@go-to-k/cdkd 0.301.5 → 0.301.7

package/dist/{deploy-engine-HAvm8vSI.js → deploy-engine-zLKsm0IM.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-B_CEQGE1.js";
 import { A as UNRENDERABLE, B as safeMsg, C as looksLikeCdkdGeneratedName, D as SAFE_MSG_ALTERED_CHAR, E as withoutGeneratedFallbackName, F as displaySafe, H as terminalSafe, I as displayStackName, L as isPasteableIdent, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, S as getCurrentStackName, T as withStackName, U as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, j as asIsMessage, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, An as SHELL_ACTIVE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, Ct as RETRY_AUXILIARY_OWNER, Dn as normalizeAwsError, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as isUpdateUnsupportedError, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as withheldTargetClause, Ht as recoveryCommandFlags, In as pasteableCommand, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as isNameCooldownError, Kn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as physicalIdShownBesideCommand, M as quotedRemedyLogicalId, Mn as UNSHOWABLE_VALUE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Ot as hasCreatedBeforeFailure, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as plainOrDescribed, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Ut as sanitizeRecoveryValue, Vn as shellQuote, Vt as formatLockOwner, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isReplayedNameCollisionFrom, Yn as isRecreateRetryableError, Yt as producerRecordKey, Zt as withPasteableAwsProfile, _t as createMaskedLogSinks, ar as isRetryableTransientError, at as startInterruptWatch, bn as ResourceUpdateNotSupportedError, bt as maskDeep, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dr as markNonRetryable, en as clientDefaultsFor, er as formatRetryClassificationSignals, f as removalWarning, fr as markRedactedCause, ft as logicalIdShown, gt as stateOrphanRecordRemedy, hn as MalformedProducerRecordRefusalError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isIamPropagationError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as SHELL_ACTIVE_WHY, jt as markAuxiliaryFailure, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DynamicReferenceRegionAmbiguousError, lr as isMarkedNonRetryable, m as withoutInjectedRemovals, mn as MacroExpansionError, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, on as CrossAccountSecretRefusalError, or as isTransientServerError, ot as ElapsedBudgetRegistry, pn as LockError, pr as wrapMaskedAwsError, qn as isNameCollisionErrorFrom, rn as AssetError, sn as DependencyError, sr as retryClassificationText, st as monotonicNowMs, tn as credentialFingerprint, tr as isAmbiguousCcHandlerErrorCode, un as IntrinsicResolutionRefusalError, ur as isThrottlingError, ut as compositeIdSeparatorRefusal, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as SynthesisError, wt as carryCreatedBeforeFailure, xt as maskerOrIdentity, yn as ResourceTimeoutError, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-BkeM7IXi.js";
+import { $ as protectedReplacementAdvice, $n as markReplayMayCollide, $t as ambientCredentialConfig, A as isQuotableImportValue, An as SHELL_ACTIVE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, Ct as RETRY_AUXILIARY_OWNER, Dn as normalizeAwsError, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as isUpdateUnsupportedError, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as withheldTargetClause, Ht as recoveryCommandFlags, In as pasteableCommand, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as isNameCollisionErrorFrom, Kn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as physicalIdShownBesideCommand, M as quotedRemedyLogicalId, Mn as UNSHOWABLE_VALUE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Ot as hasCreatedBeforeFailure, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as plainOrDescribed, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Ut as sanitizeRecoveryValue, Vn as shellQuote, Vt as formatLockOwner, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isRecreateRetryableError, Yn as isNameCooldownError, Yt as producerRecordKey, Zn as isReplayedNameCollisionFrom, Zt as withPasteableAwsProfile, _t as createMaskedLogSinks, ar as isIamPropagationError, at as startInterruptWatch, bn as ResourceUpdateNotSupportedError, bt as maskDeep, cr as retryClassificationText, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dr as isThrottlingError, en as clientDefaultsFor, f as removalWarning, fr as markNonRetryable, ft as logicalIdShown, gt as stateOrphanRecordRemedy, hn as MalformedProducerRecordRefusalError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as SHELL_ACTIVE_WHY, jt as markAuxiliaryFailure, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DynamicReferenceRegionAmbiguousError, m as withoutInjectedRemovals, mn as MacroExpansionError, mr as wrapMaskedAwsError, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as isAmbiguousCcHandlerErrorCode, on as CrossAccountSecretRefusalError, or as isRetryableTransientError, ot as ElapsedBudgetRegistry, pn as LockError, pr as markRedactedCause, rn as AssetError, rr as isAmbiguousOutcomeError, sn as DependencyError, sr as isTransientServerError, st as monotonicNowMs, tn as credentialFingerprint, tr as formatRetryClassificationSignals, un as IntrinsicResolutionRefusalError, ur as isMarkedNonRetryable, ut as compositeIdSeparatorRefusal, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as SynthesisError, wt as carryCreatedBeforeFailure, xt as maskerOrIdentity, yn as ResourceTimeoutError, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-LyArt3ew.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-DBXBcg0J.js";
-import { t as getCdkdVersion } from "./version-2jeKJQlt.js";
+import { t as getCdkdVersion } from "./version-MUc6NbW0.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7748,7 +7748,10 @@ function certifiedExpressionForLeaf(secrets, association, leaf) {
 function certifiedListForLeaf(secrets, association, bag) {
 	const certified = bag.map((element) => certifiedExpressionForLeaf(secrets, association, element));
 	if (certified.every((expression) => expression === void 0)) return void 0;
-	return bag.map((element, i) => certified[i] ?? redactSecretsForState(element, secrets));
+	return bag.map((element, i) => certified[i] ?? redactForState(element, {
+		provenance: "value-scan",
+		secrets
+	}));
 }
 function associationForSource(source, secrets) {
 	const key = crossStackSourceKey(source);
@@ -7972,7 +7975,7 @@ const NESTED_STACK_RESOURCE_TYPE$4 = "AWS::CloudFormation::Stack";
 const nestedStackParameterExpressions = /* @__PURE__ */ new WeakMap();
 const renderedParameterSpellings = /* @__PURE__ */ new WeakMap();
 const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
-function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, rules = TEMPLATE_DERIVED_RULES) {
+function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, provenance = "template-derived") {
 	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$4) return;
 	if (secrets.size === 0) return;
 	if (!isPlainObject$7(resolvedProperties) || !isPlainObject$7(sourceProperties)) return;
@@ -7981,7 +7984,7 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 	const resolvedParameters = resolvedProperties["Parameters"];
 	const sourceParameters = sourceProperties["Parameters"];
 	if (!isPlainObject$7(resolvedParameters) || !isPlainObject$7(sourceParameters)) return;
-	const positioned = redactSecretsForState(markSameGenerationBag({ ...resolvedParameters }), secrets, sourceParameters, rules);
+	const positioned = redactAtProvenance({ ...resolvedParameters }, secrets, sourceParameters, provenance, true);
 	let table = nestedStackParameterExpressions.get(secrets);
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
 		const sourceLeaf = sourceParameters[name];
@@ -8074,7 +8077,10 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 		if (typeof resolvedValue !== "string") continue;
 		const spelling = certifiedSpellingOf(name);
 		if (spelling === void 0) continue;
-		if (redactSecretsForState(resolvedValue, secrets) !== resolvedValue) continue;
+		if (redactForState(resolvedValue, {
+			provenance: "value-scan",
+			secrets
+		}) !== resolvedValue) continue;
 		const frame = singleSpanFrame(resolvedValue, spelling);
 		if (frame === void 0 || resolvedPlaintextOf(secrets, frame.token) !== frame.middle) continue;
 		if (framesByValue.get(resolvedValue)?.size !== 1) continue;
@@ -8165,7 +8171,10 @@ function inheritedRenderedSpan(childSecrets, key, text) {
 		if (carriesChildOnlyPlaintext(value, childSecrets, reads.parent)) return void 0;
 		const spelling = inheritedParameterExpression(reads.parent, name, value);
 		if (typeof spelling !== "string") return void 0;
-		if (redactSecretsForState(spelling, childSecrets) !== spelling) return void 0;
+		if (redactForState(spelling, {
+			provenance: "value-scan",
+			secrets: childSecrets
+		}) !== spelling) return void 0;
 		return {
 			value,
 			spelling
@@ -8212,7 +8221,10 @@ function recordInheritedParameterRead(childSecrets, parentSecrets, parameterName
 	parameterReadsFor(childSecrets, parentSecrets)?.names.add(parameterName);
 }
 function redactInheritedParameterValue(parentSecrets, parameterName, value) {
-	return inheritedParameterExpression(parentSecrets, parameterName, value) ?? redactSecretsForState(value, parentSecrets);
+	return inheritedParameterExpression(parentSecrets, parameterName, value) ?? redactForState(value, {
+		provenance: "value-scan",
+		secrets: parentSecrets
+	});
 }
 function positionByInheritedParameter(bag, source, secrets) {
 	const keys = Object.keys(source);
@@ -8224,7 +8236,10 @@ function positionByInheritedParameter(bag, source, secrets) {
 	if (typeof bag !== "string" && !Array.isArray(bag)) return void 0;
 	if (carriesChildOnlyPlaintext(bag, secrets, reads.parent)) return void 0;
 	const answer = redactInheritedParameterValue(reads.parent, name, bag);
-	if (!deepEqualJsonValue(redactSecretsForState(answer, secrets), answer)) return void 0;
+	if (!deepEqualJsonValue(redactForState(answer, {
+		provenance: "value-scan",
+		secrets
+	}), answer)) return void 0;
 	return answer;
 }
 const REREAD_PSEUDO_PARAMETERS = /* @__PURE__ */ new Set([
@@ -8444,7 +8459,10 @@ function holdsRereadTrigger(node, depth = 0) {
 }
 function rendersReadTo(spelling, parentSecrets, value) {
 	if (typeof spelling === "string" && typeof value === "string") {
-		if (spelling === value) return redactSecretsForState(spelling, parentSecrets) === spelling;
+		if (spelling === value) return redactForState(spelling, {
+			provenance: "value-scan",
+			secrets: parentSecrets
+		}) === spelling;
 		return rendersLiteralTo(spelling, parentSecrets, value);
 	}
 	if (Array.isArray(spelling) && Array.isArray(value) && spelling.length === value.length) return spelling.every((element, i) => rendersReadTo(element, parentSecrets, value[i]));
@@ -8552,7 +8570,10 @@ function positionByParameterReread(bag, source, secrets) {
 		answer = matching[0].redacted;
 	}
 	if (carriesChildOnlyPlaintext(bag, secrets, reads.parent)) return void 0;
-	if (!deepEqualJsonValue(redactSecretsForState(answer, secrets), answer)) return void 0;
+	if (!deepEqualJsonValue(redactForState(answer, {
+		provenance: "value-scan",
+		secrets
+	}), answer)) return void 0;
 	return answer;
 }
 function carriesChildOnlyPlaintext(value, childSecrets, parentSecrets) {
@@ -8720,7 +8741,10 @@ function positionByParameterPlaceholders(bag, source, secrets) {
 		if (bag.length < before[0].length + after[0].length) return void 0;
 		if (!bag.startsWith(before[0]) || !bag.endsWith(after[0])) return void 0;
 		const middle = bag.slice(before[0].length, bag.length - after[0].length);
-		if (redactSecretsForState(middle, secrets) !== middle) return void 0;
+		if (redactForState(middle, {
+			provenance: "value-scan",
+			secrets
+		}) !== middle) return void 0;
 		persisted = before[1] + middle + after[1];
 	}
 	const afterStart = bag.length - after[0].length;
@@ -8734,7 +8758,10 @@ function acceptedPlaceholderRendering(bag, persisted, spans, secrets) {
 			for (const [start, length] of spans) if (at < start + length && end > start && (at < start || end > start + length)) return void 0;
 		}
 	}
-	if (redactSecretsForState(persisted, secrets) !== persisted) return void 0;
+	if (redactForState(persisted, {
+		provenance: "value-scan",
+		secrets
+	}) !== persisted) return void 0;
 	return persisted;
 }
 function positionByRecordedParameterSpans(bag, source, secrets, associations) {
@@ -8764,7 +8791,10 @@ function positionByRecordedParameterSpans(bag, source, secrets, associations) {
 	const tail = bag.slice(cursor);
 	gaps.push(tail);
 	persisted += tail;
-	for (const gap of gaps) if (redactSecretsForState(gap, secrets) !== gap) return void 0;
+	for (const gap of gaps) if (redactForState(gap, {
+		provenance: "value-scan",
+		secrets
+	}) !== gap) return void 0;
 	return acceptedPlaceholderRendering(bag, persisted, certified, secrets);
 }
 
@@ -8874,7 +8904,10 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 	if (isDynamicReferenceString(source) && typeof bag === "string") {
 		if (isSingleDynamicReferenceToken(source) && (rules.trustAnyExpression || isKnownSecretExpression(source, secretExpressions))) {
 			if (!rules.sourceIsSameGeneration && isSingleDynamicReferenceToken(bag)) {
-				if (!spanNamesResolvableService(bag)) return redactSecretsForState(bag, secrets);
+				if (!spanNamesResolvableService(bag)) return redactForState(bag, {
+					provenance: "value-scan",
+					secrets
+				});
 				return secrets.get(bag) ?? bag;
 			}
 			return source;
@@ -8920,7 +8953,10 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 				const j = partnerIndex[i];
 				if (j >= 0) return redactByPath(item, source[j], secrets, rules, secretExpressions, bagIsSameGeneration);
 				if (positionalIsExact) return redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration);
-				return redactSecretsForState(item, secrets);
+				return redactForState(item, {
+					provenance: "value-scan",
+					secrets
+				});
 			});
 		}
 		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration));
@@ -8931,10 +8967,16 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 	}
 	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source)) {
 		const out = Object.create(null);
-		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactSecretsForState(v, secrets);
+		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactForState(v, {
+			provenance: "value-scan",
+			secrets
+		});
 		return out;
 	}
-	return redactSecretsForState(bag, secrets);
+	return redactForState(bag, {
+		provenance: "value-scan",
+		secrets
+	});
 }
 function isReadbackProjectedFromState(rules) {
 	return rules.trustAnyExpression && !rules.descendArrays && rules.sourceIsSameGeneration;
@@ -9247,20 +9289,23 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 
 //#endregion
 //#region src/deployment/secret-redaction/redact-state.ts
-function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RULES) {
-	return flattenEmbeddedNoEchoLeaves(redactSecretsForStatePasses(bag, secrets, source, rules), secrets);
+function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RULES, bagIsSameGeneration = false) {
+	return flattenEmbeddedNoEchoLeaves(redactSecretsForStatePasses(bag, secrets, source, rules, bagIsSameGeneration), secrets);
 }
-function redactSecretsForStatePasses(bag, secrets, source, rules) {
+function redactSecretsForStatePasses(bag, secrets, source, rules, bagIsSameGeneration) {
 	if (secrets.size === 0 && source === void 0) return bag;
 	if (source !== void 0) {
-		const positioned = redactByPath(bag, source, secrets, rules, recordedExpressionsOf(secrets), isSameGenerationBag(bag));
+		const positioned = redactByPath(bag, source, secrets, rules, recordedExpressionsOf(secrets), bagIsSameGeneration);
 		if (!isReadbackProjectedFromState(rules)) return positioned;
 		const failClosed = rules.failClosedOnUncertifiedPositions === true;
 		const refused = refuseUncertifiedReadbackPositions(positioned, source, secrets, failClosed);
 		const derived = deriveReadbackNeedles(bag, source, secrets, rules);
 		if (derived === void 0) return refused;
 		const marks = refuseUncertifiedReadbackPositions(positioned, source, secrets, failClosed, void 0, true);
-		return preferPositionDecisions(redactSecretsForState(bag, derived.certain), refused, bag, marks, derived.inferred);
+		return preferPositionDecisions(redactForState(bag, {
+			provenance: "value-scan",
+			secrets: derived.certain
+		}), refused, bag, marks, derived.inferred);
 	}
 	const regex = buildNeedleRegex(substringNeedlesOf(secrets));
 	const wholeValueExpr = (s) => s === "" ? void 0 : secrets.get(s);
@@ -9426,18 +9471,29 @@ function redactOverlappingMatches(value, matches, redacted, expressionFor) {
 	}
 	return out + value.slice(cursor);
 }
-function scrubResourceRecord(record, secrets, sourceProperties, observedRules) {
+function scrubResourceRecord(record, secrets, sourceProperties, observedProvenance, claims = {}) {
+	const propertiesClaimed = claims.properties === "same-generation";
+	const observedClaimed = claims.observed === "same-generation";
 	if (secrets.size === 0 && sourceProperties === void 0 && !record.observedProperties) return record;
 	const next = { ...record };
-	next.properties = redactSecretsForState(record.properties, secrets, sourceProperties);
+	next.properties = sourceProperties === void 0 ? redactForState(record.properties, {
+		provenance: "value-scan",
+		secrets
+	}) : redactAtProvenance(record.properties, secrets, sourceProperties, "template-derived", propertiesClaimed);
 	if (record.attributes) {
 		const ownId = record.physicalId;
 		const ids = [...attributeIdCopiesOf.get(secrets) ?? []];
 		if (typeof ownId === "string" && ownId !== "") ids.push(ownId);
 		const attributes = record.attributes;
-		next.attributes = ids.length > 0 ? withPhysicalNameCopies(secrets, ids, () => redactSecretsForState(attributes, secrets)) : redactSecretsForState(attributes, secrets);
+		next.attributes = ids.length > 0 ? withPhysicalNameCopies(secrets, ids, () => redactForState(attributes, {
+			provenance: "value-scan",
+			secrets
+		})) : redactForState(attributes, {
+			provenance: "value-scan",
+			secrets
+		});
 	}
-	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets, sourceProperties ?? next.properties, observedRules ?? (sourceProperties !== void 0 ? TEMPLATE_SOURCED_RULES : secrets.size === 0 && isSameGenerationBag(record.observedProperties) ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES));
+	if (record.observedProperties) next.observedProperties = redactAtProvenance(record.observedProperties, secrets, sourceProperties ?? next.properties, observedProvenance ?? (sourceProperties !== void 0 ? "template-sourced" : secrets.size === 0 && observedClaimed ? "state-baseline" : "state-readback"), observedClaimed);
 	return next;
 }
 function withoutPhysicalNameCopies(secrets, run) {
@@ -9499,7 +9555,10 @@ function embeddedPhysicalNameRewrites(secrets, legacySecrets = secrets) {
 	const pairs = [];
 	withoutPhysicalNameCopies(legacySecrets, () => {
 		for (const name of names) {
-			const legacy = redactSecretsForState(name, legacySecrets);
+			const legacy = redactForState(name, {
+				provenance: "value-scan",
+				secrets: legacySecrets
+			});
 			if (typeof legacy === "string" && legacy !== name && legacy.includes("{{resolve:") && !isSingleDynamicReferenceToken(legacy) && !legacy.includes("***")) pairs.push([legacy, name]);
 		}
 	});
@@ -9568,6 +9627,37 @@ function repairEmbeddedPhysicalNamesTowards(stored, target, pairs) {
 	return stored;
 }
 
+//#endregion
+//#region src/deployment/secret-redaction/context.ts
+const RULES_BY_PROVENANCE = {
+	"template-derived": TEMPLATE_DERIVED_RULES,
+	"template-sourced": TEMPLATE_SOURCED_RULES,
+	"state-readback": STATE_SOURCED_READBACK_RULES,
+	"state-baseline": STATE_SOURCED_BASELINE_RULES,
+	"state-cross-generation": STATE_SOURCED_CROSS_GENERATION_RULES,
+	"state-derived": STATE_DERIVED_RULES
+};
+function redactForState(bag, context) {
+	if (context.provenance === "value-scan") return redactSecretsForState(bag, context.secrets);
+	const { secrets, source, provenance } = context;
+	if (!((context.provenance === "template-derived" || context.provenance === "template-sourced") && context.generation === "same-generation") || !isPlainBag(bag)) return redactAtProvenance(bag, secrets, source, provenance, false);
+	const copy = shallowCopy(bag);
+	const redacted = redactAtProvenance(copy, secrets, source, provenance, true);
+	return redacted === copy ? shallowCopy(copy) : redacted;
+}
+function redactAtProvenance(bag, secrets, source, provenance, sameGeneration) {
+	return redactSecretsForState(bag, secrets, source, RULES_BY_PROVENANCE[provenance], sameGeneration);
+}
+function isPlainBag(bag) {
+	if (Array.isArray(bag)) return true;
+	if (bag === null || typeof bag !== "object") return false;
+	const proto = Object.getPrototypeOf(bag);
+	return proto === Object.prototype || proto === null;
+}
+function shallowCopy(bag) {
+	return Array.isArray(bag) ? [...bag] : { ...bag };
+}
+
 //#endregion
 //#region src/deployment/secret-redaction/positions.ts
 const SKELETON_WILDCARD = `${DYNAMIC_REFERENCE_INNER_CHAR}*`;
@@ -9674,10 +9764,16 @@ function positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration) {
 	const frame = singleSpanFrame(bag, source);
 	if (frame === void 0) {
 		if (dynamicReferenceSpans(source).length >= 2 && certifiesRenderedLiteral(bag, source, secrets, bagIsSameGeneration)) return source;
-		return redactSecretsForState(bag, secrets);
+		return redactForState(bag, {
+			provenance: "value-scan",
+			secrets
+		});
 	}
 	const recorded = resolvedPlaintextOf(secrets, frame.token);
-	if (recorded === void 0 || recorded !== frame.middle) return redactSecretsForState(bag, secrets);
+	if (recorded === void 0 || recorded !== frame.middle) return redactForState(bag, {
+		provenance: "value-scan",
+		secrets
+	});
 	return writeFramedTokenWithinScanBound(bag, secrets, frame, bagIsSameGeneration);
 }
 function pairedSpans(source, secrets) {
@@ -9717,7 +9813,10 @@ function renderedLiteralSpans(spelling, secrets, value) {
 	const spans = pairedSpans(spelling, secrets);
 	if (spans === void 0) return void 0;
 	if (renderSpans(spelling, spans, (i) => spans[i].plaintext) !== value) return void 0;
-	return redactSecretsForState(spelling, secrets) === spelling ? spans : void 0;
+	return redactForState(spelling, {
+		provenance: "value-scan",
+		secrets
+	}) === spelling ? spans : void 0;
 }
 function certifiesRenderedLiteral(bag, source, secrets, bagIsSameGeneration) {
 	const spans = renderedLiteralSpans(source, secrets, bag);
@@ -9728,13 +9827,19 @@ function certifiesRenderedLiteral(bag, source, secrets, bagIsSameGeneration) {
 		if (survivor === void 0) return false;
 		survivors.push(survivor);
 	}
-	const scanned = redactSecretsForState(bag, secrets);
+	const scanned = redactForState(bag, {
+		provenance: "value-scan",
+		secrets
+	});
 	if (scanned === renderSpans(source, spans, (i) => survivors[i])) return true;
 	if (!bagIsSameGeneration) return false;
 	return scanned === renderSpans(source, spans, (i) => spans[i].plaintext.length >= 4 ? survivors[i] : spans[i].plaintext);
 }
 function writeFramedTokenWithinScanBound(bag, secrets, frame, bagIsSameGeneration) {
-	const scanned = redactSecretsForState(bag, secrets);
+	const scanned = redactForState(bag, {
+		provenance: "value-scan",
+		secrets
+	});
 	const { token, prefix, suffix, middle } = frame;
 	const survivor = secrets.get(middle);
 	if (survivor === void 0) return scanned;
@@ -20367,7 +20472,7 @@ function maskSecretsRaw(resolver, text, context) {
 	return needled !== text ? "***" : registered;
 }
 function abandonedUnit(resolver, unit, subject, error, context, rawInput, preRedact) {
-	const raw = error instanceof Error ? error.message : String(error);
+	const raw = describeAwsFailure(error).detail;
 	return {
 		unit,
 		subject: displayMasked(resolver, subject, context),
@@ -20680,7 +20785,7 @@ var CfnFallbackCache = class {
 			};
 			return;
 		} catch (error) {
-			this.deps.logger().warn(`Fn::ImportValue: CloudFormation ListExports fallback failed for export ${quotedRender(displayMasked(this.deps.resolver, exportName, context), "'")} (region ${this.deps.resolverRegion}): ${displayMasked(this.deps.resolver, error instanceof Error ? error.message : String(error), context)}. Grant cloudformation:ListExports to resolve exports from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
+			this.deps.logger().warn(`Fn::ImportValue: CloudFormation ListExports fallback failed for export ${quotedRender(displayMasked(this.deps.resolver, exportName, context), "'")} (region ${this.deps.resolverRegion}): ${displayMasked(this.deps.resolver, describeAwsFailure(error).detail, context)}. Grant cloudformation:ListExports to resolve exports from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
 			return;
 		}
 	}
@@ -20708,7 +20813,7 @@ var CfnFallbackCache = class {
 		try {
 			return await fetch;
 		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
+			const message = describeAwsFailure(error).detail;
 			const resolver = this.deps.resolver;
 			const cfnNameMask = positionalNameMask(resolver, [[stackName, displayMasked(resolver, stackName, context)], [region, displayMasked(resolver, loggedRegionText, context)]]);
 			this.deps.logger().warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack ${displayMaskedIdent(resolver, stackName, context, STACK_REF_MAX_CODE_POINTS)} (${displayMaskedIdent(resolver, loggedRegionText, context)}): ${displayAwsMessage(displayMasked(resolver, cfnNameMask ? cfnNameMask(message) : message, context))}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
@@ -21266,7 +21371,7 @@ async function readsPinnedVersion(token, pin, { resolver, context }) {
 		return !served.includes("{{resolve:") && served.length < 4 ? "short" : "read";
 	} catch (err) {
 		if (isDeliberateResolutionRefusal(err)) throw err;
-		resolver.logger.debug(safeMsg`Pinned read of ${displayMasked(resolver, token, context)} failed: ${displayMasked(resolver, err instanceof Error ? err.message : String(err), context)}`);
+		resolver.logger.debug(safeMsg`Pinned read of ${displayMasked(resolver, token, context)} failed: ${displayMasked(resolver, describeAwsFailure(err).detail, context)}`);
 		if (!isThrottlingError(err)) {
 			if (failed === void 0) {
 				failed = /* @__PURE__ */ new Set();
@@ -21386,7 +21491,7 @@ async function resolveImportValue(resolver, importValueArg, context) {
 		try {
 			entry = await context.exportIndex.lookup(exportName);
 		} catch (err) {
-			resolver.logger.warn(`Exports index lookup failed for ${quotedRender(loggedExportName, "'", "an export whose name is not a plain identifier")}: ${displayMasked(resolver, err instanceof Error ? err.message : String(err), context)}; falling back to state.json scan`);
+			resolver.logger.warn(`Exports index lookup failed for ${quotedRender(loggedExportName, "'", "an export whose name is not a plain identifier")}: ${displayMasked(resolver, describeAwsFailure(err).detail, context)}; falling back to state.json scan`);
 			entry = void 0;
 		}
 		if (entry && (!context.stackName || entry.producerStack !== context.stackName)) {
@@ -21428,7 +21533,7 @@ async function resolveImportValue(resolver, importValueArg, context) {
 					producerStack: refStack,
 					producerRegion: lookupRegion
 				}).catch((err) => {
-					resolver.logger.debug(`Failed to patch exports index for ${quotedRender(displayMasked(resolver, exportName, context), "'", "an export whose name is not a plain identifier")}: ${displayMasked(resolver, err instanceof Error ? err.message : String(err), context)}`);
+					resolver.logger.debug(`Failed to patch exports index for ${quotedRender(displayMasked(resolver, exportName, context), "'", "an export whose name is not a plain identifier")}: ${displayMasked(resolver, describeAwsFailure(err).detail, context)}`);
 				});
 				recordImport(resolver, context, exportName, refStack, lookupRegion);
 				found = {
@@ -21440,7 +21545,7 @@ async function resolveImportValue(resolver, importValueArg, context) {
 				break;
 			}
 		} catch (error) {
-			resolver.logger.warn(`Failed to read state for stack ${displayMasked(resolver, refStack, context)}: ${displayMasked(resolver, error instanceof Error ? error.message : String(error), context)}`);
+			resolver.logger.warn(`Failed to read state for stack ${displayMasked(resolver, refStack, context)}: ${displayMasked(resolver, describeAwsFailure(error).detail, context)}`);
 			continue;
 		}
 	}
@@ -21655,7 +21760,7 @@ function describeInnermostAwsError(error) {
 		if (cause === null || typeof cause !== "object") break;
 		innermost = cause;
 	}
-	if (!(innermost instanceof Error)) return displayAwsMessage(String(innermost));
+	if (!(innermost instanceof Error)) return displayAwsMessage(safeStringify$1(innermost));
 	const code = innermost.Code;
 	const name = typeof code === "string" && code !== "" ? code : innermost.name;
 	const message = displayAwsMessage(innermost.message);
@@ -22016,7 +22121,7 @@ async function resolveDynamicReferencesWithLogTwin(resolver, value, logTwin, con
 	if (context?.abandonedResolutions !== void 0) {
 		const bag = context.abandonedResolutions;
 		for (const { placeholder, because } of takeKeptPlaceholdersInsideReferences(bag, value)) {
-			const reason = because instanceof Error ? because.message : String(because);
+			const reason = describeAwsFailure(because).detail;
 			bag.push(abandonedUnit(resolver, "placeholder", placeholder, new Error(`Fn::Sub kept the placeholder ${placeholder} (${reason}) inside a {{resolve:...}} reference, so that reference was never resolved`, { cause: because }), context, value));
 		}
 	}
@@ -22338,7 +22443,10 @@ function isMaskedOwnIdCopy(record, key, recorded, healed, producerSecrets) {
 	if (!healed.endsWith(physicalId)) return false;
 	if (!OWN_ID_ARN_PREFIX.test(healed.slice(0, healed.length - physicalId.length))) return false;
 	if (producerSecrets === void 0 || !hasMaskableValues(producerSecrets)) return false;
-	return withPhysicalNameCopies(producerSecrets, [physicalId], () => redactSecretsForState(healed, producerSecrets)) === healed;
+	return withPhysicalNameCopies(producerSecrets, [physicalId], () => redactForState(healed, {
+		provenance: "value-scan",
+		secrets: producerSecrets
+	})) === healed;
 }
 function healMaskedOwnIdAttribute(resolver, logicalId, resource, attributeName, stored, context) {
 	if (stored !== "***" || context.attributeHealer === void 0) return void 0;
@@ -22371,7 +22479,7 @@ function describeFailureObserved(resolver, read, err, context) {
 	const name = displaySafe(err instanceof Error && err.name ? err.name : "Error", { asciiOnly: true }).slice(0, 64).trim() || "Error";
 	const status = err?.$metadata?.httpStatusCode;
 	const errorClass = typeof status === "number" && Number.isInteger(status) ? `${name}, HTTP ${status}` : name;
-	resolver.logger.debug(`${read} failed (${errorClass}): ${displayMasked(resolver, err instanceof Error ? err.message : String(err), context)}`);
+	resolver.logger.debug(`${read} failed (${errorClass}): ${displayMasked(resolver, describeAwsFailure(err).detail, context)}`);
 	return `${read} failed (${errorClass}); re-run with --verbose for the AWS error text`;
 }
 function guardedPhysicalIdFallback(resolver, logicalId, attributeName, resourceType, physicalId, context) {
@@ -22461,7 +22569,7 @@ async function constructAttributeForCoreTypes(resolver, resource, attributeName,
 			resolver.logger.warn(`VPC ${loggedId} IPv6 CIDR did not reach 'associated' state after ${maxAttempts} attempts`);
 			return [];
 		} catch (error) {
-			resolver.logger.warn(`Failed to fetch VPC Ipv6CidrBlocks for ${displayMasked(resolver, physicalId, context)}: ${displayMasked(resolver, error instanceof Error ? error.message : String(error), context)}`);
+			resolver.logger.warn(`Failed to fetch VPC Ipv6CidrBlocks for ${displayMasked(resolver, physicalId, context)}: ${displayMasked(resolver, describeAwsFailure(error).detail, context)}`);
 			return [];
 		}
 		case "DefaultSecurityGroup": {
@@ -22844,7 +22952,7 @@ async function constructAttributeForComputeTypes(resolver, attributeName, contex
 				const value = attributeName === "LatestVersionNumber" ? lt?.LatestVersionNumber : lt?.DefaultVersionNumber;
 				if (value !== void 0 && value !== null) return String(value);
 			} catch (err) {
-				resolver.logger.warn(`DescribeLaunchTemplates(${displayMasked(resolver, physicalId, context)}) failed for ${displayMasked(resolver, attributeName, context)}: ${displayMasked(resolver, err instanceof Error ? err.message : String(err), context)}`);
+				resolver.logger.warn(`DescribeLaunchTemplates(${displayMasked(resolver, physicalId, context)}) failed for ${displayMasked(resolver, attributeName, context)}: ${displayMasked(resolver, describeAwsFailure(err).detail, context)}`);
 			}
 			return attributeName === "LatestVersionNumber" ? "$Latest" : "$Default";
 		}
@@ -23062,7 +23170,7 @@ async function resolveGetAZs(resolver, value, context) {
 	} catch (error) {
 		const loggedRegion = displayMasked(resolver, loggedRegionText ?? region, context);
 		const masks = namedRequestMasks(resolver, [[region, loggedRegion]], context);
-		throw new Error(`Fn::GetAZs: failed to describe availability zones for region ${quotedRender(loggedRegion, "'")}: ${masks.text(error instanceof Error ? error.message : String(error))}`);
+		throw new Error(`Fn::GetAZs: failed to describe availability zones for region ${quotedRender(loggedRegion, "'")}: ${masks.text(describeAwsFailure(error).detail)}`);
 	}
 	if (azNames.length === 0) throw markNonRetryable(/* @__PURE__ */ new Error(`Fn::GetAZs: no availability zones returned for region ${quotedRender(displayMasked(resolver, loggedRegionText ?? region, context), "'")}. Either the region is not enabled on this account (opt-in regions must be enabled before use), or the request was answered by a different region's endpoint.`));
 	cachedAvailabilityZones.set(azCacheKey, azNames);
@@ -24098,7 +24206,7 @@ async function evaluateConditions(resolver, context) {
 	for (const name of Object.keys(templateConditions)) try {
 		await withSharedDrainBudget(() => evaluateByName(name));
 	} catch (error) {
-		resolver.logger.warn(displayMasked(resolver, `Failed to evaluate condition ${name}: ${error instanceof Error ? error.message : String(error)}, assuming false`, maskingContext));
+		resolver.logger.warn(displayMasked(resolver, `Failed to evaluate condition ${name}: ${describeAwsFailure(error).detail}, assuming false`, maskingContext));
 		conditions[name] = false;
 		assumed.add(name);
 		inProgress.delete(name);
@@ -24118,7 +24226,7 @@ async function resolveKeyUnit(resolver, key, val, context, abandoned) {
 //#endregion
 //#region src/deployment/intrinsic-resolver/sub.ts
 function subPlaceholderWarning(_resolver, varName, error) {
-	return `Fn::Sub variable ${varName} could not be resolved (${error instanceof Error ? error.message : String(error)}), keeping placeholder`;
+	return `Fn::Sub variable ${varName} could not be resolved (${describeAwsFailure(error).detail}), keeping placeholder`;
 }
 function subPlaceholderNamesADeclaredTemplateEntity(resolver, varName, context) {
 	const firstDot = varName.indexOf(".");
@@ -26967,7 +27075,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DHB498Xq.js");
+			const { ASGProvider } = await import("./asg-provider-C14GB-Hy.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -27073,7 +27181,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-CxB94DZy.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CXhoiT-P.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-DagnUCn-.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-BlpYIZQP.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -32713,7 +32821,7 @@ function ownRemedyError(error) {
 }
 function rollbackFailureText(error) {
 	if (error instanceof Error && OWN_REMEDY_ERRORS.has(error)) return error.message.split("\n").map((line) => displaySafe(line)).join("\n");
-	return displaySafe(error instanceof Error ? error.message : String(error));
+	return displaySafe(describeAwsFailure(error).detail);
 }
 function collisionText(msg) {
 	return displayAwsMessage(displaySafe(msg).replace(/[\s\p{Cf}\p{Default_Ignorable_Code_Point}\u2800]{2,}/gu, " "));
@@ -33706,7 +33814,15 @@ function redactOutputsBag(deps, outputs) {
 	absorbOutputsPassSecrets(deps);
 	if (deps.outputsRun().outputSecrets.size === 0) return maskOutputsByPosition(deps.noEchoRun(), deps.noEchoDeps(), outputs);
 	const outputsRun = deps.outputsRun();
-	return maskOutputsByPosition(deps.noEchoRun(), deps.noEchoDeps(), redactSecretsForState(outputs, outputsRun.outputSecrets, outputsRun.outputsSourceUsable ? outputsRun.outputsTemplateSource : void 0, TEMPLATE_SOURCED_RULES));
+	return maskOutputsByPosition(deps.noEchoRun(), deps.noEchoDeps(), redactForState(outputs, outputsRun.outputsSourceUsable ? {
+		provenance: "template-sourced",
+		secrets: outputsRun.outputSecrets,
+		source: outputsRun.outputsTemplateSource,
+		generation: isSameGenerationBag(outputs) ? "same-generation" : "unproven"
+	} : {
+		provenance: "value-scan",
+		secrets: outputsRun.outputSecrets
+	}));
 }
 function registerNoEchoAttributes(run, deps, logicalId, result, secrets, ownProperties) {
 	const declared = recordNoEchoAttributeValues(result, secrets, ownProperties);
@@ -34088,7 +34204,7 @@ async function replaceDeleteFirstAndRecreate(run, deps, logicalId, resourceType,
 		}));
 	} catch (deleteError) {
 		const shownSecrets = unionOfSecretBags([secrets, printingSecretsFor(deps.secretsRun(), logicalId)]);
-		throw new Error(safeMsg`Failed to delete old resource ${maskSecretsInText(logicalId, shownSecrets)} ` + safeMsg`(${maskSecretsInText(currentResource.physicalId, shownSecrets)}) ` + `during the --replace delete-first fallback: ` + safeMsg`${asIsMessage(maskSecretsInText(deleteError instanceof Error ? deleteError.message : String(deleteError), shownSecrets))}`, { cause: deleteError instanceof Error ? maskSecretsInError(deleteError, secrets) : void 0 });
+		throw new Error(safeMsg`Failed to delete old resource ${maskSecretsInText(logicalId, shownSecrets)} ` + safeMsg`(${maskSecretsInText(currentResource.physicalId, shownSecrets)}) ` + `during the --replace delete-first fallback: ` + safeMsg`${asIsMessage(maskSecretsInText(describeAwsFailure(deleteError).detail, shownSecrets))}`, { cause: deleteError instanceof Error ? maskSecretsInError(deleteError, secrets) : void 0 });
 	}
 	reportDeleteGuards(deleteResult, {
 		physicalId: currentResource.physicalId,
@@ -34112,7 +34228,7 @@ async function replaceDeleteFirstAndRecreate(run, deps, logicalId, resourceType,
 		});
 	} catch (recreateError) {
 		const shownSecrets = unionOfSecretBags([secrets, printingSecretsFor(deps.secretsRun(), logicalId)]);
-		throw new Error(safeMsg`Failed to re-create ${maskSecretsInText(logicalId, shownSecrets)} after the ` + safeMsg`--replace delete-first fallback already deleted the old resource (${maskSecretsInText(currentResource.physicalId, shownSecrets)}). ` + safeMsg`Re-run the deploy to create it fresh. Cause: ${asIsMessage(maskSecretsInText(recreateError instanceof Error ? recreateError.message : String(recreateError), shownSecrets))}`, { cause: recreateError instanceof Error ? maskSecretsInError(recreateError, secrets) : void 0 });
+		throw new Error(safeMsg`Failed to re-create ${maskSecretsInText(logicalId, shownSecrets)} after the ` + safeMsg`--replace delete-first fallback already deleted the old resource (${maskSecretsInText(currentResource.physicalId, shownSecrets)}). ` + safeMsg`Re-run the deploy to create it fresh. Cause: ${asIsMessage(maskSecretsInText(describeAwsFailure(recreateError).detail, shownSecrets))}`, { cause: recreateError instanceof Error ? maskSecretsInError(recreateError, secrets) : void 0 });
 	}
 }
 function typeChangeNameQuestion(resourceType, input) {
@@ -34178,7 +34294,7 @@ async function checkedReplacementNameChange(deps, input) {
 		}), logicalId, void 0, void 0, input.createProvider);
 	} catch (probeError) {
 		if (probeErrorMeansNameHeld(resourceType, probeError)) throw markNonRetryable(new CdkdError(maskName(`${subject} requires replacement, and S3 answered 403 Forbidden for bucket ${displaySafe(change.desiredName)}: another account owns that name, or a bucket of this account denies this identity \`s3:ListBucket\`, or the request's credentials were rejected. Nothing was created or deleted. Choose another name, or if the bucket is yours grant \`s3:ListBucket\` on it (or delete it) and re-run.`), "NAMED_REPLACEMENT_COLLISION", probeError instanceof Error ? probeError : void 0));
-		throw markNonRetryable(new CdkdError(maskName(`${subject} requires replacement under a new name, and ${adoptsText}, but cdkd could not check whether another resource already holds it: ${displayAwsMessage(maskName(probeError instanceof Error ? probeError.message : String(probeError)))}. Nothing was created or deleted. Re-run the deploy once the check can succeed.`), "NAMED_REPLACEMENT_COLLISION", probeError instanceof Error ? probeError : void 0));
+		throw markNonRetryable(new CdkdError(maskName(`${subject} requires replacement under a new name, and ${adoptsText}, but cdkd could not check whether another resource already holds it: ${displayAwsMessage(maskName(describeAwsFailure(probeError).detail))}. Nothing was created or deleted. Re-run the deploy once the check can succeed.`), "NAMED_REPLACEMENT_COLLISION", probeError instanceof Error ? probeError : void 0));
 	}
 	if (found === null) return change;
 	if (!typeChanged && probeFoundSameId(resourceType, found.physicalId, currentResource.physicalId)) return;
@@ -34195,7 +34311,7 @@ async function createFirstThenDeleteOld(run, deps, input) {
 		createResult = await deps.withRetry(() => withCurrentResourceSecrets(secrets, () => input.createProvider.create(logicalId, resourceType, input.createProps, { maskSecrets: createSecretMasker(secrets) })), logicalId, void 0, void 0, input.createProvider);
 	} catch (createError) {
 		if (!isNameCollisionErrorFrom(createError, logicalId)) throw createError;
-		const createMsg = displayAwsMessage(maskName(createError instanceof Error ? createError.message : String(createError)));
+		const createMsg = displayAwsMessage(maskName(describeAwsFailure(createError).detail));
 		throw markNonRetryable(new CdkdError(maskName(`${displaySafe(logicalId)} (${displaySafe(resourceType)}) requires replacement (${input.trigger}), and cdkd created the new resource first because its name differs, but the create collided: ${createMsg}. If the collision is on the requested name: ${renderReplacementNameChange(input.change, input.createProps)}. Nothing was deleted` + (retainOld ? ` (UpdateReplacePolicy: Retain keeps the old resource in place)` : "") + ". Choose a name no other resource holds, or delete the resource holding it if it is yours."), "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
 	}
 	if (input.equalIdIsSameResource && createResult.physicalId === currentResource.physicalId) throw markNonRetryable(new CdkdError(maskName(`${displaySafe(logicalId)} (${displaySafe(resourceType)}) requires replacement (${input.trigger}) under a new name, but the create returned the resource being replaced (${displaySafe(currentResource.physicalId)}) instead of a new one, so cdkd cannot tell which name it holds. Nothing was deleted. Delete that resource by hand if it is yours, then re-run the deploy.`), "NAMED_REPLACEMENT_IDEMPOTENT_CREATE"));
@@ -34221,7 +34337,7 @@ async function deleteReplacedAfterCreate(run, deps, logicalId, oldResourceType,
 			maskSecrets: createUnionSecretMasker([secrets, secretNameBagFor(deps.secretsRun(), logicalId)])
 		}));
 	} catch (deleteError) {
-		const deleteMsg = maskSecretsInText(deleteError instanceof Error ? deleteError.message : String(deleteError), secrets);
+		const deleteMsg = maskSecretsInText(describeAwsFailure(deleteError).detail, secrets);
 		deleteFailed = true;
 		run.replacedOldMaySurvive.set(logicalId, run.replacedOldMaySurvive.get(logicalId) === "unconfirmed" ? "unconfirmed" : replacedDeleteFailureVerdict(deleteError));
 		const deferred = run.deferredReplacedDeletes;
@@ -34762,7 +34878,7 @@ var ForwardingSecrets = class extends Map {
 };
 function handleOutputResolutionFailure(deps, error, outputKey, outputs, secrets, inheritedSecrets) {
 	const union = unionOfSecretBags([inheritedSecrets, secrets]);
-	const detail = maskSecretsInText(error instanceof Error ? error.message || error.name : String(error), union);
+	const detail = maskSecretsInText(error instanceof Error ? error.message || error.name : safeStringify$1(error), union);
 	if (deps.options.strictGetAtt) {
 		const cause = typeof error === "string" ? maskSecretsInText(error, union) : maskSecretsInError(error, union);
 		throw new Error(safeMsg`Failed to resolve output ${outputKey} ` + `(--strict-getatt promotes output resolution failures to deploy errors; ` + safeMsg`drop the flag to skip the output instead): ${asIsMessage(detail)}`, cause instanceof Error || typeof cause === "string" ? { cause } : {});
@@ -35161,8 +35277,16 @@ function recaptureMaskedBaseline(args) {
 	const { previous, readback, properties, secrets } = args;
 	const admissible = new Set(secretReferenceTokensOf(properties));
 	for (const leaf of wholeStringLeavesOf(properties)) if (leaf.includes("{{resolve:")) admissible.add(leaf);
-	if (!reproducesBaseline(redactSecretsForState(readback, /* @__PURE__ */ new Map(), properties, STATE_SOURCED_BASELINE_RULES), previous, admissible)) return void 0;
-	const certified = redactSecretsForState(readback, secrets, properties, STATE_SOURCED_BASELINE_RULES);
+	if (!reproducesBaseline(redactForState(readback, {
+		provenance: "state-baseline",
+		secrets: /* @__PURE__ */ new Map(),
+		source: properties
+	}), previous, admissible)) return void 0;
+	const certified = redactForState(readback, {
+		provenance: "state-baseline",
+		secrets,
+		source: properties
+	});
 	let changed = false;
 	const overlay = (old, fresh) => {
 		if (old === "***") {
@@ -35408,9 +35532,13 @@ function redactRollbackRecord(record, secrets, journaledProps, journaledAttribut
 	if (secrets.size === 0) return record;
 	const positioned = journaledProps === void 0 ? record : {
 		...record,
-		properties: redactSecretsForState(record.properties, secrets, journaledProps, STATE_DERIVED_RULES)
+		properties: redactForState(record.properties, {
+			provenance: "state-derived",
+			secrets,
+			source: journaledProps
+		})
 	};
-	return keepPersistedPlainRecordLeaves(scrubResourceRecord(positioned, secrets), record, {
+	return keepPersistedPlainRecordLeaves(scrubResourceRecord(positioned, secrets, void 0, void 0, { observed: isSameGenerationBag(positioned.observedProperties) ? "same-generation" : "unproven" }), record, {
 		properties: journaledProps,
 		attributes: journaledAttributes
 	});
@@ -36542,7 +36670,7 @@ async function replayRevert(s) {
 	refuseMaskedReplayBaseline(desiredProps, op.logicalId, noEcho.inert);
 	logger.info(`  Rollback: Restoring ${safe(op.logicalId)} (${safe(op.resourceType)}) to previous state`);
 	const currentProps = noEcho.onPreviousSide(await resolveReplayProps(current.properties, resolver, secrets, ctx, op.logicalId, current));
-	recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, previousState.properties, STATE_DERIVED_RULES);
+	recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, previousState.properties, "state-derived");
 	opMasker.addNamed({
 		resourceType: op.resourceType,
 		properties: desiredProps,
@@ -36638,7 +36766,7 @@ async function replayReverseReplacement(s) {
 		logicalId: op.logicalId,
 		physicalIds: [prev.physicalId]
 	});
-	recordNestedStackParameterExpressions(secrets, oldType, resolvedPrevProps, prev.properties, STATE_DERIVED_RULES);
+	recordNestedStackParameterExpressions(secrets, oldType, resolvedPrevProps, prev.properties, "state-derived");
 	const deleteFirstBlocked = op.oldDeletedBeforeCreate === true && !rollbackRetainsNewResource(current) ? deleteFirstBlocker(op) : void 0;
 	if (deleteFirstBlocked !== void 0) logger.warn(mask(safeMsg`  Rollback: not deleting the new ${shownLogicalId(op.logicalId)} first: its old properties ` + safeMsg`name the resource ${shownLogicalId(deleteFirstBlocked.logicalId)} had before the same deploy ` + "replaced or deleted it, which this rollback may not be able to restore under that id — re-creating the old resource first, which keeps the new one if that fails"));
 	const reverseDeleteFirst = op.oldDeletedBeforeCreate === true && !rollbackRetainsNewResource(current) && deleteFirstBlocked === void 0;
@@ -36705,7 +36833,7 @@ async function replayReverseReplacement(s) {
 			});
 		} catch (recreateError) {
 			await deleteMarkedRecreate(recreateError, recreateCleanup);
-			throw new Error(mask(`Failed to re-create the old ${safe(op.logicalId)} after the new resource (${mask(current.physicalId)}) was already deleted: ${displaySafe(recreateError instanceof Error ? recreateError.message : String(recreateError))}. The resource is now absent — fix forward by re-deploying the stack.`), { cause: maskSecretsInError(recreateError instanceof Error ? recreateError : void 0, secrets) });
+			throw new Error(mask(`Failed to re-create the old ${safe(op.logicalId)} after the new resource (${mask(current.physicalId)}) was already deleted: ${displaySafe(describeAwsFailure(recreateError).detail)}. The resource is now absent — fix forward by re-deploying the stack.`), { cause: maskSecretsInError(recreateError instanceof Error ? recreateError : void 0, secrets) });
 		}
 	};
 	let deletedNewFirst = false;
@@ -36722,7 +36850,7 @@ async function replayReverseReplacement(s) {
 		});
 	} catch (createError) {
 		const deletedMade = await deleteMarkedRecreate(createError, recreateCleanup);
-		const msg = createError instanceof Error ? createError.message : String(createError);
+		const msg = describeAwsFailure(createError).detail;
 		if (!isNameCollisionErrorFrom(createError, op.logicalId) || deletedMade) throw createError;
 		const holder = inOriginalPrefix(() => reverseReplacementNewHoldsName({
 			oldResourceType: oldType,
@@ -36816,8 +36944,8 @@ async function replayReverseReplacement(s) {
 		}));
 		throwIfDeleteSkipped(deleteNewAfterRecreate, op.logicalId, current.physicalId, "while deleting the new resource after re-creating the old one", newDeleteGuardScope(deleteNewAfterRecreateRoute.provisionedBy));
 	} catch (deleteError) {
-		logger.warn(mask(`  Rollback: old ${safe(op.logicalId)} re-created, but deleting the new resource (${displaySafe(mask(current.physicalId))}) failed: ${displaySafe(deleteError instanceof Error ? deleteError.message : String(deleteError))}. Delete it manually — it is no longer tracked in state.`));
-		survivorReason = `The replacement's new ${op.resourceType} (${current.physicalId}) could not be deleted after the old resource was re-created: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}. It is live, still billing, and no longer tracked by cdkd — delete it yourself.`;
+		logger.warn(mask(`  Rollback: old ${safe(op.logicalId)} re-created, but deleting the new resource (${displaySafe(mask(current.physicalId))}) failed: ${displaySafe(describeAwsFailure(deleteError).detail)}. Delete it manually — it is no longer tracked in state.`));
+		survivorReason = `The replacement's new ${op.resourceType} (${current.physicalId}) could not be deleted after the old resource was re-created: ${describeAwsFailure(deleteError).detail}. It is live, still billing, and no longer tracked by cdkd — delete it yourself.`;
 		result.warnings++;
 	}
 	const recreatedId = displaySafe(mask(String(createResult.physicalId)));
@@ -36858,7 +36986,7 @@ async function deleteMarkedRecreate(error, s) {
 		}));
 		failure = deleteSkipReason(outcome);
 	} catch (deleteError) {
-		failure = deleteError instanceof Error ? deleteError.message : String(deleteError);
+		failure = describeAwsFailure(deleteError).detail;
 	}
 	if (failure === void 0) return true;
 	s.logger.warn(safeMsg`  Rollback: could not delete ${id}, which the failed re-create of ${shown} made before ` + safeMsg`failing (${s.mask(failure)}); no record holds it — delete it yourself`);
@@ -37288,7 +37416,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 					const desiredProps = noEcho.desired;
 					refuseMaskedReplayBaseline(desiredProps, op.logicalId, noEcho.inert);
 					const attemptedProps = noEcho.onPreviousSide(await resolveReplayProps(op.attemptedProperties ?? current.properties, resolver, secrets, ctx, op.logicalId, op.attemptedProperties === void 0 ? current : void 0));
-					recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, prev.properties, STATE_DERIVED_RULES);
+					recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, prev.properties, "state-derived");
 					opMasker.addNamed({
 						resourceType: op.resourceType,
 						properties: desiredProps,
@@ -37394,7 +37522,7 @@ var ObservedCapture = class {
 				this.deps.printingSecretsFor(logicalId),
 				this.deps.fingerprintNoEchoValues()
 			]);
-			this.deps.logger.debug(safeMsg`observedProperties capture for ${mask(logicalId)} (${mask(resourceType)}) failed: ${asIsMessage(mask(err instanceof Error ? err.message : String(err)))} — drift will fall back to template properties for this resource until the next successful deploy.`);
+			this.deps.logger.debug(safeMsg`observedProperties capture for ${mask(logicalId)} (${mask(resourceType)}) failed: ${asIsMessage(mask(describeAwsFailure(err).detail))} — drift will fall back to template properties for this resource until the next successful deploy.`);
 		});
 		const promise = secrets === void 0 ? read() : withCurrentResourceSecrets(secrets, read);
 		this.observedCaptureTasks.set(logicalId, promise);
@@ -38363,7 +38491,7 @@ async function loadJournaledOrphans(stateBackend, stackName, region, rollbackOrp
 		if (!journal) return NONE;
 		segments = journal.segments;
 	} catch (err) {
-		const detail = err instanceof Error ? err.message : String(err);
+		const detail = describeAwsFailure(err).detail;
 		logger.warn(safeMsg`Could not read the stack's rollback journal (${displaySafe(detail)}); ` + safeMsg`no resource it records for a failed CREATE is deleted, and ${options.unreadableOutcome ?? "a destroy that proceeds removes the journal with the state"}.`);
 		return {
 			...NONE,
@@ -38775,7 +38903,7 @@ async function markSuperseded(stateBackend, stackName, region, ids) {
 	} catch {}
 }
 function errorDetail(err) {
-	return displaySafe(err instanceof Error ? err.message : String(err));
+	return displaySafe(describeAwsFailure(err).detail);
 }
 function isHandledOrphan(handled, segment, op) {
 	return handled.some((h) => h.segment.timestamp === segment.timestamp && h.segment.runId === segment.runId && h.op.logicalId === op.logicalId && h.op.changeType === op.changeType && h.op.resourceType === op.resourceType && h.op.physicalId === op.physicalId);
@@ -39307,7 +39435,7 @@ Drop the record with: ${dropCommand}`);
 			maskSecrets: createUnionSecretMasker([secretNameBagFor(deps.secretsRun(), logicalId)])
 		}), logicalId, 3, 5e3, deleteProvider);
 	} catch (deleteError) {
-		const msg = deleteError instanceof Error ? deleteError.message : String(deleteError);
+		const msg = describeAwsFailure(deleteError).detail;
 		if (!isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && !isWaitAbandonedError(deleteError) && (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException"))) deps.logger.debug(safeMsg`Resource ${logicalId} already deleted (${asIsMessage(msg)}), removing from state`);
 		else throw deleteError;
 	}
@@ -40009,13 +40137,35 @@ function redactOperationsForJournal(deps, operations) {
 		if ((!secrets || secrets.size === 0) && !op.previousState && sources === void 0) return op;
 		const ownSecrets = secrets ?? /* @__PURE__ */ new Map();
 		const next = { ...op };
-		if (next.properties) next.properties = byPosition(redactSecretsForState(next.properties, ownSecrets, templateProps));
-		if (next.attemptedProperties) next.attemptedProperties = byPosition(redactSecretsForState(markSameGenerationBag({ ...next.attemptedProperties }), ownSecrets, templateProps));
+		if (next.properties) {
+			const properties = next.properties;
+			next.properties = byPosition(templateProps === void 0 ? redactForState(properties, {
+				provenance: "value-scan",
+				secrets: ownSecrets
+			}) : redactForState(properties, {
+				provenance: "template-derived",
+				secrets: ownSecrets,
+				source: templateProps,
+				generation: isSameGenerationBag(properties) ? "same-generation" : "unproven"
+			}));
+		}
+		if (next.attemptedProperties) {
+			const attempted = next.attemptedProperties;
+			next.attemptedProperties = byPosition(templateProps === void 0 ? redactForState(attempted, {
+				provenance: "value-scan",
+				secrets: ownSecrets
+			}) : redactForState(attempted, {
+				provenance: "template-derived",
+				secrets: ownSecrets,
+				source: templateProps,
+				generation: "same-generation"
+			}));
+		}
 		if (next.previousState) {
 			const previous = next.previousState;
 			const adopted = adoptedOrphanRecords.get(deps.owner);
 			const loaded = adopted?.has(op.logicalId) ? adopted.get(op.logicalId) : previous;
-			next.previousState = applyNoEchoPersist(deps.noEchoRun(), deps.noEchoDeps(), op.logicalId, previous, keepPersistedPlainRecordLeaves(scrubResourceRecord(previous, ownSecrets, void 0, STATE_SOURCED_READBACK_RULES), previous, loaded ?? {}), void 0, {}, void 0, true);
+			next.previousState = applyNoEchoPersist(deps.noEchoRun(), deps.noEchoDeps(), op.logicalId, previous, keepPersistedPlainRecordLeaves(scrubResourceRecord(previous, ownSecrets, void 0, "state-readback", { observed: isSameGenerationBag(previous.observedProperties) ? "same-generation" : "unproven" }), previous, loaded ?? {}), void 0, {}, void 0, true);
 		}
 		return next;
 	});
@@ -40231,7 +40381,7 @@ async function deleteRollbackJournalBestEffort(deps, stackName, supersededLogica
 	try {
 		deleted = await deps.stateBackend.deleteRollbackJournal(stackName, deps.stackRegion);
 	} catch (err) {
-		deps.logger.debug(safeMsg`Failed to delete rollback journal for ${displayStackName(stackName)}: ${err instanceof Error ? err.message : String(err)}`);
+		deps.logger.debug(safeMsg`Failed to delete rollback journal for ${displayStackName(stackName)}: ${describeAwsFailure(err).detail}`);
 		deleted = false;
 	}
 	if (deleted !== false) return true;
@@ -40239,7 +40389,7 @@ async function deleteRollbackJournalBestEffort(deps, stackName, supersededLogica
 	try {
 		await deps.stateBackend.markRollbackJournalSuperseded(stackName, deps.stackRegion, supersededLogicalIds);
 	} catch (markErr) {
-		deps.logger.debug(safeMsg`Failed to record superseded logical ids on the rollback journal for ${displayStackName(stackName)}: ${markErr instanceof Error ? markErr.message : String(markErr)}`);
+		deps.logger.debug(safeMsg`Failed to record superseded logical ids on the rollback journal for ${displayStackName(stackName)}: ${describeAwsFailure(markErr).detail}`);
 	}
 	return false;
 }
@@ -40248,7 +40398,7 @@ async function settleJournalAfterCleanRollback(deps, stackName, failedOperations
 		try {
 			await deps.stateBackend.popRollbackJournalSegment(stackName, deps.stackRegion);
 		} catch (err) {
-			deps.logger.debug(safeMsg`Failed to pop the rollback journal segment after the clean rollback: ${asIsMessage(err instanceof Error ? err.message : String(err))}`);
+			deps.logger.debug(safeMsg`Failed to pop the rollback journal segment after the clean rollback: ${asIsMessage(describeAwsFailure(err).detail)}`);
 			return false;
 		}
 		return true;
@@ -40256,7 +40406,7 @@ async function settleJournalAfterCleanRollback(deps, stackName, failedOperations
 	try {
 		await deps.stateBackend.popRollbackJournalSegment(stackName, deps.stackRegion);
 	} catch (err) {
-		deps.logger.warn(safeMsg`Failed to settle the rollback journal after the clean rollback: ${err instanceof Error ? err.message : String(err)}. ` + `The journal keeps the full segment; a later rollback replay is idempotent.`);
+		deps.logger.warn(safeMsg`Failed to settle the rollback journal after the clean rollback: ${describeAwsFailure(err).detail}. ` + `The journal keeps the full segment; a later rollback replay is idempotent.`);
 		return false;
 	}
 	if (!await writeRollbackJournalSegment(deps, stackName, [], failedOperations, "auto-rollback-clean", initialDeploy)) return true;
@@ -40331,7 +40481,7 @@ async function writeRollbackJournalSegment(deps, stackName, completedOperations,
 		deps.logger.debug(safeMsg`Rollback journal segment written (${reason})`);
 		return true;
 	} catch (journalError) {
-		deps.logger.warn(safeMsg`Failed to write rollback journal: ${asIsMessage(journalError instanceof Error ? journalError.message : String(journalError))}. ` + `'cdkd rollback' will NOT be able to revert this deploy — use 'cdkd deploy' to resume or 'cdkd destroy' to clean up.`);
+		deps.logger.warn(safeMsg`Failed to write rollback journal: ${asIsMessage(describeAwsFailure(journalError).detail)}. ` + `'cdkd rollback' will NOT be able to revert this deploy — use 'cdkd deploy' to resume or 'cdkd destroy' to clean up.`);
 		return false;
 	}
 }
@@ -42035,7 +42185,10 @@ function deployConditionInputs(parameterValues, inheritedSecrets, shadowedBy = /
 			unavailable.add(name);
 			continue;
 		}
-		const redacted = redactSecretsForState(value, inheritedSecrets);
+		const redacted = redactForState(value, {
+			provenance: "value-scan",
+			secrets: inheritedSecrets
+		});
 		if (!containsNeedle(value)) {
 			if (redacted !== value) unavailable.add(name);
 			continue;
@@ -42968,7 +43121,10 @@ function maskedInputSources(deps, template, resources, conditions, stackName) {
 			const targetSecrets = target === void 0 ? void 0 : deps.secretsRun().perResourceSecrets.get(target);
 			if (targetSecrets !== void 0 && hasMaskableValues(targetSecrets)) {
 				const probe = { value };
-				const redacted = redactSecretsForState(probe, targetSecrets);
+				const redacted = redactForState(probe, {
+					provenance: "value-scan",
+					secrets: targetSecrets
+				});
 				if (JSON.stringify(redacted) !== JSON.stringify(probe)) return {
 					value,
 					keepAsWritten: true
@@ -43177,7 +43333,7 @@ async function refuseTakenCreateName(engine, input) {
 		if (probeErrorMeansNameHeld(resourceType, probeError)) return refuse(`${subject} is created with ${named}, and S3 answered 403 Forbidden for that bucket: another account owns that name, or a bucket of this account denies this identity \`s3:ListBucket\`, or the request's credentials were rejected. Nothing was created. Choose another name, or if the bucket is yours grant \`s3:ListBucket\` on it (or delete it) and re-run.`, probeError);
 		const status = probeError?.$metadata?.httpStatusCode;
 		if (resourceType === "AWS::S3::Bucket" && status === 301) return refuse(`${subject} is created with ${named}, and S3 answered 301 for that bucket: a bucket of that name already exists in another region. Nothing was created. Choose another name, or delete that bucket if it is yours and re-run.`, probeError);
-		return refuse(`${subject} is created with ${named}, and ${adoptsText}, but cdkd could not check whether another resource already holds it: ${displayAwsMessage(maskName(probeError instanceof Error ? probeError.message : String(probeError)))}. Nothing was created. Re-run the deploy once the check can succeed.`, probeError);
+		return refuse(`${subject} is created with ${named}, and ${adoptsText}, but cdkd could not check whether another resource already holds it: ${displayAwsMessage(maskName(describeAwsFailure(probeError).detail))}. Nothing was created. Re-run the deploy once the check can succeed.`, probeError);
 	}
 	if (found === null) return;
 	const holderId = found.physicalId;
@@ -46126,7 +46282,7 @@ async function updateByReplacement(engine, { change, counts, currentProps, curre
 				}));
 			} catch (deleteError) {
 				const shownSecrets = unionOfSecretBags([updateSecrets, printingSecretsFor(engine.secretsRun, logicalId)]);
-				throw new Error(safeMsg`Failed to destroy old resource ${maskSecretsInText(logicalId, shownSecrets)} ` + safeMsg`(${maskSecretsInText(currentResource.physicalId, shownSecrets)}) during ${recreateFlagName}: ` + safeMsg`${asIsMessage(maskSecretsInText(deleteError instanceof Error ? deleteError.message : String(deleteError), shownSecrets))}`, { cause: deleteError instanceof Error ? maskSecretsInError(deleteError, updateSecrets) : void 0 });
+				throw new Error(safeMsg`Failed to destroy old resource ${maskSecretsInText(logicalId, shownSecrets)} ` + safeMsg`(${maskSecretsInText(currentResource.physicalId, shownSecrets)}) during ${recreateFlagName}: ` + safeMsg`${asIsMessage(maskSecretsInText(describeAwsFailure(deleteError).detail, shownSecrets))}`, { cause: deleteError instanceof Error ? maskSecretsInError(deleteError, updateSecrets) : void 0 });
 			}
 			reportDeleteGuards(recreateDeleteResult, {
 				physicalId: currentResource.physicalId,
@@ -46159,7 +46315,7 @@ async function updateByReplacement(engine, { change, counts, currentProps, curre
 		try {
 			createResult = await engine.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replaceProvider.create(logicalId, resourceType, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replaceProvider);
 		} catch (createError) {
-			const createMsg = displayAwsMessage(maskSecretsInText(createError instanceof Error ? createError.message : String(createError), updateSecrets));
+			const createMsg = displayAwsMessage(maskSecretsInText(describeAwsFailure(createError).detail, updateSecrets));
 			const createSentence = createMsg.endsWith(".") ? createMsg.slice(0, -1) : createMsg;
 			if (!isNameCollisionErrorFrom(createError, logicalId)) throw createError;
 			const nameOrigin = replacementNameOrigin(logicalId, currentResource.physicalId);
@@ -46217,7 +46373,7 @@ async function updateByReplacement(engine, { change, counts, currentProps, curre
 				if (snapshotError instanceof CdkdError && snapshotError.code === "FINAL_SNAPSHOT_UNSUPPORTED") throw snapshotError;
 				snapshotBlockedDelete = true;
 				engine.replacementRun.replacedOldMaySurvive.set(logicalId, "kept");
-				engine.logger.warn(safeMsg`  ⚠ Final snapshot for old ${logicalId} (${currentResource.physicalId}) ` + safeMsg`failed: ${asIsMessage(snapshotError instanceof Error ? snapshotError.message : String(snapshotError))}. ` + "The old resource was NOT deleted (UpdateReplacePolicy: Snapshot) — delete it manually once you have a snapshot; it is no longer tracked in state.");
+				engine.logger.warn(safeMsg`  ⚠ Final snapshot for old ${logicalId} (${currentResource.physicalId}) ` + safeMsg`failed: ${asIsMessage(describeAwsFailure(snapshotError).detail)}. ` + "The old resource was NOT deleted (UpdateReplacePolicy: Snapshot) — delete it manually once you have a snapshot; it is no longer tracked in state.");
 			}
 			if (!snapshotBlockedDelete) await deleteReplacedAfterCreate(engine.replacementRun, engine.replacementDeps(), logicalId, oldResourceType, currentResource, oldDeleteProvider, currentResource.properties, cleanupFinalSnapshotId, updateReplacePolicy, updateSecrets, oldDeleteRoute.provisionedBy, noEchoDeleteValues);
 		}
@@ -46388,7 +46544,7 @@ async function updateInPlace(engine, { conditions, counts, currentProps, current
 						maskSecrets: createUnionSecretMasker([updateSecrets, secretNameBagFor(engine.secretsRun, logicalId)])
 					}));
 				} catch (deleteError) {
-					const deleteMsg = deleteError instanceof Error ? deleteError.message : String(deleteError);
+					const deleteMsg = describeAwsFailure(deleteError).detail;
 					if (!isWaitAbandonedError(deleteError) && !isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound"))) engine.logger.debug(safeMsg`Old resource ${logicalId} already gone, proceeding with CREATE`);
 					else throw deleteError;
 				}
@@ -46431,7 +46587,7 @@ async function updateInPlace(engine, { conditions, counts, currentProps, current
 				if (createFirst) throw createError;
 				if (!retainOldOnReplace) {
 					const shownSecrets = unionOfSecretBags([updateSecrets, printingSecretsFor(engine.secretsRun, logicalId)]);
-					throw new Error(safeMsg`Failed to create ${maskSecretsInText(logicalId, shownSecrets)} after the ` + safeMsg`UPDATE-not-supported replacement: the old resource (${maskSecretsInText(currentResource.physicalId, shownSecrets)}) ` + safeMsg`is now gone. Re-run the deploy to create it fresh. Cause: ${asIsMessage(maskSecretsInText(createError instanceof Error ? createError.message : String(createError), shownSecrets))}`, { cause: createError instanceof Error ? createError : void 0 });
+					throw new Error(safeMsg`Failed to create ${maskSecretsInText(logicalId, shownSecrets)} after the ` + safeMsg`UPDATE-not-supported replacement: the old resource (${maskSecretsInText(currentResource.physicalId, shownSecrets)}) ` + safeMsg`is now gone. Re-run the deploy to create it fresh. Cause: ${asIsMessage(maskSecretsInText(describeAwsFailure(createError).detail, shownSecrets))}`, { cause: createError instanceof Error ? createError : void 0 });
 				}
 				if (!isNameCollisionErrorFrom(createError, logicalId)) throw createError;
 				const nameHeldElsewhere = replacementRequestsDifferentName({
@@ -46769,8 +46925,18 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 	]), fingerprints));
 	if (resourceType === "AWS::CloudFormation::Stack") recordPassedNoEchoParameters(updateSecrets, desiredProps["Parameters"], noEchoPositionSources(engine.noEchoRun, stateResources));
 	if (fingerprintSources !== void 0 && resourceType === "AWS::CloudFormation::Stack") recordPassedParameterClasses(updateSecrets, await classifyPassedParameters(desiredProps["Parameters"], fingerprintSources));
-	const desiredForSkipCheck = maskAtCoordinates(redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps), comparisonCoordinates);
-	const legacyDesired = withoutPhysicalNameCopies(updateSecrets, () => maskAtCoordinates(redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps), comparisonCoordinates));
+	const desiredForSkipCheck = maskAtCoordinates(redactForState(resolvedProps, {
+		provenance: "template-derived",
+		secrets: updateSecrets,
+		source: desiredProps,
+		generation: "same-generation"
+	}), comparisonCoordinates);
+	const legacyDesired = withoutPhysicalNameCopies(updateSecrets, () => maskAtCoordinates(redactForState(resolvedProps, {
+		provenance: "template-derived",
+		secrets: updateSecrets,
+		source: desiredProps,
+		generation: "same-generation"
+	}), comparisonCoordinates));
 	const copies = physicalNameCopiesOf.get(updateSecrets);
 	const regionEvidence = getCurrentProducerRegions()?.();
 	const recordOwnSecrets = copies !== void 0 && copies.size > 0 && regionEvidence?.complete === true && recordHoldsEmbeddedReference(currentResource) ? await resolveRecordSecrets({
@@ -46784,7 +46950,12 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 		if (repaired !== bag[key]) bag[key] = repaired;
 	}
 	if (overlapRuleAnswered(updateSecrets)) {
-		const legacyOverlapBag = withLegacyOverlapScan(updateSecrets, () => maskAtCoordinates(redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps), comparisonCoordinates));
+		const legacyOverlapBag = withLegacyOverlapScan(updateSecrets, () => maskAtCoordinates(redactForState(resolvedProps, {
+			provenance: "template-derived",
+			secrets: updateSecrets,
+			source: desiredProps,
+			generation: "same-generation"
+		}), comparisonCoordinates));
 		const legacyOverlap = legacyReferenceLeavesOnly(legacyOverlapBag);
 		for (const bag of new Set(repairable)) for (const key of Object.keys(bag)) {
 			const repaired = repairPhysicalNameCopyLeaves(bag[key], legacyOverlap[key], desiredForSkipCheck[key]);
@@ -46811,7 +46982,12 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 	const createOnlyEvidence = acceptedCreateOnlyDropsOf(currentResource);
 	const recordedAsWritten = currentResource.provisionedBy === "cc-api" ? currentProps : withoutUnwrittenSilentDropProperties(resourceType, currentProps, desiredForSkipCheck, allowedForRecord, createOnlyEvidence);
 	const unmarkedRecord = noEchoLeavesOf(currentResource) === void 0;
-	const todayAsWritten = unmarkedRecord || witnessNormalize(recordedAsWritten, void 0, desiredForSkipCheckAsWritten).differing.length > 0 ? redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), withoutNoEchoParameterEntries(updateSecrets), desiredProps) : void 0;
+	const todayAsWritten = unmarkedRecord || witnessNormalize(recordedAsWritten, void 0, desiredForSkipCheckAsWritten).differing.length > 0 ? redactForState(resolvedProps, {
+		provenance: "template-derived",
+		secrets: withoutNoEchoParameterEntries(updateSecrets),
+		source: desiredProps,
+		generation: "same-generation"
+	}) : void 0;
 	const witness = todayAsWritten === void 0 ? void 0 : witnessNormalize(recordedAsWritten, todayAsWritten, desiredForSkipCheckAsWritten);
 	const currentPropsAsWritten = witness === void 0 ? recordedAsWritten : witness.current;
 	const witnessMigrates = unmarkedRecord || (witness?.confirmed.length ?? 0) > 0;
@@ -47406,7 +47582,7 @@ async function provisionResource(engine, logicalId, change, stateResources, stac
 		});
 	} catch (error) {
 		renderer.removeTask(logicalId);
-		const message = error instanceof Error ? error.message : String(error);
+		const message = describeAwsFailure(error).detail;
 		const shownMessage = maskForResource(engine.secretsRun, logicalId, message);
 		const shownId = safeMsg`${logicalId}`;
 		engine.logger.error(maskForResource(engine.secretsRun, logicalId, `Failed to ${change.changeType.toLowerCase()} ${shownId}: ${shownMessage}`));
@@ -47488,7 +47664,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 				if (migrate) pendingMigration = false;
 				engine.logger.debug(safeMsg`State saved after ${logicalId}`);
 			} catch (error) {
-				engine.logger.warn(safeMsg`Failed to save state after ${logicalId}: ${asIsMessage(error instanceof Error ? error.message : String(error))}`);
+				engine.logger.warn(safeMsg`Failed to save state after ${logicalId}: ${asIsMessage(describeAwsFailure(error).detail)}`);
 			}
 		});
 	};
@@ -47818,7 +47994,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 			if (migrate) pendingMigration = false;
 			engine.logger.debug("Partial state saved before rollback (orphaned resource tracking)");
 		} catch (saveError) {
-			engine.logger.warn(safeMsg`Failed to save partial state before rollback: ${asIsMessage(saveError instanceof Error ? saveError.message : String(saveError))}`);
+			engine.logger.warn(safeMsg`Failed to save partial state before rollback: ${asIsMessage(describeAwsFailure(saveError).detail)}`);
 		}
 		let autoRollbackClean = false;
 		let autoRollbackJournaled = false;
@@ -47866,7 +48042,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 			engine.logger.debug("State saved after deployment failure");
 			if (autoRollbackClean) await settleNestedChildrenAfterCleanRollback(engine.rollbackDeps(), stackName, rollbackSettledNested, await settleJournalAfterCleanRollback(engine.rollbackDeps(), stackName, rollbackRemainingFailedOps, initialDeploy));
 		} catch (saveError) {
-			engine.logger.debug(safeMsg`Retrying state save after rollback (ETag mismatch): ${asIsMessage(saveError instanceof Error ? saveError.message : String(saveError))}`);
+			engine.logger.debug(safeMsg`Retrying state save after rollback (ETag mismatch): ${asIsMessage(describeAwsFailure(saveError).detail)}`);
 			try {
 				const freshEtag = (await engine.stateBackend.getState(stackName, engine.stackRegion))?.etag;
 				const postRollbackState = {
@@ -47885,7 +48061,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 				engine.logger.debug("State saved after deployment failure (retry succeeded)");
 				if (autoRollbackClean) await settleNestedChildrenAfterCleanRollback(engine.rollbackDeps(), stackName, rollbackSettledNested, await settleJournalAfterCleanRollback(engine.rollbackDeps(), stackName, rollbackRemainingFailedOps, initialDeploy));
 			} catch (retryError) {
-				engine.logger.warn(safeMsg`Failed to save state after rollback: ${asIsMessage(retryError instanceof Error ? retryError.message : String(retryError))}`);
+				engine.logger.warn(safeMsg`Failed to save state after rollback: ${asIsMessage(describeAwsFailure(retryError).detail)}`);
 			}
 		}
 		throw error;
@@ -47940,13 +48116,13 @@ async function persistStateAfterOutputFailure(engine, stackName, currentState, n
 		});
 		engine.logger.debug("State saved after output resolution failure");
 	} catch (saveError) {
-		engine.logger.debug(safeMsg`Retrying state save after output resolution failure (ETag mismatch): ${asIsMessage(saveError instanceof Error ? saveError.message : String(saveError))}`);
+		engine.logger.debug(safeMsg`Retrying state save after output resolution failure (ETag mismatch): ${asIsMessage(describeAwsFailure(saveError).detail)}`);
 		try {
 			const freshEtag = (await engine.stateBackend.getState(stackName, engine.stackRegion))?.etag;
 			await engine.stateBackend.saveState(stackName, engine.stackRegion, engine.withParentInfo(buildState()), { ...freshEtag !== void 0 && { expectedEtag: freshEtag } });
 			engine.logger.debug("State saved after output resolution failure (retry succeeded)");
 		} catch (retryError) {
-			engine.logger.warn(safeMsg`Failed to save state after output resolution failure: ${asIsMessage(retryError instanceof Error ? retryError.message : String(retryError))} — resources were provisioned but not recorded; run deploy again to reconcile.`);
+			engine.logger.warn(safeMsg`Failed to save state after output resolution failure: ${asIsMessage(describeAwsFailure(retryError).detail)} — resources were provisioned but not recorded; run deploy again to reconcile.`);
 		}
 	}
 }
@@ -48282,7 +48458,7 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 					else if (healedAttributesPending) engine.logger.debug("Persisted attributes re-read from AWS for a stale record (no-change path)");
 					else engine.logger.debug("Persisted skipped-outputs record (no outputs-value diff, no-change path)");
 				} catch (saveError) {
-					engine.logger.warn(safeMsg`Failed to persist no-change state update: ${asIsMessage(saveError instanceof Error ? saveError.message : String(saveError))} — drift baseline / outputs will be re-resolved on next deploy.`);
+					engine.logger.warn(safeMsg`Failed to persist no-change state update: ${asIsMessage(describeAwsFailure(saveError).detail)} — drift baseline / outputs will be re-resolved on next deploy.`);
 				}
 			}
 			return {
@@ -48441,7 +48617,7 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 			await engine.lockManager.releaseLock(stackName, engine.stackRegion);
 			engine.logger.debug("Lock released");
 		} catch (lockError) {
-			engine.logger.warn(safeMsg`Failed to release lock: ${asIsMessage(lockError instanceof Error ? lockError.message : String(lockError))}`);
+			engine.logger.warn(safeMsg`Failed to release lock: ${asIsMessage(describeAwsFailure(lockError).detail)}`);
 		}
 	}
 }
@@ -48703,7 +48879,8 @@ var DeployEngine = class {
 		for (const [logicalId, record] of Object.entries(state.resources)) {
 			const secrets = this.secretsRun.perResourceSecrets.get(logicalId);
 			const templateProps = this.secretsRun.perResourceTemplateProps.get(logicalId);
-			const scrubbed = scrubResourceRecord(this.attributeHealer.withHealedAttributes(logicalId, record), secrets ?? /* @__PURE__ */ new Map(), templateProps);
+			const healed = this.attributeHealer.withHealedAttributes(logicalId, record);
+			const scrubbed = scrubResourceRecord(healed, secrets ?? /* @__PURE__ */ new Map(), templateProps, void 0, sameGenerationClaimsOf(healed));
 			const noEchoScrubbed = applyNoEchoPersist(this.noEchoRun, this.noEchoDeps(), logicalId, record, withNoEchoExactEchoes(this.noEchoRun, logicalId, scrubbed), templateProps, state.resources, secrets);
 			resources[logicalId] = withReferenceProvenance(withConstructPath(withMaskedPropertyFingerprints(noEchoScrubbed, record.properties, templateProps, secrets, this.secretsRun.fingerprintNoEchoValues, this.secretsRun.perResourceInputFingerprints.get(logicalId)), constructPathOf(this.noEchoRun.constructPathTemplate, logicalId)), this.referenceProvenanceToPersist(logicalId, record, noEchoScrubbed, secrets));
 		}
@@ -48712,7 +48889,7 @@ var DeployEngine = class {
 			const orphanTemplateProps = sameResource ? this.secretsRun.perResourceTemplateProps.get(entry.logicalId) : void 0;
 			return {
 				...entry,
-				state: withMaskedPropertyFingerprints(applyNoEchoPersist(this.noEchoRun, this.noEchoDeps(), entry.logicalId, entry.state, scrubResourceRecord(entry.state, (sameResource ? this.secretsRun.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), orphanTemplateProps), orphanTemplateProps, state.resources), entry.state.properties, orphanTemplateProps, sameResource ? this.secretsRun.perResourceSecrets.get(entry.logicalId) : void 0, sameResource ? this.secretsRun.fingerprintNoEchoValues : void 0, sameResource ? this.secretsRun.perResourceInputFingerprints.get(entry.logicalId) : void 0)
+				state: withMaskedPropertyFingerprints(applyNoEchoPersist(this.noEchoRun, this.noEchoDeps(), entry.logicalId, entry.state, scrubResourceRecord(entry.state, (sameResource ? this.secretsRun.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), orphanTemplateProps, void 0, sameGenerationClaimsOf(entry.state)), orphanTemplateProps, state.resources), entry.state.properties, orphanTemplateProps, sameResource ? this.secretsRun.perResourceSecrets.get(entry.logicalId) : void 0, sameResource ? this.secretsRun.fingerprintNoEchoValues : void 0, sameResource ? this.secretsRun.perResourceInputFingerprints.get(entry.logicalId) : void 0)
 			};
 		});
 		const outputs = redactOutputs(this.maskingDeps(), state.outputs);
@@ -48765,7 +48942,10 @@ var DeployEngine = class {
 	redactCrossStackReads(state) {
 		if (state.imports === void 0 && state.outputReads === void 0) return {};
 		const secrets = allRecordedSecrets(this.secretsRun, this.maskingDeps());
-		const redact = (value) => redactSecretsForState(value, secrets);
+		const redact = (value) => redactForState(value, {
+			provenance: "value-scan",
+			secrets
+		});
 		return {
 			...state.imports === void 0 ? {} : { imports: state.imports.map((entry) => ({
 				...entry,
@@ -48782,7 +48962,10 @@ var DeployEngine = class {
 		absorbOutputsPassSecrets(this.maskingDeps());
 		const secrets = allRecordedSecrets(this.secretsRun, this.maskingDeps());
 		if (secrets.size === 0) return (name) => name;
-		return (name) => redactSecretsForState(name, secrets);
+		return (name) => redactForState(name, {
+			provenance: "value-scan",
+			secrets
+		});
 	}
 	withParentInfo(state) {
 		const redacted = this.redactStateForPersist(state);
@@ -48857,7 +49040,13 @@ var DeployEngine = class {
 		return maskingRetryLogger(this.logger, secrets);
 	}
 };
+function sameGenerationClaimsOf(record) {
+	return {
+		properties: isSameGenerationBag(record.properties) ? "same-generation" : "unproven",
+		observed: isSameGenerationBag(record.observedProperties) ? "same-generation" : "unproven"
+	};
+}
 
 //#endregion
-export { resolvePendingCloudControlRequests as $, repairMalformedOutputsForReadOnly as $a, redactedDockerCause as $c, accountArgs as $i, buildFinalSnapshotIdentifier as $n, readbackPathFor as $o, DiffCalculator as $r, S3StateBackend as $s, namesAnyDeclaredParameter as $t, findServiceTokenRefusals as A, refuseMalformedOrphanRecordsForDestroy as Aa, assertAssetBucketRegion as Ac, coerceParameterTypedValue as Ai, expectedOwnerParam as Al, gray as An, replayWarn as Ao, isCustomResourceType as Ar, inheritNestedStackParameterAssociations as As, removeProtectionTypeList as At, parentSuppliedValues as B, refuseMalformedResourceEntriesForImport as Ba, resolveDockerContextDirectory as Bc, cfnRefValueFromPhysicalId as Bi, nullPrototypeRecord as Bl, journaledOrphanPrintingBag as Bn, sameLambdaFunctionAddress as Bo, UNSPECIFIED_SKIP_REASON as Br, recordMaskOnlyValuesIn as Bs, resolveReplacementOldType as Bt, getPriorAttempts as C, malformedResourcesWarning as Ca, WorkGraph as Cc, applyCallerIdentityCredentials as Ci, CFN_TEMPLATE_BODY_LIMIT as Cl, awaitInFlightSibling as Cn, toFiniteNumber as Co, ProviderRegistry as Cr, withPhysicalNameCopies as Cs, formatResourceLine as Ct, crossStackOutputProvenanceSource as D, refuseDivergentRecordRegionForDestroy as Da, rewriteTemplateAssetReferences as Dc, classifyReplaySecretRegion as Di, uploadCfnTemplate as Dl, replacedDeleteFailureVerdict as Dn, configIntegerRefusal as Do, waitForLambdaFunctionActive as Dr, isUncertifiedBaselineMaskPosition as Ds, withApiLimit as Dt, computeImplicitDeleteEdges as E, previewableOrphanRecords as Ea, loadPublishableAssetManifest as Ec, classifyRecordedSecretRegion as Ei, findLargeInlineResources as El, withStackRecords as En, configBooleanRefusal as Eo, wouldReturnToSdkProvider as Er, dynamicReferenceTokens as Es, lookupEachName as Et, listNestedTemplateRows as F, refuseMalformedOutputsForDestroy as Fa, readBootstrapMarkerBody as Fc, carriesDynamicReference as Fi, StageLoadError as Fl, noEchoComparisonForTemplate as Fn, templateResourceTypes as Fo, customResourceResponseExpirationWarning as Fr, recordPhysicalNameCopy as Fs, planFailedOps as Ft, keptWholeReasonText as G, refuseMalformedResourcePropertiesForExport as Ga, finchSecretArgvRefusal as Gc, parameterInputsFor as Gi, renderAssemblyPathEscape as Gl, secretNamePrintingBags as Gn, maskAtCoordinates as Go, isWaitAbandonedError as Gr, STATE_SOURCED_BASELINE_RULES as Gs, inheritProducerRegions as Gt, withResourceDeadline as H, refuseMalformedResourceEntriesForOrphan as Ha, describeDockerExecFailure as Hc, refStateLookupFromResource as Hi, absoluteAssemblyPathEscape as Hl, namingSecretsWithRecordedNoEcho as Hn, TemplateParser as Ho, deleteLeftInPlace as Hr, recordNoEchoParameterFreshValue as Hs, orphanNeedsIdentity as Ht, renderNestedTemplateTreeDefect as I, refuseMalformedResourceAttributesForOrphan as Ia, validateAssetBucketName as Ic, carriesFetchableDynamicReference as Ii, processStackMessages as Il, noEchoExactEchoLeavesOf as In, describeTypeWithThrottleRetry as Io, CloudControlProvider as Ir, splitGetAttStringForm as Is, planRollback as It, makeSiblingClaimReader as J, refuseMalformedResourcesForDestroy as Ja, isDockerClientEnvKey as Jc, JSON_LISTING_HOLE_VALUE as Ji, injectedAwsRegionValue as Jl, stateSecretNameNeedles as Jn, maskedLeafCoordinatesOf as Jo, ec2InstanceProtectionSite as Jr, TEMPLATE_SOURCED_RULES as Js, redactedDeleteAddressFields as Jt, mergeNoChangeOutputs as K, refuseMalformedResourcePropertiesForOrphan as Ka, formatDockerLoginError as Kc, passedParameterClassesOf as Ki, resolveAssemblyPath as Kl, secretNamedAttributeNamesOf as Kn, maskReadbackAtCoordinates as Ko, markWaitAbandoned as Kr, STATE_SOURCED_CROSS_GENERATION_RULES as Ks, REDACTED_DELETE_ADDRESS_SKIP_REASON as Kt, templateIdentity as L, refuseMalformedResourceEntries as La, validateContainerRepoName as Lc, isNamelessDynamicReferenceError as Li, defineOwnKey as Ll, noEchoParameterNamesOf as Ln, withRetry as Lo, slowCcOperationTimeoutMs as Lr, carriesSecretMask as Ls, recheckFailedPlan as Lt, childTemplateLoader as M, refuseMalformedOrphansForDestroy as Ma, getBootstrapMarkerKey as Mc, parameterTypeMayLoseSecretIdentity as Mi, canonicalizeRegion as Ml, red as Mn, requireConfigObject as Mo, withPrintingSecrets as Mr, recoverMaskedOutput as Ms, demoteSupersededOrphans as Mt, findNestedTemplateTreeDefect as N, refuseMalformedOrphansForOrphan as Na, isCrossRegionRedirect as Nc, getAccountInfo as Ni, derivePartitionAndUrlSuffix as Nl, yellow as Nn, requireConfigString as No, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Nr, physicalNameCopiesOf as Ns, isJournaledOrphan as Nt, inheritedProvenanceForChildDiff as O, refuseMalformedNestedChildOutputs as Oa, AssetModeResolver as Oc, producerRegionsFromState as Oi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ol, bold as On, configStringRefusal as Oo, TemplateNoEchoReresolver as Or, pathCrossesDottedKey as Os, replayFailedOperations as Ot, isAbsoluteAssetPath as P, refuseMalformedOutputs as Pa, parseBootstrapMarker as Pc, isImpossibleEmptyStoredAttribute as Pi, AssemblyReader as Pl, noEchoAttributeNamesOf as Pn, prefetchCreateOnlyPropertyPaths as Po, applyCustomResourceResponseExpiration as Pr, recordAttributeIdCopy as Ps, isReplacementOrphan as Pt, pendingRequestCount as Q, repairMalformedOrphansForReadOnly as Qa, redactedCause as Qc, UNREADABLE_RESOURCES_MAP_ROW as Qi, PRE_DELETE_SNAPSHOT_TYPES as Qn, passedNoEchoParametersOf as Qo, reEnableInstanceApiTermination as Qr, isLockInfoExpired as Qs, computeParameterTaint as Qt, conditionFingerprint as R, refuseMalformedResourceEntriesForDeploy as Ra, buildDenyExternalAccessPolicy as Rc, keepsSecretReferenceToken as Ri, hasOwnKey as Rl, createReadOnlyAttributeHealerFactory as Rn, canonicalLambdaFunctionName as Ro, unchangedBehindSecretReference as Rr, provenPublicValue as Rs, recordUnderIdIsNotOwn as Rt, isTruthyCfnBoolean as S, malformedResourcePropertiesWarning as Sa, stringifyValue as Sc, AWS_CREDENTIAL_ENV_KEYS as Si, ssmResolvedValueType as Sl, formatDestructiveChange as Sn, toCfnInteger as So, CC_BROKEN_REASON as Sr, scrubResourceRecord as Ss, sameJournaledOrphans as St, IMPLICIT_DELETE_DEPENDENCIES as T, malformedStateRefusalMessage as Ta, createAssetRedirectResolver as Tc, envCredentialsAreAssumedRole as Ti, MIGRATE_TMP_PREFIX as Tl, getStackRecords as Tn, coerceCfnInteger as To, isCustomResource as Tr, DYNAMIC_REFERENCE_TOKEN_SCAN as Ts, isAccessDeniedError as Tt, diffSecurity as U, refuseMalformedResourcePropertiesForDestroy as Ua, describeDockerFailure as Uc, parseWebACLArn as Ui, describeFileReadFailure as Ul, orphanRecordsPrintingBag as Un, canonicalCoordinates as Uo, deleteSkipReason as Ur, recordProvenPublicExpression as Us, findNestedStackTypeChanges as Ut, readRecordedConditionVerdicts as V, refuseMalformedResourceEntriesForImportSave as Va, describeDockerCapturedOutput as Vc, isStalePlaceholderArnAttribute as Vi, ownValue as Vl, maskEventTextWithBoundBags as Vn, DagBuilder as Vo, deleteIndeterminateGuards as Vr, recordNoEchoAttributeValues as Vs, seedsDeleteFirstGuard as Vt, isSecretBearingReferenceString as W, refuseMalformedResourcePropertiesForDrift as Wa, dockerSpawnEnvWithSensitive as Wc, withSharedDrainBudget as Wi, displayAssemblyPath as Wl, secretNamePrintingBag as Wn, isMarkedCoordinate as Wo, withIndeterminateGuard as Wr, wholeStringLeavesOf as Ws, getCurrentProducerRegions as Wt, DeploymentEventsReader as X, refuseMalformedState as Xa, partitionSensitiveEnv as Xc, STATE_RESOURCES_MALFORMED as Xi, resolveBucketRegion as Xl, extractDeploymentEventError as Xn, noEchoLeavesOf as Xo, observeThenDisableInstanceApiTermination as Xr, isSingleDynamicReferenceToken as Xs, updatePartialMessage as Xt, planOrphanAdoption as Y, refuseMalformedResourcesForExport as Ya, isMalformedEnvKey as Yc, STATE_REGION_DIVERGED as Yi, clearBucketRegionCache as Yl, storedSecretNameNeedles as Yn, noEchoCoordinatesOf as Yo, isTerminationProtectionPropagationError as Yr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ys, redactedDeleteAddressSkip as Yt, DeploymentEventsStore as Z, repairMalformedOrphanRecordsForReadOnly as Za, redactDockerArgvValues as Zc, UNREADABLE_ORPHANS_CONTAINER_ROW as Zi, ATOMIC_FINAL_SNAPSHOT_TYPES as Zn, noEchoOutputsComparison as Zo, reDisableInstanceApiTermination as Zr, LockManager as Zs, updatePartialReason as Zt, deleteTableWithIndexBusyRetry as _, malformedOrphansWarning as _a, orphansAfterRollback as _c, assertFlagRoleArn as _i, resolveStateBucketWithDefault as _l, DEFAULT_RESOURCE_TIMEOUT_MS as _n, isStatefulRecreateTargetSync as _o, refuseMalformedDesiredTags as _r, maskSecretsInText as _s, dropFailedHint as _t, isProtectionValueActive as a, isReadableOrphanRecord as aa, isAccessDenied$1 as ac, s3BucketDomainName as ai, stripForDisplay as al, secretBearing as an, unreadableResourceEntries as ao, unsupportedFinalSnapshotError as ar, createUnionSecretMasker as as, dropSettledNestedJournals as at, S3_AUTO_DELETE_OBJECTS_TAG as b, malformedRenderedContainersWarning as ba, AssetPublisher as bc, isIamRoleArn as bi, stateBucketExistenceConfirmed as bl, constructPathOf as bn, coerceWarmThroughput as bo, definedAttributes as br, snapshotPassProvenance as bs, loadJournaledOrphans as bt, DynamoDBGlobalTableProvider as c, malformedExportNamesWarning as ca, acceptedCreateOnlyDropsOf as cc, s3BucketWebsiteUrl as ci, Synthesizer as cl, carriedExportAliasExposure as cn, findSilentDropProperties as co, reserveStackCreateToken as cr, logOnlyValueCount as cs, recordDisplacedSkips as ct, compensateRemovedDeletionProtection as d, malformedLocalResourceEntriesWarning as da, hasReadableExportSet as dc, refuseUnreadableCdkCrossAccountRefs as di, getLegacyStateBucketName as dl, isWholeDynamicReferenceValue as dn, NO_CC_HANDLERS_REASON as do, isRefusedByName as dr, recordLogOnlyValue as ds, withNestedRevertRun as dt, deployRefusesOrphanRowsReason as ea, rebuildClientForBucketRegion as ec, INTRINSIC_KEYS as ei, runDockerForeground as el, reachableDivergentParameters as en, repairMalformedResourceEntriesForReadOnly as eo, ccRoutedFinalSnapshotError as er, readsNoEchoSource as es, keptForReadoption as et, deleteBudgetKey as f, malformedLocalResourcesWarning as fa, hasReasonlessBaselineRefusal as fc, keepHeldTokenProvenance as fi, loadCdkJson as fl, noEchoParameterValueSeed as fn, hasNoCloudControlHandlers as fo, markDeleteStarted as fr, shareLogOnlyValues as fs, collectNestedChildUnaddressed as ft, INDEX_SETTLE_POLL_INTERVAL_MS as g, malformedOrphansRefusalMessage as ga, isReadableBag as gc, applyRoleArnIfSet as gi, resolveSkipPrefix as gl, bindingSkippedOutputs as gn, isStatefulRecreateTargetForReplace as go, readTagList as gr, maskSecretsInError as gs, dropFailedCommands as gt, DELETE_INDEX_WAIT_PROCEED_NOTE as h, malformedOrphanRowsKeptWarning as ha, importableOutputs as hc, recordedReferenceRegions as hi, resolveCaptureObservedState as hl, isExportAliasCollision as hn, MULTI_REGION_RECREATE_BLOCKED_TYPES as ho, planTagDiff as hr, errorCauseChain as hs, deleteJournaledOrphans as ht, PROTECTION_PROPERTY_BY_TYPE as i, hasReadableResources as ia, crossPrefixDeniedWarning as ic, s3BucketArn as ii, stripControlChars as il, exportAliasCollisionScrubWarning as in, unreadableOrphanRecords as io, refusesFinalSnapshot as ir, carryLogOnlyValues as is, displacedPhysicalIdShown as it, serviceTokenBlockingReason as j, refuseMalformedOrphans as ja, ensureAssetStorage as jc, isUnboundTemplateParameter as ji, PARTITION_TABLE as jl, green as jn, requireConfigArray as jo, getCurrentResourceSecrets as jr, recordNestedStackParameterExpressions as js, recordAfterRollbackUpdate as jt, deferredServiceTokenWarning as k, refuseMalformedOrphanRecords as ka, BOOTSTRAP_MARKER_PREFIX as kc, regionLessSecretName as ki, decodeListingKey as kl, cyan as kn, readConfigString as ko, readsNoEchoDeleteValues as kr, identityKeyFor as ks, replayRollback as kt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, malformedExportSourceWarning as la, describeRegionValueKind as lc, resolveDynamicReferences as li, synthesisStatusMessage as ll, exportNameNoEchoParameters as ln, unwrittenCreateOnlyReplacement as lo, withCreateTokenLedger as lr, printingCorpusOf as ls, revertNestedChildFromJournal as lt, resolveDynamoDbDeleteBudgetMs as m, malformedOrphanRecordsWarning as ma, importableOutputKeys as mc, recordedOutputReferenceRegions as mi, resolveAutoAssetStorage as ml, collectPublishedOutputNames as mn, shownType as mo, DBPROXY_TAG_OPTIONS as mr, createSecretMasker as ms, withNestedStackContext as mt, recordedProtectionEvidence as n, hasReadableOrphans as na, CrossPrefixScanCache as nc, poisonRenderedSpellingsCollidingIn as ni, warnFinchArgvExposure as nl, WITHHELD_NAME_DISPLAY as nn, repairMalformedResourcesForReadOnly as no, effectiveDeletionPolicy as nr, valueAtCoordinate as ns, NESTED_PENDING_PARENT_REASON as nt, perType as o, isReadableResourceEntry as oa, isNotImplemented as oc, s3BucketDualStackDomainName as oi, AssetManifestLoader as ol, secretBearingStateKeyWarning as on, withheldAccountClause as oo, earliestDefined as or, hasMaskableValues as os, getNestedRevertRun as ot, resolveDynamoDbDeleteBudgetClock as p, malformedOrphanRecordsRefusalMessage as pa, hasUnverifiableParameterRefusal as pc, outputReferenceProvenanceOf as pi, resolveApp as pl, collectDeclaredOutputNames as pn, findReplacedReadersOfRecreateTargets as po, DBPROXY_TAGS_WHAT as pr, unionOfSecretBags as ps, getCurrentNestedStackContext as pt, makeCanonicalizePropertiesFn as q, refuseMalformedResourcesForDeploy as qa, getDockerCmd as qc, declaresNoEcho as qi, injectAwsRegion as ql, secretNamedRecordNeedles as qn, maskWholeValue as qo, disableInstanceApiTermination as qr, STATE_SOURCED_READBACK_RULES as qs, isRedactedRecordedValue as qt, recordedProtectionNote as r, hasReadableOutputs as ra, applyCrossPrefixScan as rc, isSettledInstanceState as ri, escapeRegExp$3 as rl, displayTextOrWithheld as rn, unpreviewableOrphanRecords as ro, isFinalSnapshotError as rr, liveMatchesUnresolvedTokenFrame as rs, displacedOpClause as rt, readProtection as s, malformedDriftResourcePropertiesWarning as sa, splitImportedOps as sc, s3BucketRegionalDomainName as si, getDockerImageBySourceHash as sl, secretSafeKeyDisplay as sn, findActionableSilentDrops as so, ledgerForStack as sr, literalSplitDelimitersOf as ss, nestedChildStackName as st, DeployEngine as t, displayLogicalId as ta, CrossPrefixReadError as tc, IntrinsicFunctionResolver as ti, runDockerStreaming as tl, resourcesNamingDeclaredParameter as tn, repairMalformedResourcePropertiesForReadOnly as to, createPreDeleteFinalSnapshot as tr, recordedNoEchoValuesOf as ts, recordRetainedForReadoption as tt, beginDeleteWait as u, malformedLocalOutputsWarning as ua, exportNamesCarriedFrom as uc, producerLookupOver as ui, getDefaultStateBucketName as ul, exportNameSecretExposure as un, withoutSilentDropProperties as uo, acquireIdempotencyToken as ur, recordLogOnlyParameterValue as us, revertedNestedRowIds as ut, waitForIndexesSettled as v, malformedOutputsRefusalMessage as va, orphansCarriedFrom as vc, assertSendableRoleArn as vi, resolveStateBucketWithDefaultAndSource as vl, DEFAULT_RESOURCE_WARN_AFTER_MS as vn, renderStatefulReason as vo, tagMapAsList as vr, markSameGenerationBag as vs, isHandledOrphan as vt, markRefusedBeforeApplying as w, malformedScrubResourceEntriesRefusalMessage as wa, buildAssetRedirectMap as wc, callerEnvCredentials as wi, CFN_TEMPLATE_URL_LIMIT as wl, destroyStackRecordsView as wn, coerceCfnBoolean as wo, ccBrokenReason as wr, withoutPhysicalNameCopies as ws, chunks as wt, hasCdkAutoDeleteTag as x, malformedResourceEntriesWarning as xa, isSensitiveAttributeName as xc, sendableAssumeRoleCommand as xi, warnDeprecatedNoPrefixCliFlag as xl, findDestructiveChanges as xn, isWarmThroughputDecrease as xo, stringifyIfAssigned as xr, redactSecretsForState as xs, makeForeignHolderScan as xt, ECR_AUTO_DELETE_IMAGES_TAG as y, malformedOutputsWarning as ya, shouldRetainResource as yc, explicitRoleArnOrThrow as yi, resolveUseCdkBootstrapAssets as yl, maskingRetryLogger as yn, WARM_THROUGHPUT_MEMBERS as yo, tagPlanWarning as yr, recordReferenceProvenanceEntry as ys, journaledOrphanLines as yt, conditionInputsFrom as z, refuseMalformedResourceEntriesForDestroy as za, buildDockerImage as zc, AWS_NO_VALUE as zi, hasPlainPrototype$1 as zl, completedReplayEntries as zn, lambdaFunctionNameForMask as zo, RollbackInlinePolicyWriters as zr, recordMaskOnlyValue as zs, replacementNeverSwapped as zt };
-//# sourceMappingURL=deploy-engine-HAvm8vSI.js.map
+export { resolvePendingCloudControlRequests as $, repairMalformedOutputsForReadOnly as $a, escapeRegExp$3 as $c, accountArgs as $i, buildFinalSnapshotIdentifier as $n, readbackPathFor as $o, DiffCalculator as $r, applyCrossPrefixScan as $s, namesAnyDeclaredParameter as $t, findServiceTokenRefusals as A, refuseMalformedOrphanRecordsForDestroy as Aa, parseBootstrapMarker as Ac, coerceParameterTypedValue as Ai, AssemblyReader as Al, gray as An, replayWarn as Ao, isCustomResourceType as Ar, inheritNestedStackParameterAssociations as As, removeProtectionTypeList as At, parentSuppliedValues as B, refuseMalformedResourceEntriesForImport as Ba, dockerSpawnEnvWithSensitive as Bc, cfnRefValueFromPhysicalId as Bi, displayAssemblyPath as Bl, journaledOrphanPrintingBag as Bn, sameLambdaFunctionAddress as Bo, UNSPECIFIED_SKIP_REASON as Br, recordMaskOnlyValuesIn as Bs, resolveReplacementOldType as Bt, getPriorAttempts as C, malformedResourcesWarning as Ca, rewriteTemplateAssetReferences as Cc, applyCallerIdentityCredentials as Ci, uploadCfnTemplate as Cl, awaitInFlightSibling as Cn, toFiniteNumber as Co, ProviderRegistry as Cr, withPhysicalNameCopies as Cs, formatResourceLine as Ct, crossStackOutputProvenanceSource as D, refuseDivergentRecordRegionForDestroy as Da, ensureAssetStorage as Dc, classifyReplaySecretRegion as Di, PARTITION_TABLE as Dl, replacedDeleteFailureVerdict as Dn, configIntegerRefusal as Do, waitForLambdaFunctionActive as Dr, isUncertifiedBaselineMaskPosition as Ds, withApiLimit as Dt, computeImplicitDeleteEdges as E, previewableOrphanRecords as Ea, assertAssetBucketRegion as Ec, classifyRecordedSecretRegion as Ei, expectedOwnerParam as El, withStackRecords as En, configBooleanRefusal as Eo, wouldReturnToSdkProvider as Er, dynamicReferenceTokens as Es, lookupEachName as Et, listNestedTemplateRows as F, refuseMalformedOutputsForDestroy as Fa, buildDockerImage as Fc, carriesDynamicReference as Fi, hasPlainPrototype$1 as Fl, noEchoComparisonForTemplate as Fn, templateResourceTypes as Fo, customResourceResponseExpirationWarning as Fr, recordPhysicalNameCopy as Fs, planFailedOps as Ft, keptWholeReasonText as G, refuseMalformedResourcePropertiesForExport as Ga, isMalformedEnvKey as Gc, parameterInputsFor as Gi, clearBucketRegionCache as Gl, secretNamePrintingBags as Gn, maskAtCoordinates as Go, isWaitAbandonedError as Gr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Gs, inheritProducerRegions as Gt, withResourceDeadline as H, refuseMalformedResourceEntriesForOrphan as Ha, formatDockerLoginError as Hc, refStateLookupFromResource as Hi, resolveAssemblyPath as Hl, namingSecretsWithRecordedNoEcho as Hn, TemplateParser as Ho, deleteLeftInPlace as Hr, recordNoEchoParameterFreshValue as Hs, orphanNeedsIdentity as Ht, renderNestedTemplateTreeDefect as I, refuseMalformedResourceAttributesForOrphan as Ia, resolveDockerContextDirectory as Ic, carriesFetchableDynamicReference as Ii, nullPrototypeRecord as Il, noEchoExactEchoLeavesOf as In, describeTypeWithThrottleRetry as Io, CloudControlProvider as Ir, splitGetAttStringForm as Is, planRollback as It, makeSiblingClaimReader as J, refuseMalformedResourcesForDestroy as Ja, redactedCause as Jc, JSON_LISTING_HOLE_VALUE as Ji, stateSecretNameNeedles as Jn, maskedLeafCoordinatesOf as Jo, ec2InstanceProtectionSite as Jr, isLockInfoExpired as Js, redactedDeleteAddressFields as Jt, mergeNoChangeOutputs as K, refuseMalformedResourcePropertiesForOrphan as Ka, partitionSensitiveEnv as Kc, passedParameterClassesOf as Ki, resolveBucketRegion as Kl, secretNamedAttributeNamesOf as Kn, maskReadbackAtCoordinates as Ko, markWaitAbandoned as Kr, isSingleDynamicReferenceToken as Ks, REDACTED_DELETE_ADDRESS_SKIP_REASON as Kt, templateIdentity as L, refuseMalformedResourceEntries as La, describeDockerCapturedOutput as Lc, isNamelessDynamicReferenceError as Li, ownValue as Ll, noEchoParameterNamesOf as Ln, withRetry as Lo, slowCcOperationTimeoutMs as Lr, carriesSecretMask as Ls, recheckFailedPlan as Lt, childTemplateLoader as M, refuseMalformedOrphansForDestroy as Ma, validateAssetBucketName as Mc, parameterTypeMayLoseSecretIdentity as Mi, processStackMessages as Ml, red as Mn, requireConfigObject as Mo, withPrintingSecrets as Mr, recoverMaskedOutput as Ms, demoteSupersededOrphans as Mt, findNestedTemplateTreeDefect as N, refuseMalformedOrphansForOrphan as Na, validateContainerRepoName as Nc, getAccountInfo as Ni, defineOwnKey as Nl, yellow as Nn, requireConfigString as No, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Nr, physicalNameCopiesOf as Ns, isJournaledOrphan as Nt, inheritedProvenanceForChildDiff as O, refuseMalformedNestedChildOutputs as Oa, getBootstrapMarkerKey as Oc, producerRegionsFromState as Oi, canonicalizeRegion as Ol, bold as On, configStringRefusal as Oo, TemplateNoEchoReresolver as Or, pathCrossesDottedKey as Os, replayFailedOperations as Ot, isAbsoluteAssetPath as P, refuseMalformedOutputs as Pa, buildDenyExternalAccessPolicy as Pc, isImpossibleEmptyStoredAttribute as Pi, hasOwnKey as Pl, noEchoAttributeNamesOf as Pn, prefetchCreateOnlyPropertyPaths as Po, applyCustomResourceResponseExpiration as Pr, recordAttributeIdCopy as Ps, isReplacementOrphan as Pt, pendingRequestCount as Q, repairMalformedOrphansForReadOnly as Qa, warnFinchArgvExposure as Qc, UNREADABLE_RESOURCES_MAP_ROW as Qi, PRE_DELETE_SNAPSHOT_TYPES as Qn, passedNoEchoParametersOf as Qo, reEnableInstanceApiTermination as Qr, CrossPrefixScanCache as Qs, computeParameterTaint as Qt, conditionFingerprint as R, refuseMalformedResourceEntriesForDeploy as Ra, describeDockerExecFailure as Rc, keepsSecretReferenceToken as Ri, absoluteAssemblyPathEscape as Rl, createReadOnlyAttributeHealerFactory as Rn, canonicalLambdaFunctionName as Ro, unchangedBehindSecretReference as Rr, provenPublicValue as Rs, recordUnderIdIsNotOwn as Rt, isTruthyCfnBoolean as S, malformedResourcePropertiesWarning as Sa, loadPublishableAssetManifest as Sc, AWS_CREDENTIAL_ENV_KEYS as Si, findLargeInlineResources as Sl, formatDestructiveChange as Sn, toCfnInteger as So, CC_BROKEN_REASON as Sr, scrubResourceRecord as Ss, sameJournaledOrphans as St, IMPLICIT_DELETE_DEPENDENCIES as T, malformedStateRefusalMessage as Ta, BOOTSTRAP_MARKER_PREFIX as Tc, envCredentialsAreAssumedRole as Ti, decodeListingKey as Tl, getStackRecords as Tn, coerceCfnInteger as To, isCustomResource as Tr, DYNAMIC_REFERENCE_TOKEN_SCAN as Ts, isAccessDeniedError as Tt, diffSecurity as U, refuseMalformedResourcePropertiesForDestroy as Ua, getDockerCmd as Uc, parseWebACLArn as Ui, injectAwsRegion as Ul, orphanRecordsPrintingBag as Un, canonicalCoordinates as Uo, deleteSkipReason as Ur, recordProvenPublicExpression as Us, findNestedStackTypeChanges as Ut, readRecordedConditionVerdicts as V, refuseMalformedResourceEntriesForImportSave as Va, finchSecretArgvRefusal as Vc, isStalePlaceholderArnAttribute as Vi, renderAssemblyPathEscape as Vl, maskEventTextWithBoundBags as Vn, DagBuilder as Vo, deleteIndeterminateGuards as Vr, recordNoEchoAttributeValues as Vs, seedsDeleteFirstGuard as Vt, isSecretBearingReferenceString as W, refuseMalformedResourcePropertiesForDrift as Wa, isDockerClientEnvKey as Wc, withSharedDrainBudget as Wi, injectedAwsRegionValue as Wl, secretNamePrintingBag as Wn, isMarkedCoordinate as Wo, withIndeterminateGuard as Wr, wholeStringLeavesOf as Ws, getCurrentProducerRegions as Wt, DeploymentEventsReader as X, refuseMalformedState as Xa, runDockerForeground as Xc, STATE_RESOURCES_MALFORMED as Xi, extractDeploymentEventError as Xn, noEchoLeavesOf as Xo, observeThenDisableInstanceApiTermination as Xr, rebuildClientForBucketRegion as Xs, updatePartialMessage as Xt, planOrphanAdoption as Y, refuseMalformedResourcesForExport as Ya, redactedDockerCause as Yc, STATE_REGION_DIVERGED as Yi, storedSecretNameNeedles as Yn, noEchoCoordinatesOf as Yo, isTerminationProtectionPropagationError as Yr, S3StateBackend as Ys, redactedDeleteAddressSkip as Yt, DeploymentEventsStore as Z, repairMalformedOrphanRecordsForReadOnly as Za, runDockerStreaming as Zc, UNREADABLE_ORPHANS_CONTAINER_ROW as Zi, ATOMIC_FINAL_SNAPSHOT_TYPES as Zn, noEchoOutputsComparison as Zo, reDisableInstanceApiTermination as Zr, CrossPrefixReadError as Zs, updatePartialReason as Zt, deleteTableWithIndexBusyRetry as _, malformedOrphansWarning as _a, isSensitiveAttributeName as _c, assertFlagRoleArn as _i, warnDeprecatedNoPrefixCliFlag as _l, DEFAULT_RESOURCE_TIMEOUT_MS as _n, isStatefulRecreateTargetSync as _o, refuseMalformedDesiredTags as _r, maskSecretsInText as _s, dropFailedHint as _t, isProtectionValueActive as a, isReadableOrphanRecord as aa, describeRegionValueKind as ac, s3BucketDomainName as ai, synthesisStatusMessage as al, secretBearing as an, unreadableResourceEntries as ao, unsupportedFinalSnapshotError as ar, createUnionSecretMasker as as, dropSettledNestedJournals as at, S3_AUTO_DELETE_OBJECTS_TAG as b, malformedRenderedContainersWarning as ba, buildAssetRedirectMap as bc, isIamRoleArn as bi, CFN_TEMPLATE_URL_LIMIT as bl, constructPathOf as bn, coerceWarmThroughput as bo, definedAttributes as br, snapshotPassProvenance as bs, loadJournaledOrphans as bt, DynamoDBGlobalTableProvider as c, malformedExportNamesWarning as ca, hasReasonlessBaselineRefusal as cc, s3BucketWebsiteUrl as ci, loadCdkJson as cl, carriedExportAliasExposure as cn, findSilentDropProperties as co, reserveStackCreateToken as cr, logOnlyValueCount as cs, recordDisplacedSkips as ct, compensateRemovedDeletionProtection as d, malformedLocalResourceEntriesWarning as da, importableOutputs as dc, refuseUnreadableCdkCrossAccountRefs as di, resolveCaptureObservedState as dl, isWholeDynamicReferenceValue as dn, NO_CC_HANDLERS_REASON as do, isRefusedByName as dr, recordLogOnlyValue as ds, withNestedRevertRun as dt, deployRefusesOrphanRowsReason as ea, crossPrefixDeniedWarning as ec, INTRINSIC_KEYS as ei, stripControlChars as el, reachableDivergentParameters as en, repairMalformedResourceEntriesForReadOnly as eo, ccRoutedFinalSnapshotError as er, readsNoEchoSource as es, keptForReadoption as et, deleteBudgetKey as f, malformedLocalResourcesWarning as fa, isReadableBag as fc, keepHeldTokenProvenance as fi, resolveSkipPrefix as fl, noEchoParameterValueSeed as fn, hasNoCloudControlHandlers as fo, markDeleteStarted as fr, shareLogOnlyValues as fs, collectNestedChildUnaddressed as ft, INDEX_SETTLE_POLL_INTERVAL_MS as g, malformedOrphansRefusalMessage as ga, AssetPublisher as gc, applyRoleArnIfSet as gi, stateBucketExistenceConfirmed as gl, bindingSkippedOutputs as gn, isStatefulRecreateTargetForReplace as go, readTagList as gr, maskSecretsInError as gs, dropFailedCommands as gt, DELETE_INDEX_WAIT_PROCEED_NOTE as h, malformedOrphanRowsKeptWarning as ha, shouldRetainResource as hc, recordedReferenceRegions as hi, resolveUseCdkBootstrapAssets as hl, isExportAliasCollision as hn, MULTI_REGION_RECREATE_BLOCKED_TYPES as ho, planTagDiff as hr, errorCauseChain as hs, deleteJournaledOrphans as ht, PROTECTION_PROPERTY_BY_TYPE as i, hasReadableResources as ia, acceptedCreateOnlyDropsOf as ic, s3BucketArn as ii, Synthesizer as il, exportAliasCollisionScrubWarning as in, unreadableOrphanRecords as io, refusesFinalSnapshot as ir, carryLogOnlyValues as is, displacedPhysicalIdShown as it, serviceTokenBlockingReason as j, refuseMalformedOrphans as ja, readBootstrapMarkerBody as jc, isUnboundTemplateParameter as ji, StageLoadError as jl, green as jn, requireConfigArray as jo, getCurrentResourceSecrets as jr, recordNestedStackParameterExpressions as js, recordAfterRollbackUpdate as jt, deferredServiceTokenWarning as k, refuseMalformedOrphanRecords as ka, isCrossRegionRedirect as kc, regionLessSecretName as ki, derivePartitionAndUrlSuffix as kl, cyan as kn, readConfigString as ko, readsNoEchoDeleteValues as kr, identityKeyFor as ks, replayRollback as kt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, malformedExportSourceWarning as la, hasUnverifiableParameterRefusal as lc, resolveDynamicReferences as li, resolveApp as ll, exportNameNoEchoParameters as ln, unwrittenCreateOnlyReplacement as lo, withCreateTokenLedger as lr, printingCorpusOf as ls, revertNestedChildFromJournal as lt, resolveDynamoDbDeleteBudgetMs as m, malformedOrphanRecordsWarning as ma, orphansCarriedFrom as mc, recordedOutputReferenceRegions as mi, resolveStateBucketWithDefaultAndSource as ml, collectPublishedOutputNames as mn, shownType as mo, DBPROXY_TAG_OPTIONS as mr, createSecretMasker as ms, withNestedStackContext as mt, recordedProtectionEvidence as n, hasReadableOrphans as na, isNotImplemented as nc, poisonRenderedSpellingsCollidingIn as ni, AssetManifestLoader as nl, WITHHELD_NAME_DISPLAY as nn, repairMalformedResourcesForReadOnly as no, effectiveDeletionPolicy as nr, valueAtCoordinate as ns, NESTED_PENDING_PARENT_REASON as nt, perType as o, isReadableResourceEntry as oa, exportNamesCarriedFrom as oc, s3BucketDualStackDomainName as oi, getDefaultStateBucketName as ol, secretBearingStateKeyWarning as on, withheldAccountClause as oo, earliestDefined as or, hasMaskableValues as os, getNestedRevertRun as ot, resolveDynamoDbDeleteBudgetClock as p, malformedOrphanRecordsRefusalMessage as pa, orphansAfterRollback as pc, outputReferenceProvenanceOf as pi, resolveStateBucketWithDefault as pl, collectDeclaredOutputNames as pn, findReplacedReadersOfRecreateTargets as po, DBPROXY_TAGS_WHAT as pr, unionOfSecretBags as ps, getCurrentNestedStackContext as pt, makeCanonicalizePropertiesFn as q, refuseMalformedResourcesForDeploy as qa, redactDockerArgvValues as qc, declaresNoEcho as qi, secretNamedRecordNeedles as qn, maskWholeValue as qo, disableInstanceApiTermination as qr, LockManager as qs, isRedactedRecordedValue as qt, recordedProtectionNote as r, hasReadableOutputs as ra, splitImportedOps as rc, isSettledInstanceState as ri, getDockerImageBySourceHash as rl, displayTextOrWithheld as rn, unpreviewableOrphanRecords as ro, isFinalSnapshotError as rr, liveMatchesUnresolvedTokenFrame as rs, displacedOpClause as rt, readProtection as s, malformedDriftResourcePropertiesWarning as sa, hasReadableExportSet as sc, s3BucketRegionalDomainName as si, getLegacyStateBucketName as sl, secretSafeKeyDisplay as sn, findActionableSilentDrops as so, ledgerForStack as sr, literalSplitDelimitersOf as ss, nestedChildStackName as st, DeployEngine as t, displayLogicalId as ta, isAccessDenied$1 as tc, IntrinsicFunctionResolver as ti, stripForDisplay as tl, resourcesNamingDeclaredParameter as tn, repairMalformedResourcePropertiesForReadOnly as to, createPreDeleteFinalSnapshot as tr, recordedNoEchoValuesOf as ts, recordRetainedForReadoption as tt, beginDeleteWait as u, malformedLocalOutputsWarning as ua, importableOutputKeys as uc, producerLookupOver as ui, resolveAutoAssetStorage as ul, exportNameSecretExposure as un, withoutSilentDropProperties as uo, acquireIdempotencyToken as ur, recordLogOnlyParameterValue as us, revertedNestedRowIds as ut, waitForIndexesSettled as v, malformedOutputsRefusalMessage as va, stringifyValue as vc, assertSendableRoleArn as vi, ssmResolvedValueType as vl, DEFAULT_RESOURCE_WARN_AFTER_MS as vn, renderStatefulReason as vo, tagMapAsList as vr, markSameGenerationBag as vs, isHandledOrphan as vt, markRefusedBeforeApplying as w, malformedScrubResourceEntriesRefusalMessage as wa, AssetModeResolver as wc, callerEnvCredentials as wi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as wl, destroyStackRecordsView as wn, coerceCfnBoolean as wo, ccBrokenReason as wr, withoutPhysicalNameCopies as ws, chunks as wt, hasCdkAutoDeleteTag as x, malformedResourceEntriesWarning as xa, createAssetRedirectResolver as xc, sendableAssumeRoleCommand as xi, MIGRATE_TMP_PREFIX as xl, findDestructiveChanges as xn, isWarmThroughputDecrease as xo, stringifyIfAssigned as xr, redactForState as xs, makeForeignHolderScan as xt, ECR_AUTO_DELETE_IMAGES_TAG as y, malformedOutputsWarning as ya, WorkGraph as yc, explicitRoleArnOrThrow as yi, CFN_TEMPLATE_BODY_LIMIT as yl, maskingRetryLogger as yn, WARM_THROUGHPUT_MEMBERS as yo, tagPlanWarning as yr, recordReferenceProvenanceEntry as ys, journaledOrphanLines as yt, conditionInputsFrom as z, refuseMalformedResourceEntriesForDestroy as za, describeDockerFailure as zc, AWS_NO_VALUE as zi, describeFileReadFailure as zl, completedReplayEntries as zn, lambdaFunctionNameForMask as zo, RollbackInlinePolicyWriters as zr, recordMaskOnlyValue as zs, replacementNeverSwapped as zt };
+//# sourceMappingURL=deploy-engine-zLKsm0IM.js.map