@go-to-k/cdkd 0.300.0 → 0.300.2

package/dist/{deploy-engine-C-4ho8TJ.js → deploy-engine-DOBzE5TD.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-B_CEQGE1.js";
 import { A as UNRENDERABLE, B as safeMsg, C as looksLikeCdkdGeneratedName, D as SAFE_MSG_ALTERED_CHAR, E as withoutGeneratedFallbackName, F as displaySafe, H as terminalSafe, I as displayStackName, L as isPasteableIdent, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, S as getCurrentStackName, T as withStackName, U as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, j as asIsMessage, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-BxP3yqlr.js";
+import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, An as SHELL_ACTIVE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, Ct as RETRY_AUXILIARY_OWNER, Dn as normalizeAwsError, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as isUpdateUnsupportedError, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as withheldTargetClause, Ht as recoveryCommandFlags, In as pasteableCommand, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as isNameCooldownError, Kn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as physicalIdShownBesideCommand, M as quotedRemedyLogicalId, Mn as UNSHOWABLE_VALUE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Ot as hasCreatedBeforeFailure, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as plainOrDescribed, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Ut as sanitizeRecoveryValue, Vn as shellQuote, Vt as formatLockOwner, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isReplayedNameCollisionFrom, Yn as isRecreateRetryableError, Yt as producerRecordKey, Zt as withPasteableAwsProfile, _t as createMaskedLogSinks, ar as isRetryableTransientError, at as startInterruptWatch, bn as ResourceUpdateNotSupportedError, bt as maskDeep, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dr as markNonRetryable, en as clientDefaultsFor, er as formatRetryClassificationSignals, f as removalWarning, fr as markRedactedCause, ft as logicalIdShown, gt as stateOrphanRecordRemedy, hn as MalformedProducerRecordRefusalError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isIamPropagationError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as SHELL_ACTIVE_WHY, jt as markAuxiliaryFailure, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DynamicReferenceRegionAmbiguousError, lr as isMarkedNonRetryable, m as withoutInjectedRemovals, mn as MacroExpansionError, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, on as CrossAccountSecretRefusalError, or as isTransientServerError, ot as ElapsedBudgetRegistry, pn as LockError, pr as wrapMaskedAwsError, qn as isNameCollisionErrorFrom, rn as AssetError, sn as DependencyError, sr as retryClassificationText, st as monotonicNowMs, tn as credentialFingerprint, tr as isAmbiguousCcHandlerErrorCode, un as IntrinsicResolutionRefusalError, ur as isThrottlingError, ut as compositeIdSeparatorRefusal, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as SynthesisError, wt as carryCreatedBeforeFailure, xt as maskerOrIdentity, yn as ResourceTimeoutError, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-DFk7zr0Q.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-DBXBcg0J.js";
-import { t as getCdkdVersion } from "./version-CXGQKplb.js";
+import { t as getCdkdVersion } from "./version-CZbKGFSS.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2888,6 +2888,12 @@ const DOCKER_CLIENT_ENV_KEYS = /* @__PURE__ */ new Set([
 	"USERPROFILE",
 	"HOMEDRIVE",
 	"HOMEPATH",
+	"COMSPEC",
+	"SYSTEMROOT",
+	"WINDIR",
+	"SYSTEMDRIVE",
+	"PSMODULEPATH",
+	"PSEXECUTIONPOLICYPREFERENCE",
 	"DOCKER_HOST",
 	"DOCKER_CONTEXT",
 	"DOCKER_CONFIG",
@@ -3016,10 +3022,13 @@ const WELL_FORMED_ENV_KEY = /^[^=\0]+$/;
 function isMalformedEnvKey(key) {
 	return !WELL_FORMED_ENV_KEY.test(key);
 }
-function partitionSensitiveEnv(env, sensitiveKeys) {
+function partitionSensitiveEnv(env, sensitiveKeys, options = {}) {
+	const platform = options.platform ?? process.platform;
 	const flags = [];
 	const sensitiveEnv = {};
 	const collisions = [];
+	const names = platform === "win32" ? new Win32EnvNames(Object.keys(process.env)) : void 0;
+	const ambiguous = [];
 	for (const [k, v] of Object.entries(env)) {
 		if (!sensitiveKeys.has(k)) {
 			flags.push("-e", `${k}=${v}`);
@@ -3029,19 +3038,73 @@ function partitionSensitiveEnv(env, sensitiveKeys) {
 			collisions.push(k);
 			continue;
 		}
+		if (names) {
+			if (names.lookup(k).ambiguous) {
+				ambiguous.push(k);
+				continue;
+			}
+			names.replace(k);
+		}
 		flags.push("-e", k);
 		defineOwnKey(sensitiveEnv, k, v);
 	}
+	if (ambiguous.length > 0) getLogger().warn((options.subject === void 0 ? "" : safeMsg`${options.subject}: `) + safeMsg`Sensitive env var(s) ${ambiguous.map((k) => displayIdent(k)).join(", ")} ` + "were NOT passed to the container. On Windows each matches another variable's name (in your environment or another secret) only through a letter-case difference outside A-Z, which cdkd does not treat as the same variable. Rename the secret if the container needs it.");
+	if (names) warnCaseVariantSensitiveKeys(Object.keys(sensitiveEnv), options.subject);
 	return {
 		flags,
 		sensitiveEnv,
 		collisions
 	};
 }
-function dockerSpawnEnvWithSensitive(sensitiveEnv) {
+function warnCaseVariantSensitiveKeys(keys, subject) {
+	const byUpper = /* @__PURE__ */ new Map();
+	for (const k of keys) {
+		const upper = asciiUpper(k);
+		const group = byUpper.get(upper);
+		if (group) group.push(k);
+		else byUpper.set(upper, [k]);
+	}
+	for (const group of byUpper.values()) {
+		if (group.length < 2) continue;
+		getLogger().warn((subject === void 0 ? "" : safeMsg`${subject}: `) + safeMsg`Sensitive env vars ${group.map((k) => displayIdent(k)).join(", ")} differ only by letter case. ` + safeMsg`Windows treats them as one variable, so the container receives the value of ` + safeMsg`${displayIdent(group[group.length - 1])} under every one of these names. ` + `Rename them to distinct names if the container needs each value.`);
+	}
+}
+function asciiUpper(name) {
+	return name.replace(/[a-z]/g, (c) => c.toUpperCase());
+}
+var Win32EnvNames = class {
+	groups = /* @__PURE__ */ new Map();
+	constructor(names) {
+		for (const name of names) {
+			const key = name.toUpperCase();
+			const group = this.groups.get(key);
+			if (group) group.push(name);
+			else this.groups.set(key, [name]);
+		}
+	}
+	lookup(name) {
+		const others = (this.groups.get(name.toUpperCase()) ?? []).filter((n) => n !== name);
+		const folded = asciiUpper(name);
+		return {
+			aliases: others,
+			ambiguous: others.some((n) => asciiUpper(n) !== folded)
+		};
+	}
+	replace(name) {
+		this.groups.set(name.toUpperCase(), [name]);
+	}
+};
+function dockerSpawnEnvWithSensitive(sensitiveEnv, platform = process.platform) {
 	const env = { ...process.env };
+	const names = platform === "win32" ? new Win32EnvNames(Object.keys(env)) : void 0;
 	for (const [k, v] of Object.entries(sensitiveEnv)) {
 		if (isMalformedEnvKey(k) || isDockerClientEnvKey(k)) continue;
+		if (names) {
+			const { aliases, ambiguous } = names.lookup(k);
+			if (ambiguous) continue;
+			for (const alias of aliases) delete env[alias];
+			names.replace(k);
+		}
 		defineOwnKey(env, k, v);
 	}
 	return env;
@@ -7672,6 +7735,40 @@ function positionByCrossStackSource(bag, source, secrets) {
 	return certifiedExpressionForLeaf(secrets, association, bag);
 }
 
+//#endregion
+//#region src/deployment/secret-redaction/resolver-outcomes.ts
+const CONFLICTING = Symbol("cdkd.resolver-outcome.conflicting");
+const takenBranches = /* @__PURE__ */ new WeakMap();
+function recordTakenIfBranch(secrets, source, tookTrueBranch) {
+	let taken = takenBranches.get(secrets);
+	if (taken === void 0) {
+		taken = /* @__PURE__ */ new WeakMap();
+		takenBranches.set(secrets, taken);
+	}
+	const previous = taken.get(source);
+	if (previous === void 0) taken.set(source, tookTrueBranch);
+	else if (previous !== tookTrueBranch) taken.set(source, CONFLICTING);
+}
+function takenIfBranchOf(secrets, source) {
+	const taken = takenBranches.get(secrets)?.get(source);
+	return taken === CONFLICTING ? void 0 : taken;
+}
+const droppedElements = /* @__PURE__ */ new WeakMap();
+function recordDroppedArrayElements(secrets, source, dropped) {
+	let arrays = droppedElements.get(secrets);
+	if (arrays === void 0) {
+		arrays = /* @__PURE__ */ new WeakMap();
+		droppedElements.set(secrets, arrays);
+	}
+	const previous = arrays.get(source);
+	if (previous === void 0) arrays.set(source, [...dropped]);
+	else if (previous !== CONFLICTING && (previous.length !== dropped.length || previous.some((index, i) => index !== dropped[i]))) arrays.set(source, CONFLICTING);
+}
+function droppedArrayElementsOf(secrets, source) {
+	const dropped = droppedElements.get(secrets)?.get(source);
+	return dropped === CONFLICTING ? void 0 : dropped;
+}
+
 //#endregion
 //#region src/deployment/secret-redaction/physical-name-copies.ts
 const physicalNameCopiesOf = /* @__PURE__ */ new WeakMap();
@@ -8051,9 +8148,16 @@ function parameterReadsFor(childSecrets, parentSecrets) {
 	}
 	return reads;
 }
-function recordInheritedParameterValue(childSecrets, parentSecrets, parameterName, value) {
+function recordInheritedParameterValue(childSecrets, parentSecrets, parameterName, value, declared) {
 	const reads = parameterReadsFor(childSecrets, parentSecrets);
 	if (reads === void 0) return;
+	if (declared !== void 0) {
+		if (reads.declared === void 0) reads.declared = declared;
+		else if (reads.declared.size !== declared.size || [...declared].some((name) => !reads.declared.has(name))) {
+			inheritedParameterReads.set(childSecrets, POISONED_PARAMETER_READS);
+			return;
+		}
+	}
 	if (reads.values.has(parameterName)) {
 		if (!deepEqualJsonValue(reads.values.get(parameterName), value)) inheritedParameterReads.set(childSecrets, POISONED_PARAMETER_READS);
 		return;
@@ -8079,8 +8183,14 @@ function positionByInheritedParameter(bag, source, secrets) {
 	if (!deepEqualJsonValue(redactSecretsForState(answer, secrets), answer)) return void 0;
 	return answer;
 }
-const REREAD_TRIGGERS = /* @__PURE__ */ new Set(["Fn::Select", "Fn::Split"]);
+const REREAD_TRIGGERS = /* @__PURE__ */ new Set([
+	"Fn::Select",
+	"Fn::Split",
+	"Fn::If"
+]);
 const MAX_REREAD_DEPTH = 16;
+const MAX_REREAD_CONDITIONS = 4;
+const REREAD_NO_VALUE = Symbol("cdkd.reread.no-value");
 function splitOutsideDynamicReferences(text, delimiter, standsForSecret) {
 	if (delimiter === "") return text.split(delimiter);
 	const spans = dynamicReferenceSpans(text).filter((span) => {
@@ -8111,14 +8221,15 @@ function standsForInheritedSecret(parentSecrets, token) {
 	return parentSecrets !== void 0 && resolvedPlaintextOf(parentSecrets, token) !== void 0;
 }
 const plainSplit = (text, delimiter) => text.split(delimiter);
-function evaluatePureRead(node, bind, split, depth = 0) {
+function evaluatePureRead(node, bind, split, choose, depth = 0) {
 	if (depth > MAX_REREAD_DEPTH) return void 0;
+	const evaluate = (child) => evaluatePureRead(child, bind, split, choose, depth + 1);
 	if (typeof node === "string") return node.includes("{{resolve:") ? void 0 : { value: node };
 	if (Array.isArray(node)) {
 		const out = [];
 		for (const element of node) {
-			const evaluated = evaluatePureRead(element, bind, split, depth + 1);
-			if (evaluated === void 0) return void 0;
+			const evaluated = evaluate(element);
+			if (evaluated === void 0 || evaluated.value === REREAD_NO_VALUE) return void 0;
 			out.push(evaluated.value);
 		}
 		return { value: out };
@@ -8128,30 +8239,79 @@ function evaluatePureRead(node, bind, split, depth = 0) {
 	if (keys.length !== 1) return void 0;
 	const key = keys[0];
 	const args = node[key];
-	if (key === "Ref") return typeof args === "string" ? bind(args) : void 0;
+	if (key === "Ref") {
+		if (args === "AWS::NoValue") return { value: REREAD_NO_VALUE };
+		return typeof args === "string" ? bind(args) : void 0;
+	}
+	if (key === "Fn::If") {
+		if (!Array.isArray(args) || args.length !== 3 || typeof args[0] !== "string") return void 0;
+		const tookTrue = choose(args[0], node);
+		if (tookTrue === void 0) return void 0;
+		return evaluate(tookTrue ? args[1] : args[2]);
+	}
+	if (key === "Fn::Sub") return evaluatePureSub(args, bind, evaluate);
 	if (!Array.isArray(args) || args.length !== 2) return void 0;
 	if (key === "Fn::Select") {
 		const index = args[0];
 		const position = typeof index === "number" ? index : typeof index === "string" && /^(0|[1-9][0-9]*)$/.test(index) ? Number(index) : void 0;
 		if (position === void 0 || !Number.isSafeInteger(position) || position < 0) return void 0;
-		const list = evaluatePureRead(args[1], bind, split, depth + 1);
+		const list = evaluate(args[1]);
 		if (list === void 0 || !Array.isArray(list.value) || position >= list.value.length) return;
 		return { value: list.value[position] };
 	}
 	const delimiter = args[0];
 	if (typeof delimiter !== "string") return void 0;
 	if (key === "Fn::Split") {
-		const value = evaluatePureRead(args[1], bind, split, depth + 1);
+		const value = evaluate(args[1]);
 		if (value === void 0 || typeof value.value !== "string") return void 0;
 		return { value: split(value.value, delimiter) };
 	}
 	if (key === "Fn::Join") {
-		const parts = evaluatePureRead(args[1], bind, split, depth + 1);
+		const parts = evaluate(args[1]);
 		if (parts === void 0 || !Array.isArray(parts.value)) return void 0;
 		if (!parts.value.every((part) => typeof part === "string")) return void 0;
 		return { value: parts.value.join(delimiter) };
 	}
 }
+function evaluatePureSub(args, bind, evaluate) {
+	const [text, variables] = typeof args === "string" ? [args, {}] : Array.isArray(args) && args.length === 2 ? [args[0], args[1]] : [void 0, void 0];
+	if (typeof text !== "string" || text.includes("{{resolve:") || !isPlainObject$7(variables)) return;
+	const bound = /* @__PURE__ */ new Map();
+	for (const [name, variable] of Object.entries(variables)) {
+		const evaluated = evaluate(variable);
+		if (evaluated === void 0 || typeof evaluated.value !== "string") return void 0;
+		bound.set(name, evaluated.value);
+	}
+	let out = "";
+	let cursor = 0;
+	for (const match of text.matchAll(/\$\{(!)?([^}]*)\}/g)) {
+		const name = match[2] ?? "";
+		let replacement;
+		if (match[1] === "!") replacement = `\${${name}}`;
+		else if (name === "") replacement = match[0];
+		else if (bound.has(name)) replacement = bound.get(name);
+		else {
+			if (name.startsWith("AWS::") || name.includes(".")) return void 0;
+			const value = bind(name);
+			if (value === void 0 || typeof value.value !== "string") return void 0;
+			replacement = value.value;
+		}
+		out += text.slice(cursor, match.index) + replacement;
+		cursor = match.index + match[0].length;
+	}
+	return { value: out + text.slice(cursor) };
+}
+function collectRereadConditions(node, names, depth = 0) {
+	if (depth > MAX_REREAD_DEPTH) return false;
+	if (Array.isArray(node)) return node.every((element) => collectRereadConditions(element, names, depth + 1));
+	if (!isPlainObject$7(node)) return true;
+	if (Object.hasOwn(node, "Fn::If")) {
+		const args = node["Fn::If"];
+		if (!Array.isArray(args) || typeof args[0] !== "string") return false;
+		names.add(args[0]);
+	}
+	return Object.values(node).every((child) => collectRereadConditions(child, names, depth + 1));
+}
 function holdsRereadTrigger(node, depth = 0) {
 	if (depth > MAX_REREAD_DEPTH) return false;
 	if (Array.isArray(node)) return node.some((element) => holdsRereadTrigger(element, depth + 1));
@@ -8166,29 +8326,107 @@ function rendersReadTo(spelling, parentSecrets, value) {
 	if (Array.isArray(spelling) && Array.isArray(value) && spelling.length === value.length) return spelling.every((element, i) => rendersReadTo(element, parentSecrets, value[i]));
 	return false;
 }
-function rereadParameterExpression(source, bind, parentSecrets) {
-	if (!holdsRereadTrigger(source)) return void 0;
-	const resolved = evaluatePureRead(source, bind, plainSplit);
+const REREAD_UNBOUND = Symbol("cdkd.reread.unbound");
+const REREAD_PARAMETER_FREE = Symbol("cdkd.reread.parameter-free");
+function diffSideReading(bind, parentSecrets) {
+	return {
+		bind: (name) => {
+			const bound = bind(name);
+			return bound && { value: redactInheritedParameterValue(parentSecrets, name, bound.value) };
+		},
+		split: (text, delimiter) => splitOutsideDynamicReferences(text, delimiter, (token) => standsForInheritedSecret(parentSecrets, token))
+	};
+}
+function rereadUnder(source, bind, parentSecrets, choose) {
+	const resolved = evaluatePureRead(source, bind, plainSplit, choose);
 	if (resolved === void 0) return void 0;
-	const redacted = evaluatePureRead(source, (name) => {
-		const bound = bind(name);
-		return bound && { value: redactInheritedParameterValue(parentSecrets, name, bound.value) };
-	}, (text, delimiter) => splitOutsideDynamicReferences(text, delimiter, (token) => standsForInheritedSecret(parentSecrets, token)));
+	const diffSide = diffSideReading(bind, parentSecrets);
+	const redacted = evaluatePureRead(source, diffSide.bind, diffSide.split, choose);
 	if (redacted === void 0) return void 0;
+	if (resolved.value === REREAD_NO_VALUE || redacted.value === REREAD_NO_VALUE) return resolved.value === redacted.value ? REREAD_NO_VALUE : void 0;
 	if (!rendersReadTo(redacted.value, parentSecrets, resolved.value)) return void 0;
 	return {
 		resolved: resolved.value,
 		redacted: redacted.value
 	};
 }
+function namesParameterOnBranches(node, choose, isParameter, depth = 0) {
+	if (depth > MAX_REREAD_DEPTH) return true;
+	if (typeof node === "string") return node.includes("{{resolve:");
+	if (Array.isArray(node)) return node.some((element) => namesParameterOnBranches(element, choose, isParameter, depth + 1));
+	if (!isPlainObject$7(node)) return false;
+	if (Object.hasOwn(node, "Fn::If")) {
+		const args = node["Fn::If"];
+		if (Object.keys(node).length !== 1) return true;
+		if (!Array.isArray(args) || args.length !== 3 || typeof args[0] !== "string") return true;
+		const tookTrue = choose(args[0], node);
+		if (tookTrue === void 0) return true;
+		return namesParameterOnBranches(tookTrue ? args[1] : args[2], choose, isParameter, depth + 1);
+	}
+	if (typeof node["Ref"] === "string" && isParameter(node["Ref"])) return true;
+	const sub = node["Fn::Sub"];
+	const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
+	if (typeof text === "string") {
+		for (const match of text.matchAll(/\$\{([^}!][^}]*)\}/g)) if (isParameter(match[1].trim()) || isParameter(match[1])) return true;
+	}
+	return Object.values(node).some((child) => namesParameterOnBranches(child, choose, isParameter, depth + 1));
+}
+function rereadAssignments(source, bind, parentSecrets, untakenWhenUnbound = () => false, parameterFree) {
+	if (!holdsRereadTrigger(source)) return void 0;
+	const conditions = /* @__PURE__ */ new Set();
+	if (!collectRereadConditions(source, conditions)) return void 0;
+	if (conditions.size > MAX_REREAD_CONDITIONS) return void 0;
+	const names = [...conditions];
+	const out = [];
+	for (let assignment = 0; assignment < 2 ** names.length; assignment++) {
+		const choose = (condition) => Math.floor(assignment / 2 ** names.indexOf(condition)) % 2 === 1;
+		let unbound = false;
+		const tracked = (name) => {
+			const bound = bind(name);
+			if (bound === void 0 && untakenWhenUnbound(name)) unbound = true;
+			return bound;
+		};
+		const reread = rereadUnder(source, tracked, parentSecrets, choose);
+		if (unbound) out.push(REREAD_UNBOUND);
+		else if (reread !== void 0) out.push(reread);
+		else if (parameterFree !== void 0 && !namesParameterOnBranches(source, choose, parameterFree)) out.push(REREAD_PARAMETER_FREE);
+		else out.push(void 0);
+	}
+	return out;
+}
+function rereadParameterExpression(source, bind, parentSecrets) {
+	const assignments = rereadAssignments(source, bind, parentSecrets, void 0, (name) => bind(name) !== void 0);
+	if (assignments === void 0 || assignments.includes(void 0) || assignments.includes(REREAD_UNBOUND)) return;
+	return assignments.find((entry) => entry !== void 0 && entry !== REREAD_NO_VALUE && entry !== REREAD_UNBOUND && entry !== REREAD_PARAMETER_FREE);
+}
+function ambiguousRereads(rereads) {
+	return rereads.some((a, i) => rereads.slice(i + 1).some((b) => deepEqualJsonValue(a.resolved, b.resolved) && !deepEqualJsonValue(a.redacted, b.redacted)));
+}
 function positionByParameterReread(bag, source, secrets) {
 	const reads = inheritedParameterReads.get(secrets);
 	if (reads === void 0 || typeof reads === "symbol") return void 0;
 	if (typeof bag !== "string" && !Array.isArray(bag)) return void 0;
-	const reread = rereadParameterExpression(source, (name) => reads.values.has(name) ? { value: reads.values.get(name) } : void 0, reads.parent);
-	if (reread === void 0 || !deepEqualJsonValue(reread.resolved, bag)) return void 0;
+	if (!holdsRereadTrigger(source)) return void 0;
+	const bind = (name) => reads.values.has(name) ? { value: reads.values.get(name) } : void 0;
+	let unrecorded = false;
+	const recorded = rereadUnder(source, bind, reads.parent, (_, node) => {
+		const taken = takenIfBranchOf(secrets, node);
+		if (taken === void 0) unrecorded = true;
+		return taken;
+	});
+	let answer;
+	if (!unrecorded) {
+		if (recorded === void 0 || recorded === REREAD_NO_VALUE || !deepEqualJsonValue(recorded.resolved, bag)) return;
+		answer = recorded.redacted;
+	} else {
+		const declared = reads.declared;
+		const assignments = rereadAssignments(source, bind, reads.parent, (name) => declared?.has(name) === true);
+		if (assignments === void 0 || assignments.includes(void 0)) return void 0;
+		const matching = assignments.filter((entry) => entry !== void 0 && entry !== REREAD_NO_VALUE && entry !== REREAD_UNBOUND && entry !== REREAD_PARAMETER_FREE && deepEqualJsonValue(entry.resolved, bag));
+		if (matching.length === 0 || ambiguousRereads(matching)) return void 0;
+		answer = matching[0].redacted;
+	}
 	if (carriesChildOnlyPlaintext(bag, secrets, reads.parent)) return void 0;
-	const answer = reread.redacted;
 	if (!deepEqualJsonValue(redactSecretsForState(answer, secrets), answer)) return void 0;
 	return answer;
 }
@@ -8425,6 +8663,82 @@ function positionListByCrossStackSource(bag, source, secrets) {
 
 //#endregion
 //#region src/deployment/secret-redaction/redact-path.ts
+const NEVER_DROPPING_INTRINSICS = /* @__PURE__ */ new Set([
+	"Fn::Join",
+	"Fn::Sub",
+	"Fn::Select",
+	"Fn::Split",
+	"Fn::GetAtt"
+]);
+function arrayElementDrop(element, depth = 0) {
+	if (depth > 16) return "unknown";
+	if (!isPlainObject$7(element)) return "never";
+	if (Object.hasOwn(element, "Ref")) return element["Ref"] === "AWS::NoValue" ? "always" : "never";
+	const keys = Object.keys(element);
+	if (keys.filter((key) => key.startsWith("Fn::") || key === "Condition").length === 0) return "never";
+	if (keys.length !== 1) return "unknown";
+	if (NEVER_DROPPING_INTRINSICS.has(keys[0])) return "never";
+	if (keys[0] !== "Fn::If") return "unknown";
+	const args = element["Fn::If"];
+	if (!Array.isArray(args) || args.length !== 3) return "unknown";
+	const branches = [arrayElementDrop(args[1], depth + 1), arrayElementDrop(args[2], depth + 1)];
+	if (branches.includes("unknown")) return "unknown";
+	if (branches.every((branch) => branch === "never")) return "never";
+	if (branches.every((branch) => branch === "always")) return "always";
+	return "maybe";
+}
+function sourceElementsKeptFor(source, bagLength, secrets) {
+	const recorded = secrets && droppedArrayElementsOf(secrets, source);
+	if (recorded !== void 0) {
+		if (source.length - recorded.length !== bagLength) return void 0;
+		return source.filter((_, i) => !recorded.includes(i));
+	}
+	const drops = source.map((element) => arrayElementDrop(element));
+	if (drops.includes("unknown")) return void 0;
+	const always = drops.filter((drop) => drop === "always").length;
+	const maybe = drops.filter((drop) => drop === "maybe").length;
+	const dropped = source.length - bagLength;
+	let dropMaybe;
+	if (dropped === always) dropMaybe = false;
+	else if (dropped === always + maybe) dropMaybe = true;
+	else return void 0;
+	return source.filter((_, i) => drops[i] === "never" || drops[i] === "maybe" && !dropMaybe);
+}
+function keptLiteralsCorroborate(kept, bag, secrets) {
+	return kept.every((element, i) => keptElementCorroborates(element, bag[i], secrets));
+}
+function isIntrinsicNode(value) {
+	if (!isPlainObject$7(value)) return false;
+	const keys = Object.keys(value);
+	return keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"));
+}
+function keptElementCorroborates(source, bag, secrets, depth = 0) {
+	if (depth > 16) return false;
+	if (typeof source === "string") {
+		if (!source.includes("{{resolve:")) return source === bag;
+		return isSingleDynamicReferenceToken(source) && resolvedPlaintextOf(secrets, source) === bag;
+	}
+	if (source === null || typeof source !== "object") return source === bag;
+	if (isIntrinsicNode(source)) return true;
+	if (Array.isArray(source)) return Array.isArray(bag) && bag.length === source.length && source.every((element, i) => keptElementCorroborates(element, bag[i], secrets, depth + 1));
+	if (!isPlainObject$7(source) || !isPlainObject$7(bag)) return false;
+	if (Object.keys(bag).some((key) => !Object.hasOwn(source, key))) return false;
+	return Object.entries(source).every(([key, value]) => Object.hasOwn(bag, key) ? keptElementCorroborates(value, bag[key], secrets, depth + 1) : arrayElementDrop(value) === "always" || arrayElementDrop(value) === "maybe");
+}
+function corroboratesWhateverResolves(source, depth = 0) {
+	if (depth > 16) return false;
+	if (typeof source === "string") return !source.includes("{{resolve:");
+	if (source === null || typeof source !== "object") return true;
+	if (isIntrinsicNode(source)) return true;
+	if (Array.isArray(source)) return source.every((element) => arrayElementDrop(element) === "never" && corroboratesWhateverResolves(element, depth + 1));
+	if (!isPlainObject$7(source)) return false;
+	if (Object.keys(source).some((key) => key === "Ref" || key.startsWith("Fn::"))) return false;
+	return Object.values(source).every((value) => arrayElementDrop(value) !== "unknown" && corroboratesWhateverResolves(value, depth + 1));
+}
+function arrayPairsWhateverDrops(source) {
+	if (!source.some((element) => isPlainObject$7(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue" || Array.isArray(element["Fn::FindInMap"]) && element["Fn::FindInMap"].length > 3))) return true;
+	return source.every((element) => corroboratesWhateverResolves(element));
+}
 function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameGeneration) {
 	if (isDynamicReferenceString(source) && typeof bag === "string") {
 		if (isSingleDynamicReferenceToken(source) && (rules.trustAnyExpression || isKnownSecretExpression(source, secretExpressions))) {
@@ -8479,6 +8793,10 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 			});
 		}
 		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration));
+		if (rules.descendArrays && bag.length < source.length) {
+			const kept = sourceElementsKeptFor(source, bag.length, secrets);
+			if (kept !== void 0 && keptLiteralsCorroborate(kept, bag, secrets)) return bag.map((item, i) => redactByPath(item, kept[i], secrets, rules, secretExpressions, bagIsSameGeneration));
+		}
 	}
 	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source)) {
 		const out = Object.create(null);
@@ -11332,12 +11650,19 @@ async function withRetry(operation, logicalId, opts = {}) {
 		return await operation();
 	} catch (error) {
 		lastError = error;
+		const replayMadeAnother = replayMadeAnotherResource(previousError, error);
 		const carried = carryCreatedBeforeFailure(previousError, error);
 		if (hasCreatedBeforeFailure(carried) || !hasCreatedBeforeFailure(previousError)) previousError = carried;
 		if (isAuxiliaryFailure(error) || hasReplayMayCollide(error) || isAmbiguousOutcomeError(error)) replayMayCollide = true;
 		const message = describeAwsFailure(error).detail;
 		const classifyText = retryClassificationText(error);
 		if (isMarkedNonRetryable(error)) throw settle(error);
+		if (replayMadeAnother) {
+			try {
+				opts.logger?.warn?.(safeMsg`${shownId}: not retrying - a retried create made another resource instead of resuming the one an earlier attempt left behind, and only the latest is recorded for \`cdkd rollback --revert-failed\`. Find the earlier one and delete it by hand`);
+			} catch {}
+			throw settle(error);
+		}
 		const retryable = opts.isRetryable ? opts.isRetryable(classifyText, error) : isRetryableTransientError(error, classifyText);
 		const propagation = defaultSchedule && isIamPropagationError(classifyText);
 		if (propagation) sawPropagation = true;
@@ -22749,6 +23074,271 @@ async function resolveSub(subArgs, context, source) {
 	return result;
 }
 
+//#endregion
+//#region src/deployment/intrinsic-resolver/parameter-secrets.ts
+function recordInheritedParameterSecrets(parameterName, value, context) {
+	const inherited = context.inheritedSecrets;
+	const recorded = context.recordedSecretValues;
+	if (inherited && recorded) carryLogOnlyValuesCarriedBy(inherited, recorded, value);
+	if (recorded) carryPhysicalNameCopiesCarriedBy(context, recorded, value);
+	if (inherited && recorded) recordInheritedNoEchoListElements(this, inherited, recorded, value, context);
+	if (!inherited || inherited.size === 0 || !recorded) return;
+	const mirror = parameterReadMirrors.get(recorded);
+	const declared = declaredParameterNames(context);
+	recordInheritedParameterValue(recorded, inherited, parameterName, value, declared);
+	if (mirror) recordInheritedParameterValue(mirror, inherited, parameterName, value, declared);
+	for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) {
+		const carried = carriedExpressionFor(inherited, parameterName, value, plaintext, expression);
+		recorded.set(plaintext, carried);
+		const parentEntry = context.inheritedReferenceProvenance?.get(carried);
+		if (parentEntry !== void 0) recordReferenceProvenanceEntry(recorded, carried, parentEntry, "read");
+		recordInheritedParameterRead(recorded, inherited, parameterName);
+		if (mirror) recordInheritedParameterRead(mirror, inherited, parameterName);
+		carryFreshNoEchoMark(inherited, recorded, plaintext);
+	}
+}
+function declaredParameterNames(context) {
+	const declared = context.template?.Parameters;
+	if (declared === null || typeof declared !== "object") return void 0;
+	let names = declaredNamesCache.get(declared);
+	if (names === void 0) {
+		names = new Set(Object.keys(declared));
+		declaredNamesCache.set(declared, names);
+	}
+	return names;
+}
+const declaredNamesCache = /* @__PURE__ */ new WeakMap();
+const parameterReadMirrors = /* @__PURE__ */ new WeakMap();
+function mirrorInheritedParameterReads(passSecrets, persistSecrets) {
+	if (passSecrets !== persistSecrets) parameterReadMirrors.set(passSecrets, persistSecrets);
+}
+function recordTakenIfBranchIn(context, source, tookTrueBranch) {
+	if (!context.inheritedSecrets || context.inheritedSecrets.size === 0) return;
+	const recorded = context.recordedSecretValues;
+	if (recorded === void 0) return;
+	recordTakenIfBranch(recorded, source, tookTrueBranch);
+	const mirror = parameterReadMirrors.get(recorded);
+	if (mirror) recordTakenIfBranch(mirror, source, tookTrueBranch);
+}
+function recordDroppedArrayElementsIn(context, source, dropped) {
+	const recorded = context.recordedSecretValues;
+	if (recorded === void 0) return;
+	recordDroppedArrayElements(recorded, source, dropped);
+	const mirror = parameterReadMirrors.get(recorded);
+	if (mirror) recordDroppedArrayElements(mirror, source, dropped);
+}
+function carryPhysicalNameCopiesCarriedBy(context, recorded, value) {
+	const names = context.inheritedPhysicalNameCopies ?? (context.inheritedSecrets && physicalNameCopiesOf.get(context.inheritedSecrets));
+	if (names === void 0 || names.size === 0) return;
+	const leaves = [...wholeStringLeavesOf(value)];
+	for (const name of names) if (leaves.some((leaf) => leaf.includes(name))) recordPhysicalNameCopy(recorded, name);
+}
+function carriedExpressionFor(inherited, parameterName, value, plaintext, survivor) {
+	const own = inheritedParameterExpression(inherited, parameterName, plaintext);
+	if (typeof own === "string") return own;
+	return inheritedRenderedToken(inherited, parameterName, value, plaintext) ?? survivor;
+}
+function poisonRenderedSpellingsCollidingIn(template, parameterValues, inherited) {
+	if (!inherited || inherited.size === 0 || template === void 0) return;
+	const names = new Set(Object.keys(parameterValues));
+	if (names.size < 2) return;
+	const groups = [];
+	if (template.Resources !== null && typeof template.Resources === "object") for (const resource of Object.values(template.Resources)) groups.push([{
+		node: resource,
+		mode: "resource"
+	}]);
+	if (template.Outputs !== void 0) groups.push(outputsGroupParts(template.Outputs));
+	const bind = (name) => Object.hasOwn(parameterValues, name) ? { value: parameterValues[name] } : void 0;
+	const withdrawn = /* @__PURE__ */ new Set();
+	for (;;) {
+		const fresh = [...collidingRenderedNames(groups.map((parts) => {
+			const reads = /* @__PURE__ */ new Map();
+			for (const { node, mode } of parts) {
+				const reread = mode === "slot" ? void 0 : {
+					bind,
+					inherited
+				};
+				for (const [name, slotRead] of parameterReadsOf(node, names, reread, mode !== "output")) reads.set(name, slotRead || reads.get(name) === true);
+			}
+			return reads;
+		}).filter((reads) => reads.size >= 2), parameterValues, inherited)].filter((name) => !withdrawn.has(name));
+		if (fresh.length === 0) return;
+		for (const name of fresh) {
+			withdrawn.add(name);
+			withdrawRenderedParameterSpelling(inherited, name);
+		}
+	}
+}
+function collidingRenderedNames(readsByGroup, parameterValues, inherited) {
+	const withdraw = /* @__PURE__ */ new Set();
+	for (const reads of readsByGroup) {
+		const byPlaintext = /* @__PURE__ */ new Map();
+		const slotReadPlaintexts = /* @__PURE__ */ new Set();
+		for (const [name, slotRead] of reads) {
+			if (!Object.hasOwn(parameterValues, name)) continue;
+			const value = parameterValues[name];
+			for (const [plaintext, survivor] of inheritedSecretsCarriedBy(value, inherited)) {
+				const expression = carriedExpressionFor(inherited, name, value, plaintext, survivor);
+				const rendered = typeof inheritedParameterExpression(inherited, name, plaintext) !== "string" && inheritedRenderedToken(inherited, name, value, plaintext) !== void 0;
+				let byExpression = byPlaintext.get(plaintext);
+				if (byExpression === void 0) {
+					byExpression = /* @__PURE__ */ new Map();
+					byPlaintext.set(plaintext, byExpression);
+				}
+				let renderedNames = byExpression.get(expression);
+				if (renderedNames === void 0) {
+					renderedNames = [];
+					byExpression.set(expression, renderedNames);
+				}
+				if (rendered) renderedNames.push(name);
+				if (slotRead) slotReadPlaintexts.add(plaintext);
+			}
+		}
+		for (const [plaintext, byExpression] of byPlaintext) {
+			if (byExpression.size < 2 || !slotReadPlaintexts.has(plaintext)) continue;
+			for (const renderedNames of byExpression.values()) for (const name of renderedNames) withdraw.add(name);
+		}
+	}
+	return withdraw;
+}
+const POSITIONED_INTRINSICS = /* @__PURE__ */ new Set(["Fn::Join", "Fn::Sub"]);
+function parameterReadsOf(node, names, reread, positionsArrays) {
+	const reads = /* @__PURE__ */ new Map();
+	const add = (name, slotRead) => {
+		reads.set(name, slotRead || reads.get(name) === true);
+	};
+	const visit = (value, slotRead, atLeaf) => {
+		if (Array.isArray(value)) {
+			const mayShrink = atLeaf ? !positionsArrays || !arrayPairsWhateverDrops(value) : value.some((element) => element !== null && typeof element === "object" && !Array.isArray(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue"));
+			for (const element of value) visit(element, slotRead || mayShrink, atLeaf && !mayShrink);
+			return;
+		}
+		if (value === null || typeof value !== "object") return;
+		const record = value;
+		const intrinsic = Object.keys(record).some((key) => key === "Ref" || key.startsWith("Fn::"));
+		if (intrinsic && atLeaf && reread !== void 0 && rereadParameterExpression(record, reread.bind, reread.inherited) !== void 0) {
+			for (const name of refNamesIn(record, names)) add(name, false);
+			return;
+		}
+		const ref = record["Ref"];
+		if (typeof ref === "string" && names.has(ref)) add(ref, slotRead);
+		const placeholderSlot = !positionsArrays && unkeyedPlaceholderParts(record, (name) => certifiesPlaceholder(name, reread)) > MAX_UNKEYED_PARTS;
+		const sub = record["Fn::Sub"];
+		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
+		if (typeof text === "string") for (const match of text.matchAll(/\$\{([^}!][^}]*)\}/g)) {
+			const name = match[1].trim();
+			if (names.has(name)) add(name, slotRead || placeholderSlot);
+		}
+		for (const [key, child] of Object.entries(record)) visit(child, slotRead || placeholderSlot || key.startsWith("Fn::") && !POSITIONED_INTRINSICS.has(key), atLeaf && !intrinsic);
+	};
+	visit(node, reread === void 0, true);
+	return reads;
+}
+const MAX_UNKEYED_PARTS = 1;
+function certifiesPlaceholder(name, reread) {
+	if (reread === void 0) return false;
+	const bound = reread.bind(name);
+	if (bound === void 0) return false;
+	if (inheritedSecretsCarriedBy(bound.value, reread.inherited).length === 0) return false;
+	return typeof inheritedParameterExpression(reread.inherited, name, bound.value) === "string";
+}
+function unkeyedPlaceholderParts(record, certified) {
+	const keyed = (value) => typeof value === "string" || value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 1 && typeof value["Ref"] === "string" && certified(value["Ref"]);
+	if (Object.hasOwn(record, "Fn::Join")) {
+		const args = record["Fn::Join"];
+		if (!Array.isArray(args) || args.length !== 2 || !Array.isArray(args[1])) return Number.POSITIVE_INFINITY;
+		return args[1].filter((part) => !keyed(part)).length;
+	}
+	if (Object.hasOwn(record, "Fn::Sub")) {
+		const args = record["Fn::Sub"];
+		const [template, variables] = typeof args === "string" ? [args, {}] : Array.isArray(args) ? [args[0], args[1]] : [];
+		if (typeof template !== "string" || variables === null || typeof variables !== "object") return Number.POSITIVE_INFINITY;
+		let unkeyed = 0;
+		for (const hit of template.matchAll(/\$\{(!)?([^}]*)\}/g)) {
+			const name = hit[2] ?? "";
+			if (hit[1] === "!" || name === "") continue;
+			if (!(Object.hasOwn(variables, name) ? keyed(variables[name]) : certified(name))) unkeyed += 1;
+		}
+		return unkeyed;
+	}
+	return 0;
+}
+function outputsGroupParts(outputs) {
+	if (outputs === null || typeof outputs !== "object" || Array.isArray(outputs)) return [{
+		node: outputs,
+		mode: "slot"
+	}];
+	const parts = [];
+	for (const output of Object.values(outputs)) {
+		if (output === null || typeof output !== "object" || Array.isArray(output)) {
+			parts.push({
+				node: output,
+				mode: "slot"
+			});
+			continue;
+		}
+		const { Value: value, ...rest } = output;
+		parts.push({
+			node: value,
+			mode: "output"
+		}, {
+			node: rest,
+			mode: "slot"
+		});
+	}
+	return parts;
+}
+function refNamesIn(node, names) {
+	const found = /* @__PURE__ */ new Set();
+	const visit = (value) => {
+		if (Array.isArray(value)) {
+			for (const element of value) visit(element);
+			return;
+		}
+		if (value === null || typeof value !== "object") return;
+		const record = value;
+		if (typeof record["Ref"] === "string" && names.has(record["Ref"])) found.add(record["Ref"]);
+		const sub = record["Fn::Sub"];
+		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
+		if (typeof text === "string") for (const match of text.matchAll(/\$\{([^}!][^}]*)\}/g)) {
+			const name = match[1].trim();
+			if (names.has(name)) found.add(name);
+		}
+		for (const child of Object.values(record)) visit(child);
+	};
+	visit(node);
+	return found;
+}
+function recordInheritedNoEchoListElements(resolver, inherited, recorded, value, context) {
+	if (!Array.isArray(value)) return;
+	const parameterValues = [...inherited.keys()].filter((plaintext) => isNoEchoParameterPlaintext(inherited, plaintext));
+	if (parameterValues.length === 0) return;
+	const joined = value.map((element) => String(element)).join(",");
+	const normalized = (plaintext) => plaintext.split(",").map((piece) => piece.trim()).join(",");
+	if (!parameterValues.some((plaintext) => `,${normalized(plaintext)},`.includes(`,${joined},`))) return;
+	for (const element of value) {
+		if (typeof element !== "string" || element.length < 4) continue;
+		recordNoEchoParameterFreshValue(element, recorded, resolver.publicNoEchoTokens(context));
+	}
+}
+function recordNoEchoParameterValue(paramDef, value, context) {
+	const bag = context.recordedSecretValues;
+	if (!declaresNoEcho(paramDef) || bag === void 0) return;
+	recordLogOnlyParameterValue(bag, value);
+	recordNoEchoParameterFreshValue(value, bag, this.publicNoEchoTokens(context));
+}
+function refuseCoercedInheritedSecret(name, paramDef, userValue, inherited) {
+	if (!inherited || inherited.size === 0) return;
+	const secretPairs = new Map([...inherited].filter(([plaintext]) => !isNoEchoParameterPlaintext(inherited, plaintext)));
+	if (secretPairs.size === 0) return;
+	const carriedBefore = inheritedSecretsCarriedBy(userValue, secretPairs).length;
+	if (carriedBefore === 0) return;
+	if (inheritedSecretsCarriedBy(this.coerceParameterValue(userValue, paramDef.Type), secretPairs).length >= carriedBefore) return;
+	const loggedName = this.displayMasked(name);
+	const loggedType = this.displayMasked(paramDef.Type);
+	throw markNonRetryable(new IntrinsicResolutionRefusalError(`Nested-stack parameter ${quotedRender(loggedName, "'")} is declared ${QUOTABLE_RENDER.test(loggedType) ? `'Type: ${loggedType}'` : "with a Type that is not a plain identifier"}, but the parent stack resolved a SECRET dynamic reference into it. cdkd keeps a resolved secret out of persisted state by rewriting STRING leaves back to their {{resolve:...}} expression; coercing this value to ${quotedRender(loggedType, "'", "that Type")} destroys the plaintext cdkd would have matched on, so the DECRYPTED secret would be left in the child stack's state.json with nothing to redact it back to. Declare ${quotedRender(loggedName, "'", "the parameter")} as 'Type: String' in the nested stack's template (CDK does this by default for cross-stack references), or stop passing a secret reference into it.`, void 0, "NESTED_STACK_SECRET_PARAMETER_TYPE"));
+}
+
 //#endregion
 //#region src/deployment/intrinsic-resolver/functions.ts
 async function resolveIf(ifArgs, context, source) {
@@ -22770,11 +23360,13 @@ async function resolveIf(ifArgs, context, source) {
 	};
 	if (!context.conditions || !Object.hasOwn(context.conditions, conditionName)) {
 		this.logger.warn(`Condition ${this.displayMasked(String(conditionName), context)} not found in context, assuming false`);
+		recordTakenIfBranchIn(context, source, false);
 		return await resolveBranch(valueIfFalse);
 	}
 	const conditionValue = context.conditions[conditionName];
 	const selectedValue = conditionValue ? valueIfTrue : valueIfFalse;
 	this.logger.debug(`Resolved Fn::If: condition ${this.logRender(String(conditionName), context)} = ${conditionValue}, selected ${conditionValue ? "true" : "false"} branch`);
+	recordTakenIfBranchIn(context, source, Boolean(conditionValue));
 	return await resolveBranch(selectedValue);
 }
 async function resolveEquals(equalsArgs, context) {
@@ -23329,238 +23921,6 @@ async function resolveKeyUnit(key, val, context, abandoned) {
 	}
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/parameter-secrets.ts
-function recordInheritedParameterSecrets(parameterName, value, context) {
-	const inherited = context.inheritedSecrets;
-	const recorded = context.recordedSecretValues;
-	if (inherited && recorded) carryLogOnlyValuesCarriedBy(inherited, recorded, value);
-	if (recorded) carryPhysicalNameCopiesCarriedBy(context, recorded, value);
-	if (inherited && recorded) recordInheritedNoEchoListElements(this, inherited, recorded, value, context);
-	if (!inherited || inherited.size === 0 || !recorded) return;
-	const mirror = parameterReadMirrors.get(recorded);
-	recordInheritedParameterValue(recorded, inherited, parameterName, value);
-	if (mirror) recordInheritedParameterValue(mirror, inherited, parameterName, value);
-	for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) {
-		const carried = carriedExpressionFor(inherited, parameterName, value, plaintext, expression);
-		recorded.set(plaintext, carried);
-		const parentEntry = context.inheritedReferenceProvenance?.get(carried);
-		if (parentEntry !== void 0) recordReferenceProvenanceEntry(recorded, carried, parentEntry, "read");
-		recordInheritedParameterRead(recorded, inherited, parameterName);
-		if (mirror) recordInheritedParameterRead(mirror, inherited, parameterName);
-		carryFreshNoEchoMark(inherited, recorded, plaintext);
-	}
-}
-const parameterReadMirrors = /* @__PURE__ */ new WeakMap();
-function mirrorInheritedParameterReads(passSecrets, persistSecrets) {
-	if (passSecrets !== persistSecrets) parameterReadMirrors.set(passSecrets, persistSecrets);
-}
-function carryPhysicalNameCopiesCarriedBy(context, recorded, value) {
-	const names = context.inheritedPhysicalNameCopies ?? (context.inheritedSecrets && physicalNameCopiesOf.get(context.inheritedSecrets));
-	if (names === void 0 || names.size === 0) return;
-	const leaves = [...wholeStringLeavesOf(value)];
-	for (const name of names) if (leaves.some((leaf) => leaf.includes(name))) recordPhysicalNameCopy(recorded, name);
-}
-function carriedExpressionFor(inherited, parameterName, value, plaintext, survivor) {
-	const own = inheritedParameterExpression(inherited, parameterName, plaintext);
-	if (typeof own === "string") return own;
-	return inheritedRenderedToken(inherited, parameterName, value, plaintext) ?? survivor;
-}
-function poisonRenderedSpellingsCollidingIn(template, parameterValues, inherited) {
-	if (!inherited || inherited.size === 0 || template === void 0) return;
-	const names = new Set(Object.keys(parameterValues));
-	if (names.size < 2) return;
-	const groups = [];
-	if (template.Resources !== null && typeof template.Resources === "object") for (const resource of Object.values(template.Resources)) groups.push([{
-		node: resource,
-		mode: "resource"
-	}]);
-	if (template.Outputs !== void 0) groups.push(outputsGroupParts(template.Outputs));
-	const bind = (name) => Object.hasOwn(parameterValues, name) ? { value: parameterValues[name] } : void 0;
-	const withdrawn = /* @__PURE__ */ new Set();
-	for (;;) {
-		const fresh = [...collidingRenderedNames(groups.map((parts) => {
-			const reads = /* @__PURE__ */ new Map();
-			for (const { node, mode } of parts) {
-				const reread = mode === "slot" ? void 0 : {
-					bind,
-					inherited
-				};
-				for (const [name, slotRead] of parameterReadsOf(node, names, reread, mode !== "output")) reads.set(name, slotRead || reads.get(name) === true);
-			}
-			return reads;
-		}).filter((reads) => reads.size >= 2), parameterValues, inherited)].filter((name) => !withdrawn.has(name));
-		if (fresh.length === 0) return;
-		for (const name of fresh) {
-			withdrawn.add(name);
-			withdrawRenderedParameterSpelling(inherited, name);
-		}
-	}
-}
-function collidingRenderedNames(readsByGroup, parameterValues, inherited) {
-	const withdraw = /* @__PURE__ */ new Set();
-	for (const reads of readsByGroup) {
-		const byPlaintext = /* @__PURE__ */ new Map();
-		const slotReadPlaintexts = /* @__PURE__ */ new Set();
-		for (const [name, slotRead] of reads) {
-			if (!Object.hasOwn(parameterValues, name)) continue;
-			const value = parameterValues[name];
-			for (const [plaintext, survivor] of inheritedSecretsCarriedBy(value, inherited)) {
-				const expression = carriedExpressionFor(inherited, name, value, plaintext, survivor);
-				const rendered = typeof inheritedParameterExpression(inherited, name, plaintext) !== "string" && inheritedRenderedToken(inherited, name, value, plaintext) !== void 0;
-				let byExpression = byPlaintext.get(plaintext);
-				if (byExpression === void 0) {
-					byExpression = /* @__PURE__ */ new Map();
-					byPlaintext.set(plaintext, byExpression);
-				}
-				let renderedNames = byExpression.get(expression);
-				if (renderedNames === void 0) {
-					renderedNames = [];
-					byExpression.set(expression, renderedNames);
-				}
-				if (rendered) renderedNames.push(name);
-				if (slotRead) slotReadPlaintexts.add(plaintext);
-			}
-		}
-		for (const [plaintext, byExpression] of byPlaintext) {
-			if (byExpression.size < 2 || !slotReadPlaintexts.has(plaintext)) continue;
-			for (const renderedNames of byExpression.values()) for (const name of renderedNames) withdraw.add(name);
-		}
-	}
-	return withdraw;
-}
-const POSITIONED_INTRINSICS = /* @__PURE__ */ new Set(["Fn::Join", "Fn::Sub"]);
-function parameterReadsOf(node, names, reread, positionsArrays) {
-	const reads = /* @__PURE__ */ new Map();
-	const add = (name, slotRead) => {
-		reads.set(name, slotRead || reads.get(name) === true);
-	};
-	const visit = (value, slotRead, atLeaf) => {
-		if (Array.isArray(value)) {
-			const mayShrink = atLeaf && !positionsArrays || value.some((element) => element !== null && typeof element === "object" && !Array.isArray(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue"));
-			for (const element of value) visit(element, slotRead || mayShrink, atLeaf && !mayShrink);
-			return;
-		}
-		if (value === null || typeof value !== "object") return;
-		const record = value;
-		const intrinsic = Object.keys(record).some((key) => key === "Ref" || key.startsWith("Fn::"));
-		if (intrinsic && atLeaf && reread !== void 0 && rereadParameterExpression(record, reread.bind, reread.inherited) !== void 0) {
-			for (const name of refNamesIn(record, names)) add(name, false);
-			return;
-		}
-		const ref = record["Ref"];
-		if (typeof ref === "string" && names.has(ref)) add(ref, slotRead);
-		const placeholderSlot = !positionsArrays && unkeyedPlaceholderParts(record, (name) => certifiesPlaceholder(name, reread)) > MAX_UNKEYED_PARTS;
-		const sub = record["Fn::Sub"];
-		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
-		if (typeof text === "string") for (const match of text.matchAll(/\$\{([^}!][^}]*)\}/g)) {
-			const name = match[1].trim();
-			if (names.has(name)) add(name, slotRead || placeholderSlot);
-		}
-		for (const [key, child] of Object.entries(record)) visit(child, slotRead || placeholderSlot || key.startsWith("Fn::") && !POSITIONED_INTRINSICS.has(key), atLeaf && !intrinsic);
-	};
-	visit(node, reread === void 0, true);
-	return reads;
-}
-const MAX_UNKEYED_PARTS = 1;
-function certifiesPlaceholder(name, reread) {
-	if (reread === void 0) return false;
-	const bound = reread.bind(name);
-	if (bound === void 0) return false;
-	if (inheritedSecretsCarriedBy(bound.value, reread.inherited).length === 0) return false;
-	return typeof inheritedParameterExpression(reread.inherited, name, bound.value) === "string";
-}
-function unkeyedPlaceholderParts(record, certified) {
-	const keyed = (value) => typeof value === "string" || value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 1 && typeof value["Ref"] === "string" && certified(value["Ref"]);
-	if (Object.hasOwn(record, "Fn::Join")) {
-		const args = record["Fn::Join"];
-		if (!Array.isArray(args) || args.length !== 2 || !Array.isArray(args[1])) return Number.POSITIVE_INFINITY;
-		return args[1].filter((part) => !keyed(part)).length;
-	}
-	if (Object.hasOwn(record, "Fn::Sub")) {
-		const args = record["Fn::Sub"];
-		const [template, variables] = typeof args === "string" ? [args, {}] : Array.isArray(args) ? [args[0], args[1]] : [];
-		if (typeof template !== "string" || variables === null || typeof variables !== "object") return Number.POSITIVE_INFINITY;
-		let unkeyed = 0;
-		for (const hit of template.matchAll(/\$\{(!)?([^}]*)\}/g)) {
-			const name = hit[2] ?? "";
-			if (hit[1] === "!" || name === "") continue;
-			if (!(Object.hasOwn(variables, name) ? keyed(variables[name]) : certified(name))) unkeyed += 1;
-		}
-		return unkeyed;
-	}
-	return 0;
-}
-function outputsGroupParts(outputs) {
-	if (outputs === null || typeof outputs !== "object" || Array.isArray(outputs)) return [{
-		node: outputs,
-		mode: "slot"
-	}];
-	const parts = [];
-	for (const output of Object.values(outputs)) {
-		if (output === null || typeof output !== "object" || Array.isArray(output)) {
-			parts.push({
-				node: output,
-				mode: "slot"
-			});
-			continue;
-		}
-		const { Value: value, ...rest } = output;
-		parts.push({
-			node: value,
-			mode: "output"
-		}, {
-			node: rest,
-			mode: "slot"
-		});
-	}
-	return parts;
-}
-function refNamesIn(node, names) {
-	const found = /* @__PURE__ */ new Set();
-	const visit = (value) => {
-		if (Array.isArray(value)) {
-			for (const element of value) visit(element);
-			return;
-		}
-		if (value === null || typeof value !== "object") return;
-		const record = value;
-		if (typeof record["Ref"] === "string" && names.has(record["Ref"])) found.add(record["Ref"]);
-		for (const child of Object.values(record)) visit(child);
-	};
-	visit(node);
-	return found;
-}
-function recordInheritedNoEchoListElements(resolver, inherited, recorded, value, context) {
-	if (!Array.isArray(value)) return;
-	const parameterValues = [...inherited.keys()].filter((plaintext) => isNoEchoParameterPlaintext(inherited, plaintext));
-	if (parameterValues.length === 0) return;
-	const joined = value.map((element) => String(element)).join(",");
-	const normalized = (plaintext) => plaintext.split(",").map((piece) => piece.trim()).join(",");
-	if (!parameterValues.some((plaintext) => `,${normalized(plaintext)},`.includes(`,${joined},`))) return;
-	for (const element of value) {
-		if (typeof element !== "string" || element.length < 4) continue;
-		recordNoEchoParameterFreshValue(element, recorded, resolver.publicNoEchoTokens(context));
-	}
-}
-function recordNoEchoParameterValue(paramDef, value, context) {
-	const bag = context.recordedSecretValues;
-	if (!declaresNoEcho(paramDef) || bag === void 0) return;
-	recordLogOnlyParameterValue(bag, value);
-	recordNoEchoParameterFreshValue(value, bag, this.publicNoEchoTokens(context));
-}
-function refuseCoercedInheritedSecret(name, paramDef, userValue, inherited) {
-	if (!inherited || inherited.size === 0) return;
-	const secretPairs = new Map([...inherited].filter(([plaintext]) => !isNoEchoParameterPlaintext(inherited, plaintext)));
-	if (secretPairs.size === 0) return;
-	const carriedBefore = inheritedSecretsCarriedBy(userValue, secretPairs).length;
-	if (carriedBefore === 0) return;
-	if (inheritedSecretsCarriedBy(this.coerceParameterValue(userValue, paramDef.Type), secretPairs).length >= carriedBefore) return;
-	const loggedName = this.displayMasked(name);
-	const loggedType = this.displayMasked(paramDef.Type);
-	throw markNonRetryable(new IntrinsicResolutionRefusalError(`Nested-stack parameter ${quotedRender(loggedName, "'")} is declared ${QUOTABLE_RENDER.test(loggedType) ? `'Type: ${loggedType}'` : "with a Type that is not a plain identifier"}, but the parent stack resolved a SECRET dynamic reference into it. cdkd keeps a resolved secret out of persisted state by rewriting STRING leaves back to their {{resolve:...}} expression; coercing this value to ${quotedRender(loggedType, "'", "that Type")} destroys the plaintext cdkd would have matched on, so the DECRYPTED secret would be left in the child stack's state.json with nothing to redact it back to. Declare ${quotedRender(loggedName, "'", "the parameter")} as 'Type: String' in the nested stack's template (CDK does this by default for cross-stack references), or stop passing a secret reference into it.`, void 0, "NESTED_STACK_SECRET_PARAMETER_TYPE"));
-}
-
 //#endregion
 //#region src/deployment/intrinsic-resolver/refs.ts
 function nameIsNeverAResource(logicalId, context) {
@@ -23737,7 +24097,18 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			if (typeof value === "string" && value.includes("{{resolve:")) return await this.resolveTemplateLeafReferences(value, context);
 			return value;
 		}
-		if (Array.isArray(value)) return (await allSettledKeepingFirstRejection(() => value.map((v) => this.resolveValue(v, context)), (pending) => this.warnAbandonedParts(pending))).filter((v) => v !== AWS_NO_VALUE);
+		if (Array.isArray(value)) {
+			const resolved = await allSettledKeepingFirstRejection(() => value.map((v) => this.resolveValue(v, context)), (pending) => this.warnAbandonedParts(pending));
+			const kept = resolved.filter((v) => v !== AWS_NO_VALUE);
+			if (kept.length !== resolved.length) {
+				const dropped = [];
+				resolved.forEach((v, i) => {
+					if (v === AWS_NO_VALUE) dropped.push(i);
+				});
+				recordDroppedArrayElementsIn(context, value, dropped);
+			}
+			return kept;
+		}
 		const obj = value;
 		if ("Ref" in obj) {
 			const logicalId = obj["Ref"];
@@ -26331,7 +26702,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-COcKVcvZ.js");
+			const { ASGProvider } = await import("./asg-provider-DJdNNqDe.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -26437,7 +26808,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-QKN-WHF3.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-Bnr2VC6V.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-C-lGTdAb.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-UDy6HC5O.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -30914,6 +31285,58 @@ function recordedTagsUnreadableWarning(resourceType, id, applied) {
 	return safeMsg`The recorded Tags of ${resourceType} ${id} is not a list cdkd can read, so cdkd removed no tag and applied the ${applied} desired tag(s) only. Untag any key the template no longer names yourself.`;
 }
 
+//#endregion
+//#region src/provisioning/delete-started.ts
+const DELETE_STARTED = Symbol.for("cdkd.deleteStarted");
+const MAX_DEPTH = 10;
+function markDeleteStarted(error) {
+	try {
+		if (typeof error !== "object" || error === null || !Object.isExtensible(error)) return error;
+		Object.defineProperty(error, DELETE_STARTED, {
+			value: true,
+			enumerable: false,
+			writable: false,
+			configurable: true
+		});
+	} catch {}
+	return error;
+}
+function isDeleteStarted(error) {
+	try {
+		let current = error;
+		for (let depth = 0; depth < MAX_DEPTH && typeof current === "object" && current !== null; depth++) {
+			if (current[DELETE_STARTED] === true) return true;
+			current = current.cause;
+		}
+	} catch {}
+	return false;
+}
+const REFUSAL_NAMES = /* @__PURE__ */ new Set([
+	"AccessDenied",
+	"AccessDeniedException",
+	"UnauthorizedOperation",
+	"AuthorizationError",
+	"DependencyViolation",
+	"DeleteConflict",
+	"DeleteConflictException"
+]);
+function isRefusedByName(error) {
+	try {
+		let current = error;
+		for (let depth = 0; depth < MAX_DEPTH && current != null; depth++) {
+			if (typeof current !== "object") break;
+			const link = current;
+			for (const name of [
+				link.name,
+				link.Code,
+				link.code
+			]) if (typeof name === "string" && REFUSAL_NAMES.has(name)) return true;
+			current = link.cause;
+		}
+	} catch {}
+	return false;
+}
+
 //#endregion
 //#region src/provisioning/providers/idempotency-token.ts
 const PROCESS_NONCE = randomUUID();
@@ -34757,28 +35180,9 @@ async function replayRevert(s) {
 
 //#endregion
 //#region src/deployment/rollback-executor/replaced-survivor.ts
-const DELETE_REFUSAL_NAMES = /* @__PURE__ */ new Set([
-	"AccessDenied",
-	"AccessDeniedException",
-	"UnauthorizedOperation",
-	"AuthorizationError",
-	"DependencyViolation",
-	"DeleteConflict",
-	"DeleteConflictException"
-]);
 function replacedDeleteFailureVerdict(error) {
-	let current = error;
-	for (let depth = 0; depth < 10 && current != null; depth++) {
-		if (typeof current !== "object") break;
-		const link = current;
-		for (const name of [
-			link.name,
-			link.Code,
-			link.code
-		]) if (typeof name === "string" && DELETE_REFUSAL_NAMES.has(name)) return "kept";
-		current = link.cause;
-	}
-	return "unconfirmed";
+	if (isDeleteStarted(error)) return "unconfirmed";
+	return isRefusedByName(error) ? "kept" : "unconfirmed";
 }
 const REPLACED_SURVIVOR_PROBE_TIMEOUT_MS = 3e4;
 const INTERRUPT_POLL_MS = 250;
@@ -35098,7 +35502,7 @@ function survivorUnprovenRefusal(s, oldType, verdict) {
 	const oldId = op.previousState?.physicalId;
 	const oldShown = hasAddressablePhysicalId({ physicalId: oldId }) ? refusalPhysicalId(mask(String(oldId))) : "no recorded id";
 	const rerun = rerunRollbackPhrase(ctx, "cdkd rollback");
-	const why = verdict === "unreadable" ? "cdkd has no read for this resource type that can tell whether it does. Re-creating it could duplicate it or collide with it" : verdict === "interrupted" ? `the rollback was interrupted before cdkd could read whether it does; re-running ${rerun} reads it` : verdict === "unknown" ? `cdkd could not read whether it does (the read failed or did not answer in time); re-running ${rerun} reads it again. Re-creating it could duplicate it or collide with it` : `AWS still reports it, but its failed delete may have been accepted and still be running, or only partly ran. Re-adopting it could leave neither resource once a running delete finishes, or one that delete already stripped; once AWS reports it gone, re-running ${rerun} re-creates it`;
+	const why = verdict === "unreadable" ? "cdkd has no read for this resource type that can tell whether it does. Re-creating it could duplicate it or collide with it" : verdict === "interrupted" ? `the rollback was interrupted before cdkd could read whether it does; re-running ${rerun} reads it` : verdict === "unknown" ? `cdkd could not read whether it does (the read failed or did not answer in time); re-running ${rerun} reads it again. Re-creating it could duplicate it or collide with it` : `AWS still reports it, but its failed delete may have been accepted and still be running, or only partly ran. Re-adopting it could leave neither resource once a running delete finishes, or one that delete already stripped; once AWS reports it gone, re-running ${rerun} re-creates it. A refused delete is not running, so waiting does not help: if its delete was refused, delete it by hand, then re-run ${rerun}`;
 	return ownRemedyError(markNonRetryable(new CdkdError(`Cannot reverse the replacement of ${refusalLogicalId(op.logicalId)} (${refusalResourceType(oldType)}): the deploy did not confirm that it deleted the old resource (${oldShown}), so it may still exist, and ${why}. Nothing was sent and the journal is kept.` + (remedy.offered ? " To keep the new resource in its place instead, re-run with the command below, then delete the old resource by hand if it still exists." : "") + `${remedy.clause}${describedPhysicalIdPointer(oldShown)}` + remedy.line, "REPLACED_SURVIVOR_UNPROVEN")));
 }
 
@@ -39609,7 +40013,7 @@ var DynamoDBGlobalTableProvider = class {
 			this.logger.debug(maskSecrets(`Added/updated ${tagsToAdd.length} tag(s) on DynamoDB GlobalTable ${tableArn}`));
 		}
 	}
-	async applyAutoScalingDiff(tableName, dimension, oldSettings, newSettings, client, indexName, budget, maskSecrets = (text) => text) {
+	async applyAutoScalingDiff(tableName, dimension, oldSettings, newSettings, client, indexName, budget, maskSecrets = (text) => text, progress) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const asMaxRetries = autoScalingRetriesWithinDeleteBudget(budget, 8);
 		const metricType = dimension.endsWith("WriteCapacityUnits") ? "DynamoDBWriteCapacityUtilization" : "DynamoDBReadCapacityUtilization";
@@ -39709,8 +40113,10 @@ var DynamoDBGlobalTableProvider = class {
 					onInterrupted: watch.onInterrupted,
 					...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
 				});
+				if (progress) progress.stripped = true;
 			} catch (err) {
 				if (isInterruptedWaitError(err)) throw err;
+				if (progress && !isObjectNotFound(err) && !isRefusedByName(err)) progress.stripped = true;
 				if (!isObjectNotFound(err)) warn(`Could not delete auto-scaling policy on ${tableName} (${dimension}): ${describeAwsFailure(err).detail}. Run: ${pasteableAwsCommand(maskSecrets)`aws application-autoscaling delete-scaling-policy --policy-name ${policyName} --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`.render()}`);
 			}
 			try {
@@ -39725,9 +40131,11 @@ var DynamoDBGlobalTableProvider = class {
 					onInterrupted: watch.onInterrupted,
 					...autoScalingRetryDelays.sleep ? { sleep: autoScalingRetryDelays.sleep } : {}
 				});
+				if (progress) progress.stripped = true;
 				this.logger.debug(maskSecrets(`Deregistered auto-scaling target ${resourceId} (${dimension})`));
 			} catch (err) {
 				if (isInterruptedWaitError(err)) throw err;
+				if (progress && !isObjectNotFound(err) && !isRefusedByName(err)) progress.stripped = true;
 				if (!isObjectNotFound(err)) warn(`Could not deregister auto-scaling target on ${tableName} (${dimension}): ${describeAwsFailure(err).detail}. Run: ${pasteableAwsCommand(maskSecrets)`aws application-autoscaling deregister-scalable-target --service-namespace dynamodb --resource-id ${resourceId} --scalable-dimension ${dimension}`.render()}`);
 			}
 		} finally {
@@ -39815,9 +40223,11 @@ var DynamoDBGlobalTableProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		const flip = this.protectionFlips.acquire(deleteBudgetKey(physicalId, context?.expectedRegion), DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, resolveDynamoDbDeleteBudgetClock());
+		const progress = { stripped: false };
 		try {
-			await this.deleteGlobalTableResource(logicalId, physicalId, resourceType, context, flip);
+			await this.deleteGlobalTableResource(logicalId, physicalId, resourceType, context, flip, progress);
 		} catch (error) {
+			if (progress.stripped) markDeleteStarted(error);
 			let outcome = "failed";
 			try {
 				outcome = await compensateRemovedDeletionProtection({
@@ -39840,7 +40250,7 @@ var DynamoDBGlobalTableProvider = class {
 			throw error;
 		}
 	}
-	async deleteGlobalTableResource(logicalId, physicalId, resourceType, context, flip) {
+	async deleteGlobalTableResource(logicalId, physicalId, resourceType, context, flip, progress) {
 		const deleteMask = context?.maskSecrets ?? ((text) => text);
 		const shownTable = deleteMask(physicalId);
 		this.logger.debug(deleteMask(`Deleting DynamoDB GlobalTable ${logicalId}: ${shownTable}`));
@@ -39883,23 +40293,24 @@ var DynamoDBGlobalTableProvider = class {
 				const region = replica.RegionName;
 				if (!region || region === currentRegion) continue;
 				try {
-					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", {}, void 0, this.getRegionalAutoScalingClient(region), void 0, budget);
-					for (const indexName of tableIndexNames) await this.applyAutoScalingDiff(physicalId, "dynamodb:index:ReadCapacityUnits", {}, void 0, this.getRegionalAutoScalingClient(region), indexName, budget);
+					await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", {}, void 0, this.getRegionalAutoScalingClient(region), void 0, budget, void 0, progress);
+					for (const indexName of tableIndexNames) await this.applyAutoScalingDiff(physicalId, "dynamodb:index:ReadCapacityUnits", {}, void 0, this.getRegionalAutoScalingClient(region), indexName, budget, void 0, progress);
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
 						ReplicaUpdates: [{ Delete: { RegionName: region } }]
 					}));
+					progress.stripped = true;
 					await this.waitForReplicaGone(physicalId, region, logicalId, REPLICA_GONE_WAIT_ATTEMPTS, budget, context?.maskSecrets);
 				} catch (replicaErr) {
 					if (!(replicaErr instanceof ResourceNotFoundException$1)) throw replicaErr;
 				}
 			}
 			const localAsClient = await this.getLocalAutoScalingClient();
-			await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", {}, void 0, localAsClient, void 0, budget);
-			await this.applyAutoScalingDiff(physicalId, "dynamodb:table:WriteCapacityUnits", {}, void 0, localAsClient, void 0, budget);
+			await this.applyAutoScalingDiff(physicalId, "dynamodb:table:ReadCapacityUnits", {}, void 0, localAsClient, void 0, budget, void 0, progress);
+			await this.applyAutoScalingDiff(physicalId, "dynamodb:table:WriteCapacityUnits", {}, void 0, localAsClient, void 0, budget, void 0, progress);
 			for (const indexName of tableIndexNames) {
-				await this.applyAutoScalingDiff(physicalId, "dynamodb:index:WriteCapacityUnits", {}, void 0, localAsClient, indexName, budget);
-				await this.applyAutoScalingDiff(physicalId, "dynamodb:index:ReadCapacityUnits", {}, void 0, localAsClient, indexName, budget);
+				await this.applyAutoScalingDiff(physicalId, "dynamodb:index:WriteCapacityUnits", {}, void 0, localAsClient, indexName, budget, void 0, progress);
+				await this.applyAutoScalingDiff(physicalId, "dynamodb:index:ReadCapacityUnits", {}, void 0, localAsClient, indexName, budget, void 0, progress);
 			}
 		} catch (describeErr) {
 			if (describeErr instanceof ProvisioningError) throw describeErr;
@@ -47616,5 +48027,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { S3_AUTO_DELETE_OBJECTS_TAG as $, findSilentDropProperties as $a, synthesisStatusMessage as $c, malformedExportNamesWarning as $i, findDestructiveChanges as $n, printingCorpusOf as $o, assertSendableRoleArn as $r, describeRegionValueKind as $s, recordUnderIdIsNotOwn as $t, diffSecurity as A, refuseMalformedResourceEntriesForDestroy as Aa, resolveDockerContextDirectory as Ac, AWS_NO_VALUE as Ai, nullPrototypeRecord as Al, DEFAULT_RESOURCE_TIMEOUT_MS as An, lambdaFunctionNameForMask as Ao, unchangedBehindSecretReference as Ar, recordMaskOnlyValuesIn as As, withNestedStackContext as At, readProtection as B, refuseMalformedResourcesForExport as Ba, partitionSensitiveEnv as Bc, STATE_REGION_DIVERGED as Bi, resolveBucketRegion as Bl, storedSecretNameNeedles as Bn, noEchoCoordinatesOf as Bo, ec2InstanceProtectionSite as Br, isSingleDynamicReferenceToken as Bs, awaitInFlightSibling as Bt, withApiLimit as C, refuseMalformedOrphansForDestroy as Ca, isCrossRegionRedirect as Cc, parameterTypeMayLoseSecretIdentity as Ci, derivePartitionAndUrlSuffix as Cl, exportNameSecretExposure as Cn, requireConfigObject as Co, getCurrentResourceSecrets as Cr, physicalNameCopiesOf as Cs, nestedChildStackName as Ct, findServiceTokenRefusals as D, refuseMalformedResourceAttributesForOrphan as Da, validateContainerRepoName as Dc, carriesFetchableDynamicReference as Di, defineOwnKey as Dl, collectPublishedOutputNames as Dn, describeTypeWithThrottleRetry as Do, customResourceResponseExpirationWarning as Dr, carriesSecretMask as Ds, withNestedRevertRun as Dt, deferredServiceTokenWarning as E, refuseMalformedOutputsForDestroy as Ea, validateAssetBucketName as Ec, carriesDynamicReference as Ei, processStackMessages as El, collectDeclaredOutputNames as En, templateResourceTypes as Eo, applyCustomResourceResponseExpiration as Er, splitGetAttStringForm as Es, revertedNestedRowIds as Et, recordedProtectionEvidence as F, refuseMalformedResourcePropertiesForDrift as Fa, finchSecretArgvRefusal as Fc, withSharedDrainBudget as Fi, renderAssemblyPathEscape as Fl, orphanRecordsPrintingBag as Fn, isMarkedCoordinate as Fo, deleteSkipReason as Fr, STATE_SOURCED_BASELINE_RULES as Fs, loadJournaledOrphans as Ft, deleteBudgetKey as G, repairMalformedResourceEntriesForReadOnly as Ga, runDockerStreaming as Gc, deployRefusesOrphanRowsReason as Gi, ccRoutedFinalSnapshotError as Gn, readsNoEchoSource as Go, DiffCalculator as Gr, CrossPrefixReadError as Gs, replacedDeleteFailureVerdict as Gt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as H, repairMalformedOrphanRecordsForReadOnly as Ha, redactedCause as Hc, UNREADABLE_ORPHANS_CONTAINER_ROW as Hi, ATOMIC_FINAL_SNAPSHOT_TYPES as Hn, noEchoOutputsComparison as Ho, observeThenDisableInstanceApiTermination as Hr, isLockInfoExpired as Hs, getStackRecords as Ht, recordedProtectionNote as I, refuseMalformedResourcePropertiesForExport as Ia, formatDockerLoginError as Ic, parameterInputsFor as Ii, resolveAssemblyPath as Il, secretNamePrintingBag as In, maskAtCoordinates as Io, withIndeterminateGuard as Ir, STATE_SOURCED_CROSS_GENERATION_RULES as Is, makeForeignHolderScan as It, DELETE_INDEX_WAIT_PROCEED_NOTE as J, unpreviewableOrphanRecords as Ja, stripControlChars as Jc, hasReadableOutputs as Ji, isFinalSnapshotError as Jn, carryLogOnlyValues as Jo, poisonRenderedSpellingsCollidingIn as Jr, crossPrefixDeniedWarning as Js, isJournaledOrphan as Jt, resolveDynamoDbDeleteBudgetClock as K, repairMalformedResourcePropertiesForReadOnly as Ka, warnFinchArgvExposure as Kc, displayLogicalId as Ki, createPreDeleteFinalSnapshot as Kn, valueAtCoordinate as Ko, INTRINSIC_KEYS as Kr, CrossPrefixScanCache as Ks, recordAfterRollbackUpdate as Kt, PROTECTION_PROPERTY_BY_TYPE as L, refuseMalformedResourcePropertiesForOrphan as La, getDockerCmd as Lc, passedParameterClassesOf as Li, injectAwsRegion as Ll, secretNamePrintingBags as Ln, maskReadbackAtCoordinates as Lo, isWaitAbandonedError as Lr, STATE_SOURCED_READBACK_RULES as Ls, sameJournaledOrphans as Lt, noEchoComparisonForTemplate as M, refuseMalformedResourceEntriesForImportSave as Ma, describeDockerExecFailure as Mc, isStalePlaceholderArnAttribute as Mi, absoluteAssemblyPathEscape as Ml, completedReplayEntries as Mn, DagBuilder as Mo, UNSPECIFIED_SKIP_REASON as Mr, recordNoEchoParameterFreshValue as Ms, dropFailedHint as Mt, noEchoExactEchoLeavesOf as N, refuseMalformedResourceEntriesForOrphan as Na, describeDockerFailure as Nc, refStateLookupFromResource as Ni, describeFileReadFailure as Nl, journaledOrphanPrintingBag as Nn, TemplateParser as No, deleteIndeterminateGuards as Nr, recordProvenPublicExpression as Ns, isHandledOrphan as Nt, serviceTokenBlockingReason as O, refuseMalformedResourceEntries as Oa, buildDenyExternalAccessPolicy as Oc, isNamelessDynamicReferenceError as Oi, hasOwnKey as Ol, isExportAliasCollision as On, withRetry as Oo, CloudControlProvider as Or, provenPublicValue as Os, collectNestedChildUnaddressed as Ot, noEchoParameterNamesOf as P, refuseMalformedResourcePropertiesForDestroy as Pa, dockerSpawnEnvWithSensitive as Pc, parseWebACLArn as Pi, displayAssemblyPath as Pl, maskEventTextWithBoundBags as Pn, canonicalCoordinates as Po, deleteLeftInPlace as Pr, wholeStringLeavesOf as Ps, journaledOrphanLines as Pt, ECR_AUTO_DELETE_IMAGES_TAG as Q, findActionableSilentDrops as Qa, Synthesizer as Qc, malformedDriftResourcePropertiesWarning as Qi, constructPathOf as Qn, logOnlyValueCount as Qo, assertFlagRoleArn as Qr, acceptedCreateOnlyDropsOf as Qs, recheckFailedPlan as Qt, isProtectionValueActive as R, refuseMalformedResourcesForDeploy as Ra, isDockerClientEnvKey as Rc, declaresNoEcho as Ri, injectedAwsRegionValue as Rl, secretNamedRecordNeedles as Rn, maskWholeValue as Ro, markWaitAbandoned as Rr, TEMPLATE_SOURCED_RULES as Rs, replayFailedOperations as Rt, lookupEachName as S, refuseMalformedOrphans as Sa, getBootstrapMarkerKey as Sc, isUnboundTemplateParameter as Si, canonicalizeRegion as Sl, exportNameNoEchoParameters as Sn, requireConfigArray as So, isCustomResourceType as Sr, recoverMaskedOutput as Ss, getNestedRevertRun as St, recordRetainedForReadoption as T, refuseMalformedOutputs as Ta, readBootstrapMarkerBody as Tc, isImpossibleEmptyStoredAttribute as Ti, StageLoadError as Tl, noEchoParameterValueSeed as Tn, prefetchCreateOnlyPropertyPaths as To, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Tr, recordPhysicalNameCopy as Ts, revertNestedChildFromJournal as Tt, beginDeleteWait as U, repairMalformedOrphansForReadOnly as Ua, redactedDockerCause as Uc, UNREADABLE_RESOURCES_MAP_ROW as Ui, PRE_DELETE_SNAPSHOT_TYPES as Un, passedNoEchoParametersOf as Uo, reDisableInstanceApiTermination as Ur, S3StateBackend as Us, withStackRecords as Ut, DynamoDBGlobalTableProvider as V, refuseMalformedState as Va, redactDockerArgvValues as Vc, STATE_RESOURCES_MALFORMED as Vi, extractDeploymentEventError as Vn, noEchoLeavesOf as Vo, isTerminationProtectionPropagationError as Vr, LockManager as Vs, destroyStackRecordsView as Vt, compensateRemovedDeletionProtection as W, repairMalformedOutputsForReadOnly as Wa, runDockerForeground as Wc, accountArgs as Wi, buildFinalSnapshotIdentifier as Wn, readbackPathFor as Wo, reEnableInstanceApiTermination as Wr, rebuildClientForBucketRegion as Ws, removeProtectionTypeList as Wt, deleteTableWithIndexBusyRetry as X, unreadableResourceEntries as Xa, AssetManifestLoader as Xc, isReadableOrphanRecord as Xi, unsupportedFinalSnapshotError as Xn, hasMaskableValues as Xo, refuseUnreadableCdkCrossAccountRefs as Xr, isNotImplemented as Xs, planFailedOps as Xt, INDEX_SETTLE_POLL_INTERVAL_MS as Y, unreadableOrphanRecords as Ya, stripForDisplay as Yc, hasReadableResources as Yi, refusesFinalSnapshot as Yn, createUnionSecretMasker as Yo, producerLookupOver as Yr, isAccessDenied$1 as Ys, isReplacementOrphan as Yt, waitForIndexesSettled as Z, withheldAccountClause as Za, getDockerImageBySourceHash as Zc, isReadableResourceEntry as Zi, maskingRetryLogger as Zn, literalSplitDelimitersOf as Zo, applyRoleArnIfSet as Zr, splitImportedOps as Zs, planRollback as Zt, keptWholeReasonText as _, previewableOrphanRecords as _a, rewriteTemplateAssetReferences as _c, classifyRecordedSecretRegion as _i, uploadCfnTemplate as _l, exportAliasCollisionScrubWarning as _n, configBooleanRefusal as _o, ccBrokenReason as _r, isUncertifiedBaselineMaskPosition as _s, planOrphanAdoption as _t, inheritedProvenanceForChildDiff as a, malformedOrphanRecordsWarning as aa, importableOutputs as ac, callerEnvCredentials as ai, resolveCaptureObservedState as al, getCurrentProducerRegions as an, shownType as ao, acquireIdempotencyToken as ar, errorCauseChain as as, createReadOnlyAttributeHealerFactory as at, chunks as b, refuseMalformedOrphanRecords as ba, assertAssetBucketRegion as bc, regionLessSecretName as bi, expectedOwnerParam as bl, secretSafeKeyDisplay as bn, readConfigString as bo, TemplateNoEchoReresolver as br, inheritNestedStackParameterAssociations as bs, displacedPhysicalIdShown as bt, isAbsoluteAssetPath as c, malformedOrphansWarning as ca, orphansCarriedFrom as cc, keepHeldTokenProvenance as ci, resolveStateBucketWithDefaultAndSource as cl, isRedactedRecordedValue as cn, isStatefulRecreateTargetSync as co, planTagDiff as cr, markSameGenerationBag as cs, gray as ct, templateIdentity as d, malformedRenderedContainersWarning as da, isSensitiveAttributeName as dc, recordedReferenceRegions as di, warnDeprecatedNoPrefixCliFlag as dl, updatePartialMessage as dn, coerceWarmThroughput as do, tagMapAsList as dr, redactSecretsForState as ds, yellow as dt, malformedExportSourceWarning as ea, exportNamesCarriedFrom as ec, explicitRoleArnOrThrow as ei, getDefaultStateBucketName as el, replacementNeverSwapped as en, unwrittenCreateOnlyReplacement as eo, formatDestructiveChange as er, recordLogOnlyParameterValue as es, hasCdkAutoDeleteTag as et, conditionFingerprint as f, malformedResourceEntriesWarning as fa, stringifyValue as fc, s3BucketArn as fi, ssmResolvedValueType as fl, updatePartialReason as fn, isWarmThroughputDecrease as fo, tagPlanWarning as fr, scrubResourceRecord as fs, computeParameterTaint as ft, isSecretBearingReferenceString as g, malformedStateRefusalMessage as ga, loadPublishableAssetManifest as gc, s3BucketWebsiteUrl as gi, findLargeInlineResources as gl, displayTextOrWithheld as gn, coerceCfnInteger as go, ProviderRegistry as gr, dynamicReferenceTokens as gs, makeSiblingClaimReader as gt, readRecordedConditionVerdicts as h, malformedScrubResourceEntriesRefusalMessage as ha, createAssetRedirectResolver as hc, s3BucketRegionalDomainName as hi, MIGRATE_TMP_PREFIX as hl, WITHHELD_NAME_DISPLAY as hn, coerceCfnBoolean as ho, CC_BROKEN_REASON as hr, DYNAMIC_REFERENCE_TOKEN_SCAN as hs, resourcesNamingDeclaredParameter as ht, crossStackOutputProvenanceSource as i, malformedOrphanRecordsRefusalMessage as ia, importableOutputKeys as ic, applyCallerIdentityCredentials as ii, resolveAutoAssetStorage as il, findNestedStackTypeChanges as in, findReplacedReadersOfRecreateTargets as io, withCreateTokenLedger as ir, createSecretMasker as is, formatResourceLine as it, noEchoAttributeNamesOf as j, refuseMalformedResourceEntriesForImport as ja, describeDockerCapturedOutput as jc, cfnRefValueFromPhysicalId as ji, ownValue as jl, DEFAULT_RESOURCE_WARN_AFTER_MS as jn, sameLambdaFunctionAddress as jo, RollbackInlinePolicyWriters as jr, recordNoEchoAttributeValues as js, deleteJournaledOrphans as jt, withResourceDeadline as k, refuseMalformedResourceEntriesForDeploy as ka, buildDockerImage as kc, keepsSecretReferenceToken as ki, hasPlainPrototype$1 as kl, bindingSkippedOutputs as kn, canonicalLambdaFunctionName as ko, slowCcOperationTimeoutMs as kr, recordMaskOnlyValue as ks, getCurrentNestedStackContext as kt, listNestedTemplateRows as l, malformedOutputsRefusalMessage as la, shouldRetainResource as lc, outputReferenceProvenanceOf as li, resolveUseCdkBootstrapAssets as ll, redactedDeleteAddressFields as ln, renderStatefulReason as lo, readTagList as lr, recordReferenceProvenanceEntry as ls, green as lt, parentSuppliedValues as m, malformedResourcesWarning as ma, buildAssetRedirectMap as mc, s3BucketDualStackDomainName as mi, CFN_TEMPLATE_URL_LIMIT as ml, DeploymentEventsStore as mn, toFiniteNumber as mo, stringifyIfAssigned as mr, withoutPhysicalNameCopies as ms, reachableDivergentParameters as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedLocalResourceEntriesWarning as na, hasReasonlessBaselineRefusal as nc, sendableAssumeRoleCommand as ni, loadCdkJson as nl, seedsDeleteFirstGuard as nn, NO_CC_HANDLERS_REASON as no, ledgerForStack as nr, shareLogOnlyValues as ns, getPriorAttempts as nt, childTemplateLoader as o, malformedOrphanRowsKeptWarning as oa, isReadableBag as oc, envCredentialsAreAssumedRole as oi, resolveSkipPrefix as ol, inheritProducerRegions as on, MULTI_REGION_RECREATE_BLOCKED_TYPES as oo, DBPROXY_TAGS_WHAT as or, maskSecretsInError as os, bold as ot, conditionInputsFrom as p, malformedResourcePropertiesWarning as pa, WorkGraph as pc, s3BucketDomainName as pi, CFN_TEMPLATE_BODY_LIMIT as pl, DeploymentEventsReader as pn, toCfnInteger as po, definedAttributes as pr, withPhysicalNameCopies as ps, namesAnyDeclaredParameter as pt, resolveDynamoDbDeleteBudgetMs as q, repairMalformedResourcesForReadOnly as qa, escapeRegExp$3 as qc, hasReadableOrphans as qi, effectiveDeletionPolicy as qn, liveMatchesUnresolvedTokenFrame as qo, IntrinsicFunctionResolver as qr, applyCrossPrefixScan as qs, demoteSupersededOrphans as qt, computeImplicitDeleteEdges as r, malformedLocalResourcesWarning as ra, hasUnverifiableParameterRefusal as rc, AWS_CREDENTIAL_ENV_KEYS as ri, resolveApp as rl, orphanDeleteNeedsIdentity as rn, hasNoCloudControlHandlers as ro, reserveStackCreateToken as rr, unionOfSecretBags as rs, markRefusedBeforeApplying as rt, findNestedTemplateTreeDefect as s, malformedOrphansRefusalMessage as sa, orphansAfterRollback as sc, isSettledInstanceState as si, resolveStateBucketWithDefault as sl, REDACTED_DELETE_ADDRESS_SKIP_REASON as sn, isStatefulRecreateTargetForReplace as so, DBPROXY_TAG_OPTIONS as sr, maskSecretsInText as ss, cyan as st, DeployEngine as t, malformedLocalOutputsWarning as ta, hasReadableExportSet as tc, isIamRoleArn as ti, getLegacyStateBucketName as tl, resolveReplacementOldType as tn, withoutSilentDropProperties as to, earliestDefined as tr, recordLogOnlyValue as ts, isTruthyCfnBoolean as tt, renderNestedTemplateTreeDefect as u, malformedOutputsWarning as ua, AssetPublisher as uc, recordedOutputReferenceRegions as ui, stateBucketExistenceConfirmed as ul, redactedDeleteAddressSkip as un, WARM_THROUGHPUT_MEMBERS as uo, refuseMalformedDesiredTags as ur, snapshotPassProvenance as us, red as ut, mergeNoChangeOutputs as v, refuseDivergentRecordRegionForDestroy as va, AssetModeResolver as vc, classifyReplaySecretRegion as vi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as vl, secretBearing as vn, configIntegerRefusal as vo, isCustomResource as vr, pathCrossesDottedKey as vs, NESTED_PENDING_PARENT_REASON as vt, keptForReadoption as w, refuseMalformedOrphansForOrphan as wa, parseBootstrapMarker as wc, getAccountInfo as wi, AssemblyReader as wl, isWholeDynamicReferenceValue as wn, requireConfigString as wo, withPrintingSecrets as wr, recordAttributeIdCopy as ws, recordDisplacedSkips as wt, isAccessDeniedError as x, refuseMalformedOrphanRecordsForDestroy as xa, ensureAssetStorage as xc, coerceParameterTypedValue as xi, PARTITION_TABLE as xl, carriedExportAliasExposure as xn, replayWarn as xo, readsNoEchoDeleteValues as xr, recordNestedStackParameterExpressions as xs, dropSettledNestedJournals as xt, makeCanonicalizePropertiesFn as y, refuseMalformedNestedChildOutputs as ya, BOOTSTRAP_MARKER_PREFIX as yc, producerRegionsFromState as yi, decodeListingKey as yl, secretBearingStateKeyWarning as yn, configStringRefusal as yo, wouldReturnToSdkProvider as yr, identityKeyFor as ys, displacedOpClause as yt, perType as z, refuseMalformedResourcesForDestroy as za, isMalformedEnvKey as zc, JSON_LISTING_HOLE_VALUE as zi, clearBucketRegionCache as zl, stateSecretNameNeedles as zn, maskedLeafCoordinatesOf as zo, disableInstanceApiTermination as zr, WHOLE_DYNAMIC_REFERENCE_PATTERN as zs, replayRollback as zt };
-//# sourceMappingURL=deploy-engine-C-4ho8TJ.js.map
+export { S3_AUTO_DELETE_OBJECTS_TAG as $, withheldAccountClause as $a, getDockerImageBySourceHash as $c, isReadableResourceEntry as $i, findDestructiveChanges as $n, literalSplitDelimitersOf as $o, applyRoleArnIfSet as $r, splitImportedOps as $s, recordUnderIdIsNotOwn as $t, diffSecurity as A, refuseMalformedResourceEntries as Aa, buildDenyExternalAccessPolicy as Ac, isNamelessDynamicReferenceError as Ai, hasOwnKey as Al, DEFAULT_RESOURCE_TIMEOUT_MS as An, withRetry as Ao, CloudControlProvider as Ar, provenPublicValue as As, withNestedStackContext as At, readProtection as B, refuseMalformedResourcesForDeploy as Ba, isDockerClientEnvKey as Bc, declaresNoEcho as Bi, injectedAwsRegionValue as Bl, storedSecretNameNeedles as Bn, maskWholeValue as Bo, markWaitAbandoned as Br, TEMPLATE_SOURCED_RULES as Bs, awaitInFlightSibling as Bt, withApiLimit as C, refuseMalformedOrphanRecordsForDestroy as Ca, ensureAssetStorage as Cc, coerceParameterTypedValue as Ci, PARTITION_TABLE as Cl, exportNameSecretExposure as Cn, replayWarn as Co, readsNoEchoDeleteValues as Cr, recordNestedStackParameterExpressions as Cs, nestedChildStackName as Ct, findServiceTokenRefusals as D, refuseMalformedOutputs as Da, readBootstrapMarkerBody as Dc, isImpossibleEmptyStoredAttribute as Di, StageLoadError as Dl, collectPublishedOutputNames as Dn, prefetchCreateOnlyPropertyPaths as Do, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Dr, recordPhysicalNameCopy as Ds, withNestedRevertRun as Dt, deferredServiceTokenWarning as E, refuseMalformedOrphansForOrphan as Ea, parseBootstrapMarker as Ec, getAccountInfo as Ei, AssemblyReader as El, collectDeclaredOutputNames as En, requireConfigString as Eo, withPrintingSecrets as Er, recordAttributeIdCopy as Es, revertedNestedRowIds as Et, recordedProtectionEvidence as F, refuseMalformedResourceEntriesForOrphan as Fa, describeDockerFailure as Fc, refStateLookupFromResource as Fi, describeFileReadFailure as Fl, orphanRecordsPrintingBag as Fn, TemplateParser as Fo, deleteIndeterminateGuards as Fr, recordProvenPublicExpression as Fs, loadJournaledOrphans as Ft, deleteBudgetKey as G, repairMalformedOrphansForReadOnly as Ga, redactedDockerCause as Gc, UNREADABLE_RESOURCES_MAP_ROW as Gi, ccRoutedFinalSnapshotError as Gn, passedNoEchoParametersOf as Go, reDisableInstanceApiTermination as Gr, S3StateBackend as Gs, replacedDeleteFailureVerdict as Gt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as H, refuseMalformedResourcesForExport as Ha, partitionSensitiveEnv as Hc, STATE_REGION_DIVERGED as Hi, resolveBucketRegion as Hl, ATOMIC_FINAL_SNAPSHOT_TYPES as Hn, noEchoCoordinatesOf as Ho, ec2InstanceProtectionSite as Hr, isSingleDynamicReferenceToken as Hs, getStackRecords as Ht, recordedProtectionNote as I, refuseMalformedResourcePropertiesForDestroy as Ia, dockerSpawnEnvWithSensitive as Ic, parseWebACLArn as Ii, displayAssemblyPath as Il, secretNamePrintingBag as In, canonicalCoordinates as Io, deleteLeftInPlace as Ir, wholeStringLeavesOf as Is, makeForeignHolderScan as It, DELETE_INDEX_WAIT_PROCEED_NOTE as J, repairMalformedResourcePropertiesForReadOnly as Ja, warnFinchArgvExposure as Jc, displayLogicalId as Ji, isFinalSnapshotError as Jn, valueAtCoordinate as Jo, INTRINSIC_KEYS as Jr, CrossPrefixScanCache as Js, isJournaledOrphan as Jt, resolveDynamoDbDeleteBudgetClock as K, repairMalformedOutputsForReadOnly as Ka, runDockerForeground as Kc, accountArgs as Ki, createPreDeleteFinalSnapshot as Kn, readbackPathFor as Ko, reEnableInstanceApiTermination as Kr, rebuildClientForBucketRegion as Ks, recordAfterRollbackUpdate as Kt, PROTECTION_PROPERTY_BY_TYPE as L, refuseMalformedResourcePropertiesForDrift as La, finchSecretArgvRefusal as Lc, withSharedDrainBudget as Li, renderAssemblyPathEscape as Ll, secretNamePrintingBags as Ln, isMarkedCoordinate as Lo, deleteSkipReason as Lr, STATE_SOURCED_BASELINE_RULES as Ls, sameJournaledOrphans as Lt, noEchoComparisonForTemplate as M, refuseMalformedResourceEntriesForDestroy as Ma, resolveDockerContextDirectory as Mc, AWS_NO_VALUE as Mi, nullPrototypeRecord as Ml, completedReplayEntries as Mn, lambdaFunctionNameForMask as Mo, unchangedBehindSecretReference as Mr, recordMaskOnlyValuesIn as Ms, dropFailedHint as Mt, noEchoExactEchoLeavesOf as N, refuseMalformedResourceEntriesForImport as Na, describeDockerCapturedOutput as Nc, cfnRefValueFromPhysicalId as Ni, ownValue as Nl, journaledOrphanPrintingBag as Nn, sameLambdaFunctionAddress as No, RollbackInlinePolicyWriters as Nr, recordNoEchoAttributeValues as Ns, isHandledOrphan as Nt, serviceTokenBlockingReason as O, refuseMalformedOutputsForDestroy as Oa, validateAssetBucketName as Oc, carriesDynamicReference as Oi, processStackMessages as Ol, isExportAliasCollision as On, templateResourceTypes as Oo, applyCustomResourceResponseExpiration as Or, splitGetAttStringForm as Os, collectNestedChildUnaddressed as Ot, noEchoParameterNamesOf as P, refuseMalformedResourceEntriesForImportSave as Pa, describeDockerExecFailure as Pc, isStalePlaceholderArnAttribute as Pi, absoluteAssemblyPathEscape as Pl, maskEventTextWithBoundBags as Pn, DagBuilder as Po, UNSPECIFIED_SKIP_REASON as Pr, recordNoEchoParameterFreshValue as Ps, journaledOrphanLines as Pt, ECR_AUTO_DELETE_IMAGES_TAG as Q, unreadableResourceEntries as Qa, AssetManifestLoader as Qc, isReadableOrphanRecord as Qi, constructPathOf as Qn, hasMaskableValues as Qo, refuseUnreadableCdkCrossAccountRefs as Qr, isNotImplemented as Qs, recheckFailedPlan as Qt, isProtectionValueActive as R, refuseMalformedResourcePropertiesForExport as Ra, formatDockerLoginError as Rc, parameterInputsFor as Ri, resolveAssemblyPath as Rl, secretNamedRecordNeedles as Rn, maskAtCoordinates as Ro, withIndeterminateGuard as Rr, STATE_SOURCED_CROSS_GENERATION_RULES as Rs, replayFailedOperations as Rt, lookupEachName as S, refuseMalformedOrphanRecords as Sa, assertAssetBucketRegion as Sc, regionLessSecretName as Si, expectedOwnerParam as Sl, exportNameNoEchoParameters as Sn, readConfigString as So, TemplateNoEchoReresolver as Sr, inheritNestedStackParameterAssociations as Ss, getNestedRevertRun as St, recordRetainedForReadoption as T, refuseMalformedOrphansForDestroy as Ta, isCrossRegionRedirect as Tc, parameterTypeMayLoseSecretIdentity as Ti, derivePartitionAndUrlSuffix as Tl, noEchoParameterValueSeed as Tn, requireConfigObject as To, getCurrentResourceSecrets as Tr, physicalNameCopiesOf as Ts, revertNestedChildFromJournal as Tt, beginDeleteWait as U, refuseMalformedState as Ua, redactDockerArgvValues as Uc, STATE_RESOURCES_MALFORMED as Ui, PRE_DELETE_SNAPSHOT_TYPES as Un, noEchoLeavesOf as Uo, isTerminationProtectionPropagationError as Ur, LockManager as Us, withStackRecords as Ut, DynamoDBGlobalTableProvider as V, refuseMalformedResourcesForDestroy as Va, isMalformedEnvKey as Vc, JSON_LISTING_HOLE_VALUE as Vi, clearBucketRegionCache as Vl, extractDeploymentEventError as Vn, maskedLeafCoordinatesOf as Vo, disableInstanceApiTermination as Vr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Vs, destroyStackRecordsView as Vt, compensateRemovedDeletionProtection as W, repairMalformedOrphanRecordsForReadOnly as Wa, redactedCause as Wc, UNREADABLE_ORPHANS_CONTAINER_ROW as Wi, buildFinalSnapshotIdentifier as Wn, noEchoOutputsComparison as Wo, observeThenDisableInstanceApiTermination as Wr, isLockInfoExpired as Ws, removeProtectionTypeList as Wt, deleteTableWithIndexBusyRetry as X, unpreviewableOrphanRecords as Xa, stripControlChars as Xc, hasReadableOutputs as Xi, unsupportedFinalSnapshotError as Xn, carryLogOnlyValues as Xo, poisonRenderedSpellingsCollidingIn as Xr, crossPrefixDeniedWarning as Xs, planFailedOps as Xt, INDEX_SETTLE_POLL_INTERVAL_MS as Y, repairMalformedResourcesForReadOnly as Ya, escapeRegExp$3 as Yc, hasReadableOrphans as Yi, refusesFinalSnapshot as Yn, liveMatchesUnresolvedTokenFrame as Yo, IntrinsicFunctionResolver as Yr, applyCrossPrefixScan as Ys, isReplacementOrphan as Yt, waitForIndexesSettled as Z, unreadableOrphanRecords as Za, stripForDisplay as Zc, hasReadableResources as Zi, maskingRetryLogger as Zn, createUnionSecretMasker as Zo, producerLookupOver as Zr, isAccessDenied$1 as Zs, planRollback as Zt, keptWholeReasonText as _, malformedScrubResourceEntriesRefusalMessage as _a, createAssetRedirectResolver as _c, s3BucketRegionalDomainName as _i, MIGRATE_TMP_PREFIX as _l, exportAliasCollisionScrubWarning as _n, coerceCfnBoolean as _o, CC_BROKEN_REASON as _r, DYNAMIC_REFERENCE_TOKEN_SCAN as _s, planOrphanAdoption as _t, inheritedProvenanceForChildDiff as a, malformedLocalResourcesWarning as aa, hasUnverifiableParameterRefusal as ac, AWS_CREDENTIAL_ENV_KEYS as ai, resolveApp as al, getCurrentProducerRegions as an, hasNoCloudControlHandlers as ao, acquireIdempotencyToken as ar, unionOfSecretBags as as, createReadOnlyAttributeHealerFactory as at, chunks as b, refuseDivergentRecordRegionForDestroy as ba, AssetModeResolver as bc, classifyReplaySecretRegion as bi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as bl, secretSafeKeyDisplay as bn, configIntegerRefusal as bo, isCustomResource as br, pathCrossesDottedKey as bs, displacedPhysicalIdShown as bt, isAbsoluteAssetPath as c, malformedOrphanRowsKeptWarning as ca, isReadableBag as cc, envCredentialsAreAssumedRole as ci, resolveSkipPrefix as cl, isRedactedRecordedValue as cn, MULTI_REGION_RECREATE_BLOCKED_TYPES as co, DBPROXY_TAGS_WHAT as cr, maskSecretsInError as cs, gray as ct, templateIdentity as d, malformedOutputsRefusalMessage as da, shouldRetainResource as dc, outputReferenceProvenanceOf as di, resolveUseCdkBootstrapAssets as dl, updatePartialMessage as dn, renderStatefulReason as do, readTagList as dr, recordReferenceProvenanceEntry as ds, yellow as dt, malformedDriftResourcePropertiesWarning as ea, acceptedCreateOnlyDropsOf as ec, assertFlagRoleArn as ei, Synthesizer as el, replacementNeverSwapped as en, findActionableSilentDrops as eo, formatDestructiveChange as er, logOnlyValueCount as es, hasCdkAutoDeleteTag as et, conditionFingerprint as f, malformedOutputsWarning as fa, AssetPublisher as fc, recordedOutputReferenceRegions as fi, stateBucketExistenceConfirmed as fl, updatePartialReason as fn, WARM_THROUGHPUT_MEMBERS as fo, refuseMalformedDesiredTags as fr, snapshotPassProvenance as fs, computeParameterTaint as ft, isSecretBearingReferenceString as g, malformedResourcesWarning as ga, buildAssetRedirectMap as gc, s3BucketDualStackDomainName as gi, CFN_TEMPLATE_URL_LIMIT as gl, displayTextOrWithheld as gn, toFiniteNumber as go, stringifyIfAssigned as gr, withoutPhysicalNameCopies as gs, makeSiblingClaimReader as gt, readRecordedConditionVerdicts as h, malformedResourcePropertiesWarning as ha, WorkGraph as hc, s3BucketDomainName as hi, CFN_TEMPLATE_BODY_LIMIT as hl, WITHHELD_NAME_DISPLAY as hn, toCfnInteger as ho, definedAttributes as hr, withPhysicalNameCopies as hs, resourcesNamingDeclaredParameter as ht, crossStackOutputProvenanceSource as i, malformedLocalResourceEntriesWarning as ia, hasReasonlessBaselineRefusal as ic, sendableAssumeRoleCommand as ii, loadCdkJson as il, findNestedStackTypeChanges as in, NO_CC_HANDLERS_REASON as io, withCreateTokenLedger as ir, shareLogOnlyValues as is, formatResourceLine as it, noEchoAttributeNamesOf as j, refuseMalformedResourceEntriesForDeploy as ja, buildDockerImage as jc, keepsSecretReferenceToken as ji, hasPlainPrototype$1 as jl, DEFAULT_RESOURCE_WARN_AFTER_MS as jn, canonicalLambdaFunctionName as jo, slowCcOperationTimeoutMs as jr, recordMaskOnlyValue as js, deleteJournaledOrphans as jt, withResourceDeadline as k, refuseMalformedResourceAttributesForOrphan as ka, validateContainerRepoName as kc, carriesFetchableDynamicReference as ki, defineOwnKey as kl, bindingSkippedOutputs as kn, describeTypeWithThrottleRetry as ko, customResourceResponseExpirationWarning as kr, carriesSecretMask as ks, getCurrentNestedStackContext as kt, listNestedTemplateRows as l, malformedOrphansRefusalMessage as la, orphansAfterRollback as lc, isSettledInstanceState as li, resolveStateBucketWithDefault as ll, redactedDeleteAddressFields as ln, isStatefulRecreateTargetForReplace as lo, DBPROXY_TAG_OPTIONS as lr, maskSecretsInText as ls, green as lt, parentSuppliedValues as m, malformedResourceEntriesWarning as ma, stringifyValue as mc, s3BucketArn as mi, ssmResolvedValueType as ml, DeploymentEventsStore as mn, isWarmThroughputDecrease as mo, tagPlanWarning as mr, scrubResourceRecord as ms, reachableDivergentParameters as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedExportSourceWarning as na, exportNamesCarriedFrom as nc, explicitRoleArnOrThrow as ni, getDefaultStateBucketName as nl, seedsDeleteFirstGuard as nn, unwrittenCreateOnlyReplacement as no, ledgerForStack as nr, recordLogOnlyParameterValue as ns, getPriorAttempts as nt, childTemplateLoader as o, malformedOrphanRecordsRefusalMessage as oa, importableOutputKeys as oc, applyCallerIdentityCredentials as oi, resolveAutoAssetStorage as ol, inheritProducerRegions as on, findReplacedReadersOfRecreateTargets as oo, isRefusedByName as or, createSecretMasker as os, bold as ot, conditionInputsFrom as p, malformedRenderedContainersWarning as pa, isSensitiveAttributeName as pc, recordedReferenceRegions as pi, warnDeprecatedNoPrefixCliFlag as pl, DeploymentEventsReader as pn, coerceWarmThroughput as po, tagMapAsList as pr, redactSecretsForState as ps, namesAnyDeclaredParameter as pt, resolveDynamoDbDeleteBudgetMs as q, repairMalformedResourceEntriesForReadOnly as qa, runDockerStreaming as qc, deployRefusesOrphanRowsReason as qi, effectiveDeletionPolicy as qn, readsNoEchoSource as qo, DiffCalculator as qr, CrossPrefixReadError as qs, demoteSupersededOrphans as qt, computeImplicitDeleteEdges as r, malformedLocalOutputsWarning as ra, hasReadableExportSet as rc, isIamRoleArn as ri, getLegacyStateBucketName as rl, orphanDeleteNeedsIdentity as rn, withoutSilentDropProperties as ro, reserveStackCreateToken as rr, recordLogOnlyValue as rs, markRefusedBeforeApplying as rt, findNestedTemplateTreeDefect as s, malformedOrphanRecordsWarning as sa, importableOutputs as sc, callerEnvCredentials as si, resolveCaptureObservedState as sl, REDACTED_DELETE_ADDRESS_SKIP_REASON as sn, shownType as so, markDeleteStarted as sr, errorCauseChain as ss, cyan as st, DeployEngine as t, malformedExportNamesWarning as ta, describeRegionValueKind as tc, assertSendableRoleArn as ti, synthesisStatusMessage as tl, resolveReplacementOldType as tn, findSilentDropProperties as to, earliestDefined as tr, printingCorpusOf as ts, isTruthyCfnBoolean as tt, renderNestedTemplateTreeDefect as u, malformedOrphansWarning as ua, orphansCarriedFrom as uc, keepHeldTokenProvenance as ui, resolveStateBucketWithDefaultAndSource as ul, redactedDeleteAddressSkip as un, isStatefulRecreateTargetSync as uo, planTagDiff as ur, markSameGenerationBag as us, red as ut, mergeNoChangeOutputs as v, malformedStateRefusalMessage as va, loadPublishableAssetManifest as vc, s3BucketWebsiteUrl as vi, findLargeInlineResources as vl, secretBearing as vn, coerceCfnInteger as vo, ProviderRegistry as vr, dynamicReferenceTokens as vs, NESTED_PENDING_PARENT_REASON as vt, keptForReadoption as w, refuseMalformedOrphans as wa, getBootstrapMarkerKey as wc, isUnboundTemplateParameter as wi, canonicalizeRegion as wl, isWholeDynamicReferenceValue as wn, requireConfigArray as wo, isCustomResourceType as wr, recoverMaskedOutput as ws, recordDisplacedSkips as wt, isAccessDeniedError as x, refuseMalformedNestedChildOutputs as xa, BOOTSTRAP_MARKER_PREFIX as xc, producerRegionsFromState as xi, decodeListingKey as xl, carriedExportAliasExposure as xn, configStringRefusal as xo, wouldReturnToSdkProvider as xr, identityKeyFor as xs, dropSettledNestedJournals as xt, makeCanonicalizePropertiesFn as y, previewableOrphanRecords as ya, rewriteTemplateAssetReferences as yc, classifyRecordedSecretRegion as yi, uploadCfnTemplate as yl, secretBearingStateKeyWarning as yn, configBooleanRefusal as yo, ccBrokenReason as yr, isUncertifiedBaselineMaskPosition as ys, displacedOpClause as yt, perType as z, refuseMalformedResourcePropertiesForOrphan as za, getDockerCmd as zc, passedParameterClassesOf as zi, injectAwsRegion as zl, stateSecretNameNeedles as zn, maskReadbackAtCoordinates as zo, isWaitAbandonedError as zr, STATE_SOURCED_READBACK_RULES as zs, replayRollback as zt };
+//# sourceMappingURL=deploy-engine-DOBzE5TD.js.map