@go-to-k/cdkd 0.301.7 → 0.301.9

package/dist/{deploy-engine-zLKsm0IM.js → deploy-engine-BN6g5voc.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-B_CEQGE1.js";
 import { A as UNRENDERABLE, B as safeMsg, C as looksLikeCdkdGeneratedName, D as SAFE_MSG_ALTERED_CHAR, E as withoutGeneratedFallbackName, F as displaySafe, H as terminalSafe, I as displayStackName, L as isPasteableIdent, N as displayAwsMessage, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, S as getCurrentStackName, T as withStackName, U as truncateCodePoints, a as getLogger, b as generateResourceNameWithFallback, d as installLogLineMaskerSource, f as getLiveRenderer, g as applyDefaultNameForFallback, j as asIsMessage, k as STACK_REF_MAX_CODE_POINTS, o as isStdoutReservedForPayload, r as safeStringify$1, t as describeAwsFailure, u as currentLogLineMasker, v as explicitNamePropertyFor, w as withSkipPrefix, x as getCurrentSkipPrefix, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
-import { $ as protectedReplacementAdvice, $n as markReplayMayCollide, $t as ambientCredentialConfig, A as isQuotableImportValue, An as SHELL_ACTIVE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, Ct as RETRY_AUXILIARY_OWNER, Dn as normalizeAwsError, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as isUpdateUnsupportedError, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as withheldTargetClause, Ht as recoveryCommandFlags, In as pasteableCommand, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as isNameCollisionErrorFrom, Kn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as physicalIdShownBesideCommand, M as quotedRemedyLogicalId, Mn as UNSHOWABLE_VALUE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Ot as hasCreatedBeforeFailure, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as plainOrDescribed, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Ut as sanitizeRecoveryValue, Vn as shellQuote, Vt as formatLockOwner, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isRecreateRetryableError, Yn as isNameCooldownError, Yt as producerRecordKey, Zn as isReplayedNameCollisionFrom, Zt as withPasteableAwsProfile, _t as createMaskedLogSinks, ar as isIamPropagationError, at as startInterruptWatch, bn as ResourceUpdateNotSupportedError, bt as maskDeep, cr as retryClassificationText, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dr as isThrottlingError, en as clientDefaultsFor, f as removalWarning, fr as markNonRetryable, ft as logicalIdShown, gt as stateOrphanRecordRemedy, hn as MalformedProducerRecordRefusalError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as SHELL_ACTIVE_WHY, jt as markAuxiliaryFailure, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DynamicReferenceRegionAmbiguousError, m as withoutInjectedRemovals, mn as MacroExpansionError, mr as wrapMaskedAwsError, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as isAmbiguousCcHandlerErrorCode, on as CrossAccountSecretRefusalError, or as isRetryableTransientError, ot as ElapsedBudgetRegistry, pn as LockError, pr as markRedactedCause, rn as AssetError, rr as isAmbiguousOutcomeError, sn as DependencyError, sr as isTransientServerError, st as monotonicNowMs, tn as credentialFingerprint, tr as formatRetryClassificationSignals, un as IntrinsicResolutionRefusalError, ur as isMarkedNonRetryable, ut as compositeIdSeparatorRefusal, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as SynthesisError, wt as carryCreatedBeforeFailure, xt as maskerOrIdentity, yn as ResourceTimeoutError, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-LyArt3ew.js";
+import { $ as protectedReplacementAdvice, $n as markReplayMayCollide, $t as ambientCredentialConfig, A as isQuotableImportValue, An as SHELL_ACTIVE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, Ct as RETRY_AUXILIARY_OWNER, Dn as normalizeAwsError, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as isUpdateUnsupportedError, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as withheldTargetClause, Ht as recoveryCommandFlags, In as pasteableCommand, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as isNameCollisionErrorFrom, Kn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as physicalIdShownBesideCommand, M as quotedRemedyLogicalId, Mn as UNSHOWABLE_VALUE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Ot as hasCreatedBeforeFailure, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as plainOrDescribed, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Ut as sanitizeRecoveryValue, Vn as shellQuote, Vt as formatLockOwner, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isRecreateRetryableError, Yn as isNameCooldownError, Yt as producerRecordKey, Zn as isReplayedNameCollisionFrom, Zt as withPasteableAwsProfile, _t as createMaskedLogSinks, at as startInterruptWatch, bn as ResourceUpdateNotSupportedError, bt as maskDeep, cr as isTransientServerError, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dr as isMarkedNonRetryable, en as clientDefaultsFor, f as removalWarning, fr as isThrottlingError, ft as logicalIdShown, gt as stateOrphanRecordRemedy, hn as MalformedProducerRecordRefusalError, hr as wrapMaskedAwsError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isAmbiguousOutcomeError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as SHELL_ACTIVE_WHY, jt as markAuxiliaryFailure, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DynamicReferenceRegionAmbiguousError, lr as retryClassificationText, m as withoutInjectedRemovals, mn as MacroExpansionError, mr as markRedactedCause, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as formatRetryClassificationSignals, on as CrossAccountSecretRefusalError, or as isIamPropagationError, ot as ElapsedBudgetRegistry, pn as LockError, pr as markNonRetryable, rn as AssetError, rr as isAmbiguousCcHandlerErrorCode, sn as DependencyError, sr as isRetryableTransientError, st as monotonicNowMs, tn as credentialFingerprint, un as IntrinsicResolutionRefusalError, ut as compositeIdSeparatorRefusal, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as SynthesisError, wt as carryCreatedBeforeFailure, xt as maskerOrIdentity, yn as ResourceTimeoutError, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-DJmfxbko.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-DBXBcg0J.js";
-import { t as getCdkdVersion } from "./version-MUc6NbW0.js";
+import { t as getCdkdVersion } from "./version-BWoiT1SX.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7429,6 +7429,13 @@ function recordProvenPublicExpression(bag, expression, value) {
 	if (prior === false) return;
 	proofs.set(expression, prior === void 0 || prior === value ? value : false);
 }
+function sharePublicProofs(view, pass) {
+	provenPublicExpressions.set(view, proofsOf(pass));
+}
+function carryPublicProofs(from, to) {
+	for (const [expression, value] of provenPublicExpressions.get(from) ?? []) if (value === false) contradictProvenPublicExpression(to, expression);
+	else recordProvenPublicExpression(to, expression, value);
+}
 function contradictProvenPublicExpression(bag, expression) {
 	proofsOf(bag).set(expression, false);
 }
@@ -9393,6 +9400,16 @@ function differingStringLeaves(legacy, current, out = []) {
 	}
 	return out;
 }
+function legacyLeavesWithoutMask(legacy) {
+	if (typeof legacy === "string") return legacy.includes("***") ? void 0 : legacy;
+	if (Array.isArray(legacy)) return legacy.map(legacyLeavesWithoutMask);
+	if (legacy !== null && typeof legacy === "object") {
+		const out = Object.create(null);
+		for (const [key, value] of Object.entries(legacy)) out[key] = legacyLeavesWithoutMask(value);
+		return out;
+	}
+	return legacy;
+}
 function legacyReferenceLeavesOnly(legacy) {
 	if (typeof legacy === "string") return legacy.includes("{{resolve:") ? legacy : void 0;
 	if (Array.isArray(legacy)) return legacy.map(legacyReferenceLeavesOnly);
@@ -9627,6 +9644,562 @@ function repairEmbeddedPhysicalNamesTowards(stored, target, pairs) {
 	return stored;
 }
 
+//#endregion
+//#region src/deployment/secret-redaction/mask-errors.ts
+function maskSecretsInText(text, secrets) {
+	const logOnly = logOnlyValuesOf.get(secrets);
+	const noLogOnly = logOnly === void 0 || logOnly.size === 0;
+	if (secrets.size === 0 && noLogOnly) return text;
+	if (text !== "" && (secrets.has(text) || logOnly?.has(text) === true)) return "***";
+	return maskMatchSpans(text, printingNeedles(noLogOnly ? secrets.keys() : [...secrets.keys(), ...logOnly]), "***");
+}
+function maskRecordedSecretsInText(text, secrets) {
+	if (secrets.size === 0) return text;
+	if (text !== "" && secrets.has(text)) return "***";
+	return maskMatchSpans(text, substringNeedles(secrets.keys()), "***");
+}
+function substringNeedles(values) {
+	return [...new Set(values)].filter((value) => value.length >= 4);
+}
+const ERROR_CAUSE_MASK_MAX_DEPTH = 20;
+function errorCauseChain(root) {
+	const chain = [];
+	const seen = /* @__PURE__ */ new Set();
+	let current = root;
+	while (current instanceof Error && !seen.has(current) && chain.length < 20) {
+		seen.add(current);
+		chain.push(current);
+		current = current.cause;
+	}
+	return chain;
+}
+function readStack(error) {
+	try {
+		const stack = error.stack;
+		return typeof stack === "string" ? stack : void 0;
+	} catch {
+		return;
+	}
+}
+function maskDescriptorValue(descriptor, maskText) {
+	if (!("value" in descriptor)) return descriptor;
+	const value = maskErrorFieldValue(descriptor.value, maskText);
+	return value === descriptor.value ? descriptor : {
+		...descriptor,
+		value
+	};
+}
+const CLASSIFIER_IDENTIFIER_FIELDS = /* @__PURE__ */ new Set([
+	"name",
+	"code",
+	"Code",
+	"__type",
+	"ccErrorCode",
+	"ccOperation"
+]);
+function isAuxiliaryAnchor(key, descriptor) {
+	return key === "logicalId" && descriptor.enumerable === false && descriptor.writable === false && typeof descriptor.value === "string" && descriptor.value.endsWith("/auxiliary");
+}
+const CREATED_BEFORE_FAILURE_MARK = Symbol.for("cdkd.createdBeforeFailure");
+function isCreatedBeforeFailureMark(key, descriptor) {
+	return key === CREATED_BEFORE_FAILURE_MARK && descriptor.enumerable === false && descriptor.writable === false && typeof descriptor.value === "object" && descriptor.value !== null && Object.isFrozen(descriptor.value);
+}
+function isPlainContainer(value) {
+	const proto = Object.getPrototypeOf(value);
+	return Array.isArray(value) ? proto === Array.prototype : proto === Object.prototype || proto === null;
+}
+function readFieldNode(node) {
+	try {
+		if (!isPlainContainer(node)) return void 0;
+		const entries = [];
+		for (const key of Reflect.ownKeys(node)) {
+			const descriptor = Object.getOwnPropertyDescriptor(node, key);
+			if (descriptor) entries.push([key, descriptor]);
+		}
+		const isArray = Array.isArray(node);
+		return {
+			proto: Object.getPrototypeOf(node),
+			isArray,
+			length: isArray ? Object.getOwnPropertyDescriptor(node, "length") : void 0,
+			extensible: Object.isExtensible(node),
+			entries
+		};
+	} catch {
+		return;
+	}
+}
+function maskErrorFieldValue(value, maskText) {
+	if (typeof value === "string") return maskText(value);
+	if (typeof value !== "object" || value === null) return value;
+	try {
+		const nodes = /* @__PURE__ */ new Map();
+		const seen = /* @__PURE__ */ new Set();
+		let changed = false;
+		let frontier = [value];
+		for (let depth = 0; frontier.length > 0 && depth < 20; depth++) {
+			const next = [];
+			for (const node of frontier) {
+				if (seen.has(node)) continue;
+				seen.add(node);
+				const read = readFieldNode(node);
+				if (!read) continue;
+				nodes.set(node, read);
+				for (const [, descriptor] of read.entries) {
+					if (!("value" in descriptor)) continue;
+					const child = descriptor.value;
+					if (typeof child === "string") {
+						if (!changed && maskText(child) !== child) changed = true;
+					} else if (typeof child === "object" && child !== null) next.push(child);
+				}
+			}
+			frontier = next;
+		}
+		if (!changed) return value;
+		const copies = /* @__PURE__ */ new Map();
+		for (const [node, read] of nodes) copies.set(node, read.isArray ? new Array(read.length?.value ?? 0) : Object.create(read.proto));
+		for (const [node, read] of nodes) {
+			const copy = copies.get(node);
+			for (const [key, original] of read.entries) {
+				if (key === "length" && read.isArray) continue;
+				const descriptor = { ...original };
+				if ("value" in descriptor) {
+					const child = descriptor.value;
+					if (typeof child === "string") descriptor.value = maskText(child);
+					else if (typeof child === "object" && child !== null && copies.has(child)) descriptor.value = copies.get(child);
+				}
+				Object.defineProperty(copy, key, descriptor);
+			}
+			if (read.length?.writable === false) Object.defineProperty(copy, "length", { writable: false });
+			if (!read.extensible) Object.preventExtensions(copy);
+		}
+		return copies.get(value) ?? value;
+	} catch {
+		return value;
+	}
+}
+function maskSecretsInError(error, secrets, extraMask) {
+	if (!(error instanceof Error) || !hasMaskableValues(secrets) && !extraMask) return error;
+	const maskText = (text) => maskSecretsInText(extraMask ? extraMask(text) : text, secrets);
+	const chain = errorCauseChain(error);
+	let changed = false;
+	const links = chain.map((link) => {
+		const message = maskText(link.message);
+		const stack = readStack(link);
+		const maskedStack = typeof stack === "string" ? maskText(stack) : void 0;
+		const descriptors = {};
+		for (const key of Reflect.ownKeys(link)) {
+			if (key === "message" || key === "cause" || key === "stack") continue;
+			const descriptor = Object.getOwnPropertyDescriptor(link, key);
+			if (!descriptor) continue;
+			descriptors[key] = typeof key === "string" && CLASSIFIER_IDENTIFIER_FIELDS.has(key) && typeof descriptor.value === "string" || isAuxiliaryAnchor(key, descriptor) || isCreatedBeforeFailureMark(key, descriptor) ? descriptor : maskDescriptorValue(descriptor, maskText);
+			if (descriptors[key] !== descriptor) changed = true;
+		}
+		let cause = Object.getOwnPropertyDescriptor(link, "cause");
+		if (cause && !("value" in cause && cause.value instanceof Error)) {
+			const masked = maskDescriptorValue(cause, maskText);
+			if (masked !== cause) changed = true;
+			cause = masked;
+		}
+		if (message !== link.message || maskedStack !== stack) changed = true;
+		return {
+			message,
+			stack: maskedStack,
+			descriptors,
+			cause
+		};
+	});
+	if (!changed) return error;
+	const clones = /* @__PURE__ */ new Map();
+	for (const [i, original] of chain.entries()) {
+		const { message, stack, descriptors } = links[i];
+		const clone = Object.create(Object.getPrototypeOf(original), descriptors);
+		Object.defineProperty(clone, "message", {
+			value: message,
+			writable: true,
+			enumerable: false,
+			configurable: true
+		});
+		if (stack !== void 0) Object.defineProperty(clone, "stack", {
+			value: stack,
+			writable: true,
+			enumerable: false,
+			configurable: true
+		});
+		clones.set(original, clone);
+	}
+	for (const [i, original] of chain.entries()) {
+		const causeDescriptor = links[i].cause;
+		if (!causeDescriptor) continue;
+		const clone = clones.get(original);
+		const causeValue = original.cause;
+		const replacement = causeValue instanceof Error ? clones.get(causeValue) : void 0;
+		Object.defineProperty(clone, "cause", replacement ? {
+			value: replacement,
+			writable: true,
+			enumerable: causeDescriptor.enumerable === true,
+			configurable: true
+		} : causeDescriptor);
+	}
+	return clones.get(error);
+}
+function createSecretMasker(secrets) {
+	return (text) => maskSecretsInText(text, secrets);
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/log-only.ts
+const logOnlyValuesOf = /* @__PURE__ */ new WeakMap();
+function recordLogOnlyValue(secrets, plaintext) {
+	if (plaintext === "") return;
+	sideSetOf(logOnlyValuesOf, secrets).add(plaintext);
+}
+function carryLogOnlyValues(from, to) {
+	const values = logOnlyValuesOf.get(from);
+	if (values === void 0 || values.size === 0) return;
+	const into = sideSetOf(logOnlyValuesOf, to);
+	for (const value of values) into.add(value);
+}
+function carryLogOnlyValuesCarriedBy(from, to, value) {
+	const values = logOnlyValuesOf.get(from);
+	if (values === void 0 || values.size === 0) return;
+	const leaves = printedLeavesOf(value);
+	if (leaves.size === 0) return;
+	for (const needle of values) for (const leaf of leaves) if (leaf === needle || needle.length >= 4 && leaf.includes(needle)) {
+		recordLogOnlyValue(to, needle);
+		break;
+	}
+	carryListElementFragments(values, to, value);
+}
+function carryListElementFragments(needles, to, value) {
+	if (!Array.isArray(value) || value.length === 0) return;
+	if (!value.every((e) => typeof e === "string" || typeof e === "number" || typeof e === "boolean")) return;
+	const numeric = value.every((element) => typeof element === "number");
+	const joined = value.map((element) => String(element)).join(",");
+	for (const needle of [...needles]) {
+		const pieces = needle.split(",").map((piece) => piece.trim());
+		if (numeric && pieces.every((piece) => piece === "" || Number.isNaN(Number(piece)))) continue;
+		const fragments = fragmentsOfNeedleIn(joined, ",", pieces.map((piece) => numeric ? String(Number(piece)) : piece).join(","));
+		if (fragments.size === 0) continue;
+		recordLogOnlyValue(to, needle);
+		for (const fragment of fragments) recordLogOnlyValue(to, fragment);
+	}
+}
+function recordLogOnlySplitFragments(from, to, text, delimiter, printed) {
+	if (delimiter === "") return;
+	const splits = [text.split(delimiter)];
+	if (printed !== void 0 && (printed.length !== splits[0].length || printed.some((piece, i) => piece !== splits[0][i]))) splits.push(printed);
+	for (const bag of from) {
+		if (bag === void 0) continue;
+		for (const needle of [...logOnlyValuesOf.get(bag) ?? []]) for (const pieces of splits) for (const fragment of fragmentsOfNeedleIn(text, delimiter, needle, pieces)) if (fragment !== needle) recordLogOnlyValue(to, fragment);
+	}
+}
+function fragmentsOfNeedleIn(text, delimiter, needle, pieces = text.split(delimiter)) {
+	const fragments = /* @__PURE__ */ new Set();
+	if (needle === "") return fragments;
+	const starts = [];
+	if (text === needle) starts.push(0);
+	else if (needle.length >= 4) for (let at = text.indexOf(needle); at !== -1; at = text.indexOf(needle, at + 1)) starts.push(at);
+	if (starts.length === 0) return fragments;
+	const spans = [];
+	let offset = 0;
+	for (const piece of pieces) {
+		spans.push([offset, offset + piece.length]);
+		offset += piece.length + delimiter.length;
+	}
+	for (const start of starts) {
+		const end = start + needle.length;
+		for (const [pieceStart, pieceEnd] of spans) {
+			const from = Math.max(pieceStart, start);
+			const to = Math.min(pieceEnd, end);
+			if (from < to) fragments.add(text.slice(from, to));
+		}
+	}
+	return fragments;
+}
+function printedLeavesOf(value) {
+	const leaves = wholeStringLeavesOf(value);
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (node) => {
+		if (typeof node === "number" || typeof node === "boolean") {
+			leaves.add(String(node));
+			return;
+		}
+		if (node === null || typeof node !== "object") return;
+		if (seen.has(node)) return;
+		seen.add(node);
+		for (const child of Array.isArray(node) ? node : Object.values(node)) walk(child);
+	};
+	walk(value);
+	return leaves;
+}
+function shareLogOnlyValues(view, target) {
+	logOnlyValuesOf.set(view, sideSetOf(logOnlyValuesOf, target));
+}
+function recordLogOnlyParameterValue(secrets, value, splitDelimiters) {
+	const record = (leaf) => {
+		const spelled = typeof leaf === "string" ? leaf : typeof leaf === "number" || typeof leaf === "boolean" ? String(leaf) : void 0;
+		if (spelled === void 0) return;
+		recordLogOnlyValue(secrets, spelled);
+		for (const delimiter of splitDelimiters ?? []) {
+			if (delimiter === "" || !spelled.includes(delimiter)) continue;
+			for (const piece of spelled.split(delimiter)) recordLogOnlyValue(secrets, piece);
+		}
+	};
+	if (Array.isArray(value)) {
+		for (const element of value) record(element);
+		record(value.map((element) => String(element)).join(","));
+		return;
+	}
+	record(value);
+}
+function literalSplitDelimitersOf(template, parameters) {
+	const delimiters = /* @__PURE__ */ new Set();
+	if (parameters.size === 0) return delimiters;
+	const reads = (node, seen) => {
+		if (typeof node === "string") {
+			for (const name of parameters) if (node.includes(`\${${name}}`)) return true;
+			return false;
+		}
+		if (node === null || typeof node !== "object" || seen.has(node)) return false;
+		seen.add(node);
+		if (!Array.isArray(node)) {
+			const ref = node["Ref"];
+			if (typeof ref === "string" && parameters.has(ref)) return true;
+		}
+		for (const child of Array.isArray(node) ? node : Object.values(node)) if (reads(child, seen)) return true;
+		return false;
+	};
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (node) => {
+		if (node === null || typeof node !== "object" || seen.has(node)) return;
+		seen.add(node);
+		if (Array.isArray(node)) {
+			for (const child of node) walk(child);
+			return;
+		}
+		for (const [key, child] of Object.entries(node)) {
+			if (key === "Fn::Split" && Array.isArray(child) && typeof child[0] === "string" && reads(child[1], /* @__PURE__ */ new Set())) delimiters.add(child[0]);
+			walk(child);
+		}
+	};
+	walk(template);
+	return delimiters;
+}
+function printingCorpusOf(secrets) {
+	const logOnly = logOnlyValuesOf.get(secrets);
+	if (logOnly === void 0 || logOnly.size === 0) return secrets;
+	const corpus = new Map(secrets);
+	for (const needle of logOnly) if (!corpus.has(needle)) corpus.set(needle, "***");
+	return corpus;
+}
+function logOnlyValueCount(secrets) {
+	return logOnlyValuesOf.get(secrets)?.size ?? 0;
+}
+function unionOfSecretBags(bags) {
+	const union = /* @__PURE__ */ new Map();
+	for (const bag of bags) {
+		if (bag === void 0) continue;
+		for (const [plaintext, expression] of bag) if (!union.has(plaintext)) union.set(plaintext, expression);
+		carryLogOnlyValues(bag, union);
+	}
+	return union;
+}
+function createUnionSecretMasker(bags) {
+	const present = bags.filter((bag) => bag !== void 0);
+	let stamp;
+	let needles = /* @__PURE__ */ new Set();
+	let scanned = [];
+	return (text) => {
+		const now = present.map((bag) => `${bag.size}:${logOnlyValueCount(bag)}`).join(",");
+		if (now !== stamp) {
+			needles = /* @__PURE__ */ new Set();
+			for (const bag of present) {
+				for (const plaintext of bag.keys()) needles.add(plaintext);
+				for (const plaintext of logOnlyValuesOf.get(bag) ?? []) needles.add(plaintext);
+			}
+			scanned = printingNeedles(needles);
+			stamp = now;
+		}
+		if (text !== "" && needles.has(text)) return "***";
+		return maskMatchSpans(text, scanned, "***");
+	};
+}
+function hasLogOnlyValues(secrets) {
+	if (secrets === void 0) return false;
+	const logOnly = logOnlyValuesOf.get(secrets);
+	return logOnly !== void 0 && logOnly.size > 0;
+}
+function hasMaskableValues(secrets) {
+	if (secrets === void 0) return false;
+	if (secrets.size > 0) return true;
+	const logOnly = logOnlyValuesOf.get(secrets);
+	return logOnly !== void 0 && logOnly.size > 0;
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/reference-provenance.ts
+const passProvenanceOf = /* @__PURE__ */ new WeakMap();
+const MAX_REFERENCE_VERSIONS = 8;
+function provenanceTableFor(secrets) {
+	let table = passProvenanceOf.get(secrets);
+	if (table === void 0) {
+		table = /* @__PURE__ */ new Map();
+		passProvenanceOf.set(secrets, table);
+	}
+	return table;
+}
+function shareReferenceProvenance(view, pass) {
+	passProvenanceOf.set(view, provenanceTableFor(pass));
+}
+function entryFor(secrets, token) {
+	const table = provenanceTableFor(secrets);
+	let entry = table.get(token);
+	if (entry === void 0) {
+		entry = {
+			regions: /* @__PURE__ */ new Set(),
+			regionUnknown: false,
+			versions: /* @__PURE__ */ new Set(),
+			versionUnknown: false,
+			readVersions: /* @__PURE__ */ new Set()
+		};
+		table.set(token, entry);
+	}
+	return entry;
+}
+function recordReferenceResolution(secrets, token, resolution) {
+	const entry = entryFor(secrets, token);
+	if (resolution.region === void 0) entry.regionUnknown = true;
+	else entry.regions.add(resolution.region);
+	if (resolution.version === void 0) {
+		entry.versionUnknown = true;
+		return;
+	}
+	entry.versions.add(resolution.version);
+	if (resolution.route === "read") entry.readVersions.add(resolution.version);
+}
+function recordReferenceProvenanceEntry(secrets, token, provenance, route) {
+	const entry = entryFor(secrets, token);
+	if (provenance.region === void 0) entry.regionUnknown = true;
+	else entry.regions.add(provenance.region);
+	if (provenance.versions === void 0 || provenance.versions.length === 0) {
+		entry.versionUnknown = true;
+		return;
+	}
+	for (const version of provenance.versions) {
+		entry.versions.add(version);
+		if (route === "read") entry.readVersions.add(version);
+	}
+	if (route === "literal") for (const version of provenance.readVersions ?? []) entry.readVersions.add(version);
+}
+function mergeReferenceProvenance(from, to) {
+	const source = passProvenanceOf.get(from);
+	if (source === void 0 || from === to) return;
+	for (const [token, entry] of source) {
+		const target = entryFor(to, token);
+		for (const region of entry.regions) target.regions.add(region);
+		target.regionUnknown ||= entry.regionUnknown;
+		for (const version of entry.versions) target.versions.add(version);
+		target.versionUnknown ||= entry.versionUnknown;
+		for (const version of entry.readVersions) target.readVersions.add(version);
+	}
+}
+function hasPassProvenance(secrets) {
+	if (secrets === void 0) return false;
+	const table = passProvenanceOf.get(secrets);
+	return table !== void 0 && table.size > 0;
+}
+function passProvenanceFor(secrets, token) {
+	if (secrets === void 0) return void 0;
+	const entry = passProvenanceOf.get(secrets)?.get(token);
+	if (entry === void 0) return void 0;
+	return finalize(entry);
+}
+function passReadVersionsFor(secrets, token) {
+	if (secrets === void 0) return void 0;
+	const read = passProvenanceOf.get(secrets)?.get(token)?.readVersions;
+	return read === void 0 || read.size === 0 ? void 0 : read;
+}
+function finalize(entry) {
+	const out = {};
+	if (!entry.regionUnknown && entry.regions.size === 1) out.region = [...entry.regions][0];
+	if (!entry.versionUnknown && entry.versions.size > 0 && entry.versions.size <= 8) {
+		out.versions = [...entry.versions].sort();
+		if (entry.readVersions.size > 0) out.readVersions = [...entry.readVersions].sort();
+	}
+	return out;
+}
+function snapshotPassProvenance(secrets) {
+	if (secrets === void 0) return void 0;
+	const table = passProvenanceOf.get(secrets);
+	if (table === void 0 || table.size === 0) return void 0;
+	const out = /* @__PURE__ */ new Map();
+	for (const [token, entry] of table) out.set(token, finalize(entry));
+	return out;
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/recording.ts
+const scopeMaps = /* @__PURE__ */ new WeakSet();
+var WriteThroughSecrets = class extends Map {
+	pass;
+	constructor(pass) {
+		super();
+		this.pass = pass;
+	}
+	set(plaintext, expression) {
+		super.set(plaintext, expression);
+		this.pass.set(plaintext, expression);
+		return this;
+	}
+};
+function openRecordingScope(pass, policy) {
+	const secrets = new WriteThroughSecrets(pass);
+	scopeMaps.add(secrets);
+	shareLogOnlyValues(secrets, pass);
+	for (const [kind, share] of Object.entries(SCOPE_SHARERS)) if (policy[kind] === "carry") share(secrets, pass);
+	return {
+		secrets,
+		pass
+	};
+}
+const SCOPE_SHARERS = {
+	pairs: sharePairTable,
+	"mask-only-marks": (scope, pass) => {
+		for (const table of [
+			freshNoEchoValuesOf,
+			containmentValuesOf,
+			noEchoParameterValuesOf
+		]) table.set(scope, sideSetOf(table, pass));
+	},
+	"reference-provenance": shareReferenceProvenance,
+	"physical-name-copies": (scope, pass) => {
+		physicalNameCopiesOf.set(scope, sideSetOf(physicalNameCopiesOf, pass));
+	},
+	"public-proofs": sharePublicProofs
+};
+function isRecordingScope(secrets) {
+	return scopeMaps.has(secrets);
+}
+function foldRecording(from, to, policy) {
+	if (from === to) return;
+	for (const [plaintext, expression] of from) to.set(plaintext, expression);
+	for (const [kind, carry] of Object.entries(FOLD_CARRIERS)) if (policy[kind] === "carry") carry(from, to);
+}
+const FOLD_CARRIERS = {
+	"mask-only-marks": carryMaskOnlyMarks,
+	"reference-provenance": mergeReferenceProvenance,
+	pairs: mergePairTables,
+	"log-only": carryLogOnlyValues,
+	"physical-name-copies": (from, to) => {
+		for (const physicalId of physicalNameCopiesOf.get(from) ?? []) recordPhysicalNameCopy(to, physicalId);
+	},
+	"public-proofs": carryPublicProofs
+};
+function recordSecretResolution(secrets, expression, plaintext, options) {
+	secrets.set(plaintext, expression);
+	if (options.pairEvidence) recordResolvedPair(secrets, expression, plaintext);
+}
+
 //#endregion
 //#region src/deployment/secret-redaction/context.ts
 const RULES_BY_PROVENANCE = {
@@ -9638,16 +10211,21 @@ const RULES_BY_PROVENANCE = {
 	"state-derived": STATE_DERIVED_RULES
 };
 function redactForState(bag, context) {
+	refuseScopeAsPass(context.secrets);
 	if (context.provenance === "value-scan") return redactSecretsForState(bag, context.secrets);
 	const { secrets, source, provenance } = context;
-	if (!((context.provenance === "template-derived" || context.provenance === "template-sourced") && context.generation === "same-generation") || !isPlainBag(bag)) return redactAtProvenance(bag, secrets, source, provenance, false);
+	if (!((context.provenance === "template-derived" || context.provenance === "template-sourced" || context.provenance === "state-derived") && context.generation === "same-generation") || !isPlainBag(bag)) return redactAtProvenance(bag, secrets, source, provenance, false);
 	const copy = shallowCopy(bag);
 	const redacted = redactAtProvenance(copy, secrets, source, provenance, true);
 	return redacted === copy ? shallowCopy(copy) : redacted;
 }
 function redactAtProvenance(bag, secrets, source, provenance, sameGeneration) {
+	refuseScopeAsPass(secrets);
 	return redactSecretsForState(bag, secrets, source, RULES_BY_PROVENANCE[provenance], sameGeneration);
 }
+function refuseScopeAsPass(secrets) {
+	if (isRecordingScope(secrets)) throw new Error("Internal error: a bag was redacted for persistence with a recording scope; pass the scope's pass map instead.");
+}
 function isPlainBag(bag) {
 	if (Array.isArray(bag)) return true;
 	if (bag === null || typeof bag !== "object") return false;
@@ -9763,7 +10341,13 @@ function singleSpanFrame(bag, source) {
 function positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration) {
 	const frame = singleSpanFrame(bag, source);
 	if (frame === void 0) {
-		if (dynamicReferenceSpans(source).length >= 2 && certifiesRenderedLiteral(bag, source, secrets, bagIsSameGeneration)) return source;
+		if (dynamicReferenceSpans(source).length >= 2) {
+			if (certifiesRenderedLiteral(bag, source, secrets, bagIsSameGeneration)) return source;
+			if (bagIsSameGeneration) {
+				const mixed = certifiedMixedLiteral(bag, source, secrets);
+				if (mixed !== void 0) return mixed;
+			}
+		}
 		return redactForState(bag, {
 			provenance: "value-scan",
 			secrets
@@ -9835,6 +10419,71 @@ function certifiesRenderedLiteral(bag, source, secrets, bagIsSameGeneration) {
 	if (!bagIsSameGeneration) return false;
 	return scanned === renderSpans(source, spans, (i) => spans[i].plaintext.length >= 4 ? survivors[i] : spans[i].plaintext);
 }
+function certifiedMixedLiteral(bag, source, secrets) {
+	if (legacyMixedScan.has(secrets)) return void 0;
+	const answer = certifyMixedLiteral(bag, source, secrets);
+	if (answer !== void 0) mixedAnswered.add(secrets);
+	return answer;
+}
+const mixedAnswered = /* @__PURE__ */ new WeakSet();
+const legacyMixedScan = /* @__PURE__ */ new WeakSet();
+function mixedLiteralAnswered(secrets) {
+	return mixedAnswered.has(secrets);
+}
+function withLegacyMixedScan(secrets, run) {
+	if (legacyMixedScan.has(secrets)) return run();
+	legacyMixedScan.add(secrets);
+	try {
+		return run();
+	} finally {
+		legacyMixedScan.delete(secrets);
+	}
+}
+function certifyMixedLiteral(bag, source, secrets) {
+	const spans = dynamicReferenceSpans(source);
+	const parts = [];
+	for (const span of spans) {
+		const token = source.slice(span.start, span.end);
+		const plaintext = resolvedPlaintextOf(secrets, token);
+		if (plaintext !== void 0) {
+			if (plaintext === "" || isSingleDynamicReferenceToken(plaintext)) return void 0;
+			const survivor = secrets.get(plaintext);
+			if (survivor === void 0) return void 0;
+			parts.push({
+				kind: "secret",
+				plaintext,
+				survivor
+			});
+			continue;
+		}
+		const value = provenPublicValue(secrets, token);
+		if (value === void 0 || value === "" || value.includes("{{resolve:")) return void 0;
+		parts.push({
+			kind: "public",
+			value
+		});
+	}
+	const secretParts = parts.filter((p) => p.kind === "secret");
+	const publicParts = parts.filter((p) => p.kind === "public");
+	if (secretParts.length === 0 || publicParts.length === 0) return void 0;
+	const textOf = (secret) => (i) => {
+		const part = parts[i];
+		return part.kind === "secret" ? secret(part) : part.value;
+	};
+	if (renderSpans(source, spans, textOf((p) => p.plaintext)) !== bag) return void 0;
+	if (redactForState(source, {
+		provenance: "value-scan",
+		secrets
+	}) !== source) return void 0;
+	if (redactForState(bag, {
+		provenance: "value-scan",
+		secrets
+	}) !== renderSpans(source, spans, textOf((p) => p.plaintext.length >= 4 ? p.survivor : p.plaintext))) return void 0;
+	return renderSpans(source, spans, (i) => {
+		const part = parts[i];
+		return part.kind === "secret" ? source.slice(spans[i].start, spans[i].end) : part.value;
+	});
+}
 function writeFramedTokenWithinScanBound(bag, secrets, frame, bagIsSameGeneration) {
 	const scanned = redactForState(bag, {
 		provenance: "value-scan",
@@ -9880,100 +10529,6 @@ function positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIs
 	}, bagIsSameGeneration);
 }
 
-//#endregion
-//#region src/deployment/secret-redaction/reference-provenance.ts
-const passProvenanceOf = /* @__PURE__ */ new WeakMap();
-const MAX_REFERENCE_VERSIONS = 8;
-function entryFor(secrets, token) {
-	let table = passProvenanceOf.get(secrets);
-	if (table === void 0) {
-		table = /* @__PURE__ */ new Map();
-		passProvenanceOf.set(secrets, table);
-	}
-	let entry = table.get(token);
-	if (entry === void 0) {
-		entry = {
-			regions: /* @__PURE__ */ new Set(),
-			regionUnknown: false,
-			versions: /* @__PURE__ */ new Set(),
-			versionUnknown: false,
-			readVersions: /* @__PURE__ */ new Set()
-		};
-		table.set(token, entry);
-	}
-	return entry;
-}
-function recordReferenceResolution(secrets, token, resolution) {
-	const entry = entryFor(secrets, token);
-	if (resolution.region === void 0) entry.regionUnknown = true;
-	else entry.regions.add(resolution.region);
-	if (resolution.version === void 0) {
-		entry.versionUnknown = true;
-		return;
-	}
-	entry.versions.add(resolution.version);
-	if (resolution.route === "read") entry.readVersions.add(resolution.version);
-}
-function recordReferenceProvenanceEntry(secrets, token, provenance, route) {
-	const entry = entryFor(secrets, token);
-	if (provenance.region === void 0) entry.regionUnknown = true;
-	else entry.regions.add(provenance.region);
-	if (provenance.versions === void 0 || provenance.versions.length === 0) {
-		entry.versionUnknown = true;
-		return;
-	}
-	for (const version of provenance.versions) {
-		entry.versions.add(version);
-		if (route === "read") entry.readVersions.add(version);
-	}
-	if (route === "literal") for (const version of provenance.readVersions ?? []) entry.readVersions.add(version);
-}
-function mergeReferenceProvenance(from, to) {
-	const source = passProvenanceOf.get(from);
-	if (source === void 0 || from === to) return;
-	for (const [token, entry] of source) {
-		const target = entryFor(to, token);
-		for (const region of entry.regions) target.regions.add(region);
-		target.regionUnknown ||= entry.regionUnknown;
-		for (const version of entry.versions) target.versions.add(version);
-		target.versionUnknown ||= entry.versionUnknown;
-		for (const version of entry.readVersions) target.readVersions.add(version);
-	}
-}
-function hasPassProvenance(secrets) {
-	if (secrets === void 0) return false;
-	const table = passProvenanceOf.get(secrets);
-	return table !== void 0 && table.size > 0;
-}
-function passProvenanceFor(secrets, token) {
-	if (secrets === void 0) return void 0;
-	const entry = passProvenanceOf.get(secrets)?.get(token);
-	if (entry === void 0) return void 0;
-	return finalize(entry);
-}
-function passReadVersionsFor(secrets, token) {
-	if (secrets === void 0) return void 0;
-	const read = passProvenanceOf.get(secrets)?.get(token)?.readVersions;
-	return read === void 0 || read.size === 0 ? void 0 : read;
-}
-function finalize(entry) {
-	const out = {};
-	if (!entry.regionUnknown && entry.regions.size === 1) out.region = [...entry.regions][0];
-	if (!entry.versionUnknown && entry.versions.size > 0 && entry.versions.size <= 8) {
-		out.versions = [...entry.versions].sort();
-		if (entry.readVersions.size > 0) out.readVersions = [...entry.readVersions].sort();
-	}
-	return out;
-}
-function snapshotPassProvenance(secrets) {
-	if (secrets === void 0) return void 0;
-	const table = passProvenanceOf.get(secrets);
-	if (table === void 0 || table.size === 0) return void 0;
-	const out = /* @__PURE__ */ new Map();
-	for (const [token, entry] of table) out.set(token, finalize(entry));
-	return out;
-}
-
 //#endregion
 //#region src/deployment/secret-redaction/pairs.ts
 const resolvedPairsOf = /* @__PURE__ */ new WeakMap();
@@ -9995,11 +10550,17 @@ function recordResolvedPair(secrets, expression, plaintext) {
 function mergeResolvedPairs(from, to) {
 	carryMaskOnlyMarks(from, to);
 	mergeReferenceProvenance(from, to);
+	mergePairTables(from, to);
+}
+function mergePairTables(from, to) {
 	const pairs = resolvedPairsOf.get(from);
 	if (pairs === void 0) return;
 	for (const [expression, plaintext] of pairs) if (typeof plaintext === "string") recordResolvedPair(to, expression, plaintext);
 	else pairsFor(to).set(expression, CONFLICTING_PLAINTEXT);
 }
+function sharePairTable(view, pass) {
+	resolvedPairsOf.set(view, pairsFor(pass));
+}
 function resolvedPlaintextOf(secrets, expression) {
 	const recorded = resolvedPairsOf.get(secrets)?.get(expression);
 	return typeof recorded === "string" ? recorded : void 0;
@@ -10083,397 +10644,21 @@ function markSameGenerationBag(bag) {
 function isSameGenerationBag(bag) {
 	return sameGenerationBags.has(bag);
 }
-
-//#endregion
-//#region src/deployment/secret-redaction/mask-errors.ts
-function maskSecretsInText(text, secrets) {
-	const logOnly = logOnlyValuesOf.get(secrets);
-	const noLogOnly = logOnly === void 0 || logOnly.size === 0;
-	if (secrets.size === 0 && noLogOnly) return text;
-	if (text !== "" && (secrets.has(text) || logOnly?.has(text) === true)) return "***";
-	return maskMatchSpans(text, printingNeedles(noLogOnly ? secrets.keys() : [...secrets.keys(), ...logOnly]), "***");
-}
-function maskRecordedSecretsInText(text, secrets) {
-	if (secrets.size === 0) return text;
-	if (text !== "" && secrets.has(text)) return "***";
-	return maskMatchSpans(text, substringNeedles(secrets.keys()), "***");
-}
-function substringNeedles(values) {
-	return [...new Set(values)].filter((value) => value.length >= 4);
-}
-const ERROR_CAUSE_MASK_MAX_DEPTH = 20;
-function errorCauseChain(root) {
-	const chain = [];
-	const seen = /* @__PURE__ */ new Set();
-	let current = root;
-	while (current instanceof Error && !seen.has(current) && chain.length < 20) {
-		seen.add(current);
-		chain.push(current);
-		current = current.cause;
-	}
-	return chain;
-}
-function readStack(error) {
-	try {
-		const stack = error.stack;
-		return typeof stack === "string" ? stack : void 0;
-	} catch {
-		return;
-	}
-}
-function maskDescriptorValue(descriptor, maskText) {
-	if (!("value" in descriptor)) return descriptor;
-	const value = maskErrorFieldValue(descriptor.value, maskText);
-	return value === descriptor.value ? descriptor : {
-		...descriptor,
-		value
-	};
-}
-const CLASSIFIER_IDENTIFIER_FIELDS = /* @__PURE__ */ new Set([
-	"name",
-	"code",
-	"Code",
-	"__type",
-	"ccErrorCode",
-	"ccOperation"
-]);
-function isAuxiliaryAnchor(key, descriptor) {
-	return key === "logicalId" && descriptor.enumerable === false && descriptor.writable === false && typeof descriptor.value === "string" && descriptor.value.endsWith("/auxiliary");
-}
-const CREATED_BEFORE_FAILURE_MARK = Symbol.for("cdkd.createdBeforeFailure");
-function isCreatedBeforeFailureMark(key, descriptor) {
-	return key === CREATED_BEFORE_FAILURE_MARK && descriptor.enumerable === false && descriptor.writable === false && typeof descriptor.value === "object" && descriptor.value !== null && Object.isFrozen(descriptor.value);
-}
-function isPlainContainer(value) {
-	const proto = Object.getPrototypeOf(value);
-	return Array.isArray(value) ? proto === Array.prototype : proto === Object.prototype || proto === null;
-}
-function readFieldNode(node) {
-	try {
-		if (!isPlainContainer(node)) return void 0;
-		const entries = [];
-		for (const key of Reflect.ownKeys(node)) {
-			const descriptor = Object.getOwnPropertyDescriptor(node, key);
-			if (descriptor) entries.push([key, descriptor]);
-		}
-		const isArray = Array.isArray(node);
-		return {
-			proto: Object.getPrototypeOf(node),
-			isArray,
-			length: isArray ? Object.getOwnPropertyDescriptor(node, "length") : void 0,
-			extensible: Object.isExtensible(node),
-			entries
-		};
-	} catch {
-		return;
-	}
-}
-function maskErrorFieldValue(value, maskText) {
-	if (typeof value === "string") return maskText(value);
-	if (typeof value !== "object" || value === null) return value;
-	try {
-		const nodes = /* @__PURE__ */ new Map();
-		const seen = /* @__PURE__ */ new Set();
-		let changed = false;
-		let frontier = [value];
-		for (let depth = 0; frontier.length > 0 && depth < 20; depth++) {
-			const next = [];
-			for (const node of frontier) {
-				if (seen.has(node)) continue;
-				seen.add(node);
-				const read = readFieldNode(node);
-				if (!read) continue;
-				nodes.set(node, read);
-				for (const [, descriptor] of read.entries) {
-					if (!("value" in descriptor)) continue;
-					const child = descriptor.value;
-					if (typeof child === "string") {
-						if (!changed && maskText(child) !== child) changed = true;
-					} else if (typeof child === "object" && child !== null) next.push(child);
-				}
-			}
-			frontier = next;
-		}
-		if (!changed) return value;
-		const copies = /* @__PURE__ */ new Map();
-		for (const [node, read] of nodes) copies.set(node, read.isArray ? new Array(read.length?.value ?? 0) : Object.create(read.proto));
-		for (const [node, read] of nodes) {
-			const copy = copies.get(node);
-			for (const [key, original] of read.entries) {
-				if (key === "length" && read.isArray) continue;
-				const descriptor = { ...original };
-				if ("value" in descriptor) {
-					const child = descriptor.value;
-					if (typeof child === "string") descriptor.value = maskText(child);
-					else if (typeof child === "object" && child !== null && copies.has(child)) descriptor.value = copies.get(child);
-				}
-				Object.defineProperty(copy, key, descriptor);
-			}
-			if (read.length?.writable === false) Object.defineProperty(copy, "length", { writable: false });
-			if (!read.extensible) Object.preventExtensions(copy);
-		}
-		return copies.get(value) ?? value;
-	} catch {
-		return value;
-	}
-}
-function maskSecretsInError(error, secrets, extraMask) {
-	if (!(error instanceof Error) || !hasMaskableValues(secrets) && !extraMask) return error;
-	const maskText = (text) => maskSecretsInText(extraMask ? extraMask(text) : text, secrets);
-	const chain = errorCauseChain(error);
-	let changed = false;
-	const links = chain.map((link) => {
-		const message = maskText(link.message);
-		const stack = readStack(link);
-		const maskedStack = typeof stack === "string" ? maskText(stack) : void 0;
-		const descriptors = {};
-		for (const key of Reflect.ownKeys(link)) {
-			if (key === "message" || key === "cause" || key === "stack") continue;
-			const descriptor = Object.getOwnPropertyDescriptor(link, key);
-			if (!descriptor) continue;
-			descriptors[key] = typeof key === "string" && CLASSIFIER_IDENTIFIER_FIELDS.has(key) && typeof descriptor.value === "string" || isAuxiliaryAnchor(key, descriptor) || isCreatedBeforeFailureMark(key, descriptor) ? descriptor : maskDescriptorValue(descriptor, maskText);
-			if (descriptors[key] !== descriptor) changed = true;
-		}
-		let cause = Object.getOwnPropertyDescriptor(link, "cause");
-		if (cause && !("value" in cause && cause.value instanceof Error)) {
-			const masked = maskDescriptorValue(cause, maskText);
-			if (masked !== cause) changed = true;
-			cause = masked;
-		}
-		if (message !== link.message || maskedStack !== stack) changed = true;
-		return {
-			message,
-			stack: maskedStack,
-			descriptors,
-			cause
-		};
-	});
-	if (!changed) return error;
-	const clones = /* @__PURE__ */ new Map();
-	for (const [i, original] of chain.entries()) {
-		const { message, stack, descriptors } = links[i];
-		const clone = Object.create(Object.getPrototypeOf(original), descriptors);
-		Object.defineProperty(clone, "message", {
-			value: message,
-			writable: true,
-			enumerable: false,
-			configurable: true
-		});
-		if (stack !== void 0) Object.defineProperty(clone, "stack", {
-			value: stack,
-			writable: true,
-			enumerable: false,
-			configurable: true
-		});
-		clones.set(original, clone);
-	}
-	for (const [i, original] of chain.entries()) {
-		const causeDescriptor = links[i].cause;
-		if (!causeDescriptor) continue;
-		const clone = clones.get(original);
-		const causeValue = original.cause;
-		const replacement = causeValue instanceof Error ? clones.get(causeValue) : void 0;
-		Object.defineProperty(clone, "cause", replacement ? {
-			value: replacement,
-			writable: true,
-			enumerable: causeDescriptor.enumerable === true,
-			configurable: true
-		} : causeDescriptor);
-	}
-	return clones.get(error);
-}
-function createSecretMasker(secrets) {
-	return (text) => maskSecretsInText(text, secrets);
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/log-only.ts
-const logOnlyValuesOf = /* @__PURE__ */ new WeakMap();
-function recordLogOnlyValue(secrets, plaintext) {
-	if (plaintext === "") return;
-	sideSetOf(logOnlyValuesOf, secrets).add(plaintext);
-}
-function carryLogOnlyValues(from, to) {
-	const values = logOnlyValuesOf.get(from);
-	if (values === void 0 || values.size === 0) return;
-	const into = sideSetOf(logOnlyValuesOf, to);
-	for (const value of values) into.add(value);
-}
-function carryLogOnlyValuesCarriedBy(from, to, value) {
-	const values = logOnlyValuesOf.get(from);
-	if (values === void 0 || values.size === 0) return;
-	const leaves = printedLeavesOf(value);
-	if (leaves.size === 0) return;
-	for (const needle of values) for (const leaf of leaves) if (leaf === needle || needle.length >= 4 && leaf.includes(needle)) {
-		recordLogOnlyValue(to, needle);
-		break;
-	}
-	carryListElementFragments(values, to, value);
-}
-function carryListElementFragments(needles, to, value) {
-	if (!Array.isArray(value) || value.length === 0) return;
-	if (!value.every((e) => typeof e === "string" || typeof e === "number" || typeof e === "boolean")) return;
-	const numeric = value.every((element) => typeof element === "number");
-	const joined = value.map((element) => String(element)).join(",");
-	for (const needle of [...needles]) {
-		const pieces = needle.split(",").map((piece) => piece.trim());
-		if (numeric && pieces.every((piece) => piece === "" || Number.isNaN(Number(piece)))) continue;
-		const fragments = fragmentsOfNeedleIn(joined, ",", pieces.map((piece) => numeric ? String(Number(piece)) : piece).join(","));
-		if (fragments.size === 0) continue;
-		recordLogOnlyValue(to, needle);
-		for (const fragment of fragments) recordLogOnlyValue(to, fragment);
-	}
-}
-function recordLogOnlySplitFragments(from, to, text, delimiter, printed) {
-	if (delimiter === "") return;
-	const splits = [text.split(delimiter)];
-	if (printed !== void 0 && (printed.length !== splits[0].length || printed.some((piece, i) => piece !== splits[0][i]))) splits.push(printed);
-	for (const bag of from) {
-		if (bag === void 0) continue;
-		for (const needle of [...logOnlyValuesOf.get(bag) ?? []]) for (const pieces of splits) for (const fragment of fragmentsOfNeedleIn(text, delimiter, needle, pieces)) if (fragment !== needle) recordLogOnlyValue(to, fragment);
-	}
-}
-function fragmentsOfNeedleIn(text, delimiter, needle, pieces = text.split(delimiter)) {
-	const fragments = /* @__PURE__ */ new Set();
-	if (needle === "") return fragments;
-	const starts = [];
-	if (text === needle) starts.push(0);
-	else if (needle.length >= 4) for (let at = text.indexOf(needle); at !== -1; at = text.indexOf(needle, at + 1)) starts.push(at);
-	if (starts.length === 0) return fragments;
-	const spans = [];
-	let offset = 0;
-	for (const piece of pieces) {
-		spans.push([offset, offset + piece.length]);
-		offset += piece.length + delimiter.length;
-	}
-	for (const start of starts) {
-		const end = start + needle.length;
-		for (const [pieceStart, pieceEnd] of spans) {
-			const from = Math.max(pieceStart, start);
-			const to = Math.min(pieceEnd, end);
-			if (from < to) fragments.add(text.slice(from, to));
-		}
-	}
-	return fragments;
-}
-function printedLeavesOf(value) {
-	const leaves = wholeStringLeavesOf(value);
-	const seen = /* @__PURE__ */ new Set();
-	const walk = (node) => {
-		if (typeof node === "number" || typeof node === "boolean") {
-			leaves.add(String(node));
-			return;
-		}
-		if (node === null || typeof node !== "object") return;
-		if (seen.has(node)) return;
-		seen.add(node);
-		for (const child of Array.isArray(node) ? node : Object.values(node)) walk(child);
-	};
-	walk(value);
-	return leaves;
-}
-function shareLogOnlyValues(view, target) {
-	logOnlyValuesOf.set(view, sideSetOf(logOnlyValuesOf, target));
-}
-function recordLogOnlyParameterValue(secrets, value, splitDelimiters) {
-	const record = (leaf) => {
-		const spelled = typeof leaf === "string" ? leaf : typeof leaf === "number" || typeof leaf === "boolean" ? String(leaf) : void 0;
-		if (spelled === void 0) return;
-		recordLogOnlyValue(secrets, spelled);
-		for (const delimiter of splitDelimiters ?? []) {
-			if (delimiter === "" || !spelled.includes(delimiter)) continue;
-			for (const piece of spelled.split(delimiter)) recordLogOnlyValue(secrets, piece);
-		}
-	};
-	if (Array.isArray(value)) {
-		for (const element of value) record(element);
-		record(value.map((element) => String(element)).join(","));
-		return;
-	}
-	record(value);
-}
-function literalSplitDelimitersOf(template, parameters) {
-	const delimiters = /* @__PURE__ */ new Set();
-	if (parameters.size === 0) return delimiters;
-	const reads = (node, seen) => {
-		if (typeof node === "string") {
-			for (const name of parameters) if (node.includes(`\${${name}}`)) return true;
-			return false;
-		}
-		if (node === null || typeof node !== "object" || seen.has(node)) return false;
-		seen.add(node);
-		if (!Array.isArray(node)) {
-			const ref = node["Ref"];
-			if (typeof ref === "string" && parameters.has(ref)) return true;
-		}
-		for (const child of Array.isArray(node) ? node : Object.values(node)) if (reads(child, seen)) return true;
-		return false;
-	};
-	const seen = /* @__PURE__ */ new Set();
-	const walk = (node) => {
-		if (node === null || typeof node !== "object" || seen.has(node)) return;
-		seen.add(node);
-		if (Array.isArray(node)) {
-			for (const child of node) walk(child);
-			return;
-		}
-		for (const [key, child] of Object.entries(node)) {
-			if (key === "Fn::Split" && Array.isArray(child) && typeof child[0] === "string" && reads(child[1], /* @__PURE__ */ new Set())) delimiters.add(child[0]);
-			walk(child);
-		}
-	};
-	walk(template);
-	return delimiters;
+const leafCertifiedBags = /* @__PURE__ */ new WeakSet();
+function markLeafCertifiedBag(bag) {
+	leafCertifiedBags.add(bag);
+	return bag;
 }
-function printingCorpusOf(secrets) {
-	const logOnly = logOnlyValuesOf.get(secrets);
-	if (logOnly === void 0 || logOnly.size === 0) return secrets;
-	const corpus = new Map(secrets);
-	for (const needle of logOnly) if (!corpus.has(needle)) corpus.set(needle, "***");
-	return corpus;
+function isLeafCertifiedBag(bag) {
+	return leafCertifiedBags.has(bag);
 }
-function logOnlyValueCount(secrets) {
-	return logOnlyValuesOf.get(secrets)?.size ?? 0;
+function redactionClaimOf(bag) {
+	return isSameGenerationBag(bag) || isLeafCertifiedBag(bag) ? "same-generation" : "unproven";
 }
-function unionOfSecretBags(bags) {
-	const union = /* @__PURE__ */ new Map();
-	for (const bag of bags) {
-		if (bag === void 0) continue;
-		for (const [plaintext, expression] of bag) if (!union.has(plaintext)) union.set(plaintext, expression);
-		carryLogOnlyValues(bag, union);
-	}
-	return union;
-}
-function createUnionSecretMasker(bags) {
-	const present = bags.filter((bag) => bag !== void 0);
-	let stamp;
-	let needles = /* @__PURE__ */ new Set();
-	let scanned = [];
-	return (text) => {
-		const now = present.map((bag) => `${bag.size}:${logOnlyValueCount(bag)}`).join(",");
-		if (now !== stamp) {
-			needles = /* @__PURE__ */ new Set();
-			for (const bag of present) {
-				for (const plaintext of bag.keys()) needles.add(plaintext);
-				for (const plaintext of logOnlyValuesOf.get(bag) ?? []) needles.add(plaintext);
-			}
-			scanned = printingNeedles(needles);
-			stamp = now;
-		}
-		if (text !== "" && needles.has(text)) return "***";
-		return maskMatchSpans(text, scanned, "***");
-	};
-}
-function hasLogOnlyValues(secrets) {
-	if (secrets === void 0) return false;
-	const logOnly = logOnlyValuesOf.get(secrets);
-	return logOnly !== void 0 && logOnly.size > 0;
-}
-function hasMaskableValues(secrets) {
-	if (secrets === void 0) return false;
-	if (secrets.size > 0) return true;
-	const logOnly = logOnlyValuesOf.get(secrets);
-	return logOnly !== void 0 && logOnly.size > 0;
+function carryRedactionMarks(from, to) {
+	if (isSameGenerationBag(from)) markSameGenerationBag(to);
+	if (isLeafCertifiedBag(from)) markLeafCertifiedBag(to);
+	return to;
 }
 
 //#endregion
@@ -22182,10 +22367,7 @@ async function resolveDynamicReferencesWithLogTwin(resolver, value, logTwin, con
 			if (cached) {
 				if (cached.secret && cached.value && !persistedText) refuseSecretAssembledReference(resolver, fullMatch, tokenLogText, context);
 				const recorded = context?.recordedSecretValues;
-				if (cached.secret && cached.value && recorded) {
-					recorded.set(cached.value, fullMatch);
-					if (!pinnedGeneration) recordResolvedPair(recorded, fullMatch, cached.value);
-				}
+				if (cached.secret && cached.value && recorded) recordSecretResolution(recorded, fullMatch, cached.value, { pairEvidence: !pinnedGeneration });
 				if (cached.secret && cached.value) recordProvenanceOfResolution(resolver, context, fullMatch, cached.version);
 				if (service === "ssm" && !cached.secret && recorded && !resolver.producerRegionGuest) recordProvenPublicExpression(recorded, fullMatch, cached.value);
 				result = result.replace(fullMatch, () => cached.value);
@@ -22254,10 +22436,7 @@ async function resolveDynamicReferencesWithLogTwin(resolver, value, logTwin, con
 			});
 			if (isSecret && resolved) {
 				const recorded = context?.recordedSecretValues;
-				if (recorded) {
-					recorded.set(resolved, fullMatch);
-					if (!pinnedGeneration) recordResolvedPair(recorded, fullMatch, resolved);
-				}
+				if (recorded) recordSecretResolution(recorded, fullMatch, resolved, { pairEvidence: !pinnedGeneration });
 				recordProvenanceOfResolution(resolver, context, fullMatch, resolvedVersion);
 				if (service === "secretsmanager" || service === "ssm-secure") pinSecretVerdict(resolver, fullMatch, true, verdictScope);
 			}
@@ -27075,7 +27254,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-C14GB-Hy.js");
+			const { ASGProvider } = await import("./asg-provider-BsUcTrJN.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -27181,7 +27360,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-DagnUCn-.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-BlpYIZQP.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-iwtmIiPb.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-Dq6PuG9E.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -33799,12 +33978,16 @@ function rememberRecoverableMaskedOutputs(deps, stackName, resolved, redacted) {
 }
 function absorbOutputsPassSecrets(deps) {
 	const outputsRun = deps.outputsRun();
-	for (const passSecrets of outputsRun.outputsPassSecretMaps) {
-		for (const [value, expr] of passSecrets) outputsRun.outputSecrets.set(value, expr);
-		mergeResolvedPairs(passSecrets, outputsRun.outputSecrets);
-		for (const physicalId of physicalNameCopiesOf.get(passSecrets) ?? []) recordPhysicalNameCopy(outputsRun.outputSecrets, physicalId);
-	}
-}
+	for (const passSecrets of outputsRun.outputsPassSecretMaps) foldRecording(passSecrets, outputsRun.outputSecrets, OUTPUTS_PASS_FOLD);
+}
+const OUTPUTS_PASS_FOLD = {
+	pairs: "carry",
+	"log-only": "withhold",
+	"mask-only-marks": "carry",
+	"reference-provenance": "carry",
+	"physical-name-copies": "carry",
+	"public-proofs": "withhold"
+};
 function redactOutputs(deps, outputs) {
 	const redacted = redactOutputsBag(deps, outputs);
 	if (deps.outputsRun().outputsResolvedThisRun.has(outputs)) deps.outputsRun().outputsResolvedThisRun.add(redacted);
@@ -34864,17 +35047,13 @@ var OutputsRunState = class {
 	outputsResolvedThisRun = /* @__PURE__ */ new WeakSet();
 	resolvedOutputsBag = void 0;
 };
-var ForwardingSecrets = class extends Map {
-	target;
-	constructor(target) {
-		super();
-		this.target = target;
-	}
-	set(plaintext, expression) {
-		super.set(plaintext, expression);
-		this.target?.set(plaintext, expression);
-		return this;
-	}
+const EXPORT_NAME_SCOPE = {
+	pairs: "withhold",
+	"log-only": "carry",
+	"mask-only-marks": "withhold",
+	"reference-provenance": "withhold",
+	"physical-name-copies": "withhold",
+	"public-proofs": "withhold"
 };
 function handleOutputResolutionFailure(deps, error, outputKey, outputs, secrets, inheritedSecrets) {
 	const union = unionOfSecretBags([inheritedSecrets, secrets]);
@@ -34950,8 +35129,7 @@ async function resolveOutputs(run, deps, template, resources, stackName, digestS
 			if (!output.Export?.Name) continue;
 			const value = outputs[outputKey];
 			if (value === void 0) continue;
-			const nameSecrets = new ForwardingSecrets(context.recordedSecretValues);
-			if (context.recordedSecretValues) shareLogOnlyValues(nameSecrets, context.recordedSecretValues);
+			const nameSecrets = context.recordedSecretValues ? openRecordingScope(context.recordedSecretValues, EXPORT_NAME_SCOPE).secrets : /* @__PURE__ */ new Map();
 			const nameReads = [];
 			let exportName;
 			try {
@@ -35535,7 +35713,8 @@ function redactRollbackRecord(record, secrets, journaledProps, journaledAttribut
 		properties: redactForState(record.properties, {
 			provenance: "state-derived",
 			secrets,
-			source: journaledProps
+			source: journaledProps,
+			generation: redactionClaimOf(record.properties)
 		})
 	};
 	return keepPersistedPlainRecordLeaves(scrubResourceRecord(positioned, secrets, void 0, void 0, { observed: isSameGenerationBag(positioned.observedProperties) ? "same-generation" : "unproven" }), record, {
@@ -36428,7 +36607,7 @@ function recordAfterRollbackUpdate(restored, result) {
 	return {
 		...returned === void 0 && idChanged ? withoutAttributes : restored,
 		...replacedId !== void 0 && { physicalId: replacedId },
-		...result.effectiveProperties && { properties: { ...result.effectiveProperties } },
+		...result.effectiveProperties && { properties: copyClaimingProviderBag(result.effectiveProperties) },
 		...returned !== void 0 && { attributes: result.wasReplaced ? { ...returned } : {
 			...restored.attributes,
 			...returned
@@ -36436,7 +36615,11 @@ function recordAfterRollbackUpdate(restored, result) {
 	};
 }
 function recordedPropertiesAfterReplayCreate(restored, result) {
-	return result.effectiveProperties === void 0 ? restored.properties : { ...result.effectiveProperties };
+	return result.effectiveProperties === void 0 ? restored.properties : copyClaimingProviderBag(result.effectiveProperties);
+}
+function copyClaimingProviderBag(properties) {
+	const copy = markLeafCertifiedBag({ ...properties });
+	return isSameGenerationBag(properties) ? markSameGenerationBag(copy) : copy;
 }
 
 //#endregion
@@ -40146,7 +40329,7 @@ function redactOperationsForJournal(deps, operations) {
 				provenance: "template-derived",
 				secrets: ownSecrets,
 				source: templateProps,
-				generation: isSameGenerationBag(properties) ? "same-generation" : "unproven"
+				generation: redactionClaimOf(properties)
 			}));
 		}
 		if (next.attemptedProperties) {
@@ -42861,8 +43044,11 @@ function extractAllDependencies(template, logicalId) {
 	const deps = [...parser.extractDependencies(resource)].filter((dep) => !parameterNames.has(dep));
 	return deps.length > 0 ? deps : void 0;
 }
+function withPropertiesMarksOf(original, rebuilt) {
+	return carryRedactionMarks(original, rebuilt);
+}
 function propertiesToRecord(desiredProperties, result, resourceType, provisionedBy) {
-	if (result.effectiveProperties) return markWrittenFromDeployedTemplate(provisionedBy === "sdk" ? withoutSilentDropProperties(resourceType, result.effectiveProperties) : result.effectiveProperties);
+	if (result.effectiveProperties) return markWrittenFromDeployedTemplate(markLeafCertifiedBag(provisionedBy === "sdk" ? withoutSilentDropProperties(resourceType, result.effectiveProperties) : result.effectiveProperties));
 	const written = provisionedBy === "sdk" ? withoutSilentDropProperties(resourceType, desiredProperties) : desiredProperties;
 	return markWrittenFromDeployedTemplate(markSameGenerationBag(written));
 }
@@ -46971,6 +47157,27 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 			}
 		}
 	}
+	if (mixedLiteralAnswered(updateSecrets)) {
+		const legacyMixed = legacyLeavesWithoutMask(withLegacyMixedScan(updateSecrets, () => maskAtCoordinates(redactForState(resolvedProps, {
+			provenance: "template-derived",
+			secrets: updateSecrets,
+			source: desiredProps,
+			generation: "same-generation"
+		}), comparisonCoordinates)));
+		for (const bag of new Set(repairable)) for (const key of Object.keys(bag)) {
+			const repaired = repairPhysicalNameCopyLeaves(bag[key], legacyMixed[key], desiredForSkipCheck[key]);
+			if (repaired !== bag[key]) bag[key] = repaired;
+		}
+		const pairs = differingStringLeaves(legacyMixed, desiredForSkipCheck);
+		for (const field of ["attributes", "observedProperties"]) {
+			const target = currentResource[field];
+			if (target === void 0 || target === null || pairs.length === 0) continue;
+			for (const key of Object.keys(target)) {
+				const repaired = replaceWholeLeaves(target[key], pairs);
+				if (repaired !== target[key]) target[key] = repaired;
+			}
+		}
+	}
 	const attributes = currentResource.attributes;
 	if (attributes !== void 0 && attributes !== null && embeddedRewrites.length > 0) for (const key of Object.keys(attributes)) {
 		const repaired = replaceEmbeddedPhysicalNameRewrites(attributes[key], embeddedRewrites);
@@ -47954,20 +48161,20 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 			} else if (survivesParent(record.resourceType)) {
 				newResources[lost.logicalId] = {
 					...record,
-					properties: {
+					properties: withPropertiesMarksOf(record.properties, {
 						...record.properties,
 						...lost.trimmed
-					}
+					})
 				};
 				const lists = Object.keys(lost.trimmed).join(" / ");
 				engine.logger.warn(safeMsg`  ⚠ ${lost.logicalId} (${childType}) lost its attachment to a resource this deploy re-created under the same name, and the deploy failed before attaching it again: its record keeps only the attachments that survived, so the next deploy attaches it again.`.concat(attempted.has(lost.logicalId) ? safeMsg` Its attach may already have landed on `.concat(parentShown, safeMsg`: if ${lost.logicalId}'s ${lists} stops naming it before the next deploy, nothing will detach it, so detach it by hand.`) : ""));
 			} else {
 				newResources[lost.logicalId] = {
 					...record,
-					properties: {
+					properties: withPropertiesMarksOf(record.properties, {
 						...record.properties,
 						...lost.trimmed
-					}
+					})
 				};
 				engine.logger.warn(safeMsg`  ⚠ ${lost.logicalId} (${childType}) was removed from a resource this deploy re-created under the same id, and the deploy failed before writing it again: the next deploy writes it there again (its record keeps only the holders it is still on).`.concat(mayStillBeLive));
 			}
@@ -49042,11 +49249,11 @@ var DeployEngine = class {
 };
 function sameGenerationClaimsOf(record) {
 	return {
-		properties: isSameGenerationBag(record.properties) ? "same-generation" : "unproven",
+		properties: redactionClaimOf(record.properties),
 		observed: isSameGenerationBag(record.observedProperties) ? "same-generation" : "unproven"
 	};
 }
 
 //#endregion
-export { resolvePendingCloudControlRequests as $, repairMalformedOutputsForReadOnly as $a, escapeRegExp$3 as $c, accountArgs as $i, buildFinalSnapshotIdentifier as $n, readbackPathFor as $o, DiffCalculator as $r, applyCrossPrefixScan as $s, namesAnyDeclaredParameter as $t, findServiceTokenRefusals as A, refuseMalformedOrphanRecordsForDestroy as Aa, parseBootstrapMarker as Ac, coerceParameterTypedValue as Ai, AssemblyReader as Al, gray as An, replayWarn as Ao, isCustomResourceType as Ar, inheritNestedStackParameterAssociations as As, removeProtectionTypeList as At, parentSuppliedValues as B, refuseMalformedResourceEntriesForImport as Ba, dockerSpawnEnvWithSensitive as Bc, cfnRefValueFromPhysicalId as Bi, displayAssemblyPath as Bl, journaledOrphanPrintingBag as Bn, sameLambdaFunctionAddress as Bo, UNSPECIFIED_SKIP_REASON as Br, recordMaskOnlyValuesIn as Bs, resolveReplacementOldType as Bt, getPriorAttempts as C, malformedResourcesWarning as Ca, rewriteTemplateAssetReferences as Cc, applyCallerIdentityCredentials as Ci, uploadCfnTemplate as Cl, awaitInFlightSibling as Cn, toFiniteNumber as Co, ProviderRegistry as Cr, withPhysicalNameCopies as Cs, formatResourceLine as Ct, crossStackOutputProvenanceSource as D, refuseDivergentRecordRegionForDestroy as Da, ensureAssetStorage as Dc, classifyReplaySecretRegion as Di, PARTITION_TABLE as Dl, replacedDeleteFailureVerdict as Dn, configIntegerRefusal as Do, waitForLambdaFunctionActive as Dr, isUncertifiedBaselineMaskPosition as Ds, withApiLimit as Dt, computeImplicitDeleteEdges as E, previewableOrphanRecords as Ea, assertAssetBucketRegion as Ec, classifyRecordedSecretRegion as Ei, expectedOwnerParam as El, withStackRecords as En, configBooleanRefusal as Eo, wouldReturnToSdkProvider as Er, dynamicReferenceTokens as Es, lookupEachName as Et, listNestedTemplateRows as F, refuseMalformedOutputsForDestroy as Fa, buildDockerImage as Fc, carriesDynamicReference as Fi, hasPlainPrototype$1 as Fl, noEchoComparisonForTemplate as Fn, templateResourceTypes as Fo, customResourceResponseExpirationWarning as Fr, recordPhysicalNameCopy as Fs, planFailedOps as Ft, keptWholeReasonText as G, refuseMalformedResourcePropertiesForExport as Ga, isMalformedEnvKey as Gc, parameterInputsFor as Gi, clearBucketRegionCache as Gl, secretNamePrintingBags as Gn, maskAtCoordinates as Go, isWaitAbandonedError as Gr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Gs, inheritProducerRegions as Gt, withResourceDeadline as H, refuseMalformedResourceEntriesForOrphan as Ha, formatDockerLoginError as Hc, refStateLookupFromResource as Hi, resolveAssemblyPath as Hl, namingSecretsWithRecordedNoEcho as Hn, TemplateParser as Ho, deleteLeftInPlace as Hr, recordNoEchoParameterFreshValue as Hs, orphanNeedsIdentity as Ht, renderNestedTemplateTreeDefect as I, refuseMalformedResourceAttributesForOrphan as Ia, resolveDockerContextDirectory as Ic, carriesFetchableDynamicReference as Ii, nullPrototypeRecord as Il, noEchoExactEchoLeavesOf as In, describeTypeWithThrottleRetry as Io, CloudControlProvider as Ir, splitGetAttStringForm as Is, planRollback as It, makeSiblingClaimReader as J, refuseMalformedResourcesForDestroy as Ja, redactedCause as Jc, JSON_LISTING_HOLE_VALUE as Ji, stateSecretNameNeedles as Jn, maskedLeafCoordinatesOf as Jo, ec2InstanceProtectionSite as Jr, isLockInfoExpired as Js, redactedDeleteAddressFields as Jt, mergeNoChangeOutputs as K, refuseMalformedResourcePropertiesForOrphan as Ka, partitionSensitiveEnv as Kc, passedParameterClassesOf as Ki, resolveBucketRegion as Kl, secretNamedAttributeNamesOf as Kn, maskReadbackAtCoordinates as Ko, markWaitAbandoned as Kr, isSingleDynamicReferenceToken as Ks, REDACTED_DELETE_ADDRESS_SKIP_REASON as Kt, templateIdentity as L, refuseMalformedResourceEntries as La, describeDockerCapturedOutput as Lc, isNamelessDynamicReferenceError as Li, ownValue as Ll, noEchoParameterNamesOf as Ln, withRetry as Lo, slowCcOperationTimeoutMs as Lr, carriesSecretMask as Ls, recheckFailedPlan as Lt, childTemplateLoader as M, refuseMalformedOrphansForDestroy as Ma, validateAssetBucketName as Mc, parameterTypeMayLoseSecretIdentity as Mi, processStackMessages as Ml, red as Mn, requireConfigObject as Mo, withPrintingSecrets as Mr, recoverMaskedOutput as Ms, demoteSupersededOrphans as Mt, findNestedTemplateTreeDefect as N, refuseMalformedOrphansForOrphan as Na, validateContainerRepoName as Nc, getAccountInfo as Ni, defineOwnKey as Nl, yellow as Nn, requireConfigString as No, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Nr, physicalNameCopiesOf as Ns, isJournaledOrphan as Nt, inheritedProvenanceForChildDiff as O, refuseMalformedNestedChildOutputs as Oa, getBootstrapMarkerKey as Oc, producerRegionsFromState as Oi, canonicalizeRegion as Ol, bold as On, configStringRefusal as Oo, TemplateNoEchoReresolver as Or, pathCrossesDottedKey as Os, replayFailedOperations as Ot, isAbsoluteAssetPath as P, refuseMalformedOutputs as Pa, buildDenyExternalAccessPolicy as Pc, isImpossibleEmptyStoredAttribute as Pi, hasOwnKey as Pl, noEchoAttributeNamesOf as Pn, prefetchCreateOnlyPropertyPaths as Po, applyCustomResourceResponseExpiration as Pr, recordAttributeIdCopy as Ps, isReplacementOrphan as Pt, pendingRequestCount as Q, repairMalformedOrphansForReadOnly as Qa, warnFinchArgvExposure as Qc, UNREADABLE_RESOURCES_MAP_ROW as Qi, PRE_DELETE_SNAPSHOT_TYPES as Qn, passedNoEchoParametersOf as Qo, reEnableInstanceApiTermination as Qr, CrossPrefixScanCache as Qs, computeParameterTaint as Qt, conditionFingerprint as R, refuseMalformedResourceEntriesForDeploy as Ra, describeDockerExecFailure as Rc, keepsSecretReferenceToken as Ri, absoluteAssemblyPathEscape as Rl, createReadOnlyAttributeHealerFactory as Rn, canonicalLambdaFunctionName as Ro, unchangedBehindSecretReference as Rr, provenPublicValue as Rs, recordUnderIdIsNotOwn as Rt, isTruthyCfnBoolean as S, malformedResourcePropertiesWarning as Sa, loadPublishableAssetManifest as Sc, AWS_CREDENTIAL_ENV_KEYS as Si, findLargeInlineResources as Sl, formatDestructiveChange as Sn, toCfnInteger as So, CC_BROKEN_REASON as Sr, scrubResourceRecord as Ss, sameJournaledOrphans as St, IMPLICIT_DELETE_DEPENDENCIES as T, malformedStateRefusalMessage as Ta, BOOTSTRAP_MARKER_PREFIX as Tc, envCredentialsAreAssumedRole as Ti, decodeListingKey as Tl, getStackRecords as Tn, coerceCfnInteger as To, isCustomResource as Tr, DYNAMIC_REFERENCE_TOKEN_SCAN as Ts, isAccessDeniedError as Tt, diffSecurity as U, refuseMalformedResourcePropertiesForDestroy as Ua, getDockerCmd as Uc, parseWebACLArn as Ui, injectAwsRegion as Ul, orphanRecordsPrintingBag as Un, canonicalCoordinates as Uo, deleteSkipReason as Ur, recordProvenPublicExpression as Us, findNestedStackTypeChanges as Ut, readRecordedConditionVerdicts as V, refuseMalformedResourceEntriesForImportSave as Va, finchSecretArgvRefusal as Vc, isStalePlaceholderArnAttribute as Vi, renderAssemblyPathEscape as Vl, maskEventTextWithBoundBags as Vn, DagBuilder as Vo, deleteIndeterminateGuards as Vr, recordNoEchoAttributeValues as Vs, seedsDeleteFirstGuard as Vt, isSecretBearingReferenceString as W, refuseMalformedResourcePropertiesForDrift as Wa, isDockerClientEnvKey as Wc, withSharedDrainBudget as Wi, injectedAwsRegionValue as Wl, secretNamePrintingBag as Wn, isMarkedCoordinate as Wo, withIndeterminateGuard as Wr, wholeStringLeavesOf as Ws, getCurrentProducerRegions as Wt, DeploymentEventsReader as X, refuseMalformedState as Xa, runDockerForeground as Xc, STATE_RESOURCES_MALFORMED as Xi, extractDeploymentEventError as Xn, noEchoLeavesOf as Xo, observeThenDisableInstanceApiTermination as Xr, rebuildClientForBucketRegion as Xs, updatePartialMessage as Xt, planOrphanAdoption as Y, refuseMalformedResourcesForExport as Ya, redactedDockerCause as Yc, STATE_REGION_DIVERGED as Yi, storedSecretNameNeedles as Yn, noEchoCoordinatesOf as Yo, isTerminationProtectionPropagationError as Yr, S3StateBackend as Ys, redactedDeleteAddressSkip as Yt, DeploymentEventsStore as Z, repairMalformedOrphanRecordsForReadOnly as Za, runDockerStreaming as Zc, UNREADABLE_ORPHANS_CONTAINER_ROW as Zi, ATOMIC_FINAL_SNAPSHOT_TYPES as Zn, noEchoOutputsComparison as Zo, reDisableInstanceApiTermination as Zr, CrossPrefixReadError as Zs, updatePartialReason as Zt, deleteTableWithIndexBusyRetry as _, malformedOrphansWarning as _a, isSensitiveAttributeName as _c, assertFlagRoleArn as _i, warnDeprecatedNoPrefixCliFlag as _l, DEFAULT_RESOURCE_TIMEOUT_MS as _n, isStatefulRecreateTargetSync as _o, refuseMalformedDesiredTags as _r, maskSecretsInText as _s, dropFailedHint as _t, isProtectionValueActive as a, isReadableOrphanRecord as aa, describeRegionValueKind as ac, s3BucketDomainName as ai, synthesisStatusMessage as al, secretBearing as an, unreadableResourceEntries as ao, unsupportedFinalSnapshotError as ar, createUnionSecretMasker as as, dropSettledNestedJournals as at, S3_AUTO_DELETE_OBJECTS_TAG as b, malformedRenderedContainersWarning as ba, buildAssetRedirectMap as bc, isIamRoleArn as bi, CFN_TEMPLATE_URL_LIMIT as bl, constructPathOf as bn, coerceWarmThroughput as bo, definedAttributes as br, snapshotPassProvenance as bs, loadJournaledOrphans as bt, DynamoDBGlobalTableProvider as c, malformedExportNamesWarning as ca, hasReasonlessBaselineRefusal as cc, s3BucketWebsiteUrl as ci, loadCdkJson as cl, carriedExportAliasExposure as cn, findSilentDropProperties as co, reserveStackCreateToken as cr, logOnlyValueCount as cs, recordDisplacedSkips as ct, compensateRemovedDeletionProtection as d, malformedLocalResourceEntriesWarning as da, importableOutputs as dc, refuseUnreadableCdkCrossAccountRefs as di, resolveCaptureObservedState as dl, isWholeDynamicReferenceValue as dn, NO_CC_HANDLERS_REASON as do, isRefusedByName as dr, recordLogOnlyValue as ds, withNestedRevertRun as dt, deployRefusesOrphanRowsReason as ea, crossPrefixDeniedWarning as ec, INTRINSIC_KEYS as ei, stripControlChars as el, reachableDivergentParameters as en, repairMalformedResourceEntriesForReadOnly as eo, ccRoutedFinalSnapshotError as er, readsNoEchoSource as es, keptForReadoption as et, deleteBudgetKey as f, malformedLocalResourcesWarning as fa, isReadableBag as fc, keepHeldTokenProvenance as fi, resolveSkipPrefix as fl, noEchoParameterValueSeed as fn, hasNoCloudControlHandlers as fo, markDeleteStarted as fr, shareLogOnlyValues as fs, collectNestedChildUnaddressed as ft, INDEX_SETTLE_POLL_INTERVAL_MS as g, malformedOrphansRefusalMessage as ga, AssetPublisher as gc, applyRoleArnIfSet as gi, stateBucketExistenceConfirmed as gl, bindingSkippedOutputs as gn, isStatefulRecreateTargetForReplace as go, readTagList as gr, maskSecretsInError as gs, dropFailedCommands as gt, DELETE_INDEX_WAIT_PROCEED_NOTE as h, malformedOrphanRowsKeptWarning as ha, shouldRetainResource as hc, recordedReferenceRegions as hi, resolveUseCdkBootstrapAssets as hl, isExportAliasCollision as hn, MULTI_REGION_RECREATE_BLOCKED_TYPES as ho, planTagDiff as hr, errorCauseChain as hs, deleteJournaledOrphans as ht, PROTECTION_PROPERTY_BY_TYPE as i, hasReadableResources as ia, acceptedCreateOnlyDropsOf as ic, s3BucketArn as ii, Synthesizer as il, exportAliasCollisionScrubWarning as in, unreadableOrphanRecords as io, refusesFinalSnapshot as ir, carryLogOnlyValues as is, displacedPhysicalIdShown as it, serviceTokenBlockingReason as j, refuseMalformedOrphans as ja, readBootstrapMarkerBody as jc, isUnboundTemplateParameter as ji, StageLoadError as jl, green as jn, requireConfigArray as jo, getCurrentResourceSecrets as jr, recordNestedStackParameterExpressions as js, recordAfterRollbackUpdate as jt, deferredServiceTokenWarning as k, refuseMalformedOrphanRecords as ka, isCrossRegionRedirect as kc, regionLessSecretName as ki, derivePartitionAndUrlSuffix as kl, cyan as kn, readConfigString as ko, readsNoEchoDeleteValues as kr, identityKeyFor as ks, replayRollback as kt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, malformedExportSourceWarning as la, hasUnverifiableParameterRefusal as lc, resolveDynamicReferences as li, resolveApp as ll, exportNameNoEchoParameters as ln, unwrittenCreateOnlyReplacement as lo, withCreateTokenLedger as lr, printingCorpusOf as ls, revertNestedChildFromJournal as lt, resolveDynamoDbDeleteBudgetMs as m, malformedOrphanRecordsWarning as ma, orphansCarriedFrom as mc, recordedOutputReferenceRegions as mi, resolveStateBucketWithDefaultAndSource as ml, collectPublishedOutputNames as mn, shownType as mo, DBPROXY_TAG_OPTIONS as mr, createSecretMasker as ms, withNestedStackContext as mt, recordedProtectionEvidence as n, hasReadableOrphans as na, isNotImplemented as nc, poisonRenderedSpellingsCollidingIn as ni, AssetManifestLoader as nl, WITHHELD_NAME_DISPLAY as nn, repairMalformedResourcesForReadOnly as no, effectiveDeletionPolicy as nr, valueAtCoordinate as ns, NESTED_PENDING_PARENT_REASON as nt, perType as o, isReadableResourceEntry as oa, exportNamesCarriedFrom as oc, s3BucketDualStackDomainName as oi, getDefaultStateBucketName as ol, secretBearingStateKeyWarning as on, withheldAccountClause as oo, earliestDefined as or, hasMaskableValues as os, getNestedRevertRun as ot, resolveDynamoDbDeleteBudgetClock as p, malformedOrphanRecordsRefusalMessage as pa, orphansAfterRollback as pc, outputReferenceProvenanceOf as pi, resolveStateBucketWithDefault as pl, collectDeclaredOutputNames as pn, findReplacedReadersOfRecreateTargets as po, DBPROXY_TAGS_WHAT as pr, unionOfSecretBags as ps, getCurrentNestedStackContext as pt, makeCanonicalizePropertiesFn as q, refuseMalformedResourcesForDeploy as qa, redactDockerArgvValues as qc, declaresNoEcho as qi, secretNamedRecordNeedles as qn, maskWholeValue as qo, disableInstanceApiTermination as qr, LockManager as qs, isRedactedRecordedValue as qt, recordedProtectionNote as r, hasReadableOutputs as ra, splitImportedOps as rc, isSettledInstanceState as ri, getDockerImageBySourceHash as rl, displayTextOrWithheld as rn, unpreviewableOrphanRecords as ro, isFinalSnapshotError as rr, liveMatchesUnresolvedTokenFrame as rs, displacedOpClause as rt, readProtection as s, malformedDriftResourcePropertiesWarning as sa, hasReadableExportSet as sc, s3BucketRegionalDomainName as si, getLegacyStateBucketName as sl, secretSafeKeyDisplay as sn, findActionableSilentDrops as so, ledgerForStack as sr, literalSplitDelimitersOf as ss, nestedChildStackName as st, DeployEngine as t, displayLogicalId as ta, isAccessDenied$1 as tc, IntrinsicFunctionResolver as ti, stripForDisplay as tl, resourcesNamingDeclaredParameter as tn, repairMalformedResourcePropertiesForReadOnly as to, createPreDeleteFinalSnapshot as tr, recordedNoEchoValuesOf as ts, recordRetainedForReadoption as tt, beginDeleteWait as u, malformedLocalOutputsWarning as ua, importableOutputKeys as uc, producerLookupOver as ui, resolveAutoAssetStorage as ul, exportNameSecretExposure as un, withoutSilentDropProperties as uo, acquireIdempotencyToken as ur, recordLogOnlyParameterValue as us, revertedNestedRowIds as ut, waitForIndexesSettled as v, malformedOutputsRefusalMessage as va, stringifyValue as vc, assertSendableRoleArn as vi, ssmResolvedValueType as vl, DEFAULT_RESOURCE_WARN_AFTER_MS as vn, renderStatefulReason as vo, tagMapAsList as vr, markSameGenerationBag as vs, isHandledOrphan as vt, markRefusedBeforeApplying as w, malformedScrubResourceEntriesRefusalMessage as wa, AssetModeResolver as wc, callerEnvCredentials as wi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as wl, destroyStackRecordsView as wn, coerceCfnBoolean as wo, ccBrokenReason as wr, withoutPhysicalNameCopies as ws, chunks as wt, hasCdkAutoDeleteTag as x, malformedResourceEntriesWarning as xa, createAssetRedirectResolver as xc, sendableAssumeRoleCommand as xi, MIGRATE_TMP_PREFIX as xl, findDestructiveChanges as xn, isWarmThroughputDecrease as xo, stringifyIfAssigned as xr, redactForState as xs, makeForeignHolderScan as xt, ECR_AUTO_DELETE_IMAGES_TAG as y, malformedOutputsWarning as ya, WorkGraph as yc, explicitRoleArnOrThrow as yi, CFN_TEMPLATE_BODY_LIMIT as yl, maskingRetryLogger as yn, WARM_THROUGHPUT_MEMBERS as yo, tagPlanWarning as yr, recordReferenceProvenanceEntry as ys, journaledOrphanLines as yt, conditionInputsFrom as z, refuseMalformedResourceEntriesForDestroy as za, describeDockerFailure as zc, AWS_NO_VALUE as zi, describeFileReadFailure as zl, completedReplayEntries as zn, lambdaFunctionNameForMask as zo, RollbackInlinePolicyWriters as zr, recordMaskOnlyValue as zs, replacementNeverSwapped as zt };
-//# sourceMappingURL=deploy-engine-zLKsm0IM.js.map
+export { resolvePendingCloudControlRequests as $, repairMalformedOutputsForReadOnly as $a, escapeRegExp$3 as $c, accountArgs as $i, buildFinalSnapshotIdentifier as $n, readbackPathFor as $o, DiffCalculator as $r, applyCrossPrefixScan as $s, namesAnyDeclaredParameter as $t, findServiceTokenRefusals as A, refuseMalformedOrphanRecordsForDestroy as Aa, parseBootstrapMarker as Ac, coerceParameterTypedValue as Ai, AssemblyReader as Al, gray as An, replayWarn as Ao, isCustomResourceType as Ar, inheritNestedStackParameterAssociations as As, removeProtectionTypeList as At, parentSuppliedValues as B, refuseMalformedResourceEntriesForImport as Ba, dockerSpawnEnvWithSensitive as Bc, cfnRefValueFromPhysicalId as Bi, displayAssemblyPath as Bl, journaledOrphanPrintingBag as Bn, sameLambdaFunctionAddress as Bo, UNSPECIFIED_SKIP_REASON as Br, recordMaskOnlyValuesIn as Bs, resolveReplacementOldType as Bt, getPriorAttempts as C, malformedResourcesWarning as Ca, rewriteTemplateAssetReferences as Cc, applyCallerIdentityCredentials as Ci, uploadCfnTemplate as Cl, awaitInFlightSibling as Cn, toFiniteNumber as Co, ProviderRegistry as Cr, withPhysicalNameCopies as Cs, formatResourceLine as Ct, crossStackOutputProvenanceSource as D, refuseDivergentRecordRegionForDestroy as Da, ensureAssetStorage as Dc, classifyReplaySecretRegion as Di, PARTITION_TABLE as Dl, replacedDeleteFailureVerdict as Dn, configIntegerRefusal as Do, waitForLambdaFunctionActive as Dr, isUncertifiedBaselineMaskPosition as Ds, withApiLimit as Dt, computeImplicitDeleteEdges as E, previewableOrphanRecords as Ea, assertAssetBucketRegion as Ec, classifyRecordedSecretRegion as Ei, expectedOwnerParam as El, withStackRecords as En, configBooleanRefusal as Eo, wouldReturnToSdkProvider as Er, dynamicReferenceTokens as Es, lookupEachName as Et, listNestedTemplateRows as F, refuseMalformedOutputsForDestroy as Fa, buildDockerImage as Fc, carriesDynamicReference as Fi, hasPlainPrototype$1 as Fl, noEchoComparisonForTemplate as Fn, templateResourceTypes as Fo, customResourceResponseExpirationWarning as Fr, recordPhysicalNameCopy as Fs, planFailedOps as Ft, keptWholeReasonText as G, refuseMalformedResourcePropertiesForExport as Ga, isMalformedEnvKey as Gc, parameterInputsFor as Gi, clearBucketRegionCache as Gl, secretNamePrintingBags as Gn, maskAtCoordinates as Go, isWaitAbandonedError as Gr, WHOLE_DYNAMIC_REFERENCE_PATTERN as Gs, inheritProducerRegions as Gt, withResourceDeadline as H, refuseMalformedResourceEntriesForOrphan as Ha, formatDockerLoginError as Hc, refStateLookupFromResource as Hi, resolveAssemblyPath as Hl, namingSecretsWithRecordedNoEcho as Hn, TemplateParser as Ho, deleteLeftInPlace as Hr, recordNoEchoParameterFreshValue as Hs, orphanNeedsIdentity as Ht, renderNestedTemplateTreeDefect as I, refuseMalformedResourceAttributesForOrphan as Ia, resolveDockerContextDirectory as Ic, carriesFetchableDynamicReference as Ii, nullPrototypeRecord as Il, noEchoExactEchoLeavesOf as In, describeTypeWithThrottleRetry as Io, CloudControlProvider as Ir, splitGetAttStringForm as Is, planRollback as It, makeSiblingClaimReader as J, refuseMalformedResourcesForDestroy as Ja, redactedCause as Jc, JSON_LISTING_HOLE_VALUE as Ji, stateSecretNameNeedles as Jn, maskedLeafCoordinatesOf as Jo, ec2InstanceProtectionSite as Jr, isLockInfoExpired as Js, redactedDeleteAddressFields as Jt, mergeNoChangeOutputs as K, refuseMalformedResourcePropertiesForOrphan as Ka, partitionSensitiveEnv as Kc, passedParameterClassesOf as Ki, resolveBucketRegion as Kl, secretNamedAttributeNamesOf as Kn, maskReadbackAtCoordinates as Ko, markWaitAbandoned as Kr, isSingleDynamicReferenceToken as Ks, REDACTED_DELETE_ADDRESS_SKIP_REASON as Kt, templateIdentity as L, refuseMalformedResourceEntries as La, describeDockerCapturedOutput as Lc, isNamelessDynamicReferenceError as Li, ownValue as Ll, noEchoParameterNamesOf as Ln, withRetry as Lo, slowCcOperationTimeoutMs as Lr, carriesSecretMask as Ls, recheckFailedPlan as Lt, childTemplateLoader as M, refuseMalformedOrphansForDestroy as Ma, validateAssetBucketName as Mc, parameterTypeMayLoseSecretIdentity as Mi, processStackMessages as Ml, red as Mn, requireConfigObject as Mo, withPrintingSecrets as Mr, recoverMaskedOutput as Ms, demoteSupersededOrphans as Mt, findNestedTemplateTreeDefect as N, refuseMalformedOrphansForOrphan as Na, validateContainerRepoName as Nc, getAccountInfo as Ni, defineOwnKey as Nl, yellow as Nn, requireConfigString as No, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Nr, physicalNameCopiesOf as Ns, isJournaledOrphan as Nt, inheritedProvenanceForChildDiff as O, refuseMalformedNestedChildOutputs as Oa, getBootstrapMarkerKey as Oc, producerRegionsFromState as Oi, canonicalizeRegion as Ol, bold as On, configStringRefusal as Oo, TemplateNoEchoReresolver as Or, pathCrossesDottedKey as Os, replayFailedOperations as Ot, isAbsoluteAssetPath as P, refuseMalformedOutputs as Pa, buildDenyExternalAccessPolicy as Pc, isImpossibleEmptyStoredAttribute as Pi, hasOwnKey as Pl, noEchoAttributeNamesOf as Pn, prefetchCreateOnlyPropertyPaths as Po, applyCustomResourceResponseExpiration as Pr, recordAttributeIdCopy as Ps, isReplacementOrphan as Pt, pendingRequestCount as Q, repairMalformedOrphansForReadOnly as Qa, warnFinchArgvExposure as Qc, UNREADABLE_RESOURCES_MAP_ROW as Qi, PRE_DELETE_SNAPSHOT_TYPES as Qn, passedNoEchoParametersOf as Qo, reEnableInstanceApiTermination as Qr, CrossPrefixScanCache as Qs, computeParameterTaint as Qt, conditionFingerprint as R, refuseMalformedResourceEntriesForDeploy as Ra, describeDockerExecFailure as Rc, keepsSecretReferenceToken as Ri, absoluteAssemblyPathEscape as Rl, createReadOnlyAttributeHealerFactory as Rn, canonicalLambdaFunctionName as Ro, unchangedBehindSecretReference as Rr, provenPublicValue as Rs, recordUnderIdIsNotOwn as Rt, isTruthyCfnBoolean as S, malformedResourcePropertiesWarning as Sa, loadPublishableAssetManifest as Sc, AWS_CREDENTIAL_ENV_KEYS as Si, findLargeInlineResources as Sl, formatDestructiveChange as Sn, toCfnInteger as So, CC_BROKEN_REASON as Sr, scrubResourceRecord as Ss, sameJournaledOrphans as St, IMPLICIT_DELETE_DEPENDENCIES as T, malformedStateRefusalMessage as Ta, BOOTSTRAP_MARKER_PREFIX as Tc, envCredentialsAreAssumedRole as Ti, decodeListingKey as Tl, getStackRecords as Tn, coerceCfnInteger as To, isCustomResource as Tr, DYNAMIC_REFERENCE_TOKEN_SCAN as Ts, isAccessDeniedError as Tt, diffSecurity as U, refuseMalformedResourcePropertiesForDestroy as Ua, getDockerCmd as Uc, parseWebACLArn as Ui, injectAwsRegion as Ul, orphanRecordsPrintingBag as Un, canonicalCoordinates as Uo, deleteSkipReason as Ur, recordProvenPublicExpression as Us, findNestedStackTypeChanges as Ut, readRecordedConditionVerdicts as V, refuseMalformedResourceEntriesForImportSave as Va, finchSecretArgvRefusal as Vc, isStalePlaceholderArnAttribute as Vi, renderAssemblyPathEscape as Vl, maskEventTextWithBoundBags as Vn, DagBuilder as Vo, deleteIndeterminateGuards as Vr, recordNoEchoAttributeValues as Vs, seedsDeleteFirstGuard as Vt, isSecretBearingReferenceString as W, refuseMalformedResourcePropertiesForDrift as Wa, isDockerClientEnvKey as Wc, withSharedDrainBudget as Wi, injectedAwsRegionValue as Wl, secretNamePrintingBag as Wn, isMarkedCoordinate as Wo, withIndeterminateGuard as Wr, wholeStringLeavesOf as Ws, getCurrentProducerRegions as Wt, DeploymentEventsReader as X, refuseMalformedState as Xa, runDockerForeground as Xc, STATE_RESOURCES_MALFORMED as Xi, extractDeploymentEventError as Xn, noEchoLeavesOf as Xo, observeThenDisableInstanceApiTermination as Xr, rebuildClientForBucketRegion as Xs, updatePartialMessage as Xt, planOrphanAdoption as Y, refuseMalformedResourcesForExport as Ya, redactedDockerCause as Yc, STATE_REGION_DIVERGED as Yi, storedSecretNameNeedles as Yn, noEchoCoordinatesOf as Yo, isTerminationProtectionPropagationError as Yr, S3StateBackend as Ys, redactedDeleteAddressSkip as Yt, DeploymentEventsStore as Z, repairMalformedOrphanRecordsForReadOnly as Za, runDockerStreaming as Zc, UNREADABLE_ORPHANS_CONTAINER_ROW as Zi, ATOMIC_FINAL_SNAPSHOT_TYPES as Zn, noEchoOutputsComparison as Zo, reDisableInstanceApiTermination as Zr, CrossPrefixReadError as Zs, updatePartialReason as Zt, deleteTableWithIndexBusyRetry as _, malformedOrphansWarning as _a, isSensitiveAttributeName as _c, assertFlagRoleArn as _i, warnDeprecatedNoPrefixCliFlag as _l, DEFAULT_RESOURCE_TIMEOUT_MS as _n, isStatefulRecreateTargetSync as _o, refuseMalformedDesiredTags as _r, unionOfSecretBags as _s, dropFailedHint as _t, isProtectionValueActive as a, isReadableOrphanRecord as aa, describeRegionValueKind as ac, s3BucketDomainName as ai, synthesisStatusMessage as al, secretBearing as an, unreadableResourceEntries as ao, unsupportedFinalSnapshotError as ar, redactForState as as, dropSettledNestedJournals as at, S3_AUTO_DELETE_OBJECTS_TAG as b, malformedRenderedContainersWarning as ba, buildAssetRedirectMap as bc, isIamRoleArn as bi, CFN_TEMPLATE_URL_LIMIT as bl, constructPathOf as bn, coerceWarmThroughput as bo, definedAttributes as br, maskSecretsInError as bs, loadJournaledOrphans as bt, DynamoDBGlobalTableProvider as c, malformedExportNamesWarning as ca, hasReasonlessBaselineRefusal as cc, s3BucketWebsiteUrl as ci, loadCdkJson as cl, carriedExportAliasExposure as cn, findSilentDropProperties as co, reserveStackCreateToken as cr, carryLogOnlyValues as cs, recordDisplacedSkips as ct, compensateRemovedDeletionProtection as d, malformedLocalResourceEntriesWarning as da, importableOutputs as dc, refuseUnreadableCdkCrossAccountRefs as di, resolveCaptureObservedState as dl, isWholeDynamicReferenceValue as dn, NO_CC_HANDLERS_REASON as do, isRefusedByName as dr, literalSplitDelimitersOf as ds, withNestedRevertRun as dt, deployRefusesOrphanRowsReason as ea, crossPrefixDeniedWarning as ec, INTRINSIC_KEYS as ei, stripControlChars as el, reachableDivergentParameters as en, repairMalformedResourceEntriesForReadOnly as eo, ccRoutedFinalSnapshotError as er, readsNoEchoSource as es, keptForReadoption as et, deleteBudgetKey as f, malformedLocalResourcesWarning as fa, isReadableBag as fc, keepHeldTokenProvenance as fi, resolveSkipPrefix as fl, noEchoParameterValueSeed as fn, hasNoCloudControlHandlers as fo, markDeleteStarted as fr, logOnlyValueCount as fs, collectNestedChildUnaddressed as ft, INDEX_SETTLE_POLL_INTERVAL_MS as g, malformedOrphansRefusalMessage as ga, AssetPublisher as gc, applyRoleArnIfSet as gi, stateBucketExistenceConfirmed as gl, bindingSkippedOutputs as gn, isStatefulRecreateTargetForReplace as go, readTagList as gr, shareLogOnlyValues as gs, dropFailedCommands as gt, DELETE_INDEX_WAIT_PROCEED_NOTE as h, malformedOrphanRowsKeptWarning as ha, shouldRetainResource as hc, recordedReferenceRegions as hi, resolveUseCdkBootstrapAssets as hl, isExportAliasCollision as hn, MULTI_REGION_RECREATE_BLOCKED_TYPES as ho, planTagDiff as hr, recordLogOnlyValue as hs, deleteJournaledOrphans as ht, PROTECTION_PROPERTY_BY_TYPE as i, hasReadableResources as ia, acceptedCreateOnlyDropsOf as ic, s3BucketArn as ii, Synthesizer as il, exportAliasCollisionScrubWarning as in, unreadableOrphanRecords as io, refusesFinalSnapshot as ir, markSameGenerationBag as is, displacedPhysicalIdShown as it, serviceTokenBlockingReason as j, refuseMalformedOrphans as ja, readBootstrapMarkerBody as jc, isUnboundTemplateParameter as ji, StageLoadError as jl, green as jn, requireConfigArray as jo, getCurrentResourceSecrets as jr, recordNestedStackParameterExpressions as js, recordAfterRollbackUpdate as jt, deferredServiceTokenWarning as k, refuseMalformedOrphanRecords as ka, isCrossRegionRedirect as kc, regionLessSecretName as ki, derivePartitionAndUrlSuffix as kl, cyan as kn, readConfigString as ko, readsNoEchoDeleteValues as kr, identityKeyFor as ks, replayRollback as kt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, malformedExportSourceWarning as la, hasUnverifiableParameterRefusal as lc, resolveDynamicReferences as li, resolveApp as ll, exportNameNoEchoParameters as ln, unwrittenCreateOnlyReplacement as lo, withCreateTokenLedger as lr, createUnionSecretMasker as ls, revertNestedChildFromJournal as lt, resolveDynamoDbDeleteBudgetMs as m, malformedOrphanRecordsWarning as ma, orphansCarriedFrom as mc, recordedOutputReferenceRegions as mi, resolveStateBucketWithDefaultAndSource as ml, collectPublishedOutputNames as mn, shownType as mo, DBPROXY_TAG_OPTIONS as mr, recordLogOnlyParameterValue as ms, withNestedStackContext as mt, recordedProtectionEvidence as n, hasReadableOrphans as na, isNotImplemented as nc, poisonRenderedSpellingsCollidingIn as ni, AssetManifestLoader as nl, WITHHELD_NAME_DISPLAY as nn, repairMalformedResourcesForReadOnly as no, effectiveDeletionPolicy as nr, valueAtCoordinate as ns, NESTED_PENDING_PARENT_REASON as nt, perType as o, isReadableResourceEntry as oa, exportNamesCarriedFrom as oc, s3BucketDualStackDomainName as oi, getDefaultStateBucketName as ol, secretBearingStateKeyWarning as on, withheldAccountClause as oo, earliestDefined as or, recordReferenceProvenanceEntry as os, getNestedRevertRun as ot, resolveDynamoDbDeleteBudgetClock as p, malformedOrphanRecordsRefusalMessage as pa, orphansAfterRollback as pc, outputReferenceProvenanceOf as pi, resolveStateBucketWithDefault as pl, collectDeclaredOutputNames as pn, findReplacedReadersOfRecreateTargets as po, DBPROXY_TAGS_WHAT as pr, printingCorpusOf as ps, getCurrentNestedStackContext as pt, makeCanonicalizePropertiesFn as q, refuseMalformedResourcesForDeploy as qa, redactDockerArgvValues as qc, declaresNoEcho as qi, secretNamedRecordNeedles as qn, maskWholeValue as qo, disableInstanceApiTermination as qr, LockManager as qs, isRedactedRecordedValue as qt, recordedProtectionNote as r, hasReadableOutputs as ra, splitImportedOps as rc, isSettledInstanceState as ri, getDockerImageBySourceHash as rl, displayTextOrWithheld as rn, unpreviewableOrphanRecords as ro, isFinalSnapshotError as rr, liveMatchesUnresolvedTokenFrame as rs, displacedOpClause as rt, readProtection as s, malformedDriftResourcePropertiesWarning as sa, hasReadableExportSet as sc, s3BucketRegionalDomainName as si, getLegacyStateBucketName as sl, secretSafeKeyDisplay as sn, findActionableSilentDrops as so, ledgerForStack as sr, snapshotPassProvenance as ss, nestedChildStackName as st, DeployEngine as t, displayLogicalId as ta, isAccessDenied$1 as tc, IntrinsicFunctionResolver as ti, stripForDisplay as tl, resourcesNamingDeclaredParameter as tn, repairMalformedResourcePropertiesForReadOnly as to, createPreDeleteFinalSnapshot as tr, recordedNoEchoValuesOf as ts, recordRetainedForReadoption as tt, beginDeleteWait as u, malformedLocalOutputsWarning as ua, importableOutputKeys as uc, producerLookupOver as ui, resolveAutoAssetStorage as ul, exportNameSecretExposure as un, withoutSilentDropProperties as uo, acquireIdempotencyToken as ur, hasMaskableValues as us, revertedNestedRowIds as ut, waitForIndexesSettled as v, malformedOutputsRefusalMessage as va, stringifyValue as vc, assertSendableRoleArn as vi, ssmResolvedValueType as vl, DEFAULT_RESOURCE_WARN_AFTER_MS as vn, renderStatefulReason as vo, tagMapAsList as vr, createSecretMasker as vs, isHandledOrphan as vt, markRefusedBeforeApplying as w, malformedScrubResourceEntriesRefusalMessage as wa, AssetModeResolver as wc, callerEnvCredentials as wi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as wl, destroyStackRecordsView as wn, coerceCfnBoolean as wo, ccBrokenReason as wr, withoutPhysicalNameCopies as ws, chunks as wt, hasCdkAutoDeleteTag as x, malformedResourceEntriesWarning as xa, createAssetRedirectResolver as xc, sendableAssumeRoleCommand as xi, MIGRATE_TMP_PREFIX as xl, findDestructiveChanges as xn, isWarmThroughputDecrease as xo, stringifyIfAssigned as xr, maskSecretsInText as xs, makeForeignHolderScan as xt, ECR_AUTO_DELETE_IMAGES_TAG as y, malformedOutputsWarning as ya, WorkGraph as yc, explicitRoleArnOrThrow as yi, CFN_TEMPLATE_BODY_LIMIT as yl, maskingRetryLogger as yn, WARM_THROUGHPUT_MEMBERS as yo, tagPlanWarning as yr, errorCauseChain as ys, journaledOrphanLines as yt, conditionInputsFrom as z, refuseMalformedResourceEntriesForDestroy as za, describeDockerFailure as zc, AWS_NO_VALUE as zi, describeFileReadFailure as zl, completedReplayEntries as zn, lambdaFunctionNameForMask as zo, RollbackInlinePolicyWriters as zr, recordMaskOnlyValue as zs, replacementNeverSwapped as zt };
+//# sourceMappingURL=deploy-engine-BN6g5voc.js.map