@go-to-k/cdkd 0.296.5 → 0.296.6

package/dist/{deploy-engine-Cm7z6aQk.js → deploy-engine-BPcBCyUE.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js"
 import { A as displayIdent, C as withoutGeneratedFallbackName, D as UNRENDERABLE, E as STACK_REF_MAX_CODE_POINTS, F as plainIdentOr, I as safeMsg, M as displayStackName, N as isPasteableIdent, R as truncateCodePoints, S as withStackName, T as SECRET_REF_MAX_CODE_POINTS, _ as generateResourceNameWithFallback, b as looksLikeCdkdGeneratedName, c as installLogLineMaskerSource, g as generateResourceName, h as explicitNamePropertyFor, j as displaySafe, k as displayAwsMessage, l as getLiveRenderer, n as getLogger, p as applyDefaultNameForFallback, r as isStdoutReservedForPayload, s as currentLogLineMasker, v as getCurrentSkipPrefix, x as withSkipPrefix, y as getCurrentStackName } from "./logger-DAaB7GFO.js";
 import { $n as markRedactedCause, $t as LockError, A as isTerminalDeleteFailure, At as CUSTOM_RESOURCE_RESPONSE_PREFIX, Bn as isAmbiguousCcHandlerErrorCode, Bt as clientDefaultsFor, C as refusalTypeShown, Cn as physicalIdShownBesideCommand, Ct as buildForceUnlockCommand, D as ProtectionFlipRegistry, Dn as shellQuote, Dt as formatLockOperation, En as shellBoundedDisplay, Et as formatLockExpiry, Fn as isRecreateRetryableError, Ft as producerRecordKey, Gn as retryClassificationText, H as pasteableAwsCommand, Hn as isIamPropagationError, Ht as AccountIdUnavailableError, In as isReplayedNameCollisionFrom, J as isInterruptedWaitError, Jn as safeStringify$1, Kn as describeAwsFailure, Kt as CrossAccountSecretRefusalError, Lt as withPasteableAwsProfile, M as observeThenDisableProtection, Mn as hasReplayMayCollide, Mt as injectiveKey, N as protectionFlipKey, Nn as isNameCollisionErrorFrom, O as compensateProtectionFlip, On as withheldTargetClause, Ot as formatLockOwner, Pn as isNameCooldownError, Q as canonicalizeRoute53QueryName, Qn as markNonRetryable, R as DELETION_PROTECTION_DOC_POINTER, Rn as markReplayMayCollide, Rt as ambientClientDefaults, S as quotedRemedyLogicalId, Sn as pasteableCommand, St as UNREPRODUCIBLE_LOCK_CLAUSE, T as resolveExplicitPhysicalId, Tn as quotedOrDescribed, U as protectedReplacementAdvice, Un as isRetryableTransientError, Ut as AssetError, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, Wn as isTransientServerError, Wt as CdkdError, X as ElapsedBudgetRegistry, Xn as isMarkedNonRetryable, Xt as IntrinsicResolutionRefusalError, Y as startInterruptWatch, Yt as DynamicReferenceRegionAmbiguousError, Z as monotonicNowMs, Zn as isThrottlingError, _n as SHELL_ACTIVE_WHY, _t as hasCreatedBeforeFailure, an as ResourceTimeoutError, at as segmentAfterAnchor, b as isQuotableImportValue, bt as markAuxiliaryFailure, ct as createMaskedRetryLogger, d as prepareRemovalForUpdate, dt as maskerOrIdentity, en as MacroExpansionError, er as wrapMaskedAwsError, et as compositeIdSeparatorRefusal, f as removalWarning, ft as withDerivedNameMasks, g as assertRegionMatch, gn as SHELL_ACTIVE, gt as createdBeforeFailure, h as RESOURCE_NOT_FOUND, i as holdsSecretDerivedEntry, in as ProvisioningError, it as resourceTypeShown, jn as isUpdateUnsupportedError, jt as DEFAULT_STATE_PREFIX, k as deleteWithProtectionCompensation, kt as sanitizeRecoveryValue, l as withUnchangedSecretPrincipalLists, ln as StateError, lt as isSecretDerivedValue, m as withoutInjectedRemovals, mt as carryCreatedBeforeFailure, nt as logicalIdShown, on as ResourceUpdateNotSupportedError, ot as stateOrphanRecordRemedy, pn as normalizeAwsError, pt as RETRY_AUXILIARY_OWNER, qt as DependencyError, st as createMaskedLogSinks, tn as MalformedProducerRecordRefusalError, un as SynthesisError, ut as maskDeep, vn as UNSHOWABLE_VALUE, vt as isAuxiliaryFailure, wn as plainOrDescribed, x as normalizeAwsTagsToCfn, xn as isInertUnquoted, xt as markCreatedBeforeFailure, yn as commandHole, yt as isAuxiliaryMarkOf, zn as formatRetryClassificationSignals, zt as ambientCredentialConfig } from "./iam-policy-targets-td1X_kKN.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-CjMP26Dj.js";
+import { t as getCdkdVersion } from "./version-BgqcIKdb.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -22050,7 +22050,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DhyYUns2.js");
+			const { ASGProvider } = await import("./asg-provider-C1TlpooI.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -22156,7 +22156,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-B0JrOskT.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DCgJR2NX.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-DeGFzOUc.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CvY6ekmg.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -27446,44 +27446,6 @@ var DeploymentEventsReader = class {
 	}
 };
 
-//#endregion
-//#region src/deployment/update-outcome.ts
-function updatePartialReason(result) {
-	if (!result || result.outcome !== "partial") return void 0;
-	if (typeof result.reason !== "string") return UNSPECIFIED_PARTIAL_REASON;
-	const trimmed = result.reason.trim();
-	return trimmed === "" ? UNSPECIFIED_PARTIAL_REASON : trimmed;
-}
-const UNSPECIFIED_PARTIAL_REASON = "provider reported a partial update without a reason";
-function updatePartialMessage(reason) {
-	return `partial (${reason})`;
-}
-
-//#endregion
-//#region src/provisioning/redacted-delete-address.ts
-function isRedactedRecordedValue(value) {
-	if (carriesSecretMask(value)) return true;
-	let text;
-	try {
-		text = typeof value === "string" ? value : JSON.stringify(value);
-	} catch {
-		return false;
-	}
-	return text !== void 0 && dynamicReferenceTokens(text).length > 0;
-}
-const REDACTED_DELETE_ADDRESS_SKIP_REASON = "redacted address property in state — no delete issued";
-function redactedDeleteAddressFields(fields) {
-	return Object.keys(fields).filter((key) => isRedactedRecordedValue(fields[key]));
-}
-function redactedDeleteAddressSkip(logger, logicalId, what, redactedFields, context) {
-	if (redactedFields.length === 0) return void 0;
-	logger.warn(safeMsg`${what} ${logicalId} is recorded in state with ${redactedFields.join(", ")} ` + "redacted (the '***' mask of a NoEcho value it read, or a secret '{{resolve:...}}' reference), which names nothing in AWS; skipping deletion — no AWS call is issued, so the resource is LEFT IN PLACE unless a parent resource this run also deletes removes it (then only the record is stale). Re-deploying records the same redaction again. The state record is KEPT and the run reports the skip: on 'cdkd destroy' / 'cdkd state destroy' (which exits non-zero) and, since issue 1762, on the plain DELETE of a resource removed from the template during cdkd deploy. Remove the resource by hand, " + safeMsg`then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}. ` + "NOTE a deploy-side REPLACEMENT or rollback delete instead FAILS the resource (https://github.com/go-to-k/cdkd/issues/1762) — the old resource is left untracked there, so remove it by hand.");
-	return {
-		outcome: "skipped",
-		reason: REDACTED_DELETE_ADDRESS_SKIP_REASON
-	};
-}
-
 //#endregion
 //#region src/provisioning/final-snapshot.ts
 const ATOMIC_FINAL_SNAPSHOT_TYPES = /* @__PURE__ */ new Set([
@@ -28129,6 +28091,172 @@ async function prepareCreateRollbackFinalSnapshot(op, provisionedBy, ctx, mask)
 	}
 }
 
+//#endregion
+//#region src/deployment/secret-name-needles.ts
+function secretNameNeedlesOf(logicalId, record, secrets, options) {
+	const physicalId = typeof record?.physicalId === "string" && record.physicalId !== "" ? record.physicalId : void 0;
+	const bag = secrets !== void 0 && hasMaskableValues(secrets) ? secrets : void 0;
+	const mask = (text) => bag === void 0 ? text : maskSecretsInText(text, bag);
+	const unresolved = (value) => value.includes("{{resolve:") || value === "***";
+	const named = {
+		resourceType: record?.resourceType,
+		properties: record?.properties,
+		logicalId
+	};
+	const needles = /* @__PURE__ */ new Set();
+	const add = (needle) => {
+		if (typeof needle === "string" && needle !== "") needles.add(needle);
+	};
+	for (const [raw, derived] of secretDerivedNamePairs({
+		...named,
+		physicalIds: []
+	})) if (typeof raw === "string" && !unresolved(raw) && isSecretDerivedValue(raw, mask)) add(derived);
+	for (const [raw, spelling] of secretDerivedNamePairs({
+		...named,
+		physicalIds: [physicalId ?? "cdkd-no-physical-id-yet"]
+	})) {
+		if (!isSecretDerivedValue(raw, mask)) continue;
+		if (unresolved(raw)) {
+			if (physicalId === void 0) continue;
+			add(spelling);
+		} else {
+			add(raw);
+			if (raw.toLowerCase() !== raw && raw.length >= 4) add(raw.toLowerCase());
+		}
+	}
+	const properties = record?.properties;
+	const path = properties !== null && typeof properties === "object" && Object.hasOwn(properties, "Path") ? properties["Path"] : void 0;
+	if (physicalId !== void 0 && isSecretDerivedValue(path, mask)) add(physicalId);
+	const embedded = options === void 0 ? secrets : options.embedded;
+	const embeddedBag = embedded !== void 0 && hasMaskableValues(embedded) ? embedded : void 0;
+	if (embeddedBag !== void 0 && physicalId !== void 0) {
+		for (const needle of printingCorpusOf(embeddedBag).keys()) if (needle !== "" && (needle === physicalId || needle.length >= 4 && physicalId.includes(needle))) add(needle);
+	}
+	return needles.size > 0 ? needles : void 0;
+}
+function secretNamesReadBy(logicalId, record, resources, judge = () => ({
+	secrets: void 0,
+	embedded: void 0
+})) {
+	const read = /* @__PURE__ */ new Set();
+	const leaves = [...wholeStringLeavesOf(record?.properties)].filter((leaf) => leaf !== "");
+	if (leaves.length === 0) return read;
+	for (const [otherId, other] of Object.entries(resources)) {
+		if (otherId === logicalId) continue;
+		const bags = judge(otherId);
+		const needles = secretNameNeedlesOf(otherId, other, bags.secrets, { embedded: bags.embedded });
+		if (needles === void 0) continue;
+		for (const needle of needles) if (leaves.some((leaf) => leaf === needle || needle.length >= 4 && leaf.includes(needle))) read.add(needle);
+	}
+	return read;
+}
+function stateSecretNameNeedles(resources, secrets) {
+	return (logicalId) => secretNameNeedlesOf(logicalId, Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0, secrets, { embedded: void 0 });
+}
+function secretNamePrintingBag(logicalId, resources) {
+	const bag = /* @__PURE__ */ new Map();
+	const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+	for (const needle of secretNameNeedlesOf(logicalId, record, void 0) ?? []) recordLogOnlyValue(bag, needle);
+	for (const needle of secretNamesReadBy(logicalId, record, resources)) recordLogOnlyValue(bag, needle);
+	return bag;
+}
+function journaledOrphanPrintingBag(ops, stateResources) {
+	const bag = /* @__PURE__ */ new Map();
+	for (const op of ops) {
+		const record = {
+			resourceType: op.resourceType,
+			physicalId: op.physicalId,
+			properties: op.attemptedProperties
+		};
+		const replaced = Object.hasOwn(stateResources, op.logicalId) ? stateResources[op.logicalId] : void 0;
+		for (const needle of [
+			...secretNameNeedlesOf(op.logicalId, record, void 0) ?? [],
+			...secretNameNeedlesOf(op.logicalId, replaced, void 0) ?? [],
+			...secretNamesReadBy(op.logicalId, record, stateResources)
+		]) recordLogOnlyValue(bag, needle);
+	}
+	return bag;
+}
+function completedReplayEntries(ops) {
+	return ops.flatMap((op) => [{
+		logicalId: op.logicalId,
+		resourceType: op.resourceType,
+		physicalId: op.physicalId,
+		properties: op.properties,
+		attemptedProperties: op.properties
+	}, ...op.previousState === void 0 ? [] : [{
+		logicalId: op.logicalId,
+		resourceType: op.previousState.resourceType,
+		physicalId: op.previousState.physicalId,
+		properties: op.previousState.properties,
+		attemptedProperties: op.previousState.properties
+	}]]);
+}
+function orphanRecordsPrintingBag(records) {
+	const bag = /* @__PURE__ */ new Map();
+	for (const entry of records) {
+		if (entry === null || typeof entry !== "object") continue;
+		const { logicalId, state } = entry;
+		if (typeof logicalId !== "string" || state === null || typeof state !== "object") continue;
+		for (const needle of secretNameNeedlesOf(logicalId, state, void 0) ?? []) recordLogOnlyValue(bag, needle);
+	}
+	return bag;
+}
+const ORPHAN_COMMAND_LABEL = "To orphan it: ";
+function maskEventTextWithBoundBags(event) {
+	if (event.reason === void 0 && event.error === void 0) return event;
+	const mask = currentLogLineMasker();
+	if (mask === void 0) return event;
+	const masked = { ...event };
+	if (masked.error?.message) {
+		const message = masked.error.ownLines === true ? masked.error.message.split("\n").map((line) => line.startsWith(ORPHAN_COMMAND_LABEL) ? line : mask(line)).join("\n") : mask(masked.error.message);
+		masked.error = {
+			...masked.error,
+			message
+		};
+	}
+	if (masked.reason) masked.reason = mask(masked.reason);
+	return masked;
+}
+
+//#endregion
+//#region src/deployment/update-outcome.ts
+function updatePartialReason(result) {
+	if (!result || result.outcome !== "partial") return void 0;
+	if (typeof result.reason !== "string") return UNSPECIFIED_PARTIAL_REASON;
+	const trimmed = result.reason.trim();
+	return trimmed === "" ? UNSPECIFIED_PARTIAL_REASON : trimmed;
+}
+const UNSPECIFIED_PARTIAL_REASON = "provider reported a partial update without a reason";
+function updatePartialMessage(reason) {
+	return `partial (${reason})`;
+}
+
+//#endregion
+//#region src/provisioning/redacted-delete-address.ts
+function isRedactedRecordedValue(value) {
+	if (carriesSecretMask(value)) return true;
+	let text;
+	try {
+		text = typeof value === "string" ? value : JSON.stringify(value);
+	} catch {
+		return false;
+	}
+	return text !== void 0 && dynamicReferenceTokens(text).length > 0;
+}
+const REDACTED_DELETE_ADDRESS_SKIP_REASON = "redacted address property in state — no delete issued";
+function redactedDeleteAddressFields(fields) {
+	return Object.keys(fields).filter((key) => isRedactedRecordedValue(fields[key]));
+}
+function redactedDeleteAddressSkip(logger, logicalId, what, redactedFields, context) {
+	if (redactedFields.length === 0) return void 0;
+	logger.warn(safeMsg`${what} ${logicalId} is recorded in state with ${redactedFields.join(", ")} ` + "redacted (the '***' mask of a NoEcho value it read, or a secret '{{resolve:...}}' reference), which names nothing in AWS; skipping deletion — no AWS call is issued, so the resource is LEFT IN PLACE unless a parent resource this run also deletes removes it (then only the record is stale). Re-deploying records the same redaction again. The state record is KEPT and the run reports the skip: on 'cdkd destroy' / 'cdkd state destroy' (which exits non-zero) and, since issue 1762, on the plain DELETE of a resource removed from the template during cdkd deploy. Remove the resource by hand, " + safeMsg`then drop the record with ${stateOrphanRecordRemedy(context, logicalId)}. ` + "NOTE a deploy-side REPLACEMENT or rollback delete instead FAILS the resource (https://github.com/go-to-k/cdkd/issues/1762) — the old resource is left untracked there, so remove it by hand.");
+	return {
+		outcome: "skipped",
+		reason: REDACTED_DELETE_ADDRESS_SKIP_REASON
+	};
+}
+
 //#endregion
 //#region src/deployment/rollback-executor/replay-inline-policy-restore.ts
 async function restoreHeldInlinePolicies(writers, stateResources, stackName, ctx, result, options = {}) {
@@ -29861,7 +29989,7 @@ async function revertNestedChildFromJournal(args) {
 			providerRegistry: ctx.providerRegistry,
 			region,
 			logger,
-			...ctx.options?.eventRecorder && { recordEvent: (event) => ctx.options.eventRecorder.record(event) },
+			...ctx.options?.eventRecorder && { recordEvent: (event) => ctx.options.eventRecorder.record(maskEventTextWithBoundBags(event)) },
 			finalSnapshotClients: ctx.options?.finalSnapshotClients,
 			skipFinalSnapshot: ctx.options?.skipFinalSnapshot === true || ctx.destroyOptions?.skipFinalSnapshot === true,
 			importedProducerRegions: producerRegions.regions,
@@ -29883,11 +30011,11 @@ async function revertNestedChildFromJournal(args) {
 			const skipPrefix = segment.skipPrefix ?? getCurrentSkipPrefix();
 			const split = splitImportedOps(segment.operations, segment);
 			const result = await withNestedStackContext(childCtx, () => withSkipPrefix(skipPrefix, () => withStackName(childStackName, () => withCreateTokenLedger(ledgerForStack(ctx.stateBackend, childStackName, region), () => withNestedRevertRun(runId, async (inner) => {
-				const replayed = await replayRollback(split.replay, stateResources, childStackName, execCtx, {
+				const replayed = await withPrintingSecrets(journaledOrphanPrintingBag(completedReplayEntries(split.replay), stateResources), () => replayRollback(split.replay, stateResources, childStackName, execCtx, {
 					afterOp: save,
 					onOrphan: (record) => mintedOrphans.push(record),
 					inlinePolicyWriters
-				});
+				}));
 				for (const [id, below] of inner.settled) settledBelow.set(id, below);
 				return {
 					...replayed,
@@ -30053,105 +30181,6 @@ function makeSiblingClaimReader(params) {
 	};
 }
 
-//#endregion
-//#region src/deployment/secret-name-needles.ts
-function secretNameNeedlesOf(logicalId, record, secrets, options) {
-	const physicalId = typeof record?.physicalId === "string" && record.physicalId !== "" ? record.physicalId : void 0;
-	const bag = secrets !== void 0 && hasMaskableValues(secrets) ? secrets : void 0;
-	const mask = (text) => bag === void 0 ? text : maskSecretsInText(text, bag);
-	const unresolved = (value) => value.includes("{{resolve:") || value === "***";
-	const named = {
-		resourceType: record?.resourceType,
-		properties: record?.properties,
-		logicalId
-	};
-	const needles = /* @__PURE__ */ new Set();
-	const add = (needle) => {
-		if (typeof needle === "string" && needle !== "") needles.add(needle);
-	};
-	for (const [raw, derived] of secretDerivedNamePairs({
-		...named,
-		physicalIds: []
-	})) if (typeof raw === "string" && !unresolved(raw) && isSecretDerivedValue(raw, mask)) add(derived);
-	for (const [raw, spelling] of secretDerivedNamePairs({
-		...named,
-		physicalIds: [physicalId ?? "cdkd-no-physical-id-yet"]
-	})) {
-		if (!isSecretDerivedValue(raw, mask)) continue;
-		if (unresolved(raw)) {
-			if (physicalId === void 0) continue;
-			add(spelling);
-		} else {
-			add(raw);
-			if (raw.toLowerCase() !== raw && raw.length >= 4) add(raw.toLowerCase());
-		}
-	}
-	const properties = record?.properties;
-	const path = properties !== null && typeof properties === "object" && Object.hasOwn(properties, "Path") ? properties["Path"] : void 0;
-	if (physicalId !== void 0 && isSecretDerivedValue(path, mask)) add(physicalId);
-	const embedded = options === void 0 ? secrets : options.embedded;
-	const embeddedBag = embedded !== void 0 && hasMaskableValues(embedded) ? embedded : void 0;
-	if (embeddedBag !== void 0 && physicalId !== void 0) {
-		for (const needle of printingCorpusOf(embeddedBag).keys()) if (needle !== "" && (needle === physicalId || needle.length >= 4 && physicalId.includes(needle))) add(needle);
-	}
-	return needles.size > 0 ? needles : void 0;
-}
-function secretNamesReadBy(logicalId, record, resources, judge = () => ({
-	secrets: void 0,
-	embedded: void 0
-})) {
-	const read = /* @__PURE__ */ new Set();
-	const leaves = [...wholeStringLeavesOf(record?.properties)].filter((leaf) => leaf !== "");
-	if (leaves.length === 0) return read;
-	for (const [otherId, other] of Object.entries(resources)) {
-		if (otherId === logicalId) continue;
-		const bags = judge(otherId);
-		const needles = secretNameNeedlesOf(otherId, other, bags.secrets, { embedded: bags.embedded });
-		if (needles === void 0) continue;
-		for (const needle of needles) if (leaves.some((leaf) => leaf === needle || needle.length >= 4 && leaf.includes(needle))) read.add(needle);
-	}
-	return read;
-}
-function stateSecretNameNeedles(resources, secrets) {
-	return (logicalId) => secretNameNeedlesOf(logicalId, Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0, secrets, { embedded: void 0 });
-}
-function secretNamePrintingBag(logicalId, resources) {
-	const bag = /* @__PURE__ */ new Map();
-	const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
-	for (const needle of secretNameNeedlesOf(logicalId, record, void 0) ?? []) recordLogOnlyValue(bag, needle);
-	for (const needle of secretNamesReadBy(logicalId, record, resources)) recordLogOnlyValue(bag, needle);
-	return bag;
-}
-function journaledOrphanPrintingBag(ops, stateResources) {
-	const bag = /* @__PURE__ */ new Map();
-	for (const op of ops) {
-		const record = {
-			resourceType: op.resourceType,
-			physicalId: op.physicalId,
-			properties: op.attemptedProperties
-		};
-		const replaced = Object.hasOwn(stateResources, op.logicalId) ? stateResources[op.logicalId] : void 0;
-		for (const needle of [
-			...secretNameNeedlesOf(op.logicalId, record, void 0) ?? [],
-			...secretNameNeedlesOf(op.logicalId, replaced, void 0) ?? [],
-			...secretNamesReadBy(op.logicalId, record, stateResources)
-		]) recordLogOnlyValue(bag, needle);
-	}
-	return bag;
-}
-function maskEventTextWithBoundBags(event) {
-	if (event.reason === void 0 && event.error === void 0) return event;
-	const mask = currentLogLineMasker();
-	if (mask === void 0) return event;
-	const masked = { ...event };
-	if (masked.error?.message && masked.error.ownLines !== true) masked.error = {
-		...masked.error,
-		message: mask(masked.error.message)
-	};
-	if (masked.reason) masked.reason = mask(masked.reason);
-	return masked;
-}
-
 //#endregion
 //#region src/deployment/rollback-executor/journaled-orphans.ts
 const NONE = {
@@ -30493,7 +30522,8 @@ function redactOperationsForJournal(operations) {
 }
 async function adoptRollbackOrphans(currentState, effectiveTemplate) {
 	const records = currentState.orphans ?? [];
-	const plan = await planOrphanAdoption({
+	const named = orphanRecordsPrintingBag(records);
+	const plan = await withPrintingSecrets(named, () => planOrphanAdoption({
 		records,
 		managedLogicalIds: new Set(Object.keys(currentState.resources)),
 		template: effectiveTemplate,
@@ -30514,14 +30544,7 @@ async function adoptRollbackOrphans(currentState, effectiveTemplate) {
 			logger: this.logger
 		}),
 		logger: { debug: (m) => this.logger.debug(m) }
-	});
-	const named = /* @__PURE__ */ new Map();
-	for (const entry of records) {
-		if (entry === null || typeof entry !== "object") continue;
-		const { logicalId, state } = entry;
-		if (typeof logicalId !== "string" || state === null || typeof state !== "object") continue;
-		for (const needle of secretNameNeedlesOf(logicalId, state, void 0) ?? []) recordLogOnlyValue(named, needle);
-	}
+	}));
 	for (const notice of plan.notices) this.logger.info(maskSecretsInText(notice, named));
 	if (plan.refusals.length > 0) throw new Error(`Deploy refused — cdkd left ${plan.refusals.length} resource(s) in AWS that it cannot safely re-adopt:\n  ${plan.refusals.map((r) => maskSecretsInText(r, named)).join("\n  ")}`);
 	for (const [logicalId, record] of Object.entries(plan.adopted)) {
@@ -30531,26 +30554,26 @@ async function adoptRollbackOrphans(currentState, effectiveTemplate) {
 	if (records.length > 0) currentState.orphans = plan.remaining;
 	return plan;
 }
-function orphanReplayPrintingBag(engine, orphanOps, stateResources) {
+function replayPrintingBag(engine, entries, stateResources) {
 	const read = /* @__PURE__ */ new Map();
-	for (const op of orphanOps) {
-		const names = secretNamesReadBy(op.logicalId, { properties: op.attemptedProperties }, stateResources, (otherId) => ({
+	for (const entry of entries) {
+		const names = secretNamesReadBy(entry.logicalId, { properties: entry.properties }, stateResources, (otherId) => ({
 			secrets: engine.namingSecretsFor(otherId),
 			embedded: engine.perResourceSecrets.get(otherId)
 		}));
 		for (const needle of names) recordLogOnlyValue(read, needle);
 	}
 	const own = /* @__PURE__ */ new Map();
-	for (const op of orphanOps) {
-		const needles = secretNameNeedlesOf(op.logicalId, {
-			resourceType: op.resourceType,
-			physicalId: op.physicalId,
-			properties: op.attemptedProperties
-		}, engine.namingSecretsFor(op.logicalId), { embedded: engine.perResourceSecrets.get(op.logicalId) });
+	for (const entry of entries) {
+		const needles = secretNameNeedlesOf(entry.logicalId, {
+			resourceType: entry.resourceType,
+			physicalId: entry.physicalId,
+			properties: entry.properties
+		}, engine.namingSecretsFor(entry.logicalId), { embedded: engine.perResourceSecrets.get(entry.logicalId) });
 		for (const needle of needles ?? []) recordLogOnlyValue(own, needle);
 	}
 	return unionOfSecretBags([
-		...orphanOps.map((op) => engine.printingSecretsFor(op.logicalId)),
+		...entries.map((entry) => engine.printingSecretsFor(entry.logicalId)),
 		own,
 		read
 	]);
@@ -30572,11 +30595,14 @@ async function performRollback(completedOperations, stateResources, stackName, p
 	const runId = this.options.eventRecorder?.runId;
 	const { result, failed, run } = await withNestedRevertRun(runId, async (scope) => {
 		return {
-			failed: orphanOps.length > 0 ? await withPrintingSecrets(orphanReplayPrintingBag(this, orphanOps, stateResources), () => replayFailedOperations(orphanOps, stateResources, stackName, ctx, {
+			failed: orphanOps.length > 0 ? await withPrintingSecrets(replayPrintingBag(this, orphanOps.map((op) => ({
+				...op,
+				properties: op.attemptedProperties
+			})), stateResources), () => replayFailedOperations(orphanOps, stateResources, stackName, ctx, {
 				emitEnvelope: completedOperations.length === 0,
 				inlinePolicyWriters
 			})) : void 0,
-			result: await replayRollback(completedOperations, stateResources, stackName, ctx, { inlinePolicyWriters }),
+			result: await withPrintingSecrets(replayPrintingBag(this, completedReplayEntries(completedOperations), stateResources), () => replayRollback(completedOperations, stateResources, stackName, ctx, { inlinePolicyWriters })),
 			run: scope
 		};
 	});
@@ -37921,5 +37947,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { resourcesNamingDeclaredParameter as $, maskSecretsInError as $a, repairMalformedResourcesForReadOnly as $i, isWaitAbandonedError as $n, isCrossRegionRedirect as $o, hasReadableOrphans as $r, StageLoadError as $s, updatePartialMessage as $t, resolveDynamoDbDeleteBudgetClock as A, prefetchCreateOnlyPropertyPaths as Aa, refuseMalformedOrphansForOrphan as Ai, DBPROXY_TAG_OPTIONS as An, exportNamesCarriedFrom as Ao, isUnboundTemplateParameter as Ar, loadCdkJson as As, demoteSupersededOrphans as At, getPriorAttempts as B, inheritNestedStackParameterAssociations as Ba, refuseMalformedResourcePropertiesForDestroy as Bi, ccBrokenReason as Bn, AssetPublisher as Bo, isStalePlaceholderArnAttribute as Br, ssmResolvedValueType as Bs, ATOMIC_FINAL_SNAPSHOT_TYPES as Bt, perType as C, configIntegerRefusal as Ca, previewableOrphanRecords as Ci, RollbackInlinePolicyWriters as Cn, LockManager as Co, isSettledInstanceState as Cr, stripControlChars as Cs, replayFailedOperations as Ct, beginDeleteWait as D, requireConfigArray as Da, refuseMalformedOrphanRecordsForDestroy as Di, withCreateTokenLedger as Dn, splitImportedOps as Do, s3BucketRegionalDomainName as Dr, synthesisStatusMessage as Ds, getStackRecords as Dt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as E, replayWarn as Ea, refuseMalformedOrphanRecords as Ei, reserveStackCreateToken as En, rebuildClientForBucketRegion as Eo, s3BucketDualStackDomainName as Er, Synthesizer as Es, destroyStackRecordsView as Et, waitForIndexesSettled as F, lambdaFunctionNameForMask as Fa, refuseMalformedResourceEntriesForDeploy as Fi, tagPlanWarning as Fn, importableOutputs as Fo, carriesFetchableDynamicReference as Fr, resolveStateBucketWithDefault as Fs, replacementNeverSwapped as Ft, cyan as G, literalSplitDelimitersOf as Ga, refuseMalformedResourcesForDestroy as Gi, CloudControlProvider as Gn, createAssetRedirectResolver as Go, passedParameterClassesOf as Gr, uploadCfnTemplate as Gs, effectiveDeletionPolicy as Gt, formatResourceLine as H, carryLogOnlyValues as Ha, refuseMalformedResourcePropertiesForExport as Hi, isCustomResourceType as Hn, stringifyValue as Ho, parseWebACLArn as Hr, CFN_TEMPLATE_URL_LIMIT as Hs, buildFinalSnapshotIdentifier as Ht, ECR_AUTO_DELETE_IMAGES_TAG as I, sameLambdaFunctionAddress as Ia, refuseMalformedResourceEntriesForDestroy as Ii, definedAttributes as In, isReadableBag as Io, isNamelessDynamicReferenceError as Ir, resolveStateBucketWithDefaultAndSource as Is, resolveReplacementOldType as It, red as J, recordLogOnlyParameterValue as Ja, repairMalformedOrphanRecordsForReadOnly as Ji, unchangedBehindSecretReference as Jn, AssetModeResolver as Jo, STATE_RESOURCES_MALFORMED as Jr, expectedOwnerParam as Js, unsupportedFinalSnapshotError as Jt, gray as K, logOnlyValueCount as Ka, refuseMalformedResourcesForExport as Ki, slowCcOperationTimeoutMs as Kn, loadPublishableAssetManifest as Ko, JSON_LISTING_HOLE_VALUE as Kr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ks, isFinalSnapshotError as Kt, S3_AUTO_DELETE_OBJECTS_TAG as L, DagBuilder as La, refuseMalformedResourceEntriesForImport as Li, stringifyIfAssigned as Ln, orphansAfterRollback as Lo, keepsSecretReferenceToken as Lr, resolveUseCdkBootstrapAssets as Ls, findNestedStackTypeChanges as Lt, DELETE_INDEX_WAIT_PROCEED_NOTE as M, describeTypeWithThrottleRetry as Ma, refuseMalformedOutputsForDestroy as Mi, readTagList as Mn, hasReasonlessBaselineRefusal as Mo, getAccountInfo as Mr, resolveAutoAssetStorage as Ms, isReplacementOrphan as Mt, INDEX_SETTLE_POLL_INTERVAL_MS as N, withRetry as Na, refuseMalformedResourceAttributesForOrphan as Ni, refuseMalformedDesiredTags as Nn, hasUnverifiableParameterRefusal as No, isImpossibleEmptyStoredAttribute as Nr, resolveCaptureObservedState as Ns, planFailedOps as Nt, compensateRemovedDeletionProtection as O, requireConfigObject as Oa, refuseMalformedOrphans as Oi, acquireIdempotencyToken as On, acceptedCreateOnlyDropsOf as Oo, s3BucketWebsiteUrl as Or, getDefaultStateBucketName as Os, withStackRecords as Ot, deleteTableWithIndexBusyRetry as P, canonicalLambdaFunctionName as Pa, refuseMalformedResourceEntries as Pi, tagMapAsList as Pn, importableOutputKeys as Po, carriesDynamicReference as Pr, resolveSkipPrefix as Ps, planRollback as Pt, reachableDivergentParameters as Q, errorCauseChain as Qa, repairMalformedResourcePropertiesForReadOnly as Qi, withIndeterminateGuard as Qn, getBootstrapMarkerKey as Qo, displayLogicalId as Qr, AssemblyReader as Qs, redactedDeleteAddressSkip as Qt, hasCdkAutoDeleteTag as R, TemplateParser as Ra, refuseMalformedResourceEntriesForImportSave as Ri, CC_BROKEN_REASON as Rn, orphansCarriedFrom as Ro, AWS_NO_VALUE as Rr, stateBucketExistenceConfirmed as Rs, getCurrentProducerRegions as Rt, isProtectionValueActive as S, configBooleanRefusal as Sa, malformedStateRefusalMessage as Si, formatDestructiveChange as Sn, isSingleDynamicReferenceToken as So, envCredentialsAreAssumedRole as Sr, escapeRegExp$3 as Ss, withNestedStackContext as St, DynamoDBGlobalTableProvider as T, readConfigString as Ta, refuseMalformedNestedChildOutputs as Ti, ledgerForStack as Tn, S3StateBackend as To, s3BucketDomainName as Tr, getDockerImageBySourceHash as Ts, awaitInFlightSibling as Tt, createReadOnlyAttributeHealerFactory as U, createUnionSecretMasker as Ua, refuseMalformedResourcePropertiesForOrphan as Ui, getCurrentResourceSecrets as Un, WorkGraph as Uo, withSharedDrainBudget as Ur, MIGRATE_TMP_PREFIX as Us, ccRoutedFinalSnapshotError as Ut, markRefusedBeforeApplying as V, recordNestedStackParameterExpressions as Va, refuseMalformedResourcePropertiesForDrift as Vi, wouldReturnToSdkProvider as Vn, isSensitiveAttributeName as Vo, refStateLookupFromResource as Vr, CFN_TEMPLATE_BODY_LIMIT as Vs, PRE_DELETE_SNAPSHOT_TYPES as Vt, bold as W, hasMaskableValues as Wa, refuseMalformedResourcesForDeploy as Wi, withPrintingSecrets as Wn, buildAssetRedirectMap as Wo, parameterInputsFor as Wr, findLargeInlineResources as Ws, createPreDeleteFinalSnapshot as Wt, computeParameterTaint as X, shareLogOnlyValues as Xa, repairMalformedOutputsForReadOnly as Xi, deleteIndeterminateGuards as Xn, assertAssetBucketRegion as Xo, UNREADABLE_RESOURCES_MAP_ROW as Xr, canonicalizeRegion as Xs, isRedactedRecordedValue as Xt, yellow as Y, recordLogOnlyValue as Ya, repairMalformedOrphansForReadOnly as Yi, UNSPECIFIED_SKIP_REASON as Yn, BOOTSTRAP_MARKER_PREFIX as Yo, UNREADABLE_ORPHANS_CONTAINER_ROW as Yr, PARTITION_TABLE as Ys, REDACTED_DELETE_ADDRESS_SKIP_REASON as Yt, namesAnyDeclaredParameter as Z, createSecretMasker as Za, repairMalformedResourceEntriesForReadOnly as Zi, deleteSkipReason as Zn, ensureAssetStorage as Zo, deployRefusesOrphanRowsReason as Zr, derivePartitionAndUrlSuffix as Zs, redactedDeleteAddressFields as Zt, makeCanonicalizePropertiesFn as _, isWarmThroughputDecrease as _a, malformedRenderedContainersWarning as _i, DEFAULT_RESOURCE_TIMEOUT_MS as _n, STATE_SOURCED_BASELINE_RULES as _o, isIamRoleArn as _r, redactDockerArgvValues as _s, recordDisplacedSkips as _t, findNestedTemplateTreeDefect as a, unwrittenCreateOnlyReplacement as aa, ownValue as ac, malformedExportNamesWarning as ai, displayTextOrWithheld as an, DYNAMIC_REFERENCE_TOKEN_SCAN as ao, reDisableInstanceApiTermination as ar, buildDockerImage as as, journaledOrphanPrintingBag as at, recordedProtectionNote as b, coerceCfnBoolean as ba, malformedResourcesWarning as bi, constructPathOf as bn, TEMPLATE_SOURCED_RULES as bo, applyCallerIdentityCredentials as br, runDockerStreaming as bs, withNestedRevertRun as bt, renderNestedTemplateTreeDefect as c, hasNoCloudControlHandlers as ca, displayAssemblyPath as cc, malformedLocalResourceEntriesWarning as ci, secretBearingStateKeyWarning as cn, pathCrossesDottedKey as co, INTRINSIC_KEYS as cr, describeDockerExecFailure as cs, stateSecretNameNeedles as ct, conditionInputsFrom as d, MULTI_REGION_RECREATE_BLOCKED_TYPES as da, clearBucketRegionCache as dc, malformedOrphanRecordsWarning as di, isWholeDynamicReferenceValue as dn, provenPublicValue as do, producerRegionsFromState as dr, finchSecretArgvRefusal as ds, NESTED_PENDING_PARENT_REASON as dt, unpreviewableOrphanRecords as ea, processStackMessages as ec, hasReadableOutputs as ei, updatePartialReason as en, maskSecretsInText as eo, markWaitAbandoned as er, parseBootstrapMarker as es, deleteJournaledOrphans as et, parentSuppliedValues as f, isStatefulRecreateTargetForReplace as fa, resolveBucketRegion as fc, malformedOrphanRowsKeptWarning as fi, noEchoParameterValueSeed as fn, recordMaskOnlyValue as fo, regionLessSecretName as fr, formatDockerLoginError as fs, displacedOpClause as ft, mergeNoChangeOutputs as g, coerceWarmThroughput as ga, malformedOutputsWarning as gi, bindingSkippedOutputs as gn, wholeStringLeavesOf as go, explicitRoleArnOrThrow as gr, partitionSensitiveEnv as gs, nestedChildStackName as gt, keptWholeReasonText as h, WARM_THROUGHPUT_MEMBERS as ha, malformedOutputsRefusalMessage as hi, isExportAliasCollision as hn, recordProvenPublicExpression as ho, assertSendableRoleArn as hr, isMalformedEnvKey as hs, getNestedRevertRun as ht, childTemplateLoader as i, findSilentDropProperties as ia, nullPrototypeRecord as ic, malformedDriftResourcePropertiesWarning as ii, WITHHELD_NAME_DISPLAY as in, recoverMaskedOutput as io, observeThenDisableInstanceApiTermination as ir, buildDenyExternalAccessPolicy as is, sameJournaledOrphans as it, resolveDynamoDbDeleteBudgetMs as j, templateResourceTypes as ja, refuseMalformedOutputs as ji, planTagDiff as jn, hasReadableExportSet as jo, parameterTypeMayLoseSecretIdentity as jr, resolveApp as js, isJournaledOrphan as jt, deleteBudgetKey as k, requireConfigString as ka, refuseMalformedOrphansForDestroy as ki, DBPROXY_TAGS_WHAT as kn, describeRegionValueKind as ko, coerceParameterTypedValue as kr, getLegacyStateBucketName as ks, recordAfterRollbackUpdate as kt, templateIdentity as l, findReplacedReadersOfRecreateTargets as la, renderAssemblyPathEscape as lc, malformedLocalResourcesWarning as li, secretSafeKeyDisplay as ln, identityKeyFor as lo, IntrinsicFunctionResolver as lr, describeDockerFailure as ls, makeSiblingClaimReader as lt, isSecretBearingReferenceString as m, renderStatefulReason as ma, malformedOrphansWarning as mi, collectPublishedOutputNames as mn, recordNoEchoAttributeValues as mo, assertFlagRoleArn as mr, isDockerClientEnvKey as ms, dropSettledNestedJournals as mt, IMPLICIT_DELETE_DEPENDENCIES as n, unreadableResourceEntries as na, hasOwnKey as nc, isReadableOrphanRecord as ni, DeploymentEventsStore as nn, redactSecretsForState as no, ec2InstanceProtectionSite as nr, validateAssetBucketName as ns, journaledOrphanLines as nt, isAbsoluteAssetPath as o, withoutSilentDropProperties as oa, absoluteAssemblyPathEscape as oc, malformedExportSourceWarning as oi, exportAliasCollisionScrubWarning as on, dynamicReferenceTokens as oo, reEnableInstanceApiTermination as or, resolveDockerContextDirectory as os, maskEventTextWithBoundBags as ot, readRecordedConditionVerdicts as p, isStatefulRecreateTargetSync as pa, malformedOrphansRefusalMessage as pi, collectDeclaredOutputNames as pn, recordMaskOnlyValuesIn as po, applyRoleArnIfSet as pr, getDockerCmd as ps, displacedPhysicalIdShown as pt, green as q, printingCorpusOf as qa, refuseMalformedState as qi, ccProtectionRegistryTypes as qn, rewriteTemplateAssetReferences as qo, STATE_REGION_DIVERGED as qr, decodeListingKey as qs, refusesFinalSnapshot as qt, computeImplicitDeleteEdges as r, findActionableSilentDrops as ra, hasPlainPrototype$1 as rc, isReadableResourceEntry as ri, extractDeploymentEventError as rn, scrubResourceRecord as ro, isTerminationProtectionPropagationError as rr, validateContainerRepoName as rs, loadJournaledOrphans as rt, listNestedTemplateRows as s, NO_CC_HANDLERS_REASON as sa, describeFileReadFailure as sc, malformedLocalOutputsWarning as si, secretBearing as sn, isUncertifiedBaselineMaskPosition as so, DiffCalculator as sr, describeDockerCapturedOutput as ss, secretNamePrintingBag as st, DeployEngine as t, unreadableOrphanRecords as ta, defineOwnKey as tc, hasReadableResources as ti, DeploymentEventsReader as tn, markSameGenerationBag as to, disableInstanceApiTermination as tr, readBootstrapMarkerBody as ts, isHandledOrphan as tt, conditionFingerprint as u, shownType as ua, resolveAssemblyPath as uc, malformedOrphanRecordsRefusalMessage as ui, exportNameSecretExposure as un, carriesSecretMask as uo, classifyReplaySecretRegion as ur, dockerSpawnEnvWithSensitive as us, planOrphanAdoption as ut, withResourceDeadline as v, toCfnInteger as va, malformedResourceEntriesWarning as vi, DEFAULT_RESOURCE_WARN_AFTER_MS as vn, STATE_SOURCED_CROSS_GENERATION_RULES as vo, sendableAssumeRoleCommand as vr, redactedDockerCause as vs, revertNestedChildFromJournal as vt, readProtection as w, configStringRefusal as wa, refuseDivergentRecordRegionForDestroy as wi, earliestDefined as wn, isLockInfoExpired as wo, s3BucketArn as wr, AssetManifestLoader as ws, replayRollback as wt, PROTECTION_PROPERTY_BY_TYPE as x, coerceCfnInteger as xa, malformedScrubResourceEntriesRefusalMessage as xi, findDestructiveChanges as xn, WHOLE_DYNAMIC_REFERENCE_PATTERN as xo, callerEnvCredentials as xr, warnFinchArgvExposure as xs, getCurrentNestedStackContext as xt, recordedProtectionEvidence as y, toFiniteNumber as ya, malformedResourcePropertiesWarning as yi, maskingRetryLogger as yn, STATE_SOURCED_READBACK_RULES as yo, AWS_CREDENTIAL_ENV_KEYS as yr, runDockerForeground as ys, revertedNestedRowIds as yt, isTruthyCfnBoolean as z, liveMatchesUnresolvedTokenFrame as za, refuseMalformedResourceEntriesForOrphan as zi, ProviderRegistry as zn, shouldRetainResource as zo, cfnRefValueFromPhysicalId as zr, warnDeprecatedNoPrefixCliFlag as zs, inheritProducerRegions as zt };
-//# sourceMappingURL=deploy-engine-Cm7z6aQk.js.map
+export { resourcesNamingDeclaredParameter as $, createSecretMasker as $a, repairMalformedResourceEntriesForReadOnly as $i, deleteSkipReason as $n, ensureAssetStorage as $o, deployRefusesOrphanRowsReason as $r, derivePartitionAndUrlSuffix as $s, effectiveDeletionPolicy as $t, resolveDynamoDbDeleteBudgetClock as A, requireConfigObject as Aa, refuseMalformedOrphans as Ai, acquireIdempotencyToken as An, acceptedCreateOnlyDropsOf as Ao, s3BucketWebsiteUrl as Ar, getDefaultStateBucketName as As, planRollback as At, getPriorAttempts as B, TemplateParser as Ba, refuseMalformedResourceEntriesForImportSave as Bi, CC_BROKEN_REASON as Bn, orphansCarriedFrom as Bo, AWS_NO_VALUE as Br, stateBucketExistenceConfirmed as Bs, updatePartialMessage as Bt, perType as C, coerceCfnInteger as Ca, malformedScrubResourceEntriesRefusalMessage as Ci, findDestructiveChanges as Cn, WHOLE_DYNAMIC_REFERENCE_PATTERN as Co, callerEnvCredentials as Cr, warnFinchArgvExposure as Cs, getStackRecords as Ct, beginDeleteWait as D, readConfigString as Da, refuseMalformedNestedChildOutputs as Di, ledgerForStack as Dn, S3StateBackend as Do, s3BucketDomainName as Dr, getDockerImageBySourceHash as Ds, isJournaledOrphan as Dt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as E, configStringRefusal as Ea, refuseDivergentRecordRegionForDestroy as Ei, earliestDefined as En, isLockInfoExpired as Eo, s3BucketArn as Er, AssetManifestLoader as Es, demoteSupersededOrphans as Et, waitForIndexesSettled as F, withRetry as Fa, refuseMalformedResourceAttributesForOrphan as Fi, refuseMalformedDesiredTags as Fn, hasUnverifiableParameterRefusal as Fo, isImpossibleEmptyStoredAttribute as Fr, resolveCaptureObservedState as Fs, inheritProducerRegions as Ft, cyan as G, createUnionSecretMasker as Ga, refuseMalformedResourcePropertiesForOrphan as Gi, getCurrentResourceSecrets as Gn, WorkGraph as Go, withSharedDrainBudget as Gr, MIGRATE_TMP_PREFIX as Gs, orphanRecordsPrintingBag as Gt, formatResourceLine as H, inheritNestedStackParameterAssociations as Ha, refuseMalformedResourcePropertiesForDestroy as Hi, ccBrokenReason as Hn, AssetPublisher as Ho, isStalePlaceholderArnAttribute as Hr, ssmResolvedValueType as Hs, completedReplayEntries as Ht, ECR_AUTO_DELETE_IMAGES_TAG as I, canonicalLambdaFunctionName as Ia, refuseMalformedResourceEntries as Ii, tagMapAsList as In, importableOutputKeys as Io, carriesDynamicReference as Ir, resolveSkipPrefix as Is, REDACTED_DELETE_ADDRESS_SKIP_REASON as It, red as J, logOnlyValueCount as Ja, refuseMalformedResourcesForExport as Ji, slowCcOperationTimeoutMs as Jn, loadPublishableAssetManifest as Jo, JSON_LISTING_HOLE_VALUE as Jr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Js, ATOMIC_FINAL_SNAPSHOT_TYPES as Jt, gray as K, hasMaskableValues as Ka, refuseMalformedResourcesForDeploy as Ki, withPrintingSecrets as Kn, buildAssetRedirectMap as Ko, parameterInputsFor as Kr, findLargeInlineResources as Ks, secretNamePrintingBag as Kt, S3_AUTO_DELETE_OBJECTS_TAG as L, lambdaFunctionNameForMask as La, refuseMalformedResourceEntriesForDeploy as Li, tagPlanWarning as Ln, importableOutputs as Lo, carriesFetchableDynamicReference as Lr, resolveStateBucketWithDefault as Ls, isRedactedRecordedValue as Lt, DELETE_INDEX_WAIT_PROCEED_NOTE as M, prefetchCreateOnlyPropertyPaths as Ma, refuseMalformedOrphansForOrphan as Mi, DBPROXY_TAG_OPTIONS as Mn, exportNamesCarriedFrom as Mo, isUnboundTemplateParameter as Mr, loadCdkJson as Ms, resolveReplacementOldType as Mt, INDEX_SETTLE_POLL_INTERVAL_MS as N, templateResourceTypes as Na, refuseMalformedOutputs as Ni, planTagDiff as Nn, hasReadableExportSet as No, parameterTypeMayLoseSecretIdentity as Nr, resolveApp as Ns, findNestedStackTypeChanges as Nt, compensateRemovedDeletionProtection as O, replayWarn as Oa, refuseMalformedOrphanRecords as Oi, reserveStackCreateToken as On, rebuildClientForBucketRegion as Oo, s3BucketDualStackDomainName as Or, Synthesizer as Os, isReplacementOrphan as Ot, deleteTableWithIndexBusyRetry as P, describeTypeWithThrottleRetry as Pa, refuseMalformedOutputsForDestroy as Pi, readTagList as Pn, hasReasonlessBaselineRefusal as Po, getAccountInfo as Pr, resolveAutoAssetStorage as Ps, getCurrentProducerRegions as Pt, reachableDivergentParameters as Q, shareLogOnlyValues as Qa, repairMalformedOutputsForReadOnly as Qi, deleteIndeterminateGuards as Qn, assertAssetBucketRegion as Qo, UNREADABLE_RESOURCES_MAP_ROW as Qr, canonicalizeRegion as Qs, createPreDeleteFinalSnapshot as Qt, hasCdkAutoDeleteTag as R, sameLambdaFunctionAddress as Ra, refuseMalformedResourceEntriesForDestroy as Ri, definedAttributes as Rn, isReadableBag as Ro, isNamelessDynamicReferenceError as Rr, resolveStateBucketWithDefaultAndSource as Rs, redactedDeleteAddressFields as Rt, isProtectionValueActive as S, coerceCfnBoolean as Sa, malformedResourcesWarning as Si, constructPathOf as Sn, TEMPLATE_SOURCED_RULES as So, applyCallerIdentityCredentials as Sr, runDockerStreaming as Ss, destroyStackRecordsView as St, DynamoDBGlobalTableProvider as T, configIntegerRefusal as Ta, previewableOrphanRecords as Ti, RollbackInlinePolicyWriters as Tn, LockManager as To, isSettledInstanceState as Tr, stripControlChars as Ts, recordAfterRollbackUpdate as Tt, createReadOnlyAttributeHealerFactory as U, recordNestedStackParameterExpressions as Ua, refuseMalformedResourcePropertiesForDrift as Ui, wouldReturnToSdkProvider as Un, isSensitiveAttributeName as Uo, refStateLookupFromResource as Ur, CFN_TEMPLATE_BODY_LIMIT as Us, journaledOrphanPrintingBag as Ut, markRefusedBeforeApplying as V, liveMatchesUnresolvedTokenFrame as Va, refuseMalformedResourceEntriesForOrphan as Vi, ProviderRegistry as Vn, shouldRetainResource as Vo, cfnRefValueFromPhysicalId as Vr, warnDeprecatedNoPrefixCliFlag as Vs, updatePartialReason as Vt, bold as W, carryLogOnlyValues as Wa, refuseMalformedResourcePropertiesForExport as Wi, isCustomResourceType as Wn, stringifyValue as Wo, parseWebACLArn as Wr, CFN_TEMPLATE_URL_LIMIT as Ws, maskEventTextWithBoundBags as Wt, computeParameterTaint as X, recordLogOnlyParameterValue as Xa, repairMalformedOrphanRecordsForReadOnly as Xi, unchangedBehindSecretReference as Xn, AssetModeResolver as Xo, STATE_RESOURCES_MALFORMED as Xr, expectedOwnerParam as Xs, buildFinalSnapshotIdentifier as Xt, yellow as Y, printingCorpusOf as Ya, refuseMalformedState as Yi, ccProtectionRegistryTypes as Yn, rewriteTemplateAssetReferences as Yo, STATE_REGION_DIVERGED as Yr, decodeListingKey as Ys, PRE_DELETE_SNAPSHOT_TYPES as Yt, namesAnyDeclaredParameter as Z, recordLogOnlyValue as Za, repairMalformedOrphansForReadOnly as Zi, UNSPECIFIED_SKIP_REASON as Zn, BOOTSTRAP_MARKER_PREFIX as Zo, UNREADABLE_ORPHANS_CONTAINER_ROW as Zr, PARTITION_TABLE as Zs, ccRoutedFinalSnapshotError as Zt, makeCanonicalizePropertiesFn as _, WARM_THROUGHPUT_MEMBERS as _a, malformedOutputsRefusalMessage as _i, isExportAliasCollision as _n, recordProvenPublicExpression as _o, assertSendableRoleArn as _r, isMalformedEnvKey as _s, getCurrentNestedStackContext as _t, findNestedTemplateTreeDefect as a, findActionableSilentDrops as aa, hasPlainPrototype$1 as ac, isReadableResourceEntry as ai, extractDeploymentEventError as an, scrubResourceRecord as ao, isTerminationProtectionPropagationError as ar, validateContainerRepoName as as, makeSiblingClaimReader as at, recordedProtectionNote as b, toCfnInteger as ba, malformedResourceEntriesWarning as bi, DEFAULT_RESOURCE_WARN_AFTER_MS as bn, STATE_SOURCED_CROSS_GENERATION_RULES as bo, sendableAssumeRoleCommand as br, redactedDockerCause as bs, replayRollback as bt, renderNestedTemplateTreeDefect as c, withoutSilentDropProperties as ca, absoluteAssemblyPathEscape as cc, malformedExportSourceWarning as ci, exportAliasCollisionScrubWarning as cn, dynamicReferenceTokens as co, reEnableInstanceApiTermination as cr, resolveDockerContextDirectory as cs, displacedOpClause as ct, conditionInputsFrom as d, findReplacedReadersOfRecreateTargets as da, renderAssemblyPathEscape as dc, malformedLocalResourcesWarning as di, secretSafeKeyDisplay as dn, identityKeyFor as do, IntrinsicFunctionResolver as dr, describeDockerFailure as ds, getNestedRevertRun as dt, repairMalformedResourcePropertiesForReadOnly as ea, AssemblyReader as ec, displayLogicalId as ei, isFinalSnapshotError as en, errorCauseChain as eo, withIndeterminateGuard as er, getBootstrapMarkerKey as es, deleteJournaledOrphans as et, parentSuppliedValues as f, shownType as fa, resolveAssemblyPath as fc, malformedOrphanRecordsRefusalMessage as fi, exportNameSecretExposure as fn, carriesSecretMask as fo, classifyReplaySecretRegion as fr, dockerSpawnEnvWithSensitive as fs, nestedChildStackName as ft, mergeNoChangeOutputs as g, renderStatefulReason as ga, malformedOrphansWarning as gi, collectPublishedOutputNames as gn, recordNoEchoAttributeValues as go, assertFlagRoleArn as gr, isDockerClientEnvKey as gs, withNestedRevertRun as gt, keptWholeReasonText as h, isStatefulRecreateTargetSync as ha, malformedOrphansRefusalMessage as hi, collectDeclaredOutputNames as hn, recordMaskOnlyValuesIn as ho, applyRoleArnIfSet as hr, getDockerCmd as hs, revertedNestedRowIds as ht, childTemplateLoader as i, unreadableResourceEntries as ia, hasOwnKey as ic, isReadableOrphanRecord as ii, DeploymentEventsStore as in, redactSecretsForState as io, ec2InstanceProtectionSite as ir, validateAssetBucketName as is, sameJournaledOrphans as it, resolveDynamoDbDeleteBudgetMs as j, requireConfigString as ja, refuseMalformedOrphansForDestroy as ji, DBPROXY_TAGS_WHAT as jn, describeRegionValueKind as jo, coerceParameterTypedValue as jr, getLegacyStateBucketName as js, replacementNeverSwapped as jt, deleteBudgetKey as k, requireConfigArray as ka, refuseMalformedOrphanRecordsForDestroy as ki, withCreateTokenLedger as kn, splitImportedOps as ko, s3BucketRegionalDomainName as kr, synthesisStatusMessage as ks, planFailedOps as kt, templateIdentity as l, NO_CC_HANDLERS_REASON as la, describeFileReadFailure as lc, malformedLocalOutputsWarning as li, secretBearing as ln, isUncertifiedBaselineMaskPosition as lo, DiffCalculator as lr, describeDockerCapturedOutput as ls, displacedPhysicalIdShown as lt, isSecretBearingReferenceString as m, isStatefulRecreateTargetForReplace as ma, resolveBucketRegion as mc, malformedOrphanRowsKeptWarning as mi, noEchoParameterValueSeed as mn, recordMaskOnlyValue as mo, regionLessSecretName as mr, formatDockerLoginError as ms, revertNestedChildFromJournal as mt, IMPLICIT_DELETE_DEPENDENCIES as n, unpreviewableOrphanRecords as na, processStackMessages as nc, hasReadableOutputs as ni, unsupportedFinalSnapshotError as nn, maskSecretsInText as no, markWaitAbandoned as nr, parseBootstrapMarker as ns, journaledOrphanLines as nt, isAbsoluteAssetPath as o, findSilentDropProperties as oa, nullPrototypeRecord as oc, malformedDriftResourcePropertiesWarning as oi, WITHHELD_NAME_DISPLAY as on, recoverMaskedOutput as oo, observeThenDisableInstanceApiTermination as or, buildDenyExternalAccessPolicy as os, planOrphanAdoption as ot, readRecordedConditionVerdicts as p, MULTI_REGION_RECREATE_BLOCKED_TYPES as pa, clearBucketRegionCache as pc, malformedOrphanRecordsWarning as pi, isWholeDynamicReferenceValue as pn, provenPublicValue as po, producerRegionsFromState as pr, finchSecretArgvRefusal as ps, recordDisplacedSkips as pt, green as q, literalSplitDelimitersOf as qa, refuseMalformedResourcesForDestroy as qi, CloudControlProvider as qn, createAssetRedirectResolver as qo, passedParameterClassesOf as qr, uploadCfnTemplate as qs, stateSecretNameNeedles as qt, computeImplicitDeleteEdges as r, unreadableOrphanRecords as ra, defineOwnKey as rc, hasReadableResources as ri, DeploymentEventsReader as rn, markSameGenerationBag as ro, disableInstanceApiTermination as rr, readBootstrapMarkerBody as rs, loadJournaledOrphans as rt, listNestedTemplateRows as s, unwrittenCreateOnlyReplacement as sa, ownValue as sc, malformedExportNamesWarning as si, displayTextOrWithheld as sn, DYNAMIC_REFERENCE_TOKEN_SCAN as so, reDisableInstanceApiTermination as sr, buildDockerImage as ss, NESTED_PENDING_PARENT_REASON as st, DeployEngine as t, repairMalformedResourcesForReadOnly as ta, StageLoadError as tc, hasReadableOrphans as ti, refusesFinalSnapshot as tn, maskSecretsInError as to, isWaitAbandonedError as tr, isCrossRegionRedirect as ts, isHandledOrphan as tt, conditionFingerprint as u, hasNoCloudControlHandlers as ua, displayAssemblyPath as uc, malformedLocalResourceEntriesWarning as ui, secretBearingStateKeyWarning as un, pathCrossesDottedKey as uo, INTRINSIC_KEYS as ur, describeDockerExecFailure as us, dropSettledNestedJournals as ut, withResourceDeadline as v, coerceWarmThroughput as va, malformedOutputsWarning as vi, bindingSkippedOutputs as vn, wholeStringLeavesOf as vo, explicitRoleArnOrThrow as vr, partitionSensitiveEnv as vs, withNestedStackContext as vt, readProtection as w, configBooleanRefusal as wa, malformedStateRefusalMessage as wi, formatDestructiveChange as wn, isSingleDynamicReferenceToken as wo, envCredentialsAreAssumedRole as wr, escapeRegExp$3 as ws, withStackRecords as wt, PROTECTION_PROPERTY_BY_TYPE as x, toFiniteNumber as xa, malformedResourcePropertiesWarning as xi, maskingRetryLogger as xn, STATE_SOURCED_READBACK_RULES as xo, AWS_CREDENTIAL_ENV_KEYS as xr, runDockerForeground as xs, awaitInFlightSibling as xt, recordedProtectionEvidence as y, isWarmThroughputDecrease as ya, malformedRenderedContainersWarning as yi, DEFAULT_RESOURCE_TIMEOUT_MS as yn, STATE_SOURCED_BASELINE_RULES as yo, isIamRoleArn as yr, redactDockerArgvValues as ys, replayFailedOperations as yt, isTruthyCfnBoolean as z, DagBuilder as za, refuseMalformedResourceEntriesForImport as zi, stringifyIfAssigned as zn, orphansAfterRollback as zo, keepsSecretReferenceToken as zr, resolveUseCdkBootstrapAssets as zs, redactedDeleteAddressSkip as zt };
+//# sourceMappingURL=deploy-engine-BPcBCyUE.js.map