@go-to-k/cdkd 0.290.4 → 0.290.6

package/dist/{deploy-engine-DD7JE_Ic.js → deploy-engine-BU7n9_qY.js}

@@ -1,6 +1,6 @@
 import { b as displayIdent, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, x as displaySafe, y as UNRENDERABLE } from "./logger-th1myfgh.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BUcQz4SU.js";
+import { t as getCdkdVersion } from "./version-BvSdNpMz.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7218,6 +7218,94 @@ function describeDockerFailure(error, args) {
 	return redactDockerArgvInText(capturedStreamText(error, "stderr") || thrownMessageText(error) || safeStringify(error), args);
 }
 /**
+* A `cause` that is safe to CHAIN onto a wrapper error, for a caller that
+* wants the retry classifiers to see the failure as an object rather than as
+* an interpolated string (issue go-to-k/cdkd#2075).
+*
+* Attaching the raw `execFile` error reopens the channel go-to-k/cdkd#2440
+* closed. The mandate above applies to every docker failure text this module
+* hands out, "including one whose argv carries no user data today" — and a
+* chained cause IS such a text: `formatError` prints `cause.message`, and the
+* CLI's top-level handler walks the whole chain. The raw message is the
+* command line, so the moment an argv gains a `-e` or a `--build-arg` the
+* secret is in a printed line again, from a call site nobody re-reads.
+*
+* So the returned cause carries the REDACTED description as its message, and
+* chains nothing further. What the classifiers read is copied across — but
+* through an ALLOWLIST ({@link CLASSIFICATION_FIELDS}), never by sweeping the
+* original's own keys.
+*
+* The allowlist is the whole point, and a denylist was the first cut: it
+* skipped `message` / `stack` / `cause` and copied the rest, which carried
+* `err.cmd` — the full command line — onto the new error verbatim. That is
+* the SAME field that defeated four rounds of the go-to-k/cdkd#2440 fence
+* (`.claude/rules/docker-argv-redaction.md`), reintroduced inside the function
+* written to close it. `stderr` / `stdout` are excluded for the same reason:
+* the composer above has already read and REDACTED them into the message, so
+* copying the raw streams would hand back exactly what it removed.
+*
+* Fail-closed is the correct direction here for the reason the cache-param
+* allowlist gives: a field missing from the allowlist costs one degraded retry
+* classification, while a field missing from a denylist costs a printed
+* credential.
+*/
+/**
+* The fields {@link redactedDockerCause} carries from the original error onto
+* the redacted one.
+*
+* WHAT EACH HALF IS FOR, stated precisely because an earlier revision of this
+* comment got it wrong in a way that reads as more than it is. The AWS-shaped
+* entries (`$metadata`, `$fault`, `__type`, `code`, `statusCode`) are what
+* `isThrottlingError` / `isTransientServerError` /
+* `describeRetryClassificationSignals` actually consult, and they are reachable
+* here only when an SDK error is the cause -- the ECR-login path, whose
+* `GetAuthorizationToken` failure can be one.
+*
+* `exitCode` is NOT read by any classifier. It is carried because it is the
+* ONLY field the DOMINANT failure has: these four sites reject through
+* `spawnStreaming`, whose `SpawnError` sets `stderr` / `stdout` / `exitCode`
+* and nothing else, so without it a non-zero docker exit produced a cause with
+* a name and a message and no other content at all. What that buys is the
+* DIAGNOSTIC -- `cli/index.ts` renders the chain's own enumerable props -- not
+* a retry decision. Do not restate it as a classification field.
+*
+* `stderr` / `stdout` stay OFF: the composer has already read and REDACTED
+* them into the message, so copying the raw streams would hand back exactly
+* what it removed.
+*/
+const CLASSIFICATION_FIELDS = [
+	"exitCode",
+	"code",
+	"errno",
+	"signal",
+	"status",
+	"statusCode",
+	"$metadata",
+	"$fault",
+	"__type"
+];
+function redactedDockerCause(error, args) {
+	if (!(error instanceof Error)) return void 0;
+	const cause = new Error(describeDockerFailure(error, args));
+	try {
+		cause.name = error.name;
+	} catch {}
+	const NON_RETRYABLE_MARKER = Symbol.for("cdkd.nonRetryable");
+	try {
+		if (error[NON_RETRYABLE_MARKER] === true) Object.defineProperty(cause, NON_RETRYABLE_MARKER, {
+			value: true,
+			enumerable: false,
+			configurable: true
+		});
+	} catch {}
+	const source = error;
+	const target = cause;
+	for (const key of CLASSIFICATION_FIELDS) try {
+		if (key in source) target[key] = source[key];
+	} catch {}
+	return cause;
+}
+/**
 * Composer for a captured-output failure where the diagnostic may be on
 * STDOUT rather than stderr (`runDockerStreaming`'s non-zero-exit path, whose
 * `SpawnError` carries both). `fallback` is used when neither stream said
@@ -7474,7 +7562,12 @@ var DockerAssetPublisher = class {
 			try {
 				await this.tagImage(actualTag, tag);
 			} catch (err) {
-				throw new AssetError(`Docker tag failed re-tagging '${actualTag}' → '${tag}': ${err.message ?? String(err)}`);
+				const e = err;
+				throw new AssetError(`Docker tag failed re-tagging '${actualTag}' → '${tag}': ${e.message ?? String(err)}`, e.cause instanceof Error ? e.cause : redactedDockerCause(err, [
+					"tag",
+					actualTag,
+					tag
+				]));
 			}
 		}
 	}
@@ -7549,7 +7642,7 @@ var DockerAssetPublisher = class {
 			await runDockerStreaming(loginArgs, { input: password });
 			loggedInRegistries.add(registryKey);
 		} catch (err) {
-			throw new AssetError(`ECR login failed: ${formatDockerLoginError(describeDockerFailure(err, loginArgs), endpoint)}`);
+			throw new AssetError(`ECR login failed: ${formatDockerLoginError(describeDockerFailure(err, loginArgs), endpoint)}`, redactedDockerCause(err, loginArgs));
 		}
 	}
 	/**
@@ -7564,7 +7657,7 @@ var DockerAssetPublisher = class {
 		try {
 			await runDockerStreaming(tagArgs);
 		} catch (err) {
-			throw new AssetError(`Docker tag failed: ${describeDockerFailure(err, tagArgs)}`);
+			throw new AssetError(`Docker tag failed: ${describeDockerFailure(err, tagArgs)}`, redactedDockerCause(err, tagArgs));
 		}
 	}
 	/**
@@ -7578,7 +7671,7 @@ var DockerAssetPublisher = class {
 		try {
 			await runDockerStreaming(pushArgs);
 		} catch (err) {
-			throw new AssetError(`Docker push failed: ${describeDockerFailure(err, pushArgs)}`);
+			throw new AssetError(`Docker push failed: ${describeDockerFailure(err, pushArgs)}`, redactedDockerCause(err, pushArgs));
 		}
 	}
 	/**
@@ -9164,9 +9257,60 @@ function safeJournalText(value) {
 	return displaySafe(value, { asciiOnly: true }) || "<unrenderable>";
 }
 /**
+* The per-operation shape check (issue #3140). The journal is an unchecked
+* cast beyond `journalVersion` and `segments` being an array, and the
+* executor keys EVERY lookup on `op.logicalId` -- `stateResources[..]`,
+* `orphanLogicalIds.has(..)`, the events it records -- so a non-string id
+* planted in the bucket either coerces at each lookup (`123` finds the
+* record named `'123'`) or throws a raw `TypeError` at the first one (an
+* object whose `toString` is not callable, the issue #2947 shape). Refused
+* HERE, once, so no downstream reader has to remember; the executor keeps its
+* own `typeof` guard on the one pasted command as defense-in-depth, because
+* the deploy engine's in-process rollback reaches it without this parser.
+*
+* Only the fields a lookup or a route is keyed on: `logicalId` (non-empty
+* string), `resourceType` (string), `changeType` (string -- an unknown value
+* lands on the executor's UPDATE arm by design, pinned by a case there), and
+* `physicalId` when present (string). `previousState` and the rest stay as
+* they were; a bad value there fails the op it belongs to, not the parse.
+*
+* The refusal names the INDEX and the TYPE, never the value -- there is
+* nothing to sanitize, so nothing to get wrong.
+*/
+function refuseMalformedOperation(shownStack, where, op) {
+	const fail = (field, value, expected) => refuseMalformed(shownStack, `${where}.${field} must be ${expected} (got ${kind(value)}).`);
+	if (typeof op !== "object" || op === null || Array.isArray(op)) refuseMalformed(shownStack, `${where} must be an object (got ${kind(op)}).`);
+	const o = op;
+	if (typeof o["logicalId"] !== "string" || o["logicalId"].length === 0) fail("logicalId", o["logicalId"], "a non-empty string");
+	if (typeof o["resourceType"] !== "string") fail("resourceType", o["resourceType"], "a string");
+	if (typeof o["changeType"] !== "string") fail("changeType", o["changeType"], "a string");
+	if (o["physicalId"] !== void 0 && typeof o["physicalId"] !== "string") fail("physicalId", o["physicalId"], "a string when present");
+}
+/** The TYPE of a JSON-derived value, for a refusal that must not echo the value. */
+function kind(v) {
+	return v === null ? "null" : Array.isArray(v) ? "array" : typeof v;
+}
+/**
+* The one spelling of a malformed-journal refusal. `detail` is built from
+* indices, field names and `kind()` words only -- never a journal value -- and
+* every refusal names the way out, as `UnknownRollbackJournalVersionError`
+* names `Upgrade cdkd`: the journal is a sibling of `state.json`, so removing
+* that one object discards it (`cdkd destroy` sweeps it as well), and no
+* other stack is affected because `cdkd rollback` never parses another
+* stack's journal. The same text reaches the deploy engine's `Failed to write
+* rollback journal` warning, since appending a segment parses the existing
+* journal first.
+*/
+function refuseMalformed(shownStack, detail) {
+	throw new Error(`Rollback journal for '${shownStack}' is malformed: ${detail} Remove the stack's rollback-journal.json (next to its state.json) to discard it.`);
+}
+/**
 * Parse + validate a journal body. Throws
 * {@link UnknownRollbackJournalVersionError} on a newer version, and a plain
-* Error on a structurally-invalid body.
+* Error on a structurally-invalid body -- including, since issue #3140, a
+* segment that is not an object, an `operations` that is not an array, and an
+* operation whose `logicalId` / `resourceType` / `changeType` / `physicalId`
+* is not the string the executor keys on (see `refuseMalformedOperation`).
 */
 function parseRollbackJournal(bodyString, stackName) {
 	const shownStack = safeJournalText(stackName);
@@ -9186,6 +9330,16 @@ function parseRollbackJournal(bodyString, stackName) {
 	}
 	if (j.journalVersion > 1) throw new UnknownRollbackJournalVersionError(j.journalVersion, stackName);
 	if (!Array.isArray(j.segments)) throw new Error(`Rollback journal for '${shownStack}' is missing a 'segments' array.`);
+	j.segments.forEach((segment, s) => {
+		if (typeof segment !== "object" || segment === null || Array.isArray(segment)) refuseMalformed(shownStack, `segments[${s}] must be an object (got ${kind(segment)}).`);
+		const seg = segment;
+		if (!Array.isArray(seg["operations"])) refuseMalformed(shownStack, `segments[${s}].operations must be an array (got ${kind(seg["operations"])}).`);
+		seg["operations"].forEach((op, i) => refuseMalformedOperation(shownStack, `segments[${s}].operations[${i}]`, op));
+		if (seg["failedOperations"] !== void 0) {
+			if (!Array.isArray(seg["failedOperations"])) refuseMalformed(shownStack, `segments[${s}].failedOperations must be an array when present (got ${kind(seg["failedOperations"])}).`);
+			seg["failedOperations"].forEach((op, i) => refuseMalformedOperation(shownStack, `segments[${s}].failedOperations[${i}]`, op));
+		}
+	});
 	return {
 		journalVersion: j.journalVersion,
 		stackName: j.stackName ?? stackName,
@@ -9618,7 +9772,7 @@ var S3StateBackend = class {
 			}));
 		} catch (error) {
 			const name = error.name;
-			if (name === "NotFound" || name === "NoSuchBucket") throw new StateError(`State bucket '${this.config.bucket}' does not exist. Run 'cdkd bootstrap' to create it, or specify an existing bucket via --state-bucket, CDKD_STATE_BUCKET, or cdk.json context.cdkd.stateBucket.`);
+			if (name === "NotFound" || name === "NoSuchBucket") throw new StateError(`State bucket '${this.config.bucket}' does not exist. Run 'cdkd bootstrap' to create it, or specify an existing bucket via --state-bucket, CDKD_STATE_BUCKET, or cdk.json context.cdkd.stateBucket.`, error instanceof Error ? error : void 0);
 			const normalized = normalizeAwsError(error, {
 				bucket: this.config.bucket,
 				operation: "HeadBucket"
@@ -9750,7 +9904,7 @@ var S3StateBackend = class {
 			}
 			return response.ETag;
 		} catch (error) {
-			if (error.name === "PreconditionFailed") throw new StateError(`State has been modified by another process. Expected ETag: ${expectedEtag}, but state has changed.`);
+			if (error.name === "PreconditionFailed") throw new StateError(`State has been modified by another process. Expected ETag: ${expectedEtag}, but state has changed.`, error instanceof Error ? error : void 0);
 			const normalized = normalizeAwsError(error, {
 				bucket: this.config.bucket,
 				operation: "PutObject"
@@ -13148,7 +13302,11 @@ const UNKNOWN_PART_PLACEHOLDER = "\0";
 * longer equals the leaf's text around the middle, so the arm refuses) -- and,
 * through the frame arm's rewrite, for the nested-stack parameter recorder's
 * `frameSpellingOf`, which carries a framed parameter to the child only when
-* that arm wrote it. The recorder's own rendering of such a part does not
+* the position pass rewrote it -- which, on a value the recorder's gate (ii)
+* finds the scan silent on, only the frame arm can do (the value scan, the
+* skeleton arm and the cross-stack arm each rewrite an object-sourced leaf
+* whose WHOLE value is a recorded plaintext, and (ii) is what refuses that
+* value). The recorder's own rendering of such a part does not
 * decide the case: a part outside the token leaves its one span and service
 * prefix the same either way.
 *
@@ -13422,8 +13580,15 @@ function positionByCrossStackSource(bag, source, secrets) {
 * the source leaf is an `Fn::Join` / `Fn::Sub` there is none, so the leaf fell
 * to the value scan — and the value map is keyed by the resolved PLAINTEXT, so
 * a colliding pair collapses there exactly as it did before #1904. That is the
-* DOMINANT CDK shape rather than an edge case: any secret reached through an L2
-* token renders the secret ARN as a `Ref`, hence an `Fn::Join`.
+* DOMINANT CDK shape rather than an edge case: a secret reached through an L2
+* token usually renders the secret ARN as a `Ref`, hence an `Fn::Join`. The
+* exceptions render a plain `{{resolve:...}}` string, which the literal arm
+* already positions: a secret imported by a LITERAL ARN
+* (`Secret.fromSecretCompleteArn` / `fromSecretPartialArn`, whose
+* `secretValue` and `secretValueFromJson` both inline it),
+* `SecretValue.secretsManager('<literal arn>')` and
+* `SecretValue.ssmSecure(...)` (synth-probed on this repo's aws-cdk-lib,
+* issue #3143; `new Secret(...)` and `fromSecretNameV2` are the join).
 *
 * Three conditions must ALL hold before an expression is persisted, and each
 * removes a different way of being wrong:
@@ -23291,15 +23456,19 @@ function withoutProducerRegions(context) {
 }
 /**
 * Masked log twins registered this pass, per pass bag (issue #3100;
-* `rememberLogTwin` / `logTwinOfProduct`). Log-only: nothing that resolves or
-* persists a value reads it.
+* `rememberLogTwin` / `logTwinOfProduct`). Nothing that RESOLVES a value reads
+* it. One persistence decision does: `resolveBase64` registers its encoding
+* mask-only when the input's position mask fires (issue #3119), which a nested
+* child also reaches through the inherited-bag lookup (issue #3114).
 *
 * MODULE scope, not instance scope: a region-pinned sibling resolver
 * (`resolverForProducerRegion`) resolves on behalf of the consumer with the
 * consumer's bag, so an instance-local registry left the sibling's twin where
 * the consumer's `Fn::Join` / `Fn::Sub` never looked. The key is still the
-* pass's own bag object, so scope does not widen: another pass holds another
-* bag and cannot reach these entries, and they die with the bag.
+* pass's own bag object, so scope does not widen to unrelated passes: a pass
+* reaches only the entries under its own bag and under the bag it was handed
+* as `inheritedSecrets` (a nested-stack child reading its parent's, issue
+* #3114), and the entries die with the bag.
 */
 const LOG_TWINS_BY_PASS = /* @__PURE__ */ new WeakMap();
 /**
@@ -23430,20 +23599,22 @@ const recordedSecretExpressions = {
 */
 const cachedEc2InstanceAttributes = Object.create(null);
 /**
-* The two sibling caches of {@link cachedEc2InstanceAttributes} (issue
-* #3096), each holding a value the resolver read LIVE because the state
-* record omitted it — `definedAttributes` drops a member the provider could
-* not read back (issue #3077), so the `Fn::GetAtt` falls out of the flat
-* lookup and into `constructAttribute`'s per-type arm. Keyed by physical id
-* (AWS-minted, unique across accounts and regions, and the value — a default
-* security group id, a distribution hostname — never changes); like the
-* instance cache, a refusal caches nothing. Same process lifetime, cleared
-* together with it by {@link resetAccountInfoCache}. The RDS `DBProxy` / `DBProxyEndpoint`
-* `VpcId` arms have no cache because they have no live read: `AwsClients`
-* exposes no RDS client and this file imports none, so those two arms refuse
-* outright (see `refuseUnservedAttribute`'s callers).
-*
-* All three are NULL-PROTOTYPE objects (#3096 delta review, measured): the
+* The three sibling caches of {@link cachedEc2InstanceAttributes} (issues
+* #3096 / #3097), each holding a value the resolver read LIVE because the
+* state record omitted it — `definedAttributes` drops a member the provider
+* could not read back (issue #3077), so the `Fn::GetAtt` falls out of the
+* flat lookup and into `constructAttribute`'s per-type arm. Keyed by physical
+* id: the read is region-pinned (`clientsForRegion(this.explicitRegion)`),
+* so the key names one resource in that region, and the value — a default
+* security group id, a distribution hostname, a security group's VPC —
+* never changes; like the instance cache, a refusal caches nothing. Same
+* process lifetime, cleared together with it by {@link resetAccountInfoCache}.
+* The RDS `DBProxy` / `DBProxyEndpoint` `VpcId` arms have no cache because
+* they have no live read: `AwsClients` exposes no RDS client and this file
+* imports none, so those two arms refuse outright (see
+* `refuseUnservedAttribute`'s callers).
+*
+* All four are NULL-PROTOTYPE objects (#3096 delta review, measured): the
 * key is a state-record physical id, and on a plain `{}` a record holding
 * `constructor` / `__proto__` / `hasOwnProperty` read a FUNCTION out of
 * `Object.prototype` as the cached value — served with zero AWS calls, ahead
@@ -23452,6 +23623,7 @@ const cachedEc2InstanceAttributes = Object.create(null);
 */
 const cachedVpcDefaultSecurityGroups = Object.create(null);
 const cachedCloudFrontDomainNames = Object.create(null);
+const cachedSecurityGroupVpcIds = Object.create(null);
 /**
 * The region this call answers for: the caller's override, else the ambient one.
 *
@@ -23900,6 +24072,29 @@ async function resolveAccountIdentity() {
 	}
 }
 /**
+* Is a STORED `''` for this attribute a value the resource can never have —
+* so the flat lookup must read it as ABSENT and let the live arm run?
+*
+* Exactly one attribute qualifies today (issue #3097 review): an
+* `AWS::EC2::SecurityGroup`'s `VpcId`. Every security group lives in a VPC
+* (EC2-Classic retired 2022-08-15), so `''` can only be the pre-#3097
+* provider's copy of a template that declared no `VpcId` — and that record is
+* rewritten only by an `update()`, which a no-change deploy never issues, so
+* without this carve-out the stored `''` shadows the live arm for the life of
+* the record. The record itself stays `''` until the next update; only the
+* RESOLUTION changes.
+*
+* Deliberately NOT a general "`''` means absent" rule: #3077 records a settled
+* EC2 instance's missing public address as the KNOWN empty `''`
+* (CloudFormation's own answer), and that one must keep being served from
+* state rather than sent back to `DescribeInstances` on every resolution.
+* A new entry here needs the same argument — that `''` is IMPOSSIBLE for the
+* attribute, not merely unlikely.
+*/
+function isImpossibleEmptyStoredAttribute(resourceType, attributeName, storedValue) {
+	return storedValue === "" && resourceType === "AWS::EC2::SecurityGroup" && attributeName === "VpcId";
+}
+/**
 * Does a constructed `Fn::GetAtt` answer embed the placeholder account id?
 *
 * The guard in `constructGuardedAttribute` used to test
@@ -24625,6 +24820,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async resolveParameters(template, userParameters, options) {
 		const inheritedSecrets = options?.inheritedSecrets;
 		const maskInherited = (text) => inheritedSecrets && inheritedSecrets.size > 0 ? maskSecretsInText(text, inheritedSecrets) : text;
+		const inheritedLogContext = {
+			template,
+			resources: {},
+			...inheritedSecrets && { inheritedSecrets }
+		};
 		const parameters = Object.create(null);
 		const templateParameters = template.Parameters;
 		if (!templateParameters || typeof templateParameters !== "object") return parameters;
@@ -24637,7 +24837,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				if (userValue !== void 0) {
 					this.refuseCoercedInheritedSecret(name, paramDef, userValue, inheritedSecrets);
 					parameters[name] = this.coerceParameterValue(userValue, paramDef.Type);
-					this.logger.debug(`Parameter ${name}: using user-provided value ${maskInherited(stringifyParameterForLog(paramDef, userValue))}`);
+					this.logger.debug(`Parameter ${name}: using user-provided value ${maskInherited(stringifyParameterForLog(paramDef, this.maskValueLeaves(userValue, inheritedLogContext)))}`);
 					continue;
 				}
 			}
@@ -24966,7 +25166,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const value = context.parameters[logicalId];
 			const declared = context.template.Parameters;
 			const paramDef = declared != null && Object.hasOwn(declared, logicalId) ? declared[logicalId] : void 0;
-			this.logger.debug(`Resolved Ref to parameter: ${logicalId} -> ${this.maskSecretsForLog(stringifyParameterForLog(paramDef, value), context)}`);
+			this.logger.debug(`Resolved Ref to parameter: ${logicalId} -> ${this.maskSecretsForLog(stringifyParameterForLog(paramDef, this.maskValueLeaves(value, context)), context)}`);
 			this.recordInheritedParameterSecrets(logicalId, value, context);
 			return value;
 		}
@@ -25133,15 +25333,16 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const resource = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
 		if (!resource) throw markNonRetryable(/* @__PURE__ */ new Error(`Resource ${logicalId} not found for Fn::GetAtt`));
 		if (!(resource.resourceType === "AWS::EC2::VPC" && attributeName === "Ipv6CidrBlocks") && resource.attributes !== void 0) {
-			const flatValue = Object.hasOwn(resource.attributes, attributeName) ? resource.attributes[attributeName] : void 0;
+			const storedValue = Object.hasOwn(resource.attributes, attributeName) ? resource.attributes[attributeName] : void 0;
+			const flatValue = isImpossibleEmptyStoredAttribute(resource.resourceType, attributeName, storedValue) ? void 0 : storedValue;
 			if (flatValue !== void 0) {
 				this.rejectPlaceholderArnAttribute(resource, attributeName, flatValue, logicalId, context);
 				if (resource.resourceType === "AWS::Route53::HostedZone" && attributeName === "NameServers" && typeof flatValue === "string") {
 					const nameServers = flatValue === "" ? [] : flatValue.split(",");
-					this.logger.debug(`Normalized legacy Fn::GetAtt attribute: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, nameServers), context)}`);
+					this.logger.debug(`Normalized legacy Fn::GetAtt attribute: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, this.maskValueLeaves(nameServers, context)), context)}`);
 					return this.noteAttributeSecrecy(logicalId, attributeName, nameServers, context);
 				}
-				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, flatValue), context)}`);
+				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, this.maskValueLeaves(flatValue, context)), context)}`);
 				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${attributeName}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 				return this.noteAttributeSecrecy(logicalId, attributeName, flatValue, context);
 			}
@@ -25154,7 +25355,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					break;
 				}
 				if (cursor !== void 0) {
-					this.logger.debug(`Resolved Fn::GetAtt from nested attributes: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, cursor), context)}`);
+					this.logger.debug(`Resolved Fn::GetAtt from nested attributes: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, this.maskValueLeaves(cursor, context)), context)}`);
 					return this.noteAttributeSecrecy(logicalId, attributeName, cursor, context);
 				}
 			}
@@ -25164,7 +25365,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}]: the nested stack '${logicalId}' declares no output named '${this.maskSecretsForLog(attributeName.slice(8), context)}'. Its outputs are ${declared.length > 0 ? declared.join(", ") : "(none)"}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
 		}
 		const value = await this.constructGuardedAttribute(resource, attributeName, context, logicalId);
-		this.logger.debug(`Resolved Fn::GetAtt: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, value), context)}`);
+		this.logger.debug(`Resolved Fn::GetAtt: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, this.maskValueLeaves(value, context)), context)}`);
 		return value;
 	}
 	/**
@@ -25578,7 +25779,38 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		}
 		if (resourceType === "AWS::EC2::SecurityGroup") switch (attributeName) {
 			case "GroupId": return physicalId;
-			case "VpcId": return;
+			case "VpcId": {
+				if (!/^sg-[0-9a-f]+$/.test(physicalId)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, VpcId] for AWS::EC2::SecurityGroup: the state record's physical id "${displaySafe(this.maskThenStripThenMask(physicalId, context)).slice(0, 64)}" is not a security group id (sg-<hex>), so cdkd will not look it up. Repair the record (cdkd import, or re-create the security group) and deploy again.`));
+				const cachedVpcId = cachedSecurityGroupVpcIds[physicalId];
+				if (cachedVpcId !== void 0) return cachedVpcId;
+				let vpcId;
+				try {
+					vpcId = (await this.clientsForRegion(this.explicitRegion).ec2.send(new DescribeSecurityGroupsCommand({ GroupIds: [physicalId] }))).SecurityGroups?.[0]?.VpcId;
+				} catch (err) {
+					this.refuseUnservedAttribute({
+						logicalId,
+						attributeName,
+						resourceType,
+						physicalId,
+						context,
+						observed: this.describeFailureObserved("DescribeSecurityGroups", err, context),
+						remedy: "Fix the read (the ec2:DescribeSecurityGroups permission, or the region) and deploy again."
+					});
+				}
+				if (vpcId) {
+					cachedSecurityGroupVpcIds[physicalId] = vpcId;
+					return vpcId;
+				}
+				this.refuseUnservedAttribute({
+					logicalId,
+					attributeName,
+					resourceType,
+					physicalId,
+					context,
+					observed: "DescribeSecurityGroups reports no VpcId for the group",
+					remedy: "Check the security group in the console, or reference the attribute from a later deploy."
+				});
+			}
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::EC2::Subnet") switch (attributeName) {
@@ -25716,9 +25948,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* belongs, a `vpc-...` in a security-group slot, a distribution id where a
 	* hostname belongs, a proxy name in a `VpcId` position. Loud only where AWS
 	* rejects the shape; an Output, an export or a free-text property carried it
-	* silently. The physical id can never be the value for these attributes,
-	* so the honest answer is a refusal naming the resource, the attribute, what
-	* was observed and the remedy.
+	* silently. The security group `VpcId` arm (issue #3097) joined with the
+	* opposite pre-fix defect — it answered `undefined`, which `Fn::Join`
+	* renders `'undefined'` — and takes the same refusal. The physical id can
+	* never be the value for these attributes, so the honest answer is a
+	* refusal naming the resource, the attribute, what was observed and the
+	* remedy.
 	*
 	* DELIBERATELY NOT `markNonRetryable`, unlike every other refusal in this
 	* file but the fabricated-account guard: the verdict is TIME-DEPENDENT. A
@@ -25734,7 +25969,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* interpolated hole happens to carry a pattern — the `logicalId` (the #1838
 	* hazard: `DependencyViolation` and two other bare words), or the error
 	* CLASS name `describeFailureObserved` puts in `observed`, which none of
-	* these three reads raises — and then re-describes and can heal.
+	* these four reads raises — and then re-describes and can heal.
 	* Measured, not designed: the fabricated-account guard sits in exactly the
 	* same place. Threading a sanitized SDK error as `cause` so a throttled
 	* describe classifies as transient was considered and left out — a
@@ -25822,7 +26057,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const literalList = Array.isArray(rawValues);
 		const parts = (await allSettledKeepingFirstRejection(values.map(async (v) => {
 			if (typeof v === "string") return {
-				...v.includes("{{resolve:") ? await this.resolveDynamicReferencesWithLogTwin(v, v, context) : {
+				...v.includes("{{resolve:") ? await this.resolveDynamicReferencesWithLogTwin(v, this.logTwinOfProduct({
+					result: v,
+					twin: v
+				}, context).twin, context) : {
 					result: v,
 					twin: v
 				},
@@ -27144,8 +27382,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* pass is masked too: the over-masking direction `logTwinOfProduct` accepts.
 	*/
 	splitLogTwins(value, delimiter, pieces, context) {
-		const bag = this.logTwinBag(context);
-		const sourceTwin = this.isRecordedSecretForLog(value, context) ? "***" : bag ? LOG_TWINS_BY_PASS.get(bag)?.get(value) : void 0;
+		const sourceTwin = this.isRecordedSecretForLog(value, context) ? "***" : this.registeredLogTwin(value, context);
 		if (sourceTwin === void 0) return pieces;
 		const twinPieces = sourceTwin.split(delimiter);
 		const aligned = twinPieces.length === pieces.length && !"***".includes(delimiter);
@@ -27199,6 +27436,48 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		return context?.recordedSecretValues ?? context?.inheritedSecrets;
 	}
 	/**
+	* The masked twin registered for `value`, looked up under the pass's OWN bag
+	* and under the INHERITED one (issue
+	* [#3114](https://github.com/go-to-k/cdkd/issues/3114)). A nested-stack
+	* child receives, as `inheritedSecrets`, the very object its parent resolved
+	* the `AWS::CloudFormation::Stack` resource with: the deploy engine binds the
+	* resource context's `recordedSecretValues` as the resource's secrets, and
+	* `NestedStackProvider` hands that binding to the child. So a parameter value
+	* the parent built around a short secret (`port:q7` -> `port:***`) is
+	* registered under the child's inherited bag, while the child registers its
+	* own writes under its own bag. Two DIFFERENT registered twins mask the
+	* whole string, the rule `rememberLogTwin` applies within one bag. Lookups
+	* only: `rememberLogTwin` still registers under `logTwinBag`, the context's
+	* own `recordedSecretValues` whenever it carries one (every context
+	* `buildResolverContext` returns does; the log-only context
+	* `resolveParameters` builds carries none, and nothing on that path
+	* registers), so such a child never writes into its parent's registry. A
+	* context with ONLY an inherited bag registers into that bag, as it did
+	* before this lookup existed.
+	*
+	* ONE LEVEL ONLY. The bag a child hands its own nested stack is the child's
+	* OWN resource bag, so no twin registered ABOVE the child is reachable from a
+	* grandchild. Where the middle stack passes the value THROUGH
+	* (`{ Ref: Param }` straight into the grandchild's `Parameters`) nothing ever
+	* registers a twin in that bag, so the grandchild prints the value whether or
+	* not the bag holds pairs. Where the middle RE-WRAPS it (an `Fn::Join` around
+	* the `Ref`) the middle registers its own twin, and the hand-off still drops
+	* a bag holding no pairs (it passes `inheritedSecrets` only when `size` is
+	* nonzero). Both are issue #3156.
+	*
+	* The registry is keyed by VALUE, and `splitLogTwins`' unaligned arm
+	* registers every piece, public ones included. So a child `Fn::Base64` over a
+	* string exactly equal to such a piece of its parent's persists `***` for a
+	* non-secret property, the over-masking hazard issue #3119 already accepts
+	* within one pass, now reachable across the parent / child boundary.
+	*/
+	registeredLogTwin(value, context) {
+		const own = context?.recordedSecretValues ? LOG_TWINS_BY_PASS.get(context.recordedSecretValues)?.get(value) : void 0;
+		const inherited = context?.inheritedSecrets ? LOG_TWINS_BY_PASS.get(context.inheritedSecrets)?.get(value) : void 0;
+		if (own === void 0) return inherited;
+		return inherited === void 0 || inherited === own ? own : "***";
+	}
+	/**
 	* The log twin of a RESOLUTION PRODUCT — an intrinsic part, variable or
 	* placeholder — for issue #3100. Masked whole when its value is a recorded
 	* secret. Otherwise a part that carries no mask of its own takes the masked
@@ -27226,8 +27505,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			result: part.result,
 			twin: "***"
 		};
-		const bag = this.logTwinBag(context);
-		const registered = bag ? LOG_TWINS_BY_PASS.get(bag)?.get(part.result) : void 0;
+		const registered = this.registeredLogTwin(part.result, context);
 		if (registered === void 0 || registered === part.twin) return part;
 		return {
 			result: part.result,
@@ -27241,7 +27519,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* two DIFFERENT masked twins for one string register `***` for the whole
 	* string, since their spans cannot be merged. Scoped to the pass's bag
 	* through a `WeakMap`, like the cross-stack associations, so it dies with
-	* the bag and another pass's strings cannot be reached.
+	* the bag. An unrelated pass cannot reach these strings; a nested child
+	* whose `inheritedSecrets` is this bag reads them (`registeredLogTwin`).
 	*/
 	rememberLogTwin(context, result, twin) {
 		if (twin === result) return;
@@ -29016,7 +29295,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-NffO_bpL.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CsdVn4cg.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -34214,20 +34493,22 @@ const WARM_THROUGHPUT_MEMBERS = ["ReadUnitsPerSecond", "WriteUnitsPerSecond"];
 *
 * The accepted STRING set is `Number()`'s, which is WIDER than a decimal
 * integer: `'0x1e'`, `'0o36'`, `'1e3'`, `'30.5'` and `' 30 '` all coerce.
-* CloudFormation accepts only the LAST of those for an `Integer`-typed
-* property — measured on `AWS::Logs::LogGroup.RetentionInDays`, issue
-* [#2698](https://github.com/go-to-k/cdkd/issues/2698) — and
-* {@link toCfnInteger} is the reader that matches that measurement. It matters
-* at the CALLERS that FORWARD the result to AWS rather than merely compare it:
-* the log-group provider switched; the DynamoDB capacity / throughput
-* forwarders (`coerceWarmThroughput` below, and the `GlobalTable` provider's
-* `ProvisionedThroughput` / `OnDemandThroughput` readers) still read through
-* THIS helper, because the measurement covers one resource handler and
-* DynamoDB's has not been A/B'd — issue
-* [#3135](https://github.com/go-to-k/cdkd/issues/3135) holds that pass. A
-* GUARD caller (`stateful-types.ts`'s `has-retention`, the DynamoDB
-* already-matches / decrease tests) is safe on the wider set: over-acceptance
-* there can only produce MORE refusals or skip fewer calls.
+* CloudFormation accepts NONE of those on a DynamoDB capacity and only the
+* LAST on `AWS::Logs::LogGroup.RetentionInDays` (both measured — the tables
+* are on {@link toCfnInteger}), so this helper is for the GUARD callers only:
+* `stateful-types.ts`'s `has-retention`, the DynamoDB already-matches /
+* decrease / zero-capacity tests, the live-readback compares. A guard is safe
+* on the wider set — over-acceptance there can only produce MORE refusals or
+* skip fewer calls. A caller that FORWARDS the number to AWS reads through the
+* grammar CloudFormation measured for that handler instead:
+* `logs-loggroup-provider.ts` through {@link toCfnInteger} (issue
+* [#2698](https://github.com/go-to-k/cdkd/issues/2698)), every DynamoDB
+* capacity / throughput forwarder (`coerceWarmThroughput` below, the
+* `GlobalTable` provider's `ProvisionedThroughput` / `OnDemandThroughput`
+* readers AND the diagnostic / mirror predicates paired with them) through
+* `config-shape.ts`'s `coerceCfnInteger` (issue
+* [#3135](https://github.com/go-to-k/cdkd/issues/3135)). A forwarder left on
+* THIS helper sends `Number('0x9')` for a template CloudFormation refuses.
 *
 * EXPORTED, and not because warm throughput needs it exported. This exact rule
 * was hand-written three times — here, as `dynamodb-table-provider.ts`'s
@@ -34289,6 +34570,37 @@ function toFiniteNumber(value) {
 * behaviour varies on padding, so each helper carries its own measurement and
 * a caller picks by the property it forwards.
 *
+* The DynamoDB measurement, read beside the Logs one so the two grammars sit
+* side by side (`AWS::DynamoDB::Table.ProvisionedThroughput.ReadCapacityUnits`
+* plus one `WriteCapacityUnits` row, us-east-1, 2026-09-14, issue
+* [#3135](https://github.com/go-to-k/cdkd/issues/3135); same protocol, live
+* value read back with `dynamodb describe-table`). "properties validation" is
+* CloudFormation's own template-property check, which fires BEFORE the
+* handler; "handler" is the DynamoDB resource handler's model validation:
+*
+* ```
+* template spelling        CloudFormation                          live RCU after
+* 5 (JSON number)          accepted                                5
+* "6"                      accepted                                6
+* "+8"                     accepted                                8
+* "010"                    accepted (decimal, not octal)           10
+* " 7 " (padded)           REJECTED (properties validation)        unchanged
+* "7 " (trailing space)    REJECTED (properties validation)        unchanged
+* "" (empty string)        REJECTED (properties validation)        unchanged
+* "0x9" (RCU or WCU)       REJECTED (handler)                      unchanged
+* "1e1"                    REJECTED (Validation failed)            unchanged
+* "6.0"                    REJECTED (same)                         unchanged
+* "6.5"                    REJECTED (same)                         unchanged
+* ```
+*
+* The two agree on the digits (`/^[+-]?\d+$/`, hex / exponent / decimal-point
+* rejected by both) and DISAGREE on padding: the Logs handler trims, DynamoDB
+* rejects `" 7 "` and `"7 "` before any handler runs. So the DynamoDB
+* forwarders read through {@link coerceCfnInteger} itself — the no-trim
+* grammar — and NOT through this helper, whose trim is licensed by the Logs
+* measurement alone. `""` is not portable as "absent" either: on a REQUIRED
+* Integer it is rejected outright, where `RetentionInDays` reads it as absent.
+*
 * What this helper does NOT decide: the empty / whitespace-only strings above
 * are CloudFormation's spelling of "property absent", which is a statement
 * about the PROPERTY, not about the number — they answer `undefined` here, and
@@ -34322,6 +34634,16 @@ function toCfnInteger(value) {
 * Pure: takes the raw bag, returns numbers, logs nothing. Each caller owns its
 * own message, so the wording stays consistent across that provider's send
 * sites without forcing one wording across both providers.
+*
+* A member is read through {@link coerceCfnInteger} — CloudFormation's
+* measured DynamoDB Integer grammar (issue #3135, table on
+* {@link toCfnInteger}) — because this block is FORWARDED. A spelling
+* CloudFormation rejects (`" 7 "`, `"0x9"`, `"1e1"`, `"6.5"`) is therefore a
+* DROPPED member, named in `droppedMembers` exactly like an unresolved
+* intrinsic: the caller's diagnostic reports it and the live AWS value is left
+* alone. It is never read as ABSENT (the `=== undefined` test above runs on
+* the RAW value), and it is never forwarded as `Number()`'s reading, which
+* sent `7` for a template CloudFormation refuses.
 */
 function coerceWarmThroughput(raw) {
 	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return { droppedMembers: [] };
@@ -34330,7 +34652,7 @@ function coerceWarmThroughput(raw) {
 	const droppedMembers = [];
 	for (const member of WARM_THROUGHPUT_MEMBERS) {
 		if (bag[member] === void 0) continue;
-		const coerced = toFiniteNumber(bag[member]);
+		const coerced = coerceCfnInteger(bag[member]);
 		if (coerced === void 0) {
 			droppedMembers.push(member);
 			continue;
@@ -41672,5 +41994,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { secretSafeKeyDisplay as $, parseBootstrapMarker as $n, ConfigError as $r, DiffCalculator as $t, planOrphanAdoption as A, formatLockExpiry as An, resolveUseCdkBootstrapAssets as Ar, WAFv2WebACLProvider as At, formatResourceLine as B, AssetPublisher as Bn, PARTITION_TABLE as Br, replayWarn as Bt, createPreDeleteFinalSnapshot as C, isThrottlingError as Ci, scrubResourceRecord as Cn, getLegacyStateBucketName as Cr, cfnRefValueFromPhysicalId as Ct, makeCanonicalizePropertiesFn as D, retryClassificationText as Di, buildForceUnlockCommand as Dn, resolveSkipPrefix as Dr, parameterTypeMayLoseSecretIdentity as Dt, unsupportedFinalSnapshotError as E, markRedactedCause as Ei, rebuildClientForBucketRegion as En, resolveCaptureObservedState as Er, isUnboundTemplateParameter as Et, WARM_THROUGHPUT_MEMBERS as F, importableOutputKeys as Fn, MIGRATE_TMP_PREFIX as Fr, coerceCfnInteger as Ft, red as G, loadPublishableAssetManifest as Gn, clearBucketRegionCache as Gr, producerRegionsFromState as Gt, cyan as H, WorkGraph as Hn, derivePartitionAndUrlSuffix as Hr, requireConfigObject as Ht, coerceWarmThroughput as I, importableOutputs as In, findLargeInlineResources as Ir, configBooleanRefusal as It, collectPublishedOutputNames as J, BOOTSTRAP_MARKER_PREFIX as Jn, getAwsClients as Jr, s3BucketDomainName as Jt, yellow as K, rewriteTemplateAssetReferences as Kn, resolveBucketRegion as Kr, withSharedDrainBudget as Kt, isWarmThroughputDecrease as L, orphansAfterRollback as Ln, uploadCfnTemplate as Lr, configIntegerRefusal as Lt, isStatefulRecreateTargetForReplace as M, CUSTOM_RESOURCE_RESPONSE_PREFIX as Mn, warnDeprecatedNoPrefixCliFlag as Mr, resolveExplicitPhysicalId as Mt, isStatefulRecreateTargetSync as N, DEFAULT_STATE_PREFIX as Nn, CFN_TEMPLATE_BODY_LIMIT as Nr, assertRegionMatch as Nt, extractDeploymentEventError as O, __exportAll as Oi, buildLockContentionMessage as On, resolveStateBucketWithDefault as Or, refStateLookupFromResource as Ot, renderStatefulReason as P, exportNamesCarriedFrom as Pn, CFN_TEMPLATE_URL_LIMIT as Pr, coerceCfnBoolean as Pt, secretBearingStateKeyWarning as Q, isCrossRegionRedirect as Qn, CdkdError as Qr, applyRoleArnIfSet as Qt, toCfnInteger as R, orphansCarriedFrom as Rn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Rr, configStringRefusal as Rt, ccRoutedFinalSnapshotError as S, isRetryableTransientError as Si, redactSecretsForState as Sn, getDefaultStateBucketName as Sr, carriesDynamicReference as St, refusesFinalSnapshot as T, markNonRetryable as Ti, S3StateBackend as Tn, resolveAutoAssetStorage as Tr, getAccountInfo as Tt, gray as U, buildAssetRedirectMap as Un, AssemblyReader as Ur, requireConfigString as Ut, bold as V, stringifyValue as Vn, canonicalizeRegion as Vr, requireConfigArray as Vt, green as W, createAssetRedirectResolver as Wn, processStackMessages as Wr, classifyReplaySecretRegion as Wt, isExportAliasCollision as X, ensureAssetStorage as Xn, setAwsClients as Xr, s3BucketRegionalDomainName as Xt, exportAliasCollisionScrubWarning as Y, assertAssetBucketRegion as Yn, resetAwsClients as Yr, s3BucketDualStackDomainName as Yt, secretBearing as Z, getBootstrapMarkerKey as Zn, AssetError as Zr, s3BucketWebsiteUrl as Zt, isSecretBearingReferenceString as _, formatError as _i, markSameGenerationBag as _n, stripControlChars as _r, deleteIndeterminateGuards as _t, DeploymentEventsStore as a, LocalInvokeBuildError as ai, DagBuilder as an, buildDockerImage as ar, wouldReturnToSdkProvider as at, PRE_DELETE_SNAPSHOT_TYPES as b, withErrorHandling as bi, recordMaskOnlyValue as bn, Synthesizer as br, isTerminationProtectionPropagationError as bt, replayFailedOperations as c, NestedStackChildDirectDestroyError as ci, STATE_SOURCED_CROSS_GENERATION_RULES as cn, describeDockerFailure as cr, maskerOrIdentity as ct, updatePartialReason as d, ResourceTimeoutError as di, carriesSecretMask as dn, getDockerCmd as dr, interruptWatchListenerCount as dt, CrossAccountSecretRefusalError as ei, INTRINSIC_KEYS as en, readBootstrapMarkerBody as er, getCurrentResourceSecrets as et, withResourceDeadline as f, ResourceUpdateNotSupportedError as fi, createSecretMasker as fn, partitionSensitiveEnv as fr, isInterruptedWaitError as ft, bagHoldsSecretExpression as g, SynthesisError as gi, isSingleDynamicReferenceToken as gn, escapeRegExp$1 as gr, UNSPECIFIED_SKIP_REASON as gt, computeImplicitDeleteEdges as h, StateError as hi, identityKeyFor as hn, runDockerStreaming as hr, slowCcOperationTimeoutMs as ht, DeploymentEventsReader as i, IntrinsicResolutionRefusalError as ii, withRetry as in, describeAwsFailure as ir, ProviderRegistry as it, MULTI_REGION_RECREATE_BLOCKED_TYPES as j, shellQuote as jn, stateBucketExistenceConfirmed as jr, normalizeAwsTagsToCfn as jt, makeSiblingClaimReader as k, forceQuitRecoveryClause as kn, resolveStateBucketWithDefaultAndSource as kr, isSettledInstanceState as kt, replayRollback as l, PartialFailureError as li, STATE_SOURCED_READBACK_RULES as ln, dockerSpawnEnvWithSensitive as lr, beginCommandInterruptScope as lt, IMPLICIT_DELETE_DEPENDENCIES as m, StackTerminationProtectionError as mi, errorCauseChain as mn, runDockerForeground as mr, CloudControlProvider as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, DeployCancelledError as ni, findSilentDropProperties as nn, validateContainerRepoName as nr, collectInlinePolicyNamesManagedBySiblings as nt, planFailedOps as o, LocalStartServiceError as oi, TemplateParser as on, describeDockerCapturedOutput as or, createMaskedRetryLogger as ot, maskingRetryLogger as p, StackHasActiveImportsError as pi, dynamicReferenceTokens as pn, redactDockerArgvValues as pr, startInterruptWatch as pt, collectDeclaredOutputNames as q, AssetModeResolver as qn, AwsClients as qr, s3BucketArn as qt, DeployEngine as r, DynamicReferenceRegionAmbiguousError as ri, describeTypeWithThrottleRetry as rn, buildDenyExternalAccessPolicy as rr, clearOnUpdateRemoval as rt, planRollback as s, LockError as si, STATE_SOURCED_BASELINE_RULES as sn, describeDockerExecFailure as sr, maskDeep as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, DependencyError as ti, findActionableSilentDrops as tn, validateAssetBucketName as tr, IAMRoleProvider as tt, updatePartialMessage as u, ProvisioningError as ui, TEMPLATE_SOURCED_RULES as un, formatDockerLoginError as ur, endCommandInterruptScope as ut, bindingSkippedOutputs as v, isCdkdError as vi, maskSecretsInError as vn, AssetManifestLoader as vr, deleteSkipReason as vt, isFinalSnapshotError as w, isTransientServerError as wi, LockManager as wn, resolveApp as wr, coerceParameterTypedValue as wt, buildFinalSnapshotIdentifier as x, isMarkedNonRetryable as xi, recoverMaskedOutput as xn, synthesisStatusMessage as xr, IntrinsicFunctionResolver as xt, ATOMIC_FINAL_SNAPSHOT_TYPES as y, normalizeAwsError as yi, maskSecretsInText as yn, getDockerImageBySourceHash as yr, disableInstanceApiTermination as yt, toFiniteNumber as z, shouldRetainResource as zn, expectedOwnerParam as zr, readConfigString as zt };
-//# sourceMappingURL=deploy-engine-DD7JE_Ic.js.map
+export { secretSafeKeyDisplay as $, isCrossRegionRedirect as $n, CdkdError as $r, applyRoleArnIfSet as $t, planOrphanAdoption as A, forceQuitRecoveryClause as An, resolveStateBucketWithDefaultAndSource as Ar, isSettledInstanceState as At, formatResourceLine as B, shouldRetainResource as Bn, expectedOwnerParam as Br, readConfigString as Bt, createPreDeleteFinalSnapshot as C, isRetryableTransientError as Ci, redactSecretsForState as Cn, getDefaultStateBucketName as Cr, cfnRefValueFromPhysicalId as Ct, makeCanonicalizePropertiesFn as D, markRedactedCause as Di, rebuildClientForBucketRegion as Dn, resolveCaptureObservedState as Dr, isUnboundTemplateParameter as Dt, unsupportedFinalSnapshotError as E, markNonRetryable as Ei, S3StateBackend as En, resolveAutoAssetStorage as Er, isImpossibleEmptyStoredAttribute as Et, WARM_THROUGHPUT_MEMBERS as F, exportNamesCarriedFrom as Fn, CFN_TEMPLATE_URL_LIMIT as Fr, coerceCfnBoolean as Ft, red as G, createAssetRedirectResolver as Gn, processStackMessages as Gr, classifyReplaySecretRegion as Gt, cyan as H, stringifyValue as Hn, canonicalizeRegion as Hr, requireConfigArray as Ht, coerceWarmThroughput as I, importableOutputKeys as In, MIGRATE_TMP_PREFIX as Ir, coerceCfnInteger as It, collectPublishedOutputNames as J, AssetModeResolver as Jn, AwsClients as Jr, s3BucketArn as Jt, yellow as K, loadPublishableAssetManifest as Kn, clearBucketRegionCache as Kr, producerRegionsFromState as Kt, isWarmThroughputDecrease as L, importableOutputs as Ln, findLargeInlineResources as Lr, configBooleanRefusal as Lt, isStatefulRecreateTargetForReplace as M, shellQuote as Mn, stateBucketExistenceConfirmed as Mr, normalizeAwsTagsToCfn as Mt, isStatefulRecreateTargetSync as N, CUSTOM_RESOURCE_RESPONSE_PREFIX as Nn, warnDeprecatedNoPrefixCliFlag as Nr, resolveExplicitPhysicalId as Nt, extractDeploymentEventError as O, retryClassificationText as Oi, buildForceUnlockCommand as On, resolveSkipPrefix as Or, parameterTypeMayLoseSecretIdentity as Ot, renderStatefulReason as P, DEFAULT_STATE_PREFIX as Pn, CFN_TEMPLATE_BODY_LIMIT as Pr, assertRegionMatch as Pt, secretBearingStateKeyWarning as Q, getBootstrapMarkerKey as Qn, AssetError as Qr, s3BucketWebsiteUrl as Qt, toCfnInteger as R, orphansAfterRollback as Rn, uploadCfnTemplate as Rr, configIntegerRefusal as Rt, ccRoutedFinalSnapshotError as S, isMarkedNonRetryable as Si, recoverMaskedOutput as Sn, synthesisStatusMessage as Sr, carriesDynamicReference as St, refusesFinalSnapshot as T, isTransientServerError as Ti, LockManager as Tn, resolveApp as Tr, getAccountInfo as Tt, gray as U, WorkGraph as Un, derivePartitionAndUrlSuffix as Ur, requireConfigObject as Ut, bold as V, AssetPublisher as Vn, PARTITION_TABLE as Vr, replayWarn as Vt, green as W, buildAssetRedirectMap as Wn, AssemblyReader as Wr, requireConfigString as Wt, isExportAliasCollision as X, assertAssetBucketRegion as Xn, resetAwsClients as Xr, s3BucketDualStackDomainName as Xt, exportAliasCollisionScrubWarning as Y, BOOTSTRAP_MARKER_PREFIX as Yn, getAwsClients as Yr, s3BucketDomainName as Yt, secretBearing as Z, ensureAssetStorage as Zn, setAwsClients as Zr, s3BucketRegionalDomainName as Zt, isSecretBearingReferenceString as _, SynthesisError as _i, isSingleDynamicReferenceToken as _n, escapeRegExp$1 as _r, deleteIndeterminateGuards as _t, DeploymentEventsStore as a, IntrinsicResolutionRefusalError as ai, withRetry as an, describeAwsFailure as ar, wouldReturnToSdkProvider as at, PRE_DELETE_SNAPSHOT_TYPES as b, normalizeAwsError as bi, maskSecretsInText as bn, getDockerImageBySourceHash as br, isTerminationProtectionPropagationError as bt, replayFailedOperations as c, LockError as ci, STATE_SOURCED_BASELINE_RULES as cn, describeDockerExecFailure as cr, maskerOrIdentity as ct, updatePartialReason as d, ProvisioningError as di, TEMPLATE_SOURCED_RULES as dn, formatDockerLoginError as dr, interruptWatchListenerCount as dt, ConfigError as ei, DiffCalculator as en, parseBootstrapMarker as er, getCurrentResourceSecrets as et, withResourceDeadline as f, ResourceTimeoutError as fi, carriesSecretMask as fn, getDockerCmd as fr, isInterruptedWaitError as ft, bagHoldsSecretExpression as g, StateError as gi, identityKeyFor as gn, runDockerStreaming as gr, UNSPECIFIED_SKIP_REASON as gt, computeImplicitDeleteEdges as h, StackTerminationProtectionError as hi, errorCauseChain as hn, runDockerForeground as hr, slowCcOperationTimeoutMs as ht, DeploymentEventsReader as i, DynamicReferenceRegionAmbiguousError as ii, describeTypeWithThrottleRetry as in, buildDenyExternalAccessPolicy as ir, ProviderRegistry as it, MULTI_REGION_RECREATE_BLOCKED_TYPES as j, formatLockExpiry as jn, resolveUseCdkBootstrapAssets as jr, WAFv2WebACLProvider as jt, makeSiblingClaimReader as k, __exportAll as ki, buildLockContentionMessage as kn, resolveStateBucketWithDefault as kr, refStateLookupFromResource as kt, replayRollback as l, NestedStackChildDirectDestroyError as li, STATE_SOURCED_CROSS_GENERATION_RULES as ln, describeDockerFailure as lr, beginCommandInterruptScope as lt, IMPLICIT_DELETE_DEPENDENCIES as m, StackHasActiveImportsError as mi, dynamicReferenceTokens as mn, redactDockerArgvValues as mr, CloudControlProvider as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, DependencyError as ni, findActionableSilentDrops as nn, validateAssetBucketName as nr, collectInlinePolicyNamesManagedBySiblings as nt, planFailedOps as o, LocalInvokeBuildError as oi, DagBuilder as on, buildDockerImage as or, createMaskedRetryLogger as ot, maskingRetryLogger as p, ResourceUpdateNotSupportedError as pi, createSecretMasker as pn, partitionSensitiveEnv as pr, startInterruptWatch as pt, collectDeclaredOutputNames as q, rewriteTemplateAssetReferences as qn, resolveBucketRegion as qr, withSharedDrainBudget as qt, DeployEngine as r, DeployCancelledError as ri, findSilentDropProperties as rn, validateContainerRepoName as rr, clearOnUpdateRemoval as rt, planRollback as s, LocalStartServiceError as si, TemplateParser as sn, describeDockerCapturedOutput as sr, maskDeep as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, CrossAccountSecretRefusalError as ti, INTRINSIC_KEYS as tn, readBootstrapMarkerBody as tr, IAMRoleProvider as tt, updatePartialMessage as u, PartialFailureError as ui, STATE_SOURCED_READBACK_RULES as un, dockerSpawnEnvWithSensitive as ur, endCommandInterruptScope as ut, bindingSkippedOutputs as v, formatError as vi, markSameGenerationBag as vn, stripControlChars as vr, deleteSkipReason as vt, isFinalSnapshotError as w, isThrottlingError as wi, scrubResourceRecord as wn, getLegacyStateBucketName as wr, coerceParameterTypedValue as wt, buildFinalSnapshotIdentifier as x, withErrorHandling as xi, recordMaskOnlyValue as xn, Synthesizer as xr, IntrinsicFunctionResolver as xt, ATOMIC_FINAL_SNAPSHOT_TYPES as y, isCdkdError as yi, maskSecretsInError as yn, AssetManifestLoader as yr, disableInstanceApiTermination as yt, toFiniteNumber as z, orphansCarriedFrom as zn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as zr, configStringRefusal as zt };
+//# sourceMappingURL=deploy-engine-BU7n9_qY.js.map