@go-to-k/cdkd 0.288.3 → 0.288.4

package/dist/{deploy-engine-CfxcC3q3.js → deploy-engine-BiPxTgKT.js}

@@ -1,6 +1,6 @@
 import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-CEyZvTcB.js";
+import { t as getCdkdVersion } from "./version-BmM4QJ9t.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4017,6 +4017,18 @@ async function expectedOwnerParam(client) {
 * A caller whose value has a KNOWN ASCII charset (a stack name, an AWS region)
 * should pass `asciiOnly`, which is a positive allowlist and therefore has no
 * such residual at all.
+*
+* ONE CALLER DELIBERATELY GOES WIDER, and it is recorded here so an editor of
+* the residual note above knows a second module now disagrees with it.
+* `src/deployment/outputs-export-alias.ts` deletes a class derived from
+* `\p{Cc}` / `\p{Cf}` / `\p{Zl}` / `\p{Zp}` /
+* `\p{Default_Ignorable_Code_Point}`, because on THAT path the subject is a possibly
+* secret-bearing name in an operator's log: a plaintext split by a zero-width
+* character is READ as if it were contiguous, so it is disclosed without any
+* paste, and the command-forgery reasoning above does not transfer (issue
+* [#2874](https://github.com/go-to-k/cdkd/issues/2874)). Nothing here changes
+* -- widening this helper would alter every caller that merely wants a
+* terminal-safe string.
 */
 function displaySafe(value, opts) {
 	if (value === void 0 || value === null) return "";
@@ -19910,6 +19922,113 @@ function s3BucketWebsiteUrl(bucketName, region) {
 	return `http://${bucketName}.s3-website${S3_WEBSITE_ENDPOINT_LEGACY_DASH_REGIONS.has(folded) ? "-" : "."}${folded}.${urlSuffix}`;
 }
 
+//#endregion
+//#region src/deployment/drain-budget.ts
+/**
+* The drain BUDGET for one intrinsic resolution (issue
+* [#2563](https://github.com/go-to-k/cdkd/issues/2563)).
+*
+* Its own module rather than a corner of `intrinsic-function-resolver.ts`,
+* and that is forced rather than tidy: 70+ unit files `vi.mock` the resolver
+* module, and the ones that REPLACE its exports rather than spreading
+* `...actual` see no new export -- so an opener declared there, whether as a
+* resolver method or as a module-level function, reddens most of
+* `tests/unit/deployment` the moment `deploy-engine.ts` imports it (measured,
+* both ways). A module the engine and the resolver both import, and nobody
+* mocks, is the shape that works.
+*/
+/**
+* Named `drainDeadlines` from when it held one, and kept because the name is
+* cited from several comments and a rename is churn this issue does not need.
+* It holds a {@link DrainBudget} -- remaining WAIT, not an instant.
+*/
+const drainDeadlines = new AsyncLocalStorage();
+/**
+* Run `fn` under ONE drain budget (issue #2563), inheriting the caller's if
+* there is one.
+*
+* A module-level function rather than a resolver METHOD, deliberately: the
+* engine's callers mock the resolver wholesale, and a new method on that
+* surface would make every such mock throw before it resolved anything
+* (measured -- most of `tests/unit/deployment` red).
+*
+* Why a caller needs this. `resolve` opens a budget per CALL, and a caller
+* that resolves in a LOOP therefore gets one cap per iteration: the outputs
+* pass walks `template.Outputs` sequentially, so the DRAIN WAIT it could
+* spend before `saveState`, with the S3 lock held, was `#outputs x` the cap
+* rather than the cap. CloudFormation allows 200 outputs. Wrapping the loop
+* here bounds the total drain WAIT under it at one budget.
+*
+* The budget is REMAINING milliseconds of wait, not a deadline, and that
+* distinction is the whole of it: an absolute deadline is spent by wall
+* clock, so ordinary resolution time between drains burns it although
+* nothing drained -- an output failing with a 5 ms sibling would leave a
+* later one with zero grace after 60 s of clean AWS work. Charged only while
+* a drain is actually waiting, and only once for nested drains whose waits
+* overlap, an iteration that spent nothing keeps its full grace.
+*
+* WHAT IT DOES NOT BOUND, since the cap is not a deadline on the pass: the
+* cap is armed by a REJECTION and bounds only the extra wait a drain takes
+* after one. Ordinary resolution time is outside it entirely -- a lookup
+* that hangs with no sibling rejection anywhere is unbounded here exactly
+* as it was before this issue, and `withResourceDeadline` does not reach
+* the outputs pass. So this wrap bounds aggregate drain grace, not the
+* hold.
+*
+* THE TRADE, stated because it is real: iterations that actually WAIT spend
+* the shared budget, so a later one can find it exhausted and its drain get
+* no grace. That is the same exposure issue
+* [#2814](https://github.com/go-to-k/cdkd/issues/2814) records for nesting,
+* now reachable across a loop as well -- and on the `Export.Name` leg the
+* cost is a DROPPED write rather than a late one, since that block's
+* `nameSecrets` is a per-iteration local. What bounds it is that only real
+* waiting spends the budget: reaching zero takes a full cap of drain wait
+* inside one pass, not merely a slow pass. It is taken deliberately -- an
+* unbounded hold on a deploy's state save costs a first deploy every
+* resource it just created -- and the caller chooses, since a loop that
+* would rather buy grace per iteration simply does not wrap.
+*
+* `evaluateConditions` deliberately does NOT wrap its loop: a failed
+* condition is downgraded and evaluation continues, it runs before any
+* resource is provisioned, and one condition's slow parts should
+* not spend the next one's budget. Its aggregate is `#conditions x` the cap,
+* with the deploy lock already held -- less severe than the outputs pass,
+* where the state save is the thing waiting, but not lock-free.
+*
+* The other resolve LOOPS in the tree, assessed rather than assumed -- and
+* the first version of this note got two of them wrong, so each is stated
+* with what was checked:
+*
+* - `cdkd scrub` (`scrub.ts`): lock acquired above, `saveState` downstream,
+*   and its resolve loops -- the resources loop, two output loops, and
+*   `resolveCrossStackReads`, a per-leaf loop the other three each invoke.
+*   One budget is hoisted over all of them. That wrap is INLINE rather than
+*   around a callee, so the callee-keyed table in
+*   `intrinsic-resolver-concurrent-drain.test.ts` cannot see it; an
+*   owner-keyed case in that same file fences it instead.
+* - `cdkd import` (`import.ts`): `acquireLock` at the root and per child,
+*   `resolveImportedProperties` loops the resources, `saveState` follows.
+*   WRAPPED at both call sites.
+* - `cdkd export` (`export.ts`): child locks acquired before
+*   `buildResolvedParametersPerStack`, which loops `resolve` over the
+*   intrinsic parameters. WRAPPED.
+* - `diff-recursive.ts`: loops `resolve` over a parent's parameters with no
+*   lock and no state write -- a read-only diff. LEFT per-call, since a
+*   shared budget would buy no safety and would spend one resolution's
+*   grace on the next.
+*
+* The drain is what issue #2563 adds, so the wait in all four is new and
+* bounding it where it can hold something is part of adding it.
+*/
+async function withSharedDrainBudget(fn) {
+	if (drainDeadlines.getStore() !== void 0) return await fn();
+	return await drainDeadlines.run({
+		remaining: void 0,
+		waiting: 0,
+		since: void 0
+	}, fn);
+}
+
 //#endregion
 //#region src/deployment/secret-region-classification.ts
 /**
@@ -22133,6 +22252,170 @@ const MAX_LISTED_AVAILABLE_OUTPUTS = 10;
 */
 const dynamicReferenceRetryDelays = {};
 /**
+* How long {@link allSettledKeepingFirstRejection} waits for the remaining
+* parts AFTER a rejection is in hand. Double the largest FIXED wait in this
+* file (the `Fn::GetAtt` `Ipv6CidrBlocks` poll's sleep budget, 15 attempts
+* x 2 s), which makes it a hang guard rather than a schedule — not a
+* guarantee that healthy work fits inside it; see the function's own note.
+*
+* It is the budget for one CALL of {@link IntrinsicFunctionResolver.resolve}
+* and everything nested under it: nested drains share the REMAINING wait, so
+* a template's nesting depth cannot multiply it. It is NOT a bound on a caller
+* that resolves in a LOOP -- each iteration opens its own budget unless the
+* caller wraps the loop in {@link withSharedDrainBudget}, which the outputs
+* pass does and `evaluateConditions` deliberately does not (its aggregate is
+* `#conditions x` this, before any resource is provisioned but with the
+* deploy lock already held).
+*/
+const DRAIN_AFTER_REJECTION_MS = 6e4;
+/** Sentinel for "the cap expired", distinguishable from any resolved value. */
+const CAP_EXPIRED = Symbol("drain-cap-expired");
+/**
+* Test seam: overriding `ms` lets a unit test drive the cap without a real
+* minute of waiting (mirrors {@link dynamicReferenceRetryDelays}).
+*/
+const concurrentDrainCap = {};
+/**
+* `Promise.all`'s RESULT and its choice of error, with `Promise.allSettled`'s
+* TIMING: every promise started here has settled before this returns, and
+* before it throws unless the cap below expires first (issue
+* [#2563](https://github.com/go-to-k/cdkd/issues/2563)).
+*
+* Why the resolver needs that. Resolving a secret dynamic reference RECORDS
+* `plaintext -> expression` into `context.recordedSecretValues` just before
+* its promise settles, and that map is what every masking and redaction site
+* downstream uses as its needle set. Under a bare `Promise.all` a rejecting
+* part surfaces IMMEDIATELY, so a caller's `catch` / `finally` can run while a
+* sibling part is still in flight: `DeployEngine`'s `Export.Name` block copies
+* its private map into the pass map in exactly such a `finally`, and the
+* sibling's recording then lands in the private map after the copy and reaches
+* nothing. Draining here fixes it for every caller at once, which a
+* consumer-side drain cannot — `cdkd scrub`'s shared-map view (issue
+* [#2531](https://github.com/go-to-k/cdkd/issues/2531)) lets a late write land
+* whenever it happens but still cannot make it land before the next consumer
+* runs.
+*
+* THE ERROR IS SELECTED BY TIME, NOT BY INPUT ORDER, which is what `Promise.all`
+* does and what a naive `Promise.allSettled` + "first rejected entry" would
+* silently change: with two parts rejecting out of input order, the entry scan
+* reports the LATER one. Each promise gets its own `catch`, so the callbacks
+* fire in rejection order and the first assignment wins.
+*
+* Every input is `catch`-ed, so nothing here can raise an unhandled rejection
+* while the drain waits.
+*
+* THE WAIT IS CAPPED ONCE A REJECTION IS IN HAND. The drain exists to let a
+* sibling finish RECORDING, and that is worth a wait — but `resolveOutputs`
+* runs at `deploy-engine.ts`'s worst moment: after every resource has been
+* created in AWS, before the final `saveState`, with the S3 lock held and its
+* heartbeat pushing `expiresAt` forward. An unbounded wait there costs a deploy
+* its state and its lock, and on a FIRST deploy (`currentEtag` undefined, so
+* the incremental saves were no-ops) every created resource becomes invisible
+* to cdkd. Nothing else bounds it: `withRetry` caps ATTEMPTS not duration, no
+* `requestTimeout` is configured, and `withResourceDeadline` wraps
+* `provisionResourceBody` — which does bound the resource path, property
+* resolution included, but not the outputs pass. So once a rejection is
+* recorded the remaining settles race {@link DRAIN_AFTER_REJECTION_MS}, and the
+* recorded rejection is thrown when it expires.
+*
+* The cap is a HANG GUARD, and it does not claim to be more. It is sized
+* against the largest fixed wait in this file — the `Fn::GetAtt`
+* `Ipv6CidrBlocks` poll's sleep budget, 15 attempts x 2 s, about 30 s — but
+* that budget is a floor, not a ceiling: the poll also awaits 15 AWS calls,
+* and one part can drive several lookups in sequence through object
+* properties or `Fn::Sub` variables. Two healthy shapes measured on review
+* already exceed 60 s — three sequential `Ipv6CidrBlocks` polls in one part
+* is 3 x (15 x 2 s) = 90 s with no hang and no throttling, and five throttled
+* dynamic references is 5 x (1+2+4+8 s) = 75 s at
+* `MAX_DYNAMIC_REFERENCE_THROTTLE_RETRIES` = 4. Healthy work CAN therefore
+* outlast the cap, and when it does its recording lands after the rejection
+* was released, which is the window this whole function exists to close.
+* Nothing here cancels that sibling — it keeps running and can record
+* arbitrarily later — so what the cap bounds is the WAIT, not the lateness.
+* That is the trade taken deliberately: a bounded wait with a late record
+* still possible beyond it, against an unbounded hold on a deploy's state
+* save.
+*
+* AND A DRAIN CAN GET NO GRACE AT ALL. The budget is shared REMAINING wait,
+* so a drain that arms once it is spent gets
+* `Math.max(0, remaining - openWindow)` = 0 and releases its rejection on the
+* next macrotask. That applies to any drain NOT ALREADY ARMED when a rejection
+* reaches it: the ordinary case is an inner drain that spends the full budget
+* and throws, whose every not-yet-armed ancestor then arms against an
+* exhausted remaining-wait budget. What it does NOT mean is that a fast sibling is exposed: a
+* sibling still pending at that moment has itself been running at least the
+* budget. What it means is that the sibling's own RECORDING gets no wait --
+* a lookup begun late inside a long-running part is fast in itself and still
+* lands after the rejection was released. That reasoning covers the NESTED
+* ancestor case; a caller that wraps a LOOP widens it, because a later
+* iteration starts FRESH siblings against a budget an earlier one already
+* spent and those need not be long-running at all. So the exposure does not
+* require the "healthy work slower than 60 s" shape the sizing paragraph
+* describes; that shape is the cheapest way to reach it with no nesting and
+* no wrapped loop, not the floor.
+* Residual: issue
+* [#2814](https://github.com/go-to-k/cdkd/issues/2814).
+*
+* ONE REMAINING CONSEQUENCE, deliberate and pinned by a case rather than only
+* described: the earliest-in-time rule holds PER INVOCATION, not across
+* NESTED resolutions. For a join whose parts are `[listWithAnEarlyFailure,
+* laterFailure]`, the inner list's drain holds its own rejection while its
+* slow sibling finishes, so the outer join captures the later failure first
+* and reports that instead. That is not only cosmetic: the retry classifiers
+* DO read the message (`retryClassificationText` feeds
+* `isRetryableTransientError`, whose `RETRYABLE_ERROR_MESSAGE_PATTERNS` is an
+* explicit substring table), so swapping which failure surfaces can swap a
+* transient verdict for a terminal one. What does not change is that the
+* resolution FAILS: both are genuine failures of the same resolve, and the
+* selection was already timing-dependent — `Promise.all` reports whichever
+* lost the race. The drain adds a systematic bias toward the SHALLOWER
+* failure where the old race was arbitrary. Residual: issue
+* [#2805](https://github.com/go-to-k/cdkd/issues/2805).
+*/
+async function allSettledKeepingFirstRejection(promises) {
+	let rejection;
+	const shared = drainDeadlines.getStore();
+	let armCap;
+	const guarded = promises.map((promise) => promise.catch((error) => {
+		if (rejection === void 0) {
+			rejection = { error };
+			armCap?.();
+		}
+	}));
+	let capTimer;
+	let charged = false;
+	const capped = new Promise((resolve) => {
+		armCap = () => {
+			const budget = concurrentDrainCap.ms ?? DRAIN_AFTER_REJECTION_MS;
+			let wait = budget;
+			if (shared !== void 0) {
+				shared.remaining ??= budget;
+				const openWindow = shared.since === void 0 ? 0 : Date.now() - shared.since;
+				wait = Math.max(0, shared.remaining - openWindow);
+				if (shared.waiting === 0) shared.since = Date.now();
+				shared.waiting += 1;
+				charged = true;
+			}
+			capTimer = setTimeout(() => resolve(CAP_EXPIRED), wait);
+		};
+	});
+	try {
+		const outcome = await Promise.race([Promise.all(guarded), capped]);
+		if (rejection !== void 0) throw rejection.error;
+		if (outcome === CAP_EXPIRED) throw markNonRetryable(/* @__PURE__ */ new Error("drain cap expired with no rejection recorded"));
+		return outcome;
+	} finally {
+		if (capTimer !== void 0) clearTimeout(capTimer);
+		if (charged && shared !== void 0) {
+			shared.waiting -= 1;
+			if (shared.waiting === 0 && shared.since !== void 0) {
+				shared.remaining = Math.max(0, (shared.remaining ?? 0) - (Date.now() - shared.since));
+				shared.since = void 0;
+			}
+		}
+	}
+}
+/**
 * Is `region` safe to build an AWS SDK client from?
 *
 * This is a SECURITY gate, not an AWS region registry, and the distinction
@@ -23035,7 +23318,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* Resolve all intrinsic functions in a value
 	*/
 	async resolve(value, context) {
-		return await this.resolveValue(value, context);
+		return await withSharedDrainBudget(() => this.resolveValue(value, context));
 	}
 	/**
 	* Evaluate all conditions in the template
@@ -23077,7 +23360,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 		};
 		for (const name of Object.keys(templateConditions)) try {
-			await evaluateByName(name);
+			await withSharedDrainBudget(() => evaluateByName(name));
 		} catch (error) {
 			this.logger.warn(this.maskSecretsForLog(`Failed to evaluate condition ${name}: ${error instanceof Error ? error.message : String(error)}, assuming false`, maskingContext));
 			conditions[name] = false;
@@ -23093,7 +23376,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			if (typeof value === "string" && value.includes("{{resolve:")) return await this.resolveDynamicReferences(value, context);
 			return value;
 		}
-		if (Array.isArray(value)) return (await Promise.all(value.map((v) => this.resolveValue(v, context)))).filter((v) => v !== AWS_NO_VALUE);
+		if (Array.isArray(value)) return (await allSettledKeepingFirstRejection(value.map((v) => this.resolveValue(v, context)))).filter((v) => v !== AWS_NO_VALUE);
 		const obj = value;
 		if ("Ref" in obj) return await this.resolveRef(obj["Ref"], context);
 		if ("Fn::GetAtt" in obj) return await this.resolveGetAtt(obj["Fn::GetAtt"], context);
@@ -23920,7 +24203,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		let values = rawValues;
 		if (!Array.isArray(values)) values = await this.resolveValue(values, context);
 		if (!Array.isArray(values)) throw new Error(`Fn::Join's second argument must be a list (an array literal or a list-returning intrinsic such as Fn::Cidr / Fn::GetAZs / Fn::Split / a Ref to a list-typed parameter — any List<...> type or CommaDelimitedList), but resolved to ${typeof values}`);
-		let result = (await Promise.all(values.map(async (v) => {
+		let result = (await allSettledKeepingFirstRejection(values.map(async (v) => {
 			const resolved = await this.resolveValue(v, context);
 			return String(resolved);
 		}))).join(delimiter);
@@ -26660,7 +26943,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CQrHElrl.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-TexsJufw.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -31137,6 +31420,134 @@ function isExportAliasCollision(exportName, outputKey, ownedOutputNames) {
 */
 const MIN_SECRET_NEEDLE = 4;
 /**
+* Characters deleted before any secret containment test on this path, and
+* deleted from the text that gets PRINTED — ONE class, because the verdict and
+* the printed text have to live in the same string space (issue
+* [#2874](https://github.com/go-to-k/cdkd/issues/2874)).
+*
+* WHY A THIRD CLASS RATHER THAN EITHER SANITISER'S. `stripControlChars`
+* DELETES its class; `displaySafe` REPLACES its own with a space. Composing
+* them — which is what every site here used to do — leaves three different
+* strings in play: the raw key the verdict was taken from, the sanitised key
+* that was printed, and the masked one in between. A recorded secret split by
+* a DELETED character is absent from the raw key and contiguous in the printed
+* one, so the verdict said `safe` over text that held the plaintext; a secret
+* split by a REPLACED one is absent from both and prints one character short
+* of the plaintext, which a `not.toContain(SECRET)` assertion cannot see.
+* Measured across both classes: eight of ten characters reconstituted the
+* secret verbatim, and the remaining two printed it minus one character.
+*
+* So the fix is not another arm on the check — it is removing the second and
+* third string. Everything below happens in `canonicalForSecretScan` space.
+*
+* THE CLASS IS DERIVED FROM UNICODE CATEGORIES, NOT ENUMERATED. A hand list
+* was written first -- both sanitisers' classes plus the four residuals
+* `display-safe.ts` names -- and review measured it arbitrary: `U+2060`
+* (WORD JOINER) verdicted `safe` and printed visibly-contiguous plaintext
+* while `U+FEFF` was caught, and `U+2060` is the character Unicode itself
+* designates as the replacement for `U+FEFF` in that role. Eight more did the
+* same (`U+00AD`, `U+180E`, `U+FE0F`, `U+3164`, `U+2061`, `U+FFFB`, `U+115F`,
+* `U+17B4`). A list of the invisibles somebody happened to think of is not a
+* boundary; the general categories are.
+*
+* - `\p{Cc}` control and `\p{Cf}` format: the C0 / C1 and DEL ranges, the bidi
+*   marks / embeddings / overrides / isolates, the zero-width set, `U+FEFF`,
+*   `U+00AD`, `U+061C`, and the invisible-operator block.
+* - `\p{Zl}` / `\p{Zp}`: `U+2028` / `U+2029`, the two `displaySafe` REPLACES.
+* - `\p{Default_Ignorable_Code_Point}`: Unicode's own INTENT-TO-BE-IGNORED
+*   property, which carries the variation selectors, the Mongolian free
+*   variation selectors, the Hangul fillers and `U+034F` COMBINING GRAPHEME
+*   JOINER.
+*
+* - `\p{Me}` ENCLOSING marks. The same zero-advance-width shape as `\p{Mn}`
+*   below, and INCLUDED rather than deferred because the cost argument that
+*   defers `\p{Mn}` does not transfer: `\p{Me}` is about a dozen code points
+*   with no legitimate use in a resource name.
+*
+* NAMED RESIDUAL, because `\p{Default_Ignorable_Code_Point}` is Unicode's
+* INTENT-TO-BE-IGNORED property and NOT "everything that renders as nothing"
+* -- an earlier revision of this comment claimed the latter and review refuted
+* it. NONSPACING marks (`\p{Mn}`) carry zero advance width, so a secret split
+* by one renders contiguous while this class keeps it: measured with `U+09BC`,
+* which verdicts `safe` AND publishes the alias. Not widened here, because
+* `\p{Mn}` is the diacritics of Devanagari, Arabic, Hebrew and Vietnamese and
+* deleting it would mangle legitimate names for every user. Tracked as issue
+* [#2889](https://github.com/go-to-k/cdkd/issues/2889), which also carries the
+* homoglyph question. `origin/main` behaves identically, so this is a recorded
+* residual rather than something this change introduced.
+*
+* THE THIRD BULLET REPLACED A HAND TAIL, and the hand tail was measured
+* leaking. A first cut listed the ranges by hand -- `FE00-FE0F`,
+* `E0100-E01EF`, `180B-180D`, `115F`, `1160`, `3164`, `FFA0`, `17B4`, `17B5`
+* -- and review found `U+034F` outside it, printing `hunter2hunter2` in a
+* `warn` line under a `safe` verdict. It also spelled `180B-180D` while
+* calling itself "the Mongolian FVS", missing `U+180F`, which Unicode 14
+* added. Naming the PROPERTY is what makes the next such addition arrive
+* covered instead of arriving as another finding.
+*
+* WIDENED HERE AND NOT IN `display-safe.ts` because the two files answer
+* different questions. `displaySafe` is about a terminal rendering a value,
+* and its recorded reason for keeping these is command forgery -- where a
+* character that renders as nothing changes nothing. That reason does not
+* transfer to a secret: a plaintext split by an invisible character is READ by
+* a human exactly as if it were contiguous, so disclosure needs no paste.
+*
+* `tests/unit/deployment/secret-scan-class-superset.test.ts` fences this as a
+* SUPERSET of both sanitisers' classes by SCANNING CODE POINTS rather than by
+* comparing source text, so a future edit to either sanitiser that this class
+* does not cover reds -- the failure mode a hand list has and a derivation
+* does not.
+*/
+const SECRET_SCAN_INVISIBLES = /[\p{Cc}\p{Cf}\p{Me}\p{Zl}\p{Zp}\p{Default_Ignorable_Code_Point}]/gu;
+/**
+* The one string space in which this module tests for, masks, and prints a
+* possibly-secret-bearing name.
+*
+* `.trim()` mirrors `displaySafe`, whose trim this replaces on these paths. It
+* is applied to the TEXT only -- see {@link canonicalNeedle}, where trimming
+* would silently shorten a recorded secret.
+*/
+function canonicalForSecretScan(text) {
+	return text.replace(SECRET_SCAN_INVISIBLES, "").trim();
+}
+/**
+* A recorded secret as a NEEDLE in canonical space.
+*
+* STRIPPED BUT NOT TRIMMED. That is not an oversight of the symmetry with
+* {@link canonicalForSecretScan} but the deliberate asymmetry between a
+* haystack and a needle: whitespace at the edge of a recorded secret is part
+* of the secret and sits in the MIDDLE of a longer key, so trimming the needle
+* stops it matching there. Measured -- a recorded `"ab  "` embedded in
+* `x-ab  -y` was masked before this change and came back `safe` after it.
+*
+* Canonicalising the needle at all is what let the raw-key fallback arm go
+* away: a secret whose own plaintext carries a stripped character used to
+* survive in the raw key and be destroyed in the sanitised one, so it could be
+* DETECTED only from the raw form and MASKED in neither -- a permanent
+* `withheld`. Here it is both found and masked.
+*/
+function canonicalNeedle(plaintext) {
+	return plaintext.replace(SECRET_SCAN_INVISIBLES, "");
+}
+/**
+* The recorded secrets as NEEDLES, keyed by their canonical form.
+*
+* A needle whose canonical form is EMPTY is dropped: canonicalisation can turn
+* a non-empty recorded value into `''`, and `maskEveryOccurrence` splitting on
+* `''` interleaves the mask between every character of the key. The resolver
+* never records an empty secret, so nothing upstream guards this. Measured
+* without the guard: `OrdinaryKey` came back as
+* `O***r***d***i***n***a***r***y***K***e***y`.
+*/
+function canonicalNeedles(secrets) {
+	const out = /* @__PURE__ */ new Map();
+	for (const [plaintext, expression] of secrets ?? []) {
+		const needle = canonicalNeedle(plaintext);
+		if (needle.length > 0) out.set(needle, expression);
+	}
+	return out;
+}
+/**
 * Which recorded secrets are visible in `text`, or `undefined` when none is.
 *
 * ONE rule for both callers below, because they were inconsistent and the
@@ -31161,8 +31572,14 @@ const MIN_SECRET_NEEDLE = 4;
 */
 function secretsPresentIn(text, secrets) {
 	if (!secrets || secrets.size === 0) return void 0;
+	const haystack = canonicalForSecretScan(text);
 	const exposure = /* @__PURE__ */ new Map();
-	for (const [plaintext, expression] of secrets) if (text === plaintext || plaintext.length >= MIN_SECRET_NEEDLE && text.includes(plaintext)) exposure.set(plaintext, expression);
+	for (const [plaintext, expression] of secrets) {
+		const needle = canonicalNeedle(plaintext);
+		const canonicalHit = haystack === needle || needle.length >= MIN_SECRET_NEEDLE && haystack.includes(needle);
+		const rawHit = text === plaintext || plaintext.length >= MIN_SECRET_NEEDLE && text.includes(plaintext);
+		if (canonicalHit || rawHit) exposure.set(plaintext, expression);
+	}
 	return exposure.size > 0 ? exposure : void 0;
 }
 /**
@@ -31252,10 +31669,13 @@ function maskEveryOccurrence(text, exposure) {
 * unchanged. stderr is a reader like any other, so the invariant is absolute: a
 * message must never claim a masking it did not perform.
 */
-function secretBearingExportNameWarning(outputKey, exportName, exposure) {
-	const masked = stripControlChars(maskEveryOccurrence(exportName, exposure));
-	const shown = masked === stripControlChars(exportName) ? "" : `(masked: "${masked}") `;
-	return `Output ${stripControlChars(outputKey)} has an Export.Name that resolves to a value containing a secret ${shown}— skipping the export alias. An export name becomes a key in state.json and in the exports index, and redaction rewrites VALUES only, so publishing it would persist the secret in plaintext. Use a non-secret Export.Name.`;
+function secretBearingExportNameWarning(outputKey, exportName, exposure, secrets) {
+	const corpus = secrets ?? exposure;
+	const name = secretSafeKeyDisplay(exportName, corpus, exposure);
+	const shown = name.kind === "masked" ? `(masked: "${name.text}") ` : "";
+	const ownerForceMask = /* @__PURE__ */ new Map();
+	for (const [plaintext, expression] of exposure) if (plaintext === outputKey || canonicalNeedle(plaintext) === canonicalForSecretScan(outputKey) || plaintext.length >= MIN_SECRET_NEEDLE) ownerForceMask.set(plaintext, expression);
+	return `Output ${displayTextOrWithheld(secretSafeKeyDisplay(outputKey, corpus, ownerForceMask))} has an Export.Name that resolves to a value containing a secret ${shown}— skipping the export alias. An export name becomes a key in state.json and in the exports index, and redaction rewrites VALUES only, so publishing it would persist the secret in plaintext. Use a non-secret Export.Name.`;
 }
 /**
 * Test `key` for recorded secret plaintext and return how it may be shown.
@@ -31265,60 +31685,62 @@ function secretBearingExportNameWarning(outputKey, exportName, exposure) {
 * key safe to print" would disagree on the boundary cases those two encode
 * (the whole-key match for a sub-floor needle, longest-needle-first masking).
 *
-* SANITISED WITH BOTH helpers, because neither is a superset of the other —
-* measured, after a first cut swapped one for the other and silently traded
-* one class of character for another (issue #2667 review):
-*
-* | input    | `stripControlChars` | `displaySafe` |
-* | -------- | ------------------- | ------------- |
-* | `U+200E` | removed             | KEPT          |
-* | `U+200F` | removed             | KEPT          |
-* | `U+2028` | KEPT                | replaced      |
-* | `U+2029` | KEPT                | replaced      |
-*
-* `U+2028` / `U+2029` matter because this text is PERSISTED and re-rendered by
-* JSON and web log viewers that treat both as line terminators — the CI-log
-* surface this masking exists to protect, where an `Fn::Sub`-built export name
-* carrying one could forge a log line (`display-safe.ts` states that
-* rationale). `U+200E` / `U+200F` are the bidi MARKS, named as residuals in
-* that same file; they reorder rendered text without terminating a line. On a
-* path whose subject is a possibly-secret-bearing name in an operator's log,
-* neither loss is worth taking, and composing costs nothing.
-*
-* ORDER IS LOAD-BEARING, and for the OVERLAP set — not for the marks, which
-* an earlier revision of this comment named and measurement contradicted.
-* `displaySafe` never touches `U+200E` / `U+200F`, so those give identical
-* output either way. Where the two classes OVERLAP — `U+0000`-`U+001F`,
-* `U+007F`-`U+009F`, `U+202A`-`U+202E`, `U+2066`-`U+2069` — `stripControlChars`
-* DELETES while `displaySafe` replaces with a space, so strip-then-display
-* yields `"ab"` and display-then-strip yields `"a b"`. Stripping first keeps a
-* name carrying them from being padded out.
-*
-* `displaySafe` also `.trim()`s, which `stripControlChars` alone did not: a
-* display-shape change for a key with leading or trailing whitespace. Stated
-* because it is a real difference, not hidden.
-*
-* The sibling warnings in this file still use `stripControlChars` ALONE and
-* carry the `U+2028` half of the gap; widening that helper, or converting
-* them, changes call sites this issue does not touch, so it is filed as issue
-* [#2874](https://github.com/go-to-k/cdkd/issues/2874) rather than done here.
-*/
-function secretSafeKeyDisplay(key, secrets) {
-	const sanitise = (text) => displaySafe(stripControlChars(text));
-	const shown = sanitise(key);
-	const exposure = stateKeySecretExposure(shown, secrets) ?? stateKeySecretExposure(key, secrets);
-	if (!exposure) return {
+* CANONICAL SPACE, not a composition of the two sanitisers. An earlier
+* revision of this comment described running `stripControlChars` and then
+* `displaySafe`, with a table of what each one touches and a note that the
+* ORDER was load-bearing. That composition WAS the defect (issue
+* [#2874](https://github.com/go-to-k/cdkd/issues/2874)): it leaves three
+* strings in play -- the raw key the verdict came from, the sanitised key that
+* was printed, and the masked one between them -- and `stripControlChars`
+* DELETES, so a plaintext split by one of its characters is absent from the
+* first and contiguous in the second. See {@link SECRET_SCAN_INVISIBLES} for
+* the class that replaced it and why it is derived rather than enumerated.
+*/
+function secretSafeKeyDisplay(key, secrets, forceMask) {
+	const shown = canonicalForSecretScan(key);
+	const exposure = stateKeySecretExposure(key, secrets);
+	const mask = canonicalNeedles(forceMask);
+	for (const [plaintext, expression] of exposure ?? []) {
+		const needle = canonicalNeedle(plaintext);
+		if (needle.length > 0) mask.set(needle, expression);
+	}
+	if (mask.size === 0) return {
 		kind: "safe",
 		text: shown
 	};
-	const masked = sanitise(maskEveryOccurrence(shown, exposure));
-	if (masked === shown) return { kind: "withheld" };
+	const masked = maskEveryOccurrence(shown, mask);
+	if (masked === shown) return exposure ? { kind: "withheld" } : {
+		kind: "safe",
+		text: shown
+	};
+	if (stateKeySecretExposure(masked, secrets)) return { kind: "withheld" };
 	return {
 		kind: "masked",
 		text: masked
 	};
 }
 /**
+* The display for a name plus the verdict its CALLER needs, as one value.
+*
+* Exists so a caller cannot take the verdict from one call and the text from
+* another — the shape of the bug in {@link secretSafeKeyDisplay}'s own callers
+* (issue #2874), one level up.
+*/
+function secretBearing(display) {
+	return display.kind !== "safe";
+}
+/**
+* What a message prints in place of a name it may not show.
+*
+* Deliberately not name-shaped and never quoted as if it were a key: a reader
+* has to be able to tell this is the tool declining, not an odd export name.
+*/
+const WITHHELD_NAME_DISPLAY = "<name withheld: contains a secret>";
+/** The text of a display, or {@link WITHHELD_NAME_DISPLAY} when there is none. */
+function displayTextOrWithheld(display) {
+	return display.kind === "withheld" ? WITHHELD_NAME_DISPLAY : display.text;
+}
+/**
 * Warning for a state KEY that already holds secret plaintext — the residue an
 * EARLIER binary left when it published an export name that resolved to one.
 *
@@ -31329,8 +31751,9 @@ function secretSafeKeyDisplay(key, secrets) {
 * redeploy, which rewrites `state.outputs` wholesale and republishes the index.
 * Reported so the `--dry-run --fail` CI gate stops calling such a state clean.
 */
-function secretBearingStateKeyWarning(stackName, key, exposure) {
-	return `State for ${stripControlChars(stackName)} holds an output KEY containing a secret (masked: "${stripControlChars(maskEveryOccurrence(key, exposure))}") — cdkd scrub cannot rewrite a key, only a value, because the key IS the export name consumers resolve by. Give that output a non-secret Export.Name and redeploy: the next deploy replaces state.outputs and the exports index entirely. ROTATE the exposed secret.`;
+function secretBearingStateKeyWarning(stackName, display) {
+	const clause = display.kind === "masked" ? `(masked: "${display.text}") ` : `(the name is withheld: masking it would leave the secret readable) `;
+	return `State for ${canonicalForSecretScan(stackName)} holds an output KEY that renders a secret ${clause}— cdkd scrub cannot rewrite a key, only a value, because the key IS the export name consumers resolve by. Give that output a non-secret Export.Name and redeploy: the next deploy replaces state.outputs and the exports index entirely. ROTATE the exposed secret.`;
 }
 /**
 * Warning for an `Export.Name` colliding with an output NAME it does not own.
@@ -31339,13 +31762,18 @@ function secretBearingStateKeyWarning(stackName, key, exposure) {
 * says which value survives — the export is skipped, so the key keeps the
 * output's own value.
 *
-* No masking here, and none is needed: the name printed is one that MATCHED a
-* declared output name, i.e. template text, and a name carrying a secret is
-* refused by {@link secretBearingExportNameWarning} before this is reached.
-*/
-function exportAliasCollisionWarning(outputKey, exportName) {
-	const shown = stripControlChars(exportName);
-	const from = stripControlChars(outputKey);
+* MASKED HERE, and the bound that used to excuse it is named rather than
+* relied on. This message prints a name that MATCHED a declared output name --
+* template text -- and a secret-bearing `Export.Name` is refused by
+* {@link secretBearingExportNameWarning} upstream. But that is SOMEBODY ELSE'S
+* VERDICT, and this site is reached from exactly the arm taken when it MISSED:
+* before issue [#2874](https://github.com/go-to-k/cdkd/issues/2874)
+* canonicalised the containment scan, it missed for eight of ten invisible
+* characters, and this message printed the plaintext verbatim.
+*/
+function exportAliasCollisionWarning(outputKey, exportName, secrets) {
+	const shown = displayTextOrWithheld(secretSafeKeyDisplay(exportName, secrets));
+	const from = displayTextOrWithheld(secretSafeKeyDisplay(outputKey, secrets));
 	return `Output ${from} exports as "${shown}", which is also the name of another output in this stack — skipping the export alias, so output ${shown} keeps its own value and the export is not published. A consumer's Fn::ImportValue on "${shown}" therefore resolves to output ${shown}, NOT to ${from} (CloudFormation would publish both). Rename the export, or the colliding output.`;
 }
 /**
@@ -31360,12 +31788,12 @@ function exportAliasCollisionWarning(outputKey, exportName) {
 * {@link collectDeclaredOutputNames}.
 */
 function exportAliasCollisionScrubWarning(outputKey, exportName, secrets) {
-	const mask = (name) => {
-		const exposure = secretsPresentIn(name, secrets);
-		return stripControlChars(exposure ? maskEveryOccurrence(name, exposure) : name);
-	};
-	const shown = mask(exportName);
-	return `Output ${mask(outputKey)} exports as "${shown}", which is also the name of another output in this stack — state cannot say which of the two the stored value under "${shown}" came from, so that key is redacted by value match instead of by template position, and two references resolving to the same value could still collapse there. Rename the export, or the colliding output, and redeploy.`;
+	const nameDisplay = (name) => secretSafeKeyDisplay(name, secrets);
+	const exportDisplay = nameDisplay(exportName);
+	const shown = displayTextOrWithheld(exportDisplay);
+	const storedUnder = exportDisplay.kind === "withheld" ? "the stored value under that name" : `the stored value under "${shown}"`;
+	const ownerDisplay = nameDisplay(outputKey);
+	return `Output ${ownerDisplay.kind === "withheld" && exportDisplay.kind === "withheld" ? "<the owning output, name withheld: contains a secret>" : displayTextOrWithheld(ownerDisplay)} exports as ${exportDisplay.kind === "withheld" ? shown : `"${shown}"`}, which is also the name of another output in this stack — state cannot say which of the two ${storedUnder} came from, so that key is redacted by value match instead of by template position, and two references resolving to the same value could still collapse there. Rename the export, or the colliding output, and redeploy.`;
 }
 
 //#endregion
@@ -36322,7 +36750,7 @@ var DeployEngine = class {
 				this.logger.info("No changes detected. Stack is up to date.");
 				let persistedOutputs = currentState.outputs ?? {};
 				if (!this.options.dryRun) {
-					const resolvedOutputs = this.redactOutputs(await this.resolveOutputs(effectiveTemplate, currentState.resources, stackName, outputsDigestSource, parameterValues, conditions));
+					const resolvedOutputs = this.redactOutputs(await withSharedDrainBudget(() => this.resolveOutputs(effectiveTemplate, currentState.resources, stackName, outputsDigestSource, parameterValues, conditions)));
 					const resolutionFailed = Object.values(resolvedOutputs).some((v) => v === void 0);
 					const outputsChanged = !resolutionFailed && !outputMapsEqual(persistedOutputs, resolvedOutputs);
 					const currentEffectiveExports = new Set(importableOutputKeys(currentState));
@@ -36667,7 +37095,7 @@ var DeployEngine = class {
 		}
 		let outputs;
 		try {
-			outputs = await this.resolveOutputs(template, newResources, stackName, outputsDigestSource, parameterValues, conditions);
+			outputs = await withSharedDrainBudget(() => this.resolveOutputs(template, newResources, stackName, outputsDigestSource, parameterValues, conditions));
 			const resolvedOutputsBeforeRedaction = outputs;
 			outputs = this.redactOutputs(outputs);
 			this.rememberRecoverableMaskedOutputs(stackName, resolvedOutputsBeforeRedaction, outputs);
@@ -37865,9 +38293,16 @@ var DeployEngine = class {
 	* opposite sides of the same question. `secrets` is the outputs pass's own
 	* map: everything recorded before this handler runs, an `Export.Name`
 	* resolution's entries included (its `finally` merges them back before the
-	* `catch` reaches here). What a still-pending concurrent part would have
-	* recorded is outside both — issue #2563's late write, the same bound every
-	* other masking site in this engine has.
+	* `catch` reaches here). Since issue #2563 a still-pending concurrent part
+	* is in the PASS bag before this handler runs: the resolver drains every
+	* part it started before a rejection reaches a caller. Not
+	* unconditionally, and the weaker claim is the true one -- the drain is
+	* bounded, and since the outputs pass wraps BOTH its loops in one budget
+	* the bound spans the whole pass rather than one resolution: an early
+	* failing output can leave a later `Export.Name` drain with no wait at all,
+	* so a late record needs only a leg that had not finished recording by
+	* then rather than one that outlived a full cap. (`inheritedSecrets` is the parent's, and no
+	* resolution writes to it.)
 	*
 	* The strict arm's `cause` is masked as an OBJECT, through
 	* `maskSecretsInError` — a clone of each `Error` link `errorCauseChain`
@@ -37952,8 +38387,8 @@ var DeployEngine = class {
 				}
 				if (typeof exportName !== "string") continue;
 				const exposure = exportNameSecretExposure(exportName, nameSecrets, context.recordedSecretValues);
-				if (exposure) this.logger.warn(secretBearingExportNameWarning(outputKey, exportName, exposure));
-				else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) this.logger.warn(exportAliasCollisionWarning(outputKey, exportName));
+				if (exposure) this.logger.warn(secretBearingExportNameWarning(outputKey, exportName, exposure, context.recordedSecretValues));
+				else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) this.logger.warn(exportAliasCollisionWarning(outputKey, exportName, outputsPassSecrets));
 				else {
 					outputs[exportName] = value;
 					if (!this.resolvedExportNames.includes(exportName)) this.resolvedExportNames.push(exportName);
@@ -37987,5 +38422,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { ProviderRegistry as $, redactDockerArgvValues as $n, ResourceUpdateNotSupportedError as $r, STATE_SOURCED_READBACK_RULES as $t, renderStatefulReason as A, createAssetRedirectResolver as An, AssemblyReader as Ar, configStringRefusal as At, red as B, readBootstrapMarkerBody as Bn, ConfigError as Br, s3BucketDualStackDomainName as Bt, refusesFinalSnapshot as C, importableOutputKeys as Cn, uploadCfnTemplate as Cr, refStateLookupFromResource as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, stringifyValue as Dn, PARTITION_TABLE as Dr, assertRegionMatch as Dt, extractDeploymentEventError as E, AssetPublisher as En, expectedOwnerParam as Er, resolveExplicitPhysicalId as Et, formatResourceLine as F, assertAssetBucketRegion as Fn, getAwsClients as Fr, requireConfigString as Ft, isExportAliasCollision as G, buildDockerImage as Gn, IntrinsicResolutionRefusalError as Gr, INTRINSIC_KEYS as Gt, collectDeclaredOutputNames as H, validateContainerRepoName as Hn, DependencyError as Hr, s3BucketWebsiteUrl as Ht, bold as I, ensureAssetStorage as In, resetAwsClients as Ir, classifyReplaySecretRegion as It, stateKeySecretExposure as J, describeDockerFailure as Jn, LockError as Jr, describeTypeWithThrottleRetry as Jt, secretBearingStateKeyWarning as K, describeDockerCapturedOutput as Kn, LocalInvokeBuildError as Kr, findActionableSilentDrops as Kt, cyan as L, getBootstrapMarkerKey as Ln, setAwsClients as Lr, producerRegionsFromState as Lt, coerceWarmThroughput as M, rewriteTemplateAssetReferences as Mn, clearBucketRegionCache as Mr, replayWarn as Mt, isWarmThroughputDecrease as N, AssetModeResolver as Nn, resolveBucketRegion as Nr, requireConfigArray as Nt, isStatefulRecreateTargetForReplace as O, WorkGraph as On, canonicalizeRegion as Or, coerceCfnBoolean as Ot, toFiniteNumber as P, BOOTSTRAP_MARKER_PREFIX as Pn, AwsClients as Pr, requireConfigObject as Pt, clearOnUpdateRemoval as Q, partitionSensitiveEnv as Qn, ResourceTimeoutError as Qr, STATE_SOURCED_CROSS_GENERATION_RULES as Qt, gray as R, isCrossRegionRedirect as Rn, AssetError as Rr, s3BucketArn as Rt, isFinalSnapshotError as S, exportNamesCarriedFrom as Sn, findLargeInlineResources as Sr, parameterTypeMayLoseSecretIdentity as St, makeCanonicalizePropertiesFn as T, shouldRetainResource as Tn, displaySafe as Tr, normalizeAwsTagsToCfn as Tt, collectPublishedOutputNames as U, buildDenyExternalAccessPolicy as Un, DeployCancelledError as Ur, applyRoleArnIfSet as Ut, yellow as V, validateAssetBucketName as Vn, CrossAccountSecretRefusalError as Vr, s3BucketRegionalDomainName as Vt, exportAliasCollisionScrubWarning as W, describeAwsFailure as Wn, DynamicReferenceRegionAmbiguousError as Wr, DiffCalculator as Wt, IAMRoleProvider as X, formatDockerLoginError as Xn, PartialFailureError as Xr, DagBuilder as Xt, getCurrentResourceSecrets as Y, dockerSpawnEnvWithSensitive as Yn, NestedStackChildDirectDestroyError as Yr, withRetry as Yt, collectInlinePolicyNamesManagedBySiblings as Z, getDockerCmd as Zn, ProvisioningError as Zr, TemplateParser as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, buildLockContentionMessage as _n, stateBucketExistenceConfirmed as _r, carriesDynamicReference as _t, DeploymentEventsStore as a, isCdkdError as ai, isSingleDynamicReferenceToken as an, getDockerImageBySourceHash as ar, endCommandInterruptScope as at, ccRoutedFinalSnapshotError as b, CUSTOM_RESOURCE_RESPONSE_PREFIX as bn, CFN_TEMPLATE_URL_LIMIT as br, getAccountInfo as bt, replayFailedOperations as c, isMarkedNonRetryable as ci, recordMaskOnlyValue as cn, getDefaultStateBucketName as cr, startInterruptWatch as ct, updatePartialReason as d, isTransientServerError as di, scrubResourceRecord as dn, resolveAutoAssetStorage as dr, UNSPECIFIED_SKIP_REASON as dt, StackHasActiveImportsError as ei, TEMPLATE_SOURCED_RULES as en, runDockerForeground as er, wouldReturnToSdkProvider as et, withResourceDeadline as f, markNonRetryable as fi, LockManager as fn, resolveCaptureObservedState as fr, deleteIndeterminateGuards as ft, bindingSkippedOutputs as g, buildForceUnlockCommand as gn, resolveUseCdkBootstrapAssets as gr, IntrinsicFunctionResolver as gt, computeImplicitDeleteEdges as h, __exportAll as hi, UNRENDERABLE as hn, resolveStateBucketWithDefaultAndSource as hr, isTerminationProtectionPropagationError as ht, DeploymentEventsReader as i, formatError as ii, errorCauseChain as in, AssetManifestLoader as ir, beginCommandInterruptScope as it, WARM_THROUGHPUT_MEMBERS as j, loadPublishableAssetManifest as jn, processStackMessages as jr, readConfigString as jt, isStatefulRecreateTargetSync as k, buildAssetRedirectMap as kn, derivePartitionAndUrlSuffix as kr, configBooleanRefusal as kt, replayRollback as l, isRetryableTransientError as li, recoverMaskedOutput as ln, getLegacyStateBucketName as lr, CloudControlProvider as lt, IMPLICIT_DELETE_DEPENDENCIES as m, retryClassificationText as mi, rebuildClientForBucketRegion as mn, resolveStateBucketWithDefault as mr, disableInstanceApiTermination as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, StateError as ni, createSecretMasker as nn, escapeRegExp$1 as nr, maskDeep as nt, planFailedOps as o, normalizeAwsError as oi, maskSecretsInError as on, Synthesizer as or, interruptWatchListenerCount as ot, maskingRetryLogger as p, markRedactedCause as pi, S3StateBackend as pn, resolveSkipPrefix as pr, deleteSkipReason as pt, secretSafeKeyDisplay as q, describeDockerExecFailure as qn, LocalStartServiceError as qr, findSilentDropProperties as qt, DeployEngine as r, SynthesisError as ri, dynamicReferenceTokens as rn, stripControlChars as rr, maskerOrIdentity as rt, planRollback as s, withErrorHandling as si, maskSecretsInText as sn, synthesisStatusMessage as sr, isInterruptedWaitError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, StackTerminationProtectionError as ti, carriesSecretMask as tn, runDockerStreaming as tr, createMaskedRetryLogger as tt, updatePartialMessage as u, isThrottlingError as ui, redactSecretsForState as un, resolveApp as ur, slowCcOperationTimeoutMs as ut, PRE_DELETE_SNAPSHOT_TYPES as v, forceQuitRecoveryClause as vn, warnDeprecatedNoPrefixCliFlag as vr, cfnRefValueFromPhysicalId as vt, unsupportedFinalSnapshotError as w, importableOutputs as wn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as wr, WAFv2WebACLProvider as wt, createPreDeleteFinalSnapshot as x, DEFAULT_STATE_PREFIX as xn, MIGRATE_TMP_PREFIX as xr, isUnboundTemplateParameter as xt, buildFinalSnapshotIdentifier as y, shellQuote as yn, CFN_TEMPLATE_BODY_LIMIT as yr, coerceParameterTypedValue as yt, green as z, parseBootstrapMarker as zn, CdkdError as zr, s3BucketDomainName as zt };
-//# sourceMappingURL=deploy-engine-CfxcC3q3.js.map
+export { ProviderRegistry as $, partitionSensitiveEnv as $n, ResourceTimeoutError as $r, STATE_SOURCED_CROSS_GENERATION_RULES as $t, renderStatefulReason as A, buildAssetRedirectMap as An, derivePartitionAndUrlSuffix as Ar, configStringRefusal as At, red as B, parseBootstrapMarker as Bn, CdkdError as Br, s3BucketDomainName as Bt, refusesFinalSnapshot as C, exportNamesCarriedFrom as Cn, findLargeInlineResources as Cr, refStateLookupFromResource as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, AssetPublisher as Dn, expectedOwnerParam as Dr, assertRegionMatch as Dt, extractDeploymentEventError as E, shouldRetainResource as En, displaySafe as Er, resolveExplicitPhysicalId as Et, formatResourceLine as F, BOOTSTRAP_MARKER_PREFIX as Fn, AwsClients as Fr, requireConfigString as Ft, isExportAliasCollision as G, describeAwsFailure as Gn, DynamicReferenceRegionAmbiguousError as Gr, DiffCalculator as Gt, collectDeclaredOutputNames as H, validateAssetBucketName as Hn, CrossAccountSecretRefusalError as Hr, s3BucketRegionalDomainName as Ht, bold as I, assertAssetBucketRegion as In, getAwsClients as Ir, classifyReplaySecretRegion as It, secretSafeKeyDisplay as J, describeDockerExecFailure as Jn, LocalStartServiceError as Jr, findSilentDropProperties as Jt, secretBearing as K, buildDockerImage as Kn, IntrinsicResolutionRefusalError as Kr, INTRINSIC_KEYS as Kt, cyan as L, ensureAssetStorage as Ln, resetAwsClients as Lr, producerRegionsFromState as Lt, coerceWarmThroughput as M, loadPublishableAssetManifest as Mn, processStackMessages as Mr, replayWarn as Mt, isWarmThroughputDecrease as N, rewriteTemplateAssetReferences as Nn, clearBucketRegionCache as Nr, requireConfigArray as Nt, isStatefulRecreateTargetForReplace as O, stringifyValue as On, PARTITION_TABLE as Or, coerceCfnBoolean as Ot, toFiniteNumber as P, AssetModeResolver as Pn, resolveBucketRegion as Pr, requireConfigObject as Pt, clearOnUpdateRemoval as Q, getDockerCmd as Qn, ProvisioningError as Qr, TemplateParser as Qt, gray as R, getBootstrapMarkerKey as Rn, setAwsClients as Rr, withSharedDrainBudget as Rt, isFinalSnapshotError as S, DEFAULT_STATE_PREFIX as Sn, MIGRATE_TMP_PREFIX as Sr, parameterTypeMayLoseSecretIdentity as St, makeCanonicalizePropertiesFn as T, importableOutputs as Tn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Tr, normalizeAwsTagsToCfn as Tt, collectPublishedOutputNames as U, validateContainerRepoName as Un, DependencyError as Ur, s3BucketWebsiteUrl as Ut, yellow as V, readBootstrapMarkerBody as Vn, ConfigError as Vr, s3BucketDualStackDomainName as Vt, exportAliasCollisionScrubWarning as W, buildDenyExternalAccessPolicy as Wn, DeployCancelledError as Wr, applyRoleArnIfSet as Wt, IAMRoleProvider as X, dockerSpawnEnvWithSensitive as Xn, NestedStackChildDirectDestroyError as Xr, withRetry as Xt, getCurrentResourceSecrets as Y, describeDockerFailure as Yn, LockError as Yr, describeTypeWithThrottleRetry as Yt, collectInlinePolicyNamesManagedBySiblings as Z, formatDockerLoginError as Zn, PartialFailureError as Zr, DagBuilder as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, buildForceUnlockCommand as _n, resolveUseCdkBootstrapAssets as _r, carriesDynamicReference as _t, DeploymentEventsStore as a, formatError as ai, errorCauseChain as an, AssetManifestLoader as ar, endCommandInterruptScope as at, ccRoutedFinalSnapshotError as b, shellQuote as bn, CFN_TEMPLATE_BODY_LIMIT as br, getAccountInfo as bt, replayFailedOperations as c, withErrorHandling as ci, maskSecretsInText as cn, synthesisStatusMessage as cr, startInterruptWatch as ct, updatePartialReason as d, isThrottlingError as di, redactSecretsForState as dn, resolveApp as dr, UNSPECIFIED_SKIP_REASON as dt, ResourceUpdateNotSupportedError as ei, STATE_SOURCED_READBACK_RULES as en, redactDockerArgvValues as er, wouldReturnToSdkProvider as et, withResourceDeadline as f, isTransientServerError as fi, scrubResourceRecord as fn, resolveAutoAssetStorage as fr, deleteIndeterminateGuards as ft, bindingSkippedOutputs as g, __exportAll as gi, UNRENDERABLE as gn, resolveStateBucketWithDefaultAndSource as gr, IntrinsicFunctionResolver as gt, computeImplicitDeleteEdges as h, retryClassificationText as hi, rebuildClientForBucketRegion as hn, resolveStateBucketWithDefault as hr, isTerminationProtectionPropagationError as ht, DeploymentEventsReader as i, SynthesisError as ii, dynamicReferenceTokens as in, stripControlChars as ir, beginCommandInterruptScope as it, WARM_THROUGHPUT_MEMBERS as j, createAssetRedirectResolver as jn, AssemblyReader as jr, readConfigString as jt, isStatefulRecreateTargetSync as k, WorkGraph as kn, canonicalizeRegion as kr, configBooleanRefusal as kt, replayRollback as l, isMarkedNonRetryable as li, recordMaskOnlyValue as ln, getDefaultStateBucketName as lr, CloudControlProvider as lt, IMPLICIT_DELETE_DEPENDENCIES as m, markRedactedCause as mi, S3StateBackend as mn, resolveSkipPrefix as mr, disableInstanceApiTermination as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, StackTerminationProtectionError as ni, carriesSecretMask as nn, runDockerStreaming as nr, maskDeep as nt, planFailedOps as o, isCdkdError as oi, isSingleDynamicReferenceToken as on, getDockerImageBySourceHash as or, interruptWatchListenerCount as ot, maskingRetryLogger as p, markNonRetryable as pi, LockManager as pn, resolveCaptureObservedState as pr, deleteSkipReason as pt, secretBearingStateKeyWarning as q, describeDockerCapturedOutput as qn, LocalInvokeBuildError as qr, findActionableSilentDrops as qt, DeployEngine as r, StateError as ri, createSecretMasker as rn, escapeRegExp$1 as rr, maskerOrIdentity as rt, planRollback as s, normalizeAwsError as si, maskSecretsInError as sn, Synthesizer as sr, isInterruptedWaitError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, StackHasActiveImportsError as ti, TEMPLATE_SOURCED_RULES as tn, runDockerForeground as tr, createMaskedRetryLogger as tt, updatePartialMessage as u, isRetryableTransientError as ui, recoverMaskedOutput as un, getLegacyStateBucketName as ur, slowCcOperationTimeoutMs as ut, PRE_DELETE_SNAPSHOT_TYPES as v, buildLockContentionMessage as vn, stateBucketExistenceConfirmed as vr, cfnRefValueFromPhysicalId as vt, unsupportedFinalSnapshotError as w, importableOutputKeys as wn, uploadCfnTemplate as wr, WAFv2WebACLProvider as wt, createPreDeleteFinalSnapshot as x, CUSTOM_RESOURCE_RESPONSE_PREFIX as xn, CFN_TEMPLATE_URL_LIMIT as xr, isUnboundTemplateParameter as xt, buildFinalSnapshotIdentifier as y, forceQuitRecoveryClause as yn, warnDeprecatedNoPrefixCliFlag as yr, coerceParameterTypedValue as yt, green as z, isCrossRegionRedirect as zn, AssetError as zr, s3BucketArn as zt };
+//# sourceMappingURL=deploy-engine-BiPxTgKT.js.map