@go-to-k/cdkd 0.301.15 → 0.302.1

package/dist/{program-CXvao3wc.js → program-CvRs5pV_.js}

@@ -1,9 +1,9 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-B_CEQGE1.js";
-import { A as SECRET_REF_MAX_CODE_POINTS, D as withStackName, E as withSkipPrefix, F as displayAwsMessage, G as truncateCodePoints, H as safeMsg, I as displayIdent, L as displaySafe, M as UNRENDERABLE, P as cutMarker, R as displayStackName, U as stringifyJsonPayload, V as plainIdentOr, W as terminalSafe, _ as PATTERN_B_RESOURCE_TYPES, a as safeStringify, b as explicitNamePropertyFor, c as isStdoutReservedForPayload, d as runStackBuffered, g as PATTERN_B_NAME_PROPERTIES, h as PATTERN_B_NAME_OPTIONS, j as STACK_REF_MAX_CODE_POINTS, k as SAFE_MSG_ALTERED_CHAR, l as reserveStdoutForPayload, m as getLiveRenderer, n as describeAwsFailure, s as getLogger, x as generateResourceName, y as derivesPatternBName, z as isPasteableIdent } from "./aws-failure-text-CdgZn80O.js";
-import { $t as ambientCredentialConfig, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, D as VALUE_NOT_SHOWN, Dn as normalizeAwsError, E as assertRegionMatch, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gt as DEFAULT_STATE_PREFIX, Hn as withheldTargetClause, In as pasteableCommand, It as buildForceUnlockCommand, Jt as producerCoordinateKey, Kt as injectiveKey, Lt as buildLockContentionMessage, Nn as commandHole, On as withErrorHandling, P as remedyLogicalId, Qt as ambientClientDefaults, Rn as plainOrDescribed, Rt as forceQuitRecoveryClause, Sn as StackTerminationProtectionError, T as RESOURCE_NOT_FOUND, Un as setPasteableRunFlags, Vn as shellQuote, Vt as formatLockOwner, Wn as setPasteableVerbFlags, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as setPasteableAwsProfile, Yt as producerRecordKey, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _n as PartialFailureError, bn as ResourceUpdateNotSupportedError, cn as DeployCancelledError, dn as LocalInvokeBuildError$1, dr as isTransientServerError, en as clientDefaultsFor, fn as LocalStartServiceError, fr as retryClassificationText, ft as logicalIdShown, gn as NestedStackChildDirectDestroyError, gr as markNonRetryable, hn as MalformedProducerRecordRefusalError, hr as isThrottlingError, in as CdkdError, it as isInterruptedWaitError, jn as SHELL_ACTIVE_WHY, kn as TIMEOUT_FLAG_RESOURCE_TYPE, ln as DynamicReferenceRegionAmbiguousError, mr as isMarkedNonRetryable, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as AccountIdUnavailableError, nr as stripControlChars, nt as endCommandInterruptScope, on as CrossAccountSecretRefusalError, rr as stripForDisplay, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sr as isAmbiguousOutcomeError, t as IAM_PRINCIPAL_NAME, tn as credentialFingerprint, tr as escapeRegExp, tt as beginCommandInterruptScope, un as IntrinsicResolutionRefusalError, ur as isRetryableTransientError, vn as ProvisioningError, wn as SynthesisError, xn as StackHasActiveImportsError, yn as ResourceTimeoutError, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-Dap4bLyq.js";
+import { $ as stringifyJsonPayload, A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, Q as safeMsg, V as STACK_REF_MAX_CODE_POINTS, W as cutMarker, Y as isPasteableIdent, Z as plainIdentOr, _ as PATTERN_B_RESOURCE_TYPES, a as safeStringify, b as derivesPatternBName, c as isStdoutReservedForPayload, d as runStackBuffered, et as terminalSafe, g as PATTERN_B_NAME_PROPERTIES, h as PATTERN_B_NAME_OPTIONS, l as reserveStdoutForPayload, m as getLiveRenderer, n as describeAwsFailure, q as displaySafe, s as getLogger, tt as truncateCodePoints, x as explicitNamePropertyFor, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-e_ddrDDo.js";
+import { $t as ambientCredentialConfig, An as withErrorHandling, Bn as plainOrDescribed, Bt as formatLockOperation, Cn as StackTerminationProtectionError, D as VALUE_NOT_SHOWN, E as assertRegionMatch, Fn as commandHole, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as setPasteableRunFlags, Gt as DEFAULT_STATE_PREFIX, Hn as shellBoundedDisplay, It as buildForceUnlockCommand, Jt as producerCoordinateKey, Kn as setPasteableVerbFlags, Kt as injectiveKey, Ln as isInertUnquoted, Lt as buildLockContentionMessage, Nn as SHELL_ACTIVE_WHY, P as remedyLogicalId, Qt as ambientClientDefaults, Rn as pasteableCommand, Rt as forceQuitRecoveryClause, Sn as StackHasActiveImportsError, T as RESOURCE_NOT_FOUND, Tn as SynthesisError, Un as shellQuote, Vn as quotedOrDescribed, Vt as formatLockOwner, Wn as withheldTargetClause, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as setPasteableAwsProfile, Yt as producerRecordKey, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _n as NestedStackChildDirectDestroyError, _r as isThrottlingError, ar as stripForDisplay, bn as ResourceTimeoutError, cn as DeployCancelledError, dn as IntrinsicResolutionRefusalError, en as clientDefaultsFor, fn as LocalInvokeBuildError$1, fr as isRetryableTransientError, ft as logicalIdShown, gn as MalformedProducerRecordRefusalError, gr as isMarkedNonRetryable, in as CdkdError, ir as stripControlChars, it as isInterruptedWaitError, jn as TIMEOUT_FLAG_RESOURCE_TYPE, kn as normalizeAwsError, lr as isAmbiguousOutcomeError, mr as retryClassificationText, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as AccountIdUnavailableError, nt as endCommandInterruptScope, on as CrossAccountSecretRefusalError, pn as LocalStartServiceError, pr as isTransientServerError, rr as escapeRegExp, rt as interruptWatchListenerCount, s as readRecordedPrincipals, t as IAM_PRINCIPAL_NAME, tn as credentialFingerprint, tt as beginCommandInterruptScope, un as DynamicReferenceRegionAmbiguousError, vn as PartialFailureError, vr as markNonRetryable, wn as StateError, xn as ResourceUpdateNotSupportedError, yn as ProvisioningError, zt as formatLockExpiry } from "./iam-policy-targets-CmHNH1DY.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-DBXBcg0J.js";
-import { $ as DeploymentEventsStore, $a as repairMalformedOrphanRecordsForReadOnly, $c as runDockerStreaming, $i as UNREADABLE_ORPHANS_CONTAINER_ROW, $n as ATOMIC_FINAL_SNAPSHOT_TYPES, $o as noEchoOutputsComparison, $s as CrossPrefixReadError, $t as updatePartialReason, A as inheritedProvenanceForChildDiff, Ac as getBootstrapMarkerKey, Ai as producerRegionsFromState, Al as StageLoadError, An as bold, Ar as TemplateNoEchoReresolver, As as pathCrossesDottedKey, At as replayFailedOperations, B as conditionFingerprint, Ba as refuseMalformedResourceEntriesForDeploy, Bc as describeDockerExecFailure, Bi as keepsSecretReferenceToken, Bl as renderAssemblyPathEscape, Bn as createReadOnlyAttributeHealerFactory, Bs as provenPublicValue, Bt as recordUnderIdIsNotOwn, Ca as malformedResourceEntriesWarning, Cc as createAssetRedirectResolver, Ci as sendableAssumeRoleCommand, Cl as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Cn as findDestructiveChanges, Cs as maskSecretsInText, Ct as makeForeignHolderScan, D as IMPLICIT_DELETE_DEPENDENCIES, Da as malformedStateRefusalMessage, Dc as BOOTSTRAP_MARKER_PREFIX, Di as envCredentialsAreAssumedRole, Dl as canonicalizeRegion, Dr as isCustomResource, Ds as DYNAMIC_REFERENCE_TOKEN_SCAN, Ea as malformedScrubResourceEntriesRefusalMessage, Ec as AssetModeResolver, Ei as callerEnvCredentials, El as PARTITION_TABLE, En as destroyStackRecordsView, Er as ccBrokenReason, F as findNestedTemplateTreeDefect, Fa as refuseMalformedOrphansForOrphan, Fc as validateContainerRepoName, Fi as getAccountInfo, Fl as nullPrototypeRecord, Fn as yellow, Fr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Fs as physicalNameCopiesOf, Ft as isJournaledOrphan, G as diffSecurity, Ga as refuseMalformedResourcePropertiesForDestroy, Gc as getDockerCmd, Gl as resolveBucketRegion, Gn as orphanRecordsPrintingBag, Go as canonicalCoordinates, Gr as deleteSkipReason, Gs as recordProvenPublicExpression, Gt as findNestedStackTypeChanges, H as parentSuppliedValues, Ha as refuseMalformedResourceEntriesForImport, Hc as dockerSpawnEnvWithSensitive, Hi as cfnRefValueFromPhysicalId, Hl as injectAwsRegion, Hn as journaledOrphanPrintingBag, Hr as UNSPECIFIED_SKIP_REASON, Hs as recordMaskOnlyValuesIn, Ht as resolveReplacementOldType, I as isAbsoluteAssetPath, Ia as refuseMalformedOutputs, Ic as buildDenyExternalAccessPolicy, Ii as isImpossibleEmptyStoredAttribute, Il as ownValue, In as noEchoAttributeNamesOf, Io as prefetchCreateOnlyPropertyPaths, Ir as applyCustomResourceResponseExpiration, It as isReplacementOrphan, J as mergeNoChangeOutputs, Ja as refuseMalformedResourcePropertiesForOrphan, Jc as partitionSensitiveEnv, Jo as maskReadbackAtCoordinates, Js as isSingleDynamicReferenceToken, K as isSecretBearingReferenceString, Ka as refuseMalformedResourcePropertiesForDrift, Kc as isDockerClientEnvKey, Ki as withSharedDrainBudget, Kn as secretNamePrintingBag, Ko as isMarkedCoordinate, Ks as wholeStringLeavesOf, L as listNestedTemplateRows, La as refuseMalformedOutputsForDestroy, Lc as buildDockerImage, Li as carriesDynamicReference, Ll as absoluteAssemblyPathEscape, Ln as noEchoComparisonForTemplate, Lo as templateResourceTypes, Lr as customResourceResponseExpirationWarning, Ls as recordPhysicalNameCopy, Lt as planFailedOps, M as findServiceTokenRefusals, Ma as refuseMalformedOrphanRecordsForDestroy, Mc as parseBootstrapMarker, Mi as coerceParameterTypedValue, Ml as defineOwnKey, Mn as gray, Mr as isCustomResourceType$1, Ms as inheritNestedStackParameterAssociations, Mt as removeProtectionTypeList, N as serviceTokenBlockingReason, Na as refuseMalformedOrphans, Nc as readBootstrapMarkerBody, Ni as isUnboundTemplateParameter, Nl as hasOwnKey, Nn as green, Ns as recordNestedStackParameterExpressions, Nt as recordAfterRollbackUpdate, O as computeImplicitDeleteEdges, Oa as previewableOrphanRecords, Oc as assertAssetBucketRegion, Oi as classifyRecordedSecretRegion, Ol as derivePartitionAndUrlSuffix, On as withStackRecords, Or as wouldReturnToSdkProvider, Os as dynamicReferenceTokens, P as childTemplateLoader, Pa as refuseMalformedOrphansForDestroy, Pc as validateAssetBucketName, Pi as parameterTypeMayLoseSecretIdentity, Pl as hasPlainPrototype, Pn as red, Pr as withPrintingSecrets, Pt as demoteSupersededOrphans, Q as DeploymentEventsReader, Qa as refuseMalformedState, Qc as runDockerForeground, Qi as STATE_RESOURCES_MALFORMED, Qn as extractDeploymentEventError, Qo as noEchoLeavesOf, Qs as rebuildClientForBucketRegion, Qt as updatePartialMessage, R as renderNestedTemplateTreeDefect, Ra as refuseMalformedResourceAttributesForOrphan, Rc as resolveDockerContextDirectory, Ri as carriesFetchableDynamicReference, Rl as describeFileReadFailure, Rn as noEchoExactEchoLeavesOf, Ro as describeTypeWithThrottleRetry, Rr as CloudControlProvider, Rs as splitGetAttStringForm, Rt as planRollback, Sa as malformedRenderedContainersWarning, Sc as buildAssetRedirectMap, Si as isIamRoleArn, Sl as uploadCfnTemplate, Sn as constructPathOf, Ss as maskSecretsInError, St as loadJournaledOrphans, Ta as malformedResourcesWarning, Tc as rewriteTemplateAssetReferences, Ti as applyCallerIdentityCredentials, Tl as expectedOwnerParam, Tr as ProviderRegistry, Ts as withPhysicalNameCopies, Tt as formatResourceLine, U as readRecordedConditionVerdicts, Ua as refuseMalformedResourceEntriesForImportSave, Uc as finchSecretArgvRefusal, Ui as isStalePlaceholderArnAttribute, Ul as injectedAwsRegionValue, Un as maskEventTextWithBoundBags, Uo as DagBuilder, Ur as deleteIndeterminateGuards, Us as recordNoEchoAttributeValues, Ut as seedsDeleteFirstGuard, V as conditionInputsFrom, Va as refuseMalformedResourceEntriesForDestroy, Vc as describeDockerFailure, Vi as AWS_NO_VALUE, Vl as resolveAssemblyPath, Vn as completedReplayEntries, Vr as RollbackInlinePolicyWriters, Vs as recordMaskOnlyValue, Vt as replacementNeverSwapped, W as withResourceDeadline, Wa as refuseMalformedResourceEntriesForOrphan, Wc as formatDockerLoginError, Wi as refStateLookupFromResource, Wn as namingSecretsWithRecordedNoEcho, Wo as TemplateParser, Wr as deleteLeftInPlace, Ws as recordNoEchoParameterFreshValue, Wt as orphanNeedsIdentity, X as makeSiblingClaimReader, Xa as refuseMalformedResourcesForDestroy, Xc as redactedCause, Xi as JSON_LISTING_HOLE_VALUE, Xn as stateSecretNameNeedles, Xo as maskedLeafCoordinatesOf, Xs as isLockInfoExpired, Y as makeCanonicalizePropertiesFn, Ya as refuseMalformedResourcesForDeploy, Yc as redactDockerArgvValues, Yi as declaresNoEcho, Yn as secretNamedRecordNeedles, Yo as maskWholeValue, Ys as LockManager, Z as planOrphanAdoption, Za as refuseMalformedResourcesForExport, Zc as redactedDockerCause, Zi as STATE_REGION_DIVERGED, Zn as storedSecretNameNeedles, Zo as noEchoCoordinatesOf, Zs as S3StateBackend, _a as malformedOrphanRowsKeptWarning, _c as shouldRetainResource, _i as recordedReferenceRegions, _l as ssmResolvedValueType, _n as isExportAliasCollision, _o as MULTI_REGION_RECREATE_BLOCKED_TYPES, _s as recordLogOnlyValue, _t as deleteJournaledOrphans, a as isProtectionValueActive, aa as hasReadableOutputs, ac as splitImportedOps, al as getDefaultStateBucketName, an as displayTextOrWithheld, ao as unpreviewableOrphanRecords, ar as isFinalSnapshotError, as as liveMatchesUnresolvedTokenFrame, at as displacedOpClause, ba as malformedOutputsRefusalMessage, bc as stringifyValue, bi as assertSendableRoleArn, bl as MIGRATE_TMP_PREFIX, bn as DEFAULT_RESOURCE_WARN_AFTER_MS, bo as renderStatefulReason, bs as createSecretMasker, bt as isHandledOrphan, ca as isReadableResourceEntry, cc as exportNamesCarriedFrom, cl as resolveApp, cn as secretBearingStateKeyWarning, co as withheldAccountClause, da as malformedExportSourceWarning, dc as hasUnverifiableParameterRefusal, di as resolveDynamicReferences, dl as resolveSkipPrefix, dn as exportNameNoEchoParameters, do as unwrittenCreateOnlyReplacement, dr as withCreateTokenLedger, ds as createUnionSecretMasker, ea as UNREADABLE_RESOURCES_MAP_ROW, ec as CrossPrefixScanCache, el as warnFinchArgvExposure, en as computeParameterTaint, eo as repairMalformedOrphansForReadOnly, er as PRE_DELETE_SNAPSHOT_TYPES, et as pendingRequestCount, fa as malformedLocalOutputsWarning, fc as importableOutputKeys, fi as producerLookupOver, fl as resolveStateBucketWithDefault, fn as exportNameSecretExposure, fs as hasMaskableValues, ft as revertedNestedRowIds, ga as malformedOrphanRecordsWarning, gc as orphansCarriedFrom, gi as recordedOutputReferenceRegions, gl as warnDeprecatedNoPrefixCliFlag, gn as collectPublishedOutputNames, go as shownType, gs as recordLogOnlyParameterValue, gt as withNestedStackContext, ha as malformedOrphanRecordsRefusalMessage, hc as orphansAfterRollback, hl as stateBucketExistenceConfirmed, hn as collectDeclaredOutputNames, ho as findReplacedReadersOfRecreateTargets, hs as printingCorpusOf, ht as getCurrentNestedStackContext, i as PROTECTION_PROPERTY_BY_TYPE, ia as hasReadableOrphans, ic as isNotImplemented, ii as poisonRenderedSpellingsCollidingIn, il as synthesisStatusMessage, in as WITHHELD_NAME_DISPLAY, io as repairMalformedResourcesForReadOnly, ir as effectiveDeletionPolicy, is as valueAtCoordinate, it as NESTED_PENDING_PARENT_REASON, j as deferredServiceTokenWarning, ja as refuseMalformedOrphanRecords, jc as isCrossRegionRedirect, ji as regionLessSecretName, jl as processStackMessages, jn as cyan, jr as readsNoEchoDeleteValues, js as identityKeyFor, jt as replayRollback, k as crossStackOutputProvenanceSource, ka as refuseDivergentRecordRegionForDestroy, kc as ensureAssetStorage, ki as classifyReplaySecretRegion, kl as AssemblyReader, ks as isUncertifiedBaselineMaskPosition, la as malformedDriftResourcePropertiesWarning, lc as hasReadableExportSet, ll as resolveAutoAssetStorage, ln as secretSafeKeyDisplay, lo as findActionableSilentDrops, lr as ledgerForStack, lt as nestedChildStackName$1, ma as malformedLocalResourcesWarning, mc as isReadableBag, mi as keepHeldTokenProvenance, ml as resolveUseCdkBootstrapAssets, mn as noEchoParameterValueSeed, mo as hasNoCloudControlHandlers, ms as logOnlyValueCount, mt as collectNestedChildUnaddressed, n as recordedProtectionEvidence, na as deployRefusesOrphanRowsReason, nc as crossPrefixDeniedWarning, ni as INTRINSIC_KEYS, nl as getDockerImageBySourceHash, nn as reachableDivergentParameters, no as repairMalformedResourceEntriesForReadOnly, nr as ccRoutedFinalSnapshotError, ns as readsNoEchoSource, nt as keptForReadoption, o as perType, oa as hasReadableResources, oc as acceptedCreateOnlyDropsOf, ol as getLegacyStateBucketName, on as exportAliasCollisionScrubWarning, oo as unreadableOrphanRecords, or as refusesFinalSnapshot, ot as displacedPhysicalIdShown, pa as malformedLocalResourceEntriesWarning, pc as importableOutputs, pi as refuseUnreadableCdkCrossAccountRefs, pl as resolveStateBucketWithDefaultAndSource, pn as isWholeDynamicReferenceValue, po as NO_CC_HANDLERS_REASON, ps as literalSplitDelimitersOf, pt as withNestedRevertRun, q as keptWholeReasonText, qa as refuseMalformedResourcePropertiesForExport, qc as isMalformedEnvKey, qi as parameterInputsFor, qn as secretNamePrintingBags, qo as maskAtCoordinates, qr as isWaitAbandonedError, qs as WHOLE_DYNAMIC_REFERENCE_PATTERN, qt as inheritProducerRegions, r as recordedProtectionNote, ra as displayLogicalId, rc as isAccessDenied, ri as IntrinsicFunctionResolver, rl as Synthesizer, rn as resourcesNamingDeclaredParameter, ro as repairMalformedResourcePropertiesForReadOnly, rr as createPreDeleteFinalSnapshot, rs as recordedNoEchoValuesOf, rt as recordRetainedForReadoption, s as readProtection, sa as isReadableOrphanRecord, sc as describeRegionValueKind, sl as loadCdkJson, sn as secretBearing, so as unreadableResourceEntries, sr as unsupportedFinalSnapshotError, ss as redactForState, st as dropSettledNestedJournals, t as DeployEngine, ta as accountArgs, tc as applyCrossPrefixScan, ti as DiffCalculator, tl as AssetManifestLoader, tn as namesAnyDeclaredParameter, to as repairMalformedOutputsForReadOnly, tr as buildFinalSnapshotIdentifier, ts as readbackPathFor, tt as resolvePendingCloudControlRequests, ua as malformedExportNamesWarning, uc as hasReasonlessBaselineRefusal, ul as resolveCaptureObservedState, un as carriedExportAliasExposure, us as carryLogOnlyValues, ut as recordDisplacedSkips, va as malformedOrphansRefusalMessage, vc as AssetPublisher, vi as applyRoleArnIfSet, vl as CFN_TEMPLATE_BODY_LIMIT, vn as bindingSkippedOutputs, vo as isStatefulRecreateTargetForReplace, vs as shareLogOnlyValues, vt as dropFailedCommands, wa as malformedResourcePropertiesWarning, wc as loadPublishableAssetManifest, wi as AWS_CREDENTIAL_ENV_KEYS, wl as decodeListingKey, wn as formatDestructiveChange, wr as CC_BROKEN_REASON, ws as scrubResourceRecord, wt as sameJournaledOrphans, xa as malformedOutputsWarning, xc as WorkGraph, xi as explicitRoleArnOrThrow, xl as findLargeInlineResources, xn as maskingRetryLogger, xs as errorCauseChain, xt as journaledOrphanLines, ya as malformedOrphansWarning, yc as isSensitiveAttributeName, yi as assertFlagRoleArn, yl as CFN_TEMPLATE_URL_LIMIT, yn as DEFAULT_RESOURCE_TIMEOUT_MS, yo as isStatefulRecreateTargetSync, ys as unionOfSecretBags, yt as dropFailedHint, z as templateIdentity, za as refuseMalformedResourceEntries, zc as describeDockerCapturedOutput, zi as isNamelessDynamicReferenceError, zl as displayAssemblyPath, zn as noEchoParameterNamesOf, zo as withRetry, zr as slowCcOperationTimeoutMs, zs as carriesSecretMask, zt as recheckFailedPlan } from "./deploy-engine-Dy7N7-Il.js";
-import { t as getCdkdVersion } from "./version-DadUoJjK.js";
+import { $ as resolvePendingCloudControlRequests, $a as refuseMalformedOutputsForDestroy, $c as validateAssetBucketName, $i as carriesDynamicReference, $l as hasPlainPrototype, $n as noEchoParameterNamesOf, $o as templateResourceTypes, $r as customResourceResponseExpirationWarning, $s as recordPhysicalNameCopy, $t as nameGenerationHighWaterOf, A as inheritedProvenanceForChildDiff, Aa as malformedLocalResourcesWarning, Ac as importableOutputKeys, Ai as keepHeldTokenProvenance, Al as resolveSkipPrefix, An as destroyStackRecordsView, Ao as hasNoCloudControlHandlers, As as logOnlyValueCount, At as removeProtectionTypeList, B as conditionFingerprint, Ba as malformedResourcePropertiesWarning, Bc as WorkGraph, Bi as AWS_CREDENTIAL_ENV_KEYS, Bl as findLargeInlineResources, Bn as addSuperseded, Br as CC_BROKEN_REASON, Bs as scrubResourceRecord, Bt as resolveReplacementOldType, Ca as isReadableOrphanRecord, Cc as splitImportedOps, Cl as synthesisStatusMessage, Cn as DEFAULT_RESOURCE_TIMEOUT_MS, Co as unreadableResourceEntries, Cs as redactForState, Ct as formatResourceLine, D as IMPLICIT_DELETE_DEPENDENCIES, Da as malformedExportSourceWarning, Dc as hasReadableExportSet, Di as resolveDynamicReferences, Dl as resolveApp, Dn as findDestructiveChanges, Do as unwrittenCreateOnlyReplacement, Dr as DeploymentEventsStore, Ds as createUnionSecretMasker, Ea as malformedExportNamesWarning, Ec as exportNamesCarriedFrom, El as loadCdkJson, En as constructPathOf, Er as DeploymentEventsReader, Es as carryLogOnlyValues, F as findNestedTemplateTreeDefect, Fa as malformedOrphansWarning, Fc as shouldRetainResource, Fi as assertFlagRoleArn, Fl as warnDeprecatedNoPrefixCliFlag, Fn as cyan, Fo as isStatefulRecreateTargetSync, Fs as unionOfSecretBags, Ft as planFailedOps, G as diffSecurity, Ga as refuseDivergentRecordRegionForDestroy, Gc as AssetModeResolver, Gi as classifyReplaySecretRegion, Gl as PARTITION_TABLE, Gn as supersededAfterRollback, Gs as isUncertifiedBaselineMaskPosition, Gt as inheritProducerRegions, H as parentSuppliedValues, Ha as malformedScrubResourceEntriesRefusalMessage, Hc as createAssetRedirectResolver, Hi as callerEnvCredentials, Hl as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Hn as holdsSupersededResources, Hr as ccBrokenReason, Ht as orphanNeedsIdentity, I as isAbsoluteAssetPath, Ia as malformedOutputsRefusalMessage, Ic as stackInstanceIdCarriedFrom, Ii as assertSendableRoleArn, Il as ssmResolvedValueType, In as gray, Io as renderStatefulReason, Is as createSecretMasker, It as planRollback, J as mergeNoChangeOutputs, Ja as refuseMalformedOrphanRecordsForDestroy, Jc as ensureAssetStorage, Ji as coerceParameterTypedValue, Jl as AssemblyReader, Jn as supersededResourcesOf, Jr as isCustomResourceType$1, Js as inheritNestedStackParameterAssociations, K as isSecretBearingReferenceString, Kc as BOOTSTRAP_MARKER_PREFIX, Ki as producerRegionsFromState, Kl as canonicalizeRegion, Kn as supersededHeldByOtherTypeWarning, Kr as TemplateNoEchoReresolver, Ks as pathCrossesDottedKey, L as listNestedTemplateRows, La as malformedOutputsWarning, Lc as AssetPublisher, Li as explicitRoleArnOrThrow, Ll as CFN_TEMPLATE_BODY_LIMIT, Ln as green, Ls as errorCauseChain, Lt as recheckFailedPlan, M as findServiceTokenRefusals, Ma as malformedOrphanRecordsWarning, Mc as isReadableBag, Mi as recordedOutputReferenceRegions, Ml as resolveStateBucketWithDefaultAndSource, Mn as withStackRecords, Mo as shownType, Ms as recordLogOnlyParameterValue, Mt as demoteSupersededOrphans, N as serviceTokenBlockingReason, Na as malformedOrphanRowsKeptWarning, Nc as orphansAfterRollback, Ni as recordedReferenceRegions, Nl as resolveUseCdkBootstrapAssets, No as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ns as recordLogOnlyValue, Nt as isJournaledOrphan, O as computeImplicitDeleteEdges, Oa as malformedLocalOutputsWarning, Oc as hasReasonlessBaselineRefusal, Oi as producerLookupOver, Ol as resolveAutoAssetStorage, On as formatDestructiveChange, Or as extractDeploymentEventError, Os as hasMaskableValues, Ot as replayFailedOperations, P as childTemplateLoader, Pa as malformedOrphansRefusalMessage, Pc as orphansCarriedFrom, Pi as applyRoleArnIfSet, Pl as stateBucketExistenceConfirmed, Pn as bold, Po as isStatefulRecreateTargetForReplace, Ps as shareLogOnlyValues, Pt as isReplacementOrphan, Q as pendingRequestCount, Qa as refuseMalformedOutputs, Qc as readBootstrapMarkerBody, Qi as isImpossibleEmptyStoredAttribute, Ql as hasOwnKey, Qn as noEchoExactEchoLeavesOf, Qo as prefetchCreateOnlyPropertyPaths, Qr as applyCustomResourceResponseExpiration, Qt as nameGenerationCarriedFrom, R as renderNestedTemplateTreeDefect, Ra as malformedRenderedContainersWarning, Rc as isSensitiveAttributeName, Ri as isIamRoleArn, Rl as CFN_TEMPLATE_URL_LIMIT, Rn as red, Rs as maskSecretsInError, Rt as recordUnderIdIsNotOwn, Sa as hasReadableResources, Sc as withStackInstanceIdWithheld, Sl as Synthesizer, Sn as bindingSkippedOutputs, So as unreadableOrphanRecords, Sr as ledgerForStack, St as sameJournaledOrphans, Ta as malformedDriftResourcePropertiesWarning, Tc as describeRegionValueKind, Tl as getLegacyStateBucketName, Tn as maskingRetryLogger, To as findActionableSilentDrops, U as readRecordedConditionVerdicts, Ua as malformedStateRefusalMessage, Uc as loadPublishableAssetManifest, Ui as envCredentialsAreAssumedRole, Ul as decodeListingKey, Un as isSupersededResourceRecord, Ur as isCustomResource, Us as DYNAMIC_REFERENCE_TOKEN_SCAN, Ut as findNestedStackTypeChanges, V as conditionInputsFrom, Va as malformedResourcesWarning, Vc as buildAssetRedirectMap, Vi as applyCallerIdentityCredentials, Vl as uploadCfnTemplate, Vn as deleteSupersededEntry, Vr as ProviderRegistry, Vs as withPhysicalNameCopies, Vt as seedsDeleteFirstGuard, W as withResourceDeadline, Wa as previewableOrphanRecords, Wc as rewriteTemplateAssetReferences, Wi as classifyRecordedSecretRegion, Wl as expectedOwnerParam, Wn as removeSuperseded, Wr as wouldReturnToSdkProvider, Ws as dynamicReferenceTokens, X as makeSiblingClaimReader, Xa as refuseMalformedOrphansForDestroy, Xc as isCrossRegionRedirect, Xi as parameterTypeMayLoseSecretIdentity, Xl as processStackMessages, Xn as noEchoAttributeNamesOf, Xr as withPrintingSecrets, Xt as updatePartialMessage, Y as makeCanonicalizePropertiesFn, Ya as refuseMalformedOrphans, Yc as getBootstrapMarkerKey, Yi as isUnboundTemplateParameter, Yl as StageLoadError, Yn as withoutSuperseded, Ys as recordNestedStackParameterExpressions, Z as planOrphanAdoption, Za as refuseMalformedOrphansForOrphan, Zc as parseBootstrapMarker, Zi as getAccountInfo, Zl as defineOwnKey, Zn as noEchoComparisonForTemplate, Zr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Zs as physicalNameCopiesOf, Zt as updatePartialReason, _a as accountArgs, _c as applyCrossPrefixScan, _i as DiffCalculator, _l as runDockerForeground, _n as isWholeDynamicReferenceValue, _o as repairMalformedOutputsForReadOnly, _r as effectiveDeletionPolicy, _s as readbackPathFor, _t as dropFailedHint, a as isProtectionValueActive, aa as isStalePlaceholderArnAttribute, ac as recordNoEchoAttributeValues, ai as deleteIndeterminateGuards, al as describeDockerExecFailure, an as namesAnyDeclaredParameter, ao as refuseMalformedResourceEntriesForImportSave, ar as orphanRecordsPrintingBag, as as DagBuilder, at as dropSettledNestedJournals, au as renderAssemblyPathEscape, ba as hasReadableOrphans, bc as isNotImplemented, bi as poisonRenderedSpellingsCollidingIn, bl as AssetManifestLoader, bn as collectPublishedOutputNames, bo as repairMalformedResourcesForReadOnly, br as unsupportedFinalSnapshotError, bs as valueAtCoordinate, bt as loadJournaledOrphans, ca as withSharedDrainBudget, cc as wholeStringLeavesOf, cl as finchSecretArgvRefusal, cn as WITHHELD_NAME_DISPLAY, co as refuseMalformedResourcePropertiesForDrift, cs as isMarkedCoordinate, ct as recordDisplacedSkips, cu as injectedAwsRegionValue, da as declaresNoEcho, dc as LockManager, dl as isDockerClientEnvKey, dn as secretBearing, do as refuseMalformedResourcesForDeploy, dr as storedSecretNameNeedles, ds as maskWholeValue, dt as withNestedRevertRun, ea as carriesFetchableDynamicReference, ec as splitGetAttStringForm, ei as CloudControlProvider, el as validateContainerRepoName, en as nameScopeOf, eo as refuseMalformedResourceAttributesForOrphan, er as createReadOnlyAttributeHealerFactory, es as describeTypeWithThrottleRetry, et as keptForRetainedRecord, eu as nullPrototypeRecord, fa as JSON_LISTING_HOLE_VALUE, fc as isLockInfoExpired, fl as isMalformedEnvKey, fn as secretBearingStateKeyWarning, fo as refuseMalformedResourcesForDestroy, fr as ATOMIC_FINAL_SNAPSHOT_TYPES, fs as maskedLeafCoordinatesOf, ft as collectNestedChildUnaddressed, ga as UNREADABLE_RESOURCES_MAP_ROW, gc as CrossPrefixScanCache, gl as redactedDockerCause, gn as exportNameSecretExposure, go as repairMalformedOrphansForReadOnly, gr as createPreDeleteFinalSnapshot, gt as dropFailedCommands, ha as UNREADABLE_ORPHANS_CONTAINER_ROW, hc as CrossPrefixReadError, hl as redactedCause, hn as exportNameNoEchoParameters, ho as repairMalformedOrphanRecordsForReadOnly, hr as ccRoutedFinalSnapshotError, hs as noEchoOutputsComparison, ht as deleteJournaledOrphans, i as PROTECTION_PROPERTY_BY_TYPE, ia as cfnRefValueFromPhysicalId, ic as recordMaskOnlyValuesIn, ii as UNSPECIFIED_SKIP_REASON, il as describeDockerCapturedOutput, in as computeParameterTaint, io as refuseMalformedResourceEntriesForImport, ir as namingSecretsWithRecordedNoEcho, it as displacedPhysicalIdShown, iu as displayAssemblyPath, j as deferredServiceTokenWarning, ja as malformedOrphanRecordsRefusalMessage, jc as importableOutputs, jl as resolveStateBucketWithDefault, jo as findReplacedReadersOfRecreateTargets, js as printingCorpusOf, jt as recordAfterRollbackUpdate, k as crossStackOutputProvenanceSource, ka as malformedLocalResourceEntriesWarning, kc as hasUnverifiableParameterRefusal, ki as refuseUnreadableCdkCrossAccountRefs, kl as resolveCaptureObservedState, ko as NO_CC_HANDLERS_REASON, ks as literalSplitDelimitersOf, kt as replayRollback, la as parameterInputsFor, lc as WHOLE_DYNAMIC_REFERENCE_PATTERN, li as isWaitAbandonedError, ll as formatDockerLoginError, ln as displayTextOrWithheld, lo as refuseMalformedResourcePropertiesForExport, lr as secretNamedRecordNeedles, ls as maskAtCoordinates, ma as STATE_RESOURCES_MALFORMED, mc as rebuildClientForBucketRegion, ml as redactDockerArgvValues, mn as carriedExportAliasExposure, mo as refuseMalformedState, mr as buildFinalSnapshotIdentifier, ms as noEchoLeavesOf, mt as withNestedStackContext, n as recordedProtectionEvidence, na as keepsSecretReferenceToken, nc as provenPublicValue, nl as buildDockerImage, nn as retiredNameGenerationsAfter, no as refuseMalformedResourceEntriesForDeploy, nr as journaledOrphanPrintingBag, nt as NESTED_PENDING_PARENT_REASON, nu as absoluteAssemblyPathEscape, o as perType, oa as refStateLookupFromResource, oc as recordNoEchoParameterFreshValue, oi as deleteLeftInPlace, ol as describeDockerFailure, on as reachableDivergentParameters, oo as refuseMalformedResourceEntriesForOrphan, or as secretNamePrintingBag, os as TemplateParser, ou as resolveAssemblyPath, pa as STATE_REGION_DIVERGED, pc as S3StateBackend, pl as partitionSensitiveEnv, pn as secretSafeKeyDisplay, po as refuseMalformedResourcesForExport, pr as PRE_DELETE_SNAPSHOT_TYPES, ps as noEchoCoordinatesOf, pt as getCurrentNestedStackContext, q as keptWholeReasonText, qa as refuseMalformedOrphanRecords, qc as assertAssetBucketRegion, qi as regionLessSecretName, ql as derivePartitionAndUrlSuffix, qn as supersededHolderOf, qr as readsNoEchoDeleteValues, qs as identityKeyFor, r as recordedProtectionNote, ra as AWS_NO_VALUE, rc as recordMaskOnlyValue, ri as RollbackInlinePolicyWriters, rl as resolveDockerContextDirectory, rn as retiredNameGenerationsLeaving, ro as refuseMalformedResourceEntriesForDestroy, rr as maskEventTextWithBoundBags, rt as displacedOpClause, ru as describeFileReadFailure, s as readProtection, sc as recordProvenPublicExpression, si as deleteSkipReason, sl as dockerSpawnEnvWithSensitive, sn as resourcesNamingDeclaredParameter, so as refuseMalformedResourcePropertiesForDestroy, sr as secretNamePrintingBags, ss as canonicalCoordinates, st as nestedChildStackName$1, su as injectAwsRegion, t as DeployEngine, ta as isNamelessDynamicReferenceError, tc as carriesSecretMask, ti as slowCcOperationTimeoutMs, tl as buildDenyExternalAccessPolicy, tn as retiredAfterRollback, to as refuseMalformedResourceEntries, tr as completedReplayEntries, ts as withRetry, tt as recordRetainedForReadoption, tu as ownValue, uc as isSingleDynamicReferenceToken, ul as getDockerCmd, un as exportAliasCollisionScrubWarning, uo as refuseMalformedResourcePropertiesForOrphan, ur as stateSecretNameNeedles, us as maskReadbackAtCoordinates, ut as revertedNestedRowIds, uu as resolveBucketRegion, va as deployRefusesOrphanRowsReason, vc as crossPrefixDeniedWarning, vi as INTRINSIC_KEYS, vl as runDockerStreaming, vn as noEchoParameterValueSeed, vo as repairMalformedResourceEntriesForReadOnly, vr as isFinalSnapshotError, vs as readsNoEchoSource, vt as isHandledOrphan, wa as isReadableResourceEntry, wc as acceptedCreateOnlyDropsOf, wl as getDefaultStateBucketName, wn as DEFAULT_RESOURCE_WARN_AFTER_MS, wo as withheldAccountClause, wr as withCreateTokenLedger, xa as hasReadableOutputs, xc as stackInstanceIdOf, xl as getDockerImageBySourceHash, xn as isExportAliasCollision, xo as unpreviewableOrphanRecords, xs as liveMatchesUnresolvedTokenFrame, xt as makeForeignHolderScan, ya as displayLogicalId, yc as isAccessDenied, yi as IntrinsicFunctionResolver, yl as warnFinchArgvExposure, yn as collectDeclaredOutputNames, yo as repairMalformedResourcePropertiesForReadOnly, yr as refusesFinalSnapshot, ys as recordedNoEchoValuesOf, yt as journaledOrphanLines, z as templateIdentity, za as malformedResourceEntriesWarning, zc as stringifyValue, zi as sendableAssumeRoleCommand, zl as MIGRATE_TMP_PREFIX, zn as yellow, zs as maskSecretsInText, zt as replacementNeverSwapped } from "./deploy-engine-CYVt2NQR.js";
+import { t as getCdkdVersion } from "./version-CaejipV3.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -2559,7 +2559,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-CBbWGsK0.js");
+	providerClasses ??= import("./provider-classes-B2_u4Fg0.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -2749,11 +2749,16 @@ function findPendingPrefixRenames(stackName, state) {
 		if (typeof userSuppliedName !== "string" || userSuppliedName === "") continue;
 		const nameOptions = PATTERN_B_NAME_OPTIONS[resource.resourceType];
 		if (!nameOptions) continue;
-		const legacyName = withStackName(stackName, () => withSkipPrefix(false, () => generateResourceName(userSuppliedName, {
+		const scope = {
+			stackName,
+			stackInstanceId: void 0,
+			nameGenerations: void 0
+		};
+		const legacyName = withStackScope(scope, () => withSkipPrefix(false, () => generateResourceName(userSuppliedName, {
 			...nameOptions,
 			userSupplied: true
 		})));
-		const newName = withStackName(stackName, () => withSkipPrefix(true, () => generateResourceName(userSuppliedName, {
+		const newName = withStackScope(scope, () => withSkipPrefix(true, () => generateResourceName(userSuppliedName, {
 			...nameOptions,
 			userSupplied: true
 		})));
@@ -3387,7 +3392,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 					const syncValidation = validateRecreateTargets({
 						template: stackInfo.template,
 						state: stateForRecreateCheck?.state ?? {
-							version: 12,
+							version: 13,
 							stackName: stackInfo.stackName,
 							region: stackRegion,
 							resources: {},
@@ -3422,7 +3427,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 						const replacedReaders = await findReplacedReadersOfRecreateTargets({
 							template: stackInfo.template,
 							state: stateForRecreateCheck?.state ?? {
-								version: 12,
+								version: 13,
 								stackName: stackInfo.stackName,
 								region: stackRegion,
 								resources: {},
@@ -4797,7 +4802,7 @@ async function loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery
 			region,
 			resources: {},
 			outputs: {},
-			version: 12,
+			version: 13,
 			lastModified: Date.now()
 		},
 		unreadable: [],
@@ -6205,7 +6210,8 @@ async function diffCommand(stacks, options) {
 					selfRegion: orphanRegion,
 					logger
 				}),
-				logger
+				logger,
+				newScheme: state.stackInstanceId !== void 0
 			})));
 			return {
 				adopted: outcome.adopted,
@@ -6612,6 +6618,7 @@ async function repairParentOutputAttributes(parentRow, region, stateBackend, loc
 			const row = locked.state.resources[parentRow.logicalId];
 			await saveScrubbedState(stateBackend, parentRow.stackName, region, {
 				...locked.state,
+				...stackInstanceIdCarriedFrom(locked.state),
 				resources: {
 					...locked.state.resources,
 					[parentRow.logicalId]: {
@@ -8473,6 +8480,21 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				state: scrubbed
 			};
 		});
+		const newSuperseded = Array.isArray(state.supersededResources) ? state.supersededResources.map((entry) => {
+			if (!isSupersededResourceRecord(entry)) return entry;
+			const needles = new Map(allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets));
+			if (needles.size === 0) return entry;
+			const scrubbed = keepHeldTokenProvenance(scrubResourceRecord(entry.state, needles, void 0, "state-cross-generation", {
+				properties: "unproven",
+				observed: "unproven"
+			}));
+			if (JSON.stringify(scrubbed) === JSON.stringify(entry.state)) return entry;
+			recordsChanged++;
+			return {
+				...entry,
+				state: scrubbed
+			};
+		}) : void 0;
 		const crossStackNeedles = allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets);
 		const redactCrossStackName = (name) => redactForState(name, {
 			provenance: "value-scan",
@@ -8587,8 +8609,10 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const { skippedOutputs: _droppedByScrub, ...carriedState } = state;
 			const nextState = {
 				...carriedState,
+				...stackInstanceIdCarriedFrom(state),
 				resources: newResources,
 				...state.orphans !== void 0 && { orphans: newOrphans },
+				...newSuperseded !== void 0 && { supersededResources: newSuperseded },
 				...newImports !== void 0 && { imports: newImports },
 				...newOutputReads !== void 0 && { outputReads: newOutputReads },
 				outputs: newOutputs,
@@ -10054,7 +10078,8 @@ function redactDriftChanges(changes, secrets, secretPaths, maskPaths) {
 async function runDriftForStack(stackName, region, stateBackend, providerRegistry, ccApiFallback, resolvePrincipalUniqueId, malformedRecordMode, nestedChildRecord, refusalRecovery) {
 	const result = await stateBackend.getState(stackName, region);
 	if (!result) throw new Error(`No state found for stack '${stackName}' (${region}). Run 'cdkd state list' to see available stacks.`);
-	return await withStackName(stackName, async () => {
+	const namingScope = nameScopeOf(stackName, stackInstanceIdOf(result.state, displayStackName(stackName)), result.state);
+	return await withStackScope(namingScope, async () => {
 		const outcomes = [];
 		const state = result.state;
 		const logger = getLogger();
@@ -10520,6 +10545,7 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 			const { skippedOutputs: _droppedByAccept, ...carriedState } = report.state;
 			const newState = {
 				...carriedState,
+				...stackInstanceIdCarriedFrom(report.state),
 				resources,
 				lastModified: Date.now()
 			};
@@ -11164,6 +11190,7 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 					const { skippedOutputs: _droppedByRevert, ...carriedState } = report.state;
 					const newState = {
 						...carriedState,
+						...stackInstanceIdCarriedFrom(report.state),
 						resources,
 						lastModified: Date.now()
 					};
@@ -11810,7 +11837,8 @@ function recordDestroyEvent(recorder, event) {
 const SKIPPED_REMEDY = "Each 'skipped (...)' line above names its cause, and its warning says whether repairing the record in state.json helps. Where it does, repair it and re-run. Otherwise (for example a custom-resource Delete handler that reported FAILED), delete the resources by hand, then drop the records.";
 function countProtectedResources(state) {
 	let count = 0;
-	for (const resource of Object.values(state.resources ?? {})) {
+	const records = [...Object.values(state.resources ?? {}), ...supersededResourcesOf(state).map((entry) => entry.state)];
+	for (const resource of records) {
 		const locator = perType(PROTECTION_PROPERTY_BY_TYPE, resource.resourceType);
 		if (locator) {
 			const isActive = (recorded) => isProtectionValueActive(resource.resourceType, recorded);
@@ -11931,6 +11959,7 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 		command: "destroy",
 		logger,
 		stateResources: state.resources,
+		stackInstanceId: stackInstanceIdOf(state, displayStackName(stackName)),
 		underLock: async (settle) => {
 			const held = await acquireStackLock({
 				...stackLockBase,
@@ -11950,6 +11979,7 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 	refuseDivergentRecordRegionForDestroy(state, stackName, regionForState, ctx.divergentBodyRegion, refusalRecovery, journaledOrphans.segments.flatMap((g) => g.ops).filter((op) => op.physicalIdRecoveredFromError === true).length);
 	const resourceCount = Object.keys(state.resources).length;
 	const orphanCount = (state.orphans ?? []).length;
+	const supersededCount = supersededResourcesOf(state).length;
 	refuseMalformedOutputsForDestroy(state, stackName, regionForState, refusalRecovery);
 	if (crossPrefixScan) applyCrossPrefixScan(await crossPrefixScan, {
 		stackName,
@@ -11960,7 +11990,7 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 			stateBucket: ctx.stateBucket
 		}
 	}, "destroy", (message) => logger.warn(message), (message) => logger.info(message));
-	if (resourceCount === 0 && orphanCount === 0 && journaledOrphans.count === 0) {
+	if (resourceCount === 0 && orphanCount === 0 && !holdsSupersededResources(state) && journaledOrphans.count === 0) {
 		logger.info(`Stack ${displayStackName(stackName)} has no resources, cleaning up state...`);
 		const emptyLock = await acquireStackLock({
 			...stackLockBase,
@@ -11982,7 +12012,7 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 			const recheckJournaled = recheckRead.count;
 			refuseNewPendingRequests(recheckRead, stackName, regionForState);
 			if (recheckJournaled > 0) throw new Error(`Stack ${displayStackName(stackName)} (${displaySafe(regionForState, { asciiOnly: true })}) was empty when this run started but its rollback journal now records ${recheckJournaled} resource(s) a failed deploy created — another cdkd process wrote to it. Re-run the destroy to act on the current state.`);
-			if (!(!recheck || recheckResources === 0 && recheckOrphans === 0)) throw new Error(`Stack ${displayStackName(stackName)} (${displaySafe(regionForState, { asciiOnly: true })}) was empty when this run started but now has ${recheckResources} resource(s) and ${recheckOrphans} rollback-orphaned resource(s) — another cdkd process wrote to it. Re-run the destroy to act on the current state.`);
+			if (!(!recheck || recheckResources === 0 && recheckOrphans === 0 && !holdsSupersededResources(recheck.state))) throw new Error(`Stack ${displayStackName(stackName)} (${displaySafe(regionForState, { asciiOnly: true })}) was empty when this run started but now has ${recheckResources} resource(s) and ${recheckOrphans} rollback-orphaned resource(s) — another cdkd process wrote to it. Re-run the destroy to act on the current state.`);
 			await ctx.stateBackend.deleteState(stackName, regionForState);
 			result.stateDeleted = true;
 			logger.info(`${green("✓")} State deleted`);
@@ -12000,6 +12030,10 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 	}
 	logger.info(`\nResources to be deleted (${resourceCount}):`);
 	for (const [logicalId, resource] of Object.entries(state.resources)) logger.info(`  - ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)})`);
+	if (supersededCount > 0) {
+		logger.info(safeMsg`\nOld resources a replacement left to delete (${supersededCount}):`);
+		for (const entry of supersededResourcesOf(state)) logger.info(safeMsg`  - ${entry.logicalId} (${entry.state.resourceType}), superseded`);
+	}
 	const protectedCount = ctx.removeProtection ? countProtectedResources(state) + countProtectedJournaledOrphans(journaledOrphans, state.region) : 0;
 	let binding;
 	const stackNoEchoValues = () => {
@@ -12121,6 +12155,7 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 		}
 	}
 	const remainingResources = { ...state.resources };
+	let remainingSuperseded = state.supersededResources;
 	const stateTargetFor = (logicalId, resourceType) => resourceType === NESTED_STACK_TYPE ? `${stackName}~${logicalId}` : stackName;
 	const skippedStateTargets = /* @__PURE__ */ new Set();
 	const failedStateTargets = /* @__PURE__ */ new Set();
@@ -12143,13 +12178,16 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 	let secretPrincipalRegions;
 	let secretPrincipalRegionsIncomplete = false;
 	const buildDestroySnapshot = () => {
-		const { imports: _imports, outputReads: _outputReads, ...rest } = state;
+		const { imports: _imports, outputReads: _outputReads, supersededResources: _superseded, ...rest } = state;
 		const keepEvidence = Object.values(remainingResources).some((r) => holdsSecretDerivedPrincipalRecord(r) || secretPrincipalRegions !== void 0 && typeof r === "object" && r !== null && r.resourceType === "AWS::CloudFormation::Stack");
 		return {
 			...rest,
+			...stackInstanceIdCarriedFrom(withoutSuperseded(state)),
+			...retiredNameGenerationsLeaving(state, remainingResources),
 			...keepEvidence && _imports !== void 0 && { imports: _imports },
 			...keepEvidence && _outputReads !== void 0 && { outputReads: _outputReads },
 			resources: { ...remainingResources },
+			...remainingSuperseded !== void 0 && !(Array.isArray(remainingSuperseded) && remainingSuperseded.length === 0) && { supersededResources: remainingSuperseded },
 			outputs: {},
 			exportNames: [],
 			lastModified: Date.now()
@@ -12179,7 +12217,7 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 		if (!sameJournaledOrphans(journaledUnderLock, journaledOrphans)) throw new Error(`The rollback journal of stack ${displayStackName(stackName)} (${displaySafe(regionForState, { asciiOnly: true })}) recorded ${journaledOrphans.count} resource(s) a failed deploy created when this run started and ${journaledUnderLock.count} now, not the same ones — another cdkd process wrote to it. Nothing was deleted; re-run the destroy to act on the current journal.`);
 		const noEchoValues = await stackNoEchoValues();
 		if (journaledUnderLock.count > 0) {
-			const orphanOutcome = await deleteJournaledOrphans(journaledUnderLock, { ...state.resources }, stackName, {
+			const orphanOutcome = await deleteJournaledOrphans(journaledUnderLock, { ...state.resources }, stackName, stackInstanceIdOf(state, displayStackName(stackName)), {
 				providerRegistry: destroyProviderRegistry,
 				region: regionForState,
 				logger,
@@ -12195,7 +12233,8 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 				...state.parentStack !== void 0 && { producerRegionsIncomplete: true }
 			}, {
 				isInterrupted: () => lock.interrupted,
-				noEchoValues
+				noEchoValues,
+				retiredNameGenerations: state.retiredNameGenerations
 			});
 			result.errorCount += orphanOutcome.failures;
 			journaledOrphanFailures = orphanOutcome.failures;
@@ -12266,7 +12305,8 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 				return;
 			}
 		}));
-		const printingBagOf = (logicalId) => withStackName(stackName, () => judgedBagOf(logicalId));
+		const namingScope = nameScopeOf(stackName, stackInstanceIdOf(state, displayStackName(stackName)), state);
+		const printingBagOf = (logicalId) => withStackScope(namingScope, () => judgedBagOf(logicalId));
 		for (let levelIndex = executionLevels.length - 1; levelIndex >= 0; levelIndex--) {
 			if (lock.interrupted) {
 				logger.debug("Interrupted (draining) — not scheduling further deletion levels");
@@ -12286,7 +12326,7 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 				if (shouldRetainResource(resource.deletionPolicy)) {
 					logger.info(`  ⊘ ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) retained — DeletionPolicy: ${displaySafe(resource.deletionPolicy)}`);
 					result.retainedCount++;
-					if (keptForReadoption(resource)) {
+					if (keptForRetainedRecord(resource)) {
 						retainedForReadoption.push({
 							logicalId,
 							resourceType: resource.resourceType,
@@ -12522,6 +12562,69 @@ async function destroyStackInRegion(stackName, state, ctx, stackScope) {
 			}));
 			await Promise.all(deletePromises);
 		}
+		for (const entry of supersededResourcesOf(state)) {
+			if (lock.interrupted) break;
+			const { logicalId } = entry;
+			const { physicalId, resourceType } = entry.state;
+			const drop = () => {
+				remainingSuperseded = (remainingSuperseded ?? []).filter((row) => row !== entry);
+			};
+			const bag = unionOfSecretBags([printingBagOf(logicalId), orphanRecordsPrintingBag([entry], noEchoValues)]);
+			const holder = supersededHolderOf(entry, state.resources);
+			if (holder !== void 0) {
+				drop();
+				if (holder.resourceType !== resourceType) withPrintingSecrets(bag, () => logger.warn(safeMsg`  ⚠ ${supersededHeldByOtherTypeWarning(entry, holder.resourceType)}`));
+				continue;
+			}
+			await withPrintingSecrets(bag, async () => {
+				logger.info(safeMsg`Deleting ${logicalId}'s superseded ${resourceType} (${physicalId})...`);
+				let outcome;
+				try {
+					outcome = await withStackRecords({
+						live: () => Object.entries(remainingResources),
+						survivors: () => Object.entries(remainingResources)
+					}, () => deleteSupersededEntry(entry, {
+						provider: destroyProviderRegistry.getProviderFor({
+							resourceType,
+							...entry.state.provisionedBy !== void 0 && { provisionedBy: entry.state.provisionedBy }
+						}).provider,
+						region: state.region ?? regionForState,
+						...ctx.removeProtection === true && { removeProtection: true },
+						...ctx.stackDestroy === true && { stackDestroy: true },
+						maskSecrets: createUnionSecretMasker([bag]),
+						stop: () => lock.interrupted
+					}));
+				} catch (error) {
+					outcome = {
+						kind: "failed",
+						error
+					};
+				}
+				if (outcome.kind === "deleted") {
+					result.deletedCount++;
+					drop();
+					logger.info(safeMsg`  ✓ Deleted ${logicalId}'s superseded ${resourceType}`);
+					return;
+				}
+				const why = outcome.kind === "notDeleted" ? outcome.reason : maskSecretsInText(describeAwsFailure(outcome.error).detail, bag);
+				if (outcome.kind === "notDeleted") {
+					drop();
+					result.skippedCount++;
+					result.journaledOrphanSkips++;
+					logger.warn(safeMsg`  ⚠ ${logicalId}'s superseded ${resourceType} (${physicalId}) was not deleted: ${why}. ` + "Delete it manually — it is no longer tracked in state.");
+					return;
+				}
+				result.errorCount++;
+				logger.warn(safeMsg`  ⚠ ${logicalId}'s superseded ${resourceType} (${physicalId}) was not deleted: ${why}. ` + "State preserved: it stays recorded, and a re-run of the destroy retries it.");
+			});
+		}
+		const unreadableSuperseded = Array.isArray(state.supersededResources) ? state.supersededResources.filter((row) => !isSupersededResourceRecord(row)).length : holdsSupersededResources(state) ? 1 : 0;
+		if (unreadableSuperseded > 0) {
+			result.skippedCount += unreadableSuperseded;
+			skippedStateTargets.add(stackName);
+			const one = unreadableSuperseded === 1;
+			logger.warn(safeMsg`  ⚠ ${unreadableSuperseded} superseded resource ` + (one ? "entry" : "entries") + " in state could not be read, so nothing was deleted for " + (one ? "it" : "them") + ". State preserved: it may name a resource still in AWS.");
+		}
 		result.interrupted = lock.interrupted;
 		await saveChain;
 		const preserveState = result.errorCount > 0 || result.interrupted || result.skippedCount > result.journaledOrphanSkips;
@@ -13556,6 +13659,11 @@ async function rewriteResourceReferences(state, orphanLogicalIds, providerRegist
 	return {
 		state: {
 			...carriedState,
+			...stackInstanceIdCarriedFrom(state),
+			...retiredNameGenerationsAfter(state, orphanLogicalIds.map((logicalId) => ({
+				logicalId,
+				record: orphans[logicalId]
+			})).filter((entry) => entry.record !== null && typeof entry.record === "object")),
 			resources: newResources,
 			outputs: newOutputs,
 			lastModified: Date.now()
@@ -18024,7 +18132,7 @@ async function stateShowCommand(stackName, options) {
 		}
 		if (options.json) {
 			process.stdout.write(`${stringifyJsonPayload({
-				state: stateResult.state,
+				state: withStackInstanceIdWithheld(stateResult.state),
 				lock: lockInfo
 			})}\n`);
 			return;
@@ -18206,7 +18314,7 @@ function appendDescendants(children, out) {
 }
 function treeToShowJson(node) {
 	return {
-		state: node.state,
+		state: withStackInstanceIdWithheld(node.state),
 		lock: node.lock,
 		children: node.children.map(treeToShowJson)
 	};
@@ -19052,7 +19160,8 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 		let refusedBaseline = 0;
 		let refusedSticky = 0;
 		const publicSsmProver = new PublicSsmProver(region, () => driftProducerRegionEvidence(state, stackName, region, stateBackend), logger);
-		await withStackName(stackName, async () => {
+		const stackInstanceId = stackInstanceIdOf(state, displayStackName(stackName));
+		await withStackScope(nameScopeOf(stackName, stackInstanceId, state), async () => {
 			const printingBagOf = secretNamePrintingBags(state.resources, void 0);
 			const tasks = entries.map(([logicalId, resource]) => withPrintingSecrets(printingBagOf(logicalId), async () => {
 				if (resource.observedBaselineRefused === true && logicalId !== acceptId) {
@@ -19374,6 +19483,7 @@ async function rollbackCommand(stackArg, options) {
 			}
 			try {
 				const stateData = await setup.stateBackend.getState(stackName, region);
+				const stackInstanceId = stackInstanceIdOf(stateData?.state, displayStackName(stackName));
 				let journal = await setup.stateBackend.loadRollbackJournal(stackName, region);
 				if (await resolvePendingCloudControlRequests({
 					journal: setup.stateBackend,
@@ -19383,7 +19493,8 @@ async function rollbackCommand(stackArg, options) {
 					region,
 					command: "rollback",
 					logger,
-					stateResources: stateData?.state.resources
+					stateResources: stateData?.state.resources,
+					stackInstanceId: stateData === null ? () => setup.stateBackend.readStackInstanceSibling(stackName, region) : stackInstanceId
 				})) journal = await setup.stateBackend.loadRollbackJournal(stackName, region);
 				const orphanedPending = journal ? await judgeNestedPendingRecords(setup, stackName, region, journal.segments) : 0;
 				if (journal && orphanedPending > 0) journal = {
@@ -19421,6 +19532,8 @@ async function rollbackCommand(stackArg, options) {
 				refuseDivergentRecordRegionForRollback(baseState, stackName, region, stateData.divergentBodyRegion, journal.segments.flatMap((seg) => seg.failedOperations ?? []).filter((op) => op.physicalIdRecoveredFromError === true).length);
 				const stateResources = { ...baseState.resources };
 				const mintedOrphans = [];
+				const rolledBackCreates = [];
+				const supersededHost = {};
 				const orphanLogicalIds = new Set(options.orphan ?? []);
 				const newestSegment = journal.segments[journal.segments.length - 1];
 				if (newestSegment?.roleArn && !options.roleArn) {
@@ -19432,7 +19545,7 @@ async function rollbackCommand(stackArg, options) {
 				const legacySegments = journal.segments.filter((s) => s.skipPrefix === void 0).length;
 				if (legacySegments > 0) logger.warn(safeMsg`${legacySegments} of ${journal.segments.length} rollback journal segment(s) ` + "were recorded by a cdkd that did not record the user-supplied-name prefix setting; replaying them with the stack-name prefix " + (legacySkipPrefix() ? "SKIPPED" : "KEPT") + " on user-supplied physical names (CDKD_PREFIX_USER_SUPPLIED_NAMES / context.cdkd.prefixUserSuppliedNames in ./cdk.json / the default). If the failed deploy ran with --prefix-user-supplied-names, re-run with CDKD_PREFIX_USER_SUPPLIED_NAMES=true instead.");
 				const createTokenLedger = ledgerForStack(setup.stateBackend, stackName, region);
-				const inSegmentScope = (segment, fn) => withSkipPrefix(segment.skipPrefix ?? legacySkipPrefix(), () => withStackName(stackName, () => withCreateTokenLedger(createTokenLedger, fn)));
+				const inSegmentScope = (segment, fn) => withSkipPrefix(segment.skipPrefix ?? legacySkipPrefix(), () => withStackScope(nameScopeOf(stackName, stackInstanceId, stateData?.state), () => withCreateTokenLedger(createTokenLedger, fn)));
 				logger.info(`\nRollback plan for ${stackRegionShown(stackName, region)}:`);
 				if (!stackRegionIsPlain(stackName, region)) logger.info(STACK_REGION_DESCRIBED_NOTE);
 				if (orphanedPending > 0) logger.info(safeMsg`\n  Discard ${orphanedPending} record(s) of nested deploys whose parent run no longer ` + `has a journal to replay them (nothing else would ever replay them).`);
@@ -19505,10 +19618,13 @@ async function rollbackCommand(stackArg, options) {
 					const { skippedOutputs: _droppedByRollback, ...carriedState } = baseState;
 					const next = () => ({
 						...carriedState,
-						version: 12,
+						...stackInstanceIdCarriedFrom(baseState),
+						...supersededAfterRollback(baseState, supersededHost),
+						version: 13,
 						region,
 						resources: { ...stateResources },
 						...orphansAfterRollback(baseState, mintedOrphans),
+						...retiredAfterRollback(baseState, mintedOrphans, rolledBackCreates),
 						lastModified: Date.now()
 					});
 					try {
@@ -19577,6 +19693,7 @@ async function rollbackCommand(stackArg, options) {
 										isInterrupted: () => interrupted,
 										emitEnvelope: completedOps.length === 0,
 										onOrphan: (record) => mintedOrphans.push(record),
+										onRolledBackCreate: (create) => rolledBackCreates.push(create),
 										inlinePolicyWriters
 									})));
 									failedOpFailures = failedResult.failures;
@@ -19607,8 +19724,11 @@ async function rollbackCommand(stackArg, options) {
 									afterOp: saveState,
 									isInterrupted: () => interrupted,
 									onOrphan: (record) => mintedOrphans.push(record),
+									onRolledBackCreate: (create) => rolledBackCreates.push(create),
 									inlinePolicyWriters,
-									failedOperations: failedForGuard
+									failedOperations: failedForGuard,
+									onSuperseded: (entry) => addSuperseded(supersededHost, entry),
+									onSupersededSettled: (entry) => removeSuperseded(supersededHost, entry)
 								}));
 								return {
 									failures: replayResult.failures + failedOpFailures,
@@ -19641,7 +19761,7 @@ async function rollbackCommand(stackArg, options) {
 					await eventRecorder.finalize(totalFailures > 0 || interrupted || declinedDivergentRewrite ? "FAILED" : "SUCCEEDED");
 				}
 				const survivingOrphans = orphansAfterRollback(baseState, mintedOrphans).orphans ?? [];
-				if (journal.segments.length === 0 && oldestInitialDeploy && Object.keys(stateResources).length === 0 && survivingOrphans.length === 0) {
+				if (journal.segments.length === 0 && oldestInitialDeploy && Object.keys(stateResources).length === 0 && survivingOrphans.length === 0 && !holdsSupersededResources(baseState)) {
 					await setup.stateBackend.deleteState(stackName, region);
 					await recordRetainedForReadoption(setup.stateBackend, stackName, region, [], logger);
 					await releaseRegistryMarkerQuietly(setup.stateBackend, stackName, region, logger);
@@ -21244,6 +21364,10 @@ async function importCommand(stackArg, options) {
 			const saveOptions = {};
 			if (existingEtag) saveOptions.expectedEtag = existingEtag;
 			if (migrationPending) saveOptions.migrateLegacy = true;
+			if (existingState === null) stackState = {
+				...stackState,
+				stackInstanceId: await stateBackend.stackInstanceIdForFirstWrite(stackInfo.stackName, targetRegion, { writeAhead: false })
+			};
 			await recordImportOnRollbackJournal(stateBackend, stackInfo.stackName, targetRegion, importedRows.map((r) => r.logicalId), stackState.resources, logger);
 			await stateBackend.saveState(stackInfo.stackName, targetRegion, stackState, saveOptions);
 			logger.info(`✓ State written: ${stackInfo.stackName} (${targetRegion})`);
@@ -21695,6 +21819,7 @@ function buildStackState(stackName, region, rows, templateParser, template, exis
 		}
 		resources[row.logicalId] = {
 			physicalId: row.physicalId,
+			...importedNameGenerationFields(prior, row, existingState?.retiredNameGenerations?.[row.logicalId]),
 			resourceType: row.resourceType,
 			properties: tmplResource.Properties ?? {},
 			attributes,
@@ -21712,7 +21837,7 @@ function buildStackState(stackName, region, rows, templateParser, template, exis
 	}
 	if (namesParameter?.failedClosed !== void 0) getLogger().debug(`The template's parameter dependence could not be judged (${namesParameter.failedClosed}): every prior observed-baseline refusal recorded without a reason is carried as an unverifiable-parameter refusal.`);
 	return {
-		version: 12,
+		version: 13,
 		stackName,
 		region,
 		resources,
@@ -21720,6 +21845,7 @@ function buildStackState(stackName, region, rows, templateParser, template, exis
 		...existingState ? exportNamesCarriedFrom(existingState) : { exportNames: [] },
 		...existingState?.outputReferenceProvenance !== void 0 && { outputReferenceProvenance: existingState.outputReferenceProvenance },
 		...existingState ? orphansCarriedFrom(existingState) : {},
+		...existingState ? stackInstanceIdCarriedFrom(existingState) : {},
 		lastModified: Date.now()
 	};
 }
@@ -22182,6 +22308,10 @@ async function importNestedStackChildrenRecursive(args) {
 			childStackState.parentStack = parentStackName;
 			childStackState.parentLogicalId = childLogicalId;
 			childStackState.parentRegion = parentRegion;
+			const childPrior = await stateBackend.getState(childStackName, childRegion);
+			const childStackInstanceId = childPrior ? stackInstanceIdOf(childPrior.state, displaySafe(childStackName)) : await stateBackend.stackInstanceIdForFirstWrite(childStackName, childRegion, { writeAhead: false });
+			if (childPrior) Object.assign(childStackState, stackInstanceIdCarriedFrom(childPrior.state));
+			else if (childStackInstanceId !== void 0) childStackState.stackInstanceId = childStackInstanceId;
 			const childDeployedParameters = namesAnyDeclaredParameter(childStateTemplate) ? await readDeployedParameters(childTreeNode.stackName, args.cfnClient, logger, displaySafe(childStackName)) : void 0;
 			await captureObservedForImportedResources(childStackState, providerRegistry, logger, await withSharedDrainBudget(() => resolveImportedProperties(childStackState, childStateTemplate, childRegion, stateBackend, logger, childDeployedParameters)), rebuiltLogicalIdsFrom(rows, childTemplate));
 			await recordImportOnRollbackJournal(stateBackend, childStackName, childRegion, rows.filter((r) => r.outcome === "imported").map((r) => r.logicalId), childStackState.resources, logger);
@@ -22242,6 +22372,18 @@ function indexGrandchildTemplatePaths(childTemplate, childTemplatePath) {
 function constructPathField(path) {
 	return path === void 0 ? {} : { constructPath: path };
 }
+function importedNameGenerationFields(prior, row, retired) {
+	const retiredReached = isNameGeneration(retired) ? retired : 0;
+	const reachedField = (reached) => reached === 0 ? {} : { nameGenerationHigh: reached };
+	if (prior === null || typeof prior !== "object") return reachedField(retiredReached);
+	try {
+		if (prior.physicalId !== row.physicalId) return reachedField(Math.max(retiredReached, nameGenerationHighWaterOf(prior, row.logicalId)));
+		nameGenerationHighWaterOf(prior, row.logicalId);
+		return nameGenerationCarriedFrom(prior);
+	} catch {
+		return reachedField(retiredReached);
+	}
+}
 
 //#endregion
 //#region src/utils/local-aws-failure.ts
@@ -29564,4 +29706,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { resolveSecretDerivedPrincipals as a, buildProgram, isResolvableSecretPrincipalList as i, runDestroyForStack as n, canonicalizeIpProtocolValue as o, holdsUnprovenSecretPrincipalToken as r, resolvedResourceTimeoutMs as s, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-CXvao3wc.js.map
+//# sourceMappingURL=program-CvRs5pV_.js.map