@go-to-k/cdkd 0.296.14 → 0.296.16

package/dist/{deploy-engine-Z_zHC0jz.js → deploy-engine-DYAAwd0u.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js"
 import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
 import { $ as protectedReplacementAdvice, $n as isIamPropagationError, $t as AccountIdUnavailableError, A as isQuotableImportValue, An as commandHole, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bt as sanitizeRecoveryValue, Ct as RETRY_AUXILIARY_OWNER, Dn as SHELL_ACTIVE, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as plainOrDescribed, G as runDeleteAttempt, Gn as isNameCooldownError, H as observeThenDisableProtection, Hn as isUpdateUnsupportedError, Ht as DEFAULT_STATE_PREFIX, In as quotedOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jt as withPasteableAwsProfile, Kn as isRecreateRetryableError, Kt as producerRecordKey, L as ProtectionFlipRegistry, Ln as shellBoundedDisplay, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mn as isInertUnquoted, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as pasteableCommand, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE_WHY, Ot as hasCreatedBeforeFailure, Pn as physicalIdShownBesideCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, R as compensateProtectionFlip, Rn as shellQuote, Rt as formatLockOperation, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Un as hasReplayMayCollide, Ut as injectiveKey, Vt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Wn as isNameCollisionErrorFrom, Xn as formatRetryClassificationSignals, Xt as ambientCredentialConfig, Yn as markReplayMayCollide, Yt as ambientClientDefaults, Zn as isAmbiguousCcHandlerErrorCode, Zt as clientDefaultsFor, _n as ResourceUpdateNotSupportedError, _t as createMaskedLogSinks, ar as isThrottlingError, at as startInterruptWatch, bn as StateError, bt as maskDeep, cr as wrapMaskedAwsError, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as MacroExpansionError, en as AssetError, er as isRetryableTransientError, f as removalWarning, fn as MalformedProducerRecordRefusalError, ft as logicalIdShown, gn as ResourceTimeoutError, gt as stateOrphanRecordRemedy, hn as ProvisioningError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as DependencyError, ir as isMarkedNonRetryable, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, kn as UNSHOWABLE_VALUE, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, m as withoutInjectedRemovals, mt as resourceTypeShown, nr as retryClassificationText, on as DynamicReferenceRegionAmbiguousError, or as markNonRetryable, ot as ElapsedBudgetRegistry, qn as isReplayedNameCollisionFrom, rn as CrossAccountSecretRefusalError, sn as IntrinsicResolutionRefusalError, sr as markRedactedCause, st as monotonicNowMs, tn as CdkdError, tr as isTransientServerError, un as LockError, ut as compositeIdSeparatorRefusal, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as normalizeAwsError, wt as carryCreatedBeforeFailure, xn as SynthesisError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as withheldTargetClause, zt as formatLockOwner } from "./iam-policy-targets-BoZuWtxK.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-1NhJbqzi.js";
+import { t as getCdkdVersion } from "./version-BUhQCsJ3.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1423,6 +1423,9 @@ const PARTITION_TABLE = [
 function canonicalizeRegion(region) {
 	return typeof region === "string" ? region.toLowerCase() : region;
 }
+function sameRegion(a, b) {
+	return canonicalizeRegion(a) === canonicalizeRegion(b);
+}
 function derivePartitionAndUrlSuffix(region) {
 	const canonical = canonicalizeRegion(region);
 	for (const { prefix, partition, urlSuffix } of PARTITION_TABLE) if (canonical.startsWith(prefix)) return {
@@ -6656,217 +6659,6 @@ function positionByCrossStackSource(bag, source, secrets) {
 	return certifiedExpressionForLeaf(secrets, association, bag);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/placeholder-positions.ts
-function keyedPart(source) {
-	const key = crossStackSourceKey(source);
-	return key === void 0 ? UNKNOWN_PART : { key };
-}
-const MAX_PLACEHOLDER_DEPTH = 8;
-function pushPlaceholderPart(out, part, budget) {
-	if (budget.remaining <= 0) {
-		budget.exhausted = true;
-		return;
-	}
-	budget.remaining -= 1;
-	out.push(part);
-}
-function appendValuePlaceholderParts(value, out, budget, depth) {
-	if (budget.exhausted) return;
-	const literal = joinPartLiteralText(value);
-	if (literal !== void 0) return pushPlaceholderPart(out, literal, budget);
-	if (isPlainObject$4(value) && Object.keys(value).length === 1) {
-		const ref = value["Ref"];
-		if (typeof ref === "string" && ref !== "") return pushPlaceholderPart(out, keyedPart({ Ref: ref }), budget);
-		if (depth >= MAX_PLACEHOLDER_DEPTH) {
-			budget.exhausted = true;
-			return;
-		}
-		if (appendParameterPlaceholderParts(value, out, budget, depth + 1)) return;
-		return pushPlaceholderPart(out, keyedPart(value), budget);
-	}
-	pushPlaceholderPart(out, UNKNOWN_PART, budget);
-}
-function appendParameterPlaceholderParts(source, out, budget, depth) {
-	const keys = Object.keys(source);
-	if (keys.length !== 1) return false;
-	const key = keys[0];
-	if (key === "Fn::Join") {
-		const args = source[key];
-		if (!Array.isArray(args) || args.length !== 2) return false;
-		const [delimiter, parts] = args;
-		if (typeof delimiter !== "string" || !Array.isArray(parts)) return false;
-		for (let index = 0; index < parts.length && !budget.exhausted; index++) {
-			if (index > 0) pushPlaceholderPart(out, delimiter, budget);
-			appendValuePlaceholderParts(parts[index], out, budget, depth);
-		}
-		return true;
-	}
-	if (key === "Fn::Sub") {
-		const args = source[key];
-		let template;
-		let variables = {};
-		if (typeof args === "string") template = args;
-		else if (Array.isArray(args) && args.length === 2 && isPlainObject$4(args[1])) {
-			template = args[0];
-			variables = args[1];
-		} else return false;
-		if (typeof template !== "string") return false;
-		let cursor = 0;
-		for (const hit of template.matchAll(/\$\{(!)?([^}]*)\}/g)) {
-			if (budget.exhausted) return true;
-			pushPlaceholderPart(out, template.slice(cursor, hit.index), budget);
-			cursor = hit.index + hit[0].length;
-			const name = hit[2] ?? "";
-			if (hit[1] === "!") pushPlaceholderPart(out, `\${${name}}`, budget);
-			else if (name === "") pushPlaceholderPart(out, hit[0], budget);
-			else if (Object.hasOwn(variables, name)) appendValuePlaceholderParts(variables[name], out, budget, depth);
-			else if (name.includes(".")) pushPlaceholderPart(out, keyedPart({ "Fn::GetAtt": name }), budget);
-			else pushPlaceholderPart(out, keyedPart({ Ref: name }), budget);
-		}
-		pushPlaceholderPart(out, template.slice(cursor), budget);
-		return true;
-	}
-	return false;
-}
-function parameterPlaceholderParts(source, bag) {
-	const budget = {
-		remaining: bag.length * 2 + 16,
-		exhausted: false
-	};
-	const out = [];
-	if (!appendParameterPlaceholderParts(source, out, budget, 0)) return void 0;
-	return budget.exhausted ? void 0 : out;
-}
-function positionByParameterPlaceholders(bag, source, secrets) {
-	const associations = crossStackAssociations.get(secrets);
-	if (associations === void 0) return void 0;
-	const spanned = positionByRecordedParameterSpans(bag, source, secrets, associations);
-	if (spanned !== void 0) return spanned;
-	const parts = parameterPlaceholderParts(source, bag);
-	if (parts === void 0) return void 0;
-	const before = ["", ""];
-	const after = ["", ""];
-	let side = before;
-	let unknown = false;
-	let certified = 0;
-	const spans = [];
-	for (const part of parts) {
-		let rendered;
-		let persisted;
-		if (typeof part === "string") {
-			rendered = part;
-			persisted = part;
-		} else {
-			let expression;
-			let plaintext = "";
-			if (part !== UNKNOWN_PART) {
-				const association = associations.get(part.key);
-				if (association !== void 0 && typeof association !== "symbol") {
-					plaintext = association.plaintext;
-					expression = certifiedExpressionForLeaf(secrets, association, plaintext);
-				}
-			}
-			if (expression === void 0) {
-				if (unknown) return void 0;
-				unknown = true;
-				side = after;
-				continue;
-			}
-			rendered = plaintext;
-			persisted = expression;
-			certified += 1;
-			spans.push([
-				side,
-				side[0].length,
-				plaintext.length
-			]);
-		}
-		side[0] += rendered;
-		side[1] += persisted;
-	}
-	if (certified === 0) return void 0;
-	let persisted;
-	if (!unknown) {
-		if (before[0] !== bag) return void 0;
-		persisted = before[1];
-	} else {
-		if (bag.length < before[0].length + after[0].length) return void 0;
-		if (!bag.startsWith(before[0]) || !bag.endsWith(after[0])) return void 0;
-		const middle = bag.slice(before[0].length, bag.length - after[0].length);
-		if (redactSecretsForState(middle, secrets) !== middle) return void 0;
-		persisted = before[1] + middle + after[1];
-	}
-	const afterStart = bag.length - after[0].length;
-	return acceptedPlaceholderRendering(bag, persisted, spans.map(([side, offset, length]) => [(side === before ? 0 : afterStart) + offset, length]), secrets);
-}
-function acceptedPlaceholderRendering(bag, persisted, spans, secrets) {
-	for (const plaintext of secrets.keys()) {
-		if (plaintext.length < 4) continue;
-		for (let at = bag.indexOf(plaintext); at !== -1; at = bag.indexOf(plaintext, at + 1)) {
-			const end = at + plaintext.length;
-			for (const [start, length] of spans) if (at < start + length && end > start && (at < start || end > start + length)) return void 0;
-		}
-	}
-	if (redactSecretsForState(persisted, secrets) !== persisted) return void 0;
-	return persisted;
-}
-function positionByRecordedParameterSpans(bag, source, secrets, associations) {
-	const resolution = intrinsicLeafResolutionOf(secrets, source);
-	if (resolution === void 0 || resolution.output !== bag) return void 0;
-	const recorded = resolution.parameterSpans;
-	if (recorded === void 0) return void 0;
-	let previousEnd = 0;
-	let cursor = 0;
-	let persisted = "";
-	const gaps = [];
-	const certified = [];
-	for (const { start, length, key } of recorded) {
-		if (!(start >= previousEnd && length > 0 && start + length <= bag.length)) return void 0;
-		previousEnd = start + length;
-		const text = bag.slice(start, start + length);
-		const association = associations.get(key);
-		if (association === void 0 || typeof association === "symbol") continue;
-		const expression = certifiedExpressionForLeaf(secrets, association, text);
-		if (expression === void 0) continue;
-		const gap = bag.slice(cursor, start);
-		gaps.push(gap);
-		persisted += gap + expression;
-		certified.push([start, length]);
-		cursor = start + length;
-	}
-	if (certified.length === 0) return void 0;
-	const tail = bag.slice(cursor);
-	gaps.push(tail);
-	persisted += tail;
-	for (const gap of gaps) if (redactSecretsForState(gap, secrets) !== gap) return void 0;
-	return acceptedPlaceholderRendering(bag, persisted, certified, secrets);
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/identity-keys.ts
-const ARRAY_IDENTITY_KEYS = ["Name", "Key"];
-function isUniquelyKeyedBy(items, key) {
-	if (items.length === 0) return false;
-	const seen = /* @__PURE__ */ new Set();
-	for (const item of items) {
-		if (!isPlainObject$4(item) || !Object.hasOwn(item, key)) return false;
-		const id = item[key];
-		if (typeof id !== "string" || id === "") return false;
-		if (seen.has(id)) return false;
-		seen.add(id);
-	}
-	return true;
-}
-function identityKeyFor(bag, source) {
-	for (const key of ARRAY_IDENTITY_KEYS) if (isUniquelyKeyedBy(bag, key) && isUniquelyKeyedBy(source, key)) return key;
-}
-function positionListByCrossStackSource(bag, source, secrets) {
-	const association = associationForSource(source, secrets);
-	if (association === void 0) return void 0;
-	return certifiedListForLeaf(secrets, association, bag);
-}
-
 //#endregion
 //#region src/deployment/secret-redaction/fresh-noecho.ts
 function embedsFreshNoEchoValue(text, secrets, freshClass) {
@@ -6997,6 +6789,7 @@ function recoverMaskedOutput(identity, stackName, region, outputKey) {
 //#region src/deployment/secret-redaction/nested-stack.ts
 const NESTED_STACK_RESOURCE_TYPE$4 = "AWS::CloudFormation::Stack";
 const nestedStackParameterExpressions = /* @__PURE__ */ new WeakMap();
+const renderedParameterSpellings = /* @__PURE__ */ new WeakMap();
 const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, rules = TEMPLATE_DERIVED_RULES) {
 	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$4) return;
@@ -7009,6 +6802,23 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 	if (!isPlainObject$4(resolvedParameters) || !isPlainObject$4(sourceParameters)) return;
 	const positioned = redactSecretsForState(markSameGenerationBag({ ...resolvedParameters }), secrets, sourceParameters, rules);
 	let table = nestedStackParameterExpressions.get(secrets);
+	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
+		const sourceLeaf = sourceParameters[name];
+		if (typeof resolvedValue !== "string" || typeof sourceLeaf !== "string") continue;
+		if (isSingleDynamicReferenceToken(sourceLeaf) || positioned[name] !== sourceLeaf) continue;
+		if (!rendersLiteralTo(sourceLeaf, secrets, resolvedValue)) continue;
+		let rendered = renderedParameterSpellings.get(secrets);
+		if (rendered === void 0) {
+			rendered = /* @__PURE__ */ new Map();
+			renderedParameterSpellings.set(secrets, rendered);
+		}
+		const previous = rendered.get(name);
+		if (previous === void 0) rendered.set(name, {
+			spelling: sourceLeaf,
+			value: resolvedValue
+		});
+		else if (previous?.spelling !== sourceLeaf || previous.value !== resolvedValue) rendered.set(name, null);
+	}
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
 		if (typeof resolvedValue !== "string" || !secrets.has(resolvedValue)) continue;
 		const expression = positioned[name];
@@ -7143,10 +6953,44 @@ function inheritNestedStackParameterAssociations(childSecrets, parentSecrets) {
 }
 function inheritedParameterExpression(parentSecrets, parameterName, resolvedValue) {
 	const association = nestedStackParameterExpressions.get(parentSecrets)?.get(parameterName);
-	if (association === void 0 || typeof association === "symbol") return void 0;
+	if (association === void 0) return renderedParameterSpelling(parentSecrets, parameterName, resolvedValue);
+	if (typeof association === "symbol") return void 0;
 	if (Array.isArray(resolvedValue)) return certifiedListForLeaf(parentSecrets, association, resolvedValue);
 	return certifiedExpressionForLeaf(parentSecrets, association, resolvedValue);
 }
+function renderedParameterSpelling(parentSecrets, parameterName, resolvedValue) {
+	if (typeof resolvedValue !== "string" || parentSecrets.has(resolvedValue)) return void 0;
+	const rendered = renderedParameterSpellings.get(parentSecrets)?.get(parameterName);
+	if (rendered == null || rendered.value !== resolvedValue) return void 0;
+	if (!rendersLiteralTo(rendered.spelling, parentSecrets, resolvedValue)) return void 0;
+	return rendered.spelling;
+}
+function inheritedRenderedToken(parentSecrets, parameterName, value, plaintext) {
+	const spelling = inheritedParameterExpression(parentSecrets, parameterName, value);
+	if (typeof spelling !== "string" || isSingleDynamicReferenceToken(spelling)) return void 0;
+	return renderedTokenOf(spelling, parentSecrets, plaintext);
+}
+function withdrawRenderedParameterSpelling(parentSecrets, parameterName) {
+	const rendered = renderedParameterSpellings.get(parentSecrets);
+	if (rendered?.has(parameterName)) rendered.set(parameterName, null);
+}
+function inheritedRenderedSpan(childSecrets, key, text) {
+	const reads = inheritedParameterReads.get(childSecrets);
+	if (reads === void 0 || typeof reads === "symbol") return void 0;
+	for (const name of reads.names) {
+		if (crossStackSourceKey({ Ref: name }) !== key) continue;
+		const value = renderedParameterSpellings.get(reads.parent)?.get(name)?.value;
+		if (value === void 0 || text !== void 0 && text !== value) return void 0;
+		if (carriesChildOnlyPlaintext(value, childSecrets, reads.parent)) return void 0;
+		const spelling = inheritedParameterExpression(reads.parent, name, value);
+		if (typeof spelling !== "string") return void 0;
+		if (redactSecretsForState(spelling, childSecrets) !== spelling) return void 0;
+		return {
+			value,
+			spelling
+		};
+	}
+}
 const inheritedParameterReads = /* @__PURE__ */ new WeakMap();
 const POISONED_PARAMETER_READS = Symbol("cdkd.inherited-parameter-reads.poisoned");
 function recordInheritedParameterRead(childSecrets, parentSecrets, parameterName) {
@@ -7196,6 +7040,222 @@ function carriesChildOnlyPlaintext(value, childSecrets, parentSecrets) {
 	return visit(value);
 }
 
+//#endregion
+//#region src/deployment/secret-redaction/placeholder-positions.ts
+function keyedPart(source) {
+	const key = crossStackSourceKey(source);
+	return key === void 0 ? UNKNOWN_PART : { key };
+}
+const MAX_PLACEHOLDER_DEPTH = 8;
+function pushPlaceholderPart(out, part, budget) {
+	if (budget.remaining <= 0) {
+		budget.exhausted = true;
+		return;
+	}
+	budget.remaining -= 1;
+	out.push(part);
+}
+function appendValuePlaceholderParts(value, out, budget, depth) {
+	if (budget.exhausted) return;
+	const literal = joinPartLiteralText(value);
+	if (literal !== void 0) return pushPlaceholderPart(out, literal, budget);
+	if (isPlainObject$4(value) && Object.keys(value).length === 1) {
+		const ref = value["Ref"];
+		if (typeof ref === "string" && ref !== "") return pushPlaceholderPart(out, keyedPart({ Ref: ref }), budget);
+		if (depth >= MAX_PLACEHOLDER_DEPTH) {
+			budget.exhausted = true;
+			return;
+		}
+		if (appendParameterPlaceholderParts(value, out, budget, depth + 1)) return;
+		return pushPlaceholderPart(out, keyedPart(value), budget);
+	}
+	pushPlaceholderPart(out, UNKNOWN_PART, budget);
+}
+function appendParameterPlaceholderParts(source, out, budget, depth) {
+	const keys = Object.keys(source);
+	if (keys.length !== 1) return false;
+	const key = keys[0];
+	if (key === "Fn::Join") {
+		const args = source[key];
+		if (!Array.isArray(args) || args.length !== 2) return false;
+		const [delimiter, parts] = args;
+		if (typeof delimiter !== "string" || !Array.isArray(parts)) return false;
+		for (let index = 0; index < parts.length && !budget.exhausted; index++) {
+			if (index > 0) pushPlaceholderPart(out, delimiter, budget);
+			appendValuePlaceholderParts(parts[index], out, budget, depth);
+		}
+		return true;
+	}
+	if (key === "Fn::Sub") {
+		const args = source[key];
+		let template;
+		let variables = {};
+		if (typeof args === "string") template = args;
+		else if (Array.isArray(args) && args.length === 2 && isPlainObject$4(args[1])) {
+			template = args[0];
+			variables = args[1];
+		} else return false;
+		if (typeof template !== "string") return false;
+		let cursor = 0;
+		for (const hit of template.matchAll(/\$\{(!)?([^}]*)\}/g)) {
+			if (budget.exhausted) return true;
+			pushPlaceholderPart(out, template.slice(cursor, hit.index), budget);
+			cursor = hit.index + hit[0].length;
+			const name = hit[2] ?? "";
+			if (hit[1] === "!") pushPlaceholderPart(out, `\${${name}}`, budget);
+			else if (name === "") pushPlaceholderPart(out, hit[0], budget);
+			else if (Object.hasOwn(variables, name)) appendValuePlaceholderParts(variables[name], out, budget, depth);
+			else if (name.includes(".")) pushPlaceholderPart(out, keyedPart({ "Fn::GetAtt": name }), budget);
+			else pushPlaceholderPart(out, keyedPart({ Ref: name }), budget);
+		}
+		pushPlaceholderPart(out, template.slice(cursor), budget);
+		return true;
+	}
+	return false;
+}
+function parameterPlaceholderParts(source, bag) {
+	const budget = {
+		remaining: bag.length * 2 + 16,
+		exhausted: false
+	};
+	const out = [];
+	if (!appendParameterPlaceholderParts(source, out, budget, 0)) return void 0;
+	return budget.exhausted ? void 0 : out;
+}
+function positionByParameterPlaceholders(bag, source, secrets) {
+	const associations = crossStackAssociations.get(secrets);
+	const spanned = positionByRecordedParameterSpans(bag, source, secrets, associations);
+	if (spanned !== void 0) return spanned;
+	const parts = parameterPlaceholderParts(source, bag);
+	if (parts === void 0) return void 0;
+	const before = ["", ""];
+	const after = ["", ""];
+	let side = before;
+	let unknown = false;
+	let certified = 0;
+	const spans = [];
+	for (const part of parts) {
+		let rendered;
+		let persisted;
+		if (typeof part === "string") {
+			rendered = part;
+			persisted = part;
+		} else {
+			let expression;
+			let plaintext = "";
+			if (part !== UNKNOWN_PART) {
+				const association = associations?.get(part.key);
+				if (association !== void 0 && typeof association !== "symbol") {
+					plaintext = association.plaintext;
+					expression = certifiedExpressionForLeaf(secrets, association, plaintext);
+				}
+				if (expression === void 0) {
+					const inherited = inheritedRenderedSpan(secrets, part.key);
+					if (inherited !== void 0) {
+						plaintext = inherited.value;
+						expression = inherited.spelling;
+					}
+				}
+			}
+			if (expression === void 0) {
+				if (unknown) return void 0;
+				unknown = true;
+				side = after;
+				continue;
+			}
+			rendered = plaintext;
+			persisted = expression;
+			certified += 1;
+			spans.push([
+				side,
+				side[0].length,
+				plaintext.length
+			]);
+		}
+		side[0] += rendered;
+		side[1] += persisted;
+	}
+	if (certified === 0) return void 0;
+	let persisted;
+	if (!unknown) {
+		if (before[0] !== bag) return void 0;
+		persisted = before[1];
+	} else {
+		if (bag.length < before[0].length + after[0].length) return void 0;
+		if (!bag.startsWith(before[0]) || !bag.endsWith(after[0])) return void 0;
+		const middle = bag.slice(before[0].length, bag.length - after[0].length);
+		if (redactSecretsForState(middle, secrets) !== middle) return void 0;
+		persisted = before[1] + middle + after[1];
+	}
+	const afterStart = bag.length - after[0].length;
+	return acceptedPlaceholderRendering(bag, persisted, spans.map(([side, offset, length]) => [(side === before ? 0 : afterStart) + offset, length]), secrets);
+}
+function acceptedPlaceholderRendering(bag, persisted, spans, secrets) {
+	for (const plaintext of secrets.keys()) {
+		if (plaintext.length < 4) continue;
+		for (let at = bag.indexOf(plaintext); at !== -1; at = bag.indexOf(plaintext, at + 1)) {
+			const end = at + plaintext.length;
+			for (const [start, length] of spans) if (at < start + length && end > start && (at < start || end > start + length)) return void 0;
+		}
+	}
+	if (redactSecretsForState(persisted, secrets) !== persisted) return void 0;
+	return persisted;
+}
+function positionByRecordedParameterSpans(bag, source, secrets, associations) {
+	const resolution = intrinsicLeafResolutionOf(secrets, source);
+	if (resolution === void 0 || resolution.output !== bag) return void 0;
+	const recorded = resolution.parameterSpans;
+	if (recorded === void 0) return void 0;
+	let previousEnd = 0;
+	let cursor = 0;
+	let persisted = "";
+	const gaps = [];
+	const certified = [];
+	for (const { start, length, key } of recorded) {
+		if (!(start >= previousEnd && length > 0 && start + length <= bag.length)) return void 0;
+		previousEnd = start + length;
+		const text = bag.slice(start, start + length);
+		const association = associations?.get(key);
+		const expression = (association !== void 0 && typeof association !== "symbol" ? certifiedExpressionForLeaf(secrets, association, text) : void 0) ?? inheritedRenderedSpan(secrets, key, text)?.spelling;
+		if (expression === void 0) continue;
+		const gap = bag.slice(cursor, start);
+		gaps.push(gap);
+		persisted += gap + expression;
+		certified.push([start, length]);
+		cursor = start + length;
+	}
+	if (certified.length === 0) return void 0;
+	const tail = bag.slice(cursor);
+	gaps.push(tail);
+	persisted += tail;
+	for (const gap of gaps) if (redactSecretsForState(gap, secrets) !== gap) return void 0;
+	return acceptedPlaceholderRendering(bag, persisted, certified, secrets);
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/identity-keys.ts
+const ARRAY_IDENTITY_KEYS = ["Name", "Key"];
+function isUniquelyKeyedBy(items, key) {
+	if (items.length === 0) return false;
+	const seen = /* @__PURE__ */ new Set();
+	for (const item of items) {
+		if (!isPlainObject$4(item) || !Object.hasOwn(item, key)) return false;
+		const id = item[key];
+		if (typeof id !== "string" || id === "") return false;
+		if (seen.has(id)) return false;
+		seen.add(id);
+	}
+	return true;
+}
+function identityKeyFor(bag, source) {
+	for (const key of ARRAY_IDENTITY_KEYS) if (isUniquelyKeyedBy(bag, key) && isUniquelyKeyedBy(source, key)) return key;
+}
+function positionListByCrossStackSource(bag, source, secrets) {
+	const association = associationForSource(source, secrets);
+	if (association === void 0) return void 0;
+	return certifiedListForLeaf(secrets, association, bag);
+}
+
 //#endregion
 //#region src/deployment/secret-redaction/redact-path.ts
 function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameGeneration) {
@@ -7734,11 +7794,67 @@ function singleSpanFrame(bag, source) {
 }
 function positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration) {
 	const frame = singleSpanFrame(bag, source);
-	if (frame === void 0) return redactSecretsForState(bag, secrets);
+	if (frame === void 0) {
+		if (dynamicReferenceSpans(source).length >= 2 && certifiesRenderedLiteral(bag, source, secrets, bagIsSameGeneration)) return source;
+		return redactSecretsForState(bag, secrets);
+	}
 	const recorded = resolvedPlaintextOf(secrets, frame.token);
 	if (recorded === void 0 || recorded !== frame.middle) return redactSecretsForState(bag, secrets);
 	return writeFramedTokenWithinScanBound(bag, secrets, frame, bagIsSameGeneration);
 }
+function pairedSpans(source, secrets) {
+	const spans = dynamicReferenceSpans(source);
+	if (spans.length === 0) return void 0;
+	const out = [];
+	for (const span of spans) {
+		const plaintext = resolvedPlaintextOf(secrets, source.slice(span.start, span.end));
+		if (plaintext === void 0 || plaintext === "") return void 0;
+		if (isSingleDynamicReferenceToken(plaintext)) return void 0;
+		out.push({
+			...span,
+			plaintext
+		});
+	}
+	return out;
+}
+function renderedTokenOf(spelling, secrets, plaintext) {
+	const spans = pairedSpans(spelling, secrets);
+	if (spans === void 0) return void 0;
+	const tokens = new Set(spans.filter((span) => span.plaintext === plaintext).map((span) => spelling.slice(span.start, span.end)));
+	return tokens.size === 1 ? [...tokens][0] : void 0;
+}
+function renderSpans(source, spans, textOf) {
+	let out = "";
+	let cursor = 0;
+	spans.forEach((span, index) => {
+		out += source.slice(cursor, span.start) + textOf(index);
+		cursor = span.end;
+	});
+	return out + source.slice(cursor);
+}
+function rendersLiteralTo(spelling, secrets, value) {
+	return renderedLiteralSpans(spelling, secrets, value) !== void 0;
+}
+function renderedLiteralSpans(spelling, secrets, value) {
+	const spans = pairedSpans(spelling, secrets);
+	if (spans === void 0) return void 0;
+	if (renderSpans(spelling, spans, (i) => spans[i].plaintext) !== value) return void 0;
+	return redactSecretsForState(spelling, secrets) === spelling ? spans : void 0;
+}
+function certifiesRenderedLiteral(bag, source, secrets, bagIsSameGeneration) {
+	const spans = renderedLiteralSpans(source, secrets, bag);
+	if (spans === void 0) return false;
+	const survivors = [];
+	for (const span of spans) {
+		const survivor = secrets.get(span.plaintext);
+		if (survivor === void 0) return false;
+		survivors.push(survivor);
+	}
+	const scanned = redactSecretsForState(bag, secrets);
+	if (scanned === renderSpans(source, spans, (i) => survivors[i])) return true;
+	if (!bagIsSameGeneration) return false;
+	return scanned === renderSpans(source, spans, (i) => spans[i].plaintext.length >= 4 ? survivors[i] : spans[i].plaintext);
+}
 function writeFramedTokenWithinScanBound(bag, secrets, frame, bagIsSameGeneration) {
 	const scanned = redactSecretsForState(bag, secrets);
 	const { token, prefix, suffix, middle } = frame;
@@ -8656,7 +8772,7 @@ function canonicalJson$3(value) {
 	});
 }
 const PREVIOUS_NOECHO_VALUE = "(previous NoEcho value)";
-function parametersReadBy(node, sources) {
+function noEchoParametersReadBy(node, sources) {
 	return [...sources.parameters].filter((name) => readsNoEchoSource(node, {
 		parameters: /* @__PURE__ */ new Set([name]),
 		...sources.conditions !== void 0 && { conditions: sources.conditions }
@@ -8667,7 +8783,7 @@ function noEchoComparison(options) {
 	return ({ templateProperties, desired, current, record }) => {
 		const coordinates = noEchoCoordinatesOf(templateProperties, desired, sources);
 		const needles = [];
-		for (const name of parametersReadBy(templateProperties, sources)) {
+		for (const name of noEchoParametersReadBy(templateProperties, sources)) {
 			const value = values[name];
 			const leaves = Array.isArray(value) ? value : [value];
 			for (const leaf of leaves) if (typeof leaf === "string" && leaf.length >= minNeedleLength && !isSingleDynamicReferenceToken(leaf)) needles.push(leaf);
@@ -19037,7 +19153,7 @@ async function resolveImportValue(importValueArg, context) {
 }
 function recordImport(context, exportName, producerStack, producerRegion) {
 	if (!context.recordedImports) return;
-	if (context.recordedImports.some((e) => e.exportName === exportName && e.sourceStack === producerStack && e.sourceRegion === producerRegion)) return;
+	if (context.recordedImports.some((e) => e.exportName === exportName && e.sourceStack === producerStack && sameRegion(e.sourceRegion, producerRegion))) return;
 	context.recordedImports.push({
 		exportName,
 		sourceStack: producerStack,
@@ -19089,7 +19205,7 @@ async function fetchAllCfnExports() {
 	return exports;
 }
 async function lookupCfnStackOutputs(stackName, region, context, loggedRegionText) {
-	const cacheKey = injectiveKey(region, stackName, credentialFingerprint(ambientCredentialConfig()));
+	const cacheKey = injectiveKey(canonicalizeRegion(region), stackName, credentialFingerprint(ambientCredentialConfig()));
 	let fetch = this.cfnStackOutputsCache.get(cacheKey);
 	if (!fetch) {
 		fetch = this.fetchCfnStackOutputs(stackName, region);
@@ -19119,7 +19235,8 @@ async function fetchCfnStackOutputs(stackName, region) {
 		throw error;
 	}
 }
-function getCfnClient(region) {
+function getCfnClient(rawRegion) {
+	const region = canonicalizeRegion(rawRegion);
 	const credentialConfig = ambientCredentialConfig();
 	const key = clientCacheKey(region, credentialConfig);
 	let client = this.cfnClients.get(key);
@@ -19161,7 +19278,7 @@ async function resolveGetStackOutput(arg, context) {
 		if (typeof raw !== "string" || raw === "") throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: RoleArn must be a literal string in the template (no Ref / Fn::GetAtt / Fn::Sub allowed for cross-account references). Got ${raw === null ? "null" : Array.isArray(raw) ? "array" : typeof raw}${typeof raw === "object" ? ` (intrinsic shape: ${this.displayMasked(JSON.stringify(raw).slice(0, 80), context)})` : ""}.`));
 		roleArn = raw;
 	}
-	if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: cannot reference own stack ${this.displayMaskedIdent(stackName, context, STACK_REF_MAX_CODE_POINTS)} in the same region ${this.displayMaskedIdent(loggedRegionText, context)}`));
+	if (!roleArn && context.stackName && context.stackName === stackName && sameRegion(region, this.resolverRegion)) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetStackOutput: cannot reference own stack ${this.displayMaskedIdent(stackName, context, STACK_REF_MAX_CODE_POINTS)} in the same region ${this.displayMaskedIdent(loggedRegionText, context)}`));
 	const loggedStackName = this.displayMaskedIdent(stackName, context, STACK_REF_MAX_CODE_POINTS);
 	const loggedOutputName = this.displayMaskedIdent(outputName, context);
 	const loggedRegion = this.displayMasked(loggedRegionText, context);
@@ -19207,7 +19324,7 @@ async function resolveGetStackOutput(arg, context) {
 }
 function recordOutputRead(context, producerStack, producerRegion, outputName) {
 	if (!context.recordedOutputReads) return;
-	if (context.recordedOutputReads.some((e) => e.sourceStack === producerStack && e.sourceRegion === producerRegion && e.outputName === outputName)) return;
+	if (context.recordedOutputReads.some((e) => e.sourceStack === producerStack && sameRegion(e.sourceRegion, producerRegion) && e.outputName === outputName)) return;
 	context.recordedOutputReads.push({
 		sourceStack: producerStack,
 		sourceRegion: producerRegion,
@@ -20819,12 +20936,92 @@ function recordInheritedParameterSecrets(parameterName, value, context) {
 	if (inherited && recorded) recordInheritedNoEchoListElements(this, inherited, recorded, value, context);
 	if (!inherited || inherited.size === 0 || !recorded) return;
 	for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) {
-		const own = inheritedParameterExpression(inherited, parameterName, plaintext);
-		recorded.set(plaintext, typeof own === "string" ? own : expression);
+		recorded.set(plaintext, carriedExpressionFor(inherited, parameterName, value, plaintext, expression));
 		recordInheritedParameterRead(recorded, inherited, parameterName);
 		carryFreshNoEchoMark(inherited, recorded, plaintext);
 	}
 }
+function carriedExpressionFor(inherited, parameterName, value, plaintext, survivor) {
+	const own = inheritedParameterExpression(inherited, parameterName, plaintext);
+	if (typeof own === "string") return own;
+	return inheritedRenderedToken(inherited, parameterName, value, plaintext) ?? survivor;
+}
+function poisonRenderedSpellingsCollidingIn(template, parameterValues, inherited) {
+	if (!inherited || inherited.size === 0 || template === void 0) return;
+	const names = new Set(Object.keys(parameterValues));
+	if (names.size < 2) return;
+	const groups = [];
+	if (template.Resources !== null && typeof template.Resources === "object") for (const resource of Object.values(template.Resources)) groups.push([resource, false]);
+	if (template.Outputs !== void 0) groups.push([template.Outputs, true]);
+	const readsByGroup = groups.map(([group, countBareRefs]) => parameterReadsOf(group, names, countBareRefs)).filter((reads) => reads.size >= 2);
+	const withdrawn = /* @__PURE__ */ new Set();
+	for (;;) {
+		const fresh = [...collidingRenderedNames(readsByGroup, parameterValues, inherited)].filter((name) => !withdrawn.has(name));
+		if (fresh.length === 0) return;
+		for (const name of fresh) {
+			withdrawn.add(name);
+			withdrawRenderedParameterSpelling(inherited, name);
+		}
+	}
+}
+function collidingRenderedNames(readsByGroup, parameterValues, inherited) {
+	const withdraw = /* @__PURE__ */ new Set();
+	for (const reads of readsByGroup) {
+		const byPlaintext = /* @__PURE__ */ new Map();
+		const slotReadPlaintexts = /* @__PURE__ */ new Set();
+		for (const [name, slotRead] of reads) {
+			if (!Object.hasOwn(parameterValues, name)) continue;
+			const value = parameterValues[name];
+			for (const [plaintext, survivor] of inheritedSecretsCarriedBy(value, inherited)) {
+				const expression = carriedExpressionFor(inherited, name, value, plaintext, survivor);
+				const rendered = typeof inheritedParameterExpression(inherited, name, plaintext) !== "string" && inheritedRenderedToken(inherited, name, value, plaintext) !== void 0;
+				let byExpression = byPlaintext.get(plaintext);
+				if (byExpression === void 0) {
+					byExpression = /* @__PURE__ */ new Map();
+					byPlaintext.set(plaintext, byExpression);
+				}
+				let renderedNames = byExpression.get(expression);
+				if (renderedNames === void 0) {
+					renderedNames = [];
+					byExpression.set(expression, renderedNames);
+				}
+				if (rendered) renderedNames.push(name);
+				if (slotRead) slotReadPlaintexts.add(plaintext);
+			}
+		}
+		for (const [plaintext, byExpression] of byPlaintext) {
+			if (byExpression.size < 2 || !slotReadPlaintexts.has(plaintext)) continue;
+			for (const renderedNames of byExpression.values()) for (const name of renderedNames) withdraw.add(name);
+		}
+	}
+	return withdraw;
+}
+const POSITIONED_INTRINSICS = /* @__PURE__ */ new Set(["Fn::Join", "Fn::Sub"]);
+function parameterReadsOf(node, names, countBareRefs) {
+	const reads = /* @__PURE__ */ new Map();
+	const add = (name, slotRead) => {
+		reads.set(name, slotRead || reads.get(name) === true);
+	};
+	const visit = (value, slotRead) => {
+		if (Array.isArray(value)) {
+			for (const element of value) visit(element, slotRead);
+			return;
+		}
+		if (value === null || typeof value !== "object") return;
+		const record = value;
+		const ref = record["Ref"];
+		if (typeof ref === "string" && names.has(ref)) add(ref, slotRead);
+		const sub = record["Fn::Sub"];
+		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
+		if (typeof text === "string") for (const match of text.matchAll(/\$\{([^}!][^}]*)\}/g)) {
+			const name = match[1].trim();
+			if (names.has(name)) add(name, slotRead);
+		}
+		for (const [key, child] of Object.entries(record)) visit(child, slotRead || key.startsWith("Fn::") && !POSITIONED_INTRINSICS.has(key));
+	};
+	visit(node, countBareRefs);
+	return reads;
+}
 function recordInheritedNoEchoListElements(resolver, inherited, recorded, value, context) {
 	if (!Array.isArray(value)) return;
 	const parameterValues = [...inherited.keys()].filter((plaintext) => isNoEchoParameterPlaintext(inherited, plaintext));
@@ -20938,7 +21135,7 @@ function clientsForRegion(targetRegion, targetLogText) {
 	const cacheKey = clientCacheKey(target, ambient.credentialConfig ?? {});
 	const cached = this.regionScopedClients.get(cacheKey);
 	if (cached) return cached;
-	if (canonicalizeRegion(ambient.configuredRegion) === target) return ambient;
+	if (sameRegion(ambient.configuredRegion, target)) return ambient;
 	const scoped = ambient.withRegion(target);
 	this.regionScopedClients.set(cacheKey, scoped);
 	this.logger.debug(`Using region-scoped AWS clients for ${displaySafe(loggedTarget)}`);
@@ -21079,7 +21276,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	resolverForProducerRegion(producerRegion, context, producerRegionLogText) {
 		if (!producerRegion) return this;
 		const target = canonicalizeRegion(producerRegion);
-		if (target === canonicalizeRegion(this.explicitRegion)) return this;
+		if (sameRegion(target, this.explicitRegion)) return this;
 		const regionText = producerRegionLogText !== void 0 ? canonicalizeRegion(producerRegionLogText) : this.regionLogText(producerRegion, context);
 		const guestRegionText = this.displayMasked(regionText, context);
 		const cached = this.producerRegionResolvers.get(target);
@@ -22712,7 +22909,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-eXsnCQh2.js");
+			const { ASGProvider } = await import("./asg-provider-D2eHqx5L.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -22818,7 +23015,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-6YeZRRfW.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-ZYVwKq6K.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-Cbeq5OY8.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-X5T1Zamt.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -27532,6 +27729,20 @@ function exportNameSecretExposure(exportName, substitutedIntoName, recordedThisP
 	}
 	return exposure.size > 0 ? exposure : void 0;
 }
+function carriedExportAliasExposure(exportName, recordedThisPass, noEchoParameterValues) {
+	const carried = /* @__PURE__ */ new Map();
+	shareLogOnlyValues(carried, recordedThisPass);
+	const exposure = exportNameSecretExposure(exportName, carried, recordedThisPass, noEchoParameterValues);
+	if (exposure === void 0) return void 0;
+	return {
+		exposure,
+		noEchoOnly: isNoEchoOnlyExposure(exposure, carried, recordedThisPass)
+	};
+}
+function exportNameNoEchoParameters(exportName, sources) {
+	if (sources === void 0 || exportName === null || typeof exportName !== "object") return [];
+	return noEchoParametersReadBy(exportName, sources);
+}
 function isNoEchoOnlyExposure(exposure, substitutedIntoName, recordedThisPass) {
 	for (const plaintext of exposure.keys()) if (substitutedIntoName.has(plaintext) || recordedThisPass?.has(plaintext) === true) return false;
 	return exposure.size > 0;
@@ -27581,6 +27792,11 @@ function secretBearingExportNameWarning(outputKey, exportName, exposure, secrets
 	if (noEchoOnly) return `Output ${owner} has an Export.Name that resolves to a value containing a secret ${shown}— skipping the export alias. The name contains the value of a NoEcho template parameter, or a value derived from one: the whole name at any length, or embedded at 4 or more characters, even where the match is a coincidence. An export name becomes a key in state.json and in the exports index, where the value would be stored in plaintext. An existing Fn::ImportValue of this name stops resolving. Rename the export, or choose a NoEcho value the name does not contain.`;
 	return `Output ${owner} has an Export.Name that resolves to a value containing a secret ${shown}— skipping the export alias. An export name becomes a key in state.json and in the exports index, and redaction rewrites VALUES only, so publishing it would persist the secret in plaintext. Use a non-secret Export.Name.`;
 }
+function noEchoParameterExportNameWarning(outputKey, parameterNames, secrets) {
+	const owner = displayTextOrWithheld(secretSafeKeyDisplay(outputKey, printingCorpusOf(secrets)));
+	const names = parameterNames.map((name) => displayIdent(name, { listMember: true })).join(", ");
+	return `Output ${owner} has an Export.Name that reads the NoEcho template ${parameterNames.length === 1 ? "parameter" : "parameters"} ${names} — skipping the export alias. An export name becomes a key in state.json and in the exports index, where the value would be stored in plaintext, so a name built from a NoEcho parameter is refused whatever the value's length. An existing Fn::ImportValue of this name stops resolving. Build the Export.Name without the NoEcho parameter.`;
+}
 function mergedExposure(a, b) {
 	if (a === void 0) return b;
 	if (b === void 0) return a;
@@ -27665,6 +27881,7 @@ function handleOutputResolutionFailure(error, outputKey, outputs, secrets, inher
 }
 async function resolveOutputs(template, resources, stackName, digestSource, parameterValues, conditions) {
 	this.resolvedExportNames = [];
+	this.carriedExportAliasRefusal = void 0;
 	if (!template.Outputs) return {};
 	const outputs = Object.create(null);
 	const context = this.buildResolverContext({
@@ -27704,6 +27921,12 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 			}
 		}
 		const noEchoSeed = noEchoParameterValueSeed(template.Parameters, parameterValues, context.inheritedSecrets, this.options.parameters);
+		const noEchoSources = this.noEchoPositionSources(resources, template, conditions);
+		this.carriedExportAliasRefusal = (outputKey, exportName) => {
+			const verdict = carriedExportAliasExposure(exportName, outputsPassSecrets, noEchoSeed);
+			if (verdict === void 0) return void 0;
+			return secretBearingExportNameWarning(outputKey, exportName, verdict.exposure, context.recordedSecretValues, verdict.noEchoOnly);
+		};
 		const resolvedNames = [];
 		for (const [outputKey, output] of Object.entries(template.Outputs)) {
 			if (isOutputSuppressedByCondition(output, conditions)) continue;
@@ -27731,12 +27954,15 @@ async function resolveOutputs(template, resources, stackName, digestSource, para
 				exportName,
 				value,
 				outputValue: output.Value,
+				nameSource: output.Export.Name,
 				nameSecrets
 			});
 		}
-		for (const { outputKey, exportName, value, outputValue, nameSecrets } of resolvedNames) {
-			const exposure = exportNameSecretExposure(exportName, nameSecrets, context.recordedSecretValues, noEchoSeed);
-			if (exposure) this.logger.warn(secretBearingExportNameWarning(outputKey, exportName, exposure, context.recordedSecretValues, isNoEchoOnlyExposure(exposure, nameSecrets, context.recordedSecretValues)));
+		for (const { outputKey, exportName, value, outputValue, nameSource, nameSecrets } of resolvedNames) {
+			const noEchoParameters = exportNameNoEchoParameters(nameSource, noEchoSources);
+			const exposure = noEchoParameters.length > 0 ? void 0 : exportNameSecretExposure(exportName, nameSecrets, context.recordedSecretValues, noEchoSeed);
+			if (noEchoParameters.length > 0) this.logger.warn(noEchoParameterExportNameWarning(outputKey, noEchoParameters, outputsPassSecrets));
+			else if (exposure) this.logger.warn(secretBearingExportNameWarning(outputKey, exportName, exposure, context.recordedSecretValues, isNoEchoOnlyExposure(exposure, nameSecrets, context.recordedSecretValues)));
 			else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) this.logger.warn(exportAliasCollisionWarning(outputKey, exportName, outputsPassSecrets));
 			else {
 				outputs[exportName] = value;
@@ -38180,7 +38406,7 @@ function hasOwn(bag, key) {
 	return Object.prototype.hasOwnProperty.call(bag, key);
 }
 function mergeNoChangeOutputs(input) {
-	const { persisted, resolved, declaredOutputs, previousExportNames, resolvedExportNames } = input;
+	const { persisted, resolved, declaredOutputs, previousExportNames, resolvedExportNames, refusesCarriedAlias } = input;
 	const failedKeys = Object.keys(resolved).filter((key) => resolved[key] === void 0);
 	const exportNameOf = (outputKey) => declaredOutputs !== void 0 && hasOwn(declaredOutputs, outputKey) ? declaredOutputs[outputKey]?.Export?.Name : void 0;
 	for (const outputKey of failedKeys) {
@@ -38197,15 +38423,26 @@ function mergeNoChangeOutputs(input) {
 	const addExport = (name) => {
 		exportNames.push(name);
 	};
+	const refusedAliases = [];
+	const carryAllowed = (outputKey, exportName) => {
+		const reason = refusesCarriedAlias(outputKey, exportName);
+		if (reason === void 0) return true;
+		refusedAliases.push({
+			outputKey,
+			exportName,
+			reason
+		});
+		return false;
+	};
 	for (const outputKey of failedKeys) {
 		const exportName = exportNameOf(outputKey);
 		if (hasOwn(persisted, outputKey)) {
 			outputs[outputKey] = persisted[outputKey];
 			carriedKeys.push(outputKey);
-			if (exportName === outputKey && previousExportNames.has(outputKey)) addExport(outputKey);
+			if (exportName === outputKey && previousExportNames.has(outputKey) && carryAllowed(outputKey, outputKey)) addExport(outputKey);
 		}
 		if (typeof exportName !== "string") continue;
-		if (previousExportNames.has(exportName) && hasOwn(persisted, exportName) && !hasOwn(resolved, exportName) && !hasOwn(outputs, exportName)) {
+		if (previousExportNames.has(exportName) && hasOwn(persisted, exportName) && !hasOwn(resolved, exportName) && !hasOwn(outputs, exportName) && carryAllowed(outputKey, exportName)) {
 			outputs[exportName] = persisted[exportName];
 			carriedKeys.push(exportName);
 			addExport(exportName);
@@ -38219,7 +38456,8 @@ function mergeNoChangeOutputs(input) {
 		kind: "merged",
 		outputs,
 		exportNames,
-		carriedKeys
+		carriedKeys,
+		refusedAliases
 	};
 }
 function keptWholeReasonText(reason) {
@@ -38808,6 +39046,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		});
 		const parameterValues = await this.resolver.resolveParameters(template, this.options.parameters, { ...this.options.inheritedSecrets && hasMaskableValues(this.options.inheritedSecrets) && { inheritedSecrets: this.options.inheritedSecrets } });
 		this.logger.debug(`Resolved ${Object.keys(parameterValues).length} parameters: ${Object.keys(parameterValues).join(", ")}`);
+		poisonRenderedSpellingsCollidingIn(template, parameterValues, this.options.inheritedSecrets);
 		this.inheritedNoEchoParameters = /* @__PURE__ */ new Set([...this.freshNoEchoParameters(parameterValues) ?? [], ...this.options.passedNoEchoParameters ?? []]);
 		const backfillNoEchoValues = noEchoParameterValueSeed(template.Parameters, parameterValues, this.options.inheritedSecrets, this.options.parameters);
 		this.fingerprintNoEchoValues = backfillNoEchoValues;
@@ -38915,7 +39154,8 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 					resolved: resolvedOutputs,
 					declaredOutputs: effectiveTemplate.Outputs,
 					previousExportNames: currentEffectiveExports,
-					resolvedExportNames: this.resolvedExportNames
+					resolvedExportNames: this.resolvedExportNames,
+					refusesCarriedAlias: (outputKey, exportName) => this.carriedExportAliasRefusal === void 0 ? "An export alias was not carried: no export-name verdict is available." : this.carriedExportAliasRefusal(outputKey, exportName)
 				}) : void 0;
 				if (merge?.kind === "merged") {
 					for (const key of merge.carriedKeys) Reflect.deleteProperty(this.outputsTemplateSource, key);
@@ -38925,6 +39165,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 					};
 				}
 				if (merge?.kind === "kept") this.outputsSourceUsable = false;
+				if (merge?.kind === "merged") for (const { reason } of merge.refusedAliases) this.logger.warn(reason);
 				const outputsToPersist = merge === void 0 ? resolvedOutputs : merge.kind === "merged" ? merge.outputs : persistedOutputs;
 				const exportNamesToPersist = merge === void 0 ? this.resolvedExportNames : merge.kind === "merged" ? merge.exportNames : void 0;
 				const outputsChanged = !outputMapsEqual(persistedOutputs, outputsToPersist);
@@ -39300,6 +39541,7 @@ var DeployEngine = class {
 	outputsPassSecretMaps = [];
 	outputsTemplateSource = Object.create(null);
 	resolvedExportNames = [];
+	carriedExportAliasRefusal;
 	skippedOutputs;
 	constructPathTemplate;
 	outputsSourceUsable = true;
@@ -39583,5 +39825,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { dropFailedHint as $, maskedLeafCoordinatesOf as $a, refuseMalformedResourcePropertiesForOrphan as $i, getCurrentResourceSecrets as $n, importableOutputKeys as $o, parameterInputsFor as $r, resolveSkipPrefix as $s, secretNamePrintingBag as $t, gray as A, toFiniteNumber as Aa, clearBucketRegionCache as Ac, malformedResourcesWarning as Ai, findDestructiveChanges as An, provenPublicValue as Ao, callerEnvCredentials as Ar, finchSecretArgvRefusal as As, removeProtectionTypeList as At, NESTED_PENDING_PARENT_REASON as B, requireConfigString as Ba, refuseMalformedOrphansForOrphan as Bi, planTagDiff as Bn, WHOLE_DYNAMIC_REFERENCE_PATTERN as Bo, parameterTypeMayLoseSecretIdentity as Br, warnFinchArgvExposure as Bs, findNestedStackTypeChanges as Bt, recordedProtectionNote as C, isStatefulRecreateTargetForReplace as Ca, nullPrototypeRecord as Cc, malformedOrphansRefusalMessage as Ci, collectPublishedOutputNames as Cn, isUncertifiedBaselineMaskPosition as Co, assertFlagRoleArn as Cr, buildDenyExternalAccessPolicy as Cs, INDEX_SETTLE_POLL_INTERVAL_MS as Ct, createReadOnlyAttributeHealerFactory as D, coerceWarmThroughput as Da, displayAssemblyPath as Dc, malformedRenderedContainersWarning as Di, DEFAULT_RESOURCE_WARN_AFTER_MS as Dn, recoverMaskedOutput as Do, sendableAssumeRoleCommand as Dr, describeDockerExecFailure as Ds, S3_AUTO_DELETE_OBJECTS_TAG as Dt, formatResourceLine as E, WARM_THROUGHPUT_MEMBERS as Ea, describeFileReadFailure as Ec, malformedOutputsWarning as Ei, DEFAULT_RESOURCE_TIMEOUT_MS as En, recordNestedStackParameterExpressions as Eo, isIamRoleArn as Er, describeDockerCapturedOutput as Es, ECR_AUTO_DELETE_IMAGES_TAG as Et, namesAnyDeclaredParameter as F, configStringRefusal as Fa, refuseMalformedNestedChildOutputs as Fi, reserveStackCreateToken as Fn, wholeStringLeavesOf as Fo, s3BucketDualStackDomainName as Fr, partitionSensitiveEnv as Fs, isReplacementOrphan as Ft, nestedChildStackName as G, canonicalLambdaFunctionName as Ga, refuseMalformedResourceEntriesForDeploy as Gi, definedAttributes as Gn, rebuildClientForBucketRegion as Go, isNamelessDynamicReferenceError as Gr, Synthesizer as Gs, redactedDeleteAddressFields as Gt, displacedPhysicalIdShown as H, templateResourceTypes as Ha, refuseMalformedOutputsForDestroy as Hi, refuseMalformedDesiredTags as Hn, LockManager as Ho, isImpossibleEmptyStoredAttribute as Hr, stripControlChars as Hs, inheritProducerRegions as Ht, reachableDivergentParameters as I, readConfigString as Ia, refuseMalformedOrphanRecords as Ii, withCreateTokenLedger as In, STATE_SOURCED_BASELINE_RULES as Io, s3BucketRegionalDomainName as Ir, redactDockerArgvValues as Is, planFailedOps as It, revertedNestedRowIds as J, DagBuilder as Ja, refuseMalformedResourceEntriesForImportSave as Ji, ProviderRegistry as Jn, describeRegionValueKind as Jo, cfnRefValueFromPhysicalId as Jr, getLegacyStateBucketName as Js, updatePartialReason as Jt, recordDisplacedSkips as K, lambdaFunctionNameForMask as Ka, refuseMalformedResourceEntriesForDestroy as Ki, stringifyIfAssigned as Kn, splitImportedOps as Ko, keepsSecretReferenceToken as Kr, synthesisStatusMessage as Ks, redactedDeleteAddressSkip as Kt, resourcesNamingDeclaredParameter as L, replayWarn as La, refuseMalformedOrphanRecordsForDestroy as Li, acquireIdempotencyToken as Ln, STATE_SOURCED_CROSS_GENERATION_RULES as Lo, s3BucketWebsiteUrl as Lr, redactedDockerCause as Ls, planRollback as Lt, red as M, coerceCfnInteger as Ma, malformedStateRefusalMessage as Mi, RollbackInlinePolicyWriters as Mn, recordMaskOnlyValuesIn as Mo, isSettledInstanceState as Mr, getDockerCmd as Ms, recordAfterRollbackUpdate as Mt, yellow as N, configBooleanRefusal as Na, previewableOrphanRecords as Ni, earliestDefined as Nn, recordNoEchoAttributeValues as No, s3BucketArn as Nr, isDockerClientEnvKey as Ns, demoteSupersededOrphans as Nt, bold as O, isWarmThroughputDecrease as Oa, renderAssemblyPathEscape as Oc, malformedResourceEntriesWarning as Oi, maskingRetryLogger as On, identityKeyFor as Oo, AWS_CREDENTIAL_ENV_KEYS as Or, describeDockerFailure as Os, hasCdkAutoDeleteTag as Ot, computeParameterTaint as P, configIntegerRefusal as Pa, refuseDivergentRecordRegionForDestroy as Pi, ledgerForStack as Pn, recordProvenPublicExpression as Po, s3BucketDomainName as Pr, isMalformedEnvKey as Ps, isJournaledOrphan as Pt, deleteJournaledOrphans as Q, maskWholeValue as Qa, refuseMalformedResourcePropertiesForExport as Qi, isCustomResourceType as Qn, hasUnverifiableParameterRefusal as Qo, withSharedDrainBudget as Qr, resolveCaptureObservedState as Qs, orphanRecordsPrintingBag as Qt, makeSiblingClaimReader as R, requireConfigArray as Ra, refuseMalformedOrphans as Ri, DBPROXY_TAGS_WHAT as Rn, STATE_SOURCED_READBACK_RULES as Ro, coerceParameterTypedValue as Rr, runDockerForeground as Rs, replacementNeverSwapped as Rt, recordedProtectionEvidence as S, MULTI_REGION_RECREATE_BLOCKED_TYPES as Sa, hasPlainPrototype$1 as Sc, malformedOrphanRowsKeptWarning as Si, collectDeclaredOutputNames as Sn, dynamicReferenceTokens as So, applyRoleArnIfSet as Sr, validateContainerRepoName as Ss, DELETE_INDEX_WAIT_PROCEED_NOTE as St, markRefusedBeforeApplying as T, renderStatefulReason as Ta, absoluteAssemblyPathEscape as Tc, malformedOutputsRefusalMessage as Ti, bindingSkippedOutputs as Tn, inheritNestedStackParameterAssociations as To, explicitRoleArnOrThrow as Tr, resolveDockerContextDirectory as Ts, waitForIndexesSettled as Tt, dropSettledNestedJournals as U, describeTypeWithThrottleRetry as Ua, refuseMalformedResourceAttributesForOrphan as Ui, tagMapAsList as Un, isLockInfoExpired as Uo, carriesDynamicReference as Ur, AssetManifestLoader as Us, REDACTED_DELETE_ADDRESS_SKIP_REASON as Ut, displacedOpClause as V, prefetchCreateOnlyPropertyPaths as Va, refuseMalformedOutputs as Vi, readTagList as Vn, isSingleDynamicReferenceToken as Vo, getAccountInfo as Vr, escapeRegExp$3 as Vs, getCurrentProducerRegions as Vt, getNestedRevertRun as W, withRetry as Wa, refuseMalformedResourceEntries as Wi, tagPlanWarning as Wn, S3StateBackend as Wo, carriesFetchableDynamicReference as Wr, getDockerImageBySourceHash as Ws, isRedactedRecordedValue as Wt, getCurrentNestedStackContext as X, isMarkedCoordinate as Xa, refuseMalformedResourcePropertiesForDestroy as Xi, isCustomResource as Xn, hasReadableExportSet as Xo, refStateLookupFromResource as Xr, resolveApp as Xs, journaledOrphanPrintingBag as Xt, withNestedRevertRun as Y, TemplateParser as Ya, refuseMalformedResourceEntriesForOrphan as Yi, ccBrokenReason as Yn, exportNamesCarriedFrom as Yo, isStalePlaceholderArnAttribute as Yr, loadCdkJson as Ys, completedReplayEntries as Yt, withNestedStackContext as Z, maskReadbackAtCoordinates as Za, refuseMalformedResourcePropertiesForDrift as Zi, wouldReturnToSdkProvider as Zn, hasReasonlessBaselineRefusal as Zo, parseWebACLArn as Zr, resolveAutoAssetStorage as Zs, maskEventTextWithBoundBags as Zt, makeCanonicalizePropertiesFn as _, withoutSilentDropProperties as _a, AssemblyReader as _c, malformedLocalOutputsWarning as _i, secretBearingStateKeyWarning as _n, maskSecretsInText as _o, INTRINSIC_KEYS as _r, getBootstrapMarkerKey as _s, beginDeleteWait as _t, findNestedTemplateTreeDefect as a, repairMalformedOrphansForReadOnly as aa, ssmResolvedValueType as ac, UNREADABLE_RESOURCES_MAP_ROW as ai, createPreDeleteFinalSnapshot as an, carryLogOnlyValues as ao, deleteIndeterminateGuards as ar, AssetPublisher as as, replayFailedOperations as at, noEchoParameterNamesOf as b, findReplacedReadersOfRecreateTargets as ba, defineOwnKey as bc, malformedOrphanRecordsRefusalMessage as bi, isWholeDynamicReferenceValue as bn, scrubResourceRecord as bo, producerRegionsFromState as br, readBootstrapMarkerBody as bs, resolveDynamoDbDeleteBudgetClock as bt, renderNestedTemplateTreeDefect as c, repairMalformedResourcePropertiesForReadOnly as ca, MIGRATE_TMP_PREFIX as cc, displayLogicalId as ci, refusesFinalSnapshot as cn, literalSplitDelimitersOf as co, isWaitAbandonedError as cr, WorkGraph as cs, destroyStackRecordsView as ct, conditionInputsFrom as d, unreadableOrphanRecords as da, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as dc, hasReadableResources as di, DeploymentEventsStore as dn, recordLogOnlyParameterValue as do, ec2InstanceProtectionSite as dr, loadPublishableAssetManifest as ds, PROTECTION_PROPERTY_BY_TYPE as dt, refuseMalformedResourcesForDeploy as ea, resolveStateBucketWithDefault as ec, passedParameterClassesOf as ei, stateSecretNameNeedles as en, noEchoLeavesOf as eo, withPrintingSecrets as er, importableOutputs as es, isHandledOrphan as et, parentSuppliedValues as f, unreadableResourceEntries as fa, decodeListingKey as fc, isReadableOrphanRecord as fi, extractDeploymentEventError as fn, recordLogOnlyValue as fo, isTerminationProtectionPropagationError as fr, rewriteTemplateAssetReferences as fs, isProtectionValueActive as ft, mergeNoChangeOutputs as g, unwrittenCreateOnlyReplacement as ga, derivePartitionAndUrlSuffix as gc, malformedExportSourceWarning as gi, secretBearing as gn, maskSecretsInError as go, DiffCalculator as gr, ensureAssetStorage as gs, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as gt, keptWholeReasonText as h, findSilentDropProperties as ha, canonicalizeRegion as hc, malformedExportNamesWarning as hi, exportAliasCollisionScrubWarning as hn, errorCauseChain as ho, reEnableInstanceApiTermination as hr, assertAssetBucketRegion as hs, DynamoDBGlobalTableProvider as ht, childTemplateLoader as i, repairMalformedOrphanRecordsForReadOnly as ia, warnDeprecatedNoPrefixCliFlag as ic, UNREADABLE_ORPHANS_CONTAINER_ROW as ii, ccRoutedFinalSnapshotError as in, liveMatchesUnresolvedTokenFrame as io, UNSPECIFIED_SKIP_REASON as ir, shouldRetainResource as is, sameJournaledOrphans as it, green as j, coerceCfnBoolean as ja, resolveBucketRegion as jc, malformedScrubResourceEntriesRefusalMessage as ji, formatDestructiveChange as jn, recordMaskOnlyValue as jo, envCredentialsAreAssumedRole as jr, formatDockerLoginError as js, orphanDeleteNeedsIdentity as jt, cyan as k, toCfnInteger as ka, resolveAssemblyPath as kc, malformedResourcePropertiesWarning as ki, constructPathOf as kn, carriesSecretMask as ko, applyCallerIdentityCredentials as kr, dockerSpawnEnvWithSensitive as ks, isTruthyCfnBoolean as kt, templateIdentity as l, repairMalformedResourcesForReadOnly as la, findLargeInlineResources as lc, hasReadableOrphans as li, unsupportedFinalSnapshotError as ln, logOnlyValueCount as lo, markWaitAbandoned as lr, buildAssetRedirectMap as ls, getStackRecords as lt, isSecretBearingReferenceString as m, findActionableSilentDrops as ma, PARTITION_TABLE as mc, malformedDriftResourcePropertiesWarning as mi, displayTextOrWithheld as mn, createSecretMasker as mo, reDisableInstanceApiTermination as mr, BOOTSTRAP_MARKER_PREFIX as ms, readProtection as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedResourcesForExport as na, resolveUseCdkBootstrapAssets as nc, STATE_REGION_DIVERGED as ni, PRE_DELETE_SNAPSHOT_TYPES as nn, passedNoEchoParametersOf as no, slowCcOperationTimeoutMs as nr, orphansAfterRollback as ns, loadJournaledOrphans as nt, isAbsoluteAssetPath as o, repairMalformedOutputsForReadOnly as oa, CFN_TEMPLATE_BODY_LIMIT as oc, accountArgs as oi, effectiveDeletionPolicy as on, createUnionSecretMasker as oo, deleteSkipReason as or, isSensitiveAttributeName as os, replayRollback as ot, readRecordedConditionVerdicts as p, withheldAccountClause as pa, expectedOwnerParam as pc, isReadableResourceEntry as pi, WITHHELD_NAME_DISPLAY as pn, shareLogOnlyValues as po, observeThenDisableInstanceApiTermination as pr, AssetModeResolver as ps, perType as pt, revertNestedChildFromJournal as q, sameLambdaFunctionAddress as qa, refuseMalformedResourceEntriesForImport as qi, CC_BROKEN_REASON as qn, acceptedCreateOnlyDropsOf as qo, AWS_NO_VALUE as qr, getDefaultStateBucketName as qs, updatePartialMessage as qt, computeImplicitDeleteEdges as r, refuseMalformedState as ra, stateBucketExistenceConfirmed as rc, STATE_RESOURCES_MALFORMED as ri, buildFinalSnapshotIdentifier as rn, readsNoEchoSource as ro, unchangedBehindSecretReference as rr, orphansCarriedFrom as rs, makeForeignHolderScan as rt, listNestedTemplateRows as s, repairMalformedResourceEntriesForReadOnly as sa, CFN_TEMPLATE_URL_LIMIT as sc, deployRefusesOrphanRowsReason as si, isFinalSnapshotError as sn, hasMaskableValues as so, withIndeterminateGuard as sr, stringifyValue as ss, awaitInFlightSibling as st, DeployEngine as t, refuseMalformedResourcesForDestroy as ta, resolveStateBucketWithDefaultAndSource as tc, JSON_LISTING_HOLE_VALUE as ti, ATOMIC_FINAL_SNAPSHOT_TYPES as tn, noEchoOutputsComparison as to, CloudControlProvider as tr, isReadableBag as ts, journaledOrphanLines as tt, conditionFingerprint as u, unpreviewableOrphanRecords as ua, uploadCfnTemplate as uc, hasReadableOutputs as ui, DeploymentEventsReader as un, printingCorpusOf as uo, disableInstanceApiTermination as ur, createAssetRedirectResolver as us, withStackRecords as ut, noEchoAttributeNamesOf as v, NO_CC_HANDLERS_REASON as va, StageLoadError as vc, malformedLocalResourceEntriesWarning as vi, secretSafeKeyDisplay as vn, markSameGenerationBag as vo, IntrinsicFunctionResolver as vr, isCrossRegionRedirect as vs, compensateRemovedDeletionProtection as vt, getPriorAttempts as w, isStatefulRecreateTargetSync as wa, ownValue as wc, malformedOrphansWarning as wi, isExportAliasCollision as wn, pathCrossesDottedKey as wo, assertSendableRoleArn as wr, buildDockerImage as ws, deleteTableWithIndexBusyRetry as wt, withResourceDeadline as x, shownType as xa, hasOwnKey as xc, malformedOrphanRecordsWarning as xi, noEchoParameterValueSeed as xn, DYNAMIC_REFERENCE_TOKEN_SCAN as xo, regionLessSecretName as xr, validateAssetBucketName as xs, resolveDynamoDbDeleteBudgetMs as xt, noEchoComparisonForTemplate as y, hasNoCloudControlHandlers as ya, processStackMessages as yc, malformedLocalResourcesWarning as yi, exportNameSecretExposure as yn, redactSecretsForState as yo, classifyReplaySecretRegion as yr, parseBootstrapMarker as ys, deleteBudgetKey as yt, planOrphanAdoption as z, requireConfigObject as za, refuseMalformedOrphansForDestroy as zi, DBPROXY_TAG_OPTIONS as zn, TEMPLATE_SOURCED_RULES as zo, isUnboundTemplateParameter as zr, runDockerStreaming as zs, resolveReplacementOldType as zt };
-//# sourceMappingURL=deploy-engine-Z_zHC0jz.js.map
+export { dropFailedHint as $, isMarkedCoordinate as $a, refuseMalformedResourcePropertiesForDestroy as $i, wouldReturnToSdkProvider as $n, hasReadableExportSet as $o, refStateLookupFromResource as $r, resolveApp as $s, secretNamePrintingBag as $t, gray as A, coerceWarmThroughput as Aa, displayAssemblyPath as Ac, malformedRenderedContainersWarning as Ai, maskingRetryLogger as An, recordNestedStackParameterExpressions as Ao, sendableAssumeRoleCommand as Ar, describeDockerExecFailure as As, removeProtectionTypeList as At, NESTED_PENDING_PARENT_REASON as B, replayWarn as Ba, refuseMalformedOrphanRecordsForDestroy as Bi, DBPROXY_TAGS_WHAT as Bn, STATE_SOURCED_CROSS_GENERATION_RULES as Bo, s3BucketWebsiteUrl as Br, redactedDockerCause as Bs, findNestedStackTypeChanges as Bt, recordedProtectionNote as C, findReplacedReadersOfRecreateTargets as Ca, defineOwnKey as Cc, malformedOrphanRecordsRefusalMessage as Ci, noEchoParameterValueSeed as Cn, scrubResourceRecord as Co, producerRegionsFromState as Cr, readBootstrapMarkerBody as Cs, INDEX_SETTLE_POLL_INTERVAL_MS as Ct, createReadOnlyAttributeHealerFactory as D, isStatefulRecreateTargetSync as Da, ownValue as Dc, malformedOrphansWarning as Di, bindingSkippedOutputs as Dn, pathCrossesDottedKey as Do, assertSendableRoleArn as Dr, buildDockerImage as Ds, S3_AUTO_DELETE_OBJECTS_TAG as Dt, formatResourceLine as E, isStatefulRecreateTargetForReplace as Ea, nullPrototypeRecord as Ec, malformedOrphansRefusalMessage as Ei, isExportAliasCollision as En, isUncertifiedBaselineMaskPosition as Eo, assertFlagRoleArn as Er, buildDenyExternalAccessPolicy as Es, ECR_AUTO_DELETE_IMAGES_TAG as Et, namesAnyDeclaredParameter as F, coerceCfnInteger as Fa, malformedStateRefusalMessage as Fi, earliestDefined as Fn, recordMaskOnlyValuesIn as Fo, isSettledInstanceState as Fr, getDockerCmd as Fs, isReplacementOrphan as Ft, nestedChildStackName as G, templateResourceTypes as Ga, refuseMalformedOutputsForDestroy as Gi, tagMapAsList as Gn, LockManager as Go, isImpossibleEmptyStoredAttribute as Gr, stripControlChars as Gs, redactedDeleteAddressFields as Gt, displacedPhysicalIdShown as H, requireConfigObject as Ha, refuseMalformedOrphansForDestroy as Hi, planTagDiff as Hn, TEMPLATE_SOURCED_RULES as Ho, isUnboundTemplateParameter as Hr, runDockerStreaming as Hs, inheritProducerRegions as Ht, reachableDivergentParameters as I, configBooleanRefusal as Ia, previewableOrphanRecords as Ii, ledgerForStack as In, recordNoEchoAttributeValues as Io, s3BucketArn as Ir, isDockerClientEnvKey as Is, planFailedOps as It, revertedNestedRowIds as J, canonicalLambdaFunctionName as Ja, refuseMalformedResourceEntriesForDeploy as Ji, stringifyIfAssigned as Jn, rebuildClientForBucketRegion as Jo, isNamelessDynamicReferenceError as Jr, Synthesizer as Js, updatePartialReason as Jt, recordDisplacedSkips as K, describeTypeWithThrottleRetry as Ka, refuseMalformedResourceAttributesForOrphan as Ki, tagPlanWarning as Kn, isLockInfoExpired as Ko, carriesDynamicReference as Kr, AssetManifestLoader as Ks, redactedDeleteAddressSkip as Kt, resourcesNamingDeclaredParameter as L, configIntegerRefusal as La, refuseDivergentRecordRegionForDestroy as Li, reserveStackCreateToken as Ln, recordProvenPublicExpression as Lo, s3BucketDomainName as Lr, isMalformedEnvKey as Ls, planRollback as Lt, red as M, toCfnInteger as Ma, resolveAssemblyPath as Mc, malformedResourcePropertiesWarning as Mi, findDestructiveChanges as Mn, carriesSecretMask as Mo, applyCallerIdentityCredentials as Mr, dockerSpawnEnvWithSensitive as Ms, recordAfterRollbackUpdate as Mt, yellow as N, toFiniteNumber as Na, clearBucketRegionCache as Nc, malformedResourcesWarning as Ni, formatDestructiveChange as Nn, provenPublicValue as No, callerEnvCredentials as Nr, finchSecretArgvRefusal as Ns, demoteSupersededOrphans as Nt, bold as O, renderStatefulReason as Oa, absoluteAssemblyPathEscape as Oc, malformedOutputsRefusalMessage as Oi, DEFAULT_RESOURCE_TIMEOUT_MS as On, identityKeyFor as Oo, explicitRoleArnOrThrow as Or, resolveDockerContextDirectory as Os, hasCdkAutoDeleteTag as Ot, computeParameterTaint as P, coerceCfnBoolean as Pa, resolveBucketRegion as Pc, malformedScrubResourceEntriesRefusalMessage as Pi, RollbackInlinePolicyWriters as Pn, recordMaskOnlyValue as Po, envCredentialsAreAssumedRole as Pr, formatDockerLoginError as Ps, isJournaledOrphan as Pt, deleteJournaledOrphans as Q, TemplateParser as Qa, refuseMalformedResourceEntriesForOrphan as Qi, isCustomResource as Qn, exportNamesCarriedFrom as Qo, isStalePlaceholderArnAttribute as Qr, loadCdkJson as Qs, orphanRecordsPrintingBag as Qt, makeSiblingClaimReader as R, configStringRefusal as Ra, refuseMalformedNestedChildOutputs as Ri, withCreateTokenLedger as Rn, wholeStringLeavesOf as Ro, s3BucketDualStackDomainName as Rr, partitionSensitiveEnv as Rs, replacementNeverSwapped as Rt, recordedProtectionEvidence as S, hasNoCloudControlHandlers as Sa, processStackMessages as Sc, malformedLocalResourcesWarning as Si, isWholeDynamicReferenceValue as Sn, redactSecretsForState as So, classifyReplaySecretRegion as Sr, parseBootstrapMarker as Ss, DELETE_INDEX_WAIT_PROCEED_NOTE as St, markRefusedBeforeApplying as T, MULTI_REGION_RECREATE_BLOCKED_TYPES as Ta, hasPlainPrototype$1 as Tc, malformedOrphanRowsKeptWarning as Ti, collectPublishedOutputNames as Tn, dynamicReferenceTokens as To, applyRoleArnIfSet as Tr, validateContainerRepoName as Ts, waitForIndexesSettled as Tt, dropSettledNestedJournals as U, requireConfigString as Ua, refuseMalformedOrphansForOrphan as Ui, readTagList as Un, WHOLE_DYNAMIC_REFERENCE_PATTERN as Uo, parameterTypeMayLoseSecretIdentity as Ur, warnFinchArgvExposure as Us, REDACTED_DELETE_ADDRESS_SKIP_REASON as Ut, displacedOpClause as V, requireConfigArray as Va, refuseMalformedOrphans as Vi, DBPROXY_TAG_OPTIONS as Vn, STATE_SOURCED_READBACK_RULES as Vo, coerceParameterTypedValue as Vr, runDockerForeground as Vs, getCurrentProducerRegions as Vt, getNestedRevertRun as W, prefetchCreateOnlyPropertyPaths as Wa, refuseMalformedOutputs as Wi, refuseMalformedDesiredTags as Wn, isSingleDynamicReferenceToken as Wo, getAccountInfo as Wr, escapeRegExp$3 as Ws, isRedactedRecordedValue as Wt, getCurrentNestedStackContext as X, sameLambdaFunctionAddress as Xa, refuseMalformedResourceEntriesForImport as Xi, ProviderRegistry as Xn, acceptedCreateOnlyDropsOf as Xo, AWS_NO_VALUE as Xr, getDefaultStateBucketName as Xs, journaledOrphanPrintingBag as Xt, withNestedRevertRun as Y, lambdaFunctionNameForMask as Ya, refuseMalformedResourceEntriesForDestroy as Yi, CC_BROKEN_REASON as Yn, splitImportedOps as Yo, keepsSecretReferenceToken as Yr, synthesisStatusMessage as Ys, completedReplayEntries as Yt, withNestedStackContext as Z, DagBuilder as Za, refuseMalformedResourceEntriesForImportSave as Zi, ccBrokenReason as Zn, describeRegionValueKind as Zo, cfnRefValueFromPhysicalId as Zr, getLegacyStateBucketName as Zs, maskEventTextWithBoundBags as Zt, makeCanonicalizePropertiesFn as _, findActionableSilentDrops as _a, PARTITION_TABLE as _c, malformedDriftResourcePropertiesWarning as _i, secretBearingStateKeyWarning as _n, createSecretMasker as _o, reEnableInstanceApiTermination as _r, BOOTSTRAP_MARKER_PREFIX as _s, beginDeleteWait as _t, findNestedTemplateTreeDefect as a, refuseMalformedResourcesForExport as aa, resolveUseCdkBootstrapAssets as ac, STATE_REGION_DIVERGED as ai, createPreDeleteFinalSnapshot as an, passedNoEchoParametersOf as ao, unchangedBehindSecretReference as ar, orphansAfterRollback as as, replayFailedOperations as at, noEchoParameterNamesOf as b, withoutSilentDropProperties as ba, AssemblyReader as bc, malformedLocalOutputsWarning as bi, exportNameNoEchoParameters as bn, maskSecretsInText as bo, IntrinsicFunctionResolver as br, getBootstrapMarkerKey as bs, resolveDynamoDbDeleteBudgetClock as bt, renderNestedTemplateTreeDefect as c, repairMalformedOrphansForReadOnly as ca, ssmResolvedValueType as cc, UNREADABLE_RESOURCES_MAP_ROW as ci, refusesFinalSnapshot as cn, carryLogOnlyValues as co, deleteSkipReason as cr, AssetPublisher as cs, destroyStackRecordsView as ct, conditionInputsFrom as d, repairMalformedResourcePropertiesForReadOnly as da, MIGRATE_TMP_PREFIX as dc, displayLogicalId as di, DeploymentEventsStore as dn, literalSplitDelimitersOf as do, markWaitAbandoned as dr, WorkGraph as ds, PROTECTION_PROPERTY_BY_TYPE as dt, refuseMalformedResourcePropertiesForDrift as ea, resolveAutoAssetStorage as ec, parseWebACLArn as ei, stateSecretNameNeedles as en, maskReadbackAtCoordinates as eo, isCustomResourceType as er, hasReasonlessBaselineRefusal as es, isHandledOrphan as et, parentSuppliedValues as f, repairMalformedResourcesForReadOnly as fa, findLargeInlineResources as fc, hasReadableOrphans as fi, extractDeploymentEventError as fn, logOnlyValueCount as fo, disableInstanceApiTermination as fr, buildAssetRedirectMap as fs, isProtectionValueActive as ft, mergeNoChangeOutputs as g, withheldAccountClause as ga, expectedOwnerParam as gc, isReadableResourceEntry as gi, secretBearing as gn, shareLogOnlyValues as go, reDisableInstanceApiTermination as gr, AssetModeResolver as gs, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as gt, keptWholeReasonText as h, unreadableResourceEntries as ha, decodeListingKey as hc, isReadableOrphanRecord as hi, exportAliasCollisionScrubWarning as hn, recordLogOnlyValue as ho, observeThenDisableInstanceApiTermination as hr, rewriteTemplateAssetReferences as hs, DynamoDBGlobalTableProvider as ht, childTemplateLoader as i, refuseMalformedResourcesForDestroy as ia, resolveStateBucketWithDefaultAndSource as ic, JSON_LISTING_HOLE_VALUE as ii, ccRoutedFinalSnapshotError as in, noEchoOutputsComparison as io, slowCcOperationTimeoutMs as ir, isReadableBag as is, sameJournaledOrphans as it, green as j, isWarmThroughputDecrease as ja, renderAssemblyPathEscape as jc, malformedResourceEntriesWarning as ji, constructPathOf as jn, recoverMaskedOutput as jo, AWS_CREDENTIAL_ENV_KEYS as jr, describeDockerFailure as js, orphanDeleteNeedsIdentity as jt, cyan as k, WARM_THROUGHPUT_MEMBERS as ka, describeFileReadFailure as kc, malformedOutputsWarning as ki, DEFAULT_RESOURCE_WARN_AFTER_MS as kn, inheritNestedStackParameterAssociations as ko, isIamRoleArn as kr, describeDockerCapturedOutput as ks, isTruthyCfnBoolean as kt, templateIdentity as l, repairMalformedOutputsForReadOnly as la, CFN_TEMPLATE_BODY_LIMIT as lc, accountArgs as li, unsupportedFinalSnapshotError as ln, createUnionSecretMasker as lo, withIndeterminateGuard as lr, isSensitiveAttributeName as ls, getStackRecords as lt, isSecretBearingReferenceString as m, unreadableOrphanRecords as ma, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as mc, hasReadableResources as mi, displayTextOrWithheld as mn, recordLogOnlyParameterValue as mo, isTerminationProtectionPropagationError as mr, loadPublishableAssetManifest as ms, readProtection as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedResourcePropertiesForOrphan as na, resolveSkipPrefix as nc, parameterInputsFor as ni, PRE_DELETE_SNAPSHOT_TYPES as nn, maskedLeafCoordinatesOf as no, withPrintingSecrets as nr, importableOutputKeys as ns, loadJournaledOrphans as nt, isAbsoluteAssetPath as o, refuseMalformedState as oa, stateBucketExistenceConfirmed as oc, STATE_RESOURCES_MALFORMED as oi, effectiveDeletionPolicy as on, readsNoEchoSource as oo, UNSPECIFIED_SKIP_REASON as or, orphansCarriedFrom as os, replayRollback as ot, readRecordedConditionVerdicts as p, unpreviewableOrphanRecords as pa, uploadCfnTemplate as pc, hasReadableOutputs as pi, WITHHELD_NAME_DISPLAY as pn, printingCorpusOf as po, ec2InstanceProtectionSite as pr, createAssetRedirectResolver as ps, perType as pt, revertNestedChildFromJournal as q, withRetry as qa, refuseMalformedResourceEntries as qi, definedAttributes as qn, S3StateBackend as qo, carriesFetchableDynamicReference as qr, getDockerImageBySourceHash as qs, updatePartialMessage as qt, computeImplicitDeleteEdges as r, refuseMalformedResourcesForDeploy as ra, resolveStateBucketWithDefault as rc, passedParameterClassesOf as ri, buildFinalSnapshotIdentifier as rn, noEchoLeavesOf as ro, CloudControlProvider as rr, importableOutputs as rs, makeForeignHolderScan as rt, listNestedTemplateRows as s, repairMalformedOrphanRecordsForReadOnly as sa, warnDeprecatedNoPrefixCliFlag as sc, UNREADABLE_ORPHANS_CONTAINER_ROW as si, isFinalSnapshotError as sn, liveMatchesUnresolvedTokenFrame as so, deleteIndeterminateGuards as sr, shouldRetainResource as ss, awaitInFlightSibling as st, DeployEngine as t, refuseMalformedResourcePropertiesForExport as ta, resolveCaptureObservedState as tc, withSharedDrainBudget as ti, ATOMIC_FINAL_SNAPSHOT_TYPES as tn, maskWholeValue as to, getCurrentResourceSecrets as tr, hasUnverifiableParameterRefusal as ts, journaledOrphanLines as tt, conditionFingerprint as u, repairMalformedResourceEntriesForReadOnly as ua, CFN_TEMPLATE_URL_LIMIT as uc, deployRefusesOrphanRowsReason as ui, DeploymentEventsReader as un, hasMaskableValues as uo, isWaitAbandonedError as ur, stringifyValue as us, withStackRecords as ut, noEchoAttributeNamesOf as v, findSilentDropProperties as va, canonicalizeRegion as vc, malformedExportNamesWarning as vi, secretSafeKeyDisplay as vn, errorCauseChain as vo, DiffCalculator as vr, assertAssetBucketRegion as vs, compensateRemovedDeletionProtection as vt, getPriorAttempts as w, shownType as wa, hasOwnKey as wc, malformedOrphanRecordsWarning as wi, collectDeclaredOutputNames as wn, DYNAMIC_REFERENCE_TOKEN_SCAN as wo, regionLessSecretName as wr, validateAssetBucketName as ws, deleteTableWithIndexBusyRetry as wt, withResourceDeadline as x, NO_CC_HANDLERS_REASON as xa, StageLoadError as xc, malformedLocalResourceEntriesWarning as xi, exportNameSecretExposure as xn, markSameGenerationBag as xo, poisonRenderedSpellingsCollidingIn as xr, isCrossRegionRedirect as xs, resolveDynamoDbDeleteBudgetMs as xt, noEchoComparisonForTemplate as y, unwrittenCreateOnlyReplacement as ya, derivePartitionAndUrlSuffix as yc, malformedExportSourceWarning as yi, carriedExportAliasExposure as yn, maskSecretsInError as yo, INTRINSIC_KEYS as yr, ensureAssetStorage as ys, deleteBudgetKey as yt, planOrphanAdoption as z, readConfigString as za, refuseMalformedOrphanRecords as zi, acquireIdempotencyToken as zn, STATE_SOURCED_BASELINE_RULES as zo, s3BucketRegionalDomainName as zr, redactDockerArgvValues as zs, resolveReplacementOldType as zt };
+//# sourceMappingURL=deploy-engine-DYAAwd0u.js.map