@go-to-k/cdkd 0.301.4 → 0.301.6

package/dist/{program-DYfZCsxM.js → program-Cqk1ZTsY.js}

@@ -2,8 +2,8 @@ import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients,
 import { A as UNRENDERABLE, B as safeMsg, D as SAFE_MSG_ALTERED_CHAR, F as displaySafe, H as terminalSafe, I as displayStackName, L as isPasteableIdent, M as cutMarker, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, T as withStackName, U as truncateCodePoints, V as stringifyJsonPayload, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
 import { $t as ambientCredentialConfig, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, D as VALUE_NOT_SHOWN, Dn as normalizeAwsError, E as assertRegionMatch, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gt as DEFAULT_STATE_PREFIX, Hn as withheldTargetClause, In as pasteableCommand, It as buildForceUnlockCommand, Jt as producerCoordinateKey, Kt as injectiveKey, Lt as buildLockContentionMessage, Nn as commandHole, On as withErrorHandling, P as remedyLogicalId, Qt as ambientClientDefaults, Rn as plainOrDescribed, Rt as forceQuitRecoveryClause, Sn as StackTerminationProtectionError, T as RESOURCE_NOT_FOUND, Un as setPasteableRunFlags, Vn as shellQuote, Vt as formatLockOwner, Wn as setPasteableVerbFlags, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as setPasteableAwsProfile, Yt as producerRecordKey, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _n as PartialFailureError, ar as isRetryableTransientError, bn as ResourceUpdateNotSupportedError, cn as DeployCancelledError, dn as LocalInvokeBuildError$1, dr as markNonRetryable, en as clientDefaultsFor, fn as LocalStartServiceError, ft as logicalIdShown, gn as NestedStackChildDirectDestroyError, hn as MalformedProducerRecordRefusalError, in as CdkdError, it as isInterruptedWaitError, jn as SHELL_ACTIVE_WHY, kn as TIMEOUT_FLAG_RESOURCE_TYPE, ln as DynamicReferenceRegionAmbiguousError, lr as isMarkedNonRetryable, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, nt as endCommandInterruptScope, on as CrossAccountSecretRefusalError, or as isTransientServerError, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sr as retryClassificationText, t as IAM_PRINCIPAL_NAME, tn as credentialFingerprint, tt as beginCommandInterruptScope, un as IntrinsicResolutionRefusalError, ur as isThrottlingError, vn as ProvisioningError, wn as SynthesisError, xn as StackHasActiveImportsError, yn as ResourceTimeoutError, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-BkeM7IXi.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-DBXBcg0J.js";
-import { $a as repairMalformedResourceEntriesForReadOnly, $c as runDockerForeground, $i as deployRefusesOrphanRowsReason, $n as isFinalSnapshotError, $o as readsNoEchoSource, $r as DiffCalculator, $s as rebuildClientForBucketRegion, $t as isJournaledOrphan, A as diffSecurity, Aa as refuseMalformedOrphans, Ac as ensureAssetStorage, Ai as isUnboundTemplateParameter, Al as PARTITION_TABLE, An as collectPublishedOutputNames, Ar as isCustomResourceType$1, As as recordNestedStackParameterExpressions, At as NESTED_PENDING_PARENT_REASON, Ba as refuseMalformedResourceEntriesForImportSave, Bc as describeDockerCapturedOutput, Bi as isStalePlaceholderArnAttribute, Bl as ownValue, Bn as secretNamePrintingBag, Bo as DagBuilder, Br as UNSPECIFIED_SKIP_REASON, Bs as recordNoEchoAttributeValues, Bt as collectNestedChildUnaddressed, C as computeImplicitDeleteEdges, Ca as malformedScrubResourceEntriesRefusalMessage, Cc as buildAssetRedirectMap, Cl as CFN_TEMPLATE_URL_LIMIT, Cn as secretSafeKeyDisplay, Cr as ProviderRegistry, Ct as dropFailedCommands, D as findServiceTokenRefusals, Dc as AssetModeResolver, Di as producerRegionsFromState, Dl as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Dn as isWholeDynamicReferenceValue, Ds as pathCrossesDottedKey, Dt as loadJournaledOrphans, E as deferredServiceTokenWarning, Ea as refuseDivergentRecordRegionForDestroy, Ec as rewriteTemplateAssetReferences, Ei as classifyReplaySecretRegion, El as uploadCfnTemplate, En as exportNameSecretExposure, Er as wouldReturnToSdkProvider, Es as isUncertifiedBaselineMaskPosition, Et as journaledOrphanLines, F as perType, Fa as refuseMalformedResourceAttributesForOrphan, Fc as validateAssetBucketName, Fi as carriesFetchableDynamicReference, Fl as processStackMessages, Fn as completedReplayEntries, Fo as describeTypeWithThrottleRetry, Fr as customResourceResponseExpirationWarning, Fs as splitGetAttStringForm, Ft as nestedChildStackName$1, Ga as refuseMalformedResourcePropertiesForOrphan, Gc as formatDockerLoginError, Gl as resolveAssemblyPath, Gn as storedSecretNameNeedles, Go as maskReadbackAtCoordinates, Gr as isWaitAbandonedError, Gs as STATE_SOURCED_CROSS_GENERATION_RULES, Ha as refuseMalformedResourcePropertiesForDestroy, Hc as describeDockerFailure, Hl as describeFileReadFailure, Ho as canonicalCoordinates, Hr as deleteLeftInPlace, Hs as recordProvenPublicExpression, Ht as withNestedStackContext, I as readProtection, Ia as refuseMalformedResourceEntries, Ic as validateContainerRepoName, Ii as isNamelessDynamicReferenceError, Il as defineOwnKey, In as journaledOrphanPrintingBag, Io as withRetry, Ir as CloudControlProvider, Is as carriesSecretMask, It as recordDisplacedSkips, Ja as refuseMalformedResourcesForExport, Jc as isMalformedEnvKey, Ji as STATE_REGION_DIVERGED, Jn as PRE_DELETE_SNAPSHOT_TYPES, Jo as noEchoCoordinatesOf, Js as WHOLE_DYNAMIC_REFERENCE_PATTERN, Jt as withStackRecords, Ka as refuseMalformedResourcesForDeploy, Kc as getDockerCmd, Ki as declaresNoEcho, Kl as injectAwsRegion, Kn as extractDeploymentEventError, Ko as maskWholeValue, Ks as STATE_SOURCED_READBACK_RULES, Kt as destroyStackRecordsView, La as refuseMalformedResourceEntriesForDeploy, Lc as buildDenyExternalAccessPolicy, Li as keepsSecretReferenceToken, Ll as hasOwnKey, Ln as maskEventTextWithBoundBags, Lr as slowCcOperationTimeoutMs, Ls as provenPublicValue, M as recordedProtectionNote, Ma as refuseMalformedOrphansForOrphan, Mc as isCrossRegionRedirect, Mi as getAccountInfo, Ml as derivePartitionAndUrlSuffix, Mn as bindingSkippedOutputs, Mr as withPrintingSecrets, Ms as physicalNameCopiesOf, Mt as displacedPhysicalIdShown, N as PROTECTION_PROPERTY_BY_TYPE, Na as refuseMalformedOutputs, Nc as parseBootstrapMarker, Ni as isImpossibleEmptyStoredAttribute, Nl as AssemblyReader, Nn as DEFAULT_RESOURCE_TIMEOUT_MS, No as prefetchCreateOnlyPropertyPaths, Nr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Nt as dropSettledNestedJournals, O as serviceTokenBlockingReason, Oa as refuseMalformedOrphanRecords, Oc as BOOTSTRAP_MARKER_PREFIX, Oi as regionLessSecretName, Ol as decodeListingKey, On as noEchoParameterValueSeed, Or as TemplateNoEchoReresolver, Os as identityKeyFor, Ot as makeForeignHolderScan, P as isProtectionValueActive, Pa as refuseMalformedOutputsForDestroy, Pc as readBootstrapMarkerBody, Pi as carriesDynamicReference, Pl as StageLoadError, Pn as DEFAULT_RESOURCE_WARN_AFTER_MS, Po as templateResourceTypes, Pr as applyCustomResourceResponseExpiration, Ps as recordPhysicalNameCopy, Qa as repairMalformedOutputsForReadOnly, Qc as redactedDockerCause, Qi as accountArgs, Qn as effectiveDeletionPolicy, Qo as readbackPathFor, Qs as S3StateBackend, Qt as demoteSupersededOrphans, Ra as refuseMalformedResourceEntriesForDestroy, Rc as buildDockerImage, Ri as AWS_NO_VALUE, Rl as hasPlainPrototype, Rn as namingSecretsWithRecordedNoEcho, Rs as recordMaskOnlyValue, Rt as revertedNestedRowIds, S as IMPLICIT_DELETE_DEPENDENCIES, Sa as malformedResourcesWarning, Sc as WorkGraph, Sl as CFN_TEMPLATE_BODY_LIMIT, Sn as secretBearingStateKeyWarning, Sr as CC_BROKEN_REASON, Ss as withPhysicalNameCopies, St as deleteJournaledOrphans, T as recordRetainedForReadoption, Ta as previewableOrphanRecords, Tc as loadPublishableAssetManifest, Ti as classifyRecordedSecretRegion, Tl as findLargeInlineResources, Tn as exportNameNoEchoParameters, Tr as isCustomResource, Ts as dynamicReferenceTokens, Tt as isHandledOrphan, Ua as refuseMalformedResourcePropertiesForDrift, Uc as dockerSpawnEnvWithSensitive, Ui as withSharedDrainBudget, Ul as displayAssemblyPath, Un as secretNamedRecordNeedles, Uo as isMarkedCoordinate, Ur as deleteSkipReason, Us as wholeStringLeavesOf, Ut as replayFailedOperations, Va as refuseMalformedResourceEntriesForOrphan, Vc as describeDockerExecFailure, Vi as refStateLookupFromResource, Vl as absoluteAssemblyPathEscape, Vn as secretNamePrintingBags, Vo as TemplateParser, Vr as deleteIndeterminateGuards, Vs as recordNoEchoParameterFreshValue, Vt as getCurrentNestedStackContext, Wa as refuseMalformedResourcePropertiesForExport, Wc as finchSecretArgvRefusal, Wi as parameterInputsFor, Wl as renderAssemblyPathEscape, Wn as stateSecretNameNeedles, Wo as maskAtCoordinates, Ws as STATE_SOURCED_BASELINE_RULES, Wt as replayRollback, Xa as repairMalformedOrphanRecordsForReadOnly, Xc as redactDockerArgvValues, Xi as UNREADABLE_ORPHANS_CONTAINER_ROW, Xn as ccRoutedFinalSnapshotError, Xo as noEchoOutputsComparison, Xs as LockManager, Ya as refuseMalformedState, Yc as partitionSensitiveEnv, Yi as STATE_RESOURCES_MALFORMED, Yl as resolveBucketRegion, Yn as buildFinalSnapshotIdentifier, Yo as noEchoLeavesOf, Ys as isSingleDynamicReferenceToken, Yt as removeProtectionTypeList, Za as repairMalformedOrphansForReadOnly, Zc as redactedCause, Zi as UNREADABLE_RESOURCES_MAP_ROW, Zn as createPreDeleteFinalSnapshot, Zs as isLockInfoExpired, Zt as recordAfterRollbackUpdate, _ as makeCanonicalizePropertiesFn, _a as malformedOutputsRefusalMessage, _c as orphansCarriedFrom, _l as resolveStateBucketWithDefaultAndSource, _n as orphanNeedsIdentity, _o as renderStatefulReason, _s as markSameGenerationBag, _t as planOrphanAdoption, a as findNestedTemplateTreeDefect, aa as isReadableResourceEntry, ac as isNotImplemented, ai as applyRoleArnIfSet, al as AssetManifestLoader, an as replacementNeverSwapped, ao as withheldAccountClause, ar as formatDestructiveChange, as as hasMaskableValues, at as red, ba as malformedResourceEntriesWarning, bc as isSensitiveAttributeName, bl as warnDeprecatedNoPrefixCliFlag, bn as exportAliasCollisionScrubWarning, bs as redactSecretsForState, bt as pendingRequestCount, c as renderNestedTemplateTreeDefect, ca as malformedExportSourceWarning, cc as describeRegionValueKind, ci as explicitRoleArnOrThrow, cl as synthesisStatusMessage, cn as findNestedStackTypeChanges, co as unwrittenCreateOnlyReplacement, cs as printingCorpusOf, ct as namesAnyDeclaredParameter, d as conditionInputsFrom, da as malformedLocalResourcesWarning, dc as hasReasonlessBaselineRefusal, di as AWS_CREDENTIAL_ENV_KEYS, dl as loadCdkJson, do as hasNoCloudControlHandlers, ds as shareLogOnlyValues, dt as noEchoAttributeNamesOf, ea as displayLogicalId, ec as CrossPrefixReadError, ei as INTRINSIC_KEYS, el as runDockerStreaming, en as isReplacementOrphan, eo as repairMalformedResourcePropertiesForReadOnly, er as refusesFinalSnapshot, es as recordedNoEchoValuesOf, et as formatResourceLine, f as parentSuppliedValues, fa as malformedOrphanRecordsRefusalMessage, fc as hasUnverifiableParameterRefusal, fi as applyCallerIdentityCredentials, fl as resolveApp, fo as findReplacedReadersOfRecreateTargets, fs as unionOfSecretBags, ft as noEchoComparisonForTemplate, g as mergeNoChangeOutputs, ga as malformedOrphansWarning, gc as orphansAfterRollback, gi as keepHeldTokenProvenance, gl as resolveStateBucketWithDefault, gn as updatePartialReason, go as isStatefulRecreateTargetSync, gs as maskSecretsInText, gt as makeSiblingClaimReader, h as keptWholeReasonText, ha as malformedOrphansRefusalMessage, hc as isReadableBag, hl as resolveSkipPrefix, hn as updatePartialMessage, ho as isStatefulRecreateTargetForReplace, hs as maskSecretsInError, ht as createReadOnlyAttributeHealerFactory, i as childTemplateLoader, ia as isReadableOrphanRecord, ic as isAccessDenied, ii as refuseUnreadableCdkCrossAccountRefs, il as stripForDisplay, in as recordUnderIdIsNotOwn, io as unreadableResourceEntries, ir as findDestructiveChanges, is as createUnionSecretMasker, it as green, j as recordedProtectionEvidence, ja as refuseMalformedOrphansForDestroy, jc as getBootstrapMarkerKey, ji as parameterTypeMayLoseSecretIdentity, jl as canonicalizeRegion, jn as isExportAliasCollision, jt as displacedOpClause, k as withResourceDeadline, ka as refuseMalformedOrphanRecordsForDestroy, kc as assertAssetBucketRegion, ki as coerceParameterTypedValue, kl as expectedOwnerParam, kn as collectDeclaredOutputNames, kr as readsNoEchoDeleteValues, ks as inheritNestedStackParameterAssociations, kt as sameJournaledOrphans, l as templateIdentity, la as malformedLocalOutputsWarning, lc as exportNamesCarriedFrom, li as isIamRoleArn, ll as getDefaultStateBucketName, lr as withCreateTokenLedger, ls as recordLogOnlyParameterValue, lt as reachableDivergentParameters, m as isSecretBearingReferenceString, ma as malformedOrphanRowsKeptWarning, mc as importableOutputs, mi as envCredentialsAreAssumedRole, ml as resolveCaptureObservedState, mo as MULTI_REGION_RECREATE_BLOCKED_TYPES, ms as errorCauseChain, mt as noEchoParameterNamesOf, n as crossStackOutputProvenanceSource, na as hasReadableOutputs, nc as applyCrossPrefixScan, ni as poisonRenderedSpellingsCollidingIn, nl as escapeRegExp, nn as planRollback, no as unpreviewableOrphanRecords, nr as maskingRetryLogger, ns as liveMatchesUnresolvedTokenFrame, nt as cyan, o as isAbsoluteAssetPath, oa as malformedDriftResourcePropertiesWarning, oc as splitImportedOps, oi as assertFlagRoleArn, ol as getDockerImageBySourceHash, on as resolveReplacementOldType, oo as findActionableSilentDrops, os as literalSplitDelimitersOf, ot as yellow, p as readRecordedConditionVerdicts, pa as malformedOrphanRecordsWarning, pc as importableOutputKeys, pi as callerEnvCredentials, pl as resolveAutoAssetStorage, po as shownType, ps as createSecretMasker, pt as noEchoExactEchoLeavesOf, qa as refuseMalformedResourcesForDestroy, qc as isDockerClientEnvKey, qi as JSON_LISTING_HOLE_VALUE, ql as injectedAwsRegionValue, qn as ATOMIC_FINAL_SNAPSHOT_TYPES, qo as maskedLeafCoordinatesOf, qs as TEMPLATE_SOURCED_RULES, r as inheritedProvenanceForChildDiff, ra as hasReadableResources, rc as crossPrefixDeniedWarning, ri as producerLookupOver, rl as stripControlChars, rn as recheckFailedPlan, ro as unreadableOrphanRecords, rr as constructPathOf, rs as carryLogOnlyValues, rt as gray, s as listNestedTemplateRows, sa as malformedExportNamesWarning, sc as acceptedCreateOnlyDropsOf, si as assertSendableRoleArn, sl as Synthesizer, sn as seedsDeleteFirstGuard, sr as ledgerForStack, ss as logOnlyValueCount, st as computeParameterTaint, t as DeployEngine, ta as hasReadableOrphans, tc as CrossPrefixScanCache, ti as IntrinsicFunctionResolver, tl as warnFinchArgvExposure, tn as planFailedOps, to as repairMalformedResourcesForReadOnly, tr as unsupportedFinalSnapshotError, ts as valueAtCoordinate, tt as bold, u as conditionFingerprint, ua as malformedLocalResourceEntriesWarning, uc as hasReadableExportSet, ui as sendableAssumeRoleCommand, ul as getLegacyStateBucketName, un as inheritProducerRegions, uo as NO_CC_HANDLERS_REASON, us as recordLogOnlyValue, ut as resourcesNamingDeclaredParameter, va as malformedOutputsWarning, vc as shouldRetainResource, vi as recordedOutputReferenceRegions, vl as resolveUseCdkBootstrapAssets, vn as WITHHELD_NAME_DISPLAY, vt as DeploymentEventsReader, w as keptForReadoption, wa as malformedStateRefusalMessage, wc as createAssetRedirectResolver, wl as MIGRATE_TMP_PREFIX, wn as carriedExportAliasExposure, wr as ccBrokenReason, ws as DYNAMIC_REFERENCE_TOKEN_SCAN, wt as dropFailedHint, xa as malformedResourcePropertiesWarning, xc as stringifyValue, xl as ssmResolvedValueType, xn as secretBearing, xs as scrubResourceRecord, xt as resolvePendingCloudControlRequests, ya as malformedRenderedContainersWarning, yc as AssetPublisher, yi as recordedReferenceRegions, yl as stateBucketExistenceConfirmed, yn as displayTextOrWithheld, yt as DeploymentEventsStore, za as refuseMalformedResourceEntriesForImport, zc as resolveDockerContextDirectory, zi as cfnRefValueFromPhysicalId, zl as nullPrototypeRecord, zn as orphanRecordsPrintingBag, zr as RollbackInlinePolicyWriters, zs as recordMaskOnlyValuesIn, zt as withNestedRevertRun } from "./deploy-engine-BIPU9Xdh.js";
-import { t as getCdkdVersion } from "./version-Bft5jrTk.js";
+import { $ as resolvePendingCloudControlRequests, $a as repairMalformedOutputsForReadOnly, $c as warnFinchArgvExposure, $i as accountArgs, $n as buildFinalSnapshotIdentifier, $o as readbackPathFor, $r as DiffCalculator, $s as CrossPrefixScanCache, $t as namesAnyDeclaredParameter, A as findServiceTokenRefusals, Aa as refuseMalformedOrphanRecordsForDestroy, Ac as isCrossRegionRedirect, Ai as coerceParameterTypedValue, Al as derivePartitionAndUrlSuffix, An as gray, Ar as isCustomResourceType$1, As as inheritNestedStackParameterAssociations, At as removeProtectionTypeList, B as parentSuppliedValues, Ba as refuseMalformedResourceEntriesForImport, Bc as describeDockerFailure, Bi as cfnRefValueFromPhysicalId, Bl as describeFileReadFailure, Bn as journaledOrphanPrintingBag, Br as UNSPECIFIED_SKIP_REASON, Bs as recordMaskOnlyValuesIn, Bt as resolveReplacementOldType, Ca as malformedResourcesWarning, Cc as loadPublishableAssetManifest, Ci as applyCallerIdentityCredentials, Cl as findLargeInlineResources, Cr as ProviderRegistry, Cs as withPhysicalNameCopies, Ct as formatResourceLine, D as crossStackOutputProvenanceSource, Da as refuseDivergentRecordRegionForDestroy, Dc as assertAssetBucketRegion, Di as classifyReplaySecretRegion, Dl as expectedOwnerParam, Ds as isUncertifiedBaselineMaskPosition, E as computeImplicitDeleteEdges, Ea as previewableOrphanRecords, Ec as BOOTSTRAP_MARKER_PREFIX, Ei as classifyRecordedSecretRegion, El as decodeListingKey, En as withStackRecords, Er as wouldReturnToSdkProvider, Es as dynamicReferenceTokens, F as listNestedTemplateRows, Fa as refuseMalformedOutputsForDestroy, Fc as buildDenyExternalAccessPolicy, Fi as carriesDynamicReference, Fl as hasOwnKey, Fn as noEchoComparisonForTemplate, Fo as templateResourceTypes, Fr as customResourceResponseExpirationWarning, Fs as recordPhysicalNameCopy, Ft as planFailedOps, G as keptWholeReasonText, Ga as refuseMalformedResourcePropertiesForExport, Gc as isDockerClientEnvKey, Gi as parameterInputsFor, Gl as injectedAwsRegionValue, Gn as secretNamePrintingBags, Go as maskAtCoordinates, Gr as isWaitAbandonedError, Gs as STATE_SOURCED_CROSS_GENERATION_RULES, Gt as inheritProducerRegions, H as withResourceDeadline, Ha as refuseMalformedResourceEntriesForOrphan, Hc as finchSecretArgvRefusal, Hi as refStateLookupFromResource, Hl as renderAssemblyPathEscape, Hn as namingSecretsWithRecordedNoEcho, Ho as TemplateParser, Hr as deleteLeftInPlace, Hs as recordNoEchoParameterFreshValue, Ht as orphanNeedsIdentity, I as renderNestedTemplateTreeDefect, Ia as refuseMalformedResourceAttributesForOrphan, Ic as buildDockerImage, Ii as carriesFetchableDynamicReference, Il as hasPlainPrototype, In as noEchoExactEchoLeavesOf, Io as describeTypeWithThrottleRetry, Ir as CloudControlProvider, Is as splitGetAttStringForm, It as planRollback, J as makeSiblingClaimReader, Ja as refuseMalformedResourcesForDestroy, Jc as redactDockerArgvValues, Ji as JSON_LISTING_HOLE_VALUE, Jn as stateSecretNameNeedles, Jo as maskedLeafCoordinatesOf, Js as LockManager, K as mergeNoChangeOutputs, Ka as refuseMalformedResourcePropertiesForOrphan, Kc as isMalformedEnvKey, Ko as maskReadbackAtCoordinates, Ks as WHOLE_DYNAMIC_REFERENCE_PATTERN, L as templateIdentity, La as refuseMalformedResourceEntries, Lc as resolveDockerContextDirectory, Li as isNamelessDynamicReferenceError, Ll as nullPrototypeRecord, Ln as noEchoParameterNamesOf, Lo as withRetry, Lr as slowCcOperationTimeoutMs, Ls as carriesSecretMask, Lt as recheckFailedPlan, M as childTemplateLoader, Ma as refuseMalformedOrphansForDestroy, Mc as readBootstrapMarkerBody, Mi as parameterTypeMayLoseSecretIdentity, Ml as StageLoadError, Mn as red, Mr as withPrintingSecrets, Mt as demoteSupersededOrphans, N as findNestedTemplateTreeDefect, Na as refuseMalformedOrphansForOrphan, Nc as validateAssetBucketName, Ni as getAccountInfo, Nl as processStackMessages, Nn as yellow, Nr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ns as physicalNameCopiesOf, Nt as isJournaledOrphan, O as inheritedProvenanceForChildDiff, Oc as ensureAssetStorage, Oi as producerRegionsFromState, Ol as PARTITION_TABLE, On as bold, Or as TemplateNoEchoReresolver, Os as pathCrossesDottedKey, Ot as replayFailedOperations, P as isAbsoluteAssetPath, Pa as refuseMalformedOutputs, Pc as validateContainerRepoName, Pi as isImpossibleEmptyStoredAttribute, Pl as defineOwnKey, Pn as noEchoAttributeNamesOf, Po as prefetchCreateOnlyPropertyPaths, Pr as applyCustomResourceResponseExpiration, Pt as isReplacementOrphan, Q as pendingRequestCount, Qa as repairMalformedOrphansForReadOnly, Qc as runDockerStreaming, Qi as UNREADABLE_RESOURCES_MAP_ROW, Qn as PRE_DELETE_SNAPSHOT_TYPES, Qs as CrossPrefixReadError, Qt as computeParameterTaint, R as conditionFingerprint, Ra as refuseMalformedResourceEntriesForDeploy, Rc as describeDockerCapturedOutput, Ri as keepsSecretReferenceToken, Rl as ownValue, Rn as createReadOnlyAttributeHealerFactory, Rs as provenPublicValue, Rt as recordUnderIdIsNotOwn, Sa as malformedResourcePropertiesWarning, Sc as createAssetRedirectResolver, Si as AWS_CREDENTIAL_ENV_KEYS, Sl as MIGRATE_TMP_PREFIX, Sn as formatDestructiveChange, Sr as CC_BROKEN_REASON, Ss as scrubResourceRecord, St as sameJournaledOrphans, T as IMPLICIT_DELETE_DEPENDENCIES, Ta as malformedStateRefusalMessage, Tc as AssetModeResolver, Ti as envCredentialsAreAssumedRole, Tl as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Tr as isCustomResource, Ts as DYNAMIC_REFERENCE_TOKEN_SCAN, U as diffSecurity, Ua as refuseMalformedResourcePropertiesForDestroy, Uc as formatDockerLoginError, Ul as resolveAssemblyPath, Un as orphanRecordsPrintingBag, Uo as canonicalCoordinates, Ur as deleteSkipReason, Us as recordProvenPublicExpression, Ut as findNestedStackTypeChanges, V as readRecordedConditionVerdicts, Va as refuseMalformedResourceEntriesForImportSave, Vc as dockerSpawnEnvWithSensitive, Vi as isStalePlaceholderArnAttribute, Vl as displayAssemblyPath, Vn as maskEventTextWithBoundBags, Vo as DagBuilder, Vr as deleteIndeterminateGuards, Vs as recordNoEchoAttributeValues, Vt as seedsDeleteFirstGuard, W as isSecretBearingReferenceString, Wa as refuseMalformedResourcePropertiesForDrift, Wc as getDockerCmd, Wi as withSharedDrainBudget, Wl as injectAwsRegion, Wn as secretNamePrintingBag, Wo as isMarkedCoordinate, Ws as wholeStringLeavesOf, X as DeploymentEventsReader, Xa as refuseMalformedState, Xc as redactedDockerCause, Xi as STATE_RESOURCES_MALFORMED, Xn as extractDeploymentEventError, Xo as noEchoLeavesOf, Xs as S3StateBackend, Xt as updatePartialMessage, Y as planOrphanAdoption, Ya as refuseMalformedResourcesForExport, Yc as redactedCause, Yi as STATE_REGION_DIVERGED, Yn as storedSecretNameNeedles, Yo as noEchoCoordinatesOf, Ys as isLockInfoExpired, Z as DeploymentEventsStore, Za as repairMalformedOrphanRecordsForReadOnly, Zc as runDockerForeground, Zi as UNREADABLE_ORPHANS_CONTAINER_ROW, Zn as ATOMIC_FINAL_SNAPSHOT_TYPES, Zo as noEchoOutputsComparison, Zs as rebuildClientForBucketRegion, Zt as updatePartialReason, _a as malformedOrphansWarning, _c as AssetPublisher, _i as assertFlagRoleArn, _l as stateBucketExistenceConfirmed, _n as DEFAULT_RESOURCE_TIMEOUT_MS, _o as isStatefulRecreateTargetSync, _s as maskSecretsInError, _t as dropFailedHint, a as isProtectionValueActive, aa as isReadableOrphanRecord, ac as acceptedCreateOnlyDropsOf, al as Synthesizer, an as secretBearing, ao as unreadableResourceEntries, ar as unsupportedFinalSnapshotError, as as carryLogOnlyValues, at as dropSettledNestedJournals, ba as malformedRenderedContainersWarning, bc as WorkGraph, bi as isIamRoleArn, bl as CFN_TEMPLATE_BODY_LIMIT, bn as constructPathOf, bt as loadJournaledOrphans, ca as malformedExportNamesWarning, cc as hasReadableExportSet, cl as getLegacyStateBucketName, cn as carriedExportAliasExposure, cs as literalSplitDelimitersOf, ct as recordDisplacedSkips, da as malformedLocalResourceEntriesWarning, dc as importableOutputKeys, di as refuseUnreadableCdkCrossAccountRefs, dl as resolveAutoAssetStorage, dn as isWholeDynamicReferenceValue, do as NO_CC_HANDLERS_REASON, ds as recordLogOnlyParameterValue, dt as withNestedRevertRun, ea as deployRefusesOrphanRowsReason, ec as applyCrossPrefixScan, ei as INTRINSIC_KEYS, el as escapeRegExp, en as reachableDivergentParameters, eo as repairMalformedResourceEntriesForReadOnly, er as ccRoutedFinalSnapshotError, es as readsNoEchoSource, et as keptForReadoption, fa as malformedLocalResourcesWarning, fc as importableOutputs, fi as keepHeldTokenProvenance, fl as resolveCaptureObservedState, fn as noEchoParameterValueSeed, fo as hasNoCloudControlHandlers, fs as recordLogOnlyValue, ft as collectNestedChildUnaddressed, ga as malformedOrphansRefusalMessage, gc as shouldRetainResource, gi as applyRoleArnIfSet, gl as resolveUseCdkBootstrapAssets, gn as bindingSkippedOutputs, go as isStatefulRecreateTargetForReplace, gs as errorCauseChain, gt as dropFailedCommands, ha as malformedOrphanRowsKeptWarning, hc as orphansCarriedFrom, hi as recordedReferenceRegions, hl as resolveStateBucketWithDefaultAndSource, hn as isExportAliasCollision, ho as MULTI_REGION_RECREATE_BLOCKED_TYPES, hs as createSecretMasker, ht as deleteJournaledOrphans, i as PROTECTION_PROPERTY_BY_TYPE, ia as hasReadableResources, ic as splitImportedOps, il as getDockerImageBySourceHash, in as exportAliasCollisionScrubWarning, io as unreadableOrphanRecords, ir as refusesFinalSnapshot, is as liveMatchesUnresolvedTokenFrame, it as displacedPhysicalIdShown, j as serviceTokenBlockingReason, ja as refuseMalformedOrphans, jc as parseBootstrapMarker, ji as isUnboundTemplateParameter, jl as AssemblyReader, jn as green, js as recordNestedStackParameterExpressions, jt as recordAfterRollbackUpdate, k as deferredServiceTokenWarning, ka as refuseMalformedOrphanRecords, kc as getBootstrapMarkerKey, ki as regionLessSecretName, kl as canonicalizeRegion, kn as cyan, kr as readsNoEchoDeleteValues, ks as identityKeyFor, kt as replayRollback, la as malformedExportSourceWarning, lc as hasReasonlessBaselineRefusal, li as resolveDynamicReferences, ll as loadCdkJson, ln as exportNameNoEchoParameters, lo as unwrittenCreateOnlyReplacement, lr as withCreateTokenLedger, ls as logOnlyValueCount, ma as malformedOrphanRecordsWarning, mc as orphansAfterRollback, mi as recordedOutputReferenceRegions, ml as resolveStateBucketWithDefault, mn as collectPublishedOutputNames, mo as shownType, ms as unionOfSecretBags, mt as withNestedStackContext, n as recordedProtectionEvidence, na as hasReadableOrphans, nc as isAccessDenied, ni as poisonRenderedSpellingsCollidingIn, nl as stripForDisplay, nn as WITHHELD_NAME_DISPLAY, no as repairMalformedResourcesForReadOnly, nr as effectiveDeletionPolicy, ns as valueAtCoordinate, nt as NESTED_PENDING_PARENT_REASON, o as perType, oa as isReadableResourceEntry, oc as describeRegionValueKind, ol as synthesisStatusMessage, on as secretBearingStateKeyWarning, oo as withheldAccountClause, os as createUnionSecretMasker, pa as malformedOrphanRecordsRefusalMessage, pc as isReadableBag, pl as resolveSkipPrefix, pn as collectDeclaredOutputNames, po as findReplacedReadersOfRecreateTargets, ps as shareLogOnlyValues, pt as getCurrentNestedStackContext, q as makeCanonicalizePropertiesFn, qa as refuseMalformedResourcesForDeploy, qc as partitionSensitiveEnv, qi as declaresNoEcho, ql as resolveBucketRegion, qn as secretNamedRecordNeedles, qo as maskWholeValue, qs as isSingleDynamicReferenceToken, r as recordedProtectionNote, ra as hasReadableOutputs, rc as isNotImplemented, rl as AssetManifestLoader, rn as displayTextOrWithheld, ro as unpreviewableOrphanRecords, rr as isFinalSnapshotError, rs as redactForState, rt as displacedOpClause, s as readProtection, sa as malformedDriftResourcePropertiesWarning, sc as exportNamesCarriedFrom, sl as getDefaultStateBucketName, sn as secretSafeKeyDisplay, so as findActionableSilentDrops, sr as ledgerForStack, ss as hasMaskableValues, st as nestedChildStackName$1, t as DeployEngine, ta as displayLogicalId, tc as crossPrefixDeniedWarning, ti as IntrinsicFunctionResolver, tl as stripControlChars, tn as resourcesNamingDeclaredParameter, to as repairMalformedResourcePropertiesForReadOnly, tr as createPreDeleteFinalSnapshot, ts as recordedNoEchoValuesOf, tt as recordRetainedForReadoption, ua as malformedLocalOutputsWarning, uc as hasUnverifiableParameterRefusal, ui as producerLookupOver, ul as resolveApp, un as exportNameSecretExposure, us as printingCorpusOf, ut as revertedNestedRowIds, va as malformedOutputsRefusalMessage, vc as isSensitiveAttributeName, vi as assertSendableRoleArn, vl as warnDeprecatedNoPrefixCliFlag, vn as DEFAULT_RESOURCE_WARN_AFTER_MS, vo as renderStatefulReason, vs as maskSecretsInText, vt as isHandledOrphan, wa as malformedScrubResourceEntriesRefusalMessage, wc as rewriteTemplateAssetReferences, wi as callerEnvCredentials, wl as uploadCfnTemplate, wn as destroyStackRecordsView, wr as ccBrokenReason, xa as malformedResourceEntriesWarning, xc as buildAssetRedirectMap, xi as sendableAssumeRoleCommand, xl as CFN_TEMPLATE_URL_LIMIT, xn as findDestructiveChanges, xt as makeForeignHolderScan, ya as malformedOutputsWarning, yc as stringifyValue, yi as explicitRoleArnOrThrow, yl as ssmResolvedValueType, yn as maskingRetryLogger, yt as journaledOrphanLines, z as conditionInputsFrom, za as refuseMalformedResourceEntriesForDestroy, zc as describeDockerExecFailure, zi as AWS_NO_VALUE, zl as absoluteAssemblyPathEscape, zn as completedReplayEntries, zr as RollbackInlinePolicyWriters, zs as recordMaskOnlyValue, zt as replacementNeverSwapped } from "./deploy-engine-D1z0QUsv.js";
+import { t as getCdkdVersion } from "./version-CnjZ9J4l.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -2559,7 +2559,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-BSUoljqw.js");
+	providerClasses ??= import("./provider-classes-CR4DtD8M.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -4982,7 +4982,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		if (Object.hasOwn(bound, name)) templateParameters[name] = bound[name];
 	} catch (error) {
 		unboundParameterNames.add(name);
-		logger.debug(`Diff parameter binding for stack ${displayStackName(stackName)} is partial: ${error instanceof Error ? error.message : String(error)}`);
+		logger.debug(`Diff parameter binding for stack ${displayStackName(stackName)} is partial: ${describeAwsFailure(error).detail}`);
 	}
 	mergedParameters = {
 		...parameters,
@@ -5064,7 +5064,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		effectiveTemplate = new TemplateParser().filterResourcesByCondition(template, conditions);
 		everyConditionKnown = unboundParameterNames.size === 0 && unknownConditions.size === 0;
 	} catch (error) {
-		logger.debug(`Diff condition evaluation for stack ${displayStackName(stackName)} skipped: ${error instanceof Error ? error.message : String(error)}`);
+		logger.debug(`Diff condition evaluation for stack ${displayStackName(stackName)} skipped: ${describeAwsFailure(error).detail}`);
 	}
 	if (mismatchedRecords.length > 0) logger.warn(safeMsg`Stack ${displayStackName(stackName)}: condition(s) ${mismatchedRecords.map((name) => displayIdent(name)).join(", ")} read a secret-fed parameter and changed since the last deploy, or one of their inputs did. This diff cannot tell which branch the next deploy takes, and shows each Fn::If on them as its FALSE branch.`);
 	const stillUnknown = [...unknownConditions].filter((name) => !Object.hasOwn(recordedVerdicts, name));
@@ -7031,7 +7031,10 @@ function redactUnaccountedOutputs(positioned, stored, accountedKeys, secrets) {
 	let repaired;
 	for (const [key, value] of Object.entries(stored)) {
 		if (accountedKeys.has(key)) continue;
-		const next = redactSecretsForState(value, secrets);
+		const next = redactForState(value, {
+			provenance: "value-scan",
+			secrets
+		});
 		if (JSON.stringify(next) === JSON.stringify(value)) continue;
 		repaired ??= { ...positioned };
 		repaired[key] = next;
@@ -7230,7 +7233,7 @@ async function resolveForeignRegionTokens(leaf, stackName, ctx) {
 		if (verdict.kind === "named-region") {
 			const resolver = "recorded" in verdict ? ctx.resolvers.forRecordedRegion(verdict.region) : ctx.resolvers.forRegion(verdict.region);
 			try {
-				out += await resolver.resolveDynamicReferences(token, {
+				out += await resolveDynamicReferences(resolver, token, {
 					template: { Resources: {} },
 					resources: {},
 					recordedSecretValues: ctx.recordedSecretValues
@@ -8395,7 +8398,10 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		};
 		const holdsRecordedPlaintext = (value) => {
 			const needles = new Map([...allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets), ...outputSecrets]);
-			return JSON.stringify(redactSecretsForState(value, needles)) !== JSON.stringify(value);
+			return JSON.stringify(redactForState(value, {
+				provenance: "value-scan",
+				secrets: needles
+			})) !== JSON.stringify(value);
 		};
 		const noEchoPublicTokens = /* @__PURE__ */ new Set([region, stack.stackName]);
 		const totalSecrets = outputSecrets.size + [...perResourceSecrets.values()].reduce((n, m) => n + m.size, 0) + [...orphanSecrets.values()].reduce((n, m) => n + m.size, 0);
@@ -8430,7 +8436,11 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const ownSecrets = secrets ?? /* @__PURE__ */ new Map();
 			const positioned = templateProps ? {
 				...record,
-				properties: redactSecretsForState(record.properties, ownSecrets, templateProps, TEMPLATE_SOURCED_RULES)
+				properties: redactForState(record.properties, {
+					provenance: "template-sourced",
+					secrets: ownSecrets,
+					source: templateProps
+				})
 			} : record;
 			const scrubbed = secrets || templateProps ? scrubResourceRecord(positioned, ownSecrets, void 0, STATE_SOURCED_CROSS_GENERATION_RULES) : record;
 			const plan = noEchoPlans.byLogicalId.get(logicalId);
@@ -8454,7 +8464,10 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			};
 		});
 		const crossStackNeedles = allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets);
-		const redactCrossStackName = (name) => redactSecretsForState(name, crossStackNeedles);
+		const redactCrossStackName = (name) => redactForState(name, {
+			provenance: "value-scan",
+			secrets: crossStackNeedles
+		});
 		const newImports = state.imports?.map((entry) => {
 			const exportName = redactCrossStackName(entry.exportName);
 			if (exportName === entry.exportName) return entry;
@@ -8483,7 +8496,14 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const producer = list === "imports" ? `producer ${displayStackName(maskSecretsInText(entry.sourceStack, crossStackNeedles))}, ` : "";
 			logger.warn(safeMsg`Scrub of ${shownStack}: state.${list}[${index}] (${producer}${displayIdent(String(entry.sourceRegion))}) ` + "holds a cross-stack read name in plaintext that has the shape of a secret-bearing read in today's template but not the secret's current value — most likely a value from before the secret was ROTATED. Scrub cannot repair it (it matches only the current value) and does not print it; treat that earlier value as exposed. A deploy " + safeMsg`that updates ${shownStack} rewrites this list from the reads it performs.`);
 		}
-		const noEchoMaskedOutputs = maskScrubNoEchoOutputs(redactUnaccountedOutputs(outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsSourceUntrusted ? void 0 : outputsTemplateSource, TEMPLATE_SOURCED_RULES) : state.outputs, state.outputs, accountedOutputKeys, allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets)), noEchoPlans.outputKeys, new Set(Object.keys(stack.template.Outputs ?? {})), declaredAliasOf);
+		const noEchoMaskedOutputs = maskScrubNoEchoOutputs(redactUnaccountedOutputs(outputSecrets.size > 0 ? redactForState(state.outputs, outputsSourceUntrusted ? {
+			provenance: "value-scan",
+			secrets: outputSecrets
+		} : {
+			provenance: "template-sourced",
+			secrets: outputSecrets,
+			source: outputsTemplateSource
+		}) : state.outputs, state.outputs, accountedOutputKeys, allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets)), noEchoPlans.outputKeys, new Set(Object.keys(stack.template.Outputs ?? {})), declaredAliasOf);
 		emitAbandonedScanNotes();
 		let newOutputs = noEchoMaskedOutputs;
 		let newExportNames = state.exportNames;
@@ -9863,7 +9883,7 @@ async function driftProducerRegionEvidence(state, stackName, region, stateBacken
 async function resolveDriftLeafByRegion(leaf, propertyPath, logicalId, consumerRegion, producerRegions, resolvers, ctx, recordedRegions) {
 	const verdicts = dynamicReferenceTokens(leaf).map((token) => [token, classifyRecordedSecretRegion(token, consumerRegion, producerRegions, recordedRegions)]);
 	for (const [, verdict] of verdicts) if (verdict.kind === "ambiguous") throw regionAmbiguousDriftSecretError(logicalId, propertyPath, verdict.secretName, verdict.foreignProducerRegions, consumerRegion);
-	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region" || verdict.kind === "recorded-region")) return await resolvers.primary.resolveDynamicReferences(leaf, ctx);
+	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region" || verdict.kind === "recorded-region")) return await resolveDynamicReferences(resolvers.primary, leaf, ctx);
 	let out = "";
 	let cursor = 0;
 	for (const [token, verdict] of verdicts) {
@@ -9871,7 +9891,7 @@ async function resolveDriftLeafByRegion(leaf, propertyPath, logicalId, consumerR
 		if (at < 0) throw new DriftSecretRefusalError(`${logicalId}${propertyPath === "" ? "" : ` property '${propertyPath}'`}: could not locate a scanned dynamic reference in the value it was scanned from. Refusing rather than resolving it in '${consumerRegion}', which would be the wrong region for a reference that names another one. This is an internal invariant failure — please report it with the resource type and property path.`, "DRIFT_SECRET_TOKEN_SCAN_MISMATCH");
 		out += leaf.slice(cursor, at);
 		const resolver = verdict.kind === "named-region" ? resolvers.forRegion(verdict.region) : verdict.kind === "recorded-region" ? resolvers.forRecordedRegion(verdict.region) : resolvers.primary;
-		out += await resolver.resolveDynamicReferences(token, ctx);
+		out += await resolveDynamicReferences(resolver, token, ctx);
 		cursor = at + token.length;
 	}
 	return out + leaf.slice(cursor);
@@ -9976,7 +9996,10 @@ function isSecretBearingPath(path, secretPaths) {
 	return false;
 }
 function redactDriftValue(value, secrets, secretBearing) {
-	const redacted = redactSecretsForState(value, secrets);
+	const redacted = redactForState(value, {
+		provenance: "value-scan",
+		secrets
+	});
 	if (!secretBearing) return redacted;
 	if (redacted === void 0 || redacted === null) return redacted;
 	if (typeof redacted === "string" && isSingleDynamicReferenceToken(redacted)) return redacted;
@@ -10459,7 +10482,11 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 					setAtPath(newBaseline, change.path, change.awsValue);
 					accepted.push(change);
 				}
-				const redactedBaseline = withPhysicalNameCopies(outcome.secrets, otherPhysicalIds(report.state.resources, outcome.logicalId), () => redactSecretsForState(newBaseline, outcome.secrets, existing.properties ?? {}, hasObserved ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES));
+				const redactedBaseline = withPhysicalNameCopies(outcome.secrets, otherPhysicalIds(report.state.resources, outcome.logicalId), () => redactForState(newBaseline, {
+					provenance: hasObserved ? "state-baseline" : "state-readback",
+					secrets: outcome.secrets,
+					source: existing.properties ?? {}
+				}));
 				let recordedChanges = 0;
 				for (const change of accepted) {
 					if (deepEqualUnordered(getAtPath(redactedBaseline, change.path), change.awsValue)) {
@@ -11036,7 +11063,11 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 						try {
 							if (updateResult?.effectiveProperties) {
 								const delta = collectNarrowedTopLevelKeys(newProperties, updateResult.effectiveProperties);
-								if (Object.keys(delta).length > 0) narrowedByLogicalId.set(outcome.logicalId, keepBaselineAtUncertifiedPaths(redactSecretsForState(delta, secrets, revertBaseline, stateResource.observedProperties !== void 0 ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES), [...outcome.uncertifiedPaths, ...outcome.noEchoParameterPaths ?? []], revertBaseline));
+								if (Object.keys(delta).length > 0) narrowedByLogicalId.set(outcome.logicalId, keepBaselineAtUncertifiedPaths(redactForState(delta, {
+									provenance: stateResource.observedProperties !== void 0 ? "state-baseline" : "state-readback",
+									secrets,
+									source: revertBaseline
+								}), [...outcome.uncertifiedPaths, ...outcome.noEchoParameterPaths ?? []], revertBaseline));
 							}
 						} catch (captureErr) {
 							logger.warn(`  ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, but the provider's reported effective properties could not be read — ${maskSecretsInText(describeAwsFailure(captureErr).detail, secrets)}`);
@@ -11045,7 +11076,10 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 							if (updateResult !== void 0) {
 								const noEchoDeclared = recordNoEchoAttributeValues(updateResult, secrets, newProperties);
 								const next = recordAfterRollbackUpdate(stateResource, updateResult);
-								const keptAttributes = next.attributes === void 0 ? void 0 : keepRecordedAttributesOverMask(redactSecretsForState(next.attributes, secrets), next.attributes, stateResource.attributes, noEchoDeclared);
+								const keptAttributes = next.attributes === void 0 ? void 0 : keepRecordedAttributesOverMask(redactForState(next.attributes, {
+									provenance: "value-scan",
+									secrets
+								}), next.attributes, stateResource.attributes, noEchoDeclared);
 								const declaredNames = noEchoAttributeNamesOf(stateResource) ?? [];
 								const attributes = keptAttributes === void 0 || declaredNames.length === 0 ? keptAttributes : Object.fromEntries(Object.entries(keptAttributes).map(([name, value]) => [name, declaredNames.includes(name) ? maskWholeValue(value) : value]));
 								if (next.physicalId !== stateResource.physicalId || !sameRecordedJson(attributes, stateResource.attributes)) reRecordedByLogicalId.set(outcome.logicalId, {
@@ -11705,7 +11739,7 @@ async function resolveSecretDerivedPrincipals(values, region, producerRegions, r
 }
 async function resolveEntry(entry, primary, verdictOf, context) {
 	const tokens = dynamicReferenceTokens(entry).map((t) => [t, verdictOf(t)]);
-	if (!tokens.some(([, v]) => v.kind === "recorded-region")) return await primary.resolveDynamicReferences(entry, context);
+	if (!tokens.some(([, v]) => v.kind === "recorded-region")) return await resolveDynamicReferences(primary, entry, context);
 	let out = "";
 	let cursor = 0;
 	for (const [token, verdict] of tokens) {
@@ -11713,7 +11747,7 @@ async function resolveEntry(entry, primary, verdictOf, context) {
 		if (at < 0) throw new Error("A scanned dynamic reference is not in the entry it was scanned from");
 		out += entry.slice(cursor, at);
 		const resolver = verdict.kind === "recorded-region" ? primary.resolverForRecordedRegion(verdict.region) : primary;
-		out += await resolver.resolveDynamicReferences(token, context);
+		out += await resolveDynamicReferences(resolver, token, context);
 		cursor = at + token.length;
 	}
 	return out + entry.slice(cursor);
@@ -12629,7 +12663,7 @@ async function purgeEventsAfterDestroy(reader, stackName, region, opts, logger)
 		else if ((purge.earlierVersions?.deletedBodies ?? 0) > 0) logger.info(safeMsg`  Purged earlier deployment-event versions left under the deployments/ prefix of ${displaySafe(stackName)} (${displaySafe(region)}), unless a warning above says otherwise.`);
 		return purge;
 	} catch (purgeError) {
-		logger.warn(`  Failed to purge deployment-event history for ${displaySafe(stackName)}: ${displaySafe(purgeError instanceof Error ? purgeError.message : String(purgeError))}`);
+		logger.warn(`  Failed to purge deployment-event history for ${displaySafe(stackName)}: ${displaySafe(describeAwsFailure(purgeError).detail)}`);
 		return null;
 	}
 }
@@ -12757,7 +12791,7 @@ async function destroyCommand(stackArgs, options) {
 				}
 				throw named;
 			}
-			synthError = error instanceof Error ? error : new Error(String(error));
+			synthError = error instanceof Error ? error : new Error(safeStringify(error));
 			logger.debug("Could not synthesize app, falling back to state-based stack list");
 		}
 		const stackPatterns = stackArgs.length > 0 ? stackArgs : options.stack ? [options.stack] : [];
@@ -13230,7 +13264,7 @@ var PublicSsmProver = class {
 			skipDynamicReferences: true
 		};
 		try {
-			await this.resolver.resolveDynamicReferences(token, context);
+			await resolveDynamicReferences(this.resolver, token, context);
 		} catch (err) {
 			const name = err instanceof Error ? err.name : typeof err;
 			this.logger.debug(safeMsg`Could not prove an ssm dynamic reference public (${name}); a leaf embedding it ` + `keeps its {{resolve:...}} expression in observedProperties.`);
@@ -13409,7 +13443,7 @@ var AttributeFetcher = class {
 		} catch (err) {
 			return {
 				ok: false,
-				reason: `no provider available for ${orphan.resourceType}: ${err instanceof Error ? err.message : String(err)}`
+				reason: `no provider available for ${orphan.resourceType}: ${describeAwsFailure(err).detail}`
 			};
 		}
 		if (!provider.getAttribute) return this.cacheFallback(orphanLogicalId, attribute, `provider for ${orphan.resourceType} does not implement getAttribute`);
@@ -14777,7 +14811,7 @@ const securityGroupRuleLookupRetryDelays = {};
 const MAX_SG_RULE_THROTTLE_RETRIES = 4;
 function isAuthorizationShapedError(err) {
 	const errName = err instanceof Error ? err.name : "";
-	const message = err instanceof Error ? err.message : String(err);
+	const message = describeAwsFailure(err).detail;
 	return /AccessDenied|UnauthorizedOperation|AuthFailure|not authorized to perform/i.test(`${errName} ${message}`);
 }
 async function describeAllSecurityGroupRules(groupId, ec2Client) {
@@ -14805,7 +14839,7 @@ async function describeAllSecurityGroupRules(groupId, ec2Client) {
 				...securityGroupRuleLookupRetryDelays.sleep ? { sleep: securityGroupRuleLookupRetryDelays.sleep } : {}
 			});
 		} catch (err) {
-			const detail = err instanceof Error ? err.message : String(err);
+			const detail = describeAwsFailure(err).detail;
 			return {
 				ok: false,
 				kind: isAuthorizationShapedError(err) ? "auth" : isThrottlingError(err) ? "throttled" : "failed",
@@ -15198,7 +15232,7 @@ async function exportCommand(stackArg, options) {
 					await handler(entry);
 					logger.info(`  ${preDeletedLine(entry.physicalId)}`);
 				} catch (err) {
-					const msg = err instanceof Error ? err.message : String(err);
+					const msg = describeAwsFailure(err).detail;
 					const orphan = orphanCommandFor(resolvedStackName, targetRegion, lockRecovery);
 					throw new Error(`Phase 1 (IMPORT) succeeded; pre-delete of ${plainOrNotShown(entry.logicalId)} (${plainOrNotShown(entry.resourceType)}, physicalId: ${recordValueOrNotShown(entry.physicalId)}) failed: ${displayAwsMessage(msg)}\n\nThe CloudFormation stack ${quotedOrNotShown(cfnStackName)} contains the phase-1 imports but the IMPORT-unsupported resources (${recreateBeforePhase2.length} total) still exist in AWS unmanaged. cdkd state is UNCHANGED. Re-running \`cdkd export\` does NOT work — the existing-stack check rejects it. To recover manually:\n  1. Fix the failure cause (typically IAM permissions for the underlying AWS API — iam:Delete{Role,User,Group}Policy for an inline policy).\n  2. Delete the remaining AWS-side IMPORT-unsupported resources by hand:\n` + preDeleteManualCommands(recreateBeforePhase2).map((line) => `       ${line}\n`).join("") + `     (one per entry in the pre-delete list logged above).
   3. Run the phase-2 UPDATE manually with the full synth template:
@@ -15217,7 +15251,7 @@ async function exportCommand(stackArg, options) {
 				if (recreateBeforePhase2.length > 0) parts.push(`${recreateBeforePhase2.length} IMPORT-unsupported resource(s) re-CREATEd`);
 				logger.info(`✓ Phase 2: ${parts.join("; ")}.`);
 			} catch (err) {
-				const msg = err instanceof Error ? err.message : String(err);
+				const msg = describeAwsFailure(err).detail;
 				const recreateNote = recreateBeforePhase2.length > 0 ? `  - cdkd deleted ${recreateBeforePhase2.length} AWS resource(s) before phase 2 (Stage etc.). They are gone in AWS but absent from the CFn stack. Running phase 2 UPDATE manually will CFn-CREATE them fresh.\n` : "";
 				const orphan = orphanCommandFor(resolvedStackName, targetRegion, lockRecovery);
 				throw new Error(`Phase 1 (IMPORT) succeeded; phase 2 (UPDATE) failed: ${displayAwsMessage(msg)}\n\nThe CloudFormation stack ${quotedOrNotShown(cfnStackName)} now contains the imported resources but is missing ${phase2Count} resource(s) (${phase2Creates.length} Custom Resource(s) + ${recreateBeforePhase2.length} IMPORT-unsupported). cdkd state is UNCHANGED so you can inspect what's in it, but DO NOT run \`cdkd deploy\` against this stack (the imported resources are now CFn-managed). To recover:\n` + recreateNote + `  1. Fix the failure cause (typically an onCreate Lambda error).
@@ -15233,7 +15267,7 @@ async function exportCommand(stackArg, options) {
 			});
 		} finally {
 			if (!options.dryRun) await lockManager.releaseLock(resolvedStackName, targetRegion).catch((err) => {
-				logger.warn(`Failed to release lock: ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`Failed to release lock: ${describeAwsFailure(err).detail}`);
 			});
 		}
 	} finally {
@@ -15304,7 +15338,7 @@ async function assertCfnStackAbsent(cfnClient, stackName) {
 		if (!stack) return;
 		throw new Error(`CloudFormation stack ${quotedOrNotShown(stackName)} already exists (status: ${stack.StackStatus ?? "unknown"}). cdkd export only creates new stacks via IMPORT — delete or rename the existing stack first, or pass --cfn-stack-name to choose a different name.`);
 	} catch (err) {
-		const msg = err instanceof Error ? err.message : String(err);
+		const msg = describeAwsFailure(err).detail;
 		if (/does not exist/i.test(msg)) return;
 		throw err;
 	}
@@ -15856,7 +15890,7 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 			blocked.push({
 				logicalId,
 				resourceType,
-				reason: "could not resolve resource identifier: " + (err instanceof Error ? err.message : String(err)),
+				reason: "could not resolve resource identifier: " + describeAwsFailure(err).detail,
 				...err instanceof RepairableRefusal ? { repair: err.repair } : {}
 			});
 			continue;
@@ -16045,7 +16079,7 @@ async function resolveResourceIdentifier(resourceType, logicalId, physicalId, pr
 	try {
 		result = splitter(physicalId, properties);
 	} catch (err) {
-		throw new Error(`composite-id splitter for ${resourceType} failed: ` + (err instanceof Error ? err.message : String(err)));
+		throw new Error(`composite-id splitter for ${resourceType} failed: ` + describeAwsFailure(err).detail);
 	}
 	for (const f of entry.fields) if (!(f in result.resourceIdentifier)) throw new Error(`composite-id splitter for ${resourceType} did not produce field '${f}' (produced: ${Object.keys(result.resourceIdentifier).join(", ")})`);
 	return result;
@@ -16084,7 +16118,7 @@ async function fetchPrimaryIdentifier(resourceType, cfnClient) {
 			}
 		}
 	} catch (err) {
-		const msg = err instanceof Error ? err.message : String(err);
+		const msg = describeAwsFailure(err).detail;
 		getLogger().debug(`DescribeType failed for ${quotedOrNotShown(resourceType)}: ${safeDetail(msg)} — using fallback`);
 	}
 	const fallback = PRIMARY_IDENTIFIER_FALLBACK[resourceType];
@@ -16496,7 +16530,7 @@ async function runTemplateUploadCleanup(cleanup, bucket) {
 	try {
 		await cleanup();
 	} catch (cleanupErr) {
-		const msg = cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr);
+		const msg = describeAwsFailure(cleanupErr).detail;
 		logger.warn(`Failed to delete temporary template upload from ${quotedOrNotShown(bucket)}. Clean up manually under prefix 'cdkd-migrate-tmp/'. Cause: ${safeDetail(msg)}`);
 	}
 }
@@ -16529,7 +16563,7 @@ async function submitImportChangeSet(cfnClient, stackName, template, resourcesTo
 				]
 			}));
 		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
+			const msg = describeAwsFailure(err).detail;
 			throw new Error(`Failed to create IMPORT changeset: ${displayAwsMessage(msg)}`);
 		}
 		try {
@@ -16870,7 +16904,7 @@ async function runPerStackImportLoop(args) {
 	try {
 		resolved = await resolveAll();
 	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
+		const message = describeAwsFailure(err).detail;
 		const plannable = message.startsWith("buildResolvedParametersPerStack:") || err instanceof SsmChildParameterRefusalError;
 		if (!options.dryRun || !plannable) throw err;
 		logger.warn(safeMsg`${message} --dry-run plans without the nested stacks' Parameter values; a real run ` + `refuses here.`);
@@ -17005,7 +17039,7 @@ async function runPerStackImportLoop(args) {
 					try {
 						return await step();
 					} catch (err) {
-						throw new Error(`${what} failed for cdkd stack ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}), after its Phase 1A IMPORT succeeded. Cause: ${displayAwsMessage(err instanceof Error ? err.message : String(err))}\n` + nestedResumeTail(i, stage), { cause: err instanceof Error ? err : void 0 });
+						throw new Error(`${what} failed for cdkd stack ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}), after its Phase 1A IMPORT succeeded. Cause: ${displayAwsMessage(describeAwsFailure(err).detail)}\n` + nestedResumeTail(i, stage), { cause: err instanceof Error ? err : void 0 });
 					}
 				};
 				const phase1ATemplate = filterTemplateForImport(plan.template, plan.phase1Imports);
@@ -17019,7 +17053,7 @@ async function runPerStackImportLoop(args) {
 				try {
 					await submitImportChangeSet(deps.cfnClient, plan.cfnName, phase1ATemplate, phase1AResources, stackParameters, plan.templateFormat, deps.uploadOpts);
 				} catch (err) {
-					throw new Error(`Phase 1A IMPORT changeset failed for cdkd stack ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}). Cause: ${displayAwsMessage(err instanceof Error ? err.message : String(err))}\n` + nestedResumeTail(i, "phase1"), { cause: err instanceof Error ? err : void 0 });
+					throw new Error(`Phase 1A IMPORT changeset failed for cdkd stack ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}). Cause: ${displayAwsMessage(describeAwsFailure(err).detail)}\n` + nestedResumeTail(i, "phase1"), { cause: err instanceof Error ? err : void 0 });
 				}
 				const cfnArn = await afterImport("Reading its CloudFormation stack", "imported", async () => {
 					const arn = (await deps.cfnClient.send(new DescribeStacksCommand({ StackName: plan.cfnName }))).Stacks?.[0]?.StackId;
@@ -17072,7 +17106,7 @@ async function runPerStackImportLoop(args) {
 						await submitImportChangeSet(deps.cfnClient, plan.cfnName, phase1BTemplate, phase1BResources, stackParameters, plan.templateFormat, deps.uploadOpts);
 					} catch (err) {
 						const importedSummary = importedStacks.length > 0 ? importedStacks.map((s) => `${quotedOrNotShown(s.cdkdStackName)} → ${quotedOrNotShown(s.cfnStackName)}`).join(", ") : "(none)";
-						throw new Error(`Phase 1B (nested-child adoption) IMPORT changeset failed for parent ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}). The parent CFn stack exists with its ${plan.phase1Imports.length} leaf resource(s); ${plan.nestedStackRows.length} nested-child adoption(s) did NOT complete. Stacks IMPORTed so far (each a CFn stack): ${importedSummary}. cdkd state for every stack in the tree is preserved. To recover, fix the underlying cause (typically a template-match validation error per AWS-docs "Nested stack import validation"), then re-attempt the parent-side nested adoption by hand via the AWS console or CLI, per the AWS docs "Nest an existing stack" procedure. Do NOT run cdkd destroy on the tree: that would tear down the live AWS resources. Cause: ${displayAwsMessage(err instanceof Error ? err.message : String(err))}\n` + nestedResumeTail(i, "imported"), { cause: err instanceof Error ? err : void 0 });
+						throw new Error(`Phase 1B (nested-child adoption) IMPORT changeset failed for parent ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}). The parent CFn stack exists with its ${plan.phase1Imports.length} leaf resource(s); ${plan.nestedStackRows.length} nested-child adoption(s) did NOT complete. Stacks IMPORTed so far (each a CFn stack): ${importedSummary}. cdkd state for every stack in the tree is preserved. To recover, fix the underlying cause (typically a template-match validation error per AWS-docs "Nested stack import validation"), then re-attempt the parent-side nested adoption by hand via the AWS console or CLI, per the AWS docs "Nest an existing stack" procedure. Do NOT run cdkd destroy on the tree: that would tear down the live AWS resources. Cause: ${displayAwsMessage(describeAwsFailure(err).detail)}\n` + nestedResumeTail(i, "imported"), { cause: err instanceof Error ? err : void 0 });
 					}
 					logger.info(`  ✓ Phase 1B: parent ${quotedOrNotShown(plan.cfnName)} adopted ${plan.nestedStackRows.length} nested child(ren) via UPDATE-IMPORT.`);
 					if (plan.cdkdName !== rootStackName) {
@@ -17087,7 +17121,7 @@ async function runPerStackImportLoop(args) {
 					try {
 						await handler(entry);
 					} catch (err) {
-						const msg = err instanceof Error ? err.message : String(err);
+						const msg = describeAwsFailure(err).detail;
 						const importedSummary = importedStacks.map((s) => `${quotedOrNotShown(s.cdkdStackName)} → ${quotedOrNotShown(s.cfnStackName)}`).join(", ");
 						throw new Error(`Phase 1 (IMPORT) succeeded for cdkd stack ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}); pre-delete of ${plainOrNotShown(entry.logicalId)} (${plainOrNotShown(entry.resourceType)}, physicalId: ${recordValueOrNotShown(entry.physicalId)}) failed: ${displayAwsMessage(msg)}\n\nStacks IMPORTed so far (each CFn-managed): ${importedSummary}. cdkd state for every stack in the tree is preserved. This stack's IMPORT-unsupported resources may still exist in AWS unmanaged. To recover: fix the failure cause, delete the remaining pre-delete resources of this stack by hand:\n` + preDeleteManualCommands(plan.recreateBeforePhase2).map((line) => `  ${line}\n`).join("") + `then run the phase-2 UPDATE for ${quotedOrNotShown(plan.cfnName)} by hand with its full synth template. ` + nestedResumeTail(i, "phase2"), { cause: err instanceof Error ? err : void 0 });
 					}
@@ -17103,7 +17137,7 @@ async function runPerStackImportLoop(args) {
 					try {
 						await executeUpdateChangeSet(deps.cfnClient, plan.cfnName, phase2Template, stackParameters, plan.templateFormat, deps.uploadOpts);
 					} catch (err) {
-						throw new Error(`Phase 2 (UPDATE) failed for cdkd stack ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}): ${displayAwsMessage(err instanceof Error ? err.message : String(err))}. Its phase-1 IMPORT succeeded and cdkd state is preserved; fix the cause and run the phase-2 UPDATE by hand with its full synth template. ` + nestedResumeTail(i, "phase2"), { cause: err instanceof Error ? err : void 0 });
+						throw new Error(`Phase 2 (UPDATE) failed for cdkd stack ${quotedOrNotShown(plan.cdkdName)} (CFn name ${quotedOrNotShown(plan.cfnName)}): ${displayAwsMessage(describeAwsFailure(err).detail)}. Its phase-1 IMPORT succeeded and cdkd state is preserved; fix the cause and run the phase-2 UPDATE by hand with its full synth template. ` + nestedResumeTail(i, "phase2"), { cause: err instanceof Error ? err : void 0 });
 					}
 					logger.info(`  ✓ Phase 2: stack ${quotedOrNotShown(plan.cfnName)} updated (${plan.phase2Creates.length} non-importable CREATE, ${plan.recreateBeforePhase2.length} re-CREATE).`);
 				}
@@ -17116,7 +17150,7 @@ async function runPerStackImportLoop(args) {
 				stateDeletionFailures.push({
 					stackName: node.stackName,
 					region: node.region,
-					reason: err instanceof Error ? err.message : String(err)
+					reason: describeAwsFailure(err).detail
 				});
 				const orphan = orphanCommandFor(node.stackName, node.region, args.lockRecovery);
 				logger.warn(`Failed to delete cdkd state for ${quotedOrNotShown(node.stackName)} (${quotedRegion(node.region)}): ${safeDetail(err)}. The stack IS CFn-managed; clean up its state record.${orphan.note}\nClean up with: ${orphan.command}`);
@@ -17196,7 +17230,7 @@ async function executeUpdateChangeSet(cfnClient, stackName, template, parameters
 				]
 			}));
 		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
+			const msg = describeAwsFailure(err).detail;
 			throw new Error(`Failed to create UPDATE changeset: ${displayAwsMessage(msg)}`);
 		}
 		try {
@@ -19042,7 +19076,11 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 						logger.warn(safeMsg`  ✗ ${displayStackName(stackName)}/${displayIdent(logicalId)} ` + safeMsg`(${displayIdent(resource.resourceType)}): ` + `not found in AWS — it was deleted outside cdkd; 'cdkd drift' reports it as deleted.`);
 						return;
 					}
-					resource.observedProperties = redactSecretsForState(maskReadbackAtCoordinates(observed, resource.properties ?? {}, [...maskedLeafCoordinatesOf(resource.properties ?? {}), ...noEchoLeavesOf(resource) ?? []]), await publicSsmProver.proofBagFor(resource.properties ?? {}), resource.properties ?? {}, STATE_SOURCED_BASELINE_RULES);
+					resource.observedProperties = redactForState(maskReadbackAtCoordinates(observed, resource.properties ?? {}, [...maskedLeafCoordinatesOf(resource.properties ?? {}), ...noEchoLeavesOf(resource) ?? []]), {
+						provenance: "state-baseline",
+						secrets: await publicSsmProver.proofBagFor(resource.properties ?? {}),
+						source: resource.properties ?? {}
+					});
 					if (logicalId === acceptId) {
 						delete resource.observedBaselineRefused;
 						delete resource.observedBaselineRefusalReason;
@@ -19127,7 +19165,7 @@ function rerunRollback(stackName) {
 }
 function backendErrorText(error, stackName, region) {
 	if (!isPasteableIdent(stackName) || !isPasteableIdent(region)) return "its error text names a stack or region that is not a plain identifier, so it is not shown";
-	return displaySafe(error instanceof Error ? error.message : String(error));
+	return displaySafe(describeAwsFailure(error).detail);
 }
 function stackRegionShown(stackName, region) {
 	return `${plainOrDescribed(stackName, "stack name")} (${plainOrDescribed(region, "region")})`;
@@ -21483,7 +21521,7 @@ function parseResourceOverrides(flags, mappingFile, mappingInline) {
 		try {
 			raw = readFileSync(mappingFile, "utf-8");
 		} catch (err) {
-			throw new Error(`Failed to read --resource-mapping file '${mappingFile}': ` + (err instanceof Error ? err.message : String(err)));
+			throw new Error(`Failed to read --resource-mapping file '${mappingFile}': ` + describeAwsFailure(err).detail);
 		}
 		const parsed = parseMappingJson(raw, `--resource-mapping file '${mappingFile}'`);
 		for (const [key, value] of Object.entries(parsed)) map.set(key, value);
@@ -21504,7 +21542,7 @@ function parseMappingJson(raw, source) {
 	try {
 		parsed = JSON.parse(raw);
 	} catch (err) {
-		throw new Error(`Failed to parse ${source} as JSON: ` + (err instanceof Error ? err.message : String(err)));
+		throw new Error(`Failed to parse ${source} as JSON: ` + describeAwsFailure(err).detail);
 	}
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`${source} must be a JSON object {logicalId: physicalId}`);
 	const out = {};
@@ -21523,7 +21561,7 @@ function writeRecordedMapping(filePath, rows) {
 		writeFileSync(filePath, body, "utf-8");
 		logger.info(`Wrote resolved mapping to ${filePath} (${Object.keys(map).length} entry(ies))`);
 	} catch (err) {
-		const msg = err instanceof Error ? err.message : String(err);
+		const msg = describeAwsFailure(err).detail;
 		logger.error(`Failed to write --record-resource-mapping file '${filePath}': ${msg}. Continuing — the import already resolved every physical id in memory.`);
 	}
 }
@@ -21748,7 +21786,12 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 				...baseContext,
 				recordedSecretValues
 			});
-			resource.properties = recordedSecretValues.size > 0 ? redactSecretsForState(markSameGenerationBag(resolved), recordedSecretValues, unresolvedProperties) : resolved;
+			resource.properties = recordedSecretValues.size > 0 ? redactForState(resolved, {
+				provenance: "template-derived",
+				secrets: recordedSecretValues,
+				source: unresolvedProperties,
+				generation: "same-generation"
+			}) : resolved;
 			noEchoInputs.set(logicalId, {
 				template: unresolvedProperties,
 				resolved,
@@ -21758,7 +21801,10 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 			logger.warn(`Failed to resolve intrinsics in Properties for imported resource ${logicalIdShown(logicalId)} (${resourceTypeShown(resource.resourceType)}): ${maskSecretsInText(describeAwsFailure(err).detail, recordedSecretValues)}.\nState will be written with the raw intrinsic shape, which may cause 'cdkd destroy' to fail on this resource — re-import once every referenced sibling is in state, or remove this resource from state with 'cdkd orphan <StackPath>/<Path/To/Resource>'.` + (unboundParameterNames.length > 0 ? ` This template also declares parameter(s) with no 'Default' that an import cannot bind (${unboundParameterNames.map((name) => plainOrDescribed(name, "parameter name")).join(", ")}), and 'cdkd import' accepts no parameter values — if this property was built from one of those, re-importing a sibling will not change it: give the parameter a 'Default' in the template and re-import, or correct the recorded properties before the next 'cdkd deploy'.` : ""));
 			threw = true;
 		}
-		if (recordedSecretValues.size > 0 && resource.attributes !== void 0) resource.attributes = redactSecretsForState(resource.attributes, recordedSecretValues);
+		if (recordedSecretValues.size > 0 && resource.attributes !== void 0) resource.attributes = redactForState(resource.attributes, {
+			provenance: "value-scan",
+			secrets: recordedSecretValues
+		});
 		const dependsOnDivergent = parameterTaint?.refused.has(logicalId) === true;
 		if (dependsOnDivergent) unsafeObservedBaselineLogicalIds.unverifiableParameter.add(logicalId);
 		if (threw || dependsOnDivergent) {
@@ -22031,7 +22077,11 @@ async function captureObservedForImportedResources(stackState, providerRegistry,
 			const observed = await provider.readCurrentState(resource.physicalId, logicalId, resource.resourceType, resource.properties ?? {}, buildReadCurrentStateContext(stackState, logicalId));
 			if (observed !== void 0 && observed !== RESOURCE_NOT_FOUND) {
 				const marked = noEchoLeavesOf(resource) ?? [];
-				resource.observedProperties = redactSecretsForState(marked.length > 0 ? maskReadbackAtCoordinates(observed, resource.properties ?? {}, marked) : observed, NO_RECORDED_SECRETS, resource.properties ?? {}, STATE_SOURCED_BASELINE_RULES);
+				resource.observedProperties = redactForState(marked.length > 0 ? maskReadbackAtCoordinates(observed, resource.properties ?? {}, marked) : observed, {
+					provenance: "state-baseline",
+					secrets: NO_RECORDED_SECRETS,
+					source: resource.properties ?? {}
+				});
 			}
 		} catch (err) {
 			logger.debug(`observedProperties capture for imported ${logicalId} (${resource.resourceType}) failed: ${err instanceof Error ? err.name : typeof err} — drift will fall back to template properties for this resource until the next successful deploy.`);
@@ -22154,12 +22204,12 @@ function readNestedChildTemplate(templatePath, childLogicalId) {
 	try {
 		raw = readFileSync(templatePath, "utf-8");
 	} catch (err) {
-		throw new Error(`Failed to read nested-stack template for '${childLogicalId}' at ${templatePath}: ${err instanceof Error ? err.message : String(err)}`);
+		throw new Error(`Failed to read nested-stack template for '${childLogicalId}' at ${templatePath}: ${describeAwsFailure(err).detail}`);
 	}
 	try {
 		return JSON.parse(raw);
 	} catch (err) {
-		throw new Error(`Failed to parse nested-stack template for '${childLogicalId}' at ${templatePath}: ${err instanceof Error ? err.message : String(err)}`);
+		throw new Error(`Failed to parse nested-stack template for '${childLogicalId}' at ${templatePath}: ${describeAwsFailure(err).detail}`);
 	}
 }
 function indexGrandchildTemplatePaths(childTemplate, childTemplatePath) {
@@ -25151,7 +25201,7 @@ async function localStartApiCommand(target, options) {
 			logger.info(`Pre-warming ${groupSpecs.size} container(s) for ${group.displayName}...`);
 			const handles = await Promise.allSettled([...groupSpecs.keys()].map((id) => groupPool.acquire(id)));
 			for (const result of handles) if (result.status === "fulfilled") groupPool.release(result.value);
-			else logger.warn(`Pre-warm failed for one Lambda in ${group.displayName} (cold start cost will apply on first request): ${result.reason instanceof Error ? result.reason.message : String(result.reason)}`);
+			else logger.warn(`Pre-warm failed for one Lambda in ${group.displayName} (cold start cost will apply on first request): ${describeAwsFailure(result.reason).detail}`);
 		}
 		const defaultRegion = canonicalizeRegion(options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? void 0);
 		const started = await startApiServer({
@@ -25301,34 +25351,34 @@ async function localStartApiCommand(target, options) {
 		if (watcher) try {
 			await watcher.close();
 		} catch (err) {
-			logger.warn(`watcher.close() failed: ${err instanceof Error ? err.message : String(err)}`);
+			logger.warn(`watcher.close() failed: ${describeAwsFailure(err).detail}`);
 		}
 		await Promise.allSettled(wsServers.map(async (ws) => {
 			try {
 				await ws.attached.close();
 			} catch (err) {
-				logger.warn(`WebSocket close() failed for ${ws.api.apiLogicalId}: ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`WebSocket close() failed for ${ws.api.apiLogicalId}: ${describeAwsFailure(err).detail}`);
 			}
 		}));
 		await Promise.allSettled(servers.map(async ({ server, group }) => {
 			try {
 				await server.close();
 			} catch (err) {
-				logger.warn(`server.close() failed for ${group.displayName}: ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`server.close() failed for ${group.displayName}: ${describeAwsFailure(err).detail}`);
 			}
 		}));
 		await Promise.allSettled(wsServers.map(async (ws) => {
 			try {
 				await ws.server.close();
 			} catch (err) {
-				logger.warn(`WebSocket server.close() failed for ${ws.api.apiLogicalId}: ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`WebSocket server.close() failed for ${ws.api.apiLogicalId}: ${describeAwsFailure(err).detail}`);
 			}
 		}));
 		await Promise.allSettled(servers.map(async ({ server, group }) => {
 			try {
 				await server.getServerState().pool.dispose();
 			} catch (err) {
-				logger.warn(`pool.dispose() failed for ${group.displayName}: ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`pool.dispose() failed for ${group.displayName}: ${describeAwsFailure(err).detail}`);
 			}
 		}));
 		if (retiredPoolDisposals.size > 0) {
@@ -25339,7 +25389,7 @@ async function localStartApiCommand(target, options) {
 			try {
 				await ws.server.getServerState().pool.dispose();
 			} catch (err) {
-				logger.warn(`WebSocket pool.dispose() failed for ${ws.api.apiLogicalId}: ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`WebSocket pool.dispose() failed for ${ws.api.apiLogicalId}: ${describeAwsFailure(err).detail}`);
 			}
 		}));
 		for (const dir of inlineTmpDirs) try {
@@ -25348,7 +25398,7 @@ async function localStartApiCommand(target, options) {
 				force: true
 			});
 		} catch (err) {
-			logger.warn(`Failed to remove inline-code tmpdir ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.warn(`Failed to remove inline-code tmpdir ${dir}: ${describeAwsFailure(err).detail}`);
 		}
 		for (const dir of layerTmpDirs) try {
 			rmSync(dir, {
@@ -25356,12 +25406,12 @@ async function localStartApiCommand(target, options) {
 				force: true
 			});
 		} catch (err) {
-			logger.warn(`Failed to remove merged-layers tmpdir ${dir}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.warn(`Failed to remove merged-layers tmpdir ${dir}: ${describeAwsFailure(err).detail}`);
 		}
 		if (profileCredsFile) try {
 			await profileCredsFile.dispose();
 		} catch (err) {
-			logger.warn(`Failed to remove profile credentials tmpdir ${profileCredsFile.hostPath}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.warn(`Failed to remove profile credentials tmpdir ${profileCredsFile.hostPath}: ${describeAwsFailure(err).detail}`);
 		}
 	});
 	const shutdown = async (signal, exitCode) => {
@@ -25865,13 +25915,13 @@ function readEnvOverridesFile$3(filePath) {
 	try {
 		raw = readFileSync(filePath, "utf-8");
 	} catch (err) {
-		throw new Error(`Failed to read --env-vars file '${filePath}': ${err instanceof Error ? err.message : String(err)}`);
+		throw new Error(`Failed to read --env-vars file '${filePath}': ${describeAwsFailure(err).detail}`);
 	}
 	let parsed;
 	try {
 		parsed = JSON.parse(raw);
 	} catch (err) {
-		throw new Error(`Failed to parse --env-vars file '${filePath}' as JSON: ${err instanceof Error ? err.message : String(err)}`);
+		throw new Error(`Failed to parse --env-vars file '${filePath}' as JSON: ${describeAwsFailure(err).detail}`);
 	}
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`--env-vars file '${filePath}' must contain a JSON object at the top level.`);
 	return parsed;
@@ -26033,7 +26083,7 @@ async function reloadAllServers(args) {
 		const previousState = booted.server.setServerState(newState);
 		booted.group = group;
 		const disposal = previousState.pool.dispose().catch((err) => {
-			logger.debug(`Previous pool dispose() failed for ${group.displayName}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.debug(`Previous pool dispose() failed for ${group.displayName}: ${describeAwsFailure(err).detail}`);
 		});
 		retiredPoolDisposals?.add(disposal);
 		disposal.then(() => retiredPoolDisposals?.delete(disposal));
@@ -29501,4 +29551,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { resolveSecretDerivedPrincipals as a, buildProgram, isResolvableSecretPrincipalList as i, runDestroyForStack as n, canonicalizeIpProtocolValue as o, holdsUnprovenSecretPrincipalToken as r, resolvedResourceTimeoutMs as s, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-DYfZCsxM.js.map
+//# sourceMappingURL=program-Cqk1ZTsY.js.map