lambda::WebFunctionRevision", /* @__PURE__ */ new Map([
+		["BuildConfig", ["CodeConfig", "RuntimeConfig"]],
+		["BuildConfig.CodeConfig", ["S3Object"]],
+		["BuildConfig.CodeConfig.S3Object", ["Bucket", "Key"]],
+		["BuildConfig.RuntimeConfig", ["Runtime"]],
+		["ServiceConfig", ["ExecutionRoleArn"]]
+	])],
 	["AWS::Logs::LogGroup", /* @__PURE__ */ new Map([["Tags", ["Key", "Value"]]])],
 	["AWS::Neptune::DBCluster", /* @__PURE__ */ new Map([
 		["AssociatedRoles", ["RoleArn"]],
@@ -30058,7 +30525,10 @@ const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::Lambda::Function", "{\"Architectures\":\"array\",\"CapacityProviderConfig\":\"object\",\"CapacityProviderConfig.LambdaManagedInstancesCapacityProviderConfig\":\"object\",\"Code\":\"object\",\"DeadLetterConfig\":\"object\",\"DurableConfig\":\"object\",\"Environment\":\"object\",\"Environment.Variables\":\"object\",\"EphemeralStorage\":\"object\",\"FileSystemConfigs\":\"array\",\"FileSystemConfigs[]\":\"object\",\"FileSystemConfigs[].S3FilesConfig\":\"object\",\"FunctionScalingConfig\":\"object\",\"ImageConfig\":\"object\",\"ImageConfig.Command\":\"array\",\"ImageConfig.EntryPoint\":\"array\",\"Layers\":\"array\",\"LoggingConfig\":\"object\",\"RuntimeManagementConfig\":\"object\",\"SnapStart\":\"object\",\"SnapStartResponse\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"TenancyConfig\":\"object\",\"TracingConfig\":\"object\",\"VpcConfig\":\"object\",\"VpcConfig.SecurityGroupIds\":\"array\",\"VpcConfig.SubnetIds\":\"array\"}"],
 	["AWS::Lambda::LayerVersion", "{\"CompatibleArchitectures\":\"array\",\"CompatibleRuntimes\":\"array\",\"Content\":\"object\"}"],
 	["AWS::Lambda::MicrovmImage", "{\"AdditionalOsCapabilities\":\"array\",\"CodeArtifact\":\"object\",\"CpuConfigurations\":\"array\",\"CpuConfigurations[]\":\"object\",\"EgressNetworkConnectors\":\"array\",\"EnvironmentVariables\":\"array\",\"EnvironmentVariables[]\":\"object\",\"Hooks\":\"object\",\"Hooks.MicrovmHooks\":\"object\",\"Hooks.MicrovmImageHooks\":\"object\",\"Logging\":\"object\",\"Logging.CloudWatch\":\"object\",\"Resources\":\"array\",\"Resources[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
+	["AWS::Lambda::NetworkConnector", "{\"Configuration\":\"object\",\"Configuration.VpcEgressConfiguration\":\"object\",\"Configuration.VpcEgressConfiguration.AssociatedComputeResourceTypes\":\"array\",\"Configuration.VpcEgressConfiguration.SecurityGroupIds\":\"array\",\"Configuration.VpcEgressConfiguration.SubnetIds\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::Lambda::Url", "{\"Cors\":\"object\",\"Cors.AllowHeaders\":\"array\",\"Cors.AllowMethods\":\"array\",\"Cors.AllowOrigins\":\"array\",\"Cors.ExposeHeaders\":\"array\"}"],
+	["AWS::Lambda::WebFunctionEndpoint", "{\"RegionalEndpoints\":\"object\",\"Regions\":\"array\",\"RevisionWeights\":\"array\",\"RevisionWeights[]\":\"object\",\"ScalingConfig\":\"object\",\"ThrottleConfig\":\"object\"}"],
+	["AWS::Lambda::WebFunctionRevision", "{\"BuildConfig\":\"object\",\"BuildConfig.CodeConfig\":\"object\",\"BuildConfig.CodeConfig.S3Object\":\"object\",\"BuildConfig.RuntimeConfig\":\"object\",\"ServiceConfig\":\"object\",\"ServiceConfig.EnvironmentVariables\":\"object\",\"ServiceConfig.TelemetryConfig\":\"object\",\"ServiceConfig.TelemetryConfig.LoggingConfig\":\"object\"}"],
 	["AWS::Logs::LogGroup", "{\"DataProtectionPolicy\":\"object\",\"FieldIndexPolicies\":\"array\",\"FieldIndexPolicies[]\":\"object\",\"ResourcePolicyDocument\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::Neptune::DBCluster", "{\"AssociatedRoles\":\"array\",\"AssociatedRoles[]\":\"object\",\"AvailabilityZones\":\"array\",\"EnableCloudwatchLogsExports\":\"array\",\"ServerlessScalingConfiguration\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"VpcSecurityGroupIds\":\"array\"}"],
 	["AWS::Neptune::DBInstance", "{\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
@@ -30220,6 +30690,24 @@ const STICKY_CC_MIGRATION_EXEMPT = /* @__PURE__ */ new Map([
 		issue: "https://github.com/go-to-k/cdkd/issues/2719",
 		integFixture: "cc-to-sdk-reroute"
 	}],
+	["AWS::Lambda::WebFunctionRevision", {
+		mode: "sdk-coverage",
+		physicalIdForm: "both layers store the revision ARN: the schema primaryIdentifier is RevisionArn and LambdaWebFunctionRevisionProvider.create records the CreateWebFunctionRevision revisionArn",
+		issue: "https://github.com/go-to-k/cdkd/issues/4926",
+		integFixture: "lambda-web-function-revision-replace"
+	}],
+	["AWS::Lambda::WebFunctionEndpoint", {
+		mode: "sdk-coverage",
+		physicalIdForm: "both layers store the endpoint ARN: the schema primaryIdentifier is EndpointArn and LambdaWebFunctionEndpointProvider.create records the CreateWebFunctionEndpoint endpointArn",
+		issue: "https://github.com/go-to-k/cdkd/issues/4926",
+		integFixture: "lambda-web-function-revision-replace"
+	}],
+	["AWS::Lambda::NetworkConnector", {
+		mode: "sdk-coverage",
+		physicalIdForm: "both layers store the connector ARN: the schema primaryIdentifier is Arn and LambdaNetworkConnectorProvider.create records the CreateNetworkConnector Arn",
+		issue: "https://github.com/go-to-k/cdkd/issues/4928",
+		integFixture: "lambda-network-connector"
+	}],
 	["AWS::ElasticLoadBalancingV2::Listener", {
 		mode: "sdk-coverage",
 		physicalIdForm: "both layers store the listener ARN: the schema primaryIdentifier is ListenerArn and ELBv2Provider.create records the CreateListener ListenerArn",
@@ -30620,6 +31108,58 @@ function recordedTagsUnreadableWarning(resourceType, id, applied) {
 	return safeMsg`The recorded Tags of ${resourceType} ${id} is not a list cdkd can read, so cdkd removed no tag and applied the ${applied} desired tag(s) only. Untag any key the template no longer names yourself.`;
 }
 
+//#endregion
+//#region src/provisioning/delete-started.ts
+const DELETE_STARTED = Symbol.for("cdkd.deleteStarted");
+const MAX_DEPTH = 10;
+function markDeleteStarted(error) {
+	try {
+		if (typeof error !== "object" || error === null || !Object.isExtensible(error)) return error;
+		Object.defineProperty(error, DELETE_STARTED, {
+			value: true,
+			enumerable: false,
+			writable: false,
+			configurable: true
+		});
+	} catch {}
+	return error;
+}
+function isDeleteStarted(error) {
+	try {
+		let current = error;
+		for (let depth = 0; depth < MAX_DEPTH && typeof current === "object" && current !== null; depth++) {
+			if (current[DELETE_STARTED] === true) return true;
+			current = current.cause;
+		}
+	} catch {}
+	return false;
+}
+const REFUSAL_NAMES = /* @__PURE__ */ new Set([
+	"AccessDenied",
+	"AccessDeniedException",
+	"UnauthorizedOperation",
+	"AuthorizationError",
+	"DependencyViolation",
+	"DeleteConflict",
+	"DeleteConflictException"
+]);
+function isRefusedByName(error) {
+	try {
+		let current = error;
+		for (let depth = 0; depth < MAX_DEPTH && current != null; depth++) {
+			if (typeof current !== "object") break;
+			const link = current;
+			for (const name of [
+				link.name,
+				link.Code,
+				link.code
+			]) if (typeof name === "string" && REFUSAL_NAMES.has(name)) return true;
+			current = link.cause;
+		}
+	} catch {}
+	return false;
+}
+
 //#endregion
 //#region src/provisioning/providers/idempotency-token.ts
 const PROCESS_NONCE = randomUUID();
@@ -32614,7 +33154,11 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 	};
 	const outputsPassSecrets = context.recordedSecretValues ?? EMPTY_SECRETS;
 	const outputsPassInherited = context.inheritedSecrets ?? EMPTY_SECRETS;
-	if (context.recordedSecretValues) this.outputsPassSecretMaps.push(context.recordedSecretValues);
+	if (context.recordedSecretValues) {
+		this.outputsPassSecretMaps.push(context.recordedSecretValues);
+		mirrorInheritedParameterReads(context.recordedSecretValues, this.outputSecrets);
+		if (this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0) inheritNestedStackParameterAssociations(this.outputSecrets, this.options.inheritedSecrets);
+	}
 	const publishedOutputNames = collectPublishedOutputNames(template.Outputs, conditions);
 	let outputsPassCompleted = false;
 	try {
@@ -34291,24 +34835,25 @@ async function replayDelete(s) {
 
 //#endregion
 //#region src/deployment/rollback-executor/replay-revert.ts
-async function replayReadopt(s) {
+async function replayReadopt(s, survivor) {
 	const { op, stateResources, stackName, ctx, result, inlinePolicyWriters, afterOp, logger, mask } = s;
+	const oldKind = survivor === void 0 ? "retained" : "surviving";
 	const current = stateResources[op.logicalId];
 	const prev = op.previousState;
 	const oldShown = hasAddressablePhysicalId({ physicalId: prev.physicalId }) ? displaySafe(mask(prev.physicalId)) : "no recorded id";
 	const unprovenCopyRefusal = (reason) => {
 		const remedy = orphanRemedy(op.logicalId, ctx);
-		return ownRemedyError(markNonRetryable(new CdkdError(safeMsg`Cannot reverse the replacement of ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}): ` + reason + ` The retained old resource (${oldShown}) is named only by the rollback journal, so the JOURNAL is kept. Check both resources by hand.` + (remedy.offered ? ` To leave this one as it is, re-run ${rerunRollbackPhrase(ctx, "`cdkd rollback`")} with the command below; that also drops the journal's only record of the retained old resource (${oldShown}), so note that id first.` : ` No repair of the state record makes this op succeed on a re-run.`) + remedy.clause + remedy.line, STATE_RESOURCES_MALFORMED)));
+		return ownRemedyError(markNonRetryable(new CdkdError(safeMsg`Cannot reverse the replacement of ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}): ` + reason + ` The ${oldKind} old resource (${oldShown}) is named only by the rollback journal, so the JOURNAL is kept. Check both resources by hand.` + (remedy.offered ? ` To leave this one as it is, re-run ${rerunRollbackPhrase(ctx, "`cdkd rollback`")} with the command below; that also drops the journal's only record of the ${oldKind} old resource (${oldShown}), so note that id first.` : ` No repair of the state record makes this op succeed on a re-run.`) + remedy.clause + remedy.line, STATE_RESOURCES_MALFORMED)));
 	};
 	const opIdUnusable = op.physicalId !== void 0 && !hasAddressablePhysicalId(op);
 	if (!rollbackRetainsNewResource(current) && rollbackCannotAddress(current, op.resourceType, current.provisionedBy ?? op.provisionedBy, current.physicalId)) {
 		if (opIdUnusable) throw unprovenCopyRefusal("neither its state record nor its rollback journal entry has a non-empty string 'physicalId' for the replacement's new resource, so cdkd cannot address that resource in AWS or tell which resource it is, and sent nothing.");
 		const target = op.physicalId === void 0 ? void 0 : refusalPhysicalId(mask(String(op.physicalId)));
-		const repair = target === void 0 ? `Repair the record's 'physicalId' to the id of the replacement's NEW resource (inspect it with \`cdkd state show\`): the journal does not record that id, and the re-run DELETES the resource the repaired record names as the new copy, so name the right one. Then re-run ${rerunRollbackPhrase(ctx, "`cdkd rollback`")}.` : `Repair the record's 'physicalId' to ${target}, the replacement's new resource the journal records (inspect it with \`cdkd state show\`); the re-run deletes it and re-adopts the old one. Any other id stops the revert and drops the journal's only record of the retained old resource (${oldShown}). Then re-run ${rerunRollbackPhrase(ctx, "`cdkd rollback`")}.` + (describedPhysicalIdPointer(target) !== "" ? " That id is left out of the prose above: it is not a plain identifier — read it from the rollback journal." : target.includes("***") ? ` That id is shown masked — read the full value from the rollback journal.` : "");
-		throw new CdkdError(safeMsg`Cannot reverse the replacement of ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}): ` + `its state record has no non-empty string 'physicalId', so cdkd cannot address the new resource in AWS to delete it, and sent nothing. The retained old resource (${oldShown}) is named only by the rollback journal, so the JOURNAL is kept. ` + repair, STATE_RESOURCES_MALFORMED);
+		const repair = target === void 0 ? `Repair the record's 'physicalId' to the id of the replacement's NEW resource (inspect it with \`cdkd state show\`): the journal does not record that id, and the re-run DELETES the resource the repaired record names as the new copy, so name the right one. Then re-run ${rerunRollbackPhrase(ctx, "`cdkd rollback`")}.` : `Repair the record's 'physicalId' to ${target}, the replacement's new resource the journal records (inspect it with \`cdkd state show\`); the re-run deletes it and re-adopts the old one. Any other id stops the revert and drops the journal's only record of the ${oldKind} old resource (${oldShown}). Then re-run ${rerunRollbackPhrase(ctx, "`cdkd rollback`")}.` + (describedPhysicalIdPointer(target) !== "" ? " That id is left out of the prose above: it is not a plain identifier — read it from the rollback journal." : target.includes("***") ? ` That id is shown masked — read the full value from the rollback journal.` : "");
+		throw new CdkdError(safeMsg`Cannot reverse the replacement of ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}): ` + `its state record has no non-empty string 'physicalId', so cdkd cannot address the new resource in AWS to delete it, and sent nothing. The ${oldKind} old resource (${oldShown}) is named only by the rollback journal, so the JOURNAL is kept. ` + repair, STATE_RESOURCES_MALFORMED);
 	}
 	if (!rollbackRetainsNewResource(current) && opIdUnusable && current.physicalId !== op.physicalId) throw unprovenCopyRefusal("its rollback journal entry has no non-empty string 'physicalId' for the replacement's new resource, so cdkd cannot tell whether the resource state records under this id is that one, and did not delete it; nothing was sent.");
-	logger.info(`  Rollback: Reversing replacement of ${safe(op.logicalId)} (${safe(op.resourceType)}) — deleting the new resource and re-adopting the retained old one (${displaySafe(mask(prev.physicalId))})`);
+	logger.info(`  Rollback: Reversing replacement of ${safe(op.logicalId)} (${safe(op.resourceType)}) — deleting the new resource and re-adopting the ${oldKind} old one (${displaySafe(mask(prev.physicalId))})`);
 	let survivorReason;
 	const survivorId = retainedSurvivorId(current, op);
 	if (rollbackRetainsNewResource(current)) {
@@ -34332,7 +34877,7 @@ async function replayReadopt(s) {
 			recordedNoEchoLeaves: current.noEchoLeaves,
 			maskSecrets: mask
 		}));
-		throwIfDeleteSkipped(readoptDelete, op.logicalId, current.physicalId, "while reversing its replacement (re-adopting the retained old resource)", {
+		throwIfDeleteSkipped(readoptDelete, op.logicalId, current.physicalId, `while reversing its replacement (re-adopting the ${oldKind} old resource)`, {
 			ctx,
 			stackName,
 			resourceType: op.resourceType,
@@ -34341,7 +34886,7 @@ async function replayReadopt(s) {
 		});
 	}
 	stateResources[op.logicalId] = prev;
-	logger.info(`  Rollback: ${safe(op.logicalId)} restored to the retained old resource`);
+	logger.info(`  Rollback: ${safe(op.logicalId)} restored to the ${oldKind} old resource`);
 	await afterOp?.(op.logicalId);
 	const survivorProvisionedBy = current.provisionedBy;
 	ctx.recordEvent?.({
@@ -34351,9 +34896,10 @@ async function replayReadopt(s) {
 		logicalId: op.logicalId,
 		resourceType: op.resourceType,
 		...op.provisionedBy && { provisionedBy: op.provisionedBy },
+		...survivorReason === void 0 && survivor !== void 0 && { reason: mask(survivor.reason) },
 		...survivorReason !== void 0 && {
 			...survivorId !== void 0 && { physicalId: survivorId },
-			reason: mask(survivorReason),
+			reason: mask(survivor === void 0 ? survivorReason : `${survivorReason}; ${survivor.reason}`),
 			...survivorProvisionedBy && { provisionedBy: survivorProvisionedBy }
 		}
 	});
@@ -34455,6 +35001,54 @@ async function replayRevert(s) {
 	});
 }
 
+//#endregion
+//#region src/deployment/rollback-executor/replaced-survivor.ts
+function replacedDeleteFailureVerdict(error) {
+	if (isDeleteStarted(error)) return "unconfirmed";
+	return isRefusedByName(error) ? "kept" : "unconfirmed";
+}
+const REPLACED_SURVIVOR_PROBE_TIMEOUT_MS = 3e4;
+const INTERRUPT_POLL_MS = 250;
+async function probeReplacedSurvivor(s, oldType, timeoutMs = REPLACED_SURVIVOR_PROBE_TIMEOUT_MS) {
+	if (s.isInterrupted?.() === true) return "interrupted";
+	let timer;
+	let poll;
+	const stopped = new Promise((resolve) => {
+		timer = setTimeout(() => resolve("unknown"), timeoutMs);
+		if (s.isInterrupted !== void 0) {
+			const interrupted = s.isInterrupted;
+			poll = setInterval(() => {
+				if (interrupted()) resolve("interrupted");
+			}, INTERRUPT_POLL_MS);
+		}
+	});
+	try {
+		return await Promise.race([readSurvivor(s, oldType), stopped]);
+	} finally {
+		clearTimeout(timer);
+		clearInterval(poll);
+	}
+}
+async function readSurvivor(s, oldType) {
+	const prev = s.op.previousState;
+	const physicalId = prev?.physicalId;
+	if (typeof physicalId !== "string" || physicalId === "") return "unknown";
+	try {
+		const { provider } = s.ctx.providerRegistry.getProviderFor({
+			resourceType: oldType,
+			provisionedBy: prev?.provisionedBy
+		});
+		if (typeof provider.readCurrentState !== "function") return "unreadable";
+		const read = await withReplayDeletePrinting(s, () => provider.readCurrentState(physicalId, s.op.logicalId, oldType, prev?.properties));
+		if (read === RESOURCE_NOT_FOUND) return "gone";
+		if (read === void 0) return "unreadable";
+		if (typeof read !== "object" || read === null || Array.isArray(read)) return "unknown";
+		return Object.keys(read).length > 0 ? "exists" : "unreadable";
+	} catch {
+		return "unknown";
+	}
+}
+
 //#endregion
 //#region src/deployment/rollback-executor/replay-reverse-replacement.ts
 async function replayReverseReplacement(s) {
@@ -34464,6 +35058,18 @@ async function replayReverseReplacement(s) {
 	const oldTypeRouting = resolveReplacementOldType(op);
 	if (!oldTypeRouting.ok) throw unroutableReplacementError(op, oldTypeRouting.reason, ctx);
 	const oldType = oldTypeRouting.oldType;
+	if (op.oldResourceMaySurvive !== void 0) {
+		const survivor = await probeReplacedSurvivor(s, oldType);
+		if (survivor === "exists" && op.oldResourceMaySurvive !== "kept") throw survivorUnprovenRefusal(s, oldType, "maybe-deleting");
+		if (survivor === "exists") {
+			const oldShown = refusalPhysicalId(mask(String(prev.physicalId)));
+			logger.warn(safeMsg`  ⚠ Rollback: the old resource of ${shownLogicalId(op.logicalId)} (${oldShown}) still ` + "exists — the deploy's delete of it was not confirmed — so it is re-adopted instead of re-created. Part of it may have been removed before that delete failed: check it " + safeMsg`with cdkd drift after the rollback.${describedPhysicalIdPointer(oldShown)}`);
+			result.warnings++;
+			return replayReadopt(s, { reason: "the old resource survived a delete that was refused or never sent during the deploy and was re-adopted instead of re-created; the provider may have run part of that delete, so check it with cdkd drift" });
+		}
+		if (survivor !== "gone") throw survivorUnprovenRefusal(s, oldType, survivor);
+		logger.info(safeMsg`  Rollback: the old resource of ${safe(op.logicalId)} (${mask(String(prev.physicalId))}) is gone — re-creating it`);
+	}
 	const typeChanged = oldType !== op.resourceType;
 	if (!requireRestorableBaseline(prev.properties, logger, {
 		logicalId: op.logicalId,
@@ -34713,6 +35319,15 @@ async function deleteMarkedRecreate(error, s) {
 	s.logger.warn(safeMsg`  Rollback: could not delete ${id}, which the failed re-create of ${shown} made before ` + safeMsg`failing (${s.mask(failure)}); no record holds it — delete it yourself`);
 	return false;
 }
+function survivorUnprovenRefusal(s, oldType, verdict) {
+	const { op, ctx, mask } = s;
+	const remedy = orphanRemedy(op.logicalId, ctx);
+	const oldId = op.previousState?.physicalId;
+	const oldShown = hasAddressablePhysicalId({ physicalId: oldId }) ? refusalPhysicalId(mask(String(oldId))) : "no recorded id";
+	const rerun = rerunRollbackPhrase(ctx, "cdkd rollback");
+	const why = verdict === "unreadable" ? "cdkd has no read for this resource type that can tell whether it does. Re-creating it could duplicate it or collide with it" : verdict === "interrupted" ? `the rollback was interrupted before cdkd could read whether it does; re-running ${rerun} reads it` : verdict === "unknown" ? `cdkd could not read whether it does (the read failed or did not answer in time); re-running ${rerun} reads it again. Re-creating it could duplicate it or collide with it` : `AWS still reports it, but its failed delete may have been accepted and still be running, or only partly ran. Re-adopting it could leave neither resource once a running delete finishes, or one that delete already stripped; once AWS reports it gone, re-running ${rerun} re-creates it. A refused delete is not running, so waiting does not help: if its delete was refused, delete it by hand, then re-run ${rerun}`;
+	return ownRemedyError(markNonRetryable(new CdkdError(`Cannot reverse the replacement of ${refusalLogicalId(op.logicalId)} (${refusalResourceType(oldType)}): the deploy did not confirm that it deleted the old resource (${oldShown}), so it may still exist, and ${why}. Nothing was sent and the journal is kept.` + (remedy.offered ? " To keep the new resource in its place instead, re-run with the command below, then delete the old resource by hand if it still exists." : "") + `${remedy.clause}${describedPhysicalIdPointer(oldShown)}` + remedy.line, "REPLACED_SURVIVOR_UNPROVEN")));
+}
 
 //#endregion
 //#region src/provisioning/remove-protection-types.ts
@@ -35760,7 +36375,7 @@ function displacedOpClause(op, marks, logger) {
 	const retainedOld = retainedOldPhysicalId(op);
 	if (retainedOld !== void 0 && marks.some((m) => isMarkFor(m, op))) {
 		const shownOld = displacedPhysicalIdShown(op, logger, retainedOld);
-		return `replaced ${shownOld} ${op.oldResourceRetained === true ? "but kept it (UpdateReplacePolicy: Retain)" : "and may have kept it (the journal records no verdict)"}; cdkd import adopted the replacement, so ${shownOld} is left untracked`;
+		return `replaced ${shownOld} ${op.oldResourceRetained === true ? "but kept it (UpdateReplacePolicy: Retain)" : op.oldResourceMaySurvive !== void 0 ? "and may have kept it (its delete was not confirmed)" : "and may have kept it (the journal records no verdict)"}; cdkd import adopted the replacement, so ${shownOld} is left untracked`;
 	}
 	const shownId = displacedPhysicalIdShown(op, logger);
 	return shownId !== void 0 ? `recorded ${shownId}, which cdkd import has since replaced under this id` : "recorded no physical id, and cdkd import has since put another resource under this id";
@@ -37454,6 +38069,7 @@ async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentReso
 	} catch (deleteError) {
 		const deleteMsg = maskSecretsInText(deleteError instanceof Error ? deleteError.message : String(deleteError), secrets);
 		deleteFailed = true;
+		this.replacedOldMaySurvive.set(logicalId, this.replacedOldMaySurvive.get(logicalId) === "unconfirmed" ? "unconfirmed" : replacedDeleteFailureVerdict(deleteError));
 		const deferred = this.deferredReplacedDeletes;
 		if (!isRetry && deferred !== void 0) {
 			this.logger.info(safeMsg`  Could not delete old ${logicalId} (${currentResource.physicalId}) yet: ${deleteMsg}. Retrying after the rest of the deploy.`);
@@ -37475,9 +38091,13 @@ async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentReso
 	});
 	const skipReason = deleteSkipReason(deleteResult);
 	if (skipReason !== void 0) {
+		this.replacedOldMaySurvive.set(logicalId, "unconfirmed");
 		this.replacedDeleteSkips.set(logicalId, `the replaced ${oldResourceType} (${currentResource.physicalId}) was not deleted (${skipReason}) and is no longer tracked by cdkd`);
 		this.logger.warn(safeMsg`  ⚠ ${deleteSkippedMessage(logicalId, currentResource.physicalId, skipReason, "while cleaning up the replaced resource", { commandFreeLine: true })}. Delete it manually — it is no longer tracked in state.`);
-	} else if (!deleteFailed) this.logger.info(isRetry ? safeMsg`  ${green("✓")} Old ${logicalId} (${currentResource.physicalId}) deleted` : safeMsg`  ${green("✓")} Old resource deleted`);
+	} else if (!deleteFailed) {
+		if (isRetry) this.replacedOldMaySurvive.delete(logicalId);
+		this.logger.info(isRetry ? safeMsg`  ${green("✓")} Old ${logicalId} (${currentResource.physicalId}) deleted` : safeMsg`  ${green("✓")} Old resource deleted`);
+	}
 }
 async function retryDeferredReplacedDeletes(stackName, counts) {
 	const deferred = this.deferredReplacedDeletes;
@@ -37619,6 +38239,19 @@ function isHealEligible(logicalId, resource) {
 	const loaded = Object.hasOwn(this.healBaseline, logicalId) ? this.healBaseline[logicalId] : void 0;
 	return loaded !== void 0 && loaded.physicalId === resource.physicalId && loaded.attributes === resource.attributes && !isHealExcludedType(resource.resourceType);
 }
+const healJudges = /* @__PURE__ */ new WeakMap();
+function healPrintingBag(baseline, logicalId, resource) {
+	if (!Object.hasOwn(baseline, logicalId) || baseline[logicalId] !== resource) return secretNamePrintingBag(logicalId, {
+		...baseline,
+		[logicalId]: resource
+	});
+	let judge = healJudges.get(baseline);
+	if (judge === void 0) {
+		judge = secretNamePrintingBags(baseline, void 0);
+		healJudges.set(baseline, judge);
+	}
+	return judge(logicalId);
+}
 async function readStaleAttributes(logicalId, resource, stackName) {
 	const { provider } = this.providerRegistry.getProviderFor({
 		resourceType: resource.resourceType,
@@ -37626,13 +38259,13 @@ async function readStaleAttributes(logicalId, resource, stackName) {
 		provisionedBy: resource.provisionedBy,
 		previousProperties: resource.properties
 	});
-	const outcome = await readRecordAttributes({
+	const outcome = await withPrintingSecrets(healPrintingBag(this.healBaseline, logicalId, resource), () => readRecordAttributes({
 		provider,
 		logicalId,
 		resource,
 		stackName,
 		region: this.stackRegion
-	});
+	}));
 	if (outcome.kind !== "read") return outcome;
 	const { attributes } = outcome;
 	if (Object.keys(attributes).length > 0) this.healedAttributes.set(logicalId, {
@@ -39203,7 +39836,7 @@ var DynamoDBGlobalTableProvider = class {
 			this.logger.debug(maskSecrets(`Added/updated ${tagsToAdd.length} tag(s) on DynamoDB GlobalTable ${tableArn}`));
 		}
 	}
-	async applyAutoScalingDiff(tableName, dimension, oldSettings, newSettings, client, indexName, budget, maskSecrets = (text) => text) {
+	async applyAutoScalingDiff(tableName, dimension, oldSettings, newSettings, client, indexName, budget, maskSecrets = (text) => text, progress) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const asMaxRetries = autoScalingRetriesWithinDeleteBudget(budget, 8);
 		const metricType = dimension.endsWith("WriteCapacityUnits") ? "DynamoDBWriteCapacityUtilization" : "DynamoDBReadCapacityUtilization";
@@ -39303,8 +39936,10 @@ var DynamoDBGlobalTableProvider = class {
 					onInterrupted: watch.onInterrupted,
 					...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
 				});
+				if (progress) progress.stripped = true;
 			} catch (err) {
 				if (isInterruptedWaitError(err)) throw err;
+				if (progress && !isObjectNotFound(err) && !isRefusedByName(err)) progress.stripped = true;
 				if (!isObjectNotFound(err)) warn(`Could not delete auto-scaling policy on ${tableName} (${dimension}): ${describeAwsFailure(err).detail}. Run: ${pasteableAwsCommand(maskSecrets)`aws application-autoscaling delete-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`.render()}`);
 			}
 			try {
@@ -39319,9 +39954,11 @@ var DynamoDBGlobalTableProvider = class {
 					onInterrupted: watch.onInterrupted,
 					...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
 				});
+				if (progress) progress.stripped = true;
 				this.logger.debug(maskSecrets(`Deregistered auto-scaling target ${resourceId} (${dimension})`));
 			} catch (err) {
 				if (isInterruptedWaitError(err)) throw err;
+				if (progress && !isObjectNotFound(err) && !isRefusedByName(err)) progress.stripped = true;
 				if (!isObjectNotFound(err)) warn(`Could not deregister auto-scaling target on ${tableName} (${dimension}): ${describeAwsFailure(err).detail}. Run: ${pasteableAwsCommand(maskSecrets)`aws application-autoscaling deregister-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`.render()}`);
 			}
 		} finally {
@@ -39409,9 +40046,11 @@ var DynamoDBGlobalTableProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		const flip = this.protectionFlips.acquire(deleteBudgetKey(physicalId, context?.expectedRegion), DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, resolveDynamoDbDeleteBudgetClock());
+		const progress = { stripped: false };
 		try {
-			await this.deleteGlobalTableResource(logicalId, physicalId, resourceType, context, flip);
+			await this.deleteGlobalTableResource(logicalId, physicalId, resourceType, context, flip, progress);
 		} catch (error) {
+			if (progress.stripped) markDeleteStarted(error);
 			let outcome = "failed";
 			try {
 				outcome = await compensateRemovedDeletionProtection({
@@ -39434,7 +40073,7 @@ var DynamoDBGlobalTableProvider = class {
 			throw error;
 		}
 	}
-	async deleteGlobalTableResource(logicalId, physicalId, resourceType, context, flip) {
+	async deleteGlobalTableResource(logicalId, physicalId, resourceType, context, flip, progress) {
 		const deleteMask = context?.maskSecrets ?? ((text) => text);
 		const shownTable = deleteMask(physicalId);
 		this.logger.debug(deleteMask(`Deleting DynamoDB GlobalTable ${logicalId}: ${shownTable}`));
@@ -39477,23 +40116,24 @@ var DynamoDBGlobalTableProvider = class {
 				const region = replica.RegionName;
 				if (!region || region === currentRegion) continue;
 				try {
-					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", {}, void 0, this.getRegionalAutoScalingClient(region), void 0, budget);
-					for (const indexName of tableIndexNames) await this.applyAutoScalingDiff(physicalId, "dynamodb:index:ReadCapacityUnits", {}, void 0, this.getRegionalAutoScalingClient(region), indexName, budget);
+					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", {}, void 0, this.getRegionalAutoScalingClient(region), void 0, budget, void 0, progress);
+					for (const indexName of tableIndexNames) await this.applyAutoScalingDiff(physicalId, "dynamodb:index:ReadCapacityUnits", {}, void 0, this.getRegionalAutoScalingClient(region), indexName, budget, void 0, progress);
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
 						ReplicaUpdates: [{ Delete: { RegionName: region } }]
 					}));
+					progress.stripped = true;
 					await this.waitForReplicaGone(physicalId, region, logicalId, REPLICA_GONE_WAIT_ATTEMPTS, budget, context?.maskSecrets);
 				} catch (replicaErr) {
 					if (!(replicaErr instanceof ResourceNotFoundException$1)) throw replicaErr;
 				}
 			}
 			const localAsClient = await this.getLocalAutoScalingClient();
-			await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", {}, void 0, localAsClient, void 0, budget);
-			await this.applyAutoScalingDiff(physicalId, "dynamodb:table:WriteCapacityUnits", {}, void 0, localAsClient, void 0, budget);
+			await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", {}, void 0, localAsClient, void 0, budget, void 0, progress);
+			await this.applyAutoScalingDiff(physicalId, "dynamodb:table:WriteCapacityUnits", {}, void 0, localAsClient, void 0, budget, void 0, progress);
 			for (const indexName of tableIndexNames) {
-				await this.applyAutoScalingDiff(physicalId, "dynamodb:index:WriteCapacityUnits", {}, void 0, localAsClient, indexName, budget);
-				await this.applyAutoScalingDiff(physicalId, "dynamodb:index:ReadCapacityUnits", {}, void 0, localAsClient, indexName, budget);
+				await this.applyAutoScalingDiff(physicalId, "dynamodb:index:WriteCapacityUnits", {}, void 0, localAsClient, indexName, budget, void 0, progress);
+				await this.applyAutoScalingDiff(physicalId, "dynamodb:index:ReadCapacityUnits", {}, void 0, localAsClient, indexName, budget, void 0, progress);
 			}
 		} catch (describeErr) {
 			if (describeErr instanceof ProvisioningError) throw describeErr;
@@ -42695,7 +43335,7 @@ const REMEDY = "To move a custom resource to a different handler, give it a new
 const UNJUDGEABLE_REMEDY = `Where the recorded ServiceToken is unreadable and the handler did not change, put the ARN of the handler that created this resource (the one it was last deployed with, not the one the template names now) back as ServiceToken in state.json (a ServiceToken fed by a NoEcho parameter is recorded only as '${"***"}': feed it from a plain value) and re-deploy.`;
 function renderServiceTokenRefusal(refusals, stackName, mask = (text) => text) {
 	const rows = refusals.map((refusal) => `  - ${rowText(refusal, mask)}`);
-	return `Refusing to deploy ${stackName}: ` + (refusals.length === 1 ? `a custom resource's ServiceToken changes` : `${refusals.length} custom resources' ServiceTokens change`) + `, which CloudFormation does not allow ("Modifying service token is not allowed"). Nothing was sent to either handler.
+	return safeMsg`Refusing to deploy ${displayStackName(stackName)}: ` + (refusals.length === 1 ? `a custom resource's ServiceToken changes` : `${refusals.length} custom resources' ServiceTokens change`) + `, which CloudFormation does not allow ("Modifying service token is not allowed"). Nothing was sent to either handler.
 ${rows.join("\n")}\n  ${REMEDY}` + (refusals.some((refusal) => refusal.kind === "unjudgeable") ? `\n  ${UNJUDGEABLE_REMEDY}` : "");
 }
 function serviceTokenBlockingReason(refusal, mask) {
@@ -42741,7 +43381,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	const existingState = stateResources[logicalId];
 	const renderer = getLiveRenderer();
 	const currentResource = existingState;
-	if (!currentResource) throw new Error(`Cannot update ${logicalId}: resource not found in state`);
+	if (!currentResource) throw new Error(safeMsg`Cannot update ${logicalId}: resource not found in state`);
 	const oldResourceType = currentResource.resourceType;
 	const typeChanged = oldResourceType !== resourceType;
 	const desiredProps = change.desiredProperties || {};
@@ -42984,7 +43624,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 			applyAttributeOnlyUpdate(change.attributeChanges);
 			return;
 		}
-		this.logger.debug(`Skipping ${logicalId}: no actual changes after intrinsic function resolution`);
+		this.logger.debug(safeMsg`Skipping ${logicalId}: no actual changes after intrinsic function resolution`);
 		if (counts) counts.skipped++;
 		return;
 	}
@@ -43249,7 +43889,7 @@ function unwrittenCreateOnlyRefusal(input) {
 	const keep = [.../* @__PURE__ */ new Set([...unwritten, ...routeDriving])].sort((a, b) => a.localeCompare(b)).map((property) => `${resourceType}:${property}`).join(",");
 	const replaceFlags = nested ? "--replace (which creates the new resource before deleting the old one, so a resource holding a unique value other than its name, such as a CIDR block, collides)" : `--recreate-via-cc-api ${logicalId}, which deletes the old resource first (--replace also works, but creates the new one first, so a resource holding a unique value other than its name, such as a CIDR block, collides)`;
 	const routed = [...routeDriving].sort((a, b) => a.localeCompare(b)).join(", ");
-	return `${logicalId} (${resourceType}): ${list} ${one ? "is" : "are"} create-only, and the state record holds ${one ? "it" : "them"} although this type's SDK provider never writes ${one ? "it" : "them"}, so AWS does not. This deploy routes the resource through Cloud Control (--prefer-sdk-route does not cover ${routed}), and applying a create-only property means replacing the resource, which cdkd does not do on its own. This resource was not changed. To replace it and apply ${list}, re-run with ${replaceFlags}; a stateful resource also needs --force-stateful-recreation.` + (protectionEvidence !== void 0 ? ` ${recordedProtectionNote(protectionEvidence, nested ? "--replace" : `--recreate-via-cc-api ${logicalId} or --replace`)}` : "") + ` To keep dropping ${one ? "it" : "them"}, re-run with --prefer-sdk-route ${keep}.`;
+	return safeMsg`${logicalId} (${resourceType}): ${list} ${one ? "is" : "are"} create-only, and the ` + `state record holds ${one ? "it" : "them"} although this type's SDK provider never writes ${one ? "it" : "them"}, so AWS does not. This deploy routes the resource through ` + safeMsg`Cloud Control (--prefer-sdk-route does not cover ${routed}), and applying a create-only ` + `property means replacing the resource, which cdkd does not do on its own. This ` + safeMsg`resource was not changed. To replace it and apply ${list}, re-run with ${replaceFlags}; a ` + `stateful resource also needs --force-stateful-recreation.` + (protectionEvidence !== void 0 ? safeMsg` ${recordedProtectionNote(protectionEvidence, nested ? "--replace" : `--recreate-via-cc-api ${logicalId} or --replace`)}` : "") + safeMsg` To keep dropping ${one ? "it" : "them"}, re-run with --prefer-sdk-route ${keep}.`;
 }
 function scalarLeavesOf(value, into = /* @__PURE__ */ new Set()) {
 	if (typeof value === "string") into.add(value);
@@ -43494,6 +44134,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			} catch (snapshotError) {
 				if (snapshotError instanceof CdkdError && snapshotError.code === "FINAL_SNAPSHOT_UNSUPPORTED") throw snapshotError;
 				snapshotBlockedDelete = true;
+				this.replacedOldMaySurvive.set(logicalId, "kept");
 				this.logger.warn(safeMsg`  ⚠ Final snapshot for old ${logicalId} (${currentResource.physicalId}) ` + safeMsg`failed: ${asIsMessage(snapshotError instanceof Error ? snapshotError.message : String(snapshotError))}. ` + "The old resource was NOT deleted (UpdateReplacePolicy: Snapshot) — delete it manually once you have a snapshot; it is no longer tracked in state.");
 			}
 			if (!snapshotBlockedDelete) await this.deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, oldDeleteProvider, currentResource.properties, cleanupFinalSnapshotId, updateReplacePolicy, updateSecrets, oldDeleteRoute.provisionedBy, noEchoDeleteValues);
@@ -43604,6 +44245,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 			...removal.context
 		})), logicalId, void 0, void 0, updateProvider);
 		if (result.sentNothing === true) this.updatesThatSentNothing.add(logicalId);
+		if (result.wasReplaced === true && result.outcome === "partial") this.replacedOldMaySurvive.set(logicalId, result.oldResourceSurvivor === "kept" ? "kept" : "unconfirmed");
 		result = withoutInjectedRemovals(result, removal.injected);
 		if (removal.unhandled.length > 0) this.logger.warn(removalWarning(logicalId, resourceType, removal.unhandled));
 	} catch (updateError) {
@@ -44566,6 +45208,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 						oldResourceRetained: this.retainedOldOnReplacement.has(logicalId),
 						oldDeletedBeforeCreate: this.oldDeletedBeforeCreate.has(logicalId)
 					},
+					...change.changeType === "UPDATE" && this.replacedOldMaySurvive.has(logicalId) && { oldResourceMaySurvive: this.replacedOldMaySurvive.get(logicalId) },
 					...change.changeType === "UPDATE" && this.updateWasReplaced.has(logicalId) && { wasReplaced: this.updateWasReplaced.get(logicalId) },
 					...change.changeType === "UPDATE" && previousState !== void 0 && { previousResourceType: previousState.resourceType }
 				});
@@ -44626,7 +45269,16 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			if (this.interrupted && this.hasPending(deleteExecutor)) throw new InterruptedError(this.interruptCause ?? "user");
 		}
 		if (this.interrupted) this.warnUnretriedReplacedDeletes("interrupted");
-		else await this.retryDeferredReplacedDeletes(stackName, actualCounts);
+		else try {
+			await this.retryDeferredReplacedDeletes(stackName, actualCounts);
+		} finally {
+			for (const op of completedOperations) {
+				if (op.changeType !== "UPDATE") continue;
+				const verdict = this.replacedOldMaySurvive.get(op.logicalId);
+				if (verdict !== void 0) op.oldResourceMaySurvive = verdict;
+				else delete op.oldResourceMaySurvive;
+			}
+		}
 	} catch (error) {
 		this.warnUnretriedReplacedDeletes(this.interruptCause === "user" ? "interrupted" : "failed");
 		const initialDeploy = currentEtag === void 0;
@@ -46848,6 +47500,7 @@ var DeployEngine = class {
 	generatedNameGuard;
 	liveTaskLabels = /* @__PURE__ */ new Map();
 	retainedOldOnReplacement = /* @__PURE__ */ new Set();
+	replacedOldMaySurvive = /* @__PURE__ */ new Map();
 	recreatedUnderSameId = /* @__PURE__ */ new Set();
 	restoredLostChildren = /* @__PURE__ */ new Set();
 	updatesThatSentNothing = /* @__PURE__ */ new Set();
@@ -46924,6 +47577,7 @@ var DeployEngine = class {
 		this.outputsSourceUsable = true;
 		this.skippedOutputs = void 0;
 		this.retainedOldOnReplacement = /* @__PURE__ */ new Set();
+		this.replacedOldMaySurvive = /* @__PURE__ */ new Map();
 		this.recreatedUnderSameId = /* @__PURE__ */ new Set();
 		this.restoredLostChildren = /* @__PURE__ */ new Set();
 		this.updatesThatSentNothing = /* @__PURE__ */ new Set();
@@ -47196,5 +47850,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { S3_AUTO_DELETE_OBJECTS_TAG as $, unwrittenCreateOnlyReplacement as $a, getLegacyStateBucketName as $c, malformedExportSourceWarning as $i, formatDestructiveChange as $n, recordLogOnlyParameterValue as $o, explicitRoleArnOrThrow as $r, hasReadableExportSet as $s, replacementNeverSwapped as $t, diffSecurity as A, refuseMalformedResourceEntriesForImport as Aa, describeDockerExecFailure as Ac, cfnRefValueFromPhysicalId as Ai, absoluteAssemblyPathEscape as Al, DEFAULT_RESOURCE_WARN_AFTER_MS as An, sameLambdaFunctionAddress as Ao, RollbackInlinePolicyWriters as Ar, recordNoEchoParameterFreshValue as As, withNestedStackContext as At, readProtection as B, refuseMalformedState as Ba, redactedCause as Bc, STATE_RESOURCES_MALFORMED as Bi, extractDeploymentEventError as Bn, noEchoLeavesOf as Bo, isTerminationProtectionPropagationError as Br, isLockInfoExpired as Bs, awaitInFlightSibling as Bt, withApiLimit as C, refuseMalformedOrphansForOrphan as Ca, readBootstrapMarkerBody as Cc, getAccountInfo as Ci, StageLoadError as Cl, isWholeDynamicReferenceValue as Cn, requireConfigString as Co, withPrintingSecrets as Cr, recordPhysicalNameCopy as Cs, nestedChildStackName as Ct, findServiceTokenRefusals as D, refuseMalformedResourceEntries as Da, buildDockerImage as Dc, isNamelessDynamicReferenceError as Di, hasPlainPrototype$1 as Dl, isExportAliasCollision as Dn, withRetry as Do, CloudControlProvider as Dr, recordMaskOnlyValue as Ds, withNestedRevertRun as Dt, deferredServiceTokenWarning as E, refuseMalformedResourceAttributesForOrphan as Ea, buildDenyExternalAccessPolicy as Ec, carriesFetchableDynamicReference as Ei, hasOwnKey as El, collectPublishedOutputNames as En, describeTypeWithThrottleRetry as Eo, customResourceResponseExpirationWarning as Er, provenPublicValue as Es, revertedNestedRowIds as Et, recordedProtectionEvidence as F, refuseMalformedResourcePropertiesForExport as Fa, getDockerCmd as Fc, parameterInputsFor as Fi, injectAwsRegion as Fl, secretNamePrintingBag as Fn, maskAtCoordinates as Fo, withIndeterminateGuard as Fr, STATE_SOURCED_READBACK_RULES as Fs, loadJournaledOrphans as Ft, deleteBudgetKey as G, repairMalformedResourcePropertiesForReadOnly as Ga, escapeRegExp$3 as Gc, displayLogicalId as Gi, createPreDeleteFinalSnapshot as Gn, valueAtCoordinate as Go, INTRINSIC_KEYS as Gr, applyCrossPrefixScan as Gs, recordAfterRollbackUpdate as Gt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as H, repairMalformedOrphansForReadOnly as Ha, runDockerForeground as Hc, UNREADABLE_RESOURCES_MAP_ROW as Hi, PRE_DELETE_SNAPSHOT_TYPES as Hn, passedNoEchoParametersOf as Ho, reDisableInstanceApiTermination as Hr, rebuildClientForBucketRegion as Hs, getStackRecords as Ht, recordedProtectionNote as I, refuseMalformedResourcePropertiesForOrphan as Ia, isDockerClientEnvKey as Ic, passedParameterClassesOf as Ii, injectedAwsRegionValue as Il, secretNamePrintingBags as In, maskReadbackAtCoordinates as Io, isWaitAbandonedError as Ir, TEMPLATE_SOURCED_RULES as Is, makeForeignHolderScan as It, DELETE_INDEX_WAIT_PROCEED_NOTE as J, unreadableOrphanRecords as Ja, AssetManifestLoader as Jc, hasReadableResources as Ji, refusesFinalSnapshot as Jn, createUnionSecretMasker as Jo, producerLookupOver as Jr, isNotImplemented as Js, isReplacementOrphan as Jt, resolveDynamoDbDeleteBudgetClock as K, repairMalformedResourcesForReadOnly as Ka, stripControlChars as Kc, hasReadableOrphans as Ki, effectiveDeletionPolicy as Kn, liveMatchesUnresolvedTokenFrame as Ko, IntrinsicFunctionResolver as Kr, crossPrefixDeniedWarning as Ks, demoteSupersededOrphans as Kt, PROTECTION_PROPERTY_BY_TYPE as L, refuseMalformedResourcesForDeploy as La, isMalformedEnvKey as Lc, declaresNoEcho as Li, clearBucketRegionCache as Ll, secretNamedRecordNeedles as Ln, maskWholeValue as Lo, markWaitAbandoned as Lr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ls, sameJournaledOrphans as Lt, noEchoComparisonForTemplate as M, refuseMalformedResourceEntriesForOrphan as Ma, dockerSpawnEnvWithSensitive as Mc, refStateLookupFromResource as Mi, displayAssemblyPath as Ml, journaledOrphanPrintingBag as Mn, TemplateParser as Mo, deleteIndeterminateGuards as Mr, wholeStringLeavesOf as Ms, dropFailedHint as Mt, noEchoExactEchoLeavesOf as N, refuseMalformedResourcePropertiesForDestroy as Na, finchSecretArgvRefusal as Nc, parseWebACLArn as Ni, renderAssemblyPathEscape as Nl, maskEventTextWithBoundBags as Nn, canonicalCoordinates as No, deleteLeftInPlace as Nr, STATE_SOURCED_BASELINE_RULES as Ns, isHandledOrphan as Nt, serviceTokenBlockingReason as O, refuseMalformedResourceEntriesForDeploy as Oa, resolveDockerContextDirectory as Oc, keepsSecretReferenceToken as Oi, nullPrototypeRecord as Ol, bindingSkippedOutputs as On, canonicalLambdaFunctionName as Oo, slowCcOperationTimeoutMs as Or, recordMaskOnlyValuesIn as Os, collectNestedChildUnaddressed as Ot, noEchoParameterNamesOf as P, refuseMalformedResourcePropertiesForDrift as Pa, formatDockerLoginError as Pc, withSharedDrainBudget as Pi, resolveAssemblyPath as Pl, orphanRecordsPrintingBag as Pn, isMarkedCoordinate as Po, deleteSkipReason as Pr, STATE_SOURCED_CROSS_GENERATION_RULES as Ps, journaledOrphanLines as Pt, ECR_AUTO_DELETE_IMAGES_TAG as Q, findSilentDropProperties as Qa, getDefaultStateBucketName as Qc, malformedExportNamesWarning as Qi, findDestructiveChanges as Qn, printingCorpusOf as Qo, assertSendableRoleArn as Qr, exportNamesCarriedFrom as Qs, recordUnderIdIsNotOwn as Qt, isProtectionValueActive as R, refuseMalformedResourcesForDestroy as Ra, partitionSensitiveEnv as Rc, JSON_LISTING_HOLE_VALUE as Ri, resolveBucketRegion as Rl, stateSecretNameNeedles as Rn, maskedLeafCoordinatesOf as Ro, disableInstanceApiTermination as Rr, isSingleDynamicReferenceToken as Rs, replayFailedOperations as Rt, lookupEachName as S, refuseMalformedOrphansForDestroy as Sa, parseBootstrapMarker as Sc, parameterTypeMayLoseSecretIdentity as Si, AssemblyReader as Sl, exportNameSecretExposure as Sn, requireConfigObject as So, getCurrentResourceSecrets as Sr, recordAttributeIdCopy as Ss, getNestedRevertRun as St, recordRetainedForReadoption as T, refuseMalformedOutputsForDestroy as Ta, validateContainerRepoName as Tc, carriesDynamicReference as Ti, defineOwnKey as Tl, collectDeclaredOutputNames as Tn, templateResourceTypes as To, applyCustomResourceResponseExpiration as Tr, carriesSecretMask as Ts, revertNestedChildFromJournal as Tt, beginDeleteWait as U, repairMalformedOutputsForReadOnly as Ua, runDockerStreaming as Uc, accountArgs as Ui, buildFinalSnapshotIdentifier as Un, readbackPathFor as Uo, reEnableInstanceApiTermination as Ur, CrossPrefixReadError as Us, withStackRecords as Ut, DynamoDBGlobalTableProvider as V, repairMalformedOrphanRecordsForReadOnly as Va, redactedDockerCause as Vc, UNREADABLE_ORPHANS_CONTAINER_ROW as Vi, ATOMIC_FINAL_SNAPSHOT_TYPES as Vn, noEchoOutputsComparison as Vo, observeThenDisableInstanceApiTermination as Vr, S3StateBackend as Vs, destroyStackRecordsView as Vt, compensateRemovedDeletionProtection as W, repairMalformedResourceEntriesForReadOnly as Wa, warnFinchArgvExposure as Wc, deployRefusesOrphanRowsReason as Wi, ccRoutedFinalSnapshotError as Wn, readsNoEchoSource as Wo, DiffCalculator as Wr, CrossPrefixScanCache as Ws, removeProtectionTypeList as Wt, deleteTableWithIndexBusyRetry as X, withheldAccountClause as Xa, Synthesizer as Xc, isReadableResourceEntry as Xi, maskingRetryLogger as Xn, literalSplitDelimitersOf as Xo, applyRoleArnIfSet as Xr, acceptedCreateOnlyDropsOf as Xs, planRollback as Xt, INDEX_SETTLE_POLL_INTERVAL_MS as Y, unreadableResourceEntries as Ya, getDockerImageBySourceHash as Yc, isReadableOrphanRecord as Yi, unsupportedFinalSnapshotError as Yn, hasMaskableValues as Yo, refuseUnreadableCdkCrossAccountRefs as Yr, splitImportedOps as Ys, planFailedOps as Yt, waitForIndexesSettled as Z, findActionableSilentDrops as Za, synthesisStatusMessage as Zc, malformedDriftResourcePropertiesWarning as Zi, constructPathOf as Zn, logOnlyValueCount as Zo, assertFlagRoleArn as Zr, describeRegionValueKind as Zs, recheckFailedPlan as Zt, keptWholeReasonText as _, refuseDivergentRecordRegionForDestroy as _a, BOOTSTRAP_MARKER_PREFIX as _c, classifyReplaySecretRegion as _i, decodeListingKey as _l, secretBearing as _n, configIntegerRefusal as _o, isCustomResource as _r, identityKeyFor as _s, planOrphanAdoption as _t, inheritedProvenanceForChildDiff as a, malformedOrphanRowsKeptWarning as aa, orphansAfterRollback as ac, envCredentialsAreAssumedRole as ai, resolveStateBucketWithDefault as al, inheritProducerRegions as an, MULTI_REGION_RECREATE_BLOCKED_TYPES as ao, DBPROXY_TAGS_WHAT as ar, maskSecretsInText as as, createReadOnlyAttributeHealerFactory as at, chunks as b, refuseMalformedOrphanRecordsForDestroy as ba, getBootstrapMarkerKey as bc, coerceParameterTypedValue as bi, canonicalizeRegion as bl, carriedExportAliasExposure as bn, replayWarn as bo, readsNoEchoDeleteValues as br, recoverMaskedOutput as bs, displacedPhysicalIdShown as bt, isAbsoluteAssetPath as c, malformedOutputsRefusalMessage as ca, AssetPublisher as cc, outputReferenceProvenanceOf as ci, stateBucketExistenceConfirmed as cl, redactedDeleteAddressFields as cn, renderStatefulReason as co, readTagList as cr, snapshotPassProvenance as cs, gray as ct, templateIdentity as d, malformedResourceEntriesWarning as da, WorkGraph as dc, s3BucketArn as di, CFN_TEMPLATE_BODY_LIMIT as dl, updatePartialReason as dn, isWarmThroughputDecrease as do, tagPlanWarning as dr, withPhysicalNameCopies as ds, yellow as dt, malformedLocalOutputsWarning as ea, hasReasonlessBaselineRefusal as ec, isIamRoleArn as ei, loadCdkJson as el, resolveReplacementOldType as en, withoutSilentDropProperties as eo, earliestDefined as er, recordLogOnlyValue as es, hasCdkAutoDeleteTag as et, conditionFingerprint as f, malformedResourcePropertiesWarning as fa, buildAssetRedirectMap as fc, s3BucketDomainName as fi, CFN_TEMPLATE_URL_LIMIT as fl, DeploymentEventsReader as fn, toCfnInteger as fo, definedAttributes as fr, withoutPhysicalNameCopies as fs, computeParameterTaint as ft, isSecretBearingReferenceString as g, previewableOrphanRecords as ga, AssetModeResolver as gc, classifyRecordedSecretRegion as gi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as gl, exportAliasCollisionScrubWarning as gn, configBooleanRefusal as go, ccBrokenReason as gr, pathCrossesDottedKey as gs, makeSiblingClaimReader as gt, readRecordedConditionVerdicts as h, malformedStateRefusalMessage as ha, rewriteTemplateAssetReferences as hc, s3BucketWebsiteUrl as hi, uploadCfnTemplate as hl, displayTextOrWithheld as hn, coerceCfnInteger as ho, ProviderRegistry as hr, isUncertifiedBaselineMaskPosition as hs, resourcesNamingDeclaredParameter as ht, crossStackOutputProvenanceSource as i, malformedOrphanRecordsWarning as ia, isReadableBag as ic, callerEnvCredentials as ii, resolveSkipPrefix as il, getCurrentProducerRegions as in, shownType as io, acquireIdempotencyToken as ir, maskSecretsInError as is, formatResourceLine as it, noEchoAttributeNamesOf as j, refuseMalformedResourceEntriesForImportSave as ja, describeDockerFailure as jc, isStalePlaceholderArnAttribute as ji, describeFileReadFailure as jl, completedReplayEntries as jn, DagBuilder as jo, UNSPECIFIED_SKIP_REASON as jr, recordProvenPublicExpression as js, deleteJournaledOrphans as jt, withResourceDeadline as k, refuseMalformedResourceEntriesForDestroy as ka, describeDockerCapturedOutput as kc, AWS_NO_VALUE as ki, ownValue as kl, DEFAULT_RESOURCE_TIMEOUT_MS as kn, lambdaFunctionNameForMask as ko, unchangedBehindSecretReference as kr, recordNoEchoAttributeValues as ks, getCurrentNestedStackContext as kt, listNestedTemplateRows as l, malformedOutputsWarning as la, isSensitiveAttributeName as lc, recordedOutputReferenceRegions as li, warnDeprecatedNoPrefixCliFlag as ll, redactedDeleteAddressSkip as ln, WARM_THROUGHPUT_MEMBERS as lo, refuseMalformedDesiredTags as lr, redactSecretsForState as ls, green as lt, parentSuppliedValues as m, malformedScrubResourceEntriesRefusalMessage as ma, loadPublishableAssetManifest as mc, s3BucketRegionalDomainName as mi, findLargeInlineResources as ml, WITHHELD_NAME_DISPLAY as mn, coerceCfnBoolean as mo, CC_BROKEN_REASON as mr, dynamicReferenceTokens as ms, reachableDivergentParameters as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedLocalResourcesWarning as na, importableOutputKeys as nc, AWS_CREDENTIAL_ENV_KEYS as ni, resolveAutoAssetStorage as nl, orphanDeleteNeedsIdentity as nn, hasNoCloudControlHandlers as no, reserveStackCreateToken as nr, createSecretMasker as ns, getPriorAttempts as nt, childTemplateLoader as o, malformedOrphansRefusalMessage as oa, orphansCarriedFrom as oc, isSettledInstanceState as oi, resolveStateBucketWithDefaultAndSource as ol, REDACTED_DELETE_ADDRESS_SKIP_REASON as on, isStatefulRecreateTargetForReplace as oo, DBPROXY_TAG_OPTIONS as or, markSameGenerationBag as os, bold as ot, conditionInputsFrom as p, malformedResourcesWarning as pa, createAssetRedirectResolver as pc, s3BucketDualStackDomainName as pi, MIGRATE_TMP_PREFIX as pl, DeploymentEventsStore as pn, toFiniteNumber as po, stringifyIfAssigned as pr, DYNAMIC_REFERENCE_TOKEN_SCAN as ps, namesAnyDeclaredParameter as pt, resolveDynamoDbDeleteBudgetMs as q, unpreviewableOrphanRecords as qa, stripForDisplay as qc, hasReadableOutputs as qi, isFinalSnapshotError as qn, carryLogOnlyValues as qo, poisonRenderedSpellingsCollidingIn as qr, isAccessDenied$1 as qs, isJournaledOrphan as qt, computeImplicitDeleteEdges as r, malformedOrphanRecordsRefusalMessage as ra, importableOutputs as rc, applyCallerIdentityCredentials as ri, resolveCaptureObservedState as rl, findNestedStackTypeChanges as rn, findReplacedReadersOfRecreateTargets as ro, withCreateTokenLedger as rr, errorCauseChain as rs, markRefusedBeforeApplying as rt, findNestedTemplateTreeDefect as s, malformedOrphansWarning as sa, shouldRetainResource as sc, keepHeldTokenProvenance as si, resolveUseCdkBootstrapAssets as sl, isRedactedRecordedValue as sn, isStatefulRecreateTargetSync as so, planTagDiff as sr, recordReferenceProvenanceEntry as ss, cyan as st, DeployEngine as t, malformedLocalResourceEntriesWarning as ta, hasUnverifiableParameterRefusal as tc, sendableAssumeRoleCommand as ti, resolveApp as tl, seedsDeleteFirstGuard as tn, NO_CC_HANDLERS_REASON as to, ledgerForStack as tr, shareLogOnlyValues as ts, isTruthyCfnBoolean as tt, renderNestedTemplateTreeDefect as u, malformedRenderedContainersWarning as ua, stringifyValue as uc, recordedReferenceRegions as ui, ssmResolvedValueType as ul, updatePartialMessage as un, coerceWarmThroughput as uo, tagMapAsList as ur, scrubResourceRecord as us, red as ut, mergeNoChangeOutputs as v, refuseMalformedNestedChildOutputs as va, assertAssetBucketRegion as vc, producerRegionsFromState as vi, expectedOwnerParam as vl, secretBearingStateKeyWarning as vn, configStringRefusal as vo, wouldReturnToSdkProvider as vr, inheritNestedStackParameterAssociations as vs, NESTED_PENDING_PARENT_REASON as vt, keptForReadoption as w, refuseMalformedOutputs as wa, validateAssetBucketName as wc, isImpossibleEmptyStoredAttribute as wi, processStackMessages as wl, noEchoParameterValueSeed as wn, prefetchCreateOnlyPropertyPaths as wo, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as wr, splitGetAttStringForm as ws, recordDisplacedSkips as wt, isAccessDeniedError as x, refuseMalformedOrphans as xa, isCrossRegionRedirect as xc, isUnboundTemplateParameter as xi, derivePartitionAndUrlSuffix as xl, exportNameNoEchoParameters as xn, requireConfigArray as xo, isCustomResourceType as xr, physicalNameCopiesOf as xs, dropSettledNestedJournals as xt, makeCanonicalizePropertiesFn as y, refuseMalformedOrphanRecords as ya, ensureAssetStorage as yc, regionLessSecretName as yi, PARTITION_TABLE as yl, secretSafeKeyDisplay as yn, readConfigString as yo, TemplateNoEchoReresolver as yr, recordNestedStackParameterExpressions as ys, displacedOpClause as yt, perType as z, refuseMalformedResourcesForExport as za, redactDockerArgvValues as zc, STATE_REGION_DIVERGED as zi, storedSecretNameNeedles as zn, noEchoCoordinatesOf as zo, ec2InstanceProtectionSite as zr, LockManager as zs, replayRollback as zt };
-//# sourceMappingURL=deploy-engine-BU3iY59A.js.map
+export { S3_AUTO_DELETE_OBJECTS_TAG as $, withheldAccountClause as $a, getDockerImageBySourceHash as $c, isReadableResourceEntry as $i, findDestructiveChanges as $n, literalSplitDelimitersOf as $o, applyRoleArnIfSet as $r, splitImportedOps as $s, recordUnderIdIsNotOwn as $t, diffSecurity as A, refuseMalformedResourceEntries as Aa, buildDenyExternalAccessPolicy as Ac, isNamelessDynamicReferenceError as Ai, hasOwnKey as Al, DEFAULT_RESOURCE_TIMEOUT_MS as An, withRetry as Ao, CloudControlProvider as Ar, provenPublicValue as As, withNestedStackContext as At, readProtection as B, refuseMalformedResourcesForDeploy as Ba, isDockerClientEnvKey as Bc, declaresNoEcho as Bi, injectedAwsRegionValue as Bl, storedSecretNameNeedles as Bn, maskWholeValue as Bo, markWaitAbandoned as Br, TEMPLATE_SOURCED_RULES as Bs, awaitInFlightSibling as Bt, withApiLimit as C, refuseMalformedOrphanRecordsForDestroy as Ca, ensureAssetStorage as Cc, coerceParameterTypedValue as Ci, PARTITION_TABLE as Cl, exportNameSecretExposure as Cn, replayWarn as Co, readsNoEchoDeleteValues as Cr, recordNestedStackParameterExpressions as Cs, nestedChildStackName as Ct, findServiceTokenRefusals as D, refuseMalformedOutputs as Da, readBootstrapMarkerBody as Dc, isImpossibleEmptyStoredAttribute as Di, StageLoadError as Dl, collectPublishedOutputNames as Dn, prefetchCreateOnlyPropertyPaths as Do, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Dr, recordPhysicalNameCopy as Ds, withNestedRevertRun as Dt, deferredServiceTokenWarning as E, refuseMalformedOrphansForOrphan as Ea, parseBootstrapMarker as Ec, getAccountInfo as Ei, AssemblyReader as El, collectDeclaredOutputNames as En, requireConfigString as Eo, withPrintingSecrets as Er, recordAttributeIdCopy as Es, revertedNestedRowIds as Et, recordedProtectionEvidence as F, refuseMalformedResourceEntriesForOrphan as Fa, describeDockerFailure as Fc, refStateLookupFromResource as Fi, describeFileReadFailure as Fl, orphanRecordsPrintingBag as Fn, TemplateParser as Fo, deleteIndeterminateGuards as Fr, recordProvenPublicExpression as Fs, loadJournaledOrphans as Ft, deleteBudgetKey as G, repairMalformedOrphansForReadOnly as Ga, redactedDockerCause as Gc, UNREADABLE_RESOURCES_MAP_ROW as Gi, ccRoutedFinalSnapshotError as Gn, passedNoEchoParametersOf as Go, reDisableInstanceApiTermination as Gr, S3StateBackend as Gs, replacedDeleteFailureVerdict as Gt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as H, refuseMalformedResourcesForExport as Ha, partitionSensitiveEnv as Hc, STATE_REGION_DIVERGED as Hi, resolveBucketRegion as Hl, ATOMIC_FINAL_SNAPSHOT_TYPES as Hn, noEchoCoordinatesOf as Ho, ec2InstanceProtectionSite as Hr, isSingleDynamicReferenceToken as Hs, getStackRecords as Ht, recordedProtectionNote as I, refuseMalformedResourcePropertiesForDestroy as Ia, dockerSpawnEnvWithSensitive as Ic, parseWebACLArn as Ii, displayAssemblyPath as Il, secretNamePrintingBag as In, canonicalCoordinates as Io, deleteLeftInPlace as Ir, wholeStringLeavesOf as Is, makeForeignHolderScan as It, DELETE_INDEX_WAIT_PROCEED_NOTE as J, repairMalformedResourcePropertiesForReadOnly as Ja, warnFinchArgvExposure as Jc, displayLogicalId as Ji, isFinalSnapshotError as Jn, valueAtCoordinate as Jo, INTRINSIC_KEYS as Jr, CrossPrefixScanCache as Js, isJournaledOrphan as Jt, resolveDynamoDbDeleteBudgetClock as K, repairMalformedOutputsForReadOnly as Ka, runDockerForeground as Kc, accountArgs as Ki, createPreDeleteFinalSnapshot as Kn, readbackPathFor as Ko, reEnableInstanceApiTermination as Kr, rebuildClientForBucketRegion as Ks, recordAfterRollbackUpdate as Kt, PROTECTION_PROPERTY_BY_TYPE as L, refuseMalformedResourcePropertiesForDrift as La, finchSecretArgvRefusal as Lc, withSharedDrainBudget as Li, renderAssemblyPathEscape as Ll, secretNamePrintingBags as Ln, isMarkedCoordinate as Lo, deleteSkipReason as Lr, STATE_SOURCED_BASELINE_RULES as Ls, sameJournaledOrphans as Lt, noEchoComparisonForTemplate as M, refuseMalformedResourceEntriesForDestroy as Ma, resolveDockerContextDirectory as Mc, AWS_NO_VALUE as Mi, nullPrototypeRecord as Ml, completedReplayEntries as Mn, lambdaFunctionNameForMask as Mo, unchangedBehindSecretReference as Mr, recordMaskOnlyValuesIn as Ms, dropFailedHint as Mt, noEchoExactEchoLeavesOf as N, refuseMalformedResourceEntriesForImport as Na, describeDockerCapturedOutput as Nc, cfnRefValueFromPhysicalId as Ni, ownValue as Nl, journaledOrphanPrintingBag as Nn, sameLambdaFunctionAddress as No, RollbackInlinePolicyWriters as Nr, recordNoEchoAttributeValues as Ns, isHandledOrphan as Nt, serviceTokenBlockingReason as O, refuseMalformedOutputsForDestroy as Oa, validateAssetBucketName as Oc, carriesDynamicReference as Oi, processStackMessages as Ol, isExportAliasCollision as On, templateResourceTypes as Oo, applyCustomResourceResponseExpiration as Or, splitGetAttStringForm as Os, collectNestedChildUnaddressed as Ot, noEchoParameterNamesOf as P, refuseMalformedResourceEntriesForImportSave as Pa, describeDockerExecFailure as Pc, isStalePlaceholderArnAttribute as Pi, absoluteAssemblyPathEscape as Pl, maskEventTextWithBoundBags as Pn, DagBuilder as Po, UNSPECIFIED_SKIP_REASON as Pr, recordNoEchoParameterFreshValue as Ps, journaledOrphanLines as Pt, ECR_AUTO_DELETE_IMAGES_TAG as Q, unreadableResourceEntries as Qa, AssetManifestLoader as Qc, isReadableOrphanRecord as Qi, constructPathOf as Qn, hasMaskableValues as Qo, refuseUnreadableCdkCrossAccountRefs as Qr, isNotImplemented as Qs, recheckFailedPlan as Qt, isProtectionValueActive as R, refuseMalformedResourcePropertiesForExport as Ra, formatDockerLoginError as Rc, parameterInputsFor as Ri, resolveAssemblyPath as Rl, secretNamedRecordNeedles as Rn, maskAtCoordinates as Ro, withIndeterminateGuard as Rr, STATE_SOURCED_CROSS_GENERATION_RULES as Rs, replayFailedOperations as Rt, lookupEachName as S, refuseMalformedOrphanRecords as Sa, assertAssetBucketRegion as Sc, regionLessSecretName as Si, expectedOwnerParam as Sl, exportNameNoEchoParameters as Sn, readConfigString as So, TemplateNoEchoReresolver as Sr, inheritNestedStackParameterAssociations as Ss, getNestedRevertRun as St, recordRetainedForReadoption as T, refuseMalformedOrphansForDestroy as Ta, isCrossRegionRedirect as Tc, parameterTypeMayLoseSecretIdentity as Ti, derivePartitionAndUrlSuffix as Tl, noEchoParameterValueSeed as Tn, requireConfigObject as To, getCurrentResourceSecrets as Tr, physicalNameCopiesOf as Ts, revertNestedChildFromJournal as Tt, beginDeleteWait as U, refuseMalformedState as Ua, redactDockerArgvValues as Uc, STATE_RESOURCES_MALFORMED as Ui, PRE_DELETE_SNAPSHOT_TYPES as Un, noEchoLeavesOf as Uo, isTerminationProtectionPropagationError as Ur, LockManager as Us, withStackRecords as Ut, DynamoDBGlobalTableProvider as V, refuseMalformedResourcesForDestroy as Va, isMalformedEnvKey as Vc, JSON_LISTING_HOLE_VALUE as Vi, clearBucketRegionCache as Vl, extractDeploymentEventError as Vn, maskedLeafCoordinatesOf as Vo, disableInstanceApiTermination as Vr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Vs, destroyStackRecordsView as Vt, compensateRemovedDeletionProtection as W, repairMalformedOrphanRecordsForReadOnly as Wa, redactedCause as Wc, UNREADABLE_ORPHANS_CONTAINER_ROW as Wi, buildFinalSnapshotIdentifier as Wn, noEchoOutputsComparison as Wo, observeThenDisableInstanceApiTermination as Wr, isLockInfoExpired as Ws, removeProtectionTypeList as Wt, deleteTableWithIndexBusyRetry as X, unpreviewableOrphanRecords as Xa, stripControlChars as Xc, hasReadableOutputs as Xi, unsupportedFinalSnapshotError as Xn, carryLogOnlyValues as Xo, poisonRenderedSpellingsCollidingIn as Xr, crossPrefixDeniedWarning as Xs, planFailedOps as Xt, INDEX_SETTLE_POLL_INTERVAL_MS as Y, repairMalformedResourcesForReadOnly as Ya, escapeRegExp$3 as Yc, hasReadableOrphans as Yi, refusesFinalSnapshot as Yn, liveMatchesUnresolvedTokenFrame as Yo, IntrinsicFunctionResolver as Yr, applyCrossPrefixScan as Ys, isReplacementOrphan as Yt, waitForIndexesSettled as Z, unreadableOrphanRecords as Za, stripForDisplay as Zc, hasReadableResources as Zi, maskingRetryLogger as Zn, createUnionSecretMasker as Zo, producerLookupOver as Zr, isAccessDenied$1 as Zs, planRollback as Zt, keptWholeReasonText as _, malformedScrubResourceEntriesRefusalMessage as _a, createAssetRedirectResolver as _c, s3BucketRegionalDomainName as _i, MIGRATE_TMP_PREFIX as _l, exportAliasCollisionScrubWarning as _n, coerceCfnBoolean as _o, CC_BROKEN_REASON as _r, DYNAMIC_REFERENCE_TOKEN_SCAN as _s, planOrphanAdoption as _t, inheritedProvenanceForChildDiff as a, malformedLocalResourcesWarning as aa, hasUnverifiableParameterRefusal as ac, AWS_CREDENTIAL_ENV_KEYS as ai, resolveApp as al, getCurrentProducerRegions as an, hasNoCloudControlHandlers as ao, acquireIdempotencyToken as ar, unionOfSecretBags as as, createReadOnlyAttributeHealerFactory as at, chunks as b, refuseDivergentRecordRegionForDestroy as ba, AssetModeResolver as bc, classifyReplaySecretRegion as bi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as bl, secretSafeKeyDisplay as bn, configIntegerRefusal as bo, isCustomResource as br, pathCrossesDottedKey as bs, displacedPhysicalIdShown as bt, isAbsoluteAssetPath as c, malformedOrphanRowsKeptWarning as ca, isReadableBag as cc, envCredentialsAreAssumedRole as ci, resolveSkipPrefix as cl, isRedactedRecordedValue as cn, MULTI_REGION_RECREATE_BLOCKED_TYPES as co, DBPROXY_TAGS_WHAT as cr, maskSecretsInError as cs, gray as ct, templateIdentity as d, malformedOutputsRefusalMessage as da, shouldRetainResource as dc, outputReferenceProvenanceOf as di, resolveUseCdkBootstrapAssets as dl, updatePartialMessage as dn, renderStatefulReason as do, readTagList as dr, recordReferenceProvenanceEntry as ds, yellow as dt, malformedDriftResourcePropertiesWarning as ea, acceptedCreateOnlyDropsOf as ec, assertFlagRoleArn as ei, Synthesizer as el, replacementNeverSwapped as en, findActionableSilentDrops as eo, formatDestructiveChange as er, logOnlyValueCount as es, hasCdkAutoDeleteTag as et, conditionFingerprint as f, malformedOutputsWarning as fa, AssetPublisher as fc, recordedOutputReferenceRegions as fi, stateBucketExistenceConfirmed as fl, updatePartialReason as fn, WARM_THROUGHPUT_MEMBERS as fo, refuseMalformedDesiredTags as fr, snapshotPassProvenance as fs, computeParameterTaint as ft, isSecretBearingReferenceString as g, malformedResourcesWarning as ga, buildAssetRedirectMap as gc, s3BucketDualStackDomainName as gi, CFN_TEMPLATE_URL_LIMIT as gl, displayTextOrWithheld as gn, toFiniteNumber as go, stringifyIfAssigned as gr, withoutPhysicalNameCopies as gs, makeSiblingClaimReader as gt, readRecordedConditionVerdicts as h, malformedResourcePropertiesWarning as ha, WorkGraph as hc, s3BucketDomainName as hi, CFN_TEMPLATE_BODY_LIMIT as hl, WITHHELD_NAME_DISPLAY as hn, toCfnInteger as ho, definedAttributes as hr, withPhysicalNameCopies as hs, resourcesNamingDeclaredParameter as ht, crossStackOutputProvenanceSource as i, malformedLocalResourceEntriesWarning as ia, hasReasonlessBaselineRefusal as ic, sendableAssumeRoleCommand as ii, loadCdkJson as il, findNestedStackTypeChanges as in, NO_CC_HANDLERS_REASON as io, withCreateTokenLedger as ir, shareLogOnlyValues as is, formatResourceLine as it, noEchoAttributeNamesOf as j, refuseMalformedResourceEntriesForDeploy as ja, buildDockerImage as jc, keepsSecretReferenceToken as ji, hasPlainPrototype$1 as jl, DEFAULT_RESOURCE_WARN_AFTER_MS as jn, canonicalLambdaFunctionName as jo, slowCcOperationTimeoutMs as jr, recordMaskOnlyValue as js, deleteJournaledOrphans as jt, withResourceDeadline as k, refuseMalformedResourceAttributesForOrphan as ka, validateContainerRepoName as kc, carriesFetchableDynamicReference as ki, defineOwnKey as kl, bindingSkippedOutputs as kn, describeTypeWithThrottleRetry as ko, customResourceResponseExpirationWarning as kr, carriesSecretMask as ks, getCurrentNestedStackContext as kt, listNestedTemplateRows as l, malformedOrphansRefusalMessage as la, orphansAfterRollback as lc, isSettledInstanceState as li, resolveStateBucketWithDefault as ll, redactedDeleteAddressFields as ln, isStatefulRecreateTargetForReplace as lo, DBPROXY_TAG_OPTIONS as lr, maskSecretsInText as ls, green as lt, parentSuppliedValues as m, malformedResourceEntriesWarning as ma, stringifyValue as mc, s3BucketArn as mi, ssmResolvedValueType as ml, DeploymentEventsStore as mn, isWarmThroughputDecrease as mo, tagPlanWarning as mr, scrubResourceRecord as ms, reachableDivergentParameters as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedExportSourceWarning as na, exportNamesCarriedFrom as nc, explicitRoleArnOrThrow as ni, getDefaultStateBucketName as nl, seedsDeleteFirstGuard as nn, unwrittenCreateOnlyReplacement as no, ledgerForStack as nr, recordLogOnlyParameterValue as ns, getPriorAttempts as nt, childTemplateLoader as o, malformedOrphanRecordsRefusalMessage as oa, importableOutputKeys as oc, applyCallerIdentityCredentials as oi, resolveAutoAssetStorage as ol, inheritProducerRegions as on, findReplacedReadersOfRecreateTargets as oo, isRefusedByName as or, createSecretMasker as os, bold as ot, conditionInputsFrom as p, malformedRenderedContainersWarning as pa, isSensitiveAttributeName as pc, recordedReferenceRegions as pi, warnDeprecatedNoPrefixCliFlag as pl, DeploymentEventsReader as pn, coerceWarmThroughput as po, tagMapAsList as pr, redactSecretsForState as ps, namesAnyDeclaredParameter as pt, resolveDynamoDbDeleteBudgetMs as q, repairMalformedResourceEntriesForReadOnly as qa, runDockerStreaming as qc, deployRefusesOrphanRowsReason as qi, effectiveDeletionPolicy as qn, readsNoEchoSource as qo, DiffCalculator as qr, CrossPrefixReadError as qs, demoteSupersededOrphans as qt, computeImplicitDeleteEdges as r, malformedLocalOutputsWarning as ra, hasReadableExportSet as rc, isIamRoleArn as ri, getLegacyStateBucketName as rl, orphanDeleteNeedsIdentity as rn, withoutSilentDropProperties as ro, reserveStackCreateToken as rr, recordLogOnlyValue as rs, markRefusedBeforeApplying as rt, findNestedTemplateTreeDefect as s, malformedOrphanRecordsWarning as sa, importableOutputs as sc, callerEnvCredentials as si, resolveCaptureObservedState as sl, REDACTED_DELETE_ADDRESS_SKIP_REASON as sn, shownType as so, markDeleteStarted as sr, errorCauseChain as ss, cyan as st, DeployEngine as t, malformedExportNamesWarning as ta, describeRegionValueKind as tc, assertSendableRoleArn as ti, synthesisStatusMessage as tl, resolveReplacementOldType as tn, findSilentDropProperties as to, earliestDefined as tr, printingCorpusOf as ts, isTruthyCfnBoolean as tt, renderNestedTemplateTreeDefect as u, malformedOrphansWarning as ua, orphansCarriedFrom as uc, keepHeldTokenProvenance as ui, resolveStateBucketWithDefaultAndSource as ul, redactedDeleteAddressSkip as un, isStatefulRecreateTargetSync as uo, planTagDiff as ur, markSameGenerationBag as us, red as ut, mergeNoChangeOutputs as v, malformedStateRefusalMessage as va, loadPublishableAssetManifest as vc, s3BucketWebsiteUrl as vi, findLargeInlineResources as vl, secretBearing as vn, coerceCfnInteger as vo, ProviderRegistry as vr, dynamicReferenceTokens as vs, NESTED_PENDING_PARENT_REASON as vt, keptForReadoption as w, refuseMalformedOrphans as wa, getBootstrapMarkerKey as wc, isUnboundTemplateParameter as wi, canonicalizeRegion as wl, isWholeDynamicReferenceValue as wn, requireConfigArray as wo, isCustomResourceType as wr, recoverMaskedOutput as ws, recordDisplacedSkips as wt, isAccessDeniedError as x, refuseMalformedNestedChildOutputs as xa, BOOTSTRAP_MARKER_PREFIX as xc, producerRegionsFromState as xi, decodeListingKey as xl, carriedExportAliasExposure as xn, configStringRefusal as xo, wouldReturnToSdkProvider as xr, identityKeyFor as xs, dropSettledNestedJournals as xt, makeCanonicalizePropertiesFn as y, previewableOrphanRecords as ya, rewriteTemplateAssetReferences as yc, classifyRecordedSecretRegion as yi, uploadCfnTemplate as yl, secretBearingStateKeyWarning as yn, configBooleanRefusal as yo, ccBrokenReason as yr, isUncertifiedBaselineMaskPosition as ys, displacedOpClause as yt, perType as z, refuseMalformedResourcePropertiesForOrphan as za, getDockerCmd as zc, passedParameterClassesOf as zi, injectAwsRegion as zl, stateSecretNameNeedles as zn, maskReadbackAtCoordinates as zo, isWaitAbandonedError as zr, STATE_SOURCED_READBACK_RULES as zs, replayRollback as zt };
+//# sourceMappingURL=deploy-engine-BK4gG_5A.js.map