@go-to-k/cdkd 0.298.5 → 0.298.7

package/dist/{deploy-engine-Cqmlu_JG.js → deploy-engine-CO0EOAem.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js"
 import { A as UNRENDERABLE, C as looksLikeCdkdGeneratedName, E as withoutGeneratedFallbackName, F as displayStackName, H as truncateCodePoints, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, S as getCurrentStackName, T as withStackName, V as terminalSafe, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
 import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, An as UNSHOWABLE_VALUE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as withheldTargetClause, Bt as recoveryCommandFlags, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as physicalIdShownBesideCommand, G as runDeleteAttempt, Gn as isNameCollisionErrorFrom, H as observeThenDisableProtection, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, J as DELETION_PROTECTION_DOC_POINTER, Jn as isReplayedNameCollisionFrom, Kn as isNameCooldownError, L as ProtectionFlipRegistry, Ln as quotedOrDescribed, Lt as formatLockExpiry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE, Ot as hasCreatedBeforeFailure, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Q as pasteableAwsCommand, Qn as isAmbiguousCcHandlerErrorCode, Qt as clientDefaultsFor, R as compensateProtectionFlip, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, U as protectionFlipKey, Un as isUpdateUnsupportedError, Ut as DEFAULT_STATE_PREFIX, Vt as sanitizeRecoveryValue, Wn as hasReplayMayCollide, Wt as injectiveKey, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Zn as formatRetryClassificationSignals, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, _t as createMaskedLogSinks, an as DependencyError, ar as isMarkedNonRetryable, at as startInterruptWatch, bt as maskDeep, cn as IntrinsicResolutionRefusalError, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as LockError, en as AccountIdUnavailableError, er as isIamPropagationError, f as removalWarning, fn as MacroExpansionError, ft as logicalIdShown, gn as ProvisioningError, gt as stateOrphanRecordRemedy, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, kn as SHELL_ACTIVE_WHY, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, lr as wrapMaskedAwsError, m as withoutInjectedRemovals, mt as resourceTypeShown, nn as CdkdError, nr as isTransientServerError, or as isThrottlingError, ot as ElapsedBudgetRegistry, pn as MalformedProducerRecordRefusalError, qn as isRecreateRetryableError, qt as producerRecordKey, rr as retryClassificationText, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, st as monotonicNowMs, tn as AssetError, tr as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wt as carryCreatedBeforeFailure, xn as StateError, xt as maskerOrIdentity, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-CwKiK9nS.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-B0fI6qqz.js";
+import { t as getCdkdVersion } from "./version-B3Ymd4cN.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -106,6 +106,32 @@ async function resolveCrossAccountStateBucket(accountId, credentials) {
 	};
 }
 
+//#endregion
+//#region src/utils/injected-aws-region.ts
+let injected;
+function injectAwsRegion(region) {
+	injected ??= {
+		value: region,
+		original: process.env["AWS_REGION"]
+	};
+	injected.value = region;
+	process.env["AWS_REGION"] = region;
+}
+function injectedAwsRegionValue() {
+	return injected?.value;
+}
+function withoutInjectedAwsRegion(env) {
+	if (injected === void 0 || env["AWS_REGION"] !== injected.value) return env;
+	const out = { ...env };
+	if (injected.original === void 0) delete out["AWS_REGION"];
+	else out["AWS_REGION"] = injected.original;
+	return out;
+}
+function injectedAwsRegionOverride() {
+	if (injected === void 0 || process.env["AWS_REGION"] !== injected.value) return void 0;
+	return { AWS_REGION: injected.original };
+}
+
 //#endregion
 //#region src/synthesis/app-executor.ts
 const CDK_ASM_VERSION = "38.0.0";
@@ -122,7 +148,7 @@ var AppExecutor = class {
 		this.logger.debug("Executing CDK app:", app);
 		this.logger.debug("Output directory:", outputDir);
 		const env = {
-			...process.env,
+			...withoutInjectedAwsRegion({ ...process.env }),
 			CDK_OUTDIR: outputDir
 		};
 		if (region) env["CDK_DEFAULT_REGION"] = region;
@@ -2272,10 +2298,10 @@ function getDefaultStateBucketName(accountId) {
 function getLegacyStateBucketName(accountId, region) {
 	return `cdkd-state-${accountId}-${region}`;
 }
-async function resolveStateBucketWithDefault(cliBucket, region) {
-	return (await resolveStateBucketWithDefaultAndSource(cliBucket, region)).bucket;
+async function resolveStateBucketWithDefault(cliBucket, region, legacyFallbackRegion) {
+	return (await resolveStateBucketWithDefaultAndSource(cliBucket, region, legacyFallbackRegion)).bucket;
 }
-async function resolveStateBucketWithDefaultAndSource(cliBucket, region) {
+async function resolveStateBucketWithDefaultAndSource(cliBucket, region, legacyFallbackRegion) {
 	const syncResult = resolveStateBucketWithSource(cliBucket);
 	if (syncResult) return syncResult;
 	const logger = getLogger();
@@ -2293,7 +2319,8 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region) {
 	const accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
 	await recordResolvedAccountId(stsClient, accountId);
 	const newName = getDefaultStateBucketName(accountId);
-	const legacyName = getLegacyStateBucketName(accountId, region);
+	let legacyName = getLegacyStateBucketName(accountId, region);
+	let legacyRegion = region;
 	const stsCredentials = stsClient.config?.credentials;
 	const probe = new S3Client({
 		...awsClientDefaults(),
@@ -2301,13 +2328,30 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region) {
 		...typeof stsCredentials === "function" && { credentials: stsCredentials }
 	});
 	try {
-		const [newProbe, legacyProbe] = await Promise.all([probeBucket(probe, newName, probeDeps), probeBucket(probe, legacyName, probeDeps)]);
+		const fallbackRegion = legacyFallbackRegion !== void 0 && legacyFallbackRegion !== region ? legacyFallbackRegion : void 0;
+		const fallbackName = fallbackRegion === void 0 ? void 0 : getLegacyStateBucketName(accountId, fallbackRegion);
+		const [newProbe, primaryLegacyProbe, fallbackProbe] = await Promise.all([
+			probeBucket(probe, newName, probeDeps),
+			probeBucket(probe, legacyName, probeDeps),
+			fallbackName === void 0 ? void 0 : probeBucket(probe, fallbackName, probeDeps)
+		]);
+		let legacyProbe = primaryLegacyProbe;
+		const fallbackExists = fallbackProbe !== void 0 && fallbackProbe !== "missing";
+		const chooseLegacy = async () => {
+			if (!fallbackExists) return;
+			if (primaryLegacyProbe === "missing" || !(primaryLegacyProbe === "ok" && fallbackProbe === "access-denied") && await bucketHasAnyState(probe, fallbackName, probeDeps, "")) {
+				legacyName = fallbackName;
+				legacyRegion = fallbackRegion;
+				legacyProbe = fallbackProbe;
+			}
+		};
 		const newExists = newProbe !== "missing";
-		const legacyExists = legacyProbe !== "missing";
+		const legacyExists = primaryLegacyProbe !== "missing" || fallbackExists;
 		if (newExists && legacyExists) {
 			if (!await bucketHasAnyState(probe, newName, probeDeps)) {
+				await chooseLegacy();
 				if (await bucketHasAnyState(probe, legacyName, probeDeps)) {
-					logger.warn(`Both '${newName}' (new default) and '${legacyName}' (legacy default) exist, but the new bucket is empty and the legacy one has state. Reading from legacy. Run \`cdkd state migrate --region ${region}\` to copy the state into the new bucket and stop seeing this warning.`);
+					logger.warn(`Both '${newName}' (new default) and '${legacyName}' (legacy default) exist, but the new bucket is empty and the legacy one has state. Reading from legacy. Run \`cdkd state migrate --region ${displayIdent(legacyRegion)}\` to copy the state into the new bucket and stop seeing this warning.`);
 					return {
 						bucket: legacyName,
 						source: "default-legacy",
@@ -2331,24 +2375,25 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region) {
 			};
 		}
 		if (legacyExists) {
-			logger.warn(`Using legacy state bucket name '${legacyName}'. The default has changed to '${newName}'. To migrate, run:\n\n    cdkd state migrate --region ${region}\n\n(add --remove-legacy to delete the legacy bucket after a successful copy; legacy support will be dropped in a future release.)`);
+			await chooseLegacy();
+			logger.warn(`Using legacy state bucket name '${legacyName}'. The default has changed to '${newName}'. To migrate, run:\n\n    cdkd state migrate --region ${displayIdent(legacyRegion)}\n\n(add --remove-legacy to delete the legacy bucket after a successful copy; legacy support will be dropped in a future release.)`);
 			return {
 				bucket: legacyName,
 				source: "default-legacy",
 				probe: legacyProbe
 			};
 		}
-		throw new Error(`No cdkd state bucket found for account ${accountId}. Looked for '${newName}' (current default) and '${legacyName}' (legacy default). Run 'cdkd bootstrap' to create '${newName}'.`);
+		throw new Error(`No cdkd state bucket found for account ${accountId}. Looked for '${newName}' (current default) and '${legacyName}'` + (fallbackName === void 0 ? "" : ` / '${fallbackName}'`) + ` (legacy default). Run 'cdkd bootstrap' to create '${newName}'.`);
 	} finally {
 		probe.destroy();
 	}
 }
-async function bucketHasAnyState(client, bucketName, deps) {
+async function bucketHasAnyState(client, bucketName, deps, prefix = "cdkd/") {
 	const { ListObjectsV2Command, expectedOwnerParam } = deps;
 	try {
 		return ((await client.send(new ListObjectsV2Command({
 			Bucket: bucketName,
-			Prefix: "cdkd/",
+			...prefix && { Prefix: prefix },
 			MaxKeys: 1,
 			...await expectedOwnerParam(client)
 		}))).KeyCount ?? 0) > 0;
@@ -3495,7 +3540,11 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 		logger.debug(`Building Docker image via executable: ${shownExecutable} (cwd=${cwd})`);
 		let result;
 		try {
-			result = await spawnStreaming(cmd, args, { cwd });
+			const regionOverride = injectedAwsRegionOverride();
+			result = await spawnStreaming(cmd, args, {
+				cwd,
+				...regionOverride && { env: regionOverride }
+			});
 		} catch (err) {
 			throw options.wrapError(describeDockerFailure(err, args));
 		}
@@ -5567,6 +5616,18 @@ var S3StateBackend = class S3StateBackend {
 		if (await this.headObject(newKey)) return true;
 		return this.legacyBelongsToRegion(stackName, region);
 	}
+	async stateExistsOwnedBy(stackName, region, regionlessOwner) {
+		await this.ensureClientForBucket();
+		if (await this.headObject(this.getStateKey(stackName, region))) return true;
+		const probe = await this.probeLegacyState(stackName);
+		if (probe.kind === "no-region") return region === regionlessOwner;
+		if (probe.kind === "unreadable") throw new Error(`The legacy state record for ${this.displayName(stackName)} cannot be read (${probe.reason}), so cdkd cannot tell which region it belongs to. Name the region with AWS_REGION to proceed.`);
+		return legacyProbeBelongsTo(probe, region);
+	}
+	async rawObjectExists(key) {
+		await this.ensureClientForBucket();
+		return this.headObject(key);
+	}
 	async getState(stackName, region) {
 		await this.ensureClientForBucket();
 		const newKey = this.getStateKey(stackName, region);
@@ -24885,18 +24946,18 @@ var CloudControlProvider = class {
 			return result;
 		} catch (error) {
 			idLog.addId(identifierCarriedBy(error));
-			await this.cleanupFailedCreateRemnant(error, resourceType, logicalId);
+			await this.cleanupFailedCreateRemnant(error, resourceType, logicalId, mask);
 			this.handleError(error, "CREATE", resourceType, logicalId);
 		}
 	}
-	async cleanupFailedCreateRemnant(error, resourceType, logicalId) {
+	async cleanupFailedCreateRemnant(error, resourceType, logicalId, mask) {
 		if (!(error instanceof CloudControlOperationFailedError)) return;
 		if (error.ccOperation !== "CREATE" || !error.physicalId) return;
 		if (error.ccErrorCode === "AlreadyExists") return;
 		if (error.ccErrorCode === "ResourceConflict") return;
 		this.logger.info(`CREATE of ${logicalId} failed after materializing ${error.physicalId}; deleting the remnant so a retry can re-create it`);
 		try {
-			const cleanupResult = await this.delete(logicalId, error.physicalId, resourceType);
+			const cleanupResult = await this.delete(logicalId, error.physicalId, resourceType, void 0, { maskSecrets: mask });
 			if (cleanupResult?.outcome === "skipped") {
 				this.logger.warn(`Skipped deleting the remnant ${error.physicalId} left by the failed CREATE of ${logicalId} (a retry may fail with AlreadyExists until it is removed manually): ${displaySafe(cleanupResult.reason)}`);
 				return;
@@ -25002,7 +25063,7 @@ var CloudControlProvider = class {
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
-		const mask = maskerOrIdentity(void 0);
+		const mask = maskerOrIdentity(context?.maskSecrets);
 		const idLog = new IdScrubLog(this.logger, mask, holdsSecretDerivedLeaf(properties, mask));
 		idLog.addId(physicalId);
 		const result = await inIdLogScope(idLog, () => this.deleteInIdLogScope(logicalId, physicalId, resourceType, properties, context));
@@ -25027,7 +25088,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Cqpxk8Pl.js");
+			const { ASGProvider } = await import("./asg-provider-zprmW9pl.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -25133,7 +25194,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-DlzTjANF.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CpEImWxf.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-Cyb9LwFv.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-Bq25rRgt.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -26500,7 +26561,11 @@ var TemplateNoEchoReresolver = class TemplateNoEchoReresolver {
 
 //#endregion
 //#region src/provisioning/providers/custom-resource-provider.ts
-const DELETE_PATH_UNMASKED = void 0;
+function deletePathMasker(callerMask, noEchoMask) {
+	if (callerMask === void 0) return noEchoMask;
+	if (noEchoMask === void 0) return callerMask;
+	return (text) => callerMask(noEchoMask(text));
+}
 const CR_NO_PROPERTIES_SKIP_REASON = "no properties in state — Delete handler not invoked";
 const CR_NO_SERVICE_TOKEN_SKIP_REASON = "no ServiceToken in state — Delete handler not invoked";
 const CR_MASKED_SERVICE_TOKEN_SKIP_REASON = "masked ServiceToken in state — Delete handler not invoked";
@@ -26996,7 +27061,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				reason: CR_MASKED_PROPERTIES_SKIP_REASON
 			};
 		}
-		const deleteMask = payload === properties ? DELETE_PATH_UNMASKED : reresolved?.maskSecrets;
+		const deleteMask = deletePathMasker(context?.maskSecrets, payload === properties ? void 0 : reresolved?.maskSecrets);
 		const show = (text) => deleteMask === void 0 ? text : deleteMask(text);
 		if (!this.isSnsServiceToken(serviceToken) && await this.isBackingLambdaGone(serviceToken)) {
 			if (context?.stackDestroy === true) {
@@ -28939,7 +29004,7 @@ const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::AppSync::GraphQLApi", "{\"AdditionalAuthenticationProviders\":\"array\",\"AdditionalAuthenticationProviders[]\":\"object\",\"AdditionalAuthenticationProviders[].LambdaAuthorizerConfig\":\"object\",\"AdditionalAuthenticationProviders[].OpenIDConnectConfig\":\"object\",\"AdditionalAuthenticationProviders[].UserPoolConfig\":\"object\",\"EnhancedMetricsConfig\":\"object\",\"EnvironmentVariables\":\"object\",\"LambdaAuthorizerConfig\":\"object\",\"LogConfig\":\"object\",\"OpenIDConnectConfig\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"UserPoolConfig\":\"object\"}"],
 	["AWS::AppSync::Resolver", "{\"CachingConfig\":\"object\",\"CachingConfig.CachingKeys\":\"array\",\"PipelineConfig\":\"object\",\"PipelineConfig.Functions\":\"array\",\"Runtime\":\"object\",\"SyncConfig\":\"object\",\"SyncConfig.LambdaConflictHandlerConfig\":\"object\"}"],
 	["AWS::AutoScaling::AutoScalingGroup", "{\"AvailabilityZoneDistribution\":\"object\",\"AvailabilityZoneIds\":\"array\",\"AvailabilityZoneImpairmentPolicy\":\"object\",\"AvailabilityZones\":\"array\",\"CapacityReservationSpecification\":\"object\",\"CapacityReservationSpecification.CapacityReservationTarget\":\"object\",\"CapacityReservationSpecification.CapacityReservationTarget.CapacityReservationIds\":\"array\",\"CapacityReservationSpecification.CapacityReservationTarget.CapacityReservationResourceGroupArns\":\"array\",\"InstanceLifecyclePolicy\":\"object\",\"InstanceLifecyclePolicy.RetentionTriggers\":\"object\",\"InstanceMaintenancePolicy\":\"object\",\"LaunchTemplate\":\"object\",\"LifecycleHookSpecificationList\":\"array\",\"LifecycleHookSpecificationList[]\":\"object\",\"LoadBalancerNames\":\"array\",\"MetricsCollection\":\"array\",\"MetricsCollection[]\":\"object\",\"MetricsCollection[].Metrics\":\"array\",\"MixedInstancesPolicy\":\"object\",\"MixedInstancesPolicy.InstancesDistribution\":\"object\",\"MixedInstancesPolicy.InstancesDistribution.DistributionSegments\":\"array\",\"MixedInstancesPolicy.InstancesDistribution.DistributionSegments[]\":\"object\",\"MixedInstancesPolicy.InstancesDistribution.DistributionSegments[].TargetCapacityTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.LaunchTemplateSpecification\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[]\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorCount\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorManufacturers\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorNames\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorTotalMemoryMiB\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AllowedInstanceTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselineEbsBandwidthMbps\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors.Cpu\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors.Cpu.References\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors.Cpu.References[]\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.CpuManufacturers\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.ExcludedInstanceTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.InstanceGenerations\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.LocalStorageTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.MemoryGiBPerVCpu\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.MemoryMiB\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.NetworkBandwidthGbps\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.NetworkInterfaceCount\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.TotalLocalStorageGB\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.VCpuCount\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].LaunchTemplateSpecification\":\"object\",\"NotificationConfiguration\":\"object\",\"NotificationConfiguration.NotificationTypes\":\"array\",\"NotificationConfigurations\":\"array\",\"NotificationConfigurations[]\":\"object\",\"NotificationConfigurations[].NotificationTypes\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"TargetGroupARNs\":\"array\",\"TerminationPolicies\":\"array\",\"TrafficSources\":\"array\",\"TrafficSources[]\":\"object\",\"VPCZoneIdentifier\":\"array\"}"],
-	["AWS::BedrockAgentCore::Evaluator", "{\"EvaluatorConfig\":\"object\",\"EvaluatorConfig.CodeBased\":\"object\",\"EvaluatorConfig.CodeBased.LambdaConfig\":\"object\",\"EvaluatorConfig.Derived\":\"object\",\"EvaluatorConfig.Derived.ModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.AdditionalModelRequestFields\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.ResponsesEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.ResponsesEvaluatorModelConfig.Reasoning\":\"object\",\"EvaluatorConfig.LlmAsAJudge\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.AdditionalModelRequestFields\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig.Reasoning\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical[]\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
+	["AWS::BedrockAgentCore::Evaluator", "{\"EvaluatorConfig\":\"object\",\"EvaluatorConfig.CodeBased\":\"object\",\"EvaluatorConfig.CodeBased.LambdaConfig\":\"object\",\"EvaluatorConfig.Derived\":\"object\",\"EvaluatorConfig.Derived.ModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.AdditionalModelRequestFields\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig.StopSequences\":\"array\",\"EvaluatorConfig.Derived.ModelConfig.ResponsesEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.ResponsesEvaluatorModelConfig.Reasoning\":\"object\",\"EvaluatorConfig.LlmAsAJudge\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.AdditionalModelRequestFields\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig.StopSequences\":\"array\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig.Reasoning\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical[]\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::BedrockAgentCore::Runtime", "{\"AgentRuntimeArtifact\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration.Code\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration.Code.S3\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration.EntryPoint\":\"array\",\"AgentRuntimeArtifact.ContainerConfiguration\":\"object\",\"AuthorizerConfiguration\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedAudience\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedClients\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedScopes\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.HostingEnvironments\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.HostingEnvironments[]\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.WorkloadIdentities\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[]\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[].AuthorizingClaimMatchValue\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[].AuthorizingClaimMatchValue.ClaimMatchValue\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[].AuthorizingClaimMatchValue.ClaimMatchValue.MatchValueStringList\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource.SecurityGroupIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource.SubnetIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource.Tags\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.SelfManagedLatticeResource\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[]\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource.SecurityGroupIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource.SubnetIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource.Tags\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.SelfManagedLatticeResource\":\"object\",\"CapacityProviderConfiguration\":\"object\",\"EnvironmentVariables\":\"object\",\"FilesystemConfigurations\":\"array\",\"FilesystemConfigurations[]\":\"object\",\"FilesystemConfigurations[].CapacityProviderVolume\":\"object\",\"FilesystemConfigurations[].EfsAccessPoint\":\"object\",\"FilesystemConfigurations[].S3FilesAccessPoint\":\"object\",\"FilesystemConfigurations[].SessionStorage\":\"object\",\"LifecycleConfiguration\":\"object\",\"NetworkConfiguration\":\"object\",\"NetworkConfiguration.NetworkModeConfig\":\"object\",\"NetworkConfiguration.NetworkModeConfig.SecurityGroups\":\"array\",\"NetworkConfiguration.NetworkModeConfig.Subnets\":\"array\",\"RequestHeaderConfiguration\":\"object\",\"RequestHeaderConfiguration.RequestHeaderAllowlist\":\"array\",\"Tags\":\"object\",\"WorkloadIdentityDetails\":\"object\"}"],
 	["AWS::CertificateManager::Certificate", "{\"DomainValidationOptions\":\"array\",\"DomainValidationOptions[]\":\"object\",\"SubjectAlternativeNames\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::CloudFormation::Stack", "{\"Capabilities\":\"array\",\"NotificationARNs\":\"array\",\"Outputs\":\"array\",\"Outputs[]\":\"object\",\"Parameters\":\"object\",\"StackPolicyBody\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
@@ -30601,8 +30666,8 @@ function replayPrefixScope(input, logger, mask, restoring) {
 	const skip = choice.skipPrefix;
 	return (fn) => withSkipPrefix(skip, fn);
 }
-function createOpMasker(logger, secrets) {
-	const base = createMaskedLogSinks(logger, (text) => maskSecretsInText(text, secrets));
+function createOpMasker(logger, secrets, deployBag) {
+	const base = createMaskedLogSinks(logger, deployBag === void 0 ? (text) => maskSecretsInText(text, secrets) : createUnionSecretMasker([secrets, deployBag]));
 	const pairs = [];
 	let sinks = base;
 	return {
@@ -31842,6 +31907,13 @@ var DeploymentEventsReader = class {
 	}
 };
 
+//#endregion
+//#region src/deployment/rollback-executor/replay-scope.ts
+function withReplayDeletePrinting(scope, fn) {
+	const deployBag = scope.ctx.logOnlyNeedlesFor?.(scope.op.logicalId);
+	return withPrintingSecrets(scope.secrets, () => deployBag === void 0 ? fn() : withPrintingSecrets(deployBag, fn));
+}
+
 //#endregion
 //#region src/deployment/update-outcome.ts
 function updatePartialReason(result) {
@@ -32962,7 +33034,7 @@ async function replayDelete(s) {
 	const createRollbackClaimed = inlinePolicyWriters.claimedFor(op.resourceType, op.logicalId, stateResources);
 	const removeProtection = ctx.removeProtection === true;
 	const physicalId = op.physicalId;
-	const deleteCreated = () => provider.delete(op.logicalId, physicalId, op.resourceType, op.properties, {
+	const deleteCreated = () => withReplayDeletePrinting(s, () => provider.delete(op.logicalId, physicalId, op.resourceType, op.properties, {
 		expectedRegion: ctx.region,
 		...removeProtection && { removeProtection: true },
 		...createRollbackClaimed && { inlinePolicyClaimed: createRollbackClaimed },
@@ -32970,8 +33042,9 @@ async function replayDelete(s) {
 		...ctx.skipFinalSnapshot === true && { skipFinalSnapshot: true },
 		deletionPolicy: snapshotPolicy ? "Snapshot" : "Delete",
 		recordedAttributes: stateResources[op.logicalId]?.attributes,
-		recordedNoEchoLeaves: stateResources[op.logicalId]?.noEchoLeaves
-	});
+		recordedNoEchoLeaves: stateResources[op.logicalId]?.noEchoLeaves,
+		maskSecrets: mask
+	}));
 	const createRollbackDelete = removeProtection ? await runDeleteAttempt(true, deleteCreated) : await deleteCreated();
 	throwIfDeleteSkipped(createRollbackDelete, op.logicalId, op.physicalId, "while rolling back its CREATE", {
 		ctx,
@@ -33027,14 +33100,15 @@ async function replayReadopt(s) {
 		});
 		const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
 		const readoptClaimed = inlinePolicyWriters.claimedFor(op.resourceType, op.logicalId, stateResources);
-		const readoptDelete = await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+		const readoptDelete = await withReplayDeletePrinting(s, () => newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
 			expectedRegion: ctx.region,
 			...readoptClaimed && { inlinePolicyClaimed: readoptClaimed },
 			...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
 			deletionPolicy: replacementDeletePolicy(current.updateReplacePolicy),
 			recordedAttributes: current.attributes,
-			recordedNoEchoLeaves: current.noEchoLeaves
-		});
+			recordedNoEchoLeaves: current.noEchoLeaves,
+			maskSecrets: mask
+		}));
 		throwIfDeleteSkipped(readoptDelete, op.logicalId, current.physicalId, "while reversing its replacement (re-adopting the retained old resource)", {
 			ctx,
 			stackName,
@@ -33229,19 +33303,22 @@ async function replayReverseReplacement(s) {
 		stateResources,
 		region: ctx.region,
 		logger,
-		mask
+		mask,
+		ctx,
+		secrets
 	};
 	const deleteNewResourceFirst = async (purpose) => {
 		const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
 		const deleteNewFirstRoute = resolveNewDeleteRoute();
-		const deleteNewFirst = await deleteNewFirstRoute.provider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+		const deleteNewFirst = await withReplayDeletePrinting(s, () => deleteNewFirstRoute.provider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
 			expectedRegion: ctx.region,
 			...newCopyClaimed && { inlinePolicyClaimed: newCopyClaimed },
 			...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
 			deletionPolicy: replacementDeletePolicy(current.updateReplacePolicy),
 			recordedAttributes: current.attributes,
-			recordedNoEchoLeaves: current.noEchoLeaves
-		});
+			recordedNoEchoLeaves: current.noEchoLeaves,
+			maskSecrets: mask
+		}));
 		throwIfDeleteSkipped(deleteNewFirst, op.logicalId, current.physicalId, purpose, newDeleteGuardScope(deleteNewFirstRoute.provisionedBy));
 		delete stateResources[op.logicalId];
 		await afterOp?.(op.logicalId);
@@ -33354,14 +33431,15 @@ async function replayReverseReplacement(s) {
 	} else if (!deletedNewFirst && !adoptedLiveNewResource) try {
 		const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
 		const deleteNewAfterRecreateRoute = resolveNewDeleteRoute();
-		const deleteNewAfterRecreate = await deleteNewAfterRecreateRoute.provider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+		const deleteNewAfterRecreate = await withReplayDeletePrinting(s, () => deleteNewAfterRecreateRoute.provider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
 			expectedRegion: ctx.region,
 			...newCopyClaimed && { inlinePolicyClaimed: newCopyClaimed },
 			...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
 			deletionPolicy: replacementDeletePolicy(current.updateReplacePolicy),
 			recordedAttributes: current.attributes,
-			recordedNoEchoLeaves: current.noEchoLeaves
-		});
+			recordedNoEchoLeaves: current.noEchoLeaves,
+			maskSecrets: mask
+		}));
 		throwIfDeleteSkipped(deleteNewAfterRecreate, op.logicalId, current.physicalId, "while deleting the new resource after re-creating the old one", newDeleteGuardScope(deleteNewAfterRecreateRoute.provisionedBy));
 	} catch (deleteError) {
 		logger.warn(mask(`  Rollback: old ${safe(op.logicalId)} re-created, but deleting the new resource (${displaySafe(mask(current.physicalId))}) failed: ${displaySafe(deleteError instanceof Error ? deleteError.message : String(deleteError))}. Delete it manually — it is no longer tracked in state.`));
@@ -33399,10 +33477,11 @@ async function deleteMarkedRecreate(error, s) {
 	s.logger.info(safeMsg`  Rollback: deleting ${id}, which the failed re-create of ${shown} made before failing`);
 	let failure;
 	try {
-		const outcome = await s.provider.delete(s.op.logicalId, madeId, s.oldType, s.properties, {
+		const outcome = await withReplayDeletePrinting(s, () => s.provider.delete(s.op.logicalId, madeId, s.oldType, s.properties, {
 			expectedRegion: s.region,
-			deletionPolicy: "Delete"
-		});
+			deletionPolicy: "Delete",
+			maskSecrets: s.mask
+		}));
 		failure = deleteSkipReason(outcome);
 	} catch (deleteError) {
 		failure = deleteError instanceof Error ? deleteError.message : String(deleteError);
@@ -33561,7 +33640,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 	const secrets = /* @__PURE__ */ new Map();
 	const deployBag = ctx.logOnlyNeedlesFor?.(op.logicalId);
 	if (deployBag) carryLogOnlyValues(deployBag, secrets);
-	const opMasker = createOpMasker(logger, secrets);
+	const opMasker = createOpMasker(logger, secrets, deployBag);
 	const mask = opMasker.mask;
 	const scope = {
 		op,
@@ -33669,7 +33748,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 			break;
 		}
 		const secrets = /* @__PURE__ */ new Map();
-		const opMasker = createOpMasker(logger, secrets);
+		const opMasker = createOpMasker(logger, secrets, ctx.logOnlyNeedlesFor?.(op.logicalId));
 		const mask = opMasker.mask;
 		const skipScope = {
 			ctx,
@@ -33790,7 +33869,11 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 					});
 					const failedCreateClaimed = inlinePolicyWriters.claimedFor(op.resourceType, op.logicalId, stateResources);
 					const removeProtection = ctx.removeProtection === true && protectionRemovalProven(op, orphanDeleteChecked || ctx.orphanDeleteProven?.has(op) === true);
-					const deleteFailedCreate = () => provider.delete(op.logicalId, op.physicalId, op.resourceType, op.attemptedProperties, {
+					const deleteFailedCreate = () => withReplayDeletePrinting({
+						ctx,
+						op,
+						secrets
+					}, () => provider.delete(op.logicalId, op.physicalId, op.resourceType, op.attemptedProperties, {
 						expectedRegion: ctx.region,
 						...removeProtection && { removeProtection: true },
 						...failedCreateClaimed && { inlinePolicyClaimed: failedCreateClaimed },
@@ -33803,8 +33886,9 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 							failedCreateOrphan: true,
 							resolveAttemptedProperties: () => resolveReplayProps(op.attemptedProperties, resolver, secrets, ctx, op.logicalId),
 							...ctx.writtenThisRun !== void 0 && { writtenThisRun: ctx.writtenThisRun }
-						}
-					});
+						},
+						maskSecrets: mask
+					}));
 					const failedCreateDelete = removeProtection ? await runDeleteAttempt(true, deleteFailedCreate) : await deleteFailedCreate();
 					throwIfDeleteSkipped(failedCreateDelete, op.logicalId, op.physicalId, "while deleting the partially-created resource", {
 						ctx,
@@ -36048,15 +36132,16 @@ async function replaceDeleteFirstAndRecreate(logicalId, resourceType, oldResourc
 	const finalSnapshotIdentifier = await this.prepareFinalSnapshotForDelete(logicalId, oldResourceType, currentResource, updateReplacePolicy);
 	let deleteResult;
 	try {
-		deleteResult = await oldDeleteProvider.delete(logicalId, currentResource.physicalId, oldResourceType, currentResource.properties, {
+		deleteResult = await withPrintingSecrets(secrets, () => oldDeleteProvider.delete(logicalId, currentResource.physicalId, oldResourceType, currentResource.properties, {
 			expectedRegion: this.stackRegion,
 			forceDataDelete: this.options.forceStatefulRecreation === true,
 			...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
 			...this.replacementDeleteContext(updateReplacePolicy),
 			recordedAttributes: currentResource.attributes,
 			recordedNoEchoLeaves: currentResource.noEchoLeaves,
-			...noEchoDeleteValues !== void 0 && { noEchoDeleteValues }
-		});
+			...noEchoDeleteValues !== void 0 && { noEchoDeleteValues },
+			maskSecrets: createUnionSecretMasker([secrets, this.secretNameBagFor(logicalId)])
+		}));
 	} catch (deleteError) {
 		throw new Error(maskSecretsInText(`Failed to delete old resource ${logicalId} (${currentResource.physicalId}) during the --replace delete-first fallback: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`, secrets), { cause: deleteError instanceof Error ? maskSecretsInError(deleteError, secrets) : void 0 });
 	}
@@ -36178,7 +36263,7 @@ async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentReso
 	let deleteFailed = false;
 	const inlinePolicyClaimed = isStandaloneInlinePolicyType(oldResourceType) ? this.inlinePolicyClaimedFor(oldResourceType, logicalId, this.deployStateResources) : void 0;
 	try {
-		deleteResult = await deleteProvider.delete(logicalId, currentResource.physicalId, oldResourceType, deleteProperties, {
+		deleteResult = await withPrintingSecrets(secrets, () => deleteProvider.delete(logicalId, currentResource.physicalId, oldResourceType, deleteProperties, {
 			expectedRegion: this.stackRegion,
 			forceDataDelete: this.options.forceStatefulRecreation === true,
 			...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
@@ -36186,8 +36271,9 @@ async function deleteReplacedAfterCreate(logicalId, oldResourceType, currentReso
 			recordedAttributes: currentResource.attributes,
 			recordedNoEchoLeaves: currentResource.noEchoLeaves,
 			...noEchoDeleteValues !== void 0 && { noEchoDeleteValues },
-			...inlinePolicyClaimed && { inlinePolicyClaimed }
-		});
+			...inlinePolicyClaimed && { inlinePolicyClaimed },
+			maskSecrets: createUnionSecretMasker([secrets, this.secretNameBagFor(logicalId)])
+		}));
 	} catch (deleteError) {
 		const deleteMsg = maskSecretsInText(deleteError instanceof Error ? deleteError.message : String(deleteError), secrets);
 		deleteFailed = true;
@@ -38100,14 +38186,16 @@ var DynamoDBGlobalTableProvider = class {
 		}
 	}
 	async deleteGlobalTableResource(logicalId, physicalId, resourceType, context, flip) {
-		this.logger.debug(`Deleting DynamoDB GlobalTable ${logicalId}: ${physicalId}`);
+		const deleteMask = context?.maskSecrets ?? ((text) => text);
+		const shownTable = deleteMask(physicalId);
+		this.logger.debug(deleteMask(`Deleting DynamoDB GlobalTable ${logicalId}: ${shownTable}`));
 		const budget = this.deleteBudgets.acquire(deleteBudgetKey(physicalId, context?.expectedRegion), resolveDynamoDbDeleteBudgetMs(), resolveDynamoDbDeleteBudgetClock(), DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS);
 		if (context?.removeProtection === true) try {
 			let observedProtectionOn = false;
 			try {
 				observedProtectionOn = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table?.DeletionProtectionEnabled === true;
 			} catch (observeError) {
-				this.logger.debug(`Could not read DeletionProtectionEnabled on ${physicalId} before disabling it: ${describeAwsFailure(observeError).detail}`);
+				this.logger.debug(deleteMask(`Could not read DeletionProtectionEnabled on ${shownTable} before disabling it: ${describeAwsFailure(observeError).detail}`));
 			}
 			await this.dynamoDBClient.send(new UpdateTableCommand({
 				TableName: physicalId,
@@ -38116,12 +38204,12 @@ var DynamoDBGlobalTableProvider = class {
 			if (observedProtectionOn) flip.flippedOffByThisRun = true;
 			this.logger.debug(`Disabled DeletionProtectionEnabled on ${logicalId}, waiting for ACTIVE`);
 			try {
-				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, 600, budget);
+				await this.waitForTableActiveAfterUpdate(physicalId, logicalId, 600, budget, context?.maskSecrets);
 			} catch (waitErr) {
-				this.logger.debug(`Could not wait for table ${physicalId} ACTIVE after protection flip: ${describeAwsFailure(waitErr).detail}`);
+				this.logger.debug(deleteMask(`Could not wait for table ${shownTable} ACTIVE after protection flip: ${describeAwsFailure(waitErr).detail}`));
 			}
 		} catch (flipError) {
-			if (!(flipError instanceof ResourceNotFoundException$1)) this.logger.debug(`Could not disable DeletionProtectionEnabled on ${physicalId}: ${describeAwsFailure(flipError).detail}`);
+			if (!(flipError instanceof ResourceNotFoundException$1)) this.logger.debug(deleteMask(`Could not disable DeletionProtectionEnabled on ${shownTable}: ${describeAwsFailure(flipError).detail}`));
 		}
 		let currentRegion;
 		try {
@@ -38146,7 +38234,7 @@ var DynamoDBGlobalTableProvider = class {
 						TableName: physicalId,
 						ReplicaUpdates: [{ Delete: { RegionName: region } }]
 					}));
-					await this.waitForReplicaGone(physicalId, region, logicalId, REPLICA_GONE_WAIT_ATTEMPTS, budget);
+					await this.waitForReplicaGone(physicalId, region, logicalId, REPLICA_GONE_WAIT_ATTEMPTS, budget, context?.maskSecrets);
 				} catch (replicaErr) {
 					if (!(replicaErr instanceof ResourceNotFoundException$1)) throw replicaErr;
 				}
@@ -38171,7 +38259,8 @@ var DynamoDBGlobalTableProvider = class {
 				this.logger.debug(`Waiting for indexes on ${physicalId} to settle before DeleteTable`);
 				await this.waitForIndexesActive(physicalId, logicalId, {
 					proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE,
-					budget
+					budget,
+					...context?.maskSecrets && { maskSecrets: context.maskSecrets }
 				});
 			}
 			await deleteTableWithIndexBusyRetry({
@@ -38187,7 +38276,8 @@ var DynamoDBGlobalTableProvider = class {
 				reArm: () => this.waitForIndexesActive(physicalId, logicalId, {
 					maxAttempts: 60,
 					proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE,
-					budget
+					budget,
+					...context?.maskSecrets && { maskSecrets: context.maskSecrets }
 				}),
 				shouldKeepRetrying: () => {
 					if (!budget.isExhausted()) return true;
@@ -38196,7 +38286,7 @@ var DynamoDBGlobalTableProvider = class {
 				},
 				sleepSeam: deleteTableRetryDelays
 			});
-			await this.waitForTableGone(physicalId, logicalId, 600, budget);
+			await this.waitForTableGone(physicalId, logicalId, 600, budget, context?.maskSecrets);
 			this.logger.debug(`Successfully deleted DynamoDB GlobalTable ${logicalId}`);
 			this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 			this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
@@ -38623,13 +38713,14 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		throw new ProvisioningError(maskSecrets(`Replica ${region} for table ${maskSecrets(tableName)} did not disappear within ${wait.pollsRun}s${wait.note()}`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
 	}
-	async waitForTableGone(tableName, logicalId, maxAttempts = 600, budget) {
+	async waitForTableGone(tableName, logicalId, maxAttempts = 600, budget, mask = (text) => text) {
+		const shownName = mask(tableName);
 		const wait = beginDeleteWait(maxAttempts, budget);
-		const watch = startInterruptWatch(`DynamoDB table ${tableName} deletion wait`);
+		const watch = startInterruptWatch(mask(`DynamoDB table ${shownName} deletion wait`));
 		try {
 			while (wait.nextPoll()) {
 				if (watch.isInterrupted()) {
-					this.logger.warn(`DynamoDB GlobalTable ${logicalId}: interrupted while waiting for ${tableName} to disappear. AWS ACCEPTED the DeleteTable and will finish it; cdkd stopped watching.`);
+					this.logger.warn(mask(`DynamoDB GlobalTable ${logicalId}: interrupted while waiting for ${shownName} to disappear. AWS ACCEPTED the DeleteTable and will finish it; cdkd stopped watching.`));
 					return;
 				}
 				try {
@@ -38644,10 +38735,10 @@ var DynamoDBGlobalTableProvider = class {
 			watch.dispose();
 		}
 		if (wait.cutShort) {
-			this.logger.warn(`DynamoDB GlobalTable ${logicalId}: DeleteTable on ${tableName} was ACCEPTED by AWS but cdkd stopped waiting for the table to disappear${wait.note()} The delete completes on AWS's side; a later describe (or a re-run of this destroy) sees it gone.`);
+			this.logger.warn(mask(`DynamoDB GlobalTable ${logicalId}: DeleteTable on ${shownName} was ACCEPTED by AWS but cdkd stopped waiting for the table to disappear${wait.note()} The delete completes on AWS's side; a later describe (or a re-run of this destroy) sees it gone.`));
 			return;
 		}
-		throw new ProvisioningError(`Table ${tableName} did not disappear within ${wait.pollsRun}s${wait.note()}`, "AWS::DynamoDB::GlobalTable", logicalId, tableName);
+		throw new ProvisioningError(mask(`Table ${shownName} did not disappear within ${wait.pollsRun}s${wait.note()}`), "AWS::DynamoDB::GlobalTable", logicalId, tableName);
 	}
 };
 function refuseMalformedReplicaTags(properties, resourceType, logicalId, physicalId) {
@@ -41928,15 +42019,16 @@ async function updateByReplacement({ change, counts, currentProps, currentResour
 			const recreateFinalSnapshotId = await this.prepareFinalSnapshotForDelete(logicalId, oldResourceType, currentResource, updateReplacePolicy);
 			let recreateDeleteResult;
 			try {
-				recreateDeleteResult = await oldDeleteProvider.delete(logicalId, currentResource.physicalId, oldResourceType, currentResource.properties, {
+				recreateDeleteResult = await withPrintingSecrets(updateSecrets, () => oldDeleteProvider.delete(logicalId, currentResource.physicalId, oldResourceType, currentResource.properties, {
 					expectedRegion: this.stackRegion,
 					forceDataDelete: this.options.forceStatefulRecreation === true,
 					...recreateFinalSnapshotId !== void 0 && { finalSnapshotIdentifier: recreateFinalSnapshotId },
 					...this.replacementDeleteContext(updateReplacePolicy),
 					recordedAttributes: currentResource.attributes,
 					recordedNoEchoLeaves: currentResource.noEchoLeaves,
-					...noEchoDeleteValues !== void 0 && { noEchoDeleteValues }
-				});
+					...noEchoDeleteValues !== void 0 && { noEchoDeleteValues },
+					maskSecrets: createUnionSecretMasker([updateSecrets, this.secretNameBagFor(logicalId)])
+				}));
 			} catch (deleteError) {
 				throw new Error(maskSecretsInText(`Failed to destroy old resource ${logicalId} (${currentResource.physicalId}) during ${recreateFlagName}: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`, updateSecrets), { cause: deleteError instanceof Error ? maskSecretsInError(deleteError, updateSecrets) : void 0 });
 			}
@@ -42169,15 +42261,16 @@ async function updateInPlace({ conditions, counts, currentProps, currentPropsAsW
 				const fallbackFinalSnapshotId = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, fallbackUpdateReplacePolicy);
 				let fallbackDeleteResult = void 0;
 				try {
-					fallbackDeleteResult = await updateProvider.delete(logicalId, currentResource.physicalId, resourceType, currentProps, {
+					fallbackDeleteResult = await withPrintingSecrets(updateSecrets, () => updateProvider.delete(logicalId, currentResource.physicalId, resourceType, currentProps, {
 						expectedRegion: this.stackRegion,
 						forceDataDelete: this.options.forceStatefulRecreation === true,
 						...fallbackFinalSnapshotId !== void 0 && { finalSnapshotIdentifier: fallbackFinalSnapshotId },
 						...this.replacementDeleteContext(fallbackUpdateReplacePolicy),
 						recordedAttributes: currentResource.attributes,
 						recordedNoEchoLeaves: currentResource.noEchoLeaves,
-						...noEchoDeleteValues !== void 0 && { noEchoDeleteValues }
-					});
+						...noEchoDeleteValues !== void 0 && { noEchoDeleteValues },
+						maskSecrets: createUnionSecretMasker([updateSecrets, this.secretNameBagFor(logicalId)])
+					}));
 				} catch (deleteError) {
 					const deleteMsg = deleteError instanceof Error ? deleteError.message : String(deleteError);
 					if (!isWaitAbandonedError(deleteError) && !isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound"))) this.logger.debug(`Old resource ${logicalId} already gone, proceeding with CREATE`);
@@ -42499,7 +42592,8 @@ Drop the record with: ${dropCommand}`);
 			deletionPolicy: governingPolicy ?? "Delete",
 			...this.options.skipFinalSnapshot === true && { skipFinalSnapshot: true },
 			recordedAttributes: currentResource.attributes,
-			recordedNoEchoLeaves: currentResource.noEchoLeaves
+			recordedNoEchoLeaves: currentResource.noEchoLeaves,
+			maskSecrets: createUnionSecretMasker([this.secretNameBagFor(logicalId)])
 		}), logicalId, 3, 5e3, deleteProvider);
 	} catch (deleteError) {
 		const msg = deleteError instanceof Error ? deleteError.message : String(deleteError);
@@ -45557,5 +45651,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { isTruthyCfnBoolean as $, isStatefulRecreateTargetForReplace as $a, warnDeprecatedNoPrefixCliFlag as $c, malformedOrphansRefusalMessage as $i, ledgerForStack as $n, markSameGenerationBag as $o, sendableAssumeRoleCommand as $r, AssetPublisher as $s, seedsDeleteFirstGuard as $t, noEchoComparisonForTemplate as A, refuseMalformedResourcesForDeploy as Aa, redactDockerArgvValues as Ac, declaresNoEcho as Ai, journaledOrphanPrintingBag as An, maskWholeValue as Ao, deleteIndeterminateGuards as Ar, LockManager as As, dropFailedHint as At, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as B, unpreviewableOrphanRecords as Ba, Synthesizer as Bc, hasReadableOutputs as Bi, PRE_DELETE_SNAPSHOT_TYPES as Bn, carryLogOnlyValues as Bo, reDisableInstanceApiTermination as Br, splitImportedOps as Bs, getStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedResourceEntriesForImport as Ca, dockerSpawnEnvWithSensitive as Cc, cfnRefValueFromPhysicalId as Ci, renderAssemblyPathEscape as Cl, collectDeclaredOutputNames as Cn, sameLambdaFunctionAddress as Co, applyCustomResourceResponseExpiration as Cr, wholeStringLeavesOf as Cs, revertNestedChildFromJournal as Ct, withResourceDeadline as D, refuseMalformedResourcePropertiesForDrift as Da, isDockerClientEnvKey as Dc, withSharedDrainBudget as Di, DEFAULT_RESOURCE_TIMEOUT_MS as Dn, isMarkedCoordinate as Do, unchangedBehindSecretReference as Dr, TEMPLATE_SOURCED_RULES as Ds, getCurrentNestedStackContext as Dt, serviceTokenBlockingReason as E, refuseMalformedResourcePropertiesForDestroy as Ea, getDockerCmd as Ec, parseWebACLArn as Ei, resolveBucketRegion as El, bindingSkippedOutputs as En, canonicalCoordinates as Eo, slowCcOperationTimeoutMs as Er, STATE_SOURCED_READBACK_RULES as Es, collectNestedChildUnaddressed as Et, PROTECTION_PROPERTY_BY_TYPE as F, repairMalformedOrphansForReadOnly as Fa, escapeRegExp$3 as Fc, UNREADABLE_RESOURCES_MAP_ROW as Fi, secretNamedRecordNeedles as Fn, passedNoEchoParametersOf as Fo, markWaitAbandoned as Fr, CrossPrefixScanCache as Fs, sameJournaledOrphans as Ft, resolveDynamoDbDeleteBudgetMs as G, findSilentDropProperties as Ga, resolveApp as Gc, malformedExportNamesWarning as Gi, isFinalSnapshotError as Gn, printingCorpusOf as Go, poisonRenderedSpellingsCollidingIn as Gr, hasReasonlessBaselineRefusal as Gs, isJournaledOrphan as Gt, compensateRemovedDeletionProtection as H, unreadableResourceEntries as Ha, getDefaultStateBucketName as Hc, isReadableOrphanRecord as Hi, ccRoutedFinalSnapshotError as Hn, hasMaskableValues as Ho, DiffCalculator as Hr, describeRegionValueKind as Hs, removeProtectionTypeList as Ht, isProtectionValueActive as I, repairMalformedOutputsForReadOnly as Ia, stripControlChars as Ic, accountArgs as Ii, stateSecretNameNeedles as In, readbackPathFor as Io, disableInstanceApiTermination as Ir, applyCrossPrefixScan as Is, replayFailedOperations as It, deleteTableWithIndexBusyRetry as J, NO_CC_HANDLERS_REASON as Ja, resolveSkipPrefix as Jc, malformedLocalResourceEntriesWarning as Ji, maskingRetryLogger as Jn, shareLogOnlyValues as Jo, applyRoleArnIfSet as Jr, importableOutputs as Js, planRollback as Jt, DELETE_INDEX_WAIT_PROCEED_NOTE as K, unwrittenCreateOnlyReplacement as Ka, resolveAutoAssetStorage as Kc, malformedExportSourceWarning as Ki, refusesFinalSnapshot as Kn, recordLogOnlyParameterValue as Ko, producerLookupOver as Kr, hasUnverifiableParameterRefusal as Ks, isReplacementOrphan as Kt, perType as L, repairMalformedResourceEntriesForReadOnly as La, stripForDisplay as Lc, deployRefusesOrphanRowsReason as Li, storedSecretNameNeedles as Ln, readsNoEchoSource as Lo, ec2InstanceProtectionSite as Lr, crossPrefixDeniedWarning as Ls, replayRollback as Lt, noEchoParameterNamesOf as M, refuseMalformedResourcesForExport as Ma, runDockerForeground as Mc, STATE_REGION_DIVERGED as Mi, orphanRecordsPrintingBag as Mn, noEchoCoordinatesOf as Mo, deleteSkipReason as Mr, S3StateBackend as Ms, journaledOrphanLines as Mt, recordedProtectionEvidence as N, refuseMalformedState as Na, runDockerStreaming as Nc, STATE_RESOURCES_MALFORMED as Ni, secretNamePrintingBag as Nn, noEchoLeavesOf as No, withIndeterminateGuard as Nr, rebuildClientForBucketRegion as Ns, loadJournaledOrphans as Nt, diffSecurity as O, refuseMalformedResourcePropertiesForExport as Oa, isMalformedEnvKey as Oc, parameterInputsFor as Oi, DEFAULT_RESOURCE_WARN_AFTER_MS as On, maskAtCoordinates as Oo, RollbackInlinePolicyWriters as Or, WHOLE_DYNAMIC_REFERENCE_PATTERN as Os, withNestedStackContext as Ot, recordedProtectionNote as P, repairMalformedOrphanRecordsForReadOnly as Pa, warnFinchArgvExposure as Pc, UNREADABLE_ORPHANS_CONTAINER_ROW as Pi, secretNamePrintingBags as Pn, noEchoOutputsComparison as Po, isWaitAbandonedError as Pr, CrossPrefixReadError as Ps, makeForeignHolderScan as Pt, hasCdkAutoDeleteTag as Q, MULTI_REGION_RECREATE_BLOCKED_TYPES as Qa, stateBucketExistenceConfirmed as Qc, malformedOrphanRowsKeptWarning as Qi, earliestDefined as Qn, maskSecretsInText as Qo, isIamRoleArn as Qr, shouldRetainResource as Qs, resolveReplacementOldType as Qt, readProtection as R, repairMalformedResourcePropertiesForReadOnly as Ra, AssetManifestLoader as Rc, displayLogicalId as Ri, extractDeploymentEventError as Rn, valueAtCoordinate as Ro, isTerminationProtectionPropagationError as Rr, isAccessDenied$1 as Rs, awaitInFlightSibling as Rt, keptForReadoption as S, refuseMalformedResourceEntriesForDestroy as Sa, describeDockerFailure as Sc, AWS_NO_VALUE as Si, displayAssemblyPath as Sl, noEchoParameterValueSeed as Sn, lambdaFunctionNameForMask as So, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Sr, recordProvenPublicExpression as Ss, recordDisplacedSkips as St, findServiceTokenRefusals as T, refuseMalformedResourceEntriesForOrphan as Ta, formatDockerLoginError as Tc, refStateLookupFromResource as Ti, clearBucketRegionCache as Tl, isExportAliasCollision as Tn, TemplateParser as To, CloudControlProvider as Tr, STATE_SOURCED_CROSS_GENERATION_RULES as Ts, withNestedRevertRun as Tt, deleteBudgetKey as U, withheldAccountClause as Ua, getLegacyStateBucketName as Uc, isReadableResourceEntry as Ui, createPreDeleteFinalSnapshot as Un, literalSplitDelimitersOf as Uo, INTRINSIC_KEYS as Ur, exportNamesCarriedFrom as Us, recordAfterRollbackUpdate as Ut, beginDeleteWait as V, unreadableOrphanRecords as Va, synthesisStatusMessage as Vc, hasReadableResources as Vi, buildFinalSnapshotIdentifier as Vn, createUnionSecretMasker as Vo, reEnableInstanceApiTermination as Vr, acceptedCreateOnlyDropsOf as Vs, withStackRecords as Vt, resolveDynamoDbDeleteBudgetClock as W, findActionableSilentDrops as Wa, loadCdkJson as Wc, malformedDriftResourcePropertiesWarning as Wi, effectiveDeletionPolicy as Wn, logOnlyValueCount as Wo, IntrinsicFunctionResolver as Wr, hasReadableExportSet as Ws, demoteSupersededOrphans as Wt, ECR_AUTO_DELETE_IMAGES_TAG as X, findReplacedReadersOfRecreateTargets as Xa, resolveStateBucketWithDefaultAndSource as Xc, malformedOrphanRecordsRefusalMessage as Xi, findDestructiveChanges as Xn, errorCauseChain as Xo, assertSendableRoleArn as Xr, orphansAfterRollback as Xs, recordUnderIdIsNotOwn as Xt, waitForIndexesSettled as Y, hasNoCloudControlHandlers as Ya, resolveStateBucketWithDefault as Yc, malformedLocalResourcesWarning as Yi, constructPathOf as Yn, createSecretMasker as Yo, assertFlagRoleArn as Yr, isReadableBag as Ys, recheckFailedPlan as Yt, S3_AUTO_DELETE_OBJECTS_TAG as Z, shownType as Za, resolveUseCdkBootstrapAssets as Zc, malformedOrphanRecordsWarning as Zi, formatDestructiveChange as Zn, maskSecretsInError as Zo, explicitRoleArnOrThrow as Zr, orphansCarriedFrom as Zs, replacementNeverSwapped as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedOutputs as _a, buildDenyExternalAccessPolicy as _c, isImpossibleEmptyStoredAttribute as _i, hasPlainPrototype$1 as _l, secretSafeKeyDisplay as _n, prefetchCreateOnlyPropertyPaths as _o, TemplateNoEchoReresolver as _r, provenPublicValue as _s, displacedOpClause as _t, findNestedTemplateTreeDefect as a, malformedResourcePropertiesWarning as aa, loadPublishableAssetManifest as ac, s3BucketArn as ai, uploadCfnTemplate as al, isRedactedRecordedValue as an, toCfnInteger as ao, planTagDiff as ar, dynamicReferenceTokens as as, cyan as at, lookupEachName as b, refuseMalformedResourceEntries as ba, describeDockerCapturedOutput as bc, isNamelessDynamicReferenceError as bi, absoluteAssemblyPathEscape as bl, exportNameSecretExposure as bn, withRetry as bo, getCurrentResourceSecrets as br, recordNoEchoAttributeValues as bs, getNestedRevertRun as bt, renderNestedTemplateTreeDefect as c, malformedStateRefusalMessage as ca, BOOTSTRAP_MARKER_PREFIX as cc, s3BucketRegionalDomainName as ci, expectedOwnerParam as cl, updatePartialMessage as cn, coerceCfnInteger as co, tagMapAsList as cr, identityKeyFor as cs, red as ct, conditionInputsFrom as d, refuseMalformedNestedChildOutputs as da, getBootstrapMarkerKey as dc, producerRegionsFromState as di, derivePartitionAndUrlSuffix as dl, DeploymentEventsStore as dn, configStringRefusal as do, stringifyIfAssigned as dr, recoverMaskedOutput as ds, namesAnyDeclaredParameter as dt, malformedOrphansWarning as ea, isSensitiveAttributeName as ec, AWS_CREDENTIAL_ENV_KEYS as ei, ssmResolvedValueType as el, orphanDeleteNeedsIdentity as en, isStatefulRecreateTargetSync as eo, reserveStackCreateToken as er, redactSecretsForState as es, getPriorAttempts as et, parentSuppliedValues as f, refuseMalformedOrphanRecords as fa, isCrossRegionRedirect as fc, regionLessSecretName as fi, AssemblyReader as fl, WITHHELD_NAME_DISPLAY as fn, readConfigString as fo, CC_BROKEN_REASON as fr, physicalNameCopiesOf as fs, reachableDivergentParameters as ft, mergeNoChangeOutputs as g, refuseMalformedOrphansForOrphan as ga, validateContainerRepoName as gc, getAccountInfo as gi, hasOwnKey as gl, secretBearingStateKeyWarning as gn, requireConfigString as go, wouldReturnToSdkProvider as gr, carriesSecretMask as gs, NESTED_PENDING_PARENT_REASON as gt, keptWholeReasonText as h, refuseMalformedOrphansForDestroy as ha, validateAssetBucketName as hc, parameterTypeMayLoseSecretIdentity as hi, defineOwnKey as hl, secretBearing as hn, requireConfigObject as ho, isCustomResource as hr, splitGetAttStringForm as hs, planOrphanAdoption as ht, childTemplateLoader as i, malformedResourceEntriesWarning as ia, createAssetRedirectResolver as ic, isSettledInstanceState as ii, findLargeInlineResources as il, REDACTED_DELETE_ADDRESS_SKIP_REASON as in, isWarmThroughputDecrease as io, DBPROXY_TAG_OPTIONS as ir, DYNAMIC_REFERENCE_TOKEN_SCAN as is, bold as it, noEchoExactEchoLeavesOf as j, refuseMalformedResourcesForDestroy as ja, redactedDockerCause as jc, JSON_LISTING_HOLE_VALUE as ji, maskEventTextWithBoundBags as jn, maskedLeafCoordinatesOf as jo, deleteLeftInPlace as jr, isLockInfoExpired as js, isHandledOrphan as jt, noEchoAttributeNamesOf as k, refuseMalformedResourcePropertiesForOrphan as ka, partitionSensitiveEnv as kc, passedParameterClassesOf as ki, completedReplayEntries as kn, maskReadbackAtCoordinates as ko, UNSPECIFIED_SKIP_REASON as kr, isSingleDynamicReferenceToken as ks, deleteJournaledOrphans as kt, templateIdentity as l, previewableOrphanRecords as la, assertAssetBucketRegion as lc, s3BucketWebsiteUrl as li, PARTITION_TABLE as ll, updatePartialReason as ln, configBooleanRefusal as lo, tagPlanWarning as lr, inheritNestedStackParameterAssociations as ls, yellow as lt, isSecretBearingReferenceString as m, refuseMalformedOrphans as ma, readBootstrapMarkerBody as mc, isUnboundTemplateParameter as mi, processStackMessages as ml, exportAliasCollisionScrubWarning as mn, requireConfigArray as mo, ccBrokenReason as mr, recordPhysicalNameCopy as ms, makeSiblingClaimReader as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedOutputsWarning as na, WorkGraph as nc, callerEnvCredentials as ni, CFN_TEMPLATE_URL_LIMIT as nl, getCurrentProducerRegions as nn, WARM_THROUGHPUT_MEMBERS as no, acquireIdempotencyToken as nr, withPhysicalNameCopies as ns, formatResourceLine as nt, isAbsoluteAssetPath as o, malformedResourcesWarning as oa, rewriteTemplateAssetReferences as oc, s3BucketDomainName as oi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ol, redactedDeleteAddressFields as on, toFiniteNumber as oo, readTagList as or, isUncertifiedBaselineMaskPosition as os, gray as ot, readRecordedConditionVerdicts as p, refuseMalformedOrphanRecordsForDestroy as pa, parseBootstrapMarker as pc, coerceParameterTypedValue as pi, StageLoadError as pl, displayTextOrWithheld as pn, replayWarn as po, ProviderRegistry as pr, recordAttributeIdCopy as ps, resourcesNamingDeclaredParameter as pt, INDEX_SETTLE_POLL_INTERVAL_MS as q, withoutSilentDropProperties as qa, resolveCaptureObservedState as qc, malformedLocalOutputsWarning as qi, unsupportedFinalSnapshotError as qn, recordLogOnlyValue as qo, refuseUnreadableCdkCrossAccountRefs as qr, importableOutputKeys as qs, planFailedOps as qt, computeImplicitDeleteEdges as r, malformedRenderedContainersWarning as ra, buildAssetRedirectMap as rc, envCredentialsAreAssumedRole as ri, MIGRATE_TMP_PREFIX as rl, inheritProducerRegions as rn, coerceWarmThroughput as ro, DBPROXY_TAGS_WHAT as rr, withoutPhysicalNameCopies as rs, createReadOnlyAttributeHealerFactory as rt, listNestedTemplateRows as s, malformedScrubResourceEntriesRefusalMessage as sa, AssetModeResolver as sc, s3BucketDualStackDomainName as si, decodeListingKey as sl, redactedDeleteAddressSkip as sn, coerceCfnBoolean as so, refuseMalformedDesiredTags as sr, pathCrossesDottedKey as ss, green as st, DeployEngine as t, malformedOutputsRefusalMessage as ta, stringifyValue as tc, applyCallerIdentityCredentials as ti, CFN_TEMPLATE_BODY_LIMIT as tl, findNestedStackTypeChanges as tn, renderStatefulReason as to, withCreateTokenLedger as tr, scrubResourceRecord as ts, markRefusedBeforeApplying as tt, conditionFingerprint as u, refuseDivergentRecordRegionForDestroy as ua, ensureAssetStorage as uc, classifyReplaySecretRegion as ui, canonicalizeRegion as ul, DeploymentEventsReader as un, configIntegerRefusal as uo, definedAttributes as ur, recordNestedStackParameterExpressions as us, computeParameterTaint as ut, chunks as v, refuseMalformedOutputsForDestroy as va, buildDockerImage as vc, carriesDynamicReference as vi, nullPrototypeRecord as vl, carriedExportAliasExposure as vn, templateResourceTypes as vo, readsNoEchoDeleteValues as vr, recordMaskOnlyValue as vs, displacedPhysicalIdShown as vt, deferredServiceTokenWarning as w, refuseMalformedResourceEntriesForImportSave as wa, finchSecretArgvRefusal as wc, isStalePlaceholderArnAttribute as wi, resolveAssemblyPath as wl, collectPublishedOutputNames as wn, DagBuilder as wo, customResourceResponseExpirationWarning as wr, STATE_SOURCED_BASELINE_RULES as ws, revertedNestedRowIds as wt, withApiLimit as x, refuseMalformedResourceEntriesForDeploy as xa, describeDockerExecFailure as xc, keepsSecretReferenceToken as xi, describeFileReadFailure as xl, isWholeDynamicReferenceValue as xn, canonicalLambdaFunctionName as xo, withPrintingSecrets as xr, recordNoEchoParameterFreshValue as xs, nestedChildStackName as xt, isAccessDeniedError as y, refuseMalformedResourceAttributesForOrphan as ya, resolveDockerContextDirectory as yc, carriesFetchableDynamicReference as yi, ownValue as yl, exportNameNoEchoParameters as yn, describeTypeWithThrottleRetry as yo, isCustomResourceType as yr, recordMaskOnlyValuesIn as ys, dropSettledNestedJournals as yt, DynamoDBGlobalTableProvider as z, repairMalformedResourcesForReadOnly as za, getDockerImageBySourceHash as zc, hasReadableOrphans as zi, ATOMIC_FINAL_SNAPSHOT_TYPES as zn, liveMatchesUnresolvedTokenFrame as zo, observeThenDisableInstanceApiTermination as zr, isNotImplemented as zs, destroyStackRecordsView as zt };
-//# sourceMappingURL=deploy-engine-Cqmlu_JG.js.map
+export { isTruthyCfnBoolean as $, isStatefulRecreateTargetForReplace as $a, warnDeprecatedNoPrefixCliFlag as $c, malformedOrphansRefusalMessage as $i, ledgerForStack as $n, markSameGenerationBag as $o, sendableAssumeRoleCommand as $r, AssetPublisher as $s, seedsDeleteFirstGuard as $t, noEchoComparisonForTemplate as A, refuseMalformedResourcesForDeploy as Aa, redactDockerArgvValues as Ac, declaresNoEcho as Ai, journaledOrphanPrintingBag as An, maskWholeValue as Ao, deleteIndeterminateGuards as Ar, LockManager as As, dropFailedHint as At, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as B, unpreviewableOrphanRecords as Ba, Synthesizer as Bc, hasReadableOutputs as Bi, PRE_DELETE_SNAPSHOT_TYPES as Bn, carryLogOnlyValues as Bo, reDisableInstanceApiTermination as Br, splitImportedOps as Bs, getStackRecords as Bt, recordRetainedForReadoption as C, refuseMalformedResourceEntriesForImport as Ca, dockerSpawnEnvWithSensitive as Cc, cfnRefValueFromPhysicalId as Ci, renderAssemblyPathEscape as Cl, collectDeclaredOutputNames as Cn, sameLambdaFunctionAddress as Co, applyCustomResourceResponseExpiration as Cr, wholeStringLeavesOf as Cs, revertNestedChildFromJournal as Ct, withResourceDeadline as D, refuseMalformedResourcePropertiesForDrift as Da, isDockerClientEnvKey as Dc, withSharedDrainBudget as Di, clearBucketRegionCache as Dl, DEFAULT_RESOURCE_TIMEOUT_MS as Dn, isMarkedCoordinate as Do, unchangedBehindSecretReference as Dr, TEMPLATE_SOURCED_RULES as Ds, getCurrentNestedStackContext as Dt, serviceTokenBlockingReason as E, refuseMalformedResourcePropertiesForDestroy as Ea, getDockerCmd as Ec, parseWebACLArn as Ei, injectedAwsRegionValue as El, bindingSkippedOutputs as En, canonicalCoordinates as Eo, slowCcOperationTimeoutMs as Er, STATE_SOURCED_READBACK_RULES as Es, collectNestedChildUnaddressed as Et, PROTECTION_PROPERTY_BY_TYPE as F, repairMalformedOrphansForReadOnly as Fa, escapeRegExp$3 as Fc, UNREADABLE_RESOURCES_MAP_ROW as Fi, secretNamedRecordNeedles as Fn, passedNoEchoParametersOf as Fo, markWaitAbandoned as Fr, CrossPrefixScanCache as Fs, sameJournaledOrphans as Ft, resolveDynamoDbDeleteBudgetMs as G, findSilentDropProperties as Ga, resolveApp as Gc, malformedExportNamesWarning as Gi, isFinalSnapshotError as Gn, printingCorpusOf as Go, poisonRenderedSpellingsCollidingIn as Gr, hasReasonlessBaselineRefusal as Gs, isJournaledOrphan as Gt, compensateRemovedDeletionProtection as H, unreadableResourceEntries as Ha, getDefaultStateBucketName as Hc, isReadableOrphanRecord as Hi, ccRoutedFinalSnapshotError as Hn, hasMaskableValues as Ho, DiffCalculator as Hr, describeRegionValueKind as Hs, removeProtectionTypeList as Ht, isProtectionValueActive as I, repairMalformedOutputsForReadOnly as Ia, stripControlChars as Ic, accountArgs as Ii, stateSecretNameNeedles as In, readbackPathFor as Io, disableInstanceApiTermination as Ir, applyCrossPrefixScan as Is, replayFailedOperations as It, deleteTableWithIndexBusyRetry as J, NO_CC_HANDLERS_REASON as Ja, resolveSkipPrefix as Jc, malformedLocalResourceEntriesWarning as Ji, maskingRetryLogger as Jn, shareLogOnlyValues as Jo, applyRoleArnIfSet as Jr, importableOutputs as Js, planRollback as Jt, DELETE_INDEX_WAIT_PROCEED_NOTE as K, unwrittenCreateOnlyReplacement as Ka, resolveAutoAssetStorage as Kc, malformedExportSourceWarning as Ki, refusesFinalSnapshot as Kn, recordLogOnlyParameterValue as Ko, producerLookupOver as Kr, hasUnverifiableParameterRefusal as Ks, isReplacementOrphan as Kt, perType as L, repairMalformedResourceEntriesForReadOnly as La, stripForDisplay as Lc, deployRefusesOrphanRowsReason as Li, storedSecretNameNeedles as Ln, readsNoEchoSource as Lo, ec2InstanceProtectionSite as Lr, crossPrefixDeniedWarning as Ls, replayRollback as Lt, noEchoParameterNamesOf as M, refuseMalformedResourcesForExport as Ma, runDockerForeground as Mc, STATE_REGION_DIVERGED as Mi, orphanRecordsPrintingBag as Mn, noEchoCoordinatesOf as Mo, deleteSkipReason as Mr, S3StateBackend as Ms, journaledOrphanLines as Mt, recordedProtectionEvidence as N, refuseMalformedState as Na, runDockerStreaming as Nc, STATE_RESOURCES_MALFORMED as Ni, secretNamePrintingBag as Nn, noEchoLeavesOf as No, withIndeterminateGuard as Nr, rebuildClientForBucketRegion as Ns, loadJournaledOrphans as Nt, diffSecurity as O, refuseMalformedResourcePropertiesForExport as Oa, isMalformedEnvKey as Oc, parameterInputsFor as Oi, resolveBucketRegion as Ol, DEFAULT_RESOURCE_WARN_AFTER_MS as On, maskAtCoordinates as Oo, RollbackInlinePolicyWriters as Or, WHOLE_DYNAMIC_REFERENCE_PATTERN as Os, withNestedStackContext as Ot, recordedProtectionNote as P, repairMalformedOrphanRecordsForReadOnly as Pa, warnFinchArgvExposure as Pc, UNREADABLE_ORPHANS_CONTAINER_ROW as Pi, secretNamePrintingBags as Pn, noEchoOutputsComparison as Po, isWaitAbandonedError as Pr, CrossPrefixReadError as Ps, makeForeignHolderScan as Pt, hasCdkAutoDeleteTag as Q, MULTI_REGION_RECREATE_BLOCKED_TYPES as Qa, stateBucketExistenceConfirmed as Qc, malformedOrphanRowsKeptWarning as Qi, earliestDefined as Qn, maskSecretsInText as Qo, isIamRoleArn as Qr, shouldRetainResource as Qs, resolveReplacementOldType as Qt, readProtection as R, repairMalformedResourcePropertiesForReadOnly as Ra, AssetManifestLoader as Rc, displayLogicalId as Ri, extractDeploymentEventError as Rn, valueAtCoordinate as Ro, isTerminationProtectionPropagationError as Rr, isAccessDenied$1 as Rs, awaitInFlightSibling as Rt, keptForReadoption as S, refuseMalformedResourceEntriesForDestroy as Sa, describeDockerFailure as Sc, AWS_NO_VALUE as Si, displayAssemblyPath as Sl, noEchoParameterValueSeed as Sn, lambdaFunctionNameForMask as So, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Sr, recordProvenPublicExpression as Ss, recordDisplacedSkips as St, findServiceTokenRefusals as T, refuseMalformedResourceEntriesForOrphan as Ta, formatDockerLoginError as Tc, refStateLookupFromResource as Ti, injectAwsRegion as Tl, isExportAliasCollision as Tn, TemplateParser as To, CloudControlProvider as Tr, STATE_SOURCED_CROSS_GENERATION_RULES as Ts, withNestedRevertRun as Tt, deleteBudgetKey as U, withheldAccountClause as Ua, getLegacyStateBucketName as Uc, isReadableResourceEntry as Ui, createPreDeleteFinalSnapshot as Un, literalSplitDelimitersOf as Uo, INTRINSIC_KEYS as Ur, exportNamesCarriedFrom as Us, recordAfterRollbackUpdate as Ut, beginDeleteWait as V, unreadableOrphanRecords as Va, synthesisStatusMessage as Vc, hasReadableResources as Vi, buildFinalSnapshotIdentifier as Vn, createUnionSecretMasker as Vo, reEnableInstanceApiTermination as Vr, acceptedCreateOnlyDropsOf as Vs, withStackRecords as Vt, resolveDynamoDbDeleteBudgetClock as W, findActionableSilentDrops as Wa, loadCdkJson as Wc, malformedDriftResourcePropertiesWarning as Wi, effectiveDeletionPolicy as Wn, logOnlyValueCount as Wo, IntrinsicFunctionResolver as Wr, hasReadableExportSet as Ws, demoteSupersededOrphans as Wt, ECR_AUTO_DELETE_IMAGES_TAG as X, findReplacedReadersOfRecreateTargets as Xa, resolveStateBucketWithDefaultAndSource as Xc, malformedOrphanRecordsRefusalMessage as Xi, findDestructiveChanges as Xn, errorCauseChain as Xo, assertSendableRoleArn as Xr, orphansAfterRollback as Xs, recordUnderIdIsNotOwn as Xt, waitForIndexesSettled as Y, hasNoCloudControlHandlers as Ya, resolveStateBucketWithDefault as Yc, malformedLocalResourcesWarning as Yi, constructPathOf as Yn, createSecretMasker as Yo, assertFlagRoleArn as Yr, isReadableBag as Ys, recheckFailedPlan as Yt, S3_AUTO_DELETE_OBJECTS_TAG as Z, shownType as Za, resolveUseCdkBootstrapAssets as Zc, malformedOrphanRecordsWarning as Zi, formatDestructiveChange as Zn, maskSecretsInError as Zo, explicitRoleArnOrThrow as Zr, orphansCarriedFrom as Zs, replacementNeverSwapped as Zt, makeCanonicalizePropertiesFn as _, refuseMalformedOutputs as _a, buildDenyExternalAccessPolicy as _c, isImpossibleEmptyStoredAttribute as _i, hasPlainPrototype$1 as _l, secretSafeKeyDisplay as _n, prefetchCreateOnlyPropertyPaths as _o, TemplateNoEchoReresolver as _r, provenPublicValue as _s, displacedOpClause as _t, findNestedTemplateTreeDefect as a, malformedResourcePropertiesWarning as aa, loadPublishableAssetManifest as ac, s3BucketArn as ai, uploadCfnTemplate as al, isRedactedRecordedValue as an, toCfnInteger as ao, planTagDiff as ar, dynamicReferenceTokens as as, cyan as at, lookupEachName as b, refuseMalformedResourceEntries as ba, describeDockerCapturedOutput as bc, isNamelessDynamicReferenceError as bi, absoluteAssemblyPathEscape as bl, exportNameSecretExposure as bn, withRetry as bo, getCurrentResourceSecrets as br, recordNoEchoAttributeValues as bs, getNestedRevertRun as bt, renderNestedTemplateTreeDefect as c, malformedStateRefusalMessage as ca, BOOTSTRAP_MARKER_PREFIX as cc, s3BucketRegionalDomainName as ci, expectedOwnerParam as cl, updatePartialMessage as cn, coerceCfnInteger as co, tagMapAsList as cr, identityKeyFor as cs, red as ct, conditionInputsFrom as d, refuseMalformedNestedChildOutputs as da, getBootstrapMarkerKey as dc, producerRegionsFromState as di, derivePartitionAndUrlSuffix as dl, DeploymentEventsStore as dn, configStringRefusal as do, stringifyIfAssigned as dr, recoverMaskedOutput as ds, namesAnyDeclaredParameter as dt, malformedOrphansWarning as ea, isSensitiveAttributeName as ec, AWS_CREDENTIAL_ENV_KEYS as ei, ssmResolvedValueType as el, orphanDeleteNeedsIdentity as en, isStatefulRecreateTargetSync as eo, reserveStackCreateToken as er, redactSecretsForState as es, getPriorAttempts as et, parentSuppliedValues as f, refuseMalformedOrphanRecords as fa, isCrossRegionRedirect as fc, regionLessSecretName as fi, AssemblyReader as fl, WITHHELD_NAME_DISPLAY as fn, readConfigString as fo, CC_BROKEN_REASON as fr, physicalNameCopiesOf as fs, reachableDivergentParameters as ft, mergeNoChangeOutputs as g, refuseMalformedOrphansForOrphan as ga, validateContainerRepoName as gc, getAccountInfo as gi, hasOwnKey as gl, secretBearingStateKeyWarning as gn, requireConfigString as go, wouldReturnToSdkProvider as gr, carriesSecretMask as gs, NESTED_PENDING_PARENT_REASON as gt, keptWholeReasonText as h, refuseMalformedOrphansForDestroy as ha, validateAssetBucketName as hc, parameterTypeMayLoseSecretIdentity as hi, defineOwnKey as hl, secretBearing as hn, requireConfigObject as ho, isCustomResource as hr, splitGetAttStringForm as hs, planOrphanAdoption as ht, childTemplateLoader as i, malformedResourceEntriesWarning as ia, createAssetRedirectResolver as ic, isSettledInstanceState as ii, findLargeInlineResources as il, REDACTED_DELETE_ADDRESS_SKIP_REASON as in, isWarmThroughputDecrease as io, DBPROXY_TAG_OPTIONS as ir, DYNAMIC_REFERENCE_TOKEN_SCAN as is, bold as it, noEchoExactEchoLeavesOf as j, refuseMalformedResourcesForDestroy as ja, redactedDockerCause as jc, JSON_LISTING_HOLE_VALUE as ji, maskEventTextWithBoundBags as jn, maskedLeafCoordinatesOf as jo, deleteLeftInPlace as jr, isLockInfoExpired as js, isHandledOrphan as jt, noEchoAttributeNamesOf as k, refuseMalformedResourcePropertiesForOrphan as ka, partitionSensitiveEnv as kc, passedParameterClassesOf as ki, completedReplayEntries as kn, maskReadbackAtCoordinates as ko, UNSPECIFIED_SKIP_REASON as kr, isSingleDynamicReferenceToken as ks, deleteJournaledOrphans as kt, templateIdentity as l, previewableOrphanRecords as la, assertAssetBucketRegion as lc, s3BucketWebsiteUrl as li, PARTITION_TABLE as ll, updatePartialReason as ln, configBooleanRefusal as lo, tagPlanWarning as lr, inheritNestedStackParameterAssociations as ls, yellow as lt, isSecretBearingReferenceString as m, refuseMalformedOrphans as ma, readBootstrapMarkerBody as mc, isUnboundTemplateParameter as mi, processStackMessages as ml, exportAliasCollisionScrubWarning as mn, requireConfigArray as mo, ccBrokenReason as mr, recordPhysicalNameCopy as ms, makeSiblingClaimReader as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedOutputsWarning as na, WorkGraph as nc, callerEnvCredentials as ni, CFN_TEMPLATE_URL_LIMIT as nl, getCurrentProducerRegions as nn, WARM_THROUGHPUT_MEMBERS as no, acquireIdempotencyToken as nr, withPhysicalNameCopies as ns, formatResourceLine as nt, isAbsoluteAssetPath as o, malformedResourcesWarning as oa, rewriteTemplateAssetReferences as oc, s3BucketDomainName as oi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ol, redactedDeleteAddressFields as on, toFiniteNumber as oo, readTagList as or, isUncertifiedBaselineMaskPosition as os, gray as ot, readRecordedConditionVerdicts as p, refuseMalformedOrphanRecordsForDestroy as pa, parseBootstrapMarker as pc, coerceParameterTypedValue as pi, StageLoadError as pl, displayTextOrWithheld as pn, replayWarn as po, ProviderRegistry as pr, recordAttributeIdCopy as ps, resourcesNamingDeclaredParameter as pt, INDEX_SETTLE_POLL_INTERVAL_MS as q, withoutSilentDropProperties as qa, resolveCaptureObservedState as qc, malformedLocalOutputsWarning as qi, unsupportedFinalSnapshotError as qn, recordLogOnlyValue as qo, refuseUnreadableCdkCrossAccountRefs as qr, importableOutputKeys as qs, planFailedOps as qt, computeImplicitDeleteEdges as r, malformedRenderedContainersWarning as ra, buildAssetRedirectMap as rc, envCredentialsAreAssumedRole as ri, MIGRATE_TMP_PREFIX as rl, inheritProducerRegions as rn, coerceWarmThroughput as ro, DBPROXY_TAGS_WHAT as rr, withoutPhysicalNameCopies as rs, createReadOnlyAttributeHealerFactory as rt, listNestedTemplateRows as s, malformedScrubResourceEntriesRefusalMessage as sa, AssetModeResolver as sc, s3BucketDualStackDomainName as si, decodeListingKey as sl, redactedDeleteAddressSkip as sn, coerceCfnBoolean as so, refuseMalformedDesiredTags as sr, pathCrossesDottedKey as ss, green as st, DeployEngine as t, malformedOutputsRefusalMessage as ta, stringifyValue as tc, applyCallerIdentityCredentials as ti, CFN_TEMPLATE_BODY_LIMIT as tl, findNestedStackTypeChanges as tn, renderStatefulReason as to, withCreateTokenLedger as tr, scrubResourceRecord as ts, markRefusedBeforeApplying as tt, conditionFingerprint as u, refuseDivergentRecordRegionForDestroy as ua, ensureAssetStorage as uc, classifyReplaySecretRegion as ui, canonicalizeRegion as ul, DeploymentEventsReader as un, configIntegerRefusal as uo, definedAttributes as ur, recordNestedStackParameterExpressions as us, computeParameterTaint as ut, chunks as v, refuseMalformedOutputsForDestroy as va, buildDockerImage as vc, carriesDynamicReference as vi, nullPrototypeRecord as vl, carriedExportAliasExposure as vn, templateResourceTypes as vo, readsNoEchoDeleteValues as vr, recordMaskOnlyValue as vs, displacedPhysicalIdShown as vt, deferredServiceTokenWarning as w, refuseMalformedResourceEntriesForImportSave as wa, finchSecretArgvRefusal as wc, isStalePlaceholderArnAttribute as wi, resolveAssemblyPath as wl, collectPublishedOutputNames as wn, DagBuilder as wo, customResourceResponseExpirationWarning as wr, STATE_SOURCED_BASELINE_RULES as ws, revertedNestedRowIds as wt, withApiLimit as x, refuseMalformedResourceEntriesForDeploy as xa, describeDockerExecFailure as xc, keepsSecretReferenceToken as xi, describeFileReadFailure as xl, isWholeDynamicReferenceValue as xn, canonicalLambdaFunctionName as xo, withPrintingSecrets as xr, recordNoEchoParameterFreshValue as xs, nestedChildStackName as xt, isAccessDeniedError as y, refuseMalformedResourceAttributesForOrphan as ya, resolveDockerContextDirectory as yc, carriesFetchableDynamicReference as yi, ownValue as yl, exportNameNoEchoParameters as yn, describeTypeWithThrottleRetry as yo, isCustomResourceType as yr, recordMaskOnlyValuesIn as ys, dropSettledNestedJournals as yt, DynamoDBGlobalTableProvider as z, repairMalformedResourcesForReadOnly as za, getDockerImageBySourceHash as zc, hasReadableOrphans as zi, ATOMIC_FINAL_SNAPSHOT_TYPES as zn, liveMatchesUnresolvedTokenFrame as zo, observeThenDisableInstanceApiTermination as zr, isNotImplemented as zs, destroyStackRecordsView as zt };
+//# sourceMappingURL=deploy-engine-CO0EOAem.js.map