@go-to-k/cdkd 0.304.1 → 0.306.0

package/dist/{deploy-engine-Dwe6OnF_.js → deploy-engine-Bjr-FAuZ.js}

@@ -1,8 +1,8 @@
-import { r as getAwsClients, s as __exportAll } from "./aws-clients-WQOzP1x4.js";
+import { c as __exportAll, r as getAwsClients } from "./aws-clients-DhsLtXsN.js";
 import { A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, D as getCurrentStackInstanceId, E as getCurrentSkipPrefix, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, L as withStackScopeBeforeStateRead, N as stackInstanceNameSuffix, O as getCurrentStackName, P as withNameGeneration, Q as safeMsg, R as withoutGeneratedFallbackName, S as fallbackNamePropertyFor, T as generatedNameFor, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify$1, c as isStdoutReservedForPayload, et as terminalSafe, f as currentLogLineMasker, j as looksLikeCdkdGeneratedName, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, q as displaySafe, s as getLogger, t as VERBOSE_POINTER, tt as truncateCodePoints, v as applyDefaultNameForFallback, w as generateResourceNameWithFallback, x as explicitNamePropertyFor, y as currentNameGeneration, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-Durl920o.js";
-import { $n as isUpdateUnsupportedError, An as StateError, At as carryCreatedBeforeFailure, B as compensateProtectionFlip, Bn as UNSHOWABLE_VALUE, Bt as replayMadeAnotherResource, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, E as isMarkedNotGone, En as ResourceTimeoutError, Et as maskDeep, F as refusalTypeShown, Fn as normalizeAwsError, Ft as isAuxiliaryFailure, Gn as physicalIdShownBesideCommand, Gt as formatLockExpiry, H as deleteWithProtectionCompensation, Ht as buildForceUnlockCommand, It as isAuxiliaryMarkOf, J as observeThenDisableProtection, Jn as shellBoundedDisplay, Jt as recoveryCommandFlags, K as isTerminalDeleteFailure, Kn as plainOrDescribed, Kt as formatLockOperation, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, Mt as createdBeforeFailure, N as normalizeAwsTagsToCfn, Nt as createdResourceIdentityBeforeFailure, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Pn as isSoftAbort, Pt as hasCreatedBeforeFailure, Qt as injectiveKey, Rn as SHELL_ACTIVE, Rt as markCreatedBeforeFailure, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Y as protectionFlipKey, Yn as shellQuote, Yt as sanitizeRecoveryValue, Z as runDeleteAttempt, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, at as protectedReplacementAdvice, bn as LockError, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp$3, d as prepareRemovalForUpdate, dt as startInterruptWatch, er as hasReplayMayCollide, et as DELETION_PROTECTION_DOC_POINTER, f as removalWarning, fn as CrossAccountSecretRefusalError, fr as formatRetryClassificationSignals, ft as ElapsedBudgetRegistry, gn as DynamicReferenceRegionAmbiguousError, gr as isIamPropagationError, gt as compositeIdSeparatorRefusal, hn as DeploymentNotApprovedError, i as holdsSecretDerivedEntry, in as ambientClientDefaults, ir as isReplayedNameCollisionFrom, it as pasteableAwsCommand, jn as SynthesisError, kt as RETRY_AUXILIARY_OWNER, l as withUnchangedSecretPrincipalLists, ln as AssetError, lr as stripControlChars, m as withoutInjectedRemovals, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nr as isNameCooldownError, on as clientDefaultsFor, or as markReplayMayCollide, pn as DependencyError, pr as isAmbiguousCcHandlerErrorCode, pt as monotonicNowMs, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rr as isRecreateRetryableError, sn as credentialFingerprint, sr as relayedNameCollision, tn as producerRecordKey, tr as isNameCollisionErrorFrom, un as CdkdError, ut as isInterruptedWaitError, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, xn as MacroExpansionError, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, yr as retryClassificationText, z as ProtectionFlipRegistry, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-OyoL9Woo.js";
+import { $n as isUpdateUnsupportedError, An as StateError, At as carryCreatedBeforeFailure, B as compensateProtectionFlip, Bn as UNSHOWABLE_VALUE, Bt as replayMadeAnotherResource, Cr as markNonRetryable, Ct as createMaskedLogSinks, D as markNotGone, Dn as ResourceUpdateNotSupportedError, Dt as maskerOrIdentity, E as isMarkedNotGone, En as ResourceTimeoutError, Et as maskDeep, F as refusalTypeShown, Fn as normalizeAwsError, Ft as isAuxiliaryFailure, Gn as physicalIdShownBesideCommand, Gt as formatLockExpiry, H as deleteWithProtectionCompensation, Ht as buildForceUnlockCommand, It as isAuxiliaryMarkOf, J as observeThenDisableProtection, Jn as shellBoundedDisplay, Jt as recoveryCommandFlags, K as isTerminalDeleteFailure, Kn as plainOrDescribed, Kt as formatLockOperation, L as resolveExplicitPhysicalId, Lt as markAuxiliaryFailure, M as isQuotableImportValue, Mt as createdBeforeFailure, N as normalizeAwsTagsToCfn, Nt as createdResourceIdentityBeforeFailure, O as assertRegionMatch, Ot as withDerivedNameMasks, P as quotedRemedyLogicalId, Pn as isSoftAbort, Pt as hasCreatedBeforeFailure, Qt as injectiveKey, Rn as SHELL_ACTIVE, Rt as markCreatedBeforeFailure, Sn as MalformedProducerRecordRefusalError, Sr as isThrottlingError, St as stateOrphanRecordRemedy, T as RESOURCE_NOT_FOUND, Tn as ProvisioningError, Tr as wrapMaskedAwsError, Tt as isSecretDerivedValue, Un as isInertUnquoted, Vn as commandHole, Vt as UNREPRODUCIBLE_LOCK_CLAUSE, Wn as pasteableCommand, Xn as withheldTargetClause, Xt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Y as protectionFlipKey, Yn as shellQuote, Yt as sanitizeRecoveryValue, Z as runDeleteAttempt, Zt as DEFAULT_STATE_PREFIX, _n as IntrinsicResolutionRefusalError, _r as isRetryableTransientError, an as ambientCredentialConfig, at as protectedReplacementAdvice, bn as LockError, bt as resourceTypeShown, cn as AccountIdUnavailableError, cr as escapeRegExp$3, d as prepareRemovalForUpdate, dt as startInterruptWatch, er as hasReplayMayCollide, et as DELETION_PROTECTION_DOC_POINTER, f as removalWarning, fn as CrossAccountSecretRefusalError, fr as formatRetryClassificationSignals, ft as ElapsedBudgetRegistry, gn as DynamicReferenceRegionAmbiguousError, gr as isIamPropagationError, gt as compositeIdSeparatorRefusal, hn as DeploymentNotApprovedError, i as holdsSecretDerivedEntry, in as ambientClientDefaults, ir as isReplayedNameCollisionFrom, it as pasteableAwsCommand, jn as SynthesisError, kt as RETRY_AUXILIARY_OWNER, l as withUnchangedSecretPrincipalLists, ln as AssetError, lr as stripControlChars, m as withoutInjectedRemovals, mr as isAmbiguousOutcomeError, mt as canonicalizeRoute53QueryName, nr as isNameCooldownError, on as clientDefaultsFor, or as markReplayMayCollide, pn as DependencyError, pr as isAmbiguousCcHandlerErrorCode, pt as monotonicNowMs, qn as quotedOrDescribed, qt as formatLockOwner, rn as withPasteableAwsProfile, rr as isRecreateRetryableError, sn as credentialFingerprint, sr as relayedNameCollision, tn as producerRecordKey, tr as isNameCollisionErrorFrom, un as CdkdError, ut as isInterruptedWaitError, vr as isTransientServerError, vt as logicalIdShown, w as withoutServerErrorRetries, wr as markRedactedCause, wt as createMaskedRetryLogger, xn as MacroExpansionError, xr as isMarkedNonRetryable, xt as segmentAfterAnchor, yr as retryClassificationText, z as ProtectionFlipRegistry, zn as SHELL_ACTIVE_WHY } from "./iam-policy-targets-BbtwI9vN.js";
 import { a as setAssumedRoleCredentials, c as ambientRegion, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as quietS3Logger, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BX9Y_fKp.js";
-import { t as getCdkdVersion } from "./version-EpZTW7nR.js";
+import { t as getCdkdVersion } from "./version-CZkNvTWF.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2360,7 +2360,7 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region, legacyF
 	logger.debug("No state bucket specified, resolving default from account...");
 	const { GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const { S3Client, HeadBucketCommand, ListObjectsV2Command } = await import("@aws-sdk/client-s3");
-	const { getAwsClients } = await import("./aws-clients-WQOzP1x4.js").then((n) => n.n);
+	const { getAwsClients } = await import("./aws-clients-DhsLtXsN.js").then((n) => n.n);
 	const { expectedOwnerParam, recordResolvedAccountId } = await Promise.resolve().then(() => expected_bucket_owner_exports);
 	const probeDeps = {
 		HeadBucketCommand,
@@ -9430,10 +9430,13 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 	}
 	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source)) {
 		const out = Object.create(null);
-		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactForState(v, {
-			provenance: "value-scan",
-			secrets
-		});
+		for (const [k, v] of Object.entries(bag)) {
+			out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactForState(v, {
+				provenance: "value-scan",
+				secrets
+			});
+			if (secrets.size > 0 && RENDERED_DEFINITION_KEYS.has(k) && definitionSourceCarriesSecret(source)) out[k] = nameDefinitionSecrets(out[k], source, secrets);
+		}
 		return out;
 	}
 	return redactForState(bag, {
@@ -9462,8 +9465,211 @@ function pathCrossesDottedKey(bag, path) {
 	}
 	return false;
 }
+const DEFINITION_SOURCE_KEYS = [
+	"DefinitionSubstitutions",
+	"DefinitionString",
+	"Definition"
+];
+const RENDERED_DEFINITION_KEYS = /* @__PURE__ */ new Set(["Definition", "DefinitionString"]);
+function definitionSourceCarriesSecret(source) {
+	return DEFINITION_SOURCE_KEYS.some((k) => Object.hasOwn(source, k) && (subtreeHasDynamicReference(source[k]) || carriesSecretMask(source[k])));
+}
+function nameScalarSecrets(value, secrets) {
+	const byValue = /* @__PURE__ */ new Set();
+	for (const plaintext of secrets.keys()) try {
+		const parsed = JSON.parse(plaintext);
+		if (typeof parsed === "number" && Number.isFinite(parsed) || typeof parsed === "boolean") byValue.add(parsed);
+	} catch {}
+	if (byValue.size === 0) return value;
+	const walk = (node) => {
+		if (typeof node === "number" || typeof node === "boolean") {
+			if (typeof node === "number" && !Number.isFinite(node)) return node;
+			return secrets.has(String(node)) || byValue.has(node) ? "***" : node;
+		}
+		if (Array.isArray(node)) return node.map(walk);
+		if (isPlainObject$7(node) && hasPlainPrototype(node)) {
+			const out = Object.create(null);
+			for (const [k, v] of Object.entries(node)) out[k] = walk(v);
+			return out;
+		}
+		return node;
+	};
+	return walk(value);
+}
+const SENTINEL_IN_STRING = "";
+const SENTINEL_OUT_OF_STRING = "";
+function substitutionIsSecret(value) {
+	return subtreeHasDynamicReference(value) || value.includes("***");
+}
+function sentinelDefinitionOf(source) {
+	const subs = source["DefinitionSubstitutions"];
+	const values = /* @__PURE__ */ new Map();
+	if (isPlainObject$7(subs)) {
+		for (const [name, value] of Object.entries(subs)) if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") values.set(name, String(value));
+	}
+	for (const key of ["DefinitionString", "Definition"]) {
+		if (!Object.hasOwn(source, key)) continue;
+		const raw = source[key];
+		const body = typeof raw === "string" ? raw : isPlainObject$7(raw) ? JSON.stringify(raw) : void 0;
+		if (body === void 0) continue;
+		if (body.includes(SENTINEL_IN_STRING) || body.includes(SENTINEL_OUT_OF_STRING) || /\\u[eE]00[01]/.test(body)) continue;
+		const names = [];
+		let text = "";
+		let inString = false;
+		let escaped = false;
+		const feed = (c) => {
+			text += c;
+			if (inString) {
+				if (escaped) escaped = false;
+				else if (c === "\\") escaped = true;
+				else if (c === "\"") inString = false;
+			} else if (c === "\"") inString = true;
+		};
+		for (let i = 0; i < body.length; i++) {
+			if (body.startsWith("${", i)) {
+				const end = body.indexOf("}", i + 2);
+				const name = end === -1 ? void 0 : body.slice(i + 2, end);
+				const value = name === void 0 ? void 0 : values.get(name);
+				if (name !== void 0 && value !== void 0) {
+					if (substitutionIsSecret(value)) {
+						const index = names.push(name) - 1;
+						text += inString ? `${SENTINEL_IN_STRING}${index}${SENTINEL_IN_STRING}` : `"${SENTINEL_OUT_OF_STRING}${index}${SENTINEL_OUT_OF_STRING}"`;
+					} else for (const c of value) feed(c);
+					i = end;
+					continue;
+				}
+			}
+			feed(body[i]);
+		}
+		let parsed;
+		try {
+			parsed = JSON.parse(text);
+		} catch {
+			continue;
+		}
+		const keys = /* @__PURE__ */ new Set();
+		const strings = /* @__PURE__ */ new Set();
+		const scalars = /* @__PURE__ */ new Set();
+		const secretLeaves = [];
+		const marked = (t) => t.includes(SENTINEL_IN_STRING) || t.includes(SENTINEL_OUT_OF_STRING);
+		const outOfString = new RegExp(`^${SENTINEL_OUT_OF_STRING}(\\d+)${SENTINEL_OUT_OF_STRING}$`);
+		const inStringMarkers = new RegExp(`${SENTINEL_IN_STRING}(\\d+)${SENTINEL_IN_STRING}`, "g");
+		const written = (t) => t.replace(inStringMarkers, (_m, i) => `\${${names[Number(i)]}}`);
+		const walk = (node, path, shapes) => {
+			if (typeof node === "string") {
+				const m = outOfString.exec(node);
+				if (m !== null) secretLeaves.push({
+					path,
+					shapes,
+					outOfStringName: names[Number(m[1])],
+					asWritten: void 0
+				});
+				else if (marked(node)) secretLeaves.push({
+					path,
+					shapes,
+					outOfStringName: void 0,
+					asWritten: written(node)
+				});
+				else strings.add(node);
+				return;
+			}
+			if (typeof node === "number" || typeof node === "boolean") {
+				scalars.add(node);
+				return;
+			}
+			if (Array.isArray(node)) {
+				node.forEach((item, i) => walk(item, [...path, i], [...shapes, node.length]));
+				return;
+			}
+			if (isPlainObject$7(node)) {
+				const own = new Set(Object.keys(node).map(written));
+				for (const [k, v] of Object.entries(node)) {
+					if (!marked(k)) keys.add(k);
+					walk(v, [...path, written(k)], [...shapes, own]);
+				}
+			}
+		};
+		walk(parsed, [], []);
+		try {
+			collectObjectKeys(JSON.parse(body), keys);
+		} catch {}
+		return {
+			keys,
+			strings,
+			scalars,
+			secretLeaves
+		};
+	}
+}
+function alignedSecretLeaf(root, leaf) {
+	let cursor = root;
+	for (const [depth, segment] of leaf.path.entries()) {
+		const shape = leaf.shapes[depth];
+		if (typeof shape === "number") {
+			if (!Array.isArray(cursor) || cursor.length !== shape) return void 0;
+			cursor = cursor[segment];
+		} else {
+			if (!isPlainObject$7(cursor)) return void 0;
+			const own = Object.keys(cursor);
+			if (own.length !== shape.size || own.some((k) => !shape.has(k))) return void 0;
+			if (!Object.hasOwn(cursor, segment)) return void 0;
+			cursor = cursor[segment];
+		}
+	}
+	return { value: cursor };
+}
+function collectObjectKeys(value, into) {
+	if (Array.isArray(value)) for (const item of value) collectObjectKeys(item, into);
+	else if (isPlainObject$7(value)) for (const [k, v] of Object.entries(value)) {
+		into.add(k);
+		collectObjectKeys(v, into);
+	}
+}
+function spelledKeysOf(properties) {
+	const keys = /* @__PURE__ */ new Set();
+	collectObjectKeys(properties, keys);
+	for (const key of sentinelDefinitionOf(properties)?.keys ?? []) keys.add(key);
+	return keys;
+}
+function someKeyIsUnspelled(value, spelled) {
+	if (Array.isArray(value)) return value.some((item) => someKeyIsUnspelled(item, spelled));
+	if (isPlainObject$7(value)) return Object.entries(value).some(([k, v]) => !spelled(k) || someKeyIsUnspelled(v, spelled));
+	return false;
+}
+function nameDefinitionSecrets(value, source, secrets) {
+	if (value === null || typeof value !== "object") return value;
+	const sentinel = sentinelDefinitionOf(source);
+	if (sentinel === void 0) {
+		const plaintexts = [...secrets.keys()].filter((p) => p !== "");
+		const keyHoldsSecret = (key) => plaintexts.some((p) => key === p || p.length >= 4 && key.includes(p));
+		if (someKeyIsUnspelled(value, (key) => !keyHoldsSecret(key))) return "***";
+		return nameScalarSecrets(value, secrets);
+	}
+	if (someKeyIsUnspelled(value, (key) => sentinel.keys.has(key))) return "***";
+	let out = value;
+	for (const leaf of sentinel.secretLeaves) {
+		if (alignedSecretLeaf(out, leaf) === void 0) return "***";
+		if (leaf.outOfStringName !== void 0) out = replaceAtPath(out, leaf.path, "***");
+	}
+	return out;
+}
+function replaceAtPath(root, path, leaf) {
+	if (path.length === 0) return leaf;
+	const [head, ...rest] = path;
+	if (Array.isArray(root)) {
+		const copy = [...root];
+		copy[head] = replaceAtPath(root[head], rest, leaf);
+		return copy;
+	}
+	const copy = Object.create(null);
+	Object.assign(copy, root);
+	copy[head] = replaceAtPath(root[head], rest, leaf);
+	return copy;
+}
 function isUncertifiedBaselineMaskPosition(properties, path) {
 	if (pathCrossesDottedKey(properties, path)) return false;
+	const [head] = path.split(".");
+	if (head !== void 0 && RENDERED_DEFINITION_KEYS.has(head)) return definitionSourceCarriesSecret(properties);
 	let cursor = properties;
 	for (const segment of path.split(".")) {
 		if (typeof cursor === "string") break;
@@ -9534,7 +9740,79 @@ function deepEqualJsonValue(a, b) {
 
 //#endregion
 //#region src/deployment/secret-redaction/readback-certification.ts
-function refuseUncertifiedSubtree(value, sourceLiterals, mark, seen = /* @__PURE__ */ new Map()) {
+function renderedDefinitionLiterals(source) {
+	const keep = /* @__PURE__ */ new Set();
+	const scalarKeep = /* @__PURE__ */ new Set();
+	const keyKeep = /* @__PURE__ */ new Set();
+	const subs = source["DefinitionSubstitutions"];
+	const scalars = [];
+	if (isPlainObject$7(subs)) {
+		for (const [name, value] of Object.entries(subs)) if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+			scalars.push([name, String(value)]);
+			if (typeof value === "string") keep.add(value);
+			addScalarSpelling(scalarKeep, value);
+		}
+	}
+	const bodies = [];
+	for (const key of ["DefinitionString", "Definition"]) {
+		if (!Object.hasOwn(source, key)) continue;
+		const body = source[key];
+		if (typeof body === "string") bodies.push(body);
+		else if (isPlainObject$7(body)) bodies.push(JSON.stringify(body));
+	}
+	for (const body of bodies) {
+		let rendered = body;
+		for (const [name, value] of scalars) rendered = rendered.split(`\${${name}}`).join(value);
+		for (const text of rendered === body ? [body] : [body, rendered]) {
+			keep.add(text);
+			try {
+				const parsed = JSON.parse(text);
+				for (const leaf of wholeStringLeavesOf(parsed)) keep.add(leaf);
+				collectScalarLeaves(parsed, scalarKeep);
+				collectObjectKeys(parsed, keyKeep);
+			} catch {}
+		}
+	}
+	const sentinel = sentinelDefinitionOf(source);
+	if (sentinel !== void 0) {
+		for (const leaf of sentinel.strings) keep.add(leaf);
+		for (const leaf of sentinel.secretLeaves) if (leaf.asWritten !== void 0) keep.add(leaf.asWritten);
+		for (const leaf of sentinel.scalars) scalarKeep.add(leaf);
+		for (const key of sentinel.keys) keyKeep.add(key);
+	}
+	return {
+		strings: keep,
+		scalars: scalarKeep,
+		keys: keyKeep,
+		sentinel
+	};
+}
+function certifiedAtSecretPosition(value, rendered) {
+	if (typeof value === "symbol") return true;
+	if (typeof value !== "string") return false;
+	if (isSingleDynamicReferenceToken(value) && spanNamesResolvableService(value)) return true;
+	return (value.includes("{{resolve:") || value.includes("***") || value.includes("${")) && rendered.has(value);
+}
+function addScalarSpelling(into, value) {
+	if (typeof value !== "string") {
+		into.add(value);
+		return;
+	}
+	try {
+		const parsed = JSON.parse(value);
+		if (typeof parsed === "number" || typeof parsed === "boolean") into.add(parsed);
+	} catch {}
+}
+function collectScalarLeaves(value, into) {
+	if (typeof value === "number" || typeof value === "boolean") {
+		into.add(value);
+		return;
+	}
+	if (Array.isArray(value)) for (const item of value) collectScalarLeaves(item, into);
+	else if (isPlainObject$7(value)) for (const item of Object.values(value)) collectScalarLeaves(item, into);
+}
+function refuseUncertifiedSubtree(value, sourceLiterals, mark, scalarLiterals, seen = /* @__PURE__ */ new Map()) {
+	if (scalarLiterals !== void 0 && (typeof value === "number" || typeof value === "boolean") && !scalarLiterals.has(value)) return mark ? POSITION_UNCERTIFIED : "***";
 	if (typeof value === "string") {
 		if (isSingleDynamicReferenceToken(value) && spanNamesResolvableService(value) || sourceLiterals.has(value)) return value;
 		if (value === "") return value;
@@ -9546,13 +9824,13 @@ function refuseUncertifiedSubtree(value, sourceLiterals, mark, seen = /* @__PURE
 	if (Array.isArray(value)) {
 		const out = [];
 		seen.set(value, out);
-		for (const item of value) out.push(refuseUncertifiedSubtree(item, sourceLiterals, mark, seen));
+		for (const item of value) out.push(refuseUncertifiedSubtree(item, sourceLiterals, mark, scalarLiterals, seen));
 		return out;
 	}
 	if (isPlainObject$7(value) && hasPlainPrototype(value)) {
 		const out = Object.create(null);
 		seen.set(value, out);
-		for (const [k, v] of Object.entries(value)) out[k] = refuseUncertifiedSubtree(v, sourceLiterals, mark, seen);
+		for (const [k, v] of Object.entries(value)) out[k] = refuseUncertifiedSubtree(v, sourceLiterals, mark, scalarLiterals, seen);
 		return out;
 	}
 	if (ArrayBuffer.isView(value)) return mark ? POSITION_UNCERTIFIED : "***";
@@ -9576,6 +9854,39 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, le
 		if (learn) learnMixedLeafNeedle(learn, bag, source);
 		return mark ? POSITION_DECIDED : source;
 	}
+	if (failClosed === true && isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source) && Object.keys(bag).some((k) => RENDERED_DEFINITION_KEYS.has(k)) && definitionSourceCarriesSecret(source)) {
+		const keep = renderedDefinitionLiterals(source);
+		const out = Object.create(null);
+		const rest = Object.create(null);
+		for (const [k, v] of Object.entries(bag)) if (!RENDERED_DEFINITION_KEYS.has(k)) rest[k] = v;
+		const walkedRest = refuseUncertifiedReadbackPositions(rest, source, secrets, failClosed, learn, mark);
+		for (const [k, v] of Object.entries(bag)) {
+			if (!RENDERED_DEFINITION_KEYS.has(k)) {
+				out[k] = walkedRest[k];
+				continue;
+			}
+			if (someKeyIsUnspelled(v, (key) => keep.keys.has(key))) {
+				out[k] = mark ? POSITION_UNCERTIFIED : "***";
+				continue;
+			}
+			let positioned = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, failClosed, learn, mark) : v;
+			let misaligned = false;
+			for (const leaf of keep.sentinel?.secretLeaves ?? []) {
+				const at = alignedSecretLeaf(positioned, leaf);
+				if (at === void 0) {
+					misaligned = true;
+					break;
+				}
+				if (!certifiedAtSecretPosition(at.value, keep.strings)) positioned = replaceAtPath(positioned, leaf.path, mark ? POSITION_UNCERTIFIED : "***");
+			}
+			if (misaligned) {
+				out[k] = mark ? POSITION_UNCERTIFIED : "***";
+				continue;
+			}
+			out[k] = refuseUncertifiedSubtree(positioned, keep.strings, mark, keep.scalars);
+		}
+		return out;
+	}
 	if (!subtreeHasDynamicReference(source)) return bag;
 	if (isPlainObject$7(bag) && hasPlainPrototype(bag) && isPlainObject$7(source)) {
 		const out = Object.create(null);
@@ -16023,6 +16334,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"LogsConfig",
 			"Name",
 			"QueuedTimeoutInMinutes",
+			"ResourceAccessRole",
 			"SecondaryArtifacts",
 			"SecondarySources",
 			"SecondarySourceVersions",
@@ -16031,13 +16343,10 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"SourceVersion",
 			"Tags",
 			"TimeoutInMinutes",
+			"Visibility",
 			"VpcConfig"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([
-			["ResourceAccessRole", "not yet implemented by cdkd"],
-			["Triggers", "not yet implemented by cdkd"],
-			["Visibility", "not yet implemented by cdkd"]
-		]),
+		silentDrop: /* @__PURE__ */ new Map([["Triggers", "not yet implemented by cdkd"]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Arn", "Id"]),
 		ccRouteUnavailable: true
@@ -16970,8 +17279,12 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		ccRouteUnavailable: true
 	}],
 	["AWS::Glue::Connection", {
-		handled: /* @__PURE__ */ new Set(["CatalogId", "ConnectionInput"]),
-		silentDrop: /* @__PURE__ */ new Map([["Tags", "not yet implemented by cdkd"]]),
+		handled: /* @__PURE__ */ new Set([
+			"CatalogId",
+			"ConnectionInput",
+			"Tags"
+		]),
+		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Name"]),
 		ccRouteUnavailable: false
@@ -17210,13 +17523,14 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"DesiredShardLevelMetrics",
 			"MaxRecordSizeInKiB",
 			"Name",
+			"RecordDistributionStrategy",
 			"RetentionPeriodHours",
 			"ShardCount",
 			"StreamEncryption",
 			"StreamModeDetails",
 			"Tags"
 		]),
-		silentDrop: /* @__PURE__ */ new Map([["RecordDistributionStrategy", "not yet implemented by cdkd"], ["WarmThroughputMiBps", "not yet implemented by cdkd"]]),
+		silentDrop: /* @__PURE__ */ new Map([["WarmThroughputMiBps", "AWS accepts it only on an account enrolled in the Kinesis minimum throughput billing commitment, so the SDK path is not wired (go-to-k/cdkd#1695); Cloud Control forwards it."]]),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
 		readOnly: /* @__PURE__ */ new Set(["Arn", "WarmThroughputObject"]),
 		ccRouteUnavailable: false
@@ -20623,8 +20937,7 @@ const REF_RETURNS_SEGMENT_AFTER_PIPE = /* @__PURE__ */ new Set([
 	"AWS::AppConfig::ConfigurationProfile",
 	"AWS::AppConfig::HostedConfigurationVersion",
 	"AWS::AppConfig::Deployment",
-	"AWS::S3Tables::Namespace",
-	"AWS::S3Tables::Table"
+	"AWS::S3Tables::Namespace"
 ]);
 const REF_RETURNS_SEGMENT_BEFORE_FIRST_PIPE = /* @__PURE__ */ new Set([
 	"AWS::EC2::EIP",
@@ -20706,11 +21019,25 @@ function recordSetRefFromPhysicalId(physicalId, stateLookup) {
 	if (recordedName === void 0) return void 0;
 	return canonicalizeRoute53QueryName(name) === canonicalizeRoute53QueryName(recordedName) ? name : void 0;
 }
+function s3TablesTableRefFromPhysicalId(physicalId, stateLookup) {
+	if (!physicalId.includes("|") || !stateLookup) return physicalId;
+	const tableArn = stateLookup(["TableARN"]);
+	if (tableArn === void 0) return physicalId;
+	if (carriesSecretMask(tableArn)) return tableArn;
+	return tableArn.startsWith("arn:") && !tableArn.includes("|") ? tableArn : physicalId;
+}
+function lacksRecordedTableArn(resource) {
+	if (resource.resourceType !== "AWS::S3Tables::Table") return false;
+	if (!resource.physicalId.includes("|")) return false;
+	const recorded = (bag) => {
+		if (bag === void 0 || !Object.hasOwn(bag, "TableARN")) return false;
+		const value = bag["TableARN"];
+		return typeof value === "string" && (carriesSecretMask(value) || value.startsWith("arn:") && !value.includes("|"));
+	};
+	return !recorded(resource.properties) && !recorded(resource.attributes);
+}
 function cfnRefValueFromPhysicalId(resourceType, physicalId, stateLookup) {
-	if (resourceType === "AWS::S3Tables::Table" && !physicalId.includes("|") && stateLookup) {
-		const tableName = stateLookup(["TableName", "Name"]);
-		if (tableName) return tableName;
-	}
+	if (resourceType === "AWS::S3Tables::Table") return s3TablesTableRefFromPhysicalId(physicalId, stateLookup);
 	if (resourceType === "AWS::Glue::Table") {
 		const tableName = glueTableRefFromPhysicalId(physicalId, stateLookup);
 		if (tableName !== void 0) return tableName;
@@ -24355,6 +24682,11 @@ function lookupResourceRecord(resolver, logicalId, via, context) {
 async function resolveRef(resolver, logicalId, context, onParameter) {
 	const resource = lookupResourceRecord(resolver, logicalId, "Ref", context);
 	if (resource) {
+		if (lacksRecordedTableArn(resource)) {
+			const tableArn = await resolveGetAtt(resolver, [logicalId, "TableARN"], context);
+			if (typeof tableArn === "string" && tableArn.startsWith("arn:") && !tableArn.includes("|")) return tableArn;
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Ref ${displayMasked(resolver, logicalId, context)}: the state records no usable TableARN for this S3 Tables table (a cdkd older than v0.201.0 recorded none), and CloudFormation's Ref of a table is its TableARN, which its physical id does not contain. No usable one could be read from AWS either. If the state records none, run 'cdkd deploy' with permission to call s3tables:GetTable so cdkd records it; if it records a value that is not the table's ARN, re-import the table with 'cdkd import'.`));
+		}
 		const refValue = resolveRefValue(resolver, logicalId, resource, context);
 		recordSecretNamedRead(logicalId, refValue, context);
 		resolver.logger.debug(`Resolved Ref to resource: ${logRender(resolver, logicalId, context)} resolved to ${logRender(resolver, String(refValue), context)}`);
@@ -28062,7 +28394,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BKJrVAH4.js");
+			const { ASGProvider } = await import("./asg-provider-DrREeZeh.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -28171,7 +28503,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-p_5gnXcp.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CIAyTNad.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-Dps9UxBz.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-D_3VAhFf.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -45305,11 +45637,12 @@ const priorAttemptStore = new AsyncLocalStorage();
 function withPriorAttempts(lookup, fn) {
 	return priorAttemptStore.run(lookup, fn);
 }
-function priorAttemptLookup(logicalId, attempts) {
+function priorAttemptLookup(logicalId, attempts, provenOrphanIds) {
 	let landed = false;
 	return {
 		logicalId,
 		attempts,
+		...provenOrphanIds !== void 0 && { provenOrphanIds },
 		notePossiblyLanded: () => {
 			landed = true;
 		},
@@ -45321,20 +45654,32 @@ function getPriorAttempts(logicalId) {
 	return bound?.logicalId === logicalId ? bound : void 0;
 }
 function priorAttemptsInJournal(journal, logicalId, resourceType) {
-	let bags = [];
-	for (const segment of journal?.segments ?? []) {
-		if (segment.operations.some((op) => op.logicalId === logicalId)) bags = [];
-		for (const op of segment.failedOperations ?? []) {
-			if (op.logicalId !== logicalId || op.resourceType !== resourceType) continue;
-			if (op.changeType === "DELETE" || !isBag(op.attemptedProperties)) continue;
-			if (op.changeType === "UPDATE" && op.replacementOrphaned !== void 0) continue;
-			if (recordedAsNewResource(op)) continue;
-			bags.push(op.attemptedProperties);
-		}
-		if (segment.supersededLogicalIds?.includes(logicalId)) bags = [];
+	const bags = [];
+	for (const op of unsupersededFailedOps(journal, logicalId, resourceType)) {
+		if (op.changeType === "DELETE" || !isBag(op.attemptedProperties)) continue;
+		if (op.changeType === "UPDATE" && op.replacementOrphaned !== void 0) continue;
+		if (recordedAsNewResource(op)) continue;
+		bags.push(op.attemptedProperties);
 	}
 	return bags;
 }
+function provenOrphanIdsInJournal(journal, logicalId, resourceType) {
+	const ids = [];
+	for (const op of unsupersededFailedOps(journal, logicalId, resourceType)) {
+		if (op.changeType !== "CREATE" || op.physicalIdRecoveredFromError !== true) continue;
+		if (typeof op.physicalId === "string" && op.physicalId !== "") ids.push(op.physicalId);
+	}
+	return ids;
+}
+function unsupersededFailedOps(journal, logicalId, resourceType) {
+	let ops = [];
+	for (const segment of journal?.segments ?? []) {
+		if (segment.operations.some((op) => op.logicalId === logicalId)) ops = [];
+		for (const op of segment.failedOperations ?? []) if (op.logicalId === logicalId && op.resourceType === resourceType) ops.push(op);
+		if (segment.supersededLogicalIds?.includes(logicalId)) ops = [];
+	}
+	return ops;
+}
 function recordedAsNewResource(op) {
 	if (typeof op.physicalId !== "string" || op.physicalId === "") return false;
 	if (op.physicalIdRecoveredFromError === true) return false;
@@ -50137,7 +50482,8 @@ async function provisionResource(engine, logicalId, change, stateResources, stac
 	}
 }
 async function provisionResourceBody(engine, logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
-	const priorAttempts = priorAttemptLookup(logicalId, async () => priorAttemptsInJournal(await engine.stateBackend.loadRollbackJournal(stackName, engine.stackRegion), logicalId, change.resourceType));
+	const loadJournal = () => engine.stateBackend.loadRollbackJournal(stackName, engine.stackRegion);
+	const priorAttempts = priorAttemptLookup(logicalId, async () => priorAttemptsInJournal(await loadJournal(), logicalId, change.resourceType), async () => provenOrphanIdsInJournal(await loadJournal(), logicalId, change.resourceType));
 	return withStackRecords(engine.stackRecordsView, () => {
 		switch (change.changeType) {
 			case "CREATE": return withPriorAttempts(priorAttempts, () => provisionCreate(engine, logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress));
@@ -51743,5 +52089,5 @@ function sameGenerationClaimsOf(record) {
 }
 
 //#endregion
-export { pendingRequestCount as $, malformedLocalResourcesWarning as $a, importableOutputKeys as $c, keepHeldTokenProvenance as $i, resolveApp as $l, destroyStackRecordsView as $n, hasNoCloudControlHandlers as $o, markDeleteStarted as $r, logOnlyValueCount as $s, seedsDeleteFirstGuard as $t, inheritedProvenanceForChildDiff as A, parseWebACLArn as Aa, recordProvenPublicExpression as Ac, deleteSkipReason as Ai, describeDockerCapturedOutput as Al, isWholeDynamicReferenceValue as An, refuseMalformedResourcePropertiesForDestroy as Ao, secretNamePrintingBags as Ar, canonicalCoordinates as As, readRefactorMarkerOnce as At, ownValue as Au, conditionFingerprint as B, accountArgs as Ba, applyCrossPrefixScan as Bc, DiffCalculator as Bi, redactDockerArgvValues as Bl, findDestructiveChanges as Bn, repairMalformedOutputsForReadOnly as Bo, effectiveDeletionPolicy as Br, readbackPathFor as Bs, replayFailedOperations as Bt, hasCdkAutoDeleteTag as C, carriesFetchableDynamicReference as Ca, splitGetAttStringForm as Cc, CloudControlProvider as Ci, parseBootstrapMarker as Cl, exportAliasCollisionScrubWarning as Cn, refuseMalformedResourceAttributesForOrphan as Co, createReadOnlyAttributeHealerFactory as Cr, describeTypeWithThrottleRetry as Cs, sameJournaledOrphans as Ct, describeJsonParseFailure as Cu, IMPLICIT_DELETE_DEPENDENCIES as D, cfnRefValueFromPhysicalId as Da, recordMaskOnlyValuesIn as Dc, UNSPECIFIED_SKIP_REASON as Di, buildDenyExternalAccessPolicy as Dl, carriedExportAliasExposure as Dn, refuseMalformedResourceEntriesForImport as Do, namingSecretsWithRecordedNoEcho as Dr, sameLambdaFunctionAddress as Ds, lookupEachName as Dt, hasOwnKey as Du, markRefusedBeforeApplying as E, AWS_NO_VALUE as Ea, recordMaskOnlyValue as Ec, RollbackInlinePolicyWriters as Ei, validateContainerRepoName as El, secretSafeKeyDisplay as En, refuseMalformedResourceEntriesForDestroy as Eo, maskEventTextWithBoundBags as Er, lambdaFunctionNameForMask as Es, isAccessDeniedError as Et, defineOwnKey as Eu, findNestedTemplateTreeDefect as F, JSON_LISTING_HOLE_VALUE as Fa, isLockInfoExpired as Fc, ec2InstanceProtectionSite as Fi, formatDockerLoginError as Fl, bindingSkippedOutputs as Fn, refuseMalformedResourcesForDestroy as Fo, ATOMIC_FINAL_SNAPSHOT_TYPES as Fr, maskedLeafCoordinatesOf as Fs, updateRefactorMarker as Ft, resolveAssemblyPath as Fu, withResourceDeadline as G, hasReadableResources as Ga, withStackInstanceIdWithheld as Gc, s3BucketArn as Gi, warnFinchArgvExposure as Gl, rollbackOrphanIds as Gn, unreadableOrphanRecords as Go, ledgerForStack as Gr, markSameGenerationBag as Gs, isJournaledOrphan as Gt, parentSuppliedValues as H, displayLogicalId as Ha, isAccessDenied$1 as Hc, IntrinsicFunctionResolver as Hi, redactedDockerCause as Hl, findRefactorHints as Hn, repairMalformedResourcePropertiesForReadOnly as Ho, refusesFinalSnapshot as Hr, recordedNoEchoValuesOf as Hs, removeProtectionTypeList as Ht, isAbsoluteAssetPath as I, STATE_REGION_DIVERGED as Ia, S3StateBackend as Ic, isTerminationProtectionPropagationError as Ii, getDockerCmd as Il, DEFAULT_RESOURCE_TIMEOUT_MS as In, refuseMalformedResourcesForExport as Io, PRE_DELETE_SNAPSHOT_TYPES as Ir, noEchoCoordinatesOf as Is, hasPendingMovesOut as It, injectAwsRegion as Iu, keptWholeReasonText as J, malformedDriftResourcePropertiesWarning as Ja, describeRegionValueKind as Jc, s3BucketRegionalDomainName as Ji, Synthesizer as Jl, looselyEqual as Jn, findActionableSilentDrops as Jo, acquireIdempotencyToken as Jr, snapshotPassProvenance as Js, planRollback as Jt, diffSecurity as K, isReadableOrphanRecord as Ka, splitImportedOps as Kc, s3BucketDomainName as Ki, AssetManifestLoader as Kl, withMovedTo as Kn, unreadableResourceEntries as Ko, reserveStackCreateToken as Kr, redactForState as Ks, isReplacementOrphan as Kt, listNestedTemplateRows as L, STATE_RESOURCES_MALFORMED as La, rebuildClientForBucketRegion as Lc, observeThenDisableInstanceApiTermination as Li, isDockerClientEnvKey as Ll, DEFAULT_RESOURCE_WARN_AFTER_MS as Ln, refuseMalformedState as Lo, buildFinalSnapshotIdentifier as Lr, noEchoLeavesOf as Ls, pendingMovesOutOf as Lt, injectedAwsRegionValue as Lu, findServiceTokenRefusals as M, parameterInputsFor as Ma, WHOLE_DYNAMIC_REFERENCE_PATTERN as Mc, isWaitAbandonedError as Mi, describeDockerFailure as Ml, collectDeclaredOutputNames as Mn, refuseMalformedResourcePropertiesForExport as Mo, secretNamedRecordNeedles as Mr, maskAtCoordinates as Ms, refactorMarkerRefusalMessage as Mt, describeFileReadFailure as Mu, serviceTokenBlockingReason as N, passedParameterClassesOf as Na, isSingleDynamicReferenceToken as Nc, markWaitAbandoned as Ni, dockerSpawnEnvWithSensitive as Nl, collectPublishedOutputNames as Nn, refuseMalformedResourcePropertiesForOrphan as No, stateSecretNameNeedles as Nr, maskReadbackAtCoordinates as Ns, refuseRefactorMarker as Nt, displayAssemblyPath as Nu, computeImplicitDeleteEdges as O, isStalePlaceholderArnAttribute as Oa, recordNoEchoAttributeValues as Oc, deleteIndeterminateGuards as Oi, buildDockerImage as Ol, exportNameNoEchoParameters as On, refuseMalformedResourceEntriesForImportSave as Oo, orphanRecordsPrintingBag as Or, DagBuilder as Os, withApiLimit as Ot, hasPlainPrototype$1 as Ou, childTemplateLoader as P, declaresNoEcho as Pa, LockManager as Pc, disableInstanceApiTermination as Pi, finchSecretArgvRefusal as Pl, isExportAliasCollision as Pn, refuseMalformedResourcesForDeploy as Po, storedSecretNameNeedles as Pr, maskWholeValue as Ps, sameMove as Pt, renderAssemblyPathEscape as Pu, planOrphanAdoption as Q, malformedLocalResourceEntriesWarning as Qa, hasUnverifiableParameterRefusal as Qc, refuseUnreadableCdkCrossAccountRefs as Qi, loadCdkJson as Ql, awaitInFlightSibling as Qn, NO_CC_HANDLERS_REASON as Qo, isRefusedByName as Qr, literalSplitDelimitersOf as Qs, resolveReplacementOldType as Qt, renderNestedTemplateTreeDefect as R, UNREADABLE_ORPHANS_CONTAINER_ROW as Ra, CrossPrefixReadError as Rc, reDisableInstanceApiTermination as Ri, isMalformedEnvKey as Rl, maskingRetryLogger as Rn, repairMalformedOrphanRecordsForReadOnly as Ro, ccRoutedFinalSnapshotError as Rr, noEchoOutputsComparison as Rs, pendingMovesRefusalMessage as Rt, clearBucketRegionCache as Ru, S3_AUTO_DELETE_OBJECTS_TAG as S, carriesDynamicReference as Sa, recordPhysicalNameCopy as Sc, customResourceResponseExpirationWarning as Si, isCrossRegionRedirect as Sl, displayTextOrWithheld as Sn, refuseMalformedOutputsForDestroy as So, noEchoParameterNamesOf as Sr, templateResourceTypes as Ss, makeForeignHolderScan as St, processStackMessages as Su, getPriorAttempts as T, keepsSecretReferenceToken as Ta, provenPublicValue as Tc, unchangedBehindSecretReference as Ti, validateAssetBucketName as Tl, secretBearingStateKeyWarning as Tn, refuseMalformedResourceEntriesForDeploy as To, journaledOrphanPrintingBag as Tr, canonicalLambdaFunctionName as Ts, chunks as Tt, utf8ByteLength as Tu, readRecordedConditionVerdicts as U, hasReadableOrphans as Ua, isNotImplemented as Uc, poisonRenderedSpellingsCollidingIn as Ui, runDockerForeground as Ul, hintSidesOf as Un, repairMalformedResourcesForReadOnly as Uo, unsupportedFinalSnapshotError as Ur, valueAtCoordinate as Us, recordAfterRollbackUpdate as Ut, conditionInputsFrom as V, deployRefusesOrphanRowsReason as Va, crossPrefixDeniedWarning as Vc, INTRINSIC_KEYS as Vi, redactedCause as Vl, formatDestructiveChange as Vn, repairMalformedResourceEntriesForReadOnly as Vo, isFinalSnapshotError as Vr, readsNoEchoSource as Vs, replayRollback as Vt, enclosingDeadlineRemainingMs as W, hasReadableOutputs as Wa, stackInstanceIdOf as Wc, isSettledInstanceState as Wi, runDockerStreaming as Wl, movedToHint as Wn, unpreviewableOrphanRecords as Wo, earliestDefined as Wr, liveMatchesUnresolvedTokenFrame as Ws, demoteSupersededOrphans as Wt, makeCanonicalizePropertiesFn as X, malformedExportSourceWarning as Xa, hasReadableExportSet as Xc, resolveDynamicReferences as Xi, getDefaultStateBucketName as Xl, parseMappingFile as Xn, unwrittenCreateOnlyReplacement as Xo, DeploymentEventsStore as Xr, createUnionSecretMasker as Xs, recordUnderIdIsNotOwn as Xt, mergeNoChangeOutputs as Y, malformedExportNamesWarning as Ya, exportNamesCarriedFrom as Yc, s3BucketWebsiteUrl as Yi, synthesisStatusMessage as Yl, mappingPairs as Yn, findSilentDropProperties as Yo, DeploymentEventsReader as Yr, carryLogOnlyValues as Ys, recheckFailedPlan as Yt, makeSiblingClaimReader as Z, malformedLocalOutputsWarning as Za, hasReasonlessBaselineRefusal as Zc, producerLookupOver as Zi, getLegacyStateBucketName as Zl, proposeRenames as Zn, withoutSilentDropProperties as Zo, extractDeploymentEventError as Zr, hasMaskableValues as Zs, replacementNeverSwapped as Zt, deleteTableWithIndexBusyRetry as _, coerceParameterTypedValue as _a, inheritNestedStackParameterAssociations as _c, isCustomResourceType as _i, AssetModeResolver as _l, computeParameterTaint as _n, refuseMalformedOrphanRecordsForDestroy as _o, supersededResourcesOf as _r, replayWarn as _s, dropFailedCommands as _t, PARTITION_TABLE as _u, isProtectionValueActive as a, assertSendableRoleArn as aa, createSecretMasker as ac, tagMapAsList as ai, stackInstanceIdCarriedFrom as al, isRedactedRecordedValue as an, malformedOutputsRefusalMessage as ao, gray as ar, renderStatefulReason as as, displacedPhysicalIdShown as at, resolveUseCdkBootstrapAssets as au, waitForIndexesSettled as b, getAccountInfo as ba, physicalNameCopiesOf as bc, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as bi, ensureAssetStorage as bl, resourcesNamingDeclaredParameter as bn, refuseMalformedOrphansForOrphan as bo, noEchoComparisonForTemplate as br, requireConfigString as bs, journaledOrphanLines as bt, AssemblyReader as bu, DynamoDBGlobalTableProvider as c, sendableAssumeRoleCommand as ca, maskSecretsInText as cc, stringifyIfAssigned as ci, timePhase as cl, updatePartialMessage as cn, malformedResourceEntriesWarning as co, yellow as cr, isWarmThroughputDecrease as cs, nestedChildStackName as ct, ssmResolvedValueType as cu, compensateRemovedDeletionProtection as d, callerEnvCredentials as da, withoutPhysicalNameCopies as dc, ccBrokenReason as di, stringifyValue as dl, nameGenerationHighWaterOf as dn, malformedScrubResourceEntriesRefusalMessage as do, holdsSupersededResources as dr, coerceCfnBoolean as ds, revertedNestedRowIds as dt, MIGRATE_TMP_PREFIX as du, outputReferenceProvenanceOf as ea, printingCorpusOf as ec, DBPROXY_TAGS_WHAT as ei, importableOutputs as el, orphanNeedsIdentity as en, malformedOrphanRecordsRefusalMessage as eo, getStackRecords as er, findReplacedReadersOfRecreateTargets as es, resolvePendingCloudControlRequests as et, resolveAutoAssetStorage as eu, deleteBudgetKey as f, envCredentialsAreAssumedRole as fa, DYNAMIC_REFERENCE_TOKEN_SCAN as fc, isCustomResource as fi, WorkGraph as fl, nameScopeOf as fn, malformedStateRefusalMessage as fo, isSupersededResourceRecord as fr, coerceCfnInteger as fs, withNestedRevertRun as ft, findLargeInlineResources as fu, INDEX_SETTLE_POLL_INTERVAL_MS as g, regionLessSecretName as ga, identityKeyFor as gc, readsNoEchoDeleteValues as gi, rewriteTemplateAssetReferences as gl, withNameGenerationReached as gn, refuseMalformedOrphanRecords as go, supersededHolderOf as gr, readConfigString as gs, deleteJournaledOrphans as gt, expectedOwnerParam as gu, DELETE_INDEX_WAIT_PROCEED_NOTE as h, producerRegionsFromState as ha, pathCrossesDottedKey as hc, TemplateNoEchoReresolver as hi, loadPublishableAssetManifest as hl, retiredNameGenerationsLeaving as hn, refuseMalformedNestedChildOutputs as ho, supersededHeldByOtherTypeWarning as hr, configStringRefusal as hs, withNestedStackContext as ht, decodeListingKey as hu, PROTECTION_PROPERTY_BY_TYPE as i, assertFlagRoleArn as ia, unionOfSecretBags as ic, refuseMalformedDesiredTags as ii, shouldRetainResource as il, REDACTED_DELETE_ADDRESS_SKIP_REASON as in, malformedOrphansWarning as io, cyan as ir, isStatefulRecreateTargetSync as is, displacedOpClause as it, resolveStateBucketWithDefaultAndSource as iu, deferredServiceTokenWarning as j, withSharedDrainBudget as ja, wholeStringLeavesOf as jc, withIndeterminateGuard as ji, describeDockerExecFailure as jl, noEchoParameterValueSeed as jn, refuseMalformedResourcePropertiesForDrift as jo, secretNamedAttributeNamesOf as jr, isMarkedCoordinate as js, refactorMarkerMovesOf as jt, absoluteAssemblyPathEscape as ju, crossStackOutputProvenanceSource as k, refStateLookupFromResource as ka, recordNoEchoParameterFreshValue as kc, deleteLeftInPlace as ki, resolveDockerContextDirectory as kl, exportNameSecretExposure as kn, refuseMalformedResourceEntriesForOrphan as ko, secretNamePrintingBag as kr, TemplateParser as ks, readRefactorMarker as kt, nullPrototypeRecord as ku, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, AWS_CREDENTIAL_ENV_KEYS as la, scrubResourceRecord as lc, CC_BROKEN_REASON as li, AssetPublisher as ll, updatePartialReason as ln, malformedResourcePropertiesWarning as lo, addSuperseded as lr, toCfnInteger as ls, recordDisplacedSkips as lt, CFN_TEMPLATE_BODY_LIMIT as lu, resolveDynamoDbDeleteBudgetMs as m, classifyReplaySecretRegion as ma, isUncertifiedBaselineMaskPosition as mc, waitForLambdaFunctionActive as mi, createAssetRedirectResolver as ml, retiredNameGenerationsAfter as mn, refuseDivergentRecordRegionForDestroy as mo, supersededAfterRollback as mr, configIntegerRefusal as ms, getCurrentNestedStackContext as mt, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as mu, recordedProtectionEvidence as n, recordedReferenceRegions as na, recordLogOnlyValue as nc, planTagDiff as ni, orphansAfterRollback as nl, getCurrentProducerRegions as nn, malformedOrphanRowsKeptWarning as no, replacedDeleteFailureVerdict as nr, MULTI_REGION_RECREATE_BLOCKED_TYPES as ns, recordRetainedForReadoption as nt, resolveSkipPrefix as nu, perType as o, explicitRoleArnOrThrow as oa, errorCauseChain as oc, tagPlanWarning as oi, PhaseClock as ol, redactedDeleteAddressFields as on, malformedOutputsWarning as oo, green as or, WARM_THROUGHPUT_MEMBERS as os, dropSettledNestedJournals as ot, stateBucketExistenceConfirmed as ou, resolveDynamoDbDeleteBudgetClock as p, classifyRecordedSecretRegion as pa, dynamicReferenceTokens as pc, wouldReturnToSdkProvider as pi, buildAssetRedirectMap as pl, retiredAfterRollback as pn, previewableOrphanRecords as po, removeSuperseded as pr, configBooleanRefusal as ps, collectNestedChildUnaddressed as pt, uploadCfnTemplate as pu, isSecretBearingReferenceString as q, isReadableResourceEntry as qa, acceptedCreateOnlyDropsOf as qc, s3BucketDualStackDomainName as qi, getDockerImageBySourceHash as ql, isPairableType as qn, withheldAccountClause as qo, withCreateTokenLedger as qr, recordReferenceProvenanceEntry as qs, planFailedOps as qt, recordedProtectionNote as r, applyRoleArnIfSet as ra, shareLogOnlyValues as rc, readTagList as ri, orphansCarriedFrom as rl, inheritProducerRegions as rn, malformedOrphansRefusalMessage as ro, bold as rr, isStatefulRecreateTargetForReplace as rs, NESTED_PENDING_PARENT_REASON as rt, resolveStateBucketWithDefault as ru, readProtection as s, isIamRoleArn as sa, maskSecretsInError as sc, definedAttributes as si, renderPhaseTimings as sl, redactedDeleteAddressSkip as sn, malformedRenderedContainersWarning as so, red as sr, coerceWarmThroughput as ss, getNestedRevertRun as st, warnDeprecatedNoPrefixCliFlag as su, DeployEngine as t, recordedOutputReferenceRegions as ta, recordLogOnlyParameterValue as tc, DBPROXY_TAG_OPTIONS as ti, isReadableBag as tl, findNestedStackTypeChanges as tn, malformedOrphanRecordsWarning as to, withStackRecords as tr, shownType as ts, keptForRetainedRecord as tt, resolveCaptureObservedState as tu, beginDeleteWait as u, applyCallerIdentityCredentials as ua, withPhysicalNameCopies as uc, ProviderRegistry as ui, isSensitiveAttributeName as ul, nameGenerationCarriedFrom as un, malformedResourcesWarning as uo, deleteSupersededEntry as ur, toFiniteNumber as us, revertNestedChildFromJournal as ut, CFN_TEMPLATE_URL_LIMIT as uu, maskedLogger as v, isUnboundTemplateParameter as va, recordNestedStackParameterExpressions as vc, getCurrentResourceSecrets as vi, BOOTSTRAP_MARKER_PREFIX as vl, namesAnyDeclaredParameter as vn, refuseMalformedOrphans as vo, withoutSuperseded as vr, requireConfigArray as vs, dropFailedHint as vt, canonicalizeRegion as vu, isTruthyCfnBoolean as w, isNamelessDynamicReferenceError as wa, carriesSecretMask as wc, slowCcOperationTimeoutMs as wi, readBootstrapMarkerBody as wl, secretBearing as wn, refuseMalformedResourceEntries as wo, completedReplayEntries as wr, withRetry as ws, formatResourceLine as wt, parseFailureDebugDetail as wu, ECR_AUTO_DELETE_IMAGES_TAG as x, isImpossibleEmptyStoredAttribute as xa, recordAttributeIdCopy as xc, applyCustomResourceResponseExpiration as xi, getBootstrapMarkerKey as xl, WITHHELD_NAME_DISPLAY as xn, refuseMalformedOutputs as xo, noEchoExactEchoLeavesOf as xr, prefetchCreateOnlyPropertyPaths as xs, loadJournaledOrphans as xt, StageLoadError as xu, relayedIndexBusyDelete as y, parameterTypeMayLoseSecretIdentity as ya, recoverMaskedOutput as yc, withPrintingSecrets as yi, assertAssetBucketRegion as yl, reachableDivergentParameters as yn, refuseMalformedOrphansForDestroy as yo, noEchoAttributeNamesOf as yr, requireConfigObject as ys, isHandledOrphan as yt, derivePartitionAndUrlSuffix as yu, templateIdentity as z, UNREADABLE_RESOURCES_MAP_ROW as za, CrossPrefixScanCache as zc, reEnableInstanceApiTermination as zi, partitionSensitiveEnv as zl, constructPathOf as zn, repairMalformedOrphansForReadOnly as zo, createPreDeleteFinalSnapshot as zr, passedNoEchoParametersOf as zs, refusePendingMovesOut as zt, resolveBucketRegion as zu };
-//# sourceMappingURL=deploy-engine-Dwe6OnF_.js.map
+export { pendingRequestCount as $, malformedLocalResourceEntriesWarning as $a, hasReasonlessBaselineRefusal as $c, keepHeldTokenProvenance as $i, getLegacyStateBucketName as $l, destroyStackRecordsView as $n, NO_CC_HANDLERS_REASON as $o, markDeleteStarted as $r, literalSplitDelimitersOf as $s, seedsDeleteFirstGuard as $t, inheritedProvenanceForChildDiff as A, refStateLookupFromResource as Aa, recordNoEchoAttributeValues as Ac, deleteSkipReason as Ai, buildDockerImage as Al, isWholeDynamicReferenceValue as An, refuseMalformedResourceEntriesForOrphan as Ao, secretNamePrintingBags as Ar, TemplateParser as As, readRefactorMarkerOnce as At, hasPlainPrototype$1 as Au, conditionFingerprint as B, UNREADABLE_RESOURCES_MAP_ROW as Ba, CrossPrefixReadError as Bc, DiffCalculator as Bi, isMalformedEnvKey as Bl, findDestructiveChanges as Bn, repairMalformedOrphansForReadOnly as Bo, effectiveDeletionPolicy as Br, passedNoEchoParametersOf as Bs, replayFailedOperations as Bt, clearBucketRegionCache as Bu, hasCdkAutoDeleteTag as C, carriesFetchableDynamicReference as Ca, recordAttributeIdCopy as Cc, CloudControlProvider as Ci, getBootstrapMarkerKey as Cl, exportAliasCollisionScrubWarning as Cn, refuseMalformedOutputsForDestroy as Co, createReadOnlyAttributeHealerFactory as Cr, templateResourceTypes as Cs, sameJournaledOrphans as Ct, StageLoadError as Cu, IMPLICIT_DELETE_DEPENDENCIES as D, cfnRefValueFromPhysicalId as Da, provenPublicValue as Dc, UNSPECIFIED_SKIP_REASON as Di, validateAssetBucketName as Dl, carriedExportAliasExposure as Dn, refuseMalformedResourceEntriesForDestroy as Do, namingSecretsWithRecordedNoEcho as Dr, lambdaFunctionNameForMask as Ds, lookupEachName as Dt, utf8ByteLength as Du, markRefusedBeforeApplying as E, AWS_NO_VALUE as Ea, carriesSecretMask as Ec, RollbackInlinePolicyWriters as Ei, readBootstrapMarkerBody as El, secretSafeKeyDisplay as En, refuseMalformedResourceEntriesForDeploy as Eo, maskEventTextWithBoundBags as Er, canonicalLambdaFunctionName as Es, isAccessDeniedError as Et, parseFailureDebugDetail as Eu, findNestedTemplateTreeDefect as F, declaresNoEcho as Fa, isSingleDynamicReferenceToken as Fc, ec2InstanceProtectionSite as Fi, dockerSpawnEnvWithSensitive as Fl, bindingSkippedOutputs as Fn, refuseMalformedResourcesForDeploy as Fo, ATOMIC_FINAL_SNAPSHOT_TYPES as Fr, maskWholeValue as Fs, updateRefactorMarker as Ft, displayAssemblyPath as Fu, withResourceDeadline as G, hasReadableOutputs as Ga, isNotImplemented as Gc, s3BucketArn as Gi, runDockerForeground as Gl, rollbackOrphanIds as Gn, unpreviewableOrphanRecords as Go, ledgerForStack as Gr, liveMatchesUnresolvedTokenFrame as Gs, isJournaledOrphan as Gt, parentSuppliedValues as H, deployRefusesOrphanRowsReason as Ha, applyCrossPrefixScan as Hc, IntrinsicFunctionResolver as Hi, redactDockerArgvValues as Hl, findRefactorHints as Hn, repairMalformedResourceEntriesForReadOnly as Ho, refusesFinalSnapshot as Hr, readsNoEchoSource as Hs, removeProtectionTypeList as Ht, isAbsoluteAssetPath as I, JSON_LISTING_HOLE_VALUE as Ia, LockManager as Ic, isTerminationProtectionPropagationError as Ii, finchSecretArgvRefusal as Il, DEFAULT_RESOURCE_TIMEOUT_MS as In, refuseMalformedResourcesForDestroy as Io, PRE_DELETE_SNAPSHOT_TYPES as Ir, maskedLeafCoordinatesOf as Is, hasPendingMovesOut as It, renderAssemblyPathEscape as Iu, keptWholeReasonText as J, isReadableResourceEntry as Ja, splitImportedOps as Jc, s3BucketRegionalDomainName as Ji, AssetManifestLoader as Jl, looselyEqual as Jn, withheldAccountClause as Jo, acquireIdempotencyToken as Jr, recordReferenceProvenanceEntry as Js, planRollback as Jt, diffSecurity as K, hasReadableResources as Ka, stackInstanceIdOf as Kc, s3BucketDomainName as Ki, runDockerStreaming as Kl, withMovedTo as Kn, unreadableOrphanRecords as Ko, reserveStackCreateToken as Kr, markSameGenerationBag as Ks, isReplacementOrphan as Kt, listNestedTemplateRows as L, STATE_REGION_DIVERGED as La, isLockInfoExpired as Lc, observeThenDisableInstanceApiTermination as Li, formatDockerLoginError as Ll, DEFAULT_RESOURCE_WARN_AFTER_MS as Ln, refuseMalformedResourcesForExport as Lo, buildFinalSnapshotIdentifier as Lr, noEchoCoordinatesOf as Ls, pendingMovesOutOf as Lt, resolveAssemblyPath as Lu, findServiceTokenRefusals as M, withSharedDrainBudget as Ma, recordProvenPublicExpression as Mc, isWaitAbandonedError as Mi, describeDockerCapturedOutput as Ml, collectDeclaredOutputNames as Mn, refuseMalformedResourcePropertiesForDrift as Mo, secretNamedRecordNeedles as Mr, isMarkedCoordinate as Ms, refactorMarkerRefusalMessage as Mt, ownValue as Mu, serviceTokenBlockingReason as N, parameterInputsFor as Na, wholeStringLeavesOf as Nc, markWaitAbandoned as Ni, describeDockerExecFailure as Nl, collectPublishedOutputNames as Nn, refuseMalformedResourcePropertiesForExport as No, stateSecretNameNeedles as Nr, maskAtCoordinates as Ns, refuseRefactorMarker as Nt, absoluteAssemblyPathEscape as Nu, computeImplicitDeleteEdges as O, isStalePlaceholderArnAttribute as Oa, recordMaskOnlyValue as Oc, deleteIndeterminateGuards as Oi, validateContainerRepoName as Ol, exportNameNoEchoParameters as On, refuseMalformedResourceEntriesForImport as Oo, orphanRecordsPrintingBag as Or, sameLambdaFunctionAddress as Os, withApiLimit as Ot, defineOwnKey as Ou, childTemplateLoader as P, passedParameterClassesOf as Pa, WHOLE_DYNAMIC_REFERENCE_PATTERN as Pc, disableInstanceApiTermination as Pi, describeDockerFailure as Pl, isExportAliasCollision as Pn, refuseMalformedResourcePropertiesForOrphan as Po, storedSecretNameNeedles as Pr, maskReadbackAtCoordinates as Ps, sameMove as Pt, describeFileReadFailure as Pu, planOrphanAdoption as Q, malformedLocalOutputsWarning as Qa, hasReadableExportSet as Qc, refuseUnreadableCdkCrossAccountRefs as Qi, getDefaultStateBucketName as Ql, awaitInFlightSibling as Qn, withoutSilentDropProperties as Qo, isRefusedByName as Qr, hasMaskableValues as Qs, resolveReplacementOldType as Qt, renderNestedTemplateTreeDefect as R, STATE_RESOURCES_MALFORMED as Ra, S3StateBackend as Rc, reDisableInstanceApiTermination as Ri, getDockerCmd as Rl, maskingRetryLogger as Rn, refuseMalformedState as Ro, ccRoutedFinalSnapshotError as Rr, noEchoLeavesOf as Rs, pendingMovesRefusalMessage as Rt, injectAwsRegion as Ru, S3_AUTO_DELETE_OBJECTS_TAG as S, carriesDynamicReference as Sa, physicalNameCopiesOf as Sc, customResourceResponseExpirationWarning as Si, ensureAssetStorage as Sl, displayTextOrWithheld as Sn, refuseMalformedOutputs as So, noEchoParameterNamesOf as Sr, prefetchCreateOnlyPropertyPaths as Ss, makeForeignHolderScan as St, AssemblyReader as Su, getPriorAttempts as T, keepsSecretReferenceToken as Ta, splitGetAttStringForm as Tc, unchangedBehindSecretReference as Ti, parseBootstrapMarker as Tl, secretBearingStateKeyWarning as Tn, refuseMalformedResourceEntries as To, journaledOrphanPrintingBag as Tr, withRetry as Ts, chunks as Tt, describeJsonParseFailure as Tu, readRecordedConditionVerdicts as U, displayLogicalId as Ua, crossPrefixDeniedWarning as Uc, poisonRenderedSpellingsCollidingIn as Ui, redactedCause as Ul, hintSidesOf as Un, repairMalformedResourcePropertiesForReadOnly as Uo, unsupportedFinalSnapshotError as Ur, recordedNoEchoValuesOf as Us, recordAfterRollbackUpdate as Ut, conditionInputsFrom as V, accountArgs as Va, CrossPrefixScanCache as Vc, INTRINSIC_KEYS as Vi, partitionSensitiveEnv as Vl, formatDestructiveChange as Vn, repairMalformedOutputsForReadOnly as Vo, isFinalSnapshotError as Vr, readbackPathFor as Vs, replayRollback as Vt, resolveBucketRegion as Vu, enclosingDeadlineRemainingMs as W, hasReadableOrphans as Wa, isAccessDenied$1 as Wc, isSettledInstanceState as Wi, redactedDockerCause as Wl, movedToHint as Wn, repairMalformedResourcesForReadOnly as Wo, earliestDefined as Wr, valueAtCoordinate as Ws, demoteSupersededOrphans as Wt, makeCanonicalizePropertiesFn as X, malformedExportNamesWarning as Xa, describeRegionValueKind as Xc, resolveDynamicReferences as Xi, Synthesizer as Xl, parseMappingFile as Xn, findSilentDropProperties as Xo, DeploymentEventsStore as Xr, carryLogOnlyValues as Xs, recordUnderIdIsNotOwn as Xt, mergeNoChangeOutputs as Y, malformedDriftResourcePropertiesWarning as Ya, acceptedCreateOnlyDropsOf as Yc, s3BucketWebsiteUrl as Yi, getDockerImageBySourceHash as Yl, mappingPairs as Yn, findActionableSilentDrops as Yo, DeploymentEventsReader as Yr, snapshotPassProvenance as Ys, recheckFailedPlan as Yt, makeSiblingClaimReader as Z, malformedExportSourceWarning as Za, exportNamesCarriedFrom as Zc, producerLookupOver as Zi, synthesisStatusMessage as Zl, proposeRenames as Zn, unwrittenCreateOnlyReplacement as Zo, extractDeploymentEventError as Zr, createUnionSecretMasker as Zs, replacementNeverSwapped as Zt, deleteTableWithIndexBusyRetry as _, coerceParameterTypedValue as _a, spelledKeysOf as _c, isCustomResourceType as _i, loadPublishableAssetManifest as _l, computeParameterTaint as _n, refuseMalformedOrphanRecords as _o, supersededResourcesOf as _r, readConfigString as _s, dropFailedCommands as _t, decodeListingKey as _u, isProtectionValueActive as a, assertSendableRoleArn as aa, unionOfSecretBags as ac, tagMapAsList as ai, orphansCarriedFrom as al, isRedactedRecordedValue as an, malformedOrphansWarning as ao, gray as ar, isStatefulRecreateTargetSync as as, displacedPhysicalIdShown as at, resolveStateBucketWithDefault as au, waitForIndexesSettled as b, getAccountInfo as ba, recordNestedStackParameterExpressions as bc, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as bi, BOOTSTRAP_MARKER_PREFIX as bl, resourcesNamingDeclaredParameter as bn, refuseMalformedOrphansForDestroy as bo, noEchoComparisonForTemplate as br, requireConfigObject as bs, journaledOrphanLines as bt, canonicalizeRegion as bu, DynamoDBGlobalTableProvider as c, sendableAssumeRoleCommand as ca, maskSecretsInError as cc, stringifyIfAssigned as ci, PhaseClock as cl, updatePartialMessage as cn, malformedRenderedContainersWarning as co, yellow as cr, coerceWarmThroughput as cs, nestedChildStackName as ct, stateBucketExistenceConfirmed as cu, compensateRemovedDeletionProtection as d, callerEnvCredentials as da, withPhysicalNameCopies as dc, ccBrokenReason as di, AssetPublisher as dl, nameGenerationHighWaterOf as dn, malformedResourcesWarning as do, holdsSupersededResources as dr, toFiniteNumber as ds, revertedNestedRowIds as dt, CFN_TEMPLATE_BODY_LIMIT as du, outputReferenceProvenanceOf as ea, logOnlyValueCount as ec, DBPROXY_TAGS_WHAT as ei, hasUnverifiableParameterRefusal as el, orphanNeedsIdentity as en, malformedLocalResourcesWarning as eo, getStackRecords as er, hasNoCloudControlHandlers as es, resolvePendingCloudControlRequests as et, loadCdkJson as eu, deleteBudgetKey as f, envCredentialsAreAssumedRole as fa, withoutPhysicalNameCopies as fc, isCustomResource as fi, isSensitiveAttributeName as fl, nameScopeOf as fn, malformedScrubResourceEntriesRefusalMessage as fo, isSupersededResourceRecord as fr, coerceCfnBoolean as fs, withNestedRevertRun as ft, CFN_TEMPLATE_URL_LIMIT as fu, INDEX_SETTLE_POLL_INTERVAL_MS as g, regionLessSecretName as ga, pathCrossesDottedKey as gc, readsNoEchoDeleteValues as gi, createAssetRedirectResolver as gl, withNameGenerationReached as gn, refuseMalformedNestedChildOutputs as go, supersededHolderOf as gr, configStringRefusal as gs, deleteJournaledOrphans as gt, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as gu, DELETE_INDEX_WAIT_PROCEED_NOTE as h, producerRegionsFromState as ha, isUncertifiedBaselineMaskPosition as hc, TemplateNoEchoReresolver as hi, buildAssetRedirectMap as hl, retiredNameGenerationsLeaving as hn, refuseDivergentRecordRegionForDestroy as ho, supersededHeldByOtherTypeWarning as hr, configIntegerRefusal as hs, withNestedStackContext as ht, uploadCfnTemplate as hu, PROTECTION_PROPERTY_BY_TYPE as i, assertFlagRoleArn as ia, shareLogOnlyValues as ic, refuseMalformedDesiredTags as ii, orphansAfterRollback as il, REDACTED_DELETE_ADDRESS_SKIP_REASON as in, malformedOrphansRefusalMessage as io, cyan as ir, isStatefulRecreateTargetForReplace as is, displacedOpClause as it, resolveSkipPrefix as iu, deferredServiceTokenWarning as j, parseWebACLArn as ja, recordNoEchoParameterFreshValue as jc, withIndeterminateGuard as ji, resolveDockerContextDirectory as jl, noEchoParameterValueSeed as jn, refuseMalformedResourcePropertiesForDestroy as jo, secretNamedAttributeNamesOf as jr, canonicalCoordinates as js, refactorMarkerMovesOf as jt, nullPrototypeRecord as ju, crossStackOutputProvenanceSource as k, lacksRecordedTableArn as ka, recordMaskOnlyValuesIn as kc, deleteLeftInPlace as ki, buildDenyExternalAccessPolicy as kl, exportNameSecretExposure as kn, refuseMalformedResourceEntriesForImportSave as ko, secretNamePrintingBag as kr, DagBuilder as ks, readRefactorMarker as kt, hasOwnKey as ku, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, AWS_CREDENTIAL_ENV_KEYS as la, maskSecretsInText as lc, CC_BROKEN_REASON as li, renderPhaseTimings as ll, updatePartialReason as ln, malformedResourceEntriesWarning as lo, addSuperseded as lr, isWarmThroughputDecrease as ls, recordDisplacedSkips as lt, warnDeprecatedNoPrefixCliFlag as lu, resolveDynamoDbDeleteBudgetMs as m, classifyReplaySecretRegion as ma, dynamicReferenceTokens as mc, waitForLambdaFunctionActive as mi, WorkGraph as ml, retiredNameGenerationsAfter as mn, previewableOrphanRecords as mo, supersededAfterRollback as mr, configBooleanRefusal as ms, getCurrentNestedStackContext as mt, findLargeInlineResources as mu, recordedProtectionEvidence as n, recordedReferenceRegions as na, recordLogOnlyParameterValue as nc, planTagDiff as ni, importableOutputs as nl, getCurrentProducerRegions as nn, malformedOrphanRecordsWarning as no, replacedDeleteFailureVerdict as nr, shownType as ns, recordRetainedForReadoption as nt, resolveAutoAssetStorage as nu, perType as o, explicitRoleArnOrThrow as oa, createSecretMasker as oc, tagPlanWarning as oi, shouldRetainResource as ol, redactedDeleteAddressFields as on, malformedOutputsRefusalMessage as oo, green as or, renderStatefulReason as os, dropSettledNestedJournals as ot, resolveStateBucketWithDefaultAndSource as ou, resolveDynamoDbDeleteBudgetClock as p, classifyRecordedSecretRegion as pa, DYNAMIC_REFERENCE_TOKEN_SCAN as pc, wouldReturnToSdkProvider as pi, stringifyValue as pl, retiredAfterRollback as pn, malformedStateRefusalMessage as po, removeSuperseded as pr, coerceCfnInteger as ps, collectNestedChildUnaddressed as pt, MIGRATE_TMP_PREFIX as pu, isSecretBearingReferenceString as q, isReadableOrphanRecord as qa, withStackInstanceIdWithheld as qc, s3BucketDualStackDomainName as qi, warnFinchArgvExposure as ql, isPairableType as qn, unreadableResourceEntries as qo, withCreateTokenLedger as qr, redactForState as qs, planFailedOps as qt, recordedProtectionNote as r, applyRoleArnIfSet as ra, recordLogOnlyValue as rc, readTagList as ri, isReadableBag as rl, inheritProducerRegions as rn, malformedOrphanRowsKeptWarning as ro, bold as rr, MULTI_REGION_RECREATE_BLOCKED_TYPES as rs, NESTED_PENDING_PARENT_REASON as rt, resolveCaptureObservedState as ru, readProtection as s, isIamRoleArn as sa, errorCauseChain as sc, definedAttributes as si, stackInstanceIdCarriedFrom as sl, redactedDeleteAddressSkip as sn, malformedOutputsWarning as so, red as sr, WARM_THROUGHPUT_MEMBERS as ss, getNestedRevertRun as st, resolveUseCdkBootstrapAssets as su, DeployEngine as t, recordedOutputReferenceRegions as ta, printingCorpusOf as tc, DBPROXY_TAG_OPTIONS as ti, importableOutputKeys as tl, findNestedStackTypeChanges as tn, malformedOrphanRecordsRefusalMessage as to, withStackRecords as tr, findReplacedReadersOfRecreateTargets as ts, keptForRetainedRecord as tt, resolveApp as tu, beginDeleteWait as u, applyCallerIdentityCredentials as ua, scrubResourceRecord as uc, ProviderRegistry as ui, timePhase as ul, nameGenerationCarriedFrom as un, malformedResourcePropertiesWarning as uo, deleteSupersededEntry as ur, toCfnInteger as us, revertNestedChildFromJournal as ut, ssmResolvedValueType as uu, maskedLogger as v, isUnboundTemplateParameter as va, identityKeyFor as vc, getCurrentResourceSecrets as vi, rewriteTemplateAssetReferences as vl, namesAnyDeclaredParameter as vn, refuseMalformedOrphanRecordsForDestroy as vo, withoutSuperseded as vr, replayWarn as vs, dropFailedHint as vt, expectedOwnerParam as vu, isTruthyCfnBoolean as w, isNamelessDynamicReferenceError as wa, recordPhysicalNameCopy as wc, slowCcOperationTimeoutMs as wi, isCrossRegionRedirect as wl, secretBearing as wn, refuseMalformedResourceAttributesForOrphan as wo, completedReplayEntries as wr, describeTypeWithThrottleRetry as ws, formatResourceLine as wt, processStackMessages as wu, ECR_AUTO_DELETE_IMAGES_TAG as x, isImpossibleEmptyStoredAttribute as xa, recoverMaskedOutput as xc, applyCustomResourceResponseExpiration as xi, assertAssetBucketRegion as xl, WITHHELD_NAME_DISPLAY as xn, refuseMalformedOrphansForOrphan as xo, noEchoExactEchoLeavesOf as xr, requireConfigString as xs, loadJournaledOrphans as xt, derivePartitionAndUrlSuffix as xu, relayedIndexBusyDelete as y, parameterTypeMayLoseSecretIdentity as ya, inheritNestedStackParameterAssociations as yc, withPrintingSecrets as yi, AssetModeResolver as yl, reachableDivergentParameters as yn, refuseMalformedOrphans as yo, noEchoAttributeNamesOf as yr, requireConfigArray as ys, isHandledOrphan as yt, PARTITION_TABLE as yu, templateIdentity as z, UNREADABLE_ORPHANS_CONTAINER_ROW as za, rebuildClientForBucketRegion as zc, reEnableInstanceApiTermination as zi, isDockerClientEnvKey as zl, constructPathOf as zn, repairMalformedOrphanRecordsForReadOnly as zo, createPreDeleteFinalSnapshot as zr, noEchoOutputsComparison as zs, refusePendingMovesOut as zt, injectedAwsRegionValue as zu };
+//# sourceMappingURL=deploy-engine-Bjr-FAuZ.js.map