@go-to-k/cdkd 0.296.19 → 0.296.21

package/dist/{deploy-engine-DFGqFKxg.js → deploy-engine-CFgNpsEy.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js"
 import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
 import { $ as protectedReplacementAdvice, $n as isIamPropagationError, $t as AccountIdUnavailableError, A as isQuotableImportValue, An as commandHole, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bt as sanitizeRecoveryValue, Ct as RETRY_AUXILIARY_OWNER, Dn as SHELL_ACTIVE, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as plainOrDescribed, G as runDeleteAttempt, Gn as isNameCooldownError, H as observeThenDisableProtection, Hn as isUpdateUnsupportedError, Ht as DEFAULT_STATE_PREFIX, In as quotedOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jt as withPasteableAwsProfile, Kn as isRecreateRetryableError, Kt as producerRecordKey, L as ProtectionFlipRegistry, Ln as shellBoundedDisplay, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mn as isInertUnquoted, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as pasteableCommand, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE_WHY, Ot as hasCreatedBeforeFailure, Pn as physicalIdShownBesideCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, R as compensateProtectionFlip, Rn as shellQuote, Rt as formatLockOperation, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Un as hasReplayMayCollide, Ut as injectiveKey, Vt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Wn as isNameCollisionErrorFrom, Xn as formatRetryClassificationSignals, Xt as ambientCredentialConfig, Yn as markReplayMayCollide, Yt as ambientClientDefaults, Zn as isAmbiguousCcHandlerErrorCode, Zt as clientDefaultsFor, _n as ResourceUpdateNotSupportedError, _t as createMaskedLogSinks, ar as isThrottlingError, at as startInterruptWatch, bn as StateError, bt as maskDeep, cr as wrapMaskedAwsError, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as MacroExpansionError, en as AssetError, er as isRetryableTransientError, f as removalWarning, fn as MalformedProducerRecordRefusalError, ft as logicalIdShown, gn as ResourceTimeoutError, gt as stateOrphanRecordRemedy, hn as ProvisioningError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as DependencyError, ir as isMarkedNonRetryable, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, kn as UNSHOWABLE_VALUE, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, m as withoutInjectedRemovals, mt as resourceTypeShown, nr as retryClassificationText, on as DynamicReferenceRegionAmbiguousError, or as markNonRetryable, ot as ElapsedBudgetRegistry, qn as isReplayedNameCollisionFrom, rn as CrossAccountSecretRefusalError, sn as IntrinsicResolutionRefusalError, sr as markRedactedCause, st as monotonicNowMs, tn as CdkdError, tr as isTransientServerError, un as LockError, ut as compositeIdSeparatorRefusal, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as normalizeAwsError, wt as carryCreatedBeforeFailure, xn as SynthesisError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as withheldTargetClause, zt as formatLockOwner } from "./iam-policy-targets-BoZuWtxK.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-DsDA-Fvw.js";
+import { t as getCdkdVersion } from "./version-_h48bvqX.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -8436,7 +8436,7 @@ function wildcardOverlapsResolvedPlaintext(send, wildcards, secrets) {
 
 //#endregion
 //#region src/deployment/secret-redaction/noecho-leaves.ts
-const SUB_VARIABLE$1 = /\$\{([^}!][^}]*)\}/g;
+const SUB_VARIABLE$2 = /\$\{([^}!][^}]*)\}/g;
 function intrinsicKeyOf(node) {
 	const keys = Object.keys(node);
 	if (keys.length !== 1) return void 0;
@@ -8463,7 +8463,7 @@ function getAttReadsNoEcho(argument, sources) {
 	return sources.attributeIsNoEcho(target, attribute);
 }
 function subStringReadsNoEcho(text, variables, sources) {
-	for (const match of text.matchAll(SUB_VARIABLE$1)) {
+	for (const match of text.matchAll(SUB_VARIABLE$2)) {
 		const name = match[1].trim();
 		if (variables !== void 0 && Object.hasOwn(variables, name)) continue;
 		if (sources.parameters.has(name)) return true;
@@ -8511,8 +8511,12 @@ function literalIndex(index) {
 	if (typeof index === "number" && Number.isInteger(index)) return index;
 	if (typeof index === "string" && /^\d+$/.test(index)) return Number(index);
 }
-function noEchoCoordinatesOf(template, resolved, sources) {
+function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
 	const coordinates = [];
+	const push = (path, node) => {
+		coordinates.push(path);
+		onCoordinate?.(path, node);
+	};
 	const ancestors = /* @__PURE__ */ new Set();
 	const parametersOnly = {
 		parameters: sources.parameters,
@@ -8528,14 +8532,14 @@ function noEchoCoordinatesOf(template, resolved, sources) {
 			if (Array.isArray(source)) {
 				if (!readsNoEchoSource(source, sources)) return;
 				if (Array.isArray(value) && value.length === source.length) source.forEach((item, index) => walk(item, value[index], [...path, index]));
-				else if (readsNoEchoSource(source, parametersOnly) || source.some(isBareDeclaredGetAtt)) coordinates.push(path);
+				else if (readsNoEchoSource(source, parametersOnly) || source.some(isBareDeclaredGetAtt)) push(path, source);
 				return;
 			}
 			const record = source;
 			const intrinsic = intrinsicKeyOf(record);
 			if (intrinsic === void 0) {
 				if (!isPlainObject$4(value)) {
-					if (readsNoEchoSource(record, parametersOnly)) coordinates.push(path);
+					if (readsNoEchoSource(record, parametersOnly)) push(path, source);
 					return;
 				}
 				for (const [key, child] of Object.entries(record)) if (Object.hasOwn(value, key)) walk(child, value[key], [...path, key]);
@@ -8550,7 +8554,7 @@ function noEchoCoordinatesOf(template, resolved, sources) {
 						return;
 					}
 					if (isBareDeclaredGetAtt(argument[1]) || isBareDeclaredGetAtt(argument[2])) {
-						coordinates.push(path);
+						push(path, source);
 						return;
 					}
 				}
@@ -8567,10 +8571,10 @@ function noEchoCoordinatesOf(template, resolved, sources) {
 				}
 			}
 			if (intrinsic === "Fn::GetAtt") {
-				if (getAttReadsNoEcho(record["Fn::GetAtt"], sources)) coordinates.push(path);
+				if (getAttReadsNoEcho(record["Fn::GetAtt"], sources)) push(path, source);
 				return;
 			}
-			if (readsNoEchoSource(record, parametersOnly)) coordinates.push(path);
+			if (readsNoEchoSource(record, parametersOnly)) push(path, source);
 		} finally {
 			ancestors.delete(source);
 		}
@@ -8646,6 +8650,31 @@ function maskAtCoordinates(bag, coordinates) {
 	}
 	return root;
 }
+function replaceAtCoordinates(bag, entries) {
+	let root = bag;
+	for (const { coordinate, value } of entries) {
+		if (!readAt(root, coordinate).found) continue;
+		if (coordinate.length === 0) {
+			root = value;
+			continue;
+		}
+		root = cloneContainer(root);
+		let node = root;
+		for (let i = 0; i <= coordinate.length - 1; i++) {
+			const segment = coordinate[i];
+			const next = i === coordinate.length - 1 ? value : cloneContainer(node[segment]);
+			if (typeof segment === "number") node[segment] = next;
+			else Object.defineProperty(node, segment, {
+				value: next,
+				enumerable: true,
+				writable: true,
+				configurable: true
+			});
+			node = next;
+		}
+	}
+	return root;
+}
 function maskReadbackAtCoordinates(readback, properties, coordinates) {
 	let result = readback;
 	for (const coordinate of coordinates) {
@@ -9932,7 +9961,7 @@ async function withRetry(operation, logicalId, opts = {}) {
 		const backoffThroughThisAttemptMs = propagation ? propagationSleptMs + delay : propagationSleptMs;
 		opts.logger?.debug(`  ⏳ Retrying ${shownId} in ${delay / 1e3}s (attempt ${attempt + 1}/${attemptLimit}${propagation ? `, ${(backoffThroughThisAttemptMs / 1e3).toFixed(2)}s backoff through this attempt` : ""}) - ${message}`);
 		for (let waited = 0; waited < delay; waited += 1e3) {
-			if (opts.isInterrupted?.()) throw opts.onInterrupted ? opts.onInterrupted() : /* @__PURE__ */ new Error("Interrupted");
+			if (opts.isInterrupted?.()) throw carryCreatedBeforeFailure(previousError, opts.onInterrupted ? opts.onInterrupted() : /* @__PURE__ */ new Error("Interrupted"));
 			await sleep(Math.min(1e3, delay - waited));
 		}
 		if (propagation) {
@@ -22923,7 +22952,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-ha36d8C0.js");
+			const { ASGProvider } = await import("./asg-provider-D5_Zlj5T.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -23029,7 +23058,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-DOBUTuj4.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DHPdyc-o.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-CE85wFCg.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DGI_r9C8.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -23923,6 +23952,305 @@ function findResolvedSecretPaths(properties, secrets) {
 	return paths;
 }
 
+//#endregion
+//#region src/deployment/noecho-delete-reresolution.ts
+function readsNoEchoDeleteValues(resourceType) {
+	return resourceType === "AWS::CloudFormation::CustomResource" || resourceType.startsWith("Custom::") || resourceType === "AWS::CloudFormation::Stack";
+}
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function maskedNoEchoCoordinates(properties, recordedLeaves) {
+	return (recordedLeaves ?? []).filter((coordinate) => carriesSecretMask(valueAtCoordinate(properties, coordinate)));
+}
+function applyNoEchoDeleteValues(properties, recordedLeaves, values) {
+	const masked = maskedNoEchoCoordinates(properties, recordedLeaves);
+	if (masked.length === 0) return {
+		payload: properties,
+		unresolved: []
+	};
+	const byKey = new Map((values?.leaves ?? []).map((leaf) => [canonicalJson$3(leaf.coordinate), leaf]));
+	const entries = [];
+	const unresolved = [];
+	for (const coordinate of masked) {
+		const leaf = byKey.get(canonicalJson$3(coordinate));
+		if (leaf === void 0) unresolved.push(coordinate);
+		else entries.push({
+			coordinate,
+			value: leaf.value
+		});
+	}
+	if (unresolved.length > 0) return {
+		payload: properties,
+		unresolved
+	};
+	return {
+		payload: replaceAtCoordinates(properties, entries),
+		unresolved
+	};
+}
+function recordLeaves(bag, value) {
+	if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+		for (const child of Object.values(value)) recordLeaves(bag, child);
+		return;
+	}
+	recordLogOnlyParameterValue(bag, value);
+}
+function templateNodesAt(templateProperties, shape, noEchoParameters, conditions) {
+	const nodes = /* @__PURE__ */ new Map();
+	noEchoCoordinatesOf(templateProperties ?? {}, shape, {
+		parameters: noEchoParameters,
+		...conditions !== void 0 && { conditions }
+	}, (coordinate, node) => nodes.set(canonicalJson$3(coordinate), node));
+	return nodes;
+}
+async function fingerprintsUnchanged(record, templateProperties, coordinate, fingerprinter) {
+	const key = coordinate[0];
+	if (typeof key !== "string") return false;
+	const props = templateProperties !== null && typeof templateProperties === "object" ? templateProperties : {};
+	const raw = record.maskedPropertyFingerprints;
+	if (!(raw !== null && typeof raw === "object" && Object.hasOwn(raw, key))) return true;
+	const recorded = maskedPropertyFingerprintsOf(record).get(key);
+	if (recorded === void 0 || !Object.hasOwn(props, key)) return false;
+	if (recorded !== maskedPropertyFingerprint(props[key])) return false;
+	const bound = maskedPropertyInputFingerprintsOf(record).get(key);
+	if (bound === void 0) return true;
+	const now = fingerprinter === void 0 ? void 0 : await fingerprinter(key);
+	return now !== void 0 && now === bound;
+}
+async function noEchoDeleteValuesFromResolved(options) {
+	const { record, templateResource, resolvedProperties } = options;
+	if (!readsNoEchoDeleteValues(record.resourceType)) return void 0;
+	const masked = maskedNoEchoCoordinates(record.properties, noEchoLeavesOf(record));
+	if (masked.length === 0 || templateResource === void 0 || resolvedProperties === void 0) return;
+	if (templateResource.Type !== record.resourceType) return void 0;
+	if (carriesResolvedSecret(options.secrets)) return void 0;
+	const nodes = templateNodesAt(templateResource.Properties, resolvedProperties, options.noEchoParameters, options.conditions);
+	const bag = new Map(options.secrets);
+	carryLogOnlyValues(options.secrets, bag);
+	const templateProps = isRecord(templateResource.Properties) ? templateResource.Properties : {};
+	const fingerprinter = options.inputSources === void 0 ? void 0 : inputFingerprinter(templateProps, options.inputSources);
+	const leaves = [];
+	for (const coordinate of masked) {
+		if (!nodes.has(canonicalJson$3(coordinate))) continue;
+		if (!await fingerprintsUnchanged(record, templateProps, coordinate, fingerprinter)) continue;
+		const value = valueAtCoordinate(resolvedProperties, coordinate);
+		if (value === void 0 || carriesSecretMask(value)) continue;
+		recordLeaves(bag, value);
+		leaves.push({
+			coordinate,
+			value
+		});
+	}
+	if (leaves.length === 0) return void 0;
+	return {
+		leaves,
+		maskSecrets: createSecretMasker(bag)
+	};
+}
+const PSEUDO_PARAMETERS = /* @__PURE__ */ new Set([
+	"AWS::Region",
+	"AWS::Partition",
+	"AWS::URLSuffix",
+	"AWS::AccountId",
+	"AWS::StackName"
+]);
+const SUB_VARIABLE$1 = /\$\{([^}!][^}]*)\}/g;
+const PARAMETER_ONLY_INTRINSICS = /* @__PURE__ */ new Set([
+	"Ref",
+	"Fn::Join",
+	"Fn::Sub",
+	"Fn::Select",
+	"Fn::Split",
+	"Fn::Base64"
+]);
+function readsParametersOnly(node, declared, refused) {
+	const isParameter = (name) => typeof name === "string" && (declared.has(name) && !refused.has(name) || PSEUDO_PARAMETERS.has(name));
+	const walk = (value) => {
+		if (typeof value === "string") return !value.includes("{{resolve:");
+		if (value === null || typeof value !== "object") return true;
+		if (Array.isArray(value)) return value.every(walk);
+		const record = value;
+		const keys = Object.keys(record);
+		const intrinsic = keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::")) ? keys[0] : void 0;
+		if (keys.includes("Condition")) return false;
+		if (intrinsic === void 0) return Object.values(record).every(walk);
+		if (!PARAMETER_ONLY_INTRINSICS.has(intrinsic)) return false;
+		const argument = record[intrinsic];
+		if (intrinsic === "Ref") return isParameter(argument);
+		if (intrinsic === "Fn::Sub") {
+			const [text, variables] = Array.isArray(argument) ? argument : [argument, void 0];
+			if (typeof text !== "string" || text.includes("{{resolve:")) return false;
+			const local = variables !== null && typeof variables === "object" && !Array.isArray(variables) ? variables : void 0;
+			if (Array.isArray(argument) && argument.length === 2 && local === void 0) return false;
+			for (const match of text.matchAll(SUB_VARIABLE$1)) {
+				const name = match[1];
+				if (local !== void 0 && Object.hasOwn(local, name)) continue;
+				if (!isParameter(name)) return false;
+			}
+			return local === void 0 || Object.values(local).every(walk);
+		}
+		return walk(argument);
+	};
+	return walk(node);
+}
+var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
+	logger = getLogger().child("NoEchoDeleteReresolution");
+	resolver;
+	parametersPromise;
+	noEchoParameters;
+	options;
+	constructor(options) {
+		this.options = options;
+		this.resolver = new IntrinsicFunctionResolver(options.region);
+		const declared = /* @__PURE__ */ new Set();
+		const section = options.template.Parameters;
+		if (section !== null && typeof section === "object") for (const [name, definition] of Object.entries(section)) {
+			const noEcho = definition?.NoEcho;
+			if (noEcho === true || noEcho === "true") declared.add(name);
+		}
+		for (const name of options.inheritedNoEchoParameters ?? []) declared.add(name);
+		this.noEchoParameters = declared;
+	}
+	static usable(template) {
+		return template !== void 0 && template !== null && typeof template === "object" && template.Transform === void 0;
+	}
+	newBag() {
+		const bag = new Map(this.options.inheritedSecrets ?? []);
+		if (this.options.inheritedSecrets !== void 0) carryLogOnlyValues(this.options.inheritedSecrets, bag);
+		return bag;
+	}
+	boundParameters() {
+		this.parametersPromise ??= this.resolver.resolveParameters(this.options.template, this.options.parameters, { inheritedSecrets: this.newBag() }).catch(() => {
+			this.logger.debug(safeMsg`Could not bind the parameters of ${this.options.stackName}'s template; NoEcho ` + `coordinates are not re-resolved for its custom resources' deletes.`);
+		});
+		return this.parametersPromise;
+	}
+	inputSources(parameters) {
+		const { parameterInput, bound } = parameterInputsFor({
+			template: this.options.template,
+			values: parameters,
+			nestedChild: this.options.parameters !== void 0,
+			supplied: this.options.parameters,
+			passedClasses: this.options.passedClasses
+		});
+		return {
+			template: this.options.template,
+			parameterInput,
+			resolve: async (node) => {
+				const secrets = /* @__PURE__ */ new Map();
+				return {
+					value: await this.resolver.resolve(structuredClone(node), {
+						template: this.options.template,
+						resources: {},
+						parameters: bound,
+						stackName: this.options.stackName,
+						recordedSecretValues: secrets,
+						skipDynamicReferences: true
+					}),
+					secrets
+				};
+			}
+		};
+	}
+	async noEchoNeedles() {
+		const bag = this.newBag();
+		const parameters = await this.boundParameters();
+		for (const name of this.noEchoParameters) if (parameters !== void 0 && Object.hasOwn(parameters, name)) recordLogOnlyParameterValue(bag, parameters[name]);
+		return bag;
+	}
+	async valuesFor(logicalId, record) {
+		const masked = maskedNoEchoCoordinates(record.properties, noEchoLeavesOf(record));
+		if (masked.length === 0) return void 0;
+		const resources = this.options.template.Resources;
+		const templateResource = resources !== void 0 && Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+		if (templateResource?.Type !== record.resourceType) return void 0;
+		const parameters = await this.boundParameters();
+		if (parameters === void 0) return void 0;
+		const nodes = templateNodesAt(templateResource.Properties, record.properties, this.noEchoParameters, void 0);
+		const declared = new Set(Object.keys(this.options.template.Parameters ?? {}));
+		const templateProps = isRecord(templateResource.Properties) ? templateResource.Properties : {};
+		const fingerprinter = inputFingerprinter(templateProps, this.inputSources(parameters));
+		const refused = this.options.maskedParameters ?? /* @__PURE__ */ new Set();
+		const bag = await this.noEchoNeedles();
+		const leaves = [];
+		for (const coordinate of masked) {
+			const key = canonicalJson$3(coordinate);
+			if (!nodes.has(key)) continue;
+			const node = nodes.get(key);
+			if (!readsParametersOnly(node, declared, refused)) continue;
+			if (!await fingerprintsUnchanged(record, templateProps, coordinate, fingerprinter)) continue;
+			let value;
+			try {
+				value = await this.resolver.resolve(structuredClone(node), {
+					template: this.options.template,
+					resources: {},
+					parameters,
+					stackName: this.options.stackName,
+					recordedSecretValues: bag
+				});
+			} catch {
+				this.logger.debug(safeMsg`Could not re-resolve a NoEcho coordinate of ${logicalId} from today's template.`);
+				continue;
+			}
+			if (value === void 0 || carriesSecretMask(value)) continue;
+			recordLeaves(bag, value);
+			leaves.push({
+				coordinate,
+				value
+			});
+		}
+		if (leaves.length === 0) return void 0;
+		return {
+			leaves,
+			maskSecrets: createSecretMasker(bag)
+		};
+	}
+	async forNestedChild(logicalId, row, childStackName, load, extractParameters) {
+		const nested = this.options.nestedTemplates;
+		const templatePath = nested !== void 0 && Object.hasOwn(nested, logicalId) ? nested[logicalId] : void 0;
+		if (templatePath === void 0 || !fs.existsSync(templatePath)) return void 0;
+		try {
+			const child = load(templatePath);
+			if (!TemplateNoEchoReresolver.usable(child.template)) return void 0;
+			const leaves = row.noEchoLeaves ?? [];
+			const replaced = replaceAtCoordinates(row.properties ?? {}, row.values?.leaves ?? []);
+			const parameters = extractParameters(replaced);
+			const inherited = /* @__PURE__ */ new Set();
+			for (const coordinate of leaves) if (coordinate.length >= 2 && coordinate[0] === "Parameters") inherited.add(String(coordinate[1]));
+			const rowParameters = replaced.Parameters;
+			const masked = /* @__PURE__ */ new Set();
+			for (const [name, value] of Object.entries(parameters)) {
+				const raw = rowParameters !== null && typeof rowParameters === "object" && Object.hasOwn(rowParameters, name) ? rowParameters[name] : value;
+				if (carriesSecretMask(raw) || carriesSecretMask(value)) masked.add(name);
+			}
+			const parentNeedles = await this.noEchoNeedles();
+			const inheritedSecrets = this.newBag();
+			for (const name of inherited) if (!masked.has(name) && Object.hasOwn(parameters, name)) {
+				recordLogOnlyParameterValue(inheritedSecrets, parameters[name]);
+				carryLogOnlyValuesCarriedBy(parentNeedles, inheritedSecrets, parameters[name]);
+			}
+			const parameters0 = await this.boundParameters();
+			const rowTemplate = this.options.template.Resources?.[logicalId];
+			const passedClasses = parameters0 === void 0 ? void 0 : await classifyPassedParameters(rowTemplate?.Properties?.Parameters, this.inputSources(parameters0)).catch(() => void 0);
+			return new TemplateNoEchoReresolver({
+				...passedClasses !== void 0 && { passedClasses },
+				template: child.template,
+				stackName: childStackName,
+				region: this.options.region,
+				nestedTemplates: child.nestedTemplates,
+				parameters,
+				inheritedNoEchoParameters: inherited,
+				maskedParameters: masked,
+				inheritedSecrets
+			});
+		} catch {
+			this.logger.debug(safeMsg`Could not load nested stack ${logicalId}'s template to re-resolve its NoEcho values.`);
+			return;
+		}
+	}
+};
+
 //#endregion
 //#region src/provisioning/providers/custom-resource-provider.ts
 const DELETE_PATH_UNMASKED = void 0;
@@ -23930,6 +24258,8 @@ const CR_NO_PROPERTIES_SKIP_REASON = "no properties in state — Delete handler
 const CR_NO_SERVICE_TOKEN_SKIP_REASON = "no ServiceToken in state — Delete handler not invoked";
 const CR_MASKED_SERVICE_TOKEN_SKIP_REASON = "masked ServiceToken in state — Delete handler not invoked";
 const CR_NOECHO_PROPERTIES_SKIP_REASON = "NoEcho mask in recorded properties — Delete handler not invoked";
+const CR_MASKED_PROPERTIES_SKIP_REASON = "redaction mask in properties — Delete handler not invoked";
+const NOECHO_RERESOLUTION_BOUND = "cdkd re-resolves such a coordinate only where it holds the template ('cdkd destroy' with the app), and only while today's template reads a NoEcho parameter there with the property's text and inputs unchanged; an attribute a producer declared NoEcho has no template value to re-resolve.";
 function noEchoPropertiesRemedy(context, logicalId) {
 	return context?.stackDestroy === true ? `cdkd is KEEPING the state record and the run exits non-zero, and every re-run skips it again. Tear down what the handler manages by hand, then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}.` : "This delete is not part of a stack destroy (a 'cdkd deploy' template removal, replacement or rollback, or a 'cdkd rollback'). For a resource removed from the template the record is KEPT and every 'cdkd deploy' skips it again: tear down what the handler manages by hand. " + crDeploySkipTail(logicalId);
 }
@@ -24402,14 +24732,25 @@ var CustomResourceProvider = class CustomResourceProvider {
 				reason: CR_REFERENCE_SERVICE_TOKEN_SKIP_REASON
 			};
 		}
-		const maskedNoEchoPaths = (context?.recordedNoEchoLeaves ?? []).filter((coordinate) => carriesSecretMask(valueAtCoordinate(properties, coordinate))).map((coordinate) => coordinate.join("."));
-		if (maskedNoEchoPaths.length > 0) {
-			this.logger.warn(safeMsg`Custom resource ${logicalId} is recorded in state with ${maskedNoEchoPaths.join(", ")} ` + "holding the '***' mask of a NoEcho value (a NoEcho parameter, or an attribute declared NoEcho), which cdkd does not keep or re-resolve on delete, so its handler would receive the mask in ResourceProperties; skipping deletion — the handler is not invoked, so anything this custom resource manages is LEFT IN PLACE. " + safeMsg`${noEchoPropertiesRemedy(context, logicalId)}`);
+		const reresolved = context?.noEchoDeleteValues;
+		const { payload, unresolved } = applyNoEchoDeleteValues(properties, context?.recordedNoEchoLeaves, reresolved);
+		if (unresolved.length > 0) {
+			const maskedNoEchoPaths = unresolved.map((coordinate) => coordinate.join("."));
+			this.logger.warn(safeMsg`Custom resource ${logicalId} is recorded in state with ${maskedNoEchoPaths.join(", ")} ` + `holding the '***' mask of a NoEcho value (a NoEcho parameter, or an attribute declared NoEcho), which cdkd does not keep, so its handler would receive the mask in ResourceProperties; skipping deletion — the handler is not invoked, so anything this custom resource manages is LEFT IN PLACE. ${NOECHO_RERESOLUTION_BOUND} ` + safeMsg`${noEchoPropertiesRemedy(context, logicalId)}`);
 			return {
 				outcome: "skipped",
 				reason: CR_NOECHO_PROPERTIES_SKIP_REASON
 			};
 		}
+		if (carriesSecretMask(payload)) {
+			this.logger.warn(safeMsg`Custom resource ${logicalId} is recorded in state with a property holding the ` + "'***' redaction mask, which no NoEcho coordinate of the record names, so cdkd cannot re-resolve it and its handler would receive the mask in ResourceProperties; skipping deletion — the handler is not invoked, so anything this custom resource manages is LEFT IN PLACE. For a record 'cdkd import' or 'cdkd scrub' wrote, a 'cdkd deploy' of the app first records which positions hold a NoEcho value, after which 'cdkd destroy' sends the delete. " + safeMsg`${noEchoPropertiesRemedy(context, logicalId)}`);
+			return {
+				outcome: "skipped",
+				reason: CR_MASKED_PROPERTIES_SKIP_REASON
+			};
+		}
+		const deleteMask = payload === properties ? DELETE_PATH_UNMASKED : reresolved?.maskSecrets;
+		const show = (text) => deleteMask === void 0 ? text : deleteMask(text);
 		if (!this.isSnsServiceToken(serviceToken) && await this.isBackingLambdaGone(serviceToken)) {
 			if (context?.stackDestroy === true) {
 				this.logger.warn(safeMsg`Backing Lambda for custom resource ${logicalId} no longer exists (${serviceToken}), so ` + "its Delete handler cannot be invoked and cdkd cannot confirm the resource was deleted; skipping deletion — anything this custom resource manages may still be LIVE. cdkd is KEEPING the state record and the run exits non-zero, as CloudFormation leaves such a stack DELETE_FAILED. A re-run skips it again unless a function with that exact ARN exists again (e.g. a shared provider stack destroyed before this one, then redeployed). Otherwise confirm by hand that whatever it manages is gone (or tear it down), then drop the record with " + safeMsg`${stateOrphanRecordRemedy(context, logicalId)}.`);
@@ -24430,10 +24771,10 @@ var CustomResourceProvider = class CustomResourceProvider {
 				LogicalResourceId: logicalId,
 				PhysicalResourceId: physicalId,
 				StackId: invocation.stackId,
-				ResourceProperties: this.stringifyProperties(properties)
-			}), DELETE_PATH_UNMASKED);
+				ResourceProperties: this.stringifyProperties(payload)
+			}), deleteMask);
 			if (cfnResponse.Status === "FAILED") {
-				this.logger.warn(`Custom resource delete handler returned FAILED for ${logicalId}: ${cfnResponse.Reason || "Unknown reason"}. The handler reported that it did NOT delete, so anything this custom resource manages is LEFT IN PLACE${handlerSkipRemedy(context, logicalId)}`);
+				this.logger.warn(show(`Custom resource delete handler returned FAILED for ${logicalId}: ${cfnResponse.Reason || "Unknown reason"}. The handler reported that it did NOT delete, so anything this custom resource manages is LEFT IN PLACE${handlerSkipRemedy(context, logicalId)}`));
 				return {
 					outcome: "skipped",
 					reason: CR_DELETE_HANDLER_FAILED_SKIP_REASON
@@ -24441,7 +24782,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 			}
 			this.logger.debug(`Successfully deleted custom resource ${logicalId}`);
 		} catch (error) {
-			this.logger.warn(`Failed to delete custom resource ${logicalId}, but continuing: ${describeAwsFailure(error).detail}. The Delete handler did not complete, so anything this custom resource manages may still be LIVE${handlerSkipRemedy(context, logicalId)}`);
+			this.logger.warn(show(`Failed to delete custom resource ${logicalId}, but continuing: ${describeAwsFailure(error).detail}. The Delete handler did not complete, so anything this custom resource manages may still be LIVE${handlerSkipRemedy(context, logicalId)}`));
 			return {
 				outcome: "skipped",
 				reason: CR_DELETE_INVOKE_FAILED_SKIP_REASON
@@ -24470,6 +24811,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 	}
 	async invokeCustomResourceWithRetry(serviceToken, logicalId, operation, buildRequest, mask) {
 		const watch = startInterruptWatch(`Custom resource ${logicalId}`);
+		const shown = (text) => mask === void 0 ? text : mask(text);
 		try {
 			const stackId = await this.resolveSyntheticStackId(logicalId, operation, watch);
 			let preDeliveryRetries = 0;
@@ -24494,7 +24836,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				} catch (error) {
 					if (delivered || preDeliveryRetries >= this.preDeliveryAuthzMaxRetries || !this.isTransientAuthzThrow(error)) throw error;
 					const delayMs = Math.min(250 * Math.pow(2, preDeliveryRetries), IAM_PROPAGATION_MAX_DELAY_MS);
-					this.logger.warn(`Custom resource ${operation} for ${logicalId} hit a transient IAM-authorization error before the request was delivered (attempt ${attempt + 1}/${this.preDeliveryAuthzMaxRetries + 1}): ${this.truncateReason(describeAwsFailure(error).detail)}. Retrying in ${delayMs / 1e3}s with a fresh response URL and RequestId.`);
+					this.logger.warn(`Custom resource ${operation} for ${logicalId} hit a transient IAM-authorization error before the request was delivered (attempt ${attempt + 1}/${this.preDeliveryAuthzMaxRetries + 1}): ${this.truncateReason(shown(describeAwsFailure(error).detail))}. Retrying in ${delayMs / 1e3}s with a fresh response URL and RequestId.`);
 					if (invocation !== void 0) await this.cleanupResponseObject(invocation.responseKey);
 					preDeliveryRetries += 1;
 					await this.sleepInterruptibly(delayMs, watch);
@@ -24505,7 +24847,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				const logAuthzMatch = logTail === void 0 ? void 0 : this.findTransientAuthzLogLine(logTail);
 				if (cfnResponse.Status === "FAILED" && failedResponseRetries < this.transientAuthzMaxRetries && (reasonIsAuthz || logAuthzMatch !== void 0)) {
 					failedResponseRetries += 1;
-					this.logger.warn(`Custom resource ${operation} for ${logicalId} returned a transient IAM-authorization FAILED (attempt ${attempt + 1}/${this.transientAuthzMaxRetries + 1}): ${this.truncateReason(cfnResponse.Reason)}. ` + (logAuthzMatch === void 0 ? "" : `The handler's reason carried no authorization wording; the denial was found in the backing function's log: ${this.truncateReason(logAuthzMatch.line)}. `) + `Recycling the backing function's execution environment and retrying so its next cold start picks up the propagated policy.`);
+					this.logger.warn(`Custom resource ${operation} for ${logicalId} returned a transient IAM-authorization FAILED (attempt ${attempt + 1}/${this.transientAuthzMaxRetries + 1}): ${this.truncateReason(cfnResponse.Reason === void 0 ? void 0 : shown(cfnResponse.Reason))}. ` + (logAuthzMatch === void 0 ? "" : `The handler's reason carried no authorization wording; the denial was found in the backing function's log: ${this.truncateReason(shown(logAuthzMatch.line))}. `) + `Recycling the backing function's execution environment and retrying so its next cold start picks up the propagated policy.`);
 					await this.recycleBackingFunctionExecEnv(serviceToken, logicalId);
 					continue;
 				}
@@ -24513,7 +24855,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 					...cfnResponse,
 					Reason: `${cfnResponse.Reason ?? "Unknown reason"} [cdkd: the reason carried no authorization wording, but the backing function's invocation log matched the IAM-authorization signal "${logAuthzMatch.signal}" — see the cdkd warning for the log line, or the function's CloudWatch log group]`
 				};
-				if (logTail !== void 0 && hasHandlerLogOutput(logTail)) this.logger.warn(`Custom resource ${operation} for ${logicalId} failed and cdkd could not classify the reason. Log tail from the DISPATCH invocation (for the CDK Provider framework's async pattern the failure may have occurred in a later execution, whose log this is not):\n` + this.truncateReason(logTail, CR_LOG_TAIL_WARN_MAX_CHARS));
+				if (logTail !== void 0 && hasHandlerLogOutput(logTail)) this.logger.warn(`Custom resource ${operation} for ${logicalId} failed and cdkd could not classify the reason. Log tail from the DISPATCH invocation (for the CDK Provider framework's async pattern the failure may have occurred in a later execution, whose log this is not):\n` + this.truncateReason(shown(logTail), CR_LOG_TAIL_WARN_MAX_CHARS));
 				return cfnResponse;
 			}
 		} finally {
@@ -24629,8 +24971,8 @@ var CustomResourceProvider = class CustomResourceProvider {
 		if (lambdaResponse.FunctionError) {
 			const errorPayload = lambdaResponse.Payload ? Buffer.from(lambdaResponse.Payload).toString() : "Unknown";
 			const logTail = decodeInvokeLogTail(lambdaResponse.LogResult);
-			if (logTail !== void 0 && hasHandlerLogOutput(logTail)) this.logger.warn(`Backing function log tail for ${logicalId} (${operation}):\n` + this.truncateReason(logTail, CR_LOG_TAIL_WARN_MAX_CHARS));
-			throw new Error(`Lambda function error (${lambdaResponse.FunctionError}): ${errorPayload}`);
+			if (logTail !== void 0 && hasHandlerLogOutput(logTail)) this.logger.warn(`Backing function log tail for ${logicalId} (${operation}):\n` + this.truncateReason(mask === void 0 ? logTail : mask(logTail), CR_LOG_TAIL_WARN_MAX_CHARS));
+			throw new Error(`Lambda function error (${lambdaResponse.FunctionError}): ${mask === void 0 ? errorPayload : mask(errorPayload)}`);
 		}
 		let hasDirectPayload = false;
 		try {
@@ -32946,7 +33288,7 @@ async function prepareFinalSnapshotForDelete(logicalId, resourceType, currentRes
 	}
 	throw unsupportedFinalSnapshotError(logicalId, resourceType, "--skip-final-snapshot");
 }
-async function replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, secrets, updateReplacePolicy, oldDeleteProvisionedBy) {
+async function replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, secrets, updateReplacePolicy, oldDeleteProvisionedBy, noEchoDeleteValues) {
 	const createContext = { maskSecrets: createSecretMasker(secrets) };
 	const finalSnapshotIdentifier = await this.prepareFinalSnapshotForDelete(logicalId, oldResourceType, currentResource, updateReplacePolicy);
 	let deleteResult;
@@ -32957,7 +33299,8 @@ async function replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourc
 			...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
 			...this.replacementDeleteContext(updateReplacePolicy),
 			recordedAttributes: currentResource.attributes,
-			recordedNoEchoLeaves: currentResource.noEchoLeaves
+			recordedNoEchoLeaves: currentResource.noEchoLeaves,
+			...noEchoDeleteValues !== void 0 && { noEchoDeleteValues }
 		});
 	} catch (deleteError) {
 		throw new Error(maskSecretsInText(`Failed to delete old resource ${logicalId} (${currentResource.physicalId}) during the --replace delete-first fallback: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`, secrets), { cause: deleteError instanceof Error ? maskSecretsInError(deleteError, secrets) : void 0 });
@@ -33072,10 +33415,10 @@ async function createFirstThenDeleteOld(input) {
 	if (input.equalIdIsSameResource && createResult.physicalId === currentResource.physicalId) throw markNonRetryable(new CdkdError(maskName(`${displaySafe(logicalId)} (${displaySafe(resourceType)}) requires replacement (${input.trigger}) under a new name, but the create returned the resource being replaced (${displaySafe(currentResource.physicalId)}) instead of a new one, so cdkd cannot tell which name it holds. Nothing was deleted. Delete that resource by hand if it is yours, then re-run the deploy.`), "NAMED_REPLACEMENT_IDEMPOTENT_CREATE"));
 	if (retainOld) return createResult;
 	this.logger.info(safeMsg`  Deleting old ${logicalId} (${currentResource.physicalId})...`);
-	await this.deleteReplacedAfterCreate(logicalId, input.oldResourceType, currentResource, input.deleteProvider, input.deleteProperties, finalSnapshotIdentifier, input.deletePolicy, secrets, input.deleteProvisionedBy);
+	await this.deleteReplacedAfterCreate(logicalId, input.oldResourceType, currentResource, input.deleteProvider, input.deleteProperties, finalSnapshotIdentifier, input.deletePolicy, secrets, input.deleteProvisionedBy, input.noEchoDeleteValues);
 	return createResult;
 }
-async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, deleteProvider, deleteProperties, finalSnapshotIdentifier, updateReplacePolicy, secrets, deleteProvisionedBy) {
+async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, deleteProvider, deleteProperties, finalSnapshotIdentifier, updateReplacePolicy, secrets, deleteProvisionedBy, noEchoDeleteValues) {
 	let deleteResult = void 0;
 	let deleteFailed = false;
 	try {
@@ -33085,7 +33428,8 @@ async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentReso
 			...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
 			...this.replacementDeleteContext(updateReplacePolicy),
 			recordedAttributes: currentResource.attributes,
-			recordedNoEchoLeaves: currentResource.noEchoLeaves
+			recordedNoEchoLeaves: currentResource.noEchoLeaves,
+			...noEchoDeleteValues !== void 0 && { noEchoDeleteValues }
 		});
 	} catch (deleteError) {
 		const deleteMsg = maskSecretsInText(deleteError instanceof Error ? deleteError.message : String(deleteError), secrets);
@@ -37295,6 +37639,15 @@ function recordPreviousNoEchoLeaves(registry, stored, desiredLeaves, resolution,
 //#endregion
 //#region src/deployment/deploy-engine/update-replace.ts
 async function updateByReplacement({ change, counts, currentProps, currentResource, dependencies, logicalId, oldResourceType, progress, propertyDrivenReplacement, recreateFlagged, recreateViaCcApi, recreateViaSdkProvider, renderer, resolvedProps, resourceType, stackName, stateResources, template, typeChanged, updateReplacePolicy, updateSecrets, lostWithParent }) {
+	const noEchoDeleteValues = await noEchoDeleteValuesFromResolved({
+		record: currentResource,
+		templateResource: template?.Resources?.[logicalId],
+		resolvedProperties: resolvedProps,
+		noEchoParameters: this.noEchoPositionSources(stateResources, template)?.parameters ?? /* @__PURE__ */ new Set(),
+		conditions: this.noEchoConditions,
+		secrets: updateSecrets,
+		inputSources: template && this.maskedInputSources(template, stateResources, this.noEchoConditions, stackName)
+	});
 	if (propertyDrivenReplacement && !recreateFlagged && updateReplacePolicy !== "Retain") {
 		const statefulReason = isStatefulRecreateTargetForReplace(oldResourceType, currentProps, currentResource.observedProperties);
 		if (statefulReason && this.options.forceStatefulRecreation !== true) {
@@ -37374,7 +37727,8 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			equalIdIsSameResource,
 			snapshotPolicy: updateReplacePolicy,
 			deletePolicy: updateReplacePolicy,
-			trigger: recreateFlagName
+			trigger: recreateFlagName,
+			noEchoDeleteValues
 		});
 	} else if (recreateFlagged) {
 		const recreateFlagName = recreateViaCcApi ? "--recreate-via-cc-api" : "--recreate-via-sdk-provider";
@@ -37393,7 +37747,8 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 					...recreateFinalSnapshotId !== void 0 && { finalSnapshotIdentifier: recreateFinalSnapshotId },
 					...this.replacementDeleteContext(updateReplacePolicy),
 					recordedAttributes: currentResource.attributes,
-					recordedNoEchoLeaves: currentResource.noEchoLeaves
+					recordedNoEchoLeaves: currentResource.noEchoLeaves,
+					...noEchoDeleteValues !== void 0 && { noEchoDeleteValues }
 				});
 			} catch (deleteError) {
 				throw new Error(maskSecretsInText(`Failed to destroy old resource ${logicalId} (${currentResource.physicalId}) during ${recreateFlagName}: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`, updateSecrets), { cause: deleteError instanceof Error ? maskSecretsInError(deleteError, updateSecrets) : void 0 });
@@ -37462,7 +37817,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but the create-first attempt collided with the existing resource: ${createMsg}. ${nameOrigin.descriptor}, so the CloudFormation-style safe replacement order (create the new resource before deleting the old) cannot reuse the occupied name — CloudFormation refuses this shape with "cannot update a stack when a custom-named resource requires replacing". ${nameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated).`, "NAMED_REPLACEMENT_COLLISION");
 			this.logger.info(`  Create-first collided with the existing resource's name and --replace is set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
 			deletedOldFirst = true;
-			createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy, oldDeleteRoute.provisionedBy);
+			createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy, oldDeleteRoute.provisionedBy, noEchoDeleteValues);
 		}
 		if (equalIdIsSameResource && !deletedOldFirst && createResult.physicalId === currentResource.physicalId) {
 			const idempotentNameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
@@ -37470,7 +37825,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			if (this.options.replace !== true) throw new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its Create API is name-idempotent: the create-first attempt returned the EXISTING resource (${currentResource.physicalId}) instead of creating a new one, so deleting the "old" resource would silently destroy the resource the deploy just reported as created. ${idempotentNameOrigin.descriptor}; ${idempotentNameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated). Note: this branch is also reached when the old resource was deleted out-of-band and the physical id is name-derived — there the create was a genuine fresh create; \`--replace\` converges that case too.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
 			this.logger.info(`  Create-first returned the existing resource (name-idempotent Create API) and --replace is set — deleting old ${logicalId} (${currentResource.physicalId}) first...`);
 			deletedOldFirst = true;
-			createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy, oldDeleteRoute.provisionedBy);
+			createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy, oldDeleteRoute.provisionedBy, noEchoDeleteValues);
 		}
 		if (deletedOldFirst) {} else if (updateReplacePolicy === "Retain") {
 			this.retainedOldOnReplacement.add(logicalId);
@@ -37487,7 +37842,7 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 				snapshotBlockedDelete = true;
 				this.logger.warn(`  ⚠ Final snapshot for old ${logicalId} (${currentResource.physicalId}) failed: ${snapshotError instanceof Error ? snapshotError.message : String(snapshotError)}. The old resource was NOT deleted (UpdateReplacePolicy: Snapshot) — delete it manually once you have a snapshot; it is no longer tracked in state.`);
 			}
-			if (!snapshotBlockedDelete) await this.deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, oldDeleteProvider, currentResource.properties, cleanupFinalSnapshotId, updateReplacePolicy, updateSecrets, oldDeleteRoute.provisionedBy);
+			if (!snapshotBlockedDelete) await this.deleteReplacedAfterCreate(logicalId, oldResourceType, currentResource, oldDeleteProvider, currentResource.properties, cleanupFinalSnapshotId, updateReplacePolicy, updateSecrets, oldDeleteRoute.provisionedBy, noEchoDeleteValues);
 		}
 	}
 	this.registerNoEchoAttributes(logicalId, createResult, updateSecrets, resolvedProps);
@@ -37611,6 +37966,15 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 				secrets: updateSecrets
 			});
 			const createFirst = !retainOldOnReplace && fallbackNameChange !== void 0;
+			const noEchoDeleteValues = await noEchoDeleteValuesFromResolved({
+				record: currentResource,
+				templateResource: template?.Resources?.[logicalId],
+				resolvedProperties: resolvedProps,
+				noEchoParameters: this.noEchoPositionSources(stateResources, template)?.parameters ?? /* @__PURE__ */ new Set(),
+				conditions: this.noEchoConditions,
+				secrets: updateSecrets,
+				inputSources: template && this.maskedInputSources(template, stateResources, this.noEchoConditions, stackName)
+			});
 			this.logger.info(retainOldOnReplace ? `UPDATE not supported for ${logicalId} (${resourceType}), replacing (CREATE only — UpdateReplacePolicy: Retain keeps the old resource)` : createFirst ? safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing (CREATE → DELETE — the new name differs from the old resource's)` : `UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE → CREATE)`);
 			if (retainOldOnReplace) await noteRetainedResource(resourceType, logicalId);
 			if (!retainOldOnReplace && !createFirst) {
@@ -37624,7 +37988,8 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 						...fallbackFinalSnapshotId !== void 0 && { finalSnapshotIdentifier: fallbackFinalSnapshotId },
 						...this.replacementDeleteContext(fallbackUpdateReplacePolicy),
 						recordedAttributes: currentResource.attributes,
-						recordedNoEchoLeaves: currentResource.noEchoLeaves
+						recordedNoEchoLeaves: currentResource.noEchoLeaves,
+						...noEchoDeleteValues !== void 0 && { noEchoDeleteValues }
 					});
 				} catch (deleteError) {
 					const deleteMsg = deleteError instanceof Error ? deleteError.message : String(deleteError);
@@ -37663,7 +38028,8 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 					}),
 					snapshotPolicy: template?.Resources?.[logicalId]?.UpdateReplacePolicy ?? currentResource.updateReplacePolicy,
 					deletePolicy: template?.Resources?.[logicalId]?.UpdateReplacePolicy ?? currentResource.updateReplacePolicy,
-					trigger: "the provisioning layer cannot update it in place"
+					trigger: "the provisioning layer cannot update it in place",
+					noEchoDeleteValues
 				}) : await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replProvider.create(logicalId, resourceType, replProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replProvider);
 			} catch (createError) {
 				if (createFirst) throw createError;
@@ -40067,5 +40433,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { computeParameterTaint as $, isMarkedCoordinate as $a, refuseMalformedResourcePropertiesForDestroy as $i, wouldReturnToSdkProvider as $n, hasReadableExportSet as $o, refStateLookupFromResource as $r, resolveApp as $s, secretNamePrintingBag as $t, beginDeleteWait as A, coerceWarmThroughput as Aa, displayAssemblyPath as Ac, malformedRenderedContainersWarning as Ai, maskingRetryLogger as An, recordNestedStackParameterExpressions as Ao, sendableAssumeRoleCommand as Ar, describeDockerExecFailure as As, removeProtectionTypeList as At, S3_AUTO_DELETE_OBJECTS_TAG as B, replayWarn as Ba, refuseMalformedOrphanRecordsForDestroy as Bi, DBPROXY_TAGS_WHAT as Bn, STATE_SOURCED_CROSS_GENERATION_RULES as Bo, s3BucketWebsiteUrl as Br, redactedDockerCause as Bs, findNestedStackTypeChanges as Bt, recordedProtectionNote as C, findReplacedReadersOfRecreateTargets as Ca, defineOwnKey as Cc, malformedOrphanRecordsRefusalMessage as Ci, noEchoParameterValueSeed as Cn, scrubResourceRecord as Co, producerRegionsFromState as Cr, readBootstrapMarkerBody as Cs, sameJournaledOrphans as Ct, readProtection as D, isStatefulRecreateTargetSync as Da, ownValue as Dc, malformedOrphansWarning as Di, bindingSkippedOutputs as Dn, pathCrossesDottedKey as Do, assertSendableRoleArn as Dr, buildDockerImage as Ds, destroyStackRecordsView as Dt, perType as E, isStatefulRecreateTargetForReplace as Ea, nullPrototypeRecord as Ec, malformedOrphansRefusalMessage as Ei, isExportAliasCollision as En, isUncertifiedBaselineMaskPosition as Eo, assertFlagRoleArn as Er, buildDenyExternalAccessPolicy as Es, awaitInFlightSibling as Et, DELETE_INDEX_WAIT_PROCEED_NOTE as F, coerceCfnInteger as Fa, malformedStateRefusalMessage as Fi, earliestDefined as Fn, recordMaskOnlyValuesIn as Fo, isSettledInstanceState as Fr, getDockerCmd as Fs, isReplacementOrphan as Ft, formatResourceLine as G, templateResourceTypes as Ga, refuseMalformedOutputsForDestroy as Gi, tagMapAsList as Gn, LockManager as Go, isImpossibleEmptyStoredAttribute as Gr, stripControlChars as Gs, redactedDeleteAddressFields as Gt, isTruthyCfnBoolean as H, requireConfigObject as Ha, refuseMalformedOrphansForDestroy as Hi, planTagDiff as Hn, TEMPLATE_SOURCED_RULES as Ho, isUnboundTemplateParameter as Hr, runDockerStreaming as Hs, inheritProducerRegions as Ht, INDEX_SETTLE_POLL_INTERVAL_MS as I, configBooleanRefusal as Ia, previewableOrphanRecords as Ii, ledgerForStack as In, recordNoEchoAttributeValues as Io, s3BucketArn as Ir, isDockerClientEnvKey as Is, planFailedOps as It, cyan as J, canonicalLambdaFunctionName as Ja, refuseMalformedResourceEntriesForDeploy as Ji, stringifyIfAssigned as Jn, rebuildClientForBucketRegion as Jo, isNamelessDynamicReferenceError as Jr, Synthesizer as Js, updatePartialReason as Jt, createReadOnlyAttributeHealerFactory as K, describeTypeWithThrottleRetry as Ka, refuseMalformedResourceAttributesForOrphan as Ki, tagPlanWarning as Kn, isLockInfoExpired as Ko, carriesDynamicReference as Kr, AssetManifestLoader as Ks, redactedDeleteAddressSkip as Kt, deleteTableWithIndexBusyRetry as L, configIntegerRefusal as La, refuseDivergentRecordRegionForDestroy as Li, reserveStackCreateToken as Ln, recordProvenPublicExpression as Lo, s3BucketDomainName as Lr, isMalformedEnvKey as Ls, planRollback as Lt, deleteBudgetKey as M, toCfnInteger as Ma, resolveAssemblyPath as Mc, malformedResourcePropertiesWarning as Mi, findDestructiveChanges as Mn, carriesSecretMask as Mo, applyCallerIdentityCredentials as Mr, dockerSpawnEnvWithSensitive as Ms, recordAfterRollbackUpdate as Mt, resolveDynamoDbDeleteBudgetClock as N, toFiniteNumber as Na, clearBucketRegionCache as Nc, malformedResourcesWarning as Ni, formatDestructiveChange as Nn, provenPublicValue as No, callerEnvCredentials as Nr, finchSecretArgvRefusal as Ns, demoteSupersededOrphans as Nt, DynamoDBGlobalTableProvider as O, renderStatefulReason as Oa, absoluteAssemblyPathEscape as Oc, malformedOutputsRefusalMessage as Oi, DEFAULT_RESOURCE_TIMEOUT_MS as On, identityKeyFor as Oo, explicitRoleArnOrThrow as Or, resolveDockerContextDirectory as Os, getStackRecords as Ot, resolveDynamoDbDeleteBudgetMs as P, coerceCfnBoolean as Pa, resolveBucketRegion as Pc, malformedScrubResourceEntriesRefusalMessage as Pi, RollbackInlinePolicyWriters as Pn, recordMaskOnlyValue as Po, envCredentialsAreAssumedRole as Pr, formatDockerLoginError as Ps, isJournaledOrphan as Pt, yellow as Q, TemplateParser as Qa, refuseMalformedResourceEntriesForOrphan as Qi, isCustomResource as Qn, exportNamesCarriedFrom as Qo, isStalePlaceholderArnAttribute as Qr, loadCdkJson as Qs, orphanRecordsPrintingBag as Qt, waitForIndexesSettled as R, configStringRefusal as Ra, refuseMalformedNestedChildOutputs as Ri, withCreateTokenLedger as Rn, wholeStringLeavesOf as Ro, s3BucketDualStackDomainName as Rr, partitionSensitiveEnv as Rs, replacementNeverSwapped as Rt, recordedProtectionEvidence as S, hasNoCloudControlHandlers as Sa, processStackMessages as Sc, malformedLocalResourcesWarning as Si, isWholeDynamicReferenceValue as Sn, redactSecretsForState as So, classifyReplaySecretRegion as Sr, parseBootstrapMarker as Ss, makeForeignHolderScan as St, isProtectionValueActive as T, MULTI_REGION_RECREATE_BLOCKED_TYPES as Ta, hasPlainPrototype$1 as Tc, malformedOrphanRowsKeptWarning as Ti, collectPublishedOutputNames as Tn, dynamicReferenceTokens as To, applyRoleArnIfSet as Tr, validateContainerRepoName as Ts, replayRollback as Tt, getPriorAttempts as U, requireConfigString as Ua, refuseMalformedOrphansForOrphan as Ui, readTagList as Un, WHOLE_DYNAMIC_REFERENCE_PATTERN as Uo, parameterTypeMayLoseSecretIdentity as Ur, warnFinchArgvExposure as Us, REDACTED_DELETE_ADDRESS_SKIP_REASON as Ut, hasCdkAutoDeleteTag as V, requireConfigArray as Va, refuseMalformedOrphans as Vi, DBPROXY_TAG_OPTIONS as Vn, STATE_SOURCED_READBACK_RULES as Vo, coerceParameterTypedValue as Vr, runDockerForeground as Vs, getCurrentProducerRegions as Vt, markRefusedBeforeApplying as W, prefetchCreateOnlyPropertyPaths as Wa, refuseMalformedOutputs as Wi, refuseMalformedDesiredTags as Wn, isSingleDynamicReferenceToken as Wo, getAccountInfo as Wr, escapeRegExp$3 as Ws, isRedactedRecordedValue as Wt, green as X, sameLambdaFunctionAddress as Xa, refuseMalformedResourceEntriesForImport as Xi, ProviderRegistry as Xn, acceptedCreateOnlyDropsOf as Xo, AWS_NO_VALUE as Xr, getDefaultStateBucketName as Xs, journaledOrphanPrintingBag as Xt, gray as Y, lambdaFunctionNameForMask as Ya, refuseMalformedResourceEntriesForDestroy as Yi, CC_BROKEN_REASON as Yn, splitImportedOps as Yo, keepsSecretReferenceToken as Yr, synthesisStatusMessage as Ys, completedReplayEntries as Yt, red as Z, DagBuilder as Za, refuseMalformedResourceEntriesForImportSave as Zi, ccBrokenReason as Zn, describeRegionValueKind as Zo, cfnRefValueFromPhysicalId as Zr, getLegacyStateBucketName as Zs, maskEventTextWithBoundBags as Zt, makeCanonicalizePropertiesFn as _, findActionableSilentDrops as _a, PARTITION_TABLE as _c, malformedDriftResourcePropertiesWarning as _i, secretBearingStateKeyWarning as _n, createSecretMasker as _o, reEnableInstanceApiTermination as _r, BOOTSTRAP_MARKER_PREFIX as _s, deleteJournaledOrphans as _t, findNestedTemplateTreeDefect as a, refuseMalformedResourcesForExport as aa, resolveUseCdkBootstrapAssets as ac, STATE_REGION_DIVERGED as ai, createPreDeleteFinalSnapshot as an, passedNoEchoParametersOf as ao, unchangedBehindSecretReference as ar, orphansAfterRollback as as, NESTED_PENDING_PARENT_REASON as at, noEchoComparisonForTemplate as b, withoutSilentDropProperties as ba, AssemblyReader as bc, malformedLocalOutputsWarning as bi, exportNameNoEchoParameters as bn, maskSecretsInText as bo, IntrinsicFunctionResolver as br, getBootstrapMarkerKey as bs, journaledOrphanLines as bt, renderNestedTemplateTreeDefect as c, repairMalformedOrphansForReadOnly as ca, ssmResolvedValueType as cc, UNREADABLE_RESOURCES_MAP_ROW as ci, refusesFinalSnapshot as cn, carryLogOnlyValues as co, deleteSkipReason as cr, AssetPublisher as cs, dropSettledNestedJournals as ct, conditionInputsFrom as d, repairMalformedResourcePropertiesForReadOnly as da, MIGRATE_TMP_PREFIX as dc, displayLogicalId as di, DeploymentEventsStore as dn, literalSplitDelimitersOf as do, markWaitAbandoned as dr, WorkGraph as ds, recordDisplacedSkips as dt, refuseMalformedResourcePropertiesForDrift as ea, resolveAutoAssetStorage as ec, parseWebACLArn as ei, stateSecretNameNeedles as en, maskReadbackAtCoordinates as eo, isCustomResourceType as er, hasReasonlessBaselineRefusal as es, namesAnyDeclaredParameter as et, parentSuppliedValues as f, repairMalformedResourcesForReadOnly as fa, findLargeInlineResources as fc, hasReadableOrphans as fi, extractDeploymentEventError as fn, logOnlyValueCount as fo, disableInstanceApiTermination as fr, buildAssetRedirectMap as fs, revertNestedChildFromJournal as ft, mergeNoChangeOutputs as g, withheldAccountClause as ga, expectedOwnerParam as gc, isReadableResourceEntry as gi, secretBearing as gn, shareLogOnlyValues as go, reDisableInstanceApiTermination as gr, AssetModeResolver as gs, withNestedStackContext as gt, keptWholeReasonText as h, unreadableResourceEntries as ha, decodeListingKey as hc, isReadableOrphanRecord as hi, exportAliasCollisionScrubWarning as hn, recordLogOnlyValue as ho, observeThenDisableInstanceApiTermination as hr, rewriteTemplateAssetReferences as hs, getCurrentNestedStackContext as ht, childTemplateLoader as i, refuseMalformedResourcesForDestroy as ia, resolveStateBucketWithDefaultAndSource as ic, JSON_LISTING_HOLE_VALUE as ii, ccRoutedFinalSnapshotError as in, noEchoOutputsComparison as io, slowCcOperationTimeoutMs as ir, isReadableBag as is, planOrphanAdoption as it, compensateRemovedDeletionProtection as j, isWarmThroughputDecrease as ja, renderAssemblyPathEscape as jc, malformedResourceEntriesWarning as ji, constructPathOf as jn, recoverMaskedOutput as jo, AWS_CREDENTIAL_ENV_KEYS as jr, describeDockerFailure as js, orphanDeleteNeedsIdentity as jt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as k, WARM_THROUGHPUT_MEMBERS as ka, describeFileReadFailure as kc, malformedOutputsWarning as ki, DEFAULT_RESOURCE_WARN_AFTER_MS as kn, inheritNestedStackParameterAssociations as ko, isIamRoleArn as kr, describeDockerCapturedOutput as ks, withStackRecords as kt, templateIdentity as l, repairMalformedOutputsForReadOnly as la, CFN_TEMPLATE_BODY_LIMIT as lc, accountArgs as li, unsupportedFinalSnapshotError as ln, createUnionSecretMasker as lo, withIndeterminateGuard as lr, isSensitiveAttributeName as ls, getNestedRevertRun as lt, isSecretBearingReferenceString as m, unreadableOrphanRecords as ma, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as mc, hasReadableResources as mi, displayTextOrWithheld as mn, recordLogOnlyParameterValue as mo, isTerminationProtectionPropagationError as mr, loadPublishableAssetManifest as ms, withNestedRevertRun as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedResourcePropertiesForOrphan as na, resolveSkipPrefix as nc, parameterInputsFor as ni, PRE_DELETE_SNAPSHOT_TYPES as nn, maskedLeafCoordinatesOf as no, withPrintingSecrets as nr, importableOutputKeys as ns, resourcesNamingDeclaredParameter as nt, isAbsoluteAssetPath as o, refuseMalformedState as oa, stateBucketExistenceConfirmed as oc, STATE_RESOURCES_MALFORMED as oi, effectiveDeletionPolicy as on, readsNoEchoSource as oo, UNSPECIFIED_SKIP_REASON as or, orphansCarriedFrom as os, displacedOpClause as ot, readRecordedConditionVerdicts as p, unpreviewableOrphanRecords as pa, uploadCfnTemplate as pc, hasReadableOutputs as pi, WITHHELD_NAME_DISPLAY as pn, printingCorpusOf as po, ec2InstanceProtectionSite as pr, createAssetRedirectResolver as ps, revertedNestedRowIds as pt, bold as q, withRetry as qa, refuseMalformedResourceEntries as qi, definedAttributes as qn, S3StateBackend as qo, carriesFetchableDynamicReference as qr, getDockerImageBySourceHash as qs, updatePartialMessage as qt, computeImplicitDeleteEdges as r, refuseMalformedResourcesForDeploy as ra, resolveStateBucketWithDefault as rc, passedParameterClassesOf as ri, buildFinalSnapshotIdentifier as rn, noEchoLeavesOf as ro, CloudControlProvider as rr, importableOutputs as rs, makeSiblingClaimReader as rt, listNestedTemplateRows as s, repairMalformedOrphanRecordsForReadOnly as sa, warnDeprecatedNoPrefixCliFlag as sc, UNREADABLE_ORPHANS_CONTAINER_ROW as si, isFinalSnapshotError as sn, liveMatchesUnresolvedTokenFrame as so, deleteIndeterminateGuards as sr, shouldRetainResource as ss, displacedPhysicalIdShown as st, DeployEngine as t, refuseMalformedResourcePropertiesForExport as ta, resolveCaptureObservedState as tc, withSharedDrainBudget as ti, ATOMIC_FINAL_SNAPSHOT_TYPES as tn, maskWholeValue as to, getCurrentResourceSecrets as tr, hasUnverifiableParameterRefusal as ts, reachableDivergentParameters as tt, conditionFingerprint as u, repairMalformedResourceEntriesForReadOnly as ua, CFN_TEMPLATE_URL_LIMIT as uc, deployRefusesOrphanRowsReason as ui, DeploymentEventsReader as un, hasMaskableValues as uo, isWaitAbandonedError as ur, stringifyValue as us, nestedChildStackName as ut, withResourceDeadline as v, findSilentDropProperties as va, canonicalizeRegion as vc, malformedExportNamesWarning as vi, secretSafeKeyDisplay as vn, errorCauseChain as vo, DiffCalculator as vr, assertAssetBucketRegion as vs, dropFailedHint as vt, PROTECTION_PROPERTY_BY_TYPE as w, shownType as wa, hasOwnKey as wc, malformedOrphanRecordsWarning as wi, collectDeclaredOutputNames as wn, DYNAMIC_REFERENCE_TOKEN_SCAN as wo, regionLessSecretName as wr, validateAssetBucketName as ws, replayFailedOperations as wt, noEchoParameterNamesOf as x, NO_CC_HANDLERS_REASON as xa, StageLoadError as xc, malformedLocalResourceEntriesWarning as xi, exportNameSecretExposure as xn, markSameGenerationBag as xo, poisonRenderedSpellingsCollidingIn as xr, isCrossRegionRedirect as xs, loadJournaledOrphans as xt, noEchoAttributeNamesOf as y, unwrittenCreateOnlyReplacement as ya, derivePartitionAndUrlSuffix as yc, malformedExportSourceWarning as yi, carriedExportAliasExposure as yn, maskSecretsInError as yo, INTRINSIC_KEYS as yr, ensureAssetStorage as ys, isHandledOrphan as yt, ECR_AUTO_DELETE_IMAGES_TAG as z, readConfigString as za, refuseMalformedOrphanRecords as zi, acquireIdempotencyToken as zn, STATE_SOURCED_BASELINE_RULES as zo, s3BucketRegionalDomainName as zr, redactDockerArgvValues as zs, resolveReplacementOldType as zt };
-//# sourceMappingURL=deploy-engine-DFGqFKxg.js.map
+export { computeParameterTaint as $, DagBuilder as $a, refuseMalformedResourceEntriesForImportSave as $i, wouldReturnToSdkProvider as $n, describeRegionValueKind as $o, cfnRefValueFromPhysicalId as $r, getLegacyStateBucketName as $s, secretNamePrintingBag as $t, beginDeleteWait as A, renderStatefulReason as Aa, absoluteAssemblyPathEscape as Ac, malformedOutputsRefusalMessage as Ai, maskingRetryLogger as An, identityKeyFor as Ao, explicitRoleArnOrThrow as Ar, resolveDockerContextDirectory as As, removeProtectionTypeList as At, S3_AUTO_DELETE_OBJECTS_TAG as B, configStringRefusal as Ba, refuseMalformedNestedChildOutputs as Bi, DBPROXY_TAGS_WHAT as Bn, wholeStringLeavesOf as Bo, s3BucketDualStackDomainName as Br, partitionSensitiveEnv as Bs, findNestedStackTypeChanges as Bt, recordedProtectionNote as C, NO_CC_HANDLERS_REASON as Ca, StageLoadError as Cc, malformedLocalResourceEntriesWarning as Ci, noEchoParameterValueSeed as Cn, markSameGenerationBag as Co, poisonRenderedSpellingsCollidingIn as Cr, isCrossRegionRedirect as Cs, sameJournaledOrphans as Ct, readProtection as D, MULTI_REGION_RECREATE_BLOCKED_TYPES as Da, hasPlainPrototype$1 as Dc, malformedOrphanRowsKeptWarning as Di, bindingSkippedOutputs as Dn, dynamicReferenceTokens as Do, applyRoleArnIfSet as Dr, validateContainerRepoName as Ds, destroyStackRecordsView as Dt, perType as E, shownType as Ea, hasOwnKey as Ec, malformedOrphanRecordsWarning as Ei, isExportAliasCollision as En, DYNAMIC_REFERENCE_TOKEN_SCAN as Eo, regionLessSecretName as Er, validateAssetBucketName as Es, awaitInFlightSibling as Et, DELETE_INDEX_WAIT_PROCEED_NOTE as F, toFiniteNumber as Fa, clearBucketRegionCache as Fc, malformedResourcesWarning as Fi, earliestDefined as Fn, provenPublicValue as Fo, callerEnvCredentials as Fr, finchSecretArgvRefusal as Fs, isReplacementOrphan as Ft, formatResourceLine as G, requireConfigString as Ga, refuseMalformedOrphansForOrphan as Gi, tagMapAsList as Gn, WHOLE_DYNAMIC_REFERENCE_PATTERN as Go, parameterTypeMayLoseSecretIdentity as Gr, warnFinchArgvExposure as Gs, redactedDeleteAddressFields as Gt, isTruthyCfnBoolean as H, replayWarn as Ha, refuseMalformedOrphanRecordsForDestroy as Hi, planTagDiff as Hn, STATE_SOURCED_CROSS_GENERATION_RULES as Ho, s3BucketWebsiteUrl as Hr, redactedDockerCause as Hs, inheritProducerRegions as Ht, INDEX_SETTLE_POLL_INTERVAL_MS as I, coerceCfnBoolean as Ia, resolveBucketRegion as Ic, malformedScrubResourceEntriesRefusalMessage as Ii, ledgerForStack as In, recordMaskOnlyValue as Io, envCredentialsAreAssumedRole as Ir, formatDockerLoginError as Is, planFailedOps as It, cyan as J, describeTypeWithThrottleRetry as Ja, refuseMalformedResourceAttributesForOrphan as Ji, stringifyIfAssigned as Jn, isLockInfoExpired as Jo, carriesDynamicReference as Jr, AssetManifestLoader as Js, updatePartialReason as Jt, createReadOnlyAttributeHealerFactory as K, prefetchCreateOnlyPropertyPaths as Ka, refuseMalformedOutputs as Ki, tagPlanWarning as Kn, isSingleDynamicReferenceToken as Ko, getAccountInfo as Kr, escapeRegExp$3 as Ks, redactedDeleteAddressSkip as Kt, deleteTableWithIndexBusyRetry as L, coerceCfnInteger as La, malformedStateRefusalMessage as Li, reserveStackCreateToken as Ln, recordMaskOnlyValuesIn as Lo, isSettledInstanceState as Lr, getDockerCmd as Ls, planRollback as Lt, deleteBudgetKey as M, coerceWarmThroughput as Ma, displayAssemblyPath as Mc, malformedRenderedContainersWarning as Mi, findDestructiveChanges as Mn, recordNestedStackParameterExpressions as Mo, sendableAssumeRoleCommand as Mr, describeDockerExecFailure as Ms, recordAfterRollbackUpdate as Mt, resolveDynamoDbDeleteBudgetClock as N, isWarmThroughputDecrease as Na, renderAssemblyPathEscape as Nc, malformedResourceEntriesWarning as Ni, formatDestructiveChange as Nn, recoverMaskedOutput as No, AWS_CREDENTIAL_ENV_KEYS as Nr, describeDockerFailure as Ns, demoteSupersededOrphans as Nt, DynamoDBGlobalTableProvider as O, isStatefulRecreateTargetForReplace as Oa, nullPrototypeRecord as Oc, malformedOrphansRefusalMessage as Oi, DEFAULT_RESOURCE_TIMEOUT_MS as On, isUncertifiedBaselineMaskPosition as Oo, assertFlagRoleArn as Or, buildDenyExternalAccessPolicy as Os, getStackRecords as Ot, resolveDynamoDbDeleteBudgetMs as P, toCfnInteger as Pa, resolveAssemblyPath as Pc, malformedResourcePropertiesWarning as Pi, RollbackInlinePolicyWriters as Pn, carriesSecretMask as Po, applyCallerIdentityCredentials as Pr, dockerSpawnEnvWithSensitive as Ps, isJournaledOrphan as Pt, yellow as Q, sameLambdaFunctionAddress as Qa, refuseMalformedResourceEntriesForImport as Qi, isCustomResource as Qn, acceptedCreateOnlyDropsOf as Qo, AWS_NO_VALUE as Qr, getDefaultStateBucketName as Qs, orphanRecordsPrintingBag as Qt, waitForIndexesSettled as R, configBooleanRefusal as Ra, previewableOrphanRecords as Ri, withCreateTokenLedger as Rn, recordNoEchoAttributeValues as Ro, s3BucketArn as Rr, isDockerClientEnvKey as Rs, replacementNeverSwapped as Rt, recordedProtectionEvidence as S, withoutSilentDropProperties as Sa, AssemblyReader as Sc, malformedLocalOutputsWarning as Si, isWholeDynamicReferenceValue as Sn, maskSecretsInText as So, IntrinsicFunctionResolver as Sr, getBootstrapMarkerKey as Ss, makeForeignHolderScan as St, isProtectionValueActive as T, findReplacedReadersOfRecreateTargets as Ta, defineOwnKey as Tc, malformedOrphanRecordsRefusalMessage as Ti, collectPublishedOutputNames as Tn, scrubResourceRecord as To, producerRegionsFromState as Tr, readBootstrapMarkerBody as Ts, replayRollback as Tt, getPriorAttempts as U, requireConfigArray as Ua, refuseMalformedOrphans as Ui, readTagList as Un, STATE_SOURCED_READBACK_RULES as Uo, coerceParameterTypedValue as Ur, runDockerForeground as Us, REDACTED_DELETE_ADDRESS_SKIP_REASON as Ut, hasCdkAutoDeleteTag as V, readConfigString as Va, refuseMalformedOrphanRecords as Vi, DBPROXY_TAG_OPTIONS as Vn, STATE_SOURCED_BASELINE_RULES as Vo, s3BucketRegionalDomainName as Vr, redactDockerArgvValues as Vs, getCurrentProducerRegions as Vt, markRefusedBeforeApplying as W, requireConfigObject as Wa, refuseMalformedOrphansForDestroy as Wi, refuseMalformedDesiredTags as Wn, TEMPLATE_SOURCED_RULES as Wo, isUnboundTemplateParameter as Wr, runDockerStreaming as Ws, isRedactedRecordedValue as Wt, green as X, canonicalLambdaFunctionName as Xa, refuseMalformedResourceEntriesForDeploy as Xi, ProviderRegistry as Xn, rebuildClientForBucketRegion as Xo, isNamelessDynamicReferenceError as Xr, Synthesizer as Xs, journaledOrphanPrintingBag as Xt, gray as Y, withRetry as Ya, refuseMalformedResourceEntries as Yi, CC_BROKEN_REASON as Yn, S3StateBackend as Yo, carriesFetchableDynamicReference as Yr, getDockerImageBySourceHash as Ys, completedReplayEntries as Yt, red as Z, lambdaFunctionNameForMask as Za, refuseMalformedResourceEntriesForDestroy as Zi, ccBrokenReason as Zn, splitImportedOps as Zo, keepsSecretReferenceToken as Zr, synthesisStatusMessage as Zs, maskEventTextWithBoundBags as Zt, makeCanonicalizePropertiesFn as _, unreadableResourceEntries as _a, decodeListingKey as _c, isReadableOrphanRecord as _i, secretBearingStateKeyWarning as _n, recordLogOnlyValue as _o, observeThenDisableInstanceApiTermination as _r, rewriteTemplateAssetReferences as _s, deleteJournaledOrphans as _t, findNestedTemplateTreeDefect as a, refuseMalformedResourcesForDeploy as aa, resolveStateBucketWithDefault as ac, passedParameterClassesOf as ai, createPreDeleteFinalSnapshot as an, noEchoLeavesOf as ao, CloudControlProvider as ar, importableOutputs as as, NESTED_PENDING_PARENT_REASON as at, noEchoComparisonForTemplate as b, findSilentDropProperties as ba, canonicalizeRegion as bc, malformedExportNamesWarning as bi, exportNameNoEchoParameters as bn, errorCauseChain as bo, DiffCalculator as br, assertAssetBucketRegion as bs, journaledOrphanLines as bt, renderNestedTemplateTreeDefect as c, refuseMalformedState as ca, stateBucketExistenceConfirmed as cc, STATE_RESOURCES_MALFORMED as ci, refusesFinalSnapshot as cn, readsNoEchoSource as co, UNSPECIFIED_SKIP_REASON as cr, orphansCarriedFrom as cs, dropSettledNestedJournals as ct, conditionInputsFrom as d, repairMalformedOutputsForReadOnly as da, CFN_TEMPLATE_BODY_LIMIT as dc, accountArgs as di, DeploymentEventsStore as dn, createUnionSecretMasker as do, withIndeterminateGuard as dr, isSensitiveAttributeName as ds, recordDisplacedSkips as dt, refuseMalformedResourceEntriesForOrphan as ea, loadCdkJson as ec, isStalePlaceholderArnAttribute as ei, stateSecretNameNeedles as en, TemplateParser as eo, TemplateNoEchoReresolver as er, exportNamesCarriedFrom as es, namesAnyDeclaredParameter as et, parentSuppliedValues as f, repairMalformedResourceEntriesForReadOnly as fa, CFN_TEMPLATE_URL_LIMIT as fc, deployRefusesOrphanRowsReason as fi, extractDeploymentEventError as fn, hasMaskableValues as fo, isWaitAbandonedError as fr, stringifyValue as fs, revertNestedChildFromJournal as ft, mergeNoChangeOutputs as g, unreadableOrphanRecords as ga, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as gc, hasReadableResources as gi, secretBearing as gn, recordLogOnlyParameterValue as go, isTerminationProtectionPropagationError as gr, loadPublishableAssetManifest as gs, withNestedStackContext as gt, keptWholeReasonText as h, unpreviewableOrphanRecords as ha, uploadCfnTemplate as hc, hasReadableOutputs as hi, exportAliasCollisionScrubWarning as hn, printingCorpusOf as ho, ec2InstanceProtectionSite as hr, createAssetRedirectResolver as hs, getCurrentNestedStackContext as ht, childTemplateLoader as i, refuseMalformedResourcePropertiesForOrphan as ia, resolveSkipPrefix as ic, parameterInputsFor as ii, ccRoutedFinalSnapshotError as in, maskedLeafCoordinatesOf as io, withPrintingSecrets as ir, importableOutputKeys as is, planOrphanAdoption as it, compensateRemovedDeletionProtection as j, WARM_THROUGHPUT_MEMBERS as ja, describeFileReadFailure as jc, malformedOutputsWarning as ji, constructPathOf as jn, inheritNestedStackParameterAssociations as jo, isIamRoleArn as jr, describeDockerCapturedOutput as js, orphanDeleteNeedsIdentity as jt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as k, isStatefulRecreateTargetSync as ka, ownValue as kc, malformedOrphansWarning as ki, DEFAULT_RESOURCE_WARN_AFTER_MS as kn, pathCrossesDottedKey as ko, assertSendableRoleArn as kr, buildDockerImage as ks, withStackRecords as kt, templateIdentity as l, repairMalformedOrphanRecordsForReadOnly as la, warnDeprecatedNoPrefixCliFlag as lc, UNREADABLE_ORPHANS_CONTAINER_ROW as li, unsupportedFinalSnapshotError as ln, liveMatchesUnresolvedTokenFrame as lo, deleteIndeterminateGuards as lr, shouldRetainResource as ls, getNestedRevertRun as lt, isSecretBearingReferenceString as m, repairMalformedResourcesForReadOnly as ma, findLargeInlineResources as mc, hasReadableOrphans as mi, displayTextOrWithheld as mn, logOnlyValueCount as mo, disableInstanceApiTermination as mr, buildAssetRedirectMap as ms, withNestedRevertRun as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedResourcePropertiesForDrift as na, resolveAutoAssetStorage as nc, parseWebACLArn as ni, PRE_DELETE_SNAPSHOT_TYPES as nn, maskReadbackAtCoordinates as no, isCustomResourceType as nr, hasReasonlessBaselineRefusal as ns, resourcesNamingDeclaredParameter as nt, isAbsoluteAssetPath as o, refuseMalformedResourcesForDestroy as oa, resolveStateBucketWithDefaultAndSource as oc, JSON_LISTING_HOLE_VALUE as oi, effectiveDeletionPolicy as on, noEchoOutputsComparison as oo, slowCcOperationTimeoutMs as or, isReadableBag as os, displacedOpClause as ot, readRecordedConditionVerdicts as p, repairMalformedResourcePropertiesForReadOnly as pa, MIGRATE_TMP_PREFIX as pc, displayLogicalId as pi, WITHHELD_NAME_DISPLAY as pn, literalSplitDelimitersOf as po, markWaitAbandoned as pr, WorkGraph as ps, revertedNestedRowIds as pt, bold as q, templateResourceTypes as qa, refuseMalformedOutputsForDestroy as qi, definedAttributes as qn, LockManager as qo, isImpossibleEmptyStoredAttribute as qr, stripControlChars as qs, updatePartialMessage as qt, computeImplicitDeleteEdges as r, refuseMalformedResourcePropertiesForExport as ra, resolveCaptureObservedState as rc, withSharedDrainBudget as ri, buildFinalSnapshotIdentifier as rn, maskWholeValue as ro, getCurrentResourceSecrets as rr, hasUnverifiableParameterRefusal as rs, makeSiblingClaimReader as rt, listNestedTemplateRows as s, refuseMalformedResourcesForExport as sa, resolveUseCdkBootstrapAssets as sc, STATE_REGION_DIVERGED as si, isFinalSnapshotError as sn, passedNoEchoParametersOf as so, unchangedBehindSecretReference as sr, orphansAfterRollback as ss, displacedPhysicalIdShown as st, DeployEngine as t, refuseMalformedResourcePropertiesForDestroy as ta, resolveApp as tc, refStateLookupFromResource as ti, ATOMIC_FINAL_SNAPSHOT_TYPES as tn, isMarkedCoordinate as to, readsNoEchoDeleteValues as tr, hasReadableExportSet as ts, reachableDivergentParameters as tt, conditionFingerprint as u, repairMalformedOrphansForReadOnly as ua, ssmResolvedValueType as uc, UNREADABLE_RESOURCES_MAP_ROW as ui, DeploymentEventsReader as un, carryLogOnlyValues as uo, deleteSkipReason as ur, AssetPublisher as us, nestedChildStackName as ut, withResourceDeadline as v, withheldAccountClause as va, expectedOwnerParam as vc, isReadableResourceEntry as vi, secretSafeKeyDisplay as vn, shareLogOnlyValues as vo, reDisableInstanceApiTermination as vr, AssetModeResolver as vs, dropFailedHint as vt, PROTECTION_PROPERTY_BY_TYPE as w, hasNoCloudControlHandlers as wa, processStackMessages as wc, malformedLocalResourcesWarning as wi, collectDeclaredOutputNames as wn, redactSecretsForState as wo, classifyReplaySecretRegion as wr, parseBootstrapMarker as ws, replayFailedOperations as wt, noEchoParameterNamesOf as x, unwrittenCreateOnlyReplacement as xa, derivePartitionAndUrlSuffix as xc, malformedExportSourceWarning as xi, exportNameSecretExposure as xn, maskSecretsInError as xo, INTRINSIC_KEYS as xr, ensureAssetStorage as xs, loadJournaledOrphans as xt, noEchoAttributeNamesOf as y, findActionableSilentDrops as ya, PARTITION_TABLE as yc, malformedDriftResourcePropertiesWarning as yi, carriedExportAliasExposure as yn, createSecretMasker as yo, reEnableInstanceApiTermination as yr, BOOTSTRAP_MARKER_PREFIX as ys, isHandledOrphan as yt, ECR_AUTO_DELETE_IMAGES_TAG as z, configIntegerRefusal as za, refuseDivergentRecordRegionForDestroy as zi, acquireIdempotencyToken as zn, recordProvenPublicExpression as zo, s3BucketDomainName as zr, isMalformedEnvKey as zs, resolveReplacementOldType as zt };
+//# sourceMappingURL=deploy-engine-CFgNpsEy.js.map