@go-to-k/cdkd 0.284.11 → 0.284.13

package/dist/{deploy-engine-K5kHzsB-.js → deploy-engine-4Eh5Qqlm.js}

@@ -11095,6 +11095,159 @@ function maskSecretsInText(text, secrets) {
 	return text.replace(regex, "***");
 }
 /**
+* How deep {@link maskSecretsInError} follows a `cause` chain. A CYCLE is
+* already handled by the visited-set, so this bounds only a pathologically long
+* chain; the same bounded-walk shape `extractDeploymentEventError` (depth 10)
+* and the retry classifiers (depth 5) use. A link BEYOND the cap keeps its
+* original, UNMASKED message, and the last cloned link points at it.
+*/
+const ERROR_CAUSE_MASK_MAX_DEPTH = 20;
+/**
+* The `cause` chain of `root`, root first, stopping at the first non-`Error`
+* link, at a link already visited (so a cycle terminates instead of hanging),
+* or at {@link ERROR_CAUSE_MASK_MAX_DEPTH}.
+*/
+function errorCauseChain(root) {
+	const chain = [];
+	const seen = /* @__PURE__ */ new Set();
+	let current = root;
+	while (current instanceof Error && !seen.has(current) && chain.length < ERROR_CAUSE_MASK_MAX_DEPTH) {
+		seen.add(current);
+		chain.push(current);
+		current = current.cause;
+	}
+	return chain;
+}
+/**
+* Return `error` with {@link maskSecretsInText} applied to the `message` AND the
+* `stack` of every link in its `cause` chain, with everything else about each
+* link preserved (issue [#2038](https://github.com/go-to-k/cdkd/issues/2038)
+* review).
+*
+* Two bounds on that "every link", both stated here because the PUBLIC contract
+* is what a caller reads and neither is visible from the call site:
+* - The walk stops at {@link ERROR_CAUSE_MASK_MAX_DEPTH}. A chain longer than
+*   that keeps its remaining links' ORIGINAL, UNMASKED messages, and the last
+*   cloned link points straight at them.
+* - A `cause` that is not an `Error` (a string, a plain object) is carried
+*   through VERBATIM and is never masked — the walk has nothing to clone. No
+*   cdkd or AWS SDK site constructs one today, so this is a documented residual
+*   rather than a reachable leak, but a caller attaching arbitrary data as a
+*   `cause` must mask it itself. `src/cli/index.ts`'s `console.error` renders
+*   such a cause via `util.inspect`, so it WOULD reach the terminal.
+*
+* **Why an error and not just its text.** `formatError` (`src/utils/error-handler.ts`)
+* renders a `CdkdError`'s CAUSE as `Caused by: <cause.message>`, and `handleError`
+* logs that at `error` level for any failure that escapes a command — so a raw
+* provider error attached as a `ProvisioningError`'s cause reaches the terminal
+* verbatim, at DEFAULT verbosity, even when every log site that INTERPOLATED
+* the message masked it. Masking the string at each log site cannot close that:
+* the sink reads the error OBJECT.
+*
+* `formatError` is not the only such sink, and the second one is what makes the
+* CHAIN argument below concrete rather than hypothetical: `src/cli/index.ts`'s
+* top-level `main().catch(...)` does `console.error('Fatal error:', error)`,
+* which renders the whole object through `util.inspect` — every `[cause]` link
+* AND every link's `stack`. Measured: an outer `Error('top')` wrapping
+* `Error("Value 'hunter2' failed")` prints as
+* `Error: top ... { [cause]: Error: Value 'hunter2' failed ... }`. So a
+* multi-level sink exists TODAY, and it is why `stack` is masked below rather
+* than merely preserved.
+*
+* **Why the whole CHAIN and not just the top link.** Masking only `error.message`
+* looks sufficient because `formatError` renders one level — and it is not, in
+* two ways that a top-level-only fix gets exactly backwards. A provider that
+* wraps an AWS failure in a generic sentence (`new Error('the call failed',
+* { cause: awsError })`) leaves the plaintext ONE link down, where the
+* identity-return below then reports "nothing to mask" and hands back an object
+* still carrying it — the function's own contract says the returned error is
+* safe to render, and every later reader believes it. And `formatError`
+* rendering a single level is an implementation detail: one edit there (walking
+* the chain is the obvious improvement) re-opens the hole with nothing failing.
+* So the invariant is about the OBJECT, not about today's renderer.
+*
+* **Why a clone rather than assigning to `error.message`.** The argument is an
+* error cdkd did not create — usually the AWS SDK's — and mutating a caller's
+* object is visible to every other holder of it, including a retry loop that
+* may still classify it. Each link's clone copies the prototype and EVERY own
+* property descriptor, symbols included, so the three things that read a cause
+* chain keep working: `isMarkedNonRetryable` (a non-enumerable `Symbol.for`
+* marker), `extractDeploymentEventError` / `isThrottlingError` /
+* `isTransientServerError` (`$metadata`, `Code`, `name`), and the chain itself.
+* `Object.assign` would have dropped the marker, which is why the descriptors
+* form is used.
+*
+* `message`, `cause` and `stack` are the three descriptors deliberately NOT
+* copied through: each is re-defined per link, and copying a NON-CONFIGURABLE
+* original would make that re-definition throw. `cause` is rewired to the CLONE
+* of whatever it pointed at, in a second pass over the already-built clone map —
+* which is what makes a cyclic chain terminate rather than recurse. A `cause`
+* that is not an `Error` (a string, a plain object) keeps its original
+* descriptor verbatim.
+*
+* **Why `stack` is re-defined as DATA rather than copied.** V8 installs `stack`
+* as an own ACCESSOR whose getter reads a slot the engine attaches to an error
+* IT created, so copying that descriptor onto an `Object.create` clone yields a
+* getter with nothing behind it and `clone.stack` reads `undefined` (measured).
+* That is not a leak today — the clone is only ever reached as a `cause`, and
+* `handleError` prints the TOP-level error's stack — but this function is
+* exported and generic, so a future top-level caller would get back an error
+* with no trace at all. The clone therefore carries a masked COPY of the
+* original's stack text, which both preserves the trace and closes the sink the
+* copy would otherwise open: a stack's first line embeds the message, so an
+* unmasked stack re-exposes exactly the plaintext the `message` mask removed —
+* and `util.inspect` prints it. An original with no readable string `stack`
+* (not an engine-created error) simply gets no own `stack`, as before.
+*
+* Returns the ORIGINAL object by identity when NOTHING ANYWHERE IN THE CHAIN
+* changed, so a non-secret failure keeps referential equality and the common
+* path allocates nothing.
+*/
+function maskSecretsInError(error, secrets) {
+	if (secrets.size === 0 || !(error instanceof Error)) return error;
+	const chain = errorCauseChain(error);
+	const maskedMessages = chain.map((link) => maskSecretsInText(link.message, secrets));
+	if (maskedMessages.every((masked, i) => masked === chain[i].message)) return error;
+	const clones = /* @__PURE__ */ new Map();
+	for (const [i, original] of chain.entries()) {
+		const descriptors = {};
+		for (const key of Reflect.ownKeys(original)) {
+			if (key === "message" || key === "cause" || key === "stack") continue;
+			const descriptor = Object.getOwnPropertyDescriptor(original, key);
+			if (descriptor) descriptors[key] = descriptor;
+		}
+		const clone = Object.create(Object.getPrototypeOf(original), descriptors);
+		Object.defineProperty(clone, "message", {
+			value: maskedMessages[i],
+			writable: true,
+			enumerable: false,
+			configurable: true
+		});
+		const originalStack = original.stack;
+		if (typeof originalStack === "string") Object.defineProperty(clone, "stack", {
+			value: maskSecretsInText(originalStack, secrets),
+			writable: true,
+			enumerable: false,
+			configurable: true
+		});
+		clones.set(original, clone);
+	}
+	for (const original of chain) {
+		const causeDescriptor = Object.getOwnPropertyDescriptor(original, "cause");
+		if (!causeDescriptor) continue;
+		const clone = clones.get(original);
+		const causeValue = original.cause;
+		const replacement = causeValue instanceof Error ? clones.get(causeValue) : void 0;
+		Object.defineProperty(clone, "cause", replacement ? {
+			value: replacement,
+			writable: true,
+			enumerable: causeDescriptor.enumerable === true,
+			configurable: true
+		} : causeDescriptor);
+	}
+	return clones.get(error);
+}
+/**
 * Bind a {@link RecordedSecretValues} bag into a {@link SecretMasker} for a
 * caller to hand to a provider.
 *
@@ -16053,7 +16206,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-C9OlqHee.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-H-Dl8qng.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -22877,6 +23030,22 @@ function computeImplicitDeleteEdges(resources) {
 	return edges;
 }
 
+//#endregion
+//#region src/deployment/masking-retry-logger.ts
+/**
+* Bind `logger` to `secrets`, masking every line the retry loop emits.
+*
+* No-op when the caller resolved no secret ({@link maskSecretsInText} returns
+* the text unchanged for an empty bag), so a non-secret resource's output is
+* byte-identical to threading the raw logger.
+*/
+function maskingRetryLogger(logger, secrets) {
+	return {
+		debug: (msg) => logger.debug(maskSecretsInText(msg, secrets)),
+		warn: (msg) => logger.warn(maskSecretsInText(msg, secrets))
+	};
+}
+
 //#endregion
 //#region src/deployment/resource-deadline.ts
 /**
@@ -23156,6 +23325,38 @@ function replayingStateCreateContext(secrets) {
 	};
 }
 /**
+* The {@link DeploymentEventError} a failed replay records, with this op's
+* re-resolved secrets masked out of its message (issue
+* [#2031](https://github.com/go-to-k/cdkd/issues/2031) acceptance item 2).
+*
+* `extractDeploymentEventError` copies `err.message` VERBATIM, and the events
+* store is a DURABLE sink — `deployments/{runId}.jsonl` in S3 outlives the
+* terminal the `logger.warn` beside it scrolls past, and `cdkd events` replays
+* it later. The standalone `cdkd rollback` command wires
+* `recordEvent: (e) => eventRecorder.record(e)` (`src/cli/commands/rollback.ts`)
+* with NO masking of its own, so without this the plaintext the terminal line
+* masks is persisted one statement later.
+*
+* The in-process caller (`DeployEngine.rollbackExecutorContext`) routes through
+* `maskSecretsInEvent`, but that masks with the DEPLOY's `perResourceSecrets`
+* for the resource — a different bag from the one this replay re-resolved from
+* the JOURNAL, which can name a different secret version or a reference the
+* deploy never resolved. Masking here is what makes both callers equal, and
+* double-masking is a no-op (the mask is not a key of either bag).
+*
+* `name` / `awsErrorCode` / `requestId` are deliberately left alone: they are
+* AWS-authored identifiers, not message text, and #2038 traced all three as
+* non-sensitive.
+*/
+function maskedRollbackEventError(error, secrets) {
+	const extracted = extractDeploymentEventError(error);
+	if (secrets.size === 0) return extracted;
+	return {
+		...extracted,
+		message: maskSecretsInText(extracted.message, secrets)
+	};
+}
+/**
 * Which provisioning layer a delete must be judged against: the CURRENT
 * state record wins (it is what state says AWS holds right now), with the
 * journaled op's routing as the legacy-state fallback. Shared by both
@@ -23514,10 +23715,10 @@ function redactRollbackRecord(record, secrets, journaledProps) {
 		properties: redactSecretsForState(record.properties, secrets, journaledProps, STATE_DERIVED_RULES)
 	}, secrets);
 }
-async function updateWithRollbackRetry(provider, args, logicalId, logger, isInterrupted) {
+async function updateWithRollbackRetry(provider, args, logicalId, logger, isInterrupted, secrets) {
 	if (provider.disableOuterRetry) return await provider.update(...args);
 	return await withRetry(() => provider.update(...args), logicalId, {
-		logger,
+		logger: maskingRetryLogger(logger, secrets),
 		...isInterrupted && {
 			isInterrupted,
 			onInterrupted: () => /* @__PURE__ */ new Error("Rollback interrupted while retrying a resource update")
@@ -23572,6 +23773,21 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 	const action = classifyRollbackOp(op, stateResources, orphanLogicalIds);
 	const { logger } = ctx;
 	/**
+	* This op's `plaintext -> {{resolve:...}}expression` bag, filled by
+	* {@link resolveReplayProps} on whichever arm runs (issues
+	* [#2038](https://github.com/go-to-k/cdkd/issues/2038) /
+	* [#2031](https://github.com/go-to-k/cdkd/issues/2031)).
+	*
+	* HOISTED above the `try` rather than declared per arm, which is what the
+	* two arms used to do: the shared catch below logs the thrown AWS message and
+	* persists it to the events store, and it cannot see a binding scoped to the
+	* arm that threw. Exactly one arm runs per call, so a single per-op bag is
+	* equivalent to the per-arm ones for every existing reader (`secrets.size`
+	* stays 0 on the arms that resolve nothing, so `redactRollbackRecord` and the
+	* maskers keep their identity behavior).
+	*/
+	const secrets = /* @__PURE__ */ new Map();
+	/**
 	* The route a CREATE-rollback arm resolved for this op (issue #1366) —
 	* hoisted so the shared catch's ROLLBACK_RESOURCE_FAILED reports the route
 	* the delete was going to take, which is the one a refusal is about. Stays
@@ -23695,7 +23911,6 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 			case "reverse-replacement": {
 				const current = stateResources[op.logicalId];
 				const prev = op.previousState;
-				const secrets = /* @__PURE__ */ new Map();
 				const resolvedPrevProps = await resolveReplayProps(prev.properties, resolver, secrets) ?? {};
 				logger.info(`  Rollback: Reversing replacement of ${op.logicalId} (${op.resourceType}) — re-creating the old resource and deleting the new one`);
 				if (STATEFUL_TYPES.has(op.resourceType)) logger.warn(`  ⚠ ${op.logicalId} (${op.resourceType}) is a stateful type — the old physical resource's data was destroyed by the replacement and CANNOT be recovered; the re-created resource starts empty.`);
@@ -23712,7 +23927,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				try {
 					createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...resolvedPrevProps }, replayingStateCreateContext(secrets)), op.logicalId, {
 						...RECREATE_RETRY_SCHEDULE,
-						logger,
+						logger: maskingRetryLogger(logger, secrets),
 						...isInterrupted && {
 							isInterrupted,
 							onInterrupted: () => /* @__PURE__ */ new Error("Rollback interrupted while waiting out the name cooldown")
@@ -23735,7 +23950,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					try {
 						createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...resolvedPrevProps }, replayingStateCreateContext(secrets)), op.logicalId, {
 							...RECREATE_RETRY_SCHEDULE,
-							logger,
+							logger: maskingRetryLogger(logger, secrets),
 							...isInterrupted && {
 								isInterrupted,
 								onInterrupted: () => /* @__PURE__ */ new Error("Rollback interrupted while waiting for the old name to release")
@@ -23743,7 +23958,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 							isRetryable: isRecreateRetryableError
 						});
 					} catch (recreateError) {
-						throw new Error(`Failed to re-create the old ${op.logicalId} after the new resource (${current.physicalId}) was already deleted: ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. The resource is now absent — fix forward with 'cdkd deploy'.`);
+						throw new Error(maskSecretsInText(`Failed to re-create the old ${op.logicalId} after the new resource (${current.physicalId}) was already deleted: ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. The resource is now absent — fix forward with 'cdkd deploy'.`, secrets));
 					}
 				}
 				const adoptedLiveNewResource = !deletedNewFirst && createResult.physicalId === current.physicalId;
@@ -23766,7 +23981,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 						...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
 					}), op.logicalId, current.physicalId, "while deleting the new resource after re-creating the old one");
 				} catch (deleteError) {
-					logger.warn(`  Rollback: old ${op.logicalId} re-created, but deleting the new resource (${current.physicalId}) failed: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}. Delete it manually — it is no longer tracked in state.`);
+					logger.warn(maskSecretsInText(`  Rollback: old ${op.logicalId} re-created, but deleting the new resource (${current.physicalId}) failed: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}. Delete it manually — it is no longer tracked in state.`, secrets));
 					result.warnings++;
 				}
 				logger.info(adoptedLiveNewResource ? `  Rollback: ${op.logicalId} adopted the live resource (${createResult.physicalId}) — replacement NOT fully reversed (name-idempotent Create API)` : `  Rollback: ${op.logicalId} replacement reversed (old resource re-created as ${createResult.physicalId})`);
@@ -23798,7 +24013,6 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					resourceType: op.resourceType,
 					provisionedBy: op.provisionedBy
 				});
-				const secrets = /* @__PURE__ */ new Map();
 				const desiredProps = await resolveReplayProps(previousState.properties, resolver, secrets);
 				const currentProps = await resolveReplayProps(current.properties, resolver, secrets);
 				const revertResult = await updateWithRollbackRetry(provider, [
@@ -23808,10 +24022,10 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					desiredProps ?? {},
 					currentProps ?? {},
 					{ maskSecrets: createSecretMasker(secrets) }
-				], op.logicalId, logger, isInterrupted);
+				], op.logicalId, logger, isInterrupted, secrets);
 				stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(previousState, revertResult), secrets, previousState.properties);
 				const rollbackPartial = updatePartialReason(revertResult);
-				if (rollbackPartial !== void 0) logger.warn(`  Rollback: ${op.logicalId} restored, ${updatePartialMessage(rollbackPartial)}`);
+				if (rollbackPartial !== void 0) logger.warn(maskSecretsInText(`  Rollback: ${op.logicalId} restored, ${updatePartialMessage(rollbackPartial)}`, secrets));
 				else logger.info(`  Rollback: ${op.logicalId} restored successfully`);
 				await afterOp?.(op.logicalId);
 				ctx.recordEvent?.({
@@ -23821,13 +24035,13 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					logicalId: op.logicalId,
 					resourceType: op.resourceType,
 					...op.provisionedBy && { provisionedBy: op.provisionedBy },
-					...rollbackPartial !== void 0 && { reason: rollbackPartial }
+					...rollbackPartial !== void 0 && { reason: maskSecretsInText(rollbackPartial, secrets) }
 				});
 				return;
 			}
 		}
 	} catch (rollbackError) {
-		logger.warn(`  Rollback failed for ${op.logicalId} (${op.changeType}): ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
+		logger.warn(maskSecretsInText(`  Rollback failed for ${op.logicalId} (${op.changeType}): ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`, secrets));
 		logger.warn("  Continuing with remaining rollback operations...");
 		result.failures++;
 		const failedRoute = createRollbackRoute ?? op.provisionedBy;
@@ -23838,7 +24052,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 			logicalId: op.logicalId,
 			resourceType: op.resourceType,
 			...failedRoute && { provisionedBy: failedRoute },
-			error: extractDeploymentEventError(rollbackError)
+			error: maskedRollbackEventError(rollbackError, secrets)
 		});
 	}
 }
@@ -23875,6 +24089,15 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 		}
 		const op = failedOps[i];
 		const action = classifyFailedOp(op, stateResources);
+		/**
+		* This op's re-resolved secret bag — the twin of `replaySingle`'s, and
+		* hoisted above this iteration's `try` for the same reason (issues #2038 /
+		* #2031): the shared catch below logs the thrown AWS message and persists it
+		* to the events store, and could not see a binding scoped to the arm that
+		* threw. Re-created per ITERATION, so one op's secrets can never mask
+		* another's text.
+		*/
+		const secrets = /* @__PURE__ */ new Map();
 		let createRollbackRoute;
 		try {
 			switch (action) {
@@ -23942,7 +24165,6 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 						resourceType: op.resourceType,
 						provisionedBy: op.provisionedBy ?? current.provisionedBy
 					});
-					const secrets = /* @__PURE__ */ new Map();
 					const desiredProps = await resolveReplayProps(prev.properties, resolver, secrets);
 					const attemptedProps = await resolveReplayProps(op.attemptedProperties ?? current.properties, resolver, secrets);
 					const revertFailedResult = await updateWithRollbackRetry(provider, [
@@ -23952,10 +24174,10 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 						desiredProps ?? {},
 						attemptedProps ?? {},
 						{ maskSecrets: createSecretMasker(secrets) }
-					], op.logicalId, logger, options.isInterrupted);
+					], op.logicalId, logger, options.isInterrupted, secrets);
 					stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(prev, revertFailedResult), secrets, prev.properties);
 					const revertFailedPartial = updatePartialReason(revertFailedResult);
-					if (revertFailedPartial !== void 0) logger.warn(`  Rollback: ${op.logicalId} reverted, ${updatePartialMessage(revertFailedPartial)}`);
+					if (revertFailedPartial !== void 0) logger.warn(maskSecretsInText(`  Rollback: ${op.logicalId} reverted, ${updatePartialMessage(revertFailedPartial)}`, secrets));
 					else logger.info(`  Rollback: ${op.logicalId} reverted successfully`);
 					await options.afterOp?.(op.logicalId);
 					ctx.recordEvent?.({
@@ -23965,13 +24187,13 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 						logicalId: op.logicalId,
 						resourceType: op.resourceType,
 						...op.provisionedBy && { provisionedBy: op.provisionedBy },
-						...revertFailedPartial !== void 0 && { reason: revertFailedPartial }
+						...revertFailedPartial !== void 0 && { reason: maskSecretsInText(revertFailedPartial, secrets) }
 					});
 					break;
 				}
 			}
 		} catch (revertError) {
-			logger.warn(`  Rollback failed for failed-op ${op.logicalId} (${op.changeType}): ${revertError instanceof Error ? revertError.message : String(revertError)}`);
+			logger.warn(maskSecretsInText(`  Rollback failed for failed-op ${op.logicalId} (${op.changeType}): ${revertError instanceof Error ? revertError.message : String(revertError)}`, secrets));
 			result.failures++;
 			pending.add(op);
 			const failedRoute = createRollbackRoute ?? op.provisionedBy;
@@ -23982,7 +24204,7 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 				logicalId: op.logicalId,
 				resourceType: op.resourceType,
 				...failedRoute && { provisionedBy: failedRoute },
-				error: extractDeploymentEventError(revertError)
+				error: maskedRollbackEventError(revertError, secrets)
 			});
 		}
 	}
@@ -24082,7 +24304,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.11";
+	return "0.284.13";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -24547,6 +24769,14 @@ var DeploymentEventsReader = class {
 //#endregion
 //#region src/deployment/deploy-engine.ts
 /**
+* The bag a resource with no recorded secret masks against (issue #2038).
+* Shared so the "no entry" path allocates nothing and — more usefully — so
+* every masking site takes the SAME branch: `maskSecretsInText` /
+* `maskSecretsInError` both return their input unchanged for an empty bag, so
+* an absent entry and an empty one cannot behave differently. Never written to.
+*/
+const EMPTY_SECRETS = /* @__PURE__ */ new Map();
+/**
 * Default per-resource warn threshold: warn the user when a single
 * resource has been in flight for 5 minutes. Most CC API resources
 * complete in under a minute; 5m is the agreed elbow.
@@ -25750,7 +25980,7 @@ var DeployEngine = class {
 		} catch (error) {
 			renderer.removeTask(logicalId);
 			const message = error instanceof Error ? error.message : String(error);
-			this.logger.error(`Failed to ${change.changeType.toLowerCase()} ${logicalId}: ${message}`);
+			this.logger.error(this.maskForResource(logicalId, `Failed to ${change.changeType.toLowerCase()} ${logicalId}: ${message}`));
 			this.recordEvent({
 				eventType: "RESOURCE_FAILED",
 				stackName,
@@ -25761,7 +25991,7 @@ var DeployEngine = class {
 				durationMs: Date.now() - resourceStartedAt,
 				error: extractDeploymentEventError(error)
 			});
-			throw new ProvisioningError(`Failed to ${change.changeType.toLowerCase()} resource ${logicalId}`, resourceType, logicalId, stateResources[logicalId]?.physicalId, error instanceof Error ? error : void 0);
+			throw new ProvisioningError(`Failed to ${change.changeType.toLowerCase()} resource ${logicalId}`, resourceType, logicalId, stateResources[logicalId]?.physicalId, error instanceof Error ? maskSecretsInError(error, this.perResourceSecrets.get(logicalId) ?? EMPTY_SECRETS) : void 0);
 		} finally {
 			renderer.removeTask(logicalId);
 		}
@@ -25850,7 +26080,8 @@ var DeployEngine = class {
 	* #960 follow-up) and the name-idempotent same-id guard (issue #1238) so
 	* the two --replace escape hatches cannot drift apart.
 	*/
-	async replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, createContext, updateReplacePolicy) {
+	async replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, secrets, updateReplacePolicy) {
+		const createContext = { maskSecrets: createSecretMasker(secrets) };
 		const finalSnapshotIdentifier = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, updateReplacePolicy);
 		let deleteResult;
 		try {
@@ -25860,7 +26091,7 @@ var DeployEngine = class {
 				...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
 			});
 		} catch (deleteError) {
-			throw new Error(`Failed to delete old resource ${logicalId} (${currentResource.physicalId}) during the --replace delete-first fallback: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`);
+			throw new Error(maskSecretsInText(`Failed to delete old resource ${logicalId} (${currentResource.physicalId}) during the --replace delete-first fallback: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`, secrets));
 		}
 		const replaceSkipReason = deleteSkipReason(deleteResult);
 		if (replaceSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, replaceSkipReason, "during the --replace delete-first fallback"));
@@ -25871,13 +26102,13 @@ var DeployEngine = class {
 				maxRetries: 8,
 				initialDelayMs: 2e3,
 				maxDelayMs: 1e4,
-				logger: this.logger,
+				logger: this.maskingRetryLoggerFor(secrets),
 				isInterrupted: () => this.interrupted,
 				onInterrupted: () => new InterruptedError(this.interruptCause ?? "user"),
 				isRetryable: isRecreateRetryableError
 			});
 		} catch (recreateError) {
-			throw new Error(`Failed to re-create ${logicalId} after the --replace delete-first fallback already deleted the old resource (${currentResource.physicalId}): ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. Re-run the deploy to create it fresh.`);
+			throw new Error(maskSecretsInText(`Failed to re-create ${logicalId} after the --replace delete-first fallback already deleted the old resource (${currentResource.physicalId}): ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. Re-run the deploy to create it fresh.`, secrets));
 		}
 	}
 	/**
@@ -25899,10 +26130,10 @@ var DeployEngine = class {
 					...parameterValues && { parameters: parameterValues },
 					...conditions && { conditions }
 				}, stackName);
+				if (context.recordedSecretValues) this.perResourceSecrets.set(logicalId, context.recordedSecretValues);
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
 				this.perResourceTemplateProps.set(logicalId, desiredProps);
 				const createSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
-				if (context.recordedSecretValues) this.perResourceSecrets.set(logicalId, context.recordedSecretValues);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 				this.attemptedResolvedProps.set(logicalId, resolvedProps);
 				const createDecision = this.providerRegistry.getProviderFor({
@@ -25943,9 +26174,9 @@ var DeployEngine = class {
 					...parameterValues && { parameters: parameterValues },
 					...conditions && { conditions }
 				}, stackName);
-				const resolvedProps = await this.resolver.resolve(desiredProps, context);
 				const updateSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
 				this.perResourceSecrets.set(logicalId, updateSecrets);
+				const resolvedProps = await this.resolver.resolve(desiredProps, context);
 				this.perResourceTemplateProps.set(logicalId, desiredProps);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 				this.attemptedResolvedProps.set(logicalId, resolvedProps);
@@ -26026,7 +26257,7 @@ var DeployEngine = class {
 							maxRetries: 8,
 							initialDelayMs: 2e3,
 							maxDelayMs: 1e4,
-							logger: this.logger,
+							logger: this.maskingRetryLoggerFor(updateSecrets),
 							isInterrupted: () => this.interrupted,
 							onInterrupted: () => new InterruptedError(this.interruptCause ?? "user"),
 							isRetryable: isRecreateRetryableError
@@ -26045,7 +26276,7 @@ var DeployEngine = class {
 							if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but the create-first attempt collided with the existing resource: ${createMsg}. ${nameOrigin.descriptor}, so the CloudFormation-style safe replacement order (create the new resource before deleting the old) cannot reuse the occupied name — CloudFormation refuses this shape with "cannot update a stack when a custom-named resource requires replacing". ${nameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated).`, "NAMED_REPLACEMENT_COLLISION");
 							this.logger.info(`  Create-first collided with the existing resource's name and --replace is set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
 							deletedOldFirst = true;
-							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) }, updateReplacePolicy);
+							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy);
 						}
 						if (!deletedOldFirst && createResult.physicalId === currentResource.physicalId) {
 							const idempotentNameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
@@ -26053,7 +26284,7 @@ var DeployEngine = class {
 							if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its Create API is name-idempotent: the create-first attempt returned the EXISTING resource (${currentResource.physicalId}) instead of creating a new one, so deleting the "old" resource would silently destroy the resource the deploy just reported as created. ${idempotentNameOrigin.descriptor}; ${idempotentNameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated). Note: this branch is also reached when the old resource was deleted out-of-band and the physical id is name-derived — there the create was a genuine fresh create; \`--replace\` converges that case too.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
 							this.logger.info(`  Create-first returned the existing resource (name-idempotent Create API) and --replace is set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
 							deletedOldFirst = true;
-							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) }, updateReplacePolicy);
+							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy);
 						}
 						if (deletedOldFirst) {} else if (updateReplacePolicy === "Retain") this.logger.info(`  Retaining old ${logicalId} (${currentResource.physicalId}) - UpdateReplacePolicy: Retain`);
 						else {
@@ -26444,12 +26675,74 @@ var DeployEngine = class {
 		return withRetry(operation, logicalId, {
 			...maxRetries !== void 0 && { maxRetries },
 			...initialDelayMs !== void 0 && { initialDelayMs },
-			logger: this.logger,
+			logger: this.maskingRetryLogger(logicalId),
 			isInterrupted: () => this.interrupted,
 			onInterrupted: () => new InterruptedError(this.interruptCause ?? "user")
 		});
 	}
 	/**
+	* Mask one line of engine-authored text with a resource's OWN recorded
+	* secrets (issue [#2038](https://github.com/go-to-k/cdkd/issues/2038)).
+	*
+	* Per-resource, never session-wide — see the `perResourceSecrets` field doc
+	* for why one resource's secret must not rewrite another's literal. A
+	* `logicalId` with no entry (or an empty bag) forwards verbatim, so every
+	* non-secret resource is byte-identical to before.
+	*/
+	maskForResource(logicalId, text) {
+		return maskSecretsInText(text, this.perResourceSecrets.get(logicalId) ?? EMPTY_SECRETS);
+	}
+	/**
+	* The LAZY `RetryLogger` the engine's generic `withRetry` wrapper threads
+	* (issue [#2038](https://github.com/go-to-k/cdkd/issues/2038) acceptance
+	* item 1) — the same masking shape `drift.ts` and `rollback-executor.ts`
+	* install, bound to the resource's OWN recorded secrets.
+	*
+	* `retry.ts` interpolates the AWS message verbatim into both the per-attempt
+	* `debug` line and the give-up `warn` summary, and the bag this engine hands
+	* a provider is RESOLVED — `perResourceSecrets` is populated immediately after
+	* `resolver.resolve` and BEFORE the create / update call, so a secret is in
+	* scope at every retried provider call. An AWS validation error routinely
+	* quotes the offending value back, so the give-up summary could print it at
+	* DEFAULT verbosity: the same hole #2038 found on the rollback path, one
+	* caller over.
+	*
+	* The bag is resolved PER LINE rather than captured, because `withRetry`
+	* (the private wrapper below) is reached from call sites that hold no bag —
+	* DELETE, the observed-capture drain, the Outputs pass — and a
+	* `logicalId`-keyed read is the only thing available there. The two
+	* `--replace` sites do hold their caller's bag and use
+	* {@link maskingRetryLoggerFor} instead; see the note on
+	* {@link replaceDeleteFirstAndRecreate}'s `secrets` parameter for why binding
+	* the bag beats looking it up whenever the bag is in scope.
+	*
+	* Do NOT restate that the engine "already masked its own error text" — an
+	* earlier revision of this comment did, and it was FALSE: `provisionResource`
+	* logged the raw AWS message at `error` level (a HIGHER level than this
+	* summary) until #2038's review round. Only the EVENT store was masked.
+	*/
+	maskingRetryLogger(logicalId) {
+		return {
+			debug: (msg) => this.logger.debug(this.maskForResource(logicalId, msg)),
+			warn: (msg) => this.logger.warn(this.maskForResource(logicalId, msg))
+		};
+	}
+	/**
+	* The EAGER `RetryLogger`, bound to the bag the caller actually resolved
+	* with (issue [#2038](https://github.com/go-to-k/cdkd/issues/2038)).
+	*
+	* Preferred over {@link maskingRetryLogger} wherever the resolution pass's
+	* own `RecordedSecretValues` is in scope, for the reason
+	* {@link replaceDeleteFirstAndRecreate}'s parameter list already states about
+	* the masker it threads: a map looked up by logical id is a DIFFERENT thing
+	* from the bag this call resolved with, and one file must not argue both
+	* sides. It delegates to the shared `masking-retry-logger.ts` so the deploy
+	* engine, `rollback-executor.ts` and `drift.ts` cannot drift apart.
+	*/
+	maskingRetryLoggerFor(secrets) {
+		return maskingRetryLogger(this.logger, secrets);
+	}
+	/**
 	* What a failed Output resolution does, shared by both passes of
 	* {@link resolveOutputs} so they cannot drift — the alias pass reports the
 	* SAME failure for a name it could not resolve as the value pass does for a
@@ -26550,5 +26843,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { IntrinsicFunctionResolver as $, StackHasActiveImportsError as $n, validateContainerRepoName as $t, formatResourceLine as A, AssemblyReader as An, describeTypeWithThrottleRetry as At, isExportAliasCollision as B, ConfigError as Bn, WorkGraph as Bt, refusesFinalSnapshot as C, MIGRATE_TMP_PREFIX as Cn, s3BucketDomainName as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, PARTITION_TABLE as Dn, applyRoleArnIfSet as Dt, extractDeploymentEventError as E, expectedOwnerParam as En, s3BucketWebsiteUrl as Et, red as F, getAwsClients as Fn, S3StateBackend as Ft, clearOnUpdateRemoval as G, LocalStartServiceError as Gn, escapeRegExp$1 as Gt, stateKeySecretExposure as H, DeployCancelledError as Hn, createAssetRedirectResolver as Ht, yellow as I, resetAwsClients as In, rebuildClientForBucketRegion as It, findSilentDropProperties as J, NestedStackChildDirectDestroyError as Jn, BOOTSTRAP_MARKER_PREFIX as Jt, ProviderRegistry as K, LockError as Kn, stripControlChars as Kt, collectDeclaredOutputNames as L, setAwsClients as Ln, shouldRetainResource as Lt, cyan as M, clearBucketRegionCache as Mn, DagBuilder as Mt, gray as N, resolveBucketRegion as Nn, TemplateParser as Nt, isStatefulRecreateTargetSync as O, canonicalizeRegion as On, DiffCalculator as Ot, green as P, AwsClients as Pn, LockManager as Pt, isTerminationProtectionPropagationError as Q, ResourceUpdateNotSupportedError as Qn, validateAssetBucketName as Qt, collectPublishedOutputNames as R, AssetError as Rn, AssetPublisher as Rt, isFinalSnapshotError as S, CFN_TEMPLATE_URL_LIMIT as Sn, s3BucketArn as St, makeCanonicalizePropertiesFn as T, uploadCfnTemplate as Tn, s3BucketRegionalDomainName as Tt, IAMRoleProvider as U, LocalInvokeBuildError as Un, loadPublishableAssetManifest as Ut, secretBearingStateKeyWarning as V, DependencyError as Vn, buildAssetRedirectMap as Vt, collectInlinePolicyNamesManagedBySiblings as W, LocalMigrateError as Wn, rewriteTemplateAssetReferences as Wt, slowCcOperationTimeoutMs as X, ProvisioningError as Xn, getBootstrapMarkerKey as Xt, CloudControlProvider as Y, PartialFailureError as Yn, ensureAssetStorage as Yt, disableInstanceApiTermination as Z, ResourceTimeoutError as Zn, parseBootstrapMarker as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, resolveStateBucketWithDefaultAndSource as _n, TEMPLATE_SOURCED_RULES as _t, DeploymentEventsStore as a, runDockerStreaming as an, normalizeAwsError as ar, resolveExplicitPhysicalId as at, ccRoutedFinalSnapshotError as b, warnDeprecatedNoPrefixCliFlag as bn, redactSecretsForState as bt, replayFailedOperations as c, Synthesizer as cn, isRetryableTransientError as cr, configBooleanRefusal as ct, updatePartialReason as d, getLegacyStateBucketName as dn, __exportAll as dr, replayWarn as dt, buildDenyExternalAccessPolicy as en, StackTerminationProtectionError as er, cfnRefValueFromPhysicalId as et, UNSPECIFIED_SKIP_REASON as f, resolveApp as fn, requireConfigArray as ft, computeImplicitDeleteEdges as g, resolveStateBucketWithDefault as gn, STATE_SOURCED_READBACK_RULES as gt, IMPLICIT_DELETE_DEPENDENCIES as h, resolveSkipPrefix as hn, STATE_SOURCED_CROSS_GENERATION_RULES as ht, DeploymentEventsReader as i, runDockerForeground as in, isCdkdError as ir, normalizeAwsTagsToCfn as it, bold as j, processStackMessages as jn, withRetry as jt, renderStatefulReason as k, derivePartitionAndUrlSuffix as kn, INTRINSIC_KEYS as kt, replayRollback as l, synthesisStatusMessage as ln, isThrottlingError as lr, configStringRefusal as lt, withResourceDeadline as m, resolveCaptureObservedState as mn, requireConfigString as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, formatDockerLoginError as nn, SynthesisError as nr, refStateLookupFromResource as nt, planFailedOps as o, AssetManifestLoader as on, withErrorHandling as or, assertRegionMatch as ot, deleteSkipReason as p, resolveAutoAssetStorage as pn, requireConfigObject as pt, findActionableSilentDrops as q, MissingCdkCliError as qn, AssetModeResolver as qt, DeployEngine as r, getDockerCmd as rn, formatError as rr, WAFv2WebACLProvider as rt, planRollback as s, getDockerImageBySourceHash as sn, isMarkedNonRetryable as sr, coerceCfnBoolean as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, buildDockerImage as tn, StateError as tr, getAccountInfo as tt, updatePartialMessage as u, getDefaultStateBucketName as un, markNonRetryable as ur, readConfigString as ut, PRE_DELETE_SNAPSHOT_TYPES as v, resolveUseCdkBootstrapAssets as vn, createSecretMasker as vt, unsupportedFinalSnapshotError as w, findLargeInlineResources as wn, s3BucketDualStackDomainName as wt, createPreDeleteFinalSnapshot as x, CFN_TEMPLATE_BODY_LIMIT as xn, scrubResourceRecord as xt, buildFinalSnapshotIdentifier as y, stateBucketExistenceConfirmed as yn, maskSecretsInText as yt, exportAliasCollisionScrubWarning as z, CdkdError as zn, stringifyValue as zt };
-//# sourceMappingURL=deploy-engine-K5kHzsB-.js.map
+export { isTerminationProtectionPropagationError as $, ResourceUpdateNotSupportedError as $n, validateAssetBucketName as $t, renderStatefulReason as A, derivePartitionAndUrlSuffix as An, INTRINSIC_KEYS as At, exportAliasCollisionScrubWarning as B, CdkdError as Bn, stringifyValue as Bt, isFinalSnapshotError as C, CFN_TEMPLATE_URL_LIMIT as Cn, s3BucketArn as Ct, extractDeploymentEventError as D, expectedOwnerParam as Dn, s3BucketWebsiteUrl as Dt, makeCanonicalizePropertiesFn as E, uploadCfnTemplate as En, s3BucketRegionalDomainName as Et, green as F, AwsClients as Fn, LockManager as Ft, collectInlinePolicyNamesManagedBySiblings as G, LocalMigrateError as Gn, rewriteTemplateAssetReferences as Gt, secretBearingStateKeyWarning as H, DependencyError as Hn, buildAssetRedirectMap as Ht, red as I, getAwsClients as In, S3StateBackend as It, findActionableSilentDrops as J, MissingCdkCliError as Jn, AssetModeResolver as Jt, clearOnUpdateRemoval as K, LocalStartServiceError as Kn, escapeRegExp$1 as Kt, yellow as L, resetAwsClients as Ln, rebuildClientForBucketRegion as Lt, bold as M, processStackMessages as Mn, withRetry as Mt, cyan as N, clearBucketRegionCache as Nn, DagBuilder as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, PARTITION_TABLE as On, applyRoleArnIfSet as Ot, gray as P, resolveBucketRegion as Pn, TemplateParser as Pt, disableInstanceApiTermination as Q, ResourceTimeoutError as Qn, parseBootstrapMarker as Qt, collectDeclaredOutputNames as R, setAwsClients as Rn, shouldRetainResource as Rt, createPreDeleteFinalSnapshot as S, CFN_TEMPLATE_BODY_LIMIT as Sn, scrubResourceRecord as St, unsupportedFinalSnapshotError as T, findLargeInlineResources as Tn, s3BucketDualStackDomainName as Tt, stateKeySecretExposure as U, DeployCancelledError as Un, createAssetRedirectResolver as Ut, isExportAliasCollision as V, ConfigError as Vn, WorkGraph as Vt, IAMRoleProvider as W, LocalInvokeBuildError as Wn, loadPublishableAssetManifest as Wt, CloudControlProvider as X, PartialFailureError as Xn, ensureAssetStorage as Xt, findSilentDropProperties as Y, NestedStackChildDirectDestroyError as Yn, BOOTSTRAP_MARKER_PREFIX as Yt, slowCcOperationTimeoutMs as Z, ProvisioningError as Zn, getBootstrapMarkerKey as Zt, computeImplicitDeleteEdges as _, resolveStateBucketWithDefault as _n, STATE_SOURCED_READBACK_RULES as _t, DeploymentEventsStore as a, runDockerForeground as an, isCdkdError as ar, normalizeAwsTagsToCfn as at, buildFinalSnapshotIdentifier as b, stateBucketExistenceConfirmed as bn, maskSecretsInText as bt, replayFailedOperations as c, getDockerImageBySourceHash as cn, isMarkedNonRetryable as cr, coerceCfnBoolean as ct, updatePartialReason as d, getDefaultStateBucketName as dn, markNonRetryable as dr, readConfigString as dt, validateContainerRepoName as en, StackHasActiveImportsError as er, IntrinsicFunctionResolver as et, UNSPECIFIED_SKIP_REASON as f, getLegacyStateBucketName as fn, __exportAll as fr, replayWarn as ft, IMPLICIT_DELETE_DEPENDENCIES as g, resolveSkipPrefix as gn, STATE_SOURCED_CROSS_GENERATION_RULES as gt, maskingRetryLogger as h, resolveCaptureObservedState as hn, requireConfigString as ht, DeploymentEventsReader as i, getDockerCmd as in, formatError as ir, WAFv2WebACLProvider as it, formatResourceLine as j, AssemblyReader as jn, describeTypeWithThrottleRetry as jt, isStatefulRecreateTargetSync as k, canonicalizeRegion as kn, DiffCalculator as kt, replayRollback as l, Synthesizer as ln, isRetryableTransientError as lr, configBooleanRefusal as lt, withResourceDeadline as m, resolveAutoAssetStorage as mn, requireConfigObject as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, buildDockerImage as nn, StateError as nr, getAccountInfo as nt, planFailedOps as o, runDockerStreaming as on, normalizeAwsError as or, resolveExplicitPhysicalId as ot, deleteSkipReason as p, resolveApp as pn, requireConfigArray as pt, ProviderRegistry as q, LockError as qn, stripControlChars as qt, DeployEngine as r, formatDockerLoginError as rn, SynthesisError as rr, refStateLookupFromResource as rt, planRollback as s, AssetManifestLoader as sn, withErrorHandling as sr, assertRegionMatch as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, buildDenyExternalAccessPolicy as tn, StackTerminationProtectionError as tr, cfnRefValueFromPhysicalId as tt, updatePartialMessage as u, synthesisStatusMessage as un, isThrottlingError as ur, configStringRefusal as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, resolveStateBucketWithDefaultAndSource as vn, TEMPLATE_SOURCED_RULES as vt, refusesFinalSnapshot as w, MIGRATE_TMP_PREFIX as wn, s3BucketDomainName as wt, ccRoutedFinalSnapshotError as x, warnDeprecatedNoPrefixCliFlag as xn, redactSecretsForState as xt, PRE_DELETE_SNAPSHOT_TYPES as y, resolveUseCdkBootstrapAssets as yn, createSecretMasker as yt, collectPublishedOutputNames as z, AssetError as zn, AssetPublisher as zt };
+//# sourceMappingURL=deploy-engine-4Eh5Qqlm.js.map