@go-to-k/cdkd 0.296.0 → 0.296.1

package/dist/{deploy-engine-D7204v7Z.js → deploy-engine-xlct0Hcm.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js"
 import { A as displaySafe, E as UNRENDERABLE, F as safeMsg, L as truncateCodePoints, M as isPasteableIdent, O as displayAwsMessage, P as plainIdentOr, S as withoutGeneratedFallbackName, T as STACK_REF_MAX_CODE_POINTS, _ as getCurrentSkipPrefix, b as withSkipPrefix, c as getLiveRenderer, f as applyDefaultNameForFallback, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, m as explicitNamePropertyFor, n as getLogger, r as isStdoutReservedForPayload, s as installLogLineMaskerSource, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS, x as withStackName, y as looksLikeCdkdGeneratedName } from "./logger-Dvc7ddKe.js";
 import { $n as markRedactedCause, $t as LockError, A as isTerminalDeleteFailure, At as CUSTOM_RESOURCE_RESPONSE_PREFIX, Bn as isAmbiguousCcHandlerErrorCode, Bt as clientDefaultsFor, C as refusalTypeShown, Cn as physicalIdShownBesideCommand, Ct as buildForceUnlockCommand, D as ProtectionFlipRegistry, Dn as shellQuote, Dt as formatLockOperation, En as shellBoundedDisplay, Et as formatLockExpiry, Fn as isRecreateRetryableError, Ft as producerRecordKey, Gn as retryClassificationText, H as pasteableAwsCommand, Hn as isIamPropagationError, Ht as AccountIdUnavailableError, In as isReplayedNameCollisionFrom, J as isInterruptedWaitError, Jn as safeStringify$1, Kn as describeAwsFailure, Kt as CrossAccountSecretRefusalError, Lt as withPasteableAwsProfile, M as observeThenDisableProtection, Mn as hasReplayMayCollide, Mt as injectiveKey, N as protectionFlipKey, Nn as isNameCollisionErrorFrom, O as compensateProtectionFlip, On as withheldTargetClause, Ot as formatLockOwner, Pn as isNameCooldownError, Q as canonicalizeRoute53QueryName, Qn as markNonRetryable, R as DELETION_PROTECTION_DOC_POINTER, Rn as markReplayMayCollide, Rt as ambientClientDefaults, S as quotedRemedyLogicalId, Sn as pasteableCommand, St as UNREPRODUCIBLE_LOCK_CLAUSE, T as resolveExplicitPhysicalId, Tn as quotedOrDescribed, U as protectedReplacementAdvice, Un as isRetryableTransientError, Ut as AssetError, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, Wn as isTransientServerError, Wt as CdkdError, X as ElapsedBudgetRegistry, Xn as isMarkedNonRetryable, Xt as IntrinsicResolutionRefusalError, Y as startInterruptWatch, Yt as DynamicReferenceRegionAmbiguousError, Z as monotonicNowMs, Zn as isThrottlingError, _n as SHELL_ACTIVE_WHY, _t as hasCreatedBeforeFailure, an as ResourceTimeoutError, at as segmentAfterAnchor, b as isQuotableImportValue, bt as markAuxiliaryFailure, ct as createMaskedRetryLogger, d as prepareRemovalForUpdate, dt as maskerOrIdentity, en as MacroExpansionError, er as wrapMaskedAwsError, et as compositeIdSeparatorRefusal, f as removalWarning, ft as withDerivedNameMasks, g as assertRegionMatch, gn as SHELL_ACTIVE, gt as createdBeforeFailure, h as RESOURCE_NOT_FOUND, i as holdsSecretDerivedEntry, in as ProvisioningError, it as resourceTypeShown, jn as isUpdateUnsupportedError, jt as DEFAULT_STATE_PREFIX, k as deleteWithProtectionCompensation, kt as sanitizeRecoveryValue, l as withUnchangedSecretPrincipalLists, ln as StateError, lt as isSecretDerivedValue, m as withoutInjectedRemovals, mt as carryCreatedBeforeFailure, nt as logicalIdShown, on as ResourceUpdateNotSupportedError, ot as stateOrphanRecordRemedy, pn as normalizeAwsError, pt as RETRY_AUXILIARY_OWNER, qt as DependencyError, st as createMaskedLogSinks, tn as MalformedProducerRecordRefusalError, un as SynthesisError, ut as maskDeep, vn as UNSHOWABLE_VALUE, vt as isAuxiliaryFailure, wn as plainOrDescribed, x as normalizeAwsTagsToCfn, xn as isInertUnquoted, xt as markCreatedBeforeFailure, yn as commandHole, yt as isAuxiliaryMarkOf, zn as formatRetryClassificationSignals, zt as ambientCredentialConfig } from "./iam-policy-targets-DSDSdxXz.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-DUHDmEhz.js";
+import { t as getCdkdVersion } from "./version-Dpc_HYX0.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7674,6 +7674,10 @@ const CLASSIFIER_IDENTIFIER_FIELDS = /* @__PURE__ */ new Set([
 function isAuxiliaryAnchor(key, descriptor) {
 	return key === "logicalId" && descriptor.enumerable === false && descriptor.writable === false && typeof descriptor.value === "string" && descriptor.value.endsWith("/auxiliary");
 }
+const CREATED_BEFORE_FAILURE_MARK = Symbol.for("cdkd.createdBeforeFailure");
+function isCreatedBeforeFailureMark(key, descriptor) {
+	return key === CREATED_BEFORE_FAILURE_MARK && descriptor.enumerable === false && descriptor.writable === false && typeof descriptor.value === "object" && descriptor.value !== null && Object.isFrozen(descriptor.value);
+}
 function isPlainContainer(value) {
 	const proto = Object.getPrototypeOf(value);
 	return Array.isArray(value) ? proto === Array.prototype : proto === Object.prototype || proto === null;
@@ -7761,7 +7765,7 @@ function maskSecretsInError(error, secrets, extraMask) {
 			if (key === "message" || key === "cause" || key === "stack") continue;
 			const descriptor = Object.getOwnPropertyDescriptor(link, key);
 			if (!descriptor) continue;
-			descriptors[key] = typeof key === "string" && CLASSIFIER_IDENTIFIER_FIELDS.has(key) && typeof descriptor.value === "string" || isAuxiliaryAnchor(key, descriptor) ? descriptor : maskDescriptorValue(descriptor, maskText);
+			descriptors[key] = typeof key === "string" && CLASSIFIER_IDENTIFIER_FIELDS.has(key) && typeof descriptor.value === "string" || isAuxiliaryAnchor(key, descriptor) || isCreatedBeforeFailureMark(key, descriptor) ? descriptor : maskDescriptorValue(descriptor, maskText);
 			if (descriptors[key] !== descriptor) changed = true;
 		}
 		let cause = Object.getOwnPropertyDescriptor(link, "cause");
@@ -17975,6 +17979,7 @@ async function resolveGetAtt(getAtt, context) {
 	}
 	const resource = this.lookupResourceRecord(logicalId, "Fn::GetAtt", context);
 	if (!resource) throw markNonRetryable(/* @__PURE__ */ new Error(`Resource ${this.displayMasked(logicalId, context)} not found for Fn::GetAtt`));
+	recordSecretNamedRead(logicalId, void 0, context);
 	if (!(resource.resourceType === "AWS::EC2::VPC" && attributeName === "Ipv6CidrBlocks") && resource.attributes !== void 0) {
 		const storedValue = Object.hasOwn(resource.attributes, attributeName) ? resource.attributes[attributeName] : void 0;
 		const flatValue = isImpossibleEmptyStoredAttribute(resource.resourceType, attributeName, storedValue) ? void 0 : storedValue;
@@ -18028,6 +18033,7 @@ async function resolveGetAtt(getAtt, context) {
 		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${loggedLogicalId}, ${this.displayMasked(attributeName, context)}]: the nested stack ${quotedRender(loggedLogicalId, "'")} declares no output named ${quotedRender(this.displayMasked(this.outputNameLogText(attributeName, context), context), "'")}. Its outputs are ${this.displayMasked(declaredText, context)}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
 	}
 	const value = await this.constructWithStaleRecordHeal(resource, attributeName, context, logicalId);
+	recordSecretNamedRead(logicalId, value, context);
 	this.logger.debug(`Resolved Fn::GetAtt: ${this.logRender(logicalId, context)}.${this.logRender(attributeName, context)} resolved to ${this.logRender(stringifyAttributeForLog(attributeName, this.maskValueLeaves(value, context)), context, {
 		structured: isStructured(value),
 		redacted: isSensitiveAttributeName(attributeName)
@@ -18057,6 +18063,7 @@ function publicNoEchoTokens(context, producer) {
 	return tokens;
 }
 function noteAttributeSecrecy(logicalId, attributeName, value, context) {
+	recordSecretNamedRead(logicalId, value, context);
 	const declared = context.noEchoAttributeResources?.get(logicalId);
 	if ((declared === true || declared !== void 0 && declared.has(attributeName)) && context.recordedSecretValues) recordFreshNoEchoValuesIn(value, context.recordedSecretValues, void 0, this.publicNoEchoTokens(context, logicalId));
 	if (context.redactedAttributeReads !== void 0 && carriesSecretMask(value)) {
@@ -18070,6 +18077,17 @@ function noteAttributeSecrecy(logicalId, attributeName, value, context) {
 	}
 	return value;
 }
+function recordSecretNamedRead(logicalId, value, context) {
+	const bag = context.printingSecrets ?? context.recordedSecretValues;
+	if (bag === void 0 || context.secretNameNeedles === void 0) return;
+	const needles = context.secretNameNeedles(logicalId);
+	if (needles === void 0) return;
+	for (const needle of needles) recordLogOnlyValue(bag, needle);
+	for (const leaf of wholeStringLeavesOf(value)) for (const needle of needles) if (needle.length >= 4 && leaf.includes(needle)) {
+		recordLogOnlyValue(bag, leaf);
+		break;
+	}
+}
 function rejectPlaceholderArnAttribute(resource, attributeName, value, logicalId, context, healOutcome) {
 	if (!isStalePlaceholderArnAttribute(resource.resourceType, attributeName, value)) return;
 	throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: the recorded value ${quotedRender(stringifyValue(this.maskValueLeaves(value, context)), "\"")} is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. ` + this.staleRecordRemedy(healOutcome, context)));
@@ -20197,6 +20215,7 @@ async function resolveRef(logicalId, context, onParameter) {
 	const resource = this.lookupResourceRecord(logicalId, "Ref", context);
 	if (resource) {
 		const refValue = this.resolveRefValue(logicalId, resource, context);
+		recordSecretNamedRead(logicalId, refValue, context);
 		this.logger.debug(`Resolved Ref to resource: ${this.logRender(logicalId, context)} resolved to ${this.logRender(String(refValue), context)}`);
 		return refValue;
 	}
@@ -21997,7 +22016,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-AVCcoXnQ.js");
+			const { ASGProvider } = await import("./asg-provider-BwWy0pBH.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -22103,7 +22122,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-DltlcDiQ.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-D1t9NgT-.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-McCDKyXN.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-Cdp4jX8S.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -22926,6 +22945,10 @@ function withCurrentResourceSecrets(secrets, fn) {
 	const outer = boundSecretBagsStore.getStore() ?? [];
 	return boundSecretBagsStore.run([...outer, secrets], () => currentResourceSecretsStore.run(secrets, fn));
 }
+function withPrintingSecrets(secrets, fn) {
+	const outer = boundSecretBagsStore.getStore() ?? [];
+	return boundSecretBagsStore.run([...outer, secrets], fn);
+}
 function getCurrentResourceSecrets() {
 	return currentResourceSecretsStore.getStore();
 }
@@ -26931,6 +26954,7 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 		...parameterValues && { parameters: parameterValues },
 		...conditions && { conditions }
 	}, stackName);
+	context.printingSecrets = /* @__PURE__ */ new Map();
 	const refuseMaskedOutputReads = (outputKey, ownReads) => {
 		const added = ownReads.filter((read) => read.kind === "ref-state-key");
 		if (added.length === 0) return;
@@ -31062,7 +31086,88 @@ async function readReaderForFreshNoEchoCeiling(logicalId, currentResource, secre
 	}
 }
 function maskForResource(logicalId, text) {
-	return maskSecretsInText(text, this.perResourceSecrets.get(logicalId) ?? EMPTY_SECRETS);
+	return maskSecretsInText(text, this.printingSecretsFor(logicalId) ?? EMPTY_SECRETS);
+}
+function secretNameNeedlesOf(logicalId, record, secrets, options) {
+	const physicalId = typeof record?.physicalId === "string" && record.physicalId !== "" ? record.physicalId : void 0;
+	const bag = secrets !== void 0 && hasMaskableValues(secrets) ? secrets : void 0;
+	const mask = (text) => bag === void 0 ? text : maskSecretsInText(text, bag);
+	const unresolved = (value) => value.includes("{{resolve:") || value === "***";
+	const named = {
+		resourceType: record?.resourceType,
+		properties: record?.properties,
+		logicalId
+	};
+	const needles = /* @__PURE__ */ new Set();
+	const add = (needle) => {
+		if (typeof needle === "string" && needle !== "") needles.add(needle);
+	};
+	for (const [raw, derived] of secretDerivedNamePairs({
+		...named,
+		physicalIds: []
+	})) if (typeof raw === "string" && !unresolved(raw) && isSecretDerivedValue(raw, mask)) add(derived);
+	for (const [raw, spelling] of secretDerivedNamePairs({
+		...named,
+		physicalIds: [physicalId ?? "cdkd-no-physical-id-yet"]
+	})) {
+		if (!isSecretDerivedValue(raw, mask)) continue;
+		if (unresolved(raw)) {
+			if (physicalId === void 0) continue;
+			add(spelling);
+		} else {
+			add(raw);
+			if (raw.toLowerCase() !== raw && raw.length >= 4) add(raw.toLowerCase());
+		}
+	}
+	const properties = record?.properties;
+	const path = properties !== null && typeof properties === "object" && Object.hasOwn(properties, "Path") ? properties["Path"] : void 0;
+	if (physicalId !== void 0 && isSecretDerivedValue(path, mask)) add(physicalId);
+	const embedded = options === void 0 ? secrets : options.embedded;
+	const embeddedBag = embedded !== void 0 && hasMaskableValues(embedded) ? embedded : void 0;
+	if (embeddedBag !== void 0 && physicalId !== void 0) {
+		for (const needle of printingCorpusOf(embeddedBag).keys()) if (needle !== "" && (needle === physicalId || needle.length >= 4 && physicalId.includes(needle))) add(needle);
+	}
+	return needles.size > 0 ? needles : void 0;
+}
+function secretNameBagFor(logicalId) {
+	let bag = this.secretNameNeedles.get(logicalId);
+	if (bag === void 0) {
+		bag = /* @__PURE__ */ new Map();
+		this.secretNameNeedles.set(logicalId, bag);
+	}
+	return bag;
+}
+function noteSecretNamedRecord(logicalId, record) {
+	const needles = secretNameNeedlesOf(logicalId, record, this.namingSecretsFor(logicalId), { embedded: this.perResourceSecrets.get(logicalId) });
+	if (needles === void 0) return void 0;
+	const registry = this.secretNameBagFor(logicalId);
+	for (const needle of needles) recordLogOnlyValue(registry, needle);
+	return needles;
+}
+function namingSecretsFor(logicalId) {
+	const own = this.perResourceSecrets.get(logicalId);
+	const noEcho = this.fingerprintNoEchoValues;
+	if (!hasMaskableValues(noEcho)) return own;
+	return unionOfSecretBags([own, noEcho]);
+}
+function noteSecretNamedReads(logicalId, record, resources) {
+	const leaves = [...wholeStringLeavesOf(record?.properties)].filter((leaf) => leaf !== "");
+	if (leaves.length === 0) return;
+	for (const [otherId, other] of Object.entries(resources)) {
+		if (otherId === logicalId) continue;
+		const needles = secretNameNeedlesOf(otherId, other, this.namingSecretsFor(otherId), { embedded: this.perResourceSecrets.get(otherId) });
+		if (needles === void 0) continue;
+		const read = [...needles].filter((needle) => leaves.some((leaf) => leaf === needle || needle.length >= 4 && leaf.includes(needle)));
+		if (read.length === 0) continue;
+		const registry = this.secretNameBagFor(logicalId);
+		for (const needle of read) recordLogOnlyValue(registry, needle);
+	}
+}
+function printingSecretsFor(logicalId) {
+	const secrets = this.perResourceSecrets.get(logicalId);
+	const registry = this.secretNameNeedles.get(logicalId);
+	if (!hasMaskableValues(registry)) return secrets;
+	return unionOfSecretBags([secrets, registry]);
 }
 function maskedRecordRemedyFor(reads, resources, causeScoped = false) {
 	const NESTED_STACK_RESOURCE_TYPE = "AWS::CloudFormation::Stack";
@@ -31556,6 +31661,82 @@ function isRefusedBeforeApplying(error, logicalId) {
 	return false;
 }
 
+//#endregion
+//#region src/deployment/deploy-engine/resolver-context.ts
+function buildResolverContext(base, stackName) {
+	const recordedSecretValues = /* @__PURE__ */ new Map();
+	if (this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0) inheritNestedStackParameterAssociations(recordedSecretValues, this.options.inheritedSecrets);
+	return {
+		template: base.template,
+		resources: base.resources,
+		...base.parameters && Object.keys(base.parameters).length > 0 && { parameters: base.parameters },
+		...base.conditions && Object.keys(base.conditions).length > 0 && { conditions: base.conditions },
+		stateBackend: this.stateBackend,
+		stackName,
+		...this.exportIndexStore && { exportIndex: this.exportIndexStore },
+		recordedImports: this.recordedImports,
+		recordedOutputReads: this.recordedOutputReads,
+		attributeHealer: (logicalId, resource) => this.healStaleAttributes(logicalId, resource, stackName),
+		...this.options.inheritedSecrets && hasMaskableValues(this.options.inheritedSecrets) && { inheritedSecrets: this.options.inheritedSecrets },
+		recordedSecretValues,
+		noEchoAttributeResources: this.noEchoAttributeResources,
+		secretNameNeedles: (logicalId) => this.noteSecretNamedRecord(logicalId, Object.hasOwn(base.resources, logicalId) ? base.resources[logicalId] : void 0),
+		...base.redactedAttributeReads && { redactedAttributeReads: base.redactedAttributeReads }
+	};
+}
+function printNestedStackReadsOnly(context, resourceType) {
+	if (resourceType === "AWS::CloudFormation::Stack") context.printingSecrets = /* @__PURE__ */ new Map();
+}
+function getAttTargetOf(node) {
+	if (node === null || typeof node !== "object" || Array.isArray(node)) return void 0;
+	const getAtt = node["Fn::GetAtt"];
+	if (Array.isArray(getAtt) && typeof getAtt[0] === "string") return getAtt[0];
+	if (typeof getAtt === "string") return getAtt.split(".")[0];
+}
+function maskedInputSources(template, resources, conditions, stackName) {
+	const parameters = this.fingerprintParameters;
+	if (parameters === void 0) return void 0;
+	return {
+		template,
+		parameterInput: parameters.parameterInput,
+		conditions,
+		childTemplate: this.fingerprintChildTemplates,
+		resolve: async (node) => {
+			const { attributeHealer: _healer, ...base } = this.buildResolverContext({
+				template,
+				resources,
+				parameters: parameters.bound,
+				...conditions && { conditions }
+			}, stackName);
+			const context = {
+				...base,
+				recordedImports: [],
+				recordedOutputReads: [],
+				bestEffort: true,
+				skipDynamicReferences: true,
+				staleAttributeHeal: { phase: "probe" },
+				printingSecrets: /* @__PURE__ */ new Map()
+			};
+			const value = await this.resolver.resolve(structuredClone(node), context);
+			const secrets = context.recordedSecretValues;
+			const target = getAttTargetOf(node);
+			const targetSecrets = target === void 0 ? void 0 : this.perResourceSecrets.get(target);
+			if (targetSecrets !== void 0 && hasMaskableValues(targetSecrets)) {
+				const probe = { value };
+				const redacted = redactSecretsForState(probe, targetSecrets);
+				if (JSON.stringify(redacted) !== JSON.stringify(probe)) return {
+					value,
+					keepAsWritten: true
+				};
+			}
+			return {
+				value,
+				...secrets && { secrets }
+			};
+		}
+	};
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/create.ts
 async function provisionCreate(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
@@ -31570,7 +31751,12 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 		redactedAttributeReads: []
 	}, stackName);
 	if (context.recordedSecretValues) this.perResourceSecrets.set(logicalId, context.recordedSecretValues);
+	printNestedStackReadsOnly(context, resourceType);
 	const resolvedProps = await this.resolver.resolve(desiredProps, context);
+	this.noteSecretNamedRecord(logicalId, {
+		resourceType,
+		properties: resolvedProps
+	});
 	this.refuseRedactedAttributeReads(logicalId, resourceType, context);
 	this.perResourceTemplateProps.set(logicalId, desiredProps);
 	const fingerprintSources = template && this.maskedInputSources(template, stateResources, conditions, stackName);
@@ -34462,7 +34648,13 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	}, stackName);
 	const updateSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
 	this.perResourceSecrets.set(logicalId, updateSecrets);
+	printNestedStackReadsOnly(context, resourceType);
 	const resolvedProps = await this.resolver.resolve(desiredProps, context);
+	this.noteSecretNamedRecord(logicalId, {
+		resourceType,
+		physicalId: stateResources[logicalId]?.physicalId,
+		properties: resolvedProps
+	});
 	this.perResourceTemplateProps.set(logicalId, desiredProps);
 	this.perResourceResolvedType.set(logicalId, resourceType);
 	recordNestedStackParameterExpressions(updateSecrets, resourceType, resolvedProps, desiredProps);
@@ -35088,7 +35280,14 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 			captureProvider = replProvider;
 		} else throw updateError;
 	}
-	if (result.wasReplaced) this.logger.info(`Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`);
+	if (result.wasReplaced) {
+		this.noteSecretNamedRecord(logicalId, {
+			resourceType,
+			physicalId: result.physicalId,
+			properties: resolvedProps
+		});
+		this.logger.info(`Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`);
+	}
 	const dischargedByReplacement = result.wasReplaced === true && result.physicalId !== currentResource.physicalId;
 	const keepsParameterRefusal = !dischargedByReplacement && hasUnverifiableParameterRefusal(currentResource);
 	const carriedAttributes = result.attributes ?? (result.wasReplaced ? void 0 : currentResource.attributes);
@@ -35184,21 +35383,32 @@ async function provisionDelete(logicalId, change, stateResources, stackName, tem
 		const skipPrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
 		renderer.removeTask(logicalId);
 		this.logger.info(`${skipPrefix}${formatResourceLine("skipped", logicalId, resourceType, `skipped (${deleteSkipped})`)}`);
-		this.logger.warn(deleteSkippedMessage(logicalId, currentResource.physicalId, deleteSkipped, "while removing it from the template") + `. Its cdkd state record was KEPT, so the next 'cdkd deploy' re-attempts the delete. Repair the record first (for a nested stack it is the CHILD's own state, whose other resources may already be gone), or delete the resource by hand and drop the record.\nInspect it with: ${pasteableCommand("cdkd state show", [{
-			value: stackName,
-			hole: "stack"
-		}, {
-			flag: "--stack-region",
-			value: this.stackRegion,
-			hole: "region"
-		}]).command}\nDrop the record with: ${pasteableCommand("cdkd state orphan", [{
-			value: stackName,
-			hole: "stack"
-		}, {
+		const nested = resourceType === "AWS::CloudFormation::Stack";
+		const recordStack = nested ? nestedChildStackName(stackName, logicalId) : stackName;
+		const interrupted = nested && deleteSkipped.endsWith(" was interrupted");
+		const stackArg = {
+			value: recordStack,
+			hole: nested ? "child-stack" : "stack",
+			opts: { plainIdent: true }
+		};
+		this.logger.warn(deleteSkippedMessage(logicalId, currentResource.physicalId, deleteSkipped, "while removing it from the template") + ". Its cdkd state record was KEPT, so the next 'cdkd deploy' re-attempts the delete. Repair the record first (for a nested stack it is the CHILD's own state, whose other resources may already be gone), or delete the resource by hand and drop the record." + (interrupted ? " The commands name the child stack record. Its destroy was interrupted: re-run 'cdkd deploy' to resume it, and drop the child record only if that cannot finish, after deleting by hand what the child still holds (the inspect command with --show-nested lists every level; a child with nested stacks of its own has records under '<child>~<logicalId>' too, each needing the same drop)." : nested ? " The commands name the child stack record. Dropping it drops every record the child still has and nothing reaches those resources again, so first delete by hand what the child still holds (the inspect command with --show-nested lists every level; a child with nested stacks of its own has records under '<child>~<logicalId>' too, each needing the same drop). The next 'cdkd deploy' then removes this row." : " Keep '--resource' on the drop: without it the command drops the record of every resource in this still-deployed stack.") + `\nInspect it with: ${pasteableCommand("cdkd state show", [stackArg, {
 			flag: "--stack-region",
 			value: this.stackRegion,
 			hole: "region"
-		}]).command}`);
+		}]).command}\nDrop the record with: ${pasteableCommand("cdkd state orphan", [
+			stackArg,
+			{
+				flag: "--stack-region",
+				value: this.stackRegion,
+				hole: "region"
+			},
+			...nested ? [] : [{
+				flag: "--resource",
+				value: logicalId,
+				hole: "logicalId",
+				opts: { plainIdent: true }
+			}]
+		]).command}`);
 		if (counts) counts.deleteSkipped++;
 		return { deleteSkipped };
 	}
@@ -35343,10 +35553,13 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 	let updatePartial;
 	const physicalIdBeforeUpdate = stateResources[logicalId]?.physicalId;
 	const provisionedByBeforeUpdate = stateResources[logicalId]?.provisionedBy;
+	this.noteSecretNamedRecord(logicalId, stateResources[logicalId]);
+	if (change.changeType === "DELETE") this.noteSecretNamedReads(logicalId, stateResources[logicalId], stateResources);
+	const printingRegistry = this.secretNameBagFor(logicalId);
 	let nestedChildUnaddressed;
 	const deleteGuards = [];
 	try {
-		await withResourceDeadline(async () => {
+		await withPrintingSecrets(printingRegistry, () => withResourceDeadline(async () => {
 			try {
 				const { value: bodyResult, unaddressed } = await collectDeleteGuards(deleteGuards, () => collectNestedChildUnaddressed(() => this.provisionResourceBody(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress)));
 				deleteSkipped = bodyResult?.deleteSkipped;
@@ -35360,7 +35573,7 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 					logicalId,
 					resourceType: guard.resourceType,
 					...guard.provisionedBy && { provisionedBy: guard.provisionedBy },
-					...guard.physicalId && { physicalId: this.maskForResource(logicalId, guard.physicalId) },
+					...guard.physicalId && { physicalId: maskSecretsInText(guard.physicalId, this.perResourceSecrets.get(logicalId) ?? EMPTY_SECRETS) },
 					guard: guard.guard,
 					reason: guard.reason
 				});
@@ -35379,7 +35592,7 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 				});
 			},
 			onTimeout: (elapsedMs) => new ResourceTimeoutError(logicalId, resourceType, this.stackRegion, elapsedMs, operationKind, timeoutMs)
-		});
+		}));
 		if (counts && nestedChildUnaddressed) {
 			counts.deleteSkipped += nestedChildUnaddressed.deleteSkipped;
 			counts.updatePartial += nestedChildUnaddressed.updatePartial;
@@ -35436,7 +35649,7 @@ async function provisionResource(logicalId, change, stateResources, stackName, t
 			durationMs: Date.now() - resourceStartedAt,
 			error: extractDeploymentEventError(error)
 		});
-		throw new ProvisioningError(`Failed to ${change.changeType.toLowerCase()} resource ${logicalId}`, resourceType, logicalId, stateResources[logicalId]?.physicalId, error instanceof Error ? maskSecretsInError(error, this.perResourceSecrets.get(logicalId) ?? EMPTY_SECRETS) : void 0);
+		throw new ProvisioningError(`Failed to ${change.changeType.toLowerCase()} resource ${logicalId}`, resourceType, logicalId, stateResources[logicalId]?.physicalId, error instanceof Error ? maskSecretsInError(error, this.printingSecretsFor(logicalId) ?? EMPTY_SECRETS) : void 0);
 	} finally {
 		renderer.removeTask(logicalId);
 	}
@@ -36899,77 +37112,6 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 	}
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/resolver-context.ts
-function buildResolverContext(base, stackName) {
-	const recordedSecretValues = /* @__PURE__ */ new Map();
-	if (this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0) inheritNestedStackParameterAssociations(recordedSecretValues, this.options.inheritedSecrets);
-	return {
-		template: base.template,
-		resources: base.resources,
-		...base.parameters && Object.keys(base.parameters).length > 0 && { parameters: base.parameters },
-		...base.conditions && Object.keys(base.conditions).length > 0 && { conditions: base.conditions },
-		stateBackend: this.stateBackend,
-		stackName,
-		...this.exportIndexStore && { exportIndex: this.exportIndexStore },
-		recordedImports: this.recordedImports,
-		recordedOutputReads: this.recordedOutputReads,
-		attributeHealer: (logicalId, resource) => this.healStaleAttributes(logicalId, resource, stackName),
-		...this.options.inheritedSecrets && hasMaskableValues(this.options.inheritedSecrets) && { inheritedSecrets: this.options.inheritedSecrets },
-		recordedSecretValues,
-		noEchoAttributeResources: this.noEchoAttributeResources,
-		...base.redactedAttributeReads && { redactedAttributeReads: base.redactedAttributeReads }
-	};
-}
-function getAttTargetOf(node) {
-	if (node === null || typeof node !== "object" || Array.isArray(node)) return void 0;
-	const getAtt = node["Fn::GetAtt"];
-	if (Array.isArray(getAtt) && typeof getAtt[0] === "string") return getAtt[0];
-	if (typeof getAtt === "string") return getAtt.split(".")[0];
-}
-function maskedInputSources(template, resources, conditions, stackName) {
-	const parameters = this.fingerprintParameters;
-	if (parameters === void 0) return void 0;
-	return {
-		template,
-		parameterInput: parameters.parameterInput,
-		conditions,
-		childTemplate: this.fingerprintChildTemplates,
-		resolve: async (node) => {
-			const { attributeHealer: _healer, ...base } = this.buildResolverContext({
-				template,
-				resources,
-				parameters: parameters.bound,
-				...conditions && { conditions }
-			}, stackName);
-			const context = {
-				...base,
-				recordedImports: [],
-				recordedOutputReads: [],
-				bestEffort: true,
-				skipDynamicReferences: true,
-				staleAttributeHeal: { phase: "probe" }
-			};
-			const value = await this.resolver.resolve(structuredClone(node), context);
-			const secrets = context.recordedSecretValues;
-			const target = getAttTargetOf(node);
-			const targetSecrets = target === void 0 ? void 0 : this.perResourceSecrets.get(target);
-			if (targetSecrets !== void 0 && hasMaskableValues(targetSecrets)) {
-				const probe = { value };
-				const redacted = redactSecretsForState(probe, targetSecrets);
-				if (JSON.stringify(redacted) !== JSON.stringify(probe)) return {
-					value,
-					keepAsWritten: true
-				};
-			}
-			return {
-				value,
-				...secrets && { secrets }
-			};
-		}
-	};
-}
-
 //#endregion
 //#region src/deployment/label-routing.ts
 function deriveLabelRouting(change, existingState, registry, forceCcApi = false) {
@@ -37190,6 +37332,7 @@ var DeployEngine = class {
 	recordedOutputReads = [];
 	perResourceSecrets = /* @__PURE__ */ new Map();
 	noEchoAttributeResources = /* @__PURE__ */ new Map();
+	secretNameNeedles = /* @__PURE__ */ new Map();
 	perResourceTemplateProps = /* @__PURE__ */ new Map();
 	perResourceResolvedType = /* @__PURE__ */ new Map();
 	fingerprintNoEchoValues = void 0;
@@ -37242,6 +37385,7 @@ var DeployEngine = class {
 		this.recordedOutputReads = [];
 		this.perResourceSecrets = /* @__PURE__ */ new Map();
 		this.noEchoAttributeResources = /* @__PURE__ */ new Map();
+		this.secretNameNeedles = /* @__PURE__ */ new Map();
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
 		this.constructPathTemplate = void 0;
 		this.perResourceResolvedType = /* @__PURE__ */ new Map();
@@ -37357,7 +37501,7 @@ var DeployEngine = class {
 		} catch {}
 	}
 	maskSecretsInEvent(event) {
-		const secrets = event.logicalId ? this.perResourceSecrets.get(event.logicalId) : void 0;
+		const secrets = event.logicalId ? this.printingSecretsFor(event.logicalId) : void 0;
 		if (!secrets || !hasMaskableValues(secrets)) return event;
 		const next = { ...event };
 		if (next.error?.message) next.error = {
@@ -37433,6 +37577,11 @@ DeployEngine.prototype.refuseRedactedAttributeReads = refuseRedactedAttributeRea
 DeployEngine.prototype.allRecordedSecrets = allRecordedSecrets;
 DeployEngine.prototype.readReaderForFreshNoEchoCeiling = readReaderForFreshNoEchoCeiling;
 DeployEngine.prototype.maskForResource = maskForResource;
+DeployEngine.prototype.secretNameBagFor = secretNameBagFor;
+DeployEngine.prototype.noteSecretNamedRecord = noteSecretNamedRecord;
+DeployEngine.prototype.printingSecretsFor = printingSecretsFor;
+DeployEngine.prototype.namingSecretsFor = namingSecretsFor;
+DeployEngine.prototype.noteSecretNamedReads = noteSecretNamedReads;
 DeployEngine.prototype.kickOffObservedCapture = kickOffObservedCapture;
 DeployEngine.prototype.drainObservedCaptures = drainObservedCaptures;
 DeployEngine.prototype.buildObservedCaptureSiblings = buildObservedCaptureSiblings;
@@ -37458,4 +37607,4 @@ DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice
 
 //#endregion
 export { resourcesNamingDeclaredParameter as $, dynamicReferenceTokens as $a, withoutSilentDropProperties as $i, reEnableInstanceApiTermination as $n, resolveDockerContextDirectory as $o, malformedExportSourceWarning as $r, absoluteAssemblyPathEscape as $s, displayTextOrWithheld as $t, resolveDynamoDbDeleteBudgetClock as A, DagBuilder as Aa, refuseMalformedResourceEntriesForImport as Ai, definedAttributes as An, orphansAfterRollback as Ao, keepsSecretReferenceToken as Ar, resolveUseCdkBootstrapAssets as As, resolveReplacementOldType as At, getPriorAttempts as B, printingCorpusOf as Ba, refuseMalformedState as Bi, ccProtectionRegistryTypes as Bn, rewriteTemplateAssetReferences as Bo, STATE_REGION_DIVERGED as Br, decodeListingKey as Bs, isFinalSnapshotError as Bt, perType as C, prefetchCreateOnlyPropertyPaths as Ca, refuseMalformedOrphansForOrphan as Ci, DBPROXY_TAGS_WHAT as Cn, exportNamesCarriedFrom as Co, isUnboundTemplateParameter as Cr, loadCdkJson as Cs, getStackRecords as Ct, beginDeleteWait as D, canonicalLambdaFunctionName as Da, refuseMalformedResourceEntries as Di, refuseMalformedDesiredTags as Dn, importableOutputKeys as Do, carriesDynamicReference as Dr, resolveSkipPrefix as Ds, isJournaledOrphan as Dt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as E, withRetry as Ea, refuseMalformedResourceAttributesForOrphan as Ei, readTagList as En, hasUnverifiableParameterRefusal as Eo, isImpossibleEmptyStoredAttribute as Er, resolveCaptureObservedState as Es, demoteSupersededOrphans as Et, waitForIndexesSettled as F, carryLogOnlyValues as Fa, refuseMalformedResourcePropertiesForExport as Fi, wouldReturnToSdkProvider as Fn, stringifyValue as Fo, parseWebACLArn as Fr, CFN_TEMPLATE_URL_LIMIT as Fs, PRE_DELETE_SNAPSHOT_TYPES as Ft, cyan as G, errorCauseChain as Ga, repairMalformedResourcePropertiesForReadOnly as Gi, withIndeterminateGuard as Gn, getBootstrapMarkerKey as Go, displayLogicalId as Gr, AssemblyReader as Gs, redactedDeleteAddressFields as Gt, formatResourceLine as H, recordLogOnlyValue as Ha, repairMalformedOrphansForReadOnly as Hi, UNSPECIFIED_SKIP_REASON as Hn, BOOTSTRAP_MARKER_PREFIX as Ho, UNREADABLE_ORPHANS_CONTAINER_ROW as Hr, PARTITION_TABLE as Hs, unsupportedFinalSnapshotError as Ht, ECR_AUTO_DELETE_IMAGES_TAG as I, createUnionSecretMasker as Ia, refuseMalformedResourcePropertiesForOrphan as Ii, isCustomResourceType as In, WorkGraph as Io, withSharedDrainBudget as Ir, MIGRATE_TMP_PREFIX as Is, buildFinalSnapshotIdentifier as It, red as J, markSameGenerationBag as Ja, unreadableOrphanRecords as Ji, disableInstanceApiTermination as Jn, readBootstrapMarkerBody as Jo, hasReadableResources as Jr, defineOwnKey as Js, updatePartialReason as Jt, gray as K, maskSecretsInError as Ka, repairMalformedResourcesForReadOnly as Ki, isWaitAbandonedError as Kn, isCrossRegionRedirect as Ko, hasReadableOrphans as Kr, StageLoadError as Ks, redactedDeleteAddressSkip as Kt, S3_AUTO_DELETE_OBJECTS_TAG as L, hasMaskableValues as La, refuseMalformedResourcesForDeploy as Li, getCurrentResourceSecrets as Ln, buildAssetRedirectMap as Lo, parameterInputsFor as Lr, findLargeInlineResources as Ls, ccRoutedFinalSnapshotError as Lt, DELETE_INDEX_WAIT_PROCEED_NOTE as M, liveMatchesUnresolvedTokenFrame as Ma, refuseMalformedResourceEntriesForOrphan as Mi, CC_BROKEN_REASON as Mn, shouldRetainResource as Mo, cfnRefValueFromPhysicalId as Mr, warnDeprecatedNoPrefixCliFlag as Ms, getCurrentProducerRegions as Mt, INDEX_SETTLE_POLL_INTERVAL_MS as N, inheritNestedStackParameterAssociations as Na, refuseMalformedResourcePropertiesForDestroy as Ni, ProviderRegistry as Nn, AssetPublisher as No, isStalePlaceholderArnAttribute as Nr, ssmResolvedValueType as Ns, inheritProducerRegions as Nt, compensateRemovedDeletionProtection as O, lambdaFunctionNameForMask as Oa, refuseMalformedResourceEntriesForDeploy as Oi, tagMapAsList as On, importableOutputs as Oo, carriesFetchableDynamicReference as Or, resolveStateBucketWithDefault as Os, planFailedOps as Ot, deleteTableWithIndexBusyRetry as P, recordNestedStackParameterExpressions as Pa, refuseMalformedResourcePropertiesForDrift as Pi, ccBrokenReason as Pn, isSensitiveAttributeName as Po, refStateLookupFromResource as Pr, CFN_TEMPLATE_BODY_LIMIT as Ps, ATOMIC_FINAL_SNAPSHOT_TYPES as Pt, reachableDivergentParameters as Q, DYNAMIC_REFERENCE_TOKEN_SCAN as Qa, unwrittenCreateOnlyReplacement as Qi, reDisableInstanceApiTermination as Qn, buildDockerImage as Qo, malformedExportNamesWarning as Qr, ownValue as Qs, WITHHELD_NAME_DISPLAY as Qt, hasCdkAutoDeleteTag as R, literalSplitDelimitersOf as Ra, refuseMalformedResourcesForDestroy as Ri, CloudControlProvider as Rn, createAssetRedirectResolver as Ro, passedParameterClassesOf as Rr, uploadCfnTemplate as Rs, createPreDeleteFinalSnapshot as Rt, isProtectionValueActive as S, requireConfigString as Sa, refuseMalformedOrphansForDestroy as Si, acquireIdempotencyToken as Sn, describeRegionValueKind as So, coerceParameterTypedValue as Sr, getLegacyStateBucketName as Ss, destroyStackRecordsView as St, DynamoDBGlobalTableProvider as T, describeTypeWithThrottleRetry as Ta, refuseMalformedOutputsForDestroy as Ti, planTagDiff as Tn, hasReasonlessBaselineRefusal as To, getAccountInfo as Tr, resolveAutoAssetStorage as Ts, recordAfterRollbackUpdate as Tt, createReadOnlyAttributeHealerFactory as U, shareLogOnlyValues as Ua, repairMalformedOutputsForReadOnly as Ui, deleteIndeterminateGuards as Un, assertAssetBucketRegion as Uo, UNREADABLE_RESOURCES_MAP_ROW as Ur, canonicalizeRegion as Us, REDACTED_DELETE_ADDRESS_SKIP_REASON as Ut, markRefusedBeforeApplying as V, recordLogOnlyParameterValue as Va, repairMalformedOrphanRecordsForReadOnly as Vi, unchangedBehindSecretReference as Vn, AssetModeResolver as Vo, STATE_RESOURCES_MALFORMED as Vr, expectedOwnerParam as Vs, refusesFinalSnapshot as Vt, bold as W, createSecretMasker as Wa, repairMalformedResourceEntriesForReadOnly as Wi, deleteSkipReason as Wn, ensureAssetStorage as Wo, deployRefusesOrphanRowsReason as Wr, derivePartitionAndUrlSuffix as Ws, isRedactedRecordedValue as Wt, computeParameterTaint as X, scrubResourceRecord as Xa, findActionableSilentDrops as Xi, isTerminationProtectionPropagationError as Xn, validateContainerRepoName as Xo, isReadableResourceEntry as Xr, hasPlainPrototype$1 as Xs, DeploymentEventsStore as Xt, yellow as Y, redactSecretsForState as Ya, unreadableResourceEntries as Yi, ec2InstanceProtectionSite as Yn, validateAssetBucketName as Yo, isReadableOrphanRecord as Yr, hasOwnKey as Ys, DeploymentEventsReader as Yt, namesAnyDeclaredParameter as Z, recoverMaskedOutput as Za, findSilentDropProperties as Zi, observeThenDisableInstanceApiTermination as Zn, buildDenyExternalAccessPolicy as Zo, malformedDriftResourcePropertiesWarning as Zr, nullPrototypeRecord as Zs, extractDeploymentEventError as Zt, makeCanonicalizePropertiesFn as _, configStringRefusal as _a, refuseDivergentRecordRegionForDestroy as _i, RollbackInlinePolicyWriters as _n, isLockInfoExpired as _o, s3BucketArn as _r, AssetManifestLoader as _s, getCurrentNestedStackContext as _t, findNestedTemplateTreeDefect as a, isStatefulRecreateTargetForReplace as aa, resolveBucketRegion as ac, malformedOrphanRowsKeptWarning as ai, isWholeDynamicReferenceValue as an, recordMaskOnlyValue as ao, regionLessSecretName as ar, formatDockerLoginError as as, makeSiblingClaimReader as at, recordedProtectionNote as b, requireConfigArray as ba, refuseMalformedOrphanRecordsForDestroy as bi, reserveStackCreateToken as bn, splitImportedOps as bo, s3BucketRegionalDomainName as br, synthesisStatusMessage as bs, replayRollback as bt, renderNestedTemplateTreeDefect as c, WARM_THROUGHPUT_MEMBERS as ca, malformedOutputsRefusalMessage as ci, collectPublishedOutputNames as cn, recordProvenPublicExpression as co, assertSendableRoleArn as cr, isMalformedEnvKey as cs, displacedOpClause as ct, conditionInputsFrom as d, toCfnInteger as da, malformedResourceEntriesWarning as di, DEFAULT_RESOURCE_TIMEOUT_MS as dn, STATE_SOURCED_CROSS_GENERATION_RULES as do, sendableAssumeRoleCommand as dr, redactedDockerCause as ds, getNestedRevertRun as dt, NO_CC_HANDLERS_REASON as ea, describeFileReadFailure as ec, malformedLocalOutputsWarning as ei, exportAliasCollisionScrubWarning as en, isUncertifiedBaselineMaskPosition as eo, DiffCalculator as er, describeDockerCapturedOutput as es, deleteJournaledOrphans as et, parentSuppliedValues as f, toFiniteNumber as fa, malformedResourcePropertiesWarning as fi, DEFAULT_RESOURCE_WARN_AFTER_MS as fn, STATE_SOURCED_READBACK_RULES as fo, AWS_CREDENTIAL_ENV_KEYS as fr, runDockerForeground as fs, nestedChildStackName as ft, mergeNoChangeOutputs as g, configIntegerRefusal as ga, previewableOrphanRecords as gi, formatDestructiveChange as gn, LockManager as go, isSettledInstanceState as gr, stripControlChars as gs, withNestedRevertRun as gt, keptWholeReasonText as h, configBooleanRefusal as ha, malformedStateRefusalMessage as hi, findDestructiveChanges as hn, isSingleDynamicReferenceToken as ho, envCredentialsAreAssumedRole as hr, escapeRegExp$3 as hs, revertedNestedRowIds as ht, childTemplateLoader as i, MULTI_REGION_RECREATE_BLOCKED_TYPES as ia, clearBucketRegionCache as ic, malformedOrphanRecordsWarning as ii, exportNameSecretExposure as in, provenPublicValue as io, producerRegionsFromState as ir, finchSecretArgvRefusal as is, sameJournaledOrphans as it, resolveDynamoDbDeleteBudgetMs as j, TemplateParser as ja, refuseMalformedResourceEntriesForImportSave as ji, stringifyIfAssigned as jn, orphansCarriedFrom as jo, AWS_NO_VALUE as jr, stateBucketExistenceConfirmed as js, findNestedStackTypeChanges as jt, deleteBudgetKey as k, sameLambdaFunctionAddress as ka, refuseMalformedResourceEntriesForDestroy as ki, tagPlanWarning as kn, isReadableBag as ko, isNamelessDynamicReferenceError as kr, resolveStateBucketWithDefaultAndSource as ks, planRollback as kt, templateIdentity as l, coerceWarmThroughput as la, malformedOutputsWarning as li, isExportAliasCollision as ln, wholeStringLeavesOf as lo, explicitRoleArnOrThrow as lr, partitionSensitiveEnv as ls, displacedPhysicalIdShown as lt, isSecretBearingReferenceString as m, coerceCfnInteger as ma, malformedScrubResourceEntriesRefusalMessage as mi, constructPathOf as mn, WHOLE_DYNAMIC_REFERENCE_PATTERN as mo, callerEnvCredentials as mr, warnFinchArgvExposure as ms, revertNestedChildFromJournal as mt, IMPLICIT_DELETE_DEPENDENCIES as n, findReplacedReadersOfRecreateTargets as na, renderAssemblyPathEscape as nc, malformedLocalResourcesWarning as ni, secretBearingStateKeyWarning as nn, identityKeyFor as no, IntrinsicFunctionResolver as nr, describeDockerFailure as ns, journaledOrphanLines as nt, isAbsoluteAssetPath as o, isStatefulRecreateTargetSync as oa, malformedOrphansRefusalMessage as oi, noEchoParameterValueSeed as on, recordMaskOnlyValuesIn as oo, applyRoleArnIfSet as or, getDockerCmd as os, planOrphanAdoption as ot, readRecordedConditionVerdicts as p, coerceCfnBoolean as pa, malformedResourcesWarning as pi, maskingRetryLogger as pn, TEMPLATE_SOURCED_RULES as po, applyCallerIdentityCredentials as pr, runDockerStreaming as ps, recordDisplacedSkips as pt, green as q, maskSecretsInText as qa, unpreviewableOrphanRecords as qi, markWaitAbandoned as qn, parseBootstrapMarker as qo, hasReadableOutputs as qr, processStackMessages as qs, updatePartialMessage as qt, computeImplicitDeleteEdges as r, shownType as ra, resolveAssemblyPath as rc, malformedOrphanRecordsRefusalMessage as ri, secretSafeKeyDisplay as rn, carriesSecretMask as ro, classifyReplaySecretRegion as rr, dockerSpawnEnvWithSensitive as rs, loadJournaledOrphans as rt, listNestedTemplateRows as s, renderStatefulReason as sa, malformedOrphansWarning as si, collectDeclaredOutputNames as sn, recordNoEchoAttributeValues as so, assertFlagRoleArn as sr, isDockerClientEnvKey as ss, NESTED_PENDING_PARENT_REASON as st, DeployEngine as t, hasNoCloudControlHandlers as ta, displayAssemblyPath as tc, malformedLocalResourceEntriesWarning as ti, secretBearing as tn, pathCrossesDottedKey as to, INTRINSIC_KEYS as tr, describeDockerExecFailure as ts, isHandledOrphan as tt, conditionFingerprint as u, isWarmThroughputDecrease as ua, malformedRenderedContainersWarning as ui, bindingSkippedOutputs as un, STATE_SOURCED_BASELINE_RULES as uo, isIamRoleArn as ur, redactDockerArgvValues as us, dropSettledNestedJournals as ut, withResourceDeadline as v, readConfigString as va, refuseMalformedNestedChildOutputs as vi, earliestDefined as vn, S3StateBackend as vo, s3BucketDomainName as vr, getDockerImageBySourceHash as vs, withNestedStackContext as vt, readProtection as w, templateResourceTypes as wa, refuseMalformedOutputs as wi, DBPROXY_TAG_OPTIONS as wn, hasReadableExportSet as wo, parameterTypeMayLoseSecretIdentity as wr, resolveApp as ws, withStackRecords as wt, PROTECTION_PROPERTY_BY_TYPE as x, requireConfigObject as xa, refuseMalformedOrphans as xi, withCreateTokenLedger as xn, acceptedCreateOnlyDropsOf as xo, s3BucketWebsiteUrl as xr, getDefaultStateBucketName as xs, awaitInFlightSibling as xt, recordedProtectionEvidence as y, replayWarn as ya, refuseMalformedOrphanRecords as yi, ledgerForStack as yn, rebuildClientForBucketRegion as yo, s3BucketDualStackDomainName as yr, Synthesizer as ys, replayFailedOperations as yt, isTruthyCfnBoolean as z, logOnlyValueCount as za, refuseMalformedResourcesForExport as zi, slowCcOperationTimeoutMs as zn, loadPublishableAssetManifest as zo, JSON_LISTING_HOLE_VALUE as zr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as zs, effectiveDeletionPolicy as zt };
-//# sourceMappingURL=deploy-engine-D7204v7Z.js.map
+//# sourceMappingURL=deploy-engine-xlct0Hcm.js.map