@go-to-k/cdkd 0.290.31 → 0.290.32

package/dist/{deploy-engine-21iNqwR3.js → deploy-engine-CfOsVRQB.js}

@@ -1,6 +1,6 @@
-import { C as displayAwsMessage, E as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-BjWM-UVj.js";
+import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-BX4pJk0T.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-IwTfNQ-K.js";
+import { t as getCdkdVersion } from "./version-F41ektvu.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -9980,18 +9980,54 @@ function buildForceUnlockCommand(stackName, region, recovery) {
 	const stackIsExact = safeStack === stackName;
 	const safeRegion = region === void 0 ? void 0 : displaySafe(region, { asciiOnly: true });
 	const regionIsExact = region === void 0 || safeRegion === region;
-	const safeRecovery = {
-		profile: sanitizeRecoveryValue(recovery?.profile),
-		stateBucket: sanitizeRecoveryValue(recovery?.stateBucket),
-		statePrefix: sanitizeRecoveryValue(recovery?.statePrefix)
+	const recoveryFlags = recoveryCommandFlags(recovery);
+	if (!safeStack || safeRegion === "" || !stackIsExact || !regionIsExact || !recoveryFlags.exact) return "";
+	return [safeRegion === void 0 ? `cdkd force-unlock ${shellQuote(safeStack)}` : `cdkd force-unlock ${shellQuote(safeStack)} --stack-region ${shellQuote(safeRegion)}`, ...recoveryFlags.flags].join(" ");
+}
+/**
+* A placeholder for a value a pasteable command could not name, QUOTED.
+*
+* A bare `<profile>` is two shell redirections, not a word: pasted, `<profile`
+* reads stdin from a file named `profile` and `>` sends stdout to whatever
+* word follows. While the hole was the command's LAST word that was only a
+* syntax error; with flags appended after it (`--profile <profile>
+* --state-bucket b`) it ran the command with `--state-bucket` swallowed as a
+* redirect target and `b` as the profile — a delete against the ambient
+* bucket, with nothing printed (measured by the maintainer, M4 of the
+* go-to-k/cdkd#3363 review). Quoted, it pastes as one literal argument and
+* nothing else — no redirection, no swallowed flag. It is not refused: an
+* UNFILLED hole runs as that literal value (a stack named `<stack>`, a prefix
+* `<prefix>`).
+*/
+function commandHole(name) {
+	return `'<${name}>'`;
+}
+/**
+* The flags that pin a pasteable state command to the caller's account and
+* bucket: `--profile`, the resolved `--state-bucket`, and a NON-default
+* `--state-prefix` (see {@link LockRecoveryContext} for why each is emitted
+* when it is). ONE spelling, shared by {@link buildForceUnlockCommand} and the
+* `cdkd orphan` properties refusal `malformed-resources-bag.ts` builds
+* (go-to-k/cdkd#3363): after `cdkd orphan --profile prod ...` a remedy that
+* carried none of these resolved the DEFAULT profile's bucket when pasted.
+* Each fragment takes {@link sanitizeRecoveryValue}'s sanitize + exactness
+* pair (go-to-k/cdkd#3377); what a caller does with an inexact one is its
+* own call — `buildForceUnlockCommand` suppresses the whole command, the orphan
+* refusal prints the hole.
+*/
+function recoveryCommandFlags(recovery) {
+	const profile = sanitizeRecoveryValue(recovery?.profile);
+	const stateBucket = sanitizeRecoveryValue(recovery?.stateBucket);
+	const statePrefix = sanitizeRecoveryValue(recovery?.statePrefix);
+	const flags = [];
+	if (profile.text || !profile.exact) flags.push(profile.exact ? `--profile ${shellQuote(profile.text)}` : `--profile ${commandHole("profile")}`);
+	if (stateBucket.text || !stateBucket.exact) flags.push(stateBucket.exact ? `--state-bucket ${shellQuote(stateBucket.text)}` : `--state-bucket ${commandHole("bucket")}`);
+	const prefix = recovery?.statePrefix;
+	if (prefix !== void 0 && prefix !== "cdkd") flags.push(statePrefix.exact ? `--state-prefix ${shellQuote(statePrefix.text)}` : `--state-prefix ${commandHole("prefix")}`);
+	return {
+		flags,
+		exact: profile.exact && stateBucket.exact && statePrefix.exact
 	};
-	const recoveryIsExact = Object.values(safeRecovery).every((v) => v.exact);
-	if (!safeStack || safeRegion === "" || !stackIsExact || !regionIsExact || !recoveryIsExact) return "";
-	const parts = [safeRegion === void 0 ? `cdkd force-unlock ${shellQuote(safeStack)}` : `cdkd force-unlock ${shellQuote(safeStack)} --stack-region ${shellQuote(safeRegion)}`];
-	if (safeRecovery.profile.text) parts.push(`--profile ${shellQuote(safeRecovery.profile.text)}`);
-	if (safeRecovery.stateBucket.text) parts.push(`--state-bucket ${shellQuote(safeRecovery.stateBucket.text)}`);
-	if (safeRecovery.statePrefix.text && safeRecovery.statePrefix.text !== "cdkd") parts.push(`--state-prefix ${shellQuote(safeRecovery.statePrefix.text)}`);
-	return parts.join(" ");
 }
 /**
 * Sanitize ONE {@link LockRecoveryContext} fragment and report whether that
@@ -21847,19 +21883,70 @@ function stackClause(stackName, region) {
 * `destroy-runner.ts`; since go-to-k/cdkd#3328 the first operand is the S3
 * KEY's region rather than the record body's, which is a key SEGMENT and so
 * still plantable) -- its stack name is the caller's, so the region alone is
-* what would aim a destructive command using a value cdkd does not own. This one is reached only with the caller's
-* synthesized stack and `pickStackRegion`'s answer, so substituting is safe and
-* omitting the region is the wider action. Two opposite precedents in one
-* module; neither is the general rule.
+* what would aim a destructive command using a value cdkd does not own. This
+* one is reached only with the caller's synthesized stack and
+* `pickStackRegion`'s answer, so omitting the region is the wider action. Two
+* opposite precedents in one module; neither is the general rule.
+*
+* **Substitution is GATED on the identity rendering EXACTLY, at
+* `STACK_REF_MAX_CODE_POINTS`** (go-to-k/cdkd#3360, and the M0 finding of the
+* go-to-k/cdkd#3363 review). The synthesized name is not validated: a prebuilt
+* cloud assembly's manifest reaches `cdkd orphan` unread, so a name `safeIdentifier`
+* would TRIM (`'prod-api '`) substitutes as a healthy sibling's, and one it would
+* TRUNCATE (a 166-code-point nested name at the 128 default) becomes a command
+* `cdkd state orphan` resolves to zero records and reports as a skip at exit 0.
+* Since go-to-k/cdkd#3359 the legacy shape carries no `--stack-region`, so the
+* name is the ONLY thing narrowing this DELETE. The template arm is the fallback,
+* and the caller says where to take the name from instead
+* ({@link rendersExactly} is the test, shared with the inspect line and the
+* object path).
+*
+* `recovery` qualifies EVERY arm, the no-identity template included, the way
+* {@link buildForceUnlockCommand} is qualified, through the same `recoveryCommandFlags`: `cdkd state orphan`
+* re-resolves the bucket from the ambient profile, so a remedy pasted after
+* `cdkd orphan --profile prod ...` would otherwise address the default
+* profile's account. The template keeps them too: the identity is the hole,
+* not the account, and an operator who fills only the hole would otherwise run
+* an UNQUALIFIED delete — which `cdkd state orphan` reports as a skip at exit 0
+* when the default bucket has no such record, and offers to delete when it has
+* one (the M3 finding of the go-to-k/cdkd#3363 review).
+*/
+function dropRecordCommand(stackName, region, recovery) {
+	if (stackName === void 0 || stackName === "") return [`cdkd state orphan ${commandHole("stack")} --stack-region ${commandHole("region")}`, ...recoveryCommandFlags(recovery).flags].join(" ");
+	const known = region === void 0 || region === "" ? void 0 : region;
+	const regionExact = known === void 0 || rendersExactly(known);
+	if (!rendersExactly(stackName) || !regionExact) {
+		const flag = known === void 0 ? "" : regionExact ? ` --stack-region ${shellQuote(known)}` : ` --stack-region ${commandHole("region")}`;
+		return [`cdkd state orphan ${commandHole("stack")}${flag}`, ...recoveryCommandFlags(recovery).flags].join(" ");
+	}
+	const flag = known === void 0 ? "" : ` --stack-region ${shellQuote(known)}`;
+	return [`cdkd state orphan ${shellQuote(stackName)}${flag}`, ...recoveryCommandFlags(recovery).flags].join(" ");
+}
+/**
+* Whether an identity survives {@link safeIdentifier} UNCHANGED at the
+* state-record grammar's cap, so a command or a key built from it addresses the
+* record the message is about. The cap is `STACK_REF_MAX_CODE_POINTS`, not the
+* 128 the prose uses: `cdkd orphan` reads a PREBUILT assembly's stack name
+* unvalidated, so a manifest can carry one past 128 that is nonetheless the
+* record's real key, and truncating it names nothing — the same bound
+* `malformedDestroyResourcesRefusalMessage` uses, reached from a different
+* source.
+*
+* What it covers: every identity the `cdkd orphan` properties refusal builds
+* something PASTEABLE from — the drop command ({@link dropRecordCommand}), the
+* `cdkd state show` line ({@link orphanInspectCommand}) and the object path
+* ({@link orphanInspectClause}) — so no two of them can disagree about a name
+* (go-to-k/cdkd#3363 review, M0 and M2). What it does NOT cover yet: the
+* destroy refusal and the divergent-region refusal above still spell the same
+* test inline, and the shared {@link inspectCommand} is ungated at 128 for its
+* other callers.
 */
-function dropRecordCommand(stackName, region) {
-	if (stackName === void 0 || stackName === "") return "cdkd state orphan <stack> --stack-region <region>";
-	const flag = region === void 0 || region === "" ? "" : ` --stack-region ${shellQuote(safeIdentifier(region))}`;
-	return `cdkd state orphan ${shellQuote(safeIdentifier(stackName))}${flag}`;
+function rendersExactly(value) {
+	return safeIdentifier(value, STACK_REF_MAX_CODE_POINTS) === value;
 }
 /** The remedy command {@link stackClause}'s message ends on. */
 function inspectCommand(stackName, region) {
-	if (stackName === void 0) return "cdkd state show <stack> --stack-region <region> --json";
+	if (stackName === void 0) return `cdkd state show ${commandHole("stack")} --stack-region ${commandHole("region")} --json`;
 	const flag = region === void 0 ? "" : ` --stack-region ${shellQuote(safeIdentifier(region))}`;
 	return `cdkd state show ${shellQuote(safeIdentifier(stackName))}${flag} --json`;
 }
@@ -22164,10 +22251,144 @@ function malformedResourcePropertiesRefusalMessage(stackName, region, logicalIds
 * stack name and the region `pickStackRegion` settled on, never the record's
 * own unvalidated self-report. See {@link stackClause}.
 */
-function malformedOrphanResourcePropertiesRefusalMessage(rawStackName, rawRegion, logicalIds) {
+function malformedOrphanResourcePropertiesRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
 	const stackName = rawStackName === "" ? void 0 : rawStackName;
 	const region = rawRegion === "" ? void 0 : rawRegion;
-	return `${namedPropertyBagsClause(stackName, region, logicalIds)} 'cdkd orphan' REWRITES and SAVES every record it keeps, so it refuses rather than continuing — under '--dry-run' too, because the rewrite audit table a dry run prints is the wrong one. It is not that the save would fabricate a map: an unreadable bag is carried through VERBATIM. It is that this command exists to leave the record deployable by rewriting every reference to an orphaned resource, and a map it cannot read hides whichever references it holds — a string or a number presents none to find, and a list is walked, so its rewrites are recorded into a container that is still not a map. Continuing would rewrite, save, and report success over a record 'cdkd deploy' then REFUSES. No state was written. Two ways out need no CDK app: repair the record by hand, or drop it whole with '${dropRecordCommand(stackName, region)}', which leaves the live AWS resources standing. A third works only while the CDK app STILL DECLARES the named resource — this refusal covers just the records that would SURVIVE the save, so 'cdkd orphan <its construct path>' removes it and repairs the rest; construct paths come from the synthesized template, so a resource the app no longer declares has none and must take one of the first two. Inspect the record with: ${inspectCommand(stackName, region)}`;
+	const inspect = orphanInspectClause(stackName, region, recovery);
+	const listCommand = withheldIdentityListCommand(stackName, region, recovery);
+	const commands = [
+		`Drop the record: ${dropRecordCommand(stackName, region, recovery)}`,
+		...listCommand === void 0 ? [] : [`Find the exact name: ${listCommand}`],
+		...inspect.command === void 0 ? [] : [`Inspect the record: ${inspect.command}`]
+	];
+	return [
+		`${namedPropertyBagsClause(stackName, region, logicalIds)} 'cdkd orphan' REWRITES and SAVES every record it keeps, so it refuses rather than continuing — under '--dry-run' too, because the rewrite audit table a dry run prints is the wrong one. It is not that the save would fabricate a map: an unreadable bag is carried through VERBATIM. It is that this command exists to leave the record deployable by rewriting every reference to an orphaned resource, and a map it cannot read hides whichever references it holds — a string or a number presents none to find, and a list is walked, so its rewrites are recorded into a container that is still not a map. Continuing would rewrite, save, and report success over a record 'cdkd deploy' then REFUSES. No state was written. Two ways out need no CDK app: repair the record by hand, or drop it whole with the 'Drop the record' command below, which leaves the live AWS resources standing${withheldIdentityClause(stackName, region)}${withheldRecoveryClause(recovery)}. A third works only while the CDK app STILL DECLARES the named resource — this refusal covers just the records that would SURVIVE the save, so 'cdkd orphan <its construct path>' removes it and repairs the rest; construct paths come from the synthesized template, so a resource the app no longer declares has none and must take one of the first two.` + (inspect.sentence === void 0 ? "" : ` ${inspect.sentence}`),
+		...commands,
+		...inspect.locations ?? []
+	].join("\n");
+}
+/**
+* The half-sentence that accompanies a TEMPLATE drop remedy when a stack name
+* WAS known but it, or the region beside it, did not render exactly. The prose
+* above it prints the sanitized spelling, and an operator filling the template
+* from that spelling would be aiming at the healthy sibling the gate exists to
+* protect (`'prod-api '` renders as `prod-api`; a padded region is the same
+* misdirection one flag over), so the message says where to take them from
+* instead: `cdkd state list --json`, which writes the raw name
+* through `JSON.stringify` — `--long` renders through `displayIdent`, which
+* trims, so it would hand back the same spelling. Empty when the command was
+* substituted, and when no name was known at all — that arm's template already
+* reads as a hole to fill.
+*/
+function withheldIdentityClause(stackName, region) {
+	if (!identityWithheld(stackName, region)) return "";
+	return " — the stack name or region above did not render exactly, so take them from the 'Find the exact name' command below — replace each quoted hole, quotes included, with the shell-quoted value — rather than from this message";
+}
+/**
+* The half-sentence for the OTHER thing that can print as a hole: one of the
+* account fragments `recoveryCommandFlags` appends.
+*
+* Separate from {@link withheldIdentityClause} rather than folded into it,
+* because the two holes have different SOURCES and therefore different remedies.
+* An identity hole is filled from `cdkd state list --json`, which is why that
+* clause points at a command; an account fragment came from the operator's own
+* argv, so they already hold it and no listing would help. Conflating them would
+* send someone to a listing that does not carry their `--profile`.
+*
+* Without this, a run whose PREFIX or BUCKET was the inexact value printed
+* `--state-prefix '<prefix>'` with nothing in the message saying the hole was a
+* hole: `identityWithheld` reads the stack name and the region only, and the
+* object-path note is suppressed whenever a prefix WAS supplied. That is
+* {@link withheldIdentityClause}'s own defect class, one fragment over.
+*/
+function withheldRecoveryClause(recovery) {
+	if (recoveryCommandFlags(recovery).exact) return "";
+	return " — an account fragment ('--profile', '--state-bucket' or '--state-prefix') did not render exactly, so the command lines below print a quoted hole in its place, which you replace whole — quotes included — with the SHELL-QUOTED value you passed this run";
+}
+/**
+* The listing {@link withheldIdentityClause} points at, printed as its own
+* trailing command line. Qualified like the remedy it stands in for: a bare
+* listing after `cdkd orphan --profile prod ...` would read the DEFAULT
+* profile's bucket, and the name it hands back would then be a different
+* bucket's.
+*/
+function withheldIdentityListCommand(stackName, region, recovery) {
+	if (!identityWithheld(stackName, region)) return void 0;
+	return ["cdkd state list --json", ...recoveryCommandFlags(recovery).flags].join(" ");
+}
+/** A name WAS known, and it or the region beside it did not render exactly. */
+function identityWithheld(stackName, region) {
+	if (stackName === void 0 || stackName === "") return false;
+	const known = region === "" ? void 0 : region;
+	return !(rendersExactly(stackName) && (known === void 0 || rendersExactly(known)));
+}
+/**
+* The `cdkd state show` command on the orphan properties refusal's trailing
+* `Inspect the record:` line, for a record listed WITH a region — gated and
+* qualified exactly as the drop command on the line above it is, because it is
+* the same identity in the same message.
+* Gating only the drop command left the message contradicting itself: it said
+* the name did not render exactly, pointed at `cdkd state list --json`, and then
+* printed `cdkd state show prod-api ...` with the trimmed spelling of
+* `'prod-api '`, naming the healthy sibling (the M2 finding of the
+* go-to-k/cdkd#3363 review). Holes follow {@link dropRecordCommand}'s rule: an
+* altered region makes both a hole, an altered name only the name.
+*
+* Built here rather than by widening {@link inspectCommand}, which serves four
+* other builders whose identities come from different sources (and this one no
+* longer calls it at all).
+*/
+function orphanInspectCommand(stackName, region, recovery) {
+	const regionExact = rendersExactly(region);
+	return [`cdkd state show ${regionExact && rendersExactly(stackName) ? shellQuote(stackName) : commandHole("stack")} --stack-region ${regionExact ? shellQuote(region) : commandHole("region")} --json`, ...recoveryCommandFlags(recovery).flags].join(" ");
+}
+/**
+* How {@link malformedOrphanResourcePropertiesRefusalMessage} tells the operator
+* to inspect the record: a `command` it prints on its trailing
+* `Inspect the record:` line, or — for the legacy region-less shape, where no
+* command can serve — a prose `sentence` naming the S3 object.
+*
+* A KNOWN stack with NO region is a legacy record (`<prefix>/<stack>/state.json`)
+* that `listStacks` lists with no region — `cdkd orphan` hands this module the
+* region the record is LISTED under since go-to-k/cdkd#3359, and that is
+* `undefined` only for such a ref (its body names no region, or the probe that
+* reads it could not). `cdkd state show` refuses such a record with or without
+* `--stack-region` ("has only a legacy state record without a region"), and the
+* migration it suggests is a `cdkd deploy`, which refuses this very record
+* (go-to-k/cdkd#3191). So ending on `cdkd state show` would hand the operator a
+* command that cannot serve them; the line names the S3 object instead. Teaching
+* `state show` to read a legacy record was the alternative, declined as a wider
+* change to a command that is not the one refusing.
+*
+* The object path is printed only when the stack name {@link rendersExactly}: a
+* path with a sanitized or truncated segment names an object that does not
+* exist. The name comes from the assembly, and `cdkd orphan` accepts a PREBUILT
+* one whose manifest nothing validates, which is what makes an inexact name
+* reachable at all (go-to-k/cdkd#3360); an S3 key's `Parent~Child` name, the
+* case the destroy refusal's gate was written for, cannot appear here.
+*
+* With `recovery` the path carries the REAL prefix and names the bucket, the
+* way the drop remedy above it is qualified; without it the prefix is a
+* placeholder and the sentence says how to fill it.
+*/
+function orphanInspectClause(stackName, region, recovery) {
+	if (stackName === void 0 || stackName === "") return { command: [`cdkd state show ${commandHole("stack")} --stack-region ${commandHole("region")} --json`, ...recoveryCommandFlags(recovery).flags].join(" ") };
+	if (region !== void 0) return { command: orphanInspectCommand(stackName, region, recovery) };
+	const lead = "The record is listed with no region — a legacy 'state.json' whose body names none, or one the listing could not read — which 'cdkd state show' cannot read and a 'cdkd deploy' will not migrate while it is torn, so inspect the object directly";
+	const exactOrUndefined = (v) => v !== void 0 && sanitizeRecoveryValue(v).exact ? v : void 0;
+	const bucket = exactOrUndefined(recovery?.stateBucket) || void 0;
+	const locations = bucket === void 0 ? [] : [`State bucket: ${shellQuote(bucket)}`];
+	const where = bucket === void 0 ? `, in the state bucket ('cdkd state info' names it)` : `, in the bucket on the 'State bucket' line below`;
+	if (!rendersExactly(stackName)) return {
+		sentence: `${lead}: it is the legacy 'state.json' under this stack name, which did not render exactly${where}.`,
+		locations
+	};
+	const prefix = exactOrUndefined(recovery?.statePrefix);
+	const key = shellQuote(`${prefix ?? "<prefix>"}/${stackName}/state.json`);
+	return {
+		sentence: `${lead}: the 'Object key' line below names it${where}.${recovery?.statePrefix === void 0 ? ` Its prefix is 'cdkd' unless '--state-prefix' was given.` : prefix === void 0 ? " The prefix you passed did not render exactly, so the key shows the hole '<prefix>' where it belongs; put your own value there, inside the outer quotes." : ""}`,
+		locations: [`Object key: ${key}`, ...locations]
+	};
 }
 /**
 * For `cdkd orphan`: refuse a record whose SURVIVING resource entries carry a
@@ -22221,11 +22442,11 @@ function malformedOrphanResourcePropertiesRefusalMessage(rawStackName, rawRegion
 * The orphan set is resolved from the synthesized template before the state is
 * loaded, so nothing forces this call any lower.
 */
-function refuseMalformedResourcePropertiesForOrphan(state, removedLogicalIds, stackName, region) {
+function refuseMalformedResourcePropertiesForOrphan(state, removedLogicalIds, stackName, region, recovery) {
 	const removed = new Set(removedLogicalIds);
 	const unreadable = unreadableResourcePropertyBags(state).filter((id) => !removed.has(id));
 	if (unreadable.length === 0) return;
-	throw new CdkdError(malformedOrphanResourcePropertiesRefusalMessage(stackName, region, unreadable), STATE_RESOURCES_MALFORMED);
+	throw new CdkdError(malformedOrphanResourcePropertiesRefusalMessage(stackName, region, unreadable, recovery), STATE_RESOURCES_MALFORMED);
 }
 /**
 * The warning a caller of {@link repairMalformedResourcePropertiesForReadOnly}
@@ -25781,7 +26002,7 @@ function detectUnknownIntrinsicKey(obj) {
 function buildUnknownIntrinsicError(key) {
 	const title = `Support intrinsic ${key}`;
 	const issueUrl = `https://github.com/go-to-k/cdkd/issues/new?title=${encodeURIComponent(title)}&labels=intrinsic-support`;
-	return /* @__PURE__ */ new Error(`Unsupported CloudFormation intrinsic function "${key}": cdkd does not support resolving it yet. Deploying this template would produce a broken value. Please request support by opening an issue: ${issueUrl}`);
+	return /* @__PURE__ */ new Error(`Unsupported CloudFormation intrinsic function "${displayIdent(key)}": cdkd does not support resolving it yet. Deploying this template would produce a broken value. Please request support by opening an issue: ${issueUrl}`);
 }
 /**
 * The same context with the `producerRegions` EVIDENCE removed (issue #2134
@@ -27277,13 +27498,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		let referencedNames;
 		for (const [name, definition] of Object.entries(templateParameters)) {
 			const paramDef = definition;
-			if (isUnboundTemplateParameter(name, template, userParameters)) throw new Error(`Parameter ${name} is required but no value was provided and no default exists`);
+			if (isUnboundTemplateParameter(name, template, userParameters)) throw new Error(`Parameter ${maskInherited(name)} is required but no value was provided and no default exists`);
 			if (userParameters && Object.hasOwn(userParameters, name)) {
 				const userValue = userParameters[name];
 				if (userValue !== void 0) {
 					this.refuseCoercedInheritedSecret(name, paramDef, userValue, inheritedSecrets);
 					parameters[name] = this.coerceParameterValue(userValue, paramDef.Type);
-					this.logger.debug(`Parameter ${name}: using user-provided value ${maskInherited(stringifyParameterForLog(paramDef, this.maskValueLeaves(userValue, inheritedLogContext)))}`);
+					this.logger.debug(`Parameter ${maskInherited(name)}: using user-provided value ${maskInherited(stringifyParameterForLog(paramDef, this.maskValueLeaves(userValue, inheritedLogContext)))}`);
 					continue;
 				}
 			}
@@ -27291,19 +27512,19 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				if (paramDef.Type.startsWith("AWS::SSM::Parameter::Value")) {
 					referencedNames ??= collectReferencedParameterNames(template);
 					if (!referencedNames.has(name)) {
-						this.logger.debug(`Parameter ${name}: skipping SSM resolution (not referenced by Resources/Outputs/Conditions)`);
+						this.logger.debug(`Parameter ${maskInherited(name)}: skipping SSM resolution (not referenced by Resources/Outputs/Conditions)`);
 						continue;
 					}
 					const ssmPath = String(paramDef.Default);
-					this.logger.debug(`Parameter ${name}: resolving SSM parameter path ${ssmPath}`);
+					this.logger.debug(`Parameter ${maskInherited(name)}: resolving SSM parameter path ${maskInherited(ssmPath)}`);
 					const resolved = await this.resolveSSMParameter(ssmPath);
 					const resolvedType = ssmResolvedValueType(paramDef.Type);
 					parameters[name] = resolvedType === void 0 ? resolved : this.coerceParameterValue(resolved, resolvedType);
-					this.logger.debug(`Parameter ${name}: resolved SSM value ${maskInherited(stringifyParameterForLog(paramDef, resolved))}`);
+					this.logger.debug(`Parameter ${maskInherited(name)}: resolved SSM value ${maskInherited(stringifyParameterForLog(paramDef, resolved))}`);
 					continue;
 				}
 				parameters[name] = coerceParameterDefault(paramDef.Default, paramDef.Type);
-				this.logger.debug(`Parameter ${name}: using default value ${maskInherited(stringifyParameterForLog(paramDef, paramDef.Default))}`);
+				this.logger.debug(`Parameter ${maskInherited(name)}: using default value ${maskInherited(stringifyParameterForLog(paramDef, paramDef.Default))}`);
 				continue;
 			}
 		}
@@ -27345,11 +27566,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const inProgress = /* @__PURE__ */ new Set();
 		const evaluateByName = async (name) => {
 			if (Object.hasOwn(conditions, name)) return conditions[name];
-			if (inProgress.has(name)) throw new Error(`Circular condition reference detected involving condition "${name}"`);
+			if (inProgress.has(name)) throw new Error(`Circular condition reference detected involving condition "${this.displayMasked(name, maskingContext)}"`);
 			const bag = templateConditions;
 			const definition = Object.hasOwn(bag, name) ? bag[name] : void 0;
 			if (definition === void 0) {
-				this.logger.warn(`Condition ${name} not found in template, assuming false`);
+				this.logger.warn(`Condition ${this.displayMasked(name, maskingContext)} not found in template, assuming false`);
 				conditions[name] = false;
 				return false;
 			}
@@ -27361,7 +27582,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				});
 				const value = Boolean(result);
 				conditions[name] = value;
-				this.logger.debug(`Evaluated condition ${name} = ${value}`);
+				this.logger.debug(`Evaluated condition ${this.displayMasked(name, maskingContext)} = ${value}`);
 				return value;
 			} finally {
 				inProgress.delete(name);
@@ -27474,7 +27695,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					configurable: true
 				});
 				else resolved[key] = resolvedVal;
-			} else this.logger.debug(`Property ${key} resolved to AWS::NoValue, omitting from object`);
+			} else this.logger.debug(`Property ${this.displayMasked(key, context)} resolved to AWS::NoValue, omitting from object`);
 		}
 		return resolved;
 	}
@@ -27637,7 +27858,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const carriedBefore = inheritedSecretsCarriedBy(userValue, inherited).length;
 		if (carriedBefore === 0) return;
 		if (inheritedSecretsCarriedBy(this.coerceParameterValue(userValue, paramDef.Type), inherited).length >= carriedBefore) return;
-		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Nested-stack parameter '${name}' is declared 'Type: ${paramDef.Type}', but the parent stack resolved a SECRET dynamic reference into it. cdkd keeps a resolved secret out of persisted state by rewriting STRING leaves back to their {{resolve:...}} expression; coercing this value to '${paramDef.Type}' destroys the plaintext cdkd would have matched on, so the DECRYPTED secret would be left in the child stack's state.json with nothing to redact it back to. Declare '${name}' as 'Type: String' in the nested stack's template (CDK does this by default for cross-stack references), or stop passing a secret reference into it.`, void 0, "NESTED_STACK_SECRET_PARAMETER_TYPE"));
+		const loggedName = this.displayMasked(name);
+		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Nested-stack parameter '${loggedName}' is declared 'Type: ${paramDef.Type}', but the parent stack resolved a SECRET dynamic reference into it. cdkd keeps a resolved secret out of persisted state by rewriting STRING leaves back to their {{resolve:...}} expression; coercing this value to '${paramDef.Type}' destroys the plaintext cdkd would have matched on, so the DECRYPTED secret would be left in the child stack's state.json with nothing to redact it back to. Declare '${loggedName}' as 'Type: String' in the nested stack's template (CDK does this by default for cross-stack references), or stop passing a secret reference into it.`, void 0, "NESTED_STACK_SECRET_PARAMETER_TYPE"));
 	}
 	/**
 	* Resolve Ref intrinsic function
@@ -27651,14 +27873,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const resource = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
 		if (resource) {
 			const refValue = this.resolveRefValue(logicalId, resource, context);
-			this.logger.debug(`Resolved Ref to resource: ${logicalId} -> ${refValue}`);
+			this.logger.debug(`Resolved Ref to resource: ${this.displayMasked(logicalId, context)} -> ${refValue}`);
 			return refValue;
 		}
 		if (context.parameters && Object.hasOwn(context.parameters, logicalId)) {
 			const value = context.parameters[logicalId];
 			const declared = context.template.Parameters;
 			const paramDef = declared != null && Object.hasOwn(declared, logicalId) ? declared[logicalId] : void 0;
-			this.logger.debug(`Resolved Ref to parameter: ${logicalId} -> ${this.displayMasked(stringifyParameterForLog(paramDef, this.maskValueLeaves(value, context)), context)}`);
+			this.logger.debug(`Resolved Ref to parameter: ${this.displayMasked(logicalId, context)} -> ${this.displayMasked(stringifyParameterForLog(paramDef, this.maskValueLeaves(value, context)), context)}`);
 			this.recordInheritedParameterSecrets(logicalId, value, context);
 			return value;
 		}
@@ -27758,10 +27980,29 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* nothing to do at this site: the value has ALREADY been masked in state, so
 	* there is no plaintext to register.
 	*
-	* The SPELLING (`Ref <LogicalId> (state key <Key>)`) is what
-	* `DeployEngine.maskedRecordRemedyFor` partitions on, so it is load-bearing
-	* rather than cosmetic — that helper reads the logical id out of it to emit
-	* the re-import command, and pins the shape in a test.
+	* THE SPELLING IS NO LONGER PARSED, and this paragraph used to say the
+	* opposite (corrected in go-to-k/cdkd#3432). It read: "`Ref <LogicalId>
+	* (state key <Key>)` is what `DeployEngine.maskedRecordRemedyFor` partitions
+	* on ... that helper reads the logical id out of it". That was true when it
+	* was written and stopped being true at that helper's round-4 review, which
+	* moved the partition onto the `kind` / `logicalId` FIELDS precisely because
+	* two successive regexes over this rendering each shipped a defect — the
+	* second an `[A-Za-z0-9]+` id class that a HYPHENATED logical id falls out
+	* of. `targetOf` reads `read.logicalId`; no regex touches `display`.
+	*
+	* What the shape IS still load-bearing for is a SENTENCE: the refusal's
+	* `hasRefStateRead` arm tells the reader that "a 'Ref <LogicalId> (state key
+	* <Key>)' entry above is CDKD's own read", so the `Ref ` prefix and the
+	* `(state key ...)` clause have to keep appearing. Sanitizing the ID inside
+	* them leaves both intact.
+	*
+	* THE ID IS SANITIZED, the attribute-read sibling's judgement one branch over
+	* (go-to-k/cdkd#3432). `displayMasked` rather than `displayIdent`: the
+	* builder neither quotes nor bounds, so every legitimate id renders exactly
+	* as it did, and the deliberate collision `intrinsic-ref-state-mask.test.ts`
+	* pins between this rendering and `noteAttributeSecrecy`'s is preserved
+	* because BOTH sites take the same builder. The `logicalId` FIELD stays raw —
+	* it is the routing key and the `--resource <id>=` argument.
 	*
 	* `key` is never masked before interpolation because it is not template text:
 	* it comes from the fixed key lists `cfnRefValueFromPhysicalId` passes
@@ -27773,7 +28014,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			kind: "ref-state-key",
 			logicalId,
 			key,
-			display: `Ref ${logicalId} (state key ${key})`
+			display: `Ref ${this.displayMasked(logicalId, context)} (state key ${key})`
 		});
 	}
 	/**
@@ -27815,7 +28056,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const [rawLogicalId, rawAttributeName] = getAtt;
 			logicalId = rawLogicalId;
 			const resolvedAttributeName = await this.resolveValue(rawAttributeName, context);
-			if (typeof resolvedAttributeName !== "string") throw new Error(`Fn::GetAtt attribute name for ${logicalId} must resolve to a string, got ${typeof resolvedAttributeName}: ${stringifyValue(this.maskValueLeaves(resolvedAttributeName, context))}`);
+			if (typeof resolvedAttributeName !== "string") throw new Error(`Fn::GetAtt attribute name for ${this.displayMasked(logicalId, context)} must resolve to a string, got ${typeof resolvedAttributeName}: ${stringifyValue(this.maskValueLeaves(resolvedAttributeName, context))}`);
 			attributeName = resolvedAttributeName;
 		} else {
 			const split = splitGetAttStringForm(getAtt);
@@ -27824,7 +28065,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			attributeName = split.attributeName;
 		}
 		const resource = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
-		if (!resource) throw markNonRetryable(/* @__PURE__ */ new Error(`Resource ${logicalId} not found for Fn::GetAtt`));
+		if (!resource) throw markNonRetryable(/* @__PURE__ */ new Error(`Resource ${this.displayMasked(logicalId, context)} not found for Fn::GetAtt`));
 		if (!(resource.resourceType === "AWS::EC2::VPC" && attributeName === "Ipv6CidrBlocks") && resource.attributes !== void 0) {
 			const storedValue = Object.hasOwn(resource.attributes, attributeName) ? resource.attributes[attributeName] : void 0;
 			const flatValue = isImpossibleEmptyStoredAttribute(resource.resourceType, attributeName, storedValue) ? void 0 : storedValue;
@@ -27832,10 +28073,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				this.rejectPlaceholderArnAttribute(resource, attributeName, flatValue, logicalId, context);
 				if (resource.resourceType === "AWS::Route53::HostedZone" && attributeName === "NameServers" && typeof flatValue === "string") {
 					const nameServers = flatValue === "" ? [] : flatValue.split(",");
-					this.logger.debug(`Normalized legacy Fn::GetAtt attribute: ${logicalId}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(nameServers, context)), context)}`);
+					this.logger.debug(`Normalized legacy Fn::GetAtt attribute: ${this.displayMasked(logicalId, context)}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(nameServers, context)), context)}`);
 					return this.noteAttributeSecrecy(logicalId, attributeName, nameServers, context);
 				}
-				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(flatValue, context)), context)}`);
+				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${this.displayMasked(logicalId, context)}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(flatValue, context)), context)}`);
 				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${this.displayLeaf(attributeName, context)}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 				return this.noteAttributeSecrecy(logicalId, attributeName, flatValue, context);
 			}
@@ -27848,7 +28089,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					break;
 				}
 				if (cursor !== void 0) {
-					this.logger.debug(`Resolved Fn::GetAtt from nested attributes: ${logicalId}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(cursor, context)), context)}`);
+					this.logger.debug(`Resolved Fn::GetAtt from nested attributes: ${this.displayMasked(logicalId, context)}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(cursor, context)), context)}`);
 					return this.noteAttributeSecrecy(logicalId, attributeName, cursor, context);
 				}
 			}
@@ -27856,10 +28097,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)) {
 			const declared = Object.keys(resource.attributes ?? {}).filter((k) => k.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)).sort().map((k) => this.displayMasked(this.outputNameLogText(k, context), context));
 			const declaredText = declared.length > 0 ? declared.join(", ") : "(none)";
-			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.displayMasked(attributeName, context)}]: the nested stack '${logicalId}' declares no output named '${this.displayMasked(this.outputNameLogText(attributeName, context), context)}'. Its outputs are ${this.displayMasked(declaredText, context)}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
+			const loggedLogicalId = this.displayMasked(logicalId, context);
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${loggedLogicalId}, ${this.displayMasked(attributeName, context)}]: the nested stack '${loggedLogicalId}' declares no output named '${this.displayMasked(this.outputNameLogText(attributeName, context), context)}'. Its outputs are ${this.displayMasked(declaredText, context)}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
 		}
 		const value = await this.constructGuardedAttribute(resource, attributeName, context, logicalId);
-		this.logger.debug(`Resolved Fn::GetAtt: ${logicalId}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(value, context)), context)}`);
+		this.logger.debug(`Resolved Fn::GetAtt: ${this.displayMasked(logicalId, context)}.${this.displayMasked(attributeName, context)} -> ${this.displayMasked(stringifyAttributeForLog(attributeName, this.maskValueLeaves(value, context)), context)}`);
 		return value;
 	}
 	/**
@@ -27915,7 +28157,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				kind: "attribute",
 				logicalId,
 				key: maskedAttributeName,
-				display: `${logicalId}.${maskedAttributeName}`
+				display: `${this.displayMasked(logicalId, context)}.${maskedAttributeName}`
 			});
 		}
 		return value;
@@ -27952,7 +28194,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	rejectPlaceholderArnAttribute(resource, attributeName, value, logicalId, context) {
 		if (!REF_RETURNS_ARN_FROM_STATE.get(resource.resourceType)?.includes(attributeName)) return;
 		if (typeof value !== "string" || !isPlaceholderArn(value)) return;
-		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: the recorded value "${stringifyValue(this.maskValueLeaves(value, context))}" is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. Deploy the stack again so the resource's next update heals the record (cdkd now records the real ARN), or re-import the resource.`));
+		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: the recorded value "${stringifyValue(this.maskValueLeaves(value, context))}" is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. Deploy the stack again so the resource's next update heals the record (cdkd now records the real ARN), or re-import the resource.`));
 	}
 	/**
 	* Construct resource attribute value based on resource type, refusing to
@@ -27997,7 +28239,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async constructGuardedAttribute(resource, attributeName, context, logicalId) {
 		const accountInfo = await getAccountInfo(this.resolverRegion);
 		const value = await this.constructAttribute(resource, attributeName, context, logicalId, accountInfo);
-		if (accountInfo.fabricated && embedsAccountId(value, accountInfo.accountId)) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: STS did not report this deploy's account id, so cdkd would build the value from the placeholder account ${accountInfo.accountId} — structurally valid, naming a different account, and indistinguishable downstream from a real one. Fix the AWS credentials (or set AWS_ACCOUNT_ID to this deploy's account) and deploy again.`);
+		if (accountInfo.fabricated && embedsAccountId(value, accountInfo.accountId)) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resource.resourceType}: STS did not report this deploy's account id, so cdkd would build the value from the placeholder account ${accountInfo.accountId} — structurally valid, naming a different account, and indistinguishable downstream from a real one. Fix the AWS credentials (or set AWS_ACCOUNT_ID to this deploy's account) and deploy again.`);
 		return value;
 	}
 	/**
@@ -28059,7 +28301,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				return [];
 			}
 			case "DefaultSecurityGroup": {
-				if (!/^vpc-[0-9a-f]+$/.test(physicalId)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, DefaultSecurityGroup] for AWS::EC2::VPC: the state record's physical id "${this.displayMasked(physicalId, context).slice(0, 64)}" is not a VPC id (vpc-<hex>), so cdkd will not use it as an EC2 filter value. Repair the record (cdkd import, or re-create the VPC) and deploy again.`));
+				if (!/^vpc-[0-9a-f]+$/.test(physicalId)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, DefaultSecurityGroup] for AWS::EC2::VPC: the state record's physical id "${this.displayMasked(physicalId, context).slice(0, 64)}" is not a VPC id (vpc-<hex>), so cdkd will not use it as an EC2 filter value. Repair the record (cdkd import, or re-create the VPC) and deploy again.`));
 				const cachedGroupId = cachedVpcDefaultSecurityGroups[physicalId];
 				if (cachedGroupId !== void 0) return cachedGroupId;
 				let groupId;
@@ -28274,7 +28516,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (resourceType === "AWS::EC2::SecurityGroup") switch (attributeName) {
 			case "GroupId": return physicalId;
 			case "VpcId": {
-				if (!/^sg-[0-9a-f]+$/.test(physicalId)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, VpcId] for AWS::EC2::SecurityGroup: the state record's physical id "${this.displayMasked(physicalId, context).slice(0, 64)}" is not a security group id (sg-<hex>), so cdkd will not look it up. Repair the record (cdkd import, or re-create the security group) and deploy again.`));
+				if (!/^sg-[0-9a-f]+$/.test(physicalId)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, VpcId] for AWS::EC2::SecurityGroup: the state record's physical id "${this.displayMasked(physicalId, context).slice(0, 64)}" is not a security group id (sg-<hex>), so cdkd will not look it up. Repair the record (cdkd import, or re-create the security group) and deploy again.`));
 				const cachedVpcId = cachedSecurityGroupVpcIds[physicalId];
 				if (cachedVpcId !== void 0) return cachedVpcId;
 				let vpcId;
@@ -28391,7 +28633,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (resourceType === "AWS::CloudFront::Distribution") switch (attributeName) {
 			case "Id": return physicalId;
 			case "DomainName": {
-				if (!/^[A-Z0-9]+$/.test(physicalId)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, DomainName] for AWS::CloudFront::Distribution: the state record's physical id "${this.displayMasked(physicalId, context).slice(0, 64)}" is not a distribution id (upper-case alphanumerics), so cdkd will not look it up. Repair the record (cdkd import, or re-create the distribution) and deploy again.`));
+				if (!/^[A-Z0-9]+$/.test(physicalId)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, DomainName] for AWS::CloudFront::Distribution: the state record's physical id "${this.displayMasked(physicalId, context).slice(0, 64)}" is not a distribution id (upper-case alphanumerics), so cdkd will not look it up. Repair the record (cdkd import, or re-create the distribution) and deploy again.`));
 				const cachedDomainName = cachedCloudFrontDomainNames[physicalId];
 				if (cachedDomainName !== void 0) return cachedDomainName;
 				let domainName;
@@ -28425,7 +28667,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::RDS::DBProxy" || resourceType === "AWS::RDS::DBProxyEndpoint") {
-			if (attributeName === "VpcId") throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: the state record holds no VpcId for it (the read-back that would have recorded it reported none), and the physical id "${this.displayMasked(physicalId, context)}" is a name, not a VPC id, so cdkd refuses to substitute it. Update the resource so its next deploy records the value, or reference the VPC directly.`));
+			if (attributeName === "VpcId") throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: the state record holds no VpcId for it (the read-back that would have recorded it reported none), and the physical id "${this.displayMasked(physicalId, context)}" is a name, not a VPC id, so cdkd refuses to substitute it. Update the resource so its next deploy records the value, or reference the VPC directly.`));
 			return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
@@ -28484,7 +28726,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*/
 	refuseUnservedAttribute(site) {
 		const { logicalId, attributeName, resourceType, physicalId, context, observed, remedy } = site;
-		throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: ${observed}. The physical id "${this.displayMasked(physicalId, context)}" is not a usable ${this.displayMasked(attributeName, context)}, so cdkd refuses to substitute it. ${remedy}`);
+		throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: ${observed}. The physical id "${this.displayMasked(physicalId, context)}" is not a usable ${this.displayMasked(attributeName, context)}, so cdkd refuses to substitute it. ${remedy}`);
 	}
 	/**
 	* The `observed` clause of {@link refuseUnservedAttribute} for a live read
@@ -28531,9 +28773,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const expectsUrlShape = attributeName.endsWith("Url") && !/^https?:\/\//.test(physicalId);
 		if (expectsArnShape || expectsUrlShape) {
 			const expectedShape = expectsArnShape ? "an ARN (arn:...)" : "a URL (http(s)://...)";
-			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and the physical ID fallback "${this.displayMasked(physicalId, context)}" is not ${expectedShape}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.displayMasked(attributeName, context)}.`));
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and the physical ID fallback "${this.displayMasked(physicalId, context)}" is not ${expectedShape}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.displayMasked(attributeName, context)}.`));
 		}
-		if (this.strictGetAtt) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and --strict-getatt rejects the physical ID fallback "${this.displayMasked(physicalId, context)}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning, avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.displayMasked(attributeName, context)}.`));
+		if (this.strictGetAtt) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${this.displayMasked(logicalId, context)}, ${this.displayMasked(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and --strict-getatt rejects the physical ID fallback "${this.displayMasked(physicalId, context)}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning, avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.displayMasked(attributeName, context)}.`));
 		this.physicalIdFallbackCount++;
 		this.logger.warn(`Unknown attribute ${this.displayMasked(attributeName, context)} for resource type ${resourceType}, returning physical ID`);
 		return physicalId;
@@ -29009,7 +29251,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const resolvedValue = await this.resolveValue(value, context);
 		if (typeof resolvedValue !== "string") {
 			const source = this.describeSplitValueSource(value);
-			const sourceClause = source ? ` (from ${source.label})` : "";
+			const sourceClause = source ? ` (from ${this.displayMasked(source.label, context)})` : "";
 			if (Array.isArray(resolvedValue)) {
 				const remedy = source?.kind === "ref" ? "A list-typed parameter — any List<...> type (List<AWS::EC2::Subnet::Id>, List<Number>, …) or CommaDelimitedList — is already a list." : source?.kind === "getatt" ? "A list-valued Fn::GetAtt (for example AWS::Route53::HostedZone.NameServers or AWS::EC2::VPC.Ipv6CidrBlocks) already returns a list. If you wrote the Fn::Split as a workaround for cdkd resolving that attribute to a comma-delimited string, that bug is fixed (PR #1868) and the workaround is no longer needed." : "Several intrinsics already return a list — among them a list-valued Fn::GetAtt, a Ref to a list-typed parameter (any List<...> type or CommaDelimitedList), Fn::GetAZs, Fn::Cidr, and Fn::Split itself.";
 				throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Split: the value to split${sourceClause} is ALREADY a list (an array of ${resolvedValue.length} item${resolvedValue.length === 1 ? "" : "s"}), not a string. CloudFormation rejects Fn::Split over a list too, so this template is not valid CloudFormation either. Remove the Fn::Split and use the value directly. ${remedy}`));
@@ -29030,12 +29272,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async resolveIf(ifArgs, context) {
 		const [conditionName, valueIfTrue, valueIfFalse] = ifArgs;
 		if (!context.conditions || !Object.hasOwn(context.conditions, conditionName)) {
-			this.logger.warn(`Condition ${conditionName} not found in context, assuming false`);
+			this.logger.warn(`Condition ${this.displayMasked(String(conditionName), context)} not found in context, assuming false`);
 			return await this.resolveValue(valueIfFalse, context);
 		}
 		const conditionValue = context.conditions[conditionName];
 		const selectedValue = conditionValue ? valueIfTrue : valueIfFalse;
-		this.logger.debug(`Resolved Fn::If: condition ${conditionName} = ${conditionValue}, selected ${conditionValue ? "true" : "false"} branch`);
+		this.logger.debug(`Resolved Fn::If: condition ${this.displayMasked(String(conditionName), context)} = ${conditionValue}, selected ${conditionValue ? "true" : "false"} branch`);
 		return await this.resolveValue(selectedValue, context);
 	}
 	/**
@@ -29066,7 +29308,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async resolveConditionReference(conditionName, context) {
 		if (context.conditionResolver) return await context.conditionResolver(conditionName);
 		if (context.conditions && Object.hasOwn(context.conditions, conditionName)) return context.conditions[conditionName];
-		this.logger.warn(`Condition ${conditionName} not found in context, assuming false`);
+		this.logger.warn(`Condition ${this.displayMasked(conditionName, context)} not found in context, assuming false`);
 		return false;
 	}
 	/**
@@ -30003,11 +30245,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*
 	* Reachable from ONE place, {@link maskThenStripThenMask}, which is itself
 	* reachable only from {@link displayMasked}. That containment is the whole
-	* mechanism and it is enforced, not conventional:
-	* `scripts/check-resolver-mask-coverage.ts` does not list this method in
-	* `MASKERS`, so its AST walk — which RESOLVES an interpolated identifier to
-	* its declaration — reports any render that reaches it, through a binding or
-	* directly. Do not add it to that list, and do not call it from a new site.
+	* mechanism. It used to be enforced by an AST walk that resolved an
+	* interpolated identifier to its declaration; go-to-k/cdkd#3435 deleted that
+	* checker, and what holds the containment now is
+	* `tests/unit/deployment/resolver-display-masked-population.test.ts`, which
+	* asserts the exact reference COUNTS from the AST (one caller each) and
+	* refuses a direct `${this.<raw masker>(...)}` interpolation by line rule.
+	* Do not call this from a new site: a binding of it interpolated LATER is
+	* the shape neither survivor can see.
 	*
 	* ## What the masking itself does
 	*
@@ -30102,7 +30347,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* with the twin's positions, so the line gives both up for `***`: never
 	* more text than either mask alone would print. Returns the text BEFORE the
 	* needle mask; each log line wraps it in `displayMasked` itself, so the
-	* resolver's mask-coverage checker sees a masker at the site.
+	* sanitization happens at the render rather than here.
 	*/
 	logTwinText(result, twin, context) {
 		return twin !== result && this.maskNeedlesForLog(result, context) !== result ? "***" : twin;
@@ -30450,9 +30695,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* ONE CALLER, {@link displayMasked}, since go-to-k/cdkd#3426. It is most of
 	* the answer and reads like all of it — it omits `displaySafe`, and
 	* therefore `U+2028` / `U+2029` and the bidi overrides — so a site reaching
-	* for it directly is the near-miss back onto the treadmill. It is not in
-	* `MASKERS` in `scripts/check-resolver-mask-coverage.ts`, so a render that
-	* reaches it (through a binding or directly) is reported there.
+	* for it directly is the near-miss back onto the treadmill. A DIRECT
+	* `${this.maskThenStripThenMask(...)}` interpolation is refused by
+	* `resolver-display-masked-population.test.ts`'s line rule; a BINDING of it
+	* rendered later is not seen by anything since go-to-k/cdkd#3435 deleted the
+	* AST checker, which is why the one-caller containment above is the control
+	* that matters.
 	*
 	* THE BOUND, since this file's job is to state them: this covers a needle
 	* split by a character `stripControlChars` removes. A needle split by
@@ -30500,15 +30748,19 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*
 	* ## What keeps it closed
 	*
-	* `scripts/check-resolver-mask-coverage.ts` — an AST walk that already
-	* RESOLVES an interpolated identifier to its declaration and judges the
-	* initializer. Its `MASKERS` list names the functions a render may reach,
-	* and since go-to-k/cdkd#3426 every entry on it SANITIZES as well as masks.
-	* So a binding of a raw masker is a finding wherever it is later
-	* interpolated, by the same mechanism that already answered the secret
-	* question — no second scanner, and nothing line-shaped.
-	* `tests/unit/deployment/resolver-display-masked-population.test.ts` pins the
-	* population and the builder bodies beside it.
+	* `tests/unit/deployment/resolver-display-masked-population.test.ts`, which
+	* asserts from the AST that `maskSecretsRaw` is referenced only inside
+	* `maskThenStripThenMask` and that helper only inside this builder — exact
+	* reference counts, no inference — and refuses a direct
+	* `${this.<raw masker>(...)}` interpolation by line rule.
+	*
+	* An AST walk that ALSO resolved an interpolated identifier to its
+	* declaration used to cover the BINDING shape. go-to-k/cdkd#3435 deleted it
+	* as high-maintenance tooling (23 commits across it and its suite in nine
+	* days; a widening attempted one PR earlier produced nine defects inside
+	* itself and was withdrawn), so that shape is now held by the containment
+	* above — there is no bare masker to bind, because nothing outside this
+	* builder may call one.
 	*
 	* KNOWN BOUND, stated rather than implied away: a site carrying an
 	* exclusion marker is exempt from that walk, because the marker answers the
@@ -30533,9 +30785,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* Trojan-Source bidi overrides. That composition is what the `physicalId`
 	* renders here already spelled by hand; this names it, and they now share it.
 	*
-	* It is listed in `MASKERS` in `scripts/check-resolver-mask-coverage.ts`,
-	* which is a SECURITY decision and a sound one: every path through it passes
-	* the needle-and-twin mask, twice, so it is strictly stronger than the bare
+	* It is the ONE sanctioned exit from the masking machinery, which is a
+	* SECURITY decision and a sound one: every path through it passes the
+	* needle-and-twin mask, twice, so it is strictly stronger than the bare
 	* masker it replaced and cannot be weaker at any input.
 	*/
 	displayMasked(value, context) {
@@ -32635,7 +32887,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DNzgk-BS.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BuEvX2d9.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -43271,11 +43523,38 @@ var DeployEngine = class DeployEngine {
 		* cdkd never EXECUTES this string — it is advice in an error message — so
 		* this is about the pasted command being correct, not about injection into
 		* cdkd itself (issue #2847 round-5 review).
+		*
+		* SINCE go-to-k/cdkd#3435 no id reaching this arm can contain a `'`:
+		* `isPasteableIdent` admits `[A-Za-z0-9][A-Za-z0-9~_.-]*` only, and the
+		* command is not emitted for anything else. Kept anyway rather than
+		* deleted — dropping a guard on the strength of a NEW guard one line up is
+		* how the pair later comes apart, and this one costs a `replaceAll` on a
+		* short string.
 		*/
 		const quoteSafe = (id) => id.replaceAll("'", `'\\''`);
+		/**
+		* A logical id rendered as a NAME rather than as a command argument
+		* (go-to-k/cdkd#3435 security round).
+		*
+		* Every sentence below is joined into a `ProvisioningError` message that
+		* `handleError` prints at DEFAULT verbosity, and neither `formatError` nor
+		* the logger sanitizes `error.message` — they cover a `cause` and the extra
+		* ARGS respectively. So a `Resources` KEY carrying `ESC[2K` + CR reached the
+		* terminal raw, which is the same class this PR closed at 18 resolver
+		* renders and missed one module out.
+		*/
+		const shown = (id) => displayIdent(id);
+		/** CloudFormation's own logical-id length bound. */
+		const CFN_LOGICAL_ID_MAX_LENGTH = 255;
 		const parts = [];
-		if (localTargets.length > 0) parts.push(`Re-import the record that HOLDS the mask: ` + localTargets.map((id) => `'cdkd import <stack> --resource ${quoteSafe(id)}=<physicalId> --force'`).join(", ") + `.`);
-		if (unclearableTargets.length > 0) parts.push(`Do NOT re-import ${unclearableTargets.join(", ")}: a custom resource's import records no attributes, so the masked bag is carried forward unchanged and the refusal repeats. Cause (1) above is the one that applies to it.`);
+		if (localTargets.length > 0) {
+			const pasteableHere = (id) => isPasteableIdent(id) && id.length <= CFN_LOGICAL_ID_MAX_LENGTH;
+			const pasteable = localTargets.filter(pasteableHere);
+			const withheld = localTargets.filter((id) => !pasteableHere(id));
+			if (pasteable.length > 0) parts.push(`Re-import the record that HOLDS the mask: ` + pasteable.map((id) => `'cdkd import <stack> --resource ${quoteSafe(id)}=<physicalId> --force'`).join(", ") + `.`);
+			if (withheld.length > 0) parts.push(`Re-import the record that HOLDS the mask for ${withheld.map(shown).join(", ")}, but the command is withheld: that is not a plain CloudFormation logical id, so a pasted 'cdkd import <stack> --resource <id>=<physicalId> --force' could be reshaped by the shell or name a different resource. Read the id from 'cdkd state show' and quote it yourself.`);
+		}
+		if (unclearableTargets.length > 0) parts.push(`Do NOT re-import ${unclearableTargets.map(shown).join(", ")}: a custom resource's import records no attributes, so the masked bag is carried forward unchanged and the refusal repeats. Cause (1) above is the one that applies to it.`);
 		if (foreignReads.length > 0) {
 			const subject = reads.length === 1 ? "The read above resolves" : foreignReads.length === 1 ? "One of the reads above resolves" : "Some of the reads above resolve";
 			parts.push(`${subject} through ANOTHER stack (an Fn::ImportValue, an Fn::GetStackOutput, or a nested stack's Outputs), whose masked record lives in that stack's state — re-importing anything in this stack cannot clear it; act on the producer stack instead.`);
@@ -45702,4 +45981,4 @@ var DeployEngine = class DeployEngine {
 
 //#endregion
 export { secretBearing as $, SynthesisError as $i, recordMaskOnlyValue as $n, AssetManifestLoader as $r, s3BucketArn as $t, extractDeploymentEventError as A, getAwsClients as Ai, refuseMalformedState as An, BOOTSTRAP_MARKER_PREFIX as Ar, isImpossibleEmptyStoredAttribute as At, toCfnInteger as B, IntrinsicResolutionRefusalError as Bi, STATE_SOURCED_BASELINE_RULES as Bn, buildDockerImage as Br, coerceCfnBoolean as Bt, buildFinalSnapshotIdentifier as C, canonicalizeRegion as Ci, producerRecordKey as Cn, stringifyValue as Cr, isTerminationProtectionPropagationError as Ct, refusesFinalSnapshot as D, clearBucketRegionCache as Di, refuseMalformedOutputsForDestroy as Dn, loadPublishableAssetManifest as Dr, cfnRefValueFromPhysicalId as Dt, isFinalSnapshotError as E, processStackMessages as Ei, refuseMalformedOutputs as En, createAssetRedirectResolver as Er, carriesFetchableDynamicReference as Et, isStatefulRecreateTargetSync as F, ConfigError as Fi, findSilentDropProperties as Fn, parseBootstrapMarker as Fr, isSettledInstanceState as Ft, gray as G, NestedStackChildDirectDestroyError as Gi, createSecretMasker as Gn, formatDockerLoginError as Gr, readConfigString as Gt, formatResourceLine as H, LocalStartServiceError as Hi, STATE_SOURCED_READBACK_RULES as Hn, describeDockerExecFailure as Hr, configBooleanRefusal as Ht, renderStatefulReason as I, CrossAccountSecretRefusalError as Ii, describeTypeWithThrottleRetry as In, readBootstrapMarkerBody as Ir, WAFv2WebACLProvider as It, yellow as J, ResourceTimeoutError as Ji, identityKeyFor as Jn, redactDockerArgvValues as Jr, requireConfigObject as Jt, green as K, PartialFailureError as Ki, dynamicReferenceTokens as Kn, getDockerCmd as Kr, replayWarn as Kt, WARM_THROUGHPUT_MEMBERS as L, DependencyError as Li, withRetry as Ln, validateAssetBucketName as Lr, normalizeAwsTagsToCfn as Lt, planOrphanAdoption as M, setAwsClients as Mi, repairMalformedResourcePropertiesForReadOnly as Mn, ensureAssetStorage as Mr, isUnboundTemplateParameter as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, AssetError as Ni, repairMalformedResourcesForReadOnly as Nn, getBootstrapMarkerKey as Nr, parameterTypeMayLoseSecretIdentity as Nt, unsupportedFinalSnapshotError as O, resolveBucketRegion as Oi, refuseMalformedResourcePropertiesForOrphan as On, rewriteTemplateAssetReferences as Or, coerceParameterTypedValue as Ot, isStatefulRecreateTargetForReplace as P, CdkdError as Pi, findActionableSilentDrops as Pn, isCrossRegionRedirect as Pr, refStateLookupFromResource as Pt, isExportAliasCollision as Q, StateError as Qi, maskSecretsInText as Qn, stripControlChars as Qr, withSharedDrainBudget as Qt, coerceWarmThroughput as R, DeployCancelledError as Ri, DagBuilder as Rn, validateContainerRepoName as Rr, resolveExplicitPhysicalId as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, PARTITION_TABLE as Si, malformedStateRefusalMessage as Sn, AssetPublisher as Sr, disableInstanceApiTermination as St, createPreDeleteFinalSnapshot as T, AssemblyReader as Ti, refuseMalformedNestedChildOutputs as Tn, buildAssetRedirectMap as Tr, carriesDynamicReference as Tt, bold as U, LockError as Ui, TEMPLATE_SOURCED_RULES as Un, describeDockerFailure as Ur, configIntegerRefusal as Ut, toFiniteNumber as V, LocalInvokeBuildError as Vi, STATE_SOURCED_CROSS_GENERATION_RULES as Vn, describeDockerCapturedOutput as Vr, coerceCfnInteger as Vt, cyan as W, MalformedProducerRecordRefusalError as Wi, carriesSecretMask as Wn, dockerSpawnEnvWithSensitive as Wr, configStringRefusal as Wt, collectPublishedOutputNames as X, StackHasActiveImportsError as Xi, markSameGenerationBag as Xn, runDockerStreaming as Xr, classifyReplaySecretRegion as Xt, collectDeclaredOutputNames as Y, ResourceUpdateNotSupportedError as Yi, isSingleDynamicReferenceToken as Yn, runDockerForeground as Yr, requireConfigString as Yt, exportAliasCollisionScrubWarning as Z, StackTerminationProtectionError as Zi, maskSecretsInError as Zn, escapeRegExp$1 as Zr, producerRegionsFromState as Zt, isSecretBearingReferenceString as _, findLargeInlineResources as _i, malformedOutputsRefusalMessage as _n, importableOutputs as _r, isWaitAbandonedError as _t, DeploymentEventsStore as a, isRetryableTransientError as aa, resolveApp as ai, AWS_CREDENTIAL_ENV_KEYS as an, rebuildClientForBucketRegion as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, decodeListingKey as bi, malformedResourcePropertiesWarning as bn, orphansCarriedFrom as br, deleteIndeterminateGuards as bt, replayFailedOperations as c, markNonRetryable as ca, resolveSkipPrefix as ci, envCredentialsAreAssumedRole as cn, buildLockContentionMessage as cr, createMaskedRetryLogger as ct, updatePartialReason as d, describeAwsFailure as da, resolveUseCdkBootstrapAssets as di, STATE_RESOURCES_MALFORMED as dn, shellQuote as dr, beginCommandInterruptScope as dt, formatError as ea, getDockerImageBySourceHash as ei, s3BucketDomainName as en, recoverMaskedOutput as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, safeStringify$1 as fa, stateBucketExistenceConfirmed as fi, hasReadableOutputs as fn, CUSTOM_RESOURCE_RESPONSE_PREFIX as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, MIGRATE_TMP_PREFIX as gi, malformedLocalOutputsWarning as gn, importableOutputKeys as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, CFN_TEMPLATE_URL_LIMIT as hi, malformedExportSourceWarning as hn, hasReadableExportSet as hr, startInterruptWatch as ht, DeploymentEventsReader as i, isMarkedNonRetryable as ia, getLegacyStateBucketName as ii, applyRoleArnIfSet as in, S3StateBackend as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, resetAwsClients as ji, repairMalformedOutputsForReadOnly as jn, assertAssetBucketRegion as jr, isNamelessDynamicReferenceError as jt, makeCanonicalizePropertiesFn as k, AwsClients as ki, refuseMalformedResourcesForDestroy as kn, AssetModeResolver as kr, getAccountInfo as kt, replayRollback as l, markRedactedCause as la, resolveStateBucketWithDefault as li, DiffCalculator as ln, forceQuitRecoveryClause as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, CFN_TEMPLATE_BODY_LIMIT as mi, malformedExportNamesWarning as mn, exportNamesCarriedFrom as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, normalizeAwsError as na, synthesisStatusMessage as ni, s3BucketRegionalDomainName as nn, scrubResourceRecord as nr, getCurrentResourceSecrets as nt, planFailedOps as o, isThrottlingError as oa, resolveAutoAssetStorage as oi, applyCallerIdentityCredentials as on, UNREPRODUCIBLE_LOCK_CLAUSE as or, ProviderRegistry as ot, maskingRetryLogger as p, __exportAll as pa, warnDeprecatedNoPrefixCliFlag as pi, hasReadableResources as pn, DEFAULT_STATE_PREFIX as pr, interruptWatchListenerCount as pt, red as q, ProvisioningError as qi, errorCauseChain as qn, partitionSensitiveEnv as qr, requireConfigArray as qt, DeployEngine as r, withErrorHandling as ra, getDefaultStateBucketName as ri, s3BucketWebsiteUrl as rn, LockManager as rr, IAMRoleProvider as rt, planRollback as s, isTransientServerError as sa, resolveCaptureObservedState as si, callerEnvCredentials as sn, buildForceUnlockCommand as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, isCdkdError as ta, Synthesizer as ti, s3BucketDualStackDomainName as tn, redactSecretsForState as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, retryClassificationText as ua, resolveStateBucketWithDefaultAndSource as ui, INTRINSIC_KEYS as un, formatLockExpiry as ur, maskerOrIdentity as ut, keptWholeReasonText as v, uploadCfnTemplate as vi, malformedOutputsWarning as vn, isReadableBag as vr, slowCcOperationTimeoutMs as vt, ccRoutedFinalSnapshotError as w, derivePartitionAndUrlSuffix as wi, refuseDivergentRecordRegionForDestroy as wn, WorkGraph as wr, IntrinsicFunctionResolver as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, expectedOwnerParam as xi, malformedResourcesWarning as xn, shouldRetainResource as xr, deleteSkipReason as xt, mergeNoChangeOutputs as y, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as yi, malformedRenderedContainersWarning as yn, orphansAfterRollback as yr, UNSPECIFIED_SKIP_REASON as yt, isWarmThroughputDecrease as z, DynamicReferenceRegionAmbiguousError as zi, TemplateParser as zn, buildDenyExternalAccessPolicy as zr, assertRegionMatch as zt };
-//# sourceMappingURL=deploy-engine-21iNqwR3.js.map
+//# sourceMappingURL=deploy-engine-CfOsVRQB.js.map