@go-to-k/cdkd 0.301.6 → 0.301.7

package/dist/{deploy-engine-D1z0QUsv.js → deploy-engine-zLKsm0IM.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-B_CEQGE1.js";
 import { A as UNRENDERABLE, B as safeMsg, C as looksLikeCdkdGeneratedName, D as SAFE_MSG_ALTERED_CHAR, E as withoutGeneratedFallbackName, F as displaySafe, H as terminalSafe, I as displayStackName, L as isPasteableIdent, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, S as getCurrentStackName, T as withStackName, U as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, j as asIsMessage, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, An as SHELL_ACTIVE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, Ct as RETRY_AUXILIARY_OWNER, Dn as normalizeAwsError, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as isUpdateUnsupportedError, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as withheldTargetClause, Ht as recoveryCommandFlags, In as pasteableCommand, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as isNameCooldownError, Kn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as physicalIdShownBesideCommand, M as quotedRemedyLogicalId, Mn as UNSHOWABLE_VALUE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Ot as hasCreatedBeforeFailure, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as plainOrDescribed, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Ut as sanitizeRecoveryValue, Vn as shellQuote, Vt as formatLockOwner, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isReplayedNameCollisionFrom, Yn as isRecreateRetryableError, Yt as producerRecordKey, Zt as withPasteableAwsProfile, _t as createMaskedLogSinks, ar as isRetryableTransientError, at as startInterruptWatch, bn as ResourceUpdateNotSupportedError, bt as maskDeep, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dr as markNonRetryable, en as clientDefaultsFor, er as formatRetryClassificationSignals, f as removalWarning, fr as markRedactedCause, ft as logicalIdShown, gt as stateOrphanRecordRemedy, hn as MalformedProducerRecordRefusalError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isIamPropagationError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as SHELL_ACTIVE_WHY, jt as markAuxiliaryFailure, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DynamicReferenceRegionAmbiguousError, lr as isMarkedNonRetryable, m as withoutInjectedRemovals, mn as MacroExpansionError, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, on as CrossAccountSecretRefusalError, or as isTransientServerError, ot as ElapsedBudgetRegistry, pn as LockError, pr as wrapMaskedAwsError, qn as isNameCollisionErrorFrom, rn as AssetError, sn as DependencyError, sr as retryClassificationText, st as monotonicNowMs, tn as credentialFingerprint, tr as isAmbiguousCcHandlerErrorCode, un as IntrinsicResolutionRefusalError, ur as isThrottlingError, ut as compositeIdSeparatorRefusal, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as SynthesisError, wt as carryCreatedBeforeFailure, xt as maskerOrIdentity, yn as ResourceTimeoutError, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-BkeM7IXi.js";
+import { $ as protectedReplacementAdvice, $n as markReplayMayCollide, $t as ambientCredentialConfig, A as isQuotableImportValue, An as SHELL_ACTIVE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, Ct as RETRY_AUXILIARY_OWNER, Dn as normalizeAwsError, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as isUpdateUnsupportedError, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as withheldTargetClause, Ht as recoveryCommandFlags, In as pasteableCommand, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as isNameCollisionErrorFrom, Kn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as physicalIdShownBesideCommand, M as quotedRemedyLogicalId, Mn as UNSHOWABLE_VALUE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Ot as hasCreatedBeforeFailure, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as plainOrDescribed, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Ut as sanitizeRecoveryValue, Vn as shellQuote, Vt as formatLockOwner, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isRecreateRetryableError, Yn as isNameCooldownError, Yt as producerRecordKey, Zn as isReplayedNameCollisionFrom, Zt as withPasteableAwsProfile, _t as createMaskedLogSinks, ar as isIamPropagationError, at as startInterruptWatch, bn as ResourceUpdateNotSupportedError, bt as maskDeep, cr as retryClassificationText, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dr as isThrottlingError, en as clientDefaultsFor, f as removalWarning, fr as markNonRetryable, ft as logicalIdShown, gt as stateOrphanRecordRemedy, hn as MalformedProducerRecordRefusalError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as SHELL_ACTIVE_WHY, jt as markAuxiliaryFailure, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DynamicReferenceRegionAmbiguousError, m as withoutInjectedRemovals, mn as MacroExpansionError, mr as wrapMaskedAwsError, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as isAmbiguousCcHandlerErrorCode, on as CrossAccountSecretRefusalError, or as isRetryableTransientError, ot as ElapsedBudgetRegistry, pn as LockError, pr as markRedactedCause, rn as AssetError, rr as isAmbiguousOutcomeError, sn as DependencyError, sr as isTransientServerError, st as monotonicNowMs, tn as credentialFingerprint, tr as formatRetryClassificationSignals, un as IntrinsicResolutionRefusalError, ur as isMarkedNonRetryable, ut as compositeIdSeparatorRefusal, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as SynthesisError, wt as carryCreatedBeforeFailure, xt as maskerOrIdentity, yn as ResourceTimeoutError, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-LyArt3ew.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-DBXBcg0J.js";
-import { t as getCdkdVersion } from "./version-CnjZ9J4l.js";
+import { t as getCdkdVersion } from "./version-MUc6NbW0.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7748,7 +7748,10 @@ function certifiedExpressionForLeaf(secrets, association, leaf) {
 function certifiedListForLeaf(secrets, association, bag) {
 	const certified = bag.map((element) => certifiedExpressionForLeaf(secrets, association, element));
 	if (certified.every((expression) => expression === void 0)) return void 0;
-	return bag.map((element, i) => certified[i] ?? redactSecretsForState(element, secrets));
+	return bag.map((element, i) => certified[i] ?? redactForState(element, {
+		provenance: "value-scan",
+		secrets
+	}));
 }
 function associationForSource(source, secrets) {
 	const key = crossStackSourceKey(source);
@@ -7972,7 +7975,7 @@ const NESTED_STACK_RESOURCE_TYPE$4 = "AWS::CloudFormation::Stack";
 const nestedStackParameterExpressions = /* @__PURE__ */ new WeakMap();
 const renderedParameterSpellings = /* @__PURE__ */ new WeakMap();
 const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
-function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, rules = TEMPLATE_DERIVED_RULES) {
+function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, provenance = "template-derived") {
 	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$4) return;
 	if (secrets.size === 0) return;
 	if (!isPlainObject$7(resolvedProperties) || !isPlainObject$7(sourceProperties)) return;
@@ -7981,7 +7984,7 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 	const resolvedParameters = resolvedProperties["Parameters"];
 	const sourceParameters = sourceProperties["Parameters"];
 	if (!isPlainObject$7(resolvedParameters) || !isPlainObject$7(sourceParameters)) return;
-	const positioned = redactSecretsForState(markSameGenerationBag({ ...resolvedParameters }), secrets, sourceParameters, rules);
+	const positioned = redactAtProvenance({ ...resolvedParameters }, secrets, sourceParameters, provenance, true);
 	let table = nestedStackParameterExpressions.get(secrets);
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
 		const sourceLeaf = sourceParameters[name];
@@ -8074,7 +8077,10 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 		if (typeof resolvedValue !== "string") continue;
 		const spelling = certifiedSpellingOf(name);
 		if (spelling === void 0) continue;
-		if (redactSecretsForState(resolvedValue, secrets) !== resolvedValue) continue;
+		if (redactForState(resolvedValue, {
+			provenance: "value-scan",
+			secrets
+		}) !== resolvedValue) continue;
 		const frame = singleSpanFrame(resolvedValue, spelling);
 		if (frame === void 0 || resolvedPlaintextOf(secrets, frame.token) !== frame.middle) continue;
 		if (framesByValue.get(resolvedValue)?.size !== 1) continue;
@@ -8165,7 +8171,10 @@ function inheritedRenderedSpan(childSecrets, key, text) {
 		if (carriesChildOnlyPlaintext(value, childSecrets, reads.parent)) return void 0;
 		const spelling = inheritedParameterExpression(reads.parent, name, value);
 		if (typeof spelling !== "string") return void 0;
-		if (redactSecretsForState(spelling, childSecrets) !== spelling) return void 0;
+		if (redactForState(spelling, {
+			provenance: "value-scan",
+			secrets: childSecrets
+		}) !== spelling) return void 0;
 		return {
 			value,
 			spelling
@@ -8212,7 +8221,10 @@ function recordInheritedParameterRead(childSecrets, parentSecrets, parameterName
 	parameterReadsFor(childSecrets, parentSecrets)?.names.add(parameterName);
 }
 function redactInheritedParameterValue(parentSecrets, parameterName, value) {
-	return inheritedParameterExpression(parentSecrets, parameterName, value) ?? redactSecretsForState(value, parentSecrets);
+	return inheritedParameterExpression(parentSecrets, parameterName, value) ?? redactForState(value, {
+		provenance: "value-scan",
+		secrets: parentSecrets
+	});
 }
 function positionByInheritedParameter(bag, source, secrets) {
 	const keys = Object.keys(source);
@@ -8224,7 +8236,10 @@ function positionByInheritedParameter(bag, source, secrets) {
 	if (typeof bag !== "string" && !Array.isArray(bag)) return void 0;
 	if (carriesChildOnlyPlaintext(bag, secrets, reads.parent)) return void 0;
 	const answer = redactInheritedParameterValue(reads.parent, name, bag);
-	if (!deepEqualJsonValue(redactSecretsForState(answer, secrets), answer)) return void 0;
+	if (!deepEqualJsonValue(redactForState(answer, {
+		provenance: "value-scan",
+		secrets
+	}), answer)) return void 0;
 	return answer;
 }
 const REREAD_PSEUDO_PARAMETERS = /* @__PURE__ */ new Set([
@@ -8444,7 +8459,10 @@ function holdsRereadTrigger(node, depth = 0) {
 }
 function rendersReadTo(spelling, parentSecrets, value) {
 	if (typeof spelling === "string" && typeof value === "string") {
-		if (spelling === value) return redactSecretsForState(spelling, parentSecrets) === spelling;
+		if (spelling === value) return redactForState(spelling, {
+			provenance: "value-scan",
+			secrets: parentSecrets
+		}) === spelling;
 		return rendersLiteralTo(spelling, parentSecrets, value);
 	}
 	if (Array.isArray(spelling) && Array.isArray(value) && spelling.length === value.length) return spelling.every((element, i) => rendersReadTo(element, parentSecrets, value[i]));
@@ -8552,7 +8570,10 @@ function positionByParameterReread(bag, source, secrets) {
 		answer = matching[0].redacted;
 	}
 	if (carriesChildOnlyPlaintext(bag, secrets, reads.parent)) return void 0;
-	if (!deepEqualJsonValue(redactSecretsForState(answer, secrets), answer)) return void 0;
+	if (!deepEqualJsonValue(redactForState(answer, {
+		provenance: "value-scan",
+		secrets
+	}), answer)) return void 0;
 	return answer;
 }
 function carriesChildOnlyPlaintext(value, childSecrets, parentSecrets) {
@@ -8720,7 +8741,10 @@ function positionByParameterPlaceholders(bag, source, secrets) {
 		if (bag.length < before[0].length + after[0].length) return void 0;
 		if (!bag.startsWith(before[0]) || !bag.endsWith(after[0])) return void 0;
 		const middle = bag.slice(before[0].length, bag.length - after[0].length);
-		if (redactSecretsForState(middle, secrets) !== middle) return void 0;
+		if (redactForState(middle, {
+			provenance: "value-scan",
+			secrets
+		}) !== middle) return void 0;
 		persisted = before[1] + middle + after[1];
 	}
 	const afterStart = bag.length - after[0].length;
@@ -8734,7 +8758,10 @@ function acceptedPlaceholderRendering(bag, persisted, spans, secrets) {
 			for (const [start, length] of spans) if (at < start + length && end > start && (at < start || end > start + length)) return void 0;
 		}
 	}
-	if (redactSecretsForState(persisted, secrets) !== persisted) return void 0;
+	if (redactForState(persisted, {
+		provenance: "value-scan",
+		secrets
+	}) !== persisted) return void 0;
 	return persisted;
 }
 function positionByRecordedParameterSpans(bag, source, secrets, associations) {
@@ -8764,7 +8791,10 @@ function positionByRecordedParameterSpans(bag, source, secrets, associations) {
 	const tail = bag.slice(cursor);
 	gaps.push(tail);
 	persisted += tail;
-	for (const gap of gaps) if (redactSecretsForState(gap, secrets) !== gap) return void 0;
+	for (const gap of gaps) if (redactForState(gap, {
+		provenance: "value-scan",
+		secrets
+	}) !== gap) return void 0;
 	return acceptedPlaceholderRendering(bag, persisted, certified, secrets);
 }
 
@@ -8874,7 +8904,10 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 	if (isDynamicReferenceString(source) && typeof bag === "string") {
 		if (isSingleDynamicReferenceToken(source) && (rules.trustAnyExpression || isKnownSecretExpression(source, secretExpressions))) {
 			if (!rules.sourceIsSameGeneration && isSingleDynamicReferenceToken(bag)) {
-				if (!spanNamesResolvableService(bag)) return redactSecretsForState(bag, secrets);
+				if (!spanNamesResolvableService(bag)) return redactForState(bag, {
+					provenance: "value-scan",
+					secrets
+				});
 				return secrets.get(bag) ?? bag;
 			}
 			return source;
@@ -8920,7 +8953,10 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 				const j = partnerIndex[i];
 				if (j >= 0) return redactByPath(item, source[j], secrets, rules, secretExpressions, bagIsSameGeneration);
 				if (positionalIsExact) return redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration);
-				return redactSecretsForState(item, secrets);
+				return redactForState(item, {
+					provenance: "value-scan",
+					secrets
+				});
 			});
 		}
 		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration));
@@ -8931,10 +8967,16 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 	}
 	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source)) {
 		const out = Object.create(null);
-		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactSecretsForState(v, secrets);
+		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactForState(v, {
+			provenance: "value-scan",
+			secrets
+		});
 		return out;
 	}
-	return redactSecretsForState(bag, secrets);
+	return redactForState(bag, {
+		provenance: "value-scan",
+		secrets
+	});
 }
 function isReadbackProjectedFromState(rules) {
 	return rules.trustAnyExpression && !rules.descendArrays && rules.sourceIsSameGeneration;
@@ -9247,20 +9289,23 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 
 //#endregion
 //#region src/deployment/secret-redaction/redact-state.ts
-function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RULES) {
-	return flattenEmbeddedNoEchoLeaves(redactSecretsForStatePasses(bag, secrets, source, rules), secrets);
+function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RULES, bagIsSameGeneration = false) {
+	return flattenEmbeddedNoEchoLeaves(redactSecretsForStatePasses(bag, secrets, source, rules, bagIsSameGeneration), secrets);
 }
-function redactSecretsForStatePasses(bag, secrets, source, rules) {
+function redactSecretsForStatePasses(bag, secrets, source, rules, bagIsSameGeneration) {
 	if (secrets.size === 0 && source === void 0) return bag;
 	if (source !== void 0) {
-		const positioned = redactByPath(bag, source, secrets, rules, recordedExpressionsOf(secrets), isSameGenerationBag(bag));
+		const positioned = redactByPath(bag, source, secrets, rules, recordedExpressionsOf(secrets), bagIsSameGeneration);
 		if (!isReadbackProjectedFromState(rules)) return positioned;
 		const failClosed = rules.failClosedOnUncertifiedPositions === true;
 		const refused = refuseUncertifiedReadbackPositions(positioned, source, secrets, failClosed);
 		const derived = deriveReadbackNeedles(bag, source, secrets, rules);
 		if (derived === void 0) return refused;
 		const marks = refuseUncertifiedReadbackPositions(positioned, source, secrets, failClosed, void 0, true);
-		return preferPositionDecisions(redactSecretsForState(bag, derived.certain), refused, bag, marks, derived.inferred);
+		return preferPositionDecisions(redactForState(bag, {
+			provenance: "value-scan",
+			secrets: derived.certain
+		}), refused, bag, marks, derived.inferred);
 	}
 	const regex = buildNeedleRegex(substringNeedlesOf(secrets));
 	const wholeValueExpr = (s) => s === "" ? void 0 : secrets.get(s);
@@ -9426,18 +9471,29 @@ function redactOverlappingMatches(value, matches, redacted, expressionFor) {
 	}
 	return out + value.slice(cursor);
 }
-function scrubResourceRecord(record, secrets, sourceProperties, observedRules) {
+function scrubResourceRecord(record, secrets, sourceProperties, observedProvenance, claims = {}) {
+	const propertiesClaimed = claims.properties === "same-generation";
+	const observedClaimed = claims.observed === "same-generation";
 	if (secrets.size === 0 && sourceProperties === void 0 && !record.observedProperties) return record;
 	const next = { ...record };
-	next.properties = redactSecretsForState(record.properties, secrets, sourceProperties);
+	next.properties = sourceProperties === void 0 ? redactForState(record.properties, {
+		provenance: "value-scan",
+		secrets
+	}) : redactAtProvenance(record.properties, secrets, sourceProperties, "template-derived", propertiesClaimed);
 	if (record.attributes) {
 		const ownId = record.physicalId;
 		const ids = [...attributeIdCopiesOf.get(secrets) ?? []];
 		if (typeof ownId === "string" && ownId !== "") ids.push(ownId);
 		const attributes = record.attributes;
-		next.attributes = ids.length > 0 ? withPhysicalNameCopies(secrets, ids, () => redactSecretsForState(attributes, secrets)) : redactSecretsForState(attributes, secrets);
+		next.attributes = ids.length > 0 ? withPhysicalNameCopies(secrets, ids, () => redactForState(attributes, {
+			provenance: "value-scan",
+			secrets
+		})) : redactForState(attributes, {
+			provenance: "value-scan",
+			secrets
+		});
 	}
-	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets, sourceProperties ?? next.properties, observedRules ?? (sourceProperties !== void 0 ? TEMPLATE_SOURCED_RULES : secrets.size === 0 && isSameGenerationBag(record.observedProperties) ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES));
+	if (record.observedProperties) next.observedProperties = redactAtProvenance(record.observedProperties, secrets, sourceProperties ?? next.properties, observedProvenance ?? (sourceProperties !== void 0 ? "template-sourced" : secrets.size === 0 && observedClaimed ? "state-baseline" : "state-readback"), observedClaimed);
 	return next;
 }
 function withoutPhysicalNameCopies(secrets, run) {
@@ -9499,7 +9555,10 @@ function embeddedPhysicalNameRewrites(secrets, legacySecrets = secrets) {
 	const pairs = [];
 	withoutPhysicalNameCopies(legacySecrets, () => {
 		for (const name of names) {
-			const legacy = redactSecretsForState(name, legacySecrets);
+			const legacy = redactForState(name, {
+				provenance: "value-scan",
+				secrets: legacySecrets
+			});
 			if (typeof legacy === "string" && legacy !== name && legacy.includes("{{resolve:") && !isSingleDynamicReferenceToken(legacy) && !legacy.includes("***")) pairs.push([legacy, name]);
 		}
 	});
@@ -9568,6 +9627,37 @@ function repairEmbeddedPhysicalNamesTowards(stored, target, pairs) {
 	return stored;
 }
 
+//#endregion
+//#region src/deployment/secret-redaction/context.ts
+const RULES_BY_PROVENANCE = {
+	"template-derived": TEMPLATE_DERIVED_RULES,
+	"template-sourced": TEMPLATE_SOURCED_RULES,
+	"state-readback": STATE_SOURCED_READBACK_RULES,
+	"state-baseline": STATE_SOURCED_BASELINE_RULES,
+	"state-cross-generation": STATE_SOURCED_CROSS_GENERATION_RULES,
+	"state-derived": STATE_DERIVED_RULES
+};
+function redactForState(bag, context) {
+	if (context.provenance === "value-scan") return redactSecretsForState(bag, context.secrets);
+	const { secrets, source, provenance } = context;
+	if (!((context.provenance === "template-derived" || context.provenance === "template-sourced") && context.generation === "same-generation") || !isPlainBag(bag)) return redactAtProvenance(bag, secrets, source, provenance, false);
+	const copy = shallowCopy(bag);
+	const redacted = redactAtProvenance(copy, secrets, source, provenance, true);
+	return redacted === copy ? shallowCopy(copy) : redacted;
+}
+function redactAtProvenance(bag, secrets, source, provenance, sameGeneration) {
+	return redactSecretsForState(bag, secrets, source, RULES_BY_PROVENANCE[provenance], sameGeneration);
+}
+function isPlainBag(bag) {
+	if (Array.isArray(bag)) return true;
+	if (bag === null || typeof bag !== "object") return false;
+	const proto = Object.getPrototypeOf(bag);
+	return proto === Object.prototype || proto === null;
+}
+function shallowCopy(bag) {
+	return Array.isArray(bag) ? [...bag] : { ...bag };
+}
+
 //#endregion
 //#region src/deployment/secret-redaction/positions.ts
 const SKELETON_WILDCARD = `${DYNAMIC_REFERENCE_INNER_CHAR}*`;
@@ -9674,10 +9764,16 @@ function positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration) {
 	const frame = singleSpanFrame(bag, source);
 	if (frame === void 0) {
 		if (dynamicReferenceSpans(source).length >= 2 && certifiesRenderedLiteral(bag, source, secrets, bagIsSameGeneration)) return source;
-		return redactSecretsForState(bag, secrets);
+		return redactForState(bag, {
+			provenance: "value-scan",
+			secrets
+		});
 	}
 	const recorded = resolvedPlaintextOf(secrets, frame.token);
-	if (recorded === void 0 || recorded !== frame.middle) return redactSecretsForState(bag, secrets);
+	if (recorded === void 0 || recorded !== frame.middle) return redactForState(bag, {
+		provenance: "value-scan",
+		secrets
+	});
 	return writeFramedTokenWithinScanBound(bag, secrets, frame, bagIsSameGeneration);
 }
 function pairedSpans(source, secrets) {
@@ -9717,7 +9813,10 @@ function renderedLiteralSpans(spelling, secrets, value) {
 	const spans = pairedSpans(spelling, secrets);
 	if (spans === void 0) return void 0;
 	if (renderSpans(spelling, spans, (i) => spans[i].plaintext) !== value) return void 0;
-	return redactSecretsForState(spelling, secrets) === spelling ? spans : void 0;
+	return redactForState(spelling, {
+		provenance: "value-scan",
+		secrets
+	}) === spelling ? spans : void 0;
 }
 function certifiesRenderedLiteral(bag, source, secrets, bagIsSameGeneration) {
 	const spans = renderedLiteralSpans(source, secrets, bag);
@@ -9728,13 +9827,19 @@ function certifiesRenderedLiteral(bag, source, secrets, bagIsSameGeneration) {
 		if (survivor === void 0) return false;
 		survivors.push(survivor);
 	}
-	const scanned = redactSecretsForState(bag, secrets);
+	const scanned = redactForState(bag, {
+		provenance: "value-scan",
+		secrets
+	});
 	if (scanned === renderSpans(source, spans, (i) => survivors[i])) return true;
 	if (!bagIsSameGeneration) return false;
 	return scanned === renderSpans(source, spans, (i) => spans[i].plaintext.length >= 4 ? survivors[i] : spans[i].plaintext);
 }
 function writeFramedTokenWithinScanBound(bag, secrets, frame, bagIsSameGeneration) {
-	const scanned = redactSecretsForState(bag, secrets);
+	const scanned = redactForState(bag, {
+		provenance: "value-scan",
+		secrets
+	});
 	const { token, prefix, suffix, middle } = frame;
 	const survivor = secrets.get(middle);
 	if (survivor === void 0) return scanned;
@@ -10409,34 +10514,6 @@ function wildcardOverlapsResolvedPlaintext(send, wildcards, secrets) {
 	return false;
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/context.ts
-const RULES_BY_PROVENANCE = {
-	"template-derived": TEMPLATE_DERIVED_RULES,
-	"template-sourced": TEMPLATE_SOURCED_RULES,
-	"state-readback": STATE_SOURCED_READBACK_RULES,
-	"state-baseline": STATE_SOURCED_BASELINE_RULES,
-	"state-cross-generation": STATE_SOURCED_CROSS_GENERATION_RULES,
-	"state-derived": STATE_DERIVED_RULES
-};
-function redactForState(bag, context) {
-	if (context.provenance === "value-scan") return redactSecretsForState(bag, context.secrets);
-	const rules = RULES_BY_PROVENANCE[context.provenance];
-	if (context.provenance !== "template-derived" || context.generation !== "same-generation" || !isPlainBag(bag)) return redactSecretsForState(bag, context.secrets, context.source, rules);
-	const marked = markSameGenerationBag(shallowCopy(bag));
-	const redacted = redactSecretsForState(marked, context.secrets, context.source, rules);
-	return redacted === marked ? shallowCopy(marked) : redacted;
-}
-function isPlainBag(bag) {
-	if (Array.isArray(bag)) return true;
-	if (bag === null || typeof bag !== "object") return false;
-	const proto = Object.getPrototypeOf(bag);
-	return proto === Object.prototype || proto === null;
-}
-function shallowCopy(bag) {
-	return Array.isArray(bag) ? [...bag] : { ...bag };
-}
-
 //#endregion
 //#region src/deployment/secret-redaction/noecho-leaves.ts
 const SUB_VARIABLE$2 = /\$\{([^}!][^}]*)\}/g;
@@ -26998,7 +27075,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-GNiE6dR1.js");
+			const { ASGProvider } = await import("./asg-provider-C14GB-Hy.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -27104,7 +27181,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-DBW972HG.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DUaw7kpj.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-DagnUCn-.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-BlpYIZQP.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -33740,7 +33817,8 @@ function redactOutputsBag(deps, outputs) {
 	return maskOutputsByPosition(deps.noEchoRun(), deps.noEchoDeps(), redactForState(outputs, outputsRun.outputsSourceUsable ? {
 		provenance: "template-sourced",
 		secrets: outputsRun.outputSecrets,
-		source: outputsRun.outputsTemplateSource
+		source: outputsRun.outputsTemplateSource,
+		generation: isSameGenerationBag(outputs) ? "same-generation" : "unproven"
 	} : {
 		provenance: "value-scan",
 		secrets: outputsRun.outputSecrets
@@ -35460,7 +35538,7 @@ function redactRollbackRecord(record, secrets, journaledProps, journaledAttribut
 			source: journaledProps
 		})
 	};
-	return keepPersistedPlainRecordLeaves(scrubResourceRecord(positioned, secrets), record, {
+	return keepPersistedPlainRecordLeaves(scrubResourceRecord(positioned, secrets, void 0, void 0, { observed: isSameGenerationBag(positioned.observedProperties) ? "same-generation" : "unproven" }), record, {
 		properties: journaledProps,
 		attributes: journaledAttributes
 	});
@@ -36592,7 +36670,7 @@ async function replayRevert(s) {
 	refuseMaskedReplayBaseline(desiredProps, op.logicalId, noEcho.inert);
 	logger.info(`  Rollback: Restoring ${safe(op.logicalId)} (${safe(op.resourceType)}) to previous state`);
 	const currentProps = noEcho.onPreviousSide(await resolveReplayProps(current.properties, resolver, secrets, ctx, op.logicalId, current));
-	recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, previousState.properties, STATE_DERIVED_RULES);
+	recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, previousState.properties, "state-derived");
 	opMasker.addNamed({
 		resourceType: op.resourceType,
 		properties: desiredProps,
@@ -36688,7 +36766,7 @@ async function replayReverseReplacement(s) {
 		logicalId: op.logicalId,
 		physicalIds: [prev.physicalId]
 	});
-	recordNestedStackParameterExpressions(secrets, oldType, resolvedPrevProps, prev.properties, STATE_DERIVED_RULES);
+	recordNestedStackParameterExpressions(secrets, oldType, resolvedPrevProps, prev.properties, "state-derived");
 	const deleteFirstBlocked = op.oldDeletedBeforeCreate === true && !rollbackRetainsNewResource(current) ? deleteFirstBlocker(op) : void 0;
 	if (deleteFirstBlocked !== void 0) logger.warn(mask(safeMsg`  Rollback: not deleting the new ${shownLogicalId(op.logicalId)} first: its old properties ` + safeMsg`name the resource ${shownLogicalId(deleteFirstBlocked.logicalId)} had before the same deploy ` + "replaced or deleted it, which this rollback may not be able to restore under that id — re-creating the old resource first, which keeps the new one if that fails"));
 	const reverseDeleteFirst = op.oldDeletedBeforeCreate === true && !rollbackRetainsNewResource(current) && deleteFirstBlocked === void 0;
@@ -37338,7 +37416,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 					const desiredProps = noEcho.desired;
 					refuseMaskedReplayBaseline(desiredProps, op.logicalId, noEcho.inert);
 					const attemptedProps = noEcho.onPreviousSide(await resolveReplayProps(op.attemptedProperties ?? current.properties, resolver, secrets, ctx, op.logicalId, op.attemptedProperties === void 0 ? current : void 0));
-					recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, prev.properties, STATE_DERIVED_RULES);
+					recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, prev.properties, "state-derived");
 					opMasker.addNamed({
 						resourceType: op.resourceType,
 						properties: desiredProps,
@@ -40059,13 +40137,35 @@ function redactOperationsForJournal(deps, operations) {
 		if ((!secrets || secrets.size === 0) && !op.previousState && sources === void 0) return op;
 		const ownSecrets = secrets ?? /* @__PURE__ */ new Map();
 		const next = { ...op };
-		if (next.properties) next.properties = byPosition(redactSecretsForState(next.properties, ownSecrets, templateProps));
-		if (next.attemptedProperties) next.attemptedProperties = byPosition(redactSecretsForState(markSameGenerationBag({ ...next.attemptedProperties }), ownSecrets, templateProps));
+		if (next.properties) {
+			const properties = next.properties;
+			next.properties = byPosition(templateProps === void 0 ? redactForState(properties, {
+				provenance: "value-scan",
+				secrets: ownSecrets
+			}) : redactForState(properties, {
+				provenance: "template-derived",
+				secrets: ownSecrets,
+				source: templateProps,
+				generation: isSameGenerationBag(properties) ? "same-generation" : "unproven"
+			}));
+		}
+		if (next.attemptedProperties) {
+			const attempted = next.attemptedProperties;
+			next.attemptedProperties = byPosition(templateProps === void 0 ? redactForState(attempted, {
+				provenance: "value-scan",
+				secrets: ownSecrets
+			}) : redactForState(attempted, {
+				provenance: "template-derived",
+				secrets: ownSecrets,
+				source: templateProps,
+				generation: "same-generation"
+			}));
+		}
 		if (next.previousState) {
 			const previous = next.previousState;
 			const adopted = adoptedOrphanRecords.get(deps.owner);
 			const loaded = adopted?.has(op.logicalId) ? adopted.get(op.logicalId) : previous;
-			next.previousState = applyNoEchoPersist(deps.noEchoRun(), deps.noEchoDeps(), op.logicalId, previous, keepPersistedPlainRecordLeaves(scrubResourceRecord(previous, ownSecrets, void 0, STATE_SOURCED_READBACK_RULES), previous, loaded ?? {}), void 0, {}, void 0, true);
+			next.previousState = applyNoEchoPersist(deps.noEchoRun(), deps.noEchoDeps(), op.logicalId, previous, keepPersistedPlainRecordLeaves(scrubResourceRecord(previous, ownSecrets, void 0, "state-readback", { observed: isSameGenerationBag(previous.observedProperties) ? "same-generation" : "unproven" }), previous, loaded ?? {}), void 0, {}, void 0, true);
 		}
 		return next;
 	});
@@ -48779,7 +48879,8 @@ var DeployEngine = class {
 		for (const [logicalId, record] of Object.entries(state.resources)) {
 			const secrets = this.secretsRun.perResourceSecrets.get(logicalId);
 			const templateProps = this.secretsRun.perResourceTemplateProps.get(logicalId);
-			const scrubbed = scrubResourceRecord(this.attributeHealer.withHealedAttributes(logicalId, record), secrets ?? /* @__PURE__ */ new Map(), templateProps);
+			const healed = this.attributeHealer.withHealedAttributes(logicalId, record);
+			const scrubbed = scrubResourceRecord(healed, secrets ?? /* @__PURE__ */ new Map(), templateProps, void 0, sameGenerationClaimsOf(healed));
 			const noEchoScrubbed = applyNoEchoPersist(this.noEchoRun, this.noEchoDeps(), logicalId, record, withNoEchoExactEchoes(this.noEchoRun, logicalId, scrubbed), templateProps, state.resources, secrets);
 			resources[logicalId] = withReferenceProvenance(withConstructPath(withMaskedPropertyFingerprints(noEchoScrubbed, record.properties, templateProps, secrets, this.secretsRun.fingerprintNoEchoValues, this.secretsRun.perResourceInputFingerprints.get(logicalId)), constructPathOf(this.noEchoRun.constructPathTemplate, logicalId)), this.referenceProvenanceToPersist(logicalId, record, noEchoScrubbed, secrets));
 		}
@@ -48788,7 +48889,7 @@ var DeployEngine = class {
 			const orphanTemplateProps = sameResource ? this.secretsRun.perResourceTemplateProps.get(entry.logicalId) : void 0;
 			return {
 				...entry,
-				state: withMaskedPropertyFingerprints(applyNoEchoPersist(this.noEchoRun, this.noEchoDeps(), entry.logicalId, entry.state, scrubResourceRecord(entry.state, (sameResource ? this.secretsRun.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), orphanTemplateProps), orphanTemplateProps, state.resources), entry.state.properties, orphanTemplateProps, sameResource ? this.secretsRun.perResourceSecrets.get(entry.logicalId) : void 0, sameResource ? this.secretsRun.fingerprintNoEchoValues : void 0, sameResource ? this.secretsRun.perResourceInputFingerprints.get(entry.logicalId) : void 0)
+				state: withMaskedPropertyFingerprints(applyNoEchoPersist(this.noEchoRun, this.noEchoDeps(), entry.logicalId, entry.state, scrubResourceRecord(entry.state, (sameResource ? this.secretsRun.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), orphanTemplateProps, void 0, sameGenerationClaimsOf(entry.state)), orphanTemplateProps, state.resources), entry.state.properties, orphanTemplateProps, sameResource ? this.secretsRun.perResourceSecrets.get(entry.logicalId) : void 0, sameResource ? this.secretsRun.fingerprintNoEchoValues : void 0, sameResource ? this.secretsRun.perResourceInputFingerprints.get(entry.logicalId) : void 0)
 			};
 		});
 		const outputs = redactOutputs(this.maskingDeps(), state.outputs);
@@ -48939,7 +49040,13 @@ var DeployEngine = class {
 		return maskingRetryLogger(this.logger, secrets);
 	}
 };
+function sameGenerationClaimsOf(record) {
+	return {
+		properties: isSameGenerationBag(record.properties) ? "same-generation" : "unproven",
+		observed: isSameGenerationBag(record.observedProperties) ? "same-generation" : "unproven"
+	};
+}
 
 //#endregion
-export { resolvePendingCloudControlRequests as $, repairMalformedOutputsForReadOnly as $a, warnFinchArgvExposure as $c, accountArgs as $i, buildFinalSnapshotIdentifier as $n, readbackPathFor as $o, DiffCalculator as $r, CrossPrefixScanCache as $s, namesAnyDeclaredParameter as $t, findServiceTokenRefusals as A, refuseMalformedOrphanRecordsForDestroy as Aa, isCrossRegionRedirect as Ac, coerceParameterTypedValue as Ai, derivePartitionAndUrlSuffix as Al, gray as An, replayWarn as Ao, isCustomResourceType as Ar, inheritNestedStackParameterAssociations as As, removeProtectionTypeList as At, parentSuppliedValues as B, refuseMalformedResourceEntriesForImport as Ba, describeDockerFailure as Bc, cfnRefValueFromPhysicalId as Bi, describeFileReadFailure as Bl, journaledOrphanPrintingBag as Bn, sameLambdaFunctionAddress as Bo, UNSPECIFIED_SKIP_REASON as Br, recordMaskOnlyValuesIn as Bs, resolveReplacementOldType as Bt, getPriorAttempts as C, malformedResourcesWarning as Ca, loadPublishableAssetManifest as Cc, applyCallerIdentityCredentials as Ci, findLargeInlineResources as Cl, awaitInFlightSibling as Cn, toFiniteNumber as Co, ProviderRegistry as Cr, withPhysicalNameCopies as Cs, formatResourceLine as Ct, crossStackOutputProvenanceSource as D, refuseDivergentRecordRegionForDestroy as Da, assertAssetBucketRegion as Dc, classifyReplaySecretRegion as Di, expectedOwnerParam as Dl, replacedDeleteFailureVerdict as Dn, configIntegerRefusal as Do, waitForLambdaFunctionActive as Dr, isUncertifiedBaselineMaskPosition as Ds, withApiLimit as Dt, computeImplicitDeleteEdges as E, previewableOrphanRecords as Ea, BOOTSTRAP_MARKER_PREFIX as Ec, classifyRecordedSecretRegion as Ei, decodeListingKey as El, withStackRecords as En, configBooleanRefusal as Eo, wouldReturnToSdkProvider as Er, dynamicReferenceTokens as Es, lookupEachName as Et, listNestedTemplateRows as F, refuseMalformedOutputsForDestroy as Fa, buildDenyExternalAccessPolicy as Fc, carriesDynamicReference as Fi, hasOwnKey as Fl, noEchoComparisonForTemplate as Fn, templateResourceTypes as Fo, customResourceResponseExpirationWarning as Fr, recordPhysicalNameCopy as Fs, planFailedOps as Ft, keptWholeReasonText as G, refuseMalformedResourcePropertiesForExport as Ga, isDockerClientEnvKey as Gc, parameterInputsFor as Gi, injectedAwsRegionValue as Gl, secretNamePrintingBags as Gn, maskAtCoordinates as Go, isWaitAbandonedError as Gr, STATE_SOURCED_CROSS_GENERATION_RULES as Gs, inheritProducerRegions as Gt, withResourceDeadline as H, refuseMalformedResourceEntriesForOrphan as Ha, finchSecretArgvRefusal as Hc, refStateLookupFromResource as Hi, renderAssemblyPathEscape as Hl, namingSecretsWithRecordedNoEcho as Hn, TemplateParser as Ho, deleteLeftInPlace as Hr, recordNoEchoParameterFreshValue as Hs, orphanNeedsIdentity as Ht, renderNestedTemplateTreeDefect as I, refuseMalformedResourceAttributesForOrphan as Ia, buildDockerImage as Ic, carriesFetchableDynamicReference as Ii, hasPlainPrototype$1 as Il, noEchoExactEchoLeavesOf as In, describeTypeWithThrottleRetry as Io, CloudControlProvider as Ir, splitGetAttStringForm as Is, planRollback as It, makeSiblingClaimReader as J, refuseMalformedResourcesForDestroy as Ja, redactDockerArgvValues as Jc, JSON_LISTING_HOLE_VALUE as Ji, stateSecretNameNeedles as Jn, maskedLeafCoordinatesOf as Jo, ec2InstanceProtectionSite as Jr, LockManager as Js, redactedDeleteAddressFields as Jt, mergeNoChangeOutputs as K, refuseMalformedResourcePropertiesForOrphan as Ka, isMalformedEnvKey as Kc, passedParameterClassesOf as Ki, clearBucketRegionCache as Kl, secretNamedAttributeNamesOf as Kn, maskReadbackAtCoordinates as Ko, markWaitAbandoned as Kr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ks, REDACTED_DELETE_ADDRESS_SKIP_REASON as Kt, templateIdentity as L, refuseMalformedResourceEntries as La, resolveDockerContextDirectory as Lc, isNamelessDynamicReferenceError as Li, nullPrototypeRecord as Ll, noEchoParameterNamesOf as Ln, withRetry as Lo, slowCcOperationTimeoutMs as Lr, carriesSecretMask as Ls, recheckFailedPlan as Lt, childTemplateLoader as M, refuseMalformedOrphansForDestroy as Ma, readBootstrapMarkerBody as Mc, parameterTypeMayLoseSecretIdentity as Mi, StageLoadError as Ml, red as Mn, requireConfigObject as Mo, withPrintingSecrets as Mr, recoverMaskedOutput as Ms, demoteSupersededOrphans as Mt, findNestedTemplateTreeDefect as N, refuseMalformedOrphansForOrphan as Na, validateAssetBucketName as Nc, getAccountInfo as Ni, processStackMessages as Nl, yellow as Nn, requireConfigString as No, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Nr, physicalNameCopiesOf as Ns, isJournaledOrphan as Nt, inheritedProvenanceForChildDiff as O, refuseMalformedNestedChildOutputs as Oa, ensureAssetStorage as Oc, producerRegionsFromState as Oi, PARTITION_TABLE as Ol, bold as On, configStringRefusal as Oo, TemplateNoEchoReresolver as Or, pathCrossesDottedKey as Os, replayFailedOperations as Ot, isAbsoluteAssetPath as P, refuseMalformedOutputs as Pa, validateContainerRepoName as Pc, isImpossibleEmptyStoredAttribute as Pi, defineOwnKey as Pl, noEchoAttributeNamesOf as Pn, prefetchCreateOnlyPropertyPaths as Po, applyCustomResourceResponseExpiration as Pr, recordAttributeIdCopy as Ps, isReplacementOrphan as Pt, pendingRequestCount as Q, repairMalformedOrphansForReadOnly as Qa, runDockerStreaming as Qc, UNREADABLE_RESOURCES_MAP_ROW as Qi, PRE_DELETE_SNAPSHOT_TYPES as Qn, passedNoEchoParametersOf as Qo, reEnableInstanceApiTermination as Qr, CrossPrefixReadError as Qs, computeParameterTaint as Qt, conditionFingerprint as R, refuseMalformedResourceEntriesForDeploy as Ra, describeDockerCapturedOutput as Rc, keepsSecretReferenceToken as Ri, ownValue as Rl, createReadOnlyAttributeHealerFactory as Rn, canonicalLambdaFunctionName as Ro, unchangedBehindSecretReference as Rr, provenPublicValue as Rs, recordUnderIdIsNotOwn as Rt, isTruthyCfnBoolean as S, malformedResourcePropertiesWarning as Sa, createAssetRedirectResolver as Sc, AWS_CREDENTIAL_ENV_KEYS as Si, MIGRATE_TMP_PREFIX as Sl, formatDestructiveChange as Sn, toCfnInteger as So, CC_BROKEN_REASON as Sr, scrubResourceRecord as Ss, sameJournaledOrphans as St, IMPLICIT_DELETE_DEPENDENCIES as T, malformedStateRefusalMessage as Ta, AssetModeResolver as Tc, envCredentialsAreAssumedRole as Ti, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Tl, getStackRecords as Tn, coerceCfnInteger as To, isCustomResource as Tr, DYNAMIC_REFERENCE_TOKEN_SCAN as Ts, isAccessDeniedError as Tt, diffSecurity as U, refuseMalformedResourcePropertiesForDestroy as Ua, formatDockerLoginError as Uc, parseWebACLArn as Ui, resolveAssemblyPath as Ul, orphanRecordsPrintingBag as Un, canonicalCoordinates as Uo, deleteSkipReason as Ur, recordProvenPublicExpression as Us, findNestedStackTypeChanges as Ut, readRecordedConditionVerdicts as V, refuseMalformedResourceEntriesForImportSave as Va, dockerSpawnEnvWithSensitive as Vc, isStalePlaceholderArnAttribute as Vi, displayAssemblyPath as Vl, maskEventTextWithBoundBags as Vn, DagBuilder as Vo, deleteIndeterminateGuards as Vr, recordNoEchoAttributeValues as Vs, seedsDeleteFirstGuard as Vt, isSecretBearingReferenceString as W, refuseMalformedResourcePropertiesForDrift as Wa, getDockerCmd as Wc, withSharedDrainBudget as Wi, injectAwsRegion as Wl, secretNamePrintingBag as Wn, isMarkedCoordinate as Wo, withIndeterminateGuard as Wr, wholeStringLeavesOf as Ws, getCurrentProducerRegions as Wt, DeploymentEventsReader as X, refuseMalformedState as Xa, redactedDockerCause as Xc, STATE_RESOURCES_MALFORMED as Xi, extractDeploymentEventError as Xn, noEchoLeavesOf as Xo, observeThenDisableInstanceApiTermination as Xr, S3StateBackend as Xs, updatePartialMessage as Xt, planOrphanAdoption as Y, refuseMalformedResourcesForExport as Ya, redactedCause as Yc, STATE_REGION_DIVERGED as Yi, storedSecretNameNeedles as Yn, noEchoCoordinatesOf as Yo, isTerminationProtectionPropagationError as Yr, isLockInfoExpired as Ys, redactedDeleteAddressSkip as Yt, DeploymentEventsStore as Z, repairMalformedOrphanRecordsForReadOnly as Za, runDockerForeground as Zc, UNREADABLE_ORPHANS_CONTAINER_ROW as Zi, ATOMIC_FINAL_SNAPSHOT_TYPES as Zn, noEchoOutputsComparison as Zo, reDisableInstanceApiTermination as Zr, rebuildClientForBucketRegion as Zs, updatePartialReason as Zt, deleteTableWithIndexBusyRetry as _, malformedOrphansWarning as _a, AssetPublisher as _c, assertFlagRoleArn as _i, stateBucketExistenceConfirmed as _l, DEFAULT_RESOURCE_TIMEOUT_MS as _n, isStatefulRecreateTargetSync as _o, refuseMalformedDesiredTags as _r, maskSecretsInError as _s, dropFailedHint as _t, isProtectionValueActive as a, isReadableOrphanRecord as aa, acceptedCreateOnlyDropsOf as ac, s3BucketDomainName as ai, Synthesizer as al, secretBearing as an, unreadableResourceEntries as ao, unsupportedFinalSnapshotError as ar, carryLogOnlyValues as as, dropSettledNestedJournals as at, S3_AUTO_DELETE_OBJECTS_TAG as b, malformedRenderedContainersWarning as ba, WorkGraph as bc, isIamRoleArn as bi, CFN_TEMPLATE_BODY_LIMIT as bl, constructPathOf as bn, coerceWarmThroughput as bo, definedAttributes as br, recordReferenceProvenanceEntry as bs, loadJournaledOrphans as bt, DynamoDBGlobalTableProvider as c, malformedExportNamesWarning as ca, hasReadableExportSet as cc, s3BucketWebsiteUrl as ci, getLegacyStateBucketName as cl, carriedExportAliasExposure as cn, findSilentDropProperties as co, reserveStackCreateToken as cr, literalSplitDelimitersOf as cs, recordDisplacedSkips as ct, compensateRemovedDeletionProtection as d, malformedLocalResourceEntriesWarning as da, importableOutputKeys as dc, refuseUnreadableCdkCrossAccountRefs as di, resolveAutoAssetStorage as dl, isWholeDynamicReferenceValue as dn, NO_CC_HANDLERS_REASON as do, isRefusedByName as dr, recordLogOnlyParameterValue as ds, withNestedRevertRun as dt, deployRefusesOrphanRowsReason as ea, applyCrossPrefixScan as ec, INTRINSIC_KEYS as ei, escapeRegExp$3 as el, reachableDivergentParameters as en, repairMalformedResourceEntriesForReadOnly as eo, ccRoutedFinalSnapshotError as er, readsNoEchoSource as es, keptForReadoption as et, deleteBudgetKey as f, malformedLocalResourcesWarning as fa, importableOutputs as fc, keepHeldTokenProvenance as fi, resolveCaptureObservedState as fl, noEchoParameterValueSeed as fn, hasNoCloudControlHandlers as fo, markDeleteStarted as fr, recordLogOnlyValue as fs, collectNestedChildUnaddressed as ft, INDEX_SETTLE_POLL_INTERVAL_MS as g, malformedOrphansRefusalMessage as ga, shouldRetainResource as gc, applyRoleArnIfSet as gi, resolveUseCdkBootstrapAssets as gl, bindingSkippedOutputs as gn, isStatefulRecreateTargetForReplace as go, readTagList as gr, errorCauseChain as gs, dropFailedCommands as gt, DELETE_INDEX_WAIT_PROCEED_NOTE as h, malformedOrphanRowsKeptWarning as ha, orphansCarriedFrom as hc, recordedReferenceRegions as hi, resolveStateBucketWithDefaultAndSource as hl, isExportAliasCollision as hn, MULTI_REGION_RECREATE_BLOCKED_TYPES as ho, planTagDiff as hr, createSecretMasker as hs, deleteJournaledOrphans as ht, PROTECTION_PROPERTY_BY_TYPE as i, hasReadableResources as ia, splitImportedOps as ic, s3BucketArn as ii, getDockerImageBySourceHash as il, exportAliasCollisionScrubWarning as in, unreadableOrphanRecords as io, refusesFinalSnapshot as ir, liveMatchesUnresolvedTokenFrame as is, displacedPhysicalIdShown as it, serviceTokenBlockingReason as j, refuseMalformedOrphans as ja, parseBootstrapMarker as jc, isUnboundTemplateParameter as ji, AssemblyReader as jl, green as jn, requireConfigArray as jo, getCurrentResourceSecrets as jr, recordNestedStackParameterExpressions as js, recordAfterRollbackUpdate as jt, deferredServiceTokenWarning as k, refuseMalformedOrphanRecords as ka, getBootstrapMarkerKey as kc, regionLessSecretName as ki, canonicalizeRegion as kl, cyan as kn, readConfigString as ko, readsNoEchoDeleteValues as kr, identityKeyFor as ks, replayRollback as kt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, malformedExportSourceWarning as la, hasReasonlessBaselineRefusal as lc, resolveDynamicReferences as li, loadCdkJson as ll, exportNameNoEchoParameters as ln, unwrittenCreateOnlyReplacement as lo, withCreateTokenLedger as lr, logOnlyValueCount as ls, revertNestedChildFromJournal as lt, resolveDynamoDbDeleteBudgetMs as m, malformedOrphanRecordsWarning as ma, orphansAfterRollback as mc, recordedOutputReferenceRegions as mi, resolveStateBucketWithDefault as ml, collectPublishedOutputNames as mn, shownType as mo, DBPROXY_TAG_OPTIONS as mr, unionOfSecretBags as ms, withNestedStackContext as mt, recordedProtectionEvidence as n, hasReadableOrphans as na, isAccessDenied$1 as nc, poisonRenderedSpellingsCollidingIn as ni, stripForDisplay as nl, WITHHELD_NAME_DISPLAY as nn, repairMalformedResourcesForReadOnly as no, effectiveDeletionPolicy as nr, valueAtCoordinate as ns, NESTED_PENDING_PARENT_REASON as nt, perType as o, isReadableResourceEntry as oa, describeRegionValueKind as oc, s3BucketDualStackDomainName as oi, synthesisStatusMessage as ol, secretBearingStateKeyWarning as on, withheldAccountClause as oo, earliestDefined as or, createUnionSecretMasker as os, getNestedRevertRun as ot, resolveDynamoDbDeleteBudgetClock as p, malformedOrphanRecordsRefusalMessage as pa, isReadableBag as pc, outputReferenceProvenanceOf as pi, resolveSkipPrefix as pl, collectDeclaredOutputNames as pn, findReplacedReadersOfRecreateTargets as po, DBPROXY_TAGS_WHAT as pr, shareLogOnlyValues as ps, getCurrentNestedStackContext as pt, makeCanonicalizePropertiesFn as q, refuseMalformedResourcesForDeploy as qa, partitionSensitiveEnv as qc, declaresNoEcho as qi, resolveBucketRegion as ql, secretNamedRecordNeedles as qn, maskWholeValue as qo, disableInstanceApiTermination as qr, isSingleDynamicReferenceToken as qs, isRedactedRecordedValue as qt, recordedProtectionNote as r, hasReadableOutputs as ra, isNotImplemented as rc, isSettledInstanceState as ri, AssetManifestLoader as rl, displayTextOrWithheld as rn, unpreviewableOrphanRecords as ro, isFinalSnapshotError as rr, redactForState as rs, displacedOpClause as rt, readProtection as s, malformedDriftResourcePropertiesWarning as sa, exportNamesCarriedFrom as sc, s3BucketRegionalDomainName as si, getDefaultStateBucketName as sl, secretSafeKeyDisplay as sn, findActionableSilentDrops as so, ledgerForStack as sr, hasMaskableValues as ss, nestedChildStackName as st, DeployEngine as t, displayLogicalId as ta, crossPrefixDeniedWarning as tc, IntrinsicFunctionResolver as ti, stripControlChars as tl, resourcesNamingDeclaredParameter as tn, repairMalformedResourcePropertiesForReadOnly as to, createPreDeleteFinalSnapshot as tr, recordedNoEchoValuesOf as ts, recordRetainedForReadoption as tt, beginDeleteWait as u, malformedLocalOutputsWarning as ua, hasUnverifiableParameterRefusal as uc, producerLookupOver as ui, resolveApp as ul, exportNameSecretExposure as un, withoutSilentDropProperties as uo, acquireIdempotencyToken as ur, printingCorpusOf as us, revertedNestedRowIds as ut, waitForIndexesSettled as v, malformedOutputsRefusalMessage as va, isSensitiveAttributeName as vc, assertSendableRoleArn as vi, warnDeprecatedNoPrefixCliFlag as vl, DEFAULT_RESOURCE_WARN_AFTER_MS as vn, renderStatefulReason as vo, tagMapAsList as vr, maskSecretsInText as vs, isHandledOrphan as vt, markRefusedBeforeApplying as w, malformedScrubResourceEntriesRefusalMessage as wa, rewriteTemplateAssetReferences as wc, callerEnvCredentials as wi, uploadCfnTemplate as wl, destroyStackRecordsView as wn, coerceCfnBoolean as wo, ccBrokenReason as wr, withoutPhysicalNameCopies as ws, chunks as wt, hasCdkAutoDeleteTag as x, malformedResourceEntriesWarning as xa, buildAssetRedirectMap as xc, sendableAssumeRoleCommand as xi, CFN_TEMPLATE_URL_LIMIT as xl, findDestructiveChanges as xn, isWarmThroughputDecrease as xo, stringifyIfAssigned as xr, snapshotPassProvenance as xs, makeForeignHolderScan as xt, ECR_AUTO_DELETE_IMAGES_TAG as y, malformedOutputsWarning as ya, stringifyValue as yc, explicitRoleArnOrThrow as yi, ssmResolvedValueType as yl, maskingRetryLogger as yn, WARM_THROUGHPUT_MEMBERS as yo, tagPlanWarning as yr, markSameGenerationBag as ys, journaledOrphanLines as yt, conditionInputsFrom as z, refuseMalformedResourceEntriesForDestroy as za, describeDockerExecFailure as zc, AWS_NO_VALUE as zi, absoluteAssemblyPathEscape as zl, completedReplayEntries as zn, lambdaFunctionNameForMask as zo, RollbackInlinePolicyWriters as zr, recordMaskOnlyValue as zs, replacementNeverSwapped as zt };
-//# sourceMappingURL=deploy-engine-D1z0QUsv.js.map
+export { resolvePendingCloudControlRequests as $, repairMalformedOutputsForReadOnly as $a, escapeRegExp$3 as $c, accountArgs as $i, buildFinalSnapshotIdentifier as $n, readbackPathFor as $o, DiffCalculator as $r, applyCrossPrefixScan as $s, namesAnyDeclaredParameter as $t, findServiceTokenRefusals as A, refuseMalformedOrphanRecordsForDestroy as Aa, parseBootstrapMarker as Ac, coerceParameterTypedValue as Ai, AssemblyReader as Al, gray as An, replayWarn as Ao, isCustomResourceType as Ar, inheritNestedStackParameterAssociations as As, removeProtectionTypeList as At, parentSuppliedValues as B, refuseMalformedResourceEntriesForImport as Ba, dockerSpawnEnvWithSensitive as Bc, cfnRefValueFromPhysicalId as Bi, displayAssemblyPath as Bl, journaledOrphanPrintingBag as Bn, sameLambdaFunctionAddress as Bo, UNSPECIFIED_SKIP_REASON as Br, recordMaskOnlyValuesIn as Bs, resolveReplacementOldType as Bt, getPriorAttempts as C, malformedResourcesWarning as Ca, rewriteTemplateAssetReferences as Cc, applyCallerIdentityCredentials as Ci, uploadCfnTemplate as Cl, awaitInFlightSibling as Cn, toFiniteNumber as Co, ProviderRegistry as Cr, withPhysicalNameCopies as Cs, formatResourceLine as Ct, crossStackOutputProvenanceSource as D, refuseDivergentRecordRegionForDestroy as Da, ensureAssetStorage as Dc, classifyReplaySecretRegion as Di, PARTITION_TABLE as Dl, replacedDeleteFailureVerdict as Dn, configIntegerRefusal as Do, waitForLambdaFunctionActive as Dr, isUncertifiedBaselineMaskPosition as Ds, withApiLimit as Dt, computeImplicitDeleteEdges as E, previewableOrphanRecords as Ea, assertAssetBucketRegion as Ec, classifyRecordedSecretRegion as Ei, expectedOwnerParam as El, withStackRecords as En, configBooleanRefusal as Eo, wouldReturnToSdkProvider as Er, dynamicReferenceTokens as Es, lookupEachName as Et, listNestedTemplateRows as F, refuseMalformedOutputsForDestroy as Fa, buildDockerImage as Fc, carriesDynamicReference as Fi, hasPlainPrototype$1 as Fl, noEchoComparisonForTemplate as Fn, templateResourceTypes as Fo, customResourceResponseExpirationWarning as Fr, recordPhysicalNameCopy as Fs, planFailedOps as Ft, keptWholeReasonText as G, refuseMalformedResourcePropertiesForExport as Ga, isMalformedEnvKey as Gc, parameterInputsFor as Gi, clearBucketRegionCache as Gl, secretNamePrintingBags as Gn, maskAtCoordinates as Go, isWaitAbandonedError as Gr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Gs, inheritProducerRegions as Gt, withResourceDeadline as H, refuseMalformedResourceEntriesForOrphan as Ha, formatDockerLoginError as Hc, refStateLookupFromResource as Hi, resolveAssemblyPath as Hl, namingSecretsWithRecordedNoEcho as Hn, TemplateParser as Ho, deleteLeftInPlace as Hr, recordNoEchoParameterFreshValue as Hs, orphanNeedsIdentity as Ht, renderNestedTemplateTreeDefect as I, refuseMalformedResourceAttributesForOrphan as Ia, resolveDockerContextDirectory as Ic, carriesFetchableDynamicReference as Ii, nullPrototypeRecord as Il, noEchoExactEchoLeavesOf as In, describeTypeWithThrottleRetry as Io, CloudControlProvider as Ir, splitGetAttStringForm as Is, planRollback as It, makeSiblingClaimReader as J, refuseMalformedResourcesForDestroy as Ja, redactedCause as Jc, JSON_LISTING_HOLE_VALUE as Ji, stateSecretNameNeedles as Jn, maskedLeafCoordinatesOf as Jo, ec2InstanceProtectionSite as Jr, isLockInfoExpired as Js, redactedDeleteAddressFields as Jt, mergeNoChangeOutputs as K, refuseMalformedResourcePropertiesForOrphan as Ka, partitionSensitiveEnv as Kc, passedParameterClassesOf as Ki, resolveBucketRegion as Kl, secretNamedAttributeNamesOf as Kn, maskReadbackAtCoordinates as Ko, markWaitAbandoned as Kr, isSingleDynamicReferenceToken as Ks, REDACTED_DELETE_ADDRESS_SKIP_REASON as Kt, templateIdentity as L, refuseMalformedResourceEntries as La, describeDockerCapturedOutput as Lc, isNamelessDynamicReferenceError as Li, ownValue as Ll, noEchoParameterNamesOf as Ln, withRetry as Lo, slowCcOperationTimeoutMs as Lr, carriesSecretMask as Ls, recheckFailedPlan as Lt, childTemplateLoader as M, refuseMalformedOrphansForDestroy as Ma, validateAssetBucketName as Mc, parameterTypeMayLoseSecretIdentity as Mi, processStackMessages as Ml, red as Mn, requireConfigObject as Mo, withPrintingSecrets as Mr, recoverMaskedOutput as Ms, demoteSupersededOrphans as Mt, findNestedTemplateTreeDefect as N, refuseMalformedOrphansForOrphan as Na, validateContainerRepoName as Nc, getAccountInfo as Ni, defineOwnKey as Nl, yellow as Nn, requireConfigString as No, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Nr, physicalNameCopiesOf as Ns, isJournaledOrphan as Nt, inheritedProvenanceForChildDiff as O, refuseMalformedNestedChildOutputs as Oa, getBootstrapMarkerKey as Oc, producerRegionsFromState as Oi, canonicalizeRegion as Ol, bold as On, configStringRefusal as Oo, TemplateNoEchoReresolver as Or, pathCrossesDottedKey as Os, replayFailedOperations as Ot, isAbsoluteAssetPath as P, refuseMalformedOutputs as Pa, buildDenyExternalAccessPolicy as Pc, isImpossibleEmptyStoredAttribute as Pi, hasOwnKey as Pl, noEchoAttributeNamesOf as Pn, prefetchCreateOnlyPropertyPaths as Po, applyCustomResourceResponseExpiration as Pr, recordAttributeIdCopy as Ps, isReplacementOrphan as Pt, pendingRequestCount as Q, repairMalformedOrphansForReadOnly as Qa, warnFinchArgvExposure as Qc, UNREADABLE_RESOURCES_MAP_ROW as Qi, PRE_DELETE_SNAPSHOT_TYPES as Qn, passedNoEchoParametersOf as Qo, reEnableInstanceApiTermination as Qr, CrossPrefixScanCache as Qs, computeParameterTaint as Qt, conditionFingerprint as R, refuseMalformedResourceEntriesForDeploy as Ra, describeDockerExecFailure as Rc, keepsSecretReferenceToken as Ri, absoluteAssemblyPathEscape as Rl, createReadOnlyAttributeHealerFactory as Rn, canonicalLambdaFunctionName as Ro, unchangedBehindSecretReference as Rr, provenPublicValue as Rs, recordUnderIdIsNotOwn as Rt, isTruthyCfnBoolean as S, malformedResourcePropertiesWarning as Sa, loadPublishableAssetManifest as Sc, AWS_CREDENTIAL_ENV_KEYS as Si, findLargeInlineResources as Sl, formatDestructiveChange as Sn, toCfnInteger as So, CC_BROKEN_REASON as Sr, scrubResourceRecord as Ss, sameJournaledOrphans as St, IMPLICIT_DELETE_DEPENDENCIES as T, malformedStateRefusalMessage as Ta, BOOTSTRAP_MARKER_PREFIX as Tc, envCredentialsAreAssumedRole as Ti, decodeListingKey as Tl, getStackRecords as Tn, coerceCfnInteger as To, isCustomResource as Tr, DYNAMIC_REFERENCE_TOKEN_SCAN as Ts, isAccessDeniedError as Tt, diffSecurity as U, refuseMalformedResourcePropertiesForDestroy as Ua, getDockerCmd as Uc, parseWebACLArn as Ui, injectAwsRegion as Ul, orphanRecordsPrintingBag as Un, canonicalCoordinates as Uo, deleteSkipReason as Ur, recordProvenPublicExpression as Us, findNestedStackTypeChanges as Ut, readRecordedConditionVerdicts as V, refuseMalformedResourceEntriesForImportSave as Va, finchSecretArgvRefusal as Vc, isStalePlaceholderArnAttribute as Vi, renderAssemblyPathEscape as Vl, maskEventTextWithBoundBags as Vn, DagBuilder as Vo, deleteIndeterminateGuards as Vr, recordNoEchoAttributeValues as Vs, seedsDeleteFirstGuard as Vt, isSecretBearingReferenceString as W, refuseMalformedResourcePropertiesForDrift as Wa, isDockerClientEnvKey as Wc, withSharedDrainBudget as Wi, injectedAwsRegionValue as Wl, secretNamePrintingBag as Wn, isMarkedCoordinate as Wo, withIndeterminateGuard as Wr, wholeStringLeavesOf as Ws, getCurrentProducerRegions as Wt, DeploymentEventsReader as X, refuseMalformedState as Xa, runDockerForeground as Xc, STATE_RESOURCES_MALFORMED as Xi, extractDeploymentEventError as Xn, noEchoLeavesOf as Xo, observeThenDisableInstanceApiTermination as Xr, rebuildClientForBucketRegion as Xs, updatePartialMessage as Xt, planOrphanAdoption as Y, refuseMalformedResourcesForExport as Ya, redactedDockerCause as Yc, STATE_REGION_DIVERGED as Yi, storedSecretNameNeedles as Yn, noEchoCoordinatesOf as Yo, isTerminationProtectionPropagationError as Yr, S3StateBackend as Ys, redactedDeleteAddressSkip as Yt, DeploymentEventsStore as Z, repairMalformedOrphanRecordsForReadOnly as Za, runDockerStreaming as Zc, UNREADABLE_ORPHANS_CONTAINER_ROW as Zi, ATOMIC_FINAL_SNAPSHOT_TYPES as Zn, noEchoOutputsComparison as Zo, reDisableInstanceApiTermination as Zr, CrossPrefixReadError as Zs, updatePartialReason as Zt, deleteTableWithIndexBusyRetry as _, malformedOrphansWarning as _a, isSensitiveAttributeName as _c, assertFlagRoleArn as _i, warnDeprecatedNoPrefixCliFlag as _l, DEFAULT_RESOURCE_TIMEOUT_MS as _n, isStatefulRecreateTargetSync as _o, refuseMalformedDesiredTags as _r, maskSecretsInText as _s, dropFailedHint as _t, isProtectionValueActive as a, isReadableOrphanRecord as aa, describeRegionValueKind as ac, s3BucketDomainName as ai, synthesisStatusMessage as al, secretBearing as an, unreadableResourceEntries as ao, unsupportedFinalSnapshotError as ar, createUnionSecretMasker as as, dropSettledNestedJournals as at, S3_AUTO_DELETE_OBJECTS_TAG as b, malformedRenderedContainersWarning as ba, buildAssetRedirectMap as bc, isIamRoleArn as bi, CFN_TEMPLATE_URL_LIMIT as bl, constructPathOf as bn, coerceWarmThroughput as bo, definedAttributes as br, snapshotPassProvenance as bs, loadJournaledOrphans as bt, DynamoDBGlobalTableProvider as c, malformedExportNamesWarning as ca, hasReasonlessBaselineRefusal as cc, s3BucketWebsiteUrl as ci, loadCdkJson as cl, carriedExportAliasExposure as cn, findSilentDropProperties as co, reserveStackCreateToken as cr, logOnlyValueCount as cs, recordDisplacedSkips as ct, compensateRemovedDeletionProtection as d, malformedLocalResourceEntriesWarning as da, importableOutputs as dc, refuseUnreadableCdkCrossAccountRefs as di, resolveCaptureObservedState as dl, isWholeDynamicReferenceValue as dn, NO_CC_HANDLERS_REASON as do, isRefusedByName as dr, recordLogOnlyValue as ds, withNestedRevertRun as dt, deployRefusesOrphanRowsReason as ea, crossPrefixDeniedWarning as ec, INTRINSIC_KEYS as ei, stripControlChars as el, reachableDivergentParameters as en, repairMalformedResourceEntriesForReadOnly as eo, ccRoutedFinalSnapshotError as er, readsNoEchoSource as es, keptForReadoption as et, deleteBudgetKey as f, malformedLocalResourcesWarning as fa, isReadableBag as fc, keepHeldTokenProvenance as fi, resolveSkipPrefix as fl, noEchoParameterValueSeed as fn, hasNoCloudControlHandlers as fo, markDeleteStarted as fr, shareLogOnlyValues as fs, collectNestedChildUnaddressed as ft, INDEX_SETTLE_POLL_INTERVAL_MS as g, malformedOrphansRefusalMessage as ga, AssetPublisher as gc, applyRoleArnIfSet as gi, stateBucketExistenceConfirmed as gl, bindingSkippedOutputs as gn, isStatefulRecreateTargetForReplace as go, readTagList as gr, maskSecretsInError as gs, dropFailedCommands as gt, DELETE_INDEX_WAIT_PROCEED_NOTE as h, malformedOrphanRowsKeptWarning as ha, shouldRetainResource as hc, recordedReferenceRegions as hi, resolveUseCdkBootstrapAssets as hl, isExportAliasCollision as hn, MULTI_REGION_RECREATE_BLOCKED_TYPES as ho, planTagDiff as hr, errorCauseChain as hs, deleteJournaledOrphans as ht, PROTECTION_PROPERTY_BY_TYPE as i, hasReadableResources as ia, acceptedCreateOnlyDropsOf as ic, s3BucketArn as ii, Synthesizer as il, exportAliasCollisionScrubWarning as in, unreadableOrphanRecords as io, refusesFinalSnapshot as ir, carryLogOnlyValues as is, displacedPhysicalIdShown as it, serviceTokenBlockingReason as j, refuseMalformedOrphans as ja, readBootstrapMarkerBody as jc, isUnboundTemplateParameter as ji, StageLoadError as jl, green as jn, requireConfigArray as jo, getCurrentResourceSecrets as jr, recordNestedStackParameterExpressions as js, recordAfterRollbackUpdate as jt, deferredServiceTokenWarning as k, refuseMalformedOrphanRecords as ka, isCrossRegionRedirect as kc, regionLessSecretName as ki, derivePartitionAndUrlSuffix as kl, cyan as kn, readConfigString as ko, readsNoEchoDeleteValues as kr, identityKeyFor as ks, replayRollback as kt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, malformedExportSourceWarning as la, hasUnverifiableParameterRefusal as lc, resolveDynamicReferences as li, resolveApp as ll, exportNameNoEchoParameters as ln, unwrittenCreateOnlyReplacement as lo, withCreateTokenLedger as lr, printingCorpusOf as ls, revertNestedChildFromJournal as lt, resolveDynamoDbDeleteBudgetMs as m, malformedOrphanRecordsWarning as ma, orphansCarriedFrom as mc, recordedOutputReferenceRegions as mi, resolveStateBucketWithDefaultAndSource as ml, collectPublishedOutputNames as mn, shownType as mo, DBPROXY_TAG_OPTIONS as mr, createSecretMasker as ms, withNestedStackContext as mt, recordedProtectionEvidence as n, hasReadableOrphans as na, isNotImplemented as nc, poisonRenderedSpellingsCollidingIn as ni, AssetManifestLoader as nl, WITHHELD_NAME_DISPLAY as nn, repairMalformedResourcesForReadOnly as no, effectiveDeletionPolicy as nr, valueAtCoordinate as ns, NESTED_PENDING_PARENT_REASON as nt, perType as o, isReadableResourceEntry as oa, exportNamesCarriedFrom as oc, s3BucketDualStackDomainName as oi, getDefaultStateBucketName as ol, secretBearingStateKeyWarning as on, withheldAccountClause as oo, earliestDefined as or, hasMaskableValues as os, getNestedRevertRun as ot, resolveDynamoDbDeleteBudgetClock as p, malformedOrphanRecordsRefusalMessage as pa, orphansAfterRollback as pc, outputReferenceProvenanceOf as pi, resolveStateBucketWithDefault as pl, collectDeclaredOutputNames as pn, findReplacedReadersOfRecreateTargets as po, DBPROXY_TAGS_WHAT as pr, unionOfSecretBags as ps, getCurrentNestedStackContext as pt, makeCanonicalizePropertiesFn as q, refuseMalformedResourcesForDeploy as qa, redactDockerArgvValues as qc, declaresNoEcho as qi, secretNamedRecordNeedles as qn, maskWholeValue as qo, disableInstanceApiTermination as qr, LockManager as qs, isRedactedRecordedValue as qt, recordedProtectionNote as r, hasReadableOutputs as ra, splitImportedOps as rc, isSettledInstanceState as ri, getDockerImageBySourceHash as rl, displayTextOrWithheld as rn, unpreviewableOrphanRecords as ro, isFinalSnapshotError as rr, liveMatchesUnresolvedTokenFrame as rs, displacedOpClause as rt, readProtection as s, malformedDriftResourcePropertiesWarning as sa, hasReadableExportSet as sc, s3BucketRegionalDomainName as si, getLegacyStateBucketName as sl, secretSafeKeyDisplay as sn, findActionableSilentDrops as so, ledgerForStack as sr, literalSplitDelimitersOf as ss, nestedChildStackName as st, DeployEngine as t, displayLogicalId as ta, isAccessDenied$1 as tc, IntrinsicFunctionResolver as ti, stripForDisplay as tl, resourcesNamingDeclaredParameter as tn, repairMalformedResourcePropertiesForReadOnly as to, createPreDeleteFinalSnapshot as tr, recordedNoEchoValuesOf as ts, recordRetainedForReadoption as tt, beginDeleteWait as u, malformedLocalOutputsWarning as ua, importableOutputKeys as uc, producerLookupOver as ui, resolveAutoAssetStorage as ul, exportNameSecretExposure as un, withoutSilentDropProperties as uo, acquireIdempotencyToken as ur, recordLogOnlyParameterValue as us, revertedNestedRowIds as ut, waitForIndexesSettled as v, malformedOutputsRefusalMessage as va, stringifyValue as vc, assertSendableRoleArn as vi, ssmResolvedValueType as vl, DEFAULT_RESOURCE_WARN_AFTER_MS as vn, renderStatefulReason as vo, tagMapAsList as vr, markSameGenerationBag as vs, isHandledOrphan as vt, markRefusedBeforeApplying as w, malformedScrubResourceEntriesRefusalMessage as wa, AssetModeResolver as wc, callerEnvCredentials as wi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as wl, destroyStackRecordsView as wn, coerceCfnBoolean as wo, ccBrokenReason as wr, withoutPhysicalNameCopies as ws, chunks as wt, hasCdkAutoDeleteTag as x, malformedResourceEntriesWarning as xa, createAssetRedirectResolver as xc, sendableAssumeRoleCommand as xi, MIGRATE_TMP_PREFIX as xl, findDestructiveChanges as xn, isWarmThroughputDecrease as xo, stringifyIfAssigned as xr, redactForState as xs, makeForeignHolderScan as xt, ECR_AUTO_DELETE_IMAGES_TAG as y, malformedOutputsWarning as ya, WorkGraph as yc, explicitRoleArnOrThrow as yi, CFN_TEMPLATE_BODY_LIMIT as yl, maskingRetryLogger as yn, WARM_THROUGHPUT_MEMBERS as yo, tagPlanWarning as yr, recordReferenceProvenanceEntry as ys, journaledOrphanLines as yt, conditionInputsFrom as z, refuseMalformedResourceEntriesForDestroy as za, describeDockerFailure as zc, AWS_NO_VALUE as zi, describeFileReadFailure as zl, completedReplayEntries as zn, lambdaFunctionNameForMask as zo, RollbackInlinePolicyWriters as zr, recordMaskOnlyValue as zs, replacementNeverSwapped as zt };
+//# sourceMappingURL=deploy-engine-zLKsm0IM.js.map