@go-to-k/cdkd 0.301.3 → 0.301.4

package/dist/{deploy-engine-CZaafy9R.js → deploy-engine-BIPU9Xdh.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-B_CEQGE1.js"
 import { A as UNRENDERABLE, B as safeMsg, C as looksLikeCdkdGeneratedName, D as SAFE_MSG_ALTERED_CHAR, E as withoutGeneratedFallbackName, F as displaySafe, H as terminalSafe, I as displayStackName, L as isPasteableIdent, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, S as getCurrentStackName, T as withStackName, U as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, j as asIsMessage, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
 import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, An as SHELL_ACTIVE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, Ct as RETRY_AUXILIARY_OWNER, Dn as normalizeAwsError, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as isUpdateUnsupportedError, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as withheldTargetClause, Ht as recoveryCommandFlags, In as pasteableCommand, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as isNameCooldownError, Kn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as physicalIdShownBesideCommand, M as quotedRemedyLogicalId, Mn as UNSHOWABLE_VALUE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Ot as hasCreatedBeforeFailure, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as plainOrDescribed, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Ut as sanitizeRecoveryValue, Vn as shellQuote, Vt as formatLockOwner, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isReplayedNameCollisionFrom, Yn as isRecreateRetryableError, Yt as producerRecordKey, Zt as withPasteableAwsProfile, _t as createMaskedLogSinks, ar as isRetryableTransientError, at as startInterruptWatch, bn as ResourceUpdateNotSupportedError, bt as maskDeep, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dr as markNonRetryable, en as clientDefaultsFor, er as formatRetryClassificationSignals, f as removalWarning, fr as markRedactedCause, ft as logicalIdShown, gt as stateOrphanRecordRemedy, hn as MalformedProducerRecordRefusalError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isIamPropagationError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as SHELL_ACTIVE_WHY, jt as markAuxiliaryFailure, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DynamicReferenceRegionAmbiguousError, lr as isMarkedNonRetryable, m as withoutInjectedRemovals, mn as MacroExpansionError, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, on as CrossAccountSecretRefusalError, or as isTransientServerError, ot as ElapsedBudgetRegistry, pn as LockError, pr as wrapMaskedAwsError, qn as isNameCollisionErrorFrom, rn as AssetError, sn as DependencyError, sr as retryClassificationText, st as monotonicNowMs, tn as credentialFingerprint, tr as isAmbiguousCcHandlerErrorCode, un as IntrinsicResolutionRefusalError, ur as isThrottlingError, ut as compositeIdSeparatorRefusal, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as SynthesisError, wt as carryCreatedBeforeFailure, xt as maskerOrIdentity, yn as ResourceTimeoutError, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-BkeM7IXi.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-DBXBcg0J.js";
-import { t as getCdkdVersion } from "./version-Cx2pAgJv.js";
+import { t as getCdkdVersion } from "./version-Bft5jrTk.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -10557,6 +10557,43 @@ function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
 	walk(template, resolved, []);
 	return coordinates;
 }
+function noEchoParameterNodesAt(templateProperties, shape, noEchoParameters, conditions) {
+	const nodes = /* @__PURE__ */ new Map();
+	noEchoCoordinatesOf(templateProperties ?? {}, shape, {
+		parameters: noEchoParameters,
+		...conditions !== void 0 && { conditions }
+	}, (coordinate, node) => nodes.set(canonicalJson$3(coordinate), {
+		coordinate,
+		node
+	}));
+	return nodes;
+}
+function recordedNoEchoValuesOf(templateProperties, record, noEchoParameterNames, conditions) {
+	const bag = /* @__PURE__ */ new Map();
+	const properties = record?.properties;
+	if (properties === null || typeof properties !== "object") return bag;
+	const coordinates = /* @__PURE__ */ new Map();
+	if (noEchoParameterNames.size > 0 && templateProperties !== void 0) for (const [key, { coordinate }] of noEchoParameterNodesAt(templateProperties, properties, noEchoParameterNames, conditions)) coordinates.set(key, coordinate);
+	for (const coordinate of noEchoLeavesOf(record ?? {}) ?? []) coordinates.set(canonicalJson$3(coordinate), coordinate);
+	const recordLeaf = (leaf) => {
+		if (typeof leaf === "string") {
+			if (leaf === "***" || leaf.includes("{{resolve:")) return;
+			recordLogOnlyValue(bag, leaf);
+		} else if (typeof leaf === "number") recordLogOnlyValue(bag, String(leaf));
+	};
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (value) => {
+		if (value === null || typeof value !== "object") {
+			recordLeaf(value);
+			return;
+		}
+		if (seen.has(value)) return;
+		seen.add(value);
+		for (const child of Object.values(value)) walk(child);
+	};
+	for (const coordinate of coordinates.values()) walk(valueAtCoordinate(properties, coordinate));
+	return bag;
+}
 function maskWholeValue(value) {
 	if (value === null || value === void 0) return value;
 	if (typeof value === "string" && isSingleDynamicReferenceToken(value)) return value;
@@ -27015,7 +27052,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Di3xOH3L.js");
+			const { ASGProvider } = await import("./asg-provider--GY-B-zI.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -27121,7 +27158,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-Dadp11aB.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DTUriVz3.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-DI_O0_iG.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DoKgbZCz.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -28280,14 +28317,6 @@ function recordLeaves(bag, value) {
 	}
 	recordLogOnlyParameterValue(bag, value);
 }
-function templateNodesAt(templateProperties, shape, noEchoParameters, conditions) {
-	const nodes = /* @__PURE__ */ new Map();
-	noEchoCoordinatesOf(templateProperties ?? {}, shape, {
-		parameters: noEchoParameters,
-		...conditions !== void 0 && { conditions }
-	}, (coordinate, node) => nodes.set(canonicalJson$3(coordinate), node));
-	return nodes;
-}
 async function fingerprintsUnchanged(record, templateProperties, coordinate, fingerprinter) {
 	const key = coordinate[0];
 	if (typeof key !== "string") return false;
@@ -28309,7 +28338,7 @@ async function noEchoDeleteValuesFromResolved(options) {
 	if (masked.length === 0 || templateResource === void 0 || resolvedProperties === void 0) return;
 	if (templateResource.Type !== record.resourceType) return void 0;
 	if (carriesResolvedSecret(options.secrets)) return void 0;
-	const nodes = templateNodesAt(templateResource.Properties, resolvedProperties, options.noEchoParameters, options.conditions);
+	const nodes = noEchoParameterNodesAt(templateResource.Properties, resolvedProperties, options.noEchoParameters, options.conditions);
 	const bag = new Map(options.secrets);
 	carryLogOnlyValues(options.secrets, bag);
 	const templateProps = isRecord(templateResource.Properties) ? templateResource.Properties : {};
@@ -28474,6 +28503,11 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 		}
 		return bag;
 	}
+	recordedNoEchoValuesFor(logicalId, record) {
+		const resources = this.options.template.Resources;
+		const templateResource = resources !== void 0 && resources !== null && Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+		return recordedNoEchoValuesOf(templateResource?.Type === record?.resourceType ? templateResource?.Properties : void 0, record, this.noEchoParameters, void 0);
+	}
 	async valuesFor(logicalId, record) {
 		const masked = maskedNoEchoCoordinates(record.properties, noEchoLeavesOf(record));
 		if (masked.length === 0) return void 0;
@@ -28482,7 +28516,7 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 		if (templateResource?.Type !== record.resourceType) return void 0;
 		const parameters = await this.boundParameters();
 		if (parameters === void 0) return void 0;
-		const nodes = templateNodesAt(templateResource.Properties, record.properties, this.noEchoParameters, void 0);
+		const nodes = noEchoParameterNodesAt(templateResource.Properties, record.properties, this.noEchoParameters, void 0);
 		const declared = new Set(Object.keys(this.options.template.Parameters ?? {}));
 		const templateProps = isRecord(templateResource.Properties) ? templateResource.Properties : {};
 		const fingerprinter = inputFingerprinter(templateProps, this.inputSources(parameters));
@@ -28492,7 +28526,7 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 		for (const coordinate of masked) {
 			const key = canonicalJson$3(coordinate);
 			if (!nodes.has(key)) continue;
-			const node = nodes.get(key);
+			const node = nodes.get(key)?.node;
 			if (!readsParametersOnly(node, declared, refused)) continue;
 			if (!await fingerprintsUnchanged(record, templateProps, coordinate, fingerprinter)) continue;
 			let value;
@@ -32188,96 +32222,103 @@ function deepEqualValue(a, b) {
 
 //#endregion
 //#region src/deployment/deploy-engine/provenance-capture.ts
-function kickOffProvenanceCapture(args) {
-	const { noChange, resources, template } = args;
-	let chain = Promise.resolve();
-	for (const logicalId of noChange) {
-		const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
-		if (record === void 0 || hasReferenceProvenanceField(record)) continue;
-		const tokens = recordReferenceTokens(record);
-		if (tokens.size === 0) continue;
-		const properties = (Object.hasOwn(template.Resources, logicalId) ? template.Resources[logicalId] : void 0)?.Properties ?? {};
-		const task = chain.then(() => captureOne(this, logicalId, record, tokens, properties, args)).catch(() => ({
-			record,
-			field: void 0
-		}));
-		chain = task;
-		this.provenanceCaptureTasks.set(logicalId, task);
+var ProvenanceCapture = class {
+	tasks = /* @__PURE__ */ new Map();
+	deps;
+	constructor(deps) {
+		this.deps = deps;
 	}
-}
-function warnUnattributed(engine, logicalId) {
-	engine.logger.warn(safeMsg`Could not record where the secret reference(s) in ${logicalId} were resolved (state schema v12 migration). cdkd keeps its previous handling of them; update ${logicalId} to record it.`);
-}
-async function captureOne(engine, logicalId, record, tokens, properties, args) {
-	const bag = /* @__PURE__ */ new Map();
-	const { attributeHealer: _healer, ...base } = engine.buildResolverContext({
-		template: args.template,
-		resources: { ...args.resources },
-		...args.parameters && { parameters: args.parameters },
-		...args.conditions && { conditions: args.conditions }
-	}, args.stackName);
-	const { producerSecrets: _producer, ...withoutRecorders } = base;
-	const context = {
-		...withoutRecorders,
-		recordedSecretValues: bag,
-		recordedImports: [],
-		recordedOutputReads: [],
-		staleAttributeHeal: { phase: "probe" },
-		printingSecrets: /* @__PURE__ */ new Map(),
-		provenanceCapture: true
-	};
-	const stored = record.properties ?? {};
-	for (const [key, value] of Object.entries(properties)) {
-		if (!Object.hasOwn(stored, key) || recordReferenceTokens({ properties: stored[key] }).size === 0) continue;
-		try {
-			await engine.resolver.resolve(structuredClone(value), context);
-		} catch (error) {
-			if (isThrottlingError(error)) return {
+	kickOffProvenanceCapture(args) {
+		const { noChange, resources, template } = args;
+		let chain = Promise.resolve();
+		for (const logicalId of noChange) {
+			const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+			if (record === void 0 || hasReferenceProvenanceField(record)) continue;
+			const tokens = recordReferenceTokens(record);
+			if (tokens.size === 0) continue;
+			const properties = (Object.hasOwn(template.Resources, logicalId) ? template.Resources[logicalId] : void 0)?.Properties ?? {};
+			const task = chain.then(() => this.captureOne(logicalId, record, tokens, properties, args)).catch(() => ({
 				record,
 				field: void 0
-			};
+			}));
+			chain = task;
+			this.tasks.set(logicalId, task);
 		}
 	}
-	const physicalId = typeof record.physicalId === "string" ? record.physicalId.toLowerCase() : "";
-	const field = {};
-	let unattributed = false;
-	for (const token of [...tokens].sort()) {
-		const pass = passProvenanceFor(bag, token);
-		const plaintext = resolvedPlaintextOf(bag, token);
-		const named = plaintext !== void 0 && plaintext.length >= 4 && physicalId.includes(plaintext.toLowerCase());
-		const entry = validateReferenceProvenance(token, {
-			...pass?.region !== void 0 && { region: pass.region },
-			...named && pass?.versions !== void 0 && { versions: pass.versions }
-		}) ?? {};
-		if (entry.region === void 0 && entry.versions === void 0) unattributed = true;
-		field[token] = entry;
-	}
-	if (unattributed) warnUnattributed(engine, logicalId);
-	return {
-		record,
-		field
-	};
-}
-async function drainProvenanceCaptures(stateResources) {
-	if (this.provenanceCaptureTasks.size === 0) return 0;
-	const entries = [...this.provenanceCaptureTasks.entries()];
-	this.provenanceCaptureTasks.clear();
-	const outcomes = await Promise.all(entries.map(([, task]) => task));
-	let installed = 0;
-	for (let i = 0; i < entries.length; i++) {
-		const logicalId = entries[i][0];
-		const { record, field } = outcomes[i];
-		if (field === void 0) continue;
-		const target = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
-		if (target === void 0 || target.physicalId !== record.physicalId || target.resourceType !== record.resourceType) continue;
-		stateResources[logicalId] = {
-			...target,
-			referenceProvenance: field
+	warnUnattributed(logicalId) {
+		this.deps.logger.warn(safeMsg`Could not record where the secret reference(s) in ${logicalId} were resolved (state schema v12 migration). cdkd keeps its previous handling of them; update ${logicalId} to record it.`);
+	}
+	async captureOne(logicalId, record, tokens, properties, args) {
+		const bag = /* @__PURE__ */ new Map();
+		const { attributeHealer: _healer, ...base } = this.deps.buildResolverContext({
+			template: args.template,
+			resources: { ...args.resources },
+			...args.parameters && { parameters: args.parameters },
+			...args.conditions && { conditions: args.conditions }
+		}, args.stackName);
+		const { producerSecrets: _producer, ...withoutRecorders } = base;
+		const context = {
+			...withoutRecorders,
+			recordedSecretValues: bag,
+			recordedImports: [],
+			recordedOutputReads: [],
+			staleAttributeHeal: { phase: "probe" },
+			printingSecrets: /* @__PURE__ */ new Map(),
+			provenanceCapture: true
+		};
+		const stored = record.properties ?? {};
+		for (const [key, value] of Object.entries(properties)) {
+			if (!Object.hasOwn(stored, key) || recordReferenceTokens({ properties: stored[key] }).size === 0) continue;
+			try {
+				await this.deps.resolver.resolve(structuredClone(value), context);
+			} catch (error) {
+				if (isThrottlingError(error)) return {
+					record,
+					field: void 0
+				};
+			}
+		}
+		const physicalId = typeof record.physicalId === "string" ? record.physicalId.toLowerCase() : "";
+		const field = {};
+		let unattributed = false;
+		for (const token of [...tokens].sort()) {
+			const pass = passProvenanceFor(bag, token);
+			const plaintext = resolvedPlaintextOf(bag, token);
+			const named = plaintext !== void 0 && plaintext.length >= 4 && physicalId.includes(plaintext.toLowerCase());
+			const entry = validateReferenceProvenance(token, {
+				...pass?.region !== void 0 && { region: pass.region },
+				...named && pass?.versions !== void 0 && { versions: pass.versions }
+			}) ?? {};
+			if (entry.region === void 0 && entry.versions === void 0) unattributed = true;
+			field[token] = entry;
+		}
+		if (unattributed) this.warnUnattributed(logicalId);
+		return {
+			record,
+			field
 		};
-		installed++;
 	}
-	return installed;
-}
+	async drainProvenanceCaptures(stateResources) {
+		if (this.tasks.size === 0) return 0;
+		const entries = [...this.tasks.entries()];
+		this.tasks.clear();
+		const outcomes = await Promise.all(entries.map(([, task]) => task));
+		let installed = 0;
+		for (let i = 0; i < entries.length; i++) {
+			const logicalId = entries[i][0];
+			const { record, field } = outcomes[i];
+			if (field === void 0) continue;
+			const target = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+			if (target === void 0 || target.physicalId !== record.physicalId || target.resourceType !== record.resourceType) continue;
+			stateResources[logicalId] = {
+				...target,
+				referenceProvenance: field
+			};
+			installed++;
+		}
+		return installed;
+	}
+};
 function provenanceBaselineOf(state, tokenFree) {
 	return {
 		outputs: state.outputs,
@@ -33128,8 +33169,32 @@ function secretNameNeedlesOf(logicalId, record, secrets, options) {
 		for (const needle of printingCorpusOf(embeddedBag).keys()) if (needle !== "" && (needle === physicalId || needle.length >= 4 && physicalId.includes(needle))) add(needle);
 	}
 	if (physicalId !== void 0) for (const spelling of finalSnapshotSpellingsOf(physicalId, record?.resourceType, needles)) add(spelling);
+	for (const leaf of secretNamedAttributeLeavesOf(record)) add(leaf);
 	return needles.size > 0 ? needles : void 0;
 }
+function secretNamedAttributeLeavesOf(record) {
+	if (record?.resourceType !== "AWS::CloudFormation::Stack") return [];
+	const names = record.secretNamedAttributes;
+	const attributes = record.attributes;
+	if (!Array.isArray(names) || attributes === null || typeof attributes !== "object") return [];
+	const leaves = [];
+	for (const name of names) {
+		if (typeof name !== "string" || !Object.hasOwn(attributes, name)) continue;
+		for (const leaf of wholeStringLeavesOf(attributes[name])) if (leaf !== "" && leaf !== "***" && !leaf.includes("{{resolve:")) leaves.push(leaf);
+	}
+	return leaves;
+}
+function secretNamedAttributeNamesOf(attributes, childResources, secrets) {
+	const needles = [...printingCorpusOf(secretNamedRecordNeedles(childResources, secrets)).keys()];
+	if (needles.length === 0) return [];
+	const names = [];
+	for (const [name, value] of Object.entries(attributes)) {
+		const leaves = [...wholeStringLeavesOf(value)].filter((leaf) => leaf !== "");
+		if (leaves.length === 0) continue;
+		if (needles.some((needle) => leavesHoldNeedle(leaves, needle))) names.push(name);
+	}
+	return names.sort();
+}
 function finalSnapshotSpellingsOf(physicalId, resourceType, needles) {
 	if (typeof resourceType !== "string" || !(ATOMIC_FINAL_SNAPSHOT_TYPES.has(resourceType) || PRE_DELETE_SNAPSHOT_TYPES.has(resourceType))) return [];
 	const { prefix, sanitized, kept } = finalSnapshotNameCut(physicalId, resourceType);
@@ -33145,6 +33210,20 @@ function finalSnapshotSpellingsOf(physicalId, resourceType, needles) {
 	}
 	return spellings;
 }
+function namingBagOf(secrets, logicalId) {
+	const bag = typeof secrets === "function" ? secrets(logicalId) : secrets;
+	return bag !== void 0 && hasMaskableValues(bag) ? bag : void 0;
+}
+function namingSecretsWithRecordedNoEcho(base, recorded) {
+	const memo = /* @__PURE__ */ new Map();
+	return (logicalId) => {
+		if (memo.has(logicalId)) return memo.get(logicalId);
+		const own = recorded(logicalId);
+		const bag = own === void 0 || !hasMaskableValues(own) ? base : unionOfSecretBags([base, own]);
+		memo.set(logicalId, bag);
+		return bag;
+	};
+}
 function secretNamesReadBy(logicalId, record, resources, judge = () => ({
 	secrets: void 0,
 	embedded: void 0
@@ -33165,7 +33244,7 @@ function leavesHoldNeedle(leaves, needle) {
 	return leaves.some((leaf) => leaf === needle || needle.length >= 4 && leaf.includes(needle));
 }
 function stateSecretNameNeedles(resources, secrets) {
-	return (logicalId) => secretNameNeedlesOf(logicalId, Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0, secrets, { embedded: void 0 });
+	return (logicalId) => secretNameNeedlesOf(logicalId, Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0, namingBagOf(secrets, logicalId), { embedded: void 0 });
 }
 function storedRecordNameNeedles(logicalId, record, secrets) {
 	const needles = secretNameNeedlesOf(logicalId, record, secrets, { embedded: void 0 });
@@ -33182,7 +33261,7 @@ function storedRecordNameNeedles(logicalId, record, secrets) {
 function storedSecretNameNeedles(resources, secrets, bag = /* @__PURE__ */ new Map(), outputs) {
 	const named = [];
 	for (const [logicalId, record] of Object.entries(resources)) {
-		const needles = storedRecordNameNeedles(logicalId, record, secrets);
+		const needles = storedRecordNameNeedles(logicalId, record, namingBagOf(secrets, logicalId));
 		if (needles !== void 0) named.push([logicalId, needles]);
 	}
 	if (named.length === 0) return bag;
@@ -33203,19 +33282,18 @@ function secretNamesStoredIn(record, needles) {
 	return [...needles].filter((needle) => leavesHoldNeedle(leaves, needle));
 }
 function secretNamedRecordNeedles(resources, secrets, bag = /* @__PURE__ */ new Map()) {
-	for (const [logicalId, record] of Object.entries(resources)) for (const needle of storedRecordNameNeedles(logicalId, record, secrets) ?? []) recordLogOnlyValue(bag, needle);
+	for (const [logicalId, record] of Object.entries(resources)) for (const needle of storedRecordNameNeedles(logicalId, record, namingBagOf(secrets, logicalId)) ?? []) recordLogOnlyValue(bag, needle);
 	return bag;
 }
 function secretNamePrintingBag(logicalId, resources) {
 	return secretNamePrintingBags(resources, void 0)(logicalId);
 }
 function secretNamePrintingBags(resources, noEchoValues) {
-	const secrets = noEchoValues !== void 0 && hasMaskableValues(noEchoValues) ? noEchoValues : void 0;
 	const judged = /* @__PURE__ */ new Map();
 	const needlesOf = (logicalId, record) => {
 		const hit = judged.get(logicalId);
 		if (hit !== void 0 && hit.record === record) return hit.needles;
-		const needles = secretNameNeedlesOf(logicalId, record, secrets, { embedded: void 0 });
+		const needles = secretNameNeedlesOf(logicalId, record, namingBagOf(noEchoValues, logicalId), { embedded: void 0 });
 		judged.set(logicalId, {
 			record,
 			needles
@@ -33224,6 +33302,7 @@ function secretNamePrintingBags(resources, noEchoValues) {
 	};
 	return (logicalId) => {
 		const bag = /* @__PURE__ */ new Map();
+		const secrets = namingBagOf(noEchoValues, logicalId);
 		if (secrets !== void 0) carryLogOnlyValues(secrets, bag);
 		const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
 		for (const needle of needlesOf(logicalId, record) ?? []) recordLogOnlyValue(bag, needle);
@@ -33324,56 +33403,6 @@ function maskEventTextWithBoundBags(event) {
 const DEFAULT_RESOURCE_WARN_AFTER_MS = 3e5;
 const DEFAULT_RESOURCE_TIMEOUT_MS = 18e5;
 
-//#endregion
-//#region src/deployment/deploy-engine/name-collision.ts
-function replacementNameOrigin(logicalId, physicalId) {
-	if (looksLikeCdkdGeneratedName(physicalId, logicalId, getCurrentStackName())) return {
-		descriptor: `The physical name (${physicalId}) was GENERATED by cdkd from the construct's logical id rather than declared in your template, and that derivation has no random component — so the new resource asks for exactly the name the existing one still holds`,
-		remedy: "Either give the resource an explicit physical name in your CDK code, or rename the CONSTRUCT (its id feeds the generated name — note that this replaces the resource rather than renaming it in place)"
-	};
-	return {
-		descriptor: `The resource has a user-supplied physical name (${physicalId})`,
-		remedy: "Either rename the resource in your CDK code (a fresh name lets the safe create-first order proceed)"
-	};
-}
-function orphanedNameCollisionAdvice(changeType, logicalId, error) {
-	if (changeType !== "CREATE") return void 0;
-	if (!(error instanceof ProvisioningError)) return void 0;
-	const physicalId = error.physicalId;
-	if (!physicalId) return void 0;
-	const replayed = isReplayedNameCollisionFrom(error, logicalId, (link) => isAuxiliaryMarkOf(link, RETRY_AUXILIARY_OWNER));
-	if (!replayed && !isNameCollisionErrorFrom(error, logicalId)) return void 0;
-	const stackName = getCurrentStackName();
-	if (!looksLikeCdkdGeneratedName(physicalId, logicalId, stackName)) return void 0;
-	if (!stackName) return void 0;
-	const safeId = displaySafe(physicalId, { asciiOnly: true });
-	const safeStack = displaySafe(stackName, { asciiOnly: true });
-	const safeLogicalId = displaySafe(logicalId, { asciiOnly: true });
-	const idShown = isInertUnquoted(safeId);
-	const shownId = idShown ? safeId : "a name that cannot be shown safely here";
-	const shownLogicalId = isInertUnquoted(safeLogicalId) ? safeLogicalId : "A resource whose logical id cannot be shown safely here";
-	const diagnosis = replayed ? `${shownLogicalId}: the name AWS reports as taken (${shownId}) is most likely held by a resource THIS create made. An earlier attempt of it ended without a clear verdict (a server error, a dropped connection or a timeout, or a failure after the create call itself may have succeeded), and the retry then found the name taken. A dropped connection can also happen before the request reached AWS, so the holder may be another resource: confirm it is yours before deleting or importing it. cdkd records a resource only once its create succeeds, so this one is in no state file: no rollback or cdkd destroy will remove it, and re-running collides with it again.` : `${shownLogicalId}: the name AWS reports as taken (${shownId}) is one cdkd DERIVED from the logical id, and that derivation has no random component — so this is most likely a resource an earlier cdkd run left behind. A rollback leaves a resource carrying DeletionPolicy: Retain in AWS and drops it from state, as CloudFormation does; what differs is the name. CloudFormation would generate a fresh one for an unnamed resource and redeploy clean, whereas cdkd asks again for the name the orphan still holds — so re-running does not clear this.`;
-	const deleteArm = `If it is not a resource you want to keep, delete ${idShown ? safeId : "it"} in AWS — after confirming it holds nothing you need${replayed ? "" : ", since Retain is what kept it"} — and re-deploy.`;
-	let canImport;
-	try {
-		canImport = typeof this.providerRegistry.getProvider(error.resourceType).import === "function";
-	} catch {
-		canImport = false;
-	}
-	const commandNamesTheRightResource = safeId === physicalId && safeStack === stackName && safeLogicalId === logicalId;
-	const importableTarget = !stackName.includes("~");
-	if (!canImport || !commandNamesTheRightResource || !importableTarget) return `${diagnosis} ${!canImport ? `cdkd cannot adopt ${displaySafe(error.resourceType, { asciiOnly: true })} back into state (its provider implements no import)` : !importableTarget ? `this is a nested-stack child, whose stack name cdkd import cannot resolve` : `cdkd cannot render an import command that provably names this resource`}, so the way forward is to delete it. ${deleteArm}`;
-	const adopt = pasteableCommand("cdkd import", [{
-		value: stackName,
-		hole: "stack"
-	}, {
-		flag: "--resource",
-		value: `${logicalId}=${physicalId}`,
-		hole: "logicalId=physicalId"
-	}]);
-	return `${diagnosis} To recover, adopt it back into state instead of re-creating it, with the command below (a selective import merges into existing state and needs no --force while the resource is absent from it). CONFIRM IT IS YOURS FIRST — a name cdkd derives is predictable, so for a globally-namespaced type it can belong to another account, and the same stack deployed in another region derives the same name. ${deleteArm}${adopt.withheld.length === 0 ? "" : " The command below prints a quoted hole in place of a value cdkd will not name on a command line; replace it whole, quotes included, with your stack name or '<logicalId>=<name>', shell-quoted."}\nAdopt with: ${adopt.command}`;
-}
-
 //#endregion
 //#region src/analyzer/skipped-outputs.ts
 function canonicalJson$1(value) {
@@ -33707,6 +33736,18 @@ function exportAliasCollisionScrubWarning(outputKey, exportName, secrets) {
 
 //#endregion
 //#region src/deployment/deploy-engine/outputs.ts
+var OutputsRunState = class {
+	outputSecrets = /* @__PURE__ */ new Map();
+	outputsPassSecretMaps = [];
+	outputsTemplateSource = Object.create(null);
+	resolvedExportNames = [];
+	carriedExportAliasRefusal;
+	skippedOutputs;
+	outputsSourceUsable = true;
+	outputProvenanceSinks = /* @__PURE__ */ new Map();
+	outputsResolvedThisRun = /* @__PURE__ */ new WeakSet();
+	resolvedOutputsBag = void 0;
+};
 var ForwardingSecrets = class extends Map {
 	target;
 	constructor(target) {
@@ -33719,25 +33760,25 @@ var ForwardingSecrets = class extends Map {
 		return this;
 	}
 };
-function handleOutputResolutionFailure(error, outputKey, outputs, secrets, inheritedSecrets) {
+function handleOutputResolutionFailure(deps, error, outputKey, outputs, secrets, inheritedSecrets) {
 	const union = unionOfSecretBags([inheritedSecrets, secrets]);
 	const detail = maskSecretsInText(error instanceof Error ? error.message || error.name : String(error), union);
-	if (this.options.strictGetAtt) {
+	if (deps.options.strictGetAtt) {
 		const cause = typeof error === "string" ? maskSecretsInText(error, union) : maskSecretsInError(error, union);
 		throw new Error(safeMsg`Failed to resolve output ${outputKey} ` + `(--strict-getatt promotes output resolution failures to deploy errors; ` + safeMsg`drop the flag to skip the output instead): ${asIsMessage(detail)}`, cause instanceof Error || typeof cause === "string" ? { cause } : {});
 	}
-	this.logger.warn(safeMsg`Failed to resolve output ${outputKey}: ${asIsMessage(detail)}`);
+	deps.logger.warn(safeMsg`Failed to resolve output ${outputKey}: ${asIsMessage(detail)}`);
 	outputs[outputKey] = void 0;
 }
-async function resolveOutputs(template, resources, stackName, digestSource, parameterValues, conditions) {
-	this.resolvedExportNames = [];
-	this.carriedExportAliasRefusal = void 0;
+async function resolveOutputs(run, deps, template, resources, stackName, digestSource, parameterValues, conditions) {
+	run.resolvedExportNames = [];
+	run.carriedExportAliasRefusal = void 0;
 	if (!template.Outputs) {
-		this.carriedExportAliasRefusal = seedOnlyAliasRefusal(noEchoParameterValueSeed(template.Parameters, parameterValues, this.options.inheritedSecrets, this.options.parameters));
+		run.carriedExportAliasRefusal = seedOnlyAliasRefusal(noEchoParameterValueSeed(template.Parameters, parameterValues, deps.options.inheritedSecrets, deps.options.parameters));
 		return {};
 	}
 	const outputs = Object.create(null);
-	const context = this.buildResolverContext({
+	const context = deps.buildResolverContext({
 		template,
 		resources,
 		...parameterValues && { parameters: parameterValues },
@@ -33752,37 +33793,37 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 	const outputsPassSecrets = context.recordedSecretValues ?? EMPTY_SECRETS;
 	const outputsPassInherited = context.inheritedSecrets ?? EMPTY_SECRETS;
 	if (context.recordedSecretValues) {
-		this.outputsPassSecretMaps.push(context.recordedSecretValues);
-		mirrorInheritedParameterReads(context.recordedSecretValues, this.outputSecrets);
-		if (this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0) inheritNestedStackParameterAssociations(this.outputSecrets, this.options.inheritedSecrets);
+		run.outputsPassSecretMaps.push(context.recordedSecretValues);
+		mirrorInheritedParameterReads(context.recordedSecretValues, run.outputSecrets);
+		if (deps.options.inheritedSecrets && deps.options.inheritedSecrets.size > 0) inheritNestedStackParameterAssociations(run.outputSecrets, deps.options.inheritedSecrets);
 	}
 	const publishedOutputNames = collectPublishedOutputNames(template.Outputs, conditions);
 	let outputsPassCompleted = false;
 	try {
 		for (const [outputKey, output] of Object.entries(template.Outputs)) {
 			if (isOutputSuppressedByCondition(output, conditions)) {
-				this.logger.debug(safeMsg`Skipping output ${outputKey} — condition ${output.Condition} is false`);
+				deps.logger.debug(safeMsg`Skipping output ${outputKey} — condition ${output.Condition} is false`);
 				continue;
 			}
 			const ownReads = [];
 			const provenanceSink = /* @__PURE__ */ new Map();
-			this.outputProvenanceSinks.set(outputKey, provenanceSink);
+			run.outputProvenanceSinks.set(outputKey, provenanceSink);
 			try {
-				const resolved = await this.resolver.resolve(output.Value, {
+				const resolved = await deps.resolver.resolve(output.Value, {
 					...context,
 					redactedAttributeReads: ownReads,
 					provenanceSink
 				});
 				refuseMaskedOutputReads(outputKey, ownReads);
-				if (resolved === void 0 && this.options.strictGetAtt) throw markNonRetryable(/* @__PURE__ */ new Error("the value resolved to nothing"));
+				if (resolved === void 0 && deps.options.strictGetAtt) throw markNonRetryable(/* @__PURE__ */ new Error("the value resolved to nothing"));
 				outputs[outputKey] = resolved;
 			} catch (error) {
-				this.handleOutputResolutionFailure(error, outputKey, outputs, outputsPassSecrets, outputsPassInherited);
+				handleOutputResolutionFailure(deps, error, outputKey, outputs, outputsPassSecrets, outputsPassInherited);
 			}
 		}
-		const noEchoSeed = noEchoParameterValueSeed(template.Parameters, parameterValues, context.inheritedSecrets, this.options.parameters);
-		const noEchoSources = this.noEchoPositionSources(resources, template, conditions);
-		this.carriedExportAliasRefusal = (outputKey, exportName) => {
+		const noEchoSeed = noEchoParameterValueSeed(template.Parameters, parameterValues, context.inheritedSecrets, deps.options.parameters);
+		const noEchoSources = deps.noEchoPositionSources(resources, template, conditions);
+		run.carriedExportAliasRefusal = (outputKey, exportName) => {
 			const verdict = carriedExportAliasExposure(exportName, outputsPassSecrets, noEchoSeed);
 			if (verdict === void 0) return void 0;
 			return secretBearingExportNameWarning(outputKey, exportName, verdict.exposure, context.recordedSecretValues, verdict.noEchoOnly);
@@ -33798,14 +33839,14 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 			const nameReads = [];
 			let exportName;
 			try {
-				exportName = typeof output.Export.Name === "string" ? output.Export.Name : await this.resolver.resolve(output.Export.Name, {
+				exportName = typeof output.Export.Name === "string" ? output.Export.Name : await deps.resolver.resolve(output.Export.Name, {
 					...context,
 					recordedSecretValues: nameSecrets,
 					redactedAttributeReads: nameReads
 				});
 				refuseMaskedOutputReads(outputKey, nameReads);
 			} catch (error) {
-				this.handleOutputResolutionFailure(error, outputKey, outputs, outputsPassSecrets, outputsPassInherited);
+				handleOutputResolutionFailure(deps, error, outputKey, outputs, outputsPassSecrets, outputsPassInherited);
 				continue;
 			}
 			if (typeof exportName !== "string") continue;
@@ -33821,28 +33862,28 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 		for (const { outputKey, exportName, value, outputValue, nameSource, nameSecrets } of resolvedNames) {
 			const noEchoParameters = exportNameNoEchoParameters(nameSource, noEchoSources);
 			const exposure = noEchoParameters.length > 0 ? void 0 : exportNameSecretExposure(exportName, nameSecrets, context.recordedSecretValues, noEchoSeed);
-			if (noEchoParameters.length > 0) this.logger.warn(noEchoParameterExportNameWarning(outputKey, noEchoParameters, outputsPassSecrets));
-			else if (exposure) this.logger.warn(secretBearingExportNameWarning(outputKey, exportName, exposure, context.recordedSecretValues, isNoEchoOnlyExposure(exposure, nameSecrets, context.recordedSecretValues)));
-			else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) this.logger.warn(exportAliasCollisionWarning(outputKey, exportName, outputsPassSecrets));
+			if (noEchoParameters.length > 0) deps.logger.warn(noEchoParameterExportNameWarning(outputKey, noEchoParameters, outputsPassSecrets));
+			else if (exposure) deps.logger.warn(secretBearingExportNameWarning(outputKey, exportName, exposure, context.recordedSecretValues, isNoEchoOnlyExposure(exposure, nameSecrets, context.recordedSecretValues)));
+			else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) deps.logger.warn(exportAliasCollisionWarning(outputKey, exportName, outputsPassSecrets));
 			else {
 				outputs[exportName] = value;
-				const aliasedSink = this.outputProvenanceSinks.get(outputKey);
-				if (aliasedSink !== void 0) this.outputProvenanceSinks.set(exportName, aliasedSink);
-				if (!this.resolvedExportNames.includes(exportName)) this.resolvedExportNames.push(exportName);
-				this.outputsTemplateSource[exportName] = outputValue;
+				const aliasedSink = run.outputProvenanceSinks.get(outputKey);
+				if (aliasedSink !== void 0) run.outputProvenanceSinks.set(exportName, aliasedSink);
+				if (!run.resolvedExportNames.includes(exportName)) run.resolvedExportNames.push(exportName);
+				run.outputsTemplateSource[exportName] = outputValue;
 			}
 		}
 		outputsPassCompleted = true;
 	} finally {
-		if (!outputsPassCompleted) this.outputsSourceUsable = false;
+		if (!outputsPassCompleted) run.outputsSourceUsable = false;
 	}
 	for (const [outputKey, output] of Object.entries(template.Outputs)) {
 		if (!publishedOutputNames.has(outputKey)) continue;
-		this.outputsTemplateSource[outputKey] = output.Value;
+		run.outputsTemplateSource[outputKey] = output.Value;
 	}
-	this.skippedOutputs = collectSkippedOutputs(digestSource, outputs);
-	this.outputsResolvedThisRun.add(outputs);
-	this.resolvedOutputsBag = outputs;
+	run.skippedOutputs = collectSkippedOutputs(digestSource, outputs);
+	run.outputsResolvedThisRun.add(outputs);
+	run.resolvedOutputsBag = outputs;
 	return markSameGenerationBag(outputs);
 }
 function buildDisplayOutputs(template, resolvedOutputs) {
@@ -37551,13 +37592,414 @@ function makeSiblingClaimReader(params) {
 	};
 }
 
+//#endregion
+//#region src/deployment/read-only-attribute-healer.ts
+async function readRecordAttributes(input) {
+	const { provider, logicalId, resource, stackName, region } = input;
+	if (!provider.import) return { kind: "not-attempted" };
+	if (!hasAddressablePhysicalId(resource)) return { kind: "not-attempted" };
+	const found = await provider.import({
+		logicalId,
+		resourceType: resource.resourceType,
+		stackName,
+		region,
+		properties: resource.properties,
+		knownPhysicalId: resource.physicalId
+	});
+	if (found === null) return { kind: "not-found" };
+	if (found.physicalId !== resource.physicalId) throw new Error(`the provider answered for a different resource (${found.physicalId}) than the one asked about (${resource.physicalId})`);
+	const reported = Object.entries(normalizeHealedAttributes(found.attributes));
+	const attributes = Object.fromEntries(reported.filter(([, value]) => !carriesSecretMask(value)));
+	const withheldKeys = reported.filter(([, value]) => carriesSecretMask(value)).map(([key]) => key);
+	return {
+		kind: "read",
+		attributes,
+		...withheldKeys.length > 0 && { withheldKeys }
+	};
+}
+function createReadOnlyAttributeHealerFactory(options) {
+	const logger = getLogger().child("ReadOnlyAttributeHealer");
+	const memo = /* @__PURE__ */ new Map();
+	const readOnce = (stackName, region, logicalId, resource) => {
+		let key;
+		try {
+			if (isHealExcludedType(resource.resourceType)) return Promise.resolve({ kind: "not-attempted" });
+			key = injectiveKey(stackName, region, logicalId, resource.physicalId);
+		} catch (error) {
+			return Promise.resolve({
+				kind: "failed",
+				error
+			});
+		}
+		const inFlight = memo.get(key);
+		if (inFlight) return inFlight;
+		const heal = (async () => options.inRegion(region, () => readRecordAttributes({
+			provider: options.getProvider(resource, region),
+			logicalId,
+			resource,
+			stackName,
+			region
+		})))().then((outcome) => {
+			if (outcome.kind === "read") try {
+				logger.debug(safeMsg`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS for this preview — its state record lacked one a Fn::GetAtt asked for; nothing is written: ${Object.keys(outcome.attributes).length} attribute(s) read`);
+			} catch {}
+			return outcome;
+		}).catch((error) => ({
+			kind: "failed",
+			error
+		}));
+		memo.set(key, heal);
+		return heal;
+	};
+	return (stackName, region) => Object.assign((logicalId, resource) => readOnce(stackName, region, logicalId, resource), { readOnly: true });
+}
+
+//#endregion
+//#region src/deployment/deploy-engine/noecho.ts
+var NoEchoRunState = class {
+	noEchoAttributeResources = /* @__PURE__ */ new Map();
+	persistedNoEchoAttributes = /* @__PURE__ */ new Map();
+	noEchoConditions = void 0;
+	inheritedNoEchoParameters = /* @__PURE__ */ new Set();
+	noEchoPhysicalIdWarned = /* @__PURE__ */ new Set();
+	noEchoPositionedValues = /* @__PURE__ */ new Map();
+	noEchoExactEchoes = /* @__PURE__ */ new Map();
+	noEchoAttributeReads = /* @__PURE__ */ new Map();
+	witnessConfirmedLeaves = /* @__PURE__ */ new Map();
+	constructPathTemplate = void 0;
+};
+function noEchoExactEchoLeavesOf(record) {
+	const field = record?.noEchoExactEchoLeaves;
+	if (!Array.isArray(field)) return void 0;
+	const out = [];
+	for (const entry of field) {
+		if (!Array.isArray(entry) || entry.length === 0) return void 0;
+		if (!entry.every((segment) => typeof segment === "string")) return void 0;
+		out.push([...entry]);
+	}
+	return out;
+}
+function echoFidelityCandidates(coordinates, resolved, createOnly) {
+	const out = [];
+	for (const coordinate of coordinates) {
+		if (!coordinate.every((segment) => typeof segment === "string")) continue;
+		const keys = coordinate;
+		if (!createOnly.some((path) => path.length <= keys.length && path.every((s, i) => s === keys[i]))) continue;
+		const plaintext = valueAtCoordinate(resolved, keys);
+		if (typeof plaintext !== "string" || carriesSecretMask(plaintext)) continue;
+		out.push({
+			coordinate: keys,
+			plaintext
+		});
+	}
+	return out;
+}
+function reportedLeafAt(live, handed, candidate) {
+	if (valueAtCoordinate(handed, candidate.coordinate) !== "***") return void 0;
+	const leaf = valueAtCoordinate(live, candidate.coordinate);
+	return typeof leaf === "string" && !carriesSecretMask(leaf) ? leaf : void 0;
+}
+function echoesExactlyAt(live, handed, candidate) {
+	return reportedLeafAt(live, handed, candidate) === candidate.plaintext;
+}
+function provesEchoChangeAt(live, handed, candidate) {
+	const reported = reportedLeafAt(live, handed, candidate);
+	return reported !== void 0 && reported !== candidate.plaintext;
+}
+function noteNoEchoExactEchoes(run, logicalId, physicalId, read, handed, candidates, mode) {
+	const exact = "failure" in read ? [] : candidates.filter((candidate) => echoesExactlyAt(read.live, handed, candidate)).map((candidate) => [...candidate.coordinate]);
+	const noted = run.noEchoExactEchoes.get(logicalId);
+	const previous = mode === "add" && noted?.physicalId === physicalId ? noted.coordinates : [];
+	run.noEchoExactEchoes.set(logicalId, {
+		physicalId,
+		coordinates: sortedCoordinates([...previous, ...exact])
+	});
+}
+function sortedCoordinates(coordinates) {
+	const keyed = /* @__PURE__ */ new Map();
+	for (const coordinate of coordinates) keyed.set(JSON.stringify(coordinate), [...coordinate]);
+	return [...keyed.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([, c]) => c);
+}
+async function establishNoEchoEchoFidelity(run, deps, logicalId, record, resolvedProps, stateResources, secrets) {
+	run.noEchoExactEchoes.delete(logicalId);
+	const templateProps = deps.perResourceTemplateProps().get(logicalId);
+	const sources = noEchoPositionSources(run, stateResources);
+	if (templateProps === void 0 || sources === void 0 || sources.parameters.size === 0) return;
+	const coordinates = canonicalCoordinates(noEchoCoordinatesOf(templateProps, resolvedProps, {
+		parameters: sources.parameters,
+		...sources.conditions !== void 0 && { conditions: sources.conditions }
+	}));
+	if (coordinates.length === 0) return;
+	const candidates = echoFidelityCandidates(coordinates, resolvedProps, await getCreateOnlyPropertyPaths(record.resourceType).catch(() => []));
+	if (candidates.length === 0) return;
+	const handed = {
+		...record,
+		properties: maskAtCoordinates(record.properties, coordinates)
+	};
+	const read = await deps.readReaderForFreshNoEchoCeiling(logicalId, handed, secrets);
+	noteNoEchoExactEchoes(run, logicalId, record.physicalId, read, handed.properties, candidates, "set");
+}
+function withNoEchoExactEchoes(run, logicalId, record) {
+	const noted = run.noEchoExactEchoes.get(logicalId);
+	if (noted === void 0 || noted.coordinates.length === 0) return record;
+	if (noted.physicalId !== record.physicalId) return record;
+	const merged = sortedCoordinates([...noEchoExactEchoLeavesOf(record) ?? [], ...noted.coordinates]);
+	return {
+		...record,
+		noEchoExactEchoLeaves: merged
+	};
+}
+function noEchoParameterNamesOf(template) {
+	const names = /* @__PURE__ */ new Set();
+	const declared = template?.Parameters;
+	if (declared === null || typeof declared !== "object") return names;
+	for (const [name, definition] of Object.entries(declared)) if (declaresNoEcho(definition)) names.add(name);
+	return names;
+}
+function noEchoAttributeNamesOf(record) {
+	const field = record?.noEchoAttributeNames;
+	if (!Array.isArray(field) || !field.every((name) => typeof name === "string")) return void 0;
+	return field;
+}
+function noEchoPositionSources(run, resources = {}, template = run.constructPathTemplate, conditions = run.noEchoConditions) {
+	if (template === void 0) return void 0;
+	const declared = run.noEchoAttributeResources;
+	return {
+		parameters: /* @__PURE__ */ new Set([...noEchoParameterNamesOf(template), ...run.inheritedNoEchoParameters]),
+		attributeIsNoEcho: (logicalId, attribute) => {
+			const live = declared.get(logicalId);
+			if (live === true || live !== void 0 && live.has(attribute)) return true;
+			if (noEchoAttributeNamesOf(Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0)?.includes(attribute) === true) return true;
+			return run.persistedNoEchoAttributes.get(logicalId)?.has(attribute) === true;
+		},
+		...conditions !== void 0 && { conditions }
+	};
+}
+function noEchoLeavesFor(run, deps, logicalId, record, templateProps, sources) {
+	if (templateProps !== void 0 && isWrittenFromDeployedTemplate(record.properties)) return canonicalCoordinates(noEchoCoordinatesOf(templateProps, record.properties, sources));
+	const existing = noEchoLeavesOf(record);
+	if (existing !== void 0) {
+		const confirmed = run.witnessConfirmedLeaves.get(logicalId) ?? [];
+		return canonicalCoordinates([...existing, ...confirmed]);
+	}
+	const resolvedAsSame = deps.perResourceResolvedType().get(logicalId) === record.resourceType;
+	const source = (templateProps !== void 0 && resolvedAsSame ? templateProps : void 0) ?? templatePropertiesFor(run, logicalId, record.resourceType);
+	if (source === void 0) return void 0;
+	return canonicalCoordinates(noEchoCoordinatesOf(source, record.properties, sources));
+}
+function templatePropertiesFor(run, logicalId, resourceType) {
+	const resources = run.constructPathTemplate?.Resources;
+	if (resources === void 0 || !Object.hasOwn(resources, logicalId)) return void 0;
+	const definition = resources[logicalId];
+	if (definition?.Type !== resourceType) return void 0;
+	const properties = definition.Properties;
+	return properties !== null && typeof properties === "object" && !Array.isArray(properties) ? properties : void 0;
+}
+function noEchoAttributeNamesFor(run, logicalId, record, carried, leaves) {
+	const attributes = record.attributes ?? {};
+	const names = /* @__PURE__ */ new Set();
+	let echoed = false;
+	for (const coordinate of leaves ?? []) {
+		const value = valueAtCoordinate(record.properties, coordinate);
+		if (value === void 0 || carriesSecretMask(value)) continue;
+		for (const [name, attribute] of Object.entries(attributes)) {
+			if (carriesSecretMask(attribute)) continue;
+			if (typeof attribute === "string" && attribute === record.physicalId) continue;
+			const sameName = coordinate[0] === name && keyOrderFreeJson(attribute) === keyOrderFreeJson(value);
+			const embeds = typeof value === "string" && typeof attribute === "string" && !attribute.startsWith("arn:") && value.length >= 4 && typeof attribute === "string" && attribute.includes(value);
+			if (sameName || embeds) {
+				names.add(name);
+				echoed = true;
+			}
+		}
+	}
+	const declared = carried ? void 0 : run.noEchoAttributeResources.get(logicalId);
+	if (declared === true) for (const name of Object.keys(attributes)) names.add(name);
+	else if (declared !== void 0) {
+		for (const name of declared) if (Object.hasOwn(attributes, name)) names.add(name);
+	}
+	const prior = noEchoAttributeNamesOf(record);
+	for (const name of prior ?? []) if (Object.hasOwn(attributes, name) && carriesSecretMask(attributes[name])) names.add(name);
+	if (declared === void 0 && prior === void 0 && !echoed) return void 0;
+	return [...names].sort();
+}
+function applyNoEchoPersist(run, deps, logicalId, record, scrubbed, templateProps, resources, secrets, carried = false) {
+	const sources = noEchoPositionSources(run, resources);
+	if (sources === void 0) return scrubbed;
+	const leaves = noEchoLeavesFor(run, deps, logicalId, record, templateProps, sources);
+	const names = noEchoAttributeNamesFor(run, logicalId, record, carried, leaves);
+	if (leaves === void 0 && names === void 0) return scrubbed;
+	const next = { ...scrubbed };
+	if (leaves !== void 0) {
+		next.properties = maskAtCoordinates(scrubbed.properties, leaves);
+		if (scrubbed.observedProperties !== void 0 && leaves.length > 0) Object.assign(next, { observedProperties: maskReadbackAtCoordinates(scrubbed.observedProperties, record.properties, leaves) });
+		if (leaves.length > 0) next.noEchoLeaves = leaves;
+		else delete next.noEchoLeaves;
+		const marked = new Set(leaves.map((coordinate) => JSON.stringify(coordinate)));
+		const exact = (noEchoExactEchoLeavesOf(scrubbed) ?? []).filter((coordinate) => marked.has(JSON.stringify(coordinate)));
+		if (exact.length > 0) next.noEchoExactEchoLeaves = exact;
+		else delete next.noEchoExactEchoLeaves;
+	}
+	if (names !== void 0) {
+		if (scrubbed.attributes !== void 0 && names.length > 0) {
+			const attributes = { ...scrubbed.attributes };
+			for (const name of names) if (Object.hasOwn(attributes, name)) attributes[name] = maskWholeValue(attributes[name]);
+			next.attributes = attributes;
+		}
+		if (names.length > 0) next.noEchoAttributeNames = names;
+		else delete next.noEchoAttributeNames;
+	}
+	warnNoEchoPhysicalId(run, deps, logicalId, record, secrets);
+	return next;
+}
+function warnNoEchoPhysicalId(run, deps, logicalId, record, secrets) {
+	if (secrets === void 0 || run.noEchoPhysicalIdWarned.has(logicalId)) return;
+	const values = noEchoParameterPlaintextsOf(secrets);
+	if (values.length === 0 || typeof record.physicalId !== "string") return;
+	if (!values.some((value) => record.physicalId.includes(value))) return;
+	run.noEchoPhysicalIdWarned.add(logicalId);
+	deps.logger.warn(deps.maskForResource(logicalId, safeMsg`${logicalId}: its physical id contains a NoEcho parameter value. AWS publishes a resource's name, so cdkd keeps the physical id in state as AWS returns it.`));
+}
+function seedPersistedNoEchoAttributes(run, resources) {
+	run.persistedNoEchoAttributes = /* @__PURE__ */ new Map();
+	for (const [logicalId, record] of Object.entries(resources)) {
+		const names = noEchoAttributeNamesOf(record);
+		if (names !== void 0 && names.length > 0) run.persistedNoEchoAttributes.set(logicalId, new Set(names));
+	}
+}
+function maskOutputsByPosition(run, deps, outputs) {
+	const sources = noEchoPositionSources(run);
+	if (sources === void 0) return outputs;
+	const templateValues = Object.create(null);
+	for (const [name, definition] of Object.entries(run.constructPathTemplate?.Outputs ?? {})) templateValues[name] = definition?.Value;
+	if (deps.outputsRun().outputsSourceUsable) for (const [name, value] of Object.entries(deps.outputsRun().outputsTemplateSource)) templateValues[name] = value;
+	const coordinates = noEchoCoordinatesOf(templateValues, outputs, sources);
+	if (coordinates.length === 0) return outputs;
+	const maskedValues = new Set(coordinates.filter((coordinate) => coordinate.length === 1 && typeof coordinate[0] === "string").map((coordinate) => keyOrderFreeJson(outputs[coordinate[0]])));
+	const aliasCoordinates = Object.keys(outputs).filter((key) => !Object.hasOwn(templateValues, key) && outputs[key] !== void 0 && !carriesSecretMask(outputs[key]) && maskedValues.has(keyOrderFreeJson(outputs[key]))).map((key) => [key]);
+	return maskAtCoordinates(outputs, [...coordinates, ...aliasCoordinates]);
+}
+function getAttTargetsOf(node) {
+	const targets = [];
+	const seen = /* @__PURE__ */ new Set();
+	const subVariable = /\$\{([^}!][^}]*)\}/g;
+	const walk = (value) => {
+		if (value === null || typeof value !== "object" || seen.has(value)) return;
+		seen.add(value);
+		if (Array.isArray(value)) {
+			for (const item of value) walk(item);
+			return;
+		}
+		const record = value;
+		const getAtt = record["Fn::GetAtt"];
+		if (typeof getAtt === "string" && getAtt.indexOf(".") > 0) {
+			const dot = getAtt.indexOf(".");
+			targets.push([getAtt.slice(0, dot), getAtt.slice(dot + 1)]);
+		} else if (Array.isArray(getAtt) && typeof getAtt[0] === "string" && typeof getAtt[1] === "string") targets.push([getAtt[0], getAtt[1]]);
+		const sub = record["Fn::Sub"];
+		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
+		if (typeof text === "string") for (const match of text.matchAll(subVariable)) {
+			const name = match[1].trim();
+			const dot = name.indexOf(".");
+			if (dot > 0) targets.push([name.slice(0, dot), name.slice(dot + 1)]);
+		}
+		for (const child of Object.values(record)) walk(child);
+	};
+	walk(node);
+	return targets;
+}
+async function noEchoAttributeOverridesFor(run, deps, desiredProps, stateResources, stackName) {
+	const wanted = /* @__PURE__ */ new Map();
+	for (const [logicalId, attribute] of getAttTargetsOf(desiredProps)) {
+		const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+		if (record === void 0) continue;
+		if (noEchoAttributeNamesOf(record)?.includes(attribute) !== true) continue;
+		if (!carriesSecretMask(record.attributes?.[attribute])) continue;
+		if (!deps.perResourceSecrets().has(logicalId)) continue;
+		const set = wanted.get(logicalId) ?? /* @__PURE__ */ new Set();
+		set.add(attribute);
+		wanted.set(logicalId, set);
+	}
+	if (wanted.size === 0) return void 0;
+	const overrides = /* @__PURE__ */ new Map();
+	for (const [logicalId, attributes] of wanted) {
+		const record = stateResources[logicalId];
+		let read = run.noEchoAttributeReads.get(logicalId);
+		if (read === void 0) {
+			read = (async () => {
+				try {
+					const { provider } = deps.providerRegistry.getProviderFor({
+						resourceType: record.resourceType,
+						properties: record.properties,
+						provisionedBy: record.provisionedBy,
+						previousProperties: record.properties
+					});
+					const outcome = await readRecordAttributes({
+						provider,
+						logicalId,
+						resource: record,
+						stackName,
+						region: deps.stackRegion
+					});
+					return outcome.kind === "read" ? outcome.attributes : void 0;
+				} catch {
+					return;
+				}
+			})();
+			run.noEchoAttributeReads.set(logicalId, read);
+		}
+		const live = await read;
+		if (live === void 0) continue;
+		const secrets = deps.perResourceSecrets().get(logicalId);
+		const fresh = noEchoParameterPlaintextsOf(secrets);
+		const positioned = run.noEchoPositionedValues.get(logicalId) ?? /* @__PURE__ */ new Set();
+		const served = {};
+		for (const attribute of attributes) {
+			if (!Object.hasOwn(live, attribute)) continue;
+			const value = live[attribute];
+			if (typeof value === "string" && fresh.some((needle) => value === needle || value.includes(needle)) || value !== void 0 && positioned.has(keyOrderFreeJson(value))) served[attribute] = value;
+		}
+		if (Object.keys(served).length > 0) overrides.set(logicalId, served);
+	}
+	return overrides.size > 0 ? overrides : void 0;
+}
+function noEchoDiffComparison(run, deps, resources, template, conditions, parameterValues, stackName) {
+	const sources = noEchoPositionSources(run, resources, template, conditions);
+	if (sources === void 0) return void 0;
+	const compare = noEchoComparison({
+		sources,
+		values: parameterValues,
+		minNeedleLength: 4,
+		publicTokens: /* @__PURE__ */ new Set([deps.stackRegion, ...stackName === void 0 ? [] : [stackName]])
+	});
+	return (input) => compare(input);
+}
+function freshNoEchoParametersWithDeclared(inherited, template) {
+	const all = /* @__PURE__ */ new Set([...inherited ?? [], ...noEchoParameterNamesOf(template)]);
+	return all.size > 0 ? all : void 0;
+}
+function noEchoComparisonForTemplate(template, knownConditions, values, resources, publicTokens, inheritedNoEchoParameters) {
+	const sources = {
+		parameters: /* @__PURE__ */ new Set([...noEchoParameterNamesOf(template), ...inheritedNoEchoParameters ?? []]),
+		attributeIsNoEcho: (logicalId, attribute) => noEchoAttributeNamesOf(Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0)?.includes(attribute) === true,
+		...knownConditions !== void 0 && { conditions: knownConditions }
+	};
+	const compare = noEchoComparison({
+		sources,
+		values: values ?? {},
+		minNeedleLength: 4,
+		...publicTokens !== void 0 && { publicTokens }
+	});
+	return (input) => compare(input);
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/rollback.ts
 function redactOperationsForJournal(operations) {
 	return operations.map((op) => {
 		const secrets = this.perResourceSecrets.get(op.logicalId);
 		const templateProps = this.perResourceTemplateProps.get(op.logicalId);
-		const sources = templateProps === void 0 ? void 0 : this.noEchoPositionSources();
+		const sources = templateProps === void 0 ? void 0 : noEchoPositionSources(this.noEchoRun);
 		const byPosition = (bag) => sources === void 0 || templateProps === void 0 ? bag : maskAtCoordinates(bag, noEchoCoordinatesOf(templateProps, bag, sources));
 		if ((!secrets || secrets.size === 0) && !op.previousState && sources === void 0) return op;
 		const ownSecrets = secrets ?? /* @__PURE__ */ new Map();
@@ -37568,7 +38010,7 @@ function redactOperationsForJournal(operations) {
 			const previous = next.previousState;
 			const adopted = adoptedOrphanRecords.get(this);
 			const loaded = adopted?.has(op.logicalId) ? adopted.get(op.logicalId) : previous;
-			next.previousState = this.applyNoEchoPersist(op.logicalId, previous, keepPersistedPlainRecordLeaves(scrubResourceRecord(previous, ownSecrets, void 0, STATE_SOURCED_READBACK_RULES), previous, loaded ?? {}), void 0, {}, void 0, true);
+			next.previousState = applyNoEchoPersist(this.noEchoRun, this.noEchoDeps(), op.logicalId, previous, keepPersistedPlainRecordLeaves(scrubResourceRecord(previous, ownSecrets, void 0, STATE_SOURCED_READBACK_RULES), previous, loaded ?? {}), void 0, {}, void 0, true);
 		}
 		return next;
 	});
@@ -37704,7 +38146,7 @@ function foreignHolderResolver(engine) {
 async function settleJournalAfterSuccess(stackName, completedOperations, previousState, finalResources, initialDeploy) {
 	if (this.options.parentStackInfo) {
 		await this.writeRollbackJournalSegment(stackName, completedOperations, [], NESTED_PENDING_PARENT_REASON, initialDeploy, nestedPendingSnapshot(previousState, (name) => {
-			const verdict = this.carriedExportAliasRefusal;
+			const verdict = this.outputsRun.carriedExportAliasRefusal;
 			const dropped = verdict === void 0 || verdict(name, name) !== void 0;
 			if (dropped) this.logger.warn(verdict === void 0 ? "An export alias the previous record published was not kept for a revert of this nested stack: no export-name verdict is available." : "An export alias the previous record published was not kept for a revert of this nested stack: its name contains a NoEcho value.");
 			return dropped;
@@ -37876,7 +38318,7 @@ async function writeRollbackJournalSegment(stackName, completedOperations, faile
 			...redactedFailed.length > 0 && { failedOperations: redactedFailed },
 			...nestedPending?.previousOutputs && { previousOutputs: {
 				...nestedPending.previousOutputs,
-				outputs: this.maskOutputsByPosition(nestedPending.previousOutputs.outputs)
+				outputs: maskOutputsByPosition(this.noEchoRun, this.noEchoDeps(), nestedPending.previousOutputs.outputs)
 			} },
 			...nestedPending?.previousCrossStackReads && { previousCrossStackReads: nestedPending.previousCrossStackReads }
 		};
@@ -38209,42 +38651,158 @@ function recaptureMaskedBaseline(args) {
 
 //#endregion
 //#region src/deployment/deploy-engine/observed-capture.ts
-function kickOffObservedCapture(provider, logicalId, physicalId, resourceType, resolvedProps, context, secrets, maskAt) {
-	if (this.options.captureObservedState !== true) return;
-	this.observedCaptureTasks.delete(logicalId);
-	if (!provider.readCurrentState) return;
-	const readCurrentState = provider.readCurrentState.bind(provider);
-	const read = () => readCurrentState(physicalId, logicalId, resourceType, resolvedProps, context).then((observed) => observed === RESOURCE_NOT_FOUND ? void 0 : maskAt === void 0 || observed === void 0 || maskAt.coordinates.length === 0 ? observed : maskReadbackAtCoordinates(observed, maskAt.properties, maskAt.coordinates), (err) => {
-		const mask = createUnionSecretMasker([
-			secrets,
-			this.printingSecretsFor(logicalId),
-			this.fingerprintNoEchoValues
-		]);
-		this.logger.debug(safeMsg`observedProperties capture for ${mask(logicalId)} (${mask(resourceType)}) failed: ${asIsMessage(mask(err instanceof Error ? err.message : String(err)))} — drift will fall back to template properties for this resource until the next successful deploy.`);
-	});
-	const promise = secrets === void 0 ? read() : withCurrentResourceSecrets(secrets, read);
-	this.observedCaptureTasks.set(logicalId, promise);
-}
-async function drainObservedCaptures(stateResources) {
-	const captured = await this.drainProvenanceCaptures(stateResources);
-	if (this.observedCaptureTasks.size === 0) return captured;
-	const entries = Array.from(this.observedCaptureTasks.entries());
-	this.observedCaptureTasks.clear();
-	const resolved = await Promise.all(entries.map(([, p]) => p));
-	let installed = 0;
-	for (let i = 0; i < entries.length; i++) {
-		const logicalId = entries[i][0];
-		const observed = resolved[i];
-		const target = stateResources[logicalId];
-		const recapturedFrom = observed === void 0 ? void 0 : this.recapturedBaselines.get(observed);
-		if (recapturedFrom !== void 0 && target?.observedProperties !== recapturedFrom) continue;
-		if (target && observed !== void 0) {
-			installed++;
-			target.observedProperties = recapturedFrom !== void 0 ? observed : markSameGenerationBag({ ...observed });
+var ObservedCapture = class {
+	observedCaptureTasks = /* @__PURE__ */ new Map();
+	recapturedBaselines = /* @__PURE__ */ new WeakMap();
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	kickOffObservedCapture(provider, logicalId, physicalId, resourceType, resolvedProps, context, secrets, maskAt) {
+		if (this.deps.options.captureObservedState !== true) return;
+		this.observedCaptureTasks.delete(logicalId);
+		if (!provider.readCurrentState) return;
+		const readCurrentState = provider.readCurrentState.bind(provider);
+		const read = () => readCurrentState(physicalId, logicalId, resourceType, resolvedProps, context).then((observed) => observed === RESOURCE_NOT_FOUND ? void 0 : maskAt === void 0 || observed === void 0 || maskAt.coordinates.length === 0 ? observed : maskReadbackAtCoordinates(observed, maskAt.properties, maskAt.coordinates), (err) => {
+			const mask = createUnionSecretMasker([
+				secrets,
+				this.deps.printingSecretsFor(logicalId),
+				this.deps.fingerprintNoEchoValues()
+			]);
+			this.deps.logger.debug(safeMsg`observedProperties capture for ${mask(logicalId)} (${mask(resourceType)}) failed: ${asIsMessage(mask(err instanceof Error ? err.message : String(err)))} — drift will fall back to template properties for this resource until the next successful deploy.`);
+		});
+		const promise = secrets === void 0 ? read() : withCurrentResourceSecrets(secrets, read);
+		this.observedCaptureTasks.set(logicalId, promise);
+	}
+	async drainObservedCaptures(stateResources) {
+		const captured = await this.deps.provenanceCapture().drainProvenanceCaptures(stateResources);
+		if (this.observedCaptureTasks.size === 0) return captured;
+		const entries = Array.from(this.observedCaptureTasks.entries());
+		this.observedCaptureTasks.clear();
+		const resolved = await Promise.all(entries.map(([, p]) => p));
+		let installed = 0;
+		for (let i = 0; i < entries.length; i++) {
+			const logicalId = entries[i][0];
+			const observed = resolved[i];
+			const target = stateResources[logicalId];
+			const recapturedFrom = observed === void 0 ? void 0 : this.recapturedBaselines.get(observed);
+			if (recapturedFrom !== void 0 && target?.observedProperties !== recapturedFrom) continue;
+			if (target && observed !== void 0) {
+				installed++;
+				target.observedProperties = recapturedFrom !== void 0 ? observed : markSameGenerationBag({ ...observed });
+			}
+		}
+		return installed + captured;
+	}
+	kickOffAutoRefreshObservedProperties(stateResources, crossStackReads) {
+		if (this.deps.options.captureObservedState !== true) return;
+		if (this.deps.options.dryRun === true) return;
+		let toRefresh = 0;
+		let refused = 0;
+		const candidates = [];
+		const masked = [];
+		for (const [logicalId, resource] of Object.entries(stateResources)) {
+			if (!hasAddressablePhysicalId(resource)) continue;
+			if (resource.observedProperties !== void 0) {
+				if (isMaskedBaselineRecaptureCandidate(resource)) masked.push({
+					logicalId,
+					resource
+				});
+				continue;
+			}
+			if (resource.observedBaselineRefused === true) {
+				refused++;
+				continue;
+			}
+			candidates.push({
+				logicalId,
+				resource
+			});
 		}
+		if (refused > 0) this.deps.logger.debug(safeMsg`observed-properties auto-refresh SKIPPED for ${refused} resource(s) whose baseline a 'cdkd import' run refused: their recorded properties cannot position the redaction, so capturing an AWS readback against them could persist a resolved secret in plaintext. A deploy that actually CHANGES one of them restores its baseline, unless the refusal is an unverifiable-parameter one (only a replacement or a proving re-import discharges that); a NO_CHANGE deploy never does.`);
+		if (candidates.length === 0 && masked.length === 0) return;
+		const allSiblings = {};
+		for (const [lid, res] of Object.entries(stateResources)) allSiblings[lid] = {
+			resourceType: res.resourceType,
+			properties: res.properties ?? {}
+		};
+		for (const { logicalId, resource } of candidates) {
+			let provider;
+			try {
+				provider = this.deps.providerRegistry.getProviderFor({
+					resourceType: resource.resourceType,
+					provisionedBy: resource.provisionedBy
+				}).provider;
+			} catch {
+				continue;
+			}
+			if (!provider.readCurrentState) continue;
+			const siblings = { ...allSiblings };
+			delete siblings[logicalId];
+			const recordProperties = resource.properties ?? {};
+			const maskCoordinates = [...maskedLeafCoordinatesOf(recordProperties), ...noEchoLeavesOf(resource) ?? []];
+			this.kickOffObservedCapture(provider, logicalId, resource.physicalId, resource.resourceType, recordProperties, { siblings }, void 0, maskCoordinates.length > 0 ? {
+				properties: recordProperties,
+				coordinates: maskCoordinates
+			} : void 0);
+			toRefresh++;
+		}
+		if (toRefresh > 0) this.deps.logger.warn(safeMsg`cdkd state schema upgrade detected — refreshing observed-properties baseline for ${toRefresh} resource(s) (one-time, runs in parallel with deploy)`);
+		let producerRegions = [];
+		if (masked.length > 0) try {
+			producerRegions = producerRegionsFromState(crossStackReads);
+		} catch {
+			this.deps.logger.debug(safeMsg`Masked observed baseline re-capture skipped for ${masked.length} resource(s): the record's cross-stack reads could not be read.`);
+			masked.length = 0;
+		}
+		for (const { logicalId, resource } of masked) {
+			let provider;
+			try {
+				provider = this.deps.providerRegistry.getProviderFor({
+					resourceType: resource.resourceType,
+					provisionedBy: resource.provisionedBy
+				}).provider;
+			} catch {
+				continue;
+			}
+			if (!provider.readCurrentState) continue;
+			const siblings = { ...allSiblings };
+			delete siblings[logicalId];
+			this.kickOffMaskedBaselineRecapture(provider, logicalId, resource, producerRegions, { siblings });
+		}
+	}
+	kickOffMaskedBaselineRecapture(provider, logicalId, resource, producerRegions, context) {
+		const previous = resource.observedProperties;
+		const readCurrentState = provider.readCurrentState?.bind(provider);
+		if (previous === void 0 || readCurrentState === void 0) return;
+		const properties = resource.properties ?? {};
+		const task = (async () => {
+			const secrets = await resolveRecordSecrets(properties, (token, own) => this.deps.resolver.resolveDynamicReferences(token, persistedTokenResolverContext(own, producerRegions)));
+			if (secrets === void 0 || secrets.size === 0) {
+				this.deps.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: its recorded references did not all resolve to distinct values.`);
+				return;
+			}
+			const readback = await withCurrentResourceSecrets(secrets, () => readCurrentState(resource.physicalId, logicalId, resource.resourceType, properties, context));
+			if (readback === void 0 || readback === RESOURCE_NOT_FOUND) return void 0;
+			const recaptured = recaptureMaskedBaseline({
+				previous,
+				readback,
+				properties,
+				secrets
+			});
+			if (recaptured === void 0) {
+				this.deps.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: no masked position could be certified, or the resource no longer reads back as its baseline records.`);
+				return;
+			}
+			this.recapturedBaselines.set(recaptured, previous);
+			this.deps.logger.debug(safeMsg`Re-captured the masked observed baseline of ${logicalId}.`);
+			return recaptured;
+		})().catch(() => {
+			this.deps.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: the re-capture failed.`);
+		});
+		this.observedCaptureTasks.set(logicalId, task);
 	}
-	return installed + captured;
-}
+};
 const STANDALONE_SIBLING = {
 	Roles: {
 		type: "AWS::IAM::RolePolicy",
@@ -38259,8 +38817,8 @@ const STANDALONE_SIBLING = {
 		field: "GroupName"
 	}
 };
-async function buildObservedCaptureSiblings(resourceType, capturedLogicalId, capturedPhysicalId, template, stateResources, stackName, parameterValues, conditions) {
-	if (this.options.captureObservedState !== true) return void 0;
+async function buildObservedCaptureSiblings(deps, resourceType, capturedLogicalId, capturedPhysicalId, template, stateResources, stackName, parameterValues, conditions) {
+	if (deps.options.captureObservedState !== true) return void 0;
 	const attachmentField = resourceType === "AWS::IAM::Role" ? "Roles" : resourceType === "AWS::IAM::User" ? "Users" : resourceType === "AWS::IAM::Group" ? "Groups" : void 0;
 	if (!attachmentField) return void 0;
 	const resources = template?.Resources;
@@ -38278,14 +38836,14 @@ async function buildObservedCaptureSiblings(resourceType, capturedLogicalId, cap
 		if (!attachments.some((a) => isRefTo(a, capturedLogicalId) || a === capturedPhysicalId)) continue;
 		let policyName = props["PolicyName"];
 		if (policyName !== void 0 && typeof policyName !== "string") {
-			resolverContext ??= this.buildResolverContext({
+			resolverContext ??= deps.buildResolverContext({
 				template,
 				resources: stateResources,
 				...parameterValues && { parameters: parameterValues },
 				...conditions && { conditions }
 			}, stackName);
 			try {
-				policyName = await this.resolver.resolve(policyName, resolverContext);
+				policyName = await deps.resolver.resolve(policyName, resolverContext);
 			} catch {
 				continue;
 			}
@@ -38301,7 +38859,7 @@ async function buildObservedCaptureSiblings(resourceType, capturedLogicalId, cap
 	}
 	return Object.keys(siblings).length > 0 ? { siblings } : void 0;
 }
-function stampReasonlessParameterRefusals(stateResources, template) {
+function stampReasonlessParameterRefusals(logger, stateResources, template) {
 	let namesParameter;
 	let stamped = 0;
 	for (const [logicalId, resource] of Object.entries(stateResources)) {
@@ -38314,116 +38872,8 @@ function stampReasonlessParameterRefusals(stateResources, template) {
 		};
 		stamped++;
 	}
-	if (namesParameter?.failedClosed !== void 0) this.logger.debug(safeMsg`The template's parameter dependence could not be judged (${namesParameter.failedClosed}): every observed-baseline refusal recorded without a reason is treated as an unverifiable-parameter refusal (${stamped} stamped).`);
-	if (stamped > 0) this.logger.debug(safeMsg`${stamped} resource(s) carry an observed-baseline refusal recorded without a reason by an older cdkd, and their template definition reads a template parameter: treated as an unverifiable-parameter refusal (kept until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter).`);
-}
-function kickOffAutoRefreshObservedProperties(stateResources, crossStackReads) {
-	if (this.options.captureObservedState !== true) return;
-	if (this.options.dryRun === true) return;
-	let toRefresh = 0;
-	let refused = 0;
-	const candidates = [];
-	const masked = [];
-	for (const [logicalId, resource] of Object.entries(stateResources)) {
-		if (!hasAddressablePhysicalId(resource)) continue;
-		if (resource.observedProperties !== void 0) {
-			if (isMaskedBaselineRecaptureCandidate(resource)) masked.push({
-				logicalId,
-				resource
-			});
-			continue;
-		}
-		if (resource.observedBaselineRefused === true) {
-			refused++;
-			continue;
-		}
-		candidates.push({
-			logicalId,
-			resource
-		});
-	}
-	if (refused > 0) this.logger.debug(safeMsg`observed-properties auto-refresh SKIPPED for ${refused} resource(s) whose baseline a 'cdkd import' run refused: their recorded properties cannot position the redaction, so capturing an AWS readback against them could persist a resolved secret in plaintext. A deploy that actually CHANGES one of them restores its baseline, unless the refusal is an unverifiable-parameter one (only a replacement or a proving re-import discharges that); a NO_CHANGE deploy never does.`);
-	if (candidates.length === 0 && masked.length === 0) return;
-	const allSiblings = {};
-	for (const [lid, res] of Object.entries(stateResources)) allSiblings[lid] = {
-		resourceType: res.resourceType,
-		properties: res.properties ?? {}
-	};
-	for (const { logicalId, resource } of candidates) {
-		let provider;
-		try {
-			provider = this.providerRegistry.getProviderFor({
-				resourceType: resource.resourceType,
-				provisionedBy: resource.provisionedBy
-			}).provider;
-		} catch {
-			continue;
-		}
-		if (!provider.readCurrentState) continue;
-		const siblings = { ...allSiblings };
-		delete siblings[logicalId];
-		const recordProperties = resource.properties ?? {};
-		const maskCoordinates = [...maskedLeafCoordinatesOf(recordProperties), ...noEchoLeavesOf(resource) ?? []];
-		this.kickOffObservedCapture(provider, logicalId, resource.physicalId, resource.resourceType, recordProperties, { siblings }, void 0, maskCoordinates.length > 0 ? {
-			properties: recordProperties,
-			coordinates: maskCoordinates
-		} : void 0);
-		toRefresh++;
-	}
-	if (toRefresh > 0) this.logger.warn(safeMsg`cdkd state schema upgrade detected — refreshing observed-properties baseline for ${toRefresh} resource(s) (one-time, runs in parallel with deploy)`);
-	let producerRegions = [];
-	if (masked.length > 0) try {
-		producerRegions = producerRegionsFromState(crossStackReads);
-	} catch {
-		this.logger.debug(safeMsg`Masked observed baseline re-capture skipped for ${masked.length} resource(s): the record's cross-stack reads could not be read.`);
-		masked.length = 0;
-	}
-	for (const { logicalId, resource } of masked) {
-		let provider;
-		try {
-			provider = this.providerRegistry.getProviderFor({
-				resourceType: resource.resourceType,
-				provisionedBy: resource.provisionedBy
-			}).provider;
-		} catch {
-			continue;
-		}
-		if (!provider.readCurrentState) continue;
-		const siblings = { ...allSiblings };
-		delete siblings[logicalId];
-		this.kickOffMaskedBaselineRecapture(provider, logicalId, resource, producerRegions, { siblings });
-	}
-}
-function kickOffMaskedBaselineRecapture(provider, logicalId, resource, producerRegions, context) {
-	const previous = resource.observedProperties;
-	const readCurrentState = provider.readCurrentState?.bind(provider);
-	if (previous === void 0 || readCurrentState === void 0) return;
-	const properties = resource.properties ?? {};
-	const task = (async () => {
-		const secrets = await resolveRecordSecrets(properties, (token, own) => this.resolver.resolveDynamicReferences(token, persistedTokenResolverContext(own, producerRegions)));
-		if (secrets === void 0 || secrets.size === 0) {
-			this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: its recorded references did not all resolve to distinct values.`);
-			return;
-		}
-		const readback = await withCurrentResourceSecrets(secrets, () => readCurrentState(resource.physicalId, logicalId, resource.resourceType, properties, context));
-		if (readback === void 0 || readback === RESOURCE_NOT_FOUND) return void 0;
-		const recaptured = recaptureMaskedBaseline({
-			previous,
-			readback,
-			properties,
-			secrets
-		});
-		if (recaptured === void 0) {
-			this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: no masked position could be certified, or the resource no longer reads back as its baseline records.`);
-			return;
-		}
-		this.recapturedBaselines.set(recaptured, previous);
-		this.logger.debug(safeMsg`Re-captured the masked observed baseline of ${logicalId}.`);
-		return recaptured;
-	})().catch(() => {
-		this.logger.debug(safeMsg`Masked observed baseline of ${logicalId} kept: the re-capture failed.`);
-	});
-	this.observedCaptureTasks.set(logicalId, task);
+	if (namesParameter?.failedClosed !== void 0) logger.debug(safeMsg`The template's parameter dependence could not be judged (${namesParameter.failedClosed}): every observed-baseline refusal recorded without a reason is treated as an unverifiable-parameter refusal (${stamped} stamped).`);
+	if (stamped > 0) logger.debug(safeMsg`${stamped} resource(s) carry an observed-baseline refusal recorded without a reason by an older cdkd, and their template definition reads a template parameter: treated as an unverifiable-parameter refusal (kept until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter).`);
 }
 
 //#endregion
@@ -38445,7 +38895,7 @@ function diffLogMasker(diffSecrets, template, parameterValues, resources) {
 	return (text) => {
 		if (!judged) {
 			judged = true;
-			storedSecretNameNeedles(resources, this.fingerprintNoEchoValues, stateNames);
+			storedSecretNameNeedles(resources, this.stateNamingSecrets(), stateNames);
 		}
 		return union(text);
 	};
@@ -38475,34 +38925,34 @@ function rememberRecoverableMaskedOutputs(stackName, resolved, redacted) {
 	}
 }
 function absorbOutputsPassSecrets() {
-	for (const passSecrets of this.outputsPassSecretMaps) {
-		for (const [value, expr] of passSecrets) this.outputSecrets.set(value, expr);
-		mergeResolvedPairs(passSecrets, this.outputSecrets);
-		for (const physicalId of physicalNameCopiesOf.get(passSecrets) ?? []) recordPhysicalNameCopy(this.outputSecrets, physicalId);
+	for (const passSecrets of this.outputsRun.outputsPassSecretMaps) {
+		for (const [value, expr] of passSecrets) this.outputsRun.outputSecrets.set(value, expr);
+		mergeResolvedPairs(passSecrets, this.outputsRun.outputSecrets);
+		for (const physicalId of physicalNameCopiesOf.get(passSecrets) ?? []) recordPhysicalNameCopy(this.outputsRun.outputSecrets, physicalId);
 	}
 }
 function redactOutputs(outputs) {
 	const redacted = redactOutputsBag.call(this, outputs);
-	if (this.outputsResolvedThisRun.has(outputs)) this.outputsResolvedThisRun.add(redacted);
+	if (this.outputsRun.outputsResolvedThisRun.has(outputs)) this.outputsRun.outputsResolvedThisRun.add(redacted);
 	return redacted;
 }
 function redactOutputsBag(outputs) {
 	this.absorbOutputsPassSecrets();
-	if (this.outputSecrets.size === 0) return this.maskOutputsByPosition(outputs);
-	return this.maskOutputsByPosition(redactSecretsForState(outputs, this.outputSecrets, this.outputsSourceUsable ? this.outputsTemplateSource : void 0, TEMPLATE_SOURCED_RULES));
+	if (this.outputsRun.outputSecrets.size === 0) return maskOutputsByPosition(this.noEchoRun, this.noEchoDeps(), outputs);
+	return maskOutputsByPosition(this.noEchoRun, this.noEchoDeps(), redactSecretsForState(outputs, this.outputsRun.outputSecrets, this.outputsRun.outputsSourceUsable ? this.outputsRun.outputsTemplateSource : void 0, TEMPLATE_SOURCED_RULES));
 }
 function registerNoEchoAttributes(logicalId, result, secrets, ownProperties) {
 	const declared = recordNoEchoAttributeValues(result, secrets, ownProperties);
 	const echoed = echoedNoEchoAttributes(this, logicalId, result.attributes, secrets, ownProperties, result.physicalId);
-	if (declared === true) this.noEchoAttributeResources.set(logicalId, true);
-	else if (declared !== void 0 || echoed.size > 0) this.noEchoAttributeResources.set(logicalId, /* @__PURE__ */ new Set([...declared ?? [], ...echoed]));
+	if (declared === true) this.noEchoRun.noEchoAttributeResources.set(logicalId, true);
+	else if (declared !== void 0 || echoed.size > 0) this.noEchoRun.noEchoAttributeResources.set(logicalId, /* @__PURE__ */ new Set([...declared ?? [], ...echoed]));
 }
 function echoedNoEchoAttributes(engine, logicalId, attributes, secrets, ownProperties, physicalId) {
 	const echoed = /* @__PURE__ */ new Set();
 	if (attributes === void 0) return echoed;
 	const fresh = [...freshNoEchoValuesOf.get(secrets) ?? []].filter((value) => isMaskOnlyPlaintext(secrets, value));
 	const templateProps = engine.perResourceTemplateProps.get(logicalId);
-	const sources = engine.noEchoPositionSources();
+	const sources = noEchoPositionSources(engine.noEchoRun);
 	const positioned = /* @__PURE__ */ new Map();
 	if (templateProps !== void 0 && ownProperties !== void 0 && sources !== void 0) for (const coordinate of noEchoCoordinatesOf(templateProps, ownProperties, {
 		parameters: sources.parameters,
@@ -38541,7 +38991,7 @@ function refuseRedactedAttributeReads(logicalId, resourceType, context) {
 function allRecordedSecrets() {
 	const all = /* @__PURE__ */ new Map();
 	for (const bag of this.perResourceSecrets.values()) for (const [plaintext, expression] of bag) all.set(plaintext, expression);
-	for (const [plaintext, expression] of this.outputSecrets) all.set(plaintext, expression);
+	for (const [plaintext, expression] of this.outputsRun.outputSecrets) all.set(plaintext, expression);
 	return all;
 }
 async function readReaderForFreshNoEchoCeiling(logicalId, currentResource, secrets) {
@@ -38597,8 +39047,39 @@ function noteSecretNamedRecord(logicalId, record) {
 function namingSecretsFor(logicalId) {
 	const own = this.perResourceSecrets.get(logicalId);
 	const noEcho = this.fingerprintNoEchoValues;
-	if (!hasMaskableValues(noEcho)) return own;
-	return unionOfSecretBags([own, noEcho]);
+	const stored = this.storedNoEchoNamingValues.get(logicalId);
+	if (!hasMaskableValues(noEcho) && !hasMaskableValues(stored)) return own;
+	return unionOfSecretBags([
+		own,
+		noEcho,
+		stored
+	]);
+}
+function stateNamingSecrets() {
+	const base = this.fingerprintNoEchoValues;
+	const stored = this.storedNoEchoNamingValues;
+	if (stored.size === 0) return base;
+	const hit = namingSecretsMemo.get(stored);
+	if (hit !== void 0 && hit.base === base) return hit.secrets;
+	const secrets = namingSecretsWithRecordedNoEcho(base, (logicalId) => stored.get(logicalId));
+	namingSecretsMemo.set(stored, {
+		base,
+		secrets
+	});
+	return secrets;
+}
+const namingSecretsMemo = /* @__PURE__ */ new WeakMap();
+function captureStoredNoEchoNamingValues(resources, template, conditions) {
+	const names = new Set(this.noEchoRun.inheritedNoEchoParameters);
+	for (const [name, definition] of Object.entries(template.Parameters ?? {})) if (declaresNoEcho(definition)) names.add(name);
+	const templateResources = template.Resources ?? {};
+	const captured = /* @__PURE__ */ new Map();
+	for (const [logicalId, record] of Object.entries(resources)) {
+		const templateResource = Object.hasOwn(templateResources, logicalId) ? templateResources[logicalId] : void 0;
+		const bag = recordedNoEchoValuesOf(templateResource?.Type === record?.resourceType ? templateResource?.Properties : void 0, record, names, conditions);
+		if (hasMaskableValues(bag)) captured.set(logicalId, bag);
+	}
+	this.storedNoEchoNamingValues = captured;
 }
 function noteSecretNamedReads(logicalId, record, resources) {
 	const read = secretNamesReadBy(logicalId, record, resources, (otherId) => ({
@@ -38954,68 +39435,6 @@ function warnUnretriedReplacedDeletes(why) {
 	for (const [logicalId, entry] of deferred ?? []) withPrintingSecrets(this.secretNameBagFor(logicalId), () => this.logger.warn(safeMsg`  ⚠ Failed to delete old resource ${logicalId} (${entry.physicalId}): ${entry.failureMessage} (${note})`));
 }
 
-//#endregion
-//#region src/deployment/read-only-attribute-healer.ts
-async function readRecordAttributes(input) {
-	const { provider, logicalId, resource, stackName, region } = input;
-	if (!provider.import) return { kind: "not-attempted" };
-	if (!hasAddressablePhysicalId(resource)) return { kind: "not-attempted" };
-	const found = await provider.import({
-		logicalId,
-		resourceType: resource.resourceType,
-		stackName,
-		region,
-		properties: resource.properties,
-		knownPhysicalId: resource.physicalId
-	});
-	if (found === null) return { kind: "not-found" };
-	if (found.physicalId !== resource.physicalId) throw new Error(`the provider answered for a different resource (${found.physicalId}) than the one asked about (${resource.physicalId})`);
-	const reported = Object.entries(normalizeHealedAttributes(found.attributes));
-	const attributes = Object.fromEntries(reported.filter(([, value]) => !carriesSecretMask(value)));
-	const withheldKeys = reported.filter(([, value]) => carriesSecretMask(value)).map(([key]) => key);
-	return {
-		kind: "read",
-		attributes,
-		...withheldKeys.length > 0 && { withheldKeys }
-	};
-}
-function createReadOnlyAttributeHealerFactory(options) {
-	const logger = getLogger().child("ReadOnlyAttributeHealer");
-	const memo = /* @__PURE__ */ new Map();
-	const readOnce = (stackName, region, logicalId, resource) => {
-		let key;
-		try {
-			if (isHealExcludedType(resource.resourceType)) return Promise.resolve({ kind: "not-attempted" });
-			key = injectiveKey(stackName, region, logicalId, resource.physicalId);
-		} catch (error) {
-			return Promise.resolve({
-				kind: "failed",
-				error
-			});
-		}
-		const inFlight = memo.get(key);
-		if (inFlight) return inFlight;
-		const heal = (async () => options.inRegion(region, () => readRecordAttributes({
-			provider: options.getProvider(resource, region),
-			logicalId,
-			resource,
-			stackName,
-			region
-		})))().then((outcome) => {
-			if (outcome.kind === "read") try {
-				logger.debug(safeMsg`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS for this preview — its state record lacked one a Fn::GetAtt asked for; nothing is written: ${Object.keys(outcome.attributes).length} attribute(s) read`);
-			} catch {}
-			return outcome;
-		}).catch((error) => ({
-			kind: "failed",
-			error
-		}));
-		memo.set(key, heal);
-		return heal;
-	};
-	return (stackName, region) => Object.assign((logicalId, resource) => readOnce(stackName, region, logicalId, resource), { readOnly: true });
-}
-
 //#endregion
 //#region src/deployment/deploy-engine/attribute-healer.ts
 var AttributeHealer = class {
@@ -39052,7 +39471,7 @@ var AttributeHealer = class {
 			provisionedBy: resource.provisionedBy,
 			previousProperties: resource.properties
 		});
-		const outcome = await withPrintingSecrets(healPrintingBag(this.deps.baseline, logicalId, resource), () => readRecordAttributes({
+		const outcome = await withPrintingSecrets(healPrintingBag(this.deps.baseline, logicalId, resource, this.deps.namingSecrets()), () => readRecordAttributes({
 			provider,
 			logicalId,
 			resource,
@@ -39087,23 +39506,26 @@ var AttributeHealer = class {
 	}
 };
 const healJudges = /* @__PURE__ */ new WeakMap();
-function healPrintingBag(baseline, logicalId, resource) {
-	if (!Object.hasOwn(baseline, logicalId) || baseline[logicalId] !== resource) return secretNamePrintingBag(logicalId, {
+function healPrintingBag(baseline, logicalId, resource, namingSecrets) {
+	if (!Object.hasOwn(baseline, logicalId) || baseline[logicalId] !== resource) return secretNamePrintingBags({
 		...baseline,
 		[logicalId]: resource
-	});
-	let judge = healJudges.get(baseline);
-	if (judge === void 0) {
-		judge = secretNamePrintingBags(baseline, void 0);
-		healJudges.set(baseline, judge);
+	}, namingSecrets)(logicalId);
+	let hit = healJudges.get(baseline);
+	if (hit === void 0 || hit.namingSecrets !== namingSecrets) {
+		hit = {
+			namingSecrets,
+			judge: secretNamePrintingBags(baseline, namingSecrets)
+		};
+		healJudges.set(baseline, hit);
 	}
-	return judge(logicalId);
+	return hit.judge(logicalId);
 }
 
 //#endregion
 //#region src/deployment/deploy-engine/record-shape.ts
-function auditResolvedAssetReferences(logicalId, resourceType, resolvedProps) {
-	const redirect = this.options.assetRedirect;
+function auditResolvedAssetReferences(options, logicalId, resourceType, resolvedProps) {
+	const redirect = options.assetRedirect;
 	if (!redirect) return;
 	const findings = findUnrewrittenAssetReferences(resolvedProps, redirect);
 	if (findings.length === 0) return;
@@ -39138,6 +39560,57 @@ function acceptedCreateOnlyDropsField(recordedProperties, resourceType, provisio
 	const names = findSilentDropProperties(resourceType, recordedProperties).map(({ property }) => property).filter((property) => createOnly.has(property) && (carried === void 0 || carried.has(property)));
 	return { acceptedCreateOnlyDrops: names.length > 0 ? names : void 0 };
 }
+function secretNamedAttributesField(result, previous) {
+	const reported = result.secretNamedAttributeNames;
+	const source = reported !== void 0 ? reported : previous?.secretNamedAttributes;
+	if (!Array.isArray(source)) return {};
+	const names = source.filter((name) => typeof name === "string" && name !== "");
+	return names.length > 0 ? { secretNamedAttributes: names } : {};
+}
+
+//#endregion
+//#region src/deployment/label-routing.ts
+function deriveLabelRouting(change, existingState, registry, forceCcApi = false) {
+	try {
+		if (change.changeType === "DELETE") return existingState?.provisionedBy;
+		return registry.getProviderFor({
+			resourceType: change.resourceType,
+			properties: change.desiredProperties ?? {},
+			provisionedBy: existingState?.provisionedBy,
+			previousProperties: existingState?.properties,
+			forceCcApi
+		}).provisionedBy;
+	} catch {
+		return;
+	}
+}
+
+//#endregion
+//#region src/deployment/deploy-engine/routing.ts
+function isPinnedToCcApi(options, stackName, logicalId) {
+	return options.pinCcApi?.stackName === stackName && options.pinCcApi.logicalIds.has(logicalId);
+}
+function recreateDirectionFor(options, stackName, logicalId) {
+	const targets = options.recreateTargets?.stackName === stackName ? options.recreateTargets : void 0;
+	if (targets === void 0) return void 0;
+	if (targets.viaCcApi.has(logicalId)) return "cc-api";
+	if (targets.viaSdkProvider.has(logicalId)) return "sdk";
+}
+function peekRoutingForLabel(providerRegistry, options, change, existingState, stackName, logicalId, needsReplacement = false, recreateDirection) {
+	if (needsReplacement) {
+		const hintRecord = {
+			...recreateDirection !== void 0 && { provisionedBy: recreateDirection },
+			...existingState?.properties !== void 0 && { properties: existingState.properties }
+		};
+		return deriveLabelRouting(change, hintRecord, providerRegistry, recreateDirection === "cc-api");
+	}
+	return deriveLabelRouting(change, existingState, providerRegistry, isPinnedToCcApi(options, stackName, logicalId));
+}
+function preparePropertiesForCcApi(providerRegistry, resourceType, resolvedProps, logicalId) {
+	const sdkProvider = providerRegistry.getRegisteredTypes().includes(resourceType) ? providerRegistry.getProvider(resourceType) : void 0;
+	if (sdkProvider?.preparePropertiesForFallback) return sdkProvider.preparePropertiesForFallback(logicalId, resourceType, resolvedProps);
+	return applyDefaultNameForFallback(logicalId, resourceType, resolvedProps);
+}
 
 //#endregion
 //#region src/utils/resource-line.ts
@@ -39243,7 +39716,7 @@ function buildResolverContext(base, stackName) {
 		...this.options.inheritedPhysicalNameCopies && { inheritedPhysicalNameCopies: this.options.inheritedPhysicalNameCopies },
 		...this.options.inheritedReferenceProvenance && { inheritedReferenceProvenance: this.options.inheritedReferenceProvenance },
 		recordedSecretValues,
-		noEchoAttributeResources: this.noEchoAttributeResources,
+		noEchoAttributeResources: this.noEchoRun.noEchoAttributeResources,
 		secretNameNeedles: (logicalId) => this.noteSecretNamedRecord(logicalId, Object.hasOwn(base.resources, logicalId) ? base.resources[logicalId] : void 0),
 		producerSecrets: (logicalId) => this.perResourceSecrets.get(logicalId),
 		secretRegionEvidence: () => this.runProducerRegionEvidence?.(),
@@ -39318,7 +39791,7 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 		redactedAttributeReads: []
 	}, stackName);
 	if (context.recordedSecretValues) this.perResourceSecrets.set(logicalId, context.recordedSecretValues);
-	const noEchoOverrides = await this.noEchoAttributeOverridesFor(desiredProps, stateResources, stackName);
+	const noEchoOverrides = await noEchoAttributeOverridesFor(this.noEchoRun, this.noEchoDeps(), desiredProps, stateResources, stackName);
 	if (noEchoOverrides !== void 0) context.noEchoAttributeOverrides = noEchoOverrides;
 	printNestedStackReadsOnly(context, resourceType, this.secretNameBagFor(logicalId));
 	const resolvedProps = await this.resolver.resolve(desiredProps, context);
@@ -39336,17 +39809,17 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 	]), inputFingerprinter(desiredProps, fingerprintSources)));
 	this.perResourceResolvedType.set(logicalId, resourceType);
 	const createSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
-	if (resourceType === "AWS::CloudFormation::Stack") recordPassedNoEchoParameters(createSecrets, desiredProps["Parameters"], this.noEchoPositionSources(stateResources));
+	if (resourceType === "AWS::CloudFormation::Stack") recordPassedNoEchoParameters(createSecrets, desiredProps["Parameters"], noEchoPositionSources(this.noEchoRun, stateResources));
 	if (fingerprintSources !== void 0 && resourceType === "AWS::CloudFormation::Stack") recordPassedParameterClasses(createSecrets, await classifyPassedParameters(desiredProps["Parameters"], fingerprintSources));
 	recordNestedStackParameterExpressions(createSecrets, resourceType, resolvedProps, desiredProps);
-	this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
+	auditResolvedAssetReferences(this.options, logicalId, resourceType, resolvedProps);
 	this.attemptedResolvedProps.set(logicalId, resolvedProps);
 	const createDecision = this.providerRegistry.getProviderFor({
 		resourceType,
 		properties: resolvedProps
 	});
 	const createProvider = createDecision.provider;
-	const createProps = createDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
+	const createProps = createDecision.provisionedBy === "cc-api" ? preparePropertiesForCcApi(this.providerRegistry, resourceType, resolvedProps, logicalId) : resolvedProps;
 	const resumed = await resumeAbandonedCreate.call(this, {
 		logicalId,
 		resourceType,
@@ -39389,23 +39862,28 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 	}
 	this.generatedNameGuard?.noteReturned(logicalId);
 	this.registerNoEchoAttributes(logicalId, result, createSecrets, resolvedProps);
-	const dependencies = this.extractAllDependencies(template, logicalId);
-	const templateAttrs = this.extractTemplateAttributes(template, logicalId);
-	const recordedProperties = this.propertiesToRecord(resolvedProps, result, resourceType, createDecision.provisionedBy);
+	const dependencies = extractAllDependencies(template, logicalId);
+	const templateAttrs = extractTemplateAttributes(template, logicalId);
+	const recordedProperties = propertiesToRecord(resolvedProps, result, resourceType, createDecision.provisionedBy);
 	stateResources[logicalId] = {
 		physicalId: result.physicalId,
 		resourceType,
 		properties: recordedProperties,
 		...acceptedCreateOnlyDropsField(recordedProperties, resourceType, createDecision.provisionedBy, "new-resource"),
 		...result.attributes && { attributes: result.attributes },
+		...secretNamedAttributesField(result),
 		...dependencies && dependencies.length > 0 && { dependencies },
 		...templateAttrs,
 		provisionedBy: createDecision.provisionedBy
 	};
 	this.recordInlinePolicyWrite(logicalId, "create");
-	await this.establishNoEchoEchoFidelity(logicalId, stateResources[logicalId], resolvedProps, stateResources, createSecrets);
-	const createCaptureSiblings = await this.buildObservedCaptureSiblings(resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
-	this.kickOffObservedCapture(createProvider, logicalId, result.physicalId, resourceType, resolvedProps, {
+	await establishNoEchoEchoFidelity(this.noEchoRun, this.noEchoDeps(), logicalId, stateResources[logicalId], resolvedProps, stateResources, createSecrets);
+	const createCaptureSiblings = await buildObservedCaptureSiblings({
+		options: this.options,
+		buildResolverContext: (...args) => this.buildResolverContext(...args),
+		resolver: this.resolver
+	}, resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
+	this.observedCapture.kickOffObservedCapture(createProvider, logicalId, result.physicalId, resourceType, resolvedProps, {
 		...createCaptureSiblings,
 		afterOwnWrite: true
 	}, createSecrets);
@@ -42438,333 +42916,6 @@ function withRefreshedReadVersions(record, unchanged) {
 	return withReferenceProvenance(record, out);
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/noecho.ts
-function noEchoExactEchoLeavesOf(record) {
-	const field = record?.noEchoExactEchoLeaves;
-	if (!Array.isArray(field)) return void 0;
-	const out = [];
-	for (const entry of field) {
-		if (!Array.isArray(entry) || entry.length === 0) return void 0;
-		if (!entry.every((segment) => typeof segment === "string")) return void 0;
-		out.push([...entry]);
-	}
-	return out;
-}
-function echoFidelityCandidates(coordinates, resolved, createOnly) {
-	const out = [];
-	for (const coordinate of coordinates) {
-		if (!coordinate.every((segment) => typeof segment === "string")) continue;
-		const keys = coordinate;
-		if (!createOnly.some((path) => path.length <= keys.length && path.every((s, i) => s === keys[i]))) continue;
-		const plaintext = valueAtCoordinate(resolved, keys);
-		if (typeof plaintext !== "string" || carriesSecretMask(plaintext)) continue;
-		out.push({
-			coordinate: keys,
-			plaintext
-		});
-	}
-	return out;
-}
-function reportedLeafAt(live, handed, candidate) {
-	if (valueAtCoordinate(handed, candidate.coordinate) !== "***") return void 0;
-	const leaf = valueAtCoordinate(live, candidate.coordinate);
-	return typeof leaf === "string" && !carriesSecretMask(leaf) ? leaf : void 0;
-}
-function echoesExactlyAt(live, handed, candidate) {
-	return reportedLeafAt(live, handed, candidate) === candidate.plaintext;
-}
-function provesEchoChangeAt(live, handed, candidate) {
-	const reported = reportedLeafAt(live, handed, candidate);
-	return reported !== void 0 && reported !== candidate.plaintext;
-}
-function noteNoEchoExactEchoes(logicalId, physicalId, read, handed, candidates, mode) {
-	const exact = "failure" in read ? [] : candidates.filter((candidate) => echoesExactlyAt(read.live, handed, candidate)).map((candidate) => [...candidate.coordinate]);
-	const noted = this.noEchoExactEchoes.get(logicalId);
-	const previous = mode === "add" && noted?.physicalId === physicalId ? noted.coordinates : [];
-	this.noEchoExactEchoes.set(logicalId, {
-		physicalId,
-		coordinates: sortedCoordinates([...previous, ...exact])
-	});
-}
-function sortedCoordinates(coordinates) {
-	const keyed = /* @__PURE__ */ new Map();
-	for (const coordinate of coordinates) keyed.set(JSON.stringify(coordinate), [...coordinate]);
-	return [...keyed.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([, c]) => c);
-}
-async function establishNoEchoEchoFidelity(logicalId, record, resolvedProps, stateResources, secrets) {
-	this.noEchoExactEchoes.delete(logicalId);
-	const templateProps = this.perResourceTemplateProps.get(logicalId);
-	const sources = this.noEchoPositionSources(stateResources);
-	if (templateProps === void 0 || sources === void 0 || sources.parameters.size === 0) return;
-	const coordinates = canonicalCoordinates(noEchoCoordinatesOf(templateProps, resolvedProps, {
-		parameters: sources.parameters,
-		...sources.conditions !== void 0 && { conditions: sources.conditions }
-	}));
-	if (coordinates.length === 0) return;
-	const candidates = echoFidelityCandidates(coordinates, resolvedProps, await getCreateOnlyPropertyPaths(record.resourceType).catch(() => []));
-	if (candidates.length === 0) return;
-	const handed = {
-		...record,
-		properties: maskAtCoordinates(record.properties, coordinates)
-	};
-	const read = await this.readReaderForFreshNoEchoCeiling(logicalId, handed, secrets);
-	this.noteNoEchoExactEchoes(logicalId, record.physicalId, read, handed.properties, candidates, "set");
-}
-function withNoEchoExactEchoes(logicalId, record) {
-	const noted = this.noEchoExactEchoes.get(logicalId);
-	if (noted === void 0 || noted.coordinates.length === 0) return record;
-	if (noted.physicalId !== record.physicalId) return record;
-	const merged = sortedCoordinates([...noEchoExactEchoLeavesOf(record) ?? [], ...noted.coordinates]);
-	return {
-		...record,
-		noEchoExactEchoLeaves: merged
-	};
-}
-function noEchoParameterNamesOf(template) {
-	const names = /* @__PURE__ */ new Set();
-	const declared = template?.Parameters;
-	if (declared === null || typeof declared !== "object") return names;
-	for (const [name, definition] of Object.entries(declared)) if (declaresNoEcho(definition)) names.add(name);
-	return names;
-}
-function noEchoAttributeNamesOf(record) {
-	const field = record?.noEchoAttributeNames;
-	if (!Array.isArray(field) || !field.every((name) => typeof name === "string")) return void 0;
-	return field;
-}
-function noEchoPositionSources(resources = {}, template = this.constructPathTemplate, conditions = this.noEchoConditions) {
-	if (template === void 0) return void 0;
-	const declared = this.noEchoAttributeResources;
-	return {
-		parameters: /* @__PURE__ */ new Set([...noEchoParameterNamesOf(template), ...this.inheritedNoEchoParameters]),
-		attributeIsNoEcho: (logicalId, attribute) => {
-			const live = declared.get(logicalId);
-			if (live === true || live !== void 0 && live.has(attribute)) return true;
-			if (noEchoAttributeNamesOf(Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0)?.includes(attribute) === true) return true;
-			return this.persistedNoEchoAttributes.get(logicalId)?.has(attribute) === true;
-		},
-		...conditions !== void 0 && { conditions }
-	};
-}
-function noEchoLeavesFor(logicalId, record, templateProps, sources) {
-	if (templateProps !== void 0 && isWrittenFromDeployedTemplate(record.properties)) return canonicalCoordinates(noEchoCoordinatesOf(templateProps, record.properties, sources));
-	const existing = noEchoLeavesOf(record);
-	if (existing !== void 0) {
-		const confirmed = this.witnessConfirmedLeaves.get(logicalId) ?? [];
-		return canonicalCoordinates([...existing, ...confirmed]);
-	}
-	const resolvedAsSame = this.perResourceResolvedType.get(logicalId) === record.resourceType;
-	const source = (templateProps !== void 0 && resolvedAsSame ? templateProps : void 0) ?? templatePropertiesFor(this, logicalId, record.resourceType);
-	if (source === void 0) return void 0;
-	return canonicalCoordinates(noEchoCoordinatesOf(source, record.properties, sources));
-}
-function templatePropertiesFor(engine, logicalId, resourceType) {
-	const resources = engine.constructPathTemplate?.Resources;
-	if (resources === void 0 || !Object.hasOwn(resources, logicalId)) return void 0;
-	const definition = resources[logicalId];
-	if (definition?.Type !== resourceType) return void 0;
-	const properties = definition.Properties;
-	return properties !== null && typeof properties === "object" && !Array.isArray(properties) ? properties : void 0;
-}
-function noEchoAttributeNamesFor(engine, logicalId, record, carried, leaves) {
-	const attributes = record.attributes ?? {};
-	const names = /* @__PURE__ */ new Set();
-	let echoed = false;
-	for (const coordinate of leaves ?? []) {
-		const value = valueAtCoordinate(record.properties, coordinate);
-		if (value === void 0 || carriesSecretMask(value)) continue;
-		for (const [name, attribute] of Object.entries(attributes)) {
-			if (carriesSecretMask(attribute)) continue;
-			if (typeof attribute === "string" && attribute === record.physicalId) continue;
-			const sameName = coordinate[0] === name && keyOrderFreeJson(attribute) === keyOrderFreeJson(value);
-			const embeds = typeof value === "string" && typeof attribute === "string" && !attribute.startsWith("arn:") && value.length >= 4 && typeof attribute === "string" && attribute.includes(value);
-			if (sameName || embeds) {
-				names.add(name);
-				echoed = true;
-			}
-		}
-	}
-	const declared = carried ? void 0 : engine.noEchoAttributeResources.get(logicalId);
-	if (declared === true) for (const name of Object.keys(attributes)) names.add(name);
-	else if (declared !== void 0) {
-		for (const name of declared) if (Object.hasOwn(attributes, name)) names.add(name);
-	}
-	const prior = noEchoAttributeNamesOf(record);
-	for (const name of prior ?? []) if (Object.hasOwn(attributes, name) && carriesSecretMask(attributes[name])) names.add(name);
-	if (declared === void 0 && prior === void 0 && !echoed) return void 0;
-	return [...names].sort();
-}
-function applyNoEchoPersist(logicalId, record, scrubbed, templateProps, resources, secrets, carried = false) {
-	const sources = this.noEchoPositionSources(resources);
-	if (sources === void 0) return scrubbed;
-	const leaves = this.noEchoLeavesFor(logicalId, record, templateProps, sources);
-	const names = noEchoAttributeNamesFor(this, logicalId, record, carried, leaves);
-	if (leaves === void 0 && names === void 0) return scrubbed;
-	const next = { ...scrubbed };
-	if (leaves !== void 0) {
-		next.properties = maskAtCoordinates(scrubbed.properties, leaves);
-		if (scrubbed.observedProperties !== void 0 && leaves.length > 0) Object.assign(next, { observedProperties: maskReadbackAtCoordinates(scrubbed.observedProperties, record.properties, leaves) });
-		if (leaves.length > 0) next.noEchoLeaves = leaves;
-		else delete next.noEchoLeaves;
-		const marked = new Set(leaves.map((coordinate) => JSON.stringify(coordinate)));
-		const exact = (noEchoExactEchoLeavesOf(scrubbed) ?? []).filter((coordinate) => marked.has(JSON.stringify(coordinate)));
-		if (exact.length > 0) next.noEchoExactEchoLeaves = exact;
-		else delete next.noEchoExactEchoLeaves;
-	}
-	if (names !== void 0) {
-		if (scrubbed.attributes !== void 0 && names.length > 0) {
-			const attributes = { ...scrubbed.attributes };
-			for (const name of names) if (Object.hasOwn(attributes, name)) attributes[name] = maskWholeValue(attributes[name]);
-			next.attributes = attributes;
-		}
-		if (names.length > 0) next.noEchoAttributeNames = names;
-		else delete next.noEchoAttributeNames;
-	}
-	this.warnNoEchoPhysicalId(logicalId, record, secrets);
-	return next;
-}
-function warnNoEchoPhysicalId(logicalId, record, secrets) {
-	if (secrets === void 0 || this.noEchoPhysicalIdWarned.has(logicalId)) return;
-	const values = noEchoParameterPlaintextsOf(secrets);
-	if (values.length === 0 || typeof record.physicalId !== "string") return;
-	if (!values.some((value) => record.physicalId.includes(value))) return;
-	this.noEchoPhysicalIdWarned.add(logicalId);
-	this.logger.warn(this.maskForResource(logicalId, safeMsg`${logicalId}: its physical id contains a NoEcho parameter value. AWS publishes a resource's name, so cdkd keeps the physical id in state as AWS returns it.`));
-}
-function seedPersistedNoEchoAttributes(resources) {
-	this.persistedNoEchoAttributes = /* @__PURE__ */ new Map();
-	for (const [logicalId, record] of Object.entries(resources)) {
-		const names = noEchoAttributeNamesOf(record);
-		if (names !== void 0 && names.length > 0) this.persistedNoEchoAttributes.set(logicalId, new Set(names));
-	}
-}
-function maskOutputsByPosition(outputs) {
-	const sources = this.noEchoPositionSources();
-	if (sources === void 0) return outputs;
-	const templateValues = Object.create(null);
-	for (const [name, definition] of Object.entries(this.constructPathTemplate?.Outputs ?? {})) templateValues[name] = definition?.Value;
-	if (this.outputsSourceUsable) for (const [name, value] of Object.entries(this.outputsTemplateSource)) templateValues[name] = value;
-	const coordinates = noEchoCoordinatesOf(templateValues, outputs, sources);
-	if (coordinates.length === 0) return outputs;
-	const maskedValues = new Set(coordinates.filter((coordinate) => coordinate.length === 1 && typeof coordinate[0] === "string").map((coordinate) => keyOrderFreeJson(outputs[coordinate[0]])));
-	const aliasCoordinates = Object.keys(outputs).filter((key) => !Object.hasOwn(templateValues, key) && outputs[key] !== void 0 && !carriesSecretMask(outputs[key]) && maskedValues.has(keyOrderFreeJson(outputs[key]))).map((key) => [key]);
-	return maskAtCoordinates(outputs, [...coordinates, ...aliasCoordinates]);
-}
-function getAttTargetsOf(node) {
-	const targets = [];
-	const seen = /* @__PURE__ */ new Set();
-	const subVariable = /\$\{([^}!][^}]*)\}/g;
-	const walk = (value) => {
-		if (value === null || typeof value !== "object" || seen.has(value)) return;
-		seen.add(value);
-		if (Array.isArray(value)) {
-			for (const item of value) walk(item);
-			return;
-		}
-		const record = value;
-		const getAtt = record["Fn::GetAtt"];
-		if (typeof getAtt === "string" && getAtt.indexOf(".") > 0) {
-			const dot = getAtt.indexOf(".");
-			targets.push([getAtt.slice(0, dot), getAtt.slice(dot + 1)]);
-		} else if (Array.isArray(getAtt) && typeof getAtt[0] === "string" && typeof getAtt[1] === "string") targets.push([getAtt[0], getAtt[1]]);
-		const sub = record["Fn::Sub"];
-		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
-		if (typeof text === "string") for (const match of text.matchAll(subVariable)) {
-			const name = match[1].trim();
-			const dot = name.indexOf(".");
-			if (dot > 0) targets.push([name.slice(0, dot), name.slice(dot + 1)]);
-		}
-		for (const child of Object.values(record)) walk(child);
-	};
-	walk(node);
-	return targets;
-}
-async function noEchoAttributeOverridesFor(desiredProps, stateResources, stackName) {
-	const wanted = /* @__PURE__ */ new Map();
-	for (const [logicalId, attribute] of getAttTargetsOf(desiredProps)) {
-		const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
-		if (record === void 0) continue;
-		if (noEchoAttributeNamesOf(record)?.includes(attribute) !== true) continue;
-		if (!carriesSecretMask(record.attributes?.[attribute])) continue;
-		if (!this.perResourceSecrets.has(logicalId)) continue;
-		const set = wanted.get(logicalId) ?? /* @__PURE__ */ new Set();
-		set.add(attribute);
-		wanted.set(logicalId, set);
-	}
-	if (wanted.size === 0) return void 0;
-	const overrides = /* @__PURE__ */ new Map();
-	for (const [logicalId, attributes] of wanted) {
-		const record = stateResources[logicalId];
-		let read = this.noEchoAttributeReads.get(logicalId);
-		if (read === void 0) {
-			read = (async () => {
-				try {
-					const { provider } = this.providerRegistry.getProviderFor({
-						resourceType: record.resourceType,
-						properties: record.properties,
-						provisionedBy: record.provisionedBy,
-						previousProperties: record.properties
-					});
-					const outcome = await readRecordAttributes({
-						provider,
-						logicalId,
-						resource: record,
-						stackName,
-						region: this.stackRegion
-					});
-					return outcome.kind === "read" ? outcome.attributes : void 0;
-				} catch {
-					return;
-				}
-			})();
-			this.noEchoAttributeReads.set(logicalId, read);
-		}
-		const live = await read;
-		if (live === void 0) continue;
-		const secrets = this.perResourceSecrets.get(logicalId);
-		const fresh = noEchoParameterPlaintextsOf(secrets);
-		const positioned = this.noEchoPositionedValues.get(logicalId) ?? /* @__PURE__ */ new Set();
-		const served = {};
-		for (const attribute of attributes) {
-			if (!Object.hasOwn(live, attribute)) continue;
-			const value = live[attribute];
-			if (typeof value === "string" && fresh.some((needle) => value === needle || value.includes(needle)) || value !== void 0 && positioned.has(keyOrderFreeJson(value))) served[attribute] = value;
-		}
-		if (Object.keys(served).length > 0) overrides.set(logicalId, served);
-	}
-	return overrides.size > 0 ? overrides : void 0;
-}
-function noEchoDiffComparison(resources, template, conditions, parameterValues, stackName) {
-	const sources = this.noEchoPositionSources(resources, template, conditions);
-	if (sources === void 0) return void 0;
-	const compare = noEchoComparison({
-		sources,
-		values: parameterValues,
-		minNeedleLength: 4,
-		publicTokens: /* @__PURE__ */ new Set([this.stackRegion, ...stackName === void 0 ? [] : [stackName]])
-	});
-	return (input) => compare(input);
-}
-function freshNoEchoParametersWithDeclared(inherited, template) {
-	const all = /* @__PURE__ */ new Set([...inherited ?? [], ...noEchoParameterNamesOf(template)]);
-	return all.size > 0 ? all : void 0;
-}
-function noEchoComparisonForTemplate(template, knownConditions, values, resources, publicTokens, inheritedNoEchoParameters) {
-	const sources = {
-		parameters: /* @__PURE__ */ new Set([...noEchoParameterNamesOf(template), ...inheritedNoEchoParameters ?? []]),
-		attributeIsNoEcho: (logicalId, attribute) => noEchoAttributeNamesOf(Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0)?.includes(attribute) === true,
-		...knownConditions !== void 0 && { conditions: knownConditions }
-	};
-	const compare = noEchoComparison({
-		sources,
-		values: values ?? {},
-		minNeedleLength: 4,
-		...publicTokens !== void 0 && { publicTokens }
-	});
-	return (input) => compare(input);
-}
-
 //#endregion
 //#region src/analyzer/security-changes.ts
 const RESOURCE_SCRUTINY = {
@@ -44256,7 +44407,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	}, stackName);
 	const updateSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
 	this.perResourceSecrets.set(logicalId, updateSecrets);
-	const noEchoOverrides = await this.noEchoAttributeOverridesFor(desiredProps, stateResources, stackName);
+	const noEchoOverrides = await noEchoAttributeOverridesFor(this.noEchoRun, this.noEchoDeps(), desiredProps, stateResources, stackName);
 	if (noEchoOverrides !== void 0) context.noEchoAttributeOverrides = noEchoOverrides;
 	printNestedStackReadsOnly(context, resourceType, this.secretNameBagFor(logicalId));
 	const resolvedProps = await this.resolver.resolve(desiredProps, context);
@@ -44268,7 +44419,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	this.perResourceTemplateProps.set(logicalId, desiredProps);
 	this.perResourceResolvedType.set(logicalId, resourceType);
 	recordNestedStackParameterExpressions(updateSecrets, resourceType, resolvedProps, desiredProps);
-	this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
+	auditResolvedAssetReferences(this.options, logicalId, resourceType, resolvedProps);
 	const lostCandidate = childLostWithRecreatedParent({
 		resourceType,
 		templateProperties: desiredProps,
@@ -44279,7 +44430,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	const lostChild = lostCandidate?.mode === "reattach" || lostCandidate !== void 0 && Object.hasOwn(resolvedProps, lostCandidate.property) && Object.hasOwn(currentProps, lostCandidate.property) && keyOrderFreeJson(resolvedProps[lostCandidate.property]) === keyOrderFreeJson(currentProps[lostCandidate.property]) ? lostCandidate : void 0;
 	const lostWithParent = lostChild?.mode === "recreate" ? lostChild.parent : void 0;
 	this.registerNoEchoAttributes(logicalId, Object.assign(currentResource.attributes === void 0 ? {} : { attributes: currentResource.attributes }, { physicalId: currentResource.physicalId }), updateSecrets, resolvedProps);
-	const noEchoSources = this.noEchoPositionSources(stateResources, template, conditions);
+	const noEchoSources = noEchoPositionSources(this.noEchoRun, stateResources, template, conditions);
 	const parameterCoordinates = noEchoSources === void 0 ? [] : canonicalCoordinates(noEchoCoordinatesOf(desiredProps, resolvedProps, {
 		parameters: noEchoSources.parameters,
 		...noEchoSources.conditions !== void 0 && { conditions: noEchoSources.conditions }
@@ -44296,7 +44447,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		return resolved !== void 0 && !carriesSecretMask(resolved);
 	});
 	const comparisonCoordinates = canonicalCoordinates([...noEchoCoordinates, ...staleCoordinates]);
-	if (parameterCoordinates.length > 0) this.noEchoPositionedValues.set(logicalId, new Set(parameterCoordinates.map((coordinate) => keyOrderFreeJson(valueAtCoordinate(resolvedProps, coordinate)))));
+	if (parameterCoordinates.length > 0) this.noEchoRun.noEchoPositionedValues.set(logicalId, new Set(parameterCoordinates.map((coordinate) => keyOrderFreeJson(valueAtCoordinate(resolvedProps, coordinate)))));
 	const fingerprintSources = template && this.maskedInputSources(template, stateResources, conditions, stackName);
 	const fingerprints = fingerprintSources && inputFingerprinter(desiredProps, fingerprintSources);
 	const movedMasked = new Set(await movedMaskedProperties(currentResource, desiredProps, fingerprints));
@@ -44305,7 +44456,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		this.fingerprintNoEchoValues,
 		this.options.inheritedSecrets
 	]), fingerprints));
-	if (resourceType === "AWS::CloudFormation::Stack") recordPassedNoEchoParameters(updateSecrets, desiredProps["Parameters"], this.noEchoPositionSources(stateResources));
+	if (resourceType === "AWS::CloudFormation::Stack") recordPassedNoEchoParameters(updateSecrets, desiredProps["Parameters"], noEchoPositionSources(this.noEchoRun, stateResources));
 	if (fingerprintSources !== void 0 && resourceType === "AWS::CloudFormation::Stack") recordPassedParameterClasses(updateSecrets, await classifyPassedParameters(desiredProps["Parameters"], fingerprintSources));
 	const desiredForSkipCheck = maskAtCoordinates(redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps), comparisonCoordinates);
 	const legacyDesired = withoutPhysicalNameCopies(updateSecrets, () => maskAtCoordinates(redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps), comparisonCoordinates));
@@ -44353,7 +44504,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	const witness = todayAsWritten === void 0 ? void 0 : witnessNormalize(recordedAsWritten, todayAsWritten, desiredForSkipCheckAsWritten);
 	const currentPropsAsWritten = witness === void 0 ? recordedAsWritten : witness.current;
 	const witnessMigrates = unmarkedRecord || (witness?.confirmed.length ?? 0) > 0;
-	if (!unmarkedRecord && witness !== void 0 && witness.confirmed.length > 0) this.witnessConfirmedLeaves.set(logicalId, witness.confirmed.map((coordinate) => [...coordinate]));
+	if (!unmarkedRecord && witness !== void 0 && witness.confirmed.length > 0) this.noEchoRun.witnessConfirmedLeaves.set(logicalId, witness.confirmed.map((coordinate) => [...coordinate]));
 	for (const coordinate of witness?.differing ?? []) {
 		const desiredAt = valueAtCoordinate(desiredForSkipCheckAsWritten, coordinate);
 		recordPreviousNoEchoLeaves(this.secretNameBagFor(logicalId), valueAtCoordinate(recordedAsWritten, coordinate), scalarLeavesOf(desiredAt), updateSecrets, desiredAt !== "***");
@@ -44428,7 +44579,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		this.logger.info(safeMsg`  ↻ ${logicalId} (${resourceType}) attribute update: ${attrSummary}`);
 		stateResources[logicalId] = {
 			...stateResources[logicalId] ?? currentResource,
-			...this.extractTemplateAttributes(template, logicalId)
+			...extractTemplateAttributes(template, logicalId)
 		};
 		if (counts) counts.updated++;
 		if (progress) progress.current++;
@@ -44444,7 +44595,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	} : currentResource;
 	let readback;
 	const readOnce = () => readback ??= this.readReaderForFreshNoEchoCeiling(logicalId, readbackRecord, updateSecrets).then((read) => {
-		this.noteNoEchoExactEchoes(logicalId, currentResource.physicalId, read, readbackRecord.properties, echoCandidates, "add");
+		noteNoEchoExactEchoes(this.noEchoRun, logicalId, currentResource.physicalId, read, readbackRecord.properties, echoCandidates, "add");
 		return read;
 	});
 	const exactEchoCoordinates = new Set((noEchoExactEchoLeavesOf(currentResource) ?? []).map((c) => JSON.stringify(c)));
@@ -44496,7 +44647,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	const lateReplacementDeclined = /* @__PURE__ */ new Set();
 	const differsWhy = (key) => !lateReplacementDeclined.has(key) ? "differs; the provider is not known to report this property exactly, so the difference may be its normalization" : lateCrossPrefixRefused ? "differs; the replacement was refused: see the state-prefix warning above" : `differs; the replacement was not approved (--require-approval=${this.options.requireApproval ?? "never"})`;
 	if (witnessMigrates && !typeChanged && echoCandidates.length > 0 && hasAddressablePhysicalId(currentResource)) await readOnce();
-	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && recordMatchesDesired) {
+	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && recreateDirectionFor(this.options, stackName, logicalId) === void 0 && recordMatchesDesired) {
 		if (provenanceUnchanged.length > 0) stateResources[logicalId] = withRefreshedReadVersions(stateResources[logicalId] ?? currentResource, provenanceUnchanged);
 		if (change.attributeChanges && change.attributeChanges.length > 0) {
 			applyAttributeOnlyUpdate(change.attributeChanges);
@@ -44582,7 +44733,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		};
 		const lowered = [];
 		const movedAt = (path) => movedMasked.has(path) || rewrittenPaths.has(path) || keyOrderFreeJson(desiredForSkipCheckAsWritten[path]) !== keyOrderFreeJson(currentPropsAsWritten[path]);
-		replacedAnyway = this.recreateDirectionFor(stackName, logicalId) !== void 0 || lostWithParent !== void 0 || (change.propertyChanges ?? []).some((other) => other.requiresReplacement && (!parameterCreateOnlyPaths.has(other.path) || movedAt(other.path)));
+		replacedAnyway = recreateDirectionFor(this.options, stackName, logicalId) !== void 0 || lostWithParent !== void 0 || (change.propertyChanges ?? []).some((other) => other.requiresReplacement && (!parameterCreateOnlyPaths.has(other.path) || movedAt(other.path)));
 		for (const pc of change.propertyChanges ?? []) {
 			if (!parameterCreateOnlyPaths.has(pc.path)) {
 				lowered.push(pc);
@@ -44629,7 +44780,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		}
 	}
 	const confirmedPaths = /* @__PURE__ */ new Set([...noEchoHeldPaths, ...parameterSettledPaths]);
-	if (confirmedPaths.size > 0 && !typeChanged && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && recordMatchesDesired && Object.keys(resolvedProps).every((key) => confirmedPaths.has(key) || otherFreshAt(key).length === 0 && !pendingParameterLeaves.has(key))) {
+	if (confirmedPaths.size > 0 && !typeChanged && lostChild === void 0 && recreateDirectionFor(this.options, stackName, logicalId) === void 0 && recordMatchesDesired && Object.keys(resolvedProps).every((key) => confirmedPaths.has(key) || otherFreshAt(key).length === 0 && !pendingParameterLeaves.has(key))) {
 		this.logger.debug(safeMsg`Skipping ${logicalId}: AWS already holds every NoEcho value it carries, and nothing else changed`);
 		const staleHeld = staleCoordinates.filter((coordinate) => typeof coordinate[0] === "string" && parameterHeldKeys.has(coordinate[0]));
 		if (staleHeld.length > 0) {
@@ -44672,7 +44823,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	}
 	const liveLabel = this.liveTaskLabels.get(logicalId);
 	if (needsReplacement && liveLabel !== void 0 && !liveLabel.replacing) {
-		const label = `Replacing ${logicalId} (${resourceType})${this.peekRoutingForLabel(change, currentResource, stackName, logicalId, true, this.recreateDirectionFor(stackName, logicalId)) === "cc-api" ? " [CC API]" : ""}`;
+		const label = `Replacing ${logicalId} (${resourceType})${peekRoutingForLabel(this.providerRegistry, this.options, change, currentResource, stackName, logicalId, true, recreateDirectionFor(this.options, stackName, logicalId)) === "cc-api" ? " [CC API]" : ""}`;
 		this.liveTaskLabels.set(logicalId, {
 			label,
 			replacing: true,
@@ -44680,7 +44831,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		});
 		renderer.updateTaskLabel(logicalId, `${label}${liveLabel.warnSuffix ?? ""}`);
 	} else if (!needsReplacement && liveLabel !== void 0 && liveLabel.replacing) {
-		const label = `Updating ${logicalId} (${resourceType})${this.peekRoutingForLabel(change, currentResource, stackName, logicalId, false, this.recreateDirectionFor(stackName, logicalId)) === "cc-api" ? " [CC API]" : ""}`;
+		const label = `Updating ${logicalId} (${resourceType})${peekRoutingForLabel(this.providerRegistry, this.options, change, currentResource, stackName, logicalId, false, recreateDirectionFor(this.options, stackName, logicalId)) === "cc-api" ? " [CC API]" : ""}`;
 		this.liveTaskLabels.set(logicalId, {
 			label,
 			replacing: false,
@@ -44688,7 +44839,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		});
 		renderer.updateTaskLabel(logicalId, `${label}${liveLabel.warnSuffix ?? ""}`);
 	}
-	const dependencies = this.extractAllDependencies(template, logicalId);
+	const dependencies = extractAllDependencies(template, logicalId);
 	const updateReplacePolicy = template?.Resources?.[logicalId]?.UpdateReplacePolicy;
 	const markRestored = (outcome) => {
 		if (lostChild === void 0) return outcome;
@@ -44798,7 +44949,7 @@ function redactionRewrittenPaths(resolvedProps, desiredForSkipCheck, comparisonC
 	return new Set(Object.keys(masked).filter((key) => keyOrderFreeJson(masked[key]) !== keyOrderFreeJson(desiredForSkipCheck[key])));
 }
 function readsProducerReplacedThisRun(template, logicalId, stateResources) {
-	return (this.extractAllDependencies(template, logicalId) ?? []).some((id) => {
+	return (extractAllDependencies(template, logicalId) ?? []).some((id) => {
 		const loaded = Object.hasOwn(this.healBaseline, id) ? this.healBaseline[id] : void 0;
 		if (loaded === void 0) return false;
 		const now = Object.hasOwn(stateResources, id) ? stateResources[id] : void 0;
@@ -44806,6 +44957,56 @@ function readsProducerReplacedThisRun(template, logicalId, stateResources) {
 	});
 }
 
+//#endregion
+//#region src/deployment/deploy-engine/name-collision.ts
+function replacementNameOrigin(logicalId, physicalId) {
+	if (looksLikeCdkdGeneratedName(physicalId, logicalId, getCurrentStackName())) return {
+		descriptor: `The physical name (${physicalId}) was GENERATED by cdkd from the construct's logical id rather than declared in your template, and that derivation has no random component — so the new resource asks for exactly the name the existing one still holds`,
+		remedy: "Either give the resource an explicit physical name in your CDK code, or rename the CONSTRUCT (its id feeds the generated name — note that this replaces the resource rather than renaming it in place)"
+	};
+	return {
+		descriptor: `The resource has a user-supplied physical name (${physicalId})`,
+		remedy: "Either rename the resource in your CDK code (a fresh name lets the safe create-first order proceed)"
+	};
+}
+function orphanedNameCollisionAdvice(providerRegistry, changeType, logicalId, error) {
+	if (changeType !== "CREATE") return void 0;
+	if (!(error instanceof ProvisioningError)) return void 0;
+	const physicalId = error.physicalId;
+	if (!physicalId) return void 0;
+	const replayed = isReplayedNameCollisionFrom(error, logicalId, (link) => isAuxiliaryMarkOf(link, RETRY_AUXILIARY_OWNER));
+	if (!replayed && !isNameCollisionErrorFrom(error, logicalId)) return void 0;
+	const stackName = getCurrentStackName();
+	if (!looksLikeCdkdGeneratedName(physicalId, logicalId, stackName)) return void 0;
+	if (!stackName) return void 0;
+	const safeId = displaySafe(physicalId, { asciiOnly: true });
+	const safeStack = displaySafe(stackName, { asciiOnly: true });
+	const safeLogicalId = displaySafe(logicalId, { asciiOnly: true });
+	const idShown = isInertUnquoted(safeId);
+	const shownId = idShown ? safeId : "a name that cannot be shown safely here";
+	const shownLogicalId = isInertUnquoted(safeLogicalId) ? safeLogicalId : "A resource whose logical id cannot be shown safely here";
+	const diagnosis = replayed ? `${shownLogicalId}: the name AWS reports as taken (${shownId}) is most likely held by a resource THIS create made. An earlier attempt of it ended without a clear verdict (a server error, a dropped connection or a timeout, or a failure after the create call itself may have succeeded), and the retry then found the name taken. A dropped connection can also happen before the request reached AWS, so the holder may be another resource: confirm it is yours before deleting or importing it. cdkd records a resource only once its create succeeds, so this one is in no state file: no rollback or cdkd destroy will remove it, and re-running collides with it again.` : `${shownLogicalId}: the name AWS reports as taken (${shownId}) is one cdkd DERIVED from the logical id, and that derivation has no random component — so this is most likely a resource an earlier cdkd run left behind. A rollback leaves a resource carrying DeletionPolicy: Retain in AWS and drops it from state, as CloudFormation does; what differs is the name. CloudFormation would generate a fresh one for an unnamed resource and redeploy clean, whereas cdkd asks again for the name the orphan still holds — so re-running does not clear this.`;
+	const deleteArm = `If it is not a resource you want to keep, delete ${idShown ? safeId : "it"} in AWS — after confirming it holds nothing you need${replayed ? "" : ", since Retain is what kept it"} — and re-deploy.`;
+	let canImport;
+	try {
+		canImport = typeof providerRegistry.getProvider(error.resourceType).import === "function";
+	} catch {
+		canImport = false;
+	}
+	const commandNamesTheRightResource = safeId === physicalId && safeStack === stackName && safeLogicalId === logicalId;
+	const importableTarget = !stackName.includes("~");
+	if (!canImport || !commandNamesTheRightResource || !importableTarget) return `${diagnosis} ${!canImport ? `cdkd cannot adopt ${displaySafe(error.resourceType, { asciiOnly: true })} back into state (its provider implements no import)` : !importableTarget ? `this is a nested-stack child, whose stack name cdkd import cannot resolve` : `cdkd cannot render an import command that provably names this resource`}, so the way forward is to delete it. ${deleteArm}`;
+	const adopt = pasteableCommand("cdkd import", [{
+		value: stackName,
+		hole: "stack"
+	}, {
+		flag: "--resource",
+		value: `${logicalId}=${physicalId}`,
+		hole: "logicalId=physicalId"
+	}]);
+	return `${diagnosis} To recover, adopt it back into state instead of re-creating it, with the command below (a selective import merges into existing state and needs no --force while the resource is absent from it). CONFIRM IT IS YOURS FIRST — a name cdkd derives is predictable, so for a globally-namespaced type it can belong to another account, and the same stack deployed in another region derives the same name. ${deleteArm}${adopt.withheld.length === 0 ? "" : " The command below prints a quoted hole in place of a value cdkd will not name on a command line; replace it whole, quotes included, with your stack name or '<logicalId>=<name>', shell-quoted."}\nAdopt with: ${adopt.command}`;
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/update-replace.ts
 async function updateByReplacement({ change, counts, currentProps, currentResource, dependencies, logicalId, oldResourceType, progress, propertyDrivenReplacement, recreateFlagged, recreateViaCcApi, recreateViaSdkProvider, renderer, resolvedProps, resourceType, stackName, stateResources, template, typeChanged, updateReplacePolicy, updateSecrets, lostWithParent }) {
@@ -44813,10 +45014,10 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 		record: currentResource,
 		templateResource: template?.Resources?.[logicalId],
 		resolvedProperties: resolvedProps,
-		noEchoParameters: this.noEchoPositionSources(stateResources, template)?.parameters ?? /* @__PURE__ */ new Set(),
-		conditions: this.noEchoConditions,
+		noEchoParameters: noEchoPositionSources(this.noEchoRun, stateResources, template)?.parameters ?? /* @__PURE__ */ new Set(),
+		conditions: this.noEchoRun.noEchoConditions,
 		secrets: updateSecrets,
-		inputSources: template && this.maskedInputSources(template, stateResources, this.noEchoConditions, stackName)
+		inputSources: template && this.maskedInputSources(template, stateResources, this.noEchoRun.noEchoConditions, stackName)
 	});
 	if (propertyDrivenReplacement && !recreateFlagged && updateReplacePolicy !== "Retain") {
 		const statefulReason = isStatefulRecreateTargetForReplace(oldResourceType, currentProps, currentResource.observedProperties);
@@ -44846,7 +45047,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 		...recreateViaCcApi && { forceCcApi: true }
 	});
 	const replaceProvider = replaceDecision.provider;
-	const replaceProps = replaceDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
+	const replaceProps = replaceDecision.provisionedBy === "cc-api" ? preparePropertiesForCcApi(this.providerRegistry, resourceType, resolvedProps, logicalId) : resolvedProps;
 	const oldDeleteRoute = this.providerRegistry.getProviderFor({
 		resourceType: oldResourceType,
 		provisionedBy: currentResource.provisionedBy
@@ -44958,7 +45159,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 		} catch (createError) {
 			const createMsg = displayAwsMessage(maskSecretsInText(createError instanceof Error ? createError.message : String(createError), updateSecrets));
 			if (!isNameCollisionErrorFrom(createError, logicalId)) throw createError;
-			const nameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
+			const nameOrigin = replacementNameOrigin(logicalId, currentResource.physicalId);
 			const nameHeldElsewhere = replacementRequestsDifferentName({
 				oldResourceType,
 				newResourceType: resourceType,
@@ -44992,7 +45193,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy, oldDeleteRoute.provisionedBy, noEchoDeleteValues);
 		}
 		if (equalIdIsSameResource && !deletedOldFirst && createResult.physicalId === currentResource.physicalId) {
-			const idempotentNameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
+			const idempotentNameOrigin = replacementNameOrigin(logicalId, currentResource.physicalId);
 			if (updateReplacePolicy === "Retain") throw new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement, but its Create API is ` + `name-idempotent: the create-first attempt returned the existing resource ` + safeMsg`(${currentResource.physicalId}) instead of creating a new one, and ` + `UpdateReplacePolicy: Retain pins that resource in place. ` + safeMsg`${idempotentNameOrigin.descriptor}. ${idempotentNameOrigin.remedy} — with ` + "Retain, the old resource keeps the name, so a same-name replacement can never proceed.", "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
 			if (this.options.replace !== true) throw new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement, but its Create API is ` + `name-idempotent: the create-first attempt returned the EXISTING resource ` + safeMsg`(${currentResource.physicalId}) instead of creating a new one, so deleting ` + `the "old" resource would silently destroy the resource the deploy just ` + safeMsg`reported as created. ${idempotentNameOrigin.descriptor}; ` + safeMsg`${idempotentNameOrigin.remedy}, or re-run with ` + "`cdkd deploy --replace` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated). Note: this branch is also reached when the old resource was deleted out-of-band and the physical id is name-derived — there the create was a genuine fresh create; `--replace` converges that case too.", "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
 			this.logger.info(`  Create-first returned the existing resource (name-idempotent Create API) ` + safeMsg`and --replace is set — deleting old ${logicalId} ` + safeMsg`(${currentResource.physicalId}) first...`);
@@ -45020,20 +45221,21 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 	}
 	this.registerNoEchoAttributes(logicalId, createResult, updateSecrets, resolvedProps);
 	if (equalIdIsSameResource && createResult.physicalId === currentResource.physicalId) this.recreatedUnderSameId.add(logicalId);
-	const recordedReplacementProperties = this.propertiesToRecord(resolvedProps, createResult, resourceType, replaceDecision.provisionedBy);
+	const recordedReplacementProperties = propertiesToRecord(resolvedProps, createResult, resourceType, replaceDecision.provisionedBy);
 	stateResources[logicalId] = {
 		physicalId: createResult.physicalId,
 		resourceType,
 		properties: recordedReplacementProperties,
 		...acceptedCreateOnlyDropsField(recordedReplacementProperties, resourceType, replaceDecision.provisionedBy, "new-resource"),
 		...createResult.attributes && { attributes: createResult.attributes },
+		...secretNamedAttributesField(createResult),
 		...dependencies && dependencies.length > 0 && { dependencies },
-		...this.extractTemplateAttributes(template, logicalId),
+		...extractTemplateAttributes(template, logicalId),
 		provisionedBy: replaceDecision.provisionedBy
 	};
 	this.recordInlinePolicyWrite(logicalId, "create");
-	await this.establishNoEchoEchoFidelity(logicalId, stateResources[logicalId], resolvedProps, stateResources, updateSecrets);
-	this.kickOffObservedCapture(replaceProvider, logicalId, createResult.physicalId, resourceType, resolvedProps, { afterOwnWrite: true }, updateSecrets);
+	await establishNoEchoEchoFidelity(this.noEchoRun, this.noEchoDeps(), logicalId, stateResources[logicalId], resolvedProps, stateResources, updateSecrets);
+	this.observedCapture.kickOffObservedCapture(replaceProvider, logicalId, createResult.physicalId, resourceType, resolvedProps, { afterOwnWrite: true }, updateSecrets);
 	if (counts) counts.updated++;
 	if (progress) progress.current++;
 	const replacePrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
@@ -45072,7 +45274,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 		properties: resolvedProps,
 		provisionedBy: currentResource.provisionedBy,
 		previousProperties: currentResource.properties,
-		...this.isPinnedToCcApi(stackName, logicalId) && { forceCcApi: true }
+		...isPinnedToCcApi(this.options, stackName, logicalId) && { forceCcApi: true }
 	});
 	if (updateDecision.sdkMigration === true) {
 		const exemptMode = STICKY_CC_MIGRATION_EXEMPT.get(resourceType)?.mode;
@@ -45090,7 +45292,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 		this.logger.info(message);
 	}
 	const updateProvider = updateDecision.provider;
-	const updateProps = updateDecision.provisionedBy === "cc-api" ? withoutGeneratedFallbackName(resourceType, resolvedProps, this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId)) : resolvedProps;
+	const updateProps = updateDecision.provisionedBy === "cc-api" ? withoutGeneratedFallbackName(resourceType, resolvedProps, preparePropertiesForCcApi(this.providerRegistry, resourceType, resolvedProps, logicalId)) : resolvedProps;
 	const { previous: previousWithSecretsDropped, dropped: droppedPrincipalKinds } = withUnchangedSecretPrincipalLists(resourceType, currentResource.physicalId, noEchoHeldPaths.size === 0 ? currentPropsAsWritten : {
 		...currentPropsAsWritten,
 		...Object.fromEntries([...noEchoHeldPaths].filter((path) => Object.prototype.hasOwnProperty.call(updateProps, path)).map((path) => [path, updateProps[path]]))
@@ -45142,7 +45344,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 				previousProperties: currentResource.properties
 			});
 			const replProvider = replDecision.provider;
-			const replProps = replDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
+			const replProps = replDecision.provisionedBy === "cc-api" ? preparePropertiesForCcApi(this.providerRegistry, resourceType, resolvedProps, logicalId) : resolvedProps;
 			const fallbackNameChange = await this.checkedReplacementNameChange({
 				logicalId,
 				resourceType,
@@ -45160,10 +45362,10 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 				record: currentResource,
 				templateResource: template?.Resources?.[logicalId],
 				resolvedProperties: resolvedProps,
-				noEchoParameters: this.noEchoPositionSources(stateResources, template)?.parameters ?? /* @__PURE__ */ new Set(),
-				conditions: this.noEchoConditions,
+				noEchoParameters: noEchoPositionSources(this.noEchoRun, stateResources, template)?.parameters ?? /* @__PURE__ */ new Set(),
+				conditions: this.noEchoRun.noEchoConditions,
 				secrets: updateSecrets,
-				inputSources: template && this.maskedInputSources(template, stateResources, this.noEchoConditions, stackName)
+				inputSources: template && this.maskedInputSources(template, stateResources, this.noEchoRun.noEchoConditions, stackName)
 			});
 			this.logger.info(retainOldOnReplace ? safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing ` + `(CREATE only — UpdateReplacePolicy: Retain keeps the old resource)` : createFirst ? safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing (CREATE → DELETE — the new name differs from the old resource's)` : safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE → CREATE)`);
 			if (retainOldOnReplace) await noteRetainedResource(resourceType, logicalId);
@@ -45238,7 +45440,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 					physicalId: currentResource.physicalId
 				});
 				if (nameHeldElsewhere !== void 0) throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement because the ` + `provisioning layer cannot update it in place, but the create collided. ` + safeMsg`${renderNameHeldElsewhere(nameHeldElsewhere)} — so removing ` + "UpdateReplacePolicy: Retain would delete this resource and still collide. Choose a name no other resource holds, or delete the resource holding it if it is yours.", "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
-				const nameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
+				const nameOrigin = replacementNameOrigin(logicalId, currentResource.physicalId);
 				throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement because the ` + "provisioning layer cannot update it in place — but its physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. " + safeMsg`${nameOrigin.descriptor}. ${nameOrigin.remedy} — with Retain, the old ` + "resource keeps the name, so a same-name replacement can never proceed. Removing UpdateReplacePolicy: Retain lets cdkd delete the old resource first, which destroys it and any data it holds.", "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
 			}
 			if (!retainOldOnReplace && !createFirst && createResult.physicalId === currentResource.physicalId && !equalIdNamesDifferentResources({
@@ -45254,7 +45456,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 					oldProperties: currentResource.properties,
 					newProperties: resolvedProps
 				})) {
-					const idempotentNameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
+					const idempotentNameOrigin = replacementNameOrigin(logicalId, currentResource.physicalId);
 					throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement, but its Create ` + `API is name-idempotent: the create returned the existing resource ` + safeMsg`(${currentResource.physicalId}) instead of creating a new one, and ` + `UpdateReplacePolicy: Retain pins that resource in place, so the new ` + safeMsg`properties were not applied. ${idempotentNameOrigin.descriptor}. ` + safeMsg`${idempotentNameOrigin.remedy} — with Retain, the old resource keeps ` + `the name, so a same-name replacement can never proceed.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE"));
 				}
 				this.retainedOldOnReplacement.add(logicalId);
@@ -45267,6 +45469,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 				...createResult.attributes && { attributes: createResult.attributes },
 				...createResult.noEchoAttributes === true && { noEchoAttributes: true },
 				...createResult.noEchoAttributeNames && { noEchoAttributeNames: createResult.noEchoAttributeNames },
+				...createResult.secretNamedAttributeNames && { secretNamedAttributeNames: createResult.secretNamedAttributeNames },
 				...retainedSurvivorReason !== void 0 ? {
 					outcome: "partial",
 					reason: retainedSurvivorReason
@@ -45302,18 +45505,19 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 		...result.noEchoAttributes === true && { noEchoAttributes: true },
 		...result.noEchoAttributeNames && { noEchoAttributeNames: result.noEchoAttributeNames }
 	}, updateSecrets, resolvedProps);
-	const recordedProperties = this.propertiesToRecord(resolvedProps, result, resourceType, resultProvisionedBy);
-	if (result.wasReplaced) this.noEchoExactEchoes.delete(logicalId);
+	const recordedProperties = propertiesToRecord(resolvedProps, result, resourceType, resultProvisionedBy);
+	if (result.wasReplaced) this.noEchoRun.noEchoExactEchoes.delete(logicalId);
 	stateResources[logicalId] = {
 		physicalId: result.physicalId,
 		resourceType,
 		properties: recordedProperties,
 		...acceptedCreateOnlyDropsField(recordedProperties, resourceType, resultProvisionedBy, dischargedByReplacement ? "new-resource" : "in-place", currentResource),
 		...carriedAttributes && { attributes: carriedAttributes },
+		...secretNamedAttributesField(result, result.attributes === void 0 && !result.wasReplaced ? currentResource : void 0),
 		...!result.wasReplaced && currentResource.noEchoAttributeNames !== void 0 && { noEchoAttributeNames: currentResource.noEchoAttributeNames },
 		...!result.wasReplaced && currentResource.noEchoExactEchoLeaves !== void 0 && { noEchoExactEchoLeaves: currentResource.noEchoExactEchoLeaves },
 		...dependencies && dependencies.length > 0 && { dependencies },
-		...this.extractTemplateAttributes(template, logicalId),
+		...extractTemplateAttributes(template, logicalId),
 		provisionedBy: resultProvisionedBy,
 		...keepsParameterRefusal && {
 			observedBaselineRefused: true,
@@ -45322,8 +45526,12 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 	};
 	if (updatePartialReason(result) === void 0) this.recordInlinePolicyWrite(logicalId, "update");
 	if (keepsParameterRefusal) this.logger.debug(safeMsg`observedProperties capture SKIPPED for updated ${logicalId} (${resourceType}): 'cdkd import' refused its baseline because a template parameter was not provably deployed at its 'Default', and this deploy bound the same 'Default' — an in-place update cannot show that AWS no longer holds the deployed value. The refusal stands until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter.`);
-	const updateCaptureSiblings = keepsParameterRefusal ? void 0 : await this.buildObservedCaptureSiblings(resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
-	if (!keepsParameterRefusal) this.kickOffObservedCapture(captureProvider, logicalId, result.physicalId, resourceType, resolvedProps, {
+	const updateCaptureSiblings = keepsParameterRefusal ? void 0 : await buildObservedCaptureSiblings({
+		options: this.options,
+		buildResolverContext: (...args) => this.buildResolverContext(...args),
+		resolver: this.resolver
+	}, resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
+	if (!keepsParameterRefusal) this.observedCapture.kickOffObservedCapture(captureProvider, logicalId, result.physicalId, resourceType, resolvedProps, {
 		...updateCaptureSiblings,
 		afterOwnWrite: true
 	}, updateSecrets);
@@ -45583,11 +45791,11 @@ const NESTED_STACK_ROW_TYPE = "AWS::CloudFormation::Stack";
 async function provisionResource(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
 	const resourceType = change.resourceType;
 	const renderer = getLiveRenderer();
-	const labelRecreateDirection = this.recreateDirectionFor(stackName, logicalId);
+	const labelRecreateDirection = recreateDirectionFor(this.options, stackName, logicalId);
 	const labelRecordedType = stateResources[logicalId]?.resourceType;
 	const needsReplacement = change.changeType === "UPDATE" && ((change.propertyChanges?.some((pc) => pc.requiresReplacement && !isReplacementCeiling(pc)) ?? false) || labelRecordedType !== void 0 && labelRecordedType !== resourceType) || labelRecreateDirection !== void 0;
 	const verb = change.changeType === "CREATE" ? "Creating" : change.changeType === "DELETE" ? "Deleting" : needsReplacement ? "Replacing" : "Updating";
-	const labelRouting = this.peekRoutingForLabel(change, stateResources[logicalId], stackName, logicalId, needsReplacement, labelRecreateDirection);
+	const labelRouting = peekRoutingForLabel(this.providerRegistry, this.options, change, stateResources[logicalId], stackName, logicalId, needsReplacement, labelRecreateDirection);
 	const baseLabel = `${verb} ${logicalId} (${resourceType})${labelRouting === "cc-api" ? " [CC API]" : ""}`;
 	renderer.addTask(logicalId, baseLabel);
 	this.liveTaskLabels.set(logicalId, {
@@ -45719,7 +45927,7 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 		const shownMessage = this.maskForResource(logicalId, message);
 		const shownId = safeMsg`${logicalId}`;
 		this.logger.error(this.maskForResource(logicalId, `Failed to ${change.changeType.toLowerCase()} ${shownId}: ${shownMessage}`));
-		const orphanAdvice = this.orphanedNameCollisionAdvice(change.changeType, logicalId, error);
+		const orphanAdvice = orphanedNameCollisionAdvice(this.providerRegistry, change.changeType, logicalId, error);
 		if (orphanAdvice) this.logger.error(this.maskForResource(logicalId, orphanAdvice));
 		this.recordEvent({
 			eventType: "RESOURCE_FAILED",
@@ -45863,6 +46071,131 @@ var DagExecutor = class {
 	}
 };
 
+//#endregion
+//#region src/analyzer/implicit-delete-deps.ts
+const IMPLICIT_DELETE_DEPENDENCIES = {
+	"AWS::EC2::InternetGateway": ["AWS::EC2::VPCGatewayAttachment", "AWS::EC2::NatGateway"],
+	"AWS::EC2::VPCGatewayAttachment": ["AWS::EC2::NatGateway"],
+	"AWS::Events::EventBus": ["AWS::Events::Rule"],
+	"AWS::Athena::WorkGroup": ["AWS::Athena::NamedQuery"],
+	"AWS::CloudFront::ResponseHeadersPolicy": ["AWS::CloudFront::Distribution"],
+	"AWS::CloudFront::CachePolicy": ["AWS::CloudFront::Distribution"],
+	"AWS::CloudFront::OriginAccessControl": ["AWS::CloudFront::Distribution"],
+	"AWS::EC2::VPC": [
+		"AWS::EC2::Subnet",
+		"AWS::EC2::SecurityGroup",
+		"AWS::EC2::InternetGateway",
+		"AWS::EC2::EgressOnlyInternetGateway",
+		"AWS::EC2::VPCGatewayAttachment",
+		"AWS::EC2::RouteTable"
+	],
+	"AWS::EC2::Subnet": ["AWS::EC2::SubnetRouteTableAssociation", "AWS::Lambda::Function"],
+	"AWS::EC2::RouteTable": ["AWS::EC2::Route", "AWS::EC2::SubnetRouteTableAssociation"],
+	"AWS::EC2::SecurityGroup": [
+		"AWS::EC2::SecurityGroupIngress",
+		"AWS::EC2::SecurityGroupEgress",
+		"AWS::Lambda::Function"
+	]
+};
+const ALARM_RULE_FUNCTION_REGEX = /\b(?:ALARM|OK|INSUFFICIENT_DATA)\s*\(\s*([^)]*?)\s*\)/gi;
+function extractReferencedAlarmNames(alarmRule) {
+	const names = /* @__PURE__ */ new Set();
+	for (const match of alarmRule.matchAll(ALARM_RULE_FUNCTION_REGEX)) {
+		let arg = (match[1] ?? "").trim();
+		if (arg.length === 0) continue;
+		if (arg.startsWith("\"") && arg.endsWith("\"") || arg.startsWith("'") && arg.endsWith("'")) arg = arg.slice(1, -1);
+		if (arg.length === 0) continue;
+		const arnAlarmMatch = /:alarm:(.+)$/.exec(arg);
+		if (arnAlarmMatch?.[1]) names.add(arnAlarmMatch[1]);
+		else names.add(arg);
+	}
+	return [...names];
+}
+function computeImplicitDeleteEdges(resources) {
+	const edges = [];
+	const alarmTypes = /* @__PURE__ */ new Set(["AWS::CloudWatch::Alarm", "AWS::CloudWatch::CompositeAlarm"]);
+	const nameToLogicalId = /* @__PURE__ */ new Map();
+	for (const [logicalId, resource] of Object.entries(resources)) {
+		if (!alarmTypes.has(resource.resourceType)) continue;
+		const alarmName = typeof resource.properties?.["AlarmName"] === "string" ? resource.properties["AlarmName"] : resource.physicalId;
+		if (alarmName) nameToLogicalId.set(alarmName, logicalId);
+	}
+	for (const [logicalId, resource] of Object.entries(resources)) {
+		if (resource.resourceType !== "AWS::CloudWatch::CompositeAlarm") continue;
+		const alarmRule = resource.properties?.["AlarmRule"];
+		if (typeof alarmRule !== "string") continue;
+		for (const referencedName of extractReferencedAlarmNames(alarmRule)) {
+			const referencedLogicalId = nameToLogicalId.get(referencedName);
+			if (!referencedLogicalId || referencedLogicalId === logicalId) continue;
+			edges.push({
+				before: logicalId,
+				after: referencedLogicalId
+			});
+		}
+	}
+	return edges;
+}
+
+//#endregion
+//#region src/deployment/deploy-engine/dependencies.ts
+function hasPending(executor) {
+	for (const node of executor.values()) if (node.state === "pending") return true;
+	return false;
+}
+function buildDeletionDependencies(deleteIds, state, logger) {
+	const dependedBy = /* @__PURE__ */ new Map();
+	for (const id of deleteIds) dependedBy.set(id, /* @__PURE__ */ new Set());
+	for (const id of deleteIds) {
+		const resource = state.resources[id];
+		if (!resource?.dependencies) continue;
+		for (const dep of resource.dependencies) {
+			if (!deleteIds.has(dep)) continue;
+			dependedBy.get(dep).add(id);
+		}
+	}
+	addImplicitDeleteDependencies(deleteIds, state, dependedBy, logger);
+	return dependedBy;
+}
+function addImplicitDeleteDependencies(deleteIds, state, dependedBy, logger) {
+	const typeToIds = /* @__PURE__ */ new Map();
+	for (const id of deleteIds) {
+		const resource = state.resources[id];
+		if (!resource) continue;
+		const ids = typeToIds.get(resource.resourceType) ?? [];
+		ids.push(id);
+		typeToIds.set(resource.resourceType, ids);
+	}
+	for (const id of deleteIds) {
+		const resource = state.resources[id];
+		if (!resource) continue;
+		const mustDeleteAfter = IMPLICIT_DELETE_DEPENDENCIES[resource.resourceType];
+		if (!mustDeleteAfter) continue;
+		for (const depType of mustDeleteAfter) {
+			const depIds = typeToIds.get(depType);
+			if (!depIds) continue;
+			for (const depId of depIds) {
+				if (!dependedBy.has(id)) dependedBy.set(id, /* @__PURE__ */ new Set());
+				if (!dependedBy.get(id).has(depId)) {
+					dependedBy.get(id).add(depId);
+					logger.debug(safeMsg`Implicit delete dependency: ${depId} (${depType}) must be deleted before ${id} (${resource.resourceType})`);
+				}
+			}
+		}
+	}
+	const scoped = {};
+	for (const id of deleteIds) {
+		const resource = state.resources[id];
+		if (resource) scoped[id] = resource;
+	}
+	for (const { before, after } of computeImplicitDeleteEdges(scoped)) {
+		if (!dependedBy.has(after)) dependedBy.set(after, /* @__PURE__ */ new Set());
+		if (!dependedBy.get(after).has(before)) {
+			dependedBy.get(after).add(before);
+			logger.debug(safeMsg`Implicit delete dependency: ${before} (${scoped[before]?.resourceType}) must be deleted before ${after} (${scoped[after]?.resourceType})`);
+		}
+	}
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/execute.ts
 const NO_REPLACEMENT_ORPHAN_TYPES = /* @__PURE__ */ new Set([
@@ -46038,13 +46371,13 @@ async function executeDeployment(template, currentState, changes, dag, execution
 						provisionedBy: createdId !== void 0 ? "sdk" : pendingRequest !== void 0 ? "cc-api" : newResources[logicalId]?.provisionedBy ?? previousState?.provisionedBy,
 						...pendingRequest !== void 0 && {
 							pendingCloudControlRequest: pendingRequest,
-							deletionPolicy: journaledOrphanPolicy(this.extractTemplateAttributes(template, logicalId).deletionPolicy)
+							deletionPolicy: journaledOrphanPolicy(extractTemplateAttributes(template, logicalId).deletionPolicy)
 						},
 						...previousState && { previousState },
 						physicalId: createdId ?? statePhysicalId,
 						...createdId !== void 0 && {
 							physicalIdRecoveredFromError: true,
-							deletionPolicy: journaledOrphanPolicy(this.extractTemplateAttributes(template, logicalId).deletionPolicy)
+							deletionPolicy: journaledOrphanPolicy(extractTemplateAttributes(template, logicalId).deletionPolicy)
 						},
 						...change.changeType === "UPDATE" && this.oldDeletedBeforeCreate.has(logicalId) && { oldDeletedBeforeCreate: true },
 						...orphanedBy !== void 0 && { replacementOrphaned: this.oldDeletedBeforeCreate.has(logicalId) ? "delete-first" : "create-first" },
@@ -46060,7 +46393,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 							provisionedBy: "sdk",
 							physicalId: orphanedBy.createdId,
 							physicalIdRecoveredFromError: true,
-							deletionPolicy: journaledOrphanPolicy(this.extractTemplateAttributes(template, logicalId).deletionPolicy),
+							deletionPolicy: journaledOrphanPolicy(extractTemplateAttributes(template, logicalId).deletionPolicy),
 							replacedPhysicalId: orphanedBy.record.physicalId,
 							replacedResourceType: orphanedBy.record.resourceType,
 							...this.oldDeletedBeforeCreate.has(logicalId) && { replacedResourceDeleted: true },
@@ -46107,11 +46440,11 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			} finally {
 				await saveChain;
 			}
-			if (this.interrupted && this.hasPending(createUpdateExecutor)) throw new InterruptedError(this.interruptCause ?? "user");
+			if (this.interrupted && hasPending(createUpdateExecutor)) throw new InterruptedError(this.interruptCause ?? "user");
 		}
 		if (deleteChanges.size > 0) {
 			this.logger.info(safeMsg`${red("Deleting")} ${red(deleteChanges.size)} resource(s)`);
-			const deleteDeps = this.buildDeletionDependencies(deleteChanges, currentState);
+			const deleteDeps = buildDeletionDependencies(deleteChanges, currentState, this.logger);
 			const deleteExecutor = new DagExecutor();
 			for (const id of deleteChanges) deleteExecutor.add({
 				id,
@@ -46153,7 +46486,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			} finally {
 				await saveChain;
 			}
-			if (this.interrupted && this.hasPending(deleteExecutor)) throw new InterruptedError(this.interruptCause ?? "user");
+			if (this.interrupted && hasPending(deleteExecutor)) throw new InterruptedError(this.interruptCause ?? "user");
 		}
 		if (this.interrupted) this.warnUnretriedReplacedDeletes("interrupted");
 		else try {
@@ -46317,7 +46650,7 @@ async function executeDeployment(template, currentState, changes, dag, execution
 	}
 	let outputs;
 	try {
-		outputs = await withSharedDrainBudget(() => this.resolveOutputs(template, newResources, stackName, outputsDigestSource, parameterValues, conditions));
+		outputs = await withSharedDrainBudget(() => resolveOutputs(this.outputsRun, this.outputsDeps(), template, newResources, stackName, outputsDigestSource, parameterValues, conditions));
 		const resolvedOutputsBeforeRedaction = outputs;
 		outputs = this.redactOutputs(outputs);
 		this.rememberRecoverableMaskedOutputs(stackName, resolvedOutputsBeforeRedaction, outputs);
@@ -46334,8 +46667,8 @@ async function executeDeployment(template, currentState, changes, dag, execution
 			resources: newResources,
 			...orphansCarriedFrom(currentState),
 			outputs,
-			exportNames: [...this.resolvedExportNames],
-			...this.skippedOutputs && { skippedOutputs: { ...this.skippedOutputs } },
+			exportNames: [...this.outputsRun.resolvedExportNames],
+			...this.outputsRun.skippedOutputs && { skippedOutputs: { ...this.outputsRun.skippedOutputs } },
 			...this.recordedImports.length > 0 && { imports: [...this.recordedImports] },
 			...this.recordedOutputReads.length > 0 && { outputReads: [...this.recordedOutputReads] },
 			lastModified: Date.now()
@@ -47800,8 +48133,8 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 				}]).command}`);
 			}
 		} catch {}
-		this.stampReasonlessParameterRefusals(currentState.resources, template);
-		this.kickOffAutoRefreshObservedProperties(currentState.resources, currentState);
+		stampReasonlessParameterRefusals(this.logger, currentState.resources, template);
+		this.observedCapture.kickOffAutoRefreshObservedProperties(currentState.resources, currentState);
 		this.logger.debug(safeMsg`Template has ${Object.keys(template.Resources || {}).length} resources`);
 		const outputsDigestSource = structuredClone({
 			...template,
@@ -47810,7 +48143,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		const parameterValues = await this.resolver.resolveParameters(template, this.options.parameters, { ...this.options.inheritedSecrets && hasMaskableValues(this.options.inheritedSecrets) && { inheritedSecrets: this.options.inheritedSecrets } });
 		this.logger.debug(safeMsg`Resolved ${Object.keys(parameterValues).length} parameters: ${Object.keys(parameterValues).join(", ")}`);
 		poisonRenderedSpellingsCollidingIn(template, parameterValues, this.options.inheritedSecrets);
-		this.inheritedNoEchoParameters = /* @__PURE__ */ new Set([...this.freshNoEchoParameters(parameterValues) ?? [], ...this.options.passedNoEchoParameters ?? []]);
+		this.noEchoRun.inheritedNoEchoParameters = /* @__PURE__ */ new Set([...this.freshNoEchoParameters(parameterValues) ?? [], ...this.options.passedNoEchoParameters ?? []]);
 		const backfillNoEchoValues = noEchoParameterValueSeed(template.Parameters, parameterValues, this.options.inheritedSecrets, this.options.parameters);
 		this.fingerprintNoEchoValues = backfillNoEchoValues;
 		this.fingerprintParameters = parameterInputsFor({
@@ -47841,14 +48174,15 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			}));
 		}
 		const effectiveTemplate = this.templateParser.filterResourcesByCondition(template, conditions);
-		this.constructPathTemplate = effectiveTemplate;
-		this.noEchoConditions = conditions;
-		this.seedPersistedNoEchoAttributes(currentState.resources);
+		this.noEchoRun.constructPathTemplate = effectiveTemplate;
+		this.noEchoRun.noEchoConditions = conditions;
+		seedPersistedNoEchoAttributes(this.noEchoRun, currentState.resources);
 		const orphanCountBeforeAdoption = (currentState.orphans ?? []).length;
 		const orphanPlan = await this.adoptRollbackOrphans(currentState, effectiveTemplate);
-		this.preDeploySecretNamedRecords = secretNamedRecordNeedles(currentState.resources, this.fingerprintNoEchoValues);
+		this.captureStoredNoEchoNamingValues(currentState.resources, effectiveTemplate, conditions);
+		this.preDeploySecretNamedRecords = secretNamedRecordNeedles(currentState.resources, this.stateNamingSecrets());
 		if (Object.keys(orphanPlan.adopted).length > 0) {
-			this.stampReasonlessParameterRefusals(currentState.resources, template);
+			stampReasonlessParameterRefusals(this.logger, currentState.resources, template);
 			if (backfillMaskedPropertyFingerprints(currentState.resources, template, backfillNoEchoValues) > 0) maskedFingerprintsBackfilled = true;
 		}
 		const orphansChanged = Object.keys(orphanPlan.adopted).length > 0 || (currentState.orphans ?? []).length !== orphanCountBeforeAdoption;
@@ -47883,7 +48217,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			sources: maskedInputSourcesForDiff,
 			rebaselined: /* @__PURE__ */ new Map()
 		};
-		const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry), this.providerRegistry.getAllowedUnsupportedProperties?.(), freshNoEchoParametersWithDeclared(this.inheritedNoEchoParameters, effectiveTemplate), this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues, currentState.resources), recreateTargetIdsFor(this.options.recreateTargets, stackName), maskedInputs, this.options.refusalRecovery, this.noEchoDiffComparison(currentState.resources, effectiveTemplate, conditions, parameterValues, stackName), {
+		const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry), this.providerRegistry.getAllowedUnsupportedProperties?.(), freshNoEchoParametersWithDeclared(this.noEchoRun.inheritedNoEchoParameters, effectiveTemplate), this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues, currentState.resources), recreateTargetIdsFor(this.options.recreateTargets, stackName), maskedInputs, this.options.refusalRecovery, noEchoDiffComparison(this.noEchoRun, this.noEchoDeps(), currentState.resources, effectiveTemplate, conditions, parameterValues, stackName), {
 			...this.options.inheritedReferenceProvenance && { inherited: this.options.inheritedReferenceProvenance },
 			crossStackOutputs: crossStackOutputProvenanceSource(crossStackReads, this.recordedImports, this.stateBackend)
 		});
@@ -47926,7 +48260,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		}
 		const startProvenanceCapture = () => {
 			if (this.options.dryRun || isKnownTokenFreeState(currentStateData?.state)) return;
-			this.kickOffProvenanceCapture({
+			this.provenanceCapture.kickOffProvenanceCapture({
 				noChange: this.diffCalculator.filterByType(changes, "NO_CHANGE").map((change) => change.logicalId),
 				resources: currentState.resources,
 				template: effectiveTemplate,
@@ -47940,8 +48274,8 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			startProvenanceCapture();
 			let persistedOutputs = currentState.outputs ?? {};
 			if (!this.options.dryRun) {
-				const resolvedOutputs = this.redactOutputs(await withSharedDrainBudget(() => this.resolveOutputs(effectiveTemplate, currentState.resources, stackName, outputsDigestSource, parameterValues, conditions)));
-				const observedRefresh = await this.drainObservedCaptures(currentState.resources) > 0;
+				const resolvedOutputs = this.redactOutputs(await withSharedDrainBudget(() => resolveOutputs(this.outputsRun, this.outputsDeps(), effectiveTemplate, currentState.resources, stackName, outputsDigestSource, parameterValues, conditions)));
+				const observedRefresh = await this.observedCapture.drainObservedCaptures(currentState.resources) > 0;
 				const resolutionFailed = Object.values(resolvedOutputs).some((v) => v === void 0);
 				const currentEffectiveExports = new Set(importableOutputKeys(currentState));
 				let merge = resolutionFailed ? mergeNoChangeOutputs({
@@ -47949,26 +48283,26 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 					resolved: resolvedOutputs,
 					declaredOutputs: effectiveTemplate.Outputs,
 					previousExportNames: currentEffectiveExports,
-					resolvedExportNames: this.resolvedExportNames,
-					refusesCarriedAlias: (outputKey, exportName) => this.carriedExportAliasRefusal === void 0 ? "An export alias was not carried: no export-name verdict is available." : this.carriedExportAliasRefusal(outputKey, exportName)
+					resolvedExportNames: this.outputsRun.resolvedExportNames,
+					refusesCarriedAlias: (outputKey, exportName) => this.outputsRun.carriedExportAliasRefusal === void 0 ? "An export alias was not carried: no export-name verdict is available." : this.outputsRun.carriedExportAliasRefusal(outputKey, exportName)
 				}) : void 0;
 				if (merge?.kind === "merged") {
-					for (const key of merge.carriedKeys) Reflect.deleteProperty(this.outputsTemplateSource, key);
+					for (const key of merge.carriedKeys) Reflect.deleteProperty(this.outputsRun.outputsTemplateSource, key);
 					if (merge.carriedKeys.length > 0 && !bagHoldsSecretExpression(persistedOutputs) && bagHoldsSecretExpression(this.redactOutputs(merge.outputs))) merge = {
 						kind: "kept",
 						reason: "mixed-generation"
 					};
 				}
-				if (merge?.kind === "kept") this.outputsSourceUsable = false;
+				if (merge?.kind === "kept") this.outputsRun.outputsSourceUsable = false;
 				if (merge?.kind === "merged") for (const { reason } of merge.refusedAliases) this.logger.warn(reason);
 				const outputsToPersist = merge === void 0 ? resolvedOutputs : merge.kind === "merged" ? merge.outputs : persistedOutputs;
-				const exportNamesToPersist = merge === void 0 ? this.resolvedExportNames : merge.kind === "merged" ? merge.exportNames : void 0;
+				const exportNamesToPersist = merge === void 0 ? this.outputsRun.resolvedExportNames : merge.kind === "merged" ? merge.exportNames : void 0;
 				const outputsChanged = !outputMapsEqual(persistedOutputs, outputsToPersist);
 				const persistExportSet = new Set(exportNamesToPersist ?? []);
 				const exportSetChanged = exportNamesToPersist !== void 0 && (currentEffectiveExports.size !== persistExportSet.size || [...persistExportSet].some((k) => !currentEffectiveExports.has(k)));
 				if (merge?.kind === "kept" && !outputMapsEqual(persistedOutputs, resolvedOutputs)) this.logger.warn(safeMsg`Outputs changed but one or more could not be resolved; keeping the previously persisted outputs. ${keptWholeReasonText(merge.reason)} ` + "A downstream Fn::ImportValue may fail until the next deploy.");
 				else if (merge?.kind === "merged" && merge.carriedKeys.length > 0) this.logger.debug(safeMsg`Kept the previously persisted value of ${merge.carriedKeys.length} output key(s), ` + "carried export aliases included, that could not be resolved (no-change path)");
-				const skippedOutputsChanged = !skippedOutputsEqual(currentState.skippedOutputs, this.skippedOutputs);
+				const skippedOutputsChanged = !skippedOutputsEqual(currentState.skippedOutputs, this.outputsRun.skippedOutputs);
 				const healedAttributesPending = this.attributeHealer.hasUnpersistedHeals(currentState.resources);
 				const conditionVerdictsChanged = !conditionVerdictRecordsEqual(readRecordedConditionVerdicts(currentState), conditionVerdicts);
 				if (outputsChanged || exportSetChanged && currentState.exportNames !== void 0) await requireOutputsOnlyApproval({
@@ -47985,7 +48319,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 						...orphansCarriedFrom(currentState),
 						outputs: outputsChanged ? outputsToPersist : persistedOutputs,
 						...exportNamesToPersist === void 0 ? exportNamesCarriedFrom(currentState) : { exportNames: [...exportNamesToPersist] },
-						...this.skippedOutputs && { skippedOutputs: { ...this.skippedOutputs } },
+						...this.outputsRun.skippedOutputs && { skippedOutputs: { ...this.outputsRun.skippedOutputs } },
 						...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads, this.crossStackReadKeyNormalizer()),
 						...conditionVerdicts && { conditionVerdicts },
 						lastModified: Date.now()
@@ -48018,7 +48352,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 				updatePartial: 0,
 				unchanged: Object.keys(currentState.resources).length,
 				durationMs: Date.now() - startTime,
-				outputs: this.buildDisplayOutputs(template, this.redactOutputs(persistedOutputs)),
+				outputs: buildDisplayOutputs(template, this.redactOutputs(persistedOutputs)),
 				attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
 			};
 		}
@@ -48099,7 +48433,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		try {
 			this.stateBackend.warmConnections(stackName, this.stackRegion, TAIL_WARM_CONNECTIONS);
 		} catch {}
-		await this.drainObservedCaptures(newState.resources);
+		await this.observedCapture.drainObservedCaptures(newState.resources);
 		const [newEtag] = await Promise.all([this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(conditionVerdicts ? {
 			...newState,
 			conditionVerdicts
@@ -48136,7 +48470,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			...(actualCounts.crossPrefixKept ?? 0) > 0 && { crossPrefixKept: actualCounts.crossPrefixKept },
 			unchanged: unchangedCount,
 			durationMs,
-			outputs: this.buildDisplayOutputs(template, this.redactOutputs(newState.outputs ?? {})),
+			outputs: buildDisplayOutputs(template, this.redactOutputs(newState.outputs ?? {})),
 			attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
 		};
 	} catch (error) {
@@ -48148,7 +48482,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			renderer.stop();
 		} catch {}
 		process.removeListener("SIGINT", sigintHandler);
-		this.observedCaptureTasks.clear();
+		this.observedCapture.observedCaptureTasks.clear();
 		try {
 			await flushKeptForReadoption(this);
 			await this.generatedNameGuard?.settle();
@@ -48170,175 +48504,6 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 	}
 }
 
-//#endregion
-//#region src/deployment/label-routing.ts
-function deriveLabelRouting(change, existingState, registry, forceCcApi = false) {
-	try {
-		if (change.changeType === "DELETE") return existingState?.provisionedBy;
-		return registry.getProviderFor({
-			resourceType: change.resourceType,
-			properties: change.desiredProperties ?? {},
-			provisionedBy: existingState?.provisionedBy,
-			previousProperties: existingState?.properties,
-			forceCcApi
-		}).provisionedBy;
-	} catch {
-		return;
-	}
-}
-
-//#endregion
-//#region src/deployment/deploy-engine/routing.ts
-function isPinnedToCcApi(stackName, logicalId) {
-	return this.options.pinCcApi?.stackName === stackName && this.options.pinCcApi.logicalIds.has(logicalId);
-}
-function recreateDirectionFor(stackName, logicalId) {
-	const targets = this.options.recreateTargets?.stackName === stackName ? this.options.recreateTargets : void 0;
-	if (targets === void 0) return void 0;
-	if (targets.viaCcApi.has(logicalId)) return "cc-api";
-	if (targets.viaSdkProvider.has(logicalId)) return "sdk";
-}
-function peekRoutingForLabel(change, existingState, stackName, logicalId, needsReplacement = false, recreateDirection) {
-	if (needsReplacement) {
-		const hintRecord = {
-			...recreateDirection !== void 0 && { provisionedBy: recreateDirection },
-			...existingState?.properties !== void 0 && { properties: existingState.properties }
-		};
-		return deriveLabelRouting(change, hintRecord, this.providerRegistry, recreateDirection === "cc-api");
-	}
-	return deriveLabelRouting(change, existingState, this.providerRegistry, this.isPinnedToCcApi(stackName, logicalId));
-}
-function preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) {
-	const sdkProvider = this.providerRegistry.getRegisteredTypes().includes(resourceType) ? this.providerRegistry.getProvider(resourceType) : void 0;
-	if (sdkProvider?.preparePropertiesForFallback) return sdkProvider.preparePropertiesForFallback(logicalId, resourceType, resolvedProps);
-	return applyDefaultNameForFallback(logicalId, resourceType, resolvedProps);
-}
-
-//#endregion
-//#region src/analyzer/implicit-delete-deps.ts
-const IMPLICIT_DELETE_DEPENDENCIES = {
-	"AWS::EC2::InternetGateway": ["AWS::EC2::VPCGatewayAttachment", "AWS::EC2::NatGateway"],
-	"AWS::EC2::VPCGatewayAttachment": ["AWS::EC2::NatGateway"],
-	"AWS::Events::EventBus": ["AWS::Events::Rule"],
-	"AWS::Athena::WorkGroup": ["AWS::Athena::NamedQuery"],
-	"AWS::CloudFront::ResponseHeadersPolicy": ["AWS::CloudFront::Distribution"],
-	"AWS::CloudFront::CachePolicy": ["AWS::CloudFront::Distribution"],
-	"AWS::CloudFront::OriginAccessControl": ["AWS::CloudFront::Distribution"],
-	"AWS::EC2::VPC": [
-		"AWS::EC2::Subnet",
-		"AWS::EC2::SecurityGroup",
-		"AWS::EC2::InternetGateway",
-		"AWS::EC2::EgressOnlyInternetGateway",
-		"AWS::EC2::VPCGatewayAttachment",
-		"AWS::EC2::RouteTable"
-	],
-	"AWS::EC2::Subnet": ["AWS::EC2::SubnetRouteTableAssociation", "AWS::Lambda::Function"],
-	"AWS::EC2::RouteTable": ["AWS::EC2::Route", "AWS::EC2::SubnetRouteTableAssociation"],
-	"AWS::EC2::SecurityGroup": [
-		"AWS::EC2::SecurityGroupIngress",
-		"AWS::EC2::SecurityGroupEgress",
-		"AWS::Lambda::Function"
-	]
-};
-const ALARM_RULE_FUNCTION_REGEX = /\b(?:ALARM|OK|INSUFFICIENT_DATA)\s*\(\s*([^)]*?)\s*\)/gi;
-function extractReferencedAlarmNames(alarmRule) {
-	const names = /* @__PURE__ */ new Set();
-	for (const match of alarmRule.matchAll(ALARM_RULE_FUNCTION_REGEX)) {
-		let arg = (match[1] ?? "").trim();
-		if (arg.length === 0) continue;
-		if (arg.startsWith("\"") && arg.endsWith("\"") || arg.startsWith("'") && arg.endsWith("'")) arg = arg.slice(1, -1);
-		if (arg.length === 0) continue;
-		const arnAlarmMatch = /:alarm:(.+)$/.exec(arg);
-		if (arnAlarmMatch?.[1]) names.add(arnAlarmMatch[1]);
-		else names.add(arg);
-	}
-	return [...names];
-}
-function computeImplicitDeleteEdges(resources) {
-	const edges = [];
-	const alarmTypes = /* @__PURE__ */ new Set(["AWS::CloudWatch::Alarm", "AWS::CloudWatch::CompositeAlarm"]);
-	const nameToLogicalId = /* @__PURE__ */ new Map();
-	for (const [logicalId, resource] of Object.entries(resources)) {
-		if (!alarmTypes.has(resource.resourceType)) continue;
-		const alarmName = typeof resource.properties?.["AlarmName"] === "string" ? resource.properties["AlarmName"] : resource.physicalId;
-		if (alarmName) nameToLogicalId.set(alarmName, logicalId);
-	}
-	for (const [logicalId, resource] of Object.entries(resources)) {
-		if (resource.resourceType !== "AWS::CloudWatch::CompositeAlarm") continue;
-		const alarmRule = resource.properties?.["AlarmRule"];
-		if (typeof alarmRule !== "string") continue;
-		for (const referencedName of extractReferencedAlarmNames(alarmRule)) {
-			const referencedLogicalId = nameToLogicalId.get(referencedName);
-			if (!referencedLogicalId || referencedLogicalId === logicalId) continue;
-			edges.push({
-				before: logicalId,
-				after: referencedLogicalId
-			});
-		}
-	}
-	return edges;
-}
-
-//#endregion
-//#region src/deployment/deploy-engine/dependencies.ts
-function hasPending(executor) {
-	for (const node of executor.values()) if (node.state === "pending") return true;
-	return false;
-}
-function buildDeletionDependencies(deleteIds, state) {
-	const dependedBy = /* @__PURE__ */ new Map();
-	for (const id of deleteIds) dependedBy.set(id, /* @__PURE__ */ new Set());
-	for (const id of deleteIds) {
-		const resource = state.resources[id];
-		if (!resource?.dependencies) continue;
-		for (const dep of resource.dependencies) {
-			if (!deleteIds.has(dep)) continue;
-			dependedBy.get(dep).add(id);
-		}
-	}
-	this.addImplicitDeleteDependencies(deleteIds, state, dependedBy);
-	return dependedBy;
-}
-function addImplicitDeleteDependencies(deleteIds, state, dependedBy) {
-	const typeToIds = /* @__PURE__ */ new Map();
-	for (const id of deleteIds) {
-		const resource = state.resources[id];
-		if (!resource) continue;
-		const ids = typeToIds.get(resource.resourceType) ?? [];
-		ids.push(id);
-		typeToIds.set(resource.resourceType, ids);
-	}
-	for (const id of deleteIds) {
-		const resource = state.resources[id];
-		if (!resource) continue;
-		const mustDeleteAfter = IMPLICIT_DELETE_DEPENDENCIES[resource.resourceType];
-		if (!mustDeleteAfter) continue;
-		for (const depType of mustDeleteAfter) {
-			const depIds = typeToIds.get(depType);
-			if (!depIds) continue;
-			for (const depId of depIds) {
-				if (!dependedBy.has(id)) dependedBy.set(id, /* @__PURE__ */ new Set());
-				if (!dependedBy.get(id).has(depId)) {
-					dependedBy.get(id).add(depId);
-					this.logger.debug(safeMsg`Implicit delete dependency: ${depId} (${depType}) must be deleted before ${id} (${resource.resourceType})`);
-				}
-			}
-		}
-	}
-	const scoped = {};
-	for (const id of deleteIds) {
-		const resource = state.resources[id];
-		if (resource) scoped[id] = resource;
-	}
-	for (const { before, after } of computeImplicitDeleteEdges(scoped)) {
-		if (!dependedBy.has(after)) dependedBy.set(after, /* @__PURE__ */ new Set());
-		if (!dependedBy.get(after).has(before)) {
-			dependedBy.get(after).add(before);
-			this.logger.debug(safeMsg`Implicit delete dependency: ${before} (${scoped[before]?.resourceType}) must be deleted before ${after} (${scoped[after]?.resourceType})`);
-		}
-	}
-}
-
 //#endregion
 //#region src/deployment/deploy-engine.ts
 const EMPTY_SECRETS = /* @__PURE__ */ new Map();
@@ -48375,10 +48540,9 @@ var DeployEngine = class {
 	resolver;
 	interrupted = false;
 	interruptCause = null;
-	observedCaptureTasks = /* @__PURE__ */ new Map();
 	absentJournalVersionPurge;
 	noEchoCeilingReadbackTimeoutMs = 3e4;
-	recapturedBaselines = /* @__PURE__ */ new WeakMap();
+	observedCapture;
 	stateBackend;
 	lockManager;
 	dagBuilder;
@@ -48390,33 +48554,19 @@ var DeployEngine = class {
 	recordedImports = [];
 	recordedOutputReads = [];
 	perResourceSecrets = /* @__PURE__ */ new Map();
-	noEchoAttributeResources = /* @__PURE__ */ new Map();
-	persistedNoEchoAttributes = /* @__PURE__ */ new Map();
-	noEchoConditions;
-	inheritedNoEchoParameters = /* @__PURE__ */ new Set();
-	noEchoPhysicalIdWarned = /* @__PURE__ */ new Set();
-	noEchoPositionedValues = /* @__PURE__ */ new Map();
-	noEchoExactEchoes = /* @__PURE__ */ new Map();
-	noEchoAttributeReads = /* @__PURE__ */ new Map();
+	noEchoRun = new NoEchoRunState();
 	replacedDeleteSkips = /* @__PURE__ */ new Map();
 	deferredReplacedDeletes = void 0;
 	secretNameNeedles = /* @__PURE__ */ new Map();
 	perResourceTemplateProps = /* @__PURE__ */ new Map();
 	perResourceResolvedType = /* @__PURE__ */ new Map();
-	witnessConfirmedLeaves = /* @__PURE__ */ new Map();
 	fingerprintNoEchoValues = void 0;
 	preDeploySecretNamedRecords = void 0;
+	storedNoEchoNamingValues = /* @__PURE__ */ new Map();
 	fingerprintParameters = void 0;
 	fingerprintChildTemplates = void 0;
 	perResourceInputFingerprints = /* @__PURE__ */ new Map();
-	outputSecrets = /* @__PURE__ */ new Map();
-	outputsPassSecretMaps = [];
-	outputsTemplateSource = Object.create(null);
-	resolvedExportNames = [];
-	carriedExportAliasRefusal;
-	skippedOutputs;
-	constructPathTemplate;
-	outputsSourceUsable = true;
+	outputsRun = new OutputsRunState();
 	attemptedResolvedProps = /* @__PURE__ */ new Map();
 	resumedCreates = /* @__PURE__ */ new Map();
 	generatedNameGuard;
@@ -48428,11 +48578,8 @@ var DeployEngine = class {
 	updatesThatSentNothing = /* @__PURE__ */ new Set();
 	updateWasReplaced = /* @__PURE__ */ new Map();
 	inPlaceCreateOnlyPaths = /* @__PURE__ */ new Map();
-	outputProvenanceSinks = /* @__PURE__ */ new Map();
-	outputsResolvedThisRun = /* @__PURE__ */ new WeakSet();
 	provenanceBaseline = void 0;
-	resolvedOutputsBag = void 0;
-	provenanceCaptureTasks = /* @__PURE__ */ new Map();
+	provenanceCapture;
 	oldDeletedBeforeCreate = /* @__PURE__ */ new Set();
 	get healBaseline() {
 		return this.attributeHealer.baseline;
@@ -48467,6 +48614,19 @@ var DeployEngine = class {
 		this.options.resourceTimeoutMs = options.resourceTimeoutMs ?? 18e5;
 		this.options.captureObservedState = options.captureObservedState ?? true;
 		this.attributeHealer = this.rebaseline({});
+		this.provenanceCapture = this.freshProvenanceCapture();
+		this.observedCapture = this.freshObservedCapture();
+	}
+	freshObservedCapture() {
+		return new ObservedCapture({
+			logger: this.logger,
+			options: this.options,
+			resolver: this.resolver,
+			providerRegistry: this.providerRegistry,
+			printingSecretsFor: (logicalId) => this.printingSecretsFor(logicalId),
+			fingerprintNoEchoValues: () => this.fingerprintNoEchoValues,
+			provenanceCapture: () => this.provenanceCapture
+		});
 	}
 	rebaseline(resources) {
 		this.attributeHealer = new AttributeHealer({
@@ -48474,31 +48634,53 @@ var DeployEngine = class {
 			stackRegion: this.stackRegion,
 			logger: this.logger,
 			baseline: resources,
-			resolvedSecretsOf: (logicalId) => this.perResourceSecrets.get(logicalId)
+			resolvedSecretsOf: (logicalId) => this.perResourceSecrets.get(logicalId),
+			namingSecrets: () => this.stateNamingSecrets()
 		});
 		return this.attributeHealer;
 	}
+	freshProvenanceCapture() {
+		return new ProvenanceCapture({
+			buildResolverContext: (...args) => this.buildResolverContext(...args),
+			resolver: this.resolver,
+			logger: this.logger
+		});
+	}
+	outputsDeps() {
+		return {
+			options: this.options,
+			logger: this.logger,
+			resolver: this.resolver,
+			buildResolverContext: (...args) => this.buildResolverContext(...args),
+			noEchoPositionSources: (...args) => noEchoPositionSources(this.noEchoRun, ...args)
+		};
+	}
+	noEchoDeps() {
+		return {
+			stackRegion: this.stackRegion,
+			logger: this.logger,
+			providerRegistry: this.providerRegistry,
+			perResourceSecrets: () => this.perResourceSecrets,
+			perResourceTemplateProps: () => this.perResourceTemplateProps,
+			perResourceResolvedType: () => this.perResourceResolvedType,
+			outputsRun: () => this.outputsRun,
+			readReaderForFreshNoEchoCeiling: (...args) => this.readReaderForFreshNoEchoCeiling(...args),
+			maskForResource: (...args) => this.maskForResource(...args)
+		};
+	}
 	async deploy(stackName, template) {
 		this.recordedImports = [];
 		this.recordedOutputReads = [];
 		this.perResourceSecrets = /* @__PURE__ */ new Map();
-		this.noEchoAttributeResources = /* @__PURE__ */ new Map();
-		this.persistedNoEchoAttributes = /* @__PURE__ */ new Map();
-		this.noEchoConditions = void 0;
-		this.inheritedNoEchoParameters = /* @__PURE__ */ new Set();
-		this.noEchoPhysicalIdWarned = /* @__PURE__ */ new Set();
-		this.noEchoPositionedValues = /* @__PURE__ */ new Map();
-		this.noEchoExactEchoes = /* @__PURE__ */ new Map();
-		this.noEchoAttributeReads = /* @__PURE__ */ new Map();
+		this.noEchoRun = new NoEchoRunState();
 		this.replacedDeleteSkips = /* @__PURE__ */ new Map();
 		this.deferredReplacedDeletes = void 0;
 		this.secretNameNeedles = /* @__PURE__ */ new Map();
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
-		this.constructPathTemplate = void 0;
 		this.perResourceResolvedType = /* @__PURE__ */ new Map();
-		this.witnessConfirmedLeaves = /* @__PURE__ */ new Map();
 		this.fingerprintNoEchoValues = void 0;
 		this.preDeploySecretNamedRecords = void 0;
+		this.storedNoEchoNamingValues = /* @__PURE__ */ new Map();
 		this.fingerprintParameters = void 0;
 		this.fingerprintChildTemplates = void 0;
 		this.perResourceInputFingerprints = /* @__PURE__ */ new Map();
@@ -48506,11 +48688,7 @@ var DeployEngine = class {
 		this.resumedCreates = /* @__PURE__ */ new Map();
 		this.generatedNameGuard = void 0;
 		this.liveTaskLabels = /* @__PURE__ */ new Map();
-		this.outputSecrets = /* @__PURE__ */ new Map();
-		this.outputsPassSecretMaps = [];
-		this.outputsTemplateSource = Object.create(null);
-		this.outputsSourceUsable = true;
-		this.skippedOutputs = void 0;
+		this.outputsRun = new OutputsRunState();
 		this.retainedOldOnReplacement = /* @__PURE__ */ new Set();
 		this.replacedOldMaySurvive = /* @__PURE__ */ new Map();
 		this.recreatedUnderSameId = /* @__PURE__ */ new Set();
@@ -48518,11 +48696,9 @@ var DeployEngine = class {
 		this.updatesThatSentNothing = /* @__PURE__ */ new Set();
 		this.updateWasReplaced = /* @__PURE__ */ new Map();
 		this.inPlaceCreateOnlyPaths = /* @__PURE__ */ new Map();
-		this.outputProvenanceSinks = /* @__PURE__ */ new Map();
-		this.outputsResolvedThisRun = /* @__PURE__ */ new WeakSet();
 		this.provenanceBaseline = void 0;
-		this.resolvedOutputsBag = void 0;
-		this.provenanceCaptureTasks = /* @__PURE__ */ new Map();
+		this.provenanceCapture = this.freshProvenanceCapture();
+		this.observedCapture = this.freshObservedCapture();
 		this.oldDeletedBeforeCreate = /* @__PURE__ */ new Set();
 		this.rebaseline({});
 		this.runProducerRegionEvidence = void 0;
@@ -48540,15 +48716,15 @@ var DeployEngine = class {
 			const secrets = this.perResourceSecrets.get(logicalId);
 			const templateProps = this.perResourceTemplateProps.get(logicalId);
 			const scrubbed = scrubResourceRecord(this.attributeHealer.withHealedAttributes(logicalId, record), secrets ?? /* @__PURE__ */ new Map(), templateProps);
-			const noEchoScrubbed = this.applyNoEchoPersist(logicalId, record, this.withNoEchoExactEchoes(logicalId, scrubbed), templateProps, state.resources, secrets);
-			resources[logicalId] = withReferenceProvenance(withConstructPath(withMaskedPropertyFingerprints(noEchoScrubbed, record.properties, templateProps, secrets, this.fingerprintNoEchoValues, this.perResourceInputFingerprints.get(logicalId)), constructPathOf(this.constructPathTemplate, logicalId)), this.referenceProvenanceToPersist(logicalId, record, noEchoScrubbed, secrets));
+			const noEchoScrubbed = applyNoEchoPersist(this.noEchoRun, this.noEchoDeps(), logicalId, record, withNoEchoExactEchoes(this.noEchoRun, logicalId, scrubbed), templateProps, state.resources, secrets);
+			resources[logicalId] = withReferenceProvenance(withConstructPath(withMaskedPropertyFingerprints(noEchoScrubbed, record.properties, templateProps, secrets, this.fingerprintNoEchoValues, this.perResourceInputFingerprints.get(logicalId)), constructPathOf(this.noEchoRun.constructPathTemplate, logicalId)), this.referenceProvenanceToPersist(logicalId, record, noEchoScrubbed, secrets));
 		}
 		const orphans = state.orphans?.map((entry) => {
 			const sameResource = this.perResourceResolvedType.get(entry.logicalId) === entry.state.resourceType;
 			const orphanTemplateProps = sameResource ? this.perResourceTemplateProps.get(entry.logicalId) : void 0;
 			return {
 				...entry,
-				state: withMaskedPropertyFingerprints(this.applyNoEchoPersist(entry.logicalId, entry.state, scrubResourceRecord(entry.state, (sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), orphanTemplateProps), orphanTemplateProps, state.resources), entry.state.properties, orphanTemplateProps, sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0, sameResource ? this.fingerprintNoEchoValues : void 0, sameResource ? this.perResourceInputFingerprints.get(entry.logicalId) : void 0)
+				state: withMaskedPropertyFingerprints(applyNoEchoPersist(this.noEchoRun, this.noEchoDeps(), entry.logicalId, entry.state, scrubResourceRecord(entry.state, (sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), orphanTemplateProps), orphanTemplateProps, state.resources), entry.state.properties, orphanTemplateProps, sameResource ? this.perResourceSecrets.get(entry.logicalId) : void 0, sameResource ? this.fingerprintNoEchoValues : void 0, sameResource ? this.perResourceInputFingerprints.get(entry.logicalId) : void 0)
 			};
 		});
 		const outputs = this.redactOutputs(state.outputs);
@@ -48565,9 +48741,9 @@ var DeployEngine = class {
 		};
 	}
 	outputReferenceProvenanceFor(outputs, redacted) {
-		const sinkOf = (outputKey) => this.outputProvenanceSinks.get(outputKey);
+		const sinkOf = (outputKey) => this.outputsRun.outputProvenanceSinks.get(outputKey);
 		const baseline = this.provenanceBaseline;
-		if (!this.outputsResolvedThisRun.has(outputs) && baseline !== void 0 && outputs === baseline.outputs && baseline.outputReferenceProvenance === void 0 && !baseline.tokenFree && this.resolvedOutputsBag !== void 0 && outputMapsEqual(this.redactOutputs(this.resolvedOutputsBag), redacted)) return outputProvenanceForPersist({
+		if (!this.outputsRun.outputsResolvedThisRun.has(outputs) && baseline !== void 0 && outputs === baseline.outputs && baseline.outputReferenceProvenance === void 0 && !baseline.tokenFree && this.outputsRun.resolvedOutputsBag !== void 0 && outputMapsEqual(this.redactOutputs(this.outputsRun.resolvedOutputsBag), redacted)) return outputProvenanceForPersist({
 			outputs: redacted,
 			resolvedThisRun: true,
 			carriedFrom: void 0,
@@ -48575,7 +48751,7 @@ var DeployEngine = class {
 		});
 		return outputProvenanceForPersist({
 			outputs: redacted,
-			resolvedThisRun: this.outputsResolvedThisRun.has(outputs),
+			resolvedThisRun: this.outputsRun.outputsResolvedThisRun.has(outputs),
 			carriedFrom: baseline !== void 0 && outputs === baseline.outputs ? baseline : void 0,
 			sinkOf
 		});
@@ -48693,17 +48869,6 @@ var DeployEngine = class {
 		return maskingRetryLogger(this.logger, secrets);
 	}
 };
-DeployEngine.prototype.hasPending = hasPending;
-DeployEngine.prototype.buildDeletionDependencies = buildDeletionDependencies;
-DeployEngine.prototype.addImplicitDeleteDependencies = addImplicitDeleteDependencies;
-DeployEngine.prototype.auditResolvedAssetReferences = auditResolvedAssetReferences;
-DeployEngine.prototype.extractAllDependencies = extractAllDependencies;
-DeployEngine.prototype.propertiesToRecord = propertiesToRecord;
-DeployEngine.prototype.extractTemplateAttributes = extractTemplateAttributes;
-DeployEngine.prototype.isPinnedToCcApi = isPinnedToCcApi;
-DeployEngine.prototype.recreateDirectionFor = recreateDirectionFor;
-DeployEngine.prototype.peekRoutingForLabel = peekRoutingForLabel;
-DeployEngine.prototype.preparePropertiesForCcApi = preparePropertiesForCcApi;
 DeployEngine.prototype.buildResolverContext = buildResolverContext;
 DeployEngine.prototype.maskedInputSources = maskedInputSources;
 DeployEngine.prototype.doDeployWithPrefetch = doDeployWithPrefetch;
@@ -48740,15 +48905,9 @@ DeployEngine.prototype.secretNameBagFor = secretNameBagFor;
 DeployEngine.prototype.noteSecretNamedRecord = noteSecretNamedRecord;
 DeployEngine.prototype.printingSecretsFor = printingSecretsFor;
 DeployEngine.prototype.namingSecretsFor = namingSecretsFor;
+DeployEngine.prototype.stateNamingSecrets = stateNamingSecrets;
+DeployEngine.prototype.captureStoredNoEchoNamingValues = captureStoredNoEchoNamingValues;
 DeployEngine.prototype.noteSecretNamedReads = noteSecretNamedReads;
-DeployEngine.prototype.kickOffObservedCapture = kickOffObservedCapture;
-DeployEngine.prototype.drainObservedCaptures = drainObservedCaptures;
-DeployEngine.prototype.kickOffProvenanceCapture = kickOffProvenanceCapture;
-DeployEngine.prototype.drainProvenanceCaptures = drainProvenanceCaptures;
-DeployEngine.prototype.buildObservedCaptureSiblings = buildObservedCaptureSiblings;
-DeployEngine.prototype.stampReasonlessParameterRefusals = stampReasonlessParameterRefusals;
-DeployEngine.prototype.kickOffAutoRefreshObservedProperties = kickOffAutoRefreshObservedProperties;
-DeployEngine.prototype.kickOffMaskedBaselineRecapture = kickOffMaskedBaselineRecapture;
 DeployEngine.prototype.adoptRollbackOrphans = adoptRollbackOrphans;
 DeployEngine.prototype.performRollback = performRollback;
 DeployEngine.prototype.settleJournalAfterSuccess = settleJournalAfterSuccess;
@@ -48760,23 +48919,7 @@ DeployEngine.prototype.rollbackExecutorContext = rollbackExecutorContext;
 DeployEngine.prototype.producerRegionEvidence = producerRegionEvidence;
 DeployEngine.prototype.writeRollbackJournalSegment = writeRollbackJournalSegment;
 DeployEngine.prototype.redactOperationsForJournal = redactOperationsForJournal;
-DeployEngine.prototype.noEchoPositionSources = noEchoPositionSources;
-DeployEngine.prototype.noEchoLeavesFor = noEchoLeavesFor;
-DeployEngine.prototype.applyNoEchoPersist = applyNoEchoPersist;
-DeployEngine.prototype.maskOutputsByPosition = maskOutputsByPosition;
-DeployEngine.prototype.warnNoEchoPhysicalId = warnNoEchoPhysicalId;
-DeployEngine.prototype.seedPersistedNoEchoAttributes = seedPersistedNoEchoAttributes;
-DeployEngine.prototype.noEchoAttributeOverridesFor = noEchoAttributeOverridesFor;
-DeployEngine.prototype.noEchoDiffComparison = noEchoDiffComparison;
-DeployEngine.prototype.noteNoEchoExactEchoes = noteNoEchoExactEchoes;
-DeployEngine.prototype.establishNoEchoEchoFidelity = establishNoEchoEchoFidelity;
-DeployEngine.prototype.withNoEchoExactEchoes = withNoEchoExactEchoes;
-DeployEngine.prototype.handleOutputResolutionFailure = handleOutputResolutionFailure;
-DeployEngine.prototype.resolveOutputs = resolveOutputs;
-DeployEngine.prototype.buildDisplayOutputs = buildDisplayOutputs;
-DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
-DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
-
-//#endregion
-export { S3_AUTO_DELETE_OBJECTS_TAG as $, repairMalformedResourcesForReadOnly as $a, escapeRegExp$3 as $c, hasReadableOrphans as $i, unsupportedFinalSnapshotError as $n, liveMatchesUnresolvedTokenFrame as $o, IntrinsicFunctionResolver as $r, applyCrossPrefixScan as $s, isJournaledOrphan as $t, diffSecurity as A, refuseMalformedOrphansForOrphan as Aa, parseBootstrapMarker as Ac, getAccountInfo as Ai, AssemblyReader as Al, collectPublishedOutputNames as An, requireConfigString as Ao, withPrintingSecrets as Ar, recordAttributeIdCopy as As, NESTED_PENDING_PARENT_REASON as At, readProtection as B, refuseMalformedResourcePropertiesForDestroy as Ba, dockerSpawnEnvWithSensitive as Bc, parseWebACLArn as Bi, displayAssemblyPath as Bl, secretNamePrintingBags as Bn, canonicalCoordinates as Bo, deleteLeftInPlace as Br, wholeStringLeavesOf as Bs, collectNestedChildUnaddressed as Bt, withApiLimit as C, previewableOrphanRecords as Ca, rewriteTemplateAssetReferences as Cc, classifyRecordedSecretRegion as Ci, uploadCfnTemplate as Cl, secretSafeKeyDisplay as Cn, configBooleanRefusal as Co, isCustomResource as Cr, isUncertifiedBaselineMaskPosition as Cs, dropFailedCommands as Ct, findServiceTokenRefusals as D, refuseMalformedOrphanRecordsForDestroy as Da, ensureAssetStorage as Dc, coerceParameterTypedValue as Di, PARTITION_TABLE as Dl, isWholeDynamicReferenceValue as Dn, replayWarn as Do, readsNoEchoDeleteValues as Dr, recordNestedStackParameterExpressions as Ds, loadJournaledOrphans as Dt, deferredServiceTokenWarning as E, refuseMalformedOrphanRecords as Ea, assertAssetBucketRegion as Ec, regionLessSecretName as Ei, expectedOwnerParam as El, exportNameSecretExposure as En, readConfigString as Eo, TemplateNoEchoReresolver as Er, inheritNestedStackParameterAssociations as Es, journaledOrphanLines as Et, recordedProtectionEvidence as F, refuseMalformedResourceEntriesForDeploy as Fa, buildDockerImage as Fc, keepsSecretReferenceToken as Fi, hasPlainPrototype$1 as Fl, completedReplayEntries as Fn, canonicalLambdaFunctionName as Fo, slowCcOperationTimeoutMs as Fr, recordMaskOnlyValue as Fs, nestedChildStackName as Ft, deleteBudgetKey as G, refuseMalformedResourcesForDestroy as Ga, isMalformedEnvKey as Gc, JSON_LISTING_HOLE_VALUE as Gi, clearBucketRegionCache as Gl, ATOMIC_FINAL_SNAPSHOT_TYPES as Gn, maskedLeafCoordinatesOf as Go, disableInstanceApiTermination as Gr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Gs, awaitInFlightSibling as Gt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as H, refuseMalformedResourcePropertiesForExport as Ha, formatDockerLoginError as Hc, parameterInputsFor as Hi, resolveAssemblyPath as Hl, stateSecretNameNeedles as Hn, maskAtCoordinates as Ho, withIndeterminateGuard as Hr, STATE_SOURCED_CROSS_GENERATION_RULES as Hs, withNestedStackContext as Ht, recordedProtectionNote as I, refuseMalformedResourceEntriesForDestroy as Ia, resolveDockerContextDirectory as Ic, AWS_NO_VALUE as Ii, nullPrototypeRecord as Il, journaledOrphanPrintingBag as In, lambdaFunctionNameForMask as Io, unchangedBehindSecretReference as Ir, recordMaskOnlyValuesIn as Is, recordDisplacedSkips as It, DELETE_INDEX_WAIT_PROCEED_NOTE as J, repairMalformedOrphanRecordsForReadOnly as Ja, redactedCause as Jc, UNREADABLE_ORPHANS_CONTAINER_ROW as Ji, ccRoutedFinalSnapshotError as Jn, noEchoOutputsComparison as Jo, observeThenDisableInstanceApiTermination as Jr, isLockInfoExpired as Js, withStackRecords as Jt, resolveDynamoDbDeleteBudgetClock as K, refuseMalformedResourcesForExport as Ka, partitionSensitiveEnv as Kc, STATE_REGION_DIVERGED as Ki, resolveBucketRegion as Kl, PRE_DELETE_SNAPSHOT_TYPES as Kn, noEchoCoordinatesOf as Ko, ec2InstanceProtectionSite as Kr, isSingleDynamicReferenceToken as Ks, destroyStackRecordsView as Kt, PROTECTION_PROPERTY_BY_TYPE as L, refuseMalformedResourceEntriesForImport as La, describeDockerCapturedOutput as Lc, cfnRefValueFromPhysicalId as Li, ownValue as Ll, maskEventTextWithBoundBags as Ln, sameLambdaFunctionAddress as Lo, RollbackInlinePolicyWriters as Lr, recordNoEchoAttributeValues as Ls, revertNestedChildFromJournal as Lt, noEchoComparisonForTemplate as M, refuseMalformedOutputsForDestroy as Ma, validateAssetBucketName as Mc, carriesDynamicReference as Mi, processStackMessages as Ml, bindingSkippedOutputs as Mn, templateResourceTypes as Mo, applyCustomResourceResponseExpiration as Mr, splitGetAttStringForm as Ms, displacedPhysicalIdShown as Mt, noEchoExactEchoLeavesOf as N, refuseMalformedResourceAttributesForOrphan as Na, validateContainerRepoName as Nc, carriesFetchableDynamicReference as Ni, defineOwnKey as Nl, DEFAULT_RESOURCE_TIMEOUT_MS as Nn, describeTypeWithThrottleRetry as No, customResourceResponseExpirationWarning as Nr, carriesSecretMask as Ns, dropSettledNestedJournals as Nt, serviceTokenBlockingReason as O, refuseMalformedOrphans as Oa, getBootstrapMarkerKey as Oc, isUnboundTemplateParameter as Oi, canonicalizeRegion as Ol, noEchoParameterValueSeed as On, requireConfigArray as Oo, isCustomResourceType as Or, recoverMaskedOutput as Os, makeForeignHolderScan as Ot, noEchoParameterNamesOf as P, refuseMalformedResourceEntries as Pa, buildDenyExternalAccessPolicy as Pc, isNamelessDynamicReferenceError as Pi, hasOwnKey as Pl, DEFAULT_RESOURCE_WARN_AFTER_MS as Pn, withRetry as Po, CloudControlProvider as Pr, provenPublicValue as Ps, getNestedRevertRun as Pt, ECR_AUTO_DELETE_IMAGES_TAG as Q, repairMalformedResourcePropertiesForReadOnly as Qa, warnFinchArgvExposure as Qc, displayLogicalId as Qi, refusesFinalSnapshot as Qn, valueAtCoordinate as Qo, INTRINSIC_KEYS as Qr, CrossPrefixScanCache as Qs, demoteSupersededOrphans as Qt, isProtectionValueActive as R, refuseMalformedResourceEntriesForImportSave as Ra, describeDockerExecFailure as Rc, isStalePlaceholderArnAttribute as Ri, absoluteAssemblyPathEscape as Rl, orphanRecordsPrintingBag as Rn, DagBuilder as Ro, UNSPECIFIED_SKIP_REASON as Rr, recordNoEchoParameterFreshValue as Rs, revertedNestedRowIds as Rt, lookupEachName as S, malformedStateRefusalMessage as Sa, loadPublishableAssetManifest as Sc, s3BucketWebsiteUrl as Si, findLargeInlineResources as Sl, secretBearingStateKeyWarning as Sn, coerceCfnInteger as So, ccBrokenReason as Sr, dynamicReferenceTokens as Ss, deleteJournaledOrphans as St, recordRetainedForReadoption as T, refuseMalformedNestedChildOutputs as Ta, BOOTSTRAP_MARKER_PREFIX as Tc, producerRegionsFromState as Ti, decodeListingKey as Tl, exportNameNoEchoParameters as Tn, configStringRefusal as To, waitForLambdaFunctionActive as Tr, identityKeyFor as Ts, isHandledOrphan as Tt, beginDeleteWait as U, refuseMalformedResourcePropertiesForOrphan as Ua, getDockerCmd as Uc, passedParameterClassesOf as Ui, injectAwsRegion as Ul, storedSecretNameNeedles as Un, maskReadbackAtCoordinates as Uo, isWaitAbandonedError as Ur, STATE_SOURCED_READBACK_RULES as Us, replayFailedOperations as Ut, DynamoDBGlobalTableProvider as V, refuseMalformedResourcePropertiesForDrift as Va, finchSecretArgvRefusal as Vc, withSharedDrainBudget as Vi, renderAssemblyPathEscape as Vl, secretNamedRecordNeedles as Vn, isMarkedCoordinate as Vo, deleteSkipReason as Vr, STATE_SOURCED_BASELINE_RULES as Vs, getCurrentNestedStackContext as Vt, compensateRemovedDeletionProtection as W, refuseMalformedResourcesForDeploy as Wa, isDockerClientEnvKey as Wc, declaresNoEcho as Wi, injectedAwsRegionValue as Wl, extractDeploymentEventError as Wn, maskWholeValue as Wo, markWaitAbandoned as Wr, TEMPLATE_SOURCED_RULES as Ws, replayRollback as Wt, deleteTableWithIndexBusyRetry as X, repairMalformedOutputsForReadOnly as Xa, runDockerForeground as Xc, accountArgs as Xi, effectiveDeletionPolicy as Xn, readbackPathFor as Xo, reEnableInstanceApiTermination as Xr, rebuildClientForBucketRegion as Xs, replacedDeleteFailureVerdict as Xt, INDEX_SETTLE_POLL_INTERVAL_MS as Y, repairMalformedOrphansForReadOnly as Ya, redactedDockerCause as Yc, UNREADABLE_RESOURCES_MAP_ROW as Yi, createPreDeleteFinalSnapshot as Yn, passedNoEchoParametersOf as Yo, reDisableInstanceApiTermination as Yr, S3StateBackend as Ys, removeProtectionTypeList as Yt, waitForIndexesSettled as Z, repairMalformedResourceEntriesForReadOnly as Za, runDockerStreaming as Zc, deployRefusesOrphanRowsReason as Zi, isFinalSnapshotError as Zn, readsNoEchoSource as Zo, DiffCalculator as Zr, CrossPrefixReadError as Zs, recordAfterRollbackUpdate as Zt, keptWholeReasonText as _, malformedRenderedContainersWarning as _a, isSensitiveAttributeName as _c, recordedReferenceRegions as _i, warnDeprecatedNoPrefixCliFlag as _l, orphanNeedsIdentity as _n, coerceWarmThroughput as _o, tagPlanWarning as _r, redactSecretsForState as _s, planOrphanAdoption as _t, inheritedProvenanceForChildDiff as a, malformedExportNamesWarning as aa, describeRegionValueKind as ac, assertSendableRoleArn as ai, synthesisStatusMessage as al, replacementNeverSwapped as an, findSilentDropProperties as ao, ledgerForStack as ar, printingCorpusOf as as, createReadOnlyAttributeHealerFactory as at, chunks as b, malformedResourcesWarning as ba, buildAssetRedirectMap as bc, s3BucketDualStackDomainName as bi, CFN_TEMPLATE_URL_LIMIT as bl, exportAliasCollisionScrubWarning as bn, toFiniteNumber as bo, CC_BROKEN_REASON as br, withoutPhysicalNameCopies as bs, pendingRequestCount as bt, isAbsoluteAssetPath as c, malformedLocalResourceEntriesWarning as ca, hasReasonlessBaselineRefusal as cc, sendableAssumeRoleCommand as ci, loadCdkJson as cl, findNestedStackTypeChanges as cn, NO_CC_HANDLERS_REASON as co, acquireIdempotencyToken as cr, shareLogOnlyValues as cs, gray as ct, templateIdentity as d, malformedOrphanRecordsWarning as da, importableOutputs as dc, callerEnvCredentials as di, resolveCaptureObservedState as dl, REDACTED_DELETE_ADDRESS_SKIP_REASON as dn, shownType as do, DBPROXY_TAGS_WHAT as dr, errorCauseChain as ds, yellow as dt, hasReadableOutputs as ea, crossPrefixDeniedWarning as ec, poisonRenderedSpellingsCollidingIn as ei, stripControlChars as el, isReplacementOrphan as en, unpreviewableOrphanRecords as eo, maskingRetryLogger as er, carryLogOnlyValues as es, hasCdkAutoDeleteTag as et, conditionFingerprint as f, malformedOrphanRowsKeptWarning as fa, isReadableBag as fc, envCredentialsAreAssumedRole as fi, resolveSkipPrefix as fl, isRedactedRecordedValue as fn, MULTI_REGION_RECREATE_BLOCKED_TYPES as fo, DBPROXY_TAG_OPTIONS as fr, maskSecretsInError as fs, computeParameterTaint as ft, isSecretBearingReferenceString as g, malformedOutputsWarning as ga, AssetPublisher as gc, recordedOutputReferenceRegions as gi, stateBucketExistenceConfirmed as gl, updatePartialReason as gn, WARM_THROUGHPUT_MEMBERS as go, tagMapAsList as gr, snapshotPassProvenance as gs, makeSiblingClaimReader as gt, readRecordedConditionVerdicts as h, malformedOutputsRefusalMessage as ha, shouldRetainResource as hc, outputReferenceProvenanceOf as hi, resolveUseCdkBootstrapAssets as hl, updatePartialMessage as hn, renderStatefulReason as ho, refuseMalformedDesiredTags as hr, recordReferenceProvenanceEntry as hs, resourcesNamingDeclaredParameter as ht, crossStackOutputProvenanceSource as i, malformedDriftResourcePropertiesWarning as ia, acceptedCreateOnlyDropsOf as ic, assertFlagRoleArn as ii, Synthesizer as il, recordUnderIdIsNotOwn as in, findActionableSilentDrops as io, earliestDefined as ir, logOnlyValueCount as is, formatResourceLine as it, noEchoAttributeNamesOf as j, refuseMalformedOutputs as ja, readBootstrapMarkerBody as jc, isImpossibleEmptyStoredAttribute as ji, StageLoadError as jl, isExportAliasCollision as jn, prefetchCreateOnlyPropertyPaths as jo, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as jr, recordPhysicalNameCopy as js, displacedOpClause as jt, withResourceDeadline as k, refuseMalformedOrphansForDestroy as ka, isCrossRegionRedirect as kc, parameterTypeMayLoseSecretIdentity as ki, derivePartitionAndUrlSuffix as kl, collectDeclaredOutputNames as kn, requireConfigObject as ko, getCurrentResourceSecrets as kr, physicalNameCopiesOf as ks, sameJournaledOrphans as kt, listNestedTemplateRows as l, malformedLocalResourcesWarning as la, hasUnverifiableParameterRefusal as lc, AWS_CREDENTIAL_ENV_KEYS as li, resolveApp as ll, getCurrentProducerRegions as ln, hasNoCloudControlHandlers as lo, isRefusedByName as lr, unionOfSecretBags as ls, green as lt, parentSuppliedValues as m, malformedOrphansWarning as ma, orphansCarriedFrom as mc, keepHeldTokenProvenance as mi, resolveStateBucketWithDefaultAndSource as ml, redactedDeleteAddressSkip as mn, isStatefulRecreateTargetSync as mo, readTagList as mr, markSameGenerationBag as ms, reachableDivergentParameters as mt, IMPLICIT_DELETE_DEPENDENCIES as n, isReadableOrphanRecord as na, isNotImplemented as nc, refuseUnreadableCdkCrossAccountRefs as ni, AssetManifestLoader as nl, planRollback as nn, unreadableResourceEntries as no, findDestructiveChanges as nr, hasMaskableValues as ns, getPriorAttempts as nt, childTemplateLoader as o, malformedExportSourceWarning as oa, exportNamesCarriedFrom as oc, explicitRoleArnOrThrow as oi, getDefaultStateBucketName as ol, resolveReplacementOldType as on, unwrittenCreateOnlyReplacement as oo, reserveStackCreateToken as or, recordLogOnlyParameterValue as os, bold as ot, conditionInputsFrom as p, malformedOrphansRefusalMessage as pa, orphansAfterRollback as pc, isSettledInstanceState as pi, resolveStateBucketWithDefault as pl, redactedDeleteAddressFields as pn, isStatefulRecreateTargetForReplace as po, planTagDiff as pr, maskSecretsInText as ps, namesAnyDeclaredParameter as pt, resolveDynamoDbDeleteBudgetMs as q, refuseMalformedState as qa, redactDockerArgvValues as qc, STATE_RESOURCES_MALFORMED as qi, buildFinalSnapshotIdentifier as qn, noEchoLeavesOf as qo, isTerminationProtectionPropagationError as qr, LockManager as qs, getStackRecords as qt, computeImplicitDeleteEdges as r, isReadableResourceEntry as ra, splitImportedOps as rc, applyRoleArnIfSet as ri, getDockerImageBySourceHash as rl, recheckFailedPlan as rn, withheldAccountClause as ro, formatDestructiveChange as rr, literalSplitDelimitersOf as rs, markRefusedBeforeApplying as rt, findNestedTemplateTreeDefect as s, malformedLocalOutputsWarning as sa, hasReadableExportSet as sc, isIamRoleArn as si, getLegacyStateBucketName as sl, seedsDeleteFirstGuard as sn, withoutSilentDropProperties as so, withCreateTokenLedger as sr, recordLogOnlyValue as ss, cyan as st, DeployEngine as t, hasReadableResources as ta, isAccessDenied$1 as tc, producerLookupOver as ti, stripForDisplay as tl, planFailedOps as tn, unreadableOrphanRecords as to, constructPathOf as tr, createUnionSecretMasker as ts, isTruthyCfnBoolean as tt, renderNestedTemplateTreeDefect as u, malformedOrphanRecordsRefusalMessage as ua, importableOutputKeys as uc, applyCallerIdentityCredentials as ui, resolveAutoAssetStorage as ul, inheritProducerRegions as un, findReplacedReadersOfRecreateTargets as uo, markDeleteStarted as ur, createSecretMasker as us, red as ut, mergeNoChangeOutputs as v, malformedResourceEntriesWarning as va, stringifyValue as vc, s3BucketArn as vi, ssmResolvedValueType as vl, WITHHELD_NAME_DISPLAY as vn, isWarmThroughputDecrease as vo, definedAttributes as vr, scrubResourceRecord as vs, DeploymentEventsReader as vt, keptForReadoption as w, refuseDivergentRecordRegionForDestroy as wa, AssetModeResolver as wc, classifyReplaySecretRegion as wi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as wl, carriedExportAliasExposure as wn, configIntegerRefusal as wo, wouldReturnToSdkProvider as wr, pathCrossesDottedKey as ws, dropFailedHint as wt, isAccessDeniedError as x, malformedScrubResourceEntriesRefusalMessage as xa, createAssetRedirectResolver as xc, s3BucketRegionalDomainName as xi, MIGRATE_TMP_PREFIX as xl, secretBearing as xn, coerceCfnBoolean as xo, ProviderRegistry as xr, DYNAMIC_REFERENCE_TOKEN_SCAN as xs, resolvePendingCloudControlRequests as xt, makeCanonicalizePropertiesFn as y, malformedResourcePropertiesWarning as ya, WorkGraph as yc, s3BucketDomainName as yi, CFN_TEMPLATE_BODY_LIMIT as yl, displayTextOrWithheld as yn, toCfnInteger as yo, stringifyIfAssigned as yr, withPhysicalNameCopies as ys, DeploymentEventsStore as yt, perType as z, refuseMalformedResourceEntriesForOrphan as za, describeDockerFailure as zc, refStateLookupFromResource as zi, describeFileReadFailure as zl, secretNamePrintingBag as zn, TemplateParser as zo, deleteIndeterminateGuards as zr, recordProvenPublicExpression as zs, withNestedRevertRun as zt };
-//# sourceMappingURL=deploy-engine-CZaafy9R.js.map
+
+//#endregion
+export { markRefusedBeforeApplying as $, repairMalformedResourceEntriesForReadOnly as $a, runDockerForeground as $c, deployRefusesOrphanRowsReason as $i, isFinalSnapshotError as $n, readsNoEchoSource as $o, DiffCalculator as $r, rebuildClientForBucketRegion as $s, isJournaledOrphan as $t, diffSecurity as A, refuseMalformedOrphans as Aa, ensureAssetStorage as Ac, isUnboundTemplateParameter as Ai, PARTITION_TABLE as Al, collectPublishedOutputNames as An, requireConfigArray as Ao, isCustomResourceType as Ar, recordNestedStackParameterExpressions as As, NESTED_PENDING_PARENT_REASON as At, compensateRemovedDeletionProtection as B, refuseMalformedResourceEntriesForImportSave as Ba, describeDockerCapturedOutput as Bc, isStalePlaceholderArnAttribute as Bi, ownValue as Bl, secretNamePrintingBag as Bn, DagBuilder as Bo, UNSPECIFIED_SKIP_REASON as Br, recordNoEchoAttributeValues as Bs, collectNestedChildUnaddressed as Bt, computeImplicitDeleteEdges as C, malformedScrubResourceEntriesRefusalMessage as Ca, buildAssetRedirectMap as Cc, s3BucketRegionalDomainName as Ci, CFN_TEMPLATE_URL_LIMIT as Cl, secretSafeKeyDisplay as Cn, coerceCfnBoolean as Co, ProviderRegistry as Cr, withoutPhysicalNameCopies as Cs, dropFailedCommands as Ct, findServiceTokenRefusals as D, refuseMalformedNestedChildOutputs as Da, AssetModeResolver as Dc, producerRegionsFromState as Di, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Dl, isWholeDynamicReferenceValue as Dn, configStringRefusal as Do, waitForLambdaFunctionActive as Dr, pathCrossesDottedKey as Ds, loadJournaledOrphans as Dt, deferredServiceTokenWarning as E, refuseDivergentRecordRegionForDestroy as Ea, rewriteTemplateAssetReferences as Ec, classifyReplaySecretRegion as Ei, uploadCfnTemplate as El, exportNameSecretExposure as En, configIntegerRefusal as Eo, wouldReturnToSdkProvider as Er, isUncertifiedBaselineMaskPosition as Es, journaledOrphanLines as Et, perType as F, refuseMalformedResourceAttributesForOrphan as Fa, validateAssetBucketName as Fc, carriesFetchableDynamicReference as Fi, processStackMessages as Fl, completedReplayEntries as Fn, describeTypeWithThrottleRetry as Fo, customResourceResponseExpirationWarning as Fr, splitGetAttStringForm as Fs, nestedChildStackName as Ft, INDEX_SETTLE_POLL_INTERVAL_MS as G, refuseMalformedResourcePropertiesForOrphan as Ga, formatDockerLoginError as Gc, passedParameterClassesOf as Gi, resolveAssemblyPath as Gl, storedSecretNameNeedles as Gn, maskReadbackAtCoordinates as Go, isWaitAbandonedError as Gr, STATE_SOURCED_CROSS_GENERATION_RULES as Gs, awaitInFlightSibling as Gt, resolveDynamoDbDeleteBudgetClock as H, refuseMalformedResourcePropertiesForDestroy as Ha, describeDockerFailure as Hc, parseWebACLArn as Hi, describeFileReadFailure as Hl, secretNamedAttributeNamesOf as Hn, canonicalCoordinates as Ho, deleteLeftInPlace as Hr, recordProvenPublicExpression as Hs, withNestedStackContext as Ht, readProtection as I, refuseMalformedResourceEntries as Ia, validateContainerRepoName as Ic, isNamelessDynamicReferenceError as Ii, defineOwnKey as Il, journaledOrphanPrintingBag as In, withRetry as Io, CloudControlProvider as Ir, carriesSecretMask as Is, recordDisplacedSkips as It, ECR_AUTO_DELETE_IMAGES_TAG as J, refuseMalformedResourcesForExport as Ja, isMalformedEnvKey as Jc, STATE_REGION_DIVERGED as Ji, clearBucketRegionCache as Jl, PRE_DELETE_SNAPSHOT_TYPES as Jn, noEchoCoordinatesOf as Jo, ec2InstanceProtectionSite as Jr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Js, withStackRecords as Jt, deleteTableWithIndexBusyRetry as K, refuseMalformedResourcesForDeploy as Ka, getDockerCmd as Kc, declaresNoEcho as Ki, injectAwsRegion as Kl, extractDeploymentEventError as Kn, maskWholeValue as Ko, markWaitAbandoned as Kr, STATE_SOURCED_READBACK_RULES as Ks, destroyStackRecordsView as Kt, DynamoDBGlobalTableProvider as L, refuseMalformedResourceEntriesForDeploy as La, buildDenyExternalAccessPolicy as Lc, keepsSecretReferenceToken as Li, hasOwnKey as Ll, maskEventTextWithBoundBags as Ln, canonicalLambdaFunctionName as Lo, slowCcOperationTimeoutMs as Lr, provenPublicValue as Ls, revertNestedChildFromJournal as Lt, recordedProtectionNote as M, refuseMalformedOrphansForOrphan as Ma, isCrossRegionRedirect as Mc, getAccountInfo as Mi, derivePartitionAndUrlSuffix as Ml, bindingSkippedOutputs as Mn, requireConfigString as Mo, withPrintingSecrets as Mr, physicalNameCopiesOf as Ms, displacedPhysicalIdShown as Mt, PROTECTION_PROPERTY_BY_TYPE as N, refuseMalformedOutputs as Na, parseBootstrapMarker as Nc, isImpossibleEmptyStoredAttribute as Ni, AssemblyReader as Nl, DEFAULT_RESOURCE_TIMEOUT_MS as Nn, prefetchCreateOnlyPropertyPaths as No, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Nr, recordAttributeIdCopy as Ns, dropSettledNestedJournals as Nt, serviceTokenBlockingReason as O, refuseMalformedOrphanRecords as Oa, BOOTSTRAP_MARKER_PREFIX as Oc, regionLessSecretName as Oi, decodeListingKey as Ol, noEchoParameterValueSeed as On, readConfigString as Oo, TemplateNoEchoReresolver as Or, identityKeyFor as Os, makeForeignHolderScan as Ot, isProtectionValueActive as P, refuseMalformedOutputsForDestroy as Pa, readBootstrapMarkerBody as Pc, carriesDynamicReference as Pi, StageLoadError as Pl, DEFAULT_RESOURCE_WARN_AFTER_MS as Pn, templateResourceTypes as Po, applyCustomResourceResponseExpiration as Pr, recordPhysicalNameCopy as Ps, getNestedRevertRun as Pt, getPriorAttempts as Q, repairMalformedOutputsForReadOnly as Qa, redactedDockerCause as Qc, accountArgs as Qi, effectiveDeletionPolicy as Qn, readbackPathFor as Qo, reEnableInstanceApiTermination as Qr, S3StateBackend as Qs, demoteSupersededOrphans as Qt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as R, refuseMalformedResourceEntriesForDestroy as Ra, buildDockerImage as Rc, AWS_NO_VALUE as Ri, hasPlainPrototype$1 as Rl, namingSecretsWithRecordedNoEcho as Rn, lambdaFunctionNameForMask as Ro, unchangedBehindSecretReference as Rr, recordMaskOnlyValue as Rs, revertedNestedRowIds as Rt, IMPLICIT_DELETE_DEPENDENCIES as S, malformedResourcesWarning as Sa, WorkGraph as Sc, s3BucketDualStackDomainName as Si, CFN_TEMPLATE_BODY_LIMIT as Sl, secretBearingStateKeyWarning as Sn, toFiniteNumber as So, CC_BROKEN_REASON as Sr, withPhysicalNameCopies as Ss, deleteJournaledOrphans as St, recordRetainedForReadoption as T, previewableOrphanRecords as Ta, loadPublishableAssetManifest as Tc, classifyRecordedSecretRegion as Ti, findLargeInlineResources as Tl, exportNameNoEchoParameters as Tn, configBooleanRefusal as To, isCustomResource as Tr, dynamicReferenceTokens as Ts, isHandledOrphan as Tt, resolveDynamoDbDeleteBudgetMs as U, refuseMalformedResourcePropertiesForDrift as Ua, dockerSpawnEnvWithSensitive as Uc, withSharedDrainBudget as Ui, displayAssemblyPath as Ul, secretNamedRecordNeedles as Un, isMarkedCoordinate as Uo, deleteSkipReason as Ur, wholeStringLeavesOf as Us, replayFailedOperations as Ut, deleteBudgetKey as V, refuseMalformedResourceEntriesForOrphan as Va, describeDockerExecFailure as Vc, refStateLookupFromResource as Vi, absoluteAssemblyPathEscape as Vl, secretNamePrintingBags as Vn, TemplateParser as Vo, deleteIndeterminateGuards as Vr, recordNoEchoParameterFreshValue as Vs, getCurrentNestedStackContext as Vt, DELETE_INDEX_WAIT_PROCEED_NOTE as W, refuseMalformedResourcePropertiesForExport as Wa, finchSecretArgvRefusal as Wc, parameterInputsFor as Wi, renderAssemblyPathEscape as Wl, stateSecretNameNeedles as Wn, maskAtCoordinates as Wo, withIndeterminateGuard as Wr, STATE_SOURCED_BASELINE_RULES as Ws, replayRollback as Wt, hasCdkAutoDeleteTag as X, repairMalformedOrphanRecordsForReadOnly as Xa, redactDockerArgvValues as Xc, UNREADABLE_ORPHANS_CONTAINER_ROW as Xi, ccRoutedFinalSnapshotError as Xn, noEchoOutputsComparison as Xo, observeThenDisableInstanceApiTermination as Xr, LockManager as Xs, replacedDeleteFailureVerdict as Xt, S3_AUTO_DELETE_OBJECTS_TAG as Y, refuseMalformedState as Ya, partitionSensitiveEnv as Yc, STATE_RESOURCES_MALFORMED as Yi, resolveBucketRegion as Yl, buildFinalSnapshotIdentifier as Yn, noEchoLeavesOf as Yo, isTerminationProtectionPropagationError as Yr, isSingleDynamicReferenceToken as Ys, removeProtectionTypeList as Yt, isTruthyCfnBoolean as Z, repairMalformedOrphansForReadOnly as Za, redactedCause as Zc, UNREADABLE_RESOURCES_MAP_ROW as Zi, createPreDeleteFinalSnapshot as Zn, passedNoEchoParametersOf as Zo, reDisableInstanceApiTermination as Zr, isLockInfoExpired as Zs, recordAfterRollbackUpdate as Zt, makeCanonicalizePropertiesFn as _, malformedOutputsRefusalMessage as _a, orphansCarriedFrom as _c, outputReferenceProvenanceOf as _i, resolveStateBucketWithDefaultAndSource as _l, orphanNeedsIdentity as _n, renderStatefulReason as _o, refuseMalformedDesiredTags as _r, markSameGenerationBag as _s, planOrphanAdoption as _t, findNestedTemplateTreeDefect as a, isReadableResourceEntry as aa, isNotImplemented as ac, applyRoleArnIfSet as ai, AssetManifestLoader as al, replacementNeverSwapped as an, withheldAccountClause as ao, formatDestructiveChange as ar, hasMaskableValues as as, red as at, lookupEachName as b, malformedResourceEntriesWarning as ba, isSensitiveAttributeName as bc, s3BucketArn as bi, warnDeprecatedNoPrefixCliFlag as bl, exportAliasCollisionScrubWarning as bn, isWarmThroughputDecrease as bo, definedAttributes as br, redactSecretsForState as bs, pendingRequestCount as bt, renderNestedTemplateTreeDefect as c, malformedExportSourceWarning as ca, describeRegionValueKind as cc, explicitRoleArnOrThrow as ci, synthesisStatusMessage as cl, findNestedStackTypeChanges as cn, unwrittenCreateOnlyReplacement as co, reserveStackCreateToken as cr, printingCorpusOf as cs, namesAnyDeclaredParameter as ct, conditionInputsFrom as d, malformedLocalResourcesWarning as da, hasReasonlessBaselineRefusal as dc, AWS_CREDENTIAL_ENV_KEYS as di, loadCdkJson as dl, REDACTED_DELETE_ADDRESS_SKIP_REASON as dn, hasNoCloudControlHandlers as do, isRefusedByName as dr, shareLogOnlyValues as ds, noEchoAttributeNamesOf as dt, displayLogicalId as ea, CrossPrefixReadError as ec, INTRINSIC_KEYS as ei, runDockerStreaming as el, isReplacementOrphan as en, repairMalformedResourcePropertiesForReadOnly as eo, refusesFinalSnapshot as er, recordedNoEchoValuesOf as es, formatResourceLine as et, parentSuppliedValues as f, malformedOrphanRecordsRefusalMessage as fa, hasUnverifiableParameterRefusal as fc, applyCallerIdentityCredentials as fi, resolveApp as fl, isRedactedRecordedValue as fn, findReplacedReadersOfRecreateTargets as fo, markDeleteStarted as fr, unionOfSecretBags as fs, noEchoComparisonForTemplate as ft, mergeNoChangeOutputs as g, malformedOrphansWarning as ga, orphansAfterRollback as gc, keepHeldTokenProvenance as gi, resolveStateBucketWithDefault as gl, updatePartialReason as gn, isStatefulRecreateTargetSync as go, readTagList as gr, maskSecretsInText as gs, makeSiblingClaimReader as gt, keptWholeReasonText as h, malformedOrphansRefusalMessage as ha, isReadableBag as hc, isSettledInstanceState as hi, resolveSkipPrefix as hl, updatePartialMessage as hn, isStatefulRecreateTargetForReplace as ho, planTagDiff as hr, maskSecretsInError as hs, createReadOnlyAttributeHealerFactory as ht, childTemplateLoader as i, isReadableOrphanRecord as ia, isAccessDenied$1 as ic, refuseUnreadableCdkCrossAccountRefs as ii, stripForDisplay as il, recordUnderIdIsNotOwn as in, unreadableResourceEntries as io, findDestructiveChanges as ir, createUnionSecretMasker as is, green as it, recordedProtectionEvidence as j, refuseMalformedOrphansForDestroy as ja, getBootstrapMarkerKey as jc, parameterTypeMayLoseSecretIdentity as ji, canonicalizeRegion as jl, isExportAliasCollision as jn, requireConfigObject as jo, getCurrentResourceSecrets as jr, recoverMaskedOutput as js, displacedOpClause as jt, withResourceDeadline as k, refuseMalformedOrphanRecordsForDestroy as ka, assertAssetBucketRegion as kc, coerceParameterTypedValue as ki, expectedOwnerParam as kl, collectDeclaredOutputNames as kn, replayWarn as ko, readsNoEchoDeleteValues as kr, inheritNestedStackParameterAssociations as ks, sameJournaledOrphans as kt, templateIdentity as l, malformedLocalOutputsWarning as la, exportNamesCarriedFrom as lc, isIamRoleArn as li, getDefaultStateBucketName as ll, getCurrentProducerRegions as ln, withoutSilentDropProperties as lo, withCreateTokenLedger as lr, recordLogOnlyParameterValue as ls, reachableDivergentParameters as lt, isSecretBearingReferenceString as m, malformedOrphanRowsKeptWarning as ma, importableOutputs as mc, envCredentialsAreAssumedRole as mi, resolveCaptureObservedState as ml, redactedDeleteAddressSkip as mn, MULTI_REGION_RECREATE_BLOCKED_TYPES as mo, DBPROXY_TAG_OPTIONS as mr, errorCauseChain as ms, noEchoParameterNamesOf as mt, crossStackOutputProvenanceSource as n, hasReadableOutputs as na, applyCrossPrefixScan as nc, poisonRenderedSpellingsCollidingIn as ni, escapeRegExp$3 as nl, planRollback as nn, unpreviewableOrphanRecords as no, maskingRetryLogger as nr, liveMatchesUnresolvedTokenFrame as ns, cyan as nt, isAbsoluteAssetPath as o, malformedDriftResourcePropertiesWarning as oa, splitImportedOps as oc, assertFlagRoleArn as oi, getDockerImageBySourceHash as ol, resolveReplacementOldType as on, findActionableSilentDrops as oo, earliestDefined as or, literalSplitDelimitersOf as os, yellow as ot, readRecordedConditionVerdicts as p, malformedOrphanRecordsWarning as pa, importableOutputKeys as pc, callerEnvCredentials as pi, resolveAutoAssetStorage as pl, redactedDeleteAddressFields as pn, shownType as po, DBPROXY_TAGS_WHAT as pr, createSecretMasker as ps, noEchoExactEchoLeavesOf as pt, waitForIndexesSettled as q, refuseMalformedResourcesForDestroy as qa, isDockerClientEnvKey as qc, JSON_LISTING_HOLE_VALUE as qi, injectedAwsRegionValue as ql, ATOMIC_FINAL_SNAPSHOT_TYPES as qn, maskedLeafCoordinatesOf as qo, disableInstanceApiTermination as qr, TEMPLATE_SOURCED_RULES as qs, getStackRecords as qt, inheritedProvenanceForChildDiff as r, hasReadableResources as ra, crossPrefixDeniedWarning as rc, producerLookupOver as ri, stripControlChars as rl, recheckFailedPlan as rn, unreadableOrphanRecords as ro, constructPathOf as rr, carryLogOnlyValues as rs, gray as rt, listNestedTemplateRows as s, malformedExportNamesWarning as sa, acceptedCreateOnlyDropsOf as sc, assertSendableRoleArn as si, Synthesizer as sl, seedsDeleteFirstGuard as sn, findSilentDropProperties as so, ledgerForStack as sr, logOnlyValueCount as ss, computeParameterTaint as st, DeployEngine as t, hasReadableOrphans as ta, CrossPrefixScanCache as tc, IntrinsicFunctionResolver as ti, warnFinchArgvExposure as tl, planFailedOps as tn, repairMalformedResourcesForReadOnly as to, unsupportedFinalSnapshotError as tr, valueAtCoordinate as ts, bold as tt, conditionFingerprint as u, malformedLocalResourceEntriesWarning as ua, hasReadableExportSet as uc, sendableAssumeRoleCommand as ui, getLegacyStateBucketName as ul, inheritProducerRegions as un, NO_CC_HANDLERS_REASON as uo, acquireIdempotencyToken as ur, recordLogOnlyValue as us, resourcesNamingDeclaredParameter as ut, chunks as v, malformedOutputsWarning as va, shouldRetainResource as vc, recordedOutputReferenceRegions as vi, resolveUseCdkBootstrapAssets as vl, WITHHELD_NAME_DISPLAY as vn, WARM_THROUGHPUT_MEMBERS as vo, tagMapAsList as vr, recordReferenceProvenanceEntry as vs, DeploymentEventsReader as vt, keptForReadoption as w, malformedStateRefusalMessage as wa, createAssetRedirectResolver as wc, s3BucketWebsiteUrl as wi, MIGRATE_TMP_PREFIX as wl, carriedExportAliasExposure as wn, coerceCfnInteger as wo, ccBrokenReason as wr, DYNAMIC_REFERENCE_TOKEN_SCAN as ws, dropFailedHint as wt, withApiLimit as x, malformedResourcePropertiesWarning as xa, stringifyValue as xc, s3BucketDomainName as xi, ssmResolvedValueType as xl, secretBearing as xn, toCfnInteger as xo, stringifyIfAssigned as xr, scrubResourceRecord as xs, resolvePendingCloudControlRequests as xt, isAccessDeniedError as y, malformedRenderedContainersWarning as ya, AssetPublisher as yc, recordedReferenceRegions as yi, stateBucketExistenceConfirmed as yl, displayTextOrWithheld as yn, coerceWarmThroughput as yo, tagPlanWarning as yr, snapshotPassProvenance as ys, DeploymentEventsStore as yt, beginDeleteWait as z, refuseMalformedResourceEntriesForImport as za, resolveDockerContextDirectory as zc, cfnRefValueFromPhysicalId as zi, nullPrototypeRecord as zl, orphanRecordsPrintingBag as zn, sameLambdaFunctionAddress as zo, RollbackInlinePolicyWriters as zr, recordMaskOnlyValuesIn as zs, withNestedRevertRun as zt };
+//# sourceMappingURL=deploy-engine-BIPU9Xdh.js.map