@go-to-k/cdkd 0.301.5 → 0.301.6

package/dist/{deploy-engine-HAvm8vSI.js → deploy-engine-D1z0QUsv.js}

@@ -2,7 +2,7 @@ import { r as getAwsClients, s as __exportAll } from "./aws-clients-B_CEQGE1.js"
 import { A as UNRENDERABLE, B as safeMsg, C as looksLikeCdkdGeneratedName, D as SAFE_MSG_ALTERED_CHAR, E as withoutGeneratedFallbackName, F as displaySafe, H as terminalSafe, I as displayStackName, L as isPasteableIdent, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, S as getCurrentStackName, T as withStackName, U as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, j as asIsMessage, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
 import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, An as SHELL_ACTIVE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, Ct as RETRY_AUXILIARY_OWNER, Dn as normalizeAwsError, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as isUpdateUnsupportedError, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as withheldTargetClause, Ht as recoveryCommandFlags, In as pasteableCommand, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as isNameCooldownError, Kn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as physicalIdShownBesideCommand, M as quotedRemedyLogicalId, Mn as UNSHOWABLE_VALUE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Ot as hasCreatedBeforeFailure, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as plainOrDescribed, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Ut as sanitizeRecoveryValue, Vn as shellQuote, Vt as formatLockOwner, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isReplayedNameCollisionFrom, Yn as isRecreateRetryableError, Yt as producerRecordKey, Zt as withPasteableAwsProfile, _t as createMaskedLogSinks, ar as isRetryableTransientError, at as startInterruptWatch, bn as ResourceUpdateNotSupportedError, bt as maskDeep, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dr as markNonRetryable, en as clientDefaultsFor, er as formatRetryClassificationSignals, f as removalWarning, fr as markRedactedCause, ft as logicalIdShown, gt as stateOrphanRecordRemedy, hn as MalformedProducerRecordRefusalError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isIamPropagationError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as SHELL_ACTIVE_WHY, jt as markAuxiliaryFailure, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DynamicReferenceRegionAmbiguousError, lr as isMarkedNonRetryable, m as withoutInjectedRemovals, mn as MacroExpansionError, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, on as CrossAccountSecretRefusalError, or as isTransientServerError, ot as ElapsedBudgetRegistry, pn as LockError, pr as wrapMaskedAwsError, qn as isNameCollisionErrorFrom, rn as AssetError, sn as DependencyError, sr as retryClassificationText, st as monotonicNowMs, tn as credentialFingerprint, tr as isAmbiguousCcHandlerErrorCode, un as IntrinsicResolutionRefusalError, ur as isThrottlingError, ut as compositeIdSeparatorRefusal, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as SynthesisError, wt as carryCreatedBeforeFailure, xt as maskerOrIdentity, yn as ResourceTimeoutError, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-BkeM7IXi.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-DBXBcg0J.js";
-import { t as getCdkdVersion } from "./version-2jeKJQlt.js";
+import { t as getCdkdVersion } from "./version-CnjZ9J4l.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -10409,6 +10409,34 @@ function wildcardOverlapsResolvedPlaintext(send, wildcards, secrets) {
 	return false;
 }
 
+//#endregion
+//#region src/deployment/secret-redaction/context.ts
+const RULES_BY_PROVENANCE = {
+	"template-derived": TEMPLATE_DERIVED_RULES,
+	"template-sourced": TEMPLATE_SOURCED_RULES,
+	"state-readback": STATE_SOURCED_READBACK_RULES,
+	"state-baseline": STATE_SOURCED_BASELINE_RULES,
+	"state-cross-generation": STATE_SOURCED_CROSS_GENERATION_RULES,
+	"state-derived": STATE_DERIVED_RULES
+};
+function redactForState(bag, context) {
+	if (context.provenance === "value-scan") return redactSecretsForState(bag, context.secrets);
+	const rules = RULES_BY_PROVENANCE[context.provenance];
+	if (context.provenance !== "template-derived" || context.generation !== "same-generation" || !isPlainBag(bag)) return redactSecretsForState(bag, context.secrets, context.source, rules);
+	const marked = markSameGenerationBag(shallowCopy(bag));
+	const redacted = redactSecretsForState(marked, context.secrets, context.source, rules);
+	return redacted === marked ? shallowCopy(marked) : redacted;
+}
+function isPlainBag(bag) {
+	if (Array.isArray(bag)) return true;
+	if (bag === null || typeof bag !== "object") return false;
+	const proto = Object.getPrototypeOf(bag);
+	return proto === Object.prototype || proto === null;
+}
+function shallowCopy(bag) {
+	return Array.isArray(bag) ? [...bag] : { ...bag };
+}
+
 //#endregion
 //#region src/deployment/secret-redaction/noecho-leaves.ts
 const SUB_VARIABLE$2 = /\$\{([^}!][^}]*)\}/g;
@@ -20367,7 +20395,7 @@ function maskSecretsRaw(resolver, text, context) {
 	return needled !== text ? "***" : registered;
 }
 function abandonedUnit(resolver, unit, subject, error, context, rawInput, preRedact) {
-	const raw = error instanceof Error ? error.message : String(error);
+	const raw = describeAwsFailure(error).detail;
 	return {
 		unit,
 		subject: displayMasked(resolver, subject, context),
@@ -20680,7 +20708,7 @@ var CfnFallbackCache = class {
 			};
 			return;
 		} catch (error) {
-			this.deps.logger().warn(`Fn::ImportValue: CloudFormation ListExports fallback failed for export ${quotedRender(displayMasked(this.deps.resolver, exportName, context), "'")} (region ${this.deps.resolverRegion}): ${displayMasked(this.deps.resolver, error instanceof Error ? error.message : String(error), context)}. Grant cloudformation:ListExports to resolve exports from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
+			this.deps.logger().warn(`Fn::ImportValue: CloudFormation ListExports fallback failed for export ${quotedRender(displayMasked(this.deps.resolver, exportName, context), "'")} (region ${this.deps.resolverRegion}): ${displayMasked(this.deps.resolver, describeAwsFailure(error).detail, context)}. Grant cloudformation:ListExports to resolve exports from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
 			return;
 		}
 	}
@@ -20708,7 +20736,7 @@ var CfnFallbackCache = class {
 		try {
 			return await fetch;
 		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
+			const message = describeAwsFailure(error).detail;
 			const resolver = this.deps.resolver;
 			const cfnNameMask = positionalNameMask(resolver, [[stackName, displayMasked(resolver, stackName, context)], [region, displayMasked(resolver, loggedRegionText, context)]]);
 			this.deps.logger().warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack ${displayMaskedIdent(resolver, stackName, context, STACK_REF_MAX_CODE_POINTS)} (${displayMaskedIdent(resolver, loggedRegionText, context)}): ${displayAwsMessage(displayMasked(resolver, cfnNameMask ? cfnNameMask(message) : message, context))}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
@@ -21266,7 +21294,7 @@ async function readsPinnedVersion(token, pin, { resolver, context }) {
 		return !served.includes("{{resolve:") && served.length < 4 ? "short" : "read";
 	} catch (err) {
 		if (isDeliberateResolutionRefusal(err)) throw err;
-		resolver.logger.debug(safeMsg`Pinned read of ${displayMasked(resolver, token, context)} failed: ${displayMasked(resolver, err instanceof Error ? err.message : String(err), context)}`);
+		resolver.logger.debug(safeMsg`Pinned read of ${displayMasked(resolver, token, context)} failed: ${displayMasked(resolver, describeAwsFailure(err).detail, context)}`);
 		if (!isThrottlingError(err)) {
 			if (failed === void 0) {
 				failed = /* @__PURE__ */ new Set();
@@ -21386,7 +21414,7 @@ async function resolveImportValue(resolver, importValueArg, context) {
 		try {
 			entry = await context.exportIndex.lookup(exportName);
 		} catch (err) {
-			resolver.logger.warn(`Exports index lookup failed for ${quotedRender(loggedExportName, "'", "an export whose name is not a plain identifier")}: ${displayMasked(resolver, err instanceof Error ? err.message : String(err), context)}; falling back to state.json scan`);
+			resolver.logger.warn(`Exports index lookup failed for ${quotedRender(loggedExportName, "'", "an export whose name is not a plain identifier")}: ${displayMasked(resolver, describeAwsFailure(err).detail, context)}; falling back to state.json scan`);
 			entry = void 0;
 		}
 		if (entry && (!context.stackName || entry.producerStack !== context.stackName)) {
@@ -21428,7 +21456,7 @@ async function resolveImportValue(resolver, importValueArg, context) {
 					producerStack: refStack,
 					producerRegion: lookupRegion
 				}).catch((err) => {
-					resolver.logger.debug(`Failed to patch exports index for ${quotedRender(displayMasked(resolver, exportName, context), "'", "an export whose name is not a plain identifier")}: ${displayMasked(resolver, err instanceof Error ? err.message : String(err), context)}`);
+					resolver.logger.debug(`Failed to patch exports index for ${quotedRender(displayMasked(resolver, exportName, context), "'", "an export whose name is not a plain identifier")}: ${displayMasked(resolver, describeAwsFailure(err).detail, context)}`);
 				});
 				recordImport(resolver, context, exportName, refStack, lookupRegion);
 				found = {
@@ -21440,7 +21468,7 @@ async function resolveImportValue(resolver, importValueArg, context) {
 				break;
 			}
 		} catch (error) {
-			resolver.logger.warn(`Failed to read state for stack ${displayMasked(resolver, refStack, context)}: ${displayMasked(resolver, error instanceof Error ? error.message : String(error), context)}`);
+			resolver.logger.warn(`Failed to read state for stack ${displayMasked(resolver, refStack, context)}: ${displayMasked(resolver, describeAwsFailure(error).detail, context)}`);
 			continue;
 		}
 	}
@@ -21655,7 +21683,7 @@ function describeInnermostAwsError(error) {
 		if (cause === null || typeof cause !== "object") break;
 		innermost = cause;
 	}
-	if (!(innermost instanceof Error)) return displayAwsMessage(String(innermost));
+	if (!(innermost instanceof Error)) return displayAwsMessage(safeStringify$1(innermost));
 	const code = innermost.Code;
 	const name = typeof code === "string" && code !== "" ? code : innermost.name;
 	const message = displayAwsMessage(innermost.message);
@@ -22016,7 +22044,7 @@ async function resolveDynamicReferencesWithLogTwin(resolver, value, logTwin, con
 	if (context?.abandonedResolutions !== void 0) {
 		const bag = context.abandonedResolutions;
 		for (const { placeholder, because } of takeKeptPlaceholdersInsideReferences(bag, value)) {
-			const reason = because instanceof Error ? because.message : String(because);
+			const reason = describeAwsFailure(because).detail;
 			bag.push(abandonedUnit(resolver, "placeholder", placeholder, new Error(`Fn::Sub kept the placeholder ${placeholder} (${reason}) inside a {{resolve:...}} reference, so that reference was never resolved`, { cause: because }), context, value));
 		}
 	}
@@ -22338,7 +22366,10 @@ function isMaskedOwnIdCopy(record, key, recorded, healed, producerSecrets) {
 	if (!healed.endsWith(physicalId)) return false;
 	if (!OWN_ID_ARN_PREFIX.test(healed.slice(0, healed.length - physicalId.length))) return false;
 	if (producerSecrets === void 0 || !hasMaskableValues(producerSecrets)) return false;
-	return withPhysicalNameCopies(producerSecrets, [physicalId], () => redactSecretsForState(healed, producerSecrets)) === healed;
+	return withPhysicalNameCopies(producerSecrets, [physicalId], () => redactForState(healed, {
+		provenance: "value-scan",
+		secrets: producerSecrets
+	})) === healed;
 }
 function healMaskedOwnIdAttribute(resolver, logicalId, resource, attributeName, stored, context) {
 	if (stored !== "***" || context.attributeHealer === void 0) return void 0;
@@ -22371,7 +22402,7 @@ function describeFailureObserved(resolver, read, err, context) {
 	const name = displaySafe(err instanceof Error && err.name ? err.name : "Error", { asciiOnly: true }).slice(0, 64).trim() || "Error";
 	const status = err?.$metadata?.httpStatusCode;
 	const errorClass = typeof status === "number" && Number.isInteger(status) ? `${name}, HTTP ${status}` : name;
-	resolver.logger.debug(`${read} failed (${errorClass}): ${displayMasked(resolver, err instanceof Error ? err.message : String(err), context)}`);
+	resolver.logger.debug(`${read} failed (${errorClass}): ${displayMasked(resolver, describeAwsFailure(err).detail, context)}`);
 	return `${read} failed (${errorClass}); re-run with --verbose for the AWS error text`;
 }
 function guardedPhysicalIdFallback(resolver, logicalId, attributeName, resourceType, physicalId, context) {
@@ -22461,7 +22492,7 @@ async function constructAttributeForCoreTypes(resolver, resource, attributeName,
 			resolver.logger.warn(`VPC ${loggedId} IPv6 CIDR did not reach 'associated' state after ${maxAttempts} attempts`);
 			return [];
 		} catch (error) {
-			resolver.logger.warn(`Failed to fetch VPC Ipv6CidrBlocks for ${displayMasked(resolver, physicalId, context)}: ${displayMasked(resolver, error instanceof Error ? error.message : String(error), context)}`);
+			resolver.logger.warn(`Failed to fetch VPC Ipv6CidrBlocks for ${displayMasked(resolver, physicalId, context)}: ${displayMasked(resolver, describeAwsFailure(error).detail, context)}`);
 			return [];
 		}
 		case "DefaultSecurityGroup": {
@@ -22844,7 +22875,7 @@ async function constructAttributeForComputeTypes(resolver, attributeName, contex
 				const value = attributeName === "LatestVersionNumber" ? lt?.LatestVersionNumber : lt?.DefaultVersionNumber;
 				if (value !== void 0 && value !== null) return String(value);
 			} catch (err) {
-				resolver.logger.warn(`DescribeLaunchTemplates(${displayMasked(resolver, physicalId, context)}) failed for ${displayMasked(resolver, attributeName, context)}: ${displayMasked(resolver, err instanceof Error ? err.message : String(err), context)}`);
+				resolver.logger.warn(`DescribeLaunchTemplates(${displayMasked(resolver, physicalId, context)}) failed for ${displayMasked(resolver, attributeName, context)}: ${displayMasked(resolver, describeAwsFailure(err).detail, context)}`);
 			}
 			return attributeName === "LatestVersionNumber" ? "$Latest" : "$Default";
 		}
@@ -23062,7 +23093,7 @@ async function resolveGetAZs(resolver, value, context) {
 	} catch (error) {
 		const loggedRegion = displayMasked(resolver, loggedRegionText ?? region, context);
 		const masks = namedRequestMasks(resolver, [[region, loggedRegion]], context);
-		throw new Error(`Fn::GetAZs: failed to describe availability zones for region ${quotedRender(loggedRegion, "'")}: ${masks.text(error instanceof Error ? error.message : String(error))}`);
+		throw new Error(`Fn::GetAZs: failed to describe availability zones for region ${quotedRender(loggedRegion, "'")}: ${masks.text(describeAwsFailure(error).detail)}`);
 	}
 	if (azNames.length === 0) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetAZs: no availability zones returned for region ${quotedRender(displayMasked(resolver, loggedRegionText ?? region, context), "'")}. Either the region is not enabled on this account (opt-in regions must be enabled before use), or the request was answered by a different region's endpoint.`));
 	cachedAvailabilityZones.set(azCacheKey, azNames);
@@ -24098,7 +24129,7 @@ async function evaluateConditions(resolver, context) {
 	for (const name of Object.keys(templateConditions)) try {
 		await withSharedDrainBudget(() => evaluateByName(name));
 	} catch (error) {
-		resolver.logger.warn(displayMasked(resolver, `Failed to evaluate condition ${name}: ${error instanceof Error ? error.message : String(error)}, assuming false`, maskingContext));
+		resolver.logger.warn(displayMasked(resolver, `Failed to evaluate condition ${name}: ${describeAwsFailure(error).detail}, assuming false`, maskingContext));
 		conditions[name] = false;
 		assumed.add(name);
 		inProgress.delete(name);
@@ -24118,7 +24149,7 @@ async function resolveKeyUnit(resolver, key, val, context, abandoned) {
 //#endregion
 //#region src/deployment/intrinsic-resolver/sub.ts
 function subPlaceholderWarning(_resolver, varName, error) {
-	return `Fn::Sub variable ${varName} could not be resolved (${error instanceof Error ? error.message : String(error)}), keeping placeholder`;
+	return `Fn::Sub variable ${varName} could not be resolved (${describeAwsFailure(error).detail}), keeping placeholder`;
 }
 function subPlaceholderNamesADeclaredTemplateEntity(resolver, varName, context) {
 	const firstDot = varName.indexOf(".");
@@ -26967,7 +26998,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DHB498Xq.js");
+			const { ASGProvider } = await import("./asg-provider-GNiE6dR1.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -27073,7 +27104,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-CxB94DZy.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CXhoiT-P.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-DBW972HG.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DUaw7kpj.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -32713,7 +32744,7 @@ function ownRemedyError(error) {
 }
 function rollbackFailureText(error) {
 	if (error instanceof Error && OWN_REMEDY_ERRORS.has(error)) return error.message.split("\n").map((line) => displaySafe(line)).join("\n");
-	return displaySafe(error instanceof Error ? error.message : String(error));
+	return displaySafe(describeAwsFailure(error).detail);
 }
 function collisionText(msg) {
 	return displayAwsMessage(displaySafe(msg).replace(/[\s\p{Cf}\p{Default_Ignorable_Code_Point}\u2800]{2,}/gu, " "));
@@ -33706,7 +33737,14 @@ function redactOutputsBag(deps, outputs) {
 	absorbOutputsPassSecrets(deps);
 	if (deps.outputsRun().outputSecrets.size === 0) return maskOutputsByPosition(deps.noEchoRun(), deps.noEchoDeps(), outputs);
 	const outputsRun = deps.outputsRun();
-	return maskOutputsByPosition(deps.noEchoRun(), deps.noEchoDeps(), redactSecretsForState(outputs, outputsRun.outputSecrets, outputsRun.outputsSourceUsable ? outputsRun.outputsTemplateSource : void 0, TEMPLATE_SOURCED_RULES));
+	return maskOutputsByPosition(deps.noEchoRun(), deps.noEchoDeps(), redactForState(outputs, outputsRun.outputsSourceUsable ? {
+		provenance: "template-sourced",
+		secrets: outputsRun.outputSecrets,
+		source: outputsRun.outputsTemplateSource
+	} : {
+		provenance: "value-scan",
+		secrets: outputsRun.outputSecrets
+	}));
 }
 function registerNoEchoAttributes(run, deps, logicalId, result, secrets, ownProperties) {
 	const declared = recordNoEchoAttributeValues(result, secrets, ownProperties);
@@ -34088,7 +34126,7 @@ async function replaceDeleteFirstAndRecreate(run, deps, logicalId, resourceType,
 		}));
 	} catch (deleteError) {
 		const shownSecrets = unionOfSecretBags([secrets, printingSecretsFor(deps.secretsRun(), logicalId)]);
-		throw new Error(safeMsg`Failed to delete old resource ${maskSecretsInText(logicalId, shownSecrets)} ` + safeMsg`(${maskSecretsInText(currentResource.physicalId, shownSecrets)}) ` + `during the --replace delete-first fallback: ` + safeMsg`${asIsMessage(maskSecretsInText(deleteError instanceof Error ? deleteError.message : String(deleteError), shownSecrets))}`, { cause: deleteError instanceof Error ? maskSecretsInError(deleteError, secrets) : void 0 });
+		throw new Error(safeMsg`Failed to delete old resource ${maskSecretsInText(logicalId, shownSecrets)} ` + safeMsg`(${maskSecretsInText(currentResource.physicalId, shownSecrets)}) ` + `during the --replace delete-first fallback: ` + safeMsg`${asIsMessage(maskSecretsInText(describeAwsFailure(deleteError).detail, shownSecrets))}`, { cause: deleteError instanceof Error ? maskSecretsInError(deleteError, secrets) : void 0 });
 	}
 	reportDeleteGuards(deleteResult, {
 		physicalId: currentResource.physicalId,
@@ -34112,7 +34150,7 @@ async function replaceDeleteFirstAndRecreate(run, deps, logicalId, resourceType,
 		});
 	} catch (recreateError) {
 		const shownSecrets = unionOfSecretBags([secrets, printingSecretsFor(deps.secretsRun(), logicalId)]);
-		throw new Error(safeMsg`Failed to re-create ${maskSecretsInText(logicalId, shownSecrets)} after the ` + safeMsg`--replace delete-first fallback already deleted the old resource (${maskSecretsInText(currentResource.physicalId, shownSecrets)}). ` + safeMsg`Re-run the deploy to create it fresh. Cause: ${asIsMessage(maskSecretsInText(recreateError instanceof Error ? recreateError.message : String(recreateError), shownSecrets))}`, { cause: recreateError instanceof Error ? maskSecretsInError(recreateError, secrets) : void 0 });
+		throw new Error(safeMsg`Failed to re-create ${maskSecretsInText(logicalId, shownSecrets)} after the ` + safeMsg`--replace delete-first fallback already deleted the old resource (${maskSecretsInText(currentResource.physicalId, shownSecrets)}). ` + safeMsg`Re-run the deploy to create it fresh. Cause: ${asIsMessage(maskSecretsInText(describeAwsFailure(recreateError).detail, shownSecrets))}`, { cause: recreateError instanceof Error ? maskSecretsInError(recreateError, secrets) : void 0 });
 	}
 }
 function typeChangeNameQuestion(resourceType, input) {
@@ -34178,7 +34216,7 @@ async function checkedReplacementNameChange(deps, input) {
 		}), logicalId, void 0, void 0, input.createProvider);
 	} catch (probeError) {
 		if (probeErrorMeansNameHeld(resourceType, probeError)) throw markNonRetryable(new CdkdError(maskName(`${subject} requires replacement, and S3 answered 403 Forbidden for bucket ${displaySafe(change.desiredName)}: another account owns that name, or a bucket of this account denies this identity \`s3:ListBucket\`, or the request's credentials were rejected. Nothing was created or deleted. Choose another name, or if the bucket is yours grant \`s3:ListBucket\` on it (or delete it) and re-run.`), "NAMED_REPLACEMENT_COLLISION", probeError instanceof Error ? probeError : void 0));
-		throw markNonRetryable(new CdkdError(maskName(`${subject} requires replacement under a new name, and ${adoptsText}, but cdkd could not check whether another resource already holds it: ${displayAwsMessage(maskName(probeError instanceof Error ? probeError.message : String(probeError)))}. Nothing was created or deleted. Re-run the deploy once the check can succeed.`), "NAMED_REPLACEMENT_COLLISION", probeError instanceof Error ? probeError : void 0));
+		throw markNonRetryable(new CdkdError(maskName(`${subject} requires replacement under a new name, and ${adoptsText}, but cdkd could not check whether another resource already holds it: ${displayAwsMessage(maskName(describeAwsFailure(probeError).detail))}. Nothing was created or deleted. Re-run the deploy once the check can succeed.`), "NAMED_REPLACEMENT_COLLISION", probeError instanceof Error ? probeError : void 0));
 	}
 	if (found === null) return change;
 	if (!typeChanged && probeFoundSameId(resourceType, found.physicalId, currentResource.physicalId)) return;
@@ -34195,7 +34233,7 @@ async function createFirstThenDeleteOld(run, deps, input) {
 		createResult = await deps.withRetry(() => withCurrentResourceSecrets(secrets, () => input.createProvider.create(logicalId, resourceType, input.createProps, { maskSecrets: createSecretMasker(secrets) })), logicalId, void 0, void 0, input.createProvider);
 	} catch (createError) {
 		if (!isNameCollisionErrorFrom(createError, logicalId)) throw createError;
-		const createMsg = displayAwsMessage(maskName(createError instanceof Error ? createError.message : String(createError)));
+		const createMsg = displayAwsMessage(maskName(describeAwsFailure(createError).detail));
 		throw markNonRetryable(new CdkdError(maskName(`${displaySafe(logicalId)} (${displaySafe(resourceType)}) requires replacement (${input.trigger}), and cdkd created the new resource first because its name differs, but the create collided: ${createMsg}. If the collision is on the requested name: ${renderReplacementNameChange(input.change, input.createProps)}. Nothing was deleted` + (retainOld ? ` (UpdateReplacePolicy: Retain keeps the old resource in place)` : "") + ". Choose a name no other resource holds, or delete the resource holding it if it is yours."), "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
 	}
 	if (input.equalIdIsSameResource && createResult.physicalId === currentResource.physicalId) throw markNonRetryable(new CdkdError(maskName(`${displaySafe(logicalId)} (${displaySafe(resourceType)}) requires replacement (${input.trigger}) under a new name, but the create returned the resource being replaced (${displaySafe(currentResource.physicalId)}) instead of a new one, so cdkd cannot tell which name it holds. Nothing was deleted. Delete that resource by hand if it is yours, then re-run the deploy.`), "NAMED_REPLACEMENT_IDEMPOTENT_CREATE"));
@@ -34221,7 +34259,7 @@ async function deleteReplacedAfterCreate(run, deps, logicalId, oldResourceType,
 			maskSecrets: createUnionSecretMasker([secrets, secretNameBagFor(deps.secretsRun(), logicalId)])
 		}));
 	} catch (deleteError) {
-		const deleteMsg = maskSecretsInText(deleteError instanceof Error ? deleteError.message : String(deleteError), secrets);
+		const deleteMsg = maskSecretsInText(describeAwsFailure(deleteError).detail, secrets);
 		deleteFailed = true;
 		run.replacedOldMaySurvive.set(logicalId, run.replacedOldMaySurvive.get(logicalId) === "unconfirmed" ? "unconfirmed" : replacedDeleteFailureVerdict(deleteError));
 		const deferred = run.deferredReplacedDeletes;
@@ -34762,7 +34800,7 @@ var ForwardingSecrets = class extends Map {
 };
 function handleOutputResolutionFailure(deps, error, outputKey, outputs, secrets, inheritedSecrets) {
 	const union = unionOfSecretBags([inheritedSecrets, secrets]);
-	const detail = maskSecretsInText(error instanceof Error ? error.message || error.name : String(error), union);
+	const detail = maskSecretsInText(error instanceof Error ? error.message || error.name : safeStringify$1(error), union);
 	if (deps.options.strictGetAtt) {
 		const cause = typeof error === "string" ? maskSecretsInText(error, union) : maskSecretsInError(error, union);
 		throw new Error(safeMsg`Failed to resolve output ${outputKey} ` + `(--strict-getatt promotes output resolution failures to deploy errors; ` + safeMsg`drop the flag to skip the output instead): ${asIsMessage(detail)}`, cause instanceof Error || typeof cause === "string" ? { cause } : {});
@@ -35161,8 +35199,16 @@ function recaptureMaskedBaseline(args) {
 	const { previous, readback, properties, secrets } = args;
 	const admissible = new Set(secretReferenceTokensOf(properties));
 	for (const leaf of wholeStringLeavesOf(properties)) if (leaf.includes("{{resolve:")) admissible.add(leaf);
-	if (!reproducesBaseline(redactSecretsForState(readback, /* @__PURE__ */ new Map(), properties, STATE_SOURCED_BASELINE_RULES), previous, admissible)) return void 0;
-	const certified = redactSecretsForState(readback, secrets, properties, STATE_SOURCED_BASELINE_RULES);
+	if (!reproducesBaseline(redactForState(readback, {
+		provenance: "state-baseline",
+		secrets: /* @__PURE__ */ new Map(),
+		source: properties
+	}), previous, admissible)) return void 0;
+	const certified = redactForState(readback, {
+		provenance: "state-baseline",
+		secrets,
+		source: properties
+	});
 	let changed = false;
 	const overlay = (old, fresh) => {
 		if (old === "***") {
@@ -35408,7 +35454,11 @@ function redactRollbackRecord(record, secrets, journaledProps, journaledAttribut
 	if (secrets.size === 0) return record;
 	const positioned = journaledProps === void 0 ? record : {
 		...record,
-		properties: redactSecretsForState(record.properties, secrets, journaledProps, STATE_DERIVED_RULES)
+		properties: redactForState(record.properties, {
+			provenance: "state-derived",
+			secrets,
+			source: journaledProps
+		})
 	};
 	return keepPersistedPlainRecordLeaves(scrubResourceRecord(positioned, secrets), record, {
 		properties: journaledProps,
@@ -36705,7 +36755,7 @@ async function replayReverseReplacement(s) {
 			});
 		} catch (recreateError) {
 			await deleteMarkedRecreate(recreateError, recreateCleanup);
-			throw new Error(mask(`Failed to re-create the old ${safe(op.logicalId)} after the new resource (${mask(current.physicalId)}) was already deleted: ${displaySafe(recreateError instanceof Error ? recreateError.message : String(recreateError))}. The resource is now absent — fix forward by re-deploying the stack.`), { cause: maskSecretsInError(recreateError instanceof Error ? recreateError : void 0, secrets) });
+			throw new Error(mask(`Failed to re-create the old ${safe(op.logicalId)} after the new resource (${mask(current.physicalId)}) was already deleted: ${displaySafe(describeAwsFailure(recreateError).detail)}. The resource is now absent — fix forward by re-deploying the stack.`), { cause: maskSecretsInError(recreateError instanceof Error ? recreateError : void 0, secrets) });
 		}
 	};
 	let deletedNewFirst = false;
@@ -36722,7 +36772,7 @@ async function replayReverseReplacement(s) {
 		});
 	} catch (createError) {
 		const deletedMade = await deleteMarkedRecreate(createError, recreateCleanup);
-		const msg = createError instanceof Error ? createError.message : String(createError);
+		const msg = describeAwsFailure(createError).detail;
 		if (!isNameCollisionErrorFrom(createError, op.logicalId) || deletedMade) throw createError;
 		const holder = inOriginalPrefix(() => reverseReplacementNewHoldsName({
 			oldResourceType: oldType,
@@ -36816,8 +36866,8 @@ async function replayReverseReplacement(s) {
 		}));
 		throwIfDeleteSkipped(deleteNewAfterRecreate, op.logicalId, current.physicalId, "while deleting the new resource after re-creating the old one", newDeleteGuardScope(deleteNewAfterRecreateRoute.provisionedBy));
 	} catch (deleteError) {
-		logger.warn(mask(`  Rollback: old ${safe(op.logicalId)} re-created, but deleting the new resource (${displaySafe(mask(current.physicalId))}) failed: ${displaySafe(deleteError instanceof Error ? deleteError.message : String(deleteError))}. Delete it manually — it is no longer tracked in state.`));
-		survivorReason = `The replacement's new ${op.resourceType} (${current.physicalId}) could not be deleted after the old resource was re-created: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}. It is live, still billing, and no longer tracked by cdkd — delete it yourself.`;
+		logger.warn(mask(`  Rollback: old ${safe(op.logicalId)} re-created, but deleting the new resource (${displaySafe(mask(current.physicalId))}) failed: ${displaySafe(describeAwsFailure(deleteError).detail)}. Delete it manually — it is no longer tracked in state.`));
+		survivorReason = `The replacement's new ${op.resourceType} (${current.physicalId}) could not be deleted after the old resource was re-created: ${describeAwsFailure(deleteError).detail}. It is live, still billing, and no longer tracked by cdkd — delete it yourself.`;
 		result.warnings++;
 	}
 	const recreatedId = displaySafe(mask(String(createResult.physicalId)));
@@ -36858,7 +36908,7 @@ async function deleteMarkedRecreate(error, s) {
 		}));
 		failure = deleteSkipReason(outcome);
 	} catch (deleteError) {
-		failure = deleteError instanceof Error ? deleteError.message : String(deleteError);
+		failure = describeAwsFailure(deleteError).detail;
 	}
 	if (failure === void 0) return true;
 	s.logger.warn(safeMsg`  Rollback: could not delete ${id}, which the failed re-create of ${shown} made before ` + safeMsg`failing (${s.mask(failure)}); no record holds it — delete it yourself`);
@@ -37394,7 +37444,7 @@ var ObservedCapture = class {
 				this.deps.printingSecretsFor(logicalId),
 				this.deps.fingerprintNoEchoValues()
 			]);
-			this.deps.logger.debug(safeMsg`observedProperties capture for ${mask(logicalId)} (${mask(resourceType)}) failed: ${asIsMessage(mask(err instanceof Error ? err.message : String(err)))} — drift will fall back to template properties for this resource until the next successful deploy.`);
+			this.deps.logger.debug(safeMsg`observedProperties capture for ${mask(logicalId)} (${mask(resourceType)}) failed: ${asIsMessage(mask(describeAwsFailure(err).detail))} — drift will fall back to template properties for this resource until the next successful deploy.`);
 		});
 		const promise = secrets === void 0 ? read() : withCurrentResourceSecrets(secrets, read);
 		this.observedCaptureTasks.set(logicalId, promise);
@@ -38363,7 +38413,7 @@ async function loadJournaledOrphans(stateBackend, stackName, region, rollbackOrp
 		if (!journal) return NONE;
 		segments = journal.segments;
 	} catch (err) {
-		const detail = err instanceof Error ? err.message : String(err);
+		const detail = describeAwsFailure(err).detail;
 		logger.warn(safeMsg`Could not read the stack's rollback journal (${displaySafe(detail)}); ` + safeMsg`no resource it records for a failed CREATE is deleted, and ${options.unreadableOutcome ?? "a destroy that proceeds removes the journal with the state"}.`);
 		return {
 			...NONE,
@@ -38775,7 +38825,7 @@ async function markSuperseded(stateBackend, stackName, region, ids) {
 	} catch {}
 }
 function errorDetail(err) {
-	return displaySafe(err instanceof Error ? err.message : String(err));
+	return displaySafe(describeAwsFailure(err).detail);
 }
 function isHandledOrphan(handled, segment, op) {
 	return handled.some((h) => h.segment.timestamp === segment.timestamp && h.segment.runId === segment.runId && h.op.logicalId === op.logicalId && h.op.changeType === op.changeType && h.op.resourceType === op.resourceType && h.op.physicalId === op.physicalId);
@@ -39307,7 +39357,7 @@ Drop the record with: ${dropCommand}`);
 			maskSecrets: createUnionSecretMasker([secretNameBagFor(deps.secretsRun(), logicalId)])
 		}), logicalId, 3, 5e3, deleteProvider);
 	} catch (deleteError) {
-		const msg = deleteError instanceof Error ? deleteError.message : String(deleteError);
+		const msg = describeAwsFailure(deleteError).detail;
 		if (!isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && !isWaitAbandonedError(deleteError) && (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException"))) deps.logger.debug(safeMsg`Resource ${logicalId} already deleted (${asIsMessage(msg)}), removing from state`);
 		else throw deleteError;
 	}
@@ -40231,7 +40281,7 @@ async function deleteRollbackJournalBestEffort(deps, stackName, supersededLogica
 	try {
 		deleted = await deps.stateBackend.deleteRollbackJournal(stackName, deps.stackRegion);
 	} catch (err) {
-		deps.logger.debug(safeMsg`Failed to delete rollback journal for ${displayStackName(stackName)}: ${err instanceof Error ? err.message : String(err)}`);
+		deps.logger.debug(safeMsg`Failed to delete rollback journal for ${displayStackName(stackName)}: ${describeAwsFailure(err).detail}`);
 		deleted = false;
 	}
 	if (deleted !== false) return true;
@@ -40239,7 +40289,7 @@ async function deleteRollbackJournalBestEffort(deps, stackName, supersededLogica
 	try {
 		await deps.stateBackend.markRollbackJournalSuperseded(stackName, deps.stackRegion, supersededLogicalIds);
 	} catch (markErr) {
-		deps.logger.debug(safeMsg`Failed to record superseded logical ids on the rollback journal for ${displayStackName(stackName)}: ${markErr instanceof Error ? markErr.message : String(markErr)}`);
+		deps.logger.debug(safeMsg`Failed to record superseded logical ids on the rollback journal for ${displayStackName(stackName)}: ${describeAwsFailure(markErr).detail}`);
 	}
 	return false;
 }
@@ -40248,7 +40298,7 @@ async function settleJournalAfterCleanRollback(deps, stackName, failedOperations
 		try {
 			await deps.stateBackend.popRollbackJournalSegment(stackName, deps.stackRegion);
 		} catch (err) {
-			deps.logger.debug(safeMsg`Failed to pop the rollback journal segment after the clean rollback: ${asIsMessage(err instanceof Error ? err.message : String(err))}`);
+			deps.logger.debug(safeMsg`Failed to pop the rollback journal segment after the clean rollback: ${asIsMessage(describeAwsFailure(err).detail)}`);
 			return false;
 		}
 		return true;
@@ -40256,7 +40306,7 @@ async function settleJournalAfterCleanRollback(deps, stackName, failedOperations
 	try {
 		await deps.stateBackend.popRollbackJournalSegment(stackName, deps.stackRegion);
 	} catch (err) {
-		deps.logger.warn(safeMsg`Failed to settle the rollback journal after the clean rollback: ${err instanceof Error ? err.message : String(err)}. ` + `The journal keeps the full segment; a later rollback replay is idempotent.`);
+		deps.logger.warn(safeMsg`Failed to settle the rollback journal after the clean rollback: ${describeAwsFailure(err).detail}. ` + `The journal keeps the full segment; a later rollback replay is idempotent.`);
 		return false;
 	}
 	if (!await writeRollbackJournalSegment(deps, stackName, [], failedOperations, "auto-rollback-clean", initialDeploy)) return true;
@@ -40331,7 +40381,7 @@ async function writeRollbackJournalSegment(deps, stackName, completedOperations,
 		deps.logger.debug(safeMsg`Rollback journal segment written (${reason})`);
 		return true;
 	} catch (journalError) {
-		deps.logger.warn(safeMsg`Failed to write rollback journal: ${asIsMessage(journalError instanceof Error ? journalError.message : String(journalError))}. ` + `'cdkd rollback' will NOT be able to revert this deploy — use 'cdkd deploy' to resume or 'cdkd destroy' to clean up.`);
+		deps.logger.warn(safeMsg`Failed to write rollback journal: ${asIsMessage(describeAwsFailure(journalError).detail)}. ` + `'cdkd rollback' will NOT be able to revert this deploy — use 'cdkd deploy' to resume or 'cdkd destroy' to clean up.`);
 		return false;
 	}
 }
@@ -42035,7 +42085,10 @@ function deployConditionInputs(parameterValues, inheritedSecrets, shadowedBy = /
 			unavailable.add(name);
 			continue;
 		}
-		const redacted = redactSecretsForState(value, inheritedSecrets);
+		const redacted = redactForState(value, {
+			provenance: "value-scan",
+			secrets: inheritedSecrets
+		});
 		if (!containsNeedle(value)) {
 			if (redacted !== value) unavailable.add(name);
 			continue;
@@ -42968,7 +43021,10 @@ function maskedInputSources(deps, template, resources, conditions, stackName) {
 			const targetSecrets = target === void 0 ? void 0 : deps.secretsRun().perResourceSecrets.get(target);
 			if (targetSecrets !== void 0 && hasMaskableValues(targetSecrets)) {
 				const probe = { value };
-				const redacted = redactSecretsForState(probe, targetSecrets);
+				const redacted = redactForState(probe, {
+					provenance: "value-scan",
+					secrets: targetSecrets
+				});
 				if (JSON.stringify(redacted) !== JSON.stringify(probe)) return {
 					value,
 					keepAsWritten: true
@@ -43177,7 +43233,7 @@ async function refuseTakenCreateName(engine, input) {
 		if (probeErrorMeansNameHeld(resourceType, probeError)) return refuse(`${subject} is created with ${named}, and S3 answered 403 Forbidden for that bucket: another account owns that name, or a bucket of this account denies this identity \`s3:ListBucket\`, or the request's credentials were rejected. Nothing was created. Choose another name, or if the bucket is yours grant \`s3:ListBucket\` on it (or delete it) and re-run.`, probeError);
 		const status = probeError?.$metadata?.httpStatusCode;
 		if (resourceType === "AWS::S3::Bucket" && status === 301) return refuse(`${subject} is created with ${named}, and S3 answered 301 for that bucket: a bucket of that name already exists in another region. Nothing was created. Choose another name, or delete that bucket if it is yours and re-run.`, probeError);
-		return refuse(`${subject} is created with ${named}, and ${adoptsText}, but cdkd could not check whether another resource already holds it: ${displayAwsMessage(maskName(probeError instanceof Error ? probeError.message : String(probeError)))}. Nothing was created. Re-run the deploy once the check can succeed.`, probeError);
+		return refuse(`${subject} is created with ${named}, and ${adoptsText}, but cdkd could not check whether another resource already holds it: ${displayAwsMessage(maskName(describeAwsFailure(probeError).detail))}. Nothing was created. Re-run the deploy once the check can succeed.`, probeError);
 	}
 	if (found === null) return;
 	const holderId = found.physicalId;
@@ -46126,7 +46182,7 @@ async function updateByReplacement(engine, { change, counts, currentProps, curre
 				}));
 			} catch (deleteError) {
 				const shownSecrets = unionOfSecretBags([updateSecrets, printingSecretsFor(engine.secretsRun, logicalId)]);
-				throw new Error(safeMsg`Failed to destroy old resource ${maskSecretsInText(logicalId, shownSecrets)} ` + safeMsg`(${maskSecretsInText(currentResource.physicalId, shownSecrets)}) during ${recreateFlagName}: ` + safeMsg`${asIsMessage(maskSecretsInText(deleteError instanceof Error ? deleteError.message : String(deleteError), shownSecrets))}`, { cause: deleteError instanceof Error ? maskSecretsInError(deleteError, updateSecrets) : void 0 });
+				throw new Error(safeMsg`Failed to destroy old resource ${maskSecretsInText(logicalId, shownSecrets)} ` + safeMsg`(${maskSecretsInText(currentResource.physicalId, shownSecrets)}) during ${recreateFlagName}: ` + safeMsg`${asIsMessage(maskSecretsInText(describeAwsFailure(deleteError).detail, shownSecrets))}`, { cause: deleteError instanceof Error ? maskSecretsInError(deleteError, updateSecrets) : void 0 });
 			}
 			reportDeleteGuards(recreateDeleteResult, {
 				physicalId: currentResource.physicalId,
@@ -46159,7 +46215,7 @@ async function updateByReplacement(engine, { change, counts, currentProps, curre
 		try {
 			createResult = await engine.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replaceProvider.create(logicalId, resourceType, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replaceProvider);
 		} catch (createError) {
-			const createMsg = displayAwsMessage(maskSecretsInText(createError instanceof Error ? createError.message : String(createError), updateSecrets));
+			const createMsg = displayAwsMessage(maskSecretsInText(describeAwsFailure(createError).detail, updateSecrets));
 			const createSentence = createMsg.endsWith(".") ? createMsg.slice(0, -1) : createMsg;
 			if (!isNameCollisionErrorFrom(createError, logicalId)) throw createError;
 			const nameOrigin = replacementNameOrigin(logicalId, currentResource.physicalId);
@@ -46217,7 +46273,7 @@ async function updateByReplacement(engine, { change, counts, currentProps, curre
 				if (snapshotError instanceof CdkdError && snapshotError.code === "FINAL_SNAPSHOT_UNSUPPORTED") throw snapshotError;
 				snapshotBlockedDelete = true;
 				engine.replacementRun.replacedOldMaySurvive.set(logicalId, "kept");
-				engine.logger.warn(safeMsg`  ⚠ Final snapshot for old ${logicalId} (${currentResource.physicalId}) ` + safeMsg`failed: ${asIsMessage(snapshotError instanceof Error ? snapshotError.message : String(snapshotError))}. ` + "The old resource was NOT deleted (UpdateReplacePolicy: Snapshot) — delete it manually once you have a snapshot; it is no longer tracked in state.");
+				engine.logger.warn(safeMsg`  ⚠ Final snapshot for old ${logicalId} (${currentResource.physicalId}) ` + safeMsg`failed: ${asIsMessage(describeAwsFailure(snapshotError).detail)}. ` + "The old resource was NOT deleted (UpdateReplacePolicy: Snapshot) — delete it manually once you have a snapshot; it is no longer tracked in state.");
 			}
 			if (!snapshotBlockedDelete) await deleteReplacedAfterCreate(engine.replacementRun, engine.replacementDeps(), logicalId, oldResourceType, currentResource, oldDeleteProvider, currentResource.properties, cleanupFinalSnapshotId, updateReplacePolicy, updateSecrets, oldDeleteRoute.provisionedBy, noEchoDeleteValues);
 		}
@@ -46388,7 +46444,7 @@ async function updateInPlace(engine, { conditions, counts, currentProps, current
 						maskSecrets: createUnionSecretMasker([updateSecrets, secretNameBagFor(engine.secretsRun, logicalId)])
 					}));
 				} catch (deleteError) {
-					const deleteMsg = deleteError instanceof Error ? deleteError.message : String(deleteError);
+					const deleteMsg = describeAwsFailure(deleteError).detail;
 					if (!isWaitAbandonedError(deleteError) && !isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound"))) engine.logger.debug(safeMsg`Old resource ${logicalId} already gone, proceeding with CREATE`);
 					else throw deleteError;
 				}
@@ -46431,7 +46487,7 @@ async function updateInPlace(engine, { conditions, counts, currentProps, current
 				if (createFirst) throw createError;
 				if (!retainOldOnReplace) {
 					const shownSecrets = unionOfSecretBags([updateSecrets, printingSecretsFor(engine.secretsRun, logicalId)]);
-					throw new Error(safeMsg`Failed to create ${maskSecretsInText(logicalId, shownSecrets)} after the ` + safeMsg`UPDATE-not-supported replacement: the old resource (${maskSecretsInText(currentResource.physicalId, shownSecrets)}) ` + safeMsg`is now gone. Re-run the deploy to create it fresh. Cause: ${asIsMessage(maskSecretsInText(createError instanceof Error ? createError.message : String(createError), shownSecrets))}`, { cause: createError instanceof Error ? createError : void 0 });
+					throw new Error(safeMsg`Failed to create ${maskSecretsInText(logicalId, shownSecrets)} after the ` + safeMsg`UPDATE-not-supported replacement: the old resource (${maskSecretsInText(currentResource.physicalId, shownSecrets)}) ` + safeMsg`is now gone. Re-run the deploy to create it fresh. Cause: ${asIsMessage(maskSecretsInText(describeAwsFailure(createError).detail, shownSecrets))}`, { cause: createError instanceof Error ? createError : void 0 });
 				}
 				if (!isNameCollisionErrorFrom(createError, logicalId)) throw createError;
 				const nameHeldElsewhere = replacementRequestsDifferentName({
@@ -46769,8 +46825,18 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 	]), fingerprints));
 	if (resourceType === "AWS::CloudFormation::Stack") recordPassedNoEchoParameters(updateSecrets, desiredProps["Parameters"], noEchoPositionSources(engine.noEchoRun, stateResources));
 	if (fingerprintSources !== void 0 && resourceType === "AWS::CloudFormation::Stack") recordPassedParameterClasses(updateSecrets, await classifyPassedParameters(desiredProps["Parameters"], fingerprintSources));
-	const desiredForSkipCheck = maskAtCoordinates(redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps), comparisonCoordinates);
-	const legacyDesired = withoutPhysicalNameCopies(updateSecrets, () => maskAtCoordinates(redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps), comparisonCoordinates));
+	const desiredForSkipCheck = maskAtCoordinates(redactForState(resolvedProps, {
+		provenance: "template-derived",
+		secrets: updateSecrets,
+		source: desiredProps,
+		generation: "same-generation"
+	}), comparisonCoordinates);
+	const legacyDesired = withoutPhysicalNameCopies(updateSecrets, () => maskAtCoordinates(redactForState(resolvedProps, {
+		provenance: "template-derived",
+		secrets: updateSecrets,
+		source: desiredProps,
+		generation: "same-generation"
+	}), comparisonCoordinates));
 	const copies = physicalNameCopiesOf.get(updateSecrets);
 	const regionEvidence = getCurrentProducerRegions()?.();
 	const recordOwnSecrets = copies !== void 0 && copies.size > 0 && regionEvidence?.complete === true && recordHoldsEmbeddedReference(currentResource) ? await resolveRecordSecrets({
@@ -46784,7 +46850,12 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 		if (repaired !== bag[key]) bag[key] = repaired;
 	}
 	if (overlapRuleAnswered(updateSecrets)) {
-		const legacyOverlapBag = withLegacyOverlapScan(updateSecrets, () => maskAtCoordinates(redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps), comparisonCoordinates));
+		const legacyOverlapBag = withLegacyOverlapScan(updateSecrets, () => maskAtCoordinates(redactForState(resolvedProps, {
+			provenance: "template-derived",
+			secrets: updateSecrets,
+			source: desiredProps,
+			generation: "same-generation"
+		}), comparisonCoordinates));
 		const legacyOverlap = legacyReferenceLeavesOnly(legacyOverlapBag);
 		for (const bag of new Set(repairable)) for (const key of Object.keys(bag)) {
 			const repaired = repairPhysicalNameCopyLeaves(bag[key], legacyOverlap[key], desiredForSkipCheck[key]);
@@ -46811,7 +46882,12 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 	const createOnlyEvidence = acceptedCreateOnlyDropsOf(currentResource);
 	const recordedAsWritten = currentResource.provisionedBy === "cc-api" ? currentProps : withoutUnwrittenSilentDropProperties(resourceType, currentProps, desiredForSkipCheck, allowedForRecord, createOnlyEvidence);
 	const unmarkedRecord = noEchoLeavesOf(currentResource) === void 0;
-	const todayAsWritten = unmarkedRecord || witnessNormalize(recordedAsWritten, void 0, desiredForSkipCheckAsWritten).differing.length > 0 ? redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), withoutNoEchoParameterEntries(updateSecrets), desiredProps) : void 0;
+	const todayAsWritten = unmarkedRecord || witnessNormalize(recordedAsWritten, void 0, desiredForSkipCheckAsWritten).differing.length > 0 ? redactForState(resolvedProps, {
+		provenance: "template-derived",
+		secrets: withoutNoEchoParameterEntries(updateSecrets),
+		source: desiredProps,
+		generation: "same-generation"
+	}) : void 0;
 	const witness = todayAsWritten === void 0 ? void 0 : witnessNormalize(recordedAsWritten, todayAsWritten, desiredForSkipCheckAsWritten);
 	const currentPropsAsWritten = witness === void 0 ? recordedAsWritten : witness.current;
 	const witnessMigrates = unmarkedRecord || (witness?.confirmed.length ?? 0) > 0;
@@ -47406,7 +47482,7 @@ async function provisionResource(engine, logicalId, change, stateResources, stac
 		});
 	} catch (error) {
 		renderer.removeTask(logicalId);
-		const message = error instanceof Error ? error.message : String(error);
+		const message = describeAwsFailure(error).detail;
 		const shownMessage = maskForResource(engine.secretsRun, logicalId, message);
 		const shownId = safeMsg`${logicalId}`;
 		engine.logger.error(maskForResource(engine.secretsRun, logicalId, `Failed to ${change.changeType.toLowerCase()} ${shownId}: ${shownMessage}`));
@@ -47488,7 +47564,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 				if (migrate) pendingMigration = false;
 				engine.logger.debug(safeMsg`State saved after ${logicalId}`);
 			} catch (error) {
-				engine.logger.warn(safeMsg`Failed to save state after ${logicalId}: ${asIsMessage(error instanceof Error ? error.message : String(error))}`);
+				engine.logger.warn(safeMsg`Failed to save state after ${logicalId}: ${asIsMessage(describeAwsFailure(error).detail)}`);
 			}
 		});
 	};
@@ -47818,7 +47894,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 			if (migrate) pendingMigration = false;
 			engine.logger.debug("Partial state saved before rollback (orphaned resource tracking)");
 		} catch (saveError) {
-			engine.logger.warn(safeMsg`Failed to save partial state before rollback: ${asIsMessage(saveError instanceof Error ? saveError.message : String(saveError))}`);
+			engine.logger.warn(safeMsg`Failed to save partial state before rollback: ${asIsMessage(describeAwsFailure(saveError).detail)}`);
 		}
 		let autoRollbackClean = false;
 		let autoRollbackJournaled = false;
@@ -47866,7 +47942,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 			engine.logger.debug("State saved after deployment failure");
 			if (autoRollbackClean) await settleNestedChildrenAfterCleanRollback(engine.rollbackDeps(), stackName, rollbackSettledNested, await settleJournalAfterCleanRollback(engine.rollbackDeps(), stackName, rollbackRemainingFailedOps, initialDeploy));
 		} catch (saveError) {
-			engine.logger.debug(safeMsg`Retrying state save after rollback (ETag mismatch): ${asIsMessage(saveError instanceof Error ? saveError.message : String(saveError))}`);
+			engine.logger.debug(safeMsg`Retrying state save after rollback (ETag mismatch): ${asIsMessage(describeAwsFailure(saveError).detail)}`);
 			try {
 				const freshEtag = (await engine.stateBackend.getState(stackName, engine.stackRegion))?.etag;
 				const postRollbackState = {
@@ -47885,7 +47961,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 				engine.logger.debug("State saved after deployment failure (retry succeeded)");
 				if (autoRollbackClean) await settleNestedChildrenAfterCleanRollback(engine.rollbackDeps(), stackName, rollbackSettledNested, await settleJournalAfterCleanRollback(engine.rollbackDeps(), stackName, rollbackRemainingFailedOps, initialDeploy));
 			} catch (retryError) {
-				engine.logger.warn(safeMsg`Failed to save state after rollback: ${asIsMessage(retryError instanceof Error ? retryError.message : String(retryError))}`);
+				engine.logger.warn(safeMsg`Failed to save state after rollback: ${asIsMessage(describeAwsFailure(retryError).detail)}`);
 			}
 		}
 		throw error;
@@ -47940,13 +48016,13 @@ async function persistStateAfterOutputFailure(engine, stackName, currentState, n
 		});
 		engine.logger.debug("State saved after output resolution failure");
 	} catch (saveError) {
-		engine.logger.debug(safeMsg`Retrying state save after output resolution failure (ETag mismatch): ${asIsMessage(saveError instanceof Error ? saveError.message : String(saveError))}`);
+		engine.logger.debug(safeMsg`Retrying state save after output resolution failure (ETag mismatch): ${asIsMessage(describeAwsFailure(saveError).detail)}`);
 		try {
 			const freshEtag = (await engine.stateBackend.getState(stackName, engine.stackRegion))?.etag;
 			await engine.stateBackend.saveState(stackName, engine.stackRegion, engine.withParentInfo(buildState()), { ...freshEtag !== void 0 && { expectedEtag: freshEtag } });
 			engine.logger.debug("State saved after output resolution failure (retry succeeded)");
 		} catch (retryError) {
-			engine.logger.warn(safeMsg`Failed to save state after output resolution failure: ${asIsMessage(retryError instanceof Error ? retryError.message : String(retryError))} — resources were provisioned but not recorded; run deploy again to reconcile.`);
+			engine.logger.warn(safeMsg`Failed to save state after output resolution failure: ${asIsMessage(describeAwsFailure(retryError).detail)} — resources were provisioned but not recorded; run deploy again to reconcile.`);
 		}
 	}
 }
@@ -48282,7 +48358,7 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 					else if (healedAttributesPending) engine.logger.debug("Persisted attributes re-read from AWS for a stale record (no-change path)");
 					else engine.logger.debug("Persisted skipped-outputs record (no outputs-value diff, no-change path)");
 				} catch (saveError) {
-					engine.logger.warn(safeMsg`Failed to persist no-change state update: ${asIsMessage(saveError instanceof Error ? saveError.message : String(saveError))} — drift baseline / outputs will be re-resolved on next deploy.`);
+					engine.logger.warn(safeMsg`Failed to persist no-change state update: ${asIsMessage(describeAwsFailure(saveError).detail)} — drift baseline / outputs will be re-resolved on next deploy.`);
 				}
 			}
 			return {
@@ -48441,7 +48517,7 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 			await engine.lockManager.releaseLock(stackName, engine.stackRegion);
 			engine.logger.debug("Lock released");
 		} catch (lockError) {
-			engine.logger.warn(safeMsg`Failed to release lock: ${asIsMessage(lockError instanceof Error ? lockError.message : String(lockError))}`);
+			engine.logger.warn(safeMsg`Failed to release lock: ${asIsMessage(describeAwsFailure(lockError).detail)}`);
 		}
 	}
 }
@@ -48765,7 +48841,10 @@ var DeployEngine = class {
 	redactCrossStackReads(state) {
 		if (state.imports === void 0 && state.outputReads === void 0) return {};
 		const secrets = allRecordedSecrets(this.secretsRun, this.maskingDeps());
-		const redact = (value) => redactSecretsForState(value, secrets);
+		const redact = (value) => redactForState(value, {
+			provenance: "value-scan",
+			secrets
+		});
 		return {
 			...state.imports === void 0 ? {} : { imports: state.imports.map((entry) => ({
 				...entry,
@@ -48782,7 +48861,10 @@ var DeployEngine = class {
 		absorbOutputsPassSecrets(this.maskingDeps());
 		const secrets = allRecordedSecrets(this.secretsRun, this.maskingDeps());
 		if (secrets.size === 0) return (name) => name;
-		return (name) => redactSecretsForState(name, secrets);
+		return (name) => redactForState(name, {
+			provenance: "value-scan",
+			secrets
+		});
 	}
 	withParentInfo(state) {
 		const redacted = this.redactStateForPersist(state);
@@ -48859,5 +48941,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { resolvePendingCloudControlRequests as $, repairMalformedOutputsForReadOnly as $a, redactedDockerCause as $c, accountArgs as $i, buildFinalSnapshotIdentifier as $n, readbackPathFor as $o, DiffCalculator as $r, S3StateBackend as $s, namesAnyDeclaredParameter as $t, findServiceTokenRefusals as A, refuseMalformedOrphanRecordsForDestroy as Aa, assertAssetBucketRegion as Ac, coerceParameterTypedValue as Ai, expectedOwnerParam as Al, gray as An, replayWarn as Ao, isCustomResourceType as Ar, inheritNestedStackParameterAssociations as As, removeProtectionTypeList as At, parentSuppliedValues as B, refuseMalformedResourceEntriesForImport as Ba, resolveDockerContextDirectory as Bc, cfnRefValueFromPhysicalId as Bi, nullPrototypeRecord as Bl, journaledOrphanPrintingBag as Bn, sameLambdaFunctionAddress as Bo, UNSPECIFIED_SKIP_REASON as Br, recordMaskOnlyValuesIn as Bs, resolveReplacementOldType as Bt, getPriorAttempts as C, malformedResourcesWarning as Ca, WorkGraph as Cc, applyCallerIdentityCredentials as Ci, CFN_TEMPLATE_BODY_LIMIT as Cl, awaitInFlightSibling as Cn, toFiniteNumber as Co, ProviderRegistry as Cr, withPhysicalNameCopies as Cs, formatResourceLine as Ct, crossStackOutputProvenanceSource as D, refuseDivergentRecordRegionForDestroy as Da, rewriteTemplateAssetReferences as Dc, classifyReplaySecretRegion as Di, uploadCfnTemplate as Dl, replacedDeleteFailureVerdict as Dn, configIntegerRefusal as Do, waitForLambdaFunctionActive as Dr, isUncertifiedBaselineMaskPosition as Ds, withApiLimit as Dt, computeImplicitDeleteEdges as E, previewableOrphanRecords as Ea, loadPublishableAssetManifest as Ec, classifyRecordedSecretRegion as Ei, findLargeInlineResources as El, withStackRecords as En, configBooleanRefusal as Eo, wouldReturnToSdkProvider as Er, dynamicReferenceTokens as Es, lookupEachName as Et, listNestedTemplateRows as F, refuseMalformedOutputsForDestroy as Fa, readBootstrapMarkerBody as Fc, carriesDynamicReference as Fi, StageLoadError as Fl, noEchoComparisonForTemplate as Fn, templateResourceTypes as Fo, customResourceResponseExpirationWarning as Fr, recordPhysicalNameCopy as Fs, planFailedOps as Ft, keptWholeReasonText as G, refuseMalformedResourcePropertiesForExport as Ga, finchSecretArgvRefusal as Gc, parameterInputsFor as Gi, renderAssemblyPathEscape as Gl, secretNamePrintingBags as Gn, maskAtCoordinates as Go, isWaitAbandonedError as Gr, STATE_SOURCED_BASELINE_RULES as Gs, inheritProducerRegions as Gt, withResourceDeadline as H, refuseMalformedResourceEntriesForOrphan as Ha, describeDockerExecFailure as Hc, refStateLookupFromResource as Hi, absoluteAssemblyPathEscape as Hl, namingSecretsWithRecordedNoEcho as Hn, TemplateParser as Ho, deleteLeftInPlace as Hr, recordNoEchoParameterFreshValue as Hs, orphanNeedsIdentity as Ht, renderNestedTemplateTreeDefect as I, refuseMalformedResourceAttributesForOrphan as Ia, validateAssetBucketName as Ic, carriesFetchableDynamicReference as Ii, processStackMessages as Il, noEchoExactEchoLeavesOf as In, describeTypeWithThrottleRetry as Io, CloudControlProvider as Ir, splitGetAttStringForm as Is, planRollback as It, makeSiblingClaimReader as J, refuseMalformedResourcesForDestroy as Ja, isDockerClientEnvKey as Jc, JSON_LISTING_HOLE_VALUE as Ji, injectedAwsRegionValue as Jl, stateSecretNameNeedles as Jn, maskedLeafCoordinatesOf as Jo, ec2InstanceProtectionSite as Jr, TEMPLATE_SOURCED_RULES as Js, redactedDeleteAddressFields as Jt, mergeNoChangeOutputs as K, refuseMalformedResourcePropertiesForOrphan as Ka, formatDockerLoginError as Kc, passedParameterClassesOf as Ki, resolveAssemblyPath as Kl, secretNamedAttributeNamesOf as Kn, maskReadbackAtCoordinates as Ko, markWaitAbandoned as Kr, STATE_SOURCED_CROSS_GENERATION_RULES as Ks, REDACTED_DELETE_ADDRESS_SKIP_REASON as Kt, templateIdentity as L, refuseMalformedResourceEntries as La, validateContainerRepoName as Lc, isNamelessDynamicReferenceError as Li, defineOwnKey as Ll, noEchoParameterNamesOf as Ln, withRetry as Lo, slowCcOperationTimeoutMs as Lr, carriesSecretMask as Ls, recheckFailedPlan as Lt, childTemplateLoader as M, refuseMalformedOrphansForDestroy as Ma, getBootstrapMarkerKey as Mc, parameterTypeMayLoseSecretIdentity as Mi, canonicalizeRegion as Ml, red as Mn, requireConfigObject as Mo, withPrintingSecrets as Mr, recoverMaskedOutput as Ms, demoteSupersededOrphans as Mt, findNestedTemplateTreeDefect as N, refuseMalformedOrphansForOrphan as Na, isCrossRegionRedirect as Nc, getAccountInfo as Ni, derivePartitionAndUrlSuffix as Nl, yellow as Nn, requireConfigString as No, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Nr, physicalNameCopiesOf as Ns, isJournaledOrphan as Nt, inheritedProvenanceForChildDiff as O, refuseMalformedNestedChildOutputs as Oa, AssetModeResolver as Oc, producerRegionsFromState as Oi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ol, bold as On, configStringRefusal as Oo, TemplateNoEchoReresolver as Or, pathCrossesDottedKey as Os, replayFailedOperations as Ot, isAbsoluteAssetPath as P, refuseMalformedOutputs as Pa, parseBootstrapMarker as Pc, isImpossibleEmptyStoredAttribute as Pi, AssemblyReader as Pl, noEchoAttributeNamesOf as Pn, prefetchCreateOnlyPropertyPaths as Po, applyCustomResourceResponseExpiration as Pr, recordAttributeIdCopy as Ps, isReplacementOrphan as Pt, pendingRequestCount as Q, repairMalformedOrphansForReadOnly as Qa, redactedCause as Qc, UNREADABLE_RESOURCES_MAP_ROW as Qi, PRE_DELETE_SNAPSHOT_TYPES as Qn, passedNoEchoParametersOf as Qo, reEnableInstanceApiTermination as Qr, isLockInfoExpired as Qs, computeParameterTaint as Qt, conditionFingerprint as R, refuseMalformedResourceEntriesForDeploy as Ra, buildDenyExternalAccessPolicy as Rc, keepsSecretReferenceToken as Ri, hasOwnKey as Rl, createReadOnlyAttributeHealerFactory as Rn, canonicalLambdaFunctionName as Ro, unchangedBehindSecretReference as Rr, provenPublicValue as Rs, recordUnderIdIsNotOwn as Rt, isTruthyCfnBoolean as S, malformedResourcePropertiesWarning as Sa, stringifyValue as Sc, AWS_CREDENTIAL_ENV_KEYS as Si, ssmResolvedValueType as Sl, formatDestructiveChange as Sn, toCfnInteger as So, CC_BROKEN_REASON as Sr, scrubResourceRecord as Ss, sameJournaledOrphans as St, IMPLICIT_DELETE_DEPENDENCIES as T, malformedStateRefusalMessage as Ta, createAssetRedirectResolver as Tc, envCredentialsAreAssumedRole as Ti, MIGRATE_TMP_PREFIX as Tl, getStackRecords as Tn, coerceCfnInteger as To, isCustomResource as Tr, DYNAMIC_REFERENCE_TOKEN_SCAN as Ts, isAccessDeniedError as Tt, diffSecurity as U, refuseMalformedResourcePropertiesForDestroy as Ua, describeDockerFailure as Uc, parseWebACLArn as Ui, describeFileReadFailure as Ul, orphanRecordsPrintingBag as Un, canonicalCoordinates as Uo, deleteSkipReason as Ur, recordProvenPublicExpression as Us, findNestedStackTypeChanges as Ut, readRecordedConditionVerdicts as V, refuseMalformedResourceEntriesForImportSave as Va, describeDockerCapturedOutput as Vc, isStalePlaceholderArnAttribute as Vi, ownValue as Vl, maskEventTextWithBoundBags as Vn, DagBuilder as Vo, deleteIndeterminateGuards as Vr, recordNoEchoAttributeValues as Vs, seedsDeleteFirstGuard as Vt, isSecretBearingReferenceString as W, refuseMalformedResourcePropertiesForDrift as Wa, dockerSpawnEnvWithSensitive as Wc, withSharedDrainBudget as Wi, displayAssemblyPath as Wl, secretNamePrintingBag as Wn, isMarkedCoordinate as Wo, withIndeterminateGuard as Wr, wholeStringLeavesOf as Ws, getCurrentProducerRegions as Wt, DeploymentEventsReader as X, refuseMalformedState as Xa, partitionSensitiveEnv as Xc, STATE_RESOURCES_MALFORMED as Xi, resolveBucketRegion as Xl, extractDeploymentEventError as Xn, noEchoLeavesOf as Xo, observeThenDisableInstanceApiTermination as Xr, isSingleDynamicReferenceToken as Xs, updatePartialMessage as Xt, planOrphanAdoption as Y, refuseMalformedResourcesForExport as Ya, isMalformedEnvKey as Yc, STATE_REGION_DIVERGED as Yi, clearBucketRegionCache as Yl, storedSecretNameNeedles as Yn, noEchoCoordinatesOf as Yo, isTerminationProtectionPropagationError as Yr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ys, redactedDeleteAddressSkip as Yt, DeploymentEventsStore as Z, repairMalformedOrphanRecordsForReadOnly as Za, redactDockerArgvValues as Zc, UNREADABLE_ORPHANS_CONTAINER_ROW as Zi, ATOMIC_FINAL_SNAPSHOT_TYPES as Zn, noEchoOutputsComparison as Zo, reDisableInstanceApiTermination as Zr, LockManager as Zs, updatePartialReason as Zt, deleteTableWithIndexBusyRetry as _, malformedOrphansWarning as _a, orphansAfterRollback as _c, assertFlagRoleArn as _i, resolveStateBucketWithDefault as _l, DEFAULT_RESOURCE_TIMEOUT_MS as _n, isStatefulRecreateTargetSync as _o, refuseMalformedDesiredTags as _r, maskSecretsInText as _s, dropFailedHint as _t, isProtectionValueActive as a, isReadableOrphanRecord as aa, isAccessDenied$1 as ac, s3BucketDomainName as ai, stripForDisplay as al, secretBearing as an, unreadableResourceEntries as ao, unsupportedFinalSnapshotError as ar, createUnionSecretMasker as as, dropSettledNestedJournals as at, S3_AUTO_DELETE_OBJECTS_TAG as b, malformedRenderedContainersWarning as ba, AssetPublisher as bc, isIamRoleArn as bi, stateBucketExistenceConfirmed as bl, constructPathOf as bn, coerceWarmThroughput as bo, definedAttributes as br, snapshotPassProvenance as bs, loadJournaledOrphans as bt, DynamoDBGlobalTableProvider as c, malformedExportNamesWarning as ca, acceptedCreateOnlyDropsOf as cc, s3BucketWebsiteUrl as ci, Synthesizer as cl, carriedExportAliasExposure as cn, findSilentDropProperties as co, reserveStackCreateToken as cr, logOnlyValueCount as cs, recordDisplacedSkips as ct, compensateRemovedDeletionProtection as d, malformedLocalResourceEntriesWarning as da, hasReadableExportSet as dc, refuseUnreadableCdkCrossAccountRefs as di, getLegacyStateBucketName as dl, isWholeDynamicReferenceValue as dn, NO_CC_HANDLERS_REASON as do, isRefusedByName as dr, recordLogOnlyValue as ds, withNestedRevertRun as dt, deployRefusesOrphanRowsReason as ea, rebuildClientForBucketRegion as ec, INTRINSIC_KEYS as ei, runDockerForeground as el, reachableDivergentParameters as en, repairMalformedResourceEntriesForReadOnly as eo, ccRoutedFinalSnapshotError as er, readsNoEchoSource as es, keptForReadoption as et, deleteBudgetKey as f, malformedLocalResourcesWarning as fa, hasReasonlessBaselineRefusal as fc, keepHeldTokenProvenance as fi, loadCdkJson as fl, noEchoParameterValueSeed as fn, hasNoCloudControlHandlers as fo, markDeleteStarted as fr, shareLogOnlyValues as fs, collectNestedChildUnaddressed as ft, INDEX_SETTLE_POLL_INTERVAL_MS as g, malformedOrphansRefusalMessage as ga, isReadableBag as gc, applyRoleArnIfSet as gi, resolveSkipPrefix as gl, bindingSkippedOutputs as gn, isStatefulRecreateTargetForReplace as go, readTagList as gr, maskSecretsInError as gs, dropFailedCommands as gt, DELETE_INDEX_WAIT_PROCEED_NOTE as h, malformedOrphanRowsKeptWarning as ha, importableOutputs as hc, recordedReferenceRegions as hi, resolveCaptureObservedState as hl, isExportAliasCollision as hn, MULTI_REGION_RECREATE_BLOCKED_TYPES as ho, planTagDiff as hr, errorCauseChain as hs, deleteJournaledOrphans as ht, PROTECTION_PROPERTY_BY_TYPE as i, hasReadableResources as ia, crossPrefixDeniedWarning as ic, s3BucketArn as ii, stripControlChars as il, exportAliasCollisionScrubWarning as in, unreadableOrphanRecords as io, refusesFinalSnapshot as ir, carryLogOnlyValues as is, displacedPhysicalIdShown as it, serviceTokenBlockingReason as j, refuseMalformedOrphans as ja, ensureAssetStorage as jc, isUnboundTemplateParameter as ji, PARTITION_TABLE as jl, green as jn, requireConfigArray as jo, getCurrentResourceSecrets as jr, recordNestedStackParameterExpressions as js, recordAfterRollbackUpdate as jt, deferredServiceTokenWarning as k, refuseMalformedOrphanRecords as ka, BOOTSTRAP_MARKER_PREFIX as kc, regionLessSecretName as ki, decodeListingKey as kl, cyan as kn, readConfigString as ko, readsNoEchoDeleteValues as kr, identityKeyFor as ks, replayRollback as kt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, malformedExportSourceWarning as la, describeRegionValueKind as lc, resolveDynamicReferences as li, synthesisStatusMessage as ll, exportNameNoEchoParameters as ln, unwrittenCreateOnlyReplacement as lo, withCreateTokenLedger as lr, printingCorpusOf as ls, revertNestedChildFromJournal as lt, resolveDynamoDbDeleteBudgetMs as m, malformedOrphanRecordsWarning as ma, importableOutputKeys as mc, recordedOutputReferenceRegions as mi, resolveAutoAssetStorage as ml, collectPublishedOutputNames as mn, shownType as mo, DBPROXY_TAG_OPTIONS as mr, createSecretMasker as ms, withNestedStackContext as mt, recordedProtectionEvidence as n, hasReadableOrphans as na, CrossPrefixScanCache as nc, poisonRenderedSpellingsCollidingIn as ni, warnFinchArgvExposure as nl, WITHHELD_NAME_DISPLAY as nn, repairMalformedResourcesForReadOnly as no, effectiveDeletionPolicy as nr, valueAtCoordinate as ns, NESTED_PENDING_PARENT_REASON as nt, perType as o, isReadableResourceEntry as oa, isNotImplemented as oc, s3BucketDualStackDomainName as oi, AssetManifestLoader as ol, secretBearingStateKeyWarning as on, withheldAccountClause as oo, earliestDefined as or, hasMaskableValues as os, getNestedRevertRun as ot, resolveDynamoDbDeleteBudgetClock as p, malformedOrphanRecordsRefusalMessage as pa, hasUnverifiableParameterRefusal as pc, outputReferenceProvenanceOf as pi, resolveApp as pl, collectDeclaredOutputNames as pn, findReplacedReadersOfRecreateTargets as po, DBPROXY_TAGS_WHAT as pr, unionOfSecretBags as ps, getCurrentNestedStackContext as pt, makeCanonicalizePropertiesFn as q, refuseMalformedResourcesForDeploy as qa, getDockerCmd as qc, declaresNoEcho as qi, injectAwsRegion as ql, secretNamedRecordNeedles as qn, maskWholeValue as qo, disableInstanceApiTermination as qr, STATE_SOURCED_READBACK_RULES as qs, isRedactedRecordedValue as qt, recordedProtectionNote as r, hasReadableOutputs as ra, applyCrossPrefixScan as rc, isSettledInstanceState as ri, escapeRegExp$3 as rl, displayTextOrWithheld as rn, unpreviewableOrphanRecords as ro, isFinalSnapshotError as rr, liveMatchesUnresolvedTokenFrame as rs, displacedOpClause as rt, readProtection as s, malformedDriftResourcePropertiesWarning as sa, splitImportedOps as sc, s3BucketRegionalDomainName as si, getDockerImageBySourceHash as sl, secretSafeKeyDisplay as sn, findActionableSilentDrops as so, ledgerForStack as sr, literalSplitDelimitersOf as ss, nestedChildStackName as st, DeployEngine as t, displayLogicalId as ta, CrossPrefixReadError as tc, IntrinsicFunctionResolver as ti, runDockerStreaming as tl, resourcesNamingDeclaredParameter as tn, repairMalformedResourcePropertiesForReadOnly as to, createPreDeleteFinalSnapshot as tr, recordedNoEchoValuesOf as ts, recordRetainedForReadoption as tt, beginDeleteWait as u, malformedLocalOutputsWarning as ua, exportNamesCarriedFrom as uc, producerLookupOver as ui, getDefaultStateBucketName as ul, exportNameSecretExposure as un, withoutSilentDropProperties as uo, acquireIdempotencyToken as ur, recordLogOnlyParameterValue as us, revertedNestedRowIds as ut, waitForIndexesSettled as v, malformedOutputsRefusalMessage as va, orphansCarriedFrom as vc, assertSendableRoleArn as vi, resolveStateBucketWithDefaultAndSource as vl, DEFAULT_RESOURCE_WARN_AFTER_MS as vn, renderStatefulReason as vo, tagMapAsList as vr, markSameGenerationBag as vs, isHandledOrphan as vt, markRefusedBeforeApplying as w, malformedScrubResourceEntriesRefusalMessage as wa, buildAssetRedirectMap as wc, callerEnvCredentials as wi, CFN_TEMPLATE_URL_LIMIT as wl, destroyStackRecordsView as wn, coerceCfnBoolean as wo, ccBrokenReason as wr, withoutPhysicalNameCopies as ws, chunks as wt, hasCdkAutoDeleteTag as x, malformedResourceEntriesWarning as xa, isSensitiveAttributeName as xc, sendableAssumeRoleCommand as xi, warnDeprecatedNoPrefixCliFlag as xl, findDestructiveChanges as xn, isWarmThroughputDecrease as xo, stringifyIfAssigned as xr, redactSecretsForState as xs, makeForeignHolderScan as xt, ECR_AUTO_DELETE_IMAGES_TAG as y, malformedOutputsWarning as ya, shouldRetainResource as yc, explicitRoleArnOrThrow as yi, resolveUseCdkBootstrapAssets as yl, maskingRetryLogger as yn, WARM_THROUGHPUT_MEMBERS as yo, tagPlanWarning as yr, recordReferenceProvenanceEntry as ys, journaledOrphanLines as yt, conditionInputsFrom as z, refuseMalformedResourceEntriesForDestroy as za, buildDockerImage as zc, AWS_NO_VALUE as zi, hasPlainPrototype$1 as zl, completedReplayEntries as zn, lambdaFunctionNameForMask as zo, RollbackInlinePolicyWriters as zr, recordMaskOnlyValue as zs, replacementNeverSwapped as zt };
-//# sourceMappingURL=deploy-engine-HAvm8vSI.js.map
+export { resolvePendingCloudControlRequests as $, repairMalformedOutputsForReadOnly as $a, warnFinchArgvExposure as $c, accountArgs as $i, buildFinalSnapshotIdentifier as $n, readbackPathFor as $o, DiffCalculator as $r, CrossPrefixScanCache as $s, namesAnyDeclaredParameter as $t, findServiceTokenRefusals as A, refuseMalformedOrphanRecordsForDestroy as Aa, isCrossRegionRedirect as Ac, coerceParameterTypedValue as Ai, derivePartitionAndUrlSuffix as Al, gray as An, replayWarn as Ao, isCustomResourceType as Ar, inheritNestedStackParameterAssociations as As, removeProtectionTypeList as At, parentSuppliedValues as B, refuseMalformedResourceEntriesForImport as Ba, describeDockerFailure as Bc, cfnRefValueFromPhysicalId as Bi, describeFileReadFailure as Bl, journaledOrphanPrintingBag as Bn, sameLambdaFunctionAddress as Bo, UNSPECIFIED_SKIP_REASON as Br, recordMaskOnlyValuesIn as Bs, resolveReplacementOldType as Bt, getPriorAttempts as C, malformedResourcesWarning as Ca, loadPublishableAssetManifest as Cc, applyCallerIdentityCredentials as Ci, findLargeInlineResources as Cl, awaitInFlightSibling as Cn, toFiniteNumber as Co, ProviderRegistry as Cr, withPhysicalNameCopies as Cs, formatResourceLine as Ct, crossStackOutputProvenanceSource as D, refuseDivergentRecordRegionForDestroy as Da, assertAssetBucketRegion as Dc, classifyReplaySecretRegion as Di, expectedOwnerParam as Dl, replacedDeleteFailureVerdict as Dn, configIntegerRefusal as Do, waitForLambdaFunctionActive as Dr, isUncertifiedBaselineMaskPosition as Ds, withApiLimit as Dt, computeImplicitDeleteEdges as E, previewableOrphanRecords as Ea, BOOTSTRAP_MARKER_PREFIX as Ec, classifyRecordedSecretRegion as Ei, decodeListingKey as El, withStackRecords as En, configBooleanRefusal as Eo, wouldReturnToSdkProvider as Er, dynamicReferenceTokens as Es, lookupEachName as Et, listNestedTemplateRows as F, refuseMalformedOutputsForDestroy as Fa, buildDenyExternalAccessPolicy as Fc, carriesDynamicReference as Fi, hasOwnKey as Fl, noEchoComparisonForTemplate as Fn, templateResourceTypes as Fo, customResourceResponseExpirationWarning as Fr, recordPhysicalNameCopy as Fs, planFailedOps as Ft, keptWholeReasonText as G, refuseMalformedResourcePropertiesForExport as Ga, isDockerClientEnvKey as Gc, parameterInputsFor as Gi, injectedAwsRegionValue as Gl, secretNamePrintingBags as Gn, maskAtCoordinates as Go, isWaitAbandonedError as Gr, STATE_SOURCED_CROSS_GENERATION_RULES as Gs, inheritProducerRegions as Gt, withResourceDeadline as H, refuseMalformedResourceEntriesForOrphan as Ha, finchSecretArgvRefusal as Hc, refStateLookupFromResource as Hi, renderAssemblyPathEscape as Hl, namingSecretsWithRecordedNoEcho as Hn, TemplateParser as Ho, deleteLeftInPlace as Hr, recordNoEchoParameterFreshValue as Hs, orphanNeedsIdentity as Ht, renderNestedTemplateTreeDefect as I, refuseMalformedResourceAttributesForOrphan as Ia, buildDockerImage as Ic, carriesFetchableDynamicReference as Ii, hasPlainPrototype$1 as Il, noEchoExactEchoLeavesOf as In, describeTypeWithThrottleRetry as Io, CloudControlProvider as Ir, splitGetAttStringForm as Is, planRollback as It, makeSiblingClaimReader as J, refuseMalformedResourcesForDestroy as Ja, redactDockerArgvValues as Jc, JSON_LISTING_HOLE_VALUE as Ji, stateSecretNameNeedles as Jn, maskedLeafCoordinatesOf as Jo, ec2InstanceProtectionSite as Jr, LockManager as Js, redactedDeleteAddressFields as Jt, mergeNoChangeOutputs as K, refuseMalformedResourcePropertiesForOrphan as Ka, isMalformedEnvKey as Kc, passedParameterClassesOf as Ki, clearBucketRegionCache as Kl, secretNamedAttributeNamesOf as Kn, maskReadbackAtCoordinates as Ko, markWaitAbandoned as Kr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ks, REDACTED_DELETE_ADDRESS_SKIP_REASON as Kt, templateIdentity as L, refuseMalformedResourceEntries as La, resolveDockerContextDirectory as Lc, isNamelessDynamicReferenceError as Li, nullPrototypeRecord as Ll, noEchoParameterNamesOf as Ln, withRetry as Lo, slowCcOperationTimeoutMs as Lr, carriesSecretMask as Ls, recheckFailedPlan as Lt, childTemplateLoader as M, refuseMalformedOrphansForDestroy as Ma, readBootstrapMarkerBody as Mc, parameterTypeMayLoseSecretIdentity as Mi, StageLoadError as Ml, red as Mn, requireConfigObject as Mo, withPrintingSecrets as Mr, recoverMaskedOutput as Ms, demoteSupersededOrphans as Mt, findNestedTemplateTreeDefect as N, refuseMalformedOrphansForOrphan as Na, validateAssetBucketName as Nc, getAccountInfo as Ni, processStackMessages as Nl, yellow as Nn, requireConfigString as No, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Nr, physicalNameCopiesOf as Ns, isJournaledOrphan as Nt, inheritedProvenanceForChildDiff as O, refuseMalformedNestedChildOutputs as Oa, ensureAssetStorage as Oc, producerRegionsFromState as Oi, PARTITION_TABLE as Ol, bold as On, configStringRefusal as Oo, TemplateNoEchoReresolver as Or, pathCrossesDottedKey as Os, replayFailedOperations as Ot, isAbsoluteAssetPath as P, refuseMalformedOutputs as Pa, validateContainerRepoName as Pc, isImpossibleEmptyStoredAttribute as Pi, defineOwnKey as Pl, noEchoAttributeNamesOf as Pn, prefetchCreateOnlyPropertyPaths as Po, applyCustomResourceResponseExpiration as Pr, recordAttributeIdCopy as Ps, isReplacementOrphan as Pt, pendingRequestCount as Q, repairMalformedOrphansForReadOnly as Qa, runDockerStreaming as Qc, UNREADABLE_RESOURCES_MAP_ROW as Qi, PRE_DELETE_SNAPSHOT_TYPES as Qn, passedNoEchoParametersOf as Qo, reEnableInstanceApiTermination as Qr, CrossPrefixReadError as Qs, computeParameterTaint as Qt, conditionFingerprint as R, refuseMalformedResourceEntriesForDeploy as Ra, describeDockerCapturedOutput as Rc, keepsSecretReferenceToken as Ri, ownValue as Rl, createReadOnlyAttributeHealerFactory as Rn, canonicalLambdaFunctionName as Ro, unchangedBehindSecretReference as Rr, provenPublicValue as Rs, recordUnderIdIsNotOwn as Rt, isTruthyCfnBoolean as S, malformedResourcePropertiesWarning as Sa, createAssetRedirectResolver as Sc, AWS_CREDENTIAL_ENV_KEYS as Si, MIGRATE_TMP_PREFIX as Sl, formatDestructiveChange as Sn, toCfnInteger as So, CC_BROKEN_REASON as Sr, scrubResourceRecord as Ss, sameJournaledOrphans as St, IMPLICIT_DELETE_DEPENDENCIES as T, malformedStateRefusalMessage as Ta, AssetModeResolver as Tc, envCredentialsAreAssumedRole as Ti, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Tl, getStackRecords as Tn, coerceCfnInteger as To, isCustomResource as Tr, DYNAMIC_REFERENCE_TOKEN_SCAN as Ts, isAccessDeniedError as Tt, diffSecurity as U, refuseMalformedResourcePropertiesForDestroy as Ua, formatDockerLoginError as Uc, parseWebACLArn as Ui, resolveAssemblyPath as Ul, orphanRecordsPrintingBag as Un, canonicalCoordinates as Uo, deleteSkipReason as Ur, recordProvenPublicExpression as Us, findNestedStackTypeChanges as Ut, readRecordedConditionVerdicts as V, refuseMalformedResourceEntriesForImportSave as Va, dockerSpawnEnvWithSensitive as Vc, isStalePlaceholderArnAttribute as Vi, displayAssemblyPath as Vl, maskEventTextWithBoundBags as Vn, DagBuilder as Vo, deleteIndeterminateGuards as Vr, recordNoEchoAttributeValues as Vs, seedsDeleteFirstGuard as Vt, isSecretBearingReferenceString as W, refuseMalformedResourcePropertiesForDrift as Wa, getDockerCmd as Wc, withSharedDrainBudget as Wi, injectAwsRegion as Wl, secretNamePrintingBag as Wn, isMarkedCoordinate as Wo, withIndeterminateGuard as Wr, wholeStringLeavesOf as Ws, getCurrentProducerRegions as Wt, DeploymentEventsReader as X, refuseMalformedState as Xa, redactedDockerCause as Xc, STATE_RESOURCES_MALFORMED as Xi, extractDeploymentEventError as Xn, noEchoLeavesOf as Xo, observeThenDisableInstanceApiTermination as Xr, S3StateBackend as Xs, updatePartialMessage as Xt, planOrphanAdoption as Y, refuseMalformedResourcesForExport as Ya, redactedCause as Yc, STATE_REGION_DIVERGED as Yi, storedSecretNameNeedles as Yn, noEchoCoordinatesOf as Yo, isTerminationProtectionPropagationError as Yr, isLockInfoExpired as Ys, redactedDeleteAddressSkip as Yt, DeploymentEventsStore as Z, repairMalformedOrphanRecordsForReadOnly as Za, runDockerForeground as Zc, UNREADABLE_ORPHANS_CONTAINER_ROW as Zi, ATOMIC_FINAL_SNAPSHOT_TYPES as Zn, noEchoOutputsComparison as Zo, reDisableInstanceApiTermination as Zr, rebuildClientForBucketRegion as Zs, updatePartialReason as Zt, deleteTableWithIndexBusyRetry as _, malformedOrphansWarning as _a, AssetPublisher as _c, assertFlagRoleArn as _i, stateBucketExistenceConfirmed as _l, DEFAULT_RESOURCE_TIMEOUT_MS as _n, isStatefulRecreateTargetSync as _o, refuseMalformedDesiredTags as _r, maskSecretsInError as _s, dropFailedHint as _t, isProtectionValueActive as a, isReadableOrphanRecord as aa, acceptedCreateOnlyDropsOf as ac, s3BucketDomainName as ai, Synthesizer as al, secretBearing as an, unreadableResourceEntries as ao, unsupportedFinalSnapshotError as ar, carryLogOnlyValues as as, dropSettledNestedJournals as at, S3_AUTO_DELETE_OBJECTS_TAG as b, malformedRenderedContainersWarning as ba, WorkGraph as bc, isIamRoleArn as bi, CFN_TEMPLATE_BODY_LIMIT as bl, constructPathOf as bn, coerceWarmThroughput as bo, definedAttributes as br, recordReferenceProvenanceEntry as bs, loadJournaledOrphans as bt, DynamoDBGlobalTableProvider as c, malformedExportNamesWarning as ca, hasReadableExportSet as cc, s3BucketWebsiteUrl as ci, getLegacyStateBucketName as cl, carriedExportAliasExposure as cn, findSilentDropProperties as co, reserveStackCreateToken as cr, literalSplitDelimitersOf as cs, recordDisplacedSkips as ct, compensateRemovedDeletionProtection as d, malformedLocalResourceEntriesWarning as da, importableOutputKeys as dc, refuseUnreadableCdkCrossAccountRefs as di, resolveAutoAssetStorage as dl, isWholeDynamicReferenceValue as dn, NO_CC_HANDLERS_REASON as do, isRefusedByName as dr, recordLogOnlyParameterValue as ds, withNestedRevertRun as dt, deployRefusesOrphanRowsReason as ea, applyCrossPrefixScan as ec, INTRINSIC_KEYS as ei, escapeRegExp$3 as el, reachableDivergentParameters as en, repairMalformedResourceEntriesForReadOnly as eo, ccRoutedFinalSnapshotError as er, readsNoEchoSource as es, keptForReadoption as et, deleteBudgetKey as f, malformedLocalResourcesWarning as fa, importableOutputs as fc, keepHeldTokenProvenance as fi, resolveCaptureObservedState as fl, noEchoParameterValueSeed as fn, hasNoCloudControlHandlers as fo, markDeleteStarted as fr, recordLogOnlyValue as fs, collectNestedChildUnaddressed as ft, INDEX_SETTLE_POLL_INTERVAL_MS as g, malformedOrphansRefusalMessage as ga, shouldRetainResource as gc, applyRoleArnIfSet as gi, resolveUseCdkBootstrapAssets as gl, bindingSkippedOutputs as gn, isStatefulRecreateTargetForReplace as go, readTagList as gr, errorCauseChain as gs, dropFailedCommands as gt, DELETE_INDEX_WAIT_PROCEED_NOTE as h, malformedOrphanRowsKeptWarning as ha, orphansCarriedFrom as hc, recordedReferenceRegions as hi, resolveStateBucketWithDefaultAndSource as hl, isExportAliasCollision as hn, MULTI_REGION_RECREATE_BLOCKED_TYPES as ho, planTagDiff as hr, createSecretMasker as hs, deleteJournaledOrphans as ht, PROTECTION_PROPERTY_BY_TYPE as i, hasReadableResources as ia, splitImportedOps as ic, s3BucketArn as ii, getDockerImageBySourceHash as il, exportAliasCollisionScrubWarning as in, unreadableOrphanRecords as io, refusesFinalSnapshot as ir, liveMatchesUnresolvedTokenFrame as is, displacedPhysicalIdShown as it, serviceTokenBlockingReason as j, refuseMalformedOrphans as ja, parseBootstrapMarker as jc, isUnboundTemplateParameter as ji, AssemblyReader as jl, green as jn, requireConfigArray as jo, getCurrentResourceSecrets as jr, recordNestedStackParameterExpressions as js, recordAfterRollbackUpdate as jt, deferredServiceTokenWarning as k, refuseMalformedOrphanRecords as ka, getBootstrapMarkerKey as kc, regionLessSecretName as ki, canonicalizeRegion as kl, cyan as kn, readConfigString as ko, readsNoEchoDeleteValues as kr, identityKeyFor as ks, replayRollback as kt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, malformedExportSourceWarning as la, hasReasonlessBaselineRefusal as lc, resolveDynamicReferences as li, loadCdkJson as ll, exportNameNoEchoParameters as ln, unwrittenCreateOnlyReplacement as lo, withCreateTokenLedger as lr, logOnlyValueCount as ls, revertNestedChildFromJournal as lt, resolveDynamoDbDeleteBudgetMs as m, malformedOrphanRecordsWarning as ma, orphansAfterRollback as mc, recordedOutputReferenceRegions as mi, resolveStateBucketWithDefault as ml, collectPublishedOutputNames as mn, shownType as mo, DBPROXY_TAG_OPTIONS as mr, unionOfSecretBags as ms, withNestedStackContext as mt, recordedProtectionEvidence as n, hasReadableOrphans as na, isAccessDenied$1 as nc, poisonRenderedSpellingsCollidingIn as ni, stripForDisplay as nl, WITHHELD_NAME_DISPLAY as nn, repairMalformedResourcesForReadOnly as no, effectiveDeletionPolicy as nr, valueAtCoordinate as ns, NESTED_PENDING_PARENT_REASON as nt, perType as o, isReadableResourceEntry as oa, describeRegionValueKind as oc, s3BucketDualStackDomainName as oi, synthesisStatusMessage as ol, secretBearingStateKeyWarning as on, withheldAccountClause as oo, earliestDefined as or, createUnionSecretMasker as os, getNestedRevertRun as ot, resolveDynamoDbDeleteBudgetClock as p, malformedOrphanRecordsRefusalMessage as pa, isReadableBag as pc, outputReferenceProvenanceOf as pi, resolveSkipPrefix as pl, collectDeclaredOutputNames as pn, findReplacedReadersOfRecreateTargets as po, DBPROXY_TAGS_WHAT as pr, shareLogOnlyValues as ps, getCurrentNestedStackContext as pt, makeCanonicalizePropertiesFn as q, refuseMalformedResourcesForDeploy as qa, partitionSensitiveEnv as qc, declaresNoEcho as qi, resolveBucketRegion as ql, secretNamedRecordNeedles as qn, maskWholeValue as qo, disableInstanceApiTermination as qr, isSingleDynamicReferenceToken as qs, isRedactedRecordedValue as qt, recordedProtectionNote as r, hasReadableOutputs as ra, isNotImplemented as rc, isSettledInstanceState as ri, AssetManifestLoader as rl, displayTextOrWithheld as rn, unpreviewableOrphanRecords as ro, isFinalSnapshotError as rr, redactForState as rs, displacedOpClause as rt, readProtection as s, malformedDriftResourcePropertiesWarning as sa, exportNamesCarriedFrom as sc, s3BucketRegionalDomainName as si, getDefaultStateBucketName as sl, secretSafeKeyDisplay as sn, findActionableSilentDrops as so, ledgerForStack as sr, hasMaskableValues as ss, nestedChildStackName as st, DeployEngine as t, displayLogicalId as ta, crossPrefixDeniedWarning as tc, IntrinsicFunctionResolver as ti, stripControlChars as tl, resourcesNamingDeclaredParameter as tn, repairMalformedResourcePropertiesForReadOnly as to, createPreDeleteFinalSnapshot as tr, recordedNoEchoValuesOf as ts, recordRetainedForReadoption as tt, beginDeleteWait as u, malformedLocalOutputsWarning as ua, hasUnverifiableParameterRefusal as uc, producerLookupOver as ui, resolveApp as ul, exportNameSecretExposure as un, withoutSilentDropProperties as uo, acquireIdempotencyToken as ur, printingCorpusOf as us, revertedNestedRowIds as ut, waitForIndexesSettled as v, malformedOutputsRefusalMessage as va, isSensitiveAttributeName as vc, assertSendableRoleArn as vi, warnDeprecatedNoPrefixCliFlag as vl, DEFAULT_RESOURCE_WARN_AFTER_MS as vn, renderStatefulReason as vo, tagMapAsList as vr, maskSecretsInText as vs, isHandledOrphan as vt, markRefusedBeforeApplying as w, malformedScrubResourceEntriesRefusalMessage as wa, rewriteTemplateAssetReferences as wc, callerEnvCredentials as wi, uploadCfnTemplate as wl, destroyStackRecordsView as wn, coerceCfnBoolean as wo, ccBrokenReason as wr, withoutPhysicalNameCopies as ws, chunks as wt, hasCdkAutoDeleteTag as x, malformedResourceEntriesWarning as xa, buildAssetRedirectMap as xc, sendableAssumeRoleCommand as xi, CFN_TEMPLATE_URL_LIMIT as xl, findDestructiveChanges as xn, isWarmThroughputDecrease as xo, stringifyIfAssigned as xr, snapshotPassProvenance as xs, makeForeignHolderScan as xt, ECR_AUTO_DELETE_IMAGES_TAG as y, malformedOutputsWarning as ya, stringifyValue as yc, explicitRoleArnOrThrow as yi, ssmResolvedValueType as yl, maskingRetryLogger as yn, WARM_THROUGHPUT_MEMBERS as yo, tagPlanWarning as yr, markSameGenerationBag as ys, journaledOrphanLines as yt, conditionInputsFrom as z, refuseMalformedResourceEntriesForDestroy as za, describeDockerExecFailure as zc, AWS_NO_VALUE as zi, absoluteAssemblyPathEscape as zl, completedReplayEntries as zn, lambdaFunctionNameForMask as zo, RollbackInlinePolicyWriters as zr, recordMaskOnlyValue as zs, replacementNeverSwapped as zt };
+//# sourceMappingURL=deploy-engine-D1z0QUsv.js.map