@go-to-k/cdkd 0.296.15 → 0.296.17

package/dist/{deploy-engine-CjLZZzyn.js → deploy-engine-C0tkSwvX.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js"
 import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
 import { $ as protectedReplacementAdvice, $n as isIamPropagationError, $t as AccountIdUnavailableError, A as isQuotableImportValue, An as commandHole, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bt as sanitizeRecoveryValue, Ct as RETRY_AUXILIARY_OWNER, Dn as SHELL_ACTIVE, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as plainOrDescribed, G as runDeleteAttempt, Gn as isNameCooldownError, H as observeThenDisableProtection, Hn as isUpdateUnsupportedError, Ht as DEFAULT_STATE_PREFIX, In as quotedOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jt as withPasteableAwsProfile, Kn as isRecreateRetryableError, Kt as producerRecordKey, L as ProtectionFlipRegistry, Ln as shellBoundedDisplay, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mn as isInertUnquoted, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as pasteableCommand, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE_WHY, Ot as hasCreatedBeforeFailure, Pn as physicalIdShownBesideCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, R as compensateProtectionFlip, Rn as shellQuote, Rt as formatLockOperation, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Un as hasReplayMayCollide, Ut as injectiveKey, Vt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Wn as isNameCollisionErrorFrom, Xn as formatRetryClassificationSignals, Xt as ambientCredentialConfig, Yn as markReplayMayCollide, Yt as ambientClientDefaults, Zn as isAmbiguousCcHandlerErrorCode, Zt as clientDefaultsFor, _n as ResourceUpdateNotSupportedError, _t as createMaskedLogSinks, ar as isThrottlingError, at as startInterruptWatch, bn as StateError, bt as maskDeep, cr as wrapMaskedAwsError, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as MacroExpansionError, en as AssetError, er as isRetryableTransientError, f as removalWarning, fn as MalformedProducerRecordRefusalError, ft as logicalIdShown, gn as ResourceTimeoutError, gt as stateOrphanRecordRemedy, hn as ProvisioningError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as DependencyError, ir as isMarkedNonRetryable, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, kn as UNSHOWABLE_VALUE, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, m as withoutInjectedRemovals, mt as resourceTypeShown, nr as retryClassificationText, on as DynamicReferenceRegionAmbiguousError, or as markNonRetryable, ot as ElapsedBudgetRegistry, qn as isReplayedNameCollisionFrom, rn as CrossAccountSecretRefusalError, sn as IntrinsicResolutionRefusalError, sr as markRedactedCause, st as monotonicNowMs, tn as CdkdError, tr as isTransientServerError, un as LockError, ut as compositeIdSeparatorRefusal, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as normalizeAwsError, wt as carryCreatedBeforeFailure, xn as SynthesisError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as withheldTargetClause, zt as formatLockOwner } from "./iam-policy-targets-BoZuWtxK.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-Bdg2mYAM.js";
+import { t as getCdkdVersion } from "./version-Bl_MI_r7.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -6659,217 +6659,6 @@ function positionByCrossStackSource(bag, source, secrets) {
 	return certifiedExpressionForLeaf(secrets, association, bag);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/placeholder-positions.ts
-function keyedPart(source) {
-	const key = crossStackSourceKey(source);
-	return key === void 0 ? UNKNOWN_PART : { key };
-}
-const MAX_PLACEHOLDER_DEPTH = 8;
-function pushPlaceholderPart(out, part, budget) {
-	if (budget.remaining <= 0) {
-		budget.exhausted = true;
-		return;
-	}
-	budget.remaining -= 1;
-	out.push(part);
-}
-function appendValuePlaceholderParts(value, out, budget, depth) {
-	if (budget.exhausted) return;
-	const literal = joinPartLiteralText(value);
-	if (literal !== void 0) return pushPlaceholderPart(out, literal, budget);
-	if (isPlainObject$4(value) && Object.keys(value).length === 1) {
-		const ref = value["Ref"];
-		if (typeof ref === "string" && ref !== "") return pushPlaceholderPart(out, keyedPart({ Ref: ref }), budget);
-		if (depth >= MAX_PLACEHOLDER_DEPTH) {
-			budget.exhausted = true;
-			return;
-		}
-		if (appendParameterPlaceholderParts(value, out, budget, depth + 1)) return;
-		return pushPlaceholderPart(out, keyedPart(value), budget);
-	}
-	pushPlaceholderPart(out, UNKNOWN_PART, budget);
-}
-function appendParameterPlaceholderParts(source, out, budget, depth) {
-	const keys = Object.keys(source);
-	if (keys.length !== 1) return false;
-	const key = keys[0];
-	if (key === "Fn::Join") {
-		const args = source[key];
-		if (!Array.isArray(args) || args.length !== 2) return false;
-		const [delimiter, parts] = args;
-		if (typeof delimiter !== "string" || !Array.isArray(parts)) return false;
-		for (let index = 0; index < parts.length && !budget.exhausted; index++) {
-			if (index > 0) pushPlaceholderPart(out, delimiter, budget);
-			appendValuePlaceholderParts(parts[index], out, budget, depth);
-		}
-		return true;
-	}
-	if (key === "Fn::Sub") {
-		const args = source[key];
-		let template;
-		let variables = {};
-		if (typeof args === "string") template = args;
-		else if (Array.isArray(args) && args.length === 2 && isPlainObject$4(args[1])) {
-			template = args[0];
-			variables = args[1];
-		} else return false;
-		if (typeof template !== "string") return false;
-		let cursor = 0;
-		for (const hit of template.matchAll(/\$\{(!)?([^}]*)\}/g)) {
-			if (budget.exhausted) return true;
-			pushPlaceholderPart(out, template.slice(cursor, hit.index), budget);
-			cursor = hit.index + hit[0].length;
-			const name = hit[2] ?? "";
-			if (hit[1] === "!") pushPlaceholderPart(out, `\${${name}}`, budget);
-			else if (name === "") pushPlaceholderPart(out, hit[0], budget);
-			else if (Object.hasOwn(variables, name)) appendValuePlaceholderParts(variables[name], out, budget, depth);
-			else if (name.includes(".")) pushPlaceholderPart(out, keyedPart({ "Fn::GetAtt": name }), budget);
-			else pushPlaceholderPart(out, keyedPart({ Ref: name }), budget);
-		}
-		pushPlaceholderPart(out, template.slice(cursor), budget);
-		return true;
-	}
-	return false;
-}
-function parameterPlaceholderParts(source, bag) {
-	const budget = {
-		remaining: bag.length * 2 + 16,
-		exhausted: false
-	};
-	const out = [];
-	if (!appendParameterPlaceholderParts(source, out, budget, 0)) return void 0;
-	return budget.exhausted ? void 0 : out;
-}
-function positionByParameterPlaceholders(bag, source, secrets) {
-	const associations = crossStackAssociations.get(secrets);
-	if (associations === void 0) return void 0;
-	const spanned = positionByRecordedParameterSpans(bag, source, secrets, associations);
-	if (spanned !== void 0) return spanned;
-	const parts = parameterPlaceholderParts(source, bag);
-	if (parts === void 0) return void 0;
-	const before = ["", ""];
-	const after = ["", ""];
-	let side = before;
-	let unknown = false;
-	let certified = 0;
-	const spans = [];
-	for (const part of parts) {
-		let rendered;
-		let persisted;
-		if (typeof part === "string") {
-			rendered = part;
-			persisted = part;
-		} else {
-			let expression;
-			let plaintext = "";
-			if (part !== UNKNOWN_PART) {
-				const association = associations.get(part.key);
-				if (association !== void 0 && typeof association !== "symbol") {
-					plaintext = association.plaintext;
-					expression = certifiedExpressionForLeaf(secrets, association, plaintext);
-				}
-			}
-			if (expression === void 0) {
-				if (unknown) return void 0;
-				unknown = true;
-				side = after;
-				continue;
-			}
-			rendered = plaintext;
-			persisted = expression;
-			certified += 1;
-			spans.push([
-				side,
-				side[0].length,
-				plaintext.length
-			]);
-		}
-		side[0] += rendered;
-		side[1] += persisted;
-	}
-	if (certified === 0) return void 0;
-	let persisted;
-	if (!unknown) {
-		if (before[0] !== bag) return void 0;
-		persisted = before[1];
-	} else {
-		if (bag.length < before[0].length + after[0].length) return void 0;
-		if (!bag.startsWith(before[0]) || !bag.endsWith(after[0])) return void 0;
-		const middle = bag.slice(before[0].length, bag.length - after[0].length);
-		if (redactSecretsForState(middle, secrets) !== middle) return void 0;
-		persisted = before[1] + middle + after[1];
-	}
-	const afterStart = bag.length - after[0].length;
-	return acceptedPlaceholderRendering(bag, persisted, spans.map(([side, offset, length]) => [(side === before ? 0 : afterStart) + offset, length]), secrets);
-}
-function acceptedPlaceholderRendering(bag, persisted, spans, secrets) {
-	for (const plaintext of secrets.keys()) {
-		if (plaintext.length < 4) continue;
-		for (let at = bag.indexOf(plaintext); at !== -1; at = bag.indexOf(plaintext, at + 1)) {
-			const end = at + plaintext.length;
-			for (const [start, length] of spans) if (at < start + length && end > start && (at < start || end > start + length)) return void 0;
-		}
-	}
-	if (redactSecretsForState(persisted, secrets) !== persisted) return void 0;
-	return persisted;
-}
-function positionByRecordedParameterSpans(bag, source, secrets, associations) {
-	const resolution = intrinsicLeafResolutionOf(secrets, source);
-	if (resolution === void 0 || resolution.output !== bag) return void 0;
-	const recorded = resolution.parameterSpans;
-	if (recorded === void 0) return void 0;
-	let previousEnd = 0;
-	let cursor = 0;
-	let persisted = "";
-	const gaps = [];
-	const certified = [];
-	for (const { start, length, key } of recorded) {
-		if (!(start >= previousEnd && length > 0 && start + length <= bag.length)) return void 0;
-		previousEnd = start + length;
-		const text = bag.slice(start, start + length);
-		const association = associations.get(key);
-		if (association === void 0 || typeof association === "symbol") continue;
-		const expression = certifiedExpressionForLeaf(secrets, association, text);
-		if (expression === void 0) continue;
-		const gap = bag.slice(cursor, start);
-		gaps.push(gap);
-		persisted += gap + expression;
-		certified.push([start, length]);
-		cursor = start + length;
-	}
-	if (certified.length === 0) return void 0;
-	const tail = bag.slice(cursor);
-	gaps.push(tail);
-	persisted += tail;
-	for (const gap of gaps) if (redactSecretsForState(gap, secrets) !== gap) return void 0;
-	return acceptedPlaceholderRendering(bag, persisted, certified, secrets);
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/identity-keys.ts
-const ARRAY_IDENTITY_KEYS = ["Name", "Key"];
-function isUniquelyKeyedBy(items, key) {
-	if (items.length === 0) return false;
-	const seen = /* @__PURE__ */ new Set();
-	for (const item of items) {
-		if (!isPlainObject$4(item) || !Object.hasOwn(item, key)) return false;
-		const id = item[key];
-		if (typeof id !== "string" || id === "") return false;
-		if (seen.has(id)) return false;
-		seen.add(id);
-	}
-	return true;
-}
-function identityKeyFor(bag, source) {
-	for (const key of ARRAY_IDENTITY_KEYS) if (isUniquelyKeyedBy(bag, key) && isUniquelyKeyedBy(source, key)) return key;
-}
-function positionListByCrossStackSource(bag, source, secrets) {
-	const association = associationForSource(source, secrets);
-	if (association === void 0) return void 0;
-	return certifiedListForLeaf(secrets, association, bag);
-}
-
 //#endregion
 //#region src/deployment/secret-redaction/fresh-noecho.ts
 function embedsFreshNoEchoValue(text, secrets, freshClass) {
@@ -7000,6 +6789,7 @@ function recoverMaskedOutput(identity, stackName, region, outputKey) {
 //#region src/deployment/secret-redaction/nested-stack.ts
 const NESTED_STACK_RESOURCE_TYPE$4 = "AWS::CloudFormation::Stack";
 const nestedStackParameterExpressions = /* @__PURE__ */ new WeakMap();
+const renderedParameterSpellings = /* @__PURE__ */ new WeakMap();
 const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, rules = TEMPLATE_DERIVED_RULES) {
 	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$4) return;
@@ -7012,6 +6802,23 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 	if (!isPlainObject$4(resolvedParameters) || !isPlainObject$4(sourceParameters)) return;
 	const positioned = redactSecretsForState(markSameGenerationBag({ ...resolvedParameters }), secrets, sourceParameters, rules);
 	let table = nestedStackParameterExpressions.get(secrets);
+	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
+		const sourceLeaf = sourceParameters[name];
+		if (typeof resolvedValue !== "string" || typeof sourceLeaf !== "string") continue;
+		if (isSingleDynamicReferenceToken(sourceLeaf) || positioned[name] !== sourceLeaf) continue;
+		if (!rendersLiteralTo(sourceLeaf, secrets, resolvedValue)) continue;
+		let rendered = renderedParameterSpellings.get(secrets);
+		if (rendered === void 0) {
+			rendered = /* @__PURE__ */ new Map();
+			renderedParameterSpellings.set(secrets, rendered);
+		}
+		const previous = rendered.get(name);
+		if (previous === void 0) rendered.set(name, {
+			spelling: sourceLeaf,
+			value: resolvedValue
+		});
+		else if (previous?.spelling !== sourceLeaf || previous.value !== resolvedValue) rendered.set(name, null);
+	}
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
 		if (typeof resolvedValue !== "string" || !secrets.has(resolvedValue)) continue;
 		const expression = positioned[name];
@@ -7146,10 +6953,44 @@ function inheritNestedStackParameterAssociations(childSecrets, parentSecrets) {
 }
 function inheritedParameterExpression(parentSecrets, parameterName, resolvedValue) {
 	const association = nestedStackParameterExpressions.get(parentSecrets)?.get(parameterName);
-	if (association === void 0 || typeof association === "symbol") return void 0;
+	if (association === void 0) return renderedParameterSpelling(parentSecrets, parameterName, resolvedValue);
+	if (typeof association === "symbol") return void 0;
 	if (Array.isArray(resolvedValue)) return certifiedListForLeaf(parentSecrets, association, resolvedValue);
 	return certifiedExpressionForLeaf(parentSecrets, association, resolvedValue);
 }
+function renderedParameterSpelling(parentSecrets, parameterName, resolvedValue) {
+	if (typeof resolvedValue !== "string" || parentSecrets.has(resolvedValue)) return void 0;
+	const rendered = renderedParameterSpellings.get(parentSecrets)?.get(parameterName);
+	if (rendered == null || rendered.value !== resolvedValue) return void 0;
+	if (!rendersLiteralTo(rendered.spelling, parentSecrets, resolvedValue)) return void 0;
+	return rendered.spelling;
+}
+function inheritedRenderedToken(parentSecrets, parameterName, value, plaintext) {
+	const spelling = inheritedParameterExpression(parentSecrets, parameterName, value);
+	if (typeof spelling !== "string" || isSingleDynamicReferenceToken(spelling)) return void 0;
+	return renderedTokenOf(spelling, parentSecrets, plaintext);
+}
+function withdrawRenderedParameterSpelling(parentSecrets, parameterName) {
+	const rendered = renderedParameterSpellings.get(parentSecrets);
+	if (rendered?.has(parameterName)) rendered.set(parameterName, null);
+}
+function inheritedRenderedSpan(childSecrets, key, text) {
+	const reads = inheritedParameterReads.get(childSecrets);
+	if (reads === void 0 || typeof reads === "symbol") return void 0;
+	for (const name of reads.names) {
+		if (crossStackSourceKey({ Ref: name }) !== key) continue;
+		const value = renderedParameterSpellings.get(reads.parent)?.get(name)?.value;
+		if (value === void 0 || text !== void 0 && text !== value) return void 0;
+		if (carriesChildOnlyPlaintext(value, childSecrets, reads.parent)) return void 0;
+		const spelling = inheritedParameterExpression(reads.parent, name, value);
+		if (typeof spelling !== "string") return void 0;
+		if (redactSecretsForState(spelling, childSecrets) !== spelling) return void 0;
+		return {
+			value,
+			spelling
+		};
+	}
+}
 const inheritedParameterReads = /* @__PURE__ */ new WeakMap();
 const POISONED_PARAMETER_READS = Symbol("cdkd.inherited-parameter-reads.poisoned");
 function recordInheritedParameterRead(childSecrets, parentSecrets, parameterName) {
@@ -7199,6 +7040,222 @@ function carriesChildOnlyPlaintext(value, childSecrets, parentSecrets) {
 	return visit(value);
 }
 
+//#endregion
+//#region src/deployment/secret-redaction/placeholder-positions.ts
+function keyedPart(source) {
+	const key = crossStackSourceKey(source);
+	return key === void 0 ? UNKNOWN_PART : { key };
+}
+const MAX_PLACEHOLDER_DEPTH = 8;
+function pushPlaceholderPart(out, part, budget) {
+	if (budget.remaining <= 0) {
+		budget.exhausted = true;
+		return;
+	}
+	budget.remaining -= 1;
+	out.push(part);
+}
+function appendValuePlaceholderParts(value, out, budget, depth) {
+	if (budget.exhausted) return;
+	const literal = joinPartLiteralText(value);
+	if (literal !== void 0) return pushPlaceholderPart(out, literal, budget);
+	if (isPlainObject$4(value) && Object.keys(value).length === 1) {
+		const ref = value["Ref"];
+		if (typeof ref === "string" && ref !== "") return pushPlaceholderPart(out, keyedPart({ Ref: ref }), budget);
+		if (depth >= MAX_PLACEHOLDER_DEPTH) {
+			budget.exhausted = true;
+			return;
+		}
+		if (appendParameterPlaceholderParts(value, out, budget, depth + 1)) return;
+		return pushPlaceholderPart(out, keyedPart(value), budget);
+	}
+	pushPlaceholderPart(out, UNKNOWN_PART, budget);
+}
+function appendParameterPlaceholderParts(source, out, budget, depth) {
+	const keys = Object.keys(source);
+	if (keys.length !== 1) return false;
+	const key = keys[0];
+	if (key === "Fn::Join") {
+		const args = source[key];
+		if (!Array.isArray(args) || args.length !== 2) return false;
+		const [delimiter, parts] = args;
+		if (typeof delimiter !== "string" || !Array.isArray(parts)) return false;
+		for (let index = 0; index < parts.length && !budget.exhausted; index++) {
+			if (index > 0) pushPlaceholderPart(out, delimiter, budget);
+			appendValuePlaceholderParts(parts[index], out, budget, depth);
+		}
+		return true;
+	}
+	if (key === "Fn::Sub") {
+		const args = source[key];
+		let template;
+		let variables = {};
+		if (typeof args === "string") template = args;
+		else if (Array.isArray(args) && args.length === 2 && isPlainObject$4(args[1])) {
+			template = args[0];
+			variables = args[1];
+		} else return false;
+		if (typeof template !== "string") return false;
+		let cursor = 0;
+		for (const hit of template.matchAll(/\$\{(!)?([^}]*)\}/g)) {
+			if (budget.exhausted) return true;
+			pushPlaceholderPart(out, template.slice(cursor, hit.index), budget);
+			cursor = hit.index + hit[0].length;
+			const name = hit[2] ?? "";
+			if (hit[1] === "!") pushPlaceholderPart(out, `\${${name}}`, budget);
+			else if (name === "") pushPlaceholderPart(out, hit[0], budget);
+			else if (Object.hasOwn(variables, name)) appendValuePlaceholderParts(variables[name], out, budget, depth);
+			else if (name.includes(".")) pushPlaceholderPart(out, keyedPart({ "Fn::GetAtt": name }), budget);
+			else pushPlaceholderPart(out, keyedPart({ Ref: name }), budget);
+		}
+		pushPlaceholderPart(out, template.slice(cursor), budget);
+		return true;
+	}
+	return false;
+}
+function parameterPlaceholderParts(source, bag) {
+	const budget = {
+		remaining: bag.length * 2 + 16,
+		exhausted: false
+	};
+	const out = [];
+	if (!appendParameterPlaceholderParts(source, out, budget, 0)) return void 0;
+	return budget.exhausted ? void 0 : out;
+}
+function positionByParameterPlaceholders(bag, source, secrets) {
+	const associations = crossStackAssociations.get(secrets);
+	const spanned = positionByRecordedParameterSpans(bag, source, secrets, associations);
+	if (spanned !== void 0) return spanned;
+	const parts = parameterPlaceholderParts(source, bag);
+	if (parts === void 0) return void 0;
+	const before = ["", ""];
+	const after = ["", ""];
+	let side = before;
+	let unknown = false;
+	let certified = 0;
+	const spans = [];
+	for (const part of parts) {
+		let rendered;
+		let persisted;
+		if (typeof part === "string") {
+			rendered = part;
+			persisted = part;
+		} else {
+			let expression;
+			let plaintext = "";
+			if (part !== UNKNOWN_PART) {
+				const association = associations?.get(part.key);
+				if (association !== void 0 && typeof association !== "symbol") {
+					plaintext = association.plaintext;
+					expression = certifiedExpressionForLeaf(secrets, association, plaintext);
+				}
+				if (expression === void 0) {
+					const inherited = inheritedRenderedSpan(secrets, part.key);
+					if (inherited !== void 0) {
+						plaintext = inherited.value;
+						expression = inherited.spelling;
+					}
+				}
+			}
+			if (expression === void 0) {
+				if (unknown) return void 0;
+				unknown = true;
+				side = after;
+				continue;
+			}
+			rendered = plaintext;
+			persisted = expression;
+			certified += 1;
+			spans.push([
+				side,
+				side[0].length,
+				plaintext.length
+			]);
+		}
+		side[0] += rendered;
+		side[1] += persisted;
+	}
+	if (certified === 0) return void 0;
+	let persisted;
+	if (!unknown) {
+		if (before[0] !== bag) return void 0;
+		persisted = before[1];
+	} else {
+		if (bag.length < before[0].length + after[0].length) return void 0;
+		if (!bag.startsWith(before[0]) || !bag.endsWith(after[0])) return void 0;
+		const middle = bag.slice(before[0].length, bag.length - after[0].length);
+		if (redactSecretsForState(middle, secrets) !== middle) return void 0;
+		persisted = before[1] + middle + after[1];
+	}
+	const afterStart = bag.length - after[0].length;
+	return acceptedPlaceholderRendering(bag, persisted, spans.map(([side, offset, length]) => [(side === before ? 0 : afterStart) + offset, length]), secrets);
+}
+function acceptedPlaceholderRendering(bag, persisted, spans, secrets) {
+	for (const plaintext of secrets.keys()) {
+		if (plaintext.length < 4) continue;
+		for (let at = bag.indexOf(plaintext); at !== -1; at = bag.indexOf(plaintext, at + 1)) {
+			const end = at + plaintext.length;
+			for (const [start, length] of spans) if (at < start + length && end > start && (at < start || end > start + length)) return void 0;
+		}
+	}
+	if (redactSecretsForState(persisted, secrets) !== persisted) return void 0;
+	return persisted;
+}
+function positionByRecordedParameterSpans(bag, source, secrets, associations) {
+	const resolution = intrinsicLeafResolutionOf(secrets, source);
+	if (resolution === void 0 || resolution.output !== bag) return void 0;
+	const recorded = resolution.parameterSpans;
+	if (recorded === void 0) return void 0;
+	let previousEnd = 0;
+	let cursor = 0;
+	let persisted = "";
+	const gaps = [];
+	const certified = [];
+	for (const { start, length, key } of recorded) {
+		if (!(start >= previousEnd && length > 0 && start + length <= bag.length)) return void 0;
+		previousEnd = start + length;
+		const text = bag.slice(start, start + length);
+		const association = associations?.get(key);
+		const expression = (association !== void 0 && typeof association !== "symbol" ? certifiedExpressionForLeaf(secrets, association, text) : void 0) ?? inheritedRenderedSpan(secrets, key, text)?.spelling;
+		if (expression === void 0) continue;
+		const gap = bag.slice(cursor, start);
+		gaps.push(gap);
+		persisted += gap + expression;
+		certified.push([start, length]);
+		cursor = start + length;
+	}
+	if (certified.length === 0) return void 0;
+	const tail = bag.slice(cursor);
+	gaps.push(tail);
+	persisted += tail;
+	for (const gap of gaps) if (redactSecretsForState(gap, secrets) !== gap) return void 0;
+	return acceptedPlaceholderRendering(bag, persisted, certified, secrets);
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/identity-keys.ts
+const ARRAY_IDENTITY_KEYS = ["Name", "Key"];
+function isUniquelyKeyedBy(items, key) {
+	if (items.length === 0) return false;
+	const seen = /* @__PURE__ */ new Set();
+	for (const item of items) {
+		if (!isPlainObject$4(item) || !Object.hasOwn(item, key)) return false;
+		const id = item[key];
+		if (typeof id !== "string" || id === "") return false;
+		if (seen.has(id)) return false;
+		seen.add(id);
+	}
+	return true;
+}
+function identityKeyFor(bag, source) {
+	for (const key of ARRAY_IDENTITY_KEYS) if (isUniquelyKeyedBy(bag, key) && isUniquelyKeyedBy(source, key)) return key;
+}
+function positionListByCrossStackSource(bag, source, secrets) {
+	const association = associationForSource(source, secrets);
+	if (association === void 0) return void 0;
+	return certifiedListForLeaf(secrets, association, bag);
+}
+
 //#endregion
 //#region src/deployment/secret-redaction/redact-path.ts
 function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameGeneration) {
@@ -7737,11 +7794,67 @@ function singleSpanFrame(bag, source) {
 }
 function positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration) {
 	const frame = singleSpanFrame(bag, source);
-	if (frame === void 0) return redactSecretsForState(bag, secrets);
+	if (frame === void 0) {
+		if (dynamicReferenceSpans(source).length >= 2 && certifiesRenderedLiteral(bag, source, secrets, bagIsSameGeneration)) return source;
+		return redactSecretsForState(bag, secrets);
+	}
 	const recorded = resolvedPlaintextOf(secrets, frame.token);
 	if (recorded === void 0 || recorded !== frame.middle) return redactSecretsForState(bag, secrets);
 	return writeFramedTokenWithinScanBound(bag, secrets, frame, bagIsSameGeneration);
 }
+function pairedSpans(source, secrets) {
+	const spans = dynamicReferenceSpans(source);
+	if (spans.length === 0) return void 0;
+	const out = [];
+	for (const span of spans) {
+		const plaintext = resolvedPlaintextOf(secrets, source.slice(span.start, span.end));
+		if (plaintext === void 0 || plaintext === "") return void 0;
+		if (isSingleDynamicReferenceToken(plaintext)) return void 0;
+		out.push({
+			...span,
+			plaintext
+		});
+	}
+	return out;
+}
+function renderedTokenOf(spelling, secrets, plaintext) {
+	const spans = pairedSpans(spelling, secrets);
+	if (spans === void 0) return void 0;
+	const tokens = new Set(spans.filter((span) => span.plaintext === plaintext).map((span) => spelling.slice(span.start, span.end)));
+	return tokens.size === 1 ? [...tokens][0] : void 0;
+}
+function renderSpans(source, spans, textOf) {
+	let out = "";
+	let cursor = 0;
+	spans.forEach((span, index) => {
+		out += source.slice(cursor, span.start) + textOf(index);
+		cursor = span.end;
+	});
+	return out + source.slice(cursor);
+}
+function rendersLiteralTo(spelling, secrets, value) {
+	return renderedLiteralSpans(spelling, secrets, value) !== void 0;
+}
+function renderedLiteralSpans(spelling, secrets, value) {
+	const spans = pairedSpans(spelling, secrets);
+	if (spans === void 0) return void 0;
+	if (renderSpans(spelling, spans, (i) => spans[i].plaintext) !== value) return void 0;
+	return redactSecretsForState(spelling, secrets) === spelling ? spans : void 0;
+}
+function certifiesRenderedLiteral(bag, source, secrets, bagIsSameGeneration) {
+	const spans = renderedLiteralSpans(source, secrets, bag);
+	if (spans === void 0) return false;
+	const survivors = [];
+	for (const span of spans) {
+		const survivor = secrets.get(span.plaintext);
+		if (survivor === void 0) return false;
+		survivors.push(survivor);
+	}
+	const scanned = redactSecretsForState(bag, secrets);
+	if (scanned === renderSpans(source, spans, (i) => survivors[i])) return true;
+	if (!bagIsSameGeneration) return false;
+	return scanned === renderSpans(source, spans, (i) => spans[i].plaintext.length >= 4 ? survivors[i] : spans[i].plaintext);
+}
 function writeFramedTokenWithinScanBound(bag, secrets, frame, bagIsSameGeneration) {
 	const scanned = redactSecretsForState(bag, secrets);
 	const { token, prefix, suffix, middle } = frame;
@@ -10060,7 +10173,11 @@ const CREATE_ONLY_PATHS_SNAPSHOT = /* @__PURE__ */ new Map([
 	["AWS::AutoScaling::AutoScalingGroup", [["AutoScalingGroupName"], ["InstanceId"]]],
 	["AWS::BedrockAgentCore::Browser", []],
 	["AWS::BedrockAgentCore::CodeInterpreter", []],
-	["AWS::BedrockAgentCore::Evaluator", [["EvaluatorName"]]],
+	["AWS::BedrockAgentCore::Evaluator", [[
+		"EvaluatorConfig",
+		"Derived",
+		"BaseEvaluatorId"
+	], ["EvaluatorName"]]],
 	["AWS::BedrockAgentCore::Runtime", [["AgentRuntimeName"]]],
 	["AWS::Budgets::Budget", [["NotificationsWithSubscribers"]]],
 	["AWS::CertificateManager::Certificate", [
@@ -10338,7 +10455,8 @@ const CREATE_ONLY_PATHS_SNAPSHOT = /* @__PURE__ */ new Map([
 	["AWS::Glue::Table", [
 		["CatalogId"],
 		["DatabaseName"],
-		["Name"]
+		["Name"],
+		["TableInput", "Name"]
 	]],
 	["AWS::Glue::Trigger", [
 		["Name"],
@@ -12807,6 +12925,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"CreatedAt",
 			"EvaluatorArn",
 			"EvaluatorId",
+			"EvaluatorType",
+			"Provider",
 			"Status",
 			"UpdatedAt"
 		]),
@@ -14052,7 +14172,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
-		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		readOnly: /* @__PURE__ */ new Set(),
 		ccRouteUnavailable: true
 	}],
 	["AWS::Glue::Trigger", {
@@ -20823,12 +20943,92 @@ function recordInheritedParameterSecrets(parameterName, value, context) {
 	if (inherited && recorded) recordInheritedNoEchoListElements(this, inherited, recorded, value, context);
 	if (!inherited || inherited.size === 0 || !recorded) return;
 	for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) {
-		const own = inheritedParameterExpression(inherited, parameterName, plaintext);
-		recorded.set(plaintext, typeof own === "string" ? own : expression);
+		recorded.set(plaintext, carriedExpressionFor(inherited, parameterName, value, plaintext, expression));
 		recordInheritedParameterRead(recorded, inherited, parameterName);
 		carryFreshNoEchoMark(inherited, recorded, plaintext);
 	}
 }
+function carriedExpressionFor(inherited, parameterName, value, plaintext, survivor) {
+	const own = inheritedParameterExpression(inherited, parameterName, plaintext);
+	if (typeof own === "string") return own;
+	return inheritedRenderedToken(inherited, parameterName, value, plaintext) ?? survivor;
+}
+function poisonRenderedSpellingsCollidingIn(template, parameterValues, inherited) {
+	if (!inherited || inherited.size === 0 || template === void 0) return;
+	const names = new Set(Object.keys(parameterValues));
+	if (names.size < 2) return;
+	const groups = [];
+	if (template.Resources !== null && typeof template.Resources === "object") for (const resource of Object.values(template.Resources)) groups.push([resource, false]);
+	if (template.Outputs !== void 0) groups.push([template.Outputs, true]);
+	const readsByGroup = groups.map(([group, countBareRefs]) => parameterReadsOf(group, names, countBareRefs)).filter((reads) => reads.size >= 2);
+	const withdrawn = /* @__PURE__ */ new Set();
+	for (;;) {
+		const fresh = [...collidingRenderedNames(readsByGroup, parameterValues, inherited)].filter((name) => !withdrawn.has(name));
+		if (fresh.length === 0) return;
+		for (const name of fresh) {
+			withdrawn.add(name);
+			withdrawRenderedParameterSpelling(inherited, name);
+		}
+	}
+}
+function collidingRenderedNames(readsByGroup, parameterValues, inherited) {
+	const withdraw = /* @__PURE__ */ new Set();
+	for (const reads of readsByGroup) {
+		const byPlaintext = /* @__PURE__ */ new Map();
+		const slotReadPlaintexts = /* @__PURE__ */ new Set();
+		for (const [name, slotRead] of reads) {
+			if (!Object.hasOwn(parameterValues, name)) continue;
+			const value = parameterValues[name];
+			for (const [plaintext, survivor] of inheritedSecretsCarriedBy(value, inherited)) {
+				const expression = carriedExpressionFor(inherited, name, value, plaintext, survivor);
+				const rendered = typeof inheritedParameterExpression(inherited, name, plaintext) !== "string" && inheritedRenderedToken(inherited, name, value, plaintext) !== void 0;
+				let byExpression = byPlaintext.get(plaintext);
+				if (byExpression === void 0) {
+					byExpression = /* @__PURE__ */ new Map();
+					byPlaintext.set(plaintext, byExpression);
+				}
+				let renderedNames = byExpression.get(expression);
+				if (renderedNames === void 0) {
+					renderedNames = [];
+					byExpression.set(expression, renderedNames);
+				}
+				if (rendered) renderedNames.push(name);
+				if (slotRead) slotReadPlaintexts.add(plaintext);
+			}
+		}
+		for (const [plaintext, byExpression] of byPlaintext) {
+			if (byExpression.size < 2 || !slotReadPlaintexts.has(plaintext)) continue;
+			for (const renderedNames of byExpression.values()) for (const name of renderedNames) withdraw.add(name);
+		}
+	}
+	return withdraw;
+}
+const POSITIONED_INTRINSICS = /* @__PURE__ */ new Set(["Fn::Join", "Fn::Sub"]);
+function parameterReadsOf(node, names, countBareRefs) {
+	const reads = /* @__PURE__ */ new Map();
+	const add = (name, slotRead) => {
+		reads.set(name, slotRead || reads.get(name) === true);
+	};
+	const visit = (value, slotRead) => {
+		if (Array.isArray(value)) {
+			for (const element of value) visit(element, slotRead);
+			return;
+		}
+		if (value === null || typeof value !== "object") return;
+		const record = value;
+		const ref = record["Ref"];
+		if (typeof ref === "string" && names.has(ref)) add(ref, slotRead);
+		const sub = record["Fn::Sub"];
+		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
+		if (typeof text === "string") for (const match of text.matchAll(/\$\{([^}!][^}]*)\}/g)) {
+			const name = match[1].trim();
+			if (names.has(name)) add(name, slotRead);
+		}
+		for (const [key, child] of Object.entries(record)) visit(child, slotRead || key.startsWith("Fn::") && !POSITIONED_INTRINSICS.has(key));
+	};
+	visit(node, countBareRefs);
+	return reads;
+}
 function recordInheritedNoEchoListElements(resolver, inherited, recorded, value, context) {
 	if (!Array.isArray(value)) return;
 	const parameterValues = [...inherited.keys()].filter((plaintext) => isNoEchoParameterPlaintext(inherited, plaintext));
@@ -22716,7 +22916,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BbWC_1l5.js");
+			const { ASGProvider } = await import("./asg-provider-Bgno8Vo9.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -22822,7 +23022,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-e6XtJAGl.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DlSon_pZ.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-iDLOVERv.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-Dp8_fNO_.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -24715,6 +24915,9 @@ const NESTED_REQUIRED = /* @__PURE__ */ new Map([
 	["AWS::BedrockAgentCore::Evaluator", /* @__PURE__ */ new Map([
 		["EvaluatorConfig.CodeBased", ["LambdaConfig"]],
 		["EvaluatorConfig.CodeBased.LambdaConfig", ["LambdaArn"]],
+		["EvaluatorConfig.Derived", ["BaseEvaluatorId", "ModelConfig"]],
+		["EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig", ["ModelId"]],
+		["EvaluatorConfig.Derived.ModelConfig.ResponsesEvaluatorModelConfig", ["ModelId"]],
 		["EvaluatorConfig.LlmAsAJudge", [
 			"Instructions",
 			"ModelConfig",
@@ -26139,7 +26342,7 @@ const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::AppSync::GraphQLApi", "{\"AdditionalAuthenticationProviders\":\"array\",\"AdditionalAuthenticationProviders[]\":\"object\",\"AdditionalAuthenticationProviders[].LambdaAuthorizerConfig\":\"object\",\"AdditionalAuthenticationProviders[].OpenIDConnectConfig\":\"object\",\"AdditionalAuthenticationProviders[].UserPoolConfig\":\"object\",\"EnhancedMetricsConfig\":\"object\",\"EnvironmentVariables\":\"object\",\"LambdaAuthorizerConfig\":\"object\",\"LogConfig\":\"object\",\"OpenIDConnectConfig\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"UserPoolConfig\":\"object\"}"],
 	["AWS::AppSync::Resolver", "{\"CachingConfig\":\"object\",\"CachingConfig.CachingKeys\":\"array\",\"PipelineConfig\":\"object\",\"PipelineConfig.Functions\":\"array\",\"Runtime\":\"object\",\"SyncConfig\":\"object\",\"SyncConfig.LambdaConflictHandlerConfig\":\"object\"}"],
 	["AWS::AutoScaling::AutoScalingGroup", "{\"AvailabilityZoneDistribution\":\"object\",\"AvailabilityZoneIds\":\"array\",\"AvailabilityZoneImpairmentPolicy\":\"object\",\"AvailabilityZones\":\"array\",\"CapacityReservationSpecification\":\"object\",\"CapacityReservationSpecification.CapacityReservationTarget\":\"object\",\"CapacityReservationSpecification.CapacityReservationTarget.CapacityReservationIds\":\"array\",\"CapacityReservationSpecification.CapacityReservationTarget.CapacityReservationResourceGroupArns\":\"array\",\"InstanceLifecyclePolicy\":\"object\",\"InstanceLifecyclePolicy.RetentionTriggers\":\"object\",\"InstanceMaintenancePolicy\":\"object\",\"LaunchTemplate\":\"object\",\"LifecycleHookSpecificationList\":\"array\",\"LifecycleHookSpecificationList[]\":\"object\",\"LoadBalancerNames\":\"array\",\"MetricsCollection\":\"array\",\"MetricsCollection[]\":\"object\",\"MetricsCollection[].Metrics\":\"array\",\"MixedInstancesPolicy\":\"object\",\"MixedInstancesPolicy.InstancesDistribution\":\"object\",\"MixedInstancesPolicy.InstancesDistribution.DistributionSegments\":\"array\",\"MixedInstancesPolicy.InstancesDistribution.DistributionSegments[]\":\"object\",\"MixedInstancesPolicy.InstancesDistribution.DistributionSegments[].TargetCapacityTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.LaunchTemplateSpecification\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[]\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorCount\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorManufacturers\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorNames\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorTotalMemoryMiB\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AllowedInstanceTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselineEbsBandwidthMbps\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors.Cpu\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors.Cpu.References\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors.Cpu.References[]\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.CpuManufacturers\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.ExcludedInstanceTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.InstanceGenerations\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.LocalStorageTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.MemoryGiBPerVCpu\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.MemoryMiB\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.NetworkBandwidthGbps\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.NetworkInterfaceCount\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.TotalLocalStorageGB\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.VCpuCount\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].LaunchTemplateSpecification\":\"object\",\"NotificationConfiguration\":\"object\",\"NotificationConfiguration.NotificationTypes\":\"array\",\"NotificationConfigurations\":\"array\",\"NotificationConfigurations[]\":\"object\",\"NotificationConfigurations[].NotificationTypes\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"TargetGroupARNs\":\"array\",\"TerminationPolicies\":\"array\",\"TrafficSources\":\"array\",\"TrafficSources[]\":\"object\",\"VPCZoneIdentifier\":\"array\"}"],
-	["AWS::BedrockAgentCore::Evaluator", "{\"EvaluatorConfig\":\"object\",\"EvaluatorConfig.CodeBased\":\"object\",\"EvaluatorConfig.CodeBased.LambdaConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.AdditionalModelRequestFields\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig.Reasoning\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical[]\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
+	["AWS::BedrockAgentCore::Evaluator", "{\"EvaluatorConfig\":\"object\",\"EvaluatorConfig.CodeBased\":\"object\",\"EvaluatorConfig.CodeBased.LambdaConfig\":\"object\",\"EvaluatorConfig.Derived\":\"object\",\"EvaluatorConfig.Derived.ModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.AdditionalModelRequestFields\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.ResponsesEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.ResponsesEvaluatorModelConfig.Reasoning\":\"object\",\"EvaluatorConfig.LlmAsAJudge\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.AdditionalModelRequestFields\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig.Reasoning\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical[]\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::BedrockAgentCore::Runtime", "{\"AgentRuntimeArtifact\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration.Code\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration.Code.S3\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration.EntryPoint\":\"array\",\"AgentRuntimeArtifact.ContainerConfiguration\":\"object\",\"AuthorizerConfiguration\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedAudience\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedClients\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedScopes\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.HostingEnvironments\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.HostingEnvironments[]\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.WorkloadIdentities\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[]\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[].AuthorizingClaimMatchValue\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[].AuthorizingClaimMatchValue.ClaimMatchValue\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[].AuthorizingClaimMatchValue.ClaimMatchValue.MatchValueStringList\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource.SecurityGroupIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource.SubnetIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource.Tags\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.SelfManagedLatticeResource\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[]\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource.SecurityGroupIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource.SubnetIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource.Tags\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.SelfManagedLatticeResource\":\"object\",\"CapacityProviderConfiguration\":\"object\",\"EnvironmentVariables\":\"object\",\"FilesystemConfigurations\":\"array\",\"FilesystemConfigurations[]\":\"object\",\"FilesystemConfigurations[].CapacityProviderVolume\":\"object\",\"FilesystemConfigurations[].EfsAccessPoint\":\"object\",\"FilesystemConfigurations[].S3FilesAccessPoint\":\"object\",\"FilesystemConfigurations[].SessionStorage\":\"object\",\"LifecycleConfiguration\":\"object\",\"NetworkConfiguration\":\"object\",\"NetworkConfiguration.NetworkModeConfig\":\"object\",\"NetworkConfiguration.NetworkModeConfig.SecurityGroups\":\"array\",\"NetworkConfiguration.NetworkModeConfig.Subnets\":\"array\",\"RequestHeaderConfiguration\":\"object\",\"RequestHeaderConfiguration.RequestHeaderAllowlist\":\"array\",\"Tags\":\"object\",\"WorkloadIdentityDetails\":\"object\"}"],
 	["AWS::CertificateManager::Certificate", "{\"DomainValidationOptions\":\"array\",\"DomainValidationOptions[]\":\"object\",\"SubjectAlternativeNames\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::CloudFormation::Stack", "{\"Capabilities\":\"array\",\"NotificationARNs\":\"array\",\"Outputs\":\"array\",\"Outputs[]\":\"object\",\"Parameters\":\"object\",\"StackPolicyBody\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
@@ -26185,6 +26388,7 @@ const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::Glue::Database", "{\"DatabaseInput\":\"object\",\"DatabaseInput.CreateTableDefaultPermissions\":\"array\",\"DatabaseInput.CreateTableDefaultPermissions[]\":\"object\",\"DatabaseInput.CreateTableDefaultPermissions[].Permissions\":\"array\",\"DatabaseInput.CreateTableDefaultPermissions[].Principal\":\"object\",\"DatabaseInput.FederatedDatabase\":\"object\",\"DatabaseInput.Parameters\":\"object\",\"DatabaseInput.TargetDatabase\":\"object\"}"],
 	["AWS::Glue::Job", "{\"Command\":\"object\",\"Connections\":\"object\",\"Connections.Connections\":\"array\",\"DefaultArguments\":\"object\",\"ExecutionProperty\":\"object\",\"NonOverridableArguments\":\"object\",\"NotificationProperty\":\"object\",\"Tags\":\"object\"}"],
 	["AWS::Glue::SecurityConfiguration", "{\"EncryptionConfiguration\":\"object\",\"EncryptionConfiguration.CloudWatchEncryption\":\"object\",\"EncryptionConfiguration.JobBookmarksEncryption\":\"object\",\"EncryptionConfiguration.S3Encryptions\":\"array\",\"EncryptionConfiguration.S3Encryptions[]\":\"object\"}"],
+	["AWS::Glue::Table", "{\"OpenTableFormatInput\":\"object\",\"OpenTableFormatInput.IcebergInput\":\"object\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput\":\"object\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput.PartitionSpec\":\"object\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput.PartitionSpec.Fields\":\"array\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput.PartitionSpec.Fields[]\":\"object\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput.Properties\":\"object\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput.Schema\":\"object\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput.Schema.Fields\":\"array\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput.Schema.Fields[]\":\"object\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput.Schema.IdentifierFieldIds\":\"array\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput.WriteOrder\":\"object\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput.WriteOrder.Fields\":\"array\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput.WriteOrder.Fields[]\":\"object\",\"TableInput\":\"object\",\"TableInput.Parameters\":\"object\",\"TableInput.PartitionKeys\":\"array\",\"TableInput.PartitionKeys[]\":\"object\",\"TableInput.StorageDescriptor\":\"object\",\"TableInput.StorageDescriptor.BucketColumns\":\"array\",\"TableInput.StorageDescriptor.Columns\":\"array\",\"TableInput.StorageDescriptor.Columns[]\":\"object\",\"TableInput.StorageDescriptor.Parameters\":\"object\",\"TableInput.StorageDescriptor.SchemaReference\":\"object\",\"TableInput.StorageDescriptor.SchemaReference.SchemaId\":\"object\",\"TableInput.StorageDescriptor.SerdeInfo\":\"object\",\"TableInput.StorageDescriptor.SerdeInfo.Parameters\":\"object\",\"TableInput.StorageDescriptor.SkewedInfo\":\"object\",\"TableInput.StorageDescriptor.SkewedInfo.SkewedColumnNames\":\"array\",\"TableInput.StorageDescriptor.SkewedInfo.SkewedColumnValueLocationMaps\":\"object\",\"TableInput.StorageDescriptor.SkewedInfo.SkewedColumnValues\":\"array\",\"TableInput.StorageDescriptor.SortColumns\":\"array\",\"TableInput.StorageDescriptor.SortColumns[]\":\"object\",\"TableInput.TargetTable\":\"object\",\"TableInput.ViewDefinition\":\"object\",\"TableInput.ViewDefinition.Representations\":\"array\",\"TableInput.ViewDefinition.Representations[]\":\"object\",\"TableInput.ViewDefinition.SubObjects\":\"array\"}"],
 	["AWS::Glue::Trigger", "{\"Actions\":\"array\",\"Actions[]\":\"object\",\"Actions[].Arguments\":\"object\",\"Actions[].NotificationProperty\":\"object\",\"EventBatchingCondition\":\"object\",\"Predicate\":\"object\",\"Predicate.Conditions\":\"array\",\"Predicate.Conditions[]\":\"object\",\"Tags\":\"object\"}"],
 	["AWS::Glue::Workflow", "{\"DefaultRunProperties\":\"object\",\"Tags\":\"object\"}"],
 	["AWS::IAM::Group", "{\"ManagedPolicyArns\":\"array\",\"Policies\":\"array\",\"Policies[]\":\"object\"}"],
@@ -35934,6 +36138,7 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 		provisionedBy: createDecision.provisionedBy
 	};
 	this.recordInlinePolicyWrite(logicalId, "create");
+	await this.establishNoEchoEchoFidelity(logicalId, stateResources[logicalId], resolvedProps, stateResources, createSecrets);
 	const createCaptureSiblings = await this.buildObservedCaptureSiblings(resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
 	this.kickOffObservedCapture(createProvider, logicalId, result.physicalId, resourceType, resolvedProps, {
 		...createCaptureSiblings,
@@ -36041,6 +36246,509 @@ function recordedProtectionNote(evidence, flags) {
 	return `${evidence}. AWS refuses to delete the resource while that protection is on, and cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and cdkd state destroy act on one), so ${flags} alone does not remove the old resource: depending on the replacement order, the deploy either fails at that delete or completes leaving the old resource, and its data, in AWS and no longer tracked by cdkd. Read ${DELETION_PROTECTION_DOC_POINTER} before you disable anything, then turn the protection off out of band (the console, or the service's own API) and re-run with ${flags}.`;
 }
 
+//#endregion
+//#region src/deployment/deploy-engine/noecho.ts
+function noEchoExactEchoLeavesOf(record) {
+	const field = record?.noEchoExactEchoLeaves;
+	if (!Array.isArray(field)) return void 0;
+	const out = [];
+	for (const entry of field) {
+		if (!Array.isArray(entry) || entry.length === 0) return void 0;
+		if (!entry.every((segment) => typeof segment === "string")) return void 0;
+		out.push([...entry]);
+	}
+	return out;
+}
+function echoFidelityCandidates(coordinates, resolved, createOnly) {
+	const out = [];
+	for (const coordinate of coordinates) {
+		if (!coordinate.every((segment) => typeof segment === "string")) continue;
+		const keys = coordinate;
+		if (!createOnly.some((path) => path.length <= keys.length && path.every((s, i) => s === keys[i]))) continue;
+		const plaintext = valueAtCoordinate(resolved, keys);
+		if (typeof plaintext !== "string" || carriesSecretMask(plaintext)) continue;
+		out.push({
+			coordinate: keys,
+			plaintext
+		});
+	}
+	return out;
+}
+function reportedLeafAt(live, handed, candidate) {
+	if (valueAtCoordinate(handed, candidate.coordinate) !== "***") return void 0;
+	const leaf = valueAtCoordinate(live, candidate.coordinate);
+	return typeof leaf === "string" && !carriesSecretMask(leaf) ? leaf : void 0;
+}
+function echoesExactlyAt(live, handed, candidate) {
+	return reportedLeafAt(live, handed, candidate) === candidate.plaintext;
+}
+function provesEchoChangeAt(live, handed, candidate) {
+	const reported = reportedLeafAt(live, handed, candidate);
+	return reported !== void 0 && reported !== candidate.plaintext;
+}
+function noteNoEchoExactEchoes(logicalId, physicalId, read, handed, candidates, mode) {
+	const exact = "failure" in read ? [] : candidates.filter((candidate) => echoesExactlyAt(read.live, handed, candidate)).map((candidate) => [...candidate.coordinate]);
+	const noted = this.noEchoExactEchoes.get(logicalId);
+	const previous = mode === "add" && noted?.physicalId === physicalId ? noted.coordinates : [];
+	this.noEchoExactEchoes.set(logicalId, {
+		physicalId,
+		coordinates: sortedCoordinates([...previous, ...exact])
+	});
+}
+function sortedCoordinates(coordinates) {
+	const keyed = /* @__PURE__ */ new Map();
+	for (const coordinate of coordinates) keyed.set(JSON.stringify(coordinate), [...coordinate]);
+	return [...keyed.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([, c]) => c);
+}
+async function establishNoEchoEchoFidelity(logicalId, record, resolvedProps, stateResources, secrets) {
+	this.noEchoExactEchoes.delete(logicalId);
+	const templateProps = this.perResourceTemplateProps.get(logicalId);
+	const sources = this.noEchoPositionSources(stateResources);
+	if (templateProps === void 0 || sources === void 0 || sources.parameters.size === 0) return;
+	const coordinates = canonicalCoordinates(noEchoCoordinatesOf(templateProps, resolvedProps, {
+		parameters: sources.parameters,
+		...sources.conditions !== void 0 && { conditions: sources.conditions }
+	}));
+	if (coordinates.length === 0) return;
+	const candidates = echoFidelityCandidates(coordinates, resolvedProps, await getCreateOnlyPropertyPaths(record.resourceType).catch(() => []));
+	if (candidates.length === 0) return;
+	const handed = {
+		...record,
+		properties: maskAtCoordinates(record.properties, coordinates)
+	};
+	const read = await this.readReaderForFreshNoEchoCeiling(logicalId, handed, secrets);
+	this.noteNoEchoExactEchoes(logicalId, record.physicalId, read, handed.properties, candidates, "set");
+}
+function withNoEchoExactEchoes(logicalId, record) {
+	const noted = this.noEchoExactEchoes.get(logicalId);
+	if (noted === void 0 || noted.coordinates.length === 0) return record;
+	if (noted.physicalId !== record.physicalId) return record;
+	const merged = sortedCoordinates([...noEchoExactEchoLeavesOf(record) ?? [], ...noted.coordinates]);
+	return {
+		...record,
+		noEchoExactEchoLeaves: merged
+	};
+}
+function noEchoParameterNamesOf(template) {
+	const names = /* @__PURE__ */ new Set();
+	const declared = template?.Parameters;
+	if (declared === null || typeof declared !== "object") return names;
+	for (const [name, definition] of Object.entries(declared)) {
+		const noEcho = definition?.NoEcho;
+		if (noEcho === true || noEcho === "true") names.add(name);
+	}
+	return names;
+}
+function noEchoAttributeNamesOf(record) {
+	const field = record?.noEchoAttributeNames;
+	if (!Array.isArray(field) || !field.every((name) => typeof name === "string")) return void 0;
+	return field;
+}
+function noEchoPositionSources(resources = {}, template = this.constructPathTemplate, conditions = this.noEchoConditions) {
+	if (template === void 0) return void 0;
+	const declared = this.noEchoAttributeResources;
+	return {
+		parameters: /* @__PURE__ */ new Set([...noEchoParameterNamesOf(template), ...this.inheritedNoEchoParameters]),
+		attributeIsNoEcho: (logicalId, attribute) => {
+			const live = declared.get(logicalId);
+			if (live === true || live !== void 0 && live.has(attribute)) return true;
+			if (noEchoAttributeNamesOf(Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0)?.includes(attribute) === true) return true;
+			return this.persistedNoEchoAttributes.get(logicalId)?.has(attribute) === true;
+		},
+		...conditions !== void 0 && { conditions }
+	};
+}
+function noEchoLeavesFor(logicalId, record, templateProps, sources) {
+	if (templateProps !== void 0 && isWrittenFromDeployedTemplate(record.properties)) return canonicalCoordinates(noEchoCoordinatesOf(templateProps, record.properties, sources));
+	const existing = noEchoLeavesOf(record);
+	if (existing !== void 0) return canonicalCoordinates(existing);
+	const resolvedAsSame = this.perResourceResolvedType.get(logicalId) === record.resourceType;
+	const source = (templateProps !== void 0 && resolvedAsSame ? templateProps : void 0) ?? templatePropertiesFor(this, logicalId, record.resourceType);
+	if (source === void 0) return void 0;
+	return canonicalCoordinates(noEchoCoordinatesOf(source, record.properties, sources));
+}
+function templatePropertiesFor(engine, logicalId, resourceType) {
+	const resources = engine.constructPathTemplate?.Resources;
+	if (resources === void 0 || !Object.hasOwn(resources, logicalId)) return void 0;
+	const definition = resources[logicalId];
+	if (definition?.Type !== resourceType) return void 0;
+	const properties = definition.Properties;
+	return properties !== null && typeof properties === "object" && !Array.isArray(properties) ? properties : void 0;
+}
+function noEchoAttributeNamesFor(engine, logicalId, record, carried, leaves) {
+	const attributes = record.attributes ?? {};
+	const names = /* @__PURE__ */ new Set();
+	let echoed = false;
+	for (const coordinate of leaves ?? []) {
+		const value = valueAtCoordinate(record.properties, coordinate);
+		if (value === void 0 || carriesSecretMask(value)) continue;
+		for (const [name, attribute] of Object.entries(attributes)) {
+			if (carriesSecretMask(attribute)) continue;
+			if (typeof attribute === "string" && attribute === record.physicalId) continue;
+			const sameName = coordinate[0] === name && keyOrderFreeJson(attribute) === keyOrderFreeJson(value);
+			const embeds = typeof value === "string" && typeof attribute === "string" && !attribute.startsWith("arn:") && value.length >= 4 && typeof attribute === "string" && attribute.includes(value);
+			if (sameName || embeds) {
+				names.add(name);
+				echoed = true;
+			}
+		}
+	}
+	const declared = carried ? void 0 : engine.noEchoAttributeResources.get(logicalId);
+	if (declared === true) for (const name of Object.keys(attributes)) names.add(name);
+	else if (declared !== void 0) {
+		for (const name of declared) if (Object.hasOwn(attributes, name)) names.add(name);
+	}
+	const prior = noEchoAttributeNamesOf(record);
+	for (const name of prior ?? []) if (Object.hasOwn(attributes, name) && carriesSecretMask(attributes[name])) names.add(name);
+	if (declared === void 0 && prior === void 0 && !echoed) return void 0;
+	return [...names].sort();
+}
+function applyNoEchoPersist(logicalId, record, scrubbed, templateProps, resources, secrets, carried = false) {
+	const sources = this.noEchoPositionSources(resources);
+	if (sources === void 0) return scrubbed;
+	const leaves = this.noEchoLeavesFor(logicalId, record, templateProps, sources);
+	const names = noEchoAttributeNamesFor(this, logicalId, record, carried, leaves);
+	if (leaves === void 0 && names === void 0) return scrubbed;
+	const next = { ...scrubbed };
+	if (leaves !== void 0) {
+		next.properties = maskAtCoordinates(scrubbed.properties, leaves);
+		if (scrubbed.observedProperties !== void 0 && leaves.length > 0) Object.assign(next, { observedProperties: maskReadbackAtCoordinates(scrubbed.observedProperties, record.properties, leaves) });
+		if (leaves.length > 0) next.noEchoLeaves = leaves;
+		else delete next.noEchoLeaves;
+		const marked = new Set(leaves.map((coordinate) => JSON.stringify(coordinate)));
+		const exact = (noEchoExactEchoLeavesOf(scrubbed) ?? []).filter((coordinate) => marked.has(JSON.stringify(coordinate)));
+		if (exact.length > 0) next.noEchoExactEchoLeaves = exact;
+		else delete next.noEchoExactEchoLeaves;
+	}
+	if (names !== void 0) {
+		if (scrubbed.attributes !== void 0 && names.length > 0) {
+			const attributes = { ...scrubbed.attributes };
+			for (const name of names) if (Object.hasOwn(attributes, name)) attributes[name] = maskWholeValue(attributes[name]);
+			next.attributes = attributes;
+		}
+		if (names.length > 0) next.noEchoAttributeNames = names;
+		else delete next.noEchoAttributeNames;
+	}
+	this.warnNoEchoPhysicalId(logicalId, record, secrets);
+	return next;
+}
+function warnNoEchoPhysicalId(logicalId, record, secrets) {
+	if (secrets === void 0 || this.noEchoPhysicalIdWarned.has(logicalId)) return;
+	const values = noEchoParameterPlaintextsOf(secrets);
+	if (values.length === 0 || typeof record.physicalId !== "string") return;
+	if (!values.some((value) => record.physicalId.includes(value))) return;
+	this.noEchoPhysicalIdWarned.add(logicalId);
+	this.logger.warn(this.maskForResource(logicalId, safeMsg`${logicalId}: its physical id contains a NoEcho parameter value. AWS publishes a resource's name, so cdkd keeps the physical id in state as AWS returns it.`));
+}
+function seedPersistedNoEchoAttributes(resources) {
+	this.persistedNoEchoAttributes = /* @__PURE__ */ new Map();
+	for (const [logicalId, record] of Object.entries(resources)) {
+		const names = noEchoAttributeNamesOf(record);
+		if (names !== void 0 && names.length > 0) this.persistedNoEchoAttributes.set(logicalId, new Set(names));
+	}
+}
+function maskOutputsByPosition(outputs) {
+	const sources = this.noEchoPositionSources();
+	if (sources === void 0) return outputs;
+	const templateValues = Object.create(null);
+	for (const [name, definition] of Object.entries(this.constructPathTemplate?.Outputs ?? {})) templateValues[name] = definition?.Value;
+	if (this.outputsSourceUsable) for (const [name, value] of Object.entries(this.outputsTemplateSource)) templateValues[name] = value;
+	const coordinates = noEchoCoordinatesOf(templateValues, outputs, sources);
+	if (coordinates.length === 0) return outputs;
+	const maskedValues = new Set(coordinates.filter((coordinate) => coordinate.length === 1 && typeof coordinate[0] === "string").map((coordinate) => keyOrderFreeJson(outputs[coordinate[0]])));
+	const aliasCoordinates = Object.keys(outputs).filter((key) => !Object.hasOwn(templateValues, key) && outputs[key] !== void 0 && !carriesSecretMask(outputs[key]) && maskedValues.has(keyOrderFreeJson(outputs[key]))).map((key) => [key]);
+	return maskAtCoordinates(outputs, [...coordinates, ...aliasCoordinates]);
+}
+function getAttTargetsOf(node) {
+	const targets = [];
+	const seen = /* @__PURE__ */ new Set();
+	const subVariable = /\$\{([^}!][^}]*)\}/g;
+	const walk = (value) => {
+		if (value === null || typeof value !== "object" || seen.has(value)) return;
+		seen.add(value);
+		if (Array.isArray(value)) {
+			for (const item of value) walk(item);
+			return;
+		}
+		const record = value;
+		const getAtt = record["Fn::GetAtt"];
+		if (typeof getAtt === "string" && getAtt.indexOf(".") > 0) {
+			const dot = getAtt.indexOf(".");
+			targets.push([getAtt.slice(0, dot), getAtt.slice(dot + 1)]);
+		} else if (Array.isArray(getAtt) && typeof getAtt[0] === "string" && typeof getAtt[1] === "string") targets.push([getAtt[0], getAtt[1]]);
+		const sub = record["Fn::Sub"];
+		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
+		if (typeof text === "string") for (const match of text.matchAll(subVariable)) {
+			const name = match[1].trim();
+			const dot = name.indexOf(".");
+			if (dot > 0) targets.push([name.slice(0, dot), name.slice(dot + 1)]);
+		}
+		for (const child of Object.values(record)) walk(child);
+	};
+	walk(node);
+	return targets;
+}
+async function noEchoAttributeOverridesFor(desiredProps, stateResources, stackName) {
+	const wanted = /* @__PURE__ */ new Map();
+	for (const [logicalId, attribute] of getAttTargetsOf(desiredProps)) {
+		const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+		if (record === void 0) continue;
+		if (noEchoAttributeNamesOf(record)?.includes(attribute) !== true) continue;
+		if (!carriesSecretMask(record.attributes?.[attribute])) continue;
+		if (!this.perResourceSecrets.has(logicalId)) continue;
+		const set = wanted.get(logicalId) ?? /* @__PURE__ */ new Set();
+		set.add(attribute);
+		wanted.set(logicalId, set);
+	}
+	if (wanted.size === 0) return void 0;
+	const overrides = /* @__PURE__ */ new Map();
+	for (const [logicalId, attributes] of wanted) {
+		const record = stateResources[logicalId];
+		let read = this.noEchoAttributeReads.get(logicalId);
+		if (read === void 0) {
+			read = (async () => {
+				try {
+					const { provider } = this.providerRegistry.getProviderFor({
+						resourceType: record.resourceType,
+						properties: record.properties,
+						provisionedBy: record.provisionedBy,
+						previousProperties: record.properties
+					});
+					const outcome = await readRecordAttributes({
+						provider,
+						logicalId,
+						resource: record,
+						stackName,
+						region: this.stackRegion
+					});
+					return outcome.kind === "read" ? outcome.attributes : void 0;
+				} catch {
+					return;
+				}
+			})();
+			this.noEchoAttributeReads.set(logicalId, read);
+		}
+		const live = await read;
+		if (live === void 0) continue;
+		const secrets = this.perResourceSecrets.get(logicalId);
+		const fresh = noEchoParameterPlaintextsOf(secrets);
+		const positioned = this.noEchoPositionedValues.get(logicalId) ?? /* @__PURE__ */ new Set();
+		const served = {};
+		for (const attribute of attributes) {
+			if (!Object.hasOwn(live, attribute)) continue;
+			const value = live[attribute];
+			if (typeof value === "string" && fresh.some((needle) => value === needle || value.includes(needle)) || value !== void 0 && positioned.has(keyOrderFreeJson(value))) served[attribute] = value;
+		}
+		if (Object.keys(served).length > 0) overrides.set(logicalId, served);
+	}
+	return overrides.size > 0 ? overrides : void 0;
+}
+function noEchoDiffComparison(resources, template, conditions, parameterValues, stackName) {
+	const sources = this.noEchoPositionSources(resources, template, conditions);
+	if (sources === void 0) return void 0;
+	const compare = noEchoComparison({
+		sources,
+		values: parameterValues,
+		minNeedleLength: 4,
+		publicTokens: /* @__PURE__ */ new Set([this.stackRegion, ...stackName === void 0 ? [] : [stackName]])
+	});
+	return (input) => compare(input);
+}
+function freshNoEchoParametersWithDeclared(inherited, template) {
+	const all = /* @__PURE__ */ new Set([...inherited ?? [], ...noEchoParameterNamesOf(template)]);
+	return all.size > 0 ? all : void 0;
+}
+function noEchoComparisonForTemplate(template, knownConditions, values, resources, publicTokens, inheritedNoEchoParameters) {
+	const sources = {
+		parameters: /* @__PURE__ */ new Set([...noEchoParameterNamesOf(template), ...inheritedNoEchoParameters ?? []]),
+		attributeIsNoEcho: (logicalId, attribute) => noEchoAttributeNamesOf(Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0)?.includes(attribute) === true,
+		...knownConditions !== void 0 && { conditions: knownConditions }
+	};
+	const compare = noEchoComparison({
+		sources,
+		values: values ?? {},
+		minNeedleLength: 4,
+		...publicTokens !== void 0 && { publicTokens }
+	});
+	return (input) => compare(input);
+}
+
+//#endregion
+//#region src/deployment/resource-deadline.ts
+var InvalidResourceDeadlineError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "InvalidResourceDeadlineError";
+	}
+};
+function validateOptions(opts) {
+	const { warnAfterMs, timeoutMs } = opts;
+	if (!Number.isFinite(warnAfterMs) || !Number.isFinite(timeoutMs) || warnAfterMs <= 0 || timeoutMs <= 0) throw new InvalidResourceDeadlineError(`withResourceDeadline: warnAfterMs and timeoutMs must be positive finite numbers (got warnAfterMs=${warnAfterMs}, timeoutMs=${timeoutMs})`);
+	if (warnAfterMs >= timeoutMs) throw new InvalidResourceDeadlineError(`withResourceDeadline: warnAfterMs (${warnAfterMs}ms) must be less than timeoutMs (${timeoutMs}ms)`);
+}
+async function withResourceDeadline(operation, opts) {
+	validateOptions(opts);
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		let timedOut = false;
+		let warned = false;
+		let warnTimer;
+		let timeoutTimer;
+		let elapsedBeforePause = 0;
+		let runningSince = Date.now();
+		let pauses = 0;
+		const elapsed = () => elapsedBeforePause + (pauses > 0 ? 0 : Date.now() - runningSince);
+		const cleanup = () => {
+			if (warnTimer !== void 0) clearTimeout(warnTimer);
+			if (timeoutTimer !== void 0) clearTimeout(timeoutTimer);
+			warnTimer = void 0;
+			timeoutTimer = void 0;
+		};
+		const arm = () => {
+			if (opts.onWarn && !warned) warnTimer = setTimeout(() => {
+				if (settled) return;
+				warned = true;
+				try {
+					opts.onWarn(elapsed());
+				} catch {}
+			}, Math.max(0, opts.warnAfterMs - elapsed()));
+			timeoutTimer = setTimeout(() => {
+				if (settled) return;
+				settled = true;
+				timedOut = true;
+				cleanup();
+				reject(opts.onTimeout(elapsed()));
+			}, Math.max(0, opts.timeoutMs - elapsed()));
+		};
+		arm();
+		const outer = deadlineScope.getStore();
+		const control = {
+			pause: () => {
+				pauses += 1;
+				if (pauses === 1) {
+					elapsedBeforePause += Date.now() - runningSince;
+					cleanup();
+				}
+				outer?.pause();
+			},
+			resume: () => {
+				if (pauses === 0) return;
+				pauses -= 1;
+				if (pauses === 0) {
+					runningSince = Date.now();
+					if (!settled) arm();
+				}
+				outer?.resume();
+			},
+			expired: () => timedOut || (outer?.expired() ?? false)
+		};
+		Promise.resolve().then(() => deadlineScope.run(control, operation)).then((value) => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			resolve(value);
+		}, (err) => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			reject(err);
+		});
+	});
+}
+const deadlineScope = new AsyncLocalStorage();
+async function whileEnclosingDeadlinesPaused(fn) {
+	const control = deadlineScope.getStore();
+	if (control === void 0) return fn();
+	control.pause();
+	try {
+		return await fn();
+	} finally {
+		control.resume();
+	}
+}
+function enclosingDeadlineExpired() {
+	return deadlineScope.getStore()?.expired() ?? false;
+}
+
+//#endregion
+//#region src/deployment/deployment-approval.ts
+const NESTED_STACK_TYPE$1 = "AWS::CloudFormation::Stack";
+async function requireDeploymentApproval(args) {
+	const level = args.options.requireApproval ?? "never";
+	const approve = args.options.approveDeployment;
+	if (level === "never" || approve === void 0) return;
+	const changes = [...args.changes].filter((c) => c.changeType !== "NO_CHANGE" && !isNoEchoPromotionOnly(c));
+	const destructiveChanges = findDestructiveChanges(args.stackName, changes, args.records, args.template, new Set(args.recreateTargetIds ?? []));
+	const onlyNestedUpdates = changes.every((c) => c.changeType === "UPDATE" && c.resourceType === NESTED_STACK_TYPE$1);
+	if (!(level === "destructive" ? destructiveChanges.length > 0 : changes.length > 0 && !onlyNestedUpdates)) return;
+	const count = (type) => changes.filter((c) => c.changeType === type).length;
+	if (enclosingDeadlineExpired()) throw approvalAfterTimeout(args.stackName);
+	let approved;
+	try {
+		approved = await whileEnclosingDeadlinesPaused(() => approve({
+			stackName: args.stackName,
+			level,
+			counts: {
+				create: count("CREATE"),
+				update: count("UPDATE"),
+				delete: count("DELETE")
+			},
+			destructiveChanges
+		}));
+	} catch (error) {
+		throw error instanceof Error ? markNonRetryable(error) : error;
+	}
+	if (!approved) throw markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${args.stackName} was not approved (--require-approval=${level}). Nothing was changed.`, "DEPLOY_NOT_APPROVED"));
+}
+async function approveLateReplacement(args) {
+	const level = args.options.requireApproval ?? "never";
+	const approve = args.options.approveDeployment;
+	if (level === "never" || approve === void 0) return true;
+	if (enclosingDeadlineExpired()) return false;
+	try {
+		return await whileEnclosingDeadlinesPaused(() => approve({
+			stackName: args.stackName,
+			level,
+			counts: {
+				create: 0,
+				update: 1,
+				delete: 0
+			},
+			destructiveChanges: findDestructiveChanges(args.stackName, [args.change], args.records, args.template)
+		}));
+	} catch {
+		return false;
+	}
+}
+function approvalAfterTimeout(stackName) {
+	return markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${stackName} was not started: its parent's nested-stack row already timed out (--resource-timeout). Nothing was changed.`, "DEPLOY_APPROVAL_AFTER_TIMEOUT"));
+}
+async function requireOutputsOnlyApproval(args) {
+	const approve = args.options.approveDeployment;
+	if (args.options.requireApproval !== "any-change" || approve === void 0) return;
+	if (enclosingDeadlineExpired()) throw approvalAfterTimeout(args.stackName);
+	let approved;
+	try {
+		approved = await whileEnclosingDeadlinesPaused(() => approve({
+			stackName: args.stackName,
+			level: "any-change",
+			counts: {
+				create: 0,
+				update: 0,
+				delete: 0
+			},
+			destructiveChanges: [],
+			outputsOnly: true
+		}));
+	} catch (error) {
+		throw error instanceof Error ? markNonRetryable(error) : error;
+	}
+	if (!approved) throw markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${args.stackName} was not approved (--require-approval=any-change). Nothing was changed.`, "DEPLOY_NOT_APPROVED"));
+}
+function isNoEchoPromotionOnly(change) {
+	return change.changeType === "UPDATE" && (change.attributeChanges?.length ?? 0) === 0 && (change.propertyChanges?.length ?? 0) > 0 && change.propertyChanges.every((pc) => pc.noEchoPromoted === true);
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/update.ts
 function isWhollyMask(value) {
@@ -36148,7 +36856,8 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	const allowedForRecord = allowedSilentDrops ?? /* @__PURE__ */ new Set();
 	const createOnlyEvidence = acceptedCreateOnlyDropsOf(currentResource);
 	const recordedAsWritten = currentResource.provisionedBy === "cc-api" ? currentProps : withoutUnwrittenSilentDropProperties(resourceType, currentProps, desiredForSkipCheck, allowedForRecord, createOnlyEvidence);
-	const todayAsWritten = noEchoLeavesOf(currentResource) === void 0 ? redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), withoutNoEchoParameterEntries(updateSecrets), desiredProps) : void 0;
+	const unmarkedRecord = noEchoLeavesOf(currentResource) === void 0;
+	const todayAsWritten = unmarkedRecord ? redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), withoutNoEchoParameterEntries(updateSecrets), desiredProps) : void 0;
 	const witness = todayAsWritten === void 0 ? void 0 : witnessNormalize(recordedAsWritten, todayAsWritten, desiredForSkipCheckAsWritten);
 	const currentPropsAsWritten = witness === void 0 ? recordedAsWritten : witness.current;
 	const positionalLeavesAt = (coordinates, key) => coordinates.filter((coordinate) => coordinate[0] === key).flatMap((coordinate) => {
@@ -36217,6 +36926,51 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		renderer.removeTask(logicalId);
 		this.logger.info(safeMsg`${attrPrefix}${formatResourceLine("updated", logicalId, resourceType, "updated (metadata)")}`);
 	};
+	const schemaCreateOnly = pendingParameterLeaves.size === 0 && parameterCoordinates.length === 0 ? [] : await getCreateOnlyPropertyPaths(resourceType).catch(() => []);
+	const echoCandidates = echoFidelityCandidates(parameterCoordinates, resolvedProps, schemaCreateOnly);
+	const readbackRecord = unmarkedRecord && parameterCoordinates.length > 0 ? {
+		...currentResource,
+		properties: maskAtCoordinates(currentResource.properties, parameterCoordinates)
+	} : currentResource;
+	let readback;
+	const readOnce = () => readback ??= this.readReaderForFreshNoEchoCeiling(logicalId, readbackRecord, updateSecrets).then((read) => {
+		this.noteNoEchoExactEchoes(logicalId, currentResource.physicalId, read, readbackRecord.properties, echoCandidates, "add");
+		return read;
+	});
+	const exactEchoCoordinates = new Set((noEchoExactEchoLeavesOf(currentResource) ?? []).map((c) => JSON.stringify(c)));
+	const provenChangedAt = (key, read) => {
+		if (exactEchoCoordinates.size === 0 || read === void 0 || "failure" in read) return false;
+		return (pendingParameterLeaves.get(key) ?? []).some((leaf) => {
+			const full = [key, ...leaf.path];
+			if (!exactEchoCoordinates.has(JSON.stringify(full))) return false;
+			const [candidate] = echoFidelityCandidates([full], resolvedProps, schemaCreateOnly);
+			return candidate !== void 0 && provesEchoChangeAt(read.live, readbackRecord.properties, candidate);
+		});
+	};
+	let replacedAnyway = false;
+	let lateApproval;
+	const approveReplacementOf = (pc) => {
+		if (replacedAnyway) return Promise.resolve(true);
+		const { noEchoPromoted: _promoted, ...asReplacement } = pc;
+		lateApproval ??= approveLateReplacement({
+			options: this.options,
+			stackName,
+			change: {
+				...change,
+				changeType: "UPDATE",
+				propertyChanges: [{
+					...asReplacement,
+					requiresReplacement: true
+				}]
+			},
+			records: stateResources,
+			template
+		});
+		return lateApproval;
+	};
+	const lateReplacementDeclined = /* @__PURE__ */ new Set();
+	const differsWhy = (key) => lateReplacementDeclined.has(key) ? `differs; the replacement was not approved (--require-approval=${this.options.requireApproval ?? "never"})` : "differs; the provider is not known to report this property exactly, so the difference may be its normalization";
+	if (unmarkedRecord && !typeChanged && echoCandidates.length > 0 && hasAddressablePhysicalId(currentResource)) await readOnce();
 	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && recordMatchesDesired) {
 		if (change.attributeChanges && change.attributeChanges.length > 0) {
 			applyAttributeOnlyUpdate(change.attributeChanges);
@@ -36230,8 +36984,6 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	if (!(currentResource.resourceType === "AWS::CloudFormation::Stack" && currentResource.provisionedBy !== "cc-api") && !hasAddressablePhysicalId(currentResource)) throw markRefusedBeforeApplying(markNonRetryable(new CdkdError(unaddressableUpdateRefusalMessage(stackName, this.stackRegion, logicalId, oldResourceType, this.options.refusalRecovery), STATE_RESOURCES_MALFORMED)));
 	this.attemptedResolvedProps.set(logicalId, resolvedProps);
 	const noEchoHeldPaths = /* @__PURE__ */ new Set();
-	let readback;
-	const schemaCreateOnly = pendingParameterLeaves.size === 0 ? [] : await getCreateOnlyPropertyPaths(resourceType).catch(() => []);
 	const isSchemaCreateOnly = (key) => (pendingParameterLeaves.get(key) ?? []).some((leaf) => {
 		const full = [key, ...leaf.path.map(String)];
 		return schemaCreateOnly.some((path) => path.length <= full.length && path.every((segment, i) => segment === full[i]));
@@ -36261,8 +37013,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 					lowered.push(pc);
 					continue;
 				}
-				readback ??= this.readReaderForFreshNoEchoCeiling(logicalId, currentResource, updateSecrets);
-				const read = await readback;
+				const read = await readOnce();
 				let verdict;
 				if ("failure" in read) verdict = read.failure;
 				else if (!Object.prototype.hasOwnProperty.call(read.live, pc.path)) verdict = "not-readable";
@@ -36296,7 +37047,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	const parameterHeldKeys = /* @__PURE__ */ new Set();
 	const parameterUnreadablePaths = [];
 	if (pendingParameterLeaves.size > 0 && !typeChanged) {
-		const read = parameterCreateOnlyPaths.size > 0 || recordMatchesDesired ? await (readback ??= this.readReaderForFreshNoEchoCeiling(logicalId, currentResource, updateSecrets)) : void 0;
+		const read = parameterCreateOnlyPaths.size > 0 || recordMatchesDesired ? await readOnce() : void 0;
 		const verdictAt = (key) => {
 			if (read === void 0) return "not-readable";
 			if ("failure" in read) return read.failure;
@@ -36304,12 +37055,14 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 			return liveHoldsFreshLeaves(read.live[key], pendingParameterLeaves.get(key) ?? []) ? "held" : "differs";
 		};
 		const lowered = [];
+		const movedAt = (path) => movedMasked.has(path) || keyOrderFreeJson(desiredForSkipCheckAsWritten[path]) !== keyOrderFreeJson(currentPropsAsWritten[path]);
+		replacedAnyway = this.recreateDirectionFor(stackName, logicalId) !== void 0 || lostWithParent !== void 0 || (change.propertyChanges ?? []).some((other) => other.requiresReplacement && (!parameterCreateOnlyPaths.has(other.path) || movedAt(other.path)));
 		for (const pc of change.propertyChanges ?? []) {
 			if (!parameterCreateOnlyPaths.has(pc.path)) {
 				lowered.push(pc);
 				continue;
 			}
-			if (movedMasked.has(pc.path) || keyOrderFreeJson(desiredForSkipCheckAsWritten[pc.path]) !== keyOrderFreeJson(currentPropsAsWritten[pc.path])) {
+			if (movedAt(pc.path)) {
 				warnWitnessReplacement(pc.path);
 				lowered.push(pc);
 				continue;
@@ -36319,9 +37072,18 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 			if (verdict === "held") {
 				parameterHeldKeys.add(pc.path);
 				this.logger.debug(safeMsg`${logicalId}.${pc.path} carries a NoEcho parameter value AWS already holds: not replaced.`);
+			} else if (verdict === "differs" && provenChangedAt(pc.path, read) && await approveReplacementOf(pc)) {
+				this.logger.warn(safeMsg`${logicalId}.${pc.path} is a create-only property fed by a NoEcho parameter, and AWS, which reports it exactly, holds a different value: ${logicalId} is replaced.`);
+				lowered.push({
+					...pc,
+					requiresReplacement: true
+				});
+				continue;
 			} else {
 				const staleOnly = staleCoordinates.some((coordinate) => coordinate[0] === pc.path);
-				this.logger.warn(staleOnly ? safeMsg`${logicalId}.${pc.path} is a create-only property whose recorded value is only the NoEcho mask, and cdkd cannot confirm AWS holds its current value (${verdict}). It is not replaced, so a change to that value is not applied: to apply one, deploy with --recreate-via-cc-api ${logicalId} or --recreate-via-sdk-provider ${logicalId}.` : safeMsg`${logicalId}.${pc.path} is a create-only property fed by a NoEcho parameter, and cdkd cannot confirm AWS holds its current value (${verdict}). It is not replaced, so a change to that value is not applied: to apply one, deploy with --recreate-via-cc-api ${logicalId} or --recreate-via-sdk-provider ${logicalId}.`);
+				if (verdict === "differs" && provenChangedAt(pc.path, read)) lateReplacementDeclined.add(pc.path);
+				const why = verdict === "differs" ? differsWhy(pc.path) : verdict;
+				this.logger.warn(staleOnly ? safeMsg`${logicalId}.${pc.path} is a create-only property whose recorded value is only the NoEcho mask, and cdkd cannot confirm AWS holds its current value (${why}). It is not replaced, so a change to that value is not applied: to apply one, deploy with --recreate-via-cc-api ${logicalId} or --recreate-via-sdk-provider ${logicalId}.` : safeMsg`${logicalId}.${pc.path} is a create-only property fed by a NoEcho parameter, and cdkd cannot confirm AWS holds its current value (${why}). It is not replaced, so a change to that value is not applied: to apply one, deploy with --recreate-via-cc-api ${logicalId} or --recreate-via-sdk-provider ${logicalId}.`);
 			}
 			parameterSettledPaths.add(pc.path);
 			lowered.push({
@@ -36679,6 +37441,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 		provisionedBy: replaceDecision.provisionedBy
 	};
 	this.recordInlinePolicyWrite(logicalId, "create");
+	await this.establishNoEchoEchoFidelity(logicalId, stateResources[logicalId], resolvedProps, stateResources, updateSecrets);
 	this.kickOffObservedCapture(replaceProvider, logicalId, createResult.physicalId, resourceType, resolvedProps, { afterOwnWrite: true }, updateSecrets);
 	if (counts) counts.updated++;
 	if (progress) progress.current++;
@@ -36910,6 +37673,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 		...result.noEchoAttributeNames && { noEchoAttributeNames: result.noEchoAttributeNames }
 	}, updateSecrets, resolvedProps);
 	const recordedProperties = this.propertiesToRecord(resolvedProps, result, resourceType, resultProvisionedBy);
+	if (result.wasReplaced) this.noEchoExactEchoes.delete(logicalId);
 	stateResources[logicalId] = {
 		physicalId: result.physicalId,
 		resourceType,
@@ -36917,6 +37681,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 		...acceptedCreateOnlyDropsField(recordedProperties, resourceType, resultProvisionedBy, dischargedByReplacement ? "new-resource" : "in-place", currentResource),
 		...carriedAttributes && { attributes: carriedAttributes },
 		...!result.wasReplaced && currentResource.noEchoAttributeNames !== void 0 && { noEchoAttributeNames: currentResource.noEchoAttributeNames },
+		...!result.wasReplaced && currentResource.noEchoExactEchoLeaves !== void 0 && { noEchoExactEchoLeaves: currentResource.noEchoExactEchoLeaves },
 		...dependencies && dependencies.length > 0 && { dependencies },
 		...this.extractTemplateAttributes(template, logicalId),
 		provisionedBy: resultProvisionedBy,
@@ -37094,103 +37859,6 @@ Drop the record with: ${dropCommand}`);
 	this.logger.info(`${deletePrefix}${formatResourceLine("deleted", logicalId, resourceType)}`);
 }
 
-//#endregion
-//#region src/deployment/resource-deadline.ts
-var InvalidResourceDeadlineError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "InvalidResourceDeadlineError";
-	}
-};
-function validateOptions(opts) {
-	const { warnAfterMs, timeoutMs } = opts;
-	if (!Number.isFinite(warnAfterMs) || !Number.isFinite(timeoutMs) || warnAfterMs <= 0 || timeoutMs <= 0) throw new InvalidResourceDeadlineError(`withResourceDeadline: warnAfterMs and timeoutMs must be positive finite numbers (got warnAfterMs=${warnAfterMs}, timeoutMs=${timeoutMs})`);
-	if (warnAfterMs >= timeoutMs) throw new InvalidResourceDeadlineError(`withResourceDeadline: warnAfterMs (${warnAfterMs}ms) must be less than timeoutMs (${timeoutMs}ms)`);
-}
-async function withResourceDeadline(operation, opts) {
-	validateOptions(opts);
-	return new Promise((resolve, reject) => {
-		let settled = false;
-		let timedOut = false;
-		let warned = false;
-		let warnTimer;
-		let timeoutTimer;
-		let elapsedBeforePause = 0;
-		let runningSince = Date.now();
-		let pauses = 0;
-		const elapsed = () => elapsedBeforePause + (pauses > 0 ? 0 : Date.now() - runningSince);
-		const cleanup = () => {
-			if (warnTimer !== void 0) clearTimeout(warnTimer);
-			if (timeoutTimer !== void 0) clearTimeout(timeoutTimer);
-			warnTimer = void 0;
-			timeoutTimer = void 0;
-		};
-		const arm = () => {
-			if (opts.onWarn && !warned) warnTimer = setTimeout(() => {
-				if (settled) return;
-				warned = true;
-				try {
-					opts.onWarn(elapsed());
-				} catch {}
-			}, Math.max(0, opts.warnAfterMs - elapsed()));
-			timeoutTimer = setTimeout(() => {
-				if (settled) return;
-				settled = true;
-				timedOut = true;
-				cleanup();
-				reject(opts.onTimeout(elapsed()));
-			}, Math.max(0, opts.timeoutMs - elapsed()));
-		};
-		arm();
-		const outer = deadlineScope.getStore();
-		const control = {
-			pause: () => {
-				pauses += 1;
-				if (pauses === 1) {
-					elapsedBeforePause += Date.now() - runningSince;
-					cleanup();
-				}
-				outer?.pause();
-			},
-			resume: () => {
-				if (pauses === 0) return;
-				pauses -= 1;
-				if (pauses === 0) {
-					runningSince = Date.now();
-					if (!settled) arm();
-				}
-				outer?.resume();
-			},
-			expired: () => timedOut || (outer?.expired() ?? false)
-		};
-		Promise.resolve().then(() => deadlineScope.run(control, operation)).then((value) => {
-			if (settled) return;
-			settled = true;
-			cleanup();
-			resolve(value);
-		}, (err) => {
-			if (settled) return;
-			settled = true;
-			cleanup();
-			reject(err);
-		});
-	});
-}
-const deadlineScope = new AsyncLocalStorage();
-async function whileEnclosingDeadlinesPaused(fn) {
-	const control = deadlineScope.getStore();
-	if (control === void 0) return fn();
-	control.pause();
-	try {
-		return await fn();
-	} finally {
-		control.resume();
-	}
-}
-function enclosingDeadlineExpired() {
-	return deadlineScope.getStore()?.expired() ?? false;
-}
-
 //#endregion
 //#region src/deployment/deploy-engine/provision.ts
 async function provisionResource(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
@@ -37942,248 +38610,6 @@ function journaledOrphanPolicy(policy) {
 	return policy === "Delete" || policy === "Retain" || policy === "Snapshot" || policy === "RetainExceptOnCreate" ? policy : "Retain";
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/noecho.ts
-function noEchoParameterNamesOf(template) {
-	const names = /* @__PURE__ */ new Set();
-	const declared = template?.Parameters;
-	if (declared === null || typeof declared !== "object") return names;
-	for (const [name, definition] of Object.entries(declared)) {
-		const noEcho = definition?.NoEcho;
-		if (noEcho === true || noEcho === "true") names.add(name);
-	}
-	return names;
-}
-function noEchoAttributeNamesOf(record) {
-	const field = record?.noEchoAttributeNames;
-	if (!Array.isArray(field) || !field.every((name) => typeof name === "string")) return void 0;
-	return field;
-}
-function noEchoPositionSources(resources = {}, template = this.constructPathTemplate, conditions = this.noEchoConditions) {
-	if (template === void 0) return void 0;
-	const declared = this.noEchoAttributeResources;
-	return {
-		parameters: /* @__PURE__ */ new Set([...noEchoParameterNamesOf(template), ...this.inheritedNoEchoParameters]),
-		attributeIsNoEcho: (logicalId, attribute) => {
-			const live = declared.get(logicalId);
-			if (live === true || live !== void 0 && live.has(attribute)) return true;
-			if (noEchoAttributeNamesOf(Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0)?.includes(attribute) === true) return true;
-			return this.persistedNoEchoAttributes.get(logicalId)?.has(attribute) === true;
-		},
-		...conditions !== void 0 && { conditions }
-	};
-}
-function noEchoLeavesFor(logicalId, record, templateProps, sources) {
-	if (templateProps !== void 0 && isWrittenFromDeployedTemplate(record.properties)) return canonicalCoordinates(noEchoCoordinatesOf(templateProps, record.properties, sources));
-	const existing = noEchoLeavesOf(record);
-	if (existing !== void 0) return canonicalCoordinates(existing);
-	const resolvedAsSame = this.perResourceResolvedType.get(logicalId) === record.resourceType;
-	const source = (templateProps !== void 0 && resolvedAsSame ? templateProps : void 0) ?? templatePropertiesFor(this, logicalId, record.resourceType);
-	if (source === void 0) return void 0;
-	return canonicalCoordinates(noEchoCoordinatesOf(source, record.properties, sources));
-}
-function templatePropertiesFor(engine, logicalId, resourceType) {
-	const resources = engine.constructPathTemplate?.Resources;
-	if (resources === void 0 || !Object.hasOwn(resources, logicalId)) return void 0;
-	const definition = resources[logicalId];
-	if (definition?.Type !== resourceType) return void 0;
-	const properties = definition.Properties;
-	return properties !== null && typeof properties === "object" && !Array.isArray(properties) ? properties : void 0;
-}
-function noEchoAttributeNamesFor(engine, logicalId, record, carried, leaves) {
-	const attributes = record.attributes ?? {};
-	const names = /* @__PURE__ */ new Set();
-	let echoed = false;
-	for (const coordinate of leaves ?? []) {
-		const value = valueAtCoordinate(record.properties, coordinate);
-		if (value === void 0 || carriesSecretMask(value)) continue;
-		for (const [name, attribute] of Object.entries(attributes)) {
-			if (carriesSecretMask(attribute)) continue;
-			if (typeof attribute === "string" && attribute === record.physicalId) continue;
-			const sameName = coordinate[0] === name && keyOrderFreeJson(attribute) === keyOrderFreeJson(value);
-			const embeds = typeof value === "string" && typeof attribute === "string" && !attribute.startsWith("arn:") && value.length >= 4 && typeof attribute === "string" && attribute.includes(value);
-			if (sameName || embeds) {
-				names.add(name);
-				echoed = true;
-			}
-		}
-	}
-	const declared = carried ? void 0 : engine.noEchoAttributeResources.get(logicalId);
-	if (declared === true) for (const name of Object.keys(attributes)) names.add(name);
-	else if (declared !== void 0) {
-		for (const name of declared) if (Object.hasOwn(attributes, name)) names.add(name);
-	}
-	const prior = noEchoAttributeNamesOf(record);
-	for (const name of prior ?? []) if (Object.hasOwn(attributes, name) && carriesSecretMask(attributes[name])) names.add(name);
-	if (declared === void 0 && prior === void 0 && !echoed) return void 0;
-	return [...names].sort();
-}
-function applyNoEchoPersist(logicalId, record, scrubbed, templateProps, resources, secrets, carried = false) {
-	const sources = this.noEchoPositionSources(resources);
-	if (sources === void 0) return scrubbed;
-	const leaves = this.noEchoLeavesFor(logicalId, record, templateProps, sources);
-	const names = noEchoAttributeNamesFor(this, logicalId, record, carried, leaves);
-	if (leaves === void 0 && names === void 0) return scrubbed;
-	const next = { ...scrubbed };
-	if (leaves !== void 0) {
-		next.properties = maskAtCoordinates(scrubbed.properties, leaves);
-		if (scrubbed.observedProperties !== void 0 && leaves.length > 0) Object.assign(next, { observedProperties: maskReadbackAtCoordinates(scrubbed.observedProperties, record.properties, leaves) });
-		if (leaves.length > 0) next.noEchoLeaves = leaves;
-		else delete next.noEchoLeaves;
-	}
-	if (names !== void 0) {
-		if (scrubbed.attributes !== void 0 && names.length > 0) {
-			const attributes = { ...scrubbed.attributes };
-			for (const name of names) if (Object.hasOwn(attributes, name)) attributes[name] = maskWholeValue(attributes[name]);
-			next.attributes = attributes;
-		}
-		if (names.length > 0) next.noEchoAttributeNames = names;
-		else delete next.noEchoAttributeNames;
-	}
-	this.warnNoEchoPhysicalId(logicalId, record, secrets);
-	return next;
-}
-function warnNoEchoPhysicalId(logicalId, record, secrets) {
-	if (secrets === void 0 || this.noEchoPhysicalIdWarned.has(logicalId)) return;
-	const values = noEchoParameterPlaintextsOf(secrets);
-	if (values.length === 0 || typeof record.physicalId !== "string") return;
-	if (!values.some((value) => record.physicalId.includes(value))) return;
-	this.noEchoPhysicalIdWarned.add(logicalId);
-	this.logger.warn(this.maskForResource(logicalId, safeMsg`${logicalId}: its physical id contains a NoEcho parameter value. AWS publishes a resource's name, so cdkd keeps the physical id in state as AWS returns it.`));
-}
-function seedPersistedNoEchoAttributes(resources) {
-	this.persistedNoEchoAttributes = /* @__PURE__ */ new Map();
-	for (const [logicalId, record] of Object.entries(resources)) {
-		const names = noEchoAttributeNamesOf(record);
-		if (names !== void 0 && names.length > 0) this.persistedNoEchoAttributes.set(logicalId, new Set(names));
-	}
-}
-function maskOutputsByPosition(outputs) {
-	const sources = this.noEchoPositionSources();
-	if (sources === void 0) return outputs;
-	const templateValues = Object.create(null);
-	for (const [name, definition] of Object.entries(this.constructPathTemplate?.Outputs ?? {})) templateValues[name] = definition?.Value;
-	if (this.outputsSourceUsable) for (const [name, value] of Object.entries(this.outputsTemplateSource)) templateValues[name] = value;
-	const coordinates = noEchoCoordinatesOf(templateValues, outputs, sources);
-	if (coordinates.length === 0) return outputs;
-	const maskedValues = new Set(coordinates.filter((coordinate) => coordinate.length === 1 && typeof coordinate[0] === "string").map((coordinate) => keyOrderFreeJson(outputs[coordinate[0]])));
-	const aliasCoordinates = Object.keys(outputs).filter((key) => !Object.hasOwn(templateValues, key) && outputs[key] !== void 0 && !carriesSecretMask(outputs[key]) && maskedValues.has(keyOrderFreeJson(outputs[key]))).map((key) => [key]);
-	return maskAtCoordinates(outputs, [...coordinates, ...aliasCoordinates]);
-}
-function getAttTargetsOf(node) {
-	const targets = [];
-	const seen = /* @__PURE__ */ new Set();
-	const subVariable = /\$\{([^}!][^}]*)\}/g;
-	const walk = (value) => {
-		if (value === null || typeof value !== "object" || seen.has(value)) return;
-		seen.add(value);
-		if (Array.isArray(value)) {
-			for (const item of value) walk(item);
-			return;
-		}
-		const record = value;
-		const getAtt = record["Fn::GetAtt"];
-		if (typeof getAtt === "string" && getAtt.indexOf(".") > 0) {
-			const dot = getAtt.indexOf(".");
-			targets.push([getAtt.slice(0, dot), getAtt.slice(dot + 1)]);
-		} else if (Array.isArray(getAtt) && typeof getAtt[0] === "string" && typeof getAtt[1] === "string") targets.push([getAtt[0], getAtt[1]]);
-		const sub = record["Fn::Sub"];
-		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
-		if (typeof text === "string") for (const match of text.matchAll(subVariable)) {
-			const name = match[1].trim();
-			const dot = name.indexOf(".");
-			if (dot > 0) targets.push([name.slice(0, dot), name.slice(dot + 1)]);
-		}
-		for (const child of Object.values(record)) walk(child);
-	};
-	walk(node);
-	return targets;
-}
-async function noEchoAttributeOverridesFor(desiredProps, stateResources, stackName) {
-	const wanted = /* @__PURE__ */ new Map();
-	for (const [logicalId, attribute] of getAttTargetsOf(desiredProps)) {
-		const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
-		if (record === void 0) continue;
-		if (noEchoAttributeNamesOf(record)?.includes(attribute) !== true) continue;
-		if (!carriesSecretMask(record.attributes?.[attribute])) continue;
-		if (!this.perResourceSecrets.has(logicalId)) continue;
-		const set = wanted.get(logicalId) ?? /* @__PURE__ */ new Set();
-		set.add(attribute);
-		wanted.set(logicalId, set);
-	}
-	if (wanted.size === 0) return void 0;
-	const overrides = /* @__PURE__ */ new Map();
-	for (const [logicalId, attributes] of wanted) {
-		const record = stateResources[logicalId];
-		let read = this.noEchoAttributeReads.get(logicalId);
-		if (read === void 0) {
-			read = (async () => {
-				try {
-					const { provider } = this.providerRegistry.getProviderFor({
-						resourceType: record.resourceType,
-						properties: record.properties,
-						provisionedBy: record.provisionedBy,
-						previousProperties: record.properties
-					});
-					const outcome = await readRecordAttributes({
-						provider,
-						logicalId,
-						resource: record,
-						stackName,
-						region: this.stackRegion
-					});
-					return outcome.kind === "read" ? outcome.attributes : void 0;
-				} catch {
-					return;
-				}
-			})();
-			this.noEchoAttributeReads.set(logicalId, read);
-		}
-		const live = await read;
-		if (live === void 0) continue;
-		const secrets = this.perResourceSecrets.get(logicalId);
-		const fresh = noEchoParameterPlaintextsOf(secrets);
-		const positioned = this.noEchoPositionedValues.get(logicalId) ?? /* @__PURE__ */ new Set();
-		const served = {};
-		for (const attribute of attributes) {
-			if (!Object.hasOwn(live, attribute)) continue;
-			const value = live[attribute];
-			if (typeof value === "string" && fresh.some((needle) => value === needle || value.includes(needle)) || value !== void 0 && positioned.has(keyOrderFreeJson(value))) served[attribute] = value;
-		}
-		if (Object.keys(served).length > 0) overrides.set(logicalId, served);
-	}
-	return overrides.size > 0 ? overrides : void 0;
-}
-function noEchoDiffComparison(resources, template, conditions, parameterValues, stackName) {
-	const sources = this.noEchoPositionSources(resources, template, conditions);
-	if (sources === void 0) return void 0;
-	const compare = noEchoComparison({
-		sources,
-		values: parameterValues,
-		minNeedleLength: 4,
-		publicTokens: /* @__PURE__ */ new Set([this.stackRegion, ...stackName === void 0 ? [] : [stackName]])
-	});
-	return (input) => compare(input);
-}
-function freshNoEchoParametersWithDeclared(inherited, template) {
-	const all = /* @__PURE__ */ new Set([...inherited ?? [], ...noEchoParameterNamesOf(template)]);
-	return all.size > 0 ? all : void 0;
-}
-function noEchoComparisonForTemplate(template, knownConditions, values, resources, publicTokens, inheritedNoEchoParameters) {
-	const sources = {
-		parameters: /* @__PURE__ */ new Set([...noEchoParameterNamesOf(template), ...inheritedNoEchoParameters ?? []]),
-		attributeIsNoEcho: (logicalId, attribute) => noEchoAttributeNamesOf(Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0)?.includes(attribute) === true,
-		...knownConditions !== void 0 && { conditions: knownConditions }
-	};
-	const compare = noEchoComparison({
-		sources,
-		values: values ?? {},
-		minNeedleLength: 4,
-		...publicTokens !== void 0 && { publicTokens }
-	});
-	return (input) => compare(input);
-}
-
 //#endregion
 //#region src/provisioning/canonicalize-properties.ts
 function makeCanonicalizePropertiesFn(registry) {
@@ -38296,65 +38722,6 @@ function refuseNoValueOutputs(outputs, conditions) {
 	throw markNonRetryable(/* @__PURE__ */ new Error(`Output ${offending.join(", ")} evaluates to AWS::NoValue, and CloudFormation rejects the template for it ("The Value field of every Outputs member must evaluate to a String") before creating anything. To publish an Output only sometimes, give it a Condition instead of selecting AWS::NoValue in its Value.`));
 }
 
-//#endregion
-//#region src/deployment/deployment-approval.ts
-const NESTED_STACK_TYPE$1 = "AWS::CloudFormation::Stack";
-async function requireDeploymentApproval(args) {
-	const level = args.options.requireApproval ?? "never";
-	const approve = args.options.approveDeployment;
-	if (level === "never" || approve === void 0) return;
-	const changes = [...args.changes].filter((c) => c.changeType !== "NO_CHANGE" && !isNoEchoPromotionOnly(c));
-	const destructiveChanges = findDestructiveChanges(args.stackName, changes, args.records, args.template, new Set(args.recreateTargetIds ?? []));
-	const onlyNestedUpdates = changes.every((c) => c.changeType === "UPDATE" && c.resourceType === NESTED_STACK_TYPE$1);
-	if (!(level === "destructive" ? destructiveChanges.length > 0 : changes.length > 0 && !onlyNestedUpdates)) return;
-	const count = (type) => changes.filter((c) => c.changeType === type).length;
-	if (enclosingDeadlineExpired()) throw approvalAfterTimeout(args.stackName);
-	let approved;
-	try {
-		approved = await whileEnclosingDeadlinesPaused(() => approve({
-			stackName: args.stackName,
-			level,
-			counts: {
-				create: count("CREATE"),
-				update: count("UPDATE"),
-				delete: count("DELETE")
-			},
-			destructiveChanges
-		}));
-	} catch (error) {
-		throw error instanceof Error ? markNonRetryable(error) : error;
-	}
-	if (!approved) throw markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${args.stackName} was not approved (--require-approval=${level}). Nothing was changed.`, "DEPLOY_NOT_APPROVED"));
-}
-function approvalAfterTimeout(stackName) {
-	return markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${stackName} was not started: its parent's nested-stack row already timed out (--resource-timeout). Nothing was changed.`, "DEPLOY_APPROVAL_AFTER_TIMEOUT"));
-}
-async function requireOutputsOnlyApproval(args) {
-	const approve = args.options.approveDeployment;
-	if (args.options.requireApproval !== "any-change" || approve === void 0) return;
-	if (enclosingDeadlineExpired()) throw approvalAfterTimeout(args.stackName);
-	let approved;
-	try {
-		approved = await whileEnclosingDeadlinesPaused(() => approve({
-			stackName: args.stackName,
-			level: "any-change",
-			counts: {
-				create: 0,
-				update: 0,
-				delete: 0
-			},
-			destructiveChanges: [],
-			outputsOnly: true
-		}));
-	} catch (error) {
-		throw error instanceof Error ? markNonRetryable(error) : error;
-	}
-	if (!approved) throw markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${args.stackName} was not approved (--require-approval=any-change). Nothing was changed.`, "DEPLOY_NOT_APPROVED"));
-}
-function isNoEchoPromotionOnly(change) {
-	return change.changeType === "UPDATE" && (change.attributeChanges?.length ?? 0) === 0 && (change.propertyChanges?.length ?? 0) > 0 && change.propertyChanges.every((pc) => pc.noEchoPromoted === true);
-}
-
 //#endregion
 //#region src/deployment/condition-verdicts.ts
 function conditionInputsFrom(args) {
@@ -38853,6 +39220,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		});
 		const parameterValues = await this.resolver.resolveParameters(template, this.options.parameters, { ...this.options.inheritedSecrets && hasMaskableValues(this.options.inheritedSecrets) && { inheritedSecrets: this.options.inheritedSecrets } });
 		this.logger.debug(`Resolved ${Object.keys(parameterValues).length} parameters: ${Object.keys(parameterValues).join(", ")}`);
+		poisonRenderedSpellingsCollidingIn(template, parameterValues, this.options.inheritedSecrets);
 		this.inheritedNoEchoParameters = /* @__PURE__ */ new Set([...this.freshNoEchoParameters(parameterValues) ?? [], ...this.options.passedNoEchoParameters ?? []]);
 		const backfillNoEchoValues = noEchoParameterValueSeed(template.Parameters, parameterValues, this.options.inheritedSecrets, this.options.parameters);
 		this.fingerprintNoEchoValues = backfillNoEchoValues;
@@ -39334,6 +39702,7 @@ var DeployEngine = class {
 	inheritedNoEchoParameters = /* @__PURE__ */ new Set();
 	noEchoPhysicalIdWarned = /* @__PURE__ */ new Set();
 	noEchoPositionedValues = /* @__PURE__ */ new Map();
+	noEchoExactEchoes = /* @__PURE__ */ new Map();
 	noEchoAttributeReads = /* @__PURE__ */ new Map();
 	replacedDeleteSkips = /* @__PURE__ */ new Map();
 	secretNameNeedles = /* @__PURE__ */ new Map();
@@ -39397,6 +39766,7 @@ var DeployEngine = class {
 		this.inheritedNoEchoParameters = /* @__PURE__ */ new Set();
 		this.noEchoPhysicalIdWarned = /* @__PURE__ */ new Set();
 		this.noEchoPositionedValues = /* @__PURE__ */ new Map();
+		this.noEchoExactEchoes = /* @__PURE__ */ new Map();
 		this.noEchoAttributeReads = /* @__PURE__ */ new Map();
 		this.replacedDeleteSkips = /* @__PURE__ */ new Map();
 		this.secretNameNeedles = /* @__PURE__ */ new Map();
@@ -39436,7 +39806,7 @@ var DeployEngine = class {
 			const secrets = this.perResourceSecrets.get(logicalId);
 			const templateProps = this.perResourceTemplateProps.get(logicalId);
 			const scrubbed = scrubResourceRecord(this.withHealedAttributes(logicalId, record), secrets ?? /* @__PURE__ */ new Map(), templateProps);
-			const noEchoScrubbed = this.applyNoEchoPersist(logicalId, record, scrubbed, templateProps, state.resources, secrets);
+			const noEchoScrubbed = this.applyNoEchoPersist(logicalId, record, this.withNoEchoExactEchoes(logicalId, scrubbed), templateProps, state.resources, secrets);
 			resources[logicalId] = withConstructPath(withMaskedPropertyFingerprints(noEchoScrubbed, record.properties, templateProps, secrets, this.fingerprintNoEchoValues, this.perResourceInputFingerprints.get(logicalId)), constructPathOf(this.constructPathTemplate, logicalId));
 		}
 		const orphans = state.orphans?.map((entry) => {
@@ -39624,6 +39994,9 @@ DeployEngine.prototype.warnNoEchoPhysicalId = warnNoEchoPhysicalId;
 DeployEngine.prototype.seedPersistedNoEchoAttributes = seedPersistedNoEchoAttributes;
 DeployEngine.prototype.noEchoAttributeOverridesFor = noEchoAttributeOverridesFor;
 DeployEngine.prototype.noEchoDiffComparison = noEchoDiffComparison;
+DeployEngine.prototype.noteNoEchoExactEchoes = noteNoEchoExactEchoes;
+DeployEngine.prototype.establishNoEchoEchoFidelity = establishNoEchoEchoFidelity;
+DeployEngine.prototype.withNoEchoExactEchoes = withNoEchoExactEchoes;
 DeployEngine.prototype.handleOutputResolutionFailure = handleOutputResolutionFailure;
 DeployEngine.prototype.resolveOutputs = resolveOutputs;
 DeployEngine.prototype.buildDisplayOutputs = buildDisplayOutputs;
@@ -39631,5 +40004,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { dropFailedHint as $, maskReadbackAtCoordinates as $a, refuseMalformedResourcePropertiesForDrift as $i, wouldReturnToSdkProvider as $n, hasReasonlessBaselineRefusal as $o, parseWebACLArn as $r, resolveAutoAssetStorage as $s, secretNamePrintingBag as $t, gray as A, isWarmThroughputDecrease as Aa, renderAssemblyPathEscape as Ac, malformedResourceEntriesWarning as Ai, maskingRetryLogger as An, identityKeyFor as Ao, AWS_CREDENTIAL_ENV_KEYS as Ar, describeDockerFailure as As, removeProtectionTypeList as At, NESTED_PENDING_PARENT_REASON as B, requireConfigArray as Ba, refuseMalformedOrphans as Bi, DBPROXY_TAGS_WHAT as Bn, STATE_SOURCED_READBACK_RULES as Bo, coerceParameterTypedValue as Br, runDockerForeground as Bs, findNestedStackTypeChanges as Bt, recordedProtectionNote as C, shownType as Ca, hasOwnKey as Cc, malformedOrphanRecordsWarning as Ci, noEchoParameterValueSeed as Cn, DYNAMIC_REFERENCE_TOKEN_SCAN as Co, regionLessSecretName as Cr, validateAssetBucketName as Cs, INDEX_SETTLE_POLL_INTERVAL_MS as Ct, createReadOnlyAttributeHealerFactory as D, renderStatefulReason as Da, absoluteAssemblyPathEscape as Dc, malformedOutputsRefusalMessage as Di, bindingSkippedOutputs as Dn, inheritNestedStackParameterAssociations as Do, explicitRoleArnOrThrow as Dr, resolveDockerContextDirectory as Ds, S3_AUTO_DELETE_OBJECTS_TAG as Dt, formatResourceLine as E, isStatefulRecreateTargetSync as Ea, ownValue as Ec, malformedOrphansWarning as Ei, isExportAliasCollision as En, pathCrossesDottedKey as Eo, assertSendableRoleArn as Er, buildDockerImage as Es, ECR_AUTO_DELETE_IMAGES_TAG as Et, namesAnyDeclaredParameter as F, configBooleanRefusal as Fa, previewableOrphanRecords as Fi, earliestDefined as Fn, recordNoEchoAttributeValues as Fo, s3BucketArn as Fr, isDockerClientEnvKey as Fs, isReplacementOrphan as Ft, nestedChildStackName as G, describeTypeWithThrottleRetry as Ga, refuseMalformedResourceAttributesForOrphan as Gi, tagMapAsList as Gn, isLockInfoExpired as Go, carriesDynamicReference as Gr, AssetManifestLoader as Gs, redactedDeleteAddressFields as Gt, displacedPhysicalIdShown as H, requireConfigString as Ha, refuseMalformedOrphansForOrphan as Hi, planTagDiff as Hn, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ho, parameterTypeMayLoseSecretIdentity as Hr, warnFinchArgvExposure as Hs, inheritProducerRegions as Ht, reachableDivergentParameters as I, configIntegerRefusal as Ia, refuseDivergentRecordRegionForDestroy as Ii, ledgerForStack as In, recordProvenPublicExpression as Io, s3BucketDomainName as Ir, isMalformedEnvKey as Is, planFailedOps as It, revertedNestedRowIds as J, lambdaFunctionNameForMask as Ja, refuseMalformedResourceEntriesForDestroy as Ji, stringifyIfAssigned as Jn, splitImportedOps as Jo, keepsSecretReferenceToken as Jr, synthesisStatusMessage as Js, updatePartialReason as Jt, recordDisplacedSkips as K, withRetry as Ka, refuseMalformedResourceEntries as Ki, tagPlanWarning as Kn, S3StateBackend as Ko, carriesFetchableDynamicReference as Kr, getDockerImageBySourceHash as Ks, redactedDeleteAddressSkip as Kt, resourcesNamingDeclaredParameter as L, configStringRefusal as La, refuseMalformedNestedChildOutputs as Li, reserveStackCreateToken as Ln, wholeStringLeavesOf as Lo, s3BucketDualStackDomainName as Lr, partitionSensitiveEnv as Ls, planRollback as Lt, red as M, toFiniteNumber as Ma, clearBucketRegionCache as Mc, malformedResourcesWarning as Mi, findDestructiveChanges as Mn, provenPublicValue as Mo, callerEnvCredentials as Mr, finchSecretArgvRefusal as Ms, recordAfterRollbackUpdate as Mt, yellow as N, coerceCfnBoolean as Na, resolveBucketRegion as Nc, malformedScrubResourceEntriesRefusalMessage as Ni, formatDestructiveChange as Nn, recordMaskOnlyValue as No, envCredentialsAreAssumedRole as Nr, formatDockerLoginError as Ns, demoteSupersededOrphans as Nt, bold as O, WARM_THROUGHPUT_MEMBERS as Oa, describeFileReadFailure as Oc, malformedOutputsWarning as Oi, DEFAULT_RESOURCE_TIMEOUT_MS as On, recordNestedStackParameterExpressions as Oo, isIamRoleArn as Or, describeDockerCapturedOutput as Os, hasCdkAutoDeleteTag as Ot, computeParameterTaint as P, coerceCfnInteger as Pa, malformedStateRefusalMessage as Pi, RollbackInlinePolicyWriters as Pn, recordMaskOnlyValuesIn as Po, isSettledInstanceState as Pr, getDockerCmd as Ps, isJournaledOrphan as Pt, deleteJournaledOrphans as Q, isMarkedCoordinate as Qa, refuseMalformedResourcePropertiesForDestroy as Qi, isCustomResource as Qn, hasReadableExportSet as Qo, refStateLookupFromResource as Qr, resolveApp as Qs, orphanRecordsPrintingBag as Qt, makeSiblingClaimReader as R, readConfigString as Ra, refuseMalformedOrphanRecords as Ri, withCreateTokenLedger as Rn, STATE_SOURCED_BASELINE_RULES as Ro, s3BucketRegionalDomainName as Rr, redactDockerArgvValues as Rs, replacementNeverSwapped as Rt, recordedProtectionEvidence as S, findReplacedReadersOfRecreateTargets as Sa, defineOwnKey as Sc, malformedOrphanRecordsRefusalMessage as Si, isWholeDynamicReferenceValue as Sn, scrubResourceRecord as So, producerRegionsFromState as Sr, readBootstrapMarkerBody as Ss, DELETE_INDEX_WAIT_PROCEED_NOTE as St, markRefusedBeforeApplying as T, isStatefulRecreateTargetForReplace as Ta, nullPrototypeRecord as Tc, malformedOrphansRefusalMessage as Ti, collectPublishedOutputNames as Tn, isUncertifiedBaselineMaskPosition as To, assertFlagRoleArn as Tr, buildDenyExternalAccessPolicy as Ts, waitForIndexesSettled as Tt, dropSettledNestedJournals as U, prefetchCreateOnlyPropertyPaths as Ua, refuseMalformedOutputs as Ui, readTagList as Un, isSingleDynamicReferenceToken as Uo, getAccountInfo as Ur, escapeRegExp$3 as Us, REDACTED_DELETE_ADDRESS_SKIP_REASON as Ut, displacedOpClause as V, requireConfigObject as Va, refuseMalformedOrphansForDestroy as Vi, DBPROXY_TAG_OPTIONS as Vn, TEMPLATE_SOURCED_RULES as Vo, isUnboundTemplateParameter as Vr, runDockerStreaming as Vs, getCurrentProducerRegions as Vt, getNestedRevertRun as W, templateResourceTypes as Wa, refuseMalformedOutputsForDestroy as Wi, refuseMalformedDesiredTags as Wn, LockManager as Wo, isImpossibleEmptyStoredAttribute as Wr, stripControlChars as Ws, isRedactedRecordedValue as Wt, getCurrentNestedStackContext as X, DagBuilder as Xa, refuseMalformedResourceEntriesForImportSave as Xi, ProviderRegistry as Xn, describeRegionValueKind as Xo, cfnRefValueFromPhysicalId as Xr, getLegacyStateBucketName as Xs, journaledOrphanPrintingBag as Xt, withNestedRevertRun as Y, sameLambdaFunctionAddress as Ya, refuseMalformedResourceEntriesForImport as Yi, CC_BROKEN_REASON as Yn, acceptedCreateOnlyDropsOf as Yo, AWS_NO_VALUE as Yr, getDefaultStateBucketName as Ys, completedReplayEntries as Yt, withNestedStackContext as Z, TemplateParser as Za, refuseMalformedResourceEntriesForOrphan as Zi, ccBrokenReason as Zn, exportNamesCarriedFrom as Zo, isStalePlaceholderArnAttribute as Zr, loadCdkJson as Zs, maskEventTextWithBoundBags as Zt, makeCanonicalizePropertiesFn as _, findSilentDropProperties as _a, canonicalizeRegion as _c, malformedExportNamesWarning as _i, secretBearingStateKeyWarning as _n, errorCauseChain as _o, reEnableInstanceApiTermination as _r, assertAssetBucketRegion as _s, beginDeleteWait as _t, findNestedTemplateTreeDefect as a, refuseMalformedState as aa, stateBucketExistenceConfirmed as ac, STATE_RESOURCES_MALFORMED as ai, createPreDeleteFinalSnapshot as an, readsNoEchoSource as ao, unchangedBehindSecretReference as ar, orphansCarriedFrom as as, replayFailedOperations as at, noEchoParameterNamesOf as b, NO_CC_HANDLERS_REASON as ba, StageLoadError as bc, malformedLocalResourceEntriesWarning as bi, exportNameNoEchoParameters as bn, markSameGenerationBag as bo, IntrinsicFunctionResolver as br, isCrossRegionRedirect as bs, resolveDynamoDbDeleteBudgetClock as bt, renderNestedTemplateTreeDefect as c, repairMalformedOutputsForReadOnly as ca, CFN_TEMPLATE_BODY_LIMIT as cc, accountArgs as ci, refusesFinalSnapshot as cn, createUnionSecretMasker as co, deleteSkipReason as cr, isSensitiveAttributeName as cs, destroyStackRecordsView as ct, conditionInputsFrom as d, repairMalformedResourcesForReadOnly as da, findLargeInlineResources as dc, hasReadableOrphans as di, DeploymentEventsStore as dn, logOnlyValueCount as do, markWaitAbandoned as dr, buildAssetRedirectMap as ds, PROTECTION_PROPERTY_BY_TYPE as dt, refuseMalformedResourcePropertiesForExport as ea, resolveCaptureObservedState as ec, withSharedDrainBudget as ei, stateSecretNameNeedles as en, maskWholeValue as eo, isCustomResourceType as er, hasUnverifiableParameterRefusal as es, isHandledOrphan as et, parentSuppliedValues as f, unpreviewableOrphanRecords as fa, uploadCfnTemplate as fc, hasReadableOutputs as fi, extractDeploymentEventError as fn, printingCorpusOf as fo, disableInstanceApiTermination as fr, createAssetRedirectResolver as fs, isProtectionValueActive as ft, mergeNoChangeOutputs as g, findActionableSilentDrops as ga, PARTITION_TABLE as gc, malformedDriftResourcePropertiesWarning as gi, secretBearing as gn, createSecretMasker as go, reDisableInstanceApiTermination as gr, BOOTSTRAP_MARKER_PREFIX as gs, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as gt, keptWholeReasonText as h, withheldAccountClause as ha, expectedOwnerParam as hc, isReadableResourceEntry as hi, exportAliasCollisionScrubWarning as hn, shareLogOnlyValues as ho, observeThenDisableInstanceApiTermination as hr, AssetModeResolver as hs, DynamoDBGlobalTableProvider as ht, childTemplateLoader as i, refuseMalformedResourcesForExport as ia, resolveUseCdkBootstrapAssets as ic, STATE_REGION_DIVERGED as ii, ccRoutedFinalSnapshotError as in, passedNoEchoParametersOf as io, slowCcOperationTimeoutMs as ir, orphansAfterRollback as is, sameJournaledOrphans as it, green as j, toCfnInteger as ja, resolveAssemblyPath as jc, malformedResourcePropertiesWarning as ji, constructPathOf as jn, carriesSecretMask as jo, applyCallerIdentityCredentials as jr, dockerSpawnEnvWithSensitive as js, orphanDeleteNeedsIdentity as jt, cyan as k, coerceWarmThroughput as ka, displayAssemblyPath as kc, malformedRenderedContainersWarning as ki, DEFAULT_RESOURCE_WARN_AFTER_MS as kn, recoverMaskedOutput as ko, sendableAssumeRoleCommand as kr, describeDockerExecFailure as ks, isTruthyCfnBoolean as kt, templateIdentity as l, repairMalformedResourceEntriesForReadOnly as la, CFN_TEMPLATE_URL_LIMIT as lc, deployRefusesOrphanRowsReason as li, unsupportedFinalSnapshotError as ln, hasMaskableValues as lo, withIndeterminateGuard as lr, stringifyValue as ls, getStackRecords as lt, isSecretBearingReferenceString as m, unreadableResourceEntries as ma, decodeListingKey as mc, isReadableOrphanRecord as mi, displayTextOrWithheld as mn, recordLogOnlyValue as mo, isTerminationProtectionPropagationError as mr, rewriteTemplateAssetReferences as ms, readProtection as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedResourcesForDeploy as na, resolveStateBucketWithDefault as nc, passedParameterClassesOf as ni, PRE_DELETE_SNAPSHOT_TYPES as nn, noEchoLeavesOf as no, withPrintingSecrets as nr, importableOutputs as ns, loadJournaledOrphans as nt, isAbsoluteAssetPath as o, repairMalformedOrphanRecordsForReadOnly as oa, warnDeprecatedNoPrefixCliFlag as oc, UNREADABLE_ORPHANS_CONTAINER_ROW as oi, effectiveDeletionPolicy as on, liveMatchesUnresolvedTokenFrame as oo, UNSPECIFIED_SKIP_REASON as or, shouldRetainResource as os, replayRollback as ot, readRecordedConditionVerdicts as p, unreadableOrphanRecords as pa, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as pc, hasReadableResources as pi, WITHHELD_NAME_DISPLAY as pn, recordLogOnlyParameterValue as po, ec2InstanceProtectionSite as pr, loadPublishableAssetManifest as ps, perType as pt, revertNestedChildFromJournal as q, canonicalLambdaFunctionName as qa, refuseMalformedResourceEntriesForDeploy as qi, definedAttributes as qn, rebuildClientForBucketRegion as qo, isNamelessDynamicReferenceError as qr, Synthesizer as qs, updatePartialMessage as qt, computeImplicitDeleteEdges as r, refuseMalformedResourcesForDestroy as ra, resolveStateBucketWithDefaultAndSource as rc, JSON_LISTING_HOLE_VALUE as ri, buildFinalSnapshotIdentifier as rn, noEchoOutputsComparison as ro, CloudControlProvider as rr, isReadableBag as rs, makeForeignHolderScan as rt, listNestedTemplateRows as s, repairMalformedOrphansForReadOnly as sa, ssmResolvedValueType as sc, UNREADABLE_RESOURCES_MAP_ROW as si, isFinalSnapshotError as sn, carryLogOnlyValues as so, deleteIndeterminateGuards as sr, AssetPublisher as ss, awaitInFlightSibling as st, DeployEngine as t, refuseMalformedResourcePropertiesForOrphan as ta, resolveSkipPrefix as tc, parameterInputsFor as ti, ATOMIC_FINAL_SNAPSHOT_TYPES as tn, maskedLeafCoordinatesOf as to, getCurrentResourceSecrets as tr, importableOutputKeys as ts, journaledOrphanLines as tt, conditionFingerprint as u, repairMalformedResourcePropertiesForReadOnly as ua, MIGRATE_TMP_PREFIX as uc, displayLogicalId as ui, DeploymentEventsReader as un, literalSplitDelimitersOf as uo, isWaitAbandonedError as ur, WorkGraph as us, withStackRecords as ut, noEchoAttributeNamesOf as v, unwrittenCreateOnlyReplacement as va, derivePartitionAndUrlSuffix as vc, malformedExportSourceWarning as vi, secretSafeKeyDisplay as vn, maskSecretsInError as vo, DiffCalculator as vr, ensureAssetStorage as vs, compensateRemovedDeletionProtection as vt, getPriorAttempts as w, MULTI_REGION_RECREATE_BLOCKED_TYPES as wa, hasPlainPrototype$1 as wc, malformedOrphanRowsKeptWarning as wi, collectDeclaredOutputNames as wn, dynamicReferenceTokens as wo, applyRoleArnIfSet as wr, validateContainerRepoName as ws, deleteTableWithIndexBusyRetry as wt, withResourceDeadline as x, hasNoCloudControlHandlers as xa, processStackMessages as xc, malformedLocalResourcesWarning as xi, exportNameSecretExposure as xn, redactSecretsForState as xo, classifyReplaySecretRegion as xr, parseBootstrapMarker as xs, resolveDynamoDbDeleteBudgetMs as xt, noEchoComparisonForTemplate as y, withoutSilentDropProperties as ya, AssemblyReader as yc, malformedLocalOutputsWarning as yi, carriedExportAliasExposure as yn, maskSecretsInText as yo, INTRINSIC_KEYS as yr, getBootstrapMarkerKey as ys, deleteBudgetKey as yt, planOrphanAdoption as z, replayWarn as za, refuseMalformedOrphanRecordsForDestroy as zi, acquireIdempotencyToken as zn, STATE_SOURCED_CROSS_GENERATION_RULES as zo, s3BucketWebsiteUrl as zr, redactedDockerCause as zs, resolveReplacementOldType as zt };
-//# sourceMappingURL=deploy-engine-CjLZZzyn.js.map
+export { dropFailedHint as $, isMarkedCoordinate as $a, refuseMalformedResourcePropertiesForDestroy as $i, wouldReturnToSdkProvider as $n, hasReadableExportSet as $o, refStateLookupFromResource as $r, resolveApp as $s, secretNamePrintingBag as $t, gray as A, coerceWarmThroughput as Aa, displayAssemblyPath as Ac, malformedRenderedContainersWarning as Ai, maskingRetryLogger as An, recordNestedStackParameterExpressions as Ao, sendableAssumeRoleCommand as Ar, describeDockerExecFailure as As, removeProtectionTypeList as At, NESTED_PENDING_PARENT_REASON as B, replayWarn as Ba, refuseMalformedOrphanRecordsForDestroy as Bi, DBPROXY_TAGS_WHAT as Bn, STATE_SOURCED_CROSS_GENERATION_RULES as Bo, s3BucketWebsiteUrl as Br, redactedDockerCause as Bs, findNestedStackTypeChanges as Bt, recordedProtectionNote as C, findReplacedReadersOfRecreateTargets as Ca, defineOwnKey as Cc, malformedOrphanRecordsRefusalMessage as Ci, noEchoParameterValueSeed as Cn, scrubResourceRecord as Co, producerRegionsFromState as Cr, readBootstrapMarkerBody as Cs, INDEX_SETTLE_POLL_INTERVAL_MS as Ct, createReadOnlyAttributeHealerFactory as D, isStatefulRecreateTargetSync as Da, ownValue as Dc, malformedOrphansWarning as Di, bindingSkippedOutputs as Dn, pathCrossesDottedKey as Do, assertSendableRoleArn as Dr, buildDockerImage as Ds, S3_AUTO_DELETE_OBJECTS_TAG as Dt, formatResourceLine as E, isStatefulRecreateTargetForReplace as Ea, nullPrototypeRecord as Ec, malformedOrphansRefusalMessage as Ei, isExportAliasCollision as En, isUncertifiedBaselineMaskPosition as Eo, assertFlagRoleArn as Er, buildDenyExternalAccessPolicy as Es, ECR_AUTO_DELETE_IMAGES_TAG as Et, namesAnyDeclaredParameter as F, coerceCfnInteger as Fa, malformedStateRefusalMessage as Fi, earliestDefined as Fn, recordMaskOnlyValuesIn as Fo, isSettledInstanceState as Fr, getDockerCmd as Fs, isReplacementOrphan as Ft, nestedChildStackName as G, templateResourceTypes as Ga, refuseMalformedOutputsForDestroy as Gi, tagMapAsList as Gn, LockManager as Go, isImpossibleEmptyStoredAttribute as Gr, stripControlChars as Gs, redactedDeleteAddressFields as Gt, displacedPhysicalIdShown as H, requireConfigObject as Ha, refuseMalformedOrphansForDestroy as Hi, planTagDiff as Hn, TEMPLATE_SOURCED_RULES as Ho, isUnboundTemplateParameter as Hr, runDockerStreaming as Hs, inheritProducerRegions as Ht, reachableDivergentParameters as I, configBooleanRefusal as Ia, previewableOrphanRecords as Ii, ledgerForStack as In, recordNoEchoAttributeValues as Io, s3BucketArn as Ir, isDockerClientEnvKey as Is, planFailedOps as It, revertedNestedRowIds as J, canonicalLambdaFunctionName as Ja, refuseMalformedResourceEntriesForDeploy as Ji, stringifyIfAssigned as Jn, rebuildClientForBucketRegion as Jo, isNamelessDynamicReferenceError as Jr, Synthesizer as Js, updatePartialReason as Jt, recordDisplacedSkips as K, describeTypeWithThrottleRetry as Ka, refuseMalformedResourceAttributesForOrphan as Ki, tagPlanWarning as Kn, isLockInfoExpired as Ko, carriesDynamicReference as Kr, AssetManifestLoader as Ks, redactedDeleteAddressSkip as Kt, resourcesNamingDeclaredParameter as L, configIntegerRefusal as La, refuseDivergentRecordRegionForDestroy as Li, reserveStackCreateToken as Ln, recordProvenPublicExpression as Lo, s3BucketDomainName as Lr, isMalformedEnvKey as Ls, planRollback as Lt, red as M, toCfnInteger as Ma, resolveAssemblyPath as Mc, malformedResourcePropertiesWarning as Mi, findDestructiveChanges as Mn, carriesSecretMask as Mo, applyCallerIdentityCredentials as Mr, dockerSpawnEnvWithSensitive as Ms, recordAfterRollbackUpdate as Mt, yellow as N, toFiniteNumber as Na, clearBucketRegionCache as Nc, malformedResourcesWarning as Ni, formatDestructiveChange as Nn, provenPublicValue as No, callerEnvCredentials as Nr, finchSecretArgvRefusal as Ns, demoteSupersededOrphans as Nt, bold as O, renderStatefulReason as Oa, absoluteAssemblyPathEscape as Oc, malformedOutputsRefusalMessage as Oi, DEFAULT_RESOURCE_TIMEOUT_MS as On, identityKeyFor as Oo, explicitRoleArnOrThrow as Or, resolveDockerContextDirectory as Os, hasCdkAutoDeleteTag as Ot, computeParameterTaint as P, coerceCfnBoolean as Pa, resolveBucketRegion as Pc, malformedScrubResourceEntriesRefusalMessage as Pi, RollbackInlinePolicyWriters as Pn, recordMaskOnlyValue as Po, envCredentialsAreAssumedRole as Pr, formatDockerLoginError as Ps, isJournaledOrphan as Pt, deleteJournaledOrphans as Q, TemplateParser as Qa, refuseMalformedResourceEntriesForOrphan as Qi, isCustomResource as Qn, exportNamesCarriedFrom as Qo, isStalePlaceholderArnAttribute as Qr, loadCdkJson as Qs, orphanRecordsPrintingBag as Qt, makeSiblingClaimReader as R, configStringRefusal as Ra, refuseMalformedNestedChildOutputs as Ri, withCreateTokenLedger as Rn, wholeStringLeavesOf as Ro, s3BucketDualStackDomainName as Rr, partitionSensitiveEnv as Rs, replacementNeverSwapped as Rt, recordedProtectionEvidence as S, hasNoCloudControlHandlers as Sa, processStackMessages as Sc, malformedLocalResourcesWarning as Si, isWholeDynamicReferenceValue as Sn, redactSecretsForState as So, classifyReplaySecretRegion as Sr, parseBootstrapMarker as Ss, DELETE_INDEX_WAIT_PROCEED_NOTE as St, markRefusedBeforeApplying as T, MULTI_REGION_RECREATE_BLOCKED_TYPES as Ta, hasPlainPrototype$1 as Tc, malformedOrphanRowsKeptWarning as Ti, collectPublishedOutputNames as Tn, dynamicReferenceTokens as To, applyRoleArnIfSet as Tr, validateContainerRepoName as Ts, waitForIndexesSettled as Tt, dropSettledNestedJournals as U, requireConfigString as Ua, refuseMalformedOrphansForOrphan as Ui, readTagList as Un, WHOLE_DYNAMIC_REFERENCE_PATTERN as Uo, parameterTypeMayLoseSecretIdentity as Ur, warnFinchArgvExposure as Us, REDACTED_DELETE_ADDRESS_SKIP_REASON as Ut, displacedOpClause as V, requireConfigArray as Va, refuseMalformedOrphans as Vi, DBPROXY_TAG_OPTIONS as Vn, STATE_SOURCED_READBACK_RULES as Vo, coerceParameterTypedValue as Vr, runDockerForeground as Vs, getCurrentProducerRegions as Vt, getNestedRevertRun as W, prefetchCreateOnlyPropertyPaths as Wa, refuseMalformedOutputs as Wi, refuseMalformedDesiredTags as Wn, isSingleDynamicReferenceToken as Wo, getAccountInfo as Wr, escapeRegExp$3 as Ws, isRedactedRecordedValue as Wt, getCurrentNestedStackContext as X, sameLambdaFunctionAddress as Xa, refuseMalformedResourceEntriesForImport as Xi, ProviderRegistry as Xn, acceptedCreateOnlyDropsOf as Xo, AWS_NO_VALUE as Xr, getDefaultStateBucketName as Xs, journaledOrphanPrintingBag as Xt, withNestedRevertRun as Y, lambdaFunctionNameForMask as Ya, refuseMalformedResourceEntriesForDestroy as Yi, CC_BROKEN_REASON as Yn, splitImportedOps as Yo, keepsSecretReferenceToken as Yr, synthesisStatusMessage as Ys, completedReplayEntries as Yt, withNestedStackContext as Z, DagBuilder as Za, refuseMalformedResourceEntriesForImportSave as Zi, ccBrokenReason as Zn, describeRegionValueKind as Zo, cfnRefValueFromPhysicalId as Zr, getLegacyStateBucketName as Zs, maskEventTextWithBoundBags as Zt, makeCanonicalizePropertiesFn as _, findActionableSilentDrops as _a, PARTITION_TABLE as _c, malformedDriftResourcePropertiesWarning as _i, secretBearingStateKeyWarning as _n, createSecretMasker as _o, reEnableInstanceApiTermination as _r, BOOTSTRAP_MARKER_PREFIX as _s, beginDeleteWait as _t, findNestedTemplateTreeDefect as a, refuseMalformedResourcesForExport as aa, resolveUseCdkBootstrapAssets as ac, STATE_REGION_DIVERGED as ai, createPreDeleteFinalSnapshot as an, passedNoEchoParametersOf as ao, unchangedBehindSecretReference as ar, orphansAfterRollback as as, replayFailedOperations as at, noEchoComparisonForTemplate as b, withoutSilentDropProperties as ba, AssemblyReader as bc, malformedLocalOutputsWarning as bi, exportNameNoEchoParameters as bn, maskSecretsInText as bo, IntrinsicFunctionResolver as br, getBootstrapMarkerKey as bs, resolveDynamoDbDeleteBudgetClock as bt, renderNestedTemplateTreeDefect as c, repairMalformedOrphansForReadOnly as ca, ssmResolvedValueType as cc, UNREADABLE_RESOURCES_MAP_ROW as ci, refusesFinalSnapshot as cn, carryLogOnlyValues as co, deleteSkipReason as cr, AssetPublisher as cs, destroyStackRecordsView as ct, conditionInputsFrom as d, repairMalformedResourcePropertiesForReadOnly as da, MIGRATE_TMP_PREFIX as dc, displayLogicalId as di, DeploymentEventsStore as dn, literalSplitDelimitersOf as do, markWaitAbandoned as dr, WorkGraph as ds, PROTECTION_PROPERTY_BY_TYPE as dt, refuseMalformedResourcePropertiesForDrift as ea, resolveAutoAssetStorage as ec, parseWebACLArn as ei, stateSecretNameNeedles as en, maskReadbackAtCoordinates as eo, isCustomResourceType as er, hasReasonlessBaselineRefusal as es, isHandledOrphan as et, parentSuppliedValues as f, repairMalformedResourcesForReadOnly as fa, findLargeInlineResources as fc, hasReadableOrphans as fi, extractDeploymentEventError as fn, logOnlyValueCount as fo, disableInstanceApiTermination as fr, buildAssetRedirectMap as fs, isProtectionValueActive as ft, mergeNoChangeOutputs as g, withheldAccountClause as ga, expectedOwnerParam as gc, isReadableResourceEntry as gi, secretBearing as gn, shareLogOnlyValues as go, reDisableInstanceApiTermination as gr, AssetModeResolver as gs, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as gt, keptWholeReasonText as h, unreadableResourceEntries as ha, decodeListingKey as hc, isReadableOrphanRecord as hi, exportAliasCollisionScrubWarning as hn, recordLogOnlyValue as ho, observeThenDisableInstanceApiTermination as hr, rewriteTemplateAssetReferences as hs, DynamoDBGlobalTableProvider as ht, childTemplateLoader as i, refuseMalformedResourcesForDestroy as ia, resolveStateBucketWithDefaultAndSource as ic, JSON_LISTING_HOLE_VALUE as ii, ccRoutedFinalSnapshotError as in, noEchoOutputsComparison as io, slowCcOperationTimeoutMs as ir, isReadableBag as is, sameJournaledOrphans as it, green as j, isWarmThroughputDecrease as ja, renderAssemblyPathEscape as jc, malformedResourceEntriesWarning as ji, constructPathOf as jn, recoverMaskedOutput as jo, AWS_CREDENTIAL_ENV_KEYS as jr, describeDockerFailure as js, orphanDeleteNeedsIdentity as jt, cyan as k, WARM_THROUGHPUT_MEMBERS as ka, describeFileReadFailure as kc, malformedOutputsWarning as ki, DEFAULT_RESOURCE_WARN_AFTER_MS as kn, inheritNestedStackParameterAssociations as ko, isIamRoleArn as kr, describeDockerCapturedOutput as ks, isTruthyCfnBoolean as kt, templateIdentity as l, repairMalformedOutputsForReadOnly as la, CFN_TEMPLATE_BODY_LIMIT as lc, accountArgs as li, unsupportedFinalSnapshotError as ln, createUnionSecretMasker as lo, withIndeterminateGuard as lr, isSensitiveAttributeName as ls, getStackRecords as lt, isSecretBearingReferenceString as m, unreadableOrphanRecords as ma, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as mc, hasReadableResources as mi, displayTextOrWithheld as mn, recordLogOnlyParameterValue as mo, isTerminationProtectionPropagationError as mr, loadPublishableAssetManifest as ms, readProtection as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedResourcePropertiesForOrphan as na, resolveSkipPrefix as nc, parameterInputsFor as ni, PRE_DELETE_SNAPSHOT_TYPES as nn, maskedLeafCoordinatesOf as no, withPrintingSecrets as nr, importableOutputKeys as ns, loadJournaledOrphans as nt, isAbsoluteAssetPath as o, refuseMalformedState as oa, stateBucketExistenceConfirmed as oc, STATE_RESOURCES_MALFORMED as oi, effectiveDeletionPolicy as on, readsNoEchoSource as oo, UNSPECIFIED_SKIP_REASON as or, orphansCarriedFrom as os, replayRollback as ot, readRecordedConditionVerdicts as p, unpreviewableOrphanRecords as pa, uploadCfnTemplate as pc, hasReadableOutputs as pi, WITHHELD_NAME_DISPLAY as pn, printingCorpusOf as po, ec2InstanceProtectionSite as pr, createAssetRedirectResolver as ps, perType as pt, revertNestedChildFromJournal as q, withRetry as qa, refuseMalformedResourceEntries as qi, definedAttributes as qn, S3StateBackend as qo, carriesFetchableDynamicReference as qr, getDockerImageBySourceHash as qs, updatePartialMessage as qt, computeImplicitDeleteEdges as r, refuseMalformedResourcesForDeploy as ra, resolveStateBucketWithDefault as rc, passedParameterClassesOf as ri, buildFinalSnapshotIdentifier as rn, noEchoLeavesOf as ro, CloudControlProvider as rr, importableOutputs as rs, makeForeignHolderScan as rt, listNestedTemplateRows as s, repairMalformedOrphanRecordsForReadOnly as sa, warnDeprecatedNoPrefixCliFlag as sc, UNREADABLE_ORPHANS_CONTAINER_ROW as si, isFinalSnapshotError as sn, liveMatchesUnresolvedTokenFrame as so, deleteIndeterminateGuards as sr, shouldRetainResource as ss, awaitInFlightSibling as st, DeployEngine as t, refuseMalformedResourcePropertiesForExport as ta, resolveCaptureObservedState as tc, withSharedDrainBudget as ti, ATOMIC_FINAL_SNAPSHOT_TYPES as tn, maskWholeValue as to, getCurrentResourceSecrets as tr, hasUnverifiableParameterRefusal as ts, journaledOrphanLines as tt, conditionFingerprint as u, repairMalformedResourceEntriesForReadOnly as ua, CFN_TEMPLATE_URL_LIMIT as uc, deployRefusesOrphanRowsReason as ui, DeploymentEventsReader as un, hasMaskableValues as uo, isWaitAbandonedError as ur, stringifyValue as us, withStackRecords as ut, withResourceDeadline as v, findSilentDropProperties as va, canonicalizeRegion as vc, malformedExportNamesWarning as vi, secretSafeKeyDisplay as vn, errorCauseChain as vo, DiffCalculator as vr, assertAssetBucketRegion as vs, compensateRemovedDeletionProtection as vt, getPriorAttempts as w, shownType as wa, hasOwnKey as wc, malformedOrphanRecordsWarning as wi, collectDeclaredOutputNames as wn, DYNAMIC_REFERENCE_TOKEN_SCAN as wo, regionLessSecretName as wr, validateAssetBucketName as ws, deleteTableWithIndexBusyRetry as wt, noEchoParameterNamesOf as x, NO_CC_HANDLERS_REASON as xa, StageLoadError as xc, malformedLocalResourceEntriesWarning as xi, exportNameSecretExposure as xn, markSameGenerationBag as xo, poisonRenderedSpellingsCollidingIn as xr, isCrossRegionRedirect as xs, resolveDynamoDbDeleteBudgetMs as xt, noEchoAttributeNamesOf as y, unwrittenCreateOnlyReplacement as ya, derivePartitionAndUrlSuffix as yc, malformedExportSourceWarning as yi, carriedExportAliasExposure as yn, maskSecretsInError as yo, INTRINSIC_KEYS as yr, ensureAssetStorage as ys, deleteBudgetKey as yt, planOrphanAdoption as z, readConfigString as za, refuseMalformedOrphanRecords as zi, acquireIdempotencyToken as zn, STATE_SOURCED_BASELINE_RULES as zo, s3BucketRegionalDomainName as zr, redactDockerArgvValues as zs, resolveReplacementOldType as zt };
+//# sourceMappingURL=deploy-engine-C0tkSwvX.js.map