@go-to-k/cdkd 0.301.1 → 0.301.3

package/dist/{deploy-engine-BYgrFxwH.js → deploy-engine-CZaafy9R.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-B_CEQGE1.js";
 import { A as UNRENDERABLE, B as safeMsg, C as looksLikeCdkdGeneratedName, D as SAFE_MSG_ALTERED_CHAR, E as withoutGeneratedFallbackName, F as displaySafe, H as terminalSafe, I as displayStackName, L as isPasteableIdent, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, S as getCurrentStackName, T as withStackName, U as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, j as asIsMessage, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, An as SHELL_ACTIVE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, Ct as RETRY_AUXILIARY_OWNER, Dn as normalizeAwsError, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as isUpdateUnsupportedError, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as withheldTargetClause, Ht as recoveryCommandFlags, In as pasteableCommand, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as isNameCooldownError, Kn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as physicalIdShownBesideCommand, M as quotedRemedyLogicalId, Mn as UNSHOWABLE_VALUE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Ot as hasCreatedBeforeFailure, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as plainOrDescribed, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Ut as sanitizeRecoveryValue, Vn as shellQuote, Vt as formatLockOwner, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isReplayedNameCollisionFrom, Yn as isRecreateRetryableError, Yt as producerRecordKey, Zt as withPasteableAwsProfile, _t as createMaskedLogSinks, ar as isRetryableTransientError, at as startInterruptWatch, bn as ResourceUpdateNotSupportedError, bt as maskDeep, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dr as markNonRetryable, en as clientDefaultsFor, er as formatRetryClassificationSignals, f as removalWarning, fr as markRedactedCause, ft as logicalIdShown, gt as stateOrphanRecordRemedy, hn as MalformedProducerRecordRefusalError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isIamPropagationError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as SHELL_ACTIVE_WHY, jt as markAuxiliaryFailure, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DynamicReferenceRegionAmbiguousError, lr as isMarkedNonRetryable, m as withoutInjectedRemovals, mn as MacroExpansionError, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, on as CrossAccountSecretRefusalError, or as isTransientServerError, ot as ElapsedBudgetRegistry, pn as LockError, pr as wrapMaskedAwsError, qn as isNameCollisionErrorFrom, rn as AssetError, sn as DependencyError, sr as retryClassificationText, st as monotonicNowMs, tn as credentialFingerprint, tr as isAmbiguousCcHandlerErrorCode, un as IntrinsicResolutionRefusalError, ur as isThrottlingError, ut as compositeIdSeparatorRefusal, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as SynthesisError, wt as carryCreatedBeforeFailure, xt as maskerOrIdentity, yn as ResourceTimeoutError, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-DFk7zr0Q.js";
+import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, An as SHELL_ACTIVE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, Ct as RETRY_AUXILIARY_OWNER, Dn as normalizeAwsError, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as isUpdateUnsupportedError, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as withheldTargetClause, Ht as recoveryCommandFlags, In as pasteableCommand, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as isNameCooldownError, Kn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as physicalIdShownBesideCommand, M as quotedRemedyLogicalId, Mn as UNSHOWABLE_VALUE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Ot as hasCreatedBeforeFailure, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as plainOrDescribed, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Ut as sanitizeRecoveryValue, Vn as shellQuote, Vt as formatLockOwner, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isReplayedNameCollisionFrom, Yn as isRecreateRetryableError, Yt as producerRecordKey, Zt as withPasteableAwsProfile, _t as createMaskedLogSinks, ar as isRetryableTransientError, at as startInterruptWatch, bn as ResourceUpdateNotSupportedError, bt as maskDeep, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dr as markNonRetryable, en as clientDefaultsFor, er as formatRetryClassificationSignals, f as removalWarning, fr as markRedactedCause, ft as logicalIdShown, gt as stateOrphanRecordRemedy, hn as MalformedProducerRecordRefusalError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isIamPropagationError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as SHELL_ACTIVE_WHY, jt as markAuxiliaryFailure, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DynamicReferenceRegionAmbiguousError, lr as isMarkedNonRetryable, m as withoutInjectedRemovals, mn as MacroExpansionError, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, on as CrossAccountSecretRefusalError, or as isTransientServerError, ot as ElapsedBudgetRegistry, pn as LockError, pr as wrapMaskedAwsError, qn as isNameCollisionErrorFrom, rn as AssetError, sn as DependencyError, sr as retryClassificationText, st as monotonicNowMs, tn as credentialFingerprint, tr as isAmbiguousCcHandlerErrorCode, un as IntrinsicResolutionRefusalError, ur as isThrottlingError, ut as compositeIdSeparatorRefusal, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as SynthesisError, wt as carryCreatedBeforeFailure, xt as maskerOrIdentity, yn as ResourceTimeoutError, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-BkeM7IXi.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-DBXBcg0J.js";
-import { t as getCdkdVersion } from "./version-Q15RJPDm.js";
+import { t as getCdkdVersion } from "./version-Cx2pAgJv.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7888,6 +7888,10 @@ function isStrictlyInsideASpan(spans, start, end) {
 	return spans.some((span) => span.start <= start && end <= span.end && (span.start !== start || span.end !== end));
 }
 function embedsNeedleOutsideReferences(leaf, needles, secrets) {
+	return needleOccurrencesOutsideReferences(leaf, needles, secrets, true).length > 0;
+}
+function needleOccurrencesOutsideReferences(leaf, needles, secrets, first) {
+	const found = [];
 	let spans;
 	let names;
 	for (const needle of needles) for (let at = leaf.indexOf(needle); at >= 0; at = leaf.indexOf(needle, at + 1)) {
@@ -7896,9 +7900,19 @@ function embedsNeedleOutsideReferences(leaf, needles, secrets) {
 		names ??= physicalNameSpans(physicalNameCopiesOf.get(secrets), leaf);
 		const end = at + needle.length;
 		if (names.some((n) => n.start <= at && end <= n.end)) continue;
-		return true;
+		found.push({
+			start: at,
+			end
+		});
+		if (first) return found;
 	}
-	return false;
+	return found;
+}
+function cutsContainmentNeedle(leaf, secrets, redacted) {
+	if (redacted.length === 0) return false;
+	const needles = containmentNeedlesOf(secrets);
+	if (needles.length === 0) return false;
+	return needleOccurrencesOutsideReferences(leaf, needles, secrets, false).some((c) => redacted.some((m) => m.start < c.end && c.start < m.end && !(m.start <= c.start && c.end <= m.end)));
 }
 function flattenEmbeddedNoEchoLeaves(value, secrets) {
 	const needles = containmentNeedlesOf(secrets);
@@ -8280,6 +8294,15 @@ function pseudoBindingOf(parentSecrets) {
 	const table = inheritedPseudoParameters.get(parentSecrets);
 	return (name) => table instanceof Map && table.has(name) ? { value: table.get(name) } : void 0;
 }
+function inheritedPseudoValue(parentSecrets, name) {
+	const bound = pseudoBindingOf(parentSecrets)(name)?.value;
+	return typeof bound === "string" ? bound : void 0;
+}
+function inheritedPseudoSpan(childSecrets, key) {
+	const reads = inheritedParameterReads.get(childSecrets);
+	if (reads === void 0 || typeof reads === "symbol") return void 0;
+	for (const name of REREAD_PSEUDO_PARAMETERS) if (crossStackSourceKey({ Ref: name }) === key) return inheritedPseudoValue(reads.parent, name);
+}
 const REREAD_TRIGGERS = /* @__PURE__ */ new Set([
 	"Fn::Select",
 	"Fn::Split",
@@ -8664,6 +8687,12 @@ function positionByParameterPlaceholders(bag, source, secrets) {
 					}
 				}
 			}
+			const pseudo = expression === void 0 && part !== UNKNOWN_PART ? inheritedPseudoSpan(secrets, part.key) : void 0;
+			if (pseudo !== void 0) {
+				side[0] += pseudo;
+				side[1] += pseudo;
+				continue;
+			}
 			if (expression === void 0) {
 				if (unknown) return void 0;
 				unknown = true;
@@ -9238,14 +9267,29 @@ function redactSecretsForStatePasses(bag, secrets, source, rules) {
 	const physicalNames = physicalNameCopiesOf.get(secrets);
 	let vouched;
 	const vouchedExpressions = () => vouched ??= new Set(secrets.values());
+	const expressionFor = (match) => {
+		return secrets.get(match) ?? "***";
+	};
 	const scanLeaf = (value, needles) => {
 		const spans = isDynamicReferenceString(value) ? resolvableReferenceSpans(value, vouchedExpressions()) : [];
 		const names = physicalNameSpans(physicalNames, value);
+		const kept = (start, end) => isStrictlyInsideASpan(spans, start, end) || names.some((n) => n.start <= start && end <= n.end);
+		if (!legacyOverlapScan.has(secrets)) {
+			const matches = everyMatch(value, needles);
+			const redacted = matches.filter((m) => !kept(m.start, m.end));
+			if (cutsContainmentNeedle(value, secrets, redacted)) {
+				overlapAnswered.add(secrets);
+				return "***";
+			}
+			const overlapping = redactOverlappingMatches(value, matches, redacted, expressionFor);
+			if (overlapping !== void 0) {
+				overlapAnswered.add(secrets);
+				return overlapping;
+			}
+		}
 		return value.replace(needles, (match, offset) => {
-			if (isStrictlyInsideASpan(spans, offset, offset + match.length)) return match;
-			const end = offset + match.length;
-			if (names.some((n) => n.start <= offset && end <= n.end)) return match;
-			return secrets.get(match) ?? "***";
+			if (kept(offset, offset + match.length)) return match;
+			return expressionFor(match);
 		});
 	};
 	const walk = (value) => {
@@ -9275,6 +9319,113 @@ function redactSecretsForStatePasses(bag, secrets, source, rules) {
 	};
 	return walk(bag);
 }
+const legacyOverlapScan = /* @__PURE__ */ new WeakSet();
+const overlapAnswered = /* @__PURE__ */ new WeakSet();
+function overlapRuleAnswered(secrets) {
+	return overlapAnswered.has(secrets);
+}
+function withLegacyOverlapScan(secrets, run) {
+	if (legacyOverlapScan.has(secrets)) return run();
+	legacyOverlapScan.add(secrets);
+	try {
+		return run();
+	} finally {
+		legacyOverlapScan.delete(secrets);
+	}
+}
+function differingStringLeaves(legacy, current, out = []) {
+	if (typeof legacy === "string" && typeof current === "string") {
+		if (legacy !== current) out.push([legacy, current]);
+		return out;
+	}
+	if (Array.isArray(legacy) && Array.isArray(current) && legacy.length === current.length) {
+		legacy.forEach((item, i) => differingStringLeaves(item, current[i], out));
+		return out;
+	}
+	if (legacy !== null && current !== null && typeof legacy === "object" && typeof current === "object" && !Array.isArray(legacy) && !Array.isArray(current)) {
+		const c = current;
+		for (const [key, value] of Object.entries(legacy)) if (Object.hasOwn(c, key)) differingStringLeaves(value, c[key], out);
+	}
+	return out;
+}
+function legacyReferenceLeavesOnly(legacy) {
+	if (typeof legacy === "string") return legacy.includes("{{resolve:") ? legacy : void 0;
+	if (Array.isArray(legacy)) return legacy.map(legacyReferenceLeavesOnly);
+	if (legacy !== null && typeof legacy === "object") {
+		const out = Object.create(null);
+		for (const [key, value] of Object.entries(legacy)) out[key] = legacyReferenceLeavesOnly(value);
+		return out;
+	}
+	return legacy;
+}
+function replaceWholeLeaves(value, pairs) {
+	if (pairs.length === 0) return value;
+	if (typeof value === "string") {
+		const hit = pairs.find(([legacy]) => legacy === value);
+		return hit === void 0 ? value : hit[1];
+	}
+	if (Array.isArray(value)) {
+		let changed = false;
+		const out = value.map((item) => {
+			const next = replaceWholeLeaves(item, pairs);
+			if (next !== item) changed = true;
+			return next;
+		});
+		return changed ? out : value;
+	}
+	if (value !== null && typeof value === "object") {
+		let out;
+		for (const [key, item] of Object.entries(value)) {
+			const next = replaceWholeLeaves(item, pairs);
+			if (next !== item) {
+				out ??= Object.assign(Object.create(null), value);
+				out[key] = next;
+			}
+		}
+		return out ?? value;
+	}
+	return value;
+}
+function everyMatch(value, needles) {
+	const matches = [];
+	needles.lastIndex = 0;
+	for (let m = needles.exec(value); m !== null; m = needles.exec(value)) {
+		matches.push({
+			start: m.index,
+			end: m.index + m[0].length
+		});
+		needles.lastIndex = m.index + 1;
+	}
+	needles.lastIndex = 0;
+	return matches;
+}
+function redactOverlappingMatches(value, matches, redacted, expressionFor) {
+	let reach = 0;
+	let overlap = false;
+	for (const m of matches) {
+		if (m.start < reach) overlap = true;
+		reach = Math.max(reach, m.end);
+	}
+	if (!overlap) return void 0;
+	let out = "";
+	let cursor = 0;
+	for (let i = 0; i < redacted.length;) {
+		let end = redacted[i].end;
+		let j = i + 1;
+		for (; j < redacted.length && redacted[j].start < end; j++) end = Math.max(end, redacted[j].end);
+		const cluster = redacted.slice(i, j);
+		out += value.slice(cursor, cluster[0].start);
+		for (let at = cluster[0].start; at < end;) {
+			const tile = cluster.find((m) => m.start === at);
+			if (tile === void 0) return "***";
+			out += expressionFor(value.slice(tile.start, tile.end));
+			at = tile.end;
+		}
+		cursor = end;
+		i = j;
+	}
+	return out + value.slice(cursor);
+}
 function scrubResourceRecord(record, secrets, sourceProperties, observedRules) {
 	if (secrets.size === 0 && sourceProperties === void 0 && !record.observedProperties) return record;
 	const next = { ...record };
@@ -14992,6 +15143,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"Unit"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([
+			["ActionConfiguration", "not yet implemented by cdkd"],
 			["EvaluationCriteria", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."],
 			["EvaluationInterval", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."],
 			["EvaluationWindow", "not yet implemented by cdkd"],
@@ -21500,7 +21652,7 @@ function withheldRemedy(context) {
 	if (context?.attributeHealer?.readOnly === true) return `This preview re-read the resource through Cloud Control, but withheld the value: ${confirm} Grant the credentials the preview runs with cloudformation:DescribeType and run the diff again (a deploy's own read needs the same permission); if they already have it, the name is a writable property rather than an attribute — reference the value the template sets instead.`;
 	return `cdkd re-read the resource through Cloud Control, but withheld the value: ${confirm} Grant the deploy role cloudformation:DescribeType and deploy again; if the role already has it, the name is a writable property rather than an attribute — reference the value the template sets instead.`;
 }
-async function healStaleAttributes$1(logicalId, resource, context) {
+async function healStaleAttributes(logicalId, resource, context) {
 	if (context.attributeHealer === void 0) return void 0;
 	try {
 		return await context.attributeHealer(logicalId, resource);
@@ -23372,6 +23524,7 @@ function parameterReadsOf(node, names, reread, positionsArrays) {
 const MAX_UNKEYED_PARTS = 1;
 function certifiesPlaceholder(name, reread) {
 	if (reread === void 0) return false;
+	if (name.startsWith("AWS::")) return inheritedPseudoValue(reread.inherited, name) !== void 0;
 	const bound = reread.bind(name);
 	if (bound === void 0) return false;
 	if (inheritedSecretsCarriedBy(bound.value, reread.inherited).length === 0) return false;
@@ -24412,7 +24565,7 @@ IntrinsicFunctionResolver.prototype.staleRecordRemedy = staleRecordRemedy;
 IntrinsicFunctionResolver.prototype.unenrichedRemedy = unenrichedRemedy;
 IntrinsicFunctionResolver.prototype.healWithheld = healWithheld;
 IntrinsicFunctionResolver.prototype.withheldRemedy = withheldRemedy;
-IntrinsicFunctionResolver.prototype.healStaleAttributes = healStaleAttributes$1;
+IntrinsicFunctionResolver.prototype.healStaleAttributes = healStaleAttributes;
 IntrinsicFunctionResolver.prototype.usableHealedAttribute = usableHealedAttribute;
 IntrinsicFunctionResolver.prototype.serveHealedAttribute = serveHealedAttribute;
 IntrinsicFunctionResolver.prototype.constructWithStaleRecordHeal = constructWithStaleRecordHeal;
@@ -26862,7 +27015,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BHhRkEYv.js");
+			const { ASGProvider } = await import("./asg-provider-Di3xOH3L.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -26968,7 +27121,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-N3EBsqc6.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-iRg5Dagt.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-Dadp11aB.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DTUriVz3.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -27797,7 +27950,7 @@ var IdScrubLog = class {
 			...masked.filter((m, i) => m !== "" && m !== raw[i] && m !== "***")
 		])].sort((a, b) => b.length - a.length);
 	}
-	scrub = (text) => this.needles.reduce((out, needle) => out.split(needle).join("***"), this.mask(text));
+	scrub = (text) => maskMatchSpans(this.mask(text), this.needles, "***");
 	scrubKeepingResume(text, requestTokens) {
 		const tokens = requestTokens.filter((token) => token !== "");
 		if (tokens.length === 0) return this.scrub(text);
@@ -28640,6 +28793,22 @@ function describeWaiterFailure(error, rejections) {
 	if (withheld !== void 0) return withheld;
 	return `${error instanceof Error ? error.name : "Error"} (no function status reported). The waiter's raw payload is withheld because it embeds the whole GetFunction response, environment variables included; run \`aws lambda get-function\` for the detail.`;
 }
+async function waitForLambdaFunctionActive(client, functionArn, abortSignal) {
+	const rejections = new WaiterRejections();
+	try {
+		await waitUntilFunctionActiveV2({
+			client: observingLambdaClient(client, rejections),
+			maxWaitTime: 600,
+			minDelay: 1,
+			maxDelay: 5,
+			...abortSignal ? { abortSignal } : {}
+		}, { FunctionName: functionArn });
+	} catch (error) {
+		const log = getLogger().child("LambdaActiveWait");
+		for (const line of waiterRejectionDebugLines(rejections)) log.debug(safeMsg`Active waiter for ${functionArn} observed ${line}`);
+		throw markNonRetryable(new Error(`Lambda function ${functionArn} did not reach the Active state: ${describeWaiterFailure(error, rejections)}`, { cause: error }));
+	}
+}
 const CR_TRANSIENT_AUTHZ_SIGNALS = [
 	"not authorized to perform",
 	"no identity-based policy allows",
@@ -28831,7 +29000,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 		} catch (error) {
 			markAuxiliaryFailure(error, logicalId);
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create custom resource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			throw new ProvisioningError(`Failed to create custom resource ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -28865,7 +29034,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update custom resource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update custom resource ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
@@ -29204,7 +29373,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				sleep: customResourceRetryDelays.sleep
 			});
 		} catch (error) {
-			throw markNonRetryable(error instanceof Error ? error : new Error(String(error)));
+			throw markNonRetryable(error instanceof Error ? error : new Error(safeStringify$1(error)));
 		}
 		const command = new PutObjectCommand({
 			Bucket: this.responseBucket,
@@ -29444,6 +29613,17 @@ const NESTED_REQUIRED = /* @__PURE__ */ new Map([
 		["EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig", ["ModelId"]],
 		["EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig", ["ModelId"]],
 		["EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical", ["Definition", "Label"]],
+		["EvaluatorConfig.LlmAsAJudge.RatingScale.MultiDimensional", [
+			"DimensionInstruction",
+			"DimensionName",
+			"DimensionRatingScale"
+		]],
+		["EvaluatorConfig.LlmAsAJudge.RatingScale.MultiDimensional.DimensionRatingScale.Categorical", ["Definition", "Label"]],
+		["EvaluatorConfig.LlmAsAJudge.RatingScale.MultiDimensional.DimensionRatingScale.Numerical", [
+			"Definition",
+			"Label",
+			"Value"
+		]],
 		["EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical", [
 			"Definition",
 			"Label",
@@ -29553,6 +29733,7 @@ const NESTED_REQUIRED = /* @__PURE__ */ new Map([
 		["Tags", ["Key", "Value"]]
 	])],
 	["AWS::CloudWatch::Alarm", /* @__PURE__ */ new Map([
+		["ActionConfiguration.AlarmTagsPropagation", ["Enabled"]],
 		["Dimensions", ["Name", "Value"]],
 		["Metrics", ["Id"]],
 		["Metrics.MetricStat", [
@@ -30878,7 +31059,7 @@ const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::AppSync::GraphQLApi", "{\"AdditionalAuthenticationProviders\":\"array\",\"AdditionalAuthenticationProviders[]\":\"object\",\"AdditionalAuthenticationProviders[].LambdaAuthorizerConfig\":\"object\",\"AdditionalAuthenticationProviders[].OpenIDConnectConfig\":\"object\",\"AdditionalAuthenticationProviders[].UserPoolConfig\":\"object\",\"EnhancedMetricsConfig\":\"object\",\"EnvironmentVariables\":\"object\",\"LambdaAuthorizerConfig\":\"object\",\"LogConfig\":\"object\",\"OpenIDConnectConfig\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"UserPoolConfig\":\"object\"}"],
 	["AWS::AppSync::Resolver", "{\"CachingConfig\":\"object\",\"CachingConfig.CachingKeys\":\"array\",\"PipelineConfig\":\"object\",\"PipelineConfig.Functions\":\"array\",\"Runtime\":\"object\",\"SyncConfig\":\"object\",\"SyncConfig.LambdaConflictHandlerConfig\":\"object\"}"],
 	["AWS::AutoScaling::AutoScalingGroup", "{\"AvailabilityZoneDistribution\":\"object\",\"AvailabilityZoneIds\":\"array\",\"AvailabilityZoneImpairmentPolicy\":\"object\",\"AvailabilityZones\":\"array\",\"CapacityReservationSpecification\":\"object\",\"CapacityReservationSpecification.CapacityReservationTarget\":\"object\",\"CapacityReservationSpecification.CapacityReservationTarget.CapacityReservationIds\":\"array\",\"CapacityReservationSpecification.CapacityReservationTarget.CapacityReservationResourceGroupArns\":\"array\",\"InstanceLifecyclePolicy\":\"object\",\"InstanceLifecyclePolicy.RetentionTriggers\":\"object\",\"InstanceMaintenancePolicy\":\"object\",\"LaunchTemplate\":\"object\",\"LifecycleHookSpecificationList\":\"array\",\"LifecycleHookSpecificationList[]\":\"object\",\"LoadBalancerNames\":\"array\",\"MetricsCollection\":\"array\",\"MetricsCollection[]\":\"object\",\"MetricsCollection[].Metrics\":\"array\",\"MixedInstancesPolicy\":\"object\",\"MixedInstancesPolicy.InstancesDistribution\":\"object\",\"MixedInstancesPolicy.InstancesDistribution.DistributionSegments\":\"array\",\"MixedInstancesPolicy.InstancesDistribution.DistributionSegments[]\":\"object\",\"MixedInstancesPolicy.InstancesDistribution.DistributionSegments[].TargetCapacityTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.LaunchTemplateSpecification\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[]\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorCount\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorManufacturers\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorNames\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorTotalMemoryMiB\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AcceleratorTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.AllowedInstanceTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselineEbsBandwidthMbps\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors.Cpu\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors.Cpu.References\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.BaselinePerformanceFactors.Cpu.References[]\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.CpuManufacturers\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.ExcludedInstanceTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.InstanceGenerations\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.LocalStorageTypes\":\"array\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.MemoryGiBPerVCpu\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.MemoryMiB\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.NetworkBandwidthGbps\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.NetworkInterfaceCount\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.TotalLocalStorageGB\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].InstanceRequirements.VCpuCount\":\"object\",\"MixedInstancesPolicy.LaunchTemplate.Overrides[].LaunchTemplateSpecification\":\"object\",\"NotificationConfiguration\":\"object\",\"NotificationConfiguration.NotificationTypes\":\"array\",\"NotificationConfigurations\":\"array\",\"NotificationConfigurations[]\":\"object\",\"NotificationConfigurations[].NotificationTypes\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"TargetGroupARNs\":\"array\",\"TerminationPolicies\":\"array\",\"TrafficSources\":\"array\",\"TrafficSources[]\":\"object\",\"VPCZoneIdentifier\":\"array\"}"],
-	["AWS::BedrockAgentCore::Evaluator", "{\"EvaluatorConfig\":\"object\",\"EvaluatorConfig.CodeBased\":\"object\",\"EvaluatorConfig.CodeBased.LambdaConfig\":\"object\",\"EvaluatorConfig.Derived\":\"object\",\"EvaluatorConfig.Derived.ModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.AdditionalModelRequestFields\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig.StopSequences\":\"array\",\"EvaluatorConfig.Derived.ModelConfig.ResponsesEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.ResponsesEvaluatorModelConfig.Reasoning\":\"object\",\"EvaluatorConfig.LlmAsAJudge\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.AdditionalModelRequestFields\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig.StopSequences\":\"array\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig.Reasoning\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical[]\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
+	["AWS::BedrockAgentCore::Evaluator", "{\"EvaluatorConfig\":\"object\",\"EvaluatorConfig.CodeBased\":\"object\",\"EvaluatorConfig.CodeBased.LambdaConfig\":\"object\",\"EvaluatorConfig.Derived\":\"object\",\"EvaluatorConfig.Derived.ModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.AdditionalModelRequestFields\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig.StopSequences\":\"array\",\"EvaluatorConfig.Derived.ModelConfig.ResponsesEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.Derived.ModelConfig.ResponsesEvaluatorModelConfig.Reasoning\":\"object\",\"EvaluatorConfig.LlmAsAJudge\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.AdditionalModelRequestFields\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.BedrockEvaluatorModelConfig.InferenceConfig.StopSequences\":\"array\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig\":\"object\",\"EvaluatorConfig.LlmAsAJudge.ModelConfig.ResponsesEvaluatorModelConfig.Reasoning\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Categorical[]\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.MultiDimensional\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.MultiDimensional[]\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.MultiDimensional[].DimensionRatingScale\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.MultiDimensional[].DimensionRatingScale.Categorical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.MultiDimensional[].DimensionRatingScale.Categorical[]\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.MultiDimensional[].DimensionRatingScale.Numerical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.MultiDimensional[].DimensionRatingScale.Numerical[]\":\"object\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical\":\"array\",\"EvaluatorConfig.LlmAsAJudge.RatingScale.Numerical[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::BedrockAgentCore::Runtime", "{\"AgentRuntimeArtifact\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration.Code\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration.Code.S3\":\"object\",\"AgentRuntimeArtifact.CodeConfiguration.EntryPoint\":\"array\",\"AgentRuntimeArtifact.ContainerConfiguration\":\"object\",\"AuthorizerConfiguration\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedAudience\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedClients\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedScopes\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.HostingEnvironments\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.HostingEnvironments[]\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.AllowedWorkloadConfiguration.WorkloadIdentities\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[]\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[].AuthorizingClaimMatchValue\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[].AuthorizingClaimMatchValue.ClaimMatchValue\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.CustomClaims[].AuthorizingClaimMatchValue.ClaimMatchValue.MatchValueStringList\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource.SecurityGroupIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource.SubnetIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.ManagedVpcResource.Tags\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpoint.SelfManagedLatticeResource\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[]\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource.SecurityGroupIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource.SubnetIds\":\"array\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.ManagedVpcResource.Tags\":\"object\",\"AuthorizerConfiguration.CustomJWTAuthorizer.PrivateEndpointOverrides[].PrivateEndpoint.SelfManagedLatticeResource\":\"object\",\"CapacityProviderConfiguration\":\"object\",\"EnvironmentVariables\":\"object\",\"FilesystemConfigurations\":\"array\",\"FilesystemConfigurations[]\":\"object\",\"FilesystemConfigurations[].CapacityProviderVolume\":\"object\",\"FilesystemConfigurations[].EfsAccessPoint\":\"object\",\"FilesystemConfigurations[].S3FilesAccessPoint\":\"object\",\"FilesystemConfigurations[].SessionStorage\":\"object\",\"LifecycleConfiguration\":\"object\",\"NetworkConfiguration\":\"object\",\"NetworkConfiguration.NetworkModeConfig\":\"object\",\"NetworkConfiguration.NetworkModeConfig.SecurityGroups\":\"array\",\"NetworkConfiguration.NetworkModeConfig.Subnets\":\"array\",\"RequestHeaderConfiguration\":\"object\",\"RequestHeaderConfiguration.RequestHeaderAllowlist\":\"array\",\"Tags\":\"object\",\"WorkloadIdentityDetails\":\"object\"}"],
 	["AWS::Budgets::Budget", "{\"Budget\":\"object\",\"Budget.AutoAdjustData\":\"object\",\"Budget.AutoAdjustData.HistoricalOptions\":\"object\",\"Budget.BudgetLimit\":\"object\",\"Budget.CostFilters\":\"object\",\"Budget.CostTypes\":\"object\",\"Budget.FilterExpression\":\"object\",\"Budget.FilterExpression.And\":\"array\",\"Budget.FilterExpression.CostCategories\":\"object\",\"Budget.FilterExpression.CostCategories.MatchOptions\":\"array\",\"Budget.FilterExpression.CostCategories.Values\":\"array\",\"Budget.FilterExpression.Dimensions\":\"object\",\"Budget.FilterExpression.Dimensions.MatchOptions\":\"array\",\"Budget.FilterExpression.Dimensions.Values\":\"array\",\"Budget.FilterExpression.Or\":\"array\",\"Budget.FilterExpression.Tags\":\"object\",\"Budget.FilterExpression.Tags.MatchOptions\":\"array\",\"Budget.FilterExpression.Tags.Values\":\"array\",\"Budget.Metrics\":\"array\",\"Budget.PlannedBudgetLimits\":\"object\",\"Budget.TimePeriod\":\"object\",\"NotificationsWithSubscribers\":\"array\",\"NotificationsWithSubscribers[]\":\"object\",\"NotificationsWithSubscribers[].Notification\":\"object\",\"NotificationsWithSubscribers[].Subscribers\":\"array\",\"NotificationsWithSubscribers[].Subscribers[]\":\"object\",\"ResourceTags\":\"array\",\"ResourceTags[]\":\"object\"}"],
 	["AWS::CertificateManager::Certificate", "{\"DomainValidationOptions\":\"array\",\"DomainValidationOptions[]\":\"object\",\"SubjectAlternativeNames\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
@@ -30887,7 +31068,7 @@ const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::CloudFront::Distribution", "{\"DistributionConfig\":\"object\",\"DistributionConfig.Aliases\":\"array\",\"DistributionConfig.CNAMEs\":\"array\",\"DistributionConfig.CacheBehaviors\":\"array\",\"DistributionConfig.CacheBehaviors[]\":\"object\",\"DistributionConfig.CacheBehaviors[].AllowedMethods\":\"array\",\"DistributionConfig.CacheBehaviors[].CachedMethods\":\"array\",\"DistributionConfig.CacheBehaviors[].ForwardedValues\":\"object\",\"DistributionConfig.CacheBehaviors[].ForwardedValues.Cookies\":\"object\",\"DistributionConfig.CacheBehaviors[].ForwardedValues.Cookies.WhitelistedNames\":\"array\",\"DistributionConfig.CacheBehaviors[].ForwardedValues.Headers\":\"array\",\"DistributionConfig.CacheBehaviors[].ForwardedValues.QueryStringCacheKeys\":\"array\",\"DistributionConfig.CacheBehaviors[].FunctionAssociations\":\"array\",\"DistributionConfig.CacheBehaviors[].FunctionAssociations[]\":\"object\",\"DistributionConfig.CacheBehaviors[].GrpcConfig\":\"object\",\"DistributionConfig.CacheBehaviors[].LambdaFunctionAssociations\":\"array\",\"DistributionConfig.CacheBehaviors[].LambdaFunctionAssociations[]\":\"object\",\"DistributionConfig.CacheBehaviors[].TrustedKeyGroups\":\"array\",\"DistributionConfig.CacheBehaviors[].TrustedSigners\":\"array\",\"DistributionConfig.CacheTagConfig\":\"object\",\"DistributionConfig.ConnectionFunctionAssociation\":\"object\",\"DistributionConfig.CustomErrorResponses\":\"array\",\"DistributionConfig.CustomErrorResponses[]\":\"object\",\"DistributionConfig.CustomOrigin\":\"object\",\"DistributionConfig.CustomOrigin.OriginSSLProtocols\":\"array\",\"DistributionConfig.DefaultCacheBehavior\":\"object\",\"DistributionConfig.DefaultCacheBehavior.AllowedMethods\":\"array\",\"DistributionConfig.DefaultCacheBehavior.CachedMethods\":\"array\",\"DistributionConfig.DefaultCacheBehavior.ForwardedValues\":\"object\",\"DistributionConfig.DefaultCacheBehavior.ForwardedValues.Cookies\":\"object\",\"DistributionConfig.DefaultCacheBehavior.ForwardedValues.Cookies.WhitelistedNames\":\"array\",\"DistributionConfig.DefaultCacheBehavior.ForwardedValues.Headers\":\"array\",\"DistributionConfig.DefaultCacheBehavior.ForwardedValues.QueryStringCacheKeys\":\"array\",\"DistributionConfig.DefaultCacheBehavior.FunctionAssociations\":\"array\",\"DistributionConfig.DefaultCacheBehavior.FunctionAssociations[]\":\"object\",\"DistributionConfig.DefaultCacheBehavior.GrpcConfig\":\"object\",\"DistributionConfig.DefaultCacheBehavior.LambdaFunctionAssociations\":\"array\",\"DistributionConfig.DefaultCacheBehavior.LambdaFunctionAssociations[]\":\"object\",\"DistributionConfig.DefaultCacheBehavior.TrustedKeyGroups\":\"array\",\"DistributionConfig.DefaultCacheBehavior.TrustedSigners\":\"array\",\"DistributionConfig.Logging\":\"object\",\"DistributionConfig.OriginGroups\":\"object\",\"DistributionConfig.OriginGroups.Items\":\"array\",\"DistributionConfig.OriginGroups.Items[]\":\"object\",\"DistributionConfig.OriginGroups.Items[].FailoverCriteria\":\"object\",\"DistributionConfig.OriginGroups.Items[].FailoverCriteria.StatusCodes\":\"object\",\"DistributionConfig.OriginGroups.Items[].FailoverCriteria.StatusCodes.Items\":\"array\",\"DistributionConfig.OriginGroups.Items[].Members\":\"object\",\"DistributionConfig.OriginGroups.Items[].Members.Items\":\"array\",\"DistributionConfig.OriginGroups.Items[].Members.Items[]\":\"object\",\"DistributionConfig.Origins\":\"array\",\"DistributionConfig.Origins[]\":\"object\",\"DistributionConfig.Origins[].CustomOriginConfig\":\"object\",\"DistributionConfig.Origins[].CustomOriginConfig.OriginMtlsConfig\":\"object\",\"DistributionConfig.Origins[].CustomOriginConfig.OriginSSLProtocols\":\"array\",\"DistributionConfig.Origins[].OriginCustomHeaders\":\"array\",\"DistributionConfig.Origins[].OriginCustomHeaders[]\":\"object\",\"DistributionConfig.Origins[].OriginShield\":\"object\",\"DistributionConfig.Origins[].S3OriginConfig\":\"object\",\"DistributionConfig.Origins[].VpcOriginConfig\":\"object\",\"DistributionConfig.Restrictions\":\"object\",\"DistributionConfig.Restrictions.GeoRestriction\":\"object\",\"DistributionConfig.Restrictions.GeoRestriction.Locations\":\"array\",\"DistributionConfig.S3Origin\":\"object\",\"DistributionConfig.TenantConfig\":\"object\",\"DistributionConfig.TenantConfig.ParameterDefinitions\":\"array\",\"DistributionConfig.TenantConfig.ParameterDefinitions[]\":\"object\",\"DistributionConfig.TenantConfig.ParameterDefinitions[].Definition\":\"object\",\"DistributionConfig.TenantConfig.ParameterDefinitions[].Definition.StringSchema\":\"object\",\"DistributionConfig.ViewerCertificate\":\"object\",\"DistributionConfig.ViewerMtlsConfig\":\"object\",\"DistributionConfig.ViewerMtlsConfig.TrustStoreConfig\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::CloudFront::OriginAccessControl", "{\"OriginAccessControlConfig\":\"object\"}"],
 	["AWS::CloudTrail::Trail", "{\"AdvancedEventSelectors\":\"array\",\"AdvancedEventSelectors[]\":\"object\",\"AdvancedEventSelectors[].FieldSelectors\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[]\":\"object\",\"AdvancedEventSelectors[].FieldSelectors[].EndsWith\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].Equals\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].NotEndsWith\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].NotEquals\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].NotStartsWith\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].StartsWith\":\"array\",\"AggregationConfigurations\":\"array\",\"AggregationConfigurations[]\":\"object\",\"AggregationConfigurations[].Templates\":\"array\",\"EventSelectors\":\"array\",\"EventSelectors[]\":\"object\",\"EventSelectors[].DataResources\":\"array\",\"EventSelectors[].DataResources[]\":\"object\",\"EventSelectors[].DataResources[].Values\":\"array\",\"EventSelectors[].ExcludeManagementEventSources\":\"array\",\"InsightSelectors\":\"array\",\"InsightSelectors[]\":\"object\",\"InsightSelectors[].EventCategories\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
-	["AWS::CloudWatch::Alarm", "{\"AlarmActions\":\"array\",\"Dimensions\":\"array\",\"Dimensions[]\":\"object\",\"EvaluationCriteria\":\"object\",\"EvaluationCriteria.PromQLCriteria\":\"object\",\"EvaluationWindow\":\"object\",\"EvaluationWindow.SlidingWindow\":\"object\",\"EvaluationWindow.WallClockWindow\":\"object\",\"InsufficientDataActions\":\"array\",\"Metrics\":\"array\",\"Metrics[]\":\"object\",\"Metrics[].MetricStat\":\"object\",\"Metrics[].MetricStat.Metric\":\"object\",\"Metrics[].MetricStat.Metric.Dimensions\":\"array\",\"Metrics[].MetricStat.Metric.Dimensions[]\":\"object\",\"OKActions\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"WarmUpConfiguration\":\"object\"}"],
+	["AWS::CloudWatch::Alarm", "{\"ActionConfiguration\":\"object\",\"ActionConfiguration.AlarmTagsPropagation\":\"object\",\"ActionConfiguration.AlarmTagsPropagation.ExcludedTagKeys\":\"array\",\"ActionConfiguration.AlarmTagsPropagation.IncludedTagKeys\":\"array\",\"AlarmActions\":\"array\",\"Dimensions\":\"array\",\"Dimensions[]\":\"object\",\"EvaluationCriteria\":\"object\",\"EvaluationCriteria.PromQLCriteria\":\"object\",\"EvaluationWindow\":\"object\",\"EvaluationWindow.SlidingWindow\":\"object\",\"EvaluationWindow.WallClockWindow\":\"object\",\"InsufficientDataActions\":\"array\",\"Metrics\":\"array\",\"Metrics[]\":\"object\",\"Metrics[].MetricStat\":\"object\",\"Metrics[].MetricStat.Metric\":\"object\",\"Metrics[].MetricStat.Metric.Dimensions\":\"array\",\"Metrics[].MetricStat.Metric.Dimensions[]\":\"object\",\"OKActions\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"WarmUpConfiguration\":\"object\"}"],
 	["AWS::CodeCommit::Repository", "{\"Code\":\"object\",\"Code.S3\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"Triggers\":\"array\",\"Triggers[]\":\"object\",\"Triggers[].Branches\":\"array\",\"Triggers[].Events\":\"array\"}"],
 	["AWS::Cognito::UserPool", "{\"AccountRecoverySetting\":\"object\",\"AccountRecoverySetting.RecoveryMechanisms\":\"array\",\"AccountRecoverySetting.RecoveryMechanisms[]\":\"object\",\"AdminCreateUserConfig\":\"object\",\"AdminCreateUserConfig.InviteMessageTemplate\":\"object\",\"AliasAttributes\":\"array\",\"AutoVerifiedAttributes\":\"array\",\"DeviceConfiguration\":\"object\",\"EmailConfiguration\":\"object\",\"EnabledMfas\":\"array\",\"IssuerConfiguration\":\"object\",\"KeyConfiguration\":\"object\",\"LambdaConfig\":\"object\",\"LambdaConfig.CustomEmailSender\":\"object\",\"LambdaConfig.CustomSMSSender\":\"object\",\"LambdaConfig.InboundFederation\":\"object\",\"LambdaConfig.PreTokenGenerationConfig\":\"object\",\"Policies\":\"object\",\"Policies.PasswordPolicy\":\"object\",\"Policies.SignInPolicy\":\"object\",\"Policies.SignInPolicy.AllowedFirstAuthFactors\":\"array\",\"Schema\":\"array\",\"Schema[]\":\"object\",\"Schema[].NumberAttributeConstraints\":\"object\",\"Schema[].StringAttributeConstraints\":\"object\",\"SmsConfiguration\":\"object\",\"SmsConfiguration.EumsSms\":\"object\",\"UserAttributeUpdateSettings\":\"object\",\"UserAttributeUpdateSettings.AttributesRequireVerificationBeforeUpdate\":\"array\",\"UserPoolAddOns\":\"object\",\"UserPoolAddOns.AdvancedSecurityAdditionalFlows\":\"object\",\"UserPoolTags\":\"object\",\"UsernameAttributes\":\"array\",\"UsernameConfiguration\":\"object\",\"VerificationMessageTemplate\":\"object\"}"],
 	["AWS::DLM::LifecyclePolicy", "{\"CrossRegionCopyTargets\":\"array\",\"CrossRegionCopyTargets[]\":\"object\",\"Exclusions\":\"object\",\"Exclusions.ExcludeTags\":\"array\",\"Exclusions.ExcludeTags[]\":\"object\",\"Exclusions.ExcludeVolumeTypes\":\"array\",\"PolicyDetails\":\"object\",\"PolicyDetails.Actions\":\"array\",\"PolicyDetails.Actions[]\":\"object\",\"PolicyDetails.Actions[].CrossRegionCopy\":\"array\",\"PolicyDetails.Actions[].CrossRegionCopy[]\":\"object\",\"PolicyDetails.Actions[].CrossRegionCopy[].EncryptionConfiguration\":\"object\",\"PolicyDetails.Actions[].CrossRegionCopy[].RetainRule\":\"object\",\"PolicyDetails.CrossRegionCopyTargets\":\"array\",\"PolicyDetails.CrossRegionCopyTargets[]\":\"object\",\"PolicyDetails.EventSource\":\"object\",\"PolicyDetails.EventSource.Parameters\":\"object\",\"PolicyDetails.EventSource.Parameters.SnapshotOwner\":\"array\",\"PolicyDetails.Exclusions\":\"object\",\"PolicyDetails.Exclusions.ExcludeTags\":\"array\",\"PolicyDetails.Exclusions.ExcludeTags[]\":\"object\",\"PolicyDetails.Exclusions.ExcludeVolumeTypes\":\"array\",\"PolicyDetails.Parameters\":\"object\",\"PolicyDetails.Parameters.ExcludeDataVolumeTags\":\"array\",\"PolicyDetails.Parameters.ExcludeDataVolumeTags[]\":\"object\",\"PolicyDetails.ResourceLocations\":\"array\",\"PolicyDetails.ResourceTypes\":\"array\",\"PolicyDetails.Schedules\":\"array\",\"PolicyDetails.Schedules[]\":\"object\",\"PolicyDetails.Schedules[].ArchiveRule\":\"object\",\"PolicyDetails.Schedules[].ArchiveRule.RetainRule\":\"object\",\"PolicyDetails.Schedules[].ArchiveRule.RetainRule.RetentionArchiveTier\":\"object\",\"PolicyDetails.Schedules[].CreateRule\":\"object\",\"PolicyDetails.Schedules[].CreateRule.Scripts\":\"array\",\"PolicyDetails.Schedules[].CreateRule.Scripts[]\":\"object\",\"PolicyDetails.Schedules[].CreateRule.Scripts[].Stages\":\"array\",\"PolicyDetails.Schedules[].CreateRule.Times\":\"array\",\"PolicyDetails.Schedules[].CrossRegionCopyRules\":\"array\",\"PolicyDetails.Schedules[].CrossRegionCopyRules[]\":\"object\",\"PolicyDetails.Schedules[].CrossRegionCopyRules[].DeprecateRule\":\"object\",\"PolicyDetails.Schedules[].CrossRegionCopyRules[].RetainRule\":\"object\",\"PolicyDetails.Schedules[].DeprecateRule\":\"object\",\"PolicyDetails.Schedules[].FastRestoreRule\":\"object\",\"PolicyDetails.Schedules[].FastRestoreRule.AvailabilityZoneIds\":\"array\",\"PolicyDetails.Schedules[].FastRestoreRule.AvailabilityZones\":\"array\",\"PolicyDetails.Schedules[].RetainRule\":\"object\",\"PolicyDetails.Schedules[].ShareRules\":\"array\",\"PolicyDetails.Schedules[].ShareRules[]\":\"object\",\"PolicyDetails.Schedules[].ShareRules[].TargetAccounts\":\"array\",\"PolicyDetails.Schedules[].TagsToAdd\":\"array\",\"PolicyDetails.Schedules[].TagsToAdd[]\":\"object\",\"PolicyDetails.Schedules[].VariableTags\":\"array\",\"PolicyDetails.Schedules[].VariableTags[]\":\"object\",\"PolicyDetails.TargetTags\":\"array\",\"PolicyDetails.TargetTags[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
@@ -33442,9 +33623,7 @@ function stateKeySecretExposure(key, secrets) {
 	return secretsPresentIn(key, secrets);
 }
 function maskEveryOccurrence(text, exposure) {
-	let out = text;
-	for (const value of Array.from(exposure.keys()).sort((a, b) => b.length - a.length)) out = out.split(value).join("***");
-	return out;
+	return maskMatchSpans(text, Array.from(exposure.keys()).filter((value) => value !== ""), "***");
 }
 
 //#endregion
@@ -34723,7 +34902,7 @@ var ReplayPins = class {
 function refuseMaskedReplayBaseline(props, logicalId, inert = []) {
 	if (props === void 0 || !carriesSecretMask(props)) return;
 	if (inert.length > 0 && masksOnlyAt(props, inert)) return;
-	throw new CdkdError(`Cannot roll ${shownLogicalId(logicalId)} back: its recorded baseline holds the redaction mask ('${"***"}'), so cdkd would write that literal to the live resource. There are four ways a baseline comes to hold it. (1) A NoEcho custom-resource value was resolved there: restore the property with 'cdkd deploy' AFTER forcing that custom resource to update (change one of its properties, e.g. a nonce), so its handler runs again and supplies the real value — an ordinary re-deploy leaves the resource unchanged, so the handler does not run and the mask stays. (2) The Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records: restore the property with a 'cdkd deploy' that changes this resource, which sends it the encoded value again — a re-deploy that leaves this resource unchanged sends it nothing. Every rollback to such a baseline refuses, so to end this, stop encoding the secret into the property (have the resource read the secret at run time instead — not by writing the secret's plaintext into the template, which cdkd would then record in state in the clear). (3) The value was SPLICED from a masked record of ANOTHER resource — by 'cdkd orphan --force', or by 'cdkd import' resolving an Fn::GetAtt or a Ref over a value the Cloud Control fallback had masked. Repair the record that HOLDS the mask ('cdkd import <stack> --resource <logicalId>=<physicalId> --force', granting cloudformation:DescribeType first if the import warned that it could not read the schema), then re-run whichever command wrote this property. (4) A NoEcho template parameter's value, which cdkd stores only as the mask: restore the property with 'cdkd deploy', which sends the parameter's value again. See https://github.com/go-to-k/cdkd/issues/2449.`, "ROLLBACK_REDACTED_BASELINE");
+	throw new CdkdError(`Cannot roll ${shownLogicalId(logicalId)} back: its recorded baseline holds the redaction mask ('${"***"}'), so cdkd would write that literal to the live resource. There are five ways a baseline comes to hold it. (1) A NoEcho custom-resource value was resolved there: restore the property with 'cdkd deploy' AFTER forcing that custom resource to update (change one of its properties, e.g. a nonce), so its handler runs again and supplies the real value — an ordinary re-deploy leaves the resource unchanged, so the handler does not run and the mask stays. (2) The Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records: restore the property with a 'cdkd deploy' that changes this resource, which sends it the encoded value again — a re-deploy that leaves this resource unchanged sends it nothing. Every rollback to such a baseline refuses, so to end this, stop encoding the secret into the property (have the resource read the secret at run time instead — not by writing the secret's plaintext into the template, which cdkd would then record in state in the clear). (3) The value was SPLICED from a masked record of ANOTHER resource — by 'cdkd orphan --force', or by 'cdkd import' resolving an Fn::GetAtt or a Ref over a value the Cloud Control fallback had masked. Repair the record that HOLDS the mask ('cdkd import <stack> --resource <logicalId>=<physicalId> --force', granting cloudformation:DescribeType first if the import warned that it could not read the schema), then re-run whichever command wrote this property. (4) A NoEcho template parameter's value, which cdkd stores only as the mask: restore the property with 'cdkd deploy', which sends the parameter's value again. (5) Two secret values cdkd resolved overlap inside the value, so no single {{resolve:...}} reference renders it and cdkd stored the mask rather than part of a secret: restore the property with a 'cdkd deploy' that changes this resource, which sends it the value again. Every rollback to such a baseline refuses while the two values still overlap there, so to end this, change the property (or rotate one of the secrets) so that they no longer overlap. See https://github.com/go-to-k/cdkd/issues/2449.`, "ROLLBACK_REDACTED_BASELINE");
 }
 
 //#endregion
@@ -38357,7 +38536,7 @@ function refuseRedactedAttributeReads(logicalId, resourceType, context) {
 		const producers = [...new Set(reads.map((read) => read.logicalId).filter((id) => !!id))];
 		throw new ProvisioningError(safeMsg`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: ` + safeMsg`${producers.map((id) => displayIdent(id)).join(", ")} declared ${reads.length === 1 ? "that attribute" : "those attributes"} NoEcho, ` + safeMsg`so cdkd's recorded state holds only the redaction mask for ${reads.length === 1 ? "it" : "them"}, ` + `and cdkd does not re-run a producer to recover a value. Remedy: deploy a change to the ` + safeMsg`producer in the SAME run as ${logicalId} (for a custom resource, change one of its ` + "properties, e.g. a nonce / version property, so its handler runs again and supplies the value), or stop declaring the value NoEcho.", resourceType, logicalId);
 	}
-	throw new ProvisioningError(safeMsg`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the ` + `redaction mask there, and the value is not recoverable from state. There are three ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all, or cdkd deploy '**' when either is inside a CDK Stage) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The value holds the Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records — so a deploy that leaves the resource or output holding it unchanged reads the mask again, and a re-import does not recover it. Remedy: have this resource build the value itself from the SECRET's own reference (the {{resolve:secretsmanager:...}} or {{resolve:ssm-secure:...}} reference, or a {{resolve:ssm:...}} of a SecureString parameter, that the encoding was made from) under its own Fn::Base64, instead of reading it from another resource's attribute or another stack's output — not by a {{resolve:ssm:...}} read of a String parameter holding the encoding, which cdkd treats as public and would record in state in the clear. (3) The resource is recorded through the Cloud Control fallback (by a deploy or by 'cdkd import'), which keeps in the clear only the Fn::GetAtt attributes it can vouch for and masks the rest. If the name above is not an Fn::GetAtt attribute CloudFormation accepts for that resource type, no record will ever hold it: stop reading it. If it is one, 'cdkd import' masked it because it could not vouch for the value, or could not read the schema and warned about it when it happened (if that warning named a missing cloudformation:DescribeType permission, grant it first); a deploy that creates or updates the resource records it, unless its value came from a secret. See https://github.com/go-to-k/cdkd/issues/2449. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources, true)}`, resourceType, logicalId);
+	throw new ProvisioningError(safeMsg`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the ` + `redaction mask there, and the value is not recoverable from state. There are four ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all, or cdkd deploy '**' when either is inside a CDK Stage) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The value holds the Fn::Base64 encoding of a secret value (a {{resolve:...}} dynamic reference under Fn::Base64, such as EC2 UserData), which cdkd never records — so a deploy that leaves the resource or output holding it unchanged reads the mask again, and a re-import does not recover it. Remedy: have this resource build the value itself from the SECRET's own reference (the {{resolve:secretsmanager:...}} or {{resolve:ssm-secure:...}} reference, or a {{resolve:ssm:...}} of a SecureString parameter, that the encoding was made from) under its own Fn::Base64, instead of reading it from another resource's attribute or another stack's output — not by a {{resolve:ssm:...}} read of a String parameter holding the encoding, which cdkd treats as public and would record in state in the clear. (3) The resource is recorded through the Cloud Control fallback (by a deploy or by 'cdkd import'), which keeps in the clear only the Fn::GetAtt attributes it can vouch for and masks the rest. If the name above is not an Fn::GetAtt attribute CloudFormation accepts for that resource type, no record will ever hold it: stop reading it. If it is one, 'cdkd import' masked it because it could not vouch for the value, or could not read the schema and warned about it when it happened (if that warning named a missing cloudformation:DescribeType permission, grant it first); a deploy that creates or updates the resource records it, unless its value came from a secret. (4) Two secret values cdkd resolved overlap inside the value, so no single {{resolve:...}} reference renders it and cdkd stored the mask rather than part of a secret: change the producer's value (or rotate one of the secrets) so that they no longer overlap, and deploy the producer in the same run as this resource. See https://github.com/go-to-k/cdkd/issues/2449. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources, true)}`, resourceType, logicalId);
 }
 function allRecordedSecrets() {
 	const all = /* @__PURE__ */ new Map();
@@ -38838,23 +39017,75 @@ function createReadOnlyAttributeHealerFactory(options) {
 }
 
 //#endregion
-//#region src/deployment/deploy-engine/heal.ts
-function healStaleAttributes(logicalId, resource, stackName) {
-	if (!this.isHealEligible(logicalId, resource)) return Promise.resolve({ kind: "not-attempted" });
-	const key = injectiveKey(logicalId, resource.physicalId);
-	const inFlight = this.attributeHeals.get(key);
-	if (inFlight) return inFlight;
-	const heal = this.readStaleAttributes(logicalId, resource, stackName).catch((error) => ({
-		kind: "failed",
-		error
-	}));
-	this.attributeHeals.set(key, heal);
-	return heal;
-}
-function isHealEligible(logicalId, resource) {
-	const loaded = Object.hasOwn(this.healBaseline, logicalId) ? this.healBaseline[logicalId] : void 0;
-	return loaded !== void 0 && loaded.physicalId === resource.physicalId && loaded.attributes === resource.attributes && !isHealExcludedType(resource.resourceType);
-}
+//#region src/deployment/deploy-engine/attribute-healer.ts
+var AttributeHealer = class {
+	heals = /* @__PURE__ */ new Map();
+	healed = /* @__PURE__ */ new Map();
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	get baseline() {
+		return this.deps.baseline;
+	}
+	heal(logicalId, resource, stackName) {
+		if (!this.isEligible(logicalId, resource)) return Promise.resolve({ kind: "not-attempted" });
+		const key = injectiveKey(logicalId, resource.physicalId);
+		const inFlight = this.heals.get(key);
+		if (inFlight) return inFlight;
+		const heal = this.read(logicalId, resource, stackName).catch((error) => ({
+			kind: "failed",
+			error
+		}));
+		this.heals.set(key, heal);
+		return heal;
+	}
+	isEligible(logicalId, resource) {
+		const { baseline } = this.deps;
+		const loaded = Object.hasOwn(baseline, logicalId) ? baseline[logicalId] : void 0;
+		return loaded !== void 0 && loaded.physicalId === resource.physicalId && loaded.attributes === resource.attributes && !isHealExcludedType(resource.resourceType);
+	}
+	async read(logicalId, resource, stackName) {
+		const { provider } = this.deps.providerRegistry.getProviderFor({
+			resourceType: resource.resourceType,
+			properties: resource.properties,
+			provisionedBy: resource.provisionedBy,
+			previousProperties: resource.properties
+		});
+		const outcome = await withPrintingSecrets(healPrintingBag(this.deps.baseline, logicalId, resource), () => readRecordAttributes({
+			provider,
+			logicalId,
+			resource,
+			stackName,
+			region: this.deps.stackRegion
+		}));
+		if (outcome.kind !== "read") return outcome;
+		const { attributes } = outcome;
+		if (Object.keys(attributes).length > 0) this.healed.set(logicalId, {
+			physicalId: resource.physicalId,
+			resourceType: resource.resourceType,
+			attributes
+		});
+		this.deps.logger.debug(safeMsg`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS — its state record lacked one a Fn::GetAtt asked for: ${Object.keys(attributes).length} attribute(s) read`);
+		return outcome;
+	}
+	withHealedAttributes(logicalId, record) {
+		const healed = this.healed.get(logicalId);
+		if (healed === void 0 || healed.physicalId !== record.physicalId || healed.resourceType !== record.resourceType || !this.isEligible(logicalId, record)) return record;
+		const merged = mergeHealedAttributes(record.attributes, healed.attributes, (key, value, healedValue) => isStalePlaceholderArnAttribute(record.resourceType, key, value) || isMaskedOwnIdCopy(record, key, value, healedValue, this.deps.resolvedSecretsOf(logicalId)));
+		return merged === record.attributes || merged === void 0 ? record : {
+			...record,
+			attributes: merged
+		};
+	}
+	hasUnpersistedHeals(resources) {
+		for (const logicalId of this.healed.keys()) {
+			const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
+			if (record !== void 0 && this.withHealedAttributes(logicalId, record) !== record) return true;
+		}
+		return false;
+	}
+};
 const healJudges = /* @__PURE__ */ new WeakMap();
 function healPrintingBag(baseline, logicalId, resource) {
 	if (!Object.hasOwn(baseline, logicalId) || baseline[logicalId] !== resource) return secretNamePrintingBag(logicalId, {
@@ -38868,46 +39099,6 @@ function healPrintingBag(baseline, logicalId, resource) {
 	}
 	return judge(logicalId);
 }
-async function readStaleAttributes(logicalId, resource, stackName) {
-	const { provider } = this.providerRegistry.getProviderFor({
-		resourceType: resource.resourceType,
-		properties: resource.properties,
-		provisionedBy: resource.provisionedBy,
-		previousProperties: resource.properties
-	});
-	const outcome = await withPrintingSecrets(healPrintingBag(this.healBaseline, logicalId, resource), () => readRecordAttributes({
-		provider,
-		logicalId,
-		resource,
-		stackName,
-		region: this.stackRegion
-	}));
-	if (outcome.kind !== "read") return outcome;
-	const { attributes } = outcome;
-	if (Object.keys(attributes).length > 0) this.healedAttributes.set(logicalId, {
-		physicalId: resource.physicalId,
-		resourceType: resource.resourceType,
-		attributes
-	});
-	this.logger.debug(safeMsg`Re-read the attributes of ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) from AWS — its state record lacked one a Fn::GetAtt asked for: ${Object.keys(attributes).length} attribute(s) read`);
-	return outcome;
-}
-function withHealedAttributes(logicalId, record) {
-	const healed = this.healedAttributes.get(logicalId);
-	if (healed === void 0 || healed.physicalId !== record.physicalId || healed.resourceType !== record.resourceType || !this.isHealEligible(logicalId, record)) return record;
-	const merged = mergeHealedAttributes(record.attributes, healed.attributes, (key, value, healedValue) => isStalePlaceholderArnAttribute(record.resourceType, key, value) || isMaskedOwnIdCopy(record, key, value, healedValue, this.perResourceSecrets.get(logicalId)));
-	return merged === record.attributes || merged === void 0 ? record : {
-		...record,
-		attributes: merged
-	};
-}
-function hasUnpersistedHeals(resources) {
-	for (const logicalId of this.healedAttributes.keys()) {
-		const record = Object.hasOwn(resources, logicalId) ? resources[logicalId] : void 0;
-		if (record !== void 0 && this.withHealedAttributes(logicalId, record) !== record) return true;
-	}
-	return false;
-}
 
 //#endregion
 //#region src/deployment/deploy-engine/record-shape.ts
@@ -39047,7 +39238,7 @@ function buildResolverContext(base, stackName) {
 		...this.exportIndexStore && { exportIndex: this.exportIndexStore },
 		recordedImports: this.recordedImports,
 		recordedOutputReads: this.recordedOutputReads,
-		attributeHealer: (logicalId, resource) => this.healStaleAttributes(logicalId, resource, stackName),
+		attributeHealer: (logicalId, resource) => this.attributeHealer.heal(logicalId, resource, stackName),
 		...this.options.inheritedSecrets && hasMaskableValues(this.options.inheritedSecrets) && { inheritedSecrets: this.options.inheritedSecrets },
 		...this.options.inheritedPhysicalNameCopies && { inheritedPhysicalNameCopies: this.options.inheritedPhysicalNameCopies },
 		...this.options.inheritedReferenceProvenance && { inheritedReferenceProvenance: this.options.inheritedReferenceProvenance },
@@ -39706,7 +39897,7 @@ var DynamoDBGlobalTableProvider = class {
 				warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the state record declares no BillingMode, so this replay creates the table PAY_PER_REQUEST. If it was PROVISIONED, set the mode in the template and redeploy.`);
 			}
 		} catch (error) {
-			throw new ProvisioningError(log.mask(error instanceof Error ? error.message : String(error)), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			throw new ProvisioningError(log.mask(describeAwsFailure(error).detail), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 		}
 		const currentRegion = await this.dynamoDBClient.config.region() ?? "";
 		const replicas = properties["Replicas"] ?? [];
@@ -39736,7 +39927,7 @@ var DynamoDBGlobalTableProvider = class {
 					replayDowngrade(message);
 				} } : {});
 			} catch (error) {
-				throw new ProvisioningError(log.mask(error instanceof Error ? error.message : String(error)), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+				throw new ProvisioningError(log.mask(describeAwsFailure(error).detail), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 			}
 			createParams.StreamSpecification = {
 				StreamEnabled: true,
@@ -39767,7 +39958,7 @@ var DynamoDBGlobalTableProvider = class {
 				onUnusableCreateIndexes(`${message} Omitting the malformed block, so this create carries NO indexes; the same value is REFUSED on a template-path create`);
 			}), maskSecrets);
 		} catch (error) {
-			throw new ProvisioningError(log.mask(error instanceof Error ? error.message : String(error)), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			throw new ProvisioningError(log.mask(describeAwsFailure(error).detail), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 		}
 		let wiringProperties = properties;
 		if (indexesOmitted) {
@@ -40413,7 +40604,7 @@ var DynamoDBGlobalTableProvider = class {
 					try {
 						await this.dynamoDBClient.send(cmd);
 					} catch (ttlErr) {
-						if ((ttlErr instanceof Error ? ttlErr.message : String(ttlErr)).includes("Time to live has been modified multiple times")) throw this.wrapMaskedError(log, ttlErr, (text) => new ProvisioningError(`AWS rejected TimeToLive update on ${log.value(physicalId)}: ${text}. AWS enforces a ~4-hour rate limit on TTL changes per table; wait and redeploy, or keep the previous TTL state in this deploy.`, resourceType, logicalId, physicalId, ttlErr instanceof Error ? ttlErr : void 0));
+						if (describeAwsFailure(ttlErr).detail.includes("Time to live has been modified multiple times")) throw this.wrapMaskedError(log, ttlErr, (text) => new ProvisioningError(`AWS rejected TimeToLive update on ${log.value(physicalId)}: ${text}. AWS enforces a ~4-hour rate limit on TTL changes per table; wait and redeploy, or keep the previous TTL state in this deploy.`, resourceType, logicalId, physicalId, ttlErr instanceof Error ? ttlErr : void 0));
 						throw ttlErr;
 					}
 				};
@@ -40860,7 +41051,7 @@ var DynamoDBGlobalTableProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete DynamoDB GlobalTable ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to delete DynamoDB GlobalTable ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async isSameResource(journaledPhysicalId, record, resourceType, context) {
@@ -44130,6 +44321,23 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		const repaired = repairEmbeddedPhysicalNamesTowards(repairPhysicalNameCopyLeaves(bag[key], legacyDesired[key], desiredForSkipCheck[key]), desiredForSkipCheck[key], embeddedRewrites);
 		if (repaired !== bag[key]) bag[key] = repaired;
 	}
+	if (overlapRuleAnswered(updateSecrets)) {
+		const legacyOverlapBag = withLegacyOverlapScan(updateSecrets, () => maskAtCoordinates(redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps), comparisonCoordinates));
+		const legacyOverlap = legacyReferenceLeavesOnly(legacyOverlapBag);
+		for (const bag of new Set(repairable)) for (const key of Object.keys(bag)) {
+			const repaired = repairPhysicalNameCopyLeaves(bag[key], legacyOverlap[key], desiredForSkipCheck[key]);
+			if (repaired !== bag[key]) bag[key] = repaired;
+		}
+		const pairs = differingStringLeaves(legacyOverlap, desiredForSkipCheck);
+		for (const field of ["attributes", "observedProperties"]) {
+			const target = currentResource[field];
+			if (target === void 0 || target === null || pairs.length === 0) continue;
+			for (const key of Object.keys(target)) {
+				const repaired = replaceWholeLeaves(target[key], pairs);
+				if (repaired !== target[key]) target[key] = repaired;
+			}
+		}
+	}
 	const attributes = currentResource.attributes;
 	if (attributes !== void 0 && attributes !== null && embeddedRewrites.length > 0) for (const key of Object.keys(attributes)) {
 		const repaired = replaceEmbeddedPhysicalNameRewrites(attributes[key], embeddedRewrites);
@@ -47513,7 +47721,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			lastModified: Date.now()
 		};
 		const currentEtag = currentStateData?.etag;
-		this.healBaseline = currentState.resources ?? {};
+		this.rebaseline(currentState.resources ?? {});
 		this.runProducerRegionEvidence = () => this.producerRegionEvidence(currentState);
 		refuseMalformedOutputs(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
 		refuseMalformedResourcesForDeploy(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
@@ -47761,7 +47969,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 				if (merge?.kind === "kept" && !outputMapsEqual(persistedOutputs, resolvedOutputs)) this.logger.warn(safeMsg`Outputs changed but one or more could not be resolved; keeping the previously persisted outputs. ${keptWholeReasonText(merge.reason)} ` + "A downstream Fn::ImportValue may fail until the next deploy.");
 				else if (merge?.kind === "merged" && merge.carriedKeys.length > 0) this.logger.debug(safeMsg`Kept the previously persisted value of ${merge.carriedKeys.length} output key(s), ` + "carried export aliases included, that could not be resolved (no-change path)");
 				const skippedOutputsChanged = !skippedOutputsEqual(currentState.skippedOutputs, this.skippedOutputs);
-				const healedAttributesPending = this.hasUnpersistedHeals(currentState.resources);
+				const healedAttributesPending = this.attributeHealer.hasUnpersistedHeals(currentState.resources);
 				const conditionVerdictsChanged = !conditionVerdictRecordsEqual(readRecordedConditionVerdicts(currentState), conditionVerdicts);
 				if (outputsChanged || exportSetChanged && currentState.exportNames !== void 0) await requireOutputsOnlyApproval({
 					options: this.options,
@@ -48226,14 +48434,15 @@ var DeployEngine = class {
 	resolvedOutputsBag = void 0;
 	provenanceCaptureTasks = /* @__PURE__ */ new Map();
 	oldDeletedBeforeCreate = /* @__PURE__ */ new Set();
-	healBaseline = {};
+	get healBaseline() {
+		return this.attributeHealer.baseline;
+	}
 	runProducerRegionEvidence = void 0;
 	deployChanges = /* @__PURE__ */ new Map();
 	deployStateResources = {};
 	stackRecordsView = void 0;
 	inlinePolicyWriters = /* @__PURE__ */ new Map();
-	attributeHeals = /* @__PURE__ */ new Map();
-	healedAttributes = /* @__PURE__ */ new Map();
+	attributeHealer;
 	stackRegion;
 	constructor(stateBackend, lockManager, dagBuilder, diffCalculator, providerRegistry, options = {}, stackRegion, exportIndexStore) {
 		this.stateBackend = stateBackend;
@@ -48257,6 +48466,17 @@ var DeployEngine = class {
 		this.options.resourceWarnAfterMs = options.resourceWarnAfterMs ?? 3e5;
 		this.options.resourceTimeoutMs = options.resourceTimeoutMs ?? 18e5;
 		this.options.captureObservedState = options.captureObservedState ?? true;
+		this.attributeHealer = this.rebaseline({});
+	}
+	rebaseline(resources) {
+		this.attributeHealer = new AttributeHealer({
+			providerRegistry: this.providerRegistry,
+			stackRegion: this.stackRegion,
+			logger: this.logger,
+			baseline: resources,
+			resolvedSecretsOf: (logicalId) => this.perResourceSecrets.get(logicalId)
+		});
+		return this.attributeHealer;
 	}
 	async deploy(stackName, template) {
 		this.recordedImports = [];
@@ -48304,13 +48524,11 @@ var DeployEngine = class {
 		this.resolvedOutputsBag = void 0;
 		this.provenanceCaptureTasks = /* @__PURE__ */ new Map();
 		this.oldDeletedBeforeCreate = /* @__PURE__ */ new Set();
-		this.healBaseline = {};
+		this.rebaseline({});
 		this.runProducerRegionEvidence = void 0;
 		this.deployChanges = /* @__PURE__ */ new Map();
 		this.deployStateResources = {};
 		this.inlinePolicyWriters = /* @__PURE__ */ new Map();
-		this.attributeHeals = /* @__PURE__ */ new Map();
-		this.healedAttributes = /* @__PURE__ */ new Map();
 		this.resolver.resetPhysicalIdFallbackCount();
 		const ledger = ledgerForStack(this.stateBackend, stackName, this.stackRegion);
 		return withStackName(stackName, () => this.options.dryRun ? this.doDeploy(stackName, template) : withCreateTokenLedger(ledger, () => this.doDeploy(stackName, template)));
@@ -48321,7 +48539,7 @@ var DeployEngine = class {
 		for (const [logicalId, record] of Object.entries(state.resources)) {
 			const secrets = this.perResourceSecrets.get(logicalId);
 			const templateProps = this.perResourceTemplateProps.get(logicalId);
-			const scrubbed = scrubResourceRecord(this.withHealedAttributes(logicalId, record), secrets ?? /* @__PURE__ */ new Map(), templateProps);
+			const scrubbed = scrubResourceRecord(this.attributeHealer.withHealedAttributes(logicalId, record), secrets ?? /* @__PURE__ */ new Map(), templateProps);
 			const noEchoScrubbed = this.applyNoEchoPersist(logicalId, record, this.withNoEchoExactEchoes(logicalId, scrubbed), templateProps, state.resources, secrets);
 			resources[logicalId] = withReferenceProvenance(withConstructPath(withMaskedPropertyFingerprints(noEchoScrubbed, record.properties, templateProps, secrets, this.fingerprintNoEchoValues, this.perResourceInputFingerprints.get(logicalId)), constructPathOf(this.constructPathTemplate, logicalId)), this.referenceProvenanceToPersist(logicalId, record, noEchoScrubbed, secrets));
 		}
@@ -48498,11 +48716,6 @@ DeployEngine.prototype.provisionUpdate = provisionUpdate;
 DeployEngine.prototype.updateByReplacement = updateByReplacement;
 DeployEngine.prototype.updateInPlace = updateInPlace;
 DeployEngine.prototype.provisionCreate = provisionCreate;
-DeployEngine.prototype.healStaleAttributes = healStaleAttributes;
-DeployEngine.prototype.isHealEligible = isHealEligible;
-DeployEngine.prototype.readStaleAttributes = readStaleAttributes;
-DeployEngine.prototype.withHealedAttributes = withHealedAttributes;
-DeployEngine.prototype.hasUnpersistedHeals = hasUnpersistedHeals;
 DeployEngine.prototype.replacementDeleteContext = replacementDeleteContext;
 DeployEngine.prototype.prepareFinalSnapshotForDelete = prepareFinalSnapshotForDelete;
 DeployEngine.prototype.replaceDeleteFirstAndRecreate = replaceDeleteFirstAndRecreate;
@@ -48565,5 +48778,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { S3_AUTO_DELETE_OBJECTS_TAG as $, unpreviewableOrphanRecords as $a, stripControlChars as $c, hasReadableOutputs as $i, unsupportedFinalSnapshotError as $n, carryLogOnlyValues as $o, poisonRenderedSpellingsCollidingIn as $r, crossPrefixDeniedWarning as $s, isJournaledOrphan as $t, diffSecurity as A, refuseMalformedOutputs as Aa, readBootstrapMarkerBody as Ac, isImpossibleEmptyStoredAttribute as Ai, StageLoadError as Al, collectPublishedOutputNames as An, prefetchCreateOnlyPropertyPaths as Ao, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Ar, recordPhysicalNameCopy as As, NESTED_PENDING_PARENT_REASON as At, readProtection as B, refuseMalformedResourcePropertiesForDrift as Ba, finchSecretArgvRefusal as Bc, withSharedDrainBudget as Bi, renderAssemblyPathEscape as Bl, secretNamePrintingBags as Bn, isMarkedCoordinate as Bo, deleteSkipReason as Br, STATE_SOURCED_BASELINE_RULES as Bs, collectNestedChildUnaddressed as Bt, withApiLimit as C, refuseDivergentRecordRegionForDestroy as Ca, AssetModeResolver as Cc, classifyReplaySecretRegion as Ci, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Cl, secretSafeKeyDisplay as Cn, configIntegerRefusal as Co, isCustomResource as Cr, pathCrossesDottedKey as Cs, dropFailedCommands as Ct, findServiceTokenRefusals as D, refuseMalformedOrphans as Da, getBootstrapMarkerKey as Dc, isUnboundTemplateParameter as Di, canonicalizeRegion as Dl, isWholeDynamicReferenceValue as Dn, requireConfigArray as Do, isCustomResourceType as Dr, recoverMaskedOutput as Ds, loadJournaledOrphans as Dt, deferredServiceTokenWarning as E, refuseMalformedOrphanRecordsForDestroy as Ea, ensureAssetStorage as Ec, coerceParameterTypedValue as Ei, PARTITION_TABLE as El, exportNameSecretExposure as En, replayWarn as Eo, readsNoEchoDeleteValues as Er, recordNestedStackParameterExpressions as Es, journaledOrphanLines as Et, recordedProtectionEvidence as F, refuseMalformedResourceEntriesForDestroy as Fa, resolveDockerContextDirectory as Fc, AWS_NO_VALUE as Fi, nullPrototypeRecord as Fl, completedReplayEntries as Fn, lambdaFunctionNameForMask as Fo, unchangedBehindSecretReference as Fr, recordMaskOnlyValuesIn as Fs, nestedChildStackName as Ft, deleteBudgetKey as G, refuseMalformedResourcesForExport as Ga, partitionSensitiveEnv as Gc, STATE_REGION_DIVERGED as Gi, resolveBucketRegion as Gl, ATOMIC_FINAL_SNAPSHOT_TYPES as Gn, noEchoCoordinatesOf as Go, ec2InstanceProtectionSite as Gr, isSingleDynamicReferenceToken as Gs, awaitInFlightSibling as Gt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as H, refuseMalformedResourcePropertiesForOrphan as Ha, getDockerCmd as Hc, passedParameterClassesOf as Hi, injectAwsRegion as Hl, stateSecretNameNeedles as Hn, maskReadbackAtCoordinates as Ho, isWaitAbandonedError as Hr, STATE_SOURCED_READBACK_RULES as Hs, withNestedStackContext as Ht, recordedProtectionNote as I, refuseMalformedResourceEntriesForImport as Ia, describeDockerCapturedOutput as Ic, cfnRefValueFromPhysicalId as Ii, ownValue as Il, journaledOrphanPrintingBag as In, sameLambdaFunctionAddress as Io, RollbackInlinePolicyWriters as Ir, recordNoEchoAttributeValues as Is, recordDisplacedSkips as It, DELETE_INDEX_WAIT_PROCEED_NOTE as J, repairMalformedOrphansForReadOnly as Ja, redactedDockerCause as Jc, UNREADABLE_RESOURCES_MAP_ROW as Ji, ccRoutedFinalSnapshotError as Jn, passedNoEchoParametersOf as Jo, reDisableInstanceApiTermination as Jr, S3StateBackend as Js, withStackRecords as Jt, resolveDynamoDbDeleteBudgetClock as K, refuseMalformedState as Ka, redactDockerArgvValues as Kc, STATE_RESOURCES_MALFORMED as Ki, PRE_DELETE_SNAPSHOT_TYPES as Kn, noEchoLeavesOf as Ko, isTerminationProtectionPropagationError as Kr, LockManager as Ks, destroyStackRecordsView as Kt, PROTECTION_PROPERTY_BY_TYPE as L, refuseMalformedResourceEntriesForImportSave as La, describeDockerExecFailure as Lc, isStalePlaceholderArnAttribute as Li, absoluteAssemblyPathEscape as Ll, maskEventTextWithBoundBags as Ln, DagBuilder as Lo, UNSPECIFIED_SKIP_REASON as Lr, recordNoEchoParameterFreshValue as Ls, revertNestedChildFromJournal as Lt, noEchoComparisonForTemplate as M, refuseMalformedResourceAttributesForOrphan as Ma, validateContainerRepoName as Mc, carriesFetchableDynamicReference as Mi, defineOwnKey as Ml, bindingSkippedOutputs as Mn, describeTypeWithThrottleRetry as Mo, customResourceResponseExpirationWarning as Mr, carriesSecretMask as Ms, displacedPhysicalIdShown as Mt, noEchoExactEchoLeavesOf as N, refuseMalformedResourceEntries as Na, buildDenyExternalAccessPolicy as Nc, isNamelessDynamicReferenceError as Ni, hasOwnKey as Nl, DEFAULT_RESOURCE_TIMEOUT_MS as Nn, withRetry as No, CloudControlProvider as Nr, provenPublicValue as Ns, dropSettledNestedJournals as Nt, serviceTokenBlockingReason as O, refuseMalformedOrphansForDestroy as Oa, isCrossRegionRedirect as Oc, parameterTypeMayLoseSecretIdentity as Oi, derivePartitionAndUrlSuffix as Ol, noEchoParameterValueSeed as On, requireConfigObject as Oo, getCurrentResourceSecrets as Or, physicalNameCopiesOf as Os, makeForeignHolderScan as Ot, noEchoParameterNamesOf as P, refuseMalformedResourceEntriesForDeploy as Pa, buildDockerImage as Pc, keepsSecretReferenceToken as Pi, hasPlainPrototype$1 as Pl, DEFAULT_RESOURCE_WARN_AFTER_MS as Pn, canonicalLambdaFunctionName as Po, slowCcOperationTimeoutMs as Pr, recordMaskOnlyValue as Ps, getNestedRevertRun as Pt, ECR_AUTO_DELETE_IMAGES_TAG as Q, repairMalformedResourcesForReadOnly as Qa, escapeRegExp$3 as Qc, hasReadableOrphans as Qi, refusesFinalSnapshot as Qn, liveMatchesUnresolvedTokenFrame as Qo, IntrinsicFunctionResolver as Qr, applyCrossPrefixScan as Qs, demoteSupersededOrphans as Qt, isProtectionValueActive as R, refuseMalformedResourceEntriesForOrphan as Ra, describeDockerFailure as Rc, refStateLookupFromResource as Ri, describeFileReadFailure as Rl, orphanRecordsPrintingBag as Rn, TemplateParser as Ro, deleteIndeterminateGuards as Rr, recordProvenPublicExpression as Rs, revertedNestedRowIds as Rt, lookupEachName as S, previewableOrphanRecords as Sa, rewriteTemplateAssetReferences as Sc, classifyRecordedSecretRegion as Si, uploadCfnTemplate as Sl, secretBearingStateKeyWarning as Sn, configBooleanRefusal as So, ccBrokenReason as Sr, isUncertifiedBaselineMaskPosition as Ss, deleteJournaledOrphans as St, recordRetainedForReadoption as T, refuseMalformedOrphanRecords as Ta, assertAssetBucketRegion as Tc, regionLessSecretName as Ti, expectedOwnerParam as Tl, exportNameNoEchoParameters as Tn, readConfigString as To, TemplateNoEchoReresolver as Tr, inheritNestedStackParameterAssociations as Ts, isHandledOrphan as Tt, beginDeleteWait as U, refuseMalformedResourcesForDeploy as Ua, isDockerClientEnvKey as Uc, declaresNoEcho as Ui, injectedAwsRegionValue as Ul, storedSecretNameNeedles as Un, maskWholeValue as Uo, markWaitAbandoned as Ur, TEMPLATE_SOURCED_RULES as Us, replayFailedOperations as Ut, DynamoDBGlobalTableProvider as V, refuseMalformedResourcePropertiesForExport as Va, formatDockerLoginError as Vc, parameterInputsFor as Vi, resolveAssemblyPath as Vl, secretNamedRecordNeedles as Vn, maskAtCoordinates as Vo, withIndeterminateGuard as Vr, STATE_SOURCED_CROSS_GENERATION_RULES as Vs, getCurrentNestedStackContext as Vt, compensateRemovedDeletionProtection as W, refuseMalformedResourcesForDestroy as Wa, isMalformedEnvKey as Wc, JSON_LISTING_HOLE_VALUE as Wi, clearBucketRegionCache as Wl, extractDeploymentEventError as Wn, maskedLeafCoordinatesOf as Wo, disableInstanceApiTermination as Wr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ws, replayRollback as Wt, deleteTableWithIndexBusyRetry as X, repairMalformedResourceEntriesForReadOnly as Xa, runDockerStreaming as Xc, deployRefusesOrphanRowsReason as Xi, effectiveDeletionPolicy as Xn, readsNoEchoSource as Xo, DiffCalculator as Xr, CrossPrefixReadError as Xs, replacedDeleteFailureVerdict as Xt, INDEX_SETTLE_POLL_INTERVAL_MS as Y, repairMalformedOutputsForReadOnly as Ya, runDockerForeground as Yc, accountArgs as Yi, createPreDeleteFinalSnapshot as Yn, readbackPathFor as Yo, reEnableInstanceApiTermination as Yr, rebuildClientForBucketRegion as Ys, removeProtectionTypeList as Yt, waitForIndexesSettled as Z, repairMalformedResourcePropertiesForReadOnly as Za, warnFinchArgvExposure as Zc, displayLogicalId as Zi, isFinalSnapshotError as Zn, valueAtCoordinate as Zo, INTRINSIC_KEYS as Zr, CrossPrefixScanCache as Zs, recordAfterRollbackUpdate as Zt, keptWholeReasonText as _, malformedResourceEntriesWarning as _a, stringifyValue as _c, s3BucketArn as _i, ssmResolvedValueType as _l, orphanNeedsIdentity as _n, isWarmThroughputDecrease as _o, tagPlanWarning as _r, scrubResourceRecord as _s, planOrphanAdoption as _t, inheritedProvenanceForChildDiff as a, malformedExportSourceWarning as aa, exportNamesCarriedFrom as ac, explicitRoleArnOrThrow as ai, getDefaultStateBucketName as al, replacementNeverSwapped as an, unwrittenCreateOnlyReplacement as ao, ledgerForStack as ar, recordLogOnlyParameterValue as as, createReadOnlyAttributeHealerFactory as at, chunks as b, malformedScrubResourceEntriesRefusalMessage as ba, createAssetRedirectResolver as bc, s3BucketRegionalDomainName as bi, MIGRATE_TMP_PREFIX as bl, exportAliasCollisionScrubWarning as bn, coerceCfnBoolean as bo, CC_BROKEN_REASON as br, DYNAMIC_REFERENCE_TOKEN_SCAN as bs, pendingRequestCount as bt, isAbsoluteAssetPath as c, malformedLocalResourcesWarning as ca, hasUnverifiableParameterRefusal as cc, AWS_CREDENTIAL_ENV_KEYS as ci, resolveApp as cl, findNestedStackTypeChanges as cn, hasNoCloudControlHandlers as co, acquireIdempotencyToken as cr, unionOfSecretBags as cs, gray as ct, templateIdentity as d, malformedOrphanRowsKeptWarning as da, isReadableBag as dc, envCredentialsAreAssumedRole as di, resolveSkipPrefix as dl, REDACTED_DELETE_ADDRESS_SKIP_REASON as dn, MULTI_REGION_RECREATE_BLOCKED_TYPES as do, DBPROXY_TAGS_WHAT as dr, maskSecretsInError as ds, yellow as dt, hasReadableResources as ea, isAccessDenied$1 as ec, producerLookupOver as ei, stripForDisplay as el, isReplacementOrphan as en, unreadableOrphanRecords as eo, maskingRetryLogger as er, createUnionSecretMasker as es, hasCdkAutoDeleteTag as et, conditionFingerprint as f, malformedOrphansRefusalMessage as fa, orphansAfterRollback as fc, isSettledInstanceState as fi, resolveStateBucketWithDefault as fl, isRedactedRecordedValue as fn, isStatefulRecreateTargetForReplace as fo, DBPROXY_TAG_OPTIONS as fr, maskSecretsInText as fs, computeParameterTaint as ft, isSecretBearingReferenceString as g, malformedRenderedContainersWarning as ga, isSensitiveAttributeName as gc, recordedReferenceRegions as gi, warnDeprecatedNoPrefixCliFlag as gl, updatePartialReason as gn, coerceWarmThroughput as go, tagMapAsList as gr, redactSecretsForState as gs, makeSiblingClaimReader as gt, readRecordedConditionVerdicts as h, malformedOutputsWarning as ha, AssetPublisher as hc, recordedOutputReferenceRegions as hi, stateBucketExistenceConfirmed as hl, updatePartialMessage as hn, WARM_THROUGHPUT_MEMBERS as ho, refuseMalformedDesiredTags as hr, snapshotPassProvenance as hs, resourcesNamingDeclaredParameter as ht, crossStackOutputProvenanceSource as i, malformedExportNamesWarning as ia, describeRegionValueKind as ic, assertSendableRoleArn as ii, synthesisStatusMessage as il, recordUnderIdIsNotOwn as in, findSilentDropProperties as io, earliestDefined as ir, printingCorpusOf as is, formatResourceLine as it, noEchoAttributeNamesOf as j, refuseMalformedOutputsForDestroy as ja, validateAssetBucketName as jc, carriesDynamicReference as ji, processStackMessages as jl, isExportAliasCollision as jn, templateResourceTypes as jo, applyCustomResourceResponseExpiration as jr, splitGetAttStringForm as js, displacedOpClause as jt, withResourceDeadline as k, refuseMalformedOrphansForOrphan as ka, parseBootstrapMarker as kc, getAccountInfo as ki, AssemblyReader as kl, collectDeclaredOutputNames as kn, requireConfigString as ko, withPrintingSecrets as kr, recordAttributeIdCopy as ks, sameJournaledOrphans as kt, listNestedTemplateRows as l, malformedOrphanRecordsRefusalMessage as la, importableOutputKeys as lc, applyCallerIdentityCredentials as li, resolveAutoAssetStorage as ll, getCurrentProducerRegions as ln, findReplacedReadersOfRecreateTargets as lo, isRefusedByName as lr, createSecretMasker as ls, green as lt, parentSuppliedValues as m, malformedOutputsRefusalMessage as ma, shouldRetainResource as mc, outputReferenceProvenanceOf as mi, resolveUseCdkBootstrapAssets as ml, redactedDeleteAddressSkip as mn, renderStatefulReason as mo, readTagList as mr, recordReferenceProvenanceEntry as ms, reachableDivergentParameters as mt, IMPLICIT_DELETE_DEPENDENCIES as n, isReadableResourceEntry as na, splitImportedOps as nc, applyRoleArnIfSet as ni, getDockerImageBySourceHash as nl, planRollback as nn, withheldAccountClause as no, findDestructiveChanges as nr, literalSplitDelimitersOf as ns, getPriorAttempts as nt, childTemplateLoader as o, malformedLocalOutputsWarning as oa, hasReadableExportSet as oc, isIamRoleArn as oi, getLegacyStateBucketName as ol, resolveReplacementOldType as on, withoutSilentDropProperties as oo, reserveStackCreateToken as or, recordLogOnlyValue as os, bold as ot, conditionInputsFrom as p, malformedOrphansWarning as pa, orphansCarriedFrom as pc, keepHeldTokenProvenance as pi, resolveStateBucketWithDefaultAndSource as pl, redactedDeleteAddressFields as pn, isStatefulRecreateTargetSync as po, planTagDiff as pr, markSameGenerationBag as ps, namesAnyDeclaredParameter as pt, resolveDynamoDbDeleteBudgetMs as q, repairMalformedOrphanRecordsForReadOnly as qa, redactedCause as qc, UNREADABLE_ORPHANS_CONTAINER_ROW as qi, buildFinalSnapshotIdentifier as qn, noEchoOutputsComparison as qo, observeThenDisableInstanceApiTermination as qr, isLockInfoExpired as qs, getStackRecords as qt, computeImplicitDeleteEdges as r, malformedDriftResourcePropertiesWarning as ra, acceptedCreateOnlyDropsOf as rc, assertFlagRoleArn as ri, Synthesizer as rl, recheckFailedPlan as rn, findActionableSilentDrops as ro, formatDestructiveChange as rr, logOnlyValueCount as rs, markRefusedBeforeApplying as rt, findNestedTemplateTreeDefect as s, malformedLocalResourceEntriesWarning as sa, hasReasonlessBaselineRefusal as sc, sendableAssumeRoleCommand as si, loadCdkJson as sl, seedsDeleteFirstGuard as sn, NO_CC_HANDLERS_REASON as so, withCreateTokenLedger as sr, shareLogOnlyValues as ss, cyan as st, DeployEngine as t, isReadableOrphanRecord as ta, isNotImplemented as tc, refuseUnreadableCdkCrossAccountRefs as ti, AssetManifestLoader as tl, planFailedOps as tn, unreadableResourceEntries as to, constructPathOf as tr, hasMaskableValues as ts, isTruthyCfnBoolean as tt, renderNestedTemplateTreeDefect as u, malformedOrphanRecordsWarning as ua, importableOutputs as uc, callerEnvCredentials as ui, resolveCaptureObservedState as ul, inheritProducerRegions as un, shownType as uo, markDeleteStarted as ur, errorCauseChain as us, red as ut, mergeNoChangeOutputs as v, malformedResourcePropertiesWarning as va, WorkGraph as vc, s3BucketDomainName as vi, CFN_TEMPLATE_BODY_LIMIT as vl, WITHHELD_NAME_DISPLAY as vn, toCfnInteger as vo, definedAttributes as vr, withPhysicalNameCopies as vs, DeploymentEventsReader as vt, keptForReadoption as w, refuseMalformedNestedChildOutputs as wa, BOOTSTRAP_MARKER_PREFIX as wc, producerRegionsFromState as wi, decodeListingKey as wl, carriedExportAliasExposure as wn, configStringRefusal as wo, wouldReturnToSdkProvider as wr, identityKeyFor as ws, dropFailedHint as wt, isAccessDeniedError as x, malformedStateRefusalMessage as xa, loadPublishableAssetManifest as xc, s3BucketWebsiteUrl as xi, findLargeInlineResources as xl, secretBearing as xn, coerceCfnInteger as xo, ProviderRegistry as xr, dynamicReferenceTokens as xs, resolvePendingCloudControlRequests as xt, makeCanonicalizePropertiesFn as y, malformedResourcesWarning as ya, buildAssetRedirectMap as yc, s3BucketDualStackDomainName as yi, CFN_TEMPLATE_URL_LIMIT as yl, displayTextOrWithheld as yn, toFiniteNumber as yo, stringifyIfAssigned as yr, withoutPhysicalNameCopies as ys, DeploymentEventsStore as yt, perType as z, refuseMalformedResourcePropertiesForDestroy as za, dockerSpawnEnvWithSensitive as zc, parseWebACLArn as zi, displayAssemblyPath as zl, secretNamePrintingBag as zn, canonicalCoordinates as zo, deleteLeftInPlace as zr, wholeStringLeavesOf as zs, withNestedRevertRun as zt };
-//# sourceMappingURL=deploy-engine-BYgrFxwH.js.map
+export { S3_AUTO_DELETE_OBJECTS_TAG as $, repairMalformedResourcesForReadOnly as $a, escapeRegExp$3 as $c, hasReadableOrphans as $i, unsupportedFinalSnapshotError as $n, liveMatchesUnresolvedTokenFrame as $o, IntrinsicFunctionResolver as $r, applyCrossPrefixScan as $s, isJournaledOrphan as $t, diffSecurity as A, refuseMalformedOrphansForOrphan as Aa, parseBootstrapMarker as Ac, getAccountInfo as Ai, AssemblyReader as Al, collectPublishedOutputNames as An, requireConfigString as Ao, withPrintingSecrets as Ar, recordAttributeIdCopy as As, NESTED_PENDING_PARENT_REASON as At, readProtection as B, refuseMalformedResourcePropertiesForDestroy as Ba, dockerSpawnEnvWithSensitive as Bc, parseWebACLArn as Bi, displayAssemblyPath as Bl, secretNamePrintingBags as Bn, canonicalCoordinates as Bo, deleteLeftInPlace as Br, wholeStringLeavesOf as Bs, collectNestedChildUnaddressed as Bt, withApiLimit as C, previewableOrphanRecords as Ca, rewriteTemplateAssetReferences as Cc, classifyRecordedSecretRegion as Ci, uploadCfnTemplate as Cl, secretSafeKeyDisplay as Cn, configBooleanRefusal as Co, isCustomResource as Cr, isUncertifiedBaselineMaskPosition as Cs, dropFailedCommands as Ct, findServiceTokenRefusals as D, refuseMalformedOrphanRecordsForDestroy as Da, ensureAssetStorage as Dc, coerceParameterTypedValue as Di, PARTITION_TABLE as Dl, isWholeDynamicReferenceValue as Dn, replayWarn as Do, readsNoEchoDeleteValues as Dr, recordNestedStackParameterExpressions as Ds, loadJournaledOrphans as Dt, deferredServiceTokenWarning as E, refuseMalformedOrphanRecords as Ea, assertAssetBucketRegion as Ec, regionLessSecretName as Ei, expectedOwnerParam as El, exportNameSecretExposure as En, readConfigString as Eo, TemplateNoEchoReresolver as Er, inheritNestedStackParameterAssociations as Es, journaledOrphanLines as Et, recordedProtectionEvidence as F, refuseMalformedResourceEntriesForDeploy as Fa, buildDockerImage as Fc, keepsSecretReferenceToken as Fi, hasPlainPrototype$1 as Fl, completedReplayEntries as Fn, canonicalLambdaFunctionName as Fo, slowCcOperationTimeoutMs as Fr, recordMaskOnlyValue as Fs, nestedChildStackName as Ft, deleteBudgetKey as G, refuseMalformedResourcesForDestroy as Ga, isMalformedEnvKey as Gc, JSON_LISTING_HOLE_VALUE as Gi, clearBucketRegionCache as Gl, ATOMIC_FINAL_SNAPSHOT_TYPES as Gn, maskedLeafCoordinatesOf as Go, disableInstanceApiTermination as Gr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Gs, awaitInFlightSibling as Gt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as H, refuseMalformedResourcePropertiesForExport as Ha, formatDockerLoginError as Hc, parameterInputsFor as Hi, resolveAssemblyPath as Hl, stateSecretNameNeedles as Hn, maskAtCoordinates as Ho, withIndeterminateGuard as Hr, STATE_SOURCED_CROSS_GENERATION_RULES as Hs, withNestedStackContext as Ht, recordedProtectionNote as I, refuseMalformedResourceEntriesForDestroy as Ia, resolveDockerContextDirectory as Ic, AWS_NO_VALUE as Ii, nullPrototypeRecord as Il, journaledOrphanPrintingBag as In, lambdaFunctionNameForMask as Io, unchangedBehindSecretReference as Ir, recordMaskOnlyValuesIn as Is, recordDisplacedSkips as It, DELETE_INDEX_WAIT_PROCEED_NOTE as J, repairMalformedOrphanRecordsForReadOnly as Ja, redactedCause as Jc, UNREADABLE_ORPHANS_CONTAINER_ROW as Ji, ccRoutedFinalSnapshotError as Jn, noEchoOutputsComparison as Jo, observeThenDisableInstanceApiTermination as Jr, isLockInfoExpired as Js, withStackRecords as Jt, resolveDynamoDbDeleteBudgetClock as K, refuseMalformedResourcesForExport as Ka, partitionSensitiveEnv as Kc, STATE_REGION_DIVERGED as Ki, resolveBucketRegion as Kl, PRE_DELETE_SNAPSHOT_TYPES as Kn, noEchoCoordinatesOf as Ko, ec2InstanceProtectionSite as Kr, isSingleDynamicReferenceToken as Ks, destroyStackRecordsView as Kt, PROTECTION_PROPERTY_BY_TYPE as L, refuseMalformedResourceEntriesForImport as La, describeDockerCapturedOutput as Lc, cfnRefValueFromPhysicalId as Li, ownValue as Ll, maskEventTextWithBoundBags as Ln, sameLambdaFunctionAddress as Lo, RollbackInlinePolicyWriters as Lr, recordNoEchoAttributeValues as Ls, revertNestedChildFromJournal as Lt, noEchoComparisonForTemplate as M, refuseMalformedOutputsForDestroy as Ma, validateAssetBucketName as Mc, carriesDynamicReference as Mi, processStackMessages as Ml, bindingSkippedOutputs as Mn, templateResourceTypes as Mo, applyCustomResourceResponseExpiration as Mr, splitGetAttStringForm as Ms, displacedPhysicalIdShown as Mt, noEchoExactEchoLeavesOf as N, refuseMalformedResourceAttributesForOrphan as Na, validateContainerRepoName as Nc, carriesFetchableDynamicReference as Ni, defineOwnKey as Nl, DEFAULT_RESOURCE_TIMEOUT_MS as Nn, describeTypeWithThrottleRetry as No, customResourceResponseExpirationWarning as Nr, carriesSecretMask as Ns, dropSettledNestedJournals as Nt, serviceTokenBlockingReason as O, refuseMalformedOrphans as Oa, getBootstrapMarkerKey as Oc, isUnboundTemplateParameter as Oi, canonicalizeRegion as Ol, noEchoParameterValueSeed as On, requireConfigArray as Oo, isCustomResourceType as Or, recoverMaskedOutput as Os, makeForeignHolderScan as Ot, noEchoParameterNamesOf as P, refuseMalformedResourceEntries as Pa, buildDenyExternalAccessPolicy as Pc, isNamelessDynamicReferenceError as Pi, hasOwnKey as Pl, DEFAULT_RESOURCE_WARN_AFTER_MS as Pn, withRetry as Po, CloudControlProvider as Pr, provenPublicValue as Ps, getNestedRevertRun as Pt, ECR_AUTO_DELETE_IMAGES_TAG as Q, repairMalformedResourcePropertiesForReadOnly as Qa, warnFinchArgvExposure as Qc, displayLogicalId as Qi, refusesFinalSnapshot as Qn, valueAtCoordinate as Qo, INTRINSIC_KEYS as Qr, CrossPrefixScanCache as Qs, demoteSupersededOrphans as Qt, isProtectionValueActive as R, refuseMalformedResourceEntriesForImportSave as Ra, describeDockerExecFailure as Rc, isStalePlaceholderArnAttribute as Ri, absoluteAssemblyPathEscape as Rl, orphanRecordsPrintingBag as Rn, DagBuilder as Ro, UNSPECIFIED_SKIP_REASON as Rr, recordNoEchoParameterFreshValue as Rs, revertedNestedRowIds as Rt, lookupEachName as S, malformedStateRefusalMessage as Sa, loadPublishableAssetManifest as Sc, s3BucketWebsiteUrl as Si, findLargeInlineResources as Sl, secretBearingStateKeyWarning as Sn, coerceCfnInteger as So, ccBrokenReason as Sr, dynamicReferenceTokens as Ss, deleteJournaledOrphans as St, recordRetainedForReadoption as T, refuseMalformedNestedChildOutputs as Ta, BOOTSTRAP_MARKER_PREFIX as Tc, producerRegionsFromState as Ti, decodeListingKey as Tl, exportNameNoEchoParameters as Tn, configStringRefusal as To, waitForLambdaFunctionActive as Tr, identityKeyFor as Ts, isHandledOrphan as Tt, beginDeleteWait as U, refuseMalformedResourcePropertiesForOrphan as Ua, getDockerCmd as Uc, passedParameterClassesOf as Ui, injectAwsRegion as Ul, storedSecretNameNeedles as Un, maskReadbackAtCoordinates as Uo, isWaitAbandonedError as Ur, STATE_SOURCED_READBACK_RULES as Us, replayFailedOperations as Ut, DynamoDBGlobalTableProvider as V, refuseMalformedResourcePropertiesForDrift as Va, finchSecretArgvRefusal as Vc, withSharedDrainBudget as Vi, renderAssemblyPathEscape as Vl, secretNamedRecordNeedles as Vn, isMarkedCoordinate as Vo, deleteSkipReason as Vr, STATE_SOURCED_BASELINE_RULES as Vs, getCurrentNestedStackContext as Vt, compensateRemovedDeletionProtection as W, refuseMalformedResourcesForDeploy as Wa, isDockerClientEnvKey as Wc, declaresNoEcho as Wi, injectedAwsRegionValue as Wl, extractDeploymentEventError as Wn, maskWholeValue as Wo, markWaitAbandoned as Wr, TEMPLATE_SOURCED_RULES as Ws, replayRollback as Wt, deleteTableWithIndexBusyRetry as X, repairMalformedOutputsForReadOnly as Xa, runDockerForeground as Xc, accountArgs as Xi, effectiveDeletionPolicy as Xn, readbackPathFor as Xo, reEnableInstanceApiTermination as Xr, rebuildClientForBucketRegion as Xs, replacedDeleteFailureVerdict as Xt, INDEX_SETTLE_POLL_INTERVAL_MS as Y, repairMalformedOrphansForReadOnly as Ya, redactedDockerCause as Yc, UNREADABLE_RESOURCES_MAP_ROW as Yi, createPreDeleteFinalSnapshot as Yn, passedNoEchoParametersOf as Yo, reDisableInstanceApiTermination as Yr, S3StateBackend as Ys, removeProtectionTypeList as Yt, waitForIndexesSettled as Z, repairMalformedResourceEntriesForReadOnly as Za, runDockerStreaming as Zc, deployRefusesOrphanRowsReason as Zi, isFinalSnapshotError as Zn, readsNoEchoSource as Zo, DiffCalculator as Zr, CrossPrefixReadError as Zs, recordAfterRollbackUpdate as Zt, keptWholeReasonText as _, malformedRenderedContainersWarning as _a, isSensitiveAttributeName as _c, recordedReferenceRegions as _i, warnDeprecatedNoPrefixCliFlag as _l, orphanNeedsIdentity as _n, coerceWarmThroughput as _o, tagPlanWarning as _r, redactSecretsForState as _s, planOrphanAdoption as _t, inheritedProvenanceForChildDiff as a, malformedExportNamesWarning as aa, describeRegionValueKind as ac, assertSendableRoleArn as ai, synthesisStatusMessage as al, replacementNeverSwapped as an, findSilentDropProperties as ao, ledgerForStack as ar, printingCorpusOf as as, createReadOnlyAttributeHealerFactory as at, chunks as b, malformedResourcesWarning as ba, buildAssetRedirectMap as bc, s3BucketDualStackDomainName as bi, CFN_TEMPLATE_URL_LIMIT as bl, exportAliasCollisionScrubWarning as bn, toFiniteNumber as bo, CC_BROKEN_REASON as br, withoutPhysicalNameCopies as bs, pendingRequestCount as bt, isAbsoluteAssetPath as c, malformedLocalResourceEntriesWarning as ca, hasReasonlessBaselineRefusal as cc, sendableAssumeRoleCommand as ci, loadCdkJson as cl, findNestedStackTypeChanges as cn, NO_CC_HANDLERS_REASON as co, acquireIdempotencyToken as cr, shareLogOnlyValues as cs, gray as ct, templateIdentity as d, malformedOrphanRecordsWarning as da, importableOutputs as dc, callerEnvCredentials as di, resolveCaptureObservedState as dl, REDACTED_DELETE_ADDRESS_SKIP_REASON as dn, shownType as do, DBPROXY_TAGS_WHAT as dr, errorCauseChain as ds, yellow as dt, hasReadableOutputs as ea, crossPrefixDeniedWarning as ec, poisonRenderedSpellingsCollidingIn as ei, stripControlChars as el, isReplacementOrphan as en, unpreviewableOrphanRecords as eo, maskingRetryLogger as er, carryLogOnlyValues as es, hasCdkAutoDeleteTag as et, conditionFingerprint as f, malformedOrphanRowsKeptWarning as fa, isReadableBag as fc, envCredentialsAreAssumedRole as fi, resolveSkipPrefix as fl, isRedactedRecordedValue as fn, MULTI_REGION_RECREATE_BLOCKED_TYPES as fo, DBPROXY_TAG_OPTIONS as fr, maskSecretsInError as fs, computeParameterTaint as ft, isSecretBearingReferenceString as g, malformedOutputsWarning as ga, AssetPublisher as gc, recordedOutputReferenceRegions as gi, stateBucketExistenceConfirmed as gl, updatePartialReason as gn, WARM_THROUGHPUT_MEMBERS as go, tagMapAsList as gr, snapshotPassProvenance as gs, makeSiblingClaimReader as gt, readRecordedConditionVerdicts as h, malformedOutputsRefusalMessage as ha, shouldRetainResource as hc, outputReferenceProvenanceOf as hi, resolveUseCdkBootstrapAssets as hl, updatePartialMessage as hn, renderStatefulReason as ho, refuseMalformedDesiredTags as hr, recordReferenceProvenanceEntry as hs, resourcesNamingDeclaredParameter as ht, crossStackOutputProvenanceSource as i, malformedDriftResourcePropertiesWarning as ia, acceptedCreateOnlyDropsOf as ic, assertFlagRoleArn as ii, Synthesizer as il, recordUnderIdIsNotOwn as in, findActionableSilentDrops as io, earliestDefined as ir, logOnlyValueCount as is, formatResourceLine as it, noEchoAttributeNamesOf as j, refuseMalformedOutputs as ja, readBootstrapMarkerBody as jc, isImpossibleEmptyStoredAttribute as ji, StageLoadError as jl, isExportAliasCollision as jn, prefetchCreateOnlyPropertyPaths as jo, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as jr, recordPhysicalNameCopy as js, displacedOpClause as jt, withResourceDeadline as k, refuseMalformedOrphansForDestroy as ka, isCrossRegionRedirect as kc, parameterTypeMayLoseSecretIdentity as ki, derivePartitionAndUrlSuffix as kl, collectDeclaredOutputNames as kn, requireConfigObject as ko, getCurrentResourceSecrets as kr, physicalNameCopiesOf as ks, sameJournaledOrphans as kt, listNestedTemplateRows as l, malformedLocalResourcesWarning as la, hasUnverifiableParameterRefusal as lc, AWS_CREDENTIAL_ENV_KEYS as li, resolveApp as ll, getCurrentProducerRegions as ln, hasNoCloudControlHandlers as lo, isRefusedByName as lr, unionOfSecretBags as ls, green as lt, parentSuppliedValues as m, malformedOrphansWarning as ma, orphansCarriedFrom as mc, keepHeldTokenProvenance as mi, resolveStateBucketWithDefaultAndSource as ml, redactedDeleteAddressSkip as mn, isStatefulRecreateTargetSync as mo, readTagList as mr, markSameGenerationBag as ms, reachableDivergentParameters as mt, IMPLICIT_DELETE_DEPENDENCIES as n, isReadableOrphanRecord as na, isNotImplemented as nc, refuseUnreadableCdkCrossAccountRefs as ni, AssetManifestLoader as nl, planRollback as nn, unreadableResourceEntries as no, findDestructiveChanges as nr, hasMaskableValues as ns, getPriorAttempts as nt, childTemplateLoader as o, malformedExportSourceWarning as oa, exportNamesCarriedFrom as oc, explicitRoleArnOrThrow as oi, getDefaultStateBucketName as ol, resolveReplacementOldType as on, unwrittenCreateOnlyReplacement as oo, reserveStackCreateToken as or, recordLogOnlyParameterValue as os, bold as ot, conditionInputsFrom as p, malformedOrphansRefusalMessage as pa, orphansAfterRollback as pc, isSettledInstanceState as pi, resolveStateBucketWithDefault as pl, redactedDeleteAddressFields as pn, isStatefulRecreateTargetForReplace as po, planTagDiff as pr, maskSecretsInText as ps, namesAnyDeclaredParameter as pt, resolveDynamoDbDeleteBudgetMs as q, refuseMalformedState as qa, redactDockerArgvValues as qc, STATE_RESOURCES_MALFORMED as qi, buildFinalSnapshotIdentifier as qn, noEchoLeavesOf as qo, isTerminationProtectionPropagationError as qr, LockManager as qs, getStackRecords as qt, computeImplicitDeleteEdges as r, isReadableResourceEntry as ra, splitImportedOps as rc, applyRoleArnIfSet as ri, getDockerImageBySourceHash as rl, recheckFailedPlan as rn, withheldAccountClause as ro, formatDestructiveChange as rr, literalSplitDelimitersOf as rs, markRefusedBeforeApplying as rt, findNestedTemplateTreeDefect as s, malformedLocalOutputsWarning as sa, hasReadableExportSet as sc, isIamRoleArn as si, getLegacyStateBucketName as sl, seedsDeleteFirstGuard as sn, withoutSilentDropProperties as so, withCreateTokenLedger as sr, recordLogOnlyValue as ss, cyan as st, DeployEngine as t, hasReadableResources as ta, isAccessDenied$1 as tc, producerLookupOver as ti, stripForDisplay as tl, planFailedOps as tn, unreadableOrphanRecords as to, constructPathOf as tr, createUnionSecretMasker as ts, isTruthyCfnBoolean as tt, renderNestedTemplateTreeDefect as u, malformedOrphanRecordsRefusalMessage as ua, importableOutputKeys as uc, applyCallerIdentityCredentials as ui, resolveAutoAssetStorage as ul, inheritProducerRegions as un, findReplacedReadersOfRecreateTargets as uo, markDeleteStarted as ur, createSecretMasker as us, red as ut, mergeNoChangeOutputs as v, malformedResourceEntriesWarning as va, stringifyValue as vc, s3BucketArn as vi, ssmResolvedValueType as vl, WITHHELD_NAME_DISPLAY as vn, isWarmThroughputDecrease as vo, definedAttributes as vr, scrubResourceRecord as vs, DeploymentEventsReader as vt, keptForReadoption as w, refuseDivergentRecordRegionForDestroy as wa, AssetModeResolver as wc, classifyReplaySecretRegion as wi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as wl, carriedExportAliasExposure as wn, configIntegerRefusal as wo, wouldReturnToSdkProvider as wr, pathCrossesDottedKey as ws, dropFailedHint as wt, isAccessDeniedError as x, malformedScrubResourceEntriesRefusalMessage as xa, createAssetRedirectResolver as xc, s3BucketRegionalDomainName as xi, MIGRATE_TMP_PREFIX as xl, secretBearing as xn, coerceCfnBoolean as xo, ProviderRegistry as xr, DYNAMIC_REFERENCE_TOKEN_SCAN as xs, resolvePendingCloudControlRequests as xt, makeCanonicalizePropertiesFn as y, malformedResourcePropertiesWarning as ya, WorkGraph as yc, s3BucketDomainName as yi, CFN_TEMPLATE_BODY_LIMIT as yl, displayTextOrWithheld as yn, toCfnInteger as yo, stringifyIfAssigned as yr, withPhysicalNameCopies as ys, DeploymentEventsStore as yt, perType as z, refuseMalformedResourceEntriesForOrphan as za, describeDockerFailure as zc, refStateLookupFromResource as zi, describeFileReadFailure as zl, secretNamePrintingBag as zn, TemplateParser as zo, deleteIndeterminateGuards as zr, recordProvenPublicExpression as zs, withNestedRevertRun as zt };
+//# sourceMappingURL=deploy-engine-CZaafy9R.js.map