@go-to-k/cdkd 0.309.0 → 0.311.0

package/dist/{deploy-engine-tQ0aqZMo.js → deploy-engine-BF5exXUb.js}

@@ -1,8 +1,8 @@
 import { c as __exportAll, r as getAwsClients } from "./aws-clients-Bu9EMILF.js";
 import { A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, D as getCurrentStackInstanceId, E as getCurrentSkipPrefix, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, L as withStackScopeBeforeStateRead, N as stackInstanceNameSuffix, O as getCurrentStackName, P as withNameGeneration, Q as safeMsg, R as withoutGeneratedFallbackName, S as fallbackNamePropertyFor, T as generatedNameFor, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify$1, c as isStdoutReservedForPayload, et as terminalSafe, f as currentLogLineMasker, j as looksLikeCdkdGeneratedName, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, q as displaySafe, s as getLogger, t as VERBOSE_POINTER, tt as truncateCodePoints, v as applyDefaultNameForFallback, w as generateResourceNameWithFallback, x as explicitNamePropertyFor, y as currentNameGeneration, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-NSBdKPYK.js";
-import { $n as isUpdateUnsupportedError, An as StateError, At as carryCreatedBeforeFailure, B as compensateProtectionFlip, Bn as UNSHOWABLE_VALUE, Bt as replayMadeAnotherResource, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, E as isMarkedNotGone, En as ResourceTimeoutError, Et as maskDeep, F as refusalTypeShown, Fn as normalizeAwsError, Ft as isAuxiliaryFailure, Gn as physicalIdShownBesideCommand, Gt as formatLockExpiry, H as deleteWithProtectionCompensation, Ht as buildForceUnlockCommand, It as isAuxiliaryMarkOf, J as observeThenDisableProtection, Jn as shellBoundedDisplay, Jt as recoveryCommandFlags, K as isTerminalDeleteFailure, Kn as plainOrDescribed, Kt as formatLockOperation, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, Mt as createdBeforeFailure, N as normalizeAwsTagsToCfn, Nt as createdResourceIdentityBeforeFailure, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Pn as isSoftAbort, Pt as hasCreatedBeforeFailure, Qt as injectiveKey, Rn as SHELL_ACTIVE, Rt as markCreatedBeforeFailure, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Y as protectionFlipKey, Yn as shellQuote, Yt as sanitizeRecoveryValue, Z as runDeleteAttempt, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, at as protectedReplacementAdvice, bn as LockError, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp$3, ct as monotonicNowMs, d as prepareRemovalForUpdate, er as hasReplayMayCollide, et as DELETION_PROTECTION_DOC_POINTER, f as removalWarning, fn as CrossAccountSecretRefusalError, fr as formatRetryClassificationSignals, ft as isInterruptedWaitError, gn as DynamicReferenceRegionAmbiguousError, gr as isIamPropagationError, gt as compositeIdSeparatorRefusal, hn as DeploymentNotApprovedError, i as holdsSecretDerivedEntry, in as ambientClientDefaults, ir as isReplayedNameCollisionFrom, it as pasteableAwsCommand, jn as SynthesisError, kt as RETRY_AUXILIARY_OWNER, l as withUnchangedSecretPrincipalLists, ln as AssetError, lr as stripControlChars, m as withoutInjectedRemovals, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nr as isNameCooldownError, on as clientDefaultsFor, or as markReplayMayCollide, pn as DependencyError, pr as isAmbiguousCcHandlerErrorCode, pt as startInterruptWatch, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rr as isRecreateRetryableError, sn as credentialFingerprint, sr as relayedNameCollision, st as ElapsedBudgetRegistry, tn as producerRecordKey, tr as isNameCollisionErrorFrom, un as CdkdError, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, xn as MacroExpansionError, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, yr as retryClassificationText, z as ProtectionFlipRegistry, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-D94wh05t.js";
+import { $ as observeThenDisableProtection, $n as shellBoundedDisplay, $t as recoveryCommandFlags, A as RESOURCE_NOT_FOUND, An as ProvisioningError, Ar as wrapMaskedAwsError, At as isSecretDerivedValue, B as refusalTypeShown, Bn as normalizeAwsError, Bt as isAuxiliaryFailure, Cr as isTransientServerError, Ct as logicalIdShown, Dn as MalformedProducerRecordRefusalError, Dr as isThrottlingError, Dt as stateOrphanRecordRemedy, En as MacroExpansionError, Er as isMarkedNonRetryable, Et as segmentAfterAnchor, Fn as StateError, Ft as carryCreatedBeforeFailure, G as compensateProtectionFlip, Gn as UNSHOWABLE_VALUE, Gt as replayMadeAnotherResource, H as resolveExplicitPhysicalId, Ht as markAuxiliaryFailure, In as SynthesisError, Jn as isInertUnquoted, Kn as commandHole, Kt as UNREPRODUCIBLE_LOCK_CLAUSE, L as isQuotableImportValue, Lt as createdBeforeFailure, M as markNotGone, Mn as ResourceUpdateNotSupportedError, Mt as maskerOrIdentity, N as assertRegionMatch, Nt as withDerivedNameMasks, Or as markNonRetryable, Ot as createMaskedLogSinks, Pt as RETRY_AUXILIARY_OWNER, Qn as quotedOrDescribed, Qt as formatLockOwner, R as normalizeAwsTagsToCfn, Rt as createdResourceIdentityBeforeFailure, Sn as IntrinsicResolutionRefusalError, Sr as isRetryableTransientError, Tn as LockError, Tt as resourceTypeShown, Un as SHELL_ACTIVE, Ut as markCreatedBeforeFailure, Vt as isAuxiliaryMarkOf, W as ProtectionFlipRegistry, Wn as SHELL_ACTIVE_WHY, Xn as physicalIdShownBesideCommand, Xt as formatLockExpiry, Yn as pasteableCommand, Z as isTerminalDeleteFailure, Zn as plainOrDescribed, Zt as formatLockOperation, _ as removalWarning, _n as CrossAccountSecretRefusalError, _r as formatRetryClassificationSignals, _t as isInterruptedWaitError, a as retractCreatedResource, ar as hasReplayMayCollide, at as DELETION_PROTECTION_DOC_POINTER, bn as DeploymentNotApprovedError, cn as withPasteableAwsProfile, cr as isRecreateRetryableError, dn as clientDefaultsFor, dr as markReplayMayCollide, en as sanitizeRecoveryValue, er as shellQuote, et as protectionFlipKey, fn as credentialFingerprint, fr as relayedNameCollision, ft as ElapsedBudgetRegistry, g as prepareRemovalForUpdate, hn as CdkdError, i as reportCreatedResource, ir as isUpdateUnsupportedError, j as isMarkedNotGone, jn as ResourceTimeoutError, jt as maskDeep, k as withoutServerErrorRetries, kr as markRedactedCause, kt as createMaskedRetryLogger, l as holdsSecretDerivedEntry, ln as ambientClientDefaults, lr as isReplayedNameCollisionFrom, lt as pasteableAwsCommand, m as withUnchangedSecretPrincipalLists, mn as AssetError, mr as stripControlChars, n as clearCreatedReport, nn as DEFAULT_STATE_PREFIX, nt as runDeleteAttempt, on as producerRecordKey, or as isNameCollisionErrorFrom, pn as AccountIdUnavailableError, pr as escapeRegExp$3, pt as monotonicNowMs, q as deleteWithProtectionCompensation, qt as buildForceUnlockCommand, r as collectCreatedResources, rn as injectiveKey, sr as isNameCooldownError, t as CreatedResourceSink, tn as CUSTOM_RESOURCE_RESPONSE_PREFIX, tr as withheldTargetClause, un as ambientCredentialConfig, ut as protectedReplacementAdvice, vn as DependencyError, vr as isAmbiguousCcHandlerErrorCode, vt as startInterruptWatch, wr as retryClassificationText, xn as DynamicReferenceRegionAmbiguousError, xr as isIamPropagationError, xt as compositeIdSeparatorRefusal, y as withoutInjectedRemovals, yr as isAmbiguousOutcomeError, yt as canonicalizeRoute53QueryName, z as quotedRemedyLogicalId, zn as isSoftAbort, zt as hasCreatedBeforeFailure } from "./created-resource-sink-DlzoIY-1.js";
 import { a as setAssumedRoleCredentials, c as ambientRegion, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as quietS3Logger, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BX9Y_fKp.js";
-import { t as getCdkdVersion } from "./version-9LVuCtBU.js";
+import { t as getCdkdVersion } from "./version-BA4rBBLp.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4987,7 +4987,8 @@ const STATE_SCHEMA_VERSIONS_READABLE = [
 	11,
 	12,
 	13,
-	14
+	14,
+	15
 ];
 function hasUnverifiableParameterRefusal(record) {
 	return record?.observedBaselineRefused === true && record.observedBaselineRefusalReason === "unverifiable-parameter";
@@ -6047,7 +6048,7 @@ var S3StateBackend = class S3StateBackend {
 		const body = {
 			...state,
 			...stackInstanceIdCarriedFrom(state),
-			version: 14,
+			version: 15,
 			stackName,
 			region
 		};
@@ -10278,6 +10279,11 @@ function scrubResourceRecord(record, secrets, sourceProperties, observedProvenan
 			secrets
 		});
 	}
+	const attemptedItems = record.unsettledItems;
+	if (typeof attemptedItems === "object" && attemptedItems !== null && !Array.isArray(attemptedItems)) next.unsettledItems = redactForState(attemptedItems, {
+		provenance: "value-scan",
+		secrets
+	});
 	if (record.observedProperties) next.observedProperties = redactAtProvenance(record.observedProperties, secrets, sourceProperties ?? next.properties, observedProvenance ?? (sourceProperties !== void 0 ? "template-sourced" : secrets.size === 0 && observedClaimed ? "state-baseline" : "state-readback"), observedClaimed);
 	return next;
 }
@@ -15233,6 +15239,7 @@ const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 	"AWS::MemoryDB::Snapshot",
 	"AWS::Redshift::Snapshot",
 	"AWS::Timestream::InfluxDBBackup",
+	"AWS::EC2::Snapshot",
 	"AWS::StorageGateway::Volume",
 	"AWS::FSx::FileCache",
 	"AWS::DirectoryService::MicrosoftAD",
@@ -16283,21 +16290,20 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"AgentRuntimeArtifact",
 			"AgentRuntimeName",
 			"AuthorizerConfiguration",
+			"CapacityProviderConfiguration",
 			"ClientToken",
 			"Description",
 			"EnvironmentVariables",
+			"FilesystemConfigurations",
 			"LifecycleConfiguration",
 			"NetworkConfiguration",
+			"PlatformVersion",
 			"ProtocolConfiguration",
-			"RoleArn"
-		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["CapacityProviderConfiguration", "not yet implemented by cdkd"],
-			["FilesystemConfigurations", "not yet implemented by cdkd"],
-			["PlatformVersion", "not yet implemented by cdkd"],
-			["RequestHeaderConfiguration", "not yet implemented by cdkd"],
-			["Tags", "not yet implemented by cdkd"]
+			"RequestHeaderConfiguration",
+			"RoleArn",
+			"Tags"
 		]),
+		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
 			"AgentRuntimeArn",
@@ -16399,6 +16405,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::CloudTrail::Trail", {
 		handled: /* @__PURE__ */ new Set([
+			"AdvancedEventSelectors",
+			"AggregationConfigurations",
 			"CloudWatchLogsLogGroupArn",
 			"CloudWatchLogsRoleArn",
 			"EnableLogFileValidation",
@@ -16415,13 +16423,14 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Tags",
 			"TrailName"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["AdvancedEventSelectors", "not yet implemented by cdkd"], ["AggregationConfigurations", "not yet implemented by cdkd"]]),
+		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Arn", "SnsTopicArn"]),
 		ccRouteUnavailable: false
 	}],
 	["AWS::CloudWatch::Alarm", {
 		handled: /* @__PURE__ */ new Set([
+			"ActionConfiguration",
 			"ActionsEnabled",
 			"AlarmActions",
 			"AlarmDescription",
@@ -16430,7 +16439,10 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"DatapointsToAlarm",
 			"Dimensions",
 			"EvaluateLowSampleCountPercentile",
+			"EvaluationCriteria",
+			"EvaluationInterval",
 			"EvaluationPeriods",
+			"EvaluationWindow",
 			"ExtendedStatistic",
 			"InsufficientDataActions",
 			"MetricName",
@@ -16443,15 +16455,10 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Threshold",
 			"ThresholdMetricId",
 			"TreatMissingData",
-			"Unit"
-		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["ActionConfiguration", "not yet implemented by cdkd"],
-			["EvaluationCriteria", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."],
-			["EvaluationInterval", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."],
-			["EvaluationWindow", "not yet implemented by cdkd"],
-			["WarmUpConfiguration", "not yet implemented by cdkd"]
+			"Unit",
+			"WarmUpConfiguration"
 		]),
+		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Arn"]),
 		ccRouteUnavailable: false
@@ -17993,7 +18000,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"RetentionInDays",
 			"Tags"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["ResourcePolicyDocument", "covered by the separate account-wide AWS::Logs::ResourcePolicy resource type; logs:PutResourcePolicy is account-scoped, not per-log-group, so it has no CreateLogGroup / PutRetentionPolicy counterpart — routed via Cloud Control instead"]]),
+		silentDrop: /* @__PURE__ */ new Map([["ResourcePolicyDocument", "not driven by this provider by decision (issue #1412): no CreateLogGroup / PutRetentionPolicy member carries it, and both policy lifecycles — the account-scoped AWS::Logs::ResourcePolicy type and the log-group-scoped logs:PutResourcePolicy (resourceArn + policyScope RESOURCE) — are ones this provider does not take on — routed via Cloud Control, whose handler applies it"]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Arn"]),
 		ccRouteUnavailable: false
@@ -18477,17 +18484,16 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::S3Express::DirectoryBucket", {
 		handled: /* @__PURE__ */ new Set([
+			"BucketEncryption",
 			"BucketName",
 			"DataRedundancy",
+			"InventoryConfigurations",
+			"LifecycleConfiguration",
 			"LocationName",
+			"MetricsConfigurations",
 			"Tags"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["BucketEncryption", "not yet implemented by cdkd"],
-			["InventoryConfigurations", "not yet implemented by cdkd"],
-			["LifecycleConfiguration", "not yet implemented by cdkd"],
-			["MetricsConfigurations", "not yet implemented by cdkd"]
-		]),
+		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Arn", "AvailabilityZoneName"]),
 		ccRouteUnavailable: false
@@ -18768,25 +18774,24 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::WAFv2::WebACL", {
 		handled: /* @__PURE__ */ new Set([
+			"ApplicationConfig",
 			"AssociationConfig",
 			"CaptchaConfig",
 			"ChallengeConfig",
 			"CustomResponseBodies",
+			"DataProtectionConfig",
 			"DefaultAction",
 			"Description",
+			"MonetizationConfig",
 			"Name",
+			"OnSourceDDoSProtectionConfig",
 			"Rules",
 			"Scope",
 			"Tags",
 			"TokenDomains",
 			"VisibilityConfig"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["ApplicationConfig", "not yet implemented by cdkd"],
-			["DataProtectionConfig", "not yet implemented by cdkd"],
-			["MonetizationConfig", "not yet implemented by cdkd"],
-			["OnSourceDDoSProtectionConfig", "not yet implemented by cdkd"]
-		]),
+		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set([
 			"Arn",
@@ -26004,14 +26009,80 @@ function withUnsettledProperties(record, names) {
 	};
 }
 function withoutUnsettledProperties(record) {
-	if (!Object.hasOwn(record, "unsettledProperties")) return record;
-	const { unsettledProperties: _cleared, ...rest } = record;
+	if (!Object.hasOwn(record, "unsettledProperties") && !Object.hasOwn(record, "unsettledItems")) return record;
+	const { unsettledProperties: _cleared, unsettledItems: _items, ...rest } = record;
 	return rest;
 }
+const UNSETTLED_ITEMS_PER_PATH_CAP = 100;
+const UNSETTLED_ITEM_LENGTH_CAP = 255;
+function unsettledItemsTopKey(path) {
+	const cut = path.search(/[.[]/);
+	return cut === -1 ? path : path.slice(0, cut);
+}
+function unsettledItemsOf(record) {
+	const out = /* @__PURE__ */ new Map();
+	if (record === null || typeof record !== "object") return out;
+	const value = record.unsettledItems;
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return out;
+	const unsettled = unsettledPropertiesOf(record);
+	for (const [path, entries] of Object.entries(value)) {
+		if (!unsettled.has(unsettledItemsTopKey(path))) continue;
+		if (!Array.isArray(entries) || entries.length > 100) continue;
+		const names = entries.filter((entry) => typeof entry === "string" && entry !== "" && entry.length <= 255);
+		if (names.length > 0) out.set(path, new Set(names));
+	}
+	return out;
+}
+function isUsableAttemptedName(name) {
+	return !name.includes("{{resolve:") && !name.includes("***");
+}
+function withUnsettledItems(record, items) {
+	const merged = /* @__PURE__ */ new Map();
+	for (const [path, names] of unsettledItemsOf(record)) merged.set(path, new Set(names));
+	const unsettled = unsettledPropertiesOf(record);
+	let added = false;
+	for (const [path, names] of items) {
+		if (!unsettled.has(unsettledItemsTopKey(path))) continue;
+		const set = merged.get(path) ?? /* @__PURE__ */ new Set();
+		for (const name of names) {
+			if (typeof name !== "string" || name === "" || name.length > 255) continue;
+			if (!set.has(name)) {
+				set.add(name);
+				added = true;
+			}
+		}
+		if (set.size > 0) merged.set(path, set);
+	}
+	if (!added) return record;
+	const field = {};
+	for (const [path, set] of [...merged].sort(([a], [b]) => a.localeCompare(b))) if (set.size <= 100) field[path] = [...set].sort();
+	return {
+		...record,
+		unsettledItems: field
+	};
+}
+function unsettledItemsField(source, keys) {
+	const allowed = new Set(keys);
+	const field = {};
+	for (const [path, names] of unsettledItemsOf(source)) if (allowed.has(unsettledItemsTopKey(path))) field[path] = [...names].sort();
+	return Object.keys(field).length > 0 ? { unsettledItems: field } : {};
+}
 function unsettledContextOf(...records) {
 	const names = /* @__PURE__ */ new Set();
-	for (const record of records) for (const name of unsettledPropertiesOf(record)) names.add(name);
-	return names.size > 0 ? { unsettledProperties: names } : {};
+	const items = /* @__PURE__ */ new Map();
+	for (const record of records) {
+		for (const name of unsettledPropertiesOf(record)) names.add(name);
+		for (const [path, set] of unsettledItemsOf(record)) {
+			const merged = items.get(path) ?? /* @__PURE__ */ new Set();
+			for (const name of set) merged.add(name);
+			items.set(path, merged);
+		}
+	}
+	if (names.size === 0) return {};
+	return {
+		unsettledProperties: names,
+		...items.size > 0 && { unsettledItems: items }
+	};
 }
 
 //#endregion
@@ -28669,7 +28740,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DQoKGfKH.js");
+			const { ASGProvider } = await import("./asg-provider-CIg_guZ-.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -28778,7 +28849,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-Qpf09VQv.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DmVmx69p.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-0LUsn9Wl.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-D9ac71Ca.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -35756,7 +35827,50 @@ function noEchoAttributeNamesFor(run, logicalId, record, carried, leaves) {
 	if (declared === void 0 && prior === void 0 && !echoed) return void 0;
 	return [...names].sort();
 }
+function withNoEchoItemsMasked(run, deps, logicalId, record) {
+	const items = record.unsettledItems;
+	if (typeof items !== "object" || items === null || Array.isArray(items)) return record;
+	const secrets = deps.perResourceSecrets().get(logicalId);
+	const plaintexts = secrets === void 0 ? [] : noEchoParameterPlaintextsOf(secrets).filter((plaintext) => plaintext !== "");
+	const positioned = /* @__PURE__ */ new Set();
+	for (const json of run.noEchoPositionedValues.get(logicalId) ?? []) {
+		let value;
+		try {
+			value = JSON.parse(json);
+		} catch {
+			continue;
+		}
+		if (typeof value === "string" && value !== "") positioned.add(value);
+	}
+	if (plaintexts.length === 0 && positioned.size === 0) return record;
+	return withAttemptedItemsMasked(record, [...positioned, ...plaintexts]);
+}
+function withAttemptedItemsMasked(record, needles) {
+	const items = record.unsettledItems;
+	if (typeof items !== "object" || items === null || Array.isArray(items)) return record;
+	const usable = needles.filter((needle) => needle !== "" && needle !== "***");
+	if (usable.length === 0) return record;
+	let changed = false;
+	const masked = {};
+	for (const [path, entries] of Object.entries(items)) {
+		if (!Array.isArray(entries)) {
+			masked[path] = entries;
+			continue;
+		}
+		masked[path] = [...new Set(entries.map((entry) => {
+			if (typeof entry !== "string") return entry;
+			const served = usable.some((needle) => entry.includes(needle));
+			if (served) changed = true;
+			return served ? "***" : entry;
+		}))];
+	}
+	return changed ? {
+		...record,
+		unsettledItems: masked
+	} : record;
+}
 function applyNoEchoPersist(run, deps, logicalId, record, scrubbed, templateProps, resources, secrets, carried = false) {
+	scrubbed = withNoEchoItemsMasked(run, deps, logicalId, scrubbed);
 	const sources = noEchoPositionSources(run, resources);
 	if (sources === void 0) return scrubbed;
 	const leaves = noEchoLeavesFor(run, deps, logicalId, record, templateProps, sources);
@@ -37256,6 +37370,10 @@ function maskingRetryLogger(logger, secrets) {
 //#region src/deployment/deploy-engine/options.ts
 const DEFAULT_RESOURCE_WARN_AFTER_MS = 3e5;
 const DEFAULT_RESOURCE_TIMEOUT_MS = 18e5;
+const DEFAULT_UNSETTLED_REVERT_WAIT = {
+	timeoutMs: DEFAULT_RESOURCE_TIMEOUT_MS,
+	pollMs: 1e4
+};
 
 //#endregion
 //#region src/analyzer/skipped-outputs.ts
@@ -39531,7 +39649,7 @@ const MERGE_SEMANTICS_KEYS = /* @__PURE__ */ new Set(["Tags"]);
 async function readLive(args, names) {
 	const { provider, physicalId, logicalId, resourceType, recordedProperties } = args;
 	let live;
-	if (provider.readUnsettled !== void 0) live = await provider.readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, args.desired);
+	if (provider.readUnsettled !== void 0) live = await provider.readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, args.desired, args.attemptedItems);
 	else if (provider.readCurrentState !== void 0) live = await provider.readCurrentState(physicalId, logicalId, resourceType, recordedProperties);
 	else return;
 	if (typeof live !== "object" || live === null || Array.isArray(live)) return "unreadable";
@@ -39549,23 +39667,55 @@ async function settleUnsettledPrevious(args) {
 		if (moving.size > 0) throw refusal(args, moving, "AWS is still changing it or cdkd could not confirm it settled");
 	}
 	const substituted = new Set([...names].filter((name) => !MERGE_SEMANTICS_KEYS.has(name)));
-	if (substituted.size === 0) return previous;
+	const attemptedTags = [...args.attemptedItems?.get("Tags") ?? []].filter(isUsableAttemptedName);
+	const mergeNeedsLive = names.has("Tags") && attemptedTags.length > 0;
+	if (substituted.size === 0 && !mergeNeedsLive) return previous;
 	let live;
 	try {
-		live = await readLive(args, substituted);
+		live = await readLive(args, substituted.size > 0 ? substituted : /* @__PURE__ */ new Set(["Tags"]));
 	} catch (error) {
+		if (substituted.size === 0) return previous;
 		if (error instanceof ProvisioningError) throw error;
 		const wrapped = refusal(args, substituted, "the resource could not be read to converge it");
 		if (error instanceof Error) wrapped.cause = error;
 		throw wrapped;
 	}
 	if (live === void 0) return previous;
-	if (live === "unreadable") throw refusal(args, substituted, "the resource could not be read to converge it");
+	if (live === "unreadable") {
+		if (substituted.size === 0) return previous;
+		throw refusal(args, substituted, "the resource could not be read to converge it");
+	}
 	const out = { ...previous };
 	for (const name of substituted) if (Object.hasOwn(live, name) && live[name] !== void 0) out[name] = live[name];
 	else delete out[name];
+	if (mergeNeedsLive) {
+		const withAttempted = withAttemptedTags(out["Tags"], live["Tags"], args.desired?.["Tags"], attemptedTags);
+		if (withAttempted !== void 0) out["Tags"] = withAttempted;
+	}
 	return out;
 }
+function withAttemptedTags(recorded, live, desired, attempted) {
+	const keysOf = (value) => {
+		if (value === void 0 || value === null) return /* @__PURE__ */ new Set();
+		if (!Array.isArray(value)) return void 0;
+		const keys = /* @__PURE__ */ new Set();
+		for (const entry of value) {
+			const key = entry?.Key;
+			if (typeof key !== "string") return void 0;
+			keys.add(key);
+		}
+		return keys;
+	};
+	const recordedKeys = keysOf(recorded);
+	const desiredKeys = keysOf(desired);
+	if (recordedKeys === void 0 || desiredKeys === void 0 || !Array.isArray(live)) return void 0;
+	const removable = live.filter((entry) => {
+		const key = entry?.Key;
+		return typeof key === "string" && attempted.includes(key) && !recordedKeys.has(key) && !desiredKeys.has(key);
+	});
+	if (removable.length === 0) return void 0;
+	return [...recorded ?? [], ...removable];
+}
 function tagsHeld(desired, live) {
 	const asMap = (value) => {
 		if (value === void 0 || value === null) return /* @__PURE__ */ new Map();
@@ -39622,7 +39772,42 @@ async function withUnprovenUnsettled(record, args, warn) {
 	const kept = await unsettledAfterUpdate(args);
 	if (kept.length === 0) return record;
 	warn(safeMsg`${args.logicalId} (${args.resourceType}): the update succeeded, but AWS does not yet show the requested ${kept.join(", ")}; cdkd keeps ${kept.length === 1 ? "it" : "them"} unsettled and converges again on the next deploy.`);
-	return withUnsettledProperties(record, kept);
+	const withNames = withUnsettledProperties(record, kept);
+	return withUnsettledItems(withNames, args.attemptedItems ?? /* @__PURE__ */ new Map());
+}
+async function waitForUnsettledSettled(args) {
+	const { provider, names } = args;
+	const deadline = Date.now() + args.timeoutMs;
+	if (args.running !== void 0) {
+		let returned = false;
+		const done = args.running.then(() => {
+			returned = true;
+		}, () => {
+			returned = true;
+		});
+		while (!returned) {
+			if (args.isInterrupted()) return "interrupted";
+			const left = deadline - Date.now();
+			if (left <= 0) return "moving";
+			await Promise.race([done, new Promise((resolve) => setTimeout(resolve, Math.min(250, left)))]);
+		}
+	}
+	if (provider.unsettledInTransition === void 0 || names.size === 0) return "settled";
+	for (;;) {
+		if (args.isInterrupted()) return "interrupted";
+		let moving = true;
+		try {
+			moving = (await provider.unsettledInTransition(args.physicalId, args.logicalId, args.resourceType, names, args.recordedProperties)).size > 0;
+		} catch {}
+		if (!moving) return "settled";
+		const left = deadline - Date.now();
+		if (left <= 0) return "moving";
+		const until = Date.now() + Math.min(args.pollMs, left);
+		while (Date.now() < until) {
+			if (args.isInterrupted()) return "interrupted";
+			await new Promise((resolve) => setTimeout(resolve, Math.min(250, until - Date.now())));
+		}
+	}
 }
 function splitUnhandledRemovals(unhandled, recordedPrevious, unsettled) {
 	const addedByFailedUpdate = unhandled.filter((name) => unsettled.has(name) && !Object.hasOwn(recordedPrevious, name));
@@ -39653,7 +39838,8 @@ async function updateWithRollbackRetry(provider, args, logicalId, logger, isInte
 		recordedProperties: recordedPrevious,
 		names: context?.unsettledProperties ?? /* @__PURE__ */ new Set(),
 		previous: recordedPrevious,
-		desired
+		desired,
+		...context?.unsettledItems !== void 0 && { attemptedItems: context.unsettledItems }
 	});
 	const removal = prepareRemovalForUpdate(provider, resourceType, desired, previous);
 	const revertArgs = [
@@ -40010,7 +40196,8 @@ async function replayRevert(s) {
 		resourceType: op.resourceType,
 		recordedProperties: current.properties ?? {},
 		names: unsettledContextOf(current, previousState).unsettledProperties ?? /* @__PURE__ */ new Set(),
-		desired: desiredProps ?? {}
+		desired: desiredProps ?? {},
+		...unsettledContextOf(current, previousState).unsettledItems !== void 0 && { attemptedItems: unsettledContextOf(current, previousState).unsettledItems }
 	}, (message) => logger.warn(mask(message)));
 	if (updatePartialReason(revertResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$2(previousState.properties?.["Policies"], current.properties?.["Policies"]), revertVia);
 	const rollbackPartial = updatePartialReason(revertResult);
@@ -40672,6 +40859,12 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 function ownRecord(stateResources, logicalId) {
 	return Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
 }
+function withKeysFrom(bag, source, keys) {
+	const out = { ...bag };
+	for (const key of keys) if (source !== void 0 && Object.hasOwn(source, key)) out[key] = source[key];
+	else delete out[key];
+	return out;
+}
 async function replayFailedOperationsUnbound(failedOps, stateResources, stackName, ctx, options = {}) {
 	const inlinePolicyWriters = options.inlinePolicyWriters ?? new RollbackInlinePolicyWriters();
 	const result = {
@@ -40904,7 +41097,14 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						skipUnaddressableReplay(skipScope, logger, op, "force-revert failed UPDATE of");
 						break;
 					}
-					logger.info(`  Rollback: force-reverting failed UPDATE of ${safe(op.logicalId)} (${safe(op.resourceType)}) to its pre-deploy properties (--revert-failed; remote state is unknown)`);
+					const own = options.previousFromRecord?.get(op.logicalId);
+					const fromRecord = own !== void 0;
+					const attemptedBag = fromRecord ? void 0 : op.attemptedProperties;
+					const revertUnsettled = fromRecord ? own.names.size === 0 ? {} : {
+						unsettledProperties: own.names,
+						...own.items.size > 0 && { unsettledItems: own.items }
+					} : unsettledContextOf(current, prev);
+					logger.info(!fromRecord ? `  Rollback: force-reverting failed UPDATE of ${safe(op.logicalId)} (${safe(op.resourceType)}) to its pre-deploy properties (--revert-failed; remote state is unknown)` : own.lateSuccess ? `  Rollback: reverting the failed UPDATE of ${safe(op.logicalId)} (${safe(op.resourceType)}), whose call completed after the deploy gave up on it, to its pre-deploy properties` : `  Rollback: reverting what the failed UPDATE of ${safe(op.logicalId)} (${safe(op.resourceType)}) left unsettled (${[...own.names].map(safe).join(", ")}) to its pre-deploy properties`);
 					const { provider, provisionedBy: revertVia } = ctx.providerRegistry.getProviderFor({
 						resourceType: op.resourceType,
 						provisionedBy: op.provisionedBy ?? current.provisionedBy
@@ -40921,7 +41121,13 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 					});
 					const desiredProps = noEcho.desired;
 					refuseMaskedReplayBaseline(desiredProps, op.logicalId, noEcho.inert);
-					const attemptedProps = noEcho.onPreviousSide(await resolveReplayProps(op.attemptedProperties ?? current.properties, resolver, secrets, ctx, op.logicalId, op.attemptedProperties === void 0 ? current : void 0));
+					const resolvedPrevious = noEcho.onPreviousSide(await resolveReplayProps(attemptedBag ?? current.properties, resolver, secrets, ctx, op.logicalId, attemptedBag === void 0 ? current : void 0));
+					const excludedKeys = own?.lateSuccess === true ? [...unsettledPropertiesOf(prev)] : [];
+					const attemptedProps = excludedKeys.length === 0 || resolvedPrevious === void 0 ? resolvedPrevious : withKeysFrom(resolvedPrevious, desiredProps, excludedKeys);
+					if (excludedKeys.length > 0) {
+						const one = excludedKeys.length === 1;
+						logger.warn(safeMsg`  Rollback: ${safe(op.logicalId)} (${safe(op.resourceType)}): ${excludedKeys.map(safe).join(", ")} ${one ? "was" : "were"} left unsettled by an earlier failed deploy, so this revert leaves ${one ? "it" : "them"} as AWS holds ${one ? "it" : "them"}; the next deploy converges ${one ? "it" : "them"}.`);
+					}
 					recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, prev.properties, "state-derived");
 					opMasker.addNamed({
 						resourceType: op.resourceType,
@@ -40955,7 +41161,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 							replayingState: true,
 							recordedAttributes: current.attributes,
 							...revertFailedClaimed && { inlinePolicyClaimed: revertFailedClaimed },
-							...unsettledContextOf(current, prev)
+							...revertUnsettled
 						}
 					], op.logicalId, logger, options.isInterrupted, secrets, mask));
 					if (revertFailedResult) recordNoEchoAttributeValues(revertFailedResult, secrets, desiredProps);
@@ -40966,10 +41172,12 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						physicalId: current.physicalId,
 						resourceType: op.resourceType,
 						recordedProperties: current.properties ?? {},
-						names: unsettledContextOf(current, prev).unsettledProperties ?? /* @__PURE__ */ new Set(),
-						desired: desiredProps ?? {}
+						names: revertUnsettled.unsettledProperties ?? /* @__PURE__ */ new Set(),
+						desired: desiredProps ?? {},
+						...revertUnsettled.unsettledItems !== void 0 && { attemptedItems: revertUnsettled.unsettledItems }
 					}, (message) => logger.warn(mask(message)));
-					if (updatePartialReason(revertFailedResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$2(prev.properties?.["Policies"], (op.attemptedProperties ?? current.properties)?.["Policies"]), revertVia);
+					if (fromRecord) stateResources[op.logicalId] = withUnsettledItems(withUnsettledProperties(stateResources[op.logicalId], unsettledPropertiesOf(prev)), unsettledItemsOf(prev));
+					if (updatePartialReason(revertFailedResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$2(prev.properties?.["Policies"], (attemptedBag ?? current.properties)?.["Policies"]), revertVia);
 					const revertFailedPartial = updatePartialReason(revertFailedResult);
 					if (revertFailedPartial !== void 0) logger.warn(mask(`  Rollback: ${safe(op.logicalId)} reverted, ${updatePartialMessage(revertFailedPartial)}`));
 					else logger.info(`  Rollback: ${safe(op.logicalId)} reverted successfully`);
@@ -42883,7 +43091,7 @@ async function revertNestedChildFromJournal(args) {
 			...carried,
 			...stackInstanceIdCarriedFrom(base),
 			...supersededAfterRollback(base, supersededHost),
-			version: 14,
+			version: 15,
 			region,
 			resources: { ...stateResources },
 			...orphansAfterRollback(base, mintedOrphans),
@@ -43650,7 +43858,7 @@ function replayPrintingBag(deps, entries, stateResources) {
 		read
 	]);
 }
-async function performRollback(deps, completedOperations, stateResources, stackName, previousState, failedOperations = [], priorOrphans = []) {
+async function performRollback(deps, completedOperations, stateResources, stackName, previousState, failedOperations = [], priorOrphans = [], unsettledRevert) {
 	const orphanIndexes = [];
 	const orphanOps = [];
 	failedOperations.forEach((op, i) => {
@@ -43675,7 +43883,7 @@ async function performRollback(deps, completedOperations, stateResources, stackN
 	const inlinePolicyWriters = new RollbackInlinePolicyWriters();
 	const supersededHost = {};
 	const runId = deps.options.eventRecorder?.runId;
-	const { result, failed, run } = await withNestedRevertRun(runId, async (scope) => {
+	const { result, failed, unsettled, run } = await withNestedRevertRun(runId, async (scope) => {
 		return {
 			failed: orphanOps.length > 0 ? await withPrintingSecrets(replayPrintingBag(deps, orphanOps.map((op) => ({
 				...op,
@@ -43684,6 +43892,11 @@ async function performRollback(deps, completedOperations, stateResources, stackN
 				emitEnvelope: completedOperations.length === 0,
 				inlinePolicyWriters
 			})) : void 0,
+			unsettled: await revertUnsettledFailedUpdates(deps, ctx, stackName, stateResources, failedOperations, new Set(orphanIndexes), {
+				emitEnvelope: completedOperations.length === 0 && orphanOps.length === 0,
+				inlinePolicyWriters,
+				hooks: unsettledRevert
+			}),
 			result: await withPrintingSecrets(replayPrintingBag(deps, completedReplayEntries(completedOperations), stateResources), () => replayRollback(completedOperations, stateResources, stackName, ctx, {
 				inlinePolicyWriters,
 				failedOperations,
@@ -43696,11 +43909,12 @@ async function performRollback(deps, completedOperations, stateResources, stackN
 	});
 	const pendingOrphans = new Set(failed?.remainingFailedOps ?? []);
 	const handled = new Set(orphanIndexes.filter((_, k) => !pendingOrphans.has(orphanOps[k])));
+	for (const index of unsettled.handled) handled.add(index);
 	return {
 		failures: result.failures + (failed?.failures ?? 0),
-		warnings: result.warnings + run.warnings + (failed?.warnings ?? 0),
+		warnings: result.warnings + run.warnings + (failed?.warnings ?? 0) + unsettled.warnings,
 		skipped: result.skipped + (failed?.skipped ?? 0),
-		interrupted: result.interrupted,
+		interrupted: result.interrupted || unsettled.interrupted,
 		orphaned: [...failed?.orphaned ?? [], ...result.orphaned],
 		rolledBackCreates: [...failed?.rolledBackCreates ?? [], ...result.rolledBackCreates],
 		superseded: supersededHost.supersededResources ?? [],
@@ -43708,6 +43922,152 @@ async function performRollback(deps, completedOperations, stateResources, stackN
 		remainingFailedOps: failedOperations.filter((_, i) => !handled.has(i))
 	};
 }
+function waitText(ms) {
+	return ms >= 6e4 ? `${Math.round(ms / 6e4)} min` : `${Math.max(1, Math.round(ms / 1e3))}s`;
+}
+async function revertUnsettledFailedUpdates(deps, ctx, stackName, stateResources, failedOperations, alreadyReplayed, options) {
+	const out = {
+		handled: [],
+		warnings: 0,
+		interrupted: false
+	};
+	const hooks = options.hooks;
+	if (hooks === void 0) return out;
+	const ownMarks = (logicalId) => {
+		const onRecord = unsettledPropertiesOf(stateResources[logicalId]);
+		const marks = hooks.runMarks(logicalId);
+		const names = new Set([...marks.names].filter((name) => onRecord.has(name)));
+		return {
+			names,
+			items: new Map([...marks.items].filter(([path]) => names.has(unsettledItemsTopKey(path)))),
+			lateSuccess: false
+		};
+	};
+	const candidates = [];
+	failedOperations.forEach((op, index) => {
+		if (alreadyReplayed.has(index) || op.changeType !== "UPDATE") return;
+		if (failedOpOwnRecord(op, stateResources) === void 0) return;
+		const own = ownMarks(op.logicalId);
+		const running = hooks.stillRunning(op.logicalId);
+		if (own.names.size === 0 && running === void 0) return;
+		if (classifyFailedOp(op, stateResources, [...failedOperations]) !== "revert-failed-update") return;
+		candidates.push({
+			index,
+			op,
+			own,
+			running
+		});
+	});
+	if (candidates.length === 0) return out;
+	const { logger } = deps;
+	const isInterrupted = () => deps.userInterrupted();
+	const fallback = (names) => {
+		const one = names.size === 1;
+		const retry = deps.options.parentStackInfo === void 0 ? `, or revert ${one ? "it" : "them"} now with: ${pasteableCommand("cdkd rollback", [{
+			value: stackName,
+			hole: "stack"
+		}, { literal: "--revert-failed" }]).command}` : "";
+		return `cdkd keeps ${one ? "it" : "them"} unsettled: the next deploy converges ${one ? "it" : "them"}${retry}`;
+	};
+	const wait = deps.options.unsettledRevertWait ?? DEFAULT_UNSETTLED_REVERT_WAIT;
+	const verdicts = await Promise.all(candidates.map(async (candidate) => {
+		const { op } = candidate;
+		let provider;
+		try {
+			provider = ctx.providerRegistry.getProviderFor({
+				resourceType: op.resourceType,
+				provisionedBy: op.provisionedBy ?? stateResources[op.logicalId].provisionedBy
+			}).provider;
+		} catch {
+			return "error";
+		}
+		logger.info(safeMsg`  Rollback: waiting for ${op.logicalId} (${op.resourceType}) to settle before reverting the failed update`);
+		const started = Date.now();
+		const identity = () => {
+			const record = stateResources[op.logicalId];
+			return {
+				provider,
+				logicalId: op.logicalId,
+				physicalId: record.physicalId,
+				resourceType: op.resourceType,
+				recordedProperties: record.properties ?? {},
+				names: candidate.own.names,
+				timeoutMs: Math.max(0, wait.timeoutMs - (Date.now() - started)),
+				pollMs: wait.pollMs,
+				isInterrupted
+			};
+		};
+		if (candidate.running !== void 0) {
+			let succeeded = false;
+			const returned = await waitForUnsettledSettled({
+				...identity(),
+				names: /* @__PURE__ */ new Set(),
+				running: candidate.running.then((ok) => {
+					succeeded = ok;
+				})
+			});
+			if (returned === "moving") return "call-running";
+			if (returned === "interrupted") return returned;
+			hooks.recordMarks(op.logicalId);
+			candidate.own = {
+				...ownMarks(op.logicalId),
+				lateSuccess: succeeded
+			};
+			if (!succeeded && candidate.own.names.size === 0) return "none";
+		}
+		try {
+			return await waitForUnsettledSettled(identity());
+		} catch {
+			return "error";
+		}
+	}));
+	const ready = [];
+	candidates.forEach((candidate, k) => {
+		const verdict = verdicts[k];
+		if (verdict === "settled") {
+			ready.push(candidate);
+			return;
+		}
+		if (verdict === "none") return;
+		if (verdict === "interrupted") {
+			out.interrupted = true;
+			return;
+		}
+		const { op } = candidate;
+		const names = candidate.own.names;
+		const them = names.size === 1 ? "it" : "them";
+		const subject = names.size > 0 ? `the failed update left ${[...names].join(", ")} unsettled` : "the failed update may have applied part of the template";
+		const why = verdict === "call-running" ? `cdkd's own update call, abandoned at the per-resource deadline, had not returned after ${waitText(wait.timeoutMs)}` : verdict === "error" ? "cdkd could not reach its provider to wait for it" : `AWS had not settled ${them} after ${waitText(wait.timeoutMs)}`;
+		logger.warn(safeMsg`${op.logicalId} (${op.resourceType}): ${subject}, and ${why}, so the automatic rollback did not revert ${names.size > 0 ? them : "it"}. ${fallback(names)}`);
+		out.warnings++;
+	});
+	if (ready.length === 0 || out.interrupted) return out;
+	const ops = ready.map(({ op }) => ({ ...op }));
+	const own = new Map(ready.map(({ op, own: marks }) => [op.logicalId, marks]));
+	const replay = await withPrintingSecrets(replayPrintingBag(deps, ops.map((op) => ({
+		...op,
+		properties: op.attemptedProperties
+	})), stateResources), () => replayFailedOperations(ops, stateResources, stackName, ctx, {
+		emitEnvelope: options.emitEnvelope,
+		inlinePolicyWriters: options.inlinePolicyWriters,
+		isInterrupted,
+		previousFromRecord: own
+	}));
+	out.warnings += replay.warnings + replay.failures;
+	if (replay.interrupted) out.interrupted = true;
+	const pending = new Set(replay.remainingFailedOps);
+	const skipped = new Set(replay.skippedOps ?? []);
+	ops.forEach((op, k) => {
+		const { index, own: marks } = ready[k];
+		if (pending.has(op) || skipped.has(op)) {
+			if (!replay.interrupted) logger.warn(safeMsg`${op.logicalId} (${op.resourceType}): the automatic rollback could not revert ${marks.names.size > 0 ? `what the failed update left unsettled (${[...marks.names].join(", ")})` : "the failed update"} (see above). ${fallback(marks.names)}`);
+			return;
+		}
+		out.handled.push(index);
+		hooks.onReverted(op.logicalId, marks.names);
+	});
+	return out;
+}
 function foreignHolderResolver(deps) {
 	const sameBucketHolderFor = makeForeignHolderScan(deps.stateBackend);
 	const crossPrefixHolder = deps.options.crossPrefixHolder;
@@ -46602,6 +46962,7 @@ async function provisionCreate(engine, logicalId, change, stateResources, stackN
 		...templateAttrs,
 		provisionedBy: createDecision.provisionedBy
 	};
+	clearCreatedReport();
 	engine.recordInlinePolicyWrite(logicalId, "create");
 	await establishNoEchoEchoFidelity(engine.noEchoRun, engine.noEchoDeps(), logicalId, stateResources[logicalId], resolvedProps, stateResources, createSecrets);
 	const createCaptureSiblings = await buildObservedCaptureSiblings({
@@ -47943,7 +48304,8 @@ function identityKeyOf(...lists) {
 	return entries.some((entry) => isPlainObject(entry) && IDENTITY_KEYS.some((candidate) => typeof entry[candidate] === "string")) ? "ambiguous" : void 0;
 }
 const POSITIONAL_LIST_KEYS = /* @__PURE__ */ new Set(["KeySchema"]);
-function projectNamed(live, own, wanted, path, unnamed) {
+function projectNamed(live, own, wanted, path, unnamed, attempted = /* @__PURE__ */ new Map()) {
+	const attemptedAt = (at) => new Set([...attempted.get(at) ?? []].filter(isUsableAttemptedName));
 	if (isPlainObject(live) && (isPlainObject(own) || isPlainObject(wanted))) {
 		const ownBag = isPlainObject(own) ? own : void 0;
 		const wantedBag = isPlainObject(wanted) ? wanted : void 0;
@@ -47954,10 +48316,12 @@ function projectNamed(live, own, wanted, path, unnamed) {
 			if (IDENTITY_KEYS.includes(key)) continue;
 			if (key === "Tags") {
 				if (ownBag !== void 0 && Object.hasOwn(ownBag, "Tags")) out["Tags"] = ownBag["Tags"];
+				const withAttempted = withAttemptedReplicaTags(ownBag?.["Tags"], wantedBag?.["Tags"], live["Tags"], attemptedAt(`${path}.Tags`));
+				if (withAttempted !== void 0) out["Tags"] = withAttempted;
 				continue;
 			}
 			if (!Object.hasOwn(live, key) || live[key] === void 0) continue;
-			out[key] = POSITIONAL_LIST_KEYS.has(key) ? live[key] : projectNamed(live[key], ownBag?.[key], wantedBag?.[key], `${path}.${key}`, unnamed);
+			out[key] = POSITIONAL_LIST_KEYS.has(key) ? live[key] : projectNamed(live[key], ownBag?.[key], wantedBag?.[key], `${path}.${key}`, unnamed, attempted);
 		}
 		return out;
 	}
@@ -47984,6 +48348,7 @@ function projectNamed(live, own, wanted, path, unnamed) {
 			const ownEntry = ownById.get(value);
 			const wantedEntry = wantedById.get(value);
 			if (ownEntry === void 0 && wantedEntry === void 0) {
+				if (attemptedAt(path).has(value)) return [entry];
 				unnamed.push({
 					identity: id,
 					value,
@@ -47991,11 +48356,34 @@ function projectNamed(live, own, wanted, path, unnamed) {
 				});
 				return [];
 			}
-			return [projectNamed(entry, ownEntry, wantedEntry, `${path}[${value}]`, unnamed)];
+			return [projectNamed(entry, ownEntry, wantedEntry, `${path}[${value}]`, unnamed, attempted)];
 		});
 	}
 	return live;
 }
+function withAttemptedReplicaTags(recorded, desired, live, attempted) {
+	if (attempted.size === 0 || !Array.isArray(live)) return void 0;
+	const keysOf = (value) => {
+		if (value === void 0 || value === null) return /* @__PURE__ */ new Set();
+		if (!Array.isArray(value)) return void 0;
+		const keys = /* @__PURE__ */ new Set();
+		for (const entry of value) {
+			const key = entry?.Key;
+			if (typeof key !== "string") return void 0;
+			keys.add(key);
+		}
+		return keys;
+	};
+	const recordedKeys = keysOf(recorded);
+	const desiredKeys = keysOf(desired);
+	if (recordedKeys === void 0 || desiredKeys === void 0) return void 0;
+	const removable = live.filter((entry) => {
+		const key = entry?.Key;
+		return typeof key === "string" && attempted.has(key) && !recordedKeys.has(key) && !desiredKeys.has(key);
+	});
+	if (removable.length === 0) return void 0;
+	return [...recorded ?? [], ...removable];
+}
 const strictReadScope = new AsyncLocalStorage();
 function strictFor(key) {
 	return strictReadScope.getStore()?.has(key) === true;
@@ -48006,6 +48394,12 @@ function replicaStrictness(status) {
 	return new Set([...current].filter((key) => key !== "Replicas"));
 }
 const unsettledScope = new AsyncLocalStorage();
+const REGION_SEGMENT = /^[a-z]{2}(-[a-z]+)+-\d+$/;
+function markAttemptedItems(path, items) {
+	const scope = unsettledScope.getStore();
+	if (scope?.attempted === void 0 || items.length === 0) return;
+	scope.attempted(path, items);
+}
 function markUnsettled(...keys) {
 	const scope = unsettledScope.getStore();
 	if (scope === void 0) return;
@@ -48274,6 +48668,7 @@ var DynamoDBGlobalTableProvider = class {
 		let createdTableId;
 		try {
 			createdTableId = (await (await this.getCreateClient()).send(new CreateTableCommand(createParams)))?.TableDescription?.TableId;
+			reportCreatedResource(logicalId, resourceType, tableName, createdTableId);
 			log.debug(`CreateTable initiated for ${log.value(tableName)}, waiting for ACTIVE`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -48345,6 +48740,7 @@ var DynamoDBGlobalTableProvider = class {
 					}
 				}
 				await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: tableName }));
+				retractCreatedResource(logicalId, resourceType, tableName);
 			} catch (cleanupErr) {
 				tableLeftBehind = true;
 				warn(`Partial-create cleanup failed for ${tableName}: ${this.cleanupFailureText(log, `Partial-create cleanup failed for ${tableName}: `, cleanupErr)} To remove the orphaned AWS-side table, run: ` + pasteableAwsCommand(maskSecrets)`aws dynamodb delete-table --table-name ${tableName}`.render());
@@ -48392,6 +48788,7 @@ var DynamoDBGlobalTableProvider = class {
 				TableName: tableName,
 				ReplicaUpdates: replicaUpdates
 			}));
+			markAttemptedItems("Replicas", [region]);
 			break;
 		} catch (error) {
 			if (attempt >= 3 || !isReplicaCopyExistsRefusal(error)) throw error;
@@ -49045,7 +49442,8 @@ var DynamoDBGlobalTableProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		return unsettledScope.run({
 			mark: (key) => context?.markUnsettled?.(key),
-			unsettled: context?.unsettledProperties ?? /* @__PURE__ */ new Set()
+			unsettled: context?.unsettledProperties ?? /* @__PURE__ */ new Set(),
+			attempted: (path, items) => context?.markAttempted?.(path, items)
 		}, () => this.updateInScope(logicalId, physicalId, resourceType, properties, previousProperties, context));
 	}
 	async updateInScope(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -49130,7 +49528,7 @@ var DynamoDBGlobalTableProvider = class {
 			const extractLocalTags = (props) => {
 				return localReplicaEntry(props, currentRegion)?.["Tags"];
 			};
-			if (tableArn) await this.applyTagDiff(tableArn, resourceType, logicalId, extractLocalTags(previousProperties), extractLocalTags(properties), maskSecrets);
+			if (tableArn) await this.applyTagDiff(tableArn, resourceType, logicalId, extractLocalTags(previousProperties), extractLocalTags(properties), maskSecrets, currentRegion);
 			const liveWarmByIndexName = /* @__PURE__ */ new Map();
 			for (const liveGsi of describeResp.Table?.GlobalSecondaryIndexes ?? []) {
 				const name = liveGsi.IndexName;
@@ -49504,6 +49902,7 @@ var DynamoDBGlobalTableProvider = class {
 					AttributeDefinitions: newAttrs,
 					GlobalSecondaryIndexUpdates: [gsiUpdate]
 				}));
+				markAttemptedItems("GlobalSecondaryIndexes", [gsi.IndexName]);
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, void 0, void 0, maskSecrets);
 			}
 			for (const gsi of gsiDiff.modified) {
@@ -49623,8 +50022,8 @@ var DynamoDBGlobalTableProvider = class {
 			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to update DynamoDB GlobalTable ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async applyTagDiff(tableArn, resourceType, logicalId, oldTagsRaw, newTagsRaw, maskSecrets) {
-		await this.applyTagDiffOnClient(this.dynamoDBClient, tableArn, resourceType, logicalId, oldTagsRaw, newTagsRaw, maskSecrets);
+	async applyTagDiff(tableArn, resourceType, logicalId, oldTagsRaw, newTagsRaw, maskSecrets, region) {
+		await this.applyTagDiffOnClient(this.dynamoDBClient, tableArn, resourceType, logicalId, oldTagsRaw, newTagsRaw, maskSecrets, region);
 	}
 	async applyCrossRegionReplicaTagsDiff(tableArn, region, oldTags, newTags, resourceType, logicalId, physicalIdForLogs, maskSecrets = (text) => text) {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
@@ -49640,12 +50039,12 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		try {
 			const regionalClient = this.getRegionalClient(region);
-			await this.applyTagDiffOnClient(regionalClient, replicaArn, resourceType, `${logicalId} (replica ${region})`, oldTags, newTags, maskSecrets);
+			await this.applyTagDiffOnClient(regionalClient, replicaArn, resourceType, `${logicalId} (replica ${region})`, oldTags, newTags, maskSecrets, region);
 		} catch (tagErr) {
 			warn(`Could not apply Tags diff to cross-region replica ${region} of ${physicalIdForLogs}: ${describeAwsFailure(tagErr).detail}. The replica's Tags state will surface as drift until the next successful deploy.`);
 		}
 	}
-	async applyTagDiffOnClient(client, tableArn, resourceType, id, oldTagsRaw, newTagsRaw, maskSecrets = (text) => text) {
+	async applyTagDiffOnClient(client, tableArn, resourceType, id, oldTagsRaw, newTagsRaw, maskSecrets = (text) => text, region) {
 		const plan = planTagDiff(oldTagsRaw, newTagsRaw);
 		const tagWarning = tagPlanWarning(plan, resourceType, id);
 		if (tagWarning !== void 0) this.logger.warn(maskSecrets(tagWarning));
@@ -49667,6 +50066,15 @@ var DynamoDBGlobalTableProvider = class {
 				ResourceArn: tableArn,
 				Tags: tagsToAdd
 			}));
+			if (region !== void 0 && REGION_SEGMENT.test(region)) {
+				let recordedKeys;
+				try {
+					recordedKeys = /* @__PURE__ */ new Set([...planTagDiff(void 0, oldTagsRaw).set.keys()]);
+				} catch {
+					recordedKeys = void 0;
+				}
+				if (recordedKeys !== void 0) markAttemptedItems(`Replicas[${region}].Tags`, tagsToAdd.map((t) => t.Key).filter((key) => !recordedKeys.has(key)));
+			}
 			this.logger.debug(maskSecrets(`Added/updated ${tagsToAdd.length} tag(s) on DynamoDB GlobalTable ${tableArn}`));
 		}
 	}
@@ -50086,7 +50494,7 @@ var DynamoDBGlobalTableProvider = class {
 			throw err;
 		}
 	}
-	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties) {
+	async readUnsettled(physicalId, logicalId, resourceType, names, recordedProperties, desiredProperties, attemptedItems) {
 		const live = await strictReadScope.run(names, () => this.readCurrentState(physicalId, logicalId, resourceType, recordedProperties));
 		if (typeof live !== "object" || live === null) return live;
 		const out = { ...live };
@@ -50094,7 +50502,7 @@ var DynamoDBGlobalTableProvider = class {
 		const unnamed = [];
 		for (const name of names) {
 			if (!Object.hasOwn(out, name)) continue;
-			out[name] = projectNamed(out[name], recordedProperties?.[name], desiredProperties?.[name], name, unnamed);
+			out[name] = projectNamed(out[name], recordedProperties?.[name], desiredProperties?.[name], name, unnamed, attemptedItems);
 		}
 		for (const entry of unnamed.filter((e) => e.ambiguous === true)) this.logger.warn(safeMsg`${logicalId} (${resourceType}): ${entry.path} on AWS has entries cdkd cannot key by an identity, so convergence keeps the recorded ${entry.path} rather than risk removing an entry neither the record nor the template declares. Check it with 'cdkd drift'.`);
 		for (const entry of unnamed.filter((e) => e.ambiguous !== true)) this.logger.warn(safeMsg`${logicalId} (${resourceType}): ${entry.path} on AWS holds ${entry.identity} ${entry.value}, which neither the record nor the template declares, so cdkd leaves it in place. If the failed update added it and it should not be there, remove it by hand (for a replica: aws dynamodb update-table --replica-updates Delete; for an index: --global-secondary-index-updates Delete).`);
@@ -51799,6 +52207,7 @@ async function updateByReplacement(engine, { change, counts, currentProps, curre
 		...extractTemplateAttributes(template, logicalId),
 		provisionedBy: replaceDecision.provisionedBy
 	};
+	clearCreatedReport();
 	engine.recordInlinePolicyWrite(logicalId, "create");
 	await establishNoEchoEchoFidelity(engine.noEchoRun, engine.noEchoDeps(), logicalId, stateResources[logicalId], resolvedProps, stateResources, updateSecrets);
 	engine.observedCapture.kickOffObservedCapture(replaceProvider, logicalId, createResult.physicalId, resourceType, resolvedProps, { afterOwnWrite: true }, updateSecrets);
@@ -51876,6 +52285,7 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 	const changedForProvider = new Set(changedProperties);
 	for (const key of /* @__PURE__ */ new Set([...Object.keys(previousWithNoEchoHeld), ...Object.keys(previousForUpdate)])) if (keyOrderFreeJson(previousForUpdate[key]) !== keyOrderFreeJson(previousWithNoEchoHeld[key])) changedForProvider.add(key);
 	const unsettled = unsettledPropertiesOf(currentResource);
+	const unsettledItems = unsettledItemsOf(currentResource);
 	if (changedForProvider.size === 0) for (const key of /* @__PURE__ */ new Set([...Object.keys(updateProps), ...Object.keys(previousForUpdate)])) changedForProvider.add(key);
 	if (reattached !== void 0) engine.logger.info(safeMsg`  ${logicalId} (${resourceType}) lost its attachment to ${reattached.parents.join(", ")}, which this deploy re-created under the same name: attaching it again`);
 	if (droppedPrincipalKinds.length > 0) {
@@ -51893,7 +52303,8 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 		...unsettledIdentity,
 		names: unsettled,
 		previous: previousForUpdate,
-		desired: updateProps
+		desired: updateProps,
+		attemptedItems: unsettledItems
 	});
 	if (unsettled.has("Tags")) engine.logger.warn(safeMsg`${logicalId} (${resourceType}): an earlier failed update left Tags unsettled. cdkd re-applies the template's tags and removes only the recorded ones the template dropped; a tag that failed update added and no template declares is left on the resource. Remove it by hand if it should not be there.`);
 	const removal = prepareRemovalForUpdate(updateProvider, resourceType, updateProps, previousSettled);
@@ -51923,10 +52334,23 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 				}
 				marks.add(propertyName);
 			},
-			...unsettled.size > 0 && { unsettledProperties: unsettled }
+			markAttempted: (path, items) => {
+				if (typeof path !== "string" || path === "") return;
+				let byPath = engine.unsettledItemMarks.get(logicalId);
+				if (byPath === void 0) {
+					byPath = /* @__PURE__ */ new Map();
+					engine.unsettledItemMarks.set(logicalId, byPath);
+				}
+				const names = byPath.get(path) ?? /* @__PURE__ */ new Set();
+				for (const item of items) if (typeof item === "string" && item !== "") names.add(item);
+				byPath.set(path, names);
+			},
+			...unsettled.size > 0 && { unsettledProperties: unsettled },
+			...unsettledItems.size > 0 && { unsettledItems }
 		})), logicalId, void 0, void 0, updateProvider);
 		if (result.sentNothing === true) engine.replacementRun.updatesThatSentNothing.add(logicalId);
 		engine.unsettledMarks.delete(logicalId);
+		engine.unsettledItemMarks.delete(logicalId);
 		if (result.wasReplaced === true && result.outcome === "partial") engine.replacementRun.replacedOldMaySurvive.set(logicalId, result.oldResourceSurvivor === "kept" ? "kept" : "unconfirmed");
 		result = withoutInjectedRemovals(result, removal.injected);
 		const unhandledByCause = splitUnhandledRemovals(removal.unhandled, previousForUpdate, unsettled);
@@ -52112,6 +52536,7 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 				generation: fallbackGeneration
 			}, replaceFallback));
 			engine.unsettledMarks.delete(logicalId);
+			engine.unsettledItemMarks.delete(logicalId);
 			result = fallbackOutcome.result;
 			resultProvisionedBy = fallbackOutcome.provisionedBy;
 			captureProvider = fallbackOutcome.captureProvider;
@@ -52135,7 +52560,8 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 	const stillUnsettled = result.wasReplaced ? [] : await unsettledAfterUpdate({
 		...unsettledIdentity,
 		names: unsettled,
-		desired: updateProps
+		desired: updateProps,
+		attemptedItems: unsettledItems
 	});
 	if (stillUnsettled.length > 0) engine.logger.warn(safeMsg`${logicalId} (${resourceType}): the update succeeded, but AWS does not yet show the template's ${stillUnsettled.join(", ")}; cdkd keeps ${stillUnsettled.length === 1 ? "it" : "them"} unsettled and converges again on the next deploy.`);
 	engine.replacementRun.updateWasReplaced.set(logicalId, result.wasReplaced === true);
@@ -52174,12 +52600,16 @@ async function updateInPlace(engine, { changedProperties, conditions, counts, cu
 		...dependencies && dependencies.length > 0 && { dependencies },
 		...extractTemplateAttributes(template, logicalId),
 		provisionedBy: resultProvisionedBy,
-		...stillUnsettled.length > 0 && { unsettledProperties: stillUnsettled },
+		...stillUnsettled.length > 0 && {
+			unsettledProperties: stillUnsettled,
+			...unsettledItemsField(currentResource, stillUnsettled)
+		},
 		...keepsParameterRefusal && {
 			observedBaselineRefused: true,
 			observedBaselineRefusalReason: "unverifiable-parameter"
 		}
 	};
+	clearCreatedReport();
 	if (updatePartialReason(result) === void 0) engine.recordInlinePolicyWrite(logicalId, "update");
 	if (keepsParameterRefusal) engine.logger.debug(safeMsg`observedProperties capture SKIPPED for updated ${logicalId} (${resourceType}): 'cdkd import' refused its baseline because a template parameter was not provably deployed at its 'Default', and this deploy bound the same 'Default' — an in-place update cannot show that AWS no longer holds the deployed value. The refusal stands until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter.`);
 	const updateCaptureSiblings = keepsParameterRefusal ? void 0 : await buildObservedCaptureSiblings({
@@ -53036,7 +53466,7 @@ async function provisionResource(engine, logicalId, change, stateResources, stac
 	let nestedChildUnaddressed;
 	const deleteGuards = [];
 	try {
-		await withPrintingSecrets(printingRegistry, () => withResourceDeadline(async () => {
+		await withPrintingSecrets(printingRegistry, () => withResourceDeadline(trackInFlightBody(engine, logicalId, async () => {
 			try {
 				const { value: bodyResult, unaddressed } = await collectDeleteGuards(deleteGuards, () => collectNestedChildUnaddressed(() => provisionResourceBody(engine, logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress)));
 				deleteSkipped = bodyResult?.deleteSkipped;
@@ -53068,7 +53498,7 @@ async function provisionResource(engine, logicalId, change, stateResources, stac
 					reason: guard.reason
 				});
 			}
-		}, {
+		}), {
 			warnAfterMs,
 			timeoutMs,
 			onWarn: (elapsedMs) => {
@@ -53146,6 +53576,17 @@ async function provisionResource(engine, logicalId, change, stateResources, stac
 		renderer.removeTask(logicalId);
 	}
 }
+function trackInFlightBody(engine, logicalId, body) {
+	return () => {
+		const running = body();
+		const entry = running.then(() => true, () => false);
+		engine.inFlightBodies.set(logicalId, entry);
+		entry.then(() => {
+			if (engine.inFlightBodies.get(logicalId) === entry) engine.inFlightBodies.delete(logicalId);
+		});
+		return running;
+	};
+}
 async function provisionResourceBody(engine, logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
 	const loadJournal = () => engine.stateBackend.loadRollbackJournal(stackName, engine.stackRegion);
 	const priorAttempts = priorAttemptLookup(logicalId, async () => priorAttemptsInJournal(await loadJournal(), logicalId, change.resourceType), async () => provenOrphanIdsInJournal(await loadJournal(), logicalId, change.resourceType));
@@ -53181,6 +53622,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 	};
 	const completedOperations = [];
 	const failedOperations = [];
+	const reportedCreatesToSettle = [];
 	let pendingMigration = migrationPending;
 	const phaseScope = phaseScopeForStack(stackName, engine.stackRegion);
 	let saveChain = Promise.resolve();
@@ -53198,7 +53640,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 			const savedFor = savedIds.join(", ");
 			try {
 				const partialState = {
-					version: 14,
+					version: 15,
 					region: engine.stackRegion,
 					stackName: currentState.stackName,
 					resources: newResources,
@@ -53315,9 +53757,10 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 					settle
 				});
 				let succeeded = false;
+				const createdSink = new CreatedResourceSink(logicalId, change.resourceType);
 				try {
 					try {
-						await timePhase(phaseScope, `resource ${change.changeType.toLowerCase()}`, () => provisionResource(engine, logicalId, change, newResources, stackName, template, parameterValues, conditions, actualCounts, progress), `${logicalId} ${change.resourceType}`);
+						await timePhase(phaseScope, `resource ${change.changeType.toLowerCase()}`, () => collectCreatedResources(createdSink, () => provisionResource(engine, logicalId, change, newResources, stackName, template, parameterValues, conditions, actualCounts, progress)), `${logicalId} ${change.resourceType}`);
 						settledUpdates.add(logicalId);
 						succeeded = true;
 					} finally {
@@ -53332,10 +53775,11 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 					const attemptedGeneration = change.changeType === "UPDATE" && !refused && !isReplacementNameRefusal(provisionError, logicalId) ? engine.replacementRun.attemptedNameGeneration.get(logicalId) : void 0;
 					const statePhysicalId = newResources[logicalId]?.physicalId ?? previousState?.physicalId;
 					if (refused && change.changeType === "CREATE" && statePhysicalId === void 0) throw provisionError;
-					const createdId = change.changeType === "CREATE" && statePhysicalId === void 0 ? createdBeforeFailure(provisionError, logicalId, change.resourceType) : void 0;
+					const markedCreatedId = createdBeforeFailure(provisionError, logicalId, change.resourceType);
+					const createdId = change.changeType === "CREATE" && statePhysicalId === void 0 ? markedCreatedId : void 0;
 					const heldRecord = newResources[logicalId] ?? previousState;
 					const replaced = change.changeType === "UPDATE" && !NO_REPLACEMENT_ORPHAN_TYPES.has(change.resourceType) && statePhysicalId !== void 0 && statePhysicalId !== "" && heldRecord?.physicalId === statePhysicalId ? heldRecord : void 0;
-					const replacementCreatedId = replaced ? createdBeforeFailure(provisionError, logicalId, change.resourceType) : void 0;
+					const replacementCreatedId = replaced ? markedCreatedId : void 0;
 					const orphanedBy = replaced !== void 0 && replacementCreatedId !== void 0 && replacementCreatedId !== replaced.physicalId ? {
 						record: replaced,
 						createdId: replacementCreatedId
@@ -53371,34 +53815,17 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 					if (attemptedGeneration !== void 0 && heldNow !== void 0) newResources[logicalId] = withNameGenerationReached(heldNow, logicalId, attemptedGeneration);
 					let replacementOrphanOp;
 					if (orphanedBy !== void 0) {
-						replacementOrphanOp = {
-							logicalId,
-							changeType: "CREATE",
-							resourceType: change.resourceType,
-							provisionedBy: "sdk",
-							physicalId: orphanedBy.createdId,
-							physicalIdRecoveredFromError: true,
-							deletionPolicy: journaledOrphanPolicy(extractTemplateAttributes(template, logicalId).deletionPolicy),
-							replacedPhysicalId: orphanedBy.record.physicalId,
-							replacedResourceType: orphanedBy.record.resourceType,
-							...engine.replacementRun.oldDeletedBeforeCreate.has(logicalId) && { replacedResourceDeleted: true },
-							...!refused && { attemptedProperties: engine.attemptedResolvedProps.get(logicalId) }
-						};
+						replacementOrphanOp = replacementOrphanOpFor(engine, template, logicalId, change.resourceType, orphanedBy.record, orphanedBy.createdId, refused);
 						failedOperations.push(replacementOrphanOp);
 					}
+					if (markedCreatedId === void 0 && (change.changeType === "CREATE" && statePhysicalId === void 0 || replaced !== void 0) && deadlineFiredFor(provisionError, logicalId)) reportedCreatesToSettle.push({
+						sink: createdSink,
+						failedOp,
+						...replaced !== void 0 && { replaced },
+						refused
+					});
 					const orphanOp = createdId !== void 0 ? failedOp : replacementOrphanOp;
-					if (orphanOp?.physicalId !== void 0 && orphanOp.deletionPolicy !== "Retain" && orphanNeedsIdentity(orphanOp)) {
-						const markedIdentity = createdResourceIdentityBeforeFailure(provisionError, logicalId, change.resourceType);
-						if (markedIdentity !== void 0) orphanOp.createdResourceIdentity = markedIdentity;
-						else if (engine.interruptCause !== "user") {
-							const identity = await readResourceIdentity(engine.providerRegistry, {
-								resourceType: orphanOp.resourceType,
-								physicalId: orphanOp.physicalId,
-								provisionedBy: orphanOp.provisionedBy
-							}, engine.stackRegion);
-							if (typeof identity === "string") orphanOp.createdResourceIdentity = identity;
-						}
-					}
+					if (orphanOp !== void 0) await journalOrphanIdentity(engine, orphanOp, createdResourceIdentityBeforeFailure(provisionError, logicalId, change.resourceType));
 					throw provisionError;
 				}
 				completedOperations.push({
@@ -53549,9 +53976,10 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 				engine.logger.warn(safeMsg`  ⚠ ${lost.logicalId} (${childType}) was removed from a resource this deploy re-created under the same id, and the deploy failed before writing it again: the next deploy writes it there again (its record keeps only the holders it is still on).`.concat(mayStillBeLive));
 			}
 		}
+		await settleReportedCreates(engine, template, failedOperations, reportedCreatesToSettle);
 		try {
 			const preRollbackState = {
-				version: 14,
+				version: 15,
 				region: engine.stackRegion,
 				stackName: currentState.stackName,
 				resources: newResources,
@@ -53592,7 +54020,15 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 			engine.logger.warn(safeMsg`Partial state has been saved. ${recoveryHint(engine.rollbackDeps(), "Run 'cdkd deploy' to resume, 'cdkd rollback' to revert, or destroy to clean up.")}`);
 		} else {
 			autoRollbackJournaled = await writeRollbackJournalSegment(engine.rollbackDeps(), stackName, completedOperations, failedOperations, "auto-rollback-started", initialDeploy);
-			const rollbackResult = await performRollback(engine.rollbackDeps(), completedOperations, newResources, stackName, currentState, failedOperations, currentState.orphans ?? []);
+			const rollbackResult = await performRollback(engine.rollbackDeps(), completedOperations, newResources, stackName, currentState, failedOperations, currentState.orphans ?? [], {
+				runMarks: (logicalId) => ({
+					names: engine.unsettledMarks.get(logicalId) ?? /* @__PURE__ */ new Set(),
+					items: engine.unsettledItemMarks.get(logicalId) ?? /* @__PURE__ */ new Map()
+				}),
+				stillRunning: (logicalId) => engine.inFlightBodies.get(logicalId),
+				recordMarks: (logicalId) => recordUnsettledMarks(engine, newResources, logicalId),
+				onReverted: (logicalId, settled) => dropUnsettledMarks(engine, logicalId, settled)
+			});
 			autoRollbackClean = autoRollbackJournaled && rollbackResult.failures === 0 && rollbackResult.skipped === 0 && !rollbackResult.interrupted;
 			if (rollbackResult.interrupted && rollbackResult.failures === 0 && rollbackResult.skipped === 0) {
 				const remedy = autoRollbackJournaled ? recoveryHint(engine.rollbackDeps(), "The rollback journal keeps them; finish the rollback with: " + pasteableCommand("cdkd rollback", [{
@@ -53617,7 +54053,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 		recordUnsettledMarks(engine, newResources);
 		try {
 			const postRollbackState = {
-				version: 14,
+				version: 15,
 				region: engine.stackRegion,
 				stackName: currentState.stackName,
 				resources: newResources,
@@ -53640,7 +54076,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 				const freshEtag = (await engine.stateBackend.getState(stackName, engine.stackRegion))?.etag;
 				recordUnsettledMarks(engine, newResources);
 				const postRollbackState = {
-					version: 14,
+					version: 15,
 					region: engine.stackRegion,
 					stackName: currentState.stackName,
 					resources: newResources,
@@ -53677,7 +54113,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 	}
 	return {
 		state: {
-			version: 14,
+			version: 15,
 			region: engine.stackRegion,
 			stackName: currentState.stackName,
 			resources: newResources,
@@ -53696,7 +54132,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 }
 async function persistStateAfterOutputFailure(engine, stackName, currentState, newResources, currentEtag, pendingMigration) {
 	const buildState = () => ({
-		version: 14,
+		version: 15,
 		region: engine.stackRegion,
 		stackName: currentState.stackName,
 		resources: newResources,
@@ -53735,6 +54171,73 @@ function recordUnsettledMarks(engine, newResources, only) {
 		if (only !== void 0 && logicalId !== only) continue;
 		if (marks.size === 0 || !Object.hasOwn(newResources, logicalId)) continue;
 		newResources[logicalId] = withUnsettledProperties(newResources[logicalId], marks);
+		const items = engine.unsettledItemMarks.get(logicalId);
+		if (items !== void 0 && items.size > 0) newResources[logicalId] = withUnsettledItems(newResources[logicalId], items);
+	}
+}
+function dropUnsettledMarks(engine, logicalId, names) {
+	const marks = engine.unsettledMarks.get(logicalId);
+	if (marks !== void 0) for (const name of names) marks.delete(name);
+	const items = engine.unsettledItemMarks.get(logicalId);
+	if (items !== void 0) {
+		for (const path of [...items.keys()]) if (names.has(unsettledItemsTopKey(path))) items.delete(path);
+	}
+}
+function deadlineFiredFor(error, logicalId) {
+	try {
+		let current = error;
+		for (let depth = 0; depth < 5 && typeof current === "object" && current !== null; depth++) {
+			if (current instanceof ResourceTimeoutError) return current.logicalId === logicalId;
+			current = current.cause;
+		}
+	} catch {}
+	return false;
+}
+async function settleReportedCreates(engine, template, failedOperations, pending) {
+	for (const { sink, failedOp, replaced, refused } of pending) {
+		const report = sink.report;
+		if (report === void 0) continue;
+		let orphanOp;
+		if (replaced === void 0) {
+			failedOp.provisionedBy = "sdk";
+			failedOp.physicalId = report.physicalId;
+			failedOp.physicalIdRecoveredFromError = true;
+			failedOp.deletionPolicy = journaledOrphanPolicy(extractTemplateAttributes(template, failedOp.logicalId).deletionPolicy);
+			orphanOp = failedOp;
+		} else {
+			if (report.physicalId === replaced.physicalId) continue;
+			failedOp.replacementOrphaned = engine.replacementRun.oldDeletedBeforeCreate.has(failedOp.logicalId) ? "delete-first" : "create-first";
+			orphanOp = replacementOrphanOpFor(engine, template, failedOp.logicalId, failedOp.resourceType, replaced, report.physicalId, refused);
+			failedOperations.push(orphanOp);
+		}
+		await journalOrphanIdentity(engine, orphanOp, report.createdResourceIdentity);
+	}
+}
+function replacementOrphanOpFor(engine, template, logicalId, resourceType, record, createdId, refused) {
+	return {
+		logicalId,
+		changeType: "CREATE",
+		resourceType,
+		provisionedBy: "sdk",
+		physicalId: createdId,
+		physicalIdRecoveredFromError: true,
+		deletionPolicy: journaledOrphanPolicy(extractTemplateAttributes(template, logicalId).deletionPolicy),
+		replacedPhysicalId: record.physicalId,
+		replacedResourceType: record.resourceType,
+		...engine.replacementRun.oldDeletedBeforeCreate.has(logicalId) && { replacedResourceDeleted: true },
+		...!refused && { attemptedProperties: engine.attemptedResolvedProps.get(logicalId) }
+	};
+}
+async function journalOrphanIdentity(engine, orphanOp, carried) {
+	if (orphanOp.physicalId === void 0 || orphanOp.deletionPolicy === "Retain" || !orphanNeedsIdentity(orphanOp)) return;
+	if (carried !== void 0) orphanOp.createdResourceIdentity = carried;
+	else if (engine.interruptCause !== "user") {
+		const identity = await readResourceIdentity(engine.providerRegistry, {
+			resourceType: orphanOp.resourceType,
+			physicalId: orphanOp.physicalId,
+			provisionedBy: orphanOp.provisionedBy
+		}, engine.stackRegion);
+		if (typeof identity === "string") orphanOp.createdResourceIdentity = identity;
 	}
 }
 
@@ -53778,7 +54281,7 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 		clock.lap("state load");
 		noteDeployStateRecord(currentStateData?.state !== void 0);
 		const currentState = currentStateData?.state ?? {
-			version: 14,
+			version: 15,
 			region: engine.stackRegion,
 			stackName,
 			resources: {},
@@ -54081,7 +54584,7 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 					await resolveStackInstanceId();
 					try {
 						const refreshedState = {
-							version: 14,
+							version: 15,
 							region: engine.stackRegion,
 							stackName: currentState.stackName,
 							resources: currentState.resources,
@@ -54370,6 +54873,8 @@ var DeployEngine = class {
 	outputsRun = new OutputsRunState();
 	attemptedResolvedProps = /* @__PURE__ */ new Map();
 	unsettledMarks = /* @__PURE__ */ new Map();
+	unsettledItemMarks = /* @__PURE__ */ new Map();
+	inFlightBodies = /* @__PURE__ */ new Map();
 	resumedCreates = /* @__PURE__ */ new Map();
 	generatedNameGuard;
 	liveTaskLabels = /* @__PURE__ */ new Map();
@@ -54563,6 +55068,7 @@ var DeployEngine = class {
 		this.replacementRun = new ReplacementRunState();
 		this.attemptedResolvedProps = /* @__PURE__ */ new Map();
 		this.unsettledMarks = /* @__PURE__ */ new Map();
+		this.unsettledItemMarks = /* @__PURE__ */ new Map();
 		this.resumedCreates = /* @__PURE__ */ new Map();
 		this.generatedNameGuard = void 0;
 		this.liveTaskLabels = /* @__PURE__ */ new Map();
@@ -54767,5 +55273,5 @@ function sameGenerationClaimsOf(record) {
 }
 
 //#endregion
-export { computeImplicitDeleteEdges as $, coerceParameterTypedValue as $a, DYNAMIC_REFERENCE_TOKEN_SCAN as $c, applyCustomResourceResponseExpiration as $i, stringifyValue as $l, WITHHELD_NAME_DISPLAY as $n, refuseMalformedOrphanRecords as $o, noEchoExactEchoLeavesOf as $r, readConfigString as $s, lookupEachName as $t, MIGRATE_TMP_PREFIX as $u, beginDeleteWait as A, s3BucketRegionalDomainName as Aa, valueAtCoordinate as Ac, isRefusedByName as Ai, isAccessDenied$1 as Al, resolveReplacementOldType as An, isReadableResourceEntry as Ao, awaitInFlightSibling as Ar, withheldAccountClause as As, displacedOpClause as At, redactedDockerCause as Au, waitForIndexesSettled as B, assertFlagRoleArn as Ba, logOnlyValueCount as Bc, stringifyIfAssigned as Bi, hasUnverifiableParameterRefusal as Bl, updatePartialMessage as Bn, malformedOrphansRefusalMessage as Bo, yellow as Br, isStatefulRecreateTargetForReplace as Bs, getCurrentNestedStackContext as Bt, loadCdkJson as Bu, planContributorInsightsOp as C, withoutUnsettledProperties as Ca, noEchoCoordinatesOf as Cc, resolveAssemblyPath as Cd, ledgerForStack as Ci, isLockInfoExpired as Cl, isJournaledOrphan as Cn, accountArgs as Co, rollbackOrphanIds as Cr, repairMalformedOutputsForReadOnly as Cs, makeSiblingClaimReader as Ct, formatDockerLoginError as Cu, reverseMapTableContributorInsights as D, s3BucketArn as Da, readbackPathFor as Dc, resolveBucketRegion as Dd, DeploymentEventsReader as Di, CrossPrefixScanCache as Dl, recheckFailedPlan as Dn, hasReadableOutputs as Do, mappingPairs as Dr, unpreviewableOrphanRecords as Ds, keptForRetainedRecord as Dt, partitionSensitiveEnv as Du, reverseMapIndexContributorInsights as E, isSettledInstanceState as Ea, passedNoEchoParametersOf as Ec, clearBucketRegionCache as Ed, acquireIdempotencyToken as Ei, CrossPrefixReadError as El, planRollback as En, hasReadableOrphans as Eo, looselyEqual as Er, repairMalformedResourcesForReadOnly as Es, resolvePendingCloudControlRequests as Et, isMalformedEnvKey as Eu, DELETE_INDEX_WAIT_PROCEED_NOTE as F, keepHeldTokenProvenance as Fa, snapshotPassProvenance as Fc, readTagList as Fi, acceptedCreateOnlyDropsOf as Fl, inheritProducerRegions as Fn, malformedLocalResourceEntriesWarning as Fo, bold as Fr, NO_CC_HANDLERS_REASON as Fs, recordDisplacedSkips as Ft, getDockerImageBySourceHash as Fu, sendTtlWaitingOutRateLimit as G, AWS_CREDENTIAL_ENV_KEYS as Ga, unionOfSecretBags as Gc, wouldReturnToSdkProvider as Gi, orphansCarriedFrom as Gl, retiredAfterRollback as Gn, malformedResourceEntriesWarning as Go, removeSuperseded as Gr, isWarmThroughputDecrease as Gs, isHandledOrphan as Gt, resolveStateBucketWithDefault as Gu, isTtlRateLimited as H, explicitRoleArnOrThrow as Ha, recordLogOnlyParameterValue as Hc, ProviderRegistry as Hi, importableOutputs as Hl, nameGenerationCarriedFrom as Hn, malformedOutputsRefusalMessage as Ho, deleteSupersededEntry as Hr, renderStatefulReason as Hs, deleteJournaledOrphans as Ht, resolveAutoAssetStorage as Hu, INDEX_SETTLE_POLL_INTERVAL_MS as I, outputReferenceProvenanceOf as Ia, carryLogOnlyValues as Ic, refuseMalformedDesiredTags as Ii, describeRegionValueKind as Il, REDACTED_DELETE_ADDRESS_SKIP_REASON as In, malformedLocalResourcesWarning as Io, cyan as Ir, hasNoCloudControlHandlers as Is, revertNestedChildFromJournal as It, Synthesizer as Iu, hasCdkAutoDeleteTag as J, envCredentialsAreAssumedRole as Ja, maskSecretsInError as Jc, readsNoEchoDeleteValues as Ji, PhaseClock as Jl, withNameGenerationReached as Jn, malformedScrubResourceEntriesRefusalMessage as Jo, supersededHolderOf as Jr, coerceCfnBoolean as Js, makeForeignHolderScan as Jt, stateBucketExistenceConfirmed as Ju, ECR_AUTO_DELETE_IMAGES_TAG as K, applyCallerIdentityCredentials as Ka, createSecretMasker as Kc, waitForLambdaFunctionActive as Ki, shouldRetainResource as Kl, retiredNameGenerationsAfter as Kn, malformedResourcePropertiesWarning as Ko, supersededAfterRollback as Kr, toCfnInteger as Ks, journaledOrphanLines as Kt, resolveStateBucketWithDefaultAndSource as Ku, deleteTableWithIndexBusyRetry as L, recordedOutputReferenceRegions as La, createUnionSecretMasker as Lc, tagMapAsList as Li, exportNamesCarriedFrom as Ll, isRedactedRecordedValue as Ln, malformedOrphanRecordsRefusalMessage as Lo, gray as Lr, findReplacedReadersOfRecreateTargets as Ls, revertedNestedRowIds as Lt, synthesisStatusMessage as Lu, deleteBudgetKey as M, resolveDynamicReferences as Ma, markSameGenerationBag as Mc, DBPROXY_TAGS_WHAT as Mi, stackInstanceIdOf as Ml, orphanNeedsIdentity as Mn, malformedExportNamesWarning as Mo, getStackRecords as Mr, findSilentDropProperties as Ms, dropSettledNestedJournals as Mt, runDockerStreaming as Mu, resolveDynamoDbDeleteBudgetClock as N, producerLookupOver as Na, redactForState as Nc, DBPROXY_TAG_OPTIONS as Ni, withStackInstanceIdWithheld as Nl, findNestedStackTypeChanges as Nn, malformedExportSourceWarning as No, withStackRecords as Nr, unwrittenCreateOnlyReplacement as Ns, getNestedRevertRun as Nt, warnFinchArgvExposure as Nu, stripIndexContributorInsights as O, s3BucketDomainName as Oa, readsNoEchoSource as Oc, DeploymentEventsStore as Oi, applyCrossPrefixScan as Ol, recordUnderIdIsNotOwn as On, hasReadableResources as Oo, parseMappingFile as Or, unreadableOrphanRecords as Os, recordRetainedForReadoption as Ot, redactDockerArgvValues as Ou, resolveDynamoDbDeleteBudgetMs as P, refuseUnreadableCdkCrossAccountRefs as Pa, recordReferenceProvenanceEntry as Pc, planTagDiff as Pi, splitImportedOps as Pl, getCurrentProducerRegions as Pn, malformedLocalOutputsWarning as Po, replacedDeleteFailureVerdict as Pr, withoutSilentDropProperties as Ps, nestedChildStackName as Pt, AssetManifestLoader as Pu, IMPLICIT_DELETE_DEPENDENCIES as Q, regionLessSecretName as Qa, withoutPhysicalNameCopies as Qc, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Qi, isSensitiveAttributeName as Ql, resourcesNamingDeclaredParameter as Qn, refuseMalformedNestedChildOutputs as Qo, noEchoComparisonForTemplate as Qr, configStringRefusal as Qs, isAccessDeniedError as Qt, CFN_TEMPLATE_URL_LIMIT as Qu, maskedLogger as R, recordedReferenceRegions as Ra, hasMaskableValues as Rc, tagPlanWarning as Ri, hasReadableExportSet as Rl, redactedDeleteAddressFields as Rn, malformedOrphanRecordsWarning as Ro, green as Rr, shownType as Rs, withNestedRevertRun as Rt, getDefaultStateBucketName as Ru, indexDeclaresContributorInsights as S, withUnsettledProperties as Sa, maskedLeafCoordinatesOf as Sc, renderAssemblyPathEscape as Sd, earliestDefined as Si, LockManager as Sl, demoteSupersededOrphans as Sn, UNREADABLE_RESOURCES_MAP_ROW as So, movedToHint as Sr, repairMalformedOrphansForReadOnly as Ss, makeCanonicalizePropertiesFn as St, finchSecretArgvRefusal as Su, readContributorInsightsSpec as T, poisonRenderedSpellingsCollidingIn as Ta, noEchoOutputsComparison as Tc, injectedAwsRegionValue as Td, withCreateTokenLedger as Ti, rebuildClientForBucketRegion as Tl, planFailedOps as Tn, displayLogicalId as To, isPairableType as Tr, repairMalformedResourcePropertiesForReadOnly as Ts, pendingRequestCount as Tt, isDockerClientEnvKey as Tu, planTimeToLive as U, isIamRoleArn as Ua, recordLogOnlyValue as Uc, ccBrokenReason as Ui, isReadableBag as Ul, nameGenerationHighWaterOf as Un, malformedOutputsWarning as Uo, holdsSupersededResources as Ur, WARM_THROUGHPUT_MEMBERS as Us, dropFailedCommands as Ut, resolveCaptureObservedState as Uu, isTtlAlreadyDisabled as V, assertSendableRoleArn as Va, printingCorpusOf as Vc, CC_BROKEN_REASON as Vi, importableOutputKeys as Vl, updatePartialReason as Vn, malformedOrphansWarning as Vo, addSuperseded as Vr, isStatefulRecreateTargetSync as Vs, withNestedStackContext as Vt, resolveApp as Vu, readTtlSpec as W, sendableAssumeRoleCommand as Wa, shareLogOnlyValues as Wc, isCustomResource as Wi, orphansAfterRollback as Wl, nameScopeOf as Wn, malformedRenderedContainersWarning as Wo, isSupersededResourceRecord as Wr, coerceWarmThroughput as Ws, dropFailedHint as Wt, resolveSkipPrefix as Wu, getPriorAttempts as X, classifyReplaySecretRegion as Xa, scrubResourceRecord as Xc, getCurrentResourceSecrets as Xi, timePhase as Xl, namesAnyDeclaredParameter as Xn, previewableOrphanRecords as Xo, withoutSuperseded as Xr, configBooleanRefusal as Xs, formatResourceLine as Xt, ssmResolvedValueType as Xu, isTruthyCfnBoolean as Y, classifyRecordedSecretRegion as Ya, maskSecretsInText as Yc, isCustomResourceType as Yi, renderPhaseTimings as Yl, computeParameterTaint as Yn, malformedStateRefusalMessage as Yo, supersededResourcesOf as Yr, coerceCfnInteger as Ys, sameJournaledOrphans as Yt, warnDeprecatedNoPrefixCliFlag as Yu, markRefusedBeforeApplying as Z, producerRegionsFromState as Za, withPhysicalNameCopies as Zc, withPrintingSecrets as Zi, AssetPublisher as Zl, reachableDivergentParameters as Zn, refuseDivergentRecordRegionForDestroy as Zo, noEchoAttributeNamesOf as Zr, configIntegerRefusal as Zs, chunks as Zt, CFN_TEMPLATE_BODY_LIMIT as Zu, streamMemberRefusals as _, reDisableInstanceApiTermination as _a, canonicalCoordinates as _c, nullPrototypeRecord as _d, createPreDeleteFinalSnapshot as _i, recordNoEchoParameterFreshValue as _l, withUnprovenUnsettled as _n, declaresNoEcho as _o, constructPathOf as _r, refuseMalformedResourcesForDeploy as _s, withResourceDeadline as _t, resolveDockerContextDirectory as _u, isProtectionValueActive as a, RollbackInlinePolicyWriters as aa, templateResourceTypes as ac, PARTITION_TABLE as ad, namingSecretsWithRecordedNoEcho as ai, inheritNestedStackParameterAssociations as al, refuseRefactorMarker as an, carriesFetchableDynamicReference as ao, carriedExportAliasExposure as ar, refuseMalformedOutputsForDestroy as as, childTemplateLoader as at, AssetModeResolver as au, CONTRIBUTOR_INSIGHTS_KEY as b, INTRINSIC_KEYS as ba, maskReadbackAtCoordinates as bc, describeFileReadFailure as bd, refusesFinalSnapshot as bi, WHOLE_DYNAMIC_REFERENCE_PATTERN as bl, equalModuloMask as bn, STATE_RESOURCES_MALFORMED as bo, findRefactorHints as br, refuseMalformedState as bs, keptWholeReasonText as bt, describeDockerFailure as bu, DynamoDBGlobalTableProvider as c, deleteLeftInPlace as ca, blockDeviceMappingsDifferOnlyInDeleteOnTermination as cc, AssemblyReader as cd, secretNamePrintingBags as ci, physicalNameCopiesOf as cl, hasPendingMovesOut as cn, AWS_NO_VALUE as co, isWholeDynamicReferenceValue as cr, refuseMalformedResourceEntriesForDeploy as cs, listNestedTemplateRows as ct, ensureAssetStorage as cu, declaredStreamPolicyMember as d, isWaitAbandonedError as da, emrClusterInstancesReplaced as dc, describeJsonParseFailure as dd, stateSecretNameNeedles as di, splitGetAttStringForm as dl, refusePendingMovesOut as dn, lacksRecordedTableArn as do, collectPublishedOutputNames as dr, refuseMalformedResourceEntriesForImportSave as ds, conditionFingerprint as dt, parseBootstrapMarker as du, customResourceResponseExpirationWarning as ea, replayWarn as ec, findLargeInlineResources as ed, noEchoParameterNamesOf as ei, dynamicReferenceTokens as el, withApiLimit as en, isUnboundTemplateParameter as eo, displayTextOrWithheld as er, refuseMalformedOrphanRecordsForDestroy as es, crossStackOutputProvenanceSource as et, WorkGraph as eu, declaredStreamTagsMember as f, markWaitAbandoned as fa, canonicalLambdaFunctionName as fc, parseFailureDebugDetail as fd, storedSecretNameNeedles as fi, carriesSecretMask as fl, replayFailedOperations as fn, refStateLookupFromResource as fo, isExportAliasCollision as fr, refuseMalformedResourceEntriesForOrphan as fs, conditionInputsFrom as ft, readBootstrapMarkerBody as fu, streamDeclaresTags as g, observeThenDisableInstanceApiTermination as ga, TemplateParser as gc, hasPlainPrototype$1 as gd, ccRoutedFinalSnapshotError as gi, recordNoEchoAttributeValues as gl, settleUnsettledPrevious as gn, passedParameterClassesOf as go, maskingRetryLogger as gr, refuseMalformedResourcePropertiesForOrphan as gs, enclosingDeadlineRemainingMs as gt, buildDockerImage as gu, streamDeclaresPolicy as h, isTerminationProtectionPropagationError as ha, DagBuilder as hc, hasOwnKey as hd, buildFinalSnapshotIdentifier as hi, recordMaskOnlyValuesIn as hl, recordAfterRollbackUpdate as hn, parameterInputsFor as ho, DEFAULT_RESOURCE_WARN_AFTER_MS as hr, refuseMalformedResourcePropertiesForExport as hs, enclosingDeadlineExpired as ht, buildDenyExternalAccessPolicy as hu, PROTECTION_PROPERTY_BY_TYPE as i, unchangedBehindSecretReference as ia, prefetchCreateOnlyPropertyPaths as ic, expectedOwnerParam as id, maskEventTextWithBoundBags as ii, identityKeyFor as il, refactorMarkerRefusalMessage as in, carriesDynamicReference as io, secretSafeKeyDisplay as ir, refuseMalformedOutputs as is, serviceTokenBlockingReason as it, rewriteTemplateAssetReferences as iu, compensateRemovedDeletionProtection as j, s3BucketWebsiteUrl as ja, liveMatchesUnresolvedTokenFrame as jc, markDeleteStarted as ji, isNotImplemented as jl, seedsDeleteFirstGuard as jn, malformedDriftResourcePropertiesWarning as jo, destroyStackRecordsView as jr, findActionableSilentDrops as js, displacedPhysicalIdShown as jt, runDockerForeground as ju, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as k, s3BucketDualStackDomainName as ka, recordedNoEchoValuesOf as kc, extractDeploymentEventError as ki, crossPrefixDeniedWarning as kl, replacementNeverSwapped as kn, isReadableOrphanRecord as ko, proposeRenames as kr, unreadableResourceEntries as ks, NESTED_PENDING_PARENT_REASON as kt, redactedCause as ku, STREAM_POLICY_KEY as l, deleteSkipReason as la, dbInstanceEngineChangeIsInPlace as lc, StageLoadError as ld, secretNamedAttributeNamesOf as li, recordAttributeIdCopy as ll, pendingMovesOutOf as ln, cfnRefValueFromPhysicalId as lo, noEchoParameterValueSeed as lr, refuseMalformedResourceEntriesForDestroy as ls, renderNestedTemplateTreeDefect as lt, getBootstrapMarkerKey as lu, reverseMapStreamPolicy as m, ec2InstanceProtectionSite as ma, sameLambdaFunctionAddress as mc, defineOwnKey as md, PRE_DELETE_SNAPSHOT_TYPES as mi, recordMaskOnlyValue as ml, removeProtectionTypeList as mn, withSharedDrainBudget as mo, DEFAULT_RESOURCE_TIMEOUT_MS as mr, refuseMalformedResourcePropertiesForDrift as ms, readRecordedConditionVerdicts as mt, validateContainerRepoName as mu, recordedProtectionEvidence as n, slowCcOperationTimeoutMs as na, requireConfigObject as nc, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as nd, completedReplayEntries as ni, pathCrossesDottedKey as nl, readRefactorMarkerOnce as nn, getAccountInfo as no, secretBearing as nr, refuseMalformedOrphansForDestroy as ns, deferredServiceTokenWarning as nt, createAssetRedirectResolver as nu, perType as o, UNSPECIFIED_SKIP_REASON as oa, describeTypeWithThrottleRetry as oc, canonicalizeRegion as od, orphanRecordsPrintingBag as oi, recordNestedStackParameterExpressions as ol, sameMove as on, isNamelessDynamicReferenceError as oo, exportNameNoEchoParameters as or, refuseMalformedResourceAttributesForOrphan as os, findNestedTemplateTreeDefect as ot, BOOTSTRAP_MARKER_PREFIX as ou, planStreamMemberOps as p, disableInstanceApiTermination as pa, lambdaFunctionNameForMask as pc, utf8ByteLength as pd, ATOMIC_FINAL_SNAPSHOT_TYPES as pi, provenPublicValue as pl, replayRollback as pn, parseWebACLArn as po, bindingSkippedOutputs as pr, refuseMalformedResourcePropertiesForDestroy as ps, parentSuppliedValues as pt, validateAssetBucketName as pu, S3_AUTO_DELETE_OBJECTS_TAG as q, callerEnvCredentials as qa, errorCauseChain as qc, TemplateNoEchoReresolver as qi, stackInstanceIdCarriedFrom as ql, retiredNameGenerationsLeaving as qn, malformedResourcesWarning as qo, supersededHeldByOtherTypeWarning as qr, toFiniteNumber as qs, loadJournaledOrphans as qt, resolveUseCdkBootstrapAssets as qu, recordedProtectionNote as r, onlySecretReferencesDiffer as ra, requireConfigString as rc, decodeListingKey as rd, journaledOrphanPrintingBag as ri, spelledKeysOf as rl, refactorMarkerMovesOf as rn, isImpossibleEmptyStoredAttribute as ro, secretBearingStateKeyWarning as rr, refuseMalformedOrphansForOrphan as rs, findServiceTokenRefusals as rt, loadPublishableAssetManifest as ru, readProtection as s, deleteIndeterminateGuards as sa, withRetry as sc, derivePartitionAndUrlSuffix as sd, secretNamePrintingBag as si, recoverMaskedOutput as sl, updateRefactorMarker as sn, keepsSecretReferenceToken as so, exportNameSecretExposure as sr, refuseMalformedResourceEntries as ss, isAbsoluteAssetPath as st, assertAssetBucketRegion as su, DeployEngine as t, CloudControlProvider as ta, requireConfigArray as tc, uploadCfnTemplate as td, createReadOnlyAttributeHealerFactory as ti, isUncertifiedBaselineMaskPosition as tl, readRefactorMarker as tn, parameterTypeMayLoseSecretIdentity as to, exportAliasCollisionScrubWarning as tr, refuseMalformedOrphans as ts, inheritedProvenanceForChildDiff as tt, buildAssetRedirectMap as tu, STREAM_TAGS_KEY as u, withIndeterminateGuard as ua, ecsServiceLaunchTypeSetOrChanged as uc, processStackMessages as ud, secretNamedRecordNeedles as ui, recordPhysicalNameCopy as ul, pendingMovesRefusalMessage as un, isStalePlaceholderArnAttribute as uo, collectDeclaredOutputNames as ur, refuseMalformedResourceEntriesForImport as us, templateIdentity as ut, isCrossRegionRedirect as uu, streamPolicyMatchesDeclared as v, reEnableInstanceApiTermination as va, isMarkedCoordinate as vc, ownValue as vd, effectiveDeletionPolicy as vi, recordProvenPublicExpression as vl, calculateResourceDrift as vn, JSON_LISTING_HOLE_VALUE as vo, findDestructiveChanges as vr, refuseMalformedResourcesForDestroy as vs, diffSecurity as vt, describeDockerCapturedOutput as vu, planIndexContributorInsightsOps as w, IntrinsicFunctionResolver as wa, noEchoLeavesOf as wc, injectAwsRegion as wd, reserveStackCreateToken as wi, S3StateBackend as wl, isReplacementOrphan as wn, deployRefusesOrphanRowsReason as wo, withMovedTo as wr, repairMalformedResourceEntriesForReadOnly as ws, planOrphanAdoption as wt, getDockerCmd as wu, contributorInsightsRefusals as x, unsettledPropertiesOf as xa, maskWholeValue as xc, displayAssemblyPath as xd, unsupportedFinalSnapshotError as xi, isSingleDynamicReferenceToken as xl, undeclaredEmptyObservedKeys as xn, UNREADABLE_ORPHANS_CONTAINER_ROW as xo, hintSidesOf as xr, repairMalformedOrphanRecordsForReadOnly as xs, mergeNoChangeOutputs as xt, dockerSpawnEnvWithSensitive as xu, streamTagsMatchDeclared as y, DiffCalculator as ya, maskAtCoordinates as yc, absoluteAssemblyPathEscape as yd, isFinalSnapshotError as yi, wholeStringLeavesOf as yl, equalModuloMarkedMask as yn, STATE_REGION_DIVERGED as yo, formatDestructiveChange as yr, refuseMalformedResourcesForExport as ys, isSecretBearingReferenceString as yt, describeDockerExecFailure as yu, relayedIndexBusyDelete as z, applyRoleArnIfSet as za, literalSplitDelimitersOf as zc, definedAttributes as zi, hasReasonlessBaselineRefusal as zl, redactedDeleteAddressSkip as zn, malformedOrphanRowsKeptWarning as zo, red as zr, MULTI_REGION_RECREATE_BLOCKED_TYPES as zs, collectNestedChildUnaddressed as zt, getLegacyStateBucketName as zu };
-//# sourceMappingURL=deploy-engine-tQ0aqZMo.js.map
+export { IMPLICIT_DELETE_DEPENDENCIES as $, envCredentialsAreAssumedRole as $a, maskSecretsInError as $c, withPrintingSecrets as $i, PhaseClock as $l, resourcesNamingDeclaredParameter as $n, malformedScrubResourceEntriesRefusalMessage as $o, noEchoComparisonForTemplate as $r, coerceCfnBoolean as $s, isAccessDeniedError as $t, stateBucketExistenceConfirmed as $u, DYNAMODB_DELETE_POLL_COST_MS as A, poisonRenderedSpellingsCollidingIn as Aa, noEchoOutputsComparison as Ac, injectedAwsRegionValue as Ad, DeploymentEventsStore as Ai, rebuildClientForBucketRegion as Al, replacementNeverSwapped as An, displayLogicalId as Ao, proposeRenames as Ar, repairMalformedResourcePropertiesForReadOnly as As, NESTED_PENDING_PARENT_REASON as At, isDockerClientEnvKey as Au, relayedIndexBusyDelete as B, keepHeldTokenProvenance as Ba, snapshotPassProvenance as Bc, tagPlanWarning as Bi, acceptedCreateOnlyDropsOf as Bl, redactedDeleteAddressSkip as Bn, malformedLocalResourceEntriesWarning as Bo, red as Br, NO_CC_HANDLERS_REASON as Bs, collectNestedChildUnaddressed as Bt, getDockerImageBySourceHash as Bu, planContributorInsightsOp as C, isUsableAttemptedName as Ca, isMarkedCoordinate as Cc, ownValue as Cd, unsupportedFinalSnapshotError as Ci, recordProvenPublicExpression as Cl, demoteSupersededOrphans as Cn, JSON_LISTING_HOLE_VALUE as Co, movedToHint as Cr, refuseMalformedResourcesForDestroy as Cs, makeCanonicalizePropertiesFn as Ct, describeDockerCapturedOutput as Cu, reverseMapTableContributorInsights as D, withUnsettledProperties as Da, maskedLeafCoordinatesOf as Dc, renderAssemblyPathEscape as Dd, withCreateTokenLedger as Di, LockManager as Dl, planRollback as Dn, UNREADABLE_RESOURCES_MAP_ROW as Do, looselyEqual as Dr, repairMalformedOrphansForReadOnly as Ds, resolvePendingCloudControlRequests as Dt, finchSecretArgvRefusal as Du, reverseMapIndexContributorInsights as E, unsettledPropertiesOf as Ea, maskWholeValue as Ec, displayAssemblyPath as Ed, reserveStackCreateToken as Ei, isSingleDynamicReferenceToken as El, planFailedOps as En, UNREADABLE_ORPHANS_CONTAINER_ROW as Eo, isPairableType as Er, repairMalformedOrphanRecordsForReadOnly as Es, pendingRequestCount as Et, dockerSpawnEnvWithSensitive as Eu, resolveDynamoDbDeleteBudgetMs as F, s3BucketRegionalDomainName as Fa, valueAtCoordinate as Fc, DBPROXY_TAG_OPTIONS as Fi, isAccessDenied$1 as Fl, getCurrentProducerRegions as Fn, isReadableResourceEntry as Fo, replacedDeleteFailureVerdict as Fr, withheldAccountClause as Fs, nestedChildStackName as Ft, redactedDockerCause as Fu, readTtlSpec as G, assertFlagRoleArn as Ga, logOnlyValueCount as Gc, ccBrokenReason as Gi, hasUnverifiableParameterRefusal as Gl, nameScopeOf as Gn, malformedOrphansRefusalMessage as Go, isSupersededResourceRecord as Gr, isStatefulRecreateTargetForReplace as Gs, dropFailedHint as Gt, loadCdkJson as Gu, isTtlAlreadyDisabled as H, recordedOutputReferenceRegions as Ha, createUnionSecretMasker as Hc, stringifyIfAssigned as Hi, exportNamesCarriedFrom as Hl, updatePartialReason as Hn, malformedOrphanRecordsRefusalMessage as Ho, addSuperseded as Hr, findReplacedReadersOfRecreateTargets as Hs, withNestedStackContext as Ht, synthesisStatusMessage as Hu, DELETE_INDEX_WAIT_PROCEED_NOTE as I, s3BucketWebsiteUrl as Ia, liveMatchesUnresolvedTokenFrame as Ic, planTagDiff as Ii, isNotImplemented as Il, inheritProducerRegions as In, malformedDriftResourcePropertiesWarning as Io, bold as Ir, findActionableSilentDrops as Is, recordDisplacedSkips as It, runDockerForeground as Iu, S3_AUTO_DELETE_OBJECTS_TAG as J, isIamRoleArn as Ja, recordLogOnlyValue as Jc, waitForLambdaFunctionActive as Ji, isReadableBag as Jl, retiredNameGenerationsLeaving as Jn, malformedOutputsWarning as Jo, supersededHeldByOtherTypeWarning as Jr, WARM_THROUGHPUT_MEMBERS as Js, loadJournaledOrphans as Jt, resolveCaptureObservedState as Ju, sendTtlWaitingOutRateLimit as K, assertSendableRoleArn as Ka, printingCorpusOf as Kc, isCustomResource as Ki, importableOutputKeys as Kl, retiredAfterRollback as Kn, malformedOrphansWarning as Ko, removeSuperseded as Kr, isStatefulRecreateTargetSync as Ks, isHandledOrphan as Kt, resolveApp as Ku, INDEX_SETTLE_POLL_INTERVAL_MS as L, resolveDynamicReferences as La, markSameGenerationBag as Lc, readTagList as Li, stackInstanceIdOf as Ll, REDACTED_DELETE_ADDRESS_SKIP_REASON as Ln, malformedExportNamesWarning as Lo, cyan as Lr, findSilentDropProperties as Ls, revertNestedChildFromJournal as Lt, runDockerStreaming as Lu, compensateRemovedDeletionProtection as M, s3BucketArn as Ma, readbackPathFor as Mc, resolveBucketRegion as Md, isRefusedByName as Mi, CrossPrefixScanCache as Ml, seedsDeleteFirstGuard as Mn, hasReadableOutputs as Mo, destroyStackRecordsView as Mr, unpreviewableOrphanRecords as Ms, displacedPhysicalIdShown as Mt, partitionSensitiveEnv as Mu, deleteBudgetKey as N, s3BucketDomainName as Na, readsNoEchoSource as Nc, markDeleteStarted as Ni, applyCrossPrefixScan as Nl, orphanNeedsIdentity as Nn, hasReadableResources as No, getStackRecords as Nr, unreadableOrphanRecords as Ns, dropSettledNestedJournals as Nt, redactDockerArgvValues as Nu, stripIndexContributorInsights as O, withoutUnsettledProperties as Oa, noEchoCoordinatesOf as Oc, resolveAssemblyPath as Od, acquireIdempotencyToken as Oi, isLockInfoExpired as Ol, recheckFailedPlan as On, accountArgs as Oo, mappingPairs as Or, repairMalformedOutputsForReadOnly as Os, keptForRetainedRecord as Ot, formatDockerLoginError as Ou, resolveDynamoDbDeleteBudgetClock as P, s3BucketDualStackDomainName as Pa, recordedNoEchoValuesOf as Pc, DBPROXY_TAGS_WHAT as Pi, crossPrefixDeniedWarning as Pl, findNestedStackTypeChanges as Pn, isReadableOrphanRecord as Po, withStackRecords as Pr, unreadableResourceEntries as Ps, getNestedRevertRun as Pt, redactedCause as Pu, markRefusedBeforeApplying as Q, callerEnvCredentials as Qa, errorCauseChain as Qc, getCurrentResourceSecrets as Qi, stackInstanceIdCarriedFrom as Ql, reachableDivergentParameters as Qn, malformedResourcesWarning as Qo, noEchoAttributeNamesOf as Qr, toFiniteNumber as Qs, chunks as Qt, resolveUseCdkBootstrapAssets as Qu, deleteTableWithIndexBusyRetry as R, producerLookupOver as Ra, redactForState as Rc, refuseMalformedDesiredTags as Ri, withStackInstanceIdWithheld as Rl, isRedactedRecordedValue as Rn, malformedExportSourceWarning as Ro, gray as Rr, unwrittenCreateOnlyReplacement as Rs, revertedNestedRowIds as Rt, warnFinchArgvExposure as Ru, indexDeclaresContributorInsights as S, INTRINSIC_KEYS as Sa, canonicalCoordinates as Sc, nullPrototypeRecord as Sd, refusesFinalSnapshot as Si, recordNoEchoParameterFreshValue as Sl, undeclaredEmptyObservedKeys as Sn, declaresNoEcho as So, hintSidesOf as Sr, refuseMalformedResourcesForDeploy as Ss, mergeNoChangeOutputs as St, resolveDockerContextDirectory as Su, readContributorInsightsSpec as T, unsettledItemsOf as Ta, maskReadbackAtCoordinates as Tc, describeFileReadFailure as Td, ledgerForStack as Ti, WHOLE_DYNAMIC_REFERENCE_PATTERN as Tl, isReplacementOrphan as Tn, STATE_RESOURCES_MALFORMED as To, withMovedTo as Tr, refuseMalformedState as Ts, planOrphanAdoption as Tt, describeDockerFailure as Tu, isTtlRateLimited as U, recordedReferenceRegions as Ua, hasMaskableValues as Uc, CC_BROKEN_REASON as Ui, hasReadableExportSet as Ul, nameGenerationCarriedFrom as Un, malformedOrphanRecordsWarning as Uo, deleteSupersededEntry as Ur, shownType as Us, deleteJournaledOrphans as Ut, getDefaultStateBucketName as Uu, waitForIndexesSettled as V, outputReferenceProvenanceOf as Va, carryLogOnlyValues as Vc, definedAttributes as Vi, describeRegionValueKind as Vl, updatePartialMessage as Vn, malformedLocalResourcesWarning as Vo, yellow as Vr, hasNoCloudControlHandlers as Vs, getCurrentNestedStackContext as Vt, Synthesizer as Vu, planTimeToLive as W, applyRoleArnIfSet as Wa, literalSplitDelimitersOf as Wc, ProviderRegistry as Wi, hasReasonlessBaselineRefusal as Wl, nameGenerationHighWaterOf as Wn, malformedOrphanRowsKeptWarning as Wo, holdsSupersededResources as Wr, MULTI_REGION_RECREATE_BLOCKED_TYPES as Ws, dropFailedCommands as Wt, getLegacyStateBucketName as Wu, isTruthyCfnBoolean as X, AWS_CREDENTIAL_ENV_KEYS as Xa, unionOfSecretBags as Xc, readsNoEchoDeleteValues as Xi, orphansCarriedFrom as Xl, computeParameterTaint as Xn, malformedResourceEntriesWarning as Xo, supersededResourcesOf as Xr, isWarmThroughputDecrease as Xs, sameJournaledOrphans as Xt, resolveStateBucketWithDefault as Xu, hasCdkAutoDeleteTag as Y, sendableAssumeRoleCommand as Ya, shareLogOnlyValues as Yc, TemplateNoEchoReresolver as Yi, orphansAfterRollback as Yl, withNameGenerationReached as Yn, malformedRenderedContainersWarning as Yo, supersededHolderOf as Yr, coerceWarmThroughput as Ys, makeForeignHolderScan as Yt, resolveSkipPrefix as Yu, getPriorAttempts as Z, applyCallerIdentityCredentials as Za, createSecretMasker as Zc, isCustomResourceType as Zi, shouldRetainResource as Zl, namesAnyDeclaredParameter as Zn, malformedResourcePropertiesWarning as Zo, withoutSuperseded as Zr, toCfnInteger as Zs, formatResourceLine as Zt, resolveStateBucketWithDefaultAndSource as Zu, streamMemberRefusals as _, isTerminationProtectionPropagationError as _a, canonicalLambdaFunctionName as _c, parseFailureDebugDetail as _d, buildFinalSnapshotIdentifier as _i, carriesSecretMask as _l, settleUnsettledPrevious as _n, refStateLookupFromResource as _o, maskingRetryLogger as _r, refuseMalformedResourceEntriesForOrphan as _s, enclosingDeadlineRemainingMs as _t, readBootstrapMarkerBody as _u, isProtectionValueActive as a, onlySecretReferencesDiffer as aa, replayWarn as ac, findLargeInlineResources as ad, journaledOrphanPrintingBag as ai, dynamicReferenceTokens as al, refactorMarkerRefusalMessage as an, isUnboundTemplateParameter as ao, secretSafeKeyDisplay as ar, refuseMalformedOrphanRecordsForDestroy as as, serviceTokenBlockingReason as at, WorkGraph as au, CONTRIBUTOR_INSIGHTS_KEY as b, reEnableInstanceApiTermination as ba, DagBuilder as bc, hasOwnKey as bd, effectiveDeletionPolicy as bi, recordMaskOnlyValuesIn as bl, equalModuloMarkedMask as bn, parameterInputsFor as bo, formatDestructiveChange as br, refuseMalformedResourcePropertiesForExport as bs, isSecretBearingReferenceString as bt, buildDenyExternalAccessPolicy as bu, DynamoDBGlobalTableProvider as c, UNSPECIFIED_SKIP_REASON as ca, requireConfigString as cc, decodeListingKey as cd, orphanRecordsPrintingBag as ci, spelledKeysOf as cl, updateRefactorMarker as cn, isImpossibleEmptyStoredAttribute as co, exportNameSecretExposure as cr, refuseMalformedOrphansForOrphan as cs, isAbsoluteAssetPath as ct, loadPublishableAssetManifest as cu, declaredStreamPolicyMember as d, deleteSkipReason as da, describeTypeWithThrottleRetry as dc, canonicalizeRegion as dd, secretNamedAttributeNamesOf as di, recordNestedStackParameterExpressions as dl, pendingMovesRefusalMessage as dn, isNamelessDynamicReferenceError as do, collectDeclaredOutputNames as dr, refuseMalformedResourceAttributesForOrphan as ds, templateIdentity as dt, BOOTSTRAP_MARKER_PREFIX as du, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as ea, coerceCfnInteger as ec, warnDeprecatedNoPrefixCliFlag as ed, noEchoExactEchoLeavesOf as ei, maskSecretsInText as el, lookupEachName as en, classifyRecordedSecretRegion as eo, WITHHELD_NAME_DISPLAY as er, malformedStateRefusalMessage as es, computeImplicitDeleteEdges as et, renderPhaseTimings as eu, declaredStreamTagsMember as f, withIndeterminateGuard as fa, withRetry as fc, derivePartitionAndUrlSuffix as fd, secretNamedRecordNeedles as fi, recoverMaskedOutput as fl, refusePendingMovesOut as fn, keepsSecretReferenceToken as fo, collectPublishedOutputNames as fr, refuseMalformedResourceEntries as fs, conditionFingerprint as ft, assertAssetBucketRegion as fu, streamDeclaresTags as g, ec2InstanceProtectionSite as ga, emrClusterInstancesReplaced as gc, describeJsonParseFailure as gd, PRE_DELETE_SNAPSHOT_TYPES as gi, splitGetAttStringForm as gl, recordAfterRollbackUpdate as gn, lacksRecordedTableArn as go, DEFAULT_RESOURCE_WARN_AFTER_MS as gr, refuseMalformedResourceEntriesForImportSave as gs, enclosingDeadlineExpired as gt, parseBootstrapMarker as gu, streamDeclaresPolicy as h, disableInstanceApiTermination as ha, ecsServiceLaunchTypeSetOrChanged as hc, processStackMessages as hd, ATOMIC_FINAL_SNAPSHOT_TYPES as hi, recordPhysicalNameCopy as hl, removeProtectionTypeList as hn, isStalePlaceholderArnAttribute as ho, DEFAULT_RESOURCE_TIMEOUT_MS as hr, refuseMalformedResourceEntriesForImport as hs, readRecordedConditionVerdicts as ht, isCrossRegionRedirect as hu, PROTECTION_PROPERTY_BY_TYPE as i, slowCcOperationTimeoutMs as ia, readConfigString as ic, MIGRATE_TMP_PREFIX as id, completedReplayEntries as ii, DYNAMIC_REFERENCE_TOKEN_SCAN as il, refactorMarkerMovesOf as in, coerceParameterTypedValue as io, secretBearingStateKeyWarning as ir, refuseMalformedOrphanRecords as is, findServiceTokenRefusals as it, stringifyValue as iu, beginDeleteWait as j, isSettledInstanceState as ja, passedNoEchoParametersOf as jc, clearBucketRegionCache as jd, extractDeploymentEventError as ji, CrossPrefixReadError as jl, resolveReplacementOldType as jn, hasReadableOrphans as jo, awaitInFlightSibling as jr, repairMalformedResourcesForReadOnly as js, displacedOpClause as jt, isMalformedEnvKey as ju, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as k, IntrinsicFunctionResolver as ka, noEchoLeavesOf as kc, injectAwsRegion as kd, DeploymentEventsReader as ki, S3StateBackend as kl, recordUnderIdIsNotOwn as kn, deployRefusesOrphanRowsReason as ko, parseMappingFile as kr, repairMalformedResourceEntriesForReadOnly as ks, recordRetainedForReadoption as kt, getDockerCmd as ku, STREAM_POLICY_KEY as l, deleteIndeterminateGuards as la, prefetchCreateOnlyPropertyPaths as lc, expectedOwnerParam as ld, secretNamePrintingBag as li, identityKeyFor as ll, hasPendingMovesOut as ln, carriesDynamicReference as lo, isWholeDynamicReferenceValue as lr, refuseMalformedOutputs as ls, listNestedTemplateRows as lt, rewriteTemplateAssetReferences as lu, reverseMapStreamPolicy as m, markWaitAbandoned as ma, dbInstanceEngineChangeIsInPlace as mc, StageLoadError as md, storedSecretNameNeedles as mi, recordAttributeIdCopy as ml, replayRollback as mn, cfnRefValueFromPhysicalId as mo, bindingSkippedOutputs as mr, refuseMalformedResourceEntriesForDestroy as ms, parentSuppliedValues as mt, getBootstrapMarkerKey as mu, recordedProtectionEvidence as n, customResourceResponseExpirationWarning as na, configIntegerRefusal as nc, CFN_TEMPLATE_BODY_LIMIT as nd, withAttemptedItemsMasked as ni, withPhysicalNameCopies as nl, readRefactorMarker as nn, producerRegionsFromState as no, exportAliasCollisionScrubWarning as nr, refuseDivergentRecordRegionForDestroy as ns, inheritedProvenanceForChildDiff as nt, AssetPublisher as nu, perType as o, unchangedBehindSecretReference as oa, requireConfigArray as oc, uploadCfnTemplate as od, maskEventTextWithBoundBags as oi, isUncertifiedBaselineMaskPosition as ol, refuseRefactorMarker as on, parameterTypeMayLoseSecretIdentity as oo, carriedExportAliasExposure as or, refuseMalformedOrphans as os, childTemplateLoader as ot, buildAssetRedirectMap as ou, planStreamMemberOps as p, isWaitAbandonedError as pa, blockDeviceMappingsDifferOnlyInDeleteOnTermination as pc, AssemblyReader as pd, stateSecretNameNeedles as pi, physicalNameCopiesOf as pl, replayFailedOperations as pn, AWS_NO_VALUE as po, isExportAliasCollision as pr, refuseMalformedResourceEntriesForDeploy as ps, conditionInputsFrom as pt, ensureAssetStorage as pu, ECR_AUTO_DELETE_IMAGES_TAG as q, explicitRoleArnOrThrow as qa, recordLogOnlyParameterValue as qc, wouldReturnToSdkProvider as qi, importableOutputs as ql, retiredNameGenerationsAfter as qn, malformedOutputsRefusalMessage as qo, supersededAfterRollback as qr, renderStatefulReason as qs, journaledOrphanLines as qt, resolveAutoAssetStorage as qu, recordedProtectionNote as r, CloudControlProvider as ra, configStringRefusal as rc, CFN_TEMPLATE_URL_LIMIT as rd, createReadOnlyAttributeHealerFactory as ri, withoutPhysicalNameCopies as rl, readRefactorMarkerOnce as rn, regionLessSecretName as ro, secretBearing as rr, refuseMalformedNestedChildOutputs as rs, deferredServiceTokenWarning as rt, isSensitiveAttributeName as ru, readProtection as s, RollbackInlinePolicyWriters as sa, requireConfigObject as sc, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as sd, namingSecretsWithRecordedNoEcho as si, pathCrossesDottedKey as sl, sameMove as sn, getAccountInfo as so, exportNameNoEchoParameters as sr, refuseMalformedOrphansForDestroy as ss, findNestedTemplateTreeDefect as st, createAssetRedirectResolver as su, DeployEngine as t, applyCustomResourceResponseExpiration as ta, configBooleanRefusal as tc, ssmResolvedValueType as td, noEchoParameterNamesOf as ti, scrubResourceRecord as tl, withApiLimit as tn, classifyReplaySecretRegion as to, displayTextOrWithheld as tr, previewableOrphanRecords as ts, crossStackOutputProvenanceSource as tt, timePhase as tu, STREAM_TAGS_KEY as u, deleteLeftInPlace as ua, templateResourceTypes as uc, PARTITION_TABLE as ud, secretNamePrintingBags as ui, inheritNestedStackParameterAssociations as ul, pendingMovesOutOf as un, carriesFetchableDynamicReference as uo, noEchoParameterValueSeed as ur, refuseMalformedOutputsForDestroy as us, renderNestedTemplateTreeDefect as ut, AssetModeResolver as uu, streamPolicyMatchesDeclared as v, observeThenDisableInstanceApiTermination as va, lambdaFunctionNameForMask as vc, utf8ByteLength as vd, ccRoutedFinalSnapshotError as vi, provenPublicValue as vl, withUnprovenUnsettled as vn, parseWebACLArn as vo, constructPathOf as vr, refuseMalformedResourcePropertiesForDestroy as vs, withResourceDeadline as vt, validateAssetBucketName as vu, planIndexContributorInsightsOps as w, unsettledItemsField as wa, maskAtCoordinates as wc, absoluteAssemblyPathEscape as wd, earliestDefined as wi, wholeStringLeavesOf as wl, isJournaledOrphan as wn, STATE_REGION_DIVERGED as wo, rollbackOrphanIds as wr, refuseMalformedResourcesForExport as ws, makeSiblingClaimReader as wt, describeDockerExecFailure as wu, contributorInsightsRefusals as x, DiffCalculator as xa, TemplateParser as xc, hasPlainPrototype$1 as xd, isFinalSnapshotError as xi, recordNoEchoAttributeValues as xl, equalModuloMask as xn, passedParameterClassesOf as xo, findRefactorHints as xr, refuseMalformedResourcePropertiesForOrphan as xs, keptWholeReasonText as xt, buildDockerImage as xu, streamTagsMatchDeclared as y, reDisableInstanceApiTermination as ya, sameLambdaFunctionAddress as yc, defineOwnKey as yd, createPreDeleteFinalSnapshot as yi, recordMaskOnlyValue as yl, calculateResourceDrift as yn, withSharedDrainBudget as yo, findDestructiveChanges as yr, refuseMalformedResourcePropertiesForDrift as ys, diffSecurity as yt, validateContainerRepoName as yu, maskedLogger as z, refuseUnreadableCdkCrossAccountRefs as za, recordReferenceProvenanceEntry as zc, tagMapAsList as zi, splitImportedOps as zl, redactedDeleteAddressFields as zn, malformedLocalOutputsWarning as zo, green as zr, withoutSilentDropProperties as zs, withNestedRevertRun as zt, AssetManifestLoader as zu };
+//# sourceMappingURL=deploy-engine-BF5exXUb.js.map