@go-to-k/cdkd 0.291.12 → 0.291.13

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/deployment/secret-redaction.ts","../src/provisioning/region-check.ts","../src/types/resource.ts","../src/types/config.ts","../src/utils/logger.ts","../src/utils/error-handler.ts","../src/utils/aws-clients.ts","../src/utils/aws-region-resolver.ts","../src/types/assembly.ts","../src/synthesis/stack-messages.ts","../src/synthesis/failed-stages.ts","../src/synthesis/assembly-reader.ts","../src/cli/upload-cfn-template.ts","../src/synthesis/macro-expander.ts","../src/synthesis/synthesizer.ts","../src/types/deployment-events.ts","../src/provisioning/cloud-control-provider.ts","../src/provisioning/provider-registry.ts","../src/provisioning/final-snapshot.ts","../src/deployment/rollback-executor.ts","../src/types/rollback-journal.ts","../src/state/s3-noncurrent-version-purge.ts","../src/state/s3-state-backend.ts","../src/assets/asset-redirect.ts","../src/deployment/work-graph.ts","../src/assets/asset-publisher.ts","../src/state/lock-manager.ts","../src/analyzer/template-parser.ts","../src/analyzer/dag-builder.ts","../src/analyzer/diff-calculator.ts","../src/provisioning/providers/iam-role-provider.ts","../src/state/export-index-store.ts","../src/deployment/deploy-engine.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KAiJY;UAyBK;EAEf;EAMA;EAYA;;UAsBe;EAUf;EAMA;EAQA;;UAMe;EAKf,SAAS;EAGT;EAMA;EAGA,WAAW,eAAe;EAG1B,SAAS;EAUT,UAAU;EAoBV,cAAc;EAqBd;EA0EA,iBAAiB;EAgBjB;EAcA;EAYA;EAwCA,UAAU;EAGV;;UASe;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA,YAAY;EAcZ,qBAAqB;EAGrB,aAAa;EAGb;EAGA,WAAW;EAmBX;EAMA;EA0CA;EA6DA;EAiEA;;UA0Ce;EAEf;EAGA;EAGA;EAGA;;KAMU;UAKK;EAEf;EAGA,YAAY;EAGZ;EAGA,oBAAoB;EAGpB,oBAAoB;EAGpB,kBAAkB;EAWlB,mBAAmB;;UAUJ;EAEf;EACA;EACA;;UA+Te;EAEf;EAGA;EAGA;EAGA;EAYA;;;;KC3lCU,uBAAuB;KA2uOvB,gBAAgB;;;UC9wOX;EASf;EAyCA;EAwBA;EA0BA;;;;UClHe;EACf;EACA;EACA,aAAa,eAAe;EAC5B,WAAW,eAAe;EAC1B,UAAU,eAAe;EACzB,aAAa;EACb,WAAW;EAWX;EACA,QAAQ;;UAMO;EACf;EACA;EACA;EACA;EACA;EACA;EAMA;;UAMe;EACf;EACA,aAAa;EACb;EACA;EACA,WAAW;EACX,iBAAiB;EACjB,eAAe;EACf;EACA;;UAMe;EACf;EACA;EAOA;EACA;IACE;;;UAgCa;EAYf,sBAAsB;;UA8CP;EAKf;EAWA;;UAMe,6BAA6B,2BAA2B;EAEvE;EAEA,aAAa;;UAOL,iCAAiC,2BAA2B;EAEpE;EAEA;EAEA,aAAa;;KAwCH;WAGG;WAMA;;WAOA;WAaA;;KAOH,uBAAuB,2BAA2B;UAuB7C;WAQN;WAQA;;KA0DC;WAGG;WAKA,+BAA+B;;WAY/B,+BAA+B;WAU/B;WAaA;;UAcE;EAEf;EAGA;EAGA;EAGA;EAGA,YAAY;EASZ;;UAUe;EAEf;EAEA,aAAa;;UAiEE;EA2Df,cAAc;;UAmDC,sBAAsB;EAmBrC;EAmCA;EAgCA;;UAkBe,sBAAsB;EA0DrC;;UAqCe;EAWf,WAAW;IAGP;IACA;IACA,YAAY;IACZ,aAAa;;;UAQF;EAWf,oBAAoB,oBAAoB;EAwBxC,oBAAoB,oBAAoB;EAUxC;EAkBA;EAkBA;EAkBA,8BACE,mBACA,sBACA,YAAY,0BACX;EAmBH,OACE,mBACA,sBACA,YAAY,yBACZ,UAAU,gBACT,QAAQ;EAgBX,OACE,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAqBX,OACE,mBACA,oBACA,sBACA,aAAa,yBACb,UAAU,gBACT,eAAe;EASlB,cAAc,oBAAoB,sBAAsB,wBAAwB;EAwChF,kBACE,oBACA,mBACA,sBACA,aAAa,yBACb,UAAU,0BACT,QAAQ;EAgCX,sBAAsB,sBAAsB,aAAa;EAiCzD,+BACE,sBACA,YAAY,0BACX;EAiDH,wBAAwB;EAuDxB,6BACE,sBACA,YAAY,0BACX;EA4BH,QAAQ,OAAO,sBAAsB,QAAQ;;;;UCnxC9B;EAEf;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;;UAMe;EAEf;EAGA;EAGA,cAAc;EAGd;EAGA;EAGA;;UAMe;EAEf;EAGA;;KAMU;UAKK;EACf,MAAM,oBAAoB;EAC1B,KAAK,oBAAoB;EACzB,KAAK,oBAAoB;EACzB,MAAM,oBAAoB;;;;qBCmEf,yBAAyB;UAC5B;UACA;EAER,YAAY,QAAO,UAAmB;UAK9B;UAOA;UAsFA;EAeR,MAAM,oBAAoB;EAM1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;EAS1B,SAAS,OAAO;EAIhB,YAAY;EASZ,MAAM,iBAAiB;;cAQnB,oBAAoB;mBACP;EAEjB,YAAY,gBAAgB;UAKpB;EAMC,MAAM,oBAAoB;EAK1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;;wBAerB,aAAa;wBAUb,UAAU,QAAQ;;;qBCzWrB,kBAAkB;WACb;WACA,OAAO;EAEvB,YAAY,iBAAiB,cAAc,QAAQ;;qBAYxC,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;qBAU1B,kBAAkB;EAC7B,YAAY,iBAAiB,QAAQ;;qBAU1B,uBAAuB;EAClC,YAAY,iBAAiB,QAAQ;;qBA6B1B,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;qBA6B1B,0BAA0B;WACrB;WACA;WACA;EAEhB,YACE,iBACA,sBACA,mBACA,qBACA,QAAQ;;qBAgTC,wBAAwB;EACnC,YAAY,iBAAiB,QAAQ;;qBAU1B,oBAAoB;EAC/B,YAAY,iBAAiB,QAAQ;;wBA0avB,YAAY,iBAAiB,SAAS;wBAOtC,YAAY;UAkIX;EACf;EACA;;wBA2Bc,kBAAkB,cAAc,UAAS,2BAAgC;;;UCp+BxE;EACf;EACA;EACA;IACE;IACA;IACA;;;qBAoCS;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,SAAQ;cAsBR;MA6DR;MA4BA,oBAAoB,KAAK;EAkB7B,WAAW,iBAAiB;EAY5B,eAAe;EAmBf,yBAAyB;EAezB,gBAAgB;MAaZ,MAAM;MAON,gBAAgB;MAOhB,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,mBAAmB;MAYf,UAAU;EAOd,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,qBAAqB;MAYjB,YAAY;EAOhB,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,wBAAwB;MAYpB,eAAe;EAOnB,2BAA2B;MAYvB,kBAAkB;EAOtB,gBAAgB;MAYZ,OAAO;EAOX,uBAAuB;MAYnB,cAAc;EAWlB,gBAAgB;MAYZ,OAAO;EAaX,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,2BAA2B;MAYvB,kBAAkB;EAOtB,oCAAoC;MAYhC,2BAA2B;EAO/B,qBAAqB;MAYjB,YAAY;EAOhB,wBAAwB;MAYpB,eAAe;EAOnB;;wBAwCc,cAAc,SAAS,kBAAkB;wBAkCzC,cAAc,SAAS;wBAOvB;;;UC5tBC;EACf;EACA;IACE;IACA;IACA;;EAEF;EAaA;;wBAgEoB,oBACpB,oBACA,OAAM,6BACL;wBA2Ea;;;UChLC;EAEf;EAGA,YAAY,eAAe;EAG3B,UAAU;EAGV,UAAU;;UAMK;EAEf,MAAM;EAGN;EAMA;EAGA,aAAa;EAGb;EAGA,WAAW,eAAe;EAQ1B;;KAMU;UA+CK;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA;GAGC;;UAMc;EACf;EACA;EACA;;UAMe;EACf,YAAY;;;;KCjHF;UAKK;EACf,OAAO;EAGP;EAEA;;;;UC9Be;EAgCf;EAcA;;;;UCpCe;EAEf;EAOA;EAGA;EAGA,UAAU;EAGV;EAwBA;EAGA;EAGA;EAGA;EAeA;EAiBA,kBAAkB;EAYlB,WAAW;;UASI;EAEf,QAAQ;EAMR,cAAc;;qBAwDH;UACH;EAKR,aAAa,sBAAsB;EA2BnC,aACE,qBACA,UAAU,kBACV,uBACC;EAYH,aACE,qBACA,UAAU,kBAOV,uBACC;UASK;EAkIR,SAAS,qBAAqB,UAAU,kBAAkB,oBAAoB;EAmC9E,YACE,qBACA,UAAU,kBACV,oBACC;UAOK;UAkCA;EA6KR,UAAU,WAAW;;;;UCzlBN;EACf;EACA;IACE;IACA;IACA;;;;;UCQa;EACf;EASA;EACA,YAAY;EACZ,eAAe;EASf;;;;UCJe;EAEf;EAGA;EAGA;EAGA;EAGA,UAAU;EAaV;EAQA,0BAA0B;EAe1B;;UAMe;EAEf,UAAU;EAGV;EAGA,QAAQ;EAaR,cAAc;;qBAWH;UACH;UACA;UACA;UACA;EAYF,WAAW,SAAS,mBAAmB,QAAQ;EA2J/C,WAAW,SAAS,mBAAmB;EA0BvC,sBACJ,QAAQ,aACR,SAAS,kBACT;IAAa;IAA4B;MACxC;;;;KC7UO;KAGA;KAcA;KAsEA;UAmBK;EAEf;EAEA;EAKA;EAEA;;UAQe;EAEf;EACA,WAAW;EAMX;EAEA,UAAU;EAEV;EAEA;EAEA,SAAS;EAET,YAAY;EAEZ;EAEA;EAoBA;EAEA;EAEA;EAEA;IACE;IACA;IACA;IACA;IAqBA;;EAUF;EAyBA;EAEA,QAAQ;;UAQO;EACf,OAAO,OAAO,KAAK;WAOV;;;;qBCwYE,gCAAgC;UACnC;UACA;UACA;mBAMS;mBAGA;mBAEA;mBAEA;mBAqBA;mBAOA;EAEjB;EAQM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;UAuHG;EA+IR,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAsKL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UA8VJ;UA2EA;UAiIA;UA8LA;EA+GR,iBACJ,sBACA,qBACC,QAAQ;UAiDG;UAoRA;UAgHA;UA+CN;UAyCM;UA2CA;UAi0BA;UAiCN;UAsBM;UA+BN;UAwCA;SAUD,wBAAwB;EA6EzB,iBACJ,oBACA,oBACA,sBACA,cAAc,0BACb,QAAQ;EAwJL,OAAO,OAAO,sBAAsB,QAAQ;UAoIpC;;;;KCr0HJ;UAWK;EACf,UAAU;EACV,eAAe;EACf;IAAkB;;EAiBlB;;UAUe;EACf;EACA,aAAa;EACb,gBAAgB;EAehB,qBAAqB;EAYrB;;UAQe;EACf;EACA;EACA;;qBAsNW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;EAER;EAYA,sBAAsB,eAAe;EAiBrC,2BAA2B,SAAS;EA2BpC,mCAAmC;EAQnC,gCAAgC;EAUhC,iBAAiB;EAWjB,SAAS,sBAAsB,UAAU;EAQzC,WAAW;EAeX,eAAe,OAAO,sBAAsB;UA2HpC;EAmCR,YAAY,uBAAuB;EAOnC,mBAAmB;EAOnB,YAAY;EAmBZ,2BAA2B;EAO3B;EASA,gBAAgB;EAuBhB,sBAAsB,eAAe;EA+DrC,2BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EA4BJ,oCACE,WAAW;IACT;IACA;IACA,YAAY;;EA8BhB,iCACE,WAAW;IACT;IACA;IACA,YAAY;;EAwChB,0BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;UAoOI;EAkDR,kBACE,WAAW;IACT;IACA;IACA,YAAY;OAEb;;;;UCjrBY;EACf,KAAK;EACL,UAAU;EACV,aAAa;;;;UC2ME;EAEf;EAEA;EAEA;EAQA;EAEA,gBAAgB;EAEhB;EAEA,aAAa;EAyCb;EAkBA;;UAWe;EAEf;EAEA;EAEA;EAEA;EAEA,gBAAgB;EAEhB;EAOA,sBAAsB;;;;KCntBZ;UAkBK;EAMf;EAEA;EACA,QAAQ;EAMR;EAEA;EAEA;EAEA,YAAY;EAQZ,mBAAmB;;UAIJ;EACf;EACA;EACA;EACA,UAAU;;;;UCMK;EAOf;IAAkB;;EAQlB;EASA;IAAW,OAAO;IAAoB,SAAS;;EAqB/C;;;;UC7Fe;EACf;EAEA;;UAwBe;EACf;EACA;EACA;IACE;IACA;IACA;;;UAOa;EAgBf;;qBAkEW;UACH;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,aAAY;EAyBxE;MAII;UAOI;UAQA;UAWA;UAmBM;UAiDA;EAIR,mBAAmB,UAAS,4BAAiC;EAgD7D,YAAY,mBAAmB,iBAAiB;EA+BhD,SACJ,mBACA,iBACC;IACD,OAAO;IACP;IACA;IAaA;;EAkHI,UACJ,mBACA,gBACA,OAAO,YACP;IAAW;IAAuB;MACjC;EA0FG,YAAY,mBAAmB,iBAAiB;EA0GhD,kBAAkB,oBAAoB;EAiDtC,cAAc,QAAQ;EAsFtB,aAAa,aAAa,cAAc,uBAAmC;EAkB3E,aAAa,cAAc;EAwB3B,YAAY,oBAAoB;EAwChC,eACJ,oBACC,QAAQ;IAAQ;IAAa,cAAc;IAAM;;EA8D9C,iBAAiB,iBAAiB;EAiDlC,wBACJ,gBACA,UAAS,KAAK,6DACb;EAkCG,oBAAoB,mBAAmB,iBAAiB,QAAQ;EAYhE,6BACJ,mBACA,gBACA,SAAS,yBACR;EA2BG,mCACJ,mBACA,gBACA,WAAW,oBACV;EAiBG,0BAA0B,mBAAmB,iBAAiB;EAmD9D,sBAAsB,mBAAmB,iBAAiB;UAqClD;UA2BN;UA8DA;UA+DM;UA4EA;UAwBA;UAQA;UA6FN;;;;UC9gDO;EAEf;EAEA;;UAYe;EAEf,SAAS;EAET,OAAO;EAEP,SAAS;EAET;EACA;EACA;;;;KC7DU;KAKA;UAKK;EACf;EACA,MAAM;EACN,cAAc;EACd,OAAO;EAEP;;UAMe;EACf;EACA;EACA;;cAoBW;UACH;UACA;EAER,QAAQ,MAAM;EAOR,QACJ,aAAa,sBACb,KAAK,MAAM,aAAa,gBACvB;EAqGH,WAAW,OAAO;;;;UCpGH;EAEf;EAGA;EAGA;EAGA;EAGA;EASA,WAAW;;qBAUA;UACH;UACA;UACA;EAMR,iBACE,OAAO,WACP,sBACA;IACE;IACA;IACA;IACA;IACA,WAAW;IAMX;;EA4IE,YAAY,MAAM,WAAW;EA6B7B,oBACJ,sBACA,UAAS,wBACR;EAwDH,UAAU;;;;UClUK;EAEf;EASA;;qBA0IW;UACH;UACA;UACA;mBACS;mBACA;mBACA;mBAEA;UACT;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,UAAU;UA2CxD;UAIA;UA4CN;UAUA;UAcA;UAeA;EAmBF,YACJ,mBACA,gBACA,gBACA,qBACC;UAkLW;EA2BR,YAAY,mBAAmB,6BAA6B,QAAQ;UAa5D;EA6GR,SAAS,mBAAmB,6BAA6B;EAkCzD,YAAY,mBAAmB,iBAAiB;UAuBxC;UAwJA;UA2BN;EAgBF,iBAAiB,mBAAmB,6BAA6B;UA2EzD;UA6FA;UAgDN;UAiDA;UASA;UAiBA;UAWM;UA4GA;UA6BN;UAgBA;UAkBA;UAiBA;EAiBF,qBACJ,mBACA,gBACA,gBACA,oBACA,qBACA,sBACC;;;;qBCh5CQ;UACH;EAKR,eAAe,UAAU;EAOzB,YAAY,UAAU,wBAAwB,oBAAoB;EAmBlE,oBAAoB,UAAU,mBAAmB;EAwCjD,kBAAkB,iBAAiB;UAS3B;EA6JR,YAAY,UAAU,kBAAkB;EA8BxC,YAAY,UAAU,kBAAkB;EA8BxC,iBAAiB,oBAAoB,YAAY;EA6CjD,mBACE,UAAU,wBACV,uBACC,YAAY;EAef,eAAe,UAAU;EAoCzB,2BACE,UAAU,wBACV,YAAY,0BACX;;;;KChZA,YAAY,SAAS;UAQT;EAMf;;qBASW;UACH;UACA;UACA;EAER,YAAY,UAAS;EAWrB,WAAW,UAAU,yBAAyB;EAkJ9C,mBAAmB,OAAO;UAuDlB;EA6CR,mBAAmB,OAAO,WAAW,oBAAoB;EAoBzD,iBAAiB,OAAO,WAAW,oBAAoB;EAoBvD,sBAAsB,OAAO,WAAW;EAOxC,oBAAoB,OAAO,WAAW;EAOtC,UAAU,OAAO,WAAW,mBAAmB;UAWvC;UA4DA;UA2BA;UASA;UAwBA;UAwBA;;;;KC9dE,sBAAsB,mBAAmB;KA8CzC,4BACV,sBACA,YAAY,4BACT;qBAiCQ;UACH;UACA;UACA;EA6BF,cACJ,cAAc,YACd,iBAAiB,wBACjB,YAAY,oBACZ,yBAAyB,0BACzB,+BAA+B,sBAC9B,QAAQ,YAAY;UAgYf;UAoJA;iBAkGO;UAsED;UA2CN;UA4BM;0BAqFU;iBAOT;UA0CP;EA2ER,WAAW,SAAS,YAAY;IAC9B;IACA;IACA;IACA;IACA;;EAiCF,aAAa,SAAS,YAAY,iBAAiB,MAAM,aAAa;EAOtE,WAAW,SAAS,YAAY;EAOhC,sBAAsB,SAAS,YAAY,kBAAkB;;;;qBC7mClD,2BAA2B;UAC9B;UACA;EACR,mBAAiB,YAAA;EAiBjB;EASM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;EA6JL,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,0BACnB,QAAQ;EAsNL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UAmDJ;UAiDA;UA6CA;UAmDA;UAsCA;UAuCA;EAuDR,aACJ,oBACA,uBACA,wBACC;EA0DG,iBACJ,oBACA,oBACA,uBACA,aAAa,yBACb,UADa,0BAEZ,QAAQ;EA0KL,OAAO,OAAO,sBAAsB,QAAQ;;;;UC11BnC;EAEf;EAEA;EAGA;;UAUe;EAEf;EAEA;EAEA;;cASW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UAcA;UAEA;UACA;EAER,YACE,UAAU,UACV,gBACA,gBACA,gBACA,cAAc,gBACd,OAAM;UAWA;UAiCM;UAIA;EAuCR,OAAO,qBAAqB,QAAQ;EAuBpC,eACJ,mBACA,wBACA,SAAS,0BACR;EAiDG,wBAAwB,QAAQ,oBAAoB;EA2BpD,WACJ,oBACA,OAAO,kBACP;IAWE;MAAiB;MAAuB;;MAEzC;EAYG,YAAY,mBAAmB,yBAAyB;UAUhD;EAgBR,WAAW;UAcH;UAmBA;UA8BA;UAwBA;UAkBA;UAyBA;UA8EA;UA0CN;UAsBM;UAgCA;UAkBA;UAqBA;UAkCN;UAMA;;;;UCvlBO;EAEf;EAEA;EAEA;EAEA,aAAa;EAEb;EAOA;EAWA;EASA;EAOA,0BAA0B;EAM1B,wBAAwB;EAaxB;EAaA,gBAAgB;EAgBhB;IACE;IACA;IACA;;EAqEF,mBAAmB;EA2BnB,wBAAwB,mBAAmB,OAAO,2BAA2B;EAgE7E;IAEE;IACA,YAAY;;EAEd;IAEE;IAEA,UAAU;IAEV,gBAAgB;;EAoBlB,gBAAgB;EAkBhB;EAyBA;EAWA;EAWA;EAaA;EAYA,uBAAuB;;UAkER;EAEf;EAEA;EAEA;EAEA;EAwBA;EAQA;EAEA;EAEA;EAMA,UAAU;EAcV;;qBAiSW;UACH;UACA;UACA;UAOA;UAaA;UAEA;UACA;UACA;UACA;UACA;UACA;UACA;UAUA;UAMA;UAQA;UAiBA;UAuBA;UAWA;UAeA;UAOA;UAUA;UAkBA;UAcA;UAYA;UAQA;UASA;UAkCA;UAcA;UAUA;UAaA;UAUA;EAER,YACE,cAAc,gBACd,aAAa,aACb,YAAY,YACZ,gBAAgB,gBAChB,kBAAkB,kBAClB,SAAS,iCACT,qBACA,mBAAmB;EA+Bf,OAAO,mBAAmB,UAAU,yBAAyB,QAAQ;UAkEnE;UAuJA;UA2EA;UAiDA;UAiBA;UAyGA;iBA6GO;UA6PP;UAuFA;UA4EA;UA8BA;UAYM;UAmEN;UAsBA;UAUA;UA0IA;UAiDA;UAmCA;UAwBA;UA2BA;UAkCM;UAwGA;UA0GN;UAiDA;UA2IM;UAghCA;UAqpBA;UA8FA;UAuDA;UAgCA;UA+BA;UA4CN;UAoCM;UA4CA;UAoVN;UAwBA;UAWA;UAkDA;UAmBA;UAwBA;UAyCM;UA0CA;UAgMA;UAiqEN;UA+CA;UA4DA;UA6FA;UA0IA;UAgCA;UAOA;UAoCA;UAgFA;UA4BM;UA6BN;UAiCA;UAmBA;UAgEA;UAiEM;UAkeN"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/deployment/secret-redaction.ts","../src/provisioning/region-check.ts","../src/types/resource.ts","../src/types/config.ts","../src/utils/logger.ts","../src/utils/error-handler.ts","../src/utils/aws-clients.ts","../src/utils/aws-region-resolver.ts","../src/types/assembly.ts","../src/synthesis/stack-messages.ts","../src/synthesis/failed-stages.ts","../src/synthesis/assembly-reader.ts","../src/cli/upload-cfn-template.ts","../src/synthesis/macro-expander.ts","../src/synthesis/synthesizer.ts","../src/types/deployment-events.ts","../src/provisioning/cloud-control-provider.ts","../src/provisioning/provider-registry.ts","../src/provisioning/final-snapshot.ts","../src/deployment/rollback-executor.ts","../src/types/rollback-journal.ts","../src/state/s3-noncurrent-version-purge.ts","../src/state/s3-state-backend.ts","../src/assets/asset-redirect.ts","../src/deployment/work-graph.ts","../src/assets/asset-publisher.ts","../src/state/lock-manager.ts","../src/analyzer/template-parser.ts","../src/analyzer/dag-builder.ts","../src/analyzer/diff-calculator.ts","../src/provisioning/providers/iam-role-provider.ts","../src/state/export-index-store.ts","../src/deployment/deploy-engine.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KAiJY;UAyBK;EAEf;EAMA;EAYA;;UAsBe;EAUf;EAMA;EAQA;;UAMe;EAKf,SAAS;EAGT;EAMA;EAGA,WAAW,eAAe;EAG1B,SAAS;EAUT,UAAU;EAoBV,cAAc;EAqBd;EA0EA,iBAAiB;EAgBjB;EAcA;EAYA;EAwCA,UAAU;EAGV;;UASe;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA,YAAY;EAcZ,qBAAqB;EAGrB,aAAa;EAGb;EAGA,WAAW;EAmBX;EAMA;EA0CA;EA6DA;EAiEA;;UA0Ce;EAEf;EAGA;EAGA;EAGA;;KAMU;UAKK;EAEf;EAGA,YAAY;EAGZ;EAGA,oBAAoB;EAGpB,oBAAoB;EAGpB,kBAAkB;EAWlB,mBAAmB;;UAUJ;EAEf;EACA;EACA;;UA+Te;EAEf;EAGA;EAGA;EAGA;EAYA;;;;KC3lCU,uBAAuB;KA6zOvB,gBAAgB;;;UCh2OX;EASf;EAyCA;EAwBA;EA0BA;;;;UClHe;EACf;EACA;EACA,aAAa,eAAe;EAC5B,WAAW,eAAe;EAC1B,UAAU,eAAe;EACzB,aAAa;EACb,WAAW;EAWX;EACA,QAAQ;;UAMO;EACf;EACA;EACA;EACA;EACA;EACA;EAMA;;UAMe;EACf;EACA,aAAa;EACb;EACA;EACA,WAAW;EACX,iBAAiB;EACjB,eAAe;EACf;EACA;;UAMe;EACf;EACA;EAOA;EACA;IACE;;;UAgCa;EAYf,sBAAsB;;UA8CP;EAKf;EAWA;;UAMe,6BAA6B,2BAA2B;EAEvE;EAEA,aAAa;;UAOL,iCAAiC,2BAA2B;EAEpE;EAEA;EAEA,aAAa;;KAwCH;WAGG;WAMA;;WAOA;WAaA;;KAOH,uBAAuB,2BAA2B;UAuB7C;WAQN;WAQA;;KA0DC;WAGG;WAKA,+BAA+B;;WAY/B,+BAA+B;WAU/B;WAaA;;UAcE;EAEf;EAGA;EAGA;EAGA;EAGA,YAAY;EASZ;;UAUe;EAEf;EAEA,aAAa;;UAiEE;EA2Df,cAAc;;UAmDC,sBAAsB;EAmBrC;EAmCA;EAgCA;;UAkBe,sBAAsB;EA0DrC;;UAqCe;EAWf,WAAW;IAGP;IACA;IACA,YAAY;IACZ,aAAa;;;UAQF;EAWf,oBAAoB,oBAAoB;EAwBxC,oBAAoB,oBAAoB;EAUxC;EAkBA;EAkBA;EAkBA,8BACE,mBACA,sBACA,YAAY,0BACX;EAmBH,OACE,mBACA,sBACA,YAAY,yBACZ,UAAU,gBACT,QAAQ;EAgBX,OACE,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAqBX,OACE,mBACA,oBACA,sBACA,aAAa,yBACb,UAAU,gBACT,eAAe;EASlB,cAAc,oBAAoB,sBAAsB,wBAAwB;EAwChF,kBACE,oBACA,mBACA,sBACA,aAAa,yBACb,UAAU,0BACT,QAAQ;EAgCX,sBAAsB,sBAAsB,aAAa;EAiCzD,+BACE,sBACA,YAAY,0BACX;EAiDH,wBAAwB;EAuDxB,6BACE,sBACA,YAAY,0BACX;EA4BH,QAAQ,OAAO,sBAAsB,QAAQ;;;;UCnxC9B;EAEf;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;;UAMe;EAEf;EAGA;EAGA,cAAc;EAGd;EAGA;EAGA;;UAMe;EAEf;EAGA;;KAMU;UAKK;EACf,MAAM,oBAAoB;EAC1B,KAAK,oBAAoB;EACzB,KAAK,oBAAoB;EACzB,MAAM,oBAAoB;;;;qBCmEf,yBAAyB;UAC5B;UACA;EAER,YAAY,QAAO,UAAmB;UAK9B;UAOA;UAsFA;EAeR,MAAM,oBAAoB;EAM1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;EAS1B,SAAS,OAAO;EAIhB,YAAY;EASZ,MAAM,iBAAiB;;cAQnB,oBAAoB;mBACP;EAEjB,YAAY,gBAAgB;UAKpB;EAMC,MAAM,oBAAoB;EAK1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;;wBAerB,aAAa;wBAUb,UAAU,QAAQ;;;qBCzWrB,kBAAkB;WACb;WACA,OAAO;EAEvB,YAAY,iBAAiB,cAAc,QAAQ;;qBAYxC,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;qBAU1B,kBAAkB;EAC7B,YAAY,iBAAiB,QAAQ;;qBAU1B,uBAAuB;EAClC,YAAY,iBAAiB,QAAQ;;qBA6B1B,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;qBA6B1B,0BAA0B;WACrB;WACA;WACA;EAEhB,YACE,iBACA,sBACA,mBACA,qBACA,QAAQ;;qBAgTC,wBAAwB;EACnC,YAAY,iBAAiB,QAAQ;;qBAU1B,oBAAoB;EAC/B,YAAY,iBAAiB,QAAQ;;wBA0avB,YAAY,iBAAiB,SAAS;wBAOtC,YAAY;UAkIX;EACf;EACA;;wBA2Bc,kBAAkB,cAAc,UAAS,2BAAgC;;;UCp+BxE;EACf;EACA;EACA;IACE;IACA;IACA;;;qBAoCS;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,SAAQ;cAsBR;MA6DR;MA4BA,oBAAoB,KAAK;EAkB7B,WAAW,iBAAiB;EAY5B,eAAe;EAmBf,yBAAyB;EAezB,gBAAgB;MAaZ,MAAM;MAON,gBAAgB;MAOhB,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,mBAAmB;MAYf,UAAU;EAOd,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,qBAAqB;MAYjB,YAAY;EAOhB,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,wBAAwB;MAYpB,eAAe;EAOnB,2BAA2B;MAYvB,kBAAkB;EAOtB,gBAAgB;MAYZ,OAAO;EAOX,uBAAuB;MAYnB,cAAc;EAWlB,gBAAgB;MAYZ,OAAO;EAaX,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,2BAA2B;MAYvB,kBAAkB;EAOtB,oCAAoC;MAYhC,2BAA2B;EAO/B,qBAAqB;MAYjB,YAAY;EAOhB,wBAAwB;MAYpB,eAAe;EAOnB;;wBAwCc,cAAc,SAAS,kBAAkB;wBAkCzC,cAAc,SAAS;wBAOvB;;;UC5tBC;EACf;EACA;IACE;IACA;IACA;;EAEF;EAaA;;wBAgEoB,oBACpB,oBACA,OAAM,6BACL;wBA2Ea;;;UChLC;EAEf;EAGA,YAAY,eAAe;EAG3B,UAAU;EAGV,UAAU;;UAMK;EAEf,MAAM;EAGN;EAMA;EAGA,aAAa;EAGb;EAGA,WAAW,eAAe;EAQ1B;;KAMU;UA+CK;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA;GAGC;;UAMc;EACf;EACA;EACA;;UAMe;EACf,YAAY;;;;KCjHF;UAKK;EACf,OAAO;EAGP;EAEA;;;;UC9Be;EAgCf;EAcA;;;;UCpCe;EAEf;EAOA;EAGA;EAGA,UAAU;EAGV;EAwBA;EAGA;EAGA;EAGA;EAeA;EAiBA,kBAAkB;EAYlB,WAAW;;UASI;EAEf,QAAQ;EAMR,cAAc;;qBAwDH;UACH;EAKR,aAAa,sBAAsB;EA2BnC,aACE,qBACA,UAAU,kBACV,uBACC;EAYH,aACE,qBACA,UAAU,kBAOV,uBACC;UASK;EAkIR,SAAS,qBAAqB,UAAU,kBAAkB,oBAAoB;EAmC9E,YACE,qBACA,UAAU,kBACV,oBACC;UAOK;UAkCA;EA6KR,UAAU,WAAW;;;;UCzlBN;EACf;EACA;IACE;IACA;IACA;;;;;UCQa;EACf;EASA;EACA,YAAY;EACZ,eAAe;EASf;;;;UCJe;EAEf;EAGA;EAGA;EAGA;EAGA,UAAU;EAaV;EAQA,0BAA0B;EAe1B;;UAMe;EAEf,UAAU;EAGV;EAGA,QAAQ;EAaR,cAAc;;qBAWH;UACH;UACA;UACA;UACA;EAYF,WAAW,SAAS,mBAAmB,QAAQ;EA2J/C,WAAW,SAAS,mBAAmB;EA0BvC,sBACJ,QAAQ,aACR,SAAS,kBACT;IAAa;IAA4B;MACxC;;;;KC7UO;KAGA;KAcA;KAsEA;UAmBK;EAEf;EAEA;EAKA;EAEA;;UAQe;EAEf;EACA,WAAW;EAMX;EAEA,UAAU;EAEV;EAEA;EAEA,SAAS;EAET,YAAY;EAEZ;EAEA;EAoBA;EAEA;EAEA;EAEA;IACE;IACA;IACA;IACA;IAqBA;;EAUF;EAyBA;EAEA,QAAQ;;UAQO;EACf,OAAO,OAAO,KAAK;WAOV;;;;qBCwYE,gCAAgC;UACnC;UACA;UACA;mBAMS;mBAGA;mBAEA;mBAEA;mBAqBA;mBAOA;EAEjB;EAQM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;UAuHG;EA+IR,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAsKL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UA8VJ;UA2EA;UAiIA;UA8LA;EA+GR,iBACJ,sBACA,qBACC,QAAQ;UAiDG;UAoRA;UAgHA;UA+CN;UAyCM;UA2CA;UAi0BA;UAiCN;UAsBM;UA+BN;UAwCA;SAUD,wBAAwB;EA6EzB,iBACJ,oBACA,oBACA,sBACA,cAAc,0BACb,QAAQ;EAwJL,OAAO,OAAO,sBAAsB,QAAQ;UAoIpC;;;;KCr0HJ;UAWK;EACf,UAAU;EACV,eAAe;EACf;IAAkB;;EAiBlB;;UAUe;EACf;EACA,aAAa;EACb,gBAAgB;EAehB,qBAAqB;EAYrB;;UAQe;EACf;EACA;EACA;;qBAsNW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;EAER;EAYA,sBAAsB,eAAe;EAiBrC,2BAA2B,SAAS;EA2BpC,mCAAmC;EAQnC,gCAAgC;EAUhC,iBAAiB;EAWjB,SAAS,sBAAsB,UAAU;EAQzC,WAAW;EAeX,eAAe,OAAO,sBAAsB;UA2HpC;EAmCR,YAAY,uBAAuB;EAOnC,mBAAmB;EAOnB,YAAY;EAmBZ,2BAA2B;EAO3B;EASA,gBAAgB;EAuBhB,sBAAsB,eAAe;EA+DrC,2BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EA4BJ,oCACE,WAAW;IACT;IACA;IACA,YAAY;;EA8BhB,iCACE,WAAW;IACT;IACA;IACA,YAAY;;EAwChB,0BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;UAoOI;EAkDR,kBACE,WAAW;IACT;IACA;IACA,YAAY;OAEb;;;;UCjrBY;EACf,KAAK;EACL,UAAU;EACV,aAAa;;;;UC2ME;EAEf;EAEA;EAEA;EAQA;EAEA,gBAAgB;EAEhB;EAEA,aAAa;EAyCb;EAkBA;;UAWe;EAEf;EAEA;EAEA;EAEA;EAEA,gBAAgB;EAEhB;EAOA,sBAAsB;;;;KCntBZ;UAkBK;EAMf;EAEA;EACA,QAAQ;EAMR;EAEA;EAEA;EAEA,YAAY;EAQZ,mBAAmB;;UAIJ;EACf;EACA;EACA;EACA,UAAU;;;;UCMK;EAOf;IAAkB;;EAQlB;EASA;IAAW,OAAO;IAAoB,SAAS;;EAqB/C;;;;UC7Fe;EACf;EAEA;;UAwBe;EACf;EACA;EACA;IACE;IACA;IACA;;;UAOa;EAgBf;;qBAkEW;UACH;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,aAAY;EAyBxE;MAII;UAOI;UAQA;UAWA;UAmBM;UAiDA;EAIR,mBAAmB,UAAS,4BAAiC;EAgD7D,YAAY,mBAAmB,iBAAiB;EA+BhD,SACJ,mBACA,iBACC;IACD,OAAO;IACP;IACA;IAaA;;EAkHI,UACJ,mBACA,gBACA,OAAO,YACP;IAAW;IAAuB;MACjC;EA0FG,YAAY,mBAAmB,iBAAiB;EA0GhD,kBAAkB,oBAAoB;EAiDtC,cAAc,QAAQ;EAsFtB,aAAa,aAAa,cAAc,uBAAmC;EAkB3E,aAAa,cAAc;EAwB3B,YAAY,oBAAoB;EAwChC,eACJ,oBACC,QAAQ;IAAQ;IAAa,cAAc;IAAM;;EA8D9C,iBAAiB,iBAAiB;EAiDlC,wBACJ,gBACA,UAAS,KAAK,6DACb;EAkCG,oBAAoB,mBAAmB,iBAAiB,QAAQ;EAYhE,6BACJ,mBACA,gBACA,SAAS,yBACR;EA2BG,mCACJ,mBACA,gBACA,WAAW,oBACV;EAiBG,0BAA0B,mBAAmB,iBAAiB;EAmD9D,sBAAsB,mBAAmB,iBAAiB;UAqClD;UA2BN;UA8DA;UA+DM;UA4EA;UAwBA;UAQA;UA6FN;;;;UC9gDO;EAEf;EAEA;;UAYe;EAEf,SAAS;EAET,OAAO;EAEP,SAAS;EAET;EACA;EACA;;;;KC7DU;KAKA;UAKK;EACf;EACA,MAAM;EACN,cAAc;EACd,OAAO;EAEP;;UAMe;EACf;EACA;EACA;;cAoBW;UACH;UACA;EAER,QAAQ,MAAM;EAOR,QACJ,aAAa,sBACb,KAAK,MAAM,aAAa,gBACvB;EAqGH,WAAW,OAAO;;;;UCpGH;EAEf;EAGA;EAGA;EAGA;EAGA;EASA,WAAW;;qBAUA;UACH;UACA;UACA;EAMR,iBACE,OAAO,WACP,sBACA;IACE;IACA;IACA;IACA;IACA,WAAW;IAMX;;EA4IE,YAAY,MAAM,WAAW;EA6B7B,oBACJ,sBACA,UAAS,wBACR;EAwDH,UAAU;;;;UClUK;EAEf;EASA;;qBA0IW;UACH;UACA;UACA;mBACS;mBACA;mBACA;mBAEA;UACT;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,UAAU;UA2CxD;UAIA;UA4CN;UAUA;UAcA;UAeA;EAmBF,YACJ,mBACA,gBACA,gBACA,qBACC;UAkLW;EA2BR,YAAY,mBAAmB,6BAA6B,QAAQ;UAa5D;EA6GR,SAAS,mBAAmB,6BAA6B;EAkCzD,YAAY,mBAAmB,iBAAiB;UAuBxC;UAwJA;UA2BN;EAgBF,iBAAiB,mBAAmB,6BAA6B;UA2EzD;UA6FA;UAgDN;UAiDA;UASA;UAiBA;UAWM;UA4GA;UA6BN;UAgBA;UAkBA;UAiBA;EAiBF,qBACJ,mBACA,gBACA,gBACA,oBACA,qBACA,sBACC;;;;qBCh5CQ;UACH;EAKR,eAAe,UAAU;EAOzB,YAAY,UAAU,wBAAwB,oBAAoB;EAmBlE,oBAAoB,UAAU,mBAAmB;EAwCjD,kBAAkB,iBAAiB;UAS3B;EA6JR,YAAY,UAAU,kBAAkB;EA8BxC,YAAY,UAAU,kBAAkB;EA8BxC,iBAAiB,oBAAoB,YAAY;EA6CjD,mBACE,UAAU,wBACV,uBACC,YAAY;EAef,eAAe,UAAU;EAoCzB,2BACE,UAAU,wBACV,YAAY,0BACX;;;;KChZA,YAAY,SAAS;UAQT;EAMf;;qBASW;UACH;UACA;UACA;EAER,YAAY,UAAS;EAWrB,WAAW,UAAU,yBAAyB;EAkJ9C,mBAAmB,OAAO;UAuDlB;EA6CR,mBAAmB,OAAO,WAAW,oBAAoB;EAoBzD,iBAAiB,OAAO,WAAW,oBAAoB;EAoBvD,sBAAsB,OAAO,WAAW;EAOxC,oBAAoB,OAAO,WAAW;EAOtC,UAAU,OAAO,WAAW,mBAAmB;UAWvC;UA4DA;UA2BA;UASA;UAwBA;UAwBA;;;;KC9dE,sBAAsB,mBAAmB;KA8CzC,4BACV,sBACA,YAAY,4BACT;qBAiCQ;UACH;UACA;UACA;EA6BF,cACJ,cAAc,YACd,iBAAiB,wBACjB,YAAY,oBACZ,yBAAyB,0BACzB,+BAA+B,sBAC9B,QAAQ,YAAY;UAgYf;UAoJA;iBAkGO;UAsED;UA2CN;UA4BM;0BAqFU;iBAOT;UA0CP;EA2ER,WAAW,SAAS,YAAY;IAC9B;IACA;IACA;IACA;IACA;;EAiCF,aAAa,SAAS,YAAY,iBAAiB,MAAM,aAAa;EAOtE,WAAW,SAAS,YAAY;EAOhC,sBAAsB,SAAS,YAAY,kBAAkB;;;;qBC7mClD,2BAA2B;UAC9B;UACA;EACR,mBAAiB,YAAA;EAiBjB;EASM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;EA6JL,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,0BACnB,QAAQ;EAsNL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UAmDJ;UAiDA;UA6CA;UAmDA;UAsCA;UAuCA;EAuDR,aACJ,oBACA,uBACA,wBACC;EA0DG,iBACJ,oBACA,oBACA,uBACA,aAAa,yBACb,UADa,0BAEZ,QAAQ;EA0KL,OAAO,OAAO,sBAAsB,QAAQ;;;;UC11BnC;EAEf;EAEA;EAGA;;UAUe;EAEf;EAEA;EAEA;;cASW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UAcA;UAEA;UACA;EAER,YACE,UAAU,UACV,gBACA,gBACA,gBACA,cAAc,gBACd,OAAM;UAWA;UAiCM;UAIA;EAuCR,OAAO,qBAAqB,QAAQ;EAuBpC,eACJ,mBACA,wBACA,SAAS,0BACR;EAiDG,wBAAwB,QAAQ,oBAAoB;EA2BpD,WACJ,oBACA,OAAO,kBACP;IAWE;MAAiB;MAAuB;;MAEzC;EAYG,YAAY,mBAAmB,yBAAyB;UAUhD;EAgBR,WAAW;UAcH;UAmBA;UA8BA;UAwBA;UAkBA;UAyBA;UA8EA;UA0CN;UAsBM;UAgCA;UAkBA;UAqBA;UAkCN;UAMA;;;;UCvlBO;EAEf;EAEA;EAEA;EAEA,aAAa;EAEb;EAOA;EAWA;EASA;EAOA,0BAA0B;EAM1B,wBAAwB;EAaxB;EAaA,gBAAgB;EAgBhB;IACE;IACA;IACA;;EAqEF,mBAAmB;EA2BnB,wBAAwB,mBAAmB,OAAO,2BAA2B;EAgE7E;IAEE;IACA,YAAY;;EAEd;IAEE;IAEA,UAAU;IAEV,gBAAgB;;EAoBlB,gBAAgB;EAkBhB;EAyBA;EAWA;EAWA;EAaA;EAYA,uBAAuB;;UAkER;EAEf;EAEA;EAEA;EAEA;EAwBA;EAQA;EAEA;EAEA;EAMA,UAAU;EAcV;;qBAiSW;UACH;UACA;UACA;UAOA;UAaA;UAEA;UACA;UACA;UACA;UACA;UACA;UACA;UAUA;UAMA;UAQA;UAiBA;UAuBA;UAWA;UAeA;UAOA;UAUA;UAkBA;UAcA;UAYA;UAQA;UASA;UAkCA;UAcA;UAUA;UAaA;UAUA;EAER,YACE,cAAc,gBACd,aAAa,aACb,YAAY,YACZ,gBAAgB,gBAChB,kBAAkB,kBAClB,SAAS,iCACT,qBACA,mBAAmB;EA+Bf,OAAO,mBAAmB,UAAU,yBAAyB,QAAQ;UAkEnE;UAuJA;UA2EA;UAiDA;UAiBA;UAyGA;iBA6GO;UA6PP;UAuFA;UA4EA;UA8BA;UAYM;UAmEN;UAsBA;UAUA;UA0IA;UAiDA;UAmCA;UAwBA;UA2BA;UAkCM;UAwGA;UA0GN;UAiDA;UA2IM;UAghCA;UAqpBA;UA8FA;UAuDA;UAgCA;UA+BA;UA4CN;UAoCM;UA4CA;UAoVN;UAwBA;UAWA;UAkDA;UAmBA;UAwBA;UAyCM;UA0CA;UAgMA;UAiqEN;UA+CA;UA4DA;UA6FA;UA0IA;UAgCA;UAOA;UAoCA;UAgFA;UA4BM;UA6BN;UAiCA;UAmBA;UAgEA;UAiEM;UAkeN"}

package/dist/index.js

@@ -1,4 +1,4 @@
-import { Aa as DependencyError, Ba as ProvisioningError, Ca as resetAwsClients, Da as CdkdError, Dr as S3StateBackend, Ea as AssetError, Er as LockManager, Ga as StateError, Ia as LockError, Ja as isCdkdError, Ka as SynthesisError, Kr as AssetPublisher, Mi as Synthesizer, Oa as ConfigError, Sa as getAwsClients, Ta as setAwsClients, Ya as normalizeAwsError, ba as resolveBucketRegion, cr as TemplateParser, ct as IAMRoleProvider, dt as ProviderRegistry, mn as DiffCalculator, qa as formatError, r as DeployEngine, sa as AssemblyReader, sr as DagBuilder, xa as AwsClients, xt as CloudControlProvider, ya as clearBucketRegionCache } from "./deploy-engine-CqKbD4yk.js";
+import { Aa as CdkdError, Ar as S3StateBackend, Ca as resolveBucketRegion, Ea as resetAwsClients, Fi as Synthesizer, Ja as StateError, Na as DependencyError, Oa as setAwsClients, Qa as normalizeAwsError, Sa as clearBucketRegionCache, Ta as getAwsClients, Ua as ProvisioningError, Xa as formatError, Ya as SynthesisError, Yr as AssetPublisher, Za as isCdkdError, cr as TemplateParser, ct as IAMRoleProvider, dt as ProviderRegistry, ja as ConfigError, ka as AssetError, kr as LockManager, mn as DiffCalculator, r as DeployEngine, sr as DagBuilder, ua as AssemblyReader, wa as AwsClients, xt as CloudControlProvider, za as LockError } from "./deploy-engine-D8OVUEBp.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-GASr9bAF.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-BwCSQ51f.js → program-azHUt9mf.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $a as isMarkedNonRetryable, $i as injectiveKeyPrefix, $n as repairMalformedResourcePropertiesForReadOnly, $r as AssetModeResolver, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Ai as AssetManifestLoader, An as malformedOutputsRefusalMessage, Ar as buildForceUnlockCommand, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as ProvisioningError, Bi as resolveStateBucketWithDefault, Bn as refuseMalformedOrphansForDestroy, Br as importableOutputKeys, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as resetAwsClients, Ci as partitionSensitiveEnv, Cn as isReadableResourceEntry, Cr as recoverMaskedOutput, Ct as UNSPECIFIED_SKIP_REASON, D as PRE_DELETE_SNAPSHOT_TYPES, Da as CdkdError, Di as warnFinchArgvExposure, Dn as malformedOrphanRecordsWarning, Dr as S3StateBackend, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ei as runDockerStreaming, En as malformedLocalOutputsWarning, Er as LockManager, Et as isWaitAbandonedError, F as extractDeploymentEventError, Fa as LocalStartServiceError, Fi as getLegacyStateBucketName, Fn as malformedResourcesWarning, Fr as DEFAULT_STATE_PREFIX, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Gi as ssmResolvedValueType, Gn as refuseMalformedResourceEntries, Gr as shouldRetainResource, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as ResourceUpdateNotSupportedError, Hi as resolveUseCdkBootstrapAssets, Hn as refuseMalformedOutputs, Hr as isReadableBag, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as resolveApp, In as malformedStateRefusalMessage, Ir as exportNamesCarriedFrom, It as isNamelessDynamicReferenceError, J as bold, Ji as MIGRATE_TMP_PREFIX, Jn as refuseMalformedResourcesForDestroy, Jr as WorkGraph, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as SynthesisError, Ki as CFN_TEMPLATE_BODY_LIMIT, Kn as refuseMalformedResourceEntriesForOrphan, Kr as AssetPublisher, Kt as coerceCfnInteger, L as planOrphanAdoption, La as MalformedProducerRecordRefusalError, Li as resolveAutoAssetStorage, Ln as refuseDivergentRecordRegionForDestroy, Lr as hasReadableExportSet, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as DynamicReferenceRegionAmbiguousError, Mi as Synthesizer, Mn as malformedRenderedContainersWarning, Mr as forceQuitRecoveryClause, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as IntrinsicResolutionRefusalError, Ni as synthesisStatusMessage, Nn as malformedResourceEntriesWarning, Nr as formatLockExpiry, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oi as escapeRegExp, On as malformedOrphansRefusalMessage, Or as rebuildClientForBucketRegion, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as LocalInvokeBuildError$1, Pi as getDefaultStateBucketName, Pn as malformedResourcePropertiesWarning, Pr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Pt as getAccountInfo, Q as red, Qa as shellQuote, Qi as injectiveKey, Qn as repairMalformedResourceEntriesForReadOnly, Qr as rewriteTemplateAssetReferences, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as NestedStackChildDirectDestroyError, Ri as resolveCaptureObservedState, Rn as refuseMalformedNestedChildOutputs, Rr as hasReasonlessBaselineRefusal, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as getAwsClients, Si as isMalformedEnvKey, Sn as hasReadableResources, Sr as recordMaskOnlyValue, St as slowCcOperationTimeoutMs, T as resourcesNamingDeclaredParameter, Ta as setAwsClients, Ti as runDockerForeground, Tn as malformedExportSourceWarning, Tr as scrubResourceRecord, Tt as deleteSkipReason, U as coerceWarmThroughput$1, Ua as StackHasActiveImportsError, Ui as stateBucketExistenceConfirmed, Un as refuseMalformedOutputsForDestroy, Ur as orphansAfterRollback, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as ResourceTimeoutError, Vi as resolveStateBucketWithDefaultAndSource, Vn as refuseMalformedOrphansForOrphan, Vr as importableOutputs, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as StackTerminationProtectionError, Wi as warnDeprecatedNoPrefixCliFlag, Wn as refuseMalformedResourceAttributesForOrphan, Wr as orphansCarriedFrom, Wt as assertRegionMatch, X as gray, Xa as withErrorHandling, Xi as uploadCfnTemplate, Xn as repairMalformedOrphansForReadOnly, Xr as createAssetRedirectResolver, Xt as readConfigString, Y as cyan, Ya as normalizeAwsError, Yi as findLargeInlineResources, Yn as refuseMalformedState, Yr as buildAssetRedirectMap, Yt as configStringRefusal, Z as green, Za as pasteableCommand, Zi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Zn as repairMalformedOutputsForReadOnly, Zr as loadPublishableAssetManifest, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as renderAssemblyPathEscape, _i as dockerSpawnEnvWithSensitive, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as identityKeyFor, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as canonicalizeRegion, ai as parseBootstrapMarker, an as s3BucketDomainName, ao as retryClassificationText, ar as describeTypeWithThrottleRetry, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as resolveBucketRegion, bi as getDockerCmd, bn as hasReadableOrphans, br as maskSecretsInError, bt as startInterruptWatch, c as replayFailedOperations, ca as failedStageNote, ci as validateContainerRepoName, cn as s3BucketWebsiteUrl, cr as TemplateParser, ct as IAMRoleProvider, d as updatePartialMessage, da as defineOwnKey, di as buildDockerImage, dn as applyCallerIdentityCredentials, dr as STATE_SOURCED_READBACK_RULES, dt as ProviderRegistry, ea as producerCoordinateKey, ei as BOOTSTRAP_MARKER_PREFIX, en as requireConfigString, eo as isRetryableTransientError, er as repairMalformedResourcesForReadOnly, et as collectDeclaredOutputNames, f as updatePartialReason, fa as hasOwnKey, fi as resolveDockerContextDirectory, fn as callerEnvCredentials, fr as TEMPLATE_SOURCED_RULES, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as absoluteAssemblyPathEscape, gi as describeDockerFailure, gn as STATE_RESOURCES_MALFORMED, gr as errorCauseChain, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as ownValue, hi as describeDockerExecFailure, hn as INTRINSIC_KEYS, hr as dynamicReferenceTokens, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as PARTITION_TABLE, ii as isCrossRegionRedirect, in as s3BucketArn, io as markRedactedCause, ir as findSilentDropProperties, it as secretBearing, j as isFinalSnapshotError, ja as DeployCancelledError, ji as getDockerImageBySourceHash, jn as malformedOutputsWarning, jr as buildLockContentionMessage, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as CrossAccountSecretRefusalError, ki as stripControlChars, kn as malformedOrphansWarning, kr as UNREPRODUCIBLE_LOCK_CLAUSE, kt as IntrinsicFunctionResolver, l as replayRollback, la as globMatches, li as buildDenyExternalAccessPolicy, ln as applyRoleArnIfSet, lr as STATE_SOURCED_BASELINE_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as nullPrototypeRecord, mi as describeDockerCapturedOutput, mn as DiffCalculator, mr as createSecretMasker, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as decodeListingKey, ni as ensureAssetStorage, nn as producerRegionsFromState, no as isTransientServerError, nr as safeStackName, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as derivePartitionAndUrlSuffix, oi as readBootstrapMarkerBody, on as s3BucketDualStackDomainName, oo as describeAwsFailure, or as withRetry, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as hasPlainPrototype, pi as warnManifestExecutable, pn as envCredentialsAreAssumedRole, pr as carriesSecretMask, pt as createMaskedRetryLogger, q as formatResourceLine, qi as CFN_TEMPLATE_URL_LIMIT, qn as refuseMalformedResourcePropertiesForOrphan, qr as stringifyValue, qt as configBooleanRefusal, r as DeployEngine, ra as expectedOwnerParam, ri as getBootstrapMarkerKey, rn as withSharedDrainBudget, ro as markNonRetryable, rr as findActionableSilentDrops, rt as isExportAliasCollision, s as planRollback, sa as AssemblyReader, si as validateAssetBucketName, sn as s3BucketRegionalDomainName, so as safeStringify, sr as DagBuilder, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as producerRecordKey, ti as assertAssetBucketRegion, tn as classifyReplaySecretRegion, to as isThrottlingError, tr as safeRegion, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as processStackMessages, ui as assertCdkLocalDockerContextContained, un as AWS_CREDENTIAL_ENV_KEYS, ur as STATE_SOURCED_CROSS_GENERATION_RULES, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as resolveAssemblyPath, vi as finchSecretArgvRefusal, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as isSingleDynamicReferenceToken, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as runWithStackAwsClients, wi as redactDockerArgvValues, wn as malformedExportNamesWarning, wr as redactSecretsForState, wt as deleteIndeterminateGuards, x as bindingSkippedOutputs, xa as AwsClients, xi as isDockerClientEnvKey, xn as hasReadableOutputs, xr as maskSecretsInText, xt as CloudControlProvider, y as keptWholeReasonText, yi as formatDockerLoginError, yn as displayLogicalId, yr as markSameGenerationBag, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as PartialFailureError, zi as resolveSkipPrefix, zn as refuseMalformedOrphans, zr as hasUnverifiableParameterRefusal, zt as refStateLookupFromResource } from "./deploy-engine-CqKbD4yk.js";
+import { $ as yellow, $a as withErrorHandling, $i as uploadCfnTemplate, $n as repairMalformedResourcePropertiesForReadOnly, $r as createAssetRedirectResolver, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as CdkdError, Ai as warnFinchArgvExposure, An as malformedOutputsRefusalMessage, Ar as S3StateBackend, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as MalformedProducerRecordRefusalError, Bi as resolveAutoAssetStorage, Bn as refuseMalformedOrphansForDestroy, Br as hasReadableExportSet, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as resolveBucketRegion, Ci as getDockerCmd, Cn as isReadableResourceEntry, Cr as pathCrossesDottedKey, Ct as UNSPECIFIED_SKIP_REASON, D as PRE_DELETE_SNAPSHOT_TYPES, Da as runWithStackAwsClients, Di as redactDockerArgvValues, Dn as malformedOrphanRecordsWarning, Dr as redactSecretsForState, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as resetAwsClients, Ei as partitionSensitiveEnv, En as malformedLocalOutputsWarning, Er as recoverMaskedOutput, Et as isWaitAbandonedError, F as extractDeploymentEventError, Fa as DynamicReferenceRegionAmbiguousError, Fi as Synthesizer, Fn as malformedResourcesWarning, Fr as forceQuitRecoveryClause, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as ResourceUpdateNotSupportedError, Gi as resolveUseCdkBootstrapAssets, Gn as refuseMalformedResourceEntries, Gr as isReadableBag, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as PartialFailureError, Hi as resolveSkipPrefix, Hn as refuseMalformedOutputs, Hr as hasUnverifiableParameterRefusal, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ia as IntrinsicResolutionRefusalError, Ii as synthesisStatusMessage, In as malformedStateRefusalMessage, Ir as formatLockExpiry, It as isNamelessDynamicReferenceError, J as bold, Ji as ssmResolvedValueType, Jn as refuseMalformedResourcesForDestroy, Jr as shouldRetainResource, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as StackHasActiveImportsError, Ki as stateBucketExistenceConfirmed, Kn as refuseMalformedResourceEntriesForOrphan, Kr as orphansAfterRollback, Kt as coerceCfnInteger, L as planOrphanAdoption, La as LocalInvokeBuildError$1, Li as getDefaultStateBucketName, Ln as refuseDivergentRecordRegionForDestroy, Lr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as CrossAccountSecretRefusalError, Mi as stripControlChars, Mn as malformedRenderedContainersWarning, Mr as UNREPRODUCIBLE_LOCK_CLAUSE, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Ni as AssetManifestLoader, Nn as malformedResourceEntriesWarning, Nr as buildForceUnlockCommand, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as setAwsClients, Oi as runDockerForeground, On as malformedOrphansRefusalMessage, Or as scrubResourceRecord, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as DeployCancelledError, Pi as getDockerImageBySourceHash, Pn as malformedResourcePropertiesWarning, Pr as buildLockContentionMessage, Pt as getAccountInfo, Q as red, Qa as normalizeAwsError, Qi as findLargeInlineResources, Qn as repairMalformedResourceEntriesForReadOnly, Qr as buildAssetRedirectMap, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as LocalStartServiceError, Ri as getLegacyStateBucketName, Rn as refuseMalformedNestedChildOutputs, Rr as DEFAULT_STATE_PREFIX, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Si as formatDockerLoginError, Sn as hasReadableResources, Sr as maskSecretsInText, St as slowCcOperationTimeoutMs, T as resourcesNamingDeclaredParameter, Ta as getAwsClients, Ti as isMalformedEnvKey, Tn as malformedExportSourceWarning, Tr as recordMaskOnlyValuesIn, Tt as deleteSkipReason, U as coerceWarmThroughput$1, Ua as ProvisioningError, Ui as resolveStateBucketWithDefault, Un as refuseMalformedOutputsForDestroy, Ur as importableOutputKeys, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as NestedStackChildDirectDestroyError, Vi as resolveCaptureObservedState, Vn as refuseMalformedOrphansForOrphan, Vr as hasReasonlessBaselineRefusal, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as ResourceTimeoutError, Wi as resolveStateBucketWithDefaultAndSource, Wn as refuseMalformedResourceAttributesForOrphan, Wr as importableOutputs, Wt as assertRegionMatch, X as gray, Xi as CFN_TEMPLATE_URL_LIMIT, Xn as repairMalformedOrphansForReadOnly, Xr as stringifyValue, Xt as readConfigString, Y as cyan, Ya as SynthesisError, Yi as CFN_TEMPLATE_BODY_LIMIT, Yn as refuseMalformedState, Yr as AssetPublisher, Yt as configStringRefusal, Z as green, Zi as MIGRATE_TMP_PREFIX, Zn as repairMalformedOutputsForReadOnly, Zr as WorkGraph, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as nullPrototypeRecord, _i as describeDockerCapturedOutput, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as identityKeyFor, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as decodeListingKey, ai as ensureAssetStorage, an as s3BucketDomainName, ao as isTransientServerError, ar as describeTypeWithThrottleRetry, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as renderAssemblyPathEscape, bi as dockerSpawnEnvWithSensitive, bn as hasReadableOrphans, br as markSameGenerationBag, bt as startInterruptWatch, c as replayFailedOperations, ca as canonicalizeRegion, ci as parseBootstrapMarker, cn as s3BucketWebsiteUrl, co as retryClassificationText, cr as TemplateParser, ct as IAMRoleProvider, d as updatePartialMessage, da as failedStageNote, di as validateContainerRepoName, dn as applyCallerIdentityCredentials, dr as STATE_SOURCED_READBACK_RULES, dt as ProviderRegistry, ea as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, ei as loadPublishableAssetManifest, en as requireConfigString, eo as pasteableCommand, er as repairMalformedResourcesForReadOnly, et as collectDeclaredOutputNames, f as updatePartialReason, fa as globMatches, fi as buildDenyExternalAccessPolicy, fn as callerEnvCredentials, fr as TEMPLATE_SOURCED_RULES, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as hasPlainPrototype, gi as warnManifestExecutable, gn as STATE_RESOURCES_MALFORMED, gr as errorCauseChain, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as hasOwnKey, hi as resolveDockerContextDirectory, hn as INTRINSIC_KEYS, hr as dynamicReferenceTokens, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as producerRecordKey, ii as assertAssetBucketRegion, in as s3BucketArn, io as isThrottlingError, ir as findSilentDropProperties, it as secretBearing, j as isFinalSnapshotError, ji as escapeRegExp, jn as malformedOutputsWarning, jr as rebuildClientForBucketRegion, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ki as runDockerStreaming, kn as malformedOrphansWarning, kr as LockManager, kt as IntrinsicFunctionResolver, l as replayRollback, la as derivePartitionAndUrlSuffix, li as readBootstrapMarkerBody, ln as applyRoleArnIfSet, lo as describeAwsFailure, lr as STATE_SOURCED_BASELINE_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as defineOwnKey, mi as buildDockerImage, mn as DiffCalculator, mr as createSecretMasker, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as injectiveKeyPrefix, ni as AssetModeResolver, nn as producerRegionsFromState, no as isMarkedNonRetryable, nr as safeStackName, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as expectedOwnerParam, oi as getBootstrapMarkerKey, on as s3BucketDualStackDomainName, oo as markNonRetryable, or as withRetry, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as processStackMessages, pi as assertCdkLocalDockerContextContained, pn as envCredentialsAreAssumedRole, pr as carriesSecretMask, pt as createMaskedRetryLogger, q as formatResourceLine, qa as StackTerminationProtectionError, qi as warnDeprecatedNoPrefixCliFlag, qn as refuseMalformedResourcePropertiesForOrphan, qr as orphansCarriedFrom, qt as configBooleanRefusal, r as DeployEngine, ra as producerCoordinateKey, ri as BOOTSTRAP_MARKER_PREFIX, rn as withSharedDrainBudget, ro as isRetryableTransientError, rr as findActionableSilentDrops, rt as isExportAliasCollision, s as planRollback, sa as PARTITION_TABLE, si as isCrossRegionRedirect, sn as s3BucketRegionalDomainName, so as markRedactedCause, sr as DagBuilder, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as injectiveKey, ti as rewriteTemplateAssetReferences, tn as classifyReplaySecretRegion, to as shellQuote, tr as safeRegion, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as AssemblyReader, ui as validateAssetBucketName, un as AWS_CREDENTIAL_ENV_KEYS, uo as safeStringify, ur as STATE_SOURCED_CROSS_GENERATION_RULES, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as ownValue, vi as describeDockerExecFailure, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as isSingleDynamicReferenceToken, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as AwsClients, wi as isDockerClientEnvKey, wn as malformedExportNamesWarning, wr as recordMaskOnlyValue, wt as deleteIndeterminateGuards, x as bindingSkippedOutputs, xa as resolveAssemblyPath, xi as finchSecretArgvRefusal, xn as hasReadableOutputs, xr as maskSecretsInError, xt as CloudControlProvider, y as keptWholeReasonText, ya as absoluteAssemblyPathEscape, yi as describeDockerFailure, yn as displayLogicalId, yr as isUncertifiedBaselineMaskPosition, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, zi as resolveApp, zn as refuseMalformedOrphans, zr as exportNamesCarriedFrom, zt as refStateLookupFromResource } from "./deploy-engine-D8OVUEBp.js";
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-GASr9bAF.js";
 import { n as awsClientDefaults, s as ambientRegion } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-CdZXcCGn.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-BTiCRWQZ.js";
+import { t as getCdkdVersion } from "./version-CqL2wd8C.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DsMCnbwS.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -72863,6 +72863,36 @@ function deepEqual(a, b) {
 	}
 	return true;
 }
+/**
+* {@link deepEqual}, except that a `mask` STRING on the state side matches any
+* STRING on the AWS side (issue
+* [#3595](https://github.com/go-to-k/cdkd/issues/3595)).
+*
+* Answers "do these two differ ANYWHERE other than at a masked position?" —
+* the question that separates a baseline cdkd could not certify from real
+* drift beside it. Positional and shape-strict on purpose: an array whose
+* length changed or whose elements AWS reordered is NOT equal, because a mask
+* cannot say which element it stood for, and treating a reorder as equal would
+* hide an edit. Only a string can match a mask, since the redaction masks
+* string leaves alone.
+*/
+function equalModuloMask(state, aws, mask) {
+	const a = jsonForm(state);
+	const b = jsonForm(aws);
+	if (a === mask && typeof b === "string") return true;
+	if (a === b) return true;
+	if (a === null || b === null || a === void 0 || b === void 0) return a === b;
+	if (typeof a !== typeof b || typeof a !== "object") return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((v, i) => equalModuloMask(v, b[i], mask));
+	}
+	const aObj = a;
+	const bObj = b;
+	const aKeys = Object.keys(aObj);
+	if (aKeys.length !== Object.keys(bObj).length) return false;
+	return aKeys.every((key) => Object.prototype.hasOwnProperty.call(bObj, key) && equalModuloMask(aObj[key], bObj[key], mask));
+}
 function isPlainObject(value) {
 	return typeof value === "object" && value !== null;
 }
@@ -73608,6 +73638,10 @@ const UNCOMPARED_REASONS = {
 		kind: "unknown",
 		phrase: "only PARTIALLY compared: cdkd refused to resolve a dynamic reference their state records"
 	},
+	uncertifiedBaseline: {
+		kind: "unknown",
+		phrase: "only PARTIALLY compared: their recorded baseline holds the redaction mask where cdkd could not tell which live value a secret reference became"
+	},
 	unresolvedToken: {
 		kind: "unknown",
 		phrase: "only PARTIALLY compared: their state records a `{{resolve:...}}` spelling cdkd resolves for nobody, which no re-run can clear"
@@ -73644,6 +73678,7 @@ const UNCOMPARED_REASONS = {
 const ANY_OF_IT_COMPARED = {
 	refused: true,
 	unresolvedToken: true,
+	uncertifiedBaseline: true,
 	readFailed: false,
 	baselineRefused: false,
 	unreadableRecord: false
@@ -74182,7 +74217,8 @@ function notComparedReason(cause) {
 		unresolvedToken: "its state records a `{{resolve:...}}` spelling cdkd resolves for nobody (permanent; a re-run cannot clear it)",
 		readFailed: "the read or comparison threw, so NONE of its properties were compared",
 		unreadableRecord: "its state record is not readable as a resource — not an object, or carrying no resource type — so there was nothing to compare (repair or re-import the record)",
-		baselineRefused: "a `cdkd import` run refused to capture its observed baseline, so the only baseline available is the recorded properties that refusal already found untrustworthy (deploy a change to this resource to restore one)"
+		baselineRefused: "a `cdkd import` run refused to capture its observed baseline, so the only baseline available is the recorded properties that refusal already found untrustworthy (deploy a change to this resource to restore one)",
+		uncertifiedBaseline: "its recorded baseline holds the redaction mask at a position cdkd could not pair with the secret reference there, so that position was not compared — every other property was (deploy a change to this resource to re-capture the baseline)"
 	}[cause];
 }
 /**
@@ -74399,6 +74435,54 @@ async function resolveStateSecretExpressions(props, resolvers, secrets, options)
 	return await walk(props, "");
 }
 /**
+* Split off the changes that exist ONLY because the observed baseline holds an
+* uncertified-position mask (issue
+* [#3595](https://github.com/go-to-k/cdkd/issues/3595)).
+*
+* Issue [#2852](https://github.com/go-to-k/cdkd/issues/2852) writes
+* {@link SECRET_MASK} into `observedProperties` at every position the readback
+* walk could not pair with a dynamic reference in the source. No live value
+* equals the mask, so before this every such resource read `drifted` on every
+* run — a change nobody made, which `--accept` refused and no no-change deploy
+* cleared. The position is not drifted; it is UNKNOWN, and is reported that
+* way (`uncertifiedBaseline`, exit 2) instead.
+*
+* A change qualifies only when all three hold:
+*
+* - its state side carries a mask;
+* - the mask is the fail-closed class, not a `NoEcho` one
+*   ({@link isUncertifiedBaselineMaskPosition}) — a `NoEcho` mask keeps the
+*   issue #2274 disposition;
+* - the two sides are equal once each masked string is allowed to match any
+*   live string ({@link equalModuloMask}). Anything else — a length change, a
+*   reorder, an edit beside the mask — stays real drift.
+*
+* Runs on the COMPARISON values, before {@link redactDriftChanges}: after it
+* the AWS side is itself a mask or an expression and the equality means
+* nothing. The split-off changes reach no printer, no `--json` payload and
+* neither remediation path; nothing about them is persisted or pushed.
+*
+* Accepted residuals, both inherent to a position cdkd cannot name: a secret
+* rotated (or edited) AT a masked position is not seen, and a masked element of
+* a declared-unordered array is sorted apart from its live counterpart and so
+* stays `drifted`.
+*/
+function partitionUncertifiedBaselineChanges(changes, properties, baseline) {
+	const kept = [];
+	const uncertifiedPaths = [];
+	for (const change of changes) {
+		if (carriesSecretMask(change.stateValue) && isUncertifiedBaselineMaskPosition(properties, change.path) && !pathCrossesDottedKey(baseline, change.path) && equalModuloMask(change.stateValue, change.awsValue, "***")) {
+			uncertifiedPaths.push(change.path);
+			continue;
+		}
+		kept.push(change);
+	}
+	return {
+		kept,
+		uncertifiedPaths
+	};
+}
+/**
 * Is a drift reported at `path` positioned on, or above, a known secret?
 *
 * The PREFIX direction is the one that matters: a secret sits at a leaf (or at
@@ -74472,7 +74556,7 @@ function acceptRefusalReason(change, maskedPaths) {
 	if (!maskedPaths.has(change.path)) return void 0;
 	if (change.path.includes("***")) return "its property NAME came back carrying a secret value, so cdkd cannot name the key to write — and no redaction pass can clear it either, since they all walk values and never keys. ROTATE the secret; that is the only remedy";
 	if (change.awsValue === void 0) return "AWS no longer reports it, and accepting an absence DELETES the key — which at or above a secret dynamic reference would erase the reference out of cdkd state. Use --revert to push it back, or re-deploy";
-	if (change.stateValue === "***") return "cdkd does not know the value that belongs at this position — the baseline holds only the redaction mask, so accepting would write AWS-held plaintext over a deliberate redaction. Re-deploy to refresh it";
+	if (change.stateValue === "***") return "cdkd does not know the value that belongs at this position — the baseline holds only the redaction mask, so accepting would write AWS-held plaintext over a deliberate redaction. A `cdkd deploy` that CHANGES this resource re-captures the baseline (a deploy that changes nothing does not); where the value came from a `NoEcho` custom resource, that custom resource must update too, so its handler supplies the value again";
 	return "it carries a secret dynamic reference and the value AWS currently holds is not the one the reference resolves to";
 }
 /**
@@ -74681,12 +74765,13 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 					baseline: provider.canonicalizeDriftProperties(resource.resourceType, protocolNormalized.baseline),
 					aws: provider.canonicalizeDriftProperties(resource.resourceType, protocolNormalized.aws)
 				} : protocolNormalized;
-				const reported = redactDriftChanges(calculateResourceDrift(canonicalized.baseline, canonicalized.aws, {
+				const partitioned = partitionUncertifiedBaselineChanges(calculateResourceDrift(canonicalized.baseline, canonicalized.aws, {
 					ignorePaths: observedIgnorePaths.length ? [...ignorePaths, ...observedIgnorePaths] : ignorePaths,
 					unionWalkObjects: useObserved,
 					unorderedPaths
-				}), secrets, secretResolutionFailed ? seededSecretPaths : secretPaths, maskSecretPaths);
-				const notComparedCause = secretResolutionFailed ? "refused" : unresolvedTokens.size > 0 ? "unresolvedToken" : void 0;
+				}), resource.properties ?? {}, baseline);
+				const reported = redactDriftChanges(partitioned.kept, secrets, secretResolutionFailed ? seededSecretPaths : secretPaths, maskSecretPaths);
+				const notComparedCause = secretResolutionFailed ? "refused" : partitioned.uncertifiedPaths.length > 0 ? "uncertifiedBaseline" : unresolvedTokens.size > 0 ? "unresolvedToken" : void 0;
 				if (reported.changes.length === 0) {
 					if (notComparedCause !== void 0) outcomes.push({
 						kind: "notCompared",
@@ -74706,6 +74791,8 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 					...reported,
 					awsProperties: aws,
 					secrets,
+					uncertifiedPaths: partitioned.uncertifiedPaths,
+					secretsIncomplete: secretResolutionFailed || unresolvedTokens.size > 0,
 					notComparedCause
 				});
 			} catch (err) {
@@ -75713,6 +75800,108 @@ function corroboratedLeafCount(send, live, wildcardLeaf = isMaskLeaf) {
 	return deepEqualUnordered(send, live) ? 1 : void 0;
 }
 /**
+* Send AWS's OWN value at every uncertified-baseline position (issue
+* [#3595](https://github.com/go-to-k/cdkd/issues/3595)).
+*
+* Detection split those positions off because the baseline's `***` was the
+* only difference there, so there is nothing to revert at them. But
+* {@link buildRevertNewProperties} overlays whole TOP-LEVEL keys: a real change
+* elsewhere under the same key carries the baseline subtree — masks included —
+* into the send bag, and {@link preserveLiveValuesAtMaskedLeaves} then cannot
+* pair an anchor-less list and refuses the whole resource. Detection already
+* certified the alignment ({@link equalModuloMask} held on these very
+* positions), so the live subtree is copied in wholesale.
+*
+* Every live STRING standing where the baseline held the mask is registered as
+* a mask-only needle — at EVERY uncertified path, overlaid or not — as the mask
+* walk does for the leaves it copies: the value cdkd could not name may be a
+* secret, and the send bag is what the provider's log lines see. Registration
+* is POSITIONAL where the two sides line up, and covers every live string under
+* the path where they do not (over-masking fails safe). It is only the OVERLAY
+* that leaves a non-aligned path untouched, so the mask walk after this one
+* still refuses rather than guesses. The #1644 narrowing write does not rely on
+* the needles alone: {@link keepBaselineAtUncertifiedPaths} keeps the masked
+* baseline value at these paths whatever the value's length.
+*/
+function overlayLiveAtUncertifiedPaths(send, uncertifiedPaths, awsProperties, baseline, secrets, overlaidTopLevelKeys) {
+	if (uncertifiedPaths.length === 0) return send;
+	let out = send;
+	for (const path of uncertifiedPaths) {
+		const live = getAtPath(awsProperties, path);
+		const masked = getAtPath(baseline, path);
+		if (!(live !== void 0 && equalModuloMask(masked, live, "***"))) {
+			if (live !== void 0) recordMaskOnlyValuesIn(live, secrets);
+			continue;
+		}
+		const needles = [];
+		const collect = (b, l) => {
+			if (b === "***" && typeof l === "string") {
+				needles.push(l);
+				return;
+			}
+			if (Array.isArray(b) && Array.isArray(l)) {
+				b.forEach((item, i) => collect(item, l[i]));
+				return;
+			}
+			if (b !== null && typeof b === "object" && l !== null && typeof l === "object") {
+				for (const key of Object.keys(b)) if (hasOwnKey(l, key)) collect(b[key], ownValue(l, key));
+			}
+		};
+		collect(masked, live);
+		for (const needle of needles) recordMaskOnlyValue(secrets, needle);
+		const topLevelKey = path.split(".", 1)[0] ?? "";
+		if (overlaidTopLevelKeys.has(topLevelKey)) out = withValueAtPath(out, path, live);
+	}
+	return out;
+}
+/**
+* Put the BASELINE's own value back at every uncertified-baseline path of a
+* #1644 narrowing delta (issue [#3595](https://github.com/go-to-k/cdkd/issues/3595)).
+*
+* The delta is the provider's echo of what it delivered, and at such a path
+* that is a live value cdkd could not name: the position source holds `***`
+* rather than a reference, so the fail-closed walk never fires there, and a
+* needle shorter than the substitution floor is never registered. Keeping the
+* masked baseline value there persists nothing new — the position was unknown
+* before the revert and stays unknown — whatever the value's length. A path
+* the delta does not reach (its top-level key was not narrowed, or was
+* dropped) is left alone. The WHOLE baseline subtree comes back, so a real
+* narrowing of an unmasked neighbour inside it is undone too; the next run
+* then reports that as drift (the comparison is shape-strict), which is the
+* safe side of persisting a value cdkd cannot name.
+*/
+function keepBaselineAtUncertifiedPaths(delta, uncertifiedPaths, baseline) {
+	let out = delta;
+	for (const path of uncertifiedPaths) {
+		if (getAtPath(out, path) === void 0) continue;
+		const kept = getAtPath(baseline, path);
+		if (kept === void 0) continue;
+		out = withValueAtPath(out, path, kept);
+	}
+	return out;
+}
+/**
+* `bag` with `value` at the dotted `path`, rebuilding each ancestor rather than
+* writing into it, so the caller's bag — shared with the detection outcome —
+* is never mutated. Own keys throughout, for `getAtPath`'s reason. A path whose
+* ancestor is not a plain object returns `bag` unchanged.
+*/
+function withValueAtPath(bag, path, value) {
+	const [head, ...rest] = path.split(".");
+	if (head === void 0) return bag;
+	const out = {};
+	for (const [k, v] of Object.entries(bag)) defineOwnKey(out, k, v);
+	if (rest.length === 0) {
+		defineOwnKey(out, head, value);
+		return out;
+	}
+	const child = hasOwnKey(bag, head) ? ownValue(bag, head) : void 0;
+	if (child === null || typeof child !== "object" || Array.isArray(child)) return bag;
+	if (!hasPlainPrototype(child)) return bag;
+	defineOwnKey(out, head, withValueAtPath(child, rest.join("."), value));
+	return out;
+}
+/**
 * Keep `cdkd drift --revert` from pushing a REDACTION MASK to AWS (issue
 * [#2274](https://github.com/go-to-k/cdkd/issues/2274)).
 *
@@ -76139,8 +76328,8 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 				if (unresolvedTokens.size > 0) logger.warn(`  ! [revert] ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): cdkd cannot resolve ${maskSecretsInText([...unresolvedTokens].join(", "), secrets)} — a property whose WHOLE value is one of these tokens is left UNCHANGED by this revert when cdkd can pair its position against AWS's report (a list element by an identity field, or by its list's own unchanged literal values). Where it cannot pair, and where a token is EMBEDDED in a longer string, the token is written literally, exactly as 'cdkd deploy' does, so a resolved value AWS holds there is overwritten.`);
 				let newProperties;
 				try {
-					const overlaid = buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties, { preserveUntemplated: stateResource.observedProperties === void 0 });
-					const maskPreserved = preserveLiveValuesAtMaskedLeaves(unresolvedTokens.size > 0 ? preserveLiveValuesAtUnresolvedTokens(overlaid, outcome.awsProperties) : overlaid, outcome.awsProperties, secrets, overlaid);
+					const certifiedOverlay = overlayLiveAtUncertifiedPaths(buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties, { preserveUntemplated: stateResource.observedProperties === void 0 }), outcome.uncertifiedPaths, outcome.awsProperties, desiredProperties, secrets, new Set(outcome.changes.map((change) => change.path.split(".", 1)[0] ?? "")));
+					const maskPreserved = preserveLiveValuesAtMaskedLeaves(unresolvedTokens.size > 0 ? preserveLiveValuesAtUnresolvedTokens(certifiedOverlay, outcome.awsProperties) : certifiedOverlay, outcome.awsProperties, secrets, certifiedOverlay);
 					if (maskPreserved.unpreservablePaths.length > 0) {
 						totalUnresolvable++;
 						logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): refused to revert ${maskSecretsInText(maskPreserved.unpreservablePaths.join(", "), secrets)} — the recorded baseline holds only the redaction mask there, and AWS reports nothing to preserve, so cdkd has no value it may write. Two causes leave such a mask, and the record does not say which: a NoEcho custom-resource value (force that custom resource to update — change one of its properties, e.g. a nonce — and re-deploy, so its handler runs again and supplies the value), or a readback position cdkd could not certify when the baseline was captured (deploy a change to this resource, so the baseline is recaptured against the template). An ordinary no-change re-deploy clears neither.`);
@@ -76165,7 +76354,7 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 					try {
 						if (updateResult?.effectiveProperties) {
 							const delta = collectNarrowedTopLevelKeys(newProperties, updateResult.effectiveProperties);
-							if (Object.keys(delta).length > 0) narrowedByLogicalId.set(outcome.logicalId, redactSecretsForState(delta, secrets, revertBaseline, stateResource.observedProperties !== void 0 ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES));
+							if (Object.keys(delta).length > 0) narrowedByLogicalId.set(outcome.logicalId, keepBaselineAtUncertifiedPaths(redactSecretsForState(delta, secrets, revertBaseline, stateResource.observedProperties !== void 0 ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES), outcome.uncertifiedPaths, revertBaseline));
 						}
 					} catch (captureErr) {
 						logger.warn(`  ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, but the provider's reported effective properties could not be read — ${maskSecretsInText(captureErr instanceof Error ? captureErr.message : String(captureErr), secrets)}`);
@@ -76320,7 +76509,7 @@ function printRevertPlan(reports, out) {
 			const stateResource = report.state.resources[o.logicalId];
 			if (stateResource) {
 				const preserved = findRevertPreservedTagKeys(o.changes, stateResource.observedProperties ?? stateResource.properties ?? {}, o.awsProperties);
-				if (o.notComparedCause !== void 0 && preserved.length > 0) out.write(`    ! ${preserved.length} AWS-authored tag(s) will be preserved, but cdkd could not resolve this resource's dynamic reference(s), so their names are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
+				if (o.secretsIncomplete && preserved.length > 0) out.write(`    ! ${preserved.length} AWS-authored tag(s) will be preserved, but cdkd could not resolve this resource's dynamic reference(s), so their names are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
 				else if (preserved.length > 0) {
 					const tagWord = preserved.length === 1 ? "tag" : "tags";
 					out.write(`    ! reverting this tag list KEEPS ${preserved.length} AWS-authored ${tagWord} the baseline does not carry:\n`);
@@ -76331,7 +76520,7 @@ function printRevertPlan(reports, out) {
 			}
 			if (stateResource && stateResource.observedProperties === void 0) {
 				const unbaselined = findRevertUnbaselinedAwsKeys(o.changes, stateResource.properties ?? {}, o.awsProperties);
-				if (o.notComparedCause !== void 0 && unbaselined.length > 0) out.write(`    ! ${unbaselined.length} AWS-authored value(s) will be left untouched, but cdkd could not resolve this resource's dynamic reference(s), so their paths are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
+				if (o.secretsIncomplete && unbaselined.length > 0) out.write(`    ! ${unbaselined.length} AWS-authored value(s) will be left untouched, but cdkd could not resolve this resource's dynamic reference(s), so their paths are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
 				else if (unbaselined.length > 0) {
 					const word = unbaselined.length === 1 ? "value" : "values";
 					out.write(`    ! this resource has no observed-capture baseline, so the revert pushes the raw TEMPLATE and LEAVES ${unbaselined.length} AWS-authored ${word} untouched:\n`);
@@ -76482,8 +76671,13 @@ function writeHumanReport(reports) {
 		if (notCompared.length > 0) {
 			const notComparedAtAll = notCompared.filter((n) => !ANY_OF_IT_COMPARED[n.cause]).length;
 			const referenceCaused = notCompared.length - notComparedAtAll;
+			const partialCauses = new Set(notCompared.filter((n) => ANY_OF_IT_COMPARED[n.cause]).map((n) => n.cause));
+			const hasReferencePartial = partialCauses.has("refused") || partialCauses.has("unresolvedToken");
+			const hasUncertified = partialCauses.has("uncertifiedBaseline");
+			const partialClause = hasReferencePartial && !hasUncertified ? "cdkd could not, or refused to, resolve a dynamic reference their state records, so their secret-bearing properties were NOT compared" : hasUncertified && !hasReferencePartial ? "their recorded baseline holds the redaction mask at a position cdkd could not certify, so that position was NOT compared" : `some of their properties were NOT compared; each entry below names why`;
+			const partialClauseShort = hasReferencePartial && !hasUncertified ? "a dynamic reference cdkd could not, or refused to, resolve" : hasUncertified && !hasReferencePartial ? "a baseline position cdkd could not certify" : "see each entry";
 			const atAllCause = Object.keys(UNCOMPARED_REASONS).filter((cause) => cause in ANY_OF_IT_COMPARED).filter((cause) => !ANY_OF_IT_COMPARED[cause] && notCompared.some((n) => n.cause === cause)).map((cause) => UNCOMPARED_REASONS[cause].phrase.replace(/^not compared AT ALL: /, "")).join("; ");
-			process.stdout.write(notComparedAtAll === 0 ? `\n  ${notCompared.length} resource(s) only PARTIALLY compared — cdkd could not, or refused to, resolve a dynamic reference their state records, so their secret-bearing properties were NOT compared:\n` : `\n  ${notCompared.length} resource(s) NOT fully compared — ${notComparedAtAll} not compared AT ALL (${atAllCause})` + (referenceCaused > 0 ? `, ${referenceCaused} only PARTIALLY compared (a dynamic reference cdkd could not, or refused to, resolve)` : "") + `:\n`);
+			process.stdout.write(notComparedAtAll === 0 ? `\n  ${notCompared.length} resource(s) only PARTIALLY compared — ${partialClause}:\n` : `\n  ${notCompared.length} resource(s) NOT fully compared — ${notComparedAtAll} not compared AT ALL (${atAllCause})` + (referenceCaused > 0 ? `, ${referenceCaused} only PARTIALLY compared (${partialClauseShort})` : "") + `:\n`);
 			for (const { outcome, cause } of notCompared) process.stdout.write(`    ! ${outcome.logicalId} (${outcome.resourceType}) — ${notComparedReason(cause)}\n`);
 		}
 		if (unsupported.length > 0) {
@@ -98580,4 +98774,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-BwCSQ51f.js.map
+//# sourceMappingURL=program-azHUt9mf.js.map