@go-to-k/cdkd 0.296.22 → 0.296.24

package/dist/{deploy-engine-BueFQdfN.js → deploy-engine-4vPufRQF.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js"
 import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
 import { $ as protectedReplacementAdvice, $n as isIamPropagationError, $t as AccountIdUnavailableError, A as isQuotableImportValue, An as commandHole, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bt as sanitizeRecoveryValue, Ct as RETRY_AUXILIARY_OWNER, Dn as SHELL_ACTIVE, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as plainOrDescribed, G as runDeleteAttempt, Gn as isNameCooldownError, H as observeThenDisableProtection, Hn as isUpdateUnsupportedError, Ht as DEFAULT_STATE_PREFIX, In as quotedOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jt as withPasteableAwsProfile, Kn as isRecreateRetryableError, Kt as producerRecordKey, L as ProtectionFlipRegistry, Ln as shellBoundedDisplay, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mn as isInertUnquoted, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as pasteableCommand, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE_WHY, Ot as hasCreatedBeforeFailure, Pn as physicalIdShownBesideCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, R as compensateProtectionFlip, Rn as shellQuote, Rt as formatLockOperation, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Un as hasReplayMayCollide, Ut as injectiveKey, Vt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Wn as isNameCollisionErrorFrom, Xn as formatRetryClassificationSignals, Xt as ambientCredentialConfig, Yn as markReplayMayCollide, Yt as ambientClientDefaults, Zn as isAmbiguousCcHandlerErrorCode, Zt as clientDefaultsFor, _n as ResourceUpdateNotSupportedError, _t as createMaskedLogSinks, ar as isThrottlingError, at as startInterruptWatch, bn as StateError, bt as maskDeep, cr as wrapMaskedAwsError, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as MacroExpansionError, en as AssetError, er as isRetryableTransientError, f as removalWarning, fn as MalformedProducerRecordRefusalError, ft as logicalIdShown, gn as ResourceTimeoutError, gt as stateOrphanRecordRemedy, hn as ProvisioningError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as DependencyError, ir as isMarkedNonRetryable, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, kn as UNSHOWABLE_VALUE, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, m as withoutInjectedRemovals, mt as resourceTypeShown, nr as retryClassificationText, on as DynamicReferenceRegionAmbiguousError, or as markNonRetryable, ot as ElapsedBudgetRegistry, qn as isReplayedNameCollisionFrom, rn as CrossAccountSecretRefusalError, sn as IntrinsicResolutionRefusalError, sr as markRedactedCause, st as monotonicNowMs, tn as CdkdError, tr as isTransientServerError, un as LockError, ut as compositeIdSeparatorRefusal, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as normalizeAwsError, wt as carryCreatedBeforeFailure, xn as SynthesisError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as withheldTargetClause, zt as formatLockOwner } from "./iam-policy-targets-BoZuWtxK.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-COXjPf3D.js";
+import { t as getCdkdVersion } from "./version-3oP5vNZF.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -16721,7 +16721,7 @@ function isPlainObject$2(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 const DYNAMIC_REFERENCE_OPEN = "{{resolve:";
-const NESTED_STACK_TYPE$3 = "AWS::CloudFormation::Stack";
+const NESTED_STACK_TYPE$4 = "AWS::CloudFormation::Stack";
 const NESTED_OUTPUT_PREFIX = "Outputs.";
 function carriesSecretValue(value, corpora) {
 	if (carriesSecretMask(value)) return true;
@@ -16796,7 +16796,7 @@ function intrinsicKey(value) {
 	const key = keys[0];
 	return key === "Ref" || key.startsWith("Fn::") ? key : void 0;
 }
-const OPAQUE_ATTRIBUTE_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::CustomResource", NESTED_STACK_TYPE$3]);
+const OPAQUE_ATTRIBUTE_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::CustomResource", NESTED_STACK_TYPE$4]);
 function hasOpaqueAttributes(logicalId, walk) {
 	const definition = walk.resources[logicalId];
 	const type = isPlainObject$2(definition) ? definition["Type"] : void 0;
@@ -17153,7 +17153,7 @@ function passedKey(passed) {
 function isNestedStackRow(logicalId, walk) {
 	if (!Object.hasOwn(walk.resources, logicalId)) return false;
 	const definition = walk.resources[logicalId];
-	return isPlainObject$2(definition) && definition["Type"] === NESTED_STACK_TYPE$3;
+	return isPlainObject$2(definition) && definition["Type"] === NESTED_STACK_TYPE$4;
 }
 function getAttAttribute(operand, target) {
 	if (Array.isArray(operand)) return operand.length === 2 && typeof operand[1] === "string" ? operand[1] : void 0;
@@ -22952,7 +22952,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BYk2trWp.js");
+			const { ASGProvider } = await import("./asg-provider-DCYx2kox.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -23058,7 +23058,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-Cc9l4-JW.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-7hDILb3t.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-L9YFKmdl.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DjuYQyyG.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -24259,7 +24259,7 @@ const CR_NO_SERVICE_TOKEN_SKIP_REASON = "no ServiceToken in state — Delete han
 const CR_MASKED_SERVICE_TOKEN_SKIP_REASON = "masked ServiceToken in state — Delete handler not invoked";
 const CR_NOECHO_PROPERTIES_SKIP_REASON = "NoEcho mask in recorded properties — Delete handler not invoked";
 const CR_MASKED_PROPERTIES_SKIP_REASON = "redaction mask in properties — Delete handler not invoked";
-const NOECHO_RERESOLUTION_BOUND = "cdkd re-resolves such a coordinate only where it holds the template ('cdkd destroy' with the app), and only while today's template reads a NoEcho parameter there with the property's text and inputs unchanged; an attribute a producer declared NoEcho has no template value to re-resolve.";
+const NOECHO_RERESOLUTION_BOUND = "cdkd re-resolves such a coordinate only where it holds the template ('cdkd destroy' with the app, or 'cdkd deploy --recreate-via-cc-api' naming this resource), and only while today's template reads a NoEcho parameter there with the property's text and inputs unchanged; an attribute a producer declared NoEcho has no template value to re-resolve.";
 function noEchoPropertiesRemedy(context, logicalId) {
 	return context?.stackDestroy === true ? `cdkd is KEEPING the state record and the run exits non-zero, and every re-run skips it again. Tear down what the handler manages by hand, then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}.` : "This delete is not part of a stack destroy (a 'cdkd deploy' template removal, replacement or rollback, or a 'cdkd rollback'). For a resource removed from the template the record is KEPT and every 'cdkd deploy' skips it again: tear down what the handler manages by hand. " + crDeploySkipTail(logicalId);
 }
@@ -28242,7 +28242,10 @@ function handleOutputResolutionFailure(error, outputKey, outputs, secrets, inher
 async function resolveOutputs(template, resources, stackName, digestSource, parameterValues, conditions) {
 	this.resolvedExportNames = [];
 	this.carriedExportAliasRefusal = void 0;
-	if (!template.Outputs) return {};
+	if (!template.Outputs) {
+		this.carriedExportAliasRefusal = seedOnlyAliasRefusal(noEchoParameterValueSeed(template.Parameters, parameterValues, this.options.inheritedSecrets, this.options.parameters));
+		return {};
+	}
 	const outputs = Object.create(null);
 	const context = this.buildResolverContext({
 		template,
@@ -28350,6 +28353,13 @@ function buildDisplayOutputs(template, resolvedOutputs) {
 	}
 	return display;
 }
+function seedOnlyAliasRefusal(seed) {
+	return (outputKey, exportName) => {
+		const verdict = carriedExportAliasExposure(exportName, /* @__PURE__ */ new Map(), seed);
+		if (verdict === void 0) return void 0;
+		return secretBearingExportNameWarning(outputKey, exportName, verdict.exposure, EMPTY_SECRETS, verdict.noEchoOnly);
+	};
+}
 
 //#endregion
 //#region src/types/deployment-events.ts
@@ -30198,6 +30208,171 @@ function sortRollbackCreates(createOps, stateResources, logger) {
 	return sorted;
 }
 
+//#endregion
+//#region src/deployment/rollback-executor/replay-noecho.ts
+const NOECHO_REPLAY_READBACK_TIMEOUT_MS = 3e4;
+const NESTED_STACK_TYPE$3 = "AWS::CloudFormation::Stack";
+function coordinatePath(coordinate) {
+	let path = "";
+	for (const segment of coordinate) path += typeof segment === "number" ? `[${segment}]` : path === "" ? segment : `.${segment}`;
+	return path;
+}
+function shownPaths(coordinates) {
+	return coordinates.map((coordinate) => plainOrDescribed(coordinatePath(coordinate), "property path")).join(", ");
+}
+function unreadableNoEchoLeafRefusal(logicalId, coordinates, failure) {
+	const why = failure === "read-failed" ? "reading the resource back from AWS failed, so cdkd could not learn the value AWS holds there (re-running the rollback retries the read)" : "cdkd cannot read the value AWS holds there (the property is write-only, AWS does not return it, or cdkd has no readback for this resource type)";
+	return markNonRetryable(new CdkdError(`Cannot roll ${shownLogicalId(logicalId)} back: its recorded baseline holds a NoEcho value only as the redaction mask ('${"***"}') at ${shownPaths(coordinates)}, and ${why}. cdkd sent nothing rather than write the mask to the live resource. Restore the property with 'cdkd deploy', which sends the NoEcho parameter's value again (a NoEcho attribute of a custom resource is sent again only when that custom resource updates in the same deploy).`, "ROLLBACK_REDACTED_BASELINE"));
+}
+function refuseMarkedNoEchoRecreate(props, marked, logicalId) {
+	if (props === void 0 || marked === void 0 || marked.length === 0) return;
+	const masked = maskedLeafCoordinatesOf(props);
+	if (masked.length === 0 || !masksOnlyAt(props, marked)) return;
+	const shown = marked.filter((outer) => masked.some((inner) => isMarkedCoordinate(inner, [outer])));
+	throw new CdkdError(`Cannot re-create ${shownLogicalId(logicalId)} while reversing its replacement: its recorded baseline holds a NoEcho value only as the redaction mask ('${"***"}') at ${shownPaths(shown)}, and there is no live resource to read that value back from, so cdkd sent nothing rather than create the resource with the mask. Restore the stack with 'cdkd deploy', which sends the NoEcho parameter's value again.`, "ROLLBACK_REDACTED_BASELINE");
+}
+function masksOnlyAt(props, marked) {
+	return maskedLeafCoordinatesOf(props).every((c) => isMarkedCoordinate(c, marked));
+}
+function holdsPlaceholder(value) {
+	if (typeof value === "string") return /^\*{3,}$/.test(value);
+	if (Array.isArray(value)) return value.some(holdsPlaceholder);
+	if (value !== null && typeof value === "object") return Object.values(value).some(holdsPlaceholder);
+	return false;
+}
+function replaceAtCoordinate(bag, coordinate, value) {
+	if (coordinate.length === 0) return value;
+	const clone = (node) => Array.isArray(node) ? [...node] : node !== null && typeof node === "object" ? { ...node } : node;
+	const root = clone(bag);
+	let node = root;
+	for (let i = 0; i < coordinate.length - 1; i++) {
+		const segment = coordinate[i];
+		const next = clone(node[segment]);
+		node[segment] = next;
+		node = next;
+	}
+	const last = coordinate[coordinate.length - 1];
+	Object.defineProperty(node, last, {
+		value,
+		enumerable: true,
+		writable: true,
+		configurable: true
+	});
+	return root;
+}
+async function readLive(live, baseline, marked, logicalId, ctx) {
+	let readCurrentState;
+	try {
+		const { provider } = ctx.providerRegistry.getProviderFor({
+			resourceType: live.resourceType,
+			provisionedBy: live.provisionedBy
+		});
+		readCurrentState = provider.readCurrentState?.bind(provider);
+	} catch {
+		return { failure: "not-readable" };
+	}
+	if (readCurrentState === void 0) return { failure: "not-readable" };
+	const handed = maskReadbackAtCoordinates(maskAtCoordinates(live.properties ?? {}, [...marked, ...noEchoLeavesOf(live) ?? []]), baseline.properties, marked);
+	let timer;
+	try {
+		const result = await Promise.race([Promise.resolve().then(() => readCurrentState(live.physicalId, logicalId, live.resourceType, handed)), new Promise((_, reject) => {
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error("readback timed out")), NOECHO_REPLAY_READBACK_TIMEOUT_MS);
+		})]);
+		if (result === void 0 || result === null || typeof result !== "object") return { failure: "not-readable" };
+		return { live: result };
+	} catch {
+		return { failure: "read-failed" };
+	} finally {
+		if (timer !== void 0) clearTimeout(timer);
+	}
+}
+async function substituteMarkedNoEchoLeaves(input) {
+	const { desired, baseline, live, logicalId, ctx, secrets, routedVia, stackName } = input;
+	const identity = {
+		desired,
+		onPreviousSide: (bag) => bag,
+		inert: [],
+		substituted: []
+	};
+	if (desired === void 0) return identity;
+	const pending = (noEchoLeavesOf(baseline) ?? []).filter((coordinate) => carriesSecretMask(valueAtCoordinate(desired, coordinate)));
+	if (pending.length === 0) return identity;
+	if (live.resourceType === NESTED_STACK_TYPE$3 && baseline.resourceType === NESTED_STACK_TYPE$3 && live.provisionedBy !== "cc-api" && !routedVia.includes("cc-api")) return {
+		...identity,
+		inert: pending
+	};
+	const read = await readLive(live, baseline, pending, logicalId, ctx);
+	if ("failure" in read) throw unreadableNoEchoLeafRefusal(logicalId, pending, read.failure);
+	const values = [];
+	const unreadable = [];
+	for (const coordinate of pending) {
+		const path = readbackPathFor(read.live, baseline.properties, coordinate);
+		const value = path !== void 0 && path.length === coordinate.length ? valueAtCoordinate(read.live, path) : void 0;
+		if (value === void 0 || value === null || holdsPlaceholder(value)) {
+			unreadable.push(coordinate);
+			continue;
+		}
+		values.push({
+			coordinate,
+			value
+		});
+	}
+	if (unreadable.length > 0) throw unreadableNoEchoLeafRefusal(logicalId, unreadable, "not-readable");
+	let substituted = desired;
+	for (const { coordinate, value } of values) {
+		for (const leaf of loggableLeavesOf(value)) recordLogOnlyParameterValue(secrets, leaf);
+		recordNoEchoParameterFreshValue(value, secrets, /* @__PURE__ */ new Set([ctx.region, stackName]));
+		substituted = replaceAtCoordinate(substituted, coordinate, value);
+	}
+	return {
+		inert: [],
+		substituted: values,
+		desired: substituted,
+		onPreviousSide: (bag) => {
+			if (bag === void 0) return bag;
+			let out = bag;
+			for (const { coordinate, value } of values) if (carriesSecretMask(valueAtCoordinate(out, coordinate))) out = replaceAtCoordinate(out, coordinate, value);
+			return out;
+		}
+	};
+}
+function loggableLeavesOf(value) {
+	if (value === null || typeof value !== "object") return [value];
+	if (Array.isArray(value)) return value.every((item) => item === null || typeof item !== "object") ? [value] : value.flatMap(loggableLeavesOf);
+	return Object.values(value).flatMap(loggableLeavesOf);
+}
+function declaredNoEchoAttributeNames(record) {
+	const field = record.noEchoAttributeNames;
+	return Array.isArray(field) ? field.filter((name) => typeof name === "string") : [];
+}
+function maskRestoredNoEchoRecord(record, baseline, substituted = []) {
+	const marked = noEchoLeavesOf(baseline) ?? [];
+	const names = declaredNoEchoAttributeNames(baseline);
+	if (marked.length === 0 && names.length === 0 && substituted.length === 0) return record;
+	const echoes = (name, value) => value !== record.physicalId && substituted.some((leaf) => leaf.coordinate[0] === name && canonicalJson$3(leaf.value) === canonicalJson$3(value));
+	let attributes = record.attributes;
+	if (attributes !== void 0 && attributes !== null && typeof attributes === "object") for (const [name, value] of Object.entries(attributes)) {
+		if (!names.includes(name) && !echoes(name, value)) continue;
+		attributes = replaceAtCoordinate(attributes, [name], maskWholeValue(value));
+	}
+	const byIndex = maskAtCoordinates(record.properties, marked);
+	const reshaped = marked.filter((coordinate) => {
+		const list = coordinate.findIndex((segment) => typeof segment === "number");
+		if (list < 0) return false;
+		const path = coordinate.slice(0, list);
+		return canonicalJson$3(valueAtCoordinate(byIndex, path)) !== canonicalJson$3(valueAtCoordinate(baseline.properties, path));
+	});
+	const properties = reshaped.length === 0 ? byIndex : maskReadbackAtCoordinates(byIndex, baseline.properties, reshaped);
+	const widened = reshaped.map((coordinate) => readbackPathFor(byIndex, baseline.properties, coordinate)).filter((path, i) => path !== void 0 && path.length < reshaped[i].length);
+	const leaves = widened.length === 0 ? baseline.noEchoLeaves : canonicalCoordinates([...marked, ...widened]);
+	return {
+		...record,
+		properties,
+		...attributes !== record.attributes && { attributes },
+		...leaves !== void 0 && { noEchoLeaves: leaves }
+	};
+}
+
 //#endregion
 //#region src/deployment/rollback-executor/replay-props.ts
 async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId) {
@@ -30227,8 +30402,9 @@ async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId)
 	};
 	return await walk(props, "");
 }
-function refuseMaskedReplayBaseline(props, logicalId) {
+function refuseMaskedReplayBaseline(props, logicalId, inert = []) {
 	if (props === void 0 || !carriesSecretMask(props)) return;
+	if (inert.length > 0 && masksOnlyAt(props, inert)) return;
 	throw new CdkdError(`Cannot roll ${shownLogicalId(logicalId)} back: its recorded baseline holds the redaction mask ('${"***"}'), so cdkd would write that literal to the live resource. There are four ways a baseline comes to hold it. (1) A NoEcho custom-resource value was resolved there: restore the property with 'cdkd deploy' AFTER forcing that custom resource to update (change one of its properties, e.g. a nonce), so its handler runs again and supplies the real value — an ordinary re-deploy leaves the resource unchanged, so the handler does not run and the mask stays. (2) The Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records: restore the property with a 'cdkd deploy' that changes this resource, which sends it the encoded value again — a re-deploy that leaves this resource unchanged sends it nothing. Every rollback to such a baseline refuses, so to end this, stop encoding the secret into the property (have the resource read the secret at run time instead — not by writing the secret's plaintext into the template, which cdkd would then record in state in the clear). (3) The value was SPLICED from a masked record of ANOTHER resource — by 'cdkd orphan --force', or by 'cdkd import' resolving an Fn::GetAtt or a Ref over a value the Cloud Control fallback had masked. Repair the record that HOLDS the mask ('cdkd import <stack> --resource <logicalId>=<physicalId> --force', granting cloudformation:DescribeType first if the import warned that it could not read the schema), then re-run whichever command wrote this property. (4) A NoEcho template parameter's value, which cdkd stores only as the mask: restore the property with 'cdkd deploy', which sends the parameter's value again. See https://github.com/go-to-k/cdkd/issues/2449.`, "ROLLBACK_REDACTED_BASELINE");
 }
 
@@ -30515,14 +30691,24 @@ async function replayRevert(s) {
 		skipUnaddressableReplay(s, logger, op, "restore");
 		return;
 	}
-	logger.info(`  Rollback: Restoring ${safe(op.logicalId)} (${safe(op.resourceType)}) to previous state`);
 	const { provider, provisionedBy: revertVia } = ctx.providerRegistry.getProviderFor({
 		resourceType: op.resourceType,
 		provisionedBy: op.provisionedBy
 	});
-	const desiredProps = await resolveReplayProps(previousState.properties, resolver, secrets, ctx, op.logicalId);
-	refuseMaskedReplayBaseline(desiredProps, op.logicalId);
-	const currentProps = await resolveReplayProps(current.properties, resolver, secrets, ctx, op.logicalId);
+	const noEcho = await substituteMarkedNoEchoLeaves({
+		desired: await resolveReplayProps(previousState.properties, resolver, secrets, ctx, op.logicalId),
+		baseline: previousState,
+		live: current,
+		logicalId: op.logicalId,
+		ctx,
+		secrets,
+		routedVia: [op.provisionedBy, revertVia],
+		stackName
+	});
+	const desiredProps = noEcho.desired;
+	refuseMaskedReplayBaseline(desiredProps, op.logicalId, noEcho.inert);
+	logger.info(`  Rollback: Restoring ${safe(op.logicalId)} (${safe(op.resourceType)}) to previous state`);
+	const currentProps = noEcho.onPreviousSide(await resolveReplayProps(current.properties, resolver, secrets, ctx, op.logicalId));
 	recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, previousState.properties, STATE_DERIVED_RULES);
 	opMasker.addNamed({
 		resourceType: op.resourceType,
@@ -30558,7 +30744,7 @@ async function replayRevert(s) {
 		}
 	], op.logicalId, logger, isInterrupted, secrets, mask));
 	if (revertResult) recordNoEchoAttributeValues(revertResult, secrets, desiredProps);
-	stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(previousState, revertResult), secrets, previousState.properties);
+	stateResources[op.logicalId] = maskRestoredNoEchoRecord(redactRollbackRecord(recordAfterRollbackUpdate(previousState, revertResult), secrets, previousState.properties), previousState, noEcho.substituted);
 	if (updatePartialReason(revertResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$1(previousState.properties?.["Policies"], current.properties?.["Policies"]), revertVia);
 	const rollbackPartial = updatePartialReason(revertResult);
 	if (rollbackPartial !== void 0) logger.warn(mask(`  Rollback: ${safe(op.logicalId)} restored, ${updatePartialMessage(rollbackPartial)}`));
@@ -30599,6 +30785,7 @@ async function replayReverseReplacement(s) {
 		return;
 	}
 	const resolvedPrevProps = await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId) ?? {};
+	refuseMarkedNoEchoRecreate(resolvedPrevProps, noEchoLeavesOf(prev), op.logicalId);
 	refuseMaskedReplayBaseline(resolvedPrevProps, op.logicalId);
 	opMasker.addNamed({
 		resourceType: oldType,
@@ -31244,9 +31431,19 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						resourceType: op.resourceType,
 						provisionedBy: op.provisionedBy ?? current.provisionedBy
 					});
-					const desiredProps = await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId);
-					refuseMaskedReplayBaseline(desiredProps, op.logicalId);
-					const attemptedProps = await resolveReplayProps(op.attemptedProperties ?? current.properties, resolver, secrets, ctx, op.logicalId);
+					const noEcho = await substituteMarkedNoEchoLeaves({
+						desired: await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId),
+						baseline: prev,
+						live: current,
+						logicalId: op.logicalId,
+						ctx,
+						secrets,
+						routedVia: [op.provisionedBy ?? current.provisionedBy, revertVia],
+						stackName
+					});
+					const desiredProps = noEcho.desired;
+					refuseMaskedReplayBaseline(desiredProps, op.logicalId, noEcho.inert);
+					const attemptedProps = noEcho.onPreviousSide(await resolveReplayProps(op.attemptedProperties ?? current.properties, resolver, secrets, ctx, op.logicalId));
 					recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, prev.properties, STATE_DERIVED_RULES);
 					opMasker.addNamed({
 						resourceType: op.resourceType,
@@ -31282,7 +31479,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						}
 					], op.logicalId, logger, options.isInterrupted, secrets, mask));
 					if (revertFailedResult) recordNoEchoAttributeValues(revertFailedResult, secrets, desiredProps);
-					stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(prev, revertFailedResult), secrets, prev.properties);
+					stateResources[op.logicalId] = maskRestoredNoEchoRecord(redactRollbackRecord(recordAfterRollbackUpdate(prev, revertFailedResult), secrets, prev.properties), prev, noEcho.substituted);
 					if (updatePartialReason(revertFailedResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$1(prev.properties?.["Policies"], (op.attemptedProperties ?? current.properties)?.["Policies"]), revertVia);
 					const revertFailedPartial = updatePartialReason(revertFailedResult);
 					if (revertFailedPartial !== void 0) logger.warn(mask(`  Rollback: ${safe(op.logicalId)} reverted, ${updatePartialMessage(revertFailedPartial)}`));
@@ -31794,11 +31991,18 @@ const MAX_NESTED_WALK_DEPTH = 32;
 function nestedChildStackName(parentStackName, logicalId) {
 	return `${parentStackName}~${logicalId}`;
 }
-function nestedPendingSnapshot(state) {
+function nestedPendingSnapshot(state, refusesExportName) {
+	const outputs = { ...isPlainRecord(state.outputs) ? state.outputs : {} };
+	let exportNames = Array.isArray(state.exportNames) ? [...state.exportNames] : void 0;
+	const refused = new Set(importableOutputKeys(state).filter((name) => refusesExportName(name)));
+	if (refused.size > 0) {
+		for (const name of refused) Reflect.deleteProperty(outputs, name);
+		if (exportNames !== void 0) exportNames = exportNames.filter((name) => !refused.has(name));
+	}
 	return {
 		previousOutputs: {
-			outputs: { ...isPlainRecord(state.outputs) ? state.outputs : {} },
-			...Array.isArray(state.exportNames) && { exportNames: [...state.exportNames] }
+			outputs,
+			...exportNames !== void 0 && { exportNames }
 		},
 		previousCrossStackReads: {
 			...Array.isArray(state.imports) && { imports: [...state.imports] },
@@ -32348,7 +32552,12 @@ async function performRollback(completedOperations, stateResources, stackName, p
 }
 async function settleJournalAfterSuccess(stackName, completedOperations, previousState, finalResources, initialDeploy) {
 	if (this.options.parentStackInfo) {
-		await this.writeRollbackJournalSegment(stackName, completedOperations, [], NESTED_PENDING_PARENT_REASON, initialDeploy, nestedPendingSnapshot(previousState));
+		await this.writeRollbackJournalSegment(stackName, completedOperations, [], NESTED_PENDING_PARENT_REASON, initialDeploy, nestedPendingSnapshot(previousState, (name) => {
+			const verdict = this.carriedExportAliasRefusal;
+			const dropped = verdict === void 0 || verdict(name, name) !== void 0;
+			if (dropped) this.logger.warn(verdict === void 0 ? "An export alias the previous record published was not kept for a revert of this nested stack: no export-name verdict is available." : "An export alias the previous record published was not kept for a revert of this nested stack: its name contains a NoEcho value.");
+			return dropped;
+		}));
 		return 0;
 	}
 	let nestedLeft = 0;
@@ -37197,6 +37406,115 @@ function isNoEchoPromotionOnly(change) {
 	return change.changeType === "UPDATE" && (change.attributeChanges?.length ?? 0) === 0 && (change.propertyChanges?.length ?? 0) > 0 && change.propertyChanges.every((pc) => pc.noEchoPromoted === true);
 }
 
+//#endregion
+//#region src/deployment/custom-resource-service-token.ts
+const SERVICE_TOKEN_CHANGE_REFUSED = "CUSTOM_RESOURCE_SERVICE_TOKEN_CHANGED";
+function uncomparableToken(value) {
+	if (value === void 0 || value === null || value === "") return "absent";
+	if (typeof value !== "string") return "not-a-string";
+	if (value.includes("***")) return "masked";
+	if (dynamicReferenceTokens(value).length > 0) return "reference";
+}
+const SERVICE_TOKEN = "ServiceToken";
+function serviceTokenChange(change) {
+	return change.propertyChanges?.find((pc) => pc.path === SERVICE_TOKEN);
+}
+function isSynthetic(pc) {
+	return pc.replacementPropagated === true || pc.inPlacePropagated === true || pc.noEchoPromoted === true;
+}
+function isUnmovedPromotion(pc) {
+	return pc.noEchoPromoted === true || pc.inPlacePropagated === true;
+}
+function diffMovedServiceToken(change) {
+	const pc = serviceTokenChange(change);
+	return pc !== void 0 && !isUnmovedPromotion(pc);
+}
+function findServiceTokenRefusals(input) {
+	const refused = [];
+	const deferred = [];
+	for (const [logicalId, change] of input.changes) {
+		if (change.changeType !== "UPDATE" || !isCustomResourceType(change.resourceType)) continue;
+		if (!Object.hasOwn(input.stateResources, logicalId)) continue;
+		const record = input.stateResources[logicalId];
+		if (record === void 0 || record.resourceType !== change.resourceType) continue;
+		if (input.recreateTargetIds?.has(logicalId) === true) continue;
+		const pc = serviceTokenChange(change);
+		if (pc === void 0) continue;
+		const recordedToken = record.properties?.[SERVICE_TOKEN];
+		const recordedProblem = uncomparableToken(recordedToken);
+		if (recordedProblem !== void 0) {
+			if (isUnmovedPromotion(pc)) continue;
+			refused.push({
+				logicalId,
+				resourceType: change.resourceType,
+				kind: "unjudgeable",
+				recorded: recordedProblem
+			});
+			continue;
+		}
+		const desired = pc.newValue;
+		if (!isSynthetic(pc) && uncomparableToken(desired) === void 0) {
+			if (desired !== recordedToken) refused.push({
+				logicalId,
+				resourceType: change.resourceType,
+				kind: "changed",
+				desired
+			});
+			continue;
+		}
+		if (pc.replacementPropagated === true || pc.inPlacePropagated === true && pc.noEchoPromoted !== true || desired !== null && typeof desired === "object" && !isSynthetic(pc)) deferred.push({
+			logicalId,
+			resourceType: change.resourceType
+		});
+	}
+	return {
+		refused,
+		deferred
+	};
+}
+function serviceTokenUpdateRefusal(input) {
+	if (!isCustomResourceType(input.resourceType) || input.recordedType !== input.resourceType) return;
+	const recordedProblem = uncomparableToken(input.recorded);
+	if (recordedProblem !== void 0) return input.diffSawTokenChange ? {
+		logicalId: input.logicalId,
+		resourceType: input.resourceType,
+		kind: "unjudgeable",
+		recorded: recordedProblem
+	} : void 0;
+	if (uncomparableToken(input.desired) !== void 0) return void 0;
+	if (input.desired === input.recorded) return void 0;
+	return {
+		logicalId: input.logicalId,
+		resourceType: input.resourceType,
+		kind: "changed",
+		desired: input.desired
+	};
+}
+const UNCOMPARABLE_TEXT = {
+	absent: "missing",
+	masked: `the redaction mask '${"***"}'`,
+	reference: "a '{{resolve:...}}' dynamic reference",
+	"not-a-string": "not a string"
+};
+function rowText(refusal, mask) {
+	const id = displayIdent(refusal.logicalId);
+	if (refusal.kind === "changed") return `${id}: ServiceToken changes to ${displayIdent(mask(refusal.desired))}, away from the handler its record names.`;
+	return `${id}: its recorded ServiceToken is ${UNCOMPARABLE_TEXT[refusal.recorded]}, so cdkd cannot tell whether this deploy changes it.`;
+}
+const REMEDY = "To move a custom resource to a different handler, give it a new logical id (in CDK, a new construct id, or overrideLogicalId on its CfnResource): the deploy then creates the new resource through the new handler and deletes the old one through its old handler. To keep the existing resource, deploy its previous ServiceToken.";
+const UNJUDGEABLE_REMEDY = `Where the recorded ServiceToken is unreadable and the handler did not change, put the ARN of the handler that created this resource (the one it was last deployed with, not the one the template names now) back as ServiceToken in state.json (a ServiceToken fed by a NoEcho parameter is recorded only as '${"***"}': feed it from a plain value) and re-deploy.`;
+function renderServiceTokenRefusal(refusals, stackName, mask = (text) => text) {
+	const rows = refusals.map((refusal) => `  - ${rowText(refusal, mask)}`);
+	return `Refusing to deploy ${stackName}: ` + (refusals.length === 1 ? `a custom resource's ServiceToken changes` : `${refusals.length} custom resources' ServiceTokens change`) + `, which CloudFormation does not allow ("Modifying service token is not allowed") (issue #4749). Nothing was sent to either handler.
+${rows.join("\n")}\n  ${REMEDY}` + (refusals.some((refusal) => refusal.kind === "unjudgeable") ? `\n  ${UNJUDGEABLE_REMEDY}` : "");
+}
+function serviceTokenBlockingReason(refusal, mask) {
+	return `${rowText(refusal, mask)} cdkd deploy refuses a changed custom-resource ServiceToken, as CloudFormation does (issue #4749); give the custom resource a new logical id to move it to another handler.`;
+}
+function deferredServiceTokenWarning(row) {
+	return `${displayIdent(row.logicalId)}: its ServiceToken reads a resource this deploy replaces, creates or updates, or a value this preview cannot resolve. If it resolves to a different ARN than the one recorded, cdkd deploy refuses the update before invoking any handler and rolls back (issue #4749). A replaced backing function is already deleted by then and the rollback re-creates it; if that fails, the record names a function that no longer exists.`;
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/update.ts
 function isWhollyMask(value) {
@@ -37648,6 +37966,15 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		updateSecrets,
 		lostWithParent
 	}));
+	const serviceTokenRefusal = serviceTokenUpdateRefusal({
+		logicalId,
+		resourceType,
+		recordedType: currentResource.resourceType,
+		recorded: currentResource.properties?.["ServiceToken"],
+		desired: resolvedProps["ServiceToken"],
+		diffSawTokenChange: diffMovedServiceToken(change)
+	});
+	if (serviceTokenRefusal !== void 0) throw markRefusedBeforeApplying(markNonRetryable(new CdkdError(renderServiceTokenRefusal([serviceTokenRefusal], stackName, createSecretMasker(updateSecrets)), SERVICE_TOKEN_CHANGE_REFUSED)));
 	return markRestored(await this.updateInPlace({
 		conditions,
 		counts,
@@ -39794,6 +40121,15 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			stateResources: currentState.resources
 		});
 		if (nestedStackTypeChanges.length > 0) throw markNonRetryable(new CdkdError(renderNestedStackTypeChangeRefusal(nestedStackTypeChanges, stackName), "TYPE_CHANGE_NESTED_STACK"));
+		const serviceTokenRefusals = findServiceTokenRefusals({
+			changes,
+			stateResources: currentState.resources,
+			recreateTargetIds: recreateTargetIdsFor(this.options.recreateTargets, stackName)
+		}).refused;
+		if (serviceTokenRefusals.length > 0) {
+			const mask = this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues);
+			throw markNonRetryable(new CdkdError(renderServiceTokenRefusal(serviceTokenRefusals, stackName, mask), SERVICE_TOKEN_CHANGE_REFUSED));
+		}
 		const recreatePromotion = promoteRecreateTargets(changes, this.options.recreateTargets, stackName);
 		for (const id of recreatePromotion.promoted) this.logger.debug(safeMsg`UPDATE (recreate target): ${id} has no template change; recreating it as requested`);
 		for (const { logicalId, flag, changeType } of recreatePromotion.unreached) this.logger.warn(changeType === void 0 ? safeMsg`${flag} ${logicalId}: not recreated, this deploy has no such resource.` : safeMsg`${flag} ${logicalId}: not recreated, this deploy will ${changeType.toLowerCase()} it instead.`);
@@ -40494,5 +40830,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { computeParameterTaint as $, lambdaFunctionNameForMask as $a, refuseMalformedResourceEntriesForDestroy as $i, ccBrokenReason as $n, splitImportedOps as $o, keepsSecretReferenceToken as $r, synthesisStatusMessage as $s, maskEventTextWithBoundBags as $t, beginDeleteWait as A, isStatefulRecreateTargetForReplace as Aa, nullPrototypeRecord as Ac, malformedOrphansRefusalMessage as Ai, DEFAULT_RESOURCE_TIMEOUT_MS as An, isUncertifiedBaselineMaskPosition as Ao, assertFlagRoleArn as Ar, buildDenyExternalAccessPolicy as As, removeProtectionTypeList as At, S3_AUTO_DELETE_OBJECTS_TAG as B, configBooleanRefusal as Ba, previewableOrphanRecords as Bi, withCreateTokenLedger as Bn, recordNoEchoAttributeValues as Bo, s3BucketArn as Br, isDockerClientEnvKey as Bs, resolveReplacementOldType as Bt, recordedProtectionNote as C, unwrittenCreateOnlyReplacement as Ca, derivePartitionAndUrlSuffix as Cc, malformedExportSourceWarning as Ci, exportNameSecretExposure as Cn, maskSecretsInError as Co, INTRINSIC_KEYS as Cr, ensureAssetStorage as Cs, sameJournaledOrphans as Ct, readProtection as D, findReplacedReadersOfRecreateTargets as Da, defineOwnKey as Dc, malformedOrphanRecordsRefusalMessage as Di, collectPublishedOutputNames as Dn, scrubResourceRecord as Do, producerRegionsFromState as Dr, readBootstrapMarkerBody as Ds, destroyStackRecordsView as Dt, perType as E, hasNoCloudControlHandlers as Ea, processStackMessages as Ec, malformedLocalResourcesWarning as Ei, collectDeclaredOutputNames as En, redactSecretsForState as Eo, classifyReplaySecretRegion as Er, parseBootstrapMarker as Es, awaitInFlightSibling as Et, DELETE_INDEX_WAIT_PROCEED_NOTE as F, isWarmThroughputDecrease as Fa, renderAssemblyPathEscape as Fc, malformedResourceEntriesWarning as Fi, formatDestructiveChange as Fn, recoverMaskedOutput as Fo, AWS_CREDENTIAL_ENV_KEYS as Fr, describeDockerFailure as Fs, planFailedOps as Ft, formatResourceLine as G, requireConfigArray as Ga, refuseMalformedOrphans as Gi, readTagList as Gn, STATE_SOURCED_READBACK_RULES as Go, coerceParameterTypedValue as Gr, runDockerForeground as Gs, REDACTED_DELETE_ADDRESS_SKIP_REASON as Gt, isTruthyCfnBoolean as H, configStringRefusal as Ha, refuseMalformedNestedChildOutputs as Hi, DBPROXY_TAGS_WHAT as Hn, wholeStringLeavesOf as Ho, s3BucketDualStackDomainName as Hr, partitionSensitiveEnv as Hs, findNestedStackTypeChanges as Ht, INDEX_SETTLE_POLL_INTERVAL_MS as I, toCfnInteger as Ia, resolveAssemblyPath as Ic, malformedResourcePropertiesWarning as Ii, RollbackInlinePolicyWriters as In, carriesSecretMask as Io, applyCallerIdentityCredentials as Ir, dockerSpawnEnvWithSensitive as Is, planRollback as It, cyan as J, prefetchCreateOnlyPropertyPaths as Ja, refuseMalformedOutputs as Ji, tagPlanWarning as Jn, isSingleDynamicReferenceToken as Jo, getAccountInfo as Jr, escapeRegExp$3 as Js, redactedDeleteAddressSkip as Jt, createReadOnlyAttributeHealerFactory as K, requireConfigObject as Ka, refuseMalformedOrphansForDestroy as Ki, refuseMalformedDesiredTags as Kn, TEMPLATE_SOURCED_RULES as Ko, isUnboundTemplateParameter as Kr, runDockerStreaming as Ks, isRedactedRecordedValue as Kt, deleteTableWithIndexBusyRetry as L, toFiniteNumber as La, clearBucketRegionCache as Lc, malformedResourcesWarning as Li, earliestDefined as Ln, provenPublicValue as Lo, callerEnvCredentials as Lr, finchSecretArgvRefusal as Ls, recheckFailedPlan as Lt, deleteBudgetKey as M, renderStatefulReason as Ma, absoluteAssemblyPathEscape as Mc, malformedOutputsRefusalMessage as Mi, maskingRetryLogger as Mn, identityKeyFor as Mo, explicitRoleArnOrThrow as Mr, resolveDockerContextDirectory as Ms, demoteSupersededOrphans as Mt, resolveDynamoDbDeleteBudgetClock as N, WARM_THROUGHPUT_MEMBERS as Na, describeFileReadFailure as Nc, malformedOutputsWarning as Ni, constructPathOf as Nn, inheritNestedStackParameterAssociations as No, isIamRoleArn as Nr, describeDockerCapturedOutput as Ns, isJournaledOrphan as Nt, DynamoDBGlobalTableProvider as O, shownType as Oa, hasOwnKey as Oc, malformedOrphanRecordsWarning as Oi, isExportAliasCollision as On, DYNAMIC_REFERENCE_TOKEN_SCAN as Oo, regionLessSecretName as Or, validateAssetBucketName as Os, getStackRecords as Ot, resolveDynamoDbDeleteBudgetMs as P, coerceWarmThroughput as Pa, displayAssemblyPath as Pc, malformedRenderedContainersWarning as Pi, findDestructiveChanges as Pn, recordNestedStackParameterExpressions as Po, sendableAssumeRoleCommand as Pr, describeDockerExecFailure as Ps, isReplacementOrphan as Pt, yellow as Q, canonicalLambdaFunctionName as Qa, refuseMalformedResourceEntriesForDeploy as Qi, ProviderRegistry as Qn, rebuildClientForBucketRegion as Qo, isNamelessDynamicReferenceError as Qr, Synthesizer as Qs, journaledOrphanPrintingBag as Qt, waitForIndexesSettled as R, coerceCfnBoolean as Ra, resolveBucketRegion as Rc, malformedScrubResourceEntriesRefusalMessage as Ri, ledgerForStack as Rn, recordMaskOnlyValue as Ro, envCredentialsAreAssumedRole as Rr, formatDockerLoginError as Rs, recordUnderIdIsNotOwn as Rt, recordedProtectionEvidence as S, findSilentDropProperties as Sa, canonicalizeRegion as Sc, malformedExportNamesWarning as Si, exportNameNoEchoParameters as Sn, errorCauseChain as So, DiffCalculator as Sr, assertAssetBucketRegion as Ss, makeForeignHolderScan as St, isProtectionValueActive as T, NO_CC_HANDLERS_REASON as Ta, StageLoadError as Tc, malformedLocalResourceEntriesWarning as Ti, noEchoParameterValueSeed as Tn, markSameGenerationBag as To, poisonRenderedSpellingsCollidingIn as Tr, isCrossRegionRedirect as Ts, replayRollback as Tt, getPriorAttempts as U, readConfigString as Ua, refuseMalformedOrphanRecords as Ui, DBPROXY_TAG_OPTIONS as Un, STATE_SOURCED_BASELINE_RULES as Uo, s3BucketRegionalDomainName as Ur, redactDockerArgvValues as Us, getCurrentProducerRegions as Ut, hasCdkAutoDeleteTag as V, configIntegerRefusal as Va, refuseDivergentRecordRegionForDestroy as Vi, acquireIdempotencyToken as Vn, recordProvenPublicExpression as Vo, s3BucketDomainName as Vr, isMalformedEnvKey as Vs, orphanDeleteNeedsIdentity as Vt, markRefusedBeforeApplying as W, replayWarn as Wa, refuseMalformedOrphanRecordsForDestroy as Wi, planTagDiff as Wn, STATE_SOURCED_CROSS_GENERATION_RULES as Wo, s3BucketWebsiteUrl as Wr, redactedDockerCause as Ws, inheritProducerRegions as Wt, green as X, describeTypeWithThrottleRetry as Xa, refuseMalformedResourceAttributesForOrphan as Xi, stringifyIfAssigned as Xn, isLockInfoExpired as Xo, carriesDynamicReference as Xr, AssetManifestLoader as Xs, updatePartialReason as Xt, gray as Y, templateResourceTypes as Ya, refuseMalformedOutputsForDestroy as Yi, definedAttributes as Yn, LockManager as Yo, isImpossibleEmptyStoredAttribute as Yr, stripControlChars as Ys, updatePartialMessage as Yt, red as Z, withRetry as Za, refuseMalformedResourceEntries as Zi, CC_BROKEN_REASON as Zn, S3StateBackend as Zo, carriesFetchableDynamicReference as Zr, getDockerImageBySourceHash as Zs, completedReplayEntries as Zt, makeCanonicalizePropertiesFn as _, unpreviewableOrphanRecords as _a, uploadCfnTemplate as _c, hasReadableOutputs as _i, exportAliasCollisionScrubWarning as _n, printingCorpusOf as _o, ec2InstanceProtectionSite as _r, createAssetRedirectResolver as _s, deleteJournaledOrphans as _t, findNestedTemplateTreeDefect as a, refuseMalformedResourcePropertiesForExport as aa, resolveCaptureObservedState as ac, withSharedDrainBudget as ai, buildFinalSnapshotIdentifier as an, maskWholeValue as ao, getCurrentResourceSecrets as ar, hasUnverifiableParameterRefusal as as, NESTED_PENDING_PARENT_REASON as at, noEchoComparisonForTemplate as b, withheldAccountClause as ba, expectedOwnerParam as bc, isReadableResourceEntry as bi, secretSafeKeyDisplay as bn, shareLogOnlyValues as bo, reDisableInstanceApiTermination as br, AssetModeResolver as bs, journaledOrphanLines as bt, renderNestedTemplateTreeDefect as c, refuseMalformedResourcesForDestroy as ca, resolveStateBucketWithDefaultAndSource as cc, JSON_LISTING_HOLE_VALUE as ci, effectiveDeletionPolicy as cn, noEchoOutputsComparison as co, slowCcOperationTimeoutMs as cr, isReadableBag as cs, dropSettledNestedJournals as ct, conditionInputsFrom as d, repairMalformedOrphanRecordsForReadOnly as da, warnDeprecatedNoPrefixCliFlag as dc, UNREADABLE_ORPHANS_CONTAINER_ROW as di, unsupportedFinalSnapshotError as dn, liveMatchesUnresolvedTokenFrame as do, deleteIndeterminateGuards as dr, shouldRetainResource as ds, recordDisplacedSkips as dt, refuseMalformedResourceEntriesForImport as ea, getDefaultStateBucketName as ec, AWS_NO_VALUE as ei, orphanRecordsPrintingBag as en, sameLambdaFunctionAddress as eo, isCustomResource as er, acceptedCreateOnlyDropsOf as es, namesAnyDeclaredParameter as et, parentSuppliedValues as f, repairMalformedOrphansForReadOnly as fa, ssmResolvedValueType as fc, UNREADABLE_RESOURCES_MAP_ROW as fi, DeploymentEventsReader as fn, carryLogOnlyValues as fo, deleteSkipReason as fr, AssetPublisher as fs, revertNestedChildFromJournal as ft, mergeNoChangeOutputs as g, repairMalformedResourcesForReadOnly as ga, findLargeInlineResources as gc, hasReadableOrphans as gi, displayTextOrWithheld as gn, logOnlyValueCount as go, disableInstanceApiTermination as gr, buildAssetRedirectMap as gs, withNestedStackContext as gt, keptWholeReasonText as h, repairMalformedResourcePropertiesForReadOnly as ha, MIGRATE_TMP_PREFIX as hc, displayLogicalId as hi, WITHHELD_NAME_DISPLAY as hn, literalSplitDelimitersOf as ho, markWaitAbandoned as hr, WorkGraph as hs, getCurrentNestedStackContext as ht, childTemplateLoader as i, refuseMalformedResourcePropertiesForDrift as ia, resolveAutoAssetStorage as ic, parseWebACLArn as ii, PRE_DELETE_SNAPSHOT_TYPES as in, maskReadbackAtCoordinates as io, isCustomResourceType as ir, hasReasonlessBaselineRefusal as is, planOrphanAdoption as it, compensateRemovedDeletionProtection as j, isStatefulRecreateTargetSync as ja, ownValue as jc, malformedOrphansWarning as ji, DEFAULT_RESOURCE_WARN_AFTER_MS as jn, pathCrossesDottedKey as jo, assertSendableRoleArn as jr, buildDockerImage as js, recordAfterRollbackUpdate as jt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as k, MULTI_REGION_RECREATE_BLOCKED_TYPES as ka, hasPlainPrototype$1 as kc, malformedOrphanRowsKeptWarning as ki, bindingSkippedOutputs as kn, dynamicReferenceTokens as ko, applyRoleArnIfSet as kr, validateContainerRepoName as ks, withStackRecords as kt, templateIdentity as l, refuseMalformedResourcesForExport as la, resolveUseCdkBootstrapAssets as lc, STATE_REGION_DIVERGED as li, isFinalSnapshotError as ln, passedNoEchoParametersOf as lo, unchangedBehindSecretReference as lr, orphansAfterRollback as ls, getNestedRevertRun as lt, isSecretBearingReferenceString as m, repairMalformedResourceEntriesForReadOnly as ma, CFN_TEMPLATE_URL_LIMIT as mc, deployRefusesOrphanRowsReason as mi, extractDeploymentEventError as mn, hasMaskableValues as mo, isWaitAbandonedError as mr, stringifyValue as ms, withNestedRevertRun as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedResourceEntriesForOrphan as na, loadCdkJson as nc, isStalePlaceholderArnAttribute as ni, stateSecretNameNeedles as nn, TemplateParser as no, TemplateNoEchoReresolver as nr, exportNamesCarriedFrom as ns, resourcesNamingDeclaredParameter as nt, isAbsoluteAssetPath as o, refuseMalformedResourcePropertiesForOrphan as oa, resolveSkipPrefix as oc, parameterInputsFor as oi, ccRoutedFinalSnapshotError as on, maskedLeafCoordinatesOf as oo, withPrintingSecrets as or, importableOutputKeys as os, displacedOpClause as ot, readRecordedConditionVerdicts as p, repairMalformedOutputsForReadOnly as pa, CFN_TEMPLATE_BODY_LIMIT as pc, accountArgs as pi, DeploymentEventsStore as pn, createUnionSecretMasker as po, withIndeterminateGuard as pr, isSensitiveAttributeName as ps, revertedNestedRowIds as pt, bold as q, requireConfigString as qa, refuseMalformedOrphansForOrphan as qi, tagMapAsList as qn, WHOLE_DYNAMIC_REFERENCE_PATTERN as qo, parameterTypeMayLoseSecretIdentity as qr, warnFinchArgvExposure as qs, redactedDeleteAddressFields as qt, computeImplicitDeleteEdges as r, refuseMalformedResourcePropertiesForDestroy as ra, resolveApp as rc, refStateLookupFromResource as ri, ATOMIC_FINAL_SNAPSHOT_TYPES as rn, isMarkedCoordinate as ro, readsNoEchoDeleteValues as rr, hasReadableExportSet as rs, makeSiblingClaimReader as rt, listNestedTemplateRows as s, refuseMalformedResourcesForDeploy as sa, resolveStateBucketWithDefault as sc, passedParameterClassesOf as si, createPreDeleteFinalSnapshot as sn, noEchoLeavesOf as so, CloudControlProvider as sr, importableOutputs as ss, displacedPhysicalIdShown as st, DeployEngine as t, refuseMalformedResourceEntriesForImportSave as ta, getLegacyStateBucketName as tc, cfnRefValueFromPhysicalId as ti, secretNamePrintingBag as tn, DagBuilder as to, wouldReturnToSdkProvider as tr, describeRegionValueKind as ts, reachableDivergentParameters as tt, conditionFingerprint as u, refuseMalformedState as ua, stateBucketExistenceConfirmed as uc, STATE_RESOURCES_MALFORMED as ui, refusesFinalSnapshot as un, readsNoEchoSource as uo, UNSPECIFIED_SKIP_REASON as ur, orphansCarriedFrom as us, nestedChildStackName as ut, withResourceDeadline as v, unreadableOrphanRecords as va, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as vc, hasReadableResources as vi, secretBearing as vn, recordLogOnlyParameterValue as vo, isTerminationProtectionPropagationError as vr, loadPublishableAssetManifest as vs, dropFailedHint as vt, PROTECTION_PROPERTY_BY_TYPE as w, withoutSilentDropProperties as wa, AssemblyReader as wc, malformedLocalOutputsWarning as wi, isWholeDynamicReferenceValue as wn, maskSecretsInText as wo, IntrinsicFunctionResolver as wr, getBootstrapMarkerKey as ws, replayFailedOperations as wt, noEchoParameterNamesOf as x, findActionableSilentDrops as xa, PARTITION_TABLE as xc, malformedDriftResourcePropertiesWarning as xi, carriedExportAliasExposure as xn, createSecretMasker as xo, reEnableInstanceApiTermination as xr, BOOTSTRAP_MARKER_PREFIX as xs, loadJournaledOrphans as xt, noEchoAttributeNamesOf as y, unreadableResourceEntries as ya, decodeListingKey as yc, isReadableOrphanRecord as yi, secretBearingStateKeyWarning as yn, recordLogOnlyValue as yo, observeThenDisableInstanceApiTermination as yr, rewriteTemplateAssetReferences as ys, isHandledOrphan as yt, ECR_AUTO_DELETE_IMAGES_TAG as z, coerceCfnInteger as za, malformedStateRefusalMessage as zi, reserveStackCreateToken as zn, recordMaskOnlyValuesIn as zo, isSettledInstanceState as zr, getDockerCmd as zs, replacementNeverSwapped as zt };
-//# sourceMappingURL=deploy-engine-BueFQdfN.js.map
+export { green as $, describeTypeWithThrottleRetry as $a, refuseMalformedResourceAttributesForOrphan as $i, stringifyIfAssigned as $n, isLockInfoExpired as $o, carriesDynamicReference as $r, AssetManifestLoader as $s, updatePartialReason as $t, readProtection as A, findReplacedReadersOfRecreateTargets as Aa, defineOwnKey as Ac, malformedOrphanRecordsRefusalMessage as Ai, collectPublishedOutputNames as An, scrubResourceRecord as Ao, producerRegionsFromState as Ar, readBootstrapMarkerBody as As, destroyStackRecordsView as At, deleteTableWithIndexBusyRetry as B, toFiniteNumber as Ba, clearBucketRegionCache as Bc, malformedResourcesWarning as Bi, earliestDefined as Bn, provenPublicValue as Bo, callerEnvCredentials as Br, finchSecretArgvRefusal as Bs, recheckFailedPlan as Bt, noEchoComparisonForTemplate as C, withheldAccountClause as Ca, expectedOwnerParam as Cc, isReadableResourceEntry as Ci, secretSafeKeyDisplay as Cn, shareLogOnlyValues as Co, reDisableInstanceApiTermination as Cr, AssetModeResolver as Cs, journaledOrphanLines as Ct, PROTECTION_PROPERTY_BY_TYPE as D, withoutSilentDropProperties as Da, AssemblyReader as Dc, malformedLocalOutputsWarning as Di, isWholeDynamicReferenceValue as Dn, maskSecretsInText as Do, IntrinsicFunctionResolver as Dr, getBootstrapMarkerKey as Ds, replayFailedOperations as Dt, recordedProtectionNote as E, unwrittenCreateOnlyReplacement as Ea, derivePartitionAndUrlSuffix as Ec, malformedExportSourceWarning as Ei, exportNameSecretExposure as En, maskSecretsInError as Eo, INTRINSIC_KEYS as Er, ensureAssetStorage as Es, sameJournaledOrphans as Et, deleteBudgetKey as F, renderStatefulReason as Fa, absoluteAssemblyPathEscape as Fc, malformedOutputsRefusalMessage as Fi, maskingRetryLogger as Fn, identityKeyFor as Fo, explicitRoleArnOrThrow as Fr, resolveDockerContextDirectory as Fs, demoteSupersededOrphans as Ft, isTruthyCfnBoolean as G, configStringRefusal as Ga, refuseMalformedNestedChildOutputs as Gi, DBPROXY_TAGS_WHAT as Gn, wholeStringLeavesOf as Go, s3BucketDualStackDomainName as Gr, partitionSensitiveEnv as Gs, findNestedStackTypeChanges as Gt, ECR_AUTO_DELETE_IMAGES_TAG as H, coerceCfnInteger as Ha, malformedStateRefusalMessage as Hi, reserveStackCreateToken as Hn, recordMaskOnlyValuesIn as Ho, isSettledInstanceState as Hr, getDockerCmd as Hs, replacementNeverSwapped as Ht, resolveDynamoDbDeleteBudgetClock as I, WARM_THROUGHPUT_MEMBERS as Ia, describeFileReadFailure as Ic, malformedOutputsWarning as Ii, constructPathOf as In, inheritNestedStackParameterAssociations as Io, isIamRoleArn as Ir, describeDockerCapturedOutput as Is, isJournaledOrphan as It, formatResourceLine as J, requireConfigArray as Ja, refuseMalformedOrphans as Ji, readTagList as Jn, STATE_SOURCED_READBACK_RULES as Jo, coerceParameterTypedValue as Jr, runDockerForeground as Js, REDACTED_DELETE_ADDRESS_SKIP_REASON as Jt, getPriorAttempts as K, readConfigString as Ka, refuseMalformedOrphanRecords as Ki, DBPROXY_TAG_OPTIONS as Kn, STATE_SOURCED_BASELINE_RULES as Ko, s3BucketRegionalDomainName as Kr, redactDockerArgvValues as Ks, getCurrentProducerRegions as Kt, resolveDynamoDbDeleteBudgetMs as L, coerceWarmThroughput as La, displayAssemblyPath as Lc, malformedRenderedContainersWarning as Li, findDestructiveChanges as Ln, recordNestedStackParameterExpressions as Lo, sendableAssumeRoleCommand as Lr, describeDockerExecFailure as Ls, isReplacementOrphan as Lt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as M, MULTI_REGION_RECREATE_BLOCKED_TYPES as Ma, hasPlainPrototype$1 as Mc, malformedOrphanRowsKeptWarning as Mi, bindingSkippedOutputs as Mn, dynamicReferenceTokens as Mo, applyRoleArnIfSet as Mr, validateContainerRepoName as Ms, withStackRecords as Mt, beginDeleteWait as N, isStatefulRecreateTargetForReplace as Na, nullPrototypeRecord as Nc, malformedOrphansRefusalMessage as Ni, DEFAULT_RESOURCE_TIMEOUT_MS as Nn, isUncertifiedBaselineMaskPosition as No, assertFlagRoleArn as Nr, buildDenyExternalAccessPolicy as Ns, removeProtectionTypeList as Nt, isProtectionValueActive as O, NO_CC_HANDLERS_REASON as Oa, StageLoadError as Oc, malformedLocalResourceEntriesWarning as Oi, noEchoParameterValueSeed as On, markSameGenerationBag as Oo, poisonRenderedSpellingsCollidingIn as Or, isCrossRegionRedirect as Os, replayRollback as Ot, compensateRemovedDeletionProtection as P, isStatefulRecreateTargetSync as Pa, ownValue as Pc, malformedOrphansWarning as Pi, DEFAULT_RESOURCE_WARN_AFTER_MS as Pn, pathCrossesDottedKey as Po, assertSendableRoleArn as Pr, buildDockerImage as Ps, recordAfterRollbackUpdate as Pt, gray as Q, templateResourceTypes as Qa, refuseMalformedOutputsForDestroy as Qi, definedAttributes as Qn, LockManager as Qo, isImpossibleEmptyStoredAttribute as Qr, stripControlChars as Qs, updatePartialMessage as Qt, DELETE_INDEX_WAIT_PROCEED_NOTE as R, isWarmThroughputDecrease as Ra, renderAssemblyPathEscape as Rc, malformedResourceEntriesWarning as Ri, formatDestructiveChange as Rn, recoverMaskedOutput as Ro, AWS_CREDENTIAL_ENV_KEYS as Rr, describeDockerFailure as Rs, planFailedOps as Rt, noEchoAttributeNamesOf as S, unreadableResourceEntries as Sa, decodeListingKey as Sc, isReadableOrphanRecord as Si, secretBearingStateKeyWarning as Sn, recordLogOnlyValue as So, observeThenDisableInstanceApiTermination as Sr, rewriteTemplateAssetReferences as Ss, isHandledOrphan as St, recordedProtectionEvidence as T, findSilentDropProperties as Ta, canonicalizeRegion as Tc, malformedExportNamesWarning as Ti, exportNameNoEchoParameters as Tn, errorCauseChain as To, DiffCalculator as Tr, assertAssetBucketRegion as Ts, makeForeignHolderScan as Tt, S3_AUTO_DELETE_OBJECTS_TAG as U, configBooleanRefusal as Ua, previewableOrphanRecords as Ui, withCreateTokenLedger as Un, recordNoEchoAttributeValues as Uo, s3BucketArn as Ur, isDockerClientEnvKey as Us, resolveReplacementOldType as Ut, waitForIndexesSettled as V, coerceCfnBoolean as Va, resolveBucketRegion as Vc, malformedScrubResourceEntriesRefusalMessage as Vi, ledgerForStack as Vn, recordMaskOnlyValue as Vo, envCredentialsAreAssumedRole as Vr, formatDockerLoginError as Vs, recordUnderIdIsNotOwn as Vt, hasCdkAutoDeleteTag as W, configIntegerRefusal as Wa, refuseDivergentRecordRegionForDestroy as Wi, acquireIdempotencyToken as Wn, recordProvenPublicExpression as Wo, s3BucketDomainName as Wr, isMalformedEnvKey as Ws, orphanDeleteNeedsIdentity as Wt, bold as X, requireConfigString as Xa, refuseMalformedOrphansForOrphan as Xi, tagMapAsList as Xn, WHOLE_DYNAMIC_REFERENCE_PATTERN as Xo, parameterTypeMayLoseSecretIdentity as Xr, warnFinchArgvExposure as Xs, redactedDeleteAddressFields as Xt, createReadOnlyAttributeHealerFactory as Y, requireConfigObject as Ya, refuseMalformedOrphansForDestroy as Yi, refuseMalformedDesiredTags as Yn, TEMPLATE_SOURCED_RULES as Yo, isUnboundTemplateParameter as Yr, runDockerStreaming as Ys, isRedactedRecordedValue as Yt, cyan as Z, prefetchCreateOnlyPropertyPaths as Za, refuseMalformedOutputs as Zi, tagPlanWarning as Zn, isSingleDynamicReferenceToken as Zo, getAccountInfo as Zr, escapeRegExp$3 as Zs, redactedDeleteAddressSkip as Zt, makeCanonicalizePropertiesFn as _, repairMalformedResourceEntriesForReadOnly as _a, CFN_TEMPLATE_URL_LIMIT as _c, deployRefusesOrphanRowsReason as _i, extractDeploymentEventError as _n, hasMaskableValues as _o, isWaitAbandonedError as _r, stringifyValue as _s, withNestedRevertRun as _t, findNestedTemplateTreeDefect as a, refuseMalformedResourceEntriesForOrphan as aa, loadCdkJson as ac, isStalePlaceholderArnAttribute as ai, stateSecretNameNeedles as an, TemplateParser as ao, TemplateNoEchoReresolver as ar, exportNamesCarriedFrom as as, resourcesNamingDeclaredParameter as at, serviceTokenBlockingReason as b, unpreviewableOrphanRecords as ba, uploadCfnTemplate as bc, hasReadableOutputs as bi, exportAliasCollisionScrubWarning as bn, printingCorpusOf as bo, ec2InstanceProtectionSite as br, createAssetRedirectResolver as bs, deleteJournaledOrphans as bt, renderNestedTemplateTreeDefect as c, refuseMalformedResourcePropertiesForExport as ca, resolveCaptureObservedState as cc, withSharedDrainBudget as ci, buildFinalSnapshotIdentifier as cn, maskWholeValue as co, getCurrentResourceSecrets as cr, hasUnverifiableParameterRefusal as cs, NESTED_PENDING_PARENT_REASON as ct, conditionInputsFrom as d, refuseMalformedResourcesForDestroy as da, resolveStateBucketWithDefaultAndSource as dc, JSON_LISTING_HOLE_VALUE as di, effectiveDeletionPolicy as dn, noEchoOutputsComparison as do, slowCcOperationTimeoutMs as dr, isReadableBag as ds, dropSettledNestedJournals as dt, refuseMalformedResourceEntries as ea, getDockerImageBySourceHash as ec, carriesFetchableDynamicReference as ei, completedReplayEntries as en, withRetry as eo, CC_BROKEN_REASON as er, S3StateBackend as es, red as et, parentSuppliedValues as f, refuseMalformedResourcesForExport as fa, resolveUseCdkBootstrapAssets as fc, STATE_REGION_DIVERGED as fi, isFinalSnapshotError as fn, passedNoEchoParametersOf as fo, unchangedBehindSecretReference as fr, orphansAfterRollback as fs, getNestedRevertRun as ft, mergeNoChangeOutputs as g, repairMalformedOutputsForReadOnly as ga, CFN_TEMPLATE_BODY_LIMIT as gc, accountArgs as gi, DeploymentEventsStore as gn, createUnionSecretMasker as go, withIndeterminateGuard as gr, isSensitiveAttributeName as gs, revertedNestedRowIds as gt, keptWholeReasonText as h, repairMalformedOrphansForReadOnly as ha, ssmResolvedValueType as hc, UNREADABLE_RESOURCES_MAP_ROW as hi, DeploymentEventsReader as hn, carryLogOnlyValues as ho, deleteSkipReason as hr, AssetPublisher as hs, revertNestedChildFromJournal as ht, childTemplateLoader as i, refuseMalformedResourceEntriesForImportSave as ia, getLegacyStateBucketName as ic, cfnRefValueFromPhysicalId as ii, secretNamePrintingBag as in, DagBuilder as io, wouldReturnToSdkProvider as ir, describeRegionValueKind as is, reachableDivergentParameters as it, DynamoDBGlobalTableProvider as j, shownType as ja, hasOwnKey as jc, malformedOrphanRecordsWarning as ji, isExportAliasCollision as jn, DYNAMIC_REFERENCE_TOKEN_SCAN as jo, regionLessSecretName as jr, validateAssetBucketName as js, getStackRecords as jt, perType as k, hasNoCloudControlHandlers as ka, processStackMessages as kc, malformedLocalResourcesWarning as ki, collectDeclaredOutputNames as kn, redactSecretsForState as ko, classifyReplaySecretRegion as kr, parseBootstrapMarker as ks, awaitInFlightSibling as kt, templateIdentity as l, refuseMalformedResourcePropertiesForOrphan as la, resolveSkipPrefix as lc, parameterInputsFor as li, ccRoutedFinalSnapshotError as ln, maskedLeafCoordinatesOf as lo, withPrintingSecrets as lr, importableOutputKeys as ls, displacedOpClause as lt, isSecretBearingReferenceString as m, repairMalformedOrphanRecordsForReadOnly as ma, warnDeprecatedNoPrefixCliFlag as mc, UNREADABLE_ORPHANS_CONTAINER_ROW as mi, unsupportedFinalSnapshotError as mn, liveMatchesUnresolvedTokenFrame as mo, deleteIndeterminateGuards as mr, shouldRetainResource as ms, recordDisplacedSkips as mt, IMPLICIT_DELETE_DEPENDENCIES as n, refuseMalformedResourceEntriesForDestroy as na, synthesisStatusMessage as nc, keepsSecretReferenceToken as ni, maskEventTextWithBoundBags as nn, lambdaFunctionNameForMask as no, ccBrokenReason as nr, splitImportedOps as ns, computeParameterTaint as nt, isAbsoluteAssetPath as o, refuseMalformedResourcePropertiesForDestroy as oa, resolveApp as oc, refStateLookupFromResource as oi, ATOMIC_FINAL_SNAPSHOT_TYPES as on, isMarkedCoordinate as oo, readsNoEchoDeleteValues as or, hasReadableExportSet as os, makeSiblingClaimReader as ot, readRecordedConditionVerdicts as p, refuseMalformedState as pa, stateBucketExistenceConfirmed as pc, STATE_RESOURCES_MALFORMED as pi, refusesFinalSnapshot as pn, readsNoEchoSource as po, UNSPECIFIED_SKIP_REASON as pr, orphansCarriedFrom as ps, nestedChildStackName as pt, markRefusedBeforeApplying as q, replayWarn as qa, refuseMalformedOrphanRecordsForDestroy as qi, planTagDiff as qn, STATE_SOURCED_CROSS_GENERATION_RULES as qo, s3BucketWebsiteUrl as qr, redactedDockerCause as qs, inheritProducerRegions as qt, computeImplicitDeleteEdges as r, refuseMalformedResourceEntriesForImport as ra, getDefaultStateBucketName as rc, AWS_NO_VALUE as ri, orphanRecordsPrintingBag as rn, sameLambdaFunctionAddress as ro, isCustomResource as rr, acceptedCreateOnlyDropsOf as rs, namesAnyDeclaredParameter as rt, listNestedTemplateRows as s, refuseMalformedResourcePropertiesForDrift as sa, resolveAutoAssetStorage as sc, parseWebACLArn as si, PRE_DELETE_SNAPSHOT_TYPES as sn, maskReadbackAtCoordinates as so, isCustomResourceType as sr, hasReasonlessBaselineRefusal as ss, planOrphanAdoption as st, DeployEngine as t, refuseMalformedResourceEntriesForDeploy as ta, Synthesizer as tc, isNamelessDynamicReferenceError as ti, journaledOrphanPrintingBag as tn, canonicalLambdaFunctionName as to, ProviderRegistry as tr, rebuildClientForBucketRegion as ts, yellow as tt, conditionFingerprint as u, refuseMalformedResourcesForDeploy as ua, resolveStateBucketWithDefault as uc, passedParameterClassesOf as ui, createPreDeleteFinalSnapshot as un, noEchoLeavesOf as uo, CloudControlProvider as ur, importableOutputs as us, displacedPhysicalIdShown as ut, deferredServiceTokenWarning as v, repairMalformedResourcePropertiesForReadOnly as va, MIGRATE_TMP_PREFIX as vc, displayLogicalId as vi, WITHHELD_NAME_DISPLAY as vn, literalSplitDelimitersOf as vo, markWaitAbandoned as vr, WorkGraph as vs, getCurrentNestedStackContext as vt, noEchoParameterNamesOf as w, findActionableSilentDrops as wa, PARTITION_TABLE as wc, malformedDriftResourcePropertiesWarning as wi, carriedExportAliasExposure as wn, createSecretMasker as wo, reEnableInstanceApiTermination as wr, BOOTSTRAP_MARKER_PREFIX as ws, loadJournaledOrphans as wt, withResourceDeadline as x, unreadableOrphanRecords as xa, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as xc, hasReadableResources as xi, secretBearing as xn, recordLogOnlyParameterValue as xo, isTerminationProtectionPropagationError as xr, loadPublishableAssetManifest as xs, dropFailedHint as xt, findServiceTokenRefusals as y, repairMalformedResourcesForReadOnly as ya, findLargeInlineResources as yc, hasReadableOrphans as yi, displayTextOrWithheld as yn, logOnlyValueCount as yo, disableInstanceApiTermination as yr, buildAssetRedirectMap as ys, withNestedStackContext as yt, INDEX_SETTLE_POLL_INTERVAL_MS as z, toCfnInteger as za, resolveAssemblyPath as zc, malformedResourcePropertiesWarning as zi, RollbackInlinePolicyWriters as zn, carriesSecretMask as zo, applyCallerIdentityCredentials as zr, dockerSpawnEnvWithSensitive as zs, planRollback as zt };
+//# sourceMappingURL=deploy-engine-4vPufRQF.js.map