@go-to-k/cdkd 0.290.30 → 0.290.31

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-C15BftsD.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-IwTfNQ-K.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-qSSjqstP.js");
+	const { buildProgram } = await import("./program-CnSaRdY9.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-mI1Xv1oi.js → deploy-engine-21iNqwR3.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, E as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-BjWM-UVj.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-C15BftsD.js";
+import { t as getCdkdVersion } from "./version-IwTfNQ-K.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -17109,7 +17109,8 @@ var DagBuilder = class {
 		resourceIds.forEach((logicalId) => {
 			const resource = this.parser.getResource(template, logicalId);
 			graph.setNode(logicalId, resource);
-			this.logger.debug(`Added node: ${logicalId} (${resource?.Type})`);
+			const typeText = resource?.Type == null ? "<no Type>" : displayIdent(resource.Type);
+			this.logger.debug(`Added node: ${displayIdent(logicalId)} (${typeText})`);
 		});
 		this.logger.debug(`Total nodes: ${resourceIds.length}`);
 		const parameterNames = new Set(Object.keys(template.Parameters ?? {}));
@@ -17123,15 +17124,15 @@ var DagBuilder = class {
 			for (const depId of dependencies) {
 				if (skip?.has(depId)) {
 					relaxedEdgeCount++;
-					this.logger.debug(`Skipped CDK-defensive DependsOn edge: ${depId} -> ${logicalId} (default; opt out with --no-aggressive-vpc-parallel)`);
+					this.logger.debug(`Skipped CDK-defensive DependsOn edge: ${displayIdent(depId)} -> ${displayIdent(logicalId)} (default; opt out with --no-aggressive-vpc-parallel)`);
 					continue;
 				}
 				if (graph.hasNode(depId)) {
 					graph.setEdge(depId, logicalId);
 					edgeCount++;
-					this.logger.debug(`Added edge: ${depId} -> ${logicalId}`);
-				} else if (parameterNames.has(depId)) this.logger.debug(`Skipped Parameter reference: ${logicalId} -> ${depId}`);
-				else this.logger.warn(`Resource ${logicalId} depends on ${depId}, but ${depId} not found in template`);
+					this.logger.debug(`Added edge: ${displayIdent(depId)} -> ${displayIdent(logicalId)}`);
+				} else if (parameterNames.has(depId)) this.logger.debug(`Skipped Parameter reference: ${displayIdent(logicalId)} -> ${displayIdent(depId)}`);
+				else this.logger.warn(`Resource ${displayIdent(logicalId)} depends on ${displayIdent(depId)}, but ${displayIdent(depId)} not found in template`);
 			}
 		}
 		if (relaxedEdgeCount > 0) this.logger.info(`[DagBuilder] Relaxed ${relaxedEdgeCount} CDK-defensive DependsOn edge(s) (default; opt out with --no-aggressive-vpc-parallel)`);
@@ -17140,7 +17141,7 @@ var DagBuilder = class {
 		edgeCount += this.addLambdaVpcEdges(graph, template);
 		if (!alg.isAcyclic(graph)) {
 			const cycles = this.findCycles(graph);
-			throw new DependencyError(`Circular dependency detected in template. Cycles: ${cycles.map((c) => c.join(" -> ")).join("; ")}`);
+			throw new DependencyError(`Circular dependency detected in template. Cycles: ${cycles.map((c) => c.map((n) => displayIdent(n)).join(" -> ")).join("; ")}`);
 		}
 		return graph;
 	}
@@ -17172,9 +17173,9 @@ var DagBuilder = class {
 			});
 			if (readyNodes.length === 0) {
 				const remaining = graphCopy.nodes();
-				throw new DependencyError(`Circular dependency detected. Remaining nodes: ${remaining.join(", ")}`);
+				throw new DependencyError(`Circular dependency detected. Remaining nodes: ${remaining.map((n) => displayIdent(n)).join(", ")}`);
 			}
-			this.logger.debug(`Level ${levelNum}: ${readyNodes.length} resources - ${readyNodes.join(", ")}`);
+			this.logger.debug(`Level ${levelNum}: ${readyNodes.length} resources - ${readyNodes.map((n) => displayIdent(n)).join(", ")}`);
 			levels.push(readyNodes);
 			readyNodes.forEach((node) => {
 				graphCopy.removeNode(node);
@@ -17291,7 +17292,7 @@ var DagBuilder = class {
 				if (graph.hasEdge(policyId, logicalId)) continue;
 				graph.setEdge(policyId, logicalId);
 				added++;
-				this.logger.debug(`Added implicit edge (custom resource policy): ${policyId} -> ${logicalId}`);
+				this.logger.debug(`Added implicit edge (custom resource policy): ${displayIdent(policyId)} -> ${displayIdent(logicalId)}`);
 			}
 		}
 		if (added > 0) this.logger.debug(`Added ${added} implicit edges for custom resource policies`);
@@ -17322,7 +17323,7 @@ var DagBuilder = class {
 			if (graph.hasEdge(depId, dependentId)) continue;
 			graph.setEdge(depId, dependentId);
 			added++;
-			this.logger.debug(`Added implicit edge (lambda vpc): ${depId} -> ${dependentId}`);
+			this.logger.debug(`Added implicit edge (lambda vpc): ${displayIdent(depId)} -> ${displayIdent(dependentId)}`);
 		}
 		if (added > 0) this.logger.debug(`Added ${added} implicit edges for Lambda VpcConfig`);
 		return added;
@@ -27188,14 +27189,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (!targetRegion) return ambient;
 		const target = canonicalizeRegion(targetRegion);
 		const loggedTarget = targetLogText ?? (targetRegion === this.explicitRegion ? this.explicitRegionLogText : void 0) ?? target;
-		if (!isClientSafeRegion(target)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to build AWS clients for the region '${stripControlChars(loggedTarget).slice(0, 64)}': it is not a valid AWS region name, and a region is substituted into the AWS service hostname.`));
+		if (!isClientSafeRegion(target)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to build AWS clients for the region '${displaySafe(stripControlChars(loggedTarget)).slice(0, 64)}': it is not a valid AWS region name, and a region is substituted into the AWS service hostname.`));
 		if (typeof ambient.withRegion !== "function") return ambient;
 		const cached = this.regionScopedClients.get(target);
 		if (cached) return cached;
 		if (canonicalizeRegion(ambient.configuredRegion) === target) return ambient;
 		const scoped = ambient.withRegion(target);
 		this.regionScopedClients.set(target, scoped);
-		this.logger.debug(`Using region-scoped AWS clients for ${loggedTarget}`);
+		this.logger.debug(`Using region-scoped AWS clients for ${displaySafe(loggedTarget)}`);
 		return scoped;
 	}
 	/**
@@ -27261,7 +27262,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*/
 	async resolveParameters(template, userParameters, options) {
 		const inheritedSecrets = options?.inheritedSecrets;
-		const maskInherited = (text) => inheritedSecrets && inheritedSecrets.size > 0 ? maskSecretsInText(text, inheritedSecrets) : text;
+		const maskInherited = (text) => {
+			const mask = (value) => inheritedSecrets && inheritedSecrets.size > 0 ? maskSecretsInText(value, inheritedSecrets) : value;
+			return displaySafe(mask(stripControlChars(mask(text))));
+		};
 		const inheritedLogContext = {
 			template,
 			resources: {},
@@ -27366,7 +27370,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		for (const name of Object.keys(templateConditions)) try {
 			await withSharedDrainBudget(() => evaluateByName(name));
 		} catch (error) {
-			this.logger.warn(this.maskSecretsForLog(`Failed to evaluate condition ${name}: ${error instanceof Error ? error.message : String(error)}, assuming false`, maskingContext));
+			this.logger.warn(this.displayMasked(`Failed to evaluate condition ${name}: ${error instanceof Error ? error.message : String(error)}, assuming false`, maskingContext));
 			conditions[name] = false;
 			inProgress.delete(name);
 		}
@@ -27664,10 +27668,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			this.logger.debug(`Resolved Ref to pseudo parameter: ${logicalId} -> ${valueStr}`);
 			return pseudoValue;
 		}
-		const notFoundMsg = `Ref ${logicalId} not found (not a resource, parameter, or pseudo parameter)`;
+		const loggedLogicalId = this.displayMasked(logicalId, context);
+		const notFoundMsg = `Ref ${loggedLogicalId} not found (not a resource, parameter, or pseudo parameter)`;
 		if (context.bestEffort) this.logger.debug(notFoundMsg);
 		else this.logger.warn(notFoundMsg);
-		throw markNonRetryable(/* @__PURE__ */ new Error(`Ref ${logicalId} not found`));
+		throw markNonRetryable(/* @__PURE__ */ new Error(`Ref ${loggedLogicalId} not found`));
 	}
 	/**
 	* Resolve the value a CloudFormation `Ref` returns for a resource.
@@ -27849,7 +27854,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 		}
 		if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)) {
-			const declared = Object.keys(resource.attributes ?? {}).filter((k) => k.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)).sort().map((k) => this.maskSecretsForLog(this.outputNameLogText(k, context), context));
+			const declared = Object.keys(resource.attributes ?? {}).filter((k) => k.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)).sort().map((k) => this.displayMasked(this.outputNameLogText(k, context), context));
 			const declaredText = declared.length > 0 ? declared.join(", ") : "(none)";
 			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.displayMasked(attributeName, context)}]: the nested stack '${logicalId}' declares no output named '${this.displayMasked(this.outputNameLogText(attributeName, context), context)}'. Its outputs are ${this.displayMasked(declaredText, context)}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
 		}
@@ -27905,7 +27910,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const declared = context.noEchoAttributeResources?.get(logicalId);
 		if ((declared === true || declared !== void 0 && declared.has(attributeName)) && context.recordedSecretValues) recordMaskOnlyValuesIn(value, context.recordedSecretValues);
 		if (context.redactedAttributeReads !== void 0 && carriesSecretMask(value)) {
-			const maskedAttributeName = this.maskSecretsForLog(attributeName, context);
+			const maskedAttributeName = this.displayMasked(attributeName, context);
 			this.pushRedactedAttributeRead(context, {
 				kind: "attribute",
 				logicalId,
@@ -28806,13 +28811,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					} catch (getAttError) {
 						if (getAttError instanceof IntrinsicResolutionRefusalError) throw getAttError;
 						this.rethrowStructuralSubFailure(varNameStr, getAttError, context);
-						this.logger.warn(this.maskSecretsForLog(this.subPlaceholderWarning(varNameStr, getAttError), context));
+						this.logger.warn(this.displayMasked(this.subPlaceholderWarning(varNameStr, getAttError), context));
 						replacement = match[0];
 					}
 					else {
 						if (refError instanceof IntrinsicResolutionRefusalError) throw refError;
 						this.rethrowStructuralSubFailure(varNameStr, refError, context);
-						this.logger.warn(this.maskSecretsForLog(this.subPlaceholderWarning(varNameStr, refError), context));
+						this.logger.warn(this.displayMasked(this.subPlaceholderWarning(varNameStr, refError), context));
 						replacement = match[0];
 					}
 				}
@@ -29193,7 +29198,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				return recovered;
 			}
 			if (context.redactedAttributeReads !== void 0) {
-				const loggedOrigin = this.maskSecretsForLog(origin, context);
+				const loggedOrigin = this.displayMasked(origin, context);
 				this.pushRedactedAttributeRead(context, {
 					kind: "cross-stack",
 					display: loggedOrigin
@@ -29287,7 +29292,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const target = canonicalizeRegion(producerRegion);
 		if (target === canonicalizeRegion(this.explicitRegion)) return this;
 		const regionText = producerRegionLogText !== void 0 ? canonicalizeRegion(producerRegionLogText) : this.regionLogText(producerRegion, context);
-		const guestRegionText = this.maskThenStripThenMask(regionText, context);
+		const guestRegionText = this.displayMasked(regionText, context);
 		const cached = this.producerRegionResolvers.get(target);
 		if (cached) {
 			if (cached.explicitRegionLogText !== guestRegionText) cached.explicitRegionLogText = "***";
@@ -29313,7 +29318,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const exportName = await this.resolveValue(importValueArg, context);
 		if (typeof exportName !== "string") throw new Error(`Fn::ImportValue: export name must resolve to a string, got ${typeof exportName}`);
 		if (!context.stateBackend) throw new Error("Fn::ImportValue: state backend is required for cross-stack references");
-		const loggedExportName = this.maskSecretsForLog(exportName, context);
+		const loggedExportName = this.displayMasked(exportName, context);
 		this.logger.debug(`Resolving Fn::ImportValue: ${loggedExportName}`);
 		if (context.exportIndex) {
 			let entry;
@@ -29442,7 +29447,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* `OutputName` is the overwhelmingly common cause, and the list is what makes
 	* the error actionable.
 	*
-	* `maskSecretsForLog` reads the consumer pass's log twin first (issue #3150),
+	* `maskSecretsRaw` reads the consumer pass's log twin first (issue #3150),
 	* so a key equal to a name this pass assembled around a short secret is
 	* masked. Residual, stated rather than hidden: the needles and twins belong to the
 	* CONSUMER's resolution, so a plaintext sitting in a PRODUCER key that this
@@ -29493,7 +29498,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
 			const cfnNameMask = this.positionalNameMask([[stackName, this.displayMasked(stackName, context)], [region, this.displayMasked(loggedRegionText, context)]]);
-			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${this.displayMasked(stackName, context)}' (${this.displayMasked(loggedRegionText, context)}): ${displayAwsMessage(this.maskSecretsForLog(cfnNameMask ? cfnNameMask(message) : message, context))}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
+			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${this.displayMasked(stackName, context)}' (${this.displayMasked(loggedRegionText, context)}): ${displayAwsMessage(this.displayMasked(cfnNameMask ? cfnNameMask(message) : message, context))}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
 			return;
 		}
 	}
@@ -29616,7 +29621,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw new Error(`Fn::GetStackOutput: cannot reference own stack '${this.displayMasked(stackName, context)}' in the same region '${this.displayMasked(loggedRegionText, context)}'`);
 		const loggedStackName = this.displayMasked(stackName, context);
 		const loggedOutputName = this.displayMasked(outputName, context);
-		const loggedRegion = this.maskSecretsForLog(loggedRegionText, context);
+		const loggedRegion = this.displayMasked(loggedRegionText, context);
 		const shownRoleArn = roleArn ? displayIdent(roleArn, { maxCodePoints: 613 }) : "";
 		this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${shownRoleArn}` : ""}`);
 		let stateData;
@@ -29706,7 +29711,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* own comment says why. What this clause is not is redundant against
 	* `raw !== masked`: `rememberLogTwin` has no empty-key guard and
 	* `splitLogTwins` registers every piece it produces, so `registeredLogTwin`
-	* can answer `***` for the empty string and make `maskSecretsForLog('')`
+	* can answer `***` for the empty string and make `maskSecretsRaw('')`
 	* differ from `''`. Neither call site can reach it — both refuse an empty
 	* name upstream — so it fences nothing measured today.
 	*
@@ -29931,7 +29936,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			this.logger.debug(`Resolved Fn::GetAZs from cache: ${this.displayMasked(loggedRegionText ?? region, context)} -> ${JSON.stringify(this.maskValueLeaves(cached, context))}`);
 			return cached;
 		}
-		const ec2Client = this.clientsForRegion(clientRegion, loggedRegionText === void 0 ? void 0 : this.maskSecretsForLog(loggedRegionText, context)).ec2;
+		const ec2Client = this.clientsForRegion(clientRegion, loggedRegionText === void 0 ? void 0 : this.displayMasked(loggedRegionText, context)).ec2;
 		let azNames;
 		try {
 			azNames = ((await ec2Client.send(new DescribeAvailabilityZonesCommand({ Filters: [{
@@ -29980,9 +29985,31 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* Results are cached to avoid repeated API calls.
 	*/
 	/**
-	* Mask any resolved secret value out of a string bound for a log line, using
-	* the secrets recorded on the resolution pass (GHSA fix). No-op when the pass
-	* recorded no secrets.
+	* The SECRET answer alone: mask any resolved secret value out of `text`,
+	* using the secrets recorded on the resolution pass (GHSA fix). No-op when
+	* the pass recorded no secrets.
+	*
+	* ## NOT a display form, and the name says so
+	*
+	* This was `maskSecretsForLog` until go-to-k/cdkd#3426, and the name was the
+	* defect. It answers "does this text contain a recorded secret" and makes no
+	* claim about CONTROL CHARACTERS — but it read as "the spelling a log line
+	* takes", so TEN local bindings took its result and interpolated it later,
+	* one of them reaching an `Fn::ImportValue` warn and throw with a live
+	* `ESC[2K` + CR from a template-supplied export name (measured on this tree,
+	* at DEFAULT verbosity, on the DEFAULT path). Renaming it is what makes the
+	* hazard visible at the BINDING rather than at the render: `const x =
+	* this.maskSecretsRaw(...)` states that more work is owed.
+	*
+	* Reachable from ONE place, {@link maskThenStripThenMask}, which is itself
+	* reachable only from {@link displayMasked}. That containment is the whole
+	* mechanism and it is enforced, not conventional:
+	* `scripts/check-resolver-mask-coverage.ts` does not list this method in
+	* `MASKERS`, so its AST walk — which RESOLVES an interpolated identifier to
+	* its declaration — reports any render that reaches it, through a binding or
+	* directly. Do not add it to that list, and do not call it from a new site.
+	*
+	* ## What the masking itself does
 	*
 	* A value with a registered LOG TWIN prints as its twin first (issue
 	* [#3150](https://github.com/go-to-k/cdkd/issues/3150)). The needle mask
@@ -29992,7 +30019,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* reference) printed in the clear at every site that handed its RAW value
 	* here, although the pass had registered where the secret sits. Looking the
 	* twin up HERE, rather than at each such site, is what makes the class
-	* closed for raw values: every one of those sites already calls this method.
+	* closed for raw values: every one of those sites already reaches this
+	* method through the builder.
 	* The twin prints as it is: it is the raw text with masked spans, so it
 	* holds no recorded needle the raw text lacks. When the needle mask ALSO
 	* changes the raw text the whole text is masked instead, the rule
@@ -30000,8 +30028,21 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* cannot be merged. What this cannot see is a value TRANSFORMED before it
 	* arrives (a lowercased region, a sliced output name, an assembled
 	* sentence); those sites derive their text from the twin themselves.
+	*
+	* ## The SELF-COMPARISON, and why it did not block the strip
+	*
+	* The line below compares `maskNeedlesForLog(text) !== text` — the NEEDLE
+	* mask, not this method's own result — so making the RENDER path strip
+	* changes no comparison anywhere. An earlier revision of `displayMasked`'s
+	* comment said stripping could not move inside "the masker" because its
+	* result is also a comparison; that was a claim about this expression, and
+	* the expression's operand is a different function. The measurement that
+	* settled it: every one of this method's 20 escaping call sites rendered
+	* into a log line, a throw, or a `display:` field that becomes one — none
+	* compared, persisted or re-parsed the result — so the render path could
+	* take the strip whole.
 	*/
-	maskSecretsForLog(text, context) {
+	maskSecretsRaw(text, context) {
 		const registered = this.registeredLogTwin(text, context);
 		if (registered === void 0) return this.maskNeedlesForLog(text, context);
 		return this.maskNeedlesForLog(text, context) !== text ? "***" : registered;
@@ -30020,19 +30061,19 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const raw = error instanceof Error ? error.message : String(error);
 		return {
 			unit,
-			subject: this.maskSecretsForLog(subject, context),
-			message: this.maskSecretsForLog(preRedact === void 0 ? raw : preRedact(raw), context),
+			subject: this.displayMasked(subject, context),
+			message: this.displayMasked(preRedact === void 0 ? raw : preRedact(raw), context),
 			error,
 			carriedDynamicReference: carriesDynamicReference(rawInput),
 			carriedFetchableReference: carriesFetchableDynamicReference(rawInput)
 		};
 	}
 	/**
-	* The needle mask alone: {@link maskSecretsForLog} without the log-twin
+	* The needle mask alone: {@link maskSecretsRaw} without the log-twin
 	* lookup. For the two DETECTORS that must ask the needle mask apart from the
 	* position mask: `logTwinText`, which asks it of a value that already has a
 	* twin, and `resolveBase64`, whose other operand is the position mask. A
-	* message masks through `maskSecretsForLog`.
+	* message masks through `displayMasked`.
 	*/
 	maskNeedlesForLog(text, context) {
 		let masked = text;
@@ -30060,7 +30101,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* part of it outside the span. The value's own needle mask cannot be merged
 	* with the twin's positions, so the line gives both up for `***`: never
 	* more text than either mask alone would print. Returns the text BEFORE the
-	* needle mask; each log line wraps it in `maskSecretsForLog` itself, so the
+	* needle mask; each log line wraps it in `displayMasked` itself, so the
 	* resolver's mask-coverage checker sees a masker at the site.
 	*/
 	logTwinText(result, twin, context) {
@@ -30112,12 +30153,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* the leaf treated as a resolution product — masked whole when it is a
 	* recorded secret, otherwise the masked twin this pass registered for it —
 	* and then `logTwinText`'s whole-line guard. The caller still wraps the
-	* result in `maskSecretsForLog`. Used where the text is needed BEFORE that
+	* result in `displayMasked`. Used where the text is needed BEFORE that
 	* masker, or apart from it: the `Fn::Base64` line and its detector, and the
 	* names issue [#3150](https://github.com/go-to-k/cdkd/issues/3150)
 	* transforms or composes before printing (`regionLogText`,
 	* `outputNameLogText`, the invalid-region refusals, the cross-stack `origin`
-	* strings). A leaf printed as it is needs none of it: `maskSecretsForLog`
+	* strings). A leaf printed as it is needs none of it: `displayMasked`
 	* looks the twin up itself, which is how `maskValueLeaves` gives its lines
 	* and the THROWN messages it masks (the `Fn::Cidr` argument refusals, for
 	* one) the same position mask.
@@ -30357,7 +30398,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	maskValueLeaves(value, context) {
 		const done = /* @__PURE__ */ new Map();
 		const walk = (node) => {
-			if (typeof node === "string") return this.maskSecretsForLog(node, context);
+			if (typeof node === "string") return this.displayMasked(node, context);
 			if (node === null || typeof node !== "object") return node;
 			const memo = done.get(node);
 			if (memo !== void 0) return memo;
@@ -30369,7 +30410,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 			const out = Object.create(null);
 			done.set(node, out);
-			for (const [key, child] of Object.entries(node)) out[this.maskSecretsForLog(key, context)] = walk(child);
+			for (const [key, child] of Object.entries(node)) out[this.displayMasked(key, context)] = walk(child);
 			return out;
 		};
 		return walk(value);
@@ -30400,10 +30441,18 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* of the text in hand. A value this resolver resolved cannot be that text
 	* (the split copy is itself recorded, so the first mask catches it), but a
 	* template LITERAL can: issue #3150's region-scoped clients refusal prints
-	* a producer-region guest's region through this helper, and a literal ARN
-	* region spelling a recorded `st-1` as `s` + U+0001 + `t-1` is masked only
-	* by the second pass (`intrinsic-resolver-name-argument-log-twin.test.ts`
-	* pins both halves on that route).
+	* a producer-region guest's region through {@link displayMasked}, and a
+	* literal ARN region spelling a recorded `st-1` as `s` + U+0001 + `t-1` is
+	* masked only by the second pass
+	* (`intrinsic-resolver-name-argument-log-twin.test.ts` pins both halves on
+	* that route).
+	*
+	* ONE CALLER, {@link displayMasked}, since go-to-k/cdkd#3426. It is most of
+	* the answer and reads like all of it — it omits `displaySafe`, and
+	* therefore `U+2028` / `U+2029` and the bidi overrides — so a site reaching
+	* for it directly is the near-miss back onto the treadmill. It is not in
+	* `MASKERS` in `scripts/check-resolver-mask-coverage.ts`, so a render that
+	* reaches it (through a binding or directly) is reported there.
 	*
 	* THE BOUND, since this file's job is to state them: this covers a needle
 	* split by a character `stripControlChars` removes. A needle split by
@@ -30412,59 +30461,67 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* solved here.
 	*/
 	maskThenStripThenMask(value, context) {
-		return this.maskSecretsForLog(stripControlChars(this.maskSecretsForLog(value, context)), context);
+		return this.maskSecretsRaw(stripControlChars(this.maskSecretsRaw(value, context)), context);
 	}
 	/**
-	* The ONE way a masked value reaches a message in this file.
+	* The ONE way a masked value reaches a message in this file — and, since
+	* go-to-k/cdkd#3426, the ONLY exit from the masking machinery at all.
 	*
 	* ## Why this exists rather than a rule about call sites
 	*
-	* `maskSecretsForLog` answers "does this text contain a recorded secret". It
-	* makes NO claim about control characters, and it cannot be taught to: its
-	* result is also used as a COMPARISON (`maskNeedlesForLog(text) !== text`
-	* decides whether a twin was registered), so stripping inside it would change
-	* what that comparison means at every call site.
-	*
-	* That split produced a four-round treadmill on go-to-k/cdkd#3408. Round 1
-	* found the four `Fn::GetStackOutput` throws rendering a masked name raw and
-	* fixed them. Round 2 found the CloudFormation-fallback warn — the DEFAULT
-	* path, at DEFAULT verbosity — and the self-reference throw. Round 3 found
-	* the `reresolveCrossStackValue` origin builder and
-	* `describeAvailableOutputs`. Each round fixed what it found and the next
-	* round found more, because the population was never enumerated. Measured
-	* 2026-09-19 with a comment-stripped scan: SEVENTY-ONE interpolations
-	* rendered a `maskSecretsForLog` result directly, plus thirteen hand-spelled
+	* {@link maskSecretsRaw} answers "does this text contain a recorded secret"
+	* and makes NO claim about control characters. That split produced a
+	* four-round treadmill on go-to-k/cdkd#3408. Round 1 found the four
+	* `Fn::GetStackOutput` throws rendering a masked name raw and fixed them.
+	* Round 2 found the CloudFormation-fallback warn — the DEFAULT path, at
+	* DEFAULT verbosity — and the self-reference throw. Round 3 found the
+	* `reresolveCrossStackValue` origin builder and `describeAvailableOutputs`.
+	* Each round fixed what it found and the next round found more, because the
+	* population was never enumerated. Measured 2026-09-19 with a
+	* comment-stripped scan: SEVENTY-ONE interpolations rendered a bare masker
+	* result directly, plus thirteen hand-spelled
 	* `displaySafe(maskThenStripThenMask(...))` compositions and two bare
 	* `maskThenStripThenMask` interpolations — and three reviewers between them
 	* reached eight of the eighty-six.
 	*
-	* So the repair is not another site. Interpolating the MASKER is now itself
-	* the defect, and this is the only sanctioned way to render one — which turns
-	* "did someone remember to strip here" into a property one scanner checks
-	* over the whole file at once.
-	* `tests/unit/deployment/resolver-display-masked-population.test.ts` is that
-	* scanner: it fails on any `${this.maskSecretsForLog(...)}`, so a new raw
-	* render in THAT SHAPE cannot be added silently.
-	*
-	* ## KNOWN RESIDUAL — the class is NARROWED, not closed
-	*
-	* Stated here rather than implied away, because an earlier revision of this
-	* comment claimed the class was "closed by CONSTRUCTION" and that is FALSE.
-	* The scanner is line-shaped and forbids only the `${this.<masker>(` spelling.
-	* TEN local bindings take a raw masker result and interpolate it later, which
-	* it cannot see — and at least one is a live exposure:
-	* `loggedExportName` (bound from `maskSecretsForLog`) reaches an
-	* `Fn::ImportValue` throw carrying an unstripped ESC and CR, measured on this
-	* tree. `loggedSecretId`, `loggedJsonKey`, `loggedParameterName`,
-	* `maskedAttributeName` and `loggedOrigin` are the same shape.
-	*
-	* Do NOT close those by hand at the ten sites: that is the fifth round of the
-	* enumeration this builder exists to end, and the mechanism that resolves an
-	* identifier to its initializer ALREADY EXISTS in this repo —
-	* `sanitizedLocals` in
-	* `tests/unit/cli/local-profile-display-population.test.ts`.
-	* go-to-k/cdkd#3426 owns binding the scanner to it; go-to-k/cdkd#3405 and
-	* go-to-k/cdkd#3411 own the surrounding scope and parser work.
+	* ROUND FIVE was the BINDING shape: `const loggedExportName =
+	* this.<masker>(...)` interpolated later, which a line-shaped scanner
+	* forbidding `${this.<masker>(` structurally cannot see. Ten of them existed,
+	* and `loggedExportName` was a LIVE exposure — an `Fn::ImportValue` export
+	* name carrying `ESC[2K` + CR reached a warn AND a throw unstripped, at
+	* default verbosity on the default path.
+	*
+	* Patching those ten sites would have been the fifth round of one
+	* enumeration. What closes the class instead is that there is no longer a
+	* masking answer a site can reach WITHOUT the strip: every escaping call of
+	* the old `maskSecretsForLog` now calls this builder, the raw masker is
+	* reachable only through {@link maskThenStripThenMask}, and that helper is
+	* reachable only from here.
+	*
+	* ## What keeps it closed
+	*
+	* `scripts/check-resolver-mask-coverage.ts` — an AST walk that already
+	* RESOLVES an interpolated identifier to its declaration and judges the
+	* initializer. Its `MASKERS` list names the functions a render may reach,
+	* and since go-to-k/cdkd#3426 every entry on it SANITIZES as well as masks.
+	* So a binding of a raw masker is a finding wherever it is later
+	* interpolated, by the same mechanism that already answered the secret
+	* question — no second scanner, and nothing line-shaped.
+	* `tests/unit/deployment/resolver-display-masked-population.test.ts` pins the
+	* population and the builder bodies beside it.
+	*
+	* KNOWN BOUND, stated rather than implied away: a site carrying an
+	* exclusion marker is exempt from that walk, because the marker answers the
+	* SECRET question ("this value cannot carry a plaintext"), which is not the
+	* control-character question. Such a site sanitizes by hand or not at all —
+	* `clientsForRegion`'s two region renders are both markered, and both
+	* sanitize. Widening the walk to judge every interpolated value is
+	* go-to-k/cdkd#3405's mixed-render scope, not this builder's.
+	*
+	* (The marker's literal spelling is deliberately not written in this comment:
+	* the checker scans the raw text for it, and a prose mention parses as a
+	* marker no site consumes — which it then reports STALE. Measured while
+	* writing this paragraph.)
 	*
 	* ## What it does, in order
 	*
@@ -30478,8 +30535,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*
 	* It is listed in `MASKERS` in `scripts/check-resolver-mask-coverage.ts`,
 	* which is a SECURITY decision and a sound one: every path through it passes
-	* `maskSecretsForLog`, so it is strictly stronger than the entry it replaces
-	* and cannot be weaker at any input.
+	* the needle-and-twin mask, twice, so it is strictly stronger than the bare
+	* masker it replaced and cannot be weaker at any input.
 	*/
 	displayMasked(value, context) {
 		return displaySafe(this.maskThenStripThenMask(value, context));
@@ -30489,16 +30546,16 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* the same reason as {@link displayMasked} and closed by the same scanner.
 	*
 	* `logTextOfLeaf` resolves a value to its registered twin (or `SECRET_MASK`),
-	* which is a MASKING answer and, like `maskSecretsForLog`'s, says nothing
+	* which is a MASKING answer and, like `maskSecretsRaw`'s, says nothing
 	* about control characters. Four `origin` builders interpolated it raw — the
 	* `Fn::ImportValue` pair, the `Fn::GetStackOutput` one and the nested-stack
 	* attribute one — and those strings flow into `redactedAttributeReads[].display`
 	* and out through a `ProvisioningError` message.
 	*
-	* This route is why fixing the masker alone did not close the class:
-	* `displayMasked` covers every site that interpolates `maskSecretsForLog`,
-	* and these interpolate something else. Two routes, two names, one scanner
-	* forbidding the raw form of both.
+	* This route is why fixing the secret masker alone did not close the class:
+	* `displayMasked` covers every site that renders a needle-masked value, and
+	* these render something else. Two routes, two names, one checker refusing
+	* the raw form of both.
 	*
 	* Composed rather than re-derived. `maskSecretsInText` is idempotent (see
 	* {@link maskThenStripThenMask}), so masking twin text again costs nothing
@@ -30557,7 +30614,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					continue;
 				}
 				const regionVerdict = classifyReplaySecretRegion(fullMatch, this.explicitRegion ?? this.resolverRegion, context?.producerRegions);
-				if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${this.displayMasked(tokenLogText, context)}: it names '${this.displayMasked(nameLogText(regionVerdict.secretName), context)}' without a region, and this stack reads from ${this.displayMasked(regionVerdict.foreignProducerRegions.map((r) => this.maskSecretsForLog(r, context)).join(", "), context)} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
+				if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${this.displayMasked(tokenLogText, context)}: it names '${this.displayMasked(nameLogText(regionVerdict.secretName), context)}' without a region, and this stack reads from ${this.displayMasked(regionVerdict.foreignProducerRegions.map((r) => this.displayMasked(r, context)).join(", "), context)} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
 				if (regionVerdict.kind === "named-region") {
 					const foreign = await this.resolverForProducerRegion(regionVerdict.region, context, nameLogText(regionVerdict.region)).resolveDynamicReferencesWithLogTwin(fullMatch, fullMatch, withoutProducerRegions(context), {
 						tokenLogText,
@@ -30626,7 +30683,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					isSecret = true;
 					resolved = param.value;
 				} else {
-					this.logger.warn(this.maskSecretsForLog(`Unsupported dynamic reference service: ${this.displayMasked(nameLogText(String(service)), context)}`, context));
+					this.logger.warn(this.displayMasked(`Unsupported dynamic reference service: ${this.displayMasked(nameLogText(String(service)), context)}`, context));
 					complete = false;
 					continue;
 				}
@@ -30714,8 +30771,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		} else secretId = afterService;
 		if (!versionStage) versionStage = "AWSCURRENT";
 		if (!secretId) throw new Error("Dynamic reference: secretsmanager SECRET_ID is required");
-		const loggedSecretId = this.maskSecretsForLog(nameLogText(secretId), context);
-		const loggedJsonKey = this.maskSecretsForLog(nameLogText(jsonKey), context);
+		const loggedSecretId = this.displayMasked(nameLogText(secretId), context);
+		const loggedJsonKey = this.displayMasked(nameLogText(jsonKey), context);
 		this.logger.debug(`Resolving dynamic reference: secretsmanager:${loggedSecretId}:SecretString:${loggedJsonKey}:${this.displayMasked(nameLogText(versionStage), context)}:${this.displayMasked(nameLogText(versionId), context)}`);
 		const client = this.clientsForRegion(this.explicitRegion).secretsManager;
 		const command = new GetSecretValueCommand({
@@ -30880,7 +30937,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async resolveSSMReference(parts, decrypt, service, context, nameLogText) {
 		const parameterName = parts.slice(1).join(":");
 		if (!parameterName) throw new Error(`Dynamic reference: ${service} PARAMETER_NAME is required`);
-		const loggedParameterName = this.maskSecretsForLog(nameLogText(parameterName), context);
+		const loggedParameterName = this.displayMasked(nameLogText(parameterName), context);
 		this.logger.debug(`Resolving dynamic reference: ${service}:${loggedParameterName}`);
 		const client = this.clientsForRegion(this.explicitRegion).ssm;
 		const command = new GetParameterCommand({
@@ -32578,7 +32635,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-De5KONKr.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DNzgk-BS.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -45645,4 +45702,4 @@ var DeployEngine = class DeployEngine {
 
 //#endregion
 export { secretBearing as $, SynthesisError as $i, recordMaskOnlyValue as $n, AssetManifestLoader as $r, s3BucketArn as $t, extractDeploymentEventError as A, getAwsClients as Ai, refuseMalformedState as An, BOOTSTRAP_MARKER_PREFIX as Ar, isImpossibleEmptyStoredAttribute as At, toCfnInteger as B, IntrinsicResolutionRefusalError as Bi, STATE_SOURCED_BASELINE_RULES as Bn, buildDockerImage as Br, coerceCfnBoolean as Bt, buildFinalSnapshotIdentifier as C, canonicalizeRegion as Ci, producerRecordKey as Cn, stringifyValue as Cr, isTerminationProtectionPropagationError as Ct, refusesFinalSnapshot as D, clearBucketRegionCache as Di, refuseMalformedOutputsForDestroy as Dn, loadPublishableAssetManifest as Dr, cfnRefValueFromPhysicalId as Dt, isFinalSnapshotError as E, processStackMessages as Ei, refuseMalformedOutputs as En, createAssetRedirectResolver as Er, carriesFetchableDynamicReference as Et, isStatefulRecreateTargetSync as F, ConfigError as Fi, findSilentDropProperties as Fn, parseBootstrapMarker as Fr, isSettledInstanceState as Ft, gray as G, NestedStackChildDirectDestroyError as Gi, createSecretMasker as Gn, formatDockerLoginError as Gr, readConfigString as Gt, formatResourceLine as H, LocalStartServiceError as Hi, STATE_SOURCED_READBACK_RULES as Hn, describeDockerExecFailure as Hr, configBooleanRefusal as Ht, renderStatefulReason as I, CrossAccountSecretRefusalError as Ii, describeTypeWithThrottleRetry as In, readBootstrapMarkerBody as Ir, WAFv2WebACLProvider as It, yellow as J, ResourceTimeoutError as Ji, identityKeyFor as Jn, redactDockerArgvValues as Jr, requireConfigObject as Jt, green as K, PartialFailureError as Ki, dynamicReferenceTokens as Kn, getDockerCmd as Kr, replayWarn as Kt, WARM_THROUGHPUT_MEMBERS as L, DependencyError as Li, withRetry as Ln, validateAssetBucketName as Lr, normalizeAwsTagsToCfn as Lt, planOrphanAdoption as M, setAwsClients as Mi, repairMalformedResourcePropertiesForReadOnly as Mn, ensureAssetStorage as Mr, isUnboundTemplateParameter as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, AssetError as Ni, repairMalformedResourcesForReadOnly as Nn, getBootstrapMarkerKey as Nr, parameterTypeMayLoseSecretIdentity as Nt, unsupportedFinalSnapshotError as O, resolveBucketRegion as Oi, refuseMalformedResourcePropertiesForOrphan as On, rewriteTemplateAssetReferences as Or, coerceParameterTypedValue as Ot, isStatefulRecreateTargetForReplace as P, CdkdError as Pi, findActionableSilentDrops as Pn, isCrossRegionRedirect as Pr, refStateLookupFromResource as Pt, isExportAliasCollision as Q, StateError as Qi, maskSecretsInText as Qn, stripControlChars as Qr, withSharedDrainBudget as Qt, coerceWarmThroughput as R, DeployCancelledError as Ri, DagBuilder as Rn, validateContainerRepoName as Rr, resolveExplicitPhysicalId as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, PARTITION_TABLE as Si, malformedStateRefusalMessage as Sn, AssetPublisher as Sr, disableInstanceApiTermination as St, createPreDeleteFinalSnapshot as T, AssemblyReader as Ti, refuseMalformedNestedChildOutputs as Tn, buildAssetRedirectMap as Tr, carriesDynamicReference as Tt, bold as U, LockError as Ui, TEMPLATE_SOURCED_RULES as Un, describeDockerFailure as Ur, configIntegerRefusal as Ut, toFiniteNumber as V, LocalInvokeBuildError as Vi, STATE_SOURCED_CROSS_GENERATION_RULES as Vn, describeDockerCapturedOutput as Vr, coerceCfnInteger as Vt, cyan as W, MalformedProducerRecordRefusalError as Wi, carriesSecretMask as Wn, dockerSpawnEnvWithSensitive as Wr, configStringRefusal as Wt, collectPublishedOutputNames as X, StackHasActiveImportsError as Xi, markSameGenerationBag as Xn, runDockerStreaming as Xr, classifyReplaySecretRegion as Xt, collectDeclaredOutputNames as Y, ResourceUpdateNotSupportedError as Yi, isSingleDynamicReferenceToken as Yn, runDockerForeground as Yr, requireConfigString as Yt, exportAliasCollisionScrubWarning as Z, StackTerminationProtectionError as Zi, maskSecretsInError as Zn, escapeRegExp$1 as Zr, producerRegionsFromState as Zt, isSecretBearingReferenceString as _, findLargeInlineResources as _i, malformedOutputsRefusalMessage as _n, importableOutputs as _r, isWaitAbandonedError as _t, DeploymentEventsStore as a, isRetryableTransientError as aa, resolveApp as ai, AWS_CREDENTIAL_ENV_KEYS as an, rebuildClientForBucketRegion as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, decodeListingKey as bi, malformedResourcePropertiesWarning as bn, orphansCarriedFrom as br, deleteIndeterminateGuards as bt, replayFailedOperations as c, markNonRetryable as ca, resolveSkipPrefix as ci, envCredentialsAreAssumedRole as cn, buildLockContentionMessage as cr, createMaskedRetryLogger as ct, updatePartialReason as d, describeAwsFailure as da, resolveUseCdkBootstrapAssets as di, STATE_RESOURCES_MALFORMED as dn, shellQuote as dr, beginCommandInterruptScope as dt, formatError as ea, getDockerImageBySourceHash as ei, s3BucketDomainName as en, recoverMaskedOutput as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, safeStringify$1 as fa, stateBucketExistenceConfirmed as fi, hasReadableOutputs as fn, CUSTOM_RESOURCE_RESPONSE_PREFIX as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, MIGRATE_TMP_PREFIX as gi, malformedLocalOutputsWarning as gn, importableOutputKeys as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, CFN_TEMPLATE_URL_LIMIT as hi, malformedExportSourceWarning as hn, hasReadableExportSet as hr, startInterruptWatch as ht, DeploymentEventsReader as i, isMarkedNonRetryable as ia, getLegacyStateBucketName as ii, applyRoleArnIfSet as in, S3StateBackend as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, resetAwsClients as ji, repairMalformedOutputsForReadOnly as jn, assertAssetBucketRegion as jr, isNamelessDynamicReferenceError as jt, makeCanonicalizePropertiesFn as k, AwsClients as ki, refuseMalformedResourcesForDestroy as kn, AssetModeResolver as kr, getAccountInfo as kt, replayRollback as l, markRedactedCause as la, resolveStateBucketWithDefault as li, DiffCalculator as ln, forceQuitRecoveryClause as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, CFN_TEMPLATE_BODY_LIMIT as mi, malformedExportNamesWarning as mn, exportNamesCarriedFrom as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, normalizeAwsError as na, synthesisStatusMessage as ni, s3BucketRegionalDomainName as nn, scrubResourceRecord as nr, getCurrentResourceSecrets as nt, planFailedOps as o, isThrottlingError as oa, resolveAutoAssetStorage as oi, applyCallerIdentityCredentials as on, UNREPRODUCIBLE_LOCK_CLAUSE as or, ProviderRegistry as ot, maskingRetryLogger as p, __exportAll as pa, warnDeprecatedNoPrefixCliFlag as pi, hasReadableResources as pn, DEFAULT_STATE_PREFIX as pr, interruptWatchListenerCount as pt, red as q, ProvisioningError as qi, errorCauseChain as qn, partitionSensitiveEnv as qr, requireConfigArray as qt, DeployEngine as r, withErrorHandling as ra, getDefaultStateBucketName as ri, s3BucketWebsiteUrl as rn, LockManager as rr, IAMRoleProvider as rt, planRollback as s, isTransientServerError as sa, resolveCaptureObservedState as si, callerEnvCredentials as sn, buildForceUnlockCommand as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, isCdkdError as ta, Synthesizer as ti, s3BucketDualStackDomainName as tn, redactSecretsForState as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, retryClassificationText as ua, resolveStateBucketWithDefaultAndSource as ui, INTRINSIC_KEYS as un, formatLockExpiry as ur, maskerOrIdentity as ut, keptWholeReasonText as v, uploadCfnTemplate as vi, malformedOutputsWarning as vn, isReadableBag as vr, slowCcOperationTimeoutMs as vt, ccRoutedFinalSnapshotError as w, derivePartitionAndUrlSuffix as wi, refuseDivergentRecordRegionForDestroy as wn, WorkGraph as wr, IntrinsicFunctionResolver as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, expectedOwnerParam as xi, malformedResourcesWarning as xn, shouldRetainResource as xr, deleteSkipReason as xt, mergeNoChangeOutputs as y, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as yi, malformedRenderedContainersWarning as yn, orphansAfterRollback as yr, UNSPECIFIED_SKIP_REASON as yt, isWarmThroughputDecrease as z, DynamicReferenceRegionAmbiguousError as zi, TemplateParser as zn, buildDenyExternalAccessPolicy as zr, assertRegionMatch as zt };
-//# sourceMappingURL=deploy-engine-mI1Xv1oi.js.map
+//# sourceMappingURL=deploy-engine-21iNqwR3.js.map