@go-to-k/cdkd 0.301.2 → 0.301.4

package/dist/{deploy-engine--5XWdjW3.js → deploy-engine-BIPU9Xdh.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-B_CEQGE1.js";
 import { A as UNRENDERABLE, B as safeMsg, C as looksLikeCdkdGeneratedName, D as SAFE_MSG_ALTERED_CHAR, E as withoutGeneratedFallbackName, F as displaySafe, H as terminalSafe, I as displayStackName, L as isPasteableIdent, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, S as getCurrentStackName, T as withStackName, U as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, j as asIsMessage, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, An as SHELL_ACTIVE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, Ct as RETRY_AUXILIARY_OWNER, Dn as normalizeAwsError, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as isUpdateUnsupportedError, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as withheldTargetClause, Ht as recoveryCommandFlags, In as pasteableCommand, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as isNameCooldownError, Kn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as physicalIdShownBesideCommand, M as quotedRemedyLogicalId, Mn as UNSHOWABLE_VALUE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Ot as hasCreatedBeforeFailure, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as plainOrDescribed, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Ut as sanitizeRecoveryValue, Vn as shellQuote, Vt as formatLockOwner, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isReplayedNameCollisionFrom, Yn as isRecreateRetryableError, Yt as producerRecordKey, Zt as withPasteableAwsProfile, _t as createMaskedLogSinks, ar as isRetryableTransientError, at as startInterruptWatch, bn as ResourceUpdateNotSupportedError, bt as maskDeep, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dr as markNonRetryable, en as clientDefaultsFor, er as formatRetryClassificationSignals, f as removalWarning, fr as markRedactedCause, ft as logicalIdShown, gt as stateOrphanRecordRemedy, hn as MalformedProducerRecordRefusalError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isIamPropagationError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as SHELL_ACTIVE_WHY, jt as markAuxiliaryFailure, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DynamicReferenceRegionAmbiguousError, lr as isMarkedNonRetryable, m as withoutInjectedRemovals, mn as MacroExpansionError, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, on as CrossAccountSecretRefusalError, or as isTransientServerError, ot as ElapsedBudgetRegistry, pn as LockError, pr as wrapMaskedAwsError, qn as isNameCollisionErrorFrom, rn as AssetError, sn as DependencyError, sr as retryClassificationText, st as monotonicNowMs, tn as credentialFingerprint, tr as isAmbiguousCcHandlerErrorCode, un as IntrinsicResolutionRefusalError, ur as isThrottlingError, ut as compositeIdSeparatorRefusal, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as SynthesisError, wt as carryCreatedBeforeFailure, xt as maskerOrIdentity, yn as ResourceTimeoutError, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-DFk7zr0Q.js";
+import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, An as SHELL_ACTIVE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, Ct as RETRY_AUXILIARY_OWNER, Dn as normalizeAwsError, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as isUpdateUnsupportedError, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as withheldTargetClause, Ht as recoveryCommandFlags, In as pasteableCommand, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as isNameCooldownError, Kn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as physicalIdShownBesideCommand, M as quotedRemedyLogicalId, Mn as UNSHOWABLE_VALUE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Ot as hasCreatedBeforeFailure, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as plainOrDescribed, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Ut as sanitizeRecoveryValue, Vn as shellQuote, Vt as formatLockOwner, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isReplayedNameCollisionFrom, Yn as isRecreateRetryableError, Yt as producerRecordKey, Zt as withPasteableAwsProfile, _t as createMaskedLogSinks, ar as isRetryableTransientError, at as startInterruptWatch, bn as ResourceUpdateNotSupportedError, bt as maskDeep, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dr as markNonRetryable, en as clientDefaultsFor, er as formatRetryClassificationSignals, f as removalWarning, fr as markRedactedCause, ft as logicalIdShown, gt as stateOrphanRecordRemedy, hn as MalformedProducerRecordRefusalError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isIamPropagationError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as SHELL_ACTIVE_WHY, jt as markAuxiliaryFailure, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DynamicReferenceRegionAmbiguousError, lr as isMarkedNonRetryable, m as withoutInjectedRemovals, mn as MacroExpansionError, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, on as CrossAccountSecretRefusalError, or as isTransientServerError, ot as ElapsedBudgetRegistry, pn as LockError, pr as wrapMaskedAwsError, qn as isNameCollisionErrorFrom, rn as AssetError, sn as DependencyError, sr as retryClassificationText, st as monotonicNowMs, tn as credentialFingerprint, tr as isAmbiguousCcHandlerErrorCode, un as IntrinsicResolutionRefusalError, ur as isThrottlingError, ut as compositeIdSeparatorRefusal, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as SynthesisError, wt as carryCreatedBeforeFailure, xt as maskerOrIdentity, yn as ResourceTimeoutError, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-BkeM7IXi.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-DBXBcg0J.js";
-import { t as getCdkdVersion } from "./version-DUYEmFtp.js";
+import { t as getCdkdVersion } from "./version-Bft5jrTk.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7888,6 +7888,10 @@ function isStrictlyInsideASpan(spans, start, end) {
 	return spans.some((span) => span.start <= start && end <= span.end && (span.start !== start || span.end !== end));
 }
 function embedsNeedleOutsideReferences(leaf, needles, secrets) {
+	return needleOccurrencesOutsideReferences(leaf, needles, secrets, true).length > 0;
+}
+function needleOccurrencesOutsideReferences(leaf, needles, secrets, first) {
+	const found = [];
 	let spans;
 	let names;
 	for (const needle of needles) for (let at = leaf.indexOf(needle); at >= 0; at = leaf.indexOf(needle, at + 1)) {
@@ -7896,9 +7900,19 @@ function embedsNeedleOutsideReferences(leaf, needles, secrets) {
 		names ??= physicalNameSpans(physicalNameCopiesOf.get(secrets), leaf);
 		const end = at + needle.length;
 		if (names.some((n) => n.start <= at && end <= n.end)) continue;
-		return true;
+		found.push({
+			start: at,
+			end
+		});
+		if (first) return found;
 	}
-	return false;
+	return found;
+}
+function cutsContainmentNeedle(leaf, secrets, redacted) {
+	if (redacted.length === 0) return false;
+	const needles = containmentNeedlesOf(secrets);
+	if (needles.length === 0) return false;
+	return needleOccurrencesOutsideReferences(leaf, needles, secrets, false).some((c) => redacted.some((m) => m.start < c.end && c.start < m.end && !(m.start <= c.start && c.end <= m.end)));
 }
 function flattenEmbeddedNoEchoLeaves(value, secrets) {
 	const needles = containmentNeedlesOf(secrets);
@@ -9253,14 +9267,29 @@ function redactSecretsForStatePasses(bag, secrets, source, rules) {
 	const physicalNames = physicalNameCopiesOf.get(secrets);
 	let vouched;
 	const vouchedExpressions = () => vouched ??= new Set(secrets.values());
+	const expressionFor = (match) => {
+		return secrets.get(match) ?? "***";
+	};
 	const scanLeaf = (value, needles) => {
 		const spans = isDynamicReferenceString(value) ? resolvableReferenceSpans(value, vouchedExpressions()) : [];
 		const names = physicalNameSpans(physicalNames, value);
+		const kept = (start, end) => isStrictlyInsideASpan(spans, start, end) || names.some((n) => n.start <= start && end <= n.end);
+		if (!legacyOverlapScan.has(secrets)) {
+			const matches = everyMatch(value, needles);
+			const redacted = matches.filter((m) => !kept(m.start, m.end));
+			if (cutsContainmentNeedle(value, secrets, redacted)) {
+				overlapAnswered.add(secrets);
+				return "***";
+			}
+			const overlapping = redactOverlappingMatches(value, matches, redacted, expressionFor);
+			if (overlapping !== void 0) {
+				overlapAnswered.add(secrets);
+				return overlapping;
+			}
+		}
 		return value.replace(needles, (match, offset) => {
-			if (isStrictlyInsideASpan(spans, offset, offset + match.length)) return match;
-			const end = offset + match.length;
-			if (names.some((n) => n.start <= offset && end <= n.end)) return match;
-			return secrets.get(match) ?? "***";
+			if (kept(offset, offset + match.length)) return match;
+			return expressionFor(match);
 		});
 	};
 	const walk = (value) => {
@@ -9290,6 +9319,113 @@ function redactSecretsForStatePasses(bag, secrets, source, rules) {
 	};
 	return walk(bag);
 }
+const legacyOverlapScan = /* @__PURE__ */ new WeakSet();
+const overlapAnswered = /* @__PURE__ */ new WeakSet();
+function overlapRuleAnswered(secrets) {
+	return overlapAnswered.has(secrets);
+}
+function withLegacyOverlapScan(secrets, run) {
+	if (legacyOverlapScan.has(secrets)) return run();
+	legacyOverlapScan.add(secrets);
+	try {
+		return run();
+	} finally {
+		legacyOverlapScan.delete(secrets);
+	}
+}
+function differingStringLeaves(legacy, current, out = []) {
+	if (typeof legacy === "string" && typeof current === "string") {
+		if (legacy !== current) out.push([legacy, current]);
+		return out;
+	}
+	if (Array.isArray(legacy) && Array.isArray(current) && legacy.length === current.length) {
+		legacy.forEach((item, i) => differingStringLeaves(item, current[i], out));
+		return out;
+	}
+	if (legacy !== null && current !== null && typeof legacy === "object" && typeof current === "object" && !Array.isArray(legacy) && !Array.isArray(current)) {
+		const c = current;
+		for (const [key, value] of Object.entries(legacy)) if (Object.hasOwn(c, key)) differingStringLeaves(value, c[key], out);
+	}
+	return out;
+}
+function legacyReferenceLeavesOnly(legacy) {
+	if (typeof legacy === "string") return legacy.includes("{{resolve:") ? legacy : void 0;
+	if (Array.isArray(legacy)) return legacy.map(legacyReferenceLeavesOnly);
+	if (legacy !== null && typeof legacy === "object") {
+		const out = Object.create(null);
+		for (const [key, value] of Object.entries(legacy)) out[key] = legacyReferenceLeavesOnly(value);
+		return out;
+	}
+	return legacy;
+}
+function replaceWholeLeaves(value, pairs) {
+	if (pairs.length === 0) return value;
+	if (typeof value === "string") {
+		const hit = pairs.find(([legacy]) => legacy === value);
+		return hit === void 0 ? value : hit[1];
+	}
+	if (Array.isArray(value)) {
+		let changed = false;
+		const out = value.map((item) => {
+			const next = replaceWholeLeaves(item, pairs);
+			if (next !== item) changed = true;
+			return next;
+		});
+		return changed ? out : value;
+	}
+	if (value !== null && typeof value === "object") {
+		let out;
+		for (const [key, item] of Object.entries(value)) {
+			const next = replaceWholeLeaves(item, pairs);
+			if (next !== item) {
+				out ??= Object.assign(Object.create(null), value);
+				out[key] = next;
+			}
+		}
+		return out ?? value;
+	}
+	return value;
+}
+function everyMatch(value, needles) {
+	const matches = [];
+	needles.lastIndex = 0;
+	for (let m = needles.exec(value); m !== null; m = needles.exec(value)) {
+		matches.push({
+			start: m.index,
+			end: m.index + m[0].length
+		});
+		needles.lastIndex = m.index + 1;
+	}
+	needles.lastIndex = 0;
+	return matches;
+}
+function redactOverlappingMatches(value, matches, redacted, expressionFor) {
+	let reach = 0;
+	let overlap = false;
+	for (const m of matches) {
+		if (m.start < reach) overlap = true;
+		reach = Math.max(reach, m.end);
+	}
+	if (!overlap) return void 0;
+	let out = "";
+	let cursor = 0;
+	for (let i = 0; i < redacted.length;) {
+		let end = redacted[i].end;
+		let j = i + 1;
+		for (; j < redacted.length && redacted[j].start < end; j++) end = Math.max(end, redacted[j].end);
+		const cluster = redacted.slice(i, j);
+		out += value.slice(cursor, cluster[0].start);
+		for (let at = cluster[0].start; at < end;) {
+			const tile = cluster.find((m) => m.start === at);
+			if (tile === void 0) return "***";
+			out += expressionFor(value.slice(tile.start, tile.end));
+			at = tile.end;
+		}
+		cursor = end;
+		i = j;
+	}
+	return out + value.slice(cursor);
+}
 function scrubResourceRecord(record, secrets, sourceProperties, observedRules) {
 	if (secrets.size === 0 && sourceProperties === void 0 && !record.observedProperties) return record;
 	const next = { ...record };
@@ -10421,6 +10557,43 @@ function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
 	walk(template, resolved, []);
 	return coordinates;
 }
+function noEchoParameterNodesAt(templateProperties, shape, noEchoParameters, conditions) {
+	const nodes = /* @__PURE__ */ new Map();
+	noEchoCoordinatesOf(templateProperties ?? {}, shape, {
+		parameters: noEchoParameters,
+		...conditions !== void 0 && { conditions }
+	}, (coordinate, node) => nodes.set(canonicalJson$3(coordinate), {
+		coordinate,
+		node
+	}));
+	return nodes;
+}
+function recordedNoEchoValuesOf(templateProperties, record, noEchoParameterNames, conditions) {
+	const bag = /* @__PURE__ */ new Map();
+	const properties = record?.properties;
+	if (properties === null || typeof properties !== "object") return bag;
+	const coordinates = /* @__PURE__ */ new Map();
+	if (noEchoParameterNames.size > 0 && templateProperties !== void 0) for (const [key, { coordinate }] of noEchoParameterNodesAt(templateProperties, properties, noEchoParameterNames, conditions)) coordinates.set(key, coordinate);
+	for (const coordinate of noEchoLeavesOf(record ?? {}) ?? []) coordinates.set(canonicalJson$3(coordinate), coordinate);
+	const recordLeaf = (leaf) => {
+		if (typeof leaf === "string") {
+			if (leaf === "***" || leaf.includes("{{resolve:")) return;
+			recordLogOnlyValue(bag, leaf);
+		} else if (typeof leaf === "number") recordLogOnlyValue(bag, String(leaf));
+	};
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (value) => {
+		if (value === null || typeof value !== "object") {
+			recordLeaf(value);
+			return;
+		}
+		if (seen.has(value)) return;
+		seen.add(value);
+		for (const child of Object.values(value)) walk(child);
+	};
+	for (const coordinate of coordinates.values()) walk(valueAtCoordinate(properties, coordinate));
+	return bag;
+}
 function maskWholeValue(value) {
 	if (value === null || value === void 0) return value;
 	if (typeof value === "string" && isSingleDynamicReferenceToken(value)) return value;
@@ -15007,6 +15180,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Unit"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([
+			["ActionConfiguration", "not yet implemented by cdkd"],
 			["EvaluationCriteria", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."],
 			["EvaluationInterval", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."],
 			["EvaluationWindow", "not yet implemented by cdkd"],
@@ -21515,7 +21689,7 @@ function withheldRemedy(context) {
 	if (context?.attributeHealer?.readOnly === true) return `This preview re-read the resource through Cloud Control, but withheld the value: ${confirm} Grant the credentials the preview runs with cloudformation:DescribeType and run the diff again (a deploy's own read needs the same permission); if they already have it, the name is a writable property rather than an attribute — reference the value the template sets instead.`;
 	return `cdkd re-read the resource through Cloud Control, but withheld the value: ${confirm} Grant the deploy role cloudformation:DescribeType and deploy again; if the role already has it, the name is a writable property rather than an attribute — reference the value the template sets instead.`;
 }
-async function healStaleAttributes$1(logicalId, resource, context) {
+async function healStaleAttributes(logicalId, resource, context) {
 	if (context.attributeHealer === void 0) return void 0;
 	try {
 		return await context.attributeHealer(logicalId, resource);
@@ -24428,7 +24602,7 @@ IntrinsicFunctionResolver.prototype.staleRecordRemedy = staleRecordRemedy;
 IntrinsicFunctionResolver.prototype.unenrichedRemedy = unenrichedRemedy;
 IntrinsicFunctionResolver.prototype.healWithheld = healWithheld;
 IntrinsicFunctionResolver.prototype.withheldRemedy = withheldRemedy;
-IntrinsicFunctionResolver.prototype.healStaleAttributes = healStaleAttributes$1;
+IntrinsicFunctionResolver.prototype.healStaleAttributes = healStaleAttributes;
 IntrinsicFunctionResolver.prototype.usableHealedAttribute = usableHealedAttribute;
 IntrinsicFunctionResolver.prototype.serveHealedAttribute = serveHealedAttribute;
 IntrinsicFunctionResolver.prototype.constructWithStaleRecordHeal = constructWithStaleRecordHeal;
@@ -26878,7 +27052,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider--t5d-gjf.js");
+			const { ASGProvider } = await import("./asg-provider--GY-B-zI.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -26984,7 +27158,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-BvZhdkOC.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DjEVKBcV.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-DI_O0_iG.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DoKgbZCz.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -27813,7 +27987,7 @@ var IdScrubLog = class {
 			...masked.filter((m, i) => m !== "" && m !== raw[i] && m !== "***")
 		])].sort((a, b) => b.length - a.length);
 	}
-	scrub = (text) => this.needles.reduce((out, needle) => out.split(needle).join("***"), this.mask(text));
+	scrub = (text) => maskMatchSpans(this.mask(text), this.needles, "***");
 	scrubKeepingResume(text, requestTokens) {
 		const tokens = requestTokens.filter((token) => token !== "");
 		if (tokens.length === 0) return this.scrub(text);
@@ -28143,14 +28317,6 @@ function recordLeaves(bag, value) {
 	}
 	recordLogOnlyParameterValue(bag, value);
 }
-function templateNodesAt(templateProperties, shape, noEchoParameters, conditions) {
-	const nodes = /* @__PURE__ */ new Map();
-	noEchoCoordinatesOf(templateProperties ?? {}, shape, {
-		parameters: noEchoParameters,
-		...conditions !== void 0 && { conditions }
-	}, (coordinate, node) => nodes.set(canonicalJson$3(coordinate), node));
-	return nodes;
-}
 async function fingerprintsUnchanged(record, templateProperties, coordinate, fingerprinter) {
 	const key = coordinate[0];
 	if (typeof key !== "string") return false;
@@ -28172,7 +28338,7 @@ async function noEchoDeleteValuesFromResolved(options) {
 	if (masked.length === 0 || templateResource === void 0 || resolvedProperties === void 0) return;
 	if (templateResource.Type !== record.resourceType) return void 0;
 	if (carriesResolvedSecret(options.secrets)) return void 0;
-	const nodes = templateNodesAt(templateResource.Properties, resolvedProperties, options.noEchoParameters, options.conditions);
+	const nodes = noEchoParameterNodesAt(templateResource.Properties, resolvedProperties, options.noEchoParameters, options.conditions);
 	const bag = new Map(options.secrets);
 	carryLogOnlyValues(options.secrets, bag);
 	const templateProps = isRecord(templateResource.Properties) ? templateResource.Properties : {};
@@ -28337,6 +28503,11 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 		}
 		return bag;
 	}
+	recordedNoEchoValuesFor(logicalId, record) {
+		const resources = this.options.template.Resources;
+		const templateResource = resources !== void 0 && resources !== null && Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+		return recordedNoEchoValuesOf(templateResource?.Type === record?.resourceType ? templateResource?.Properties : void 0, record, this.noEchoParameters, void 0);
+	}
 	async valuesFor(logicalId, record) {
 		const masked = maskedNoEchoCoordinates(record.properties, noEchoLeavesOf(record));
 		if (masked.length === 0) return void 0;
@@ -28345,7 +28516,7 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 		if (templateResource?.Type !== record.resourceType) return void 0;
 		const parameters = await this.boundParameters();
 		if (parameters === void 0) return void 0;
-		const nodes = templateNodesAt(templateResource.Properties, record.properties, this.noEchoParameters, void 0);
+		const nodes = noEchoParameterNodesAt(templateResource.Properties, record.properties, this.noEchoParameters, void 0);
 		const declared = new Set(Object.keys(this.options.template.Parameters ?? {}));
 		const templateProps = isRecord(templateResource.Properties) ? templateResource.Properties : {};
 		const fingerprinter = inputFingerprinter(templateProps, this.inputSources(parameters));
@@ -28355,7 +28526,7 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 		for (const coordinate of masked) {
 			const key = canonicalJson$3(coordinate);
 			if (!nodes.has(key)) continue;
-			const node = nodes.get(key);
+			const node = nodes.get(key)?.node;
 			if (!readsParametersOnly(node, declared, refused)) continue;
 			if (!await fingerprintsUnchanged(record, templateProps, coordinate, fingerprinter)) continue;
 			let value;
@@ -28656,6 +28827,22 @@ function describeWaiterFailure(error, rejections) {
 	if (withheld !== void 0) return withheld;
 	return `${error instanceof Error ? error.name : "Error"} (no function status reported). The waiter's raw payload is withheld because it embeds the whole GetFunction response, environment variables included; run \`aws lambda get-function\` for the detail.`;
 }
+async function waitForLambdaFunctionActive(client, functionArn, abortSignal) {
+	const rejections = new WaiterRejections();
+	try {
+		await waitUntilFunctionActiveV2({
+			client: observingLambdaClient(client, rejections),
+			maxWaitTime: 600,
+			minDelay: 1,
+			maxDelay: 5,
+			...abortSignal ? { abortSignal } : {}
+		}, { FunctionName: functionArn });
+	} catch (error) {
+		const log = getLogger().child("LambdaActiveWait");
+		for (const line of waiterRejectionDebugLines(rejections)) log.debug(safeMsg`Active waiter for ${functionArn} observed ${line}`);
+		throw markNonRetryable(new Error(`Lambda function ${functionArn} did not reach the Active state: ${describeWaiterFailure(error, rejections)}`, { cause: error }));
+	}
+}
 const CR_TRANSIENT_AUTHZ_SIGNALS = [
 	"not authorized to perform",
 	"no identity-based policy allows",
@@ -28847,7 +29034,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 		} catch (error) {
 			markAuxiliaryFailure(error, logicalId);
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create custom resource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create custom resource ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -28881,7 +29068,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update custom resource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update custom resource ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
@@ -29220,7 +29407,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				sleep: customResourceRetryDelays.sleep
 			});
 		} catch (error) {
-			throw markNonRetryable(error instanceof Error ? error : new Error(String(error)));
+			throw markNonRetryable(error instanceof Error ? error : new Error(safeStringify$1(error)));
 		}
 		const command = new PutObjectCommand({
 			Bucket: this.responseBucket,
@@ -29460,6 +29647,17 @@ const NESTED_REQUIRED = /* @__PURE__ */ new Map([
 		["EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig", ["ModelId"]],
 		["EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig", ["ModelId"]],
 		["EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical", ["Definition", "Label"]],
+		["EvaluatorConfig.LlmAsAJudge.RatingScale.MultiDimensional", [
+			"DimensionInstruction",
+			"DimensionName",
+			"DimensionRatingScale"
+		]],
+		["EvaluatorConfig.LlmAsAJudge.RatingScale.MultiDimensional.DimensionRatingScale.Categorical", ["Definition", "Label"]],
+		["EvaluatorConfig.LlmAsAJudge.RatingScale.MultiDimensional.DimensionRatingScale.Numerical", [
+			"Definition",
+			"Label",
+			"Value"
+		]],
 		["EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical", [
 			"Definition",
 			"Label",
@@ -29569,6 +29767,7 @@ const NESTED_REQUIRED = /* @__PURE__ */ new Map([
 		["Tags", ["Key", "Value"]]
 	])],
 	["AWS::CloudWatch::Alarm", /* @__PURE__ */ new Map([
+		["ActionConfiguration.AlarmTagsPropagation", ["Enabled"]],
 		["Dimensions", ["Name", "Value"]],
 		["Metrics", ["Id"]],
 		["Metrics.MetricStat", [
@@ -30894,7 +31093,7 @@ const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::AppSync::GraphQLApi", "{\"AdditionalAuthenticationProviders\":\"array\",\"AdditionalAuthenticationProviders[]\":\"object\",\"AdditionalAuthenticationProviders[].LambdaAuthorizerConfig\":\"object\",\"AdditionalAuthenticationProviders[].OpenIDConnectConfig\":\"object\",\"AdditionalAuthenticationProviders[].UserPoolConfig\":\"object\",\"EnhancedMetricsConfig\":\"object\",\"EnvironmentVariables\":\"object\",\"LambdaAuthorizerConfig\":\"object\",\"LogConfig\":\"object\",\"OpenIDConnectConfig\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"UserPoolConfig\":\"object\"}"],
 	["AWS::AppSync::Resolver", "{\"CachingConfig\":\"object\",\"CachingConfig.CachingKeys\":\"array\",\"PipelineConfig\":\"object\",\"PipelineConfig.Functions\":\"array\",\"Runtime\":\"object\",\"SyncConfig\":\"object\",\"SyncConfig.LambdaConflictHandlerConfig\":\"object\"}"],
 	["AWS::AutoScaling::AutoScalingGroup", "{\"AvailabilityZoneDistribution\":\"object\",\"AvailabilityZoneIds\":\"array\",\"AvailabilityZoneImpairmentPolicy\":\"object\",\"AvailabilityZones\":\"array\",\"CapacityReservationSpecification\":\"object\",\"CapacityReservationSpecification.CapacityReservationTarget\":\"object\",\"CapacityReservationSpecification.CapacityReservationTarget.CapacityReservationIds\":\"array\",\"CapacityReservationSpecification.CapacityReservationTarget.CapacityReservationResourceGroupArns\":\"array\",\"InstanceLifecyclePolicy\":\"object\",\"InstanceLifecyclePolicy.RetentionTriggers\":\"object\",\"InstanceMaintenancePolicy\":\"object\",\"LaunchTemplate\":\"object\",\"LifecycleHookSpecificationList\":\"array\",\"LifecycleHookSpecificationList[]\":\"object\",\"LoadBalancerNames\":\"array\",\"MetricsCollection\":\"array\",\"MetricsCollection[]\":\"object\",\"MetricsCollection[].Metrics\":\"array\",\"MixedInstancesPolicy\":\"object\",\"MixedInstancesPolicy.InstancesDistribution\":\"object\",\"MixedInstancesPolicy.InstancesDistribution.DistributionSegments\":\"array\",\"MixedInstancesPolicy.InstancesDistribution.DistributionSegments[]\":\"object\",\"MixedInstancesPolicy.InstancesDistribution.DistributionSegments[].TargetCapacityTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.LaunchTemplateSpecification\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[]\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorCount\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorManufacturers\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorNames\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorTotalMemoryMiB\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AllowedInstanceTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselineEbsBandwidthMbps\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors.Cpu\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors.Cpu.References\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors.Cpu.References[]\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.CpuManufacturers\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.ExcludedInstanceTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.InstanceGenerations\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.LocalStorageTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.MemoryGiBPerVCpu\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.MemoryMiB\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.NetworkBandwidthGbps\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.NetworkInterfaceCount\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.TotalLocalStorageGB\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.VCpuCount\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].LaunchTemplateSpecification\":\"object\",\"NotificationConfiguration\":\"object\",\"NotificationConfiguration.NotificationTypes\":\"array\",\"NotificationConfigurations\":\"array\",\"NotificationConfigurations[]\":\"object\",\"NotificationConfigurations[].NotificationTypes\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"TargetGroupARNs\":\"array\",\"TerminationPolicies\":\"array\",\"TrafficSources\":\"array\",\"TrafficSources[]\":\"object\",\"VPCZoneIdentifier\":\"array\"}"],
-	["AWS::BedrockAgentCore::Evaluator", "{\"EvaluatorConfig\":\"object\",\"EvaluatorConfig.CodeBased\":\"object\",\"EvaluatorConfig.CodeBased.LambdaConfig\":\"object\",\"EvaluatorConfig.Derived\":\"object\",\"EvaluatorConfig.Derived.ModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.AdditionalModelRequestFields\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig.StopSequences\":\"array\",\"EvaluatorConfig.Derived.ModelConfig.ResponsesEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.ResponsesEvaluatorModelConfig.Reasoning\":\"object\",\"EvaluatorConfig.LlmAsAJudge\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.AdditionalModelRequestFields\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig.StopSequences\":\"array\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig.Reasoning\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical[]\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
+	["AWS::BedrockAgentCore::Evaluator", "{\"EvaluatorConfig\":\"object\",\"EvaluatorConfig.CodeBased\":\"object\",\"EvaluatorConfig.CodeBased.LambdaConfig\":\"object\",\"EvaluatorConfig.Derived\":\"object\",\"EvaluatorConfig.Derived.ModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.AdditionalModelRequestFields\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig.StopSequences\":\"array\",\"EvaluatorConfig.Derived.ModelConfig.ResponsesEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.ResponsesEvaluatorModelConfig.Reasoning\":\"object\",\"EvaluatorConfig.LlmAsAJudge\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.AdditionalModelRequestFields\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig.StopSequences\":\"array\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig.Reasoning\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical[]\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.MultiDimensional\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.MultiDimensional[]\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.MultiDimensional[].DimensionRatingScale\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.MultiDimensional[].DimensionRatingScale.Categorical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.MultiDimensional[].DimensionRatingScale.Categorical[]\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.MultiDimensional[].DimensionRatingScale.Numerical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.MultiDimensional[].DimensionRatingScale.Numerical[]\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::BedrockAgentCore::Runtime", "{\"AgentRuntimeArtifact\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration.Code\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration.Code.S3\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration.EntryPoint\":\"array\",\"AgentRuntimeArtifact.ContainerConfiguration\":\"object\",\"AuthorizerConfiguration\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedAudience\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedClients\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedScopes\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.HostingEnvironments\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.HostingEnvironments[]\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.WorkloadIdentities\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[]\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[].AuthorizingClaimMatchValue\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[].AuthorizingClaimMatchValue.ClaimMatchValue\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[].AuthorizingClaimMatchValue.ClaimMatchValue.MatchValueStringList\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource.SecurityGroupIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource.SubnetIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource.Tags\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.SelfManagedLatticeResource\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[]\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource.SecurityGroupIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource.SubnetIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource.Tags\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.SelfManagedLatticeResource\":\"object\",\"CapacityProviderConfiguration\":\"object\",\"EnvironmentVariables\":\"object\",\"FilesystemConfigurations\":\"array\",\"FilesystemConfigurations[]\":\"object\",\"FilesystemConfigurations[].CapacityProviderVolume\":\"object\",\"FilesystemConfigurations[].EfsAccessPoint\":\"object\",\"FilesystemConfigurations[].S3FilesAccessPoint\":\"object\",\"FilesystemConfigurations[].SessionStorage\":\"object\",\"LifecycleConfiguration\":\"object\",\"NetworkConfiguration\":\"object\",\"NetworkConfiguration.NetworkModeConfig\":\"object\",\"NetworkConfiguration.NetworkModeConfig.SecurityGroups\":\"array\",\"NetworkConfiguration.NetworkModeConfig.Subnets\":\"array\",\"RequestHeaderConfiguration\":\"object\",\"RequestHeaderConfiguration.RequestHeaderAllowlist\":\"array\",\"Tags\":\"object\",\"WorkloadIdentityDetails\":\"object\"}"],
 	["AWS::Budgets::Budget", "{\"Budget\":\"object\",\"Budget.AutoAdjustData\":\"object\",\"Budget.AutoAdjustData.HistoricalOptions\":\"object\",\"Budget.BudgetLimit\":\"object\",\"Budget.CostFilters\":\"object\",\"Budget.CostTypes\":\"object\",\"Budget.FilterExpression\":\"object\",\"Budget.FilterExpression.And\":\"array\",\"Budget.FilterExpression.CostCategories\":\"object\",\"Budget.FilterExpression.CostCategories.MatchOptions\":\"array\",\"Budget.FilterExpression.CostCategories.Values\":\"array\",\"Budget.FilterExpression.Dimensions\":\"object\",\"Budget.FilterExpression.Dimensions.MatchOptions\":\"array\",\"Budget.FilterExpression.Dimensions.Values\":\"array\",\"Budget.FilterExpression.Or\":\"array\",\"Budget.FilterExpression.Tags\":\"object\",\"Budget.FilterExpression.Tags.MatchOptions\":\"array\",\"Budget.FilterExpression.Tags.Values\":\"array\",\"Budget.Metrics\":\"array\",\"Budget.PlannedBudgetLimits\":\"object\",\"Budget.TimePeriod\":\"object\",\"NotificationsWithSubscribers\":\"array\",\"NotificationsWithSubscribers[]\":\"object\",\"NotificationsWithSubscribers[].Notification\":\"object\",\"NotificationsWithSubscribers[].Subscribers\":\"array\",\"NotificationsWithSubscribers[].Subscribers[]\":\"object\",\"ResourceTags\":\"array\",\"ResourceTags[]\":\"object\"}"],
 	["AWS::CertificateManager::Certificate", "{\"DomainValidationOptions\":\"array\",\"DomainValidationOptions[]\":\"object\",\"SubjectAlternativeNames\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
@@ -30903,7 +31102,7 @@ const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::CloudFront::Distribution", "{\"DistributionConfig\":\"object\",\"DistributionConfig.Aliases\":\"array\",\"DistributionConfig.CNAMEs\":\"array\",\"DistributionConfig.CacheBehaviors\":\"array\",\"DistributionConfig.CacheBehaviors[]\":\"object\",\"DistributionConfig.CacheBehaviors[].AllowedMethods\":\"array\",\"DistributionConfig.CacheBehaviors[].CachedMethods\":\"array\",\"DistributionConfig.CacheBehaviors[].ForwardedValues\":\"object\",\"DistributionConfig.CacheBehaviors[].ForwardedValues.Cookies\":\"object\",\"DistributionConfig.CacheBehaviors[].ForwardedValues.Cookies.WhitelistedNames\":\"array\",\"DistributionConfig.CacheBehaviors[].ForwardedValues.Headers\":\"array\",\"DistributionConfig.CacheBehaviors[].ForwardedValues.QueryStringCacheKeys\":\"array\",\"DistributionConfig.CacheBehaviors[].FunctionAssociations\":\"array\",\"DistributionConfig.CacheBehaviors[].FunctionAssociations[]\":\"object\",\"DistributionConfig.CacheBehaviors[].GrpcConfig\":\"object\",\"DistributionConfig.CacheBehaviors[].LambdaFunctionAssociations\":\"array\",\"DistributionConfig.CacheBehaviors[].LambdaFunctionAssociations[]\":\"object\",\"DistributionConfig.CacheBehaviors[].TrustedKeyGroups\":\"array\",\"DistributionConfig.CacheBehaviors[].TrustedSigners\":\"array\",\"DistributionConfig.CacheTagConfig\":\"object\",\"DistributionConfig.ConnectionFunctionAssociation\":\"object\",\"DistributionConfig.CustomErrorResponses\":\"array\",\"DistributionConfig.CustomErrorResponses[]\":\"object\",\"DistributionConfig.CustomOrigin\":\"object\",\"DistributionConfig.CustomOrigin.OriginSSLProtocols\":\"array\",\"DistributionConfig.DefaultCacheBehavior\":\"object\",\"DistributionConfig.DefaultCacheBehavior.AllowedMethods\":\"array\",\"DistributionConfig.DefaultCacheBehavior.CachedMethods\":\"array\",\"DistributionConfig.DefaultCacheBehavior.ForwardedValues\":\"object\",\"DistributionConfig.DefaultCacheBehavior.ForwardedValues.Cookies\":\"object\",\"DistributionConfig.DefaultCacheBehavior.ForwardedValues.Cookies.WhitelistedNames\":\"array\",\"DistributionConfig.DefaultCacheBehavior.ForwardedValues.Headers\":\"array\",\"DistributionConfig.DefaultCacheBehavior.ForwardedValues.QueryStringCacheKeys\":\"array\",\"DistributionConfig.DefaultCacheBehavior.FunctionAssociations\":\"array\",\"DistributionConfig.DefaultCacheBehavior.FunctionAssociations[]\":\"object\",\"DistributionConfig.DefaultCacheBehavior.GrpcConfig\":\"object\",\"DistributionConfig.DefaultCacheBehavior.LambdaFunctionAssociations\":\"array\",\"DistributionConfig.DefaultCacheBehavior.LambdaFunctionAssociations[]\":\"object\",\"DistributionConfig.DefaultCacheBehavior.TrustedKeyGroups\":\"array\",\"DistributionConfig.DefaultCacheBehavior.TrustedSigners\":\"array\",\"DistributionConfig.Logging\":\"object\",\"DistributionConfig.OriginGroups\":\"object\",\"DistributionConfig.OriginGroups.Items\":\"array\",\"DistributionConfig.OriginGroups.Items[]\":\"object\",\"DistributionConfig.OriginGroups.Items[].FailoverCriteria\":\"object\",\"DistributionConfig.OriginGroups.Items[].FailoverCriteria.StatusCodes\":\"object\",\"DistributionConfig.OriginGroups.Items[].FailoverCriteria.StatusCodes.Items\":\"array\",\"DistributionConfig.OriginGroups.Items[].Members\":\"object\",\"DistributionConfig.OriginGroups.Items[].Members.Items\":\"array\",\"DistributionConfig.OriginGroups.Items[].Members.Items[]\":\"object\",\"DistributionConfig.Origins\":\"array\",\"DistributionConfig.Origins[]\":\"object\",\"DistributionConfig.Origins[].CustomOriginConfig\":\"object\",\"DistributionConfig.Origins[].CustomOriginConfig.OriginMtlsConfig\":\"object\",\"DistributionConfig.Origins[].CustomOriginConfig.OriginSSLProtocols\":\"array\",\"DistributionConfig.Origins[].OriginCustomHeaders\":\"array\",\"DistributionConfig.Origins[].OriginCustomHeaders[]\":\"object\",\"DistributionConfig.Origins[].OriginShield\":\"object\",\"DistributionConfig.Origins[].S3OriginConfig\":\"object\",\"DistributionConfig.Origins[].VpcOriginConfig\":\"object\",\"DistributionConfig.Restrictions\":\"object\",\"DistributionConfig.Restrictions.GeoRestriction\":\"object\",\"DistributionConfig.Restrictions.GeoRestriction.Locations\":\"array\",\"DistributionConfig.S3Origin\":\"object\",\"DistributionConfig.TenantConfig\":\"object\",\"DistributionConfig.TenantConfig.ParameterDefinitions\":\"array\",\"DistributionConfig.TenantConfig.ParameterDefinitions[]\":\"object\",\"DistributionConfig.TenantConfig.ParameterDefinitions[].Definition\":\"object\",\"DistributionConfig.TenantConfig.ParameterDefinitions[].Definition.StringSchema\":\"object\",\"DistributionConfig.ViewerCertificate\":\"object\",\"DistributionConfig.ViewerMtlsConfig\":\"object\",\"DistributionConfig.ViewerMtlsConfig.TrustStoreConfig\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::CloudFront::OriginAccessControl", "{\"OriginAccessControlConfig\":\"object\"}"],
 	["AWS::CloudTrail::Trail", "{\"AdvancedEventSelectors\":\"array\",\"AdvancedEventSelectors[]\":\"object\",\"AdvancedEventSelectors[].FieldSelectors\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[]\":\"object\",\"AdvancedEventSelectors[].FieldSelectors[].EndsWith\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].Equals\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].NotEndsWith\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].NotEquals\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].NotStartsWith\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].StartsWith\":\"array\",\"AggregationConfigurations\":\"array\",\"AggregationConfigurations[]\":\"object\",\"AggregationConfigurations[].Templates\":\"array\",\"EventSelectors\":\"array\",\"EventSelectors[]\":\"object\",\"EventSelectors[].DataResources\":\"array\",\"EventSelectors[].DataResources[]\":\"object\",\"EventSelectors[].DataResources[].Values\":\"array\",\"EventSelectors[].ExcludeManagementEventSources\":\"array\",\"InsightSelectors\":\"array\",\"InsightSelectors[]\":\"object\",\"InsightSelectors[].EventCategories\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
-	["AWS::CloudWatch::Alarm", "{\"AlarmActions\":\"array\",\"Dimensions\":\"array\",\"Dimensions[]\":\"object\",\"EvaluationCriteria\":\"object\",\"EvaluationCriteria.PromQLCriteria\":\"object\",\"EvaluationWindow\":\"object\",\"EvaluationWindow.SlidingWindow\":\"object\",\"EvaluationWindow.WallClockWindow\":\"object\",\"InsufficientDataActions\":\"array\",\"Metrics\":\"array\",\"Metrics[]\":\"object\",\"Metrics[].MetricStat\":\"object\",\"Metrics[].MetricStat.Metric\":\"object\",\"Metrics[].MetricStat.Metric.Dimensions\":\"array\",\"Metrics[].MetricStat.Metric.Dimensions[]\":\"object\",\"OKActions\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"WarmUpConfiguration\":\"object\"}"],
+	["AWS::CloudWatch::Alarm", "{\"ActionConfiguration\":\"object\",\"ActionConfiguration.AlarmTagsPropagation\":\"object\",\"ActionConfiguration.AlarmTagsPropagation.ExcludedTagKeys\":\"array\",\"ActionConfiguration.AlarmTagsPropagation.IncludedTagKeys\":\"array\",\"AlarmActions\":\"array\",\"Dimensions\":\"array\",\"Dimensions[]\":\"object\",\"EvaluationCriteria\":\"object\",\"EvaluationCriteria.PromQLCriteria\":\"object\",\"EvaluationWindow\":\"object\",\"EvaluationWindow.SlidingWindow\":\"object\",\"EvaluationWindow.WallClockWindow\":\"object\",\"InsufficientDataActions\":\"array\",\"Metrics\":\"array\",\"Metrics[]\":\"object\",\"Metrics[].MetricStat\":\"object\",\"Metrics[].MetricStat.Metric\":\"object\",\"Metrics[].MetricStat.Metric.Dimensions\":\"array\",\"Metrics[].MetricStat.Metric.Dimensions[]\":\"object\",\"OKActions\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"WarmUpConfiguration\":\"object\"}"],
 	["AWS::CodeCommit::Repository", "{\"Code\":\"object\",\"Code.S3\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"Triggers\":\"array\",\"Triggers[]\":\"object\",\"Triggers[].Branches\":\"array\",\"Triggers[].Events\":\"array\"}"],
 	["AWS::Cognito::UserPool", "{\"AccountRecoverySetting\":\"object\",\"AccountRecoverySetting.RecoveryMechanisms\":\"array\",\"AccountRecoverySetting.RecoveryMechanisms[]\":\"object\",\"AdminCreateUserConfig\":\"object\",\"AdminCreateUserConfig.InviteMessageTemplate\":\"object\",\"AliasAttributes\":\"array\",\"AutoVerifiedAttributes\":\"array\",\"DeviceConfiguration\":\"object\",\"EmailConfiguration\":\"object\",\"EnabledMfas\":\"array\",\"IssuerConfiguration\":\"object\",\"KeyConfiguration\":\"object\",\"LambdaConfig\":\"object\",\"LambdaConfig.CustomEmailSender\":\"object\",\"LambdaConfig.CustomSMSSender\":\"object\",\"LambdaConfig.InboundFederation\":\"object\",\"LambdaConfig.PreTokenGenerationConfig\":\"object\",\"Policies\":\"object\",\"Policies.PasswordPolicy\":\"object\",\"Policies.SignInPolicy\":\"object\",\"Policies.SignInPolicy.AllowedFirstAuthFactors\":\"array\",\"Schema\":\"array\",\"Schema[]\":\"object\",\"Schema[].NumberAttributeConstraints\":\"object\",\"Schema[].StringAttributeConstraints\":\"object\",\"SmsConfiguration\":\"object\",\"SmsConfiguration.EumsSms\":\"object\",\"UserAttributeUpdateSettings\":\"object\",\"UserAttributeUpdateSettings.AttributesRequireVerificationBeforeUpdate\":\"array\",\"UserPoolAddOns\":\"object\",\"UserPoolAddOns.AdvancedSecurityAdditionalFlows\":\"object\",\"UserPoolTags\":\"object\",\"UsernameAttributes\":\"array\",\"UsernameConfiguration\":\"object\",\"VerificationMessageTemplate\":\"object\"}"],
 	["AWS::DLM::LifecyclePolicy", "{\"CrossRegionCopyTargets\":\"array\",\"CrossRegionCopyTargets[]\":\"object\",\"Exclusions\":\"object\",\"Exclusions.ExcludeTags\":\"array\",\"Exclusions.ExcludeTags[]\":\"object\",\"Exclusions.ExcludeVolumeTypes\":\"array\",\"PolicyDetails\":\"object\",\"PolicyDetails.Actions\":\"array\",\"PolicyDetails.Actions[]\":\"object\",\"PolicyDetails.Actions[].CrossRegionCopy\":\"array\",\"PolicyDetails.Actions[].CrossRegionCopy[]\":\"object\",\"PolicyDetails.Actions[].CrossRegionCopy[].EncryptionConfiguration\":\"object\",\"PolicyDetails.Actions[].CrossRegionCopy[].RetainRule\":\"object\",\"PolicyDetails.CrossRegionCopyTargets\":\"array\",\"PolicyDetails.CrossRegionCopyTargets[]\":\"object\",\"PolicyDetails.EventSource\":\"object\",\"PolicyDetails.EventSource.Parameters\":\"object\",\"PolicyDetails.EventSource.Parameters.SnapshotOwner\":\"array\",\"PolicyDetails.Exclusions\":\"object\",\"PolicyDetails.Exclusions.ExcludeTags\":\"array\",\"PolicyDetails.Exclusions.ExcludeTags[]\":\"object\",\"PolicyDetails.Exclusions.ExcludeVolumeTypes\":\"array\",\"PolicyDetails.Parameters\":\"object\",\"PolicyDetails.Parameters.ExcludeDataVolumeTags\":\"array\",\"PolicyDetails.Parameters.ExcludeDataVolumeTags[]\":\"object\",\"PolicyDetails.ResourceLocations\":\"array\",\"PolicyDetails.ResourceTypes\":\"array\",\"PolicyDetails.Schedules\":\"array\",\"PolicyDetails.Schedules[]\":\"object\",\"PolicyDetails.Schedules[].ArchiveRule\":\"object\",\"PolicyDetails.Schedules[].ArchiveRule.RetainRule\":\"object\",\"PolicyDetails.Schedules[].ArchiveRule.RetainRule.RetentionArchiveTier\":\"object\",\"PolicyDetails.Schedules[].CreateRule\":\"object\",\"PolicyDetails.Schedules[].CreateRule.Scripts\":\"array\",\"PolicyDetails.Schedules[].CreateRule.Scripts[]\":\"object\",\"PolicyDetails.Schedules[].CreateRule.Scripts[].Stages\":\"array\",\"PolicyDetails.Schedules[].CreateRule.Times\":\"array\",\"PolicyDetails.Schedules[].CrossRegionCopyRules\":\"array\",\"PolicyDetails.Schedules[].CrossRegionCopyRules[]\":\"object\",\"PolicyDetails.Schedules[].CrossRegionCopyRules[].DeprecateRule\":\"object\",\"PolicyDetails.Schedules[].CrossRegionCopyRules[].RetainRule\":\"object\",\"PolicyDetails.Schedules[].DeprecateRule\":\"object\",\"PolicyDetails.Schedules[].FastRestoreRule\":\"object\",\"PolicyDetails.Schedules[].FastRestoreRule.AvailabilityZoneIds\":\"array\",\"PolicyDetails.Schedules[].FastRestoreRule.AvailabilityZones\":\"array\",\"PolicyDetails.Schedules[].RetainRule\":\"object\",\"PolicyDetails.Schedules[].ShareRules\":\"array\",\"PolicyDetails.Schedules[].ShareRules[]\":\"object\",\"PolicyDetails.Schedules[].ShareRules[].TargetAccounts\":\"array\",\"PolicyDetails.Schedules[].TagsToAdd\":\"array\",\"PolicyDetails.Schedules[].TagsToAdd[]\":\"object\",\"PolicyDetails.Schedules[].VariableTags\":\"array\",\"PolicyDetails.Schedules[].VariableTags[]\":\"object\",\"PolicyDetails.TargetTags\":\"array\",\"PolicyDetails.TargetTags[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
@@ -32023,96 +32222,103 @@ function deepEqualValue(a, b) {
 
 //#endregion
 //#region src/deployment/deploy-engine/provenance-capture.ts
-function kickOffProvenanceCapture(args) {
-	const { noChange, resources, template } = args;
-	let chain = Promise.resolve();
-	for (const logicalId of noChange) {
-		const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
-		if (record === void 0 || hasReferenceProvenanceField(record)) continue;
-		const tokens = recordReferenceTokens(record);
-		if (tokens.size === 0) continue;
-		const properties = (Object.hasOwn(template.Resources, logicalId) ? template.Resources[logicalId] : void 0)?.Properties ?? {};
-		const task = chain.then(() => captureOne(this, logicalId, record, tokens, properties, args)).catch(() => ({
-			record,
-			field: void 0
-		}));
-		chain = task;
-		this.provenanceCaptureTasks.set(logicalId, task);
-	}
-}
-function warnUnattributed(engine, logicalId) {
-	engine.logger.warn(safeMsg`Could not record where the secret reference(s) in ${logicalId} were resolved (state schema v12 migration). cdkd keeps its previous handling of them; update ${logicalId} to record it.`);
-}
-async function captureOne(engine, logicalId, record, tokens, properties, args) {
-	const bag = /* @__PURE__ */ new Map();
-	const { attributeHealer: _healer, ...base } = engine.buildResolverContext({
-		template: args.template,
-		resources: { ...args.resources },
-		...args.parameters && { parameters: args.parameters },
-		...args.conditions && { conditions: args.conditions }
-	}, args.stackName);
-	const { producerSecrets: _producer, ...withoutRecorders } = base;
-	const context = {
-		...withoutRecorders,
-		recordedSecretValues: bag,
-		recordedImports: [],
-		recordedOutputReads: [],
-		staleAttributeHeal: { phase: "probe" },
-		printingSecrets: /* @__PURE__ */ new Map(),
-		provenanceCapture: true
-	};
-	const stored = record.properties ?? {};
-	for (const [key, value] of Object.entries(properties)) {
-		if (!Object.hasOwn(stored, key) || recordReferenceTokens({ properties: stored[key] }).size === 0) continue;
-		try {
-			await engine.resolver.resolve(structuredClone(value), context);
-		} catch (error) {
-			if (isThrottlingError(error)) return {
+var ProvenanceCapture = class {
+	tasks = /* @__PURE__ */ new Map();
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	kickOffProvenanceCapture(args) {
+		const { noChange, resources, template } = args;
+		let chain = Promise.resolve();
+		for (const logicalId of noChange) {
+			const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+			if (record === void 0 || hasReferenceProvenanceField(record)) continue;
+			const tokens = recordReferenceTokens(record);
+			if (tokens.size === 0) continue;
+			const properties = (Object.hasOwn(template.Resources, logicalId) ? template.Resources[logicalId] : void 0)?.Properties ?? {};
+			const task = chain.then(() => this.captureOne(logicalId, record, tokens, properties, args)).catch(() => ({
 				record,
 				field: void 0
-			};
+			}));
+			chain = task;
+			this.tasks.set(logicalId, task);
 		}
 	}
-	const physicalId = typeof record.physicalId === "string" ? record.physicalId.toLowerCase() : "";
-	const field = {};
-	let unattributed = false;
-	for (const token of [...tokens].sort()) {
-		const pass = passProvenanceFor(bag, token);
-		const plaintext = resolvedPlaintextOf(bag, token);
-		const named = plaintext !== void 0 && plaintext.length >= 4 && physicalId.includes(plaintext.toLowerCase());
-		const entry = validateReferenceProvenance(token, {
-			...pass?.region !== void 0 && { region: pass.region },
-			...named && pass?.versions !== void 0 && { versions: pass.versions }
-		}) ?? {};
-		if (entry.region === void 0 && entry.versions === void 0) unattributed = true;
-		field[token] = entry;
-	}
-	if (unattributed) warnUnattributed(engine, logicalId);
-	return {
-		record,
-		field
-	};
-}
-async function drainProvenanceCaptures(stateResources) {
-	if (this.provenanceCaptureTasks.size === 0) return 0;
-	const entries = [...this.provenanceCaptureTasks.entries()];
-	this.provenanceCaptureTasks.clear();
-	const outcomes = await Promise.all(entries.map(([, task]) => task));
-	let installed = 0;
-	for (let i = 0; i < entries.length; i++) {
-		const logicalId = entries[i][0];
-		const { record, field } = outcomes[i];
-		if (field === void 0) continue;
-		const target = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
-		if (target === void 0 || target.physicalId !== record.physicalId || target.resourceType !== record.resourceType) continue;
-		stateResources[logicalId] = {
-			...target,
-			referenceProvenance: field
+	warnUnattributed(logicalId) {
+		this.deps.logger.warn(safeMsg`Could not record where the secret reference(s) in ${logicalId} were resolved (state schema v12 migration). cdkd keeps its previous handling of them; update ${logicalId} to record it.`);
+	}
+	async captureOne(logicalId, record, tokens, properties, args) {
+		const bag = /* @__PURE__ */ new Map();
+		const { attributeHealer: _healer, ...base } = this.deps.buildResolverContext({
+			template: args.template,
+			resources: { ...args.resources },
+			...args.parameters && { parameters: args.parameters },
+			...args.conditions && { conditions: args.conditions }
+		}, args.stackName);
+		const { producerSecrets: _producer, ...withoutRecorders } = base;
+		const context = {
+			...withoutRecorders,
+			recordedSecretValues: bag,
+			recordedImports: [],
+			recordedOutputReads: [],
+			staleAttributeHeal: { phase: "probe" },
+			printingSecrets: /* @__PURE__ */ new Map(),
+			provenanceCapture: true
+		};
+		const stored = record.properties ?? {};
+		for (const [key, value] of Object.entries(properties)) {
+			if (!Object.hasOwn(stored, key) || recordReferenceTokens({ properties: stored[key] }).size === 0) continue;
+			try {
+				await this.deps.resolver.resolve(structuredClone(value), context);
+			} catch (error) {
+				if (isThrottlingError(error)) return {
+					record,
+					field: void 0
+				};
+			}
+		}
+		const physicalId = typeof record.physicalId === "string" ? record.physicalId.toLowerCase() : "";
+		const field = {};
+		let unattributed = false;
+		for (const token of [...tokens].sort()) {
+			const pass = passProvenanceFor(bag, token);
+			const plaintext = resolvedPlaintextOf(bag, token);
+			const named = plaintext !== void 0 && plaintext.length >= 4 && physicalId.includes(plaintext.toLowerCase());
+			const entry = validateReferenceProvenance(token, {
+				...pass?.region !== void 0 && { region: pass.region },
+				...named && pass?.versions !== void 0 && { versions: pass.versions }
+			}) ?? {};
+			if (entry.region === void 0 && entry.versions === void 0) unattributed = true;
+			field[token] = entry;
+		}
+		if (unattributed) this.warnUnattributed(logicalId);
+		return {
+			record,
+			field
 		};
-		installed++;
 	}
-	return installed;
-}
+	async drainProvenanceCaptures(stateResources) {
+		if (this.tasks.size === 0) return 0;
+		const entries = [...this.tasks.entries()];
+		this.tasks.clear();
+		const outcomes = await Promise.all(entries.map(([, task]) => task));
+		let installed = 0;
+		for (let i = 0; i < entries.length; i++) {
+			const logicalId = entries[i][0];
+			const { record, field } = outcomes[i];
+			if (field === void 0) continue;
+			const target = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+			if (target === void 0 || target.physicalId !== record.physicalId || target.resourceType !== record.resourceType) continue;
+			stateResources[logicalId] = {
+				...target,
+				referenceProvenance: field
+			};
+			installed++;
+		}
+		return installed;
+	}
+};
 function provenanceBaselineOf(state, tokenFree) {
 	return {
 		outputs: state.outputs,
@@ -32963,8 +33169,32 @@ function secretNameNeedlesOf(logicalId, record, secrets, options) {
 		for (const needle of printingCorpusOf(embeddedBag).keys()) if (needle !== "" && (needle === physicalId || needle.length >= 4 && physicalId.includes(needle))) add(needle);
 	}
 	if (physicalId !== void 0) for (const spelling of finalSnapshotSpellingsOf(physicalId, record?.resourceType, needles)) add(spelling);
+	for (const leaf of secretNamedAttributeLeavesOf(record)) add(leaf);
 	return needles.size > 0 ? needles : void 0;
 }
+function secretNamedAttributeLeavesOf(record) {
+	if (record?.resourceType !== "AWS::CloudFormation::Stack") return [];
+	const names = record.secretNamedAttributes;
+	const attributes = record.attributes;
+	if (!Array.isArray(names) || attributes === null || typeof attributes !== "object") return [];
+	const leaves = [];
+	for (const name of names) {
+		if (typeof name !== "string" || !Object.hasOwn(attributes, name)) continue;
+		for (const leaf of wholeStringLeavesOf(attributes[name])) if (leaf !== "" && leaf !== "***" && !leaf.includes("{{resolve:")) leaves.push(leaf);
+	}
+	return leaves;
+}
+function secretNamedAttributeNamesOf(attributes, childResources, secrets) {
+	const needles = [...printingCorpusOf(secretNamedRecordNeedles(childResources, secrets)).keys()];
+	if (needles.length === 0) return [];
+	const names = [];
+	for (const [name, value] of Object.entries(attributes)) {
+		const leaves = [...wholeStringLeavesOf(value)].filter((leaf) => leaf !== "");
+		if (leaves.length === 0) continue;
+		if (needles.some((needle) => leavesHoldNeedle(leaves, needle))) names.push(name);
+	}
+	return names.sort();
+}
 function finalSnapshotSpellingsOf(physicalId, resourceType, needles) {
 	if (typeof resourceType !== "string" || !(ATOMIC_FINAL_SNAPSHOT_TYPES.has(resourceType) || PRE_DELETE_SNAPSHOT_TYPES.has(resourceType))) return [];
 	const { prefix, sanitized, kept } = finalSnapshotNameCut(physicalId, resourceType);
@@ -32980,6 +33210,20 @@ function finalSnapshotSpellingsOf(physicalId, resourceType, needles) {
 	}
 	return spellings;
 }
+function namingBagOf(secrets, logicalId) {
+	const bag = typeof secrets === "function" ? secrets(logicalId) : secrets;
+	return bag !== void 0 && hasMaskableValues(bag) ? bag : void 0;
+}
+function namingSecretsWithRecordedNoEcho(base, recorded) {
+	const memo = /* @__PURE__ */ new Map();
+	return (logicalId) => {
+		if (memo.has(logicalId)) return memo.get(logicalId);
+		const own = recorded(logicalId);
+		const bag = own === void 0 || !hasMaskableValues(own) ? base : unionOfSecretBags([base, own]);
+		memo.set(logicalId, bag);
+		return bag;
+	};
+}
 function secretNamesReadBy(logicalId, record, resources, judge = () => ({
 	secrets: void 0,
 	embedded: void 0
@@ -33000,7 +33244,7 @@ function leavesHoldNeedle(leaves, needle) {
 	return leaves.some((leaf) => leaf === needle || needle.length >= 4 && leaf.includes(needle));
 }
 function stateSecretNameNeedles(resources, secrets) {
-	return (logicalId) => secretNameNeedlesOf(logicalId, Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0, secrets, { embedded: void 0 });
+	return (logicalId) => secretNameNeedlesOf(logicalId, Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0, namingBagOf(secrets, logicalId), { embedded: void 0 });
 }
 function storedRecordNameNeedles(logicalId, record, secrets) {
 	const needles = secretNameNeedlesOf(logicalId, record, secrets, { embedded: void 0 });
@@ -33017,7 +33261,7 @@ function storedRecordNameNeedles(logicalId, record, secrets) {
 function storedSecretNameNeedles(resources, secrets, bag = /* @__PURE__ */ new Map(), outputs) {
 	const named = [];
 	for (const [logicalId, record] of Object.entries(resources)) {
-		const needles = storedRecordNameNeedles(logicalId, record, secrets);
+		const needles = storedRecordNameNeedles(logicalId, record, namingBagOf(secrets, logicalId));
 		if (needles !== void 0) named.push([logicalId, needles]);
 	}
 	if (named.length === 0) return bag;
@@ -33038,19 +33282,18 @@ function secretNamesStoredIn(record, needles) {
 	return [...needles].filter((needle) => leavesHoldNeedle(leaves, needle));
 }
 function secretNamedRecordNeedles(resources, secrets, bag = /* @__PURE__ */ new Map()) {
-	for (const [logicalId, record] of Object.entries(resources)) for (const needle of storedRecordNameNeedles(logicalId, record, secrets) ?? []) recordLogOnlyValue(bag, needle);
+	for (const [logicalId, record] of Object.entries(resources)) for (const needle of storedRecordNameNeedles(logicalId, record, namingBagOf(secrets, logicalId)) ?? []) recordLogOnlyValue(bag, needle);
 	return bag;
 }
 function secretNamePrintingBag(logicalId, resources) {
 	return secretNamePrintingBags(resources, void 0)(logicalId);
 }
 function secretNamePrintingBags(resources, noEchoValues) {
-	const secrets = noEchoValues !== void 0 && hasMaskableValues(noEchoValues) ? noEchoValues : void 0;
 	const judged = /* @__PURE__ */ new Map();
 	const needlesOf = (logicalId, record) => {
 		const hit = judged.get(logicalId);
 		if (hit !== void 0 && hit.record === record) return hit.needles;
-		const needles = secretNameNeedlesOf(logicalId, record, secrets, { embedded: void 0 });
+		const needles = secretNameNeedlesOf(logicalId, record, namingBagOf(noEchoValues, logicalId), { embedded: void 0 });
 		judged.set(logicalId, {
 			record,
 			needles
@@ -33059,6 +33302,7 @@ function secretNamePrintingBags(resources, noEchoValues) {
 	};
 	return (logicalId) => {
 		const bag = /* @__PURE__ */ new Map();
+		const secrets = namingBagOf(noEchoValues, logicalId);
 		if (secrets !== void 0) carryLogOnlyValues(secrets, bag);
 		const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
 		for (const needle of needlesOf(logicalId, record) ?? []) recordLogOnlyValue(bag, needle);
@@ -33159,56 +33403,6 @@ function maskEventTextWithBoundBags(event) {
 const DEFAULT_RESOURCE_WARN_AFTER_MS = 3e5;
 const DEFAULT_RESOURCE_TIMEOUT_MS = 18e5;
 
-//#endregion
-//#region src/deployment/deploy-engine/name-collision.ts
-function replacementNameOrigin(logicalId, physicalId) {
-	if (looksLikeCdkdGeneratedName(physicalId, logicalId, getCurrentStackName())) return {
-		descriptor: `The physical name (${physicalId}) was GENERATED by cdkd from the construct's logical id rather than declared in your template, and that derivation has no random component — so the new resource asks for exactly the name the existing one still holds`,
-		remedy: "Either give the resource an explicit physical name in your CDK code, or rename the CONSTRUCT (its id feeds the generated name — note that this replaces the resource rather than renaming it in place)"
-	};
-	return {
-		descriptor: `The resource has a user-supplied physical name (${physicalId})`,
-		remedy: "Either rename the resource in your CDK code (a fresh name lets the safe create-first order proceed)"
-	};
-}
-function orphanedNameCollisionAdvice(changeType, logicalId, error) {
-	if (changeType !== "CREATE") return void 0;
-	if (!(error instanceof ProvisioningError)) return void 0;
-	const physicalId = error.physicalId;
-	if (!physicalId) return void 0;
-	const replayed = isReplayedNameCollisionFrom(error, logicalId, (link) => isAuxiliaryMarkOf(link, RETRY_AUXILIARY_OWNER));
-	if (!replayed && !isNameCollisionErrorFrom(error, logicalId)) return void 0;
-	const stackName = getCurrentStackName();
-	if (!looksLikeCdkdGeneratedName(physicalId, logicalId, stackName)) return void 0;
-	if (!stackName) return void 0;
-	const safeId = displaySafe(physicalId, { asciiOnly: true });
-	const safeStack = displaySafe(stackName, { asciiOnly: true });
-	const safeLogicalId = displaySafe(logicalId, { asciiOnly: true });
-	const idShown = isInertUnquoted(safeId);
-	const shownId = idShown ? safeId : "a name that cannot be shown safely here";
-	const shownLogicalId = isInertUnquoted(safeLogicalId) ? safeLogicalId : "A resource whose logical id cannot be shown safely here";
-	const diagnosis = replayed ? `${shownLogicalId}: the name AWS reports as taken (${shownId}) is most likely held by a resource THIS create made. An earlier attempt of it ended without a clear verdict (a server error, a dropped connection or a timeout, or a failure after the create call itself may have succeeded), and the retry then found the name taken. A dropped connection can also happen before the request reached AWS, so the holder may be another resource: confirm it is yours before deleting or importing it. cdkd records a resource only once its create succeeds, so this one is in no state file: no rollback or cdkd destroy will remove it, and re-running collides with it again.` : `${shownLogicalId}: the name AWS reports as taken (${shownId}) is one cdkd DERIVED from the logical id, and that derivation has no random component — so this is most likely a resource an earlier cdkd run left behind. A rollback leaves a resource carrying DeletionPolicy: Retain in AWS and drops it from state, as CloudFormation does; what differs is the name. CloudFormation would generate a fresh one for an unnamed resource and redeploy clean, whereas cdkd asks again for the name the orphan still holds — so re-running does not clear this.`;
-	const deleteArm = `If it is not a resource you want to keep, delete ${idShown ? safeId : "it"} in AWS — after confirming it holds nothing you need${replayed ? "" : ", since Retain is what kept it"} — and re-deploy.`;
-	let canImport;
-	try {
-		canImport = typeof this.providerRegistry.getProvider(error.resourceType).import === "function";
-	} catch {
-		canImport = false;
-	}
-	const commandNamesTheRightResource = safeId === physicalId && safeStack === stackName && safeLogicalId === logicalId;
-	const importableTarget = !stackName.includes("~");
-	if (!canImport || !commandNamesTheRightResource || !importableTarget) return `${diagnosis} ${!canImport ? `cdkd cannot adopt ${displaySafe(error.resourceType, { asciiOnly: true })} back into state (its provider implements no import)` : !importableTarget ? `this is a nested-stack child, whose stack name cdkd import cannot resolve` : `cdkd cannot render an import command that provably names this resource`}, so the way forward is to delete it. ${deleteArm}`;
-	const adopt = pasteableCommand("cdkd import", [{
-		value: stackName,
-		hole: "stack"
-	}, {
-		flag: "--resource",
-		value: `${logicalId}=${physicalId}`,
-		hole: "logicalId=physicalId"
-	}]);
-	return `${diagnosis} To recover, adopt it back into state instead of re-creating it, with the command below (a selective import merges into existing state and needs no --force while the resource is absent from it). CONFIRM IT IS YOURS FIRST — a name cdkd derives is predictable, so for a globally-namespaced type it can belong to another account, and the same stack deployed in another region derives the same name. ${deleteArm}${adopt.withheld.length === 0 ? "" : " The command below prints a quoted hole in place of a value cdkd will not name on a command line; replace it whole, quotes included, with your stack name or '<logicalId>=<name>', shell-quoted."}\nAdopt with: ${adopt.command}`;
-}
-
 //#endregion
 //#region src/analyzer/skipped-outputs.ts
 function canonicalJson$1(value) {
@@ -33458,9 +33652,7 @@ function stateKeySecretExposure(key, secrets) {
 	return secretsPresentIn(key, secrets);
 }
 function maskEveryOccurrence(text, exposure) {
-	let out = text;
-	for (const value of Array.from(exposure.keys()).sort((a, b) => b.length - a.length)) out = out.split(value).join("***");
-	return out;
+	return maskMatchSpans(text, Array.from(exposure.keys()).filter((value) => value !== ""), "***");
 }
 
 //#endregion
@@ -33544,6 +33736,18 @@ function exportAliasCollisionScrubWarning(outputKey, exportName, secrets) {
 
 //#endregion
 //#region src/deployment/deploy-engine/outputs.ts
+var OutputsRunState = class {
+	outputSecrets = /* @__PURE__ */ new Map();
+	outputsPassSecretMaps = [];
+	outputsTemplateSource = Object.create(null);
+	resolvedExportNames = [];
+	carriedExportAliasRefusal;
+	skippedOutputs;
+	outputsSourceUsable = true;
+	outputProvenanceSinks = /* @__PURE__ */ new Map();
+	outputsResolvedThisRun = /* @__PURE__ */ new WeakSet();
+	resolvedOutputsBag = void 0;
+};
 var ForwardingSecrets = class extends Map {
 	target;
 	constructor(target) {
@@ -33556,25 +33760,25 @@ var ForwardingSecrets = class extends Map {
 		return this;
 	}
 };
-function handleOutputResolutionFailure(error, outputKey, outputs, secrets, inheritedSecrets) {
+function handleOutputResolutionFailure(deps, error, outputKey, outputs, secrets, inheritedSecrets) {
 	const union = unionOfSecretBags([inheritedSecrets, secrets]);
 	const detail = maskSecretsInText(error instanceof Error ? error.message || error.name : String(error), union);
-	if (this.options.strictGetAtt) {
+	if (deps.options.strictGetAtt) {
 		const cause = typeof error === "string" ? maskSecretsInText(error, union) : maskSecretsInError(error, union);
 		throw new Error(safeMsg`Failed to resolve output ${outputKey} ` + `(--strict-getatt promotes output resolution failures to deploy errors; ` + safeMsg`drop the flag to skip the output instead): ${asIsMessage(detail)}`, cause instanceof Error || typeof cause === "string" ? { cause } : {});
 	}
-	this.logger.warn(safeMsg`Failed to resolve output ${outputKey}: ${asIsMessage(detail)}`);
+	deps.logger.warn(safeMsg`Failed to resolve output ${outputKey}: ${asIsMessage(detail)}`);
 	outputs[outputKey] = void 0;
 }
-async function resolveOutputs(template, resources, stackName, digestSource, parameterValues, conditions) {
-	this.resolvedExportNames = [];
-	this.carriedExportAliasRefusal = void 0;
+async function resolveOutputs(run, deps, template, resources, stackName, digestSource, parameterValues, conditions) {
+	run.resolvedExportNames = [];
+	run.carriedExportAliasRefusal = void 0;
 	if (!template.Outputs) {
-		this.carriedExportAliasRefusal = seedOnlyAliasRefusal(noEchoParameterValueSeed(template.Parameters, parameterValues, this.options.inheritedSecrets, this.options.parameters));
+		run.carriedExportAliasRefusal = seedOnlyAliasRefusal(noEchoParameterValueSeed(template.Parameters, parameterValues, deps.options.inheritedSecrets, deps.options.parameters));
 		return {};
 	}
 	const outputs = Object.create(null);
-	const context = this.buildResolverContext({
+	const context = deps.buildResolverContext({
 		template,
 		resources,
 		...parameterValues && { parameters: parameterValues },
@@ -33589,37 +33793,37 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 	const outputsPassSecrets = context.recordedSecretValues ?? EMPTY_SECRETS;
 	const outputsPassInherited = context.inheritedSecrets ?? EMPTY_SECRETS;
 	if (context.recordedSecretValues) {
-		this.outputsPassSecretMaps.push(context.recordedSecretValues);
-		mirrorInheritedParameterReads(context.recordedSecretValues, this.outputSecrets);
-		if (this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0) inheritNestedStackParameterAssociations(this.outputSecrets, this.options.inheritedSecrets);
+		run.outputsPassSecretMaps.push(context.recordedSecretValues);
+		mirrorInheritedParameterReads(context.recordedSecretValues, run.outputSecrets);
+		if (deps.options.inheritedSecrets && deps.options.inheritedSecrets.size > 0) inheritNestedStackParameterAssociations(run.outputSecrets, deps.options.inheritedSecrets);
 	}
 	const publishedOutputNames = collectPublishedOutputNames(template.Outputs, conditions);
 	let outputsPassCompleted = false;
 	try {
 		for (const [outputKey, output] of Object.entries(template.Outputs)) {
 			if (isOutputSuppressedByCondition(output, conditions)) {
-				this.logger.debug(safeMsg`Skipping output ${outputKey} — condition ${output.Condition} is false`);
+				deps.logger.debug(safeMsg`Skipping output ${outputKey} — condition ${output.Condition} is false`);
 				continue;
 			}
 			const ownReads = [];
 			const provenanceSink = /* @__PURE__ */ new Map();
-			this.outputProvenanceSinks.set(outputKey, provenanceSink);
+			run.outputProvenanceSinks.set(outputKey, provenanceSink);
 			try {
-				const resolved = await this.resolver.resolve(output.Value, {
+				const resolved = await deps.resolver.resolve(output.Value, {
 					...context,
 					redactedAttributeReads: ownReads,
 					provenanceSink
 				});
 				refuseMaskedOutputReads(outputKey, ownReads);
-				if (resolved === void 0 && this.options.strictGetAtt) throw markNonRetryable(/* @__PURE__ */ new Error("the value resolved to nothing"));
+				if (resolved === void 0 && deps.options.strictGetAtt) throw markNonRetryable(/* @__PURE__ */ new Error("the value resolved to nothing"));
 				outputs[outputKey] = resolved;
 			} catch (error) {
-				this.handleOutputResolutionFailure(error, outputKey, outputs, outputsPassSecrets, outputsPassInherited);
+				handleOutputResolutionFailure(deps, error, outputKey, outputs, outputsPassSecrets, outputsPassInherited);
 			}
 		}
-		const noEchoSeed = noEchoParameterValueSeed(template.Parameters, parameterValues, context.inheritedSecrets, this.options.parameters);
-		const noEchoSources = this.noEchoPositionSources(resources, template, conditions);
-		this.carriedExportAliasRefusal = (outputKey, exportName) => {
+		const noEchoSeed = noEchoParameterValueSeed(template.Parameters, parameterValues, context.inheritedSecrets, deps.options.parameters);
+		const noEchoSources = deps.noEchoPositionSources(resources, template, conditions);
+		run.carriedExportAliasRefusal = (outputKey, exportName) => {
 			const verdict = carriedExportAliasExposure(exportName, outputsPassSecrets, noEchoSeed);
 			if (verdict === void 0) return void 0;
 			return secretBearingExportNameWarning(outputKey, exportName, verdict.exposure, context.recordedSecretValues, verdict.noEchoOnly);
@@ -33635,14 +33839,14 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 			const nameReads = [];
 			let exportName;
 			try {
-				exportName = typeof output.Export.Name === "string" ? output.Export.Name : await this.resolver.resolve(output.Export.Name, {
+				exportName = typeof output.Export.Name === "string" ? output.Export.Name : await deps.resolver.resolve(output.Export.Name, {
 					...context,
 					recordedSecretValues: nameSecrets,
 					redactedAttributeReads: nameReads
 				});
 				refuseMaskedOutputReads(outputKey, nameReads);
 			} catch (error) {
-				this.handleOutputResolutionFailure(error, outputKey, outputs, outputsPassSecrets, outputsPassInherited);
+				handleOutputResolutionFailure(deps, error, outputKey, outputs, outputsPassSecrets, outputsPassInherited);
 				continue;
 			}
 			if (typeof exportName !== "string") continue;
@@ -33658,28 +33862,28 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 		for (const { outputKey, exportName, value, outputValue, nameSource, nameSecrets } of resolvedNames) {
 			const noEchoParameters = exportNameNoEchoParameters(nameSource, noEchoSources);
 			const exposure = noEchoParameters.length > 0 ? void 0 : exportNameSecretExposure(exportName, nameSecrets, context.recordedSecretValues, noEchoSeed);
-			if (noEchoParameters.length > 0) this.logger.warn(noEchoParameterExportNameWarning(outputKey, noEchoParameters, outputsPassSecrets));
-			else if (exposure) this.logger.warn(secretBearingExportNameWarning(outputKey, exportName, exposure, context.recordedSecretValues, isNoEchoOnlyExposure(exposure, nameSecrets, context.recordedSecretValues)));
-			else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) this.logger.warn(exportAliasCollisionWarning(outputKey, exportName, outputsPassSecrets));
+			if (noEchoParameters.length > 0) deps.logger.warn(noEchoParameterExportNameWarning(outputKey, noEchoParameters, outputsPassSecrets));
+			else if (exposure) deps.logger.warn(secretBearingExportNameWarning(outputKey, exportName, exposure, context.recordedSecretValues, isNoEchoOnlyExposure(exposure, nameSecrets, context.recordedSecretValues)));
+			else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) deps.logger.warn(exportAliasCollisionWarning(outputKey, exportName, outputsPassSecrets));
 			else {
 				outputs[exportName] = value;
-				const aliasedSink = this.outputProvenanceSinks.get(outputKey);
-				if (aliasedSink !== void 0) this.outputProvenanceSinks.set(exportName, aliasedSink);
-				if (!this.resolvedExportNames.includes(exportName)) this.resolvedExportNames.push(exportName);
-				this.outputsTemplateSource[exportName] = outputValue;
+				const aliasedSink = run.outputProvenanceSinks.get(outputKey);
+				if (aliasedSink !== void 0) run.outputProvenanceSinks.set(exportName, aliasedSink);
+				if (!run.resolvedExportNames.includes(exportName)) run.resolvedExportNames.push(exportName);
+				run.outputsTemplateSource[exportName] = outputValue;
 			}
 		}
 		outputsPassCompleted = true;
 	} finally {
-		if (!outputsPassCompleted) this.outputsSourceUsable = false;
+		if (!outputsPassCompleted) run.outputsSourceUsable = false;
 	}
 	for (const [outputKey, output] of Object.entries(template.Outputs)) {
 		if (!publishedOutputNames.has(outputKey)) continue;
-		this.outputsTemplateSource[outputKey] = output.Value;
+		run.outputsTemplateSource[outputKey] = output.Value;
 	}
-	this.skippedOutputs = collectSkippedOutputs(digestSource, outputs);
-	this.outputsResolvedThisRun.add(outputs);
-	this.resolvedOutputsBag = outputs;
+	run.skippedOutputs = collectSkippedOutputs(digestSource, outputs);
+	run.outputsResolvedThisRun.add(outputs);
+	run.resolvedOutputsBag = outputs;
 	return markSameGenerationBag(outputs);
 }
 function buildDisplayOutputs(template, resolvedOutputs) {
@@ -34739,7 +34943,7 @@ var ReplayPins = class {
 function refuseMaskedReplayBaseline(props, logicalId, inert = []) {
 	if (props === void 0 || !carriesSecretMask(props)) return;
 	if (inert.length > 0 && masksOnlyAt(props, inert)) return;
-	throw new CdkdError(`Cannot roll ${shownLogicalId(logicalId)} back: its recorded baseline holds the redaction mask ('${"***"}'), so cdkd would write that literal to the live resource. There are four ways a baseline comes to hold it. (1) A NoEcho custom-resource value was resolved there: restore the property with 'cdkd deploy' AFTER forcing that custom resource to update (change one of its properties, e.g. a nonce), so its handler runs again and supplies the real value — an ordinary re-deploy leaves the resource unchanged, so the handler does not run and the mask stays. (2) The Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records: restore the property with a 'cdkd deploy' that changes this resource, which sends it the encoded value again — a re-deploy that leaves this resource unchanged sends it nothing. Every rollback to such a baseline refuses, so to end this, stop encoding the secret into the property (have the resource read the secret at run time instead — not by writing the secret's plaintext into the template, which cdkd would then record in state in the clear). (3) The value was SPLICED from a masked record of ANOTHER resource — by 'cdkd orphan --force', or by 'cdkd import' resolving an Fn::GetAtt or a Ref over a value the Cloud Control fallback had masked. Repair the record that HOLDS the mask ('cdkd import <stack> --resource <logicalId>=<physicalId> --force', granting cloudformation:DescribeType first if the import warned that it could not read the schema), then re-run whichever command wrote this property. (4) A NoEcho template parameter's value, which cdkd stores only as the mask: restore the property with 'cdkd deploy', which sends the parameter's value again. See https://github.com/go-to-k/cdkd/issues/2449.`, "ROLLBACK_REDACTED_BASELINE");
+	throw new CdkdError(`Cannot roll ${shownLogicalId(logicalId)} back: its recorded baseline holds the redaction mask ('${"***"}'), so cdkd would write that literal to the live resource. There are five ways a baseline comes to hold it. (1) A NoEcho custom-resource value was resolved there: restore the property with 'cdkd deploy' AFTER forcing that custom resource to update (change one of its properties, e.g. a nonce), so its handler runs again and supplies the real value — an ordinary re-deploy leaves the resource unchanged, so the handler does not run and the mask stays. (2) The Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records: restore the property with a 'cdkd deploy' that changes this resource, which sends it the encoded value again — a re-deploy that leaves this resource unchanged sends it nothing. Every rollback to such a baseline refuses, so to end this, stop encoding the secret into the property (have the resource read the secret at run time instead — not by writing the secret's plaintext into the template, which cdkd would then record in state in the clear). (3) The value was SPLICED from a masked record of ANOTHER resource — by 'cdkd orphan --force', or by 'cdkd import' resolving an Fn::GetAtt or a Ref over a value the Cloud Control fallback had masked. Repair the record that HOLDS the mask ('cdkd import <stack> --resource <logicalId>=<physicalId> --force', granting cloudformation:DescribeType first if the import warned that it could not read the schema), then re-run whichever command wrote this property. (4) A NoEcho template parameter's value, which cdkd stores only as the mask: restore the property with 'cdkd deploy', which sends the parameter's value again. (5) Two secret values cdkd resolved overlap inside the value, so no single {{resolve:...}} reference renders it and cdkd stored the mask rather than part of a secret: restore the property with a 'cdkd deploy' that changes this resource, which sends it the value again. Every rollback to such a baseline refuses while the two values still overlap there, so to end this, change the property (or rotate one of the secrets) so that they no longer overlap. See https://github.com/go-to-k/cdkd/issues/2449.`, "ROLLBACK_REDACTED_BASELINE");
 }
 
 //#endregion
@@ -37388,13 +37592,414 @@ function makeSiblingClaimReader(params) {
 	};
 }
 
+//#endregion
+//#region src/deployment/read-only-attribute-healer.ts
+async function readRecordAttributes(input) {
+	const { provider, logicalId, resource, stackName, region } = input;
+	if (!provider.import) return { kind: "not-attempted" };
+	if (!hasAddressablePhysicalId(resource)) return { kind: "not-attempted" };
+	const found = await provider.import({
+		logicalId,
+		resourceType: resource.resourceType,
+		stackName,
+		region,
+		properties: resource.properties,
+		knownPhysicalId: resource.physicalId
+	});
+	if (found === null) return { kind: "not-found" };
+	if (found.physicalId !== resource.physicalId) throw new Error(`the provider answered for a different resource (${found.physicalId}) than the one asked about (${resource.physicalId})`);
+	const reported = Object.entries(normalizeHealedAttributes(found.attributes));
+	const attributes = Object.fromEntries(reported.filter(([, value]) => !carriesSecretMask(value)));
+	const withheldKeys = reported.filter(([, value]) => carriesSecretMask(value)).map(([key]) => key);
+	return {
+		kind: "read",
+		attributes,
+		...withheldKeys.length > 0 && { withheldKeys }
+	};
+}
+function createReadOnlyAttributeHealerFactory(options) {
+	const logger = getLogger().child("ReadOnlyAttributeHealer");
+	const memo = /* @__PURE__ */ new Map();
+	const readOnce = (stackName, region, logicalId, resource) => {
+		let key;
+		try {
+			if (isHealExcludedType(resource.resourceType)) return Promise.resolve({ kind: "not-attempted" });
+			key = injectiveKey(stackName, region, logicalId, resource.physicalId);
+		} catch (error) {
+			return Promise.resolve({
+				kind: "failed",
+				error
+			});
+		}
+		const inFlight = memo.get(key);
+		if (inFlight) return inFlight;
+		const heal = (async () => options.inRegion(region, () => readRecordAttributes({
+			provider: options.getProvider(resource, region),
+			logicalId,
+			resource,
+			stackName,
+			region
+		})))().then((outcome) => {
+			if (outcome.kind === "read") try {
+				logger.debug(safeMsg`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS for this preview — its state record lacked one a Fn::GetAtt asked for; nothing is written: ${Object.keys(outcome.attributes).length} attribute(s) read`);
+			} catch {}
+			return outcome;
+		}).catch((error) => ({
+			kind: "failed",
+			error
+		}));
+		memo.set(key, heal);
+		return heal;
+	};
+	return (stackName, region) => Object.assign((logicalId, resource) => readOnce(stackName, region, logicalId, resource), { readOnly: true });
+}
+
+//#endregion
+//#region src/deployment/deploy-engine/noecho.ts
+var NoEchoRunState = class {
+	noEchoAttributeResources = /* @__PURE__ */ new Map();
+	persistedNoEchoAttributes = /* @__PURE__ */ new Map();
+	noEchoConditions = void 0;
+	inheritedNoEchoParameters = /* @__PURE__ */ new Set();
+	noEchoPhysicalIdWarned = /* @__PURE__ */ new Set();
+	noEchoPositionedValues = /* @__PURE__ */ new Map();
+	noEchoExactEchoes = /* @__PURE__ */ new Map();
+	noEchoAttributeReads = /* @__PURE__ */ new Map();
+	witnessConfirmedLeaves = /* @__PURE__ */ new Map();
+	constructPathTemplate = void 0;
+};
+function noEchoExactEchoLeavesOf(record) {
+	const field = record?.noEchoExactEchoLeaves;
+	if (!Array.isArray(field)) return void 0;
+	const out = [];
+	for (const entry of field) {
+		if (!Array.isArray(entry) || entry.length === 0) return void 0;
+		if (!entry.every((segment) => typeof segment === "string")) return void 0;
+		out.push([...entry]);
+	}
+	return out;
+}
+function echoFidelityCandidates(coordinates, resolved, createOnly) {
+	const out = [];
+	for (const coordinate of coordinates) {
+		if (!coordinate.every((segment) => typeof segment === "string")) continue;
+		const keys = coordinate;
+		if (!createOnly.some((path) => path.length <= keys.length && path.every((s, i) => s === keys[i]))) continue;
+		const plaintext = valueAtCoordinate(resolved, keys);
+		if (typeof plaintext !== "string" || carriesSecretMask(plaintext)) continue;
+		out.push({
+			coordinate: keys,
+			plaintext
+		});
+	}
+	return out;
+}
+function reportedLeafAt(live, handed, candidate) {
+	if (valueAtCoordinate(handed, candidate.coordinate) !== "***") return void 0;
+	const leaf = valueAtCoordinate(live, candidate.coordinate);
+	return typeof leaf === "string" && !carriesSecretMask(leaf) ? leaf : void 0;
+}
+function echoesExactlyAt(live, handed, candidate) {
+	return reportedLeafAt(live, handed, candidate) === candidate.plaintext;
+}
+function provesEchoChangeAt(live, handed, candidate) {
+	const reported = reportedLeafAt(live, handed, candidate);
+	return reported !== void 0 && reported !== candidate.plaintext;
+}
+function noteNoEchoExactEchoes(run, logicalId, physicalId, read, handed, candidates, mode) {
+	const exact = "failure" in read ? [] : candidates.filter((candidate) => echoesExactlyAt(read.live, handed, candidate)).map((candidate) => [...candidate.coordinate]);
+	const noted = run.noEchoExactEchoes.get(logicalId);
+	const previous = mode === "add" && noted?.physicalId === physicalId ? noted.coordinates : [];
+	run.noEchoExactEchoes.set(logicalId, {
+		physicalId,
+		coordinates: sortedCoordinates([...previous, ...exact])
+	});
+}
+function sortedCoordinates(coordinates) {
+	const keyed = /* @__PURE__ */ new Map();
+	for (const coordinate of coordinates) keyed.set(JSON.stringify(coordinate), [...coordinate]);
+	return [...keyed.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([, c]) => c);
+}
+async function establishNoEchoEchoFidelity(run, deps, logicalId, record, resolvedProps, stateResources, secrets) {
+	run.noEchoExactEchoes.delete(logicalId);
+	const templateProps = deps.perResourceTemplateProps().get(logicalId);
+	const sources = noEchoPositionSources(run, stateResources);
+	if (templateProps === void 0 || sources === void 0 || sources.parameters.size === 0) return;
+	const coordinates = canonicalCoordinates(noEchoCoordinatesOf(templateProps, resolvedProps, {
+		parameters: sources.parameters,
+		...sources.conditions !== void 0 && { conditions: sources.conditions }
+	}));
+	if (coordinates.length === 0) return;
+	const candidates = echoFidelityCandidates(coordinates, resolvedProps, await getCreateOnlyPropertyPaths(record.resourceType).catch(() => []));
+	if (candidates.length === 0) return;
+	const handed = {
+		...record,
+		properties: maskAtCoordinates(record.properties, coordinates)
+	};
+	const read = await deps.readReaderForFreshNoEchoCeiling(logicalId, handed, secrets);
+	noteNoEchoExactEchoes(run, logicalId, record.physicalId, read, handed.properties, candidates, "set");
+}
+function withNoEchoExactEchoes(run, logicalId, record) {
+	const noted = run.noEchoExactEchoes.get(logicalId);
+	if (noted === void 0 || noted.coordinates.length === 0) return record;
+	if (noted.physicalId !== record.physicalId) return record;
+	const merged = sortedCoordinates([...noEchoExactEchoLeavesOf(record) ?? [], ...noted.coordinates]);
+	return {
+		...record,
+		noEchoExactEchoLeaves: merged
+	};
+}
+function noEchoParameterNamesOf(template) {
+	const names = /* @__PURE__ */ new Set();
+	const declared = template?.Parameters;
+	if (declared === null || typeof declared !== "object") return names;
+	for (const [name, definition] of Object.entries(declared)) if (declaresNoEcho(definition)) names.add(name);
+	return names;
+}
+function noEchoAttributeNamesOf(record) {
+	const field = record?.noEchoAttributeNames;
+	if (!Array.isArray(field) || !field.every((name) => typeof name === "string")) return void 0;
+	return field;
+}
+function noEchoPositionSources(run, resources = {}, template = run.constructPathTemplate, conditions = run.noEchoConditions) {
+	if (template === void 0) return void 0;
+	const declared = run.noEchoAttributeResources;
+	return {
+		parameters: /* @__PURE__ */ new Set([...noEchoParameterNamesOf(template), ...run.inheritedNoEchoParameters]),
+		attributeIsNoEcho: (logicalId, attribute) => {
+			const live = declared.get(logicalId);
+			if (live === true || live !== void 0 && live.has(attribute)) return true;
+			if (noEchoAttributeNamesOf(Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0)?.includes(attribute) === true) return true;
+			return run.persistedNoEchoAttributes.get(logicalId)?.has(attribute) === true;
+		},
+		...conditions !== void 0 && { conditions }
+	};
+}
+function noEchoLeavesFor(run, deps, logicalId, record, templateProps, sources) {
+	if (templateProps !== void 0 && isWrittenFromDeployedTemplate(record.properties)) return canonicalCoordinates(noEchoCoordinatesOf(templateProps, record.properties, sources));
+	const existing = noEchoLeavesOf(record);
+	if (existing !== void 0) {
+		const confirmed = run.witnessConfirmedLeaves.get(logicalId) ?? [];
+		return canonicalCoordinates([...existing, ...confirmed]);
+	}
+	const resolvedAsSame = deps.perResourceResolvedType().get(logicalId) === record.resourceType;
+	const source = (templateProps !== void 0 && resolvedAsSame ? templateProps : void 0) ?? templatePropertiesFor(run, logicalId, record.resourceType);
+	if (source === void 0) return void 0;
+	return canonicalCoordinates(noEchoCoordinatesOf(source, record.properties, sources));
+}
+function templatePropertiesFor(run, logicalId, resourceType) {
+	const resources = run.constructPathTemplate?.Resources;
+	if (resources === void 0 || !Object.hasOwn(resources, logicalId)) return void 0;
+	const definition = resources[logicalId];
+	if (definition?.Type !== resourceType) return void 0;
+	const properties = definition.Properties;
+	return properties !== null && typeof properties === "object" && !Array.isArray(properties) ? properties : void 0;
+}
+function noEchoAttributeNamesFor(run, logicalId, record, carried, leaves) {
+	const attributes = record.attributes ?? {};
+	const names = /* @__PURE__ */ new Set();
+	let echoed = false;
+	for (const coordinate of leaves ?? []) {
+		const value = valueAtCoordinate(record.properties, coordinate);
+		if (value === void 0 || carriesSecretMask(value)) continue;
+		for (const [name, attribute] of Object.entries(attributes)) {
+			if (carriesSecretMask(attribute)) continue;
+			if (typeof attribute === "string" && attribute === record.physicalId) continue;
+			const sameName = coordinate[0] === name && keyOrderFreeJson(attribute) === keyOrderFreeJson(value);
+			const embeds = typeof value === "string" && typeof attribute === "string" && !attribute.startsWith("arn:") && value.length >= 4 && typeof attribute === "string" && attribute.includes(value);
+			if (sameName || embeds) {
+				names.add(name);
+				echoed = true;
+			}
+		}
+	}
+	const declared = carried ? void 0 : run.noEchoAttributeResources.get(logicalId);
+	if (declared === true) for (const name of Object.keys(attributes)) names.add(name);
+	else if (declared !== void 0) {
+		for (const name of declared) if (Object.hasOwn(attributes, name)) names.add(name);
+	}
+	const prior = noEchoAttributeNamesOf(record);
+	for (const name of prior ?? []) if (Object.hasOwn(attributes, name) && carriesSecretMask(attributes[name])) names.add(name);
+	if (declared === void 0 && prior === void 0 && !echoed) return void 0;
+	return [...names].sort();
+}
+function applyNoEchoPersist(run, deps, logicalId, record, scrubbed, templateProps, resources, secrets, carried = false) {
+	const sources = noEchoPositionSources(run, resources);
+	if (sources === void 0) return scrubbed;
+	const leaves = noEchoLeavesFor(run, deps, logicalId, record, templateProps, sources);
+	const names = noEchoAttributeNamesFor(run, logicalId, record, carried, leaves);
+	if (leaves === void 0 && names === void 0) return scrubbed;
+	const next = { ...scrubbed };
+	if (leaves !== void 0) {
+		next.properties = maskAtCoordinates(scrubbed.properties, leaves);
+		if (scrubbed.observedProperties !== void 0 && leaves.length > 0) Object.assign(next, { observedProperties: maskReadbackAtCoordinates(scrubbed.observedProperties, record.properties, leaves) });
+		if (leaves.length > 0) next.noEchoLeaves = leaves;
+		else delete next.noEchoLeaves;
+		const marked = new Set(leaves.map((coordinate) => JSON.stringify(coordinate)));
+		const exact = (noEchoExactEchoLeavesOf(scrubbed) ?? []).filter((coordinate) => marked.has(JSON.stringify(coordinate)));
+		if (exact.length > 0) next.noEchoExactEchoLeaves = exact;
+		else delete next.noEchoExactEchoLeaves;
+	}
+	if (names !== void 0) {
+		if (scrubbed.attributes !== void 0 && names.length > 0) {
+			const attributes = { ...scrubbed.attributes };
+			for (const name of names) if (Object.hasOwn(attributes, name)) attributes[name] = maskWholeValue(attributes[name]);
+			next.attributes = attributes;
+		}
+		if (names.length > 0) next.noEchoAttributeNames = names;
+		else delete next.noEchoAttributeNames;
+	}
+	warnNoEchoPhysicalId(run, deps, logicalId, record, secrets);
+	return next;
+}
+function warnNoEchoPhysicalId(run, deps, logicalId, record, secrets) {
+	if (secrets === void 0 || run.noEchoPhysicalIdWarned.has(logicalId)) return;
+	const values = noEchoParameterPlaintextsOf(secrets);
+	if (values.length === 0 || typeof record.physicalId !== "string") return;
+	if (!values.some((value) => record.physicalId.includes(value))) return;
+	run.noEchoPhysicalIdWarned.add(logicalId);
+	deps.logger.warn(deps.maskForResource(logicalId, safeMsg`${logicalId}: its physical id contains a NoEcho parameter value. AWS publishes a resource's name, so cdkd keeps the physical id in state as AWS returns it.`));
+}
+function seedPersistedNoEchoAttributes(run, resources) {
+	run.persistedNoEchoAttributes = /* @__PURE__ */ new Map();
+	for (const [logicalId, record] of Object.entries(resources)) {
+		const names = noEchoAttributeNamesOf(record);
+		if (names !== void 0 && names.length > 0) run.persistedNoEchoAttributes.set(logicalId, new Set(names));
+	}
+}
+function maskOutputsByPosition(run, deps, outputs) {
+	const sources = noEchoPositionSources(run);
+	if (sources === void 0) return outputs;
+	const templateValues = Object.create(null);
+	for (const [name, definition] of Object.entries(run.constructPathTemplate?.Outputs ?? {})) templateValues[name] = definition?.Value;
+	if (deps.outputsRun().outputsSourceUsable) for (const [name, value] of Object.entries(deps.outputsRun().outputsTemplateSource)) templateValues[name] = value;
+	const coordinates = noEchoCoordinatesOf(templateValues, outputs, sources);
+	if (coordinates.length === 0) return outputs;
+	const maskedValues = new Set(coordinates.filter((coordinate) => coordinate.length === 1 && typeof coordinate[0] === "string").map((coordinate) => keyOrderFreeJson(outputs[coordinate[0]])));
+	const aliasCoordinates = Object.keys(outputs).filter((key) => !Object.hasOwn(templateValues, key) && outputs[key] !== void 0 && !carriesSecretMask(outputs[key]) && maskedValues.has(keyOrderFreeJson(outputs[key]))).map((key) => [key]);
+	return maskAtCoordinates(outputs, [...coordinates, ...aliasCoordinates]);
+}
+function getAttTargetsOf(node) {
+	const targets = [];
+	const seen = /* @__PURE__ */ new Set();
+	const subVariable = /\$\{([^}!][^}]*)\}/g;
+	const walk = (value) => {
+		if (value === null || typeof value !== "object" || seen.has(value)) return;
+		seen.add(value);
+		if (Array.isArray(value)) {
+			for (const item of value) walk(item);
+			return;
+		}
+		const record = value;
+		const getAtt = record["Fn::GetAtt"];
+		if (typeof getAtt === "string" && getAtt.indexOf(".") > 0) {
+			const dot = getAtt.indexOf(".");
+			targets.push([getAtt.slice(0, dot), getAtt.slice(dot + 1)]);
+		} else if (Array.isArray(getAtt) && typeof getAtt[0] === "string" && typeof getAtt[1] === "string") targets.push([getAtt[0], getAtt[1]]);
+		const sub = record["Fn::Sub"];
+		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
+		if (typeof text === "string") for (const match of text.matchAll(subVariable)) {
+			const name = match[1].trim();
+			const dot = name.indexOf(".");
+			if (dot > 0) targets.push([name.slice(0, dot), name.slice(dot + 1)]);
+		}
+		for (const child of Object.values(record)) walk(child);
+	};
+	walk(node);
+	return targets;
+}
+async function noEchoAttributeOverridesFor(run, deps, desiredProps, stateResources, stackName) {
+	const wanted = /* @__PURE__ */ new Map();
+	for (const [logicalId, attribute] of getAttTargetsOf(desiredProps)) {
+		const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+		if (record === void 0) continue;
+		if (noEchoAttributeNamesOf(record)?.includes(attribute) !== true) continue;
+		if (!carriesSecretMask(record.attributes?.[attribute])) continue;
+		if (!deps.perResourceSecrets().has(logicalId)) continue;
+		const set = wanted.get(logicalId) ?? /* @__PURE__ */ new Set();
+		set.add(attribute);
+		wanted.set(logicalId, set);
+	}
+	if (wanted.size === 0) return void 0;
+	const overrides = /* @__PURE__ */ new Map();
+	for (const [logicalId, attributes] of wanted) {
+		const record = stateResources[logicalId];
+		let read = run.noEchoAttributeReads.get(logicalId);
+		if (read === void 0) {
+			read = (async () => {
+				try {
+					const { provider } = deps.providerRegistry.getProviderFor({
+						resourceType: record.resourceType,
+						properties: record.properties,
+						provisionedBy: record.provisionedBy,
+						previousProperties: record.properties
+					});
+					const outcome = await readRecordAttributes({
+						provider,
+						logicalId,
+						resource: record,
+						stackName,
+						region: deps.stackRegion
+					});
+					return outcome.kind === "read" ? outcome.attributes : void 0;
+				} catch {
+					return;
+				}
+			})();
+			run.noEchoAttributeReads.set(logicalId, read);
+		}
+		const live = await read;
+		if (live === void 0) continue;
+		const secrets = deps.perResourceSecrets().get(logicalId);
+		const fresh = noEchoParameterPlaintextsOf(secrets);
+		const positioned = run.noEchoPositionedValues.get(logicalId) ?? /* @__PURE__ */ new Set();
+		const served = {};
+		for (const attribute of attributes) {
+			if (!Object.hasOwn(live, attribute)) continue;
+			const value = live[attribute];
+			if (typeof value === "string" && fresh.some((needle) => value === needle || value.includes(needle)) || value !== void 0 && positioned.has(keyOrderFreeJson(value))) served[attribute] = value;
+		}
+		if (Object.keys(served).length > 0) overrides.set(logicalId, served);
+	}
+	return overrides.size > 0 ? overrides : void 0;
+}
+function noEchoDiffComparison(run, deps, resources, template, conditions, parameterValues, stackName) {
+	const sources = noEchoPositionSources(run, resources, template, conditions);
+	if (sources === void 0) return void 0;
+	const compare = noEchoComparison({
+		sources,
+		values: parameterValues,
+		minNeedleLength: 4,
+		publicTokens: /* @__PURE__ */ new Set([deps.stackRegion, ...stackName === void 0 ? [] : [stackName]])
+	});
+	return (input) => compare(input);
+}
+function freshNoEchoParametersWithDeclared(inherited, template) {
+	const all = /* @__PURE__ */ new Set([...inherited ?? [], ...noEchoParameterNamesOf(template)]);
+	return all.size > 0 ? all : void 0;
+}
+function noEchoComparisonForTemplate(template, knownConditions, values, resources, publicTokens, inheritedNoEchoParameters) {
+	const sources = {
+		parameters: /* @__PURE__ */ new Set([...noEchoParameterNamesOf(template), ...inheritedNoEchoParameters ?? []]),
+		attributeIsNoEcho: (logicalId, attribute) => noEchoAttributeNamesOf(Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0)?.includes(attribute) === true,
+		...knownConditions !== void 0 && { conditions: knownConditions }
+	};
+	const compare = noEchoComparison({
+		sources,
+		values: values ?? {},
+		minNeedleLength: 4,
+		...publicTokens !== void 0 && { publicTokens }
+	});
+	return (input) => compare(input);
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/rollback.ts
 function redactOperationsForJournal(operations) {
 	return operations.map((op) => {
 		const secrets = this.perResourceSecrets.get(op.logicalId);
 		const templateProps = this.perResourceTemplateProps.get(op.logicalId);
-		const sources = templateProps === void 0 ? void 0 : this.noEchoPositionSources();
+		const sources = templateProps === void 0 ? void 0 : noEchoPositionSources(this.noEchoRun);
 		const byPosition = (bag) => sources === void 0 || templateProps === void 0 ? bag : maskAtCoordinates(bag, noEchoCoordinatesOf(templateProps, bag, sources));
 		if ((!secrets || secrets.size === 0) && !op.previousState && sources === void 0) return op;
 		const ownSecrets = secrets ?? /* @__PURE__ */ new Map();
@@ -37405,7 +38010,7 @@ function redactOperationsForJournal(operations) {
 			const previous = next.previousState;
 			const adopted = adoptedOrphanRecords.get(this);
 			const loaded = adopted?.has(op.logicalId) ? adopted.get(op.logicalId) : previous;
-			next.previousState = this.applyNoEchoPersist(op.logicalId, previous, keepPersistedPlainRecordLeaves(scrubResourceRecord(previous, ownSecrets, void 0, STATE_SOURCED_READBACK_RULES), previous, loaded ?? {}), void 0, {}, void 0, true);
+			next.previousState = applyNoEchoPersist(this.noEchoRun, this.noEchoDeps(), op.logicalId, previous, keepPersistedPlainRecordLeaves(scrubResourceRecord(previous, ownSecrets, void 0, STATE_SOURCED_READBACK_RULES), previous, loaded ?? {}), void 0, {}, void 0, true);
 		}
 		return next;
 	});
@@ -37541,7 +38146,7 @@ function foreignHolderResolver(engine) {
 async function settleJournalAfterSuccess(stackName, completedOperations, previousState, finalResources, initialDeploy) {
 	if (this.options.parentStackInfo) {
 		await this.writeRollbackJournalSegment(stackName, completedOperations, [], NESTED_PENDING_PARENT_REASON, initialDeploy, nestedPendingSnapshot(previousState, (name) => {
-			const verdict = this.carriedExportAliasRefusal;
+			const verdict = this.outputsRun.carriedExportAliasRefusal;
 			const dropped = verdict === void 0 || verdict(name, name) !== void 0;
 			if (dropped) this.logger.warn(verdict === void 0 ? "An export alias the previous record published was not kept for a revert of this nested stack: no export-name verdict is available." : "An export alias the previous record published was not kept for a revert of this nested stack: its name contains a NoEcho value.");
 			return dropped;
@@ -37713,7 +38318,7 @@ async function writeRollbackJournalSegment(stackName, completedOperations, faile
 			...redactedFailed.length > 0 && { failedOperations: redactedFailed },
 			...nestedPending?.previousOutputs && { previousOutputs: {
 				...nestedPending.previousOutputs,
-				outputs: this.maskOutputsByPosition(nestedPending.previousOutputs.outputs)
+				outputs: maskOutputsByPosition(this.noEchoRun, this.noEchoDeps(), nestedPending.previousOutputs.outputs)
 			} },
 			...nestedPending?.previousCrossStackReads && { previousCrossStackReads: nestedPending.previousCrossStackReads }
 		};
@@ -38046,42 +38651,158 @@ function recaptureMaskedBaseline(args) {
 
 //#endregion
 //#region src/deployment/deploy-engine/observed-capture.ts
-function kickOffObservedCapture(provider, logicalId, physicalId, resourceType, resolvedProps, context, secrets, maskAt) {
-	if (this.options.captureObservedState !== true) return;
-	this.observedCaptureTasks.delete(logicalId);
-	if (!provider.readCurrentState) return;
-	const readCurrentState = provider.readCurrentState.bind(provider);
-	const read = () => readCurrentState(physicalId, logicalId, resourceType, resolvedProps, context).then((observed) => observed === RESOURCE_NOT_FOUND ? void 0 : maskAt === void 0 || observed === void 0 || maskAt.coordinates.length === 0 ? observed : maskReadbackAtCoordinates(observed, maskAt.properties, maskAt.coordinates), (err) => {
-		const mask = createUnionSecretMasker([
-			secrets,
-			this.printingSecretsFor(logicalId),
-			this.fingerprintNoEchoValues
-		]);
-		this.logger.debug(safeMsg`observedProperties capture for ${mask(logicalId)} (${mask(resourceType)}) failed: ${asIsMessage(mask(err instanceof Error ? err.message : String(err)))} — drift will fall back to template properties for this resource until the next successful deploy.`);
-	});
-	const promise = secrets === void 0 ? read() : withCurrentResourceSecrets(secrets, read);
-	this.observedCaptureTasks.set(logicalId, promise);
-}
-async function drainObservedCaptures(stateResources) {
-	const captured = await this.drainProvenanceCaptures(stateResources);
-	if (this.observedCaptureTasks.size === 0) return captured;
-	const entries = Array.from(this.observedCaptureTasks.entries());
-	this.observedCaptureTasks.clear();
-	const resolved = await Promise.all(entries.map(([, p]) => p));
-	let installed = 0;
-	for (let i = 0; i < entries.length; i++) {
-		const logicalId = entries[i][0];
-		const observed = resolved[i];
-		const target = stateResources[logicalId];
-		const recapturedFrom = observed === void 0 ? void 0 : this.recapturedBaselines.get(observed);
-		if (recapturedFrom !== void 0 && target?.observedProperties !== recapturedFrom) continue;
-		if (target && observed !== void 0) {
-			installed++;
-			target.observedProperties = recapturedFrom !== void 0 ? observed : markSameGenerationBag({ ...observed });
+var ObservedCapture = class {
+	observedCaptureTasks = /* @__PURE__ */ new Map();
+	recapturedBaselines = /* @__PURE__ */ new WeakMap();
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	kickOffObservedCapture(provider, logicalId, physicalId, resourceType, resolvedProps, context, secrets, maskAt) {
+		if (this.deps.options.captureObservedState !== true) return;
+		this.observedCaptureTasks.delete(logicalId);
+		if (!provider.readCurrentState) return;
+		const readCurrentState = provider.readCurrentState.bind(provider);
+		const read = () => readCurrentState(physicalId, logicalId, resourceType, resolvedProps, context).then((observed) => observed === RESOURCE_NOT_FOUND ? void 0 : maskAt === void 0 || observed === void 0 || maskAt.coordinates.length === 0 ? observed : maskReadbackAtCoordinates(observed, maskAt.properties, maskAt.coordinates), (err) => {
+			const mask = createUnionSecretMasker([
+				secrets,
+				this.deps.printingSecretsFor(logicalId),
+				this.deps.fingerprintNoEchoValues()
+			]);
+			this.deps.logger.debug(safeMsg`observedProperties capture for ${mask(logicalId)} (${mask(resourceType)}) failed: ${asIsMessage(mask(err instanceof Error ? err.message : String(err)))} — drift will fall back to template properties for this resource until the next successful deploy.`);
+		});
+		const promise = secrets === void 0 ? read() : withCurrentResourceSecrets(secrets, read);
+		this.observedCaptureTasks.set(logicalId, promise);
+	}
+	async drainObservedCaptures(stateResources) {
+		const captured = await this.deps.provenanceCapture().drainProvenanceCaptures(stateResources);
+		if (this.observedCaptureTasks.size === 0) return captured;
+		const entries = Array.from(this.observedCaptureTasks.entries());
+		this.observedCaptureTasks.clear();
+		const resolved = await Promise.all(entries.map(([, p]) => p));
+		let installed = 0;
+		for (let i = 0; i < entries.length; i++) {
+			const logicalId = entries[i][0];
+			const observed = resolved[i];
+			const target = stateResources[logicalId];
+			const recapturedFrom = observed === void 0 ? void 0 : this.recapturedBaselines.get(observed);
+			if (recapturedFrom !== void 0 && target?.observedProperties !== recapturedFrom) continue;
+			if (target && observed !== void 0) {
+				installed++;
+				target.observedProperties = recapturedFrom !== void 0 ? observed : markSameGenerationBag({ ...observed });
+			}
+		}
+		return installed + captured;
+	}
+	kickOffAutoRefreshObservedProperties(stateResources, crossStackReads) {
+		if (this.deps.options.captureObservedState !== true) return;
+		if (this.deps.options.dryRun === true) return;
+		let toRefresh = 0;
+		let refused = 0;
+		const candidates = [];
+		const masked = [];
+		for (const [logicalId, resource] of Object.entries(stateResources)) {
+			if (!hasAddressablePhysicalId(resource)) continue;
+			if (resource.observedProperties !== void 0) {
+				if (isMaskedBaselineRecaptureCandidate(resource)) masked.push({
+					logicalId,
+					resource
+				});
+				continue;
+			}
+			if (resource.observedBaselineRefused === true) {
+				refused++;
+				continue;
+			}
+			candidates.push({
+				logicalId,
+				resource
+			});
+		}
+		if (refused > 0) this.deps.logger.debug(safeMsg`observed-properties auto-refresh SKIPPED for ${refused} resource(s) whose baseline a 'cdkd import' run refused: their recorded properties cannot position the redaction, so capturing an AWS readback against them could persist a resolved secret in plaintext. A deploy that actually CHANGES one of them restores its baseline, unless the refusal is an unverifiable-parameter one (only a replacement or a proving re-import discharges that); a NO_CHANGE deploy never does.`);
+		if (candidates.length === 0 && masked.length === 0) return;
+		const allSiblings = {};
+		for (const [lid, res] of Object.entries(stateResources)) allSiblings[lid] = {
+			resourceType: res.resourceType,
+			properties: res.properties ?? {}
+		};
+		for (const { logicalId, resource } of candidates) {
+			let provider;
+			try {
+				provider = this.deps.providerRegistry.getProviderFor({
+					resourceType: resource.resourceType,
+					provisionedBy: resource.provisionedBy
+				}).provider;
+			} catch {
+				continue;
+			}
+			if (!provider.readCurrentState) continue;
+			const siblings = { ...allSiblings };
+			delete siblings[logicalId];
+			const recordProperties = resource.properties ?? {};
+			const maskCoordinates = [...maskedLeafCoordinatesOf(recordProperties), ...noEchoLeavesOf(resource) ?? []];
+			this.kickOffObservedCapture(provider, logicalId, resource.physicalId, resource.resourceType, recordProperties, { siblings }, void 0, maskCoordinates.length > 0 ? {
+				properties: recordProperties,
+				coordinates: maskCoordinates
+			} : void 0);
+			toRefresh++;
+		}
+		if (toRefresh > 0) this.deps.logger.warn(safeMsg`cdkd state schema upgrade detected — refreshing observed-properties baseline for ${toRefresh} resource(s) (one-time, runs in parallel with deploy)`);
+		let producerRegions = [];
+		if (masked.length > 0) try {
+			producerRegions = producerRegionsFromState(crossStackReads);
+		} catch {
+			this.deps.logger.debug(safeMsg`Masked observed baseline re-capture skipped for ${masked.length} resource(s): the record's cross-stack reads could not be read.`);
+			masked.length = 0;
 		}
+		for (const { logicalId, resource } of masked) {
+			let provider;
+			try {
+				provider = this.deps.providerRegistry.getProviderFor({
+					resourceType: resource.resourceType,
+					provisionedBy: resource.provisionedBy
+				}).provider;
+			} catch {
+				continue;
+			}
+			if (!provider.readCurrentState) continue;
+			const siblings = { ...allSiblings };
+			delete siblings[logicalId];
+			this.kickOffMaskedBaselineRecapture(provider, logicalId, resource, producerRegions, { siblings });
+		}
+	}
+	kickOffMaskedBaselineRecapture(provider, logicalId, resource, producerRegions, context) {
+		const previous = resource.observedProperties;
+		const readCurrentState = provider.readCurrentState?.bind(provider);
+		if (previous === void 0 || readCurrentState === void 0) return;
+		const properties = resource.properties ?? {};
+		const task = (async () => {
+			const secrets = await resolveRecordSecrets(properties, (token, own) => this.deps.resolver.resolveDynamicReferences(token, persistedTokenResolverContext(own, producerRegions)));
+			if (secrets === void 0 || secrets.size === 0) {
+				this.deps.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: its recorded references did not all resolve to distinct values.`);
+				return;
+			}
+			const readback = await withCurrentResourceSecrets(secrets, () => readCurrentState(resource.physicalId, logicalId, resource.resourceType, properties, context));
+			if (readback === void 0 || readback === RESOURCE_NOT_FOUND) return void 0;
+			const recaptured = recaptureMaskedBaseline({
+				previous,
+				readback,
+				properties,
+				secrets
+			});
+			if (recaptured === void 0) {
+				this.deps.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: no masked position could be certified, or the resource no longer reads back as its baseline records.`);
+				return;
+			}
+			this.recapturedBaselines.set(recaptured, previous);
+			this.deps.logger.debug(safeMsg`Re-captured the masked observed baseline of ${logicalId}.`);
+			return recaptured;
+		})().catch(() => {
+			this.deps.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: the re-capture failed.`);
+		});
+		this.observedCaptureTasks.set(logicalId, task);
 	}
-	return installed + captured;
-}
+};
 const STANDALONE_SIBLING = {
 	Roles: {
 		type: "AWS::IAM::RolePolicy",
@@ -38096,8 +38817,8 @@ const STANDALONE_SIBLING = {
 		field: "GroupName"
 	}
 };
-async function buildObservedCaptureSiblings(resourceType, capturedLogicalId, capturedPhysicalId, template, stateResources, stackName, parameterValues, conditions) {
-	if (this.options.captureObservedState !== true) return void 0;
+async function buildObservedCaptureSiblings(deps, resourceType, capturedLogicalId, capturedPhysicalId, template, stateResources, stackName, parameterValues, conditions) {
+	if (deps.options.captureObservedState !== true) return void 0;
 	const attachmentField = resourceType === "AWS::IAM::Role" ? "Roles" : resourceType === "AWS::IAM::User" ? "Users" : resourceType === "AWS::IAM::Group" ? "Groups" : void 0;
 	if (!attachmentField) return void 0;
 	const resources = template?.Resources;
@@ -38115,14 +38836,14 @@ async function buildObservedCaptureSiblings(resourceType, capturedLogicalId, cap
 		if (!attachments.some((a) => isRefTo(a, capturedLogicalId) || a === capturedPhysicalId)) continue;
 		let policyName = props["PolicyName"];
 		if (policyName !== void 0 && typeof policyName !== "string") {
-			resolverContext ??= this.buildResolverContext({
+			resolverContext ??= deps.buildResolverContext({
 				template,
 				resources: stateResources,
 				...parameterValues && { parameters: parameterValues },
 				...conditions && { conditions }
 			}, stackName);
 			try {
-				policyName = await this.resolver.resolve(policyName, resolverContext);
+				policyName = await deps.resolver.resolve(policyName, resolverContext);
 			} catch {
 				continue;
 			}
@@ -38138,7 +38859,7 @@ async function buildObservedCaptureSiblings(resourceType, capturedLogicalId, cap
 	}
 	return Object.keys(siblings).length > 0 ? { siblings } : void 0;
 }
-function stampReasonlessParameterRefusals(stateResources, template) {
+function stampReasonlessParameterRefusals(logger, stateResources, template) {
 	let namesParameter;
 	let stamped = 0;
 	for (const [logicalId, resource] of Object.entries(stateResources)) {
@@ -38151,116 +38872,8 @@ function stampReasonlessParameterRefusals(stateResources, template) {
 		};
 		stamped++;
 	}
-	if (namesParameter?.failedClosed !== void 0) this.logger.debug(safeMsg`The template's parameter dependence could not be judged (${namesParameter.failedClosed}): every observed-baseline refusal recorded without a reason is treated as an unverifiable-parameter refusal (${stamped} stamped).`);
-	if (stamped > 0) this.logger.debug(safeMsg`${stamped} resource(s) carry an observed-baseline refusal recorded without a reason by an older cdkd, and their template definition reads a template parameter: treated as an unverifiable-parameter refusal (kept until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter).`);
-}
-function kickOffAutoRefreshObservedProperties(stateResources, crossStackReads) {
-	if (this.options.captureObservedState !== true) return;
-	if (this.options.dryRun === true) return;
-	let toRefresh = 0;
-	let refused = 0;
-	const candidates = [];
-	const masked = [];
-	for (const [logicalId, resource] of Object.entries(stateResources)) {
-		if (!hasAddressablePhysicalId(resource)) continue;
-		if (resource.observedProperties !== void 0) {
-			if (isMaskedBaselineRecaptureCandidate(resource)) masked.push({
-				logicalId,
-				resource
-			});
-			continue;
-		}
-		if (resource.observedBaselineRefused === true) {
-			refused++;
-			continue;
-		}
-		candidates.push({
-			logicalId,
-			resource
-		});
-	}
-	if (refused > 0) this.logger.debug(safeMsg`observed-properties auto-refresh SKIPPED for ${refused} resource(s) whose baseline a 'cdkd import' run refused: their recorded properties cannot position the redaction, so capturing an AWS readback against them could persist a resolved secret in plaintext. A deploy that actually CHANGES one of them restores its baseline, unless the refusal is an unverifiable-parameter one (only a replacement or a proving re-import discharges that); a NO_CHANGE deploy never does.`);
-	if (candidates.length === 0 && masked.length === 0) return;
-	const allSiblings = {};
-	for (const [lid, res] of Object.entries(stateResources)) allSiblings[lid] = {
-		resourceType: res.resourceType,
-		properties: res.properties ?? {}
-	};
-	for (const { logicalId, resource } of candidates) {
-		let provider;
-		try {
-			provider = this.providerRegistry.getProviderFor({
-				resourceType: resource.resourceType,
-				provisionedBy: resource.provisionedBy
-			}).provider;
-		} catch {
-			continue;
-		}
-		if (!provider.readCurrentState) continue;
-		const siblings = { ...allSiblings };
-		delete siblings[logicalId];
-		const recordProperties = resource.properties ?? {};
-		const maskCoordinates = [...maskedLeafCoordinatesOf(recordProperties), ...noEchoLeavesOf(resource) ?? []];
-		this.kickOffObservedCapture(provider, logicalId, resource.physicalId, resource.resourceType, recordProperties, { siblings }, void 0, maskCoordinates.length > 0 ? {
-			properties: recordProperties,
-			coordinates: maskCoordinates
-		} : void 0);
-		toRefresh++;
-	}
-	if (toRefresh > 0) this.logger.warn(safeMsg`cdkd state schema upgrade detected — refreshing observed-properties baseline for ${toRefresh} resource(s) (one-time, runs in parallel with deploy)`);
-	let producerRegions = [];
-	if (masked.length > 0) try {
-		producerRegions = producerRegionsFromState(crossStackReads);
-	} catch {
-		this.logger.debug(safeMsg`Masked observed baseline re-capture skipped for ${masked.length} resource(s): the record's cross-stack reads could not be read.`);
-		masked.length = 0;
-	}
-	for (const { logicalId, resource } of masked) {
-		let provider;
-		try {
-			provider = this.providerRegistry.getProviderFor({
-				resourceType: resource.resourceType,
-				provisionedBy: resource.provisionedBy
-			}).provider;
-		} catch {
-			continue;
-		}
-		if (!provider.readCurrentState) continue;
-		const siblings = { ...allSiblings };
-		delete siblings[logicalId];
-		this.kickOffMaskedBaselineRecapture(provider, logicalId, resource, producerRegions, { siblings });
-	}
-}
-function kickOffMaskedBaselineRecapture(provider, logicalId, resource, producerRegions, context) {
-	const previous = resource.observedProperties;
-	const readCurrentState = provider.readCurrentState?.bind(provider);
-	if (previous === void 0 || readCurrentState === void 0) return;
-	const properties = resource.properties ?? {};
-	const task = (async () => {
-		const secrets = await resolveRecordSecrets(properties, (token, own) => this.resolver.resolveDynamicReferences(token, persistedTokenResolverContext(own, producerRegions)));
-		if (secrets === void 0 || secrets.size === 0) {
-			this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: its recorded references did not all resolve to distinct values.`);
-			return;
-		}
-		const readback = await withCurrentResourceSecrets(secrets, () => readCurrentState(resource.physicalId, logicalId, resource.resourceType, properties, context));
-		if (readback === void 0 || readback === RESOURCE_NOT_FOUND) return void 0;
-		const recaptured = recaptureMaskedBaseline({
-			previous,
-			readback,
-			properties,
-			secrets
-		});
-		if (recaptured === void 0) {
-			this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: no masked position could be certified, or the resource no longer reads back as its baseline records.`);
-			return;
-		}
-		this.recapturedBaselines.set(recaptured, previous);
-		this.logger.debug(safeMsg`Re-captured the masked observed baseline of ${logicalId}.`);
-		return recaptured;
-	})().catch(() => {
-		this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: the re-capture failed.`);
-	});
-	this.observedCaptureTasks.set(logicalId, task);
+	if (namesParameter?.failedClosed !== void 0) logger.debug(safeMsg`The template's parameter dependence could not be judged (${namesParameter.failedClosed}): every observed-baseline refusal recorded without a reason is treated as an unverifiable-parameter refusal (${stamped} stamped).`);
+	if (stamped > 0) logger.debug(safeMsg`${stamped} resource(s) carry an observed-baseline refusal recorded without a reason by an older cdkd, and their template definition reads a template parameter: treated as an unverifiable-parameter refusal (kept until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter).`);
 }
 
 //#endregion
@@ -38282,7 +38895,7 @@ function diffLogMasker(diffSecrets, template, parameterValues, resources) {
 	return (text) => {
 		if (!judged) {
 			judged = true;
-			storedSecretNameNeedles(resources, this.fingerprintNoEchoValues, stateNames);
+			storedSecretNameNeedles(resources, this.stateNamingSecrets(), stateNames);
 		}
 		return union(text);
 	};
@@ -38312,34 +38925,34 @@ function rememberRecoverableMaskedOutputs(stackName, resolved, redacted) {
 	}
 }
 function absorbOutputsPassSecrets() {
-	for (const passSecrets of this.outputsPassSecretMaps) {
-		for (const [value, expr] of passSecrets) this.outputSecrets.set(value, expr);
-		mergeResolvedPairs(passSecrets, this.outputSecrets);
-		for (const physicalId of physicalNameCopiesOf.get(passSecrets) ?? []) recordPhysicalNameCopy(this.outputSecrets, physicalId);
+	for (const passSecrets of this.outputsRun.outputsPassSecretMaps) {
+		for (const [value, expr] of passSecrets) this.outputsRun.outputSecrets.set(value, expr);
+		mergeResolvedPairs(passSecrets, this.outputsRun.outputSecrets);
+		for (const physicalId of physicalNameCopiesOf.get(passSecrets) ?? []) recordPhysicalNameCopy(this.outputsRun.outputSecrets, physicalId);
 	}
 }
 function redactOutputs(outputs) {
 	const redacted = redactOutputsBag.call(this, outputs);
-	if (this.outputsResolvedThisRun.has(outputs)) this.outputsResolvedThisRun.add(redacted);
+	if (this.outputsRun.outputsResolvedThisRun.has(outputs)) this.outputsRun.outputsResolvedThisRun.add(redacted);
 	return redacted;
 }
 function redactOutputsBag(outputs) {
 	this.absorbOutputsPassSecrets();
-	if (this.outputSecrets.size === 0) return this.maskOutputsByPosition(outputs);
-	return this.maskOutputsByPosition(redactSecretsForState(outputs, this.outputSecrets, this.outputsSourceUsable ? this.outputsTemplateSource : void 0, TEMPLATE_SOURCED_RULES));
+	if (this.outputsRun.outputSecrets.size === 0) return maskOutputsByPosition(this.noEchoRun, this.noEchoDeps(), outputs);
+	return maskOutputsByPosition(this.noEchoRun, this.noEchoDeps(), redactSecretsForState(outputs, this.outputsRun.outputSecrets, this.outputsRun.outputsSourceUsable ? this.outputsRun.outputsTemplateSource : void 0, TEMPLATE_SOURCED_RULES));
 }
 function registerNoEchoAttributes(logicalId, result, secrets, ownProperties) {
 	const declared = recordNoEchoAttributeValues(result, secrets, ownProperties);
 	const echoed = echoedNoEchoAttributes(this, logicalId, result.attributes, secrets, ownProperties, result.physicalId);
-	if (declared === true) this.noEchoAttributeResources.set(logicalId, true);
-	else if (declared !== void 0 || echoed.size > 0) this.noEchoAttributeResources.set(logicalId, /* @__PURE__ */ new Set([...declared ?? [], ...echoed]));
+	if (declared === true) this.noEchoRun.noEchoAttributeResources.set(logicalId, true);
+	else if (declared !== void 0 || echoed.size > 0) this.noEchoRun.noEchoAttributeResources.set(logicalId, /* @__PURE__ */ new Set([...declared ?? [], ...echoed]));
 }
 function echoedNoEchoAttributes(engine, logicalId, attributes, secrets, ownProperties, physicalId) {
 	const echoed = /* @__PURE__ */ new Set();
 	if (attributes === void 0) return echoed;
 	const fresh = [...freshNoEchoValuesOf.get(secrets) ?? []].filter((value) => isMaskOnlyPlaintext(secrets, value));
 	const templateProps = engine.perResourceTemplateProps.get(logicalId);
-	const sources = engine.noEchoPositionSources();
+	const sources = noEchoPositionSources(engine.noEchoRun);
 	const positioned = /* @__PURE__ */ new Map();
 	if (templateProps !== void 0 && ownProperties !== void 0 && sources !== void 0) for (const coordinate of noEchoCoordinatesOf(templateProps, ownProperties, {
 		parameters: sources.parameters,
@@ -38373,12 +38986,12 @@ function refuseRedactedAttributeReads(logicalId, resourceType, context) {
 		const producers = [...new Set(reads.map((read) => read.logicalId).filter((id) => !!id))];
 		throw new ProvisioningError(safeMsg`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: ` + safeMsg`${producers.map((id) => displayIdent(id)).join(", ")} declared ${reads.length === 1 ? "that attribute" : "those attributes"} NoEcho, ` + safeMsg`so cdkd's recorded state holds only the redaction mask for ${reads.length === 1 ? "it" : "them"}, ` + `and cdkd does not re-run a producer to recover a value. Remedy: deploy a change to the ` + safeMsg`producer in the SAME run as ${logicalId} (for a custom resource, change one of its ` + "properties, e.g. a nonce / version property, so its handler runs again and supplies the value), or stop declaring the value NoEcho.", resourceType, logicalId);
 	}
-	throw new ProvisioningError(safeMsg`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the ` + `redaction mask there, and the value is not recoverable from state. There are three ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all, or cdkd deploy '**' when either is inside a CDK Stage) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The value holds the Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records — so a deploy that leaves the resource or output holding it unchanged reads the mask again, and a re-import does not recover it. Remedy: have this resource build the value itself from the SECRET's own reference (the {{resolve:secretsmanager:...}} or {{resolve:ssm-secure:...}} reference, or a {{resolve:ssm:...}} of a SecureString parameter, that the encoding was made from) under its own Fn::Base64, instead of reading it from another resource's attribute or another stack's output — not by a {{resolve:ssm:...}} read of a String parameter holding the encoding, which cdkd treats as public and would record in state in the clear. (3) The resource is recorded through the Cloud Control fallback (by a deploy or by 'cdkd import'), which keeps in the clear only the Fn::GetAtt attributes it can vouch for and masks the rest. If the name above is not an Fn::GetAtt attribute CloudFormation accepts for that resource type, no record will ever hold it: stop reading it. If it is one, 'cdkd import' masked it because it could not vouch for the value, or could not read the schema and warned about it when it happened (if that warning named a missing cloudformation:DescribeType permission, grant it first); a deploy that creates or updates the resource records it, unless its value came from a secret. See https://github.com/go-to-k/cdkd/issues/2449. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources, true)}`, resourceType, logicalId);
+	throw new ProvisioningError(safeMsg`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the ` + `redaction mask there, and the value is not recoverable from state. There are four ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all, or cdkd deploy '**' when either is inside a CDK Stage) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The value holds the Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records — so a deploy that leaves the resource or output holding it unchanged reads the mask again, and a re-import does not recover it. Remedy: have this resource build the value itself from the SECRET's own reference (the {{resolve:secretsmanager:...}} or {{resolve:ssm-secure:...}} reference, or a {{resolve:ssm:...}} of a SecureString parameter, that the encoding was made from) under its own Fn::Base64, instead of reading it from another resource's attribute or another stack's output — not by a {{resolve:ssm:...}} read of a String parameter holding the encoding, which cdkd treats as public and would record in state in the clear. (3) The resource is recorded through the Cloud Control fallback (by a deploy or by 'cdkd import'), which keeps in the clear only the Fn::GetAtt attributes it can vouch for and masks the rest. If the name above is not an Fn::GetAtt attribute CloudFormation accepts for that resource type, no record will ever hold it: stop reading it. If it is one, 'cdkd import' masked it because it could not vouch for the value, or could not read the schema and warned about it when it happened (if that warning named a missing cloudformation:DescribeType permission, grant it first); a deploy that creates or updates the resource records it, unless its value came from a secret. (4) Two secret values cdkd resolved overlap inside the value, so no single {{resolve:...}} reference renders it and cdkd stored the mask rather than part of a secret: change the producer's value (or rotate one of the secrets) so that they no longer overlap, and deploy the producer in the same run as this resource. See https://github.com/go-to-k/cdkd/issues/2449. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources, true)}`, resourceType, logicalId);
 }
 function allRecordedSecrets() {
 	const all = /* @__PURE__ */ new Map();
 	for (const bag of this.perResourceSecrets.values()) for (const [plaintext, expression] of bag) all.set(plaintext, expression);
-	for (const [plaintext, expression] of this.outputSecrets) all.set(plaintext, expression);
+	for (const [plaintext, expression] of this.outputsRun.outputSecrets) all.set(plaintext, expression);
 	return all;
 }
 async function readReaderForFreshNoEchoCeiling(logicalId, currentResource, secrets) {
@@ -38434,8 +39047,39 @@ function noteSecretNamedRecord(logicalId, record) {
 function namingSecretsFor(logicalId) {
 	const own = this.perResourceSecrets.get(logicalId);
 	const noEcho = this.fingerprintNoEchoValues;
-	if (!hasMaskableValues(noEcho)) return own;
-	return unionOfSecretBags([own, noEcho]);
+	const stored = this.storedNoEchoNamingValues.get(logicalId);
+	if (!hasMaskableValues(noEcho) && !hasMaskableValues(stored)) return own;
+	return unionOfSecretBags([
+		own,
+		noEcho,
+		stored
+	]);
+}
+function stateNamingSecrets() {
+	const base = this.fingerprintNoEchoValues;
+	const stored = this.storedNoEchoNamingValues;
+	if (stored.size === 0) return base;
+	const hit = namingSecretsMemo.get(stored);
+	if (hit !== void 0 && hit.base === base) return hit.secrets;
+	const secrets = namingSecretsWithRecordedNoEcho(base, (logicalId) => stored.get(logicalId));
+	namingSecretsMemo.set(stored, {
+		base,
+		secrets
+	});
+	return secrets;
+}
+const namingSecretsMemo = /* @__PURE__ */ new WeakMap();
+function captureStoredNoEchoNamingValues(resources, template, conditions) {
+	const names = new Set(this.noEchoRun.inheritedNoEchoParameters);
+	for (const [name, definition] of Object.entries(template.Parameters ?? {})) if (declaresNoEcho(definition)) names.add(name);
+	const templateResources = template.Resources ?? {};
+	const captured = /* @__PURE__ */ new Map();
+	for (const [logicalId, record] of Object.entries(resources)) {
+		const templateResource = Object.hasOwn(templateResources, logicalId) ? templateResources[logicalId] : void 0;
+		const bag = recordedNoEchoValuesOf(templateResource?.Type === record?.resourceType ? templateResource?.Properties : void 0, record, names, conditions);
+		if (hasMaskableValues(bag)) captured.set(logicalId, bag);
+	}
+	this.storedNoEchoNamingValues = captured;
 }
 function noteSecretNamedReads(logicalId, record, resources) {
 	const read = secretNamesReadBy(logicalId, record, resources, (otherId) => ({
@@ -38792,143 +39436,96 @@ function warnUnretriedReplacedDeletes(why) {
 }
 
 //#endregion
-//#region src/deployment/read-only-attribute-healer.ts
-async function readRecordAttributes(input) {
-	const { provider, logicalId, resource, stackName, region } = input;
-	if (!provider.import) return { kind: "not-attempted" };
-	if (!hasAddressablePhysicalId(resource)) return { kind: "not-attempted" };
-	const found = await provider.import({
-		logicalId,
-		resourceType: resource.resourceType,
-		stackName,
-		region,
-		properties: resource.properties,
-		knownPhysicalId: resource.physicalId
-	});
-	if (found === null) return { kind: "not-found" };
-	if (found.physicalId !== resource.physicalId) throw new Error(`the provider answered for a different resource (${found.physicalId}) than the one asked about (${resource.physicalId})`);
-	const reported = Object.entries(normalizeHealedAttributes(found.attributes));
-	const attributes = Object.fromEntries(reported.filter(([, value]) => !carriesSecretMask(value)));
-	const withheldKeys = reported.filter(([, value]) => carriesSecretMask(value)).map(([key]) => key);
-	return {
-		kind: "read",
-		attributes,
-		...withheldKeys.length > 0 && { withheldKeys }
-	};
-}
-function createReadOnlyAttributeHealerFactory(options) {
-	const logger = getLogger().child("ReadOnlyAttributeHealer");
-	const memo = /* @__PURE__ */ new Map();
-	const readOnce = (stackName, region, logicalId, resource) => {
-		let key;
-		try {
-			if (isHealExcludedType(resource.resourceType)) return Promise.resolve({ kind: "not-attempted" });
-			key = injectiveKey(stackName, region, logicalId, resource.physicalId);
-		} catch (error) {
-			return Promise.resolve({
-				kind: "failed",
-				error
-			});
-		}
-		const inFlight = memo.get(key);
+//#region src/deployment/deploy-engine/attribute-healer.ts
+var AttributeHealer = class {
+	heals = /* @__PURE__ */ new Map();
+	healed = /* @__PURE__ */ new Map();
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	get baseline() {
+		return this.deps.baseline;
+	}
+	heal(logicalId, resource, stackName) {
+		if (!this.isEligible(logicalId, resource)) return Promise.resolve({ kind: "not-attempted" });
+		const key = injectiveKey(logicalId, resource.physicalId);
+		const inFlight = this.heals.get(key);
 		if (inFlight) return inFlight;
-		const heal = (async () => options.inRegion(region, () => readRecordAttributes({
-			provider: options.getProvider(resource, region),
-			logicalId,
-			resource,
-			stackName,
-			region
-		})))().then((outcome) => {
-			if (outcome.kind === "read") try {
-				logger.debug(safeMsg`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS for this preview — its state record lacked one a Fn::GetAtt asked for; nothing is written: ${Object.keys(outcome.attributes).length} attribute(s) read`);
-			} catch {}
-			return outcome;
-		}).catch((error) => ({
+		const heal = this.read(logicalId, resource, stackName).catch((error) => ({
 			kind: "failed",
 			error
 		}));
-		memo.set(key, heal);
+		this.heals.set(key, heal);
 		return heal;
-	};
-	return (stackName, region) => Object.assign((logicalId, resource) => readOnce(stackName, region, logicalId, resource), { readOnly: true });
-}
-
-//#endregion
-//#region src/deployment/deploy-engine/heal.ts
-function healStaleAttributes(logicalId, resource, stackName) {
-	if (!this.isHealEligible(logicalId, resource)) return Promise.resolve({ kind: "not-attempted" });
-	const key = injectiveKey(logicalId, resource.physicalId);
-	const inFlight = this.attributeHeals.get(key);
-	if (inFlight) return inFlight;
-	const heal = this.readStaleAttributes(logicalId, resource, stackName).catch((error) => ({
-		kind: "failed",
-		error
-	}));
-	this.attributeHeals.set(key, heal);
-	return heal;
-}
-function isHealEligible(logicalId, resource) {
-	const loaded = Object.hasOwn(this.healBaseline, logicalId) ? this.healBaseline[logicalId] : void 0;
-	return loaded !== void 0 && loaded.physicalId === resource.physicalId && loaded.attributes === resource.attributes && !isHealExcludedType(resource.resourceType);
-}
+	}
+	isEligible(logicalId, resource) {
+		const { baseline } = this.deps;
+		const loaded = Object.hasOwn(baseline, logicalId) ? baseline[logicalId] : void 0;
+		return loaded !== void 0 && loaded.physicalId === resource.physicalId && loaded.attributes === resource.attributes && !isHealExcludedType(resource.resourceType);
+	}
+	async read(logicalId, resource, stackName) {
+		const { provider } = this.deps.providerRegistry.getProviderFor({
+			resourceType: resource.resourceType,
+			properties: resource.properties,
+			provisionedBy: resource.provisionedBy,
+			previousProperties: resource.properties
+		});
+		const outcome = await withPrintingSecrets(healPrintingBag(this.deps.baseline, logicalId, resource, this.deps.namingSecrets()), () => readRecordAttributes({
+			provider,
+			logicalId,
+			resource,
+			stackName,
+			region: this.deps.stackRegion
+		}));
+		if (outcome.kind !== "read") return outcome;
+		const { attributes } = outcome;
+		if (Object.keys(attributes).length > 0) this.healed.set(logicalId, {
+			physicalId: resource.physicalId,
+			resourceType: resource.resourceType,
+			attributes
+		});
+		this.deps.logger.debug(safeMsg`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS — its state record lacked one a Fn::GetAtt asked for: ${Object.keys(attributes).length} attribute(s) read`);
+		return outcome;
+	}
+	withHealedAttributes(logicalId, record) {
+		const healed = this.healed.get(logicalId);
+		if (healed === void 0 || healed.physicalId !== record.physicalId || healed.resourceType !== record.resourceType || !this.isEligible(logicalId, record)) return record;
+		const merged = mergeHealedAttributes(record.attributes, healed.attributes, (key, value, healedValue) => isStalePlaceholderArnAttribute(record.resourceType, key, value) || isMaskedOwnIdCopy(record, key, value, healedValue, this.deps.resolvedSecretsOf(logicalId)));
+		return merged === record.attributes || merged === void 0 ? record : {
+			...record,
+			attributes: merged
+		};
+	}
+	hasUnpersistedHeals(resources) {
+		for (const logicalId of this.healed.keys()) {
+			const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+			if (record !== void 0 && this.withHealedAttributes(logicalId, record) !== record) return true;
+		}
+		return false;
+	}
+};
 const healJudges = /* @__PURE__ */ new WeakMap();
-function healPrintingBag(baseline, logicalId, resource) {
-	if (!Object.hasOwn(baseline, logicalId) || baseline[logicalId] !== resource) return secretNamePrintingBag(logicalId, {
+function healPrintingBag(baseline, logicalId, resource, namingSecrets) {
+	if (!Object.hasOwn(baseline, logicalId) || baseline[logicalId] !== resource) return secretNamePrintingBags({
 		...baseline,
 		[logicalId]: resource
-	});
-	let judge = healJudges.get(baseline);
-	if (judge === void 0) {
-		judge = secretNamePrintingBags(baseline, void 0);
-		healJudges.set(baseline, judge);
-	}
-	return judge(logicalId);
-}
-async function readStaleAttributes(logicalId, resource, stackName) {
-	const { provider } = this.providerRegistry.getProviderFor({
-		resourceType: resource.resourceType,
-		properties: resource.properties,
-		provisionedBy: resource.provisionedBy,
-		previousProperties: resource.properties
-	});
-	const outcome = await withPrintingSecrets(healPrintingBag(this.healBaseline, logicalId, resource), () => readRecordAttributes({
-		provider,
-		logicalId,
-		resource,
-		stackName,
-		region: this.stackRegion
-	}));
-	if (outcome.kind !== "read") return outcome;
-	const { attributes } = outcome;
-	if (Object.keys(attributes).length > 0) this.healedAttributes.set(logicalId, {
-		physicalId: resource.physicalId,
-		resourceType: resource.resourceType,
-		attributes
-	});
-	this.logger.debug(safeMsg`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS — its state record lacked one a Fn::GetAtt asked for: ${Object.keys(attributes).length} attribute(s) read`);
-	return outcome;
-}
-function withHealedAttributes(logicalId, record) {
-	const healed = this.healedAttributes.get(logicalId);
-	if (healed === void 0 || healed.physicalId !== record.physicalId || healed.resourceType !== record.resourceType || !this.isHealEligible(logicalId, record)) return record;
-	const merged = mergeHealedAttributes(record.attributes, healed.attributes, (key, value, healedValue) => isStalePlaceholderArnAttribute(record.resourceType, key, value) || isMaskedOwnIdCopy(record, key, value, healedValue, this.perResourceSecrets.get(logicalId)));
-	return merged === record.attributes || merged === void 0 ? record : {
-		...record,
-		attributes: merged
-	};
-}
-function hasUnpersistedHeals(resources) {
-	for (const logicalId of this.healedAttributes.keys()) {
-		const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
-		if (record !== void 0 && this.withHealedAttributes(logicalId, record) !== record) return true;
+	}, namingSecrets)(logicalId);
+	let hit = healJudges.get(baseline);
+	if (hit === void 0 || hit.namingSecrets !== namingSecrets) {
+		hit = {
+			namingSecrets,
+			judge: secretNamePrintingBags(baseline, namingSecrets)
+		};
+		healJudges.set(baseline, hit);
 	}
-	return false;
+	return hit.judge(logicalId);
 }
 
 //#endregion
 //#region src/deployment/deploy-engine/record-shape.ts
-function auditResolvedAssetReferences(logicalId, resourceType, resolvedProps) {
-	const redirect = this.options.assetRedirect;
+function auditResolvedAssetReferences(options, logicalId, resourceType, resolvedProps) {
+	const redirect = options.assetRedirect;
 	if (!redirect) return;
 	const findings = findUnrewrittenAssetReferences(resolvedProps, redirect);
 	if (findings.length === 0) return;
@@ -38963,6 +39560,57 @@ function acceptedCreateOnlyDropsField(recordedProperties, resourceType, provisio
 	const names = findSilentDropProperties(resourceType, recordedProperties).map(({ property }) => property).filter((property) => createOnly.has(property) && (carried === void 0 || carried.has(property)));
 	return { acceptedCreateOnlyDrops: names.length > 0 ? names : void 0 };
 }
+function secretNamedAttributesField(result, previous) {
+	const reported = result.secretNamedAttributeNames;
+	const source = reported !== void 0 ? reported : previous?.secretNamedAttributes;
+	if (!Array.isArray(source)) return {};
+	const names = source.filter((name) => typeof name === "string" && name !== "");
+	return names.length > 0 ? { secretNamedAttributes: names } : {};
+}
+
+//#endregion
+//#region src/deployment/label-routing.ts
+function deriveLabelRouting(change, existingState, registry, forceCcApi = false) {
+	try {
+		if (change.changeType === "DELETE") return existingState?.provisionedBy;
+		return registry.getProviderFor({
+			resourceType: change.resourceType,
+			properties: change.desiredProperties ?? {},
+			provisionedBy: existingState?.provisionedBy,
+			previousProperties: existingState?.properties,
+			forceCcApi
+		}).provisionedBy;
+	} catch {
+		return;
+	}
+}
+
+//#endregion
+//#region src/deployment/deploy-engine/routing.ts
+function isPinnedToCcApi(options, stackName, logicalId) {
+	return options.pinCcApi?.stackName === stackName && options.pinCcApi.logicalIds.has(logicalId);
+}
+function recreateDirectionFor(options, stackName, logicalId) {
+	const targets = options.recreateTargets?.stackName === stackName ? options.recreateTargets : void 0;
+	if (targets === void 0) return void 0;
+	if (targets.viaCcApi.has(logicalId)) return "cc-api";
+	if (targets.viaSdkProvider.has(logicalId)) return "sdk";
+}
+function peekRoutingForLabel(providerRegistry, options, change, existingState, stackName, logicalId, needsReplacement = false, recreateDirection) {
+	if (needsReplacement) {
+		const hintRecord = {
+			...recreateDirection !== void 0 && { provisionedBy: recreateDirection },
+			...existingState?.properties !== void 0 && { properties: existingState.properties }
+		};
+		return deriveLabelRouting(change, hintRecord, providerRegistry, recreateDirection === "cc-api");
+	}
+	return deriveLabelRouting(change, existingState, providerRegistry, isPinnedToCcApi(options, stackName, logicalId));
+}
+function preparePropertiesForCcApi(providerRegistry, resourceType, resolvedProps, logicalId) {
+	const sdkProvider = providerRegistry.getRegisteredTypes().includes(resourceType) ? providerRegistry.getProvider(resourceType) : void 0;
+	if (sdkProvider?.preparePropertiesForFallback) return sdkProvider.preparePropertiesForFallback(logicalId, resourceType, resolvedProps);
+	return applyDefaultNameForFallback(logicalId, resourceType, resolvedProps);
+}
 
 //#endregion
 //#region src/utils/resource-line.ts
@@ -39063,12 +39711,12 @@ function buildResolverContext(base, stackName) {
 		...this.exportIndexStore && { exportIndex: this.exportIndexStore },
 		recordedImports: this.recordedImports,
 		recordedOutputReads: this.recordedOutputReads,
-		attributeHealer: (logicalId, resource) => this.healStaleAttributes(logicalId, resource, stackName),
+		attributeHealer: (logicalId, resource) => this.attributeHealer.heal(logicalId, resource, stackName),
 		...this.options.inheritedSecrets && hasMaskableValues(this.options.inheritedSecrets) && { inheritedSecrets: this.options.inheritedSecrets },
 		...this.options.inheritedPhysicalNameCopies && { inheritedPhysicalNameCopies: this.options.inheritedPhysicalNameCopies },
 		...this.options.inheritedReferenceProvenance && { inheritedReferenceProvenance: this.options.inheritedReferenceProvenance },
 		recordedSecretValues,
-		noEchoAttributeResources: this.noEchoAttributeResources,
+		noEchoAttributeResources: this.noEchoRun.noEchoAttributeResources,
 		secretNameNeedles: (logicalId) => this.noteSecretNamedRecord(logicalId, Object.hasOwn(base.resources, logicalId) ? base.resources[logicalId] : void 0),
 		producerSecrets: (logicalId) => this.perResourceSecrets.get(logicalId),
 		secretRegionEvidence: () => this.runProducerRegionEvidence?.(),
@@ -39143,7 +39791,7 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 		redactedAttributeReads: []
 	}, stackName);
 	if (context.recordedSecretValues) this.perResourceSecrets.set(logicalId, context.recordedSecretValues);
-	const noEchoOverrides = await this.noEchoAttributeOverridesFor(desiredProps, stateResources, stackName);
+	const noEchoOverrides = await noEchoAttributeOverridesFor(this.noEchoRun, this.noEchoDeps(), desiredProps, stateResources, stackName);
 	if (noEchoOverrides !== void 0) context.noEchoAttributeOverrides = noEchoOverrides;
 	printNestedStackReadsOnly(context, resourceType, this.secretNameBagFor(logicalId));
 	const resolvedProps = await this.resolver.resolve(desiredProps, context);
@@ -39161,17 +39809,17 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 	]), inputFingerprinter(desiredProps, fingerprintSources)));
 	this.perResourceResolvedType.set(logicalId, resourceType);
 	const createSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
-	if (resourceType === "AWS::CloudFormation::Stack") recordPassedNoEchoParameters(createSecrets, desiredProps["Parameters"], this.noEchoPositionSources(stateResources));
+	if (resourceType === "AWS::CloudFormation::Stack") recordPassedNoEchoParameters(createSecrets, desiredProps["Parameters"], noEchoPositionSources(this.noEchoRun, stateResources));
 	if (fingerprintSources !== void 0 && resourceType === "AWS::CloudFormation::Stack") recordPassedParameterClasses(createSecrets, await classifyPassedParameters(desiredProps["Parameters"], fingerprintSources));
 	recordNestedStackParameterExpressions(createSecrets, resourceType, resolvedProps, desiredProps);
-	this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
+	auditResolvedAssetReferences(this.options, logicalId, resourceType, resolvedProps);
 	this.attemptedResolvedProps.set(logicalId, resolvedProps);
 	const createDecision = this.providerRegistry.getProviderFor({
 		resourceType,
 		properties: resolvedProps
 	});
 	const createProvider = createDecision.provider;
-	const createProps = createDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
+	const createProps = createDecision.provisionedBy === "cc-api" ? preparePropertiesForCcApi(this.providerRegistry, resourceType, resolvedProps, logicalId) : resolvedProps;
 	const resumed = await resumeAbandonedCreate.call(this, {
 		logicalId,
 		resourceType,
@@ -39214,23 +39862,28 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 	}
 	this.generatedNameGuard?.noteReturned(logicalId);
 	this.registerNoEchoAttributes(logicalId, result, createSecrets, resolvedProps);
-	const dependencies = this.extractAllDependencies(template, logicalId);
-	const templateAttrs = this.extractTemplateAttributes(template, logicalId);
-	const recordedProperties = this.propertiesToRecord(resolvedProps, result, resourceType, createDecision.provisionedBy);
+	const dependencies = extractAllDependencies(template, logicalId);
+	const templateAttrs = extractTemplateAttributes(template, logicalId);
+	const recordedProperties = propertiesToRecord(resolvedProps, result, resourceType, createDecision.provisionedBy);
 	stateResources[logicalId] = {
 		physicalId: result.physicalId,
 		resourceType,
 		properties: recordedProperties,
 		...acceptedCreateOnlyDropsField(recordedProperties, resourceType, createDecision.provisionedBy, "new-resource"),
 		...result.attributes && { attributes: result.attributes },
+		...secretNamedAttributesField(result),
 		...dependencies && dependencies.length > 0 && { dependencies },
 		...templateAttrs,
 		provisionedBy: createDecision.provisionedBy
 	};
 	this.recordInlinePolicyWrite(logicalId, "create");
-	await this.establishNoEchoEchoFidelity(logicalId, stateResources[logicalId], resolvedProps, stateResources, createSecrets);
-	const createCaptureSiblings = await this.buildObservedCaptureSiblings(resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
-	this.kickOffObservedCapture(createProvider, logicalId, result.physicalId, resourceType, resolvedProps, {
+	await establishNoEchoEchoFidelity(this.noEchoRun, this.noEchoDeps(), logicalId, stateResources[logicalId], resolvedProps, stateResources, createSecrets);
+	const createCaptureSiblings = await buildObservedCaptureSiblings({
+		options: this.options,
+		buildResolverContext: (...args) => this.buildResolverContext(...args),
+		resolver: this.resolver
+	}, resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
+	this.observedCapture.kickOffObservedCapture(createProvider, logicalId, result.physicalId, resourceType, resolvedProps, {
 		...createCaptureSiblings,
 		afterOwnWrite: true
 	}, createSecrets);
@@ -39722,7 +40375,7 @@ var DynamoDBGlobalTableProvider = class {
 				warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the state record declares no BillingMode, so this replay creates the table PAY_PER_REQUEST. If it was PROVISIONED, set the mode in the template and redeploy.`);
 			}
 		} catch (error) {
-			throw new ProvisioningError(log.mask(error instanceof Error ? error.message : String(error)), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			throw new ProvisioningError(log.mask(describeAwsFailure(error).detail), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 		}
 		const currentRegion = await this.dynamoDBClient.config.region() ?? "";
 		const replicas = properties["Replicas"] ?? [];
@@ -39752,7 +40405,7 @@ var DynamoDBGlobalTableProvider = class {
 					replayDowngrade(message);
 				} } : {});
 			} catch (error) {
-				throw new ProvisioningError(log.mask(error instanceof Error ? error.message : String(error)), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+				throw new ProvisioningError(log.mask(describeAwsFailure(error).detail), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 			}
 			createParams.StreamSpecification = {
 				StreamEnabled: true,
@@ -39783,7 +40436,7 @@ var DynamoDBGlobalTableProvider = class {
 				onUnusableCreateIndexes(`${message} Omitting the malformed block, so this create carries NO indexes; the same value is REFUSED on a template-path create`);
 			}), maskSecrets);
 		} catch (error) {
-			throw new ProvisioningError(log.mask(error instanceof Error ? error.message : String(error)), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			throw new ProvisioningError(log.mask(describeAwsFailure(error).detail), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 		}
 		let wiringProperties = properties;
 		if (indexesOmitted) {
@@ -40429,7 +41082,7 @@ var DynamoDBGlobalTableProvider = class {
 					try {
 						await this.dynamoDBClient.send(cmd);
 					} catch (ttlErr) {
-						if ((ttlErr instanceof Error ? ttlErr.message : String(ttlErr)).includes("Time to live has been modified multiple times")) throw this.wrapMaskedError(log, ttlErr, (text) => new ProvisioningError(`AWS rejected TimeToLive update on ${log.value(physicalId)}: ${text}. AWS enforces a ~4-hour rate limit on TTL changes per table; wait and redeploy, or keep the previous TTL state in this deploy.`, resourceType, logicalId, physicalId, ttlErr instanceof Error ? ttlErr : void 0));
+						if (describeAwsFailure(ttlErr).detail.includes("Time to live has been modified multiple times")) throw this.wrapMaskedError(log, ttlErr, (text) => new ProvisioningError(`AWS rejected TimeToLive update on ${log.value(physicalId)}: ${text}. AWS enforces a ~4-hour rate limit on TTL changes per table; wait and redeploy, or keep the previous TTL state in this deploy.`, resourceType, logicalId, physicalId, ttlErr instanceof Error ? ttlErr : void 0));
 						throw ttlErr;
 					}
 				};
@@ -40876,7 +41529,7 @@ var DynamoDBGlobalTableProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete DynamoDB GlobalTable ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete DynamoDB GlobalTable ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async isSameResource(journaledPhysicalId, record, resourceType, context) {
@@ -42263,333 +42916,6 @@ function withRefreshedReadVersions(record, unchanged) {
 	return withReferenceProvenance(record, out);
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/noecho.ts
-function noEchoExactEchoLeavesOf(record) {
-	const field = record?.noEchoExactEchoLeaves;
-	if (!Array.isArray(field)) return void 0;
-	const out = [];
-	for (const entry of field) {
-		if (!Array.isArray(entry) || entry.length === 0) return void 0;
-		if (!entry.every((segment) => typeof segment === "string")) return void 0;
-		out.push([...entry]);
-	}
-	return out;
-}
-function echoFidelityCandidates(coordinates, resolved, createOnly) {
-	const out = [];
-	for (const coordinate of coordinates) {
-		if (!coordinate.every((segment) => typeof segment === "string")) continue;
-		const keys = coordinate;
-		if (!createOnly.some((path) => path.length <= keys.length && path.every((s, i) => s === keys[i]))) continue;
-		const plaintext = valueAtCoordinate(resolved, keys);
-		if (typeof plaintext !== "string" || carriesSecretMask(plaintext)) continue;
-		out.push({
-			coordinate: keys,
-			plaintext
-		});
-	}
-	return out;
-}
-function reportedLeafAt(live, handed, candidate) {
-	if (valueAtCoordinate(handed, candidate.coordinate) !== "***") return void 0;
-	const leaf = valueAtCoordinate(live, candidate.coordinate);
-	return typeof leaf === "string" && !carriesSecretMask(leaf) ? leaf : void 0;
-}
-function echoesExactlyAt(live, handed, candidate) {
-	return reportedLeafAt(live, handed, candidate) === candidate.plaintext;
-}
-function provesEchoChangeAt(live, handed, candidate) {
-	const reported = reportedLeafAt(live, handed, candidate);
-	return reported !== void 0 && reported !== candidate.plaintext;
-}
-function noteNoEchoExactEchoes(logicalId, physicalId, read, handed, candidates, mode) {
-	const exact = "failure" in read ? [] : candidates.filter((candidate) => echoesExactlyAt(read.live, handed, candidate)).map((candidate) => [...candidate.coordinate]);
-	const noted = this.noEchoExactEchoes.get(logicalId);
-	const previous = mode === "add" && noted?.physicalId === physicalId ? noted.coordinates : [];
-	this.noEchoExactEchoes.set(logicalId, {
-		physicalId,
-		coordinates: sortedCoordinates([...previous, ...exact])
-	});
-}
-function sortedCoordinates(coordinates) {
-	const keyed = /* @__PURE__ */ new Map();
-	for (const coordinate of coordinates) keyed.set(JSON.stringify(coordinate), [...coordinate]);
-	return [...keyed.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([, c]) => c);
-}
-async function establishNoEchoEchoFidelity(logicalId, record, resolvedProps, stateResources, secrets) {
-	this.noEchoExactEchoes.delete(logicalId);
-	const templateProps = this.perResourceTemplateProps.get(logicalId);
-	const sources = this.noEchoPositionSources(stateResources);
-	if (templateProps === void 0 || sources === void 0 || sources.parameters.size === 0) return;
-	const coordinates = canonicalCoordinates(noEchoCoordinatesOf(templateProps, resolvedProps, {
-		parameters: sources.parameters,
-		...sources.conditions !== void 0 && { conditions: sources.conditions }
-	}));
-	if (coordinates.length === 0) return;
-	const candidates = echoFidelityCandidates(coordinates, resolvedProps, await getCreateOnlyPropertyPaths(record.resourceType).catch(() => []));
-	if (candidates.length === 0) return;
-	const handed = {
-		...record,
-		properties: maskAtCoordinates(record.properties, coordinates)
-	};
-	const read = await this.readReaderForFreshNoEchoCeiling(logicalId, handed, secrets);
-	this.noteNoEchoExactEchoes(logicalId, record.physicalId, read, handed.properties, candidates, "set");
-}
-function withNoEchoExactEchoes(logicalId, record) {
-	const noted = this.noEchoExactEchoes.get(logicalId);
-	if (noted === void 0 || noted.coordinates.length === 0) return record;
-	if (noted.physicalId !== record.physicalId) return record;
-	const merged = sortedCoordinates([...noEchoExactEchoLeavesOf(record) ?? [], ...noted.coordinates]);
-	return {
-		...record,
-		noEchoExactEchoLeaves: merged
-	};
-}
-function noEchoParameterNamesOf(template) {
-	const names = /* @__PURE__ */ new Set();
-	const declared = template?.Parameters;
-	if (declared === null || typeof declared !== "object") return names;
-	for (const [name, definition] of Object.entries(declared)) if (declaresNoEcho(definition)) names.add(name);
-	return names;
-}
-function noEchoAttributeNamesOf(record) {
-	const field = record?.noEchoAttributeNames;
-	if (!Array.isArray(field) || !field.every((name) => typeof name === "string")) return void 0;
-	return field;
-}
-function noEchoPositionSources(resources = {}, template = this.constructPathTemplate, conditions = this.noEchoConditions) {
-	if (template === void 0) return void 0;
-	const declared = this.noEchoAttributeResources;
-	return {
-		parameters: /* @__PURE__ */ new Set([...noEchoParameterNamesOf(template), ...this.inheritedNoEchoParameters]),
-		attributeIsNoEcho: (logicalId, attribute) => {
-			const live = declared.get(logicalId);
-			if (live === true || live !== void 0 && live.has(attribute)) return true;
-			if (noEchoAttributeNamesOf(Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0)?.includes(attribute) === true) return true;
-			return this.persistedNoEchoAttributes.get(logicalId)?.has(attribute) === true;
-		},
-		...conditions !== void 0 && { conditions }
-	};
-}
-function noEchoLeavesFor(logicalId, record, templateProps, sources) {
-	if (templateProps !== void 0 && isWrittenFromDeployedTemplate(record.properties)) return canonicalCoordinates(noEchoCoordinatesOf(templateProps, record.properties, sources));
-	const existing = noEchoLeavesOf(record);
-	if (existing !== void 0) {
-		const confirmed = this.witnessConfirmedLeaves.get(logicalId) ?? [];
-		return canonicalCoordinates([...existing, ...confirmed]);
-	}
-	const resolvedAsSame = this.perResourceResolvedType.get(logicalId) === record.resourceType;
-	const source = (templateProps !== void 0 && resolvedAsSame ? templateProps : void 0) ?? templatePropertiesFor(this, logicalId, record.resourceType);
-	if (source === void 0) return void 0;
-	return canonicalCoordinates(noEchoCoordinatesOf(source, record.properties, sources));
-}
-function templatePropertiesFor(engine, logicalId, resourceType) {
-	const resources = engine.constructPathTemplate?.Resources;
-	if (resources === void 0 || !Object.hasOwn(resources, logicalId)) return void 0;
-	const definition = resources[logicalId];
-	if (definition?.Type !== resourceType) return void 0;
-	const properties = definition.Properties;
-	return properties !== null && typeof properties === "object" && !Array.isArray(properties) ? properties : void 0;
-}
-function noEchoAttributeNamesFor(engine, logicalId, record, carried, leaves) {
-	const attributes = record.attributes ?? {};
-	const names = /* @__PURE__ */ new Set();
-	let echoed = false;
-	for (const coordinate of leaves ?? []) {
-		const value = valueAtCoordinate(record.properties, coordinate);
-		if (value === void 0 || carriesSecretMask(value)) continue;
-		for (const [name, attribute] of Object.entries(attributes)) {
-			if (carriesSecretMask(attribute)) continue;
-			if (typeof attribute === "string" && attribute === record.physicalId) continue;
-			const sameName = coordinate[0] === name && keyOrderFreeJson(attribute) === keyOrderFreeJson(value);
-			const embeds = typeof value === "string" && typeof attribute === "string" && !attribute.startsWith("arn:") && value.length >= 4 && typeof attribute === "string" && attribute.includes(value);
-			if (sameName || embeds) {
-				names.add(name);
-				echoed = true;
-			}
-		}
-	}
-	const declared = carried ? void 0 : engine.noEchoAttributeResources.get(logicalId);
-	if (declared === true) for (const name of Object.keys(attributes)) names.add(name);
-	else if (declared !== void 0) {
-		for (const name of declared) if (Object.hasOwn(attributes, name)) names.add(name);
-	}
-	const prior = noEchoAttributeNamesOf(record);
-	for (const name of prior ?? []) if (Object.hasOwn(attributes, name) && carriesSecretMask(attributes[name])) names.add(name);
-	if (declared === void 0 && prior === void 0 && !echoed) return void 0;
-	return [...names].sort();
-}
-function applyNoEchoPersist(logicalId, record, scrubbed, templateProps, resources, secrets, carried = false) {
-	const sources = this.noEchoPositionSources(resources);
-	if (sources === void 0) return scrubbed;
-	const leaves = this.noEchoLeavesFor(logicalId, record, templateProps, sources);
-	const names = noEchoAttributeNamesFor(this, logicalId, record, carried, leaves);
-	if (leaves === void 0 && names === void 0) return scrubbed;
-	const next = { ...scrubbed };
-	if (leaves !== void 0) {
-		next.properties = maskAtCoordinates(scrubbed.properties, leaves);
-		if (scrubbed.observedProperties !== void 0 && leaves.length > 0) Object.assign(next, { observedProperties: maskReadbackAtCoordinates(scrubbed.observedProperties, record.properties, leaves) });
-		if (leaves.length > 0) next.noEchoLeaves = leaves;
-		else delete next.noEchoLeaves;
-		const marked = new Set(leaves.map((coordinate) => JSON.stringify(coordinate)));
-		const exact = (noEchoExactEchoLeavesOf(scrubbed) ?? []).filter((coordinate) => marked.has(JSON.stringify(coordinate)));
-		if (exact.length > 0) next.noEchoExactEchoLeaves = exact;
-		else delete next.noEchoExactEchoLeaves;
-	}
-	if (names !== void 0) {
-		if (scrubbed.attributes !== void 0 && names.length > 0) {
-			const attributes = { ...scrubbed.attributes };
-			for (const name of names) if (Object.hasOwn(attributes, name)) attributes[name] = maskWholeValue(attributes[name]);
-			next.attributes = attributes;
-		}
-		if (names.length > 0) next.noEchoAttributeNames = names;
-		else delete next.noEchoAttributeNames;
-	}
-	this.warnNoEchoPhysicalId(logicalId, record, secrets);
-	return next;
-}
-function warnNoEchoPhysicalId(logicalId, record, secrets) {
-	if (secrets === void 0 || this.noEchoPhysicalIdWarned.has(logicalId)) return;
-	const values = noEchoParameterPlaintextsOf(secrets);
-	if (values.length === 0 || typeof record.physicalId !== "string") return;
-	if (!values.some((value) => record.physicalId.includes(value))) return;
-	this.noEchoPhysicalIdWarned.add(logicalId);
-	this.logger.warn(this.maskForResource(logicalId, safeMsg`${logicalId}: its physical id contains a NoEcho parameter value. AWS publishes a resource's name, so cdkd keeps the physical id in state as AWS returns it.`));
-}
-function seedPersistedNoEchoAttributes(resources) {
-	this.persistedNoEchoAttributes = /* @__PURE__ */ new Map();
-	for (const [logicalId, record] of Object.entries(resources)) {
-		const names = noEchoAttributeNamesOf(record);
-		if (names !== void 0 && names.length > 0) this.persistedNoEchoAttributes.set(logicalId, new Set(names));
-	}
-}
-function maskOutputsByPosition(outputs) {
-	const sources = this.noEchoPositionSources();
-	if (sources === void 0) return outputs;
-	const templateValues = Object.create(null);
-	for (const [name, definition] of Object.entries(this.constructPathTemplate?.Outputs ?? {})) templateValues[name] = definition?.Value;
-	if (this.outputsSourceUsable) for (const [name, value] of Object.entries(this.outputsTemplateSource)) templateValues[name] = value;
-	const coordinates = noEchoCoordinatesOf(templateValues, outputs, sources);
-	if (coordinates.length === 0) return outputs;
-	const maskedValues = new Set(coordinates.filter((coordinate) => coordinate.length === 1 && typeof coordinate[0] === "string").map((coordinate) => keyOrderFreeJson(outputs[coordinate[0]])));
-	const aliasCoordinates = Object.keys(outputs).filter((key) => !Object.hasOwn(templateValues, key) && outputs[key] !== void 0 && !carriesSecretMask(outputs[key]) && maskedValues.has(keyOrderFreeJson(outputs[key]))).map((key) => [key]);
-	return maskAtCoordinates(outputs, [...coordinates, ...aliasCoordinates]);
-}
-function getAttTargetsOf(node) {
-	const targets = [];
-	const seen = /* @__PURE__ */ new Set();
-	const subVariable = /\$\{([^}!][^}]*)\}/g;
-	const walk = (value) => {
-		if (value === null || typeof value !== "object" || seen.has(value)) return;
-		seen.add(value);
-		if (Array.isArray(value)) {
-			for (const item of value) walk(item);
-			return;
-		}
-		const record = value;
-		const getAtt = record["Fn::GetAtt"];
-		if (typeof getAtt === "string" && getAtt.indexOf(".") > 0) {
-			const dot = getAtt.indexOf(".");
-			targets.push([getAtt.slice(0, dot), getAtt.slice(dot + 1)]);
-		} else if (Array.isArray(getAtt) && typeof getAtt[0] === "string" && typeof getAtt[1] === "string") targets.push([getAtt[0], getAtt[1]]);
-		const sub = record["Fn::Sub"];
-		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
-		if (typeof text === "string") for (const match of text.matchAll(subVariable)) {
-			const name = match[1].trim();
-			const dot = name.indexOf(".");
-			if (dot > 0) targets.push([name.slice(0, dot), name.slice(dot + 1)]);
-		}
-		for (const child of Object.values(record)) walk(child);
-	};
-	walk(node);
-	return targets;
-}
-async function noEchoAttributeOverridesFor(desiredProps, stateResources, stackName) {
-	const wanted = /* @__PURE__ */ new Map();
-	for (const [logicalId, attribute] of getAttTargetsOf(desiredProps)) {
-		const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
-		if (record === void 0) continue;
-		if (noEchoAttributeNamesOf(record)?.includes(attribute) !== true) continue;
-		if (!carriesSecretMask(record.attributes?.[attribute])) continue;
-		if (!this.perResourceSecrets.has(logicalId)) continue;
-		const set = wanted.get(logicalId) ?? /* @__PURE__ */ new Set();
-		set.add(attribute);
-		wanted.set(logicalId, set);
-	}
-	if (wanted.size === 0) return void 0;
-	const overrides = /* @__PURE__ */ new Map();
-	for (const [logicalId, attributes] of wanted) {
-		const record = stateResources[logicalId];
-		let read = this.noEchoAttributeReads.get(logicalId);
-		if (read === void 0) {
-			read = (async () => {
-				try {
-					const { provider } = this.providerRegistry.getProviderFor({
-						resourceType: record.resourceType,
-						properties: record.properties,
-						provisionedBy: record.provisionedBy,
-						previousProperties: record.properties
-					});
-					const outcome = await readRecordAttributes({
-						provider,
-						logicalId,
-						resource: record,
-						stackName,
-						region: this.stackRegion
-					});
-					return outcome.kind === "read" ? outcome.attributes : void 0;
-				} catch {
-					return;
-				}
-			})();
-			this.noEchoAttributeReads.set(logicalId, read);
-		}
-		const live = await read;
-		if (live === void 0) continue;
-		const secrets = this.perResourceSecrets.get(logicalId);
-		const fresh = noEchoParameterPlaintextsOf(secrets);
-		const positioned = this.noEchoPositionedValues.get(logicalId) ?? /* @__PURE__ */ new Set();
-		const served = {};
-		for (const attribute of attributes) {
-			if (!Object.hasOwn(live, attribute)) continue;
-			const value = live[attribute];
-			if (typeof value === "string" && fresh.some((needle) => value === needle || value.includes(needle)) || value !== void 0 && positioned.has(keyOrderFreeJson(value))) served[attribute] = value;
-		}
-		if (Object.keys(served).length > 0) overrides.set(logicalId, served);
-	}
-	return overrides.size > 0 ? overrides : void 0;
-}
-function noEchoDiffComparison(resources, template, conditions, parameterValues, stackName) {
-	const sources = this.noEchoPositionSources(resources, template, conditions);
-	if (sources === void 0) return void 0;
-	const compare = noEchoComparison({
-		sources,
-		values: parameterValues,
-		minNeedleLength: 4,
-		publicTokens: /* @__PURE__ */ new Set([this.stackRegion, ...stackName === void 0 ? [] : [stackName]])
-	});
-	return (input) => compare(input);
-}
-function freshNoEchoParametersWithDeclared(inherited, template) {
-	const all = /* @__PURE__ */ new Set([...inherited ?? [], ...noEchoParameterNamesOf(template)]);
-	return all.size > 0 ? all : void 0;
-}
-function noEchoComparisonForTemplate(template, knownConditions, values, resources, publicTokens, inheritedNoEchoParameters) {
-	const sources = {
-		parameters: /* @__PURE__ */ new Set([...noEchoParameterNamesOf(template), ...inheritedNoEchoParameters ?? []]),
-		attributeIsNoEcho: (logicalId, attribute) => noEchoAttributeNamesOf(Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0)?.includes(attribute) === true,
-		...knownConditions !== void 0 && { conditions: knownConditions }
-	};
-	const compare = noEchoComparison({
-		sources,
-		values: values ?? {},
-		minNeedleLength: 4,
-		...publicTokens !== void 0 && { publicTokens }
-	});
-	return (input) => compare(input);
-}
-
 //#endregion
 //#region src/analyzer/security-changes.ts
 const RESOURCE_SCRUTINY = {
@@ -44081,7 +44407,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	}, stackName);
 	const updateSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
 	this.perResourceSecrets.set(logicalId, updateSecrets);
-	const noEchoOverrides = await this.noEchoAttributeOverridesFor(desiredProps, stateResources, stackName);
+	const noEchoOverrides = await noEchoAttributeOverridesFor(this.noEchoRun, this.noEchoDeps(), desiredProps, stateResources, stackName);
 	if (noEchoOverrides !== void 0) context.noEchoAttributeOverrides = noEchoOverrides;
 	printNestedStackReadsOnly(context, resourceType, this.secretNameBagFor(logicalId));
 	const resolvedProps = await this.resolver.resolve(desiredProps, context);
@@ -44093,7 +44419,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	this.perResourceTemplateProps.set(logicalId, desiredProps);
 	this.perResourceResolvedType.set(logicalId, resourceType);
 	recordNestedStackParameterExpressions(updateSecrets, resourceType, resolvedProps, desiredProps);
-	this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
+	auditResolvedAssetReferences(this.options, logicalId, resourceType, resolvedProps);
 	const lostCandidate = childLostWithRecreatedParent({
 		resourceType,
 		templateProperties: desiredProps,
@@ -44104,7 +44430,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	const lostChild = lostCandidate?.mode === "reattach" || lostCandidate !== void 0 && Object.hasOwn(resolvedProps, lostCandidate.property) && Object.hasOwn(currentProps, lostCandidate.property) && keyOrderFreeJson(resolvedProps[lostCandidate.property]) === keyOrderFreeJson(currentProps[lostCandidate.property]) ? lostCandidate : void 0;
 	const lostWithParent = lostChild?.mode === "recreate" ? lostChild.parent : void 0;
 	this.registerNoEchoAttributes(logicalId, Object.assign(currentResource.attributes === void 0 ? {} : { attributes: currentResource.attributes }, { physicalId: currentResource.physicalId }), updateSecrets, resolvedProps);
-	const noEchoSources = this.noEchoPositionSources(stateResources, template, conditions);
+	const noEchoSources = noEchoPositionSources(this.noEchoRun, stateResources, template, conditions);
 	const parameterCoordinates = noEchoSources === void 0 ? [] : canonicalCoordinates(noEchoCoordinatesOf(desiredProps, resolvedProps, {
 		parameters: noEchoSources.parameters,
 		...noEchoSources.conditions !== void 0 && { conditions: noEchoSources.conditions }
@@ -44121,7 +44447,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		return resolved !== void 0 && !carriesSecretMask(resolved);
 	});
 	const comparisonCoordinates = canonicalCoordinates([...noEchoCoordinates, ...staleCoordinates]);
-	if (parameterCoordinates.length > 0) this.noEchoPositionedValues.set(logicalId, new Set(parameterCoordinates.map((coordinate) => keyOrderFreeJson(valueAtCoordinate(resolvedProps, coordinate)))));
+	if (parameterCoordinates.length > 0) this.noEchoRun.noEchoPositionedValues.set(logicalId, new Set(parameterCoordinates.map((coordinate) => keyOrderFreeJson(valueAtCoordinate(resolvedProps, coordinate)))));
 	const fingerprintSources = template && this.maskedInputSources(template, stateResources, conditions, stackName);
 	const fingerprints = fingerprintSources && inputFingerprinter(desiredProps, fingerprintSources);
 	const movedMasked = new Set(await movedMaskedProperties(currentResource, desiredProps, fingerprints));
@@ -44130,7 +44456,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		this.fingerprintNoEchoValues,
 		this.options.inheritedSecrets
 	]), fingerprints));
-	if (resourceType === "AWS::CloudFormation::Stack") recordPassedNoEchoParameters(updateSecrets, desiredProps["Parameters"], this.noEchoPositionSources(stateResources));
+	if (resourceType === "AWS::CloudFormation::Stack") recordPassedNoEchoParameters(updateSecrets, desiredProps["Parameters"], noEchoPositionSources(this.noEchoRun, stateResources));
 	if (fingerprintSources !== void 0 && resourceType === "AWS::CloudFormation::Stack") recordPassedParameterClasses(updateSecrets, await classifyPassedParameters(desiredProps["Parameters"], fingerprintSources));
 	const desiredForSkipCheck = maskAtCoordinates(redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps), comparisonCoordinates);
 	const legacyDesired = withoutPhysicalNameCopies(updateSecrets, () => maskAtCoordinates(redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps), comparisonCoordinates));
@@ -44146,6 +44472,23 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		const repaired = repairEmbeddedPhysicalNamesTowards(repairPhysicalNameCopyLeaves(bag[key], legacyDesired[key], desiredForSkipCheck[key]), desiredForSkipCheck[key], embeddedRewrites);
 		if (repaired !== bag[key]) bag[key] = repaired;
 	}
+	if (overlapRuleAnswered(updateSecrets)) {
+		const legacyOverlapBag = withLegacyOverlapScan(updateSecrets, () => maskAtCoordinates(redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps), comparisonCoordinates));
+		const legacyOverlap = legacyReferenceLeavesOnly(legacyOverlapBag);
+		for (const bag of new Set(repairable)) for (const key of Object.keys(bag)) {
+			const repaired = repairPhysicalNameCopyLeaves(bag[key], legacyOverlap[key], desiredForSkipCheck[key]);
+			if (repaired !== bag[key]) bag[key] = repaired;
+		}
+		const pairs = differingStringLeaves(legacyOverlap, desiredForSkipCheck);
+		for (const field of ["attributes", "observedProperties"]) {
+			const target = currentResource[field];
+			if (target === void 0 || target === null || pairs.length === 0) continue;
+			for (const key of Object.keys(target)) {
+				const repaired = replaceWholeLeaves(target[key], pairs);
+				if (repaired !== target[key]) target[key] = repaired;
+			}
+		}
+	}
 	const attributes = currentResource.attributes;
 	if (attributes !== void 0 && attributes !== null && embeddedRewrites.length > 0) for (const key of Object.keys(attributes)) {
 		const repaired = replaceEmbeddedPhysicalNameRewrites(attributes[key], embeddedRewrites);
@@ -44161,7 +44504,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	const witness = todayAsWritten === void 0 ? void 0 : witnessNormalize(recordedAsWritten, todayAsWritten, desiredForSkipCheckAsWritten);
 	const currentPropsAsWritten = witness === void 0 ? recordedAsWritten : witness.current;
 	const witnessMigrates = unmarkedRecord || (witness?.confirmed.length ?? 0) > 0;
-	if (!unmarkedRecord && witness !== void 0 && witness.confirmed.length > 0) this.witnessConfirmedLeaves.set(logicalId, witness.confirmed.map((coordinate) => [...coordinate]));
+	if (!unmarkedRecord && witness !== void 0 && witness.confirmed.length > 0) this.noEchoRun.witnessConfirmedLeaves.set(logicalId, witness.confirmed.map((coordinate) => [...coordinate]));
 	for (const coordinate of witness?.differing ?? []) {
 		const desiredAt = valueAtCoordinate(desiredForSkipCheckAsWritten, coordinate);
 		recordPreviousNoEchoLeaves(this.secretNameBagFor(logicalId), valueAtCoordinate(recordedAsWritten, coordinate), scalarLeavesOf(desiredAt), updateSecrets, desiredAt !== "***");
@@ -44236,7 +44579,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		this.logger.info(safeMsg`  ↻ ${logicalId} (${resourceType}) attribute update: ${attrSummary}`);
 		stateResources[logicalId] = {
 			...stateResources[logicalId] ?? currentResource,
-			...this.extractTemplateAttributes(template, logicalId)
+			...extractTemplateAttributes(template, logicalId)
 		};
 		if (counts) counts.updated++;
 		if (progress) progress.current++;
@@ -44252,7 +44595,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	} : currentResource;
 	let readback;
 	const readOnce = () => readback ??= this.readReaderForFreshNoEchoCeiling(logicalId, readbackRecord, updateSecrets).then((read) => {
-		this.noteNoEchoExactEchoes(logicalId, currentResource.physicalId, read, readbackRecord.properties, echoCandidates, "add");
+		noteNoEchoExactEchoes(this.noEchoRun, logicalId, currentResource.physicalId, read, readbackRecord.properties, echoCandidates, "add");
 		return read;
 	});
 	const exactEchoCoordinates = new Set((noEchoExactEchoLeavesOf(currentResource) ?? []).map((c) => JSON.stringify(c)));
@@ -44304,7 +44647,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	const lateReplacementDeclined = /* @__PURE__ */ new Set();
 	const differsWhy = (key) => !lateReplacementDeclined.has(key) ? "differs; the provider is not known to report this property exactly, so the difference may be its normalization" : lateCrossPrefixRefused ? "differs; the replacement was refused: see the state-prefix warning above" : `differs; the replacement was not approved (--require-approval=${this.options.requireApproval ?? "never"})`;
 	if (witnessMigrates && !typeChanged && echoCandidates.length > 0 && hasAddressablePhysicalId(currentResource)) await readOnce();
-	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && recordMatchesDesired) {
+	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && recreateDirectionFor(this.options, stackName, logicalId) === void 0 && recordMatchesDesired) {
 		if (provenanceUnchanged.length > 0) stateResources[logicalId] = withRefreshedReadVersions(stateResources[logicalId] ?? currentResource, provenanceUnchanged);
 		if (change.attributeChanges && change.attributeChanges.length > 0) {
 			applyAttributeOnlyUpdate(change.attributeChanges);
@@ -44390,7 +44733,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		};
 		const lowered = [];
 		const movedAt = (path) => movedMasked.has(path) || rewrittenPaths.has(path) || keyOrderFreeJson(desiredForSkipCheckAsWritten[path]) !== keyOrderFreeJson(currentPropsAsWritten[path]);
-		replacedAnyway = this.recreateDirectionFor(stackName, logicalId) !== void 0 || lostWithParent !== void 0 || (change.propertyChanges ?? []).some((other) => other.requiresReplacement && (!parameterCreateOnlyPaths.has(other.path) || movedAt(other.path)));
+		replacedAnyway = recreateDirectionFor(this.options, stackName, logicalId) !== void 0 || lostWithParent !== void 0 || (change.propertyChanges ?? []).some((other) => other.requiresReplacement && (!parameterCreateOnlyPaths.has(other.path) || movedAt(other.path)));
 		for (const pc of change.propertyChanges ?? []) {
 			if (!parameterCreateOnlyPaths.has(pc.path)) {
 				lowered.push(pc);
@@ -44437,7 +44780,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		}
 	}
 	const confirmedPaths = /* @__PURE__ */ new Set([...noEchoHeldPaths, ...parameterSettledPaths]);
-	if (confirmedPaths.size > 0 && !typeChanged && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && recordMatchesDesired && Object.keys(resolvedProps).every((key) => confirmedPaths.has(key) || otherFreshAt(key).length === 0 && !pendingParameterLeaves.has(key))) {
+	if (confirmedPaths.size > 0 && !typeChanged && lostChild === void 0 && recreateDirectionFor(this.options, stackName, logicalId) === void 0 && recordMatchesDesired && Object.keys(resolvedProps).every((key) => confirmedPaths.has(key) || otherFreshAt(key).length === 0 && !pendingParameterLeaves.has(key))) {
 		this.logger.debug(safeMsg`Skipping ${logicalId}: AWS already holds every NoEcho value it carries, and nothing else changed`);
 		const staleHeld = staleCoordinates.filter((coordinate) => typeof coordinate[0] === "string" && parameterHeldKeys.has(coordinate[0]));
 		if (staleHeld.length > 0) {
@@ -44480,7 +44823,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	}
 	const liveLabel = this.liveTaskLabels.get(logicalId);
 	if (needsReplacement && liveLabel !== void 0 && !liveLabel.replacing) {
-		const label = `Replacing ${logicalId} (${resourceType})${this.peekRoutingForLabel(change, currentResource, stackName, logicalId, true, this.recreateDirectionFor(stackName, logicalId)) === "cc-api" ? " [CC API]" : ""}`;
+		const label = `Replacing ${logicalId} (${resourceType})${peekRoutingForLabel(this.providerRegistry, this.options, change, currentResource, stackName, logicalId, true, recreateDirectionFor(this.options, stackName, logicalId)) === "cc-api" ? " [CC API]" : ""}`;
 		this.liveTaskLabels.set(logicalId, {
 			label,
 			replacing: true,
@@ -44488,7 +44831,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		});
 		renderer.updateTaskLabel(logicalId, `${label}${liveLabel.warnSuffix ?? ""}`);
 	} else if (!needsReplacement && liveLabel !== void 0 && liveLabel.replacing) {
-		const label = `Updating ${logicalId} (${resourceType})${this.peekRoutingForLabel(change, currentResource, stackName, logicalId, false, this.recreateDirectionFor(stackName, logicalId)) === "cc-api" ? " [CC API]" : ""}`;
+		const label = `Updating ${logicalId} (${resourceType})${peekRoutingForLabel(this.providerRegistry, this.options, change, currentResource, stackName, logicalId, false, recreateDirectionFor(this.options, stackName, logicalId)) === "cc-api" ? " [CC API]" : ""}`;
 		this.liveTaskLabels.set(logicalId, {
 			label,
 			replacing: false,
@@ -44496,7 +44839,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		});
 		renderer.updateTaskLabel(logicalId, `${label}${liveLabel.warnSuffix ?? ""}`);
 	}
-	const dependencies = this.extractAllDependencies(template, logicalId);
+	const dependencies = extractAllDependencies(template, logicalId);
 	const updateReplacePolicy = template?.Resources?.[logicalId]?.UpdateReplacePolicy;
 	const markRestored = (outcome) => {
 		if (lostChild === void 0) return outcome;
@@ -44606,7 +44949,7 @@ function redactionRewrittenPaths(resolvedProps, desiredForSkipCheck, comparisonC
 	return new Set(Object.keys(masked).filter((key) => keyOrderFreeJson(masked[key]) !== keyOrderFreeJson(desiredForSkipCheck[key])));
 }
 function readsProducerReplacedThisRun(template, logicalId, stateResources) {
-	return (this.extractAllDependencies(template, logicalId) ?? []).some((id) => {
+	return (extractAllDependencies(template, logicalId) ?? []).some((id) => {
 		const loaded = Object.hasOwn(this.healBaseline, id) ? this.healBaseline[id] : void 0;
 		if (loaded === void 0) return false;
 		const now = Object.hasOwn(stateResources, id) ? stateResources[id] : void 0;
@@ -44614,6 +44957,56 @@ function readsProducerReplacedThisRun(template, logicalId, stateResources) {
 	});
 }
 
+//#endregion
+//#region src/deployment/deploy-engine/name-collision.ts
+function replacementNameOrigin(logicalId, physicalId) {
+	if (looksLikeCdkdGeneratedName(physicalId, logicalId, getCurrentStackName())) return {
+		descriptor: `The physical name (${physicalId}) was GENERATED by cdkd from the construct's logical id rather than declared in your template, and that derivation has no random component — so the new resource asks for exactly the name the existing one still holds`,
+		remedy: "Either give the resource an explicit physical name in your CDK code, or rename the CONSTRUCT (its id feeds the generated name — note that this replaces the resource rather than renaming it in place)"
+	};
+	return {
+		descriptor: `The resource has a user-supplied physical name (${physicalId})`,
+		remedy: "Either rename the resource in your CDK code (a fresh name lets the safe create-first order proceed)"
+	};
+}
+function orphanedNameCollisionAdvice(providerRegistry, changeType, logicalId, error) {
+	if (changeType !== "CREATE") return void 0;
+	if (!(error instanceof ProvisioningError)) return void 0;
+	const physicalId = error.physicalId;
+	if (!physicalId) return void 0;
+	const replayed = isReplayedNameCollisionFrom(error, logicalId, (link) => isAuxiliaryMarkOf(link, RETRY_AUXILIARY_OWNER));
+	if (!replayed && !isNameCollisionErrorFrom(error, logicalId)) return void 0;
+	const stackName = getCurrentStackName();
+	if (!looksLikeCdkdGeneratedName(physicalId, logicalId, stackName)) return void 0;
+	if (!stackName) return void 0;
+	const safeId = displaySafe(physicalId, { asciiOnly: true });
+	const safeStack = displaySafe(stackName, { asciiOnly: true });
+	const safeLogicalId = displaySafe(logicalId, { asciiOnly: true });
+	const idShown = isInertUnquoted(safeId);
+	const shownId = idShown ? safeId : "a name that cannot be shown safely here";
+	const shownLogicalId = isInertUnquoted(safeLogicalId) ? safeLogicalId : "A resource whose logical id cannot be shown safely here";
+	const diagnosis = replayed ? `${shownLogicalId}: the name AWS reports as taken (${shownId}) is most likely held by a resource THIS create made. An earlier attempt of it ended without a clear verdict (a server error, a dropped connection or a timeout, or a failure after the create call itself may have succeeded), and the retry then found the name taken. A dropped connection can also happen before the request reached AWS, so the holder may be another resource: confirm it is yours before deleting or importing it. cdkd records a resource only once its create succeeds, so this one is in no state file: no rollback or cdkd destroy will remove it, and re-running collides with it again.` : `${shownLogicalId}: the name AWS reports as taken (${shownId}) is one cdkd DERIVED from the logical id, and that derivation has no random component — so this is most likely a resource an earlier cdkd run left behind. A rollback leaves a resource carrying DeletionPolicy: Retain in AWS and drops it from state, as CloudFormation does; what differs is the name. CloudFormation would generate a fresh one for an unnamed resource and redeploy clean, whereas cdkd asks again for the name the orphan still holds — so re-running does not clear this.`;
+	const deleteArm = `If it is not a resource you want to keep, delete ${idShown ? safeId : "it"} in AWS — after confirming it holds nothing you need${replayed ? "" : ", since Retain is what kept it"} — and re-deploy.`;
+	let canImport;
+	try {
+		canImport = typeof providerRegistry.getProvider(error.resourceType).import === "function";
+	} catch {
+		canImport = false;
+	}
+	const commandNamesTheRightResource = safeId === physicalId && safeStack === stackName && safeLogicalId === logicalId;
+	const importableTarget = !stackName.includes("~");
+	if (!canImport || !commandNamesTheRightResource || !importableTarget) return `${diagnosis} ${!canImport ? `cdkd cannot adopt ${displaySafe(error.resourceType, { asciiOnly: true })} back into state (its provider implements no import)` : !importableTarget ? `this is a nested-stack child, whose stack name cdkd import cannot resolve` : `cdkd cannot render an import command that provably names this resource`}, so the way forward is to delete it. ${deleteArm}`;
+	const adopt = pasteableCommand("cdkd import", [{
+		value: stackName,
+		hole: "stack"
+	}, {
+		flag: "--resource",
+		value: `${logicalId}=${physicalId}`,
+		hole: "logicalId=physicalId"
+	}]);
+	return `${diagnosis} To recover, adopt it back into state instead of re-creating it, with the command below (a selective import merges into existing state and needs no --force while the resource is absent from it). CONFIRM IT IS YOURS FIRST — a name cdkd derives is predictable, so for a globally-namespaced type it can belong to another account, and the same stack deployed in another region derives the same name. ${deleteArm}${adopt.withheld.length === 0 ? "" : " The command below prints a quoted hole in place of a value cdkd will not name on a command line; replace it whole, quotes included, with your stack name or '<logicalId>=<name>', shell-quoted."}\nAdopt with: ${adopt.command}`;
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/update-replace.ts
 async function updateByReplacement({ change, counts, currentProps, currentResource, dependencies, logicalId, oldResourceType, progress, propertyDrivenReplacement, recreateFlagged, recreateViaCcApi, recreateViaSdkProvider, renderer, resolvedProps, resourceType, stackName, stateResources, template, typeChanged, updateReplacePolicy, updateSecrets, lostWithParent }) {
@@ -44621,10 +45014,10 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 		record: currentResource,
 		templateResource: template?.Resources?.[logicalId],
 		resolvedProperties: resolvedProps,
-		noEchoParameters: this.noEchoPositionSources(stateResources, template)?.parameters ?? /* @__PURE__ */ new Set(),
-		conditions: this.noEchoConditions,
+		noEchoParameters: noEchoPositionSources(this.noEchoRun, stateResources, template)?.parameters ?? /* @__PURE__ */ new Set(),
+		conditions: this.noEchoRun.noEchoConditions,
 		secrets: updateSecrets,
-		inputSources: template && this.maskedInputSources(template, stateResources, this.noEchoConditions, stackName)
+		inputSources: template && this.maskedInputSources(template, stateResources, this.noEchoRun.noEchoConditions, stackName)
 	});
 	if (propertyDrivenReplacement && !recreateFlagged && updateReplacePolicy !== "Retain") {
 		const statefulReason = isStatefulRecreateTargetForReplace(oldResourceType, currentProps, currentResource.observedProperties);
@@ -44654,7 +45047,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 		...recreateViaCcApi && { forceCcApi: true }
 	});
 	const replaceProvider = replaceDecision.provider;
-	const replaceProps = replaceDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
+	const replaceProps = replaceDecision.provisionedBy === "cc-api" ? preparePropertiesForCcApi(this.providerRegistry, resourceType, resolvedProps, logicalId) : resolvedProps;
 	const oldDeleteRoute = this.providerRegistry.getProviderFor({
 		resourceType: oldResourceType,
 		provisionedBy: currentResource.provisionedBy
@@ -44766,7 +45159,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 		} catch (createError) {
 			const createMsg = displayAwsMessage(maskSecretsInText(createError instanceof Error ? createError.message : String(createError), updateSecrets));
 			if (!isNameCollisionErrorFrom(createError, logicalId)) throw createError;
-			const nameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
+			const nameOrigin = replacementNameOrigin(logicalId, currentResource.physicalId);
 			const nameHeldElsewhere = replacementRequestsDifferentName({
 				oldResourceType,
 				newResourceType: resourceType,
@@ -44800,7 +45193,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy, oldDeleteRoute.provisionedBy, noEchoDeleteValues);
 		}
 		if (equalIdIsSameResource && !deletedOldFirst && createResult.physicalId === currentResource.physicalId) {
-			const idempotentNameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
+			const idempotentNameOrigin = replacementNameOrigin(logicalId, currentResource.physicalId);
 			if (updateReplacePolicy === "Retain") throw new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement, but its Create API is ` + `name-idempotent: the create-first attempt returned the existing resource ` + safeMsg`(${currentResource.physicalId}) instead of creating a new one, and ` + `UpdateReplacePolicy: Retain pins that resource in place. ` + safeMsg`${idempotentNameOrigin.descriptor}. ${idempotentNameOrigin.remedy} — with ` + "Retain, the old resource keeps the name, so a same-name replacement can never proceed.", "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
 			if (this.options.replace !== true) throw new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement, but its Create API is ` + `name-idempotent: the create-first attempt returned the EXISTING resource ` + safeMsg`(${currentResource.physicalId}) instead of creating a new one, so deleting ` + `the "old" resource would silently destroy the resource the deploy just ` + safeMsg`reported as created. ${idempotentNameOrigin.descriptor}; ` + safeMsg`${idempotentNameOrigin.remedy}, or re-run with ` + "`cdkd deploy --replace` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated). Note: this branch is also reached when the old resource was deleted out-of-band and the physical id is name-derived — there the create was a genuine fresh create; `--replace` converges that case too.", "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
 			this.logger.info(`  Create-first returned the existing resource (name-idempotent Create API) ` + safeMsg`and --replace is set — deleting old ${logicalId} ` + safeMsg`(${currentResource.physicalId}) first...`);
@@ -44828,20 +45221,21 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 	}
 	this.registerNoEchoAttributes(logicalId, createResult, updateSecrets, resolvedProps);
 	if (equalIdIsSameResource && createResult.physicalId === currentResource.physicalId) this.recreatedUnderSameId.add(logicalId);
-	const recordedReplacementProperties = this.propertiesToRecord(resolvedProps, createResult, resourceType, replaceDecision.provisionedBy);
+	const recordedReplacementProperties = propertiesToRecord(resolvedProps, createResult, resourceType, replaceDecision.provisionedBy);
 	stateResources[logicalId] = {
 		physicalId: createResult.physicalId,
 		resourceType,
 		properties: recordedReplacementProperties,
 		...acceptedCreateOnlyDropsField(recordedReplacementProperties, resourceType, replaceDecision.provisionedBy, "new-resource"),
 		...createResult.attributes && { attributes: createResult.attributes },
+		...secretNamedAttributesField(createResult),
 		...dependencies && dependencies.length > 0 && { dependencies },
-		...this.extractTemplateAttributes(template, logicalId),
+		...extractTemplateAttributes(template, logicalId),
 		provisionedBy: replaceDecision.provisionedBy
 	};
 	this.recordInlinePolicyWrite(logicalId, "create");
-	await this.establishNoEchoEchoFidelity(logicalId, stateResources[logicalId], resolvedProps, stateResources, updateSecrets);
-	this.kickOffObservedCapture(replaceProvider, logicalId, createResult.physicalId, resourceType, resolvedProps, { afterOwnWrite: true }, updateSecrets);
+	await establishNoEchoEchoFidelity(this.noEchoRun, this.noEchoDeps(), logicalId, stateResources[logicalId], resolvedProps, stateResources, updateSecrets);
+	this.observedCapture.kickOffObservedCapture(replaceProvider, logicalId, createResult.physicalId, resourceType, resolvedProps, { afterOwnWrite: true }, updateSecrets);
 	if (counts) counts.updated++;
 	if (progress) progress.current++;
 	const replacePrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
@@ -44880,7 +45274,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 		properties: resolvedProps,
 		provisionedBy: currentResource.provisionedBy,
 		previousProperties: currentResource.properties,
-		...this.isPinnedToCcApi(stackName, logicalId) && { forceCcApi: true }
+		...isPinnedToCcApi(this.options, stackName, logicalId) && { forceCcApi: true }
 	});
 	if (updateDecision.sdkMigration === true) {
 		const exemptMode = STICKY_CC_MIGRATION_EXEMPT.get(resourceType)?.mode;
@@ -44898,7 +45292,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 		this.logger.info(message);
 	}
 	const updateProvider = updateDecision.provider;
-	const updateProps = updateDecision.provisionedBy === "cc-api" ? withoutGeneratedFallbackName(resourceType, resolvedProps, this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId)) : resolvedProps;
+	const updateProps = updateDecision.provisionedBy === "cc-api" ? withoutGeneratedFallbackName(resourceType, resolvedProps, preparePropertiesForCcApi(this.providerRegistry, resourceType, resolvedProps, logicalId)) : resolvedProps;
 	const { previous: previousWithSecretsDropped, dropped: droppedPrincipalKinds } = withUnchangedSecretPrincipalLists(resourceType, currentResource.physicalId, noEchoHeldPaths.size === 0 ? currentPropsAsWritten : {
 		...currentPropsAsWritten,
 		...Object.fromEntries([...noEchoHeldPaths].filter((path) => Object.prototype.hasOwnProperty.call(updateProps, path)).map((path) => [path, updateProps[path]]))
@@ -44950,7 +45344,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 				previousProperties: currentResource.properties
 			});
 			const replProvider = replDecision.provider;
-			const replProps = replDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
+			const replProps = replDecision.provisionedBy === "cc-api" ? preparePropertiesForCcApi(this.providerRegistry, resourceType, resolvedProps, logicalId) : resolvedProps;
 			const fallbackNameChange = await this.checkedReplacementNameChange({
 				logicalId,
 				resourceType,
@@ -44968,10 +45362,10 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 				record: currentResource,
 				templateResource: template?.Resources?.[logicalId],
 				resolvedProperties: resolvedProps,
-				noEchoParameters: this.noEchoPositionSources(stateResources, template)?.parameters ?? /* @__PURE__ */ new Set(),
-				conditions: this.noEchoConditions,
+				noEchoParameters: noEchoPositionSources(this.noEchoRun, stateResources, template)?.parameters ?? /* @__PURE__ */ new Set(),
+				conditions: this.noEchoRun.noEchoConditions,
 				secrets: updateSecrets,
-				inputSources: template && this.maskedInputSources(template, stateResources, this.noEchoConditions, stackName)
+				inputSources: template && this.maskedInputSources(template, stateResources, this.noEchoRun.noEchoConditions, stackName)
 			});
 			this.logger.info(retainOldOnReplace ? safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing ` + `(CREATE only — UpdateReplacePolicy: Retain keeps the old resource)` : createFirst ? safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing (CREATE → DELETE — the new name differs from the old resource's)` : safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE → CREATE)`);
 			if (retainOldOnReplace) await noteRetainedResource(resourceType, logicalId);
@@ -45046,7 +45440,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 					physicalId: currentResource.physicalId
 				});
 				if (nameHeldElsewhere !== void 0) throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement because the ` + `provisioning layer cannot update it in place, but the create collided. ` + safeMsg`${renderNameHeldElsewhere(nameHeldElsewhere)} — so removing ` + "UpdateReplacePolicy: Retain would delete this resource and still collide. Choose a name no other resource holds, or delete the resource holding it if it is yours.", "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
-				const nameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
+				const nameOrigin = replacementNameOrigin(logicalId, currentResource.physicalId);
 				throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement because the ` + "provisioning layer cannot update it in place — but its physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. " + safeMsg`${nameOrigin.descriptor}. ${nameOrigin.remedy} — with Retain, the old ` + "resource keeps the name, so a same-name replacement can never proceed. Removing UpdateReplacePolicy: Retain lets cdkd delete the old resource first, which destroys it and any data it holds.", "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
 			}
 			if (!retainOldOnReplace && !createFirst && createResult.physicalId === currentResource.physicalId && !equalIdNamesDifferentResources({
@@ -45062,7 +45456,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 					oldProperties: currentResource.properties,
 					newProperties: resolvedProps
 				})) {
-					const idempotentNameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
+					const idempotentNameOrigin = replacementNameOrigin(logicalId, currentResource.physicalId);
 					throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement, but its Create ` + `API is name-idempotent: the create returned the existing resource ` + safeMsg`(${currentResource.physicalId}) instead of creating a new one, and ` + `UpdateReplacePolicy: Retain pins that resource in place, so the new ` + safeMsg`properties were not applied. ${idempotentNameOrigin.descriptor}. ` + safeMsg`${idempotentNameOrigin.remedy} — with Retain, the old resource keeps ` + `the name, so a same-name replacement can never proceed.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE"));
 				}
 				this.retainedOldOnReplacement.add(logicalId);
@@ -45075,6 +45469,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 				...createResult.attributes && { attributes: createResult.attributes },
 				...createResult.noEchoAttributes === true && { noEchoAttributes: true },
 				...createResult.noEchoAttributeNames && { noEchoAttributeNames: createResult.noEchoAttributeNames },
+				...createResult.secretNamedAttributeNames && { secretNamedAttributeNames: createResult.secretNamedAttributeNames },
 				...retainedSurvivorReason !== void 0 ? {
 					outcome: "partial",
 					reason: retainedSurvivorReason
@@ -45110,18 +45505,19 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 		...result.noEchoAttributes === true && { noEchoAttributes: true },
 		...result.noEchoAttributeNames && { noEchoAttributeNames: result.noEchoAttributeNames }
 	}, updateSecrets, resolvedProps);
-	const recordedProperties = this.propertiesToRecord(resolvedProps, result, resourceType, resultProvisionedBy);
-	if (result.wasReplaced) this.noEchoExactEchoes.delete(logicalId);
+	const recordedProperties = propertiesToRecord(resolvedProps, result, resourceType, resultProvisionedBy);
+	if (result.wasReplaced) this.noEchoRun.noEchoExactEchoes.delete(logicalId);
 	stateResources[logicalId] = {
 		physicalId: result.physicalId,
 		resourceType,
 		properties: recordedProperties,
 		...acceptedCreateOnlyDropsField(recordedProperties, resourceType, resultProvisionedBy, dischargedByReplacement ? "new-resource" : "in-place", currentResource),
 		...carriedAttributes && { attributes: carriedAttributes },
+		...secretNamedAttributesField(result, result.attributes === void 0 && !result.wasReplaced ? currentResource : void 0),
 		...!result.wasReplaced && currentResource.noEchoAttributeNames !== void 0 && { noEchoAttributeNames: currentResource.noEchoAttributeNames },
 		...!result.wasReplaced && currentResource.noEchoExactEchoLeaves !== void 0 && { noEchoExactEchoLeaves: currentResource.noEchoExactEchoLeaves },
 		...dependencies && dependencies.length > 0 && { dependencies },
-		...this.extractTemplateAttributes(template, logicalId),
+		...extractTemplateAttributes(template, logicalId),
 		provisionedBy: resultProvisionedBy,
 		...keepsParameterRefusal && {
 			observedBaselineRefused: true,
@@ -45130,8 +45526,12 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 	};
 	if (updatePartialReason(result) === void 0) this.recordInlinePolicyWrite(logicalId, "update");
 	if (keepsParameterRefusal) this.logger.debug(safeMsg`observedProperties capture SKIPPED for updated ${logicalId} (${resourceType}): 'cdkd import' refused its baseline because a template parameter was not provably deployed at its 'Default', and this deploy bound the same 'Default' — an in-place update cannot show that AWS no longer holds the deployed value. The refusal stands until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter.`);
-	const updateCaptureSiblings = keepsParameterRefusal ? void 0 : await this.buildObservedCaptureSiblings(resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
-	if (!keepsParameterRefusal) this.kickOffObservedCapture(captureProvider, logicalId, result.physicalId, resourceType, resolvedProps, {
+	const updateCaptureSiblings = keepsParameterRefusal ? void 0 : await buildObservedCaptureSiblings({
+		options: this.options,
+		buildResolverContext: (...args) => this.buildResolverContext(...args),
+		resolver: this.resolver
+	}, resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
+	if (!keepsParameterRefusal) this.observedCapture.kickOffObservedCapture(captureProvider, logicalId, result.physicalId, resourceType, resolvedProps, {
 		...updateCaptureSiblings,
 		afterOwnWrite: true
 	}, updateSecrets);
@@ -45391,11 +45791,11 @@ const NESTED_STACK_ROW_TYPE = "AWS::CloudFormation::Stack";
 async function provisionResource(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
 	const resourceType = change.resourceType;
 	const renderer = getLiveRenderer();
-	const labelRecreateDirection = this.recreateDirectionFor(stackName, logicalId);
+	const labelRecreateDirection = recreateDirectionFor(this.options, stackName, logicalId);
 	const labelRecordedType = stateResources[logicalId]?.resourceType;
 	const needsReplacement = change.changeType === "UPDATE" && ((change.propertyChanges?.some((pc) => pc.requiresReplacement && !isReplacementCeiling(pc)) ?? false) || labelRecordedType !== void 0 && labelRecordedType !== resourceType) || labelRecreateDirection !== void 0;
 	const verb = change.changeType === "CREATE" ? "Creating" : change.changeType === "DELETE" ? "Deleting" : needsReplacement ? "Replacing" : "Updating";
-	const labelRouting = this.peekRoutingForLabel(change, stateResources[logicalId], stackName, logicalId, needsReplacement, labelRecreateDirection);
+	const labelRouting = peekRoutingForLabel(this.providerRegistry, this.options, change, stateResources[logicalId], stackName, logicalId, needsReplacement, labelRecreateDirection);
 	const baseLabel = `${verb} ${logicalId} (${resourceType})${labelRouting === "cc-api" ? " [CC API]" : ""}`;
 	renderer.addTask(logicalId, baseLabel);
 	this.liveTaskLabels.set(logicalId, {
@@ -45527,7 +45927,7 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 		const shownMessage = this.maskForResource(logicalId, message);
 		const shownId = safeMsg`${logicalId}`;
 		this.logger.error(this.maskForResource(logicalId, `Failed to ${change.changeType.toLowerCase()} ${shownId}: ${shownMessage}`));
-		const orphanAdvice = this.orphanedNameCollisionAdvice(change.changeType, logicalId, error);
+		const orphanAdvice = orphanedNameCollisionAdvice(this.providerRegistry, change.changeType, logicalId, error);
 		if (orphanAdvice) this.logger.error(this.maskForResource(logicalId, orphanAdvice));
 		this.recordEvent({
 			eventType: "RESOURCE_FAILED",
@@ -45671,6 +46071,131 @@ var DagExecutor = class {
 	}
 };
 
+//#endregion
+//#region src/analyzer/implicit-delete-deps.ts
+const IMPLICIT_DELETE_DEPENDENCIES = {
+	"AWS::EC2::InternetGateway": ["AWS::EC2::VPCGatewayAttachment", "AWS::EC2::NatGateway"],
+	"AWS::EC2::VPCGatewayAttachment": ["AWS::EC2::NatGateway"],
+	"AWS::Events::EventBus": ["AWS::Events::Rule"],
+	"AWS::Athena::WorkGroup": ["AWS::Athena::NamedQuery"],
+	"AWS::CloudFront::ResponseHeadersPolicy": ["AWS::CloudFront::Distribution"],
+	"AWS::CloudFront::CachePolicy": ["AWS::CloudFront::Distribution"],
+	"AWS::CloudFront::OriginAccessControl": ["AWS::CloudFront::Distribution"],
+	"AWS::EC2::VPC": [
+		"AWS::EC2::Subnet",
+		"AWS::EC2::SecurityGroup",
+		"AWS::EC2::InternetGateway",
+		"AWS::EC2::EgressOnlyInternetGateway",
+		"AWS::EC2::VPCGatewayAttachment",
+		"AWS::EC2::RouteTable"
+	],
+	"AWS::EC2::Subnet": ["AWS::EC2::SubnetRouteTableAssociation", "AWS::Lambda::Function"],
+	"AWS::EC2::RouteTable": ["AWS::EC2::Route", "AWS::EC2::SubnetRouteTableAssociation"],
+	"AWS::EC2::SecurityGroup": [
+		"AWS::EC2::SecurityGroupIngress",
+		"AWS::EC2::SecurityGroupEgress",
+		"AWS::Lambda::Function"
+	]
+};
+const ALARM_RULE_FUNCTION_REGEX = /\b(?:ALARM|OK|INSUFFICIENT_DATA)\s*\(\s*([^)]*?)\s*\)/gi;
+function extractReferencedAlarmNames(alarmRule) {
+	const names = /* @__PURE__ */ new Set();
+	for (const match of alarmRule.matchAll(ALARM_RULE_FUNCTION_REGEX)) {
+		let arg = (match[1] ?? "").trim();
+		if (arg.length === 0) continue;
+		if (arg.startsWith("\"") && arg.endsWith("\"") || arg.startsWith("'") && arg.endsWith("'")) arg = arg.slice(1, -1);
+		if (arg.length === 0) continue;
+		const arnAlarmMatch = /:alarm:(.+)$/.exec(arg);
+		if (arnAlarmMatch?.[1]) names.add(arnAlarmMatch[1]);
+		else names.add(arg);
+	}
+	return [...names];
+}
+function computeImplicitDeleteEdges(resources) {
+	const edges = [];
+	const alarmTypes = /* @__PURE__ */ new Set(["AWS::CloudWatch::Alarm", "AWS::CloudWatch::CompositeAlarm"]);
+	const nameToLogicalId = /* @__PURE__ */ new Map();
+	for (const [logicalId, resource] of Object.entries(resources)) {
+		if (!alarmTypes.has(resource.resourceType)) continue;
+		const alarmName = typeof resource.properties?.["AlarmName"] === "string" ? resource.properties["AlarmName"] : resource.physicalId;
+		if (alarmName) nameToLogicalId.set(alarmName, logicalId);
+	}
+	for (const [logicalId, resource] of Object.entries(resources)) {
+		if (resource.resourceType !== "AWS::CloudWatch::CompositeAlarm") continue;
+		const alarmRule = resource.properties?.["AlarmRule"];
+		if (typeof alarmRule !== "string") continue;
+		for (const referencedName of extractReferencedAlarmNames(alarmRule)) {
+			const referencedLogicalId = nameToLogicalId.get(referencedName);
+			if (!referencedLogicalId || referencedLogicalId === logicalId) continue;
+			edges.push({
+				before: logicalId,
+				after: referencedLogicalId
+			});
+		}
+	}
+	return edges;
+}
+
+//#endregion
+//#region src/deployment/deploy-engine/dependencies.ts
+function hasPending(executor) {
+	for (const node of executor.values()) if (node.state === "pending") return true;
+	return false;
+}
+function buildDeletionDependencies(deleteIds, state, logger) {
+	const dependedBy = /* @__PURE__ */ new Map();
+	for (const id of deleteIds) dependedBy.set(id, /* @__PURE__ */ new Set());
+	for (const id of deleteIds) {
+		const resource = state.resources[id];
+		if (!resource?.dependencies) continue;
+		for (const dep of resource.dependencies) {
+			if (!deleteIds.has(dep)) continue;
+			dependedBy.get(dep).add(id);
+		}
+	}
+	addImplicitDeleteDependencies(deleteIds, state, dependedBy, logger);
+	return dependedBy;
+}
+function addImplicitDeleteDependencies(deleteIds, state, dependedBy, logger) {
+	const typeToIds = /* @__PURE__ */ new Map();
+	for (const id of deleteIds) {
+		const resource = state.resources[id];
+		if (!resource) continue;
+		const ids = typeToIds.get(resource.resourceType) ?? [];
+		ids.push(id);
+		typeToIds.set(resource.resourceType, ids);
+	}
+	for (const id of deleteIds) {
+		const resource = state.resources[id];
+		if (!resource) continue;
+		const mustDeleteAfter = IMPLICIT_DELETE_DEPENDENCIES[resource.resourceType];
+		if (!mustDeleteAfter) continue;
+		for (const depType of mustDeleteAfter) {
+			const depIds = typeToIds.get(depType);
+			if (!depIds) continue;
+			for (const depId of depIds) {
+				if (!dependedBy.has(id)) dependedBy.set(id, /* @__PURE__ */ new Set());
+				if (!dependedBy.get(id).has(depId)) {
+					dependedBy.get(id).add(depId);
+					logger.debug(safeMsg`Implicit delete dependency: ${depId} (${depType}) must be deleted before ${id} (${resource.resourceType})`);
+				}
+			}
+		}
+	}
+	const scoped = {};
+	for (const id of deleteIds) {
+		const resource = state.resources[id];
+		if (resource) scoped[id] = resource;
+	}
+	for (const { before, after } of computeImplicitDeleteEdges(scoped)) {
+		if (!dependedBy.has(after)) dependedBy.set(after, /* @__PURE__ */ new Set());
+		if (!dependedBy.get(after).has(before)) {
+			dependedBy.get(after).add(before);
+			logger.debug(safeMsg`Implicit delete dependency: ${before} (${scoped[before]?.resourceType}) must be deleted before ${after} (${scoped[after]?.resourceType})`);
+		}
+	}
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/execute.ts
 const NO_REPLACEMENT_ORPHAN_TYPES = /* @__PURE__ */ new Set([
@@ -45846,13 +46371,13 @@ async function executeDeployment(template, currentState, changes, dag, execution
 						provisionedBy: createdId !== void 0 ? "sdk" : pendingRequest !== void 0 ? "cc-api" : newResources[logicalId]?.provisionedBy ?? previousState?.provisionedBy,
 						...pendingRequest !== void 0 && {
 							pendingCloudControlRequest: pendingRequest,
-							deletionPolicy: journaledOrphanPolicy(this.extractTemplateAttributes(template, logicalId).deletionPolicy)
+							deletionPolicy: journaledOrphanPolicy(extractTemplateAttributes(template, logicalId).deletionPolicy)
 						},
 						...previousState && { previousState },
 						physicalId: createdId ?? statePhysicalId,
 						...createdId !== void 0 && {
 							physicalIdRecoveredFromError: true,
-							deletionPolicy: journaledOrphanPolicy(this.extractTemplateAttributes(template, logicalId).deletionPolicy)
+							deletionPolicy: journaledOrphanPolicy(extractTemplateAttributes(template, logicalId).deletionPolicy)
 						},
 						...change.changeType === "UPDATE" && this.oldDeletedBeforeCreate.has(logicalId) && { oldDeletedBeforeCreate: true },
 						...orphanedBy !== void 0 && { replacementOrphaned: this.oldDeletedBeforeCreate.has(logicalId) ? "delete-first" : "create-first" },
@@ -45868,7 +46393,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 							provisionedBy: "sdk",
 							physicalId: orphanedBy.createdId,
 							physicalIdRecoveredFromError: true,
-							deletionPolicy: journaledOrphanPolicy(this.extractTemplateAttributes(template, logicalId).deletionPolicy),
+							deletionPolicy: journaledOrphanPolicy(extractTemplateAttributes(template, logicalId).deletionPolicy),
 							replacedPhysicalId: orphanedBy.record.physicalId,
 							replacedResourceType: orphanedBy.record.resourceType,
 							...this.oldDeletedBeforeCreate.has(logicalId) && { replacedResourceDeleted: true },
@@ -45915,11 +46440,11 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			} finally {
 				await saveChain;
 			}
-			if (this.interrupted && this.hasPending(createUpdateExecutor)) throw new InterruptedError(this.interruptCause ?? "user");
+			if (this.interrupted && hasPending(createUpdateExecutor)) throw new InterruptedError(this.interruptCause ?? "user");
 		}
 		if (deleteChanges.size > 0) {
 			this.logger.info(safeMsg`${red("Deleting")} ${red(deleteChanges.size)} resource(s)`);
-			const deleteDeps = this.buildDeletionDependencies(deleteChanges, currentState);
+			const deleteDeps = buildDeletionDependencies(deleteChanges, currentState, this.logger);
 			const deleteExecutor = new DagExecutor();
 			for (const id of deleteChanges) deleteExecutor.add({
 				id,
@@ -45961,7 +46486,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			} finally {
 				await saveChain;
 			}
-			if (this.interrupted && this.hasPending(deleteExecutor)) throw new InterruptedError(this.interruptCause ?? "user");
+			if (this.interrupted && hasPending(deleteExecutor)) throw new InterruptedError(this.interruptCause ?? "user");
 		}
 		if (this.interrupted) this.warnUnretriedReplacedDeletes("interrupted");
 		else try {
@@ -46125,7 +46650,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 	}
 	let outputs;
 	try {
-		outputs = await withSharedDrainBudget(() => this.resolveOutputs(template, newResources, stackName, outputsDigestSource, parameterValues, conditions));
+		outputs = await withSharedDrainBudget(() => resolveOutputs(this.outputsRun, this.outputsDeps(), template, newResources, stackName, outputsDigestSource, parameterValues, conditions));
 		const resolvedOutputsBeforeRedaction = outputs;
 		outputs = this.redactOutputs(outputs);
 		this.rememberRecoverableMaskedOutputs(stackName, resolvedOutputsBeforeRedaction, outputs);
@@ -46142,8 +46667,8 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			resources: newResources,
 			...orphansCarriedFrom(currentState),
 			outputs,
-			exportNames: [...this.resolvedExportNames],
-			...this.skippedOutputs && { skippedOutputs: { ...this.skippedOutputs } },
+			exportNames: [...this.outputsRun.resolvedExportNames],
+			...this.outputsRun.skippedOutputs && { skippedOutputs: { ...this.outputsRun.skippedOutputs } },
 			...this.recordedImports.length > 0 && { imports: [...this.recordedImports] },
 			...this.recordedOutputReads.length > 0 && { outputReads: [...this.recordedOutputReads] },
 			lastModified: Date.now()
@@ -47529,7 +48054,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			lastModified: Date.now()
 		};
 		const currentEtag = currentStateData?.etag;
-		this.healBaseline = currentState.resources ?? {};
+		this.rebaseline(currentState.resources ?? {});
 		this.runProducerRegionEvidence = () => this.producerRegionEvidence(currentState);
 		refuseMalformedOutputs(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
 		refuseMalformedResourcesForDeploy(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
@@ -47608,8 +48133,8 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 				}]).command}`);
 			}
 		} catch {}
-		this.stampReasonlessParameterRefusals(currentState.resources, template);
-		this.kickOffAutoRefreshObservedProperties(currentState.resources, currentState);
+		stampReasonlessParameterRefusals(this.logger, currentState.resources, template);
+		this.observedCapture.kickOffAutoRefreshObservedProperties(currentState.resources, currentState);
 		this.logger.debug(safeMsg`Template has ${Object.keys(template.Resources || {}).length} resources`);
 		const outputsDigestSource = structuredClone({
 			...template,
@@ -47618,7 +48143,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		const parameterValues = await this.resolver.resolveParameters(template, this.options.parameters, { ...this.options.inheritedSecrets && hasMaskableValues(this.options.inheritedSecrets) && { inheritedSecrets: this.options.inheritedSecrets } });
 		this.logger.debug(safeMsg`Resolved ${Object.keys(parameterValues).length} parameters: ${Object.keys(parameterValues).join(", ")}`);
 		poisonRenderedSpellingsCollidingIn(template, parameterValues, this.options.inheritedSecrets);
-		this.inheritedNoEchoParameters = /* @__PURE__ */ new Set([...this.freshNoEchoParameters(parameterValues) ?? [], ...this.options.passedNoEchoParameters ?? []]);
+		this.noEchoRun.inheritedNoEchoParameters = /* @__PURE__ */ new Set([...this.freshNoEchoParameters(parameterValues) ?? [], ...this.options.passedNoEchoParameters ?? []]);
 		const backfillNoEchoValues = noEchoParameterValueSeed(template.Parameters, parameterValues, this.options.inheritedSecrets, this.options.parameters);
 		this.fingerprintNoEchoValues = backfillNoEchoValues;
 		this.fingerprintParameters = parameterInputsFor({
@@ -47649,14 +48174,15 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			}));
 		}
 		const effectiveTemplate = this.templateParser.filterResourcesByCondition(template, conditions);
-		this.constructPathTemplate = effectiveTemplate;
-		this.noEchoConditions = conditions;
-		this.seedPersistedNoEchoAttributes(currentState.resources);
+		this.noEchoRun.constructPathTemplate = effectiveTemplate;
+		this.noEchoRun.noEchoConditions = conditions;
+		seedPersistedNoEchoAttributes(this.noEchoRun, currentState.resources);
 		const orphanCountBeforeAdoption = (currentState.orphans ?? []).length;
 		const orphanPlan = await this.adoptRollbackOrphans(currentState, effectiveTemplate);
-		this.preDeploySecretNamedRecords = secretNamedRecordNeedles(currentState.resources, this.fingerprintNoEchoValues);
+		this.captureStoredNoEchoNamingValues(currentState.resources, effectiveTemplate, conditions);
+		this.preDeploySecretNamedRecords = secretNamedRecordNeedles(currentState.resources, this.stateNamingSecrets());
 		if (Object.keys(orphanPlan.adopted).length > 0) {
-			this.stampReasonlessParameterRefusals(currentState.resources, template);
+			stampReasonlessParameterRefusals(this.logger, currentState.resources, template);
 			if (backfillMaskedPropertyFingerprints(currentState.resources, template, backfillNoEchoValues) > 0) maskedFingerprintsBackfilled = true;
 		}
 		const orphansChanged = Object.keys(orphanPlan.adopted).length > 0 || (currentState.orphans ?? []).length !== orphanCountBeforeAdoption;
@@ -47691,7 +48217,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			sources: maskedInputSourcesForDiff,
 			rebaselined: /* @__PURE__ */ new Map()
 		};
-		const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry), this.providerRegistry.getAllowedUnsupportedProperties?.(), freshNoEchoParametersWithDeclared(this.inheritedNoEchoParameters, effectiveTemplate), this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues, currentState.resources), recreateTargetIdsFor(this.options.recreateTargets, stackName), maskedInputs, this.options.refusalRecovery, this.noEchoDiffComparison(currentState.resources, effectiveTemplate, conditions, parameterValues, stackName), {
+		const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry), this.providerRegistry.getAllowedUnsupportedProperties?.(), freshNoEchoParametersWithDeclared(this.noEchoRun.inheritedNoEchoParameters, effectiveTemplate), this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues, currentState.resources), recreateTargetIdsFor(this.options.recreateTargets, stackName), maskedInputs, this.options.refusalRecovery, noEchoDiffComparison(this.noEchoRun, this.noEchoDeps(), currentState.resources, effectiveTemplate, conditions, parameterValues, stackName), {
 			...this.options.inheritedReferenceProvenance && { inherited: this.options.inheritedReferenceProvenance },
 			crossStackOutputs: crossStackOutputProvenanceSource(crossStackReads, this.recordedImports, this.stateBackend)
 		});
@@ -47734,7 +48260,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		}
 		const startProvenanceCapture = () => {
 			if (this.options.dryRun || isKnownTokenFreeState(currentStateData?.state)) return;
-			this.kickOffProvenanceCapture({
+			this.provenanceCapture.kickOffProvenanceCapture({
 				noChange: this.diffCalculator.filterByType(changes, "NO_CHANGE").map((change) => change.logicalId),
 				resources: currentState.resources,
 				template: effectiveTemplate,
@@ -47748,8 +48274,8 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			startProvenanceCapture();
 			let persistedOutputs = currentState.outputs ?? {};
 			if (!this.options.dryRun) {
-				const resolvedOutputs = this.redactOutputs(await withSharedDrainBudget(() => this.resolveOutputs(effectiveTemplate, currentState.resources, stackName, outputsDigestSource, parameterValues, conditions)));
-				const observedRefresh = await this.drainObservedCaptures(currentState.resources) > 0;
+				const resolvedOutputs = this.redactOutputs(await withSharedDrainBudget(() => resolveOutputs(this.outputsRun, this.outputsDeps(), effectiveTemplate, currentState.resources, stackName, outputsDigestSource, parameterValues, conditions)));
+				const observedRefresh = await this.observedCapture.drainObservedCaptures(currentState.resources) > 0;
 				const resolutionFailed = Object.values(resolvedOutputs).some((v) => v === void 0);
 				const currentEffectiveExports = new Set(importableOutputKeys(currentState));
 				let merge = resolutionFailed ? mergeNoChangeOutputs({
@@ -47757,27 +48283,27 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 					resolved: resolvedOutputs,
 					declaredOutputs: effectiveTemplate.Outputs,
 					previousExportNames: currentEffectiveExports,
-					resolvedExportNames: this.resolvedExportNames,
-					refusesCarriedAlias: (outputKey, exportName) => this.carriedExportAliasRefusal === void 0 ? "An export alias was not carried: no export-name verdict is available." : this.carriedExportAliasRefusal(outputKey, exportName)
+					resolvedExportNames: this.outputsRun.resolvedExportNames,
+					refusesCarriedAlias: (outputKey, exportName) => this.outputsRun.carriedExportAliasRefusal === void 0 ? "An export alias was not carried: no export-name verdict is available." : this.outputsRun.carriedExportAliasRefusal(outputKey, exportName)
 				}) : void 0;
 				if (merge?.kind === "merged") {
-					for (const key of merge.carriedKeys) Reflect.deleteProperty(this.outputsTemplateSource, key);
+					for (const key of merge.carriedKeys) Reflect.deleteProperty(this.outputsRun.outputsTemplateSource, key);
 					if (merge.carriedKeys.length > 0 && !bagHoldsSecretExpression(persistedOutputs) && bagHoldsSecretExpression(this.redactOutputs(merge.outputs))) merge = {
 						kind: "kept",
 						reason: "mixed-generation"
 					};
 				}
-				if (merge?.kind === "kept") this.outputsSourceUsable = false;
+				if (merge?.kind === "kept") this.outputsRun.outputsSourceUsable = false;
 				if (merge?.kind === "merged") for (const { reason } of merge.refusedAliases) this.logger.warn(reason);
 				const outputsToPersist = merge === void 0 ? resolvedOutputs : merge.kind === "merged" ? merge.outputs : persistedOutputs;
-				const exportNamesToPersist = merge === void 0 ? this.resolvedExportNames : merge.kind === "merged" ? merge.exportNames : void 0;
+				const exportNamesToPersist = merge === void 0 ? this.outputsRun.resolvedExportNames : merge.kind === "merged" ? merge.exportNames : void 0;
 				const outputsChanged = !outputMapsEqual(persistedOutputs, outputsToPersist);
 				const persistExportSet = new Set(exportNamesToPersist ?? []);
 				const exportSetChanged = exportNamesToPersist !== void 0 && (currentEffectiveExports.size !== persistExportSet.size || [...persistExportSet].some((k) => !currentEffectiveExports.has(k)));
 				if (merge?.kind === "kept" && !outputMapsEqual(persistedOutputs, resolvedOutputs)) this.logger.warn(safeMsg`Outputs changed but one or more could not be resolved; keeping the previously persisted outputs. ${keptWholeReasonText(merge.reason)} ` + "A downstream Fn::ImportValue may fail until the next deploy.");
 				else if (merge?.kind === "merged" && merge.carriedKeys.length > 0) this.logger.debug(safeMsg`Kept the previously persisted value of ${merge.carriedKeys.length} output key(s), ` + "carried export aliases included, that could not be resolved (no-change path)");
-				const skippedOutputsChanged = !skippedOutputsEqual(currentState.skippedOutputs, this.skippedOutputs);
-				const healedAttributesPending = this.hasUnpersistedHeals(currentState.resources);
+				const skippedOutputsChanged = !skippedOutputsEqual(currentState.skippedOutputs, this.outputsRun.skippedOutputs);
+				const healedAttributesPending = this.attributeHealer.hasUnpersistedHeals(currentState.resources);
 				const conditionVerdictsChanged = !conditionVerdictRecordsEqual(readRecordedConditionVerdicts(currentState), conditionVerdicts);
 				if (outputsChanged || exportSetChanged && currentState.exportNames !== void 0) await requireOutputsOnlyApproval({
 					options: this.options,
@@ -47793,7 +48319,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 						...orphansCarriedFrom(currentState),
 						outputs: outputsChanged ? outputsToPersist : persistedOutputs,
 						...exportNamesToPersist === void 0 ? exportNamesCarriedFrom(currentState) : { exportNames: [...exportNamesToPersist] },
-						...this.skippedOutputs && { skippedOutputs: { ...this.skippedOutputs } },
+						...this.outputsRun.skippedOutputs && { skippedOutputs: { ...this.outputsRun.skippedOutputs } },
 						...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads, this.crossStackReadKeyNormalizer()),
 						...conditionVerdicts && { conditionVerdicts },
 						lastModified: Date.now()
@@ -47826,7 +48352,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 				updatePartial: 0,
 				unchanged: Object.keys(currentState.resources).length,
 				durationMs: Date.now() - startTime,
-				outputs: this.buildDisplayOutputs(template, this.redactOutputs(persistedOutputs)),
+				outputs: buildDisplayOutputs(template, this.redactOutputs(persistedOutputs)),
 				attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
 			};
 		}
@@ -47907,7 +48433,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		try {
 			this.stateBackend.warmConnections(stackName, this.stackRegion, TAIL_WARM_CONNECTIONS);
 		} catch {}
-		await this.drainObservedCaptures(newState.resources);
+		await this.observedCapture.drainObservedCaptures(newState.resources);
 		const [newEtag] = await Promise.all([this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(conditionVerdicts ? {
 			...newState,
 			conditionVerdicts
@@ -47944,7 +48470,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			...(actualCounts.crossPrefixKept ?? 0) > 0 && { crossPrefixKept: actualCounts.crossPrefixKept },
 			unchanged: unchangedCount,
 			durationMs,
-			outputs: this.buildDisplayOutputs(template, this.redactOutputs(newState.outputs ?? {})),
+			outputs: buildDisplayOutputs(template, this.redactOutputs(newState.outputs ?? {})),
 			attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
 		};
 	} catch (error) {
@@ -47956,7 +48482,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			renderer.stop();
 		} catch {}
 		process.removeListener("SIGINT", sigintHandler);
-		this.observedCaptureTasks.clear();
+		this.observedCapture.observedCaptureTasks.clear();
 		try {
 			await flushKeptForReadoption(this);
 			await this.generatedNameGuard?.settle();
@@ -47978,175 +48504,6 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 	}
 }
 
-//#endregion
-//#region src/deployment/label-routing.ts
-function deriveLabelRouting(change, existingState, registry, forceCcApi = false) {
-	try {
-		if (change.changeType === "DELETE") return existingState?.provisionedBy;
-		return registry.getProviderFor({
-			resourceType: change.resourceType,
-			properties: change.desiredProperties ?? {},
-			provisionedBy: existingState?.provisionedBy,
-			previousProperties: existingState?.properties,
-			forceCcApi
-		}).provisionedBy;
-	} catch {
-		return;
-	}
-}
-
-//#endregion
-//#region src/deployment/deploy-engine/routing.ts
-function isPinnedToCcApi(stackName, logicalId) {
-	return this.options.pinCcApi?.stackName === stackName && this.options.pinCcApi.logicalIds.has(logicalId);
-}
-function recreateDirectionFor(stackName, logicalId) {
-	const targets = this.options.recreateTargets?.stackName === stackName ? this.options.recreateTargets : void 0;
-	if (targets === void 0) return void 0;
-	if (targets.viaCcApi.has(logicalId)) return "cc-api";
-	if (targets.viaSdkProvider.has(logicalId)) return "sdk";
-}
-function peekRoutingForLabel(change, existingState, stackName, logicalId, needsReplacement = false, recreateDirection) {
-	if (needsReplacement) {
-		const hintRecord = {
-			...recreateDirection !== void 0 && { provisionedBy: recreateDirection },
-			...existingState?.properties !== void 0 && { properties: existingState.properties }
-		};
-		return deriveLabelRouting(change, hintRecord, this.providerRegistry, recreateDirection === "cc-api");
-	}
-	return deriveLabelRouting(change, existingState, this.providerRegistry, this.isPinnedToCcApi(stackName, logicalId));
-}
-function preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) {
-	const sdkProvider = this.providerRegistry.getRegisteredTypes().includes(resourceType) ? this.providerRegistry.getProvider(resourceType) : void 0;
-	if (sdkProvider?.preparePropertiesForFallback) return sdkProvider.preparePropertiesForFallback(logicalId, resourceType, resolvedProps);
-	return applyDefaultNameForFallback(logicalId, resourceType, resolvedProps);
-}
-
-//#endregion
-//#region src/analyzer/implicit-delete-deps.ts
-const IMPLICIT_DELETE_DEPENDENCIES = {
-	"AWS::EC2::InternetGateway": ["AWS::EC2::VPCGatewayAttachment", "AWS::EC2::NatGateway"],
-	"AWS::EC2::VPCGatewayAttachment": ["AWS::EC2::NatGateway"],
-	"AWS::Events::EventBus": ["AWS::Events::Rule"],
-	"AWS::Athena::WorkGroup": ["AWS::Athena::NamedQuery"],
-	"AWS::CloudFront::ResponseHeadersPolicy": ["AWS::CloudFront::Distribution"],
-	"AWS::CloudFront::CachePolicy": ["AWS::CloudFront::Distribution"],
-	"AWS::CloudFront::OriginAccessControl": ["AWS::CloudFront::Distribution"],
-	"AWS::EC2::VPC": [
-		"AWS::EC2::Subnet",
-		"AWS::EC2::SecurityGroup",
-		"AWS::EC2::InternetGateway",
-		"AWS::EC2::EgressOnlyInternetGateway",
-		"AWS::EC2::VPCGatewayAttachment",
-		"AWS::EC2::RouteTable"
-	],
-	"AWS::EC2::Subnet": ["AWS::EC2::SubnetRouteTableAssociation", "AWS::Lambda::Function"],
-	"AWS::EC2::RouteTable": ["AWS::EC2::Route", "AWS::EC2::SubnetRouteTableAssociation"],
-	"AWS::EC2::SecurityGroup": [
-		"AWS::EC2::SecurityGroupIngress",
-		"AWS::EC2::SecurityGroupEgress",
-		"AWS::Lambda::Function"
-	]
-};
-const ALARM_RULE_FUNCTION_REGEX = /\b(?:ALARM|OK|INSUFFICIENT_DATA)\s*\(\s*([^)]*?)\s*\)/gi;
-function extractReferencedAlarmNames(alarmRule) {
-	const names = /* @__PURE__ */ new Set();
-	for (const match of alarmRule.matchAll(ALARM_RULE_FUNCTION_REGEX)) {
-		let arg = (match[1] ?? "").trim();
-		if (arg.length === 0) continue;
-		if (arg.startsWith("\"") && arg.endsWith("\"") || arg.startsWith("'") && arg.endsWith("'")) arg = arg.slice(1, -1);
-		if (arg.length === 0) continue;
-		const arnAlarmMatch = /:alarm:(.+)$/.exec(arg);
-		if (arnAlarmMatch?.[1]) names.add(arnAlarmMatch[1]);
-		else names.add(arg);
-	}
-	return [...names];
-}
-function computeImplicitDeleteEdges(resources) {
-	const edges = [];
-	const alarmTypes = /* @__PURE__ */ new Set(["AWS::CloudWatch::Alarm", "AWS::CloudWatch::CompositeAlarm"]);
-	const nameToLogicalId = /* @__PURE__ */ new Map();
-	for (const [logicalId, resource] of Object.entries(resources)) {
-		if (!alarmTypes.has(resource.resourceType)) continue;
-		const alarmName = typeof resource.properties?.["AlarmName"] === "string" ? resource.properties["AlarmName"] : resource.physicalId;
-		if (alarmName) nameToLogicalId.set(alarmName, logicalId);
-	}
-	for (const [logicalId, resource] of Object.entries(resources)) {
-		if (resource.resourceType !== "AWS::CloudWatch::CompositeAlarm") continue;
-		const alarmRule = resource.properties?.["AlarmRule"];
-		if (typeof alarmRule !== "string") continue;
-		for (const referencedName of extractReferencedAlarmNames(alarmRule)) {
-			const referencedLogicalId = nameToLogicalId.get(referencedName);
-			if (!referencedLogicalId || referencedLogicalId === logicalId) continue;
-			edges.push({
-				before: logicalId,
-				after: referencedLogicalId
-			});
-		}
-	}
-	return edges;
-}
-
-//#endregion
-//#region src/deployment/deploy-engine/dependencies.ts
-function hasPending(executor) {
-	for (const node of executor.values()) if (node.state === "pending") return true;
-	return false;
-}
-function buildDeletionDependencies(deleteIds, state) {
-	const dependedBy = /* @__PURE__ */ new Map();
-	for (const id of deleteIds) dependedBy.set(id, /* @__PURE__ */ new Set());
-	for (const id of deleteIds) {
-		const resource = state.resources[id];
-		if (!resource?.dependencies) continue;
-		for (const dep of resource.dependencies) {
-			if (!deleteIds.has(dep)) continue;
-			dependedBy.get(dep).add(id);
-		}
-	}
-	this.addImplicitDeleteDependencies(deleteIds, state, dependedBy);
-	return dependedBy;
-}
-function addImplicitDeleteDependencies(deleteIds, state, dependedBy) {
-	const typeToIds = /* @__PURE__ */ new Map();
-	for (const id of deleteIds) {
-		const resource = state.resources[id];
-		if (!resource) continue;
-		const ids = typeToIds.get(resource.resourceType) ?? [];
-		ids.push(id);
-		typeToIds.set(resource.resourceType, ids);
-	}
-	for (const id of deleteIds) {
-		const resource = state.resources[id];
-		if (!resource) continue;
-		const mustDeleteAfter = IMPLICIT_DELETE_DEPENDENCIES[resource.resourceType];
-		if (!mustDeleteAfter) continue;
-		for (const depType of mustDeleteAfter) {
-			const depIds = typeToIds.get(depType);
-			if (!depIds) continue;
-			for (const depId of depIds) {
-				if (!dependedBy.has(id)) dependedBy.set(id, /* @__PURE__ */ new Set());
-				if (!dependedBy.get(id).has(depId)) {
-					dependedBy.get(id).add(depId);
-					this.logger.debug(safeMsg`Implicit delete dependency: ${depId} (${depType}) must be deleted before ${id} (${resource.resourceType})`);
-				}
-			}
-		}
-	}
-	const scoped = {};
-	for (const id of deleteIds) {
-		const resource = state.resources[id];
-		if (resource) scoped[id] = resource;
-	}
-	for (const { before, after } of computeImplicitDeleteEdges(scoped)) {
-		if (!dependedBy.has(after)) dependedBy.set(after, /* @__PURE__ */ new Set());
-		if (!dependedBy.get(after).has(before)) {
-			dependedBy.get(after).add(before);
-			this.logger.debug(safeMsg`Implicit delete dependency: ${before} (${scoped[before]?.resourceType}) must be deleted before ${after} (${scoped[after]?.resourceType})`);
-		}
-	}
-}
-
 //#endregion
 //#region src/deployment/deploy-engine.ts
 const EMPTY_SECRETS = /* @__PURE__ */ new Map();
@@ -48183,10 +48540,9 @@ var DeployEngine = class {
 	resolver;
 	interrupted = false;
 	interruptCause = null;
-	observedCaptureTasks = /* @__PURE__ */ new Map();
 	absentJournalVersionPurge;
 	noEchoCeilingReadbackTimeoutMs = 3e4;
-	recapturedBaselines = /* @__PURE__ */ new WeakMap();
+	observedCapture;
 	stateBackend;
 	lockManager;
 	dagBuilder;
@@ -48198,33 +48554,19 @@ var DeployEngine = class {
 	recordedImports = [];
 	recordedOutputReads = [];
 	perResourceSecrets = /* @__PURE__ */ new Map();
-	noEchoAttributeResources = /* @__PURE__ */ new Map();
-	persistedNoEchoAttributes = /* @__PURE__ */ new Map();
-	noEchoConditions;
-	inheritedNoEchoParameters = /* @__PURE__ */ new Set();
-	noEchoPhysicalIdWarned = /* @__PURE__ */ new Set();
-	noEchoPositionedValues = /* @__PURE__ */ new Map();
-	noEchoExactEchoes = /* @__PURE__ */ new Map();
-	noEchoAttributeReads = /* @__PURE__ */ new Map();
+	noEchoRun = new NoEchoRunState();
 	replacedDeleteSkips = /* @__PURE__ */ new Map();
 	deferredReplacedDeletes = void 0;
 	secretNameNeedles = /* @__PURE__ */ new Map();
 	perResourceTemplateProps = /* @__PURE__ */ new Map();
 	perResourceResolvedType = /* @__PURE__ */ new Map();
-	witnessConfirmedLeaves = /* @__PURE__ */ new Map();
 	fingerprintNoEchoValues = void 0;
 	preDeploySecretNamedRecords = void 0;
+	storedNoEchoNamingValues = /* @__PURE__ */ new Map();
 	fingerprintParameters = void 0;
 	fingerprintChildTemplates = void 0;
 	perResourceInputFingerprints = /* @__PURE__ */ new Map();
-	outputSecrets = /* @__PURE__ */ new Map();
-	outputsPassSecretMaps = [];
-	outputsTemplateSource = Object.create(null);
-	resolvedExportNames = [];
-	carriedExportAliasRefusal;
-	skippedOutputs;
-	constructPathTemplate;
-	outputsSourceUsable = true;
+	outputsRun = new OutputsRunState();
 	attemptedResolvedProps = /* @__PURE__ */ new Map();
 	resumedCreates = /* @__PURE__ */ new Map();
 	generatedNameGuard;
@@ -48236,20 +48578,18 @@ var DeployEngine = class {
 	updatesThatSentNothing = /* @__PURE__ */ new Set();
 	updateWasReplaced = /* @__PURE__ */ new Map();
 	inPlaceCreateOnlyPaths = /* @__PURE__ */ new Map();
-	outputProvenanceSinks = /* @__PURE__ */ new Map();
-	outputsResolvedThisRun = /* @__PURE__ */ new WeakSet();
 	provenanceBaseline = void 0;
-	resolvedOutputsBag = void 0;
-	provenanceCaptureTasks = /* @__PURE__ */ new Map();
+	provenanceCapture;
 	oldDeletedBeforeCreate = /* @__PURE__ */ new Set();
-	healBaseline = {};
+	get healBaseline() {
+		return this.attributeHealer.baseline;
+	}
 	runProducerRegionEvidence = void 0;
 	deployChanges = /* @__PURE__ */ new Map();
 	deployStateResources = {};
 	stackRecordsView = void 0;
 	inlinePolicyWriters = /* @__PURE__ */ new Map();
-	attributeHeals = /* @__PURE__ */ new Map();
-	healedAttributes = /* @__PURE__ */ new Map();
+	attributeHealer;
 	stackRegion;
 	constructor(stateBackend, lockManager, dagBuilder, diffCalculator, providerRegistry, options = {}, stackRegion, exportIndexStore) {
 		this.stateBackend = stateBackend;
@@ -48273,28 +48613,74 @@ var DeployEngine = class {
 		this.options.resourceWarnAfterMs = options.resourceWarnAfterMs ?? 3e5;
 		this.options.resourceTimeoutMs = options.resourceTimeoutMs ?? 18e5;
 		this.options.captureObservedState = options.captureObservedState ?? true;
+		this.attributeHealer = this.rebaseline({});
+		this.provenanceCapture = this.freshProvenanceCapture();
+		this.observedCapture = this.freshObservedCapture();
+	}
+	freshObservedCapture() {
+		return new ObservedCapture({
+			logger: this.logger,
+			options: this.options,
+			resolver: this.resolver,
+			providerRegistry: this.providerRegistry,
+			printingSecretsFor: (logicalId) => this.printingSecretsFor(logicalId),
+			fingerprintNoEchoValues: () => this.fingerprintNoEchoValues,
+			provenanceCapture: () => this.provenanceCapture
+		});
+	}
+	rebaseline(resources) {
+		this.attributeHealer = new AttributeHealer({
+			providerRegistry: this.providerRegistry,
+			stackRegion: this.stackRegion,
+			logger: this.logger,
+			baseline: resources,
+			resolvedSecretsOf: (logicalId) => this.perResourceSecrets.get(logicalId),
+			namingSecrets: () => this.stateNamingSecrets()
+		});
+		return this.attributeHealer;
+	}
+	freshProvenanceCapture() {
+		return new ProvenanceCapture({
+			buildResolverContext: (...args) => this.buildResolverContext(...args),
+			resolver: this.resolver,
+			logger: this.logger
+		});
+	}
+	outputsDeps() {
+		return {
+			options: this.options,
+			logger: this.logger,
+			resolver: this.resolver,
+			buildResolverContext: (...args) => this.buildResolverContext(...args),
+			noEchoPositionSources: (...args) => noEchoPositionSources(this.noEchoRun, ...args)
+		};
+	}
+	noEchoDeps() {
+		return {
+			stackRegion: this.stackRegion,
+			logger: this.logger,
+			providerRegistry: this.providerRegistry,
+			perResourceSecrets: () => this.perResourceSecrets,
+			perResourceTemplateProps: () => this.perResourceTemplateProps,
+			perResourceResolvedType: () => this.perResourceResolvedType,
+			outputsRun: () => this.outputsRun,
+			readReaderForFreshNoEchoCeiling: (...args) => this.readReaderForFreshNoEchoCeiling(...args),
+			maskForResource: (...args) => this.maskForResource(...args)
+		};
 	}
 	async deploy(stackName, template) {
 		this.recordedImports = [];
 		this.recordedOutputReads = [];
 		this.perResourceSecrets = /* @__PURE__ */ new Map();
-		this.noEchoAttributeResources = /* @__PURE__ */ new Map();
-		this.persistedNoEchoAttributes = /* @__PURE__ */ new Map();
-		this.noEchoConditions = void 0;
-		this.inheritedNoEchoParameters = /* @__PURE__ */ new Set();
-		this.noEchoPhysicalIdWarned = /* @__PURE__ */ new Set();
-		this.noEchoPositionedValues = /* @__PURE__ */ new Map();
-		this.noEchoExactEchoes = /* @__PURE__ */ new Map();
-		this.noEchoAttributeReads = /* @__PURE__ */ new Map();
+		this.noEchoRun = new NoEchoRunState();
 		this.replacedDeleteSkips = /* @__PURE__ */ new Map();
 		this.deferredReplacedDeletes = void 0;
 		this.secretNameNeedles = /* @__PURE__ */ new Map();
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
-		this.constructPathTemplate = void 0;
 		this.perResourceResolvedType = /* @__PURE__ */ new Map();
-		this.witnessConfirmedLeaves = /* @__PURE__ */ new Map();
 		this.fingerprintNoEchoValues = void 0;
 		this.preDeploySecretNamedRecords = void 0;
+		this.storedNoEchoNamingValues = /* @__PURE__ */ new Map();
 		this.fingerprintParameters = void 0;
 		this.fingerprintChildTemplates = void 0;
 		this.perResourceInputFingerprints = /* @__PURE__ */ new Map();
@@ -48302,11 +48688,7 @@ var DeployEngine = class {
 		this.resumedCreates = /* @__PURE__ */ new Map();
 		this.generatedNameGuard = void 0;
 		this.liveTaskLabels = /* @__PURE__ */ new Map();
-		this.outputSecrets = /* @__PURE__ */ new Map();
-		this.outputsPassSecretMaps = [];
-		this.outputsTemplateSource = Object.create(null);
-		this.outputsSourceUsable = true;
-		this.skippedOutputs = void 0;
+		this.outputsRun = new OutputsRunState();
 		this.retainedOldOnReplacement = /* @__PURE__ */ new Set();
 		this.replacedOldMaySurvive = /* @__PURE__ */ new Map();
 		this.recreatedUnderSameId = /* @__PURE__ */ new Set();
@@ -48314,19 +48696,15 @@ var DeployEngine = class {
 		this.updatesThatSentNothing = /* @__PURE__ */ new Set();
 		this.updateWasReplaced = /* @__PURE__ */ new Map();
 		this.inPlaceCreateOnlyPaths = /* @__PURE__ */ new Map();
-		this.outputProvenanceSinks = /* @__PURE__ */ new Map();
-		this.outputsResolvedThisRun = /* @__PURE__ */ new WeakSet();
 		this.provenanceBaseline = void 0;
-		this.resolvedOutputsBag = void 0;
-		this.provenanceCaptureTasks = /* @__PURE__ */ new Map();
+		this.provenanceCapture = this.freshProvenanceCapture();
+		this.observedCapture = this.freshObservedCapture();
 		this.oldDeletedBeforeCreate = /* @__PURE__ */ new Set();
-		this.healBaseline = {};
+		this.rebaseline({});
 		this.runProducerRegionEvidence = void 0;
 		this.deployChanges = /* @__PURE__ */ new Map();
 		this.deployStateResources = {};
 		this.inlinePolicyWriters = /* @__PURE__ */ new Map();
-		this.attributeHeals = /* @__PURE__ */ new Map();
-		this.healedAttributes = /* @__PURE__ */ new Map();
 		this.resolver.resetPhysicalIdFallbackCount();
 		const ledger = ledgerForStack(this.stateBackend, stackName, this.stackRegion);
 		return withStackName(stackName, () => this.options.dryRun ? this.doDeploy(stackName, template) : withCreateTokenLedger(ledger, () => this.doDeploy(stackName, template)));
@@ -48337,16 +48715,16 @@ var DeployEngine = class {
 		for (const [logicalId, record] of Object.entries(state.resources)) {
 			const secrets = this.perResourceSecrets.get(logicalId);
 			const templateProps = this.perResourceTemplateProps.get(logicalId);
-			const scrubbed = scrubResourceRecord(this.withHealedAttributes(logicalId, record), secrets ?? /* @__PURE__ */ new Map(), templateProps);
-			const noEchoScrubbed = this.applyNoEchoPersist(logicalId, record, this.withNoEchoExactEchoes(logicalId, scrubbed), templateProps, state.resources, secrets);
-			resources[logicalId] = withReferenceProvenance(withConstructPath(withMaskedPropertyFingerprints(noEchoScrubbed, record.properties, templateProps, secrets, this.fingerprintNoEchoValues, this.perResourceInputFingerprints.get(logicalId)), constructPathOf(this.constructPathTemplate, logicalId)), this.referenceProvenanceToPersist(logicalId, record, noEchoScrubbed, secrets));
+			const scrubbed = scrubResourceRecord(this.attributeHealer.withHealedAttributes(logicalId, record), secrets ?? /* @__PURE__ */ new Map(), templateProps);
+			const noEchoScrubbed = applyNoEchoPersist(this.noEchoRun, this.noEchoDeps(), logicalId, record, withNoEchoExactEchoes(this.noEchoRun, logicalId, scrubbed), templateProps, state.resources, secrets);
+			resources[logicalId] = withReferenceProvenance(withConstructPath(withMaskedPropertyFingerprints(noEchoScrubbed, record.properties, templateProps, secrets, this.fingerprintNoEchoValues, this.perResourceInputFingerprints.get(logicalId)), constructPathOf(this.noEchoRun.constructPathTemplate, logicalId)), this.referenceProvenanceToPersist(logicalId, record, noEchoScrubbed, secrets));
 		}
 		const orphans = state.orphans?.map((entry) => {
 			const sameResource = this.perResourceResolvedType.get(entry.logicalId) === entry.state.resourceType;
 			const orphanTemplateProps = sameResource ? this.perResourceTemplateProps.get(entry.logicalId) : void 0;
 			return {
 				...entry,
-				state: withMaskedPropertyFingerprints(this.applyNoEchoPersist(entry.logicalId, entry.state, scrubResourceRecord(entry.state, (sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), orphanTemplateProps), orphanTemplateProps, state.resources), entry.state.properties, orphanTemplateProps, sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0, sameResource ? this.fingerprintNoEchoValues : void 0, sameResource ? this.perResourceInputFingerprints.get(entry.logicalId) : void 0)
+				state: withMaskedPropertyFingerprints(applyNoEchoPersist(this.noEchoRun, this.noEchoDeps(), entry.logicalId, entry.state, scrubResourceRecord(entry.state, (sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), orphanTemplateProps), orphanTemplateProps, state.resources), entry.state.properties, orphanTemplateProps, sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0, sameResource ? this.fingerprintNoEchoValues : void 0, sameResource ? this.perResourceInputFingerprints.get(entry.logicalId) : void 0)
 			};
 		});
 		const outputs = this.redactOutputs(state.outputs);
@@ -48363,9 +48741,9 @@ var DeployEngine = class {
 		};
 	}
 	outputReferenceProvenanceFor(outputs, redacted) {
-		const sinkOf = (outputKey) => this.outputProvenanceSinks.get(outputKey);
+		const sinkOf = (outputKey) => this.outputsRun.outputProvenanceSinks.get(outputKey);
 		const baseline = this.provenanceBaseline;
-		if (!this.outputsResolvedThisRun.has(outputs) && baseline !== void 0 && outputs === baseline.outputs && baseline.outputReferenceProvenance === void 0 && !baseline.tokenFree && this.resolvedOutputsBag !== void 0 && outputMapsEqual(this.redactOutputs(this.resolvedOutputsBag), redacted)) return outputProvenanceForPersist({
+		if (!this.outputsRun.outputsResolvedThisRun.has(outputs) && baseline !== void 0 && outputs === baseline.outputs && baseline.outputReferenceProvenance === void 0 && !baseline.tokenFree && this.outputsRun.resolvedOutputsBag !== void 0 && outputMapsEqual(this.redactOutputs(this.outputsRun.resolvedOutputsBag), redacted)) return outputProvenanceForPersist({
 			outputs: redacted,
 			resolvedThisRun: true,
 			carriedFrom: void 0,
@@ -48373,7 +48751,7 @@ var DeployEngine = class {
 		});
 		return outputProvenanceForPersist({
 			outputs: redacted,
-			resolvedThisRun: this.outputsResolvedThisRun.has(outputs),
+			resolvedThisRun: this.outputsRun.outputsResolvedThisRun.has(outputs),
 			carriedFrom: baseline !== void 0 && outputs === baseline.outputs ? baseline : void 0,
 			sinkOf
 		});
@@ -48491,17 +48869,6 @@ var DeployEngine = class {
 		return maskingRetryLogger(this.logger, secrets);
 	}
 };
-DeployEngine.prototype.hasPending = hasPending;
-DeployEngine.prototype.buildDeletionDependencies = buildDeletionDependencies;
-DeployEngine.prototype.addImplicitDeleteDependencies = addImplicitDeleteDependencies;
-DeployEngine.prototype.auditResolvedAssetReferences = auditResolvedAssetReferences;
-DeployEngine.prototype.extractAllDependencies = extractAllDependencies;
-DeployEngine.prototype.propertiesToRecord = propertiesToRecord;
-DeployEngine.prototype.extractTemplateAttributes = extractTemplateAttributes;
-DeployEngine.prototype.isPinnedToCcApi = isPinnedToCcApi;
-DeployEngine.prototype.recreateDirectionFor = recreateDirectionFor;
-DeployEngine.prototype.peekRoutingForLabel = peekRoutingForLabel;
-DeployEngine.prototype.preparePropertiesForCcApi = preparePropertiesForCcApi;
 DeployEngine.prototype.buildResolverContext = buildResolverContext;
 DeployEngine.prototype.maskedInputSources = maskedInputSources;
 DeployEngine.prototype.doDeployWithPrefetch = doDeployWithPrefetch;
@@ -48514,11 +48881,6 @@ DeployEngine.prototype.provisionUpdate = provisionUpdate;
 DeployEngine.prototype.updateByReplacement = updateByReplacement;
 DeployEngine.prototype.updateInPlace = updateInPlace;
 DeployEngine.prototype.provisionCreate = provisionCreate;
-DeployEngine.prototype.healStaleAttributes = healStaleAttributes;
-DeployEngine.prototype.isHealEligible = isHealEligible;
-DeployEngine.prototype.readStaleAttributes = readStaleAttributes;
-DeployEngine.prototype.withHealedAttributes = withHealedAttributes;
-DeployEngine.prototype.hasUnpersistedHeals = hasUnpersistedHeals;
 DeployEngine.prototype.replacementDeleteContext = replacementDeleteContext;
 DeployEngine.prototype.prepareFinalSnapshotForDelete = prepareFinalSnapshotForDelete;
 DeployEngine.prototype.replaceDeleteFirstAndRecreate = replaceDeleteFirstAndRecreate;
@@ -48543,15 +48905,9 @@ DeployEngine.prototype.secretNameBagFor = secretNameBagFor;
 DeployEngine.prototype.noteSecretNamedRecord = noteSecretNamedRecord;
 DeployEngine.prototype.printingSecretsFor = printingSecretsFor;
 DeployEngine.prototype.namingSecretsFor = namingSecretsFor;
+DeployEngine.prototype.stateNamingSecrets = stateNamingSecrets;
+DeployEngine.prototype.captureStoredNoEchoNamingValues = captureStoredNoEchoNamingValues;
 DeployEngine.prototype.noteSecretNamedReads = noteSecretNamedReads;
-DeployEngine.prototype.kickOffObservedCapture = kickOffObservedCapture;
-DeployEngine.prototype.drainObservedCaptures = drainObservedCaptures;
-DeployEngine.prototype.kickOffProvenanceCapture = kickOffProvenanceCapture;
-DeployEngine.prototype.drainProvenanceCaptures = drainProvenanceCaptures;
-DeployEngine.prototype.buildObservedCaptureSiblings = buildObservedCaptureSiblings;
-DeployEngine.prototype.stampReasonlessParameterRefusals = stampReasonlessParameterRefusals;
-DeployEngine.prototype.kickOffAutoRefreshObservedProperties = kickOffAutoRefreshObservedProperties;
-DeployEngine.prototype.kickOffMaskedBaselineRecapture = kickOffMaskedBaselineRecapture;
 DeployEngine.prototype.adoptRollbackOrphans = adoptRollbackOrphans;
 DeployEngine.prototype.performRollback = performRollback;
 DeployEngine.prototype.settleJournalAfterSuccess = settleJournalAfterSuccess;
@@ -48563,23 +48919,7 @@ DeployEngine.prototype.rollbackExecutorContext = rollbackExecutorContext;
 DeployEngine.prototype.producerRegionEvidence = producerRegionEvidence;
 DeployEngine.prototype.writeRollbackJournalSegment = writeRollbackJournalSegment;
 DeployEngine.prototype.redactOperationsForJournal = redactOperationsForJournal;
-DeployEngine.prototype.noEchoPositionSources = noEchoPositionSources;
-DeployEngine.prototype.noEchoLeavesFor = noEchoLeavesFor;
-DeployEngine.prototype.applyNoEchoPersist = applyNoEchoPersist;
-DeployEngine.prototype.maskOutputsByPosition = maskOutputsByPosition;
-DeployEngine.prototype.warnNoEchoPhysicalId = warnNoEchoPhysicalId;
-DeployEngine.prototype.seedPersistedNoEchoAttributes = seedPersistedNoEchoAttributes;
-DeployEngine.prototype.noEchoAttributeOverridesFor = noEchoAttributeOverridesFor;
-DeployEngine.prototype.noEchoDiffComparison = noEchoDiffComparison;
-DeployEngine.prototype.noteNoEchoExactEchoes = noteNoEchoExactEchoes;
-DeployEngine.prototype.establishNoEchoEchoFidelity = establishNoEchoEchoFidelity;
-DeployEngine.prototype.withNoEchoExactEchoes = withNoEchoExactEchoes;
-DeployEngine.prototype.handleOutputResolutionFailure = handleOutputResolutionFailure;
-DeployEngine.prototype.resolveOutputs = resolveOutputs;
-DeployEngine.prototype.buildDisplayOutputs = buildDisplayOutputs;
-DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
-DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
-
-//#endregion
-export { S3_AUTO_DELETE_OBJECTS_TAG as $, unpreviewableOrphanRecords as $a, stripControlChars as $c, hasReadableOutputs as $i, unsupportedFinalSnapshotError as $n, carryLogOnlyValues as $o, poisonRenderedSpellingsCollidingIn as $r, crossPrefixDeniedWarning as $s, isJournaledOrphan as $t, diffSecurity as A, refuseMalformedOutputs as Aa, readBootstrapMarkerBody as Ac, isImpossibleEmptyStoredAttribute as Ai, StageLoadError as Al, collectPublishedOutputNames as An, prefetchCreateOnlyPropertyPaths as Ao, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Ar, recordPhysicalNameCopy as As, NESTED_PENDING_PARENT_REASON as At, readProtection as B, refuseMalformedResourcePropertiesForDrift as Ba, finchSecretArgvRefusal as Bc, withSharedDrainBudget as Bi, renderAssemblyPathEscape as Bl, secretNamePrintingBags as Bn, isMarkedCoordinate as Bo, deleteSkipReason as Br, STATE_SOURCED_BASELINE_RULES as Bs, collectNestedChildUnaddressed as Bt, withApiLimit as C, refuseDivergentRecordRegionForDestroy as Ca, AssetModeResolver as Cc, classifyReplaySecretRegion as Ci, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Cl, secretSafeKeyDisplay as Cn, configIntegerRefusal as Co, isCustomResource as Cr, pathCrossesDottedKey as Cs, dropFailedCommands as Ct, findServiceTokenRefusals as D, refuseMalformedOrphans as Da, getBootstrapMarkerKey as Dc, isUnboundTemplateParameter as Di, canonicalizeRegion as Dl, isWholeDynamicReferenceValue as Dn, requireConfigArray as Do, isCustomResourceType as Dr, recoverMaskedOutput as Ds, loadJournaledOrphans as Dt, deferredServiceTokenWarning as E, refuseMalformedOrphanRecordsForDestroy as Ea, ensureAssetStorage as Ec, coerceParameterTypedValue as Ei, PARTITION_TABLE as El, exportNameSecretExposure as En, replayWarn as Eo, readsNoEchoDeleteValues as Er, recordNestedStackParameterExpressions as Es, journaledOrphanLines as Et, recordedProtectionEvidence as F, refuseMalformedResourceEntriesForDestroy as Fa, resolveDockerContextDirectory as Fc, AWS_NO_VALUE as Fi, nullPrototypeRecord as Fl, completedReplayEntries as Fn, lambdaFunctionNameForMask as Fo, unchangedBehindSecretReference as Fr, recordMaskOnlyValuesIn as Fs, nestedChildStackName as Ft, deleteBudgetKey as G, refuseMalformedResourcesForExport as Ga, partitionSensitiveEnv as Gc, STATE_REGION_DIVERGED as Gi, resolveBucketRegion as Gl, ATOMIC_FINAL_SNAPSHOT_TYPES as Gn, noEchoCoordinatesOf as Go, ec2InstanceProtectionSite as Gr, isSingleDynamicReferenceToken as Gs, awaitInFlightSibling as Gt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as H, refuseMalformedResourcePropertiesForOrphan as Ha, getDockerCmd as Hc, passedParameterClassesOf as Hi, injectAwsRegion as Hl, stateSecretNameNeedles as Hn, maskReadbackAtCoordinates as Ho, isWaitAbandonedError as Hr, STATE_SOURCED_READBACK_RULES as Hs, withNestedStackContext as Ht, recordedProtectionNote as I, refuseMalformedResourceEntriesForImport as Ia, describeDockerCapturedOutput as Ic, cfnRefValueFromPhysicalId as Ii, ownValue as Il, journaledOrphanPrintingBag as In, sameLambdaFunctionAddress as Io, RollbackInlinePolicyWriters as Ir, recordNoEchoAttributeValues as Is, recordDisplacedSkips as It, DELETE_INDEX_WAIT_PROCEED_NOTE as J, repairMalformedOrphansForReadOnly as Ja, redactedDockerCause as Jc, UNREADABLE_RESOURCES_MAP_ROW as Ji, ccRoutedFinalSnapshotError as Jn, passedNoEchoParametersOf as Jo, reDisableInstanceApiTermination as Jr, S3StateBackend as Js, withStackRecords as Jt, resolveDynamoDbDeleteBudgetClock as K, refuseMalformedState as Ka, redactDockerArgvValues as Kc, STATE_RESOURCES_MALFORMED as Ki, PRE_DELETE_SNAPSHOT_TYPES as Kn, noEchoLeavesOf as Ko, isTerminationProtectionPropagationError as Kr, LockManager as Ks, destroyStackRecordsView as Kt, PROTECTION_PROPERTY_BY_TYPE as L, refuseMalformedResourceEntriesForImportSave as La, describeDockerExecFailure as Lc, isStalePlaceholderArnAttribute as Li, absoluteAssemblyPathEscape as Ll, maskEventTextWithBoundBags as Ln, DagBuilder as Lo, UNSPECIFIED_SKIP_REASON as Lr, recordNoEchoParameterFreshValue as Ls, revertNestedChildFromJournal as Lt, noEchoComparisonForTemplate as M, refuseMalformedResourceAttributesForOrphan as Ma, validateContainerRepoName as Mc, carriesFetchableDynamicReference as Mi, defineOwnKey as Ml, bindingSkippedOutputs as Mn, describeTypeWithThrottleRetry as Mo, customResourceResponseExpirationWarning as Mr, carriesSecretMask as Ms, displacedPhysicalIdShown as Mt, noEchoExactEchoLeavesOf as N, refuseMalformedResourceEntries as Na, buildDenyExternalAccessPolicy as Nc, isNamelessDynamicReferenceError as Ni, hasOwnKey as Nl, DEFAULT_RESOURCE_TIMEOUT_MS as Nn, withRetry as No, CloudControlProvider as Nr, provenPublicValue as Ns, dropSettledNestedJournals as Nt, serviceTokenBlockingReason as O, refuseMalformedOrphansForDestroy as Oa, isCrossRegionRedirect as Oc, parameterTypeMayLoseSecretIdentity as Oi, derivePartitionAndUrlSuffix as Ol, noEchoParameterValueSeed as On, requireConfigObject as Oo, getCurrentResourceSecrets as Or, physicalNameCopiesOf as Os, makeForeignHolderScan as Ot, noEchoParameterNamesOf as P, refuseMalformedResourceEntriesForDeploy as Pa, buildDockerImage as Pc, keepsSecretReferenceToken as Pi, hasPlainPrototype$1 as Pl, DEFAULT_RESOURCE_WARN_AFTER_MS as Pn, canonicalLambdaFunctionName as Po, slowCcOperationTimeoutMs as Pr, recordMaskOnlyValue as Ps, getNestedRevertRun as Pt, ECR_AUTO_DELETE_IMAGES_TAG as Q, repairMalformedResourcesForReadOnly as Qa, escapeRegExp$3 as Qc, hasReadableOrphans as Qi, refusesFinalSnapshot as Qn, liveMatchesUnresolvedTokenFrame as Qo, IntrinsicFunctionResolver as Qr, applyCrossPrefixScan as Qs, demoteSupersededOrphans as Qt, isProtectionValueActive as R, refuseMalformedResourceEntriesForOrphan as Ra, describeDockerFailure as Rc, refStateLookupFromResource as Ri, describeFileReadFailure as Rl, orphanRecordsPrintingBag as Rn, TemplateParser as Ro, deleteIndeterminateGuards as Rr, recordProvenPublicExpression as Rs, revertedNestedRowIds as Rt, lookupEachName as S, previewableOrphanRecords as Sa, rewriteTemplateAssetReferences as Sc, classifyRecordedSecretRegion as Si, uploadCfnTemplate as Sl, secretBearingStateKeyWarning as Sn, configBooleanRefusal as So, ccBrokenReason as Sr, isUncertifiedBaselineMaskPosition as Ss, deleteJournaledOrphans as St, recordRetainedForReadoption as T, refuseMalformedOrphanRecords as Ta, assertAssetBucketRegion as Tc, regionLessSecretName as Ti, expectedOwnerParam as Tl, exportNameNoEchoParameters as Tn, readConfigString as To, TemplateNoEchoReresolver as Tr, inheritNestedStackParameterAssociations as Ts, isHandledOrphan as Tt, beginDeleteWait as U, refuseMalformedResourcesForDeploy as Ua, isDockerClientEnvKey as Uc, declaresNoEcho as Ui, injectedAwsRegionValue as Ul, storedSecretNameNeedles as Un, maskWholeValue as Uo, markWaitAbandoned as Ur, TEMPLATE_SOURCED_RULES as Us, replayFailedOperations as Ut, DynamoDBGlobalTableProvider as V, refuseMalformedResourcePropertiesForExport as Va, formatDockerLoginError as Vc, parameterInputsFor as Vi, resolveAssemblyPath as Vl, secretNamedRecordNeedles as Vn, maskAtCoordinates as Vo, withIndeterminateGuard as Vr, STATE_SOURCED_CROSS_GENERATION_RULES as Vs, getCurrentNestedStackContext as Vt, compensateRemovedDeletionProtection as W, refuseMalformedResourcesForDestroy as Wa, isMalformedEnvKey as Wc, JSON_LISTING_HOLE_VALUE as Wi, clearBucketRegionCache as Wl, extractDeploymentEventError as Wn, maskedLeafCoordinatesOf as Wo, disableInstanceApiTermination as Wr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ws, replayRollback as Wt, deleteTableWithIndexBusyRetry as X, repairMalformedResourceEntriesForReadOnly as Xa, runDockerStreaming as Xc, deployRefusesOrphanRowsReason as Xi, effectiveDeletionPolicy as Xn, readsNoEchoSource as Xo, DiffCalculator as Xr, CrossPrefixReadError as Xs, replacedDeleteFailureVerdict as Xt, INDEX_SETTLE_POLL_INTERVAL_MS as Y, repairMalformedOutputsForReadOnly as Ya, runDockerForeground as Yc, accountArgs as Yi, createPreDeleteFinalSnapshot as Yn, readbackPathFor as Yo, reEnableInstanceApiTermination as Yr, rebuildClientForBucketRegion as Ys, removeProtectionTypeList as Yt, waitForIndexesSettled as Z, repairMalformedResourcePropertiesForReadOnly as Za, warnFinchArgvExposure as Zc, displayLogicalId as Zi, isFinalSnapshotError as Zn, valueAtCoordinate as Zo, INTRINSIC_KEYS as Zr, CrossPrefixScanCache as Zs, recordAfterRollbackUpdate as Zt, keptWholeReasonText as _, malformedResourceEntriesWarning as _a, stringifyValue as _c, s3BucketArn as _i, ssmResolvedValueType as _l, orphanNeedsIdentity as _n, isWarmThroughputDecrease as _o, tagPlanWarning as _r, scrubResourceRecord as _s, planOrphanAdoption as _t, inheritedProvenanceForChildDiff as a, malformedExportSourceWarning as aa, exportNamesCarriedFrom as ac, explicitRoleArnOrThrow as ai, getDefaultStateBucketName as al, replacementNeverSwapped as an, unwrittenCreateOnlyReplacement as ao, ledgerForStack as ar, recordLogOnlyParameterValue as as, createReadOnlyAttributeHealerFactory as at, chunks as b, malformedScrubResourceEntriesRefusalMessage as ba, createAssetRedirectResolver as bc, s3BucketRegionalDomainName as bi, MIGRATE_TMP_PREFIX as bl, exportAliasCollisionScrubWarning as bn, coerceCfnBoolean as bo, CC_BROKEN_REASON as br, DYNAMIC_REFERENCE_TOKEN_SCAN as bs, pendingRequestCount as bt, isAbsoluteAssetPath as c, malformedLocalResourcesWarning as ca, hasUnverifiableParameterRefusal as cc, AWS_CREDENTIAL_ENV_KEYS as ci, resolveApp as cl, findNestedStackTypeChanges as cn, hasNoCloudControlHandlers as co, acquireIdempotencyToken as cr, unionOfSecretBags as cs, gray as ct, templateIdentity as d, malformedOrphanRowsKeptWarning as da, isReadableBag as dc, envCredentialsAreAssumedRole as di, resolveSkipPrefix as dl, REDACTED_DELETE_ADDRESS_SKIP_REASON as dn, MULTI_REGION_RECREATE_BLOCKED_TYPES as do, DBPROXY_TAGS_WHAT as dr, maskSecretsInError as ds, yellow as dt, hasReadableResources as ea, isAccessDenied$1 as ec, producerLookupOver as ei, stripForDisplay as el, isReplacementOrphan as en, unreadableOrphanRecords as eo, maskingRetryLogger as er, createUnionSecretMasker as es, hasCdkAutoDeleteTag as et, conditionFingerprint as f, malformedOrphansRefusalMessage as fa, orphansAfterRollback as fc, isSettledInstanceState as fi, resolveStateBucketWithDefault as fl, isRedactedRecordedValue as fn, isStatefulRecreateTargetForReplace as fo, DBPROXY_TAG_OPTIONS as fr, maskSecretsInText as fs, computeParameterTaint as ft, isSecretBearingReferenceString as g, malformedRenderedContainersWarning as ga, isSensitiveAttributeName as gc, recordedReferenceRegions as gi, warnDeprecatedNoPrefixCliFlag as gl, updatePartialReason as gn, coerceWarmThroughput as go, tagMapAsList as gr, redactSecretsForState as gs, makeSiblingClaimReader as gt, readRecordedConditionVerdicts as h, malformedOutputsWarning as ha, AssetPublisher as hc, recordedOutputReferenceRegions as hi, stateBucketExistenceConfirmed as hl, updatePartialMessage as hn, WARM_THROUGHPUT_MEMBERS as ho, refuseMalformedDesiredTags as hr, snapshotPassProvenance as hs, resourcesNamingDeclaredParameter as ht, crossStackOutputProvenanceSource as i, malformedExportNamesWarning as ia, describeRegionValueKind as ic, assertSendableRoleArn as ii, synthesisStatusMessage as il, recordUnderIdIsNotOwn as in, findSilentDropProperties as io, earliestDefined as ir, printingCorpusOf as is, formatResourceLine as it, noEchoAttributeNamesOf as j, refuseMalformedOutputsForDestroy as ja, validateAssetBucketName as jc, carriesDynamicReference as ji, processStackMessages as jl, isExportAliasCollision as jn, templateResourceTypes as jo, applyCustomResourceResponseExpiration as jr, splitGetAttStringForm as js, displacedOpClause as jt, withResourceDeadline as k, refuseMalformedOrphansForOrphan as ka, parseBootstrapMarker as kc, getAccountInfo as ki, AssemblyReader as kl, collectDeclaredOutputNames as kn, requireConfigString as ko, withPrintingSecrets as kr, recordAttributeIdCopy as ks, sameJournaledOrphans as kt, listNestedTemplateRows as l, malformedOrphanRecordsRefusalMessage as la, importableOutputKeys as lc, applyCallerIdentityCredentials as li, resolveAutoAssetStorage as ll, getCurrentProducerRegions as ln, findReplacedReadersOfRecreateTargets as lo, isRefusedByName as lr, createSecretMasker as ls, green as lt, parentSuppliedValues as m, malformedOutputsRefusalMessage as ma, shouldRetainResource as mc, outputReferenceProvenanceOf as mi, resolveUseCdkBootstrapAssets as ml, redactedDeleteAddressSkip as mn, renderStatefulReason as mo, readTagList as mr, recordReferenceProvenanceEntry as ms, reachableDivergentParameters as mt, IMPLICIT_DELETE_DEPENDENCIES as n, isReadableResourceEntry as na, splitImportedOps as nc, applyRoleArnIfSet as ni, getDockerImageBySourceHash as nl, planRollback as nn, withheldAccountClause as no, findDestructiveChanges as nr, literalSplitDelimitersOf as ns, getPriorAttempts as nt, childTemplateLoader as o, malformedLocalOutputsWarning as oa, hasReadableExportSet as oc, isIamRoleArn as oi, getLegacyStateBucketName as ol, resolveReplacementOldType as on, withoutSilentDropProperties as oo, reserveStackCreateToken as or, recordLogOnlyValue as os, bold as ot, conditionInputsFrom as p, malformedOrphansWarning as pa, orphansCarriedFrom as pc, keepHeldTokenProvenance as pi, resolveStateBucketWithDefaultAndSource as pl, redactedDeleteAddressFields as pn, isStatefulRecreateTargetSync as po, planTagDiff as pr, markSameGenerationBag as ps, namesAnyDeclaredParameter as pt, resolveDynamoDbDeleteBudgetMs as q, repairMalformedOrphanRecordsForReadOnly as qa, redactedCause as qc, UNREADABLE_ORPHANS_CONTAINER_ROW as qi, buildFinalSnapshotIdentifier as qn, noEchoOutputsComparison as qo, observeThenDisableInstanceApiTermination as qr, isLockInfoExpired as qs, getStackRecords as qt, computeImplicitDeleteEdges as r, malformedDriftResourcePropertiesWarning as ra, acceptedCreateOnlyDropsOf as rc, assertFlagRoleArn as ri, Synthesizer as rl, recheckFailedPlan as rn, findActionableSilentDrops as ro, formatDestructiveChange as rr, logOnlyValueCount as rs, markRefusedBeforeApplying as rt, findNestedTemplateTreeDefect as s, malformedLocalResourceEntriesWarning as sa, hasReasonlessBaselineRefusal as sc, sendableAssumeRoleCommand as si, loadCdkJson as sl, seedsDeleteFirstGuard as sn, NO_CC_HANDLERS_REASON as so, withCreateTokenLedger as sr, shareLogOnlyValues as ss, cyan as st, DeployEngine as t, isReadableOrphanRecord as ta, isNotImplemented as tc, refuseUnreadableCdkCrossAccountRefs as ti, AssetManifestLoader as tl, planFailedOps as tn, unreadableResourceEntries as to, constructPathOf as tr, hasMaskableValues as ts, isTruthyCfnBoolean as tt, renderNestedTemplateTreeDefect as u, malformedOrphanRecordsWarning as ua, importableOutputs as uc, callerEnvCredentials as ui, resolveCaptureObservedState as ul, inheritProducerRegions as un, shownType as uo, markDeleteStarted as ur, errorCauseChain as us, red as ut, mergeNoChangeOutputs as v, malformedResourcePropertiesWarning as va, WorkGraph as vc, s3BucketDomainName as vi, CFN_TEMPLATE_BODY_LIMIT as vl, WITHHELD_NAME_DISPLAY as vn, toCfnInteger as vo, definedAttributes as vr, withPhysicalNameCopies as vs, DeploymentEventsReader as vt, keptForReadoption as w, refuseMalformedNestedChildOutputs as wa, BOOTSTRAP_MARKER_PREFIX as wc, producerRegionsFromState as wi, decodeListingKey as wl, carriedExportAliasExposure as wn, configStringRefusal as wo, wouldReturnToSdkProvider as wr, identityKeyFor as ws, dropFailedHint as wt, isAccessDeniedError as x, malformedStateRefusalMessage as xa, loadPublishableAssetManifest as xc, s3BucketWebsiteUrl as xi, findLargeInlineResources as xl, secretBearing as xn, coerceCfnInteger as xo, ProviderRegistry as xr, dynamicReferenceTokens as xs, resolvePendingCloudControlRequests as xt, makeCanonicalizePropertiesFn as y, malformedResourcesWarning as ya, buildAssetRedirectMap as yc, s3BucketDualStackDomainName as yi, CFN_TEMPLATE_URL_LIMIT as yl, displayTextOrWithheld as yn, toFiniteNumber as yo, stringifyIfAssigned as yr, withoutPhysicalNameCopies as ys, DeploymentEventsStore as yt, perType as z, refuseMalformedResourcePropertiesForDestroy as za, dockerSpawnEnvWithSensitive as zc, parseWebACLArn as zi, displayAssemblyPath as zl, secretNamePrintingBag as zn, canonicalCoordinates as zo, deleteLeftInPlace as zr, wholeStringLeavesOf as zs, withNestedRevertRun as zt };
-//# sourceMappingURL=deploy-engine--5XWdjW3.js.map
+
+//#endregion
+export { markRefusedBeforeApplying as $, repairMalformedResourceEntriesForReadOnly as $a, runDockerForeground as $c, deployRefusesOrphanRowsReason as $i, isFinalSnapshotError as $n, readsNoEchoSource as $o, DiffCalculator as $r, rebuildClientForBucketRegion as $s, isJournaledOrphan as $t, diffSecurity as A, refuseMalformedOrphans as Aa, ensureAssetStorage as Ac, isUnboundTemplateParameter as Ai, PARTITION_TABLE as Al, collectPublishedOutputNames as An, requireConfigArray as Ao, isCustomResourceType as Ar, recordNestedStackParameterExpressions as As, NESTED_PENDING_PARENT_REASON as At, compensateRemovedDeletionProtection as B, refuseMalformedResourceEntriesForImportSave as Ba, describeDockerCapturedOutput as Bc, isStalePlaceholderArnAttribute as Bi, ownValue as Bl, secretNamePrintingBag as Bn, DagBuilder as Bo, UNSPECIFIED_SKIP_REASON as Br, recordNoEchoAttributeValues as Bs, collectNestedChildUnaddressed as Bt, computeImplicitDeleteEdges as C, malformedScrubResourceEntriesRefusalMessage as Ca, buildAssetRedirectMap as Cc, s3BucketRegionalDomainName as Ci, CFN_TEMPLATE_URL_LIMIT as Cl, secretSafeKeyDisplay as Cn, coerceCfnBoolean as Co, ProviderRegistry as Cr, withoutPhysicalNameCopies as Cs, dropFailedCommands as Ct, findServiceTokenRefusals as D, refuseMalformedNestedChildOutputs as Da, AssetModeResolver as Dc, producerRegionsFromState as Di, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Dl, isWholeDynamicReferenceValue as Dn, configStringRefusal as Do, waitForLambdaFunctionActive as Dr, pathCrossesDottedKey as Ds, loadJournaledOrphans as Dt, deferredServiceTokenWarning as E, refuseDivergentRecordRegionForDestroy as Ea, rewriteTemplateAssetReferences as Ec, classifyReplaySecretRegion as Ei, uploadCfnTemplate as El, exportNameSecretExposure as En, configIntegerRefusal as Eo, wouldReturnToSdkProvider as Er, isUncertifiedBaselineMaskPosition as Es, journaledOrphanLines as Et, perType as F, refuseMalformedResourceAttributesForOrphan as Fa, validateAssetBucketName as Fc, carriesFetchableDynamicReference as Fi, processStackMessages as Fl, completedReplayEntries as Fn, describeTypeWithThrottleRetry as Fo, customResourceResponseExpirationWarning as Fr, splitGetAttStringForm as Fs, nestedChildStackName as Ft, INDEX_SETTLE_POLL_INTERVAL_MS as G, refuseMalformedResourcePropertiesForOrphan as Ga, formatDockerLoginError as Gc, passedParameterClassesOf as Gi, resolveAssemblyPath as Gl, storedSecretNameNeedles as Gn, maskReadbackAtCoordinates as Go, isWaitAbandonedError as Gr, STATE_SOURCED_CROSS_GENERATION_RULES as Gs, awaitInFlightSibling as Gt, resolveDynamoDbDeleteBudgetClock as H, refuseMalformedResourcePropertiesForDestroy as Ha, describeDockerFailure as Hc, parseWebACLArn as Hi, describeFileReadFailure as Hl, secretNamedAttributeNamesOf as Hn, canonicalCoordinates as Ho, deleteLeftInPlace as Hr, recordProvenPublicExpression as Hs, withNestedStackContext as Ht, readProtection as I, refuseMalformedResourceEntries as Ia, validateContainerRepoName as Ic, isNamelessDynamicReferenceError as Ii, defineOwnKey as Il, journaledOrphanPrintingBag as In, withRetry as Io, CloudControlProvider as Ir, carriesSecretMask as Is, recordDisplacedSkips as It, ECR_AUTO_DELETE_IMAGES_TAG as J, refuseMalformedResourcesForExport as Ja, isMalformedEnvKey as Jc, STATE_REGION_DIVERGED as Ji, clearBucketRegionCache as Jl, PRE_DELETE_SNAPSHOT_TYPES as Jn, noEchoCoordinatesOf as Jo, ec2InstanceProtectionSite as Jr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Js, withStackRecords as Jt, deleteTableWithIndexBusyRetry as K, refuseMalformedResourcesForDeploy as Ka, getDockerCmd as Kc, declaresNoEcho as Ki, injectAwsRegion as Kl, extractDeploymentEventError as Kn, maskWholeValue as Ko, markWaitAbandoned as Kr, STATE_SOURCED_READBACK_RULES as Ks, destroyStackRecordsView as Kt, DynamoDBGlobalTableProvider as L, refuseMalformedResourceEntriesForDeploy as La, buildDenyExternalAccessPolicy as Lc, keepsSecretReferenceToken as Li, hasOwnKey as Ll, maskEventTextWithBoundBags as Ln, canonicalLambdaFunctionName as Lo, slowCcOperationTimeoutMs as Lr, provenPublicValue as Ls, revertNestedChildFromJournal as Lt, recordedProtectionNote as M, refuseMalformedOrphansForOrphan as Ma, isCrossRegionRedirect as Mc, getAccountInfo as Mi, derivePartitionAndUrlSuffix as Ml, bindingSkippedOutputs as Mn, requireConfigString as Mo, withPrintingSecrets as Mr, physicalNameCopiesOf as Ms, displacedPhysicalIdShown as Mt, PROTECTION_PROPERTY_BY_TYPE as N, refuseMalformedOutputs as Na, parseBootstrapMarker as Nc, isImpossibleEmptyStoredAttribute as Ni, AssemblyReader as Nl, DEFAULT_RESOURCE_TIMEOUT_MS as Nn, prefetchCreateOnlyPropertyPaths as No, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Nr, recordAttributeIdCopy as Ns, dropSettledNestedJournals as Nt, serviceTokenBlockingReason as O, refuseMalformedOrphanRecords as Oa, BOOTSTRAP_MARKER_PREFIX as Oc, regionLessSecretName as Oi, decodeListingKey as Ol, noEchoParameterValueSeed as On, readConfigString as Oo, TemplateNoEchoReresolver as Or, identityKeyFor as Os, makeForeignHolderScan as Ot, isProtectionValueActive as P, refuseMalformedOutputsForDestroy as Pa, readBootstrapMarkerBody as Pc, carriesDynamicReference as Pi, StageLoadError as Pl, DEFAULT_RESOURCE_WARN_AFTER_MS as Pn, templateResourceTypes as Po, applyCustomResourceResponseExpiration as Pr, recordPhysicalNameCopy as Ps, getNestedRevertRun as Pt, getPriorAttempts as Q, repairMalformedOutputsForReadOnly as Qa, redactedDockerCause as Qc, accountArgs as Qi, effectiveDeletionPolicy as Qn, readbackPathFor as Qo, reEnableInstanceApiTermination as Qr, S3StateBackend as Qs, demoteSupersededOrphans as Qt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as R, refuseMalformedResourceEntriesForDestroy as Ra, buildDockerImage as Rc, AWS_NO_VALUE as Ri, hasPlainPrototype$1 as Rl, namingSecretsWithRecordedNoEcho as Rn, lambdaFunctionNameForMask as Ro, unchangedBehindSecretReference as Rr, recordMaskOnlyValue as Rs, revertedNestedRowIds as Rt, IMPLICIT_DELETE_DEPENDENCIES as S, malformedResourcesWarning as Sa, WorkGraph as Sc, s3BucketDualStackDomainName as Si, CFN_TEMPLATE_BODY_LIMIT as Sl, secretBearingStateKeyWarning as Sn, toFiniteNumber as So, CC_BROKEN_REASON as Sr, withPhysicalNameCopies as Ss, deleteJournaledOrphans as St, recordRetainedForReadoption as T, previewableOrphanRecords as Ta, loadPublishableAssetManifest as Tc, classifyRecordedSecretRegion as Ti, findLargeInlineResources as Tl, exportNameNoEchoParameters as Tn, configBooleanRefusal as To, isCustomResource as Tr, dynamicReferenceTokens as Ts, isHandledOrphan as Tt, resolveDynamoDbDeleteBudgetMs as U, refuseMalformedResourcePropertiesForDrift as Ua, dockerSpawnEnvWithSensitive as Uc, withSharedDrainBudget as Ui, displayAssemblyPath as Ul, secretNamedRecordNeedles as Un, isMarkedCoordinate as Uo, deleteSkipReason as Ur, wholeStringLeavesOf as Us, replayFailedOperations as Ut, deleteBudgetKey as V, refuseMalformedResourceEntriesForOrphan as Va, describeDockerExecFailure as Vc, refStateLookupFromResource as Vi, absoluteAssemblyPathEscape as Vl, secretNamePrintingBags as Vn, TemplateParser as Vo, deleteIndeterminateGuards as Vr, recordNoEchoParameterFreshValue as Vs, getCurrentNestedStackContext as Vt, DELETE_INDEX_WAIT_PROCEED_NOTE as W, refuseMalformedResourcePropertiesForExport as Wa, finchSecretArgvRefusal as Wc, parameterInputsFor as Wi, renderAssemblyPathEscape as Wl, stateSecretNameNeedles as Wn, maskAtCoordinates as Wo, withIndeterminateGuard as Wr, STATE_SOURCED_BASELINE_RULES as Ws, replayRollback as Wt, hasCdkAutoDeleteTag as X, repairMalformedOrphanRecordsForReadOnly as Xa, redactDockerArgvValues as Xc, UNREADABLE_ORPHANS_CONTAINER_ROW as Xi, ccRoutedFinalSnapshotError as Xn, noEchoOutputsComparison as Xo, observeThenDisableInstanceApiTermination as Xr, LockManager as Xs, replacedDeleteFailureVerdict as Xt, S3_AUTO_DELETE_OBJECTS_TAG as Y, refuseMalformedState as Ya, partitionSensitiveEnv as Yc, STATE_RESOURCES_MALFORMED as Yi, resolveBucketRegion as Yl, buildFinalSnapshotIdentifier as Yn, noEchoLeavesOf as Yo, isTerminationProtectionPropagationError as Yr, isSingleDynamicReferenceToken as Ys, removeProtectionTypeList as Yt, isTruthyCfnBoolean as Z, repairMalformedOrphansForReadOnly as Za, redactedCause as Zc, UNREADABLE_RESOURCES_MAP_ROW as Zi, createPreDeleteFinalSnapshot as Zn, passedNoEchoParametersOf as Zo, reDisableInstanceApiTermination as Zr, isLockInfoExpired as Zs, recordAfterRollbackUpdate as Zt, makeCanonicalizePropertiesFn as _, malformedOutputsRefusalMessage as _a, orphansCarriedFrom as _c, outputReferenceProvenanceOf as _i, resolveStateBucketWithDefaultAndSource as _l, orphanNeedsIdentity as _n, renderStatefulReason as _o, refuseMalformedDesiredTags as _r, markSameGenerationBag as _s, planOrphanAdoption as _t, findNestedTemplateTreeDefect as a, isReadableResourceEntry as aa, isNotImplemented as ac, applyRoleArnIfSet as ai, AssetManifestLoader as al, replacementNeverSwapped as an, withheldAccountClause as ao, formatDestructiveChange as ar, hasMaskableValues as as, red as at, lookupEachName as b, malformedResourceEntriesWarning as ba, isSensitiveAttributeName as bc, s3BucketArn as bi, warnDeprecatedNoPrefixCliFlag as bl, exportAliasCollisionScrubWarning as bn, isWarmThroughputDecrease as bo, definedAttributes as br, redactSecretsForState as bs, pendingRequestCount as bt, renderNestedTemplateTreeDefect as c, malformedExportSourceWarning as ca, describeRegionValueKind as cc, explicitRoleArnOrThrow as ci, synthesisStatusMessage as cl, findNestedStackTypeChanges as cn, unwrittenCreateOnlyReplacement as co, reserveStackCreateToken as cr, printingCorpusOf as cs, namesAnyDeclaredParameter as ct, conditionInputsFrom as d, malformedLocalResourcesWarning as da, hasReasonlessBaselineRefusal as dc, AWS_CREDENTIAL_ENV_KEYS as di, loadCdkJson as dl, REDACTED_DELETE_ADDRESS_SKIP_REASON as dn, hasNoCloudControlHandlers as do, isRefusedByName as dr, shareLogOnlyValues as ds, noEchoAttributeNamesOf as dt, displayLogicalId as ea, CrossPrefixReadError as ec, INTRINSIC_KEYS as ei, runDockerStreaming as el, isReplacementOrphan as en, repairMalformedResourcePropertiesForReadOnly as eo, refusesFinalSnapshot as er, recordedNoEchoValuesOf as es, formatResourceLine as et, parentSuppliedValues as f, malformedOrphanRecordsRefusalMessage as fa, hasUnverifiableParameterRefusal as fc, applyCallerIdentityCredentials as fi, resolveApp as fl, isRedactedRecordedValue as fn, findReplacedReadersOfRecreateTargets as fo, markDeleteStarted as fr, unionOfSecretBags as fs, noEchoComparisonForTemplate as ft, mergeNoChangeOutputs as g, malformedOrphansWarning as ga, orphansAfterRollback as gc, keepHeldTokenProvenance as gi, resolveStateBucketWithDefault as gl, updatePartialReason as gn, isStatefulRecreateTargetSync as go, readTagList as gr, maskSecretsInText as gs, makeSiblingClaimReader as gt, keptWholeReasonText as h, malformedOrphansRefusalMessage as ha, isReadableBag as hc, isSettledInstanceState as hi, resolveSkipPrefix as hl, updatePartialMessage as hn, isStatefulRecreateTargetForReplace as ho, planTagDiff as hr, maskSecretsInError as hs, createReadOnlyAttributeHealerFactory as ht, childTemplateLoader as i, isReadableOrphanRecord as ia, isAccessDenied$1 as ic, refuseUnreadableCdkCrossAccountRefs as ii, stripForDisplay as il, recordUnderIdIsNotOwn as in, unreadableResourceEntries as io, findDestructiveChanges as ir, createUnionSecretMasker as is, green as it, recordedProtectionEvidence as j, refuseMalformedOrphansForDestroy as ja, getBootstrapMarkerKey as jc, parameterTypeMayLoseSecretIdentity as ji, canonicalizeRegion as jl, isExportAliasCollision as jn, requireConfigObject as jo, getCurrentResourceSecrets as jr, recoverMaskedOutput as js, displacedOpClause as jt, withResourceDeadline as k, refuseMalformedOrphanRecordsForDestroy as ka, assertAssetBucketRegion as kc, coerceParameterTypedValue as ki, expectedOwnerParam as kl, collectDeclaredOutputNames as kn, replayWarn as ko, readsNoEchoDeleteValues as kr, inheritNestedStackParameterAssociations as ks, sameJournaledOrphans as kt, templateIdentity as l, malformedLocalOutputsWarning as la, exportNamesCarriedFrom as lc, isIamRoleArn as li, getDefaultStateBucketName as ll, getCurrentProducerRegions as ln, withoutSilentDropProperties as lo, withCreateTokenLedger as lr, recordLogOnlyParameterValue as ls, reachableDivergentParameters as lt, isSecretBearingReferenceString as m, malformedOrphanRowsKeptWarning as ma, importableOutputs as mc, envCredentialsAreAssumedRole as mi, resolveCaptureObservedState as ml, redactedDeleteAddressSkip as mn, MULTI_REGION_RECREATE_BLOCKED_TYPES as mo, DBPROXY_TAG_OPTIONS as mr, errorCauseChain as ms, noEchoParameterNamesOf as mt, crossStackOutputProvenanceSource as n, hasReadableOutputs as na, applyCrossPrefixScan as nc, poisonRenderedSpellingsCollidingIn as ni, escapeRegExp$3 as nl, planRollback as nn, unpreviewableOrphanRecords as no, maskingRetryLogger as nr, liveMatchesUnresolvedTokenFrame as ns, cyan as nt, isAbsoluteAssetPath as o, malformedDriftResourcePropertiesWarning as oa, splitImportedOps as oc, assertFlagRoleArn as oi, getDockerImageBySourceHash as ol, resolveReplacementOldType as on, findActionableSilentDrops as oo, earliestDefined as or, literalSplitDelimitersOf as os, yellow as ot, readRecordedConditionVerdicts as p, malformedOrphanRecordsWarning as pa, importableOutputKeys as pc, callerEnvCredentials as pi, resolveAutoAssetStorage as pl, redactedDeleteAddressFields as pn, shownType as po, DBPROXY_TAGS_WHAT as pr, createSecretMasker as ps, noEchoExactEchoLeavesOf as pt, waitForIndexesSettled as q, refuseMalformedResourcesForDestroy as qa, isDockerClientEnvKey as qc, JSON_LISTING_HOLE_VALUE as qi, injectedAwsRegionValue as ql, ATOMIC_FINAL_SNAPSHOT_TYPES as qn, maskedLeafCoordinatesOf as qo, disableInstanceApiTermination as qr, TEMPLATE_SOURCED_RULES as qs, getStackRecords as qt, inheritedProvenanceForChildDiff as r, hasReadableResources as ra, crossPrefixDeniedWarning as rc, producerLookupOver as ri, stripControlChars as rl, recheckFailedPlan as rn, unreadableOrphanRecords as ro, constructPathOf as rr, carryLogOnlyValues as rs, gray as rt, listNestedTemplateRows as s, malformedExportNamesWarning as sa, acceptedCreateOnlyDropsOf as sc, assertSendableRoleArn as si, Synthesizer as sl, seedsDeleteFirstGuard as sn, findSilentDropProperties as so, ledgerForStack as sr, logOnlyValueCount as ss, computeParameterTaint as st, DeployEngine as t, hasReadableOrphans as ta, CrossPrefixScanCache as tc, IntrinsicFunctionResolver as ti, warnFinchArgvExposure as tl, planFailedOps as tn, repairMalformedResourcesForReadOnly as to, unsupportedFinalSnapshotError as tr, valueAtCoordinate as ts, bold as tt, conditionFingerprint as u, malformedLocalResourceEntriesWarning as ua, hasReadableExportSet as uc, sendableAssumeRoleCommand as ui, getLegacyStateBucketName as ul, inheritProducerRegions as un, NO_CC_HANDLERS_REASON as uo, acquireIdempotencyToken as ur, recordLogOnlyValue as us, resourcesNamingDeclaredParameter as ut, chunks as v, malformedOutputsWarning as va, shouldRetainResource as vc, recordedOutputReferenceRegions as vi, resolveUseCdkBootstrapAssets as vl, WITHHELD_NAME_DISPLAY as vn, WARM_THROUGHPUT_MEMBERS as vo, tagMapAsList as vr, recordReferenceProvenanceEntry as vs, DeploymentEventsReader as vt, keptForReadoption as w, malformedStateRefusalMessage as wa, createAssetRedirectResolver as wc, s3BucketWebsiteUrl as wi, MIGRATE_TMP_PREFIX as wl, carriedExportAliasExposure as wn, coerceCfnInteger as wo, ccBrokenReason as wr, DYNAMIC_REFERENCE_TOKEN_SCAN as ws, dropFailedHint as wt, withApiLimit as x, malformedResourcePropertiesWarning as xa, stringifyValue as xc, s3BucketDomainName as xi, ssmResolvedValueType as xl, secretBearing as xn, toCfnInteger as xo, stringifyIfAssigned as xr, scrubResourceRecord as xs, resolvePendingCloudControlRequests as xt, isAccessDeniedError as y, malformedRenderedContainersWarning as ya, AssetPublisher as yc, recordedReferenceRegions as yi, stateBucketExistenceConfirmed as yl, displayTextOrWithheld as yn, coerceWarmThroughput as yo, tagPlanWarning as yr, snapshotPassProvenance as ys, DeploymentEventsStore as yt, beginDeleteWait as z, refuseMalformedResourceEntriesForImport as za, resolveDockerContextDirectory as zc, cfnRefValueFromPhysicalId as zi, nullPrototypeRecord as zl, orphanRecordsPrintingBag as zn, sameLambdaFunctionAddress as zo, RollbackInlinePolicyWriters as zr, recordMaskOnlyValuesIn as zs, withNestedRevertRun as zt };
+//# sourceMappingURL=deploy-engine-BIPU9Xdh.js.map