@go-to-k/cdkd 0.302.1 → 0.302.3

package/dist/{deploy-engine-CYVt2NQR.js → deploy-engine-D9SDE-Pj.js}

@@ -1,8 +1,9 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-B_CEQGE1.js";
-import { A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, D as getCurrentStackInstanceId, E as getCurrentSkipPrefix, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, L as withStackScopeBeforeStateRead, N as stackInstanceNameSuffix, O as getCurrentStackName, P as withNameGeneration, Q as safeMsg, R as withoutGeneratedFallbackName, S as fallbackNamePropertyFor, T as generatedNameFor, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify$1, c as isStdoutReservedForPayload, et as terminalSafe, f as currentLogLineMasker, j as looksLikeCdkdGeneratedName, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, q as displaySafe, s as getLogger, t as VERBOSE_POINTER, tt as truncateCodePoints, v as applyDefaultNameForFallback, w as generateResourceNameWithFallback, x as explicitNamePropertyFor, y as currentNameGeneration, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-e_ddrDDo.js";
-import { $ as protectedReplacementAdvice, $n as isReplayedNameCollisionFrom, $t as ambientCredentialConfig, A as isQuotableImportValue, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as plainOrDescribed, Bt as formatLockOperation, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as commandHole, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as shellBoundedDisplay, Ht as recoveryCommandFlags, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as isInertUnquoted, M as quotedRemedyLogicalId, Mn as SHELL_ACTIVE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as SHELL_ACTIVE_WHY, On as isSoftAbort, Ot as hasCreatedBeforeFailure, Pn as UNSHOWABLE_VALUE, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qn as isRecreateRetryableError, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as pasteableCommand, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as SynthesisError, U as protectionFlipKey, Un as shellQuote, Ut as sanitizeRecoveryValue, Vn as quotedOrDescribed, Vt as formatLockOwner, Wn as withheldTargetClause, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isNameCollisionErrorFrom, Yt as producerRecordKey, Zn as isNameCooldownError, Zt as withPasteableAwsProfile, _r as isThrottlingError, _t as createMaskedLogSinks, at as startInterruptWatch, bn as ResourceTimeoutError, br as wrapMaskedAwsError, bt as maskDeep, cr as isAmbiguousCcHandlerErrorCode, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as IntrinsicResolutionRefusalError, dr as isIamPropagationError, en as clientDefaultsFor, f as removalWarning, fr as isRetryableTransientError, ft as logicalIdShown, gn as MalformedProducerRecordRefusalError, gr as isMarkedNonRetryable, gt as stateOrphanRecordRemedy, hn as MacroExpansionError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as stripControlChars, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, kn as normalizeAwsError, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DeploymentNotApprovedError, lr as isAmbiguousOutcomeError, m as withoutInjectedRemovals, mn as LockError, mr as retryClassificationText, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as relayedNameCollision, on as CrossAccountSecretRefusalError, ot as ElapsedBudgetRegistry, pr as isTransientServerError, qn as isUpdateUnsupportedError, rn as AssetError, rr as escapeRegExp$3, sn as DependencyError, sr as formatRetryClassificationSignals, st as monotonicNowMs, tn as credentialFingerprint, tr as markReplayMayCollide, un as DynamicReferenceRegionAmbiguousError, ut as compositeIdSeparatorRefusal, vr as markNonRetryable, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as StateError, wt as carryCreatedBeforeFailure, xn as ResourceUpdateNotSupportedError, xt as maskerOrIdentity, yn as ProvisioningError, yr as markRedactedCause, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as physicalIdShownBesideCommand, zt as formatLockExpiry } from "./iam-policy-targets-CmHNH1DY.js";
+import { A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, D as getCurrentStackInstanceId, E as getCurrentSkipPrefix, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, L as withStackScopeBeforeStateRead, N as stackInstanceNameSuffix, O as getCurrentStackName, P as withNameGeneration, Q as safeMsg, R as withoutGeneratedFallbackName, S as fallbackNamePropertyFor, T as generatedNameFor, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify$1, c as isStdoutReservedForPayload, et as terminalSafe, f as currentLogLineMasker, j as looksLikeCdkdGeneratedName, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, q as displaySafe, s as getLogger, t as VERBOSE_POINTER, tt as truncateCodePoints, v as applyDefaultNameForFallback, w as generateResourceNameWithFallback, x as explicitNamePropertyFor, y as currentNameGeneration } from "./aws-failure-text-e_ddrDDo.js";
+import { $ as protectedReplacementAdvice, $n as isReplayedNameCollisionFrom, $t as ambientCredentialConfig, A as isQuotableImportValue, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as plainOrDescribed, Bt as formatLockOperation, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as commandHole, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as shellBoundedDisplay, Ht as recoveryCommandFlags, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as isInertUnquoted, M as quotedRemedyLogicalId, Mn as SHELL_ACTIVE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as SHELL_ACTIVE_WHY, On as isSoftAbort, Ot as hasCreatedBeforeFailure, Pn as UNSHOWABLE_VALUE, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qn as isRecreateRetryableError, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as pasteableCommand, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as SynthesisError, U as protectionFlipKey, Un as shellQuote, Ut as sanitizeRecoveryValue, Vn as quotedOrDescribed, Vt as formatLockOwner, Wn as withheldTargetClause, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isNameCollisionErrorFrom, Yt as producerRecordKey, Zn as isNameCooldownError, Zt as withPasteableAwsProfile, _r as isThrottlingError, _t as createMaskedLogSinks, at as startInterruptWatch, bn as ResourceTimeoutError, br as wrapMaskedAwsError, bt as maskDeep, cr as isAmbiguousCcHandlerErrorCode, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as IntrinsicResolutionRefusalError, dr as isIamPropagationError, en as clientDefaultsFor, f as removalWarning, fr as isRetryableTransientError, ft as logicalIdShown, gn as MalformedProducerRecordRefusalError, gr as isMarkedNonRetryable, gt as stateOrphanRecordRemedy, hn as MacroExpansionError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as stripControlChars, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, kn as normalizeAwsError, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DeploymentNotApprovedError, lr as isAmbiguousOutcomeError, m as withoutInjectedRemovals, mn as LockError, mr as retryClassificationText, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as relayedNameCollision, on as CrossAccountSecretRefusalError, ot as ElapsedBudgetRegistry, pr as isTransientServerError, qn as isUpdateUnsupportedError, rn as AssetError, rr as escapeRegExp$2, sn as DependencyError, sr as formatRetryClassificationSignals, st as monotonicNowMs, tn as credentialFingerprint, tr as markReplayMayCollide, un as DynamicReferenceRegionAmbiguousError, ut as compositeIdSeparatorRefusal, vr as markNonRetryable, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as StateError, wt as carryCreatedBeforeFailure, xn as ResourceUpdateNotSupportedError, xt as maskerOrIdentity, yn as ProvisioningError, yr as markRedactedCause, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as physicalIdShownBesideCommand, zt as formatLockExpiry } from "./iam-policy-targets-OtGPguLH.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-DBXBcg0J.js";
-import { t as getCdkdVersion } from "./version-CaejipV3.js";
+import { $ as recordLogOnlyParameterValue, $t as crossStackSourceKey, A as recordIntrinsicLeafResolutionAs, At as inheritedParameterExpression, B as passProvenanceFor, Bt as standsForInheritedSecret, C as carryRedactionMarks, Ct as DYNAMIC_REFERENCE_TOKEN_SCAN, D as markSameGenerationBag, E as markLeafCertifiedBag, En as maskMatchSpans, F as redactForState, Ft as recordInheritedPseudoParameters, G as carryLogOnlyValues, Gt as freshNoEchoLeafPositions, H as recordReferenceProvenanceEntry, Ht as withdrawRenderedParameterSpelling, I as foldRecording, It as recordNestedStackParameterExpressions, J as hasLogOnlyValues, Jt as physicalNameCopiesOf, K as carryLogOnlyValuesCarriedBy, Kt as recordRecoverableMaskedOutput, L as openRecordingScope, Lt as redactInheritedParameterValue, M as resolvedPlaintextOf, Mt as inheritedRenderedToken, N as mixedLiteralAnswered, Nt as recordInheritedParameterRead, O as mergeResolvedPairs, P as withLegacyMixedScan, Pt as recordInheritedParameterValue, Q as printingCorpusOf, Qt as recordTakenIfBranch, R as recordSecretResolution, Rt as rereadParameterExpression, Sn as withoutNoEchoParameterEntries, St as spanNamesResolvableService, T as isSameGenerationBag, Tn as isSingleDynamicReferenceToken, Tt as dynamicReferenceTokens, U as recordReferenceResolution, Ut as carriesFreshNoEchoValue, V as passReadVersionsFor, Vt as templateRereadsAccountId, Wt as embedsFreshNoEchoValue, X as literalSplitDelimitersOf, Xt as recordPhysicalNameCopy, Y as hasMaskableValues, Zt as recordDroppedArrayElements, _ as recordPassedNoEchoParameters, _t as replaceWholeLeaves, a as maskReadbackAtCoordinates, an as freshNoEchoValuesOf, at as errorCauseChain, b as valueAtCoordinate, bn as recordProvenPublicExpression, bt as withPhysicalNameCopies, c as noEchoComparison, cn as isScopedSecretVerdict, ct as maskSecretsInText, dn as noEchoParameterPlaintextsOf, dt as legacyLeavesWithoutMask, en as recordCrossStackExpression, et as recordLogOnlySplitFragments, f as noEchoParameterNodesAt, fn as pinScopedSecretVerdict, ft as legacyReferenceLeavesOnly, gt as replaceEmbeddedPhysicalNameRewrites, h as readbackPathFor, hn as recordFreshNoEchoValuesIn, ht as repairPhysicalNameCopyLeaves, i as maskAtCoordinates, in as contradictProvenPublicExpression, it as createSecretMasker, j as redactionClaimOf, jt as inheritedPseudoValue, k as recordIntrinsicLeafResolution, kt as inheritNestedStackParameterAssociations, l as noEchoCoordinatesOf, ln as isSecretExpressionByVerdictOrSpelling, lt as differingStringLeaves, mn as recordDerivedMaskOnlyValue, mt as repairEmbeddedPhysicalNamesTowards, n as canonicalJson$3, nn as carriesSecretMask, nt as shareLogOnlyValues, o as maskWholeValue, on as isMaskOnlyPlaintext, ot as maskRecordedSecretsInText, p as noEchoParametersReadBy, pt as overlapRuleAnswered, q as createUnionSecretMasker, qt as recoverMaskedOutput, r as isMarkedCoordinate, rn as carryFreshNoEchoMark, rt as unionOfSecretBags, s as maskedLeafCoordinatesOf, sn as isNoEchoParameterPlaintext, st as maskSecretsInError, t as canonicalCoordinates, tn as splitGetAttStringForm, tt as recordLogOnlyValue, u as noEchoLeavesOf, un as markNoEchoParameterClass, ut as embeddedPhysicalNameRewrites, v as recordedNoEchoValuesOf, vn as recordNoEchoAttributeValues, vt as scrubResourceRecord, w as intrinsicLeafResolutionOf, wn as isDynamicReferenceString, wt as arrayPairsWhateverDrops, x as witnessNormalize, xn as wholeStringLeavesOf, xt as withoutPhysicalNameCopies, y as replaceAtCoordinates, yn as recordNoEchoParameterFreshValue, yt as withLegacyOverlapScan, z as hasPassProvenance, zt as splitOutsideDynamicReferences } from "./secret-redaction-BHWS-PZK.js";
+import { t as getCdkdVersion } from "./version-DDpKuzTw.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -424,7 +425,7 @@ function defineOwnKey(target, key, value) {
 		configurable: true
 	});
 }
-function hasPlainPrototype$1(value) {
+function hasPlainPrototype(value) {
 	const proto = Object.getPrototypeOf(value);
 	return proto === Object.prototype || proto === null;
 }
@@ -3247,7 +3248,7 @@ function trailingShortFlagOfCluster(arg) {
 	for (const flag of ARGV_VALUE_BEARING_FLAGS) if (flag.length === 2 && flag.startsWith("-") && flag[1] !== "-" && flag[1] === last) return flag;
 }
 const ARGV_VALUE_TOKEN_RE = (() => {
-	const alternation = [...ARGV_VALUE_BEARING_FLAGS].sort((a, b) => b.length - a.length || a.localeCompare(b)).map(escapeRegExp$3).join("|");
+	const alternation = [...ARGV_VALUE_BEARING_FLAGS].sort((a, b) => b.length - a.length || a.localeCompare(b)).map(escapeRegExp$2).join("|");
 	if (alternation.length === 0 || [...ARGV_VALUE_BEARING_FLAGS].some((f) => f.trim() === "")) throw new Error("ARGV_VALUE_BEARING_FLAGS is empty or holds an empty flag: the token scan would match every k=v");
 	return new RegExp(`(^|\\s)(${alternation})(\\s+|=)([^\\s=]*)=\\S*`, "g");
 })();
@@ -4265,10 +4266,10 @@ function flattenAssetPlaceholders(value, accountId, region, partition = "aws") {
 	return value.replace(/\$\{AWS::AccountId\}/g, accountId).replace(/\$\{AWS::Region\}/g, region).replace(/\$\{AWS::Partition\}/g, partition);
 }
 function isDefaultBootstrapBucketName(name, accountId, region) {
-	return new RegExp(`^cdk-[a-z0-9]+-assets-${accountId}-${escapeRegExp$3(region)}$`).test(name);
+	return new RegExp(`^cdk-[a-z0-9]+-assets-${accountId}-${escapeRegExp$2(region)}$`).test(name);
 }
 function isDefaultBootstrapRepoName(name, accountId, region) {
-	return new RegExp(`^cdk-[a-z0-9]+-container-assets-${accountId}-${escapeRegExp$3(region)}$`).test(name);
+	return new RegExp(`^cdk-[a-z0-9]+-container-assets-${accountId}-${escapeRegExp$2(region)}$`).test(name);
 }
 function buildAssetRedirectMap(manifest, marker, accountId, region, partition = "aws") {
 	const buckets = /* @__PURE__ */ new Map();
@@ -4277,7 +4278,7 @@ function buildAssetRedirectMap(manifest, marker, accountId, region, partition =
 	const addForms = (rawName, flattened, target) => {
 		sources.set(flattened, target);
 		if (rawName !== flattened) sources.set(rawName, target);
-		const suffixRe = new RegExp(`-${accountId}-${escapeRegExp$3(region)}$`);
+		const suffixRe = new RegExp(`-${accountId}-${escapeRegExp$2(region)}$`);
 		for (const suffix of [
 			"-${AWS::AccountId}-${AWS::Region}",
 			`-\${AWS::AccountId}-${region}`,
@@ -4318,7 +4319,7 @@ function buildAssetRedirectMap(manifest, marker, accountId, region, partition =
 	};
 }
 function buildBoundaryRegex(source) {
-	return new RegExp(`(?<![A-Za-z0-9_.-])${escapeRegExp$3(source)}(?![A-Za-z0-9_-])`, "g");
+	return new RegExp(`(?<![A-Za-z0-9_.-])${escapeRegExp$2(source)}(?![A-Za-z0-9_-])`, "g");
 }
 function rewriteString(value, map, counter) {
 	let result = value;
@@ -7104,4294 +7105,361 @@ var LockManager = class {
 					const why = Number.isFinite(existing.info.expiresAt) ? "A live cdkd process renews its lock well inside the TTL, so this normally means the previous owner crashed or was suspended" : `Its expiresAt is not a finite number, which cdkd treats as already expired`;
 					this.logger.warn(`Took over an EXPIRED lock for stack: ${safeSegment(stackName)} (${safeSegment(region)}, owner: ${formatLockOwner(existing.info.owner)}, ${formatLockExpiry(existing.info.expiresAt)}). ${why} -- if it is in fact still running, both processes are now writing to the same stack.`);
 					const abandonedAt = abandonedRunHorizon(existing);
-					if (abandonedAt !== void 0) this.abandonedLocks.set(key, abandonedAt);
-					try {
-						const retryEtag = await this.putLockObject(key, lockInfo);
-						this.logger.debug(`Lock acquired for stack: ${stackRef(stackName, region)} after expired lock cleanup, owner: ${displaySafe(lockOwner)}`);
-						this.trackHeldLock({
-							stackName,
-							region,
-							key,
-							info: lockInfo,
-							etag: retryEtag
-						});
-						return true;
-					} catch (retryError) {
-						if (this.isForeignLockError(retryError)) {
-							this.logger.debug(`Lock was acquired by another process during expired lock cleanup for stack: ${stackRef(stackName, region)}`);
-							return false;
-						}
-						throw retryError;
-					} finally {
-						await this.purgeLockVersions(key, "reap");
-					}
-				}
-				return false;
-			}
-			throw new LockError(`Failed to acquire lock for stack ${safeSegment(stackName)} (${safeSegment(region)}): ` + errorDetail$1(error), error instanceof Error ? error : void 0);
-		}
-	}
-	async putLockObject(key, lockInfo, condition = { IfNoneMatch: "*" }) {
-		const body = JSON.stringify(lockInfo, null, 2);
-		return (await this.s3Client.send(new PutObjectCommand({
-			Bucket: this.config.bucket,
-			...await this.ownerParam(),
-			Key: key,
-			Body: body,
-			ContentLength: Buffer.byteLength(body),
-			ContentType: "application/json",
-			...condition
-		}))).ETag;
-	}
-	async getLockInfo(stackName, region) {
-		const record = await this.getLockRecord(stackName, region);
-		return record ? record.info : null;
-	}
-	async getLockRecord(stackName, region) {
-		await this.ensureClientForBucket();
-		const key = this.getLockKey(stackName, region);
-		const shownStack = safeSegment(stackName);
-		try {
-			this.logger.debug(`Getting lock info for stack: ${shownStack}`);
-			const response = await this.s3Client.send(new GetObjectCommand({
-				Bucket: this.config.bucket,
-				...await this.ownerParam(),
-				Key: key
-			}));
-			if (!response.Body) throw new LockError(`Lock file for stack ${shownStack} has no body`);
-			const bodyString = await response.Body.transformToString();
-			const raw = JSON.parse(bodyString);
-			if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
-				this.logger.debug(`Lock file for stack ${shownStack} is not an object; treating as absent`);
-				return null;
-			}
-			const parsed = raw;
-			const lockInfo = {
-				...parsed,
-				owner: displaySafe(parsed.owner),
-				...parsed.operation !== void 0 && { operation: displaySafe(parsed.operation) },
-				expiresAt: nanIfUncoercible(parsed.expiresAt)
-			};
-			this.logger.debug(`Lock info for stack: ${shownStack}:`, lockInfo);
-			return {
-				info: lockInfo,
-				etag: response.ETag,
-				...response.LastModified instanceof Date && { lastModified: response.LastModified.getTime() }
-			};
-		} catch (error) {
-			if (error instanceof NoSuchKey) {
-				this.logger.debug(`No lock exists for stack: ${shownStack}`);
-				return null;
-			}
-			if (error instanceof LockError) throw error;
-			throw new LockError(`Failed to get lock info for stack ${shownStack}: ${errorDetail$1(error)}`, error instanceof Error ? error : void 0);
-		}
-	}
-	async isLocked(stackName, region) {
-		return await this.getLockInfo(stackName, region) !== null;
-	}
-	async releaseLock(stackName, region) {
-		const key = this.getLockKey(stackName, region);
-		const held = this.heldLocks.get(key);
-		if (held?.releasing) {
-			this.logger.debug(`Release already in flight (or done) for stack ${stackRef(stackName, region)}`);
-			return held.releasing;
-		}
-		if (!held) return this.doReleaseLock(stackName, region, void 0);
-		this.stopRenewal(held);
-		const releasing = this.doReleaseLock(stackName, region, held);
-		held.releasing = releasing;
-		return releasing;
-	}
-	async doReleaseLock(stackName, region, held) {
-		await this.ensureClientForBucket();
-		if (held) await held.renewing?.catch(() => void 0);
-		if (held?.lost) {
-			this.logger.warn(`Not releasing the lock for stack ${stackRef(stackName, region)}: this process lost it while the operation was still running, so the lock present now belongs to someone else.`);
-			return;
-		}
-		if (held && held.etag === void 0 && !await this.stillOursByBody(held)) {
-			this.logger.warn(`Not releasing the lock for stack ${stackRef(stackName, region)}: this process never learned which version of the lock it wrote, and could not confirm the one present is its own. It expires on its own, or clear it with cdkd force-unlock.`);
-			return;
-		}
-		try {
-			this.logger.debug(`Releasing lock for stack: ${stackRef(stackName, region)}`);
-			await this.deleteLock(stackName, region, held?.etag);
-			this.logger.debug(`Lock released for stack: ${stackRef(stackName, region)}`);
-		} catch (error) {
-			if (this.isForeignLockError(error)) {
-				this.logger.warn(held?.etagUncertain ? `Not releasing the lock for stack ${stackRef(stackName, region)}: this process could not confirm which version of the lock it last wrote, so it will not delete one it may not own. The lock clears on its own at ${new Date(held.info.expiresAt).toISOString()}, or immediately with cdkd force-unlock.` : `Not releasing the lock for stack ${stackRef(stackName, region)}: it has been replaced since this process acquired it, so another cdkd process now holds it. Leaving it in place.`);
-				return;
-			}
-			if (this.isGoneError(error)) {
-				this.logger.debug(`Lock for stack ${stackRef(stackName, region)} was already gone`);
-				return;
-			}
-			if (held?.etag !== void 0 && this.isConditionUnsupportedError(error)) {
-				if (!await this.stillOursByBody(held)) {
-					this.logger.warn(`Not releasing the lock for stack ${stackRef(stackName, region)}: the conditional delete could not be evaluated here, and this process could not confirm the lock is still its own. Leaving it in place rather than risk deleting another process's lock. It expires on its own, or clear it with cdkd force-unlock. If this repeats, grant s3:GetObject on the lock key -- a delete conditioned on an ETag requires it.`);
-					return;
-				}
-				this.logger.debug(`Conditional lock release for stack ${stackRef(stackName, region)} is not supported here (${errorDetail$1(error)}); retrying unconditionally`);
-				try {
-					await this.deleteLock(stackName, region);
-					this.logger.debug(`Lock released for stack: ${stackRef(stackName, region)}`);
-					return;
-				} catch (fallbackError) {
-					throw new LockError(`Failed to release lock for stack ${stackRef(stackName, region)}: ${errorDetail$1(fallbackError)}`, fallbackError instanceof Error ? fallbackError : void 0);
-				}
-			}
-			throw new LockError(`Failed to release lock for stack ${stackRef(stackName, region)}: ${errorDetail$1(error)}`, error instanceof Error ? error : void 0);
-		} finally {
-			const purge = this.purgeLockVersions(this.getLockKey(stackName, region), "release");
-			if (this.deferReleasePurge) {
-				this.deferredPurges.add(purge);
-				purge.finally(() => this.deferredPurges.delete(purge));
-			} else await purge;
-		}
-	}
-	async stillOursByBody(held) {
-		let record;
-		try {
-			record = await this.getLockRecord(held.stackName, held.region);
-		} catch {
-			return false;
-		}
-		if (!record) return false;
-		return this.sameLockIdentity(record.info, held.info);
-	}
-	sameLockIdentity(a, b) {
-		return displaySafe(a.owner) === displaySafe(b.owner) && a.timestamp === b.timestamp;
-	}
-	abandonedRunEndedBy(stackName, region) {
-		return this.abandonedLocks.get(this.getLockKey(stackName, region));
-	}
-	async forceReleaseLock(stackName, region, beforeDelete) {
-		const where = stackRef(stackName, region);
-		const record = await this.getLockRecord(stackName, region).catch(() => null);
-		const lockInfo = record?.info ?? null;
-		this.logger.warn(lockInfo ? `Force releasing lock for stack: ${where}, owner: ${formatLockOwner(lockInfo.owner)}${lockInfo.operation ? `, operation: ${formatLockOperation(lockInfo.operation)}` : ""}, expired: ${this.isLockExpired(lockInfo)}` : `Force releasing lock for stack: ${where} (no lock body read — absent or unparseable; deleting the object either way, since a lock cdkd cannot read is a lock nothing else can clear)`);
-		const key = this.getLockKey(stackName, region);
-		const held = this.heldLocks.get(key);
-		if (held) {
-			this.stopRenewal(held);
-			held.releasing = Promise.resolve();
-		}
-		const horizon = record ? abandonedRunHorizon(record) : void 0;
-		if (horizon !== void 0 && beforeDelete !== void 0) await beforeDelete(horizon).catch(() => void 0);
-		try {
-			await this.deleteLock(stackName, region);
-		} finally {
-			await this.purgeLockVersions(key, "reap");
-		}
-		return horizon;
-	}
-	async deleteLock(stackName, region, etag) {
-		await this.ensureClientForBucket();
-		const key = this.getLockKey(stackName, region);
-		await this.s3Client.send(new DeleteObjectCommand({
-			Bucket: this.config.bucket,
-			...await this.ownerParam(),
-			Key: key,
-			...etag !== void 0 && { IfMatch: etag }
-		}));
-	}
-	async purgeLockVersions(key, path) {
-		const report = (message) => {
-			try {
-				if (path === "reap") this.logger.warn(message);
-				else this.logger.debug(message);
-			} catch {}
-		};
-		try {
-			await this.ensureClientForBucket();
-			await purgeNoncurrentKeyVersions(this.s3Client, this.config.bucket, [key], {
-				requestFields: await this.ownerParam(),
-				logger: { warn: report },
-				objectDescription: LOCK_OBJECT_DESCRIPTION
-			});
-		} catch (error) {
-			report(`Could not purge noncurrent versions of the lock key ${displayIdent(key, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })} in bucket '${this.config.bucket}': the purge could not be started. Their previous versions survive and remain readable via GetObject with a VersionId (${LOCK_OBJECT_DESCRIPTION}). Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key by hand. Underlying error: ${errorDetail$1(error)}`);
-		}
-	}
-	trackHeldLock(args) {
-		const previous = this.heldLocks.get(args.key);
-		if (previous) this.stopRenewal(previous);
-		const held = {
-			stackName: args.stackName,
-			region: args.region,
-			key: args.key,
-			info: args.info,
-			etag: args.etag,
-			timer: void 0,
-			renewing: void 0,
-			lost: false,
-			releasing: void 0,
-			etagUncertain: false,
-			warnedPastExpiry: false
-		};
-		this.heldLocks.set(args.key, held);
-		if (this.renewalDisabled) {
-			this.logger.debug(`Lock renewal is disabled; the lock for ${stackRef(args.stackName, args.region)} will lapse at its TTL`);
-			return;
-		}
-		if (args.etag === void 0) {
-			this.logger.debug(`No ETag returned when acquiring the lock for ${stackRef(args.stackName, args.region)}; renewal disabled for this lock`);
-			return;
-		}
-		this.startRenewal(held);
-	}
-	startRenewal(held) {
-		const timer = setInterval(() => {
-			this.renewLock(held);
-		}, this.renewalIntervalMs);
-		timer.unref?.();
-		held.timer = timer;
-	}
-	stopRenewal(held) {
-		if (held.timer !== void 0) {
-			clearInterval(held.timer);
-			held.timer = void 0;
-		}
-	}
-	renewLock(held) {
-		if (held.lost || held.renewing !== void 0 || held.etag === void 0) return Promise.resolve();
-		const inFlight = this.doRenewLock(held).finally(() => {
-			held.renewing = void 0;
-		});
-		held.renewing = inFlight;
-		return inFlight;
-	}
-	async doRenewLock(held) {
-		const currentEtag = held.etag;
-		if (currentEtag === void 0) return;
-		const renewed = {
-			...held.info,
-			expiresAt: Date.now() + this.ttlMs
-		};
-		try {
-			const etag = await this.putLockObject(held.key, renewed, { IfMatch: currentEtag });
-			if (etag === void 0) {
-				if (await this.adoptOwnWrite(held, renewed)) return;
-				held.info = renewed;
-				held.etagUncertain = true;
-				this.stopRenewal(held);
-				this.logger.debug(`Lock renewal for ${stackRef(held.stackName, held.region)} returned no ETag and the object could not be re-read; stopping renewal and keeping the previous ETag`);
-				return;
-			}
-			held.info = renewed;
-			held.etag = etag;
-			held.warnedPastExpiry = false;
-			this.logger.debug(`Renewed lock for stack: ${stackRef(held.stackName, held.region)} until ${new Date(renewed.expiresAt).toISOString()}`);
-		} catch (error) {
-			if (this.isForeignLockError(error) && await this.adoptOwnWrite(held, renewed)) return;
-			if (this.isNotOursError(error)) {
-				held.lost = true;
-				this.stopRenewal(held);
-				this.logger.warn(`Lost the lock for stack ${stackRef(held.stackName, held.region)} while the operation was still running: the lock object has been replaced or removed. Another cdkd process may now be writing to this stack concurrently. This process will not delete the current lock when it finishes.`);
-				return;
-			}
-			this.logger.debug(`Lock renewal for stack ${stackRef(held.stackName, held.region)} failed, will retry: ${errorDetail$1(error)}`);
-			if (!held.warnedPastExpiry && Date.now() >= held.info.expiresAt) {
-				held.warnedPastExpiry = true;
-				this.logger.warn(`Lock renewal for stack ${stackRef(held.stackName, held.region)} has been failing long enough that the lock expired at ${new Date(held.info.expiresAt).toISOString()}. Another cdkd process can now take it while this operation is still running. Renewal keeps retrying.`);
-			}
-		}
-	}
-	async adoptOwnWrite(held, renewed) {
-		const record = await this.getLockRecord(held.stackName, held.region).catch(() => null);
-		if (!record || record.etag === void 0 || record.info.expiresAt !== renewed.expiresAt || !this.sameLockIdentity(record.info, renewed)) return false;
-		held.info = renewed;
-		held.etag = record.etag;
-		held.warnedPastExpiry = false;
-		this.logger.debug(`Lock renewal for stack ${stackRef(held.stackName, held.region)} reported a conflict, but the object holds this process's own renewal -- adopting it and continuing`);
-		return true;
-	}
-	isForeignLockError(error) {
-		return error instanceof S3ServiceException && (error.name === "PreconditionFailed" || error.$metadata.httpStatusCode === 412);
-	}
-	isGoneError(error) {
-		if (error instanceof NoSuchKey) return true;
-		if (!(error instanceof S3ServiceException)) return false;
-		if (error.name === "NoSuchBucket") return false;
-		return error.name === "NoSuchKey" || error.$metadata.httpStatusCode === 404;
-	}
-	isConditionUnsupportedError(error) {
-		if (!(error instanceof S3ServiceException)) return false;
-		const status = error.$metadata.httpStatusCode;
-		return status === 403 || status === 501 || error.name === "AccessDenied" || error.name === "Forbidden" || error.name === "NotImplemented";
-	}
-	isNotOursError(error) {
-		return this.isForeignLockError(error) || this.isGoneError(error);
-	}
-	async acquireLockWithRetry(stackName, region, owner, operation, maxRetries = 3, retryDelay = 2e3) {
-		let attempts = 0;
-		let releasedReacquires = 0;
-		let lockInfo = null;
-		for (let attempt = 0; attempt <= maxRetries; attempt++) {
-			attempts++;
-			if (await this.acquireLock(stackName, region, owner, operation)) return;
-			lockInfo = await this.getLockInfo(stackName, region);
-			if (!lockInfo && releasedReacquires < 3) {
-				releasedReacquires++;
-				this.logger.debug(safeMsg`Lock for stack ${stackRef(stackName, region)} could not be acquired, yet no readable lock was found -- most likely released in between; re-attempting (${releasedReacquires}/${3})`);
-				attempt--;
-				continue;
-			}
-			if (attempt < maxRetries) {
-				const holder = lockInfo ? `is locked by ${formatLockOwner(lockInfo.owner)}${lockInfo.operation ? ` (operation: ${formatLockOperation(lockInfo.operation)})` : ""}. Lock ${formatLockExpiry(lockInfo.expiresAt)}.` : `could not be locked, and no readable lock was found.`;
-				this.logger.info(`Stack ${safeSegment(stackName)} (${safeSegment(region)}) ${holder} Retrying in ${this.formatDuration(retryDelay)}... (attempt ${attempt + 1}/${maxRetries})`);
-				await new Promise((resolve) => setTimeout(resolve, retryDelay));
-			}
-		}
-		const expiry = lockInfo ? formatLockExpiry(lockInfo.expiresAt) : void 0;
-		const forceUnlockCommand = buildForceUnlockCommand(stackName, region);
-		const recovery = forceUnlockCommand ? `If you are certain no other process is active, run: ${forceUnlockCommand}` : `If you are certain no other process is active, ${UNREPRODUCIBLE_LOCK_CLAUSE.charAt(0).toLowerCase()}${UNREPRODUCIBLE_LOCK_CLAUSE.slice(1)}`;
-		const safeStack = safeSegment(stackName);
-		const safeRegion = safeSegment(region);
-		throw new LockError(`Failed to acquire lock for stack ${safeStack} (${safeRegion}) after ${attempts} attempt${attempts === 1 ? "" : "s"}. ` + (lockInfo ? `Locked by: ${formatLockOwner(lockInfo.owner)}${lockInfo.operation ? `, operation: ${formatLockOperation(lockInfo.operation)}` : ""}, ${expiry}. ` + recovery : `No lock could be read after the last failed attempt, so it was most likely released just now: re-run the command. If this repeats, lock.json may hold a body that is not a readable lock. ${recovery}`));
-	}
-};
-function nanIfUncoercible(value) {
-	try {
-		Number(value);
-		return value;
-	} catch {
-		return NaN;
-	}
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/rules.ts
-const MIN_NEEDLE_LENGTH = 4;
-function printingNeedles(values) {
-	const out = /* @__PURE__ */ new Set();
-	for (const value of values) {
-		if (value.length < 4) continue;
-		out.add(value);
-		const flat = flattenedSpelling(value);
-		if (flat !== void 0 && flat.trim().length >= 4) out.add(flat);
-	}
-	return [...out];
-}
-const FLATTENED_MEMO_CAP = 4096;
-const flattenedMemo = /* @__PURE__ */ new Map();
-function flattenedSpelling(value) {
-	if (!SAFE_MSG_ALTERED_CHAR.test(value)) return void 0;
-	let flat = flattenedMemo.get(value);
-	if (flat === void 0) {
-		flat = safeMsg`${value}`;
-		if (flattenedMemo.size >= FLATTENED_MEMO_CAP) flattenedMemo.clear();
-		flattenedMemo.set(value, flat);
-	}
-	return flat === value ? void 0 : flat;
-}
-function escapeRegExp$2(value) {
-	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function maskMatchSpans(text, needles, mask) {
-	const spans = [];
-	for (const needle of needles) for (let at = text.indexOf(needle); at !== -1; at = text.indexOf(needle, at + 1)) spans.push([at, at + needle.length]);
-	if (spans.length === 0) return text;
-	spans.sort((a, b) => a[0] - b[0] || b[1] - a[1]);
-	let out = "";
-	let cursor = 0;
-	let [start, end] = spans[0];
-	for (const [nextStart, nextEnd] of spans.slice(1)) {
-		if (nextStart < end) {
-			end = Math.max(end, nextEnd);
-			continue;
-		}
-		out += text.slice(cursor, start) + mask;
-		cursor = end;
-		[start, end] = [nextStart, nextEnd];
-	}
-	return out + text.slice(cursor, start) + mask + text.slice(end);
-}
-function buildNeedleRegex(values) {
-	const needles = Array.from(new Set(values)).filter((v) => v.length >= 4).sort((a, b) => b.length - a.length);
-	if (needles.length === 0) return void 0;
-	return new RegExp(needles.map(escapeRegExp$2).join("|"), "g");
-}
-const TEMPLATE_DERIVED_RULES = {
-	descendArrays: true,
-	trustAnyExpression: false,
-	sourceIsSameGeneration: false
-};
-const TEMPLATE_SOURCED_RULES = {
-	descendArrays: false,
-	trustAnyExpression: false,
-	sourceIsSameGeneration: false
-};
-const STATE_SOURCED_READBACK_RULES = {
-	descendArrays: false,
-	trustAnyExpression: true,
-	sourceIsSameGeneration: true
-};
-const STATE_SOURCED_BASELINE_RULES = {
-	descendArrays: false,
-	trustAnyExpression: true,
-	sourceIsSameGeneration: true,
-	failClosedOnUncertifiedPositions: true
-};
-const STATE_SOURCED_CROSS_GENERATION_RULES = {
-	descendArrays: false,
-	trustAnyExpression: true,
-	sourceIsSameGeneration: false
-};
-const STATE_DERIVED_RULES = {
-	descendArrays: true,
-	trustAnyExpression: true,
-	sourceIsSameGeneration: true
-};
-function isDynamicReferenceString(value) {
-	return typeof value === "string" && value.includes("{{resolve:");
-}
-const DYNAMIC_REFERENCE_INNER_CHAR = "[^}]";
-const DYNAMIC_REFERENCE_INNER = `${DYNAMIC_REFERENCE_INNER_CHAR}+`;
-const WHOLE_DYNAMIC_REFERENCE_PATTERN = new RegExp(`^\\{\\{resolve:${DYNAMIC_REFERENCE_INNER}\\}\\}$`);
-function isSingleDynamicReferenceToken(value) {
-	return WHOLE_DYNAMIC_REFERENCE_PATTERN.test(value);
-}
-function isPlainObject$7(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/mask-only.ts
-const recordedSecretExpressions = /* @__PURE__ */ new Set();
-const secretVerdictScopes = /* @__PURE__ */ new Map();
-function pinScopedSecretVerdict(scope, expression, secret) {
-	const scopes = secretVerdictScopes.get(expression);
-	if (secret) {
-		if (scopes) scopes.add(scope);
-		else secretVerdictScopes.set(expression, /* @__PURE__ */ new Set([scope]));
-		recordedSecretExpressions.add(expression);
-		return;
-	}
-	if (scopes?.delete(scope) && scopes.size === 0) secretVerdictScopes.delete(expression);
-	recordedSecretExpressions.delete(expression);
-}
-function isScopedSecretVerdict(scope, expression) {
-	return secretVerdictScopes.get(expression)?.has(scope) === true;
-}
-function isRecordedSecretExpression(expression) {
-	return recordedSecretExpressions.has(expression);
-}
-const provenPublicExpressions = /* @__PURE__ */ new WeakMap();
-function proofsOf(bag) {
-	let proofs = provenPublicExpressions.get(bag);
-	if (!proofs) {
-		proofs = /* @__PURE__ */ new Map();
-		provenPublicExpressions.set(bag, proofs);
-	}
-	return proofs;
-}
-function recordProvenPublicExpression(bag, expression, value) {
-	const proofs = proofsOf(bag);
-	const prior = proofs.get(expression);
-	if (prior === false) return;
-	proofs.set(expression, prior === void 0 || prior === value ? value : false);
-}
-function sharePublicProofs(view, pass) {
-	provenPublicExpressions.set(view, proofsOf(pass));
-}
-function carryPublicProofs(from, to) {
-	for (const [expression, value] of provenPublicExpressions.get(from) ?? []) if (value === false) contradictProvenPublicExpression(to, expression);
-	else recordProvenPublicExpression(to, expression, value);
-}
-function contradictProvenPublicExpression(bag, expression) {
-	proofsOf(bag).set(expression, false);
-}
-function provenPublicValue(bag, expression) {
-	const value = provenPublicExpressions.get(bag)?.get(expression);
-	if (value === void 0 || value === false) return void 0;
-	if (recordedSecretExpressions.has(expression)) return void 0;
-	for (const recorded of bag.values()) if (recorded === expression) return void 0;
-	return value;
-}
-function recordMaskOnlyValue(secrets, plaintext) {
-	if (plaintext.length < 4) return;
-	const existing = secrets.get(plaintext);
-	if (existing !== void 0 && existing !== "***") return;
-	secrets.set(plaintext, "***");
-}
-function isMaskOnlyPlaintext(secrets, plaintext) {
-	return secrets.get(plaintext) === "***";
-}
-function recordMaskOnlyValuesIn(value, secrets, excluded) {
-	const seen = /* @__PURE__ */ new Set();
-	const walk = (node) => {
-		if (typeof node === "string") {
-			if (excluded?.has(node) === true) return;
-			recordMaskOnlyValue(secrets, node);
-			return;
-		}
-		if (node === null || typeof node !== "object") return;
-		if (seen.has(node)) return;
-		seen.add(node);
-		if (Array.isArray(node)) {
-			for (const item of node) walk(item);
-			return;
-		}
-		for (const child of Object.values(node)) walk(child);
-	};
-	walk(value);
-}
-function wholeStringLeavesOf(value) {
-	const leaves = /* @__PURE__ */ new Set();
-	const seen = /* @__PURE__ */ new Set();
-	const walk = (node) => {
-		if (typeof node === "string") {
-			leaves.add(node);
-			return;
-		}
-		if (node === null || typeof node !== "object") return;
-		if (seen.has(node)) return;
-		seen.add(node);
-		if (Array.isArray(node)) {
-			for (const item of node) walk(item);
-			return;
-		}
-		for (const child of Object.values(node)) walk(child);
-	};
-	walk(value);
-	return leaves;
-}
-function recordNoEchoAttributeValues(result, secrets, ownProperties) {
-	const attributes = result.attributes;
-	if (attributes === void 0) return void 0;
-	const excluded = ownProperties === void 0 ? void 0 : wholeStringLeavesOf(ownProperties);
-	if (result.noEchoAttributes === true) {
-		recordMaskOnlyValuesIn(attributes, secrets, excluded);
-		return true;
-	}
-	const names = (result.noEchoAttributeNames ?? []).filter((name) => Object.hasOwn(attributes, name));
-	if (names.length === 0) return void 0;
-	for (const name of names) recordMaskOnlyValuesIn(attributes[name], secrets, excluded);
-	return new Set(names);
-}
-function carriesSecretMask(value) {
-	const seen = /* @__PURE__ */ new Set();
-	const walk = (node) => {
-		if (typeof node === "string") return node === "***";
-		if (node === null || typeof node !== "object") return false;
-		if (seen.has(node)) return false;
-		seen.add(node);
-		if (Array.isArray(node)) return node.some((item) => walk(item));
-		return Object.values(node).some((child) => walk(child));
-	};
-	return walk(value);
-}
-const freshNoEchoValuesOf = /* @__PURE__ */ new WeakMap();
-function freshNoEchoSet(secrets) {
-	return sideSetOf(freshNoEchoValuesOf, secrets);
-}
-const containmentValuesOf = /* @__PURE__ */ new WeakMap();
-function sideSetOf(table, secrets) {
-	let set = table.get(secrets);
-	if (set === void 0) {
-		set = /* @__PURE__ */ new Set();
-		table.set(secrets, set);
-	}
-	return set;
-}
-function recordDerivedMaskOnlyValue(secrets, plaintext) {
-	recordMaskOnlyValue(secrets, plaintext);
-	if (isMaskOnlyPlaintext(secrets, plaintext)) sideSetOf(containmentValuesOf, secrets).add(plaintext);
-}
-function recordFreshNoEchoValuesIn(value, secrets, excluded, publicTokens) {
-	recordMaskOnlyValuesIn(value, secrets, excluded);
-	const fresh = freshNoEchoSet(secrets);
-	const containment = sideSetOf(containmentValuesOf, secrets);
-	const seen = /* @__PURE__ */ new Set();
-	const walk = (node) => {
-		if (typeof node === "string") {
-			if (excluded?.has(node) !== true && isMaskOnlyPlaintext(secrets, node)) {
-				fresh.add(node);
-				if (publicTokens?.has(node) !== true) containment.add(node);
-			}
-			return;
-		}
-		if (node === null || typeof node !== "object") return;
-		if (seen.has(node)) return;
-		seen.add(node);
-		if (Array.isArray(node)) {
-			for (const item of node) walk(item);
-			return;
-		}
-		for (const child of Object.values(node)) walk(child);
-	};
-	walk(value);
-}
-const noEchoParameterValuesOf = /* @__PURE__ */ new WeakMap();
-function recordNoEchoParameterFreshValue(value, secrets, publicTokens) {
-	recordFreshNoEchoValuesIn(value, secrets, void 0, publicTokens);
-	const parameterClass = sideSetOf(noEchoParameterValuesOf, secrets);
-	const walk = (node) => {
-		if (typeof node === "string") {
-			if (isMaskOnlyPlaintext(secrets, node)) parameterClass.add(node);
-			return;
-		}
-		if (Array.isArray(node)) for (const item of node) walk(item);
-	};
-	walk(value);
-}
-function withoutNoEchoParameterEntries(secrets) {
-	const fresh = freshNoEchoValuesOf.get(secrets);
-	if (fresh === void 0 || fresh.size === 0) return secrets;
-	const copy = /* @__PURE__ */ new Map();
-	for (const [plaintext, expression] of secrets) {
-		if (expression === "***" && fresh.has(plaintext)) continue;
-		copy.set(plaintext, expression);
-	}
-	mergeResolvedPairs(secrets, copy);
-	carryMaskOnlyMarks(secrets, copy);
-	return copy;
-}
-function markNoEchoParameterClass(secrets, plaintext) {
-	if (isMaskOnlyPlaintext(secrets, plaintext)) sideSetOf(noEchoParameterValuesOf, secrets).add(plaintext);
-}
-function isNoEchoParameterPlaintext(secrets, plaintext) {
-	return noEchoParameterValuesOf.get(secrets)?.has(plaintext) === true && isMaskOnlyPlaintext(secrets, plaintext);
-}
-function noEchoParameterPlaintextsOf(secrets) {
-	return [...noEchoParameterValuesOf.get(secrets) ?? []].filter((plaintext) => isMaskOnlyPlaintext(secrets, plaintext));
-}
-function carryFreshNoEchoMark(from, to, plaintext) {
-	if (!isMaskOnlyPlaintext(to, plaintext)) return;
-	if (containmentValuesOf.get(from)?.has(plaintext) === true) sideSetOf(containmentValuesOf, to).add(plaintext);
-	if (freshNoEchoValuesOf.get(from)?.has(plaintext) === true) freshNoEchoSet(to).add(plaintext);
-	if (noEchoParameterValuesOf.get(from)?.has(plaintext) === true) sideSetOf(noEchoParameterValuesOf, to).add(plaintext);
-}
-function carryMaskOnlyMarks(from, to) {
-	for (const table of [
-		freshNoEchoValuesOf,
-		containmentValuesOf,
-		noEchoParameterValuesOf
-	]) {
-		const marks = table.get(from);
-		if (marks === void 0) continue;
-		for (const plaintext of marks) if (isMaskOnlyPlaintext(to, plaintext)) sideSetOf(table, to).add(plaintext);
-	}
-}
-function isKnownSecretExpression(expression, secretExpressions) {
-	return isSecretExpressionByVerdictOrSpelling(expression) || secretExpressions.has(expression);
-}
-function isSecretExpressionByVerdictOrSpelling(expression) {
-	return expression.startsWith("{{resolve:secretsmanager:") || expression.startsWith("{{resolve:ssm-secure:") || isRecordedSecretExpression(expression);
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/cross-stack.ts
-const crossStackAssociations = /* @__PURE__ */ new WeakMap();
-const CONFLICTING_CROSS_STACK = Symbol("conflicting cross-stack association");
-const CROSS_STACK_KEY_SEPARATOR = "\0";
-function literalStringOrUndefined(value) {
-	return typeof value === "string" && value !== "" ? value : void 0;
-}
-function splitGetAttStringForm(getAtt) {
-	const firstDot = getAtt.indexOf(".");
-	if (firstDot <= 0 || firstDot === getAtt.length - 1) return void 0;
-	return {
-		logicalId: getAtt.slice(0, firstDot),
-		attributeName: getAtt.slice(firstDot + 1)
-	};
-}
-function crossStackSourceKey(source) {
-	const keys = Object.keys(source);
-	if (keys.length !== 1) return void 0;
-	const key = keys[0];
-	if (key === "Fn::ImportValue") {
-		const exportName = literalStringOrUndefined(source[key]);
-		if (exportName === void 0) return void 0;
-		return ["Fn::ImportValue", exportName].join(CROSS_STACK_KEY_SEPARATOR);
-	}
-	if (key === "Fn::GetStackOutput") {
-		const args = source[key];
-		if (!isPlainObject$7(args)) return void 0;
-		const stackName = Object.hasOwn(args, "StackName") ? literalStringOrUndefined(args["StackName"]) : void 0;
-		const outputName = Object.hasOwn(args, "OutputName") ? literalStringOrUndefined(args["OutputName"]) : void 0;
-		if (stackName === void 0 || outputName === void 0) return void 0;
-		const slots = [
-			"Fn::GetStackOutput",
-			stackName,
-			outputName
-		];
-		for (const optional of ["Region", "RoleArn"]) {
-			const raw = Object.hasOwn(args, optional) ? args[optional] : void 0;
-			if (raw === void 0 || raw === null) {
-				slots.push("");
-				continue;
-			}
-			const literal = literalStringOrUndefined(raw);
-			if (literal === void 0) return void 0;
-			slots.push(literal);
-		}
-		return slots.join(CROSS_STACK_KEY_SEPARATOR);
-	}
-	if (key === "Fn::GetAtt") {
-		const raw = source[key];
-		let logicalId;
-		let attributeName;
-		if (typeof raw === "string") {
-			const split = splitGetAttStringForm(raw);
-			if (split === void 0) return void 0;
-			logicalId = split.logicalId;
-			attributeName = split.attributeName;
-		} else if (Array.isArray(raw) && raw.length === 2) {
-			logicalId = literalStringOrUndefined(raw[0]);
-			attributeName = literalStringOrUndefined(raw[1]);
-		}
-		if (logicalId === void 0 || attributeName === void 0) return void 0;
-		return [
-			"Fn::GetAtt",
-			logicalId,
-			attributeName
-		].join(CROSS_STACK_KEY_SEPARATOR);
-	}
-	if (key === "Fn::Sub") {
-		const raw = source[key];
-		let template;
-		let variables;
-		if (typeof raw === "string") template = raw;
-		else if (Array.isArray(raw) && raw.length === 2 && isPlainObject$7(raw[1])) {
-			if (typeof raw[0] !== "string") return void 0;
-			template = raw[0];
-			variables = raw[1];
-		}
-		if (template === void 0) return void 0;
-		const only = /^\$\{(!)?([^}]*)\}$/.exec(template);
-		if (only === null || only[1] === "!") return void 0;
-		const varName = only[2] ?? "";
-		if (varName in (variables ?? {})) return void 0;
-		const split = splitGetAttStringForm(varName);
-		if (split === void 0) return void 0;
-		return [
-			"Fn::GetAtt",
-			split.logicalId,
-			split.attributeName
-		].join(CROSS_STACK_KEY_SEPARATOR);
-	}
-	if (key === "Ref") {
-		const parameterName = literalStringOrUndefined(source[key]);
-		if (parameterName === void 0) return void 0;
-		return ["Ref", parameterName].join(CROSS_STACK_KEY_SEPARATOR);
-	}
-}
-function recordCrossStackExpression(secrets, key, expression, plaintext) {
-	if (!isSingleDynamicReferenceToken(expression)) return;
-	let associations = crossStackAssociations.get(secrets);
-	if (associations === void 0) {
-		associations = /* @__PURE__ */ new Map();
-		crossStackAssociations.set(secrets, associations);
-	}
-	storeAssociation(associations, key, expression, plaintext);
-}
-function storeAssociation(associations, key, expression, plaintext) {
-	const seen = associations.get(key);
-	if (seen === void 0) {
-		associations.set(key, {
-			expression,
-			plaintext
-		});
-		return;
-	}
-	if (typeof seen === "symbol") return;
-	if (seen.expression !== expression || seen.plaintext !== plaintext) associations.set(key, CONFLICTING_CROSS_STACK);
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/certified-positions.ts
-function plaintextIndexOf(secrets) {
-	const plaintextOf = /* @__PURE__ */ new Map();
-	for (const [plaintext, expression] of secrets) plaintextOf.set(expression, plaintextOf.has(expression) ? CONFLICTING_PLAINTEXT : plaintext);
-	return plaintextOf;
-}
-function certifiedExpressionForLeaf(secrets, association, leaf) {
-	if (typeof leaf !== "string" || leaf === "") return void 0;
-	if (!secrets.has(leaf)) return void 0;
-	if (association.plaintext !== leaf) return void 0;
-	const recordedPlaintext = plaintextIndexOf(secrets).get(association.expression);
-	if (recordedPlaintext !== void 0 && recordedPlaintext !== leaf) return void 0;
-	return association.expression;
-}
-function certifiedListForLeaf(secrets, association, bag) {
-	const certified = bag.map((element) => certifiedExpressionForLeaf(secrets, association, element));
-	if (certified.every((expression) => expression === void 0)) return void 0;
-	return bag.map((element, i) => certified[i] ?? redactForState(element, {
-		provenance: "value-scan",
-		secrets
-	}));
-}
-function associationForSource(source, secrets) {
-	const key = crossStackSourceKey(source);
-	if (key === void 0) return void 0;
-	const associations = crossStackAssociations.get(secrets);
-	if (associations === void 0) return void 0;
-	const association = associations.get(key);
-	if (association === void 0 || typeof association === "symbol") return void 0;
-	return association;
-}
-function positionByCrossStackSource(bag, source, secrets) {
-	const association = associationForSource(source, secrets);
-	if (association === void 0) return void 0;
-	return certifiedExpressionForLeaf(secrets, association, bag);
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/resolver-outcomes.ts
-const CONFLICTING = Symbol("cdkd.resolver-outcome.conflicting");
-const takenBranches = /* @__PURE__ */ new WeakMap();
-function recordTakenIfBranch(secrets, source, tookTrueBranch) {
-	let taken = takenBranches.get(secrets);
-	if (taken === void 0) {
-		taken = /* @__PURE__ */ new WeakMap();
-		takenBranches.set(secrets, taken);
-	}
-	const previous = taken.get(source);
-	if (previous === void 0) taken.set(source, tookTrueBranch);
-	else if (previous !== tookTrueBranch) taken.set(source, CONFLICTING);
-}
-function takenIfBranchOf(secrets, source) {
-	const taken = takenBranches.get(secrets)?.get(source);
-	return taken === CONFLICTING ? void 0 : taken;
-}
-const droppedElements = /* @__PURE__ */ new WeakMap();
-function recordDroppedArrayElements(secrets, source, dropped) {
-	let arrays = droppedElements.get(secrets);
-	if (arrays === void 0) {
-		arrays = /* @__PURE__ */ new WeakMap();
-		droppedElements.set(secrets, arrays);
-	}
-	const previous = arrays.get(source);
-	if (previous === void 0) arrays.set(source, [...dropped]);
-	else if (previous !== CONFLICTING && (previous.length !== dropped.length || previous.some((index, i) => index !== dropped[i]))) arrays.set(source, CONFLICTING);
-}
-function droppedArrayElementsOf(secrets, source) {
-	const dropped = droppedElements.get(secrets)?.get(source);
-	return dropped === CONFLICTING ? void 0 : dropped;
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/physical-name-copies.ts
-const physicalNameCopiesOf = /* @__PURE__ */ new WeakMap();
-function recordPhysicalNameCopy(secrets, physicalId) {
-	if (physicalId === "") return;
-	sideSetOf(physicalNameCopiesOf, secrets).add(physicalId);
-}
-const attributeIdCopiesOf = /* @__PURE__ */ new WeakMap();
-function recordAttributeIdCopy(secrets, physicalId) {
-	if (physicalId === "") return;
-	sideSetOf(attributeIdCopiesOf, secrets).add(physicalId);
-}
-function physicalNameSpans(names, value) {
-	const spans = [];
-	if (names === void 0) return spans;
-	for (const name of names) for (let at = value.indexOf(name); at !== -1; at = value.indexOf(name, at + 1)) spans.push({
-		start: at,
-		end: at + name.length
-	});
-	return spans;
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/fresh-noecho.ts
-function embedsFreshNoEchoValue(text, secrets, freshClass) {
-	const fresh = freshNoEchoValuesOf.get(secrets);
-	if (fresh === void 0) return false;
-	for (const value of fresh) {
-		if (freshClass !== void 0 && isNoEchoParameterPlaintext(secrets, value) !== (freshClass === "parameter")) continue;
-		if (isMaskOnlyPlaintext(secrets, value) && text.includes(value)) return true;
-	}
-	return false;
-}
-function carriesFreshNoEchoValue(value, secrets, freshClass) {
-	const isFresh = freshNoEchoLeafTest(secrets, freshClass);
-	if (isFresh === void 0) return false;
-	const seen = /* @__PURE__ */ new Set();
-	const walk = (node) => {
-		if (typeof node === "string") return isFresh(node);
-		if (node === null || typeof node !== "object") return false;
-		if (seen.has(node)) return false;
-		seen.add(node);
-		if (Array.isArray(node)) return node.some((item) => walk(item));
-		return Object.values(node).some((child) => walk(child));
-	};
-	return walk(value);
-}
-function freshNoEchoLeafPositions(value, secrets, freshClass) {
-	const isFresh = freshNoEchoLeafTest(secrets, freshClass);
-	if (isFresh === void 0) return [];
-	const leaves = [];
-	const ancestors = /* @__PURE__ */ new Set();
-	const walk = (node, path) => {
-		if (typeof node === "string") {
-			if (isFresh(node)) leaves.push({
-				path,
-				plaintext: node
-			});
-			return;
-		}
-		if (node === null || typeof node !== "object") return;
-		if (ancestors.has(node)) return;
-		ancestors.add(node);
-		if (Array.isArray(node)) node.forEach((item, index) => walk(item, [...path, index]));
-		else for (const [key, child] of Object.entries(node)) walk(child, [...path, key]);
-		ancestors.delete(node);
-	};
-	walk(value, []);
-	return leaves;
-}
-function freshNoEchoLeafTest(secrets, freshClass) {
-	const all = freshNoEchoValuesOf.get(secrets);
-	if (all === void 0 || all.size === 0) return void 0;
-	const fresh = freshClass === void 0 ? all : new Set([...all].filter((value) => isNoEchoParameterPlaintext(secrets, value) === (freshClass === "parameter")));
-	if (fresh.size === 0) return void 0;
-	const needles = containmentNeedlesOf(secrets).filter((needle) => fresh.has(needle));
-	return (leaf) => fresh.has(leaf) && isMaskOnlyPlaintext(secrets, leaf) || leaf !== "***" && embedsNeedleOutsideReferences(leaf, needles, secrets);
-}
-function containmentNeedlesOf(secrets) {
-	const values = containmentValuesOf.get(secrets);
-	if (values === void 0 || values.size === 0) return [];
-	const needles = [];
-	for (const value of values) if (value.length >= 4 && isMaskOnlyPlaintext(secrets, value)) needles.push(value);
-	return needles;
-}
-function isStrictlyInsideASpan(spans, start, end) {
-	return spans.some((span) => span.start <= start && end <= span.end && (span.start !== start || span.end !== end));
-}
-function embedsNeedleOutsideReferences(leaf, needles, secrets) {
-	return needleOccurrencesOutsideReferences(leaf, needles, secrets, true).length > 0;
-}
-function needleOccurrencesOutsideReferences(leaf, needles, secrets, first) {
-	const found = [];
-	let spans;
-	let names;
-	for (const needle of needles) for (let at = leaf.indexOf(needle); at >= 0; at = leaf.indexOf(needle, at + 1)) {
-		spans ??= isDynamicReferenceString(leaf) ? resolvableReferenceSpans(leaf, new Set(secrets.values())) : [];
-		if (isStrictlyInsideASpan(spans, at, at + needle.length)) continue;
-		names ??= physicalNameSpans(physicalNameCopiesOf.get(secrets), leaf);
-		const end = at + needle.length;
-		if (names.some((n) => n.start <= at && end <= n.end)) continue;
-		found.push({
-			start: at,
-			end
-		});
-		if (first) return found;
-	}
-	return found;
-}
-function cutsContainmentNeedle(leaf, secrets, redacted) {
-	if (redacted.length === 0) return false;
-	const needles = containmentNeedlesOf(secrets);
-	if (needles.length === 0) return false;
-	return needleOccurrencesOutsideReferences(leaf, needles, secrets, false).some((c) => redacted.some((m) => m.start < c.end && c.start < m.end && !(m.start <= c.start && c.end <= m.end)));
-}
-function flattenEmbeddedNoEchoLeaves(value, secrets) {
-	const needles = containmentNeedlesOf(secrets);
-	if (needles.length === 0) return value;
-	const flattens = (leaf) => leaf !== "***" && embedsNeedleOutsideReferences(leaf, needles, secrets);
-	const walk = (node) => {
-		if (typeof node === "string") return flattens(node) ? "***" : node;
-		if (node === null || typeof node !== "object") return node;
-		if (Array.isArray(node)) {
-			let changed = false;
-			const out = node.map((item) => {
-				const next = walk(item);
-				if (next !== item) changed = true;
-				return next;
-			});
-			return changed ? out : node;
-		}
-		if (isOrdinaryDate(node)) {
-			const persisted = node.toJSON();
-			return typeof persisted === "string" && flattens(persisted) ? "***" : node;
-		}
-		let out;
-		for (const [key, child] of Object.entries(node)) {
-			const next = walk(child);
-			if (next === child) continue;
-			out ??= Object.assign(Object.create(null), node);
-			out[key] = next;
-		}
-		return out ?? node;
-	};
-	return walk(value);
-}
-function substringNeedlesOf(secrets) {
-	const needles = [];
-	for (const plaintext of secrets.keys()) if (!isMaskOnlyPlaintext(secrets, plaintext)) needles.push(plaintext);
-	return needles;
-}
-function recordedExpressionsOf(secrets) {
-	const expressions = /* @__PURE__ */ new Set();
-	for (const [plaintext, expression] of secrets) if (!isMaskOnlyPlaintext(secrets, plaintext)) expressions.add(expression);
-	return expressions;
-}
-const recoverableMaskedOutputs = /* @__PURE__ */ new Map();
-function maskedOutputKey(identity, stackName, region, outputKey) {
-	return `${identity}\u0000${stackName}\u0000${region}\u0000${outputKey}`;
-}
-function recordRecoverableMaskedOutput(identity, stackName, region, outputKey, plaintext) {
-	recoverableMaskedOutputs.set(maskedOutputKey(identity, stackName, region, outputKey), plaintext);
-}
-function recoverMaskedOutput(identity, stackName, region, outputKey) {
-	return recoverableMaskedOutputs.get(maskedOutputKey(identity, stackName, region, outputKey));
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/nested-stack.ts
-const NESTED_STACK_RESOURCE_TYPE$4 = "AWS::CloudFormation::Stack";
-const nestedStackParameterExpressions = /* @__PURE__ */ new WeakMap();
-const renderedParameterSpellings = /* @__PURE__ */ new WeakMap();
-const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
-function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, provenance = "template-derived") {
-	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$4) return;
-	if (secrets.size === 0) return;
-	if (!isPlainObject$7(resolvedProperties) || !isPlainObject$7(sourceProperties)) return;
-	if (!Object.hasOwn(resolvedProperties, "Parameters")) return;
-	if (!Object.hasOwn(sourceProperties, "Parameters")) return;
-	const resolvedParameters = resolvedProperties["Parameters"];
-	const sourceParameters = sourceProperties["Parameters"];
-	if (!isPlainObject$7(resolvedParameters) || !isPlainObject$7(sourceParameters)) return;
-	const positioned = redactAtProvenance({ ...resolvedParameters }, secrets, sourceParameters, provenance, true);
-	let table = nestedStackParameterExpressions.get(secrets);
-	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
-		const sourceLeaf = sourceParameters[name];
-		if (typeof resolvedValue !== "string" || typeof sourceLeaf !== "string") continue;
-		if (isSingleDynamicReferenceToken(sourceLeaf) || positioned[name] !== sourceLeaf) continue;
-		if (!rendersLiteralTo(sourceLeaf, secrets, resolvedValue)) continue;
-		let rendered = renderedParameterSpellings.get(secrets);
-		if (rendered === void 0) {
-			rendered = /* @__PURE__ */ new Map();
-			renderedParameterSpellings.set(secrets, rendered);
-		}
-		const previous = rendered.get(name);
-		if (previous === void 0) rendered.set(name, {
-			spelling: sourceLeaf,
-			value: resolvedValue
-		});
-		else if (previous?.spelling !== sourceLeaf || previous.value !== resolvedValue) rendered.set(name, null);
-	}
-	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
-		if (typeof resolvedValue !== "string" || !secrets.has(resolvedValue)) continue;
-		const expression = positioned[name];
-		if (typeof expression !== "string") continue;
-		if (!isSingleDynamicReferenceToken(expression)) continue;
-		const sourceLeaf = sourceParameters[name];
-		if (typeof sourceLeaf === "string" && expression !== sourceLeaf) continue;
-		if (expression === resolvedValue) continue;
-		const seenResolvingTo = plaintextIndexOf(secrets).get(expression);
-		if (seenResolvingTo !== void 0 && seenResolvingTo !== resolvedValue) continue;
-		if (typeof sourceLeaf === "string" && resolvedPlaintextOf(secrets, expression) !== resolvedValue) continue;
-		if (table === void 0) {
-			table = /* @__PURE__ */ new Map();
-			nestedStackParameterExpressions.set(secrets, table);
-		}
-		storeAssociation(table, name, expression, resolvedValue);
-	}
-	const framesByValue = /* @__PURE__ */ new Map();
-	const tokensOf = /* @__PURE__ */ new Map();
-	const frameSpellings = /* @__PURE__ */ new Map();
-	const frameSpellingOf = (name) => {
-		if (!frameSpellings.has(name)) frameSpellings.set(name, computeFrameSpelling(name));
-		return frameSpellings.get(name);
-	};
-	const computeFrameSpelling = (name) => {
-		const resolvedValue = resolvedParameters[name];
-		if (typeof resolvedValue !== "string") return void 0;
-		const sourceLeaf = sourceParameters[name];
-		if (typeof sourceLeaf === "string") return sourceLeaf;
-		if (!isPlainObject$7(sourceLeaf)) return void 0;
-		const written = positioned[name];
-		if (typeof written !== "string") return void 0;
-		const rendered = intrinsicSkeletonSegments(sourceLeaf)?.map((s) => s === UNKNOWN_PART ? "\0" : s).join("");
-		const spans = rendered === void 0 ? [] : dynamicReferenceSpans(rendered);
-		if (rendered !== void 0 && spans.length === 1) {
-			const [span] = spans;
-			const ownToken = rendered.slice(span.start, span.end);
-			if (written !== resolvedValue && SPELLED_SECRET_REFERENCE_PREFIXES.some((prefix) => ownToken.startsWith(prefix))) return written;
-		}
-		const substituted = substitutedSpellingOf(secrets, sourceLeaf, resolvedValue);
-		if (substituted === void 0) return void 0;
-		return written === resolvedValue || written === substituted ? substituted : void 0;
-	};
-	const certifiedSpellingOf = (name) => {
-		const sourceLeaf = sourceParameters[name];
-		if (typeof sourceLeaf === "string") return positioned[name] === sourceLeaf ? sourceLeaf : void 0;
-		return frameSpellingOf(name);
-	};
-	const unwrittenValues = /* @__PURE__ */ new Set();
-	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
-		if (typeof resolvedValue !== "string") continue;
-		const spelling = frameSpellingOf(name);
-		const frame = spelling === void 0 ? void 0 : singleSpanFrame(resolvedValue, spelling);
-		const frames = framesByValue.get(resolvedValue) ?? /* @__PURE__ */ new Set();
-		const unframed = frame === void 0 || resolvedPlaintextOf(secrets, frame.token) !== frame.middle;
-		frames.add(unframed ? UNFRAMED_SPELLING : `${frame.prefix.length}:${frame.prefix}${frame.suffix}`);
-		framesByValue.set(resolvedValue, frames);
-		if (!unframed) {
-			const tokens = tokensOf.get(resolvedValue) ?? /* @__PURE__ */ new Set();
-			tokens.add(frame.token);
-			tokensOf.set(resolvedValue, tokens);
-			if (typeof sourceParameters[name] !== "string" && positioned[name] !== spelling) unwrittenValues.add(resolvedValue);
-		}
-	}
-	for (const value of unwrittenValues) if (tokensOf.get(value)?.size !== 1) framesByValue.get(value)?.add(UNFRAMED_SPELLING);
-	const rowWithoutParameters = {};
-	for (const [key, value] of Object.entries(resolvedProperties)) if (key !== "Parameters") rowWithoutParameters[key] = value;
-	const outsideLeaves = wholeStringLeavesOf(rowWithoutParameters);
-	const framed = /* @__PURE__ */ new Map();
-	const framedByName = [];
-	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
-		if (typeof resolvedValue !== "string") continue;
-		const spelling = certifiedSpellingOf(name);
-		if (spelling === void 0) continue;
-		if (redactForState(resolvedValue, {
-			provenance: "value-scan",
-			secrets
-		}) !== resolvedValue) continue;
-		const frame = singleSpanFrame(resolvedValue, spelling);
-		if (frame === void 0 || resolvedPlaintextOf(secrets, frame.token) !== frame.middle) continue;
-		if (framesByValue.get(resolvedValue)?.size !== 1) continue;
-		const isNeedle = resolvedValue.length >= 4;
-		const rewrites = (leaf) => leaf === resolvedValue || isNeedle && leaf.includes(resolvedValue);
-		let embedded = false;
-		for (const leaf of outsideLeaves) if (rewrites(leaf)) {
-			embedded = true;
-			break;
-		}
-		for (const other of Object.values(resolvedParameters)) {
-			if (embedded) break;
-			if (typeof other === "string") {
-				if (other !== resolvedValue && rewrites(other)) embedded = true;
-				continue;
-			}
-			for (const leaf of wholeStringLeavesOf(other)) if (rewrites(leaf)) {
-				embedded = true;
-				break;
-			}
-		}
-		if (embedded) continue;
-		framedByName.push([
-			name,
-			spelling,
-			resolvedValue
-		]);
-		if (secrets.get(frame.middle) !== frame.token && tokensOf.get(resolvedValue)?.size !== 1) continue;
-		framed.set(resolvedValue, spelling);
-	}
-	for (const [plaintext, expression] of framed) secrets.set(plaintext, expression);
-	for (const [name, expression, plaintext] of framedByName) {
-		if (table === void 0) {
-			table = /* @__PURE__ */ new Map();
-			nestedStackParameterExpressions.set(secrets, table);
-		}
-		storeAssociation(table, name, expression, plaintext);
-	}
-}
-function inheritNestedStackParameterAssociations(childSecrets, parentSecrets) {
-	const table = nestedStackParameterExpressions.get(parentSecrets);
-	if (table === void 0 || table.size === 0) return;
-	let associations = crossStackAssociations.get(childSecrets);
-	for (const [name, association] of table) {
-		const key = crossStackSourceKey({ Ref: name });
-		if (key === void 0) continue;
-		if (associations === void 0) {
-			associations = /* @__PURE__ */ new Map();
-			crossStackAssociations.set(childSecrets, associations);
-		}
-		if (typeof association === "symbol") {
-			associations.set(key, association);
-			continue;
-		}
-		storeAssociation(associations, key, association.expression, association.plaintext);
-	}
-}
-function inheritedParameterExpression(parentSecrets, parameterName, resolvedValue) {
-	const association = nestedStackParameterExpressions.get(parentSecrets)?.get(parameterName);
-	if (association === void 0) return renderedParameterSpelling(parentSecrets, parameterName, resolvedValue);
-	if (typeof association === "symbol") return void 0;
-	if (Array.isArray(resolvedValue)) return certifiedListForLeaf(parentSecrets, association, resolvedValue);
-	return certifiedExpressionForLeaf(parentSecrets, association, resolvedValue);
-}
-function renderedParameterSpelling(parentSecrets, parameterName, resolvedValue) {
-	if (typeof resolvedValue !== "string" || parentSecrets.has(resolvedValue)) return void 0;
-	const rendered = renderedParameterSpellings.get(parentSecrets)?.get(parameterName);
-	if (rendered == null || rendered.value !== resolvedValue) return void 0;
-	if (!rendersLiteralTo(rendered.spelling, parentSecrets, resolvedValue)) return void 0;
-	return rendered.spelling;
-}
-function inheritedRenderedToken(parentSecrets, parameterName, value, plaintext) {
-	const spelling = inheritedParameterExpression(parentSecrets, parameterName, value);
-	if (typeof spelling !== "string" || isSingleDynamicReferenceToken(spelling)) return void 0;
-	return renderedTokenOf(spelling, parentSecrets, plaintext);
-}
-function withdrawRenderedParameterSpelling(parentSecrets, parameterName) {
-	const rendered = renderedParameterSpellings.get(parentSecrets);
-	if (rendered?.has(parameterName)) rendered.set(parameterName, null);
-}
-function inheritedRenderedSpan(childSecrets, key, text) {
-	const reads = inheritedParameterReads.get(childSecrets);
-	if (reads === void 0 || typeof reads === "symbol") return void 0;
-	for (const name of reads.names) {
-		if (crossStackSourceKey({ Ref: name }) !== key) continue;
-		const value = renderedParameterSpellings.get(reads.parent)?.get(name)?.value;
-		if (value === void 0 || text !== void 0 && text !== value) return void 0;
-		if (carriesChildOnlyPlaintext(value, childSecrets, reads.parent)) return void 0;
-		const spelling = inheritedParameterExpression(reads.parent, name, value);
-		if (typeof spelling !== "string") return void 0;
-		if (redactForState(spelling, {
-			provenance: "value-scan",
-			secrets: childSecrets
-		}) !== spelling) return void 0;
-		return {
-			value,
-			spelling
-		};
-	}
-}
-const inheritedParameterReads = /* @__PURE__ */ new WeakMap();
-const POISONED_PARAMETER_READS = Symbol("cdkd.inherited-parameter-reads.poisoned");
-function parameterReadsFor(childSecrets, parentSecrets) {
-	const reads = inheritedParameterReads.get(childSecrets);
-	if (reads === void 0) {
-		const created = {
-			parent: parentSecrets,
-			names: /* @__PURE__ */ new Set(),
-			values: /* @__PURE__ */ new Map()
-		};
-		inheritedParameterReads.set(childSecrets, created);
-		return created;
-	}
-	if (typeof reads === "symbol") return void 0;
-	if (reads.parent !== parentSecrets) {
-		inheritedParameterReads.set(childSecrets, POISONED_PARAMETER_READS);
-		return;
-	}
-	return reads;
-}
-function recordInheritedParameterValue(childSecrets, parentSecrets, parameterName, value, declared) {
-	const reads = parameterReadsFor(childSecrets, parentSecrets);
-	if (reads === void 0) return;
-	if (declared !== void 0) {
-		if (reads.declared === void 0) reads.declared = declared;
-		else if (reads.declared.size !== declared.size || [...declared].some((name) => !reads.declared.has(name))) {
-			inheritedParameterReads.set(childSecrets, POISONED_PARAMETER_READS);
-			return;
-		}
-	}
-	if (reads.values.has(parameterName)) {
-		if (!deepEqualJsonValue(reads.values.get(parameterName), value)) inheritedParameterReads.set(childSecrets, POISONED_PARAMETER_READS);
-		return;
-	}
-	reads.values.set(parameterName, value);
-}
-function recordInheritedParameterRead(childSecrets, parentSecrets, parameterName) {
-	parameterReadsFor(childSecrets, parentSecrets)?.names.add(parameterName);
-}
-function redactInheritedParameterValue(parentSecrets, parameterName, value) {
-	return inheritedParameterExpression(parentSecrets, parameterName, value) ?? redactForState(value, {
-		provenance: "value-scan",
-		secrets: parentSecrets
-	});
-}
-function positionByInheritedParameter(bag, source, secrets) {
-	const keys = Object.keys(source);
-	if (keys.length !== 1 || keys[0] !== "Ref") return void 0;
-	const name = source["Ref"];
-	if (typeof name !== "string") return void 0;
-	const reads = inheritedParameterReads.get(secrets);
-	if (reads === void 0 || typeof reads === "symbol" || !reads.names.has(name)) return;
-	if (typeof bag !== "string" && !Array.isArray(bag)) return void 0;
-	if (carriesChildOnlyPlaintext(bag, secrets, reads.parent)) return void 0;
-	const answer = redactInheritedParameterValue(reads.parent, name, bag);
-	if (!deepEqualJsonValue(redactForState(answer, {
-		provenance: "value-scan",
-		secrets
-	}), answer)) return void 0;
-	return answer;
-}
-const REREAD_PSEUDO_PARAMETERS = /* @__PURE__ */ new Set([
-	"AWS::Region",
-	"AWS::Partition",
-	"AWS::URLSuffix",
-	"AWS::AccountId"
-]);
-function templateRereadsAccountId(template) {
-	if (template === void 0) return false;
-	const resources = template.Resources !== null && typeof template.Resources === "object" ? template.Resources : void 0;
-	const cached = resources && accountRereadVerdicts.get(resources);
-	if (cached !== void 0 && cached.outputs === template.Outputs) return cached.verdict;
-	const parts = resources ? Object.values(resources) : [];
-	if (template.Outputs !== void 0) parts.push(template.Outputs);
-	const verdict = parts.some(partRereadsAccountId);
-	if (resources) accountRereadVerdicts.set(resources, {
-		outputs: template.Outputs,
-		verdict
-	});
-	return verdict;
-}
-const accountRereadVerdicts = /* @__PURE__ */ new WeakMap();
-function partRereadsAccountId(part) {
-	let trigger = false;
-	let account = false;
-	const pending = [part];
-	while (pending.length > 0 && !(trigger && account)) {
-		const node = pending.pop();
-		if (Array.isArray(node)) {
-			pending.push(...node);
-			continue;
-		}
-		if (node === null || typeof node !== "object") continue;
-		for (const [key, value] of Object.entries(node)) {
-			if (REREAD_TRIGGERS.has(key)) trigger = true;
-			if (key === "Ref" && value === "AWS::AccountId") account = true;
-			if (key === "Fn::Sub") {
-				const text = Array.isArray(value) ? value[0] : value;
-				if (typeof text === "string" && text.includes("${AWS::AccountId}")) account = true;
-			}
-			pending.push(value);
-		}
-	}
-	return trigger && account;
-}
-const inheritedPseudoParameters = /* @__PURE__ */ new WeakMap();
-const POISONED_PSEUDO_PARAMETERS = Symbol("cdkd.inherited-pseudo-parameters.poisoned");
-function recordInheritedPseudoParameters(inheritedSecrets, values) {
-	let table = inheritedPseudoParameters.get(inheritedSecrets);
-	if (table === POISONED_PSEUDO_PARAMETERS) return;
-	if (table === void 0) {
-		table = /* @__PURE__ */ new Map();
-		inheritedPseudoParameters.set(inheritedSecrets, table);
-	}
-	for (const [name, value] of values) {
-		if (!REREAD_PSEUDO_PARAMETERS.has(name) || typeof value !== "string") continue;
-		const known = table.get(name);
-		if (known !== void 0 && known !== value) {
-			inheritedPseudoParameters.set(inheritedSecrets, POISONED_PSEUDO_PARAMETERS);
-			return;
-		}
-		table.set(name, value);
-	}
-}
-function pseudoBindingOf(parentSecrets) {
-	const table = inheritedPseudoParameters.get(parentSecrets);
-	return (name) => table instanceof Map && table.has(name) ? { value: table.get(name) } : void 0;
-}
-function inheritedPseudoValue(parentSecrets, name) {
-	const bound = pseudoBindingOf(parentSecrets)(name)?.value;
-	return typeof bound === "string" ? bound : void 0;
-}
-function inheritedPseudoSpan(childSecrets, key) {
-	const reads = inheritedParameterReads.get(childSecrets);
-	if (reads === void 0 || typeof reads === "symbol") return void 0;
-	for (const name of REREAD_PSEUDO_PARAMETERS) if (crossStackSourceKey({ Ref: name }) === key) return inheritedPseudoValue(reads.parent, name);
-}
-const REREAD_TRIGGERS = /* @__PURE__ */ new Set([
-	"Fn::Select",
-	"Fn::Split",
-	"Fn::If"
-]);
-const MAX_REREAD_DEPTH = 16;
-const MAX_REREAD_CONDITIONS = 4;
-const REREAD_NO_VALUE = Symbol("cdkd.reread.no-value");
-function splitOutsideDynamicReferences(text, delimiter, standsForSecret) {
-	if (delimiter === "") return text.split(delimiter);
-	const spans = dynamicReferenceSpans(text).filter((span) => {
-		const token = text.slice(span.start, span.end);
-		return spanNamesResolvableService(token) && standsForSecret(token);
-	});
-	if (spans.length === 0) return text.split(delimiter);
-	const pieces = [];
-	let cursor = 0;
-	let from = 0;
-	for (;;) {
-		const at = text.indexOf(delimiter, from);
-		if (at === -1) break;
-		const end = at + delimiter.length;
-		const token = spans.find((span) => span.start < end && at < span.end);
-		if (token !== void 0) {
-			from = token.end;
-			continue;
-		}
-		pieces.push(text.slice(cursor, at));
-		cursor = end;
-		from = end;
-	}
-	pieces.push(text.slice(cursor));
-	return pieces;
-}
-function standsForInheritedSecret(parentSecrets, token) {
-	return parentSecrets !== void 0 && resolvedPlaintextOf(parentSecrets, token) !== void 0;
-}
-const plainSplit = (text, delimiter) => text.split(delimiter);
-function evaluatePureRead(node, bind, pseudo, split, choose, depth = 0) {
-	if (depth > MAX_REREAD_DEPTH) return void 0;
-	const evaluate = (child) => evaluatePureRead(child, bind, pseudo, split, choose, depth + 1);
-	if (typeof node === "string") return node.includes("{{resolve:") ? void 0 : { value: node };
-	if (Array.isArray(node)) {
-		const out = [];
-		for (const element of node) {
-			const evaluated = evaluate(element);
-			if (evaluated === void 0 || evaluated.value === REREAD_NO_VALUE) return void 0;
-			out.push(evaluated.value);
-		}
-		return { value: out };
-	}
-	if (!isPlainObject$7(node)) return void 0;
-	const keys = Object.keys(node);
-	if (keys.length !== 1) return void 0;
-	const key = keys[0];
-	const args = node[key];
-	if (key === "Ref") {
-		if (args === "AWS::NoValue") return { value: REREAD_NO_VALUE };
-		return typeof args === "string" ? bindReadName(args, bind, pseudo) : void 0;
-	}
-	if (key === "Fn::If") {
-		if (!Array.isArray(args) || args.length !== 3 || typeof args[0] !== "string") return void 0;
-		const tookTrue = choose(args[0], node);
-		if (tookTrue === void 0) return void 0;
-		return evaluate(tookTrue ? args[1] : args[2]);
-	}
-	if (key === "Fn::Sub") return evaluatePureSub(args, bind, pseudo, evaluate);
-	if (!Array.isArray(args) || args.length !== 2) return void 0;
-	if (key === "Fn::Select") {
-		const index = args[0];
-		const position = typeof index === "number" ? index : typeof index === "string" && /^(0|[1-9][0-9]*)$/.test(index) ? Number(index) : void 0;
-		if (position === void 0 || !Number.isSafeInteger(position) || position < 0) return void 0;
-		const list = evaluate(args[1]);
-		if (list === void 0 || !Array.isArray(list.value) || position >= list.value.length) return;
-		return { value: list.value[position] };
-	}
-	const delimiter = args[0];
-	if (typeof delimiter !== "string") return void 0;
-	if (key === "Fn::Split") {
-		const value = evaluate(args[1]);
-		if (value === void 0 || typeof value.value !== "string") return void 0;
-		return { value: split(value.value, delimiter) };
-	}
-	if (key === "Fn::Join") {
-		const parts = evaluate(args[1]);
-		if (parts === void 0 || !Array.isArray(parts.value)) return void 0;
-		if (!parts.value.every((part) => typeof part === "string")) return void 0;
-		return { value: parts.value.join(delimiter) };
-	}
-}
-function evaluatePureSub(args, bind, pseudo, evaluate) {
-	const [text, variables] = typeof args === "string" ? [args, {}] : Array.isArray(args) && args.length === 2 ? [args[0], args[1]] : [void 0, void 0];
-	if (typeof text !== "string" || text.includes("{{resolve:") || !isPlainObject$7(variables)) return;
-	const bound = /* @__PURE__ */ new Map();
-	for (const [name, variable] of Object.entries(variables)) {
-		const evaluated = evaluate(variable);
-		if (evaluated === void 0 || typeof evaluated.value !== "string") return void 0;
-		bound.set(name, evaluated.value);
-	}
-	let out = "";
-	let cursor = 0;
-	for (const match of text.matchAll(/\$\{(!)?([^}]*)\}/g)) {
-		const name = match[2] ?? "";
-		let replacement;
-		if (match[1] === "!") replacement = `\${${name}}`;
-		else if (name === "") replacement = match[0];
-		else if (bound.has(name)) replacement = bound.get(name);
-		else {
-			if (name.includes(".")) return void 0;
-			const value = bindReadName(name, bind, pseudo);
-			if (value === void 0 || typeof value.value !== "string") return void 0;
-			replacement = value.value;
-		}
-		out += text.slice(cursor, match.index) + replacement;
-		cursor = match.index + match[0].length;
-	}
-	return { value: out + text.slice(cursor) };
-}
-function bindReadName(name, bind, pseudo) {
-	if (!name.startsWith("AWS::")) return bind(name);
-	return bind(name) === void 0 ? pseudo(name) : void 0;
-}
-function collectRereadConditions(node, names, depth = 0) {
-	if (depth > MAX_REREAD_DEPTH) return false;
-	if (Array.isArray(node)) return node.every((element) => collectRereadConditions(element, names, depth + 1));
-	if (!isPlainObject$7(node)) return true;
-	if (Object.hasOwn(node, "Fn::If")) {
-		const args = node["Fn::If"];
-		if (!Array.isArray(args) || typeof args[0] !== "string") return false;
-		names.add(args[0]);
-	}
-	return Object.values(node).every((child) => collectRereadConditions(child, names, depth + 1));
-}
-function holdsRereadTrigger(node, depth = 0) {
-	if (depth > MAX_REREAD_DEPTH) return false;
-	if (Array.isArray(node)) return node.some((element) => holdsRereadTrigger(element, depth + 1));
-	if (!isPlainObject$7(node)) return false;
-	return Object.entries(node).some(([key, child]) => REREAD_TRIGGERS.has(key) || holdsRereadTrigger(child, depth + 1));
-}
-function rendersReadTo(spelling, parentSecrets, value) {
-	if (typeof spelling === "string" && typeof value === "string") {
-		if (spelling === value) return redactForState(spelling, {
-			provenance: "value-scan",
-			secrets: parentSecrets
-		}) === spelling;
-		return rendersLiteralTo(spelling, parentSecrets, value);
-	}
-	if (Array.isArray(spelling) && Array.isArray(value) && spelling.length === value.length) return spelling.every((element, i) => rendersReadTo(element, parentSecrets, value[i]));
-	return false;
-}
-const REREAD_UNBOUND = Symbol("cdkd.reread.unbound");
-const REREAD_PARAMETER_FREE = Symbol("cdkd.reread.parameter-free");
-function diffSideReading(bind, parentSecrets) {
-	return {
-		bind: (name) => {
-			const bound = bind(name);
-			return bound && { value: redactInheritedParameterValue(parentSecrets, name, bound.value) };
-		},
-		split: (text, delimiter) => splitOutsideDynamicReferences(text, delimiter, (token) => standsForInheritedSecret(parentSecrets, token))
-	};
-}
-function rereadUnder(source, bind, parentSecrets, choose) {
-	const pseudo = pseudoBindingOf(parentSecrets);
-	const resolved = evaluatePureRead(source, bind, pseudo, plainSplit, choose);
-	if (resolved === void 0) return void 0;
-	const diffSide = diffSideReading(bind, parentSecrets);
-	const redacted = evaluatePureRead(source, diffSide.bind, pseudo, diffSide.split, choose);
-	if (redacted === void 0) return void 0;
-	if (resolved.value === REREAD_NO_VALUE || redacted.value === REREAD_NO_VALUE) return resolved.value === redacted.value ? REREAD_NO_VALUE : void 0;
-	if (!rendersReadTo(redacted.value, parentSecrets, resolved.value)) return void 0;
-	return {
-		resolved: resolved.value,
-		redacted: redacted.value
-	};
-}
-function namesParameterOnBranches(node, choose, isParameter, depth = 0) {
-	if (depth > MAX_REREAD_DEPTH) return true;
-	if (typeof node === "string") return node.includes("{{resolve:");
-	if (Array.isArray(node)) return node.some((element) => namesParameterOnBranches(element, choose, isParameter, depth + 1));
-	if (!isPlainObject$7(node)) return false;
-	if (Object.hasOwn(node, "Fn::If")) {
-		const args = node["Fn::If"];
-		if (Object.keys(node).length !== 1) return true;
-		if (!Array.isArray(args) || args.length !== 3 || typeof args[0] !== "string") return true;
-		const tookTrue = choose(args[0], node);
-		if (tookTrue === void 0) return true;
-		return namesParameterOnBranches(tookTrue ? args[1] : args[2], choose, isParameter, depth + 1);
-	}
-	if (typeof node["Ref"] === "string" && isParameter(node["Ref"])) return true;
-	const sub = node["Fn::Sub"];
-	const text = typeof sub === "string" ? sub : Array.isArray(sub) ? sub[0] : void 0;
-	if (typeof text === "string") {
-		for (const match of text.matchAll(/\$\{([^}!][^}]*)\}/g)) if (isParameter(match[1].trim()) || isParameter(match[1])) return true;
-	}
-	return Object.values(node).some((child) => namesParameterOnBranches(child, choose, isParameter, depth + 1));
-}
-function rereadAssignments(source, bind, parentSecrets, untakenWhenUnbound = () => false, parameterFree) {
-	if (!holdsRereadTrigger(source)) return void 0;
-	const conditions = /* @__PURE__ */ new Set();
-	if (!collectRereadConditions(source, conditions)) return void 0;
-	if (conditions.size > MAX_REREAD_CONDITIONS) return void 0;
-	const names = [...conditions];
-	const out = [];
-	for (let assignment = 0; assignment < 2 ** names.length; assignment++) {
-		const choose = (condition) => Math.floor(assignment / 2 ** names.indexOf(condition)) % 2 === 1;
-		let unbound = false;
-		const tracked = (name) => {
-			const bound = bind(name);
-			if (bound === void 0 && untakenWhenUnbound(name)) unbound = true;
-			return bound;
-		};
-		const reread = rereadUnder(source, tracked, parentSecrets, choose);
-		if (unbound) out.push(REREAD_UNBOUND);
-		else if (reread !== void 0) out.push(reread);
-		else if (parameterFree !== void 0 && !namesParameterOnBranches(source, choose, parameterFree)) out.push(REREAD_PARAMETER_FREE);
-		else out.push(void 0);
-	}
-	return out;
-}
-function rereadParameterExpression(source, bind, parentSecrets) {
-	const assignments = rereadAssignments(source, bind, parentSecrets, void 0, (name) => bind(name) !== void 0);
-	if (assignments === void 0 || assignments.includes(void 0) || assignments.includes(REREAD_UNBOUND)) return;
-	return assignments.find((entry) => entry !== void 0 && entry !== REREAD_NO_VALUE && entry !== REREAD_UNBOUND && entry !== REREAD_PARAMETER_FREE);
-}
-function ambiguousRereads(rereads) {
-	return rereads.some((a, i) => rereads.slice(i + 1).some((b) => deepEqualJsonValue(a.resolved, b.resolved) && !deepEqualJsonValue(a.redacted, b.redacted)));
-}
-function positionByParameterReread(bag, source, secrets) {
-	const reads = inheritedParameterReads.get(secrets);
-	if (reads === void 0 || typeof reads === "symbol") return void 0;
-	if (typeof bag !== "string" && !Array.isArray(bag)) return void 0;
-	if (!holdsRereadTrigger(source)) return void 0;
-	const bind = (name) => reads.values.has(name) ? { value: reads.values.get(name) } : void 0;
-	let unrecorded = false;
-	const recorded = rereadUnder(source, bind, reads.parent, (_, node) => {
-		const taken = takenIfBranchOf(secrets, node);
-		if (taken === void 0) unrecorded = true;
-		return taken;
-	});
-	let answer;
-	if (!unrecorded) {
-		if (recorded === void 0 || recorded === REREAD_NO_VALUE || !deepEqualJsonValue(recorded.resolved, bag)) return;
-		answer = recorded.redacted;
-	} else {
-		const declared = reads.declared;
-		const assignments = rereadAssignments(source, bind, reads.parent, (name) => declared?.has(name) === true);
-		if (assignments === void 0 || assignments.includes(void 0)) return void 0;
-		const matching = assignments.filter((entry) => entry !== void 0 && entry !== REREAD_NO_VALUE && entry !== REREAD_UNBOUND && entry !== REREAD_PARAMETER_FREE && deepEqualJsonValue(entry.resolved, bag));
-		if (matching.length === 0 || ambiguousRereads(matching)) return void 0;
-		answer = matching[0].redacted;
-	}
-	if (carriesChildOnlyPlaintext(bag, secrets, reads.parent)) return void 0;
-	if (!deepEqualJsonValue(redactForState(answer, {
-		provenance: "value-scan",
-		secrets
-	}), answer)) return void 0;
-	return answer;
-}
-function carriesChildOnlyPlaintext(value, childSecrets, parentSecrets) {
-	const parentNeedles = new Set(substringNeedlesOf(parentSecrets));
-	const childNeedles = new Set(substringNeedlesOf(childSecrets));
-	const childOnly = [...childSecrets.keys()].filter((plaintext) => plaintext !== "" && (!parentSecrets.has(plaintext) || childNeedles.has(plaintext) && !parentNeedles.has(plaintext)));
-	for (const needle of parentNeedles) if (needle.length >= 4 && !childSecrets.has(needle)) childOnly.push(needle);
-	if (childOnly.length === 0) return false;
-	const visit = (node) => {
-		if (typeof node === "string") return childOnly.some((plaintext) => node.includes(plaintext));
-		if (Array.isArray(node)) return node.some(visit);
-		if (node !== null && typeof node === "object") return Object.values(node).some(visit);
-		return false;
-	};
-	return visit(value);
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/placeholder-positions.ts
-function keyedPart(source) {
-	const key = crossStackSourceKey(source);
-	return key === void 0 ? UNKNOWN_PART : { key };
-}
-const MAX_PLACEHOLDER_DEPTH = 8;
-function pushPlaceholderPart(out, part, budget) {
-	if (budget.remaining <= 0) {
-		budget.exhausted = true;
-		return;
-	}
-	budget.remaining -= 1;
-	out.push(part);
-}
-function appendValuePlaceholderParts(value, out, budget, depth) {
-	if (budget.exhausted) return;
-	const literal = joinPartLiteralText(value);
-	if (literal !== void 0) return pushPlaceholderPart(out, literal, budget);
-	if (isPlainObject$7(value) && Object.keys(value).length === 1) {
-		const ref = value["Ref"];
-		if (typeof ref === "string" && ref !== "") return pushPlaceholderPart(out, keyedPart({ Ref: ref }), budget);
-		if (depth >= MAX_PLACEHOLDER_DEPTH) {
-			budget.exhausted = true;
-			return;
-		}
-		if (appendParameterPlaceholderParts(value, out, budget, depth + 1)) return;
-		return pushPlaceholderPart(out, keyedPart(value), budget);
-	}
-	pushPlaceholderPart(out, UNKNOWN_PART, budget);
-}
-function appendParameterPlaceholderParts(source, out, budget, depth) {
-	const keys = Object.keys(source);
-	if (keys.length !== 1) return false;
-	const key = keys[0];
-	if (key === "Fn::Join") {
-		const args = source[key];
-		if (!Array.isArray(args) || args.length !== 2) return false;
-		const [delimiter, parts] = args;
-		if (typeof delimiter !== "string" || !Array.isArray(parts)) return false;
-		for (let index = 0; index < parts.length && !budget.exhausted; index++) {
-			if (index > 0) pushPlaceholderPart(out, delimiter, budget);
-			appendValuePlaceholderParts(parts[index], out, budget, depth);
-		}
-		return true;
-	}
-	if (key === "Fn::Sub") {
-		const args = source[key];
-		let template;
-		let variables = {};
-		if (typeof args === "string") template = args;
-		else if (Array.isArray(args) && args.length === 2 && isPlainObject$7(args[1])) {
-			template = args[0];
-			variables = args[1];
-		} else return false;
-		if (typeof template !== "string") return false;
-		let cursor = 0;
-		for (const hit of template.matchAll(/\$\{(!)?([^}]*)\}/g)) {
-			if (budget.exhausted) return true;
-			pushPlaceholderPart(out, template.slice(cursor, hit.index), budget);
-			cursor = hit.index + hit[0].length;
-			const name = hit[2] ?? "";
-			if (hit[1] === "!") pushPlaceholderPart(out, `\${${name}}`, budget);
-			else if (name === "") pushPlaceholderPart(out, hit[0], budget);
-			else if (Object.hasOwn(variables, name)) appendValuePlaceholderParts(variables[name], out, budget, depth);
-			else if (name.includes(".")) pushPlaceholderPart(out, keyedPart({ "Fn::GetAtt": name }), budget);
-			else pushPlaceholderPart(out, keyedPart({ Ref: name }), budget);
-		}
-		pushPlaceholderPart(out, template.slice(cursor), budget);
-		return true;
-	}
-	return false;
-}
-function parameterPlaceholderParts(source, bag) {
-	const budget = {
-		remaining: bag.length * 2 + 16,
-		exhausted: false
-	};
-	const out = [];
-	if (!appendParameterPlaceholderParts(source, out, budget, 0)) return void 0;
-	return budget.exhausted ? void 0 : out;
-}
-function positionByParameterPlaceholders(bag, source, secrets) {
-	const associations = crossStackAssociations.get(secrets);
-	const spanned = positionByRecordedParameterSpans(bag, source, secrets, associations);
-	if (spanned !== void 0) return spanned;
-	const parts = parameterPlaceholderParts(source, bag);
-	if (parts === void 0) return void 0;
-	const before = ["", ""];
-	const after = ["", ""];
-	let side = before;
-	let unknown = false;
-	let certified = 0;
-	const spans = [];
-	for (const part of parts) {
-		let rendered;
-		let persisted;
-		if (typeof part === "string") {
-			rendered = part;
-			persisted = part;
-		} else {
-			let expression;
-			let plaintext = "";
-			if (part !== UNKNOWN_PART) {
-				const association = associations?.get(part.key);
-				if (association !== void 0 && typeof association !== "symbol") {
-					plaintext = association.plaintext;
-					expression = certifiedExpressionForLeaf(secrets, association, plaintext);
-				}
-				if (expression === void 0) {
-					const inherited = inheritedRenderedSpan(secrets, part.key);
-					if (inherited !== void 0) {
-						plaintext = inherited.value;
-						expression = inherited.spelling;
-					}
-				}
-			}
-			const pseudo = expression === void 0 && part !== UNKNOWN_PART ? inheritedPseudoSpan(secrets, part.key) : void 0;
-			if (pseudo !== void 0) {
-				side[0] += pseudo;
-				side[1] += pseudo;
-				continue;
-			}
-			if (expression === void 0) {
-				if (unknown) return void 0;
-				unknown = true;
-				side = after;
-				continue;
-			}
-			rendered = plaintext;
-			persisted = expression;
-			certified += 1;
-			spans.push([
-				side,
-				side[0].length,
-				plaintext.length
-			]);
-		}
-		side[0] += rendered;
-		side[1] += persisted;
-	}
-	if (certified === 0) return void 0;
-	let persisted;
-	if (!unknown) {
-		if (before[0] !== bag) return void 0;
-		persisted = before[1];
-	} else {
-		if (bag.length < before[0].length + after[0].length) return void 0;
-		if (!bag.startsWith(before[0]) || !bag.endsWith(after[0])) return void 0;
-		const middle = bag.slice(before[0].length, bag.length - after[0].length);
-		if (redactForState(middle, {
-			provenance: "value-scan",
-			secrets
-		}) !== middle) return void 0;
-		persisted = before[1] + middle + after[1];
-	}
-	const afterStart = bag.length - after[0].length;
-	return acceptedPlaceholderRendering(bag, persisted, spans.map(([side, offset, length]) => [(side === before ? 0 : afterStart) + offset, length]), secrets);
-}
-function acceptedPlaceholderRendering(bag, persisted, spans, secrets) {
-	for (const plaintext of secrets.keys()) {
-		if (plaintext.length < 4) continue;
-		for (let at = bag.indexOf(plaintext); at !== -1; at = bag.indexOf(plaintext, at + 1)) {
-			const end = at + plaintext.length;
-			for (const [start, length] of spans) if (at < start + length && end > start && (at < start || end > start + length)) return void 0;
-		}
-	}
-	if (redactForState(persisted, {
-		provenance: "value-scan",
-		secrets
-	}) !== persisted) return void 0;
-	return persisted;
-}
-function positionByRecordedParameterSpans(bag, source, secrets, associations) {
-	const resolution = intrinsicLeafResolutionOf(secrets, source);
-	if (resolution === void 0 || resolution.output !== bag) return void 0;
-	const recorded = resolution.parameterSpans;
-	if (recorded === void 0) return void 0;
-	let previousEnd = 0;
-	let cursor = 0;
-	let persisted = "";
-	const gaps = [];
-	const certified = [];
-	for (const { start, length, key } of recorded) {
-		if (!(start >= previousEnd && length > 0 && start + length <= bag.length)) return void 0;
-		previousEnd = start + length;
-		const text = bag.slice(start, start + length);
-		const association = associations?.get(key);
-		const expression = (association !== void 0 && typeof association !== "symbol" ? certifiedExpressionForLeaf(secrets, association, text) : void 0) ?? inheritedRenderedSpan(secrets, key, text)?.spelling;
-		if (expression === void 0) continue;
-		const gap = bag.slice(cursor, start);
-		gaps.push(gap);
-		persisted += gap + expression;
-		certified.push([start, length]);
-		cursor = start + length;
-	}
-	if (certified.length === 0) return void 0;
-	const tail = bag.slice(cursor);
-	gaps.push(tail);
-	persisted += tail;
-	for (const gap of gaps) if (redactForState(gap, {
-		provenance: "value-scan",
-		secrets
-	}) !== gap) return void 0;
-	return acceptedPlaceholderRendering(bag, persisted, certified, secrets);
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/identity-keys.ts
-const ARRAY_IDENTITY_KEYS = ["Name", "Key"];
-function isUniquelyKeyedBy(items, key) {
-	if (items.length === 0) return false;
-	const seen = /* @__PURE__ */ new Set();
-	for (const item of items) {
-		if (!isPlainObject$7(item) || !Object.hasOwn(item, key)) return false;
-		const id = item[key];
-		if (typeof id !== "string" || id === "") return false;
-		if (seen.has(id)) return false;
-		seen.add(id);
-	}
-	return true;
-}
-function identityKeyFor(bag, source) {
-	for (const key of ARRAY_IDENTITY_KEYS) if (isUniquelyKeyedBy(bag, key) && isUniquelyKeyedBy(source, key)) return key;
-}
-function positionListByCrossStackSource(bag, source, secrets) {
-	const association = associationForSource(source, secrets);
-	if (association === void 0) return void 0;
-	return certifiedListForLeaf(secrets, association, bag);
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/redact-path.ts
-const NEVER_DROPPING_INTRINSICS = /* @__PURE__ */ new Set([
-	"Fn::Join",
-	"Fn::Sub",
-	"Fn::Select",
-	"Fn::Split",
-	"Fn::GetAtt"
-]);
-function arrayElementDrop(element, depth = 0) {
-	if (depth > 16) return "unknown";
-	if (!isPlainObject$7(element)) return "never";
-	if (Object.hasOwn(element, "Ref")) return element["Ref"] === "AWS::NoValue" ? "always" : "never";
-	const keys = Object.keys(element);
-	if (keys.filter((key) => key.startsWith("Fn::") || key === "Condition").length === 0) return "never";
-	if (keys.length !== 1) return "unknown";
-	if (NEVER_DROPPING_INTRINSICS.has(keys[0])) return "never";
-	if (keys[0] !== "Fn::If") return "unknown";
-	const args = element["Fn::If"];
-	if (!Array.isArray(args) || args.length !== 3) return "unknown";
-	const branches = [arrayElementDrop(args[1], depth + 1), arrayElementDrop(args[2], depth + 1)];
-	if (branches.includes("unknown")) return "unknown";
-	if (branches.every((branch) => branch === "never")) return "never";
-	if (branches.every((branch) => branch === "always")) return "always";
-	return "maybe";
-}
-function sourceElementsKeptFor(source, bagLength, secrets) {
-	const recorded = secrets && droppedArrayElementsOf(secrets, source);
-	if (recorded !== void 0) {
-		if (source.length - recorded.length !== bagLength) return void 0;
-		return source.filter((_, i) => !recorded.includes(i));
-	}
-	const drops = source.map((element) => arrayElementDrop(element));
-	if (drops.includes("unknown")) return void 0;
-	const always = drops.filter((drop) => drop === "always").length;
-	const maybe = drops.filter((drop) => drop === "maybe").length;
-	const dropped = source.length - bagLength;
-	let dropMaybe;
-	if (dropped === always) dropMaybe = false;
-	else if (dropped === always + maybe) dropMaybe = true;
-	else return void 0;
-	return source.filter((_, i) => drops[i] === "never" || drops[i] === "maybe" && !dropMaybe);
-}
-function keptLiteralsCorroborate(kept, bag, secrets) {
-	return kept.every((element, i) => keptElementCorroborates(element, bag[i], secrets));
-}
-function isIntrinsicNode(value) {
-	if (!isPlainObject$7(value)) return false;
-	const keys = Object.keys(value);
-	return keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"));
-}
-function keptElementCorroborates(source, bag, secrets, depth = 0) {
-	if (depth > 16) return false;
-	if (typeof source === "string") {
-		if (!source.includes("{{resolve:")) return source === bag;
-		return isSingleDynamicReferenceToken(source) && resolvedPlaintextOf(secrets, source) === bag;
-	}
-	if (source === null || typeof source !== "object") return source === bag;
-	if (isIntrinsicNode(source)) return true;
-	if (Array.isArray(source)) return Array.isArray(bag) && bag.length === source.length && source.every((element, i) => keptElementCorroborates(element, bag[i], secrets, depth + 1));
-	if (!isPlainObject$7(source) || !isPlainObject$7(bag)) return false;
-	if (Object.keys(bag).some((key) => !Object.hasOwn(source, key))) return false;
-	return Object.entries(source).every(([key, value]) => Object.hasOwn(bag, key) ? keptElementCorroborates(value, bag[key], secrets, depth + 1) : arrayElementDrop(value) === "always" || arrayElementDrop(value) === "maybe");
-}
-function corroboratesWhateverResolves(source, depth = 0) {
-	if (depth > 16) return false;
-	if (typeof source === "string") return !source.includes("{{resolve:");
-	if (source === null || typeof source !== "object") return true;
-	if (isIntrinsicNode(source)) return true;
-	if (Array.isArray(source)) return source.every((element) => arrayElementDrop(element) === "never" && corroboratesWhateverResolves(element, depth + 1));
-	if (!isPlainObject$7(source)) return false;
-	if (Object.keys(source).some((key) => key === "Ref" || key.startsWith("Fn::"))) return false;
-	return Object.values(source).every((value) => arrayElementDrop(value) !== "unknown" && corroboratesWhateverResolves(value, depth + 1));
-}
-function arrayPairsWhateverDrops(source) {
-	if (!source.some((element) => isPlainObject$7(element) && (Object.hasOwn(element, "Fn::If") || element["Ref"] === "AWS::NoValue" || Array.isArray(element["Fn::FindInMap"]) && element["Fn::FindInMap"].length > 3))) return true;
-	return source.every((element) => corroboratesWhateverResolves(element));
-}
-function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameGeneration) {
-	if (isDynamicReferenceString(source) && typeof bag === "string") {
-		if (isSingleDynamicReferenceToken(source) && (rules.trustAnyExpression || isKnownSecretExpression(source, secretExpressions))) {
-			if (!rules.sourceIsSameGeneration && isSingleDynamicReferenceToken(bag)) {
-				if (!spanNamesResolvableService(bag)) return redactForState(bag, {
-					provenance: "value-scan",
-					secrets
-				});
-				return secrets.get(bag) ?? bag;
-			}
-			return source;
-		}
-		return positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration);
-	}
-	if ((typeof bag === "string" || Array.isArray(bag)) && isPlainObject$7(source)) {
-		const inherited = positionByInheritedParameter(bag, source, secrets);
-		if (inherited !== void 0) return inherited;
-		const reread = positionByParameterReread(bag, source, secrets);
-		if (reread !== void 0) return reread;
-	}
-	if (typeof bag === "string" && isPlainObject$7(source)) {
-		const certified = positionByCrossStackSource(bag, source, secrets);
-		if (certified !== void 0) return certified;
-		const placeheld = positionByParameterPlaceholders(bag, source, secrets);
-		if (placeheld !== void 0) return placeheld;
-		const positioned = positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions);
-		if (positioned !== void 0) return positioned;
-		const framed = positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIsSameGeneration);
-		if (framed !== void 0) return framed;
-	}
-	if (Array.isArray(bag) && isPlainObject$7(source)) {
-		const positionedList = positionListByCrossStackSource(bag, source, secrets);
-		if (positionedList !== void 0) return positionedList;
-	}
-	if (Array.isArray(bag) && Array.isArray(source)) {
-		const key = identityKeyFor(bag, source);
-		if (key !== void 0) {
-			const sourceIndexById = /* @__PURE__ */ new Map();
-			source.forEach((item, i) => {
-				sourceIndexById.set(item[key], i);
-			});
-			let orderPreserved = true;
-			const partnerIndex = bag.map((item, i) => {
-				const j = sourceIndexById.get(item[key]);
-				if (j === void 0) return -1;
-				if (j !== i) orderPreserved = false;
-				return j;
-			});
-			const positionalIsExact = rules.descendArrays && bag.length === source.length && orderPreserved;
-			return bag.map((item, i) => {
-				const j = partnerIndex[i];
-				if (j >= 0) return redactByPath(item, source[j], secrets, rules, secretExpressions, bagIsSameGeneration);
-				if (positionalIsExact) return redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration);
-				return redactForState(item, {
-					provenance: "value-scan",
-					secrets
-				});
-			});
-		}
-		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration));
-		if (rules.descendArrays && bag.length < source.length) {
-			const kept = sourceElementsKeptFor(source, bag.length, secrets);
-			if (kept !== void 0 && keptLiteralsCorroborate(kept, bag, secrets)) return bag.map((item, i) => redactByPath(item, kept[i], secrets, rules, secretExpressions, bagIsSameGeneration));
-		}
-	}
-	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source)) {
-		const out = Object.create(null);
-		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactForState(v, {
-			provenance: "value-scan",
-			secrets
-		});
-		return out;
-	}
-	return redactForState(bag, {
-		provenance: "value-scan",
-		secrets
-	});
-}
-function isReadbackProjectedFromState(rules) {
-	return rules.trustAnyExpression && !rules.descendArrays && rules.sourceIsSameGeneration;
-}
-function subtreeHasDynamicReference(value) {
-	if (isDynamicReferenceString(value)) return true;
-	if (Array.isArray(value)) return value.some(subtreeHasDynamicReference);
-	if (isPlainObject$7(value)) return Object.values(value).some(subtreeHasDynamicReference);
-	return false;
-}
-function pathCrossesDottedKey(bag, path) {
-	const segments = path.split(".");
-	let cursor = bag;
-	for (let i = 0; i < segments.length; i++) {
-		if (cursor === null || typeof cursor !== "object" || Array.isArray(cursor)) return false;
-		const rest = segments.slice(i).join(".");
-		for (const key of Object.keys(cursor)) if (key.includes(".") && (rest === key || rest.startsWith(`${key}.`))) return true;
-		if (!Object.hasOwn(cursor, segments[i])) return false;
-		cursor = cursor[segments[i]];
-	}
-	return false;
-}
-function isUncertifiedBaselineMaskPosition(properties, path) {
-	if (pathCrossesDottedKey(properties, path)) return false;
-	let cursor = properties;
-	for (const segment of path.split(".")) {
-		if (typeof cursor === "string") break;
-		if (cursor === null || typeof cursor !== "object" || Array.isArray(cursor) || !Object.hasOwn(cursor, segment)) return false;
-		cursor = cursor[segment];
-	}
-	if (typeof cursor === "string") return isDynamicReferenceString(cursor) && cursor !== "***";
-	return subtreeHasDynamicReference(cursor) && !carriesSecretMask(cursor);
-}
-const DYNAMIC_REFERENCE_TOKEN_SCAN = new RegExp(`\\{\\{resolve:${DYNAMIC_REFERENCE_INNER}\\}\\}`, "g");
-function dynamicReferenceTokens(value) {
-	return value.match(DYNAMIC_REFERENCE_TOKEN_SCAN) ?? [];
-}
-function dynamicReferenceSpans(value) {
-	DYNAMIC_REFERENCE_TOKEN_SCAN.lastIndex = 0;
-	const spans = [];
-	for (const match of value.matchAll(DYNAMIC_REFERENCE_TOKEN_SCAN)) spans.push({
-		start: match.index,
-		end: match.index + match[0].length
-	});
-	return spans;
-}
-function mixedLeafMayCarryPublicReference(source, secrets, readback) {
-	if (secrets.size === 0) return mixedLeafProvenPublic(source, secrets, readback);
-	return dynamicReferenceTokens(source).some((token) => token.startsWith("{{resolve:ssm:") && !isRecordedSecretExpression(token));
-}
-function mixedLeafProvenPublic(source, secrets, readback) {
-	const tokens = dynamicReferenceTokens(source);
-	if (tokens.length === 0) return false;
-	const values = /* @__PURE__ */ new Map();
-	for (const token of tokens) {
-		if (!token.startsWith("{{resolve:ssm:")) return false;
-		const value = provenPublicValue(secrets, token);
-		if (value === void 0) return false;
-		values.set(token, value);
-	}
-	DYNAMIC_REFERENCE_TOKEN_SCAN.lastIndex = 0;
-	return source.replace(DYNAMIC_REFERENCE_TOKEN_SCAN, (token) => values.get(token)) === readback;
-}
-function hasPlainPrototype(value) {
-	const proto = Object.getPrototypeOf(value);
-	return proto === Object.prototype || proto === null;
-}
-function isOrdinaryDate(value) {
-	if (Object.getPrototypeOf(value) !== Date.prototype) return false;
-	try {
-		Date.prototype.getTime.call(value);
-	} catch {
-		return false;
-	}
-	return Reflect.ownKeys(value).length === 0;
-}
-function deepEqualJsonValue(a, b) {
-	if (a === b) return true;
-	if (Array.isArray(a)) {
-		if (!Array.isArray(b) || a.length !== b.length) return false;
-		return a.every((item, i) => deepEqualJsonValue(item, b[i]));
-	}
-	if (isPlainObject$7(a)) {
-		if (!isPlainObject$7(b)) return false;
-		if (!hasPlainPrototype(a) || !hasPlainPrototype(b)) return false;
-		const keys = Object.keys(a);
-		if (keys.length !== Object.keys(b).length) return false;
-		return keys.every((k) => Object.hasOwn(b, k) && deepEqualJsonValue(a[k], b[k]));
-	}
-	return false;
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/readback-certification.ts
-function refuseUncertifiedSubtree(value, sourceLiterals, mark, seen = /* @__PURE__ */ new Map()) {
-	if (typeof value === "string") {
-		if (isSingleDynamicReferenceToken(value) && spanNamesResolvableService(value) || sourceLiterals.has(value)) return value;
-		if (value === "") return value;
-		return mark ? POSITION_UNCERTIFIED : "***";
-	}
-	if (value === null || typeof value !== "object") return value;
-	const memo = seen.get(value);
-	if (memo !== void 0) return memo;
-	if (Array.isArray(value)) {
-		const out = [];
-		seen.set(value, out);
-		for (const item of value) out.push(refuseUncertifiedSubtree(item, sourceLiterals, mark, seen));
-		return out;
-	}
-	if (isPlainObject$7(value) && hasPlainPrototype(value)) {
-		const out = Object.create(null);
-		seen.set(value, out);
-		for (const [k, v] of Object.entries(value)) out[k] = refuseUncertifiedSubtree(v, sourceLiterals, mark, seen);
-		return out;
-	}
-	if (ArrayBuffer.isView(value)) return mark ? POSITION_UNCERTIFIED : "***";
-	seen.set(value, value);
-	return value;
-}
-function refuseAgainstSource(bag, source, failClosed, mark) {
-	if (failClosed !== true) return bag;
-	return refuseUncertifiedSubtree(bag, wholeStringLeavesOf(source), mark);
-}
-function unpairedSourceCarriesReference(source, key, bagIdentities) {
-	return source.some((item) => !bagIdentities.has(item[key]) && subtreeHasDynamicReference(item));
-}
-function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, learn, mark) {
-	if (isDynamicReferenceString(source) && typeof bag === "string") {
-		if (isSingleDynamicReferenceToken(source)) {
-			if (learn) learnWholeTokenNeedle(learn, bag, source);
-			return mark ? POSITION_DECIDED : source;
-		}
-		if (mixedLeafMayCarryPublicReference(source, secrets, bag)) return mark ? POSITION_DECIDED : bag;
-		if (learn) learnMixedLeafNeedle(learn, bag, source);
-		return mark ? POSITION_DECIDED : source;
-	}
-	if (!subtreeHasDynamicReference(source)) return bag;
-	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source)) {
-		const out = Object.create(null);
-		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, failClosed, learn, mark) : v;
-		return out;
-	}
-	if (Array.isArray(bag) && Array.isArray(source)) {
-		const key = identityKeyFor(bag, source);
-		if (key === void 0) {
-			if (!unkeyedArrayPairsByAnchors(bag, source)) return refuseAgainstSource(bag, source, failClosed, mark);
-			return bag.map((item, i) => refuseUncertifiedReadbackPositions(item, source[i], secrets, failClosed, learn, mark));
-		}
-		const sourceByIdentity = /* @__PURE__ */ new Map();
-		for (const item of source) sourceByIdentity.set(item[key], item);
-		const orphanLiterals = unpairedSourceCarriesReference(source, key, new Set(bag.map((item) => item[key]))) && failClosed === true ? wholeStringLeavesOf(source) : void 0;
-		return bag.map((item) => {
-			const partner = sourceByIdentity.get(item[key]);
-			return partner === void 0 ? orphanLiterals !== void 0 ? refuseUncertifiedSubtree(item, orphanLiterals, mark) : item : refuseUncertifiedReadbackPositions(item, partner, secrets, failClosed, learn, mark);
-		});
-	}
-	return refuseAgainstSource(bag, source, failClosed, mark);
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/anchors.ts
-function isDistinguishingAnchor(value) {
-	if (typeof value === "string") return value !== "";
-	if (Array.isArray(value)) return value.some(isDistinguishingAnchor);
-	if (isPlainObject$7(value)) return Object.values(value).some(isDistinguishingAnchor);
-	return false;
-}
-const ANCHOR_REFERENCE_MASK = "<ref>";
-function anchorSignature(source) {
-	if (isDynamicReferenceString(source)) return ANCHOR_REFERENCE_MASK;
-	if (Array.isArray(source)) return `[${source.map(anchorSignature).sort().join(",")}]`;
-	if (isPlainObject$7(source)) return `{${Object.keys(source).sort().map((k) => `${JSON.stringify(k)}:${anchorSignature(source[k])}`).join(",")}}`;
-	return JSON.stringify(source) ?? "undefined";
-}
-function anchorsCorroboratePairing(bag, source, anchors) {
-	if (!subtreeHasDynamicReference(source)) {
-		if (!deepEqualJsonValue(bag, source)) return false;
-		if (isDistinguishingAnchor(source)) anchors.distinguishing += 1;
-		return true;
-	}
-	if (isDynamicReferenceString(source)) return typeof bag === "string";
-	if (isPlainObject$7(source)) {
-		if (!isPlainObject$7(bag)) return false;
-		return Object.keys(source).every((k) => Object.hasOwn(bag, k) && anchorsCorroboratePairing(bag[k], source[k], anchors));
-	}
-	if (Array.isArray(source)) {
-		if (!Array.isArray(bag) || bag.length !== source.length) return false;
-		return source.every((item, i) => anchorsCorroboratePairing(bag[i], item, anchors));
-	}
-	return false;
-}
-function unkeyedArrayPairsByAnchors(bag, source) {
-	if (bag.length !== source.length) return false;
-	const distinguishingPerElement = [];
-	for (const [i, item] of source.entries()) {
-		const anchors = { distinguishing: 0 };
-		if (!anchorsCorroboratePairing(bag[i], item, anchors)) return false;
-		distinguishingPerElement.push(anchors.distinguishing);
-	}
-	const frameDistinguishing = source.reduce((total, item, i) => subtreeHasDynamicReference(item) ? total : total + distinguishingPerElement[i], 0);
-	const signatures = /* @__PURE__ */ new Set();
-	for (const [i, item] of source.entries()) {
-		if (!subtreeHasDynamicReference(item)) continue;
-		const signature = anchorSignature(item);
-		if (signatures.has(signature)) return false;
-		signatures.add(signature);
-		if (distinguishingPerElement[i] > 0) continue;
-		if (!isDynamicReferenceString(item) || frameDistinguishing === 0) return false;
-	}
-	return true;
-}
-const POSITION_DECIDED = Symbol("position decided by a position pass");
-const POSITION_UNCERTIFIED = Symbol("position refused by a position pass");
-function learnNeedle(collector, plaintext, expression) {
-	if (plaintext.length < 4) return;
-	if (collector.poisoned.has(plaintext)) return;
-	if (expressionSecretIsInferred(expression)) collector.inferred.add(plaintext);
-	const already = collector.needles.get(plaintext);
-	if (already === void 0) {
-		collector.needles.set(plaintext, expression);
-		return;
-	}
-	if (already === expression) return;
-	collector.needles.delete(plaintext);
-	collector.poisoned.add(plaintext);
-}
-const SECRET_BEARING_REFERENCE_PREFIXES = [
-	"{{resolve:secretsmanager:",
-	"{{resolve:ssm-secure:",
-	"{{resolve:ssm:"
-];
-function spanNamesResolvableService(token) {
-	return SECRET_BEARING_REFERENCE_PREFIXES.some((prefix) => token.startsWith(prefix));
-}
-function resolvableReferenceSpans(value, vouchedExpressions) {
-	const spans = dynamicReferenceSpans(value).filter((span) => spanNamesResolvableService(value.slice(span.start, span.end)));
-	const starts = new Set(spans.map((span) => span.start));
-	for (const prefix of SECRET_BEARING_REFERENCE_PREFIXES) for (let at = value.indexOf(prefix); at >= 0; at = value.indexOf(prefix, at + 1)) {
-		if (starts.has(at)) continue;
-		DYNAMIC_REFERENCE_TOKEN_SCAN.lastIndex = at;
-		const match = DYNAMIC_REFERENCE_TOKEN_SCAN.exec(value);
-		DYNAMIC_REFERENCE_TOKEN_SCAN.lastIndex = 0;
-		if (match?.index !== at) continue;
-		const end = at + match[0].length;
-		if (!vouchedExpressions.has(value.slice(at, end))) continue;
-		spans.push({
-			start: at,
-			end
-		});
-		starts.add(at);
-	}
-	return spans;
-}
-const SPELLED_SECRET_REFERENCE_PREFIXES = ["{{resolve:secretsmanager:", "{{resolve:ssm-secure:"];
-function expressionSecretIsInferred(expression) {
-	return !SPELLED_SECRET_REFERENCE_PREFIXES.some((prefix) => expression.startsWith(prefix));
-}
-function expressionMaySeedANeedle(expression) {
-	return isRecordedSecretExpression(expression) || SECRET_BEARING_REFERENCE_PREFIXES.some((prefix) => expression.startsWith(prefix));
-}
-function learnWholeTokenNeedle(collector, bag, source) {
-	if (isSingleDynamicReferenceToken(bag)) return;
-	if (!expressionMaySeedANeedle(source)) return;
-	learnNeedle(collector, bag, source);
-}
-function learnMixedLeafNeedle(collector, bag, source) {
-	const frame = singleSpanFrame(bag, source);
-	if (frame === void 0) return;
-	const { token, middle: plaintext } = frame;
-	if (!expressionMaySeedANeedle(token)) return;
-	learnNeedle(collector, plaintext, token);
-}
-function asChild(marks, key) {
-	return isPlainObject$7(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
-}
-function asIndex(marks, index) {
-	return Array.isArray(marks) ? marks[index] : void 0;
-}
-function preferPositionDecisions(scanned, refused, bag, marks, inferred) {
-	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(refused) && isPlainObject$7(scanned)) {
-		const out = Object.create(null);
-		for (const [k, v] of Object.entries(refused)) out[k] = preferPositionDecisions(scanned[k], v, bag[k], asChild(marks, k), inferred);
-		return out;
-	}
-	if (Array.isArray(bag) && Array.isArray(refused) && Array.isArray(scanned) && refused.length === bag.length && scanned.length === bag.length) return refused.map((item, i) => preferPositionDecisions(scanned[i], item, bag[i], asIndex(marks, i), inferred));
-	if (typeof bag !== "string" || marks === POSITION_DECIDED) return refused;
-	const scanDecision = scanned === bag ? inferred.get(bag) ?? scanned : scanned;
-	if (marks === POSITION_UNCERTIFIED && !(typeof scanDecision === "string" && isSingleDynamicReferenceToken(scanDecision))) return refused;
-	return scanDecision;
-}
-function deriveReadbackNeedles(bag, source, secrets, rules) {
-	if (!isReadbackProjectedFromState(rules)) return void 0;
-	if (secrets.size > 0) return void 0;
-	if (!subtreeHasDynamicReference(source)) return void 0;
-	const collector = {
-		needles: /* @__PURE__ */ new Map(),
-		poisoned: /* @__PURE__ */ new Set(),
-		inferred: /* @__PURE__ */ new Set()
-	};
-	refuseUncertifiedReadbackPositions(bag, source, secrets, false, collector);
-	if (collector.needles.size === 0) return void 0;
-	const certain = /* @__PURE__ */ new Map();
-	const inferred = /* @__PURE__ */ new Map();
-	for (const [plaintext, expression] of collector.needles) (collector.inferred.has(plaintext) ? inferred : certain).set(plaintext, expression);
-	return {
-		certain,
-		inferred
-	};
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/redact-state.ts
-function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RULES, bagIsSameGeneration = false) {
-	return flattenEmbeddedNoEchoLeaves(redactSecretsForStatePasses(bag, secrets, source, rules, bagIsSameGeneration), secrets);
-}
-function redactSecretsForStatePasses(bag, secrets, source, rules, bagIsSameGeneration) {
-	if (secrets.size === 0 && source === void 0) return bag;
-	if (source !== void 0) {
-		const positioned = redactByPath(bag, source, secrets, rules, recordedExpressionsOf(secrets), bagIsSameGeneration);
-		if (!isReadbackProjectedFromState(rules)) return positioned;
-		const failClosed = rules.failClosedOnUncertifiedPositions === true;
-		const refused = refuseUncertifiedReadbackPositions(positioned, source, secrets, failClosed);
-		const derived = deriveReadbackNeedles(bag, source, secrets, rules);
-		if (derived === void 0) return refused;
-		const marks = refuseUncertifiedReadbackPositions(positioned, source, secrets, failClosed, void 0, true);
-		return preferPositionDecisions(redactForState(bag, {
-			provenance: "value-scan",
-			secrets: derived.certain
-		}), refused, bag, marks, derived.inferred);
-	}
-	const regex = buildNeedleRegex(substringNeedlesOf(secrets));
-	const wholeValueExpr = (s) => s === "" ? void 0 : secrets.get(s);
-	const physicalNames = physicalNameCopiesOf.get(secrets);
-	let vouched;
-	const vouchedExpressions = () => vouched ??= new Set(secrets.values());
-	const expressionFor = (match) => {
-		return secrets.get(match) ?? "***";
-	};
-	const scanLeaf = (value, needles) => {
-		const spans = isDynamicReferenceString(value) ? resolvableReferenceSpans(value, vouchedExpressions()) : [];
-		const names = physicalNameSpans(physicalNames, value);
-		const kept = (start, end) => isStrictlyInsideASpan(spans, start, end) || names.some((n) => n.start <= start && end <= n.end);
-		if (!legacyOverlapScan.has(secrets)) {
-			const matches = everyMatch(value, needles);
-			const redacted = matches.filter((m) => !kept(m.start, m.end));
-			if (cutsContainmentNeedle(value, secrets, redacted)) {
-				overlapAnswered.add(secrets);
-				return "***";
-			}
-			const overlapping = redactOverlappingMatches(value, matches, redacted, expressionFor);
-			if (overlapping !== void 0) {
-				overlapAnswered.add(secrets);
-				return overlapping;
-			}
-		}
-		return value.replace(needles, (match, offset) => {
-			if (kept(offset, offset + match.length)) return match;
-			return expressionFor(match);
-		});
-	};
-	const walk = (value) => {
-		if (typeof value === "string") {
-			if (physicalNames?.has(value) === true) return value;
-			const whole = wholeValueExpr(value);
-			if (whole !== void 0) return whole;
-			if (isSingleDynamicReferenceToken(value) && spanNamesResolvableService(value)) return value;
-			if (!regex) return value;
-			regex.lastIndex = 0;
-			if (!regex.test(value)) return value;
-			return scanLeaf(value, regex);
-		}
-		if (Array.isArray(value)) return value.map(walk);
-		if (value !== null && typeof value === "object") {
-			if (isOrdinaryDate(value)) {
-				const persisted = value.toJSON();
-				if (typeof persisted !== "string") return value;
-				const scanned = walk(persisted);
-				return scanned === persisted ? value : scanned;
-			}
-			const out = Object.create(null);
-			for (const [k, v] of Object.entries(value)) out[k] = walk(v);
-			return out;
-		}
-		return value;
-	};
-	return walk(bag);
-}
-const legacyOverlapScan = /* @__PURE__ */ new WeakSet();
-const overlapAnswered = /* @__PURE__ */ new WeakSet();
-function overlapRuleAnswered(secrets) {
-	return overlapAnswered.has(secrets);
-}
-function withLegacyOverlapScan(secrets, run) {
-	if (legacyOverlapScan.has(secrets)) return run();
-	legacyOverlapScan.add(secrets);
-	try {
-		return run();
-	} finally {
-		legacyOverlapScan.delete(secrets);
-	}
-}
-function differingStringLeaves(legacy, current, out = []) {
-	if (typeof legacy === "string" && typeof current === "string") {
-		if (legacy !== current) out.push([legacy, current]);
-		return out;
-	}
-	if (Array.isArray(legacy) && Array.isArray(current) && legacy.length === current.length) {
-		legacy.forEach((item, i) => differingStringLeaves(item, current[i], out));
-		return out;
-	}
-	if (legacy !== null && current !== null && typeof legacy === "object" && typeof current === "object" && !Array.isArray(legacy) && !Array.isArray(current)) {
-		const c = current;
-		for (const [key, value] of Object.entries(legacy)) if (Object.hasOwn(c, key)) differingStringLeaves(value, c[key], out);
-	}
-	return out;
-}
-function legacyLeavesWithoutMask(legacy) {
-	if (typeof legacy === "string") return legacy.includes("***") ? void 0 : legacy;
-	if (Array.isArray(legacy)) return legacy.map(legacyLeavesWithoutMask);
-	if (legacy !== null && typeof legacy === "object") {
-		const out = Object.create(null);
-		for (const [key, value] of Object.entries(legacy)) out[key] = legacyLeavesWithoutMask(value);
-		return out;
-	}
-	return legacy;
-}
-function legacyReferenceLeavesOnly(legacy) {
-	if (typeof legacy === "string") return legacy.includes("{{resolve:") ? legacy : void 0;
-	if (Array.isArray(legacy)) return legacy.map(legacyReferenceLeavesOnly);
-	if (legacy !== null && typeof legacy === "object") {
-		const out = Object.create(null);
-		for (const [key, value] of Object.entries(legacy)) out[key] = legacyReferenceLeavesOnly(value);
-		return out;
-	}
-	return legacy;
-}
-function replaceWholeLeaves(value, pairs) {
-	if (pairs.length === 0) return value;
-	if (typeof value === "string") {
-		const hit = pairs.find(([legacy]) => legacy === value);
-		return hit === void 0 ? value : hit[1];
-	}
-	if (Array.isArray(value)) {
-		let changed = false;
-		const out = value.map((item) => {
-			const next = replaceWholeLeaves(item, pairs);
-			if (next !== item) changed = true;
-			return next;
-		});
-		return changed ? out : value;
-	}
-	if (value !== null && typeof value === "object") {
-		let out;
-		for (const [key, item] of Object.entries(value)) {
-			const next = replaceWholeLeaves(item, pairs);
-			if (next !== item) {
-				out ??= Object.assign(Object.create(null), value);
-				out[key] = next;
-			}
-		}
-		return out ?? value;
-	}
-	return value;
-}
-function everyMatch(value, needles) {
-	const matches = [];
-	needles.lastIndex = 0;
-	for (let m = needles.exec(value); m !== null; m = needles.exec(value)) {
-		matches.push({
-			start: m.index,
-			end: m.index + m[0].length
-		});
-		needles.lastIndex = m.index + 1;
-	}
-	needles.lastIndex = 0;
-	return matches;
-}
-function redactOverlappingMatches(value, matches, redacted, expressionFor) {
-	let reach = 0;
-	let overlap = false;
-	for (const m of matches) {
-		if (m.start < reach) overlap = true;
-		reach = Math.max(reach, m.end);
-	}
-	if (!overlap) return void 0;
-	let out = "";
-	let cursor = 0;
-	for (let i = 0; i < redacted.length;) {
-		let end = redacted[i].end;
-		let j = i + 1;
-		for (; j < redacted.length && redacted[j].start < end; j++) end = Math.max(end, redacted[j].end);
-		const cluster = redacted.slice(i, j);
-		out += value.slice(cursor, cluster[0].start);
-		for (let at = cluster[0].start; at < end;) {
-			const tile = cluster.find((m) => m.start === at);
-			if (tile === void 0) return "***";
-			out += expressionFor(value.slice(tile.start, tile.end));
-			at = tile.end;
-		}
-		cursor = end;
-		i = j;
-	}
-	return out + value.slice(cursor);
-}
-function scrubResourceRecord(record, secrets, sourceProperties, observedProvenance, claims = {}) {
-	const propertiesClaimed = claims.properties === "same-generation";
-	const observedClaimed = claims.observed === "same-generation";
-	if (secrets.size === 0 && sourceProperties === void 0 && !record.observedProperties) return record;
-	const next = { ...record };
-	next.properties = sourceProperties === void 0 ? redactForState(record.properties, {
-		provenance: "value-scan",
-		secrets
-	}) : redactAtProvenance(record.properties, secrets, sourceProperties, "template-derived", propertiesClaimed);
-	if (record.attributes) {
-		const ownId = record.physicalId;
-		const ids = [...attributeIdCopiesOf.get(secrets) ?? []];
-		if (typeof ownId === "string" && ownId !== "") ids.push(ownId);
-		const attributes = record.attributes;
-		next.attributes = ids.length > 0 ? withPhysicalNameCopies(secrets, ids, () => redactForState(attributes, {
-			provenance: "value-scan",
-			secrets
-		})) : redactForState(attributes, {
-			provenance: "value-scan",
-			secrets
-		});
-	}
-	if (record.observedProperties) next.observedProperties = redactAtProvenance(record.observedProperties, secrets, sourceProperties ?? next.properties, observedProvenance ?? (sourceProperties !== void 0 ? "template-sourced" : secrets.size === 0 && observedClaimed ? "state-baseline" : "state-readback"), observedClaimed);
-	return next;
-}
-function withoutPhysicalNameCopies(secrets, run) {
-	const names = physicalNameCopiesOf.get(secrets);
-	if (names === void 0) return run();
-	physicalNameCopiesOf.delete(secrets);
-	try {
-		return run();
-	} finally {
-		physicalNameCopiesOf.set(secrets, names);
-	}
-}
-function withPhysicalNameCopies(secrets, ids, run) {
-	const previous = physicalNameCopiesOf.get(secrets);
-	const names = new Set(previous);
-	for (const id of ids) if (id !== "") names.add(id);
-	physicalNameCopiesOf.set(secrets, names);
-	try {
-		return run();
-	} finally {
-		if (previous === void 0) physicalNameCopiesOf.delete(secrets);
-		else physicalNameCopiesOf.set(secrets, previous);
-	}
-}
-function repairPhysicalNameCopyLeaves(stored, legacy, current) {
-	if (typeof stored === "string") return typeof legacy === "string" && typeof current === "string" && stored === legacy && current !== legacy ? current : stored;
-	if (Array.isArray(stored)) {
-		if (!Array.isArray(legacy) || !Array.isArray(current)) return stored;
-		if (legacy.length !== stored.length || current.length !== stored.length) return stored;
-		let changed = false;
-		const out = stored.map((item, i) => {
-			const next = repairPhysicalNameCopyLeaves(item, legacy[i], current[i]);
-			if (next !== item) changed = true;
-			return next;
-		});
-		return changed ? out : stored;
-	}
-	if (stored !== null && typeof stored === "object") {
-		if (legacy === null || typeof legacy !== "object" || Array.isArray(legacy)) return stored;
-		if (current === null || typeof current !== "object" || Array.isArray(current)) return stored;
-		const l = legacy;
-		const c = current;
-		let out;
-		for (const [key, value] of Object.entries(stored)) {
-			if (!Object.hasOwn(l, key) || !Object.hasOwn(c, key)) continue;
-			const next = repairPhysicalNameCopyLeaves(value, l[key], c[key]);
-			if (next !== value) {
-				out ??= { ...stored };
-				out[key] = next;
-			}
-		}
-		return out ?? stored;
-	}
-	return stored;
-}
-function embeddedPhysicalNameRewrites(secrets, legacySecrets = secrets) {
-	const names = physicalNameCopiesOf.get(secrets);
-	if (names === void 0) return [];
-	const pairs = [];
-	withoutPhysicalNameCopies(legacySecrets, () => {
-		for (const name of names) {
-			const legacy = redactForState(name, {
-				provenance: "value-scan",
-				secrets: legacySecrets
-			});
-			if (typeof legacy === "string" && legacy !== name && legacy.includes("{{resolve:") && !isSingleDynamicReferenceToken(legacy) && !legacy.includes("***")) pairs.push([legacy, name]);
-		}
-	});
-	return pairs;
-}
-function replaceEmbeddedPhysicalNameRewrites(value, pairs) {
-	if (pairs.length === 0) return value;
-	if (typeof value === "string") {
-		let next = value;
-		for (const [legacy, name] of pairs) next = next.split(legacy).join(name);
-		return next;
-	}
-	if (Array.isArray(value)) {
-		let changed = false;
-		const out = value.map((item) => {
-			const next = replaceEmbeddedPhysicalNameRewrites(item, pairs);
-			if (next !== item) changed = true;
-			return next;
-		});
-		return changed ? out : value;
-	}
-	if (value !== null && typeof value === "object") {
-		let out;
-		for (const [key, item] of Object.entries(value)) {
-			const next = replaceEmbeddedPhysicalNameRewrites(item, pairs);
-			if (next !== item) {
-				out ??= { ...value };
-				out[key] = next;
-			}
-		}
-		return out ?? value;
-	}
-	return value;
-}
-function repairEmbeddedPhysicalNamesTowards(stored, target, pairs) {
-	if (pairs.length === 0) return stored;
-	if (typeof stored === "string") {
-		if (typeof target !== "string" || stored === target) return stored;
-		const repaired = replaceEmbeddedPhysicalNameRewrites(stored, pairs);
-		return repaired === target ? repaired : stored;
-	}
-	if (Array.isArray(stored)) {
-		if (!Array.isArray(target) || target.length !== stored.length) return stored;
-		let changed = false;
-		const out = stored.map((item, i) => {
-			const next = repairEmbeddedPhysicalNamesTowards(item, target[i], pairs);
-			if (next !== item) changed = true;
-			return next;
-		});
-		return changed ? out : stored;
-	}
-	if (stored !== null && typeof stored === "object") {
-		if (target === null || typeof target !== "object" || Array.isArray(target)) return stored;
-		const t = target;
-		let out;
-		for (const [key, value] of Object.entries(stored)) {
-			if (!Object.hasOwn(t, key)) continue;
-			const next = repairEmbeddedPhysicalNamesTowards(value, t[key], pairs);
-			if (next !== value) {
-				out ??= { ...stored };
-				out[key] = next;
-			}
-		}
-		return out ?? stored;
-	}
-	return stored;
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/mask-errors.ts
-function maskSecretsInText(text, secrets) {
-	const logOnly = logOnlyValuesOf.get(secrets);
-	const noLogOnly = logOnly === void 0 || logOnly.size === 0;
-	if (secrets.size === 0 && noLogOnly) return text;
-	if (text !== "" && (secrets.has(text) || logOnly?.has(text) === true)) return "***";
-	return maskMatchSpans(text, printingNeedles(noLogOnly ? secrets.keys() : [...secrets.keys(), ...logOnly]), "***");
-}
-function maskRecordedSecretsInText(text, secrets) {
-	if (secrets.size === 0) return text;
-	if (text !== "" && secrets.has(text)) return "***";
-	return maskMatchSpans(text, substringNeedles(secrets.keys()), "***");
-}
-function substringNeedles(values) {
-	return [...new Set(values)].filter((value) => value.length >= 4);
-}
-const ERROR_CAUSE_MASK_MAX_DEPTH = 20;
-function errorCauseChain(root) {
-	const chain = [];
-	const seen = /* @__PURE__ */ new Set();
-	let current = root;
-	while (current instanceof Error && !seen.has(current) && chain.length < 20) {
-		seen.add(current);
-		chain.push(current);
-		current = current.cause;
-	}
-	return chain;
-}
-function readStack(error) {
-	try {
-		const stack = error.stack;
-		return typeof stack === "string" ? stack : void 0;
-	} catch {
-		return;
-	}
-}
-function maskDescriptorValue(descriptor, maskText) {
-	if (!("value" in descriptor)) return descriptor;
-	const value = maskErrorFieldValue(descriptor.value, maskText);
-	return value === descriptor.value ? descriptor : {
-		...descriptor,
-		value
-	};
-}
-const CLASSIFIER_IDENTIFIER_FIELDS = /* @__PURE__ */ new Set([
-	"name",
-	"code",
-	"Code",
-	"__type",
-	"ccErrorCode",
-	"ccOperation"
-]);
-function isAuxiliaryAnchor(key, descriptor) {
-	return key === "logicalId" && descriptor.enumerable === false && descriptor.writable === false && typeof descriptor.value === "string" && descriptor.value.endsWith("/auxiliary");
-}
-const CREATED_BEFORE_FAILURE_MARK = Symbol.for("cdkd.createdBeforeFailure");
-function isCreatedBeforeFailureMark(key, descriptor) {
-	return key === CREATED_BEFORE_FAILURE_MARK && descriptor.enumerable === false && descriptor.writable === false && typeof descriptor.value === "object" && descriptor.value !== null && Object.isFrozen(descriptor.value);
-}
-function isPlainContainer(value) {
-	const proto = Object.getPrototypeOf(value);
-	return Array.isArray(value) ? proto === Array.prototype : proto === Object.prototype || proto === null;
-}
-function readFieldNode(node) {
-	try {
-		if (!isPlainContainer(node)) return void 0;
-		const entries = [];
-		for (const key of Reflect.ownKeys(node)) {
-			const descriptor = Object.getOwnPropertyDescriptor(node, key);
-			if (descriptor) entries.push([key, descriptor]);
-		}
-		const isArray = Array.isArray(node);
-		return {
-			proto: Object.getPrototypeOf(node),
-			isArray,
-			length: isArray ? Object.getOwnPropertyDescriptor(node, "length") : void 0,
-			extensible: Object.isExtensible(node),
-			entries
-		};
-	} catch {
-		return;
-	}
-}
-function maskErrorFieldValue(value, maskText) {
-	if (typeof value === "string") return maskText(value);
-	if (typeof value !== "object" || value === null) return value;
-	try {
-		const nodes = /* @__PURE__ */ new Map();
-		const seen = /* @__PURE__ */ new Set();
-		let changed = false;
-		let frontier = [value];
-		for (let depth = 0; frontier.length > 0 && depth < 20; depth++) {
-			const next = [];
-			for (const node of frontier) {
-				if (seen.has(node)) continue;
-				seen.add(node);
-				const read = readFieldNode(node);
-				if (!read) continue;
-				nodes.set(node, read);
-				for (const [, descriptor] of read.entries) {
-					if (!("value" in descriptor)) continue;
-					const child = descriptor.value;
-					if (typeof child === "string") {
-						if (!changed && maskText(child) !== child) changed = true;
-					} else if (typeof child === "object" && child !== null) next.push(child);
-				}
-			}
-			frontier = next;
-		}
-		if (!changed) return value;
-		const copies = /* @__PURE__ */ new Map();
-		for (const [node, read] of nodes) copies.set(node, read.isArray ? new Array(read.length?.value ?? 0) : Object.create(read.proto));
-		for (const [node, read] of nodes) {
-			const copy = copies.get(node);
-			for (const [key, original] of read.entries) {
-				if (key === "length" && read.isArray) continue;
-				const descriptor = { ...original };
-				if ("value" in descriptor) {
-					const child = descriptor.value;
-					if (typeof child === "string") descriptor.value = maskText(child);
-					else if (typeof child === "object" && child !== null && copies.has(child)) descriptor.value = copies.get(child);
-				}
-				Object.defineProperty(copy, key, descriptor);
-			}
-			if (read.length?.writable === false) Object.defineProperty(copy, "length", { writable: false });
-			if (!read.extensible) Object.preventExtensions(copy);
-		}
-		return copies.get(value) ?? value;
-	} catch {
-		return value;
-	}
-}
-function maskSecretsInError(error, secrets, extraMask) {
-	if (!(error instanceof Error) || !hasMaskableValues(secrets) && !extraMask) return error;
-	const maskText = (text) => maskSecretsInText(extraMask ? extraMask(text) : text, secrets);
-	const chain = errorCauseChain(error);
-	let changed = false;
-	const links = chain.map((link) => {
-		const message = maskText(link.message);
-		const stack = readStack(link);
-		const maskedStack = typeof stack === "string" ? maskText(stack) : void 0;
-		const descriptors = {};
-		for (const key of Reflect.ownKeys(link)) {
-			if (key === "message" || key === "cause" || key === "stack") continue;
-			const descriptor = Object.getOwnPropertyDescriptor(link, key);
-			if (!descriptor) continue;
-			descriptors[key] = typeof key === "string" && CLASSIFIER_IDENTIFIER_FIELDS.has(key) && typeof descriptor.value === "string" || isAuxiliaryAnchor(key, descriptor) || isCreatedBeforeFailureMark(key, descriptor) ? descriptor : maskDescriptorValue(descriptor, maskText);
-			if (descriptors[key] !== descriptor) changed = true;
-		}
-		let cause = Object.getOwnPropertyDescriptor(link, "cause");
-		if (cause && !("value" in cause && cause.value instanceof Error)) {
-			const masked = maskDescriptorValue(cause, maskText);
-			if (masked !== cause) changed = true;
-			cause = masked;
-		}
-		if (message !== link.message || maskedStack !== stack) changed = true;
-		return {
-			message,
-			stack: maskedStack,
-			descriptors,
-			cause
-		};
-	});
-	if (!changed) return error;
-	const clones = /* @__PURE__ */ new Map();
-	for (const [i, original] of chain.entries()) {
-		const { message, stack, descriptors } = links[i];
-		const clone = Object.create(Object.getPrototypeOf(original), descriptors);
-		Object.defineProperty(clone, "message", {
-			value: message,
-			writable: true,
-			enumerable: false,
-			configurable: true
-		});
-		if (stack !== void 0) Object.defineProperty(clone, "stack", {
-			value: stack,
-			writable: true,
-			enumerable: false,
-			configurable: true
-		});
-		clones.set(original, clone);
-	}
-	for (const [i, original] of chain.entries()) {
-		const causeDescriptor = links[i].cause;
-		if (!causeDescriptor) continue;
-		const clone = clones.get(original);
-		const causeValue = original.cause;
-		const replacement = causeValue instanceof Error ? clones.get(causeValue) : void 0;
-		Object.defineProperty(clone, "cause", replacement ? {
-			value: replacement,
-			writable: true,
-			enumerable: causeDescriptor.enumerable === true,
-			configurable: true
-		} : causeDescriptor);
-	}
-	return clones.get(error);
-}
-function createSecretMasker(secrets) {
-	return (text) => maskSecretsInText(text, secrets);
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/log-only.ts
-const logOnlyValuesOf = /* @__PURE__ */ new WeakMap();
-function recordLogOnlyValue(secrets, plaintext) {
-	if (plaintext === "") return;
-	sideSetOf(logOnlyValuesOf, secrets).add(plaintext);
-}
-function carryLogOnlyValues(from, to) {
-	const values = logOnlyValuesOf.get(from);
-	if (values === void 0 || values.size === 0) return;
-	const into = sideSetOf(logOnlyValuesOf, to);
-	for (const value of values) into.add(value);
-}
-function carryLogOnlyValuesCarriedBy(from, to, value) {
-	const values = logOnlyValuesOf.get(from);
-	if (values === void 0 || values.size === 0) return;
-	const leaves = printedLeavesOf(value);
-	if (leaves.size === 0) return;
-	for (const needle of values) for (const leaf of leaves) if (leaf === needle || needle.length >= 4 && leaf.includes(needle)) {
-		recordLogOnlyValue(to, needle);
-		break;
-	}
-	carryListElementFragments(values, to, value);
-}
-function carryListElementFragments(needles, to, value) {
-	if (!Array.isArray(value) || value.length === 0) return;
-	if (!value.every((e) => typeof e === "string" || typeof e === "number" || typeof e === "boolean")) return;
-	const numeric = value.every((element) => typeof element === "number");
-	const joined = value.map((element) => String(element)).join(",");
-	for (const needle of [...needles]) {
-		const pieces = needle.split(",").map((piece) => piece.trim());
-		if (numeric && pieces.every((piece) => piece === "" || Number.isNaN(Number(piece)))) continue;
-		const fragments = fragmentsOfNeedleIn(joined, ",", pieces.map((piece) => numeric ? String(Number(piece)) : piece).join(","));
-		if (fragments.size === 0) continue;
-		recordLogOnlyValue(to, needle);
-		for (const fragment of fragments) recordLogOnlyValue(to, fragment);
-	}
-}
-function recordLogOnlySplitFragments(from, to, text, delimiter, printed) {
-	if (delimiter === "") return;
-	const splits = [text.split(delimiter)];
-	if (printed !== void 0 && (printed.length !== splits[0].length || printed.some((piece, i) => piece !== splits[0][i]))) splits.push(printed);
-	for (const bag of from) {
-		if (bag === void 0) continue;
-		for (const needle of [...logOnlyValuesOf.get(bag) ?? []]) for (const pieces of splits) for (const fragment of fragmentsOfNeedleIn(text, delimiter, needle, pieces)) if (fragment !== needle) recordLogOnlyValue(to, fragment);
-	}
-}
-function fragmentsOfNeedleIn(text, delimiter, needle, pieces = text.split(delimiter)) {
-	const fragments = /* @__PURE__ */ new Set();
-	if (needle === "") return fragments;
-	const starts = [];
-	if (text === needle) starts.push(0);
-	else if (needle.length >= 4) for (let at = text.indexOf(needle); at !== -1; at = text.indexOf(needle, at + 1)) starts.push(at);
-	if (starts.length === 0) return fragments;
-	const spans = [];
-	let offset = 0;
-	for (const piece of pieces) {
-		spans.push([offset, offset + piece.length]);
-		offset += piece.length + delimiter.length;
-	}
-	for (const start of starts) {
-		const end = start + needle.length;
-		for (const [pieceStart, pieceEnd] of spans) {
-			const from = Math.max(pieceStart, start);
-			const to = Math.min(pieceEnd, end);
-			if (from < to) fragments.add(text.slice(from, to));
-		}
-	}
-	return fragments;
-}
-function printedLeavesOf(value) {
-	const leaves = wholeStringLeavesOf(value);
-	const seen = /* @__PURE__ */ new Set();
-	const walk = (node) => {
-		if (typeof node === "number" || typeof node === "boolean") {
-			leaves.add(String(node));
-			return;
-		}
-		if (node === null || typeof node !== "object") return;
-		if (seen.has(node)) return;
-		seen.add(node);
-		for (const child of Array.isArray(node) ? node : Object.values(node)) walk(child);
-	};
-	walk(value);
-	return leaves;
-}
-function shareLogOnlyValues(view, target) {
-	logOnlyValuesOf.set(view, sideSetOf(logOnlyValuesOf, target));
-}
-function recordLogOnlyParameterValue(secrets, value, splitDelimiters) {
-	const record = (leaf) => {
-		const spelled = typeof leaf === "string" ? leaf : typeof leaf === "number" || typeof leaf === "boolean" ? String(leaf) : void 0;
-		if (spelled === void 0) return;
-		recordLogOnlyValue(secrets, spelled);
-		for (const delimiter of splitDelimiters ?? []) {
-			if (delimiter === "" || !spelled.includes(delimiter)) continue;
-			for (const piece of spelled.split(delimiter)) recordLogOnlyValue(secrets, piece);
-		}
-	};
-	if (Array.isArray(value)) {
-		for (const element of value) record(element);
-		record(value.map((element) => String(element)).join(","));
-		return;
-	}
-	record(value);
-}
-function literalSplitDelimitersOf(template, parameters) {
-	const delimiters = /* @__PURE__ */ new Set();
-	if (parameters.size === 0) return delimiters;
-	const reads = (node, seen) => {
-		if (typeof node === "string") {
-			for (const name of parameters) if (node.includes(`\${${name}}`)) return true;
-			return false;
-		}
-		if (node === null || typeof node !== "object" || seen.has(node)) return false;
-		seen.add(node);
-		if (!Array.isArray(node)) {
-			const ref = node["Ref"];
-			if (typeof ref === "string" && parameters.has(ref)) return true;
-		}
-		for (const child of Array.isArray(node) ? node : Object.values(node)) if (reads(child, seen)) return true;
-		return false;
-	};
-	const seen = /* @__PURE__ */ new Set();
-	const walk = (node) => {
-		if (node === null || typeof node !== "object" || seen.has(node)) return;
-		seen.add(node);
-		if (Array.isArray(node)) {
-			for (const child of node) walk(child);
-			return;
-		}
-		for (const [key, child] of Object.entries(node)) {
-			if (key === "Fn::Split" && Array.isArray(child) && typeof child[0] === "string" && reads(child[1], /* @__PURE__ */ new Set())) delimiters.add(child[0]);
-			walk(child);
-		}
-	};
-	walk(template);
-	return delimiters;
-}
-function printingCorpusOf(secrets) {
-	const logOnly = logOnlyValuesOf.get(secrets);
-	if (logOnly === void 0 || logOnly.size === 0) return secrets;
-	const corpus = new Map(secrets);
-	for (const needle of logOnly) if (!corpus.has(needle)) corpus.set(needle, "***");
-	return corpus;
-}
-function logOnlyValueCount(secrets) {
-	return logOnlyValuesOf.get(secrets)?.size ?? 0;
-}
-function unionOfSecretBags(bags) {
-	const union = /* @__PURE__ */ new Map();
-	for (const bag of bags) {
-		if (bag === void 0) continue;
-		for (const [plaintext, expression] of bag) if (!union.has(plaintext)) union.set(plaintext, expression);
-		carryLogOnlyValues(bag, union);
-	}
-	return union;
-}
-function createUnionSecretMasker(bags) {
-	const present = bags.filter((bag) => bag !== void 0);
-	let stamp;
-	let needles = /* @__PURE__ */ new Set();
-	let scanned = [];
-	return (text) => {
-		const now = present.map((bag) => `${bag.size}:${logOnlyValueCount(bag)}`).join(",");
-		if (now !== stamp) {
-			needles = /* @__PURE__ */ new Set();
-			for (const bag of present) {
-				for (const plaintext of bag.keys()) needles.add(plaintext);
-				for (const plaintext of logOnlyValuesOf.get(bag) ?? []) needles.add(plaintext);
-			}
-			scanned = printingNeedles(needles);
-			stamp = now;
-		}
-		if (text !== "" && needles.has(text)) return "***";
-		return maskMatchSpans(text, scanned, "***");
-	};
-}
-function hasLogOnlyValues(secrets) {
-	if (secrets === void 0) return false;
-	const logOnly = logOnlyValuesOf.get(secrets);
-	return logOnly !== void 0 && logOnly.size > 0;
-}
-function hasMaskableValues(secrets) {
-	if (secrets === void 0) return false;
-	if (secrets.size > 0) return true;
-	const logOnly = logOnlyValuesOf.get(secrets);
-	return logOnly !== void 0 && logOnly.size > 0;
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/reference-provenance.ts
-const passProvenanceOf = /* @__PURE__ */ new WeakMap();
-const MAX_REFERENCE_VERSIONS = 8;
-function provenanceTableFor(secrets) {
-	let table = passProvenanceOf.get(secrets);
-	if (table === void 0) {
-		table = /* @__PURE__ */ new Map();
-		passProvenanceOf.set(secrets, table);
-	}
-	return table;
-}
-function shareReferenceProvenance(view, pass) {
-	passProvenanceOf.set(view, provenanceTableFor(pass));
-}
-function entryFor(secrets, token) {
-	const table = provenanceTableFor(secrets);
-	let entry = table.get(token);
-	if (entry === void 0) {
-		entry = {
-			regions: /* @__PURE__ */ new Set(),
-			regionUnknown: false,
-			versions: /* @__PURE__ */ new Set(),
-			versionUnknown: false,
-			readVersions: /* @__PURE__ */ new Set()
-		};
-		table.set(token, entry);
-	}
-	return entry;
-}
-function recordReferenceResolution(secrets, token, resolution) {
-	const entry = entryFor(secrets, token);
-	if (resolution.region === void 0) entry.regionUnknown = true;
-	else entry.regions.add(resolution.region);
-	if (resolution.version === void 0) {
-		entry.versionUnknown = true;
-		return;
-	}
-	entry.versions.add(resolution.version);
-	if (resolution.route === "read") entry.readVersions.add(resolution.version);
-}
-function recordReferenceProvenanceEntry(secrets, token, provenance, route) {
-	const entry = entryFor(secrets, token);
-	if (provenance.region === void 0) entry.regionUnknown = true;
-	else entry.regions.add(provenance.region);
-	if (provenance.versions === void 0 || provenance.versions.length === 0) {
-		entry.versionUnknown = true;
-		return;
-	}
-	for (const version of provenance.versions) {
-		entry.versions.add(version);
-		if (route === "read") entry.readVersions.add(version);
-	}
-	if (route === "literal") for (const version of provenance.readVersions ?? []) entry.readVersions.add(version);
-}
-function mergeReferenceProvenance(from, to) {
-	const source = passProvenanceOf.get(from);
-	if (source === void 0 || from === to) return;
-	for (const [token, entry] of source) {
-		const target = entryFor(to, token);
-		for (const region of entry.regions) target.regions.add(region);
-		target.regionUnknown ||= entry.regionUnknown;
-		for (const version of entry.versions) target.versions.add(version);
-		target.versionUnknown ||= entry.versionUnknown;
-		for (const version of entry.readVersions) target.readVersions.add(version);
-	}
-}
-function hasPassProvenance(secrets) {
-	if (secrets === void 0) return false;
-	const table = passProvenanceOf.get(secrets);
-	return table !== void 0 && table.size > 0;
-}
-function passProvenanceFor(secrets, token) {
-	if (secrets === void 0) return void 0;
-	const entry = passProvenanceOf.get(secrets)?.get(token);
-	if (entry === void 0) return void 0;
-	return finalize(entry);
-}
-function passReadVersionsFor(secrets, token) {
-	if (secrets === void 0) return void 0;
-	const read = passProvenanceOf.get(secrets)?.get(token)?.readVersions;
-	return read === void 0 || read.size === 0 ? void 0 : read;
-}
-function finalize(entry) {
-	const out = {};
-	if (!entry.regionUnknown && entry.regions.size === 1) out.region = [...entry.regions][0];
-	if (!entry.versionUnknown && entry.versions.size > 0 && entry.versions.size <= 8) {
-		out.versions = [...entry.versions].sort();
-		if (entry.readVersions.size > 0) out.readVersions = [...entry.readVersions].sort();
-	}
-	return out;
-}
-function snapshotPassProvenance(secrets) {
-	if (secrets === void 0) return void 0;
-	const table = passProvenanceOf.get(secrets);
-	if (table === void 0 || table.size === 0) return void 0;
-	const out = /* @__PURE__ */ new Map();
-	for (const [token, entry] of table) out.set(token, finalize(entry));
-	return out;
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/recording.ts
-const scopeMaps = /* @__PURE__ */ new WeakSet();
-var WriteThroughSecrets = class extends Map {
-	pass;
-	constructor(pass) {
-		super();
-		this.pass = pass;
-	}
-	set(plaintext, expression) {
-		super.set(plaintext, expression);
-		this.pass.set(plaintext, expression);
-		return this;
-	}
-};
-function openRecordingScope(pass, policy) {
-	const secrets = new WriteThroughSecrets(pass);
-	scopeMaps.add(secrets);
-	shareLogOnlyValues(secrets, pass);
-	for (const [kind, share] of Object.entries(SCOPE_SHARERS)) if (policy[kind] === "carry") share(secrets, pass);
-	return {
-		secrets,
-		pass
-	};
-}
-const SCOPE_SHARERS = {
-	pairs: sharePairTable,
-	"mask-only-marks": (scope, pass) => {
-		for (const table of [
-			freshNoEchoValuesOf,
-			containmentValuesOf,
-			noEchoParameterValuesOf
-		]) table.set(scope, sideSetOf(table, pass));
-	},
-	"reference-provenance": shareReferenceProvenance,
-	"physical-name-copies": (scope, pass) => {
-		physicalNameCopiesOf.set(scope, sideSetOf(physicalNameCopiesOf, pass));
-	},
-	"public-proofs": sharePublicProofs
-};
-function isRecordingScope(secrets) {
-	return scopeMaps.has(secrets);
-}
-function foldRecording(from, to, policy) {
-	if (from === to) return;
-	for (const [plaintext, expression] of from) to.set(plaintext, expression);
-	for (const [kind, carry] of Object.entries(FOLD_CARRIERS)) if (policy[kind] === "carry") carry(from, to);
-}
-const FOLD_CARRIERS = {
-	"mask-only-marks": carryMaskOnlyMarks,
-	"reference-provenance": mergeReferenceProvenance,
-	pairs: mergePairTables,
-	"log-only": carryLogOnlyValues,
-	"physical-name-copies": (from, to) => {
-		for (const physicalId of physicalNameCopiesOf.get(from) ?? []) recordPhysicalNameCopy(to, physicalId);
-	},
-	"public-proofs": carryPublicProofs
-};
-function recordSecretResolution(secrets, expression, plaintext, options) {
-	secrets.set(plaintext, expression);
-	if (options.pairEvidence) recordResolvedPair(secrets, expression, plaintext);
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/context.ts
-const RULES_BY_PROVENANCE = {
-	"template-derived": TEMPLATE_DERIVED_RULES,
-	"template-sourced": TEMPLATE_SOURCED_RULES,
-	"state-readback": STATE_SOURCED_READBACK_RULES,
-	"state-baseline": STATE_SOURCED_BASELINE_RULES,
-	"state-cross-generation": STATE_SOURCED_CROSS_GENERATION_RULES,
-	"state-derived": STATE_DERIVED_RULES
-};
-function redactForState(bag, context) {
-	refuseScopeAsPass(context.secrets);
-	if (context.provenance === "value-scan") return redactSecretsForState(bag, context.secrets);
-	const { secrets, source, provenance } = context;
-	if (!((context.provenance === "template-derived" || context.provenance === "template-sourced" || context.provenance === "state-derived") && context.generation === "same-generation") || !isPlainBag(bag)) return redactAtProvenance(bag, secrets, source, provenance, false);
-	const copy = shallowCopy(bag);
-	const redacted = redactAtProvenance(copy, secrets, source, provenance, true);
-	return redacted === copy ? shallowCopy(copy) : redacted;
-}
-function redactAtProvenance(bag, secrets, source, provenance, sameGeneration) {
-	refuseScopeAsPass(secrets);
-	return redactSecretsForState(bag, secrets, source, RULES_BY_PROVENANCE[provenance], sameGeneration);
-}
-function refuseScopeAsPass(secrets) {
-	if (isRecordingScope(secrets)) throw new Error("Internal error: a bag was redacted for persistence with a recording scope; pass the scope's pass map instead.");
-}
-function isPlainBag(bag) {
-	if (Array.isArray(bag)) return true;
-	if (bag === null || typeof bag !== "object") return false;
-	const proto = Object.getPrototypeOf(bag);
-	return proto === Object.prototype || proto === null;
-}
-function shallowCopy(bag) {
-	return Array.isArray(bag) ? [...bag] : { ...bag };
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/positions.ts
-const SKELETON_WILDCARD = `${DYNAMIC_REFERENCE_INNER_CHAR}*`;
-const MAX_SKELETON_WILDCARDS = 3;
-const MAX_SKELETON_CANDIDATE_LENGTH = 512;
-function joinSkeletonSegments(segments) {
-	const out = [];
-	let wildcards = 0;
-	for (const segment of segments) {
-		if (segment === "") continue;
-		if (segment === SKELETON_WILDCARD) {
-			if (out[out.length - 1] === SKELETON_WILDCARD) continue;
-			wildcards += 1;
-			if (wildcards > MAX_SKELETON_WILDCARDS) return void 0;
-		}
-		out.push(segment);
-	}
-	return out.join("");
-}
-function intrinsicSkeletonPattern(source) {
-	const segments = intrinsicSkeletonSegments(source);
-	if (segments === void 0) return void 0;
-	return anchoredSkeletonPattern(segments);
-}
-function anchoredSkeletonPattern(segments) {
-	const body = joinSkeletonSegments(segments.map((segment) => segment === UNKNOWN_PART ? SKELETON_WILDCARD : escapeRegExp$2(segment)));
-	return body === void 0 ? void 0 : new RegExp(`^${body}$`);
-}
-const UNKNOWN_PART = Symbol("unknown intrinsic part");
-const UNKNOWN_PART_PLACEHOLDER = "\0";
-function joinPartLiteralText(part) {
-	if (typeof part === "string") return part;
-	if (typeof part === "number" || typeof part === "boolean") return String(part);
-}
-function intrinsicSkeletonSegments(source) {
-	const keys = Object.keys(source);
-	if (keys.length !== 1) return void 0;
-	const key = keys[0];
-	if (key === "Fn::Join") {
-		const args = source[key];
-		if (!Array.isArray(args) || args.length !== 2) return void 0;
-		const [delimiter, parts] = args;
-		if (typeof delimiter !== "string" || !Array.isArray(parts)) return void 0;
-		const segments = [];
-		parts.forEach((part, index) => {
-			if (index > 0) segments.push(delimiter);
-			segments.push(joinPartLiteralText(part) ?? UNKNOWN_PART);
-		});
-		return segments;
-	}
-	if (key === "Fn::Sub") {
-		const args = source[key];
-		const template = typeof args === "string" ? args : Array.isArray(args) ? args[0] : void 0;
-		if (typeof template !== "string") return void 0;
-		const segments = [];
-		let cursor = 0;
-		const variable = /\$\{([^}]*)\}/g;
-		let hit;
-		while ((hit = variable.exec(template)) !== null) {
-			segments.push(template.slice(cursor, hit.index));
-			const inner = hit[1];
-			segments.push(inner.startsWith("!") ? `\${${inner.slice(1)}}` : UNKNOWN_PART);
-			cursor = hit.index + hit[0].length;
-		}
-		segments.push(template.slice(cursor));
-		return segments;
-	}
-}
-function positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions) {
-	if (bag === "" || !secrets.has(bag)) return void 0;
-	const pattern = intrinsicSkeletonPattern(source);
-	if (!pattern) return void 0;
-	const plaintextOf = plaintextIndexOf(secrets);
-	let matched;
-	for (const candidate of /* @__PURE__ */ new Set([...secretExpressions, ...recordedSecretExpressions])) {
-		if (candidate.length > MAX_SKELETON_CANDIDATE_LENGTH) return void 0;
-		if (!pattern.test(candidate)) continue;
-		const recordedPlaintext = plaintextOf.get(candidate);
-		if (recordedPlaintext !== void 0 && recordedPlaintext !== bag) continue;
-		if (matched !== void 0) return void 0;
-		matched = candidate;
-	}
-	return matched;
-}
-function singleSpanFrame(bag, source) {
-	const spans = dynamicReferenceSpans(source);
-	if (spans.length !== 1) return void 0;
-	const [span] = spans;
-	const token = source.slice(span.start, span.end);
-	const prefix = source.slice(0, span.start);
-	const suffix = source.slice(span.end);
-	if (bag.length <= prefix.length + suffix.length) return void 0;
-	if (!bag.startsWith(prefix) || !bag.endsWith(suffix)) return void 0;
-	const middle = bag.slice(prefix.length, bag.length - suffix.length);
-	if (isSingleDynamicReferenceToken(middle)) return void 0;
-	return {
-		token,
-		prefix,
-		suffix,
-		middle
-	};
-}
-function positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration) {
-	const frame = singleSpanFrame(bag, source);
-	if (frame === void 0) {
-		if (dynamicReferenceSpans(source).length >= 2) {
-			if (certifiesRenderedLiteral(bag, source, secrets, bagIsSameGeneration)) return source;
-			if (bagIsSameGeneration) {
-				const mixed = certifiedMixedLiteral(bag, source, secrets);
-				if (mixed !== void 0) return mixed;
-			}
-		}
-		return redactForState(bag, {
-			provenance: "value-scan",
-			secrets
-		});
-	}
-	const recorded = resolvedPlaintextOf(secrets, frame.token);
-	if (recorded === void 0 || recorded !== frame.middle) return redactForState(bag, {
-		provenance: "value-scan",
-		secrets
-	});
-	return writeFramedTokenWithinScanBound(bag, secrets, frame, bagIsSameGeneration);
-}
-function pairedSpans(source, secrets) {
-	const spans = dynamicReferenceSpans(source);
-	if (spans.length === 0) return void 0;
-	const out = [];
-	for (const span of spans) {
-		const plaintext = resolvedPlaintextOf(secrets, source.slice(span.start, span.end));
-		if (plaintext === void 0 || plaintext === "") return void 0;
-		if (isSingleDynamicReferenceToken(plaintext)) return void 0;
-		out.push({
-			...span,
-			plaintext
-		});
-	}
-	return out;
-}
-function renderedTokenOf(spelling, secrets, plaintext) {
-	const spans = pairedSpans(spelling, secrets);
-	if (spans === void 0) return void 0;
-	const tokens = new Set(spans.filter((span) => span.plaintext === plaintext).map((span) => spelling.slice(span.start, span.end)));
-	return tokens.size === 1 ? [...tokens][0] : void 0;
-}
-function renderSpans(source, spans, textOf) {
-	let out = "";
-	let cursor = 0;
-	spans.forEach((span, index) => {
-		out += source.slice(cursor, span.start) + textOf(index);
-		cursor = span.end;
-	});
-	return out + source.slice(cursor);
-}
-function rendersLiteralTo(spelling, secrets, value) {
-	return renderedLiteralSpans(spelling, secrets, value) !== void 0;
-}
-function renderedLiteralSpans(spelling, secrets, value) {
-	const spans = pairedSpans(spelling, secrets);
-	if (spans === void 0) return void 0;
-	if (renderSpans(spelling, spans, (i) => spans[i].plaintext) !== value) return void 0;
-	return redactForState(spelling, {
-		provenance: "value-scan",
-		secrets
-	}) === spelling ? spans : void 0;
-}
-function certifiesRenderedLiteral(bag, source, secrets, bagIsSameGeneration) {
-	const spans = renderedLiteralSpans(source, secrets, bag);
-	if (spans === void 0) return false;
-	const survivors = [];
-	for (const span of spans) {
-		const survivor = secrets.get(span.plaintext);
-		if (survivor === void 0) return false;
-		survivors.push(survivor);
-	}
-	const scanned = redactForState(bag, {
-		provenance: "value-scan",
-		secrets
-	});
-	if (scanned === renderSpans(source, spans, (i) => survivors[i])) return true;
-	if (!bagIsSameGeneration) return false;
-	return scanned === renderSpans(source, spans, (i) => spans[i].plaintext.length >= 4 ? survivors[i] : spans[i].plaintext);
-}
-function certifiedMixedLiteral(bag, source, secrets) {
-	if (legacyMixedScan.has(secrets)) return void 0;
-	const answer = certifyMixedLiteral(bag, source, secrets);
-	if (answer !== void 0) mixedAnswered.add(secrets);
-	return answer;
-}
-const mixedAnswered = /* @__PURE__ */ new WeakSet();
-const legacyMixedScan = /* @__PURE__ */ new WeakSet();
-function mixedLiteralAnswered(secrets) {
-	return mixedAnswered.has(secrets);
-}
-function withLegacyMixedScan(secrets, run) {
-	if (legacyMixedScan.has(secrets)) return run();
-	legacyMixedScan.add(secrets);
-	try {
-		return run();
-	} finally {
-		legacyMixedScan.delete(secrets);
-	}
-}
-function certifyMixedLiteral(bag, source, secrets) {
-	const spans = dynamicReferenceSpans(source);
-	const parts = [];
-	for (const span of spans) {
-		const token = source.slice(span.start, span.end);
-		const plaintext = resolvedPlaintextOf(secrets, token);
-		if (plaintext !== void 0) {
-			if (plaintext === "" || isSingleDynamicReferenceToken(plaintext)) return void 0;
-			const survivor = secrets.get(plaintext);
-			if (survivor === void 0) return void 0;
-			parts.push({
-				kind: "secret",
-				plaintext,
-				survivor
-			});
-			continue;
+					if (abandonedAt !== void 0) this.abandonedLocks.set(key, abandonedAt);
+					try {
+						const retryEtag = await this.putLockObject(key, lockInfo);
+						this.logger.debug(`Lock acquired for stack: ${stackRef(stackName, region)} after expired lock cleanup, owner: ${displaySafe(lockOwner)}`);
+						this.trackHeldLock({
+							stackName,
+							region,
+							key,
+							info: lockInfo,
+							etag: retryEtag
+						});
+						return true;
+					} catch (retryError) {
+						if (this.isForeignLockError(retryError)) {
+							this.logger.debug(`Lock was acquired by another process during expired lock cleanup for stack: ${stackRef(stackName, region)}`);
+							return false;
+						}
+						throw retryError;
+					} finally {
+						await this.purgeLockVersions(key, "reap");
+					}
+				}
+				return false;
+			}
+			throw new LockError(`Failed to acquire lock for stack ${safeSegment(stackName)} (${safeSegment(region)}): ` + errorDetail$1(error), error instanceof Error ? error : void 0);
 		}
-		const value = provenPublicValue(secrets, token);
-		if (value === void 0 || value === "" || value.includes("{{resolve:")) return void 0;
-		parts.push({
-			kind: "public",
-			value
-		});
-	}
-	const secretParts = parts.filter((p) => p.kind === "secret");
-	const publicParts = parts.filter((p) => p.kind === "public");
-	if (secretParts.length === 0 || publicParts.length === 0) return void 0;
-	const textOf = (secret) => (i) => {
-		const part = parts[i];
-		return part.kind === "secret" ? secret(part) : part.value;
-	};
-	if (renderSpans(source, spans, textOf((p) => p.plaintext)) !== bag) return void 0;
-	if (redactForState(source, {
-		provenance: "value-scan",
-		secrets
-	}) !== source) return void 0;
-	if (redactForState(bag, {
-		provenance: "value-scan",
-		secrets
-	}) !== renderSpans(source, spans, textOf((p) => p.plaintext.length >= 4 ? p.survivor : p.plaintext))) return void 0;
-	return renderSpans(source, spans, (i) => {
-		const part = parts[i];
-		return part.kind === "secret" ? source.slice(spans[i].start, spans[i].end) : part.value;
-	});
-}
-function writeFramedTokenWithinScanBound(bag, secrets, frame, bagIsSameGeneration) {
-	const scanned = redactForState(bag, {
-		provenance: "value-scan",
-		secrets
-	});
-	const { token, prefix, suffix, middle } = frame;
-	const survivor = secrets.get(middle);
-	if (survivor === void 0) return scanned;
-	if (scanned === prefix + survivor + suffix) return prefix + token + suffix;
-	if (bagIsSameGeneration && scanned === bag) return prefix + token + suffix;
-	return scanned;
-}
-function positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIsSameGeneration) {
-	const segments = intrinsicSkeletonSegments(source);
-	if (segments === void 0) return void 0;
-	if (segments.some((s) => s !== UNKNOWN_PART && s.includes("\0"))) return;
-	const frame = singleSpanFrame(bag, segments.map((s) => s === UNKNOWN_PART ? "\0" : s).join(""));
-	if (frame === void 0) return void 0;
-	const { token, prefix, suffix, middle } = frame;
-	if (prefix.includes("\0") || suffix.includes("\0")) return;
-	const pattern = anchoredSkeletonPattern(token.split("\0").flatMap((literal, i) => i === 0 ? [literal] : [UNKNOWN_PART, literal]));
-	if (pattern === void 0) return void 0;
-	const plaintextOf = plaintextIndexOf(secrets);
-	let matched;
-	for (const candidate of /* @__PURE__ */ new Set([
-		...secretExpressions,
-		...recordedSecretExpressions,
-		...resolvedExpressionsOf(secrets)
-	])) {
-		if (candidate.length > MAX_SKELETON_CANDIDATE_LENGTH) return void 0;
-		if (!pattern.test(candidate)) continue;
-		const recordedPlaintext = plaintextOf.get(candidate);
-		if (recordedPlaintext !== void 0 && recordedPlaintext !== middle) continue;
-		if (matched !== void 0) return void 0;
-		matched = candidate;
-	}
-	if (matched === void 0 || resolvedPlaintextOf(secrets, matched) !== middle) return;
-	return writeFramedTokenWithinScanBound(bag, secrets, {
-		token: matched,
-		prefix,
-		suffix,
-		middle
-	}, bagIsSameGeneration);
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/pairs.ts
-const resolvedPairsOf = /* @__PURE__ */ new WeakMap();
-const CONFLICTING_PLAINTEXT = Symbol("conflicting plaintext");
-function pairsFor(secrets) {
-	let pairs = resolvedPairsOf.get(secrets);
-	if (pairs === void 0) {
-		pairs = /* @__PURE__ */ new Map();
-		resolvedPairsOf.set(secrets, pairs);
 	}
-	return pairs;
-}
-function recordResolvedPair(secrets, expression, plaintext) {
-	const pairs = pairsFor(secrets);
-	const previous = pairs.get(expression);
-	if (previous === void 0) pairs.set(expression, plaintext);
-	else if (previous !== plaintext) pairs.set(expression, CONFLICTING_PLAINTEXT);
-}
-function mergeResolvedPairs(from, to) {
-	carryMaskOnlyMarks(from, to);
-	mergeReferenceProvenance(from, to);
-	mergePairTables(from, to);
-}
-function mergePairTables(from, to) {
-	const pairs = resolvedPairsOf.get(from);
-	if (pairs === void 0) return;
-	for (const [expression, plaintext] of pairs) if (typeof plaintext === "string") recordResolvedPair(to, expression, plaintext);
-	else pairsFor(to).set(expression, CONFLICTING_PLAINTEXT);
-}
-function sharePairTable(view, pass) {
-	resolvedPairsOf.set(view, pairsFor(pass));
-}
-function resolvedPlaintextOf(secrets, expression) {
-	const recorded = resolvedPairsOf.get(secrets)?.get(expression);
-	return typeof recorded === "string" ? recorded : void 0;
-}
-function resolvedExpressionsOf(secrets) {
-	return [...resolvedPairsOf.get(secrets)?.keys() ?? []];
-}
-const CONFLICTING_LEAF_RESOLUTION = Symbol("conflicting leaf resolution");
-const intrinsicLeafResolutionsOf = /* @__PURE__ */ new WeakMap();
-function recordIntrinsicLeafResolution(secrets, source, resolution) {
-	let leaves = intrinsicLeafResolutionsOf.get(secrets);
-	if (leaves === void 0) {
-		leaves = /* @__PURE__ */ new WeakMap();
-		intrinsicLeafResolutionsOf.set(secrets, leaves);
-	}
-	const copy = {
-		input: resolution.input,
-		output: resolution.output,
-		substitutions: resolution.substitutions.map(({ token, value, secret }) => ({
-			token,
-			value,
-			secret
-		})),
-		complete: resolution.complete,
-		...resolution.parameterSpans === void 0 ? {} : { parameterSpans: resolution.parameterSpans.map(({ start, length, key }) => ({
-			start,
-			length,
-			key
-		})) }
-	};
-	const previous = leaves.get(source);
-	if (previous === void 0) leaves.set(source, copy);
-	else if (previous === CONFLICTING_LEAF_RESOLUTION || !sameLeafResolution(previous, copy)) leaves.set(source, CONFLICTING_LEAF_RESOLUTION);
-}
-function intrinsicLeafResolutionOf(secrets, source) {
-	const resolution = intrinsicLeafResolutionsOf.get(secrets)?.get(source);
-	return resolution === CONFLICTING_LEAF_RESOLUTION ? void 0 : resolution;
-}
-function recordIntrinsicLeafResolutionAs(secrets, source, branch) {
-	let leaves = intrinsicLeafResolutionsOf.get(secrets);
-	const resolution = typeof branch === "object" && branch !== null ? leaves?.get(branch) : void 0;
-	if (resolution === void 0 || resolution === CONFLICTING_LEAF_RESOLUTION) {
-		if (leaves === void 0) {
-			leaves = /* @__PURE__ */ new WeakMap();
-			intrinsicLeafResolutionsOf.set(secrets, leaves);
-		}
-		leaves.set(source, CONFLICTING_LEAF_RESOLUTION);
-		return;
+	async putLockObject(key, lockInfo, condition = { IfNoneMatch: "*" }) {
+		const body = JSON.stringify(lockInfo, null, 2);
+		return (await this.s3Client.send(new PutObjectCommand({
+			Bucket: this.config.bucket,
+			...await this.ownerParam(),
+			Key: key,
+			Body: body,
+			ContentLength: Buffer.byteLength(body),
+			ContentType: "application/json",
+			...condition
+		}))).ETag;
 	}
-	recordIntrinsicLeafResolution(secrets, source, resolution);
-}
-function sameLeafResolution(a, b) {
-	return a.input === b.input && a.output === b.output && a.complete === b.complete && a.substitutions.length === b.substitutions.length && a.substitutions.every((s, i) => s.token === b.substitutions[i].token && s.value === b.substitutions[i].value && s.secret === b.substitutions[i].secret) && sameParameterSpans(a.parameterSpans, b.parameterSpans);
-}
-function sameParameterSpans(a, b) {
-	if (a === void 0 || b === void 0) return a === b;
-	return a.length === b.length && a.every((s, i) => s.start === b[i].start && s.length === b[i].length && s.key === b[i].key);
-}
-function substitutedSpellingOf(secrets, source, resolvedValue) {
-	const resolution = intrinsicLeafResolutionsOf.get(secrets)?.get(source);
-	if (resolution === void 0 || resolution === CONFLICTING_LEAF_RESOLUTION) return void 0;
-	if (!resolution.complete || resolution.output !== resolvedValue) return void 0;
-	if (resolution.substitutions.length !== 1) return void 0;
-	const [substitution] = resolution.substitutions;
-	if (!substitution.secret) return void 0;
-	const frame = singleSpanFrame(resolvedValue, resolution.input);
-	if (frame === void 0) return void 0;
-	if (frame.token !== substitution.token || frame.middle !== substitution.value) return void 0;
-	for (const plaintext of secrets.keys()) {
-		if (plaintext === "") continue;
-		const outsideToken = frame.prefix.includes(plaintext) || frame.suffix.includes(plaintext);
-		if (plaintext === substitution.value ? outsideToken : resolution.input.includes(plaintext)) return;
-	}
-	return resolution.input;
-}
-const sameGenerationBags = /* @__PURE__ */ new WeakSet();
-function markSameGenerationBag(bag) {
-	sameGenerationBags.add(bag);
-	return bag;
-}
-function isSameGenerationBag(bag) {
-	return sameGenerationBags.has(bag);
-}
-const leafCertifiedBags = /* @__PURE__ */ new WeakSet();
-function markLeafCertifiedBag(bag) {
-	leafCertifiedBags.add(bag);
-	return bag;
-}
-function isLeafCertifiedBag(bag) {
-	return leafCertifiedBags.has(bag);
-}
-function redactionClaimOf(bag) {
-	return isSameGenerationBag(bag) || isLeafCertifiedBag(bag) ? "same-generation" : "unproven";
-}
-function carryRedactionMarks(from, to) {
-	if (isSameGenerationBag(from)) markSameGenerationBag(to);
-	if (isLeafCertifiedBag(from)) markLeafCertifiedBag(to);
-	return to;
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/unresolved-token-frame.ts
-function liveMatchesUnresolvedTokenFrame(send, live, unresolvedTokens, secrets) {
-	const wildcards = dynamicReferenceSpans(send).filter((span) => unresolvedTokens.has(send.slice(span.start, span.end)));
-	if (wildcards.length === 0) return false;
-	if (wildcardOverlapsResolvedPlaintext(send, wildcards, secrets)) return false;
-	const literals = [];
-	let at = 0;
-	for (const span of wildcards) {
-		literals.push(send.slice(at, span.start));
-		at = span.end;
-	}
-	literals.push(send.slice(at));
-	const first = literals[0];
-	const last = literals[literals.length - 1];
-	if (live.length < first.length + last.length) return false;
-	if (!live.startsWith(first) || !live.endsWith(last)) return false;
-	let pos = first.length;
-	const end = live.length - last.length;
-	for (let i = 1; i < literals.length - 1; i++) {
-		const literal = literals[i];
-		const found = live.indexOf(literal, pos);
-		if (found < 0 || found + literal.length > end) return false;
-		pos = found + literal.length;
+	async getLockInfo(stackName, region) {
+		const record = await this.getLockRecord(stackName, region);
+		return record ? record.info : null;
 	}
-	return true;
-}
-function wildcardOverlapsResolvedPlaintext(send, wildcards, secrets) {
-	for (const plaintext of secrets.keys()) {
-		if (plaintext === "") continue;
-		for (let from = send.indexOf(plaintext); from >= 0; from = send.indexOf(plaintext, from + 1)) {
-			const to = from + plaintext.length;
-			if (wildcards.some((span) => span.start < to && from < span.end)) return true;
+	async getLockRecord(stackName, region) {
+		await this.ensureClientForBucket();
+		const key = this.getLockKey(stackName, region);
+		const shownStack = safeSegment(stackName);
+		try {
+			this.logger.debug(`Getting lock info for stack: ${shownStack}`);
+			const response = await this.s3Client.send(new GetObjectCommand({
+				Bucket: this.config.bucket,
+				...await this.ownerParam(),
+				Key: key
+			}));
+			if (!response.Body) throw new LockError(`Lock file for stack ${shownStack} has no body`);
+			const bodyString = await response.Body.transformToString();
+			const raw = JSON.parse(bodyString);
+			if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+				this.logger.debug(`Lock file for stack ${shownStack} is not an object; treating as absent`);
+				return null;
+			}
+			const parsed = raw;
+			const lockInfo = {
+				...parsed,
+				owner: displaySafe(parsed.owner),
+				...parsed.operation !== void 0 && { operation: displaySafe(parsed.operation) },
+				expiresAt: nanIfUncoercible(parsed.expiresAt)
+			};
+			this.logger.debug(`Lock info for stack: ${shownStack}:`, lockInfo);
+			return {
+				info: lockInfo,
+				etag: response.ETag,
+				...response.LastModified instanceof Date && { lastModified: response.LastModified.getTime() }
+			};
+		} catch (error) {
+			if (error instanceof NoSuchKey) {
+				this.logger.debug(`No lock exists for stack: ${shownStack}`);
+				return null;
+			}
+			if (error instanceof LockError) throw error;
+			throw new LockError(`Failed to get lock info for stack ${shownStack}: ${errorDetail$1(error)}`, error instanceof Error ? error : void 0);
 		}
 	}
-	return false;
-}
-
-//#endregion
-//#region src/deployment/secret-redaction/noecho-leaves.ts
-const SUB_VARIABLE$2 = /\$\{([^}!][^}]*)\}/g;
-function intrinsicKeyOf(node) {
-	const keys = Object.keys(node);
-	if (keys.length !== 1) return void 0;
-	const key = keys[0];
-	return key === "Ref" || key.startsWith("Fn::") ? key : void 0;
-}
-function conditionVerdict(sources, name) {
-	if (typeof name !== "string" || sources.conditions === void 0) return void 0;
-	return Object.hasOwn(sources.conditions, name) ? sources.conditions[name] : void 0;
-}
-function getAttReadsNoEcho(argument, sources) {
-	if (sources.attributeIsNoEcho === void 0) return false;
-	let target;
-	let attribute;
-	if (typeof argument === "string") {
-		const dot = argument.indexOf(".");
-		if (dot <= 0) return false;
-		target = argument.slice(0, dot);
-		attribute = argument.slice(dot + 1);
-	} else if (Array.isArray(argument) && argument.length === 2) [target, attribute] = argument;
-	else return false;
-	if (typeof target !== "string") return false;
-	if (typeof attribute !== "string") return readsNoEchoSource(attribute, sources);
-	return sources.attributeIsNoEcho(target, attribute);
-}
-function subStringReadsNoEcho(text, variables, sources) {
-	for (const match of text.matchAll(SUB_VARIABLE$2)) {
-		const name = match[1].trim();
-		if (variables !== void 0 && Object.hasOwn(variables, name)) continue;
-		if (sources.parameters.has(name)) return true;
-		const dot = name.indexOf(".");
-		if (dot > 0 && sources.attributeIsNoEcho?.(name.slice(0, dot), name.slice(dot + 1)) === true) return true;
+	async isLocked(stackName, region) {
+		return await this.getLockInfo(stackName, region) !== null;
 	}
-	return false;
-}
-function readsNoEchoSource(node, sources) {
-	const seen = /* @__PURE__ */ new Set();
-	const walk = (value) => {
-		if (value === null || typeof value !== "object") return false;
-		if (seen.has(value)) return false;
-		seen.add(value);
-		if (Array.isArray(value)) return value.some(walk);
-		const record = value;
-		const intrinsic = intrinsicKeyOf(record);
-		if (intrinsic === "Ref") return typeof record["Ref"] === "string" && sources.parameters.has(record["Ref"]);
-		if (intrinsic === "Fn::GetAtt") return getAttReadsNoEcho(record["Fn::GetAtt"], sources);
-		if (intrinsic === "Fn::Sub") {
-			const argument = record["Fn::Sub"];
-			if (typeof argument === "string") return subStringReadsNoEcho(argument, void 0, sources);
-			if (Array.isArray(argument)) {
-				const [text, variables] = argument;
-				const vars = isPlainObject$7(variables) ? variables : void 0;
-				if (typeof text === "string" && subStringReadsNoEcho(text, vars, sources)) return true;
-				return vars !== void 0 && Object.values(vars).some(walk);
-			}
-			return walk(argument);
+	async releaseLock(stackName, region) {
+		const key = this.getLockKey(stackName, region);
+		const held = this.heldLocks.get(key);
+		if (held?.releasing) {
+			this.logger.debug(`Release already in flight (or done) for stack ${stackRef(stackName, region)}`);
+			return held.releasing;
 		}
-		if (intrinsic === "Fn::If") {
-			const argument = record["Fn::If"];
-			if (Array.isArray(argument) && argument.length === 3) {
-				const verdict = conditionVerdict(sources, argument[0]);
-				if (verdict !== void 0) return walk(verdict ? argument[1] : argument[2]);
-				return walk(argument[1]) || walk(argument[2]);
-			}
-			return walk(argument);
+		if (!held) return this.doReleaseLock(stackName, region, void 0);
+		this.stopRenewal(held);
+		const releasing = this.doReleaseLock(stackName, region, held);
+		held.releasing = releasing;
+		return releasing;
+	}
+	async doReleaseLock(stackName, region, held) {
+		await this.ensureClientForBucket();
+		if (held) await held.renewing?.catch(() => void 0);
+		if (held?.lost) {
+			this.logger.warn(`Not releasing the lock for stack ${stackRef(stackName, region)}: this process lost it while the operation was still running, so the lock present now belongs to someone else.`);
+			return;
+		}
+		if (held && held.etag === void 0 && !await this.stillOursByBody(held)) {
+			this.logger.warn(`Not releasing the lock for stack ${stackRef(stackName, region)}: this process never learned which version of the lock it wrote, and could not confirm the one present is its own. It expires on its own, or clear it with cdkd force-unlock.`);
+			return;
 		}
-		return Object.values(record).some(walk);
-	};
-	return walk(node);
-}
-function literalIndex(index) {
-	if (typeof index === "number" && Number.isInteger(index)) return index;
-	if (typeof index === "string" && /^\d+$/.test(index)) return Number(index);
-}
-function noEchoCoordinatesOf(template, resolved, sources, onCoordinate) {
-	const coordinates = [];
-	const push = (path, node) => {
-		coordinates.push(path);
-		onCoordinate?.(path, node);
-	};
-	const ancestors = /* @__PURE__ */ new Set();
-	const parametersOnly = {
-		parameters: sources.parameters,
-		...sources.conditions !== void 0 && { conditions: sources.conditions }
-	};
-	const isBareDeclaredGetAtt = (node) => isPlainObject$7(node) && intrinsicKeyOf(node) === "Fn::GetAtt" && getAttReadsNoEcho(node["Fn::GetAtt"], sources);
-	const walk = (source, value, path) => {
-		if (value === void 0) return;
-		if (source === null || typeof source !== "object") return;
-		if (ancestors.has(source)) return;
-		ancestors.add(source);
 		try {
-			if (Array.isArray(source)) {
-				if (!readsNoEchoSource(source, sources)) return;
-				if (Array.isArray(value) && value.length === source.length) source.forEach((item, index) => walk(item, value[index], [...path, index]));
-				else if (readsNoEchoSource(source, parametersOnly) || source.some(isBareDeclaredGetAtt)) push(path, source);
+			this.logger.debug(`Releasing lock for stack: ${stackRef(stackName, region)}`);
+			await this.deleteLock(stackName, region, held?.etag);
+			this.logger.debug(`Lock released for stack: ${stackRef(stackName, region)}`);
+		} catch (error) {
+			if (this.isForeignLockError(error)) {
+				this.logger.warn(held?.etagUncertain ? `Not releasing the lock for stack ${stackRef(stackName, region)}: this process could not confirm which version of the lock it last wrote, so it will not delete one it may not own. The lock clears on its own at ${new Date(held.info.expiresAt).toISOString()}, or immediately with cdkd force-unlock.` : `Not releasing the lock for stack ${stackRef(stackName, region)}: it has been replaced since this process acquired it, so another cdkd process now holds it. Leaving it in place.`);
 				return;
 			}
-			const record = source;
-			const intrinsic = intrinsicKeyOf(record);
-			if (intrinsic === void 0) {
-				if (!isPlainObject$7(value)) {
-					if (readsNoEchoSource(record, parametersOnly)) push(path, source);
-					return;
-				}
-				for (const [key, child] of Object.entries(record)) if (Object.hasOwn(value, key)) walk(child, value[key], [...path, key]);
+			if (this.isGoneError(error)) {
+				this.logger.debug(`Lock for stack ${stackRef(stackName, region)} was already gone`);
 				return;
 			}
-			if (intrinsic === "Fn::If") {
-				const argument = record["Fn::If"];
-				if (Array.isArray(argument) && argument.length === 3) {
-					const verdict = conditionVerdict(sources, argument[0]);
-					if (verdict !== void 0) {
-						walk(verdict ? argument[1] : argument[2], value, path);
-						return;
-					}
-					if (isBareDeclaredGetAtt(argument[1]) || isBareDeclaredGetAtt(argument[2])) {
-						push(path, source);
-						return;
-					}
+			if (held?.etag !== void 0 && this.isConditionUnsupportedError(error)) {
+				if (!await this.stillOursByBody(held)) {
+					this.logger.warn(`Not releasing the lock for stack ${stackRef(stackName, region)}: the conditional delete could not be evaluated here, and this process could not confirm the lock is still its own. Leaving it in place rather than risk deleting another process's lock. It expires on its own, or clear it with cdkd force-unlock. If this repeats, grant s3:GetObject on the lock key -- a delete conditioned on an ETag requires it.`);
+					return;
 				}
-			}
-			if (intrinsic === "Fn::Select") {
-				const argument = record["Fn::Select"];
-				if (Array.isArray(argument) && argument.length === 2 && Array.isArray(argument[1])) {
-					const index = literalIndex(argument[0]);
-					const list = argument[1];
-					if (index !== void 0 && index < list.length) {
-						walk(list[index], value, path);
-						return;
-					}
+				this.logger.debug(`Conditional lock release for stack ${stackRef(stackName, region)} is not supported here (${errorDetail$1(error)}); retrying unconditionally`);
+				try {
+					await this.deleteLock(stackName, region);
+					this.logger.debug(`Lock released for stack: ${stackRef(stackName, region)}`);
+					return;
+				} catch (fallbackError) {
+					throw new LockError(`Failed to release lock for stack ${stackRef(stackName, region)}: ${errorDetail$1(fallbackError)}`, fallbackError instanceof Error ? fallbackError : void 0);
 				}
 			}
-			if (intrinsic === "Fn::GetAtt") {
-				if (getAttReadsNoEcho(record["Fn::GetAtt"], sources)) push(path, source);
-				return;
-			}
-			if (readsNoEchoSource(record, parametersOnly)) push(path, source);
+			throw new LockError(`Failed to release lock for stack ${stackRef(stackName, region)}: ${errorDetail$1(error)}`, error instanceof Error ? error : void 0);
 		} finally {
-			ancestors.delete(source);
-		}
-	};
-	walk(template, resolved, []);
-	return coordinates;
-}
-function noEchoParameterNodesAt(templateProperties, shape, noEchoParameters, conditions) {
-	const nodes = /* @__PURE__ */ new Map();
-	noEchoCoordinatesOf(templateProperties ?? {}, shape, {
-		parameters: noEchoParameters,
-		...conditions !== void 0 && { conditions }
-	}, (coordinate, node) => nodes.set(canonicalJson$3(coordinate), {
-		coordinate,
-		node
-	}));
-	return nodes;
-}
-function recordedNoEchoValuesOf(templateProperties, record, noEchoParameterNames, conditions) {
-	const bag = /* @__PURE__ */ new Map();
-	const properties = record?.properties;
-	if (properties === null || typeof properties !== "object") return bag;
-	const coordinates = /* @__PURE__ */ new Map();
-	if (noEchoParameterNames.size > 0 && templateProperties !== void 0) for (const [key, { coordinate }] of noEchoParameterNodesAt(templateProperties, properties, noEchoParameterNames, conditions)) coordinates.set(key, coordinate);
-	for (const coordinate of noEchoLeavesOf(record ?? {}) ?? []) coordinates.set(canonicalJson$3(coordinate), coordinate);
-	const recordLeaf = (leaf) => {
-		if (typeof leaf === "string") {
-			if (leaf === "***" || leaf.includes("{{resolve:")) return;
-			recordLogOnlyValue(bag, leaf);
-		} else if (typeof leaf === "number") recordLogOnlyValue(bag, String(leaf));
-	};
-	const seen = /* @__PURE__ */ new Set();
-	const walk = (value) => {
-		if (value === null || typeof value !== "object") {
-			recordLeaf(value);
-			return;
+			const purge = this.purgeLockVersions(this.getLockKey(stackName, region), "release");
+			if (this.deferReleasePurge) {
+				this.deferredPurges.add(purge);
+				purge.finally(() => this.deferredPurges.delete(purge));
+			} else await purge;
 		}
-		if (seen.has(value)) return;
-		seen.add(value);
-		for (const child of Object.values(value)) walk(child);
-	};
-	for (const coordinate of coordinates.values()) walk(valueAtCoordinate(properties, coordinate));
-	return bag;
-}
-function maskWholeValue(value) {
-	if (value === null || value === void 0) return value;
-	if (typeof value === "string" && isSingleDynamicReferenceToken(value)) return value;
-	if (Array.isArray(value)) return value.map(maskWholeValue);
-	if (isPlainObject$7(value)) {
-		const out = {};
-		for (const [key, child] of Object.entries(value)) Object.defineProperty(out, key, {
-			value: maskWholeValue(child),
-			enumerable: true,
-			writable: true,
-			configurable: true
-		});
-		return out;
 	}
-	return "***";
-}
-function readAt(bag, coordinate) {
-	let node = bag;
-	for (const segment of coordinate) {
-		if (typeof segment === "number") {
-			if (!Array.isArray(node) || segment >= node.length) return {
-				found: false,
-				value: void 0
-			};
-			node = node[segment];
-			continue;
+	async stillOursByBody(held) {
+		let record;
+		try {
+			record = await this.getLockRecord(held.stackName, held.region);
+		} catch {
+			return false;
 		}
-		if (!isPlainObject$7(node) || !Object.hasOwn(node, segment)) return {
-			found: false,
-			value: void 0
-		};
-		node = node[segment];
+		if (!record) return false;
+		return this.sameLockIdentity(record.info, held.info);
 	}
-	return {
-		found: true,
-		value: node
-	};
-}
-function valueAtCoordinate(bag, coordinate) {
-	return readAt(bag, coordinate).value;
-}
-function cloneContainer(node) {
-	if (Array.isArray(node)) return [...node];
-	if (isPlainObject$7(node)) return { ...node };
-	return node;
-}
-function maskAtCoordinates(bag, coordinates) {
-	if (coordinates.length === 0) return bag;
-	let root = bag;
-	for (const coordinate of coordinates) {
-		if (!readAt(root, coordinate).found) continue;
-		if (coordinate.length === 0) {
-			root = maskWholeValue(root);
-			continue;
-		}
-		root = cloneContainer(root);
-		let node = root;
-		for (let i = 0; i < coordinate.length - 1; i++) {
-			const segment = coordinate[i];
-			const next = cloneContainer(node[segment]);
-			node[segment] = next;
-			node = next;
-		}
-		const last = coordinate[coordinate.length - 1];
-		node[last] = maskWholeValue(node[last]);
+	sameLockIdentity(a, b) {
+		return displaySafe(a.owner) === displaySafe(b.owner) && a.timestamp === b.timestamp;
 	}
-	return root;
-}
-function replaceAtCoordinates(bag, entries) {
-	let root = bag;
-	for (const { coordinate, value } of entries) {
-		if (!readAt(root, coordinate).found) continue;
-		if (coordinate.length === 0) {
-			root = value;
-			continue;
+	abandonedRunEndedBy(stackName, region) {
+		return this.abandonedLocks.get(this.getLockKey(stackName, region));
+	}
+	async forceReleaseLock(stackName, region, beforeDelete) {
+		const where = stackRef(stackName, region);
+		const record = await this.getLockRecord(stackName, region).catch(() => null);
+		const lockInfo = record?.info ?? null;
+		this.logger.warn(lockInfo ? `Force releasing lock for stack: ${where}, owner: ${formatLockOwner(lockInfo.owner)}${lockInfo.operation ? `, operation: ${formatLockOperation(lockInfo.operation)}` : ""}, expired: ${this.isLockExpired(lockInfo)}` : `Force releasing lock for stack: ${where} (no lock body read — absent or unparseable; deleting the object either way, since a lock cdkd cannot read is a lock nothing else can clear)`);
+		const key = this.getLockKey(stackName, region);
+		const held = this.heldLocks.get(key);
+		if (held) {
+			this.stopRenewal(held);
+			held.releasing = Promise.resolve();
 		}
-		root = cloneContainer(root);
-		let node = root;
-		for (let i = 0; i <= coordinate.length - 1; i++) {
-			const segment = coordinate[i];
-			const next = i === coordinate.length - 1 ? value : cloneContainer(node[segment]);
-			if (typeof segment === "number") node[segment] = next;
-			else Object.defineProperty(node, segment, {
-				value: next,
-				enumerable: true,
-				writable: true,
-				configurable: true
-			});
-			node = next;
+		const horizon = record ? abandonedRunHorizon(record) : void 0;
+		if (horizon !== void 0 && beforeDelete !== void 0) await beforeDelete(horizon).catch(() => void 0);
+		try {
+			await this.deleteLock(stackName, region);
+		} finally {
+			await this.purgeLockVersions(key, "reap");
 		}
+		return horizon;
 	}
-	return root;
-}
-function maskReadbackAtCoordinates(readback, properties, coordinates) {
-	let result = readback;
-	for (const coordinate of coordinates) {
-		const target = readbackPathFor(result, properties, coordinate);
-		if (target !== void 0) result = maskAtCoordinates(result, [target]);
+	async deleteLock(stackName, region, etag) {
+		await this.ensureClientForBucket();
+		const key = this.getLockKey(stackName, region);
+		await this.s3Client.send(new DeleteObjectCommand({
+			Bucket: this.config.bucket,
+			...await this.ownerParam(),
+			Key: key,
+			...etag !== void 0 && { IfMatch: etag }
+		}));
 	}
-	return result;
-}
-function readbackPathFor(readback, properties, coordinate) {
-	const path = [];
-	let live = readback;
-	let desired = properties;
-	for (const segment of coordinate) {
-		if (typeof segment === "number") {
-			if (!Array.isArray(live)) return path.length === 0 ? void 0 : path;
-			const key = Array.isArray(desired) ? identityKeyFor(live, desired) : void 0;
-			const element = Array.isArray(desired) ? desired[segment] : void 0;
-			if (key === void 0 || !isPlainObject$7(element)) return path;
-			const identity = element[key];
-			const index = live.findIndex((item) => isPlainObject$7(item) && item[key] === identity);
-			if (index < 0) return path;
-			path.push(index);
-			live = live[index];
-			desired = element;
-			continue;
+	async purgeLockVersions(key, path) {
+		const report = (message) => {
+			try {
+				if (path === "reap") this.logger.warn(message);
+				else this.logger.debug(message);
+			} catch {}
+		};
+		try {
+			await this.ensureClientForBucket();
+			await purgeNoncurrentKeyVersions(this.s3Client, this.config.bucket, [key], {
+				requestFields: await this.ownerParam(),
+				logger: { warn: report },
+				objectDescription: LOCK_OBJECT_DESCRIPTION
+			});
+		} catch (error) {
+			report(`Could not purge noncurrent versions of the lock key ${displayIdent(key, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })} in bucket '${this.config.bucket}': the purge could not be started. Their previous versions survive and remain readable via GetObject with a VersionId (${LOCK_OBJECT_DESCRIPTION}). Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key by hand. Underlying error: ${errorDetail$1(error)}`);
 		}
-		if (!isPlainObject$7(live)) return path.length === 0 ? void 0 : path;
-		if (!Object.hasOwn(live, segment)) return void 0;
-		path.push(segment);
-		live = live[segment];
-		desired = isPlainObject$7(desired) ? desired[segment] : void 0;
-	}
-	return path;
-}
-function canonicalCoordinates(coordinates) {
-	const keyed = /* @__PURE__ */ new Map();
-	for (const coordinate of coordinates) keyed.set(JSON.stringify(coordinate), [...coordinate]);
-	const all = [...keyed.values()];
-	const covered = (inner) => all.some((outer) => outer.length < inner.length && outer.every((segment, i) => segment === inner[i]));
-	return all.filter((coordinate) => !covered(coordinate)).sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)));
-}
-function noEchoLeavesOf(record) {
-	const field = record.noEchoLeaves;
-	if (!Array.isArray(field)) return void 0;
-	const out = [];
-	for (const entry of field) {
-		if (!Array.isArray(entry)) return void 0;
-		if (!entry.every((s) => typeof s === "string" || typeof s === "number" && Number.isInteger(s))) return void 0;
-		out.push(entry);
 	}
-	return out;
-}
-function isMarkedCoordinate(coordinate, marked) {
-	return marked.some((outer) => outer.length <= coordinate.length && outer.every((segment, i) => segment === coordinate[i]));
-}
-function witnessNormalize(stored, today, v11) {
-	const confirmed = [];
-	const differing = [];
-	const walk = (s, t, v, path) => {
-		if (v !== "***" && containsMask(v) && (Array.isArray(v) ? !Array.isArray(s) || s.length !== v.length : isPlainObject$7(v) ? !isPlainObject$7(s) : false)) {
-			if (s === void 0 || containsMask(s)) return s;
-			if (jsonEqual(s, t)) {
-				confirmed.push(path);
-				return v;
-			}
-			differing.push(path);
-			return s;
-		}
-		if (v === "***") {
-			if (s === void 0 || containsMask(s)) return s;
-			if (jsonEqual(s, t)) {
-				confirmed.push(path);
-				return v;
-			}
-			differing.push(path);
-			return s;
-		}
-		if (Array.isArray(v) && Array.isArray(s)) {
-			if (s.length !== v.length) return s;
-			const tt = Array.isArray(t) ? t : [];
-			let changed = false;
-			const out = s.map((item, i) => {
-				const next = walk(item, tt[i], v[i], [...path, i]);
-				if (next !== item) changed = true;
-				return next;
-			});
-			return changed ? out : s;
-		}
-		if (isPlainObject$7(v) && isPlainObject$7(s)) {
-			const tt = isPlainObject$7(t) ? t : {};
-			let out;
-			for (const key of Object.keys(v)) {
-				if (!Object.hasOwn(s, key)) continue;
-				const next = walk(s[key], tt[key], v[key], [...path, key]);
-				if (next !== s[key]) {
-					out ??= { ...s };
-					out[key] = next;
-				}
-			}
-			return out ?? s;
+	trackHeldLock(args) {
+		const previous = this.heldLocks.get(args.key);
+		if (previous) this.stopRenewal(previous);
+		const held = {
+			stackName: args.stackName,
+			region: args.region,
+			key: args.key,
+			info: args.info,
+			etag: args.etag,
+			timer: void 0,
+			renewing: void 0,
+			lost: false,
+			releasing: void 0,
+			etagUncertain: false,
+			warnedPastExpiry: false
+		};
+		this.heldLocks.set(args.key, held);
+		if (this.renewalDisabled) {
+			this.logger.debug(`Lock renewal is disabled; the lock for ${stackRef(args.stackName, args.region)} will lapse at its TTL`);
+			return;
 		}
-		return s;
-	};
-	return {
-		current: walk(stored, today, v11, []),
-		confirmed,
-		differing
-	};
-}
-function containsMask(value) {
-	if (value === "***") return true;
-	if (Array.isArray(value)) return value.some(containsMask);
-	if (isPlainObject$7(value)) return Object.values(value).some(containsMask);
-	return false;
-}
-function jsonEqual(a, b) {
-	return canonicalJson$3(a) === canonicalJson$3(b);
-}
-function canonicalJson$3(value) {
-	return JSON.stringify(value, (_key, node) => {
-		if (node === null || typeof node !== "object" || Array.isArray(node)) return node;
-		const sorted = Object.create(null);
-		for (const key of Object.keys(node).sort()) sorted[key] = node[key];
-		return sorted;
-	});
-}
-const PREVIOUS_NOECHO_VALUE = "(previous NoEcho value)";
-function noEchoParametersReadBy(node, sources) {
-	return [...sources.parameters].filter((name) => readsNoEchoSource(node, {
-		parameters: /* @__PURE__ */ new Set([name]),
-		...sources.conditions !== void 0 && { conditions: sources.conditions }
-	}));
-}
-function noEchoComparison(options) {
-	const { sources, values, minNeedleLength, publicTokens } = options;
-	return ({ templateProperties, desired, current }) => {
-		const coordinates = noEchoCoordinatesOf(templateProperties, desired, sources);
-		const needles = [];
-		for (const name of noEchoParametersReadBy(templateProperties, sources)) {
-			const value = values[name];
-			const leaves = Array.isArray(value) ? value : [value];
-			for (const leaf of leaves) if (typeof leaf === "string" && leaf.length >= minNeedleLength && !isSingleDynamicReferenceToken(leaf)) needles.push(leaf);
-		}
-		if (coordinates.length === 0 && needles.length === 0) return void 0;
-		let masked = maskAtCoordinates(desired, coordinates);
-		if (needles.length > 0) {
-			const walk = (node) => {
-				if (typeof node === "string") {
-					if (node === "***") return node;
-					const outside = node.replace(DYNAMIC_REFERENCE_TOKEN_SCAN, "");
-					return needles.some((needle) => node === needle || publicTokens?.has(needle) !== true && outside.includes(needle)) ? "***" : node;
-				}
-				if (Array.isArray(node)) {
-					const out = node.map(walk);
-					return out.some((item, i) => item !== node[i]) ? out : node;
-				}
-				if (isPlainObject$7(node)) {
-					let out;
-					for (const [key, child] of Object.entries(node)) {
-						const next = walk(child);
-						if (next !== child) {
-							out ??= { ...node };
-							out[key] = next;
-						}
-					}
-					return out ?? node;
-				}
-				return node;
-			};
-			masked = walk(masked);
+		if (args.etag === void 0) {
+			this.logger.debug(`No ETag returned when acquiring the lock for ${stackRef(args.stackName, args.region)}; renewal disabled for this lock`);
+			return;
 		}
-		const witnessed = witnessNormalize(current, desired, masked);
-		const shown = maskAtCoordinatesWith(witnessed.current, witnessed.differing, PREVIOUS_NOECHO_VALUE);
-		return {
-			desired: masked,
-			current: shown
-		};
-	};
-}
-function maskAtCoordinatesWith(bag, coordinates, replacement) {
-	let root = bag;
-	for (const coordinate of coordinates) {
-		if (coordinate.length === 0 || !readAt(root, coordinate).found) continue;
-		root = cloneContainer(root);
-		let node = root;
-		for (let i = 0; i < coordinate.length - 1; i++) {
-			const segment = coordinate[i];
-			const next = cloneContainer(node[segment]);
-			node[segment] = next;
-			node = next;
+		this.startRenewal(held);
+	}
+	startRenewal(held) {
+		const timer = setInterval(() => {
+			this.renewLock(held);
+		}, this.renewalIntervalMs);
+		timer.unref?.();
+		held.timer = timer;
+	}
+	stopRenewal(held) {
+		if (held.timer !== void 0) {
+			clearInterval(held.timer);
+			held.timer = void 0;
 		}
-		node[coordinate[coordinate.length - 1]] = replacement;
 	}
-	return root;
-}
-function noEchoOutputsComparison(templateValues, sources) {
-	return (current, desired) => {
-		const coordinates = noEchoCoordinatesOf(templateValues, desired, sources);
-		const maskedKeys = new Set(coordinates.map((coordinate) => coordinate[0]).filter((key) => typeof key === "string"));
-		const maskedValues = new Set([...maskedKeys].map((key) => canonicalJson$3(desired[key])));
-		for (const key of Object.keys(desired)) if (!Object.hasOwn(templateValues, key) && maskedValues.has(canonicalJson$3(desired[key]))) maskedKeys.add(key);
-		if (maskedKeys.size === 0) return {
-			current,
-			desired,
-			masked: []
+	renewLock(held) {
+		if (held.lost || held.renewing !== void 0 || held.etag === void 0) return Promise.resolve();
+		const inFlight = this.doRenewLock(held).finally(() => {
+			held.renewing = void 0;
+		});
+		held.renewing = inFlight;
+		return inFlight;
+	}
+	async doRenewLock(held) {
+		const currentEtag = held.etag;
+		if (currentEtag === void 0) return;
+		const renewed = {
+			...held.info,
+			expiresAt: Date.now() + this.ttlMs
 		};
-		const maskedDesired = { ...desired };
-		for (const key of maskedKeys) maskedDesired[key] = maskWholeValue(desired[key]);
-		let normalized = current;
-		if (current !== void 0 && current !== null && typeof current === "object") for (const key of maskedKeys) {
-			if (!Object.hasOwn(current, key)) continue;
-			const stored = current[key];
-			if (containsMask(stored)) continue;
-			normalized = { ...normalized ?? {} };
-			normalized[key] = canonicalJson$3(stored) === canonicalJson$3(desired[key]) ? maskedDesired[key] : PREVIOUS_NOECHO_VALUE;
+		try {
+			const etag = await this.putLockObject(held.key, renewed, { IfMatch: currentEtag });
+			if (etag === void 0) {
+				if (await this.adoptOwnWrite(held, renewed)) return;
+				held.info = renewed;
+				held.etagUncertain = true;
+				this.stopRenewal(held);
+				this.logger.debug(`Lock renewal for ${stackRef(held.stackName, held.region)} returned no ETag and the object could not be re-read; stopping renewal and keeping the previous ETag`);
+				return;
+			}
+			held.info = renewed;
+			held.etag = etag;
+			held.warnedPastExpiry = false;
+			this.logger.debug(`Renewed lock for stack: ${stackRef(held.stackName, held.region)} until ${new Date(renewed.expiresAt).toISOString()}`);
+		} catch (error) {
+			if (this.isForeignLockError(error) && await this.adoptOwnWrite(held, renewed)) return;
+			if (this.isNotOursError(error)) {
+				held.lost = true;
+				this.stopRenewal(held);
+				this.logger.warn(`Lost the lock for stack ${stackRef(held.stackName, held.region)} while the operation was still running: the lock object has been replaced or removed. Another cdkd process may now be writing to this stack concurrently. This process will not delete the current lock when it finishes.`);
+				return;
+			}
+			this.logger.debug(`Lock renewal for stack ${stackRef(held.stackName, held.region)} failed, will retry: ${errorDetail$1(error)}`);
+			if (!held.warnedPastExpiry && Date.now() >= held.info.expiresAt) {
+				held.warnedPastExpiry = true;
+				this.logger.warn(`Lock renewal for stack ${stackRef(held.stackName, held.region)} has been failing long enough that the lock expired at ${new Date(held.info.expiresAt).toISOString()}. Another cdkd process can now take it while this operation is still running. Renewal keeps retrying.`);
+			}
 		}
-		return {
-			current: normalized,
-			desired: maskedDesired,
-			masked: [...maskedKeys]
-		};
-	};
-}
-function maskedLeafCoordinatesOf(bag) {
-	const coordinates = [];
-	const ancestors = /* @__PURE__ */ new Set();
-	const walk = (node, path) => {
-		if (node === "***") {
-			coordinates.push(path);
-			return;
+	}
+	async adoptOwnWrite(held, renewed) {
+		const record = await this.getLockRecord(held.stackName, held.region).catch(() => null);
+		if (!record || record.etag === void 0 || record.info.expiresAt !== renewed.expiresAt || !this.sameLockIdentity(record.info, renewed)) return false;
+		held.info = renewed;
+		held.etag = record.etag;
+		held.warnedPastExpiry = false;
+		this.logger.debug(`Lock renewal for stack ${stackRef(held.stackName, held.region)} reported a conflict, but the object holds this process's own renewal -- adopting it and continuing`);
+		return true;
+	}
+	isForeignLockError(error) {
+		return error instanceof S3ServiceException && (error.name === "PreconditionFailed" || error.$metadata.httpStatusCode === 412);
+	}
+	isGoneError(error) {
+		if (error instanceof NoSuchKey) return true;
+		if (!(error instanceof S3ServiceException)) return false;
+		if (error.name === "NoSuchBucket") return false;
+		return error.name === "NoSuchKey" || error.$metadata.httpStatusCode === 404;
+	}
+	isConditionUnsupportedError(error) {
+		if (!(error instanceof S3ServiceException)) return false;
+		const status = error.$metadata.httpStatusCode;
+		return status === 403 || status === 501 || error.name === "AccessDenied" || error.name === "Forbidden" || error.name === "NotImplemented";
+	}
+	isNotOursError(error) {
+		return this.isForeignLockError(error) || this.isGoneError(error);
+	}
+	async acquireLockWithRetry(stackName, region, owner, operation, maxRetries = 3, retryDelay = 2e3) {
+		let attempts = 0;
+		let releasedReacquires = 0;
+		let lockInfo = null;
+		for (let attempt = 0; attempt <= maxRetries; attempt++) {
+			attempts++;
+			if (await this.acquireLock(stackName, region, owner, operation)) return;
+			lockInfo = await this.getLockInfo(stackName, region);
+			if (!lockInfo && releasedReacquires < 3) {
+				releasedReacquires++;
+				this.logger.debug(safeMsg`Lock for stack ${stackRef(stackName, region)} could not be acquired, yet no readable lock was found -- most likely released in between; re-attempting (${releasedReacquires}/${3})`);
+				attempt--;
+				continue;
+			}
+			if (attempt < maxRetries) {
+				const holder = lockInfo ? `is locked by ${formatLockOwner(lockInfo.owner)}${lockInfo.operation ? ` (operation: ${formatLockOperation(lockInfo.operation)})` : ""}. Lock ${formatLockExpiry(lockInfo.expiresAt)}.` : `could not be locked, and no readable lock was found.`;
+				this.logger.info(`Stack ${safeSegment(stackName)} (${safeSegment(region)}) ${holder} Retrying in ${this.formatDuration(retryDelay)}... (attempt ${attempt + 1}/${maxRetries})`);
+				await new Promise((resolve) => setTimeout(resolve, retryDelay));
+			}
 		}
-		if (node === null || typeof node !== "object" || ancestors.has(node)) return;
-		ancestors.add(node);
-		if (Array.isArray(node)) node.forEach((item, index) => walk(item, [...path, index]));
-		else for (const [key, child] of Object.entries(node)) walk(child, [...path, key]);
-		ancestors.delete(node);
-	};
-	walk(bag, []);
-	return coordinates;
-}
-const passedNoEchoParameters = /* @__PURE__ */ new WeakMap();
-function recordPassedNoEchoParameters(bag, parameters, sources) {
-	const names = /* @__PURE__ */ new Set();
-	if (sources !== void 0 && parameters !== null && typeof parameters === "object") {
-		for (const [name, value] of Object.entries(parameters)) if (readsNoEchoSource(value, sources)) names.add(name);
+		const expiry = lockInfo ? formatLockExpiry(lockInfo.expiresAt) : void 0;
+		const forceUnlockCommand = buildForceUnlockCommand(stackName, region);
+		const recovery = forceUnlockCommand ? `If you are certain no other process is active, run: ${forceUnlockCommand}` : `If you are certain no other process is active, ${UNREPRODUCIBLE_LOCK_CLAUSE.charAt(0).toLowerCase()}${UNREPRODUCIBLE_LOCK_CLAUSE.slice(1)}`;
+		const safeStack = safeSegment(stackName);
+		const safeRegion = safeSegment(region);
+		throw new LockError(`Failed to acquire lock for stack ${safeStack} (${safeRegion}) after ${attempts} attempt${attempts === 1 ? "" : "s"}. ` + (lockInfo ? `Locked by: ${formatLockOwner(lockInfo.owner)}${lockInfo.operation ? `, operation: ${formatLockOperation(lockInfo.operation)}` : ""}, ${expiry}. ` + recovery : `No lock could be read after the last failed attempt, so it was most likely released just now: re-run the command. If this repeats, lock.json may hold a body that is not a readable lock. ${recovery}`));
+	}
+};
+function nanIfUncoercible(value) {
+	try {
+		Number(value);
+		return value;
+	} catch {
+		return NaN;
 	}
-	if (names.size > 0) passedNoEchoParameters.set(bag, names);
-	else passedNoEchoParameters.delete(bag);
-}
-function passedNoEchoParametersOf(bag) {
-	return bag === void 0 ? void 0 : passedNoEchoParameters.get(bag);
 }
 
 //#endregion
@@ -21838,6 +17906,20 @@ function pinSecretVerdict(resolver, expression, secret, scope) {
 	if (resolver.producerRegionGuest) return;
 	pinScopedSecretVerdict(scope, expression, secret);
 }
+async function sameRegionExportEntry(resolver, context, exportName, entry) {
+	try {
+		const local = await context.stateBackend.getState(entry.producerStack, resolver.resolverRegion);
+		if (!local || !importableOutputKeys(local.state).includes(exportName)) return void 0;
+		return {
+			value: local.state.outputs[exportName],
+			producerStack: entry.producerStack,
+			producerRegion: resolver.resolverRegion
+		};
+	} catch (err) {
+		resolver.logger.debug(safeMsg`Same-region read for an exports index entry failed: ${displayMasked(resolver, describeAwsFailure(err).detail, context)}`);
+		return;
+	}
+}
 async function resolveImportValue(resolver, importValueArg, context) {
 	const sourceKey = crossStackSourceKey({ "Fn::ImportValue": importValueArg });
 	const exportName = await resolver.resolveValue(importValueArg, context);
@@ -21853,6 +17935,7 @@ async function resolveImportValue(resolver, importValueArg, context) {
 			resolver.logger.warn(`Exports index lookup failed for ${quotedRender(loggedExportName, "'", "an export whose name is not a plain identifier")}: ${displayMasked(resolver, describeAwsFailure(err).detail, context)}; falling back to state.json scan`);
 			entry = void 0;
 		}
+		if (entry && !sameRegion(entry.producerRegion, resolver.resolverRegion) && entry.producerStack !== context.stackName) entry = await sameRegionExportEntry(resolver, context, exportName, entry) ?? entry;
 		if (entry && (!context.stackName || entry.producerStack !== context.stackName)) {
 			recordImport(resolver, context, exportName, entry.producerStack, entry.producerRegion);
 			resolver.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from index: ${displayMasked(resolver, entry.producerStack, context)} / ${displayMasked(resolver, entry.producerRegion, context)}; ${carriesDynamicReference(entry.value) ? "redacted dynamic reference" : "literal value"})`);
@@ -21866,7 +17949,9 @@ async function resolveImportValue(resolver, importValueArg, context) {
 	const allStacks = await context.stateBackend.listStacks();
 	resolver.logger.debug(`Found ${allStacks.length} state record(s) to search for export: ${loggedExportName}`);
 	let found;
-	for (const ref of allStacks) {
+	const inThisRegion = (r) => r.region === void 0 || sameRegion(r.region, resolver.resolverRegion);
+	const scanOrder = [...allStacks.filter(inThisRegion), ...allStacks.filter((r) => !inThisRegion(r))];
+	for (const ref of scanOrder) {
 		const { stackName: refStack, region: refRegion } = ref;
 		if (context.stackName && refStack === context.stackName) {
 			resolver.logger.debug(`Skipping current stack: ${displayMasked(resolver, refStack, context)}`);
@@ -27428,7 +23513,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BpRcm_UB.js");
+			const { ASGProvider } = await import("./asg-provider-DCrwgSCZ.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -27460,7 +23545,7 @@ var CloudControlProvider = class {
 					client: ec2Client,
 					observedOn: await observeThenDisableInstanceApiTermination(ec2Client, physicalId, flip, this.logger)
 				};
-				else await this.observeThenDisableCcProtection(logicalId, physicalId, resourceType, protectionEntry, flip);
+				else await this.observeThenDisableCcProtection(logicalId, physicalId, resourceType, protectionEntry, flip, context?.maskSecrets);
 				try {
 					result = await this.deleteThroughCloudControl(logicalId, physicalId, resourceType, context, indeterminateGuard, flip, protectedEc2);
 				} catch (error) {
@@ -27534,7 +23619,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-CmKbYAvr.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DzTl6-74.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-ByCpdpUq.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DjVgEWGf.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -27647,12 +23732,13 @@ var CloudControlProvider = class {
 			return isWaitAbandonedError(error) || error instanceof CloudControlOperationFailedError && error.ccOperation === "UPDATE" && isAmbiguousCcHandlerErrorCode(error.ccErrorCode);
 		}
 	}
-	async observeThenDisableCcProtection(logicalId, physicalId, resourceType, entry, flip) {
+	async observeThenDisableCcProtection(logicalId, physicalId, resourceType, entry, flip, mask) {
 		try {
 			await observeThenDisableProtection({
 				flip,
 				logger: this.logger,
 				physicalId,
+				mask,
 				guardName: entry.property,
 				observe: async () => {
 					const model = await this.getResourceState(resourceType, physicalId);
@@ -36807,7 +32893,7 @@ function keepPersistedPlainLeaves(redacted, raw, persisted) {
 	return out ?? redacted;
 }
 function isPlainRecord$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value) && hasPlainPrototype$1(value);
+	return typeof value === "object" && value !== null && !Array.isArray(value) && hasPlainPrototype(value);
 }
 
 //#endregion
@@ -43073,7 +39159,8 @@ async function withResourceDeadline(operation, opts) {
 				}
 				outer?.resume();
 			},
-			expired: () => timedOut || (outer?.expired() ?? false)
+			expired: () => timedOut || (outer?.expired() ?? false),
+			remainingMs: () => Math.min(timedOut ? 0 : Math.max(0, opts.timeoutMs - elapsed()), outer?.remainingMs() ?? Number.POSITIVE_INFINITY)
 		};
 		Promise.resolve().then(() => deadlineScope.run(control, operation)).then((value) => {
 			if (settled) return;
@@ -43102,6 +39189,9 @@ async function whileEnclosingDeadlinesPaused(fn) {
 function enclosingDeadlineExpired() {
 	return deadlineScope.getStore()?.expired() ?? false;
 }
+function enclosingDeadlineRemainingMs() {
+	return deadlineScope.getStore()?.remainingMs() ?? Number.POSITIVE_INFINITY;
+}
 
 //#endregion
 //#region src/deployment/deployment-approval.ts
@@ -50452,5 +46542,5 @@ function sameGenerationClaimsOf(record) {
 }
 
 //#endregion
-export { resolvePendingCloudControlRequests as $, refuseMalformedOutputsForDestroy as $a, validateAssetBucketName as $c, carriesDynamicReference as $i, hasPlainPrototype$1 as $l, noEchoParameterNamesOf as $n, templateResourceTypes as $o, customResourceResponseExpirationWarning as $r, recordPhysicalNameCopy as $s, nameGenerationHighWaterOf as $t, inheritedProvenanceForChildDiff as A, malformedLocalResourcesWarning as Aa, importableOutputKeys as Ac, keepHeldTokenProvenance as Ai, resolveSkipPrefix as Al, destroyStackRecordsView as An, hasNoCloudControlHandlers as Ao, markDeleteStarted as Ar, logOnlyValueCount as As, removeProtectionTypeList as At, conditionFingerprint as B, malformedResourcePropertiesWarning as Ba, WorkGraph as Bc, AWS_CREDENTIAL_ENV_KEYS as Bi, findLargeInlineResources as Bl, addSuperseded as Bn, toCfnInteger as Bo, CC_BROKEN_REASON as Br, scrubResourceRecord as Bs, resolveReplacementOldType as Bt, hasCdkAutoDeleteTag as C, isReadableOrphanRecord as Ca, splitImportedOps as Cc, s3BucketDomainName as Ci, synthesisStatusMessage as Cl, DEFAULT_RESOURCE_TIMEOUT_MS as Cn, unreadableResourceEntries as Co, reserveStackCreateToken as Cr, redactForState as Cs, formatResourceLine as Ct, IMPLICIT_DELETE_DEPENDENCIES as D, malformedExportSourceWarning as Da, hasReadableExportSet as Dc, resolveDynamicReferences as Di, resolveApp as Dl, findDestructiveChanges as Dn, unwrittenCreateOnlyReplacement as Do, DeploymentEventsStore as Dr, createUnionSecretMasker as Ds, withApiLimit as Dt, markRefusedBeforeApplying as E, malformedExportNamesWarning as Ea, exportNamesCarriedFrom as Ec, s3BucketWebsiteUrl as Ei, loadCdkJson as El, constructPathOf as En, findSilentDropProperties as Eo, DeploymentEventsReader as Er, carryLogOnlyValues as Es, lookupEachName as Et, findNestedTemplateTreeDefect as F, malformedOrphansWarning as Fa, shouldRetainResource as Fc, assertFlagRoleArn as Fi, warnDeprecatedNoPrefixCliFlag as Fl, cyan as Fn, isStatefulRecreateTargetSync as Fo, refuseMalformedDesiredTags as Fr, unionOfSecretBags as Fs, planFailedOps as Ft, diffSecurity as G, refuseDivergentRecordRegionForDestroy as Ga, AssetModeResolver as Gc, classifyReplaySecretRegion as Gi, PARTITION_TABLE as Gl, supersededAfterRollback as Gn, configIntegerRefusal as Go, waitForLambdaFunctionActive as Gr, isUncertifiedBaselineMaskPosition as Gs, inheritProducerRegions as Gt, parentSuppliedValues as H, malformedScrubResourceEntriesRefusalMessage as Ha, createAssetRedirectResolver as Hc, callerEnvCredentials as Hi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Hl, holdsSupersededResources as Hn, coerceCfnBoolean as Ho, ccBrokenReason as Hr, withoutPhysicalNameCopies as Hs, orphanNeedsIdentity as Ht, isAbsoluteAssetPath as I, malformedOutputsRefusalMessage as Ia, stackInstanceIdCarriedFrom as Ic, assertSendableRoleArn as Ii, ssmResolvedValueType as Il, gray as In, renderStatefulReason as Io, tagMapAsList as Ir, createSecretMasker as Is, planRollback as It, mergeNoChangeOutputs as J, refuseMalformedOrphanRecordsForDestroy as Ja, ensureAssetStorage as Jc, coerceParameterTypedValue as Ji, AssemblyReader as Jl, supersededResourcesOf as Jn, replayWarn as Jo, isCustomResourceType as Jr, inheritNestedStackParameterAssociations as Js, redactedDeleteAddressFields as Jt, isSecretBearingReferenceString as K, refuseMalformedNestedChildOutputs as Ka, BOOTSTRAP_MARKER_PREFIX as Kc, producerRegionsFromState as Ki, canonicalizeRegion as Kl, supersededHeldByOtherTypeWarning as Kn, configStringRefusal as Ko, TemplateNoEchoReresolver as Kr, pathCrossesDottedKey as Ks, REDACTED_DELETE_ADDRESS_SKIP_REASON as Kt, listNestedTemplateRows as L, malformedOutputsWarning as La, AssetPublisher as Lc, explicitRoleArnOrThrow as Li, CFN_TEMPLATE_BODY_LIMIT as Ll, green as Ln, WARM_THROUGHPUT_MEMBERS as Lo, tagPlanWarning as Lr, errorCauseChain as Ls, recheckFailedPlan as Lt, findServiceTokenRefusals as M, malformedOrphanRecordsWarning as Ma, isReadableBag as Mc, recordedOutputReferenceRegions as Mi, resolveStateBucketWithDefaultAndSource as Ml, withStackRecords as Mn, shownType as Mo, DBPROXY_TAG_OPTIONS as Mr, recordLogOnlyParameterValue as Ms, demoteSupersededOrphans as Mt, serviceTokenBlockingReason as N, malformedOrphanRowsKeptWarning as Na, orphansAfterRollback as Nc, recordedReferenceRegions as Ni, resolveUseCdkBootstrapAssets as Nl, replacedDeleteFailureVerdict as Nn, MULTI_REGION_RECREATE_BLOCKED_TYPES as No, planTagDiff as Nr, recordLogOnlyValue as Ns, isJournaledOrphan as Nt, computeImplicitDeleteEdges as O, malformedLocalOutputsWarning as Oa, hasReasonlessBaselineRefusal as Oc, producerLookupOver as Oi, resolveAutoAssetStorage as Ol, formatDestructiveChange as On, withoutSilentDropProperties as Oo, extractDeploymentEventError as Or, hasMaskableValues as Os, replayFailedOperations as Ot, childTemplateLoader as P, malformedOrphansRefusalMessage as Pa, orphansCarriedFrom as Pc, applyRoleArnIfSet as Pi, stateBucketExistenceConfirmed as Pl, bold as Pn, isStatefulRecreateTargetForReplace as Po, readTagList as Pr, shareLogOnlyValues as Ps, isReplacementOrphan as Pt, pendingRequestCount as Q, refuseMalformedOutputs as Qa, readBootstrapMarkerBody as Qc, isImpossibleEmptyStoredAttribute as Qi, hasOwnKey as Ql, noEchoExactEchoLeavesOf as Qn, prefetchCreateOnlyPropertyPaths as Qo, applyCustomResourceResponseExpiration as Qr, recordAttributeIdCopy as Qs, nameGenerationCarriedFrom as Qt, renderNestedTemplateTreeDefect as R, malformedRenderedContainersWarning as Ra, isSensitiveAttributeName as Rc, isIamRoleArn as Ri, CFN_TEMPLATE_URL_LIMIT as Rl, red as Rn, coerceWarmThroughput as Ro, definedAttributes as Rr, maskSecretsInError as Rs, recordUnderIdIsNotOwn as Rt, S3_AUTO_DELETE_OBJECTS_TAG as S, hasReadableResources as Sa, withStackInstanceIdWithheld as Sc, s3BucketArn as Si, Synthesizer as Sl, bindingSkippedOutputs as Sn, unreadableOrphanRecords as So, ledgerForStack as Sr, markSameGenerationBag as Ss, sameJournaledOrphans as St, getPriorAttempts as T, malformedDriftResourcePropertiesWarning as Ta, describeRegionValueKind as Tc, s3BucketRegionalDomainName as Ti, getLegacyStateBucketName as Tl, maskingRetryLogger as Tn, findActionableSilentDrops as To, acquireIdempotencyToken as Tr, snapshotPassProvenance as Ts, isAccessDeniedError as Tt, readRecordedConditionVerdicts as U, malformedStateRefusalMessage as Ua, loadPublishableAssetManifest as Uc, envCredentialsAreAssumedRole as Ui, decodeListingKey as Ul, isSupersededResourceRecord as Un, coerceCfnInteger as Uo, isCustomResource as Ur, DYNAMIC_REFERENCE_TOKEN_SCAN as Us, findNestedStackTypeChanges as Ut, conditionInputsFrom as V, malformedResourcesWarning as Va, buildAssetRedirectMap as Vc, applyCallerIdentityCredentials as Vi, uploadCfnTemplate as Vl, deleteSupersededEntry as Vn, toFiniteNumber as Vo, ProviderRegistry as Vr, withPhysicalNameCopies as Vs, seedsDeleteFirstGuard as Vt, withResourceDeadline as W, previewableOrphanRecords as Wa, rewriteTemplateAssetReferences as Wc, classifyRecordedSecretRegion as Wi, expectedOwnerParam as Wl, removeSuperseded as Wn, configBooleanRefusal as Wo, wouldReturnToSdkProvider as Wr, dynamicReferenceTokens as Ws, getCurrentProducerRegions as Wt, makeSiblingClaimReader as X, refuseMalformedOrphansForDestroy as Xa, isCrossRegionRedirect as Xc, parameterTypeMayLoseSecretIdentity as Xi, processStackMessages as Xl, noEchoAttributeNamesOf as Xn, requireConfigObject as Xo, withPrintingSecrets as Xr, recoverMaskedOutput as Xs, updatePartialMessage as Xt, makeCanonicalizePropertiesFn as Y, refuseMalformedOrphans as Ya, getBootstrapMarkerKey as Yc, isUnboundTemplateParameter as Yi, StageLoadError as Yl, withoutSuperseded as Yn, requireConfigArray as Yo, getCurrentResourceSecrets as Yr, recordNestedStackParameterExpressions as Ys, redactedDeleteAddressSkip as Yt, planOrphanAdoption as Z, refuseMalformedOrphansForOrphan as Za, parseBootstrapMarker as Zc, getAccountInfo as Zi, defineOwnKey as Zl, noEchoComparisonForTemplate as Zn, requireConfigString as Zo, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Zr, physicalNameCopiesOf as Zs, updatePartialReason as Zt, deleteTableWithIndexBusyRetry as _, accountArgs as _a, applyCrossPrefixScan as _c, DiffCalculator as _i, runDockerForeground as _l, isWholeDynamicReferenceValue as _n, repairMalformedOutputsForReadOnly as _o, effectiveDeletionPolicy as _r, readbackPathFor as _s, dropFailedHint as _t, isProtectionValueActive as a, isStalePlaceholderArnAttribute as aa, recordNoEchoAttributeValues as ac, deleteIndeterminateGuards as ai, describeDockerExecFailure as al, namesAnyDeclaredParameter as an, refuseMalformedResourceEntriesForImportSave as ao, orphanRecordsPrintingBag as ar, DagBuilder as as, dropSettledNestedJournals as at, renderAssemblyPathEscape as au, waitForIndexesSettled as b, hasReadableOrphans as ba, isNotImplemented as bc, poisonRenderedSpellingsCollidingIn as bi, AssetManifestLoader as bl, collectPublishedOutputNames as bn, repairMalformedResourcesForReadOnly as bo, unsupportedFinalSnapshotError as br, valueAtCoordinate as bs, loadJournaledOrphans as bt, DynamoDBGlobalTableProvider as c, withSharedDrainBudget as ca, wholeStringLeavesOf as cc, withIndeterminateGuard as ci, finchSecretArgvRefusal as cl, WITHHELD_NAME_DISPLAY as cn, refuseMalformedResourcePropertiesForDrift as co, secretNamedAttributeNamesOf as cr, isMarkedCoordinate as cs, recordDisplacedSkips as ct, injectedAwsRegionValue as cu, compensateRemovedDeletionProtection as d, declaresNoEcho as da, LockManager as dc, disableInstanceApiTermination as di, isDockerClientEnvKey as dl, secretBearing as dn, refuseMalformedResourcesForDeploy as do, storedSecretNameNeedles as dr, maskWholeValue as ds, withNestedRevertRun as dt, carriesFetchableDynamicReference as ea, splitGetAttStringForm as ec, CloudControlProvider as ei, validateContainerRepoName as el, nameScopeOf as en, refuseMalformedResourceAttributesForOrphan as eo, createReadOnlyAttributeHealerFactory as er, describeTypeWithThrottleRetry as es, keptForRetainedRecord as et, nullPrototypeRecord as eu, deleteBudgetKey as f, JSON_LISTING_HOLE_VALUE as fa, isLockInfoExpired as fc, ec2InstanceProtectionSite as fi, isMalformedEnvKey as fl, secretBearingStateKeyWarning as fn, refuseMalformedResourcesForDestroy as fo, ATOMIC_FINAL_SNAPSHOT_TYPES as fr, maskedLeafCoordinatesOf as fs, collectNestedChildUnaddressed as ft, INDEX_SETTLE_POLL_INTERVAL_MS as g, UNREADABLE_RESOURCES_MAP_ROW as ga, CrossPrefixScanCache as gc, reEnableInstanceApiTermination as gi, redactedDockerCause as gl, exportNameSecretExposure as gn, repairMalformedOrphansForReadOnly as go, createPreDeleteFinalSnapshot as gr, passedNoEchoParametersOf as gs, dropFailedCommands as gt, DELETE_INDEX_WAIT_PROCEED_NOTE as h, UNREADABLE_ORPHANS_CONTAINER_ROW as ha, CrossPrefixReadError as hc, reDisableInstanceApiTermination as hi, redactedCause as hl, exportNameNoEchoParameters as hn, repairMalformedOrphanRecordsForReadOnly as ho, ccRoutedFinalSnapshotError as hr, noEchoOutputsComparison as hs, deleteJournaledOrphans as ht, PROTECTION_PROPERTY_BY_TYPE as i, cfnRefValueFromPhysicalId as ia, recordMaskOnlyValuesIn as ic, UNSPECIFIED_SKIP_REASON as ii, describeDockerCapturedOutput as il, computeParameterTaint as in, refuseMalformedResourceEntriesForImport as io, namingSecretsWithRecordedNoEcho as ir, sameLambdaFunctionAddress as is, displacedPhysicalIdShown as it, displayAssemblyPath as iu, deferredServiceTokenWarning as j, malformedOrphanRecordsRefusalMessage as ja, importableOutputs as jc, outputReferenceProvenanceOf as ji, resolveStateBucketWithDefault as jl, getStackRecords as jn, findReplacedReadersOfRecreateTargets as jo, DBPROXY_TAGS_WHAT as jr, printingCorpusOf as js, recordAfterRollbackUpdate as jt, crossStackOutputProvenanceSource as k, malformedLocalResourceEntriesWarning as ka, hasUnverifiableParameterRefusal as kc, refuseUnreadableCdkCrossAccountRefs as ki, resolveCaptureObservedState as kl, awaitInFlightSibling as kn, NO_CC_HANDLERS_REASON as ko, isRefusedByName as kr, literalSplitDelimitersOf as ks, replayRollback as kt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, parameterInputsFor as la, WHOLE_DYNAMIC_REFERENCE_PATTERN as lc, isWaitAbandonedError as li, formatDockerLoginError as ll, displayTextOrWithheld as ln, refuseMalformedResourcePropertiesForExport as lo, secretNamedRecordNeedles as lr, maskAtCoordinates as ls, revertNestedChildFromJournal as lt, clearBucketRegionCache as lu, resolveDynamoDbDeleteBudgetMs as m, STATE_RESOURCES_MALFORMED as ma, rebuildClientForBucketRegion as mc, observeThenDisableInstanceApiTermination as mi, redactDockerArgvValues as ml, carriedExportAliasExposure as mn, refuseMalformedState as mo, buildFinalSnapshotIdentifier as mr, noEchoLeavesOf as ms, withNestedStackContext as mt, recordedProtectionEvidence as n, keepsSecretReferenceToken as na, provenPublicValue as nc, unchangedBehindSecretReference as ni, buildDockerImage as nl, retiredNameGenerationsAfter as nn, refuseMalformedResourceEntriesForDeploy as no, journaledOrphanPrintingBag as nr, canonicalLambdaFunctionName as ns, NESTED_PENDING_PARENT_REASON as nt, absoluteAssemblyPathEscape as nu, perType as o, refStateLookupFromResource as oa, recordNoEchoParameterFreshValue as oc, deleteLeftInPlace as oi, describeDockerFailure as ol, reachableDivergentParameters as on, refuseMalformedResourceEntriesForOrphan as oo, secretNamePrintingBag as or, TemplateParser as os, getNestedRevertRun as ot, resolveAssemblyPath as ou, resolveDynamoDbDeleteBudgetClock as p, STATE_REGION_DIVERGED as pa, S3StateBackend as pc, isTerminationProtectionPropagationError as pi, partitionSensitiveEnv as pl, secretSafeKeyDisplay as pn, refuseMalformedResourcesForExport as po, PRE_DELETE_SNAPSHOT_TYPES as pr, noEchoCoordinatesOf as ps, getCurrentNestedStackContext as pt, keptWholeReasonText as q, refuseMalformedOrphanRecords as qa, assertAssetBucketRegion as qc, regionLessSecretName as qi, derivePartitionAndUrlSuffix as ql, supersededHolderOf as qn, readConfigString as qo, readsNoEchoDeleteValues as qr, identityKeyFor as qs, isRedactedRecordedValue as qt, recordedProtectionNote as r, AWS_NO_VALUE as ra, recordMaskOnlyValue as rc, RollbackInlinePolicyWriters as ri, resolveDockerContextDirectory as rl, retiredNameGenerationsLeaving as rn, refuseMalformedResourceEntriesForDestroy as ro, maskEventTextWithBoundBags as rr, lambdaFunctionNameForMask as rs, displacedOpClause as rt, describeFileReadFailure as ru, readProtection as s, parseWebACLArn as sa, recordProvenPublicExpression as sc, deleteSkipReason as si, dockerSpawnEnvWithSensitive as sl, resourcesNamingDeclaredParameter as sn, refuseMalformedResourcePropertiesForDestroy as so, secretNamePrintingBags as sr, canonicalCoordinates as ss, nestedChildStackName as st, injectAwsRegion as su, DeployEngine as t, isNamelessDynamicReferenceError as ta, carriesSecretMask as tc, slowCcOperationTimeoutMs as ti, buildDenyExternalAccessPolicy as tl, retiredAfterRollback as tn, refuseMalformedResourceEntries as to, completedReplayEntries as tr, withRetry as ts, recordRetainedForReadoption as tt, ownValue as tu, beginDeleteWait as u, passedParameterClassesOf as ua, isSingleDynamicReferenceToken as uc, markWaitAbandoned as ui, getDockerCmd as ul, exportAliasCollisionScrubWarning as un, refuseMalformedResourcePropertiesForOrphan as uo, stateSecretNameNeedles as ur, maskReadbackAtCoordinates as us, revertedNestedRowIds as ut, resolveBucketRegion as uu, maskedLogger as v, deployRefusesOrphanRowsReason as va, crossPrefixDeniedWarning as vc, INTRINSIC_KEYS as vi, runDockerStreaming as vl, noEchoParameterValueSeed as vn, repairMalformedResourceEntriesForReadOnly as vo, isFinalSnapshotError as vr, readsNoEchoSource as vs, isHandledOrphan as vt, isTruthyCfnBoolean as w, isReadableResourceEntry as wa, acceptedCreateOnlyDropsOf as wc, s3BucketDualStackDomainName as wi, getDefaultStateBucketName as wl, DEFAULT_RESOURCE_WARN_AFTER_MS as wn, withheldAccountClause as wo, withCreateTokenLedger as wr, recordReferenceProvenanceEntry as ws, chunks as wt, ECR_AUTO_DELETE_IMAGES_TAG as x, hasReadableOutputs as xa, stackInstanceIdOf as xc, isSettledInstanceState as xi, getDockerImageBySourceHash as xl, isExportAliasCollision as xn, unpreviewableOrphanRecords as xo, earliestDefined as xr, liveMatchesUnresolvedTokenFrame as xs, makeForeignHolderScan as xt, relayedIndexBusyDelete as y, displayLogicalId as ya, isAccessDenied$1 as yc, IntrinsicFunctionResolver as yi, warnFinchArgvExposure as yl, collectDeclaredOutputNames as yn, repairMalformedResourcePropertiesForReadOnly as yo, refusesFinalSnapshot as yr, recordedNoEchoValuesOf as ys, journaledOrphanLines as yt, templateIdentity as z, malformedResourceEntriesWarning as za, stringifyValue as zc, sendableAssumeRoleCommand as zi, MIGRATE_TMP_PREFIX as zl, yellow as zn, isWarmThroughputDecrease as zo, stringifyIfAssigned as zr, maskSecretsInText as zs, replacementNeverSwapped as zt };
-//# sourceMappingURL=deploy-engine-CYVt2NQR.js.map
+export { pendingRequestCount as $, refuseMalformedOutputs as $a, absoluteAssemblyPathEscape as $c, isImpossibleEmptyStoredAttribute as $i, noEchoExactEchoLeavesOf as $n, prefetchCreateOnlyPropertyPaths as $o, applyCustomResourceResponseExpiration as $r, buildDockerImage as $s, nameGenerationCarriedFrom as $t, inheritedProvenanceForChildDiff as A, malformedLocalResourceEntriesWarning as Aa, resolveUseCdkBootstrapAssets as Ac, refuseUnreadableCdkCrossAccountRefs as Ai, awaitInFlightSibling as An, NO_CC_HANDLERS_REASON as Ao, isRefusedByName as Ar, orphansAfterRollback as As, replayRollback as At, conditionFingerprint as B, malformedResourceEntriesWarning as Ba, decodeListingKey as Bc, sendableAssumeRoleCommand as Bi, yellow as Bn, isWarmThroughputDecrease as Bo, stringifyIfAssigned as Br, loadPublishableAssetManifest as Bs, replacementNeverSwapped as Bt, hasCdkAutoDeleteTag as C, hasReadableResources as Ca, loadCdkJson as Cc, s3BucketArn as Ci, bindingSkippedOutputs as Cn, unreadableOrphanRecords as Co, ledgerForStack as Cr, exportNamesCarriedFrom as Cs, sameJournaledOrphans as Ct, IMPLICIT_DELETE_DEPENDENCIES as D, malformedExportNamesWarning as Da, resolveSkipPrefix as Dc, s3BucketWebsiteUrl as Di, constructPathOf as Dn, findSilentDropProperties as Do, DeploymentEventsReader as Dr, importableOutputKeys as Ds, lookupEachName as Dt, markRefusedBeforeApplying as E, malformedDriftResourcePropertiesWarning as Ea, resolveCaptureObservedState as Ec, s3BucketRegionalDomainName as Ei, maskingRetryLogger as En, findActionableSilentDrops as Eo, acquireIdempotencyToken as Er, hasUnverifiableParameterRefusal as Es, isAccessDeniedError as Et, findNestedTemplateTreeDefect as F, malformedOrphansRefusalMessage as Fa, CFN_TEMPLATE_URL_LIMIT as Fc, applyRoleArnIfSet as Fi, bold as Fn, isStatefulRecreateTargetForReplace as Fo, readTagList as Fr, isSensitiveAttributeName as Fs, isReplacementOrphan as Ft, withResourceDeadline as G, previewableOrphanRecords as Ga, AssemblyReader as Gc, classifyRecordedSecretRegion as Gi, removeSuperseded as Gn, configBooleanRefusal as Go, wouldReturnToSdkProvider as Gr, ensureAssetStorage as Gs, getCurrentProducerRegions as Gt, parentSuppliedValues as H, malformedResourcesWarning as Ha, PARTITION_TABLE as Hc, applyCallerIdentityCredentials as Hi, deleteSupersededEntry as Hn, toFiniteNumber as Ho, ProviderRegistry as Hr, AssetModeResolver as Hs, seedsDeleteFirstGuard as Ht, isAbsoluteAssetPath as I, malformedOrphansWarning as Ia, MIGRATE_TMP_PREFIX as Ic, assertFlagRoleArn as Ii, cyan as In, isStatefulRecreateTargetSync as Io, refuseMalformedDesiredTags as Ir, stringifyValue as Is, planFailedOps as It, keptWholeReasonText as J, refuseMalformedOrphanRecords as Ja, defineOwnKey as Jc, regionLessSecretName as Ji, supersededHolderOf as Jn, readConfigString as Jo, readsNoEchoDeleteValues as Jr, parseBootstrapMarker as Js, isRedactedRecordedValue as Jt, diffSecurity as K, refuseDivergentRecordRegionForDestroy as Ka, StageLoadError as Kc, classifyReplaySecretRegion as Ki, supersededAfterRollback as Kn, configIntegerRefusal as Ko, waitForLambdaFunctionActive as Kr, getBootstrapMarkerKey as Ks, inheritProducerRegions as Kt, listNestedTemplateRows as L, malformedOutputsRefusalMessage as La, findLargeInlineResources as Lc, assertSendableRoleArn as Li, gray as Ln, renderStatefulReason as Lo, tagMapAsList as Lr, WorkGraph as Ls, planRollback as Lt, findServiceTokenRefusals as M, malformedOrphanRecordsRefusalMessage as Ma, warnDeprecatedNoPrefixCliFlag as Mc, outputReferenceProvenanceOf as Mi, getStackRecords as Mn, findReplacedReadersOfRecreateTargets as Mo, DBPROXY_TAGS_WHAT as Mr, shouldRetainResource as Ms, recordAfterRollbackUpdate as Mt, serviceTokenBlockingReason as N, malformedOrphanRecordsWarning as Na, ssmResolvedValueType as Nc, recordedOutputReferenceRegions as Ni, withStackRecords as Nn, shownType as No, DBPROXY_TAG_OPTIONS as Nr, stackInstanceIdCarriedFrom as Ns, demoteSupersededOrphans as Nt, computeImplicitDeleteEdges as O, malformedExportSourceWarning as Oa, resolveStateBucketWithDefault as Oc, resolveDynamicReferences as Oi, findDestructiveChanges as On, unwrittenCreateOnlyReplacement as Oo, DeploymentEventsStore as Or, importableOutputs as Os, withApiLimit as Ot, childTemplateLoader as P, malformedOrphanRowsKeptWarning as Pa, CFN_TEMPLATE_BODY_LIMIT as Pc, recordedReferenceRegions as Pi, replacedDeleteFailureVerdict as Pn, MULTI_REGION_RECREATE_BLOCKED_TYPES as Po, planTagDiff as Pr, AssetPublisher as Ps, isJournaledOrphan as Pt, planOrphanAdoption as Q, refuseMalformedOrphansForOrphan as Qa, ownValue as Qc, getAccountInfo as Qi, noEchoComparisonForTemplate as Qn, requireConfigString as Qo, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Qr, buildDenyExternalAccessPolicy as Qs, updatePartialReason as Qt, renderNestedTemplateTreeDefect as R, malformedOutputsWarning as Ra, uploadCfnTemplate as Rc, explicitRoleArnOrThrow as Ri, green as Rn, WARM_THROUGHPUT_MEMBERS as Ro, tagPlanWarning as Rr, buildAssetRedirectMap as Rs, recheckFailedPlan as Rt, S3_AUTO_DELETE_OBJECTS_TAG as S, hasReadableOutputs as Sa, getLegacyStateBucketName as Sc, isSettledInstanceState as Si, isExportAliasCollision as Sn, unpreviewableOrphanRecords as So, earliestDefined as Sr, describeRegionValueKind as Ss, makeForeignHolderScan as St, getPriorAttempts as T, isReadableResourceEntry as Ta, resolveAutoAssetStorage as Tc, s3BucketDualStackDomainName as Ti, DEFAULT_RESOURCE_WARN_AFTER_MS as Tn, withheldAccountClause as To, withCreateTokenLedger as Tr, hasReasonlessBaselineRefusal as Ts, chunks as Tt, readRecordedConditionVerdicts as U, malformedScrubResourceEntriesRefusalMessage as Ua, canonicalizeRegion as Uc, callerEnvCredentials as Ui, holdsSupersededResources as Un, coerceCfnBoolean as Uo, ccBrokenReason as Ur, BOOTSTRAP_MARKER_PREFIX as Us, orphanNeedsIdentity as Ut, conditionInputsFrom as V, malformedResourcePropertiesWarning as Va, expectedOwnerParam as Vc, AWS_CREDENTIAL_ENV_KEYS as Vi, addSuperseded as Vn, toCfnInteger as Vo, CC_BROKEN_REASON as Vr, rewriteTemplateAssetReferences as Vs, resolveReplacementOldType as Vt, enclosingDeadlineRemainingMs as W, malformedStateRefusalMessage as Wa, derivePartitionAndUrlSuffix as Wc, envCredentialsAreAssumedRole as Wi, isSupersededResourceRecord as Wn, coerceCfnInteger as Wo, isCustomResource as Wr, assertAssetBucketRegion as Ws, findNestedStackTypeChanges as Wt, makeCanonicalizePropertiesFn as X, refuseMalformedOrphans as Xa, hasPlainPrototype as Xc, isUnboundTemplateParameter as Xi, withoutSuperseded as Xn, requireConfigArray as Xo, getCurrentResourceSecrets as Xr, validateAssetBucketName as Xs, redactedDeleteAddressSkip as Xt, mergeNoChangeOutputs as Y, refuseMalformedOrphanRecordsForDestroy as Ya, hasOwnKey as Yc, coerceParameterTypedValue as Yi, supersededResourcesOf as Yn, replayWarn as Yo, isCustomResourceType as Yr, readBootstrapMarkerBody as Ys, redactedDeleteAddressFields as Yt, makeSiblingClaimReader as Z, refuseMalformedOrphansForDestroy as Za, nullPrototypeRecord as Zc, parameterTypeMayLoseSecretIdentity as Zi, noEchoAttributeNamesOf as Zn, requireConfigObject as Zo, withPrintingSecrets as Zr, validateContainerRepoName as Zs, updatePartialMessage as Zt, deleteTableWithIndexBusyRetry as _, UNREADABLE_RESOURCES_MAP_ROW as _a, AssetManifestLoader as _c, reEnableInstanceApiTermination as _i, exportNameSecretExposure as _n, repairMalformedOrphansForReadOnly as _o, createPreDeleteFinalSnapshot as _r, isNotImplemented as _s, dropFailedCommands as _t, isProtectionValueActive as a, cfnRefValueFromPhysicalId as aa, finchSecretArgvRefusal as ac, UNSPECIFIED_SKIP_REASON as ai, injectedAwsRegionValue as al, computeParameterTaint as an, refuseMalformedResourceEntriesForImport as ao, namingSecretsWithRecordedNoEcho as ar, sameLambdaFunctionAddress as as, displacedPhysicalIdShown as at, waitForIndexesSettled as b, displayLogicalId as ba, synthesisStatusMessage as bc, IntrinsicFunctionResolver as bi, collectDeclaredOutputNames as bn, repairMalformedResourcePropertiesForReadOnly as bo, refusesFinalSnapshot as br, splitImportedOps as bs, journaledOrphanLines as bt, DynamoDBGlobalTableProvider as c, parseWebACLArn as ca, isDockerClientEnvKey as cc, deleteSkipReason as ci, resourcesNamingDeclaredParameter as cn, refuseMalformedResourcePropertiesForDestroy as co, secretNamePrintingBags as cr, LockManager as cs, nestedChildStackName as ct, compensateRemovedDeletionProtection as d, passedParameterClassesOf as da, redactDockerArgvValues as dc, markWaitAbandoned as di, exportAliasCollisionScrubWarning as dn, refuseMalformedResourcePropertiesForOrphan as do, stateSecretNameNeedles as dr, rebuildClientForBucketRegion as ds, revertedNestedRowIds as dt, carriesDynamicReference as ea, resolveDockerContextDirectory as ec, customResourceResponseExpirationWarning as ei, describeFileReadFailure as el, nameGenerationHighWaterOf as en, refuseMalformedOutputsForDestroy as eo, noEchoParameterNamesOf as er, templateResourceTypes as es, resolvePendingCloudControlRequests as et, deleteBudgetKey as f, declaresNoEcho as fa, redactedCause as fc, disableInstanceApiTermination as fi, secretBearing as fn, refuseMalformedResourcesForDeploy as fo, storedSecretNameNeedles as fr, CrossPrefixReadError as fs, withNestedRevertRun as ft, INDEX_SETTLE_POLL_INTERVAL_MS as g, UNREADABLE_ORPHANS_CONTAINER_ROW as ga, warnFinchArgvExposure as gc, reDisableInstanceApiTermination as gi, exportNameNoEchoParameters as gn, repairMalformedOrphanRecordsForReadOnly as go, ccRoutedFinalSnapshotError as gr, isAccessDenied$1 as gs, deleteJournaledOrphans as gt, DELETE_INDEX_WAIT_PROCEED_NOTE as h, STATE_RESOURCES_MALFORMED as ha, runDockerStreaming as hc, observeThenDisableInstanceApiTermination as hi, carriedExportAliasExposure as hn, refuseMalformedState as ho, buildFinalSnapshotIdentifier as hr, crossPrefixDeniedWarning as hs, withNestedStackContext as ht, PROTECTION_PROPERTY_BY_TYPE as i, AWS_NO_VALUE as ia, dockerSpawnEnvWithSensitive as ic, RollbackInlinePolicyWriters as ii, injectAwsRegion as il, retiredNameGenerationsLeaving as in, refuseMalformedResourceEntriesForDestroy as io, maskEventTextWithBoundBags as ir, lambdaFunctionNameForMask as is, displacedOpClause as it, deferredServiceTokenWarning as j, malformedLocalResourcesWarning as ja, stateBucketExistenceConfirmed as jc, keepHeldTokenProvenance as ji, destroyStackRecordsView as jn, hasNoCloudControlHandlers as jo, markDeleteStarted as jr, orphansCarriedFrom as js, removeProtectionTypeList as jt, crossStackOutputProvenanceSource as k, malformedLocalOutputsWarning as ka, resolveStateBucketWithDefaultAndSource as kc, producerLookupOver as ki, formatDestructiveChange as kn, withoutSilentDropProperties as ko, extractDeploymentEventError as kr, isReadableBag as ks, replayFailedOperations as kt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, withSharedDrainBudget as la, isMalformedEnvKey as lc, withIndeterminateGuard as li, WITHHELD_NAME_DISPLAY as ln, refuseMalformedResourcePropertiesForDrift as lo, secretNamedAttributeNamesOf as lr, isLockInfoExpired as ls, recordDisplacedSkips as lt, resolveDynamoDbDeleteBudgetMs as m, STATE_REGION_DIVERGED as ma, runDockerForeground as mc, isTerminationProtectionPropagationError as mi, secretSafeKeyDisplay as mn, refuseMalformedResourcesForExport as mo, PRE_DELETE_SNAPSHOT_TYPES as mr, applyCrossPrefixScan as ms, getCurrentNestedStackContext as mt, recordedProtectionEvidence as n, isNamelessDynamicReferenceError as na, describeDockerExecFailure as nc, slowCcOperationTimeoutMs as ni, renderAssemblyPathEscape as nl, retiredAfterRollback as nn, refuseMalformedResourceEntries as no, completedReplayEntries as nr, withRetry as ns, recordRetainedForReadoption as nt, perType as o, isStalePlaceholderArnAttribute as oa, formatDockerLoginError as oc, deleteIndeterminateGuards as oi, clearBucketRegionCache as ol, namesAnyDeclaredParameter as on, refuseMalformedResourceEntriesForImportSave as oo, orphanRecordsPrintingBag as or, DagBuilder as os, dropSettledNestedJournals as ot, resolveDynamoDbDeleteBudgetClock as p, JSON_LISTING_HOLE_VALUE as pa, redactedDockerCause as pc, ec2InstanceProtectionSite as pi, secretBearingStateKeyWarning as pn, refuseMalformedResourcesForDestroy as po, ATOMIC_FINAL_SNAPSHOT_TYPES as pr, CrossPrefixScanCache as ps, collectNestedChildUnaddressed as pt, isSecretBearingReferenceString as q, refuseMalformedNestedChildOutputs as qa, processStackMessages as qc, producerRegionsFromState as qi, supersededHeldByOtherTypeWarning as qn, configStringRefusal as qo, TemplateNoEchoReresolver as qr, isCrossRegionRedirect as qs, REDACTED_DELETE_ADDRESS_SKIP_REASON as qt, recordedProtectionNote as r, keepsSecretReferenceToken as ra, describeDockerFailure as rc, unchangedBehindSecretReference as ri, resolveAssemblyPath as rl, retiredNameGenerationsAfter as rn, refuseMalformedResourceEntriesForDeploy as ro, journaledOrphanPrintingBag as rr, canonicalLambdaFunctionName as rs, NESTED_PENDING_PARENT_REASON as rt, readProtection as s, refStateLookupFromResource as sa, getDockerCmd as sc, deleteLeftInPlace as si, resolveBucketRegion as sl, reachableDivergentParameters as sn, refuseMalformedResourceEntriesForOrphan as so, secretNamePrintingBag as sr, TemplateParser as ss, getNestedRevertRun as st, DeployEngine as t, carriesFetchableDynamicReference as ta, describeDockerCapturedOutput as tc, CloudControlProvider as ti, displayAssemblyPath as tl, nameScopeOf as tn, refuseMalformedResourceAttributesForOrphan as to, createReadOnlyAttributeHealerFactory as tr, describeTypeWithThrottleRetry as ts, keptForRetainedRecord as tt, beginDeleteWait as u, parameterInputsFor as ua, partitionSensitiveEnv as uc, isWaitAbandonedError as ui, displayTextOrWithheld as un, refuseMalformedResourcePropertiesForExport as uo, secretNamedRecordNeedles as ur, S3StateBackend as us, revertNestedChildFromJournal as ut, maskedLogger as v, accountArgs as va, getDockerImageBySourceHash as vc, DiffCalculator as vi, isWholeDynamicReferenceValue as vn, repairMalformedOutputsForReadOnly as vo, effectiveDeletionPolicy as vr, stackInstanceIdOf as vs, dropFailedHint as vt, isTruthyCfnBoolean as w, isReadableOrphanRecord as wa, resolveApp as wc, s3BucketDomainName as wi, DEFAULT_RESOURCE_TIMEOUT_MS as wn, unreadableResourceEntries as wo, reserveStackCreateToken as wr, hasReadableExportSet as ws, formatResourceLine as wt, ECR_AUTO_DELETE_IMAGES_TAG as x, hasReadableOrphans as xa, getDefaultStateBucketName as xc, poisonRenderedSpellingsCollidingIn as xi, collectPublishedOutputNames as xn, repairMalformedResourcesForReadOnly as xo, unsupportedFinalSnapshotError as xr, acceptedCreateOnlyDropsOf as xs, loadJournaledOrphans as xt, relayedIndexBusyDelete as y, deployRefusesOrphanRowsReason as ya, Synthesizer as yc, INTRINSIC_KEYS as yi, noEchoParameterValueSeed as yn, repairMalformedResourceEntriesForReadOnly as yo, isFinalSnapshotError as yr, withStackInstanceIdWithheld as ys, isHandledOrphan as yt, templateIdentity as z, malformedRenderedContainersWarning as za, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as zc, isIamRoleArn as zi, red as zn, coerceWarmThroughput as zo, definedAttributes as zr, createAssetRedirectResolver as zs, recordUnderIdIsNotOwn as zt };
+//# sourceMappingURL=deploy-engine-D9SDE-Pj.js.map