@go-to-k/cdkd 0.310.0 → 0.312.0

package/dist/{program-CS420Kx9.js → program-Nk_95KKk.js}

@@ -1,9 +1,9 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-Bu9EMILF.js";
 import { $ as stringifyJsonPayload, A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, C as generateResourceName, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, Q as safeMsg, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, W as cutMarker, Y as isPasteableIdent, Z as plainIdentOr, _ as PATTERN_B_RESOURCE_TYPES, a as safeStringify, b as derivesPatternBName, c as isStdoutReservedForPayload, d as runStackBuffered, et as terminalSafe, g as PATTERN_B_NAME_PROPERTIES, h as PATTERN_B_NAME_OPTIONS, l as reserveStdoutForPayload, m as getLiveRenderer, n as describeAwsFailure, q as displaySafe, s as getLogger, tt as truncateCodePoints, x as explicitNamePropertyFor, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-NSBdKPYK.js";
-import { An as StateError, Cn as NestedStackChildDirectDestroyError, Cr as markNonRetryable, Dn as ResourceUpdateNotSupportedError, E as isMarkedNotGone, En as ResourceTimeoutError, Fn as normalizeAwsError, Gt as formatLockExpiry, Ht as buildForceUnlockCommand, I as remedyLogicalId, In as withErrorHandling, Jn as shellBoundedDisplay, Kn as plainOrDescribed, Kt as formatLockOperation, Ln as TIMEOUT_FLAG_RESOURCE_TYPE, Mn as formatError, O as assertRegionMatch, On as StackHasActiveImportsError, Qn as setPasteableVerbFlags, Qt as injectiveKey, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Un as isInertUnquoted, Ut as buildLockContentionMessage, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Wt as forceQuitRecoveryClause, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Yn as shellQuote, Z as runDeleteAttempt, Zn as setPasteableRunFlags, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp, dt as interruptWatchListenerCount, en as producerCoordinateKey, fn as CrossAccountSecretRefusalError, ft as isInterruptedWaitError, gn as DynamicReferenceRegionAmbiguousError, in as ambientClientDefaults, jn as SynthesisError, k as VALUE_NOT_SHOWN, kn as StackTerminationProtectionError, lr as stripControlChars, lt as beginCommandInterruptScope, mn as DeployCancelledError, mr as isAmbiguousOutcomeError, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as setPasteableAwsProfile, on as clientDefaultsFor, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rt as isAwsCliLiteral, s as readRecordedPrincipals, sn as credentialFingerprint, t as IAM_PRINCIPAL_NAME, tn as producerRecordKey, un as CdkdError, ur as stripForDisplay, ut as endCommandInterruptScope, vn as LocalInvokeBuildError$1, vr as isTransientServerError, vt as logicalIdShown, wn as PartialFailureError, xr as isMarkedNonRetryable, yn as LocalStartServiceError, yr as retryClassificationText, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-D94wh05t.js";
+import { $n as plainOrDescribed, $t as formatLockOperation, An as NestedStackChildDirectDestroyError, Ar as markNonRetryable, Cn as DynamicReferenceRegionAmbiguousError, Dt as resourceTypeShown, En as LocalStartServiceError, Er as retryClassificationText, F as VALUE_NOT_SHOWN, Fn as StackHasActiveImportsError, H as remedyLogicalId, Hn as normalizeAwsError, In as StackTerminationProtectionError, Jn as commandHole, Jt as UNREPRODUCIBLE_LOCK_CLAUSE, Kn as SHELL_ACTIVE_WHY, Ln as StateError, M as isMarkedNotGone, Mn as ProvisioningError, Nn as ResourceTimeoutError, Or as isMarkedNonRetryable, P as assertRegionMatch, Pn as ResourceUpdateNotSupportedError, Qt as formatLockExpiry, Rn as SynthesisError, Tn as LocalInvokeBuildError$1, Tr as isTransientServerError, Tt as logicalIdShown, Un as withErrorHandling, Wn as TIMEOUT_FLAG_RESOURCE_TYPE, Xn as isInertUnquoted, Xt as buildLockContentionMessage, Yt as buildForceUnlockCommand, Zn as pasteableCommand, Zt as forceQuitRecoveryClause, _n as CdkdError, _r as stripForDisplay, _t as endCommandInterruptScope, an as injectiveKey, ar as setPasteableVerbFlags, cn as producerRecordKey, dn as ambientClientDefaults, en as formatLockOwner, er as quotedOrDescribed, f as readRecordedPrincipals, fn as ambientCredentialConfig, gr as stripControlChars, gt as beginCommandInterruptScope, hn as AccountIdUnavailableError, hr as escapeRegExp, in as DEFAULT_STATE_PREFIX, ir as setPasteableRunFlags, j as RESOURCE_NOT_FOUND, jn as PartialFailureError, kn as MalformedProducerRecordRefusalError, kr as isThrottlingError, ln as setPasteableAwsProfile, lt as isAwsCliLiteral, mn as credentialFingerprint, nr as shellQuote, o as IAM_PRINCIPAL_NAME, pn as clientDefaultsFor, rn as CUSTOM_RESOURCE_RESPONSE_PREFIX, rr as withheldTargetClause, rt as runDeleteAttempt, s as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, sn as producerCoordinateKey, tr as shellBoundedDisplay, un as withPasteableAwsProfile, vt as interruptWatchListenerCount, wn as IntrinsicResolutionRefusalError, wr as isRetryableTransientError, xn as DeployCancelledError, xr as isAmbiguousOutcomeError, yn as CrossAccountSecretRefusalError, yt as isInterruptedWaitError, zn as formatError } from "./created-resource-sink-BT2Dfnpt.js";
 import { a as setAssumedRoleCredentials, d as formatAuthority, i as getPreAssumeEnvCredentials, n as awsClientDefaults, r as getAssumedRoleCredentials, u as runInStackAwsScope } from "./aws-client-defaults-BX9Y_fKp.js";
-import { $ as computeImplicitDeleteEdges, $a as coerceParameterTypedValue, $c as DYNAMIC_REFERENCE_TOKEN_SCAN, $i as applyCustomResourceResponseExpiration, $l as stringifyValue, $n as WITHHELD_NAME_DISPLAY, $o as refuseMalformedOrphanRecords, $r as noEchoExactEchoLeavesOf, $u as MIGRATE_TMP_PREFIX, Ac as valueAtCoordinate, Al as isAccessDenied, An as resolveReplacementOldType, Ao as isReadableResourceEntry, As as withheldAccountClause, At as displacedOpClause, Au as redactedDockerCause, Ba as assertFlagRoleArn, Bc as logOnlyValueCount, Bl as hasUnverifiableParameterRefusal, Bn as updatePartialMessage, Bo as malformedOrphansRefusalMessage, Br as yellow, Bs as isStatefulRecreateTargetForReplace, Bt as getCurrentNestedStackContext, Bu as loadCdkJson, Ca as withoutUnsettledProperties, Cc as noEchoCoordinatesOf, Cd as resolveAssemblyPath, Ci as ledgerForStack, Cl as isLockInfoExpired, Cn as isJournaledOrphan, Co as accountArgs, Cr as rollbackOrphanIds, Cs as repairMalformedOutputsForReadOnly, Ct as makeSiblingClaimReader, Cu as formatDockerLoginError, Dc as readbackPathFor, Dd as resolveBucketRegion, Di as DeploymentEventsReader, Dl as CrossPrefixScanCache, Dn as recheckFailedPlan, Do as hasReadableOutputs, Dr as mappingPairs, Ds as unpreviewableOrphanRecords, Dt as keptForRetainedRecord, Du as partitionSensitiveEnv, El as CrossPrefixReadError, En as planRollback, Eo as hasReadableOrphans, Er as looselyEqual, Es as repairMalformedResourcesForReadOnly, Et as resolvePendingCloudControlRequests, Eu as isMalformedEnvKey, Fa as keepHeldTokenProvenance, Fl as acceptedCreateOnlyDropsOf, Fn as inheritProducerRegions, Fo as malformedLocalResourceEntriesWarning, Fr as bold, Fs as NO_CC_HANDLERS_REASON, Ft as recordDisplacedSkips, Fu as getDockerImageBySourceHash, Ga as AWS_CREDENTIAL_ENV_KEYS, Gc as unionOfSecretBags, Gi as wouldReturnToSdkProvider, Gl as orphansCarriedFrom, Gn as retiredAfterRollback, Go as malformedResourceEntriesWarning, Gr as removeSuperseded, Gt as isHandledOrphan, Gu as resolveStateBucketWithDefault, Ha as explicitRoleArnOrThrow, Hc as recordLogOnlyParameterValue, Hi as ProviderRegistry, Hl as importableOutputs, Hn as nameGenerationCarriedFrom, Ho as malformedOutputsRefusalMessage, Hr as deleteSupersededEntry, Hs as renderStatefulReason, Ht as deleteJournaledOrphans, Hu as resolveAutoAssetStorage, Ic as carryLogOnlyValues, Il as describeRegionValueKind, Io as malformedLocalResourcesWarning, Ir as cyan, Is as hasNoCloudControlHandlers, Iu as Synthesizer, Ja as envCredentialsAreAssumedRole, Jc as maskSecretsInError, Ji as readsNoEchoDeleteValues, Jl as PhaseClock, Jn as withNameGenerationReached, Jo as malformedScrubResourceEntriesRefusalMessage, Jr as supersededHolderOf, Jt as makeForeignHolderScan, Ju as stateBucketExistenceConfirmed, Ka as applyCallerIdentityCredentials, Kc as createSecretMasker, Kl as shouldRetainResource, Kn as retiredNameGenerationsAfter, Ko as malformedResourcePropertiesWarning, Kr as supersededAfterRollback, Kt as journaledOrphanLines, Ku as resolveStateBucketWithDefaultAndSource, La as recordedOutputReferenceRegions, Lc as createUnionSecretMasker, Ll as exportNamesCarriedFrom, Lo as malformedOrphanRecordsRefusalMessage, Lr as gray, Ls as findReplacedReadersOfRecreateTargets, Lt as revertedNestedRowIds, Lu as synthesisStatusMessage, Ma as resolveDynamicReferences, Ml as stackInstanceIdOf, Mn as orphanNeedsIdentity, Mo as malformedExportNamesWarning, Mt as dropSettledNestedJournals, Mu as runDockerStreaming, Na as producerLookupOver, Nc as redactForState, Nl as withStackInstanceIdWithheld, Nn as findNestedStackTypeChanges, No as malformedExportSourceWarning, Nr as withStackRecords, Ns as unwrittenCreateOnlyReplacement, Nu as warnFinchArgvExposure, Oc as readsNoEchoSource, Oi as DeploymentEventsStore, Ol as applyCrossPrefixScan, On as recordUnderIdIsNotOwn, Oo as hasReadableResources, Or as parseMappingFile, Os as unreadableOrphanRecords, Ot as recordRetainedForReadoption, Ou as redactDockerArgvValues, Pa as refuseUnreadableCdkCrossAccountRefs, Pl as splitImportedOps, Po as malformedLocalOutputsWarning, Pt as nestedChildStackName$1, Pu as AssetManifestLoader, Q as IMPLICIT_DELETE_DEPENDENCIES, Qa as regionLessSecretName, Qi as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ql as isSensitiveAttributeName, Qn as resourcesNamingDeclaredParameter, Qr as noEchoComparisonForTemplate, Qu as CFN_TEMPLATE_URL_LIMIT, Ra as recordedReferenceRegions, Rc as hasMaskableValues, Rl as hasReadableExportSet, Ro as malformedOrphanRecordsWarning, Rr as green, Rs as shownType, Rt as withNestedRevertRun, Ru as getDefaultStateBucketName, Sa as withUnsettledProperties, Sc as maskedLeafCoordinatesOf, Sd as renderAssemblyPathEscape, Sl as LockManager, Sn as demoteSupersededOrphans, So as UNREADABLE_RESOURCES_MAP_ROW, Sr as movedToHint, Ss as repairMalformedOrphansForReadOnly, St as makeCanonicalizePropertiesFn, Su as finchSecretArgvRefusal, Ta as poisonRenderedSpellingsCollidingIn, Tc as noEchoOutputsComparison, Td as injectedAwsRegionValue, Ti as withCreateTokenLedger, Tl as rebuildClientForBucketRegion, Tn as planFailedOps, To as displayLogicalId, Tr as isPairableType, Ts as repairMalformedResourcePropertiesForReadOnly, Tt as pendingRequestCount, Tu as isDockerClientEnvKey, Ua as isIamRoleArn, Uc as recordLogOnlyValue, Ui as ccBrokenReason, Ul as isReadableBag, Un as nameGenerationHighWaterOf, Uo as malformedOutputsWarning, Ur as holdsSupersededResources, Ut as dropFailedCommands, Uu as resolveCaptureObservedState, Va as assertSendableRoleArn, Vc as printingCorpusOf, Vi as CC_BROKEN_REASON, Vl as importableOutputKeys, Vn as updatePartialReason, Vo as malformedOrphansWarning, Vr as addSuperseded, Vs as isStatefulRecreateTargetSync, Vt as withNestedStackContext, Vu as resolveApp, Wa as sendableAssumeRoleCommand, Wc as shareLogOnlyValues, Wi as isCustomResource, Wl as orphansAfterRollback, Wn as nameScopeOf, Wo as malformedRenderedContainersWarning, Wr as isSupersededResourceRecord, Wt as dropFailedHint, Wu as resolveSkipPrefix, Xa as classifyReplaySecretRegion, Xc as scrubResourceRecord, Xl as timePhase, Xn as namesAnyDeclaredParameter, Xo as previewableOrphanRecords, Xr as withoutSuperseded, Xt as formatResourceLine, Xu as ssmResolvedValueType, Ya as classifyRecordedSecretRegion, Yc as maskSecretsInText, Yi as isCustomResourceType$1, Yl as renderPhaseTimings, Yn as computeParameterTaint, Yo as malformedStateRefusalMessage, Yr as supersededResourcesOf, Yt as sameJournaledOrphans, Yu as warnDeprecatedNoPrefixCliFlag, Za as producerRegionsFromState, Zc as withPhysicalNameCopies, Zi as withPrintingSecrets, Zl as AssetPublisher, Zn as reachableDivergentParameters, Zo as refuseDivergentRecordRegionForDestroy, Zr as noEchoAttributeNamesOf, Zu as CFN_TEMPLATE_BODY_LIMIT, _c as canonicalCoordinates, _d as nullPrototypeRecord, _i as createPreDeleteFinalSnapshot, _l as recordNoEchoParameterFreshValue, _n as withUnprovenUnsettled, _o as declaresNoEcho, _r as constructPathOf$1, _s as refuseMalformedResourcesForDeploy, _t as withResourceDeadline, _u as resolveDockerContextDirectory, a as isProtectionValueActive, aa as RollbackInlinePolicyWriters, ac as templateResourceTypes, ad as PARTITION_TABLE, ai as namingSecretsWithRecordedNoEcho, al as inheritNestedStackParameterAssociations, an as refuseRefactorMarker, ao as carriesFetchableDynamicReference, ar as carriedExportAliasExposure, as as refuseMalformedOutputsForDestroy, at as childTemplateLoader, au as AssetModeResolver, ba as INTRINSIC_KEYS, bc as maskReadbackAtCoordinates, bd as describeFileReadFailure, bi as refusesFinalSnapshot, bl as WHOLE_DYNAMIC_REFERENCE_PATTERN, bn as equalModuloMask, bo as STATE_RESOURCES_MALFORMED, br as findRefactorHints, bs as refuseMalformedState, bt as keptWholeReasonText, bu as describeDockerFailure, ca as deleteLeftInPlace, cd as AssemblyReader, ci as secretNamePrintingBags, cl as physicalNameCopiesOf, cn as hasPendingMovesOut, co as AWS_NO_VALUE, cr as isWholeDynamicReferenceValue, cs as refuseMalformedResourceEntriesForDeploy, ct as listNestedTemplateRows, cu as ensureAssetStorage, da as isWaitAbandonedError, dd as describeJsonParseFailure, di as stateSecretNameNeedles, dl as splitGetAttStringForm, dn as refusePendingMovesOut, do as lacksRecordedTableArn, dr as collectPublishedOutputNames, ds as refuseMalformedResourceEntriesForImportSave, dt as conditionFingerprint, du as parseBootstrapMarker, ea as customResourceResponseExpirationWarning, ed as findLargeInlineResources, ei as noEchoParameterNamesOf, el as dynamicReferenceTokens, eo as isUnboundTemplateParameter, er as displayTextOrWithheld, es as refuseMalformedOrphanRecordsForDestroy, et as crossStackOutputProvenanceSource, eu as WorkGraph, fd as parseFailureDebugDetail, fi as storedSecretNameNeedles, fl as carriesSecretMask, fn as replayFailedOperations, fo as refStateLookupFromResource, fr as isExportAliasCollision, fs as refuseMalformedResourceEntriesForOrphan, ft as conditionInputsFrom, fu as readBootstrapMarkerBody, gc as TemplateParser, gd as hasPlainPrototype, gi as ccRoutedFinalSnapshotError, gl as recordNoEchoAttributeValues, gn as settleUnsettledPrevious, gr as maskingRetryLogger, gs as refuseMalformedResourcePropertiesForOrphan, gu as buildDockerImage, hc as DagBuilder, hd as hasOwnKey, hi as buildFinalSnapshotIdentifier, hl as recordMaskOnlyValuesIn, hn as recordAfterRollbackUpdate, ho as parameterInputsFor, hr as DEFAULT_RESOURCE_WARN_AFTER_MS, hs as refuseMalformedResourcePropertiesForExport, hu as buildDenyExternalAccessPolicy, i as PROTECTION_PROPERTY_BY_TYPE, ic as prefetchCreateOnlyPropertyPaths, id as expectedOwnerParam, ii as maskEventTextWithBoundBags, il as identityKeyFor, in as refactorMarkerRefusalMessage, io as carriesDynamicReference, ir as secretSafeKeyDisplay, is as refuseMalformedOutputs, it as serviceTokenBlockingReason, iu as rewriteTemplateAssetReferences, jc as liveMatchesUnresolvedTokenFrame, jl as isNotImplemented, jn as seedsDeleteFirstGuard, jo as malformedDriftResourcePropertiesWarning, jr as destroyStackRecordsView, js as findActionableSilentDrops, jt as displacedPhysicalIdShown, ju as runDockerForeground, kc as recordedNoEchoValuesOf, ki as extractDeploymentEventError, kl as crossPrefixDeniedWarning, kn as replacementNeverSwapped, ko as isReadableOrphanRecord, kr as proposeRenames, ks as unreadableResourceEntries, kt as NESTED_PENDING_PARENT_REASON, ku as redactedCause, la as deleteSkipReason, ld as StageLoadError, ln as pendingMovesOutOf, lo as cfnRefValueFromPhysicalId, lr as noEchoParameterValueSeed, ls as refuseMalformedResourceEntriesForDestroy, lt as renderNestedTemplateTreeDefect, lu as getBootstrapMarkerKey, md as defineOwnKey, mi as PRE_DELETE_SNAPSHOT_TYPES, ml as recordMaskOnlyValue, mn as removeProtectionTypeList, mo as withSharedDrainBudget, mr as DEFAULT_RESOURCE_TIMEOUT_MS, ms as refuseMalformedResourcePropertiesForDrift, mt as readRecordedConditionVerdicts, mu as validateContainerRepoName, n as recordedProtectionEvidence, na as slowCcOperationTimeoutMs, nd as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, ni as completedReplayEntries, nl as pathCrossesDottedKey, nn as readRefactorMarkerOnce, no as getAccountInfo, nr as secretBearing, ns as refuseMalformedOrphansForDestroy, nt as deferredServiceTokenWarning, nu as createAssetRedirectResolver, o as perType, oa as UNSPECIFIED_SKIP_REASON, oc as describeTypeWithThrottleRetry, od as canonicalizeRegion, oi as orphanRecordsPrintingBag, ol as recordNestedStackParameterExpressions, on as sameMove, oo as isNamelessDynamicReferenceError, or as exportNameNoEchoParameters, os as refuseMalformedResourceAttributesForOrphan, ot as findNestedTemplateTreeDefect, ou as BOOTSTRAP_MARKER_PREFIX, pd as utf8ByteLength, pi as ATOMIC_FINAL_SNAPSHOT_TYPES, pl as provenPublicValue, pn as replayRollback, pr as bindingSkippedOutputs, ps as refuseMalformedResourcePropertiesForDestroy, pt as parentSuppliedValues, pu as validateAssetBucketName, qa as callerEnvCredentials, qc as errorCauseChain, qi as TemplateNoEchoReresolver, ql as stackInstanceIdCarriedFrom, qn as retiredNameGenerationsLeaving, qo as malformedResourcesWarning, qr as supersededHeldByOtherTypeWarning, qt as loadJournaledOrphans, qu as resolveUseCdkBootstrapAssets, r as recordedProtectionNote, rd as decodeListingKey, ri as journaledOrphanPrintingBag, rl as spelledKeysOf, rn as refactorMarkerMovesOf, ro as isImpossibleEmptyStoredAttribute, rr as secretBearingStateKeyWarning, rs as refuseMalformedOrphansForOrphan, rt as findServiceTokenRefusals, ru as loadPublishableAssetManifest, s as readProtection, sa as deleteIndeterminateGuards, sc as withRetry, sd as derivePartitionAndUrlSuffix, si as secretNamePrintingBag, sn as updateRefactorMarker, so as keepsSecretReferenceToken, sr as exportNameSecretExposure, ss as refuseMalformedResourceEntries, st as isAbsoluteAssetPath, su as assertAssetBucketRegion, t as DeployEngine, ta as CloudControlProvider, td as uploadCfnTemplate, ti as createReadOnlyAttributeHealerFactory, tl as isUncertifiedBaselineMaskPosition, tn as readRefactorMarker, to as parameterTypeMayLoseSecretIdentity, tr as exportAliasCollisionScrubWarning, ts as refuseMalformedOrphans, tt as inheritedProvenanceForChildDiff, tu as buildAssetRedirectMap, ud as processStackMessages, ui as secretNamedRecordNeedles, ul as recordPhysicalNameCopy, un as pendingMovesRefusalMessage, uo as isStalePlaceholderArnAttribute, ur as collectDeclaredOutputNames, us as refuseMalformedResourceEntriesForImport, ut as templateIdentity, uu as isCrossRegionRedirect, vc as isMarkedCoordinate, vd as ownValue, vi as effectiveDeletionPolicy, vl as recordProvenPublicExpression, vn as calculateResourceDrift, vo as JSON_LISTING_HOLE_VALUE, vr as findDestructiveChanges, vs as refuseMalformedResourcesForDestroy, vt as diffSecurity, vu as describeDockerCapturedOutput, wa as IntrinsicFunctionResolver, wc as noEchoLeavesOf, wd as injectAwsRegion, wl as S3StateBackend, wn as isReplacementOrphan, wo as deployRefusesOrphanRowsReason, wr as withMovedTo, ws as repairMalformedResourceEntriesForReadOnly, wt as planOrphanAdoption, wu as getDockerCmd, xa as unsettledPropertiesOf, xc as maskWholeValue, xd as displayAssemblyPath, xi as unsupportedFinalSnapshotError, xl as isSingleDynamicReferenceToken, xn as undeclaredEmptyObservedKeys, xo as UNREADABLE_ORPHANS_CONTAINER_ROW, xr as hintSidesOf, xs as repairMalformedOrphanRecordsForReadOnly, xt as mergeNoChangeOutputs, xu as dockerSpawnEnvWithSensitive, ya as DiffCalculator, yc as maskAtCoordinates, yd as absoluteAssemblyPathEscape, yi as isFinalSnapshotError, yl as wholeStringLeavesOf, yn as equalModuloMarkedMask, yo as STATE_REGION_DIVERGED, yr as formatDestructiveChange, ys as refuseMalformedResourcesForExport, yt as isSecretBearingReferenceString, yu as describeDockerExecFailure, za as applyRoleArnIfSet, zc as literalSplitDelimitersOf, zl as hasReasonlessBaselineRefusal, zo as malformedOrphanRowsKeptWarning, zr as red, zs as MULTI_REGION_RECREATE_BLOCKED_TYPES, zt as collectNestedChildUnaddressed, zu as getLegacyStateBucketName } from "./deploy-engine-DZO2SOQJ.js";
-import { t as getCdkdVersion } from "./version-QOtLxcEo.js";
+import { $a as applyCallerIdentityCredentials, $c as unionOfSecretBags, $i as isCustomResourceType$1, $l as orphansCarriedFrom, $n as namesAnyDeclaredParameter, $o as malformedResourcePropertiesWarning, $r as withoutSuperseded, $t as formatResourceLine, $u as resolveStateBucketWithDefault, Aa as withoutUnsettledProperties, Ac as maskedLeafCoordinatesOf, Ad as renderAssemblyPathEscape, Al as LockManager, An as recheckFailedPlan, Ao as accountArgs, Ar as mappingPairs, As as repairMalformedOutputsForReadOnly, At as keptForRetainedRecord, Au as finchSecretArgvRefusal, Ba as producerLookupOver, Bl as stackInstanceIdOf, Bo as malformedExportSourceWarning, Br as gray, Bt as revertedNestedRowIds, Bu as runDockerStreaming, Ca as DiffCalculator, Cc as DagBuilder, Cd as hasOwnKey, Ci as isFinalSnapshotError, Cl as recordMaskOnlyValuesIn, Cn as equalModuloMask, Cr as findRefactorHints, Cs as refuseMalformedResourcePropertiesForOrphan, Ct as keptWholeReasonText, Cu as buildDenyExternalAccessPolicy, Da as unsettledItemsOf, Dc as maskAtCoordinates, Dd as absoluteAssemblyPathEscape, Di as ledgerForStack, Dl as wholeStringLeavesOf, Dn as isReplacementOrphan, Do as STATE_RESOURCES_MALFORMED, Dr as withMovedTo, Ds as refuseMalformedState, Dt as planOrphanAdoption, Du as describeDockerExecFailure, Ea as unsettledItemsField, Ec as isMarkedCoordinate, Ed as ownValue, El as recordProvenPublicExpression, En as isJournaledOrphan, Eo as STATE_REGION_DIVERGED, Er as rollbackOrphanIds, Es as refuseMalformedResourcesForExport, Et as makeSiblingClaimReader, Eu as describeDockerCapturedOutput, Fc as readbackPathFor, Fd as resolveBucketRegion, Fl as CrossPrefixScanCache, Fn as orphanNeedsIdentity, Fo as hasReadableResources, Fs as unreadableOrphanRecords, Ft as dropSettledNestedJournals, Fu as partitionSensitiveEnv, Ga as recordedReferenceRegions, Gc as createUnionSecretMasker, Gi as CC_BROKEN_REASON, Gl as exportNamesCarriedFrom, Gn as nameGenerationCarriedFrom, Go as malformedOrphanRecordsWarning, Gr as deleteSupersededEntry, Gs as findReplacedReadersOfRecreateTargets, Gt as deleteJournaledOrphans, Gu as synthesisStatusMessage, Ha as keepHeldTokenProvenance, Hl as splitImportedOps, Ho as malformedLocalResourceEntriesWarning, Hr as red, Ht as collectNestedChildUnaddressed, Hu as AssetManifestLoader, Ic as readsNoEchoSource, Il as applyCrossPrefixScan, In as findNestedStackTypeChanges, Io as isReadableOrphanRecord, Ir as withStackRecords, Is as unreadableResourceEntries, Iu as redactDockerArgvValues, Ja as assertSendableRoleArn, Jc as logOnlyValueCount, Ji as isCustomResource, Jl as hasUnverifiableParameterRefusal, Jn as retiredAfterRollback, Jo as malformedOrphansWarning, Jr as removeSuperseded, Js as isStatefulRecreateTargetForReplace, Jt as isHandledOrphan, Ju as loadCdkJson, Ka as applyRoleArnIfSet, Kc as hasMaskableValues, Ki as ProviderRegistry, Kl as hasReadableExportSet, Kn as nameGenerationHighWaterOf, Ko as malformedOrphanRowsKeptWarning, Kr as holdsSupersededResources, Ks as shownType, Kt as dropFailedCommands, Ku as getDefaultStateBucketName, Lc as recordedNoEchoValuesOf, Ll as crossPrefixDeniedWarning, Lo as isReadableResourceEntry, Ls as withheldAccountClause, Lt as nestedChildStackName$1, Lu as redactedCause, Ma as poisonRenderedSpellingsCollidingIn, Mc as noEchoLeavesOf, Md as injectAwsRegion, Mi as DeploymentEventsStore, Ml as S3StateBackend, Mn as replacementNeverSwapped, Mo as displayLogicalId, Mr as proposeRenames, Ms as repairMalformedResourcePropertiesForReadOnly, Mt as NESTED_PENDING_PARENT_REASON, Mu as getDockerCmd, Nc as noEchoOutputsComparison, Nd as injectedAwsRegionValue, Ni as extractDeploymentEventError, Nl as rebuildClientForBucketRegion, Nn as resolveReplacementOldType, No as hasReadableOrphans, Ns as repairMalformedResourcesForReadOnly, Nt as displacedOpClause, Nu as isDockerClientEnvKey, Oa as unsettledPropertiesOf, Oc as maskReadbackAtCoordinates, Od as describeFileReadFailure, Ol as WHOLE_DYNAMIC_REFERENCE_PATTERN, On as planFailedOps, Oo as UNREADABLE_ORPHANS_CONTAINER_ROW, Or as isPairableType, Os as repairMalformedOrphanRecordsForReadOnly, Ot as pendingRequestCount, Ou as describeDockerFailure, Pl as CrossPrefixReadError, Pn as seedsDeleteFirstGuard, Po as hasReadableOutputs, Pr as destroyStackRecordsView, Ps as unpreviewableOrphanRecords, Pt as displacedPhysicalIdShown, Pu as isMalformedEnvKey, Qa as AWS_CREDENTIAL_ENV_KEYS, Qc as shareLogOnlyValues, Qi as readsNoEchoDeleteValues, Ql as orphansAfterRollback, Qn as computeParameterTaint, Qo as malformedResourceEntriesWarning, Qr as supersededResourcesOf, Qt as sameJournaledOrphans, Qu as resolveSkipPrefix, Rc as valueAtCoordinate, Rl as isAccessDenied, Rn as inheritProducerRegions, Ro as malformedDriftResourcePropertiesWarning, Rr as bold, Rs as findActionableSilentDrops, Rt as recordDisplacedSkips, Ru as redactedDockerCause, Sd as defineOwnKey, Si as effectiveDeletionPolicy, Sl as recordMaskOnlyValue, Sn as equalModuloMarkedMask, So as parameterInputsFor, Sr as formatDestructiveChange, Ss as refuseMalformedResourcePropertiesForExport, St as isSecretBearingReferenceString, Su as validateContainerRepoName, Tc as canonicalCoordinates, Td as nullPrototypeRecord, Ti as unsupportedFinalSnapshotError, Tl as recordNoEchoParameterFreshValue, Tn as demoteSupersededOrphans, To as JSON_LISTING_HOLE_VALUE, Tr as movedToHint, Ts as refuseMalformedResourcesForDestroy, Tt as makeCanonicalizePropertiesFn, Tu as resolveDockerContextDirectory, Ul as acceptedCreateOnlyDropsOf, Un as updatePartialMessage, Uo as malformedLocalResourcesWarning, Ur as yellow, Us as NO_CC_HANDLERS_REASON, Ut as getCurrentNestedStackContext, Uu as getDockerImageBySourceHash, Va as refuseUnreadableCdkCrossAccountRefs, Vc as redactForState, Vl as withStackInstanceIdWithheld, Vo as malformedLocalOutputsWarning, Vr as green, Vs as unwrittenCreateOnlyReplacement, Vt as withNestedRevertRun, Vu as warnFinchArgvExposure, Wa as recordedOutputReferenceRegions, Wc as carryLogOnlyValues, Wl as describeRegionValueKind, Wn as updatePartialReason, Wo as malformedOrphanRecordsRefusalMessage, Wr as addSuperseded, Ws as hasNoCloudControlHandlers, Wt as withNestedStackContext, Wu as Synthesizer, Xa as isIamRoleArn, Xc as recordLogOnlyParameterValue, Xl as importableOutputs, Xn as retiredNameGenerationsLeaving, Xo as malformedOutputsWarning, Xr as supersededHeldByOtherTypeWarning, Xs as renderStatefulReason, Xt as loadJournaledOrphans, Xu as resolveAutoAssetStorage, Ya as explicitRoleArnOrThrow, Yc as printingCorpusOf, Yi as wouldReturnToSdkProvider, Yl as importableOutputKeys, Yn as retiredNameGenerationsAfter, Yo as malformedOutputsRefusalMessage, Yr as supersededAfterRollback, Ys as isStatefulRecreateTargetSync, Yt as journaledOrphanLines, Yu as resolveApp, Za as sendableAssumeRoleCommand, Zc as recordLogOnlyValue, Zi as TemplateNoEchoReresolver, Zl as isReadableBag, Zn as withNameGenerationReached, Zo as malformedRenderedContainersWarning, Zr as supersededHolderOf, Zt as makeForeignHolderScan, Zu as resolveCaptureObservedState, _d as StageLoadError, _i as ATOMIC_FINAL_SNAPSHOT_TYPES, _n as removeProtectionTypeList, _o as isStalePlaceholderArnAttribute, _r as DEFAULT_RESOURCE_TIMEOUT_MS, _s as refuseMalformedResourceEntriesForImport, _t as readRecordedConditionVerdicts, _u as getBootstrapMarkerKey, a as isProtectionValueActive, aa as CloudControlProvider, ad as CFN_TEMPLATE_BODY_LIMIT, ai as createReadOnlyAttributeHealerFactory, al as withPhysicalNameCopies, an as readRefactorMarkerOnce, ao as regionLessSecretName, ar as secretBearing, at as deferredServiceTokenWarning, au as AssetPublisher, bd as parseFailureDebugDetail, bi as ccRoutedFinalSnapshotError, bl as carriesSecretMask, bn as withUnprovenUnsettled, br as constructPathOf$1, bs as refuseMalformedResourcePropertiesForDestroy, bt as withResourceDeadline, bu as readBootstrapMarkerBody, cd as findLargeInlineResources, ci as maskEventTextWithBoundBags, cl as dynamicReferenceTokens, cn as refuseRefactorMarker, co as parameterTypeMayLoseSecretIdentity, cr as carriedExportAliasExposure, cs as refuseMalformedOrphans, ct as childTemplateLoader, cu as WorkGraph, da as deleteIndeterminateGuards, dd as decodeListingKey, di as secretNamePrintingBag, dl as spelledKeysOf, dn as hasPendingMovesOut, do as carriesDynamicReference, dr as isWholeDynamicReferenceValue, ds as refuseMalformedOutputs, dt as listNestedTemplateRows, du as loadPublishableAssetManifest, ed as resolveStateBucketWithDefaultAndSource, ei as noEchoAttributeNamesOf, el as createSecretMasker, eo as callerEnvCredentials, er as reachableDivergentParameters, es as malformedResourcesWarning, eu as shouldRetainResource, fa as deleteLeftInPlace, fc as prefetchCreateOnlyPropertyPaths, fd as expectedOwnerParam, fi as secretNamePrintingBags, fl as identityKeyFor, fn as pendingMovesOutOf, fo as carriesFetchableDynamicReference, fr as noEchoParameterValueSeed, fs as refuseMalformedOutputsForDestroy, ft as renderNestedTemplateTreeDefect, fu as rewriteTemplateAssetReferences, gd as AssemblyReader, gi as storedSecretNameNeedles, gl as physicalNameCopiesOf, gn as replayRollback, go as cfnRefValueFromPhysicalId, gr as bindingSkippedOutputs, gs as refuseMalformedResourceEntriesForDestroy, gt as parentSuppliedValues, gu as ensureAssetStorage, ha as isWaitAbandonedError, hc as withRetry, hd as derivePartitionAndUrlSuffix, hi as stateSecretNameNeedles, hn as replayFailedOperations, ho as AWS_NO_VALUE, hr as isExportAliasCollision, hs as refuseMalformedResourceEntriesForDeploy, ht as conditionInputsFrom, hu as assertAssetBucketRegion, i as PROTECTION_PROPERTY_BY_TYPE, ia as customResourceResponseExpirationWarning, id as ssmResolvedValueType, ii as withAttemptedItemsMasked, il as scrubResourceRecord, in as readRefactorMarker, io as producerRegionsFromState, ir as exportAliasCollisionScrubWarning, is as refuseDivergentRecordRegionForDestroy, it as inheritedProvenanceForChildDiff, iu as timePhase, ja as IntrinsicFunctionResolver, jc as noEchoCoordinatesOf, jd as resolveAssemblyPath, ji as DeploymentEventsReader, jl as isLockInfoExpired, jn as recordUnderIdIsNotOwn, jo as deployRefusesOrphanRowsReason, jr as parseMappingFile, js as repairMalformedResourceEntriesForReadOnly, jt as recordRetainedForReadoption, ju as formatDockerLoginError, ka as withUnsettledProperties, kc as maskWholeValue, kd as displayAssemblyPath, ki as withCreateTokenLedger, kl as isSingleDynamicReferenceToken, kn as planRollback, ko as UNREADABLE_RESOURCES_MAP_ROW, kr as looselyEqual, ks as repairMalformedOrphansForReadOnly, kt as resolvePendingCloudControlRequests, ku as dockerSpawnEnvWithSensitive, la as RollbackInlinePolicyWriters, ld as uploadCfnTemplate, li as namingSecretsWithRecordedNoEcho, ll as isUncertifiedBaselineMaskPosition, ln as sameMove, lo as getAccountInfo, lr as exportNameNoEchoParameters, ls as refuseMalformedOrphansForDestroy, lt as findNestedTemplateTreeDefect, lu as buildAssetRedirectMap, mc as describeTypeWithThrottleRetry, md as canonicalizeRegion, mi as secretNamedRecordNeedles, ml as recordNestedStackParameterExpressions, mn as refusePendingMovesOut, mo as keepsSecretReferenceToken, mr as collectPublishedOutputNames, ms as refuseMalformedResourceEntries, mt as conditionFingerprint, mu as BOOTSTRAP_MARKER_PREFIX, n as recordedProtectionEvidence, na as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, nd as stateBucketExistenceConfirmed, ni as noEchoExactEchoLeavesOf, nl as maskSecretsInError, no as classifyRecordedSecretRegion, nr as WITHHELD_NAME_DISPLAY, ns as malformedStateRefusalMessage, nt as computeImplicitDeleteEdges, nu as PhaseClock, o as perType, oa as slowCcOperationTimeoutMs, od as CFN_TEMPLATE_URL_LIMIT, oi as completedReplayEntries, on as refactorMarkerMovesOf, oo as coerceParameterTypedValue, or as secretBearingStateKeyWarning, os as refuseMalformedOrphanRecords, ot as findServiceTokenRefusals, ou as isSensitiveAttributeName, pa as deleteSkipReason, pc as templateResourceTypes, pd as PARTITION_TABLE, pl as inheritNestedStackParameterAssociations, pn as pendingMovesRefusalMessage, po as isNamelessDynamicReferenceError, pr as collectDeclaredOutputNames, ps as refuseMalformedResourceAttributesForOrphan, pt as templateIdentity, pu as AssetModeResolver, qa as assertFlagRoleArn, qc as literalSplitDelimitersOf, qi as ccBrokenReason, ql as hasReasonlessBaselineRefusal, qn as nameScopeOf, qo as malformedOrphansRefusalMessage, qr as isSupersededResourceRecord, qs as MULTI_REGION_RECREATE_BLOCKED_TYPES, qt as dropFailedHint, qu as getLegacyStateBucketName, r as recordedProtectionNote, ra as applyCustomResourceResponseExpiration, rd as warnDeprecatedNoPrefixCliFlag, ri as noEchoParameterNamesOf, rl as maskSecretsInText, ro as classifyReplaySecretRegion, rr as displayTextOrWithheld, rs as previewableOrphanRecords, rt as crossStackOutputProvenanceSource, ru as renderPhaseTimings, s as readProtection, sd as MIGRATE_TMP_PREFIX, si as journaledOrphanPrintingBag, sl as DYNAMIC_REFERENCE_TOKEN_SCAN, sn as refactorMarkerRefusalMessage, so as isUnboundTemplateParameter, sr as secretSafeKeyDisplay, ss as refuseMalformedOrphanRecordsForDestroy, st as serviceTokenBlockingReason, su as stringifyValue, t as DeployEngine, ta as withPrintingSecrets, td as resolveUseCdkBootstrapAssets, ti as noEchoComparisonForTemplate, tl as errorCauseChain, to as envCredentialsAreAssumedRole, tr as resourcesNamingDeclaredParameter, ts as malformedScrubResourceEntriesRefusalMessage, tt as IMPLICIT_DELETE_DEPENDENCIES, tu as stackInstanceIdCarriedFrom, ua as UNSPECIFIED_SKIP_REASON, ud as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, ui as orphanRecordsPrintingBag, ul as pathCrossesDottedKey, un as updateRefactorMarker, uo as isImpossibleEmptyStoredAttribute, ur as exportNameSecretExposure, us as refuseMalformedOrphansForOrphan, ut as isAbsoluteAssetPath, uu as createAssetRedirectResolver, vd as processStackMessages, vi as PRE_DELETE_SNAPSHOT_TYPES, vl as recordPhysicalNameCopy, vn as recordAfterRollbackUpdate, vo as lacksRecordedTableArn, vr as DEFAULT_RESOURCE_WARN_AFTER_MS, vs as refuseMalformedResourceEntriesForImportSave, vu as isCrossRegionRedirect, wa as INTRINSIC_KEYS, wc as TemplateParser, wd as hasPlainPrototype, wi as refusesFinalSnapshot, wl as recordNoEchoAttributeValues, wn as undeclaredEmptyObservedKeys, wo as declaresNoEcho, wr as hintSidesOf, ws as refuseMalformedResourcesForDeploy, wt as mergeNoChangeOutputs, wu as buildDockerImage, xd as utf8ByteLength, xi as createPreDeleteFinalSnapshot, xl as provenPublicValue, xn as calculateResourceDrift, xo as withSharedDrainBudget, xr as findDestructiveChanges, xs as refuseMalformedResourcePropertiesForDrift, xt as diffSecurity, xu as validateAssetBucketName, yd as describeJsonParseFailure, yi as buildFinalSnapshotIdentifier, yl as splitGetAttStringForm, yn as settleUnsettledPrevious, yo as refStateLookupFromResource, yr as maskingRetryLogger, ys as refuseMalformedResourceEntriesForOrphan, yu as parseBootstrapMarker, za as resolveDynamicReferences, zc as liveMatchesUnresolvedTokenFrame, zl as isNotImplemented, zo as malformedExportNamesWarning, zr as cyan, zs as findHandledUnwrittenCreateOnly, zu as runDockerForeground } from "./deploy-engine-CVNzK__j.js";
+import { t as getCdkdVersion } from "./version-BqCEt5Wu.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -181,8 +181,8 @@ function ensureWarnAfter(opts) {
 	if (!opts.resourceWarnAfter.perTypeMs) opts.resourceWarnAfter.perTypeMs = {};
 	return opts.resourceWarnAfter;
 }
-const noWaitOption = new Option("--no-wait", "Skip waiting for async resources to stabilize (RDS, ElastiCache, NAT Gateway, EC2 Instance, ELBv2 LoadBalancer, Lambda MicroVM Image)");
-const fullWaitOption = new Option("--full-wait", "Also wait for stabilizations cdkd skips by default, matching CloudFormation (ECS Service steady state, CloudFront Distribution Deployed)");
+const noWaitOption = new Option("--no-wait", "Skip waiting for async resources to stabilize (RDS, ElastiCache, NAT Gateway, EC2 Instance, ELBv2 LoadBalancer, Lambda MicroVM Image, ECS Service steady state)");
+const fullWaitOption = new Option("--full-wait", "Also wait for stabilizations cdkd skips by default, matching CloudFormation (CloudFront Distribution Deployed)");
 function validateWaitFlags(opts) {
 	if (opts.wait === false && opts.fullWait === true) throw new Error("--no-wait and --full-wait cannot be combined: --no-wait skips stabilization waits, --full-wait adds them. Pick one.");
 }
@@ -2710,7 +2710,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-KsrvwO_r.js");
+	providerClasses ??= import("./provider-classes-Dz0pYmlJ.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -3557,7 +3557,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 					const syncValidation = validateRecreateTargets({
 						template: stackInfo.template,
 						state: stateForRecreateCheck?.state ?? {
-							version: 14,
+							version: 15,
 							stackName: stackInfo.stackName,
 							region: stackRegion,
 							resources: {},
@@ -3592,7 +3592,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 						const replacedReaders = await findReplacedReadersOfRecreateTargets({
 							template: stackInfo.template,
 							state: stateForRecreateCheck?.state ?? {
-								version: 14,
+								version: 15,
 								stackName: stackInfo.stackName,
 								region: stackRegion,
 								resources: {},
@@ -4899,8 +4899,14 @@ function findUnwrittenCreateOnlyRefusals(changes, stateResources) {
 		const keys = unwrittenCreateOnlyReplacement(change.resourceType, record.properties ?? {}, desired, /* @__PURE__ */ new Set(), acceptedCreateOnlyDropsOf(record), propertyChanges.filter((pc) => pc.requiresReplacement).map((pc) => pc.path));
 		if (keys.length === 0) continue;
 		const routeDriving = findActionableSilentDrops(change.resourceType, desired, /* @__PURE__ */ new Set(), record.properties ?? {}).map(({ property }) => property);
-		const keep = [.../* @__PURE__ */ new Set([...keys, ...routeDriving])].sort((a, b) => a.localeCompare(b)).map((property) => displayIdent(`${change.resourceType}:${property}`)).join(",");
+		const nowWritten = findHandledUnwrittenCreateOnly(change.resourceType, record.properties ?? {}, acceptedCreateOnlyDropsOf(record)).filter((property) => keys.includes(property));
+		const keepKeys = [.../* @__PURE__ */ new Set([...keys, ...routeDriving])].filter((property) => !nowWritten.includes(property)).sort((a, b) => a.localeCompare(b));
+		const keep = keepKeys.map((property) => displayIdent(`${change.resourceType}:${property}`)).join(",");
 		const one = keys.length === 1;
+		if (nowWritten.length > 0) {
+			reasons.push(`${displayIdent(logicalId)} (${displayIdent(change.resourceType)}): this previews a replacement that would apply create-only ${keys.map((k) => displayIdent(k)).join(", ")}, which the state record holds although the SDK provider that built the resource did not write ${one ? "it" : "them"}, so AWS does not. This cdkd version's SDK provider writes ${nowWritten.map((k) => displayIdent(k)).join(", ")}, so a deploy refuses it (CREATE_ONLY_DROP_NEEDS_REPLACEMENT) unless --recreate-via-cc-api or --replace opts in, whatever --prefer-sdk-route names; a deploy with ${nowWritten.map((k) => displayIdent(k)).join(", ")} removed from the template` + (keepKeys.length > 0 ? ` and --prefer-sdk-route ${keep}` : "") + ` changes nothing.`);
+			continue;
+		}
 		reasons.push(`${displayIdent(logicalId)} (${displayIdent(change.resourceType)}): this previews a replacement that would apply create-only ${keys.map((k) => displayIdent(k)).join(", ")}, which the state record holds although the SDK provider never wrote ${one ? "it" : "them"}, so AWS does not. A deploy without --prefer-sdk-route refuses it (CREATE_ONLY_DROP_NEEDS_REPLACEMENT) unless --recreate-via-cc-api or --replace opts in; a deploy passing --prefer-sdk-route ${keep} changes nothing.`);
 	}
 	return reasons;
@@ -5001,7 +5007,7 @@ async function loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery
 			region,
 			resources: {},
 			outputs: {},
-			version: 14,
+			version: 15,
 			lastModified: Date.now()
 		},
 		unreadable: [],
@@ -9030,7 +9036,11 @@ function applyScrubNoEcho(scrubbed, record, plan) {
 		next.attributes = masked;
 		next.noEchoAttributeNames = [...attributeNames];
 	}
-	return next;
+	const needles = leaves.flatMap((coordinate) => {
+		const value = valueAtCoordinate(record.properties, coordinate);
+		return typeof value === "string" && value !== "" ? [value] : [];
+	});
+	return withAttemptedItemsMasked(next, needles);
 }
 function withoutFnIf(value) {
 	if (Array.isArray(value)) return value.map(withoutFnIf);
@@ -11126,6 +11136,7 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 							resourceType: outcome.resourceType,
 							recordedProperties: stateResource.properties ?? {},
 							names: unsettledPropertiesOf(stateResource),
+							attemptedItems: unsettledItemsOf(stateResource),
 							previous: outcome.awsProperties,
 							desired: newProperties
 						});
@@ -11147,7 +11158,8 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 								resourceType: outcome.resourceType,
 								recordedProperties: stateResource.properties ?? {},
 								names: unsettledNames,
-								desired: newProperties
+								desired: newProperties,
+								attemptedItems: unsettledItemsOf(stateResource)
 							}, (message) => logger.warn(maskSecretsInText(message, secrets)));
 							if (unsettledPropertiesOf(settled).size < unsettledNames.size) settledByRevert.set(outcome.logicalId, settled);
 						}
@@ -11201,7 +11213,10 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 					for (const [logicalId, settled] of settledByRevert) {
 						const existing = resources[logicalId];
 						if (!existing) continue;
-						resources[logicalId] = withUnsettledProperties(withoutUnsettledProperties(existing), unsettledPropertiesOf(settled));
+						resources[logicalId] = {
+							...withUnsettledProperties(withoutUnsettledProperties(existing), unsettledPropertiesOf(settled)),
+							...unsettledItemsField(settled, unsettledPropertiesOf(settled))
+						};
 						settledCount++;
 					}
 					let recordedCount = 0;
@@ -11438,7 +11453,10 @@ async function settleUnsettled(record, logicalId, providerOf) {
 	}
 	const keep = [...names].filter((name) => kept.has(name));
 	if (keep.length === names.size) return record;
-	return withUnsettledProperties(withoutUnsettledProperties(record), keep);
+	return {
+		...withUnsettledProperties(withoutUnsettledProperties(record), keep),
+		...unsettledItemsField(record, keep)
+	};
 }
 function unsettledRowsOf(report) {
 	const rows = [];
@@ -15047,7 +15065,7 @@ const COMPOSITE_ID_SPLITTERS = {
 	"AWS::AppSync::ApiKey": (physicalId, properties) => {
 		const trimmed = physicalId.trim();
 		if (!trimmed) throw new Error("empty physical id for AWS::AppSync::ApiKey (expected 'apiId|apiKeyId', the key ARN, or a bare apiKeyId)");
-		const arnMatch = /^arn:[^:]+:appsync:[^:]*:[^:]*:apis\/([^/|]+)\/apikey\/([^/|]+)$/.exec(trimmed);
+		const arnMatch = /^arn:[^:]+:appsync:[^:]*:[^:]*:apis\/([^/|]+)\/apikeys?\/([^/|]+)$/.exec(trimmed);
 		if (arnMatch) {
 			const [, apiId, apiKeyId] = arnMatch;
 			return {
@@ -15058,7 +15076,7 @@ const COMPOSITE_ID_SPLITTERS = {
 				propertiesOverlay: { ApiId: apiId }
 			};
 		}
-		if (trimmed.startsWith("arn:")) throw new Error(`${showRecordValue(physicalId)} looks like an ARN but is not an AppSync API key ARN (expected arn:<partition>:appsync:<region>:<account>:apis/<apiId>/apikey/<apiKeyId>)`);
+		if (trimmed.startsWith("arn:")) throw new Error(`${showRecordValue(physicalId)} looks like an ARN but is not an AppSync API key ARN (expected arn:<partition>:appsync:<region>:<account>:apis/<apiId>/apikeys/<apiKeyId>)`);
 		const parts = trimmed.split("|");
 		if (parts.length > 2) throw new Error(`expected 'apiId|apiKeyId', the key ARN, or a bare apiKeyId, got ${parts.length} parts: ${showRecordValue(physicalId)}`);
 		if (parts.length === 2) {
@@ -20011,7 +20029,7 @@ async function rollbackCommand(stackArg, options) {
 						...carriedState,
 						...stackInstanceIdCarriedFrom(baseState),
 						...supersededAfterRollback(baseState, supersededHost),
-						version: 14,
+						version: 15,
 						region,
 						resources: { ...stateResources },
 						...orphansAfterRollback(baseState, mintedOrphans),
@@ -23579,7 +23597,7 @@ function buildStackState(stackName, region, rows, templateParser, template, exis
 	}
 	if (namesParameter?.failedClosed !== void 0) getLogger().debug(`The template's parameter dependence could not be judged (${namesParameter.failedClosed}): every prior observed-baseline refusal recorded without a reason is carried as an unverifiable-parameter refusal.`);
 	return {
-		version: 14,
+		version: 15,
 		stackName,
 		region,
 		resources,
@@ -31585,4 +31603,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { resolveSecretDerivedPrincipals as a, buildProgram, isResolvableSecretPrincipalList as i, runDestroyForStack as n, canonicalizeIpProtocolValue as o, holdsUnprovenSecretPrincipalToken as r, resolvedResourceTimeoutMs as s, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-CS420Kx9.js.map
+//# sourceMappingURL=program-Nk_95KKk.js.map