@go-to-k/cdkd 0.291.18 → 0.291.19

package/dist/{deploy-engine-BwDlgFRs.js → deploy-engine-OgrMdBRR.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as isPasteableIdent, E as displayStackName, O as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-Bt0RGDfb.js";
 import { a as setAssumedRoleCredentials, c as currentStackAwsScope, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-CJkb2usU.js";
+import { t as getCdkdVersion } from "./version-2QIPw29e.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4120,6 +4120,109 @@ var ContextStore = class {
 	}
 };
 
+//#endregion
+//#region src/utils/ambient-client-defaults.ts
+/**
+* Client config for an SDK client built OUTSIDE `AwsClients` (issue
+* [#3588](https://github.com/go-to-k/cdkd/issues/3588)).
+*
+* `awsClientDefaults()` alone carries the ambient ENVIRONMENT — `AWS_PROFILE`,
+* a published `--role-arn` role, the proxy handler, a stack scope's region — but
+* not an explicit `AwsClientConfig.credentials` object, which has no
+* environment path at all. A LIBRARY caller that installs
+* `new AwsClients({ credentials })` (`AwsClients` / `setAwsClients` are public
+* exports) therefore had every client a provider, context provider,
+* asset publisher or the cross-account STS hop built for itself signing with
+* the default credential chain: a different identity from the one it
+* configured. {@link ambientClientDefaults} closes that for every site at once
+* by reading the ACTIVE clients' {@link AwsClients.credentialConfig}.
+*
+* BOUND: a site that caches its client (every SDK provider's lazy
+* `getClient()`) captures the identity active at its FIRST call. cdkd builds a
+* provider registry per stack inside that stack's scope, so this is the stack's
+* identity; a library caller that reuses one registry across `setAwsClients`
+* switches keeps the first identity's clients.
+*
+* SPREAD IT FIRST, exactly where `awsClientDefaults()` was spread:
+*
+* `new GlueClient({ ...ambientClientDefaults(), ...(region && { region }) })`
+*
+* The site's own keys still win, so a site that names its own `region` or its
+* own `credentials` keeps them. `scripts/check-aws-client-defaults.ts` accepts
+* this helper as the defaults spread (it calls `awsClientDefaults` afresh per
+* call, so each client still gets its own routing agent), and
+* `tests/unit/utils/ambient-client-defaults-fence.test.ts` refuses a new
+* `awsClientDefaults()`-only construction under `src/**`.
+*
+* Its own module rather than a member of `aws-clients.ts` so that a test which
+* `vi.mock`s `aws-clients.js` with a `getAwsClients` double still reaches this
+* code and degrades, instead of losing the export. It is deliberately OUTSIDE
+* the literal-`.ts` closure `scripts/audit-provider-coverage.ts` resolves
+* (nothing in that closure imports it), and neither module it imports imports
+* it back, so there is no cycle.
+*/
+/**
+* The ACTIVE clients' credential configuration: the stack scope's
+* `AwsClients` inside `runWithStackAwsClients`, else the process-global one.
+*
+* `{}` when those clients carry none (every CLI run passes no explicit
+* `credentials`, and `--profile` alone yields `{ profile }`), and also for a
+* test double that has no `credentialConfig` getter — degrading to the plain
+* `awsClientDefaults()` answer rather than throwing.
+*
+* Read through `getAwsClients()`, which creates an unconfigured global on first
+* use when nothing installed one. That is side-effect free here: its service
+* clients are lazy, no production call passes `getAwsClients(config)` (so no
+* later configuration is shadowed), and `setAwsClients` replaces it.
+*/
+function ambientCredentialConfig() {
+	return getAwsClients()?.credentialConfig ?? {};
+}
+/**
+* `awsClientDefaults(...)` plus `credentialConfig`, in `AwsClients.clientOptions`'
+* spread order: the defaults FIRST, so an explicit `credentials` outranks a
+* published `--role-arn` role, then `profile`, then `credentials`.
+*
+* Takes the configuration as an argument for the callers that must key a cache
+* on the SAME reading they build from ({@link credentialFingerprint}); every
+* other site calls {@link ambientClientDefaults}.
+*/
+function clientDefaultsFor(credentialConfig) {
+	return {
+		...awsClientDefaults({ profile: credentialConfig.profile }),
+		...credentialConfig.profile && { profile: credentialConfig.profile },
+		...credentialConfig.credentials && { credentials: { ...credentialConfig.credentials } }
+	};
+}
+/**
+* The config every SDK client built outside `AwsClients` spreads first: the
+* proxy / role / scope-region defaults plus the ACTIVE clients' profile and
+* explicit credentials.
+*/
+function ambientClientDefaults() {
+	return clientDefaultsFor(ambientCredentialConfig());
+}
+/**
+* A cache-key component naming WHICH identity a credential configuration
+* selects, for a cache that holds a client (or credentials) built from it.
+*
+* `profile` plus the explicit credentials' ACCESS KEY ID — never the secret
+* key or the session token. The access key id is an identifier rather than a
+* secret (`expected-bucket-owner.ts` already keys its account cache on it), and
+* STS issues a distinct one per session, so two different explicit bags are
+* told apart. The one collision is two bags sharing an access key id with
+* different secrets, at most one of which can be valid.
+*
+* What it does NOT carry, because it is PROCESS-WIDE rather than per
+* configuration: a published `--role-arn` role (set once, refused a second
+* time), the proxy, and `AWS_PROFILE` / the environment chain. Two readings
+* with equal fingerprints within one process therefore resolve to the same
+* identity. Do not log it.
+*/
+function credentialFingerprint(credentialConfig) {
+	return JSON.stringify([credentialConfig.profile ?? null, credentialConfig.credentials?.accessKeyId ?? null]);
+}
+
 //#endregion
 //#region src/synthesis/context-providers/az-provider.ts
 /**
@@ -4138,7 +4241,7 @@ var AZContextProvider = class {
 		const region = props["region"] || this.awsConfig?.region;
 		this.logger.debug(`Fetching availability zones for region: ${region}`);
 		const client = new EC2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4171,7 +4274,7 @@ var SSMContextProvider = class {
 		if (!parameterName) throw new Error("SSM context provider requires parameterName property");
 		this.logger.debug(`Reading SSM parameter: ${parameterName} (region: ${region})`);
 		const client = new SSMClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4213,7 +4316,7 @@ var HostedZoneContextProvider = class {
 		if (!domainName) throw new Error("Hosted zone context provider requires domainName property");
 		this.logger.debug(`Looking up hosted zone: ${domainName} (private: ${privateZone})`);
 		const client = new Route53Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4267,7 +4370,7 @@ var VpcContextProvider = class {
 		const returnVpnGateways = props["returnVpnGateways"];
 		this.logger.debug(`Looking up VPC (region: ${region}, filter: ${JSON.stringify(filter)})`);
 		const client = new EC2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4433,7 +4536,7 @@ var CcApiContextProvider = class {
 		if (!typeName) throw new Error("CC API context provider requires typeName property");
 		this.logger.debug(`CC API lookup: ${typeName}${exactIdentifier ? ` (id: ${exactIdentifier})` : ""} (region: ${region})`);
 		const client = new CloudControlClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4560,7 +4663,7 @@ var AmiContextProvider = class {
 		const filters = props["filters"];
 		this.logger.debug(`Looking up AMI (region: ${region})`);
 		const client = new EC2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4603,7 +4706,7 @@ var SecurityGroupContextProvider = class {
 		const vpcId = props["vpcId"];
 		this.logger.debug(`Looking up security group (id: ${securityGroupId}, name: ${securityGroupName}, region: ${region})`);
 		const client = new EC2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4657,7 +4760,7 @@ var LoadBalancerContextProvider = class {
 		const loadBalancerType = props["loadBalancerType"];
 		this.logger.debug(`Looking up load balancer (arn: ${loadBalancerArn}, region: ${region})`);
 		const client = new ElasticLoadBalancingV2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4699,7 +4802,7 @@ var LoadBalancerListenerContextProvider = class {
 		const listenerProtocol = props["listenerProtocol"];
 		this.logger.debug(`Looking up load balancer listener (arn: ${listenerArn}, lb: ${loadBalancerArn}, region: ${region})`);
 		const client = new ElasticLoadBalancingV2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4743,7 +4846,7 @@ var KeyContextProvider = class {
 		if (!aliasName) throw new Error("Key context provider requires aliasName property");
 		this.logger.debug(`Looking up KMS key by alias: ${aliasName} (region: ${region})`);
 		const client = new KMSClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -6647,7 +6750,7 @@ async function expandMacrosAttempt(template, opts, logger) {
 		const parameters = buildParameterValues(template, logger);
 		ownsClient = opts.cfnClient === void 0;
 		cfn = opts.cfnClient ?? new CloudFormationClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			region
 		});
 		let templateInput;
@@ -7778,7 +7881,7 @@ var FileAssetPublisher = class {
 			const destRegion = dest.region ? this.resolvePlaceholders(dest.region, accountId, region) : region;
 			this.logger.debug(`Publishing file asset ${asset.displayName || assetHash} → s3://${bucketName}/${objectKey}`);
 			const client = new S3Client({
-				...awsClientDefaults(),
+				...ambientClientDefaults(),
 				region: destRegion
 			});
 			try {
@@ -9740,7 +9843,7 @@ var DockerAssetPublisher = class {
 			const ecrUri = `${accountId}.dkr.ecr.${destRegion}.${ecrUrlSuffix(destRegion)}/${repositoryName}:${imageTag}`;
 			this.logger.debug(`Publishing Docker image ${asset.displayName || assetHash} → ${ecrUri}`);
 			const client = new ECRClient({
-				...awsClientDefaults(),
+				...ambientClientDefaults(),
 				region: destRegion
 			});
 			try {
@@ -9779,7 +9882,7 @@ var DockerAssetPublisher = class {
 			const destRegion = dest.region ? this.resolvePlaceholders(dest.region, accountId, region) : region;
 			const ecrUri = `${accountId}.dkr.ecr.${destRegion}.${ecrUrlSuffix(destRegion)}/${repositoryName}:${imageTag}`;
 			const client = new ECRClient({
-				...awsClientDefaults(),
+				...ambientClientDefaults(),
 				region: destRegion
 			});
 			try {
@@ -11322,7 +11425,7 @@ var AssetPublisher = class {
 			if (!accountId) {
 				const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 				const stsClient = new STSClient({
-					...awsClientDefaults(),
+					...ambientClientDefaults(),
 					region
 				});
 				accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
@@ -26557,7 +26660,8 @@ function applyCallerIdentityCredentials(env) {
 //#endregion
 //#region src/utils/role-arn.ts
 /**
-* Process-lifetime cache of assumed credentials keyed by RoleArn.
+* Process-lifetime cache of assumed credentials keyed by RoleArn AND the
+* SOURCE identity the `sts:AssumeRole` hop runs as.
 *
 * Storing the in-flight `Promise` (rather than the resolved value) collapses
 * concurrent first-time callers into a single `sts:AssumeRole` request. After
@@ -26565,10 +26669,19 @@ function applyCallerIdentityCredentials(env) {
 * stack that references the same producer N times via `Fn::GetStackOutput`
 * only pays the STS hop once.
 *
-* The cache is keyed by RoleArn alone (not RoleArn + region) because STS
-* credentials are global — assumed credentials work against any region's
-* service endpoint. The downstream S3 client built from these credentials
-* picks its own region via `GetBucketLocation`.
+* Not keyed by region, because STS credentials are global — assumed
+* credentials work against any region's service endpoint. The downstream S3
+* client built from these credentials picks its own region via
+* `GetBucketLocation`.
+*
+* KEYED BY THE SOURCE IDENTITY TOO (issue
+* [#3588](https://github.com/go-to-k/cdkd/issues/3588)): the hop runs as the
+* ACTIVE `AwsClients`' credential configuration, and a library caller can
+* install (`setAwsClients`) two different explicit credentials in one process,
+* as can cdkd's own per-stack scopes. Keyed by RoleArn alone, the second would be handed
+* credentials the FIRST identity obtained — a role the second one may not even
+* be trusted to assume. The source half is `credentialFingerprint`'s (profile +
+* access key id, never secret material).
 *
 * **Expiration handling**: on every cache hit, the cached credentials'
 * `expiration` is compared against `Date.now()` with a 60-second safety
@@ -26628,7 +26741,7 @@ function parseIamRoleArn(roleArn) {
 * the consumer account's normal credentials). Threading the credentials
 * through a fresh `S3Client` via this helper keeps the scope narrow.
 *
-* **Why cache per-RoleArn for the process lifetime.** A multi-resource
+* **Why cache per RoleArn (and source identity) for the process lifetime.** A multi-resource
 * stack typically references `Fn::GetStackOutput` from many template sites
 * (every IAM policy / Lambda env / ALB listener that pulls a shared VPC ID
 * from a platform stack). Assuming the role once per deploy is sufficient;
@@ -26651,17 +26764,19 @@ function parseIamRoleArn(roleArn) {
 * uniformly), but the next caller after rejection gets a clean slate.
 */
 async function assumeRoleForCrossAccountStateRead(roleArn) {
-	const cached = crossAccountCredentialsCache.get(roleArn);
+	const sourceConfig = ambientCredentialConfig();
+	const cacheKey = JSON.stringify([credentialFingerprint(sourceConfig), roleArn]);
+	const cached = crossAccountCredentialsCache.get(cacheKey);
 	if (cached) {
 		const cachedCreds = await cached;
 		if (!cachedCreds.expiration || Date.now() < cachedCreds.expiration.getTime() - CRED_EXPIRY_SAFETY_MS) return cachedCreds;
-		crossAccountCredentialsCache.delete(roleArn);
+		crossAccountCredentialsCache.delete(cacheKey);
 	}
 	const promise = (async () => {
 		const logger = getLogger().child("role-arn");
 		const displayRoleArn = displayIdent(roleArn, { maxCodePoints: 613 });
 		logger.debug(`Assuming role for cross-account state read: ${displayRoleArn}`);
-		const sts = new STSClient({ ...awsClientDefaults() });
+		const sts = new STSClient({ ...clientDefaultsFor(sourceConfig) });
 		try {
 			let response;
 			try {
@@ -26688,10 +26803,10 @@ async function assumeRoleForCrossAccountStateRead(roleArn) {
 			sts.destroy();
 		}
 	})().catch((err) => {
-		if (crossAccountCredentialsCache.get(roleArn) === promise) crossAccountCredentialsCache.delete(roleArn);
+		if (crossAccountCredentialsCache.get(cacheKey) === promise) crossAccountCredentialsCache.delete(cacheKey);
 		throw err;
 	});
-	crossAccountCredentialsCache.set(roleArn, promise);
+	crossAccountCredentialsCache.set(cacheKey, promise);
 	return promise;
 }
 /**
@@ -28588,7 +28703,7 @@ var WAFv2WebACLProvider = class {
 	])]]);
 	getClient() {
 		if (!this.wafv2Client) this.wafv2Client = new WAFV2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.wafv2Client;
@@ -30012,6 +30127,18 @@ async function allSettledKeepingFirstRejection(promises, onAbandoned) {
 	}
 }
 /**
+* The key for the resolver's per-region SDK client caches ({@link
+* IntrinsicFunctionResolver}'s `cfnClients`, `regionScopedClients` and
+* `serviceDiscoveryClients`): the region PLUS the credential fingerprint of the
+* configuration the cached client was built from (issue
+* [#3588](https://github.com/go-to-k/cdkd/issues/3588)). Encoded through
+* {@link injectiveKey}, so no region or profile spelling can forge another
+* pair's key.
+*/
+function clientCacheKey(region, credentialConfig) {
+	return injectiveKey(region, credentialFingerprint(credentialConfig));
+}
+/**
 * Is `region` safe to build an AWS SDK client from?
 *
 * This is a SECURITY gate, not an AWS region registry, and the distinction
@@ -30493,15 +30620,22 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* foreign region per resolver, versus the ambient clients which are already
 	* created and destroyed per stack by `deploy.ts`.
 	*
-	* KEYED BY REGION ALONE, which means an entry also pins the CREDENTIAL
-	* configuration of whichever ambient instance was current at the first
-	* mismatch for that region. That is sound today because the credential half
-	* is process-wide rather than per-stack: `--profile` comes from one CLI
-	* option and `--role-arn` lands in `process.env`, so every ambient instance
-	* a run installs carries the same one. Widen the key to include
-	* {@link AwsClients.credentialConfig} the moment that stops being true —
-	* per-stack credentials would otherwise let one stack's lookups run under
-	* another's identity, which is a worse bug than the one this cache serves.
+	* KEYED BY REGION AND CREDENTIAL FINGERPRINT ({@link clientCacheKey}, issue
+	* [#3588](https://github.com/go-to-k/cdkd/issues/3588)). An entry pins the
+	* credential configuration of the ambient instance it was derived from, and
+	* that half is process-wide only for the CLI (one `--profile`, one
+	* `--role-arn`): a LIBRARY caller can drive one resolver across two
+	* `setAwsClients` installs (or cdkd's per-stack scopes) with different
+	* explicit credentials, and keyed by region alone the second's lookups ran under the first's
+	* identity. {@link cfnClients} and {@link serviceDiscoveryClients} share the
+	* key for the same reason, and the two CloudFormation fallback memos
+	* ({@link cfnExportsPromises}, {@link cfnStackOutputsCache}) carry the
+	* fingerprint too.
+	*
+	* THE CLIENT HALF IS CLOSED, NOT THE WHOLE CLASS: {@link cachedDynamicReferences}
+	* (keyed by the expression alone) and the PROCESS-GLOBAL account identity
+	* behind `getAccountInfo` still assume one identity per resolver and per
+	* process respectively — a value one identity read is served to the next.
 	*/
 	regionScopedClients = /* @__PURE__ */ new Map();
 	/**
@@ -30568,9 +30702,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	/**
 	* Per-region CloudFormation clients for the cross-stack fallback
 	* lookups (issue #1697). Keyed by region because `Fn::GetStackOutput`
-	* may target a region different from the consumer's deploy region.
+	* may target a region different from the consumer's deploy region, and by
+	* the credential fingerprint for {@link regionScopedClients}' reason.
 	*/
-	cfnClients = {};
+	cfnClients = /* @__PURE__ */ new Map();
 	/**
 	* Memoized full `ListExports` listing for the `Fn::ImportValue`
 	* fallback (issue #1697 review). Without it, EVERY cdkd-miss import
@@ -30582,14 +30717,18 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* deploys. FAILED fetches are not cached (the rejection handler
 	* clears the slot) so a transient throttle does not poison the rest
 	* of the deploy's lookups.
+	*
+	* Keyed by the credential fingerprint (issue #3588): a listing is an answer
+	* one identity was allowed to read, so it is never handed to another.
 	*/
-	cfnExportsPromise;
+	cfnExportsPromises = /* @__PURE__ */ new Map();
 	/**
 	* Memoized per-(region, stack) `DescribeStacks` outputs for the
 	* `Fn::GetStackOutput` fallback (issue #1697 review) — a stack
 	* referencing the same CFn producer N times pays one call. Successful
 	* lookups (including the definitive "stack does not exist" miss) are
-	* cached; lookup FAILURES are evicted so they are retried.
+	* cached; lookup FAILURES are evicted so they are retried. Keyed by the
+	* credential fingerprint as well, for {@link cfnExportsPromises}' reason.
 	*/
 	cfnStackOutputsCache = /* @__PURE__ */ new Map();
 	/**
@@ -30821,11 +30960,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const loggedTarget = targetLogText ?? (targetRegion === this.explicitRegion ? this.explicitRegionLogText : void 0) ?? target;
 		if (!isClientSafeRegion(target)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to build AWS clients for the region '${displaySafe(stripControlChars(loggedTarget)).slice(0, 64)}': it is not a valid AWS region name, and a region is substituted into the AWS service hostname.`));
 		if (typeof ambient.withRegion !== "function") return ambient;
-		const cached = this.regionScopedClients.get(target);
+		const cacheKey = clientCacheKey(target, ambient.credentialConfig ?? {});
+		const cached = this.regionScopedClients.get(cacheKey);
 		if (cached) return cached;
 		if (canonicalizeRegion(ambient.configuredRegion) === target) return ambient;
 		const scoped = ambient.withRegion(target);
-		this.regionScopedClients.set(target, scoped);
+		this.regionScopedClients.set(cacheKey, scoped);
 		this.logger.debug(`Using region-scoped AWS clients for ${displaySafe(loggedTarget)}`);
 		return scoped;
 	}
@@ -30856,21 +30996,21 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* `getAccountInfo`'s in-flight promise and reach here one at a time, which
 	* the case says out loud. A REJECTED import is evicted
 	* so a transient failure does not poison the rest of the deploy, mirroring
-	* `cfnExportsPromise`. Lifetime is the resolver's own, like
+	* `cfnExportsPromises`. Lifetime is the resolver's own, like
 	* {@link regionScopedClients} and {@link cfnClients}: at most one per region
 	* per resolver, versus the one-per-CALL this replaces.
 	*/
 	async serviceDiscoveryClient() {
 		const scoped = this.clientsForRegion(this.explicitRegion);
 		const region = scoped.configuredRegion;
-		const key = region ?? "";
+		const credentialConfig = scoped.credentialConfig ?? {};
+		const key = clientCacheKey(region ?? "", credentialConfig);
 		const cached = this.serviceDiscoveryClients.get(key);
 		if (cached) return cached;
 		const building = (async () => {
 			const { ServiceDiscoveryClient } = await import("@aws-sdk/client-servicediscovery");
 			return new ServiceDiscoveryClient({
-				...awsClientDefaults({ profile: scoped.credentialConfig?.profile }),
-				...scoped.credentialConfig ?? {},
+				...clientDefaultsFor(credentialConfig),
 				...region ? { region } : {}
 			});
 		})();
@@ -33276,12 +33416,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* the same not-found error anyway.
 	*/
 	async lookupCfnExport(exportName, context) {
-		let listing = this.cfnExportsPromise;
+		const listingKey = credentialFingerprint(ambientCredentialConfig());
+		let listing = this.cfnExportsPromises.get(listingKey);
 		if (!listing) {
-			listing = this.fetchAllCfnExports();
-			this.cfnExportsPromise = listing;
-			listing.catch(() => {
-				if (this.cfnExportsPromise === listing) this.cfnExportsPromise = void 0;
+			const fetched = this.fetchAllCfnExports();
+			listing = fetched;
+			this.cfnExportsPromises.set(listingKey, fetched);
+			fetched.catch(() => {
+				if (this.cfnExportsPromises.get(listingKey) === fetched) this.cfnExportsPromises.delete(listingKey);
 			});
 		}
 		try {
@@ -33351,7 +33493,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* contract as {@link lookupCfnExport}.
 	*/
 	async lookupCfnStackOutputs(stackName, region, context, loggedRegionText) {
-		const cacheKey = injectiveKey(region, stackName);
+		const cacheKey = injectiveKey(region, stackName, credentialFingerprint(ambientCredentialConfig()));
 		let fetch = this.cfnStackOutputsCache.get(cacheKey);
 		if (!fetch) {
 			fetch = this.fetchCfnStackOutputs(stackName, region);
@@ -33402,19 +33544,19 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* Not routed through {@link clientsForRegion}: the region here is always
 	* the one the caller named, never the ambient's, and a test double without
 	* `credentialConfig` degrades to the default chain rather than throwing.
-	* Keyed by region alone for the reason {@link regionScopedClients} gives:
-	* the credential half is process-wide.
+	* Keyed by region AND credential fingerprint for the reason
+	* {@link regionScopedClients} gives (issue #3588).
 	*/
 	getCfnClient(region) {
-		let client = this.cfnClients[region];
+		const credentialConfig = ambientCredentialConfig();
+		const key = clientCacheKey(region, credentialConfig);
+		let client = this.cfnClients.get(key);
 		if (!client) {
-			const credentialConfig = getAwsClients().credentialConfig ?? {};
 			client = new CloudFormationClient({
-				...awsClientDefaults({ profile: credentialConfig.profile }),
-				...credentialConfig,
+				...clientDefaultsFor(credentialConfig),
 				region
 			});
-			this.cfnClients[region] = client;
+			this.cfnClients.set(key, client);
 		}
 		return client;
 	}
@@ -36756,7 +36898,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DR5gOGbi.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-Dpki2-Xd.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -37306,7 +37448,7 @@ var CloudControlProvider = class {
 				break;
 			case "AWS::RDS::DBCluster":
 				try {
-					const cluster = (await new RDSClient({ ...awsClientDefaults() }).send(new DescribeDBClustersCommand({ DBClusterIdentifier: physicalId }))).DBClusters?.[0];
+					const cluster = (await new RDSClient({ ...ambientClientDefaults() }).send(new DescribeDBClustersCommand({ DBClusterIdentifier: physicalId }))).DBClusters?.[0];
 					if (cluster) {
 						if (cluster.Endpoint) enriched["Endpoint.Address"] = cluster.Endpoint;
 						if (cluster.Port !== void 0) enriched["Endpoint.Port"] = String(cluster.Port);
@@ -37321,7 +37463,7 @@ var CloudControlProvider = class {
 				break;
 			case "AWS::RDS::DBInstance":
 				try {
-					const inst = (await new RDSClient({ ...awsClientDefaults() }).send(new DescribeDBInstancesCommand({ DBInstanceIdentifier: physicalId }))).DBInstances?.[0];
+					const inst = (await new RDSClient({ ...ambientClientDefaults() }).send(new DescribeDBInstancesCommand({ DBInstanceIdentifier: physicalId }))).DBInstances?.[0];
 					if (inst) {
 						if (inst.Endpoint?.Address) enriched["Endpoint.Address"] = inst.Endpoint.Address;
 						if (inst.Endpoint?.Port !== void 0) enriched["Endpoint.Port"] = String(inst.Endpoint.Port);
@@ -37475,7 +37617,7 @@ var CloudControlProvider = class {
 				break;
 			case "AWS::ElastiCache::ReplicationGroup":
 				try {
-					const rg = (await new ElastiCacheClient({ ...awsClientDefaults() }).send(new DescribeReplicationGroupsCommand({ ReplicationGroupId: physicalId }))).ReplicationGroups?.[0];
+					const rg = (await new ElastiCacheClient({ ...ambientClientDefaults() }).send(new DescribeReplicationGroupsCommand({ ReplicationGroupId: physicalId }))).ReplicationGroups?.[0];
 					if (rg) {
 						const primaryNode = rg.NodeGroups?.[0];
 						if (primaryNode?.PrimaryEndpoint?.Address) enriched["PrimaryEndPoint.Address"] = primaryNode.PrimaryEndpoint.Address;
@@ -37497,7 +37639,7 @@ var CloudControlProvider = class {
 				break;
 			case "AWS::Redshift::Cluster":
 				try {
-					const cluster = (await new RedshiftClient({ ...awsClientDefaults() }).send(new DescribeClustersCommand({ ClusterIdentifier: physicalId }))).Clusters?.[0];
+					const cluster = (await new RedshiftClient({ ...ambientClientDefaults() }).send(new DescribeClustersCommand({ ClusterIdentifier: physicalId }))).Clusters?.[0];
 					if (cluster?.Endpoint) {
 						if (cluster.Endpoint.Address) enriched["Endpoint.Address"] = cluster.Endpoint.Address;
 						if (cluster.Endpoint.Port !== void 0) enriched["Endpoint.Port"] = String(cluster.Endpoint.Port);
@@ -37509,7 +37651,7 @@ var CloudControlProvider = class {
 				break;
 			case "AWS::OpenSearchService::Domain":
 				try {
-					const domain = (await new OpenSearchClient({ ...awsClientDefaults() }).send(new DescribeDomainCommand({ DomainName: physicalId }))).DomainStatus;
+					const domain = (await new OpenSearchClient({ ...ambientClientDefaults() }).send(new DescribeDomainCommand({ DomainName: physicalId }))).DomainStatus;
 					if (domain) {
 						const endpoint = domain.Endpoint ?? domain.Endpoints?.["vpc"];
 						if (endpoint) enriched["DomainEndpoint"] = endpoint;
@@ -44746,8 +44888,11 @@ async function planOrphanAdoption(params) {
 	const claims = async () => siblingClaims ??= await params.readSiblingClaims();
 	for (const record of params.records) {
 		const { logicalId, state } = record;
+		const shownId = displayIdent(logicalId);
+		const shownType = displayIdent(state.resourceType);
+		const shownPhysicalId = displaySafe(state.physicalId);
 		if (params.managedLogicalIds.has(logicalId)) {
-			params.logger.debug(`orphan ${logicalId}: already present in state.resources — dropping the stale record`);
+			params.logger.debug(`orphan ${shownId}: already present in state.resources — dropping the stale record`);
 			continue;
 		}
 		let provider;
@@ -44755,12 +44900,12 @@ async function planOrphanAdoption(params) {
 			provider = params.getProvider(state.resourceType, state.provisionedBy);
 		} catch (error) {
 			outcome.remaining.push(record);
-			outcome.notices.push(`${logicalId} (${state.resourceType}) is still in AWS as ${state.physicalId} from an earlier rollback, but this build cannot route that type (${error instanceof Error ? error.message : String(error)}) — cdkd is not adopting it.`);
+			outcome.notices.push(`${shownId} (${shownType}) is still in AWS as ${shownPhysicalId} from an earlier rollback, but this build cannot route that type (${displayAwsMessage(error instanceof Error ? error.message : String(error))}) — cdkd is not adopting it.`);
 			continue;
 		}
 		if (!provider.import) {
 			outcome.remaining.push(record);
-			outcome.notices.push(`${logicalId} (${state.resourceType}) was left in AWS by an earlier rollback as ${state.physicalId}, but its provider cannot verify it — cdkd is not adopting it.`);
+			outcome.notices.push(`${shownId} (${shownType}) was left in AWS by an earlier rollback as ${shownPhysicalId}, but its provider cannot verify it — cdkd is not adopting it.`);
 			continue;
 		}
 		let found;
@@ -44774,32 +44919,32 @@ async function planOrphanAdoption(params) {
 				knownPhysicalId: state.physicalId
 			});
 		} catch (error) {
-			outcome.notices.push(`${logicalId} (${state.resourceType}) is recorded as left in AWS as ${state.physicalId}, but cdkd could not confirm it exists (${error instanceof Error ? error.message : String(error)}) — keeping the record and not adopting it this run.`);
+			outcome.notices.push(`${shownId} (${shownType}) is recorded as left in AWS as ${shownPhysicalId}, but cdkd could not confirm it exists (${displayAwsMessage(error instanceof Error ? error.message : String(error))}) — keeping the record and not adopting it this run.`);
 			outcome.remaining.push(record);
 			continue;
 		}
 		if (found !== null && found.physicalId !== state.physicalId) {
 			outcome.remaining.push(record);
-			outcome.notices.push(`${logicalId} (${state.resourceType}): cdkd asked about ${state.physicalId} and its provider answered for ${found.physicalId} — not adopting.`);
+			outcome.notices.push(`${shownId} (${shownType}): cdkd asked about ${shownPhysicalId} and its provider answered for ${displaySafe(found.physicalId)} — not adopting.`);
 			continue;
 		}
 		if (found === null) {
-			params.logger.debug(`orphan ${logicalId}: ${state.physicalId} no longer exists in AWS — dropping the record`);
+			params.logger.debug(`orphan ${shownId}: ${shownPhysicalId} no longer exists in AWS — dropping the record`);
 			continue;
 		}
 		if (params.nameProperties(state.resourceType).length === 0 || ADOPTION_REFUSED_TYPES.has(state.resourceType)) {
 			outcome.remaining.push(record);
 			const why = ADOPTION_REFUSED_TYPES.has(state.resourceType) ? "a new deploy of it mints a new resource rather than colliding, and cdkd cannot update one in place — so adopting it would end in a replacement that destroys what DeletionPolicy: Retain preserved" : "cdkd does not derive that resource's physical name, so a new deploy mints a new resource instead of colliding";
-			outcome.notices.push(`${logicalId} (${state.resourceType}) is still in AWS as ${state.physicalId} from an earlier rollback. cdkd does not re-adopt this type: ${why}. Delete it yourself when you no longer need it.`);
+			outcome.notices.push(`${shownId} (${shownType}) is still in AWS as ${shownPhysicalId} from an earlier rollback. cdkd does not re-adopt this type: ${why}. Delete it yourself when you no longer need it.`);
 			continue;
 		}
 		if (!templateStillDeclares(params.template, record, params.nameProperties(state.resourceType))) {
 			outcome.remaining.push(record);
-			outcome.notices.push(`${logicalId} (${state.resourceType}) is still in AWS as ${state.physicalId} from an earlier rollback. This deploy does not create it under that name, so cdkd is leaving it alone.`);
+			outcome.notices.push(`${shownId} (${shownType}) is still in AWS as ${shownPhysicalId} from an earlier rollback. This deploy does not create it under that name, so cdkd is leaving it alone.`);
 			continue;
 		}
 		if ((await claims()).has(state.physicalId)) {
-			outcome.refusals.push(`${logicalId}: ${state.physicalId} is already recorded by another cdkd stack. cdkd will not adopt a resource another stack manages.`);
+			outcome.refusals.push(`${shownId}: ${shownPhysicalId} is already recorded by another cdkd stack. cdkd will not adopt a resource another stack manages.`);
 			outcome.remaining.push(record);
 			continue;
 		}
@@ -44852,7 +44997,7 @@ function makeSiblingClaimReader(params) {
 		try {
 			refs = await stateBackend.listStacks();
 		} catch (error) {
-			logger.debug(`orphan adoption: could not list sibling stacks — ${error instanceof Error ? error.message : String(error)}`);
+			logger.debug(`orphan adoption: could not list sibling stacks — ${displayAwsMessage(error instanceof Error ? error.message : String(error))}`);
 			return claimed;
 		}
 		for (const ref of refs) {
@@ -44862,7 +45007,7 @@ function makeSiblingClaimReader(params) {
 				const sibling = await stateBackend.getState(ref.stackName, ref.region);
 				for (const record of Object.values(sibling?.state.resources ?? {})) claimed.add(record.physicalId);
 			} catch (error) {
-				logger.debug(`orphan adoption: skipping unreadable state for ${ref.stackName} — ${error instanceof Error ? error.message : String(error)}`);
+				logger.debug(`orphan adoption: skipping unreadable state for ${displayStackName(ref.stackName)} — ${displayAwsMessage(error instanceof Error ? error.message : String(error))}`);
 			}
 		}
 		return claimed;
@@ -50785,7 +50930,7 @@ var DeployEngine = class DeployEngine {
 		if (plan.refusals.length > 0) throw new Error(`Deploy refused — cdkd left ${plan.refusals.length} resource(s) in AWS that it cannot safely re-adopt:\n  ${plan.refusals.join("\n  ")}`);
 		for (const [logicalId, record] of Object.entries(plan.adopted)) {
 			currentState.resources[logicalId] = record;
-			this.logger.info(`Adopting ${logicalId} (${record.resourceType}) left in AWS by an earlier rollback as ${record.physicalId}`);
+			this.logger.info(`Adopting ${displayIdent(logicalId)} (${displayIdent(record.resourceType)}) left in AWS by an earlier rollback as ${displaySafe(record.physicalId)}`);
 		}
 		if (records.length > 0) currentState.orphans = plan.remaining;
 		return plan;
@@ -52252,5 +52397,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, NestedStackChildDirectDestroyError as $a, resolveSkipPrefix as $i, refuseMalformedOutputsForDestroy as $n, hasReadableExportSet as $r, readConfigString as $t, createPreDeleteFinalSnapshot as A, absoluteAssemblyPathEscape as Aa, describeDockerFailure as Ai, malformedExportSourceWarning as An, identityKeyFor as Ar, disableInstanceApiTermination as At, isStatefulRecreateTargetSync as B, setAwsClients as Ba, runDockerStreaming as Bi, malformedResourceEntriesWarning as Bn, redactSecretsForState as Br, isUnboundTemplateParameter as Bt, namesAnyDeclaredParameter as C, globMatches as Ca, validateAssetBucketName as Ci, displayLogicalId as Cn, __exportAll as Co, STATE_SOURCED_CROSS_GENERATION_RULES as Cr, CloudControlProvider as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, hasPlainPrototype$1 as Da, resolveDockerContextDirectory as Di, isReadableOrphanRecord as Dn, createSecretMasker as Dr, deleteIndeterminateGuards as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, hasOwnKey as Ea, buildDockerImage as Ei, hasReadableResources as En, carriesSecretMask as Er, UNSPECIFIED_SKIP_REASON as Et, extractDeploymentEventError as F, resolveBucketRegion as Fa, isDockerClientEnvKey as Fi, malformedOrphansRefusalMessage as Fn, maskSecretsInText as Fr, cfnRefValueFromPhysicalId as Ft, toCfnInteger as G, DependencyError as Ga, getDockerImageBySourceHash as Gi, refuseDivergentRecordRegionForDestroy as Gn, UNREPRODUCIBLE_LOCK_CLAUSE as Gr, normalizeAwsTagsToCfn as Gt, WARM_THROUGHPUT_MEMBERS as H, CdkdError as Ha, escapeRegExp$1 as Hi, malformedResourcesWarning as Hn, LockManager as Hr, refStateLookupFromResource as Ht, makeSiblingClaimReader as I, AwsClients as Ia, isMalformedEnvKey as Ii, malformedOrphansWarning as In, pathCrossesDottedKey as Ir, coerceParameterTypedValue as It, bold as J, IntrinsicResolutionRefusalError as Ja, getDefaultStateBucketName as Ji, refuseMalformedOrphanRecordsForDestroy as Jn, forceQuitRecoveryClause as Jr, coerceCfnBoolean as Jt, toFiniteNumber as K, DeployCancelledError as Ka, Synthesizer as Ki, refuseMalformedNestedChildOutputs as Kn, buildForceUnlockCommand as Kr, resolveExplicitPhysicalId as Kt, planOrphanAdoption as L, getAwsClients as La, partitionSensitiveEnv as Li, malformedOutputsRefusalMessage as Ln, recordMaskOnlyValue as Lr, getAccountInfo as Lt, refusesFinalSnapshot as M, renderAssemblyPathEscape as Ma, finchSecretArgvRefusal as Mi, malformedOrphanRecordsRefusalMessage as Mn, isUncertifiedBaselineMaskPosition as Mr, IntrinsicFunctionResolver as Mt, unsupportedFinalSnapshotError as N, resolveAssemblyPath as Na, formatDockerLoginError as Ni, malformedOrphanRecordsWarning as Nn, markSameGenerationBag as Nr, carriesDynamicReference as Nt, buildFinalSnapshotIdentifier as O, nullPrototypeRecord as Oa, describeDockerCapturedOutput as Oi, isReadableResourceEntry as On, dynamicReferenceTokens as Or, deleteSkipReason as Ot, makeCanonicalizePropertiesFn as P, clearBucketRegionCache as Pa, getDockerCmd as Pi, malformedOrphanRowsKeptWarning as Pn, maskSecretsInError as Pr, carriesFetchableDynamicReference as Pt, red as Q, MalformedProducerRecordRefusalError as Qa, resolveCaptureObservedState as Qi, refuseMalformedOutputs as Qn, exportNamesCarriedFrom as Qr, configStringRefusal as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, resetAwsClients as Ra, redactDockerArgvValues as Ri, malformedOutputsWarning as Rn, recordMaskOnlyValuesIn as Rr, isImpossibleEmptyStoredAttribute as Rt, computeParameterTaint as S, failedStageNote as Sa, readBootstrapMarkerBody as Si, deployRefusesOrphanRowsReason as Sn, safeStringify$1 as So, STATE_SOURCED_BASELINE_RULES as Sr, startInterruptWatch as St, resourcesNamingDeclaredParameter as T, defineOwnKey as Ta, buildDenyExternalAccessPolicy as Ti, hasReadableOutputs as Tn, TEMPLATE_SOURCED_RULES as Tr, ccProtectionRegistryTypes as Tt, coerceWarmThroughput as U, ConfigError as Ua, stripControlChars as Ui, malformedStateRefusalMessage as Un, S3StateBackend as Ur, isSettledInstanceState as Ut, renderStatefulReason as V, AssetError as Va, warnFinchArgvExposure as Vi, malformedResourcePropertiesWarning as Vn, scrubResourceRecord as Vr, parameterTypeMayLoseSecretIdentity as Vt, isWarmThroughputDecrease as W, CrossAccountSecretRefusalError as Wa, AssetManifestLoader as Wi, previewableOrphanRecords as Wn, rebuildClientForBucketRegion as Wr, WAFv2WebACLProvider as Wt, gray as X, LocalStartServiceError as Xa, resolveApp as Xi, refuseMalformedOrphansForDestroy as Xn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Xr, configBooleanRefusal as Xt, cyan as Y, LocalInvokeBuildError as Ya, getLegacyStateBucketName as Yi, refuseMalformedOrphans as Yn, formatLockExpiry as Yr, coerceCfnInteger as Yt, green as Z, LockError as Za, resolveAutoAssetStorage as Zi, refuseMalformedOrphansForOrphan as Zn, DEFAULT_STATE_PREFIX as Zr, configIntegerRefusal as Zt, bagHoldsSecretExpression as _, expectedOwnerParam as _a, assertAssetBucketRegion as _i, DiffCalculator as _n, isTransientServerError as _o, findSilentDropProperties as _r, maskerOrIdentity as _t, DeploymentEventsStore as a, ssmResolvedValueType as aa, orphansAfterRollback as ai, producerRegionsFromState as an, StackTerminationProtectionError as ao, refuseMalformedState as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, derivePartitionAndUrlSuffix as ba, isCrossRegionRedirect as bi, UNREADABLE_ORPHANS_CONTAINER_ROW as bn, retryClassificationText as bo, DagBuilder as br, interruptWatchListenerCount as bt, replayFailedOperations as c, MIGRATE_TMP_PREFIX as ca, AssetPublisher as ci, s3BucketDomainName as cn, formatError as co, repairMalformedOutputsForReadOnly as cr, IAMRoleProvider as ct, updatePartialMessage as d, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as da, buildAssetRedirectMap as di, s3BucketWebsiteUrl as dn, withErrorHandling as do, repairMalformedResourcesForReadOnly as dr, definedAttributes as dt, resolveStateBucketWithDefault as ea, hasReasonlessBaselineRefusal as ei, replayWarn as en, PartialFailureError as eo, refuseMalformedResourceAttributesForOrphan as er, collectDeclaredOutputNames as et, updatePartialReason as f, injectiveKey as fa, createAssetRedirectResolver as fi, applyRoleArnIfSet as fn, pasteableCommand as fo, safeRegion as fr, stringifyIfAssigned as ft, computeImplicitDeleteEdges as g, decodeListingKey as ga, BOOTSTRAP_MARKER_PREFIX as gi, envCredentialsAreAssumedRole as gn, isThrottlingError as go, findActionableSilentDrops as gr, maskDeep as gt, IMPLICIT_DELETE_DEPENDENCIES as h, producerRecordKey as ha, AssetModeResolver as hi, callerEnvCredentials as hn, isRetryableTransientError as ho, unreadableOrphanRecords as hr, createMaskedRetryLogger as ht, DeploymentEventsReader as i, warnDeprecatedNoPrefixCliFlag as ia, isReadableBag as ii, classifyReplaySecretRegion as in, StackHasActiveImportsError as io, refuseMalformedResourcesForDestroy as ir, secretBearing as it, isFinalSnapshotError as j, displayAssemblyPath as ja, dockerSpawnEnvWithSensitive as ji, malformedLocalOutputsWarning as jn, isSingleDynamicReferenceToken as jr, isTerminationProtectionPropagationError as jt, ccRoutedFinalSnapshotError as k, ownValue as ka, describeDockerExecFailure as ki, malformedExportNamesWarning as kn, errorCauseChain as kr, isWaitAbandonedError as kt, replayRollback as l, findLargeInlineResources as la, stringifyValue as li, s3BucketDualStackDomainName as ln, isCdkdError as lo, repairMalformedResourceEntriesForReadOnly as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, producerCoordinateKey as ma, rewriteTemplateAssetReferences as mi, applyCallerIdentityCredentials as mn, isMarkedNonRetryable as mo, unpreviewableOrphanRecords as mr, wouldReturnToSdkProvider as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveUseCdkBootstrapAssets as na, importableOutputKeys as ni, requireConfigObject as nn, ResourceTimeoutError as no, refuseMalformedResourceEntriesForOrphan as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, CFN_TEMPLATE_BODY_LIMIT as oa, orphansCarriedFrom as oi, withSharedDrainBudget as on, StateError as oo, repairMalformedOrphanRecordsForReadOnly as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, injectiveKeyPrefix as pa, loadPublishableAssetManifest as pi, AWS_CREDENTIAL_ENV_KEYS as pn, shellQuote as po, safeStackName as pr, ProviderRegistry as pt, formatResourceLine as q, DynamicReferenceRegionAmbiguousError as qa, synthesisStatusMessage as qi, refuseMalformedOrphanRecords as qn, buildLockContentionMessage as qr, assertRegionMatch as qt, DeployEngine as r, stateBucketExistenceConfirmed as ra, importableOutputs as ri, requireConfigString as rn, ResourceUpdateNotSupportedError as ro, refuseMalformedResourcePropertiesForOrphan as rr, isExportAliasCollision as rt, planRollback as s, CFN_TEMPLATE_URL_LIMIT as sa, shouldRetainResource as si, s3BucketArn as sn, SynthesisError as so, repairMalformedOrphansForReadOnly as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveStateBucketWithDefaultAndSource as ta, hasUnverifiableParameterRefusal as ti, requireConfigArray as tn, ProvisioningError as to, refuseMalformedResourceEntries as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, uploadCfnTemplate as ua, WorkGraph as ui, s3BucketRegionalDomainName as un, normalizeAwsError as uo, repairMalformedResourcePropertiesForReadOnly as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, PARTITION_TABLE as va, ensureAssetStorage as vi, INTRINSIC_KEYS as vn, markNonRetryable as vo, describeTypeWithThrottleRetry as vr, beginCommandInterruptScope as vt, reachableDivergentParameters as w, processStackMessages as wa, validateContainerRepoName as wi, hasReadableOrphans as wn, STATE_SOURCED_READBACK_RULES as wr, slowCcOperationTimeoutMs as wt, bindingSkippedOutputs as x, AssemblyReader as xa, parseBootstrapMarker as xi, UNREADABLE_RESOURCES_MAP_ROW as xn, describeAwsFailure as xo, TemplateParser as xr, isInterruptedWaitError as xt, keptWholeReasonText as y, canonicalizeRegion as ya, getBootstrapMarkerKey as yi, STATE_RESOURCES_MALFORMED as yn, markRedactedCause as yo, withRetry as yr, endCommandInterruptScope as yt, isStatefulRecreateTargetForReplace as z, runWithStackAwsClients as za, runDockerForeground as zi, malformedRenderedContainersWarning as zn, recoverMaskedOutput as zr, isNamelessDynamicReferenceError as zt };
-//# sourceMappingURL=deploy-engine-BwDlgFRs.js.map
+export { yellow as $, MalformedProducerRecordRefusalError as $a, resolveSkipPrefix as $i, refuseMalformedOutputsForDestroy as $n, hasReadableExportSet as $r, readConfigString as $t, createPreDeleteFinalSnapshot as A, ownValue as Aa, describeDockerFailure as Ai, malformedExportSourceWarning as An, identityKeyFor as Ar, disableInstanceApiTermination as At, isStatefulRecreateTargetSync as B, runWithStackAwsClients as Ba, runDockerStreaming as Bi, malformedResourceEntriesWarning as Bn, redactSecretsForState as Br, isUnboundTemplateParameter as Bt, namesAnyDeclaredParameter as C, failedStageNote as Ca, validateAssetBucketName as Ci, displayLogicalId as Cn, safeStringify$1 as Co, STATE_SOURCED_CROSS_GENERATION_RULES as Cr, CloudControlProvider as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, hasOwnKey as Da, resolveDockerContextDirectory as Di, isReadableOrphanRecord as Dn, createSecretMasker as Dr, deleteIndeterminateGuards as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, defineOwnKey as Ea, buildDockerImage as Ei, hasReadableResources as En, carriesSecretMask as Er, UNSPECIFIED_SKIP_REASON as Et, extractDeploymentEventError as F, clearBucketRegionCache as Fa, isDockerClientEnvKey as Fi, malformedOrphansRefusalMessage as Fn, maskSecretsInText as Fr, cfnRefValueFromPhysicalId as Ft, toCfnInteger as G, CrossAccountSecretRefusalError as Ga, getDockerImageBySourceHash as Gi, refuseDivergentRecordRegionForDestroy as Gn, UNREPRODUCIBLE_LOCK_CLAUSE as Gr, normalizeAwsTagsToCfn as Gt, WARM_THROUGHPUT_MEMBERS as H, AssetError as Ha, escapeRegExp$1 as Hi, malformedResourcesWarning as Hn, LockManager as Hr, refStateLookupFromResource as Ht, makeSiblingClaimReader as I, resolveBucketRegion as Ia, isMalformedEnvKey as Ii, malformedOrphansWarning as In, pathCrossesDottedKey as Ir, coerceParameterTypedValue as It, bold as J, DynamicReferenceRegionAmbiguousError as Ja, getDefaultStateBucketName as Ji, refuseMalformedOrphanRecordsForDestroy as Jn, forceQuitRecoveryClause as Jr, coerceCfnBoolean as Jt, toFiniteNumber as K, DependencyError as Ka, Synthesizer as Ki, refuseMalformedNestedChildOutputs as Kn, buildForceUnlockCommand as Kr, resolveExplicitPhysicalId as Kt, planOrphanAdoption as L, AwsClients as La, partitionSensitiveEnv as Li, malformedOutputsRefusalMessage as Ln, recordMaskOnlyValue as Lr, getAccountInfo as Lt, refusesFinalSnapshot as M, displayAssemblyPath as Ma, finchSecretArgvRefusal as Mi, malformedOrphanRecordsRefusalMessage as Mn, isUncertifiedBaselineMaskPosition as Mr, IntrinsicFunctionResolver as Mt, unsupportedFinalSnapshotError as N, renderAssemblyPathEscape as Na, formatDockerLoginError as Ni, malformedOrphanRecordsWarning as Nn, markSameGenerationBag as Nr, carriesDynamicReference as Nt, buildFinalSnapshotIdentifier as O, hasPlainPrototype$1 as Oa, describeDockerCapturedOutput as Oi, isReadableResourceEntry as On, dynamicReferenceTokens as Or, deleteSkipReason as Ot, makeCanonicalizePropertiesFn as P, resolveAssemblyPath as Pa, getDockerCmd as Pi, malformedOrphanRowsKeptWarning as Pn, maskSecretsInError as Pr, carriesFetchableDynamicReference as Pt, red as Q, LockError as Qa, resolveCaptureObservedState as Qi, refuseMalformedOutputs as Qn, exportNamesCarriedFrom as Qr, configStringRefusal as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, getAwsClients as Ra, redactDockerArgvValues as Ri, malformedOutputsWarning as Rn, recordMaskOnlyValuesIn as Rr, isImpossibleEmptyStoredAttribute as Rt, computeParameterTaint as S, AssemblyReader as Sa, readBootstrapMarkerBody as Si, deployRefusesOrphanRowsReason as Sn, describeAwsFailure as So, STATE_SOURCED_BASELINE_RULES as Sr, startInterruptWatch as St, resourcesNamingDeclaredParameter as T, processStackMessages as Ta, buildDenyExternalAccessPolicy as Ti, hasReadableOutputs as Tn, TEMPLATE_SOURCED_RULES as Tr, ccProtectionRegistryTypes as Tt, coerceWarmThroughput as U, CdkdError as Ua, stripControlChars as Ui, malformedStateRefusalMessage as Un, S3StateBackend as Ur, isSettledInstanceState as Ut, renderStatefulReason as V, setAwsClients as Va, warnFinchArgvExposure as Vi, malformedResourcePropertiesWarning as Vn, scrubResourceRecord as Vr, parameterTypeMayLoseSecretIdentity as Vt, isWarmThroughputDecrease as W, ConfigError as Wa, AssetManifestLoader as Wi, previewableOrphanRecords as Wn, rebuildClientForBucketRegion as Wr, WAFv2WebACLProvider as Wt, gray as X, LocalInvokeBuildError as Xa, resolveApp as Xi, refuseMalformedOrphansForDestroy as Xn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Xr, configBooleanRefusal as Xt, cyan as Y, IntrinsicResolutionRefusalError as Ya, getLegacyStateBucketName as Yi, refuseMalformedOrphans as Yn, formatLockExpiry as Yr, coerceCfnInteger as Yt, green as Z, LocalStartServiceError as Za, resolveAutoAssetStorage as Zi, refuseMalformedOrphansForOrphan as Zn, DEFAULT_STATE_PREFIX as Zr, configIntegerRefusal as Zt, bagHoldsSecretExpression as _, expectedOwnerParam as _a, assertAssetBucketRegion as _i, DiffCalculator as _n, isThrottlingError as _o, findSilentDropProperties as _r, maskerOrIdentity as _t, DeploymentEventsStore as a, ssmResolvedValueType as aa, orphansAfterRollback as ai, producerRegionsFromState as an, StackHasActiveImportsError as ao, refuseMalformedState as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, derivePartitionAndUrlSuffix as ba, isCrossRegionRedirect as bi, UNREADABLE_ORPHANS_CONTAINER_ROW as bn, markRedactedCause as bo, DagBuilder as br, interruptWatchListenerCount as bt, replayFailedOperations as c, MIGRATE_TMP_PREFIX as ca, AssetPublisher as ci, s3BucketDomainName as cn, SynthesisError as co, repairMalformedOutputsForReadOnly as cr, IAMRoleProvider as ct, updatePartialMessage as d, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as da, buildAssetRedirectMap as di, s3BucketWebsiteUrl as dn, normalizeAwsError as do, repairMalformedResourcesForReadOnly as dr, definedAttributes as dt, resolveStateBucketWithDefault as ea, hasReasonlessBaselineRefusal as ei, replayWarn as en, NestedStackChildDirectDestroyError as eo, refuseMalformedResourceAttributesForOrphan as er, collectDeclaredOutputNames as et, updatePartialReason as f, injectiveKey as fa, createAssetRedirectResolver as fi, applyRoleArnIfSet as fn, withErrorHandling as fo, safeRegion as fr, stringifyIfAssigned as ft, computeImplicitDeleteEdges as g, decodeListingKey as ga, BOOTSTRAP_MARKER_PREFIX as gi, envCredentialsAreAssumedRole as gn, isRetryableTransientError as go, findActionableSilentDrops as gr, maskDeep as gt, IMPLICIT_DELETE_DEPENDENCIES as h, producerRecordKey as ha, AssetModeResolver as hi, callerEnvCredentials as hn, isMarkedNonRetryable as ho, unreadableOrphanRecords as hr, createMaskedRetryLogger as ht, DeploymentEventsReader as i, warnDeprecatedNoPrefixCliFlag as ia, isReadableBag as ii, classifyReplaySecretRegion as in, ResourceUpdateNotSupportedError as io, refuseMalformedResourcesForDestroy as ir, secretBearing as it, isFinalSnapshotError as j, absoluteAssemblyPathEscape as ja, dockerSpawnEnvWithSensitive as ji, malformedLocalOutputsWarning as jn, isSingleDynamicReferenceToken as jr, isTerminationProtectionPropagationError as jt, ccRoutedFinalSnapshotError as k, nullPrototypeRecord as ka, describeDockerExecFailure as ki, malformedExportNamesWarning as kn, errorCauseChain as kr, isWaitAbandonedError as kt, replayRollback as l, findLargeInlineResources as la, stringifyValue as li, s3BucketDualStackDomainName as ln, formatError as lo, repairMalformedResourceEntriesForReadOnly as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, producerCoordinateKey as ma, rewriteTemplateAssetReferences as mi, applyCallerIdentityCredentials as mn, shellQuote as mo, unpreviewableOrphanRecords as mr, wouldReturnToSdkProvider as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveUseCdkBootstrapAssets as na, importableOutputKeys as ni, requireConfigObject as nn, ProvisioningError as no, refuseMalformedResourceEntriesForOrphan as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, CFN_TEMPLATE_BODY_LIMIT as oa, orphansCarriedFrom as oi, withSharedDrainBudget as on, StackTerminationProtectionError as oo, repairMalformedOrphanRecordsForReadOnly as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, injectiveKeyPrefix as pa, loadPublishableAssetManifest as pi, AWS_CREDENTIAL_ENV_KEYS as pn, pasteableCommand as po, safeStackName as pr, ProviderRegistry as pt, formatResourceLine as q, DeployCancelledError as qa, synthesisStatusMessage as qi, refuseMalformedOrphanRecords as qn, buildLockContentionMessage as qr, assertRegionMatch as qt, DeployEngine as r, stateBucketExistenceConfirmed as ra, importableOutputs as ri, requireConfigString as rn, ResourceTimeoutError as ro, refuseMalformedResourcePropertiesForOrphan as rr, isExportAliasCollision as rt, planRollback as s, CFN_TEMPLATE_URL_LIMIT as sa, shouldRetainResource as si, s3BucketArn as sn, StateError as so, repairMalformedOrphansForReadOnly as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveStateBucketWithDefaultAndSource as ta, hasUnverifiableParameterRefusal as ti, requireConfigArray as tn, PartialFailureError as to, refuseMalformedResourceEntries as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, uploadCfnTemplate as ua, WorkGraph as ui, s3BucketRegionalDomainName as un, isCdkdError as uo, repairMalformedResourcePropertiesForReadOnly as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, PARTITION_TABLE as va, ensureAssetStorage as vi, INTRINSIC_KEYS as vn, isTransientServerError as vo, describeTypeWithThrottleRetry as vr, beginCommandInterruptScope as vt, reachableDivergentParameters as w, globMatches as wa, validateContainerRepoName as wi, hasReadableOrphans as wn, __exportAll as wo, STATE_SOURCED_READBACK_RULES as wr, slowCcOperationTimeoutMs as wt, bindingSkippedOutputs as x, ambientClientDefaults as xa, parseBootstrapMarker as xi, UNREADABLE_RESOURCES_MAP_ROW as xn, retryClassificationText as xo, TemplateParser as xr, isInterruptedWaitError as xt, keptWholeReasonText as y, canonicalizeRegion as ya, getBootstrapMarkerKey as yi, STATE_RESOURCES_MALFORMED as yn, markNonRetryable as yo, withRetry as yr, endCommandInterruptScope as yt, isStatefulRecreateTargetForReplace as z, resetAwsClients as za, runDockerForeground as zi, malformedRenderedContainersWarning as zn, recoverMaskedOutput as zr, isNamelessDynamicReferenceError as zt };
+//# sourceMappingURL=deploy-engine-OgrMdBRR.js.map