@go-to-k/cdkd 0.301.5 → 0.301.7

package/dist/{program-DmPDfDhE.js → program-CiTz5-_D.js}

@@ -1,9 +1,9 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-B_CEQGE1.js";
 import { A as UNRENDERABLE, B as safeMsg, D as SAFE_MSG_ALTERED_CHAR, F as displaySafe, H as terminalSafe, I as displayStackName, L as isPasteableIdent, M as cutMarker, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, T as withStackName, U as truncateCodePoints, V as stringifyJsonPayload, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $t as ambientCredentialConfig, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, D as VALUE_NOT_SHOWN, Dn as normalizeAwsError, E as assertRegionMatch, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gt as DEFAULT_STATE_PREFIX, Hn as withheldTargetClause, In as pasteableCommand, It as buildForceUnlockCommand, Jt as producerCoordinateKey, Kt as injectiveKey, Lt as buildLockContentionMessage, Nn as commandHole, On as withErrorHandling, P as remedyLogicalId, Qt as ambientClientDefaults, Rn as plainOrDescribed, Rt as forceQuitRecoveryClause, Sn as StackTerminationProtectionError, T as RESOURCE_NOT_FOUND, Un as setPasteableRunFlags, Vn as shellQuote, Vt as formatLockOwner, Wn as setPasteableVerbFlags, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as setPasteableAwsProfile, Yt as producerRecordKey, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _n as PartialFailureError, ar as isRetryableTransientError, bn as ResourceUpdateNotSupportedError, cn as DeployCancelledError, dn as LocalInvokeBuildError$1, dr as markNonRetryable, en as clientDefaultsFor, fn as LocalStartServiceError, ft as logicalIdShown, gn as NestedStackChildDirectDestroyError, hn as MalformedProducerRecordRefusalError, in as CdkdError, it as isInterruptedWaitError, jn as SHELL_ACTIVE_WHY, kn as TIMEOUT_FLAG_RESOURCE_TYPE, ln as DynamicReferenceRegionAmbiguousError, lr as isMarkedNonRetryable, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, nt as endCommandInterruptScope, on as CrossAccountSecretRefusalError, or as isTransientServerError, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sr as retryClassificationText, t as IAM_PRINCIPAL_NAME, tn as credentialFingerprint, tt as beginCommandInterruptScope, un as IntrinsicResolutionRefusalError, ur as isThrottlingError, vn as ProvisioningError, wn as SynthesisError, xn as StackHasActiveImportsError, yn as ResourceTimeoutError, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-BkeM7IXi.js";
+import { $t as ambientCredentialConfig, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, D as VALUE_NOT_SHOWN, Dn as normalizeAwsError, E as assertRegionMatch, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gt as DEFAULT_STATE_PREFIX, Hn as withheldTargetClause, In as pasteableCommand, It as buildForceUnlockCommand, Jt as producerCoordinateKey, Kt as injectiveKey, Lt as buildLockContentionMessage, Nn as commandHole, On as withErrorHandling, P as remedyLogicalId, Qt as ambientClientDefaults, Rn as plainOrDescribed, Rt as forceQuitRecoveryClause, Sn as StackTerminationProtectionError, T as RESOURCE_NOT_FOUND, Un as setPasteableRunFlags, Vn as shellQuote, Vt as formatLockOwner, Wn as setPasteableVerbFlags, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as setPasteableAwsProfile, Yt as producerRecordKey, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _n as PartialFailureError, bn as ResourceUpdateNotSupportedError, cn as DeployCancelledError, cr as retryClassificationText, dn as LocalInvokeBuildError$1, dr as isThrottlingError, en as clientDefaultsFor, fn as LocalStartServiceError, fr as markNonRetryable, ft as logicalIdShown, gn as NestedStackChildDirectDestroyError, hn as MalformedProducerRecordRefusalError, in as CdkdError, it as isInterruptedWaitError, jn as SHELL_ACTIVE_WHY, kn as TIMEOUT_FLAG_RESOURCE_TYPE, ln as DynamicReferenceRegionAmbiguousError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as AccountIdUnavailableError, nt as endCommandInterruptScope, on as CrossAccountSecretRefusalError, or as isRetryableTransientError, rr as isAmbiguousOutcomeError, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sr as isTransientServerError, t as IAM_PRINCIPAL_NAME, tn as credentialFingerprint, tt as beginCommandInterruptScope, un as IntrinsicResolutionRefusalError, ur as isMarkedNonRetryable, vn as ProvisioningError, wn as SynthesisError, xn as StackHasActiveImportsError, yn as ResourceTimeoutError, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-LyArt3ew.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-DBXBcg0J.js";
-import { $ as resolvePendingCloudControlRequests, $a as repairMalformedOutputsForReadOnly, $c as redactedDockerCause, $i as accountArgs, $n as buildFinalSnapshotIdentifier, $o as readbackPathFor, $r as DiffCalculator, $s as S3StateBackend, $t as namesAnyDeclaredParameter, A as findServiceTokenRefusals, Aa as refuseMalformedOrphanRecordsForDestroy, Ac as assertAssetBucketRegion, Ai as coerceParameterTypedValue, Al as expectedOwnerParam, An as gray, Ar as isCustomResourceType$1, As as inheritNestedStackParameterAssociations, At as removeProtectionTypeList, B as parentSuppliedValues, Ba as refuseMalformedResourceEntriesForImport, Bc as resolveDockerContextDirectory, Bi as cfnRefValueFromPhysicalId, Bl as nullPrototypeRecord, Bn as journaledOrphanPrintingBag, Br as UNSPECIFIED_SKIP_REASON, Bs as recordMaskOnlyValuesIn, Bt as resolveReplacementOldType, Ca as malformedResourcesWarning, Cc as WorkGraph, Ci as applyCallerIdentityCredentials, Cl as CFN_TEMPLATE_BODY_LIMIT, Cr as ProviderRegistry, Cs as withPhysicalNameCopies, Ct as formatResourceLine, D as crossStackOutputProvenanceSource, Da as refuseDivergentRecordRegionForDestroy, Dc as rewriteTemplateAssetReferences, Di as classifyReplaySecretRegion, Dl as uploadCfnTemplate, Ds as isUncertifiedBaselineMaskPosition, E as computeImplicitDeleteEdges, Ea as previewableOrphanRecords, Ec as loadPublishableAssetManifest, Ei as classifyRecordedSecretRegion, El as findLargeInlineResources, En as withStackRecords, Er as wouldReturnToSdkProvider, Es as dynamicReferenceTokens, F as listNestedTemplateRows, Fa as refuseMalformedOutputsForDestroy, Fc as readBootstrapMarkerBody, Fi as carriesDynamicReference, Fl as StageLoadError, Fn as noEchoComparisonForTemplate, Fo as templateResourceTypes, Fr as customResourceResponseExpirationWarning, Fs as recordPhysicalNameCopy, Ft as planFailedOps, G as keptWholeReasonText, Ga as refuseMalformedResourcePropertiesForExport, Gc as finchSecretArgvRefusal, Gi as parameterInputsFor, Gl as renderAssemblyPathEscape, Gn as secretNamePrintingBags, Go as maskAtCoordinates, Gr as isWaitAbandonedError, Gs as STATE_SOURCED_BASELINE_RULES, Gt as inheritProducerRegions, H as withResourceDeadline, Ha as refuseMalformedResourceEntriesForOrphan, Hc as describeDockerExecFailure, Hi as refStateLookupFromResource, Hl as absoluteAssemblyPathEscape, Hn as namingSecretsWithRecordedNoEcho, Ho as TemplateParser, Hr as deleteLeftInPlace, Hs as recordNoEchoParameterFreshValue, Ht as orphanNeedsIdentity, I as renderNestedTemplateTreeDefect, Ia as refuseMalformedResourceAttributesForOrphan, Ic as validateAssetBucketName, Ii as carriesFetchableDynamicReference, Il as processStackMessages, In as noEchoExactEchoLeavesOf, Io as describeTypeWithThrottleRetry, Ir as CloudControlProvider, Is as splitGetAttStringForm, It as planRollback, J as makeSiblingClaimReader, Ja as refuseMalformedResourcesForDestroy, Jc as isDockerClientEnvKey, Ji as JSON_LISTING_HOLE_VALUE, Jl as injectedAwsRegionValue, Jn as stateSecretNameNeedles, Jo as maskedLeafCoordinatesOf, Js as TEMPLATE_SOURCED_RULES, K as mergeNoChangeOutputs, Ka as refuseMalformedResourcePropertiesForOrphan, Kc as formatDockerLoginError, Kl as resolveAssemblyPath, Ko as maskReadbackAtCoordinates, Ks as STATE_SOURCED_CROSS_GENERATION_RULES, L as templateIdentity, La as refuseMalformedResourceEntries, Lc as validateContainerRepoName, Li as isNamelessDynamicReferenceError, Ll as defineOwnKey, Ln as noEchoParameterNamesOf, Lo as withRetry, Lr as slowCcOperationTimeoutMs, Ls as carriesSecretMask, Lt as recheckFailedPlan, M as childTemplateLoader, Ma as refuseMalformedOrphansForDestroy, Mc as getBootstrapMarkerKey, Mi as parameterTypeMayLoseSecretIdentity, Ml as canonicalizeRegion, Mn as red, Mr as withPrintingSecrets, Mt as demoteSupersededOrphans, N as findNestedTemplateTreeDefect, Na as refuseMalformedOrphansForOrphan, Nc as isCrossRegionRedirect, Ni as getAccountInfo, Nl as derivePartitionAndUrlSuffix, Nn as yellow, Nr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ns as physicalNameCopiesOf, Nt as isJournaledOrphan, O as inheritedProvenanceForChildDiff, Oc as AssetModeResolver, Oi as producerRegionsFromState, Ol as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, On as bold, Or as TemplateNoEchoReresolver, Os as pathCrossesDottedKey, Ot as replayFailedOperations, P as isAbsoluteAssetPath, Pa as refuseMalformedOutputs, Pc as parseBootstrapMarker, Pi as isImpossibleEmptyStoredAttribute, Pl as AssemblyReader, Pn as noEchoAttributeNamesOf, Po as prefetchCreateOnlyPropertyPaths, Pr as applyCustomResourceResponseExpiration, Pt as isReplacementOrphan, Q as pendingRequestCount, Qa as repairMalformedOrphansForReadOnly, Qc as redactedCause, Qi as UNREADABLE_RESOURCES_MAP_ROW, Qn as PRE_DELETE_SNAPSHOT_TYPES, Qs as isLockInfoExpired, Qt as computeParameterTaint, R as conditionFingerprint, Ra as refuseMalformedResourceEntriesForDeploy, Rc as buildDenyExternalAccessPolicy, Ri as keepsSecretReferenceToken, Rl as hasOwnKey, Rn as createReadOnlyAttributeHealerFactory, Rs as provenPublicValue, Rt as recordUnderIdIsNotOwn, Sa as malformedResourcePropertiesWarning, Sc as stringifyValue, Si as AWS_CREDENTIAL_ENV_KEYS, Sl as ssmResolvedValueType, Sn as formatDestructiveChange, Sr as CC_BROKEN_REASON, Ss as scrubResourceRecord, St as sameJournaledOrphans, T as IMPLICIT_DELETE_DEPENDENCIES, Ta as malformedStateRefusalMessage, Tc as createAssetRedirectResolver, Ti as envCredentialsAreAssumedRole, Tl as MIGRATE_TMP_PREFIX, Tr as isCustomResource, Ts as DYNAMIC_REFERENCE_TOKEN_SCAN, U as diffSecurity, Ua as refuseMalformedResourcePropertiesForDestroy, Uc as describeDockerFailure, Ul as describeFileReadFailure, Un as orphanRecordsPrintingBag, Uo as canonicalCoordinates, Ur as deleteSkipReason, Us as recordProvenPublicExpression, Ut as findNestedStackTypeChanges, V as readRecordedConditionVerdicts, Va as refuseMalformedResourceEntriesForImportSave, Vc as describeDockerCapturedOutput, Vi as isStalePlaceholderArnAttribute, Vl as ownValue, Vn as maskEventTextWithBoundBags, Vo as DagBuilder, Vr as deleteIndeterminateGuards, Vs as recordNoEchoAttributeValues, Vt as seedsDeleteFirstGuard, W as isSecretBearingReferenceString, Wa as refuseMalformedResourcePropertiesForDrift, Wc as dockerSpawnEnvWithSensitive, Wi as withSharedDrainBudget, Wl as displayAssemblyPath, Wn as secretNamePrintingBag, Wo as isMarkedCoordinate, Ws as wholeStringLeavesOf, X as DeploymentEventsReader, Xa as refuseMalformedState, Xc as partitionSensitiveEnv, Xi as STATE_RESOURCES_MALFORMED, Xl as resolveBucketRegion, Xn as extractDeploymentEventError, Xo as noEchoLeavesOf, Xs as isSingleDynamicReferenceToken, Xt as updatePartialMessage, Y as planOrphanAdoption, Ya as refuseMalformedResourcesForExport, Yc as isMalformedEnvKey, Yi as STATE_REGION_DIVERGED, Yn as storedSecretNameNeedles, Yo as noEchoCoordinatesOf, Ys as WHOLE_DYNAMIC_REFERENCE_PATTERN, Z as DeploymentEventsStore, Za as repairMalformedOrphanRecordsForReadOnly, Zc as redactDockerArgvValues, Zi as UNREADABLE_ORPHANS_CONTAINER_ROW, Zn as ATOMIC_FINAL_SNAPSHOT_TYPES, Zo as noEchoOutputsComparison, Zs as LockManager, Zt as updatePartialReason, _a as malformedOrphansWarning, _c as orphansAfterRollback, _i as assertFlagRoleArn, _l as resolveStateBucketWithDefault, _n as DEFAULT_RESOURCE_TIMEOUT_MS, _o as isStatefulRecreateTargetSync, _s as maskSecretsInText, _t as dropFailedHint, a as isProtectionValueActive, aa as isReadableOrphanRecord, ac as isAccessDenied, al as stripForDisplay, an as secretBearing, ao as unreadableResourceEntries, ar as unsupportedFinalSnapshotError, as as createUnionSecretMasker, at as dropSettledNestedJournals, ba as malformedRenderedContainersWarning, bc as AssetPublisher, bi as isIamRoleArn, bl as stateBucketExistenceConfirmed, bn as constructPathOf, bt as loadJournaledOrphans, ca as malformedExportNamesWarning, cc as acceptedCreateOnlyDropsOf, cl as Synthesizer, cn as carriedExportAliasExposure, cs as logOnlyValueCount, ct as recordDisplacedSkips, da as malformedLocalResourceEntriesWarning, dc as hasReadableExportSet, di as refuseUnreadableCdkCrossAccountRefs, dl as getLegacyStateBucketName, dn as isWholeDynamicReferenceValue, do as NO_CC_HANDLERS_REASON, ds as recordLogOnlyValue, dt as withNestedRevertRun, ea as deployRefusesOrphanRowsReason, ec as rebuildClientForBucketRegion, ei as INTRINSIC_KEYS, el as runDockerForeground, en as reachableDivergentParameters, eo as repairMalformedResourceEntriesForReadOnly, er as ccRoutedFinalSnapshotError, es as readsNoEchoSource, et as keptForReadoption, fa as malformedLocalResourcesWarning, fc as hasReasonlessBaselineRefusal, fi as keepHeldTokenProvenance, fl as loadCdkJson, fn as noEchoParameterValueSeed, fo as hasNoCloudControlHandlers, fs as shareLogOnlyValues, ft as collectNestedChildUnaddressed, ga as malformedOrphansRefusalMessage, gc as isReadableBag, gi as applyRoleArnIfSet, gl as resolveSkipPrefix, gn as bindingSkippedOutputs, go as isStatefulRecreateTargetForReplace, gs as maskSecretsInError, gt as dropFailedCommands, ha as malformedOrphanRowsKeptWarning, hc as importableOutputs, hi as recordedReferenceRegions, hl as resolveCaptureObservedState, hn as isExportAliasCollision, ho as MULTI_REGION_RECREATE_BLOCKED_TYPES, hs as errorCauseChain, ht as deleteJournaledOrphans, i as PROTECTION_PROPERTY_BY_TYPE, ia as hasReadableResources, ic as crossPrefixDeniedWarning, il as stripControlChars, in as exportAliasCollisionScrubWarning, io as unreadableOrphanRecords, ir as refusesFinalSnapshot, is as carryLogOnlyValues, it as displacedPhysicalIdShown, j as serviceTokenBlockingReason, ja as refuseMalformedOrphans, jc as ensureAssetStorage, ji as isUnboundTemplateParameter, jl as PARTITION_TABLE, jn as green, js as recordNestedStackParameterExpressions, jt as recordAfterRollbackUpdate, k as deferredServiceTokenWarning, ka as refuseMalformedOrphanRecords, kc as BOOTSTRAP_MARKER_PREFIX, ki as regionLessSecretName, kl as decodeListingKey, kn as cyan, kr as readsNoEchoDeleteValues, ks as identityKeyFor, kt as replayRollback, la as malformedExportSourceWarning, lc as describeRegionValueKind, li as resolveDynamicReferences, ll as synthesisStatusMessage, ln as exportNameNoEchoParameters, lo as unwrittenCreateOnlyReplacement, lr as withCreateTokenLedger, ls as printingCorpusOf, ma as malformedOrphanRecordsWarning, mc as importableOutputKeys, mi as recordedOutputReferenceRegions, ml as resolveAutoAssetStorage, mn as collectPublishedOutputNames, mo as shownType, ms as createSecretMasker, mt as withNestedStackContext, n as recordedProtectionEvidence, na as hasReadableOrphans, nc as CrossPrefixScanCache, ni as poisonRenderedSpellingsCollidingIn, nl as warnFinchArgvExposure, nn as WITHHELD_NAME_DISPLAY, no as repairMalformedResourcesForReadOnly, nr as effectiveDeletionPolicy, ns as valueAtCoordinate, nt as NESTED_PENDING_PARENT_REASON, o as perType, oa as isReadableResourceEntry, oc as isNotImplemented, ol as AssetManifestLoader, on as secretBearingStateKeyWarning, oo as withheldAccountClause, os as hasMaskableValues, pa as malformedOrphanRecordsRefusalMessage, pc as hasUnverifiableParameterRefusal, pl as resolveApp, pn as collectDeclaredOutputNames, po as findReplacedReadersOfRecreateTargets, ps as unionOfSecretBags, pt as getCurrentNestedStackContext, q as makeCanonicalizePropertiesFn, qa as refuseMalformedResourcesForDeploy, qc as getDockerCmd, qi as declaresNoEcho, ql as injectAwsRegion, qn as secretNamedRecordNeedles, qo as maskWholeValue, qs as STATE_SOURCED_READBACK_RULES, r as recordedProtectionNote, ra as hasReadableOutputs, rc as applyCrossPrefixScan, rl as escapeRegExp, rn as displayTextOrWithheld, ro as unpreviewableOrphanRecords, rr as isFinalSnapshotError, rs as liveMatchesUnresolvedTokenFrame, rt as displacedOpClause, s as readProtection, sa as malformedDriftResourcePropertiesWarning, sc as splitImportedOps, sl as getDockerImageBySourceHash, sn as secretSafeKeyDisplay, so as findActionableSilentDrops, sr as ledgerForStack, ss as literalSplitDelimitersOf, st as nestedChildStackName$1, t as DeployEngine, ta as displayLogicalId, tc as CrossPrefixReadError, ti as IntrinsicFunctionResolver, tl as runDockerStreaming, tn as resourcesNamingDeclaredParameter, to as repairMalformedResourcePropertiesForReadOnly, tr as createPreDeleteFinalSnapshot, ts as recordedNoEchoValuesOf, tt as recordRetainedForReadoption, ua as malformedLocalOutputsWarning, uc as exportNamesCarriedFrom, ui as producerLookupOver, ul as getDefaultStateBucketName, un as exportNameSecretExposure, us as recordLogOnlyParameterValue, ut as revertedNestedRowIds, va as malformedOutputsRefusalMessage, vc as orphansCarriedFrom, vi as assertSendableRoleArn, vl as resolveStateBucketWithDefaultAndSource, vn as DEFAULT_RESOURCE_WARN_AFTER_MS, vo as renderStatefulReason, vs as markSameGenerationBag, vt as isHandledOrphan, wa as malformedScrubResourceEntriesRefusalMessage, wc as buildAssetRedirectMap, wi as callerEnvCredentials, wl as CFN_TEMPLATE_URL_LIMIT, wn as destroyStackRecordsView, wr as ccBrokenReason, xa as malformedResourceEntriesWarning, xc as isSensitiveAttributeName, xi as sendableAssumeRoleCommand, xl as warnDeprecatedNoPrefixCliFlag, xn as findDestructiveChanges, xs as redactSecretsForState, xt as makeForeignHolderScan, ya as malformedOutputsWarning, yc as shouldRetainResource, yi as explicitRoleArnOrThrow, yl as resolveUseCdkBootstrapAssets, yn as maskingRetryLogger, yt as journaledOrphanLines, z as conditionInputsFrom, za as refuseMalformedResourceEntriesForDestroy, zc as buildDockerImage, zi as AWS_NO_VALUE, zl as hasPlainPrototype, zn as completedReplayEntries, zr as RollbackInlinePolicyWriters, zs as recordMaskOnlyValue, zt as replacementNeverSwapped } from "./deploy-engine-HAvm8vSI.js";
-import { t as getCdkdVersion } from "./version-2jeKJQlt.js";
+import { $ as resolvePendingCloudControlRequests, $a as repairMalformedOutputsForReadOnly, $c as escapeRegExp, $i as accountArgs, $n as buildFinalSnapshotIdentifier, $o as readbackPathFor, $r as DiffCalculator, $s as applyCrossPrefixScan, $t as namesAnyDeclaredParameter, A as findServiceTokenRefusals, Aa as refuseMalformedOrphanRecordsForDestroy, Ac as parseBootstrapMarker, Ai as coerceParameterTypedValue, Al as AssemblyReader, An as gray, Ar as isCustomResourceType$1, As as inheritNestedStackParameterAssociations, At as removeProtectionTypeList, B as parentSuppliedValues, Ba as refuseMalformedResourceEntriesForImport, Bc as dockerSpawnEnvWithSensitive, Bi as cfnRefValueFromPhysicalId, Bl as displayAssemblyPath, Bn as journaledOrphanPrintingBag, Br as UNSPECIFIED_SKIP_REASON, Bs as recordMaskOnlyValuesIn, Bt as resolveReplacementOldType, Ca as malformedResourcesWarning, Cc as rewriteTemplateAssetReferences, Ci as applyCallerIdentityCredentials, Cl as uploadCfnTemplate, Cr as ProviderRegistry, Cs as withPhysicalNameCopies, Ct as formatResourceLine, D as crossStackOutputProvenanceSource, Da as refuseDivergentRecordRegionForDestroy, Dc as ensureAssetStorage, Di as classifyReplaySecretRegion, Dl as PARTITION_TABLE, Ds as isUncertifiedBaselineMaskPosition, E as computeImplicitDeleteEdges, Ea as previewableOrphanRecords, Ec as assertAssetBucketRegion, Ei as classifyRecordedSecretRegion, El as expectedOwnerParam, En as withStackRecords, Er as wouldReturnToSdkProvider, Es as dynamicReferenceTokens, F as listNestedTemplateRows, Fa as refuseMalformedOutputsForDestroy, Fc as buildDockerImage, Fi as carriesDynamicReference, Fl as hasPlainPrototype, Fn as noEchoComparisonForTemplate, Fo as templateResourceTypes, Fr as customResourceResponseExpirationWarning, Fs as recordPhysicalNameCopy, Ft as planFailedOps, G as keptWholeReasonText, Ga as refuseMalformedResourcePropertiesForExport, Gc as isMalformedEnvKey, Gi as parameterInputsFor, Gn as secretNamePrintingBags, Go as maskAtCoordinates, Gr as isWaitAbandonedError, Gs as WHOLE_DYNAMIC_REFERENCE_PATTERN, Gt as inheritProducerRegions, H as withResourceDeadline, Ha as refuseMalformedResourceEntriesForOrphan, Hc as formatDockerLoginError, Hi as refStateLookupFromResource, Hl as resolveAssemblyPath, Hn as namingSecretsWithRecordedNoEcho, Ho as TemplateParser, Hr as deleteLeftInPlace, Hs as recordNoEchoParameterFreshValue, Ht as orphanNeedsIdentity, I as renderNestedTemplateTreeDefect, Ia as refuseMalformedResourceAttributesForOrphan, Ic as resolveDockerContextDirectory, Ii as carriesFetchableDynamicReference, Il as nullPrototypeRecord, In as noEchoExactEchoLeavesOf, Io as describeTypeWithThrottleRetry, Ir as CloudControlProvider, Is as splitGetAttStringForm, It as planRollback, J as makeSiblingClaimReader, Ja as refuseMalformedResourcesForDestroy, Jc as redactedCause, Ji as JSON_LISTING_HOLE_VALUE, Jn as stateSecretNameNeedles, Jo as maskedLeafCoordinatesOf, Js as isLockInfoExpired, K as mergeNoChangeOutputs, Ka as refuseMalformedResourcePropertiesForOrphan, Kc as partitionSensitiveEnv, Kl as resolveBucketRegion, Ko as maskReadbackAtCoordinates, Ks as isSingleDynamicReferenceToken, L as templateIdentity, La as refuseMalformedResourceEntries, Lc as describeDockerCapturedOutput, Li as isNamelessDynamicReferenceError, Ll as ownValue, Ln as noEchoParameterNamesOf, Lo as withRetry, Lr as slowCcOperationTimeoutMs, Ls as carriesSecretMask, Lt as recheckFailedPlan, M as childTemplateLoader, Ma as refuseMalformedOrphansForDestroy, Mc as validateAssetBucketName, Mi as parameterTypeMayLoseSecretIdentity, Ml as processStackMessages, Mn as red, Mr as withPrintingSecrets, Mt as demoteSupersededOrphans, N as findNestedTemplateTreeDefect, Na as refuseMalformedOrphansForOrphan, Nc as validateContainerRepoName, Ni as getAccountInfo, Nl as defineOwnKey, Nn as yellow, Nr as CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID, Ns as physicalNameCopiesOf, Nt as isJournaledOrphan, O as inheritedProvenanceForChildDiff, Oc as getBootstrapMarkerKey, Oi as producerRegionsFromState, Ol as canonicalizeRegion, On as bold, Or as TemplateNoEchoReresolver, Os as pathCrossesDottedKey, Ot as replayFailedOperations, P as isAbsoluteAssetPath, Pa as refuseMalformedOutputs, Pc as buildDenyExternalAccessPolicy, Pi as isImpossibleEmptyStoredAttribute, Pl as hasOwnKey, Pn as noEchoAttributeNamesOf, Po as prefetchCreateOnlyPropertyPaths, Pr as applyCustomResourceResponseExpiration, Pt as isReplacementOrphan, Q as pendingRequestCount, Qa as repairMalformedOrphansForReadOnly, Qc as warnFinchArgvExposure, Qi as UNREADABLE_RESOURCES_MAP_ROW, Qn as PRE_DELETE_SNAPSHOT_TYPES, Qs as CrossPrefixScanCache, Qt as computeParameterTaint, R as conditionFingerprint, Ra as refuseMalformedResourceEntriesForDeploy, Rc as describeDockerExecFailure, Ri as keepsSecretReferenceToken, Rl as absoluteAssemblyPathEscape, Rn as createReadOnlyAttributeHealerFactory, Rs as provenPublicValue, Rt as recordUnderIdIsNotOwn, Sa as malformedResourcePropertiesWarning, Sc as loadPublishableAssetManifest, Si as AWS_CREDENTIAL_ENV_KEYS, Sl as findLargeInlineResources, Sn as formatDestructiveChange, Sr as CC_BROKEN_REASON, Ss as scrubResourceRecord, St as sameJournaledOrphans, T as IMPLICIT_DELETE_DEPENDENCIES, Ta as malformedStateRefusalMessage, Tc as BOOTSTRAP_MARKER_PREFIX, Ti as envCredentialsAreAssumedRole, Tl as decodeListingKey, Tr as isCustomResource, Ts as DYNAMIC_REFERENCE_TOKEN_SCAN, U as diffSecurity, Ua as refuseMalformedResourcePropertiesForDestroy, Uc as getDockerCmd, Ul as injectAwsRegion, Un as orphanRecordsPrintingBag, Uo as canonicalCoordinates, Ur as deleteSkipReason, Us as recordProvenPublicExpression, Ut as findNestedStackTypeChanges, V as readRecordedConditionVerdicts, Va as refuseMalformedResourceEntriesForImportSave, Vc as finchSecretArgvRefusal, Vi as isStalePlaceholderArnAttribute, Vl as renderAssemblyPathEscape, Vn as maskEventTextWithBoundBags, Vo as DagBuilder, Vr as deleteIndeterminateGuards, Vs as recordNoEchoAttributeValues, Vt as seedsDeleteFirstGuard, W as isSecretBearingReferenceString, Wa as refuseMalformedResourcePropertiesForDrift, Wc as isDockerClientEnvKey, Wi as withSharedDrainBudget, Wl as injectedAwsRegionValue, Wn as secretNamePrintingBag, Wo as isMarkedCoordinate, Ws as wholeStringLeavesOf, X as DeploymentEventsReader, Xa as refuseMalformedState, Xc as runDockerForeground, Xi as STATE_RESOURCES_MALFORMED, Xn as extractDeploymentEventError, Xo as noEchoLeavesOf, Xs as rebuildClientForBucketRegion, Xt as updatePartialMessage, Y as planOrphanAdoption, Ya as refuseMalformedResourcesForExport, Yc as redactedDockerCause, Yi as STATE_REGION_DIVERGED, Yn as storedSecretNameNeedles, Yo as noEchoCoordinatesOf, Ys as S3StateBackend, Z as DeploymentEventsStore, Za as repairMalformedOrphanRecordsForReadOnly, Zc as runDockerStreaming, Zi as UNREADABLE_ORPHANS_CONTAINER_ROW, Zn as ATOMIC_FINAL_SNAPSHOT_TYPES, Zo as noEchoOutputsComparison, Zs as CrossPrefixReadError, Zt as updatePartialReason, _a as malformedOrphansWarning, _c as isSensitiveAttributeName, _i as assertFlagRoleArn, _l as warnDeprecatedNoPrefixCliFlag, _n as DEFAULT_RESOURCE_TIMEOUT_MS, _o as isStatefulRecreateTargetSync, _s as maskSecretsInText, _t as dropFailedHint, a as isProtectionValueActive, aa as isReadableOrphanRecord, ac as describeRegionValueKind, al as synthesisStatusMessage, an as secretBearing, ao as unreadableResourceEntries, ar as unsupportedFinalSnapshotError, as as createUnionSecretMasker, at as dropSettledNestedJournals, ba as malformedRenderedContainersWarning, bc as buildAssetRedirectMap, bi as isIamRoleArn, bl as CFN_TEMPLATE_URL_LIMIT, bn as constructPathOf, bt as loadJournaledOrphans, ca as malformedExportNamesWarning, cc as hasReasonlessBaselineRefusal, cl as loadCdkJson, cn as carriedExportAliasExposure, cs as logOnlyValueCount, ct as recordDisplacedSkips, da as malformedLocalResourceEntriesWarning, dc as importableOutputs, di as refuseUnreadableCdkCrossAccountRefs, dl as resolveCaptureObservedState, dn as isWholeDynamicReferenceValue, do as NO_CC_HANDLERS_REASON, ds as recordLogOnlyValue, dt as withNestedRevertRun, ea as deployRefusesOrphanRowsReason, ec as crossPrefixDeniedWarning, ei as INTRINSIC_KEYS, el as stripControlChars, en as reachableDivergentParameters, eo as repairMalformedResourceEntriesForReadOnly, er as ccRoutedFinalSnapshotError, es as readsNoEchoSource, et as keptForReadoption, fa as malformedLocalResourcesWarning, fc as isReadableBag, fi as keepHeldTokenProvenance, fl as resolveSkipPrefix, fn as noEchoParameterValueSeed, fo as hasNoCloudControlHandlers, fs as shareLogOnlyValues, ft as collectNestedChildUnaddressed, ga as malformedOrphansRefusalMessage, gc as AssetPublisher, gi as applyRoleArnIfSet, gl as stateBucketExistenceConfirmed, gn as bindingSkippedOutputs, go as isStatefulRecreateTargetForReplace, gs as maskSecretsInError, gt as dropFailedCommands, ha as malformedOrphanRowsKeptWarning, hc as shouldRetainResource, hi as recordedReferenceRegions, hl as resolveUseCdkBootstrapAssets, hn as isExportAliasCollision, ho as MULTI_REGION_RECREATE_BLOCKED_TYPES, hs as errorCauseChain, ht as deleteJournaledOrphans, i as PROTECTION_PROPERTY_BY_TYPE, ia as hasReadableResources, ic as acceptedCreateOnlyDropsOf, il as Synthesizer, in as exportAliasCollisionScrubWarning, io as unreadableOrphanRecords, ir as refusesFinalSnapshot, is as carryLogOnlyValues, it as displacedPhysicalIdShown, j as serviceTokenBlockingReason, ja as refuseMalformedOrphans, jc as readBootstrapMarkerBody, ji as isUnboundTemplateParameter, jl as StageLoadError, jn as green, js as recordNestedStackParameterExpressions, jt as recordAfterRollbackUpdate, k as deferredServiceTokenWarning, ka as refuseMalformedOrphanRecords, kc as isCrossRegionRedirect, ki as regionLessSecretName, kl as derivePartitionAndUrlSuffix, kn as cyan, kr as readsNoEchoDeleteValues, ks as identityKeyFor, kt as replayRollback, la as malformedExportSourceWarning, lc as hasUnverifiableParameterRefusal, li as resolveDynamicReferences, ll as resolveApp, ln as exportNameNoEchoParameters, lo as unwrittenCreateOnlyReplacement, lr as withCreateTokenLedger, ls as printingCorpusOf, ma as malformedOrphanRecordsWarning, mc as orphansCarriedFrom, mi as recordedOutputReferenceRegions, ml as resolveStateBucketWithDefaultAndSource, mn as collectPublishedOutputNames, mo as shownType, ms as createSecretMasker, mt as withNestedStackContext, n as recordedProtectionEvidence, na as hasReadableOrphans, nc as isNotImplemented, ni as poisonRenderedSpellingsCollidingIn, nl as AssetManifestLoader, nn as WITHHELD_NAME_DISPLAY, no as repairMalformedResourcesForReadOnly, nr as effectiveDeletionPolicy, ns as valueAtCoordinate, nt as NESTED_PENDING_PARENT_REASON, o as perType, oa as isReadableResourceEntry, oc as exportNamesCarriedFrom, ol as getDefaultStateBucketName, on as secretBearingStateKeyWarning, oo as withheldAccountClause, os as hasMaskableValues, pa as malformedOrphanRecordsRefusalMessage, pc as orphansAfterRollback, pl as resolveStateBucketWithDefault, pn as collectDeclaredOutputNames, po as findReplacedReadersOfRecreateTargets, ps as unionOfSecretBags, pt as getCurrentNestedStackContext, q as makeCanonicalizePropertiesFn, qa as refuseMalformedResourcesForDeploy, qc as redactDockerArgvValues, qi as declaresNoEcho, qn as secretNamedRecordNeedles, qo as maskWholeValue, qs as LockManager, r as recordedProtectionNote, ra as hasReadableOutputs, rc as splitImportedOps, rl as getDockerImageBySourceHash, rn as displayTextOrWithheld, ro as unpreviewableOrphanRecords, rr as isFinalSnapshotError, rs as liveMatchesUnresolvedTokenFrame, rt as displacedOpClause, s as readProtection, sa as malformedDriftResourcePropertiesWarning, sc as hasReadableExportSet, sl as getLegacyStateBucketName, sn as secretSafeKeyDisplay, so as findActionableSilentDrops, sr as ledgerForStack, ss as literalSplitDelimitersOf, st as nestedChildStackName$1, t as DeployEngine, ta as displayLogicalId, tc as isAccessDenied, ti as IntrinsicFunctionResolver, tl as stripForDisplay, tn as resourcesNamingDeclaredParameter, to as repairMalformedResourcePropertiesForReadOnly, tr as createPreDeleteFinalSnapshot, ts as recordedNoEchoValuesOf, tt as recordRetainedForReadoption, ua as malformedLocalOutputsWarning, uc as importableOutputKeys, ui as producerLookupOver, ul as resolveAutoAssetStorage, un as exportNameSecretExposure, us as recordLogOnlyParameterValue, ut as revertedNestedRowIds, va as malformedOutputsRefusalMessage, vc as stringifyValue, vi as assertSendableRoleArn, vl as ssmResolvedValueType, vn as DEFAULT_RESOURCE_WARN_AFTER_MS, vo as renderStatefulReason, vt as isHandledOrphan, wa as malformedScrubResourceEntriesRefusalMessage, wc as AssetModeResolver, wi as callerEnvCredentials, wl as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, wn as destroyStackRecordsView, wr as ccBrokenReason, xa as malformedResourceEntriesWarning, xc as createAssetRedirectResolver, xi as sendableAssumeRoleCommand, xl as MIGRATE_TMP_PREFIX, xn as findDestructiveChanges, xs as redactForState, xt as makeForeignHolderScan, ya as malformedOutputsWarning, yc as WorkGraph, yi as explicitRoleArnOrThrow, yl as CFN_TEMPLATE_BODY_LIMIT, yn as maskingRetryLogger, yt as journaledOrphanLines, z as conditionInputsFrom, za as refuseMalformedResourceEntriesForDestroy, zc as describeDockerFailure, zi as AWS_NO_VALUE, zl as describeFileReadFailure, zn as completedReplayEntries, zr as RollbackInlinePolicyWriters, zs as recordMaskOnlyValue, zt as replacementNeverSwapped } from "./deploy-engine-zLKsm0IM.js";
+import { t as getCdkdVersion } from "./version-MUc6NbW0.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -2559,7 +2559,7 @@ function collectCrossStackRefs(node, onRef, unconditional) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-DPwEHVDJ.js");
+	providerClasses ??= import("./provider-classes-BWo7K01p.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -4982,7 +4982,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		if (Object.hasOwn(bound, name)) templateParameters[name] = bound[name];
 	} catch (error) {
 		unboundParameterNames.add(name);
-		logger.debug(`Diff parameter binding for stack ${displayStackName(stackName)} is partial: ${error instanceof Error ? error.message : String(error)}`);
+		logger.debug(`Diff parameter binding for stack ${displayStackName(stackName)} is partial: ${describeAwsFailure(error).detail}`);
 	}
 	mergedParameters = {
 		...parameters,
@@ -5064,7 +5064,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		effectiveTemplate = new TemplateParser().filterResourcesByCondition(template, conditions);
 		everyConditionKnown = unboundParameterNames.size === 0 && unknownConditions.size === 0;
 	} catch (error) {
-		logger.debug(`Diff condition evaluation for stack ${displayStackName(stackName)} skipped: ${error instanceof Error ? error.message : String(error)}`);
+		logger.debug(`Diff condition evaluation for stack ${displayStackName(stackName)} skipped: ${describeAwsFailure(error).detail}`);
 	}
 	if (mismatchedRecords.length > 0) logger.warn(safeMsg`Stack ${displayStackName(stackName)}: condition(s) ${mismatchedRecords.map((name) => displayIdent(name)).join(", ")} read a secret-fed parameter and changed since the last deploy, or one of their inputs did. This diff cannot tell which branch the next deploy takes, and shows each Fn::If on them as its FALSE branch.`);
 	const stillUnknown = [...unknownConditions].filter((name) => !Object.hasOwn(recordedVerdicts, name));
@@ -7031,7 +7031,10 @@ function redactUnaccountedOutputs(positioned, stored, accountedKeys, secrets) {
 	let repaired;
 	for (const [key, value] of Object.entries(stored)) {
 		if (accountedKeys.has(key)) continue;
-		const next = redactSecretsForState(value, secrets);
+		const next = redactForState(value, {
+			provenance: "value-scan",
+			secrets
+		});
 		if (JSON.stringify(next) === JSON.stringify(value)) continue;
 		repaired ??= { ...positioned };
 		repaired[key] = next;
@@ -8395,7 +8398,10 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		};
 		const holdsRecordedPlaintext = (value) => {
 			const needles = new Map([...allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets), ...outputSecrets]);
-			return JSON.stringify(redactSecretsForState(value, needles)) !== JSON.stringify(value);
+			return JSON.stringify(redactForState(value, {
+				provenance: "value-scan",
+				secrets: needles
+			})) !== JSON.stringify(value);
 		};
 		const noEchoPublicTokens = /* @__PURE__ */ new Set([region, stack.stackName]);
 		const totalSecrets = outputSecrets.size + [...perResourceSecrets.values()].reduce((n, m) => n + m.size, 0) + [...orphanSecrets.values()].reduce((n, m) => n + m.size, 0);
@@ -8430,12 +8436,23 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const ownSecrets = secrets ?? /* @__PURE__ */ new Map();
 			const positioned = templateProps ? {
 				...record,
-				properties: redactSecretsForState(record.properties, ownSecrets, templateProps, TEMPLATE_SOURCED_RULES)
+				properties: redactForState(record.properties, {
+					provenance: "template-sourced",
+					secrets: ownSecrets,
+					source: templateProps,
+					generation: "unproven"
+				})
 			} : record;
-			const scrubbed = secrets || templateProps ? scrubResourceRecord(positioned, ownSecrets, void 0, STATE_SOURCED_CROSS_GENERATION_RULES) : record;
+			const scrubbed = secrets || templateProps ? scrubResourceRecord(positioned, ownSecrets, void 0, "state-cross-generation", {
+				properties: "unproven",
+				observed: "unproven"
+			}) : record;
 			const plan = noEchoPlans.byLogicalId.get(logicalId);
 			const migrationNeedles = scrubMigrationNeedles(plan, noEchoPublicTokens);
-			const migrated = migrationNeedles === void 0 ? scrubbed : scrubResourceRecord(scrubbed, migrationNeedles, void 0, STATE_SOURCED_CROSS_GENERATION_RULES);
+			const migrated = migrationNeedles === void 0 ? scrubbed : scrubResourceRecord(scrubbed, migrationNeedles, void 0, "state-cross-generation", {
+				properties: "unproven",
+				observed: "unproven"
+			});
 			const written = keepHeldTokenProvenance(applyScrubNoEcho(migrated, record, plan));
 			if (JSON.stringify(written) !== JSON.stringify(record)) recordsChanged++;
 			newResources[logicalId] = written;
@@ -8445,7 +8462,10 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const needles = new Map(allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets));
 			for (const [plaintext, expression] of own ?? []) needles.set(plaintext, expression);
 			if (needles.size === 0) return record;
-			const scrubbed = keepHeldTokenProvenance(scrubResourceRecord(record.state, needles, void 0, STATE_SOURCED_CROSS_GENERATION_RULES));
+			const scrubbed = keepHeldTokenProvenance(scrubResourceRecord(record.state, needles, void 0, "state-cross-generation", {
+				properties: "unproven",
+				observed: "unproven"
+			}));
 			if (JSON.stringify(scrubbed) === JSON.stringify(record.state)) return record;
 			recordsChanged++;
 			return {
@@ -8454,7 +8474,10 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			};
 		});
 		const crossStackNeedles = allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets);
-		const redactCrossStackName = (name) => redactSecretsForState(name, crossStackNeedles);
+		const redactCrossStackName = (name) => redactForState(name, {
+			provenance: "value-scan",
+			secrets: crossStackNeedles
+		});
 		const newImports = state.imports?.map((entry) => {
 			const exportName = redactCrossStackName(entry.exportName);
 			if (exportName === entry.exportName) return entry;
@@ -8483,7 +8506,15 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const producer = list === "imports" ? `producer ${displayStackName(maskSecretsInText(entry.sourceStack, crossStackNeedles))}, ` : "";
 			logger.warn(safeMsg`Scrub of ${shownStack}: state.${list}[${index}] (${producer}${displayIdent(String(entry.sourceRegion))}) ` + "holds a cross-stack read name in plaintext that has the shape of a secret-bearing read in today's template but not the secret's current value — most likely a value from before the secret was ROTATED. Scrub cannot repair it (it matches only the current value) and does not print it; treat that earlier value as exposed. A deploy " + safeMsg`that updates ${shownStack} rewrites this list from the reads it performs.`);
 		}
-		const noEchoMaskedOutputs = maskScrubNoEchoOutputs(redactUnaccountedOutputs(outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsSourceUntrusted ? void 0 : outputsTemplateSource, TEMPLATE_SOURCED_RULES) : state.outputs, state.outputs, accountedOutputKeys, allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets)), noEchoPlans.outputKeys, new Set(Object.keys(stack.template.Outputs ?? {})), declaredAliasOf);
+		const noEchoMaskedOutputs = maskScrubNoEchoOutputs(redactUnaccountedOutputs(outputSecrets.size > 0 ? redactForState(state.outputs, outputsSourceUntrusted ? {
+			provenance: "value-scan",
+			secrets: outputSecrets
+		} : {
+			provenance: "template-sourced",
+			secrets: outputSecrets,
+			source: outputsTemplateSource,
+			generation: "unproven"
+		}) : state.outputs, state.outputs, accountedOutputKeys, allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets)), noEchoPlans.outputKeys, new Set(Object.keys(stack.template.Outputs ?? {})), declaredAliasOf);
 		emitAbandonedScanNotes();
 		let newOutputs = noEchoMaskedOutputs;
 		let newExportNames = state.exportNames;
@@ -9976,7 +10007,10 @@ function isSecretBearingPath(path, secretPaths) {
 	return false;
 }
 function redactDriftValue(value, secrets, secretBearing) {
-	const redacted = redactSecretsForState(value, secrets);
+	const redacted = redactForState(value, {
+		provenance: "value-scan",
+		secrets
+	});
 	if (!secretBearing) return redacted;
 	if (redacted === void 0 || redacted === null) return redacted;
 	if (typeof redacted === "string" && isSingleDynamicReferenceToken(redacted)) return redacted;
@@ -10459,7 +10493,11 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 					setAtPath(newBaseline, change.path, change.awsValue);
 					accepted.push(change);
 				}
-				const redactedBaseline = withPhysicalNameCopies(outcome.secrets, otherPhysicalIds(report.state.resources, outcome.logicalId), () => redactSecretsForState(newBaseline, outcome.secrets, existing.properties ?? {}, hasObserved ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES));
+				const redactedBaseline = withPhysicalNameCopies(outcome.secrets, otherPhysicalIds(report.state.resources, outcome.logicalId), () => redactForState(newBaseline, {
+					provenance: hasObserved ? "state-baseline" : "state-readback",
+					secrets: outcome.secrets,
+					source: existing.properties ?? {}
+				}));
 				let recordedChanges = 0;
 				for (const change of accepted) {
 					if (deepEqualUnordered(getAtPath(redactedBaseline, change.path), change.awsValue)) {
@@ -11036,7 +11074,11 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 						try {
 							if (updateResult?.effectiveProperties) {
 								const delta = collectNarrowedTopLevelKeys(newProperties, updateResult.effectiveProperties);
-								if (Object.keys(delta).length > 0) narrowedByLogicalId.set(outcome.logicalId, keepBaselineAtUncertifiedPaths(redactSecretsForState(delta, secrets, revertBaseline, stateResource.observedProperties !== void 0 ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES), [...outcome.uncertifiedPaths, ...outcome.noEchoParameterPaths ?? []], revertBaseline));
+								if (Object.keys(delta).length > 0) narrowedByLogicalId.set(outcome.logicalId, keepBaselineAtUncertifiedPaths(redactForState(delta, {
+									provenance: stateResource.observedProperties !== void 0 ? "state-baseline" : "state-readback",
+									secrets,
+									source: revertBaseline
+								}), [...outcome.uncertifiedPaths, ...outcome.noEchoParameterPaths ?? []], revertBaseline));
 							}
 						} catch (captureErr) {
 							logger.warn(`  ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, but the provider's reported effective properties could not be read — ${maskSecretsInText(describeAwsFailure(captureErr).detail, secrets)}`);
@@ -11045,7 +11087,10 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 							if (updateResult !== void 0) {
 								const noEchoDeclared = recordNoEchoAttributeValues(updateResult, secrets, newProperties);
 								const next = recordAfterRollbackUpdate(stateResource, updateResult);
-								const keptAttributes = next.attributes === void 0 ? void 0 : keepRecordedAttributesOverMask(redactSecretsForState(next.attributes, secrets), next.attributes, stateResource.attributes, noEchoDeclared);
+								const keptAttributes = next.attributes === void 0 ? void 0 : keepRecordedAttributesOverMask(redactForState(next.attributes, {
+									provenance: "value-scan",
+									secrets
+								}), next.attributes, stateResource.attributes, noEchoDeclared);
 								const declaredNames = noEchoAttributeNamesOf(stateResource) ?? [];
 								const attributes = keptAttributes === void 0 || declaredNames.length === 0 ? keptAttributes : Object.fromEntries(Object.entries(keptAttributes).map(([name, value]) => [name, declaredNames.includes(name) ? maskWholeValue(value) : value]));
 								if (next.physicalId !== stateResource.physicalId || !sameRecordedJson(attributes, stateResource.attributes)) reRecordedByLogicalId.set(outcome.logicalId, {
@@ -12629,7 +12674,7 @@ async function purgeEventsAfterDestroy(reader, stackName, region, opts, logger)
 		else if ((purge.earlierVersions?.deletedBodies ?? 0) > 0) logger.info(safeMsg`  Purged earlier deployment-event versions left under the deployments/ prefix of ${displaySafe(stackName)} (${displaySafe(region)}), unless a warning above says otherwise.`);
 		return purge;
 	} catch (purgeError) {
-		logger.warn(`  Failed to purge deployment-event history for ${displaySafe(stackName)}: ${displaySafe(purgeError instanceof Error ? purgeError.message : String(purgeError))}`);
+		logger.warn(`  Failed to purge deployment-event history for ${displaySafe(stackName)}: ${displaySafe(describeAwsFailure(purgeError).detail)}`);
 		return null;
 	}
 }
@@ -12757,7 +12802,7 @@ async function destroyCommand(stackArgs, options) {
 				}
 				throw named;
 			}
-			synthError = error instanceof Error ? error : new Error(String(error));
+			synthError = error instanceof Error ? error : new Error(safeStringify(error));
 			logger.debug("Could not synthesize app, falling back to state-based stack list");
 		}
 		const stackPatterns = stackArgs.length > 0 ? stackArgs : options.stack ? [options.stack] : [];
@@ -19042,7 +19087,11 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 						logger.warn(safeMsg`  ✗ ${displayStackName(stackName)}/${displayIdent(logicalId)} ` + safeMsg`(${displayIdent(resource.resourceType)}): ` + `not found in AWS — it was deleted outside cdkd; 'cdkd drift' reports it as deleted.`);
 						return;
 					}
-					resource.observedProperties = redactSecretsForState(maskReadbackAtCoordinates(observed, resource.properties ?? {}, [...maskedLeafCoordinatesOf(resource.properties ?? {}), ...noEchoLeavesOf(resource) ?? []]), await publicSsmProver.proofBagFor(resource.properties ?? {}), resource.properties ?? {}, STATE_SOURCED_BASELINE_RULES);
+					resource.observedProperties = redactForState(maskReadbackAtCoordinates(observed, resource.properties ?? {}, [...maskedLeafCoordinatesOf(resource.properties ?? {}), ...noEchoLeavesOf(resource) ?? []]), {
+						provenance: "state-baseline",
+						secrets: await publicSsmProver.proofBagFor(resource.properties ?? {}),
+						source: resource.properties ?? {}
+					});
 					if (logicalId === acceptId) {
 						delete resource.observedBaselineRefused;
 						delete resource.observedBaselineRefusalReason;
@@ -19127,7 +19176,7 @@ function rerunRollback(stackName) {
 }
 function backendErrorText(error, stackName, region) {
 	if (!isPasteableIdent(stackName) || !isPasteableIdent(region)) return "its error text names a stack or region that is not a plain identifier, so it is not shown";
-	return displaySafe(error instanceof Error ? error.message : String(error));
+	return displaySafe(describeAwsFailure(error).detail);
 }
 function stackRegionShown(stackName, region) {
 	return `${plainOrDescribed(stackName, "stack name")} (${plainOrDescribed(region, "region")})`;
@@ -21748,7 +21797,12 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 				...baseContext,
 				recordedSecretValues
 			});
-			resource.properties = recordedSecretValues.size > 0 ? redactSecretsForState(markSameGenerationBag(resolved), recordedSecretValues, unresolvedProperties) : resolved;
+			resource.properties = recordedSecretValues.size > 0 ? redactForState(resolved, {
+				provenance: "template-derived",
+				secrets: recordedSecretValues,
+				source: unresolvedProperties,
+				generation: "same-generation"
+			}) : resolved;
 			noEchoInputs.set(logicalId, {
 				template: unresolvedProperties,
 				resolved,
@@ -21758,7 +21812,10 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 			logger.warn(`Failed to resolve intrinsics in Properties for imported resource ${logicalIdShown(logicalId)} (${resourceTypeShown(resource.resourceType)}): ${maskSecretsInText(describeAwsFailure(err).detail, recordedSecretValues)}.\nState will be written with the raw intrinsic shape, which may cause 'cdkd destroy' to fail on this resource — re-import once every referenced sibling is in state, or remove this resource from state with 'cdkd orphan <StackPath>/<Path/To/Resource>'.` + (unboundParameterNames.length > 0 ? ` This template also declares parameter(s) with no 'Default' that an import cannot bind (${unboundParameterNames.map((name) => plainOrDescribed(name, "parameter name")).join(", ")}), and 'cdkd import' accepts no parameter values — if this property was built from one of those, re-importing a sibling will not change it: give the parameter a 'Default' in the template and re-import, or correct the recorded properties before the next 'cdkd deploy'.` : ""));
 			threw = true;
 		}
-		if (recordedSecretValues.size > 0 && resource.attributes !== void 0) resource.attributes = redactSecretsForState(resource.attributes, recordedSecretValues);
+		if (recordedSecretValues.size > 0 && resource.attributes !== void 0) resource.attributes = redactForState(resource.attributes, {
+			provenance: "value-scan",
+			secrets: recordedSecretValues
+		});
 		const dependsOnDivergent = parameterTaint?.refused.has(logicalId) === true;
 		if (dependsOnDivergent) unsafeObservedBaselineLogicalIds.unverifiableParameter.add(logicalId);
 		if (threw || dependsOnDivergent) {
@@ -22031,7 +22088,11 @@ async function captureObservedForImportedResources(stackState, providerRegistry,
 			const observed = await provider.readCurrentState(resource.physicalId, logicalId, resource.resourceType, resource.properties ?? {}, buildReadCurrentStateContext(stackState, logicalId));
 			if (observed !== void 0 && observed !== RESOURCE_NOT_FOUND) {
 				const marked = noEchoLeavesOf(resource) ?? [];
-				resource.observedProperties = redactSecretsForState(marked.length > 0 ? maskReadbackAtCoordinates(observed, resource.properties ?? {}, marked) : observed, NO_RECORDED_SECRETS, resource.properties ?? {}, STATE_SOURCED_BASELINE_RULES);
+				resource.observedProperties = redactForState(marked.length > 0 ? maskReadbackAtCoordinates(observed, resource.properties ?? {}, marked) : observed, {
+					provenance: "state-baseline",
+					secrets: NO_RECORDED_SECRETS,
+					source: resource.properties ?? {}
+				});
 			}
 		} catch (err) {
 			logger.debug(`observedProperties capture for imported ${logicalId} (${resource.resourceType}) failed: ${err instanceof Error ? err.name : typeof err} — drift will fall back to template properties for this resource until the next successful deploy.`);
@@ -29501,4 +29562,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { resolveSecretDerivedPrincipals as a, buildProgram, isResolvableSecretPrincipalList as i, runDestroyForStack as n, canonicalizeIpProtocolValue as o, holdsUnprovenSecretPrincipalToken as r, resolvedResourceTimeoutMs as s, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-DmPDfDhE.js.map
+//# sourceMappingURL=program-CiTz5-_D.js.map