@go-to-k/cdkd 0.300.1 → 0.300.2

package/dist/{deploy-engine-BK4gG_5A.js → deploy-engine-DOBzE5TD.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-B_CEQGE1.js";
 import { A as UNRENDERABLE, B as safeMsg, C as looksLikeCdkdGeneratedName, D as SAFE_MSG_ALTERED_CHAR, E as withoutGeneratedFallbackName, F as displaySafe, H as terminalSafe, I as displayStackName, L as isPasteableIdent, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, S as getCurrentStackName, T as withStackName, U as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, j as asIsMessage, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $ as protectedReplacementAdvice, $n as formatRetryClassificationSignals, $t as ambientCredentialConfig, A as isQuotableImportValue, An as SHELL_ACTIVE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, Ct as RETRY_AUXILIARY_OWNER, Dn as normalizeAwsError, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as isUpdateUnsupportedError, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as withheldTargetClause, Ht as recoveryCommandFlags, In as pasteableCommand, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as isNameCooldownError, Kn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as physicalIdShownBesideCommand, M as quotedRemedyLogicalId, Mn as UNSHOWABLE_VALUE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Ot as hasCreatedBeforeFailure, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as plainOrDescribed, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Ut as sanitizeRecoveryValue, Vn as shellQuote, Vt as formatLockOwner, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isReplayedNameCollisionFrom, Yn as isRecreateRetryableError, Yt as producerRecordKey, Zt as withPasteableAwsProfile, _t as createMaskedLogSinks, ar as retryClassificationText, at as startInterruptWatch, bn as ResourceUpdateNotSupportedError, bt as maskDeep, cr as isThrottlingError, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dr as wrapMaskedAwsError, en as clientDefaultsFor, er as isAmbiguousCcHandlerErrorCode, f as removalWarning, ft as logicalIdShown, gt as stateOrphanRecordRemedy, hn as MalformedProducerRecordRefusalError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isTransientServerError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as SHELL_ACTIVE_WHY, jt as markAuxiliaryFailure, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DynamicReferenceRegionAmbiguousError, lr as markNonRetryable, m as withoutInjectedRemovals, mn as MacroExpansionError, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as isIamPropagationError, on as CrossAccountSecretRefusalError, ot as ElapsedBudgetRegistry, pn as LockError, qn as isNameCollisionErrorFrom, rn as AssetError, rr as isRetryableTransientError, sn as DependencyError, sr as isMarkedNonRetryable, st as monotonicNowMs, tn as credentialFingerprint, tr as isAmbiguousOutcomeError, un as IntrinsicResolutionRefusalError, ur as markRedactedCause, ut as compositeIdSeparatorRefusal, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as SynthesisError, wt as carryCreatedBeforeFailure, xt as maskerOrIdentity, yn as ResourceTimeoutError, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-DAs3w7QW.js";
+import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, An as SHELL_ACTIVE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, Ct as RETRY_AUXILIARY_OWNER, Dn as normalizeAwsError, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as isUpdateUnsupportedError, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as withheldTargetClause, Ht as recoveryCommandFlags, In as pasteableCommand, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as isNameCooldownError, Kn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as physicalIdShownBesideCommand, M as quotedRemedyLogicalId, Mn as UNSHOWABLE_VALUE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Ot as hasCreatedBeforeFailure, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as plainOrDescribed, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Ut as sanitizeRecoveryValue, Vn as shellQuote, Vt as formatLockOwner, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isReplayedNameCollisionFrom, Yn as isRecreateRetryableError, Yt as producerRecordKey, Zt as withPasteableAwsProfile, _t as createMaskedLogSinks, ar as isRetryableTransientError, at as startInterruptWatch, bn as ResourceUpdateNotSupportedError, bt as maskDeep, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dr as markNonRetryable, en as clientDefaultsFor, er as formatRetryClassificationSignals, f as removalWarning, fr as markRedactedCause, ft as logicalIdShown, gt as stateOrphanRecordRemedy, hn as MalformedProducerRecordRefusalError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isIamPropagationError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as SHELL_ACTIVE_WHY, jt as markAuxiliaryFailure, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DynamicReferenceRegionAmbiguousError, lr as isMarkedNonRetryable, m as withoutInjectedRemovals, mn as MacroExpansionError, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, on as CrossAccountSecretRefusalError, or as isTransientServerError, ot as ElapsedBudgetRegistry, pn as LockError, pr as wrapMaskedAwsError, qn as isNameCollisionErrorFrom, rn as AssetError, sn as DependencyError, sr as retryClassificationText, st as monotonicNowMs, tn as credentialFingerprint, tr as isAmbiguousCcHandlerErrorCode, un as IntrinsicResolutionRefusalError, ur as isThrottlingError, ut as compositeIdSeparatorRefusal, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as SynthesisError, wt as carryCreatedBeforeFailure, xt as maskerOrIdentity, yn as ResourceTimeoutError, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-DFk7zr0Q.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-DBXBcg0J.js";
-import { t as getCdkdVersion } from "./version-DTSDiQcV.js";
+import { t as getCdkdVersion } from "./version-CZbKGFSS.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2888,6 +2888,12 @@ const DOCKER_CLIENT_ENV_KEYS = /* @__PURE__ */ new Set([
 	"USERPROFILE",
 	"HOMEDRIVE",
 	"HOMEPATH",
+	"COMSPEC",
+	"SYSTEMROOT",
+	"WINDIR",
+	"SYSTEMDRIVE",
+	"PSMODULEPATH",
+	"PSEXECUTIONPOLICYPREFERENCE",
 	"DOCKER_HOST",
 	"DOCKER_CONTEXT",
 	"DOCKER_CONFIG",
@@ -3016,10 +3022,13 @@ const WELL_FORMED_ENV_KEY = /^[^=\0]+$/;
 function isMalformedEnvKey(key) {
 	return !WELL_FORMED_ENV_KEY.test(key);
 }
-function partitionSensitiveEnv(env, sensitiveKeys) {
+function partitionSensitiveEnv(env, sensitiveKeys, options = {}) {
+	const platform = options.platform ?? process.platform;
 	const flags = [];
 	const sensitiveEnv = {};
 	const collisions = [];
+	const names = platform === "win32" ? new Win32EnvNames(Object.keys(process.env)) : void 0;
+	const ambiguous = [];
 	for (const [k, v] of Object.entries(env)) {
 		if (!sensitiveKeys.has(k)) {
 			flags.push("-e", `${k}=${v}`);
@@ -3029,19 +3038,73 @@ function partitionSensitiveEnv(env, sensitiveKeys) {
 			collisions.push(k);
 			continue;
 		}
+		if (names) {
+			if (names.lookup(k).ambiguous) {
+				ambiguous.push(k);
+				continue;
+			}
+			names.replace(k);
+		}
 		flags.push("-e", k);
 		defineOwnKey(sensitiveEnv, k, v);
 	}
+	if (ambiguous.length > 0) getLogger().warn((options.subject === void 0 ? "" : safeMsg`${options.subject}: `) + safeMsg`Sensitive env var(s) ${ambiguous.map((k) => displayIdent(k)).join(", ")} ` + "were NOT passed to the container. On Windows each matches another variable's name (in your environment or another secret) only through a letter-case difference outside A-Z, which cdkd does not treat as the same variable. Rename the secret if the container needs it.");
+	if (names) warnCaseVariantSensitiveKeys(Object.keys(sensitiveEnv), options.subject);
 	return {
 		flags,
 		sensitiveEnv,
 		collisions
 	};
 }
-function dockerSpawnEnvWithSensitive(sensitiveEnv) {
+function warnCaseVariantSensitiveKeys(keys, subject) {
+	const byUpper = /* @__PURE__ */ new Map();
+	for (const k of keys) {
+		const upper = asciiUpper(k);
+		const group = byUpper.get(upper);
+		if (group) group.push(k);
+		else byUpper.set(upper, [k]);
+	}
+	for (const group of byUpper.values()) {
+		if (group.length < 2) continue;
+		getLogger().warn((subject === void 0 ? "" : safeMsg`${subject}: `) + safeMsg`Sensitive env vars ${group.map((k) => displayIdent(k)).join(", ")} differ only by letter case. ` + safeMsg`Windows treats them as one variable, so the container receives the value of ` + safeMsg`${displayIdent(group[group.length - 1])} under every one of these names. ` + `Rename them to distinct names if the container needs each value.`);
+	}
+}
+function asciiUpper(name) {
+	return name.replace(/[a-z]/g, (c) => c.toUpperCase());
+}
+var Win32EnvNames = class {
+	groups = /* @__PURE__ */ new Map();
+	constructor(names) {
+		for (const name of names) {
+			const key = name.toUpperCase();
+			const group = this.groups.get(key);
+			if (group) group.push(name);
+			else this.groups.set(key, [name]);
+		}
+	}
+	lookup(name) {
+		const others = (this.groups.get(name.toUpperCase()) ?? []).filter((n) => n !== name);
+		const folded = asciiUpper(name);
+		return {
+			aliases: others,
+			ambiguous: others.some((n) => asciiUpper(n) !== folded)
+		};
+	}
+	replace(name) {
+		this.groups.set(name.toUpperCase(), [name]);
+	}
+};
+function dockerSpawnEnvWithSensitive(sensitiveEnv, platform = process.platform) {
 	const env = { ...process.env };
+	const names = platform === "win32" ? new Win32EnvNames(Object.keys(env)) : void 0;
 	for (const [k, v] of Object.entries(sensitiveEnv)) {
 		if (isMalformedEnvKey(k) || isDockerClientEnvKey(k)) continue;
+		if (names) {
+			const { aliases, ambiguous } = names.lookup(k);
+			if (ambiguous) continue;
+			for (const alias of aliases) delete env[alias];
+			names.replace(k);
+		}
 		defineOwnKey(env, k, v);
 	}
 	return env;
@@ -7672,6 +7735,40 @@ function positionByCrossStackSource(bag, source, secrets) {
 	return certifiedExpressionForLeaf(secrets, association, bag);
 }
 
+//#endregion
+//#region src/deployment/secret-redaction/resolver-outcomes.ts
+const CONFLICTING = Symbol("cdkd.resolver-outcome.conflicting");
+const takenBranches = /* @__PURE__ */ new WeakMap();
+function recordTakenIfBranch(secrets, source, tookTrueBranch) {
+	let taken = takenBranches.get(secrets);
+	if (taken === void 0) {
+		taken = /* @__PURE__ */ new WeakMap();
+		takenBranches.set(secrets, taken);
+	}
+	const previous = taken.get(source);
+	if (previous === void 0) taken.set(source, tookTrueBranch);
+	else if (previous !== tookTrueBranch) taken.set(source, CONFLICTING);
+}
+function takenIfBranchOf(secrets, source) {
+	const taken = takenBranches.get(secrets)?.get(source);
+	return taken === CONFLICTING ? void 0 : taken;
+}
+const droppedElements = /* @__PURE__ */ new WeakMap();
+function recordDroppedArrayElements(secrets, source, dropped) {
+	let arrays = droppedElements.get(secrets);
+	if (arrays === void 0) {
+		arrays = /* @__PURE__ */ new WeakMap();
+		droppedElements.set(secrets, arrays);
+	}
+	const previous = arrays.get(source);
+	if (previous === void 0) arrays.set(source, [...dropped]);
+	else if (previous !== CONFLICTING && (previous.length !== dropped.length || previous.some((index, i) => index !== dropped[i]))) arrays.set(source, CONFLICTING);
+}
+function droppedArrayElementsOf(secrets, source) {
+	const dropped = droppedElements.get(secrets)?.get(source);
+	return dropped === CONFLICTING ? void 0 : dropped;
+}
+
 //#endregion
 //#region src/deployment/secret-redaction/physical-name-copies.ts
 const physicalNameCopiesOf = /* @__PURE__ */ new WeakMap();
@@ -8148,7 +8245,9 @@ function evaluatePureRead(node, bind, split, choose, depth = 0) {
 	}
 	if (key === "Fn::If") {
 		if (!Array.isArray(args) || args.length !== 3 || typeof args[0] !== "string") return void 0;
-		return evaluate(choose(args[0]) ? args[1] : args[2]);
+		const tookTrue = choose(args[0], node);
+		if (tookTrue === void 0) return void 0;
+		return evaluate(tookTrue ? args[1] : args[2]);
 	}
 	if (key === "Fn::Sub") return evaluatePureSub(args, bind, evaluate);
 	if (!Array.isArray(args) || args.length !== 2) return void 0;
@@ -8228,17 +8327,56 @@ function rendersReadTo(spelling, parentSecrets, value) {
 	return false;
 }
 const REREAD_UNBOUND = Symbol("cdkd.reread.unbound");
-function rereadAssignments(source, bind, parentSecrets, untakenWhenUnbound = () => false) {
+const REREAD_PARAMETER_FREE = Symbol("cdkd.reread.parameter-free");
+function diffSideReading(bind, parentSecrets) {
+	return {
+		bind: (name) => {
+			const bound = bind(name);
+			return bound && { value: redactInheritedParameterValue(parentSecrets, name, bound.value) };
+		},
+		split: (text, delimiter) => splitOutsideDynamicReferences(text, delimiter, (token) => standsForInheritedSecret(parentSecrets, token))
+	};
+}
+function rereadUnder(source, bind, parentSecrets, choose) {
+	const resolved = evaluatePureRead(source, bind, plainSplit, choose);
+	if (resolved === void 0) return void 0;
+	const diffSide = diffSideReading(bind, parentSecrets);
+	const redacted = evaluatePureRead(source, diffSide.bind, diffSide.split, choose);
+	if (redacted === void 0) return void 0;
+	if (resolved.value === REREAD_NO_VALUE || redacted.value === REREAD_NO_VALUE) return resolved.value === redacted.value ? REREAD_NO_VALUE : void 0;
+	if (!rendersReadTo(redacted.value, parentSecrets, resolved.value)) return void 0;
+	return {
+		resolved: resolved.value,
+		redacted: redacted.value
+	};
+}
+function namesParameterOnBranches(node, choose, isParameter, depth = 0) {
+	if (depth > MAX_REREAD_DEPTH) return true;
+	if (typeof node === "string") return node.includes("{{resolve:");
+	if (Array.isArray(node)) return node.some((element) => namesParameterOnBranches(element, choose, isParameter, depth + 1));
+	if (!isPlainObject$7(node)) return false;
+	if (Object.hasOwn(node, "Fn::If")) {
+		const args = node["Fn::If"];
+		if (Object.keys(node).length !== 1) return true;
+		if (!Array.isArray(args) || args.length !== 3 || typeof args[0] !== "string") return true;
+		const tookTrue = choose(args[0], node);
+		if (tookTrue === void 0) return true;
+		return namesParameterOnBranches(tookTrue ? args[1] : args[2], choose, isParameter, depth + 1);
+	}
+	if (typeof node["Ref"] === "string" && isParameter(node["Ref"])) return true;
+	const sub = node["Fn::Sub"];
+	const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
+	if (typeof text === "string") {
+		for (const match of text.matchAll(/\$\{([^}!][^}]*)\}/g)) if (isParameter(match[1].trim()) || isParameter(match[1])) return true;
+	}
+	return Object.values(node).some((child) => namesParameterOnBranches(child, choose, isParameter, depth + 1));
+}
+function rereadAssignments(source, bind, parentSecrets, untakenWhenUnbound = () => false, parameterFree) {
 	if (!holdsRereadTrigger(source)) return void 0;
 	const conditions = /* @__PURE__ */ new Set();
 	if (!collectRereadConditions(source, conditions)) return void 0;
 	if (conditions.size > MAX_REREAD_CONDITIONS) return void 0;
 	const names = [...conditions];
-	const redactedBind = (name) => {
-		const bound = bind(name);
-		return bound && { value: redactInheritedParameterValue(parentSecrets, name, bound.value) };
-	};
-	const tokenSplit = (text, delimiter) => splitOutsideDynamicReferences(text, delimiter, (token) => standsForInheritedSecret(parentSecrets, token));
 	const out = [];
 	for (let assignment = 0; assignment < 2 ** names.length; assignment++) {
 		const choose = (condition) => Math.floor(assignment / 2 ** names.indexOf(condition)) % 2 === 1;
@@ -8248,25 +8386,18 @@ function rereadAssignments(source, bind, parentSecrets, untakenWhenUnbound = ()
 			if (bound === void 0 && untakenWhenUnbound(name)) unbound = true;
 			return bound;
 		};
-		const resolved = evaluatePureRead(source, tracked, plainSplit, choose);
-		const redacted = resolved && evaluatePureRead(source, redactedBind, tokenSplit, choose);
+		const reread = rereadUnder(source, tracked, parentSecrets, choose);
 		if (unbound) out.push(REREAD_UNBOUND);
-		else if (resolved === void 0 || redacted === void 0) out.push(void 0);
-		else if (resolved.value === REREAD_NO_VALUE || redacted.value === REREAD_NO_VALUE) out.push(resolved.value === redacted.value ? REREAD_NO_VALUE : void 0);
-		else if (!rendersReadTo(redacted.value, parentSecrets, resolved.value)) out.push(void 0);
-		else out.push({
-			resolved: resolved.value,
-			redacted: redacted.value
-		});
+		else if (reread !== void 0) out.push(reread);
+		else if (parameterFree !== void 0 && !namesParameterOnBranches(source, choose, parameterFree)) out.push(REREAD_PARAMETER_FREE);
+		else out.push(void 0);
 	}
 	return out;
 }
 function rereadParameterExpression(source, bind, parentSecrets) {
-	const assignments = rereadAssignments(source, bind, parentSecrets);
+	const assignments = rereadAssignments(source, bind, parentSecrets, void 0, (name) => bind(name) !== void 0);
 	if (assignments === void 0 || assignments.includes(void 0) || assignments.includes(REREAD_UNBOUND)) return;
-	const rereads = assignments.filter((entry) => entry !== void 0 && entry !== REREAD_NO_VALUE && entry !== REREAD_UNBOUND);
-	if (rereads.length === 0 || ambiguousRereads(rereads)) return void 0;
-	return rereads[0];
+	return assignments.find((entry) => entry !== void 0 && entry !== REREAD_NO_VALUE && entry !== REREAD_UNBOUND && entry !== REREAD_PARAMETER_FREE);
 }
 function ambiguousRereads(rereads) {
 	return rereads.some((a, i) => rereads.slice(i + 1).some((b) => deepEqualJsonValue(a.resolved, b.resolved) && !deepEqualJsonValue(a.redacted, b.redacted)));
@@ -8275,13 +8406,27 @@ function positionByParameterReread(bag, source, secrets) {
 	const reads = inheritedParameterReads.get(secrets);
 	if (reads === void 0 || typeof reads === "symbol") return void 0;
 	if (typeof bag !== "string" && !Array.isArray(bag)) return void 0;
-	const declared = reads.declared;
-	const assignments = rereadAssignments(source, (name) => reads.values.has(name) ? { value: reads.values.get(name) } : void 0, reads.parent, (name) => declared?.has(name) === true);
-	if (assignments === void 0 || assignments.includes(void 0)) return void 0;
-	const matching = assignments.filter((entry) => entry !== void 0 && entry !== REREAD_NO_VALUE && entry !== REREAD_UNBOUND && deepEqualJsonValue(entry.resolved, bag));
-	if (matching.length === 0 || ambiguousRereads(matching)) return void 0;
+	if (!holdsRereadTrigger(source)) return void 0;
+	const bind = (name) => reads.values.has(name) ? { value: reads.values.get(name) } : void 0;
+	let unrecorded = false;
+	const recorded = rereadUnder(source, bind, reads.parent, (_, node) => {
+		const taken = takenIfBranchOf(secrets, node);
+		if (taken === void 0) unrecorded = true;
+		return taken;
+	});
+	let answer;
+	if (!unrecorded) {
+		if (recorded === void 0 || recorded === REREAD_NO_VALUE || !deepEqualJsonValue(recorded.resolved, bag)) return;
+		answer = recorded.redacted;
+	} else {
+		const declared = reads.declared;
+		const assignments = rereadAssignments(source, bind, reads.parent, (name) => declared?.has(name) === true);
+		if (assignments === void 0 || assignments.includes(void 0)) return void 0;
+		const matching = assignments.filter((entry) => entry !== void 0 && entry !== REREAD_NO_VALUE && entry !== REREAD_UNBOUND && entry !== REREAD_PARAMETER_FREE && deepEqualJsonValue(entry.resolved, bag));
+		if (matching.length === 0 || ambiguousRereads(matching)) return void 0;
+		answer = matching[0].redacted;
+	}
 	if (carriesChildOnlyPlaintext(bag, secrets, reads.parent)) return void 0;
-	const answer = matching[0].redacted;
 	if (!deepEqualJsonValue(redactSecretsForState(answer, secrets), answer)) return void 0;
 	return answer;
 }
@@ -8542,7 +8687,12 @@ function arrayElementDrop(element, depth = 0) {
 	if (branches.every((branch) => branch === "always")) return "always";
 	return "maybe";
 }
-function sourceElementsKeptFor(source, bagLength) {
+function sourceElementsKeptFor(source, bagLength, secrets) {
+	const recorded = secrets && droppedArrayElementsOf(secrets, source);
+	if (recorded !== void 0) {
+		if (source.length - recorded.length !== bagLength) return void 0;
+		return source.filter((_, i) => !recorded.includes(i));
+	}
 	const drops = source.map((element) => arrayElementDrop(element));
 	if (drops.includes("unknown")) return void 0;
 	const always = drops.filter((drop) => drop === "always").length;
@@ -8587,8 +8737,7 @@ function corroboratesWhateverResolves(source, depth = 0) {
 }
 function arrayPairsWhateverDrops(source) {
 	if (!source.some((element) => isPlainObject$7(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue" || Array.isArray(element["Fn::FindInMap"]) && element["Fn::FindInMap"].length > 3))) return true;
-	const drops = source.map((element) => arrayElementDrop(element));
-	return !drops.includes("unknown") && drops.filter((drop) => drop === "maybe").length <= 1 && source.every((element) => corroboratesWhateverResolves(element));
+	return source.every((element) => corroboratesWhateverResolves(element));
 }
 function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameGeneration) {
 	if (isDynamicReferenceString(source) && typeof bag === "string") {
@@ -8645,7 +8794,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration));
 		if (rules.descendArrays && bag.length < source.length) {
-			const kept = sourceElementsKeptFor(source, bag.length);
+			const kept = sourceElementsKeptFor(source, bag.length, secrets);
 			if (kept !== void 0 && keptLiteralsCorroborate(kept, bag, secrets)) return bag.map((item, i) => redactByPath(item, kept[i], secrets, rules, secretExpressions, bagIsSameGeneration));
 		}
 	}
@@ -22925,6 +23074,271 @@ async function resolveSub(subArgs, context, source) {
 	return result;
 }
 
+//#endregion
+//#region src/deployment/intrinsic-resolver/parameter-secrets.ts
+function recordInheritedParameterSecrets(parameterName, value, context) {
+	const inherited = context.inheritedSecrets;
+	const recorded = context.recordedSecretValues;
+	if (inherited && recorded) carryLogOnlyValuesCarriedBy(inherited, recorded, value);
+	if (recorded) carryPhysicalNameCopiesCarriedBy(context, recorded, value);
+	if (inherited && recorded) recordInheritedNoEchoListElements(this, inherited, recorded, value, context);
+	if (!inherited || inherited.size === 0 || !recorded) return;
+	const mirror = parameterReadMirrors.get(recorded);
+	const declared = declaredParameterNames(context);
+	recordInheritedParameterValue(recorded, inherited, parameterName, value, declared);
+	if (mirror) recordInheritedParameterValue(mirror, inherited, parameterName, value, declared);
+	for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) {
+		const carried = carriedExpressionFor(inherited, parameterName, value, plaintext, expression);
+		recorded.set(plaintext, carried);
+		const parentEntry = context.inheritedReferenceProvenance?.get(carried);
+		if (parentEntry !== void 0) recordReferenceProvenanceEntry(recorded, carried, parentEntry, "read");
+		recordInheritedParameterRead(recorded, inherited, parameterName);
+		if (mirror) recordInheritedParameterRead(mirror, inherited, parameterName);
+		carryFreshNoEchoMark(inherited, recorded, plaintext);
+	}
+}
+function declaredParameterNames(context) {
+	const declared = context.template?.Parameters;
+	if (declared === null || typeof declared !== "object") return void 0;
+	let names = declaredNamesCache.get(declared);
+	if (names === void 0) {
+		names = new Set(Object.keys(declared));
+		declaredNamesCache.set(declared, names);
+	}
+	return names;
+}
+const declaredNamesCache = /* @__PURE__ */ new WeakMap();
+const parameterReadMirrors = /* @__PURE__ */ new WeakMap();
+function mirrorInheritedParameterReads(passSecrets, persistSecrets) {
+	if (passSecrets !== persistSecrets) parameterReadMirrors.set(passSecrets, persistSecrets);
+}
+function recordTakenIfBranchIn(context, source, tookTrueBranch) {
+	if (!context.inheritedSecrets || context.inheritedSecrets.size === 0) return;
+	const recorded = context.recordedSecretValues;
+	if (recorded === void 0) return;
+	recordTakenIfBranch(recorded, source, tookTrueBranch);
+	const mirror = parameterReadMirrors.get(recorded);
+	if (mirror) recordTakenIfBranch(mirror, source, tookTrueBranch);
+}
+function recordDroppedArrayElementsIn(context, source, dropped) {
+	const recorded = context.recordedSecretValues;
+	if (recorded === void 0) return;
+	recordDroppedArrayElements(recorded, source, dropped);
+	const mirror = parameterReadMirrors.get(recorded);
+	if (mirror) recordDroppedArrayElements(mirror, source, dropped);
+}
+function carryPhysicalNameCopiesCarriedBy(context, recorded, value) {
+	const names = context.inheritedPhysicalNameCopies ?? (context.inheritedSecrets && physicalNameCopiesOf.get(context.inheritedSecrets));
+	if (names === void 0 || names.size === 0) return;
+	const leaves = [...wholeStringLeavesOf(value)];
+	for (const name of names) if (leaves.some((leaf) => leaf.includes(name))) recordPhysicalNameCopy(recorded, name);
+}
+function carriedExpressionFor(inherited, parameterName, value, plaintext, survivor) {
+	const own = inheritedParameterExpression(inherited, parameterName, plaintext);
+	if (typeof own === "string") return own;
+	return inheritedRenderedToken(inherited, parameterName, value, plaintext) ?? survivor;
+}
+function poisonRenderedSpellingsCollidingIn(template, parameterValues, inherited) {
+	if (!inherited || inherited.size === 0 || template === void 0) return;
+	const names = new Set(Object.keys(parameterValues));
+	if (names.size < 2) return;
+	const groups = [];
+	if (template.Resources !== null && typeof template.Resources === "object") for (const resource of Object.values(template.Resources)) groups.push([{
+		node: resource,
+		mode: "resource"
+	}]);
+	if (template.Outputs !== void 0) groups.push(outputsGroupParts(template.Outputs));
+	const bind = (name) => Object.hasOwn(parameterValues, name) ? { value: parameterValues[name] } : void 0;
+	const withdrawn = /* @__PURE__ */ new Set();
+	for (;;) {
+		const fresh = [...collidingRenderedNames(groups.map((parts) => {
+			const reads = /* @__PURE__ */ new Map();
+			for (const { node, mode } of parts) {
+				const reread = mode === "slot" ? void 0 : {
+					bind,
+					inherited
+				};
+				for (const [name, slotRead] of parameterReadsOf(node, names, reread, mode !== "output")) reads.set(name, slotRead || reads.get(name) === true);
+			}
+			return reads;
+		}).filter((reads) => reads.size >= 2), parameterValues, inherited)].filter((name) => !withdrawn.has(name));
+		if (fresh.length === 0) return;
+		for (const name of fresh) {
+			withdrawn.add(name);
+			withdrawRenderedParameterSpelling(inherited, name);
+		}
+	}
+}
+function collidingRenderedNames(readsByGroup, parameterValues, inherited) {
+	const withdraw = /* @__PURE__ */ new Set();
+	for (const reads of readsByGroup) {
+		const byPlaintext = /* @__PURE__ */ new Map();
+		const slotReadPlaintexts = /* @__PURE__ */ new Set();
+		for (const [name, slotRead] of reads) {
+			if (!Object.hasOwn(parameterValues, name)) continue;
+			const value = parameterValues[name];
+			for (const [plaintext, survivor] of inheritedSecretsCarriedBy(value, inherited)) {
+				const expression = carriedExpressionFor(inherited, name, value, plaintext, survivor);
+				const rendered = typeof inheritedParameterExpression(inherited, name, plaintext) !== "string" && inheritedRenderedToken(inherited, name, value, plaintext) !== void 0;
+				let byExpression = byPlaintext.get(plaintext);
+				if (byExpression === void 0) {
+					byExpression = /* @__PURE__ */ new Map();
+					byPlaintext.set(plaintext, byExpression);
+				}
+				let renderedNames = byExpression.get(expression);
+				if (renderedNames === void 0) {
+					renderedNames = [];
+					byExpression.set(expression, renderedNames);
+				}
+				if (rendered) renderedNames.push(name);
+				if (slotRead) slotReadPlaintexts.add(plaintext);
+			}
+		}
+		for (const [plaintext, byExpression] of byPlaintext) {
+			if (byExpression.size < 2 || !slotReadPlaintexts.has(plaintext)) continue;
+			for (const renderedNames of byExpression.values()) for (const name of renderedNames) withdraw.add(name);
+		}
+	}
+	return withdraw;
+}
+const POSITIONED_INTRINSICS = /* @__PURE__ */ new Set(["Fn::Join", "Fn::Sub"]);
+function parameterReadsOf(node, names, reread, positionsArrays) {
+	const reads = /* @__PURE__ */ new Map();
+	const add = (name, slotRead) => {
+		reads.set(name, slotRead || reads.get(name) === true);
+	};
+	const visit = (value, slotRead, atLeaf) => {
+		if (Array.isArray(value)) {
+			const mayShrink = atLeaf ? !positionsArrays || !arrayPairsWhateverDrops(value) : value.some((element) => element !== null && typeof element === "object" && !Array.isArray(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue"));
+			for (const element of value) visit(element, slotRead || mayShrink, atLeaf && !mayShrink);
+			return;
+		}
+		if (value === null || typeof value !== "object") return;
+		const record = value;
+		const intrinsic = Object.keys(record).some((key) => key === "Ref" || key.startsWith("Fn::"));
+		if (intrinsic && atLeaf && reread !== void 0 && rereadParameterExpression(record, reread.bind, reread.inherited) !== void 0) {
+			for (const name of refNamesIn(record, names)) add(name, false);
+			return;
+		}
+		const ref = record["Ref"];
+		if (typeof ref === "string" && names.has(ref)) add(ref, slotRead);
+		const placeholderSlot = !positionsArrays && unkeyedPlaceholderParts(record, (name) => certifiesPlaceholder(name, reread)) > MAX_UNKEYED_PARTS;
+		const sub = record["Fn::Sub"];
+		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
+		if (typeof text === "string") for (const match of text.matchAll(/\$\{([^}!][^}]*)\}/g)) {
+			const name = match[1].trim();
+			if (names.has(name)) add(name, slotRead || placeholderSlot);
+		}
+		for (const [key, child] of Object.entries(record)) visit(child, slotRead || placeholderSlot || key.startsWith("Fn::") && !POSITIONED_INTRINSICS.has(key), atLeaf && !intrinsic);
+	};
+	visit(node, reread === void 0, true);
+	return reads;
+}
+const MAX_UNKEYED_PARTS = 1;
+function certifiesPlaceholder(name, reread) {
+	if (reread === void 0) return false;
+	const bound = reread.bind(name);
+	if (bound === void 0) return false;
+	if (inheritedSecretsCarriedBy(bound.value, reread.inherited).length === 0) return false;
+	return typeof inheritedParameterExpression(reread.inherited, name, bound.value) === "string";
+}
+function unkeyedPlaceholderParts(record, certified) {
+	const keyed = (value) => typeof value === "string" || value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 1 && typeof value["Ref"] === "string" && certified(value["Ref"]);
+	if (Object.hasOwn(record, "Fn::Join")) {
+		const args = record["Fn::Join"];
+		if (!Array.isArray(args) || args.length !== 2 || !Array.isArray(args[1])) return Number.POSITIVE_INFINITY;
+		return args[1].filter((part) => !keyed(part)).length;
+	}
+	if (Object.hasOwn(record, "Fn::Sub")) {
+		const args = record["Fn::Sub"];
+		const [template, variables] = typeof args === "string" ? [args, {}] : Array.isArray(args) ? [args[0], args[1]] : [];
+		if (typeof template !== "string" || variables === null || typeof variables !== "object") return Number.POSITIVE_INFINITY;
+		let unkeyed = 0;
+		for (const hit of template.matchAll(/\$\{(!)?([^}]*)\}/g)) {
+			const name = hit[2] ?? "";
+			if (hit[1] === "!" || name === "") continue;
+			if (!(Object.hasOwn(variables, name) ? keyed(variables[name]) : certified(name))) unkeyed += 1;
+		}
+		return unkeyed;
+	}
+	return 0;
+}
+function outputsGroupParts(outputs) {
+	if (outputs === null || typeof outputs !== "object" || Array.isArray(outputs)) return [{
+		node: outputs,
+		mode: "slot"
+	}];
+	const parts = [];
+	for (const output of Object.values(outputs)) {
+		if (output === null || typeof output !== "object" || Array.isArray(output)) {
+			parts.push({
+				node: output,
+				mode: "slot"
+			});
+			continue;
+		}
+		const { Value: value, ...rest } = output;
+		parts.push({
+			node: value,
+			mode: "output"
+		}, {
+			node: rest,
+			mode: "slot"
+		});
+	}
+	return parts;
+}
+function refNamesIn(node, names) {
+	const found = /* @__PURE__ */ new Set();
+	const visit = (value) => {
+		if (Array.isArray(value)) {
+			for (const element of value) visit(element);
+			return;
+		}
+		if (value === null || typeof value !== "object") return;
+		const record = value;
+		if (typeof record["Ref"] === "string" && names.has(record["Ref"])) found.add(record["Ref"]);
+		const sub = record["Fn::Sub"];
+		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
+		if (typeof text === "string") for (const match of text.matchAll(/\$\{([^}!][^}]*)\}/g)) {
+			const name = match[1].trim();
+			if (names.has(name)) found.add(name);
+		}
+		for (const child of Object.values(record)) visit(child);
+	};
+	visit(node);
+	return found;
+}
+function recordInheritedNoEchoListElements(resolver, inherited, recorded, value, context) {
+	if (!Array.isArray(value)) return;
+	const parameterValues = [...inherited.keys()].filter((plaintext) => isNoEchoParameterPlaintext(inherited, plaintext));
+	if (parameterValues.length === 0) return;
+	const joined = value.map((element) => String(element)).join(",");
+	const normalized = (plaintext) => plaintext.split(",").map((piece) => piece.trim()).join(",");
+	if (!parameterValues.some((plaintext) => `,${normalized(plaintext)},`.includes(`,${joined},`))) return;
+	for (const element of value) {
+		if (typeof element !== "string" || element.length < 4) continue;
+		recordNoEchoParameterFreshValue(element, recorded, resolver.publicNoEchoTokens(context));
+	}
+}
+function recordNoEchoParameterValue(paramDef, value, context) {
+	const bag = context.recordedSecretValues;
+	if (!declaresNoEcho(paramDef) || bag === void 0) return;
+	recordLogOnlyParameterValue(bag, value);
+	recordNoEchoParameterFreshValue(value, bag, this.publicNoEchoTokens(context));
+}
+function refuseCoercedInheritedSecret(name, paramDef, userValue, inherited) {
+	if (!inherited || inherited.size === 0) return;
+	const secretPairs = new Map([...inherited].filter(([plaintext]) => !isNoEchoParameterPlaintext(inherited, plaintext)));
+	if (secretPairs.size === 0) return;
+	const carriedBefore = inheritedSecretsCarriedBy(userValue, secretPairs).length;
+	if (carriedBefore === 0) return;
+	if (inheritedSecretsCarriedBy(this.coerceParameterValue(userValue, paramDef.Type), secretPairs).length >= carriedBefore) return;
+	const loggedName = this.displayMasked(name);
+	const loggedType = this.displayMasked(paramDef.Type);
+	throw markNonRetryable(new IntrinsicResolutionRefusalError(`Nested-stack parameter ${quotedRender(loggedName, "'")} is declared ${QUOTABLE_RENDER.test(loggedType) ? `'Type: ${loggedType}'` : "with a Type that is not a plain identifier"}, but the parent stack resolved a SECRET dynamic reference into it. cdkd keeps a resolved secret out of persisted state by rewriting STRING leaves back to their {{resolve:...}} expression; coercing this value to ${quotedRender(loggedType, "'", "that Type")} destroys the plaintext cdkd would have matched on, so the DECRYPTED secret would be left in the child stack's state.json with nothing to redact it back to. Declare ${quotedRender(loggedName, "'", "the parameter")} as 'Type: String' in the nested stack's template (CDK does this by default for cross-stack references), or stop passing a secret reference into it.`, void 0, "NESTED_STACK_SECRET_PARAMETER_TYPE"));
+}
+
 //#endregion
 //#region src/deployment/intrinsic-resolver/functions.ts
 async function resolveIf(ifArgs, context, source) {
@@ -22946,11 +23360,13 @@ async function resolveIf(ifArgs, context, source) {
 	};
 	if (!context.conditions || !Object.hasOwn(context.conditions, conditionName)) {
 		this.logger.warn(`Condition ${this.displayMasked(String(conditionName), context)} not found in context, assuming false`);
+		recordTakenIfBranchIn(context, source, false);
 		return await resolveBranch(valueIfFalse);
 	}
 	const conditionValue = context.conditions[conditionName];
 	const selectedValue = conditionValue ? valueIfTrue : valueIfFalse;
 	this.logger.debug(`Resolved Fn::If: condition ${this.logRender(String(conditionName), context)} = ${conditionValue}, selected ${conditionValue ? "true" : "false"} branch`);
+	recordTakenIfBranchIn(context, source, Boolean(conditionValue));
 	return await resolveBranch(selectedValue);
 }
 async function resolveEquals(equalsArgs, context) {
@@ -23505,256 +23921,6 @@ async function resolveKeyUnit(key, val, context, abandoned) {
 	}
 }
 
-//#endregion
-//#region src/deployment/intrinsic-resolver/parameter-secrets.ts
-function recordInheritedParameterSecrets(parameterName, value, context) {
-	const inherited = context.inheritedSecrets;
-	const recorded = context.recordedSecretValues;
-	if (inherited && recorded) carryLogOnlyValuesCarriedBy(inherited, recorded, value);
-	if (recorded) carryPhysicalNameCopiesCarriedBy(context, recorded, value);
-	if (inherited && recorded) recordInheritedNoEchoListElements(this, inherited, recorded, value, context);
-	if (!inherited || inherited.size === 0 || !recorded) return;
-	const mirror = parameterReadMirrors.get(recorded);
-	const declared = declaredParameterNames(context);
-	recordInheritedParameterValue(recorded, inherited, parameterName, value, declared);
-	if (mirror) recordInheritedParameterValue(mirror, inherited, parameterName, value, declared);
-	for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) {
-		const carried = carriedExpressionFor(inherited, parameterName, value, plaintext, expression);
-		recorded.set(plaintext, carried);
-		const parentEntry = context.inheritedReferenceProvenance?.get(carried);
-		if (parentEntry !== void 0) recordReferenceProvenanceEntry(recorded, carried, parentEntry, "read");
-		recordInheritedParameterRead(recorded, inherited, parameterName);
-		if (mirror) recordInheritedParameterRead(mirror, inherited, parameterName);
-		carryFreshNoEchoMark(inherited, recorded, plaintext);
-	}
-}
-function declaredParameterNames(context) {
-	const declared = context.template?.Parameters;
-	if (declared === null || typeof declared !== "object") return void 0;
-	let names = declaredNamesCache.get(declared);
-	if (names === void 0) {
-		names = new Set(Object.keys(declared));
-		declaredNamesCache.set(declared, names);
-	}
-	return names;
-}
-const declaredNamesCache = /* @__PURE__ */ new WeakMap();
-const parameterReadMirrors = /* @__PURE__ */ new WeakMap();
-function mirrorInheritedParameterReads(passSecrets, persistSecrets) {
-	if (passSecrets !== persistSecrets) parameterReadMirrors.set(passSecrets, persistSecrets);
-}
-function carryPhysicalNameCopiesCarriedBy(context, recorded, value) {
-	const names = context.inheritedPhysicalNameCopies ?? (context.inheritedSecrets && physicalNameCopiesOf.get(context.inheritedSecrets));
-	if (names === void 0 || names.size === 0) return;
-	const leaves = [...wholeStringLeavesOf(value)];
-	for (const name of names) if (leaves.some((leaf) => leaf.includes(name))) recordPhysicalNameCopy(recorded, name);
-}
-function carriedExpressionFor(inherited, parameterName, value, plaintext, survivor) {
-	const own = inheritedParameterExpression(inherited, parameterName, plaintext);
-	if (typeof own === "string") return own;
-	return inheritedRenderedToken(inherited, parameterName, value, plaintext) ?? survivor;
-}
-function poisonRenderedSpellingsCollidingIn(template, parameterValues, inherited) {
-	if (!inherited || inherited.size === 0 || template === void 0) return;
-	const names = new Set(Object.keys(parameterValues));
-	if (names.size < 2) return;
-	const groups = [];
-	if (template.Resources !== null && typeof template.Resources === "object") for (const resource of Object.values(template.Resources)) groups.push([{
-		node: resource,
-		mode: "resource"
-	}]);
-	if (template.Outputs !== void 0) groups.push(outputsGroupParts(template.Outputs));
-	const bind = (name) => Object.hasOwn(parameterValues, name) ? { value: parameterValues[name] } : void 0;
-	const withdrawn = /* @__PURE__ */ new Set();
-	for (;;) {
-		const fresh = [...collidingRenderedNames(groups.map((parts) => {
-			const reads = /* @__PURE__ */ new Map();
-			for (const { node, mode } of parts) {
-				const reread = mode === "slot" ? void 0 : {
-					bind,
-					inherited
-				};
-				for (const [name, slotRead] of parameterReadsOf(node, names, reread, mode !== "output")) reads.set(name, slotRead || reads.get(name) === true);
-			}
-			return reads;
-		}).filter((reads) => reads.size >= 2), parameterValues, inherited)].filter((name) => !withdrawn.has(name));
-		if (fresh.length === 0) return;
-		for (const name of fresh) {
-			withdrawn.add(name);
-			withdrawRenderedParameterSpelling(inherited, name);
-		}
-	}
-}
-function collidingRenderedNames(readsByGroup, parameterValues, inherited) {
-	const withdraw = /* @__PURE__ */ new Set();
-	for (const reads of readsByGroup) {
-		const byPlaintext = /* @__PURE__ */ new Map();
-		const slotReadPlaintexts = /* @__PURE__ */ new Set();
-		for (const [name, slotRead] of reads) {
-			if (!Object.hasOwn(parameterValues, name)) continue;
-			const value = parameterValues[name];
-			for (const [plaintext, survivor] of inheritedSecretsCarriedBy(value, inherited)) {
-				const expression = carriedExpressionFor(inherited, name, value, plaintext, survivor);
-				const rendered = typeof inheritedParameterExpression(inherited, name, plaintext) !== "string" && inheritedRenderedToken(inherited, name, value, plaintext) !== void 0;
-				let byExpression = byPlaintext.get(plaintext);
-				if (byExpression === void 0) {
-					byExpression = /* @__PURE__ */ new Map();
-					byPlaintext.set(plaintext, byExpression);
-				}
-				let renderedNames = byExpression.get(expression);
-				if (renderedNames === void 0) {
-					renderedNames = [];
-					byExpression.set(expression, renderedNames);
-				}
-				if (rendered) renderedNames.push(name);
-				if (slotRead) slotReadPlaintexts.add(plaintext);
-			}
-		}
-		for (const [plaintext, byExpression] of byPlaintext) {
-			if (byExpression.size < 2 || !slotReadPlaintexts.has(plaintext)) continue;
-			for (const renderedNames of byExpression.values()) for (const name of renderedNames) withdraw.add(name);
-		}
-	}
-	return withdraw;
-}
-const POSITIONED_INTRINSICS = /* @__PURE__ */ new Set(["Fn::Join", "Fn::Sub"]);
-function parameterReadsOf(node, names, reread, positionsArrays) {
-	const reads = /* @__PURE__ */ new Map();
-	const add = (name, slotRead) => {
-		reads.set(name, slotRead || reads.get(name) === true);
-	};
-	const visit = (value, slotRead, atLeaf) => {
-		if (Array.isArray(value)) {
-			const mayShrink = atLeaf ? !positionsArrays || !arrayPairsWhateverDrops(value) : value.some((element) => element !== null && typeof element === "object" && !Array.isArray(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue"));
-			for (const element of value) visit(element, slotRead || mayShrink, atLeaf && !mayShrink);
-			return;
-		}
-		if (value === null || typeof value !== "object") return;
-		const record = value;
-		const intrinsic = Object.keys(record).some((key) => key === "Ref" || key.startsWith("Fn::"));
-		if (intrinsic && atLeaf && reread !== void 0 && rereadParameterExpression(record, reread.bind, reread.inherited) !== void 0) {
-			for (const name of refNamesIn(record, names)) add(name, false);
-			return;
-		}
-		const ref = record["Ref"];
-		if (typeof ref === "string" && names.has(ref)) add(ref, slotRead);
-		const placeholderSlot = !positionsArrays && unkeyedPlaceholderParts(record, (name) => certifiesPlaceholder(name, reread)) > MAX_UNKEYED_PARTS;
-		const sub = record["Fn::Sub"];
-		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
-		if (typeof text === "string") for (const match of text.matchAll(/\$\{([^}!][^}]*)\}/g)) {
-			const name = match[1].trim();
-			if (names.has(name)) add(name, slotRead || placeholderSlot);
-		}
-		for (const [key, child] of Object.entries(record)) visit(child, slotRead || placeholderSlot || key.startsWith("Fn::") && !POSITIONED_INTRINSICS.has(key), atLeaf && !intrinsic);
-	};
-	visit(node, reread === void 0, true);
-	return reads;
-}
-const MAX_UNKEYED_PARTS = 1;
-function certifiesPlaceholder(name, reread) {
-	if (reread === void 0) return false;
-	const bound = reread.bind(name);
-	if (bound === void 0) return false;
-	if (inheritedSecretsCarriedBy(bound.value, reread.inherited).length === 0) return false;
-	return typeof inheritedParameterExpression(reread.inherited, name, bound.value) === "string";
-}
-function unkeyedPlaceholderParts(record, certified) {
-	const keyed = (value) => typeof value === "string" || value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 1 && typeof value["Ref"] === "string" && certified(value["Ref"]);
-	if (Object.hasOwn(record, "Fn::Join")) {
-		const args = record["Fn::Join"];
-		if (!Array.isArray(args) || args.length !== 2 || !Array.isArray(args[1])) return Number.POSITIVE_INFINITY;
-		return args[1].filter((part) => !keyed(part)).length;
-	}
-	if (Object.hasOwn(record, "Fn::Sub")) {
-		const args = record["Fn::Sub"];
-		const [template, variables] = typeof args === "string" ? [args, {}] : Array.isArray(args) ? [args[0], args[1]] : [];
-		if (typeof template !== "string" || variables === null || typeof variables !== "object") return Number.POSITIVE_INFINITY;
-		let unkeyed = 0;
-		for (const hit of template.matchAll(/\$\{(!)?([^}]*)\}/g)) {
-			const name = hit[2] ?? "";
-			if (hit[1] === "!" || name === "") continue;
-			if (!(Object.hasOwn(variables, name) ? keyed(variables[name]) : certified(name))) unkeyed += 1;
-		}
-		return unkeyed;
-	}
-	return 0;
-}
-function outputsGroupParts(outputs) {
-	if (outputs === null || typeof outputs !== "object" || Array.isArray(outputs)) return [{
-		node: outputs,
-		mode: "slot"
-	}];
-	const parts = [];
-	for (const output of Object.values(outputs)) {
-		if (output === null || typeof output !== "object" || Array.isArray(output)) {
-			parts.push({
-				node: output,
-				mode: "slot"
-			});
-			continue;
-		}
-		const { Value: value, ...rest } = output;
-		parts.push({
-			node: value,
-			mode: "output"
-		}, {
-			node: rest,
-			mode: "slot"
-		});
-	}
-	return parts;
-}
-function refNamesIn(node, names) {
-	const found = /* @__PURE__ */ new Set();
-	const visit = (value) => {
-		if (Array.isArray(value)) {
-			for (const element of value) visit(element);
-			return;
-		}
-		if (value === null || typeof value !== "object") return;
-		const record = value;
-		if (typeof record["Ref"] === "string" && names.has(record["Ref"])) found.add(record["Ref"]);
-		const sub = record["Fn::Sub"];
-		const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
-		if (typeof text === "string") for (const match of text.matchAll(/\$\{([^}!][^}]*)\}/g)) {
-			const name = match[1].trim();
-			if (names.has(name)) found.add(name);
-		}
-		for (const child of Object.values(record)) visit(child);
-	};
-	visit(node);
-	return found;
-}
-function recordInheritedNoEchoListElements(resolver, inherited, recorded, value, context) {
-	if (!Array.isArray(value)) return;
-	const parameterValues = [...inherited.keys()].filter((plaintext) => isNoEchoParameterPlaintext(inherited, plaintext));
-	if (parameterValues.length === 0) return;
-	const joined = value.map((element) => String(element)).join(",");
-	const normalized = (plaintext) => plaintext.split(",").map((piece) => piece.trim()).join(",");
-	if (!parameterValues.some((plaintext) => `,${normalized(plaintext)},`.includes(`,${joined},`))) return;
-	for (const element of value) {
-		if (typeof element !== "string" || element.length < 4) continue;
-		recordNoEchoParameterFreshValue(element, recorded, resolver.publicNoEchoTokens(context));
-	}
-}
-function recordNoEchoParameterValue(paramDef, value, context) {
-	const bag = context.recordedSecretValues;
-	if (!declaresNoEcho(paramDef) || bag === void 0) return;
-	recordLogOnlyParameterValue(bag, value);
-	recordNoEchoParameterFreshValue(value, bag, this.publicNoEchoTokens(context));
-}
-function refuseCoercedInheritedSecret(name, paramDef, userValue, inherited) {
-	if (!inherited || inherited.size === 0) return;
-	const secretPairs = new Map([...inherited].filter(([plaintext]) => !isNoEchoParameterPlaintext(inherited, plaintext)));
-	if (secretPairs.size === 0) return;
-	const carriedBefore = inheritedSecretsCarriedBy(userValue, secretPairs).length;
-	if (carriedBefore === 0) return;
-	if (inheritedSecretsCarriedBy(this.coerceParameterValue(userValue, paramDef.Type), secretPairs).length >= carriedBefore) return;
-	const loggedName = this.displayMasked(name);
-	const loggedType = this.displayMasked(paramDef.Type);
-	throw markNonRetryable(new IntrinsicResolutionRefusalError(`Nested-stack parameter ${quotedRender(loggedName, "'")} is declared ${QUOTABLE_RENDER.test(loggedType) ? `'Type: ${loggedType}'` : "with a Type that is not a plain identifier"}, but the parent stack resolved a SECRET dynamic reference into it. cdkd keeps a resolved secret out of persisted state by rewriting STRING leaves back to their {{resolve:...}} expression; coercing this value to ${quotedRender(loggedType, "'", "that Type")} destroys the plaintext cdkd would have matched on, so the DECRYPTED secret would be left in the child stack's state.json with nothing to redact it back to. Declare ${quotedRender(loggedName, "'", "the parameter")} as 'Type: String' in the nested stack's template (CDK does this by default for cross-stack references), or stop passing a secret reference into it.`, void 0, "NESTED_STACK_SECRET_PARAMETER_TYPE"));
-}
-
 //#endregion
 //#region src/deployment/intrinsic-resolver/refs.ts
 function nameIsNeverAResource(logicalId, context) {
@@ -23931,7 +24097,18 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			if (typeof value === "string" && value.includes("{{resolve:")) return await this.resolveTemplateLeafReferences(value, context);
 			return value;
 		}
-		if (Array.isArray(value)) return (await allSettledKeepingFirstRejection(() => value.map((v) => this.resolveValue(v, context)), (pending) => this.warnAbandonedParts(pending))).filter((v) => v !== AWS_NO_VALUE);
+		if (Array.isArray(value)) {
+			const resolved = await allSettledKeepingFirstRejection(() => value.map((v) => this.resolveValue(v, context)), (pending) => this.warnAbandonedParts(pending));
+			const kept = resolved.filter((v) => v !== AWS_NO_VALUE);
+			if (kept.length !== resolved.length) {
+				const dropped = [];
+				resolved.forEach((v, i) => {
+					if (v === AWS_NO_VALUE) dropped.push(i);
+				});
+				recordDroppedArrayElementsIn(context, value, dropped);
+			}
+			return kept;
+		}
 		const obj = value;
 		if ("Ref" in obj) {
 			const logicalId = obj["Ref"];
@@ -26525,7 +26702,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BS5i71bK.js");
+			const { ASGProvider } = await import("./asg-provider-DJdNNqDe.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -26631,7 +26808,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-DraxDuQq.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CqZ1FaqT.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-C-lGTdAb.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-UDy6HC5O.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -47851,4 +48028,4 @@ DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice
 
 //#endregion
 export { S3_AUTO_DELETE_OBJECTS_TAG as $, withheldAccountClause as $a, getDockerImageBySourceHash as $c, isReadableResourceEntry as $i, findDestructiveChanges as $n, literalSplitDelimitersOf as $o, applyRoleArnIfSet as $r, splitImportedOps as $s, recordUnderIdIsNotOwn as $t, diffSecurity as A, refuseMalformedResourceEntries as Aa, buildDenyExternalAccessPolicy as Ac, isNamelessDynamicReferenceError as Ai, hasOwnKey as Al, DEFAULT_RESOURCE_TIMEOUT_MS as An, withRetry as Ao, CloudControlProvider as Ar, provenPublicValue as As, withNestedStackContext as At, readProtection as B, refuseMalformedResourcesForDeploy as Ba, isDockerClientEnvKey as Bc, declaresNoEcho as Bi, injectedAwsRegionValue as Bl, storedSecretNameNeedles as Bn, maskWholeValue as Bo, markWaitAbandoned as Br, TEMPLATE_SOURCED_RULES as Bs, awaitInFlightSibling as Bt, withApiLimit as C, refuseMalformedOrphanRecordsForDestroy as Ca, ensureAssetStorage as Cc, coerceParameterTypedValue as Ci, PARTITION_TABLE as Cl, exportNameSecretExposure as Cn, replayWarn as Co, readsNoEchoDeleteValues as Cr, recordNestedStackParameterExpressions as Cs, nestedChildStackName as Ct, findServiceTokenRefusals as D, refuseMalformedOutputs as Da, readBootstrapMarkerBody as Dc, isImpossibleEmptyStoredAttribute as Di, StageLoadError as Dl, collectPublishedOutputNames as Dn, prefetchCreateOnlyPropertyPaths as Do, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Dr, recordPhysicalNameCopy as Ds, withNestedRevertRun as Dt, deferredServiceTokenWarning as E, refuseMalformedOrphansForOrphan as Ea, parseBootstrapMarker as Ec, getAccountInfo as Ei, AssemblyReader as El, collectDeclaredOutputNames as En, requireConfigString as Eo, withPrintingSecrets as Er, recordAttributeIdCopy as Es, revertedNestedRowIds as Et, recordedProtectionEvidence as F, refuseMalformedResourceEntriesForOrphan as Fa, describeDockerFailure as Fc, refStateLookupFromResource as Fi, describeFileReadFailure as Fl, orphanRecordsPrintingBag as Fn, TemplateParser as Fo, deleteIndeterminateGuards as Fr, recordProvenPublicExpression as Fs, loadJournaledOrphans as Ft, deleteBudgetKey as G, repairMalformedOrphansForReadOnly as Ga, redactedDockerCause as Gc, UNREADABLE_RESOURCES_MAP_ROW as Gi, ccRoutedFinalSnapshotError as Gn, passedNoEchoParametersOf as Go, reDisableInstanceApiTermination as Gr, S3StateBackend as Gs, replacedDeleteFailureVerdict as Gt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as H, refuseMalformedResourcesForExport as Ha, partitionSensitiveEnv as Hc, STATE_REGION_DIVERGED as Hi, resolveBucketRegion as Hl, ATOMIC_FINAL_SNAPSHOT_TYPES as Hn, noEchoCoordinatesOf as Ho, ec2InstanceProtectionSite as Hr, isSingleDynamicReferenceToken as Hs, getStackRecords as Ht, recordedProtectionNote as I, refuseMalformedResourcePropertiesForDestroy as Ia, dockerSpawnEnvWithSensitive as Ic, parseWebACLArn as Ii, displayAssemblyPath as Il, secretNamePrintingBag as In, canonicalCoordinates as Io, deleteLeftInPlace as Ir, wholeStringLeavesOf as Is, makeForeignHolderScan as It, DELETE_INDEX_WAIT_PROCEED_NOTE as J, repairMalformedResourcePropertiesForReadOnly as Ja, warnFinchArgvExposure as Jc, displayLogicalId as Ji, isFinalSnapshotError as Jn, valueAtCoordinate as Jo, INTRINSIC_KEYS as Jr, CrossPrefixScanCache as Js, isJournaledOrphan as Jt, resolveDynamoDbDeleteBudgetClock as K, repairMalformedOutputsForReadOnly as Ka, runDockerForeground as Kc, accountArgs as Ki, createPreDeleteFinalSnapshot as Kn, readbackPathFor as Ko, reEnableInstanceApiTermination as Kr, rebuildClientForBucketRegion as Ks, recordAfterRollbackUpdate as Kt, PROTECTION_PROPERTY_BY_TYPE as L, refuseMalformedResourcePropertiesForDrift as La, finchSecretArgvRefusal as Lc, withSharedDrainBudget as Li, renderAssemblyPathEscape as Ll, secretNamePrintingBags as Ln, isMarkedCoordinate as Lo, deleteSkipReason as Lr, STATE_SOURCED_BASELINE_RULES as Ls, sameJournaledOrphans as Lt, noEchoComparisonForTemplate as M, refuseMalformedResourceEntriesForDestroy as Ma, resolveDockerContextDirectory as Mc, AWS_NO_VALUE as Mi, nullPrototypeRecord as Ml, completedReplayEntries as Mn, lambdaFunctionNameForMask as Mo, unchangedBehindSecretReference as Mr, recordMaskOnlyValuesIn as Ms, dropFailedHint as Mt, noEchoExactEchoLeavesOf as N, refuseMalformedResourceEntriesForImport as Na, describeDockerCapturedOutput as Nc, cfnRefValueFromPhysicalId as Ni, ownValue as Nl, journaledOrphanPrintingBag as Nn, sameLambdaFunctionAddress as No, RollbackInlinePolicyWriters as Nr, recordNoEchoAttributeValues as Ns, isHandledOrphan as Nt, serviceTokenBlockingReason as O, refuseMalformedOutputsForDestroy as Oa, validateAssetBucketName as Oc, carriesDynamicReference as Oi, processStackMessages as Ol, isExportAliasCollision as On, templateResourceTypes as Oo, applyCustomResourceResponseExpiration as Or, splitGetAttStringForm as Os, collectNestedChildUnaddressed as Ot, noEchoParameterNamesOf as P, refuseMalformedResourceEntriesForImportSave as Pa, describeDockerExecFailure as Pc, isStalePlaceholderArnAttribute as Pi, absoluteAssemblyPathEscape as Pl, maskEventTextWithBoundBags as Pn, DagBuilder as Po, UNSPECIFIED_SKIP_REASON as Pr, recordNoEchoParameterFreshValue as Ps, journaledOrphanLines as Pt, ECR_AUTO_DELETE_IMAGES_TAG as Q, unreadableResourceEntries as Qa, AssetManifestLoader as Qc, isReadableOrphanRecord as Qi, constructPathOf as Qn, hasMaskableValues as Qo, refuseUnreadableCdkCrossAccountRefs as Qr, isNotImplemented as Qs, recheckFailedPlan as Qt, isProtectionValueActive as R, refuseMalformedResourcePropertiesForExport as Ra, formatDockerLoginError as Rc, parameterInputsFor as Ri, resolveAssemblyPath as Rl, secretNamedRecordNeedles as Rn, maskAtCoordinates as Ro, withIndeterminateGuard as Rr, STATE_SOURCED_CROSS_GENERATION_RULES as Rs, replayFailedOperations as Rt, lookupEachName as S, refuseMalformedOrphanRecords as Sa, assertAssetBucketRegion as Sc, regionLessSecretName as Si, expectedOwnerParam as Sl, exportNameNoEchoParameters as Sn, readConfigString as So, TemplateNoEchoReresolver as Sr, inheritNestedStackParameterAssociations as Ss, getNestedRevertRun as St, recordRetainedForReadoption as T, refuseMalformedOrphansForDestroy as Ta, isCrossRegionRedirect as Tc, parameterTypeMayLoseSecretIdentity as Ti, derivePartitionAndUrlSuffix as Tl, noEchoParameterValueSeed as Tn, requireConfigObject as To, getCurrentResourceSecrets as Tr, physicalNameCopiesOf as Ts, revertNestedChildFromJournal as Tt, beginDeleteWait as U, refuseMalformedState as Ua, redactDockerArgvValues as Uc, STATE_RESOURCES_MALFORMED as Ui, PRE_DELETE_SNAPSHOT_TYPES as Un, noEchoLeavesOf as Uo, isTerminationProtectionPropagationError as Ur, LockManager as Us, withStackRecords as Ut, DynamoDBGlobalTableProvider as V, refuseMalformedResourcesForDestroy as Va, isMalformedEnvKey as Vc, JSON_LISTING_HOLE_VALUE as Vi, clearBucketRegionCache as Vl, extractDeploymentEventError as Vn, maskedLeafCoordinatesOf as Vo, disableInstanceApiTermination as Vr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Vs, destroyStackRecordsView as Vt, compensateRemovedDeletionProtection as W, repairMalformedOrphanRecordsForReadOnly as Wa, redactedCause as Wc, UNREADABLE_ORPHANS_CONTAINER_ROW as Wi, buildFinalSnapshotIdentifier as Wn, noEchoOutputsComparison as Wo, observeThenDisableInstanceApiTermination as Wr, isLockInfoExpired as Ws, removeProtectionTypeList as Wt, deleteTableWithIndexBusyRetry as X, unpreviewableOrphanRecords as Xa, stripControlChars as Xc, hasReadableOutputs as Xi, unsupportedFinalSnapshotError as Xn, carryLogOnlyValues as Xo, poisonRenderedSpellingsCollidingIn as Xr, crossPrefixDeniedWarning as Xs, planFailedOps as Xt, INDEX_SETTLE_POLL_INTERVAL_MS as Y, repairMalformedResourcesForReadOnly as Ya, escapeRegExp$3 as Yc, hasReadableOrphans as Yi, refusesFinalSnapshot as Yn, liveMatchesUnresolvedTokenFrame as Yo, IntrinsicFunctionResolver as Yr, applyCrossPrefixScan as Ys, isReplacementOrphan as Yt, waitForIndexesSettled as Z, unreadableOrphanRecords as Za, stripForDisplay as Zc, hasReadableResources as Zi, maskingRetryLogger as Zn, createUnionSecretMasker as Zo, producerLookupOver as Zr, isAccessDenied$1 as Zs, planRollback as Zt, keptWholeReasonText as _, malformedScrubResourceEntriesRefusalMessage as _a, createAssetRedirectResolver as _c, s3BucketRegionalDomainName as _i, MIGRATE_TMP_PREFIX as _l, exportAliasCollisionScrubWarning as _n, coerceCfnBoolean as _o, CC_BROKEN_REASON as _r, DYNAMIC_REFERENCE_TOKEN_SCAN as _s, planOrphanAdoption as _t, inheritedProvenanceForChildDiff as a, malformedLocalResourcesWarning as aa, hasUnverifiableParameterRefusal as ac, AWS_CREDENTIAL_ENV_KEYS as ai, resolveApp as al, getCurrentProducerRegions as an, hasNoCloudControlHandlers as ao, acquireIdempotencyToken as ar, unionOfSecretBags as as, createReadOnlyAttributeHealerFactory as at, chunks as b, refuseDivergentRecordRegionForDestroy as ba, AssetModeResolver as bc, classifyReplaySecretRegion as bi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as bl, secretSafeKeyDisplay as bn, configIntegerRefusal as bo, isCustomResource as br, pathCrossesDottedKey as bs, displacedPhysicalIdShown as bt, isAbsoluteAssetPath as c, malformedOrphanRowsKeptWarning as ca, isReadableBag as cc, envCredentialsAreAssumedRole as ci, resolveSkipPrefix as cl, isRedactedRecordedValue as cn, MULTI_REGION_RECREATE_BLOCKED_TYPES as co, DBPROXY_TAGS_WHAT as cr, maskSecretsInError as cs, gray as ct, templateIdentity as d, malformedOutputsRefusalMessage as da, shouldRetainResource as dc, outputReferenceProvenanceOf as di, resolveUseCdkBootstrapAssets as dl, updatePartialMessage as dn, renderStatefulReason as do, readTagList as dr, recordReferenceProvenanceEntry as ds, yellow as dt, malformedDriftResourcePropertiesWarning as ea, acceptedCreateOnlyDropsOf as ec, assertFlagRoleArn as ei, Synthesizer as el, replacementNeverSwapped as en, findActionableSilentDrops as eo, formatDestructiveChange as er, logOnlyValueCount as es, hasCdkAutoDeleteTag as et, conditionFingerprint as f, malformedOutputsWarning as fa, AssetPublisher as fc, recordedOutputReferenceRegions as fi, stateBucketExistenceConfirmed as fl, updatePartialReason as fn, WARM_THROUGHPUT_MEMBERS as fo, refuseMalformedDesiredTags as fr, snapshotPassProvenance as fs, computeParameterTaint as ft, isSecretBearingReferenceString as g, malformedResourcesWarning as ga, buildAssetRedirectMap as gc, s3BucketDualStackDomainName as gi, CFN_TEMPLATE_URL_LIMIT as gl, displayTextOrWithheld as gn, toFiniteNumber as go, stringifyIfAssigned as gr, withoutPhysicalNameCopies as gs, makeSiblingClaimReader as gt, readRecordedConditionVerdicts as h, malformedResourcePropertiesWarning as ha, WorkGraph as hc, s3BucketDomainName as hi, CFN_TEMPLATE_BODY_LIMIT as hl, WITHHELD_NAME_DISPLAY as hn, toCfnInteger as ho, definedAttributes as hr, withPhysicalNameCopies as hs, resourcesNamingDeclaredParameter as ht, crossStackOutputProvenanceSource as i, malformedLocalResourceEntriesWarning as ia, hasReasonlessBaselineRefusal as ic, sendableAssumeRoleCommand as ii, loadCdkJson as il, findNestedStackTypeChanges as in, NO_CC_HANDLERS_REASON as io, withCreateTokenLedger as ir, shareLogOnlyValues as is, formatResourceLine as it, noEchoAttributeNamesOf as j, refuseMalformedResourceEntriesForDeploy as ja, buildDockerImage as jc, keepsSecretReferenceToken as ji, hasPlainPrototype$1 as jl, DEFAULT_RESOURCE_WARN_AFTER_MS as jn, canonicalLambdaFunctionName as jo, slowCcOperationTimeoutMs as jr, recordMaskOnlyValue as js, deleteJournaledOrphans as jt, withResourceDeadline as k, refuseMalformedResourceAttributesForOrphan as ka, validateContainerRepoName as kc, carriesFetchableDynamicReference as ki, defineOwnKey as kl, bindingSkippedOutputs as kn, describeTypeWithThrottleRetry as ko, customResourceResponseExpirationWarning as kr, carriesSecretMask as ks, getCurrentNestedStackContext as kt, listNestedTemplateRows as l, malformedOrphansRefusalMessage as la, orphansAfterRollback as lc, isSettledInstanceState as li, resolveStateBucketWithDefault as ll, redactedDeleteAddressFields as ln, isStatefulRecreateTargetForReplace as lo, DBPROXY_TAG_OPTIONS as lr, maskSecretsInText as ls, green as lt, parentSuppliedValues as m, malformedResourceEntriesWarning as ma, stringifyValue as mc, s3BucketArn as mi, ssmResolvedValueType as ml, DeploymentEventsStore as mn, isWarmThroughputDecrease as mo, tagPlanWarning as mr, scrubResourceRecord as ms, reachableDivergentParameters as mt, IMPLICIT_DELETE_DEPENDENCIES as n, malformedExportSourceWarning as na, exportNamesCarriedFrom as nc, explicitRoleArnOrThrow as ni, getDefaultStateBucketName as nl, seedsDeleteFirstGuard as nn, unwrittenCreateOnlyReplacement as no, ledgerForStack as nr, recordLogOnlyParameterValue as ns, getPriorAttempts as nt, childTemplateLoader as o, malformedOrphanRecordsRefusalMessage as oa, importableOutputKeys as oc, applyCallerIdentityCredentials as oi, resolveAutoAssetStorage as ol, inheritProducerRegions as on, findReplacedReadersOfRecreateTargets as oo, isRefusedByName as or, createSecretMasker as os, bold as ot, conditionInputsFrom as p, malformedRenderedContainersWarning as pa, isSensitiveAttributeName as pc, recordedReferenceRegions as pi, warnDeprecatedNoPrefixCliFlag as pl, DeploymentEventsReader as pn, coerceWarmThroughput as po, tagMapAsList as pr, redactSecretsForState as ps, namesAnyDeclaredParameter as pt, resolveDynamoDbDeleteBudgetMs as q, repairMalformedResourceEntriesForReadOnly as qa, runDockerStreaming as qc, deployRefusesOrphanRowsReason as qi, effectiveDeletionPolicy as qn, readsNoEchoSource as qo, DiffCalculator as qr, CrossPrefixReadError as qs, demoteSupersededOrphans as qt, computeImplicitDeleteEdges as r, malformedLocalOutputsWarning as ra, hasReadableExportSet as rc, isIamRoleArn as ri, getLegacyStateBucketName as rl, orphanDeleteNeedsIdentity as rn, withoutSilentDropProperties as ro, reserveStackCreateToken as rr, recordLogOnlyValue as rs, markRefusedBeforeApplying as rt, findNestedTemplateTreeDefect as s, malformedOrphanRecordsWarning as sa, importableOutputs as sc, callerEnvCredentials as si, resolveCaptureObservedState as sl, REDACTED_DELETE_ADDRESS_SKIP_REASON as sn, shownType as so, markDeleteStarted as sr, errorCauseChain as ss, cyan as st, DeployEngine as t, malformedExportNamesWarning as ta, describeRegionValueKind as tc, assertSendableRoleArn as ti, synthesisStatusMessage as tl, resolveReplacementOldType as tn, findSilentDropProperties as to, earliestDefined as tr, printingCorpusOf as ts, isTruthyCfnBoolean as tt, renderNestedTemplateTreeDefect as u, malformedOrphansWarning as ua, orphansCarriedFrom as uc, keepHeldTokenProvenance as ui, resolveStateBucketWithDefaultAndSource as ul, redactedDeleteAddressSkip as un, isStatefulRecreateTargetSync as uo, planTagDiff as ur, markSameGenerationBag as us, red as ut, mergeNoChangeOutputs as v, malformedStateRefusalMessage as va, loadPublishableAssetManifest as vc, s3BucketWebsiteUrl as vi, findLargeInlineResources as vl, secretBearing as vn, coerceCfnInteger as vo, ProviderRegistry as vr, dynamicReferenceTokens as vs, NESTED_PENDING_PARENT_REASON as vt, keptForReadoption as w, refuseMalformedOrphans as wa, getBootstrapMarkerKey as wc, isUnboundTemplateParameter as wi, canonicalizeRegion as wl, isWholeDynamicReferenceValue as wn, requireConfigArray as wo, isCustomResourceType as wr, recoverMaskedOutput as ws, recordDisplacedSkips as wt, isAccessDeniedError as x, refuseMalformedNestedChildOutputs as xa, BOOTSTRAP_MARKER_PREFIX as xc, producerRegionsFromState as xi, decodeListingKey as xl, carriedExportAliasExposure as xn, configStringRefusal as xo, wouldReturnToSdkProvider as xr, identityKeyFor as xs, dropSettledNestedJournals as xt, makeCanonicalizePropertiesFn as y, previewableOrphanRecords as ya, rewriteTemplateAssetReferences as yc, classifyRecordedSecretRegion as yi, uploadCfnTemplate as yl, secretBearingStateKeyWarning as yn, configBooleanRefusal as yo, ccBrokenReason as yr, isUncertifiedBaselineMaskPosition as ys, displacedOpClause as yt, perType as z, refuseMalformedResourcePropertiesForOrphan as za, getDockerCmd as zc, passedParameterClassesOf as zi, injectAwsRegion as zl, stateSecretNameNeedles as zn, maskReadbackAtCoordinates as zo, isWaitAbandonedError as zr, STATE_SOURCED_READBACK_RULES as zs, replayRollback as zt };
-//# sourceMappingURL=deploy-engine-BK4gG_5A.js.map
+//# sourceMappingURL=deploy-engine-DOBzE5TD.js.map