@go-to-k/cdkd 0.290.22 → 0.290.23

package/dist/{deploy-engine-Dbmoo4FQ.js → deploy-engine-CBzq85r6.js}

@@ -1,6 +1,6 @@
-import { C as displaySafe, S as displayIdent, b as STACK_REF_MAX_CODE_POINTS, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE, y as withoutGeneratedFallbackName } from "./logger-C17H06QA.js";
+import { C as displaySafe, S as displayIdent, b as STACK_REF_MAX_CODE_POINTS, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE, y as withoutGeneratedFallbackName } from "./logger-CkHVgzLx.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-CpOEkAtB.js";
+import { t as getCdkdVersion } from "./version-DxUVmvM5.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7360,7 +7360,7 @@ function repairSpawnRefusal(text, args, maskedArgs) {
 * error would only say "Command failed with exit code N".
 */
 function describeDockerExecFailure(error, args) {
-	const message = thrownMessageText(error) || safeStringify(error);
+	const message = thrownMessageText(error) || safeStringify$1(error);
 	const stderrText = capturedStreamText(error, "stderr");
 	return redactDockerArgvInText(stderrText ? `${message}\n${stderrText}` : message, args);
 }
@@ -7403,7 +7403,7 @@ function thrownMessageText(error) {
 * two of these call sites are in `cleanupEcsRun`, where an exception aborts
 * the remaining volume / network teardown and leaks real Docker resources.
 */
-function safeStringify(error) {
+function safeStringify$1(error) {
 	try {
 		return String(error);
 	} catch {
@@ -7429,7 +7429,7 @@ function safeStringify(error) {
 * wrapper text needs the status as well.
 */
 function describeDockerFailure(error, args) {
-	return redactDockerArgvInText(capturedStreamText(error, "stderr") || thrownMessageText(error) || safeStringify(error), args);
+	return redactDockerArgvInText(capturedStreamText(error, "stderr") || thrownMessageText(error) || safeStringify$1(error), args);
 }
 /**
 * A `cause` that is safe to CHAIN onto a wrapper error, for a caller that
@@ -8019,6 +8019,40 @@ function isAwsAuthoredFailure(error) {
 	return candidate.$fault !== void 0 || typeof candidate.$metadata?.httpStatusCode === "number" || error.name === "CredentialsProviderError";
 }
 /**
+* Exactly what `String(value)` produces, without the throw.
+*
+* `String(value)` is the only spelling that carries an `Error`'s NAME as well
+* as its message (`"AccessDenied: User ... is not authorized"`), and several
+* call sites depend on that: four build a persisted `outcome: 'partial'`
+* reason where the wire code is the discriminator an operator reads first.
+* {@link describeAwsFailure}'s `detail` is the MESSAGE only, so it is NOT a
+* drop-in for the bare form -- substituting it silently deletes the code.
+* Measured, after a sweep did exactly that at nine sites.
+*
+* So this is the 1:1 replacement: same output for every value `String` can
+* convert, and a stable sentence for the ones it cannot. A null-prototype
+* object throws `TypeError: Cannot convert object to primitive value`, and an
+* object with a hostile or `null` `toString` throws whatever it likes -- inside
+* a catch, that replaces the failure being reported.
+*
+* Use `describeAwsFailure(x).detail` where the site previously read
+* `x instanceof Error ? x.message : String(x)`; use THIS where it read a bare
+* `String(x)`.
+*
+* NOT a substitute for `displaySafe` in `display-safe.ts`, which guards the
+* same coercion and answers differently on purpose -- it falls back to
+* `Object.prototype.toString` and, more importantly, SANITISES the result for a
+* terminal. Anything about to be rendered or logged goes through that one; this
+* one is for the text a catch is about to record.
+*/
+function safeStringify(value) {
+	try {
+		return String(value);
+	} catch {
+		return "a value that could not be converted to text";
+	}
+}
+/**
 * Describe a caught failure for a thrown message. See {@link AwsFailureText}.
 */
 function describeAwsFailure(error) {
@@ -11935,6 +11969,84 @@ function resolvedPlaintextOf(secrets, expression) {
 function resolvedExpressionsOf(secrets) {
 	return [...resolvedPairsOf.get(secrets)?.keys() ?? []];
 }
+/** Poison for an intrinsic object one pass resolved two different ways. */
+const CONFLICTING_LEAF_RESOLUTION = Symbol("conflicting leaf resolution");
+/**
+* {@link IntrinsicLeafResolution}s per pass bag, keyed by the template OBJECT
+* that was resolved (issue [#3156](https://github.com/go-to-k/cdkd/issues/3156)).
+* The carry in {@link recordNestedStackParameterExpressions} reads it for the
+* very object the deploy engine handed the resolver, so its evidence is THIS
+* leaf's own resolution: no other leaf's substitution, however equal its value,
+* can answer for it, and each substitution carries its own verdict, which the
+* secret-only pair table cannot (an unclassifiable `ssm` answer recorded as a
+* pair looks the same as a later public answer with the same plaintext).
+* Both keys are weak, so a record lives as long as its bag and its template.
+*/
+const intrinsicLeafResolutionsOf = /* @__PURE__ */ new WeakMap();
+/**
+* Record how the pass that owns `secrets` resolved the intrinsic object
+* `source`. A second resolution of the same object that differs in any field
+* poisons it for the pass, and the poison is never lifted; an identical one
+* changes nothing.
+*/
+function recordIntrinsicLeafResolution(secrets, source, resolution) {
+	let leaves = intrinsicLeafResolutionsOf.get(secrets);
+	if (leaves === void 0) {
+		leaves = /* @__PURE__ */ new WeakMap();
+		intrinsicLeafResolutionsOf.set(secrets, leaves);
+	}
+	const copy = {
+		input: resolution.input,
+		output: resolution.output,
+		substitutions: resolution.substitutions.map(({ token, value, secret }) => ({
+			token,
+			value,
+			secret
+		})),
+		complete: resolution.complete
+	};
+	const previous = leaves.get(source);
+	if (previous === void 0) leaves.set(source, copy);
+	else if (previous === CONFLICTING_LEAF_RESOLUTION || !sameLeafResolution(previous, copy)) leaves.set(source, CONFLICTING_LEAF_RESOLUTION);
+}
+function sameLeafResolution(a, b) {
+	return a.input === b.input && a.output === b.output && a.complete === b.complete && a.substitutions.length === b.substitutions.length && a.substitutions.every((s, i) => s.token === b.substitutions[i].token && s.value === b.substitutions[i].value && s.secret === b.substitutions[i].secret);
+}
+/**
+* The spelling `source`'s own resolution in this pass proves for
+* `resolvedValue`, or `undefined` (issue
+* [#3156](https://github.com/go-to-k/cdkd/issues/3156)). Certified only when
+* the resolution replaced every token it met, replaced exactly ONE, took a
+* SECRET verdict for it, and produced `resolvedValue` from `input` by that one
+* replacement ({@link singleSpanFrame} over `input` with the token and value
+* equal). That is the observed equation `resolvedValue = input[token := value]`;
+* it says nothing about what a later lookup of the token returns.
+*
+* The `secret` test and the COUNT are independent. The count refuses a
+* replacement listed ahead of the one the frame names that left its plaintext,
+* not its token, in `input` -- a used Sub variable holding the SAME token as
+* the template (`port:T${V}` with `V` = `T`), whose first replacement passes
+* the token and value tests while `input` keeps the variable's plaintext.
+* `complete`, `output` and the token and value tests are implied, for every
+* shape the resolver records, by the count and `singleSpanFrame` over `input`:
+* a token left unreplaced in `input` is a second span, and a frame that fits
+* `input` around the one replacement fixes the output it produces. They are
+* kept so a recorder that is not faithful refuses rather than certifies, and
+* are pinned by hand-built records only.
+*/
+function substitutedSpellingOf(secrets, source, resolvedValue) {
+	const resolution = intrinsicLeafResolutionsOf.get(secrets)?.get(source);
+	if (resolution === void 0 || resolution === CONFLICTING_LEAF_RESOLUTION) return void 0;
+	if (!resolution.complete || resolution.output !== resolvedValue) return void 0;
+	if (resolution.substitutions.length !== 1) return void 0;
+	const [substitution] = resolution.substitutions;
+	if (!substitution.secret) return void 0;
+	const frame = singleSpanFrame(resolvedValue, resolution.input);
+	if (frame === void 0) return void 0;
+	if (frame.token !== substitution.token || frame.middle !== substitution.value) return void 0;
+	for (const plaintext of secrets.keys()) if (plaintext !== "" && (frame.prefix.includes(plaintext) || frame.suffix.includes(plaintext))) return;
+	return resolution.input;
+}
 /**
 * The bag OBJECTS a deploy pass produced ITSELF and installed on a success
 * path — the fact the resolved-pair evidence above cannot state (issue
@@ -12886,8 +12998,9 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 *         literal source; pinned by the "map NO RESOLVER populated" case,
 *         where (ii) and (iii) both pass and only the missing pair refuses.
 *         On an OBJECT source (`Fn::Join` / `Fn::Sub`, issue #3062) there is
-*         no source text to compare, so the spelling is what the pass WROTE,
-*         admitted only when `positioned[name] !== resolvedValue`. Sound
+*         no source text to compare, so the spelling-based arm takes what
+*         the pass WROTE, admitted only when `positioned[name] !==
+*         resolvedValue`. Sound
 *         together with (ii), not alone: on a value the scan is silent on,
 *         the cross-stack and skeleton arms both refuse (each requires the
 *         WHOLE leaf to be a key of the map, which would make the scan's
@@ -12895,16 +13008,23 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 *         scan leaves the leaf alone -- so the frame arm is the only writer
 *         that can have rewritten it, on its pair and the engine's mark. A
 *         frame that is not wholly literal makes that arm refuse, the leaf
-*         comes back unrewritten, and (i) refuses too. The object arm
-*         certifies only a source whose OWN rendered token starts with a
+*         comes back unrewritten, and this arm refuses too. It certifies
+*         only a source whose OWN rendered token starts with a
 *         spelled-secret prefix (`secretsmanager:` / `ssm-secure:`), read from
 *         the source and never from what the pass wrote: the frame arm
 *         matches among RECORDED references and a public `ssm` parameter
 *         records none, so a public leaf whose source spells `ssm:`, or leaves
 *         the service to an intrinsic part, can match a recorded secret
-*         sibling and be written as the sibling's reference. A SecureString
-*         spelled either way is indistinguishable here, so both are refused
-*         (see (e)). The STATE-derived
+*         sibling and be written as the sibling's reference. Where it refuses,
+*         the PROVENANCE arm (issue #3156) certifies on the leaf's own
+*         resolution instead: the resolver records, per `Fn::Join` /
+*         `Fn::Sub` object and pass bag, every token it replaced with the
+*         verdict that replacement took, and one SECRET replacement that turns
+*         the record's input into the value certifies that input as the
+*         spelling -- an `ssm:` or intrinsic-service token, and a frame whose
+*         non-literal part sits OUTSIDE the token, which the frame arm never
+*         writes. `frameSpellingOf` states what it proves and what it does
+*         not. The STATE-derived
 *         call sites reach this arm as well: `cdkd import` can leave raw
 *         intrinsics in a record's `properties`, which a rollback replay
 *         passes as its source, and the frame arm does not read `rules`.
@@ -12940,10 +13060,9 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 *         (i)-(iii) on its own), a leaf (iii) refused under a different
 *         frame, an object spelling the frame arm refused and a plain
 *         literal equal to the value all fail it and would take the entry's
-*         frame (an object spelling the arm POSITIONED whose own source
-*         spells a secret service is a frame like a literal one, issue
-*         #3062; one whose source does not counts as unframed) -- and so
-*         would a
+*         frame (an object spelling (i) certified is a frame like a literal
+*         one, issues #3062 and #3156; one it refused counts as unframed) --
+*         and so would a
 *         same-frame sibling whose token this pass never resolved to the
 *         middle: a PUBLIC `ssm` reference in the same `port:` frame holding
 *         the same two characters is kept RESOLVED on the record, and the
@@ -12952,7 +13071,13 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 *         the row are gathered BEFORE the conditions run, a spelling that is
 *         not a single-span literal frame with this pass's pair for its token
 *         (`resolvedPlaintextOf`) counting as its own, and a value is
-*         recorded only when its certified frame is the row's only one.
+*         recorded only when its certified frame is the row's only one. A
+*         value one of whose leaves the position pass did NOT write (the
+*         provenance arm's outside-the-token frame) also counts as unframed
+*         unless every framed spelling of it carries ONE token: the frame arm
+*         refuses that leaf on the parent's record, so the entry is written
+*         onto it by the value scan whatever its token, and (iii)'s rescue
+*         for a same-frame sibling does not reach it.
 *   (v)   No OTHER string leaf of the ROW would be rewritten by the entry,
 *         read over every leaf of the resolved row since the bag is per
 *         resource, not per `Parameters`. Two arms of the persist walk read
@@ -13038,16 +13163,29 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 * persists the plaintext -- the same class as the nonliteral-frame deferral.
 * (e) CLOSED for a wholly literal frame by (i)'s object arm (issue #3062;
 * was: an `Fn::Join` / `Fn::Sub` source in the parent's own `Parameters`
-* block was never carried). What remains of it: an object source whose frame
-* is NOT wholly literal -- a region `Ref` outside the token -- is refused by
-* the frame arm, so (i) refuses it and the child leaf keeps the plaintext,
-* the same nonliteral-frame deferral the parent's own record has; and an
-* intrinsic frame whose token spells `ssm:`, or leaves its service to an
-* intrinsic part, is refused by (i) whatever the parameter's type, so a 1-3
-* character SecureString spelled that way keeps the plaintext in the child
-* too. That refusal is what keeps the frame arm's own wrong-reference
-* residual -- a public leaf matching a recorded sibling -- on the parent's
-* record instead of carrying it into the child's. (f) A child record persisted BEFORE this carry
+* block was never carried), and for the two spellings that arm refused -- a
+* token spelling `ssm:` or leaving its service to an intrinsic part, and a
+* frame whose non-literal part sits outside the token -- by its provenance
+* arm (issue #3156), which on the second also rewrites the PARENT's record of
+* the leaf through the entry. What remains of it: a leaf whose own resolution
+* does not certify -- the token spelled inside a NESTED intrinsic part (the
+* outer object's own text spells none), the token held by a used `Fn::Sub`
+* variable (the template spells a placeholder there), a leaf resolved two
+* different ways in one pass, one whose replacement took a public verdict, one
+* that replaced more than one token, one whose affix holds a plaintext the bag
+* holds (another secret a non-literal part resolved), an `Fn::If` around the
+* object (which the skeleton cannot render, and whose record is under the
+* selected branch) -- keeps the plaintext in the child, and for the
+* outside-the-token frame in the parent's record; so does an outside-the-token
+* frame sharing its value with a leaf of another token, which (iv) refuses. A
+* rollback replay records nothing here (`resolveReplayProps` resolves strings,
+* not intrinsic objects): a journal a deploy wrote holds a carried frame's
+* persisted spelling as a STRING, which the literal arm reads, while a record
+* `cdkd import` left holding the raw intrinsic stays refused on this arm
+* (go-to-k/cdkd#3306 tracks the refused shapes). Any other resolved
+* text a non-literal part contributes is carried verbatim in the spelling, as
+* the value already carries it.
+* (f) A child record persisted BEFORE this carry
 * keeps `port:q7` until the child is next redeployed: the parent's own row
 * already held the frame (the literal or frame arm), so a parent deploy whose child
 * row is unchanged never re-runs the child, and `cdkd scrub` cannot repair
@@ -13083,12 +13221,19 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 	}
 	const framesByValue = /* @__PURE__ */ new Map();
 	const tokensOf = /* @__PURE__ */ new Map();
-	const frameSpellingOf = (name, resolvedValue) => {
+	const frameSpellings = /* @__PURE__ */ new Map();
+	const frameSpellingOf = (name) => {
+		if (!frameSpellings.has(name)) frameSpellings.set(name, computeFrameSpelling(name));
+		return frameSpellings.get(name);
+	};
+	const computeFrameSpelling = (name) => {
+		const resolvedValue = resolvedParameters[name];
+		if (typeof resolvedValue !== "string") return void 0;
 		const sourceLeaf = sourceParameters[name];
 		if (typeof sourceLeaf === "string") return sourceLeaf;
 		if (!isPlainObject$2(sourceLeaf)) return void 0;
 		const written = positioned[name];
-		if (typeof written !== "string" || written === resolvedValue) return void 0;
+		if (typeof written !== "string") return void 0;
 		const segments = intrinsicSkeletonSegments(sourceLeaf);
 		if (segments === void 0) return void 0;
 		const rendered = segments.map((s) => s === UNKNOWN_PART ? UNKNOWN_PART_PLACEHOLDER : s).join("");
@@ -13096,16 +13241,20 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 		if (spans.length !== 1) return void 0;
 		const [span] = spans;
 		const ownToken = rendered.slice(span.start, span.end);
-		return SPELLED_SECRET_REFERENCE_PREFIXES.some((prefix) => ownToken.startsWith(prefix)) ? written : void 0;
+		if (written !== resolvedValue && SPELLED_SECRET_REFERENCE_PREFIXES.some((prefix) => ownToken.startsWith(prefix))) return written;
+		const substituted = substitutedSpellingOf(secrets, sourceLeaf, resolvedValue);
+		if (substituted === void 0) return void 0;
+		return written === resolvedValue || written === substituted ? substituted : void 0;
 	};
-	const certifiedSpellingOf = (name, resolvedValue) => {
+	const certifiedSpellingOf = (name) => {
 		const sourceLeaf = sourceParameters[name];
 		if (typeof sourceLeaf === "string") return positioned[name] === sourceLeaf ? sourceLeaf : void 0;
-		return frameSpellingOf(name, resolvedValue);
+		return frameSpellingOf(name);
 	};
+	const unwrittenValues = /* @__PURE__ */ new Set();
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
 		if (typeof resolvedValue !== "string") continue;
-		const spelling = frameSpellingOf(name, resolvedValue);
+		const spelling = frameSpellingOf(name);
 		const frame = spelling === void 0 ? void 0 : singleSpanFrame(resolvedValue, spelling);
 		const frames = framesByValue.get(resolvedValue) ?? /* @__PURE__ */ new Set();
 		const unframed = frame === void 0 || resolvedPlaintextOf(secrets, frame.token) !== frame.middle;
@@ -13115,8 +13264,10 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 			const tokens = tokensOf.get(resolvedValue) ?? /* @__PURE__ */ new Set();
 			tokens.add(frame.token);
 			tokensOf.set(resolvedValue, tokens);
+			if (typeof sourceParameters[name] !== "string" && positioned[name] !== spelling) unwrittenValues.add(resolvedValue);
 		}
 	}
+	for (const value of unwrittenValues) if (tokensOf.get(value)?.size !== 1) framesByValue.get(value)?.add(UNFRAMED_SPELLING);
 	const rowWithoutParameters = {};
 	for (const [key, value] of Object.entries(resolvedProperties)) if (key !== "Parameters") rowWithoutParameters[key] = value;
 	const outsideLeaves = wholeStringLeavesOf(rowWithoutParameters);
@@ -13124,7 +13275,7 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 	const framedByName = [];
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
 		if (typeof resolvedValue !== "string") continue;
-		const spelling = certifiedSpellingOf(name, resolvedValue);
+		const spelling = certifiedSpellingOf(name);
 		if (spelling === void 0) continue;
 		if (redactSecretsForState(resolvedValue, secrets) !== resolvedValue) continue;
 		const frame = singleSpanFrame(resolvedValue, spelling);
@@ -17884,7 +18035,7 @@ function getCreateOnlyPropertyPaths(resourceType) {
 	if (cached) return cached;
 	const entry = fetchCreateOnlyPropertyPaths(resourceType).catch((error) => {
 		createOnlyPropertiesCache.delete(resourceType);
-		const message = error instanceof Error ? error.message : String(error);
+		const message = describeAwsFailure(error).detail;
 		getLogger().child("CreateOnlyProperties").warn(`Failed to resolve create-only properties for ${resourceType} via cloudformation:DescribeType (${message}). Falling back to the registry-only replacement classification for this resource — an immutable-property change may be mis-classified as an in-place update. Grant cloudformation:DescribeType to enable schema-driven replacement detection.`);
 		return [];
 	});
@@ -24743,7 +24894,7 @@ var WAFv2WebACLProvider = class {
 			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$11({ ResourceARN: physicalId }));
 			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagInfoForResource?.TagList);
 		} catch (err) {
-			this.logger.debug(`WAFv2 ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			this.logger.debug(`WAFv2 ListTagsForResource(${physicalId}) failed: ${describeAwsFailure(err).detail}`);
 		}
 		return result;
 	}
@@ -26967,8 +27118,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const obj = value;
 		if ("Ref" in obj) return await this.resolveRef(obj["Ref"], context);
 		if ("Fn::GetAtt" in obj) return await this.resolveGetAtt(obj["Fn::GetAtt"], context);
-		if ("Fn::Join" in obj) return await this.resolveJoin(obj["Fn::Join"], context);
-		if ("Fn::Sub" in obj) return await this.resolveSub(obj["Fn::Sub"], context);
+		if ("Fn::Join" in obj) return await this.resolveJoin(obj["Fn::Join"], context, obj);
+		if ("Fn::Sub" in obj) return await this.resolveSub(obj["Fn::Sub"], context, obj);
 		if ("Fn::Select" in obj) return await this.resolveSelect(obj["Fn::Select"], context);
 		if ("Fn::Split" in obj) return await this.resolveSplit(obj["Fn::Split"], context);
 		if ("Fn::If" in obj) return await this.resolveIf(obj["Fn::If"], context);
@@ -28064,32 +28215,45 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*
 	* Fn::Join: [delimiter, [value1, value2, ...]]
 	*/
-	async resolveJoin(joinArgs, context) {
+	async resolveJoin(joinArgs, context, source) {
 		const [delimiter, rawValues] = joinArgs;
 		let values = rawValues;
 		if (!Array.isArray(values)) values = await this.resolveValue(values, context);
 		if (!Array.isArray(values)) throw new Error(`Fn::Join's second argument must be a list (an array literal or a list-returning intrinsic such as Fn::Cidr / Fn::GetAZs / Fn::Split / a Ref to a list-typed parameter — any List<...> type or CommaDelimitedList), but resolved to ${typeof values}`);
 		const literalList = Array.isArray(rawValues);
-		const parts = (await allSettledKeepingFirstRejection(values.map(async (v) => {
-			if (typeof v === "string") return {
-				...v.includes("{{resolve:") ? await this.resolveDynamicReferencesWithLogTwin(v, this.logTwinOfProduct({
+		const resolvedParts = await allSettledKeepingFirstRejection(values.map(async (v) => {
+			if (typeof v === "string") {
+				const part = v.includes("{{resolve:") ? await this.resolveDynamicReferencesWithLogTwin(v, this.logTwinOfProduct({
 					result: v,
 					twin: v
 				}, context).twin, context) : {
 					result: v,
-					twin: v
-				},
-				product: !literalList
-			};
+					twin: v,
+					substitutions: [],
+					complete: true
+				};
+				return {
+					result: part.result,
+					twin: part.twin,
+					product: !literalList,
+					input: v,
+					substitutions: part.substitutions,
+					complete: part.complete
+				};
+			}
 			const raw = await this.resolveValue(v, context);
 			const resolved = String(raw);
 			return {
 				result: resolved,
 				twin: resolved,
 				product: true,
-				raw: { value: raw }
+				raw: { value: raw },
+				input: resolved,
+				substitutions: [],
+				complete: true
 			};
-		}), (pending) => this.warnAbandonedParts(pending))).map((part) => {
+		}), (pending) => this.warnAbandonedParts(pending));
+		const parts = resolvedParts.map((part) => {
 			if (!part.product) return part;
 			if (part.raw) return {
 				result: part.result,
@@ -28099,7 +28263,20 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		});
 		let result = parts.map((part) => part.result).join(delimiter);
 		let twin = parts.map((part) => part.twin).join(delimiter);
-		if (result.includes("{{resolve:")) ({result, twin} = await this.resolveDynamicReferencesWithLogTwin(result, twin, context));
+		const substitutions = resolvedParts.flatMap((part) => part.substitutions);
+		let complete = resolvedParts.every((part) => part.complete);
+		if (result.includes("{{resolve:")) {
+			const joined = await this.resolveDynamicReferencesWithLogTwin(result, twin, context);
+			({result, twin} = joined);
+			substitutions.push(...joined.substitutions);
+			complete &&= joined.complete;
+		}
+		this.recordLeafResolution(context, source, {
+			input: resolvedParts.map((part) => part.input).join(delimiter),
+			output: result,
+			substitutions,
+			complete
+		});
 		this.rememberLogTwin(context, result, twin);
 		this.logger.debug(`Resolved Fn::Join: ${this.maskSecretsForLog(this.logTwinText(result, twin, context), context)}`);
 		return result;
@@ -28241,10 +28418,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* inside replace(). For full async support, we'd need to collect all replacements
 	* first, then do them synchronously.
 	*/
-	async resolveSub(subArgs, context) {
+	async resolveSub(subArgs, context, source) {
 		let template;
 		const variables = Object.create(null);
 		const variableTwins = Object.create(null);
+		const variablePasses = Object.create(null);
 		if (Array.isArray(subArgs)) {
 			const [templateString, variableMap] = subArgs;
 			template = templateString;
@@ -28252,10 +28430,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			for (const [key, val] of Object.entries(variableMap)) if (typeof val === "string") {
 				const resolved = val.includes("{{resolve:") ? await this.resolveDynamicReferencesWithLogTwin(val, val, context) : {
 					result: val,
-					twin: val
+					twin: val,
+					substitutions: [],
+					complete: true
 				};
 				variables[key] = resolved.result;
 				variableTwins[key] = resolved.twin;
+				variablePasses[key] = resolved;
 			} else variables[key] = context.abandonedResolutions === void 0 ? await this.resolveValue(val, context) : await this.resolveKeyUnit(key, val, context, context.abandonedResolutions);
 		} else template = subArgs;
 		const replacements = [];
@@ -28282,9 +28463,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 			let replacement;
 			let twinReplacement;
+			let pass;
 			if (varNameStr in variables) {
 				replacement = String(variables[varNameStr]);
 				twinReplacement = varNameStr in variableTwins ? variableTwins[varNameStr] : this.productLogTwin(variables[varNameStr], context);
+				if (varNameStr in variablePasses) pass = variablePasses[varNameStr];
 			} else {
 				const pseudoValue = await this.resolvePseudoParameter(varNameStr, context);
 				if (pseudoValue !== void 0) replacement = String(pseudoValue);
@@ -28314,7 +28497,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			replacements.push({
 				match: match[0],
 				replacement,
-				twin: twinReplacement ?? replacement
+				twin: twinReplacement ?? replacement,
+				...pass ? { pass } : {}
 			});
 		}
 		let cursor = 0;
@@ -28327,7 +28511,21 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const entry = replacements[twinCursor++];
 			return entry ? entry.twin : whole;
 		});
-		if (result.includes("{{resolve:")) ({result, twin} = await this.resolveDynamicReferencesWithLogTwin(result, twin, context));
+		const input = result;
+		const substitutions = replacements.flatMap((entry) => entry.pass?.substitutions ?? []);
+		let complete = replacements.every((entry) => entry.pass?.complete ?? true);
+		if (result.includes("{{resolve:")) {
+			const substituted = await this.resolveDynamicReferencesWithLogTwin(result, twin, context);
+			({result, twin} = substituted);
+			substitutions.push(...substituted.substitutions);
+			complete &&= substituted.complete;
+		}
+		this.recordLeafResolution(context, source, {
+			input,
+			output: result,
+			substitutions,
+			complete
+		});
 		this.rememberLogTwin(context, result, twin);
 		this.logger.debug(`Resolved Fn::Sub: ${this.maskSecretsForLog(this.logTwinText(result, twin, context), context)}`);
 		return result;
@@ -29717,7 +29915,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* not the bag holds pairs. Where the middle RE-WRAPS it (an `Fn::Join` around
 	* the `Ref`) the middle registers its own twin, and the hand-off still drops
 	* a bag holding no pairs (it passes `inheritedSecrets` only when `size` is
-	* nonzero). Both are issue #3156.
+	* nonzero). What reaches a grandchild instead is the parent's WHOLE-VALUE
+	* entry: the middle's `{ Ref }` copies it into the middle's bag, which is then
+	* non-empty and handed down. Issue #3156 made the carry record that entry for
+	* the intrinsic frames it used to refuse; a frame it still refuses (listed on
+	* `recordNestedStackParameterExpressions`) keeps both gaps.
 	*
 	* The registry is keyed by VALUE, and `splitLogTwins`' unaligned arm
 	* registers every piece, public ones included. So a child `Fn::Base64` over a
@@ -29767,6 +29969,17 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		};
 	}
 	/**
+	* Record the `Fn::Join` / `Fn::Sub` object `source`'s own resolution under
+	* the pass bag the nested-stack carry reads (issue
+	* [#3156](https://github.com/go-to-k/cdkd/issues/3156)). The key is the
+	* object `resolveValue` dispatched on, and a context with no bag has no pass
+	* to scope it to.
+	*/
+	recordLeafResolution(context, source, resolution) {
+		if (context.recordedSecretValues === void 0) return;
+		recordIntrinsicLeafResolution(context.recordedSecretValues, source, resolution);
+	}
+	/**
 	* Register a MASKED `twin` as the log twin of `result` for this pass (issue
 	* #3100). An unmasked twin is not registered, so a later literal that
 	* resolves to the same string cannot replace an earlier write's mask, and
@@ -29904,6 +30117,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const pattern = /\{\{resolve:([^}]+)\}\}/g;
 		let result = value;
 		let twin = logTwin;
+		const substitutions = [];
+		let complete = true;
 		let match;
 		const matches = [];
 		while ((match = pattern.exec(value)) !== null) matches.push({
@@ -29919,7 +30134,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const nameLogText = inherited?.nameLogText ?? (pairedTwin === void 0 ? () => "***" : this.dynamicReferenceNameLogText(inner, pairedTwin, context));
 			try {
 				const isKnownSecret = service === "secretsmanager" || service === "ssm-secure" || recordedSecretExpressions.has(fullMatch);
-				if (isKnownSecret && context?.skipDynamicReferences) continue;
+				if (isKnownSecret && context?.skipDynamicReferences) {
+					complete = false;
+					continue;
+				}
 				const regionVerdict = classifyReplaySecretRegion(fullMatch, this.explicitRegion ?? this.resolverRegion, context?.producerRegions);
 				if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${this.maskSecretsForLog(tokenLogText, context)}: it names '${this.maskSecretsForLog(nameLogText(regionVerdict.secretName), context)}' without a region, and this stack reads from ${this.maskSecretsForLog(regionVerdict.foreignProducerRegions.map((r) => this.maskSecretsForLog(r, context)).join(", "), context)} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
 				if (regionVerdict.kind === "named-region") {
@@ -29929,6 +30147,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					});
 					result = result.replace(fullMatch, () => foreign.result);
 					twin = twin.replace(fullMatch, () => foreign.twin);
+					const [delegated] = foreign.substitutions;
+					substitutions.push({
+						token: fullMatch,
+						value: foreign.result,
+						secret: foreign.substitutions.length === 1 && delegated.secret
+					});
+					if (!foreign.complete || foreign.substitutions.length !== 1) complete = false;
 					continue;
 				}
 				const cached = this.cachedDynamicReferences.get(fullMatch);
@@ -29939,6 +30164,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					}
 					result = result.replace(fullMatch, () => cached.value);
 					twin = twin.replace(fullMatch, () => cached.secret && cached.value ? "***" : cached.value);
+					substitutions.push({
+						token: fullMatch,
+						value: cached.value,
+						secret: cached.secret
+					});
 					continue;
 				}
 				const parts = inner.split(":");
@@ -29966,7 +30196,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					else cacheable = false;
 					isSecret = param.secure;
 					if (param.secure) {
-						if (!decrypt) continue;
+						if (!decrypt) {
+							complete = false;
+							continue;
+						}
 					}
 					resolved = param.value;
 				} else if (service === "ssm-secure") {
@@ -29976,6 +30209,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					resolved = param.value;
 				} else {
 					this.logger.warn(this.maskSecretsForLog(`Unsupported dynamic reference service: ${this.maskSecretsForLog(nameLogText(String(service)), context)}`, context));
+					complete = false;
 					continue;
 				}
 				if (cacheable) this.cachedDynamicReferences.set(fullMatch, {
@@ -29989,6 +30223,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				}
 				result = result.replace(fullMatch, () => resolved);
 				twin = twin.replace(fullMatch, () => isSecret && resolved ? "***" : resolved);
+				substitutions.push({
+					token: fullMatch,
+					value: resolved,
+					secret: isSecret
+				});
 			} catch (err) {
 				if (context?.abandonedResolutions === void 0) throw err;
 				if (isDeliberateResolutionRefusal(err)) throw err;
@@ -30001,13 +30240,16 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					}
 					return out;
 				}));
+				complete = false;
 				continue;
 			}
 		}
 		if (context) this.rememberLogTwin(context, result, twin);
 		return {
 			result,
-			twin
+			twin,
+			substitutions,
+			complete
 		};
 	}
 	/**
@@ -30262,7 +30504,7 @@ async function disableInstanceApiTermination(client, instanceId, logger) {
 		}));
 		logger.debug(`Disabled DisableApiTermination on EC2 Instance ${instanceId} before deletion`);
 	} catch (flipError) {
-		logger.debug(`Could not disable DisableApiTermination on ${instanceId}: ${flipError instanceof Error ? flipError.message : String(flipError)}`);
+		logger.debug(`Could not disable DisableApiTermination on ${instanceId}: ${describeAwsFailure(flipError).detail}`);
 	}
 }
 /**
@@ -30574,7 +30816,7 @@ function getTopLevelWriteOnlyProperties(resourceType) {
 	if (cached) return cached;
 	const entry = fetchTopLevelWriteOnlyProperties(resourceType).catch((error) => {
 		writeOnlyPropertiesCache.delete(resourceType);
-		const message = error instanceof Error ? error.message : String(error);
+		const message = describeAwsFailure(error).detail;
 		getLogger().child("WriteOnlyProperties").warn(`Failed to resolve write-only properties for ${resourceType} via cloudformation:DescribeType (${message}). Falling back to a minimal update patch — write-only properties (if any) may be dropped by the Cloud Control read-modify-write update. Grant cloudformation:DescribeType to enable write-only property re-inclusion.`);
 		return /* @__PURE__ */ new Set();
 	});
@@ -30700,7 +30942,7 @@ function getTopLevelReadOnlyProperties(resourceType) {
 	if (cached) return cached;
 	const entry = fetchTopLevelReadOnlyProperties(resourceType).catch((error) => {
 		readOnlyPropertiesCache.delete(resourceType);
-		const message = error instanceof Error ? error.message : String(error);
+		const message = describeAwsFailure(error).detail;
 		getLogger().child("ReadOnlyProperties").debug(`Failed to resolve read-only properties for ${displaySafe(resourceType, { asciiOnly: true })} via cloudformation:DescribeType (${message}).`);
 	});
 	readOnlyPropertiesCache.set(resourceType, entry);
@@ -31918,7 +32160,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DTzndMHB.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BOYln2Tw.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -34585,7 +34827,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 			}
 			this.logger.debug(`Successfully deleted custom resource ${logicalId}`);
 		} catch (error) {
-			this.logger.warn(`Failed to delete custom resource ${logicalId}, but continuing: ${error instanceof Error ? error.message : String(error)}. The Delete handler did not complete, so anything this custom resource manages may still be LIVE — cdkd is KEEPING the state record and the run exits non-zero. ${CR_SKIP_NOT_A_RETRY_CAVEAT} ${DEPLOY_SKIP_CAVEAT}`);
+			this.logger.warn(`Failed to delete custom resource ${logicalId}, but continuing: ${describeAwsFailure(error).detail}. The Delete handler did not complete, so anything this custom resource manages may still be LIVE — cdkd is KEEPING the state record and the run exits non-zero. ${CR_SKIP_NOT_A_RETRY_CAVEAT} ${DEPLOY_SKIP_CAVEAT}`);
 			return {
 				outcome: "skipped",
 				reason: CR_DELETE_INVOKE_FAILED_SKIP_REASON
@@ -34622,7 +34864,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 			return false;
 		} catch (error) {
 			if (error.name === "ResourceNotFoundException") return true;
-			this.logger.debug(`GetFunction pre-check for ${serviceToken} failed inconclusively (${error instanceof Error ? error.message : String(error)}); proceeding with the normal delete invoke`);
+			this.logger.debug(`GetFunction pre-check for ${serviceToken} failed inconclusively (${describeAwsFailure(error).detail}); proceeding with the normal delete invoke`);
 			return false;
 		}
 	}
@@ -34699,7 +34941,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				} catch (error) {
 					if (delivered || preDeliveryRetries >= this.preDeliveryAuthzMaxRetries || !this.isTransientAuthzThrow(error)) throw error;
 					const delayMs = Math.min(250 * Math.pow(2, preDeliveryRetries), IAM_PROPAGATION_MAX_DELAY_MS);
-					this.logger.warn(`Custom resource ${operation} for ${logicalId} hit a transient IAM-authorization error before the request was delivered (attempt ${attempt + 1}/${this.preDeliveryAuthzMaxRetries + 1}): ${this.truncateReason(error instanceof Error ? error.message : String(error))}. Retrying in ${delayMs / 1e3}s with a fresh response URL and RequestId.`);
+					this.logger.warn(`Custom resource ${operation} for ${logicalId} hit a transient IAM-authorization error before the request was delivered (attempt ${attempt + 1}/${this.preDeliveryAuthzMaxRetries + 1}): ${this.truncateReason(describeAwsFailure(error).detail)}. Retrying in ${delayMs / 1e3}s with a fresh response URL and RequestId.`);
 					if (invocation !== void 0) await this.cleanupResponseObject(invocation.responseKey);
 					preDeliveryRetries += 1;
 					await this.sleepInterruptibly(delayMs, watch);
@@ -34901,7 +35143,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				maxDelay: 5
 			}, { FunctionName: serviceToken });
 		} catch (error) {
-			this.logger.debug(`Could not recycle backing function for ${logicalId} (${error instanceof Error ? error.message : String(error)}); retrying invoke without a forced cold start`);
+			this.logger.debug(`Could not recycle backing function for ${logicalId} (${describeAwsFailure(error).detail}); retrying invoke without a forced cold start`);
 		}
 	}
 	/**
@@ -35250,7 +35492,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				Key: responseKey
 			}));
 		} catch (error) {
-			this.logger.debug(`Failed to delete custom-resource response object s3://${displaySafe(bucket, { asciiOnly: true }) || "<unrenderable>"}/${displaySafe(responseKey)}; it remains as a current object. Underlying error: ${displaySafe(error instanceof Error ? error.message : String(error)) || "<unrenderable>"}`);
+			this.logger.debug(`Failed to delete custom-resource response object s3://${displaySafe(bucket, { asciiOnly: true }) || "<unrenderable>"}/${displaySafe(responseKey)}; it remains as a current object. Underlying error: ${displaySafe(describeAwsFailure(error).detail) || "<unrenderable>"}`);
 		}
 		await purgeNoncurrentKeyVersions(this.s3Client, bucket, [responseKey], {
 			logger: this.logger,
@@ -36029,7 +36271,7 @@ var IAMRoleProvider = class {
 					await this.iamClient.send(new DeleteRoleCommand({ RoleName: roleName }));
 					this.logger.debug(`Cleaned up partially-created IAM role ${logicalId} (${roleName}) after wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created IAM role ${logicalId} (${roleName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: detach managed policies (aws iam list-attached-role-policies --role-name ${roleName} then aws iam detach-role-policy --role-name ${roleName} --policy-arn <arn>), delete inline policies (aws iam list-role-policies --role-name ${roleName} then aws iam delete-role-policy --role-name ${roleName} --policy-name <name>), then aws iam delete-role --role-name ${roleName}`);
+					this.logger.warn(`Failed to clean up partially-created IAM role ${logicalId} (${roleName}): ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required before the next deploy: detach managed policies (aws iam list-attached-role-policies --role-name ${roleName} then aws iam detach-role-policy --role-name ${roleName} --policy-arn <arn>), delete inline policies (aws iam list-role-policies --role-name ${roleName} then aws iam delete-role-policy --role-name ${roleName} --policy-name <name>), then aws iam delete-role --role-name ${roleName}`);
 				}
 				throw innerError;
 			}
@@ -36066,8 +36308,8 @@ var IAMRoleProvider = class {
 					this.logger.warn(`Skipped deleting old role ${physicalId} during replacement: ${deleteResult.reason}. The old role may be orphaned and require manual cleanup.`);
 				}
 			} catch (error) {
-				orphanReason = `old role ${physicalId} could not be deleted: ${String(error)}`;
-				this.logger.warn(`Failed to delete old role ${physicalId} during replacement: ${String(error)}. The old role may be orphaned and require manual cleanup.`);
+				orphanReason = `old role ${physicalId} could not be deleted: ${safeStringify(error)}`;
+				this.logger.warn(`Failed to delete old role ${physicalId} during replacement: ${safeStringify(error)}. The old role may be orphaned and require manual cleanup.`);
 			}
 			const base = {
 				physicalId: createResult.physicalId,
@@ -38336,7 +38578,7 @@ function makeCanonicalizePropertiesFn(registry) {
 			if (!registry.hasProvider(resourceType)) return properties;
 			return registry.getProvider(resourceType).canonicalizeDesiredProperties?.(resourceType, properties) ?? properties;
 		} catch (error) {
-			logger.debug(`canonicalizeDesiredProperties failed for ${resourceType}: ${error instanceof Error ? error.message : String(error)}`);
+			logger.debug(`canonicalizeDesiredProperties failed for ${resourceType}: ${describeAwsFailure(error).detail}`);
 			return properties;
 		}
 	};
@@ -44912,5 +45154,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { secretBearing as $, normalizeAwsError as $i, scrubResourceRecord as $n, synthesisStatusMessage as $r, s3BucketArn as $t, extractDeploymentEventError as A, AssetError as Ai, repairMalformedResourcesForReadOnly as An, isCrossRegionRedirect as Ar, isImpossibleEmptyStoredAttribute as At, toCfnInteger as B, LockError as Bi, TEMPLATE_SOURCED_RULES as Bn, describeDockerFailure as Br, coerceCfnBoolean as Bt, buildFinalSnapshotIdentifier as C, processStackMessages as Ci, refuseMalformedOutputs as Cn, loadPublishableAssetManifest as Cr, isTerminationProtectionPropagationError as Ct, refusesFinalSnapshot as D, getAwsClients as Di, refuseMalformedState as Dn, assertAssetBucketRegion as Dr, cfnRefValueFromPhysicalId as Dt, isFinalSnapshotError as E, AwsClients as Ei, refuseMalformedResourcesForDestroy as En, BOOTSTRAP_MARKER_PREFIX as Er, carriesFetchableDynamicReference as Et, isStatefulRecreateTargetSync as F, DeployCancelledError as Fi, DagBuilder as Fn, buildDenyExternalAccessPolicy as Fr, isSettledInstanceState as Ft, gray as G, ResourceTimeoutError as Gi, identityKeyFor as Gn, redactDockerArgvValues as Gr, readConfigString as Gt, formatResourceLine as H, NestedStackChildDirectDestroyError as Hi, createSecretMasker as Hn, formatDockerLoginError as Hr, configBooleanRefusal as Ht, renderStatefulReason as I, DynamicReferenceRegionAmbiguousError as Ii, TemplateParser as In, describeAwsFailure as Ir, WAFv2WebACLProvider as It, yellow as J, StackTerminationProtectionError as Ji, maskSecretsInError as Jn, escapeRegExp$1 as Jr, requireConfigObject as Jt, green as K, ResourceUpdateNotSupportedError as Ki, isSingleDynamicReferenceToken as Kn, runDockerForeground as Kr, replayWarn as Kt, WARM_THROUGHPUT_MEMBERS as L, IntrinsicResolutionRefusalError as Li, STATE_SOURCED_BASELINE_RULES as Ln, buildDockerImage as Lr, normalizeAwsTagsToCfn as Lt, planOrphanAdoption as M, ConfigError as Mi, findSilentDropProperties as Mn, readBootstrapMarkerBody as Mr, isUnboundTemplateParameter as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, CrossAccountSecretRefusalError as Ni, describeTypeWithThrottleRetry as Nn, validateAssetBucketName as Nr, parameterTypeMayLoseSecretIdentity as Nt, unsupportedFinalSnapshotError as O, resetAwsClients as Oi, repairMalformedOutputsForReadOnly as On, ensureAssetStorage as Or, coerceParameterTypedValue as Ot, isStatefulRecreateTargetForReplace as P, DependencyError as Pi, withRetry as Pn, validateContainerRepoName as Pr, refStateLookupFromResource as Pt, isExportAliasCollision as Q, isCdkdError as Qi, redactSecretsForState as Qn, Synthesizer as Qr, withSharedDrainBudget as Qt, coerceWarmThroughput as R, LocalInvokeBuildError as Ri, STATE_SOURCED_CROSS_GENERATION_RULES as Rn, describeDockerCapturedOutput as Rr, resolveExplicitPhysicalId as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, AssemblyReader as Si, refuseMalformedNestedChildOutputs as Sn, createAssetRedirectResolver as Sr, disableInstanceApiTermination as St, createPreDeleteFinalSnapshot as T, resolveBucketRegion as Ti, refuseMalformedResourcePropertiesForOrphan as Tn, AssetModeResolver as Tr, carriesDynamicReference as Tt, bold as U, PartialFailureError as Ui, dynamicReferenceTokens as Un, getDockerCmd as Ur, configIntegerRefusal as Ut, toFiniteNumber as V, MalformedProducerRecordRefusalError as Vi, carriesSecretMask as Vn, dockerSpawnEnvWithSensitive as Vr, coerceCfnInteger as Vt, cyan as W, ProvisioningError as Wi, errorCauseChain as Wn, partitionSensitiveEnv as Wr, configStringRefusal as Wt, collectPublishedOutputNames as X, SynthesisError as Xi, recordMaskOnlyValue as Xn, AssetManifestLoader as Xr, classifyReplaySecretRegion as Xt, collectDeclaredOutputNames as Y, StateError as Yi, maskSecretsInText as Yn, stripControlChars as Yr, requireConfigString as Yt, exportAliasCollisionScrubWarning as Z, formatError as Zi, recoverMaskedOutput as Zn, getDockerImageBySourceHash as Zr, producerRegionsFromState as Zt, isSecretBearingReferenceString as _, decodeListingKey as _i, malformedRenderedContainersWarning as _n, shouldRetainResource as _r, isWaitAbandonedError as _t, DeploymentEventsStore as a, markNonRetryable as aa, resolveSkipPrefix as ai, applyCallerIdentityCredentials as an, forceQuitRecoveryClause as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, canonicalizeRegion as bi, malformedStateRefusalMessage as bn, WorkGraph as br, deleteIndeterminateGuards as bt, replayFailedOperations as c, __exportAll as ca, resolveUseCdkBootstrapAssets as ci, INTRINSIC_KEYS as cn, CUSTOM_RESOURCE_RESPONSE_PREFIX as cr, createMaskedRetryLogger as ct, updatePartialReason as d, CFN_TEMPLATE_BODY_LIMIT as di, hasReadableResources as dn, hasReadableExportSet as dr, beginCommandInterruptScope as dt, withErrorHandling as ea, getDefaultStateBucketName as ei, s3BucketDomainName as en, LockManager as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, CFN_TEMPLATE_URL_LIMIT as fi, malformedExportNamesWarning as fn, importableOutputKeys as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as gi, malformedOutputsWarning as gn, orphansCarriedFrom as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, uploadCfnTemplate as hi, malformedOutputsRefusalMessage as hn, orphansAfterRollback as hr, startInterruptWatch as ht, DeploymentEventsReader as i, isTransientServerError as ia, resolveCaptureObservedState as ii, applyRoleArnIfSet as in, buildLockContentionMessage as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, CdkdError as ji, findActionableSilentDrops as jn, parseBootstrapMarker as jr, isNamelessDynamicReferenceError as jt, makeCanonicalizePropertiesFn as k, setAwsClients as ki, repairMalformedResourcePropertiesForReadOnly as kn, getBootstrapMarkerKey as kr, getAccountInfo as kt, replayRollback as l, stateBucketExistenceConfirmed as li, STATE_RESOURCES_MALFORMED as ln, DEFAULT_STATE_PREFIX as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, findLargeInlineResources as mi, malformedLocalOutputsWarning as mn, isReadableBag as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isRetryableTransientError as na, resolveApp as ni, s3BucketRegionalDomainName as nn, rebuildClientForBucketRegion as nr, getCurrentResourceSecrets as nt, planFailedOps as o, markRedactedCause as oa, resolveStateBucketWithDefault as oi, callerEnvCredentials as on, formatLockExpiry as or, ProviderRegistry as ot, maskingRetryLogger as p, MIGRATE_TMP_PREFIX as pi, malformedExportSourceWarning as pn, importableOutputs as pr, interruptWatchListenerCount as pt, red as q, StackHasActiveImportsError as qi, markSameGenerationBag as qn, runDockerStreaming as qr, requireConfigArray as qt, DeployEngine as r, isThrottlingError as ra, resolveAutoAssetStorage as ri, s3BucketWebsiteUrl as rn, buildForceUnlockCommand as rr, IAMRoleProvider as rt, planRollback as s, retryClassificationText as sa, resolveStateBucketWithDefaultAndSource as si, DiffCalculator as sn, shellQuote as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, isMarkedNonRetryable as ta, getLegacyStateBucketName as ti, s3BucketDualStackDomainName as tn, S3StateBackend as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, warnDeprecatedNoPrefixCliFlag as ui, hasReadableOutputs as un, exportNamesCarriedFrom as ur, maskerOrIdentity as ut, keptWholeReasonText as v, expectedOwnerParam as vi, malformedResourcePropertiesWarning as vn, AssetPublisher as vr, slowCcOperationTimeoutMs as vt, ccRoutedFinalSnapshotError as w, clearBucketRegionCache as wi, refuseMalformedOutputsForDestroy as wn, rewriteTemplateAssetReferences as wr, IntrinsicFunctionResolver as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, derivePartitionAndUrlSuffix as xi, producerRecordKey as xn, buildAssetRedirectMap as xr, deleteSkipReason as xt, mergeNoChangeOutputs as y, PARTITION_TABLE as yi, malformedResourcesWarning as yn, stringifyValue as yr, UNSPECIFIED_SKIP_REASON as yt, isWarmThroughputDecrease as z, LocalStartServiceError as zi, STATE_SOURCED_READBACK_RULES as zn, describeDockerExecFailure as zr, assertRegionMatch as zt };
-//# sourceMappingURL=deploy-engine-Dbmoo4FQ.js.map
+export { secretBearing as $, isCdkdError as $i, scrubResourceRecord as $n, Synthesizer as $r, s3BucketArn as $t, extractDeploymentEventError as A, setAwsClients as Ai, repairMalformedResourcesForReadOnly as An, isCrossRegionRedirect as Ar, isImpossibleEmptyStoredAttribute as At, toCfnInteger as B, LocalStartServiceError as Bi, TEMPLATE_SOURCED_RULES as Bn, describeDockerExecFailure as Br, coerceCfnBoolean as Bt, buildFinalSnapshotIdentifier as C, AssemblyReader as Ci, refuseMalformedOutputs as Cn, loadPublishableAssetManifest as Cr, isTerminationProtectionPropagationError as Ct, refusesFinalSnapshot as D, AwsClients as Di, refuseMalformedState as Dn, assertAssetBucketRegion as Dr, cfnRefValueFromPhysicalId as Dt, isFinalSnapshotError as E, resolveBucketRegion as Ei, refuseMalformedResourcesForDestroy as En, BOOTSTRAP_MARKER_PREFIX as Er, carriesFetchableDynamicReference as Et, isStatefulRecreateTargetSync as F, DependencyError as Fi, DagBuilder as Fn, buildDenyExternalAccessPolicy as Fr, isSettledInstanceState as Ft, gray as G, ProvisioningError as Gi, identityKeyFor as Gn, partitionSensitiveEnv as Gr, readConfigString as Gt, formatResourceLine as H, MalformedProducerRecordRefusalError as Hi, createSecretMasker as Hn, dockerSpawnEnvWithSensitive as Hr, configBooleanRefusal as Ht, renderStatefulReason as I, DeployCancelledError as Ii, TemplateParser as In, describeAwsFailure as Ir, WAFv2WebACLProvider as It, yellow as J, StackHasActiveImportsError as Ji, maskSecretsInError as Jn, runDockerStreaming as Jr, requireConfigObject as Jt, green as K, ResourceTimeoutError as Ki, isSingleDynamicReferenceToken as Kn, redactDockerArgvValues as Kr, replayWarn as Kt, WARM_THROUGHPUT_MEMBERS as L, DynamicReferenceRegionAmbiguousError as Li, STATE_SOURCED_BASELINE_RULES as Ln, safeStringify as Lr, normalizeAwsTagsToCfn as Lt, planOrphanAdoption as M, CdkdError as Mi, findSilentDropProperties as Mn, readBootstrapMarkerBody as Mr, isUnboundTemplateParameter as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, ConfigError as Ni, describeTypeWithThrottleRetry as Nn, validateAssetBucketName as Nr, parameterTypeMayLoseSecretIdentity as Nt, unsupportedFinalSnapshotError as O, getAwsClients as Oi, repairMalformedOutputsForReadOnly as On, ensureAssetStorage as Or, coerceParameterTypedValue as Ot, isStatefulRecreateTargetForReplace as P, CrossAccountSecretRefusalError as Pi, withRetry as Pn, validateContainerRepoName as Pr, refStateLookupFromResource as Pt, isExportAliasCollision as Q, formatError as Qi, redactSecretsForState as Qn, getDockerImageBySourceHash as Qr, withSharedDrainBudget as Qt, coerceWarmThroughput as R, IntrinsicResolutionRefusalError as Ri, STATE_SOURCED_CROSS_GENERATION_RULES as Rn, buildDockerImage as Rr, resolveExplicitPhysicalId as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, derivePartitionAndUrlSuffix as Si, refuseMalformedNestedChildOutputs as Sn, createAssetRedirectResolver as Sr, disableInstanceApiTermination as St, createPreDeleteFinalSnapshot as T, clearBucketRegionCache as Ti, refuseMalformedResourcePropertiesForOrphan as Tn, AssetModeResolver as Tr, carriesDynamicReference as Tt, bold as U, NestedStackChildDirectDestroyError as Ui, dynamicReferenceTokens as Un, formatDockerLoginError as Ur, configIntegerRefusal as Ut, toFiniteNumber as V, LockError as Vi, carriesSecretMask as Vn, describeDockerFailure as Vr, coerceCfnInteger as Vt, cyan as W, PartialFailureError as Wi, errorCauseChain as Wn, getDockerCmd as Wr, configStringRefusal as Wt, collectPublishedOutputNames as X, StateError as Xi, recordMaskOnlyValue as Xn, stripControlChars as Xr, classifyReplaySecretRegion as Xt, collectDeclaredOutputNames as Y, StackTerminationProtectionError as Yi, maskSecretsInText as Yn, escapeRegExp$1 as Yr, requireConfigString as Yt, exportAliasCollisionScrubWarning as Z, SynthesisError as Zi, recoverMaskedOutput as Zn, AssetManifestLoader as Zr, producerRegionsFromState as Zt, isSecretBearingReferenceString as _, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as _i, malformedRenderedContainersWarning as _n, shouldRetainResource as _r, isWaitAbandonedError as _t, DeploymentEventsStore as a, isTransientServerError as aa, resolveCaptureObservedState as ai, applyCallerIdentityCredentials as an, forceQuitRecoveryClause as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, PARTITION_TABLE as bi, malformedStateRefusalMessage as bn, WorkGraph as br, deleteIndeterminateGuards as bt, replayFailedOperations as c, retryClassificationText as ca, resolveStateBucketWithDefaultAndSource as ci, INTRINSIC_KEYS as cn, CUSTOM_RESOURCE_RESPONSE_PREFIX as cr, createMaskedRetryLogger as ct, updatePartialReason as d, warnDeprecatedNoPrefixCliFlag as di, hasReadableResources as dn, hasReadableExportSet as dr, beginCommandInterruptScope as dt, normalizeAwsError as ea, synthesisStatusMessage as ei, s3BucketDomainName as en, LockManager as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, CFN_TEMPLATE_BODY_LIMIT as fi, malformedExportNamesWarning as fn, importableOutputKeys as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, uploadCfnTemplate as gi, malformedOutputsWarning as gn, orphansCarriedFrom as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, findLargeInlineResources as hi, malformedOutputsRefusalMessage as hn, orphansAfterRollback as hr, startInterruptWatch as ht, DeploymentEventsReader as i, isThrottlingError as ia, resolveAutoAssetStorage as ii, applyRoleArnIfSet as in, buildLockContentionMessage as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, AssetError as ji, findActionableSilentDrops as jn, parseBootstrapMarker as jr, isNamelessDynamicReferenceError as jt, makeCanonicalizePropertiesFn as k, resetAwsClients as ki, repairMalformedResourcePropertiesForReadOnly as kn, getBootstrapMarkerKey as kr, getAccountInfo as kt, replayRollback as l, __exportAll as la, resolveUseCdkBootstrapAssets as li, STATE_RESOURCES_MALFORMED as ln, DEFAULT_STATE_PREFIX as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, MIGRATE_TMP_PREFIX as mi, malformedLocalOutputsWarning as mn, isReadableBag as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isMarkedNonRetryable as na, getLegacyStateBucketName as ni, s3BucketRegionalDomainName as nn, rebuildClientForBucketRegion as nr, getCurrentResourceSecrets as nt, planFailedOps as o, markNonRetryable as oa, resolveSkipPrefix as oi, callerEnvCredentials as on, formatLockExpiry as or, ProviderRegistry as ot, maskingRetryLogger as p, CFN_TEMPLATE_URL_LIMIT as pi, malformedExportSourceWarning as pn, importableOutputs as pr, interruptWatchListenerCount as pt, red as q, ResourceUpdateNotSupportedError as qi, markSameGenerationBag as qn, runDockerForeground as qr, requireConfigArray as qt, DeployEngine as r, isRetryableTransientError as ra, resolveApp as ri, s3BucketWebsiteUrl as rn, buildForceUnlockCommand as rr, IAMRoleProvider as rt, planRollback as s, markRedactedCause as sa, resolveStateBucketWithDefault as si, DiffCalculator as sn, shellQuote as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, withErrorHandling as ta, getDefaultStateBucketName as ti, s3BucketDualStackDomainName as tn, S3StateBackend as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, stateBucketExistenceConfirmed as ui, hasReadableOutputs as un, exportNamesCarriedFrom as ur, maskerOrIdentity as ut, keptWholeReasonText as v, decodeListingKey as vi, malformedResourcePropertiesWarning as vn, AssetPublisher as vr, slowCcOperationTimeoutMs as vt, ccRoutedFinalSnapshotError as w, processStackMessages as wi, refuseMalformedOutputsForDestroy as wn, rewriteTemplateAssetReferences as wr, IntrinsicFunctionResolver as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, canonicalizeRegion as xi, producerRecordKey as xn, buildAssetRedirectMap as xr, deleteSkipReason as xt, mergeNoChangeOutputs as y, expectedOwnerParam as yi, malformedResourcesWarning as yn, stringifyValue as yr, UNSPECIFIED_SKIP_REASON as yt, isWarmThroughputDecrease as z, LocalInvokeBuildError as zi, STATE_SOURCED_READBACK_RULES as zn, describeDockerCapturedOutput as zr, assertRegionMatch as zt };
+//# sourceMappingURL=deploy-engine-CBzq85r6.js.map