@go-to-k/cdkd 0.300.1 → 0.301.0

package/dist/{deploy-engine-BK4gG_5A.js → deploy-engine-DEvS2r2M.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-B_CEQGE1.js";
 import { A as UNRENDERABLE, B as safeMsg, C as looksLikeCdkdGeneratedName, D as SAFE_MSG_ALTERED_CHAR, E as withoutGeneratedFallbackName, F as displaySafe, H as terminalSafe, I as displayStackName, L as isPasteableIdent, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, S as getCurrentStackName, T as withStackName, U as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, j as asIsMessage, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $ as protectedReplacementAdvice, $n as formatRetryClassificationSignals, $t as ambientCredentialConfig, A as isQuotableImportValue, An as SHELL_ACTIVE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, Ct as RETRY_AUXILIARY_OWNER, Dn as normalizeAwsError, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as isUpdateUnsupportedError, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as withheldTargetClause, Ht as recoveryCommandFlags, In as pasteableCommand, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as isNameCooldownError, Kn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as physicalIdShownBesideCommand, M as quotedRemedyLogicalId, Mn as UNSHOWABLE_VALUE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Ot as hasCreatedBeforeFailure, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as plainOrDescribed, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Ut as sanitizeRecoveryValue, Vn as shellQuote, Vt as formatLockOwner, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isReplayedNameCollisionFrom, Yn as isRecreateRetryableError, Yt as producerRecordKey, Zt as withPasteableAwsProfile, _t as createMaskedLogSinks, ar as retryClassificationText, at as startInterruptWatch, bn as ResourceUpdateNotSupportedError, bt as maskDeep, cr as isThrottlingError, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dr as wrapMaskedAwsError, en as clientDefaultsFor, er as isAmbiguousCcHandlerErrorCode, f as removalWarning, ft as logicalIdShown, gt as stateOrphanRecordRemedy, hn as MalformedProducerRecordRefusalError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isTransientServerError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as SHELL_ACTIVE_WHY, jt as markAuxiliaryFailure, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DynamicReferenceRegionAmbiguousError, lr as markNonRetryable, m as withoutInjectedRemovals, mn as MacroExpansionError, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as isIamPropagationError, on as CrossAccountSecretRefusalError, ot as ElapsedBudgetRegistry, pn as LockError, qn as isNameCollisionErrorFrom, rn as AssetError, rr as isRetryableTransientError, sn as DependencyError, sr as isMarkedNonRetryable, st as monotonicNowMs, tn as credentialFingerprint, tr as isAmbiguousOutcomeError, un as IntrinsicResolutionRefusalError, ur as markRedactedCause, ut as compositeIdSeparatorRefusal, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as SynthesisError, wt as carryCreatedBeforeFailure, xt as maskerOrIdentity, yn as ResourceTimeoutError, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-DAs3w7QW.js";
+import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, An as SHELL_ACTIVE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, Ct as RETRY_AUXILIARY_OWNER, Dn as normalizeAwsError, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as isUpdateUnsupportedError, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as withheldTargetClause, Ht as recoveryCommandFlags, In as pasteableCommand, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as isNameCooldownError, Kn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as physicalIdShownBesideCommand, M as quotedRemedyLogicalId, Mn as UNSHOWABLE_VALUE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Ot as hasCreatedBeforeFailure, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as plainOrDescribed, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Ut as sanitizeRecoveryValue, Vn as shellQuote, Vt as formatLockOwner, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isReplayedNameCollisionFrom, Yn as isRecreateRetryableError, Yt as producerRecordKey, Zt as withPasteableAwsProfile, _t as createMaskedLogSinks, ar as isRetryableTransientError, at as startInterruptWatch, bn as ResourceUpdateNotSupportedError, bt as maskDeep, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dr as markNonRetryable, en as clientDefaultsFor, er as formatRetryClassificationSignals, f as removalWarning, fr as markRedactedCause, ft as logicalIdShown, gt as stateOrphanRecordRemedy, hn as MalformedProducerRecordRefusalError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isIamPropagationError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as SHELL_ACTIVE_WHY, jt as markAuxiliaryFailure, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DynamicReferenceRegionAmbiguousError, lr as isMarkedNonRetryable, m as withoutInjectedRemovals, mn as MacroExpansionError, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, on as CrossAccountSecretRefusalError, or as isTransientServerError, ot as ElapsedBudgetRegistry, pn as LockError, pr as wrapMaskedAwsError, qn as isNameCollisionErrorFrom, rn as AssetError, sn as DependencyError, sr as retryClassificationText, st as monotonicNowMs, tn as credentialFingerprint, tr as isAmbiguousCcHandlerErrorCode, un as IntrinsicResolutionRefusalError, ur as isThrottlingError, ut as compositeIdSeparatorRefusal, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as SynthesisError, wt as carryCreatedBeforeFailure, xt as maskerOrIdentity, yn as ResourceTimeoutError, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-DFk7zr0Q.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-DBXBcg0J.js";
-import { t as getCdkdVersion } from "./version-DTSDiQcV.js";
+import { t as getCdkdVersion } from "./version-BdWNHoO2.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2888,6 +2888,12 @@ const DOCKER_CLIENT_ENV_KEYS = /* @__PURE__ */ new Set([
 	"USERPROFILE",
 	"HOMEDRIVE",
 	"HOMEPATH",
+	"COMSPEC",
+	"SYSTEMROOT",
+	"WINDIR",
+	"SYSTEMDRIVE",
+	"PSMODULEPATH",
+	"PSEXECUTIONPOLICYPREFERENCE",
 	"DOCKER_HOST",
 	"DOCKER_CONTEXT",
 	"DOCKER_CONFIG",
@@ -3016,10 +3022,13 @@ const WELL_FORMED_ENV_KEY = /^[^=\0]+$/;
 function isMalformedEnvKey(key) {
 	return !WELL_FORMED_ENV_KEY.test(key);
 }
-function partitionSensitiveEnv(env, sensitiveKeys) {
+function partitionSensitiveEnv(env, sensitiveKeys, options = {}) {
+	const platform = options.platform ?? process.platform;
 	const flags = [];
 	const sensitiveEnv = {};
 	const collisions = [];
+	const names = platform === "win32" ? new Win32EnvNames(Object.keys(process.env)) : void 0;
+	const ambiguous = [];
 	for (const [k, v] of Object.entries(env)) {
 		if (!sensitiveKeys.has(k)) {
 			flags.push("-e", `${k}=${v}`);
@@ -3029,19 +3038,73 @@ function partitionSensitiveEnv(env, sensitiveKeys) {
 			collisions.push(k);
 			continue;
 		}
+		if (names) {
+			if (names.lookup(k).ambiguous) {
+				ambiguous.push(k);
+				continue;
+			}
+			names.replace(k);
+		}
 		flags.push("-e", k);
 		defineOwnKey(sensitiveEnv, k, v);
 	}
+	if (ambiguous.length > 0) getLogger().warn((options.subject === void 0 ? "" : safeMsg`${options.subject}: `) + safeMsg`Sensitive env var(s) ${ambiguous.map((k) => displayIdent(k)).join(", ")} ` + "were NOT passed to the container. On Windows each matches another variable's name (in your environment or another secret) only through a letter-case difference outside A-Z, which cdkd does not treat as the same variable. Rename the secret if the container needs it.");
+	if (names) warnCaseVariantSensitiveKeys(Object.keys(sensitiveEnv), options.subject);
 	return {
 		flags,
 		sensitiveEnv,
 		collisions
 	};
 }
-function dockerSpawnEnvWithSensitive(sensitiveEnv) {
+function warnCaseVariantSensitiveKeys(keys, subject) {
+	const byUpper = /* @__PURE__ */ new Map();
+	for (const k of keys) {
+		const upper = asciiUpper(k);
+		const group = byUpper.get(upper);
+		if (group) group.push(k);
+		else byUpper.set(upper, [k]);
+	}
+	for (const group of byUpper.values()) {
+		if (group.length < 2) continue;
+		getLogger().warn((subject === void 0 ? "" : safeMsg`${subject}: `) + safeMsg`Sensitive env vars ${group.map((k) => displayIdent(k)).join(", ")} differ only by letter case. ` + safeMsg`Windows treats them as one variable, so the container receives the value of ` + safeMsg`${displayIdent(group[group.length - 1])} under every one of these names. ` + `Rename them to distinct names if the container needs each value.`);
+	}
+}
+function asciiUpper(name) {
+	return name.replace(/[a-z]/g, (c) => c.toUpperCase());
+}
+var Win32EnvNames = class {
+	groups = /* @__PURE__ */ new Map();
+	constructor(names) {
+		for (const name of names) {
+			const key = name.toUpperCase();
+			const group = this.groups.get(key);
+			if (group) group.push(name);
+			else this.groups.set(key, [name]);
+		}
+	}
+	lookup(name) {
+		const others = (this.groups.get(name.toUpperCase()) ?? []).filter((n) => n !== name);
+		const folded = asciiUpper(name);
+		return {
+			aliases: others,
+			ambiguous: others.some((n) => asciiUpper(n) !== folded)
+		};
+	}
+	replace(name) {
+		this.groups.set(name.toUpperCase(), [name]);
+	}
+};
+function dockerSpawnEnvWithSensitive(sensitiveEnv, platform = process.platform) {
 	const env = { ...process.env };
+	const names = platform === "win32" ? new Win32EnvNames(Object.keys(env)) : void 0;
 	for (const [k, v] of Object.entries(sensitiveEnv)) {
 		if (isMalformedEnvKey(k) || isDockerClientEnvKey(k)) continue;
+		if (names) {
+			const { aliases, ambiguous } = names.lookup(k);
+			if (ambiguous) continue;
+			for (const alias of aliases) delete env[alias];
+			names.replace(k);
+		}
 		defineOwnKey(env, k, v);
 	}
 	return env;
@@ -4895,11 +4958,22 @@ function refuseMalformedOperation(shownStack, where, op) {
 	if (o["oldResourceMaySurvive"] !== void 0 && !["kept", "unconfirmed"].includes(o["oldResourceMaySurvive"])) fail("oldResourceMaySurvive", o["oldResourceMaySurvive"], "kept or unconfirmed when present");
 	if (o["physicalIdRecoveredFromError"] !== void 0 && typeof o["physicalIdRecoveredFromError"] !== "boolean") fail("physicalIdRecoveredFromError", o["physicalIdRecoveredFromError"], "a boolean when present");
 	if (o["physicalIdRecoveredFromError"] !== void 0 && o["changeType"] !== "CREATE") refuseMalformed(shownStack, `${where}.physicalIdRecoveredFromError is only valid on a CREATE (got changeType ${kind(o["changeType"])}).`);
+	const pending = o["pendingCloudControlRequest"];
+	if (pending !== void 0) {
+		const p = pending;
+		if (typeof pending !== "object" || pending === null || Array.isArray(pending) || typeof p["requestToken"] !== "string" || !/^[-A-Za-z0-9+/=]{1,128}$/.test(p["requestToken"]) || typeof p["abandonedAt"] !== "number" || !Number.isFinite(p["abandonedAt"])) fail("pendingCloudControlRequest", pending, "an object with a Cloud Control requestToken and a numeric abandonedAt when present");
+		if (o["changeType"] !== "CREATE" || o["physicalId"] !== void 0 || o["physicalIdRecoveredFromError"] !== void 0) refuseMalformed(shownStack, `${where}.pendingCloudControlRequest is only valid on a CREATE with no physicalId.`);
+	}
 	const identity = o["createdResourceIdentity"];
 	if (identity !== void 0) {
 		if (typeof identity !== "string" || identity === "") fail("createdResourceIdentity", identity, "a non-empty string when present");
 		if (typeof o["physicalIdRecoveredFromError"] !== "boolean") refuseMalformed(shownStack, `${where}.createdResourceIdentity is only valid on a CREATE carrying physicalIdRecoveredFromError.`);
 	}
+	const unique = o["createdIdentifierUnique"];
+	if (unique !== void 0) {
+		if (typeof unique !== "boolean") fail("createdIdentifierUnique", unique, "a boolean when present");
+		if (typeof o["physicalIdRecoveredFromError"] !== "boolean" || o["provisionedBy"] !== "cc-api") refuseMalformed(shownStack, `${where}.createdIdentifierUnique is only valid on a Cloud Control CREATE carrying physicalIdRecoveredFromError.`);
+	}
 	if (o["deletionPolicy"] !== void 0 && ![
 		"Delete",
 		"Retain",
@@ -6395,6 +6469,25 @@ var S3StateBackend = class S3StateBackend {
 		await this.putRawObject(this.getRollbackJournalKey(stackName, region), JSON.stringify(journal, null, 2));
 		return removed;
 	}
+	async rewriteRollbackJournalFailedOperations(stackName, region, rewrite) {
+		const journal = await this.loadRollbackJournal(stackName, region);
+		if (!journal) return 0;
+		let changed = 0;
+		for (const segment of journal.segments) {
+			if (!segment.failedOperations) continue;
+			const next = [];
+			for (const op of segment.failedOperations) {
+				const out = rewrite(op, segment);
+				if (out !== op) changed++;
+				if (out !== null) next.push(out);
+			}
+			if (next.length === 0) delete segment.failedOperations;
+			else segment.failedOperations = next;
+		}
+		if (changed === 0) return 0;
+		await this.putRawObject(this.getRollbackJournalKey(stackName, region), JSON.stringify(journal, null, 2));
+		return changed;
+	}
 	async reduceRollbackJournalToFailedOperations(stackName, region, keep, supersededLogicalIds = [], demote = () => false) {
 		const journal = await this.loadRollbackJournal(stackName, region);
 		if (!journal) return 0;
@@ -7672,6 +7765,40 @@ function positionByCrossStackSource(bag, source, secrets) {
 	return certifiedExpressionForLeaf(secrets, association, bag);
 }
 
+//#endregion
+//#region src/deployment/secret-redaction/resolver-outcomes.ts
+const CONFLICTING = Symbol("cdkd.resolver-outcome.conflicting");
+const takenBranches = /* @__PURE__ */ new WeakMap();
+function recordTakenIfBranch(secrets, source, tookTrueBranch) {
+	let taken = takenBranches.get(secrets);
+	if (taken === void 0) {
+		taken = /* @__PURE__ */ new WeakMap();
+		takenBranches.set(secrets, taken);
+	}
+	const previous = taken.get(source);
+	if (previous === void 0) taken.set(source, tookTrueBranch);
+	else if (previous !== tookTrueBranch) taken.set(source, CONFLICTING);
+}
+function takenIfBranchOf(secrets, source) {
+	const taken = takenBranches.get(secrets)?.get(source);
+	return taken === CONFLICTING ? void 0 : taken;
+}
+const droppedElements = /* @__PURE__ */ new WeakMap();
+function recordDroppedArrayElements(secrets, source, dropped) {
+	let arrays = droppedElements.get(secrets);
+	if (arrays === void 0) {
+		arrays = /* @__PURE__ */ new WeakMap();
+		droppedElements.set(secrets, arrays);
+	}
+	const previous = arrays.get(source);
+	if (previous === void 0) arrays.set(source, [...dropped]);
+	else if (previous !== CONFLICTING && (previous.length !== dropped.length || previous.some((index, i) => index !== dropped[i]))) arrays.set(source, CONFLICTING);
+}
+function droppedArrayElementsOf(secrets, source) {
+	const dropped = droppedElements.get(secrets)?.get(source);
+	return dropped === CONFLICTING ? void 0 : dropped;
+}
+
 //#endregion
 //#region src/deployment/secret-redaction/physical-name-copies.ts
 const physicalNameCopiesOf = /* @__PURE__ */ new WeakMap();
@@ -8086,6 +8213,34 @@ function positionByInheritedParameter(bag, source, secrets) {
 	if (!deepEqualJsonValue(redactSecretsForState(answer, secrets), answer)) return void 0;
 	return answer;
 }
+const REREAD_PSEUDO_PARAMETERS = /* @__PURE__ */ new Set([
+	"AWS::Region",
+	"AWS::Partition",
+	"AWS::URLSuffix"
+]);
+const inheritedPseudoParameters = /* @__PURE__ */ new WeakMap();
+const POISONED_PSEUDO_PARAMETERS = Symbol("cdkd.inherited-pseudo-parameters.poisoned");
+function recordInheritedPseudoParameters(inheritedSecrets, values) {
+	let table = inheritedPseudoParameters.get(inheritedSecrets);
+	if (table === POISONED_PSEUDO_PARAMETERS) return;
+	if (table === void 0) {
+		table = /* @__PURE__ */ new Map();
+		inheritedPseudoParameters.set(inheritedSecrets, table);
+	}
+	for (const [name, value] of values) {
+		if (!REREAD_PSEUDO_PARAMETERS.has(name) || typeof value !== "string") continue;
+		const known = table.get(name);
+		if (known !== void 0 && known !== value) {
+			inheritedPseudoParameters.set(inheritedSecrets, POISONED_PSEUDO_PARAMETERS);
+			return;
+		}
+		table.set(name, value);
+	}
+}
+function pseudoBindingOf(parentSecrets) {
+	const table = inheritedPseudoParameters.get(parentSecrets);
+	return (name) => table instanceof Map && table.has(name) ? { value: table.get(name) } : void 0;
+}
 const REREAD_TRIGGERS = /* @__PURE__ */ new Set([
 	"Fn::Select",
 	"Fn::Split",
@@ -8124,9 +8279,9 @@ function standsForInheritedSecret(parentSecrets, token) {
 	return parentSecrets !== void 0 && resolvedPlaintextOf(parentSecrets, token) !== void 0;
 }
 const plainSplit = (text, delimiter) => text.split(delimiter);
-function evaluatePureRead(node, bind, split, choose, depth = 0) {
+function evaluatePureRead(node, bind, pseudo, split, choose, depth = 0) {
 	if (depth > MAX_REREAD_DEPTH) return void 0;
-	const evaluate = (child) => evaluatePureRead(child, bind, split, choose, depth + 1);
+	const evaluate = (child) => evaluatePureRead(child, bind, pseudo, split, choose, depth + 1);
 	if (typeof node === "string") return node.includes("{{resolve:") ? void 0 : { value: node };
 	if (Array.isArray(node)) {
 		const out = [];
@@ -8144,13 +8299,15 @@ function evaluatePureRead(node, bind, split, choose, depth = 0) {
 	const args = node[key];
 	if (key === "Ref") {
 		if (args === "AWS::NoValue") return { value: REREAD_NO_VALUE };
-		return typeof args === "string" ? bind(args) : void 0;
+		return typeof args === "string" ? bindReadName(args, bind, pseudo) : void 0;
 	}
 	if (key === "Fn::If") {
 		if (!Array.isArray(args) || args.length !== 3 || typeof args[0] !== "string") return void 0;
-		return evaluate(choose(args[0]) ? args[1] : args[2]);
+		const tookTrue = choose(args[0], node);
+		if (tookTrue === void 0) return void 0;
+		return evaluate(tookTrue ? args[1] : args[2]);
 	}
-	if (key === "Fn::Sub") return evaluatePureSub(args, bind, evaluate);
+	if (key === "Fn::Sub") return evaluatePureSub(args, bind, pseudo, evaluate);
 	if (!Array.isArray(args) || args.length !== 2) return void 0;
 	if (key === "Fn::Select") {
 		const index = args[0];
@@ -8174,7 +8331,7 @@ function evaluatePureRead(node, bind, split, choose, depth = 0) {
 		return { value: parts.value.join(delimiter) };
 	}
 }
-function evaluatePureSub(args, bind, evaluate) {
+function evaluatePureSub(args, bind, pseudo, evaluate) {
 	const [text, variables] = typeof args === "string" ? [args, {}] : Array.isArray(args) && args.length === 2 ? [args[0], args[1]] : [void 0, void 0];
 	if (typeof text !== "string" || text.includes("{{resolve:") || !isPlainObject$7(variables)) return;
 	const bound = /* @__PURE__ */ new Map();
@@ -8192,8 +8349,8 @@ function evaluatePureSub(args, bind, evaluate) {
 		else if (name === "") replacement = match[0];
 		else if (bound.has(name)) replacement = bound.get(name);
 		else {
-			if (name.startsWith("AWS::") || name.includes(".")) return void 0;
-			const value = bind(name);
+			if (name.includes(".")) return void 0;
+			const value = bindReadName(name, bind, pseudo);
 			if (value === void 0 || typeof value.value !== "string") return void 0;
 			replacement = value.value;
 		}
@@ -8202,6 +8359,10 @@ function evaluatePureSub(args, bind, evaluate) {
 	}
 	return { value: out + text.slice(cursor) };
 }
+function bindReadName(name, bind, pseudo) {
+	if (!name.startsWith("AWS::")) return bind(name);
+	return bind(name) === void 0 ? pseudo(name) : void 0;
+}
 function collectRereadConditions(node, names, depth = 0) {
 	if (depth > MAX_REREAD_DEPTH) return false;
 	if (Array.isArray(node)) return node.every((element) => collectRereadConditions(element, names, depth + 1));
@@ -8228,17 +8389,57 @@ function rendersReadTo(spelling, parentSecrets, value) {
 	return false;
 }
 const REREAD_UNBOUND = Symbol("cdkd.reread.unbound");
-function rereadAssignments(source, bind, parentSecrets, untakenWhenUnbound = () => false) {
+const REREAD_PARAMETER_FREE = Symbol("cdkd.reread.parameter-free");
+function diffSideReading(bind, parentSecrets) {
+	return {
+		bind: (name) => {
+			const bound = bind(name);
+			return bound && { value: redactInheritedParameterValue(parentSecrets, name, bound.value) };
+		},
+		split: (text, delimiter) => splitOutsideDynamicReferences(text, delimiter, (token) => standsForInheritedSecret(parentSecrets, token))
+	};
+}
+function rereadUnder(source, bind, parentSecrets, choose) {
+	const pseudo = pseudoBindingOf(parentSecrets);
+	const resolved = evaluatePureRead(source, bind, pseudo, plainSplit, choose);
+	if (resolved === void 0) return void 0;
+	const diffSide = diffSideReading(bind, parentSecrets);
+	const redacted = evaluatePureRead(source, diffSide.bind, pseudo, diffSide.split, choose);
+	if (redacted === void 0) return void 0;
+	if (resolved.value === REREAD_NO_VALUE || redacted.value === REREAD_NO_VALUE) return resolved.value === redacted.value ? REREAD_NO_VALUE : void 0;
+	if (!rendersReadTo(redacted.value, parentSecrets, resolved.value)) return void 0;
+	return {
+		resolved: resolved.value,
+		redacted: redacted.value
+	};
+}
+function namesParameterOnBranches(node, choose, isParameter, depth = 0) {
+	if (depth > MAX_REREAD_DEPTH) return true;
+	if (typeof node === "string") return node.includes("{{resolve:");
+	if (Array.isArray(node)) return node.some((element) => namesParameterOnBranches(element, choose, isParameter, depth + 1));
+	if (!isPlainObject$7(node)) return false;
+	if (Object.hasOwn(node, "Fn::If")) {
+		const args = node["Fn::If"];
+		if (Object.keys(node).length !== 1) return true;
+		if (!Array.isArray(args) || args.length !== 3 || typeof args[0] !== "string") return true;
+		const tookTrue = choose(args[0], node);
+		if (tookTrue === void 0) return true;
+		return namesParameterOnBranches(tookTrue ? args[1] : args[2], choose, isParameter, depth + 1);
+	}
+	if (typeof node["Ref"] === "string" && isParameter(node["Ref"])) return true;
+	const sub = node["Fn::Sub"];
+	const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
+	if (typeof text === "string") {
+		for (const match of text.matchAll(/\$\{([^}!][^}]*)\}/g)) if (isParameter(match[1].trim()) || isParameter(match[1])) return true;
+	}
+	return Object.values(node).some((child) => namesParameterOnBranches(child, choose, isParameter, depth + 1));
+}
+function rereadAssignments(source, bind, parentSecrets, untakenWhenUnbound = () => false, parameterFree) {
 	if (!holdsRereadTrigger(source)) return void 0;
 	const conditions = /* @__PURE__ */ new Set();
 	if (!collectRereadConditions(source, conditions)) return void 0;
 	if (conditions.size > MAX_REREAD_CONDITIONS) return void 0;
 	const names = [...conditions];
-	const redactedBind = (name) => {
-		const bound = bind(name);
-		return bound && { value: redactInheritedParameterValue(parentSecrets, name, bound.value) };
-	};
-	const tokenSplit = (text, delimiter) => splitOutsideDynamicReferences(text, delimiter, (token) => standsForInheritedSecret(parentSecrets, token));
 	const out = [];
 	for (let assignment = 0; assignment < 2 ** names.length; assignment++) {
 		const choose = (condition) => Math.floor(assignment / 2 ** names.indexOf(condition)) % 2 === 1;
@@ -8248,25 +8449,18 @@ function rereadAssignments(source, bind, parentSecrets, untakenWhenUnbound = ()
 			if (bound === void 0 && untakenWhenUnbound(name)) unbound = true;
 			return bound;
 		};
-		const resolved = evaluatePureRead(source, tracked, plainSplit, choose);
-		const redacted = resolved && evaluatePureRead(source, redactedBind, tokenSplit, choose);
+		const reread = rereadUnder(source, tracked, parentSecrets, choose);
 		if (unbound) out.push(REREAD_UNBOUND);
-		else if (resolved === void 0 || redacted === void 0) out.push(void 0);
-		else if (resolved.value === REREAD_NO_VALUE || redacted.value === REREAD_NO_VALUE) out.push(resolved.value === redacted.value ? REREAD_NO_VALUE : void 0);
-		else if (!rendersReadTo(redacted.value, parentSecrets, resolved.value)) out.push(void 0);
-		else out.push({
-			resolved: resolved.value,
-			redacted: redacted.value
-		});
+		else if (reread !== void 0) out.push(reread);
+		else if (parameterFree !== void 0 && !namesParameterOnBranches(source, choose, parameterFree)) out.push(REREAD_PARAMETER_FREE);
+		else out.push(void 0);
 	}
 	return out;
 }
 function rereadParameterExpression(source, bind, parentSecrets) {
-	const assignments = rereadAssignments(source, bind, parentSecrets);
+	const assignments = rereadAssignments(source, bind, parentSecrets, void 0, (name) => bind(name) !== void 0);
 	if (assignments === void 0 || assignments.includes(void 0) || assignments.includes(REREAD_UNBOUND)) return;
-	const rereads = assignments.filter((entry) => entry !== void 0 && entry !== REREAD_NO_VALUE && entry !== REREAD_UNBOUND);
-	if (rereads.length === 0 || ambiguousRereads(rereads)) return void 0;
-	return rereads[0];
+	return assignments.find((entry) => entry !== void 0 && entry !== REREAD_NO_VALUE && entry !== REREAD_UNBOUND && entry !== REREAD_PARAMETER_FREE);
 }
 function ambiguousRereads(rereads) {
 	return rereads.some((a, i) => rereads.slice(i + 1).some((b) => deepEqualJsonValue(a.resolved, b.resolved) && !deepEqualJsonValue(a.redacted, b.redacted)));
@@ -8275,13 +8469,27 @@ function positionByParameterReread(bag, source, secrets) {
 	const reads = inheritedParameterReads.get(secrets);
 	if (reads === void 0 || typeof reads === "symbol") return void 0;
 	if (typeof bag !== "string" && !Array.isArray(bag)) return void 0;
-	const declared = reads.declared;
-	const assignments = rereadAssignments(source, (name) => reads.values.has(name) ? { value: reads.values.get(name) } : void 0, reads.parent, (name) => declared?.has(name) === true);
-	if (assignments === void 0 || assignments.includes(void 0)) return void 0;
-	const matching = assignments.filter((entry) => entry !== void 0 && entry !== REREAD_NO_VALUE && entry !== REREAD_UNBOUND && deepEqualJsonValue(entry.resolved, bag));
-	if (matching.length === 0 || ambiguousRereads(matching)) return void 0;
+	if (!holdsRereadTrigger(source)) return void 0;
+	const bind = (name) => reads.values.has(name) ? { value: reads.values.get(name) } : void 0;
+	let unrecorded = false;
+	const recorded = rereadUnder(source, bind, reads.parent, (_, node) => {
+		const taken = takenIfBranchOf(secrets, node);
+		if (taken === void 0) unrecorded = true;
+		return taken;
+	});
+	let answer;
+	if (!unrecorded) {
+		if (recorded === void 0 || recorded === REREAD_NO_VALUE || !deepEqualJsonValue(recorded.resolved, bag)) return;
+		answer = recorded.redacted;
+	} else {
+		const declared = reads.declared;
+		const assignments = rereadAssignments(source, bind, reads.parent, (name) => declared?.has(name) === true);
+		if (assignments === void 0 || assignments.includes(void 0)) return void 0;
+		const matching = assignments.filter((entry) => entry !== void 0 && entry !== REREAD_NO_VALUE && entry !== REREAD_UNBOUND && entry !== REREAD_PARAMETER_FREE && deepEqualJsonValue(entry.resolved, bag));
+		if (matching.length === 0 || ambiguousRereads(matching)) return void 0;
+		answer = matching[0].redacted;
+	}
 	if (carriesChildOnlyPlaintext(bag, secrets, reads.parent)) return void 0;
-	const answer = matching[0].redacted;
 	if (!deepEqualJsonValue(redactSecretsForState(answer, secrets), answer)) return void 0;
 	return answer;
 }
@@ -8542,7 +8750,12 @@ function arrayElementDrop(element, depth = 0) {
 	if (branches.every((branch) => branch === "always")) return "always";
 	return "maybe";
 }
-function sourceElementsKeptFor(source, bagLength) {
+function sourceElementsKeptFor(source, bagLength, secrets) {
+	const recorded = secrets && droppedArrayElementsOf(secrets, source);
+	if (recorded !== void 0) {
+		if (source.length - recorded.length !== bagLength) return void 0;
+		return source.filter((_, i) => !recorded.includes(i));
+	}
 	const drops = source.map((element) => arrayElementDrop(element));
 	if (drops.includes("unknown")) return void 0;
 	const always = drops.filter((drop) => drop === "always").length;
@@ -8587,8 +8800,7 @@ function corroboratesWhateverResolves(source, depth = 0) {
 }
 function arrayPairsWhateverDrops(source) {
 	if (!source.some((element) => isPlainObject$7(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue" || Array.isArray(element["Fn::FindInMap"]) && element["Fn::FindInMap"].length > 3))) return true;
-	const drops = source.map((element) => arrayElementDrop(element));
-	return !drops.includes("unknown") && drops.filter((drop) => drop === "maybe").length <= 1 && source.every((element) => corroboratesWhateverResolves(element));
+	return source.every((element) => corroboratesWhateverResolves(element));
 }
 function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameGeneration) {
 	if (isDynamicReferenceString(source) && typeof bag === "string") {
@@ -8645,7 +8857,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration));
 		if (rules.descendArrays && bag.length < source.length) {
-			const kept = sourceElementsKeptFor(source, bag.length);
+			const kept = sourceElementsKeptFor(source, bag.length, secrets);
 			if (kept !== void 0 && keptLiteralsCorroborate(kept, bag, secrets)) return bag.map((item, i) => redactByPath(item, kept[i], secrets, rules, secretExpressions, bagIsSameGeneration));
 		}
 	}
@@ -22925,6 +23137,281 @@ async function resolveSub(subArgs, context, source) {
 	return result;
 }
 
+//#endregion
+//#region src/deployment/intrinsic-resolver/parameter-secrets.ts
+function recordInheritedParameterSecrets(parameterName, value, context) {
+	const inherited = context.inheritedSecrets;
+	const recorded = context.recordedSecretValues;
+	if (inherited && recorded) carryLogOnlyValuesCarriedBy(inherited, recorded, value);
+	if (recorded) carryPhysicalNameCopiesCarriedBy(context, recorded, value);
+	if (inherited && recorded) recordInheritedNoEchoListElements(this, inherited, recorded, value, context);
+	if (!inherited || inherited.size === 0 || !recorded) return;
+	const mirror = parameterReadMirrors.get(recorded);
+	const declared = declaredParameterNames(context);
+	recordInheritedParameterValue(recorded, inherited, parameterName, value, declared);
+	if (mirror) recordInheritedParameterValue(mirror, inherited, parameterName, value, declared);
+	for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) {
+		const carried = carriedExpressionFor(inherited, parameterName, value, plaintext, expression);
+		recorded.set(plaintext, carried);
+		const parentEntry = context.inheritedReferenceProvenance?.get(carried);
+		if (parentEntry !== void 0) recordReferenceProvenanceEntry(recorded, carried, parentEntry, "read");
+		recordInheritedParameterRead(recorded, inherited, parameterName);
+		if (mirror) recordInheritedParameterRead(mirror, inherited, parameterName);
+		carryFreshNoEchoMark(inherited, recorded, plaintext);
+	}
+}
+async function recordInheritedPseudoParameterValues(resolver, inherited) {
+	if (inherited.size === 0) return;
+	const values = /* @__PURE__ */ new Map();
+	for (const name of [
+		"AWS::Region",
+		"AWS::Partition",
+		"AWS::URLSuffix"
+	]) values.set(name, await resolver.resolvePseudoParameter(name));
+	recordInheritedPseudoParameters(inherited, values);
+}
+function declaredParameterNames(context) {
+	const declared = context.template?.Parameters;
+	if (declared === null || typeof declared !== "object") return void 0;
+	let names = declaredNamesCache.get(declared);
+	if (names === void 0) {
+		names = new Set(Object.keys(declared));
+		declaredNamesCache.set(declared, names);
+	}
+	return names;
+}
+const declaredNamesCache = /* @__PURE__ */ new WeakMap();
+const parameterReadMirrors = /* @__PURE__ */ new WeakMap();
+function mirrorInheritedParameterReads(passSecrets, persistSecrets) {
+	if (passSecrets !== persistSecrets) parameterReadMirrors.set(passSecrets, persistSecrets);
+}
+function recordTakenIfBranchIn(context, source, tookTrueBranch) {
+	if (!context.inheritedSecrets || context.inheritedSecrets.size === 0) return;
+	const recorded = context.recordedSecretValues;
+	if (recorded === void 0) return;
+	recordTakenIfBranch(recorded, source, tookTrueBranch);
+	const mirror = parameterReadMirrors.get(recorded);
+	if (mirror) recordTakenIfBranch(mirror, source, tookTrueBranch);
+}
+function recordDroppedArrayElementsIn(context, source, dropped) {
+	const recorded = context.recordedSecretValues;
+	if (recorded === void 0) return;
+	recordDroppedArrayElements(recorded, source, dropped);
+	const mirror = parameterReadMirrors.get(recorded);
+	if (mirror) recordDroppedArrayElements(mirror, source, dropped);
+}
+function carryPhysicalNameCopiesCarriedBy(context, recorded, value) {
+	const names = context.inheritedPhysicalNameCopies ?? (context.inheritedSecrets && physicalNameCopiesOf.get(context.inheritedSecrets));
+	if (names === void 0 || names.size === 0) return;
+	const leaves = [...wholeStringLeavesOf(value)];
+	for (const name of names) if (leaves.some((leaf) => leaf.includes(name))) recordPhysicalNameCopy(recorded, name);
+}
+function carriedExpressionFor(inherited, parameterName, value, plaintext, survivor) {
+	const own = inheritedParameterExpression(inherited, parameterName, plaintext);
+	if (typeof own === "string") return own;
+	return inheritedRenderedToken(inherited, parameterName, value, plaintext) ?? survivor;
+}
+function poisonRenderedSpellingsCollidingIn(template, parameterValues, inherited) {
+	if (!inherited || inherited.size === 0 || template === void 0) return;
+	const names = new Set(Object.keys(parameterValues));
+	if (names.size < 2) return;
+	const groups = [];
+	if (template.Resources !== null && typeof template.Resources === "object") for (const resource of Object.values(template.Resources)) groups.push([{
+		node: resource,
+		mode: "resource"
+	}]);
+	if (template.Outputs !== void 0) groups.push(outputsGroupParts(template.Outputs));
+	const bind = (name) => Object.hasOwn(parameterValues, name) ? { value: parameterValues[name] } : void 0;
+	const withdrawn = /* @__PURE__ */ new Set();
+	for (;;) {
+		const fresh = [...collidingRenderedNames(groups.map((parts) => {
+			const reads = /* @__PURE__ */ new Map();
+			for (const { node, mode } of parts) {
+				const reread = mode === "slot" ? void 0 : {
+					bind,
+					inherited
+				};
+				for (const [name, slotRead] of parameterReadsOf(node, names, reread, mode !== "output")) reads.set(name, slotRead || reads.get(name) === true);
+			}
+			return reads;
+		}).filter((reads) => reads.size >= 2), parameterValues, inherited)].filter((name) => !withdrawn.has(name));
+		if (fresh.length === 0) return;
+		for (const name of fresh) {
+			withdrawn.add(name);
+			withdrawRenderedParameterSpelling(inherited, name);
+		}
+	}
+}
+function collidingRenderedNames(readsByGroup, parameterValues, inherited) {
+	const withdraw = /* @__PURE__ */ new Set();
+	for (const reads of readsByGroup) {
+		const byPlaintext = /* @__PURE__ */ new Map();
+		const slotReadPlaintexts = /* @__PURE__ */ new Set();
+		for (const [name, slotRead] of reads) {
+			if (!Object.hasOwn(parameterValues, name)) continue;
+			const value = parameterValues[name];
+			for (const [plaintext, survivor] of inheritedSecretsCarriedBy(value, inherited)) {
+				const expression = carriedExpressionFor(inherited, name, value, plaintext, survivor);
+				const rendered = typeof inheritedParameterExpression(inherited, name, plaintext) !== "string" && inheritedRenderedToken(inherited, name, value, plaintext) !== void 0;
+				let byExpression = byPlaintext.get(plaintext);
+				if (byExpression === void 0) {
+					byExpression = /* @__PURE__ */ new Map();
+					byPlaintext.set(plaintext, byExpression);
+				}
+				let renderedNames = byExpression.get(expression);
+				if (renderedNames === void 0) {
+					renderedNames = [];
+					byExpression.set(expression, renderedNames);
+				}
+				if (rendered) renderedNames.push(name);
+				if (slotRead) slotReadPlaintexts.add(plaintext);
+			}
+		}
+		for (const [plaintext, byExpression] of byPlaintext) {
+			if (byExpression.size < 2 || !slotReadPlaintexts.has(plaintext)) continue;
+			for (const renderedNames of byExpression.values()) for (const name of renderedNames) withdraw.add(name);
+		}
+	}
+	return withdraw;
+}
+const POSITIONED_INTRINSICS = /* @__PURE__ */ new Set(["Fn::Join", "Fn::Sub"]);
+function parameterReadsOf(node, names, reread, positionsArrays) {
+	const reads = /* @__PURE__ */ new Map();
+	const add = (name, slotRead) => {
+		reads.set(name, slotRead || reads.get(name) === true);
+	};
+	const visit = (value, slotRead, atLeaf) => {
+		if (Array.isArray(value)) {
+			const mayShrink = atLeaf ? !positionsArrays || !arrayPairsWhateverDrops(value) : value.some((element) => element !== null && typeof element === "object" && !Array.isArray(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue"));
+			for (const element of value) visit(element, slotRead || mayShrink, atLeaf && !mayShrink);
+			return;
+		}
+		if (value === null || typeof value !== "object") return;
+		const record = value;
+		const intrinsic = Object.keys(record).some((key) => key === "Ref" || key.startsWith("Fn::"));
+		if (intrinsic && atLeaf && reread !== void 0 && rereadParameterExpression(record, reread.bind, reread.inherited) !== void 0) {
+			for (const name of refNamesIn(record, names)) add(name, false);
+			return;
+		}
+		const ref = record["Ref"];
+		if (typeof ref === "string" && names.has(ref)) add(ref, slotRead);
+		const placeholderSlot = !positionsArrays && unkeyedPlaceholderParts(record, (name) => certifiesPlaceholder(name, reread)) > MAX_UNKEYED_PARTS;
+		const sub = record["Fn::Sub"];
+		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
+		if (typeof text === "string") for (const match of text.matchAll(/\$\{([^}!][^}]*)\}/g)) {
+			const name = match[1].trim();
+			if (names.has(name)) add(name, slotRead || placeholderSlot);
+		}
+		for (const [key, child] of Object.entries(record)) visit(child, slotRead || placeholderSlot || key.startsWith("Fn::") && !POSITIONED_INTRINSICS.has(key), atLeaf && !intrinsic);
+	};
+	visit(node, reread === void 0, true);
+	return reads;
+}
+const MAX_UNKEYED_PARTS = 1;
+function certifiesPlaceholder(name, reread) {
+	if (reread === void 0) return false;
+	const bound = reread.bind(name);
+	if (bound === void 0) return false;
+	if (inheritedSecretsCarriedBy(bound.value, reread.inherited).length === 0) return false;
+	return typeof inheritedParameterExpression(reread.inherited, name, bound.value) === "string";
+}
+function unkeyedPlaceholderParts(record, certified) {
+	const keyed = (value) => typeof value === "string" || value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 1 && typeof value["Ref"] === "string" && certified(value["Ref"]);
+	if (Object.hasOwn(record, "Fn::Join")) {
+		const args = record["Fn::Join"];
+		if (!Array.isArray(args) || args.length !== 2 || !Array.isArray(args[1])) return Number.POSITIVE_INFINITY;
+		return args[1].filter((part) => !keyed(part)).length;
+	}
+	if (Object.hasOwn(record, "Fn::Sub")) {
+		const args = record["Fn::Sub"];
+		const [template, variables] = typeof args === "string" ? [args, {}] : Array.isArray(args) ? [args[0], args[1]] : [];
+		if (typeof template !== "string" || variables === null || typeof variables !== "object") return Number.POSITIVE_INFINITY;
+		let unkeyed = 0;
+		for (const hit of template.matchAll(/\$\{(!)?([^}]*)\}/g)) {
+			const name = hit[2] ?? "";
+			if (hit[1] === "!" || name === "") continue;
+			if (!(Object.hasOwn(variables, name) ? keyed(variables[name]) : certified(name))) unkeyed += 1;
+		}
+		return unkeyed;
+	}
+	return 0;
+}
+function outputsGroupParts(outputs) {
+	if (outputs === null || typeof outputs !== "object" || Array.isArray(outputs)) return [{
+		node: outputs,
+		mode: "slot"
+	}];
+	const parts = [];
+	for (const output of Object.values(outputs)) {
+		if (output === null || typeof output !== "object" || Array.isArray(output)) {
+			parts.push({
+				node: output,
+				mode: "slot"
+			});
+			continue;
+		}
+		const { Value: value, ...rest } = output;
+		parts.push({
+			node: value,
+			mode: "output"
+		}, {
+			node: rest,
+			mode: "slot"
+		});
+	}
+	return parts;
+}
+function refNamesIn(node, names) {
+	const found = /* @__PURE__ */ new Set();
+	const visit = (value) => {
+		if (Array.isArray(value)) {
+			for (const element of value) visit(element);
+			return;
+		}
+		if (value === null || typeof value !== "object") return;
+		const record = value;
+		if (typeof record["Ref"] === "string" && names.has(record["Ref"])) found.add(record["Ref"]);
+		const sub = record["Fn::Sub"];
+		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
+		if (typeof text === "string") for (const match of text.matchAll(/\$\{([^}!][^}]*)\}/g)) {
+			const name = match[1].trim();
+			if (names.has(name)) found.add(name);
+		}
+		for (const child of Object.values(record)) visit(child);
+	};
+	visit(node);
+	return found;
+}
+function recordInheritedNoEchoListElements(resolver, inherited, recorded, value, context) {
+	if (!Array.isArray(value)) return;
+	const parameterValues = [...inherited.keys()].filter((plaintext) => isNoEchoParameterPlaintext(inherited, plaintext));
+	if (parameterValues.length === 0) return;
+	const joined = value.map((element) => String(element)).join(",");
+	const normalized = (plaintext) => plaintext.split(",").map((piece) => piece.trim()).join(",");
+	if (!parameterValues.some((plaintext) => `,${normalized(plaintext)},`.includes(`,${joined},`))) return;
+	for (const element of value) {
+		if (typeof element !== "string" || element.length < 4) continue;
+		recordNoEchoParameterFreshValue(element, recorded, resolver.publicNoEchoTokens(context));
+	}
+}
+function recordNoEchoParameterValue(paramDef, value, context) {
+	const bag = context.recordedSecretValues;
+	if (!declaresNoEcho(paramDef) || bag === void 0) return;
+	recordLogOnlyParameterValue(bag, value);
+	recordNoEchoParameterFreshValue(value, bag, this.publicNoEchoTokens(context));
+}
+function refuseCoercedInheritedSecret(name, paramDef, userValue, inherited) {
+	if (!inherited || inherited.size === 0) return;
+	const secretPairs = new Map([...inherited].filter(([plaintext]) => !isNoEchoParameterPlaintext(inherited, plaintext)));
+	if (secretPairs.size === 0) return;
+	const carriedBefore = inheritedSecretsCarriedBy(userValue, secretPairs).length;
+	if (carriedBefore === 0) return;
+	if (inheritedSecretsCarriedBy(this.coerceParameterValue(userValue, paramDef.Type), secretPairs).length >= carriedBefore) return;
+	const loggedName = this.displayMasked(name);
+	const loggedType = this.displayMasked(paramDef.Type);
+	throw markNonRetryable(new IntrinsicResolutionRefusalError(`Nested-stack parameter ${quotedRender(loggedName, "'")} is declared ${QUOTABLE_RENDER.test(loggedType) ? `'Type: ${loggedType}'` : "with a Type that is not a plain identifier"}, but the parent stack resolved a SECRET dynamic reference into it. cdkd keeps a resolved secret out of persisted state by rewriting STRING leaves back to their {{resolve:...}} expression; coercing this value to ${quotedRender(loggedType, "'", "that Type")} destroys the plaintext cdkd would have matched on, so the DECRYPTED secret would be left in the child stack's state.json with nothing to redact it back to. Declare ${quotedRender(loggedName, "'", "the parameter")} as 'Type: String' in the nested stack's template (CDK does this by default for cross-stack references), or stop passing a secret reference into it.`, void 0, "NESTED_STACK_SECRET_PARAMETER_TYPE"));
+}
+
 //#endregion
 //#region src/deployment/intrinsic-resolver/functions.ts
 async function resolveIf(ifArgs, context, source) {
@@ -22946,11 +23433,13 @@ async function resolveIf(ifArgs, context, source) {
 	};
 	if (!context.conditions || !Object.hasOwn(context.conditions, conditionName)) {
 		this.logger.warn(`Condition ${this.displayMasked(String(conditionName), context)} not found in context, assuming false`);
+		recordTakenIfBranchIn(context, source, false);
 		return await resolveBranch(valueIfFalse);
 	}
 	const conditionValue = context.conditions[conditionName];
 	const selectedValue = conditionValue ? valueIfTrue : valueIfFalse;
 	this.logger.debug(`Resolved Fn::If: condition ${this.logRender(String(conditionName), context)} = ${conditionValue}, selected ${conditionValue ? "true" : "false"} branch`);
+	recordTakenIfBranchIn(context, source, Boolean(conditionValue));
 	return await resolveBranch(selectedValue);
 }
 async function resolveEquals(equalsArgs, context) {
@@ -23398,6 +23887,7 @@ function displayLeaf(value, context) {
 //#region src/deployment/intrinsic-resolver/params-conditions.ts
 async function resolveParameters(template, userParameters, options) {
 	const inheritedSecrets = options?.inheritedSecrets;
+	if (inheritedSecrets) await recordInheritedPseudoParameterValues(this, inheritedSecrets);
 	const maskInherited = (text) => {
 		const mask = (value) => inheritedSecrets && hasMaskableValues(inheritedSecrets) ? maskSecretsInText(value, inheritedSecrets) : value;
 		return displaySafe(mask(stripControlChars(mask(text))));
@@ -23505,256 +23995,6 @@ async function resolveKeyUnit(key, val, context, abandoned) {
 	}
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/parameter-secrets.ts
-function recordInheritedParameterSecrets(parameterName, value, context) {
-	const inherited = context.inheritedSecrets;
-	const recorded = context.recordedSecretValues;
-	if (inherited && recorded) carryLogOnlyValuesCarriedBy(inherited, recorded, value);
-	if (recorded) carryPhysicalNameCopiesCarriedBy(context, recorded, value);
-	if (inherited && recorded) recordInheritedNoEchoListElements(this, inherited, recorded, value, context);
-	if (!inherited || inherited.size === 0 || !recorded) return;
-	const mirror = parameterReadMirrors.get(recorded);
-	const declared = declaredParameterNames(context);
-	recordInheritedParameterValue(recorded, inherited, parameterName, value, declared);
-	if (mirror) recordInheritedParameterValue(mirror, inherited, parameterName, value, declared);
-	for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) {
-		const carried = carriedExpressionFor(inherited, parameterName, value, plaintext, expression);
-		recorded.set(plaintext, carried);
-		const parentEntry = context.inheritedReferenceProvenance?.get(carried);
-		if (parentEntry !== void 0) recordReferenceProvenanceEntry(recorded, carried, parentEntry, "read");
-		recordInheritedParameterRead(recorded, inherited, parameterName);
-		if (mirror) recordInheritedParameterRead(mirror, inherited, parameterName);
-		carryFreshNoEchoMark(inherited, recorded, plaintext);
-	}
-}
-function declaredParameterNames(context) {
-	const declared = context.template?.Parameters;
-	if (declared === null || typeof declared !== "object") return void 0;
-	let names = declaredNamesCache.get(declared);
-	if (names === void 0) {
-		names = new Set(Object.keys(declared));
-		declaredNamesCache.set(declared, names);
-	}
-	return names;
-}
-const declaredNamesCache = /* @__PURE__ */ new WeakMap();
-const parameterReadMirrors = /* @__PURE__ */ new WeakMap();
-function mirrorInheritedParameterReads(passSecrets, persistSecrets) {
-	if (passSecrets !== persistSecrets) parameterReadMirrors.set(passSecrets, persistSecrets);
-}
-function carryPhysicalNameCopiesCarriedBy(context, recorded, value) {
-	const names = context.inheritedPhysicalNameCopies ?? (context.inheritedSecrets && physicalNameCopiesOf.get(context.inheritedSecrets));
-	if (names === void 0 || names.size === 0) return;
-	const leaves = [...wholeStringLeavesOf(value)];
-	for (const name of names) if (leaves.some((leaf) => leaf.includes(name))) recordPhysicalNameCopy(recorded, name);
-}
-function carriedExpressionFor(inherited, parameterName, value, plaintext, survivor) {
-	const own = inheritedParameterExpression(inherited, parameterName, plaintext);
-	if (typeof own === "string") return own;
-	return inheritedRenderedToken(inherited, parameterName, value, plaintext) ?? survivor;
-}
-function poisonRenderedSpellingsCollidingIn(template, parameterValues, inherited) {
-	if (!inherited || inherited.size === 0 || template === void 0) return;
-	const names = new Set(Object.keys(parameterValues));
-	if (names.size < 2) return;
-	const groups = [];
-	if (template.Resources !== null && typeof template.Resources === "object") for (const resource of Object.values(template.Resources)) groups.push([{
-		node: resource,
-		mode: "resource"
-	}]);
-	if (template.Outputs !== void 0) groups.push(outputsGroupParts(template.Outputs));
-	const bind = (name) => Object.hasOwn(parameterValues, name) ? { value: parameterValues[name] } : void 0;
-	const withdrawn = /* @__PURE__ */ new Set();
-	for (;;) {
-		const fresh = [...collidingRenderedNames(groups.map((parts) => {
-			const reads = /* @__PURE__ */ new Map();
-			for (const { node, mode } of parts) {
-				const reread = mode === "slot" ? void 0 : {
-					bind,
-					inherited
-				};
-				for (const [name, slotRead] of parameterReadsOf(node, names, reread, mode !== "output")) reads.set(name, slotRead || reads.get(name) === true);
-			}
-			return reads;
-		}).filter((reads) => reads.size >= 2), parameterValues, inherited)].filter((name) => !withdrawn.has(name));
-		if (fresh.length === 0) return;
-		for (const name of fresh) {
-			withdrawn.add(name);
-			withdrawRenderedParameterSpelling(inherited, name);
-		}
-	}
-}
-function collidingRenderedNames(readsByGroup, parameterValues, inherited) {
-	const withdraw = /* @__PURE__ */ new Set();
-	for (const reads of readsByGroup) {
-		const byPlaintext = /* @__PURE__ */ new Map();
-		const slotReadPlaintexts = /* @__PURE__ */ new Set();
-		for (const [name, slotRead] of reads) {
-			if (!Object.hasOwn(parameterValues, name)) continue;
-			const value = parameterValues[name];
-			for (const [plaintext, survivor] of inheritedSecretsCarriedBy(value, inherited)) {
-				const expression = carriedExpressionFor(inherited, name, value, plaintext, survivor);
-				const rendered = typeof inheritedParameterExpression(inherited, name, plaintext) !== "string" && inheritedRenderedToken(inherited, name, value, plaintext) !== void 0;
-				let byExpression = byPlaintext.get(plaintext);
-				if (byExpression === void 0) {
-					byExpression = /* @__PURE__ */ new Map();
-					byPlaintext.set(plaintext, byExpression);
-				}
-				let renderedNames = byExpression.get(expression);
-				if (renderedNames === void 0) {
-					renderedNames = [];
-					byExpression.set(expression, renderedNames);
-				}
-				if (rendered) renderedNames.push(name);
-				if (slotRead) slotReadPlaintexts.add(plaintext);
-			}
-		}
-		for (const [plaintext, byExpression] of byPlaintext) {
-			if (byExpression.size < 2 || !slotReadPlaintexts.has(plaintext)) continue;
-			for (const renderedNames of byExpression.values()) for (const name of renderedNames) withdraw.add(name);
-		}
-	}
-	return withdraw;
-}
-const POSITIONED_INTRINSICS = /* @__PURE__ */ new Set(["Fn::Join", "Fn::Sub"]);
-function parameterReadsOf(node, names, reread, positionsArrays) {
-	const reads = /* @__PURE__ */ new Map();
-	const add = (name, slotRead) => {
-		reads.set(name, slotRead || reads.get(name) === true);
-	};
-	const visit = (value, slotRead, atLeaf) => {
-		if (Array.isArray(value)) {
-			const mayShrink = atLeaf ? !positionsArrays || !arrayPairsWhateverDrops(value) : value.some((element) => element !== null && typeof element === "object" && !Array.isArray(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue"));
-			for (const element of value) visit(element, slotRead || mayShrink, atLeaf && !mayShrink);
-			return;
-		}
-		if (value === null || typeof value !== "object") return;
-		const record = value;
-		const intrinsic = Object.keys(record).some((key) => key === "Ref" || key.startsWith("Fn::"));
-		if (intrinsic && atLeaf && reread !== void 0 && rereadParameterExpression(record, reread.bind, reread.inherited) !== void 0) {
-			for (const name of refNamesIn(record, names)) add(name, false);
-			return;
-		}
-		const ref = record["Ref"];
-		if (typeof ref === "string" && names.has(ref)) add(ref, slotRead);
-		const placeholderSlot = !positionsArrays && unkeyedPlaceholderParts(record, (name) => certifiesPlaceholder(name, reread)) > MAX_UNKEYED_PARTS;
-		const sub = record["Fn::Sub"];
-		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
-		if (typeof text === "string") for (const match of text.matchAll(/\$\{([^}!][^}]*)\}/g)) {
-			const name = match[1].trim();
-			if (names.has(name)) add(name, slotRead || placeholderSlot);
-		}
-		for (const [key, child] of Object.entries(record)) visit(child, slotRead || placeholderSlot || key.startsWith("Fn::") && !POSITIONED_INTRINSICS.has(key), atLeaf && !intrinsic);
-	};
-	visit(node, reread === void 0, true);
-	return reads;
-}
-const MAX_UNKEYED_PARTS = 1;
-function certifiesPlaceholder(name, reread) {
-	if (reread === void 0) return false;
-	const bound = reread.bind(name);
-	if (bound === void 0) return false;
-	if (inheritedSecretsCarriedBy(bound.value, reread.inherited).length === 0) return false;
-	return typeof inheritedParameterExpression(reread.inherited, name, bound.value) === "string";
-}
-function unkeyedPlaceholderParts(record, certified) {
-	const keyed = (value) => typeof value === "string" || value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 1 && typeof value["Ref"] === "string" && certified(value["Ref"]);
-	if (Object.hasOwn(record, "Fn::Join")) {
-		const args = record["Fn::Join"];
-		if (!Array.isArray(args) || args.length !== 2 || !Array.isArray(args[1])) return Number.POSITIVE_INFINITY;
-		return args[1].filter((part) => !keyed(part)).length;
-	}
-	if (Object.hasOwn(record, "Fn::Sub")) {
-		const args = record["Fn::Sub"];
-		const [template, variables] = typeof args === "string" ? [args, {}] : Array.isArray(args) ? [args[0], args[1]] : [];
-		if (typeof template !== "string" || variables === null || typeof variables !== "object") return Number.POSITIVE_INFINITY;
-		let unkeyed = 0;
-		for (const hit of template.matchAll(/\$\{(!)?([^}]*)\}/g)) {
-			const name = hit[2] ?? "";
-			if (hit[1] === "!" || name === "") continue;
-			if (!(Object.hasOwn(variables, name) ? keyed(variables[name]) : certified(name))) unkeyed += 1;
-		}
-		return unkeyed;
-	}
-	return 0;
-}
-function outputsGroupParts(outputs) {
-	if (outputs === null || typeof outputs !== "object" || Array.isArray(outputs)) return [{
-		node: outputs,
-		mode: "slot"
-	}];
-	const parts = [];
-	for (const output of Object.values(outputs)) {
-		if (output === null || typeof output !== "object" || Array.isArray(output)) {
-			parts.push({
-				node: output,
-				mode: "slot"
-			});
-			continue;
-		}
-		const { Value: value, ...rest } = output;
-		parts.push({
-			node: value,
-			mode: "output"
-		}, {
-			node: rest,
-			mode: "slot"
-		});
-	}
-	return parts;
-}
-function refNamesIn(node, names) {
-	const found = /* @__PURE__ */ new Set();
-	const visit = (value) => {
-		if (Array.isArray(value)) {
-			for (const element of value) visit(element);
-			return;
-		}
-		if (value === null || typeof value !== "object") return;
-		const record = value;
-		if (typeof record["Ref"] === "string" && names.has(record["Ref"])) found.add(record["Ref"]);
-		const sub = record["Fn::Sub"];
-		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
-		if (typeof text === "string") for (const match of text.matchAll(/\$\{([^}!][^}]*)\}/g)) {
-			const name = match[1].trim();
-			if (names.has(name)) found.add(name);
-		}
-		for (const child of Object.values(record)) visit(child);
-	};
-	visit(node);
-	return found;
-}
-function recordInheritedNoEchoListElements(resolver, inherited, recorded, value, context) {
-	if (!Array.isArray(value)) return;
-	const parameterValues = [...inherited.keys()].filter((plaintext) => isNoEchoParameterPlaintext(inherited, plaintext));
-	if (parameterValues.length === 0) return;
-	const joined = value.map((element) => String(element)).join(",");
-	const normalized = (plaintext) => plaintext.split(",").map((piece) => piece.trim()).join(",");
-	if (!parameterValues.some((plaintext) => `,${normalized(plaintext)},`.includes(`,${joined},`))) return;
-	for (const element of value) {
-		if (typeof element !== "string" || element.length < 4) continue;
-		recordNoEchoParameterFreshValue(element, recorded, resolver.publicNoEchoTokens(context));
-	}
-}
-function recordNoEchoParameterValue(paramDef, value, context) {
-	const bag = context.recordedSecretValues;
-	if (!declaresNoEcho(paramDef) || bag === void 0) return;
-	recordLogOnlyParameterValue(bag, value);
-	recordNoEchoParameterFreshValue(value, bag, this.publicNoEchoTokens(context));
-}
-function refuseCoercedInheritedSecret(name, paramDef, userValue, inherited) {
-	if (!inherited || inherited.size === 0) return;
-	const secretPairs = new Map([...inherited].filter(([plaintext]) => !isNoEchoParameterPlaintext(inherited, plaintext)));
-	if (secretPairs.size === 0) return;
-	const carriedBefore = inheritedSecretsCarriedBy(userValue, secretPairs).length;
-	if (carriedBefore === 0) return;
-	if (inheritedSecretsCarriedBy(this.coerceParameterValue(userValue, paramDef.Type), secretPairs).length >= carriedBefore) return;
-	const loggedName = this.displayMasked(name);
-	const loggedType = this.displayMasked(paramDef.Type);
-	throw markNonRetryable(new IntrinsicResolutionRefusalError(`Nested-stack parameter ${quotedRender(loggedName, "'")} is declared ${QUOTABLE_RENDER.test(loggedType) ? `'Type: ${loggedType}'` : "with a Type that is not a plain identifier"}, but the parent stack resolved a SECRET dynamic reference into it. cdkd keeps a resolved secret out of persisted state by rewriting STRING leaves back to their {{resolve:...}} expression; coercing this value to ${quotedRender(loggedType, "'", "that Type")} destroys the plaintext cdkd would have matched on, so the DECRYPTED secret would be left in the child stack's state.json with nothing to redact it back to. Declare ${quotedRender(loggedName, "'", "the parameter")} as 'Type: String' in the nested stack's template (CDK does this by default for cross-stack references), or stop passing a secret reference into it.`, void 0, "NESTED_STACK_SECRET_PARAMETER_TYPE"));
-}
-
 //#endregion
 //#region src/deployment/intrinsic-resolver/refs.ts
 function nameIsNeverAResource(logicalId, context) {
@@ -23931,7 +24171,18 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			if (typeof value === "string" && value.includes("{{resolve:")) return await this.resolveTemplateLeafReferences(value, context);
 			return value;
 		}
-		if (Array.isArray(value)) return (await allSettledKeepingFirstRejection(() => value.map((v) => this.resolveValue(v, context)), (pending) => this.warnAbandonedParts(pending))).filter((v) => v !== AWS_NO_VALUE);
+		if (Array.isArray(value)) {
+			const resolved = await allSettledKeepingFirstRejection(() => value.map((v) => this.resolveValue(v, context)), (pending) => this.warnAbandonedParts(pending));
+			const kept = resolved.filter((v) => v !== AWS_NO_VALUE);
+			if (kept.length !== resolved.length) {
+				const dropped = [];
+				resolved.forEach((v, i) => {
+					if (v === AWS_NO_VALUE) dropped.push(i);
+				});
+				recordDroppedArrayElementsIn(context, value, dropped);
+			}
+			return kept;
+		}
 		const obj = value;
 		if ("Ref" in obj) {
 			const logicalId = obj["Ref"];
@@ -24919,8 +25170,9 @@ function ec2InstanceProtectionSite(instanceId, region) {
 //#endregion
 //#region src/provisioning/wait-abandoned.ts
 const WAIT_ABANDONED_MARKER = Symbol.for("cdkd.waitAbandoned");
+const ABANDONED_REQUEST = Symbol.for("cdkd.waitAbandoned.request");
 const MAX_CAUSE_CHAIN_DEPTH = 5;
-function markWaitAbandoned(error) {
+function markWaitAbandoned(error, request) {
 	if (!Object.isExtensible(error)) return error;
 	Object.defineProperty(error, WAIT_ABANDONED_MARKER, {
 		value: true,
@@ -24928,6 +25180,12 @@ function markWaitAbandoned(error) {
 		configurable: true,
 		writable: false
 	});
+	if (request !== void 0) Object.defineProperty(error, ABANDONED_REQUEST, {
+		value: Object.freeze({ ...request }),
+		enumerable: false,
+		configurable: true,
+		writable: false
+	});
 	return error;
 }
 function isWaitAbandonedError(error) {
@@ -24938,6 +25196,14 @@ function isWaitAbandonedError(error) {
 	}
 	return false;
 }
+function abandonedRequestOf(error) {
+	let current = error;
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+		const request = current[ABANDONED_REQUEST];
+		if (request !== void 0) return request;
+		current = current.cause;
+	}
+}
 
 //#endregion
 //#region src/provisioning/ec2-volume-delete.ts
@@ -26195,9 +26461,18 @@ var CloudControlWaitAbandonedError = class CloudControlWaitAbandonedError extend
 		this.lastSeenIdentifier = lastSeenIdentifier;
 		this.name = "CloudControlWaitAbandonedError";
 		Object.setPrototypeOf(this, CloudControlWaitAbandonedError.prototype);
-		markWaitAbandoned(this);
+		markWaitAbandoned(this, {
+			requestToken,
+			operation: ccOperation
+		});
 	}
 };
+function failedOutcome$1(errorCode, identifier) {
+	return identifier && errorCode !== "AlreadyExists" && errorCode !== "ResourceConflict" ? {
+		status: "failed",
+		remnant: identifier
+	} : { status: "failed" };
+}
 const POLL_TRANSPORT_ERROR_CODES = /* @__PURE__ */ new Set([
 	"ECONNRESET",
 	"ECONNREFUSED",
@@ -26525,7 +26800,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BS5i71bK.js");
+			const { ASGProvider } = await import("./asg-provider-CK2nZE6B.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -26631,7 +26906,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-DraxDuQq.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CqZ1FaqT.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-BfwQbYRR.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-BWESr5fm.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -26839,9 +27114,10 @@ var CloudControlProvider = class {
 					const failureMessage = progressEvent.StatusMessage || "Unknown error";
 					throw new CloudControlOperationFailedError(`${operation} failed for ${logicalId}: ${failureMessage}${handlerAuthFailureHint(failureMessage)}`, progressEvent.TypeName || "Unknown", logicalId, progressEvent.Identifier, progressEvent.ErrorCode, operation);
 				}
-				case "CANCEL_COMPLETE": throw new ProvisioningError(`${operation} cancelled for ${logicalId}`, progressEvent.TypeName || "Unknown", logicalId, progressEvent.Identifier);
+				case "CANCEL_COMPLETE": throw Object.assign(new ProvisioningError(`${operation} cancelled for ${logicalId}`, progressEvent.TypeName || "Unknown", logicalId, progressEvent.Identifier), { ccOperationCancelled: true });
 				case "IN_PROGRESS":
 				case "PENDING":
+				case "CANCEL_IN_PROGRESS":
 					await this.sleep(pollInterval);
 					pollInterval = Math.min(Math.ceil(pollInterval * 1.5), this.MAX_POLL_INTERVAL_MS);
 					break;
@@ -26853,13 +27129,90 @@ var CloudControlProvider = class {
 		}
 		throw await this.abandonWait(requestToken, logicalId, operation, resourceType, lastSeenIdentifier, `${operation} timeout for ${logicalId} after ${maxWaitMs / 1e3}s`, lastTransientError);
 	}
+	async resumeCreatedResource(logicalId, resourceType, identifier, properties, context) {
+		const mask = maskerOrIdentity(context?.maskSecrets);
+		const attributeNamesLookup = getTopLevelDeployAttributeNames(resourceType);
+		let raw;
+		try {
+			raw = (await this.cloudControlClient.send(new GetResourceCommand({
+				TypeName: resourceType,
+				Identifier: identifier
+			}))).ResourceDescription?.Properties;
+		} catch (error) {
+			if (error.name === "ResourceNotFoundException") throw Object.assign(new ProvisioningError(`${logicalId}'s resource that an earlier CREATE made no longer exists`, resourceType, logicalId, identifier, error instanceof Error ? error : void 0), { resumedResourceGone: true });
+			throw error;
+		}
+		const model = typeof raw === "string" && raw !== "" ? this.parseResourceModel(raw) : {};
+		const modelKeys = Object.keys(model);
+		const enriched = await this.enrichResourceAttributes(resourceType, identifier, model);
+		return {
+			physicalId: identifier,
+			attributes: await this.maskDeployedNonAttributeKeys(enriched, modelKeys, resourceType, identifier, attributeNamesLookup, properties, mask)
+		};
+	}
+	async resumeAbandonedRequest(requestToken, logicalId, resourceType) {
+		let first;
+		try {
+			first = await this.cloudControlClient.send(new GetResourceRequestStatusCommand({ RequestToken: requestToken }));
+		} catch (error) {
+			if (error.name === "RequestTokenNotFoundException") return { status: "not-found" };
+			return {
+				status: "unresolved",
+				error
+			};
+		}
+		let event = first.ProgressEvent;
+		if (event?.TypeName !== void 0 && event.TypeName !== resourceType || event?.Operation !== void 0 && event.Operation !== "CREATE") return {
+			status: "unresolved",
+			error: /* @__PURE__ */ new Error("the request is not a CREATE of the type the journal records")
+		};
+		if (event !== void 0 && ![
+			"SUCCESS",
+			"FAILED",
+			"CANCEL_COMPLETE"
+		].includes(String(event.OperationStatus))) try {
+			event = await this.waitForOperation(requestToken, logicalId, "CREATE", resourceType);
+		} catch (error) {
+			if (error instanceof CloudControlOperationFailedError) return failedOutcome$1(error.ccErrorCode, error.physicalId);
+			if (error.ccOperationCancelled === true) {
+				const made = error.physicalId;
+				return made ? {
+					status: "cancelled",
+					remnant: made
+				} : { status: "cancelled" };
+			}
+			if (isInterruptedWaitError(error)) throw error;
+			return {
+				status: "unresolved",
+				error
+			};
+		}
+		switch (event?.OperationStatus) {
+			case "SUCCESS": return event.Identifier ? {
+				status: "succeeded",
+				identifier: event.Identifier
+			} : {
+				status: "unresolved",
+				error: /* @__PURE__ */ new Error("the SUCCESS event named no Identifier")
+			};
+			case "FAILED": return failedOutcome$1(event.ErrorCode, event.Identifier);
+			case "CANCEL_COMPLETE": return event.Identifier ? {
+				status: "cancelled",
+				remnant: event.Identifier
+			} : { status: "cancelled" };
+			default: return {
+				status: "unresolved",
+				error: /* @__PURE__ */ new Error(`unexpected operation status ${String(event?.OperationStatus)}`)
+			};
+		}
+	}
 	async abandonWait(requestToken, logicalId, operation, resourceType, lastSeenIdentifier, reason, cause) {
 		const described = describePollFailure(cause);
 		const safeDisplay = displaySafe(described.display);
 		const causeText = safeDisplay === "" ? "" : `: ${safeDisplay}`;
 		if (described.detail !== "") this.logger.debug(`${operation} ${logicalId}: the abandoned operation's underlying failure was: ${displaySafe(described.detail)}`);
 		const identifierClause = lastSeenIdentifier === void 0 ? "" : ` The last status cdkd read named the resource ${displaySafe(lastSeenIdentifier, { asciiOnly: true })}.`;
-		const consequence = operation === "CREATE" ? "cdkd has NO state record for it, so any resource it creates is untracked by rollback and by cdkd destroy" : operation === "DELETE" ? "the resource may or may not have been removed; its state record is kept so a re-run can finish the delete" : "its state record still holds the PREVIOUS properties, so the record may no longer describe the live resource";
+		const consequence = operation === "CREATE" ? "cdkd has NO state record for it: when the failed deploy records the request in the stack's rollback journal, the next cdkd deploy, destroy or rollback checks how it ended, and otherwise any resource it creates is untracked" : operation === "DELETE" ? "the resource may or may not have been removed; its state record is kept so a re-run can finish the delete" : "its state record still holds the PREVIOUS properties, so the record may no longer describe the live resource";
 		const error = new CloudControlWaitAbandonedError(safeMsg`${operation} of ${logicalId} was accepted by Cloud Control API, but cdkd stopped waiting for it ` + safeMsg`(${reason}${causeText}). The operation may still be running in AWS, and ${consequence}.` + `${identifierClause} Check what it did with:\n  ${await this.buildResumeCommand(requestToken)}`, resourceType, logicalId, requestToken, operation, lastSeenIdentifier, cause instanceof Error ? cause : void 0);
 		if (described.marker) markRedactedCause(error);
 		return operation === "CREATE" ? markNonRetryable(error) : error;
@@ -33266,343 +33619,95 @@ function seedOnlyAliasRefusal(seed) {
 }
 
 //#endregion
-//#region src/state/deployment-events-store.ts
-const DEPLOYMENT_EVENTS_MAX_INDEX_RUNS = 20;
-const FLUSH_INTERVAL_MS = 2e3;
-const FLUSH_EVENT_THRESHOLD = 50;
-function newDeploymentRunId(now = /* @__PURE__ */ new Date()) {
-	return `${now.toISOString().replace(/[-:.]/g, "")}-${randomUUID().slice(0, 8)}`;
-}
-function deploymentEventsKey(prefix, stackName, region, runId) {
-	return `${prefix}/${stackName}/${region}/deployments/${runId}.jsonl`;
-}
-function deploymentEventsIndexKey(prefix, stackName, region) {
-	return `${prefix}/${stackName}/${region}/deployments/index.json`;
+//#region src/deployment/rollback-executor/orphan-identity.ts
+const UNIQUE_PHYSICAL_ID_TYPES = /* @__PURE__ */ new Set([
+	"AWS::EC2::VPC",
+	"AWS::EC2::Subnet",
+	"AWS::EC2::EIP",
+	"AWS::EC2::NatGateway",
+	"AWS::EC2::SecurityGroup",
+	"AWS::EC2::Instance",
+	"AWS::EFS::FileSystem",
+	"AWS::EFS::MountTarget",
+	"AWS::FSx::FileSystem",
+	"AWS::KMS::Key",
+	"AWS::CertificateManager::Certificate",
+	"AWS::ElasticLoadBalancingV2::LoadBalancer",
+	"AWS::ElasticLoadBalancingV2::TargetGroup",
+	"AWS::ElasticLoadBalancingV2::Listener",
+	"AWS::EMR::Cluster",
+	"AWS::EMR::InstanceGroupConfig",
+	"AWS::EMR::InstanceFleetConfig",
+	"AWS::Cognito::UserPool",
+	"AWS::Route53::HostedZone",
+	"AWS::ServiceDiscovery::PrivateDnsNamespace",
+	"AWS::ServiceDiscovery::PublicDnsNamespace",
+	"AWS::ServiceDiscovery::HttpNamespace",
+	"AWS::ServiceDiscovery::Service",
+	"AWS::AppSync::GraphQLApi",
+	"AWS::IAM::AccessKey",
+	"AWS::Kinesis::StreamConsumer"
+]);
+const CONTENT_COMPARED_DELETE_TYPES = /* @__PURE__ */ new Set(["AWS::SQS::QueuePolicy", "AWS::SNS::TopicPolicy"]);
+const CDKD_NAMESPACE_ID_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::Stack"]);
+function orphanDeleteNeedsIdentity(resourceType) {
+	return !UNIQUE_PHYSICAL_ID_TYPES.has(resourceType) && !CONTENT_COMPARED_DELETE_TYPES.has(resourceType) && !CDKD_NAMESPACE_ID_TYPES.has(resourceType);
 }
-function deploymentsDirPrefix(prefix, stackName, region) {
-	return `${prefix}/${stackName}/${region}/deployments/`;
+function orphanNeedsIdentity(op) {
+	if (op.provisionedBy === "cc-api") return op.createdIdentifierUnique !== true;
+	return orphanDeleteNeedsIdentity(op.resourceType);
 }
-const DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION = "deployment-event streams and their index, whose recorded error messages can quote values the secret mask does not catch";
-async function deleteAndPurgeEventObjects(backend, keys, dirPrefix, scope = "deleted-keys") {
-	if (keys.length === 0) return void 0;
-	let swept;
+const RESOURCE_IDENTITY_TIMEOUT_MS = 1e4;
+async function readResourceIdentity(providerRegistry, target, region, timeoutMs = RESOURCE_IDENTITY_TIMEOUT_MS) {
+	let timer;
+	const timedOut = new Promise((resolve) => {
+		timer = setTimeout(() => resolve(void 0), timeoutMs);
+	});
 	try {
-		await backend.deleteRawObjects(keys);
+		return await Promise.race([askResourceIdentity(providerRegistry, target, region), timedOut]);
 	} finally {
-		if (scope === "whole-dir") swept = await backend.purgeNoncurrentVersionsUnderPrefix(dirPrefix, { objectDescription: DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION });
-		else await backend.purgeNoncurrentVersions(keys, {
-			...keys.length > 1 && { listPrefix: dirPrefix },
-			objectDescription: DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION
-		});
+		clearTimeout(timer);
 	}
-	return swept;
 }
-function runIdTimestampMs(runId) {
-	const m = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})(\d{3})Z/.exec(runId);
-	if (!m) return null;
-	const iso = `${m[1]}-${m[2]}-${m[3]}T${m[4]}:${m[5]}:${m[6]}.${m[7]}Z`;
-	const ms = Date.parse(iso);
-	return Number.isNaN(ms) ? null : ms;
-}
-function runIdFromJsonlKey(key, dirPrefix) {
-	if (!key.startsWith(dirPrefix) || !key.endsWith(".jsonl")) return null;
-	return key.slice(dirPrefix.length, -6);
-}
-var DeploymentEventsStore = class {
-	logger = getLogger().child("DeploymentEvents");
-	backend;
-	stackName;
-	region;
-	command;
-	runId;
-	cdkdVersion;
-	startedAt;
-	events = [];
-	persistedCount = 0;
-	flushTimer;
-	writeChain = Promise.resolve();
-	warnedOnce = false;
-	finalized = false;
-	constructor(backend, options) {
-		this.backend = backend;
-		this.stackName = options.stackName;
-		this.region = options.region;
-		this.command = options.command;
-		this.runId = options.runId ?? newDeploymentRunId();
-		this.cdkdVersion = options.cdkdVersion ?? getCdkdVersion();
-		this.startedAt = (/* @__PURE__ */ new Date()).toISOString();
-	}
-	record(event) {
-		try {
-			if (this.finalized) return;
-			this.events.push({
-				timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-				...event
-			});
-			if (this.events.length - this.persistedCount >= FLUSH_EVENT_THRESHOLD) this.scheduleFlush(0);
-			else this.scheduleFlush(FLUSH_INTERVAL_MS);
-		} catch {}
-	}
-	async finalize(result) {
-		if (this.finalized) return;
-		this.finalized = true;
-		if (this.flushTimer) {
-			clearTimeout(this.flushTimer);
-			this.flushTimer = void 0;
-		}
-		if (this.events.length === 0) return;
-		await this.enqueueWrite(async () => {
-			const indexRead = this.readIndexRuns();
-			indexRead.catch(() => {});
-			await this.doFlush();
-			await this.writeIndexAndPrune(result, await indexRead);
-		});
-	}
-	async writeIndexAndPrune(result, existingRuns) {
-		const { key, file, runs } = this.buildIndexUpdate(result, existingRuns);
-		const keptRunIds = runs.map((r) => r.runId);
-		const willPrune = keptRunIds.length >= 20;
-		const dirPrefix = deploymentsDirPrefix(this.backend.prefix, this.stackName, this.region);
-		const staleKeysRead = willPrune ? this.backend.listRawKeys(dirPrefix) : void 0;
-		staleKeysRead?.catch(() => {});
-		await this.backend.putRawObject(key, JSON.stringify(file, null, 2));
-		if (!staleKeysRead) return;
-		await this.pruneSupersededRunFiles(keptRunIds, dirPrefix, await staleKeysRead);
-	}
-	async drain() {
-		await this.writeChain;
-	}
-	scheduleFlush(delayMs) {
-		if (this.flushTimer) {
-			if (delayMs > 0) return;
-			clearTimeout(this.flushTimer);
-		}
-		this.flushTimer = setTimeout(() => {
-			this.flushTimer = void 0;
-			this.enqueueWrite(() => this.doFlush());
-		}, delayMs);
-		this.flushTimer.unref?.();
-	}
-	enqueueWrite(op) {
-		const next = this.writeChain.then(op).catch((err) => {
-			this.warnOnce(`Failed to persist deployment events for run ${this.runId}: ${describeAwsFailure(err).detail}`);
-		});
-		this.writeChain = next;
-		return next;
-	}
-	async doFlush() {
-		if (this.events.length === 0 || this.events.length === this.persistedCount) return;
-		const snapshotCount = this.events.length;
-		const body = this.events.slice(0, snapshotCount).map((e) => JSON.stringify(e)).join("\n");
-		await this.backend.putRawObject(deploymentEventsKey(this.backend.prefix, this.stackName, this.region, this.runId), body + "\n", "application/x-ndjson");
-		this.persistedCount = snapshotCount;
-	}
-	async readIndexRuns() {
-		const key = deploymentEventsIndexKey(this.backend.prefix, this.stackName, this.region);
-		try {
-			const raw = await this.backend.getRawObject(key);
-			if (raw !== null) {
-				const parsed = JSON.parse(raw);
-				if (Array.isArray(parsed.runs)) return parsed.runs;
-			}
-		} catch (err) {
-			this.logger.debug(`Deployment-events index unreadable, rewriting: ${describeAwsFailure(err).detail}`);
-		}
-		return [];
-	}
-	buildIndexUpdate(result, existingRuns) {
-		const key = deploymentEventsIndexKey(this.backend.prefix, this.stackName, this.region);
-		const runs = [{
-			runId: this.runId,
-			command: this.command,
-			cdkdVersion: this.cdkdVersion,
-			startedAt: this.startedAt,
-			finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
-			result,
-			eventCount: this.persistedCount
-		}, ...existingRuns.filter((r) => r.runId !== this.runId)].slice(0, 20);
-		return {
-			key,
-			file: {
-				indexVersion: 1,
-				stackName: this.stackName,
-				region: this.region,
-				runs,
-				lastModified: Date.now()
-			},
-			runs
-		};
-	}
-	async pruneSupersededRunFiles(keptRunIds, dirPrefix, keys) {
-		if (keptRunIds.length < 20) return;
-		const cutoff = keptRunIds.reduce((min, id) => id < min ? id : min, keptRunIds[0]);
-		const stale = keys.filter((k) => {
-			const runId = runIdFromJsonlKey(k, dirPrefix);
-			return runId !== null && runId < cutoff;
+async function askResourceIdentity(providerRegistry, target, region) {
+	try {
+		const { provider } = providerRegistry.getProviderFor({
+			resourceType: target.resourceType,
+			provisionedBy: target.provisionedBy
 		});
-		if (stale.length === 0) return;
-		await deleteAndPurgeEventObjects(this.backend, stale, dirPrefix);
-		this.logger.debug(`Pruned ${stale.length} superseded deployment-event stream(s) for ${this.stackName} (${this.region})`);
-	}
-	warnOnce(message) {
-		if (this.warnedOnce) {
-			this.logger.debug(message);
-			return;
-		}
-		this.warnedOnce = true;
-		this.logger.warn(`${message} — continuing; deployment events are best-effort and never block the run.`);
-	}
-};
-var DeploymentEventsReader = class {
-	backend;
-	constructor(backend) {
-		this.backend = backend;
-	}
-	async listRegions(stackName) {
-		const prefix = `${this.backend.prefix}/${stackName}/`;
-		const keys = await this.backend.listRawKeys(prefix);
-		const regions = /* @__PURE__ */ new Set();
-		for (const key of keys) {
-			const segments = key.slice(prefix.length).split("/");
-			if (segments.length === 3 && segments[1] === "deployments" && segments[0]) regions.add(segments[0]);
-		}
-		return [...regions].sort();
-	}
-	async listRuns(stackName, region) {
-		const key = deploymentEventsIndexKey(this.backend.prefix, stackName, region);
-		try {
-			const raw = await this.backend.getRawObject(key);
-			if (raw !== null) {
-				const parsed = JSON.parse(raw);
-				if (Array.isArray(parsed.runs)) return parsed.runs;
-			}
-		} catch {}
-		const dirPrefix = `${this.backend.prefix}/${stackName}/${region}/deployments/`;
-		const runIds = (await this.backend.listRawKeys(dirPrefix)).filter((k) => k.endsWith(".jsonl")).map((k) => k.slice(dirPrefix.length, -6)).sort().reverse();
-		return Promise.all(runIds.map((runId) => this.summarizeRunFromJsonl(stackName, region, runId)));
-	}
-	async summarizeRunFromJsonl(stackName, region, runId) {
-		const fallback = {
-			runId,
-			command: "deploy",
-			cdkdVersion: "unknown",
-			startedAt: "",
-			finishedAt: "",
-			result: "UNKNOWN",
-			eventCount: 0
-		};
-		let events = null;
-		try {
-			events = await this.readRunEvents(stackName, region, runId);
-		} catch {
-			return fallback;
-		}
-		if (events === null || events.length === 0) return fallback;
-		const started = events.find((e) => e.eventType === "RUN_STARTED");
-		let finished;
-		for (const e of events) if (e.eventType === "RUN_FINISHED") finished = e;
-		return {
-			runId,
-			command: started?.command ?? fallback.command,
-			cdkdVersion: started?.cdkdVersion ?? fallback.cdkdVersion,
-			startedAt: started?.timestamp ?? fallback.startedAt,
-			finishedAt: finished?.timestamp ?? fallback.finishedAt,
-			result: finished?.result ?? "UNKNOWN",
-			eventCount: events.length
-		};
-	}
-	async readRunEvents(stackName, region, runId) {
-		const key = deploymentEventsKey(this.backend.prefix, stackName, region, runId);
-		const raw = await this.backend.getRawObject(key);
-		if (raw === null) return null;
-		const events = [];
-		for (const line of raw.split("\n")) {
-			const trimmed = line.trim();
-			if (!trimmed) continue;
-			try {
-				events.push(JSON.parse(trimmed));
-			} catch {}
-		}
-		return events;
+		if (typeof provider.resourceIdentity !== "function") return void 0;
+		const identity = await provider.resourceIdentity(target.physicalId, target.resourceType, { expectedRegion: region });
+		if (identity === RESOURCE_NOT_FOUND) return RESOURCE_NOT_FOUND;
+		return typeof identity === "string" && identity !== "" ? identity : void 0;
+	} catch {
+		return;
 	}
-	async pruneRuns(stackName, region, opts = {}) {
-		const dirPrefix = deploymentsDirPrefix(this.backend.prefix, stackName, region);
-		const keys = await this.backend.listRawKeys(dirPrefix);
-		const runIdsDesc = keys.map((k) => runIdFromJsonlKey(k, dirPrefix)).filter((id) => id !== null).sort().reverse();
-		const indexKey = deploymentEventsIndexKey(this.backend.prefix, stackName, region);
-		const indexExisted = keys.includes(indexKey);
-		if (opts.all === true) {
-			const toDelete = runIdsDesc.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
-			const earlierVersions = await deleteAndPurgeEventObjects(this.backend, [...toDelete, indexKey], dirPrefix, "whole-dir");
-			return {
-				deletedRunIds: runIdsDesc,
-				remainingRunIds: [],
-				indexDeleted: indexExisted,
-				...earlierVersions !== void 0 && { earlierVersions }
-			};
-		}
-		const noGuards = opts.keep === void 0 && opts.olderThanMs === void 0;
-		const keep = opts.keep ?? (noGuards ? 20 : void 0);
-		const protectedByCount = keep === void 0 ? /* @__PURE__ */ new Set() : new Set(runIdsDesc.slice(0, keep));
-		let candidates = runIdsDesc.filter((id) => !protectedByCount.has(id));
-		if (opts.olderThanMs !== void 0) {
-			const cutoff = (opts.now ?? /* @__PURE__ */ new Date()).getTime() - opts.olderThanMs;
-			candidates = candidates.filter((id) => {
-				const t = runIdTimestampMs(id);
-				return t !== null && t < cutoff;
-			});
-		}
-		if (candidates.length === 0) return {
-			deletedRunIds: [],
-			remainingRunIds: runIdsDesc,
-			indexDeleted: false
-		};
-		const deletedSet = new Set(candidates);
-		const deleteKeys = candidates.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
-		const remainingRunIds = runIdsDesc.filter((id) => !deletedSet.has(id));
-		if (remainingRunIds.length === 0) {
-			await deleteAndPurgeEventObjects(this.backend, [...deleteKeys, indexKey], dirPrefix);
-			return {
-				deletedRunIds: candidates,
-				remainingRunIds,
-				indexDeleted: indexExisted
-			};
-		}
-		await this.rewriteIndexAfterPrune(indexKey, stackName, region, deletedSet);
-		await deleteAndPurgeEventObjects(this.backend, deleteKeys, dirPrefix);
+}
+async function createdResourceStillThere(op, ctx) {
+	if (op.deletionPolicy === "Retain") return "proven";
+	if (!orphanNeedsIdentity(op)) return "proven";
+	const physicalId = op.physicalId;
+	if (!physicalId) return "unproven";
+	const live = await readResourceIdentity(ctx.providerRegistry, {
+		resourceType: op.resourceType,
+		physicalId,
+		provisionedBy: op.provisionedBy
+	}, ctx.region);
+	if (live === RESOURCE_NOT_FOUND) return "gone";
+	const journaled = op.createdResourceIdentity;
+	if (typeof journaled !== "string" || journaled === "" || typeof live !== "string") return "unproven";
+	return live === journaled ? "proven" : "mismatch";
+}
+async function askForeignHolder(foreignHolder, op) {
+	try {
+		return await foreignHolder(op.resourceType, op.physicalId);
+	} catch {
 		return {
-			deletedRunIds: candidates,
-			remainingRunIds,
-			indexDeleted: false
-		};
-	}
-	async rewriteIndexAfterPrune(indexKey, stackName, region, deletedRunIds) {
-		let raw;
-		try {
-			raw = await this.backend.getRawObject(indexKey);
-		} catch {
-			return;
-		}
-		if (raw === null) return;
-		let parsed;
-		try {
-			parsed = JSON.parse(raw);
-		} catch {
-			return;
-		}
-		if (!Array.isArray(parsed.runs)) return;
-		const remaining = parsed.runs.filter((r) => !deletedRunIds.has(r.runId));
-		if (remaining.length === parsed.runs.length) return;
-		const file = {
-			indexVersion: 1,
-			stackName,
-			region,
-			runs: remaining,
-			lastModified: Date.now()
+			kind: "unreadable",
+			what: "the other stacks' state records (the scan failed)"
 		};
-		await this.backend.putRawObject(indexKey, JSON.stringify(file, null, 2));
 	}
-};
+}
 
 //#endregion
 //#region src/deployment/rollback-executor/replay-scope.ts
@@ -33912,93 +34017,6 @@ function renderNestedStackTypeChangeRefusal(typeChanges, stackName) {
 	return `Refusing to deploy ${stackName}: ` + (typeChanges.length === 1 ? `a resource changes its Type ` : `${typeChanges.length} resources change their Type `) + `into or out of ${NESTED_STACK_RESOURCE_TYPE}, which cdkd does not replace in place.\n${rows.join("\n")}\n  Deploy this as two changes instead: give the new resource a DIFFERENT logical id (in CDK, rename the construct) so the existing row is deleted through its own type's provider and the new one is created under its own — or remove the resource in one deploy and add its replacement in the next. There is no flag that overrides this refusal.`;
 }
 
-//#endregion
-//#region src/deployment/rollback-executor/orphan-identity.ts
-const UNIQUE_PHYSICAL_ID_TYPES = /* @__PURE__ */ new Set([
-	"AWS::EC2::VPC",
-	"AWS::EC2::Subnet",
-	"AWS::EC2::EIP",
-	"AWS::EC2::NatGateway",
-	"AWS::EC2::SecurityGroup",
-	"AWS::EC2::Instance",
-	"AWS::EFS::FileSystem",
-	"AWS::EFS::MountTarget",
-	"AWS::FSx::FileSystem",
-	"AWS::KMS::Key",
-	"AWS::CertificateManager::Certificate",
-	"AWS::ElasticLoadBalancingV2::LoadBalancer",
-	"AWS::ElasticLoadBalancingV2::TargetGroup",
-	"AWS::ElasticLoadBalancingV2::Listener",
-	"AWS::EMR::Cluster",
-	"AWS::EMR::InstanceGroupConfig",
-	"AWS::EMR::InstanceFleetConfig",
-	"AWS::Cognito::UserPool",
-	"AWS::Route53::HostedZone",
-	"AWS::ServiceDiscovery::PrivateDnsNamespace",
-	"AWS::ServiceDiscovery::PublicDnsNamespace",
-	"AWS::ServiceDiscovery::HttpNamespace",
-	"AWS::ServiceDiscovery::Service",
-	"AWS::AppSync::GraphQLApi",
-	"AWS::IAM::AccessKey",
-	"AWS::Kinesis::StreamConsumer"
-]);
-const CONTENT_COMPARED_DELETE_TYPES = /* @__PURE__ */ new Set(["AWS::SQS::QueuePolicy", "AWS::SNS::TopicPolicy"]);
-const CDKD_NAMESPACE_ID_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::Stack"]);
-function orphanDeleteNeedsIdentity(resourceType) {
-	return !UNIQUE_PHYSICAL_ID_TYPES.has(resourceType) && !CONTENT_COMPARED_DELETE_TYPES.has(resourceType) && !CDKD_NAMESPACE_ID_TYPES.has(resourceType);
-}
-const RESOURCE_IDENTITY_TIMEOUT_MS = 1e4;
-async function readResourceIdentity(providerRegistry, target, region, timeoutMs = RESOURCE_IDENTITY_TIMEOUT_MS) {
-	let timer;
-	const timedOut = new Promise((resolve) => {
-		timer = setTimeout(() => resolve(void 0), timeoutMs);
-	});
-	try {
-		return await Promise.race([askResourceIdentity(providerRegistry, target, region), timedOut]);
-	} finally {
-		clearTimeout(timer);
-	}
-}
-async function askResourceIdentity(providerRegistry, target, region) {
-	try {
-		const { provider } = providerRegistry.getProviderFor({
-			resourceType: target.resourceType,
-			provisionedBy: target.provisionedBy
-		});
-		if (typeof provider.resourceIdentity !== "function") return void 0;
-		const identity = await provider.resourceIdentity(target.physicalId, target.resourceType, { expectedRegion: region });
-		if (identity === RESOURCE_NOT_FOUND) return RESOURCE_NOT_FOUND;
-		return typeof identity === "string" && identity !== "" ? identity : void 0;
-	} catch {
-		return;
-	}
-}
-async function createdResourceStillThere(op, ctx) {
-	if (op.deletionPolicy === "Retain") return "proven";
-	if (!orphanDeleteNeedsIdentity(op.resourceType)) return "proven";
-	const physicalId = op.physicalId;
-	if (!physicalId) return "unproven";
-	const live = await readResourceIdentity(ctx.providerRegistry, {
-		resourceType: op.resourceType,
-		physicalId,
-		provisionedBy: op.provisionedBy
-	}, ctx.region);
-	if (live === RESOURCE_NOT_FOUND) return "gone";
-	const journaled = op.createdResourceIdentity;
-	if (typeof journaled !== "string" || journaled === "" || typeof live !== "string") return "unproven";
-	return live === journaled ? "proven" : "mismatch";
-}
-async function askForeignHolder(foreignHolder, op) {
-	try {
-		return await foreignHolder(op.resourceType, op.physicalId);
-	} catch {
-		return {
-			kind: "unreadable",
-			what: "the other stacks' state records (the scan failed)"
-		};
-	}
-}
-
 //#endregion
 //#region src/deployment/rollback-executor/plan.ts
 function journaledOldTypes(op) {
@@ -35455,7 +35473,7 @@ async function replayRollbackUnbound(operations, stateResources, stackName, ctx,
 }
 function protectionRemovalProven(op, deleteProven) {
 	if (op.physicalIdRecoveredFromError !== true) return true;
-	return deleteProven && (!orphanDeleteNeedsIdentity(op.resourceType) || removeProtectionTypes().includes(op.resourceType));
+	return deleteProven && (!orphanNeedsIdentity(op) || removeProtectionTypes().includes(op.resourceType));
 }
 async function journaledOrphanKeepReason(op, foreignHolder, ctx) {
 	const holding = await askForeignHolder(foreignHolder, op);
@@ -35873,6 +35891,344 @@ async function replayFailedOperations(...args) {
 	return await withProducerRegions(() => replayProducerRegionEvidence(args[3]), () => withStackRecords(replayStackRecordsView(args[1]), () => replayFailedOperationsUnbound(...args)));
 }
 
+//#endregion
+//#region src/provisioning/nested-stack-context.ts
+const storage$1 = new AsyncLocalStorage();
+function withNestedStackContext(ctx, fn) {
+	return storage$1.run(ctx, fn);
+}
+function getCurrentNestedStackContext() {
+	return storage$1.getStore();
+}
+async function collectNestedChildUnaddressed(fn) {
+	const ctx = storage$1.getStore();
+	if (!ctx) return {
+		value: await fn(),
+		unaddressed: void 0
+	};
+	const slot = {};
+	return {
+		value: await storage$1.run({
+			...ctx,
+			childUnaddressed: slot
+		}, fn),
+		unaddressed: slot.last
+	};
+}
+
+//#endregion
+//#region src/deployment/nested-child-journal.ts
+const NESTED_PENDING_PARENT_REASON = "nested-pending-parent";
+const NESTED_STACK_TYPE$2 = "AWS::CloudFormation::Stack";
+const MAX_NESTED_WALK_DEPTH = 32;
+function nestedChildStackName(parentStackName, logicalId) {
+	return `${parentStackName}~${logicalId}`;
+}
+function nestedPendingSnapshot(state, refusesExportName) {
+	const outputs = { ...isPlainRecord(state.outputs) ? state.outputs : {} };
+	let exportNames = Array.isArray(state.exportNames) ? [...state.exportNames] : void 0;
+	const refused = new Set(importableOutputKeys(state).filter((name) => refusesExportName(name)));
+	if (refused.size > 0) {
+		for (const name of refused) Reflect.deleteProperty(outputs, name);
+		if (exportNames !== void 0) exportNames = exportNames.filter((name) => !refused.has(name));
+	}
+	return {
+		previousOutputs: {
+			outputs,
+			...exportNames !== void 0 && { exportNames }
+		},
+		previousCrossStackReads: {
+			...Array.isArray(state.imports) && { imports: [...state.imports] },
+			...Array.isArray(state.outputReads) && { outputReads: [...state.outputReads] }
+		}
+	};
+}
+function displacedPhysicalIdShown(op, logger, physicalId = journalOpPhysicalId(op)) {
+	if (physicalId === void 0) return void 0;
+	const masker = createOpMasker(logger, /* @__PURE__ */ new Map());
+	for (const properties of [
+		op.properties,
+		op.attemptedProperties,
+		op.previousState?.properties
+	]) {
+		if (properties === void 0) continue;
+		masker.addNamed({
+			resourceType: op.resourceType,
+			properties,
+			logicalId: op.logicalId,
+			physicalIds: [physicalId]
+		});
+	}
+	return displaySafe(String(masker.mask(physicalId)));
+}
+function displacedOpClause(op, marks, logger) {
+	const retainedOld = retainedOldPhysicalId(op);
+	if (retainedOld !== void 0 && marks.some((m) => isMarkFor(m, op))) {
+		const shownOld = displacedPhysicalIdShown(op, logger, retainedOld);
+		return `replaced ${shownOld} ${op.oldResourceRetained === true ? "but kept it (UpdateReplacePolicy: Retain)" : op.oldResourceMaySurvive !== void 0 ? "and may have kept it (its delete was not confirmed)" : "and may have kept it (the journal records no verdict)"}; cdkd import adopted the replacement, so ${shownOld} is left untracked`;
+	}
+	const shownId = displacedPhysicalIdShown(op, logger);
+	return shownId !== void 0 ? `recorded ${shownId}, which cdkd import has since replaced under this id` : "recorded no physical id, and cdkd import has since put another resource under this id";
+}
+function recordDisplacedSkips(recordEvent, stackName, ops) {
+	for (const op of ops) recordEvent?.({
+		eventType: "ROLLBACK_RESOURCE_SKIPPED",
+		stackName,
+		operation: op.changeType,
+		logicalId: op.logicalId,
+		resourceType: op.resourceType,
+		...op.provisionedBy && { provisionedBy: op.provisionedBy },
+		reason: "cdkd import has since put another resource under this logical id, so the op was not reverted; check the resource it recorded by hand"
+	});
+}
+function revertedNestedRowIds(ops) {
+	return ops.filter((op) => op.resourceType === NESTED_STACK_TYPE$2 && op.changeType === "UPDATE").map((op) => op.logicalId);
+}
+const revertRunStorage = new AsyncLocalStorage();
+function withNestedRevertRun(runId, fn) {
+	const run = {
+		runId,
+		settled: /* @__PURE__ */ new Map(),
+		warnings: 0
+	};
+	return revertRunStorage.run(run, () => fn(run));
+}
+function getNestedRevertRun() {
+	return revertRunStorage.getStore();
+}
+function errorText(error) {
+	return displaySafe(describeAwsFailure(error).detail);
+}
+function isPlainRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function dropNestedChildJournals(args) {
+	const { stateBackend, parentStackName, region, resources, logger } = args;
+	const depth = args.depth ?? 0;
+	if (!isPlainRecord(resources)) return;
+	if (depthExceeded(depth, parentStackName, logger)) return;
+	for (const [logicalId, record] of Object.entries(resources)) {
+		if (!isPlainRecord(record) || record["resourceType"] !== NESTED_STACK_TYPE$2) continue;
+		const child = nestedChildStackName(parentStackName, logicalId);
+		try {
+			const data = await stateBackend.getState(child, region);
+			if (data && isPlainRecord(data.state) && isPlainRecord(data.state.resources) && (data.state.stackName === void 0 || data.state.stackName === child)) await dropNestedChildJournals({
+				...args,
+				parentStackName: child,
+				resources: data.state.resources,
+				depth: depth + 1
+			});
+		} catch (error) {
+			warnUncleared(logger, child, error);
+		}
+		try {
+			if (await withChildLock(args.lockManager, child, region, logger, async () => {
+				if (args.beforeDelete) {
+					if (!await args.beforeDelete(child, await readOwnRecord(stateBackend, child, region))) return false;
+				}
+				let gone;
+				try {
+					gone = await stateBackend.deleteRollbackJournal(child, region);
+				} catch (error) {
+					await args.onDeleteFailed?.(child);
+					throw error;
+				}
+				if (gone === false) {
+					await args.onDeleteFailed?.(child);
+					return false;
+				}
+				return true;
+			})) logger.debug(safeMsg`Deleted the rollback journal of nested stack ${displaySafe(child)}`);
+		} catch (error) {
+			warnUncleared(logger, child, error);
+		}
+	}
+}
+async function readOwnRecord(stateBackend, child, region) {
+	try {
+		const data = await stateBackend.getState(child, region);
+		if (data && isPlainRecord(data.state) && isPlainRecord(data.state.resources) && (data.state.stackName === void 0 || data.state.stackName === child)) return data.state;
+	} catch {}
+}
+async function dropSettledNestedJournals(args) {
+	const { stateBackend, parentStackName, region, runId, logger } = args;
+	const depth = args.depth ?? 0;
+	if (runId === void 0) return;
+	if (depthExceeded(depth, parentStackName, logger)) return;
+	const isSettled = (segment) => segment.runId === runId && segment.reason === "nested-pending-parent";
+	for (const [logicalId, grandchildren] of args.settled) {
+		const child = nestedChildStackName(parentStackName, logicalId);
+		if (grandchildren.size > 0) await dropSettledNestedJournals({
+			...args,
+			parentStackName: child,
+			settled: grandchildren,
+			depth: depth + 1
+		});
+		try {
+			const removed = await withChildLock(args.lockManager, child, region, logger, () => stateBackend.dropRollbackJournalSegments(child, region, isSettled));
+			if (removed > 0) logger.debug(safeMsg`Dropped ${removed} settled rollback journal segment(s) of ${displaySafe(child)}`);
+		} catch (error) {
+			warnUncleared(logger, child, error);
+		}
+	}
+}
+async function withChildLock(lockManager, child, region, logger, fn) {
+	await lockManager.acquireLockWithRetry(child, region, void 0, "rollback");
+	try {
+		return await fn();
+	} finally {
+		await lockManager.releaseLock(child, region).catch((error) => {
+			logger.warn(safeMsg`Failed to release the lock of nested stack ${displayIdent(child)}: ${errorText(error)}`);
+		});
+	}
+}
+function depthExceeded(depth, parentStackName, logger) {
+	if (depth < MAX_NESTED_WALK_DEPTH) return false;
+	logger.warn(safeMsg`Stopped clearing nested rollback journals below ${displayIdent(parentStackName)}: ` + safeMsg`the nesting is deeper than ${MAX_NESTED_WALK_DEPTH} levels.`);
+	return true;
+}
+function warnUncleared(logger, child, error) {
+	logger.warn(safeMsg`Could not clear the rollback journal of nested stack ${displayIdent(child)}: ${errorText(error)}. ` + "It is inert to every parent revert (they select segments by run) and the next successful deploy of the top-level stack removes it.");
+}
+async function revertNestedChildFromJournal(args) {
+	const { ctx, logicalId, childStackName, region, run, logger } = args;
+	const runId = run.runId;
+	const shownChild = displayIdent(childStackName);
+	const refuse = (detail) => {
+		throw markNonRetryable(/* @__PURE__ */ new Error(`Cannot revert nested stack ${shownChild} (row ${displayIdent(logicalId)}): ${detail} The child was NOT (fully) reverted and may still hold the failed deploy's configuration. Inspect it with 'cdkd state show'; re-run the rollback once the cause is fixed (its journal is kept), or re-deploy the parent to converge.`));
+	};
+	if (runId === void 0) refuse("the rollback carries no deploy run id to select its journal segments by.");
+	await ctx.lockManager.acquireLockWithRetry(childStackName, region, void 0, "rollback");
+	try {
+		const stateData = await ctx.stateBackend.getState(childStackName, region);
+		if (!stateData) refuse("its state.json is missing.");
+		if (stateData.divergentBodyRegion !== void 0) refuse("its state record's region field disagrees with the key it is stored under.");
+		const base = stateData.state;
+		const refusalRecovery = {
+			profile: ctx.destroyOptions?.profile,
+			stateBucket: ctx.stateBucket,
+			statePrefix: ctx.destroyOptions?.statePrefix
+		};
+		refuseMalformedState(base, childStackName, region, refusalRecovery);
+		refuseMalformedOrphans(base, childStackName, region, refusalRecovery);
+		refuseMalformedOrphanRecords(base, childStackName, region, refusalRecovery);
+		const segments = ((await ctx.stateBackend.loadRollbackJournal(childStackName, region))?.segments ?? []).filter((segment) => segment.runId === runId);
+		if (segments.length === 0) refuse("its rollback journal holds no segment for this deploy run, so there is no record of what it held before.");
+		const stateResources = { ...base.resources };
+		const mintedOrphans = [];
+		const restoredOutputs = segments.find((s) => s.previousOutputs)?.previousOutputs;
+		const restoredReads = segments.find((s) => s.previousCrossStackReads)?.previousCrossStackReads;
+		let currentEtag = stateData.etag;
+		let persisted = false;
+		let restoring = false;
+		const { skippedOutputs: _dropped, ...carried } = base;
+		const next = () => ({
+			...carried,
+			version: 12,
+			region,
+			resources: { ...stateResources },
+			...orphansAfterRollback(base, mintedOrphans),
+			...restoring && restoredOutputs && { outputs: { ...restoredOutputs.outputs } },
+			...restoring && restoredReads && {
+				...restoredReads.imports && { imports: [...restoredReads.imports] },
+				...restoredReads.outputReads && { outputReads: [...restoredReads.outputReads] }
+			},
+			...restoring && restoredOutputs?.exportNames && { exportNames: [...restoredOutputs.exportNames] },
+			lastModified: Date.now()
+		});
+		const nextState = () => {
+			const state = next();
+			if (!restoring) return state;
+			if (restoredOutputs && !restoredOutputs.exportNames) delete state.exportNames;
+			if (restoredOutputs) delete state.outputReferenceProvenance;
+			if (restoredReads && !restoredReads.imports) delete state.imports;
+			if (restoredReads && !restoredReads.outputReads) delete state.outputReads;
+			return state;
+		};
+		const save = async () => {
+			persisted = false;
+			try {
+				currentEtag = await ctx.stateBackend.saveState(childStackName, region, nextState(), { ...currentEtag !== void 0 && { expectedEtag: currentEtag } });
+				persisted = true;
+			} catch {
+				try {
+					const fresh = await ctx.stateBackend.getState(childStackName, region);
+					currentEtag = await ctx.stateBackend.saveState(childStackName, region, nextState(), { ...fresh?.etag !== void 0 && { expectedEtag: fresh.etag } });
+					persisted = true;
+				} catch (retryError) {
+					logger.warn(safeMsg`Failed to persist the state of nested stack ${shownChild} after reverting it: ` + safeMsg`${errorText(retryError)}. The resources were reverted in AWS.`);
+				}
+			}
+		};
+		const producerRegions = inheritProducerRegions(producerRegionsFromState({
+			imports: [...base.imports ?? [], ...restoredReads?.imports ?? []],
+			outputReads: [...base.outputReads ?? [], ...restoredReads?.outputReads ?? []]
+		}), args.inheritedProducerRegions);
+		const execCtx = {
+			providerRegistry: ctx.providerRegistry,
+			region,
+			logger,
+			...ctx.options?.eventRecorder && { recordEvent: (event) => ctx.options.eventRecorder.record(maskEventTextWithBoundBags(event)) },
+			finalSnapshotClients: ctx.options?.finalSnapshotClients,
+			skipFinalSnapshot: ctx.options?.skipFinalSnapshot === true || ctx.destroyOptions?.skipFinalSnapshot === true,
+			...ctx.destroyOptions?.removeProtection === true && {
+				removeProtection: true,
+				foreignHolder: makeForeignHolderScan(ctx.stateBackend)({
+					stackName: childStackName,
+					region
+				})
+			},
+			importedProducerRegions: producerRegions.regions,
+			producerRegionsIncomplete: !producerRegions.complete,
+			nestedChildRevert: true
+		};
+		const childCtx = {
+			...ctx,
+			parentStackName: childStackName,
+			parentRegion: region,
+			nestedTemplates: void 0
+		};
+		let failures = 0;
+		let warnings = 0;
+		const inlinePolicyWriters = new RollbackInlinePolicyWriters();
+		const settledBelow = /* @__PURE__ */ new Map();
+		for (let s = segments.length - 1; s >= 0; s--) {
+			const segment = segments[s];
+			const skipPrefix = segment.skipPrefix ?? getCurrentSkipPrefix();
+			const split = splitImportedOps(segment.operations, segment);
+			const result = await withNestedStackContext(childCtx, () => withSkipPrefix(skipPrefix, () => withStackName(childStackName, () => withCreateTokenLedger(ledgerForStack(ctx.stateBackend, childStackName, region), () => withNestedRevertRun(runId, async (inner) => {
+				const replayed = await withPrintingSecrets(journaledOrphanPrintingBag(completedReplayEntries(split.replay), stateResources), () => replayRollback(split.replay, stateResources, childStackName, execCtx, {
+					afterOp: save,
+					onOrphan: (record) => mintedOrphans.push(record),
+					inlinePolicyWriters,
+					failedOperations: segment.failedOperations
+				}));
+				for (const [id, below] of inner.settled) settledBelow.set(id, below);
+				return {
+					...replayed,
+					warnings: replayed.warnings + inner.warnings
+				};
+			})))));
+			failures += result.failures;
+			warnings += result.warnings + split.displaced.length;
+			recordDisplacedSkips(execCtx.recordEvent, childStackName, split.displaced);
+			for (const op of split.displaced) logger.warn(safeMsg`Nested stack ${childStackName}: ${op.logicalId} ` + safeMsg`${displacedOpClause(op, segment.importedResources ?? [], logger)}; ` + "not reverted, check that resource by hand");
+		}
+		restoring = failures === 0;
+		await save();
+		if (restoring && persisted && restoredOutputs && ctx.exportIndexStore) await ctx.exportIndexStore.updateForStack(childStackName, region, importableOutputs(nextState()));
+		if (warnings > 0) logger.warn(safeMsg`Nested stack ${shownChild}: ${warnings} operation(s) were skipped with a warning during ` + `its revert (see above); they may need attention by hand.`);
+		if (failures > 0) refuse(`${failures} of its operation(s) failed to revert (see the warnings above).`);
+		if (warnings > 0) run.warnings += warnings;
+		else run.settled.set(logicalId, settledBelow);
+		return { warnings };
+	} finally {
+		await ctx.lockManager.releaseLock(childStackName, region).catch((error) => {
+			logger.warn(safeMsg`Failed to release the lock of nested stack ${shownChild}: ${errorText(error)}`);
+		});
+	}
+}
+
 //#endregion
 //#region src/deployment/rollback-executor/journaled-orphans.ts
 const NONE = {
@@ -35905,6 +36261,7 @@ async function loadJournaledOrphans(stateBackend, stackName, region, rollbackOrp
 	for (const segment of segments) if (options.deployRunId !== void 0 && segment.reason === "nested-pending-parent" && segment.runId === options.deployRunId) for (const op of segment.operations) deployLogicalIds.add(op.logicalId);
 	const out = [];
 	let count = 0;
+	const pendingRequests = segments.flatMap((segment) => segment.failedOperations ?? []).filter((op) => op.pendingCloudControlRequest !== void 0).length;
 	for (let s = segments.length - 1; s >= 0; s--) {
 		const segment = segments[s];
 		if (segment.reason === "nested-pending-parent") continue;
@@ -35922,7 +36279,8 @@ async function loadJournaledOrphans(stateBackend, stackName, region, rollbackOrp
 	return {
 		segments: out,
 		count,
-		deployLogicalIds
+		deployLogicalIds,
+		...pendingRequests > 0 && { pendingRequests }
 	};
 }
 function journaledOrphanLines(orphans, logger) {
@@ -36038,10 +36396,24 @@ async function settleJournaledOrphansOnSuccess(args) {
 			keepJournal: true
 		};
 	}
-	if (orphans.count === 0) return {
-		unaddressed: 0,
-		keepJournal: false
+	const pendingKept = (orphans.pendingRequests ?? 0) > 0;
+	const keepPendingOnly = async () => {
+		try {
+			await stateBackend.reduceRollbackJournalToFailedOperations(stackName, region, (op) => op.pendingCloudControlRequest !== void 0, newerIds, () => false);
+			return true;
+		} catch (err) {
+			logger.warn(safeMsg`Failed to reduce the rollback journal of stack ${stack} to its unsettled Cloud ` + safeMsg`Control requests: ${errorDetail(err)}. The whole journal is kept.`);
+			await markSuperseded(stateBackend, stackName, region, newerIds);
+			return false;
+		}
 	};
+	if (orphans.count === 0) {
+		if (pendingKept) await keepPendingOnly();
+		return {
+			unaddressed: 0,
+			keepJournal: pendingKept
+		};
+	}
 	const all = orphans.segments.flatMap(({ segment, ops }) => ops.map((op) => ({
 		segment,
 		op
@@ -36093,15 +36465,18 @@ async function settleJournaledOrphansOnSuccess(args) {
 			logger.warn(safeMsg`Failed to remove the settled entries from the rollback journal of stack ${stack}: ` + safeMsg`${errorDetail(err)}. A cdkd rollback or cdkd destroy could act on them again; run a ` + "successful cdkd deploy of the stack first, which settles them again.");
 		}
 	};
-	if (kept.length === 0) return {
-		unaddressed: skipped + leftInPlace,
-		keepJournal: false,
-		...stripCleared && { stripCleared }
-	};
+	if (kept.length === 0) {
+		if (pendingKept && !await keepPendingOnly()) await stripCleared?.();
+		return {
+			unaddressed: skipped + leftInPlace,
+			keepJournal: pendingKept,
+			...stripCleared && { stripCleared }
+		};
+	}
 	const keptIds = new Set(kept.map(({ op }) => op.logicalId));
 	const supersededIds = newerIds.filter((id) => !keptIds.has(id));
 	const demoted = kept.filter(({ op }) => op.physicalIdRecoveredFromError === false);
-	const reduce = () => stateBackend.reduceRollbackJournalToFailedOperations(stackName, region, (op, segment) => isHandledOrphan(kept, segment, op), supersededIds, (op, segment) => isHandledOrphan(demoted, segment, op));
+	const reduce = () => stateBackend.reduceRollbackJournalToFailedOperations(stackName, region, (op, segment) => isHandledOrphan(kept, segment, op) || op.pendingCloudControlRequest !== void 0, supersededIds, (op, segment) => isHandledOrphan(demoted, segment, op));
 	let reduced = false;
 	for (let attempt = 0; attempt < 2 && !reduced; attempt++) try {
 		await reduce();
@@ -36302,342 +36677,496 @@ function sameJournaledOrphans(a, b) {
 }
 
 //#endregion
-//#region src/provisioning/nested-stack-context.ts
-const storage$1 = new AsyncLocalStorage();
-function withNestedStackContext(ctx, fn) {
-	return storage$1.run(ctx, fn);
+//#region src/deployment/cc-pending-requests.ts
+function hasPendingCloudControlRequest(op) {
+	return op.pendingCloudControlRequest !== void 0;
 }
-function getCurrentNestedStackContext() {
-	return storage$1.getStore();
+function pendingRequestCount(journal) {
+	return pendingRequests(journal ?? null).size;
 }
-async function collectNestedChildUnaddressed(fn) {
-	const ctx = storage$1.getStore();
-	if (!ctx) return {
-		value: await fn(),
-		unaddressed: void 0
-	};
-	const slot = {};
-	return {
-		value: await storage$1.run({
-			...ctx,
-			childUnaddressed: slot
-		}, fn),
-		unaddressed: slot.last
+async function resolvePendingCloudControlRequests(params) {
+	const { journal, stackName, region } = params;
+	if (pendingRequests(params.loaded).size === 0) return false;
+	const settle = async () => {
+		await params.beforeSettle?.();
+		let current = params.loaded;
+		if (params.underLock) try {
+			current = await journal.loadRollbackJournal(stackName, region);
+		} catch (error) {
+			throw new CdkdError(safeMsg`cdkd ${params.command} of ${displayStackName(stackName)} refused: its rollback ` + "journal recorded an unsettled Cloud Control CREATE when this run started and cannot " + safeMsg`be read now (${displaySafe(describeAwsFailure(error).summary)}). Nothing was ` + "changed; re-run once it can be read.", "CC_PENDING_REQUEST_UNREADABLE");
+		}
+		const pending = pendingRequests(current);
+		if (pending.size > 0) await settlePending(params, pending);
+		return params.underLock !== void 0 || pending.size > 0;
 	};
+	return params.underLock ? params.underLock(settle) : settle();
 }
-
-//#endregion
-//#region src/deployment/nested-child-journal.ts
-const NESTED_PENDING_PARENT_REASON = "nested-pending-parent";
-const NESTED_STACK_TYPE$2 = "AWS::CloudFormation::Stack";
-const MAX_NESTED_WALK_DEPTH = 32;
-function nestedChildStackName(parentStackName, logicalId) {
-	return `${parentStackName}~${logicalId}`;
+function pendingRequests(loaded) {
+	const pending = /* @__PURE__ */ new Map();
+	for (const segment of loaded?.segments ?? []) for (const op of segment.failedOperations ?? []) if (hasPendingCloudControlRequest(op)) pending.set(op.pendingCloudControlRequest.requestToken, op);
+	return pending;
 }
-function nestedPendingSnapshot(state, refusesExportName) {
-	const outputs = { ...isPlainRecord(state.outputs) ? state.outputs : {} };
-	let exportNames = Array.isArray(state.exportNames) ? [...state.exportNames] : void 0;
-	const refused = new Set(importableOutputKeys(state).filter((name) => refusesExportName(name)));
-	if (refused.size > 0) {
-		for (const name of refused) Reflect.deleteProperty(outputs, name);
-		if (exportNames !== void 0) exportNames = exportNames.filter((name) => !refused.has(name));
-	}
-	return {
-		previousOutputs: {
-			outputs,
-			...exportNames !== void 0 && { exportNames }
-		},
-		previousCrossStackReads: {
-			...Array.isArray(state.imports) && { imports: [...state.imports] },
-			...Array.isArray(state.outputReads) && { outputReads: [...state.outputReads] }
+async function settlePending(params, pending) {
+	const { journal, stackName, region, command, logger } = params;
+	const reader = params.reader();
+	const isUnique = params.identifierUnique ?? ccIdentifierIsUnique;
+	const stackShown = displayStackName(stackName);
+	const settlements = /* @__PURE__ */ new Map();
+	const unresolved = [];
+	for (const [token, op] of pending) {
+		const named = `${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)})`;
+		logger.info(safeMsg`A previous run of ${stackShown} stopped waiting for the Cloud Control CREATE of ${named}; ` + "checking how it ended...");
+		const outcome = await reader.resumeAbandonedRequest(token, op.logicalId, op.resourceType);
+		switch (outcome.status) {
+			case "succeeded":
+			case "failed":
+			case "cancelled": {
+				const made = outcome.status === "succeeded" ? outcome.identifier : outcome.remnant;
+				if (made === void 0) {
+					logger.info(safeMsg`The CREATE of ${named} ${outcome.status === "cancelled" ? "was cancelled" : "failed"} ` + "in AWS and made nothing.");
+					settlements.set(token, { kind: "drop" });
+					break;
+				}
+				const madeShown = displacedPhysicalIdShown({
+					...op,
+					physicalId: made
+				}, logger, made) ?? "a resource";
+				const held = params.stateResources?.[op.logicalId];
+				if (held !== void 0 && held.physicalId === made) {
+					logger.info(safeMsg`The CREATE of ${named} made ${madeShown}, which state already records.`);
+					settlements.set(token, { kind: "drop" });
+					break;
+				}
+				const unique = await isUnique({
+					resourceType: op.resourceType,
+					identifier: made,
+					attemptedProperties: op.attemptedProperties,
+					logicalId: op.logicalId,
+					stackName
+				});
+				const ended = outcome.status === "succeeded" ? "completed" : outcome.status === "cancelled" ? "was cancelled" : "failed";
+				if (outcome.status === "succeeded" && unique && held === void 0 && params.resume?.(op, made)) {
+					logger.info(safeMsg`The CREATE of ${named} completed in AWS after cdkd stopped waiting, and made ` + safeMsg`${madeShown}; this deploy's CREATE of it takes that resource over when it sends ` + "the same properties.");
+					settlements.set(token, { kind: "resume" });
+					break;
+				}
+				if (params.resume !== void 0 && !unique) logger.warn(safeMsg`The CREATE of ${named} ${ended} in AWS after cdkd stopped waiting, and made ` + safeMsg`${madeShown}. cdkd cannot prove its id is unique (it may be a name, which can ` + safeMsg`since belong to another resource), so this deploy does not take it over, and creating ${logicalIdShown(op.logicalId)} ` + "again will ask for the name it holds. Adopt it with cdkd import (--resource " + safeMsg`${logicalIdShown(op.logicalId)}=<its id>), or delete it, then re-run. It is kept in the ` + "rollback journal as a resource the failed deploy created.");
+				else logger.warn(safeMsg`The CREATE of ${named} ${ended} in AWS after cdkd stopped waiting, and made ` + safeMsg`${madeShown}. It is now recorded in the rollback journal as a resource the failed ` + "deploy created: cdkd destroy, cdkd rollback --revert-failed and the next successful deploy delete it as its DeletionPolicy directs when cdkd can prove it is still the resource that create made, and otherwise name it in a warning for you to delete by hand.");
+				settlements.set(token, {
+					kind: "orphan",
+					physicalId: made,
+					unique
+				});
+				break;
+			}
+			case "not-found":
+				logger.warn(safeMsg`Cloud Control no longer has the CREATE request of ${named}: requests expire after ` + "seven days, and a request is not visible from another account or region. cdkd cannot tell whether it created the resource and stops tracking the request. If it exists, adopt it with cdkd import or delete it by hand.");
+				settlements.set(token, { kind: "drop" });
+				break;
+			case "unresolved": {
+				settlements.set(token, { kind: "keep" });
+				const reason = holdsSecretReference(op.attemptedProperties) ? "details withheld: its properties carry a secret" : displaySafe(describeAwsFailure(outcome.error).summary);
+				unresolved.push(safeMsg`  - ${named}${reason === "" ? "" : ` (${reason})`}\n` + `    Check it with: ${await reader.buildResumeCommand(token)}`);
+				break;
+			}
 		}
-	};
-}
-function displacedPhysicalIdShown(op, logger, physicalId = journalOpPhysicalId(op)) {
-	if (physicalId === void 0) return void 0;
-	const masker = createOpMasker(logger, /* @__PURE__ */ new Map());
-	for (const properties of [
-		op.properties,
-		op.attemptedProperties,
-		op.previousState?.properties
-	]) {
-		if (properties === void 0) continue;
-		masker.addNamed({
-			resourceType: op.resourceType,
-			properties,
-			logicalId: op.logicalId,
-			physicalIds: [physicalId]
-		});
 	}
-	return displaySafe(String(masker.mask(physicalId)));
+	if ([...settlements.values()].some((s) => s.kind === "orphan" || s.kind === "drop")) await journal.rewriteRollbackJournalFailedOperations(stackName, region, (op) => {
+		if (!hasPendingCloudControlRequest(op)) return op;
+		const settlement = settlements.get(op.pendingCloudControlRequest.requestToken);
+		if (settlement?.kind === "drop") return withoutPendingRequest(op);
+		if (settlement?.kind !== "orphan") return op;
+		return {
+			...withoutPendingRequest(op),
+			provisionedBy: "cc-api",
+			physicalId: settlement.physicalId,
+			physicalIdRecoveredFromError: true,
+			...settlement.unique && { createdIdentifierUnique: true }
+		};
+	});
+	if (unresolved.length > 0) {
+		const kept = [...pending.values()].filter((op) => settlements.get(op.pendingCloudControlRequest.requestToken)?.kind === "keep");
+		const drop = dropFailedCommands(stackName, region, kept.map((op) => op.logicalId));
+		const withheld = drop?.commands.some((c) => c.includes("<")) === true;
+		throw new CdkdError(safeMsg`cdkd ${command} of ${stackShown} refused: a previous run stopped waiting for a Cloud ` + `Control CREATE, and cdkd still cannot tell whether it made its resource. Proceeding could leave that resource untracked. Nothing was changed.
+${unresolved.join("\n")}\nRe-run once the request has finished and can be read. If you have reconciled it by hand (cdkd import, or deleted the resource), drop its journal entry with:` + (drop === void 0 ? "" : drop.commands.map((c) => `\n  ${c}`).join("")) + (withheld ? "\nA value that is not a plain identifier is shown as a <hole>; read it from the stack's state record and rollback-journal.json." : ""), "CC_PENDING_REQUEST_UNRESOLVED");
+	}
+}
+function holdsSecretReference(properties) {
+	if (properties === void 0) return false;
+	return carriesSecretMask(properties) || JSON.stringify(properties).includes("{{resolve:");
+}
+const ccIdentifierIsUnique = async ({ resourceType, identifier, attemptedProperties, logicalId, stackName }) => {
+	if (attemptedProperties === void 0 || holdsSecretReference(attemptedProperties)) return false;
+	const [fields, readOnly] = await Promise.all([getPrimaryIdentifierFields(resourceType), getTopLevelReadOnlyProperties(resourceType)]);
+	if (fields === void 0 || readOnly === void 0) return false;
+	const parts = identifier.split("|");
+	if (parts.length !== fields.length) return false;
+	const sent = /* @__PURE__ */ new Set();
+	const collect = (value) => {
+		if (typeof value === "string" || typeof value === "number") for (const piece of nameSegments(String(value))) sent.add(piece);
+		else if (Array.isArray(value)) value.forEach(collect);
+		else if (value !== null && typeof value === "object") Object.values(value).forEach(collect);
+	};
+	collect(attemptedProperties);
+	return parts.some((part, i) => {
+		if (part === "" || !readOnly.has(fields[i])) return false;
+		return !nameSegments(part).some((segment) => sent.has(segment) || looksLikeCdkdGeneratedName(segment, logicalId, stackName));
+	});
+};
+function nameSegments(value) {
+	const text = value.toLowerCase();
+	const arn = /^arn:[^:]*:[^:]*:[^:]*:[^:]*:(.*)$/.exec(text);
+	const body = arn ? arn[1] : text;
+	return [
+		text,
+		body,
+		...body.split(/[:/]/)
+	].filter((piece) => piece !== "");
 }
-function displacedOpClause(op, marks, logger) {
-	const retainedOld = retainedOldPhysicalId(op);
-	if (retainedOld !== void 0 && marks.some((m) => isMarkFor(m, op))) {
-		const shownOld = displacedPhysicalIdShown(op, logger, retainedOld);
-		return `replaced ${shownOld} ${op.oldResourceRetained === true ? "but kept it (UpdateReplacePolicy: Retain)" : op.oldResourceMaySurvive !== void 0 ? "and may have kept it (its delete was not confirmed)" : "and may have kept it (the journal records no verdict)"}; cdkd import adopted the replacement, so ${shownOld} is left untracked`;
-	}
-	const shownId = displacedPhysicalIdShown(op, logger);
-	return shownId !== void 0 ? `recorded ${shownId}, which cdkd import has since replaced under this id` : "recorded no physical id, and cdkd import has since put another resource under this id";
+function withoutPendingRequest(op) {
+	const { pendingCloudControlRequest: _settled, ...rest } = op;
+	return rest;
 }
-function recordDisplacedSkips(recordEvent, stackName, ops) {
-	for (const op of ops) recordEvent?.({
-		eventType: "ROLLBACK_RESOURCE_SKIPPED",
-		stackName,
-		operation: op.changeType,
-		logicalId: op.logicalId,
-		resourceType: op.resourceType,
-		...op.provisionedBy && { provisionedBy: op.provisionedBy },
-		reason: "cdkd import has since put another resource under this logical id, so the op was not reverted; check the resource it recorded by hand"
-	});
+
+//#endregion
+//#region src/state/deployment-events-store.ts
+const DEPLOYMENT_EVENTS_MAX_INDEX_RUNS = 20;
+const FLUSH_INTERVAL_MS = 2e3;
+const FLUSH_EVENT_THRESHOLD = 50;
+function newDeploymentRunId(now = /* @__PURE__ */ new Date()) {
+	return `${now.toISOString().replace(/[-:.]/g, "")}-${randomUUID().slice(0, 8)}`;
 }
-function revertedNestedRowIds(ops) {
-	return ops.filter((op) => op.resourceType === NESTED_STACK_TYPE$2 && op.changeType === "UPDATE").map((op) => op.logicalId);
+function deploymentEventsKey(prefix, stackName, region, runId) {
+	return `${prefix}/${stackName}/${region}/deployments/${runId}.jsonl`;
 }
-const revertRunStorage = new AsyncLocalStorage();
-function withNestedRevertRun(runId, fn) {
-	const run = {
-		runId,
-		settled: /* @__PURE__ */ new Map(),
-		warnings: 0
-	};
-	return revertRunStorage.run(run, () => fn(run));
+function deploymentEventsIndexKey(prefix, stackName, region) {
+	return `${prefix}/${stackName}/${region}/deployments/index.json`;
 }
-function getNestedRevertRun() {
-	return revertRunStorage.getStore();
+function deploymentsDirPrefix(prefix, stackName, region) {
+	return `${prefix}/${stackName}/${region}/deployments/`;
 }
-function errorText(error) {
-	return displaySafe(describeAwsFailure(error).detail);
+const DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION = "deployment-event streams and their index, whose recorded error messages can quote values the secret mask does not catch";
+async function deleteAndPurgeEventObjects(backend, keys, dirPrefix, scope = "deleted-keys") {
+	if (keys.length === 0) return void 0;
+	let swept;
+	try {
+		await backend.deleteRawObjects(keys);
+	} finally {
+		if (scope === "whole-dir") swept = await backend.purgeNoncurrentVersionsUnderPrefix(dirPrefix, { objectDescription: DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION });
+		else await backend.purgeNoncurrentVersions(keys, {
+			...keys.length > 1 && { listPrefix: dirPrefix },
+			objectDescription: DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION
+		});
+	}
+	return swept;
 }
-function isPlainRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
+function runIdTimestampMs(runId) {
+	const m = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})(\d{3})Z/.exec(runId);
+	if (!m) return null;
+	const iso = `${m[1]}-${m[2]}-${m[3]}T${m[4]}:${m[5]}:${m[6]}.${m[7]}Z`;
+	const ms = Date.parse(iso);
+	return Number.isNaN(ms) ? null : ms;
 }
-async function dropNestedChildJournals(args) {
-	const { stateBackend, parentStackName, region, resources, logger } = args;
-	const depth = args.depth ?? 0;
-	if (!isPlainRecord(resources)) return;
-	if (depthExceeded(depth, parentStackName, logger)) return;
-	for (const [logicalId, record] of Object.entries(resources)) {
-		if (!isPlainRecord(record) || record["resourceType"] !== NESTED_STACK_TYPE$2) continue;
-		const child = nestedChildStackName(parentStackName, logicalId);
+function runIdFromJsonlKey(key, dirPrefix) {
+	if (!key.startsWith(dirPrefix) || !key.endsWith(".jsonl")) return null;
+	return key.slice(dirPrefix.length, -6);
+}
+var DeploymentEventsStore = class {
+	logger = getLogger().child("DeploymentEvents");
+	backend;
+	stackName;
+	region;
+	command;
+	runId;
+	cdkdVersion;
+	startedAt;
+	events = [];
+	persistedCount = 0;
+	flushTimer;
+	writeChain = Promise.resolve();
+	warnedOnce = false;
+	finalized = false;
+	constructor(backend, options) {
+		this.backend = backend;
+		this.stackName = options.stackName;
+		this.region = options.region;
+		this.command = options.command;
+		this.runId = options.runId ?? newDeploymentRunId();
+		this.cdkdVersion = options.cdkdVersion ?? getCdkdVersion();
+		this.startedAt = (/* @__PURE__ */ new Date()).toISOString();
+	}
+	record(event) {
 		try {
-			const data = await stateBackend.getState(child, region);
-			if (data && isPlainRecord(data.state) && isPlainRecord(data.state.resources) && (data.state.stackName === void 0 || data.state.stackName === child)) await dropNestedChildJournals({
-				...args,
-				parentStackName: child,
-				resources: data.state.resources,
-				depth: depth + 1
+			if (this.finalized) return;
+			this.events.push({
+				timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+				...event
 			});
-		} catch (error) {
-			warnUncleared(logger, child, error);
+			if (this.events.length - this.persistedCount >= FLUSH_EVENT_THRESHOLD) this.scheduleFlush(0);
+			else this.scheduleFlush(FLUSH_INTERVAL_MS);
+		} catch {}
+	}
+	async finalize(result) {
+		if (this.finalized) return;
+		this.finalized = true;
+		if (this.flushTimer) {
+			clearTimeout(this.flushTimer);
+			this.flushTimer = void 0;
 		}
-		try {
-			if (await withChildLock(args.lockManager, child, region, logger, async () => {
-				if (args.beforeDelete) {
-					if (!await args.beforeDelete(child, await readOwnRecord(stateBackend, child, region))) return false;
-				}
-				let gone;
-				try {
-					gone = await stateBackend.deleteRollbackJournal(child, region);
-				} catch (error) {
-					await args.onDeleteFailed?.(child);
-					throw error;
-				}
-				if (gone === false) {
-					await args.onDeleteFailed?.(child);
-					return false;
-				}
-				return true;
-			})) logger.debug(safeMsg`Deleted the rollback journal of nested stack ${displaySafe(child)}`);
-		} catch (error) {
-			warnUncleared(logger, child, error);
+		if (this.events.length === 0) return;
+		await this.enqueueWrite(async () => {
+			const indexRead = this.readIndexRuns();
+			indexRead.catch(() => {});
+			await this.doFlush();
+			await this.writeIndexAndPrune(result, await indexRead);
+		});
+	}
+	async writeIndexAndPrune(result, existingRuns) {
+		const { key, file, runs } = this.buildIndexUpdate(result, existingRuns);
+		const keptRunIds = runs.map((r) => r.runId);
+		const willPrune = keptRunIds.length >= 20;
+		const dirPrefix = deploymentsDirPrefix(this.backend.prefix, this.stackName, this.region);
+		const staleKeysRead = willPrune ? this.backend.listRawKeys(dirPrefix) : void 0;
+		staleKeysRead?.catch(() => {});
+		await this.backend.putRawObject(key, JSON.stringify(file, null, 2));
+		if (!staleKeysRead) return;
+		await this.pruneSupersededRunFiles(keptRunIds, dirPrefix, await staleKeysRead);
+	}
+	async drain() {
+		await this.writeChain;
+	}
+	scheduleFlush(delayMs) {
+		if (this.flushTimer) {
+			if (delayMs > 0) return;
+			clearTimeout(this.flushTimer);
 		}
+		this.flushTimer = setTimeout(() => {
+			this.flushTimer = void 0;
+			this.enqueueWrite(() => this.doFlush());
+		}, delayMs);
+		this.flushTimer.unref?.();
 	}
-}
-async function readOwnRecord(stateBackend, child, region) {
-	try {
-		const data = await stateBackend.getState(child, region);
-		if (data && isPlainRecord(data.state) && isPlainRecord(data.state.resources) && (data.state.stackName === void 0 || data.state.stackName === child)) return data.state;
-	} catch {}
-}
-async function dropSettledNestedJournals(args) {
-	const { stateBackend, parentStackName, region, runId, logger } = args;
-	const depth = args.depth ?? 0;
-	if (runId === void 0) return;
-	if (depthExceeded(depth, parentStackName, logger)) return;
-	const isSettled = (segment) => segment.runId === runId && segment.reason === "nested-pending-parent";
-	for (const [logicalId, grandchildren] of args.settled) {
-		const child = nestedChildStackName(parentStackName, logicalId);
-		if (grandchildren.size > 0) await dropSettledNestedJournals({
-			...args,
-			parentStackName: child,
-			settled: grandchildren,
-			depth: depth + 1
+	enqueueWrite(op) {
+		const next = this.writeChain.then(op).catch((err) => {
+			this.warnOnce(`Failed to persist deployment events for run ${this.runId}: ${describeAwsFailure(err).detail}`);
 		});
+		this.writeChain = next;
+		return next;
+	}
+	async doFlush() {
+		if (this.events.length === 0 || this.events.length === this.persistedCount) return;
+		const snapshotCount = this.events.length;
+		const body = this.events.slice(0, snapshotCount).map((e) => JSON.stringify(e)).join("\n");
+		await this.backend.putRawObject(deploymentEventsKey(this.backend.prefix, this.stackName, this.region, this.runId), body + "\n", "application/x-ndjson");
+		this.persistedCount = snapshotCount;
+	}
+	async readIndexRuns() {
+		const key = deploymentEventsIndexKey(this.backend.prefix, this.stackName, this.region);
 		try {
-			const removed = await withChildLock(args.lockManager, child, region, logger, () => stateBackend.dropRollbackJournalSegments(child, region, isSettled));
-			if (removed > 0) logger.debug(safeMsg`Dropped ${removed} settled rollback journal segment(s) of ${displaySafe(child)}`);
-		} catch (error) {
-			warnUncleared(logger, child, error);
+			const raw = await this.backend.getRawObject(key);
+			if (raw !== null) {
+				const parsed = JSON.parse(raw);
+				if (Array.isArray(parsed.runs)) return parsed.runs;
+			}
+		} catch (err) {
+			this.logger.debug(`Deployment-events index unreadable, rewriting: ${describeAwsFailure(err).detail}`);
 		}
+		return [];
 	}
-}
-async function withChildLock(lockManager, child, region, logger, fn) {
-	await lockManager.acquireLockWithRetry(child, region, void 0, "rollback");
-	try {
-		return await fn();
-	} finally {
-		await lockManager.releaseLock(child, region).catch((error) => {
-			logger.warn(safeMsg`Failed to release the lock of nested stack ${displayIdent(child)}: ${errorText(error)}`);
+	buildIndexUpdate(result, existingRuns) {
+		const key = deploymentEventsIndexKey(this.backend.prefix, this.stackName, this.region);
+		const runs = [{
+			runId: this.runId,
+			command: this.command,
+			cdkdVersion: this.cdkdVersion,
+			startedAt: this.startedAt,
+			finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			result,
+			eventCount: this.persistedCount
+		}, ...existingRuns.filter((r) => r.runId !== this.runId)].slice(0, 20);
+		return {
+			key,
+			file: {
+				indexVersion: 1,
+				stackName: this.stackName,
+				region: this.region,
+				runs,
+				lastModified: Date.now()
+			},
+			runs
+		};
+	}
+	async pruneSupersededRunFiles(keptRunIds, dirPrefix, keys) {
+		if (keptRunIds.length < 20) return;
+		const cutoff = keptRunIds.reduce((min, id) => id < min ? id : min, keptRunIds[0]);
+		const stale = keys.filter((k) => {
+			const runId = runIdFromJsonlKey(k, dirPrefix);
+			return runId !== null && runId < cutoff;
 		});
+		if (stale.length === 0) return;
+		await deleteAndPurgeEventObjects(this.backend, stale, dirPrefix);
+		this.logger.debug(`Pruned ${stale.length} superseded deployment-event stream(s) for ${this.stackName} (${this.region})`);
 	}
-}
-function depthExceeded(depth, parentStackName, logger) {
-	if (depth < MAX_NESTED_WALK_DEPTH) return false;
-	logger.warn(safeMsg`Stopped clearing nested rollback journals below ${displayIdent(parentStackName)}: ` + safeMsg`the nesting is deeper than ${MAX_NESTED_WALK_DEPTH} levels.`);
-	return true;
-}
-function warnUncleared(logger, child, error) {
-	logger.warn(safeMsg`Could not clear the rollback journal of nested stack ${displayIdent(child)}: ${errorText(error)}. ` + "It is inert to every parent revert (they select segments by run) and the next successful deploy of the top-level stack removes it.");
-}
-async function revertNestedChildFromJournal(args) {
-	const { ctx, logicalId, childStackName, region, run, logger } = args;
-	const runId = run.runId;
-	const shownChild = displayIdent(childStackName);
-	const refuse = (detail) => {
-		throw markNonRetryable(/* @__PURE__ */ new Error(`Cannot revert nested stack ${shownChild} (row ${displayIdent(logicalId)}): ${detail} The child was NOT (fully) reverted and may still hold the failed deploy's configuration. Inspect it with 'cdkd state show'; re-run the rollback once the cause is fixed (its journal is kept), or re-deploy the parent to converge.`));
-	};
-	if (runId === void 0) refuse("the rollback carries no deploy run id to select its journal segments by.");
-	await ctx.lockManager.acquireLockWithRetry(childStackName, region, void 0, "rollback");
-	try {
-		const stateData = await ctx.stateBackend.getState(childStackName, region);
-		if (!stateData) refuse("its state.json is missing.");
-		if (stateData.divergentBodyRegion !== void 0) refuse("its state record's region field disagrees with the key it is stored under.");
-		const base = stateData.state;
-		const refusalRecovery = {
-			profile: ctx.destroyOptions?.profile,
-			stateBucket: ctx.stateBucket,
-			statePrefix: ctx.destroyOptions?.statePrefix
+	warnOnce(message) {
+		if (this.warnedOnce) {
+			this.logger.debug(message);
+			return;
+		}
+		this.warnedOnce = true;
+		this.logger.warn(`${message} — continuing; deployment events are best-effort and never block the run.`);
+	}
+};
+var DeploymentEventsReader = class {
+	backend;
+	constructor(backend) {
+		this.backend = backend;
+	}
+	async listRegions(stackName) {
+		const prefix = `${this.backend.prefix}/${stackName}/`;
+		const keys = await this.backend.listRawKeys(prefix);
+		const regions = /* @__PURE__ */ new Set();
+		for (const key of keys) {
+			const segments = key.slice(prefix.length).split("/");
+			if (segments.length === 3 && segments[1] === "deployments" && segments[0]) regions.add(segments[0]);
+		}
+		return [...regions].sort();
+	}
+	async listRuns(stackName, region) {
+		const key = deploymentEventsIndexKey(this.backend.prefix, stackName, region);
+		try {
+			const raw = await this.backend.getRawObject(key);
+			if (raw !== null) {
+				const parsed = JSON.parse(raw);
+				if (Array.isArray(parsed.runs)) return parsed.runs;
+			}
+		} catch {}
+		const dirPrefix = `${this.backend.prefix}/${stackName}/${region}/deployments/`;
+		const runIds = (await this.backend.listRawKeys(dirPrefix)).filter((k) => k.endsWith(".jsonl")).map((k) => k.slice(dirPrefix.length, -6)).sort().reverse();
+		return Promise.all(runIds.map((runId) => this.summarizeRunFromJsonl(stackName, region, runId)));
+	}
+	async summarizeRunFromJsonl(stackName, region, runId) {
+		const fallback = {
+			runId,
+			command: "deploy",
+			cdkdVersion: "unknown",
+			startedAt: "",
+			finishedAt: "",
+			result: "UNKNOWN",
+			eventCount: 0
 		};
-		refuseMalformedState(base, childStackName, region, refusalRecovery);
-		refuseMalformedOrphans(base, childStackName, region, refusalRecovery);
-		refuseMalformedOrphanRecords(base, childStackName, region, refusalRecovery);
-		const segments = ((await ctx.stateBackend.loadRollbackJournal(childStackName, region))?.segments ?? []).filter((segment) => segment.runId === runId);
-		if (segments.length === 0) refuse("its rollback journal holds no segment for this deploy run, so there is no record of what it held before.");
-		const stateResources = { ...base.resources };
-		const mintedOrphans = [];
-		const restoredOutputs = segments.find((s) => s.previousOutputs)?.previousOutputs;
-		const restoredReads = segments.find((s) => s.previousCrossStackReads)?.previousCrossStackReads;
-		let currentEtag = stateData.etag;
-		let persisted = false;
-		let restoring = false;
-		const { skippedOutputs: _dropped, ...carried } = base;
-		const next = () => ({
-			...carried,
-			version: 12,
-			region,
-			resources: { ...stateResources },
-			...orphansAfterRollback(base, mintedOrphans),
-			...restoring && restoredOutputs && { outputs: { ...restoredOutputs.outputs } },
-			...restoring && restoredReads && {
-				...restoredReads.imports && { imports: [...restoredReads.imports] },
-				...restoredReads.outputReads && { outputReads: [...restoredReads.outputReads] }
-			},
-			...restoring && restoredOutputs?.exportNames && { exportNames: [...restoredOutputs.exportNames] },
-			lastModified: Date.now()
-		});
-		const nextState = () => {
-			const state = next();
-			if (!restoring) return state;
-			if (restoredOutputs && !restoredOutputs.exportNames) delete state.exportNames;
-			if (restoredOutputs) delete state.outputReferenceProvenance;
-			if (restoredReads && !restoredReads.imports) delete state.imports;
-			if (restoredReads && !restoredReads.outputReads) delete state.outputReads;
-			return state;
+		let events = null;
+		try {
+			events = await this.readRunEvents(stackName, region, runId);
+		} catch {
+			return fallback;
+		}
+		if (events === null || events.length === 0) return fallback;
+		const started = events.find((e) => e.eventType === "RUN_STARTED");
+		let finished;
+		for (const e of events) if (e.eventType === "RUN_FINISHED") finished = e;
+		return {
+			runId,
+			command: started?.command ?? fallback.command,
+			cdkdVersion: started?.cdkdVersion ?? fallback.cdkdVersion,
+			startedAt: started?.timestamp ?? fallback.startedAt,
+			finishedAt: finished?.timestamp ?? fallback.finishedAt,
+			result: finished?.result ?? "UNKNOWN",
+			eventCount: events.length
 		};
-		const save = async () => {
-			persisted = false;
+	}
+	async readRunEvents(stackName, region, runId) {
+		const key = deploymentEventsKey(this.backend.prefix, stackName, region, runId);
+		const raw = await this.backend.getRawObject(key);
+		if (raw === null) return null;
+		const events = [];
+		for (const line of raw.split("\n")) {
+			const trimmed = line.trim();
+			if (!trimmed) continue;
 			try {
-				currentEtag = await ctx.stateBackend.saveState(childStackName, region, nextState(), { ...currentEtag !== void 0 && { expectedEtag: currentEtag } });
-				persisted = true;
-			} catch {
-				try {
-					const fresh = await ctx.stateBackend.getState(childStackName, region);
-					currentEtag = await ctx.stateBackend.saveState(childStackName, region, nextState(), { ...fresh?.etag !== void 0 && { expectedEtag: fresh.etag } });
-					persisted = true;
-				} catch (retryError) {
-					logger.warn(safeMsg`Failed to persist the state of nested stack ${shownChild} after reverting it: ` + safeMsg`${errorText(retryError)}. The resources were reverted in AWS.`);
-				}
-			}
-		};
-		const producerRegions = inheritProducerRegions(producerRegionsFromState({
-			imports: [...base.imports ?? [], ...restoredReads?.imports ?? []],
-			outputReads: [...base.outputReads ?? [], ...restoredReads?.outputReads ?? []]
-		}), args.inheritedProducerRegions);
-		const execCtx = {
-			providerRegistry: ctx.providerRegistry,
-			region,
-			logger,
-			...ctx.options?.eventRecorder && { recordEvent: (event) => ctx.options.eventRecorder.record(maskEventTextWithBoundBags(event)) },
-			finalSnapshotClients: ctx.options?.finalSnapshotClients,
-			skipFinalSnapshot: ctx.options?.skipFinalSnapshot === true || ctx.destroyOptions?.skipFinalSnapshot === true,
-			...ctx.destroyOptions?.removeProtection === true && {
-				removeProtection: true,
-				foreignHolder: makeForeignHolderScan(ctx.stateBackend)({
-					stackName: childStackName,
-					region
-				})
-			},
-			importedProducerRegions: producerRegions.regions,
-			producerRegionsIncomplete: !producerRegions.complete,
-			nestedChildRevert: true
+				events.push(JSON.parse(trimmed));
+			} catch {}
+		}
+		return events;
+	}
+	async pruneRuns(stackName, region, opts = {}) {
+		const dirPrefix = deploymentsDirPrefix(this.backend.prefix, stackName, region);
+		const keys = await this.backend.listRawKeys(dirPrefix);
+		const runIdsDesc = keys.map((k) => runIdFromJsonlKey(k, dirPrefix)).filter((id) => id !== null).sort().reverse();
+		const indexKey = deploymentEventsIndexKey(this.backend.prefix, stackName, region);
+		const indexExisted = keys.includes(indexKey);
+		if (opts.all === true) {
+			const toDelete = runIdsDesc.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
+			const earlierVersions = await deleteAndPurgeEventObjects(this.backend, [...toDelete, indexKey], dirPrefix, "whole-dir");
+			return {
+				deletedRunIds: runIdsDesc,
+				remainingRunIds: [],
+				indexDeleted: indexExisted,
+				...earlierVersions !== void 0 && { earlierVersions }
+			};
+		}
+		const noGuards = opts.keep === void 0 && opts.olderThanMs === void 0;
+		const keep = opts.keep ?? (noGuards ? 20 : void 0);
+		const protectedByCount = keep === void 0 ? /* @__PURE__ */ new Set() : new Set(runIdsDesc.slice(0, keep));
+		let candidates = runIdsDesc.filter((id) => !protectedByCount.has(id));
+		if (opts.olderThanMs !== void 0) {
+			const cutoff = (opts.now ?? /* @__PURE__ */ new Date()).getTime() - opts.olderThanMs;
+			candidates = candidates.filter((id) => {
+				const t = runIdTimestampMs(id);
+				return t !== null && t < cutoff;
+			});
+		}
+		if (candidates.length === 0) return {
+			deletedRunIds: [],
+			remainingRunIds: runIdsDesc,
+			indexDeleted: false
 		};
-		const childCtx = {
-			...ctx,
-			parentStackName: childStackName,
-			parentRegion: region,
-			nestedTemplates: void 0
+		const deletedSet = new Set(candidates);
+		const deleteKeys = candidates.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
+		const remainingRunIds = runIdsDesc.filter((id) => !deletedSet.has(id));
+		if (remainingRunIds.length === 0) {
+			await deleteAndPurgeEventObjects(this.backend, [...deleteKeys, indexKey], dirPrefix);
+			return {
+				deletedRunIds: candidates,
+				remainingRunIds,
+				indexDeleted: indexExisted
+			};
+		}
+		await this.rewriteIndexAfterPrune(indexKey, stackName, region, deletedSet);
+		await deleteAndPurgeEventObjects(this.backend, deleteKeys, dirPrefix);
+		return {
+			deletedRunIds: candidates,
+			remainingRunIds,
+			indexDeleted: false
 		};
-		let failures = 0;
-		let warnings = 0;
-		const inlinePolicyWriters = new RollbackInlinePolicyWriters();
-		const settledBelow = /* @__PURE__ */ new Map();
-		for (let s = segments.length - 1; s >= 0; s--) {
-			const segment = segments[s];
-			const skipPrefix = segment.skipPrefix ?? getCurrentSkipPrefix();
-			const split = splitImportedOps(segment.operations, segment);
-			const result = await withNestedStackContext(childCtx, () => withSkipPrefix(skipPrefix, () => withStackName(childStackName, () => withCreateTokenLedger(ledgerForStack(ctx.stateBackend, childStackName, region), () => withNestedRevertRun(runId, async (inner) => {
-				const replayed = await withPrintingSecrets(journaledOrphanPrintingBag(completedReplayEntries(split.replay), stateResources), () => replayRollback(split.replay, stateResources, childStackName, execCtx, {
-					afterOp: save,
-					onOrphan: (record) => mintedOrphans.push(record),
-					inlinePolicyWriters,
-					failedOperations: segment.failedOperations
-				}));
-				for (const [id, below] of inner.settled) settledBelow.set(id, below);
-				return {
-					...replayed,
-					warnings: replayed.warnings + inner.warnings
-				};
-			})))));
-			failures += result.failures;
-			warnings += result.warnings + split.displaced.length;
-			recordDisplacedSkips(execCtx.recordEvent, childStackName, split.displaced);
-			for (const op of split.displaced) logger.warn(safeMsg`Nested stack ${childStackName}: ${op.logicalId} ` + safeMsg`${displacedOpClause(op, segment.importedResources ?? [], logger)}; ` + "not reverted, check that resource by hand");
+	}
+	async rewriteIndexAfterPrune(indexKey, stackName, region, deletedRunIds) {
+		let raw;
+		try {
+			raw = await this.backend.getRawObject(indexKey);
+		} catch {
+			return;
 		}
-		restoring = failures === 0;
-		await save();
-		if (restoring && persisted && restoredOutputs && ctx.exportIndexStore) await ctx.exportIndexStore.updateForStack(childStackName, region, importableOutputs(nextState()));
-		if (warnings > 0) logger.warn(safeMsg`Nested stack ${shownChild}: ${warnings} operation(s) were skipped with a warning during ` + `its revert (see above); they may need attention by hand.`);
-		if (failures > 0) refuse(`${failures} of its operation(s) failed to revert (see the warnings above).`);
-		if (warnings > 0) run.warnings += warnings;
-		else run.settled.set(logicalId, settledBelow);
-		return { warnings };
-	} finally {
-		await ctx.lockManager.releaseLock(childStackName, region).catch((error) => {
-			logger.warn(safeMsg`Failed to release the lock of nested stack ${shownChild}: ${errorText(error)}`);
-		});
+		if (raw === null) return;
+		let parsed;
+		try {
+			parsed = JSON.parse(raw);
+		} catch {
+			return;
+		}
+		if (!Array.isArray(parsed.runs)) return;
+		const remaining = parsed.runs.filter((r) => !deletedRunIds.has(r.runId));
+		if (remaining.length === parsed.runs.length) return;
+		const file = {
+			indexVersion: 1,
+			stackName,
+			region,
+			runs: remaining,
+			lastModified: Date.now()
+		};
+		await this.backend.putRawObject(indexKey, JSON.stringify(file, null, 2));
 	}
-}
+};
 
 //#endregion
 //#region src/deployment/orphan-adoption.ts
@@ -36943,6 +37472,7 @@ async function settleJournalAfterSuccess(stackName, completedOperations, previou
 	const deployRunId = this.options.eventRecorder?.runId;
 	const stripOnFailure = /* @__PURE__ */ new Map();
 	const [ownLeft] = await Promise.all([(async () => {
+		await orphanUntakenResumes.call(this, stackName, finalResources);
 		if (this.absentJournalVersionPurge !== void 0 && this.stateBackend.rollbackJournalReadAbsent(stackName, this.stackRegion)) {
 			await this.absentJournalVersionPurge;
 			return 0;
@@ -37114,6 +37644,27 @@ async function writeRollbackJournalSegment(stackName, completedOperations, faile
 		return false;
 	}
 }
+async function orphanUntakenResumes(stackName, finalResources) {
+	if (this.resumedCreates.size === 0) return;
+	const untaken = new Map([...this.resumedCreates.values()].map((r) => [r.requestToken, r]));
+	this.resumedCreates = /* @__PURE__ */ new Map();
+	try {
+		await this.stateBackend.rewriteRollbackJournalFailedOperations(stackName, this.stackRegion, (op) => {
+			const resumed = op.pendingCloudControlRequest === void 0 ? void 0 : untaken.get(op.pendingCloudControlRequest.requestToken);
+			if (resumed === void 0) return op;
+			if (resumed.gone || finalResources[op.logicalId]?.physicalId === resumed.identifier) return withoutPendingRequest(op);
+			return {
+				...withoutPendingRequest(op),
+				provisionedBy: "cc-api",
+				physicalId: resumed.identifier,
+				physicalIdRecoveredFromError: true,
+				createdIdentifierUnique: true
+			};
+		});
+	} catch (error) {
+		this.logger.warn(safeMsg`Could not settle the resumed Cloud Control requests in the rollback journal of ` + safeMsg`${displayStackName(stackName)} (${displaySafe(describeAwsFailure(error).summary)}); ` + "the next run settles them.");
+	}
+}
 
 //#endregion
 //#region src/analyzer/parameter-dependence.ts
@@ -38540,30 +39091,45 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 	});
 	const createProvider = createDecision.provider;
 	const createProps = createDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
-	await refuseUnlicensedGeneratedName.call(this, {
-		logicalId,
-		resourceType,
-		stackName,
-		createdVia: createDecision.provisionedBy,
-		resolvedProps
-	});
-	await refuseTakenCreateName.call(this, {
+	const resumed = await resumeAbandonedCreate.call(this, {
 		logicalId,
 		resourceType,
 		stackName,
+		resolvedProps,
+		createProps,
 		createProvider,
 		createdVia: createDecision.provisionedBy,
-		createProps,
-		secrets: createSecrets,
-		stateResources
+		maskSecrets: createSecretMasker(createSecrets)
 	});
-	this.generatedNameGuard?.noteSent(logicalId);
 	let result;
-	try {
-		result = await this.withRetry(() => withCurrentResourceSecrets(createSecrets, () => createProvider.create(logicalId, resourceType, createProps, { maskSecrets: createSecretMasker(createSecrets) })), logicalId, void 0, void 0, createProvider);
-	} catch (error) {
-		this.generatedNameGuard?.noteFailed(logicalId, error);
-		throw error;
+	if (resumed !== void 0) {
+		this.generatedNameGuard?.noteSent(logicalId);
+		result = resumed;
+	} else {
+		await refuseUnlicensedGeneratedName.call(this, {
+			logicalId,
+			resourceType,
+			stackName,
+			createdVia: createDecision.provisionedBy,
+			resolvedProps
+		});
+		await refuseTakenCreateName.call(this, {
+			logicalId,
+			resourceType,
+			stackName,
+			createProvider,
+			createdVia: createDecision.provisionedBy,
+			createProps,
+			secrets: createSecrets,
+			stateResources
+		});
+		this.generatedNameGuard?.noteSent(logicalId);
+		try {
+			result = await this.withRetry(() => withCurrentResourceSecrets(createSecrets, () => createProvider.create(logicalId, resourceType, createProps, { maskSecrets: createSecretMasker(createSecrets) })), logicalId, void 0, void 0, createProvider);
+		} catch (error) {
+			this.generatedNameGuard?.noteFailed(logicalId, error);
+			throw error;
+		}
 	}
 	this.generatedNameGuard?.noteReturned(logicalId);
 	this.registerNoEchoAttributes(logicalId, result, createSecrets, resolvedProps);
@@ -38693,6 +39259,45 @@ async function refuseTakenCreateName(input) {
 	return refuse(`${subject} is created with ${named}, and an existing resource (${shown(holderId)}) already holds that name. Since ${adoptsText}, creating it would take that resource over and record it as this stack's, for a later \`cdkd destroy\` to delete. Nothing was created. Choose a name no other resource holds; ` + ownRemedy + holeNote + (adopt === void 0 ? "" : `
 CONFIRM IT IS YOURS FIRST: another stack or app may own a resource of that name, and adopting it hands that resource to this stack's \`cdkd destroy\`.\nAdopt with: ${adopt.command}`));
 }
+async function resumeAbandonedCreate(args) {
+	const { logicalId, resourceType } = args;
+	const resumed = this.resumedCreates.get(logicalId);
+	if (resumed === void 0 || resumed.taken || resumed.resourceType !== resourceType) return;
+	const reader = args.createProvider;
+	if (args.createdVia !== "cc-api" || typeof reader.resumeCreatedResource !== "function") return;
+	const probe = {
+		logicalId,
+		changeType: "CREATE",
+		resourceType,
+		attemptedProperties: args.resolvedProps
+	};
+	const [redacted] = this.redactOperationsForJournal([probe]);
+	const sentNow = redacted?.attemptedProperties;
+	const asJson = (value) => value === void 0 ? void 0 : JSON.parse(JSON.stringify(value));
+	if (!isDeepStrictEqual(asJson(sentNow), asJson(resumed.attemptedProperties))) {
+		this.logger.warn(safeMsg`${logicalId}: the template changed since the CREATE cdkd stopped waiting for, so ` + "this deploy creates the resource again; the one that CREATE made is kept in the rollback journal as a resource the failed deploy created.");
+		return;
+	}
+	let result;
+	try {
+		result = await this.withRetry(() => reader.resumeCreatedResource(logicalId, resourceType, resumed.identifier, args.createProps, { maskSecrets: args.maskSecrets }), logicalId, void 0, void 0, args.createProvider);
+	} catch (error) {
+		if (error.resumedResourceGone !== true) throw error;
+		resumed.gone = true;
+		this.logger.warn(safeMsg`${logicalId}: the resource the earlier CREATE made no longer exists; creating it as usual.`);
+		return;
+	}
+	resumed.taken = true;
+	const shown = displacedPhysicalIdShown({
+		logicalId,
+		changeType: "CREATE",
+		resourceType,
+		physicalId: resumed.identifier,
+		attemptedProperties: resumed.attemptedProperties
+	}, this.logger, resumed.identifier) ?? "the resource";
+	this.logger.info(safeMsg`${logicalId}: took over ${shown}, the resource the earlier CREATE made, instead of ` + "creating another.");
+	return result;
+}
 
 //#endregion
 //#region src/provisioning/data-delete-intent.ts
@@ -45148,11 +45753,20 @@ async function executeDeployment(template, currentState, changes, dag, execution
 						record: replaced,
 						createdId: replacementCreatedId
 					} : void 0;
+					const abandoned = change.changeType === "CREATE" && statePhysicalId === void 0 && createdId === void 0 ? abandonedRequestOf(provisionError) : void 0;
+					const pendingRequest = abandoned?.operation === "CREATE" && /^[-A-Za-z0-9+/=]{1,128}$/.test(abandoned.requestToken) ? {
+						requestToken: abandoned.requestToken,
+						abandonedAt: Date.now()
+					} : void 0;
 					const failedOp = {
 						logicalId,
 						changeType: change.changeType,
 						resourceType: change.resourceType,
-						provisionedBy: createdId !== void 0 ? "sdk" : newResources[logicalId]?.provisionedBy ?? previousState?.provisionedBy,
+						provisionedBy: createdId !== void 0 ? "sdk" : pendingRequest !== void 0 ? "cc-api" : newResources[logicalId]?.provisionedBy ?? previousState?.provisionedBy,
+						...pendingRequest !== void 0 && {
+							pendingCloudControlRequest: pendingRequest,
+							deletionPolicy: journaledOrphanPolicy(this.extractTemplateAttributes(template, logicalId).deletionPolicy)
+						},
 						...previousState && { previousState },
 						physicalId: createdId ?? statePhysicalId,
 						...createdId !== void 0 && {
@@ -45182,7 +45796,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 						failedOperations.push(replacementOrphanOp);
 					}
 					const orphanOp = createdId !== void 0 ? failedOp : replacementOrphanOp;
-					if (orphanOp?.physicalId !== void 0 && orphanOp.deletionPolicy !== "Retain" && orphanDeleteNeedsIdentity(orphanOp.resourceType)) {
+					if (orphanOp?.physicalId !== void 0 && orphanOp.deletionPolicy !== "Retain" && orphanNeedsIdentity(orphanOp)) {
 						const markedIdentity = createdResourceIdentityBeforeFailure(provisionError, logicalId, change.resourceType);
 						if (markedIdentity !== void 0) orphanOp.createdResourceIdentity = markedIdentity;
 						else if (this.interruptCause !== "user") {
@@ -46861,8 +47475,42 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			if (exportIndexStore && importableOutputKeys(currentState).length === 0) exportsPrefetch = afterGate(() => exportIndexStore.prefetch());
 		}
 		this.absentJournalVersionPurge = void 0;
+		let journalAtStart = null;
+		let journalReadError;
+		try {
+			journalAtStart = await this.stateBackend.loadRollbackJournal(stackName, this.stackRegion);
+		} catch (error) {
+			journalReadError = error ?? /* @__PURE__ */ new Error("unreadable rollback journal");
+		}
+		if (!this.options.dryRun && await resolvePendingCloudControlRequests({
+			journal: this.stateBackend,
+			loaded: journalAtStart,
+			reader: () => this.providerRegistry.getCloudControlProvider(),
+			stackName,
+			region: this.stackRegion,
+			command: "deploy",
+			logger: this.logger,
+			stateResources: currentState.resources,
+			resume: (op, identifier) => {
+				const attempted = op.attemptedProperties;
+				if (template.Resources?.[op.logicalId]?.Type !== op.resourceType || attempted === void 0 || carriesSecretMask(attempted) || op.pendingCloudControlRequest === void 0 || Object.values(currentState.resources).some((r) => r.physicalId === identifier && r.resourceType === op.resourceType)) return false;
+				this.resumedCreates.set(op.logicalId, {
+					requestToken: op.pendingCloudControlRequest.requestToken,
+					identifier,
+					resourceType: op.resourceType,
+					attemptedProperties: attempted
+				});
+				return true;
+			},
+			...gate !== void 0 && { beforeSettle: () => gate }
+		})) try {
+			journalAtStart = await this.stateBackend.loadRollbackJournal(stackName, this.stackRegion);
+		} catch (error) {
+			journalReadError = error ?? /* @__PURE__ */ new Error("unreadable rollback journal");
+		}
 		try {
-			const loaded = await this.stateBackend.loadRollbackJournal(stackName, this.stackRegion);
+			if (journalReadError !== void 0) throw journalReadError;
+			const loaded = journalAtStart;
 			if (loaded === null && !this.options.parentStackInfo && !this.options.dryRun) this.absentJournalVersionPurge = afterGate(() => this.stateBackend.purgeRollbackJournalVersions(stackName, this.stackRegion));
 			const journal = loaded && {
 				...loaded,
@@ -47497,6 +48145,7 @@ var DeployEngine = class {
 	constructPathTemplate;
 	outputsSourceUsable = true;
 	attemptedResolvedProps = /* @__PURE__ */ new Map();
+	resumedCreates = /* @__PURE__ */ new Map();
 	generatedNameGuard;
 	liveTaskLabels = /* @__PURE__ */ new Map();
 	retainedOldOnReplacement = /* @__PURE__ */ new Set();
@@ -47569,6 +48218,7 @@ var DeployEngine = class {
 		this.fingerprintChildTemplates = void 0;
 		this.perResourceInputFingerprints = /* @__PURE__ */ new Map();
 		this.attemptedResolvedProps = /* @__PURE__ */ new Map();
+		this.resumedCreates = /* @__PURE__ */ new Map();
 		this.generatedNameGuard = void 0;
 		this.liveTaskLabels = /* @__PURE__ */ new Map();
 		this.outputSecrets = /* @__PURE__ */ new Map();
@@ -47850,5 +48500,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { S3_AUTO_DELETE_OBJECTS_TAG as $, withheldAccountClause as $a, getDockerImageBySourceHash as $c, isReadableResourceEntry as $i, findDestructiveChanges as $n, literalSplitDelimitersOf as $o, applyRoleArnIfSet as $r, splitImportedOps as $s, recordUnderIdIsNotOwn as $t, diffSecurity as A, refuseMalformedResourceEntries as Aa, buildDenyExternalAccessPolicy as Ac, isNamelessDynamicReferenceError as Ai, hasOwnKey as Al, DEFAULT_RESOURCE_TIMEOUT_MS as An, withRetry as Ao, CloudControlProvider as Ar, provenPublicValue as As, withNestedStackContext as At, readProtection as B, refuseMalformedResourcesForDeploy as Ba, isDockerClientEnvKey as Bc, declaresNoEcho as Bi, injectedAwsRegionValue as Bl, storedSecretNameNeedles as Bn, maskWholeValue as Bo, markWaitAbandoned as Br, TEMPLATE_SOURCED_RULES as Bs, awaitInFlightSibling as Bt, withApiLimit as C, refuseMalformedOrphanRecordsForDestroy as Ca, ensureAssetStorage as Cc, coerceParameterTypedValue as Ci, PARTITION_TABLE as Cl, exportNameSecretExposure as Cn, replayWarn as Co, readsNoEchoDeleteValues as Cr, recordNestedStackParameterExpressions as Cs, nestedChildStackName as Ct, findServiceTokenRefusals as D, refuseMalformedOutputs as Da, readBootstrapMarkerBody as Dc, isImpossibleEmptyStoredAttribute as Di, StageLoadError as Dl, collectPublishedOutputNames as Dn, prefetchCreateOnlyPropertyPaths as Do, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Dr, recordPhysicalNameCopy as Ds, withNestedRevertRun as Dt, deferredServiceTokenWarning as E, refuseMalformedOrphansForOrphan as Ea, parseBootstrapMarker as Ec, getAccountInfo as Ei, AssemblyReader as El, collectDeclaredOutputNames as En, requireConfigString as Eo, withPrintingSecrets as Er, recordAttributeIdCopy as Es, revertedNestedRowIds as Et, recordedProtectionEvidence as F, refuseMalformedResourceEntriesForOrphan as Fa, describeDockerFailure as Fc, refStateLookupFromResource as Fi, describeFileReadFailure as Fl, orphanRecordsPrintingBag as Fn, TemplateParser as Fo, deleteIndeterminateGuards as Fr, recordProvenPublicExpression as Fs, loadJournaledOrphans as Ft, deleteBudgetKey as G, repairMalformedOrphansForReadOnly as Ga, redactedDockerCause as Gc, UNREADABLE_RESOURCES_MAP_ROW as Gi, ccRoutedFinalSnapshotError as Gn, passedNoEchoParametersOf as Go, reDisableInstanceApiTermination as Gr, S3StateBackend as Gs, replacedDeleteFailureVerdict as Gt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as H, refuseMalformedResourcesForExport as Ha, partitionSensitiveEnv as Hc, STATE_REGION_DIVERGED as Hi, resolveBucketRegion as Hl, ATOMIC_FINAL_SNAPSHOT_TYPES as Hn, noEchoCoordinatesOf as Ho, ec2InstanceProtectionSite as Hr, isSingleDynamicReferenceToken as Hs, getStackRecords as Ht, recordedProtectionNote as I, refuseMalformedResourcePropertiesForDestroy as Ia, dockerSpawnEnvWithSensitive as Ic, parseWebACLArn as Ii, displayAssemblyPath as Il, secretNamePrintingBag as In, canonicalCoordinates as Io, deleteLeftInPlace as Ir, wholeStringLeavesOf as Is, makeForeignHolderScan as It, DELETE_INDEX_WAIT_PROCEED_NOTE as J, repairMalformedResourcePropertiesForReadOnly as Ja, warnFinchArgvExposure as Jc, displayLogicalId as Ji, isFinalSnapshotError as Jn, valueAtCoordinate as Jo, INTRINSIC_KEYS as Jr, CrossPrefixScanCache as Js, isJournaledOrphan as Jt, resolveDynamoDbDeleteBudgetClock as K, repairMalformedOutputsForReadOnly as Ka, runDockerForeground as Kc, accountArgs as Ki, createPreDeleteFinalSnapshot as Kn, readbackPathFor as Ko, reEnableInstanceApiTermination as Kr, rebuildClientForBucketRegion as Ks, recordAfterRollbackUpdate as Kt, PROTECTION_PROPERTY_BY_TYPE as L, refuseMalformedResourcePropertiesForDrift as La, finchSecretArgvRefusal as Lc, withSharedDrainBudget as Li, renderAssemblyPathEscape as Ll, secretNamePrintingBags as Ln, isMarkedCoordinate as Lo, deleteSkipReason as Lr, STATE_SOURCED_BASELINE_RULES as Ls, sameJournaledOrphans as Lt, noEchoComparisonForTemplate as M, refuseMalformedResourceEntriesForDestroy as Ma, resolveDockerContextDirectory as Mc, AWS_NO_VALUE as Mi, nullPrototypeRecord as Ml, completedReplayEntries as Mn, lambdaFunctionNameForMask as Mo, unchangedBehindSecretReference as Mr, recordMaskOnlyValuesIn as Ms, dropFailedHint as Mt, noEchoExactEchoLeavesOf as N, refuseMalformedResourceEntriesForImport as Na, describeDockerCapturedOutput as Nc, cfnRefValueFromPhysicalId as Ni, ownValue as Nl, journaledOrphanPrintingBag as Nn, sameLambdaFunctionAddress as No, RollbackInlinePolicyWriters as Nr, recordNoEchoAttributeValues as Ns, isHandledOrphan as Nt, serviceTokenBlockingReason as O, refuseMalformedOutputsForDestroy as Oa, validateAssetBucketName as Oc, carriesDynamicReference as Oi, processStackMessages as Ol, isExportAliasCollision as On, templateResourceTypes as Oo, applyCustomResourceResponseExpiration as Or, splitGetAttStringForm as Os, collectNestedChildUnaddressed as Ot, noEchoParameterNamesOf as P, refuseMalformedResourceEntriesForImportSave as Pa, describeDockerExecFailure as Pc, isStalePlaceholderArnAttribute as Pi, absoluteAssemblyPathEscape as Pl, maskEventTextWithBoundBags as Pn, DagBuilder as Po, UNSPECIFIED_SKIP_REASON as Pr, recordNoEchoParameterFreshValue as Ps, journaledOrphanLines as Pt, ECR_AUTO_DELETE_IMAGES_TAG as Q, unreadableResourceEntries as Qa, AssetManifestLoader as Qc, isReadableOrphanRecord as Qi, constructPathOf as Qn, hasMaskableValues as Qo, refuseUnreadableCdkCrossAccountRefs as Qr, isNotImplemented as Qs, recheckFailedPlan as Qt, isProtectionValueActive as R, refuseMalformedResourcePropertiesForExport as Ra, formatDockerLoginError as Rc, parameterInputsFor as Ri, resolveAssemblyPath as Rl, secretNamedRecordNeedles as Rn, maskAtCoordinates as Ro, withIndeterminateGuard as Rr, STATE_SOURCED_CROSS_GENERATION_RULES as Rs, replayFailedOperations as Rt, lookupEachName as S, refuseMalformedOrphanRecords as Sa, assertAssetBucketRegion as Sc, regionLessSecretName as Si, expectedOwnerParam as Sl, exportNameNoEchoParameters as Sn, readConfigString as So, TemplateNoEchoReresolver as Sr, inheritNestedStackParameterAssociations as Ss, getNestedRevertRun as St, recordRetainedForReadoption as T, refuseMalformedOrphansForDestroy as Ta, isCrossRegionRedirect as Tc, parameterTypeMayLoseSecretIdentity as Ti, derivePartitionAndUrlSuffix as Tl, noEchoParameterValueSeed as Tn, requireConfigObject as To, getCurrentResourceSecrets as Tr, physicalNameCopiesOf as Ts, revertNestedChildFromJournal as Tt, beginDeleteWait as U, refuseMalformedState as Ua, redactDockerArgvValues as Uc, STATE_RESOURCES_MALFORMED as Ui, PRE_DELETE_SNAPSHOT_TYPES as Un, noEchoLeavesOf as Uo, isTerminationProtectionPropagationError as Ur, LockManager as Us, withStackRecords as Ut, DynamoDBGlobalTableProvider as V, refuseMalformedResourcesForDestroy as Va, isMalformedEnvKey as Vc, JSON_LISTING_HOLE_VALUE as Vi, clearBucketRegionCache as Vl, extractDeploymentEventError as Vn, maskedLeafCoordinatesOf as Vo, disableInstanceApiTermination as Vr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Vs, destroyStackRecordsView as Vt, compensateRemovedDeletionProtection as W, repairMalformedOrphanRecordsForReadOnly as Wa, redactedCause as Wc, UNREADABLE_ORPHANS_CONTAINER_ROW as Wi, buildFinalSnapshotIdentifier as Wn, noEchoOutputsComparison as Wo, observeThenDisableInstanceApiTermination as Wr, isLockInfoExpired as Ws, removeProtectionTypeList as Wt, deleteTableWithIndexBusyRetry as X, unpreviewableOrphanRecords as Xa, stripControlChars as Xc, hasReadableOutputs as Xi, unsupportedFinalSnapshotError as Xn, carryLogOnlyValues as Xo, poisonRenderedSpellingsCollidingIn as Xr, crossPrefixDeniedWarning as Xs, planFailedOps as Xt, INDEX_SETTLE_POLL_INTERVAL_MS as Y, repairMalformedResourcesForReadOnly as Ya, escapeRegExp$3 as Yc, hasReadableOrphans as Yi, refusesFinalSnapshot as Yn, liveMatchesUnresolvedTokenFrame as Yo, IntrinsicFunctionResolver as Yr, applyCrossPrefixScan as Ys, isReplacementOrphan as Yt, waitForIndexesSettled as Z, unreadableOrphanRecords as Za, stripForDisplay as Zc, hasReadableResources as Zi, maskingRetryLogger as Zn, createUnionSecretMasker as Zo, producerLookupOver as Zr, isAccessDenied$1 as Zs, planRollback as Zt, keptWholeReasonText as _, malformedScrubResourceEntriesRefusalMessage as _a, createAssetRedirectResolver as _c, s3BucketRegionalDomainName as _i, MIGRATE_TMP_PREFIX as _l, exportAliasCollisionScrubWarning as _n, coerceCfnBoolean as _o, CC_BROKEN_REASON as _r, DYNAMIC_REFERENCE_TOKEN_SCAN as _s, planOrphanAdoption as _t, inheritedProvenanceForChildDiff as a, malformedLocalResourcesWarning as aa, hasUnverifiableParameterRefusal as ac, AWS_CREDENTIAL_ENV_KEYS as ai, resolveApp as al, getCurrentProducerRegions as an, hasNoCloudControlHandlers as ao, acquireIdempotencyToken as ar, unionOfSecretBags as as, createReadOnlyAttributeHealerFactory as at, chunks as b, refuseDivergentRecordRegionForDestroy as ba, AssetModeResolver as bc, classifyReplaySecretRegion as bi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as bl, secretSafeKeyDisplay as bn, configIntegerRefusal as bo, isCustomResource as br, pathCrossesDottedKey as bs, displacedPhysicalIdShown as bt, isAbsoluteAssetPath as c, malformedOrphanRowsKeptWarning as ca, isReadableBag as cc, envCredentialsAreAssumedRole as ci, resolveSkipPrefix as cl, isRedactedRecordedValue as cn, MULTI_REGION_RECREATE_BLOCKED_TYPES as co, DBPROXY_TAGS_WHAT as cr, maskSecretsInError as cs, gray as ct, templateIdentity as d, malformedOutputsRefusalMessage as da, shouldRetainResource as dc, outputReferenceProvenanceOf as di, resolveUseCdkBootstrapAssets as dl, updatePartialMessage as dn, renderStatefulReason as do, readTagList as dr, recordReferenceProvenanceEntry as ds, yellow as dt, malformedDriftResourcePropertiesWarning as ea, acceptedCreateOnlyDropsOf as ec, assertFlagRoleArn as ei, Synthesizer as el, replacementNeverSwapped as en, findActionableSilentDrops as eo, formatDestructiveChange as er, logOnlyValueCount as es, hasCdkAutoDeleteTag as et, conditionFingerprint as f, malformedOutputsWarning as fa, AssetPublisher as fc, recordedOutputReferenceRegions as fi, stateBucketExistenceConfirmed as fl, updatePartialReason as fn, WARM_THROUGHPUT_MEMBERS as fo, refuseMalformedDesiredTags as fr, snapshotPassProvenance as fs, computeParameterTaint as ft, isSecretBearingReferenceString as g, malformedResourcesWarning as ga, buildAssetRedirectMap as gc, s3BucketDualStackDomainName as gi, CFN_TEMPLATE_URL_LIMIT as gl, displayTextOrWithheld as gn, toFiniteNumber as go, stringifyIfAssigned as gr, withoutPhysicalNameCopies as gs, makeSiblingClaimReader as gt, readRecordedConditionVerdicts as h, malformedResourcePropertiesWarning as ha, WorkGraph as hc, s3BucketDomainName as hi, CFN_TEMPLATE_BODY_LIMIT as hl, WITHHELD_NAME_DISPLAY as hn, toCfnInteger as ho, definedAttributes as hr, withPhysicalNameCopies as hs, resourcesNamingDeclaredParameter as ht, crossStackOutputProvenanceSource as i, malformedLocalResourceEntriesWarning as ia, hasReasonlessBaselineRefusal as ic, sendableAssumeRoleCommand as ii, loadCdkJson as il, findNestedStackTypeChanges as in, NO_CC_HANDLERS_REASON as io, withCreateTokenLedger as ir, shareLogOnlyValues as is, formatResourceLine as it, noEchoAttributeNamesOf as j, refuseMalformedResourceEntriesForDeploy as ja, buildDockerImage as jc, keepsSecretReferenceToken as ji, hasPlainPrototype$1 as jl, DEFAULT_RESOURCE_WARN_AFTER_MS as jn, canonicalLambdaFunctionName as jo, slowCcOperationTimeoutMs as jr, recordMaskOnlyValue as js, deleteJournaledOrphans as jt, withResourceDeadline as k, refuseMalformedResourceAttributesForOrphan as ka, validateContainerRepoName as kc, carriesFetchableDynamicReference as ki, defineOwnKey as kl, bindingSkippedOutputs as kn, describeTypeWithThrottleRetry as ko, customResourceResponseExpirationWarning as kr, carriesSecretMask as ks, getCurrentNestedStackContext as kt, listNestedTemplateRows as l, malformedOrphansRefusalMessage as la, orphansAfterRollback as lc, isSettledInstanceState as li, resolveStateBucketWithDefault as ll, redactedDeleteAddressFields as ln, isStatefulRecreateTargetForReplace as lo, DBPROXY_TAG_OPTIONS as lr, maskSecretsInText as ls, green as lt, parentSuppliedValues as m, malformedResourceEntriesWarning as ma, stringifyValue as mc, s3BucketArn as mi, ssmResolvedValueType as ml, DeploymentEventsStore as mn, isWarmThroughputDecrease as mo, tagPlanWarning as mr, scrubResourceRecord as ms, reachableDivergentParameters as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedExportSourceWarning as na, exportNamesCarriedFrom as nc, explicitRoleArnOrThrow as ni, getDefaultStateBucketName as nl, seedsDeleteFirstGuard as nn, unwrittenCreateOnlyReplacement as no, ledgerForStack as nr, recordLogOnlyParameterValue as ns, getPriorAttempts as nt, childTemplateLoader as o, malformedOrphanRecordsRefusalMessage as oa, importableOutputKeys as oc, applyCallerIdentityCredentials as oi, resolveAutoAssetStorage as ol, inheritProducerRegions as on, findReplacedReadersOfRecreateTargets as oo, isRefusedByName as or, createSecretMasker as os, bold as ot, conditionInputsFrom as p, malformedRenderedContainersWarning as pa, isSensitiveAttributeName as pc, recordedReferenceRegions as pi, warnDeprecatedNoPrefixCliFlag as pl, DeploymentEventsReader as pn, coerceWarmThroughput as po, tagMapAsList as pr, redactSecretsForState as ps, namesAnyDeclaredParameter as pt, resolveDynamoDbDeleteBudgetMs as q, repairMalformedResourceEntriesForReadOnly as qa, runDockerStreaming as qc, deployRefusesOrphanRowsReason as qi, effectiveDeletionPolicy as qn, readsNoEchoSource as qo, DiffCalculator as qr, CrossPrefixReadError as qs, demoteSupersededOrphans as qt, computeImplicitDeleteEdges as r, malformedLocalOutputsWarning as ra, hasReadableExportSet as rc, isIamRoleArn as ri, getLegacyStateBucketName as rl, orphanDeleteNeedsIdentity as rn, withoutSilentDropProperties as ro, reserveStackCreateToken as rr, recordLogOnlyValue as rs, markRefusedBeforeApplying as rt, findNestedTemplateTreeDefect as s, malformedOrphanRecordsWarning as sa, importableOutputs as sc, callerEnvCredentials as si, resolveCaptureObservedState as sl, REDACTED_DELETE_ADDRESS_SKIP_REASON as sn, shownType as so, markDeleteStarted as sr, errorCauseChain as ss, cyan as st, DeployEngine as t, malformedExportNamesWarning as ta, describeRegionValueKind as tc, assertSendableRoleArn as ti, synthesisStatusMessage as tl, resolveReplacementOldType as tn, findSilentDropProperties as to, earliestDefined as tr, printingCorpusOf as ts, isTruthyCfnBoolean as tt, renderNestedTemplateTreeDefect as u, malformedOrphansWarning as ua, orphansCarriedFrom as uc, keepHeldTokenProvenance as ui, resolveStateBucketWithDefaultAndSource as ul, redactedDeleteAddressSkip as un, isStatefulRecreateTargetSync as uo, planTagDiff as ur, markSameGenerationBag as us, red as ut, mergeNoChangeOutputs as v, malformedStateRefusalMessage as va, loadPublishableAssetManifest as vc, s3BucketWebsiteUrl as vi, findLargeInlineResources as vl, secretBearing as vn, coerceCfnInteger as vo, ProviderRegistry as vr, dynamicReferenceTokens as vs, NESTED_PENDING_PARENT_REASON as vt, keptForReadoption as w, refuseMalformedOrphans as wa, getBootstrapMarkerKey as wc, isUnboundTemplateParameter as wi, canonicalizeRegion as wl, isWholeDynamicReferenceValue as wn, requireConfigArray as wo, isCustomResourceType as wr, recoverMaskedOutput as ws, recordDisplacedSkips as wt, isAccessDeniedError as x, refuseMalformedNestedChildOutputs as xa, BOOTSTRAP_MARKER_PREFIX as xc, producerRegionsFromState as xi, decodeListingKey as xl, carriedExportAliasExposure as xn, configStringRefusal as xo, wouldReturnToSdkProvider as xr, identityKeyFor as xs, dropSettledNestedJournals as xt, makeCanonicalizePropertiesFn as y, previewableOrphanRecords as ya, rewriteTemplateAssetReferences as yc, classifyRecordedSecretRegion as yi, uploadCfnTemplate as yl, secretBearingStateKeyWarning as yn, configBooleanRefusal as yo, ccBrokenReason as yr, isUncertifiedBaselineMaskPosition as ys, displacedOpClause as yt, perType as z, refuseMalformedResourcePropertiesForOrphan as za, getDockerCmd as zc, passedParameterClassesOf as zi, injectAwsRegion as zl, stateSecretNameNeedles as zn, maskReadbackAtCoordinates as zo, isWaitAbandonedError as zr, STATE_SOURCED_READBACK_RULES as zs, replayRollback as zt };
-//# sourceMappingURL=deploy-engine-BK4gG_5A.js.map
+export { S3_AUTO_DELETE_OBJECTS_TAG as $, unpreviewableOrphanRecords as $a, stripControlChars as $c, hasReadableOutputs as $i, unsupportedFinalSnapshotError as $n, carryLogOnlyValues as $o, poisonRenderedSpellingsCollidingIn as $r, crossPrefixDeniedWarning as $s, isJournaledOrphan as $t, diffSecurity as A, refuseMalformedOutputs as Aa, readBootstrapMarkerBody as Ac, isImpossibleEmptyStoredAttribute as Ai, StageLoadError as Al, collectPublishedOutputNames as An, prefetchCreateOnlyPropertyPaths as Ao, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Ar, recordPhysicalNameCopy as As, NESTED_PENDING_PARENT_REASON as At, readProtection as B, refuseMalformedResourcePropertiesForDrift as Ba, finchSecretArgvRefusal as Bc, withSharedDrainBudget as Bi, renderAssemblyPathEscape as Bl, secretNamePrintingBags as Bn, isMarkedCoordinate as Bo, deleteSkipReason as Br, STATE_SOURCED_BASELINE_RULES as Bs, collectNestedChildUnaddressed as Bt, withApiLimit as C, refuseDivergentRecordRegionForDestroy as Ca, AssetModeResolver as Cc, classifyReplaySecretRegion as Ci, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Cl, secretSafeKeyDisplay as Cn, configIntegerRefusal as Co, isCustomResource as Cr, pathCrossesDottedKey as Cs, dropFailedCommands as Ct, findServiceTokenRefusals as D, refuseMalformedOrphans as Da, getBootstrapMarkerKey as Dc, isUnboundTemplateParameter as Di, canonicalizeRegion as Dl, isWholeDynamicReferenceValue as Dn, requireConfigArray as Do, isCustomResourceType as Dr, recoverMaskedOutput as Ds, loadJournaledOrphans as Dt, deferredServiceTokenWarning as E, refuseMalformedOrphanRecordsForDestroy as Ea, ensureAssetStorage as Ec, coerceParameterTypedValue as Ei, PARTITION_TABLE as El, exportNameSecretExposure as En, replayWarn as Eo, readsNoEchoDeleteValues as Er, recordNestedStackParameterExpressions as Es, journaledOrphanLines as Et, recordedProtectionEvidence as F, refuseMalformedResourceEntriesForDestroy as Fa, resolveDockerContextDirectory as Fc, AWS_NO_VALUE as Fi, nullPrototypeRecord as Fl, completedReplayEntries as Fn, lambdaFunctionNameForMask as Fo, unchangedBehindSecretReference as Fr, recordMaskOnlyValuesIn as Fs, nestedChildStackName as Ft, deleteBudgetKey as G, refuseMalformedResourcesForExport as Ga, partitionSensitiveEnv as Gc, STATE_REGION_DIVERGED as Gi, resolveBucketRegion as Gl, ATOMIC_FINAL_SNAPSHOT_TYPES as Gn, noEchoCoordinatesOf as Go, ec2InstanceProtectionSite as Gr, isSingleDynamicReferenceToken as Gs, awaitInFlightSibling as Gt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as H, refuseMalformedResourcePropertiesForOrphan as Ha, getDockerCmd as Hc, passedParameterClassesOf as Hi, injectAwsRegion as Hl, stateSecretNameNeedles as Hn, maskReadbackAtCoordinates as Ho, isWaitAbandonedError as Hr, STATE_SOURCED_READBACK_RULES as Hs, withNestedStackContext as Ht, recordedProtectionNote as I, refuseMalformedResourceEntriesForImport as Ia, describeDockerCapturedOutput as Ic, cfnRefValueFromPhysicalId as Ii, ownValue as Il, journaledOrphanPrintingBag as In, sameLambdaFunctionAddress as Io, RollbackInlinePolicyWriters as Ir, recordNoEchoAttributeValues as Is, recordDisplacedSkips as It, DELETE_INDEX_WAIT_PROCEED_NOTE as J, repairMalformedOrphansForReadOnly as Ja, redactedDockerCause as Jc, UNREADABLE_RESOURCES_MAP_ROW as Ji, ccRoutedFinalSnapshotError as Jn, passedNoEchoParametersOf as Jo, reDisableInstanceApiTermination as Jr, S3StateBackend as Js, withStackRecords as Jt, resolveDynamoDbDeleteBudgetClock as K, refuseMalformedState as Ka, redactDockerArgvValues as Kc, STATE_RESOURCES_MALFORMED as Ki, PRE_DELETE_SNAPSHOT_TYPES as Kn, noEchoLeavesOf as Ko, isTerminationProtectionPropagationError as Kr, LockManager as Ks, destroyStackRecordsView as Kt, PROTECTION_PROPERTY_BY_TYPE as L, refuseMalformedResourceEntriesForImportSave as La, describeDockerExecFailure as Lc, isStalePlaceholderArnAttribute as Li, absoluteAssemblyPathEscape as Ll, maskEventTextWithBoundBags as Ln, DagBuilder as Lo, UNSPECIFIED_SKIP_REASON as Lr, recordNoEchoParameterFreshValue as Ls, revertNestedChildFromJournal as Lt, noEchoComparisonForTemplate as M, refuseMalformedResourceAttributesForOrphan as Ma, validateContainerRepoName as Mc, carriesFetchableDynamicReference as Mi, defineOwnKey as Ml, bindingSkippedOutputs as Mn, describeTypeWithThrottleRetry as Mo, customResourceResponseExpirationWarning as Mr, carriesSecretMask as Ms, displacedPhysicalIdShown as Mt, noEchoExactEchoLeavesOf as N, refuseMalformedResourceEntries as Na, buildDenyExternalAccessPolicy as Nc, isNamelessDynamicReferenceError as Ni, hasOwnKey as Nl, DEFAULT_RESOURCE_TIMEOUT_MS as Nn, withRetry as No, CloudControlProvider as Nr, provenPublicValue as Ns, dropSettledNestedJournals as Nt, serviceTokenBlockingReason as O, refuseMalformedOrphansForDestroy as Oa, isCrossRegionRedirect as Oc, parameterTypeMayLoseSecretIdentity as Oi, derivePartitionAndUrlSuffix as Ol, noEchoParameterValueSeed as On, requireConfigObject as Oo, getCurrentResourceSecrets as Or, physicalNameCopiesOf as Os, makeForeignHolderScan as Ot, noEchoParameterNamesOf as P, refuseMalformedResourceEntriesForDeploy as Pa, buildDockerImage as Pc, keepsSecretReferenceToken as Pi, hasPlainPrototype$1 as Pl, DEFAULT_RESOURCE_WARN_AFTER_MS as Pn, canonicalLambdaFunctionName as Po, slowCcOperationTimeoutMs as Pr, recordMaskOnlyValue as Ps, getNestedRevertRun as Pt, ECR_AUTO_DELETE_IMAGES_TAG as Q, repairMalformedResourcesForReadOnly as Qa, escapeRegExp$3 as Qc, hasReadableOrphans as Qi, refusesFinalSnapshot as Qn, liveMatchesUnresolvedTokenFrame as Qo, IntrinsicFunctionResolver as Qr, applyCrossPrefixScan as Qs, demoteSupersededOrphans as Qt, isProtectionValueActive as R, refuseMalformedResourceEntriesForOrphan as Ra, describeDockerFailure as Rc, refStateLookupFromResource as Ri, describeFileReadFailure as Rl, orphanRecordsPrintingBag as Rn, TemplateParser as Ro, deleteIndeterminateGuards as Rr, recordProvenPublicExpression as Rs, revertedNestedRowIds as Rt, lookupEachName as S, previewableOrphanRecords as Sa, rewriteTemplateAssetReferences as Sc, classifyRecordedSecretRegion as Si, uploadCfnTemplate as Sl, secretBearingStateKeyWarning as Sn, configBooleanRefusal as So, ccBrokenReason as Sr, isUncertifiedBaselineMaskPosition as Ss, deleteJournaledOrphans as St, recordRetainedForReadoption as T, refuseMalformedOrphanRecords as Ta, assertAssetBucketRegion as Tc, regionLessSecretName as Ti, expectedOwnerParam as Tl, exportNameNoEchoParameters as Tn, readConfigString as To, TemplateNoEchoReresolver as Tr, inheritNestedStackParameterAssociations as Ts, isHandledOrphan as Tt, beginDeleteWait as U, refuseMalformedResourcesForDeploy as Ua, isDockerClientEnvKey as Uc, declaresNoEcho as Ui, injectedAwsRegionValue as Ul, storedSecretNameNeedles as Un, maskWholeValue as Uo, markWaitAbandoned as Ur, TEMPLATE_SOURCED_RULES as Us, replayFailedOperations as Ut, DynamoDBGlobalTableProvider as V, refuseMalformedResourcePropertiesForExport as Va, formatDockerLoginError as Vc, parameterInputsFor as Vi, resolveAssemblyPath as Vl, secretNamedRecordNeedles as Vn, maskAtCoordinates as Vo, withIndeterminateGuard as Vr, STATE_SOURCED_CROSS_GENERATION_RULES as Vs, getCurrentNestedStackContext as Vt, compensateRemovedDeletionProtection as W, refuseMalformedResourcesForDestroy as Wa, isMalformedEnvKey as Wc, JSON_LISTING_HOLE_VALUE as Wi, clearBucketRegionCache as Wl, extractDeploymentEventError as Wn, maskedLeafCoordinatesOf as Wo, disableInstanceApiTermination as Wr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ws, replayRollback as Wt, deleteTableWithIndexBusyRetry as X, repairMalformedResourceEntriesForReadOnly as Xa, runDockerStreaming as Xc, deployRefusesOrphanRowsReason as Xi, effectiveDeletionPolicy as Xn, readsNoEchoSource as Xo, DiffCalculator as Xr, CrossPrefixReadError as Xs, replacedDeleteFailureVerdict as Xt, INDEX_SETTLE_POLL_INTERVAL_MS as Y, repairMalformedOutputsForReadOnly as Ya, runDockerForeground as Yc, accountArgs as Yi, createPreDeleteFinalSnapshot as Yn, readbackPathFor as Yo, reEnableInstanceApiTermination as Yr, rebuildClientForBucketRegion as Ys, removeProtectionTypeList as Yt, waitForIndexesSettled as Z, repairMalformedResourcePropertiesForReadOnly as Za, warnFinchArgvExposure as Zc, displayLogicalId as Zi, isFinalSnapshotError as Zn, valueAtCoordinate as Zo, INTRINSIC_KEYS as Zr, CrossPrefixScanCache as Zs, recordAfterRollbackUpdate as Zt, keptWholeReasonText as _, malformedResourceEntriesWarning as _a, stringifyValue as _c, s3BucketArn as _i, ssmResolvedValueType as _l, orphanNeedsIdentity as _n, isWarmThroughputDecrease as _o, tagPlanWarning as _r, scrubResourceRecord as _s, planOrphanAdoption as _t, inheritedProvenanceForChildDiff as a, malformedExportSourceWarning as aa, exportNamesCarriedFrom as ac, explicitRoleArnOrThrow as ai, getDefaultStateBucketName as al, replacementNeverSwapped as an, unwrittenCreateOnlyReplacement as ao, ledgerForStack as ar, recordLogOnlyParameterValue as as, createReadOnlyAttributeHealerFactory as at, chunks as b, malformedScrubResourceEntriesRefusalMessage as ba, createAssetRedirectResolver as bc, s3BucketRegionalDomainName as bi, MIGRATE_TMP_PREFIX as bl, exportAliasCollisionScrubWarning as bn, coerceCfnBoolean as bo, CC_BROKEN_REASON as br, DYNAMIC_REFERENCE_TOKEN_SCAN as bs, pendingRequestCount as bt, isAbsoluteAssetPath as c, malformedLocalResourcesWarning as ca, hasUnverifiableParameterRefusal as cc, AWS_CREDENTIAL_ENV_KEYS as ci, resolveApp as cl, findNestedStackTypeChanges as cn, hasNoCloudControlHandlers as co, acquireIdempotencyToken as cr, unionOfSecretBags as cs, gray as ct, templateIdentity as d, malformedOrphanRowsKeptWarning as da, isReadableBag as dc, envCredentialsAreAssumedRole as di, resolveSkipPrefix as dl, REDACTED_DELETE_ADDRESS_SKIP_REASON as dn, MULTI_REGION_RECREATE_BLOCKED_TYPES as do, DBPROXY_TAGS_WHAT as dr, maskSecretsInError as ds, yellow as dt, hasReadableResources as ea, isAccessDenied$1 as ec, producerLookupOver as ei, stripForDisplay as el, isReplacementOrphan as en, unreadableOrphanRecords as eo, maskingRetryLogger as er, createUnionSecretMasker as es, hasCdkAutoDeleteTag as et, conditionFingerprint as f, malformedOrphansRefusalMessage as fa, orphansAfterRollback as fc, isSettledInstanceState as fi, resolveStateBucketWithDefault as fl, isRedactedRecordedValue as fn, isStatefulRecreateTargetForReplace as fo, DBPROXY_TAG_OPTIONS as fr, maskSecretsInText as fs, computeParameterTaint as ft, isSecretBearingReferenceString as g, malformedRenderedContainersWarning as ga, isSensitiveAttributeName as gc, recordedReferenceRegions as gi, warnDeprecatedNoPrefixCliFlag as gl, updatePartialReason as gn, coerceWarmThroughput as go, tagMapAsList as gr, redactSecretsForState as gs, makeSiblingClaimReader as gt, readRecordedConditionVerdicts as h, malformedOutputsWarning as ha, AssetPublisher as hc, recordedOutputReferenceRegions as hi, stateBucketExistenceConfirmed as hl, updatePartialMessage as hn, WARM_THROUGHPUT_MEMBERS as ho, refuseMalformedDesiredTags as hr, snapshotPassProvenance as hs, resourcesNamingDeclaredParameter as ht, crossStackOutputProvenanceSource as i, malformedExportNamesWarning as ia, describeRegionValueKind as ic, assertSendableRoleArn as ii, synthesisStatusMessage as il, recordUnderIdIsNotOwn as in, findSilentDropProperties as io, earliestDefined as ir, printingCorpusOf as is, formatResourceLine as it, noEchoAttributeNamesOf as j, refuseMalformedOutputsForDestroy as ja, validateAssetBucketName as jc, carriesDynamicReference as ji, processStackMessages as jl, isExportAliasCollision as jn, templateResourceTypes as jo, applyCustomResourceResponseExpiration as jr, splitGetAttStringForm as js, displacedOpClause as jt, withResourceDeadline as k, refuseMalformedOrphansForOrphan as ka, parseBootstrapMarker as kc, getAccountInfo as ki, AssemblyReader as kl, collectDeclaredOutputNames as kn, requireConfigString as ko, withPrintingSecrets as kr, recordAttributeIdCopy as ks, sameJournaledOrphans as kt, listNestedTemplateRows as l, malformedOrphanRecordsRefusalMessage as la, importableOutputKeys as lc, applyCallerIdentityCredentials as li, resolveAutoAssetStorage as ll, getCurrentProducerRegions as ln, findReplacedReadersOfRecreateTargets as lo, isRefusedByName as lr, createSecretMasker as ls, green as lt, parentSuppliedValues as m, malformedOutputsRefusalMessage as ma, shouldRetainResource as mc, outputReferenceProvenanceOf as mi, resolveUseCdkBootstrapAssets as ml, redactedDeleteAddressSkip as mn, renderStatefulReason as mo, readTagList as mr, recordReferenceProvenanceEntry as ms, reachableDivergentParameters as mt, IMPLICIT_DELETE_DEPENDENCIES as n, isReadableResourceEntry as na, splitImportedOps as nc, applyRoleArnIfSet as ni, getDockerImageBySourceHash as nl, planRollback as nn, withheldAccountClause as no, findDestructiveChanges as nr, literalSplitDelimitersOf as ns, getPriorAttempts as nt, childTemplateLoader as o, malformedLocalOutputsWarning as oa, hasReadableExportSet as oc, isIamRoleArn as oi, getLegacyStateBucketName as ol, resolveReplacementOldType as on, withoutSilentDropProperties as oo, reserveStackCreateToken as or, recordLogOnlyValue as os, bold as ot, conditionInputsFrom as p, malformedOrphansWarning as pa, orphansCarriedFrom as pc, keepHeldTokenProvenance as pi, resolveStateBucketWithDefaultAndSource as pl, redactedDeleteAddressFields as pn, isStatefulRecreateTargetSync as po, planTagDiff as pr, markSameGenerationBag as ps, namesAnyDeclaredParameter as pt, resolveDynamoDbDeleteBudgetMs as q, repairMalformedOrphanRecordsForReadOnly as qa, redactedCause as qc, UNREADABLE_ORPHANS_CONTAINER_ROW as qi, buildFinalSnapshotIdentifier as qn, noEchoOutputsComparison as qo, observeThenDisableInstanceApiTermination as qr, isLockInfoExpired as qs, getStackRecords as qt, computeImplicitDeleteEdges as r, malformedDriftResourcePropertiesWarning as ra, acceptedCreateOnlyDropsOf as rc, assertFlagRoleArn as ri, Synthesizer as rl, recheckFailedPlan as rn, findActionableSilentDrops as ro, formatDestructiveChange as rr, logOnlyValueCount as rs, markRefusedBeforeApplying as rt, findNestedTemplateTreeDefect as s, malformedLocalResourceEntriesWarning as sa, hasReasonlessBaselineRefusal as sc, sendableAssumeRoleCommand as si, loadCdkJson as sl, seedsDeleteFirstGuard as sn, NO_CC_HANDLERS_REASON as so, withCreateTokenLedger as sr, shareLogOnlyValues as ss, cyan as st, DeployEngine as t, isReadableOrphanRecord as ta, isNotImplemented as tc, refuseUnreadableCdkCrossAccountRefs as ti, AssetManifestLoader as tl, planFailedOps as tn, unreadableResourceEntries as to, constructPathOf as tr, hasMaskableValues as ts, isTruthyCfnBoolean as tt, renderNestedTemplateTreeDefect as u, malformedOrphanRecordsWarning as ua, importableOutputs as uc, callerEnvCredentials as ui, resolveCaptureObservedState as ul, inheritProducerRegions as un, shownType as uo, markDeleteStarted as ur, errorCauseChain as us, red as ut, mergeNoChangeOutputs as v, malformedResourcePropertiesWarning as va, WorkGraph as vc, s3BucketDomainName as vi, CFN_TEMPLATE_BODY_LIMIT as vl, WITHHELD_NAME_DISPLAY as vn, toCfnInteger as vo, definedAttributes as vr, withPhysicalNameCopies as vs, DeploymentEventsReader as vt, keptForReadoption as w, refuseMalformedNestedChildOutputs as wa, BOOTSTRAP_MARKER_PREFIX as wc, producerRegionsFromState as wi, decodeListingKey as wl, carriedExportAliasExposure as wn, configStringRefusal as wo, wouldReturnToSdkProvider as wr, identityKeyFor as ws, dropFailedHint as wt, isAccessDeniedError as x, malformedStateRefusalMessage as xa, loadPublishableAssetManifest as xc, s3BucketWebsiteUrl as xi, findLargeInlineResources as xl, secretBearing as xn, coerceCfnInteger as xo, ProviderRegistry as xr, dynamicReferenceTokens as xs, resolvePendingCloudControlRequests as xt, makeCanonicalizePropertiesFn as y, malformedResourcesWarning as ya, buildAssetRedirectMap as yc, s3BucketDualStackDomainName as yi, CFN_TEMPLATE_URL_LIMIT as yl, displayTextOrWithheld as yn, toFiniteNumber as yo, stringifyIfAssigned as yr, withoutPhysicalNameCopies as ys, DeploymentEventsStore as yt, perType as z, refuseMalformedResourcePropertiesForDestroy as za, dockerSpawnEnvWithSensitive as zc, parseWebACLArn as zi, displayAssemblyPath as zl, secretNamePrintingBag as zn, canonicalCoordinates as zo, deleteLeftInPlace as zr, wholeStringLeavesOf as zs, withNestedRevertRun as zt };
+//# sourceMappingURL=deploy-engine-DEvS2r2M.js.map