@go-to-k/cdkd 0.290.21 → 0.290.23

package/dist/{deploy-engine-KnCjibgq.js → deploy-engine-CBzq85r6.js}

@@ -1,6 +1,6 @@
-import { C as displaySafe, S as displayIdent, b as STACK_REF_MAX_CODE_POINTS, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE, y as withoutGeneratedFallbackName } from "./logger-C17H06QA.js";
+import { C as displaySafe, S as displayIdent, b as STACK_REF_MAX_CODE_POINTS, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE, y as withoutGeneratedFallbackName } from "./logger-CkHVgzLx.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-CGcB3KHZ.js";
+import { t as getCdkdVersion } from "./version-DxUVmvM5.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7360,7 +7360,7 @@ function repairSpawnRefusal(text, args, maskedArgs) {
 * error would only say "Command failed with exit code N".
 */
 function describeDockerExecFailure(error, args) {
-	const message = thrownMessageText(error) || safeStringify(error);
+	const message = thrownMessageText(error) || safeStringify$1(error);
 	const stderrText = capturedStreamText(error, "stderr");
 	return redactDockerArgvInText(stderrText ? `${message}\n${stderrText}` : message, args);
 }
@@ -7403,7 +7403,7 @@ function thrownMessageText(error) {
 * two of these call sites are in `cleanupEcsRun`, where an exception aborts
 * the remaining volume / network teardown and leaks real Docker resources.
 */
-function safeStringify(error) {
+function safeStringify$1(error) {
 	try {
 		return String(error);
 	} catch {
@@ -7429,7 +7429,7 @@ function safeStringify(error) {
 * wrapper text needs the status as well.
 */
 function describeDockerFailure(error, args) {
-	return redactDockerArgvInText(capturedStreamText(error, "stderr") || thrownMessageText(error) || safeStringify(error), args);
+	return redactDockerArgvInText(capturedStreamText(error, "stderr") || thrownMessageText(error) || safeStringify$1(error), args);
 }
 /**
 * A `cause` that is safe to CHAIN onto a wrapper error, for a caller that
@@ -8019,6 +8019,40 @@ function isAwsAuthoredFailure(error) {
 	return candidate.$fault !== void 0 || typeof candidate.$metadata?.httpStatusCode === "number" || error.name === "CredentialsProviderError";
 }
 /**
+* Exactly what `String(value)` produces, without the throw.
+*
+* `String(value)` is the only spelling that carries an `Error`'s NAME as well
+* as its message (`"AccessDenied: User ... is not authorized"`), and several
+* call sites depend on that: four build a persisted `outcome: 'partial'`
+* reason where the wire code is the discriminator an operator reads first.
+* {@link describeAwsFailure}'s `detail` is the MESSAGE only, so it is NOT a
+* drop-in for the bare form -- substituting it silently deletes the code.
+* Measured, after a sweep did exactly that at nine sites.
+*
+* So this is the 1:1 replacement: same output for every value `String` can
+* convert, and a stable sentence for the ones it cannot. A null-prototype
+* object throws `TypeError: Cannot convert object to primitive value`, and an
+* object with a hostile or `null` `toString` throws whatever it likes -- inside
+* a catch, that replaces the failure being reported.
+*
+* Use `describeAwsFailure(x).detail` where the site previously read
+* `x instanceof Error ? x.message : String(x)`; use THIS where it read a bare
+* `String(x)`.
+*
+* NOT a substitute for `displaySafe` in `display-safe.ts`, which guards the
+* same coercion and answers differently on purpose -- it falls back to
+* `Object.prototype.toString` and, more importantly, SANITISES the result for a
+* terminal. Anything about to be rendered or logged goes through that one; this
+* one is for the text a catch is about to record.
+*/
+function safeStringify(value) {
+	try {
+		return String(value);
+	} catch {
+		return "a value that could not be converted to text";
+	}
+}
+/**
 * Describe a caught failure for a thrown message. See {@link AwsFailureText}.
 */
 function describeAwsFailure(error) {
@@ -11935,6 +11969,84 @@ function resolvedPlaintextOf(secrets, expression) {
 function resolvedExpressionsOf(secrets) {
 	return [...resolvedPairsOf.get(secrets)?.keys() ?? []];
 }
+/** Poison for an intrinsic object one pass resolved two different ways. */
+const CONFLICTING_LEAF_RESOLUTION = Symbol("conflicting leaf resolution");
+/**
+* {@link IntrinsicLeafResolution}s per pass bag, keyed by the template OBJECT
+* that was resolved (issue [#3156](https://github.com/go-to-k/cdkd/issues/3156)).
+* The carry in {@link recordNestedStackParameterExpressions} reads it for the
+* very object the deploy engine handed the resolver, so its evidence is THIS
+* leaf's own resolution: no other leaf's substitution, however equal its value,
+* can answer for it, and each substitution carries its own verdict, which the
+* secret-only pair table cannot (an unclassifiable `ssm` answer recorded as a
+* pair looks the same as a later public answer with the same plaintext).
+* Both keys are weak, so a record lives as long as its bag and its template.
+*/
+const intrinsicLeafResolutionsOf = /* @__PURE__ */ new WeakMap();
+/**
+* Record how the pass that owns `secrets` resolved the intrinsic object
+* `source`. A second resolution of the same object that differs in any field
+* poisons it for the pass, and the poison is never lifted; an identical one
+* changes nothing.
+*/
+function recordIntrinsicLeafResolution(secrets, source, resolution) {
+	let leaves = intrinsicLeafResolutionsOf.get(secrets);
+	if (leaves === void 0) {
+		leaves = /* @__PURE__ */ new WeakMap();
+		intrinsicLeafResolutionsOf.set(secrets, leaves);
+	}
+	const copy = {
+		input: resolution.input,
+		output: resolution.output,
+		substitutions: resolution.substitutions.map(({ token, value, secret }) => ({
+			token,
+			value,
+			secret
+		})),
+		complete: resolution.complete
+	};
+	const previous = leaves.get(source);
+	if (previous === void 0) leaves.set(source, copy);
+	else if (previous === CONFLICTING_LEAF_RESOLUTION || !sameLeafResolution(previous, copy)) leaves.set(source, CONFLICTING_LEAF_RESOLUTION);
+}
+function sameLeafResolution(a, b) {
+	return a.input === b.input && a.output === b.output && a.complete === b.complete && a.substitutions.length === b.substitutions.length && a.substitutions.every((s, i) => s.token === b.substitutions[i].token && s.value === b.substitutions[i].value && s.secret === b.substitutions[i].secret);
+}
+/**
+* The spelling `source`'s own resolution in this pass proves for
+* `resolvedValue`, or `undefined` (issue
+* [#3156](https://github.com/go-to-k/cdkd/issues/3156)). Certified only when
+* the resolution replaced every token it met, replaced exactly ONE, took a
+* SECRET verdict for it, and produced `resolvedValue` from `input` by that one
+* replacement ({@link singleSpanFrame} over `input` with the token and value
+* equal). That is the observed equation `resolvedValue = input[token := value]`;
+* it says nothing about what a later lookup of the token returns.
+*
+* The `secret` test and the COUNT are independent. The count refuses a
+* replacement listed ahead of the one the frame names that left its plaintext,
+* not its token, in `input` -- a used Sub variable holding the SAME token as
+* the template (`port:T${V}` with `V` = `T`), whose first replacement passes
+* the token and value tests while `input` keeps the variable's plaintext.
+* `complete`, `output` and the token and value tests are implied, for every
+* shape the resolver records, by the count and `singleSpanFrame` over `input`:
+* a token left unreplaced in `input` is a second span, and a frame that fits
+* `input` around the one replacement fixes the output it produces. They are
+* kept so a recorder that is not faithful refuses rather than certifies, and
+* are pinned by hand-built records only.
+*/
+function substitutedSpellingOf(secrets, source, resolvedValue) {
+	const resolution = intrinsicLeafResolutionsOf.get(secrets)?.get(source);
+	if (resolution === void 0 || resolution === CONFLICTING_LEAF_RESOLUTION) return void 0;
+	if (!resolution.complete || resolution.output !== resolvedValue) return void 0;
+	if (resolution.substitutions.length !== 1) return void 0;
+	const [substitution] = resolution.substitutions;
+	if (!substitution.secret) return void 0;
+	const frame = singleSpanFrame(resolvedValue, resolution.input);
+	if (frame === void 0) return void 0;
+	if (frame.token !== substitution.token || frame.middle !== substitution.value) return void 0;
+	for (const plaintext of secrets.keys()) if (plaintext !== "" && (frame.prefix.includes(plaintext) || frame.suffix.includes(plaintext))) return;
+	return resolution.input;
+}
 /**
 * The bag OBJECTS a deploy pass produced ITSELF and installed on a success
 * path — the fact the resolved-pair evidence above cannot state (issue
@@ -12886,8 +12998,9 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 *         literal source; pinned by the "map NO RESOLVER populated" case,
 *         where (ii) and (iii) both pass and only the missing pair refuses.
 *         On an OBJECT source (`Fn::Join` / `Fn::Sub`, issue #3062) there is
-*         no source text to compare, so the spelling is what the pass WROTE,
-*         admitted only when `positioned[name] !== resolvedValue`. Sound
+*         no source text to compare, so the spelling-based arm takes what
+*         the pass WROTE, admitted only when `positioned[name] !==
+*         resolvedValue`. Sound
 *         together with (ii), not alone: on a value the scan is silent on,
 *         the cross-stack and skeleton arms both refuse (each requires the
 *         WHOLE leaf to be a key of the map, which would make the scan's
@@ -12895,16 +13008,23 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 *         scan leaves the leaf alone -- so the frame arm is the only writer
 *         that can have rewritten it, on its pair and the engine's mark. A
 *         frame that is not wholly literal makes that arm refuse, the leaf
-*         comes back unrewritten, and (i) refuses too. The object arm
-*         certifies only a source whose OWN rendered token starts with a
+*         comes back unrewritten, and this arm refuses too. It certifies
+*         only a source whose OWN rendered token starts with a
 *         spelled-secret prefix (`secretsmanager:` / `ssm-secure:`), read from
 *         the source and never from what the pass wrote: the frame arm
 *         matches among RECORDED references and a public `ssm` parameter
 *         records none, so a public leaf whose source spells `ssm:`, or leaves
 *         the service to an intrinsic part, can match a recorded secret
-*         sibling and be written as the sibling's reference. A SecureString
-*         spelled either way is indistinguishable here, so both are refused
-*         (see (e)). The STATE-derived
+*         sibling and be written as the sibling's reference. Where it refuses,
+*         the PROVENANCE arm (issue #3156) certifies on the leaf's own
+*         resolution instead: the resolver records, per `Fn::Join` /
+*         `Fn::Sub` object and pass bag, every token it replaced with the
+*         verdict that replacement took, and one SECRET replacement that turns
+*         the record's input into the value certifies that input as the
+*         spelling -- an `ssm:` or intrinsic-service token, and a frame whose
+*         non-literal part sits OUTSIDE the token, which the frame arm never
+*         writes. `frameSpellingOf` states what it proves and what it does
+*         not. The STATE-derived
 *         call sites reach this arm as well: `cdkd import` can leave raw
 *         intrinsics in a record's `properties`, which a rollback replay
 *         passes as its source, and the frame arm does not read `rules`.
@@ -12940,10 +13060,9 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 *         (i)-(iii) on its own), a leaf (iii) refused under a different
 *         frame, an object spelling the frame arm refused and a plain
 *         literal equal to the value all fail it and would take the entry's
-*         frame (an object spelling the arm POSITIONED whose own source
-*         spells a secret service is a frame like a literal one, issue
-*         #3062; one whose source does not counts as unframed) -- and so
-*         would a
+*         frame (an object spelling (i) certified is a frame like a literal
+*         one, issues #3062 and #3156; one it refused counts as unframed) --
+*         and so would a
 *         same-frame sibling whose token this pass never resolved to the
 *         middle: a PUBLIC `ssm` reference in the same `port:` frame holding
 *         the same two characters is kept RESOLVED on the record, and the
@@ -12952,7 +13071,13 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 *         the row are gathered BEFORE the conditions run, a spelling that is
 *         not a single-span literal frame with this pass's pair for its token
 *         (`resolvedPlaintextOf`) counting as its own, and a value is
-*         recorded only when its certified frame is the row's only one.
+*         recorded only when its certified frame is the row's only one. A
+*         value one of whose leaves the position pass did NOT write (the
+*         provenance arm's outside-the-token frame) also counts as unframed
+*         unless every framed spelling of it carries ONE token: the frame arm
+*         refuses that leaf on the parent's record, so the entry is written
+*         onto it by the value scan whatever its token, and (iii)'s rescue
+*         for a same-frame sibling does not reach it.
 *   (v)   No OTHER string leaf of the ROW would be rewritten by the entry,
 *         read over every leaf of the resolved row since the bag is per
 *         resource, not per `Parameters`. Two arms of the persist walk read
@@ -13038,16 +13163,29 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 * persists the plaintext -- the same class as the nonliteral-frame deferral.
 * (e) CLOSED for a wholly literal frame by (i)'s object arm (issue #3062;
 * was: an `Fn::Join` / `Fn::Sub` source in the parent's own `Parameters`
-* block was never carried). What remains of it: an object source whose frame
-* is NOT wholly literal -- a region `Ref` outside the token -- is refused by
-* the frame arm, so (i) refuses it and the child leaf keeps the plaintext,
-* the same nonliteral-frame deferral the parent's own record has; and an
-* intrinsic frame whose token spells `ssm:`, or leaves its service to an
-* intrinsic part, is refused by (i) whatever the parameter's type, so a 1-3
-* character SecureString spelled that way keeps the plaintext in the child
-* too. That refusal is what keeps the frame arm's own wrong-reference
-* residual -- a public leaf matching a recorded sibling -- on the parent's
-* record instead of carrying it into the child's. (f) A child record persisted BEFORE this carry
+* block was never carried), and for the two spellings that arm refused -- a
+* token spelling `ssm:` or leaving its service to an intrinsic part, and a
+* frame whose non-literal part sits outside the token -- by its provenance
+* arm (issue #3156), which on the second also rewrites the PARENT's record of
+* the leaf through the entry. What remains of it: a leaf whose own resolution
+* does not certify -- the token spelled inside a NESTED intrinsic part (the
+* outer object's own text spells none), the token held by a used `Fn::Sub`
+* variable (the template spells a placeholder there), a leaf resolved two
+* different ways in one pass, one whose replacement took a public verdict, one
+* that replaced more than one token, one whose affix holds a plaintext the bag
+* holds (another secret a non-literal part resolved), an `Fn::If` around the
+* object (which the skeleton cannot render, and whose record is under the
+* selected branch) -- keeps the plaintext in the child, and for the
+* outside-the-token frame in the parent's record; so does an outside-the-token
+* frame sharing its value with a leaf of another token, which (iv) refuses. A
+* rollback replay records nothing here (`resolveReplayProps` resolves strings,
+* not intrinsic objects): a journal a deploy wrote holds a carried frame's
+* persisted spelling as a STRING, which the literal arm reads, while a record
+* `cdkd import` left holding the raw intrinsic stays refused on this arm
+* (go-to-k/cdkd#3306 tracks the refused shapes). Any other resolved
+* text a non-literal part contributes is carried verbatim in the spelling, as
+* the value already carries it.
+* (f) A child record persisted BEFORE this carry
 * keeps `port:q7` until the child is next redeployed: the parent's own row
 * already held the frame (the literal or frame arm), so a parent deploy whose child
 * row is unchanged never re-runs the child, and `cdkd scrub` cannot repair
@@ -13083,12 +13221,19 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 	}
 	const framesByValue = /* @__PURE__ */ new Map();
 	const tokensOf = /* @__PURE__ */ new Map();
-	const frameSpellingOf = (name, resolvedValue) => {
+	const frameSpellings = /* @__PURE__ */ new Map();
+	const frameSpellingOf = (name) => {
+		if (!frameSpellings.has(name)) frameSpellings.set(name, computeFrameSpelling(name));
+		return frameSpellings.get(name);
+	};
+	const computeFrameSpelling = (name) => {
+		const resolvedValue = resolvedParameters[name];
+		if (typeof resolvedValue !== "string") return void 0;
 		const sourceLeaf = sourceParameters[name];
 		if (typeof sourceLeaf === "string") return sourceLeaf;
 		if (!isPlainObject$2(sourceLeaf)) return void 0;
 		const written = positioned[name];
-		if (typeof written !== "string" || written === resolvedValue) return void 0;
+		if (typeof written !== "string") return void 0;
 		const segments = intrinsicSkeletonSegments(sourceLeaf);
 		if (segments === void 0) return void 0;
 		const rendered = segments.map((s) => s === UNKNOWN_PART ? UNKNOWN_PART_PLACEHOLDER : s).join("");
@@ -13096,16 +13241,20 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 		if (spans.length !== 1) return void 0;
 		const [span] = spans;
 		const ownToken = rendered.slice(span.start, span.end);
-		return SPELLED_SECRET_REFERENCE_PREFIXES.some((prefix) => ownToken.startsWith(prefix)) ? written : void 0;
+		if (written !== resolvedValue && SPELLED_SECRET_REFERENCE_PREFIXES.some((prefix) => ownToken.startsWith(prefix))) return written;
+		const substituted = substitutedSpellingOf(secrets, sourceLeaf, resolvedValue);
+		if (substituted === void 0) return void 0;
+		return written === resolvedValue || written === substituted ? substituted : void 0;
 	};
-	const certifiedSpellingOf = (name, resolvedValue) => {
+	const certifiedSpellingOf = (name) => {
 		const sourceLeaf = sourceParameters[name];
 		if (typeof sourceLeaf === "string") return positioned[name] === sourceLeaf ? sourceLeaf : void 0;
-		return frameSpellingOf(name, resolvedValue);
+		return frameSpellingOf(name);
 	};
+	const unwrittenValues = /* @__PURE__ */ new Set();
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
 		if (typeof resolvedValue !== "string") continue;
-		const spelling = frameSpellingOf(name, resolvedValue);
+		const spelling = frameSpellingOf(name);
 		const frame = spelling === void 0 ? void 0 : singleSpanFrame(resolvedValue, spelling);
 		const frames = framesByValue.get(resolvedValue) ?? /* @__PURE__ */ new Set();
 		const unframed = frame === void 0 || resolvedPlaintextOf(secrets, frame.token) !== frame.middle;
@@ -13115,8 +13264,10 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 			const tokens = tokensOf.get(resolvedValue) ?? /* @__PURE__ */ new Set();
 			tokens.add(frame.token);
 			tokensOf.set(resolvedValue, tokens);
+			if (typeof sourceParameters[name] !== "string" && positioned[name] !== spelling) unwrittenValues.add(resolvedValue);
 		}
 	}
+	for (const value of unwrittenValues) if (tokensOf.get(value)?.size !== 1) framesByValue.get(value)?.add(UNFRAMED_SPELLING);
 	const rowWithoutParameters = {};
 	for (const [key, value] of Object.entries(resolvedProperties)) if (key !== "Parameters") rowWithoutParameters[key] = value;
 	const outsideLeaves = wholeStringLeavesOf(rowWithoutParameters);
@@ -13124,7 +13275,7 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 	const framedByName = [];
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
 		if (typeof resolvedValue !== "string") continue;
-		const spelling = certifiedSpellingOf(name, resolvedValue);
+		const spelling = certifiedSpellingOf(name);
 		if (spelling === void 0) continue;
 		if (redactSecretsForState(resolvedValue, secrets) !== resolvedValue) continue;
 		const frame = singleSpanFrame(resolvedValue, spelling);
@@ -17884,7 +18035,7 @@ function getCreateOnlyPropertyPaths(resourceType) {
 	if (cached) return cached;
 	const entry = fetchCreateOnlyPropertyPaths(resourceType).catch((error) => {
 		createOnlyPropertiesCache.delete(resourceType);
-		const message = error instanceof Error ? error.message : String(error);
+		const message = describeAwsFailure(error).detail;
 		getLogger().child("CreateOnlyProperties").warn(`Failed to resolve create-only properties for ${resourceType} via cloudformation:DescribeType (${message}). Falling back to the registry-only replacement classification for this resource — an immutable-property change may be mis-classified as an in-place update. Grant cloudformation:DescribeType to enable schema-driven replacement detection.`);
 		return [];
 	});
@@ -21389,6 +21540,39 @@ function stackClause(stackName, region) {
 	const where = region === void 0 ? "" : ` (${shellQuote(safeIdentifier(region))})`;
 	return `State for ${shellQuote(safeIdentifier(stackName))}${where}`;
 }
+/**
+* The DESTRUCTIVE remedy, built the way {@link inspectCommand} builds the
+* read-only one, and the region clause follows the SAME rule for two reasons
+* that pull in opposite directions.
+*
+* With a region in hand the flag is not decoration: `cdkd state orphan <stack>`
+* without it drops the record for that stack name in EVERY region, so omitting
+* it hands a stuck operator something wider than the message describes.
+*
+* With NO region the flag is worse than useless, and a placeholder is the worst
+* of the three: an absent region means a v1 record, which predates the
+* region-prefixed key layout, so `--stack-region <region>` selects no record at
+* all whatever the operator fills in. The bare command is the correct one
+* there, because such a record is not region-partitioned.
+*
+* With no trusted STACK the whole thing degrades to a template, as the inspect
+* command does — there is nothing to substitute.
+*
+* **It diverges from {@link malformedDestroyResourcesRefusalMessage}, which
+* keeps `cdkd state orphan` a template on purpose, and the difference is where
+* the identity comes from.** That builder is reached with a record-derived
+* REGION (`state.region ?? ctx.baseRegion` in `destroy-runner.ts`) -- its stack
+* name is the caller's, so the region alone is what would aim a destructive
+* command using a value the record supplied. This one is reached only with the caller's
+* synthesized stack and `pickStackRegion`'s answer, so substituting is safe and
+* omitting the region is the wider action. Two opposite precedents in one
+* module; neither is the general rule.
+*/
+function dropRecordCommand(stackName, region) {
+	if (stackName === void 0 || stackName === "") return "cdkd state orphan <stack> --stack-region <region>";
+	const flag = region === void 0 || region === "" ? "" : ` --stack-region ${shellQuote(safeIdentifier(region))}`;
+	return `cdkd state orphan ${shellQuote(safeIdentifier(stackName))}${flag}`;
+}
 /** The remedy command {@link stackClause}'s message ends on. */
 function inspectCommand(stackName, region) {
 	if (stackName === void 0) return "cdkd state show <stack> --stack-region <region> --json";
@@ -21463,12 +21647,19 @@ function unreadableResourcePropertyBags(state) {
 *
 * Deliberately NOT folded into {@link refuseMalformedState}, for the reason
 * {@link unreadableResourcePropertyBags} gives: that predicate answers a
-* question about the record ROOT, and its four callers (`cdkd scrub`,
-* `import`, `orphan`, `rollback`) have made no decision about this one. Three
-* of them do not compare properties at all, and `cdkd rollback` replays a
-* journal rather than diffing, so an unrelated broken bag would stop the
-* command documented as the way to UNWIND a stack whose state is already
-* suspect. This rule is OPT-IN, taken by the flow that COMPARES the bag.
+* question about the record ROOT, and its callers have each had to make their
+* own decision about this one. `cdkd rollback` replays a journal rather than
+* diffing, so an unrelated broken bag would stop the command documented as the
+* way to UNWIND a stack whose state is already suspect; `cdkd scrub` and
+* `cdkd import` do not compare properties at all.
+*
+* **The rule is OPT-IN PER CALLER, not "whoever COMPARES the bag"**, and an
+* earlier revision of this sentence said the latter — which go-to-k/cdkd#3318
+* falsified within two lanes. `cdkd orphan` compares nothing and still opts in
+* through {@link refuseMalformedResourcePropertiesForOrphan}, because it SAVES
+* the bag; what each caller owes is an answer to "what would I do with a map I
+* cannot read", and comparison is only one way to owe one. Do not read this
+* paragraph as licence to delete a call from a caller that does not diff.
 */
 function refuseMalformedResourceProperties(state, stackName, region) {
 	const unreadable = unreadableResourcePropertyBags(state);
@@ -21575,7 +21766,7 @@ function namedPropertyBagsClause(stackName, region, logicalIds) {
 /**
 * The text {@link refuseMalformedResourceProperties} raises.
 *
-* `stackName` / `region` are the CALLER's resolved identity or nothing at all;
+* `rawStackName` / `rawRegion` are the CALLER's resolved identity or nothing at all;
 * {@link stackClause} is the authority for why this one may be handed neither.
 *
 * **It must be true under `cdkd deploy --dry-run` as well**, and the first
@@ -21604,6 +21795,155 @@ function malformedResourcePropertiesRefusalMessage(stackName, region, logicalIds
 	return `${namedPropertyBagsClause(stackName, region, logicalIds)} 'cdkd deploy' can WRITE state and AWS resources, so it refuses rather than continuing — under '--dry-run' too, because the plan a dry run would print is the wrong one: a DELETE and re-create of resources the template did not change, and reading the bag as empty produces that same verdict rather than avoiding it. Nothing was provisioned and no state was written FOR THIS STACK. Repair or remove the record first; 'cdkd diff' previews the rest of the stack with those maps read as EMPTY and warns that it did. Inspect the record with: ${inspectCommand(stackName, region)}`;
 }
 /**
+* The `cdkd orphan` refusal text for the per-entry `properties` container
+* (issue [#3318](https://github.com/go-to-k/cdkd/issues/3318)).
+*
+* A SECOND `properties` refusal beside
+* {@link malformedResourcePropertiesRefusalMessage}, for the reason every
+* split in this module is its own: that text describes the DIFF's verdict —
+* "a DELETE and re-create of resources the template did not change" — which
+* `cdkd orphan` never computes. It runs no diff at all.
+*
+* **And the harm here is NOT the laundering the module's other write-capable
+* refusals describe.** Measured 2026-09-17 through the real
+* `rewriteResourceReferences` over an `AWS::S3::Bucket` record: `rewriteValue`
+* returns a non-object verbatim, so a stored `"abcdef"` comes back as
+* `"abcdef"`, a `5` as `5`, a `null` as `null`, and an ABSENT bag stays absent
+* once `JSON.stringify` drops it. Nothing is fabricated and no evidence is
+* replaced — so {@link malformedOutputsRefusalMessage}'s "saved back as a
+* well-formed six-key map" sentence, true one container over, would be FALSE
+* here and must not be borrowed.
+*
+* What it DOES share is {@link namedPropertyBagsClause}, which carries a
+* diff-shaped sentence of its own ("a create-only property among them is a
+* REPLACEMENT of the live resource"). That is not a contradiction and is not
+* an oversight: the shared clause describes what the RECORD is, and the reason
+* an operator must care is precisely that a later `cdkd deploy` / `cdkd diff`
+* reaches that verdict. What this text must not do — and what its fence pins —
+* is claim that verdict as its OWN, since `cdkd orphan` computes no diff.
+*
+* What IS at stake is the command's own job. `cdkd orphan` exists to leave the
+* record deployable: it rewrites every surviving sibling's `Ref` /
+* `Fn::GetAtt` / `Fn::Sub` reference to an orphan so the next deploy neither
+* re-creates the orphan nor fails on a stale reference. Over a map it cannot
+* read it cannot do that and cannot say it did not. A scalar bag presents no
+* reference to find, so the `--force`-less hard fail on unresolvable
+* references can never fire for one; a LIST bag is the one unreadable shape
+* `rewriteValue` DOES walk (measured: a stored `[{"Ref":"<orphan>"}]` came
+* back as `["<physicalId>"]` with one row in the audit table), so its rewrites
+* are reported into a container that is still not a map. Either way the
+* command takes a lock, saves, and reports success over a record left in
+* exactly the state `cdkd deploy` REFUSES
+* ({@link malformedResourcePropertiesRefusalMessage}) and `cdkd diff` previews
+* as a replacement — one command after the evidence was last in cdkd's hands.
+*
+* **The refusal is SCOPED to the records the save would KEEP, so orphaning the
+* DAMAGED record itself still works** —
+* {@link refuseMalformedResourcePropertiesForOrphan} is handed the ids being
+* removed and never names one. Compare
+* `malformedDestroyResourcesRefusalMessage`, which has to point at a different
+* COMMAND for its way out because a destroy keeps every record it reads.
+*
+* **But that in-command way out is CONDITIONAL, and the text must say so.**
+* `cdkd orphan` addresses resources only through the `aws:cdk:path` index of
+* the SYNTHESIZED template (`resolveConstructPaths` →
+* `buildCdkPathIndex`), so an id the CDK app no longer declares — a record
+* left behind when the construct was deleted, or one a hand edit invented —
+* can never enter the orphan set for ANY invocation. The exemption therefore
+* cannot reach it, and an earlier revision of this text nonetheless told the
+* operator to "orphan the damaged record ITSELF" unconditionally: an
+* instruction that dies on `Construct path '...' not found in template`, which
+* is the misstating-the-remedy class this module's own notes record (security
+* review of go-to-k/cdkd#3318). The remedy is now stated with its condition and
+* the two unconditional ways out beside it — hand repair, and
+* `cdkd state orphan <stack>`, which needs no CDK app and drops the whole
+* record with the live resources left standing.
+*
+* So the recovery-path objection is answered for the common case by the
+* exemption and for the rest by naming commands that do not depend on the
+* template. What this does NOT claim is that `cdkd orphan` stays usable on a
+* stack holding a template-less torn record: it does not, exactly as
+* `cdkd deploy` does not (go-to-k/cdkd#3191). A state-keyed escape hatch
+* (`--orphan-logical-id`, addressing a record by its state key rather than by
+* a construct path) was considered in the same review and DECLINED: it is a new
+* mutating CLI surface whose only job is to route around a record the operator
+* must repair or drop anyway, and `cdkd state orphan <stack>` already removes
+* such a record with no CDK app and no new flag.
+*
+* It must be true under `--dry-run` as well, and it is: the guard sits at the
+* load, far above the `if (options.dryRun)` return. Refusing there is
+* {@link malformedResourcePropertiesRefusalMessage}'s call for the same
+* reason — a plausible rewrite audit table followed by a refusal the moment
+* the flag comes off is the worst arm of all.
+*
+* `rawStackName` / `rawRegion` are the CALLER's resolved identity — the synthesized
+* stack name and the region `pickStackRegion` settled on, never the record's
+* own unvalidated self-report. See {@link stackClause}.
+*/
+function malformedOrphanResourcePropertiesRefusalMessage(rawStackName, rawRegion, logicalIds) {
+	const stackName = rawStackName === "" ? void 0 : rawStackName;
+	const region = rawRegion === "" ? void 0 : rawRegion;
+	return `${namedPropertyBagsClause(stackName, region, logicalIds)} 'cdkd orphan' REWRITES and SAVES every record it keeps, so it refuses rather than continuing — under '--dry-run' too, because the rewrite audit table a dry run prints is the wrong one. It is not that the save would fabricate a map: an unreadable bag is carried through VERBATIM. It is that this command exists to leave the record deployable by rewriting every reference to an orphaned resource, and a map it cannot read hides whichever references it holds — a string or a number presents none to find, and a list is walked, so its rewrites are recorded into a container that is still not a map. Continuing would rewrite, save, and report success over a record 'cdkd deploy' then REFUSES. No state was written. Two ways out need no CDK app: repair the record by hand, or drop it whole with '${dropRecordCommand(stackName, region)}', which leaves the live AWS resources standing. A third works only while the CDK app STILL DECLARES the named resource — this refusal covers just the records that would SURVIVE the save, so 'cdkd orphan <its construct path>' removes it and repairs the rest; construct paths come from the synthesized template, so a resource the app no longer declares has none and must take one of the first two. Inspect the record with: ${inspectCommand(stackName, region)}`;
+}
+/**
+* For `cdkd orphan`: refuse a record whose SURVIVING resource entries carry a
+* `properties` bag that cannot be read (issue
+* [#3318](https://github.com/go-to-k/cdkd/issues/3318)).
+*
+* A separate call from {@link refuseMalformedResourceProperties} rather than a
+* flag on it, for the reason {@link refuseMalformedOutputsForDestroy} is
+* separate from {@link refuseMalformedOutputs}: the refusal a user sees must
+* describe what THIS command would have done with the bag, and
+* {@link malformedOrphanResourcePropertiesRefusalMessage} records how far the
+* two consequences diverge.
+*
+* `removedLogicalIds` is the orphan set — the ids this run is dropping from
+* `state.resources`. They are EXCLUDED from the verdict because the save
+* cannot persist a record it is deleting, and because refusing on one would
+* break the recovery path the refusal is otherwise meant to preserve.
+*
+* **It covers `state.resources` ONLY, and the save keeps more than that.**
+* `rewriteResourceReferences` spreads `carriedState`, so `state.orphans[]` —
+* rollback-orphaned records each holding a whole `ResourceState`
+* (go-to-k/cdkd#2934) — rides through untouched, and
+* {@link unreadableResourcePropertyBags} never walks it. A torn bag parked
+* there is therefore still saved, and `computeStackDiff` splices those records
+* into `state.resources` on the next preview. Stated rather than implied,
+* because "the records the save would KEEP" reads wider than what this scans:
+* the gap is go-to-k/cdkd#3344, filed rather than folded in because the remedy
+* differs — an entry in that container has no construct path, so the message's
+* third way out is meaningless for it.
+*
+* **A surviving ENTRY that is not a map is the other gap, and it DOES launder.**
+* This scan asks whether a resource's `properties` is readable; it never asks
+* whether the resource RECORD is. `isReadableBag('abcdef')` is false, so a
+* string entry is skipped here, and then `rewriteResourceReferences`'s
+* `{ ...resource }` spreads it into per-character keys — the record is SAVED as
+* `{"0":"a",…,"dependencies":[]}` and the run reports success. A number entry
+* saves as `{"dependencies":[]}`, a record with no `physicalId`. So the
+* refusal's own text, which says a torn `properties` map is persisted verbatim
+* rather than reshaped, is true of the container it scans and NOT of the one
+* above it.
+*
+* That gap is NOT go-to-k/cdkd#3202's as filed — that issue records only the
+* `null`-entry `TypeError` — and NOT open PR go-to-k/cdkd#3226's, whose file
+* list carries neither `orphan.ts` nor `orphan-rewriter.ts`. A lane closing
+* either one leaves this open, which is why it is named here rather than
+* deferred to them by reference. Filed as go-to-k/cdkd#3350.
+*
+* CALL IT AT THE LOAD, beside {@link refuseMalformedState} and
+* {@link refuseMalformedOutputs}, above `rewriteResourceReferences` — the
+* placement rule {@link repairMalformedResourcesForReadOnly}'s note records.
+* The orphan set is resolved from the synthesized template before the state is
+* loaded, so nothing forces this call any lower.
+*/
+function refuseMalformedResourcePropertiesForOrphan(state, removedLogicalIds, stackName, region) {
+	const removed = new Set(removedLogicalIds);
+	const unreadable = unreadableResourcePropertyBags(state).filter((id) => !removed.has(id));
+	if (unreadable.length === 0) return;
+	throw new CdkdError(malformedOrphanResourcePropertiesRefusalMessage(stackName, region, unreadable), STATE_RESOURCES_MALFORMED);
+}
+/**
 * The warning a caller of {@link repairMalformedResourcePropertiesForReadOnly}
 * emits.
 */
@@ -24554,7 +24894,7 @@ var WAFv2WebACLProvider = class {
 			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$11({ ResourceARN: physicalId }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagInfoForResource?.TagList);
 		} catch (err) {
-			this.logger.debug(`WAFv2 ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`WAFv2 ListTagsForResource(${physicalId}) failed: ${describeAwsFailure(err).detail}`);
 		}
 		return result;
 	}
@@ -26778,8 +27118,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const obj = value;
 		if ("Ref" in obj) return await this.resolveRef(obj["Ref"], context);
 		if ("Fn::GetAtt" in obj) return await this.resolveGetAtt(obj["Fn::GetAtt"], context);
-		if ("Fn::Join" in obj) return await this.resolveJoin(obj["Fn::Join"], context);
-		if ("Fn::Sub" in obj) return await this.resolveSub(obj["Fn::Sub"], context);
+		if ("Fn::Join" in obj) return await this.resolveJoin(obj["Fn::Join"], context, obj);
+		if ("Fn::Sub" in obj) return await this.resolveSub(obj["Fn::Sub"], context, obj);
 		if ("Fn::Select" in obj) return await this.resolveSelect(obj["Fn::Select"], context);
 		if ("Fn::Split" in obj) return await this.resolveSplit(obj["Fn::Split"], context);
 		if ("Fn::If" in obj) return await this.resolveIf(obj["Fn::If"], context);
@@ -27875,32 +28215,45 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*
 	* Fn::Join: [delimiter, [value1, value2, ...]]
 	*/
-	async resolveJoin(joinArgs, context) {
+	async resolveJoin(joinArgs, context, source) {
 		const [delimiter, rawValues] = joinArgs;
 		let values = rawValues;
 		if (!Array.isArray(values)) values = await this.resolveValue(values, context);
 		if (!Array.isArray(values)) throw new Error(`Fn::Join's second argument must be a list (an array literal or a list-returning intrinsic such as Fn::Cidr / Fn::GetAZs / Fn::Split / a Ref to a list-typed parameter — any List<...> type or CommaDelimitedList), but resolved to ${typeof values}`);
 		const literalList = Array.isArray(rawValues);
-		const parts = (await allSettledKeepingFirstRejection(values.map(async (v) => {
-			if (typeof v === "string") return {
-				...v.includes("{{resolve:") ? await this.resolveDynamicReferencesWithLogTwin(v, this.logTwinOfProduct({
+		const resolvedParts = await allSettledKeepingFirstRejection(values.map(async (v) => {
+			if (typeof v === "string") {
+				const part = v.includes("{{resolve:") ? await this.resolveDynamicReferencesWithLogTwin(v, this.logTwinOfProduct({
 					result: v,
 					twin: v
 				}, context).twin, context) : {
 					result: v,
-					twin: v
-				},
-				product: !literalList
-			};
+					twin: v,
+					substitutions: [],
+					complete: true
+				};
+				return {
+					result: part.result,
+					twin: part.twin,
+					product: !literalList,
+					input: v,
+					substitutions: part.substitutions,
+					complete: part.complete
+				};
+			}
 			const raw = await this.resolveValue(v, context);
 			const resolved = String(raw);
 			return {
 				result: resolved,
 				twin: resolved,
 				product: true,
-				raw: { value: raw }
+				raw: { value: raw },
+				input: resolved,
+				substitutions: [],
+				complete: true
 			};
-		}), (pending) => this.warnAbandonedParts(pending))).map((part) => {
+		}), (pending) => this.warnAbandonedParts(pending));
+		const parts = resolvedParts.map((part) => {
 			if (!part.product) return part;
 			if (part.raw) return {
 				result: part.result,
@@ -27910,7 +28263,20 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		});
 		let result = parts.map((part) => part.result).join(delimiter);
 		let twin = parts.map((part) => part.twin).join(delimiter);
-		if (result.includes("{{resolve:")) ({result, twin} = await this.resolveDynamicReferencesWithLogTwin(result, twin, context));
+		const substitutions = resolvedParts.flatMap((part) => part.substitutions);
+		let complete = resolvedParts.every((part) => part.complete);
+		if (result.includes("{{resolve:")) {
+			const joined = await this.resolveDynamicReferencesWithLogTwin(result, twin, context);
+			({result, twin} = joined);
+			substitutions.push(...joined.substitutions);
+			complete &&= joined.complete;
+		}
+		this.recordLeafResolution(context, source, {
+			input: resolvedParts.map((part) => part.input).join(delimiter),
+			output: result,
+			substitutions,
+			complete
+		});
 		this.rememberLogTwin(context, result, twin);
 		this.logger.debug(`Resolved Fn::Join: ${this.maskSecretsForLog(this.logTwinText(result, twin, context), context)}`);
 		return result;
@@ -28052,10 +28418,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* inside replace(). For full async support, we'd need to collect all replacements
 	* first, then do them synchronously.
 	*/
-	async resolveSub(subArgs, context) {
+	async resolveSub(subArgs, context, source) {
 		let template;
 		const variables = Object.create(null);
 		const variableTwins = Object.create(null);
+		const variablePasses = Object.create(null);
 		if (Array.isArray(subArgs)) {
 			const [templateString, variableMap] = subArgs;
 			template = templateString;
@@ -28063,10 +28430,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			for (const [key, val] of Object.entries(variableMap)) if (typeof val === "string") {
 				const resolved = val.includes("{{resolve:") ? await this.resolveDynamicReferencesWithLogTwin(val, val, context) : {
 					result: val,
-					twin: val
+					twin: val,
+					substitutions: [],
+					complete: true
 				};
 				variables[key] = resolved.result;
 				variableTwins[key] = resolved.twin;
+				variablePasses[key] = resolved;
 			} else variables[key] = context.abandonedResolutions === void 0 ? await this.resolveValue(val, context) : await this.resolveKeyUnit(key, val, context, context.abandonedResolutions);
 		} else template = subArgs;
 		const replacements = [];
@@ -28093,9 +28463,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 			let replacement;
 			let twinReplacement;
+			let pass;
 			if (varNameStr in variables) {
 				replacement = String(variables[varNameStr]);
 				twinReplacement = varNameStr in variableTwins ? variableTwins[varNameStr] : this.productLogTwin(variables[varNameStr], context);
+				if (varNameStr in variablePasses) pass = variablePasses[varNameStr];
 			} else {
 				const pseudoValue = await this.resolvePseudoParameter(varNameStr, context);
 				if (pseudoValue !== void 0) replacement = String(pseudoValue);
@@ -28125,7 +28497,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			replacements.push({
 				match: match[0],
 				replacement,
-				twin: twinReplacement ?? replacement
+				twin: twinReplacement ?? replacement,
+				...pass ? { pass } : {}
 			});
 		}
 		let cursor = 0;
@@ -28138,7 +28511,21 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const entry = replacements[twinCursor++];
 			return entry ? entry.twin : whole;
 		});
-		if (result.includes("{{resolve:")) ({result, twin} = await this.resolveDynamicReferencesWithLogTwin(result, twin, context));
+		const input = result;
+		const substitutions = replacements.flatMap((entry) => entry.pass?.substitutions ?? []);
+		let complete = replacements.every((entry) => entry.pass?.complete ?? true);
+		if (result.includes("{{resolve:")) {
+			const substituted = await this.resolveDynamicReferencesWithLogTwin(result, twin, context);
+			({result, twin} = substituted);
+			substitutions.push(...substituted.substitutions);
+			complete &&= substituted.complete;
+		}
+		this.recordLeafResolution(context, source, {
+			input,
+			output: result,
+			substitutions,
+			complete
+		});
 		this.rememberLogTwin(context, result, twin);
 		this.logger.debug(`Resolved Fn::Sub: ${this.maskSecretsForLog(this.logTwinText(result, twin, context), context)}`);
 		return result;
@@ -29528,7 +29915,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* not the bag holds pairs. Where the middle RE-WRAPS it (an `Fn::Join` around
 	* the `Ref`) the middle registers its own twin, and the hand-off still drops
 	* a bag holding no pairs (it passes `inheritedSecrets` only when `size` is
-	* nonzero). Both are issue #3156.
+	* nonzero). What reaches a grandchild instead is the parent's WHOLE-VALUE
+	* entry: the middle's `{ Ref }` copies it into the middle's bag, which is then
+	* non-empty and handed down. Issue #3156 made the carry record that entry for
+	* the intrinsic frames it used to refuse; a frame it still refuses (listed on
+	* `recordNestedStackParameterExpressions`) keeps both gaps.
 	*
 	* The registry is keyed by VALUE, and `splitLogTwins`' unaligned arm
 	* registers every piece, public ones included. So a child `Fn::Base64` over a
@@ -29578,6 +29969,17 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		};
 	}
 	/**
+	* Record the `Fn::Join` / `Fn::Sub` object `source`'s own resolution under
+	* the pass bag the nested-stack carry reads (issue
+	* [#3156](https://github.com/go-to-k/cdkd/issues/3156)). The key is the
+	* object `resolveValue` dispatched on, and a context with no bag has no pass
+	* to scope it to.
+	*/
+	recordLeafResolution(context, source, resolution) {
+		if (context.recordedSecretValues === void 0) return;
+		recordIntrinsicLeafResolution(context.recordedSecretValues, source, resolution);
+	}
+	/**
 	* Register a MASKED `twin` as the log twin of `result` for this pass (issue
 	* #3100). An unmasked twin is not registered, so a later literal that
 	* resolves to the same string cannot replace an earlier write's mask, and
@@ -29715,6 +30117,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const pattern = /\{\{resolve:([^}]+)\}\}/g;
 		let result = value;
 		let twin = logTwin;
+		const substitutions = [];
+		let complete = true;
 		let match;
 		const matches = [];
 		while ((match = pattern.exec(value)) !== null) matches.push({
@@ -29730,7 +30134,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const nameLogText = inherited?.nameLogText ?? (pairedTwin === void 0 ? () => "***" : this.dynamicReferenceNameLogText(inner, pairedTwin, context));
 			try {
 				const isKnownSecret = service === "secretsmanager" || service === "ssm-secure" || recordedSecretExpressions.has(fullMatch);
-				if (isKnownSecret && context?.skipDynamicReferences) continue;
+				if (isKnownSecret && context?.skipDynamicReferences) {
+					complete = false;
+					continue;
+				}
 				const regionVerdict = classifyReplaySecretRegion(fullMatch, this.explicitRegion ?? this.resolverRegion, context?.producerRegions);
 				if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${this.maskSecretsForLog(tokenLogText, context)}: it names '${this.maskSecretsForLog(nameLogText(regionVerdict.secretName), context)}' without a region, and this stack reads from ${this.maskSecretsForLog(regionVerdict.foreignProducerRegions.map((r) => this.maskSecretsForLog(r, context)).join(", "), context)} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
 				if (regionVerdict.kind === "named-region") {
@@ -29740,6 +30147,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					});
 					result = result.replace(fullMatch, () => foreign.result);
 					twin = twin.replace(fullMatch, () => foreign.twin);
+					const [delegated] = foreign.substitutions;
+					substitutions.push({
+						token: fullMatch,
+						value: foreign.result,
+						secret: foreign.substitutions.length === 1 && delegated.secret
+					});
+					if (!foreign.complete || foreign.substitutions.length !== 1) complete = false;
 					continue;
 				}
 				const cached = this.cachedDynamicReferences.get(fullMatch);
@@ -29750,6 +30164,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					}
 					result = result.replace(fullMatch, () => cached.value);
 					twin = twin.replace(fullMatch, () => cached.secret && cached.value ? "***" : cached.value);
+					substitutions.push({
+						token: fullMatch,
+						value: cached.value,
+						secret: cached.secret
+					});
 					continue;
 				}
 				const parts = inner.split(":");
@@ -29777,7 +30196,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					else cacheable = false;
 					isSecret = param.secure;
 					if (param.secure) {
-						if (!decrypt) continue;
+						if (!decrypt) {
+							complete = false;
+							continue;
+						}
 					}
 					resolved = param.value;
 				} else if (service === "ssm-secure") {
@@ -29787,6 +30209,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					resolved = param.value;
 				} else {
 					this.logger.warn(this.maskSecretsForLog(`Unsupported dynamic reference service: ${this.maskSecretsForLog(nameLogText(String(service)), context)}`, context));
+					complete = false;
 					continue;
 				}
 				if (cacheable) this.cachedDynamicReferences.set(fullMatch, {
@@ -29800,6 +30223,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				}
 				result = result.replace(fullMatch, () => resolved);
 				twin = twin.replace(fullMatch, () => isSecret && resolved ? "***" : resolved);
+				substitutions.push({
+					token: fullMatch,
+					value: resolved,
+					secret: isSecret
+				});
 			} catch (err) {
 				if (context?.abandonedResolutions === void 0) throw err;
 				if (isDeliberateResolutionRefusal(err)) throw err;
@@ -29812,13 +30240,16 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					}
 					return out;
 				}));
+				complete = false;
 				continue;
 			}
 		}
 		if (context) this.rememberLogTwin(context, result, twin);
 		return {
 			result,
-			twin
+			twin,
+			substitutions,
+			complete
 		};
 	}
 	/**
@@ -30073,7 +30504,7 @@ async function disableInstanceApiTermination(client, instanceId, logger) {
 		}));
 		logger.debug(`Disabled DisableApiTermination on EC2 Instance ${instanceId} before deletion`);
 	} catch (flipError) {
-		logger.debug(`Could not disable DisableApiTermination on ${instanceId}: ${flipError instanceof Error ? flipError.message : String(flipError)}`);
+		logger.debug(`Could not disable DisableApiTermination on ${instanceId}: ${describeAwsFailure(flipError).detail}`);
 	}
 }
 /**
@@ -30385,7 +30816,7 @@ function getTopLevelWriteOnlyProperties(resourceType) {
 	if (cached) return cached;
 	const entry = fetchTopLevelWriteOnlyProperties(resourceType).catch((error) => {
 		writeOnlyPropertiesCache.delete(resourceType);
-		const message = error instanceof Error ? error.message : String(error);
+		const message = describeAwsFailure(error).detail;
 		getLogger().child("WriteOnlyProperties").warn(`Failed to resolve write-only properties for ${resourceType} via cloudformation:DescribeType (${message}). Falling back to a minimal update patch — write-only properties (if any) may be dropped by the Cloud Control read-modify-write update. Grant cloudformation:DescribeType to enable write-only property re-inclusion.`);
 		return /* @__PURE__ */ new Set();
 	});
@@ -30511,7 +30942,7 @@ function getTopLevelReadOnlyProperties(resourceType) {
 	if (cached) return cached;
 	const entry = fetchTopLevelReadOnlyProperties(resourceType).catch((error) => {
 		readOnlyPropertiesCache.delete(resourceType);
-		const message = error instanceof Error ? error.message : String(error);
+		const message = describeAwsFailure(error).detail;
 		getLogger().child("ReadOnlyProperties").debug(`Failed to resolve read-only properties for ${displaySafe(resourceType, { asciiOnly: true })} via cloudformation:DescribeType (${message}).`);
 	});
 	readOnlyPropertiesCache.set(resourceType, entry);
@@ -31729,7 +32160,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-B8GAVns4.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BOYln2Tw.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -34396,7 +34827,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 			}
 			this.logger.debug(`Successfully deleted custom resource ${logicalId}`);
 		} catch (error) {
-			this.logger.warn(`Failed to delete custom resource ${logicalId}, but continuing: ${error instanceof Error ? error.message : String(error)}. The Delete handler did not complete, so anything this custom resource manages may still be LIVE — cdkd is KEEPING the state record and the run exits non-zero. ${CR_SKIP_NOT_A_RETRY_CAVEAT} ${DEPLOY_SKIP_CAVEAT}`);
+			this.logger.warn(`Failed to delete custom resource ${logicalId}, but continuing: ${describeAwsFailure(error).detail}. The Delete handler did not complete, so anything this custom resource manages may still be LIVE — cdkd is KEEPING the state record and the run exits non-zero. ${CR_SKIP_NOT_A_RETRY_CAVEAT} ${DEPLOY_SKIP_CAVEAT}`);
 			return {
 				outcome: "skipped",
 				reason: CR_DELETE_INVOKE_FAILED_SKIP_REASON
@@ -34433,7 +34864,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 			return false;
 		} catch (error) {
 			if (error.name === "ResourceNotFoundException") return true;
-			this.logger.debug(`GetFunction pre-check for ${serviceToken} failed inconclusively (${error instanceof Error ? error.message : String(error)}); proceeding with the normal delete invoke`);
+			this.logger.debug(`GetFunction pre-check for ${serviceToken} failed inconclusively (${describeAwsFailure(error).detail}); proceeding with the normal delete invoke`);
 			return false;
 		}
 	}
@@ -34510,7 +34941,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				} catch (error) {
 					if (delivered || preDeliveryRetries >= this.preDeliveryAuthzMaxRetries || !this.isTransientAuthzThrow(error)) throw error;
 					const delayMs = Math.min(250 * Math.pow(2, preDeliveryRetries), IAM_PROPAGATION_MAX_DELAY_MS);
-					this.logger.warn(`Custom resource ${operation} for ${logicalId} hit a transient IAM-authorization error before the request was delivered (attempt ${attempt + 1}/${this.preDeliveryAuthzMaxRetries + 1}): ${this.truncateReason(error instanceof Error ? error.message : String(error))}. Retrying in ${delayMs / 1e3}s with a fresh response URL and RequestId.`);
+					this.logger.warn(`Custom resource ${operation} for ${logicalId} hit a transient IAM-authorization error before the request was delivered (attempt ${attempt + 1}/${this.preDeliveryAuthzMaxRetries + 1}): ${this.truncateReason(describeAwsFailure(error).detail)}. Retrying in ${delayMs / 1e3}s with a fresh response URL and RequestId.`);
 					if (invocation !== void 0) await this.cleanupResponseObject(invocation.responseKey);
 					preDeliveryRetries += 1;
 					await this.sleepInterruptibly(delayMs, watch);
@@ -34712,7 +35143,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				maxDelay: 5
 			}, { FunctionName: serviceToken });
 		} catch (error) {
-			this.logger.debug(`Could not recycle backing function for ${logicalId} (${error instanceof Error ? error.message : String(error)}); retrying invoke without a forced cold start`);
+			this.logger.debug(`Could not recycle backing function for ${logicalId} (${describeAwsFailure(error).detail}); retrying invoke without a forced cold start`);
 		}
 	}
 	/**
@@ -35061,7 +35492,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				Key: responseKey
 			}));
 		} catch (error) {
-			this.logger.debug(`Failed to delete custom-resource response object s3://${displaySafe(bucket, { asciiOnly: true }) || "<unrenderable>"}/${displaySafe(responseKey)}; it remains as a current object. Underlying error: ${displaySafe(error instanceof Error ? error.message : String(error)) || "<unrenderable>"}`);
+			this.logger.debug(`Failed to delete custom-resource response object s3://${displaySafe(bucket, { asciiOnly: true }) || "<unrenderable>"}/${displaySafe(responseKey)}; it remains as a current object. Underlying error: ${displaySafe(describeAwsFailure(error).detail) || "<unrenderable>"}`);
 		}
 		await purgeNoncurrentKeyVersions(this.s3Client, bucket, [responseKey], {
 			logger: this.logger,
@@ -35840,7 +36271,7 @@ var IAMRoleProvider = class {
 					await this.iamClient.send(new DeleteRoleCommand({ RoleName: roleName }));
 					this.logger.debug(`Cleaned up partially-created IAM role ${logicalId} (${roleName}) after wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created IAM role ${logicalId} (${roleName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: detach managed policies (aws iam list-attached-role-policies --role-name ${roleName} then aws iam detach-role-policy --role-name ${roleName} --policy-arn <arn>), delete inline policies (aws iam list-role-policies --role-name ${roleName} then aws iam delete-role-policy --role-name ${roleName} --policy-name <name>), then aws iam delete-role --role-name ${roleName}`);
+					this.logger.warn(`Failed to clean up partially-created IAM role ${logicalId} (${roleName}): ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required before the next deploy: detach managed policies (aws iam list-attached-role-policies --role-name ${roleName} then aws iam detach-role-policy --role-name ${roleName} --policy-arn <arn>), delete inline policies (aws iam list-role-policies --role-name ${roleName} then aws iam delete-role-policy --role-name ${roleName} --policy-name <name>), then aws iam delete-role --role-name ${roleName}`);
 				}
 				throw innerError;
 			}
@@ -35877,8 +36308,8 @@ var IAMRoleProvider = class {
 					this.logger.warn(`Skipped deleting old role ${physicalId} during replacement: ${deleteResult.reason}. The old role may be orphaned and require manual cleanup.`);
 				}
 			} catch (error) {
-				orphanReason = `old role ${physicalId} could not be deleted: ${String(error)}`;
-				this.logger.warn(`Failed to delete old role ${physicalId} during replacement: ${String(error)}. The old role may be orphaned and require manual cleanup.`);
+				orphanReason = `old role ${physicalId} could not be deleted: ${safeStringify(error)}`;
+				this.logger.warn(`Failed to delete old role ${physicalId} during replacement: ${safeStringify(error)}. The old role may be orphaned and require manual cleanup.`);
 			}
 			const base = {
 				physicalId: createResult.physicalId,
@@ -38147,7 +38578,7 @@ function makeCanonicalizePropertiesFn(registry) {
 			if (!registry.hasProvider(resourceType)) return properties;
 			return registry.getProvider(resourceType).canonicalizeDesiredProperties?.(resourceType, properties) ?? properties;
 		} catch (error) {
-			logger.debug(`canonicalizeDesiredProperties failed for ${resourceType}: ${error instanceof Error ? error.message : String(error)}`);
+			logger.debug(`canonicalizeDesiredProperties failed for ${resourceType}: ${describeAwsFailure(error).detail}`);
 			return properties;
 		}
 	};
@@ -44723,5 +45154,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { secretBearing as $, withErrorHandling as $i, LockManager as $n, getDefaultStateBucketName as $r, s3BucketArn as $t, extractDeploymentEventError as A, CdkdError as Ai, findActionableSilentDrops as An, parseBootstrapMarker as Ar, isImpossibleEmptyStoredAttribute as At, toCfnInteger as B, MalformedProducerRecordRefusalError as Bi, carriesSecretMask as Bn, dockerSpawnEnvWithSensitive as Br, coerceCfnBoolean as Bt, buildFinalSnapshotIdentifier as C, clearBucketRegionCache as Ci, refuseMalformedOutputs as Cn, rewriteTemplateAssetReferences as Cr, isTerminationProtectionPropagationError as Ct, refusesFinalSnapshot as D, resetAwsClients as Di, repairMalformedOutputsForReadOnly as Dn, ensureAssetStorage as Dr, cfnRefValueFromPhysicalId as Dt, isFinalSnapshotError as E, getAwsClients as Ei, refuseMalformedState as En, assertAssetBucketRegion as Er, carriesFetchableDynamicReference as Et, isStatefulRecreateTargetSync as F, DynamicReferenceRegionAmbiguousError as Fi, TemplateParser as Fn, describeAwsFailure as Fr, isSettledInstanceState as Ft, gray as G, ResourceUpdateNotSupportedError as Gi, isSingleDynamicReferenceToken as Gn, runDockerForeground as Gr, readConfigString as Gt, formatResourceLine as H, PartialFailureError as Hi, dynamicReferenceTokens as Hn, getDockerCmd as Hr, configBooleanRefusal as Ht, renderStatefulReason as I, IntrinsicResolutionRefusalError as Ii, STATE_SOURCED_BASELINE_RULES as In, buildDockerImage as Ir, WAFv2WebACLProvider as It, yellow as J, StateError as Ji, maskSecretsInText as Jn, stripControlChars as Jr, requireConfigObject as Jt, green as K, StackHasActiveImportsError as Ki, markSameGenerationBag as Kn, runDockerStreaming as Kr, replayWarn as Kt, WARM_THROUGHPUT_MEMBERS as L, LocalInvokeBuildError as Li, STATE_SOURCED_CROSS_GENERATION_RULES as Ln, describeDockerCapturedOutput as Lr, normalizeAwsTagsToCfn as Lt, planOrphanAdoption as M, CrossAccountSecretRefusalError as Mi, describeTypeWithThrottleRetry as Mn, validateAssetBucketName as Mr, isUnboundTemplateParameter as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, DependencyError as Ni, withRetry as Nn, validateContainerRepoName as Nr, parameterTypeMayLoseSecretIdentity as Nt, unsupportedFinalSnapshotError as O, setAwsClients as Oi, repairMalformedResourcePropertiesForReadOnly as On, getBootstrapMarkerKey as Or, coerceParameterTypedValue as Ot, isStatefulRecreateTargetForReplace as P, DeployCancelledError as Pi, DagBuilder as Pn, buildDenyExternalAccessPolicy as Pr, refStateLookupFromResource as Pt, isExportAliasCollision as Q, normalizeAwsError as Qi, scrubResourceRecord as Qn, synthesisStatusMessage as Qr, withSharedDrainBudget as Qt, coerceWarmThroughput as R, LocalStartServiceError as Ri, STATE_SOURCED_READBACK_RULES as Rn, describeDockerExecFailure as Rr, resolveExplicitPhysicalId as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, processStackMessages as Si, refuseMalformedNestedChildOutputs as Sn, loadPublishableAssetManifest as Sr, disableInstanceApiTermination as St, createPreDeleteFinalSnapshot as T, AwsClients as Ti, refuseMalformedResourcesForDestroy as Tn, BOOTSTRAP_MARKER_PREFIX as Tr, carriesDynamicReference as Tt, bold as U, ProvisioningError as Ui, errorCauseChain as Un, partitionSensitiveEnv as Ur, configIntegerRefusal as Ut, toFiniteNumber as V, NestedStackChildDirectDestroyError as Vi, createSecretMasker as Vn, formatDockerLoginError as Vr, coerceCfnInteger as Vt, cyan as W, ResourceTimeoutError as Wi, identityKeyFor as Wn, redactDockerArgvValues as Wr, configStringRefusal as Wt, collectPublishedOutputNames as X, formatError as Xi, recoverMaskedOutput as Xn, getDockerImageBySourceHash as Xr, classifyReplaySecretRegion as Xt, collectDeclaredOutputNames as Y, SynthesisError as Yi, recordMaskOnlyValue as Yn, AssetManifestLoader as Yr, requireConfigString as Yt, exportAliasCollisionScrubWarning as Z, isCdkdError as Zi, redactSecretsForState as Zn, Synthesizer as Zr, producerRegionsFromState as Zt, isSecretBearingReferenceString as _, expectedOwnerParam as _i, malformedRenderedContainersWarning as _n, AssetPublisher as _r, isWaitAbandonedError as _t, DeploymentEventsStore as a, markRedactedCause as aa, resolveStateBucketWithDefault as ai, applyCallerIdentityCredentials as an, formatLockExpiry as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, derivePartitionAndUrlSuffix as bi, malformedStateRefusalMessage as bn, buildAssetRedirectMap as br, deleteIndeterminateGuards as bt, replayFailedOperations as c, stateBucketExistenceConfirmed as ci, INTRINSIC_KEYS as cn, DEFAULT_STATE_PREFIX as cr, createMaskedRetryLogger as ct, updatePartialReason as d, CFN_TEMPLATE_URL_LIMIT as di, hasReadableResources as dn, importableOutputKeys as dr, beginCommandInterruptScope as dt, isMarkedNonRetryable as ea, getLegacyStateBucketName as ei, s3BucketDomainName as en, S3StateBackend as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, MIGRATE_TMP_PREFIX as fi, malformedExportNamesWarning as fn, importableOutputs as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, decodeListingKey as gi, malformedOutputsWarning as gn, shouldRetainResource as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as hi, malformedOutputsRefusalMessage as hn, orphansCarriedFrom as hr, startInterruptWatch as ht, DeploymentEventsReader as i, markNonRetryable as ia, resolveSkipPrefix as ii, applyRoleArnIfSet as in, forceQuitRecoveryClause as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, ConfigError as ji, findSilentDropProperties as jn, readBootstrapMarkerBody as jr, isNamelessDynamicReferenceError as jt, makeCanonicalizePropertiesFn as k, AssetError as ki, repairMalformedResourcesForReadOnly as kn, isCrossRegionRedirect as kr, getAccountInfo as kt, replayRollback as l, warnDeprecatedNoPrefixCliFlag as li, STATE_RESOURCES_MALFORMED as ln, exportNamesCarriedFrom as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, uploadCfnTemplate as mi, malformedLocalOutputsWarning as mn, orphansAfterRollback as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isThrottlingError as na, resolveAutoAssetStorage as ni, s3BucketRegionalDomainName as nn, buildForceUnlockCommand as nr, getCurrentResourceSecrets as nt, planFailedOps as o, retryClassificationText as oa, resolveStateBucketWithDefaultAndSource as oi, callerEnvCredentials as on, shellQuote as or, ProviderRegistry as ot, maskingRetryLogger as p, findLargeInlineResources as pi, malformedExportSourceWarning as pn, isReadableBag as pr, interruptWatchListenerCount as pt, red as q, StackTerminationProtectionError as qi, maskSecretsInError as qn, escapeRegExp$1 as qr, requireConfigArray as qt, DeployEngine as r, isTransientServerError as ra, resolveCaptureObservedState as ri, s3BucketWebsiteUrl as rn, buildLockContentionMessage as rr, IAMRoleProvider as rt, planRollback as s, __exportAll as sa, resolveUseCdkBootstrapAssets as si, DiffCalculator as sn, CUSTOM_RESOURCE_RESPONSE_PREFIX as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, isRetryableTransientError as ta, resolveApp as ti, s3BucketDualStackDomainName as tn, rebuildClientForBucketRegion as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, CFN_TEMPLATE_BODY_LIMIT as ui, hasReadableOutputs as un, hasReadableExportSet as ur, maskerOrIdentity as ut, keptWholeReasonText as v, PARTITION_TABLE as vi, malformedResourcePropertiesWarning as vn, stringifyValue as vr, slowCcOperationTimeoutMs as vt, ccRoutedFinalSnapshotError as w, resolveBucketRegion as wi, refuseMalformedOutputsForDestroy as wn, AssetModeResolver as wr, IntrinsicFunctionResolver as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, AssemblyReader as xi, producerRecordKey as xn, createAssetRedirectResolver as xr, deleteSkipReason as xt, mergeNoChangeOutputs as y, canonicalizeRegion as yi, malformedResourcesWarning as yn, WorkGraph as yr, UNSPECIFIED_SKIP_REASON as yt, isWarmThroughputDecrease as z, LockError as zi, TEMPLATE_SOURCED_RULES as zn, describeDockerFailure as zr, assertRegionMatch as zt };
-//# sourceMappingURL=deploy-engine-KnCjibgq.js.map
+export { secretBearing as $, isCdkdError as $i, scrubResourceRecord as $n, Synthesizer as $r, s3BucketArn as $t, extractDeploymentEventError as A, setAwsClients as Ai, repairMalformedResourcesForReadOnly as An, isCrossRegionRedirect as Ar, isImpossibleEmptyStoredAttribute as At, toCfnInteger as B, LocalStartServiceError as Bi, TEMPLATE_SOURCED_RULES as Bn, describeDockerExecFailure as Br, coerceCfnBoolean as Bt, buildFinalSnapshotIdentifier as C, AssemblyReader as Ci, refuseMalformedOutputs as Cn, loadPublishableAssetManifest as Cr, isTerminationProtectionPropagationError as Ct, refusesFinalSnapshot as D, AwsClients as Di, refuseMalformedState as Dn, assertAssetBucketRegion as Dr, cfnRefValueFromPhysicalId as Dt, isFinalSnapshotError as E, resolveBucketRegion as Ei, refuseMalformedResourcesForDestroy as En, BOOTSTRAP_MARKER_PREFIX as Er, carriesFetchableDynamicReference as Et, isStatefulRecreateTargetSync as F, DependencyError as Fi, DagBuilder as Fn, buildDenyExternalAccessPolicy as Fr, isSettledInstanceState as Ft, gray as G, ProvisioningError as Gi, identityKeyFor as Gn, partitionSensitiveEnv as Gr, readConfigString as Gt, formatResourceLine as H, MalformedProducerRecordRefusalError as Hi, createSecretMasker as Hn, dockerSpawnEnvWithSensitive as Hr, configBooleanRefusal as Ht, renderStatefulReason as I, DeployCancelledError as Ii, TemplateParser as In, describeAwsFailure as Ir, WAFv2WebACLProvider as It, yellow as J, StackHasActiveImportsError as Ji, maskSecretsInError as Jn, runDockerStreaming as Jr, requireConfigObject as Jt, green as K, ResourceTimeoutError as Ki, isSingleDynamicReferenceToken as Kn, redactDockerArgvValues as Kr, replayWarn as Kt, WARM_THROUGHPUT_MEMBERS as L, DynamicReferenceRegionAmbiguousError as Li, STATE_SOURCED_BASELINE_RULES as Ln, safeStringify as Lr, normalizeAwsTagsToCfn as Lt, planOrphanAdoption as M, CdkdError as Mi, findSilentDropProperties as Mn, readBootstrapMarkerBody as Mr, isUnboundTemplateParameter as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, ConfigError as Ni, describeTypeWithThrottleRetry as Nn, validateAssetBucketName as Nr, parameterTypeMayLoseSecretIdentity as Nt, unsupportedFinalSnapshotError as O, getAwsClients as Oi, repairMalformedOutputsForReadOnly as On, ensureAssetStorage as Or, coerceParameterTypedValue as Ot, isStatefulRecreateTargetForReplace as P, CrossAccountSecretRefusalError as Pi, withRetry as Pn, validateContainerRepoName as Pr, refStateLookupFromResource as Pt, isExportAliasCollision as Q, formatError as Qi, redactSecretsForState as Qn, getDockerImageBySourceHash as Qr, withSharedDrainBudget as Qt, coerceWarmThroughput as R, IntrinsicResolutionRefusalError as Ri, STATE_SOURCED_CROSS_GENERATION_RULES as Rn, buildDockerImage as Rr, resolveExplicitPhysicalId as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, derivePartitionAndUrlSuffix as Si, refuseMalformedNestedChildOutputs as Sn, createAssetRedirectResolver as Sr, disableInstanceApiTermination as St, createPreDeleteFinalSnapshot as T, clearBucketRegionCache as Ti, refuseMalformedResourcePropertiesForOrphan as Tn, AssetModeResolver as Tr, carriesDynamicReference as Tt, bold as U, NestedStackChildDirectDestroyError as Ui, dynamicReferenceTokens as Un, formatDockerLoginError as Ur, configIntegerRefusal as Ut, toFiniteNumber as V, LockError as Vi, carriesSecretMask as Vn, describeDockerFailure as Vr, coerceCfnInteger as Vt, cyan as W, PartialFailureError as Wi, errorCauseChain as Wn, getDockerCmd as Wr, configStringRefusal as Wt, collectPublishedOutputNames as X, StateError as Xi, recordMaskOnlyValue as Xn, stripControlChars as Xr, classifyReplaySecretRegion as Xt, collectDeclaredOutputNames as Y, StackTerminationProtectionError as Yi, maskSecretsInText as Yn, escapeRegExp$1 as Yr, requireConfigString as Yt, exportAliasCollisionScrubWarning as Z, SynthesisError as Zi, recoverMaskedOutput as Zn, AssetManifestLoader as Zr, producerRegionsFromState as Zt, isSecretBearingReferenceString as _, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as _i, malformedRenderedContainersWarning as _n, shouldRetainResource as _r, isWaitAbandonedError as _t, DeploymentEventsStore as a, isTransientServerError as aa, resolveCaptureObservedState as ai, applyCallerIdentityCredentials as an, forceQuitRecoveryClause as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, PARTITION_TABLE as bi, malformedStateRefusalMessage as bn, WorkGraph as br, deleteIndeterminateGuards as bt, replayFailedOperations as c, retryClassificationText as ca, resolveStateBucketWithDefaultAndSource as ci, INTRINSIC_KEYS as cn, CUSTOM_RESOURCE_RESPONSE_PREFIX as cr, createMaskedRetryLogger as ct, updatePartialReason as d, warnDeprecatedNoPrefixCliFlag as di, hasReadableResources as dn, hasReadableExportSet as dr, beginCommandInterruptScope as dt, normalizeAwsError as ea, synthesisStatusMessage as ei, s3BucketDomainName as en, LockManager as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, CFN_TEMPLATE_BODY_LIMIT as fi, malformedExportNamesWarning as fn, importableOutputKeys as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, uploadCfnTemplate as gi, malformedOutputsWarning as gn, orphansCarriedFrom as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, findLargeInlineResources as hi, malformedOutputsRefusalMessage as hn, orphansAfterRollback as hr, startInterruptWatch as ht, DeploymentEventsReader as i, isThrottlingError as ia, resolveAutoAssetStorage as ii, applyRoleArnIfSet as in, buildLockContentionMessage as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, AssetError as ji, findActionableSilentDrops as jn, parseBootstrapMarker as jr, isNamelessDynamicReferenceError as jt, makeCanonicalizePropertiesFn as k, resetAwsClients as ki, repairMalformedResourcePropertiesForReadOnly as kn, getBootstrapMarkerKey as kr, getAccountInfo as kt, replayRollback as l, __exportAll as la, resolveUseCdkBootstrapAssets as li, STATE_RESOURCES_MALFORMED as ln, DEFAULT_STATE_PREFIX as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, MIGRATE_TMP_PREFIX as mi, malformedLocalOutputsWarning as mn, isReadableBag as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isMarkedNonRetryable as na, getLegacyStateBucketName as ni, s3BucketRegionalDomainName as nn, rebuildClientForBucketRegion as nr, getCurrentResourceSecrets as nt, planFailedOps as o, markNonRetryable as oa, resolveSkipPrefix as oi, callerEnvCredentials as on, formatLockExpiry as or, ProviderRegistry as ot, maskingRetryLogger as p, CFN_TEMPLATE_URL_LIMIT as pi, malformedExportSourceWarning as pn, importableOutputs as pr, interruptWatchListenerCount as pt, red as q, ResourceUpdateNotSupportedError as qi, markSameGenerationBag as qn, runDockerForeground as qr, requireConfigArray as qt, DeployEngine as r, isRetryableTransientError as ra, resolveApp as ri, s3BucketWebsiteUrl as rn, buildForceUnlockCommand as rr, IAMRoleProvider as rt, planRollback as s, markRedactedCause as sa, resolveStateBucketWithDefault as si, DiffCalculator as sn, shellQuote as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, withErrorHandling as ta, getDefaultStateBucketName as ti, s3BucketDualStackDomainName as tn, S3StateBackend as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, stateBucketExistenceConfirmed as ui, hasReadableOutputs as un, exportNamesCarriedFrom as ur, maskerOrIdentity as ut, keptWholeReasonText as v, decodeListingKey as vi, malformedResourcePropertiesWarning as vn, AssetPublisher as vr, slowCcOperationTimeoutMs as vt, ccRoutedFinalSnapshotError as w, processStackMessages as wi, refuseMalformedOutputsForDestroy as wn, rewriteTemplateAssetReferences as wr, IntrinsicFunctionResolver as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, canonicalizeRegion as xi, producerRecordKey as xn, buildAssetRedirectMap as xr, deleteSkipReason as xt, mergeNoChangeOutputs as y, expectedOwnerParam as yi, malformedResourcesWarning as yn, stringifyValue as yr, UNSPECIFIED_SKIP_REASON as yt, isWarmThroughputDecrease as z, LocalInvokeBuildError as zi, STATE_SOURCED_READBACK_RULES as zn, describeDockerCapturedOutput as zr, assertRegionMatch as zt };
+//# sourceMappingURL=deploy-engine-CBzq85r6.js.map