@go-to-k/cdkd 0.301.6 → 0.301.8

package/dist/{deploy-engine-D1z0QUsv.js → deploy-engine-6bGIDa7Z.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-B_CEQGE1.js";
 import { A as UNRENDERABLE, B as safeMsg, C as looksLikeCdkdGeneratedName, D as SAFE_MSG_ALTERED_CHAR, E as withoutGeneratedFallbackName, F as displaySafe, H as terminalSafe, I as displayStackName, L as isPasteableIdent, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, S as getCurrentStackName, T as withStackName, U as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, j as asIsMessage, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $ as protectedReplacementAdvice, $t as ambientCredentialConfig, A as isQuotableImportValue, An as SHELL_ACTIVE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, Ct as RETRY_AUXILIARY_OWNER, Dn as normalizeAwsError, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as isUpdateUnsupportedError, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as withheldTargetClause, Ht as recoveryCommandFlags, In as pasteableCommand, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as isNameCooldownError, Kn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as physicalIdShownBesideCommand, M as quotedRemedyLogicalId, Mn as UNSHOWABLE_VALUE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Ot as hasCreatedBeforeFailure, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qn as markReplayMayCollide, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as plainOrDescribed, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Ut as sanitizeRecoveryValue, Vn as shellQuote, Vt as formatLockOwner, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isReplayedNameCollisionFrom, Yn as isRecreateRetryableError, Yt as producerRecordKey, Zt as withPasteableAwsProfile, _t as createMaskedLogSinks, ar as isRetryableTransientError, at as startInterruptWatch, bn as ResourceUpdateNotSupportedError, bt as maskDeep, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dr as markNonRetryable, en as clientDefaultsFor, er as formatRetryClassificationSignals, f as removalWarning, fr as markRedactedCause, ft as logicalIdShown, gt as stateOrphanRecordRemedy, hn as MalformedProducerRecordRefusalError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isIamPropagationError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as SHELL_ACTIVE_WHY, jt as markAuxiliaryFailure, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DynamicReferenceRegionAmbiguousError, lr as isMarkedNonRetryable, m as withoutInjectedRemovals, mn as MacroExpansionError, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as isAmbiguousOutcomeError, on as CrossAccountSecretRefusalError, or as isTransientServerError, ot as ElapsedBudgetRegistry, pn as LockError, pr as wrapMaskedAwsError, qn as isNameCollisionErrorFrom, rn as AssetError, sn as DependencyError, sr as retryClassificationText, st as monotonicNowMs, tn as credentialFingerprint, tr as isAmbiguousCcHandlerErrorCode, un as IntrinsicResolutionRefusalError, ur as isThrottlingError, ut as compositeIdSeparatorRefusal, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as SynthesisError, wt as carryCreatedBeforeFailure, xt as maskerOrIdentity, yn as ResourceTimeoutError, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-BkeM7IXi.js";
+import { $ as protectedReplacementAdvice, $n as markReplayMayCollide, $t as ambientCredentialConfig, A as isQuotableImportValue, An as SHELL_ACTIVE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, Ct as RETRY_AUXILIARY_OWNER, Dn as normalizeAwsError, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as isUpdateUnsupportedError, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as withheldTargetClause, Ht as recoveryCommandFlags, In as pasteableCommand, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as isNameCollisionErrorFrom, Kn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as physicalIdShownBesideCommand, M as quotedRemedyLogicalId, Mn as UNSHOWABLE_VALUE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Ot as hasCreatedBeforeFailure, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as plainOrDescribed, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Ut as sanitizeRecoveryValue, Vn as shellQuote, Vt as formatLockOwner, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isRecreateRetryableError, Yn as isNameCooldownError, Yt as producerRecordKey, Zn as isReplayedNameCollisionFrom, Zt as withPasteableAwsProfile, _t as createMaskedLogSinks, at as startInterruptWatch, bn as ResourceUpdateNotSupportedError, bt as maskDeep, cr as isTransientServerError, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dr as isMarkedNonRetryable, en as clientDefaultsFor, f as removalWarning, fr as isThrottlingError, ft as logicalIdShown, gt as stateOrphanRecordRemedy, hn as MalformedProducerRecordRefusalError, hr as wrapMaskedAwsError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isAmbiguousOutcomeError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as SHELL_ACTIVE_WHY, jt as markAuxiliaryFailure, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DynamicReferenceRegionAmbiguousError, lr as retryClassificationText, m as withoutInjectedRemovals, mn as MacroExpansionError, mr as markRedactedCause, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as formatRetryClassificationSignals, on as CrossAccountSecretRefusalError, or as isIamPropagationError, ot as ElapsedBudgetRegistry, pn as LockError, pr as markNonRetryable, rn as AssetError, rr as isAmbiguousCcHandlerErrorCode, sn as DependencyError, sr as isRetryableTransientError, st as monotonicNowMs, tn as credentialFingerprint, un as IntrinsicResolutionRefusalError, ut as compositeIdSeparatorRefusal, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as SynthesisError, wt as carryCreatedBeforeFailure, xt as maskerOrIdentity, yn as ResourceTimeoutError, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-DJmfxbko.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-DBXBcg0J.js";
-import { t as getCdkdVersion } from "./version-CnjZ9J4l.js";
+import { t as getCdkdVersion } from "./version-B3HWuj22.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7429,6 +7429,13 @@ function recordProvenPublicExpression(bag, expression, value) {
 	if (prior === false) return;
 	proofs.set(expression, prior === void 0 || prior === value ? value : false);
 }
+function sharePublicProofs(view, pass) {
+	provenPublicExpressions.set(view, proofsOf(pass));
+}
+function carryPublicProofs(from, to) {
+	for (const [expression, value] of provenPublicExpressions.get(from) ?? []) if (value === false) contradictProvenPublicExpression(to, expression);
+	else recordProvenPublicExpression(to, expression, value);
+}
 function contradictProvenPublicExpression(bag, expression) {
 	proofsOf(bag).set(expression, false);
 }
@@ -7748,7 +7755,10 @@ function certifiedExpressionForLeaf(secrets, association, leaf) {
 function certifiedListForLeaf(secrets, association, bag) {
 	const certified = bag.map((element) => certifiedExpressionForLeaf(secrets, association, element));
 	if (certified.every((expression) => expression === void 0)) return void 0;
-	return bag.map((element, i) => certified[i] ?? redactSecretsForState(element, secrets));
+	return bag.map((element, i) => certified[i] ?? redactForState(element, {
+		provenance: "value-scan",
+		secrets
+	}));
 }
 function associationForSource(source, secrets) {
 	const key = crossStackSourceKey(source);
@@ -7972,7 +7982,7 @@ const NESTED_STACK_RESOURCE_TYPE$4 = "AWS::CloudFormation::Stack";
 const nestedStackParameterExpressions = /* @__PURE__ */ new WeakMap();
 const renderedParameterSpellings = /* @__PURE__ */ new WeakMap();
 const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
-function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, rules = TEMPLATE_DERIVED_RULES) {
+function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, provenance = "template-derived") {
 	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$4) return;
 	if (secrets.size === 0) return;
 	if (!isPlainObject$7(resolvedProperties) || !isPlainObject$7(sourceProperties)) return;
@@ -7981,7 +7991,7 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 	const resolvedParameters = resolvedProperties["Parameters"];
 	const sourceParameters = sourceProperties["Parameters"];
 	if (!isPlainObject$7(resolvedParameters) || !isPlainObject$7(sourceParameters)) return;
-	const positioned = redactSecretsForState(markSameGenerationBag({ ...resolvedParameters }), secrets, sourceParameters, rules);
+	const positioned = redactAtProvenance({ ...resolvedParameters }, secrets, sourceParameters, provenance, true);
 	let table = nestedStackParameterExpressions.get(secrets);
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
 		const sourceLeaf = sourceParameters[name];
@@ -8074,7 +8084,10 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 		if (typeof resolvedValue !== "string") continue;
 		const spelling = certifiedSpellingOf(name);
 		if (spelling === void 0) continue;
-		if (redactSecretsForState(resolvedValue, secrets) !== resolvedValue) continue;
+		if (redactForState(resolvedValue, {
+			provenance: "value-scan",
+			secrets
+		}) !== resolvedValue) continue;
 		const frame = singleSpanFrame(resolvedValue, spelling);
 		if (frame === void 0 || resolvedPlaintextOf(secrets, frame.token) !== frame.middle) continue;
 		if (framesByValue.get(resolvedValue)?.size !== 1) continue;
@@ -8165,7 +8178,10 @@ function inheritedRenderedSpan(childSecrets, key, text) {
 		if (carriesChildOnlyPlaintext(value, childSecrets, reads.parent)) return void 0;
 		const spelling = inheritedParameterExpression(reads.parent, name, value);
 		if (typeof spelling !== "string") return void 0;
-		if (redactSecretsForState(spelling, childSecrets) !== spelling) return void 0;
+		if (redactForState(spelling, {
+			provenance: "value-scan",
+			secrets: childSecrets
+		}) !== spelling) return void 0;
 		return {
 			value,
 			spelling
@@ -8212,7 +8228,10 @@ function recordInheritedParameterRead(childSecrets, parentSecrets, parameterName
 	parameterReadsFor(childSecrets, parentSecrets)?.names.add(parameterName);
 }
 function redactInheritedParameterValue(parentSecrets, parameterName, value) {
-	return inheritedParameterExpression(parentSecrets, parameterName, value) ?? redactSecretsForState(value, parentSecrets);
+	return inheritedParameterExpression(parentSecrets, parameterName, value) ?? redactForState(value, {
+		provenance: "value-scan",
+		secrets: parentSecrets
+	});
 }
 function positionByInheritedParameter(bag, source, secrets) {
 	const keys = Object.keys(source);
@@ -8224,7 +8243,10 @@ function positionByInheritedParameter(bag, source, secrets) {
 	if (typeof bag !== "string" && !Array.isArray(bag)) return void 0;
 	if (carriesChildOnlyPlaintext(bag, secrets, reads.parent)) return void 0;
 	const answer = redactInheritedParameterValue(reads.parent, name, bag);
-	if (!deepEqualJsonValue(redactSecretsForState(answer, secrets), answer)) return void 0;
+	if (!deepEqualJsonValue(redactForState(answer, {
+		provenance: "value-scan",
+		secrets
+	}), answer)) return void 0;
 	return answer;
 }
 const REREAD_PSEUDO_PARAMETERS = /* @__PURE__ */ new Set([
@@ -8444,7 +8466,10 @@ function holdsRereadTrigger(node, depth = 0) {
 }
 function rendersReadTo(spelling, parentSecrets, value) {
 	if (typeof spelling === "string" && typeof value === "string") {
-		if (spelling === value) return redactSecretsForState(spelling, parentSecrets) === spelling;
+		if (spelling === value) return redactForState(spelling, {
+			provenance: "value-scan",
+			secrets: parentSecrets
+		}) === spelling;
 		return rendersLiteralTo(spelling, parentSecrets, value);
 	}
 	if (Array.isArray(spelling) && Array.isArray(value) && spelling.length === value.length) return spelling.every((element, i) => rendersReadTo(element, parentSecrets, value[i]));
@@ -8552,7 +8577,10 @@ function positionByParameterReread(bag, source, secrets) {
 		answer = matching[0].redacted;
 	}
 	if (carriesChildOnlyPlaintext(bag, secrets, reads.parent)) return void 0;
-	if (!deepEqualJsonValue(redactSecretsForState(answer, secrets), answer)) return void 0;
+	if (!deepEqualJsonValue(redactForState(answer, {
+		provenance: "value-scan",
+		secrets
+	}), answer)) return void 0;
 	return answer;
 }
 function carriesChildOnlyPlaintext(value, childSecrets, parentSecrets) {
@@ -8720,7 +8748,10 @@ function positionByParameterPlaceholders(bag, source, secrets) {
 		if (bag.length < before[0].length + after[0].length) return void 0;
 		if (!bag.startsWith(before[0]) || !bag.endsWith(after[0])) return void 0;
 		const middle = bag.slice(before[0].length, bag.length - after[0].length);
-		if (redactSecretsForState(middle, secrets) !== middle) return void 0;
+		if (redactForState(middle, {
+			provenance: "value-scan",
+			secrets
+		}) !== middle) return void 0;
 		persisted = before[1] + middle + after[1];
 	}
 	const afterStart = bag.length - after[0].length;
@@ -8734,7 +8765,10 @@ function acceptedPlaceholderRendering(bag, persisted, spans, secrets) {
 			for (const [start, length] of spans) if (at < start + length && end > start && (at < start || end > start + length)) return void 0;
 		}
 	}
-	if (redactSecretsForState(persisted, secrets) !== persisted) return void 0;
+	if (redactForState(persisted, {
+		provenance: "value-scan",
+		secrets
+	}) !== persisted) return void 0;
 	return persisted;
 }
 function positionByRecordedParameterSpans(bag, source, secrets, associations) {
@@ -8764,7 +8798,10 @@ function positionByRecordedParameterSpans(bag, source, secrets, associations) {
 	const tail = bag.slice(cursor);
 	gaps.push(tail);
 	persisted += tail;
-	for (const gap of gaps) if (redactSecretsForState(gap, secrets) !== gap) return void 0;
+	for (const gap of gaps) if (redactForState(gap, {
+		provenance: "value-scan",
+		secrets
+	}) !== gap) return void 0;
 	return acceptedPlaceholderRendering(bag, persisted, certified, secrets);
 }
 
@@ -8874,7 +8911,10 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 	if (isDynamicReferenceString(source) && typeof bag === "string") {
 		if (isSingleDynamicReferenceToken(source) && (rules.trustAnyExpression || isKnownSecretExpression(source, secretExpressions))) {
 			if (!rules.sourceIsSameGeneration && isSingleDynamicReferenceToken(bag)) {
-				if (!spanNamesResolvableService(bag)) return redactSecretsForState(bag, secrets);
+				if (!spanNamesResolvableService(bag)) return redactForState(bag, {
+					provenance: "value-scan",
+					secrets
+				});
 				return secrets.get(bag) ?? bag;
 			}
 			return source;
@@ -8920,7 +8960,10 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 				const j = partnerIndex[i];
 				if (j >= 0) return redactByPath(item, source[j], secrets, rules, secretExpressions, bagIsSameGeneration);
 				if (positionalIsExact) return redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration);
-				return redactSecretsForState(item, secrets);
+				return redactForState(item, {
+					provenance: "value-scan",
+					secrets
+				});
 			});
 		}
 		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration));
@@ -8931,10 +8974,16 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 	}
 	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source)) {
 		const out = Object.create(null);
-		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactSecretsForState(v, secrets);
+		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactForState(v, {
+			provenance: "value-scan",
+			secrets
+		});
 		return out;
 	}
-	return redactSecretsForState(bag, secrets);
+	return redactForState(bag, {
+		provenance: "value-scan",
+		secrets
+	});
 }
 function isReadbackProjectedFromState(rules) {
 	return rules.trustAnyExpression && !rules.descendArrays && rules.sourceIsSameGeneration;
@@ -9247,20 +9296,23 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 
 //#endregion
 //#region src/deployment/secret-redaction/redact-state.ts
-function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RULES) {
-	return flattenEmbeddedNoEchoLeaves(redactSecretsForStatePasses(bag, secrets, source, rules), secrets);
+function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RULES, bagIsSameGeneration = false) {
+	return flattenEmbeddedNoEchoLeaves(redactSecretsForStatePasses(bag, secrets, source, rules, bagIsSameGeneration), secrets);
 }
-function redactSecretsForStatePasses(bag, secrets, source, rules) {
+function redactSecretsForStatePasses(bag, secrets, source, rules, bagIsSameGeneration) {
 	if (secrets.size === 0 && source === void 0) return bag;
 	if (source !== void 0) {
-		const positioned = redactByPath(bag, source, secrets, rules, recordedExpressionsOf(secrets), isSameGenerationBag(bag));
+		const positioned = redactByPath(bag, source, secrets, rules, recordedExpressionsOf(secrets), bagIsSameGeneration);
 		if (!isReadbackProjectedFromState(rules)) return positioned;
 		const failClosed = rules.failClosedOnUncertifiedPositions === true;
 		const refused = refuseUncertifiedReadbackPositions(positioned, source, secrets, failClosed);
 		const derived = deriveReadbackNeedles(bag, source, secrets, rules);
 		if (derived === void 0) return refused;
 		const marks = refuseUncertifiedReadbackPositions(positioned, source, secrets, failClosed, void 0, true);
-		return preferPositionDecisions(redactSecretsForState(bag, derived.certain), refused, bag, marks, derived.inferred);
+		return preferPositionDecisions(redactForState(bag, {
+			provenance: "value-scan",
+			secrets: derived.certain
+		}), refused, bag, marks, derived.inferred);
 	}
 	const regex = buildNeedleRegex(substringNeedlesOf(secrets));
 	const wholeValueExpr = (s) => s === "" ? void 0 : secrets.get(s);
@@ -9426,18 +9478,29 @@ function redactOverlappingMatches(value, matches, redacted, expressionFor) {
 	}
 	return out + value.slice(cursor);
 }
-function scrubResourceRecord(record, secrets, sourceProperties, observedRules) {
+function scrubResourceRecord(record, secrets, sourceProperties, observedProvenance, claims = {}) {
+	const propertiesClaimed = claims.properties === "same-generation";
+	const observedClaimed = claims.observed === "same-generation";
 	if (secrets.size === 0 && sourceProperties === void 0 && !record.observedProperties) return record;
 	const next = { ...record };
-	next.properties = redactSecretsForState(record.properties, secrets, sourceProperties);
+	next.properties = sourceProperties === void 0 ? redactForState(record.properties, {
+		provenance: "value-scan",
+		secrets
+	}) : redactAtProvenance(record.properties, secrets, sourceProperties, "template-derived", propertiesClaimed);
 	if (record.attributes) {
 		const ownId = record.physicalId;
 		const ids = [...attributeIdCopiesOf.get(secrets) ?? []];
 		if (typeof ownId === "string" && ownId !== "") ids.push(ownId);
 		const attributes = record.attributes;
-		next.attributes = ids.length > 0 ? withPhysicalNameCopies(secrets, ids, () => redactSecretsForState(attributes, secrets)) : redactSecretsForState(attributes, secrets);
+		next.attributes = ids.length > 0 ? withPhysicalNameCopies(secrets, ids, () => redactForState(attributes, {
+			provenance: "value-scan",
+			secrets
+		})) : redactForState(attributes, {
+			provenance: "value-scan",
+			secrets
+		});
 	}
-	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets, sourceProperties ?? next.properties, observedRules ?? (sourceProperties !== void 0 ? TEMPLATE_SOURCED_RULES : secrets.size === 0 && isSameGenerationBag(record.observedProperties) ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES));
+	if (record.observedProperties) next.observedProperties = redactAtProvenance(record.observedProperties, secrets, sourceProperties ?? next.properties, observedProvenance ?? (sourceProperties !== void 0 ? "template-sourced" : secrets.size === 0 && observedClaimed ? "state-baseline" : "state-readback"), observedClaimed);
 	return next;
 }
 function withoutPhysicalNameCopies(secrets, run) {
@@ -9499,7 +9562,10 @@ function embeddedPhysicalNameRewrites(secrets, legacySecrets = secrets) {
 	const pairs = [];
 	withoutPhysicalNameCopies(legacySecrets, () => {
 		for (const name of names) {
-			const legacy = redactSecretsForState(name, legacySecrets);
+			const legacy = redactForState(name, {
+				provenance: "value-scan",
+				secrets: legacySecrets
+			});
 			if (typeof legacy === "string" && legacy !== name && legacy.includes("{{resolve:") && !isSingleDynamicReferenceToken(legacy) && !legacy.includes("***")) pairs.push([legacy, name]);
 		}
 	});
@@ -9568,6 +9634,598 @@ function repairEmbeddedPhysicalNamesTowards(stored, target, pairs) {
 	return stored;
 }
 
+//#endregion
+//#region src/deployment/secret-redaction/mask-errors.ts
+function maskSecretsInText(text, secrets) {
+	const logOnly = logOnlyValuesOf.get(secrets);
+	const noLogOnly = logOnly === void 0 || logOnly.size === 0;
+	if (secrets.size === 0 && noLogOnly) return text;
+	if (text !== "" && (secrets.has(text) || logOnly?.has(text) === true)) return "***";
+	return maskMatchSpans(text, printingNeedles(noLogOnly ? secrets.keys() : [...secrets.keys(), ...logOnly]), "***");
+}
+function maskRecordedSecretsInText(text, secrets) {
+	if (secrets.size === 0) return text;
+	if (text !== "" && secrets.has(text)) return "***";
+	return maskMatchSpans(text, substringNeedles(secrets.keys()), "***");
+}
+function substringNeedles(values) {
+	return [...new Set(values)].filter((value) => value.length >= 4);
+}
+const ERROR_CAUSE_MASK_MAX_DEPTH = 20;
+function errorCauseChain(root) {
+	const chain = [];
+	const seen = /* @__PURE__ */ new Set();
+	let current = root;
+	while (current instanceof Error && !seen.has(current) && chain.length < 20) {
+		seen.add(current);
+		chain.push(current);
+		current = current.cause;
+	}
+	return chain;
+}
+function readStack(error) {
+	try {
+		const stack = error.stack;
+		return typeof stack === "string" ? stack : void 0;
+	} catch {
+		return;
+	}
+}
+function maskDescriptorValue(descriptor, maskText) {
+	if (!("value" in descriptor)) return descriptor;
+	const value = maskErrorFieldValue(descriptor.value, maskText);
+	return value === descriptor.value ? descriptor : {
+		...descriptor,
+		value
+	};
+}
+const CLASSIFIER_IDENTIFIER_FIELDS = /* @__PURE__ */ new Set([
+	"name",
+	"code",
+	"Code",
+	"__type",
+	"ccErrorCode",
+	"ccOperation"
+]);
+function isAuxiliaryAnchor(key, descriptor) {
+	return key === "logicalId" && descriptor.enumerable === false && descriptor.writable === false && typeof descriptor.value === "string" && descriptor.value.endsWith("/auxiliary");
+}
+const CREATED_BEFORE_FAILURE_MARK = Symbol.for("cdkd.createdBeforeFailure");
+function isCreatedBeforeFailureMark(key, descriptor) {
+	return key === CREATED_BEFORE_FAILURE_MARK && descriptor.enumerable === false && descriptor.writable === false && typeof descriptor.value === "object" && descriptor.value !== null && Object.isFrozen(descriptor.value);
+}
+function isPlainContainer(value) {
+	const proto = Object.getPrototypeOf(value);
+	return Array.isArray(value) ? proto === Array.prototype : proto === Object.prototype || proto === null;
+}
+function readFieldNode(node) {
+	try {
+		if (!isPlainContainer(node)) return void 0;
+		const entries = [];
+		for (const key of Reflect.ownKeys(node)) {
+			const descriptor = Object.getOwnPropertyDescriptor(node, key);
+			if (descriptor) entries.push([key, descriptor]);
+		}
+		const isArray = Array.isArray(node);
+		return {
+			proto: Object.getPrototypeOf(node),
+			isArray,
+			length: isArray ? Object.getOwnPropertyDescriptor(node, "length") : void 0,
+			extensible: Object.isExtensible(node),
+			entries
+		};
+	} catch {
+		return;
+	}
+}
+function maskErrorFieldValue(value, maskText) {
+	if (typeof value === "string") return maskText(value);
+	if (typeof value !== "object" || value === null) return value;
+	try {
+		const nodes = /* @__PURE__ */ new Map();
+		const seen = /* @__PURE__ */ new Set();
+		let changed = false;
+		let frontier = [value];
+		for (let depth = 0; frontier.length > 0 && depth < 20; depth++) {
+			const next = [];
+			for (const node of frontier) {
+				if (seen.has(node)) continue;
+				seen.add(node);
+				const read = readFieldNode(node);
+				if (!read) continue;
+				nodes.set(node, read);
+				for (const [, descriptor] of read.entries) {
+					if (!("value" in descriptor)) continue;
+					const child = descriptor.value;
+					if (typeof child === "string") {
+						if (!changed && maskText(child) !== child) changed = true;
+					} else if (typeof child === "object" && child !== null) next.push(child);
+				}
+			}
+			frontier = next;
+		}
+		if (!changed) return value;
+		const copies = /* @__PURE__ */ new Map();
+		for (const [node, read] of nodes) copies.set(node, read.isArray ? new Array(read.length?.value ?? 0) : Object.create(read.proto));
+		for (const [node, read] of nodes) {
+			const copy = copies.get(node);
+			for (const [key, original] of read.entries) {
+				if (key === "length" && read.isArray) continue;
+				const descriptor = { ...original };
+				if ("value" in descriptor) {
+					const child = descriptor.value;
+					if (typeof child === "string") descriptor.value = maskText(child);
+					else if (typeof child === "object" && child !== null && copies.has(child)) descriptor.value = copies.get(child);
+				}
+				Object.defineProperty(copy, key, descriptor);
+			}
+			if (read.length?.writable === false) Object.defineProperty(copy, "length", { writable: false });
+			if (!read.extensible) Object.preventExtensions(copy);
+		}
+		return copies.get(value) ?? value;
+	} catch {
+		return value;
+	}
+}
+function maskSecretsInError(error, secrets, extraMask) {
+	if (!(error instanceof Error) || !hasMaskableValues(secrets) && !extraMask) return error;
+	const maskText = (text) => maskSecretsInText(extraMask ? extraMask(text) : text, secrets);
+	const chain = errorCauseChain(error);
+	let changed = false;
+	const links = chain.map((link) => {
+		const message = maskText(link.message);
+		const stack = readStack(link);
+		const maskedStack = typeof stack === "string" ? maskText(stack) : void 0;
+		const descriptors = {};
+		for (const key of Reflect.ownKeys(link)) {
+			if (key === "message" || key === "cause" || key === "stack") continue;
+			const descriptor = Object.getOwnPropertyDescriptor(link, key);
+			if (!descriptor) continue;
+			descriptors[key] = typeof key === "string" && CLASSIFIER_IDENTIFIER_FIELDS.has(key) && typeof descriptor.value === "string" || isAuxiliaryAnchor(key, descriptor) || isCreatedBeforeFailureMark(key, descriptor) ? descriptor : maskDescriptorValue(descriptor, maskText);
+			if (descriptors[key] !== descriptor) changed = true;
+		}
+		let cause = Object.getOwnPropertyDescriptor(link, "cause");
+		if (cause && !("value" in cause && cause.value instanceof Error)) {
+			const masked = maskDescriptorValue(cause, maskText);
+			if (masked !== cause) changed = true;
+			cause = masked;
+		}
+		if (message !== link.message || maskedStack !== stack) changed = true;
+		return {
+			message,
+			stack: maskedStack,
+			descriptors,
+			cause
+		};
+	});
+	if (!changed) return error;
+	const clones = /* @__PURE__ */ new Map();
+	for (const [i, original] of chain.entries()) {
+		const { message, stack, descriptors } = links[i];
+		const clone = Object.create(Object.getPrototypeOf(original), descriptors);
+		Object.defineProperty(clone, "message", {
+			value: message,
+			writable: true,
+			enumerable: false,
+			configurable: true
+		});
+		if (stack !== void 0) Object.defineProperty(clone, "stack", {
+			value: stack,
+			writable: true,
+			enumerable: false,
+			configurable: true
+		});
+		clones.set(original, clone);
+	}
+	for (const [i, original] of chain.entries()) {
+		const causeDescriptor = links[i].cause;
+		if (!causeDescriptor) continue;
+		const clone = clones.get(original);
+		const causeValue = original.cause;
+		const replacement = causeValue instanceof Error ? clones.get(causeValue) : void 0;
+		Object.defineProperty(clone, "cause", replacement ? {
+			value: replacement,
+			writable: true,
+			enumerable: causeDescriptor.enumerable === true,
+			configurable: true
+		} : causeDescriptor);
+	}
+	return clones.get(error);
+}
+function createSecretMasker(secrets) {
+	return (text) => maskSecretsInText(text, secrets);
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/log-only.ts
+const logOnlyValuesOf = /* @__PURE__ */ new WeakMap();
+function recordLogOnlyValue(secrets, plaintext) {
+	if (plaintext === "") return;
+	sideSetOf(logOnlyValuesOf, secrets).add(plaintext);
+}
+function carryLogOnlyValues(from, to) {
+	const values = logOnlyValuesOf.get(from);
+	if (values === void 0 || values.size === 0) return;
+	const into = sideSetOf(logOnlyValuesOf, to);
+	for (const value of values) into.add(value);
+}
+function carryLogOnlyValuesCarriedBy(from, to, value) {
+	const values = logOnlyValuesOf.get(from);
+	if (values === void 0 || values.size === 0) return;
+	const leaves = printedLeavesOf(value);
+	if (leaves.size === 0) return;
+	for (const needle of values) for (const leaf of leaves) if (leaf === needle || needle.length >= 4 && leaf.includes(needle)) {
+		recordLogOnlyValue(to, needle);
+		break;
+	}
+	carryListElementFragments(values, to, value);
+}
+function carryListElementFragments(needles, to, value) {
+	if (!Array.isArray(value) || value.length === 0) return;
+	if (!value.every((e) => typeof e === "string" || typeof e === "number" || typeof e === "boolean")) return;
+	const numeric = value.every((element) => typeof element === "number");
+	const joined = value.map((element) => String(element)).join(",");
+	for (const needle of [...needles]) {
+		const pieces = needle.split(",").map((piece) => piece.trim());
+		if (numeric && pieces.every((piece) => piece === "" || Number.isNaN(Number(piece)))) continue;
+		const fragments = fragmentsOfNeedleIn(joined, ",", pieces.map((piece) => numeric ? String(Number(piece)) : piece).join(","));
+		if (fragments.size === 0) continue;
+		recordLogOnlyValue(to, needle);
+		for (const fragment of fragments) recordLogOnlyValue(to, fragment);
+	}
+}
+function recordLogOnlySplitFragments(from, to, text, delimiter, printed) {
+	if (delimiter === "") return;
+	const splits = [text.split(delimiter)];
+	if (printed !== void 0 && (printed.length !== splits[0].length || printed.some((piece, i) => piece !== splits[0][i]))) splits.push(printed);
+	for (const bag of from) {
+		if (bag === void 0) continue;
+		for (const needle of [...logOnlyValuesOf.get(bag) ?? []]) for (const pieces of splits) for (const fragment of fragmentsOfNeedleIn(text, delimiter, needle, pieces)) if (fragment !== needle) recordLogOnlyValue(to, fragment);
+	}
+}
+function fragmentsOfNeedleIn(text, delimiter, needle, pieces = text.split(delimiter)) {
+	const fragments = /* @__PURE__ */ new Set();
+	if (needle === "") return fragments;
+	const starts = [];
+	if (text === needle) starts.push(0);
+	else if (needle.length >= 4) for (let at = text.indexOf(needle); at !== -1; at = text.indexOf(needle, at + 1)) starts.push(at);
+	if (starts.length === 0) return fragments;
+	const spans = [];
+	let offset = 0;
+	for (const piece of pieces) {
+		spans.push([offset, offset + piece.length]);
+		offset += piece.length + delimiter.length;
+	}
+	for (const start of starts) {
+		const end = start + needle.length;
+		for (const [pieceStart, pieceEnd] of spans) {
+			const from = Math.max(pieceStart, start);
+			const to = Math.min(pieceEnd, end);
+			if (from < to) fragments.add(text.slice(from, to));
+		}
+	}
+	return fragments;
+}
+function printedLeavesOf(value) {
+	const leaves = wholeStringLeavesOf(value);
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (node) => {
+		if (typeof node === "number" || typeof node === "boolean") {
+			leaves.add(String(node));
+			return;
+		}
+		if (node === null || typeof node !== "object") return;
+		if (seen.has(node)) return;
+		seen.add(node);
+		for (const child of Array.isArray(node) ? node : Object.values(node)) walk(child);
+	};
+	walk(value);
+	return leaves;
+}
+function shareLogOnlyValues(view, target) {
+	logOnlyValuesOf.set(view, sideSetOf(logOnlyValuesOf, target));
+}
+function recordLogOnlyParameterValue(secrets, value, splitDelimiters) {
+	const record = (leaf) => {
+		const spelled = typeof leaf === "string" ? leaf : typeof leaf === "number" || typeof leaf === "boolean" ? String(leaf) : void 0;
+		if (spelled === void 0) return;
+		recordLogOnlyValue(secrets, spelled);
+		for (const delimiter of splitDelimiters ?? []) {
+			if (delimiter === "" || !spelled.includes(delimiter)) continue;
+			for (const piece of spelled.split(delimiter)) recordLogOnlyValue(secrets, piece);
+		}
+	};
+	if (Array.isArray(value)) {
+		for (const element of value) record(element);
+		record(value.map((element) => String(element)).join(","));
+		return;
+	}
+	record(value);
+}
+function literalSplitDelimitersOf(template, parameters) {
+	const delimiters = /* @__PURE__ */ new Set();
+	if (parameters.size === 0) return delimiters;
+	const reads = (node, seen) => {
+		if (typeof node === "string") {
+			for (const name of parameters) if (node.includes(`\${${name}}`)) return true;
+			return false;
+		}
+		if (node === null || typeof node !== "object" || seen.has(node)) return false;
+		seen.add(node);
+		if (!Array.isArray(node)) {
+			const ref = node["Ref"];
+			if (typeof ref === "string" && parameters.has(ref)) return true;
+		}
+		for (const child of Array.isArray(node) ? node : Object.values(node)) if (reads(child, seen)) return true;
+		return false;
+	};
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (node) => {
+		if (node === null || typeof node !== "object" || seen.has(node)) return;
+		seen.add(node);
+		if (Array.isArray(node)) {
+			for (const child of node) walk(child);
+			return;
+		}
+		for (const [key, child] of Object.entries(node)) {
+			if (key === "Fn::Split" && Array.isArray(child) && typeof child[0] === "string" && reads(child[1], /* @__PURE__ */ new Set())) delimiters.add(child[0]);
+			walk(child);
+		}
+	};
+	walk(template);
+	return delimiters;
+}
+function printingCorpusOf(secrets) {
+	const logOnly = logOnlyValuesOf.get(secrets);
+	if (logOnly === void 0 || logOnly.size === 0) return secrets;
+	const corpus = new Map(secrets);
+	for (const needle of logOnly) if (!corpus.has(needle)) corpus.set(needle, "***");
+	return corpus;
+}
+function logOnlyValueCount(secrets) {
+	return logOnlyValuesOf.get(secrets)?.size ?? 0;
+}
+function unionOfSecretBags(bags) {
+	const union = /* @__PURE__ */ new Map();
+	for (const bag of bags) {
+		if (bag === void 0) continue;
+		for (const [plaintext, expression] of bag) if (!union.has(plaintext)) union.set(plaintext, expression);
+		carryLogOnlyValues(bag, union);
+	}
+	return union;
+}
+function createUnionSecretMasker(bags) {
+	const present = bags.filter((bag) => bag !== void 0);
+	let stamp;
+	let needles = /* @__PURE__ */ new Set();
+	let scanned = [];
+	return (text) => {
+		const now = present.map((bag) => `${bag.size}:${logOnlyValueCount(bag)}`).join(",");
+		if (now !== stamp) {
+			needles = /* @__PURE__ */ new Set();
+			for (const bag of present) {
+				for (const plaintext of bag.keys()) needles.add(plaintext);
+				for (const plaintext of logOnlyValuesOf.get(bag) ?? []) needles.add(plaintext);
+			}
+			scanned = printingNeedles(needles);
+			stamp = now;
+		}
+		if (text !== "" && needles.has(text)) return "***";
+		return maskMatchSpans(text, scanned, "***");
+	};
+}
+function hasLogOnlyValues(secrets) {
+	if (secrets === void 0) return false;
+	const logOnly = logOnlyValuesOf.get(secrets);
+	return logOnly !== void 0 && logOnly.size > 0;
+}
+function hasMaskableValues(secrets) {
+	if (secrets === void 0) return false;
+	if (secrets.size > 0) return true;
+	const logOnly = logOnlyValuesOf.get(secrets);
+	return logOnly !== void 0 && logOnly.size > 0;
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/reference-provenance.ts
+const passProvenanceOf = /* @__PURE__ */ new WeakMap();
+const MAX_REFERENCE_VERSIONS = 8;
+function provenanceTableFor(secrets) {
+	let table = passProvenanceOf.get(secrets);
+	if (table === void 0) {
+		table = /* @__PURE__ */ new Map();
+		passProvenanceOf.set(secrets, table);
+	}
+	return table;
+}
+function shareReferenceProvenance(view, pass) {
+	passProvenanceOf.set(view, provenanceTableFor(pass));
+}
+function entryFor(secrets, token) {
+	const table = provenanceTableFor(secrets);
+	let entry = table.get(token);
+	if (entry === void 0) {
+		entry = {
+			regions: /* @__PURE__ */ new Set(),
+			regionUnknown: false,
+			versions: /* @__PURE__ */ new Set(),
+			versionUnknown: false,
+			readVersions: /* @__PURE__ */ new Set()
+		};
+		table.set(token, entry);
+	}
+	return entry;
+}
+function recordReferenceResolution(secrets, token, resolution) {
+	const entry = entryFor(secrets, token);
+	if (resolution.region === void 0) entry.regionUnknown = true;
+	else entry.regions.add(resolution.region);
+	if (resolution.version === void 0) {
+		entry.versionUnknown = true;
+		return;
+	}
+	entry.versions.add(resolution.version);
+	if (resolution.route === "read") entry.readVersions.add(resolution.version);
+}
+function recordReferenceProvenanceEntry(secrets, token, provenance, route) {
+	const entry = entryFor(secrets, token);
+	if (provenance.region === void 0) entry.regionUnknown = true;
+	else entry.regions.add(provenance.region);
+	if (provenance.versions === void 0 || provenance.versions.length === 0) {
+		entry.versionUnknown = true;
+		return;
+	}
+	for (const version of provenance.versions) {
+		entry.versions.add(version);
+		if (route === "read") entry.readVersions.add(version);
+	}
+	if (route === "literal") for (const version of provenance.readVersions ?? []) entry.readVersions.add(version);
+}
+function mergeReferenceProvenance(from, to) {
+	const source = passProvenanceOf.get(from);
+	if (source === void 0 || from === to) return;
+	for (const [token, entry] of source) {
+		const target = entryFor(to, token);
+		for (const region of entry.regions) target.regions.add(region);
+		target.regionUnknown ||= entry.regionUnknown;
+		for (const version of entry.versions) target.versions.add(version);
+		target.versionUnknown ||= entry.versionUnknown;
+		for (const version of entry.readVersions) target.readVersions.add(version);
+	}
+}
+function hasPassProvenance(secrets) {
+	if (secrets === void 0) return false;
+	const table = passProvenanceOf.get(secrets);
+	return table !== void 0 && table.size > 0;
+}
+function passProvenanceFor(secrets, token) {
+	if (secrets === void 0) return void 0;
+	const entry = passProvenanceOf.get(secrets)?.get(token);
+	if (entry === void 0) return void 0;
+	return finalize(entry);
+}
+function passReadVersionsFor(secrets, token) {
+	if (secrets === void 0) return void 0;
+	const read = passProvenanceOf.get(secrets)?.get(token)?.readVersions;
+	return read === void 0 || read.size === 0 ? void 0 : read;
+}
+function finalize(entry) {
+	const out = {};
+	if (!entry.regionUnknown && entry.regions.size === 1) out.region = [...entry.regions][0];
+	if (!entry.versionUnknown && entry.versions.size > 0 && entry.versions.size <= 8) {
+		out.versions = [...entry.versions].sort();
+		if (entry.readVersions.size > 0) out.readVersions = [...entry.readVersions].sort();
+	}
+	return out;
+}
+function snapshotPassProvenance(secrets) {
+	if (secrets === void 0) return void 0;
+	const table = passProvenanceOf.get(secrets);
+	if (table === void 0 || table.size === 0) return void 0;
+	const out = /* @__PURE__ */ new Map();
+	for (const [token, entry] of table) out.set(token, finalize(entry));
+	return out;
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/recording.ts
+const scopeMaps = /* @__PURE__ */ new WeakSet();
+var WriteThroughSecrets = class extends Map {
+	pass;
+	constructor(pass) {
+		super();
+		this.pass = pass;
+	}
+	set(plaintext, expression) {
+		super.set(plaintext, expression);
+		this.pass.set(plaintext, expression);
+		return this;
+	}
+};
+function openRecordingScope(pass, policy) {
+	const secrets = new WriteThroughSecrets(pass);
+	scopeMaps.add(secrets);
+	shareLogOnlyValues(secrets, pass);
+	for (const [kind, share] of Object.entries(SCOPE_SHARERS)) if (policy[kind] === "carry") share(secrets, pass);
+	return {
+		secrets,
+		pass
+	};
+}
+const SCOPE_SHARERS = {
+	pairs: sharePairTable,
+	"mask-only-marks": (scope, pass) => {
+		for (const table of [
+			freshNoEchoValuesOf,
+			containmentValuesOf,
+			noEchoParameterValuesOf
+		]) table.set(scope, sideSetOf(table, pass));
+	},
+	"reference-provenance": shareReferenceProvenance,
+	"physical-name-copies": (scope, pass) => {
+		physicalNameCopiesOf.set(scope, sideSetOf(physicalNameCopiesOf, pass));
+	},
+	"public-proofs": sharePublicProofs
+};
+function isRecordingScope(secrets) {
+	return scopeMaps.has(secrets);
+}
+function foldRecording(from, to, policy) {
+	if (from === to) return;
+	for (const [plaintext, expression] of from) to.set(plaintext, expression);
+	for (const [kind, carry] of Object.entries(FOLD_CARRIERS)) if (policy[kind] === "carry") carry(from, to);
+}
+const FOLD_CARRIERS = {
+	"mask-only-marks": carryMaskOnlyMarks,
+	"reference-provenance": mergeReferenceProvenance,
+	pairs: mergePairTables,
+	"log-only": carryLogOnlyValues,
+	"physical-name-copies": (from, to) => {
+		for (const physicalId of physicalNameCopiesOf.get(from) ?? []) recordPhysicalNameCopy(to, physicalId);
+	},
+	"public-proofs": carryPublicProofs
+};
+function recordSecretResolution(secrets, expression, plaintext, options) {
+	secrets.set(plaintext, expression);
+	if (options.pairEvidence) recordResolvedPair(secrets, expression, plaintext);
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/context.ts
+const RULES_BY_PROVENANCE = {
+	"template-derived": TEMPLATE_DERIVED_RULES,
+	"template-sourced": TEMPLATE_SOURCED_RULES,
+	"state-readback": STATE_SOURCED_READBACK_RULES,
+	"state-baseline": STATE_SOURCED_BASELINE_RULES,
+	"state-cross-generation": STATE_SOURCED_CROSS_GENERATION_RULES,
+	"state-derived": STATE_DERIVED_RULES
+};
+function redactForState(bag, context) {
+	refuseScopeAsPass(context.secrets);
+	if (context.provenance === "value-scan") return redactSecretsForState(bag, context.secrets);
+	const { secrets, source, provenance } = context;
+	if (!((context.provenance === "template-derived" || context.provenance === "template-sourced") && context.generation === "same-generation") || !isPlainBag(bag)) return redactAtProvenance(bag, secrets, source, provenance, false);
+	const copy = shallowCopy(bag);
+	const redacted = redactAtProvenance(copy, secrets, source, provenance, true);
+	return redacted === copy ? shallowCopy(copy) : redacted;
+}
+function redactAtProvenance(bag, secrets, source, provenance, sameGeneration) {
+	refuseScopeAsPass(secrets);
+	return redactSecretsForState(bag, secrets, source, RULES_BY_PROVENANCE[provenance], sameGeneration);
+}
+function refuseScopeAsPass(secrets) {
+	if (isRecordingScope(secrets)) throw new Error("Internal error: a bag was redacted for persistence with a recording scope; pass the scope's pass map instead.");
+}
+function isPlainBag(bag) {
+	if (Array.isArray(bag)) return true;
+	if (bag === null || typeof bag !== "object") return false;
+	const proto = Object.getPrototypeOf(bag);
+	return proto === Object.prototype || proto === null;
+}
+function shallowCopy(bag) {
+	return Array.isArray(bag) ? [...bag] : { ...bag };
+}
+
 //#endregion
 //#region src/deployment/secret-redaction/positions.ts
 const SKELETON_WILDCARD = `${DYNAMIC_REFERENCE_INNER_CHAR}*`;
@@ -9674,10 +10332,16 @@ function positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration) {
 	const frame = singleSpanFrame(bag, source);
 	if (frame === void 0) {
 		if (dynamicReferenceSpans(source).length >= 2 && certifiesRenderedLiteral(bag, source, secrets, bagIsSameGeneration)) return source;
-		return redactSecretsForState(bag, secrets);
+		return redactForState(bag, {
+			provenance: "value-scan",
+			secrets
+		});
 	}
 	const recorded = resolvedPlaintextOf(secrets, frame.token);
-	if (recorded === void 0 || recorded !== frame.middle) return redactSecretsForState(bag, secrets);
+	if (recorded === void 0 || recorded !== frame.middle) return redactForState(bag, {
+		provenance: "value-scan",
+		secrets
+	});
 	return writeFramedTokenWithinScanBound(bag, secrets, frame, bagIsSameGeneration);
 }
 function pairedSpans(source, secrets) {
@@ -9717,7 +10381,10 @@ function renderedLiteralSpans(spelling, secrets, value) {
 	const spans = pairedSpans(spelling, secrets);
 	if (spans === void 0) return void 0;
 	if (renderSpans(spelling, spans, (i) => spans[i].plaintext) !== value) return void 0;
-	return redactSecretsForState(spelling, secrets) === spelling ? spans : void 0;
+	return redactForState(spelling, {
+		provenance: "value-scan",
+		secrets
+	}) === spelling ? spans : void 0;
 }
 function certifiesRenderedLiteral(bag, source, secrets, bagIsSameGeneration) {
 	const spans = renderedLiteralSpans(source, secrets, bag);
@@ -9728,13 +10395,19 @@ function certifiesRenderedLiteral(bag, source, secrets, bagIsSameGeneration) {
 		if (survivor === void 0) return false;
 		survivors.push(survivor);
 	}
-	const scanned = redactSecretsForState(bag, secrets);
+	const scanned = redactForState(bag, {
+		provenance: "value-scan",
+		secrets
+	});
 	if (scanned === renderSpans(source, spans, (i) => survivors[i])) return true;
 	if (!bagIsSameGeneration) return false;
 	return scanned === renderSpans(source, spans, (i) => spans[i].plaintext.length >= 4 ? survivors[i] : spans[i].plaintext);
 }
 function writeFramedTokenWithinScanBound(bag, secrets, frame, bagIsSameGeneration) {
-	const scanned = redactSecretsForState(bag, secrets);
+	const scanned = redactForState(bag, {
+		provenance: "value-scan",
+		secrets
+	});
 	const { token, prefix, suffix, middle } = frame;
 	const survivor = secrets.get(middle);
 	if (survivor === void 0) return scanned;
@@ -9775,100 +10448,6 @@ function positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIs
 	}, bagIsSameGeneration);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/reference-provenance.ts
-const passProvenanceOf = /* @__PURE__ */ new WeakMap();
-const MAX_REFERENCE_VERSIONS = 8;
-function entryFor(secrets, token) {
-	let table = passProvenanceOf.get(secrets);
-	if (table === void 0) {
-		table = /* @__PURE__ */ new Map();
-		passProvenanceOf.set(secrets, table);
-	}
-	let entry = table.get(token);
-	if (entry === void 0) {
-		entry = {
-			regions: /* @__PURE__ */ new Set(),
-			regionUnknown: false,
-			versions: /* @__PURE__ */ new Set(),
-			versionUnknown: false,
-			readVersions: /* @__PURE__ */ new Set()
-		};
-		table.set(token, entry);
-	}
-	return entry;
-}
-function recordReferenceResolution(secrets, token, resolution) {
-	const entry = entryFor(secrets, token);
-	if (resolution.region === void 0) entry.regionUnknown = true;
-	else entry.regions.add(resolution.region);
-	if (resolution.version === void 0) {
-		entry.versionUnknown = true;
-		return;
-	}
-	entry.versions.add(resolution.version);
-	if (resolution.route === "read") entry.readVersions.add(resolution.version);
-}
-function recordReferenceProvenanceEntry(secrets, token, provenance, route) {
-	const entry = entryFor(secrets, token);
-	if (provenance.region === void 0) entry.regionUnknown = true;
-	else entry.regions.add(provenance.region);
-	if (provenance.versions === void 0 || provenance.versions.length === 0) {
-		entry.versionUnknown = true;
-		return;
-	}
-	for (const version of provenance.versions) {
-		entry.versions.add(version);
-		if (route === "read") entry.readVersions.add(version);
-	}
-	if (route === "literal") for (const version of provenance.readVersions ?? []) entry.readVersions.add(version);
-}
-function mergeReferenceProvenance(from, to) {
-	const source = passProvenanceOf.get(from);
-	if (source === void 0 || from === to) return;
-	for (const [token, entry] of source) {
-		const target = entryFor(to, token);
-		for (const region of entry.regions) target.regions.add(region);
-		target.regionUnknown ||= entry.regionUnknown;
-		for (const version of entry.versions) target.versions.add(version);
-		target.versionUnknown ||= entry.versionUnknown;
-		for (const version of entry.readVersions) target.readVersions.add(version);
-	}
-}
-function hasPassProvenance(secrets) {
-	if (secrets === void 0) return false;
-	const table = passProvenanceOf.get(secrets);
-	return table !== void 0 && table.size > 0;
-}
-function passProvenanceFor(secrets, token) {
-	if (secrets === void 0) return void 0;
-	const entry = passProvenanceOf.get(secrets)?.get(token);
-	if (entry === void 0) return void 0;
-	return finalize(entry);
-}
-function passReadVersionsFor(secrets, token) {
-	if (secrets === void 0) return void 0;
-	const read = passProvenanceOf.get(secrets)?.get(token)?.readVersions;
-	return read === void 0 || read.size === 0 ? void 0 : read;
-}
-function finalize(entry) {
-	const out = {};
-	if (!entry.regionUnknown && entry.regions.size === 1) out.region = [...entry.regions][0];
-	if (!entry.versionUnknown && entry.versions.size > 0 && entry.versions.size <= 8) {
-		out.versions = [...entry.versions].sort();
-		if (entry.readVersions.size > 0) out.readVersions = [...entry.readVersions].sort();
-	}
-	return out;
-}
-function snapshotPassProvenance(secrets) {
-	if (secrets === void 0) return void 0;
-	const table = passProvenanceOf.get(secrets);
-	if (table === void 0 || table.size === 0) return void 0;
-	const out = /* @__PURE__ */ new Map();
-	for (const [token, entry] of table) out.set(token, finalize(entry));
-	return out;
-}
-
 //#endregion
 //#region src/deployment/secret-redaction/pairs.ts
 const resolvedPairsOf = /* @__PURE__ */ new WeakMap();
@@ -9890,11 +10469,17 @@ function recordResolvedPair(secrets, expression, plaintext) {
 function mergeResolvedPairs(from, to) {
 	carryMaskOnlyMarks(from, to);
 	mergeReferenceProvenance(from, to);
+	mergePairTables(from, to);
+}
+function mergePairTables(from, to) {
 	const pairs = resolvedPairsOf.get(from);
 	if (pairs === void 0) return;
 	for (const [expression, plaintext] of pairs) if (typeof plaintext === "string") recordResolvedPair(to, expression, plaintext);
 	else pairsFor(to).set(expression, CONFLICTING_PLAINTEXT);
 }
+function sharePairTable(view, pass) {
+	resolvedPairsOf.set(view, pairsFor(pass));
+}
 function resolvedPlaintextOf(secrets, expression) {
 	const recorded = resolvedPairsOf.get(secrets)?.get(expression);
 	return typeof recorded === "string" ? recorded : void 0;
@@ -9979,398 +10564,6 @@ function isSameGenerationBag(bag) {
 	return sameGenerationBags.has(bag);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/mask-errors.ts
-function maskSecretsInText(text, secrets) {
-	const logOnly = logOnlyValuesOf.get(secrets);
-	const noLogOnly = logOnly === void 0 || logOnly.size === 0;
-	if (secrets.size === 0 && noLogOnly) return text;
-	if (text !== "" && (secrets.has(text) || logOnly?.has(text) === true)) return "***";
-	return maskMatchSpans(text, printingNeedles(noLogOnly ? secrets.keys() : [...secrets.keys(), ...logOnly]), "***");
-}
-function maskRecordedSecretsInText(text, secrets) {
-	if (secrets.size === 0) return text;
-	if (text !== "" && secrets.has(text)) return "***";
-	return maskMatchSpans(text, substringNeedles(secrets.keys()), "***");
-}
-function substringNeedles(values) {
-	return [...new Set(values)].filter((value) => value.length >= 4);
-}
-const ERROR_CAUSE_MASK_MAX_DEPTH = 20;
-function errorCauseChain(root) {
-	const chain = [];
-	const seen = /* @__PURE__ */ new Set();
-	let current = root;
-	while (current instanceof Error && !seen.has(current) && chain.length < 20) {
-		seen.add(current);
-		chain.push(current);
-		current = current.cause;
-	}
-	return chain;
-}
-function readStack(error) {
-	try {
-		const stack = error.stack;
-		return typeof stack === "string" ? stack : void 0;
-	} catch {
-		return;
-	}
-}
-function maskDescriptorValue(descriptor, maskText) {
-	if (!("value" in descriptor)) return descriptor;
-	const value = maskErrorFieldValue(descriptor.value, maskText);
-	return value === descriptor.value ? descriptor : {
-		...descriptor,
-		value
-	};
-}
-const CLASSIFIER_IDENTIFIER_FIELDS = /* @__PURE__ */ new Set([
-	"name",
-	"code",
-	"Code",
-	"__type",
-	"ccErrorCode",
-	"ccOperation"
-]);
-function isAuxiliaryAnchor(key, descriptor) {
-	return key === "logicalId" && descriptor.enumerable === false && descriptor.writable === false && typeof descriptor.value === "string" && descriptor.value.endsWith("/auxiliary");
-}
-const CREATED_BEFORE_FAILURE_MARK = Symbol.for("cdkd.createdBeforeFailure");
-function isCreatedBeforeFailureMark(key, descriptor) {
-	return key === CREATED_BEFORE_FAILURE_MARK && descriptor.enumerable === false && descriptor.writable === false && typeof descriptor.value === "object" && descriptor.value !== null && Object.isFrozen(descriptor.value);
-}
-function isPlainContainer(value) {
-	const proto = Object.getPrototypeOf(value);
-	return Array.isArray(value) ? proto === Array.prototype : proto === Object.prototype || proto === null;
-}
-function readFieldNode(node) {
-	try {
-		if (!isPlainContainer(node)) return void 0;
-		const entries = [];
-		for (const key of Reflect.ownKeys(node)) {
-			const descriptor = Object.getOwnPropertyDescriptor(node, key);
-			if (descriptor) entries.push([key, descriptor]);
-		}
-		const isArray = Array.isArray(node);
-		return {
-			proto: Object.getPrototypeOf(node),
-			isArray,
-			length: isArray ? Object.getOwnPropertyDescriptor(node, "length") : void 0,
-			extensible: Object.isExtensible(node),
-			entries
-		};
-	} catch {
-		return;
-	}
-}
-function maskErrorFieldValue(value, maskText) {
-	if (typeof value === "string") return maskText(value);
-	if (typeof value !== "object" || value === null) return value;
-	try {
-		const nodes = /* @__PURE__ */ new Map();
-		const seen = /* @__PURE__ */ new Set();
-		let changed = false;
-		let frontier = [value];
-		for (let depth = 0; frontier.length > 0 && depth < 20; depth++) {
-			const next = [];
-			for (const node of frontier) {
-				if (seen.has(node)) continue;
-				seen.add(node);
-				const read = readFieldNode(node);
-				if (!read) continue;
-				nodes.set(node, read);
-				for (const [, descriptor] of read.entries) {
-					if (!("value" in descriptor)) continue;
-					const child = descriptor.value;
-					if (typeof child === "string") {
-						if (!changed && maskText(child) !== child) changed = true;
-					} else if (typeof child === "object" && child !== null) next.push(child);
-				}
-			}
-			frontier = next;
-		}
-		if (!changed) return value;
-		const copies = /* @__PURE__ */ new Map();
-		for (const [node, read] of nodes) copies.set(node, read.isArray ? new Array(read.length?.value ?? 0) : Object.create(read.proto));
-		for (const [node, read] of nodes) {
-			const copy = copies.get(node);
-			for (const [key, original] of read.entries) {
-				if (key === "length" && read.isArray) continue;
-				const descriptor = { ...original };
-				if ("value" in descriptor) {
-					const child = descriptor.value;
-					if (typeof child === "string") descriptor.value = maskText(child);
-					else if (typeof child === "object" && child !== null && copies.has(child)) descriptor.value = copies.get(child);
-				}
-				Object.defineProperty(copy, key, descriptor);
-			}
-			if (read.length?.writable === false) Object.defineProperty(copy, "length", { writable: false });
-			if (!read.extensible) Object.preventExtensions(copy);
-		}
-		return copies.get(value) ?? value;
-	} catch {
-		return value;
-	}
-}
-function maskSecretsInError(error, secrets, extraMask) {
-	if (!(error instanceof Error) || !hasMaskableValues(secrets) && !extraMask) return error;
-	const maskText = (text) => maskSecretsInText(extraMask ? extraMask(text) : text, secrets);
-	const chain = errorCauseChain(error);
-	let changed = false;
-	const links = chain.map((link) => {
-		const message = maskText(link.message);
-		const stack = readStack(link);
-		const maskedStack = typeof stack === "string" ? maskText(stack) : void 0;
-		const descriptors = {};
-		for (const key of Reflect.ownKeys(link)) {
-			if (key === "message" || key === "cause" || key === "stack") continue;
-			const descriptor = Object.getOwnPropertyDescriptor(link, key);
-			if (!descriptor) continue;
-			descriptors[key] = typeof key === "string" && CLASSIFIER_IDENTIFIER_FIELDS.has(key) && typeof descriptor.value === "string" || isAuxiliaryAnchor(key, descriptor) || isCreatedBeforeFailureMark(key, descriptor) ? descriptor : maskDescriptorValue(descriptor, maskText);
-			if (descriptors[key] !== descriptor) changed = true;
-		}
-		let cause = Object.getOwnPropertyDescriptor(link, "cause");
-		if (cause && !("value" in cause && cause.value instanceof Error)) {
-			const masked = maskDescriptorValue(cause, maskText);
-			if (masked !== cause) changed = true;
-			cause = masked;
-		}
-		if (message !== link.message || maskedStack !== stack) changed = true;
-		return {
-			message,
-			stack: maskedStack,
-			descriptors,
-			cause
-		};
-	});
-	if (!changed) return error;
-	const clones = /* @__PURE__ */ new Map();
-	for (const [i, original] of chain.entries()) {
-		const { message, stack, descriptors } = links[i];
-		const clone = Object.create(Object.getPrototypeOf(original), descriptors);
-		Object.defineProperty(clone, "message", {
-			value: message,
-			writable: true,
-			enumerable: false,
-			configurable: true
-		});
-		if (stack !== void 0) Object.defineProperty(clone, "stack", {
-			value: stack,
-			writable: true,
-			enumerable: false,
-			configurable: true
-		});
-		clones.set(original, clone);
-	}
-	for (const [i, original] of chain.entries()) {
-		const causeDescriptor = links[i].cause;
-		if (!causeDescriptor) continue;
-		const clone = clones.get(original);
-		const causeValue = original.cause;
-		const replacement = causeValue instanceof Error ? clones.get(causeValue) : void 0;
-		Object.defineProperty(clone, "cause", replacement ? {
-			value: replacement,
-			writable: true,
-			enumerable: causeDescriptor.enumerable === true,
-			configurable: true
-		} : causeDescriptor);
-	}
-	return clones.get(error);
-}
-function createSecretMasker(secrets) {
-	return (text) => maskSecretsInText(text, secrets);
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/log-only.ts
-const logOnlyValuesOf = /* @__PURE__ */ new WeakMap();
-function recordLogOnlyValue(secrets, plaintext) {
-	if (plaintext === "") return;
-	sideSetOf(logOnlyValuesOf, secrets).add(plaintext);
-}
-function carryLogOnlyValues(from, to) {
-	const values = logOnlyValuesOf.get(from);
-	if (values === void 0 || values.size === 0) return;
-	const into = sideSetOf(logOnlyValuesOf, to);
-	for (const value of values) into.add(value);
-}
-function carryLogOnlyValuesCarriedBy(from, to, value) {
-	const values = logOnlyValuesOf.get(from);
-	if (values === void 0 || values.size === 0) return;
-	const leaves = printedLeavesOf(value);
-	if (leaves.size === 0) return;
-	for (const needle of values) for (const leaf of leaves) if (leaf === needle || needle.length >= 4 && leaf.includes(needle)) {
-		recordLogOnlyValue(to, needle);
-		break;
-	}
-	carryListElementFragments(values, to, value);
-}
-function carryListElementFragments(needles, to, value) {
-	if (!Array.isArray(value) || value.length === 0) return;
-	if (!value.every((e) => typeof e === "string" || typeof e === "number" || typeof e === "boolean")) return;
-	const numeric = value.every((element) => typeof element === "number");
-	const joined = value.map((element) => String(element)).join(",");
-	for (const needle of [...needles]) {
-		const pieces = needle.split(",").map((piece) => piece.trim());
-		if (numeric && pieces.every((piece) => piece === "" || Number.isNaN(Number(piece)))) continue;
-		const fragments = fragmentsOfNeedleIn(joined, ",", pieces.map((piece) => numeric ? String(Number(piece)) : piece).join(","));
-		if (fragments.size === 0) continue;
-		recordLogOnlyValue(to, needle);
-		for (const fragment of fragments) recordLogOnlyValue(to, fragment);
-	}
-}
-function recordLogOnlySplitFragments(from, to, text, delimiter, printed) {
-	if (delimiter === "") return;
-	const splits = [text.split(delimiter)];
-	if (printed !== void 0 && (printed.length !== splits[0].length || printed.some((piece, i) => piece !== splits[0][i]))) splits.push(printed);
-	for (const bag of from) {
-		if (bag === void 0) continue;
-		for (const needle of [...logOnlyValuesOf.get(bag) ?? []]) for (const pieces of splits) for (const fragment of fragmentsOfNeedleIn(text, delimiter, needle, pieces)) if (fragment !== needle) recordLogOnlyValue(to, fragment);
-	}
-}
-function fragmentsOfNeedleIn(text, delimiter, needle, pieces = text.split(delimiter)) {
-	const fragments = /* @__PURE__ */ new Set();
-	if (needle === "") return fragments;
-	const starts = [];
-	if (text === needle) starts.push(0);
-	else if (needle.length >= 4) for (let at = text.indexOf(needle); at !== -1; at = text.indexOf(needle, at + 1)) starts.push(at);
-	if (starts.length === 0) return fragments;
-	const spans = [];
-	let offset = 0;
-	for (const piece of pieces) {
-		spans.push([offset, offset + piece.length]);
-		offset += piece.length + delimiter.length;
-	}
-	for (const start of starts) {
-		const end = start + needle.length;
-		for (const [pieceStart, pieceEnd] of spans) {
-			const from = Math.max(pieceStart, start);
-			const to = Math.min(pieceEnd, end);
-			if (from < to) fragments.add(text.slice(from, to));
-		}
-	}
-	return fragments;
-}
-function printedLeavesOf(value) {
-	const leaves = wholeStringLeavesOf(value);
-	const seen = /* @__PURE__ */ new Set();
-	const walk = (node) => {
-		if (typeof node === "number" || typeof node === "boolean") {
-			leaves.add(String(node));
-			return;
-		}
-		if (node === null || typeof node !== "object") return;
-		if (seen.has(node)) return;
-		seen.add(node);
-		for (const child of Array.isArray(node) ? node : Object.values(node)) walk(child);
-	};
-	walk(value);
-	return leaves;
-}
-function shareLogOnlyValues(view, target) {
-	logOnlyValuesOf.set(view, sideSetOf(logOnlyValuesOf, target));
-}
-function recordLogOnlyParameterValue(secrets, value, splitDelimiters) {
-	const record = (leaf) => {
-		const spelled = typeof leaf === "string" ? leaf : typeof leaf === "number" || typeof leaf === "boolean" ? String(leaf) : void 0;
-		if (spelled === void 0) return;
-		recordLogOnlyValue(secrets, spelled);
-		for (const delimiter of splitDelimiters ?? []) {
-			if (delimiter === "" || !spelled.includes(delimiter)) continue;
-			for (const piece of spelled.split(delimiter)) recordLogOnlyValue(secrets, piece);
-		}
-	};
-	if (Array.isArray(value)) {
-		for (const element of value) record(element);
-		record(value.map((element) => String(element)).join(","));
-		return;
-	}
-	record(value);
-}
-function literalSplitDelimitersOf(template, parameters) {
-	const delimiters = /* @__PURE__ */ new Set();
-	if (parameters.size === 0) return delimiters;
-	const reads = (node, seen) => {
-		if (typeof node === "string") {
-			for (const name of parameters) if (node.includes(`\${${name}}`)) return true;
-			return false;
-		}
-		if (node === null || typeof node !== "object" || seen.has(node)) return false;
-		seen.add(node);
-		if (!Array.isArray(node)) {
-			const ref = node["Ref"];
-			if (typeof ref === "string" && parameters.has(ref)) return true;
-		}
-		for (const child of Array.isArray(node) ? node : Object.values(node)) if (reads(child, seen)) return true;
-		return false;
-	};
-	const seen = /* @__PURE__ */ new Set();
-	const walk = (node) => {
-		if (node === null || typeof node !== "object" || seen.has(node)) return;
-		seen.add(node);
-		if (Array.isArray(node)) {
-			for (const child of node) walk(child);
-			return;
-		}
-		for (const [key, child] of Object.entries(node)) {
-			if (key === "Fn::Split" && Array.isArray(child) && typeof child[0] === "string" && reads(child[1], /* @__PURE__ */ new Set())) delimiters.add(child[0]);
-			walk(child);
-		}
-	};
-	walk(template);
-	return delimiters;
-}
-function printingCorpusOf(secrets) {
-	const logOnly = logOnlyValuesOf.get(secrets);
-	if (logOnly === void 0 || logOnly.size === 0) return secrets;
-	const corpus = new Map(secrets);
-	for (const needle of logOnly) if (!corpus.has(needle)) corpus.set(needle, "***");
-	return corpus;
-}
-function logOnlyValueCount(secrets) {
-	return logOnlyValuesOf.get(secrets)?.size ?? 0;
-}
-function unionOfSecretBags(bags) {
-	const union = /* @__PURE__ */ new Map();
-	for (const bag of bags) {
-		if (bag === void 0) continue;
-		for (const [plaintext, expression] of bag) if (!union.has(plaintext)) union.set(plaintext, expression);
-		carryLogOnlyValues(bag, union);
-	}
-	return union;
-}
-function createUnionSecretMasker(bags) {
-	const present = bags.filter((bag) => bag !== void 0);
-	let stamp;
-	let needles = /* @__PURE__ */ new Set();
-	let scanned = [];
-	return (text) => {
-		const now = present.map((bag) => `${bag.size}:${logOnlyValueCount(bag)}`).join(",");
-		if (now !== stamp) {
-			needles = /* @__PURE__ */ new Set();
-			for (const bag of present) {
-				for (const plaintext of bag.keys()) needles.add(plaintext);
-				for (const plaintext of logOnlyValuesOf.get(bag) ?? []) needles.add(plaintext);
-			}
-			scanned = printingNeedles(needles);
-			stamp = now;
-		}
-		if (text !== "" && needles.has(text)) return "***";
-		return maskMatchSpans(text, scanned, "***");
-	};
-}
-function hasLogOnlyValues(secrets) {
-	if (secrets === void 0) return false;
-	const logOnly = logOnlyValuesOf.get(secrets);
-	return logOnly !== void 0 && logOnly.size > 0;
-}
-function hasMaskableValues(secrets) {
-	if (secrets === void 0) return false;
-	if (secrets.size > 0) return true;
-	const logOnly = logOnlyValuesOf.get(secrets);
-	return logOnly !== void 0 && logOnly.size > 0;
-}
-
 //#endregion
 //#region src/deployment/secret-redaction/unresolved-token-frame.ts
 function liveMatchesUnresolvedTokenFrame(send, live, unresolvedTokens, secrets) {
@@ -10409,34 +10602,6 @@ function wildcardOverlapsResolvedPlaintext(send, wildcards, secrets) {
 	return false;
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/context.ts
-const RULES_BY_PROVENANCE = {
-	"template-derived": TEMPLATE_DERIVED_RULES,
-	"template-sourced": TEMPLATE_SOURCED_RULES,
-	"state-readback": STATE_SOURCED_READBACK_RULES,
-	"state-baseline": STATE_SOURCED_BASELINE_RULES,
-	"state-cross-generation": STATE_SOURCED_CROSS_GENERATION_RULES,
-	"state-derived": STATE_DERIVED_RULES
-};
-function redactForState(bag, context) {
-	if (context.provenance === "value-scan") return redactSecretsForState(bag, context.secrets);
-	const rules = RULES_BY_PROVENANCE[context.provenance];
-	if (context.provenance !== "template-derived" || context.generation !== "same-generation" || !isPlainBag(bag)) return redactSecretsForState(bag, context.secrets, context.source, rules);
-	const marked = markSameGenerationBag(shallowCopy(bag));
-	const redacted = redactSecretsForState(marked, context.secrets, context.source, rules);
-	return redacted === marked ? shallowCopy(marked) : redacted;
-}
-function isPlainBag(bag) {
-	if (Array.isArray(bag)) return true;
-	if (bag === null || typeof bag !== "object") return false;
-	const proto = Object.getPrototypeOf(bag);
-	return proto === Object.prototype || proto === null;
-}
-function shallowCopy(bag) {
-	return Array.isArray(bag) ? [...bag] : { ...bag };
-}
-
 //#endregion
 //#region src/deployment/secret-redaction/noecho-leaves.ts
 const SUB_VARIABLE$2 = /\$\{([^}!][^}]*)\}/g;
@@ -22105,10 +22270,7 @@ async function resolveDynamicReferencesWithLogTwin(resolver, value, logTwin, con
 			if (cached) {
 				if (cached.secret && cached.value && !persistedText) refuseSecretAssembledReference(resolver, fullMatch, tokenLogText, context);
 				const recorded = context?.recordedSecretValues;
-				if (cached.secret && cached.value && recorded) {
-					recorded.set(cached.value, fullMatch);
-					if (!pinnedGeneration) recordResolvedPair(recorded, fullMatch, cached.value);
-				}
+				if (cached.secret && cached.value && recorded) recordSecretResolution(recorded, fullMatch, cached.value, { pairEvidence: !pinnedGeneration });
 				if (cached.secret && cached.value) recordProvenanceOfResolution(resolver, context, fullMatch, cached.version);
 				if (service === "ssm" && !cached.secret && recorded && !resolver.producerRegionGuest) recordProvenPublicExpression(recorded, fullMatch, cached.value);
 				result = result.replace(fullMatch, () => cached.value);
@@ -22177,10 +22339,7 @@ async function resolveDynamicReferencesWithLogTwin(resolver, value, logTwin, con
 			});
 			if (isSecret && resolved) {
 				const recorded = context?.recordedSecretValues;
-				if (recorded) {
-					recorded.set(resolved, fullMatch);
-					if (!pinnedGeneration) recordResolvedPair(recorded, fullMatch, resolved);
-				}
+				if (recorded) recordSecretResolution(recorded, fullMatch, resolved, { pairEvidence: !pinnedGeneration });
 				recordProvenanceOfResolution(resolver, context, fullMatch, resolvedVersion);
 				if (service === "secretsmanager" || service === "ssm-secure") pinSecretVerdict(resolver, fullMatch, true, verdictScope);
 			}
@@ -26998,7 +27157,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-GNiE6dR1.js");
+			const { ASGProvider } = await import("./asg-provider-BHNhL4VV.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -27104,7 +27263,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-DBW972HG.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DUaw7kpj.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-BTabgCz5.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CrH00sHx.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -33722,12 +33881,16 @@ function rememberRecoverableMaskedOutputs(deps, stackName, resolved, redacted) {
 }
 function absorbOutputsPassSecrets(deps) {
 	const outputsRun = deps.outputsRun();
-	for (const passSecrets of outputsRun.outputsPassSecretMaps) {
-		for (const [value, expr] of passSecrets) outputsRun.outputSecrets.set(value, expr);
-		mergeResolvedPairs(passSecrets, outputsRun.outputSecrets);
-		for (const physicalId of physicalNameCopiesOf.get(passSecrets) ?? []) recordPhysicalNameCopy(outputsRun.outputSecrets, physicalId);
-	}
-}
+	for (const passSecrets of outputsRun.outputsPassSecretMaps) foldRecording(passSecrets, outputsRun.outputSecrets, OUTPUTS_PASS_FOLD);
+}
+const OUTPUTS_PASS_FOLD = {
+	pairs: "carry",
+	"log-only": "withhold",
+	"mask-only-marks": "carry",
+	"reference-provenance": "carry",
+	"physical-name-copies": "carry",
+	"public-proofs": "withhold"
+};
 function redactOutputs(deps, outputs) {
 	const redacted = redactOutputsBag(deps, outputs);
 	if (deps.outputsRun().outputsResolvedThisRun.has(outputs)) deps.outputsRun().outputsResolvedThisRun.add(redacted);
@@ -33740,7 +33903,8 @@ function redactOutputsBag(deps, outputs) {
 	return maskOutputsByPosition(deps.noEchoRun(), deps.noEchoDeps(), redactForState(outputs, outputsRun.outputsSourceUsable ? {
 		provenance: "template-sourced",
 		secrets: outputsRun.outputSecrets,
-		source: outputsRun.outputsTemplateSource
+		source: outputsRun.outputsTemplateSource,
+		generation: isSameGenerationBag(outputs) ? "same-generation" : "unproven"
 	} : {
 		provenance: "value-scan",
 		secrets: outputsRun.outputSecrets
@@ -34786,17 +34950,13 @@ var OutputsRunState = class {
 	outputsResolvedThisRun = /* @__PURE__ */ new WeakSet();
 	resolvedOutputsBag = void 0;
 };
-var ForwardingSecrets = class extends Map {
-	target;
-	constructor(target) {
-		super();
-		this.target = target;
-	}
-	set(plaintext, expression) {
-		super.set(plaintext, expression);
-		this.target?.set(plaintext, expression);
-		return this;
-	}
+const EXPORT_NAME_SCOPE = {
+	pairs: "withhold",
+	"log-only": "carry",
+	"mask-only-marks": "withhold",
+	"reference-provenance": "withhold",
+	"physical-name-copies": "withhold",
+	"public-proofs": "withhold"
 };
 function handleOutputResolutionFailure(deps, error, outputKey, outputs, secrets, inheritedSecrets) {
 	const union = unionOfSecretBags([inheritedSecrets, secrets]);
@@ -34872,8 +35032,7 @@ async function resolveOutputs(run, deps, template, resources, stackName, digestS
 			if (!output.Export?.Name) continue;
 			const value = outputs[outputKey];
 			if (value === void 0) continue;
-			const nameSecrets = new ForwardingSecrets(context.recordedSecretValues);
-			if (context.recordedSecretValues) shareLogOnlyValues(nameSecrets, context.recordedSecretValues);
+			const nameSecrets = context.recordedSecretValues ? openRecordingScope(context.recordedSecretValues, EXPORT_NAME_SCOPE).secrets : /* @__PURE__ */ new Map();
 			const nameReads = [];
 			let exportName;
 			try {
@@ -35460,7 +35619,7 @@ function redactRollbackRecord(record, secrets, journaledProps, journaledAttribut
 			source: journaledProps
 		})
 	};
-	return keepPersistedPlainRecordLeaves(scrubResourceRecord(positioned, secrets), record, {
+	return keepPersistedPlainRecordLeaves(scrubResourceRecord(positioned, secrets, void 0, void 0, { observed: isSameGenerationBag(positioned.observedProperties) ? "same-generation" : "unproven" }), record, {
 		properties: journaledProps,
 		attributes: journaledAttributes
 	});
@@ -36592,7 +36751,7 @@ async function replayRevert(s) {
 	refuseMaskedReplayBaseline(desiredProps, op.logicalId, noEcho.inert);
 	logger.info(`  Rollback: Restoring ${safe(op.logicalId)} (${safe(op.resourceType)}) to previous state`);
 	const currentProps = noEcho.onPreviousSide(await resolveReplayProps(current.properties, resolver, secrets, ctx, op.logicalId, current));
-	recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, previousState.properties, STATE_DERIVED_RULES);
+	recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, previousState.properties, "state-derived");
 	opMasker.addNamed({
 		resourceType: op.resourceType,
 		properties: desiredProps,
@@ -36688,7 +36847,7 @@ async function replayReverseReplacement(s) {
 		logicalId: op.logicalId,
 		physicalIds: [prev.physicalId]
 	});
-	recordNestedStackParameterExpressions(secrets, oldType, resolvedPrevProps, prev.properties, STATE_DERIVED_RULES);
+	recordNestedStackParameterExpressions(secrets, oldType, resolvedPrevProps, prev.properties, "state-derived");
 	const deleteFirstBlocked = op.oldDeletedBeforeCreate === true && !rollbackRetainsNewResource(current) ? deleteFirstBlocker(op) : void 0;
 	if (deleteFirstBlocked !== void 0) logger.warn(mask(safeMsg`  Rollback: not deleting the new ${shownLogicalId(op.logicalId)} first: its old properties ` + safeMsg`name the resource ${shownLogicalId(deleteFirstBlocked.logicalId)} had before the same deploy ` + "replaced or deleted it, which this rollback may not be able to restore under that id — re-creating the old resource first, which keeps the new one if that fails"));
 	const reverseDeleteFirst = op.oldDeletedBeforeCreate === true && !rollbackRetainsNewResource(current) && deleteFirstBlocked === void 0;
@@ -37338,7 +37497,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 					const desiredProps = noEcho.desired;
 					refuseMaskedReplayBaseline(desiredProps, op.logicalId, noEcho.inert);
 					const attemptedProps = noEcho.onPreviousSide(await resolveReplayProps(op.attemptedProperties ?? current.properties, resolver, secrets, ctx, op.logicalId, op.attemptedProperties === void 0 ? current : void 0));
-					recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, prev.properties, STATE_DERIVED_RULES);
+					recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, prev.properties, "state-derived");
 					opMasker.addNamed({
 						resourceType: op.resourceType,
 						properties: desiredProps,
@@ -40059,13 +40218,35 @@ function redactOperationsForJournal(deps, operations) {
 		if ((!secrets || secrets.size === 0) && !op.previousState && sources === void 0) return op;
 		const ownSecrets = secrets ?? /* @__PURE__ */ new Map();
 		const next = { ...op };
-		if (next.properties) next.properties = byPosition(redactSecretsForState(next.properties, ownSecrets, templateProps));
-		if (next.attemptedProperties) next.attemptedProperties = byPosition(redactSecretsForState(markSameGenerationBag({ ...next.attemptedProperties }), ownSecrets, templateProps));
+		if (next.properties) {
+			const properties = next.properties;
+			next.properties = byPosition(templateProps === void 0 ? redactForState(properties, {
+				provenance: "value-scan",
+				secrets: ownSecrets
+			}) : redactForState(properties, {
+				provenance: "template-derived",
+				secrets: ownSecrets,
+				source: templateProps,
+				generation: isSameGenerationBag(properties) ? "same-generation" : "unproven"
+			}));
+		}
+		if (next.attemptedProperties) {
+			const attempted = next.attemptedProperties;
+			next.attemptedProperties = byPosition(templateProps === void 0 ? redactForState(attempted, {
+				provenance: "value-scan",
+				secrets: ownSecrets
+			}) : redactForState(attempted, {
+				provenance: "template-derived",
+				secrets: ownSecrets,
+				source: templateProps,
+				generation: "same-generation"
+			}));
+		}
 		if (next.previousState) {
 			const previous = next.previousState;
 			const adopted = adoptedOrphanRecords.get(deps.owner);
 			const loaded = adopted?.has(op.logicalId) ? adopted.get(op.logicalId) : previous;
-			next.previousState = applyNoEchoPersist(deps.noEchoRun(), deps.noEchoDeps(), op.logicalId, previous, keepPersistedPlainRecordLeaves(scrubResourceRecord(previous, ownSecrets, void 0, STATE_SOURCED_READBACK_RULES), previous, loaded ?? {}), void 0, {}, void 0, true);
+			next.previousState = applyNoEchoPersist(deps.noEchoRun(), deps.noEchoDeps(), op.logicalId, previous, keepPersistedPlainRecordLeaves(scrubResourceRecord(previous, ownSecrets, void 0, "state-readback", { observed: isSameGenerationBag(previous.observedProperties) ? "same-generation" : "unproven" }), previous, loaded ?? {}), void 0, {}, void 0, true);
 		}
 		return next;
 	});
@@ -48779,7 +48960,8 @@ var DeployEngine = class {
 		for (const [logicalId, record] of Object.entries(state.resources)) {
 			const secrets = this.secretsRun.perResourceSecrets.get(logicalId);
 			const templateProps = this.secretsRun.perResourceTemplateProps.get(logicalId);
-			const scrubbed = scrubResourceRecord(this.attributeHealer.withHealedAttributes(logicalId, record), secrets ?? /* @__PURE__ */ new Map(), templateProps);
+			const healed = this.attributeHealer.withHealedAttributes(logicalId, record);
+			const scrubbed = scrubResourceRecord(healed, secrets ?? /* @__PURE__ */ new Map(), templateProps, void 0, sameGenerationClaimsOf(healed));
 			const noEchoScrubbed = applyNoEchoPersist(this.noEchoRun, this.noEchoDeps(), logicalId, record, withNoEchoExactEchoes(this.noEchoRun, logicalId, scrubbed), templateProps, state.resources, secrets);
 			resources[logicalId] = withReferenceProvenance(withConstructPath(withMaskedPropertyFingerprints(noEchoScrubbed, record.properties, templateProps, secrets, this.secretsRun.fingerprintNoEchoValues, this.secretsRun.perResourceInputFingerprints.get(logicalId)), constructPathOf(this.noEchoRun.constructPathTemplate, logicalId)), this.referenceProvenanceToPersist(logicalId, record, noEchoScrubbed, secrets));
 		}
@@ -48788,7 +48970,7 @@ var DeployEngine = class {
 			const orphanTemplateProps = sameResource ? this.secretsRun.perResourceTemplateProps.get(entry.logicalId) : void 0;
 			return {
 				...entry,
-				state: withMaskedPropertyFingerprints(applyNoEchoPersist(this.noEchoRun, this.noEchoDeps(), entry.logicalId, entry.state, scrubResourceRecord(entry.state, (sameResource ? this.secretsRun.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), orphanTemplateProps), orphanTemplateProps, state.resources), entry.state.properties, orphanTemplateProps, sameResource ? this.secretsRun.perResourceSecrets.get(entry.logicalId) : void 0, sameResource ? this.secretsRun.fingerprintNoEchoValues : void 0, sameResource ? this.secretsRun.perResourceInputFingerprints.get(entry.logicalId) : void 0)
+				state: withMaskedPropertyFingerprints(applyNoEchoPersist(this.noEchoRun, this.noEchoDeps(), entry.logicalId, entry.state, scrubResourceRecord(entry.state, (sameResource ? this.secretsRun.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), orphanTemplateProps, void 0, sameGenerationClaimsOf(entry.state)), orphanTemplateProps, state.resources), entry.state.properties, orphanTemplateProps, sameResource ? this.secretsRun.perResourceSecrets.get(entry.logicalId) : void 0, sameResource ? this.secretsRun.fingerprintNoEchoValues : void 0, sameResource ? this.secretsRun.perResourceInputFingerprints.get(entry.logicalId) : void 0)
 			};
 		});
 		const outputs = redactOutputs(this.maskingDeps(), state.outputs);
@@ -48939,7 +49121,13 @@ var DeployEngine = class {
 		return maskingRetryLogger(this.logger, secrets);
 	}
 };
+function sameGenerationClaimsOf(record) {
+	return {
+		properties: isSameGenerationBag(record.properties) ? "same-generation" : "unproven",
+		observed: isSameGenerationBag(record.observedProperties) ? "same-generation" : "unproven"
+	};
+}
 
 //#endregion
-export { resolvePendingCloudControlRequests as $, repairMalformedOutputsForReadOnly as $a, warnFinchArgvExposure as $c, accountArgs as $i, buildFinalSnapshotIdentifier as $n, readbackPathFor as $o, DiffCalculator as $r, CrossPrefixScanCache as $s, namesAnyDeclaredParameter as $t, findServiceTokenRefusals as A, refuseMalformedOrphanRecordsForDestroy as Aa, isCrossRegionRedirect as Ac, coerceParameterTypedValue as Ai, derivePartitionAndUrlSuffix as Al, gray as An, replayWarn as Ao, isCustomResourceType as Ar, inheritNestedStackParameterAssociations as As, removeProtectionTypeList as At, parentSuppliedValues as B, refuseMalformedResourceEntriesForImport as Ba, describeDockerFailure as Bc, cfnRefValueFromPhysicalId as Bi, describeFileReadFailure as Bl, journaledOrphanPrintingBag as Bn, sameLambdaFunctionAddress as Bo, UNSPECIFIED_SKIP_REASON as Br, recordMaskOnlyValuesIn as Bs, resolveReplacementOldType as Bt, getPriorAttempts as C, malformedResourcesWarning as Ca, loadPublishableAssetManifest as Cc, applyCallerIdentityCredentials as Ci, findLargeInlineResources as Cl, awaitInFlightSibling as Cn, toFiniteNumber as Co, ProviderRegistry as Cr, withPhysicalNameCopies as Cs, formatResourceLine as Ct, crossStackOutputProvenanceSource as D, refuseDivergentRecordRegionForDestroy as Da, assertAssetBucketRegion as Dc, classifyReplaySecretRegion as Di, expectedOwnerParam as Dl, replacedDeleteFailureVerdict as Dn, configIntegerRefusal as Do, waitForLambdaFunctionActive as Dr, isUncertifiedBaselineMaskPosition as Ds, withApiLimit as Dt, computeImplicitDeleteEdges as E, previewableOrphanRecords as Ea, BOOTSTRAP_MARKER_PREFIX as Ec, classifyRecordedSecretRegion as Ei, decodeListingKey as El, withStackRecords as En, configBooleanRefusal as Eo, wouldReturnToSdkProvider as Er, dynamicReferenceTokens as Es, lookupEachName as Et, listNestedTemplateRows as F, refuseMalformedOutputsForDestroy as Fa, buildDenyExternalAccessPolicy as Fc, carriesDynamicReference as Fi, hasOwnKey as Fl, noEchoComparisonForTemplate as Fn, templateResourceTypes as Fo, customResourceResponseExpirationWarning as Fr, recordPhysicalNameCopy as Fs, planFailedOps as Ft, keptWholeReasonText as G, refuseMalformedResourcePropertiesForExport as Ga, isDockerClientEnvKey as Gc, parameterInputsFor as Gi, injectedAwsRegionValue as Gl, secretNamePrintingBags as Gn, maskAtCoordinates as Go, isWaitAbandonedError as Gr, STATE_SOURCED_CROSS_GENERATION_RULES as Gs, inheritProducerRegions as Gt, withResourceDeadline as H, refuseMalformedResourceEntriesForOrphan as Ha, finchSecretArgvRefusal as Hc, refStateLookupFromResource as Hi, renderAssemblyPathEscape as Hl, namingSecretsWithRecordedNoEcho as Hn, TemplateParser as Ho, deleteLeftInPlace as Hr, recordNoEchoParameterFreshValue as Hs, orphanNeedsIdentity as Ht, renderNestedTemplateTreeDefect as I, refuseMalformedResourceAttributesForOrphan as Ia, buildDockerImage as Ic, carriesFetchableDynamicReference as Ii, hasPlainPrototype$1 as Il, noEchoExactEchoLeavesOf as In, describeTypeWithThrottleRetry as Io, CloudControlProvider as Ir, splitGetAttStringForm as Is, planRollback as It, makeSiblingClaimReader as J, refuseMalformedResourcesForDestroy as Ja, redactDockerArgvValues as Jc, JSON_LISTING_HOLE_VALUE as Ji, stateSecretNameNeedles as Jn, maskedLeafCoordinatesOf as Jo, ec2InstanceProtectionSite as Jr, LockManager as Js, redactedDeleteAddressFields as Jt, mergeNoChangeOutputs as K, refuseMalformedResourcePropertiesForOrphan as Ka, isMalformedEnvKey as Kc, passedParameterClassesOf as Ki, clearBucketRegionCache as Kl, secretNamedAttributeNamesOf as Kn, maskReadbackAtCoordinates as Ko, markWaitAbandoned as Kr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Ks, REDACTED_DELETE_ADDRESS_SKIP_REASON as Kt, templateIdentity as L, refuseMalformedResourceEntries as La, resolveDockerContextDirectory as Lc, isNamelessDynamicReferenceError as Li, nullPrototypeRecord as Ll, noEchoParameterNamesOf as Ln, withRetry as Lo, slowCcOperationTimeoutMs as Lr, carriesSecretMask as Ls, recheckFailedPlan as Lt, childTemplateLoader as M, refuseMalformedOrphansForDestroy as Ma, readBootstrapMarkerBody as Mc, parameterTypeMayLoseSecretIdentity as Mi, StageLoadError as Ml, red as Mn, requireConfigObject as Mo, withPrintingSecrets as Mr, recoverMaskedOutput as Ms, demoteSupersededOrphans as Mt, findNestedTemplateTreeDefect as N, refuseMalformedOrphansForOrphan as Na, validateAssetBucketName as Nc, getAccountInfo as Ni, processStackMessages as Nl, yellow as Nn, requireConfigString as No, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Nr, physicalNameCopiesOf as Ns, isJournaledOrphan as Nt, inheritedProvenanceForChildDiff as O, refuseMalformedNestedChildOutputs as Oa, ensureAssetStorage as Oc, producerRegionsFromState as Oi, PARTITION_TABLE as Ol, bold as On, configStringRefusal as Oo, TemplateNoEchoReresolver as Or, pathCrossesDottedKey as Os, replayFailedOperations as Ot, isAbsoluteAssetPath as P, refuseMalformedOutputs as Pa, validateContainerRepoName as Pc, isImpossibleEmptyStoredAttribute as Pi, defineOwnKey as Pl, noEchoAttributeNamesOf as Pn, prefetchCreateOnlyPropertyPaths as Po, applyCustomResourceResponseExpiration as Pr, recordAttributeIdCopy as Ps, isReplacementOrphan as Pt, pendingRequestCount as Q, repairMalformedOrphansForReadOnly as Qa, runDockerStreaming as Qc, UNREADABLE_RESOURCES_MAP_ROW as Qi, PRE_DELETE_SNAPSHOT_TYPES as Qn, passedNoEchoParametersOf as Qo, reEnableInstanceApiTermination as Qr, CrossPrefixReadError as Qs, computeParameterTaint as Qt, conditionFingerprint as R, refuseMalformedResourceEntriesForDeploy as Ra, describeDockerCapturedOutput as Rc, keepsSecretReferenceToken as Ri, ownValue as Rl, createReadOnlyAttributeHealerFactory as Rn, canonicalLambdaFunctionName as Ro, unchangedBehindSecretReference as Rr, provenPublicValue as Rs, recordUnderIdIsNotOwn as Rt, isTruthyCfnBoolean as S, malformedResourcePropertiesWarning as Sa, createAssetRedirectResolver as Sc, AWS_CREDENTIAL_ENV_KEYS as Si, MIGRATE_TMP_PREFIX as Sl, formatDestructiveChange as Sn, toCfnInteger as So, CC_BROKEN_REASON as Sr, scrubResourceRecord as Ss, sameJournaledOrphans as St, IMPLICIT_DELETE_DEPENDENCIES as T, malformedStateRefusalMessage as Ta, AssetModeResolver as Tc, envCredentialsAreAssumedRole as Ti, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Tl, getStackRecords as Tn, coerceCfnInteger as To, isCustomResource as Tr, DYNAMIC_REFERENCE_TOKEN_SCAN as Ts, isAccessDeniedError as Tt, diffSecurity as U, refuseMalformedResourcePropertiesForDestroy as Ua, formatDockerLoginError as Uc, parseWebACLArn as Ui, resolveAssemblyPath as Ul, orphanRecordsPrintingBag as Un, canonicalCoordinates as Uo, deleteSkipReason as Ur, recordProvenPublicExpression as Us, findNestedStackTypeChanges as Ut, readRecordedConditionVerdicts as V, refuseMalformedResourceEntriesForImportSave as Va, dockerSpawnEnvWithSensitive as Vc, isStalePlaceholderArnAttribute as Vi, displayAssemblyPath as Vl, maskEventTextWithBoundBags as Vn, DagBuilder as Vo, deleteIndeterminateGuards as Vr, recordNoEchoAttributeValues as Vs, seedsDeleteFirstGuard as Vt, isSecretBearingReferenceString as W, refuseMalformedResourcePropertiesForDrift as Wa, getDockerCmd as Wc, withSharedDrainBudget as Wi, injectAwsRegion as Wl, secretNamePrintingBag as Wn, isMarkedCoordinate as Wo, withIndeterminateGuard as Wr, wholeStringLeavesOf as Ws, getCurrentProducerRegions as Wt, DeploymentEventsReader as X, refuseMalformedState as Xa, redactedDockerCause as Xc, STATE_RESOURCES_MALFORMED as Xi, extractDeploymentEventError as Xn, noEchoLeavesOf as Xo, observeThenDisableInstanceApiTermination as Xr, S3StateBackend as Xs, updatePartialMessage as Xt, planOrphanAdoption as Y, refuseMalformedResourcesForExport as Ya, redactedCause as Yc, STATE_REGION_DIVERGED as Yi, storedSecretNameNeedles as Yn, noEchoCoordinatesOf as Yo, isTerminationProtectionPropagationError as Yr, isLockInfoExpired as Ys, redactedDeleteAddressSkip as Yt, DeploymentEventsStore as Z, repairMalformedOrphanRecordsForReadOnly as Za, runDockerForeground as Zc, UNREADABLE_ORPHANS_CONTAINER_ROW as Zi, ATOMIC_FINAL_SNAPSHOT_TYPES as Zn, noEchoOutputsComparison as Zo, reDisableInstanceApiTermination as Zr, rebuildClientForBucketRegion as Zs, updatePartialReason as Zt, deleteTableWithIndexBusyRetry as _, malformedOrphansWarning as _a, AssetPublisher as _c, assertFlagRoleArn as _i, stateBucketExistenceConfirmed as _l, DEFAULT_RESOURCE_TIMEOUT_MS as _n, isStatefulRecreateTargetSync as _o, refuseMalformedDesiredTags as _r, maskSecretsInError as _s, dropFailedHint as _t, isProtectionValueActive as a, isReadableOrphanRecord as aa, acceptedCreateOnlyDropsOf as ac, s3BucketDomainName as ai, Synthesizer as al, secretBearing as an, unreadableResourceEntries as ao, unsupportedFinalSnapshotError as ar, carryLogOnlyValues as as, dropSettledNestedJournals as at, S3_AUTO_DELETE_OBJECTS_TAG as b, malformedRenderedContainersWarning as ba, WorkGraph as bc, isIamRoleArn as bi, CFN_TEMPLATE_BODY_LIMIT as bl, constructPathOf as bn, coerceWarmThroughput as bo, definedAttributes as br, recordReferenceProvenanceEntry as bs, loadJournaledOrphans as bt, DynamoDBGlobalTableProvider as c, malformedExportNamesWarning as ca, hasReadableExportSet as cc, s3BucketWebsiteUrl as ci, getLegacyStateBucketName as cl, carriedExportAliasExposure as cn, findSilentDropProperties as co, reserveStackCreateToken as cr, literalSplitDelimitersOf as cs, recordDisplacedSkips as ct, compensateRemovedDeletionProtection as d, malformedLocalResourceEntriesWarning as da, importableOutputKeys as dc, refuseUnreadableCdkCrossAccountRefs as di, resolveAutoAssetStorage as dl, isWholeDynamicReferenceValue as dn, NO_CC_HANDLERS_REASON as do, isRefusedByName as dr, recordLogOnlyParameterValue as ds, withNestedRevertRun as dt, deployRefusesOrphanRowsReason as ea, applyCrossPrefixScan as ec, INTRINSIC_KEYS as ei, escapeRegExp$3 as el, reachableDivergentParameters as en, repairMalformedResourceEntriesForReadOnly as eo, ccRoutedFinalSnapshotError as er, readsNoEchoSource as es, keptForReadoption as et, deleteBudgetKey as f, malformedLocalResourcesWarning as fa, importableOutputs as fc, keepHeldTokenProvenance as fi, resolveCaptureObservedState as fl, noEchoParameterValueSeed as fn, hasNoCloudControlHandlers as fo, markDeleteStarted as fr, recordLogOnlyValue as fs, collectNestedChildUnaddressed as ft, INDEX_SETTLE_POLL_INTERVAL_MS as g, malformedOrphansRefusalMessage as ga, shouldRetainResource as gc, applyRoleArnIfSet as gi, resolveUseCdkBootstrapAssets as gl, bindingSkippedOutputs as gn, isStatefulRecreateTargetForReplace as go, readTagList as gr, errorCauseChain as gs, dropFailedCommands as gt, DELETE_INDEX_WAIT_PROCEED_NOTE as h, malformedOrphanRowsKeptWarning as ha, orphansCarriedFrom as hc, recordedReferenceRegions as hi, resolveStateBucketWithDefaultAndSource as hl, isExportAliasCollision as hn, MULTI_REGION_RECREATE_BLOCKED_TYPES as ho, planTagDiff as hr, createSecretMasker as hs, deleteJournaledOrphans as ht, PROTECTION_PROPERTY_BY_TYPE as i, hasReadableResources as ia, splitImportedOps as ic, s3BucketArn as ii, getDockerImageBySourceHash as il, exportAliasCollisionScrubWarning as in, unreadableOrphanRecords as io, refusesFinalSnapshot as ir, liveMatchesUnresolvedTokenFrame as is, displacedPhysicalIdShown as it, serviceTokenBlockingReason as j, refuseMalformedOrphans as ja, parseBootstrapMarker as jc, isUnboundTemplateParameter as ji, AssemblyReader as jl, green as jn, requireConfigArray as jo, getCurrentResourceSecrets as jr, recordNestedStackParameterExpressions as js, recordAfterRollbackUpdate as jt, deferredServiceTokenWarning as k, refuseMalformedOrphanRecords as ka, getBootstrapMarkerKey as kc, regionLessSecretName as ki, canonicalizeRegion as kl, cyan as kn, readConfigString as ko, readsNoEchoDeleteValues as kr, identityKeyFor as ks, replayRollback as kt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, malformedExportSourceWarning as la, hasReasonlessBaselineRefusal as lc, resolveDynamicReferences as li, loadCdkJson as ll, exportNameNoEchoParameters as ln, unwrittenCreateOnlyReplacement as lo, withCreateTokenLedger as lr, logOnlyValueCount as ls, revertNestedChildFromJournal as lt, resolveDynamoDbDeleteBudgetMs as m, malformedOrphanRecordsWarning as ma, orphansAfterRollback as mc, recordedOutputReferenceRegions as mi, resolveStateBucketWithDefault as ml, collectPublishedOutputNames as mn, shownType as mo, DBPROXY_TAG_OPTIONS as mr, unionOfSecretBags as ms, withNestedStackContext as mt, recordedProtectionEvidence as n, hasReadableOrphans as na, isAccessDenied$1 as nc, poisonRenderedSpellingsCollidingIn as ni, stripForDisplay as nl, WITHHELD_NAME_DISPLAY as nn, repairMalformedResourcesForReadOnly as no, effectiveDeletionPolicy as nr, valueAtCoordinate as ns, NESTED_PENDING_PARENT_REASON as nt, perType as o, isReadableResourceEntry as oa, describeRegionValueKind as oc, s3BucketDualStackDomainName as oi, synthesisStatusMessage as ol, secretBearingStateKeyWarning as on, withheldAccountClause as oo, earliestDefined as or, createUnionSecretMasker as os, getNestedRevertRun as ot, resolveDynamoDbDeleteBudgetClock as p, malformedOrphanRecordsRefusalMessage as pa, isReadableBag as pc, outputReferenceProvenanceOf as pi, resolveSkipPrefix as pl, collectDeclaredOutputNames as pn, findReplacedReadersOfRecreateTargets as po, DBPROXY_TAGS_WHAT as pr, shareLogOnlyValues as ps, getCurrentNestedStackContext as pt, makeCanonicalizePropertiesFn as q, refuseMalformedResourcesForDeploy as qa, partitionSensitiveEnv as qc, declaresNoEcho as qi, resolveBucketRegion as ql, secretNamedRecordNeedles as qn, maskWholeValue as qo, disableInstanceApiTermination as qr, isSingleDynamicReferenceToken as qs, isRedactedRecordedValue as qt, recordedProtectionNote as r, hasReadableOutputs as ra, isNotImplemented as rc, isSettledInstanceState as ri, AssetManifestLoader as rl, displayTextOrWithheld as rn, unpreviewableOrphanRecords as ro, isFinalSnapshotError as rr, redactForState as rs, displacedOpClause as rt, readProtection as s, malformedDriftResourcePropertiesWarning as sa, exportNamesCarriedFrom as sc, s3BucketRegionalDomainName as si, getDefaultStateBucketName as sl, secretSafeKeyDisplay as sn, findActionableSilentDrops as so, ledgerForStack as sr, hasMaskableValues as ss, nestedChildStackName as st, DeployEngine as t, displayLogicalId as ta, crossPrefixDeniedWarning as tc, IntrinsicFunctionResolver as ti, stripControlChars as tl, resourcesNamingDeclaredParameter as tn, repairMalformedResourcePropertiesForReadOnly as to, createPreDeleteFinalSnapshot as tr, recordedNoEchoValuesOf as ts, recordRetainedForReadoption as tt, beginDeleteWait as u, malformedLocalOutputsWarning as ua, hasUnverifiableParameterRefusal as uc, producerLookupOver as ui, resolveApp as ul, exportNameSecretExposure as un, withoutSilentDropProperties as uo, acquireIdempotencyToken as ur, printingCorpusOf as us, revertedNestedRowIds as ut, waitForIndexesSettled as v, malformedOutputsRefusalMessage as va, isSensitiveAttributeName as vc, assertSendableRoleArn as vi, warnDeprecatedNoPrefixCliFlag as vl, DEFAULT_RESOURCE_WARN_AFTER_MS as vn, renderStatefulReason as vo, tagMapAsList as vr, maskSecretsInText as vs, isHandledOrphan as vt, markRefusedBeforeApplying as w, malformedScrubResourceEntriesRefusalMessage as wa, rewriteTemplateAssetReferences as wc, callerEnvCredentials as wi, uploadCfnTemplate as wl, destroyStackRecordsView as wn, coerceCfnBoolean as wo, ccBrokenReason as wr, withoutPhysicalNameCopies as ws, chunks as wt, hasCdkAutoDeleteTag as x, malformedResourceEntriesWarning as xa, buildAssetRedirectMap as xc, sendableAssumeRoleCommand as xi, CFN_TEMPLATE_URL_LIMIT as xl, findDestructiveChanges as xn, isWarmThroughputDecrease as xo, stringifyIfAssigned as xr, snapshotPassProvenance as xs, makeForeignHolderScan as xt, ECR_AUTO_DELETE_IMAGES_TAG as y, malformedOutputsWarning as ya, stringifyValue as yc, explicitRoleArnOrThrow as yi, ssmResolvedValueType as yl, maskingRetryLogger as yn, WARM_THROUGHPUT_MEMBERS as yo, tagPlanWarning as yr, markSameGenerationBag as ys, journaledOrphanLines as yt, conditionInputsFrom as z, refuseMalformedResourceEntriesForDestroy as za, describeDockerExecFailure as zc, AWS_NO_VALUE as zi, absoluteAssemblyPathEscape as zl, completedReplayEntries as zn, lambdaFunctionNameForMask as zo, RollbackInlinePolicyWriters as zr, recordMaskOnlyValue as zs, replacementNeverSwapped as zt };
-//# sourceMappingURL=deploy-engine-D1z0QUsv.js.map
+export { resolvePendingCloudControlRequests as $, repairMalformedOutputsForReadOnly as $a, escapeRegExp$3 as $c, accountArgs as $i, buildFinalSnapshotIdentifier as $n, readbackPathFor as $o, DiffCalculator as $r, applyCrossPrefixScan as $s, namesAnyDeclaredParameter as $t, findServiceTokenRefusals as A, refuseMalformedOrphanRecordsForDestroy as Aa, parseBootstrapMarker as Ac, coerceParameterTypedValue as Ai, AssemblyReader as Al, gray as An, replayWarn as Ao, isCustomResourceType as Ar, inheritNestedStackParameterAssociations as As, removeProtectionTypeList as At, parentSuppliedValues as B, refuseMalformedResourceEntriesForImport as Ba, dockerSpawnEnvWithSensitive as Bc, cfnRefValueFromPhysicalId as Bi, displayAssemblyPath as Bl, journaledOrphanPrintingBag as Bn, sameLambdaFunctionAddress as Bo, UNSPECIFIED_SKIP_REASON as Br, recordMaskOnlyValuesIn as Bs, resolveReplacementOldType as Bt, getPriorAttempts as C, malformedResourcesWarning as Ca, rewriteTemplateAssetReferences as Cc, applyCallerIdentityCredentials as Ci, uploadCfnTemplate as Cl, awaitInFlightSibling as Cn, toFiniteNumber as Co, ProviderRegistry as Cr, withPhysicalNameCopies as Cs, formatResourceLine as Ct, crossStackOutputProvenanceSource as D, refuseDivergentRecordRegionForDestroy as Da, ensureAssetStorage as Dc, classifyReplaySecretRegion as Di, PARTITION_TABLE as Dl, replacedDeleteFailureVerdict as Dn, configIntegerRefusal as Do, waitForLambdaFunctionActive as Dr, isUncertifiedBaselineMaskPosition as Ds, withApiLimit as Dt, computeImplicitDeleteEdges as E, previewableOrphanRecords as Ea, assertAssetBucketRegion as Ec, classifyRecordedSecretRegion as Ei, expectedOwnerParam as El, withStackRecords as En, configBooleanRefusal as Eo, wouldReturnToSdkProvider as Er, dynamicReferenceTokens as Es, lookupEachName as Et, listNestedTemplateRows as F, refuseMalformedOutputsForDestroy as Fa, buildDockerImage as Fc, carriesDynamicReference as Fi, hasPlainPrototype$1 as Fl, noEchoComparisonForTemplate as Fn, templateResourceTypes as Fo, customResourceResponseExpirationWarning as Fr, recordPhysicalNameCopy as Fs, planFailedOps as Ft, keptWholeReasonText as G, refuseMalformedResourcePropertiesForExport as Ga, isMalformedEnvKey as Gc, parameterInputsFor as Gi, clearBucketRegionCache as Gl, secretNamePrintingBags as Gn, maskAtCoordinates as Go, isWaitAbandonedError as Gr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Gs, inheritProducerRegions as Gt, withResourceDeadline as H, refuseMalformedResourceEntriesForOrphan as Ha, formatDockerLoginError as Hc, refStateLookupFromResource as Hi, resolveAssemblyPath as Hl, namingSecretsWithRecordedNoEcho as Hn, TemplateParser as Ho, deleteLeftInPlace as Hr, recordNoEchoParameterFreshValue as Hs, orphanNeedsIdentity as Ht, renderNestedTemplateTreeDefect as I, refuseMalformedResourceAttributesForOrphan as Ia, resolveDockerContextDirectory as Ic, carriesFetchableDynamicReference as Ii, nullPrototypeRecord as Il, noEchoExactEchoLeavesOf as In, describeTypeWithThrottleRetry as Io, CloudControlProvider as Ir, splitGetAttStringForm as Is, planRollback as It, makeSiblingClaimReader as J, refuseMalformedResourcesForDestroy as Ja, redactedCause as Jc, JSON_LISTING_HOLE_VALUE as Ji, stateSecretNameNeedles as Jn, maskedLeafCoordinatesOf as Jo, ec2InstanceProtectionSite as Jr, isLockInfoExpired as Js, redactedDeleteAddressFields as Jt, mergeNoChangeOutputs as K, refuseMalformedResourcePropertiesForOrphan as Ka, partitionSensitiveEnv as Kc, passedParameterClassesOf as Ki, resolveBucketRegion as Kl, secretNamedAttributeNamesOf as Kn, maskReadbackAtCoordinates as Ko, markWaitAbandoned as Kr, isSingleDynamicReferenceToken as Ks, REDACTED_DELETE_ADDRESS_SKIP_REASON as Kt, templateIdentity as L, refuseMalformedResourceEntries as La, describeDockerCapturedOutput as Lc, isNamelessDynamicReferenceError as Li, ownValue as Ll, noEchoParameterNamesOf as Ln, withRetry as Lo, slowCcOperationTimeoutMs as Lr, carriesSecretMask as Ls, recheckFailedPlan as Lt, childTemplateLoader as M, refuseMalformedOrphansForDestroy as Ma, validateAssetBucketName as Mc, parameterTypeMayLoseSecretIdentity as Mi, processStackMessages as Ml, red as Mn, requireConfigObject as Mo, withPrintingSecrets as Mr, recoverMaskedOutput as Ms, demoteSupersededOrphans as Mt, findNestedTemplateTreeDefect as N, refuseMalformedOrphansForOrphan as Na, validateContainerRepoName as Nc, getAccountInfo as Ni, defineOwnKey as Nl, yellow as Nn, requireConfigString as No, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Nr, physicalNameCopiesOf as Ns, isJournaledOrphan as Nt, inheritedProvenanceForChildDiff as O, refuseMalformedNestedChildOutputs as Oa, getBootstrapMarkerKey as Oc, producerRegionsFromState as Oi, canonicalizeRegion as Ol, bold as On, configStringRefusal as Oo, TemplateNoEchoReresolver as Or, pathCrossesDottedKey as Os, replayFailedOperations as Ot, isAbsoluteAssetPath as P, refuseMalformedOutputs as Pa, buildDenyExternalAccessPolicy as Pc, isImpossibleEmptyStoredAttribute as Pi, hasOwnKey as Pl, noEchoAttributeNamesOf as Pn, prefetchCreateOnlyPropertyPaths as Po, applyCustomResourceResponseExpiration as Pr, recordAttributeIdCopy as Ps, isReplacementOrphan as Pt, pendingRequestCount as Q, repairMalformedOrphansForReadOnly as Qa, warnFinchArgvExposure as Qc, UNREADABLE_RESOURCES_MAP_ROW as Qi, PRE_DELETE_SNAPSHOT_TYPES as Qn, passedNoEchoParametersOf as Qo, reEnableInstanceApiTermination as Qr, CrossPrefixScanCache as Qs, computeParameterTaint as Qt, conditionFingerprint as R, refuseMalformedResourceEntriesForDeploy as Ra, describeDockerExecFailure as Rc, keepsSecretReferenceToken as Ri, absoluteAssemblyPathEscape as Rl, createReadOnlyAttributeHealerFactory as Rn, canonicalLambdaFunctionName as Ro, unchangedBehindSecretReference as Rr, provenPublicValue as Rs, recordUnderIdIsNotOwn as Rt, isTruthyCfnBoolean as S, malformedResourcePropertiesWarning as Sa, loadPublishableAssetManifest as Sc, AWS_CREDENTIAL_ENV_KEYS as Si, findLargeInlineResources as Sl, formatDestructiveChange as Sn, toCfnInteger as So, CC_BROKEN_REASON as Sr, scrubResourceRecord as Ss, sameJournaledOrphans as St, IMPLICIT_DELETE_DEPENDENCIES as T, malformedStateRefusalMessage as Ta, BOOTSTRAP_MARKER_PREFIX as Tc, envCredentialsAreAssumedRole as Ti, decodeListingKey as Tl, getStackRecords as Tn, coerceCfnInteger as To, isCustomResource as Tr, DYNAMIC_REFERENCE_TOKEN_SCAN as Ts, isAccessDeniedError as Tt, diffSecurity as U, refuseMalformedResourcePropertiesForDestroy as Ua, getDockerCmd as Uc, parseWebACLArn as Ui, injectAwsRegion as Ul, orphanRecordsPrintingBag as Un, canonicalCoordinates as Uo, deleteSkipReason as Ur, recordProvenPublicExpression as Us, findNestedStackTypeChanges as Ut, readRecordedConditionVerdicts as V, refuseMalformedResourceEntriesForImportSave as Va, finchSecretArgvRefusal as Vc, isStalePlaceholderArnAttribute as Vi, renderAssemblyPathEscape as Vl, maskEventTextWithBoundBags as Vn, DagBuilder as Vo, deleteIndeterminateGuards as Vr, recordNoEchoAttributeValues as Vs, seedsDeleteFirstGuard as Vt, isSecretBearingReferenceString as W, refuseMalformedResourcePropertiesForDrift as Wa, isDockerClientEnvKey as Wc, withSharedDrainBudget as Wi, injectedAwsRegionValue as Wl, secretNamePrintingBag as Wn, isMarkedCoordinate as Wo, withIndeterminateGuard as Wr, wholeStringLeavesOf as Ws, getCurrentProducerRegions as Wt, DeploymentEventsReader as X, refuseMalformedState as Xa, runDockerForeground as Xc, STATE_RESOURCES_MALFORMED as Xi, extractDeploymentEventError as Xn, noEchoLeavesOf as Xo, observeThenDisableInstanceApiTermination as Xr, rebuildClientForBucketRegion as Xs, updatePartialMessage as Xt, planOrphanAdoption as Y, refuseMalformedResourcesForExport as Ya, redactedDockerCause as Yc, STATE_REGION_DIVERGED as Yi, storedSecretNameNeedles as Yn, noEchoCoordinatesOf as Yo, isTerminationProtectionPropagationError as Yr, S3StateBackend as Ys, redactedDeleteAddressSkip as Yt, DeploymentEventsStore as Z, repairMalformedOrphanRecordsForReadOnly as Za, runDockerStreaming as Zc, UNREADABLE_ORPHANS_CONTAINER_ROW as Zi, ATOMIC_FINAL_SNAPSHOT_TYPES as Zn, noEchoOutputsComparison as Zo, reDisableInstanceApiTermination as Zr, CrossPrefixReadError as Zs, updatePartialReason as Zt, deleteTableWithIndexBusyRetry as _, malformedOrphansWarning as _a, isSensitiveAttributeName as _c, assertFlagRoleArn as _i, warnDeprecatedNoPrefixCliFlag as _l, DEFAULT_RESOURCE_TIMEOUT_MS as _n, isStatefulRecreateTargetSync as _o, refuseMalformedDesiredTags as _r, unionOfSecretBags as _s, dropFailedHint as _t, isProtectionValueActive as a, isReadableOrphanRecord as aa, describeRegionValueKind as ac, s3BucketDomainName as ai, synthesisStatusMessage as al, secretBearing as an, unreadableResourceEntries as ao, unsupportedFinalSnapshotError as ar, redactForState as as, dropSettledNestedJournals as at, S3_AUTO_DELETE_OBJECTS_TAG as b, malformedRenderedContainersWarning as ba, buildAssetRedirectMap as bc, isIamRoleArn as bi, CFN_TEMPLATE_URL_LIMIT as bl, constructPathOf as bn, coerceWarmThroughput as bo, definedAttributes as br, maskSecretsInError as bs, loadJournaledOrphans as bt, DynamoDBGlobalTableProvider as c, malformedExportNamesWarning as ca, hasReasonlessBaselineRefusal as cc, s3BucketWebsiteUrl as ci, loadCdkJson as cl, carriedExportAliasExposure as cn, findSilentDropProperties as co, reserveStackCreateToken as cr, carryLogOnlyValues as cs, recordDisplacedSkips as ct, compensateRemovedDeletionProtection as d, malformedLocalResourceEntriesWarning as da, importableOutputs as dc, refuseUnreadableCdkCrossAccountRefs as di, resolveCaptureObservedState as dl, isWholeDynamicReferenceValue as dn, NO_CC_HANDLERS_REASON as do, isRefusedByName as dr, literalSplitDelimitersOf as ds, withNestedRevertRun as dt, deployRefusesOrphanRowsReason as ea, crossPrefixDeniedWarning as ec, INTRINSIC_KEYS as ei, stripControlChars as el, reachableDivergentParameters as en, repairMalformedResourceEntriesForReadOnly as eo, ccRoutedFinalSnapshotError as er, readsNoEchoSource as es, keptForReadoption as et, deleteBudgetKey as f, malformedLocalResourcesWarning as fa, isReadableBag as fc, keepHeldTokenProvenance as fi, resolveSkipPrefix as fl, noEchoParameterValueSeed as fn, hasNoCloudControlHandlers as fo, markDeleteStarted as fr, logOnlyValueCount as fs, collectNestedChildUnaddressed as ft, INDEX_SETTLE_POLL_INTERVAL_MS as g, malformedOrphansRefusalMessage as ga, AssetPublisher as gc, applyRoleArnIfSet as gi, stateBucketExistenceConfirmed as gl, bindingSkippedOutputs as gn, isStatefulRecreateTargetForReplace as go, readTagList as gr, shareLogOnlyValues as gs, dropFailedCommands as gt, DELETE_INDEX_WAIT_PROCEED_NOTE as h, malformedOrphanRowsKeptWarning as ha, shouldRetainResource as hc, recordedReferenceRegions as hi, resolveUseCdkBootstrapAssets as hl, isExportAliasCollision as hn, MULTI_REGION_RECREATE_BLOCKED_TYPES as ho, planTagDiff as hr, recordLogOnlyValue as hs, deleteJournaledOrphans as ht, PROTECTION_PROPERTY_BY_TYPE as i, hasReadableResources as ia, acceptedCreateOnlyDropsOf as ic, s3BucketArn as ii, Synthesizer as il, exportAliasCollisionScrubWarning as in, unreadableOrphanRecords as io, refusesFinalSnapshot as ir, markSameGenerationBag as is, displacedPhysicalIdShown as it, serviceTokenBlockingReason as j, refuseMalformedOrphans as ja, readBootstrapMarkerBody as jc, isUnboundTemplateParameter as ji, StageLoadError as jl, green as jn, requireConfigArray as jo, getCurrentResourceSecrets as jr, recordNestedStackParameterExpressions as js, recordAfterRollbackUpdate as jt, deferredServiceTokenWarning as k, refuseMalformedOrphanRecords as ka, isCrossRegionRedirect as kc, regionLessSecretName as ki, derivePartitionAndUrlSuffix as kl, cyan as kn, readConfigString as ko, readsNoEchoDeleteValues as kr, identityKeyFor as ks, replayRollback as kt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, malformedExportSourceWarning as la, hasUnverifiableParameterRefusal as lc, resolveDynamicReferences as li, resolveApp as ll, exportNameNoEchoParameters as ln, unwrittenCreateOnlyReplacement as lo, withCreateTokenLedger as lr, createUnionSecretMasker as ls, revertNestedChildFromJournal as lt, resolveDynamoDbDeleteBudgetMs as m, malformedOrphanRecordsWarning as ma, orphansCarriedFrom as mc, recordedOutputReferenceRegions as mi, resolveStateBucketWithDefaultAndSource as ml, collectPublishedOutputNames as mn, shownType as mo, DBPROXY_TAG_OPTIONS as mr, recordLogOnlyParameterValue as ms, withNestedStackContext as mt, recordedProtectionEvidence as n, hasReadableOrphans as na, isNotImplemented as nc, poisonRenderedSpellingsCollidingIn as ni, AssetManifestLoader as nl, WITHHELD_NAME_DISPLAY as nn, repairMalformedResourcesForReadOnly as no, effectiveDeletionPolicy as nr, valueAtCoordinate as ns, NESTED_PENDING_PARENT_REASON as nt, perType as o, isReadableResourceEntry as oa, exportNamesCarriedFrom as oc, s3BucketDualStackDomainName as oi, getDefaultStateBucketName as ol, secretBearingStateKeyWarning as on, withheldAccountClause as oo, earliestDefined as or, recordReferenceProvenanceEntry as os, getNestedRevertRun as ot, resolveDynamoDbDeleteBudgetClock as p, malformedOrphanRecordsRefusalMessage as pa, orphansAfterRollback as pc, outputReferenceProvenanceOf as pi, resolveStateBucketWithDefault as pl, collectDeclaredOutputNames as pn, findReplacedReadersOfRecreateTargets as po, DBPROXY_TAGS_WHAT as pr, printingCorpusOf as ps, getCurrentNestedStackContext as pt, makeCanonicalizePropertiesFn as q, refuseMalformedResourcesForDeploy as qa, redactDockerArgvValues as qc, declaresNoEcho as qi, secretNamedRecordNeedles as qn, maskWholeValue as qo, disableInstanceApiTermination as qr, LockManager as qs, isRedactedRecordedValue as qt, recordedProtectionNote as r, hasReadableOutputs as ra, splitImportedOps as rc, isSettledInstanceState as ri, getDockerImageBySourceHash as rl, displayTextOrWithheld as rn, unpreviewableOrphanRecords as ro, isFinalSnapshotError as rr, liveMatchesUnresolvedTokenFrame as rs, displacedOpClause as rt, readProtection as s, malformedDriftResourcePropertiesWarning as sa, hasReadableExportSet as sc, s3BucketRegionalDomainName as si, getLegacyStateBucketName as sl, secretSafeKeyDisplay as sn, findActionableSilentDrops as so, ledgerForStack as sr, snapshotPassProvenance as ss, nestedChildStackName as st, DeployEngine as t, displayLogicalId as ta, isAccessDenied$1 as tc, IntrinsicFunctionResolver as ti, stripForDisplay as tl, resourcesNamingDeclaredParameter as tn, repairMalformedResourcePropertiesForReadOnly as to, createPreDeleteFinalSnapshot as tr, recordedNoEchoValuesOf as ts, recordRetainedForReadoption as tt, beginDeleteWait as u, malformedLocalOutputsWarning as ua, importableOutputKeys as uc, producerLookupOver as ui, resolveAutoAssetStorage as ul, exportNameSecretExposure as un, withoutSilentDropProperties as uo, acquireIdempotencyToken as ur, hasMaskableValues as us, revertedNestedRowIds as ut, waitForIndexesSettled as v, malformedOutputsRefusalMessage as va, stringifyValue as vc, assertSendableRoleArn as vi, ssmResolvedValueType as vl, DEFAULT_RESOURCE_WARN_AFTER_MS as vn, renderStatefulReason as vo, tagMapAsList as vr, createSecretMasker as vs, isHandledOrphan as vt, markRefusedBeforeApplying as w, malformedScrubResourceEntriesRefusalMessage as wa, AssetModeResolver as wc, callerEnvCredentials as wi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as wl, destroyStackRecordsView as wn, coerceCfnBoolean as wo, ccBrokenReason as wr, withoutPhysicalNameCopies as ws, chunks as wt, hasCdkAutoDeleteTag as x, malformedResourceEntriesWarning as xa, createAssetRedirectResolver as xc, sendableAssumeRoleCommand as xi, MIGRATE_TMP_PREFIX as xl, findDestructiveChanges as xn, isWarmThroughputDecrease as xo, stringifyIfAssigned as xr, maskSecretsInText as xs, makeForeignHolderScan as xt, ECR_AUTO_DELETE_IMAGES_TAG as y, malformedOutputsWarning as ya, WorkGraph as yc, explicitRoleArnOrThrow as yi, CFN_TEMPLATE_BODY_LIMIT as yl, maskingRetryLogger as yn, WARM_THROUGHPUT_MEMBERS as yo, tagPlanWarning as yr, errorCauseChain as ys, journaledOrphanLines as yt, conditionInputsFrom as z, refuseMalformedResourceEntriesForDestroy as za, describeDockerFailure as zc, AWS_NO_VALUE as zi, describeFileReadFailure as zl, completedReplayEntries as zn, lambdaFunctionNameForMask as zo, RollbackInlinePolicyWriters as zr, recordMaskOnlyValue as zs, replacementNeverSwapped as zt };
+//# sourceMappingURL=deploy-engine-6bGIDa7Z.js.map