@go-to-k/cdkd 0.302.0 → 0.302.1

package/dist/{deploy-engine-DU0BoQqo.js → deploy-engine-CYVt2NQR.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-B_CEQGE1.js";
-import { $ as terminalSafe, A as looksLikeCdkdGeneratedName, B as STACK_REF_MAX_CODE_POINTS, D as getCurrentStackInstanceId, E as getCurrentSkipPrefix, F as withStackScope, G as displayIdent, H as asIsMessage, I as withStackScopeBeforeStateRead, J as isPasteableIdent, K as displaySafe, L as withoutGeneratedFallbackName, M as stackInstanceNameSuffix, N as withNameGeneration, O as getCurrentStackName, P as withSkipPrefix, R as SAFE_MSG_ALTERED_CHAR, S as fallbackNamePropertyFor, T as generatedNameFor, V as UNRENDERABLE, W as displayAwsMessage, X as plainIdentOr, Z as safeMsg, a as safeStringify$1, c as isStdoutReservedForPayload, et as truncateCodePoints, f as currentLogLineMasker, k as isNameGeneration, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, q as displayStackName, s as getLogger, t as VERBOSE_POINTER, v as applyDefaultNameForFallback, w as generateResourceNameWithFallback, x as explicitNamePropertyFor, y as currentNameGeneration, z as SECRET_REF_MAX_CODE_POINTS } from "./aws-failure-text-BDZdavf4.js";
-import { $ as protectedReplacementAdvice, $n as markReplayMayCollide, $t as ambientCredentialConfig, A as isQuotableImportValue, An as SHELL_ACTIVE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, Ct as RETRY_AUXILIARY_OWNER, Dn as normalizeAwsError, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as isUpdateUnsupportedError, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as withheldTargetClause, Ht as recoveryCommandFlags, In as pasteableCommand, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as isNameCollisionErrorFrom, Kn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as physicalIdShownBesideCommand, M as quotedRemedyLogicalId, Mn as UNSHOWABLE_VALUE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Ot as hasCreatedBeforeFailure, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as plainOrDescribed, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Ut as sanitizeRecoveryValue, Vn as shellQuote, Vt as formatLockOwner, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isRecreateRetryableError, Yn as isNameCooldownError, Yt as producerRecordKey, Zn as isReplayedNameCollisionFrom, Zt as withPasteableAwsProfile, _r as markRedactedCause, _t as createMaskedLogSinks, ar as formatRetryClassificationSignals, at as startInterruptWatch, bn as ResourceUpdateNotSupportedError, bt as maskDeep, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dr as isTransientServerError, en as clientDefaultsFor, er as relayedNameCollision, f as removalWarning, fr as retryClassificationText, ft as logicalIdShown, gr as markNonRetryable, gt as stateOrphanRecordRemedy, hn as MalformedProducerRecordRefusalError, hr as isThrottlingError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as SHELL_ACTIVE_WHY, jt as markAuxiliaryFailure, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DynamicReferenceRegionAmbiguousError, lr as isIamPropagationError, m as withoutInjectedRemovals, mn as MacroExpansionError, mr as isMarkedNonRetryable, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as stripControlChars, on as CrossAccountSecretRefusalError, or as isAmbiguousCcHandlerErrorCode, ot as ElapsedBudgetRegistry, pn as LockError, rn as AssetError, sn as DependencyError, sr as isAmbiguousOutcomeError, st as monotonicNowMs, tn as credentialFingerprint, tr as escapeRegExp$3, un as IntrinsicResolutionRefusalError, ur as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ProvisioningError, vr as wrapMaskedAwsError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as SynthesisError, wt as carryCreatedBeforeFailure, xt as maskerOrIdentity, yn as ResourceTimeoutError, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-Dnk6FCsr.js";
+import { A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, D as getCurrentStackInstanceId, E as getCurrentSkipPrefix, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, L as withStackScopeBeforeStateRead, N as stackInstanceNameSuffix, O as getCurrentStackName, P as withNameGeneration, Q as safeMsg, R as withoutGeneratedFallbackName, S as fallbackNamePropertyFor, T as generatedNameFor, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify$1, c as isStdoutReservedForPayload, et as terminalSafe, f as currentLogLineMasker, j as looksLikeCdkdGeneratedName, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, q as displaySafe, s as getLogger, t as VERBOSE_POINTER, tt as truncateCodePoints, v as applyDefaultNameForFallback, w as generateResourceNameWithFallback, x as explicitNamePropertyFor, y as currentNameGeneration, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-e_ddrDDo.js";
+import { $ as protectedReplacementAdvice, $n as isReplayedNameCollisionFrom, $t as ambientCredentialConfig, A as isQuotableImportValue, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as plainOrDescribed, Bt as formatLockOperation, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as commandHole, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as shellBoundedDisplay, Ht as recoveryCommandFlags, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as isInertUnquoted, M as quotedRemedyLogicalId, Mn as SHELL_ACTIVE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as SHELL_ACTIVE_WHY, On as isSoftAbort, Ot as hasCreatedBeforeFailure, Pn as UNSHOWABLE_VALUE, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qn as isRecreateRetryableError, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as pasteableCommand, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as SynthesisError, U as protectionFlipKey, Un as shellQuote, Ut as sanitizeRecoveryValue, Vn as quotedOrDescribed, Vt as formatLockOwner, Wn as withheldTargetClause, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isNameCollisionErrorFrom, Yt as producerRecordKey, Zn as isNameCooldownError, Zt as withPasteableAwsProfile, _r as isThrottlingError, _t as createMaskedLogSinks, at as startInterruptWatch, bn as ResourceTimeoutError, br as wrapMaskedAwsError, bt as maskDeep, cr as isAmbiguousCcHandlerErrorCode, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as IntrinsicResolutionRefusalError, dr as isIamPropagationError, en as clientDefaultsFor, f as removalWarning, fr as isRetryableTransientError, ft as logicalIdShown, gn as MalformedProducerRecordRefusalError, gr as isMarkedNonRetryable, gt as stateOrphanRecordRemedy, hn as MacroExpansionError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as stripControlChars, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, kn as normalizeAwsError, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DeploymentNotApprovedError, lr as isAmbiguousOutcomeError, m as withoutInjectedRemovals, mn as LockError, mr as retryClassificationText, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as relayedNameCollision, on as CrossAccountSecretRefusalError, ot as ElapsedBudgetRegistry, pr as isTransientServerError, qn as isUpdateUnsupportedError, rn as AssetError, rr as escapeRegExp$3, sn as DependencyError, sr as formatRetryClassificationSignals, st as monotonicNowMs, tn as credentialFingerprint, tr as markReplayMayCollide, un as DynamicReferenceRegionAmbiguousError, ut as compositeIdSeparatorRefusal, vr as markNonRetryable, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as StateError, wt as carryCreatedBeforeFailure, xn as ResourceUpdateNotSupportedError, xt as maskerOrIdentity, yn as ProvisioningError, yr as markRedactedCause, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as physicalIdShownBesideCommand, zt as formatLockExpiry } from "./iam-policy-targets-CmHNH1DY.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-DBXBcg0J.js";
-import { t as getCdkdVersion } from "./version-C2XBsD-i.js";
+import { t as getCdkdVersion } from "./version-CaejipV3.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4577,7 +4577,8 @@ var WorkGraph = class {
 							nodeId: node.id,
 							error
 						});
-						this.logger.error(`Failed: ${node.id}: ${describeAwsFailure(error).detail}`);
+						if (isSoftAbort(error)) this.logger.debug(safeMsg`Not approved: ${node.id}`);
+						else this.logger.error(`Failed: ${node.id}: ${describeAwsFailure(error).detail}`);
 					}).finally(() => {
 						active[node.type]--;
 						dispatch();
@@ -4591,6 +4592,12 @@ var WorkGraph = class {
 					}
 					if (errors.length > 0) {
 						const skippedCount = [...this.nodes.values()].filter((n) => n.state === "skipped").length;
+						if (errors.every((e) => isSoftAbort(e.error))) {
+							const lines = errors.map((e) => e.error.message);
+							if (skippedCount > 0) lines.push(`${skippedCount} node(s) depending on a declined stack were skipped.`);
+							reject(errors.length === 1 && skippedCount === 0 ? errors[0].error : new DeploymentNotApprovedError(lines.join("\n")));
+							return;
+						}
 						const msg = errors.map((e) => `  - ${e.nodeId}: ${describeAwsFailure(e.error).detail}`).join("\n");
 						reject(/* @__PURE__ */ new Error(`${errors.length} node(s) failed${skippedCount > 0 ? `, ${skippedCount} skipped` : ""}:\n${msg}`));
 						return;
@@ -27421,7 +27428,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BRr_hsky.js");
+			const { ASGProvider } = await import("./asg-provider-BpRcm_UB.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -27527,7 +27534,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-6RgDTDCV.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-WE1O3kXY.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-CmKbYAvr.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DzTl6-74.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -32223,6 +32230,443 @@ function isRefusedByName(error) {
 	return false;
 }
 
+//#endregion
+//#region src/types/deployment-events.ts
+function extractDeploymentEventError(err) {
+	if (!(err instanceof Error)) return {
+		name: "UnknownError",
+		message: safeStringify$1(err)
+	};
+	const result = {
+		name: err.name || "Error",
+		message: err.message
+	};
+	let current = err;
+	for (let depth = 0; depth < 10 && current instanceof Error; depth++) {
+		const maybeAws = current;
+		if (maybeAws.$metadata !== void 0) {
+			const code = maybeAws.Code ?? maybeAws.name;
+			if (code) result.awsErrorCode = code;
+			if (maybeAws.$metadata.requestId) result.requestId = maybeAws.$metadata.requestId;
+		}
+		current = current.cause;
+	}
+	return result;
+}
+
+//#endregion
+//#region src/state/deployment-events-store.ts
+const DEPLOYMENT_EVENTS_MAX_INDEX_RUNS = 20;
+const FLUSH_INTERVAL_MS = 2e3;
+const FLUSH_EVENT_THRESHOLD = 50;
+function newDeploymentRunId(now = /* @__PURE__ */ new Date()) {
+	return `${now.toISOString().replace(/[-:.]/g, "")}-${randomUUID().slice(0, 8)}`;
+}
+function deploymentEventsKey(prefix, stackName, region, runId) {
+	return `${prefix}/${stackName}/${region}/deployments/${runId}.jsonl`;
+}
+function deploymentEventsIndexKey(prefix, stackName, region) {
+	return `${prefix}/${stackName}/${region}/deployments/index.json`;
+}
+function deploymentsDirPrefix(prefix, stackName, region) {
+	return `${prefix}/${stackName}/${region}/deployments/`;
+}
+const DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION = "deployment-event streams and their index, whose recorded error messages can quote values the secret mask does not catch";
+async function deleteAndPurgeEventObjects(backend, keys, dirPrefix, scope = "deleted-keys") {
+	if (keys.length === 0) return void 0;
+	let swept;
+	try {
+		await backend.deleteRawObjects(keys);
+	} finally {
+		if (scope === "whole-dir") swept = await backend.purgeNoncurrentVersionsUnderPrefix(dirPrefix, { objectDescription: DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION });
+		else await backend.purgeNoncurrentVersions(keys, {
+			...keys.length > 1 && { listPrefix: dirPrefix },
+			objectDescription: DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION
+		});
+	}
+	return swept;
+}
+function runIdTimestampMs(runId) {
+	const m = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})(\d{3})Z/.exec(runId);
+	if (!m) return null;
+	const iso = `${m[1]}-${m[2]}-${m[3]}T${m[4]}:${m[5]}:${m[6]}.${m[7]}Z`;
+	const ms = Date.parse(iso);
+	return Number.isNaN(ms) ? null : ms;
+}
+function runIdFromJsonlKey(key, dirPrefix) {
+	if (!key.startsWith(dirPrefix) || !key.endsWith(".jsonl")) return null;
+	return key.slice(dirPrefix.length, -6);
+}
+var DeploymentEventsStore = class {
+	logger = getLogger().child("DeploymentEvents");
+	backend;
+	stackName;
+	region;
+	command;
+	runId;
+	cdkdVersion;
+	startedAt;
+	events = [];
+	persistedCount = 0;
+	flushTimer;
+	writeChain = Promise.resolve();
+	warnedOnce = false;
+	finalized = false;
+	constructor(backend, options) {
+		this.backend = backend;
+		this.stackName = options.stackName;
+		this.region = options.region;
+		this.command = options.command;
+		this.runId = options.runId ?? newDeploymentRunId();
+		this.cdkdVersion = options.cdkdVersion ?? getCdkdVersion();
+		this.startedAt = (/* @__PURE__ */ new Date()).toISOString();
+	}
+	record(event) {
+		try {
+			if (this.finalized) return;
+			this.events.push({
+				timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+				...event
+			});
+			if (this.events.length - this.persistedCount >= FLUSH_EVENT_THRESHOLD) this.scheduleFlush(0);
+			else this.scheduleFlush(FLUSH_INTERVAL_MS);
+		} catch {}
+	}
+	async finalize(result) {
+		if (this.finalized) return;
+		this.finalized = true;
+		if (this.flushTimer) {
+			clearTimeout(this.flushTimer);
+			this.flushTimer = void 0;
+		}
+		if (this.events.length === 0) return;
+		await this.enqueueWrite(async () => {
+			const indexRead = this.readIndexRuns();
+			indexRead.catch(() => {});
+			await this.doFlush();
+			await this.writeIndexAndPrune(result, await indexRead);
+		});
+	}
+	async writeIndexAndPrune(result, existingRuns) {
+		const { key, file, runs } = this.buildIndexUpdate(result, existingRuns);
+		const keptRunIds = runs.map((r) => r.runId);
+		const willPrune = keptRunIds.length >= 20;
+		const dirPrefix = deploymentsDirPrefix(this.backend.prefix, this.stackName, this.region);
+		const staleKeysRead = willPrune ? this.backend.listRawKeys(dirPrefix) : void 0;
+		staleKeysRead?.catch(() => {});
+		await this.backend.putRawObject(key, JSON.stringify(file, null, 2));
+		if (!staleKeysRead) return;
+		await this.pruneSupersededRunFiles(keptRunIds, dirPrefix, await staleKeysRead);
+	}
+	async drain() {
+		await this.writeChain;
+	}
+	scheduleFlush(delayMs) {
+		if (this.flushTimer) {
+			if (delayMs > 0) return;
+			clearTimeout(this.flushTimer);
+		}
+		this.flushTimer = setTimeout(() => {
+			this.flushTimer = void 0;
+			this.enqueueWrite(() => this.doFlush());
+		}, delayMs);
+		this.flushTimer.unref?.();
+	}
+	enqueueWrite(op) {
+		const next = this.writeChain.then(op).catch((err) => {
+			this.warnOnce(`Failed to persist deployment events for run ${this.runId}: ${describeAwsFailure(err).detail}`);
+		});
+		this.writeChain = next;
+		return next;
+	}
+	async doFlush() {
+		if (this.events.length === 0 || this.events.length === this.persistedCount) return;
+		const snapshotCount = this.events.length;
+		const body = this.events.slice(0, snapshotCount).map((e) => JSON.stringify(e)).join("\n");
+		await this.backend.putRawObject(deploymentEventsKey(this.backend.prefix, this.stackName, this.region, this.runId), body + "\n", "application/x-ndjson");
+		this.persistedCount = snapshotCount;
+	}
+	async readIndexRuns() {
+		const key = deploymentEventsIndexKey(this.backend.prefix, this.stackName, this.region);
+		try {
+			const raw = await this.backend.getRawObject(key);
+			if (raw !== null) {
+				const parsed = JSON.parse(raw);
+				if (Array.isArray(parsed.runs)) return parsed.runs;
+			}
+		} catch (err) {
+			this.logger.debug(`Deployment-events index unreadable, rewriting: ${describeAwsFailure(err).detail}`);
+		}
+		return [];
+	}
+	buildIndexUpdate(result, existingRuns) {
+		const key = deploymentEventsIndexKey(this.backend.prefix, this.stackName, this.region);
+		const runs = [{
+			runId: this.runId,
+			command: this.command,
+			cdkdVersion: this.cdkdVersion,
+			startedAt: this.startedAt,
+			finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			result,
+			eventCount: this.persistedCount
+		}, ...existingRuns.filter((r) => r.runId !== this.runId)].slice(0, 20);
+		return {
+			key,
+			file: {
+				indexVersion: 1,
+				stackName: this.stackName,
+				region: this.region,
+				runs,
+				lastModified: Date.now()
+			},
+			runs
+		};
+	}
+	async pruneSupersededRunFiles(keptRunIds, dirPrefix, keys) {
+		if (keptRunIds.length < 20) return;
+		const cutoff = keptRunIds.reduce((min, id) => id < min ? id : min, keptRunIds[0]);
+		const stale = keys.filter((k) => {
+			const runId = runIdFromJsonlKey(k, dirPrefix);
+			return runId !== null && runId < cutoff;
+		});
+		if (stale.length === 0) return;
+		await deleteAndPurgeEventObjects(this.backend, stale, dirPrefix);
+		this.logger.debug(`Pruned ${stale.length} superseded deployment-event stream(s) for ${this.stackName} (${this.region})`);
+	}
+	warnOnce(message) {
+		if (this.warnedOnce) {
+			this.logger.debug(message);
+			return;
+		}
+		this.warnedOnce = true;
+		this.logger.warn(`${message} — continuing; deployment events are best-effort and never block the run.`);
+	}
+};
+var DeploymentEventsReader = class {
+	backend;
+	constructor(backend) {
+		this.backend = backend;
+	}
+	async listRegions(stackName) {
+		const prefix = `${this.backend.prefix}/${stackName}/`;
+		const keys = await this.backend.listRawKeys(prefix);
+		const regions = /* @__PURE__ */ new Set();
+		for (const key of keys) {
+			const segments = key.slice(prefix.length).split("/");
+			if (segments.length === 3 && segments[1] === "deployments" && segments[0]) regions.add(segments[0]);
+		}
+		return [...regions].sort();
+	}
+	async listRuns(stackName, region) {
+		const key = deploymentEventsIndexKey(this.backend.prefix, stackName, region);
+		try {
+			const raw = await this.backend.getRawObject(key);
+			if (raw !== null) {
+				const parsed = JSON.parse(raw);
+				if (Array.isArray(parsed.runs)) return parsed.runs;
+			}
+		} catch {}
+		const dirPrefix = `${this.backend.prefix}/${stackName}/${region}/deployments/`;
+		const runIds = (await this.backend.listRawKeys(dirPrefix)).filter((k) => k.endsWith(".jsonl")).map((k) => k.slice(dirPrefix.length, -6)).sort().reverse();
+		return Promise.all(runIds.map((runId) => this.summarizeRunFromJsonl(stackName, region, runId)));
+	}
+	async summarizeRunFromJsonl(stackName, region, runId) {
+		const fallback = {
+			runId,
+			command: "deploy",
+			cdkdVersion: "unknown",
+			startedAt: "",
+			finishedAt: "",
+			result: "UNKNOWN",
+			eventCount: 0
+		};
+		let events = null;
+		try {
+			events = await this.readRunEvents(stackName, region, runId);
+		} catch {
+			return fallback;
+		}
+		if (events === null || events.length === 0) return fallback;
+		const started = events.find((e) => e.eventType === "RUN_STARTED");
+		let finished;
+		for (const e of events) if (e.eventType === "RUN_FINISHED") finished = e;
+		return {
+			runId,
+			command: started?.command ?? fallback.command,
+			cdkdVersion: started?.cdkdVersion ?? fallback.cdkdVersion,
+			startedAt: started?.timestamp ?? fallback.startedAt,
+			finishedAt: finished?.timestamp ?? fallback.finishedAt,
+			result: finished?.result ?? "UNKNOWN",
+			eventCount: events.length
+		};
+	}
+	async readRunEvents(stackName, region, runId) {
+		const key = deploymentEventsKey(this.backend.prefix, stackName, region, runId);
+		const raw = await this.backend.getRawObject(key);
+		if (raw === null) return null;
+		const events = [];
+		for (const line of raw.split("\n")) {
+			const trimmed = line.trim();
+			if (!trimmed) continue;
+			try {
+				events.push(JSON.parse(trimmed));
+			} catch {}
+		}
+		return events;
+	}
+	async pruneRuns(stackName, region, opts = {}) {
+		const dirPrefix = deploymentsDirPrefix(this.backend.prefix, stackName, region);
+		const keys = await this.backend.listRawKeys(dirPrefix);
+		const runIdsDesc = keys.map((k) => runIdFromJsonlKey(k, dirPrefix)).filter((id) => id !== null).sort().reverse();
+		const indexKey = deploymentEventsIndexKey(this.backend.prefix, stackName, region);
+		const indexExisted = keys.includes(indexKey);
+		if (opts.all === true) {
+			const toDelete = runIdsDesc.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
+			const earlierVersions = await deleteAndPurgeEventObjects(this.backend, [...toDelete, indexKey], dirPrefix, "whole-dir");
+			return {
+				deletedRunIds: runIdsDesc,
+				remainingRunIds: [],
+				indexDeleted: indexExisted,
+				...earlierVersions !== void 0 && { earlierVersions }
+			};
+		}
+		const noGuards = opts.keep === void 0 && opts.olderThanMs === void 0;
+		const keep = opts.keep ?? (noGuards ? 20 : void 0);
+		const protectedByCount = keep === void 0 ? /* @__PURE__ */ new Set() : new Set(runIdsDesc.slice(0, keep));
+		let candidates = runIdsDesc.filter((id) => !protectedByCount.has(id));
+		if (opts.olderThanMs !== void 0) {
+			const cutoff = (opts.now ?? /* @__PURE__ */ new Date()).getTime() - opts.olderThanMs;
+			candidates = candidates.filter((id) => {
+				const t = runIdTimestampMs(id);
+				return t !== null && t < cutoff;
+			});
+		}
+		if (candidates.length === 0) return {
+			deletedRunIds: [],
+			remainingRunIds: runIdsDesc,
+			indexDeleted: false
+		};
+		const deletedSet = new Set(candidates);
+		const deleteKeys = candidates.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
+		const remainingRunIds = runIdsDesc.filter((id) => !deletedSet.has(id));
+		if (remainingRunIds.length === 0) {
+			await deleteAndPurgeEventObjects(this.backend, [...deleteKeys, indexKey], dirPrefix);
+			return {
+				deletedRunIds: candidates,
+				remainingRunIds,
+				indexDeleted: indexExisted
+			};
+		}
+		await this.rewriteIndexAfterPrune(indexKey, stackName, region, deletedSet);
+		await deleteAndPurgeEventObjects(this.backend, deleteKeys, dirPrefix);
+		return {
+			deletedRunIds: candidates,
+			remainingRunIds,
+			indexDeleted: false
+		};
+	}
+	async rewriteIndexAfterPrune(indexKey, stackName, region, deletedRunIds) {
+		let raw;
+		try {
+			raw = await this.backend.getRawObject(indexKey);
+		} catch {
+			return;
+		}
+		if (raw === null) return;
+		let parsed;
+		try {
+			parsed = JSON.parse(raw);
+		} catch {
+			return;
+		}
+		if (!Array.isArray(parsed.runs)) return;
+		const remaining = parsed.runs.filter((r) => !deletedRunIds.has(r.runId));
+		if (remaining.length === parsed.runs.length) return;
+		const file = {
+			indexVersion: 1,
+			stackName,
+			region,
+			runs: remaining,
+			lastModified: Date.now()
+		};
+		await this.backend.putRawObject(indexKey, JSON.stringify(file, null, 2));
+	}
+};
+
+//#endregion
+//#region src/deployment/kept-in-history.ts
+function keptInEarlierRecords(records) {
+	const out = [];
+	for (const record of records) for (const [logicalId, raw] of Object.entries(record.resources)) {
+		if (raw === null || typeof raw !== "object") continue;
+		const r = raw;
+		if (typeof r.resourceType !== "string" || typeof r.physicalId !== "string") continue;
+		if (r.physicalId === "") continue;
+		if (!shouldRetainResource(r.deletionPolicy)) continue;
+		out.push({
+			logicalId,
+			resourceType: r.resourceType,
+			physicalId: r.physicalId,
+			...record.writtenAt !== void 0 && { keptAt: record.writtenAt }
+		});
+	}
+	return out;
+}
+function keptInEventHistory(runs, stackName) {
+	const made = /* @__PURE__ */ new Map();
+	const out = [];
+	for (const events of runs) for (const e of events) {
+		if (e.stackName !== stackName || typeof e.logicalId !== "string") continue;
+		if (typeof e.resourceType !== "string") continue;
+		if (e.eventType === "RESOURCE_SUCCEEDED" && (e.operation === "CREATE" || e.operation === "UPDATE") && typeof e.physicalId === "string" && e.physicalId !== "") made.set(e.logicalId, {
+			resourceType: e.resourceType,
+			physicalId: e.physicalId
+		});
+		else if (e.eventType === "RESOURCE_RETAINED") {
+			const m = made.get(e.logicalId);
+			if (m !== void 0 && m.resourceType === e.resourceType) {
+				const keptAt = Date.parse(e.timestamp);
+				out.push({
+					logicalId: e.logicalId,
+					...m,
+					...Number.isFinite(keptAt) && { keptAt }
+				});
+			}
+		}
+	}
+	return out;
+}
+async function loadKeptInHistory(sources, stackName, region) {
+	const [records, runs] = await Promise.all([sources.earlierStateResources(stackName, region).catch(() => []), readRecentRuns(sources, stackName, region)]);
+	return [...keptInEarlierRecords(records), ...keptInEventHistory(runs, stackName)];
+}
+async function readRecentRuns(sources, stackName, region) {
+	const runsOf = stackName.split("~")[0];
+	return (async () => {
+		const listed = (await sources.listRuns(runsOf, region)).slice(0, 20);
+		return (await Promise.all(listed.map((r) => sources.readRunEvents(runsOf, region, r.runId).catch(() => null)))).filter((e) => e !== null).reverse();
+	})().catch(() => []);
+}
+const RETAINED_SURVIVOR_REASON_PREFIX = "UpdateReplacePolicy: Retain kept the replacement's new";
+function rollbackRetainedInEventHistory(runs, stackName) {
+	const out = [];
+	for (const events of runs) for (const e of events) {
+		if (e.stackName !== stackName || e.eventType !== "ROLLBACK_RESOURCE_SUCCEEDED") continue;
+		if (typeof e.logicalId !== "string" || typeof e.resourceType !== "string") continue;
+		if (typeof e.physicalId !== "string" || e.physicalId === "") continue;
+		if (typeof e.reason !== "string" || !e.reason.startsWith("UpdateReplacePolicy: Retain kept the replacement's new")) continue;
+		out.push({
+			logicalId: e.logicalId,
+			resourceType: e.resourceType,
+			physicalId: e.physicalId
+		});
+	}
+	return out;
+}
+async function loadRollbackRetainedCopies(sources, stackName, region) {
+	return rollbackRetainedInEventHistory(await readRecentRuns(sources, stackName, region), stackName);
+}
+
 //#endregion
 //#region src/provisioning/providers/idempotency-token.ts
 const PROCESS_NONCE = randomUUID();
@@ -33088,30 +33532,6 @@ async function createReplicationGroupFinalSnapshot(client, replicationGroupId, l
 	});
 }
 
-//#endregion
-//#region src/types/deployment-events.ts
-function extractDeploymentEventError(err) {
-	if (!(err instanceof Error)) return {
-		name: "UnknownError",
-		message: safeStringify$1(err)
-	};
-	const result = {
-		name: err.name || "Error",
-		message: err.message
-	};
-	let current = err;
-	for (let depth = 0; depth < 10 && current instanceof Error; depth++) {
-		const maybeAws = current;
-		if (maybeAws.$metadata !== void 0) {
-			const code = maybeAws.Code ?? maybeAws.name;
-			if (code) result.awsErrorCode = code;
-			if (maybeAws.$metadata.requestId) result.requestId = maybeAws.$metadata.requestId;
-		}
-		current = current.cause;
-	}
-	return result;
-}
-
 //#endregion
 //#region src/deployment/rollback-executor/types.ts
 const NESTED_STACK_RESOURCE_TYPE$1 = "AWS::CloudFormation::Stack";
@@ -33307,7 +33727,7 @@ function retainedSurvivorMessages(logicalId, resourceType, survivorPhysicalId, s
 	const clause = mask(stateClause);
 	return {
 		warn: `  ⚠ ${safe(logicalId)} (${safe(resourceType)}) has UpdateReplacePolicy: Retain — the replacement's new physical resource (${displaySafe(survivorId)}) is RETAINED by this rollback and is no longer tracked by cdkd: it keeps running and incurring cost, and destroying the stack will not remove it. Delete it yourself once you no longer need it. ${displaySafe(clause)}`,
-		reason: `UpdateReplacePolicy: Retain kept the replacement's new ${resourceType} (${survivorId}); it is live, still billing, and no longer tracked by cdkd. ${clause}`
+		reason: `${RETAINED_SURVIVOR_REASON_PREFIX} ${resourceType} (${survivorId}); it is live, still billing, and no longer tracked by cdkd. ${clause}`
 	};
 }
 
@@ -34944,7 +35364,8 @@ async function checkedReplacementNameChange(deps, input) {
 	}
 	if (found === null) return change;
 	if (!typeChanged && probeFoundSameId(resourceType, found.physicalId, currentResource.physicalId)) return;
-	throw markNonRetryable(new CdkdError(maskName(`${subject} requires replacement, and another existing resource (${displaySafe(found.physicalId)}) already holds the name it asks for. ${renderReplacementNameChange(change, input.createProps)}. Since ${adoptsText}, creating the replacement would take that resource over and record it as this stack's. Nothing was created or deleted. Choose a name no other resource holds, or delete the resource holding it if it is yours.`), "NAMED_REPLACEMENT_COLLISION"));
+	const remedy = (await deps.rollbackRetainedCopies?.(input.stackName).catch(() => []) ?? []).some((copy) => copy.logicalId === logicalId && copy.resourceType === resourceType && probeFoundSameId(resourceType, copy.physicalId, found.physicalId)) ? `This stack's event history records that a rolled-back deploy kept ${displaySafe(logicalId)}'s replacement under this name because of UpdateReplacePolicy: Retain, as CloudFormation also does, untracked by cdkd. If the holder is that copy and you no longer need it, delete it; otherwise choose another name.` : `Choose a name no other resource holds, or delete the resource holding it if it is yours.`;
+	throw markNonRetryable(new CdkdError(maskName(`${subject} requires replacement, and another existing resource (${displaySafe(found.physicalId)}) already holds the name it asks for. ${renderReplacementNameChange(change, input.createProps)}. Since ${adoptsText}, creating the replacement would take that resource over and record it as this stack's. Nothing was created or deleted. ${remedy}`), "NAMED_REPLACEMENT_COLLISION"));
 }
 async function createFirstThenDeleteOld(run, deps, input) {
 	const { logicalId, resourceType, currentResource, secrets } = input;
@@ -36392,6 +36813,7 @@ function isPlainRecord$1(value) {
 //#endregion
 //#region src/deployment/type-change-guard.ts
 function equalIdNamesDifferentResources(input) {
+	if (input.resourceType === "AWS::Lambda::Permission") return permissionsOnDifferentFunctions(input.oldProperties, input.newProperties);
 	if (input.resourceType !== "AWS::Glue::Table" || input.physicalId === void 0) return false;
 	const oldDb = input.oldProperties?.["DatabaseName"];
 	const newDb = input.newProperties?.["DatabaseName"];
@@ -36400,6 +36822,15 @@ function equalIdNamesDifferentResources(input) {
 	if (segmentAfterAnchor(input.physicalId, oldDb) === void 0 || segmentAfterAnchor(input.physicalId, newDb) === void 0) return false;
 	return oldDb !== newDb;
 }
+function permissionsOnDifferentFunctions(oldProperties, newProperties) {
+	const oldFn = oldProperties?.["FunctionName"];
+	const newFn = newProperties?.["FunctionName"];
+	if (typeof oldFn !== "string" || typeof newFn !== "string") return false;
+	if (carriesSecretMask(oldFn) || carriesSecretMask(newFn)) return false;
+	const oldName = parseLambdaFunctionAddress(oldFn)?.name;
+	const newName = parseLambdaFunctionAddress(newFn)?.name;
+	return oldName !== void 0 && newName !== void 0 && oldName !== newName;
+}
 function equalIdNamesSameResource(input) {
 	if (input.oldType === input.newType) return !equalIdNamesDifferentResources({
 		resourceType: input.oldType,
@@ -40786,345 +41217,6 @@ function withoutPendingRequest(op) {
 	return rest;
 }
 
-//#endregion
-//#region src/state/deployment-events-store.ts
-const DEPLOYMENT_EVENTS_MAX_INDEX_RUNS = 20;
-const FLUSH_INTERVAL_MS = 2e3;
-const FLUSH_EVENT_THRESHOLD = 50;
-function newDeploymentRunId(now = /* @__PURE__ */ new Date()) {
-	return `${now.toISOString().replace(/[-:.]/g, "")}-${randomUUID().slice(0, 8)}`;
-}
-function deploymentEventsKey(prefix, stackName, region, runId) {
-	return `${prefix}/${stackName}/${region}/deployments/${runId}.jsonl`;
-}
-function deploymentEventsIndexKey(prefix, stackName, region) {
-	return `${prefix}/${stackName}/${region}/deployments/index.json`;
-}
-function deploymentsDirPrefix(prefix, stackName, region) {
-	return `${prefix}/${stackName}/${region}/deployments/`;
-}
-const DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION = "deployment-event streams and their index, whose recorded error messages can quote values the secret mask does not catch";
-async function deleteAndPurgeEventObjects(backend, keys, dirPrefix, scope = "deleted-keys") {
-	if (keys.length === 0) return void 0;
-	let swept;
-	try {
-		await backend.deleteRawObjects(keys);
-	} finally {
-		if (scope === "whole-dir") swept = await backend.purgeNoncurrentVersionsUnderPrefix(dirPrefix, { objectDescription: DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION });
-		else await backend.purgeNoncurrentVersions(keys, {
-			...keys.length > 1 && { listPrefix: dirPrefix },
-			objectDescription: DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION
-		});
-	}
-	return swept;
-}
-function runIdTimestampMs(runId) {
-	const m = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})(\d{3})Z/.exec(runId);
-	if (!m) return null;
-	const iso = `${m[1]}-${m[2]}-${m[3]}T${m[4]}:${m[5]}:${m[6]}.${m[7]}Z`;
-	const ms = Date.parse(iso);
-	return Number.isNaN(ms) ? null : ms;
-}
-function runIdFromJsonlKey(key, dirPrefix) {
-	if (!key.startsWith(dirPrefix) || !key.endsWith(".jsonl")) return null;
-	return key.slice(dirPrefix.length, -6);
-}
-var DeploymentEventsStore = class {
-	logger = getLogger().child("DeploymentEvents");
-	backend;
-	stackName;
-	region;
-	command;
-	runId;
-	cdkdVersion;
-	startedAt;
-	events = [];
-	persistedCount = 0;
-	flushTimer;
-	writeChain = Promise.resolve();
-	warnedOnce = false;
-	finalized = false;
-	constructor(backend, options) {
-		this.backend = backend;
-		this.stackName = options.stackName;
-		this.region = options.region;
-		this.command = options.command;
-		this.runId = options.runId ?? newDeploymentRunId();
-		this.cdkdVersion = options.cdkdVersion ?? getCdkdVersion();
-		this.startedAt = (/* @__PURE__ */ new Date()).toISOString();
-	}
-	record(event) {
-		try {
-			if (this.finalized) return;
-			this.events.push({
-				timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-				...event
-			});
-			if (this.events.length - this.persistedCount >= FLUSH_EVENT_THRESHOLD) this.scheduleFlush(0);
-			else this.scheduleFlush(FLUSH_INTERVAL_MS);
-		} catch {}
-	}
-	async finalize(result) {
-		if (this.finalized) return;
-		this.finalized = true;
-		if (this.flushTimer) {
-			clearTimeout(this.flushTimer);
-			this.flushTimer = void 0;
-		}
-		if (this.events.length === 0) return;
-		await this.enqueueWrite(async () => {
-			const indexRead = this.readIndexRuns();
-			indexRead.catch(() => {});
-			await this.doFlush();
-			await this.writeIndexAndPrune(result, await indexRead);
-		});
-	}
-	async writeIndexAndPrune(result, existingRuns) {
-		const { key, file, runs } = this.buildIndexUpdate(result, existingRuns);
-		const keptRunIds = runs.map((r) => r.runId);
-		const willPrune = keptRunIds.length >= 20;
-		const dirPrefix = deploymentsDirPrefix(this.backend.prefix, this.stackName, this.region);
-		const staleKeysRead = willPrune ? this.backend.listRawKeys(dirPrefix) : void 0;
-		staleKeysRead?.catch(() => {});
-		await this.backend.putRawObject(key, JSON.stringify(file, null, 2));
-		if (!staleKeysRead) return;
-		await this.pruneSupersededRunFiles(keptRunIds, dirPrefix, await staleKeysRead);
-	}
-	async drain() {
-		await this.writeChain;
-	}
-	scheduleFlush(delayMs) {
-		if (this.flushTimer) {
-			if (delayMs > 0) return;
-			clearTimeout(this.flushTimer);
-		}
-		this.flushTimer = setTimeout(() => {
-			this.flushTimer = void 0;
-			this.enqueueWrite(() => this.doFlush());
-		}, delayMs);
-		this.flushTimer.unref?.();
-	}
-	enqueueWrite(op) {
-		const next = this.writeChain.then(op).catch((err) => {
-			this.warnOnce(`Failed to persist deployment events for run ${this.runId}: ${describeAwsFailure(err).detail}`);
-		});
-		this.writeChain = next;
-		return next;
-	}
-	async doFlush() {
-		if (this.events.length === 0 || this.events.length === this.persistedCount) return;
-		const snapshotCount = this.events.length;
-		const body = this.events.slice(0, snapshotCount).map((e) => JSON.stringify(e)).join("\n");
-		await this.backend.putRawObject(deploymentEventsKey(this.backend.prefix, this.stackName, this.region, this.runId), body + "\n", "application/x-ndjson");
-		this.persistedCount = snapshotCount;
-	}
-	async readIndexRuns() {
-		const key = deploymentEventsIndexKey(this.backend.prefix, this.stackName, this.region);
-		try {
-			const raw = await this.backend.getRawObject(key);
-			if (raw !== null) {
-				const parsed = JSON.parse(raw);
-				if (Array.isArray(parsed.runs)) return parsed.runs;
-			}
-		} catch (err) {
-			this.logger.debug(`Deployment-events index unreadable, rewriting: ${describeAwsFailure(err).detail}`);
-		}
-		return [];
-	}
-	buildIndexUpdate(result, existingRuns) {
-		const key = deploymentEventsIndexKey(this.backend.prefix, this.stackName, this.region);
-		const runs = [{
-			runId: this.runId,
-			command: this.command,
-			cdkdVersion: this.cdkdVersion,
-			startedAt: this.startedAt,
-			finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
-			result,
-			eventCount: this.persistedCount
-		}, ...existingRuns.filter((r) => r.runId !== this.runId)].slice(0, 20);
-		return {
-			key,
-			file: {
-				indexVersion: 1,
-				stackName: this.stackName,
-				region: this.region,
-				runs,
-				lastModified: Date.now()
-			},
-			runs
-		};
-	}
-	async pruneSupersededRunFiles(keptRunIds, dirPrefix, keys) {
-		if (keptRunIds.length < 20) return;
-		const cutoff = keptRunIds.reduce((min, id) => id < min ? id : min, keptRunIds[0]);
-		const stale = keys.filter((k) => {
-			const runId = runIdFromJsonlKey(k, dirPrefix);
-			return runId !== null && runId < cutoff;
-		});
-		if (stale.length === 0) return;
-		await deleteAndPurgeEventObjects(this.backend, stale, dirPrefix);
-		this.logger.debug(`Pruned ${stale.length} superseded deployment-event stream(s) for ${this.stackName} (${this.region})`);
-	}
-	warnOnce(message) {
-		if (this.warnedOnce) {
-			this.logger.debug(message);
-			return;
-		}
-		this.warnedOnce = true;
-		this.logger.warn(`${message} — continuing; deployment events are best-effort and never block the run.`);
-	}
-};
-var DeploymentEventsReader = class {
-	backend;
-	constructor(backend) {
-		this.backend = backend;
-	}
-	async listRegions(stackName) {
-		const prefix = `${this.backend.prefix}/${stackName}/`;
-		const keys = await this.backend.listRawKeys(prefix);
-		const regions = /* @__PURE__ */ new Set();
-		for (const key of keys) {
-			const segments = key.slice(prefix.length).split("/");
-			if (segments.length === 3 && segments[1] === "deployments" && segments[0]) regions.add(segments[0]);
-		}
-		return [...regions].sort();
-	}
-	async listRuns(stackName, region) {
-		const key = deploymentEventsIndexKey(this.backend.prefix, stackName, region);
-		try {
-			const raw = await this.backend.getRawObject(key);
-			if (raw !== null) {
-				const parsed = JSON.parse(raw);
-				if (Array.isArray(parsed.runs)) return parsed.runs;
-			}
-		} catch {}
-		const dirPrefix = `${this.backend.prefix}/${stackName}/${region}/deployments/`;
-		const runIds = (await this.backend.listRawKeys(dirPrefix)).filter((k) => k.endsWith(".jsonl")).map((k) => k.slice(dirPrefix.length, -6)).sort().reverse();
-		return Promise.all(runIds.map((runId) => this.summarizeRunFromJsonl(stackName, region, runId)));
-	}
-	async summarizeRunFromJsonl(stackName, region, runId) {
-		const fallback = {
-			runId,
-			command: "deploy",
-			cdkdVersion: "unknown",
-			startedAt: "",
-			finishedAt: "",
-			result: "UNKNOWN",
-			eventCount: 0
-		};
-		let events = null;
-		try {
-			events = await this.readRunEvents(stackName, region, runId);
-		} catch {
-			return fallback;
-		}
-		if (events === null || events.length === 0) return fallback;
-		const started = events.find((e) => e.eventType === "RUN_STARTED");
-		let finished;
-		for (const e of events) if (e.eventType === "RUN_FINISHED") finished = e;
-		return {
-			runId,
-			command: started?.command ?? fallback.command,
-			cdkdVersion: started?.cdkdVersion ?? fallback.cdkdVersion,
-			startedAt: started?.timestamp ?? fallback.startedAt,
-			finishedAt: finished?.timestamp ?? fallback.finishedAt,
-			result: finished?.result ?? "UNKNOWN",
-			eventCount: events.length
-		};
-	}
-	async readRunEvents(stackName, region, runId) {
-		const key = deploymentEventsKey(this.backend.prefix, stackName, region, runId);
-		const raw = await this.backend.getRawObject(key);
-		if (raw === null) return null;
-		const events = [];
-		for (const line of raw.split("\n")) {
-			const trimmed = line.trim();
-			if (!trimmed) continue;
-			try {
-				events.push(JSON.parse(trimmed));
-			} catch {}
-		}
-		return events;
-	}
-	async pruneRuns(stackName, region, opts = {}) {
-		const dirPrefix = deploymentsDirPrefix(this.backend.prefix, stackName, region);
-		const keys = await this.backend.listRawKeys(dirPrefix);
-		const runIdsDesc = keys.map((k) => runIdFromJsonlKey(k, dirPrefix)).filter((id) => id !== null).sort().reverse();
-		const indexKey = deploymentEventsIndexKey(this.backend.prefix, stackName, region);
-		const indexExisted = keys.includes(indexKey);
-		if (opts.all === true) {
-			const toDelete = runIdsDesc.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
-			const earlierVersions = await deleteAndPurgeEventObjects(this.backend, [...toDelete, indexKey], dirPrefix, "whole-dir");
-			return {
-				deletedRunIds: runIdsDesc,
-				remainingRunIds: [],
-				indexDeleted: indexExisted,
-				...earlierVersions !== void 0 && { earlierVersions }
-			};
-		}
-		const noGuards = opts.keep === void 0 && opts.olderThanMs === void 0;
-		const keep = opts.keep ?? (noGuards ? 20 : void 0);
-		const protectedByCount = keep === void 0 ? /* @__PURE__ */ new Set() : new Set(runIdsDesc.slice(0, keep));
-		let candidates = runIdsDesc.filter((id) => !protectedByCount.has(id));
-		if (opts.olderThanMs !== void 0) {
-			const cutoff = (opts.now ?? /* @__PURE__ */ new Date()).getTime() - opts.olderThanMs;
-			candidates = candidates.filter((id) => {
-				const t = runIdTimestampMs(id);
-				return t !== null && t < cutoff;
-			});
-		}
-		if (candidates.length === 0) return {
-			deletedRunIds: [],
-			remainingRunIds: runIdsDesc,
-			indexDeleted: false
-		};
-		const deletedSet = new Set(candidates);
-		const deleteKeys = candidates.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
-		const remainingRunIds = runIdsDesc.filter((id) => !deletedSet.has(id));
-		if (remainingRunIds.length === 0) {
-			await deleteAndPurgeEventObjects(this.backend, [...deleteKeys, indexKey], dirPrefix);
-			return {
-				deletedRunIds: candidates,
-				remainingRunIds,
-				indexDeleted: indexExisted
-			};
-		}
-		await this.rewriteIndexAfterPrune(indexKey, stackName, region, deletedSet);
-		await deleteAndPurgeEventObjects(this.backend, deleteKeys, dirPrefix);
-		return {
-			deletedRunIds: candidates,
-			remainingRunIds,
-			indexDeleted: false
-		};
-	}
-	async rewriteIndexAfterPrune(indexKey, stackName, region, deletedRunIds) {
-		let raw;
-		try {
-			raw = await this.backend.getRawObject(indexKey);
-		} catch {
-			return;
-		}
-		if (raw === null) return;
-		let parsed;
-		try {
-			parsed = JSON.parse(raw);
-		} catch {
-			return;
-		}
-		if (!Array.isArray(parsed.runs)) return;
-		const remaining = parsed.runs.filter((r) => !deletedRunIds.has(r.runId));
-		if (remaining.length === parsed.runs.length) return;
-		const file = {
-			indexVersion: 1,
-			stackName,
-			region,
-			runs: remaining,
-			lastModified: Date.now()
-		};
-		await this.backend.putRawObject(indexKey, JSON.stringify(file, null, 2));
-	}
-};
-
 //#endregion
 //#region src/deployment/orphan-adoption.ts
 function templateStillDeclares(template, record, nameProperties) {
@@ -41668,58 +41760,6 @@ async function orphanUntakenResumes(deps, stackName, finalResources) {
 	}
 }
 
-//#endregion
-//#region src/deployment/kept-in-history.ts
-function keptInEarlierRecords(records) {
-	const out = [];
-	for (const record of records) for (const [logicalId, raw] of Object.entries(record.resources)) {
-		if (raw === null || typeof raw !== "object") continue;
-		const r = raw;
-		if (typeof r.resourceType !== "string" || typeof r.physicalId !== "string") continue;
-		if (r.physicalId === "") continue;
-		if (!shouldRetainResource(r.deletionPolicy)) continue;
-		out.push({
-			logicalId,
-			resourceType: r.resourceType,
-			physicalId: r.physicalId,
-			...record.writtenAt !== void 0 && { keptAt: record.writtenAt }
-		});
-	}
-	return out;
-}
-function keptInEventHistory(runs, stackName) {
-	const made = /* @__PURE__ */ new Map();
-	const out = [];
-	for (const events of runs) for (const e of events) {
-		if (e.stackName !== stackName || typeof e.logicalId !== "string") continue;
-		if (typeof e.resourceType !== "string") continue;
-		if (e.eventType === "RESOURCE_SUCCEEDED" && (e.operation === "CREATE" || e.operation === "UPDATE") && typeof e.physicalId === "string" && e.physicalId !== "") made.set(e.logicalId, {
-			resourceType: e.resourceType,
-			physicalId: e.physicalId
-		});
-		else if (e.eventType === "RESOURCE_RETAINED") {
-			const m = made.get(e.logicalId);
-			if (m !== void 0 && m.resourceType === e.resourceType) {
-				const keptAt = Date.parse(e.timestamp);
-				out.push({
-					logicalId: e.logicalId,
-					...m,
-					...Number.isFinite(keptAt) && { keptAt }
-				});
-			}
-		}
-	}
-	return out;
-}
-async function loadKeptInHistory(sources, stackName, region) {
-	const runsOf = stackName.split("~")[0];
-	const [records, runs] = await Promise.all([sources.earlierStateResources(stackName, region).catch(() => []), (async () => {
-		const listed = (await sources.listRuns(runsOf, region)).slice(0, 20);
-		return (await Promise.all(listed.map((r) => sources.readRunEvents(runsOf, region, r.runId).catch(() => null)))).filter((e) => e !== null).reverse();
-	})().catch(() => [])]);
-	return [...keptInEarlierRecords(records), ...keptInEventHistory(runs, stackName)];
-}
-
 //#endregion
 //#region src/provisioning/canonicalize-properties.ts
 function makeCanonicalizePropertiesFn(registry) {
@@ -43101,7 +43141,7 @@ async function requireDeploymentApproval(args) {
 	} catch (error) {
 		throw error instanceof Error ? markNonRetryable(error) : error;
 	}
-	if (!approved) throw markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${args.stackName} was not approved (--require-approval=${level}). Nothing was changed.`, "DEPLOY_NOT_APPROVED"));
+	if (!approved) throw markNonRetryable(new DeploymentNotApprovedError(safeMsg`Deployment of stack ${args.stackName} was not approved (--require-approval=${level}). Nothing was changed.`));
 	return approve.autoApproves !== true;
 }
 async function checkDestructivePlan(args) {
@@ -43158,7 +43198,7 @@ async function requireOutputsOnlyApproval(args) {
 	} catch (error) {
 		throw error instanceof Error ? markNonRetryable(error) : error;
 	}
-	if (!approved) throw markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${args.stackName} was not approved (--require-approval=any-change). Nothing was changed.`, "DEPLOY_NOT_APPROVED"));
+	if (!approved) throw markNonRetryable(new DeploymentNotApprovedError(safeMsg`Deployment of stack ${args.stackName} was not approved (--require-approval=any-change). Nothing was changed.`));
 }
 function isNoEchoPromotionOnly(change) {
 	return change.changeType === "UPDATE" && (change.attributeChanges?.length ?? 0) === 0 && (change.propertyChanges?.length ?? 0) > 0 && change.propertyChanges.every((pc) => pc.noEchoPromoted === true);
@@ -47599,7 +47639,7 @@ function ccAutoRouteUpdateFailureRemedy(logicalId, resourceType, autoRoutedPrope
 
 //#endregion
 //#region src/deployment/deploy-engine/update-in-place.ts
-async function updateInPlace(engine, { conditions, counts, currentProps, currentPropsAsWritten, currentResource, dependencies, desiredForSkipCheckAsWritten, logicalId, noEchoHeldPaths, parameterValues, progress, renderer, resolvedProps, resourceType, stackName, stateResources, template, updateReplacePolicy, updateSecrets, reattach }) {
+async function updateInPlace(engine, { changedProperties, conditions, counts, currentProps, currentPropsAsWritten, currentResource, dependencies, desiredForSkipCheckAsWritten, logicalId, noEchoHeldPaths, parameterValues, progress, renderer, resolvedProps, resourceType, stackName, stateResources, template, updateReplacePolicy, updateSecrets, reattach }) {
 	engine.logger.debug(safeMsg`Updating ${logicalId} (${resourceType})`);
 	const updateDecision = engine.providerRegistry.getProviderFor({
 		resourceType,
@@ -47625,10 +47665,11 @@ async function updateInPlace(engine, { conditions, counts, currentProps, current
 	}
 	const updateProvider = updateDecision.provider;
 	const updateProps = updateDecision.provisionedBy === "cc-api" ? withoutGeneratedFallbackName(resourceType, resolvedProps, preparePropertiesForCcApi(engine.providerRegistry, resourceType, resolvedProps, logicalId, "omit")) : resolvedProps;
-	const { previous: previousWithSecretsDropped, dropped: droppedPrincipalKinds } = withUnchangedSecretPrincipalLists(resourceType, currentResource.physicalId, noEchoHeldPaths.size === 0 ? currentPropsAsWritten : {
+	const previousWithNoEchoHeld = noEchoHeldPaths.size === 0 ? currentPropsAsWritten : {
 		...currentPropsAsWritten,
 		...Object.fromEntries([...noEchoHeldPaths].filter((path) => Object.prototype.hasOwnProperty.call(updateProps, path)).map((path) => [path, updateProps[path]]))
-	}, desiredForSkipCheckAsWritten);
+	};
+	const { previous: previousWithSecretsDropped, dropped: droppedPrincipalKinds } = withUnchangedSecretPrincipalLists(resourceType, currentResource.physicalId, previousWithNoEchoHeld, desiredForSkipCheckAsWritten);
 	const reattached = reattach === true ? withRecreatedAttachmentsDropped({
 		resourceType,
 		templateProperties: template?.Resources?.[logicalId]?.Properties,
@@ -47638,6 +47679,9 @@ async function updateInPlace(engine, { conditions, counts, currentProps, current
 		conditions
 	}) : void 0;
 	const previousForUpdate = reattached?.previous ?? previousWithSecretsDropped;
+	const changedForProvider = new Set(changedProperties);
+	for (const key of /* @__PURE__ */ new Set([...Object.keys(previousWithNoEchoHeld), ...Object.keys(previousForUpdate)])) if (keyOrderFreeJson(previousForUpdate[key]) !== keyOrderFreeJson(previousWithNoEchoHeld[key])) changedForProvider.add(key);
+	if (changedForProvider.size === 0) for (const key of /* @__PURE__ */ new Set([...Object.keys(updateProps), ...Object.keys(previousForUpdate)])) changedForProvider.add(key);
 	if (reattached !== void 0) engine.logger.info(safeMsg`  ${logicalId} (${resourceType}) lost its attachment to ${reattached.parents.join(", ")}, which this deploy re-created under the same name: attaching it again`);
 	if (droppedPrincipalKinds.length > 0) {
 		const kinds = droppedPrincipalKinds.join(" / ");
@@ -47655,7 +47699,8 @@ async function updateInPlace(engine, { conditions, counts, currentProps, current
 			expectedRegion: engine.stackRegion,
 			recordedAttributes: currentResource.attributes,
 			...inlinePolicyClaimed && { inlinePolicyClaimed },
-			...removal.context
+			...removal.context,
+			changedProperties: changedForProvider
 		})), logicalId, void 0, void 0, updateProvider);
 		if (result.sentNothing === true) engine.replacementRun.updatesThatSentNothing.add(logicalId);
 		if (result.wasReplaced === true && result.outcome === "partial") engine.replacementRun.replacedOldMaySurvive.set(logicalId, result.oldResourceSurvivor === "kept" ? "kept" : "unconfirmed");
@@ -47915,6 +47960,10 @@ async function updateInPlace(engine, { conditions, counts, currentProps, current
 	engine.logger.info(safeMsg`${updatePrefix}${formatResourceLine("updated", logicalId, resourceType)}`);
 }
 
+//#endregion
+//#region src/provisioning/changed-properties-consumers.ts
+const CHANGED_PROPERTIES_CONSUMER_TYPES = /* @__PURE__ */ new Set(["AWS::ServiceDiscovery::Service"]);
+
 //#endregion
 //#region src/deployment/deploy-engine/read-provenance-moved.ts
 function occurrences(value, token) {
@@ -48285,6 +48334,7 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 	for (const path of provenanceMoved.paths) rewrittenPaths.add(path);
 	if (provenanceMoved.paths.size > 0) engine.logger.info(safeMsg`${logicalId} is sent: ${[...provenanceMoved.paths].sort().join(", ")} read a secret-derived value at a newer version than ${logicalId} was deployed with (its upstream changed since then)`);
 	const recordMatchesDesired = movedMasked.size === 0 && rewrittenPaths.size === 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten);
+	const movedAsWritten = (key) => movedMasked.has(key) || rewrittenPaths.has(key) || keyOrderFreeJson(desiredForSkipCheckAsWritten[key]) !== keyOrderFreeJson(currentPropsAsWritten[key]);
 	const applyAttributeOnlyUpdate = (attributeChanges) => {
 		const attrSummary = attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
 		engine.logger.info(safeMsg`  ↻ ${logicalId} (${resourceType}) attribute update: ${attrSummary}`);
@@ -48389,7 +48439,7 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 				lowered.push(pc);
 				continue;
 			}
-			const moved = movedMasked.has(pc.path) || rewrittenPaths.has(pc.path) || keyOrderFreeJson(desiredForSkipCheckAsWritten[pc.path]) !== keyOrderFreeJson(currentPropsAsWritten[pc.path]);
+			const moved = movedAsWritten(pc.path);
 			const conditionalVerdict = moved && !typeChanged && isReplacementCeiling(pc) ? engine.diffCalculator.conditionalReplacementVerdict?.(resourceType, pc.path, currentPropsAsWritten[pc.path], desiredForSkipCheckAsWritten[pc.path]) : void 0;
 			if (moved && conditionalVerdict !== false) {
 				warnWitnessReplacement(pc.path);
@@ -48435,7 +48485,8 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 	const parameterHeldKeys = /* @__PURE__ */ new Set();
 	const parameterUnreadablePaths = [];
 	if (pendingParameterLeaves.size > 0 && !typeChanged) {
-		const read = parameterCreateOnlyPaths.size > 0 || recordMatchesDesired ? await readOnce() : void 0;
+		const consumerReadsBack = CHANGED_PROPERTIES_CONSUMER_TYPES.has(resourceType) && currentResource.provisionedBy !== "cc-api" && [...pendingParameterLeaves.keys()].some((key) => !parameterCreateOnlyPaths.has(key) && otherFreshAt(key).length === 0);
+		const read = parameterCreateOnlyPaths.size > 0 || recordMatchesDesired || consumerReadsBack ? await readOnce() : void 0;
 		const verdictAt = (key) => {
 			if (read === void 0) return "not-readable";
 			if ("failure" in read) return read.failure;
@@ -48443,14 +48494,13 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 			return liveHoldsFreshLeaves(read.live[key], pendingParameterLeaves.get(key) ?? []) ? "held" : "differs";
 		};
 		const lowered = [];
-		const movedAt = (path) => movedMasked.has(path) || rewrittenPaths.has(path) || keyOrderFreeJson(desiredForSkipCheckAsWritten[path]) !== keyOrderFreeJson(currentPropsAsWritten[path]);
-		replacedAnyway = recreateDirectionFor(engine.options, stackName, logicalId) !== void 0 || lostWithParent !== void 0 || (change.propertyChanges ?? []).some((other) => other.requiresReplacement && (!parameterCreateOnlyPaths.has(other.path) || movedAt(other.path)));
+		replacedAnyway = recreateDirectionFor(engine.options, stackName, logicalId) !== void 0 || lostWithParent !== void 0 || (change.propertyChanges ?? []).some((other) => other.requiresReplacement && (!parameterCreateOnlyPaths.has(other.path) || movedAsWritten(other.path)));
 		for (const pc of change.propertyChanges ?? []) {
 			if (!parameterCreateOnlyPaths.has(pc.path)) {
 				lowered.push(pc);
 				continue;
 			}
-			if (movedAt(pc.path)) {
+			if (movedAsWritten(pc.path)) {
 				if (pc.requiresReplacement) warnWitnessReplacement(pc.path);
 				lowered.push(pc);
 				continue;
@@ -48603,6 +48653,11 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 		diffSawTokenChange: diffMovedServiceToken(change)
 	});
 	if (serviceTokenRefusal !== void 0) throw markRefusedBeforeApplying(markNonRetryable(new CdkdError(renderServiceTokenRefusal([serviceTokenRefusal], stackName, createSecretMasker(updateSecrets)), SERVICE_TOKEN_CHANGE_REFUSED)));
+	const changedProperties = new Set([.../* @__PURE__ */ new Set([
+		...Object.keys(desiredForSkipCheckAsWritten),
+		...Object.keys(currentPropsAsWritten),
+		...Object.keys(resolvedProps)
+	])].filter((key) => movedAsWritten(key) || !confirmedPaths.has(key) && (pendingParameterLeaves.has(key) || otherFreshAt(key).length > 0)));
 	let previousForProvider = currentPropsAsWritten;
 	for (const coordinate of witness?.confirmed ?? []) {
 		const value = valueAtCoordinate(resolvedProps, coordinate);
@@ -48613,6 +48668,7 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 		counts,
 		currentProps,
 		currentPropsAsWritten: previousForProvider,
+		changedProperties,
 		currentResource,
 		dependencies,
 		desiredForSkipCheckAsWritten,
@@ -50120,7 +50176,14 @@ var DeployEngine = class {
 			inlinePolicyClaimedFor: (...args) => this.inlinePolicyClaimedFor(...args),
 			recordEvent: (...args) => this.recordEvent(...args),
 			guardedReplacementCreate: (input, create) => guardedReplacementCreate(this, input, create),
-			generatedNameGuarded: (logicalId) => this.generatedNameGuard?.candidate(logicalId) !== void 0
+			generatedNameGuarded: (logicalId) => this.generatedNameGuard?.candidate(logicalId) !== void 0,
+			rollbackRetainedCopies: (stackName) => {
+				const reader = new DeploymentEventsReader(this.stateBackend);
+				return loadRollbackRetainedCopies({
+					listRuns: (s, r) => reader.listRuns(s, r),
+					readRunEvents: (s, r, id) => reader.readRunEvents(s, r, id)
+				}, stackName, this.stackRegion);
+			}
 		};
 	}
 	resolverContextDeps() {
@@ -50389,5 +50452,5 @@ function sameGenerationClaimsOf(record) {
 }
 
 //#endregion
-export { DeploymentEventsStore as $, refuseMalformedOutputsForDestroy as $a, validateAssetBucketName as $c, carriesDynamicReference as $i, hasPlainPrototype$1 as $l, noEchoComparisonForTemplate as $n, templateResourceTypes as $o, customResourceResponseExpirationWarning as $r, recordPhysicalNameCopy as $s, updatePartialReason as $t, inheritedProvenanceForChildDiff as A, malformedLocalResourcesWarning as Aa, importableOutputKeys as Ac, keepHeldTokenProvenance as Ai, resolveSkipPrefix as Al, formatDestructiveChange as An, hasNoCloudControlHandlers as Ao, markDeleteStarted as Ar, logOnlyValueCount as As, replayFailedOperations as At, conditionFingerprint as B, malformedResourcePropertiesWarning as Ba, WorkGraph as Bc, AWS_CREDENTIAL_ENV_KEYS as Bi, findLargeInlineResources as Bl, red as Bn, toCfnInteger as Bo, CC_BROKEN_REASON as Br, scrubResourceRecord as Bs, recordUnderIdIsNotOwn as Bt, hasCdkAutoDeleteTag as C, isReadableOrphanRecord as Ca, splitImportedOps as Cc, s3BucketDomainName as Ci, synthesisStatusMessage as Cl, isExportAliasCollision as Cn, unreadableResourceEntries as Co, unsupportedFinalSnapshotError as Cr, redactForState as Cs, makeForeignHolderScan as Ct, IMPLICIT_DELETE_DEPENDENCIES as D, malformedExportSourceWarning as Da, hasReadableExportSet as Dc, resolveDynamicReferences as Di, resolveApp as Dl, maskingRetryLogger as Dn, unwrittenCreateOnlyReplacement as Do, withCreateTokenLedger as Dr, createUnionSecretMasker as Ds, isAccessDeniedError as Dt, markRefusedBeforeApplying as E, malformedExportNamesWarning as Ea, exportNamesCarriedFrom as Ec, s3BucketWebsiteUrl as Ei, loadCdkJson as El, DEFAULT_RESOURCE_WARN_AFTER_MS as En, findSilentDropProperties as Eo, reserveStackCreateToken as Er, carryLogOnlyValues as Es, chunks as Et, findNestedTemplateTreeDefect as F, malformedOrphansWarning as Fa, shouldRetainResource as Fc, assertFlagRoleArn as Fi, warnDeprecatedNoPrefixCliFlag as Fl, replacedDeleteFailureVerdict as Fn, isStatefulRecreateTargetSync as Fo, refuseMalformedDesiredTags as Fr, unionOfSecretBags as Fs, isJournaledOrphan as Ft, diffSecurity as G, refuseDivergentRecordRegionForDestroy as Ga, AssetModeResolver as Gc, classifyReplaySecretRegion as Gi, PARTITION_TABLE as Gl, isSupersededResourceRecord as Gn, configIntegerRefusal as Go, waitForLambdaFunctionActive as Gr, isUncertifiedBaselineMaskPosition as Gs, findNestedStackTypeChanges as Gt, parentSuppliedValues as H, malformedScrubResourceEntriesRefusalMessage as Ha, createAssetRedirectResolver as Hc, callerEnvCredentials as Hi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Hl, addSuperseded as Hn, coerceCfnBoolean as Ho, ccBrokenReason as Hr, withoutPhysicalNameCopies as Hs, resolveReplacementOldType as Ht, isAbsoluteAssetPath as I, malformedOutputsRefusalMessage as Ia, stackInstanceIdCarriedFrom as Ic, assertSendableRoleArn as Ii, ssmResolvedValueType as Il, bold as In, renderStatefulReason as Io, tagMapAsList as Ir, createSecretMasker as Is, isReplacementOrphan as It, mergeNoChangeOutputs as J, refuseMalformedOrphanRecordsForDestroy as Ja, ensureAssetStorage as Jc, coerceParameterTypedValue as Ji, AssemblyReader as Jl, supersededHeldByOtherTypeWarning as Jn, replayWarn as Jo, isCustomResourceType as Jr, inheritNestedStackParameterAssociations as Js, REDACTED_DELETE_ADDRESS_SKIP_REASON as Jt, isSecretBearingReferenceString as K, refuseMalformedNestedChildOutputs as Ka, BOOTSTRAP_MARKER_PREFIX as Kc, producerRegionsFromState as Ki, canonicalizeRegion as Kl, removeSuperseded as Kn, configStringRefusal as Ko, TemplateNoEchoReresolver as Kr, pathCrossesDottedKey as Ks, getCurrentProducerRegions as Kt, listNestedTemplateRows as L, malformedOutputsWarning as La, AssetPublisher as Lc, explicitRoleArnOrThrow as Li, CFN_TEMPLATE_BODY_LIMIT as Ll, cyan as Ln, WARM_THROUGHPUT_MEMBERS as Lo, tagPlanWarning as Lr, errorCauseChain as Ls, planFailedOps as Lt, findServiceTokenRefusals as M, malformedOrphanRecordsWarning as Ma, isReadableBag as Mc, recordedOutputReferenceRegions as Mi, resolveStateBucketWithDefaultAndSource as Ml, destroyStackRecordsView as Mn, shownType as Mo, DBPROXY_TAG_OPTIONS as Mr, recordLogOnlyParameterValue as Ms, removeProtectionTypeList as Mt, serviceTokenBlockingReason as N, malformedOrphanRowsKeptWarning as Na, orphansAfterRollback as Nc, recordedReferenceRegions as Ni, resolveUseCdkBootstrapAssets as Nl, getStackRecords as Nn, MULTI_REGION_RECREATE_BLOCKED_TYPES as No, planTagDiff as Nr, recordLogOnlyValue as Ns, recordAfterRollbackUpdate as Nt, computeImplicitDeleteEdges as O, malformedLocalOutputsWarning as Oa, hasReasonlessBaselineRefusal as Oc, producerLookupOver as Oi, resolveAutoAssetStorage as Ol, constructPathOf as On, withoutSilentDropProperties as Oo, acquireIdempotencyToken as Or, hasMaskableValues as Os, lookupEachName as Ot, childTemplateLoader as P, malformedOrphansRefusalMessage as Pa, orphansCarriedFrom as Pc, applyRoleArnIfSet as Pi, stateBucketExistenceConfirmed as Pl, withStackRecords as Pn, isStatefulRecreateTargetForReplace as Po, readTagList as Pr, shareLogOnlyValues as Ps, demoteSupersededOrphans as Pt, DeploymentEventsReader as Q, refuseMalformedOutputs as Qa, readBootstrapMarkerBody as Qc, isImpossibleEmptyStoredAttribute as Qi, hasOwnKey as Ql, noEchoAttributeNamesOf as Qn, prefetchCreateOnlyPropertyPaths as Qo, applyCustomResourceResponseExpiration as Qr, recordAttributeIdCopy as Qs, updatePartialMessage as Qt, renderNestedTemplateTreeDefect as R, malformedRenderedContainersWarning as Ra, isSensitiveAttributeName as Rc, isIamRoleArn as Ri, CFN_TEMPLATE_URL_LIMIT as Rl, gray as Rn, coerceWarmThroughput as Ro, definedAttributes as Rr, maskSecretsInError as Rs, planRollback as Rt, S3_AUTO_DELETE_OBJECTS_TAG as S, hasReadableResources as Sa, withStackInstanceIdWithheld as Sc, s3BucketArn as Si, Synthesizer as Sl, collectPublishedOutputNames as Sn, unreadableOrphanRecords as So, refusesFinalSnapshot as Sr, markSameGenerationBag as Ss, loadJournaledOrphans as St, getPriorAttempts as T, malformedDriftResourcePropertiesWarning as Ta, describeRegionValueKind as Tc, s3BucketRegionalDomainName as Ti, getLegacyStateBucketName as Tl, DEFAULT_RESOURCE_TIMEOUT_MS as Tn, findActionableSilentDrops as To, ledgerForStack as Tr, snapshotPassProvenance as Ts, formatResourceLine as Tt, readRecordedConditionVerdicts as U, malformedStateRefusalMessage as Ua, loadPublishableAssetManifest as Uc, envCredentialsAreAssumedRole as Ui, decodeListingKey as Ul, deleteSupersededEntry as Un, coerceCfnInteger as Uo, isCustomResource as Ur, DYNAMIC_REFERENCE_TOKEN_SCAN as Us, seedsDeleteFirstGuard as Ut, conditionInputsFrom as V, malformedResourcesWarning as Va, buildAssetRedirectMap as Vc, applyCallerIdentityCredentials as Vi, uploadCfnTemplate as Vl, yellow as Vn, toFiniteNumber as Vo, ProviderRegistry as Vr, withPhysicalNameCopies as Vs, replacementNeverSwapped as Vt, withResourceDeadline as W, previewableOrphanRecords as Wa, rewriteTemplateAssetReferences as Wc, classifyRecordedSecretRegion as Wi, expectedOwnerParam as Wl, holdsSupersededResources as Wn, configBooleanRefusal as Wo, wouldReturnToSdkProvider as Wr, dynamicReferenceTokens as Ws, orphanNeedsIdentity as Wt, makeSiblingClaimReader as X, refuseMalformedOrphansForDestroy as Xa, isCrossRegionRedirect as Xc, parameterTypeMayLoseSecretIdentity as Xi, processStackMessages as Xl, supersededResourcesOf as Xn, requireConfigObject as Xo, withPrintingSecrets as Xr, recoverMaskedOutput as Xs, redactedDeleteAddressFields as Xt, makeCanonicalizePropertiesFn as Y, refuseMalformedOrphans as Ya, getBootstrapMarkerKey as Yc, isUnboundTemplateParameter as Yi, StageLoadError as Yl, supersededHolderOf as Yn, requireConfigArray as Yo, getCurrentResourceSecrets as Yr, recordNestedStackParameterExpressions as Ys, isRedactedRecordedValue as Yt, planOrphanAdoption as Z, refuseMalformedOrphansForOrphan as Za, parseBootstrapMarker as Zc, getAccountInfo as Zi, defineOwnKey as Zl, withoutSuperseded as Zn, requireConfigString as Zo, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Zr, physicalNameCopiesOf as Zs, redactedDeleteAddressSkip as Zt, deleteTableWithIndexBusyRetry as _, accountArgs as _a, applyCrossPrefixScan as _c, DiffCalculator as _i, runDockerForeground as _l, exportNameNoEchoParameters as _n, repairMalformedOutputsForReadOnly as _o, buildFinalSnapshotIdentifier as _r, readbackPathFor as _s, deleteJournaledOrphans as _t, isProtectionValueActive as a, isStalePlaceholderArnAttribute as aa, recordNoEchoAttributeValues as ac, deleteIndeterminateGuards as ai, describeDockerExecFailure as al, retiredNameGenerationsLeaving as an, refuseMalformedResourceEntriesForImportSave as ao, maskEventTextWithBoundBags as ar, DagBuilder as as, displacedOpClause as at, renderAssemblyPathEscape as au, waitForIndexesSettled as b, hasReadableOrphans as ba, isNotImplemented as bc, poisonRenderedSpellingsCollidingIn as bi, AssetManifestLoader as bl, noEchoParameterValueSeed as bn, repairMalformedResourcesForReadOnly as bo, effectiveDeletionPolicy as br, valueAtCoordinate as bs, isHandledOrphan as bt, DynamoDBGlobalTableProvider as c, withSharedDrainBudget as ca, wholeStringLeavesOf as cc, withIndeterminateGuard as ci, finchSecretArgvRefusal as cl, reachableDivergentParameters as cn, refuseMalformedResourcePropertiesForDrift as co, secretNamePrintingBag as cr, isMarkedCoordinate as cs, getNestedRevertRun as ct, injectedAwsRegionValue as cu, compensateRemovedDeletionProtection as d, declaresNoEcho as da, LockManager as dc, disableInstanceApiTermination as di, isDockerClientEnvKey as dl, displayTextOrWithheld as dn, refuseMalformedResourcesForDeploy as do, secretNamedRecordNeedles as dr, maskWholeValue as ds, revertNestedChildFromJournal as dt, carriesFetchableDynamicReference as ea, splitGetAttStringForm as ec, CloudControlProvider as ei, validateContainerRepoName as el, nameGenerationCarriedFrom as en, refuseMalformedResourceAttributesForOrphan as eo, noEchoExactEchoLeavesOf as er, describeTypeWithThrottleRetry as es, pendingRequestCount as et, nullPrototypeRecord as eu, deleteBudgetKey as f, JSON_LISTING_HOLE_VALUE as fa, isLockInfoExpired as fc, ec2InstanceProtectionSite as fi, isMalformedEnvKey as fl, exportAliasCollisionScrubWarning as fn, refuseMalformedResourcesForDestroy as fo, stateSecretNameNeedles as fr, maskedLeafCoordinatesOf as fs, revertedNestedRowIds as ft, INDEX_SETTLE_POLL_INTERVAL_MS as g, UNREADABLE_RESOURCES_MAP_ROW as ga, CrossPrefixScanCache as gc, reEnableInstanceApiTermination as gi, redactedDockerCause as gl, carriedExportAliasExposure as gn, repairMalformedOrphansForReadOnly as go, PRE_DELETE_SNAPSHOT_TYPES as gr, passedNoEchoParametersOf as gs, withNestedStackContext as gt, DELETE_INDEX_WAIT_PROCEED_NOTE as h, UNREADABLE_ORPHANS_CONTAINER_ROW as ha, CrossPrefixReadError as hc, reDisableInstanceApiTermination as hi, redactedCause as hl, secretSafeKeyDisplay as hn, repairMalformedOrphanRecordsForReadOnly as ho, ATOMIC_FINAL_SNAPSHOT_TYPES as hr, noEchoOutputsComparison as hs, getCurrentNestedStackContext as ht, PROTECTION_PROPERTY_BY_TYPE as i, cfnRefValueFromPhysicalId as ia, recordMaskOnlyValuesIn as ic, UNSPECIFIED_SKIP_REASON as ii, describeDockerCapturedOutput as il, retiredNameGenerationsAfter as in, refuseMalformedResourceEntriesForImport as io, journaledOrphanPrintingBag as ir, sameLambdaFunctionAddress as is, NESTED_PENDING_PARENT_REASON as it, displayAssemblyPath as iu, deferredServiceTokenWarning as j, malformedOrphanRecordsRefusalMessage as ja, importableOutputs as jc, outputReferenceProvenanceOf as ji, resolveStateBucketWithDefault as jl, awaitInFlightSibling as jn, findReplacedReadersOfRecreateTargets as jo, DBPROXY_TAGS_WHAT as jr, printingCorpusOf as js, replayRollback as jt, crossStackOutputProvenanceSource as k, malformedLocalResourceEntriesWarning as ka, hasUnverifiableParameterRefusal as kc, refuseUnreadableCdkCrossAccountRefs as ki, resolveCaptureObservedState as kl, findDestructiveChanges as kn, NO_CC_HANDLERS_REASON as ko, isRefusedByName as kr, literalSplitDelimitersOf as ks, withApiLimit as kt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, parameterInputsFor as la, WHOLE_DYNAMIC_REFERENCE_PATTERN as lc, isWaitAbandonedError as li, formatDockerLoginError as ll, resourcesNamingDeclaredParameter as ln, refuseMalformedResourcePropertiesForExport as lo, secretNamePrintingBags as lr, maskAtCoordinates as ls, nestedChildStackName as lt, clearBucketRegionCache as lu, resolveDynamoDbDeleteBudgetMs as m, STATE_RESOURCES_MALFORMED as ma, rebuildClientForBucketRegion as mc, observeThenDisableInstanceApiTermination as mi, redactDockerArgvValues as ml, secretBearingStateKeyWarning as mn, refuseMalformedState as mo, extractDeploymentEventError as mr, noEchoLeavesOf as ms, collectNestedChildUnaddressed as mt, recordedProtectionEvidence as n, keepsSecretReferenceToken as na, provenPublicValue as nc, unchangedBehindSecretReference as ni, buildDockerImage as nl, nameScopeOf as nn, refuseMalformedResourceEntriesForDeploy as no, createReadOnlyAttributeHealerFactory as nr, canonicalLambdaFunctionName as ns, keptForRetainedRecord as nt, absoluteAssemblyPathEscape as nu, perType as o, refStateLookupFromResource as oa, recordNoEchoParameterFreshValue as oc, deleteLeftInPlace as oi, describeDockerFailure as ol, computeParameterTaint as on, refuseMalformedResourceEntriesForOrphan as oo, namingSecretsWithRecordedNoEcho as or, TemplateParser as os, displacedPhysicalIdShown as ot, resolveAssemblyPath as ou, resolveDynamoDbDeleteBudgetClock as p, STATE_REGION_DIVERGED as pa, S3StateBackend as pc, isTerminationProtectionPropagationError as pi, partitionSensitiveEnv as pl, secretBearing as pn, refuseMalformedResourcesForExport as po, storedSecretNameNeedles as pr, noEchoCoordinatesOf as ps, withNestedRevertRun as pt, keptWholeReasonText as q, refuseMalformedOrphanRecords as qa, assertAssetBucketRegion as qc, regionLessSecretName as qi, derivePartitionAndUrlSuffix as ql, supersededAfterRollback as qn, readConfigString as qo, readsNoEchoDeleteValues as qr, identityKeyFor as qs, inheritProducerRegions as qt, recordedProtectionNote as r, AWS_NO_VALUE as ra, recordMaskOnlyValue as rc, RollbackInlinePolicyWriters as ri, resolveDockerContextDirectory as rl, retiredAfterRollback as rn, refuseMalformedResourceEntriesForDestroy as ro, completedReplayEntries as rr, lambdaFunctionNameForMask as rs, recordRetainedForReadoption as rt, describeFileReadFailure as ru, readProtection as s, parseWebACLArn as sa, recordProvenPublicExpression as sc, deleteSkipReason as si, dockerSpawnEnvWithSensitive as sl, namesAnyDeclaredParameter as sn, refuseMalformedResourcePropertiesForDestroy as so, orphanRecordsPrintingBag as sr, canonicalCoordinates as ss, dropSettledNestedJournals as st, injectAwsRegion as su, DeployEngine as t, isNamelessDynamicReferenceError as ta, carriesSecretMask as tc, slowCcOperationTimeoutMs as ti, buildDenyExternalAccessPolicy as tl, nameGenerationHighWaterOf as tn, refuseMalformedResourceEntries as to, noEchoParameterNamesOf as tr, withRetry as ts, resolvePendingCloudControlRequests as tt, ownValue as tu, beginDeleteWait as u, passedParameterClassesOf as ua, isSingleDynamicReferenceToken as uc, markWaitAbandoned as ui, getDockerCmd as ul, WITHHELD_NAME_DISPLAY as un, refuseMalformedResourcePropertiesForOrphan as uo, secretNamedAttributeNamesOf as ur, maskReadbackAtCoordinates as us, recordDisplacedSkips as ut, resolveBucketRegion as uu, maskedLogger as v, deployRefusesOrphanRowsReason as va, crossPrefixDeniedWarning as vc, INTRINSIC_KEYS as vi, runDockerStreaming as vl, exportNameSecretExposure as vn, repairMalformedResourceEntriesForReadOnly as vo, ccRoutedFinalSnapshotError as vr, readsNoEchoSource as vs, dropFailedCommands as vt, isTruthyCfnBoolean as w, isReadableResourceEntry as wa, acceptedCreateOnlyDropsOf as wc, s3BucketDualStackDomainName as wi, getDefaultStateBucketName as wl, bindingSkippedOutputs as wn, withheldAccountClause as wo, earliestDefined as wr, recordReferenceProvenanceEntry as ws, sameJournaledOrphans as wt, ECR_AUTO_DELETE_IMAGES_TAG as x, hasReadableOutputs as xa, stackInstanceIdOf as xc, isSettledInstanceState as xi, getDockerImageBySourceHash as xl, collectDeclaredOutputNames as xn, unpreviewableOrphanRecords as xo, isFinalSnapshotError as xr, liveMatchesUnresolvedTokenFrame as xs, journaledOrphanLines as xt, relayedIndexBusyDelete as y, displayLogicalId as ya, isAccessDenied$1 as yc, IntrinsicFunctionResolver as yi, warnFinchArgvExposure as yl, isWholeDynamicReferenceValue as yn, repairMalformedResourcePropertiesForReadOnly as yo, createPreDeleteFinalSnapshot as yr, recordedNoEchoValuesOf as ys, dropFailedHint as yt, templateIdentity as z, malformedResourceEntriesWarning as za, stringifyValue as zc, sendableAssumeRoleCommand as zi, MIGRATE_TMP_PREFIX as zl, green as zn, isWarmThroughputDecrease as zo, stringifyIfAssigned as zr, maskSecretsInText as zs, recheckFailedPlan as zt };
-//# sourceMappingURL=deploy-engine-DU0BoQqo.js.map
+export { resolvePendingCloudControlRequests as $, refuseMalformedOutputsForDestroy as $a, validateAssetBucketName as $c, carriesDynamicReference as $i, hasPlainPrototype$1 as $l, noEchoParameterNamesOf as $n, templateResourceTypes as $o, customResourceResponseExpirationWarning as $r, recordPhysicalNameCopy as $s, nameGenerationHighWaterOf as $t, inheritedProvenanceForChildDiff as A, malformedLocalResourcesWarning as Aa, importableOutputKeys as Ac, keepHeldTokenProvenance as Ai, resolveSkipPrefix as Al, destroyStackRecordsView as An, hasNoCloudControlHandlers as Ao, markDeleteStarted as Ar, logOnlyValueCount as As, removeProtectionTypeList as At, conditionFingerprint as B, malformedResourcePropertiesWarning as Ba, WorkGraph as Bc, AWS_CREDENTIAL_ENV_KEYS as Bi, findLargeInlineResources as Bl, addSuperseded as Bn, toCfnInteger as Bo, CC_BROKEN_REASON as Br, scrubResourceRecord as Bs, resolveReplacementOldType as Bt, hasCdkAutoDeleteTag as C, isReadableOrphanRecord as Ca, splitImportedOps as Cc, s3BucketDomainName as Ci, synthesisStatusMessage as Cl, DEFAULT_RESOURCE_TIMEOUT_MS as Cn, unreadableResourceEntries as Co, reserveStackCreateToken as Cr, redactForState as Cs, formatResourceLine as Ct, IMPLICIT_DELETE_DEPENDENCIES as D, malformedExportSourceWarning as Da, hasReadableExportSet as Dc, resolveDynamicReferences as Di, resolveApp as Dl, findDestructiveChanges as Dn, unwrittenCreateOnlyReplacement as Do, DeploymentEventsStore as Dr, createUnionSecretMasker as Ds, withApiLimit as Dt, markRefusedBeforeApplying as E, malformedExportNamesWarning as Ea, exportNamesCarriedFrom as Ec, s3BucketWebsiteUrl as Ei, loadCdkJson as El, constructPathOf as En, findSilentDropProperties as Eo, DeploymentEventsReader as Er, carryLogOnlyValues as Es, lookupEachName as Et, findNestedTemplateTreeDefect as F, malformedOrphansWarning as Fa, shouldRetainResource as Fc, assertFlagRoleArn as Fi, warnDeprecatedNoPrefixCliFlag as Fl, cyan as Fn, isStatefulRecreateTargetSync as Fo, refuseMalformedDesiredTags as Fr, unionOfSecretBags as Fs, planFailedOps as Ft, diffSecurity as G, refuseDivergentRecordRegionForDestroy as Ga, AssetModeResolver as Gc, classifyReplaySecretRegion as Gi, PARTITION_TABLE as Gl, supersededAfterRollback as Gn, configIntegerRefusal as Go, waitForLambdaFunctionActive as Gr, isUncertifiedBaselineMaskPosition as Gs, inheritProducerRegions as Gt, parentSuppliedValues as H, malformedScrubResourceEntriesRefusalMessage as Ha, createAssetRedirectResolver as Hc, callerEnvCredentials as Hi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Hl, holdsSupersededResources as Hn, coerceCfnBoolean as Ho, ccBrokenReason as Hr, withoutPhysicalNameCopies as Hs, orphanNeedsIdentity as Ht, isAbsoluteAssetPath as I, malformedOutputsRefusalMessage as Ia, stackInstanceIdCarriedFrom as Ic, assertSendableRoleArn as Ii, ssmResolvedValueType as Il, gray as In, renderStatefulReason as Io, tagMapAsList as Ir, createSecretMasker as Is, planRollback as It, mergeNoChangeOutputs as J, refuseMalformedOrphanRecordsForDestroy as Ja, ensureAssetStorage as Jc, coerceParameterTypedValue as Ji, AssemblyReader as Jl, supersededResourcesOf as Jn, replayWarn as Jo, isCustomResourceType as Jr, inheritNestedStackParameterAssociations as Js, redactedDeleteAddressFields as Jt, isSecretBearingReferenceString as K, refuseMalformedNestedChildOutputs as Ka, BOOTSTRAP_MARKER_PREFIX as Kc, producerRegionsFromState as Ki, canonicalizeRegion as Kl, supersededHeldByOtherTypeWarning as Kn, configStringRefusal as Ko, TemplateNoEchoReresolver as Kr, pathCrossesDottedKey as Ks, REDACTED_DELETE_ADDRESS_SKIP_REASON as Kt, listNestedTemplateRows as L, malformedOutputsWarning as La, AssetPublisher as Lc, explicitRoleArnOrThrow as Li, CFN_TEMPLATE_BODY_LIMIT as Ll, green as Ln, WARM_THROUGHPUT_MEMBERS as Lo, tagPlanWarning as Lr, errorCauseChain as Ls, recheckFailedPlan as Lt, findServiceTokenRefusals as M, malformedOrphanRecordsWarning as Ma, isReadableBag as Mc, recordedOutputReferenceRegions as Mi, resolveStateBucketWithDefaultAndSource as Ml, withStackRecords as Mn, shownType as Mo, DBPROXY_TAG_OPTIONS as Mr, recordLogOnlyParameterValue as Ms, demoteSupersededOrphans as Mt, serviceTokenBlockingReason as N, malformedOrphanRowsKeptWarning as Na, orphansAfterRollback as Nc, recordedReferenceRegions as Ni, resolveUseCdkBootstrapAssets as Nl, replacedDeleteFailureVerdict as Nn, MULTI_REGION_RECREATE_BLOCKED_TYPES as No, planTagDiff as Nr, recordLogOnlyValue as Ns, isJournaledOrphan as Nt, computeImplicitDeleteEdges as O, malformedLocalOutputsWarning as Oa, hasReasonlessBaselineRefusal as Oc, producerLookupOver as Oi, resolveAutoAssetStorage as Ol, formatDestructiveChange as On, withoutSilentDropProperties as Oo, extractDeploymentEventError as Or, hasMaskableValues as Os, replayFailedOperations as Ot, childTemplateLoader as P, malformedOrphansRefusalMessage as Pa, orphansCarriedFrom as Pc, applyRoleArnIfSet as Pi, stateBucketExistenceConfirmed as Pl, bold as Pn, isStatefulRecreateTargetForReplace as Po, readTagList as Pr, shareLogOnlyValues as Ps, isReplacementOrphan as Pt, pendingRequestCount as Q, refuseMalformedOutputs as Qa, readBootstrapMarkerBody as Qc, isImpossibleEmptyStoredAttribute as Qi, hasOwnKey as Ql, noEchoExactEchoLeavesOf as Qn, prefetchCreateOnlyPropertyPaths as Qo, applyCustomResourceResponseExpiration as Qr, recordAttributeIdCopy as Qs, nameGenerationCarriedFrom as Qt, renderNestedTemplateTreeDefect as R, malformedRenderedContainersWarning as Ra, isSensitiveAttributeName as Rc, isIamRoleArn as Ri, CFN_TEMPLATE_URL_LIMIT as Rl, red as Rn, coerceWarmThroughput as Ro, definedAttributes as Rr, maskSecretsInError as Rs, recordUnderIdIsNotOwn as Rt, S3_AUTO_DELETE_OBJECTS_TAG as S, hasReadableResources as Sa, withStackInstanceIdWithheld as Sc, s3BucketArn as Si, Synthesizer as Sl, bindingSkippedOutputs as Sn, unreadableOrphanRecords as So, ledgerForStack as Sr, markSameGenerationBag as Ss, sameJournaledOrphans as St, getPriorAttempts as T, malformedDriftResourcePropertiesWarning as Ta, describeRegionValueKind as Tc, s3BucketRegionalDomainName as Ti, getLegacyStateBucketName as Tl, maskingRetryLogger as Tn, findActionableSilentDrops as To, acquireIdempotencyToken as Tr, snapshotPassProvenance as Ts, isAccessDeniedError as Tt, readRecordedConditionVerdicts as U, malformedStateRefusalMessage as Ua, loadPublishableAssetManifest as Uc, envCredentialsAreAssumedRole as Ui, decodeListingKey as Ul, isSupersededResourceRecord as Un, coerceCfnInteger as Uo, isCustomResource as Ur, DYNAMIC_REFERENCE_TOKEN_SCAN as Us, findNestedStackTypeChanges as Ut, conditionInputsFrom as V, malformedResourcesWarning as Va, buildAssetRedirectMap as Vc, applyCallerIdentityCredentials as Vi, uploadCfnTemplate as Vl, deleteSupersededEntry as Vn, toFiniteNumber as Vo, ProviderRegistry as Vr, withPhysicalNameCopies as Vs, seedsDeleteFirstGuard as Vt, withResourceDeadline as W, previewableOrphanRecords as Wa, rewriteTemplateAssetReferences as Wc, classifyRecordedSecretRegion as Wi, expectedOwnerParam as Wl, removeSuperseded as Wn, configBooleanRefusal as Wo, wouldReturnToSdkProvider as Wr, dynamicReferenceTokens as Ws, getCurrentProducerRegions as Wt, makeSiblingClaimReader as X, refuseMalformedOrphansForDestroy as Xa, isCrossRegionRedirect as Xc, parameterTypeMayLoseSecretIdentity as Xi, processStackMessages as Xl, noEchoAttributeNamesOf as Xn, requireConfigObject as Xo, withPrintingSecrets as Xr, recoverMaskedOutput as Xs, updatePartialMessage as Xt, makeCanonicalizePropertiesFn as Y, refuseMalformedOrphans as Ya, getBootstrapMarkerKey as Yc, isUnboundTemplateParameter as Yi, StageLoadError as Yl, withoutSuperseded as Yn, requireConfigArray as Yo, getCurrentResourceSecrets as Yr, recordNestedStackParameterExpressions as Ys, redactedDeleteAddressSkip as Yt, planOrphanAdoption as Z, refuseMalformedOrphansForOrphan as Za, parseBootstrapMarker as Zc, getAccountInfo as Zi, defineOwnKey as Zl, noEchoComparisonForTemplate as Zn, requireConfigString as Zo, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Zr, physicalNameCopiesOf as Zs, updatePartialReason as Zt, deleteTableWithIndexBusyRetry as _, accountArgs as _a, applyCrossPrefixScan as _c, DiffCalculator as _i, runDockerForeground as _l, isWholeDynamicReferenceValue as _n, repairMalformedOutputsForReadOnly as _o, effectiveDeletionPolicy as _r, readbackPathFor as _s, dropFailedHint as _t, isProtectionValueActive as a, isStalePlaceholderArnAttribute as aa, recordNoEchoAttributeValues as ac, deleteIndeterminateGuards as ai, describeDockerExecFailure as al, namesAnyDeclaredParameter as an, refuseMalformedResourceEntriesForImportSave as ao, orphanRecordsPrintingBag as ar, DagBuilder as as, dropSettledNestedJournals as at, renderAssemblyPathEscape as au, waitForIndexesSettled as b, hasReadableOrphans as ba, isNotImplemented as bc, poisonRenderedSpellingsCollidingIn as bi, AssetManifestLoader as bl, collectPublishedOutputNames as bn, repairMalformedResourcesForReadOnly as bo, unsupportedFinalSnapshotError as br, valueAtCoordinate as bs, loadJournaledOrphans as bt, DynamoDBGlobalTableProvider as c, withSharedDrainBudget as ca, wholeStringLeavesOf as cc, withIndeterminateGuard as ci, finchSecretArgvRefusal as cl, WITHHELD_NAME_DISPLAY as cn, refuseMalformedResourcePropertiesForDrift as co, secretNamedAttributeNamesOf as cr, isMarkedCoordinate as cs, recordDisplacedSkips as ct, injectedAwsRegionValue as cu, compensateRemovedDeletionProtection as d, declaresNoEcho as da, LockManager as dc, disableInstanceApiTermination as di, isDockerClientEnvKey as dl, secretBearing as dn, refuseMalformedResourcesForDeploy as do, storedSecretNameNeedles as dr, maskWholeValue as ds, withNestedRevertRun as dt, carriesFetchableDynamicReference as ea, splitGetAttStringForm as ec, CloudControlProvider as ei, validateContainerRepoName as el, nameScopeOf as en, refuseMalformedResourceAttributesForOrphan as eo, createReadOnlyAttributeHealerFactory as er, describeTypeWithThrottleRetry as es, keptForRetainedRecord as et, nullPrototypeRecord as eu, deleteBudgetKey as f, JSON_LISTING_HOLE_VALUE as fa, isLockInfoExpired as fc, ec2InstanceProtectionSite as fi, isMalformedEnvKey as fl, secretBearingStateKeyWarning as fn, refuseMalformedResourcesForDestroy as fo, ATOMIC_FINAL_SNAPSHOT_TYPES as fr, maskedLeafCoordinatesOf as fs, collectNestedChildUnaddressed as ft, INDEX_SETTLE_POLL_INTERVAL_MS as g, UNREADABLE_RESOURCES_MAP_ROW as ga, CrossPrefixScanCache as gc, reEnableInstanceApiTermination as gi, redactedDockerCause as gl, exportNameSecretExposure as gn, repairMalformedOrphansForReadOnly as go, createPreDeleteFinalSnapshot as gr, passedNoEchoParametersOf as gs, dropFailedCommands as gt, DELETE_INDEX_WAIT_PROCEED_NOTE as h, UNREADABLE_ORPHANS_CONTAINER_ROW as ha, CrossPrefixReadError as hc, reDisableInstanceApiTermination as hi, redactedCause as hl, exportNameNoEchoParameters as hn, repairMalformedOrphanRecordsForReadOnly as ho, ccRoutedFinalSnapshotError as hr, noEchoOutputsComparison as hs, deleteJournaledOrphans as ht, PROTECTION_PROPERTY_BY_TYPE as i, cfnRefValueFromPhysicalId as ia, recordMaskOnlyValuesIn as ic, UNSPECIFIED_SKIP_REASON as ii, describeDockerCapturedOutput as il, computeParameterTaint as in, refuseMalformedResourceEntriesForImport as io, namingSecretsWithRecordedNoEcho as ir, sameLambdaFunctionAddress as is, displacedPhysicalIdShown as it, displayAssemblyPath as iu, deferredServiceTokenWarning as j, malformedOrphanRecordsRefusalMessage as ja, importableOutputs as jc, outputReferenceProvenanceOf as ji, resolveStateBucketWithDefault as jl, getStackRecords as jn, findReplacedReadersOfRecreateTargets as jo, DBPROXY_TAGS_WHAT as jr, printingCorpusOf as js, recordAfterRollbackUpdate as jt, crossStackOutputProvenanceSource as k, malformedLocalResourceEntriesWarning as ka, hasUnverifiableParameterRefusal as kc, refuseUnreadableCdkCrossAccountRefs as ki, resolveCaptureObservedState as kl, awaitInFlightSibling as kn, NO_CC_HANDLERS_REASON as ko, isRefusedByName as kr, literalSplitDelimitersOf as ks, replayRollback as kt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, parameterInputsFor as la, WHOLE_DYNAMIC_REFERENCE_PATTERN as lc, isWaitAbandonedError as li, formatDockerLoginError as ll, displayTextOrWithheld as ln, refuseMalformedResourcePropertiesForExport as lo, secretNamedRecordNeedles as lr, maskAtCoordinates as ls, revertNestedChildFromJournal as lt, clearBucketRegionCache as lu, resolveDynamoDbDeleteBudgetMs as m, STATE_RESOURCES_MALFORMED as ma, rebuildClientForBucketRegion as mc, observeThenDisableInstanceApiTermination as mi, redactDockerArgvValues as ml, carriedExportAliasExposure as mn, refuseMalformedState as mo, buildFinalSnapshotIdentifier as mr, noEchoLeavesOf as ms, withNestedStackContext as mt, recordedProtectionEvidence as n, keepsSecretReferenceToken as na, provenPublicValue as nc, unchangedBehindSecretReference as ni, buildDockerImage as nl, retiredNameGenerationsAfter as nn, refuseMalformedResourceEntriesForDeploy as no, journaledOrphanPrintingBag as nr, canonicalLambdaFunctionName as ns, NESTED_PENDING_PARENT_REASON as nt, absoluteAssemblyPathEscape as nu, perType as o, refStateLookupFromResource as oa, recordNoEchoParameterFreshValue as oc, deleteLeftInPlace as oi, describeDockerFailure as ol, reachableDivergentParameters as on, refuseMalformedResourceEntriesForOrphan as oo, secretNamePrintingBag as or, TemplateParser as os, getNestedRevertRun as ot, resolveAssemblyPath as ou, resolveDynamoDbDeleteBudgetClock as p, STATE_REGION_DIVERGED as pa, S3StateBackend as pc, isTerminationProtectionPropagationError as pi, partitionSensitiveEnv as pl, secretSafeKeyDisplay as pn, refuseMalformedResourcesForExport as po, PRE_DELETE_SNAPSHOT_TYPES as pr, noEchoCoordinatesOf as ps, getCurrentNestedStackContext as pt, keptWholeReasonText as q, refuseMalformedOrphanRecords as qa, assertAssetBucketRegion as qc, regionLessSecretName as qi, derivePartitionAndUrlSuffix as ql, supersededHolderOf as qn, readConfigString as qo, readsNoEchoDeleteValues as qr, identityKeyFor as qs, isRedactedRecordedValue as qt, recordedProtectionNote as r, AWS_NO_VALUE as ra, recordMaskOnlyValue as rc, RollbackInlinePolicyWriters as ri, resolveDockerContextDirectory as rl, retiredNameGenerationsLeaving as rn, refuseMalformedResourceEntriesForDestroy as ro, maskEventTextWithBoundBags as rr, lambdaFunctionNameForMask as rs, displacedOpClause as rt, describeFileReadFailure as ru, readProtection as s, parseWebACLArn as sa, recordProvenPublicExpression as sc, deleteSkipReason as si, dockerSpawnEnvWithSensitive as sl, resourcesNamingDeclaredParameter as sn, refuseMalformedResourcePropertiesForDestroy as so, secretNamePrintingBags as sr, canonicalCoordinates as ss, nestedChildStackName as st, injectAwsRegion as su, DeployEngine as t, isNamelessDynamicReferenceError as ta, carriesSecretMask as tc, slowCcOperationTimeoutMs as ti, buildDenyExternalAccessPolicy as tl, retiredAfterRollback as tn, refuseMalformedResourceEntries as to, completedReplayEntries as tr, withRetry as ts, recordRetainedForReadoption as tt, ownValue as tu, beginDeleteWait as u, passedParameterClassesOf as ua, isSingleDynamicReferenceToken as uc, markWaitAbandoned as ui, getDockerCmd as ul, exportAliasCollisionScrubWarning as un, refuseMalformedResourcePropertiesForOrphan as uo, stateSecretNameNeedles as ur, maskReadbackAtCoordinates as us, revertedNestedRowIds as ut, resolveBucketRegion as uu, maskedLogger as v, deployRefusesOrphanRowsReason as va, crossPrefixDeniedWarning as vc, INTRINSIC_KEYS as vi, runDockerStreaming as vl, noEchoParameterValueSeed as vn, repairMalformedResourceEntriesForReadOnly as vo, isFinalSnapshotError as vr, readsNoEchoSource as vs, isHandledOrphan as vt, isTruthyCfnBoolean as w, isReadableResourceEntry as wa, acceptedCreateOnlyDropsOf as wc, s3BucketDualStackDomainName as wi, getDefaultStateBucketName as wl, DEFAULT_RESOURCE_WARN_AFTER_MS as wn, withheldAccountClause as wo, withCreateTokenLedger as wr, recordReferenceProvenanceEntry as ws, chunks as wt, ECR_AUTO_DELETE_IMAGES_TAG as x, hasReadableOutputs as xa, stackInstanceIdOf as xc, isSettledInstanceState as xi, getDockerImageBySourceHash as xl, isExportAliasCollision as xn, unpreviewableOrphanRecords as xo, earliestDefined as xr, liveMatchesUnresolvedTokenFrame as xs, makeForeignHolderScan as xt, relayedIndexBusyDelete as y, displayLogicalId as ya, isAccessDenied$1 as yc, IntrinsicFunctionResolver as yi, warnFinchArgvExposure as yl, collectDeclaredOutputNames as yn, repairMalformedResourcePropertiesForReadOnly as yo, refusesFinalSnapshot as yr, recordedNoEchoValuesOf as ys, journaledOrphanLines as yt, templateIdentity as z, malformedResourceEntriesWarning as za, stringifyValue as zc, sendableAssumeRoleCommand as zi, MIGRATE_TMP_PREFIX as zl, yellow as zn, isWarmThroughputDecrease as zo, stringifyIfAssigned as zr, maskSecretsInText as zs, replacementNeverSwapped as zt };
+//# sourceMappingURL=deploy-engine-CYVt2NQR.js.map