@go-to-k/cdkd 0.286.4 → 0.287.0

package/dist/{deploy-engine-DylsbAdu.js → deploy-engine-B377YKBI.js}

@@ -1,6 +1,6 @@
 import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-CKOnsgg1.js";
+import { t as getCdkdVersion } from "./version-Rs7TV7Gz.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -11161,7 +11161,9 @@ function recordResolvedPair(secrets, expression, plaintext) {
 * evidence — so a literal `Output` embedding one of two same-plaintext
 * references would fall back to the value scan and persist the sibling's
 * expression. The engine's other entry-by-entry copy — an `Export.Name`'s
-* secrets into the pass map — deliberately does NOT call this: a name never
+* secrets into the pass map — deliberately does NOT call this (and `cdkd
+* scrub`'s name loop resolves through a VIEW whose pairs never reach the pass
+* map at all, issue #2531): a name never
 * positions a leaf, a value re-using the same token records its own pair at
 * the seam, and the only thing the merge could add is a CONFLICT (a
 * non-cacheable `{{resolve:ssm:X}}` whose value moved between the value pass
@@ -20212,6 +20214,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const conditions = {};
 		const templateConditions = context.template.Conditions;
 		if (!templateConditions || typeof templateConditions !== "object") return conditions;
+		const maskingContext = context.recordedSecretValues ? context : {
+			...context,
+			recordedSecretValues: /* @__PURE__ */ new Map()
+		};
 		const inProgress = /* @__PURE__ */ new Set();
 		const evaluateByName = async (name) => {
 			if (name in conditions) return conditions[name];
@@ -20225,7 +20231,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			inProgress.add(name);
 			try {
 				const result = await this.resolveValue(definition, {
-					...context,
+					...maskingContext,
 					conditionResolver: evaluateByName
 				});
 				const value = Boolean(result);
@@ -20239,7 +20245,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		for (const name of Object.keys(templateConditions)) try {
 			await evaluateByName(name);
 		} catch (error) {
-			this.logger.warn(`Failed to evaluate condition ${name}: ${error instanceof Error ? error.message : String(error)}, assuming false`);
+			this.logger.warn(this.maskSecretsForLog(`Failed to evaluate condition ${name}: ${error instanceof Error ? error.message : String(error)}, assuming false`, maskingContext));
 			conditions[name] = false;
 			inProgress.delete(name);
 		}
@@ -22341,10 +22347,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			* which caches nothing (issue #1933).
 			*/
 			let cacheable = true;
-			if (service === "secretsmanager") resolved = await this.resolveSecretsManagerReference(inner);
+			if (service === "secretsmanager") resolved = await this.resolveSecretsManagerReference(inner, context);
 			else if (service === "ssm") {
 				const decrypt = context?.skipDynamicReferences !== true;
-				const param = await this.resolveSSMReference(parts, decrypt);
+				const param = await this.resolveSSMReference(parts, decrypt, "ssm", context);
 				if (param.type === "SecureString") this.pinSecretVerdict(fullMatch, true);
 				else if (!param.secure) this.pinSecretVerdict(fullMatch, false);
 				else cacheable = false;
@@ -22354,12 +22360,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				}
 				resolved = param.value;
 			} else if (service === "ssm-secure") {
-				const param = await this.resolveSSMReference(parts, true, "ssm-secure");
+				const param = await this.resolveSSMReference(parts, true, "ssm-secure", context);
 				if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${fullMatch}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
 				isSecret = true;
 				resolved = param.value;
 			} else {
-				this.logger.warn(`Unsupported dynamic reference service: ${service}`);
+				this.logger.warn(this.maskSecretsForLog(`Unsupported dynamic reference service: ${service}`, context));
 				continue;
 			}
 			if (cacheable) this.cachedDynamicReferences.set(fullMatch, {
@@ -22390,7 +22396,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* runs when no mid-string ":SecretString:" delimiter is present, so the json-key / version
 	* forms are unaffected.)
 	*/
-	async resolveSecretsManagerReference(inner) {
+	async resolveSecretsManagerReference(inner, context) {
 		const afterService = inner.substring(15);
 		let secretId;
 		let jsonKey = "";
@@ -22419,14 +22425,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		} else secretId = afterService;
 		if (!versionStage) versionStage = "AWSCURRENT";
 		if (!secretId) throw new Error("Dynamic reference: secretsmanager SECRET_ID is required");
-		this.logger.debug(`Resolving dynamic reference: secretsmanager:${secretId}:SecretString:${jsonKey}:${versionStage}:${versionId}`);
+		this.logger.debug(this.maskSecretsForLog(`Resolving dynamic reference: secretsmanager:${secretId}:SecretString:${jsonKey}:${versionStage}:${versionId}`, context));
 		const client = this.clientsForRegion(this.explicitRegion).secretsManager;
 		const command = new GetSecretValueCommand({
 			SecretId: secretId,
 			...versionStage && versionStage !== "" && { VersionStage: versionStage },
 			...versionId && versionId !== "" && { VersionId: versionId }
 		});
-		const secretString = (await this.sendWithThrottleRetry(() => client.send(command), `secretsmanager:${secretId}`)).SecretString;
+		const secretString = (await this.sendWithThrottleRetry(() => client.send(command), this.maskSecretsForLog(`secretsmanager:${secretId}`, context))).SecretString;
 		if (!secretString) throw new Error(`Dynamic reference: secret '${secretId}' does not contain a SecretString value`);
 		if (jsonKey) try {
 			const keyValue = JSON.parse(secretString)[jsonKey];
@@ -22579,16 +22585,16 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* discard the value when `secure` is set — it is ciphertext, not the resolved
 	* reference.
 	*/
-	async resolveSSMReference(parts, decrypt = true, service = "ssm") {
+	async resolveSSMReference(parts, decrypt = true, service = "ssm", context) {
 		const parameterName = parts.slice(1).join(":");
 		if (!parameterName) throw new Error(`Dynamic reference: ${service} PARAMETER_NAME is required`);
-		this.logger.debug(`Resolving dynamic reference: ${service}:${parameterName}`);
+		this.logger.debug(this.maskSecretsForLog(`Resolving dynamic reference: ${service}:${parameterName}`, context));
 		const client = this.clientsForRegion(this.explicitRegion).ssm;
 		const command = new GetParameterCommand({
 			Name: parameterName,
 			WithDecryption: decrypt
 		});
-		const response = await this.sendWithThrottleRetry(() => client.send(command), `${service}:${parameterName}`);
+		const response = await this.sendWithThrottleRetry(() => client.send(command), this.maskSecretsForLog(`${service}:${parameterName}`, context));
 		const paramValue = response.Parameter?.Value;
 		if (paramValue === void 0 || paramValue === null) throw new Error(`Dynamic reference: SSM parameter '${parameterName}' not found or has no value`);
 		const paramType = response.Parameter?.Type;
@@ -22596,7 +22602,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (secure && paramType !== "SecureString" && !this.warnedUnrecognizedSsmTypes.has(`${parameterName}\u0000${String(paramType)}`)) {
 			this.warnedUnrecognizedSsmTypes.add(`${parameterName}\u0000${String(paramType)}`);
 			const reported = paramType === void 0 ? "(absent)" : `'${String(paramType)}'`;
-			this.logger.warn(`SSM parameter '${parameterName}' reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:${service}:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`);
+			this.logger.warn(this.maskSecretsForLog(`SSM parameter '${parameterName}' reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:${service}:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`, context));
 		}
 		return {
 			value: paramValue,
@@ -23549,9 +23555,14 @@ function describeJsonKeys(document) {
 *     `disableCcApiFallback` is not read on that path. The poisoned pre-guard
 *     state record the issue is about is precisely a record that already says
 *     `cc-api`, so it would still arrive here. Only adding the type to
-*     `STICKY_CC_MIGRATION_EXEMPT` would divert it -- and that set is reserved
-*     for types whose CC routing is BROKEN, which would then send the
-*     silent-drop property back down the dropping path on the next deploy.
+*     `STICKY_CC_MIGRATION_EXEMPT` would divert it. Since issue #2719 that
+*     table admits two modes, and NEITHER helps here: `'cc-broken'` is for
+*     types Cloud Control cannot manage, and `'sdk-coverage'` diverts a
+*     resource only when its property bags carry no actionable silent drop --
+*     which is the opposite of this case by construction. Were a type somehow
+*     admitted anyway, the divert would send the silent-drop property back
+*     down the dropping path on the next deploy; the property gate is what
+*     prevents it.
 *
 * So the confirmation belongs where the delete is actually issued. The set is
 * a set rather than an `if` because the hazard is not S3-specific in kind: any
@@ -23800,7 +23811,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-dBSdt3nB.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-D10GWdiA.js").then((n) => n.n);
 			return withIndeterminateGuard(await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -29056,6 +29067,65 @@ function findActionableSilentDrops(resourceType, templateProperties, allowedKeys
 	if (drops.length === 0) return drops;
 	return drops.filter(({ property }) => !allowedKeys.has(`${resourceType}:${property}`));
 }
+/**
+* A 1-click pre-filled GitHub issue link requesting cdkd support for a
+* specific top-level property on a resource type. Surfaced in the pre-flight
+* error so a user hitting a silent drop lands directly in the "request
+* support" flow.
+*/
+function unsupportedPropertyIssueUrl(resourceType, property) {
+	return `https://github.com/go-to-k/cdkd/issues/new?title=${encodeURIComponent(`Support property ${resourceType}.${property}`)}&labels=resource-support`;
+}
+/**
+* Identify top-level template properties this type's committed CFn schema
+* snapshot does not know about at all — present in neither
+* `coverage.handled` nor `coverage.silentDrop` (issue
+* [#2718](https://github.com/go-to-k/cdkd/issues/2718)).
+*
+* The complement of {@link findSilentDropProperties}, which deliberately
+* PASSES these through: a property absent from the schema is indistinguishable
+* at deploy time from a user typo or an `addPropertyOverride` escape hatch, so
+* it cannot drive a routing decision. That tolerance is correct for routing
+* and wrong for silence — the routing table is built offline from
+* `tests/fixtures/cfn-schemas/*.json`, so every property AWS publishes AFTER
+* that snapshot lands here, and on the SDK route it reaches neither AWS nor an
+* error while the deploy reports success. That is the issue
+* [#614](https://github.com/go-to-k/cdkd/issues/614) failure class arriving
+* through the one input the #614 machinery cannot observe.
+*
+* **Why a warn built on this has no false-positive mode.** An SDK provider
+* writes only what it declares in `handledProperties`, so a top-level property
+* in neither set does not reach AWS under ANY of the three readings — a
+* post-snapshot AWS addition, a typo, or a deliberate `addPropertyOverride`.
+* "This value will not reach AWS" is true in all three, so the caller does not
+* have to guess intent, and at deploy time it could not: cdkd holds only the
+* template and the baked-in table. Firing on a typo is a feature rather than
+* noise — CloudFormation would have REJECTED that typo, so today's silence is
+* strictly the worst of the three behaviors.
+*
+* Deliberately NOT gated on the snapshot's age: the statement is true whatever
+* `generatedAt` says, and an age gate would trade the typo visibility away for
+* a wall-clock dependence.
+*
+* Returns `[]` for Tier 2 / Custom / unknown types (no coverage record — Cloud
+* Control forwards the full property map, so nothing is dropped) and sorts
+* alphabetically, mirroring {@link findSilentDropProperties}. The CALLER is
+* responsible for firing only when the resource actually resolves to the SDK
+* route; see `ProviderRegistry.reportSilentDropDecisions`.
+*/
+function findUnrecognizedProperties(resourceType, templateProperties) {
+	if (!templateProperties) return [];
+	const coverage = getPropertyCoverage(resourceType);
+	if (!coverage) return [];
+	const unrecognized = [];
+	for (const prop of Object.keys(templateProperties)) {
+		if (prop === "Ref" || prop.startsWith("Fn::")) continue;
+		if (coverage.handled.has(prop)) continue;
+		if (coverage.silentDrop.has(prop)) continue;
+		unrecognized.push(prop);
+	}
+	return unrecognized.sort((a, b) => a.localeCompare(b));
+}
 
 //#endregion
 //#region src/provisioning/mutually-exclusive-properties.ts
@@ -29165,56 +29235,39 @@ function buildMutuallyExclusiveMessage(logicalId, violation) {
 //#endregion
 //#region src/provisioning/provider-registry.ts
 /**
-* Provider registry for managing resource providers.
-*
-* Selection strategy for a fresh resource (see {@link getProviderFor}):
-* 1. Custom Resource (`Custom::*` / `AWS::CloudFormation::CustomResource`)
-*    → Custom Resource provider (recorded as `provisionedBy: 'sdk'`).
-* 2. Existing-state `provisionedBy: 'cc-api'` → Cloud Control (sticky).
-* 3. SDK Provider registered, no silent-drop properties (after the
-*    `--allow-unsupported-properties` override filter) → SDK Provider.
-* 4. SDK Provider registered, silent-drop properties present, NOT all
-*    in the allow set → Cloud Control (auto-route, info-logged). When the
-*    CC route is NOT viable — the type is `NON_PROVISIONABLE` (no CC
-*    handlers, e.g. AWS::FSx::FileSystem) or the provider sets
-*    `disableCcApiFallback` (e.g. NestedStackProvider) — throw the clear
-*    pre-flight error instead of failing opaquely at provisioning time.
-* 5. SDK Provider registered, silent-drop properties present, ALL in
-*    the allow set → SDK Provider (the user explicitly accepted the
-*    silent drop, warn-logged).
-* 6. No SDK Provider, Cloud Control supports the type → Cloud Control.
-* 7. `--allow-unsupported-types` escape hatch → Cloud Control optimistically.
-* 8. Otherwise → throw (no provider available).
-*
-* SDK-provider-less Tier 3 (`NON_PROVISIONABLE`) types are rejected earlier
-* by {@link validateResourceTypes}. A Tier 1 type that is ALSO
-* NON_PROVISIONABLE (SDK provider registered for a type Cloud Control cannot
-* manage — e.g. AWS::FSx::FileSystem, AWS::DLM::LifecyclePolicy) passes the
-* type check but has no viable CC auto-route; rule 4's viability guard turns
-* that case into a clear pre-flight error.
-*/
-/**
 * Types exempt from the sticky `provisionedBy: 'cc-api'` routing rule.
 *
-* The sticky rule exists to avoid physical-ID churn when an SDK provider is
-* backfilled for a type Cloud Control was already managing fine. These types
-* are different: their CLOUD CONTROL ROUTING IS BROKEN, so keeping existing
-* state pinned to cc-api would keep the bug alive for every pre-existing
-* resource. Only add a type here when BOTH hold:
-*
-* 1. the CC handler cannot correctly manage the resource (not a perf choice),
-* 2. the SDK provider uses the SAME physicalId the CC path stored, so the
-*    re-route is churn-free and the record flips to `provisionedBy: 'sdk'`
-*    transparently on its next state write.
-*
-* - AWS::Scheduler::Schedule (issue #961): a schedule in a custom
-*   ScheduleGroup is unaddressable via CC (the handlers resolve the bare-Name
-*   identifier against the DEFAULT group) — CC UPDATE fails NotFound and CC
-*   DELETE silently no-ops, orphaning a live schedule. Both paths stored the
-*   bare schedule name as physicalId, and the state properties carry
-*   GroupName, so the SDK provider addresses existing records correctly.
-*/
-const STICKY_CC_MIGRATION_EXEMPT = /* @__PURE__ */ new Set(["AWS::Scheduler::Schedule"]);
+* The sticky rule (rule 2 in `getProviderFor`) exists to avoid physical-ID
+* churn when an SDK provider is backfilled for a type Cloud Control was
+* already managing fine. Both exemption modes are narrow escapes from it; see
+* `StickyExemptMode` for which applies when.
+*
+* Condition 2 -- physicalId parity -- is a hard requirement in BOTH modes and
+* is what makes a flip churn-free. It is also why this is a curated table
+* rather than a predicate: an automatic flip keyed on "the type has coverage"
+* would assert parity for types nobody measured.
+*/
+const STICKY_CC_MIGRATION_EXEMPT = /* @__PURE__ */ new Map([["AWS::Scheduler::Schedule", {
+	mode: "cc-broken",
+	physicalIdForm: "both layers store the bare schedule name; the state properties carry GroupName, so the SDK provider addresses existing records correctly",
+	issue: "https://github.com/go-to-k/cdkd/issues/961",
+	integFixture: "scheduler-custom-group"
+}], ["AWS::SNS::Topic", {
+	mode: "sdk-coverage",
+	physicalIdForm: "both layers store the topic ARN: the schema primaryIdentifier is TopicArn and SnsTopicProvider.create records the CreateTopic TopicArn",
+	issue: "https://github.com/go-to-k/cdkd/issues/2719",
+	integFixture: "cc-to-sdk-reroute"
+}]]);
+function wouldReturnToSdkProvider(input) {
+	const { resourceType, desiredProperties, previousProperties, allowedUnsupportedProperties = /* @__PURE__ */ new Set(), forceCcApi = false, exemptions = STICKY_CC_MIGRATION_EXEMPT } = input;
+	const exemption = exemptions.get(resourceType);
+	if (exemption === void 0) return false;
+	if (exemption.mode === "cc-broken") return true;
+	if (forceCcApi) return false;
+	if (desiredProperties === void 0) return false;
+	if (previousProperties === void 0) return false;
+	return [desiredProperties, previousProperties].every((bag) => findActionableSilentDrops(resourceType, bag, allowedUnsupportedProperties).length === 0);
+}
 var ProviderRegistry = class {
 	logger = getLogger().child("ProviderRegistry");
 	providers = /* @__PURE__ */ new Map();
@@ -29309,18 +29362,36 @@ var ProviderRegistry = class {
 				provisionedBy: "sdk"
 			};
 		}
-		if (provisionedBy === "cc-api" && !STICKY_CC_MIGRATION_EXEMPT.has(resourceType)) {
-			this.logger.debug(`Routing ${resourceType} via Cloud Control (state-recorded provisionedBy=cc-api)`);
-			return {
-				provider: this.cloudControlProvider,
-				provisionedBy: "cc-api"
-			};
+		let returningToSdk = false;
+		if (provisionedBy === "cc-api") {
+			if (!wouldReturnToSdkProvider({
+				resourceType,
+				desiredProperties: properties,
+				previousProperties: input.previousProperties,
+				allowedUnsupportedProperties: this.allowedUnsupportedProperties,
+				forceCcApi: input.forceCcApi === true
+			})) {
+				this.logger.debug(`Routing ${resourceType} via Cloud Control (state-recorded provisionedBy=cc-api)`);
+				return {
+					provider: this.cloudControlProvider,
+					provisionedBy: "cc-api"
+				};
+			}
+			returningToSdk = true;
 		}
 		const specificProvider = this.providers.get(resourceType);
 		if (specificProvider) {
 			const actionableDrops = findActionableSilentDrops(resourceType, properties, this.allowedUnsupportedProperties);
 			if (actionableDrops.length === 0) {
 				this.logger.debug(`Using specific SDK provider for ${resourceType}`);
+				if (returningToSdk) {
+					this.logger.debug(`${resourceType} is returning to its SDK provider from a state-recorded cc-api route; physical id is preserved`);
+					return {
+						provider: specificProvider,
+						provisionedBy: "sdk",
+						sdkMigration: true
+					};
+				}
 				return {
 					provider: specificProvider,
 					provisionedBy: "sdk"
@@ -29520,7 +29591,6 @@ var ProviderRegistry = class {
 	reportSilentDropDecisions(resources) {
 		for (const { logicalId, resourceType, properties, provisionedBy } of resources) {
 			const drops = findSilentDropProperties(resourceType, properties);
-			if (drops.length === 0) continue;
 			const overridden = [];
 			const autoRouted = [];
 			for (const { property } of drops) {
@@ -29539,9 +29609,71 @@ var ProviderRegistry = class {
 				const propList = overridden.join(", ");
 				this.logger.warn(`${logicalId} (${resourceType}): ${propList} will be silently dropped (--allow-unsupported-properties override accepted). Remove the override to route this resource via Cloud Control API instead.`);
 			}
+			this.reportUnrecognizedProperties(logicalId, resourceType, properties, {
+				provisionedBy,
+				autoRouted: autoRouted.length > 0
+			});
 		}
 	}
 	/**
+	* Warn about top-level template properties this type's committed CFn schema
+	* snapshot does not know about, on resources that resolve to the SDK route
+	* (issue [#2718](https://github.com/go-to-k/cdkd/issues/2718)).
+	*
+	* The gap this closes: {@link getProviderFor} decides SDK-vs-Cloud-Control
+	* from `property-coverage.generated.ts`, built offline from the schema
+	* fixtures, and there is no runtime `DescribeType` on that path. So a
+	* property AWS publishes AFTER the fixture snapshot produces no
+	* `silentDrop` entry, does not auto-route to Cloud Control, and is dropped
+	* with the deploy reporting success — the issue
+	* [#614](https://github.com/go-to-k/cdkd/issues/614) failure class reached
+	* through the one input the #614 machinery cannot observe. The scheduled
+	* fixture-refresh job is the FIX (the property enters the fixture and the
+	* existing auto-route handles it); this warn is what protects a user
+	* deploying BETWEEN refresh cycles.
+	*
+	* Fires only on the SDK route, which is where the drop actually happens.
+	* The two Cloud-Control routes both forward the full property map verbatim,
+	* so the property does reach AWS there and a warn would be false:
+	* - `provisionedBy: 'cc-api'` from existing state (sticky rule 2 of
+	*   {@link getProviderFor}), minus the `STICKY_CC_MIGRATION_EXEMPT` types
+	*   that deliberately re-route back to their SDK provider;
+	* - an actionable silent drop auto-routing this deploy (`autoRouted`).
+	*
+	* The route test MIRRORS `getProviderFor` rather than re-deriving it — the
+	* two answering differently is the only way this warn can be wrong about a
+	* resource, and it is not decidable from the message.
+	*
+	* **Known divergence, in the SAFE direction.** This runs on the template's
+	* RAW properties (`deploy-engine.ts` calls `validateResourceProperties`
+	* pre-flight) while `getProviderFor` runs on RESOLVED ones. So a silent-drop
+	* key present only behind an `Fn::If` that resolves to `AWS::NoValue` makes
+	* `autoRouted` true here and suppresses the warn, while the real route ends
+	* up on the SDK provider and does drop the unrecognized property. The result
+	* is a MISSING warn, never a false one — which is the right direction for an
+	* advisory line, and why this is documented rather than fixed by resolving
+	* twice. `getProviderFor` remains the authority on routing; nothing here
+	* changes a routing decision.
+	*
+	* Suppressed per `<Type>:<Prop>` by `--allow-unsupported-properties`, whose
+	* meaning ("accept the silent drop, stay on the SDK path") is exactly this
+	* case; deliberately no new flag. Warn rather than error because the drop
+	* may be intended, and deliberately NOT an auto-route: flipping to
+	* Cloud Control on an UNRECOGNIZED property would let a typo trigger the
+	* currently one-way `cc-api` state flip (issue
+	* [#2719](https://github.com/go-to-k/cdkd/issues/2719)), and CC would reject
+	* the unknown key anyway.
+	*/
+	reportUnrecognizedProperties(logicalId, resourceType, properties, route) {
+		if (route.provisionedBy === "cc-api" && !STICKY_CC_MIGRATION_EXEMPT.has(resourceType) || route.autoRouted) return;
+		const unrecognized = findUnrecognizedProperties(resourceType, properties).filter((property) => !this.allowedUnsupportedProperties.has(`${resourceType}:${property}`));
+		if (unrecognized.length === 0) return;
+		const propList = unrecognized.join(", ");
+		const overrideHint = unrecognized.map((p) => `${resourceType}:${p}`).join(",");
+		const one = unrecognized.length === 1;
+		this.logger.warn(`${logicalId} (${resourceType}): ${propList} ${one ? "is" : "are"} not in cdkd's CFn schema snapshot for this type, so ${one ? "it" : "they"} will NOT reach AWS — the deploy will still report success. Anything of these shapes looks the same here: a misspelled name (fix the spelling); a read-only attribute, which is not settable on any engine (remove it); or a property AWS published after cdkd's snapshot, which cdkd should be routing via Cloud Control — please report that one: ${unsupportedPropertyIssueUrl(resourceType, unrecognized[0])}${one ? "" : ` (link is for ${unrecognized[0]})`}. If the drop is intended — an addPropertyOverride escape hatch — silence this via --allow-unsupported-properties ${overrideHint}.`);
+	}
+	/**
 	* Pure-functional discovery of every resource whose template uses one or
 	* more silent-drop properties that are NOT in the
 	* `--allow-unsupported-properties` allow set — i.e. every resource that
@@ -34244,31 +34376,15 @@ var InterruptedError = class extends Error {
 		this.name = "InterruptedError";
 	}
 };
-/**
-* Best-effort routing inference for the live-progress task label
-* (#614 §9). Mirrors the routing decision tree but is purely cosmetic:
-* errors here never surface — when the inference fails we return
-* `undefined` and the label gets no `[CC API]` tag. The real
-* `getProviderFor` call inside the deploy/destroy critical path is the
-* load-bearing dispatch.
-*
-* Inputs:
-* - CREATE / UPDATE → template-side `desiredProperties` (top-level CFn
-*   property names; intrinsic resolution does not change those, so we
-*   can route ahead of the resolver run).
-* - DELETE → sticky `provisionedBy` from the existing-state record.
-*
-* Exported so {@link DeployEngine.peekRoutingForLabel} stays a 1-line
-* delegate and the routing-inference logic is directly unit-testable
-* without standing up a full DeployEngine harness.
-*/
-function deriveLabelRouting(change, existingState, registry) {
+function deriveLabelRouting(change, existingState, registry, forceCcApi = false) {
 	try {
 		if (change.changeType === "DELETE") return existingState?.provisionedBy;
 		return registry.getProviderFor({
 			resourceType: change.resourceType,
-			properties: change.desiredProperties,
-			provisionedBy: existingState?.provisionedBy
+			properties: change.desiredProperties ?? {},
+			provisionedBy: existingState?.provisionedBy,
+			previousProperties: existingState?.properties,
+			forceCcApi
 		}).provisionedBy;
 	} catch {
 		return;
@@ -35660,9 +35776,10 @@ var DeployEngine = class {
 	async provisionResource(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
 		const resourceType = change.resourceType;
 		const renderer = getLiveRenderer();
-		const needsReplacement = change.changeType === "UPDATE" && (change.propertyChanges?.some((pc) => pc.requiresReplacement) ?? false);
+		const labelRecreateDirection = this.recreateDirectionFor(stackName, logicalId);
+		const needsReplacement = change.changeType === "UPDATE" && (change.propertyChanges?.some((pc) => pc.requiresReplacement) ?? false) || labelRecreateDirection !== void 0;
 		const verb = change.changeType === "CREATE" ? "Creating" : change.changeType === "DELETE" ? "Deleting" : needsReplacement ? "Replacing" : "Updating";
-		const labelRouting = this.peekRoutingForLabel(change, stateResources[logicalId]);
+		const labelRouting = this.peekRoutingForLabel(change, stateResources[logicalId], stackName, logicalId, needsReplacement, labelRecreateDirection);
 		const baseLabel = `${verb} ${logicalId} (${resourceType})${labelRouting === "cc-api" ? " [CC API]" : ""}`;
 		renderer.addTask(logicalId, baseLabel);
 		const operationKind = change.changeType === "CREATE" ? "CREATE" : change.changeType === "DELETE" ? "DELETE" : "UPDATE";
@@ -35757,8 +35874,51 @@ var DeployEngine = class {
 			renderer.removeTask(logicalId);
 		}
 	}
-	peekRoutingForLabel(change, existingState) {
-		return deriveLabelRouting(change, existingState, this.providerRegistry);
+	/**
+	* Is this resource pinned to Cloud Control for this deploy (`--pin-cc-api`)?
+	*
+	* ONE implementation, called by the update dispatch and by the progress
+	* label. They carried separate copies of this expression for one revision,
+	* and a mutation probe caught the predictable result: neutering the LABEL's
+	* copy left every test green, because the only cases that existed exercised
+	* the dispatch's. Same shape as the duplicated flip predicate this lane
+	* already collapsed once.
+	*
+	* SCOPED BY STACK, like `recreateTargets`. `NestedStackProvider.runChildDeploy`
+	* spreads the parent's options into every child engine, and a logical id is
+	* unique only within one template, so an unscoped set would pin a same-named
+	* resource in a stack the user never named — silently, since a pin produces
+	* no output of its own.
+	*/
+	isPinnedToCcApi(stackName, logicalId) {
+		return this.options.pinCcApi?.stackName === stackName && this.options.pinCcApi.logicalIds.has(logicalId);
+	}
+	/**
+	* The `--recreate-via-*` direction for this resource, or `undefined`.
+	*
+	* Stack-scoped for the same reason as {@link isPinnedToCcApi}, and extracted
+	* for a sharper one: the LABEL and the DISPATCH were computing "is this a
+	* replacement" from DIFFERENT expressions. The dispatch asks
+	* `propertyDrivenReplacement || recreateFlagged`; the label asked only the
+	* property half. So a `--recreate-via-*` target whose property change does
+	* not itself force a replacement took the label's non-replacement path and
+	* was routed from the state record, while the dispatch routed it from the
+	* flag -- mislabelling in BOTH directions, and rendering `Updating` over a
+	* destroy + recreate.
+	*
+	* Three review rounds fixed three instances of that one class (the pin, then
+	* the sticky inputs, then this) by subtracting one input at a time from the
+	* label. The class closes by asking the same QUESTION at both sites instead.
+	*/
+	recreateDirectionFor(stackName, logicalId) {
+		const targets = this.options.recreateTargets?.stackName === stackName ? this.options.recreateTargets : void 0;
+		if (targets === void 0) return void 0;
+		if (targets.viaCcApi.has(logicalId)) return "cc-api";
+		if (targets.viaSdkProvider.has(logicalId)) return "sdk";
+	}
+	peekRoutingForLabel(change, existingState, stackName, logicalId, needsReplacement = false, recreateDirection) {
+		if (needsReplacement) return deriveLabelRouting(change, recreateDirection === void 0 ? void 0 : { provisionedBy: recreateDirection }, this.providerRegistry, recreateDirection === "cc-api");
+		return deriveLabelRouting(change, existingState, this.providerRegistry, this.isPinnedToCcApi(stackName, logicalId));
 	}
 	/**
 	* #808 — forward one structured deployment event to the optional
@@ -35990,7 +36150,8 @@ var DeployEngine = class {
 					const replaceDecision = this.providerRegistry.getProviderFor({
 						resourceType,
 						properties: resolvedProps,
-						...recreateDirectionHint && { provisionedBy: recreateDirectionHint }
+						...recreateDirectionHint && { provisionedBy: recreateDirectionHint },
+						...recreateViaCcApi && { forceCcApi: true }
 					});
 					const replaceProvider = replaceDecision.provider;
 					const replaceProps = replaceDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
@@ -36109,8 +36270,25 @@ var DeployEngine = class {
 					const updateDecision = this.providerRegistry.getProviderFor({
 						resourceType,
 						properties: resolvedProps,
-						provisionedBy: currentResource.provisionedBy
+						provisionedBy: currentResource.provisionedBy,
+						previousProperties: currentResource.properties,
+						...this.isPinnedToCcApi(stackName, logicalId) && { forceCcApi: true }
 					});
+					if (updateDecision.sdkMigration === true) {
+						const exemptMode = STICKY_CC_MIGRATION_EXEMPT.get(resourceType)?.mode;
+						const preserved = "The physical id is preserved";
+						let message;
+						switch (exemptMode) {
+							case "cc-broken":
+								message = `${logicalId} (${resourceType}): moving to the SDK provider — Cloud Control cannot manage this type correctly. ${preserved}, and this routing is not optional.`;
+								break;
+							case "sdk-coverage":
+								message = `${logicalId} (${resourceType}): returning to the SDK provider — cdkd now covers every property this resource uses. ${preserved}; pass --pin-cc-api ${logicalId} to decline this for a deploy.`;
+								break;
+							default: message = `${logicalId} (${resourceType}): moving to the SDK provider. ${preserved}.`;
+						}
+						this.logger.info(message);
+					}
 					const updateProvider = updateDecision.provider;
 					const updateProps = updateDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
 					let result;
@@ -36563,10 +36741,55 @@ var DeployEngine = class {
 	* the deploy instead of silently publishing nothing (which breaks downstream
 	* `Fn::ImportValue` consumers with "export not found" long after this deploy
 	* exits 0).
-	*/
-	handleOutputResolutionFailure(error, outputKey, outputs) {
-		if (this.options.strictGetAtt) throw new Error(`Failed to resolve output ${outputKey}: ${error instanceof Error ? error.message : String(error)} (--strict-getatt promotes output resolution failures to deploy errors; drop the flag to warn and skip the output instead)`, { cause: error });
-		this.logger.warn(`Failed to resolve output ${outputKey}: ${String(error)}`);
+	*
+	* The error is masked on both arms (issue
+	* [#2728](https://github.com/go-to-k/cdkd/issues/2728)). The resolver's own
+	* failures echo the offending reference token, a secret id / JSON key, or
+	* an SSM parameter name, and `resolveSub` / `resolveJoin` re-enter
+	* `resolveDynamicReferences` with the ASSEMBLED string — so a reference
+	* built out of a value this same pass resolved from a secret puts that
+	* plaintext into the echoed field (a JSON key assembled from the resolved
+	* password says `key '<password>' not found`).
+	*
+	* TWO bags, the inherited one first, the same pair the resolver's
+	* `maskSecretsForLog` masks against and for the same reason (issue #1903
+	* round 2): on a nested-stack child the parent-decrypted parameter
+	* plaintext is in `inheritedSecrets` and not in the pass map until a
+	* `{Ref: <Param>}` resolution copies it across. No shape reaching this
+	* handler before that copy has been constructed (every `${Param}` route
+	* goes through `resolveRef`, which records), so the inherited bag is
+	* defense in depth here — but two masking sites in one flow must not argue
+	* opposite sides of the same question. `secrets` is the outputs pass's own
+	* map: everything recorded before this handler runs, an `Export.Name`
+	* resolution's entries included (its `finally` merges them back before the
+	* `catch` reaches here). What a still-pending concurrent part would have
+	* recorded is outside both — issue #2563's late write, the same bound every
+	* other masking site in this engine has.
+	*
+	* The strict arm's `cause` is masked as an OBJECT, through
+	* `maskSecretsInError` — a clone of each `Error` link `errorCauseChain`
+	* reaches (`ERROR_CAUSE_MASK_MAX_DEPTH` links, a cycle stops it; a
+	* non-`Error` cause is kept verbatim), symbols included, so
+	* `isMarkedNonRetryable`'s non-enumerable marker survives (the same reason
+	* `provisionResource` uses it). No sink on the deploy path renders past
+	* one level today (`formatError` prints `Caused by:` for a `CdkdError`'s
+	* direct cause only), but that is a property of reachability, not of the
+	* sinks: `cdkd scrub`'s `describeFailure` renders a chain, and is safe
+	* because its boundary masks with this same helper and it walks the same
+	* bounded `errorCauseChain`. Masking here gives a renderer within that
+	* bound nothing to leak. A thrown STRING is masked as text; any other
+	* non-`Error` value is not threaded as a cause at all (it would travel
+	* unmasked, and `markNonRetryable` cannot have marked it).
+	*/
+	handleOutputResolutionFailure(error, outputKey, outputs, secrets, inheritedSecrets) {
+		let detail = error instanceof Error ? error.message || error.name : String(error);
+		for (const bag of [inheritedSecrets, secrets]) detail = maskSecretsInText(detail, bag);
+		if (this.options.strictGetAtt) {
+			let cause = error;
+			for (const bag of [inheritedSecrets, secrets]) cause = typeof cause === "string" ? maskSecretsInText(cause, bag) : maskSecretsInError(cause, bag);
+			throw new Error(`Failed to resolve output ${outputKey}: ${detail} (--strict-getatt promotes output resolution failures to deploy errors; drop the flag to warn and skip the output instead)`, cause instanceof Error || typeof cause === "string" ? { cause } : {});
+		}
+		this.logger.warn(`Failed to resolve output ${outputKey}: ${detail}`);
 		outputs[outputKey] = void 0;
 	}
 	/**
@@ -36588,6 +36811,8 @@ var DeployEngine = class {
 			...parameterValues && { parameters: parameterValues },
 			...conditions && { conditions }
 		}, stackName);
+		const outputsPassSecrets = context.recordedSecretValues ?? EMPTY_SECRETS;
+		const outputsPassInherited = context.inheritedSecrets ?? EMPTY_SECRETS;
 		const publishedOutputNames = collectPublishedOutputNames(template.Outputs, conditions);
 		let outputsPassCompleted = false;
 		try {
@@ -36599,7 +36824,7 @@ var DeployEngine = class {
 				try {
 					outputs[outputKey] = await this.resolver.resolve(output.Value, context);
 				} catch (error) {
-					this.handleOutputResolutionFailure(error, outputKey, outputs);
+					this.handleOutputResolutionFailure(error, outputKey, outputs, outputsPassSecrets, outputsPassInherited);
 				}
 			}
 			for (const [outputKey, output] of Object.entries(template.Outputs)) {
@@ -36619,7 +36844,7 @@ var DeployEngine = class {
 						for (const [plaintext, expression] of nameSecrets) context.recordedSecretValues?.set(plaintext, expression);
 					}
 				} catch (error) {
-					this.handleOutputResolutionFailure(error, outputKey, outputs);
+					this.handleOutputResolutionFailure(error, outputKey, outputs, outputsPassSecrets, outputsPassInherited);
 					continue;
 				}
 				if (typeof exportName !== "string") continue;
@@ -36658,5 +36883,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { findSilentDropProperties as $, escapeRegExp$1 as $n, StateError as $r, createSecretMasker as $t, WARM_THROUGHPUT_MEMBERS as A, AssetModeResolver as An, resolveBucketRegion as Ar, readConfigString as At, yellow as B, buildDenyExternalAccessPolicy as Bn, DeployCancelledError as Br, s3BucketRegionalDomainName as Bt, unsupportedFinalSnapshotError as C, AssetPublisher as Cn, expectedOwnerParam as Cr, WAFv2WebACLProvider as Ct, isStatefulRecreateTargetForReplace as D, createAssetRedirectResolver as Dn, AssemblyReader as Dr, coerceCfnBoolean as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, buildAssetRedirectMap as En, derivePartitionAndUrlSuffix as Er, assertRegionMatch as Et, bold as F, isCrossRegionRedirect as Fn, AssetError as Fr, classifyReplaySecretRegion as Ft, secretBearingStateKeyWarning as G, describeDockerFailure as Gn, LockError as Gr, describeTypeWithThrottleRetry as Gt, collectPublishedOutputNames as H, buildDockerImage as Hn, IntrinsicResolutionRefusalError as Hr, applyRoleArnIfSet as Ht, cyan as I, parseBootstrapMarker as In, CdkdError as Ir, producerRegionsFromState as It, IAMRoleProvider as J, getDockerCmd as Jn, ProvisioningError as Jr, TemplateParser as Jt, stateKeySecretExposure as K, dockerSpawnEnvWithSensitive as Kn, NestedStackChildDirectDestroyError as Kr, withRetry as Kt, gray as L, readBootstrapMarkerBody as Ln, ConfigError as Lr, s3BucketArn as Lt, isWarmThroughputDecrease as M, assertAssetBucketRegion as Mn, getAwsClients as Mr, requireConfigArray as Mt, toFiniteNumber as N, ensureAssetStorage as Nn, resetAwsClients as Nr, requireConfigObject as Nt, isStatefulRecreateTargetSync as O, loadPublishableAssetManifest as On, processStackMessages as Or, configBooleanRefusal as Ot, formatResourceLine as P, getBootstrapMarkerKey as Pn, setAwsClients as Pr, requireConfigString as Pt, findActionableSilentDrops as Q, runDockerStreaming as Qn, StackTerminationProtectionError as Qr, carriesSecretMask as Qt, green as R, validateAssetBucketName as Rn, CrossAccountSecretRefusalError as Rr, s3BucketDomainName as Rt, refusesFinalSnapshot as S, shouldRetainResource as Sn, displaySafe as Sr, refStateLookupFromResource as St, extractDeploymentEventError as T, WorkGraph as Tn, canonicalizeRegion as Tr, resolveExplicitPhysicalId as Tt, exportAliasCollisionScrubWarning as U, describeDockerCapturedOutput as Un, LocalInvokeBuildError as Ur, DiffCalculator as Ut, collectDeclaredOutputNames as V, describeAwsFailure as Vn, DynamicReferenceRegionAmbiguousError as Vr, s3BucketWebsiteUrl as Vt, isExportAliasCollision as W, describeDockerExecFailure as Wn, LocalStartServiceError as Wr, INTRINSIC_KEYS as Wt, clearOnUpdateRemoval as X, redactDockerArgvValues as Xn, ResourceUpdateNotSupportedError as Xr, STATE_SOURCED_READBACK_RULES as Xt, collectInlinePolicyNamesManagedBySiblings as Y, partitionSensitiveEnv as Yn, ResourceTimeoutError as Yr, STATE_SOURCED_CROSS_GENERATION_RULES as Yt, ProviderRegistry as Z, runDockerForeground as Zn, StackHasActiveImportsError as Zr, TEMPLATE_SOURCED_RULES as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, CUSTOM_RESOURCE_RESPONSE_PREFIX as _n, CFN_TEMPLATE_URL_LIMIT as _r, cfnRefValueFromPhysicalId as _t, DeploymentEventsStore as a, isMarkedNonRetryable as ai, recordMaskOnlyValue as an, getDefaultStateBucketName as ar, interruptWatchListenerCount as at, createPreDeleteFinalSnapshot as b, importableOutputKeys as bn, uploadCfnTemplate as br, isUnboundTemplateParameter as bt, replayFailedOperations as c, isTransientServerError as ci, scrubResourceRecord as cn, resolveAutoAssetStorage as cr, CloudControlProvider as ct, updatePartialReason as d, retryClassificationText as di, rebuildClientForBucketRegion as dn, resolveStateBucketWithDefault as dr, deleteIndeterminateGuards as dt, SynthesisError as ei, dynamicReferenceTokens as en, stripControlChars as er, createMaskedRetryLogger as et, withResourceDeadline as f, __exportAll as fi, UNRENDERABLE as fn, resolveStateBucketWithDefaultAndSource as fr, deleteSkipReason as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, shellQuote as gn, CFN_TEMPLATE_BODY_LIMIT as gr, carriesDynamicReference as gt, computeImplicitDeleteEdges as h, forceQuitRecoveryClause as hn, warnDeprecatedNoPrefixCliFlag as hr, IntrinsicFunctionResolver as ht, DeploymentEventsReader as i, withErrorHandling as ii, maskSecretsInText as in, synthesisStatusMessage as ir, endCommandInterruptScope as it, coerceWarmThroughput as j, BOOTSTRAP_MARKER_PREFIX as jn, AwsClients as jr, replayWarn as jt, renderStatefulReason as k, rewriteTemplateAssetReferences as kn, clearBucketRegionCache as kr, configStringRefusal as kt, replayRollback as l, markNonRetryable as li, LockManager as ln, resolveCaptureObservedState as lr, slowCcOperationTimeoutMs as lt, IMPLICIT_DELETE_DEPENDENCIES as m, buildLockContentionMessage as mn, stateBucketExistenceConfirmed as mr, isTerminationProtectionPropagationError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isCdkdError as ni, isSingleDynamicReferenceToken as nn, getDockerImageBySourceHash as nr, maskerOrIdentity as nt, planFailedOps as o, isRetryableTransientError as oi, recoverMaskedOutput as on, getLegacyStateBucketName as or, isInterruptedWaitError as ot, maskingRetryLogger as p, buildForceUnlockCommand as pn, resolveUseCdkBootstrapAssets as pr, disableInstanceApiTermination as pt, getCurrentResourceSecrets as q, formatDockerLoginError as qn, PartialFailureError as qr, DagBuilder as qt, DeployEngine as r, normalizeAwsError as ri, maskSecretsInError as rn, Synthesizer as rr, beginCommandInterruptScope as rt, planRollback as s, isThrottlingError as si, redactSecretsForState as sn, resolveApp as sr, startInterruptWatch as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, formatError as ti, errorCauseChain as tn, AssetManifestLoader as tr, maskDeep as tt, updatePartialMessage as u, markRedactedCause as ui, S3StateBackend as un, resolveSkipPrefix as ur, UNSPECIFIED_SKIP_REASON as ut, buildFinalSnapshotIdentifier as v, DEFAULT_STATE_PREFIX as vn, MIGRATE_TMP_PREFIX as vr, coerceParameterTypedValue as vt, makeCanonicalizePropertiesFn as w, stringifyValue as wn, PARTITION_TABLE as wr, normalizeAwsTagsToCfn as wt, isFinalSnapshotError as x, importableOutputs as xn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as xr, parameterTypeMayLoseSecretIdentity as xt, ccRoutedFinalSnapshotError as y, exportNamesCarriedFrom as yn, findLargeInlineResources as yr, getAccountInfo as yt, red as z, validateContainerRepoName as zn, DependencyError as zr, s3BucketDualStackDomainName as zt };
-//# sourceMappingURL=deploy-engine-DylsbAdu.js.map
+export { findActionableSilentDrops as $, runDockerStreaming as $n, StackTerminationProtectionError as $r, carriesSecretMask as $t, WARM_THROUGHPUT_MEMBERS as A, rewriteTemplateAssetReferences as An, clearBucketRegionCache as Ar, configStringRefusal as At, yellow as B, validateContainerRepoName as Bn, DependencyError as Br, s3BucketDualStackDomainName as Bt, unsupportedFinalSnapshotError as C, shouldRetainResource as Cn, displaySafe as Cr, refStateLookupFromResource as Ct, isStatefulRecreateTargetForReplace as D, buildAssetRedirectMap as Dn, derivePartitionAndUrlSuffix as Dr, assertRegionMatch as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, WorkGraph as En, canonicalizeRegion as Er, resolveExplicitPhysicalId as Et, bold as F, getBootstrapMarkerKey as Fn, setAwsClients as Fr, requireConfigString as Ft, secretBearingStateKeyWarning as G, describeDockerExecFailure as Gn, LocalStartServiceError as Gr, INTRINSIC_KEYS as Gt, collectPublishedOutputNames as H, describeAwsFailure as Hn, DynamicReferenceRegionAmbiguousError as Hr, s3BucketWebsiteUrl as Ht, cyan as I, isCrossRegionRedirect as In, AssetError as Ir, classifyReplaySecretRegion as It, IAMRoleProvider as J, formatDockerLoginError as Jn, PartialFailureError as Jr, DagBuilder as Jt, stateKeySecretExposure as K, describeDockerFailure as Kn, LockError as Kr, describeTypeWithThrottleRetry as Kt, gray as L, parseBootstrapMarker as Ln, CdkdError as Lr, producerRegionsFromState as Lt, isWarmThroughputDecrease as M, BOOTSTRAP_MARKER_PREFIX as Mn, AwsClients as Mr, replayWarn as Mt, toFiniteNumber as N, assertAssetBucketRegion as Nn, getAwsClients as Nr, requireConfigArray as Nt, isStatefulRecreateTargetSync as O, createAssetRedirectResolver as On, AssemblyReader as Or, coerceCfnBoolean as Ot, formatResourceLine as P, ensureAssetStorage as Pn, resetAwsClients as Pr, requireConfigObject as Pt, wouldReturnToSdkProvider as Q, runDockerForeground as Qn, StackHasActiveImportsError as Qr, TEMPLATE_SOURCED_RULES as Qt, green as R, readBootstrapMarkerBody as Rn, ConfigError as Rr, s3BucketArn as Rt, refusesFinalSnapshot as S, importableOutputs as Sn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Sr, parameterTypeMayLoseSecretIdentity as St, extractDeploymentEventError as T, stringifyValue as Tn, PARTITION_TABLE as Tr, normalizeAwsTagsToCfn as Tt, exportAliasCollisionScrubWarning as U, buildDockerImage as Un, IntrinsicResolutionRefusalError as Ur, applyRoleArnIfSet as Ut, collectDeclaredOutputNames as V, buildDenyExternalAccessPolicy as Vn, DeployCancelledError as Vr, s3BucketRegionalDomainName as Vt, isExportAliasCollision as W, describeDockerCapturedOutput as Wn, LocalInvokeBuildError as Wr, DiffCalculator as Wt, clearOnUpdateRemoval as X, partitionSensitiveEnv as Xn, ResourceTimeoutError as Xr, STATE_SOURCED_CROSS_GENERATION_RULES as Xt, collectInlinePolicyNamesManagedBySiblings as Y, getDockerCmd as Yn, ProvisioningError as Yr, TemplateParser as Yt, ProviderRegistry as Z, redactDockerArgvValues as Zn, ResourceUpdateNotSupportedError as Zr, STATE_SOURCED_READBACK_RULES as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, shellQuote as _n, CFN_TEMPLATE_BODY_LIMIT as _r, carriesDynamicReference as _t, DeploymentEventsStore as a, withErrorHandling as ai, maskSecretsInText as an, synthesisStatusMessage as ar, endCommandInterruptScope as at, createPreDeleteFinalSnapshot as b, exportNamesCarriedFrom as bn, findLargeInlineResources as br, getAccountInfo as bt, replayFailedOperations as c, isThrottlingError as ci, redactSecretsForState as cn, resolveApp as cr, startInterruptWatch as ct, updatePartialReason as d, markRedactedCause as di, S3StateBackend as dn, resolveSkipPrefix as dr, UNSPECIFIED_SKIP_REASON as dt, StateError as ei, createSecretMasker as en, escapeRegExp$1 as er, findSilentDropProperties as et, withResourceDeadline as f, retryClassificationText as fi, rebuildClientForBucketRegion as fn, resolveStateBucketWithDefault as fr, deleteIndeterminateGuards as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, forceQuitRecoveryClause as gn, warnDeprecatedNoPrefixCliFlag as gr, IntrinsicFunctionResolver as gt, computeImplicitDeleteEdges as h, buildLockContentionMessage as hn, stateBucketExistenceConfirmed as hr, isTerminationProtectionPropagationError as ht, DeploymentEventsReader as i, normalizeAwsError as ii, maskSecretsInError as in, Synthesizer as ir, beginCommandInterruptScope as it, coerceWarmThroughput as j, AssetModeResolver as jn, resolveBucketRegion as jr, readConfigString as jt, renderStatefulReason as k, loadPublishableAssetManifest as kn, processStackMessages as kr, configBooleanRefusal as kt, replayRollback as l, isTransientServerError as li, scrubResourceRecord as ln, resolveAutoAssetStorage as lr, CloudControlProvider as lt, IMPLICIT_DELETE_DEPENDENCIES as m, buildForceUnlockCommand as mn, resolveUseCdkBootstrapAssets as mr, disableInstanceApiTermination as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, formatError as ni, errorCauseChain as nn, AssetManifestLoader as nr, maskDeep as nt, planFailedOps as o, isMarkedNonRetryable as oi, recordMaskOnlyValue as on, getDefaultStateBucketName as or, interruptWatchListenerCount as ot, maskingRetryLogger as p, __exportAll as pi, UNRENDERABLE as pn, resolveStateBucketWithDefaultAndSource as pr, deleteSkipReason as pt, getCurrentResourceSecrets as q, dockerSpawnEnvWithSensitive as qn, NestedStackChildDirectDestroyError as qr, withRetry as qt, DeployEngine as r, isCdkdError as ri, isSingleDynamicReferenceToken as rn, getDockerImageBySourceHash as rr, maskerOrIdentity as rt, planRollback as s, isRetryableTransientError as si, recoverMaskedOutput as sn, getLegacyStateBucketName as sr, isInterruptedWaitError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, SynthesisError as ti, dynamicReferenceTokens as tn, stripControlChars as tr, createMaskedRetryLogger as tt, updatePartialMessage as u, markNonRetryable as ui, LockManager as un, resolveCaptureObservedState as ur, slowCcOperationTimeoutMs as ut, buildFinalSnapshotIdentifier as v, CUSTOM_RESOURCE_RESPONSE_PREFIX as vn, CFN_TEMPLATE_URL_LIMIT as vr, cfnRefValueFromPhysicalId as vt, makeCanonicalizePropertiesFn as w, AssetPublisher as wn, expectedOwnerParam as wr, WAFv2WebACLProvider as wt, isFinalSnapshotError as x, importableOutputKeys as xn, uploadCfnTemplate as xr, isUnboundTemplateParameter as xt, ccRoutedFinalSnapshotError as y, DEFAULT_STATE_PREFIX as yn, MIGRATE_TMP_PREFIX as yr, coerceParameterTypedValue as yt, red as z, validateAssetBucketName as zn, CrossAccountSecretRefusalError as zr, s3BucketDomainName as zt };
+//# sourceMappingURL=deploy-engine-B377YKBI.js.map