@go-to-k/cdkd 0.289.3 → 0.289.5

package/dist/{deploy-engine-DAykhfpV.js → deploy-engine-Dhgm0r8o.js}

@@ -1,6 +1,6 @@
-import { d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName } from "./logger-D2Md1kTq.js";
+import { d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, y as displaySafe } from "./logger-CecsQ1UT.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-DPykgdNN.js";
+import { t as getCdkdVersion } from "./version-DMsY_Ble.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1554,7 +1554,10 @@ function isCdkdError(error) {
 function formatError(error) {
 	if (isCdkdError(error)) {
 		let message = `${error.name}: ${error.message}`;
-		if (error.cause) message += `\nCaused by: ${error.cause.message}`;
+		if (error.cause) {
+			const cause = displaySafe(error.cause.message);
+			if (cause) message += `\nCaused by: ${cause}`;
+		}
 		return message;
 	}
 	if (error instanceof Error) return `${error.name}: ${error.message}`;
@@ -3987,56 +3990,6 @@ async function expectedOwnerParam(client) {
 	return owner ? { ExpectedBucketOwner: owner } : {};
 }
 
-//#endregion
-//#region src/utils/display-safe.ts
-/**
-* Make an untrusted value safe to render in a terminal or persist into a log.
-*
-* A LEAF module with no imports, and deliberately in `src/utils/` rather than
-* beside its first caller: issue [#2170](https://github.com/go-to-k/cdkd/issues/2170)'s
-* review found the same rule being widened BY HAND one module at a time and
-* missing an instance every round — the change sanitized 1 of 5 readers of
-* `LockInfo.owner`. One shared definition, imported by everything that renders
-* such a value, is what stops the next reader from inheriting nothing.
-*
-* The stripped class is wider than C0 + DEL, which a first cut used and which
-* misses every mechanism that actually forges a line:
-*
-* - `U+0085` (NEL) and the C1 range — xterm reads `U+009B` as CSI in UTF-8;
-* - `U+2028` / `U+2029` — this text is PERSISTED and re-rendered by JSON and
-*   web log viewers, where both are line terminators;
-* - `U+202A`-`U+202E` / `U+2066`-`U+2069` — the Trojan-Source bidi overrides
-*   and isolates, which visually REORDER the command being pasted.
-*
-* Known residual, recorded rather than implied away: the invisible formatters
-* (`U+200B`-`U+200D`, `U+FEFF`) and the bidi MARKS (`U+200E` / `U+200F` /
-* `U+061C`) survive, as do bare RTL letters, which no denylist can reach. All
-* of them can only make a rendered name differ visually from its bytes — the
-* command a user pastes still acts on exactly what is shown, and the blast
-* radius stays the attacker's own stack name.
-*
-* A caller whose value has a KNOWN ASCII charset (a stack name, an AWS region)
-* should pass `asciiOnly`, which is a positive allowlist and therefore has no
-* such residual at all.
-*
-* ONE CALLER DELIBERATELY GOES WIDER, and it is recorded here so an editor of
-* the residual note above knows a second module now disagrees with it.
-* `src/deployment/outputs-export-alias.ts` deletes a class derived from
-* `\p{Cc}` / `\p{Cf}` / `\p{Zl}` / `\p{Zp}` /
-* `\p{Default_Ignorable_Code_Point}`, because on THAT path the subject is a possibly
-* secret-bearing name in an operator's log: a plaintext split by a zero-width
-* character is READ as if it were contiguous, so it is disclosed without any
-* paste, and the command-forgery reasoning above does not transfer (issue
-* [#2874](https://github.com/go-to-k/cdkd/issues/2874)). Nothing here changes
-* -- widening this helper would alter every caller that merely wants a
-* terminal-safe string.
-*/
-function displaySafe(value, opts) {
-	if (value === void 0 || value === null) return "";
-	const text = String(value);
-	return (opts?.asciiOnly ? text.replace(/[^ -~]/g, " ") : text.replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029\u202a-\u202e\u2066-\u2069]/g, " ")).trim();
-}
-
 //#endregion
 //#region src/state/s3-replication-purge-gap.ts
 /**
@@ -9656,18 +9609,20 @@ var S3StateBackend = class {
 	async getState(stackName, region) {
 		await this.ensureClientForBucket();
 		const newKey = this.getStateKey(stackName, region);
+		const shownStackName = this.displayName(stackName);
+		const shownRegionName = displaySafe(region, { asciiOnly: true }) || "<unrenderable>";
 		try {
-			this.logger.debug(`Getting state for stack: ${stackName} (${region})`);
+			this.logger.debug(`Getting state for stack: ${shownStackName} (${shownRegionName})`);
 			const response = await this.s3Client.send(new GetObjectCommand({
 				Bucket: this.config.bucket,
 				...await this.ownerParam(),
 				Key: newKey
 			}));
-			if (!response.Body) throw new StateError(`State file for stack '${stackName}' (${region}) has no body`);
-			if (!response.ETag) throw new StateError(`State file for stack '${stackName}' (${region}) has no ETag`);
+			if (!response.Body) throw new StateError(`State file for stack '${shownStackName}' (${shownRegionName}) has no body`);
+			if (!response.ETag) throw new StateError(`State file for stack '${shownStackName}' (${shownRegionName}) has no ETag`);
 			const bodyString = await response.Body.transformToString();
 			const state = this.parseStateBody(bodyString, stackName);
-			this.logger.debug(`Retrieved state: ${stackName} (${region}), ETag: ${response.ETag}`);
+			this.logger.debug(`Retrieved state: ${shownStackName} (${shownRegionName}), ETag: ${response.ETag}`);
 			return {
 				state,
 				etag: response.ETag
@@ -9675,13 +9630,15 @@ var S3StateBackend = class {
 		} catch (error) {
 			if (!isNoSuchKey(error)) {
 				if (error instanceof StateError) throw error;
-				throw new StateError(`Failed to get state for stack '${stackName}' (${region}): ${error instanceof Error ? error.message : String(error)}`, error instanceof Error ? error : void 0);
+				const detail = displaySafe(error instanceof Error ? error.message : String(error), { asciiOnly: true }) || "<unrenderable>";
+				throw new StateError(`Failed to get state for stack '${shownStackName}' (${shownRegionName}): ${detail}`, error instanceof Error ? error : void 0);
 			}
-			this.logger.debug(`No state at new key for stack: ${stackName} (${region})`);
+			this.logger.debug(`No state at new key for stack: ${shownStackName} (${shownRegionName})`);
 		}
 		const legacy = await this.tryGetLegacy(stackName, region);
 		if (legacy) {
-			this.logger.warn(`Loaded legacy state for stack '${stackName}' from '${this.getLegacyStateKey(stackName)}'. It will be migrated to the region-scoped layout on next save.`);
+			const shownKey = displaySafe(this.getLegacyStateKey(stackName), { asciiOnly: true }) || "<unrenderable>";
+			this.logger.warn(`Loaded legacy state for stack '${shownStackName}' from '${shownKey}'. It will be migrated to the region-scoped layout on next save.`);
 			return {
 				...legacy,
 				migrationPending: true
@@ -10309,7 +10266,7 @@ var S3StateBackend = class {
 			const bodyString = await response.Body.transformToString();
 			const state = this.parseStateBody(bodyString, stackName);
 			if (state.region && state.region !== region) {
-				this.logger.debug(`Legacy state for stack '${stackName}' has region '${state.region}', not '${region}' — skipping legacy fallback.`);
+				this.logger.debug(`Legacy state for stack '${this.displayName(stackName)}' has region '${displaySafe(state.region, { asciiOnly: true }) || "<unrenderable>"}', not '${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}' — skipping legacy fallback.`);
 				return null;
 			}
 			return {
@@ -10318,7 +10275,8 @@ var S3StateBackend = class {
 			};
 		} catch (error) {
 			if (isNoSuchKey(error)) return null;
-			throw new StateError(`Failed to get legacy state for stack '${stackName}': ${error instanceof Error ? error.message : String(error)}`, error instanceof Error ? error : void 0);
+			const detail = displaySafe(error instanceof Error ? error.message : String(error), { asciiOnly: true }) || "<unrenderable>";
+			throw new StateError(`Failed to get legacy state for stack '${this.displayName(stackName)}': ${detail}`, error instanceof Error ? error : void 0);
 		}
 	}
 	/**
@@ -10332,10 +10290,15 @@ var S3StateBackend = class {
 		try {
 			parsed = JSON.parse(bodyString);
 		} catch (error) {
-			throw new StateError(`State file for stack '${stackName}' is not valid JSON: ${error instanceof Error ? error.message : String(error)}`, error instanceof Error ? error : void 0);
+			const raw = error instanceof Error ? error.message : String(error);
+			const detail = displaySafe(raw, { asciiOnly: true }) || "<unrenderable>";
+			throw new StateError(`State file for stack '${this.displayName(stackName)}' is not valid JSON: ${detail}`, error instanceof Error ? error : void 0);
 		}
 		const v = parsed.version;
-		if (v !== void 0 && !STATE_SCHEMA_VERSIONS_READABLE.includes(v)) throw new StateError(`Unsupported state schema version ${String(v)} for stack '${stackName}'. This cdkd binary supports versions ${STATE_SCHEMA_VERSIONS_READABLE.join(", ")}. Upgrade cdkd to a version that supports schema ${String(v)}.`);
+		if (v !== void 0 && !STATE_SCHEMA_VERSIONS_READABLE.includes(v)) {
+			const shown = displaySafe(String(v), { asciiOnly: true }) || "<unrenderable>";
+			throw new StateError(`Unsupported state schema version ${shown} for stack '${this.displayName(stackName)}'. This cdkd binary supports versions ${STATE_SCHEMA_VERSIONS_READABLE.join(", ")}. Upgrade cdkd to a version that supports schema ${shown}.`);
+		}
 		return parsed;
 	}
 };
@@ -10381,6 +10344,20 @@ const MIN_RENEWAL_INTERVAL_MS = 1e3;
 */
 const LOCK_OBJECT_DESCRIPTION = "a stack lock heartbeat, which records the lock owner, its acquisition timestamp, its deadline and the operation name — no secret, but one row per renewal";
 /**
+* One spelling of "this value came from an S3 key or a lock record, and is
+* about to be interpolated into a message a terminal will render". A stack
+* name and an AWS region both have a known charset, so the ASCII allowlist is
+* a no-op on every legitimate input while an S3 key admits any UTF-8.
+*
+* Call it for a stack name or a region. Not every value in this file goes
+* through it, and this comment does not say which do: three revisions of that
+* sentence carried a count or a scope claim and each was wrong.
+* `grep safeSegment` answers it exactly.
+*/
+function safeSegment(value) {
+	return displaySafe(value, { asciiOnly: true }) || "<unrenderable>";
+}
+/**
 * S3-based lock manager using conditional writes (If-None-Match)
 *
 * Implements distributed locking using S3's If-None-Match: "*" condition
@@ -10585,7 +10562,7 @@ var LockManager = class {
 				}
 				return false;
 			}
-			throw new LockError(`Failed to acquire lock for stack '${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}' (${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}): ${displaySafe(error instanceof Error ? error.message : String(error))}`, error instanceof Error ? error : void 0);
+			throw new LockError(`Failed to acquire lock for stack '${safeSegment(stackName)}' (${safeSegment(region)}): ${displaySafe(error instanceof Error ? error.message : String(error), { asciiOnly: true }) || "<unrenderable>"}`, error instanceof Error ? error : void 0);
 		}
 	}
 	/**
@@ -10628,18 +10605,19 @@ var LockManager = class {
 	async getLockRecord(stackName, region) {
 		await this.ensureClientForBucket();
 		const key = this.getLockKey(stackName, region);
+		const shownStack = safeSegment(stackName);
 		try {
-			this.logger.debug(`Getting lock info for stack: ${stackName}`);
+			this.logger.debug(`Getting lock info for stack: ${shownStack}`);
 			const response = await this.s3Client.send(new GetObjectCommand({
 				Bucket: this.config.bucket,
 				...await this.ownerParam(),
 				Key: key
 			}));
-			if (!response.Body) throw new LockError(`Lock file for stack '${stackName}' has no body`);
+			if (!response.Body) throw new LockError(`Lock file for stack '${shownStack}' has no body`);
 			const bodyString = await response.Body.transformToString();
 			const raw = JSON.parse(bodyString);
 			if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
-				this.logger.debug(`Lock file for stack ${stackName} is not an object; treating as absent`);
+				this.logger.debug(`Lock file for stack ${shownStack} is not an object; treating as absent`);
 				return null;
 			}
 			const parsed = raw;
@@ -10648,18 +10626,19 @@ var LockManager = class {
 				owner: displaySafe(parsed.owner),
 				...parsed.operation !== void 0 && { operation: displaySafe(parsed.operation) }
 			};
-			this.logger.debug(`Lock info for stack: ${stackName}:`, lockInfo);
+			this.logger.debug(`Lock info for stack: ${shownStack}:`, lockInfo);
 			return {
 				info: lockInfo,
 				etag: response.ETag
 			};
 		} catch (error) {
 			if (error instanceof NoSuchKey) {
-				this.logger.debug(`No lock exists for stack: ${stackName}`);
+				this.logger.debug(`No lock exists for stack: ${shownStack}`);
 				return null;
 			}
 			if (error instanceof LockError) throw error;
-			throw new LockError(`Failed to get lock info for stack '${stackName}': ${error instanceof Error ? error.message : String(error)}`, error instanceof Error ? error : void 0);
+			const detail = displaySafe(error instanceof Error ? error.message : String(error), { asciiOnly: true }) || "<unrenderable>";
+			throw new LockError(`Failed to get lock info for stack '${shownStack}': ${detail}`, error instanceof Error ? error : void 0);
 		}
 	}
 	/**
@@ -11156,7 +11135,7 @@ var LockManager = class {
 			if (lockInfo) {
 				const remainingMs = lockInfo.expiresAt - Date.now();
 				if (attempt < maxRetries) {
-					this.logger.info(`Stack '${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}' (${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}) is locked by ${lockInfo.owner}${lockInfo.operation ? ` (operation: ${lockInfo.operation})` : ""}. Lock expires in ${this.formatDuration(remainingMs)}. Retrying in ${this.formatDuration(retryDelay)}... (attempt ${attempt + 1}/${maxRetries})`);
+					this.logger.info(`Stack '${safeSegment(stackName)}' (${safeSegment(region)}) is locked by ${lockInfo.owner}${lockInfo.operation ? ` (operation: ${lockInfo.operation})` : ""}. Lock expires in ${this.formatDuration(remainingMs)}. Retrying in ${this.formatDuration(retryDelay)}... (attempt ${attempt + 1}/${maxRetries})`);
 					await new Promise((resolve) => setTimeout(resolve, retryDelay));
 					continue;
 				}
@@ -11166,8 +11145,8 @@ var LockManager = class {
 		const expiresIn = lockInfo ? this.formatDuration(lockInfo.expiresAt - Date.now()) : "unknown";
 		const forceUnlockCommand = buildForceUnlockCommand(stackName, region);
 		const recovery = forceUnlockCommand ? `If you are certain no other process is active, run: ${forceUnlockCommand}` : `If you are certain no other process is active, ${UNREPRODUCIBLE_LOCK_CLAUSE.charAt(0).toLowerCase()}${UNREPRODUCIBLE_LOCK_CLAUSE.slice(1)}`;
-		const safeStack = displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>";
-		const safeRegion = displaySafe(region, { asciiOnly: true }) || "<unrenderable>";
+		const safeStack = safeSegment(stackName);
+		const safeRegion = safeSegment(region);
 		throw new LockError(`Failed to acquire lock for stack '${safeStack}' (${safeRegion}) after ${maxRetries + 1} attempts. ` + (lockInfo ? `Locked by: ${lockInfo.owner}${lockInfo.operation ? `, operation: ${lockInfo.operation}` : ""}, expires in: ${expiresIn}. ` + recovery : `Lock exists but could not read lock info. ${recovery}`));
 	}
 };
@@ -11300,7 +11279,8 @@ function resolvedExpressionsOf(secrets) {
 * for the object it is handed. A copy of the bag, a derived needle map, a
 * previous generation's record, a scrub / drift walk and a bag nobody marked
 * all answer `false` and keep the fall-through. `cdkd import` marks the one
-* bag its own resolver produced (the sixth site below, issue #2745).
+* bag its own resolver produced (the sixth site below, issue #2745), and the
+* nested-stack recorder marks the COPY it positions (the seventh, same issue).
 *
 * A `WeakSet` for the reason {@link resolvedPairsOf} is a `WeakMap`: the mark
 * dies with the object it is on, and nothing has to clear it.
@@ -11335,9 +11315,9 @@ const sameGenerationBags = /* @__PURE__ */ new WeakSet();
 * and may skip it entirely. "Every leaf this pass produced" is false for the
 * auto-refresh readback of an UNCHANGED resource, where nothing was resolved
 * at all — there the safety comes from the empty secrets map, not from the
-* mark. Read the per-site list below rather than a rule over all six.
+* mark. Read the per-site list below rather than a rule over all seven.
 *
-* The six call sites, and which of them the record HOLDS, because the earlier
+* The seven call sites, and which of them the record HOLDS, because the earlier
 * "two never-installed copies" reading of this paragraph was false once the
 * third copy arrived:
 * - `propertiesToRecord` — the record's `properties`, installed. The resolved
@@ -11382,6 +11362,20 @@ const sameGenerationBags = /* @__PURE__ */ new WeakSet();
 *   it does NOT claim is that AWS holds the value: `observedProperties` is
 *   captured separately, against the redacted record, and is never marked
 *   here.
+* - `recordNestedStackParameterExpressions` (issue #2745) — a shallow COPY of
+*   a nested-stack row's resolved `Parameters` sub-bag, marked as the
+*   position pass's input so a sub-floor middle a literal frame embeds is
+*   written as its token there, which is what the recorder's sub-floor
+*   carry reads. NOT installed: the caller's own object is untouched, and
+*   whether THAT gets marked is decided at the caller (the deploy engine's
+*   two sites mark it later, in `propertiesToRecord`; the replay's three
+*   never do). Pair provenance holds at all five callers: the engine's two
+*   resolve the row in the pass that recorded the pairs, and the replay's
+*   three hand it the bag `resolveReplayProps` filled through
+*   `recordResolvedPair` from the journal rows it resolved just before -- the
+*   desired row, and on the update and failed-op arms the current or
+*   attempted row as well -- all within one replay, so every pair in it is
+*   that pass's own.
 */
 function markSameGenerationBag(bag) {
 	sameGenerationBags.add(bag);
@@ -11712,6 +11706,21 @@ function substringNeedlesOf(secrets) {
 * documented as "the expressions this pass recorded" must not silently contain
 * something that is not one: the day a candidate test stops requiring token
 * SHAPE, the sentinel would be live in it.
+*
+* A SECOND non-token class passes the filter, and is meant to: the FRAMED
+* whole-value entry `recordNestedStackParameterExpressions` writes for a
+* sub-floor carry (issue #2745) has a `port:{{resolve:...}}` value. It
+* enters the skeleton and frame candidate unions. The frame pattern is
+* anchored to the source's token and cannot match it; the SKELETON pattern of
+* an `Fn::Join` / `Fn::Sub` spelling the same frame around the same token
+* CAN, and then names that leaf's own frame around this pass's token -- the
+* correct expression for it, and one `isKnownSecretExpression` reads as
+* secret anyway, since the value is a map entry. What it DOES cost is the
+* length cap -- a framed value longer than
+* `MAX_SKELETON_CANDIDATE_LENGTH` makes both intrinsic arms refuse every
+* INTRINSIC-sourced leaf of the resource whose bag holds it; a literal-source
+* leaf keeps the span arm, which reads no candidate list (the recorder's doc
+* lists it).
 */
 function recordedExpressionsOf(secrets) {
 	const expressions = /* @__PURE__ */ new Set();
@@ -12081,6 +12090,14 @@ const NESTED_STACK_RESOURCE_TYPE$2 = "AWS::CloudFormation::Stack";
 */
 const nestedStackParameterExpressions = /* @__PURE__ */ new WeakMap();
 /**
+* Condition (iv)'s key (see {@link recordNestedStackParameterExpressions}) for
+* a `Parameters` spelling that is not a single-span literal frame of its
+* resolved value carrying this pass's pair for its token: an object source, a
+* plain literal, a two-span literal, a bag equal to its source, and a frame
+* whose token this pass never resolved to the middle (a PUBLIC sibling).
+*/
+const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
+/**
 * Record, for the pass that owns `secrets`, which `{{resolve:...}}` expression
 * each `Parameters` entry of a nested-stack row was resolved FROM (issue
 * #2291). No-op for every other resource type.
@@ -12154,6 +12171,127 @@ const nestedStackParameterExpressions = /* @__PURE__ */ new WeakMap();
 *    `return source`, which is the same string again), so both callers reach it.
 *    Fenced by the self-referential case in
 *    `secret-redaction-nested-parameter-source.test.ts`.
+*
+* THE SUB-FLOOR CARRY (issue #2745, its nested-stack site). A parameter the
+* parent spelled as a LITERAL frame around one token -- `Pin:
+* 'port:{{resolve:secretsmanager:S:SecretString:pin::}}'` -- resolves to
+* `port:q7`: not a key of the map (refusal 1), with a middle below
+* `MIN_NEEDLE_LENGTH`, so the child's carry (`inheritedSecretsCarriedBy`:
+* whole value at any length, substring at or above the floor) misses it both
+* ways and the child persisted `port:q7`. This recorder is the only point
+* holding the literal frame beside the pair, so the carry is written HERE:
+* the position pass runs over a MARKED shallow copy, on which
+* {@link positionByEmbeddedSpan} writes the frame on pair evidence, and a
+* second walk records `resolvedValue -> sourceLeaf`
+* (`'port:q7' -> 'port:{{resolve:...}}'`) as an ordinary WHOLE-VALUE entry of
+* the parent's own bag, under five conditions:
+*
+*   (i)   `positioned[name] === sourceLeaf` -- the pass CERTIFIED the leaf.
+*         On a literal source the span arm returns the source verbatim, so a
+*         mismatch proves it did not fire -- refusal 2b's test, applied to
+*         a literal source; pinned by the "map NO RESOLVER populated" case,
+*         where (ii) and (iii) both pass and only the missing pair refuses.
+*   (ii)  `redactSecretsForState(resolvedValue, secrets) === resolvedValue`
+*         -- the value scan is SILENT on it: the sub-floor gate, byte-for-byte
+*         the bound the span arm accepted. What it refuses is a middle at or
+*         above the floor, whose substring carry the child already has (the
+*         only refusal a test can see: the others coincide with (i) or with
+*         the map's own entry, as a whole-token source's would).
+*   (iii) `secrets.get(middle) === token` -- the token IS the map's survivor
+*         for the middle. Load-bearing: two framed parameters over ONE middle
+*         (`pin::` and `pin:AWSCURRENT:`) keep their own tokens on this row's
+*         record today because each reaches the span arm with the scan
+*         silent; once a `'port:q7'` entry exists the scan answers for the
+*         whole leaf and the arm's bound (`scanned === prefix + survivor +
+*         suffix`) decides. Recording only the frame whose token is the
+*         middle's survivor makes every parent leaf keep its own token by
+*         construction rather than by recording order.
+*   (iv)  ONE FRAME per VALUE, across the whole row. Once the entry exists
+*         the scan is no longer silent on the value, so on the parent's
+*         record every leaf holding it answers against the entry through the
+*         span arm's bound (`scanned === prefix + survivor + suffix`). The
+*         SAME frame around another token -- the (iii) shape, `port:` + A
+*         beside `port:` + B -- passes that bound and keeps its own token. A
+*         DIFFERENT frame (`port:` + `q7` beside `port` + `:q7`, each passing
+*         (i)-(iii) on its own), a leaf (iii) refused under a different
+*         frame, an object spelling and a plain literal equal to the value
+*         all fail it and would take the entry's frame -- and so would a
+*         same-frame sibling whose token this pass never resolved to the
+*         middle: a PUBLIC `ssm` reference in the same `port:` frame holding
+*         the same two characters is kept RESOLVED on the record, and the
+*         entry would rewrite it to the secret sibling's expression. So the
+*         frames (prefix + suffix) of every spelling of every string value in
+*         the row are gathered BEFORE the conditions run, a spelling that is
+*         not a single-span literal frame with this pass's pair for its token
+*         (`resolvedPlaintextOf`) counting as its own, and a value is
+*         recorded only when its certified frame is the row's only one.
+*   (v)   No OTHER string leaf of the ROW would be rewritten by the entry,
+*         read over every leaf of the resolved row since the bag is per
+*         resource, not per `Parameters`. Two arms of the persist walk read
+*         a map entry. The WHOLE-VALUE arm is floorless, so a leaf EQUAL to
+*         the value OUTSIDE `Parameters` (a `TemplateURL` that happens to
+*         equal it has no frame of its own and escapes (iv)) or inside a
+*         LIST-valued sibling parameter (an array here; `extractParameters`
+*         joins it back for the wire) refuses at any length; equality
+*         between string parameters is (iv)'s frame identity. The SUBSTRING
+*         arm is reached only by a value at or above `MIN_NEEDLE_LENGTH`
+*         (`port:q7` clears the floor its bare middle sits under), so a
+*         sibling merely CONTAINING the value -- `x-port` + `:q7` from
+*         another token, a plain literal `literal-port:q7-end` -- refuses
+*         only then, or it would be spliced with this frame on the parent's
+*         record, exactly the #2087 splice the child side is scoped against;
+*         a 3-character `pq7` beside such a sibling is carried, since no
+*         needle exists for it.
+*
+* Written AFTER the walk, so no iteration reads the recorder's own write --
+* a statement of intent rather than a pinned behaviour: under (iv) and (v)
+* an in-loop write is EQUIVALENT (a later value the entry would rewrite is
+* refused by (v), an equal one by (iv) or as the same entry), so no test can
+* red on the order, and it is kept so (ii)'s reading of the map cannot come
+* to depend on iteration order. No pair and no pin are recorded for the
+* entry: it is not a token
+* ({@link recordedExpressionsOf} names the class), and no consumer needs one
+* -- the child's carry, the child's persist (the floorless whole-value arm),
+* the diff side (`redactParametersForDiff`'s fallback) and the parent's
+* rollback record all read the map by whole value. Refusal 3's
+* self-referential shape cannot reach the write: {@link singleSpanFrame}
+* refuses a middle that is itself a token, which is what a bag equal to its
+* source has.
+*
+* WHAT STAYS OPEN, weighed against the three live consumers named on
+* {@link positionByIntrinsicFrame} (`cdkd rollback`, `drift --revert`, a
+* consumer's cross-stack read). (a) Over one middle with TWO tokens, (iii)
+* records the survivor's frames only, never a loser's, so the loser's child
+* leaf takes the survivor's frame when the two frames MATCH (`port:` + either
+* token: the survivor's entry is the loser's whole value too) and stays
+* PLAINTEXT when they differ (`port:` + A beside `url:` + B: no entry names
+* `port:q7`). Either is the pre-#2291 answer for this shape; on a match it is
+* the wrong reference those consumers re-resolve -- after the sibling
+* rotates, a rollback or `--revert` of the child hands the sibling's
+* plaintext to the loser's live property. The PARENT's record stays per leaf
+* by (iii) and (iv). One token framed two ways (`port:` + T and `url:` + T)
+* is two values and two entries, not this shape. (b) The framed
+* value is a SUBSTRING needle (7 characters here) in every child resource
+* that consumed the parameter, so an unrelated literal there containing it
+* is spliced -- the #2087 class, bounded to resources whose own resolution
+* consumed the parameter; on the parent's own row (v) refuses the entry
+* instead, over the leaves visible at record time -- a readback leaf AWS
+* rewrote to contain the value is spliced like any 4+ character needle's.
+* (c) A frame longer than
+* `MAX_SKELETON_CANDIDATE_LENGTH` makes both intrinsic arms refuse every
+* INTRINSIC-sourced leaf of that child resource, which then falls to the
+* value scan (a literal-source leaf keeps the span arm). (d) A child
+* OUTPUT carrying the framed value re-resolves in the parent to `port:q7`,
+* where the cross-stack seam refuses a non-token and the consumer's leaf
+* persists the plaintext -- the same class as the nonliteral-frame deferral.
+* (e) An OBJECT-spelled parameter source (`Fn::Join` / `Fn::Sub` in the
+* parent's own `Parameters` block) is out of this arm's reach -- (i) cannot
+* hold for one. #2745 scopes this site to the literal spelling; the object
+* spelling is issue #3062. (f) A child record persisted BEFORE this carry
+* keeps `port:q7` until the child is next redeployed: the parent's own row
+* already held the frame (the literal arm), so a parent deploy whose child
+* row is unchanged never re-runs the child, and `cdkd scrub` cannot repair
+* it either -- it walks the child's stored bag with no inherited bag.
 */
 function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, rules = TEMPLATE_DERIVED_RULES) {
 	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$2) return;
@@ -12164,7 +12302,7 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 	const resolvedParameters = resolvedProperties["Parameters"];
 	const sourceParameters = sourceProperties["Parameters"];
 	if (!isPlainObject$2(resolvedParameters) || !isPlainObject$2(sourceParameters)) return;
-	const positioned = redactSecretsForState(resolvedParameters, secrets, sourceParameters, rules);
+	const positioned = redactSecretsForState(markSameGenerationBag({ ...resolvedParameters }), secrets, sourceParameters, rules);
 	let table = nestedStackParameterExpressions.get(secrets);
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
 		if (typeof resolvedValue !== "string" || !secrets.has(resolvedValue)) continue;
@@ -12182,6 +12320,49 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 		}
 		storeAssociation(table, name, expression, resolvedValue);
 	}
+	const framesByValue = /* @__PURE__ */ new Map();
+	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
+		if (typeof resolvedValue !== "string") continue;
+		const sourceLeaf = sourceParameters[name];
+		const frame = typeof sourceLeaf === "string" ? singleSpanFrame(resolvedValue, sourceLeaf) : void 0;
+		const frames = framesByValue.get(resolvedValue) ?? /* @__PURE__ */ new Set();
+		frames.add(frame === void 0 || resolvedPlaintextOf(secrets, frame.token) !== frame.middle ? UNFRAMED_SPELLING : `${frame.prefix.length}:${frame.prefix}${frame.suffix}`);
+		framesByValue.set(resolvedValue, frames);
+	}
+	const rowWithoutParameters = {};
+	for (const [key, value] of Object.entries(resolvedProperties)) if (key !== "Parameters") rowWithoutParameters[key] = value;
+	const outsideLeaves = wholeStringLeavesOf(rowWithoutParameters);
+	const framed = /* @__PURE__ */ new Map();
+	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
+		const sourceLeaf = sourceParameters[name];
+		if (typeof resolvedValue !== "string" || typeof sourceLeaf !== "string") continue;
+		if (positioned[name] !== sourceLeaf) continue;
+		if (redactSecretsForState(resolvedValue, secrets) !== resolvedValue) continue;
+		const frame = singleSpanFrame(resolvedValue, sourceLeaf);
+		if (frame === void 0 || secrets.get(frame.middle) !== frame.token) continue;
+		if (framesByValue.get(resolvedValue)?.size !== 1) continue;
+		const isNeedle = resolvedValue.length >= 4;
+		const rewrites = (leaf) => leaf === resolvedValue || isNeedle && leaf.includes(resolvedValue);
+		let embedded = false;
+		for (const leaf of outsideLeaves) if (rewrites(leaf)) {
+			embedded = true;
+			break;
+		}
+		for (const other of Object.values(resolvedParameters)) {
+			if (embedded) break;
+			if (typeof other === "string") {
+				if (other !== resolvedValue && rewrites(other)) embedded = true;
+				continue;
+			}
+			for (const leaf of wholeStringLeavesOf(other)) if (rewrites(leaf)) {
+				embedded = true;
+				break;
+			}
+		}
+		if (embedded) continue;
+		framed.set(resolvedValue, sourceLeaf);
+	}
+	for (const [plaintext, expression] of framed) secrets.set(plaintext, expression);
 }
 /**
 * Copy a parent pass's per-PARAMETER associations onto a nested-stack CHILD
@@ -13047,10 +13228,14 @@ function positionByCrossStackSource(bag, source, secrets) {
 * template text, which genuinely can be a PUBLIC ssm reference that must stay
 * resolved in state (issue #1901), so it has to be tested. Here the candidates
 * come only from {@link recordedSecretExpressions} and from the values of a
-* {@link RecordedSecretValues} map, both of which the resolver populates ONLY
-* on a proven-secret verdict — so the test could never answer `false`, and an
-* unfalsifiable guard reads as protection while fencing nothing. Widening
-* either candidate source is what would make it necessary again.
+* {@link RecordedSecretValues} map, which the resolver populates ONLY on a
+* proven-secret verdict — and, since issue #2745, the nested-stack recorder's
+* framed carry entries ({@link recordedExpressionsOf}), which are not
+* references but ARE map values, so the same membership test reads them as
+* secret too. So the test could never answer `false`, and an
+* unfalsifiable guard reads as protection while fencing nothing. Widening the
+* candidate sources to a reference that can be public is what would make it
+* necessary again.
 */
 function positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions) {
 	if (bag === "" || !secrets.has(bag)) return void 0;
@@ -20533,11 +20718,15 @@ const drainDeadlines = new AsyncLocalStorage();
 *
 * THE TRADE, stated because it is real: iterations that actually WAIT spend
 * the shared budget, so a later one can find it exhausted and its drain get
-* no grace. That is the same exposure issue
+* no grace. That is the exposure issue
 * [#2814](https://github.com/go-to-k/cdkd/issues/2814) records for nesting,
-* now reachable across a loop as well -- and on the `Export.Name` leg the
-* cost is a DROPPED write rather than a late one, since that block's
-* `nameSecrets` is a per-iteration local. What bounds it is that only real
+* reachable across a loop as well: a part such a drain stops waiting for
+* records LATE. Late, not lost -- the engine's `Export.Name` block writes each
+* recording through to the pass map (it used to copy a per-iteration local,
+* which DROPPED a late one), and the outputs readers after the pass redact
+* against the pass map at the moment they read -- but a reader that already
+* took its copy does not see it, and the resolver warns when a drain stops
+* waiting. What bounds it is that only real
 * waiting spends the budget: reaching zero takes a full cap of drain wait
 * inside one pass, not merely a slow pass. It is taken deliberately -- an
 * unbounded hold on a deploy's state save costs a first deploy every
@@ -21297,6 +21486,61 @@ function configBooleanRefusal(container, key, containerPath) {
 	if (coerceCfnBoolean(value) !== void 0) return void 0;
 	return `${containerPath}.${key} must be a boolean ${malformedShapeDetail(value)}`;
 }
+/**
+* Coerce a CFn integer, which may arrive as the string `"32"`.
+*
+* Same reason as {@link coerceCfnBoolean}: CloudFormation is stringly typed, so
+* an imported or hand-written template legitimately spells `PasswordLength:
+* "32"`. A safe whole number, or a string that is a DECIMAL INTEGER LITERAL
+* (optional sign, then digits, nothing else), is the value; anything else —
+* `null`, `''`, `'abc'`, `3.5`, `'1e2'`, `'0x10'`, `' 32 '`, an object,
+* an unresolved intrinsic — is `undefined`, so a caller that indexed
+* `(x as number) || 32` cannot read a malformed member as its default. The
+* string grammar is exactly what CloudFormation's own validator accepts,
+* MEASURED (us-east-1, 2026-09-13, `AWS::SecretsManager::Secret
+* GenerateSecretString.PasswordLength`): `"+12"` and `"007"` pass, `" 12 "` fails
+* `expected type: Integer, found: String`, `"1e1"` fails `found: Float` —
+* so a padded string is refused HERE rather than minted from a template the
+* service rejects, and a signed one is accepted. Both branches use
+* `Number.isSafeInteger`, so one value gets one verdict whatever its
+* spelling.
+*
+* @returns the integer, or `undefined` when the value is not one.
+*/
+function coerceCfnInteger(value) {
+	if (typeof value === "number") return Number.isSafeInteger(value) ? value : void 0;
+	if (typeof value !== "string" || !/^[+-]?\d+$/.test(value)) return void 0;
+	const n = Number(value);
+	return Number.isSafeInteger(n) ? n : void 0;
+}
+/**
+* The integer twin of {@link configBooleanRefusal} (issue #3056): the same
+* CONTAINER-then-FIELD halves, the FIELD half being {@link coerceCfnInteger} —
+* the function the wire read calls. Exists for the member shape neither
+* sibling sees: `(config['PasswordLength'] as number) || 32` read a
+* malformed length as the default, and a non-numeric STRING (truthy) reached
+* `new Uint8Array('abc')` and minted an EMPTY password with no warning.
+*
+* @param min the smallest integer that is usable (a generated-password length
+*   of `0` is a value, not a refusal, to `Number.isInteger`, and it mints an
+*   empty secret); pass `1` for a count, `0` where zero is legitimate.
+* @param max the largest, when the API documents one — a value the service
+*   would reject is refused HERE, before a local consumer spends the work
+*   (`new Uint8Array(1e9)` allocates and spins before AWS ever sees the
+*   length). Omit when the API states no cap.
+* @returns The refusal sentence (`<path> must be …`), or `undefined` when the
+*   value is usable — including the ABSENT container / ABSENT key cases, which
+*   legitimately take the caller's default.
+*/
+function configIntegerRefusal(container, key, containerPath, min, max) {
+	if (container === void 0 || container === null) return void 0;
+	if (!isPlainObject$1(container) || isUnresolvedIntrinsicContainer(container)) return `${containerPath} must be an object ${malformedShapeDetail(container)}`;
+	const value = container[key];
+	if (value === void 0) return void 0;
+	const n = coerceCfnInteger(value);
+	if (n !== void 0 && n >= min && (max === void 0 || n <= max)) return void 0;
+	return `${containerPath}.${key} must be an integer ${max === void 0 ? `>= ${min}` : `between ${min} and ${max}`} ${malformedShapeDetail(value)}`;
+}
 /** The FIELD half of {@link configStringRefusal}, shared with {@link requireConfigString}. */
 function configValueRefusal(value, fallback, path, options) {
 	if (value === void 0) return void 0;
@@ -21373,9 +21617,13 @@ const NAMEABLE_INTRINSIC_KEYS = /* @__PURE__ */ new Set([
 * now throw on an intrinsic — `route53-provider.ts` (`HostedZoneConfig`),
 * `cloudfront-oai-provider.ts` (`CloudFrontOriginAccessIdentityConfig`),
 * `kinesis-provider.ts` (`StreamModeDetails`), `ecs-provider.ts`
-* (`DeploymentController`), `secretsmanager-secret-provider.ts`
-* (`GenerateSecretString`, via `generateSecretString`) and `codebuild-provider.ts`
-* (reached from `update()` through `mapProperties`). Not a count, for the same
+* (`DeploymentController`) and `codebuild-provider.ts` (reached from `update()`
+* through `mapProperties`). `secretsmanager-secret-provider.ts` was on this
+* list until issue #3048 moved its update path to a SKIP (the container is
+* refused by `requireConfigObject` before `generateSecretString` reads it,
+* and since issue #3056 every MEMBER read inside it takes the same skip
+* through an `onUnusable` callback; `create()` still throws on both). Not a
+* count, for the same
 * reason as the near-copy list below: two successive reviews each found
 * another. Re-derive with
 * `grep -rn 'readConfigString(' src/provisioning/providers/`.
@@ -23033,6 +23281,13 @@ const CAP_EXPIRED = Symbol("drain-cap-expired");
 */
 const concurrentDrainCap = {};
 /**
+* The budgets whose drain has already reported abandoned inputs (issue
+* [#2814](https://github.com/go-to-k/cdkd/issues/2814)). A `WeakSet` so a
+* budget's entry dies with the budget, as the budget itself does with the
+* async context that opened it.
+*/
+const abandonReported = /* @__PURE__ */ new WeakSet();
+/**
 * `Promise.all`'s RESULT and its choice of error, with `Promise.allSettled`'s
 * TIMING: every promise started here has settled before this returns, and
 * before it throws unless the cap below expires first (issue
@@ -23110,8 +23365,25 @@ const concurrentDrainCap = {};
 * require the "healthy work slower than 60 s" shape the sizing paragraph
 * describes; that shape is the cheapest way to reach it with no nesting and
 * no wrapped loop, not the floor.
-* Residual: issue
-* [#2814](https://github.com/go-to-k/cdkd/issues/2814).
+*
+* WHAT HAPPENS TO A PART THE CAP STOPS WAITING FOR (issue
+* [#2814](https://github.com/go-to-k/cdkd/issues/2814)). It keeps running, and
+* its recording still lands in the context's map whenever it arrives -- the
+* cap costs it ORDER, not the write. So the answer sits with the READERS: one
+* that runs after the recording arrives must see it, which `DeployEngine`'s
+* outputs pass arranges for its `Export.Name` block (a map that writes each
+* recording through to the pass map at once, where a local copied in a
+* `finally` used to drop it) and for the persisted outputs, the exports index
+* and the deploy summary (each redacting against the pass map as it stands
+* at the moment it is written). A reader that took its
+* copy BEFORE the recording arrived -- a failure message already printed, a
+* state save already sent -- cannot be helped without waiting, and the wait
+* is what the cap bounds. Cancelling the
+* part would not close that either: a cancelled part never records, so its
+* plaintext would be missing for EVERY reader rather than for the early ones.
+* What this helper adds is the report: releasing a rejection with inputs
+* still running calls `onAbandoned` with how many, at most once per budget,
+* and the resolver turns that into a warning.
 *
 * ONE REMAINING CONSEQUENCE, deliberate and pinned by a case rather than only
 * described: the earliest-in-time rule holds PER INVOCATION, not across
@@ -23129,11 +23401,16 @@ const concurrentDrainCap = {};
 * failure where the old race was arbitrary. Residual: issue
 * [#2805](https://github.com/go-to-k/cdkd/issues/2805).
 */
-async function allSettledKeepingFirstRejection(promises) {
+async function allSettledKeepingFirstRejection(promises, onAbandoned) {
 	let rejection;
 	const shared = drainDeadlines.getStore();
 	let armCap;
-	const guarded = promises.map((promise) => promise.catch((error) => {
+	let settled = 0;
+	const guarded = promises.map((promise) => promise.then((value) => {
+		settled += 1;
+		return value;
+	}, (error) => {
+		settled += 1;
 		if (rejection === void 0) {
 			rejection = { error };
 			armCap?.();
@@ -23158,7 +23435,17 @@ async function allSettledKeepingFirstRejection(promises) {
 	});
 	try {
 		const outcome = await Promise.race([Promise.all(guarded), capped]);
-		if (rejection !== void 0) throw rejection.error;
+		if (rejection !== void 0) {
+			const pending = promises.length - settled;
+			if (pending > 0) {
+				if (shared === void 0) onAbandoned(pending);
+				else if (!abandonReported.has(shared)) {
+					abandonReported.add(shared);
+					onAbandoned(pending);
+				}
+			}
+			throw rejection.error;
+		}
 		if (outcome === CAP_EXPIRED) throw markNonRetryable(/* @__PURE__ */ new Error("drain cap expired with no rejection recorded"));
 		return outcome;
 	} finally {
@@ -24126,6 +24413,17 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		return conditions;
 	}
 	/**
+	* Warn that a drain stopped waiting for `pending` inputs of a failed
+	* resolution (issue [#2814](https://github.com/go-to-k/cdkd/issues/2814)).
+	* The helper calls this at most once per budget. The text carries a count
+	* and the cap, nothing the template or AWS supplied, so it needs no masking.
+	*/
+	warnAbandonedParts(pending) {
+		const capSeconds = (concurrentDrainCap.ms ?? DRAIN_AFTER_REJECTION_MS) / 1e3;
+		const parts = pending === 1 ? "1 concurrent part was" : `${pending} concurrent parts were`;
+		this.logger.warn(`A resolution failed while ${parts} still running, and cdkd stopped waiting because the wait after a failure (capped at ${capSeconds}s) was used up. A secret such a part resolves from now on is still recorded, but only what runs after it arrives can mask it: output already printed or saved is not revisited.`);
+	}
+	/**
 	* Recursively resolve a value
 	*/
 	async resolveValue(value, context) {
@@ -24133,7 +24431,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			if (typeof value === "string" && value.includes("{{resolve:")) return await this.resolveDynamicReferences(value, context);
 			return value;
 		}
-		if (Array.isArray(value)) return (await allSettledKeepingFirstRejection(value.map((v) => this.resolveValue(v, context)))).filter((v) => v !== AWS_NO_VALUE);
+		if (Array.isArray(value)) return (await allSettledKeepingFirstRejection(value.map((v) => this.resolveValue(v, context)), (pending) => this.warnAbandonedParts(pending))).filter((v) => v !== AWS_NO_VALUE);
 		const obj = value;
 		if ("Ref" in obj) return await this.resolveRef(obj["Ref"], context);
 		if ("Fn::GetAtt" in obj) return await this.resolveGetAtt(obj["Fn::GetAtt"], context);
@@ -25040,7 +25338,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		let result = (await allSettledKeepingFirstRejection(values.map(async (v) => {
 			const resolved = await this.resolveValue(v, context);
 			return String(resolved);
-		}))).join(delimiter);
+		}), (pending) => this.warnAbandonedParts(pending))).join(delimiter);
 		if (result.includes("{{resolve:")) result = await this.resolveDynamicReferences(result, context);
 		this.logger.debug(`Resolved Fn::Join: ${this.maskSecretsForLog(result, context)}`);
 		return result;
@@ -28005,7 +28303,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-rQ1BW281.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DD_xuWE3.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -37316,6 +37614,47 @@ var DeploymentEventsReader = class {
 */
 const EMPTY_SECRETS = /* @__PURE__ */ new Map();
 /**
+* A secrets map that keeps its OWN entries and also writes each one through
+* to `target` the moment it is recorded (issue
+* [#2814](https://github.com/go-to-k/cdkd/issues/2814)).
+*
+* The outputs pass resolves each intrinsic `Export.Name` through one of these.
+* Its own entries are what `exportNameSecretExposure` reads as "substituted
+* into THIS name", which must stay exact -- a view of the whole pass map
+* (`cdkd scrub`'s `SharedEntriesSecrets`) would report every secret the pass
+* has recorded as one the name holds, and refuse every alias. The write-through
+* is what a copy could not give: a part the drain cap stopped waiting for
+* records AFTER the name's block has ended, and when this was a local copied
+* into the pass map in a `finally`, such a record reached nothing.
+*
+* Only `set` writes through: it is the one operation the resolver performs on
+* a recording map (grepped -- no resolver path calls `delete` or `clear` on
+* one). `cdkd scrub`'s `SharedEntriesSecrets` overrides those too, and the
+* asymmetry is deliberate: that one is a VIEW holding no entries of its own,
+* while a `delete` here would leave the pass map carrying an entry this map
+* dropped -- one needle too many, which over-redacts rather than leaks.
+* The ENTRIES only, never the resolved pairs beside them
+* (issue #2485): those are keyed by map INSTANCE (`recordResolvedPair`), so
+* they stay on this one. A name never positions a leaf, and a value re-using
+* the same token records its own pair at the seam, so carrying them could add
+* nothing -- what it COULD do is mark a pair conflicting (an `ssm` reference
+* whose `Type` came back unclassifiable is never cached, so a name resolving
+* it re-asks AWS and can see a value that moved since the value pass) and
+* destroy the positioning the value pass had earned.
+*/
+var ForwardingSecrets = class extends Map {
+	target;
+	constructor(target) {
+		super();
+		this.target = target;
+	}
+	set(plaintext, expression) {
+		super.set(plaintext, expression);
+		this.target?.set(plaintext, expression);
+		return this;
+	}
+};
+/**
 * Default per-resource warn threshold: warn the user when a single
 * resource has been in flight for 5 minutes. Most CC API resources
 * complete in under a minute; 5m is the agreed elbow.
@@ -37590,6 +37929,16 @@ var DeployEngine = class DeployEngine {
 	*/
 	outputSecrets = /* @__PURE__ */ new Map();
 	/**
+	* The outputs pass's own recording map(s), one per `resolveOutputs` call
+	* this deploy, so every redaction of the outputs bag re-reads them rather
+	* than trusting the copy taken when the pass ended (issue
+	* [#2814](https://github.com/go-to-k/cdkd/issues/2814)): a part the drain
+	* cap stopped waiting for records into its pass map LATE, and the final
+	* save, the exports index and the deploy summary all run after that copy.
+	* Reset per `deploy()`.
+	*/
+	outputsPassSecretMaps = [];
+	/**
 	* UNRESOLVED template `Outputs` values, keyed by output name (issue #1910) —
 	* the outputs' POSITION source, the sibling of `perResourceTemplateProps` for
 	* the bag `resolveOutputs` produces. Without it two outputs resolving one
@@ -37718,6 +38067,7 @@ var DeployEngine = class DeployEngine {
 		this.perResourceResolvedType = /* @__PURE__ */ new Map();
 		this.attemptedResolvedProps = /* @__PURE__ */ new Map();
 		this.outputSecrets = /* @__PURE__ */ new Map();
+		this.outputsPassSecretMaps = [];
 		this.outputsTemplateSource = Object.create(null);
 		this.outputsSourceUsable = true;
 		this.skippedOutputs = void 0;
@@ -37789,12 +38139,16 @@ var DeployEngine = class DeployEngine {
 	* Redact the resolved stack OUTPUTS bag, positioned by the unresolved
 	* template `Outputs` values (issue #1910).
 	*
-	* A single entry point because THREE call sites redact this same bag — the
-	* state-persist choke point, the no-change re-check, and the post-deploy
-	* publish that feeds the exports index / deploy summary — and before this
-	* they each spelled the value-only redaction separately. Two outputs
-	* resolving one secret collapsed onto whichever expression was recorded last
-	* at all three.
+	* A single entry point because SEVEN call sites redact this same bag — the
+	* state-persist choke point, the no-change re-check, that path's exports
+	* index and deploy summary, the changes path's index and summary, and the
+	* outputs pass itself. THREE of those are the ones issue #1910 unified —
+	* the persist choke point, the re-check, and the outputs pass, which the
+	* list above ends on rather than opens with: before it they each spelled
+	* the value-only redaction separately, and two outputs resolving one secret
+	* collapsed onto whichever expression was recorded last at all three. The
+	* other FOUR are issue #2814's, both paths' index and summary: each read
+	* the bag unredacted until then, and now redacts at the moment it reads.
 	*/
 	/**
 	* Record the plaintext behind every output {@link redactOutputs} just masked,
@@ -37807,9 +38161,18 @@ var DeployEngine = class DeployEngine {
 	* value read back out of a previous run's state — is skipped, because there
 	* is no plaintext behind it to remember.
 	*
-	* Called only from the REAL-DEPLOY outputs pass. The other two `redactOutputs`
-	* callers hand it a bag from a previous generation, where a mask is already
-	* unrecoverable and pretending otherwise would serve a stale value.
+	* Called only from the REAL-DEPLOY outputs pass. Of the six other
+	* `redactOutputs` callers, three CAN hand it a bag from a previous
+	* generation — the persist walk always may, and the no-change path's
+	* exports index and summary do on the arms where that path keeps the
+	* previous bag — and there a mask is already unrecoverable, so pretending
+	* otherwise would
+	* serve a stale value. The other three are not this pass either: the
+	* no-change path performs the FIRST redaction of its own resolution there,
+	* and the changes path's index and summary re-redact the bag this pass
+	* already produced. (The "other two" this replaces counted the base's three
+	* callers correctly; what was wrong was calling both of the others
+	* previous-generation, when only the persist walk was one.)
 	*/
 	rememberRecoverableMaskedOutputs(stackName, resolved, redacted) {
 		if (resolved === redacted) return;
@@ -37820,7 +38183,51 @@ var DeployEngine = class DeployEngine {
 			recordRecoverableMaskedOutput(stackName, this.stackRegion, key, plaintext);
 		}
 	}
+	/**
+	* Fold every outputs-pass recording map into `outputSecrets` — the entries,
+	* and the uncollapsed evidence beside them (issue #2485: without it a
+	* literal Output embedding one of two same-plaintext references would lose
+	* its span positioning and persist the sibling's expression). Only what the
+	* outputs pass itself resolved, so the outputs redaction (GHSA fix) uses
+	* only outputs-substituted references: a literal output equal to a secret
+	* nothing resolved is not recorded, and is not touched.
+	*
+	* Run by every {@link redactOutputs} (issue
+	* [#2814](https://github.com/go-to-k/cdkd/issues/2814)), because a part the
+	* drain cap stopped waiting for records into its pass map LATE: a secret
+	* that arrives between the pass and the final save is then still a needle
+	* for the save, the exports index and the deploy summary. Repeating it is
+	* safe for the ENTRIES — re-setting one the bag holds changes nothing, and
+	* `Map.set` on an existing key keeps its insertion order, so last-wins
+	* cannot be reordered by a refold.
+	*
+	* The PAIRS are where repeating is not merely a no-op, stated because the
+	* end-of-pass copy could not see it: a part the cap stopped waiting for can
+	* record a pair LATE, and a second value for one expression marks it
+	* `CONFLICTING_PLAINTEXT` (a non-cacheable `{{resolve:ssm:X}}` re-resolved
+	* to a moved value). A later refold then carries that conflict into
+	* `outputSecrets`, the leaf loses its positioning and falls to the value
+	* scan, which can persist a sibling's expression (the issue #2485 class).
+	* The plaintext stays MASKED either way, so the cost is which expression
+	* is stored, not a disclosure — and the alternative, dropping the late
+	* pair, would keep a positioning the pass itself no longer vouches for.
+	*/
+	absorbOutputsPassSecrets() {
+		for (const passSecrets of this.outputsPassSecretMaps) {
+			for (const [value, expr] of passSecrets) this.outputSecrets.set(value, expr);
+			mergeResolvedPairs(passSecrets, this.outputSecrets);
+		}
+	}
+	/**
+	* Redact the outputs bag. NOT a pure transform: it folds the outputs pass
+	* map into `outputSecrets` first (issue #2814), so every call can grow that
+	* bag. Its KEY set only grows, and the bag has no other reader, which is
+	* what makes calling this on every save, index write and summary safe. The
+	* resolved PAIRS beside those keys are not equally free to refold — see
+	* {@link absorbOutputsPassSecrets}, which states what a late one costs.
+	*/
 	redactOutputs(outputs) {
+		this.absorbOutputsPassSecrets();
 		if (this.outputSecrets.size === 0) return outputs;
 		return redactSecretsForState(outputs, this.outputSecrets, this.outputsSourceUsable ? this.outputsTemplateSource : void 0, TEMPLATE_SOURCED_RULES);
 	}
@@ -38453,7 +38860,10 @@ var DeployEngine = class DeployEngine {
 							persistedOutputs = refreshedState.outputs;
 							if (outputsChanged) this.logger.info("Persisted Outputs-only change (no resource diff).");
 							else this.logger.debug("Persisted export-set change (no outputs-value diff, no-change path, #2193)");
-							if (this.exportIndexStore) await this.exportIndexStore.updateForStack(stackName, this.stackRegion, importableOutputs(refreshedState));
+							if (this.exportIndexStore) await this.exportIndexStore.updateForStack(stackName, this.stackRegion, importableOutputs({
+								...refreshedState,
+								outputs: this.redactOutputs(refreshedState.outputs)
+							}));
 						} else if (observedRefresh) this.logger.debug("Persisted refreshed observedProperties (no-change path)");
 						else this.logger.debug("Persisted skipped-outputs record (no outputs-value diff, no-change path, #2740)");
 					} catch (saveError) {
@@ -38470,7 +38880,7 @@ var DeployEngine = class DeployEngine {
 					updatePartial: 0,
 					unchanged: Object.keys(currentState.resources).length,
 					durationMs: Date.now() - startTime,
-					outputs: this.buildDisplayOutputs(template, persistedOutputs),
+					outputs: this.buildDisplayOutputs(template, this.redactOutputs(persistedOutputs)),
 					attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
 				};
 			}
@@ -38501,7 +38911,10 @@ var DeployEngine = class DeployEngine {
 			await this.drainObservedCaptures(newState.resources);
 			const newEtag = await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(newState));
 			this.logger.debug(`State saved (ETag: ${newEtag})`);
-			await Promise.all([this.deleteRollbackJournalBestEffort(stackName), this.exportIndexStore ? this.exportIndexStore.updateForStack(stackName, this.stackRegion, importableOutputs(newState)) : Promise.resolve()]);
+			await Promise.all([this.deleteRollbackJournalBestEffort(stackName), this.exportIndexStore ? this.exportIndexStore.updateForStack(stackName, this.stackRegion, importableOutputs({
+				...newState,
+				outputs: this.redactOutputs(newState.outputs)
+			})) : Promise.resolve()]);
 			const durationMs = Date.now() - startTime;
 			const unchangedCount = this.diffCalculator.filterByType(changes, "NO_CHANGE").length + actualCounts.skipped;
 			return {
@@ -38513,7 +38926,7 @@ var DeployEngine = class DeployEngine {
 				updatePartial: actualCounts.updatePartial,
 				unchanged: unchangedCount,
 				durationMs,
-				outputs: this.buildDisplayOutputs(template, newState.outputs ?? {}),
+				outputs: this.buildDisplayOutputs(template, this.redactOutputs(newState.outputs ?? {})),
 				attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
 			};
 		} finally {
@@ -40125,8 +40538,10 @@ var DeployEngine = class DeployEngine {
 	* defense in depth here — but two masking sites in one flow must not argue
 	* opposite sides of the same question. `secrets` is the outputs pass's own
 	* map: everything recorded before this handler runs, an `Export.Name`
-	* resolution's entries included (its `finally` merges them back before the
-	* `catch` reaches here). Since issue #2563 a still-pending concurrent part
+	* resolution's entries included (its map writes each one through to the
+	* pass map as the resolver records it, so they are here before the `catch`
+	* is; issue #2814 replaced the `finally` that copied them at the end of
+	* the block). Since issue #2563 a still-pending concurrent part
 	* is in the PASS bag before this handler runs: the resolver drains every
 	* part it started before a rejection reaches a caller. Not
 	* unconditionally, and the weaker claim is the true one -- the drain is
@@ -40261,6 +40676,7 @@ var DeployEngine = class DeployEngine {
 		};
 		const outputsPassSecrets = context.recordedSecretValues ?? EMPTY_SECRETS;
 		const outputsPassInherited = context.inheritedSecrets ?? EMPTY_SECRETS;
+		if (context.recordedSecretValues) this.outputsPassSecretMaps.push(context.recordedSecretValues);
 		const publishedOutputNames = collectPublishedOutputNames(template.Outputs, conditions);
 		let outputsPassCompleted = false;
 		try {
@@ -40286,20 +40702,16 @@ var DeployEngine = class DeployEngine {
 				if (!output.Export?.Name) continue;
 				const value = outputs[outputKey];
 				if (value === void 0) continue;
-				const nameSecrets = /* @__PURE__ */ new Map();
+				const nameSecrets = new ForwardingSecrets(context.recordedSecretValues);
 				const nameReads = [];
 				let exportName;
 				try {
-					try {
-						exportName = typeof output.Export.Name === "string" ? output.Export.Name : await this.resolver.resolve(output.Export.Name, {
-							...context,
-							recordedSecretValues: nameSecrets,
-							redactedAttributeReads: nameReads
-						});
-						refuseMaskedOutputReads(outputKey, nameReads);
-					} finally {
-						for (const [plaintext, expression] of nameSecrets) context.recordedSecretValues?.set(plaintext, expression);
-					}
+					exportName = typeof output.Export.Name === "string" ? output.Export.Name : await this.resolver.resolve(output.Export.Name, {
+						...context,
+						recordedSecretValues: nameSecrets,
+						redactedAttributeReads: nameReads
+					});
+					refuseMaskedOutputReads(outputKey, nameReads);
 				} catch (error) {
 					this.handleOutputResolutionFailure(error, outputKey, outputs, outputsPassSecrets, outputsPassInherited);
 					continue;
@@ -40316,10 +40728,6 @@ var DeployEngine = class DeployEngine {
 			}
 			outputsPassCompleted = true;
 		} finally {
-			if (context.recordedSecretValues) {
-				for (const [value, expr] of context.recordedSecretValues) this.outputSecrets.set(value, expr);
-				mergeResolvedPairs(context.recordedSecretValues, this.outputSecrets);
-			}
 			if (!outputsPassCompleted) this.outputsSourceUsable = false;
 		}
 		for (const [outputKey, output] of Object.entries(template.Outputs)) {
@@ -40341,5 +40749,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { collectInlinePolicyNamesManagedBySiblings as $, buildDockerImage as $n, IntrinsicResolutionRefusalError as $r, DagBuilder as $t, isStatefulRecreateTargetForReplace as A, importableOutputs as An, findLargeInlineResources as Ar, coerceCfnBoolean as At, gray as B, rewriteTemplateAssetReferences as Bn, clearBucketRegionCache as Br, withSharedDrainBudget as Bt, refusesFinalSnapshot as C, __exportAll as Ci, buildLockContentionMessage as Cn, resolveStateBucketWithDefaultAndSource as Cr, isUnboundTemplateParameter as Ct, makeSiblingClaimReader as D, DEFAULT_STATE_PREFIX as Dn, CFN_TEMPLATE_BODY_LIMIT as Dr, normalizeAwsTagsToCfn as Dt, extractDeploymentEventError as E, CUSTOM_RESOURCE_RESPONSE_PREFIX as En, warnDeprecatedNoPrefixCliFlag as Er, WAFv2WebACLProvider as Et, isWarmThroughputDecrease as F, stringifyValue as Fn, PARTITION_TABLE as Fr, requireConfigArray as Ft, collectPublishedOutputNames as G, getBootstrapMarkerKey as Gn, setAwsClients as Gr, s3BucketWebsiteUrl as Gt, red as H, BOOTSTRAP_MARKER_PREFIX as Hn, AwsClients as Hr, s3BucketDomainName as Ht, toFiniteNumber as I, WorkGraph as In, canonicalizeRegion as Ir, requireConfigObject as It, secretBearing as J, readBootstrapMarkerBody as Jn, ConfigError as Jr, INTRINSIC_KEYS as Jt, exportAliasCollisionScrubWarning as K, isCrossRegionRedirect as Kn, AssetError as Kr, applyRoleArnIfSet as Kt, formatResourceLine as L, buildAssetRedirectMap as Ln, derivePartitionAndUrlSuffix as Lr, requireConfigString as Lt, renderStatefulReason as M, orphansCarriedFrom as Mn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Mr, configStringRefusal as Mt, WARM_THROUGHPUT_MEMBERS as N, shouldRetainResource as Nn, displaySafe as Nr, readConfigString as Nt, planOrphanAdoption as O, exportNamesCarriedFrom as On, CFN_TEMPLATE_URL_LIMIT as Or, resolveExplicitPhysicalId as Ot, coerceWarmThroughput as P, AssetPublisher as Pn, expectedOwnerParam as Pr, replayWarn as Pt, IAMRoleProvider as Q, describeAwsFailure as Qn, DynamicReferenceRegionAmbiguousError as Qr, withRetry as Qt, bold as R, createAssetRedirectResolver as Rn, AssemblyReader as Rr, classifyReplaySecretRegion as Rt, isFinalSnapshotError as S, retryClassificationText as Si, buildForceUnlockCommand as Sn, resolveStateBucketWithDefault as Sr, getAccountInfo as St, makeCanonicalizePropertiesFn as T, shellQuote as Tn, stateBucketExistenceConfirmed as Tr, refStateLookupFromResource as Tt, yellow as U, assertAssetBucketRegion as Un, getAwsClients as Ur, s3BucketDualStackDomainName as Ut, green as V, AssetModeResolver as Vn, resolveBucketRegion as Vr, s3BucketArn as Vt, collectDeclaredOutputNames as W, ensureAssetStorage as Wn, resetAwsClients as Wr, s3BucketRegionalDomainName as Wt, secretSafeKeyDisplay as X, validateContainerRepoName as Xn, DependencyError as Xr, findSilentDropProperties as Xt, secretBearingStateKeyWarning as Y, validateAssetBucketName as Yn, CrossAccountSecretRefusalError as Yr, findActionableSilentDrops as Yt, getCurrentResourceSecrets as Z, buildDenyExternalAccessPolicy as Zn, DeployCancelledError as Zr, describeTypeWithThrottleRetry as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, isRetryableTransientError as _i, scrubResourceRecord as _n, getLegacyStateBucketName as _r, isTerminationProtectionPropagationError as _t, DeploymentEventsStore as a, ProvisioningError as ai, carriesSecretMask as an, getDockerCmd as ar, maskerOrIdentity as at, ccRoutedFinalSnapshotError as b, markNonRetryable as bi, rebuildClientForBucketRegion as bn, resolveCaptureObservedState as br, cfnRefValueFromPhysicalId as bt, replayFailedOperations as c, StackHasActiveImportsError as ci, errorCauseChain as cn, runDockerForeground as cr, interruptWatchListenerCount as ct, updatePartialReason as d, SynthesisError as di, markSameGenerationBag as dn, stripControlChars as dr, CloudControlProvider as dt, LocalInvokeBuildError as ei, TemplateParser as en, describeDockerCapturedOutput as er, clearOnUpdateRemoval as et, withResourceDeadline as f, formatError as fi, maskSecretsInError as fn, AssetManifestLoader as fr, slowCcOperationTimeoutMs as ft, bindingSkippedOutputs as g, isMarkedNonRetryable as gi, redactSecretsForState as gn, getDefaultStateBucketName as gr, disableInstanceApiTermination as gt, computeImplicitDeleteEdges as h, withErrorHandling as hi, recoverMaskedOutput as hn, synthesisStatusMessage as hr, deleteSkipReason as ht, DeploymentEventsReader as i, PartialFailureError as ii, TEMPLATE_SOURCED_RULES as in, formatDockerLoginError as ir, maskDeep as it, isStatefulRecreateTargetSync as j, orphansAfterRollback as jn, uploadCfnTemplate as jr, configBooleanRefusal as jt, MULTI_REGION_RECREATE_BLOCKED_TYPES as k, importableOutputKeys as kn, MIGRATE_TMP_PREFIX as kr, assertRegionMatch as kt, replayRollback as l, StackTerminationProtectionError as li, identityKeyFor as ln, runDockerStreaming as lr, isInterruptedWaitError as lt, IMPLICIT_DELETE_DEPENDENCIES as m, normalizeAwsError as mi, recordMaskOnlyValue as mn, Synthesizer as mr, deleteIndeterminateGuards as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, LockError as ni, STATE_SOURCED_CROSS_GENERATION_RULES as nn, describeDockerFailure as nr, wouldReturnToSdkProvider as nt, planFailedOps as o, ResourceTimeoutError as oi, createSecretMasker as on, partitionSensitiveEnv as or, beginCommandInterruptScope as ot, maskingRetryLogger as p, isCdkdError as pi, maskSecretsInText as pn, getDockerImageBySourceHash as pr, UNSPECIFIED_SKIP_REASON as pt, isExportAliasCollision as q, parseBootstrapMarker as qn, CdkdError as qr, DiffCalculator as qt, DeployEngine as r, NestedStackChildDirectDestroyError as ri, STATE_SOURCED_READBACK_RULES as rn, dockerSpawnEnvWithSensitive as rr, createMaskedRetryLogger as rt, planRollback as s, ResourceUpdateNotSupportedError as si, dynamicReferenceTokens as sn, redactDockerArgvValues as sr, endCommandInterruptScope as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, LocalStartServiceError as ti, STATE_SOURCED_BASELINE_RULES as tn, describeDockerExecFailure as tr, ProviderRegistry as tt, updatePartialMessage as u, StateError as ui, isSingleDynamicReferenceToken as un, escapeRegExp$1 as ur, startInterruptWatch as ut, PRE_DELETE_SNAPSHOT_TYPES as v, isThrottlingError as vi, LockManager as vn, resolveApp as vr, IntrinsicFunctionResolver as vt, unsupportedFinalSnapshotError as w, forceQuitRecoveryClause as wn, resolveUseCdkBootstrapAssets as wr, parameterTypeMayLoseSecretIdentity as wt, createPreDeleteFinalSnapshot as x, markRedactedCause as xi, UNRENDERABLE as xn, resolveSkipPrefix as xr, coerceParameterTypedValue as xt, buildFinalSnapshotIdentifier as y, isTransientServerError as yi, S3StateBackend as yn, resolveAutoAssetStorage as yr, carriesDynamicReference as yt, cyan as z, loadPublishableAssetManifest as zn, processStackMessages as zr, producerRegionsFromState as zt };
-//# sourceMappingURL=deploy-engine-DAykhfpV.js.map
+export { collectInlinePolicyNamesManagedBySiblings as $, buildDenyExternalAccessPolicy as $n, DynamicReferenceRegionAmbiguousError as $r, describeTypeWithThrottleRetry as $t, isStatefulRecreateTargetForReplace as A, exportNamesCarriedFrom as An, CFN_TEMPLATE_URL_LIMIT as Ar, coerceCfnBoolean as At, gray as B, createAssetRedirectResolver as Bn, processStackMessages as Br, classifyReplaySecretRegion as Bt, refusesFinalSnapshot as C, retryClassificationText as Ci, UNRENDERABLE as Cn, resolveSkipPrefix as Cr, isUnboundTemplateParameter as Ct, makeSiblingClaimReader as D, shellQuote as Dn, stateBucketExistenceConfirmed as Dr, normalizeAwsTagsToCfn as Dt, extractDeploymentEventError as E, forceQuitRecoveryClause as En, resolveUseCdkBootstrapAssets as Er, WAFv2WebACLProvider as Et, isWarmThroughputDecrease as F, shouldRetainResource as Fn, expectedOwnerParam as Fr, readConfigString as Ft, collectPublishedOutputNames as G, assertAssetBucketRegion as Gn, resetAwsClients as Gr, s3BucketDualStackDomainName as Gt, red as H, rewriteTemplateAssetReferences as Hn, resolveBucketRegion as Hr, withSharedDrainBudget as Ht, toFiniteNumber as I, AssetPublisher as In, PARTITION_TABLE as Ir, replayWarn as It, secretBearing as J, isCrossRegionRedirect as Jn, CdkdError as Jr, applyRoleArnIfSet as Jt, exportAliasCollisionScrubWarning as K, ensureAssetStorage as Kn, setAwsClients as Kr, s3BucketRegionalDomainName as Kt, formatResourceLine as L, stringifyValue as Ln, canonicalizeRegion as Lr, requireConfigArray as Lt, renderStatefulReason as M, importableOutputs as Mn, findLargeInlineResources as Mr, configBooleanRefusal as Mt, WARM_THROUGHPUT_MEMBERS as N, orphansAfterRollback as Nn, uploadCfnTemplate as Nr, configIntegerRefusal as Nt, planOrphanAdoption as O, CUSTOM_RESOURCE_RESPONSE_PREFIX as On, warnDeprecatedNoPrefixCliFlag as Or, resolveExplicitPhysicalId as Ot, coerceWarmThroughput as P, orphansCarriedFrom as Pn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Pr, configStringRefusal as Pt, IAMRoleProvider as Q, validateContainerRepoName as Qn, DeployCancelledError as Qr, findSilentDropProperties as Qt, bold as R, WorkGraph as Rn, derivePartitionAndUrlSuffix as Rr, requireConfigObject as Rt, isFinalSnapshotError as S, markRedactedCause as Si, rebuildClientForBucketRegion as Sn, resolveCaptureObservedState as Sr, getAccountInfo as St, makeCanonicalizePropertiesFn as T, buildLockContentionMessage as Tn, resolveStateBucketWithDefaultAndSource as Tr, refStateLookupFromResource as Tt, yellow as U, AssetModeResolver as Un, AwsClients as Ur, s3BucketArn as Ut, green as V, loadPublishableAssetManifest as Vn, clearBucketRegionCache as Vr, producerRegionsFromState as Vt, collectDeclaredOutputNames as W, BOOTSTRAP_MARKER_PREFIX as Wn, getAwsClients as Wr, s3BucketDomainName as Wt, secretSafeKeyDisplay as X, readBootstrapMarkerBody as Xn, CrossAccountSecretRefusalError as Xr, INTRINSIC_KEYS as Xt, secretBearingStateKeyWarning as Y, parseBootstrapMarker as Yn, ConfigError as Yr, DiffCalculator as Yt, getCurrentResourceSecrets as Z, validateAssetBucketName as Zn, DependencyError as Zr, findActionableSilentDrops as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, isMarkedNonRetryable as _i, recoverMaskedOutput as _n, synthesisStatusMessage as _r, isTerminationProtectionPropagationError as _t, DeploymentEventsStore as a, PartialFailureError as ai, STATE_SOURCED_READBACK_RULES as an, dockerSpawnEnvWithSensitive as ar, maskerOrIdentity as at, ccRoutedFinalSnapshotError as b, isTransientServerError as bi, LockManager as bn, resolveApp as br, cfnRefValueFromPhysicalId as bt, replayFailedOperations as c, ResourceUpdateNotSupportedError as ci, createSecretMasker as cn, partitionSensitiveEnv as cr, interruptWatchListenerCount as ct, updatePartialReason as d, StateError as di, identityKeyFor as dn, runDockerStreaming as dr, CloudControlProvider as dt, IntrinsicResolutionRefusalError as ei, withRetry as en, describeAwsFailure as er, clearOnUpdateRemoval as et, withResourceDeadline as f, SynthesisError as fi, isSingleDynamicReferenceToken as fn, escapeRegExp$1 as fr, slowCcOperationTimeoutMs as ft, bindingSkippedOutputs as g, withErrorHandling as gi, recordMaskOnlyValue as gn, Synthesizer as gr, disableInstanceApiTermination as gt, computeImplicitDeleteEdges as h, normalizeAwsError as hi, maskSecretsInText as hn, getDockerImageBySourceHash as hr, deleteSkipReason as ht, DeploymentEventsReader as i, NestedStackChildDirectDestroyError as ii, STATE_SOURCED_CROSS_GENERATION_RULES as in, describeDockerFailure as ir, maskDeep as it, isStatefulRecreateTargetSync as j, importableOutputKeys as jn, MIGRATE_TMP_PREFIX as jr, coerceCfnInteger as jt, MULTI_REGION_RECREATE_BLOCKED_TYPES as k, DEFAULT_STATE_PREFIX as kn, CFN_TEMPLATE_BODY_LIMIT as kr, assertRegionMatch as kt, replayRollback as l, StackHasActiveImportsError as li, dynamicReferenceTokens as ln, redactDockerArgvValues as lr, isInterruptedWaitError as lt, IMPLICIT_DELETE_DEPENDENCIES as m, isCdkdError as mi, maskSecretsInError as mn, AssetManifestLoader as mr, deleteIndeterminateGuards as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, LocalStartServiceError as ni, TemplateParser as nn, describeDockerCapturedOutput as nr, wouldReturnToSdkProvider as nt, planFailedOps as o, ProvisioningError as oi, TEMPLATE_SOURCED_RULES as on, formatDockerLoginError as or, beginCommandInterruptScope as ot, maskingRetryLogger as p, formatError as pi, markSameGenerationBag as pn, stripControlChars as pr, UNSPECIFIED_SKIP_REASON as pt, isExportAliasCollision as q, getBootstrapMarkerKey as qn, AssetError as qr, s3BucketWebsiteUrl as qt, DeployEngine as r, LockError as ri, STATE_SOURCED_BASELINE_RULES as rn, describeDockerExecFailure as rr, createMaskedRetryLogger as rt, planRollback as s, ResourceTimeoutError as si, carriesSecretMask as sn, getDockerCmd as sr, endCommandInterruptScope as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, LocalInvokeBuildError as ti, DagBuilder as tn, buildDockerImage as tr, ProviderRegistry as tt, updatePartialMessage as u, StackTerminationProtectionError as ui, errorCauseChain as un, runDockerForeground as ur, startInterruptWatch as ut, PRE_DELETE_SNAPSHOT_TYPES as v, isRetryableTransientError as vi, redactSecretsForState as vn, getDefaultStateBucketName as vr, IntrinsicFunctionResolver as vt, unsupportedFinalSnapshotError as w, __exportAll as wi, buildForceUnlockCommand as wn, resolveStateBucketWithDefault as wr, parameterTypeMayLoseSecretIdentity as wt, createPreDeleteFinalSnapshot as x, markNonRetryable as xi, S3StateBackend as xn, resolveAutoAssetStorage as xr, coerceParameterTypedValue as xt, buildFinalSnapshotIdentifier as y, isThrottlingError as yi, scrubResourceRecord as yn, getLegacyStateBucketName as yr, carriesDynamicReference as yt, cyan as z, buildAssetRedirectMap as zn, AssemblyReader as zr, requireConfigString as zt };
+//# sourceMappingURL=deploy-engine-Dhgm0r8o.js.map