@go-to-k/cdkd 0.301.9 → 0.301.10

package/dist/{provider-classes-Dbw16dmt.js → provider-classes-B9XBsEl1.js}

@@ -2,12 +2,12 @@ import { r as getAwsClients } from "./aws-clients-B_CEQGE1.js";
 import { B as safeMsg, F as displaySafe, I as displayStackName, L as isPasteableIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
 import { $ as protectedReplacementAdvice, $n as markReplayMayCollide, $t as ambientCredentialConfig, A as isQuotableImportValue, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, H as observeThenDisableProtection, Hn as withheldTargetClause, In as pasteableCommand, Kt as injectiveKey, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Nt as markSupersedesEarlierCreate, O as isPlainImportJson, P as remedyLogicalId, Pn as hasClauseBreak, Q as pasteableAwsCommand, Qn as markNameCollision, Qt as ambientClientDefaults, Rn as plainOrDescribed, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, Vn as shellQuote, W as rdsFamilyProtectionSite, X as WITHHELD_AWS_COMMAND, Y as UNNAMEABLE_ID_CLAUSE, Z as isAwsCliLiteral, Zt as withPasteableAwsProfile, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isExplicitDenyError, at as startInterruptWatch, b as isInsideWindow, bn as ResourceUpdateNotSupportedError, bt as maskDeep, c as recordedPrincipalsRepair, cr as isTransientServerError, ct as canonicalizeRoute53QueryName, dr as isMarkedNonRetryable, dt as compositeIdSkipResult, en as clientDefaultsFor, er as relayedNameCollision, et as renderDisableCommand, fr as isThrottlingError, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hr as wrapMaskedAwsError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as isAmbiguousOutcomeError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, k as isPlainImportValue, lt as compositeIdFormatMessage, mr as markRedactedCause, nn as AccountIdUnavailableError, o as readPrincipalLists, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pr as markNonRetryable, pt as packCompositeId, q as userPoolProtectionSite, qn as isNameCollisionError, qt as injectiveKeyPrefix, r as SECRET_DERIVED_READ_LIVE, sr as isRetryableTransientError, tn as credentialFingerprint, tr as explicitDenyPolicyKind, u as clearOnUpdateRemoval, ur as THROTTLING_ERROR_NAMES, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ProvisioningError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation } from "./iam-policy-targets-DJmfxbko.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $i as accountArgs, Ao as replayWarn, Bl as displayAssemblyPath, Bo as sameLambdaFunctionAddress, C as getPriorAttempts, Cc as rewriteTemplateAssetReferences, Cn as awaitInFlightSibling, Co as toFiniteNumber, Dn as replacedDeleteFailureVerdict, Do as configIntegerRefusal, Dr as waitForLambdaFunctionActive, Dt as withApiLimit, Eo as configBooleanRefusal, Es as dynamicReferenceTokens, Et as lookupEachName, F as listNestedTemplateRows, Gr as isWaitAbandonedError, Hl as resolveAssemblyPath, I as renderNestedTemplateTreeDefect, Ja as refuseMalformedResourcesForDestroy, Jr as ec2InstanceProtectionSite, Jt as redactedDeleteAddressFields, Ki as passedParameterClassesOf, Kn as secretNamedAttributeNamesOf, Kr as markWaitAbandoned, Kt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Lo as withRetry, Lr as slowCcOperationTimeoutMs, Ls as carriesSecretMask, Mo as requireConfigObject, Ms as recoverMaskedOutput, N as findNestedTemplateTreeDefect, Ni as getAccountInfo, No as requireConfigString, Ns as physicalNameCopiesOf, Oa as refuseMalformedNestedChildOutputs, Ol as canonicalizeRegion, Oo as configStringRefusal, P as isAbsoluteAssetPath, Ps as recordAttributeIdCopy, Qo as passedNoEchoParametersOf, Qr as reEnableInstanceApiTermination, Ro as canonicalLambdaFunctionName, Rr as unchangedBehindSecretReference, S as isTruthyCfnBoolean, So as toCfnInteger, Tl as decodeListingKey, Tn as getStackRecords, To as coerceCfnInteger, Tt as isAccessDeniedError, Ui as parseWebACLArn, Ur as deleteSkipReason, Vl as renderAssemblyPathEscape, Wr as withIndeterminateGuard, Wt as getCurrentProducerRegions, Xr as observeThenDisableInstanceApiTermination, Yr as isTerminationProtectionPropagationError, Yt as redactedDeleteAddressSkip, Zr as reDisableInstanceApiTermination, _ as deleteTableWithIndexBusyRetry, _r as refuseMalformedDesiredTags, ai as s3BucketDomainName, as as redactForState, b as S3_AUTO_DELETE_OBJECTS_TAG, bo as coerceWarmThroughput$1, br as definedAttributes, c as DynamoDBGlobalTableProvider, ci as s3BucketWebsiteUrl, co as findSilentDropProperties, cr as reserveStackCreateToken, d as compensateRemovedDeletionProtection, dr as isRefusedByName, f as deleteBudgetKey, fr as markDeleteStarted, g as INDEX_SETTLE_POLL_INTERVAL_MS, gr as readTagList, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hr as planTagDiff, ii as s3BucketArn, is as markSameGenerationBag, jo as requireConfigArray, jr as getCurrentResourceSecrets, kl as derivePartitionAndUrlSuffix, ko as readConfigString, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, lt as revertNestedChildFromJournal, m as resolveDynamoDbDeleteBudgetMs, mr as DBPROXY_TAG_OPTIONS, mt as withNestedStackContext, oi as s3BucketDualStackDomainName, oo as withheldAccountClause, or as earliestDefined, os as recordReferenceProvenanceEntry, ot as getNestedRevertRun, p as resolveDynamoDbDeleteBudgetClock, pi as outputReferenceProvenanceOf, pr as DBPROXY_TAGS_WHAT, pt as getCurrentNestedStackContext, qt as isRedactedRecordedValue, ri as isSettledInstanceState, si as s3BucketRegionalDomainName, ss as snapshotPassProvenance, t as DeployEngine, u as beginDeleteWait, uo as withoutSilentDropProperties, ur as acquireIdempotencyToken, us as hasMaskableValues, v as waitForIndexesSettled, vc as stringifyValue, vr as tagMapAsList, w as markRefusedBeforeApplying, wo as coerceCfnBoolean, ws as withoutPhysicalNameCopies, wt as chunks, x as hasCdkAutoDeleteTag, xo as isWarmThroughputDecrease, xr as stringifyIfAssigned, y as ECR_AUTO_DELETE_IMAGES_TAG, yo as WARM_THROUGHPUT_MEMBERS, yr as tagPlanWarning, zl as describeFileReadFailure, zo as lambdaFunctionNameForMask } from "./deploy-engine-BN6g5voc.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-ox_QAXCb.js";
-import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-bNAjgmlg.js";
-import { RDSProvider } from "./rds-provider-iwtmIiPb.js";
-import { NeptuneProvider } from "./neptune-provider-Dq6PuG9E.js";
-import { ASGProvider } from "./asg-provider-BsUcTrJN.js";
+import { $i as accountArgs, Ao as replayWarn, Bl as displayAssemblyPath, Bo as sameLambdaFunctionAddress, C as getPriorAttempts, Cc as rewriteTemplateAssetReferences, Cn as awaitInFlightSibling, Co as toFiniteNumber, Dn as replacedDeleteFailureVerdict, Do as configIntegerRefusal, Dr as waitForLambdaFunctionActive, Dt as withApiLimit, Eo as configBooleanRefusal, Es as dynamicReferenceTokens, Et as lookupEachName, F as listNestedTemplateRows, Gr as isWaitAbandonedError, Hl as resolveAssemblyPath, I as renderNestedTemplateTreeDefect, Ja as refuseMalformedResourcesForDestroy, Jr as ec2InstanceProtectionSite, Jt as redactedDeleteAddressFields, Ki as passedParameterClassesOf, Kn as secretNamedAttributeNamesOf, Kr as markWaitAbandoned, Kt as REDACTED_DELETE_ADDRESS_SKIP_REASON, Lo as withRetry, Lr as slowCcOperationTimeoutMs, Ls as carriesSecretMask, Mo as requireConfigObject, Ms as recoverMaskedOutput, N as findNestedTemplateTreeDefect, Ni as getAccountInfo, No as requireConfigString, Ns as physicalNameCopiesOf, Oa as refuseMalformedNestedChildOutputs, Ol as canonicalizeRegion, Oo as configStringRefusal, P as isAbsoluteAssetPath, Ps as recordAttributeIdCopy, Qo as passedNoEchoParametersOf, Qr as reEnableInstanceApiTermination, Ro as canonicalLambdaFunctionName, Rr as unchangedBehindSecretReference, S as isTruthyCfnBoolean, So as toCfnInteger, Tl as decodeListingKey, Tn as getStackRecords, To as coerceCfnInteger, Tt as isAccessDeniedError, Ui as parseWebACLArn, Ur as deleteSkipReason, Vl as renderAssemblyPathEscape, Wr as withIndeterminateGuard, Wt as getCurrentProducerRegions, Xr as observeThenDisableInstanceApiTermination, Yr as isTerminationProtectionPropagationError, Yt as redactedDeleteAddressSkip, Zr as reDisableInstanceApiTermination, _ as deleteTableWithIndexBusyRetry, _r as refuseMalformedDesiredTags, ai as s3BucketDomainName, as as redactForState, b as S3_AUTO_DELETE_OBJECTS_TAG, bo as coerceWarmThroughput$1, br as definedAttributes, c as DynamoDBGlobalTableProvider, ci as s3BucketWebsiteUrl, co as findSilentDropProperties, cr as reserveStackCreateToken, d as compensateRemovedDeletionProtection, dr as isRefusedByName, f as deleteBudgetKey, fr as markDeleteStarted, g as INDEX_SETTLE_POLL_INTERVAL_MS, gr as readTagList, h as DELETE_INDEX_WAIT_PROCEED_NOTE, hr as planTagDiff, ii as s3BucketArn, is as markSameGenerationBag, jo as requireConfigArray, jr as getCurrentResourceSecrets, kl as derivePartitionAndUrlSuffix, ko as readConfigString, l as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, lt as revertNestedChildFromJournal, m as resolveDynamoDbDeleteBudgetMs, mr as DBPROXY_TAG_OPTIONS, mt as withNestedStackContext, oi as s3BucketDualStackDomainName, oo as withheldAccountClause, or as earliestDefined, os as recordReferenceProvenanceEntry, ot as getNestedRevertRun, p as resolveDynamoDbDeleteBudgetClock, pi as outputReferenceProvenanceOf, pr as DBPROXY_TAGS_WHAT, pt as getCurrentNestedStackContext, qt as isRedactedRecordedValue, ri as isSettledInstanceState, si as s3BucketRegionalDomainName, ss as snapshotPassProvenance, t as DeployEngine, u as beginDeleteWait, uo as withoutSilentDropProperties, ur as acquireIdempotencyToken, us as hasMaskableValues, v as waitForIndexesSettled, vc as stringifyValue, vr as tagMapAsList, w as markRefusedBeforeApplying, wo as coerceCfnBoolean, ws as withoutPhysicalNameCopies, wt as chunks, x as hasCdkAutoDeleteTag, xo as isWarmThroughputDecrease, xr as stringifyIfAssigned, y as ECR_AUTO_DELETE_IMAGES_TAG, yo as WARM_THROUGHPUT_MEMBERS, yr as tagPlanWarning, zl as describeFileReadFailure, zo as lambdaFunctionNameForMask } from "./deploy-engine-BOHXbSq5.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-3CUpHJfg.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-BGo747Co.js";
+import { RDSProvider } from "./rds-provider-CaPSidBQ.js";
+import { NeptuneProvider } from "./neptune-provider-U_LOS8jM.js";
+import { ASGProvider } from "./asg-provider-BEProOyz.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -32584,7 +32584,7 @@ var AppSyncProvider = class {
 	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
 			case "AWS::AppSync::GraphQLApi": return this.createGraphQLApi(logicalId, resourceType, properties, context);
-			case "AWS::AppSync::GraphQLSchema": return this.createGraphQLSchema(logicalId, resourceType, properties);
+			case "AWS::AppSync::GraphQLSchema": return this.createGraphQLSchema(logicalId, resourceType, properties, context);
 			case "AWS::AppSync::DataSource": return this.createDataSource(logicalId, resourceType, properties, context);
 			case "AWS::AppSync::Resolver": return this.createResolver(logicalId, resourceType, properties, context);
 			case "AWS::AppSync::ApiKey": return this.createApiKey(logicalId, resourceType, properties, context);
@@ -32594,7 +32594,7 @@ var AppSyncProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
 			case "AWS::AppSync::GraphQLApi": return this.updateGraphQLApi(logicalId, physicalId, resourceType, properties, previousProperties, context);
-			case "AWS::AppSync::GraphQLSchema": return this.updateGraphQLSchema(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::AppSync::GraphQLSchema": return this.updateGraphQLSchema(logicalId, physicalId, resourceType, properties, previousProperties, maskerOrIdentity(context?.maskSecrets));
 			case "AWS::AppSync::DataSource": return this.updateDataSource(logicalId, physicalId, resourceType, properties, previousProperties, maskerOrIdentity(context?.maskSecrets));
 			case "AWS::AppSync::Resolver": return this.updateResolver(logicalId, physicalId, resourceType, properties, previousProperties, maskerOrIdentity(context?.maskSecrets));
 			case "AWS::AppSync::ApiKey": return this.updateApiKey(logicalId, physicalId, resourceType, properties, previousProperties, maskerOrIdentity(context?.maskSecrets));
@@ -32698,14 +32698,14 @@ var AppSyncProvider = class {
 			}
 		}
 		const envRecord = await this.applyEnvironmentVariables(physicalId, resourceType, logicalId, properties, previousProperties, false, maskerOrIdentity(context?.maskSecrets));
-		await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
+		await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"], maskerOrIdentity(context?.maskSecrets));
 		return {
 			physicalId,
 			wasReplaced: false,
 			...envRecord && { effectiveProperties: this.withEnvironmentVariablesRecord(properties, envRecord) }
 		};
 	}
-	async updateGraphQLSchema(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async updateGraphQLSchema(logicalId, physicalId, resourceType, properties, previousProperties, mask = maskerOrIdentity(void 0)) {
 		const newDef = properties["Definition"];
 		const oldDef = previousProperties["Definition"];
 		const newLoc = properties["DefinitionS3Location"];
@@ -32723,7 +32723,7 @@ var AppSyncProvider = class {
 				physicalId,
 				wasReplaced: false
 			};
-			definition = await this.fetchS3LocationBody(newLoc, resourceType, logicalId, "DefinitionS3Location");
+			definition = await this.fetchS3LocationBody(newLoc, resourceType, logicalId, "DefinitionS3Location", mask);
 		} else return {
 			physicalId,
 			wasReplaced: false
@@ -32735,7 +32735,7 @@ var AppSyncProvider = class {
 				definition: Buffer.from(definition, "utf-8")
 			}));
 		} catch (error) {
-			throw this.wrapUpdateError(error, resourceType, logicalId, physicalId, "GraphqlSchema");
+			throw this.wrapUpdateError(error, resourceType, logicalId, physicalId, "GraphqlSchema", mask);
 		}
 		return {
 			physicalId,
@@ -32829,7 +32829,7 @@ var AppSyncProvider = class {
 			typeName,
 			fieldName
 		};
-		await this.applyResolverConfig(input, resourceType, logicalId, properties, previousProperties, true);
+		await this.applyResolverConfig(input, resourceType, logicalId, properties, previousProperties, true, mask);
 		try {
 			await this.getClient().send(new UpdateResolverCommand(input));
 		} catch (error) {
@@ -32865,7 +32865,7 @@ var AppSyncProvider = class {
 		}
 		return this.childUpdateResult(resourceType, physicalId, mask);
 	}
-	async applyTagDiff(apiId, resourceType, logicalId, oldTagsRaw, newTagsRaw) {
+	async applyTagDiff(apiId, resourceType, logicalId, oldTagsRaw, newTagsRaw, mask = maskerOrIdentity(void 0)) {
 		const plan = planTagDiff(oldTagsRaw, newTagsRaw);
 		const tagWarning = tagPlanWarning(plan, resourceType, logicalId);
 		if (tagWarning !== void 0) this.logger.warn(tagWarning);
@@ -32875,7 +32875,7 @@ var AppSyncProvider = class {
 			try {
 				arn = (await this.getClient().send(new GetGraphqlApiCommand({ apiId }))).graphqlApi?.arn;
 			} catch (error) {
-				throw this.wrapUpdateError(error, resourceType, logicalId, apiId, "GraphqlApi");
+				throw this.wrapUpdateError(error, resourceType, logicalId, apiId, "GraphqlApi", mask);
 			}
 			if (!arn) throw new ProvisioningError(`Could not resolve ARN for AppSync GraphqlApi ${apiId} to apply tags diff`, resourceType, logicalId, apiId);
 			this.arnCache.set(apiId, arn);
@@ -32888,7 +32888,7 @@ var AppSyncProvider = class {
 				tagKeys: tagKeysToRemove
 			}));
 		} catch (error) {
-			throw this.wrapUpdateError(error, resourceType, logicalId, apiId, "GraphqlApi (untag)");
+			throw this.wrapUpdateError(error, resourceType, logicalId, apiId, "GraphqlApi (untag)", mask);
 		}
 		if (Object.keys(tagsToAdd).length > 0) try {
 			await this.getClient().send(new TagResourceCommand$17({
@@ -32896,12 +32896,24 @@ var AppSyncProvider = class {
 				tags: tagsToAdd
 			}));
 		} catch (error) {
-			throw this.wrapUpdateError(error, resourceType, logicalId, apiId, "GraphqlApi (tag)");
+			throw this.wrapUpdateError(error, resourceType, logicalId, apiId, "GraphqlApi (tag)", mask);
 		}
 	}
 	wrapUpdateError(error, resourceType, logicalId, physicalId, subType, mask = maskerOrIdentity(void 0)) {
 		const cause = error instanceof Error ? error : void 0;
-		return wrapMaskedAwsError(mask, error, (text) => new ProvisioningError(`Failed to update AppSync ${subType} ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
+		const build = (text) => new ProvisioningError(`Failed to update AppSync ${subType} ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause);
+		const failure = describeAwsFailure(error);
+		if (error instanceof Error && failure.redacted) return this.withheldAwsFailure(mask, failure.detail, failure.summary, build);
+		return wrapMaskedAwsError(mask, error, build);
+	}
+	wrapCaughtError(mask, error, build) {
+		const failure = describeAwsFailure(error);
+		if (!(error instanceof Error) || !failure.redacted) return build(failure.detail);
+		return this.withheldAwsFailure(mask, failure.detail, failure.summary, build);
+	}
+	withheldAwsFailure(mask, detail, summary, build) {
+		this.logger.debug(mask(build(mask(detail)).message));
+		return markRedactedCause(build(`${mask(summary)}${relayedNameCollision(detail)}`));
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		switch (resourceType) {
@@ -33130,7 +33142,7 @@ var AppSyncProvider = class {
 				environmentVariables
 			}));
 		} catch (error) {
-			throw this.wrapUpdateError(error, resourceType, logicalId, apiId, isUpdate ? "GraphqlApi (env vars)" : "GraphqlApi (env vars, post-create)");
+			throw this.wrapUpdateError(error, resourceType, logicalId, apiId, isUpdate ? "GraphqlApi (env vars)" : "GraphqlApi (env vars, post-create)", mask);
 		}
 		return narrowed;
 	}
@@ -33172,7 +33184,7 @@ var AppSyncProvider = class {
 			key: match[2]
 		};
 	}
-	async fetchS3LocationBody(location, resourceType, logicalId, propertyPath) {
+	async fetchS3LocationBody(location, resourceType, logicalId, propertyPath, mask = maskerOrIdentity(void 0)) {
 		const { bucket, key } = this.parseS3LocationUrl(location, resourceType, logicalId, propertyPath);
 		this.logger.debug(`Fetching ${propertyPath} for ${logicalId} from s3://${bucket}/${key}`);
 		let body;
@@ -33185,19 +33197,20 @@ var AppSyncProvider = class {
 			body = await resp.Body.transformToString();
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
-			throw new ProvisioningError(`Failed to fetch ${propertyPath} s3://${bucket}/${key} for ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			const cause = error instanceof Error ? error : void 0;
+			throw this.wrapCaughtError(mask, error, (text) => new ProvisioningError(`Failed to fetch ${propertyPath} s3://${bucket}/${key} for ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 		if (body.length === 0) throw new ProvisioningError(`${propertyPath} object s3://${bucket}/${key} returned an empty body`, resourceType, logicalId);
 		return body;
 	}
-	async resolveInlineOrS3Template(inline, s3Location, inlineKey, s3Key, resourceType, logicalId) {
+	async resolveInlineOrS3Template(inline, s3Location, inlineKey, s3Key, resourceType, logicalId, mask = maskerOrIdentity(void 0)) {
 		if (inline !== void 0) {
 			if (s3Location !== void 0) this.logger.warn(`${resourceType} ${logicalId}: both ${inlineKey} and ${s3Key} are set — using the inline ${inlineKey} and ignoring ${s3Key} (CFn treats them as alternatives)`);
 			return inline;
 		}
-		if (s3Location !== void 0) return this.fetchS3LocationBody(s3Location, resourceType, logicalId, s3Key);
+		if (s3Location !== void 0) return this.fetchS3LocationBody(s3Location, resourceType, logicalId, s3Key, mask);
 	}
-	async applyResolverConfig(input, resourceType, logicalId, properties, previousProperties, forUpdate = false) {
+	async applyResolverConfig(input, resourceType, logicalId, properties, previousProperties, forUpdate = false, mask = maskerOrIdentity(void 0)) {
 		const effectiveKind = properties["Kind"] ?? previousProperties?.["Kind"] ?? "UNIT";
 		if ((!forUpdate || effectiveKind === "UNIT") && properties["DataSourceName"] !== void 0) input.dataSourceName = properties["DataSourceName"];
 		if (properties["Kind"] !== void 0) input.kind = properties["Kind"];
@@ -33209,11 +33222,11 @@ var AppSyncProvider = class {
 				runtimeVersion: runtime["RuntimeVersion"]
 			};
 		}
-		const requestTemplate = await this.resolveInlineOrS3Template(properties["RequestMappingTemplate"], properties["RequestMappingTemplateS3Location"], "RequestMappingTemplate", "RequestMappingTemplateS3Location", resourceType, logicalId);
+		const requestTemplate = await this.resolveInlineOrS3Template(properties["RequestMappingTemplate"], properties["RequestMappingTemplateS3Location"], "RequestMappingTemplate", "RequestMappingTemplateS3Location", resourceType, logicalId, mask);
 		if (requestTemplate !== void 0) input.requestMappingTemplate = requestTemplate;
-		const responseTemplate = await this.resolveInlineOrS3Template(properties["ResponseMappingTemplate"], properties["ResponseMappingTemplateS3Location"], "ResponseMappingTemplate", "ResponseMappingTemplateS3Location", resourceType, logicalId);
+		const responseTemplate = await this.resolveInlineOrS3Template(properties["ResponseMappingTemplate"], properties["ResponseMappingTemplateS3Location"], "ResponseMappingTemplate", "ResponseMappingTemplateS3Location", resourceType, logicalId, mask);
 		if (responseTemplate !== void 0) input.responseMappingTemplate = responseTemplate;
-		const code = await this.resolveInlineOrS3Template(properties["Code"], properties["CodeS3Location"], "Code", "CodeS3Location", resourceType, logicalId);
+		const code = await this.resolveInlineOrS3Template(properties["Code"], properties["CodeS3Location"], "Code", "CodeS3Location", resourceType, logicalId, mask);
 		if (code !== void 0) input.code = code;
 		const caching = this.toSdkCachingConfig(properties["CachingConfig"], logicalId);
 		if (caching) input.cachingConfig = caching;
@@ -33360,7 +33373,7 @@ var AppSyncProvider = class {
 				}
 			}
 			const cause = error instanceof Error ? error : void 0;
-			const thrown = new ProvisioningError(`Failed to create GraphQL API ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			const thrown = this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to create GraphQL API ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 			if (apiLeftBehind && createdApiId) {
 				markCreatedBeforeFailure(thrown, logicalId, resourceType, createdApiId);
 				markNonRetryable(thrown);
@@ -33429,10 +33442,10 @@ var AppSyncProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete GraphQL API ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to delete GraphQL API ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
-	async createGraphQLSchema(logicalId, resourceType, properties) {
+	async createGraphQLSchema(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating GraphQL Schema ${logicalId}`);
 		const apiId = properties["ApiId"];
 		if (!apiId) throw new ProvisioningError(`ApiId is required for GraphQLSchema ${logicalId}`, resourceType, logicalId);
@@ -33446,7 +33459,7 @@ var AppSyncProvider = class {
 					definition: new TextEncoder().encode(definition)
 				}));
 			} else if (definitionS3Location !== void 0) {
-				const body = await this.fetchS3LocationBody(definitionS3Location, resourceType, logicalId, "DefinitionS3Location");
+				const body = await this.fetchS3LocationBody(definitionS3Location, resourceType, logicalId, "DefinitionS3Location", maskerOrIdentity(context?.maskSecrets));
 				await this.getClient().send(new StartSchemaCreationCommand({
 					apiId,
 					definition: new TextEncoder().encode(body)
@@ -33459,7 +33472,7 @@ var AppSyncProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create GraphQL Schema ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to create GraphQL Schema ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 	}
 	async createDataSource(logicalId, resourceType, properties, context) {
@@ -33490,7 +33503,7 @@ var AppSyncProvider = class {
 			this.logger.debug(`Successfully created DataSource ${logicalId}: ${physicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create DataSource ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to create DataSource ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 		const dataSourceArn = reportedArn ?? await this.buildAppSyncArnOrWarn(`apis/${apiId}/datasources/${name}`, logicalId, physicalId);
 		return {
@@ -33522,7 +33535,7 @@ var AppSyncProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete DataSource ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to delete DataSource ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async createResolver(logicalId, resourceType, properties, context) {
@@ -33555,12 +33568,12 @@ var AppSyncProvider = class {
 				typeName,
 				fieldName
 			};
-			await this.applyResolverConfig(input, resourceType, logicalId, properties);
+			await this.applyResolverConfig(input, resourceType, logicalId, properties, void 0, false, maskerOrIdentity(context?.maskSecrets));
 			reportedArn = (await this.getClient().send(new CreateResolverCommand(input))).resolver?.resolverArn;
 			this.logger.debug(`Successfully created Resolver ${logicalId}: ${physicalId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create Resolver ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to create Resolver ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 		const resolverArn = reportedArn ?? await this.buildAppSyncArnOrWarn(`apis/${apiId}/types/${typeName}/resolvers/${fieldName}`, logicalId, physicalId);
 		return {
@@ -33591,7 +33604,7 @@ var AppSyncProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete Resolver ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to delete Resolver ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	async createApiKey(logicalId, resourceType, properties, context) {
@@ -33620,7 +33633,7 @@ var AppSyncProvider = class {
 			this.logger.debug(`Successfully created ApiKey ${logicalId}: ${apiKeyId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create ApiKey ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, void 0, cause);
+			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to create ApiKey ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
 		}
 		const physicalId = packCompositeId(resourceType, logicalId, [{
 			name: "apiId",
@@ -33687,7 +33700,7 @@ var AppSyncProvider = class {
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete ApiKey ${logicalId}: ${describeAwsFailure(error).detail}`, resourceType, logicalId, physicalId, cause);
+			throw this.wrapCaughtError(maskerOrIdentity(context?.maskSecrets), error, (text) => new ProvisioningError(`Failed to delete ApiKey ${logicalId}: ${text}`, resourceType, logicalId, physicalId, cause));
 		}
 	}
 	isNotFoundError(error) {
@@ -46943,4 +46956,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaNetworkConnectorProvider, LambdaPermissionProvider, LambdaUrlProvider, LambdaWebFunctionEndpointProvider, LambdaWebFunctionRevisionProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-Dbw16dmt.js.map
+//# sourceMappingURL=provider-classes-B9XBsEl1.js.map