@go-to-k/cdkd 0.302.1 → 0.302.3

package/dist/secret-redaction-BHWS-PZK.js

@@ -0,0 +1,3937 @@
+import { Q as safeMsg, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-e_ddrDDo.js";
+
+//#region src/deployment/secret-redaction/rules.ts
+const MIN_NEEDLE_LENGTH = 4;
+function printingNeedles(values) {
+	const out = /* @__PURE__ */ new Set();
+	for (const value of values) {
+		if (value.length < 4) continue;
+		out.add(value);
+		const flat = flattenedSpelling(value);
+		if (flat !== void 0 && flat.trim().length >= 4) out.add(flat);
+	}
+	return [...out];
+}
+const FLATTENED_MEMO_CAP = 4096;
+const flattenedMemo = /* @__PURE__ */ new Map();
+function flattenedSpelling(value) {
+	if (!SAFE_MSG_ALTERED_CHAR.test(value)) return void 0;
+	let flat = flattenedMemo.get(value);
+	if (flat === void 0) {
+		flat = safeMsg`${value}`;
+		if (flattenedMemo.size >= FLATTENED_MEMO_CAP) flattenedMemo.clear();
+		flattenedMemo.set(value, flat);
+	}
+	return flat === value ? void 0 : flat;
+}
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function maskMatchSpans(text, needles, mask) {
+	const spans = [];
+	for (const needle of needles) for (let at = text.indexOf(needle); at !== -1; at = text.indexOf(needle, at + 1)) spans.push([at, at + needle.length]);
+	if (spans.length === 0) return text;
+	spans.sort((a, b) => a[0] - b[0] || b[1] - a[1]);
+	let out = "";
+	let cursor = 0;
+	let [start, end] = spans[0];
+	for (const [nextStart, nextEnd] of spans.slice(1)) {
+		if (nextStart < end) {
+			end = Math.max(end, nextEnd);
+			continue;
+		}
+		out += text.slice(cursor, start) + mask;
+		cursor = end;
+		[start, end] = [nextStart, nextEnd];
+	}
+	return out + text.slice(cursor, start) + mask + text.slice(end);
+}
+function buildNeedleRegex(values) {
+	const needles = Array.from(new Set(values)).filter((v) => v.length >= 4).sort((a, b) => b.length - a.length);
+	if (needles.length === 0) return void 0;
+	return new RegExp(needles.map(escapeRegExp).join("|"), "g");
+}
+const TEMPLATE_DERIVED_RULES = {
+	descendArrays: true,
+	trustAnyExpression: false,
+	sourceIsSameGeneration: false
+};
+const TEMPLATE_SOURCED_RULES = {
+	descendArrays: false,
+	trustAnyExpression: false,
+	sourceIsSameGeneration: false
+};
+const STATE_SOURCED_READBACK_RULES = {
+	descendArrays: false,
+	trustAnyExpression: true,
+	sourceIsSameGeneration: true
+};
+const STATE_SOURCED_BASELINE_RULES = {
+	descendArrays: false,
+	trustAnyExpression: true,
+	sourceIsSameGeneration: true,
+	failClosedOnUncertifiedPositions: true
+};
+const STATE_SOURCED_CROSS_GENERATION_RULES = {
+	descendArrays: false,
+	trustAnyExpression: true,
+	sourceIsSameGeneration: false
+};
+const STATE_DERIVED_RULES = {
+	descendArrays: true,
+	trustAnyExpression: true,
+	sourceIsSameGeneration: true
+};
+function isDynamicReferenceString(value) {
+	return typeof value === "string" && value.includes("{{resolve:");
+}
+const DYNAMIC_REFERENCE_INNER_CHAR = "[^}]";
+const DYNAMIC_REFERENCE_INNER = `${DYNAMIC_REFERENCE_INNER_CHAR}+`;
+const WHOLE_DYNAMIC_REFERENCE_PATTERN = new RegExp(`^\\{\\{resolve:${DYNAMIC_REFERENCE_INNER}\\}\\}$`);
+function isSingleDynamicReferenceToken(value) {
+	return WHOLE_DYNAMIC_REFERENCE_PATTERN.test(value);
+}
+function isPlainObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/mask-only.ts
+const recordedSecretExpressions = /* @__PURE__ */ new Set();
+const secretVerdictScopes = /* @__PURE__ */ new Map();
+function pinScopedSecretVerdict(scope, expression, secret) {
+	const scopes = secretVerdictScopes.get(expression);
+	if (secret) {
+		if (scopes) scopes.add(scope);
+		else secretVerdictScopes.set(expression, /* @__PURE__ */ new Set([scope]));
+		recordedSecretExpressions.add(expression);
+		return;
+	}
+	if (scopes?.delete(scope) && scopes.size === 0) secretVerdictScopes.delete(expression);
+	recordedSecretExpressions.delete(expression);
+}
+function isScopedSecretVerdict(scope, expression) {
+	return secretVerdictScopes.get(expression)?.has(scope) === true;
+}
+function isRecordedSecretExpression(expression) {
+	return recordedSecretExpressions.has(expression);
+}
+const provenPublicExpressions = /* @__PURE__ */ new WeakMap();
+function proofsOf(bag) {
+	let proofs = provenPublicExpressions.get(bag);
+	if (!proofs) {
+		proofs = /* @__PURE__ */ new Map();
+		provenPublicExpressions.set(bag, proofs);
+	}
+	return proofs;
+}
+function recordProvenPublicExpression(bag, expression, value) {
+	const proofs = proofsOf(bag);
+	const prior = proofs.get(expression);
+	if (prior === false) return;
+	proofs.set(expression, prior === void 0 || prior === value ? value : false);
+}
+function sharePublicProofs(view, pass) {
+	provenPublicExpressions.set(view, proofsOf(pass));
+}
+function carryPublicProofs(from, to) {
+	for (const [expression, value] of provenPublicExpressions.get(from) ?? []) if (value === false) contradictProvenPublicExpression(to, expression);
+	else recordProvenPublicExpression(to, expression, value);
+}
+function contradictProvenPublicExpression(bag, expression) {
+	proofsOf(bag).set(expression, false);
+}
+function provenPublicValue(bag, expression) {
+	const value = provenPublicExpressions.get(bag)?.get(expression);
+	if (value === void 0 || value === false) return void 0;
+	if (recordedSecretExpressions.has(expression)) return void 0;
+	for (const recorded of bag.values()) if (recorded === expression) return void 0;
+	return value;
+}
+function recordMaskOnlyValue(secrets, plaintext) {
+	if (plaintext.length < 4) return;
+	const existing = secrets.get(plaintext);
+	if (existing !== void 0 && existing !== "***") return;
+	secrets.set(plaintext, "***");
+}
+function isMaskOnlyPlaintext(secrets, plaintext) {
+	return secrets.get(plaintext) === "***";
+}
+function recordMaskOnlyValuesIn(value, secrets, excluded) {
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (node) => {
+		if (typeof node === "string") {
+			if (excluded?.has(node) === true) return;
+			recordMaskOnlyValue(secrets, node);
+			return;
+		}
+		if (node === null || typeof node !== "object") return;
+		if (seen.has(node)) return;
+		seen.add(node);
+		if (Array.isArray(node)) {
+			for (const item of node) walk(item);
+			return;
+		}
+		for (const child of Object.values(node)) walk(child);
+	};
+	walk(value);
+}
+function wholeStringLeavesOf(value) {
+	const leaves = /* @__PURE__ */ new Set();
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (node) => {
+		if (typeof node === "string") {
+			leaves.add(node);
+			return;
+		}
+		if (node === null || typeof node !== "object") return;
+		if (seen.has(node)) return;
+		seen.add(node);
+		if (Array.isArray(node)) {
+			for (const item of node) walk(item);
+			return;
+		}
+		for (const child of Object.values(node)) walk(child);
+	};
+	walk(value);
+	return leaves;
+}
+function recordNoEchoAttributeValues(result, secrets, ownProperties) {
+	const attributes = result.attributes;
+	if (attributes === void 0) return void 0;
+	const excluded = ownProperties === void 0 ? void 0 : wholeStringLeavesOf(ownProperties);
+	if (result.noEchoAttributes === true) {
+		recordMaskOnlyValuesIn(attributes, secrets, excluded);
+		return true;
+	}
+	const names = (result.noEchoAttributeNames ?? []).filter((name) => Object.hasOwn(attributes, name));
+	if (names.length === 0) return void 0;
+	for (const name of names) recordMaskOnlyValuesIn(attributes[name], secrets, excluded);
+	return new Set(names);
+}
+function carriesSecretMask(value) {
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (node) => {
+		if (typeof node === "string") return node === "***";
+		if (node === null || typeof node !== "object") return false;
+		if (seen.has(node)) return false;
+		seen.add(node);
+		if (Array.isArray(node)) return node.some((item) => walk(item));
+		return Object.values(node).some((child) => walk(child));
+	};
+	return walk(value);
+}
+const freshNoEchoValuesOf = /* @__PURE__ */ new WeakMap();
+function freshNoEchoSet(secrets) {
+	return sideSetOf(freshNoEchoValuesOf, secrets);
+}
+const containmentValuesOf = /* @__PURE__ */ new WeakMap();
+function sideSetOf(table, secrets) {
+	let set = table.get(secrets);
+	if (set === void 0) {
+		set = /* @__PURE__ */ new Set();
+		table.set(secrets, set);
+	}
+	return set;
+}
+function recordDerivedMaskOnlyValue(secrets, plaintext) {
+	recordMaskOnlyValue(secrets, plaintext);
+	if (isMaskOnlyPlaintext(secrets, plaintext)) sideSetOf(containmentValuesOf, secrets).add(plaintext);
+}
+function recordFreshNoEchoValuesIn(value, secrets, excluded, publicTokens) {
+	recordMaskOnlyValuesIn(value, secrets, excluded);
+	const fresh = freshNoEchoSet(secrets);
+	const containment = sideSetOf(containmentValuesOf, secrets);
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (node) => {
+		if (typeof node === "string") {
+			if (excluded?.has(node) !== true && isMaskOnlyPlaintext(secrets, node)) {
+				fresh.add(node);
+				if (publicTokens?.has(node) !== true) containment.add(node);
+			}
+			return;
+		}
+		if (node === null || typeof node !== "object") return;
+		if (seen.has(node)) return;
+		seen.add(node);
+		if (Array.isArray(node)) {
+			for (const item of node) walk(item);
+			return;
+		}
+		for (const child of Object.values(node)) walk(child);
+	};
+	walk(value);
+}
+const noEchoParameterValuesOf = /* @__PURE__ */ new WeakMap();
+function recordNoEchoParameterFreshValue(value, secrets, publicTokens) {
+	recordFreshNoEchoValuesIn(value, secrets, void 0, publicTokens);
+	const parameterClass = sideSetOf(noEchoParameterValuesOf, secrets);
+	const walk = (node) => {
+		if (typeof node === "string") {
+			if (isMaskOnlyPlaintext(secrets, node)) parameterClass.add(node);
+			return;
+		}
+		if (Array.isArray(node)) for (const item of node) walk(item);
+	};
+	walk(value);
+}
+function withoutNoEchoParameterEntries(secrets) {
+	const fresh = freshNoEchoValuesOf.get(secrets);
+	if (fresh === void 0 || fresh.size === 0) return secrets;
+	const copy = /* @__PURE__ */ new Map();
+	for (const [plaintext, expression] of secrets) {
+		if (expression === "***" && fresh.has(plaintext)) continue;
+		copy.set(plaintext, expression);
+	}
+	mergeResolvedPairs(secrets, copy);
+	carryMaskOnlyMarks(secrets, copy);
+	return copy;
+}
+function markNoEchoParameterClass(secrets, plaintext) {
+	if (isMaskOnlyPlaintext(secrets, plaintext)) sideSetOf(noEchoParameterValuesOf, secrets).add(plaintext);
+}
+function isNoEchoParameterPlaintext(secrets, plaintext) {
+	return noEchoParameterValuesOf.get(secrets)?.has(plaintext) === true && isMaskOnlyPlaintext(secrets, plaintext);
+}
+function noEchoParameterPlaintextsOf(secrets) {
+	return [...noEchoParameterValuesOf.get(secrets) ?? []].filter((plaintext) => isMaskOnlyPlaintext(secrets, plaintext));
+}
+function carryFreshNoEchoMark(from, to, plaintext) {
+	if (!isMaskOnlyPlaintext(to, plaintext)) return;
+	if (containmentValuesOf.get(from)?.has(plaintext) === true) sideSetOf(containmentValuesOf, to).add(plaintext);
+	if (freshNoEchoValuesOf.get(from)?.has(plaintext) === true) freshNoEchoSet(to).add(plaintext);
+	if (noEchoParameterValuesOf.get(from)?.has(plaintext) === true) sideSetOf(noEchoParameterValuesOf, to).add(plaintext);
+}
+function carryMaskOnlyMarks(from, to) {
+	for (const table of [
+		freshNoEchoValuesOf,
+		containmentValuesOf,
+		noEchoParameterValuesOf
+	]) {
+		const marks = table.get(from);
+		if (marks === void 0) continue;
+		for (const plaintext of marks) if (isMaskOnlyPlaintext(to, plaintext)) sideSetOf(table, to).add(plaintext);
+	}
+}
+function isKnownSecretExpression(expression, secretExpressions) {
+	return isSecretExpressionByVerdictOrSpelling(expression) || secretExpressions.has(expression);
+}
+function isSecretExpressionByVerdictOrSpelling(expression) {
+	return expression.startsWith("{{resolve:secretsmanager:") || expression.startsWith("{{resolve:ssm-secure:") || isRecordedSecretExpression(expression);
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/cross-stack.ts
+const crossStackAssociations = /* @__PURE__ */ new WeakMap();
+const CONFLICTING_CROSS_STACK = Symbol("conflicting cross-stack association");
+const CROSS_STACK_KEY_SEPARATOR = "\0";
+function literalStringOrUndefined(value) {
+	return typeof value === "string" && value !== "" ? value : void 0;
+}
+function splitGetAttStringForm(getAtt) {
+	const firstDot = getAtt.indexOf(".");
+	if (firstDot <= 0 || firstDot === getAtt.length - 1) return void 0;
+	return {
+		logicalId: getAtt.slice(0, firstDot),
+		attributeName: getAtt.slice(firstDot + 1)
+	};
+}
+function crossStackSourceKey(source) {
+	const keys = Object.keys(source);
+	if (keys.length !== 1) return void 0;
+	const key = keys[0];
+	if (key === "Fn::ImportValue") {
+		const exportName = literalStringOrUndefined(source[key]);
+		if (exportName === void 0) return void 0;
+		return ["Fn::ImportValue", exportName].join(CROSS_STACK_KEY_SEPARATOR);
+	}
+	if (key === "Fn::GetStackOutput") {
+		const args = source[key];
+		if (!isPlainObject(args)) return void 0;
+		const stackName = Object.hasOwn(args, "StackName") ? literalStringOrUndefined(args["StackName"]) : void 0;
+		const outputName = Object.hasOwn(args, "OutputName") ? literalStringOrUndefined(args["OutputName"]) : void 0;
+		if (stackName === void 0 || outputName === void 0) return void 0;
+		const slots = [
+			"Fn::GetStackOutput",
+			stackName,
+			outputName
+		];
+		for (const optional of ["Region", "RoleArn"]) {
+			const raw = Object.hasOwn(args, optional) ? args[optional] : void 0;
+			if (raw === void 0 || raw === null) {
+				slots.push("");
+				continue;
+			}
+			const literal = literalStringOrUndefined(raw);
+			if (literal === void 0) return void 0;
+			slots.push(literal);
+		}
+		return slots.join(CROSS_STACK_KEY_SEPARATOR);
+	}
+	if (key === "Fn::GetAtt") {
+		const raw = source[key];
+		let logicalId;
+		let attributeName;
+		if (typeof raw === "string") {
+			const split = splitGetAttStringForm(raw);
+			if (split === void 0) return void 0;
+			logicalId = split.logicalId;
+			attributeName = split.attributeName;
+		} else if (Array.isArray(raw) && raw.length === 2) {
+			logicalId = literalStringOrUndefined(raw[0]);
+			attributeName = literalStringOrUndefined(raw[1]);
+		}
+		if (logicalId === void 0 || attributeName === void 0) return void 0;
+		return [
+			"Fn::GetAtt",
+			logicalId,
+			attributeName
+		].join(CROSS_STACK_KEY_SEPARATOR);
+	}
+	if (key === "Fn::Sub") {
+		const raw = source[key];
+		let template;
+		let variables;
+		if (typeof raw === "string") template = raw;
+		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject(raw[1])) {
+			if (typeof raw[0] !== "string") return void 0;
+			template = raw[0];
+			variables = raw[1];
+		}
+		if (template === void 0) return void 0;
+		const only = /^\$\{(!)?([^}]*)\}$/.exec(template);
+		if (only === null || only[1] === "!") return void 0;
+		const varName = only[2] ?? "";
+		if (varName in (variables ?? {})) return void 0;
+		const split = splitGetAttStringForm(varName);
+		if (split === void 0) return void 0;
+		return [
+			"Fn::GetAtt",
+			split.logicalId,
+			split.attributeName
+		].join(CROSS_STACK_KEY_SEPARATOR);
+	}
+	if (key === "Ref") {
+		const parameterName = literalStringOrUndefined(source[key]);
+		if (parameterName === void 0) return void 0;
+		return ["Ref", parameterName].join(CROSS_STACK_KEY_SEPARATOR);
+	}
+}
+function recordCrossStackExpression(secrets, key, expression, plaintext) {
+	if (!isSingleDynamicReferenceToken(expression)) return;
+	let associations = crossStackAssociations.get(secrets);
+	if (associations === void 0) {
+		associations = /* @__PURE__ */ new Map();
+		crossStackAssociations.set(secrets, associations);
+	}
+	storeAssociation(associations, key, expression, plaintext);
+}
+function storeAssociation(associations, key, expression, plaintext) {
+	const seen = associations.get(key);
+	if (seen === void 0) {
+		associations.set(key, {
+			expression,
+			plaintext
+		});
+		return;
+	}
+	if (typeof seen === "symbol") return;
+	if (seen.expression !== expression || seen.plaintext !== plaintext) associations.set(key, CONFLICTING_CROSS_STACK);
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/certified-positions.ts
+function plaintextIndexOf(secrets) {
+	const plaintextOf = /* @__PURE__ */ new Map();
+	for (const [plaintext, expression] of secrets) plaintextOf.set(expression, plaintextOf.has(expression) ? CONFLICTING_PLAINTEXT : plaintext);
+	return plaintextOf;
+}
+function certifiedExpressionForLeaf(secrets, association, leaf) {
+	if (typeof leaf !== "string" || leaf === "") return void 0;
+	if (!secrets.has(leaf)) return void 0;
+	if (association.plaintext !== leaf) return void 0;
+	const recordedPlaintext = plaintextIndexOf(secrets).get(association.expression);
+	if (recordedPlaintext !== void 0 && recordedPlaintext !== leaf) return void 0;
+	return association.expression;
+}
+function certifiedListForLeaf(secrets, association, bag) {
+	const certified = bag.map((element) => certifiedExpressionForLeaf(secrets, association, element));
+	if (certified.every((expression) => expression === void 0)) return void 0;
+	return bag.map((element, i) => certified[i] ?? redactForState(element, {
+		provenance: "value-scan",
+		secrets
+	}));
+}
+function associationForSource(source, secrets) {
+	const key = crossStackSourceKey(source);
+	if (key === void 0) return void 0;
+	const associations = crossStackAssociations.get(secrets);
+	if (associations === void 0) return void 0;
+	const association = associations.get(key);
+	if (association === void 0 || typeof association === "symbol") return void 0;
+	return association;
+}
+function positionByCrossStackSource(bag, source, secrets) {
+	const association = associationForSource(source, secrets);
+	if (association === void 0) return void 0;
+	return certifiedExpressionForLeaf(secrets, association, bag);
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/resolver-outcomes.ts
+const CONFLICTING = Symbol("cdkd.resolver-outcome.conflicting");
+const takenBranches = /* @__PURE__ */ new WeakMap();
+function recordTakenIfBranch(secrets, source, tookTrueBranch) {
+	let taken = takenBranches.get(secrets);
+	if (taken === void 0) {
+		taken = /* @__PURE__ */ new WeakMap();
+		takenBranches.set(secrets, taken);
+	}
+	const previous = taken.get(source);
+	if (previous === void 0) taken.set(source, tookTrueBranch);
+	else if (previous !== tookTrueBranch) taken.set(source, CONFLICTING);
+}
+function takenIfBranchOf(secrets, source) {
+	const taken = takenBranches.get(secrets)?.get(source);
+	return taken === CONFLICTING ? void 0 : taken;
+}
+const droppedElements = /* @__PURE__ */ new WeakMap();
+function recordDroppedArrayElements(secrets, source, dropped) {
+	let arrays = droppedElements.get(secrets);
+	if (arrays === void 0) {
+		arrays = /* @__PURE__ */ new WeakMap();
+		droppedElements.set(secrets, arrays);
+	}
+	const previous = arrays.get(source);
+	if (previous === void 0) arrays.set(source, [...dropped]);
+	else if (previous !== CONFLICTING && (previous.length !== dropped.length || previous.some((index, i) => index !== dropped[i]))) arrays.set(source, CONFLICTING);
+}
+function droppedArrayElementsOf(secrets, source) {
+	const dropped = droppedElements.get(secrets)?.get(source);
+	return dropped === CONFLICTING ? void 0 : dropped;
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/physical-name-copies.ts
+const physicalNameCopiesOf = /* @__PURE__ */ new WeakMap();
+function recordPhysicalNameCopy(secrets, physicalId) {
+	if (physicalId === "") return;
+	sideSetOf(physicalNameCopiesOf, secrets).add(physicalId);
+}
+const attributeIdCopiesOf = /* @__PURE__ */ new WeakMap();
+function recordAttributeIdCopy(secrets, physicalId) {
+	if (physicalId === "") return;
+	sideSetOf(attributeIdCopiesOf, secrets).add(physicalId);
+}
+function physicalNameSpans(names, value) {
+	const spans = [];
+	if (names === void 0) return spans;
+	for (const name of names) for (let at = value.indexOf(name); at !== -1; at = value.indexOf(name, at + 1)) spans.push({
+		start: at,
+		end: at + name.length
+	});
+	return spans;
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/fresh-noecho.ts
+function embedsFreshNoEchoValue(text, secrets, freshClass) {
+	const fresh = freshNoEchoValuesOf.get(secrets);
+	if (fresh === void 0) return false;
+	for (const value of fresh) {
+		if (freshClass !== void 0 && isNoEchoParameterPlaintext(secrets, value) !== (freshClass === "parameter")) continue;
+		if (isMaskOnlyPlaintext(secrets, value) && text.includes(value)) return true;
+	}
+	return false;
+}
+function carriesFreshNoEchoValue(value, secrets, freshClass) {
+	const isFresh = freshNoEchoLeafTest(secrets, freshClass);
+	if (isFresh === void 0) return false;
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (node) => {
+		if (typeof node === "string") return isFresh(node);
+		if (node === null || typeof node !== "object") return false;
+		if (seen.has(node)) return false;
+		seen.add(node);
+		if (Array.isArray(node)) return node.some((item) => walk(item));
+		return Object.values(node).some((child) => walk(child));
+	};
+	return walk(value);
+}
+function freshNoEchoLeafPositions(value, secrets, freshClass) {
+	const isFresh = freshNoEchoLeafTest(secrets, freshClass);
+	if (isFresh === void 0) return [];
+	const leaves = [];
+	const ancestors = /* @__PURE__ */ new Set();
+	const walk = (node, path) => {
+		if (typeof node === "string") {
+			if (isFresh(node)) leaves.push({
+				path,
+				plaintext: node
+			});
+			return;
+		}
+		if (node === null || typeof node !== "object") return;
+		if (ancestors.has(node)) return;
+		ancestors.add(node);
+		if (Array.isArray(node)) node.forEach((item, index) => walk(item, [...path, index]));
+		else for (const [key, child] of Object.entries(node)) walk(child, [...path, key]);
+		ancestors.delete(node);
+	};
+	walk(value, []);
+	return leaves;
+}
+function freshNoEchoLeafTest(secrets, freshClass) {
+	const all = freshNoEchoValuesOf.get(secrets);
+	if (all === void 0 || all.size === 0) return void 0;
+	const fresh = freshClass === void 0 ? all : new Set([...all].filter((value) => isNoEchoParameterPlaintext(secrets, value) === (freshClass === "parameter")));
+	if (fresh.size === 0) return void 0;
+	const needles = containmentNeedlesOf(secrets).filter((needle) => fresh.has(needle));
+	return (leaf) => fresh.has(leaf) && isMaskOnlyPlaintext(secrets, leaf) || leaf !== "***" && embedsNeedleOutsideReferences(leaf, needles, secrets);
+}
+function containmentNeedlesOf(secrets) {
+	const values = containmentValuesOf.get(secrets);
+	if (values === void 0 || values.size === 0) return [];
+	const needles = [];
+	for (const value of values) if (value.length >= 4 && isMaskOnlyPlaintext(secrets, value)) needles.push(value);
+	return needles;
+}
+function isStrictlyInsideASpan(spans, start, end) {
+	return spans.some((span) => span.start <= start && end <= span.end && (span.start !== start || span.end !== end));
+}
+function embedsNeedleOutsideReferences(leaf, needles, secrets) {
+	return needleOccurrencesOutsideReferences(leaf, needles, secrets, true).length > 0;
+}
+function needleOccurrencesOutsideReferences(leaf, needles, secrets, first) {
+	const found = [];
+	let spans;
+	let names;
+	for (const needle of needles) for (let at = leaf.indexOf(needle); at >= 0; at = leaf.indexOf(needle, at + 1)) {
+		spans ??= isDynamicReferenceString(leaf) ? resolvableReferenceSpans(leaf, new Set(secrets.values())) : [];
+		if (isStrictlyInsideASpan(spans, at, at + needle.length)) continue;
+		names ??= physicalNameSpans(physicalNameCopiesOf.get(secrets), leaf);
+		const end = at + needle.length;
+		if (names.some((n) => n.start <= at && end <= n.end)) continue;
+		found.push({
+			start: at,
+			end
+		});
+		if (first) return found;
+	}
+	return found;
+}
+function cutsContainmentNeedle(leaf, secrets, redacted) {
+	if (redacted.length === 0) return false;
+	const needles = containmentNeedlesOf(secrets);
+	if (needles.length === 0) return false;
+	return needleOccurrencesOutsideReferences(leaf, needles, secrets, false).some((c) => redacted.some((m) => m.start < c.end && c.start < m.end && !(m.start <= c.start && c.end <= m.end)));
+}
+function flattenEmbeddedNoEchoLeaves(value, secrets) {
+	const needles = containmentNeedlesOf(secrets);
+	if (needles.length === 0) return value;
+	const flattens = (leaf) => leaf !== "***" && embedsNeedleOutsideReferences(leaf, needles, secrets);
+	const walk = (node) => {
+		if (typeof node === "string") return flattens(node) ? "***" : node;
+		if (node === null || typeof node !== "object") return node;
+		if (Array.isArray(node)) {
+			let changed = false;
+			const out = node.map((item) => {
+				const next = walk(item);
+				if (next !== item) changed = true;
+				return next;
+			});
+			return changed ? out : node;
+		}
+		if (isOrdinaryDate(node)) {
+			const persisted = node.toJSON();
+			return typeof persisted === "string" && flattens(persisted) ? "***" : node;
+		}
+		let out;
+		for (const [key, child] of Object.entries(node)) {
+			const next = walk(child);
+			if (next === child) continue;
+			out ??= Object.assign(Object.create(null), node);
+			out[key] = next;
+		}
+		return out ?? node;
+	};
+	return walk(value);
+}
+function substringNeedlesOf(secrets) {
+	const needles = [];
+	for (const plaintext of secrets.keys()) if (!isMaskOnlyPlaintext(secrets, plaintext)) needles.push(plaintext);
+	return needles;
+}
+function recordedExpressionsOf(secrets) {
+	const expressions = /* @__PURE__ */ new Set();
+	for (const [plaintext, expression] of secrets) if (!isMaskOnlyPlaintext(secrets, plaintext)) expressions.add(expression);
+	return expressions;
+}
+const recoverableMaskedOutputs = /* @__PURE__ */ new Map();
+function maskedOutputKey(identity, stackName, region, outputKey) {
+	return `${identity}\u0000${stackName}\u0000${region}\u0000${outputKey}`;
+}
+function recordRecoverableMaskedOutput(identity, stackName, region, outputKey, plaintext) {
+	recoverableMaskedOutputs.set(maskedOutputKey(identity, stackName, region, outputKey), plaintext);
+}
+function recoverMaskedOutput(identity, stackName, region, outputKey) {
+	return recoverableMaskedOutputs.get(maskedOutputKey(identity, stackName, region, outputKey));
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/nested-stack.ts
+const NESTED_STACK_RESOURCE_TYPE = "AWS::CloudFormation::Stack";
+const nestedStackParameterExpressions = /* @__PURE__ */ new WeakMap();
+const renderedParameterSpellings = /* @__PURE__ */ new WeakMap();
+const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
+function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, provenance = "template-derived") {
+	if (resourceType !== NESTED_STACK_RESOURCE_TYPE) return;
+	if (secrets.size === 0) return;
+	if (!isPlainObject(resolvedProperties) || !isPlainObject(sourceProperties)) return;
+	if (!Object.hasOwn(resolvedProperties, "Parameters")) return;
+	if (!Object.hasOwn(sourceProperties, "Parameters")) return;
+	const resolvedParameters = resolvedProperties["Parameters"];
+	const sourceParameters = sourceProperties["Parameters"];
+	if (!isPlainObject(resolvedParameters) || !isPlainObject(sourceParameters)) return;
+	const positioned = redactAtProvenance({ ...resolvedParameters }, secrets, sourceParameters, provenance, true);
+	let table = nestedStackParameterExpressions.get(secrets);
+	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
+		const sourceLeaf = sourceParameters[name];
+		if (typeof resolvedValue !== "string" || typeof sourceLeaf !== "string") continue;
+		if (isSingleDynamicReferenceToken(sourceLeaf) || positioned[name] !== sourceLeaf) continue;
+		if (!rendersLiteralTo(sourceLeaf, secrets, resolvedValue)) continue;
+		let rendered = renderedParameterSpellings.get(secrets);
+		if (rendered === void 0) {
+			rendered = /* @__PURE__ */ new Map();
+			renderedParameterSpellings.set(secrets, rendered);
+		}
+		const previous = rendered.get(name);
+		if (previous === void 0) rendered.set(name, {
+			spelling: sourceLeaf,
+			value: resolvedValue
+		});
+		else if (previous?.spelling !== sourceLeaf || previous.value !== resolvedValue) rendered.set(name, null);
+	}
+	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
+		if (typeof resolvedValue !== "string" || !secrets.has(resolvedValue)) continue;
+		const expression = positioned[name];
+		if (typeof expression !== "string") continue;
+		if (!isSingleDynamicReferenceToken(expression)) continue;
+		const sourceLeaf = sourceParameters[name];
+		if (typeof sourceLeaf === "string" && expression !== sourceLeaf) continue;
+		if (expression === resolvedValue) continue;
+		const seenResolvingTo = plaintextIndexOf(secrets).get(expression);
+		if (seenResolvingTo !== void 0 && seenResolvingTo !== resolvedValue) continue;
+		if (typeof sourceLeaf === "string" && resolvedPlaintextOf(secrets, expression) !== resolvedValue) continue;
+		if (table === void 0) {
+			table = /* @__PURE__ */ new Map();
+			nestedStackParameterExpressions.set(secrets, table);
+		}
+		storeAssociation(table, name, expression, resolvedValue);
+	}
+	const framesByValue = /* @__PURE__ */ new Map();
+	const tokensOf = /* @__PURE__ */ new Map();
+	const frameSpellings = /* @__PURE__ */ new Map();
+	const frameSpellingOf = (name) => {
+		if (!frameSpellings.has(name)) frameSpellings.set(name, computeFrameSpelling(name));
+		return frameSpellings.get(name);
+	};
+	const computeFrameSpelling = (name) => {
+		const resolvedValue = resolvedParameters[name];
+		if (typeof resolvedValue !== "string") return void 0;
+		const sourceLeaf = sourceParameters[name];
+		if (typeof sourceLeaf === "string") return sourceLeaf;
+		if (!isPlainObject(sourceLeaf)) return void 0;
+		const written = positioned[name];
+		if (typeof written !== "string") return void 0;
+		const rendered = intrinsicSkeletonSegments(sourceLeaf)?.map((s) => s === UNKNOWN_PART ? "\0" : s).join("");
+		const spans = rendered === void 0 ? [] : dynamicReferenceSpans(rendered);
+		if (rendered !== void 0 && spans.length === 1) {
+			const [span] = spans;
+			const ownToken = rendered.slice(span.start, span.end);
+			if (written !== resolvedValue && SPELLED_SECRET_REFERENCE_PREFIXES.some((prefix) => ownToken.startsWith(prefix))) return written;
+		}
+		const substituted = substitutedSpellingOf(secrets, sourceLeaf, resolvedValue);
+		if (substituted === void 0) return void 0;
+		return written === resolvedValue || written === substituted ? substituted : void 0;
+	};
+	const certifiedSpellingOf = (name) => {
+		const sourceLeaf = sourceParameters[name];
+		if (typeof sourceLeaf === "string") return positioned[name] === sourceLeaf ? sourceLeaf : void 0;
+		return frameSpellingOf(name);
+	};
+	const unwrittenValues = /* @__PURE__ */ new Set();
+	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
+		if (typeof resolvedValue !== "string") continue;
+		const spelling = frameSpellingOf(name);
+		const frame = spelling === void 0 ? void 0 : singleSpanFrame(resolvedValue, spelling);
+		const frames = framesByValue.get(resolvedValue) ?? /* @__PURE__ */ new Set();
+		const unframed = frame === void 0 || resolvedPlaintextOf(secrets, frame.token) !== frame.middle;
+		frames.add(unframed ? UNFRAMED_SPELLING : `${frame.prefix.length}:${frame.prefix}${frame.suffix}`);
+		framesByValue.set(resolvedValue, frames);
+		if (!unframed) {
+			const tokens = tokensOf.get(resolvedValue) ?? /* @__PURE__ */ new Set();
+			tokens.add(frame.token);
+			tokensOf.set(resolvedValue, tokens);
+			if (typeof sourceParameters[name] !== "string" && positioned[name] !== spelling) unwrittenValues.add(resolvedValue);
+		}
+	}
+	for (const value of unwrittenValues) if (tokensOf.get(value)?.size !== 1) framesByValue.get(value)?.add(UNFRAMED_SPELLING);
+	const rowWithoutParameters = {};
+	for (const [key, value] of Object.entries(resolvedProperties)) if (key !== "Parameters") rowWithoutParameters[key] = value;
+	const outsideLeaves = wholeStringLeavesOf(rowWithoutParameters);
+	const framed = /* @__PURE__ */ new Map();
+	const framedByName = [];
+	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
+		if (typeof resolvedValue !== "string") continue;
+		const spelling = certifiedSpellingOf(name);
+		if (spelling === void 0) continue;
+		if (redactForState(resolvedValue, {
+			provenance: "value-scan",
+			secrets
+		}) !== resolvedValue) continue;
+		const frame = singleSpanFrame(resolvedValue, spelling);
+		if (frame === void 0 || resolvedPlaintextOf(secrets, frame.token) !== frame.middle) continue;
+		if (framesByValue.get(resolvedValue)?.size !== 1) continue;
+		const isNeedle = resolvedValue.length >= 4;
+		const rewrites = (leaf) => leaf === resolvedValue || isNeedle && leaf.includes(resolvedValue);
+		let embedded = false;
+		for (const leaf of outsideLeaves) if (rewrites(leaf)) {
+			embedded = true;
+			break;
+		}
+		for (const other of Object.values(resolvedParameters)) {
+			if (embedded) break;
+			if (typeof other === "string") {
+				if (other !== resolvedValue && rewrites(other)) embedded = true;
+				continue;
+			}
+			for (const leaf of wholeStringLeavesOf(other)) if (rewrites(leaf)) {
+				embedded = true;
+				break;
+			}
+		}
+		if (embedded) continue;
+		framedByName.push([
+			name,
+			spelling,
+			resolvedValue
+		]);
+		if (secrets.get(frame.middle) !== frame.token && tokensOf.get(resolvedValue)?.size !== 1) continue;
+		framed.set(resolvedValue, spelling);
+	}
+	for (const [plaintext, expression] of framed) secrets.set(plaintext, expression);
+	for (const [name, expression, plaintext] of framedByName) {
+		if (table === void 0) {
+			table = /* @__PURE__ */ new Map();
+			nestedStackParameterExpressions.set(secrets, table);
+		}
+		storeAssociation(table, name, expression, plaintext);
+	}
+}
+function inheritNestedStackParameterAssociations(childSecrets, parentSecrets) {
+	const table = nestedStackParameterExpressions.get(parentSecrets);
+	if (table === void 0 || table.size === 0) return;
+	let associations = crossStackAssociations.get(childSecrets);
+	for (const [name, association] of table) {
+		const key = crossStackSourceKey({ Ref: name });
+		if (key === void 0) continue;
+		if (associations === void 0) {
+			associations = /* @__PURE__ */ new Map();
+			crossStackAssociations.set(childSecrets, associations);
+		}
+		if (typeof association === "symbol") {
+			associations.set(key, association);
+			continue;
+		}
+		storeAssociation(associations, key, association.expression, association.plaintext);
+	}
+}
+function inheritedParameterExpression(parentSecrets, parameterName, resolvedValue) {
+	const association = nestedStackParameterExpressions.get(parentSecrets)?.get(parameterName);
+	if (association === void 0) return renderedParameterSpelling(parentSecrets, parameterName, resolvedValue);
+	if (typeof association === "symbol") return void 0;
+	if (Array.isArray(resolvedValue)) return certifiedListForLeaf(parentSecrets, association, resolvedValue);
+	return certifiedExpressionForLeaf(parentSecrets, association, resolvedValue);
+}
+function renderedParameterSpelling(parentSecrets, parameterName, resolvedValue) {
+	if (typeof resolvedValue !== "string" || parentSecrets.has(resolvedValue)) return void 0;
+	const rendered = renderedParameterSpellings.get(parentSecrets)?.get(parameterName);
+	if (rendered == null || rendered.value !== resolvedValue) return void 0;
+	if (!rendersLiteralTo(rendered.spelling, parentSecrets, resolvedValue)) return void 0;
+	return rendered.spelling;
+}
+function inheritedRenderedToken(parentSecrets, parameterName, value, plaintext) {
+	const spelling = inheritedParameterExpression(parentSecrets, parameterName, value);
+	if (typeof spelling !== "string" || isSingleDynamicReferenceToken(spelling)) return void 0;
+	return renderedTokenOf(spelling, parentSecrets, plaintext);
+}
+function withdrawRenderedParameterSpelling(parentSecrets, parameterName) {
+	const rendered = renderedParameterSpellings.get(parentSecrets);
+	if (rendered?.has(parameterName)) rendered.set(parameterName, null);
+}
+function inheritedRenderedSpan(childSecrets, key, text) {
+	const reads = inheritedParameterReads.get(childSecrets);
+	if (reads === void 0 || typeof reads === "symbol") return void 0;
+	for (const name of reads.names) {
+		if (crossStackSourceKey({ Ref: name }) !== key) continue;
+		const value = renderedParameterSpellings.get(reads.parent)?.get(name)?.value;
+		if (value === void 0 || text !== void 0 && text !== value) return void 0;
+		if (carriesChildOnlyPlaintext(value, childSecrets, reads.parent)) return void 0;
+		const spelling = inheritedParameterExpression(reads.parent, name, value);
+		if (typeof spelling !== "string") return void 0;
+		if (redactForState(spelling, {
+			provenance: "value-scan",
+			secrets: childSecrets
+		}) !== spelling) return void 0;
+		return {
+			value,
+			spelling
+		};
+	}
+}
+const inheritedParameterReads = /* @__PURE__ */ new WeakMap();
+const POISONED_PARAMETER_READS = Symbol("cdkd.inherited-parameter-reads.poisoned");
+function parameterReadsFor(childSecrets, parentSecrets) {
+	const reads = inheritedParameterReads.get(childSecrets);
+	if (reads === void 0) {
+		const created = {
+			parent: parentSecrets,
+			names: /* @__PURE__ */ new Set(),
+			values: /* @__PURE__ */ new Map()
+		};
+		inheritedParameterReads.set(childSecrets, created);
+		return created;
+	}
+	if (typeof reads === "symbol") return void 0;
+	if (reads.parent !== parentSecrets) {
+		inheritedParameterReads.set(childSecrets, POISONED_PARAMETER_READS);
+		return;
+	}
+	return reads;
+}
+function recordInheritedParameterValue(childSecrets, parentSecrets, parameterName, value, declared) {
+	const reads = parameterReadsFor(childSecrets, parentSecrets);
+	if (reads === void 0) return;
+	if (declared !== void 0) {
+		if (reads.declared === void 0) reads.declared = declared;
+		else if (reads.declared.size !== declared.size || [...declared].some((name) => !reads.declared.has(name))) {
+			inheritedParameterReads.set(childSecrets, POISONED_PARAMETER_READS);
+			return;
+		}
+	}
+	if (reads.values.has(parameterName)) {
+		if (!deepEqualJsonValue(reads.values.get(parameterName), value)) inheritedParameterReads.set(childSecrets, POISONED_PARAMETER_READS);
+		return;
+	}
+	reads.values.set(parameterName, value);
+}
+function recordInheritedParameterRead(childSecrets, parentSecrets, parameterName) {
+	parameterReadsFor(childSecrets, parentSecrets)?.names.add(parameterName);
+}
+function redactInheritedParameterValue(parentSecrets, parameterName, value) {
+	return inheritedParameterExpression(parentSecrets, parameterName, value) ?? redactForState(value, {
+		provenance: "value-scan",
+		secrets: parentSecrets
+	});
+}
+function positionByInheritedParameter(bag, source, secrets) {
+	const keys = Object.keys(source);
+	if (keys.length !== 1 || keys[0] !== "Ref") return void 0;
+	const name = source["Ref"];
+	if (typeof name !== "string") return void 0;
+	const reads = inheritedParameterReads.get(secrets);
+	if (reads === void 0 || typeof reads === "symbol" || !reads.names.has(name)) return;
+	if (typeof bag !== "string" && !Array.isArray(bag)) return void 0;
+	if (carriesChildOnlyPlaintext(bag, secrets, reads.parent)) return void 0;
+	const answer = redactInheritedParameterValue(reads.parent, name, bag);
+	if (!deepEqualJsonValue(redactForState(answer, {
+		provenance: "value-scan",
+		secrets
+	}), answer)) return void 0;
+	return answer;
+}
+const REREAD_PSEUDO_PARAMETERS = /* @__PURE__ */ new Set([
+	"AWS::Region",
+	"AWS::Partition",
+	"AWS::URLSuffix",
+	"AWS::AccountId"
+]);
+function templateRereadsAccountId(template) {
+	if (template === void 0) return false;
+	const resources = template.Resources !== null && typeof template.Resources === "object" ? template.Resources : void 0;
+	const cached = resources && accountRereadVerdicts.get(resources);
+	if (cached !== void 0 && cached.outputs === template.Outputs) return cached.verdict;
+	const parts = resources ? Object.values(resources) : [];
+	if (template.Outputs !== void 0) parts.push(template.Outputs);
+	const verdict = parts.some(partRereadsAccountId);
+	if (resources) accountRereadVerdicts.set(resources, {
+		outputs: template.Outputs,
+		verdict
+	});
+	return verdict;
+}
+const accountRereadVerdicts = /* @__PURE__ */ new WeakMap();
+function partRereadsAccountId(part) {
+	let trigger = false;
+	let account = false;
+	const pending = [part];
+	while (pending.length > 0 && !(trigger && account)) {
+		const node = pending.pop();
+		if (Array.isArray(node)) {
+			pending.push(...node);
+			continue;
+		}
+		if (node === null || typeof node !== "object") continue;
+		for (const [key, value] of Object.entries(node)) {
+			if (REREAD_TRIGGERS.has(key)) trigger = true;
+			if (key === "Ref" && value === "AWS::AccountId") account = true;
+			if (key === "Fn::Sub") {
+				const text = Array.isArray(value) ? value[0] : value;
+				if (typeof text === "string" && text.includes("${AWS::AccountId}")) account = true;
+			}
+			pending.push(value);
+		}
+	}
+	return trigger && account;
+}
+const inheritedPseudoParameters = /* @__PURE__ */ new WeakMap();
+const POISONED_PSEUDO_PARAMETERS = Symbol("cdkd.inherited-pseudo-parameters.poisoned");
+function recordInheritedPseudoParameters(inheritedSecrets, values) {
+	let table = inheritedPseudoParameters.get(inheritedSecrets);
+	if (table === POISONED_PSEUDO_PARAMETERS) return;
+	if (table === void 0) {
+		table = /* @__PURE__ */ new Map();
+		inheritedPseudoParameters.set(inheritedSecrets, table);
+	}
+	for (const [name, value] of values) {
+		if (!REREAD_PSEUDO_PARAMETERS.has(name) || typeof value !== "string") continue;
+		const known = table.get(name);
+		if (known !== void 0 && known !== value) {
+			inheritedPseudoParameters.set(inheritedSecrets, POISONED_PSEUDO_PARAMETERS);
+			return;
+		}
+		table.set(name, value);
+	}
+}
+function pseudoBindingOf(parentSecrets) {
+	const table = inheritedPseudoParameters.get(parentSecrets);
+	return (name) => table instanceof Map && table.has(name) ? { value: table.get(name) } : void 0;
+}
+function inheritedPseudoValue(parentSecrets, name) {
+	const bound = pseudoBindingOf(parentSecrets)(name)?.value;
+	return typeof bound === "string" ? bound : void 0;
+}
+function inheritedPseudoSpan(childSecrets, key) {
+	const reads = inheritedParameterReads.get(childSecrets);
+	if (reads === void 0 || typeof reads === "symbol") return void 0;
+	for (const name of REREAD_PSEUDO_PARAMETERS) if (crossStackSourceKey({ Ref: name }) === key) return inheritedPseudoValue(reads.parent, name);
+}
+const REREAD_TRIGGERS = /* @__PURE__ */ new Set([
+	"Fn::Select",
+	"Fn::Split",
+	"Fn::If"
+]);
+const MAX_REREAD_DEPTH = 16;
+const MAX_REREAD_CONDITIONS = 4;
+const REREAD_NO_VALUE = Symbol("cdkd.reread.no-value");
+function splitOutsideDynamicReferences(text, delimiter, standsForSecret) {
+	if (delimiter === "") return text.split(delimiter);
+	const spans = dynamicReferenceSpans(text).filter((span) => {
+		const token = text.slice(span.start, span.end);
+		return spanNamesResolvableService(token) && standsForSecret(token);
+	});
+	if (spans.length === 0) return text.split(delimiter);
+	const pieces = [];
+	let cursor = 0;
+	let from = 0;
+	for (;;) {
+		const at = text.indexOf(delimiter, from);
+		if (at === -1) break;
+		const end = at + delimiter.length;
+		const token = spans.find((span) => span.start < end && at < span.end);
+		if (token !== void 0) {
+			from = token.end;
+			continue;
+		}
+		pieces.push(text.slice(cursor, at));
+		cursor = end;
+		from = end;
+	}
+	pieces.push(text.slice(cursor));
+	return pieces;
+}
+function standsForInheritedSecret(parentSecrets, token) {
+	return parentSecrets !== void 0 && resolvedPlaintextOf(parentSecrets, token) !== void 0;
+}
+const plainSplit = (text, delimiter) => text.split(delimiter);
+function evaluatePureRead(node, bind, pseudo, split, choose, depth = 0) {
+	if (depth > MAX_REREAD_DEPTH) return void 0;
+	const evaluate = (child) => evaluatePureRead(child, bind, pseudo, split, choose, depth + 1);
+	if (typeof node === "string") return node.includes("{{resolve:") ? void 0 : { value: node };
+	if (Array.isArray(node)) {
+		const out = [];
+		for (const element of node) {
+			const evaluated = evaluate(element);
+			if (evaluated === void 0 || evaluated.value === REREAD_NO_VALUE) return void 0;
+			out.push(evaluated.value);
+		}
+		return { value: out };
+	}
+	if (!isPlainObject(node)) return void 0;
+	const keys = Object.keys(node);
+	if (keys.length !== 1) return void 0;
+	const key = keys[0];
+	const args = node[key];
+	if (key === "Ref") {
+		if (args === "AWS::NoValue") return { value: REREAD_NO_VALUE };
+		return typeof args === "string" ? bindReadName(args, bind, pseudo) : void 0;
+	}
+	if (key === "Fn::If") {
+		if (!Array.isArray(args) || args.length !== 3 || typeof args[0] !== "string") return void 0;
+		const tookTrue = choose(args[0], node);
+		if (tookTrue === void 0) return void 0;
+		return evaluate(tookTrue ? args[1] : args[2]);
+	}
+	if (key === "Fn::Sub") return evaluatePureSub(args, bind, pseudo, evaluate);
+	if (!Array.isArray(args) || args.length !== 2) return void 0;
+	if (key === "Fn::Select") {
+		const index = args[0];
+		const position = typeof index === "number" ? index : typeof index === "string" && /^(0|[1-9][0-9]*)$/.test(index) ? Number(index) : void 0;
+		if (position === void 0 || !Number.isSafeInteger(position) || position < 0) return void 0;
+		const list = evaluate(args[1]);
+		if (list === void 0 || !Array.isArray(list.value) || position >= list.value.length) return;
+		return { value: list.value[position] };
+	}
+	const delimiter = args[0];
+	if (typeof delimiter !== "string") return void 0;
+	if (key === "Fn::Split") {
+		const value = evaluate(args[1]);
+		if (value === void 0 || typeof value.value !== "string") return void 0;
+		return { value: split(value.value, delimiter) };
+	}
+	if (key === "Fn::Join") {
+		const parts = evaluate(args[1]);
+		if (parts === void 0 || !Array.isArray(parts.value)) return void 0;
+		if (!parts.value.every((part) => typeof part === "string")) return void 0;
+		return { value: parts.value.join(delimiter) };
+	}
+}
+function evaluatePureSub(args, bind, pseudo, evaluate) {
+	const [text, variables] = typeof args === "string" ? [args, {}] : Array.isArray(args) && args.length === 2 ? [args[0], args[1]] : [void 0, void 0];
+	if (typeof text !== "string" || text.includes("{{resolve:") || !isPlainObject(variables)) return;
+	const bound = /* @__PURE__ */ new Map();
+	for (const [name, variable] of Object.entries(variables)) {
+		const evaluated = evaluate(variable);
+		if (evaluated === void 0 || typeof evaluated.value !== "string") return void 0;
+		bound.set(name, evaluated.value);
+	}
+	let out = "";
+	let cursor = 0;
+	for (const match of text.matchAll(/\$\{(!)?([^}]*)\}/g)) {
+		const name = match[2] ?? "";
+		let replacement;
+		if (match[1] === "!") replacement = `\${${name}}`;
+		else if (name === "") replacement = match[0];
+		else if (bound.has(name)) replacement = bound.get(name);
+		else {
+			if (name.includes(".")) return void 0;
+			const value = bindReadName(name, bind, pseudo);
+			if (value === void 0 || typeof value.value !== "string") return void 0;
+			replacement = value.value;
+		}
+		out += text.slice(cursor, match.index) + replacement;
+		cursor = match.index + match[0].length;
+	}
+	return { value: out + text.slice(cursor) };
+}
+function bindReadName(name, bind, pseudo) {
+	if (!name.startsWith("AWS::")) return bind(name);
+	return bind(name) === void 0 ? pseudo(name) : void 0;
+}
+function collectRereadConditions(node, names, depth = 0) {
+	if (depth > MAX_REREAD_DEPTH) return false;
+	if (Array.isArray(node)) return node.every((element) => collectRereadConditions(element, names, depth + 1));
+	if (!isPlainObject(node)) return true;
+	if (Object.hasOwn(node, "Fn::If")) {
+		const args = node["Fn::If"];
+		if (!Array.isArray(args) || typeof args[0] !== "string") return false;
+		names.add(args[0]);
+	}
+	return Object.values(node).every((child) => collectRereadConditions(child, names, depth + 1));
+}
+function holdsRereadTrigger(node, depth = 0) {
+	if (depth > MAX_REREAD_DEPTH) return false;
+	if (Array.isArray(node)) return node.some((element) => holdsRereadTrigger(element, depth + 1));
+	if (!isPlainObject(node)) return false;
+	return Object.entries(node).some(([key, child]) => REREAD_TRIGGERS.has(key) || holdsRereadTrigger(child, depth + 1));
+}
+function rendersReadTo(spelling, parentSecrets, value) {
+	if (typeof spelling === "string" && typeof value === "string") {
+		if (spelling === value) return redactForState(spelling, {
+			provenance: "value-scan",
+			secrets: parentSecrets
+		}) === spelling;
+		return rendersLiteralTo(spelling, parentSecrets, value);
+	}
+	if (Array.isArray(spelling) && Array.isArray(value) && spelling.length === value.length) return spelling.every((element, i) => rendersReadTo(element, parentSecrets, value[i]));
+	return false;
+}
+const REREAD_UNBOUND = Symbol("cdkd.reread.unbound");
+const REREAD_PARAMETER_FREE = Symbol("cdkd.reread.parameter-free");
+function diffSideReading(bind, parentSecrets) {
+	return {
+		bind: (name) => {
+			const bound = bind(name);
+			return bound && { value: redactInheritedParameterValue(parentSecrets, name, bound.value) };
+		},
+		split: (text, delimiter) => splitOutsideDynamicReferences(text, delimiter, (token) => standsForInheritedSecret(parentSecrets, token))
+	};
+}
+function rereadUnder(source, bind, parentSecrets, choose) {
+	const pseudo = pseudoBindingOf(parentSecrets);
+	const resolved = evaluatePureRead(source, bind, pseudo, plainSplit, choose);
+	if (resolved === void 0) return void 0;
+	const diffSide = diffSideReading(bind, parentSecrets);
+	const redacted = evaluatePureRead(source, diffSide.bind, pseudo, diffSide.split, choose);
+	if (redacted === void 0) return void 0;
+	if (resolved.value === REREAD_NO_VALUE || redacted.value === REREAD_NO_VALUE) return resolved.value === redacted.value ? REREAD_NO_VALUE : void 0;
+	if (!rendersReadTo(redacted.value, parentSecrets, resolved.value)) return void 0;
+	return {
+		resolved: resolved.value,
+		redacted: redacted.value
+	};
+}
+function namesParameterOnBranches(node, choose, isParameter, depth = 0) {
+	if (depth > MAX_REREAD_DEPTH) return true;
+	if (typeof node === "string") return node.includes("{{resolve:");
+	if (Array.isArray(node)) return node.some((element) => namesParameterOnBranches(element, choose, isParameter, depth + 1));
+	if (!isPlainObject(node)) return false;
+	if (Object.hasOwn(node, "Fn::If")) {
+		const args = node["Fn::If"];
+		if (Object.keys(node).length !== 1) return true;
+		if (!Array.isArray(args) || args.length !== 3 || typeof args[0] !== "string") return true;
+		const tookTrue = choose(args[0], node);
+		if (tookTrue === void 0) return true;
+		return namesParameterOnBranches(tookTrue ? args[1] : args[2], choose, isParameter, depth + 1);
+	}
+	if (typeof node["Ref"] === "string" && isParameter(node["Ref"])) return true;
+	const sub = node["Fn::Sub"];
+	const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
+	if (typeof text === "string") {
+		for (const match of text.matchAll(/\$\{([^}!][^}]*)\}/g)) if (isParameter(match[1].trim()) || isParameter(match[1])) return true;
+	}
+	return Object.values(node).some((child) => namesParameterOnBranches(child, choose, isParameter, depth + 1));
+}
+function rereadAssignments(source, bind, parentSecrets, untakenWhenUnbound = () => false, parameterFree) {
+	if (!holdsRereadTrigger(source)) return void 0;
+	const conditions = /* @__PURE__ */ new Set();
+	if (!collectRereadConditions(source, conditions)) return void 0;
+	if (conditions.size > MAX_REREAD_CONDITIONS) return void 0;
+	const names = [...conditions];
+	const out = [];
+	for (let assignment = 0; assignment < 2 ** names.length; assignment++) {
+		const choose = (condition) => Math.floor(assignment / 2 ** names.indexOf(condition)) % 2 === 1;
+		let unbound = false;
+		const tracked = (name) => {
+			const bound = bind(name);
+			if (bound === void 0 && untakenWhenUnbound(name)) unbound = true;
+			return bound;
+		};
+		const reread = rereadUnder(source, tracked, parentSecrets, choose);
+		if (unbound) out.push(REREAD_UNBOUND);
+		else if (reread !== void 0) out.push(reread);
+		else if (parameterFree !== void 0 && !namesParameterOnBranches(source, choose, parameterFree)) out.push(REREAD_PARAMETER_FREE);
+		else out.push(void 0);
+	}
+	return out;
+}
+function rereadParameterExpression(source, bind, parentSecrets) {
+	const assignments = rereadAssignments(source, bind, parentSecrets, void 0, (name) => bind(name) !== void 0);
+	if (assignments === void 0 || assignments.includes(void 0) || assignments.includes(REREAD_UNBOUND)) return;
+	return assignments.find((entry) => entry !== void 0 && entry !== REREAD_NO_VALUE && entry !== REREAD_UNBOUND && entry !== REREAD_PARAMETER_FREE);
+}
+function ambiguousRereads(rereads) {
+	return rereads.some((a, i) => rereads.slice(i + 1).some((b) => deepEqualJsonValue(a.resolved, b.resolved) && !deepEqualJsonValue(a.redacted, b.redacted)));
+}
+function positionByParameterReread(bag, source, secrets) {
+	const reads = inheritedParameterReads.get(secrets);
+	if (reads === void 0 || typeof reads === "symbol") return void 0;
+	if (typeof bag !== "string" && !Array.isArray(bag)) return void 0;
+	if (!holdsRereadTrigger(source)) return void 0;
+	const bind = (name) => reads.values.has(name) ? { value: reads.values.get(name) } : void 0;
+	let unrecorded = false;
+	const recorded = rereadUnder(source, bind, reads.parent, (_, node) => {
+		const taken = takenIfBranchOf(secrets, node);
+		if (taken === void 0) unrecorded = true;
+		return taken;
+	});
+	let answer;
+	if (!unrecorded) {
+		if (recorded === void 0 || recorded === REREAD_NO_VALUE || !deepEqualJsonValue(recorded.resolved, bag)) return;
+		answer = recorded.redacted;
+	} else {
+		const declared = reads.declared;
+		const assignments = rereadAssignments(source, bind, reads.parent, (name) => declared?.has(name) === true);
+		if (assignments === void 0 || assignments.includes(void 0)) return void 0;
+		const matching = assignments.filter((entry) => entry !== void 0 && entry !== REREAD_NO_VALUE && entry !== REREAD_UNBOUND && entry !== REREAD_PARAMETER_FREE && deepEqualJsonValue(entry.resolved, bag));
+		if (matching.length === 0 || ambiguousRereads(matching)) return void 0;
+		answer = matching[0].redacted;
+	}
+	if (carriesChildOnlyPlaintext(bag, secrets, reads.parent)) return void 0;
+	if (!deepEqualJsonValue(redactForState(answer, {
+		provenance: "value-scan",
+		secrets
+	}), answer)) return void 0;
+	return answer;
+}
+function carriesChildOnlyPlaintext(value, childSecrets, parentSecrets) {
+	const parentNeedles = new Set(substringNeedlesOf(parentSecrets));
+	const childNeedles = new Set(substringNeedlesOf(childSecrets));
+	const childOnly = [...childSecrets.keys()].filter((plaintext) => plaintext !== "" && (!parentSecrets.has(plaintext) || childNeedles.has(plaintext) && !parentNeedles.has(plaintext)));
+	for (const needle of parentNeedles) if (needle.length >= 4 && !childSecrets.has(needle)) childOnly.push(needle);
+	if (childOnly.length === 0) return false;
+	const visit = (node) => {
+		if (typeof node === "string") return childOnly.some((plaintext) => node.includes(plaintext));
+		if (Array.isArray(node)) return node.some(visit);
+		if (node !== null && typeof node === "object") return Object.values(node).some(visit);
+		return false;
+	};
+	return visit(value);
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/placeholder-positions.ts
+function keyedPart(source) {
+	const key = crossStackSourceKey(source);
+	return key === void 0 ? UNKNOWN_PART : { key };
+}
+const MAX_PLACEHOLDER_DEPTH = 8;
+function pushPlaceholderPart(out, part, budget) {
+	if (budget.remaining <= 0) {
+		budget.exhausted = true;
+		return;
+	}
+	budget.remaining -= 1;
+	out.push(part);
+}
+function appendValuePlaceholderParts(value, out, budget, depth) {
+	if (budget.exhausted) return;
+	const literal = joinPartLiteralText(value);
+	if (literal !== void 0) return pushPlaceholderPart(out, literal, budget);
+	if (isPlainObject(value) && Object.keys(value).length === 1) {
+		const ref = value["Ref"];
+		if (typeof ref === "string" && ref !== "") return pushPlaceholderPart(out, keyedPart({ Ref: ref }), budget);
+		if (depth >= MAX_PLACEHOLDER_DEPTH) {
+			budget.exhausted = true;
+			return;
+		}
+		if (appendParameterPlaceholderParts(value, out, budget, depth + 1)) return;
+		return pushPlaceholderPart(out, keyedPart(value), budget);
+	}
+	pushPlaceholderPart(out, UNKNOWN_PART, budget);
+}
+function appendParameterPlaceholderParts(source, out, budget, depth) {
+	const keys = Object.keys(source);
+	if (keys.length !== 1) return false;
+	const key = keys[0];
+	if (key === "Fn::Join") {
+		const args = source[key];
+		if (!Array.isArray(args) || args.length !== 2) return false;
+		const [delimiter, parts] = args;
+		if (typeof delimiter !== "string" || !Array.isArray(parts)) return false;
+		for (let index = 0; index < parts.length && !budget.exhausted; index++) {
+			if (index > 0) pushPlaceholderPart(out, delimiter, budget);
+			appendValuePlaceholderParts(parts[index], out, budget, depth);
+		}
+		return true;
+	}
+	if (key === "Fn::Sub") {
+		const args = source[key];
+		let template;
+		let variables = {};
+		if (typeof args === "string") template = args;
+		else if (Array.isArray(args) && args.length === 2 && isPlainObject(args[1])) {
+			template = args[0];
+			variables = args[1];
+		} else return false;
+		if (typeof template !== "string") return false;
+		let cursor = 0;
+		for (const hit of template.matchAll(/\$\{(!)?([^}]*)\}/g)) {
+			if (budget.exhausted) return true;
+			pushPlaceholderPart(out, template.slice(cursor, hit.index), budget);
+			cursor = hit.index + hit[0].length;
+			const name = hit[2] ?? "";
+			if (hit[1] === "!") pushPlaceholderPart(out, `\${${name}}`, budget);
+			else if (name === "") pushPlaceholderPart(out, hit[0], budget);
+			else if (Object.hasOwn(variables, name)) appendValuePlaceholderParts(variables[name], out, budget, depth);
+			else if (name.includes(".")) pushPlaceholderPart(out, keyedPart({ "Fn::GetAtt": name }), budget);
+			else pushPlaceholderPart(out, keyedPart({ Ref: name }), budget);
+		}
+		pushPlaceholderPart(out, template.slice(cursor), budget);
+		return true;
+	}
+	return false;
+}
+function parameterPlaceholderParts(source, bag) {
+	const budget = {
+		remaining: bag.length * 2 + 16,
+		exhausted: false
+	};
+	const out = [];
+	if (!appendParameterPlaceholderParts(source, out, budget, 0)) return void 0;
+	return budget.exhausted ? void 0 : out;
+}
+function positionByParameterPlaceholders(bag, source, secrets) {
+	const associations = crossStackAssociations.get(secrets);
+	const spanned = positionByRecordedParameterSpans(bag, source, secrets, associations);
+	if (spanned !== void 0) return spanned;
+	const parts = parameterPlaceholderParts(source, bag);
+	if (parts === void 0) return void 0;
+	const before = ["", ""];
+	const after = ["", ""];
+	let side = before;
+	let unknown = false;
+	let certified = 0;
+	const spans = [];
+	for (const part of parts) {
+		let rendered;
+		let persisted;
+		if (typeof part === "string") {
+			rendered = part;
+			persisted = part;
+		} else {
+			let expression;
+			let plaintext = "";
+			if (part !== UNKNOWN_PART) {
+				const association = associations?.get(part.key);
+				if (association !== void 0 && typeof association !== "symbol") {
+					plaintext = association.plaintext;
+					expression = certifiedExpressionForLeaf(secrets, association, plaintext);
+				}
+				if (expression === void 0) {
+					const inherited = inheritedRenderedSpan(secrets, part.key);
+					if (inherited !== void 0) {
+						plaintext = inherited.value;
+						expression = inherited.spelling;
+					}
+				}
+			}
+			const pseudo = expression === void 0 && part !== UNKNOWN_PART ? inheritedPseudoSpan(secrets, part.key) : void 0;
+			if (pseudo !== void 0) {
+				side[0] += pseudo;
+				side[1] += pseudo;
+				continue;
+			}
+			if (expression === void 0) {
+				if (unknown) return void 0;
+				unknown = true;
+				side = after;
+				continue;
+			}
+			rendered = plaintext;
+			persisted = expression;
+			certified += 1;
+			spans.push([
+				side,
+				side[0].length,
+				plaintext.length
+			]);
+		}
+		side[0] += rendered;
+		side[1] += persisted;
+	}
+	if (certified === 0) return void 0;
+	let persisted;
+	if (!unknown) {
+		if (before[0] !== bag) return void 0;
+		persisted = before[1];
+	} else {
+		if (bag.length < before[0].length + after[0].length) return void 0;
+		if (!bag.startsWith(before[0]) || !bag.endsWith(after[0])) return void 0;
+		const middle = bag.slice(before[0].length, bag.length - after[0].length);
+		if (redactForState(middle, {
+			provenance: "value-scan",
+			secrets
+		}) !== middle) return void 0;
+		persisted = before[1] + middle + after[1];
+	}
+	const afterStart = bag.length - after[0].length;
+	return acceptedPlaceholderRendering(bag, persisted, spans.map(([side, offset, length]) => [(side === before ? 0 : afterStart) + offset, length]), secrets);
+}
+function acceptedPlaceholderRendering(bag, persisted, spans, secrets) {
+	for (const plaintext of secrets.keys()) {
+		if (plaintext.length < 4) continue;
+		for (let at = bag.indexOf(plaintext); at !== -1; at = bag.indexOf(plaintext, at + 1)) {
+			const end = at + plaintext.length;
+			for (const [start, length] of spans) if (at < start + length && end > start && (at < start || end > start + length)) return void 0;
+		}
+	}
+	if (redactForState(persisted, {
+		provenance: "value-scan",
+		secrets
+	}) !== persisted) return void 0;
+	return persisted;
+}
+function positionByRecordedParameterSpans(bag, source, secrets, associations) {
+	const resolution = intrinsicLeafResolutionOf(secrets, source);
+	if (resolution === void 0 || resolution.output !== bag) return void 0;
+	const recorded = resolution.parameterSpans;
+	if (recorded === void 0) return void 0;
+	let previousEnd = 0;
+	let cursor = 0;
+	let persisted = "";
+	const gaps = [];
+	const certified = [];
+	for (const { start, length, key } of recorded) {
+		if (!(start >= previousEnd && length > 0 && start + length <= bag.length)) return void 0;
+		previousEnd = start + length;
+		const text = bag.slice(start, start + length);
+		const association = associations?.get(key);
+		const expression = (association !== void 0 && typeof association !== "symbol" ? certifiedExpressionForLeaf(secrets, association, text) : void 0) ?? inheritedRenderedSpan(secrets, key, text)?.spelling;
+		if (expression === void 0) continue;
+		const gap = bag.slice(cursor, start);
+		gaps.push(gap);
+		persisted += gap + expression;
+		certified.push([start, length]);
+		cursor = start + length;
+	}
+	if (certified.length === 0) return void 0;
+	const tail = bag.slice(cursor);
+	gaps.push(tail);
+	persisted += tail;
+	for (const gap of gaps) if (redactForState(gap, {
+		provenance: "value-scan",
+		secrets
+	}) !== gap) return void 0;
+	return acceptedPlaceholderRendering(bag, persisted, certified, secrets);
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/identity-keys.ts
+const ARRAY_IDENTITY_KEYS = ["Name", "Key"];
+function isUniquelyKeyedBy(items, key) {
+	if (items.length === 0) return false;
+	const seen = /* @__PURE__ */ new Set();
+	for (const item of items) {
+		if (!isPlainObject(item) || !Object.hasOwn(item, key)) return false;
+		const id = item[key];
+		if (typeof id !== "string" || id === "") return false;
+		if (seen.has(id)) return false;
+		seen.add(id);
+	}
+	return true;
+}
+function identityKeyFor(bag, source) {
+	for (const key of ARRAY_IDENTITY_KEYS) if (isUniquelyKeyedBy(bag, key) && isUniquelyKeyedBy(source, key)) return key;
+}
+function positionListByCrossStackSource(bag, source, secrets) {
+	const association = associationForSource(source, secrets);
+	if (association === void 0) return void 0;
+	return certifiedListForLeaf(secrets, association, bag);
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/redact-path.ts
+const NEVER_DROPPING_INTRINSICS = /* @__PURE__ */ new Set([
+	"Fn::Join",
+	"Fn::Sub",
+	"Fn::Select",
+	"Fn::Split",
+	"Fn::GetAtt"
+]);
+function arrayElementDrop(element, depth = 0) {
+	if (depth > 16) return "unknown";
+	if (!isPlainObject(element)) return "never";
+	if (Object.hasOwn(element, "Ref")) return element["Ref"] === "AWS::NoValue" ? "always" : "never";
+	const keys = Object.keys(element);
+	if (keys.filter((key) => key.startsWith("Fn::") || key === "Condition").length === 0) return "never";
+	if (keys.length !== 1) return "unknown";
+	if (NEVER_DROPPING_INTRINSICS.has(keys[0])) return "never";
+	if (keys[0] !== "Fn::If") return "unknown";
+	const args = element["Fn::If"];
+	if (!Array.isArray(args) || args.length !== 3) return "unknown";
+	const branches = [arrayElementDrop(args[1], depth + 1), arrayElementDrop(args[2], depth + 1)];
+	if (branches.includes("unknown")) return "unknown";
+	if (branches.every((branch) => branch === "never")) return "never";
+	if (branches.every((branch) => branch === "always")) return "always";
+	return "maybe";
+}
+function sourceElementsKeptFor(source, bagLength, secrets) {
+	const recorded = secrets && droppedArrayElementsOf(secrets, source);
+	if (recorded !== void 0) {
+		if (source.length - recorded.length !== bagLength) return void 0;
+		return source.filter((_, i) => !recorded.includes(i));
+	}
+	const drops = source.map((element) => arrayElementDrop(element));
+	if (drops.includes("unknown")) return void 0;
+	const always = drops.filter((drop) => drop === "always").length;
+	const maybe = drops.filter((drop) => drop === "maybe").length;
+	const dropped = source.length - bagLength;
+	let dropMaybe;
+	if (dropped === always) dropMaybe = false;
+	else if (dropped === always + maybe) dropMaybe = true;
+	else return void 0;
+	return source.filter((_, i) => drops[i] === "never" || drops[i] === "maybe" && !dropMaybe);
+}
+function keptLiteralsCorroborate(kept, bag, secrets) {
+	return kept.every((element, i) => keptElementCorroborates(element, bag[i], secrets));
+}
+function isIntrinsicNode(value) {
+	if (!isPlainObject(value)) return false;
+	const keys = Object.keys(value);
+	return keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"));
+}
+function keptElementCorroborates(source, bag, secrets, depth = 0) {
+	if (depth > 16) return false;
+	if (typeof source === "string") {
+		if (!source.includes("{{resolve:")) return source === bag;
+		return isSingleDynamicReferenceToken(source) && resolvedPlaintextOf(secrets, source) === bag;
+	}
+	if (source === null || typeof source !== "object") return source === bag;
+	if (isIntrinsicNode(source)) return true;
+	if (Array.isArray(source)) return Array.isArray(bag) && bag.length === source.length && source.every((element, i) => keptElementCorroborates(element, bag[i], secrets, depth + 1));
+	if (!isPlainObject(source) || !isPlainObject(bag)) return false;
+	if (Object.keys(bag).some((key) => !Object.hasOwn(source, key))) return false;
+	return Object.entries(source).every(([key, value]) => Object.hasOwn(bag, key) ? keptElementCorroborates(value, bag[key], secrets, depth + 1) : arrayElementDrop(value) === "always" || arrayElementDrop(value) === "maybe");
+}
+function corroboratesWhateverResolves(source, depth = 0) {
+	if (depth > 16) return false;
+	if (typeof source === "string") return !source.includes("{{resolve:");
+	if (source === null || typeof source !== "object") return true;
+	if (isIntrinsicNode(source)) return true;
+	if (Array.isArray(source)) return source.every((element) => arrayElementDrop(element) === "never" && corroboratesWhateverResolves(element, depth + 1));
+	if (!isPlainObject(source)) return false;
+	if (Object.keys(source).some((key) => key === "Ref" || key.startsWith("Fn::"))) return false;
+	return Object.values(source).every((value) => arrayElementDrop(value) !== "unknown" && corroboratesWhateverResolves(value, depth + 1));
+}
+function arrayPairsWhateverDrops(source) {
+	if (!source.some((element) => isPlainObject(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue" || Array.isArray(element["Fn::FindInMap"]) && element["Fn::FindInMap"].length > 3))) return true;
+	return source.every((element) => corroboratesWhateverResolves(element));
+}
+function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameGeneration) {
+	if (isDynamicReferenceString(source) && typeof bag === "string") {
+		if (isSingleDynamicReferenceToken(source) && (rules.trustAnyExpression || isKnownSecretExpression(source, secretExpressions))) {
+			if (!rules.sourceIsSameGeneration && isSingleDynamicReferenceToken(bag)) {
+				if (!spanNamesResolvableService(bag)) return redactForState(bag, {
+					provenance: "value-scan",
+					secrets
+				});
+				return secrets.get(bag) ?? bag;
+			}
+			return source;
+		}
+		return positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration);
+	}
+	if ((typeof bag === "string" || Array.isArray(bag)) && isPlainObject(source)) {
+		const inherited = positionByInheritedParameter(bag, source, secrets);
+		if (inherited !== void 0) return inherited;
+		const reread = positionByParameterReread(bag, source, secrets);
+		if (reread !== void 0) return reread;
+	}
+	if (typeof bag === "string" && isPlainObject(source)) {
+		const certified = positionByCrossStackSource(bag, source, secrets);
+		if (certified !== void 0) return certified;
+		const placeheld = positionByParameterPlaceholders(bag, source, secrets);
+		if (placeheld !== void 0) return placeheld;
+		const positioned = positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions);
+		if (positioned !== void 0) return positioned;
+		const framed = positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIsSameGeneration);
+		if (framed !== void 0) return framed;
+	}
+	if (Array.isArray(bag) && isPlainObject(source)) {
+		const positionedList = positionListByCrossStackSource(bag, source, secrets);
+		if (positionedList !== void 0) return positionedList;
+	}
+	if (Array.isArray(bag) && Array.isArray(source)) {
+		const key = identityKeyFor(bag, source);
+		if (key !== void 0) {
+			const sourceIndexById = /* @__PURE__ */ new Map();
+			source.forEach((item, i) => {
+				sourceIndexById.set(item[key], i);
+			});
+			let orderPreserved = true;
+			const partnerIndex = bag.map((item, i) => {
+				const j = sourceIndexById.get(item[key]);
+				if (j === void 0) return -1;
+				if (j !== i) orderPreserved = false;
+				return j;
+			});
+			const positionalIsExact = rules.descendArrays && bag.length === source.length && orderPreserved;
+			return bag.map((item, i) => {
+				const j = partnerIndex[i];
+				if (j >= 0) return redactByPath(item, source[j], secrets, rules, secretExpressions, bagIsSameGeneration);
+				if (positionalIsExact) return redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration);
+				return redactForState(item, {
+					provenance: "value-scan",
+					secrets
+				});
+			});
+		}
+		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration));
+		if (rules.descendArrays && bag.length < source.length) {
+			const kept = sourceElementsKeptFor(source, bag.length, secrets);
+			if (kept !== void 0 && keptLiteralsCorroborate(kept, bag, secrets)) return bag.map((item, i) => redactByPath(item, kept[i], secrets, rules, secretExpressions, bagIsSameGeneration));
+		}
+	}
+	if (isPlainObject(bag) && hasPlainPrototype(bag) && isPlainObject(source)) {
+		const out = Object.create(null);
+		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactForState(v, {
+			provenance: "value-scan",
+			secrets
+		});
+		return out;
+	}
+	return redactForState(bag, {
+		provenance: "value-scan",
+		secrets
+	});
+}
+function isReadbackProjectedFromState(rules) {
+	return rules.trustAnyExpression && !rules.descendArrays && rules.sourceIsSameGeneration;
+}
+function subtreeHasDynamicReference(value) {
+	if (isDynamicReferenceString(value)) return true;
+	if (Array.isArray(value)) return value.some(subtreeHasDynamicReference);
+	if (isPlainObject(value)) return Object.values(value).some(subtreeHasDynamicReference);
+	return false;
+}
+function pathCrossesDottedKey(bag, path) {
+	const segments = path.split(".");
+	let cursor = bag;
+	for (let i = 0; i < segments.length; i++) {
+		if (cursor === null || typeof cursor !== "object" || Array.isArray(cursor)) return false;
+		const rest = segments.slice(i).join(".");
+		for (const key of Object.keys(cursor)) if (key.includes(".") && (rest === key || rest.startsWith(`${key}.`))) return true;
+		if (!Object.hasOwn(cursor, segments[i])) return false;
+		cursor = cursor[segments[i]];
+	}
+	return false;
+}
+function isUncertifiedBaselineMaskPosition(properties, path) {
+	if (pathCrossesDottedKey(properties, path)) return false;
+	let cursor = properties;
+	for (const segment of path.split(".")) {
+		if (typeof cursor === "string") break;
+		if (cursor === null || typeof cursor !== "object" || Array.isArray(cursor) || !Object.hasOwn(cursor, segment)) return false;
+		cursor = cursor[segment];
+	}
+	if (typeof cursor === "string") return isDynamicReferenceString(cursor) && cursor !== "***";
+	return subtreeHasDynamicReference(cursor) && !carriesSecretMask(cursor);
+}
+const DYNAMIC_REFERENCE_TOKEN_SCAN = new RegExp(`\\{\\{resolve:${DYNAMIC_REFERENCE_INNER}\\}\\}`, "g");
+function dynamicReferenceTokens(value) {
+	return value.match(DYNAMIC_REFERENCE_TOKEN_SCAN) ?? [];
+}
+function dynamicReferenceSpans(value) {
+	DYNAMIC_REFERENCE_TOKEN_SCAN.lastIndex = 0;
+	const spans = [];
+	for (const match of value.matchAll(DYNAMIC_REFERENCE_TOKEN_SCAN)) spans.push({
+		start: match.index,
+		end: match.index + match[0].length
+	});
+	return spans;
+}
+function mixedLeafMayCarryPublicReference(source, secrets, readback) {
+	if (secrets.size === 0) return mixedLeafProvenPublic(source, secrets, readback);
+	return dynamicReferenceTokens(source).some((token) => token.startsWith("{{resolve:ssm:") && !isRecordedSecretExpression(token));
+}
+function mixedLeafProvenPublic(source, secrets, readback) {
+	const tokens = dynamicReferenceTokens(source);
+	if (tokens.length === 0) return false;
+	const values = /* @__PURE__ */ new Map();
+	for (const token of tokens) {
+		if (!token.startsWith("{{resolve:ssm:")) return false;
+		const value = provenPublicValue(secrets, token);
+		if (value === void 0) return false;
+		values.set(token, value);
+	}
+	DYNAMIC_REFERENCE_TOKEN_SCAN.lastIndex = 0;
+	return source.replace(DYNAMIC_REFERENCE_TOKEN_SCAN, (token) => values.get(token)) === readback;
+}
+function hasPlainPrototype(value) {
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
+function isOrdinaryDate(value) {
+	if (Object.getPrototypeOf(value) !== Date.prototype) return false;
+	try {
+		Date.prototype.getTime.call(value);
+	} catch {
+		return false;
+	}
+	return Reflect.ownKeys(value).length === 0;
+}
+function deepEqualJsonValue(a, b) {
+	if (a === b) return true;
+	if (Array.isArray(a)) {
+		if (!Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((item, i) => deepEqualJsonValue(item, b[i]));
+	}
+	if (isPlainObject(a)) {
+		if (!isPlainObject(b)) return false;
+		if (!hasPlainPrototype(a) || !hasPlainPrototype(b)) return false;
+		const keys = Object.keys(a);
+		if (keys.length !== Object.keys(b).length) return false;
+		return keys.every((k) => Object.hasOwn(b, k) && deepEqualJsonValue(a[k], b[k]));
+	}
+	return false;
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/readback-certification.ts
+function refuseUncertifiedSubtree(value, sourceLiterals, mark, seen = /* @__PURE__ */ new Map()) {
+	if (typeof value === "string") {
+		if (isSingleDynamicReferenceToken(value) && spanNamesResolvableService(value) || sourceLiterals.has(value)) return value;
+		if (value === "") return value;
+		return mark ? POSITION_UNCERTIFIED : "***";
+	}
+	if (value === null || typeof value !== "object") return value;
+	const memo = seen.get(value);
+	if (memo !== void 0) return memo;
+	if (Array.isArray(value)) {
+		const out = [];
+		seen.set(value, out);
+		for (const item of value) out.push(refuseUncertifiedSubtree(item, sourceLiterals, mark, seen));
+		return out;
+	}
+	if (isPlainObject(value) && hasPlainPrototype(value)) {
+		const out = Object.create(null);
+		seen.set(value, out);
+		for (const [k, v] of Object.entries(value)) out[k] = refuseUncertifiedSubtree(v, sourceLiterals, mark, seen);
+		return out;
+	}
+	if (ArrayBuffer.isView(value)) return mark ? POSITION_UNCERTIFIED : "***";
+	seen.set(value, value);
+	return value;
+}
+function refuseAgainstSource(bag, source, failClosed, mark) {
+	if (failClosed !== true) return bag;
+	return refuseUncertifiedSubtree(bag, wholeStringLeavesOf(source), mark);
+}
+function unpairedSourceCarriesReference(source, key, bagIdentities) {
+	return source.some((item) => !bagIdentities.has(item[key]) && subtreeHasDynamicReference(item));
+}
+function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, learn, mark) {
+	if (isDynamicReferenceString(source) && typeof bag === "string") {
+		if (isSingleDynamicReferenceToken(source)) {
+			if (learn) learnWholeTokenNeedle(learn, bag, source);
+			return mark ? POSITION_DECIDED : source;
+		}
+		if (mixedLeafMayCarryPublicReference(source, secrets, bag)) return mark ? POSITION_DECIDED : bag;
+		if (learn) learnMixedLeafNeedle(learn, bag, source);
+		return mark ? POSITION_DECIDED : source;
+	}
+	if (!subtreeHasDynamicReference(source)) return bag;
+	if (isPlainObject(bag) && hasPlainPrototype(bag) && isPlainObject(source)) {
+		const out = Object.create(null);
+		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, failClosed, learn, mark) : v;
+		return out;
+	}
+	if (Array.isArray(bag) && Array.isArray(source)) {
+		const key = identityKeyFor(bag, source);
+		if (key === void 0) {
+			if (!unkeyedArrayPairsByAnchors(bag, source)) return refuseAgainstSource(bag, source, failClosed, mark);
+			return bag.map((item, i) => refuseUncertifiedReadbackPositions(item, source[i], secrets, failClosed, learn, mark));
+		}
+		const sourceByIdentity = /* @__PURE__ */ new Map();
+		for (const item of source) sourceByIdentity.set(item[key], item);
+		const orphanLiterals = unpairedSourceCarriesReference(source, key, new Set(bag.map((item) => item[key]))) && failClosed === true ? wholeStringLeavesOf(source) : void 0;
+		return bag.map((item) => {
+			const partner = sourceByIdentity.get(item[key]);
+			return partner === void 0 ? orphanLiterals !== void 0 ? refuseUncertifiedSubtree(item, orphanLiterals, mark) : item : refuseUncertifiedReadbackPositions(item, partner, secrets, failClosed, learn, mark);
+		});
+	}
+	return refuseAgainstSource(bag, source, failClosed, mark);
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/anchors.ts
+function isDistinguishingAnchor(value) {
+	if (typeof value === "string") return value !== "";
+	if (Array.isArray(value)) return value.some(isDistinguishingAnchor);
+	if (isPlainObject(value)) return Object.values(value).some(isDistinguishingAnchor);
+	return false;
+}
+const ANCHOR_REFERENCE_MASK = "<ref>";
+function anchorSignature(source) {
+	if (isDynamicReferenceString(source)) return ANCHOR_REFERENCE_MASK;
+	if (Array.isArray(source)) return `[${source.map(anchorSignature).sort().join(",")}]`;
+	if (isPlainObject(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
+	return JSON.stringify(source) ?? "undefined";
+}
+function anchorsCorroboratePairing(bag, source, anchors) {
+	if (!subtreeHasDynamicReference(source)) {
+		if (!deepEqualJsonValue(bag, source)) return false;
+		if (isDistinguishingAnchor(source)) anchors.distinguishing += 1;
+		return true;
+	}
+	if (isDynamicReferenceString(source)) return typeof bag === "string";
+	if (isPlainObject(source)) {
+		if (!isPlainObject(bag)) return false;
+		return Object.keys(source).every((k) => Object.hasOwn(bag, k) && anchorsCorroboratePairing(bag[k], source[k], anchors));
+	}
+	if (Array.isArray(source)) {
+		if (!Array.isArray(bag) || bag.length !== source.length) return false;
+		return source.every((item, i) => anchorsCorroboratePairing(bag[i], item, anchors));
+	}
+	return false;
+}
+function unkeyedArrayPairsByAnchors(bag, source) {
+	if (bag.length !== source.length) return false;
+	const distinguishingPerElement = [];
+	for (const [i, item] of source.entries()) {
+		const anchors = { distinguishing: 0 };
+		if (!anchorsCorroboratePairing(bag[i], item, anchors)) return false;
+		distinguishingPerElement.push(anchors.distinguishing);
+	}
+	const frameDistinguishing = source.reduce((total, item, i) => subtreeHasDynamicReference(item) ? total : total + distinguishingPerElement[i], 0);
+	const signatures = /* @__PURE__ */ new Set();
+	for (const [i, item] of source.entries()) {
+		if (!subtreeHasDynamicReference(item)) continue;
+		const signature = anchorSignature(item);
+		if (signatures.has(signature)) return false;
+		signatures.add(signature);
+		if (distinguishingPerElement[i] > 0) continue;
+		if (!isDynamicReferenceString(item) || frameDistinguishing === 0) return false;
+	}
+	return true;
+}
+const POSITION_DECIDED = Symbol("position decided by a position pass");
+const POSITION_UNCERTIFIED = Symbol("position refused by a position pass");
+function learnNeedle(collector, plaintext, expression) {
+	if (plaintext.length < 4) return;
+	if (collector.poisoned.has(plaintext)) return;
+	if (expressionSecretIsInferred(expression)) collector.inferred.add(plaintext);
+	const already = collector.needles.get(plaintext);
+	if (already === void 0) {
+		collector.needles.set(plaintext, expression);
+		return;
+	}
+	if (already === expression) return;
+	collector.needles.delete(plaintext);
+	collector.poisoned.add(plaintext);
+}
+const SECRET_BEARING_REFERENCE_PREFIXES = [
+	"{{resolve:secretsmanager:",
+	"{{resolve:ssm-secure:",
+	"{{resolve:ssm:"
+];
+function spanNamesResolvableService(token) {
+	return SECRET_BEARING_REFERENCE_PREFIXES.some((prefix) => token.startsWith(prefix));
+}
+function resolvableReferenceSpans(value, vouchedExpressions) {
+	const spans = dynamicReferenceSpans(value).filter((span) => spanNamesResolvableService(value.slice(span.start, span.end)));
+	const starts = new Set(spans.map((span) => span.start));
+	for (const prefix of SECRET_BEARING_REFERENCE_PREFIXES) for (let at = value.indexOf(prefix); at >= 0; at = value.indexOf(prefix, at + 1)) {
+		if (starts.has(at)) continue;
+		DYNAMIC_REFERENCE_TOKEN_SCAN.lastIndex = at;
+		const match = DYNAMIC_REFERENCE_TOKEN_SCAN.exec(value);
+		DYNAMIC_REFERENCE_TOKEN_SCAN.lastIndex = 0;
+		if (match?.index !== at) continue;
+		const end = at + match[0].length;
+		if (!vouchedExpressions.has(value.slice(at, end))) continue;
+		spans.push({
+			start: at,
+			end
+		});
+		starts.add(at);
+	}
+	return spans;
+}
+const SPELLED_SECRET_REFERENCE_PREFIXES = ["{{resolve:secretsmanager:", "{{resolve:ssm-secure:"];
+function expressionSecretIsInferred(expression) {
+	return !SPELLED_SECRET_REFERENCE_PREFIXES.some((prefix) => expression.startsWith(prefix));
+}
+function expressionMaySeedANeedle(expression) {
+	return isRecordedSecretExpression(expression) || SECRET_BEARING_REFERENCE_PREFIXES.some((prefix) => expression.startsWith(prefix));
+}
+function learnWholeTokenNeedle(collector, bag, source) {
+	if (isSingleDynamicReferenceToken(bag)) return;
+	if (!expressionMaySeedANeedle(source)) return;
+	learnNeedle(collector, bag, source);
+}
+function learnMixedLeafNeedle(collector, bag, source) {
+	const frame = singleSpanFrame(bag, source);
+	if (frame === void 0) return;
+	const { token, middle: plaintext } = frame;
+	if (!expressionMaySeedANeedle(token)) return;
+	learnNeedle(collector, plaintext, token);
+}
+function asChild(marks, key) {
+	return isPlainObject(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
+}
+function asIndex(marks, index) {
+	return Array.isArray(marks) ? marks[index] : void 0;
+}
+function preferPositionDecisions(scanned, refused, bag, marks, inferred) {
+	if (isPlainObject(bag) && hasPlainPrototype(bag) && isPlainObject(refused) && isPlainObject(scanned)) {
+		const out = Object.create(null);
+		for (const [k, v] of Object.entries(refused)) out[k] = preferPositionDecisions(scanned[k], v, bag[k], asChild(marks, k), inferred);
+		return out;
+	}
+	if (Array.isArray(bag) && Array.isArray(refused) && Array.isArray(scanned) && refused.length === bag.length && scanned.length === bag.length) return refused.map((item, i) => preferPositionDecisions(scanned[i], item, bag[i], asIndex(marks, i), inferred));
+	if (typeof bag !== "string" || marks === POSITION_DECIDED) return refused;
+	const scanDecision = scanned === bag ? inferred.get(bag) ?? scanned : scanned;
+	if (marks === POSITION_UNCERTIFIED && !(typeof scanDecision === "string" && isSingleDynamicReferenceToken(scanDecision))) return refused;
+	return scanDecision;
+}
+function deriveReadbackNeedles(bag, source, secrets, rules) {
+	if (!isReadbackProjectedFromState(rules)) return void 0;
+	if (secrets.size > 0) return void 0;
+	if (!subtreeHasDynamicReference(source)) return void 0;
+	const collector = {
+		needles: /* @__PURE__ */ new Map(),
+		poisoned: /* @__PURE__ */ new Set(),
+		inferred: /* @__PURE__ */ new Set()
+	};
+	refuseUncertifiedReadbackPositions(bag, source, secrets, false, collector);
+	if (collector.needles.size === 0) return void 0;
+	const certain = /* @__PURE__ */ new Map();
+	const inferred = /* @__PURE__ */ new Map();
+	for (const [plaintext, expression] of collector.needles) (collector.inferred.has(plaintext) ? inferred : certain).set(plaintext, expression);
+	return {
+		certain,
+		inferred
+	};
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/redact-state.ts
+function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RULES, bagIsSameGeneration = false) {
+	return flattenEmbeddedNoEchoLeaves(redactSecretsForStatePasses(bag, secrets, source, rules, bagIsSameGeneration), secrets);
+}
+function redactSecretsForStatePasses(bag, secrets, source, rules, bagIsSameGeneration) {
+	if (secrets.size === 0 && source === void 0) return bag;
+	if (source !== void 0) {
+		const positioned = redactByPath(bag, source, secrets, rules, recordedExpressionsOf(secrets), bagIsSameGeneration);
+		if (!isReadbackProjectedFromState(rules)) return positioned;
+		const failClosed = rules.failClosedOnUncertifiedPositions === true;
+		const refused = refuseUncertifiedReadbackPositions(positioned, source, secrets, failClosed);
+		const derived = deriveReadbackNeedles(bag, source, secrets, rules);
+		if (derived === void 0) return refused;
+		const marks = refuseUncertifiedReadbackPositions(positioned, source, secrets, failClosed, void 0, true);
+		return preferPositionDecisions(redactForState(bag, {
+			provenance: "value-scan",
+			secrets: derived.certain
+		}), refused, bag, marks, derived.inferred);
+	}
+	const regex = buildNeedleRegex(substringNeedlesOf(secrets));
+	const wholeValueExpr = (s) => s === "" ? void 0 : secrets.get(s);
+	const physicalNames = physicalNameCopiesOf.get(secrets);
+	let vouched;
+	const vouchedExpressions = () => vouched ??= new Set(secrets.values());
+	const expressionFor = (match) => {
+		return secrets.get(match) ?? "***";
+	};
+	const scanLeaf = (value, needles) => {
+		const spans = isDynamicReferenceString(value) ? resolvableReferenceSpans(value, vouchedExpressions()) : [];
+		const names = physicalNameSpans(physicalNames, value);
+		const kept = (start, end) => isStrictlyInsideASpan(spans, start, end) || names.some((n) => n.start <= start && end <= n.end);
+		if (!legacyOverlapScan.has(secrets)) {
+			const matches = everyMatch(value, needles);
+			const redacted = matches.filter((m) => !kept(m.start, m.end));
+			if (cutsContainmentNeedle(value, secrets, redacted)) {
+				overlapAnswered.add(secrets);
+				return "***";
+			}
+			const overlapping = redactOverlappingMatches(value, matches, redacted, expressionFor);
+			if (overlapping !== void 0) {
+				overlapAnswered.add(secrets);
+				return overlapping;
+			}
+		}
+		return value.replace(needles, (match, offset) => {
+			if (kept(offset, offset + match.length)) return match;
+			return expressionFor(match);
+		});
+	};
+	const walk = (value) => {
+		if (typeof value === "string") {
+			if (physicalNames?.has(value) === true) return value;
+			const whole = wholeValueExpr(value);
+			if (whole !== void 0) return whole;
+			if (isSingleDynamicReferenceToken(value) && spanNamesResolvableService(value)) return value;
+			if (!regex) return value;
+			regex.lastIndex = 0;
+			if (!regex.test(value)) return value;
+			return scanLeaf(value, regex);
+		}
+		if (Array.isArray(value)) return value.map(walk);
+		if (value !== null && typeof value === "object") {
+			if (isOrdinaryDate(value)) {
+				const persisted = value.toJSON();
+				if (typeof persisted !== "string") return value;
+				const scanned = walk(persisted);
+				return scanned === persisted ? value : scanned;
+			}
+			const out = Object.create(null);
+			for (const [k, v] of Object.entries(value)) out[k] = walk(v);
+			return out;
+		}
+		return value;
+	};
+	return walk(bag);
+}
+const legacyOverlapScan = /* @__PURE__ */ new WeakSet();
+const overlapAnswered = /* @__PURE__ */ new WeakSet();
+function overlapRuleAnswered(secrets) {
+	return overlapAnswered.has(secrets);
+}
+function withLegacyOverlapScan(secrets, run) {
+	if (legacyOverlapScan.has(secrets)) return run();
+	legacyOverlapScan.add(secrets);
+	try {
+		return run();
+	} finally {
+		legacyOverlapScan.delete(secrets);
+	}
+}
+function differingStringLeaves(legacy, current, out = []) {
+	if (typeof legacy === "string" && typeof current === "string") {
+		if (legacy !== current) out.push([legacy, current]);
+		return out;
+	}
+	if (Array.isArray(legacy) && Array.isArray(current) && legacy.length === current.length) {
+		legacy.forEach((item, i) => differingStringLeaves(item, current[i], out));
+		return out;
+	}
+	if (legacy !== null && current !== null && typeof legacy === "object" && typeof current === "object" && !Array.isArray(legacy) && !Array.isArray(current)) {
+		const c = current;
+		for (const [key, value] of Object.entries(legacy)) if (Object.hasOwn(c, key)) differingStringLeaves(value, c[key], out);
+	}
+	return out;
+}
+function legacyLeavesWithoutMask(legacy) {
+	if (typeof legacy === "string") return legacy.includes("***") ? void 0 : legacy;
+	if (Array.isArray(legacy)) return legacy.map(legacyLeavesWithoutMask);
+	if (legacy !== null && typeof legacy === "object") {
+		const out = Object.create(null);
+		for (const [key, value] of Object.entries(legacy)) out[key] = legacyLeavesWithoutMask(value);
+		return out;
+	}
+	return legacy;
+}
+function legacyReferenceLeavesOnly(legacy) {
+	if (typeof legacy === "string") return legacy.includes("{{resolve:") ? legacy : void 0;
+	if (Array.isArray(legacy)) return legacy.map(legacyReferenceLeavesOnly);
+	if (legacy !== null && typeof legacy === "object") {
+		const out = Object.create(null);
+		for (const [key, value] of Object.entries(legacy)) out[key] = legacyReferenceLeavesOnly(value);
+		return out;
+	}
+	return legacy;
+}
+function replaceWholeLeaves(value, pairs) {
+	if (pairs.length === 0) return value;
+	if (typeof value === "string") {
+		const hit = pairs.find(([legacy]) => legacy === value);
+		return hit === void 0 ? value : hit[1];
+	}
+	if (Array.isArray(value)) {
+		let changed = false;
+		const out = value.map((item) => {
+			const next = replaceWholeLeaves(item, pairs);
+			if (next !== item) changed = true;
+			return next;
+		});
+		return changed ? out : value;
+	}
+	if (value !== null && typeof value === "object") {
+		let out;
+		for (const [key, item] of Object.entries(value)) {
+			const next = replaceWholeLeaves(item, pairs);
+			if (next !== item) {
+				out ??= Object.assign(Object.create(null), value);
+				out[key] = next;
+			}
+		}
+		return out ?? value;
+	}
+	return value;
+}
+function everyMatch(value, needles) {
+	const matches = [];
+	needles.lastIndex = 0;
+	for (let m = needles.exec(value); m !== null; m = needles.exec(value)) {
+		matches.push({
+			start: m.index,
+			end: m.index + m[0].length
+		});
+		needles.lastIndex = m.index + 1;
+	}
+	needles.lastIndex = 0;
+	return matches;
+}
+function redactOverlappingMatches(value, matches, redacted, expressionFor) {
+	let reach = 0;
+	let overlap = false;
+	for (const m of matches) {
+		if (m.start < reach) overlap = true;
+		reach = Math.max(reach, m.end);
+	}
+	if (!overlap) return void 0;
+	let out = "";
+	let cursor = 0;
+	for (let i = 0; i < redacted.length;) {
+		let end = redacted[i].end;
+		let j = i + 1;
+		for (; j < redacted.length && redacted[j].start < end; j++) end = Math.max(end, redacted[j].end);
+		const cluster = redacted.slice(i, j);
+		out += value.slice(cursor, cluster[0].start);
+		for (let at = cluster[0].start; at < end;) {
+			const tile = cluster.find((m) => m.start === at);
+			if (tile === void 0) return "***";
+			out += expressionFor(value.slice(tile.start, tile.end));
+			at = tile.end;
+		}
+		cursor = end;
+		i = j;
+	}
+	return out + value.slice(cursor);
+}
+function scrubResourceRecord(record, secrets, sourceProperties, observedProvenance, claims = {}) {
+	const propertiesClaimed = claims.properties === "same-generation";
+	const observedClaimed = claims.observed === "same-generation";
+	if (secrets.size === 0 && sourceProperties === void 0 && !record.observedProperties) return record;
+	const next = { ...record };
+	next.properties = sourceProperties === void 0 ? redactForState(record.properties, {
+		provenance: "value-scan",
+		secrets
+	}) : redactAtProvenance(record.properties, secrets, sourceProperties, "template-derived", propertiesClaimed);
+	if (record.attributes) {
+		const ownId = record.physicalId;
+		const ids = [...attributeIdCopiesOf.get(secrets) ?? []];
+		if (typeof ownId === "string" && ownId !== "") ids.push(ownId);
+		const attributes = record.attributes;
+		next.attributes = ids.length > 0 ? withPhysicalNameCopies(secrets, ids, () => redactForState(attributes, {
+			provenance: "value-scan",
+			secrets
+		})) : redactForState(attributes, {
+			provenance: "value-scan",
+			secrets
+		});
+	}
+	if (record.observedProperties) next.observedProperties = redactAtProvenance(record.observedProperties, secrets, sourceProperties ?? next.properties, observedProvenance ?? (sourceProperties !== void 0 ? "template-sourced" : secrets.size === 0 && observedClaimed ? "state-baseline" : "state-readback"), observedClaimed);
+	return next;
+}
+function withoutPhysicalNameCopies(secrets, run) {
+	const names = physicalNameCopiesOf.get(secrets);
+	if (names === void 0) return run();
+	physicalNameCopiesOf.delete(secrets);
+	try {
+		return run();
+	} finally {
+		physicalNameCopiesOf.set(secrets, names);
+	}
+}
+function withPhysicalNameCopies(secrets, ids, run) {
+	const previous = physicalNameCopiesOf.get(secrets);
+	const names = new Set(previous);
+	for (const id of ids) if (id !== "") names.add(id);
+	physicalNameCopiesOf.set(secrets, names);
+	try {
+		return run();
+	} finally {
+		if (previous === void 0) physicalNameCopiesOf.delete(secrets);
+		else physicalNameCopiesOf.set(secrets, previous);
+	}
+}
+function repairPhysicalNameCopyLeaves(stored, legacy, current) {
+	if (typeof stored === "string") return typeof legacy === "string" && typeof current === "string" && stored === legacy && current !== legacy ? current : stored;
+	if (Array.isArray(stored)) {
+		if (!Array.isArray(legacy) || !Array.isArray(current)) return stored;
+		if (legacy.length !== stored.length || current.length !== stored.length) return stored;
+		let changed = false;
+		const out = stored.map((item, i) => {
+			const next = repairPhysicalNameCopyLeaves(item, legacy[i], current[i]);
+			if (next !== item) changed = true;
+			return next;
+		});
+		return changed ? out : stored;
+	}
+	if (stored !== null && typeof stored === "object") {
+		if (legacy === null || typeof legacy !== "object" || Array.isArray(legacy)) return stored;
+		if (current === null || typeof current !== "object" || Array.isArray(current)) return stored;
+		const l = legacy;
+		const c = current;
+		let out;
+		for (const [key, value] of Object.entries(stored)) {
+			if (!Object.hasOwn(l, key) || !Object.hasOwn(c, key)) continue;
+			const next = repairPhysicalNameCopyLeaves(value, l[key], c[key]);
+			if (next !== value) {
+				out ??= { ...stored };
+				out[key] = next;
+			}
+		}
+		return out ?? stored;
+	}
+	return stored;
+}
+function embeddedPhysicalNameRewrites(secrets, legacySecrets = secrets) {
+	const names = physicalNameCopiesOf.get(secrets);
+	if (names === void 0) return [];
+	const pairs = [];
+	withoutPhysicalNameCopies(legacySecrets, () => {
+		for (const name of names) {
+			const legacy = redactForState(name, {
+				provenance: "value-scan",
+				secrets: legacySecrets
+			});
+			if (typeof legacy === "string" && legacy !== name && legacy.includes("{{resolve:") && !isSingleDynamicReferenceToken(legacy) && !legacy.includes("***")) pairs.push([legacy, name]);
+		}
+	});
+	return pairs;
+}
+function replaceEmbeddedPhysicalNameRewrites(value, pairs) {
+	if (pairs.length === 0) return value;
+	if (typeof value === "string") {
+		let next = value;
+		for (const [legacy, name] of pairs) next = next.split(legacy).join(name);
+		return next;
+	}
+	if (Array.isArray(value)) {
+		let changed = false;
+		const out = value.map((item) => {
+			const next = replaceEmbeddedPhysicalNameRewrites(item, pairs);
+			if (next !== item) changed = true;
+			return next;
+		});
+		return changed ? out : value;
+	}
+	if (value !== null && typeof value === "object") {
+		let out;
+		for (const [key, item] of Object.entries(value)) {
+			const next = replaceEmbeddedPhysicalNameRewrites(item, pairs);
+			if (next !== item) {
+				out ??= { ...value };
+				out[key] = next;
+			}
+		}
+		return out ?? value;
+	}
+	return value;
+}
+function repairEmbeddedPhysicalNamesTowards(stored, target, pairs) {
+	if (pairs.length === 0) return stored;
+	if (typeof stored === "string") {
+		if (typeof target !== "string" || stored === target) return stored;
+		const repaired = replaceEmbeddedPhysicalNameRewrites(stored, pairs);
+		return repaired === target ? repaired : stored;
+	}
+	if (Array.isArray(stored)) {
+		if (!Array.isArray(target) || target.length !== stored.length) return stored;
+		let changed = false;
+		const out = stored.map((item, i) => {
+			const next = repairEmbeddedPhysicalNamesTowards(item, target[i], pairs);
+			if (next !== item) changed = true;
+			return next;
+		});
+		return changed ? out : stored;
+	}
+	if (stored !== null && typeof stored === "object") {
+		if (target === null || typeof target !== "object" || Array.isArray(target)) return stored;
+		const t = target;
+		let out;
+		for (const [key, value] of Object.entries(stored)) {
+			if (!Object.hasOwn(t, key)) continue;
+			const next = repairEmbeddedPhysicalNamesTowards(value, t[key], pairs);
+			if (next !== value) {
+				out ??= { ...stored };
+				out[key] = next;
+			}
+		}
+		return out ?? stored;
+	}
+	return stored;
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/mask-errors.ts
+function maskSecretsInText(text, secrets) {
+	const logOnly = logOnlyValuesOf.get(secrets);
+	const noLogOnly = logOnly === void 0 || logOnly.size === 0;
+	if (secrets.size === 0 && noLogOnly) return text;
+	if (text !== "" && (secrets.has(text) || logOnly?.has(text) === true)) return "***";
+	return maskMatchSpans(text, printingNeedles(noLogOnly ? secrets.keys() : [...secrets.keys(), ...logOnly]), "***");
+}
+function maskRecordedSecretsInText(text, secrets) {
+	if (secrets.size === 0) return text;
+	if (text !== "" && secrets.has(text)) return "***";
+	return maskMatchSpans(text, substringNeedles(secrets.keys()), "***");
+}
+function substringNeedles(values) {
+	return [...new Set(values)].filter((value) => value.length >= 4);
+}
+const ERROR_CAUSE_MASK_MAX_DEPTH = 20;
+function errorCauseChain(root) {
+	const chain = [];
+	const seen = /* @__PURE__ */ new Set();
+	let current = root;
+	while (current instanceof Error && !seen.has(current) && chain.length < 20) {
+		seen.add(current);
+		chain.push(current);
+		current = current.cause;
+	}
+	return chain;
+}
+function readStack(error) {
+	try {
+		const stack = error.stack;
+		return typeof stack === "string" ? stack : void 0;
+	} catch {
+		return;
+	}
+}
+function maskDescriptorValue(descriptor, maskText) {
+	if (!("value" in descriptor)) return descriptor;
+	const value = maskErrorFieldValue(descriptor.value, maskText);
+	return value === descriptor.value ? descriptor : {
+		...descriptor,
+		value
+	};
+}
+const CLASSIFIER_IDENTIFIER_FIELDS = /* @__PURE__ */ new Set([
+	"name",
+	"code",
+	"Code",
+	"__type",
+	"ccErrorCode",
+	"ccOperation"
+]);
+function isAuxiliaryAnchor(key, descriptor) {
+	return key === "logicalId" && descriptor.enumerable === false && descriptor.writable === false && typeof descriptor.value === "string" && descriptor.value.endsWith("/auxiliary");
+}
+const CREATED_BEFORE_FAILURE_MARK = Symbol.for("cdkd.createdBeforeFailure");
+function isCreatedBeforeFailureMark(key, descriptor) {
+	return key === CREATED_BEFORE_FAILURE_MARK && descriptor.enumerable === false && descriptor.writable === false && typeof descriptor.value === "object" && descriptor.value !== null && Object.isFrozen(descriptor.value);
+}
+function isPlainContainer(value) {
+	const proto = Object.getPrototypeOf(value);
+	return Array.isArray(value) ? proto === Array.prototype : proto === Object.prototype || proto === null;
+}
+function readFieldNode(node) {
+	try {
+		if (!isPlainContainer(node)) return void 0;
+		const entries = [];
+		for (const key of Reflect.ownKeys(node)) {
+			const descriptor = Object.getOwnPropertyDescriptor(node, key);
+			if (descriptor) entries.push([key, descriptor]);
+		}
+		const isArray = Array.isArray(node);
+		return {
+			proto: Object.getPrototypeOf(node),
+			isArray,
+			length: isArray ? Object.getOwnPropertyDescriptor(node, "length") : void 0,
+			extensible: Object.isExtensible(node),
+			entries
+		};
+	} catch {
+		return;
+	}
+}
+function maskErrorFieldValue(value, maskText) {
+	if (typeof value === "string") return maskText(value);
+	if (typeof value !== "object" || value === null) return value;
+	try {
+		const nodes = /* @__PURE__ */ new Map();
+		const seen = /* @__PURE__ */ new Set();
+		let changed = false;
+		let frontier = [value];
+		for (let depth = 0; frontier.length > 0 && depth < 20; depth++) {
+			const next = [];
+			for (const node of frontier) {
+				if (seen.has(node)) continue;
+				seen.add(node);
+				const read = readFieldNode(node);
+				if (!read) continue;
+				nodes.set(node, read);
+				for (const [, descriptor] of read.entries) {
+					if (!("value" in descriptor)) continue;
+					const child = descriptor.value;
+					if (typeof child === "string") {
+						if (!changed && maskText(child) !== child) changed = true;
+					} else if (typeof child === "object" && child !== null) next.push(child);
+				}
+			}
+			frontier = next;
+		}
+		if (!changed) return value;
+		const copies = /* @__PURE__ */ new Map();
+		for (const [node, read] of nodes) copies.set(node, read.isArray ? new Array(read.length?.value ?? 0) : Object.create(read.proto));
+		for (const [node, read] of nodes) {
+			const copy = copies.get(node);
+			for (const [key, original] of read.entries) {
+				if (key === "length" && read.isArray) continue;
+				const descriptor = { ...original };
+				if ("value" in descriptor) {
+					const child = descriptor.value;
+					if (typeof child === "string") descriptor.value = maskText(child);
+					else if (typeof child === "object" && child !== null && copies.has(child)) descriptor.value = copies.get(child);
+				}
+				Object.defineProperty(copy, key, descriptor);
+			}
+			if (read.length?.writable === false) Object.defineProperty(copy, "length", { writable: false });
+			if (!read.extensible) Object.preventExtensions(copy);
+		}
+		return copies.get(value) ?? value;
+	} catch {
+		return value;
+	}
+}
+function maskSecretsInError(error, secrets, extraMask) {
+	if (!(error instanceof Error) || !hasMaskableValues(secrets) && !extraMask) return error;
+	const maskText = (text) => maskSecretsInText(extraMask ? extraMask(text) : text, secrets);
+	const chain = errorCauseChain(error);
+	let changed = false;
+	const links = chain.map((link) => {
+		const message = maskText(link.message);
+		const stack = readStack(link);
+		const maskedStack = typeof stack === "string" ? maskText(stack) : void 0;
+		const descriptors = {};
+		for (const key of Reflect.ownKeys(link)) {
+			if (key === "message" || key === "cause" || key === "stack") continue;
+			const descriptor = Object.getOwnPropertyDescriptor(link, key);
+			if (!descriptor) continue;
+			descriptors[key] = typeof key === "string" && CLASSIFIER_IDENTIFIER_FIELDS.has(key) && typeof descriptor.value === "string" || isAuxiliaryAnchor(key, descriptor) || isCreatedBeforeFailureMark(key, descriptor) ? descriptor : maskDescriptorValue(descriptor, maskText);
+			if (descriptors[key] !== descriptor) changed = true;
+		}
+		let cause = Object.getOwnPropertyDescriptor(link, "cause");
+		if (cause && !("value" in cause && cause.value instanceof Error)) {
+			const masked = maskDescriptorValue(cause, maskText);
+			if (masked !== cause) changed = true;
+			cause = masked;
+		}
+		if (message !== link.message || maskedStack !== stack) changed = true;
+		return {
+			message,
+			stack: maskedStack,
+			descriptors,
+			cause
+		};
+	});
+	if (!changed) return error;
+	const clones = /* @__PURE__ */ new Map();
+	for (const [i, original] of chain.entries()) {
+		const { message, stack, descriptors } = links[i];
+		const clone = Object.create(Object.getPrototypeOf(original), descriptors);
+		Object.defineProperty(clone, "message", {
+			value: message,
+			writable: true,
+			enumerable: false,
+			configurable: true
+		});
+		if (stack !== void 0) Object.defineProperty(clone, "stack", {
+			value: stack,
+			writable: true,
+			enumerable: false,
+			configurable: true
+		});
+		clones.set(original, clone);
+	}
+	for (const [i, original] of chain.entries()) {
+		const causeDescriptor = links[i].cause;
+		if (!causeDescriptor) continue;
+		const clone = clones.get(original);
+		const causeValue = original.cause;
+		const replacement = causeValue instanceof Error ? clones.get(causeValue) : void 0;
+		Object.defineProperty(clone, "cause", replacement ? {
+			value: replacement,
+			writable: true,
+			enumerable: causeDescriptor.enumerable === true,
+			configurable: true
+		} : causeDescriptor);
+	}
+	return clones.get(error);
+}
+function createSecretMasker(secrets) {
+	return (text) => maskSecretsInText(text, secrets);
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/log-only.ts
+const logOnlyValuesOf = /* @__PURE__ */ new WeakMap();
+function recordLogOnlyValue(secrets, plaintext) {
+	if (plaintext === "") return;
+	sideSetOf(logOnlyValuesOf, secrets).add(plaintext);
+}
+function carryLogOnlyValues(from, to) {
+	const values = logOnlyValuesOf.get(from);
+	if (values === void 0 || values.size === 0) return;
+	const into = sideSetOf(logOnlyValuesOf, to);
+	for (const value of values) into.add(value);
+}
+function carryLogOnlyValuesCarriedBy(from, to, value) {
+	const values = logOnlyValuesOf.get(from);
+	if (values === void 0 || values.size === 0) return;
+	const leaves = printedLeavesOf(value);
+	if (leaves.size === 0) return;
+	for (const needle of values) for (const leaf of leaves) if (leaf === needle || needle.length >= 4 && leaf.includes(needle)) {
+		recordLogOnlyValue(to, needle);
+		break;
+	}
+	carryListElementFragments(values, to, value);
+}
+function carryListElementFragments(needles, to, value) {
+	if (!Array.isArray(value) || value.length === 0) return;
+	if (!value.every((e) => typeof e === "string" || typeof e === "number" || typeof e === "boolean")) return;
+	const numeric = value.every((element) => typeof element === "number");
+	const joined = value.map((element) => String(element)).join(",");
+	for (const needle of [...needles]) {
+		const pieces = needle.split(",").map((piece) => piece.trim());
+		if (numeric && pieces.every((piece) => piece === "" || Number.isNaN(Number(piece)))) continue;
+		const fragments = fragmentsOfNeedleIn(joined, ",", pieces.map((piece) => numeric ? String(Number(piece)) : piece).join(","));
+		if (fragments.size === 0) continue;
+		recordLogOnlyValue(to, needle);
+		for (const fragment of fragments) recordLogOnlyValue(to, fragment);
+	}
+}
+function recordLogOnlySplitFragments(from, to, text, delimiter, printed) {
+	if (delimiter === "") return;
+	const splits = [text.split(delimiter)];
+	if (printed !== void 0 && (printed.length !== splits[0].length || printed.some((piece, i) => piece !== splits[0][i]))) splits.push(printed);
+	for (const bag of from) {
+		if (bag === void 0) continue;
+		for (const needle of [...logOnlyValuesOf.get(bag) ?? []]) for (const pieces of splits) for (const fragment of fragmentsOfNeedleIn(text, delimiter, needle, pieces)) if (fragment !== needle) recordLogOnlyValue(to, fragment);
+	}
+}
+function fragmentsOfNeedleIn(text, delimiter, needle, pieces = text.split(delimiter)) {
+	const fragments = /* @__PURE__ */ new Set();
+	if (needle === "") return fragments;
+	const starts = [];
+	if (text === needle) starts.push(0);
+	else if (needle.length >= 4) for (let at = text.indexOf(needle); at !== -1; at = text.indexOf(needle, at + 1)) starts.push(at);
+	if (starts.length === 0) return fragments;
+	const spans = [];
+	let offset = 0;
+	for (const piece of pieces) {
+		spans.push([offset, offset + piece.length]);
+		offset += piece.length + delimiter.length;
+	}
+	for (const start of starts) {
+		const end = start + needle.length;
+		for (const [pieceStart, pieceEnd] of spans) {
+			const from = Math.max(pieceStart, start);
+			const to = Math.min(pieceEnd, end);
+			if (from < to) fragments.add(text.slice(from, to));
+		}
+	}
+	return fragments;
+}
+function printedLeavesOf(value) {
+	const leaves = wholeStringLeavesOf(value);
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (node) => {
+		if (typeof node === "number" || typeof node === "boolean") {
+			leaves.add(String(node));
+			return;
+		}
+		if (node === null || typeof node !== "object") return;
+		if (seen.has(node)) return;
+		seen.add(node);
+		for (const child of Array.isArray(node) ? node : Object.values(node)) walk(child);
+	};
+	walk(value);
+	return leaves;
+}
+function shareLogOnlyValues(view, target) {
+	logOnlyValuesOf.set(view, sideSetOf(logOnlyValuesOf, target));
+}
+function recordLogOnlyParameterValue(secrets, value, splitDelimiters) {
+	const record = (leaf) => {
+		const spelled = typeof leaf === "string" ? leaf : typeof leaf === "number" || typeof leaf === "boolean" ? String(leaf) : void 0;
+		if (spelled === void 0) return;
+		recordLogOnlyValue(secrets, spelled);
+		for (const delimiter of splitDelimiters ?? []) {
+			if (delimiter === "" || !spelled.includes(delimiter)) continue;
+			for (const piece of spelled.split(delimiter)) recordLogOnlyValue(secrets, piece);
+		}
+	};
+	if (Array.isArray(value)) {
+		for (const element of value) record(element);
+		record(value.map((element) => String(element)).join(","));
+		return;
+	}
+	record(value);
+}
+function literalSplitDelimitersOf(template, parameters) {
+	const delimiters = /* @__PURE__ */ new Set();
+	if (parameters.size === 0) return delimiters;
+	const reads = (node, seen) => {
+		if (typeof node === "string") {
+			for (const name of parameters) if (node.includes(`\${${name}}`)) return true;
+			return false;
+		}
+		if (node === null || typeof node !== "object" || seen.has(node)) return false;
+		seen.add(node);
+		if (!Array.isArray(node)) {
+			const ref = node["Ref"];
+			if (typeof ref === "string" && parameters.has(ref)) return true;
+		}
+		for (const child of Array.isArray(node) ? node : Object.values(node)) if (reads(child, seen)) return true;
+		return false;
+	};
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (node) => {
+		if (node === null || typeof node !== "object" || seen.has(node)) return;
+		seen.add(node);
+		if (Array.isArray(node)) {
+			for (const child of node) walk(child);
+			return;
+		}
+		for (const [key, child] of Object.entries(node)) {
+			if (key === "Fn::Split" && Array.isArray(child) && typeof child[0] === "string" && reads(child[1], /* @__PURE__ */ new Set())) delimiters.add(child[0]);
+			walk(child);
+		}
+	};
+	walk(template);
+	return delimiters;
+}
+function printingCorpusOf(secrets) {
+	const logOnly = logOnlyValuesOf.get(secrets);
+	if (logOnly === void 0 || logOnly.size === 0) return secrets;
+	const corpus = new Map(secrets);
+	for (const needle of logOnly) if (!corpus.has(needle)) corpus.set(needle, "***");
+	return corpus;
+}
+function logOnlyValueCount(secrets) {
+	return logOnlyValuesOf.get(secrets)?.size ?? 0;
+}
+function unionOfSecretBags(bags) {
+	const union = /* @__PURE__ */ new Map();
+	for (const bag of bags) {
+		if (bag === void 0) continue;
+		for (const [plaintext, expression] of bag) if (!union.has(plaintext)) union.set(plaintext, expression);
+		carryLogOnlyValues(bag, union);
+	}
+	return union;
+}
+function createUnionSecretMasker(bags) {
+	const present = bags.filter((bag) => bag !== void 0);
+	let stamp;
+	let needles = /* @__PURE__ */ new Set();
+	let scanned = [];
+	return (text) => {
+		const now = present.map((bag) => `${bag.size}:${logOnlyValueCount(bag)}`).join(",");
+		if (now !== stamp) {
+			needles = /* @__PURE__ */ new Set();
+			for (const bag of present) {
+				for (const plaintext of bag.keys()) needles.add(plaintext);
+				for (const plaintext of logOnlyValuesOf.get(bag) ?? []) needles.add(plaintext);
+			}
+			scanned = printingNeedles(needles);
+			stamp = now;
+		}
+		if (text !== "" && needles.has(text)) return "***";
+		return maskMatchSpans(text, scanned, "***");
+	};
+}
+function hasLogOnlyValues(secrets) {
+	if (secrets === void 0) return false;
+	const logOnly = logOnlyValuesOf.get(secrets);
+	return logOnly !== void 0 && logOnly.size > 0;
+}
+function hasMaskableValues(secrets) {
+	if (secrets === void 0) return false;
+	if (secrets.size > 0) return true;
+	const logOnly = logOnlyValuesOf.get(secrets);
+	return logOnly !== void 0 && logOnly.size > 0;
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/reference-provenance.ts
+const passProvenanceOf = /* @__PURE__ */ new WeakMap();
+const MAX_REFERENCE_VERSIONS = 8;
+function provenanceTableFor(secrets) {
+	let table = passProvenanceOf.get(secrets);
+	if (table === void 0) {
+		table = /* @__PURE__ */ new Map();
+		passProvenanceOf.set(secrets, table);
+	}
+	return table;
+}
+function shareReferenceProvenance(view, pass) {
+	passProvenanceOf.set(view, provenanceTableFor(pass));
+}
+function entryFor(secrets, token) {
+	const table = provenanceTableFor(secrets);
+	let entry = table.get(token);
+	if (entry === void 0) {
+		entry = {
+			regions: /* @__PURE__ */ new Set(),
+			regionUnknown: false,
+			versions: /* @__PURE__ */ new Set(),
+			versionUnknown: false,
+			readVersions: /* @__PURE__ */ new Set()
+		};
+		table.set(token, entry);
+	}
+	return entry;
+}
+function recordReferenceResolution(secrets, token, resolution) {
+	const entry = entryFor(secrets, token);
+	if (resolution.region === void 0) entry.regionUnknown = true;
+	else entry.regions.add(resolution.region);
+	if (resolution.version === void 0) {
+		entry.versionUnknown = true;
+		return;
+	}
+	entry.versions.add(resolution.version);
+	if (resolution.route === "read") entry.readVersions.add(resolution.version);
+}
+function recordReferenceProvenanceEntry(secrets, token, provenance, route) {
+	const entry = entryFor(secrets, token);
+	if (provenance.region === void 0) entry.regionUnknown = true;
+	else entry.regions.add(provenance.region);
+	if (provenance.versions === void 0 || provenance.versions.length === 0) {
+		entry.versionUnknown = true;
+		return;
+	}
+	for (const version of provenance.versions) {
+		entry.versions.add(version);
+		if (route === "read") entry.readVersions.add(version);
+	}
+	if (route === "literal") for (const version of provenance.readVersions ?? []) entry.readVersions.add(version);
+}
+function mergeReferenceProvenance(from, to) {
+	const source = passProvenanceOf.get(from);
+	if (source === void 0 || from === to) return;
+	for (const [token, entry] of source) {
+		const target = entryFor(to, token);
+		for (const region of entry.regions) target.regions.add(region);
+		target.regionUnknown ||= entry.regionUnknown;
+		for (const version of entry.versions) target.versions.add(version);
+		target.versionUnknown ||= entry.versionUnknown;
+		for (const version of entry.readVersions) target.readVersions.add(version);
+	}
+}
+function hasPassProvenance(secrets) {
+	if (secrets === void 0) return false;
+	const table = passProvenanceOf.get(secrets);
+	return table !== void 0 && table.size > 0;
+}
+function passProvenanceFor(secrets, token) {
+	if (secrets === void 0) return void 0;
+	const entry = passProvenanceOf.get(secrets)?.get(token);
+	if (entry === void 0) return void 0;
+	return finalize(entry);
+}
+function passReadVersionsFor(secrets, token) {
+	if (secrets === void 0) return void 0;
+	const read = passProvenanceOf.get(secrets)?.get(token)?.readVersions;
+	return read === void 0 || read.size === 0 ? void 0 : read;
+}
+function finalize(entry) {
+	const out = {};
+	if (!entry.regionUnknown && entry.regions.size === 1) out.region = [...entry.regions][0];
+	if (!entry.versionUnknown && entry.versions.size > 0 && entry.versions.size <= 8) {
+		out.versions = [...entry.versions].sort();
+		if (entry.readVersions.size > 0) out.readVersions = [...entry.readVersions].sort();
+	}
+	return out;
+}
+function snapshotPassProvenance(secrets) {
+	if (secrets === void 0) return void 0;
+	const table = passProvenanceOf.get(secrets);
+	if (table === void 0 || table.size === 0) return void 0;
+	const out = /* @__PURE__ */ new Map();
+	for (const [token, entry] of table) out.set(token, finalize(entry));
+	return out;
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/recording.ts
+const scopeMaps = /* @__PURE__ */ new WeakSet();
+var WriteThroughSecrets = class extends Map {
+	pass;
+	constructor(pass) {
+		super();
+		this.pass = pass;
+	}
+	set(plaintext, expression) {
+		super.set(plaintext, expression);
+		this.pass.set(plaintext, expression);
+		return this;
+	}
+};
+function openRecordingScope(pass, policy) {
+	const secrets = new WriteThroughSecrets(pass);
+	scopeMaps.add(secrets);
+	shareLogOnlyValues(secrets, pass);
+	for (const [kind, share] of Object.entries(SCOPE_SHARERS)) if (policy[kind] === "carry") share(secrets, pass);
+	return {
+		secrets,
+		pass
+	};
+}
+const SCOPE_SHARERS = {
+	pairs: sharePairTable,
+	"mask-only-marks": (scope, pass) => {
+		for (const table of [
+			freshNoEchoValuesOf,
+			containmentValuesOf,
+			noEchoParameterValuesOf
+		]) table.set(scope, sideSetOf(table, pass));
+	},
+	"reference-provenance": shareReferenceProvenance,
+	"physical-name-copies": (scope, pass) => {
+		physicalNameCopiesOf.set(scope, sideSetOf(physicalNameCopiesOf, pass));
+	},
+	"public-proofs": sharePublicProofs
+};
+function isRecordingScope(secrets) {
+	return scopeMaps.has(secrets);
+}
+function foldRecording(from, to, policy) {
+	if (from === to) return;
+	for (const [plaintext, expression] of from) to.set(plaintext, expression);
+	for (const [kind, carry] of Object.entries(FOLD_CARRIERS)) if (policy[kind] === "carry") carry(from, to);
+}
+const FOLD_CARRIERS = {
+	"mask-only-marks": carryMaskOnlyMarks,
+	"reference-provenance": mergeReferenceProvenance,
+	pairs: mergePairTables,
+	"log-only": carryLogOnlyValues,
+	"physical-name-copies": (from, to) => {
+		for (const physicalId of physicalNameCopiesOf.get(from) ?? []) recordPhysicalNameCopy(to, physicalId);
+	},
+	"public-proofs": carryPublicProofs
+};
+function recordSecretResolution(secrets, expression, plaintext, options) {
+	secrets.set(plaintext, expression);
+	if (options.pairEvidence) recordResolvedPair(secrets, expression, plaintext);
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/context.ts
+const RULES_BY_PROVENANCE = {
+	"template-derived": TEMPLATE_DERIVED_RULES,
+	"template-sourced": TEMPLATE_SOURCED_RULES,
+	"state-readback": STATE_SOURCED_READBACK_RULES,
+	"state-baseline": STATE_SOURCED_BASELINE_RULES,
+	"state-cross-generation": STATE_SOURCED_CROSS_GENERATION_RULES,
+	"state-derived": STATE_DERIVED_RULES
+};
+function redactForState(bag, context) {
+	refuseScopeAsPass(context.secrets);
+	if (context.provenance === "value-scan") return redactSecretsForState(bag, context.secrets);
+	const { secrets, source, provenance } = context;
+	if (!((context.provenance === "template-derived" || context.provenance === "template-sourced" || context.provenance === "state-derived") && context.generation === "same-generation") || !isPlainBag(bag)) return redactAtProvenance(bag, secrets, source, provenance, false);
+	const copy = shallowCopy(bag);
+	const redacted = redactAtProvenance(copy, secrets, source, provenance, true);
+	return redacted === copy ? shallowCopy(copy) : redacted;
+}
+function redactAtProvenance(bag, secrets, source, provenance, sameGeneration) {
+	refuseScopeAsPass(secrets);
+	return redactSecretsForState(bag, secrets, source, RULES_BY_PROVENANCE[provenance], sameGeneration);
+}
+function refuseScopeAsPass(secrets) {
+	if (isRecordingScope(secrets)) throw new Error("Internal error: a bag was redacted for persistence with a recording scope; pass the scope's pass map instead.");
+}
+function isPlainBag(bag) {
+	if (Array.isArray(bag)) return true;
+	if (bag === null || typeof bag !== "object") return false;
+	const proto = Object.getPrototypeOf(bag);
+	return proto === Object.prototype || proto === null;
+}
+function shallowCopy(bag) {
+	return Array.isArray(bag) ? [...bag] : { ...bag };
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/positions.ts
+const SKELETON_WILDCARD = `${DYNAMIC_REFERENCE_INNER_CHAR}*`;
+const MAX_SKELETON_WILDCARDS = 3;
+const MAX_SKELETON_CANDIDATE_LENGTH = 512;
+function joinSkeletonSegments(segments) {
+	const out = [];
+	let wildcards = 0;
+	for (const segment of segments) {
+		if (segment === "") continue;
+		if (segment === SKELETON_WILDCARD) {
+			if (out[out.length - 1] === SKELETON_WILDCARD) continue;
+			wildcards += 1;
+			if (wildcards > MAX_SKELETON_WILDCARDS) return void 0;
+		}
+		out.push(segment);
+	}
+	return out.join("");
+}
+function intrinsicSkeletonPattern(source) {
+	const segments = intrinsicSkeletonSegments(source);
+	if (segments === void 0) return void 0;
+	return anchoredSkeletonPattern(segments);
+}
+function anchoredSkeletonPattern(segments) {
+	const body = joinSkeletonSegments(segments.map((segment) => segment === UNKNOWN_PART ? SKELETON_WILDCARD : escapeRegExp(segment)));
+	return body === void 0 ? void 0 : new RegExp(`^${body}$`);
+}
+const UNKNOWN_PART = Symbol("unknown intrinsic part");
+const UNKNOWN_PART_PLACEHOLDER = "\0";
+function joinPartLiteralText(part) {
+	if (typeof part === "string") return part;
+	if (typeof part === "number" || typeof part === "boolean") return String(part);
+}
+function intrinsicSkeletonSegments(source) {
+	const keys = Object.keys(source);
+	if (keys.length !== 1) return void 0;
+	const key = keys[0];
+	if (key === "Fn::Join") {
+		const args = source[key];
+		if (!Array.isArray(args) || args.length !== 2) return void 0;
+		const [delimiter, parts] = args;
+		if (typeof delimiter !== "string" || !Array.isArray(parts)) return void 0;
+		const segments = [];
+		parts.forEach((part, index) => {
+			if (index > 0) segments.push(delimiter);
+			segments.push(joinPartLiteralText(part) ?? UNKNOWN_PART);
+		});
+		return segments;
+	}
+	if (key === "Fn::Sub") {
+		const args = source[key];
+		const template = typeof args === "string" ? args : Array.isArray(args) ? args[0] : void 0;
+		if (typeof template !== "string") return void 0;
+		const segments = [];
+		let cursor = 0;
+		const variable = /\$\{([^}]*)\}/g;
+		let hit;
+		while ((hit = variable.exec(template)) !== null) {
+			segments.push(template.slice(cursor, hit.index));
+			const inner = hit[1];
+			segments.push(inner.startsWith("!") ? `\${${inner.slice(1)}}` : UNKNOWN_PART);
+			cursor = hit.index + hit[0].length;
+		}
+		segments.push(template.slice(cursor));
+		return segments;
+	}
+}
+function positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions) {
+	if (bag === "" || !secrets.has(bag)) return void 0;
+	const pattern = intrinsicSkeletonPattern(source);
+	if (!pattern) return void 0;
+	const plaintextOf = plaintextIndexOf(secrets);
+	let matched;
+	for (const candidate of /* @__PURE__ */ new Set([...secretExpressions, ...recordedSecretExpressions])) {
+		if (candidate.length > MAX_SKELETON_CANDIDATE_LENGTH) return void 0;
+		if (!pattern.test(candidate)) continue;
+		const recordedPlaintext = plaintextOf.get(candidate);
+		if (recordedPlaintext !== void 0 && recordedPlaintext !== bag) continue;
+		if (matched !== void 0) return void 0;
+		matched = candidate;
+	}
+	return matched;
+}
+function singleSpanFrame(bag, source) {
+	const spans = dynamicReferenceSpans(source);
+	if (spans.length !== 1) return void 0;
+	const [span] = spans;
+	const token = source.slice(span.start, span.end);
+	const prefix = source.slice(0, span.start);
+	const suffix = source.slice(span.end);
+	if (bag.length <= prefix.length + suffix.length) return void 0;
+	if (!bag.startsWith(prefix) || !bag.endsWith(suffix)) return void 0;
+	const middle = bag.slice(prefix.length, bag.length - suffix.length);
+	if (isSingleDynamicReferenceToken(middle)) return void 0;
+	return {
+		token,
+		prefix,
+		suffix,
+		middle
+	};
+}
+function positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration) {
+	const frame = singleSpanFrame(bag, source);
+	if (frame === void 0) {
+		if (dynamicReferenceSpans(source).length >= 2) {
+			if (certifiesRenderedLiteral(bag, source, secrets, bagIsSameGeneration)) return source;
+			if (bagIsSameGeneration) {
+				const mixed = certifiedMixedLiteral(bag, source, secrets);
+				if (mixed !== void 0) return mixed;
+			}
+		}
+		return redactForState(bag, {
+			provenance: "value-scan",
+			secrets
+		});
+	}
+	const recorded = resolvedPlaintextOf(secrets, frame.token);
+	if (recorded === void 0 || recorded !== frame.middle) return redactForState(bag, {
+		provenance: "value-scan",
+		secrets
+	});
+	return writeFramedTokenWithinScanBound(bag, secrets, frame, bagIsSameGeneration);
+}
+function pairedSpans(source, secrets) {
+	const spans = dynamicReferenceSpans(source);
+	if (spans.length === 0) return void 0;
+	const out = [];
+	for (const span of spans) {
+		const plaintext = resolvedPlaintextOf(secrets, source.slice(span.start, span.end));
+		if (plaintext === void 0 || plaintext === "") return void 0;
+		if (isSingleDynamicReferenceToken(plaintext)) return void 0;
+		out.push({
+			...span,
+			plaintext
+		});
+	}
+	return out;
+}
+function renderedTokenOf(spelling, secrets, plaintext) {
+	const spans = pairedSpans(spelling, secrets);
+	if (spans === void 0) return void 0;
+	const tokens = new Set(spans.filter((span) => span.plaintext === plaintext).map((span) => spelling.slice(span.start, span.end)));
+	return tokens.size === 1 ? [...tokens][0] : void 0;
+}
+function renderSpans(source, spans, textOf) {
+	let out = "";
+	let cursor = 0;
+	spans.forEach((span, index) => {
+		out += source.slice(cursor, span.start) + textOf(index);
+		cursor = span.end;
+	});
+	return out + source.slice(cursor);
+}
+function rendersLiteralTo(spelling, secrets, value) {
+	return renderedLiteralSpans(spelling, secrets, value) !== void 0;
+}
+function renderedLiteralSpans(spelling, secrets, value) {
+	const spans = pairedSpans(spelling, secrets);
+	if (spans === void 0) return void 0;
+	if (renderSpans(spelling, spans, (i) => spans[i].plaintext) !== value) return void 0;
+	return redactForState(spelling, {
+		provenance: "value-scan",
+		secrets
+	}) === spelling ? spans : void 0;
+}
+function certifiesRenderedLiteral(bag, source, secrets, bagIsSameGeneration) {
+	const spans = renderedLiteralSpans(source, secrets, bag);
+	if (spans === void 0) return false;
+	const survivors = [];
+	for (const span of spans) {
+		const survivor = secrets.get(span.plaintext);
+		if (survivor === void 0) return false;
+		survivors.push(survivor);
+	}
+	const scanned = redactForState(bag, {
+		provenance: "value-scan",
+		secrets
+	});
+	if (scanned === renderSpans(source, spans, (i) => survivors[i])) return true;
+	if (!bagIsSameGeneration) return false;
+	return scanned === renderSpans(source, spans, (i) => spans[i].plaintext.length >= 4 ? survivors[i] : spans[i].plaintext);
+}
+function certifiedMixedLiteral(bag, source, secrets) {
+	if (legacyMixedScan.has(secrets)) return void 0;
+	const answer = certifyMixedLiteral(bag, source, secrets);
+	if (answer !== void 0) mixedAnswered.add(secrets);
+	return answer;
+}
+const mixedAnswered = /* @__PURE__ */ new WeakSet();
+const legacyMixedScan = /* @__PURE__ */ new WeakSet();
+function mixedLiteralAnswered(secrets) {
+	return mixedAnswered.has(secrets);
+}
+function withLegacyMixedScan(secrets, run) {
+	if (legacyMixedScan.has(secrets)) return run();
+	legacyMixedScan.add(secrets);
+	try {
+		return run();
+	} finally {
+		legacyMixedScan.delete(secrets);
+	}
+}
+function certifyMixedLiteral(bag, source, secrets) {
+	const spans = dynamicReferenceSpans(source);
+	const parts = [];
+	for (const span of spans) {
+		const token = source.slice(span.start, span.end);
+		const plaintext = resolvedPlaintextOf(secrets, token);
+		if (plaintext !== void 0) {
+			if (plaintext === "" || isSingleDynamicReferenceToken(plaintext)) return void 0;
+			const survivor = secrets.get(plaintext);
+			if (survivor === void 0) return void 0;
+			parts.push({
+				kind: "secret",
+				plaintext,
+				survivor
+			});
+			continue;
+		}
+		const value = provenPublicValue(secrets, token);
+		if (value === void 0 || value === "" || value.includes("{{resolve:")) return void 0;
+		parts.push({
+			kind: "public",
+			value
+		});
+	}
+	const secretParts = parts.filter((p) => p.kind === "secret");
+	const publicParts = parts.filter((p) => p.kind === "public");
+	if (secretParts.length === 0 || publicParts.length === 0) return void 0;
+	const textOf = (secret) => (i) => {
+		const part = parts[i];
+		return part.kind === "secret" ? secret(part) : part.value;
+	};
+	if (renderSpans(source, spans, textOf((p) => p.plaintext)) !== bag) return void 0;
+	if (redactForState(source, {
+		provenance: "value-scan",
+		secrets
+	}) !== source) return void 0;
+	if (redactForState(bag, {
+		provenance: "value-scan",
+		secrets
+	}) !== renderSpans(source, spans, textOf((p) => p.plaintext.length >= 4 ? p.survivor : p.plaintext))) return void 0;
+	return renderSpans(source, spans, (i) => {
+		const part = parts[i];
+		return part.kind === "secret" ? source.slice(spans[i].start, spans[i].end) : part.value;
+	});
+}
+function writeFramedTokenWithinScanBound(bag, secrets, frame, bagIsSameGeneration) {
+	const scanned = redactForState(bag, {
+		provenance: "value-scan",
+		secrets
+	});
+	const { token, prefix, suffix, middle } = frame;
+	const survivor = secrets.get(middle);
+	if (survivor === void 0) return scanned;
+	if (scanned === prefix + survivor + suffix) return prefix + token + suffix;
+	if (bagIsSameGeneration && scanned === bag) return prefix + token + suffix;
+	return scanned;
+}
+function positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIsSameGeneration) {
+	const segments = intrinsicSkeletonSegments(source);
+	if (segments === void 0) return void 0;
+	if (segments.some((s) => s !== UNKNOWN_PART && s.includes("\0"))) return;
+	const frame = singleSpanFrame(bag, segments.map((s) => s === UNKNOWN_PART ? "\0" : s).join(""));
+	if (frame === void 0) return void 0;
+	const { token, prefix, suffix, middle } = frame;
+	if (prefix.includes("\0") || suffix.includes("\0")) return;
+	const pattern = anchoredSkeletonPattern(token.split("\0").flatMap((literal, i) => i === 0 ? [literal] : [UNKNOWN_PART, literal]));
+	if (pattern === void 0) return void 0;
+	const plaintextOf = plaintextIndexOf(secrets);
+	let matched;
+	for (const candidate of /* @__PURE__ */ new Set([
+		...secretExpressions,
+		...recordedSecretExpressions,
+		...resolvedExpressionsOf(secrets)
+	])) {
+		if (candidate.length > MAX_SKELETON_CANDIDATE_LENGTH) return void 0;
+		if (!pattern.test(candidate)) continue;
+		const recordedPlaintext = plaintextOf.get(candidate);
+		if (recordedPlaintext !== void 0 && recordedPlaintext !== middle) continue;
+		if (matched !== void 0) return void 0;
+		matched = candidate;
+	}
+	if (matched === void 0 || resolvedPlaintextOf(secrets, matched) !== middle) return;
+	return writeFramedTokenWithinScanBound(bag, secrets, {
+		token: matched,
+		prefix,
+		suffix,
+		middle
+	}, bagIsSameGeneration);
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/pairs.ts
+const resolvedPairsOf = /* @__PURE__ */ new WeakMap();
+const CONFLICTING_PLAINTEXT = Symbol("conflicting plaintext");
+function pairsFor(secrets) {
+	let pairs = resolvedPairsOf.get(secrets);
+	if (pairs === void 0) {
+		pairs = /* @__PURE__ */ new Map();
+		resolvedPairsOf.set(secrets, pairs);
+	}
+	return pairs;
+}
+function recordResolvedPair(secrets, expression, plaintext) {
+	const pairs = pairsFor(secrets);
+	const previous = pairs.get(expression);
+	if (previous === void 0) pairs.set(expression, plaintext);
+	else if (previous !== plaintext) pairs.set(expression, CONFLICTING_PLAINTEXT);
+}
+function mergeResolvedPairs(from, to) {
+	carryMaskOnlyMarks(from, to);
+	mergeReferenceProvenance(from, to);
+	mergePairTables(from, to);
+}
+function mergePairTables(from, to) {
+	const pairs = resolvedPairsOf.get(from);
+	if (pairs === void 0) return;
+	for (const [expression, plaintext] of pairs) if (typeof plaintext === "string") recordResolvedPair(to, expression, plaintext);
+	else pairsFor(to).set(expression, CONFLICTING_PLAINTEXT);
+}
+function sharePairTable(view, pass) {
+	resolvedPairsOf.set(view, pairsFor(pass));
+}
+function resolvedPlaintextOf(secrets, expression) {
+	const recorded = resolvedPairsOf.get(secrets)?.get(expression);
+	return typeof recorded === "string" ? recorded : void 0;
+}
+function resolvedExpressionsOf(secrets) {
+	return [...resolvedPairsOf.get(secrets)?.keys() ?? []];
+}
+const CONFLICTING_LEAF_RESOLUTION = Symbol("conflicting leaf resolution");
+const intrinsicLeafResolutionsOf = /* @__PURE__ */ new WeakMap();
+function recordIntrinsicLeafResolution(secrets, source, resolution) {
+	let leaves = intrinsicLeafResolutionsOf.get(secrets);
+	if (leaves === void 0) {
+		leaves = /* @__PURE__ */ new WeakMap();
+		intrinsicLeafResolutionsOf.set(secrets, leaves);
+	}
+	const copy = {
+		input: resolution.input,
+		output: resolution.output,
+		substitutions: resolution.substitutions.map(({ token, value, secret }) => ({
+			token,
+			value,
+			secret
+		})),
+		complete: resolution.complete,
+		...resolution.parameterSpans === void 0 ? {} : { parameterSpans: resolution.parameterSpans.map(({ start, length, key }) => ({
+			start,
+			length,
+			key
+		})) }
+	};
+	const previous = leaves.get(source);
+	if (previous === void 0) leaves.set(source, copy);
+	else if (previous === CONFLICTING_LEAF_RESOLUTION || !sameLeafResolution(previous, copy)) leaves.set(source, CONFLICTING_LEAF_RESOLUTION);
+}
+function intrinsicLeafResolutionOf(secrets, source) {
+	const resolution = intrinsicLeafResolutionsOf.get(secrets)?.get(source);
+	return resolution === CONFLICTING_LEAF_RESOLUTION ? void 0 : resolution;
+}
+function recordIntrinsicLeafResolutionAs(secrets, source, branch) {
+	let leaves = intrinsicLeafResolutionsOf.get(secrets);
+	const resolution = typeof branch === "object" && branch !== null ? leaves?.get(branch) : void 0;
+	if (resolution === void 0 || resolution === CONFLICTING_LEAF_RESOLUTION) {
+		if (leaves === void 0) {
+			leaves = /* @__PURE__ */ new WeakMap();
+			intrinsicLeafResolutionsOf.set(secrets, leaves);
+		}
+		leaves.set(source, CONFLICTING_LEAF_RESOLUTION);
+		return;
+	}
+	recordIntrinsicLeafResolution(secrets, source, resolution);
+}
+function sameLeafResolution(a, b) {
+	return a.input === b.input && a.output === b.output && a.complete === b.complete && a.substitutions.length === b.substitutions.length && a.substitutions.every((s, i) => s.token === b.substitutions[i].token && s.value === b.substitutions[i].value && s.secret === b.substitutions[i].secret) && sameParameterSpans(a.parameterSpans, b.parameterSpans);
+}
+function sameParameterSpans(a, b) {
+	if (a === void 0 || b === void 0) return a === b;
+	return a.length === b.length && a.every((s, i) => s.start === b[i].start && s.length === b[i].length && s.key === b[i].key);
+}
+function substitutedSpellingOf(secrets, source, resolvedValue) {
+	const resolution = intrinsicLeafResolutionsOf.get(secrets)?.get(source);
+	if (resolution === void 0 || resolution === CONFLICTING_LEAF_RESOLUTION) return void 0;
+	if (!resolution.complete || resolution.output !== resolvedValue) return void 0;
+	if (resolution.substitutions.length !== 1) return void 0;
+	const [substitution] = resolution.substitutions;
+	if (!substitution.secret) return void 0;
+	const frame = singleSpanFrame(resolvedValue, resolution.input);
+	if (frame === void 0) return void 0;
+	if (frame.token !== substitution.token || frame.middle !== substitution.value) return void 0;
+	for (const plaintext of secrets.keys()) {
+		if (plaintext === "") continue;
+		const outsideToken = frame.prefix.includes(plaintext) || frame.suffix.includes(plaintext);
+		if (plaintext === substitution.value ? outsideToken : resolution.input.includes(plaintext)) return;
+	}
+	return resolution.input;
+}
+const sameGenerationBags = /* @__PURE__ */ new WeakSet();
+function markSameGenerationBag(bag) {
+	sameGenerationBags.add(bag);
+	return bag;
+}
+function isSameGenerationBag(bag) {
+	return sameGenerationBags.has(bag);
+}
+const leafCertifiedBags = /* @__PURE__ */ new WeakSet();
+function markLeafCertifiedBag(bag) {
+	leafCertifiedBags.add(bag);
+	return bag;
+}
+function isLeafCertifiedBag(bag) {
+	return leafCertifiedBags.has(bag);
+}
+function redactionClaimOf(bag) {
+	return isSameGenerationBag(bag) || isLeafCertifiedBag(bag) ? "same-generation" : "unproven";
+}
+function carryRedactionMarks(from, to) {
+	if (isSameGenerationBag(from)) markSameGenerationBag(to);
+	if (isLeafCertifiedBag(from)) markLeafCertifiedBag(to);
+	return to;
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/unresolved-token-frame.ts
+function liveMatchesUnresolvedTokenFrame(send, live, unresolvedTokens, secrets) {
+	const wildcards = dynamicReferenceSpans(send).filter((span) => unresolvedTokens.has(send.slice(span.start, span.end)));
+	if (wildcards.length === 0) return false;
+	if (wildcardOverlapsResolvedPlaintext(send, wildcards, secrets)) return false;
+	const literals = [];
+	let at = 0;
+	for (const span of wildcards) {
+		literals.push(send.slice(at, span.start));
+		at = span.end;
+	}
+	literals.push(send.slice(at));
+	const first = literals[0];
+	const last = literals[literals.length - 1];
+	if (live.length < first.length + last.length) return false;
+	if (!live.startsWith(first) || !live.endsWith(last)) return false;
+	let pos = first.length;
+	const end = live.length - last.length;
+	for (let i = 1; i < literals.length - 1; i++) {
+		const literal = literals[i];
+		const found = live.indexOf(literal, pos);
+		if (found < 0 || found + literal.length > end) return false;
+		pos = found + literal.length;
+	}
+	return true;
+}
+function wildcardOverlapsResolvedPlaintext(send, wildcards, secrets) {
+	for (const plaintext of secrets.keys()) {
+		if (plaintext === "") continue;
+		for (let from = send.indexOf(plaintext); from >= 0; from = send.indexOf(plaintext, from + 1)) {
+			const to = from + plaintext.length;
+			if (wildcards.some((span) => span.start < to && from < span.end)) return true;
+		}
+	}
+	return false;
+}
+
+//#endregion
+//#region src/deployment/secret-redaction/noecho-leaves.ts
+const SUB_VARIABLE = /\$\{([^}!][^}]*)\}/g;
+function intrinsicKeyOf(node) {
+	const keys = Object.keys(node);
+	if (keys.length !== 1) return void 0;
+	const key = keys[0];
+	return key === "Ref" || key.startsWith("Fn::") ? key : void 0;
+}
+function conditionVerdict(sources, name) {
+	if (typeof name !== "string" || sources.conditions === void 0) return void 0;
+	return Object.hasOwn(sources.conditions, name) ? sources.conditions[name] : void 0;
+}
+function getAttReadsNoEcho(argument, sources) {
+	if (sources.attributeIsNoEcho === void 0) return false;
+	let target;
+	let attribute;
+	if (typeof argument === "string") {
+		const dot = argument.indexOf(".");
+		if (dot <= 0) return false;
+		target = argument.slice(0, dot);
+		attribute = argument.slice(dot + 1);
+	} else if (Array.isArray(argument) && argument.length === 2) [target, attribute] = argument;
+	else return false;
+	if (typeof target !== "string") return false;
+	if (typeof attribute !== "string") return readsNoEchoSource(attribute, sources);
+	return sources.attributeIsNoEcho(target, attribute);
+}
+function subStringReadsNoEcho(text, variables, sources) {
+	for (const match of text.matchAll(SUB_VARIABLE)) {
+		const name = match[1].trim();
+		if (variables !== void 0 && Object.hasOwn(variables, name)) continue;
+		if (sources.parameters.has(name)) return true;
+		const dot = name.indexOf(".");
+		if (dot > 0 && sources.attributeIsNoEcho?.(name.slice(0, dot), name.slice(dot + 1)) === true) return true;
+	}
+	return false;
+}
+function readsNoEchoSource(node, sources) {
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (value) => {
+		if (value === null || typeof value !== "object") return false;
+		if (seen.has(value)) return false;
+		seen.add(value);
+		if (Array.isArray(value)) return value.some(walk);
+		const record = value;
+		const intrinsic = intrinsicKeyOf(record);
+		if (intrinsic === "Ref") return typeof record["Ref"] === "string" && sources.parameters.has(record["Ref"]);
+		if (intrinsic === "Fn::GetAtt") return getAttReadsNoEcho(record["Fn::GetAtt"], sources);
+		if (intrinsic === "Fn::Sub") {
+			const argument = record["Fn::Sub"];
+			if (typeof argument === "string") return subStringReadsNoEcho(argument, void 0, sources);
+			if (Array.isArray(argument)) {
+				const [text, variables] = argument;
+				const vars = isPlainObject(variables) ? variables : void 0;
+				if (typeof text === "string" && subStringReadsNoEcho(text, vars, sources)) return true;
+				return vars !== void 0 && Object.values(vars).some(walk);
+			}
+			return walk(argument);
+		}
+		if (intrinsic === "Fn::If") {
+			const argument = record["Fn::If"];
+			if (Array.isArray(argument) && argument.length === 3) {
+				const verdict = conditionVerdict(sources, argument[0]);
+				if (verdict !== void 0) return walk(verdict ? argument[1] : argument[2]);
+				return walk(argument[1]) || walk(argument[2]);
+			}
+			return walk(argument);
+		}
+		return Object.values(record).some(walk);
+	};
+	return walk(node);
+}
+function literalIndex(index) {
+	if (typeof index === "number" && Number.isInteger(index)) return index;
+	if (typeof index === "string" && /^\d+$/.test(index)) return Number(index);
+}
+function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
+	const coordinates = [];
+	const push = (path, node) => {
+		coordinates.push(path);
+		onCoordinate?.(path, node);
+	};
+	const ancestors = /* @__PURE__ */ new Set();
+	const parametersOnly = {
+		parameters: sources.parameters,
+		...sources.conditions !== void 0 && { conditions: sources.conditions }
+	};
+	const isBareDeclaredGetAtt = (node) => isPlainObject(node) && intrinsicKeyOf(node) === "Fn::GetAtt" && getAttReadsNoEcho(node["Fn::GetAtt"], sources);
+	const walk = (source, value, path) => {
+		if (value === void 0) return;
+		if (source === null || typeof source !== "object") return;
+		if (ancestors.has(source)) return;
+		ancestors.add(source);
+		try {
+			if (Array.isArray(source)) {
+				if (!readsNoEchoSource(source, sources)) return;
+				if (Array.isArray(value) && value.length === source.length) source.forEach((item, index) => walk(item, value[index], [...path, index]));
+				else if (readsNoEchoSource(source, parametersOnly) || source.some(isBareDeclaredGetAtt)) push(path, source);
+				return;
+			}
+			const record = source;
+			const intrinsic = intrinsicKeyOf(record);
+			if (intrinsic === void 0) {
+				if (!isPlainObject(value)) {
+					if (readsNoEchoSource(record, parametersOnly)) push(path, source);
+					return;
+				}
+				for (const [key, child] of Object.entries(record)) if (Object.hasOwn(value, key)) walk(child, value[key], [...path, key]);
+				return;
+			}
+			if (intrinsic === "Fn::If") {
+				const argument = record["Fn::If"];
+				if (Array.isArray(argument) && argument.length === 3) {
+					const verdict = conditionVerdict(sources, argument[0]);
+					if (verdict !== void 0) {
+						walk(verdict ? argument[1] : argument[2], value, path);
+						return;
+					}
+					if (isBareDeclaredGetAtt(argument[1]) || isBareDeclaredGetAtt(argument[2])) {
+						push(path, source);
+						return;
+					}
+				}
+			}
+			if (intrinsic === "Fn::Select") {
+				const argument = record["Fn::Select"];
+				if (Array.isArray(argument) && argument.length === 2 && Array.isArray(argument[1])) {
+					const index = literalIndex(argument[0]);
+					const list = argument[1];
+					if (index !== void 0 && index < list.length) {
+						walk(list[index], value, path);
+						return;
+					}
+				}
+			}
+			if (intrinsic === "Fn::GetAtt") {
+				if (getAttReadsNoEcho(record["Fn::GetAtt"], sources)) push(path, source);
+				return;
+			}
+			if (readsNoEchoSource(record, parametersOnly)) push(path, source);
+		} finally {
+			ancestors.delete(source);
+		}
+	};
+	walk(template, resolved, []);
+	return coordinates;
+}
+function noEchoParameterNodesAt(templateProperties, shape, noEchoParameters, conditions) {
+	const nodes = /* @__PURE__ */ new Map();
+	noEchoCoordinatesOf(templateProperties ?? {}, shape, {
+		parameters: noEchoParameters,
+		...conditions !== void 0 && { conditions }
+	}, (coordinate, node) => nodes.set(canonicalJson(coordinate), {
+		coordinate,
+		node
+	}));
+	return nodes;
+}
+function recordedNoEchoValuesOf(templateProperties, record, noEchoParameterNames, conditions) {
+	const bag = /* @__PURE__ */ new Map();
+	const properties = record?.properties;
+	if (properties === null || typeof properties !== "object") return bag;
+	const coordinates = /* @__PURE__ */ new Map();
+	if (noEchoParameterNames.size > 0 && templateProperties !== void 0) for (const [key, { coordinate }] of noEchoParameterNodesAt(templateProperties, properties, noEchoParameterNames, conditions)) coordinates.set(key, coordinate);
+	for (const coordinate of noEchoLeavesOf(record ?? {}) ?? []) coordinates.set(canonicalJson(coordinate), coordinate);
+	const recordLeaf = (leaf) => {
+		if (typeof leaf === "string") {
+			if (leaf === "***" || leaf.includes("{{resolve:")) return;
+			recordLogOnlyValue(bag, leaf);
+		} else if (typeof leaf === "number") recordLogOnlyValue(bag, String(leaf));
+	};
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (value) => {
+		if (value === null || typeof value !== "object") {
+			recordLeaf(value);
+			return;
+		}
+		if (seen.has(value)) return;
+		seen.add(value);
+		for (const child of Object.values(value)) walk(child);
+	};
+	for (const coordinate of coordinates.values()) walk(valueAtCoordinate(properties, coordinate));
+	return bag;
+}
+function maskWholeValue(value) {
+	if (value === null || value === void 0) return value;
+	if (typeof value === "string" && isSingleDynamicReferenceToken(value)) return value;
+	if (Array.isArray(value)) return value.map(maskWholeValue);
+	if (isPlainObject(value)) {
+		const out = {};
+		for (const [key, child] of Object.entries(value)) Object.defineProperty(out, key, {
+			value: maskWholeValue(child),
+			enumerable: true,
+			writable: true,
+			configurable: true
+		});
+		return out;
+	}
+	return "***";
+}
+function readAt(bag, coordinate) {
+	let node = bag;
+	for (const segment of coordinate) {
+		if (typeof segment === "number") {
+			if (!Array.isArray(node) || segment >= node.length) return {
+				found: false,
+				value: void 0
+			};
+			node = node[segment];
+			continue;
+		}
+		if (!isPlainObject(node) || !Object.hasOwn(node, segment)) return {
+			found: false,
+			value: void 0
+		};
+		node = node[segment];
+	}
+	return {
+		found: true,
+		value: node
+	};
+}
+function valueAtCoordinate(bag, coordinate) {
+	return readAt(bag, coordinate).value;
+}
+function cloneContainer(node) {
+	if (Array.isArray(node)) return [...node];
+	if (isPlainObject(node)) return { ...node };
+	return node;
+}
+function maskAtCoordinates(bag, coordinates) {
+	if (coordinates.length === 0) return bag;
+	let root = bag;
+	for (const coordinate of coordinates) {
+		if (!readAt(root, coordinate).found) continue;
+		if (coordinate.length === 0) {
+			root = maskWholeValue(root);
+			continue;
+		}
+		root = cloneContainer(root);
+		let node = root;
+		for (let i = 0; i < coordinate.length - 1; i++) {
+			const segment = coordinate[i];
+			const next = cloneContainer(node[segment]);
+			node[segment] = next;
+			node = next;
+		}
+		const last = coordinate[coordinate.length - 1];
+		node[last] = maskWholeValue(node[last]);
+	}
+	return root;
+}
+function replaceAtCoordinates(bag, entries) {
+	let root = bag;
+	for (const { coordinate, value } of entries) {
+		if (!readAt(root, coordinate).found) continue;
+		if (coordinate.length === 0) {
+			root = value;
+			continue;
+		}
+		root = cloneContainer(root);
+		let node = root;
+		for (let i = 0; i <= coordinate.length - 1; i++) {
+			const segment = coordinate[i];
+			const next = i === coordinate.length - 1 ? value : cloneContainer(node[segment]);
+			if (typeof segment === "number") node[segment] = next;
+			else Object.defineProperty(node, segment, {
+				value: next,
+				enumerable: true,
+				writable: true,
+				configurable: true
+			});
+			node = next;
+		}
+	}
+	return root;
+}
+function maskReadbackAtCoordinates(readback, properties, coordinates) {
+	let result = readback;
+	for (const coordinate of coordinates) {
+		const target = readbackPathFor(result, properties, coordinate);
+		if (target !== void 0) result = maskAtCoordinates(result, [target]);
+	}
+	return result;
+}
+function readbackPathFor(readback, properties, coordinate) {
+	const path = [];
+	let live = readback;
+	let desired = properties;
+	for (const segment of coordinate) {
+		if (typeof segment === "number") {
+			if (!Array.isArray(live)) return path.length === 0 ? void 0 : path;
+			const key = Array.isArray(desired) ? identityKeyFor(live, desired) : void 0;
+			const element = Array.isArray(desired) ? desired[segment] : void 0;
+			if (key === void 0 || !isPlainObject(element)) return path;
+			const identity = element[key];
+			const index = live.findIndex((item) => isPlainObject(item) && item[key] === identity);
+			if (index < 0) return path;
+			path.push(index);
+			live = live[index];
+			desired = element;
+			continue;
+		}
+		if (!isPlainObject(live)) return path.length === 0 ? void 0 : path;
+		if (!Object.hasOwn(live, segment)) return void 0;
+		path.push(segment);
+		live = live[segment];
+		desired = isPlainObject(desired) ? desired[segment] : void 0;
+	}
+	return path;
+}
+function canonicalCoordinates(coordinates) {
+	const keyed = /* @__PURE__ */ new Map();
+	for (const coordinate of coordinates) keyed.set(JSON.stringify(coordinate), [...coordinate]);
+	const all = [...keyed.values()];
+	const covered = (inner) => all.some((outer) => outer.length < inner.length && outer.every((segment, i) => segment === inner[i]));
+	return all.filter((coordinate) => !covered(coordinate)).sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)));
+}
+function noEchoLeavesOf(record) {
+	const field = record.noEchoLeaves;
+	if (!Array.isArray(field)) return void 0;
+	const out = [];
+	for (const entry of field) {
+		if (!Array.isArray(entry)) return void 0;
+		if (!entry.every((s) => typeof s === "string" || typeof s === "number" && Number.isInteger(s))) return void 0;
+		out.push(entry);
+	}
+	return out;
+}
+function isMarkedCoordinate(coordinate, marked) {
+	return marked.some((outer) => outer.length <= coordinate.length && outer.every((segment, i) => segment === coordinate[i]));
+}
+function witnessNormalize(stored, today, v11) {
+	const confirmed = [];
+	const differing = [];
+	const walk = (s, t, v, path) => {
+		if (v !== "***" && containsMask(v) && (Array.isArray(v) ? !Array.isArray(s) || s.length !== v.length : isPlainObject(v) ? !isPlainObject(s) : false)) {
+			if (s === void 0 || containsMask(s)) return s;
+			if (jsonEqual(s, t)) {
+				confirmed.push(path);
+				return v;
+			}
+			differing.push(path);
+			return s;
+		}
+		if (v === "***") {
+			if (s === void 0 || containsMask(s)) return s;
+			if (jsonEqual(s, t)) {
+				confirmed.push(path);
+				return v;
+			}
+			differing.push(path);
+			return s;
+		}
+		if (Array.isArray(v) && Array.isArray(s)) {
+			if (s.length !== v.length) return s;
+			const tt = Array.isArray(t) ? t : [];
+			let changed = false;
+			const out = s.map((item, i) => {
+				const next = walk(item, tt[i], v[i], [...path, i]);
+				if (next !== item) changed = true;
+				return next;
+			});
+			return changed ? out : s;
+		}
+		if (isPlainObject(v) && isPlainObject(s)) {
+			const tt = isPlainObject(t) ? t : {};
+			let out;
+			for (const key of Object.keys(v)) {
+				if (!Object.hasOwn(s, key)) continue;
+				const next = walk(s[key], tt[key], v[key], [...path, key]);
+				if (next !== s[key]) {
+					out ??= { ...s };
+					out[key] = next;
+				}
+			}
+			return out ?? s;
+		}
+		return s;
+	};
+	return {
+		current: walk(stored, today, v11, []),
+		confirmed,
+		differing
+	};
+}
+function containsMask(value) {
+	if (value === "***") return true;
+	if (Array.isArray(value)) return value.some(containsMask);
+	if (isPlainObject(value)) return Object.values(value).some(containsMask);
+	return false;
+}
+function jsonEqual(a, b) {
+	return canonicalJson(a) === canonicalJson(b);
+}
+function canonicalJson(value) {
+	return JSON.stringify(value, (_key, node) => {
+		if (node === null || typeof node !== "object" || Array.isArray(node)) return node;
+		const sorted = Object.create(null);
+		for (const key of Object.keys(node).sort()) sorted[key] = node[key];
+		return sorted;
+	});
+}
+const PREVIOUS_NOECHO_VALUE = "(previous NoEcho value)";
+function noEchoParametersReadBy(node, sources) {
+	return [...sources.parameters].filter((name) => readsNoEchoSource(node, {
+		parameters: /* @__PURE__ */ new Set([name]),
+		...sources.conditions !== void 0 && { conditions: sources.conditions }
+	}));
+}
+function noEchoComparison(options) {
+	const { sources, values, minNeedleLength, publicTokens } = options;
+	return ({ templateProperties, desired, current }) => {
+		const coordinates = noEchoCoordinatesOf(templateProperties, desired, sources);
+		const needles = [];
+		for (const name of noEchoParametersReadBy(templateProperties, sources)) {
+			const value = values[name];
+			const leaves = Array.isArray(value) ? value : [value];
+			for (const leaf of leaves) if (typeof leaf === "string" && leaf.length >= minNeedleLength && !isSingleDynamicReferenceToken(leaf)) needles.push(leaf);
+		}
+		if (coordinates.length === 0 && needles.length === 0) return void 0;
+		let masked = maskAtCoordinates(desired, coordinates);
+		if (needles.length > 0) {
+			const walk = (node) => {
+				if (typeof node === "string") {
+					if (node === "***") return node;
+					const outside = node.replace(DYNAMIC_REFERENCE_TOKEN_SCAN, "");
+					return needles.some((needle) => node === needle || publicTokens?.has(needle) !== true && outside.includes(needle)) ? "***" : node;
+				}
+				if (Array.isArray(node)) {
+					const out = node.map(walk);
+					return out.some((item, i) => item !== node[i]) ? out : node;
+				}
+				if (isPlainObject(node)) {
+					let out;
+					for (const [key, child] of Object.entries(node)) {
+						const next = walk(child);
+						if (next !== child) {
+							out ??= { ...node };
+							out[key] = next;
+						}
+					}
+					return out ?? node;
+				}
+				return node;
+			};
+			masked = walk(masked);
+		}
+		const witnessed = witnessNormalize(current, desired, masked);
+		const shown = maskAtCoordinatesWith(witnessed.current, witnessed.differing, PREVIOUS_NOECHO_VALUE);
+		return {
+			desired: masked,
+			current: shown
+		};
+	};
+}
+function maskAtCoordinatesWith(bag, coordinates, replacement) {
+	let root = bag;
+	for (const coordinate of coordinates) {
+		if (coordinate.length === 0 || !readAt(root, coordinate).found) continue;
+		root = cloneContainer(root);
+		let node = root;
+		for (let i = 0; i < coordinate.length - 1; i++) {
+			const segment = coordinate[i];
+			const next = cloneContainer(node[segment]);
+			node[segment] = next;
+			node = next;
+		}
+		node[coordinate[coordinate.length - 1]] = replacement;
+	}
+	return root;
+}
+function noEchoOutputsComparison(templateValues, sources) {
+	return (current, desired) => {
+		const coordinates = noEchoCoordinatesOf(templateValues, desired, sources);
+		const maskedKeys = new Set(coordinates.map((coordinate) => coordinate[0]).filter((key) => typeof key === "string"));
+		const maskedValues = new Set([...maskedKeys].map((key) => canonicalJson(desired[key])));
+		for (const key of Object.keys(desired)) if (!Object.hasOwn(templateValues, key) && maskedValues.has(canonicalJson(desired[key]))) maskedKeys.add(key);
+		if (maskedKeys.size === 0) return {
+			current,
+			desired,
+			masked: []
+		};
+		const maskedDesired = { ...desired };
+		for (const key of maskedKeys) maskedDesired[key] = maskWholeValue(desired[key]);
+		let normalized = current;
+		if (current !== void 0 && current !== null && typeof current === "object") for (const key of maskedKeys) {
+			if (!Object.hasOwn(current, key)) continue;
+			const stored = current[key];
+			if (containsMask(stored)) continue;
+			normalized = { ...normalized ?? {} };
+			normalized[key] = canonicalJson(stored) === canonicalJson(desired[key]) ? maskedDesired[key] : PREVIOUS_NOECHO_VALUE;
+		}
+		return {
+			current: normalized,
+			desired: maskedDesired,
+			masked: [...maskedKeys]
+		};
+	};
+}
+function maskedLeafCoordinatesOf(bag) {
+	const coordinates = [];
+	const ancestors = /* @__PURE__ */ new Set();
+	const walk = (node, path) => {
+		if (node === "***") {
+			coordinates.push(path);
+			return;
+		}
+		if (node === null || typeof node !== "object" || ancestors.has(node)) return;
+		ancestors.add(node);
+		if (Array.isArray(node)) node.forEach((item, index) => walk(item, [...path, index]));
+		else for (const [key, child] of Object.entries(node)) walk(child, [...path, key]);
+		ancestors.delete(node);
+	};
+	walk(bag, []);
+	return coordinates;
+}
+const passedNoEchoParameters = /* @__PURE__ */ new WeakMap();
+function recordPassedNoEchoParameters(bag, parameters, sources) {
+	const names = /* @__PURE__ */ new Set();
+	if (sources !== void 0 && parameters !== null && typeof parameters === "object") {
+		for (const [name, value] of Object.entries(parameters)) if (readsNoEchoSource(value, sources)) names.add(name);
+	}
+	if (names.size > 0) passedNoEchoParameters.set(bag, names);
+	else passedNoEchoParameters.delete(bag);
+}
+function passedNoEchoParametersOf(bag) {
+	return bag === void 0 ? void 0 : passedNoEchoParameters.get(bag);
+}
+
+//#endregion
+export { recordLogOnlyParameterValue as $, crossStackSourceKey as $t, recordIntrinsicLeafResolutionAs as A, inheritedParameterExpression as At, passProvenanceFor as B, standsForInheritedSecret as Bt, carryRedactionMarks as C, WHOLE_DYNAMIC_REFERENCE_PATTERN as Cn, DYNAMIC_REFERENCE_TOKEN_SCAN as Ct, markSameGenerationBag as D, pathCrossesDottedKey as Dt, markLeafCertifiedBag as E, maskMatchSpans as En, isUncertifiedBaselineMaskPosition as Et, redactForState as F, recordInheritedPseudoParameters as Ft, carryLogOnlyValues as G, freshNoEchoLeafPositions as Gt, recordReferenceProvenanceEntry as H, withdrawRenderedParameterSpelling as Ht, foldRecording as I, recordNestedStackParameterExpressions as It, hasLogOnlyValues as J, physicalNameCopiesOf as Jt, carryLogOnlyValuesCarriedBy as K, recordRecoverableMaskedOutput as Kt, openRecordingScope as L, redactInheritedParameterValue as Lt, resolvedPlaintextOf as M, inheritedRenderedToken as Mt, mixedLiteralAnswered as N, recordInheritedParameterRead as Nt, mergeResolvedPairs as O, identityKeyFor as Ot, withLegacyMixedScan as P, recordInheritedParameterValue as Pt, printingCorpusOf as Q, recordTakenIfBranch as Qt, recordSecretResolution as R, rereadParameterExpression as Rt, liveMatchesUnresolvedTokenFrame as S, withoutNoEchoParameterEntries as Sn, spanNamesResolvableService as St, isSameGenerationBag as T, isSingleDynamicReferenceToken as Tn, dynamicReferenceTokens as Tt, recordReferenceResolution as U, carriesFreshNoEchoValue as Ut, passReadVersionsFor as V, templateRereadsAccountId as Vt, snapshotPassProvenance as W, embedsFreshNoEchoValue as Wt, literalSplitDelimitersOf as X, recordPhysicalNameCopy as Xt, hasMaskableValues as Y, recordAttributeIdCopy as Yt, logOnlyValueCount as Z, recordDroppedArrayElements as Zt, recordPassedNoEchoParameters as _, recordMaskOnlyValuesIn as _n, replaceWholeLeaves as _t, maskReadbackAtCoordinates as a, freshNoEchoValuesOf as an, errorCauseChain as at, valueAtCoordinate as b, recordProvenPublicExpression as bn, withPhysicalNameCopies as bt, noEchoComparison as c, isScopedSecretVerdict as cn, maskSecretsInText as ct, noEchoOutputsComparison as d, noEchoParameterPlaintextsOf as dn, legacyLeavesWithoutMask as dt, recordCrossStackExpression as en, recordLogOnlySplitFragments as et, noEchoParameterNodesAt as f, pinScopedSecretVerdict as fn, legacyReferenceLeavesOnly as ft, readsNoEchoSource as g, recordMaskOnlyValue as gn, replaceEmbeddedPhysicalNameRewrites as gt, readbackPathFor as h, recordFreshNoEchoValuesIn as hn, repairPhysicalNameCopyLeaves as ht, maskAtCoordinates as i, contradictProvenPublicExpression as in, createSecretMasker as it, redactionClaimOf as j, inheritedPseudoValue as jt, recordIntrinsicLeafResolution as k, inheritNestedStackParameterAssociations as kt, noEchoCoordinatesOf as l, isSecretExpressionByVerdictOrSpelling as ln, differingStringLeaves as lt, passedNoEchoParametersOf as m, recordDerivedMaskOnlyValue as mn, repairEmbeddedPhysicalNamesTowards as mt, canonicalJson as n, carriesSecretMask as nn, shareLogOnlyValues as nt, maskWholeValue as o, isMaskOnlyPlaintext as on, maskRecordedSecretsInText as ot, noEchoParametersReadBy as p, provenPublicValue as pn, overlapRuleAnswered as pt, createUnionSecretMasker as q, recoverMaskedOutput as qt, isMarkedCoordinate as r, carryFreshNoEchoMark as rn, unionOfSecretBags as rt, maskedLeafCoordinatesOf as s, isNoEchoParameterPlaintext as sn, maskSecretsInError as st, canonicalCoordinates as t, splitGetAttStringForm as tn, recordLogOnlyValue as tt, noEchoLeavesOf as u, markNoEchoParameterClass as un, embeddedPhysicalNameRewrites as ut, recordedNoEchoValuesOf as v, recordNoEchoAttributeValues as vn, scrubResourceRecord as vt, intrinsicLeafResolutionOf as w, isDynamicReferenceString as wn, arrayPairsWhateverDrops as wt, witnessNormalize as x, wholeStringLeavesOf as xn, withoutPhysicalNameCopies as xt, replaceAtCoordinates as y, recordNoEchoParameterFreshValue as yn, withLegacyOverlapScan as yt, hasPassProvenance as z, splitOutsideDynamicReferences as zt };
+//# sourceMappingURL=secret-redaction-BHWS-PZK.js.map