@go-to-k/cdkd 0.296.16 → 0.296.18

package/dist/{deploy-engine-DYAAwd0u.js → deploy-engine-DWbbP9w6.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js"
 import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
 import { $ as protectedReplacementAdvice, $n as isIamPropagationError, $t as AccountIdUnavailableError, A as isQuotableImportValue, An as commandHole, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bt as sanitizeRecoveryValue, Ct as RETRY_AUXILIARY_OWNER, Dn as SHELL_ACTIVE, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as plainOrDescribed, G as runDeleteAttempt, Gn as isNameCooldownError, H as observeThenDisableProtection, Hn as isUpdateUnsupportedError, Ht as DEFAULT_STATE_PREFIX, In as quotedOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jt as withPasteableAwsProfile, Kn as isRecreateRetryableError, Kt as producerRecordKey, L as ProtectionFlipRegistry, Ln as shellBoundedDisplay, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mn as isInertUnquoted, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as pasteableCommand, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE_WHY, Ot as hasCreatedBeforeFailure, Pn as physicalIdShownBesideCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, R as compensateProtectionFlip, Rn as shellQuote, Rt as formatLockOperation, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Un as hasReplayMayCollide, Ut as injectiveKey, Vt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Wn as isNameCollisionErrorFrom, Xn as formatRetryClassificationSignals, Xt as ambientCredentialConfig, Yn as markReplayMayCollide, Yt as ambientClientDefaults, Zn as isAmbiguousCcHandlerErrorCode, Zt as clientDefaultsFor, _n as ResourceUpdateNotSupportedError, _t as createMaskedLogSinks, ar as isThrottlingError, at as startInterruptWatch, bn as StateError, bt as maskDeep, cr as wrapMaskedAwsError, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as MacroExpansionError, en as AssetError, er as isRetryableTransientError, f as removalWarning, fn as MalformedProducerRecordRefusalError, ft as logicalIdShown, gn as ResourceTimeoutError, gt as stateOrphanRecordRemedy, hn as ProvisioningError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as DependencyError, ir as isMarkedNonRetryable, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, kn as UNSHOWABLE_VALUE, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, m as withoutInjectedRemovals, mt as resourceTypeShown, nr as retryClassificationText, on as DynamicReferenceRegionAmbiguousError, or as markNonRetryable, ot as ElapsedBudgetRegistry, qn as isReplayedNameCollisionFrom, rn as CrossAccountSecretRefusalError, sn as IntrinsicResolutionRefusalError, sr as markRedactedCause, st as monotonicNowMs, tn as CdkdError, tr as isTransientServerError, un as LockError, ut as compositeIdSeparatorRefusal, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as normalizeAwsError, wt as carryCreatedBeforeFailure, xn as SynthesisError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as withheldTargetClause, zt as formatLockOwner } from "./iam-policy-targets-BoZuWtxK.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-BUhQCsJ3.js";
+import { t as getCdkdVersion } from "./version-Cl-QXSua.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -10173,7 +10173,11 @@ const CREATE_ONLY_PATHS_SNAPSHOT = /* @__PURE__ */ new Map([
 	["AWS::AutoScaling::AutoScalingGroup", [["AutoScalingGroupName"], ["InstanceId"]]],
 	["AWS::BedrockAgentCore::Browser", []],
 	["AWS::BedrockAgentCore::CodeInterpreter", []],
-	["AWS::BedrockAgentCore::Evaluator", [["EvaluatorName"]]],
+	["AWS::BedrockAgentCore::Evaluator", [[
+		"EvaluatorConfig",
+		"Derived",
+		"BaseEvaluatorId"
+	], ["EvaluatorName"]]],
 	["AWS::BedrockAgentCore::Runtime", [["AgentRuntimeName"]]],
 	["AWS::Budgets::Budget", [["NotificationsWithSubscribers"]]],
 	["AWS::CertificateManager::Certificate", [
@@ -10451,7 +10455,8 @@ const CREATE_ONLY_PATHS_SNAPSHOT = /* @__PURE__ */ new Map([
 	["AWS::Glue::Table", [
 		["CatalogId"],
 		["DatabaseName"],
-		["Name"]
+		["Name"],
+		["TableInput", "Name"]
 	]],
 	["AWS::Glue::Trigger", [
 		["Name"],
@@ -12920,6 +12925,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"CreatedAt",
 			"EvaluatorArn",
 			"EvaluatorId",
+			"EvaluatorType",
+			"Provider",
 			"Status",
 			"UpdatedAt"
 		]),
@@ -14165,7 +14172,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
-		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		readOnly: /* @__PURE__ */ new Set(),
 		ccRouteUnavailable: true
 	}],
 	["AWS::Glue::Trigger", {
@@ -22909,7 +22916,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-D2eHqx5L.js");
+			const { ASGProvider } = await import("./asg-provider-B3568WgD.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -23015,7 +23022,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-Cbeq5OY8.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-X5T1Zamt.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-DArbEUG9.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-0RhO6C4E.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -24908,6 +24915,9 @@ const NESTED_REQUIRED = /* @__PURE__ */ new Map([
 	["AWS::BedrockAgentCore::Evaluator", /* @__PURE__ */ new Map([
 		["EvaluatorConfig.CodeBased", ["LambdaConfig"]],
 		["EvaluatorConfig.CodeBased.LambdaConfig", ["LambdaArn"]],
+		["EvaluatorConfig.Derived", ["BaseEvaluatorId", "ModelConfig"]],
+		["EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig", ["ModelId"]],
+		["EvaluatorConfig.Derived.ModelConfig.ResponsesEvaluatorModelConfig", ["ModelId"]],
 		["EvaluatorConfig.LlmAsAJudge", [
 			"Instructions",
 			"ModelConfig",
@@ -26332,7 +26342,7 @@ const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::AppSync::GraphQLApi", "{\"AdditionalAuthenticationProviders\":\"array\",\"AdditionalAuthenticationProviders[]\":\"object\",\"AdditionalAuthenticationProviders[].LambdaAuthorizerConfig\":\"object\",\"AdditionalAuthenticationProviders[].OpenIDConnectConfig\":\"object\",\"AdditionalAuthenticationProviders[].UserPoolConfig\":\"object\",\"EnhancedMetricsConfig\":\"object\",\"EnvironmentVariables\":\"object\",\"LambdaAuthorizerConfig\":\"object\",\"LogConfig\":\"object\",\"OpenIDConnectConfig\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"UserPoolConfig\":\"object\"}"],
 	["AWS::AppSync::Resolver", "{\"CachingConfig\":\"object\",\"CachingConfig.CachingKeys\":\"array\",\"PipelineConfig\":\"object\",\"PipelineConfig.Functions\":\"array\",\"Runtime\":\"object\",\"SyncConfig\":\"object\",\"SyncConfig.LambdaConflictHandlerConfig\":\"object\"}"],
 	["AWS::AutoScaling::AutoScalingGroup", "{\"AvailabilityZoneDistribution\":\"object\",\"AvailabilityZoneIds\":\"array\",\"AvailabilityZoneImpairmentPolicy\":\"object\",\"AvailabilityZones\":\"array\",\"CapacityReservationSpecification\":\"object\",\"CapacityReservationSpecification.CapacityReservationTarget\":\"object\",\"CapacityReservationSpecification.CapacityReservationTarget.CapacityReservationIds\":\"array\",\"CapacityReservationSpecification.CapacityReservationTarget.CapacityReservationResourceGroupArns\":\"array\",\"InstanceLifecyclePolicy\":\"object\",\"InstanceLifecyclePolicy.RetentionTriggers\":\"object\",\"InstanceMaintenancePolicy\":\"object\",\"LaunchTemplate\":\"object\",\"LifecycleHookSpecificationList\":\"array\",\"LifecycleHookSpecificationList[]\":\"object\",\"LoadBalancerNames\":\"array\",\"MetricsCollection\":\"array\",\"MetricsCollection[]\":\"object\",\"MetricsCollection[].Metrics\":\"array\",\"MixedInstancesPolicy\":\"object\",\"MixedInstancesPolicy.InstancesDistribution\":\"object\",\"MixedInstancesPolicy.InstancesDistribution.DistributionSegments\":\"array\",\"MixedInstancesPolicy.InstancesDistribution.DistributionSegments[]\":\"object\",\"MixedInstancesPolicy.InstancesDistribution.DistributionSegments[].TargetCapacityTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.LaunchTemplateSpecification\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[]\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorCount\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorManufacturers\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorNames\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorTotalMemoryMiB\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AllowedInstanceTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselineEbsBandwidthMbps\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors.Cpu\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors.Cpu.References\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors.Cpu.References[]\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.CpuManufacturers\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.ExcludedInstanceTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.InstanceGenerations\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.LocalStorageTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.MemoryGiBPerVCpu\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.MemoryMiB\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.NetworkBandwidthGbps\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.NetworkInterfaceCount\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.TotalLocalStorageGB\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.VCpuCount\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].LaunchTemplateSpecification\":\"object\",\"NotificationConfiguration\":\"object\",\"NotificationConfiguration.NotificationTypes\":\"array\",\"NotificationConfigurations\":\"array\",\"NotificationConfigurations[]\":\"object\",\"NotificationConfigurations[].NotificationTypes\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"TargetGroupARNs\":\"array\",\"TerminationPolicies\":\"array\",\"TrafficSources\":\"array\",\"TrafficSources[]\":\"object\",\"VPCZoneIdentifier\":\"array\"}"],
-	["AWS::BedrockAgentCore::Evaluator", "{\"EvaluatorConfig\":\"object\",\"EvaluatorConfig.CodeBased\":\"object\",\"EvaluatorConfig.CodeBased.LambdaConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.AdditionalModelRequestFields\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig.Reasoning\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical[]\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
+	["AWS::BedrockAgentCore::Evaluator", "{\"EvaluatorConfig\":\"object\",\"EvaluatorConfig.CodeBased\":\"object\",\"EvaluatorConfig.CodeBased.LambdaConfig\":\"object\",\"EvaluatorConfig.Derived\":\"object\",\"EvaluatorConfig.Derived.ModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.AdditionalModelRequestFields\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.ResponsesEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.ResponsesEvaluatorModelConfig.Reasoning\":\"object\",\"EvaluatorConfig.LlmAsAJudge\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.AdditionalModelRequestFields\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig.Reasoning\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical[]\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::BedrockAgentCore::Runtime", "{\"AgentRuntimeArtifact\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration.Code\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration.Code.S3\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration.EntryPoint\":\"array\",\"AgentRuntimeArtifact.ContainerConfiguration\":\"object\",\"AuthorizerConfiguration\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedAudience\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedClients\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedScopes\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.HostingEnvironments\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.HostingEnvironments[]\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.WorkloadIdentities\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[]\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[].AuthorizingClaimMatchValue\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[].AuthorizingClaimMatchValue.ClaimMatchValue\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[].AuthorizingClaimMatchValue.ClaimMatchValue.MatchValueStringList\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource.SecurityGroupIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource.SubnetIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource.Tags\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.SelfManagedLatticeResource\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[]\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource.SecurityGroupIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource.SubnetIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource.Tags\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.SelfManagedLatticeResource\":\"object\",\"CapacityProviderConfiguration\":\"object\",\"EnvironmentVariables\":\"object\",\"FilesystemConfigurations\":\"array\",\"FilesystemConfigurations[]\":\"object\",\"FilesystemConfigurations[].CapacityProviderVolume\":\"object\",\"FilesystemConfigurations[].EfsAccessPoint\":\"object\",\"FilesystemConfigurations[].S3FilesAccessPoint\":\"object\",\"FilesystemConfigurations[].SessionStorage\":\"object\",\"LifecycleConfiguration\":\"object\",\"NetworkConfiguration\":\"object\",\"NetworkConfiguration.NetworkModeConfig\":\"object\",\"NetworkConfiguration.NetworkModeConfig.SecurityGroups\":\"array\",\"NetworkConfiguration.NetworkModeConfig.Subnets\":\"array\",\"RequestHeaderConfiguration\":\"object\",\"RequestHeaderConfiguration.RequestHeaderAllowlist\":\"array\",\"Tags\":\"object\",\"WorkloadIdentityDetails\":\"object\"}"],
 	["AWS::CertificateManager::Certificate", "{\"DomainValidationOptions\":\"array\",\"DomainValidationOptions[]\":\"object\",\"SubjectAlternativeNames\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::CloudFormation::Stack", "{\"Capabilities\":\"array\",\"NotificationARNs\":\"array\",\"Outputs\":\"array\",\"Outputs[]\":\"object\",\"Parameters\":\"object\",\"StackPolicyBody\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
@@ -26378,6 +26388,7 @@ const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::Glue::Database", "{\"DatabaseInput\":\"object\",\"DatabaseInput.CreateTableDefaultPermissions\":\"array\",\"DatabaseInput.CreateTableDefaultPermissions[]\":\"object\",\"DatabaseInput.CreateTableDefaultPermissions[].Permissions\":\"array\",\"DatabaseInput.CreateTableDefaultPermissions[].Principal\":\"object\",\"DatabaseInput.FederatedDatabase\":\"object\",\"DatabaseInput.Parameters\":\"object\",\"DatabaseInput.TargetDatabase\":\"object\"}"],
 	["AWS::Glue::Job", "{\"Command\":\"object\",\"Connections\":\"object\",\"Connections.Connections\":\"array\",\"DefaultArguments\":\"object\",\"ExecutionProperty\":\"object\",\"NonOverridableArguments\":\"object\",\"NotificationProperty\":\"object\",\"Tags\":\"object\"}"],
 	["AWS::Glue::SecurityConfiguration", "{\"EncryptionConfiguration\":\"object\",\"EncryptionConfiguration.CloudWatchEncryption\":\"object\",\"EncryptionConfiguration.JobBookmarksEncryption\":\"object\",\"EncryptionConfiguration.S3Encryptions\":\"array\",\"EncryptionConfiguration.S3Encryptions[]\":\"object\"}"],
+	["AWS::Glue::Table", "{\"OpenTableFormatInput\":\"object\",\"OpenTableFormatInput.IcebergInput\":\"object\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput\":\"object\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput.PartitionSpec\":\"object\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput.PartitionSpec.Fields\":\"array\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput.PartitionSpec.Fields[]\":\"object\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput.Properties\":\"object\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput.Schema\":\"object\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput.Schema.Fields\":\"array\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput.Schema.Fields[]\":\"object\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput.Schema.IdentifierFieldIds\":\"array\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput.WriteOrder\":\"object\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput.WriteOrder.Fields\":\"array\",\"OpenTableFormatInput.IcebergInput.IcebergTableInput.WriteOrder.Fields[]\":\"object\",\"TableInput\":\"object\",\"TableInput.Parameters\":\"object\",\"TableInput.PartitionKeys\":\"array\",\"TableInput.PartitionKeys[]\":\"object\",\"TableInput.StorageDescriptor\":\"object\",\"TableInput.StorageDescriptor.BucketColumns\":\"array\",\"TableInput.StorageDescriptor.Columns\":\"array\",\"TableInput.StorageDescriptor.Columns[]\":\"object\",\"TableInput.StorageDescriptor.Parameters\":\"object\",\"TableInput.StorageDescriptor.SchemaReference\":\"object\",\"TableInput.StorageDescriptor.SchemaReference.SchemaId\":\"object\",\"TableInput.StorageDescriptor.SerdeInfo\":\"object\",\"TableInput.StorageDescriptor.SerdeInfo.Parameters\":\"object\",\"TableInput.StorageDescriptor.SkewedInfo\":\"object\",\"TableInput.StorageDescriptor.SkewedInfo.SkewedColumnNames\":\"array\",\"TableInput.StorageDescriptor.SkewedInfo.SkewedColumnValueLocationMaps\":\"object\",\"TableInput.StorageDescriptor.SkewedInfo.SkewedColumnValues\":\"array\",\"TableInput.StorageDescriptor.SortColumns\":\"array\",\"TableInput.StorageDescriptor.SortColumns[]\":\"object\",\"TableInput.TargetTable\":\"object\",\"TableInput.ViewDefinition\":\"object\",\"TableInput.ViewDefinition.Representations\":\"array\",\"TableInput.ViewDefinition.Representations[]\":\"object\",\"TableInput.ViewDefinition.SubObjects\":\"array\"}"],
 	["AWS::Glue::Trigger", "{\"Actions\":\"array\",\"Actions[]\":\"object\",\"Actions[].Arguments\":\"object\",\"Actions[].NotificationProperty\":\"object\",\"EventBatchingCondition\":\"object\",\"Predicate\":\"object\",\"Predicate.Conditions\":\"array\",\"Predicate.Conditions[]\":\"object\",\"Tags\":\"object\"}"],
 	["AWS::Glue::Workflow", "{\"DefaultRunProperties\":\"object\",\"Tags\":\"object\"}"],
 	["AWS::IAM::Group", "{\"ManagedPolicyArns\":\"array\",\"Policies\":\"array\",\"Policies[]\":\"object\"}"],
@@ -36127,6 +36138,7 @@ async function provisionCreate(logicalId, change, stateResources, stackName, tem
 		provisionedBy: createDecision.provisionedBy
 	};
 	this.recordInlinePolicyWrite(logicalId, "create");
+	await this.establishNoEchoEchoFidelity(logicalId, stateResources[logicalId], resolvedProps, stateResources, createSecrets);
 	const createCaptureSiblings = await this.buildObservedCaptureSiblings(resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
 	this.kickOffObservedCapture(createProvider, logicalId, result.physicalId, resourceType, resolvedProps, {
 		...createCaptureSiblings,
@@ -36234,6 +36246,509 @@ function recordedProtectionNote(evidence, flags) {
 	return `${evidence}. AWS refuses to delete the resource while that protection is on, and cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and cdkd state destroy act on one), so ${flags} alone does not remove the old resource: depending on the replacement order, the deploy either fails at that delete or completes leaving the old resource, and its data, in AWS and no longer tracked by cdkd. Read ${DELETION_PROTECTION_DOC_POINTER} before you disable anything, then turn the protection off out of band (the console, or the service's own API) and re-run with ${flags}.`;
 }
 
+//#endregion
+//#region src/deployment/deploy-engine/noecho.ts
+function noEchoExactEchoLeavesOf(record) {
+	const field = record?.noEchoExactEchoLeaves;
+	if (!Array.isArray(field)) return void 0;
+	const out = [];
+	for (const entry of field) {
+		if (!Array.isArray(entry) || entry.length === 0) return void 0;
+		if (!entry.every((segment) => typeof segment === "string")) return void 0;
+		out.push([...entry]);
+	}
+	return out;
+}
+function echoFidelityCandidates(coordinates, resolved, createOnly) {
+	const out = [];
+	for (const coordinate of coordinates) {
+		if (!coordinate.every((segment) => typeof segment === "string")) continue;
+		const keys = coordinate;
+		if (!createOnly.some((path) => path.length <= keys.length && path.every((s, i) => s === keys[i]))) continue;
+		const plaintext = valueAtCoordinate(resolved, keys);
+		if (typeof plaintext !== "string" || carriesSecretMask(plaintext)) continue;
+		out.push({
+			coordinate: keys,
+			plaintext
+		});
+	}
+	return out;
+}
+function reportedLeafAt(live, handed, candidate) {
+	if (valueAtCoordinate(handed, candidate.coordinate) !== "***") return void 0;
+	const leaf = valueAtCoordinate(live, candidate.coordinate);
+	return typeof leaf === "string" && !carriesSecretMask(leaf) ? leaf : void 0;
+}
+function echoesExactlyAt(live, handed, candidate) {
+	return reportedLeafAt(live, handed, candidate) === candidate.plaintext;
+}
+function provesEchoChangeAt(live, handed, candidate) {
+	const reported = reportedLeafAt(live, handed, candidate);
+	return reported !== void 0 && reported !== candidate.plaintext;
+}
+function noteNoEchoExactEchoes(logicalId, physicalId, read, handed, candidates, mode) {
+	const exact = "failure" in read ? [] : candidates.filter((candidate) => echoesExactlyAt(read.live, handed, candidate)).map((candidate) => [...candidate.coordinate]);
+	const noted = this.noEchoExactEchoes.get(logicalId);
+	const previous = mode === "add" && noted?.physicalId === physicalId ? noted.coordinates : [];
+	this.noEchoExactEchoes.set(logicalId, {
+		physicalId,
+		coordinates: sortedCoordinates([...previous, ...exact])
+	});
+}
+function sortedCoordinates(coordinates) {
+	const keyed = /* @__PURE__ */ new Map();
+	for (const coordinate of coordinates) keyed.set(JSON.stringify(coordinate), [...coordinate]);
+	return [...keyed.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([, c]) => c);
+}
+async function establishNoEchoEchoFidelity(logicalId, record, resolvedProps, stateResources, secrets) {
+	this.noEchoExactEchoes.delete(logicalId);
+	const templateProps = this.perResourceTemplateProps.get(logicalId);
+	const sources = this.noEchoPositionSources(stateResources);
+	if (templateProps === void 0 || sources === void 0 || sources.parameters.size === 0) return;
+	const coordinates = canonicalCoordinates(noEchoCoordinatesOf(templateProps, resolvedProps, {
+		parameters: sources.parameters,
+		...sources.conditions !== void 0 && { conditions: sources.conditions }
+	}));
+	if (coordinates.length === 0) return;
+	const candidates = echoFidelityCandidates(coordinates, resolvedProps, await getCreateOnlyPropertyPaths(record.resourceType).catch(() => []));
+	if (candidates.length === 0) return;
+	const handed = {
+		...record,
+		properties: maskAtCoordinates(record.properties, coordinates)
+	};
+	const read = await this.readReaderForFreshNoEchoCeiling(logicalId, handed, secrets);
+	this.noteNoEchoExactEchoes(logicalId, record.physicalId, read, handed.properties, candidates, "set");
+}
+function withNoEchoExactEchoes(logicalId, record) {
+	const noted = this.noEchoExactEchoes.get(logicalId);
+	if (noted === void 0 || noted.coordinates.length === 0) return record;
+	if (noted.physicalId !== record.physicalId) return record;
+	const merged = sortedCoordinates([...noEchoExactEchoLeavesOf(record) ?? [], ...noted.coordinates]);
+	return {
+		...record,
+		noEchoExactEchoLeaves: merged
+	};
+}
+function noEchoParameterNamesOf(template) {
+	const names = /* @__PURE__ */ new Set();
+	const declared = template?.Parameters;
+	if (declared === null || typeof declared !== "object") return names;
+	for (const [name, definition] of Object.entries(declared)) {
+		const noEcho = definition?.NoEcho;
+		if (noEcho === true || noEcho === "true") names.add(name);
+	}
+	return names;
+}
+function noEchoAttributeNamesOf(record) {
+	const field = record?.noEchoAttributeNames;
+	if (!Array.isArray(field) || !field.every((name) => typeof name === "string")) return void 0;
+	return field;
+}
+function noEchoPositionSources(resources = {}, template = this.constructPathTemplate, conditions = this.noEchoConditions) {
+	if (template === void 0) return void 0;
+	const declared = this.noEchoAttributeResources;
+	return {
+		parameters: /* @__PURE__ */ new Set([...noEchoParameterNamesOf(template), ...this.inheritedNoEchoParameters]),
+		attributeIsNoEcho: (logicalId, attribute) => {
+			const live = declared.get(logicalId);
+			if (live === true || live !== void 0 && live.has(attribute)) return true;
+			if (noEchoAttributeNamesOf(Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0)?.includes(attribute) === true) return true;
+			return this.persistedNoEchoAttributes.get(logicalId)?.has(attribute) === true;
+		},
+		...conditions !== void 0 && { conditions }
+	};
+}
+function noEchoLeavesFor(logicalId, record, templateProps, sources) {
+	if (templateProps !== void 0 && isWrittenFromDeployedTemplate(record.properties)) return canonicalCoordinates(noEchoCoordinatesOf(templateProps, record.properties, sources));
+	const existing = noEchoLeavesOf(record);
+	if (existing !== void 0) return canonicalCoordinates(existing);
+	const resolvedAsSame = this.perResourceResolvedType.get(logicalId) === record.resourceType;
+	const source = (templateProps !== void 0 && resolvedAsSame ? templateProps : void 0) ?? templatePropertiesFor(this, logicalId, record.resourceType);
+	if (source === void 0) return void 0;
+	return canonicalCoordinates(noEchoCoordinatesOf(source, record.properties, sources));
+}
+function templatePropertiesFor(engine, logicalId, resourceType) {
+	const resources = engine.constructPathTemplate?.Resources;
+	if (resources === void 0 || !Object.hasOwn(resources, logicalId)) return void 0;
+	const definition = resources[logicalId];
+	if (definition?.Type !== resourceType) return void 0;
+	const properties = definition.Properties;
+	return properties !== null && typeof properties === "object" && !Array.isArray(properties) ? properties : void 0;
+}
+function noEchoAttributeNamesFor(engine, logicalId, record, carried, leaves) {
+	const attributes = record.attributes ?? {};
+	const names = /* @__PURE__ */ new Set();
+	let echoed = false;
+	for (const coordinate of leaves ?? []) {
+		const value = valueAtCoordinate(record.properties, coordinate);
+		if (value === void 0 || carriesSecretMask(value)) continue;
+		for (const [name, attribute] of Object.entries(attributes)) {
+			if (carriesSecretMask(attribute)) continue;
+			if (typeof attribute === "string" && attribute === record.physicalId) continue;
+			const sameName = coordinate[0] === name && keyOrderFreeJson(attribute) === keyOrderFreeJson(value);
+			const embeds = typeof value === "string" && typeof attribute === "string" && !attribute.startsWith("arn:") && value.length >= 4 && typeof attribute === "string" && attribute.includes(value);
+			if (sameName || embeds) {
+				names.add(name);
+				echoed = true;
+			}
+		}
+	}
+	const declared = carried ? void 0 : engine.noEchoAttributeResources.get(logicalId);
+	if (declared === true) for (const name of Object.keys(attributes)) names.add(name);
+	else if (declared !== void 0) {
+		for (const name of declared) if (Object.hasOwn(attributes, name)) names.add(name);
+	}
+	const prior = noEchoAttributeNamesOf(record);
+	for (const name of prior ?? []) if (Object.hasOwn(attributes, name) && carriesSecretMask(attributes[name])) names.add(name);
+	if (declared === void 0 && prior === void 0 && !echoed) return void 0;
+	return [...names].sort();
+}
+function applyNoEchoPersist(logicalId, record, scrubbed, templateProps, resources, secrets, carried = false) {
+	const sources = this.noEchoPositionSources(resources);
+	if (sources === void 0) return scrubbed;
+	const leaves = this.noEchoLeavesFor(logicalId, record, templateProps, sources);
+	const names = noEchoAttributeNamesFor(this, logicalId, record, carried, leaves);
+	if (leaves === void 0 && names === void 0) return scrubbed;
+	const next = { ...scrubbed };
+	if (leaves !== void 0) {
+		next.properties = maskAtCoordinates(scrubbed.properties, leaves);
+		if (scrubbed.observedProperties !== void 0 && leaves.length > 0) Object.assign(next, { observedProperties: maskReadbackAtCoordinates(scrubbed.observedProperties, record.properties, leaves) });
+		if (leaves.length > 0) next.noEchoLeaves = leaves;
+		else delete next.noEchoLeaves;
+		const marked = new Set(leaves.map((coordinate) => JSON.stringify(coordinate)));
+		const exact = (noEchoExactEchoLeavesOf(scrubbed) ?? []).filter((coordinate) => marked.has(JSON.stringify(coordinate)));
+		if (exact.length > 0) next.noEchoExactEchoLeaves = exact;
+		else delete next.noEchoExactEchoLeaves;
+	}
+	if (names !== void 0) {
+		if (scrubbed.attributes !== void 0 && names.length > 0) {
+			const attributes = { ...scrubbed.attributes };
+			for (const name of names) if (Object.hasOwn(attributes, name)) attributes[name] = maskWholeValue(attributes[name]);
+			next.attributes = attributes;
+		}
+		if (names.length > 0) next.noEchoAttributeNames = names;
+		else delete next.noEchoAttributeNames;
+	}
+	this.warnNoEchoPhysicalId(logicalId, record, secrets);
+	return next;
+}
+function warnNoEchoPhysicalId(logicalId, record, secrets) {
+	if (secrets === void 0 || this.noEchoPhysicalIdWarned.has(logicalId)) return;
+	const values = noEchoParameterPlaintextsOf(secrets);
+	if (values.length === 0 || typeof record.physicalId !== "string") return;
+	if (!values.some((value) => record.physicalId.includes(value))) return;
+	this.noEchoPhysicalIdWarned.add(logicalId);
+	this.logger.warn(this.maskForResource(logicalId, safeMsg`${logicalId}: its physical id contains a NoEcho parameter value. AWS publishes a resource's name, so cdkd keeps the physical id in state as AWS returns it.`));
+}
+function seedPersistedNoEchoAttributes(resources) {
+	this.persistedNoEchoAttributes = /* @__PURE__ */ new Map();
+	for (const [logicalId, record] of Object.entries(resources)) {
+		const names = noEchoAttributeNamesOf(record);
+		if (names !== void 0 && names.length > 0) this.persistedNoEchoAttributes.set(logicalId, new Set(names));
+	}
+}
+function maskOutputsByPosition(outputs) {
+	const sources = this.noEchoPositionSources();
+	if (sources === void 0) return outputs;
+	const templateValues = Object.create(null);
+	for (const [name, definition] of Object.entries(this.constructPathTemplate?.Outputs ?? {})) templateValues[name] = definition?.Value;
+	if (this.outputsSourceUsable) for (const [name, value] of Object.entries(this.outputsTemplateSource)) templateValues[name] = value;
+	const coordinates = noEchoCoordinatesOf(templateValues, outputs, sources);
+	if (coordinates.length === 0) return outputs;
+	const maskedValues = new Set(coordinates.filter((coordinate) => coordinate.length === 1 && typeof coordinate[0] === "string").map((coordinate) => keyOrderFreeJson(outputs[coordinate[0]])));
+	const aliasCoordinates = Object.keys(outputs).filter((key) => !Object.hasOwn(templateValues, key) && outputs[key] !== void 0 && !carriesSecretMask(outputs[key]) && maskedValues.has(keyOrderFreeJson(outputs[key]))).map((key) => [key]);
+	return maskAtCoordinates(outputs, [...coordinates, ...aliasCoordinates]);
+}
+function getAttTargetsOf(node) {
+	const targets = [];
+	const seen = /* @__PURE__ */ new Set();
+	const subVariable = /\$\{([^}!][^}]*)\}/g;
+	const walk = (value) => {
+		if (value === null || typeof value !== "object" || seen.has(value)) return;
+		seen.add(value);
+		if (Array.isArray(value)) {
+			for (const item of value) walk(item);
+			return;
+		}
+		const record = value;
+		const getAtt = record["Fn::GetAtt"];
+		if (typeof getAtt === "string" && getAtt.indexOf(".") > 0) {
+			const dot = getAtt.indexOf(".");
+			targets.push([getAtt.slice(0, dot), getAtt.slice(dot + 1)]);
+		} else if (Array.isArray(getAtt) && typeof getAtt[0] === "string" && typeof getAtt[1] === "string") targets.push([getAtt[0], getAtt[1]]);
+		const sub = record["Fn::Sub"];
+		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
+		if (typeof text === "string") for (const match of text.matchAll(subVariable)) {
+			const name = match[1].trim();
+			const dot = name.indexOf(".");
+			if (dot > 0) targets.push([name.slice(0, dot), name.slice(dot + 1)]);
+		}
+		for (const child of Object.values(record)) walk(child);
+	};
+	walk(node);
+	return targets;
+}
+async function noEchoAttributeOverridesFor(desiredProps, stateResources, stackName) {
+	const wanted = /* @__PURE__ */ new Map();
+	for (const [logicalId, attribute] of getAttTargetsOf(desiredProps)) {
+		const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
+		if (record === void 0) continue;
+		if (noEchoAttributeNamesOf(record)?.includes(attribute) !== true) continue;
+		if (!carriesSecretMask(record.attributes?.[attribute])) continue;
+		if (!this.perResourceSecrets.has(logicalId)) continue;
+		const set = wanted.get(logicalId) ?? /* @__PURE__ */ new Set();
+		set.add(attribute);
+		wanted.set(logicalId, set);
+	}
+	if (wanted.size === 0) return void 0;
+	const overrides = /* @__PURE__ */ new Map();
+	for (const [logicalId, attributes] of wanted) {
+		const record = stateResources[logicalId];
+		let read = this.noEchoAttributeReads.get(logicalId);
+		if (read === void 0) {
+			read = (async () => {
+				try {
+					const { provider } = this.providerRegistry.getProviderFor({
+						resourceType: record.resourceType,
+						properties: record.properties,
+						provisionedBy: record.provisionedBy,
+						previousProperties: record.properties
+					});
+					const outcome = await readRecordAttributes({
+						provider,
+						logicalId,
+						resource: record,
+						stackName,
+						region: this.stackRegion
+					});
+					return outcome.kind === "read" ? outcome.attributes : void 0;
+				} catch {
+					return;
+				}
+			})();
+			this.noEchoAttributeReads.set(logicalId, read);
+		}
+		const live = await read;
+		if (live === void 0) continue;
+		const secrets = this.perResourceSecrets.get(logicalId);
+		const fresh = noEchoParameterPlaintextsOf(secrets);
+		const positioned = this.noEchoPositionedValues.get(logicalId) ?? /* @__PURE__ */ new Set();
+		const served = {};
+		for (const attribute of attributes) {
+			if (!Object.hasOwn(live, attribute)) continue;
+			const value = live[attribute];
+			if (typeof value === "string" && fresh.some((needle) => value === needle || value.includes(needle)) || value !== void 0 && positioned.has(keyOrderFreeJson(value))) served[attribute] = value;
+		}
+		if (Object.keys(served).length > 0) overrides.set(logicalId, served);
+	}
+	return overrides.size > 0 ? overrides : void 0;
+}
+function noEchoDiffComparison(resources, template, conditions, parameterValues, stackName) {
+	const sources = this.noEchoPositionSources(resources, template, conditions);
+	if (sources === void 0) return void 0;
+	const compare = noEchoComparison({
+		sources,
+		values: parameterValues,
+		minNeedleLength: 4,
+		publicTokens: /* @__PURE__ */ new Set([this.stackRegion, ...stackName === void 0 ? [] : [stackName]])
+	});
+	return (input) => compare(input);
+}
+function freshNoEchoParametersWithDeclared(inherited, template) {
+	const all = /* @__PURE__ */ new Set([...inherited ?? [], ...noEchoParameterNamesOf(template)]);
+	return all.size > 0 ? all : void 0;
+}
+function noEchoComparisonForTemplate(template, knownConditions, values, resources, publicTokens, inheritedNoEchoParameters) {
+	const sources = {
+		parameters: /* @__PURE__ */ new Set([...noEchoParameterNamesOf(template), ...inheritedNoEchoParameters ?? []]),
+		attributeIsNoEcho: (logicalId, attribute) => noEchoAttributeNamesOf(Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0)?.includes(attribute) === true,
+		...knownConditions !== void 0 && { conditions: knownConditions }
+	};
+	const compare = noEchoComparison({
+		sources,
+		values: values ?? {},
+		minNeedleLength: 4,
+		...publicTokens !== void 0 && { publicTokens }
+	});
+	return (input) => compare(input);
+}
+
+//#endregion
+//#region src/deployment/resource-deadline.ts
+var InvalidResourceDeadlineError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "InvalidResourceDeadlineError";
+	}
+};
+function validateOptions(opts) {
+	const { warnAfterMs, timeoutMs } = opts;
+	if (!Number.isFinite(warnAfterMs) || !Number.isFinite(timeoutMs) || warnAfterMs <= 0 || timeoutMs <= 0) throw new InvalidResourceDeadlineError(`withResourceDeadline: warnAfterMs and timeoutMs must be positive finite numbers (got warnAfterMs=${warnAfterMs}, timeoutMs=${timeoutMs})`);
+	if (warnAfterMs >= timeoutMs) throw new InvalidResourceDeadlineError(`withResourceDeadline: warnAfterMs (${warnAfterMs}ms) must be less than timeoutMs (${timeoutMs}ms)`);
+}
+async function withResourceDeadline(operation, opts) {
+	validateOptions(opts);
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		let timedOut = false;
+		let warned = false;
+		let warnTimer;
+		let timeoutTimer;
+		let elapsedBeforePause = 0;
+		let runningSince = Date.now();
+		let pauses = 0;
+		const elapsed = () => elapsedBeforePause + (pauses > 0 ? 0 : Date.now() - runningSince);
+		const cleanup = () => {
+			if (warnTimer !== void 0) clearTimeout(warnTimer);
+			if (timeoutTimer !== void 0) clearTimeout(timeoutTimer);
+			warnTimer = void 0;
+			timeoutTimer = void 0;
+		};
+		const arm = () => {
+			if (opts.onWarn && !warned) warnTimer = setTimeout(() => {
+				if (settled) return;
+				warned = true;
+				try {
+					opts.onWarn(elapsed());
+				} catch {}
+			}, Math.max(0, opts.warnAfterMs - elapsed()));
+			timeoutTimer = setTimeout(() => {
+				if (settled) return;
+				settled = true;
+				timedOut = true;
+				cleanup();
+				reject(opts.onTimeout(elapsed()));
+			}, Math.max(0, opts.timeoutMs - elapsed()));
+		};
+		arm();
+		const outer = deadlineScope.getStore();
+		const control = {
+			pause: () => {
+				pauses += 1;
+				if (pauses === 1) {
+					elapsedBeforePause += Date.now() - runningSince;
+					cleanup();
+				}
+				outer?.pause();
+			},
+			resume: () => {
+				if (pauses === 0) return;
+				pauses -= 1;
+				if (pauses === 0) {
+					runningSince = Date.now();
+					if (!settled) arm();
+				}
+				outer?.resume();
+			},
+			expired: () => timedOut || (outer?.expired() ?? false)
+		};
+		Promise.resolve().then(() => deadlineScope.run(control, operation)).then((value) => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			resolve(value);
+		}, (err) => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			reject(err);
+		});
+	});
+}
+const deadlineScope = new AsyncLocalStorage();
+async function whileEnclosingDeadlinesPaused(fn) {
+	const control = deadlineScope.getStore();
+	if (control === void 0) return fn();
+	control.pause();
+	try {
+		return await fn();
+	} finally {
+		control.resume();
+	}
+}
+function enclosingDeadlineExpired() {
+	return deadlineScope.getStore()?.expired() ?? false;
+}
+
+//#endregion
+//#region src/deployment/deployment-approval.ts
+const NESTED_STACK_TYPE$1 = "AWS::CloudFormation::Stack";
+async function requireDeploymentApproval(args) {
+	const level = args.options.requireApproval ?? "never";
+	const approve = args.options.approveDeployment;
+	if (level === "never" || approve === void 0) return;
+	const changes = [...args.changes].filter((c) => c.changeType !== "NO_CHANGE" && !isNoEchoPromotionOnly(c));
+	const destructiveChanges = findDestructiveChanges(args.stackName, changes, args.records, args.template, new Set(args.recreateTargetIds ?? []));
+	const onlyNestedUpdates = changes.every((c) => c.changeType === "UPDATE" && c.resourceType === NESTED_STACK_TYPE$1);
+	if (!(level === "destructive" ? destructiveChanges.length > 0 : changes.length > 0 && !onlyNestedUpdates)) return;
+	const count = (type) => changes.filter((c) => c.changeType === type).length;
+	if (enclosingDeadlineExpired()) throw approvalAfterTimeout(args.stackName);
+	let approved;
+	try {
+		approved = await whileEnclosingDeadlinesPaused(() => approve({
+			stackName: args.stackName,
+			level,
+			counts: {
+				create: count("CREATE"),
+				update: count("UPDATE"),
+				delete: count("DELETE")
+			},
+			destructiveChanges
+		}));
+	} catch (error) {
+		throw error instanceof Error ? markNonRetryable(error) : error;
+	}
+	if (!approved) throw markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${args.stackName} was not approved (--require-approval=${level}). Nothing was changed.`, "DEPLOY_NOT_APPROVED"));
+}
+async function approveLateReplacement(args) {
+	const level = args.options.requireApproval ?? "never";
+	const approve = args.options.approveDeployment;
+	if (level === "never" || approve === void 0) return true;
+	if (enclosingDeadlineExpired()) return false;
+	try {
+		return await whileEnclosingDeadlinesPaused(() => approve({
+			stackName: args.stackName,
+			level,
+			counts: {
+				create: 0,
+				update: 1,
+				delete: 0
+			},
+			destructiveChanges: findDestructiveChanges(args.stackName, [args.change], args.records, args.template)
+		}));
+	} catch {
+		return false;
+	}
+}
+function approvalAfterTimeout(stackName) {
+	return markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${stackName} was not started: its parent's nested-stack row already timed out (--resource-timeout). Nothing was changed.`, "DEPLOY_APPROVAL_AFTER_TIMEOUT"));
+}
+async function requireOutputsOnlyApproval(args) {
+	const approve = args.options.approveDeployment;
+	if (args.options.requireApproval !== "any-change" || approve === void 0) return;
+	if (enclosingDeadlineExpired()) throw approvalAfterTimeout(args.stackName);
+	let approved;
+	try {
+		approved = await whileEnclosingDeadlinesPaused(() => approve({
+			stackName: args.stackName,
+			level: "any-change",
+			counts: {
+				create: 0,
+				update: 0,
+				delete: 0
+			},
+			destructiveChanges: [],
+			outputsOnly: true
+		}));
+	} catch (error) {
+		throw error instanceof Error ? markNonRetryable(error) : error;
+	}
+	if (!approved) throw markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${args.stackName} was not approved (--require-approval=any-change). Nothing was changed.`, "DEPLOY_NOT_APPROVED"));
+}
+function isNoEchoPromotionOnly(change) {
+	return change.changeType === "UPDATE" && (change.attributeChanges?.length ?? 0) === 0 && (change.propertyChanges?.length ?? 0) > 0 && change.propertyChanges.every((pc) => pc.noEchoPromoted === true);
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/update.ts
 function isWhollyMask(value) {
@@ -36341,7 +36856,8 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	const allowedForRecord = allowedSilentDrops ?? /* @__PURE__ */ new Set();
 	const createOnlyEvidence = acceptedCreateOnlyDropsOf(currentResource);
 	const recordedAsWritten = currentResource.provisionedBy === "cc-api" ? currentProps : withoutUnwrittenSilentDropProperties(resourceType, currentProps, desiredForSkipCheck, allowedForRecord, createOnlyEvidence);
-	const todayAsWritten = noEchoLeavesOf(currentResource) === void 0 ? redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), withoutNoEchoParameterEntries(updateSecrets), desiredProps) : void 0;
+	const unmarkedRecord = noEchoLeavesOf(currentResource) === void 0;
+	const todayAsWritten = unmarkedRecord ? redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), withoutNoEchoParameterEntries(updateSecrets), desiredProps) : void 0;
 	const witness = todayAsWritten === void 0 ? void 0 : witnessNormalize(recordedAsWritten, todayAsWritten, desiredForSkipCheckAsWritten);
 	const currentPropsAsWritten = witness === void 0 ? recordedAsWritten : witness.current;
 	const positionalLeavesAt = (coordinates, key) => coordinates.filter((coordinate) => coordinate[0] === key).flatMap((coordinate) => {
@@ -36410,6 +36926,51 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		renderer.removeTask(logicalId);
 		this.logger.info(safeMsg`${attrPrefix}${formatResourceLine("updated", logicalId, resourceType, "updated (metadata)")}`);
 	};
+	const schemaCreateOnly = pendingParameterLeaves.size === 0 && parameterCoordinates.length === 0 ? [] : await getCreateOnlyPropertyPaths(resourceType).catch(() => []);
+	const echoCandidates = echoFidelityCandidates(parameterCoordinates, resolvedProps, schemaCreateOnly);
+	const readbackRecord = unmarkedRecord && parameterCoordinates.length > 0 ? {
+		...currentResource,
+		properties: maskAtCoordinates(currentResource.properties, parameterCoordinates)
+	} : currentResource;
+	let readback;
+	const readOnce = () => readback ??= this.readReaderForFreshNoEchoCeiling(logicalId, readbackRecord, updateSecrets).then((read) => {
+		this.noteNoEchoExactEchoes(logicalId, currentResource.physicalId, read, readbackRecord.properties, echoCandidates, "add");
+		return read;
+	});
+	const exactEchoCoordinates = new Set((noEchoExactEchoLeavesOf(currentResource) ?? []).map((c) => JSON.stringify(c)));
+	const provenChangedAt = (key, read) => {
+		if (exactEchoCoordinates.size === 0 || read === void 0 || "failure" in read) return false;
+		return (pendingParameterLeaves.get(key) ?? []).some((leaf) => {
+			const full = [key, ...leaf.path];
+			if (!exactEchoCoordinates.has(JSON.stringify(full))) return false;
+			const [candidate] = echoFidelityCandidates([full], resolvedProps, schemaCreateOnly);
+			return candidate !== void 0 && provesEchoChangeAt(read.live, readbackRecord.properties, candidate);
+		});
+	};
+	let replacedAnyway = false;
+	let lateApproval;
+	const approveReplacementOf = (pc) => {
+		if (replacedAnyway) return Promise.resolve(true);
+		const { noEchoPromoted: _promoted, ...asReplacement } = pc;
+		lateApproval ??= approveLateReplacement({
+			options: this.options,
+			stackName,
+			change: {
+				...change,
+				changeType: "UPDATE",
+				propertyChanges: [{
+					...asReplacement,
+					requiresReplacement: true
+				}]
+			},
+			records: stateResources,
+			template
+		});
+		return lateApproval;
+	};
+	const lateReplacementDeclined = /* @__PURE__ */ new Set();
+	const differsWhy = (key) => lateReplacementDeclined.has(key) ? `differs; the replacement was not approved (--require-approval=${this.options.requireApproval ?? "never"})` : "differs; the provider is not known to report this property exactly, so the difference may be its normalization";
+	if (unmarkedRecord && !typeChanged && echoCandidates.length > 0 && hasAddressablePhysicalId(currentResource)) await readOnce();
 	if (!typeChanged && !suppliesFreshMaskOnlyValue && lostChild === void 0 && this.recreateDirectionFor(stackName, logicalId) === void 0 && recordMatchesDesired) {
 		if (change.attributeChanges && change.attributeChanges.length > 0) {
 			applyAttributeOnlyUpdate(change.attributeChanges);
@@ -36423,8 +36984,6 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	if (!(currentResource.resourceType === "AWS::CloudFormation::Stack" && currentResource.provisionedBy !== "cc-api") && !hasAddressablePhysicalId(currentResource)) throw markRefusedBeforeApplying(markNonRetryable(new CdkdError(unaddressableUpdateRefusalMessage(stackName, this.stackRegion, logicalId, oldResourceType, this.options.refusalRecovery), STATE_RESOURCES_MALFORMED)));
 	this.attemptedResolvedProps.set(logicalId, resolvedProps);
 	const noEchoHeldPaths = /* @__PURE__ */ new Set();
-	let readback;
-	const schemaCreateOnly = pendingParameterLeaves.size === 0 ? [] : await getCreateOnlyPropertyPaths(resourceType).catch(() => []);
 	const isSchemaCreateOnly = (key) => (pendingParameterLeaves.get(key) ?? []).some((leaf) => {
 		const full = [key, ...leaf.path.map(String)];
 		return schemaCreateOnly.some((path) => path.length <= full.length && path.every((segment, i) => segment === full[i]));
@@ -36454,8 +37013,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 					lowered.push(pc);
 					continue;
 				}
-				readback ??= this.readReaderForFreshNoEchoCeiling(logicalId, currentResource, updateSecrets);
-				const read = await readback;
+				const read = await readOnce();
 				let verdict;
 				if ("failure" in read) verdict = read.failure;
 				else if (!Object.prototype.hasOwnProperty.call(read.live, pc.path)) verdict = "not-readable";
@@ -36489,7 +37047,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 	const parameterHeldKeys = /* @__PURE__ */ new Set();
 	const parameterUnreadablePaths = [];
 	if (pendingParameterLeaves.size > 0 && !typeChanged) {
-		const read = parameterCreateOnlyPaths.size > 0 || recordMatchesDesired ? await (readback ??= this.readReaderForFreshNoEchoCeiling(logicalId, currentResource, updateSecrets)) : void 0;
+		const read = parameterCreateOnlyPaths.size > 0 || recordMatchesDesired ? await readOnce() : void 0;
 		const verdictAt = (key) => {
 			if (read === void 0) return "not-readable";
 			if ("failure" in read) return read.failure;
@@ -36497,13 +37055,15 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 			return liveHoldsFreshLeaves(read.live[key], pendingParameterLeaves.get(key) ?? []) ? "held" : "differs";
 		};
 		const lowered = [];
+		const movedAt = (path) => movedMasked.has(path) || keyOrderFreeJson(desiredForSkipCheckAsWritten[path]) !== keyOrderFreeJson(currentPropsAsWritten[path]);
+		replacedAnyway = this.recreateDirectionFor(stackName, logicalId) !== void 0 || lostWithParent !== void 0 || (change.propertyChanges ?? []).some((other) => other.requiresReplacement && (!parameterCreateOnlyPaths.has(other.path) || movedAt(other.path)));
 		for (const pc of change.propertyChanges ?? []) {
 			if (!parameterCreateOnlyPaths.has(pc.path)) {
 				lowered.push(pc);
 				continue;
 			}
-			if (movedMasked.has(pc.path) || keyOrderFreeJson(desiredForSkipCheckAsWritten[pc.path]) !== keyOrderFreeJson(currentPropsAsWritten[pc.path])) {
-				warnWitnessReplacement(pc.path);
+			if (movedAt(pc.path)) {
+				if (pc.requiresReplacement) warnWitnessReplacement(pc.path);
 				lowered.push(pc);
 				continue;
 			}
@@ -36512,9 +37072,18 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 			if (verdict === "held") {
 				parameterHeldKeys.add(pc.path);
 				this.logger.debug(safeMsg`${logicalId}.${pc.path} carries a NoEcho parameter value AWS already holds: not replaced.`);
+			} else if (verdict === "differs" && provenChangedAt(pc.path, read) && await approveReplacementOf(pc)) {
+				this.logger.warn(safeMsg`${logicalId}.${pc.path} is a create-only property fed by a NoEcho parameter, and AWS, which reports it exactly, holds a different value: ${logicalId} is replaced.`);
+				lowered.push({
+					...pc,
+					requiresReplacement: true
+				});
+				continue;
 			} else {
 				const staleOnly = staleCoordinates.some((coordinate) => coordinate[0] === pc.path);
-				this.logger.warn(staleOnly ? safeMsg`${logicalId}.${pc.path} is a create-only property whose recorded value is only the NoEcho mask, and cdkd cannot confirm AWS holds its current value (${verdict}). It is not replaced, so a change to that value is not applied: to apply one, deploy with --recreate-via-cc-api ${logicalId} or --recreate-via-sdk-provider ${logicalId}.` : safeMsg`${logicalId}.${pc.path} is a create-only property fed by a NoEcho parameter, and cdkd cannot confirm AWS holds its current value (${verdict}). It is not replaced, so a change to that value is not applied: to apply one, deploy with --recreate-via-cc-api ${logicalId} or --recreate-via-sdk-provider ${logicalId}.`);
+				if (verdict === "differs" && provenChangedAt(pc.path, read)) lateReplacementDeclined.add(pc.path);
+				const why = verdict === "differs" ? differsWhy(pc.path) : verdict;
+				this.logger.warn(staleOnly ? safeMsg`${logicalId}.${pc.path} is a create-only property whose recorded value is only the NoEcho mask, and cdkd cannot confirm AWS holds its current value (${why}). It is not replaced, so a change to that value is not applied: to apply one, deploy with --recreate-via-cc-api ${logicalId} or --recreate-via-sdk-provider ${logicalId}.` : safeMsg`${logicalId}.${pc.path} is a create-only property fed by a NoEcho parameter, and cdkd cannot confirm AWS holds its current value (${why}). It is not replaced, so a change to that value is not applied: to apply one, deploy with --recreate-via-cc-api ${logicalId} or --recreate-via-sdk-provider ${logicalId}.`);
 			}
 			parameterSettledPaths.add(pc.path);
 			lowered.push({
@@ -36872,6 +37441,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 		provisionedBy: replaceDecision.provisionedBy
 	};
 	this.recordInlinePolicyWrite(logicalId, "create");
+	await this.establishNoEchoEchoFidelity(logicalId, stateResources[logicalId], resolvedProps, stateResources, updateSecrets);
 	this.kickOffObservedCapture(replaceProvider, logicalId, createResult.physicalId, resourceType, resolvedProps, { afterOwnWrite: true }, updateSecrets);
 	if (counts) counts.updated++;
 	if (progress) progress.current++;
@@ -37103,6 +37673,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 		...result.noEchoAttributeNames && { noEchoAttributeNames: result.noEchoAttributeNames }
 	}, updateSecrets, resolvedProps);
 	const recordedProperties = this.propertiesToRecord(resolvedProps, result, resourceType, resultProvisionedBy);
+	if (result.wasReplaced) this.noEchoExactEchoes.delete(logicalId);
 	stateResources[logicalId] = {
 		physicalId: result.physicalId,
 		resourceType,
@@ -37110,6 +37681,7 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 		...acceptedCreateOnlyDropsField(recordedProperties, resourceType, resultProvisionedBy, dischargedByReplacement ? "new-resource" : "in-place", currentResource),
 		...carriedAttributes && { attributes: carriedAttributes },
 		...!result.wasReplaced && currentResource.noEchoAttributeNames !== void 0 && { noEchoAttributeNames: currentResource.noEchoAttributeNames },
+		...!result.wasReplaced && currentResource.noEchoExactEchoLeaves !== void 0 && { noEchoExactEchoLeaves: currentResource.noEchoExactEchoLeaves },
 		...dependencies && dependencies.length > 0 && { dependencies },
 		...this.extractTemplateAttributes(template, logicalId),
 		provisionedBy: resultProvisionedBy,
@@ -37287,103 +37859,6 @@ Drop the record with: ${dropCommand}`);
 	this.logger.info(`${deletePrefix}${formatResourceLine("deleted", logicalId, resourceType)}`);
 }
 
-//#endregion
-//#region src/deployment/resource-deadline.ts
-var InvalidResourceDeadlineError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "InvalidResourceDeadlineError";
-	}
-};
-function validateOptions(opts) {
-	const { warnAfterMs, timeoutMs } = opts;
-	if (!Number.isFinite(warnAfterMs) || !Number.isFinite(timeoutMs) || warnAfterMs <= 0 || timeoutMs <= 0) throw new InvalidResourceDeadlineError(`withResourceDeadline: warnAfterMs and timeoutMs must be positive finite numbers (got warnAfterMs=${warnAfterMs}, timeoutMs=${timeoutMs})`);
-	if (warnAfterMs >= timeoutMs) throw new InvalidResourceDeadlineError(`withResourceDeadline: warnAfterMs (${warnAfterMs}ms) must be less than timeoutMs (${timeoutMs}ms)`);
-}
-async function withResourceDeadline(operation, opts) {
-	validateOptions(opts);
-	return new Promise((resolve, reject) => {
-		let settled = false;
-		let timedOut = false;
-		let warned = false;
-		let warnTimer;
-		let timeoutTimer;
-		let elapsedBeforePause = 0;
-		let runningSince = Date.now();
-		let pauses = 0;
-		const elapsed = () => elapsedBeforePause + (pauses > 0 ? 0 : Date.now() - runningSince);
-		const cleanup = () => {
-			if (warnTimer !== void 0) clearTimeout(warnTimer);
-			if (timeoutTimer !== void 0) clearTimeout(timeoutTimer);
-			warnTimer = void 0;
-			timeoutTimer = void 0;
-		};
-		const arm = () => {
-			if (opts.onWarn && !warned) warnTimer = setTimeout(() => {
-				if (settled) return;
-				warned = true;
-				try {
-					opts.onWarn(elapsed());
-				} catch {}
-			}, Math.max(0, opts.warnAfterMs - elapsed()));
-			timeoutTimer = setTimeout(() => {
-				if (settled) return;
-				settled = true;
-				timedOut = true;
-				cleanup();
-				reject(opts.onTimeout(elapsed()));
-			}, Math.max(0, opts.timeoutMs - elapsed()));
-		};
-		arm();
-		const outer = deadlineScope.getStore();
-		const control = {
-			pause: () => {
-				pauses += 1;
-				if (pauses === 1) {
-					elapsedBeforePause += Date.now() - runningSince;
-					cleanup();
-				}
-				outer?.pause();
-			},
-			resume: () => {
-				if (pauses === 0) return;
-				pauses -= 1;
-				if (pauses === 0) {
-					runningSince = Date.now();
-					if (!settled) arm();
-				}
-				outer?.resume();
-			},
-			expired: () => timedOut || (outer?.expired() ?? false)
-		};
-		Promise.resolve().then(() => deadlineScope.run(control, operation)).then((value) => {
-			if (settled) return;
-			settled = true;
-			cleanup();
-			resolve(value);
-		}, (err) => {
-			if (settled) return;
-			settled = true;
-			cleanup();
-			reject(err);
-		});
-	});
-}
-const deadlineScope = new AsyncLocalStorage();
-async function whileEnclosingDeadlinesPaused(fn) {
-	const control = deadlineScope.getStore();
-	if (control === void 0) return fn();
-	control.pause();
-	try {
-		return await fn();
-	} finally {
-		control.resume();
-	}
-}
-function enclosingDeadlineExpired() {
-	return deadlineScope.getStore()?.expired() ?? false;
-}
-
 //#endregion
 //#region src/deployment/deploy-engine/provision.ts
 async function provisionResource(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
@@ -38135,248 +38610,6 @@ function journaledOrphanPolicy(policy) {
 	return policy === "Delete" || policy === "Retain" || policy === "Snapshot" || policy === "RetainExceptOnCreate" ? policy : "Retain";
 }
 
-//#endregion
-//#region src/deployment/deploy-engine/noecho.ts
-function noEchoParameterNamesOf(template) {
-	const names = /* @__PURE__ */ new Set();
-	const declared = template?.Parameters;
-	if (declared === null || typeof declared !== "object") return names;
-	for (const [name, definition] of Object.entries(declared)) {
-		const noEcho = definition?.NoEcho;
-		if (noEcho === true || noEcho === "true") names.add(name);
-	}
-	return names;
-}
-function noEchoAttributeNamesOf(record) {
-	const field = record?.noEchoAttributeNames;
-	if (!Array.isArray(field) || !field.every((name) => typeof name === "string")) return void 0;
-	return field;
-}
-function noEchoPositionSources(resources = {}, template = this.constructPathTemplate, conditions = this.noEchoConditions) {
-	if (template === void 0) return void 0;
-	const declared = this.noEchoAttributeResources;
-	return {
-		parameters: /* @__PURE__ */ new Set([...noEchoParameterNamesOf(template), ...this.inheritedNoEchoParameters]),
-		attributeIsNoEcho: (logicalId, attribute) => {
-			const live = declared.get(logicalId);
-			if (live === true || live !== void 0 && live.has(attribute)) return true;
-			if (noEchoAttributeNamesOf(Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0)?.includes(attribute) === true) return true;
-			return this.persistedNoEchoAttributes.get(logicalId)?.has(attribute) === true;
-		},
-		...conditions !== void 0 && { conditions }
-	};
-}
-function noEchoLeavesFor(logicalId, record, templateProps, sources) {
-	if (templateProps !== void 0 && isWrittenFromDeployedTemplate(record.properties)) return canonicalCoordinates(noEchoCoordinatesOf(templateProps, record.properties, sources));
-	const existing = noEchoLeavesOf(record);
-	if (existing !== void 0) return canonicalCoordinates(existing);
-	const resolvedAsSame = this.perResourceResolvedType.get(logicalId) === record.resourceType;
-	const source = (templateProps !== void 0 && resolvedAsSame ? templateProps : void 0) ?? templatePropertiesFor(this, logicalId, record.resourceType);
-	if (source === void 0) return void 0;
-	return canonicalCoordinates(noEchoCoordinatesOf(source, record.properties, sources));
-}
-function templatePropertiesFor(engine, logicalId, resourceType) {
-	const resources = engine.constructPathTemplate?.Resources;
-	if (resources === void 0 || !Object.hasOwn(resources, logicalId)) return void 0;
-	const definition = resources[logicalId];
-	if (definition?.Type !== resourceType) return void 0;
-	const properties = definition.Properties;
-	return properties !== null && typeof properties === "object" && !Array.isArray(properties) ? properties : void 0;
-}
-function noEchoAttributeNamesFor(engine, logicalId, record, carried, leaves) {
-	const attributes = record.attributes ?? {};
-	const names = /* @__PURE__ */ new Set();
-	let echoed = false;
-	for (const coordinate of leaves ?? []) {
-		const value = valueAtCoordinate(record.properties, coordinate);
-		if (value === void 0 || carriesSecretMask(value)) continue;
-		for (const [name, attribute] of Object.entries(attributes)) {
-			if (carriesSecretMask(attribute)) continue;
-			if (typeof attribute === "string" && attribute === record.physicalId) continue;
-			const sameName = coordinate[0] === name && keyOrderFreeJson(attribute) === keyOrderFreeJson(value);
-			const embeds = typeof value === "string" && typeof attribute === "string" && !attribute.startsWith("arn:") && value.length >= 4 && typeof attribute === "string" && attribute.includes(value);
-			if (sameName || embeds) {
-				names.add(name);
-				echoed = true;
-			}
-		}
-	}
-	const declared = carried ? void 0 : engine.noEchoAttributeResources.get(logicalId);
-	if (declared === true) for (const name of Object.keys(attributes)) names.add(name);
-	else if (declared !== void 0) {
-		for (const name of declared) if (Object.hasOwn(attributes, name)) names.add(name);
-	}
-	const prior = noEchoAttributeNamesOf(record);
-	for (const name of prior ?? []) if (Object.hasOwn(attributes, name) && carriesSecretMask(attributes[name])) names.add(name);
-	if (declared === void 0 && prior === void 0 && !echoed) return void 0;
-	return [...names].sort();
-}
-function applyNoEchoPersist(logicalId, record, scrubbed, templateProps, resources, secrets, carried = false) {
-	const sources = this.noEchoPositionSources(resources);
-	if (sources === void 0) return scrubbed;
-	const leaves = this.noEchoLeavesFor(logicalId, record, templateProps, sources);
-	const names = noEchoAttributeNamesFor(this, logicalId, record, carried, leaves);
-	if (leaves === void 0 && names === void 0) return scrubbed;
-	const next = { ...scrubbed };
-	if (leaves !== void 0) {
-		next.properties = maskAtCoordinates(scrubbed.properties, leaves);
-		if (scrubbed.observedProperties !== void 0 && leaves.length > 0) Object.assign(next, { observedProperties: maskReadbackAtCoordinates(scrubbed.observedProperties, record.properties, leaves) });
-		if (leaves.length > 0) next.noEchoLeaves = leaves;
-		else delete next.noEchoLeaves;
-	}
-	if (names !== void 0) {
-		if (scrubbed.attributes !== void 0 && names.length > 0) {
-			const attributes = { ...scrubbed.attributes };
-			for (const name of names) if (Object.hasOwn(attributes, name)) attributes[name] = maskWholeValue(attributes[name]);
-			next.attributes = attributes;
-		}
-		if (names.length > 0) next.noEchoAttributeNames = names;
-		else delete next.noEchoAttributeNames;
-	}
-	this.warnNoEchoPhysicalId(logicalId, record, secrets);
-	return next;
-}
-function warnNoEchoPhysicalId(logicalId, record, secrets) {
-	if (secrets === void 0 || this.noEchoPhysicalIdWarned.has(logicalId)) return;
-	const values = noEchoParameterPlaintextsOf(secrets);
-	if (values.length === 0 || typeof record.physicalId !== "string") return;
-	if (!values.some((value) => record.physicalId.includes(value))) return;
-	this.noEchoPhysicalIdWarned.add(logicalId);
-	this.logger.warn(this.maskForResource(logicalId, safeMsg`${logicalId}: its physical id contains a NoEcho parameter value. AWS publishes a resource's name, so cdkd keeps the physical id in state as AWS returns it.`));
-}
-function seedPersistedNoEchoAttributes(resources) {
-	this.persistedNoEchoAttributes = /* @__PURE__ */ new Map();
-	for (const [logicalId, record] of Object.entries(resources)) {
-		const names = noEchoAttributeNamesOf(record);
-		if (names !== void 0 && names.length > 0) this.persistedNoEchoAttributes.set(logicalId, new Set(names));
-	}
-}
-function maskOutputsByPosition(outputs) {
-	const sources = this.noEchoPositionSources();
-	if (sources === void 0) return outputs;
-	const templateValues = Object.create(null);
-	for (const [name, definition] of Object.entries(this.constructPathTemplate?.Outputs ?? {})) templateValues[name] = definition?.Value;
-	if (this.outputsSourceUsable) for (const [name, value] of Object.entries(this.outputsTemplateSource)) templateValues[name] = value;
-	const coordinates = noEchoCoordinatesOf(templateValues, outputs, sources);
-	if (coordinates.length === 0) return outputs;
-	const maskedValues = new Set(coordinates.filter((coordinate) => coordinate.length === 1 && typeof coordinate[0] === "string").map((coordinate) => keyOrderFreeJson(outputs[coordinate[0]])));
-	const aliasCoordinates = Object.keys(outputs).filter((key) => !Object.hasOwn(templateValues, key) && outputs[key] !== void 0 && !carriesSecretMask(outputs[key]) && maskedValues.has(keyOrderFreeJson(outputs[key]))).map((key) => [key]);
-	return maskAtCoordinates(outputs, [...coordinates, ...aliasCoordinates]);
-}
-function getAttTargetsOf(node) {
-	const targets = [];
-	const seen = /* @__PURE__ */ new Set();
-	const subVariable = /\$\{([^}!][^}]*)\}/g;
-	const walk = (value) => {
-		if (value === null || typeof value !== "object" || seen.has(value)) return;
-		seen.add(value);
-		if (Array.isArray(value)) {
-			for (const item of value) walk(item);
-			return;
-		}
-		const record = value;
-		const getAtt = record["Fn::GetAtt"];
-		if (typeof getAtt === "string" && getAtt.indexOf(".") > 0) {
-			const dot = getAtt.indexOf(".");
-			targets.push([getAtt.slice(0, dot), getAtt.slice(dot + 1)]);
-		} else if (Array.isArray(getAtt) && typeof getAtt[0] === "string" && typeof getAtt[1] === "string") targets.push([getAtt[0], getAtt[1]]);
-		const sub = record["Fn::Sub"];
-		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
-		if (typeof text === "string") for (const match of text.matchAll(subVariable)) {
-			const name = match[1].trim();
-			const dot = name.indexOf(".");
-			if (dot > 0) targets.push([name.slice(0, dot), name.slice(dot + 1)]);
-		}
-		for (const child of Object.values(record)) walk(child);
-	};
-	walk(node);
-	return targets;
-}
-async function noEchoAttributeOverridesFor(desiredProps, stateResources, stackName) {
-	const wanted = /* @__PURE__ */ new Map();
-	for (const [logicalId, attribute] of getAttTargetsOf(desiredProps)) {
-		const record = Object.hasOwn(stateResources, logicalId) ? stateResources[logicalId] : void 0;
-		if (record === void 0) continue;
-		if (noEchoAttributeNamesOf(record)?.includes(attribute) !== true) continue;
-		if (!carriesSecretMask(record.attributes?.[attribute])) continue;
-		if (!this.perResourceSecrets.has(logicalId)) continue;
-		const set = wanted.get(logicalId) ?? /* @__PURE__ */ new Set();
-		set.add(attribute);
-		wanted.set(logicalId, set);
-	}
-	if (wanted.size === 0) return void 0;
-	const overrides = /* @__PURE__ */ new Map();
-	for (const [logicalId, attributes] of wanted) {
-		const record = stateResources[logicalId];
-		let read = this.noEchoAttributeReads.get(logicalId);
-		if (read === void 0) {
-			read = (async () => {
-				try {
-					const { provider } = this.providerRegistry.getProviderFor({
-						resourceType: record.resourceType,
-						properties: record.properties,
-						provisionedBy: record.provisionedBy,
-						previousProperties: record.properties
-					});
-					const outcome = await readRecordAttributes({
-						provider,
-						logicalId,
-						resource: record,
-						stackName,
-						region: this.stackRegion
-					});
-					return outcome.kind === "read" ? outcome.attributes : void 0;
-				} catch {
-					return;
-				}
-			})();
-			this.noEchoAttributeReads.set(logicalId, read);
-		}
-		const live = await read;
-		if (live === void 0) continue;
-		const secrets = this.perResourceSecrets.get(logicalId);
-		const fresh = noEchoParameterPlaintextsOf(secrets);
-		const positioned = this.noEchoPositionedValues.get(logicalId) ?? /* @__PURE__ */ new Set();
-		const served = {};
-		for (const attribute of attributes) {
-			if (!Object.hasOwn(live, attribute)) continue;
-			const value = live[attribute];
-			if (typeof value === "string" && fresh.some((needle) => value === needle || value.includes(needle)) || value !== void 0 && positioned.has(keyOrderFreeJson(value))) served[attribute] = value;
-		}
-		if (Object.keys(served).length > 0) overrides.set(logicalId, served);
-	}
-	return overrides.size > 0 ? overrides : void 0;
-}
-function noEchoDiffComparison(resources, template, conditions, parameterValues, stackName) {
-	const sources = this.noEchoPositionSources(resources, template, conditions);
-	if (sources === void 0) return void 0;
-	const compare = noEchoComparison({
-		sources,
-		values: parameterValues,
-		minNeedleLength: 4,
-		publicTokens: /* @__PURE__ */ new Set([this.stackRegion, ...stackName === void 0 ? [] : [stackName]])
-	});
-	return (input) => compare(input);
-}
-function freshNoEchoParametersWithDeclared(inherited, template) {
-	const all = /* @__PURE__ */ new Set([...inherited ?? [], ...noEchoParameterNamesOf(template)]);
-	return all.size > 0 ? all : void 0;
-}
-function noEchoComparisonForTemplate(template, knownConditions, values, resources, publicTokens, inheritedNoEchoParameters) {
-	const sources = {
-		parameters: /* @__PURE__ */ new Set([...noEchoParameterNamesOf(template), ...inheritedNoEchoParameters ?? []]),
-		attributeIsNoEcho: (logicalId, attribute) => noEchoAttributeNamesOf(Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0)?.includes(attribute) === true,
-		...knownConditions !== void 0 && { conditions: knownConditions }
-	};
-	const compare = noEchoComparison({
-		sources,
-		values: values ?? {},
-		minNeedleLength: 4,
-		...publicTokens !== void 0 && { publicTokens }
-	});
-	return (input) => compare(input);
-}
-
 //#endregion
 //#region src/provisioning/canonicalize-properties.ts
 function makeCanonicalizePropertiesFn(registry) {
@@ -38489,65 +38722,6 @@ function refuseNoValueOutputs(outputs, conditions) {
 	throw markNonRetryable(/* @__PURE__ */ new Error(`Output ${offending.join(", ")} evaluates to AWS::NoValue, and CloudFormation rejects the template for it ("The Value field of every Outputs member must evaluate to a String") before creating anything. To publish an Output only sometimes, give it a Condition instead of selecting AWS::NoValue in its Value.`));
 }
 
-//#endregion
-//#region src/deployment/deployment-approval.ts
-const NESTED_STACK_TYPE$1 = "AWS::CloudFormation::Stack";
-async function requireDeploymentApproval(args) {
-	const level = args.options.requireApproval ?? "never";
-	const approve = args.options.approveDeployment;
-	if (level === "never" || approve === void 0) return;
-	const changes = [...args.changes].filter((c) => c.changeType !== "NO_CHANGE" && !isNoEchoPromotionOnly(c));
-	const destructiveChanges = findDestructiveChanges(args.stackName, changes, args.records, args.template, new Set(args.recreateTargetIds ?? []));
-	const onlyNestedUpdates = changes.every((c) => c.changeType === "UPDATE" && c.resourceType === NESTED_STACK_TYPE$1);
-	if (!(level === "destructive" ? destructiveChanges.length > 0 : changes.length > 0 && !onlyNestedUpdates)) return;
-	const count = (type) => changes.filter((c) => c.changeType === type).length;
-	if (enclosingDeadlineExpired()) throw approvalAfterTimeout(args.stackName);
-	let approved;
-	try {
-		approved = await whileEnclosingDeadlinesPaused(() => approve({
-			stackName: args.stackName,
-			level,
-			counts: {
-				create: count("CREATE"),
-				update: count("UPDATE"),
-				delete: count("DELETE")
-			},
-			destructiveChanges
-		}));
-	} catch (error) {
-		throw error instanceof Error ? markNonRetryable(error) : error;
-	}
-	if (!approved) throw markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${args.stackName} was not approved (--require-approval=${level}). Nothing was changed.`, "DEPLOY_NOT_APPROVED"));
-}
-function approvalAfterTimeout(stackName) {
-	return markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${stackName} was not started: its parent's nested-stack row already timed out (--resource-timeout). Nothing was changed.`, "DEPLOY_APPROVAL_AFTER_TIMEOUT"));
-}
-async function requireOutputsOnlyApproval(args) {
-	const approve = args.options.approveDeployment;
-	if (args.options.requireApproval !== "any-change" || approve === void 0) return;
-	if (enclosingDeadlineExpired()) throw approvalAfterTimeout(args.stackName);
-	let approved;
-	try {
-		approved = await whileEnclosingDeadlinesPaused(() => approve({
-			stackName: args.stackName,
-			level: "any-change",
-			counts: {
-				create: 0,
-				update: 0,
-				delete: 0
-			},
-			destructiveChanges: [],
-			outputsOnly: true
-		}));
-	} catch (error) {
-		throw error instanceof Error ? markNonRetryable(error) : error;
-	}
-	if (!approved) throw markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${args.stackName} was not approved (--require-approval=any-change). Nothing was changed.`, "DEPLOY_NOT_APPROVED"));
-}
-function isNoEchoPromotionOnly(change) {
-	return change.changeType === "UPDATE" && (change.attributeChanges?.length ?? 0) === 0 && (change.propertyChanges?.length ?? 0) > 0 && change.propertyChanges.every((pc) => pc.noEchoPromoted === true);
-}
-
 //#endregion
 //#region src/deployment/condition-verdicts.ts
 function conditionInputsFrom(args) {
@@ -39528,6 +39702,7 @@ var DeployEngine = class {
 	inheritedNoEchoParameters = /* @__PURE__ */ new Set();
 	noEchoPhysicalIdWarned = /* @__PURE__ */ new Set();
 	noEchoPositionedValues = /* @__PURE__ */ new Map();
+	noEchoExactEchoes = /* @__PURE__ */ new Map();
 	noEchoAttributeReads = /* @__PURE__ */ new Map();
 	replacedDeleteSkips = /* @__PURE__ */ new Map();
 	secretNameNeedles = /* @__PURE__ */ new Map();
@@ -39591,6 +39766,7 @@ var DeployEngine = class {
 		this.inheritedNoEchoParameters = /* @__PURE__ */ new Set();
 		this.noEchoPhysicalIdWarned = /* @__PURE__ */ new Set();
 		this.noEchoPositionedValues = /* @__PURE__ */ new Map();
+		this.noEchoExactEchoes = /* @__PURE__ */ new Map();
 		this.noEchoAttributeReads = /* @__PURE__ */ new Map();
 		this.replacedDeleteSkips = /* @__PURE__ */ new Map();
 		this.secretNameNeedles = /* @__PURE__ */ new Map();
@@ -39630,7 +39806,7 @@ var DeployEngine = class {
 			const secrets = this.perResourceSecrets.get(logicalId);
 			const templateProps = this.perResourceTemplateProps.get(logicalId);
 			const scrubbed = scrubResourceRecord(this.withHealedAttributes(logicalId, record), secrets ?? /* @__PURE__ */ new Map(), templateProps);
-			const noEchoScrubbed = this.applyNoEchoPersist(logicalId, record, scrubbed, templateProps, state.resources, secrets);
+			const noEchoScrubbed = this.applyNoEchoPersist(logicalId, record, this.withNoEchoExactEchoes(logicalId, scrubbed), templateProps, state.resources, secrets);
 			resources[logicalId] = withConstructPath(withMaskedPropertyFingerprints(noEchoScrubbed, record.properties, templateProps, secrets, this.fingerprintNoEchoValues, this.perResourceInputFingerprints.get(logicalId)), constructPathOf(this.constructPathTemplate, logicalId));
 		}
 		const orphans = state.orphans?.map((entry) => {
@@ -39818,6 +39994,9 @@ DeployEngine.prototype.warnNoEchoPhysicalId = warnNoEchoPhysicalId;
 DeployEngine.prototype.seedPersistedNoEchoAttributes = seedPersistedNoEchoAttributes;
 DeployEngine.prototype.noEchoAttributeOverridesFor = noEchoAttributeOverridesFor;
 DeployEngine.prototype.noEchoDiffComparison = noEchoDiffComparison;
+DeployEngine.prototype.noteNoEchoExactEchoes = noteNoEchoExactEchoes;
+DeployEngine.prototype.establishNoEchoEchoFidelity = establishNoEchoEchoFidelity;
+DeployEngine.prototype.withNoEchoExactEchoes = withNoEchoExactEchoes;
 DeployEngine.prototype.handleOutputResolutionFailure = handleOutputResolutionFailure;
 DeployEngine.prototype.resolveOutputs = resolveOutputs;
 DeployEngine.prototype.buildDisplayOutputs = buildDisplayOutputs;
@@ -39825,5 +40004,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { dropFailedHint as $, isMarkedCoordinate as $a, refuseMalformedResourcePropertiesForDestroy as $i, wouldReturnToSdkProvider as $n, hasReadableExportSet as $o, refStateLookupFromResource as $r, resolveApp as $s, secretNamePrintingBag as $t, gray as A, coerceWarmThroughput as Aa, displayAssemblyPath as Ac, malformedRenderedContainersWarning as Ai, maskingRetryLogger as An, recordNestedStackParameterExpressions as Ao, sendableAssumeRoleCommand as Ar, describeDockerExecFailure as As, removeProtectionTypeList as At, NESTED_PENDING_PARENT_REASON as B, replayWarn as Ba, refuseMalformedOrphanRecordsForDestroy as Bi, DBPROXY_TAGS_WHAT as Bn, STATE_SOURCED_CROSS_GENERATION_RULES as Bo, s3BucketWebsiteUrl as Br, redactedDockerCause as Bs, findNestedStackTypeChanges as Bt, recordedProtectionNote as C, findReplacedReadersOfRecreateTargets as Ca, defineOwnKey as Cc, malformedOrphanRecordsRefusalMessage as Ci, noEchoParameterValueSeed as Cn, scrubResourceRecord as Co, producerRegionsFromState as Cr, readBootstrapMarkerBody as Cs, INDEX_SETTLE_POLL_INTERVAL_MS as Ct, createReadOnlyAttributeHealerFactory as D, isStatefulRecreateTargetSync as Da, ownValue as Dc, malformedOrphansWarning as Di, bindingSkippedOutputs as Dn, pathCrossesDottedKey as Do, assertSendableRoleArn as Dr, buildDockerImage as Ds, S3_AUTO_DELETE_OBJECTS_TAG as Dt, formatResourceLine as E, isStatefulRecreateTargetForReplace as Ea, nullPrototypeRecord as Ec, malformedOrphansRefusalMessage as Ei, isExportAliasCollision as En, isUncertifiedBaselineMaskPosition as Eo, assertFlagRoleArn as Er, buildDenyExternalAccessPolicy as Es, ECR_AUTO_DELETE_IMAGES_TAG as Et, namesAnyDeclaredParameter as F, coerceCfnInteger as Fa, malformedStateRefusalMessage as Fi, earliestDefined as Fn, recordMaskOnlyValuesIn as Fo, isSettledInstanceState as Fr, getDockerCmd as Fs, isReplacementOrphan as Ft, nestedChildStackName as G, templateResourceTypes as Ga, refuseMalformedOutputsForDestroy as Gi, tagMapAsList as Gn, LockManager as Go, isImpossibleEmptyStoredAttribute as Gr, stripControlChars as Gs, redactedDeleteAddressFields as Gt, displacedPhysicalIdShown as H, requireConfigObject as Ha, refuseMalformedOrphansForDestroy as Hi, planTagDiff as Hn, TEMPLATE_SOURCED_RULES as Ho, isUnboundTemplateParameter as Hr, runDockerStreaming as Hs, inheritProducerRegions as Ht, reachableDivergentParameters as I, configBooleanRefusal as Ia, previewableOrphanRecords as Ii, ledgerForStack as In, recordNoEchoAttributeValues as Io, s3BucketArn as Ir, isDockerClientEnvKey as Is, planFailedOps as It, revertedNestedRowIds as J, canonicalLambdaFunctionName as Ja, refuseMalformedResourceEntriesForDeploy as Ji, stringifyIfAssigned as Jn, rebuildClientForBucketRegion as Jo, isNamelessDynamicReferenceError as Jr, Synthesizer as Js, updatePartialReason as Jt, recordDisplacedSkips as K, describeTypeWithThrottleRetry as Ka, refuseMalformedResourceAttributesForOrphan as Ki, tagPlanWarning as Kn, isLockInfoExpired as Ko, carriesDynamicReference as Kr, AssetManifestLoader as Ks, redactedDeleteAddressSkip as Kt, resourcesNamingDeclaredParameter as L, configIntegerRefusal as La, refuseDivergentRecordRegionForDestroy as Li, reserveStackCreateToken as Ln, recordProvenPublicExpression as Lo, s3BucketDomainName as Lr, isMalformedEnvKey as Ls, planRollback as Lt, red as M, toCfnInteger as Ma, resolveAssemblyPath as Mc, malformedResourcePropertiesWarning as Mi, findDestructiveChanges as Mn, carriesSecretMask as Mo, applyCallerIdentityCredentials as Mr, dockerSpawnEnvWithSensitive as Ms, recordAfterRollbackUpdate as Mt, yellow as N, toFiniteNumber as Na, clearBucketRegionCache as Nc, malformedResourcesWarning as Ni, formatDestructiveChange as Nn, provenPublicValue as No, callerEnvCredentials as Nr, finchSecretArgvRefusal as Ns, demoteSupersededOrphans as Nt, bold as O, renderStatefulReason as Oa, absoluteAssemblyPathEscape as Oc, malformedOutputsRefusalMessage as Oi, DEFAULT_RESOURCE_TIMEOUT_MS as On, identityKeyFor as Oo, explicitRoleArnOrThrow as Or, resolveDockerContextDirectory as Os, hasCdkAutoDeleteTag as Ot, computeParameterTaint as P, coerceCfnBoolean as Pa, resolveBucketRegion as Pc, malformedScrubResourceEntriesRefusalMessage as Pi, RollbackInlinePolicyWriters as Pn, recordMaskOnlyValue as Po, envCredentialsAreAssumedRole as Pr, formatDockerLoginError as Ps, isJournaledOrphan as Pt, deleteJournaledOrphans as Q, TemplateParser as Qa, refuseMalformedResourceEntriesForOrphan as Qi, isCustomResource as Qn, exportNamesCarriedFrom as Qo, isStalePlaceholderArnAttribute as Qr, loadCdkJson as Qs, orphanRecordsPrintingBag as Qt, makeSiblingClaimReader as R, configStringRefusal as Ra, refuseMalformedNestedChildOutputs as Ri, withCreateTokenLedger as Rn, wholeStringLeavesOf as Ro, s3BucketDualStackDomainName as Rr, partitionSensitiveEnv as Rs, replacementNeverSwapped as Rt, recordedProtectionEvidence as S, hasNoCloudControlHandlers as Sa, processStackMessages as Sc, malformedLocalResourcesWarning as Si, isWholeDynamicReferenceValue as Sn, redactSecretsForState as So, classifyReplaySecretRegion as Sr, parseBootstrapMarker as Ss, DELETE_INDEX_WAIT_PROCEED_NOTE as St, markRefusedBeforeApplying as T, MULTI_REGION_RECREATE_BLOCKED_TYPES as Ta, hasPlainPrototype$1 as Tc, malformedOrphanRowsKeptWarning as Ti, collectPublishedOutputNames as Tn, dynamicReferenceTokens as To, applyRoleArnIfSet as Tr, validateContainerRepoName as Ts, waitForIndexesSettled as Tt, dropSettledNestedJournals as U, requireConfigString as Ua, refuseMalformedOrphansForOrphan as Ui, readTagList as Un, WHOLE_DYNAMIC_REFERENCE_PATTERN as Uo, parameterTypeMayLoseSecretIdentity as Ur, warnFinchArgvExposure as Us, REDACTED_DELETE_ADDRESS_SKIP_REASON as Ut, displacedOpClause as V, requireConfigArray as Va, refuseMalformedOrphans as Vi, DBPROXY_TAG_OPTIONS as Vn, STATE_SOURCED_READBACK_RULES as Vo, coerceParameterTypedValue as Vr, runDockerForeground as Vs, getCurrentProducerRegions as Vt, getNestedRevertRun as W, prefetchCreateOnlyPropertyPaths as Wa, refuseMalformedOutputs as Wi, refuseMalformedDesiredTags as Wn, isSingleDynamicReferenceToken as Wo, getAccountInfo as Wr, escapeRegExp$3 as Ws, isRedactedRecordedValue as Wt, getCurrentNestedStackContext as X, sameLambdaFunctionAddress as Xa, refuseMalformedResourceEntriesForImport as Xi, ProviderRegistry as Xn, acceptedCreateOnlyDropsOf as Xo, AWS_NO_VALUE as Xr, getDefaultStateBucketName as Xs, journaledOrphanPrintingBag as Xt, withNestedRevertRun as Y, lambdaFunctionNameForMask as Ya, refuseMalformedResourceEntriesForDestroy as Yi, CC_BROKEN_REASON as Yn, splitImportedOps as Yo, keepsSecretReferenceToken as Yr, synthesisStatusMessage as Ys, completedReplayEntries as Yt, withNestedStackContext as Z, DagBuilder as Za, refuseMalformedResourceEntriesForImportSave as Zi, ccBrokenReason as Zn, describeRegionValueKind as Zo, cfnRefValueFromPhysicalId as Zr, getLegacyStateBucketName as Zs, maskEventTextWithBoundBags as Zt, makeCanonicalizePropertiesFn as _, findActionableSilentDrops as _a, PARTITION_TABLE as _c, malformedDriftResourcePropertiesWarning as _i, secretBearingStateKeyWarning as _n, createSecretMasker as _o, reEnableInstanceApiTermination as _r, BOOTSTRAP_MARKER_PREFIX as _s, beginDeleteWait as _t, findNestedTemplateTreeDefect as a, refuseMalformedResourcesForExport as aa, resolveUseCdkBootstrapAssets as ac, STATE_REGION_DIVERGED as ai, createPreDeleteFinalSnapshot as an, passedNoEchoParametersOf as ao, unchangedBehindSecretReference as ar, orphansAfterRollback as as, replayFailedOperations as at, noEchoParameterNamesOf as b, withoutSilentDropProperties as ba, AssemblyReader as bc, malformedLocalOutputsWarning as bi, exportNameNoEchoParameters as bn, maskSecretsInText as bo, IntrinsicFunctionResolver as br, getBootstrapMarkerKey as bs, resolveDynamoDbDeleteBudgetClock as bt, renderNestedTemplateTreeDefect as c, repairMalformedOrphansForReadOnly as ca, ssmResolvedValueType as cc, UNREADABLE_RESOURCES_MAP_ROW as ci, refusesFinalSnapshot as cn, carryLogOnlyValues as co, deleteSkipReason as cr, AssetPublisher as cs, destroyStackRecordsView as ct, conditionInputsFrom as d, repairMalformedResourcePropertiesForReadOnly as da, MIGRATE_TMP_PREFIX as dc, displayLogicalId as di, DeploymentEventsStore as dn, literalSplitDelimitersOf as do, markWaitAbandoned as dr, WorkGraph as ds, PROTECTION_PROPERTY_BY_TYPE as dt, refuseMalformedResourcePropertiesForDrift as ea, resolveAutoAssetStorage as ec, parseWebACLArn as ei, stateSecretNameNeedles as en, maskReadbackAtCoordinates as eo, isCustomResourceType as er, hasReasonlessBaselineRefusal as es, isHandledOrphan as et, parentSuppliedValues as f, repairMalformedResourcesForReadOnly as fa, findLargeInlineResources as fc, hasReadableOrphans as fi, extractDeploymentEventError as fn, logOnlyValueCount as fo, disableInstanceApiTermination as fr, buildAssetRedirectMap as fs, isProtectionValueActive as ft, mergeNoChangeOutputs as g, withheldAccountClause as ga, expectedOwnerParam as gc, isReadableResourceEntry as gi, secretBearing as gn, shareLogOnlyValues as go, reDisableInstanceApiTermination as gr, AssetModeResolver as gs, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as gt, keptWholeReasonText as h, unreadableResourceEntries as ha, decodeListingKey as hc, isReadableOrphanRecord as hi, exportAliasCollisionScrubWarning as hn, recordLogOnlyValue as ho, observeThenDisableInstanceApiTermination as hr, rewriteTemplateAssetReferences as hs, DynamoDBGlobalTableProvider as ht, childTemplateLoader as i, refuseMalformedResourcesForDestroy as ia, resolveStateBucketWithDefaultAndSource as ic, JSON_LISTING_HOLE_VALUE as ii, ccRoutedFinalSnapshotError as in, noEchoOutputsComparison as io, slowCcOperationTimeoutMs as ir, isReadableBag as is, sameJournaledOrphans as it, green as j, isWarmThroughputDecrease as ja, renderAssemblyPathEscape as jc, malformedResourceEntriesWarning as ji, constructPathOf as jn, recoverMaskedOutput as jo, AWS_CREDENTIAL_ENV_KEYS as jr, describeDockerFailure as js, orphanDeleteNeedsIdentity as jt, cyan as k, WARM_THROUGHPUT_MEMBERS as ka, describeFileReadFailure as kc, malformedOutputsWarning as ki, DEFAULT_RESOURCE_WARN_AFTER_MS as kn, inheritNestedStackParameterAssociations as ko, isIamRoleArn as kr, describeDockerCapturedOutput as ks, isTruthyCfnBoolean as kt, templateIdentity as l, repairMalformedOutputsForReadOnly as la, CFN_TEMPLATE_BODY_LIMIT as lc, accountArgs as li, unsupportedFinalSnapshotError as ln, createUnionSecretMasker as lo, withIndeterminateGuard as lr, isSensitiveAttributeName as ls, getStackRecords as lt, isSecretBearingReferenceString as m, unreadableOrphanRecords as ma, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as mc, hasReadableResources as mi, displayTextOrWithheld as mn, recordLogOnlyParameterValue as mo, isTerminationProtectionPropagationError as mr, loadPublishableAssetManifest as ms, readProtection as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedResourcePropertiesForOrphan as na, resolveSkipPrefix as nc, parameterInputsFor as ni, PRE_DELETE_SNAPSHOT_TYPES as nn, maskedLeafCoordinatesOf as no, withPrintingSecrets as nr, importableOutputKeys as ns, loadJournaledOrphans as nt, isAbsoluteAssetPath as o, refuseMalformedState as oa, stateBucketExistenceConfirmed as oc, STATE_RESOURCES_MALFORMED as oi, effectiveDeletionPolicy as on, readsNoEchoSource as oo, UNSPECIFIED_SKIP_REASON as or, orphansCarriedFrom as os, replayRollback as ot, readRecordedConditionVerdicts as p, unpreviewableOrphanRecords as pa, uploadCfnTemplate as pc, hasReadableOutputs as pi, WITHHELD_NAME_DISPLAY as pn, printingCorpusOf as po, ec2InstanceProtectionSite as pr, createAssetRedirectResolver as ps, perType as pt, revertNestedChildFromJournal as q, withRetry as qa, refuseMalformedResourceEntries as qi, definedAttributes as qn, S3StateBackend as qo, carriesFetchableDynamicReference as qr, getDockerImageBySourceHash as qs, updatePartialMessage as qt, computeImplicitDeleteEdges as r, refuseMalformedResourcesForDeploy as ra, resolveStateBucketWithDefault as rc, passedParameterClassesOf as ri, buildFinalSnapshotIdentifier as rn, noEchoLeavesOf as ro, CloudControlProvider as rr, importableOutputs as rs, makeForeignHolderScan as rt, listNestedTemplateRows as s, repairMalformedOrphanRecordsForReadOnly as sa, warnDeprecatedNoPrefixCliFlag as sc, UNREADABLE_ORPHANS_CONTAINER_ROW as si, isFinalSnapshotError as sn, liveMatchesUnresolvedTokenFrame as so, deleteIndeterminateGuards as sr, shouldRetainResource as ss, awaitInFlightSibling as st, DeployEngine as t, refuseMalformedResourcePropertiesForExport as ta, resolveCaptureObservedState as tc, withSharedDrainBudget as ti, ATOMIC_FINAL_SNAPSHOT_TYPES as tn, maskWholeValue as to, getCurrentResourceSecrets as tr, hasUnverifiableParameterRefusal as ts, journaledOrphanLines as tt, conditionFingerprint as u, repairMalformedResourceEntriesForReadOnly as ua, CFN_TEMPLATE_URL_LIMIT as uc, deployRefusesOrphanRowsReason as ui, DeploymentEventsReader as un, hasMaskableValues as uo, isWaitAbandonedError as ur, stringifyValue as us, withStackRecords as ut, noEchoAttributeNamesOf as v, findSilentDropProperties as va, canonicalizeRegion as vc, malformedExportNamesWarning as vi, secretSafeKeyDisplay as vn, errorCauseChain as vo, DiffCalculator as vr, assertAssetBucketRegion as vs, compensateRemovedDeletionProtection as vt, getPriorAttempts as w, shownType as wa, hasOwnKey as wc, malformedOrphanRecordsWarning as wi, collectDeclaredOutputNames as wn, DYNAMIC_REFERENCE_TOKEN_SCAN as wo, regionLessSecretName as wr, validateAssetBucketName as ws, deleteTableWithIndexBusyRetry as wt, withResourceDeadline as x, NO_CC_HANDLERS_REASON as xa, StageLoadError as xc, malformedLocalResourceEntriesWarning as xi, exportNameSecretExposure as xn, markSameGenerationBag as xo, poisonRenderedSpellingsCollidingIn as xr, isCrossRegionRedirect as xs, resolveDynamoDbDeleteBudgetMs as xt, noEchoComparisonForTemplate as y, unwrittenCreateOnlyReplacement as ya, derivePartitionAndUrlSuffix as yc, malformedExportSourceWarning as yi, carriedExportAliasExposure as yn, maskSecretsInError as yo, INTRINSIC_KEYS as yr, ensureAssetStorage as ys, deleteBudgetKey as yt, planOrphanAdoption as z, readConfigString as za, refuseMalformedOrphanRecords as zi, acquireIdempotencyToken as zn, STATE_SOURCED_BASELINE_RULES as zo, s3BucketRegionalDomainName as zr, redactDockerArgvValues as zs, resolveReplacementOldType as zt };
-//# sourceMappingURL=deploy-engine-DYAAwd0u.js.map
+export { dropFailedHint as $, isMarkedCoordinate as $a, refuseMalformedResourcePropertiesForDestroy as $i, wouldReturnToSdkProvider as $n, hasReadableExportSet as $o, refStateLookupFromResource as $r, resolveApp as $s, secretNamePrintingBag as $t, gray as A, coerceWarmThroughput as Aa, displayAssemblyPath as Ac, malformedRenderedContainersWarning as Ai, maskingRetryLogger as An, recordNestedStackParameterExpressions as Ao, sendableAssumeRoleCommand as Ar, describeDockerExecFailure as As, removeProtectionTypeList as At, NESTED_PENDING_PARENT_REASON as B, replayWarn as Ba, refuseMalformedOrphanRecordsForDestroy as Bi, DBPROXY_TAGS_WHAT as Bn, STATE_SOURCED_CROSS_GENERATION_RULES as Bo, s3BucketWebsiteUrl as Br, redactedDockerCause as Bs, findNestedStackTypeChanges as Bt, recordedProtectionNote as C, findReplacedReadersOfRecreateTargets as Ca, defineOwnKey as Cc, malformedOrphanRecordsRefusalMessage as Ci, noEchoParameterValueSeed as Cn, scrubResourceRecord as Co, producerRegionsFromState as Cr, readBootstrapMarkerBody as Cs, INDEX_SETTLE_POLL_INTERVAL_MS as Ct, createReadOnlyAttributeHealerFactory as D, isStatefulRecreateTargetSync as Da, ownValue as Dc, malformedOrphansWarning as Di, bindingSkippedOutputs as Dn, pathCrossesDottedKey as Do, assertSendableRoleArn as Dr, buildDockerImage as Ds, S3_AUTO_DELETE_OBJECTS_TAG as Dt, formatResourceLine as E, isStatefulRecreateTargetForReplace as Ea, nullPrototypeRecord as Ec, malformedOrphansRefusalMessage as Ei, isExportAliasCollision as En, isUncertifiedBaselineMaskPosition as Eo, assertFlagRoleArn as Er, buildDenyExternalAccessPolicy as Es, ECR_AUTO_DELETE_IMAGES_TAG as Et, namesAnyDeclaredParameter as F, coerceCfnInteger as Fa, malformedStateRefusalMessage as Fi, earliestDefined as Fn, recordMaskOnlyValuesIn as Fo, isSettledInstanceState as Fr, getDockerCmd as Fs, isReplacementOrphan as Ft, nestedChildStackName as G, templateResourceTypes as Ga, refuseMalformedOutputsForDestroy as Gi, tagMapAsList as Gn, LockManager as Go, isImpossibleEmptyStoredAttribute as Gr, stripControlChars as Gs, redactedDeleteAddressFields as Gt, displacedPhysicalIdShown as H, requireConfigObject as Ha, refuseMalformedOrphansForDestroy as Hi, planTagDiff as Hn, TEMPLATE_SOURCED_RULES as Ho, isUnboundTemplateParameter as Hr, runDockerStreaming as Hs, inheritProducerRegions as Ht, reachableDivergentParameters as I, configBooleanRefusal as Ia, previewableOrphanRecords as Ii, ledgerForStack as In, recordNoEchoAttributeValues as Io, s3BucketArn as Ir, isDockerClientEnvKey as Is, planFailedOps as It, revertedNestedRowIds as J, canonicalLambdaFunctionName as Ja, refuseMalformedResourceEntriesForDeploy as Ji, stringifyIfAssigned as Jn, rebuildClientForBucketRegion as Jo, isNamelessDynamicReferenceError as Jr, Synthesizer as Js, updatePartialReason as Jt, recordDisplacedSkips as K, describeTypeWithThrottleRetry as Ka, refuseMalformedResourceAttributesForOrphan as Ki, tagPlanWarning as Kn, isLockInfoExpired as Ko, carriesDynamicReference as Kr, AssetManifestLoader as Ks, redactedDeleteAddressSkip as Kt, resourcesNamingDeclaredParameter as L, configIntegerRefusal as La, refuseDivergentRecordRegionForDestroy as Li, reserveStackCreateToken as Ln, recordProvenPublicExpression as Lo, s3BucketDomainName as Lr, isMalformedEnvKey as Ls, planRollback as Lt, red as M, toCfnInteger as Ma, resolveAssemblyPath as Mc, malformedResourcePropertiesWarning as Mi, findDestructiveChanges as Mn, carriesSecretMask as Mo, applyCallerIdentityCredentials as Mr, dockerSpawnEnvWithSensitive as Ms, recordAfterRollbackUpdate as Mt, yellow as N, toFiniteNumber as Na, clearBucketRegionCache as Nc, malformedResourcesWarning as Ni, formatDestructiveChange as Nn, provenPublicValue as No, callerEnvCredentials as Nr, finchSecretArgvRefusal as Ns, demoteSupersededOrphans as Nt, bold as O, renderStatefulReason as Oa, absoluteAssemblyPathEscape as Oc, malformedOutputsRefusalMessage as Oi, DEFAULT_RESOURCE_TIMEOUT_MS as On, identityKeyFor as Oo, explicitRoleArnOrThrow as Or, resolveDockerContextDirectory as Os, hasCdkAutoDeleteTag as Ot, computeParameterTaint as P, coerceCfnBoolean as Pa, resolveBucketRegion as Pc, malformedScrubResourceEntriesRefusalMessage as Pi, RollbackInlinePolicyWriters as Pn, recordMaskOnlyValue as Po, envCredentialsAreAssumedRole as Pr, formatDockerLoginError as Ps, isJournaledOrphan as Pt, deleteJournaledOrphans as Q, TemplateParser as Qa, refuseMalformedResourceEntriesForOrphan as Qi, isCustomResource as Qn, exportNamesCarriedFrom as Qo, isStalePlaceholderArnAttribute as Qr, loadCdkJson as Qs, orphanRecordsPrintingBag as Qt, makeSiblingClaimReader as R, configStringRefusal as Ra, refuseMalformedNestedChildOutputs as Ri, withCreateTokenLedger as Rn, wholeStringLeavesOf as Ro, s3BucketDualStackDomainName as Rr, partitionSensitiveEnv as Rs, replacementNeverSwapped as Rt, recordedProtectionEvidence as S, hasNoCloudControlHandlers as Sa, processStackMessages as Sc, malformedLocalResourcesWarning as Si, isWholeDynamicReferenceValue as Sn, redactSecretsForState as So, classifyReplaySecretRegion as Sr, parseBootstrapMarker as Ss, DELETE_INDEX_WAIT_PROCEED_NOTE as St, markRefusedBeforeApplying as T, MULTI_REGION_RECREATE_BLOCKED_TYPES as Ta, hasPlainPrototype$1 as Tc, malformedOrphanRowsKeptWarning as Ti, collectPublishedOutputNames as Tn, dynamicReferenceTokens as To, applyRoleArnIfSet as Tr, validateContainerRepoName as Ts, waitForIndexesSettled as Tt, dropSettledNestedJournals as U, requireConfigString as Ua, refuseMalformedOrphansForOrphan as Ui, readTagList as Un, WHOLE_DYNAMIC_REFERENCE_PATTERN as Uo, parameterTypeMayLoseSecretIdentity as Ur, warnFinchArgvExposure as Us, REDACTED_DELETE_ADDRESS_SKIP_REASON as Ut, displacedOpClause as V, requireConfigArray as Va, refuseMalformedOrphans as Vi, DBPROXY_TAG_OPTIONS as Vn, STATE_SOURCED_READBACK_RULES as Vo, coerceParameterTypedValue as Vr, runDockerForeground as Vs, getCurrentProducerRegions as Vt, getNestedRevertRun as W, prefetchCreateOnlyPropertyPaths as Wa, refuseMalformedOutputs as Wi, refuseMalformedDesiredTags as Wn, isSingleDynamicReferenceToken as Wo, getAccountInfo as Wr, escapeRegExp$3 as Ws, isRedactedRecordedValue as Wt, getCurrentNestedStackContext as X, sameLambdaFunctionAddress as Xa, refuseMalformedResourceEntriesForImport as Xi, ProviderRegistry as Xn, acceptedCreateOnlyDropsOf as Xo, AWS_NO_VALUE as Xr, getDefaultStateBucketName as Xs, journaledOrphanPrintingBag as Xt, withNestedRevertRun as Y, lambdaFunctionNameForMask as Ya, refuseMalformedResourceEntriesForDestroy as Yi, CC_BROKEN_REASON as Yn, splitImportedOps as Yo, keepsSecretReferenceToken as Yr, synthesisStatusMessage as Ys, completedReplayEntries as Yt, withNestedStackContext as Z, DagBuilder as Za, refuseMalformedResourceEntriesForImportSave as Zi, ccBrokenReason as Zn, describeRegionValueKind as Zo, cfnRefValueFromPhysicalId as Zr, getLegacyStateBucketName as Zs, maskEventTextWithBoundBags as Zt, makeCanonicalizePropertiesFn as _, findActionableSilentDrops as _a, PARTITION_TABLE as _c, malformedDriftResourcePropertiesWarning as _i, secretBearingStateKeyWarning as _n, createSecretMasker as _o, reEnableInstanceApiTermination as _r, BOOTSTRAP_MARKER_PREFIX as _s, beginDeleteWait as _t, findNestedTemplateTreeDefect as a, refuseMalformedResourcesForExport as aa, resolveUseCdkBootstrapAssets as ac, STATE_REGION_DIVERGED as ai, createPreDeleteFinalSnapshot as an, passedNoEchoParametersOf as ao, unchangedBehindSecretReference as ar, orphansAfterRollback as as, replayFailedOperations as at, noEchoComparisonForTemplate as b, withoutSilentDropProperties as ba, AssemblyReader as bc, malformedLocalOutputsWarning as bi, exportNameNoEchoParameters as bn, maskSecretsInText as bo, IntrinsicFunctionResolver as br, getBootstrapMarkerKey as bs, resolveDynamoDbDeleteBudgetClock as bt, renderNestedTemplateTreeDefect as c, repairMalformedOrphansForReadOnly as ca, ssmResolvedValueType as cc, UNREADABLE_RESOURCES_MAP_ROW as ci, refusesFinalSnapshot as cn, carryLogOnlyValues as co, deleteSkipReason as cr, AssetPublisher as cs, destroyStackRecordsView as ct, conditionInputsFrom as d, repairMalformedResourcePropertiesForReadOnly as da, MIGRATE_TMP_PREFIX as dc, displayLogicalId as di, DeploymentEventsStore as dn, literalSplitDelimitersOf as do, markWaitAbandoned as dr, WorkGraph as ds, PROTECTION_PROPERTY_BY_TYPE as dt, refuseMalformedResourcePropertiesForDrift as ea, resolveAutoAssetStorage as ec, parseWebACLArn as ei, stateSecretNameNeedles as en, maskReadbackAtCoordinates as eo, isCustomResourceType as er, hasReasonlessBaselineRefusal as es, isHandledOrphan as et, parentSuppliedValues as f, repairMalformedResourcesForReadOnly as fa, findLargeInlineResources as fc, hasReadableOrphans as fi, extractDeploymentEventError as fn, logOnlyValueCount as fo, disableInstanceApiTermination as fr, buildAssetRedirectMap as fs, isProtectionValueActive as ft, mergeNoChangeOutputs as g, withheldAccountClause as ga, expectedOwnerParam as gc, isReadableResourceEntry as gi, secretBearing as gn, shareLogOnlyValues as go, reDisableInstanceApiTermination as gr, AssetModeResolver as gs, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as gt, keptWholeReasonText as h, unreadableResourceEntries as ha, decodeListingKey as hc, isReadableOrphanRecord as hi, exportAliasCollisionScrubWarning as hn, recordLogOnlyValue as ho, observeThenDisableInstanceApiTermination as hr, rewriteTemplateAssetReferences as hs, DynamoDBGlobalTableProvider as ht, childTemplateLoader as i, refuseMalformedResourcesForDestroy as ia, resolveStateBucketWithDefaultAndSource as ic, JSON_LISTING_HOLE_VALUE as ii, ccRoutedFinalSnapshotError as in, noEchoOutputsComparison as io, slowCcOperationTimeoutMs as ir, isReadableBag as is, sameJournaledOrphans as it, green as j, isWarmThroughputDecrease as ja, renderAssemblyPathEscape as jc, malformedResourceEntriesWarning as ji, constructPathOf as jn, recoverMaskedOutput as jo, AWS_CREDENTIAL_ENV_KEYS as jr, describeDockerFailure as js, orphanDeleteNeedsIdentity as jt, cyan as k, WARM_THROUGHPUT_MEMBERS as ka, describeFileReadFailure as kc, malformedOutputsWarning as ki, DEFAULT_RESOURCE_WARN_AFTER_MS as kn, inheritNestedStackParameterAssociations as ko, isIamRoleArn as kr, describeDockerCapturedOutput as ks, isTruthyCfnBoolean as kt, templateIdentity as l, repairMalformedOutputsForReadOnly as la, CFN_TEMPLATE_BODY_LIMIT as lc, accountArgs as li, unsupportedFinalSnapshotError as ln, createUnionSecretMasker as lo, withIndeterminateGuard as lr, isSensitiveAttributeName as ls, getStackRecords as lt, isSecretBearingReferenceString as m, unreadableOrphanRecords as ma, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as mc, hasReadableResources as mi, displayTextOrWithheld as mn, recordLogOnlyParameterValue as mo, isTerminationProtectionPropagationError as mr, loadPublishableAssetManifest as ms, readProtection as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedResourcePropertiesForOrphan as na, resolveSkipPrefix as nc, parameterInputsFor as ni, PRE_DELETE_SNAPSHOT_TYPES as nn, maskedLeafCoordinatesOf as no, withPrintingSecrets as nr, importableOutputKeys as ns, loadJournaledOrphans as nt, isAbsoluteAssetPath as o, refuseMalformedState as oa, stateBucketExistenceConfirmed as oc, STATE_RESOURCES_MALFORMED as oi, effectiveDeletionPolicy as on, readsNoEchoSource as oo, UNSPECIFIED_SKIP_REASON as or, orphansCarriedFrom as os, replayRollback as ot, readRecordedConditionVerdicts as p, unpreviewableOrphanRecords as pa, uploadCfnTemplate as pc, hasReadableOutputs as pi, WITHHELD_NAME_DISPLAY as pn, printingCorpusOf as po, ec2InstanceProtectionSite as pr, createAssetRedirectResolver as ps, perType as pt, revertNestedChildFromJournal as q, withRetry as qa, refuseMalformedResourceEntries as qi, definedAttributes as qn, S3StateBackend as qo, carriesFetchableDynamicReference as qr, getDockerImageBySourceHash as qs, updatePartialMessage as qt, computeImplicitDeleteEdges as r, refuseMalformedResourcesForDeploy as ra, resolveStateBucketWithDefault as rc, passedParameterClassesOf as ri, buildFinalSnapshotIdentifier as rn, noEchoLeavesOf as ro, CloudControlProvider as rr, importableOutputs as rs, makeForeignHolderScan as rt, listNestedTemplateRows as s, repairMalformedOrphanRecordsForReadOnly as sa, warnDeprecatedNoPrefixCliFlag as sc, UNREADABLE_ORPHANS_CONTAINER_ROW as si, isFinalSnapshotError as sn, liveMatchesUnresolvedTokenFrame as so, deleteIndeterminateGuards as sr, shouldRetainResource as ss, awaitInFlightSibling as st, DeployEngine as t, refuseMalformedResourcePropertiesForExport as ta, resolveCaptureObservedState as tc, withSharedDrainBudget as ti, ATOMIC_FINAL_SNAPSHOT_TYPES as tn, maskWholeValue as to, getCurrentResourceSecrets as tr, hasUnverifiableParameterRefusal as ts, journaledOrphanLines as tt, conditionFingerprint as u, repairMalformedResourceEntriesForReadOnly as ua, CFN_TEMPLATE_URL_LIMIT as uc, deployRefusesOrphanRowsReason as ui, DeploymentEventsReader as un, hasMaskableValues as uo, isWaitAbandonedError as ur, stringifyValue as us, withStackRecords as ut, withResourceDeadline as v, findSilentDropProperties as va, canonicalizeRegion as vc, malformedExportNamesWarning as vi, secretSafeKeyDisplay as vn, errorCauseChain as vo, DiffCalculator as vr, assertAssetBucketRegion as vs, compensateRemovedDeletionProtection as vt, getPriorAttempts as w, shownType as wa, hasOwnKey as wc, malformedOrphanRecordsWarning as wi, collectDeclaredOutputNames as wn, DYNAMIC_REFERENCE_TOKEN_SCAN as wo, regionLessSecretName as wr, validateAssetBucketName as ws, deleteTableWithIndexBusyRetry as wt, noEchoParameterNamesOf as x, NO_CC_HANDLERS_REASON as xa, StageLoadError as xc, malformedLocalResourceEntriesWarning as xi, exportNameSecretExposure as xn, markSameGenerationBag as xo, poisonRenderedSpellingsCollidingIn as xr, isCrossRegionRedirect as xs, resolveDynamoDbDeleteBudgetMs as xt, noEchoAttributeNamesOf as y, unwrittenCreateOnlyReplacement as ya, derivePartitionAndUrlSuffix as yc, malformedExportSourceWarning as yi, carriedExportAliasExposure as yn, maskSecretsInError as yo, INTRINSIC_KEYS as yr, ensureAssetStorage as ys, deleteBudgetKey as yt, planOrphanAdoption as z, readConfigString as za, refuseMalformedOrphanRecords as zi, acquireIdempotencyToken as zn, STATE_SOURCED_BASELINE_RULES as zo, s3BucketRegionalDomainName as zr, redactDockerArgvValues as zs, resolveReplacementOldType as zt };
+//# sourceMappingURL=deploy-engine-DWbbP9w6.js.map